pjsip_distributor.c

Go to the documentation of this file.

/*
 * Asterisk -- An open source telephony toolkit.
 *
 * Copyright (C) 2013, Digium, Inc.
 *
 * Mark Michelson <[email protected]>
 *
 * See http://www.asterisk.org for more information about
 * the Asterisk project. Please do not directly contact
 * any of the maintainers of this project for assistance;
 * the project provides a web site, mailing lists and IRC
 * channels for your use.
 *
 * This program is free software, distributed under the terms of
 * the GNU General Public License Version 2. See the LICENSE file
 * at the top of the source tree.
 */

#include "asterisk.h"

#include <pjsip.h>

#include "asterisk/res_pjsip.h"
#include "asterisk/acl.h"
#include "include/res_pjsip_private.h"
#include "asterisk/taskprocessor.h"
#include "asterisk/threadpool.h"
#include "asterisk/res_pjsip_cli.h"

static int distribute(void *data);
static pj_bool_t distributor(pjsip_rx_data *rdata);
static pj_status_t record_serializer(pjsip_tx_data *tdata);

static pjsip_module distributor_mod = {
   .name = {"Request Distributor", 19},
   .priority = PJSIP_MOD_PRIORITY_TSX_LAYER - 6,
   .on_tx_request = record_serializer,
   .on_rx_request = distributor,
   .on_rx_response = distributor,
};

struct ast_sched_context *prune_context;

/* From the auth/realm realtime column size */
#define MAX_REALM_LENGTH 40

#define DEFAULT_SUSPECTS_BUCKETS 53

static struct ao2_container *unidentified_requests;
static unsigned int unidentified_count;
static unsigned int unidentified_period;
static unsigned int unidentified_prune_interval;
static int using_auth_username;
static enum ast_sip_taskprocessor_overload_trigger overload_trigger;

struct unidentified_request{
   struct timeval first_seen;
   int count;
   char src_name[];
};

/*! Number of serializers in pool if one not otherwise known.  (Best if prime number) */
#define DISTRIBUTOR_POOL_SIZE    31

/*! Pool of serializers to use if not supplied. */
static struct ast_taskprocessor *distributor_pool[DISTRIBUTOR_POOL_SIZE];

/*!
 * \internal
 * \brief Record the task's serializer name on the tdata structure.
 * \since 14.0.0
 *
 * \param tdata The outgoing message.
 *
 * \retval PJ_SUCCESS.
 */
static pj_status_t record_serializer(pjsip_tx_data *tdata)
{
   struct ast_taskprocessor *serializer;

   serializer = ast_threadpool_serializer_get_current();
   if (serializer) {
      const char *name;

      name = ast_taskprocessor_name(serializer);
      if (!ast_strlen_zero(name)
         && (!tdata->mod_data[distributor_mod.id]
            || strcmp(tdata->mod_data[distributor_mod.id], name))) {
         char *tdata_name;

         /* The serializer in use changed. */
         tdata_name = pj_pool_alloc(tdata->pool, strlen(name) + 1);
         strcpy(tdata_name, name);/* Safe */

         tdata->mod_data[distributor_mod.id] = tdata_name;
      }
   }

   return PJ_SUCCESS;
}

/*!
 * \internal
 * \brief Find the request tdata to get the serializer it used.
 * \since 14.0.0
 *
 * \param rdata The incoming message.
 *
 * \retval serializer on success.
 * \retval NULL on error or could not find the serializer.
 */
static struct ast_taskprocessor *find_request_serializer(pjsip_rx_data *rdata)
{
   struct ast_taskprocessor *serializer = NULL;
   pj_str_t tsx_key;
   pjsip_transaction *tsx;

   pjsip_tsx_create_key(rdata->tp_info.pool, &tsx_key, PJSIP_ROLE_UAC,
      &rdata->msg_info.cseq->method, rdata);

   tsx = pjsip_tsx_layer_find_tsx(&tsx_key, PJ_TRUE);
   if (!tsx) {
      ast_debug(1, "Could not find transaction for %s.\n",
         pjsip_rx_data_get_info(rdata));
      return NULL;
   }
   ast_debug(3, "Found transaction %s for %s.\n",
      tsx->obj_name, pjsip_rx_data_get_info(rdata));

   if (tsx->last_tx) {
      const char *serializer_name;

      serializer_name = tsx->last_tx->mod_data[distributor_mod.id];
      if (!ast_strlen_zero(serializer_name)) {
         serializer = ast_taskprocessor_get(serializer_name, TPS_REF_IF_EXISTS);
         if (serializer) {
            ast_debug(3, "Found serializer %s on transaction %s\n",
                  serializer_name, tsx->obj_name);
         }
      }
   }

#ifdef HAVE_PJ_TRANSACTION_GRP_LOCK
   pj_grp_lock_release(tsx->grp_lock);
#else
   pj_mutex_unlock(tsx->mutex);
#endif

   return serializer;
}

/*! Dialog-specific information the distributor uses */
struct distributor_dialog_data {
   /*! dialog_associations ao2 container key */
   pjsip_dialog *dlg;
   /*! Serializer to distribute tasks to for this dialog */
   struct ast_taskprocessor *serializer;
   /*! Endpoint associated with this dialog */
   struct ast_sip_endpoint *endpoint;
};

#define DIALOG_ASSOCIATIONS_BUCKETS 251

static struct ao2_container *dialog_associations;

