fix: use sips scheme in From/Contact when forwarding to a sips Request-URI

RFC 3261 8.1.1.8 requires a SIPS Contact when the Request-URI is SIPS. The forward path (dial verb to a sip target) always defaulted to sip:. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
0.9.11
2026-10-04 10:14:29 +00:00 · 2026-10-01 23:58:47 -04:00 · 2026-09-15 12:39:32 -04:00 · 2026-09-15 12:39:12 -04:00 · 2026-09-07 18:42:47 +01:00 · 2026-08-20 09:16:55 -04:00
6 changed files with 76 additions and 17 deletions
@@ -29,9 +29,19 @@ Configuration is provided via environment variables:
 |JAMBONES_RTPENGINES| commans-separated list of ip:ng-port for rtpengines (e.g. '172.31.32.10:22222')|yes|
 |JAMBONES_TIME_SERIES_HOST| influxdb host |yes|
 |JAMBONES_RECORD_ALL_CALLS| enable auto record calls |no|
+|JAMBONES_CODEC_OFFER_WITH_ORDER| comma-separated codec list to use as the outbound offer toward the carrier; the original codecs from the feature server are stripped first (e.g. `'opus,PCMU,PCMA,telephone-event'`) |no|
+|JAMBONES_CODEC_TRANSCODE| comma-separated codec list that rtpengine should add to the outbound offer and transcode on the fly when the carrier selects them — used to support codecs the feature server does not speak (e.g. `'AMR-WB/16000'`). Requires an rtpengine build that includes the corresponding codec module. |no|
+|JAMBONES_ACCEPT_AND_TRANSCODE| comma-separated codec list to accept on the outbound leg and transcode to PCMU/PCMA toward the feature server |no|
+|JAMBONES_ACCEPT_G729| if set, accept G.729 on the outbound leg and transcode to PCMU/PCMA (shorthand for `JAMBONES_ACCEPT_AND_TRANSCODE=g729`) |no|
 |K8S| service running as kubernetes service |no|
 |K8S_RTPENGINE_SERVICE_NAME| rtpengine service name(required for K8S) |no|

+#### Codec transcoding notes
+
+`JAMBONES_CODEC_OFFER_WITH_ORDER` and `JAMBONES_CODEC_TRANSCODE` can be combined. When both are set, rtpengine first strips the original codecs from the SDP, then adds the codecs listed in `JAMBONES_CODEC_OFFER_WITH_ORDER` to the offer, and finally adds the codecs from `JAMBONES_CODEC_TRANSCODE` with transcoding enabled. When only `JAMBONES_CODEC_TRANSCODE` is set, the original codecs from the feature server are kept in the offer and the transcode codecs are appended.
+
+Codecs that require licensed or optional rtpengine modules (AMR, AMR-WB, G.729, etc.) only work if rtpengine was compiled with support for them. Carrier-specific fmtp parameters (for example, `octet-align=1` for AMR-WB) can be appended to the codec name as needed (e.g. `AMR-WB/16000;octet-align=1`).
+
 ### running under pm2
 Typically, this application runs under [pm2](https://pm2.io) using an [ecosystem.config.js](https://pm2.keymetrics.io/docs/usage/application-declaration/) file similar to this:
 ```js
@@ -4,7 +4,7 @@
    "ICE": "force",
    "SDES": "off",
    "flags": ["generate mid", "SDES-no", "port latching"],
-    "rtcp-mux": ["require"]  
+    "rtcp-mux": ["offer"]
  },
  "teams": {
    "transport-protocol": "RTP/SAVP",
@@ -237,6 +237,24 @@ class CallSession extends Emitter {
        this.logger.info(`sending call to registered user ${destUri}`);
      }
      else if (this.req.locals.target === 'forward') {
+        /* the feature-server sets X-Jambonz-SRTP (from the dial verb's srtpEncryption
+           option) to request encrypted media on a per-call basis */
+        const srtpMode = this.req.get('X-Jambonz-SRTP');
+        if (srtpMode) {
+          /* SDES (RTP/SAVP): pass teams=true to select the SDES srtp profile, matching
+             the proven carrier tls/srtp path above. This offers a=crypto to the target
+             (what SIP endpoints such as LiveKit expect), not DTLS-SRTP. */
+          this.logger.info({uri: this.req.uri, srtpMode},
+            'using SRTP (SDES) for forwarded call per X-Jambonz-SRTP');
+          this.rtpEngineOpts = makeRtpEngineOpts(this.req, false, true, false, true);
