Change-Id: I8e661067d83c3a292f2ec43cd7fd129d8e3f01a7
(cherry picked from commit bee6275cf9)

Looks like this didn't exist prior to 1.1.1

Fix-up for 8fba68f2c9

Change-Id: I1568ce6c583114659cc2e9997269f45043bd220a
(cherry picked from commit d6b09b53ea)

Check the correct field against "*"

Change-Id: I12e3b91f974d3acd9798c93f10491ef6dae43c1a
(cherry picked from commit 5fb74f1e43)

... instead of "current" if available

closes #1771

Change-Id: Id1b742b2446d4d59b3de251a1d1a5dcbed86834a
(cherry picked from commit 8fba68f2c9)

Check addresses of received DTLS packets against known ICE pairs if ICE
is in use. Ignore packets that don't correspond to known ICE pairs.

Credit to the the team at EnableSecurity.com for disclosure.

Ref: https://github.com/EnableSecurity/advisories/tree/master/ES2023-03-rtpengine-dtls-hello-race
Change-Id: I45197c50aedeb078763f2f444225ddbda78d9349
(cherry picked from commit e969a79428)

closes #1772

Change-Id: Iaf80e7314730537ca56112cd5f9e1f9c85ca6e3c
(cherry picked from commit afd85a4f94)

Grab the correct list link when inserting in the middle of the list.

Change-Id: I4ae484ba05f5e4be827101193952653c21c47ad3
(cherry picked from commit 3f5a22d2a5)

This is required to look up the correct interface during Redis restore.

Change-Id: I0ea67576deba95b4201c6384fdcf8051b84f879e
(cherry picked from commit 531e720fd4)

If the kernel module is loaded automatically/implicitly through
insertion of an iptables rule, it gets loaded with only the default
module parameters. Add a modprobe.d fragment to handle this case.

Change-Id: I08659e2f0db8fed401cbcce6edee51e942da1f3e
(cherry picked from commit 85b8a765d1)

If we're updating the handlers for one particular source -> sink flow,
only stop/reset the handlers matching this flow.

Change-Id: I1d046f47f8d26cac47c5d0f4318498eacb6c5677
(cherry picked from commit e24bacaa4c)

Capabilities listed in the ambient set must also be included in the
bounding set.

Change-Id: I172bd30c9fbe488574e9cc015ba552e805c95fe6
(cherry picked from commit 7200c7af64)

Use `->subscribers.head` instead of `->subscriptions.head`
for the second logging.

Change-Id: Iaaff61aebbe8bcd421a0159f5490903c0ea9c4ea
(cherry picked from commit d9f12ce27b)

for #1690

Follow up to 37d7762f

Change-Id: Id58204db5a733b3d821cbef855fac72451484b41
(cherry picked from commit 3e81cfa351)

The resampler unit test also needs to take ffmpeg API changes into
account

Change-Id: I94e92188cc8f745eb42108bc2d6d21a02b3dfefa
(cherry picked from commit e8d3bf5dd5)

g_string_free(..., FALSE) is declared as warn_unused_result

closes #1690

Change-Id: Ib0a7fb4eab4359226fba519cfd485fb3228a0bc7
(cherry picked from commit 37d7762fec)

G.722 uses 4 bits per sample, not 8. This error was negated by the ptime
incorrectly being adjusted by the clock rate multiplier.

Change-Id: I125c897ee9cbdac29278be9b6451d82b48ff94c2
(cherry picked from commit e7b9ab2825)

Creating the codec handler can possibly fail. Catch that case.

Closes #1693

Change-Id: Iebd8d1c6aa3542cd9e1351756148c48ebada38ec
(cherry picked from commit 94ba3e0fa8)

... stream after a reconnect

if we're in the middle of a disconnect then ssrc_tls_state may have destroyed
the streambuf so we need to skip the rest of the function, otherwise the now
null pointer is passed into streambuf_write, which will return immediately and
the metadata will have been marked as sent when it hasn't been

closes #1694

Change-Id: I679fdd0ff9245e4413bc5a5ab40a70ea4f9ef7c0
(cherry picked from commit 88c0ffd49b)
(cherry picked from commit a06c0156ae)

Change-Id: If72f91c4433a7363638482520cb2d942681353ee
(cherry picked from commit 6bb87132ac)

closes #1311
closes #1649

Change-Id: Ibb07715377e813959401d5782d0d07b158417537
(cherry picked from commit 2f4f6d5273)

Avoid trying to acquire a recursive lock by making sure the response is
always generated in a different thread.