/*!
 * \internal
 * \brief Compute a hash value on an arbitrary buffer.
 * \since 13.17.0
 *
 * \param[in] pos The buffer to add to the hash
 * \param[in] len The buffer length to add to the hash
 * \param[in] hash The hash value to add to
 *
 * \details
 * This version of the function is for when you need to compute a
 * hash of more than one buffer.
 *
 * This famous hash algorithm was written by Dan Bernstein and is
 * commonly used.
 *
 * \sa http://www.cse.yorku.ca/~oz/hash.html
 */
static int buf_hash_add(const char *pos, size_t len, int hash)
{
   while (len--) {
      hash = hash * 33 ^ *pos++;
   }

   return hash;
}

/*!
 * \internal
 * \brief Compute a hash value on an arbitrary buffer.
 * \since 13.17.0
 *
 * \param[in] pos The buffer to add to the hash
 * \param[in] len The buffer length to add to the hash
 *
 * \details
 * This version of the function is for when you need to compute a
 * hash of more than one buffer.
 *
 * This famous hash algorithm was written by Dan Bernstein and is
 * commonly used.
 *
 * \sa http://www.cse.yorku.ca/~oz/hash.html
 */
static int buf_hash(const char *pos, size_t len)
{
   return buf_hash_add(pos, len, 5381);
}

static int dialog_associations_hash(const void *obj, int flags)
{
   const struct distributor_dialog_data *object;
   union {
      const pjsip_dialog *dlg;
      const char buf[sizeof(pjsip_dialog *)];
   } key;

   switch (flags & OBJ_SEARCH_MASK) {
   case OBJ_SEARCH_KEY:
      key.dlg = obj;
      break;
   case OBJ_SEARCH_OBJECT:
      object = obj;
      key.dlg = object->dlg;
      break;
   default:
      /* Hash can only work on something with a full key. */
      ast_assert(0);
      return 0;
   }
   return ast_str_hash_restrict(buf_hash(key.buf, sizeof(key.buf)));
}

static int dialog_associations_cmp(void *obj, void *arg, int flags)
{
   const struct distributor_dialog_data *object_left = obj;
   const struct distributor_dialog_data *object_right = arg;
   const pjsip_dialog *right_key = arg;
   int cmp = 0;

   switch (flags & OBJ_SEARCH_MASK) {
   case OBJ_SEARCH_OBJECT:
      right_key = object_right->dlg;
      /* Fall through */
   case OBJ_SEARCH_KEY:
      if (object_left->dlg == right_key) {
         cmp = CMP_MATCH;
      }
      break;
   case OBJ_SEARCH_PARTIAL_KEY:
      /* There is no such thing for this container. */
      ast_assert(0);
      break;
   default:
      cmp = 0;
      break;
   }
   return cmp;
}

void ast_sip_dialog_set_serializer(pjsip_dialog *dlg, struct ast_taskprocessor *serializer)
{
   struct distributor_dialog_data *dist;

   ao2_wrlock(dialog_associations);
   dist = ao2_find(dialog_associations, dlg, OBJ_SEARCH_KEY | OBJ_NOLOCK);
   if (!dist) {
      if (serializer) {
         dist = ao2_alloc(sizeof(*dist), NULL);
         if (dist) {
            dist->dlg = dlg;
            dist->serializer = serializer;
            ao2_link_flags(dialog_associations, dist, OBJ_NOLOCK);
            ao2_ref(dist, -1);
         }
      }
   } else {
      ao2_lock(dist);
      dist->serializer = serializer;
      if (!dist->serializer && !dist->endpoint) {
         ao2_unlink_flags(dialog_associations, dist, OBJ_NOLOCK);
      }
      ao2_unlock(dist);
      ao2_ref(dist, -1);
   }
   ao2_unlock(dialog_associations);
}

void ast_sip_dialog_set_endpoint(pjsip_dialog *dlg, struct ast_sip_endpoint *endpoint)
{
   struct distributor_dialog_data *dist;

   ao2_wrlock(dialog_associations);
   dist = ao2_find(dialog_associations, dlg, OBJ_SEARCH_KEY | OBJ_NOLOCK);
   if (!dist) {
      if (endpoint) {
         dist = ao2_alloc(sizeof(*dist), NULL);
         if (dist) {
            dist->dlg = dlg;
            dist->endpoint = endpoint;
            ao2_link_flags(dialog_associations, dist, OBJ_NOLOCK);
            ao2_ref(dist, -1);
         }
      }
   } else {
      ao2_lock(dist);
      dist->endpoint = endpoint;
      if (!dist->serializer && !dist->endpoint) {
         ao2_unlink_flags(dialog_associations, dist, OBJ_NOLOCK);
      }
      ao2_unlock(dist);
      ao2_ref(dist, -1);
   }
   ao2_unlock(dialog_associations);
}

struct ast_sip_endpoint *ast_sip_dialog_get_endpoint(pjsip_dialog *dlg)
{
   struct distributor_dialog_data *dist;
   struct ast_sip_endpoint *endpoint;

   dist = ao2_find(dialog_associations, dlg, OBJ_SEARCH_KEY);
   if (dist) {
      ao2_lock(dist);
      endpoint = ao2_bump(dist->endpoint);
      ao2_unlock(dist);
      ao2_ref(dist, -1);
   } else {
      endpoint = NULL;
   }
   return endpoint;
}

static pjsip_dialog *find_dialog(pjsip_rx_data *rdata)
{
   pj_str_t tsx_key;
   pjsip_transaction *tsx;
   pjsip_dialog *dlg;
   pj_str_t *local_tag;
   pj_str_t *remote_tag;

   if (!rdata->msg_info.msg) {
      return NULL;
   }

   if (rdata->msg_info.msg->type == PJSIP_REQUEST_MSG) {
      local_tag = &rdata->msg_info.to->tag;
      remote_tag = &rdata->msg_info.from->tag;
   } else {
      local_tag = &rdata->msg_info.from->tag;
      remote_tag = &rdata->msg_info.to->tag;
   }

   /* We can only call the convenient method for
    *  1) responses
    *  2) non-CANCEL requests
    *  3) CANCEL requests with a to-tag
    */
   if (rdata->msg_info.msg->type == PJSIP_RESPONSE_MSG ||
         pjsip_method_cmp(&rdata->msg_info.msg->line.req.method, &pjsip_cancel_method) ||
         rdata->msg_info.to->tag.slen != 0) {
      dlg = pjsip_ua_find_dialog(&rdata->msg_info.cid->id, local_tag,
            remote_tag, PJ_FALSE);
      if (dlg) {
         return dlg;
      }
   }