+          encryptedMedia = true;
+        }
+        else if (process.env.JAMBONES_SIPS_FORWARD_SRTP && this.req.uri.startsWith('sips:')) {
+          /* legacy global opt-in for sips: forwards (uses the DTLS srtp profile) */
+          this.logger.info({uri: this.req.uri}, 'using SRTP/TLS for forwarded sips: call');
+          this.rtpEngineOpts = makeRtpEngineOpts(this.req, false, true, false, false);
+          encryptedMedia = true;
+        }
        uris = [{
          private_network: await isPrivateVoipNetwork(this.req.uri),
          uri: this.req.uri
@@ -487,17 +505,21 @@ class CallSession extends Emitter {
        }
        else {
          const uri = parseUri(this.req.uri);
+          /* RFC 3261 8.1.1.8: a sips Request-URI requires a sips Contact */
+          const scheme = uri.scheme === 'sips' ? 'sips' : 'sip';
          hdrs = {
            ...hdrs,
            'From': createBLegFromHeader({
              logger: this.logger,
              req: this.req,
+              scheme,
              transport: uri.params.transport,
              ...(private_network && {host: this.privateSipAddress})
            }),
            'Contact': createBLegFromHeader({
              logger: this.logger,
              req: this.req,
+              scheme,
              transport: uri.params.transport,
              ...(private_network && {host: this.privateSipAddress})
            })
@@ -526,6 +548,7 @@ class CallSession extends Emitter {
              '-X-Preferred-From-Host',
              '-X-Jambonz-FS-UUID',
              '-X-Voip-Carrier-Sid',
+              '-X-Jambonz-SRTP',
              '-X-SIP-Proxy'
            ],
            proxyResponseHeaders: [
@@ -660,7 +683,21 @@ class CallSession extends Emitter {
        }
      }
    } catch (err) {
-      if ('abandonded' !== err.message) this.logger.error({err}, `Error setting up outbound call to: ${uris}`);
+      if ('abandoned' !== err.message) this.logger.error({err}, `Error setting up outbound call to: ${uris}`);
+
+      /* the call count was incremented on 'init' but we bailed out before connecting (e.g. caller
+         hung up before the B leg answered), so we must decrement it here - no failure response is
+         sent on this path, so the res.once('end') safety net in middleware would not fire.
+         nudgeCallCounts is a no-op if the count was already decremented elsewhere. */
+      const {writeCallCount, writeCallCountSP, writeCallCountApp} = this.req.srf.locals;
+      nudgeCallCounts(this.req, 'failure', {
+        service_provider_sid: this.service_provider_sid,
+        account_sid: this.account_sid,
+        application_sid: this.application_sid,
+        callId: this.req.locals.callId
+      }, this.decrKey, {writeCallCountSP, writeCallCount, writeCallCountApp})
+        .catch((err) => this.logger.error(err, 'Error decrementing call counts'));
+
      this.emit('failed');
      this.srf.endSession(this.req);
      this.rtpEngineResource.destroy();
@@ -887,8 +924,14 @@ Duration=${payload.duration} `
        process.env.JAMBONES_ACCEPT_G729 ? 'g729' : '';
      offerMedia = { ...offerMedia, ...(acceptCodecs && dlg.type === 'uac' &&
        { codec: { mask: acceptCodecs, transcode: 'pcmu,pcma' } })};
-      answerMedia = { ...answerMedia, ...(process.env.JAMBONES_CODEC_OFFER_WITH_ORDER && dlg.type === 'uac' &&
-        { codec: {offer: process.env.JAMBONES_CODEC_OFFER_WITH_ORDER.split(','), strip: 'all' }})};
+      answerMedia = { ...answerMedia, ...((process.env.JAMBONES_CODEC_OFFER_WITH_ORDER ||
+        process.env.JAMBONES_CODEC_TRANSCODE) && dlg.type === 'uac' &&
+        { codec: {
+          ...(process.env.JAMBONES_CODEC_OFFER_WITH_ORDER &&
+            { offer: process.env.JAMBONES_CODEC_OFFER_WITH_ORDER.split(','), strip: 'all' }),
+          ...(process.env.JAMBONES_CODEC_TRANSCODE &&
+            { transcode: process.env.JAMBONES_CODEC_TRANSCODE.split(',') })