Fixes #1656

Change-Id: I6c4c5bb52cb95a204823848bb427ab24f42dcccd
(cherry picked from commit 04ce204ef6)

The `encoder` is actually persistent and only freed when the output is
freed, so testing for its existence is not enough to determine whether
the output is open. The `fmtctx` can be used for that.

Change-Id: I2cc3f00a0e983fafd5915736089a0421385b6ce3
(cherry picked from commit 833c30d69e)

We're supposed to use the remote password for sending STUN error
responses (same as for sending STUN success responses), not the local
one.

Fixes a bug from 2015.

Closes #1626

Change-Id: I975178405dcd41661bdc5e0c1208295f9db70006
(cherry picked from commit 394ed2fc62)

While LWS explicitly allows usage of lws_callback_on_writable() from
other threads, for some reason there is no internal locking in place,
and so a concurrently running lws_service() can interfere with internal
structures, in particular if lws_service() is closing connections at the
same time as lws_callback_on_writable() is invoked.

The suggested approach of using lws_cancel_service() in combination with
the LWS_CALLBACK_EVENT_WAIT_CANCELLED callback and a user-kept queue is
not feasible, as we need to support LWS 2.x, which doesn't have
LWS_CALLBACK_EVENT_WAIT_CANCELLED.

Closes #1624

Change-Id: Ia3ddeda66fd553c87f99404e0816d97ecbd4cdfe
(cherry picked from commit 1457b34f65)

These functions now cannot fail and so returning a value is pointless.

Change-Id: I062449f30f05fb3efa4ba520004a13de3a0abd5a
(cherry picked from commit 26cc168f83)

Avoid calling lws_write() from threads other than the service thread, as
this might not be thread-safe. Instead store the values used for the
HTTP response headers in the websocket_output, then trigger a "writable"
callback, and finally do all the lws_write() calls from the service
thread.

Reported in #1624

Change-Id: Ifcb050193044e5543f750a12fb44f5e16d4c0a08
(cherry picked from commit b207d0c586)

... instead of explicit lock/unlock pairs to save some code lines.

Change-Id: Iece32fb201cd3b662038e91d98443e1dcfd04a63
(cherry picked from commit f293ca9a18)

Removes one level of indentation for prettier code. Functional no-op.

Change-Id: I5f5528944f144499540f34bc1f322d00c9454fa6
(cherry picked from commit cb9ec2abf9)

Don't change to a new port for sendonly streams as this causes problems
with NAT. A device receiving a sendonly SDP with a new port won't send
any RTP to the new port, leading to a closed (non existent) NAT mapping.

Change-Id: I2ea2163eb9f1203226bd781b53f421c790a86f0a
(cherry picked from commit 6d7603e064)

The old port latching logic was simply to use the last (newest)
allocated endpoint_map. This turned out to be wrong, because the last
used socket on the monologue could have been one that was allocated
earlier (and older endpoint_map), as it can happen during repeated
re-invites. Add a new function to actually look for the correct
endpoint_map, matching the currently used socket, to make sure the port
doesn't change.

Change-Id: Iae768fe48539264575aed67cbbb6b08ac745130f
(cherry picked from commit 3778d0f359)

Code refactor only, functional no-op

Change-Id: Ifb8354c6b7e2771de861d8d666a410eaf4d2755a
(cherry picked from commit 37d7664173)

These are the entries the kernel will try to look for when userspace
tries to use the RTPENGINE support, but the module is called
xt_RTPENGINE so the kernel does not find it and thus cannot autoload
it.

The problem is that we have startup code that sets up iptables rules,
and will fail if the module has not yet been loaded. By adding these
aliases we are no longer concerned about the ordering, and can let the
kernel autoload the modules when they are needed.