   /*
    * There may still be a matching dialog if this is
    * 1) an incoming CANCEL request without a to-tag
    * 2) an incoming response to a dialog-creating request.
    */
   if (rdata->msg_info.msg->type == PJSIP_REQUEST_MSG) {
      /* CANCEL requests will need to match the INVITE we initially received. Any
       * other request type will either have been matched already or is not in
       * dialog
       */
      pjsip_tsx_create_key(rdata->tp_info.pool, &tsx_key, PJSIP_ROLE_UAS,
            pjsip_get_invite_method(), rdata);
   } else {
      pjsip_tsx_create_key(rdata->tp_info.pool, &tsx_key, PJSIP_ROLE_UAC,
            &rdata->msg_info.cseq->method, rdata);
   }

   tsx = pjsip_tsx_layer_find_tsx(&tsx_key, PJ_TRUE);
   if (!tsx) {
      ast_debug(3, "Could not find matching transaction for %s\n",
         pjsip_rx_data_get_info(rdata));
      return NULL;
   }

   dlg = pjsip_tsx_get_dlg(tsx);

#ifdef HAVE_PJ_TRANSACTION_GRP_LOCK
   pj_grp_lock_release(tsx->grp_lock);
#else
   pj_mutex_unlock(tsx->mutex);
#endif

   return dlg;
}

/*!
 * \internal
 * \brief Compute a hash value on a pjlib string
 * \since 13.10.0
 *
 * \param[in] str The pjlib string to add to the hash
 * \param[in] hash The hash value to add to
 *
 * \details
 * This version of the function is for when you need to compute a
 * string hash of more than one string.
 *
 * This famous hash algorithm was written by Dan Bernstein and is
 * commonly used.
 *
 * \sa http://www.cse.yorku.ca/~oz/hash.html
 */
static int pjstr_hash_add(pj_str_t *str, int hash)
{
   return buf_hash_add(pj_strbuf(str), pj_strlen(str), hash);
}

/*!
 * \internal
 * \brief Compute a hash value on a pjlib string
 * \since 13.10.0
 *
 * \param[in] str The pjlib string to hash
 *
 * This famous hash algorithm was written by Dan Bernstein and is
 * commonly used.
 *
 * http://www.cse.yorku.ca/~oz/hash.html
 */
static int pjstr_hash(pj_str_t *str)
{
   return pjstr_hash_add(str, 5381);
}

struct ast_taskprocessor *ast_sip_get_distributor_serializer(pjsip_rx_data *rdata)
{
   int hash;
   pj_str_t *remote_tag;
   struct ast_taskprocessor *serializer;

   if (!rdata->msg_info.msg) {
      return NULL;
   }

   if (rdata->msg_info.msg->type == PJSIP_REQUEST_MSG) {
      remote_tag = &rdata->msg_info.from->tag;
   } else {
      remote_tag = &rdata->msg_info.to->tag;
   }

   /* Compute the hash from the SIP message call-id and remote-tag */
   hash = pjstr_hash(&rdata->msg_info.cid->id);
   hash = pjstr_hash_add(remote_tag, hash);
   hash = ast_str_hash_restrict(hash);

   serializer = ao2_bump(distributor_pool[hash % ARRAY_LEN(distributor_pool)]);
   if (serializer) {
      ast_debug(3, "Calculated serializer %s to use for %s\n",
         ast_taskprocessor_name(serializer), pjsip_rx_data_get_info(rdata));
   }
   return serializer;
}

static pj_bool_t endpoint_lookup(pjsip_rx_data *rdata);

static pjsip_module endpoint_mod = {
   .name = {"Endpoint Identifier", 19},
   .priority = PJSIP_MOD_PRIORITY_TSX_LAYER - 3,
   .on_rx_request = endpoint_lookup,
};

static pj_bool_t distributor(pjsip_rx_data *rdata)
{
   pjsip_dialog *dlg;
   struct distributor_dialog_data *dist = NULL;
   struct ast_taskprocessor *serializer = NULL;
   pjsip_rx_data *clone;

   if (!ast_test_flag(&ast_options, AST_OPT_FLAG_FULLY_BOOTED)) {
      /*
       * Ignore everything until we are fully booted.  Let the
       * peer retransmit messages until we are ready.
       */
      return PJ_TRUE;
   }

   dlg = find_dialog(rdata);
   if (dlg) {
      ast_debug(3, "Searching for serializer associated with dialog %s for %s\n",
         dlg->obj_name, pjsip_rx_data_get_info(rdata));
      dist = ao2_find(dialog_associations, dlg, OBJ_SEARCH_KEY);
      if (dist) {
         ao2_lock(dist);
         serializer = ao2_bump(dist->serializer);
         ao2_unlock(dist);
         if (serializer) {
            ast_debug(3, "Found serializer %s associated with dialog %s\n",
               ast_taskprocessor_name(serializer), dlg->obj_name);
         }
      }
   }

   if (serializer) {
      /* We have a serializer so we know where to send the message. */
   } else if (rdata->msg_info.msg->type == PJSIP_RESPONSE_MSG) {
      ast_debug(3, "No dialog serializer for %s.  Using request transaction as basis.\n",
         pjsip_rx_data_get_info(rdata));
      serializer = find_request_serializer(rdata);
      if (!serializer) {
         /*
          * Pick a serializer for the unmatched response.
          * We couldn't determine what serializer originally
          * sent the request or the serializer is gone.
          */
         serializer = ast_sip_get_distributor_serializer(rdata);
      }
   } else if (!pjsip_method_cmp(&rdata->msg_info.msg->line.req.method, &pjsip_cancel_method)
      || !pjsip_method_cmp(&rdata->msg_info.msg->line.req.method, &pjsip_bye_method)) {
      /* We have a BYE or CANCEL request without a serializer. */
      pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata,
         PJSIP_SC_CALL_TSX_DOES_NOT_EXIST, NULL, NULL, NULL);
      ao2_cleanup(dist);
      return PJ_TRUE;
   } else {
      if ((overload_trigger == TASKPROCESSOR_OVERLOAD_TRIGGER_GLOBAL &&
         ast_taskprocessor_alert_get())
         || (overload_trigger == TASKPROCESSOR_OVERLOAD_TRIGGER_PJSIP_ONLY &&
         ast_taskprocessor_get_subsystem_alert("pjsip"))) {
         /*
          * When taskprocessors get backed up, there is a good chance that
          * we are being overloaded and need to defer adding new work to
          * the system.  To defer the work we will ignore the request and
          * rely on the peer's transport layer to retransmit the message.
          * We usually work off the overload within a few seconds.
          * If transport is non-UDP we send a 503 response instead.
          */
         switch (rdata->tp_info.transport->key.type) {
         case PJSIP_TRANSPORT_UDP6:
         case PJSIP_TRANSPORT_UDP:
            ast_debug(3, "Taskprocessor overload alert: Ignoring '%s'.\n",
               pjsip_rx_data_get_info(rdata));
            break;
         default:
            ast_debug(3, "Taskprocessor overload on non-udp transport. Received:'%s'. "
               "Responding with a 503.\n", pjsip_rx_data_get_info(rdata));
            pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata,
               PJSIP_SC_SERVICE_UNAVAILABLE, NULL, NULL, NULL);
            break;
         }
         ao2_cleanup(dist);
         return PJ_TRUE;
      }