+        }})};
      let opts = {
        ...this.rtpEngineOpts.common,
        ...offerMedia,
@@ -1227,6 +1270,7 @@ Duration=${payload.duration} `
        this.activeCallIds.delete(this.req.get('Call-ID'));
        if (this.activeCallIds.size === 0) this.idleEmitter.emit('idle');
        uac.other.destroy();
+        this._stopRecording();
        if (this.req.locals.cdr) {
          const now = Date.now();
          const day = new Date();
@@ -58,6 +58,10 @@ function makeRtpEngineOpts(req, srcIsUsingSrtp, dstIsUsingSrtp, padCrypto, teams
        offer: process.env.JAMBONES_CODEC_OFFER_WITH_ORDER.split(','),
        strip: 'all'
      }),
+    ...(process.env.JAMBONES_CODEC_TRANSCODE &&
+      {
+        transcode: process.env.JAMBONES_CODEC_TRANSCODE.split(',')
+      }),
  };

  return {
@@ -1,19 +1,19 @@
 {
  "name": "sbc-outbound",
-  "version": "0.9.6",
+  "version": "0.9.11",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sbc-outbound",
-      "version": "0.9.6",
+      "version": "0.9.11",
      "license": "MIT",
      "dependencies": {
        "@babel/helpers": "^7.26.10",
        "@jambonz/db-helpers": "^0.9.18",
        "@jambonz/http-health-check": "^0.0.1",
        "@jambonz/mw-registrar": "0.2.7",
-        "@jambonz/realtimedb-helpers": "^0.8.13",
+        "@jambonz/realtimedb-helpers": "^0.8.21",
        "@jambonz/rtpengine-utils": "^0.4.4",
        "@jambonz/siprec-client-utils": "^0.2.10",
        "@jambonz/stats-collector": "^0.1.10",
@@ -21,7 +21,7 @@
        "cidr-matcher": "^2.1.1",
        "debug": "^4.4.3",
        "drachtio-fn-b2b-sugar": "^0.2.1",
-        "drachtio-srf": "^5.0.20",
+        "drachtio-srf": "^5.0.21",
        "express": "^4.21.2",
        "pino": "^10.1.0",
        "sdp-transform": "^2.15.0"
@@ -594,9 +594,10 @@
      }
    },
    "node_modules/@jambonz/realtimedb-helpers": {
-      "version": "0.8.13",
-      "resolved": "https://registry.npmjs.org/@jambonz/realtimedb-helpers/-/realtimedb-helpers-0.8.13.tgz",
-      "integrity": "sha512-/7c8kCu/dMSk8CWTYdEv4xU/7+vmVL30VCjtHPRAXVBRIVejAPDf1xK5n0rXwG8Fda1Oa+0TFsymkiRpew8P6w==",
+      "version": "0.8.21",
+      "resolved": "https://registry.npmjs.org/@jambonz/realtimedb-helpers/-/realtimedb-helpers-0.8.21.tgz",
+      "integrity": "sha512-Zn/Zw14U0L1pB2RlN5i160FwWqphonhQ7p880OzsKOuvg+wmj6qIkxdLjDXo6TSxFPXDHD25s33zfGOT6ZIfsw==",
+      "license": "MIT",
      "dependencies": {
        "debug": "^4.3.4",
        "ioredis": "^5.3.2"
@@ -1597,9 +1598,9 @@
      "integrity": "sha512-bMtje8GWVTze+UG6WSGnlUfBaYCuFiApNXl/XxWc+X9uATZiZkV2jIqhf+Y4SY3nS8dZclJIVKd9qwoCa+i+Vw=="
    },
    "node_modules/drachtio-srf": {
-      "version": "5.0.20",
-      "resolved": "https://registry.npmjs.org/drachtio-srf/-/drachtio-srf-5.0.20.tgz",
-      "integrity": "sha512-gqWTfqFZhC93TVBaFtRseemmfHPASotMfHhCy/3wQUHZShUl+Zr7Vbq+pLD1kyTNr4/pzpMwEMLd0/6oq/fCtg==",
+      "version": "5.0.21",
+      "resolved": "https://registry.npmjs.org/drachtio-srf/-/drachtio-srf-5.0.21.tgz",
+      "integrity": "sha512-9hkQ7LURI1ceTMs49Nh2aosAd2v0565eD8Ccho5sSzXEHuq0DE3epjStlThq6LvIGVVAOXuSQGXFmlMWK92R3w==",
      "license": "MIT",
      "dependencies": {
        "debug": "^4.4.3",
@@ -1,6 +1,6 @@
 {
  "name": "sbc-outbound",
-  "version": "0.9.6",
+  "version": "0.9.11",
  "main": "app.js",
  "engines": {
    "node": ">= 20.0.0"
@@ -31,7 +31,7 @@
    "@jambonz/db-helpers": "^0.9.18",
    "@jambonz/http-health-check": "^0.0.1",
    "@jambonz/mw-registrar": "0.2.7",
-    "@jambonz/realtimedb-helpers": "^0.8.13",
+    "@jambonz/realtimedb-helpers": "^0.8.21",
    "@jambonz/rtpengine-utils": "^0.4.4",
    "@jambonz/siprec-client-utils": "^0.2.10",
    "@jambonz/stats-collector": "^0.1.10",
@@ -39,7 +39,7 @@
    "cidr-matcher": "^2.1.1",
    "debug": "^4.4.3",
    "drachtio-fn-b2b-sugar": "^0.2.1",
-    "drachtio-srf": "^5.0.20",
+    "drachtio-srf": "^5.0.21",