Change-Id: I43a54af4e32adf755538c57df711da048c720030
(cherry picked from commit 2a6b2459f2)

This reverts commit b28794f853.

Change-Id: I1c61b939096fc935e47f83642653c3ac341cf553

lsb-base as of version 11.5 and as present in Debian/testing AKA
bookworm is a transitional package (depending on sysvinit-utils).
As of lintian >=2.116.0 a dependency on lsb-base is considered an error:

| E: ngcp-rtpengine-daemon: depends-on-obsolete-package Depends: lsb-base (>= 3.0-6)
| E: ngcp-rtpengine-recording-daemon: depends-on-obsolete-package Depends: lsb-base (>= 3.0-6)

Now having lintian 2.116.1 in Debian/testing AKA bookworm our package
builds fail because of this.

Since we still have init script support and references to
/lib/lsb/init-functions, let's depend on either sysvinit-utils
or lsb-base.

See related discussion on debian-devel mailing list:
https://lists.debian.org/debian-devel/2023/01/msg00149.html

Change-Id: Id3228425405e39904e52de8fdf00911539ac63bb
(cherry picked from commit e774bcb30f)

The SRTP decryption context is associated with the local socket. Use the
socket that a packet was actually received on for the decryption context
instead of using the one that it was expected to be received on.

Change-Id: Iddf400a440fc51b4afb370ec827f75e9626b2cfd

When a receiving socket doesn't match the socket we were expecting, make
sure that the receiving socket is actually one of the sockets we want to
use at this point before blindly switching the socket.

This fixes a race condition after a re-invite: A new set of sockets has
been opened, but an old/delayed RTP packet still arrives on one of the
old ports. In this case we don't want to switch the local socket.

Change-Id: I4e2b87ad608b1a9c6a0bb2eae5c305fd79be70d5

The extension handling changed [0,1]. Fix compilation with iptables
1.8.8 [2].

[0] - https://git.netfilter.org/iptables/commit/?id=ef108943f69a6e20533d58823740d3f0534ea8ec
[1] - https://git.netfilter.org/iptables/commit/?id=6c689b639cf8e2aeced8685eca2915892d76ad86
[2] - openwrt/openwrt#9886

Signed-off-by: Nick Hainke <vincent@systemli.org>
(cherry picked from commit 2a6d5cd2cb)

Change-Id: Ifbfca3abacd6acba6d370820e36871c876b70d21

As Redis updates must be triggered with the call unlocked, use a
convenience wrapper function to unlock, update, unref.

fixes #1602

Change-Id: I67095f31fb605b6977c88d9e9b3db581dd71a0d9

The data in Redis must be updated after a successful publish/subscribe.

closes #1602

Change-Id: If39cbf04cf1c20e04b390b0b865c473a9acdb2ab
(cherry picked from commit cf6aa99dae)

Zero is a valid version for new sessions (mentioned in RFC 2327) and still used by some SIP implementations.

(cherry picked from commit 78f9811fda)

Many of the SIP stacks use 32-bit integers internally and the Asterisk chan_sip SDP decoder will cap version to 9223372036854775807.

(cherry picked from commit 2351d7f6ac3b6e016d2be0cf5fa4a9aa5f267e1b)

If the expected buffer to hold a packet was determined incorrectly, log
a warning instead of throwing an assertion.

closes #1591

Change-Id: I4169378a27b27fed51e453e6d2da8014259c659e
(cherry picked from commit 4009d58f3c)

Prevent a wrongly advertised (too small) a=ptime from producing too
small buffers to hold encoded packets by flagging codecs with a fixed or
minimum frame size as such.

This is relevant to libavcodec only as the code determines the expected
frame size from the clock rate and the ptime.

closes #1591

Change-Id: I9f5c56d45f2aad56951b19d846ddbfa4b7bd7e7d
(cherry picked from commit 38b0351d03)

Support fake bind() on non-INET sockets. This fixes the tests when
building against libwebsockets19 4.3.2-1.

Change-Id: I91e5271e8b0cd5a0fa10317bae059615b234926c
(cherry picked from commit 2f4ed358c0)