      /* Pick a serializer for the out-of-dialog request. */
      serializer = ast_sip_get_distributor_serializer(rdata);
   }

   if (pjsip_rx_data_clone(rdata, 0, &clone) != PJ_SUCCESS) {
      ast_taskprocessor_unreference(serializer);
      ao2_cleanup(dist);
      return PJ_TRUE;
   }

   if (dist) {
      ao2_lock(dist);
      clone->endpt_info.mod_data[endpoint_mod.id] = ao2_bump(dist->endpoint);
      ao2_unlock(dist);
      ao2_cleanup(dist);
   }

   if (ast_sip_push_task(serializer, distribute, clone)) {
      ao2_cleanup(clone->endpt_info.mod_data[endpoint_mod.id]);
      pjsip_rx_data_free_cloned(clone);
   }

   ast_taskprocessor_unreference(serializer);

   return PJ_TRUE;
}

static struct ast_sip_auth *alloc_artificial_auth(char *default_realm)
{
   struct ast_sip_auth *fake_auth;

   fake_auth = ast_sorcery_alloc(ast_sip_get_sorcery(), SIP_SORCERY_AUTH_TYPE,
      "artificial");
   if (!fake_auth) {
      return NULL;
   }

   ast_string_field_set(fake_auth, realm, default_realm);
   ast_string_field_set(fake_auth, auth_user, "");
   ast_string_field_set(fake_auth, auth_pass, "");
   fake_auth->type = AST_SIP_AUTH_TYPE_ARTIFICIAL;

   return fake_auth;
}

static AO2_GLOBAL_OBJ_STATIC(artificial_auth);

static int create_artificial_auth(void)
{
   char default_realm[MAX_REALM_LENGTH + 1];
   struct ast_sip_auth *fake_auth;

   ast_sip_get_default_realm(default_realm, sizeof(default_realm));
   fake_auth = alloc_artificial_auth(default_realm);
   if (!fake_auth) {
      ast_log(LOG_ERROR, "Unable to create artificial auth\n");
      return -1;
   }

   ao2_global_obj_replace_unref(artificial_auth, fake_auth);
   ao2_ref(fake_auth, -1);
   return 0;
}

struct ast_sip_auth *ast_sip_get_artificial_auth(void)
{
   return ao2_global_obj_ref(artificial_auth);
}

static struct ast_sip_endpoint *artificial_endpoint = NULL;

static int create_artificial_endpoint(void)
{
   artificial_endpoint = ast_sorcery_alloc(ast_sip_get_sorcery(), "endpoint", NULL);
   if (!artificial_endpoint) {
      return -1;
   }

   AST_VECTOR_INIT(&artificial_endpoint->inbound_auths, 1);
   /* Pushing a bogus value into the vector will ensure that
    * the proper size of the vector is returned. This value is
    * not actually used anywhere
    */
   AST_VECTOR_APPEND(&artificial_endpoint->inbound_auths, ast_strdup("artificial-auth"));
   return 0;
}

struct ast_sip_endpoint *ast_sip_get_artificial_endpoint(void)
{
   ao2_ref(artificial_endpoint, +1);
   return artificial_endpoint;
}

static void log_failed_request(pjsip_rx_data *rdata, char *msg, unsigned int count, unsigned int period)
{
   char from_buf[PJSIP_MAX_URL_SIZE];
   char callid_buf[PJSIP_MAX_URL_SIZE];
   char method_buf[PJSIP_MAX_URL_SIZE];
   char src_addr_buf[AST_SOCKADDR_BUFLEN];
   pjsip_uri_print(PJSIP_URI_IN_FROMTO_HDR, rdata->msg_info.from->uri, from_buf, PJSIP_MAX_URL_SIZE);
   ast_copy_pj_str(callid_buf, &rdata->msg_info.cid->id, PJSIP_MAX_URL_SIZE);
   ast_copy_pj_str(method_buf, &rdata->msg_info.msg->line.req.method.name, PJSIP_MAX_URL_SIZE);
   if (count) {
      ast_log(LOG_NOTICE, "Request '%s' from '%s' failed for '%s' (callid: %s) - %s"
         " after %u tries in %.3f ms\n",
         method_buf, from_buf,
         pj_sockaddr_print(&rdata->pkt_info.src_addr, src_addr_buf, sizeof(src_addr_buf), 3),
         callid_buf, msg, count, period / 1000.0);
   } else {
      ast_log(LOG_NOTICE, "Request '%s' from '%s' failed for '%s' (callid: %s) - %s\n",
         method_buf, from_buf,
         pj_sockaddr_print(&rdata->pkt_info.src_addr, src_addr_buf, sizeof(src_addr_buf), 3),
         callid_buf, msg);
   }
}

static void check_endpoint(pjsip_rx_data *rdata, struct unidentified_request *unid,
   const char *name)
{
   int64_t ms = ast_tvdiff_ms(ast_tvnow(), unid->first_seen);

   ao2_wrlock(unid);
   unid->count++;

   if (ms < (unidentified_period * 1000) && unid->count >= unidentified_count) {
      log_failed_request(rdata, "No matching endpoint found", unid->count, ms);
      ast_sip_report_invalid_endpoint(name, rdata);
   }
   ao2_unlock(unid);
}

static int apply_endpoint_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint);
static int apply_endpoint_contact_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint);

static void apply_acls(pjsip_rx_data *rdata)
{
   struct ast_sip_endpoint *endpoint;