    "express": "^4.21.2",
    "pino": "^10.1.0",
    "sdp-transform": "^2.15.0"
Author	SHA1	Message	Date
Dave HortonandClaude Opus 5.5	37686f680c	fix: use sips scheme in From/Contact when forwarding to a sips Request-URI RFC 3261 8.1.1.8 requires a SIPS Contact when the Request-URI is SIPS. The forward path (dial verb to a sip target) always defaulted to sip:. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-01 23:58:47 -04:00
Dave Horton	7099671e69	0.9.11	2026-09-15 12:39:32 -04:00
Dave Horton	11764e40b0	0.9.10	2026-09-15 12:39:12 -04:00
Hoan Luu HuuandClaude Opus 5	b9e9fe305a	Fix/siprec survives fs transfer (#232 ) * fix: keep siprec recording alive across a feature server transfer A cross-feature-server move (enqueue/dequeue or conference) re-negotiates the feature-server leg in _onFeatureServerTransfer, but nothing rebuilt the rtpengine subscription the SIPREC recording forks from, so the recorder went silent from the moment the call moved. The fresh destroy handler installed on the new leg also dropped the _stopRecording() call the original handlers have, so the SIPREC dialog was never BYEd and the recorder had to wait out its media timeout. Rebuild the subscription after the transfer re-negotiates media, and stop the recording when the transferred leg ends. The resubscribe call is guarded so this is safe to deploy before @jambonz/siprec-client-utils is bumped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: drop the siprec re-subscribe, keep the missing teardown The cross-feature-server move was tested on a real two-feature-server cluster (inbound path): the rtpengine subscription survives the REFER on its own, so resubscribe() was fixing a fault that does not exist. rtpengine keeps non-offer-answer subscriptions across an answer. What does fail, and what this branch still fixes, is the teardown: the destroy handler installed on the transferred leg never stopped the recording, so the recorder was left without a BYE. Verified on the inbound path; the outbound transfer path has the identical handler and the same omission. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-07 18:42:47 +01:00
Dave Horton	fec25d5d15	0.9.9	2026-08-20 09:16:55 -04:00
Dave Horton	5c470b9630	0.9.8	2026-07-20 08:43:34 -04:00
Hoan Luu HuuandClaude Opus 4.8	606792825e	feat: honor X-Jambonz-SRTP header for forwarded sip URI calls (#230 ) The feature-server sets X-Jambonz-SRTP (from the dial verb's srtpEncryption option) to request encrypted media on a per-call basis. Previously SRTP on a forwarded sip URI could only be enabled globally via JAMBONES_SIPS_FORWARD_SRTP + a sips: scheme; now an application can opt in per call. The env var remains as a global fallback. The internal header is stripped before the INVITE is sent to the target. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-20 07:24:14 -04:00
Dave Horton	ffec713d62	bump version	2026-07-09 07:31:05 -04:00
Hoan Luu Huu	6921c1cf31	update rtcp-mux to default for srtp (#229 )	2026-07-09 07:10:13 -04:00
Sam Machin	37e4dea705	decrement count on abandoned call (#228 ) fix typo so correct error message is logged	2026-07-03 11:11:46 -04:00
Hoan Luu Huu	4fb5acaf40	update realtimedb-helper (#227 )	2026-06-15 20:43:07 -04:00
Sam MachinandDave Horton	865068f158	add new CODEC_TRANSCODE option (#225 ) * add new CODEC_TRANSCODE option allows RTP engine to add additional codecs to the outgoing offer that wern't in the invite from Freeswitch so RTP engine will transcode outbound calls. * update README for new env var descriptions --------- Co-authored-by: Dave Horton <daveh@beachdognet.com>	2026-05-01 08:43:13 -04:00
Hoan Luu Huu	4f65b4b585	support srtp for sips sipuri outbound call (#224 ) * support srtp for sips sipuri outbound call * wip * wip * add env variable for disable the srtp for sipURI	2026-04-22 08:00:50 -04:00
Hoan Luu Huu	8ccd02aa1f	update drachtio srf 5.0.21 (#221 )	2026-04-13 21:24:42 -04:00