   /* Is the endpoint allowed with the source or contact address? */
   endpoint = rdata->endpt_info.mod_data[endpoint_mod.id];
   if (endpoint != artificial_endpoint
      && (apply_endpoint_acl(rdata, endpoint)
         || apply_endpoint_contact_acl(rdata, endpoint))) {
      ast_debug(1, "Endpoint '%s' not allowed by ACL\n",
         ast_sorcery_object_get_id(endpoint));

      /* Replace the rdata endpoint with the artificial endpoint. */
      ao2_replace(rdata->endpt_info.mod_data[endpoint_mod.id], artificial_endpoint);
   }
}

static pj_bool_t endpoint_lookup(pjsip_rx_data *rdata)
{
   struct ast_sip_endpoint *endpoint;
   struct unidentified_request *unid;
   int is_ack = rdata->msg_info.msg->line.req.method.id == PJSIP_ACK_METHOD;

   endpoint = rdata->endpt_info.mod_data[endpoint_mod.id];
   if (endpoint) {
      /*
       * ao2_find with OBJ_UNLINK always write locks the container before even searching
       * for the object.  Since the majority case is that the object won't be found, do
       * the find without OBJ_UNLINK to prevent the unnecessary write lock, then unlink
       * if needed.
       */
      unid = ao2_find(unidentified_requests, rdata->pkt_info.src_name, OBJ_SEARCH_KEY);
      if (unid) {
         ao2_unlink(unidentified_requests, unid);
         ao2_ref(unid, -1);
      }
      apply_acls(rdata);
      return PJ_FALSE;
   }

   endpoint = ast_sip_identify_endpoint(rdata);
   if (endpoint) {
      unid = ao2_find(unidentified_requests, rdata->pkt_info.src_name, OBJ_SEARCH_KEY);
      if (unid) {
         ao2_unlink(unidentified_requests, unid);
         ao2_ref(unid, -1);
      }
   }

   if (!endpoint) {
      /* always use an artificial endpoint - per discussion no reason
         to have "alwaysauthreject" as an option.  It is felt using it
         was a bug fix and it is not needed since we are not worried about
         breaking old stuff and we really don't want to enable the discovery
         of SIP accounts */
      endpoint = ast_sip_get_artificial_endpoint();
   }

   /* endpoint ref held by mod_data[] */
   rdata->endpt_info.mod_data[endpoint_mod.id] = endpoint;

   if (endpoint == artificial_endpoint && !is_ack) {
      char name[AST_UUID_STR_LEN] = "";
      pjsip_uri *from = rdata->msg_info.from->uri;

      if (PJSIP_URI_SCHEME_IS_SIP(from) || PJSIP_URI_SCHEME_IS_SIPS(from)) {
         pjsip_sip_uri *sip_from = pjsip_uri_get_uri(from);
         ast_copy_pj_str(name, &sip_from->user, sizeof(name));
      }

      unid = ao2_find(unidentified_requests, rdata->pkt_info.src_name, OBJ_SEARCH_KEY);
      if (unid) {
         check_endpoint(rdata, unid, name);
         ao2_ref(unid, -1);
      } else if (using_auth_username) {
         ao2_wrlock(unidentified_requests);
         /* Checking again with the write lock held allows us to eliminate the DUPS_REPLACE and sort_fn */
         unid = ao2_find(unidentified_requests, rdata->pkt_info.src_name,
            OBJ_SEARCH_KEY | OBJ_NOLOCK);
         if (unid) {
            check_endpoint(rdata, unid, name);
         } else {
            unid = ao2_alloc_options(sizeof(*unid) + strlen(rdata->pkt_info.src_name) + 1,
               NULL, AO2_ALLOC_OPT_LOCK_RWLOCK);
            if (!unid) {
               ao2_unlock(unidentified_requests);
               pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 500, NULL, NULL, NULL);
               return PJ_TRUE;
            }
            strcpy(unid->src_name, rdata->pkt_info.src_name); /* Safe */
            unid->first_seen = ast_tvnow();
            unid->count = 1;
            ao2_link_flags(unidentified_requests, unid, OBJ_NOLOCK);
         }
         ao2_ref(unid, -1);
         ao2_unlock(unidentified_requests);
      } else {
         log_failed_request(rdata, "No matching endpoint found", 0, 0);
         ast_sip_report_invalid_endpoint(name, rdata);
      }
   }

   apply_acls(rdata);
   return PJ_FALSE;
}

static int apply_endpoint_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint)
{
   struct ast_sockaddr addr;

   if (ast_acl_list_is_empty(endpoint->acl)) {
      return 0;
   }

   memset(&addr, 0, sizeof(addr));
   ast_sockaddr_parse(&addr, rdata->pkt_info.src_name, PARSE_PORT_FORBID);
   ast_sockaddr_set_port(&addr, rdata->pkt_info.src_port);

   if (ast_apply_acl(endpoint->acl, &addr, "SIP ACL: ") != AST_SENSE_ALLOW) {
      log_failed_request(rdata, "Not match Endpoint ACL", 0, 0);
      ast_sip_report_failed_acl(endpoint, rdata, "not_match_endpoint_acl");
      return 1;
   }
   return 0;
}

static int extract_contact_addr(pjsip_contact_hdr *contact, struct ast_sockaddr **addrs)
{
   pjsip_sip_uri *sip_uri;
   char host[256];

   if (!contact || contact->star) {
      *addrs = NULL;
      return 0;
   }
   if (!PJSIP_URI_SCHEME_IS_SIP(contact->uri) && !PJSIP_URI_SCHEME_IS_SIPS(contact->uri)) {
      *addrs = NULL;
      return 0;
   }
   sip_uri = pjsip_uri_get_uri(contact->uri);
   ast_copy_pj_str(host, &sip_uri->host, sizeof(host));
   return ast_sockaddr_resolve(addrs, host, PARSE_PORT_FORBID, AST_AF_UNSPEC);
}

static int apply_endpoint_contact_acl(pjsip_rx_data *rdata, struct ast_sip_endpoint *endpoint)
{
   int num_contact_addrs;
   int forbidden = 0;
   struct ast_sockaddr *contact_addrs;
   int i;
   pjsip_contact_hdr *contact = (pjsip_contact_hdr *)&rdata->msg_info.msg->hdr;

   if (ast_acl_list_is_empty(endpoint->contact_acl)) {
      return 0;
   }

   while ((contact = pjsip_msg_find_hdr(rdata->msg_info.msg, PJSIP_H_CONTACT, contact->next))) {
      num_contact_addrs = extract_contact_addr(contact, &contact_addrs);
      if (num_contact_addrs <= 0) {
         continue;
      }
      for (i = 0; i < num_contact_addrs; ++i) {
         if (ast_apply_acl(endpoint->contact_acl, &contact_addrs[i], "SIP Contact ACL: ") != AST_SENSE_ALLOW) {
            log_failed_request(rdata, "Not match Endpoint Contact ACL", 0, 0);
            ast_sip_report_failed_acl(endpoint, rdata, "not_match_endpoint_contact_acl");
            forbidden = 1;
            break;
         }
      }
      ast_free(contact_addrs);
      if (forbidden) {
         /* No use checking other contacts if we already have failed ACL check */
         break;
      }
   }

   return forbidden;
}

static pj_bool_t authenticate(pjsip_rx_data *rdata)
{
   RAII_VAR(struct ast_sip_endpoint *, endpoint, ast_pjsip_rdata_get_endpoint(rdata), ao2_cleanup);
   int is_ack = rdata->msg_info.msg->line.req.method.id == PJSIP_ACK_METHOD;

   ast_assert(endpoint != NULL);

   if (is_ack) {
      return PJ_FALSE;
   }

   if (ast_sip_requires_authentication(endpoint, rdata)) {
      pjsip_tx_data *tdata;
      struct unidentified_request *unid;

      pjsip_endpt_create_response(ast_sip_get_pjsip_endpoint(), rdata, 401, NULL, &tdata);
      switch (ast_sip_check_authentication(endpoint, rdata, tdata)) {
      case AST_SIP_AUTHENTICATION_CHALLENGE:
         /* Send the 401 we created for them */
         ast_sip_report_auth_challenge_sent(endpoint, rdata, tdata);
         if (pjsip_endpt_send_response2(ast_sip_get_pjsip_endpoint(), rdata, tdata, NULL, NULL) != PJ_SUCCESS) {
            pjsip_tx_data_dec_ref(tdata);
         }
         return PJ_TRUE;
      case AST_SIP_AUTHENTICATION_SUCCESS:
         /* See note in endpoint_lookup about not holding an unnecessary write lock */
         unid = ao2_find(unidentified_requests, rdata->pkt_info.src_name, OBJ_SEARCH_KEY);
         if (unid) {
            ao2_unlink(unidentified_requests, unid);
            ao2_ref(unid, -1);
         }
         ast_sip_report_auth_success(endpoint, rdata);
         break;
      case AST_SIP_AUTHENTICATION_FAILED:
         log_failed_request(rdata, "Failed to authenticate", 0, 0);
         ast_sip_report_auth_failed_challenge_response(endpoint, rdata);
         if (pjsip_endpt_send_response2(ast_sip_get_pjsip_endpoint(), rdata, tdata, NULL, NULL) != PJ_SUCCESS) {
            pjsip_tx_data_dec_ref(tdata);
         }
         return PJ_TRUE;
      case AST_SIP_AUTHENTICATION_ERROR:
         log_failed_request(rdata, "Error to authenticate", 0, 0);
         ast_sip_report_auth_failed_challenge_response(endpoint, rdata);
         pjsip_tx_data_dec_ref(tdata);
         pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 500, NULL, NULL, NULL);
         return PJ_TRUE;
      }
      pjsip_tx_data_dec_ref(tdata);
   } else if (endpoint == artificial_endpoint) {
      /* Uh. Oh.  The artificial endpoint couldn't challenge so block the request. */
      pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 500, NULL, NULL, NULL);
      return PJ_TRUE;
   }

   return PJ_FALSE;
}

static pjsip_module auth_mod = {
   .name = {"Request Authenticator", 21},
   .priority = PJSIP_MOD_PRIORITY_APPLICATION - 2,
   .on_rx_request = authenticate,
};

static int distribute(void *data)
{
   static pjsip_process_rdata_param param = {
      .start_mod = &distributor_mod,
      .idx_after_start = 1,
   };
   pj_bool_t handled = PJ_FALSE;
   pjsip_rx_data *rdata = data;
   int is_request = rdata->msg_info.msg->type == PJSIP_REQUEST_MSG;
   int is_ack = is_request ? rdata->msg_info.msg->line.req.method.id == PJSIP_ACK_METHOD : 0;
   struct ast_sip_endpoint *endpoint;

   pjsip_endpt_process_rx_data(ast_sip_get_pjsip_endpoint(), rdata, &param, &handled);
   if (!handled && is_request && !is_ack) {
      pjsip_endpt_respond_stateless(ast_sip_get_pjsip_endpoint(), rdata, 501, NULL, NULL, NULL);
   }

   /* The endpoint_mod stores an endpoint reference in the mod_data of rdata. This
    * is the only appropriate spot to actually decrement the reference.
    */
   endpoint = rdata->endpt_info.mod_data[endpoint_mod.id];
   ao2_cleanup(endpoint);
   pjsip_rx_data_free_cloned(rdata);
   return 0;
}

struct ast_sip_endpoint *ast_pjsip_rdata_get_endpoint(pjsip_rx_data *rdata)
{
   struct ast_sip_endpoint *endpoint = rdata->endpt_info.mod_data[endpoint_mod.id];
   if (endpoint) {
      ao2_ref(endpoint, +1);
   }
   return endpoint;
}

static int suspects_sort(const void *obj, const void *arg, int flags)
{
   const struct unidentified_request *object_left = obj;
   const struct unidentified_request *object_right = arg;
   const char *right_key = arg;
   int cmp;

   switch (flags & OBJ_SEARCH_MASK) {
   case OBJ_SEARCH_OBJECT:
      right_key = object_right->src_name;
      /* Fall through */
   case OBJ_SEARCH_KEY:
      cmp = strcmp(object_left->src_name, right_key);
      break;
   case OBJ_SEARCH_PARTIAL_KEY:
      cmp = strncmp(object_left->src_name, right_key, strlen(right_key));
      break;
   default:
      cmp = 0;
      break;
   }
   return cmp;
}

static int suspects_compare(void *obj, void *arg, int flags)
{
   const struct unidentified_request *object_left = obj;
   const struct unidentified_request *object_right = arg;
   const char *right_key = arg;
   int cmp = 0;

   switch (flags & OBJ_SEARCH_MASK) {
   case OBJ_SEARCH_OBJECT:
      right_key = object_right->src_name;
      /* Fall through */
   case OBJ_SEARCH_KEY:
      if (strcmp(object_left->src_name, right_key) == 0) {
         cmp = CMP_MATCH;
      }
      break;
   case OBJ_SEARCH_PARTIAL_KEY:
      if (strncmp(object_left->src_name, right_key, strlen(right_key)) == 0) {
         cmp = CMP_MATCH;
      }
      break;
   default:
      cmp = 0;
      break;
   }
   return cmp;
}

static int suspects_hash(const void *obj, int flags)
{
   const struct unidentified_request *object;
   const char *key;

   switch (flags & OBJ_SEARCH_MASK) {
   case OBJ_SEARCH_KEY:
      key = obj;
      break;
   case OBJ_SEARCH_OBJECT:
      object = obj;
      key = object->src_name;
      break;
   default:
      /* Hash can only work on something with a full key. */
      ast_assert(0);
      return 0;
   }
   return ast_str_hash(key);
}

static struct ao2_container *cli_unid_get_container(const char *regex)
{
   struct ao2_container *s_container;

   s_container = ao2_container_alloc_list(AO2_ALLOC_OPT_LOCK_NOLOCK, 0,
      suspects_sort, suspects_compare);
   if (!s_container) {
      return NULL;
   }

   if (ao2_container_dup(s_container, unidentified_requests, 0)) {
      ao2_ref(s_container, -1);
      return NULL;
   }

   return s_container;
}

static int cli_unid_iterate(void *container, ao2_callback_fn callback, void *args)
{
   ao2_callback(container, 0, callback, args);

   return 0;
}

static void *cli_unid_retrieve_by_id(const char *id)
{
   return ao2_find(unidentified_requests, id, OBJ_SEARCH_KEY);
}

static const char *cli_unid_get_id(const void *obj)
{
   const struct unidentified_request *unid = obj;

   return unid->src_name;
}

static int cli_unid_print_header(void *obj, void *arg, int flags)
{
   struct ast_sip_cli_context *context = arg;
   RAII_VAR(struct ast_sip_cli_formatter_entry *, formatter_entry, NULL, ao2_cleanup);

   int indent = CLI_INDENT_TO_SPACES(context->indent_level);
   int filler = CLI_LAST_TABSTOP - indent - 7;

   ast_assert(context->output_buffer != NULL);

   ast_str_append(&context->output_buffer, 0,
      "%*s:  <IP Address%*.*s>  <Count> <Age(sec)>\n",
      indent, "Request", filler, filler, CLI_HEADER_FILLER);

   return 0;
}

static int cli_unid_print_body(void *obj, void *arg, int flags)
{
   struct unidentified_request *unid = obj;
   struct ast_sip_cli_context *context = arg;
   int indent;
   int flexwidth;
   int64_t ms = ast_tvdiff_ms(ast_tvnow(), unid->first_seen);

   ast_assert(context->output_buffer != NULL);

   indent = CLI_INDENT_TO_SPACES(context->indent_level);
   flexwidth = CLI_LAST_TABSTOP - 4;

   ast_str_append(&context->output_buffer, 0, "%*s:  %-*.*s  %7d %10.3f\n",
      indent,
      "Request",
      flexwidth, flexwidth,
      unid->src_name, unid->count,  ms / 1000.0);

   return 0;
}

static struct ast_cli_entry cli_commands[] = {
   AST_CLI_DEFINE(ast_sip_cli_traverse_objects, "Show PJSIP Unidentified Requests",
      .command = "pjsip show unidentified_requests",
      .usage = "Usage: pjsip show unidentified_requests\n"
            "       Show the PJSIP Unidentified Requests\n"),
};

struct ast_sip_cli_formatter_entry *unid_formatter;

static int expire_requests(void *object, void *arg, int flags)
{
   struct unidentified_request *unid = object;
   int *maxage = arg;
   int64_t ms = ast_tvdiff_ms(ast_tvnow(), unid->first_seen);

   if (ms > (*maxage) * 2 * 1000) {
      return CMP_MATCH;
   }

   return 0;
}

static int prune_task(const void *data)
{
   unsigned int maxage;

   ast_sip_get_unidentified_request_thresholds(&unidentified_count, &unidentified_period, &unidentified_prune_interval);
   maxage = unidentified_period * 2;
   ao2_callback(unidentified_requests, OBJ_MULTIPLE | OBJ_NODATA | OBJ_UNLINK, expire_requests, &maxage);

   return unidentified_prune_interval * 1000;
}

static int clean_task(const void *data)
{
   return 0;
}

static void global_loaded(const char *object_type)
{
   char default_realm[MAX_REALM_LENGTH + 1];
   struct ast_sip_auth *fake_auth;
   char *identifier_order;

   /* Update using_auth_username */
   identifier_order = ast_sip_get_endpoint_identifier_order();
   if (identifier_order) {
      char *identify_method;
      char *io_copy = ast_strdupa(identifier_order);
      int new_using = 0;

      ast_free(identifier_order);
      while ((identify_method = ast_strip(strsep(&io_copy, ",")))) {
         if (!strcmp(identify_method, "auth_username")) {
            new_using = 1;
            break;
         }
      }
      using_auth_username = new_using;
   }

   /* Update default_realm of artificial_auth */
   ast_sip_get_default_realm(default_realm, sizeof(default_realm));
   fake_auth = ast_sip_get_artificial_auth();
   if (!fake_auth || strcmp(fake_auth->realm, default_realm)) {
      ao2_cleanup(fake_auth);

      fake_auth = alloc_artificial_auth(default_realm);
      if (fake_auth) {
         ao2_global_obj_replace_unref(artificial_auth, fake_auth);
      }
   }
   ao2_cleanup(fake_auth);

   ast_sip_get_unidentified_request_thresholds(&unidentified_count, &unidentified_period, &unidentified_prune_interval);

   overload_trigger = ast_sip_get_taskprocessor_overload_trigger();

   /* Clean out the old task, if any */
   ast_sched_clean_by_callback(prune_context, prune_task, clean_task);
   /* Have to do something with the return value to shut up the stupid compiler. */
   if (ast_sched_add_variable(prune_context, unidentified_prune_interval * 1000, prune_task, NULL, 1) < 0) {
      return;
   }
}

/*! \brief Observer which is used to update our interval and default_realm when the global setting changes */
static struct ast_sorcery_observer global_observer = {
   .loaded = global_loaded,
};

/*!
 * \internal
 * \brief Shutdown the serializers in the distributor pool.
 * \since 13.10.0
 *
 * \return Nothing
 */
static void distributor_pool_shutdown(void)
{
   int idx;

   for (idx = 0; idx < ARRAY_LEN(distributor_pool); ++idx) {
      ast_taskprocessor_unreference(distributor_pool[idx]);
      distributor_pool[idx] = NULL;
   }
}

/*!
 * \internal
 * \brief Setup the serializers in the distributor pool.
 * \since 13.10.0
 *
 * \retval 0 on success.
 * \retval -1 on error.
 */
static int distributor_pool_setup(void)
{
   char tps_name[AST_TASKPROCESSOR_MAX_NAME + 1];
   int idx;

   for (idx = 0; idx < ARRAY_LEN(distributor_pool); ++idx) {
      /* Create name with seq number appended. */
      ast_taskprocessor_build_name(tps_name, sizeof(tps_name), "pjsip/distributor");

      distributor_pool[idx] = ast_sip_create_serializer(tps_name);
      if (!distributor_pool[idx]) {
         return -1;
      }
   }
   return 0;
}

int ast_sip_initialize_distributor(void)
{
   unidentified_requests = ao2_container_alloc_hash(AO2_ALLOC_OPT_LOCK_RWLOCK, 0,
      DEFAULT_SUSPECTS_BUCKETS, suspects_hash, NULL, suspects_compare);
   if (!unidentified_requests) {
      return -1;
   }

   dialog_associations = ao2_container_alloc_hash(AO2_ALLOC_OPT_LOCK_RWLOCK, 0,
      DIALOG_ASSOCIATIONS_BUCKETS, dialog_associations_hash, NULL,
      dialog_associations_cmp);
   if (!dialog_associations) {
      ast_sip_destroy_distributor();
      return -1;
   }

   if (distributor_pool_setup()) {
      ast_sip_destroy_distributor();
      return -1;
   }

   prune_context = ast_sched_context_create();
   if (!prune_context) {
      ast_sip_destroy_distributor();
      return -1;
   }

   if (ast_sched_start_thread(prune_context)) {
      ast_sip_destroy_distributor();
      return -1;
   }

   ast_sorcery_observer_add(ast_sip_get_sorcery(), "global", &global_observer);
   ast_sorcery_reload_object(ast_sip_get_sorcery(), "global");

   if (create_artificial_endpoint() || create_artificial_auth()) {
      ast_sip_destroy_distributor();
      return -1;
   }

   if (ast_sip_register_service(&distributor_mod)) {
      ast_sip_destroy_distributor();
      return -1;
   }
   if (ast_sip_register_service(&endpoint_mod)) {
      ast_sip_destroy_distributor();
      return -1;
   }
   if (ast_sip_register_service(&auth_mod)) {
      ast_sip_destroy_distributor();
      return -1;
   }

   unid_formatter = ao2_alloc_options(sizeof(struct ast_sip_cli_formatter_entry), NULL,
      AO2_ALLOC_OPT_LOCK_NOLOCK);
   if (!unid_formatter) {
      ast_sip_destroy_distributor();
      ast_log(LOG_ERROR, "Unable to allocate memory for unid_formatter\n");
      return -1;
   }
   unid_formatter->name = "unidentified_request";
   unid_formatter->print_header = cli_unid_print_header;
   unid_formatter->print_body = cli_unid_print_body;
   unid_formatter->get_container = cli_unid_get_container;
   unid_formatter->iterate = cli_unid_iterate;
   unid_formatter->get_id = cli_unid_get_id;
   unid_formatter->retrieve_by_id = cli_unid_retrieve_by_id;
   ast_sip_register_cli_formatter(unid_formatter);

   ast_cli_register_multiple(cli_commands, ARRAY_LEN(cli_commands));

   return 0;
}

void ast_sip_destroy_distributor(void)
{
   ast_cli_unregister_multiple(cli_commands, ARRAY_LEN(cli_commands));
   ast_sip_unregister_cli_formatter(unid_formatter);

   ast_sip_unregister_service(&auth_mod);
   ast_sip_unregister_service(&endpoint_mod);
   ast_sip_unregister_service(&distributor_mod);

   ao2_global_obj_release(artificial_auth);
   ao2_cleanup(artificial_endpoint);

   ast_sorcery_observer_remove(ast_sip_get_sorcery(), "global", &global_observer);

   if (prune_context) {
      ast_sched_context_destroy(prune_context);
   }

   distributor_pool_shutdown();

   ao2_cleanup(dialog_associations);
   ao2_cleanup(unidentified_requests);
}