Merge "chan_iax2: Prevent deadlock between hangup and sending lagrq/ping"

[asterisk/asterisk.git] / channels / chan_iax2.c

/*
 * Asterisk -- An open source telephony toolkit.
 *
 * Copyright (C) 1999 - 2006, Digium, Inc.
 *
 * Mark Spencer <markster@digium.com>
 *
 * See http://www.asterisk.org for more information about
 * the Asterisk project. Please do not directly contact
 * any of the maintainers of this project for assistance;
 * the project provides a web site, mailing lists and IRC
 * channels for your use.
 *
 * This program is free software, distributed under the terms of
 * the GNU General Public License Version 2. See the LICENSE file
 * at the top of the source tree.
 */

/*! \file
 *
 * \brief Implementation of Inter-Asterisk eXchange Version 2
 *        as specified in RFC 5456
 *
 * \author Mark Spencer <markster@digium.com>
 *
 * \par See also
 * \arg \ref Config_iax
 *
 * \ingroup channel_drivers
 *
 * \todo Implement musicclass settings for IAX2 devices
 */

/*! \li \ref chan_iax2.c uses the configuration file \ref iax.conf
 * \addtogroup configuration_file
 */

/*! \page iax.conf iax.conf
 * \verbinclude iax.conf.sample
 */

/*!
 * \todo XXX The IAX2 channel driver needs its native bridge
 * code converted to the new bridge technology scheme.
 *
 * \note The chan_dahdi native bridge code can be used as an
 * example.  It also appears that chan_iax2 also has a native
 * transfer check like chan_dahdi to eliminate tromboned calls.
 *
 * \note The existing native bridge code is marked with the
 * IAX2_NATIVE_BRIDGING conditional.
 */

/*** MODULEINFO
        <use type="external">crypto</use>
        <support_level>core</support_level>
 ***/

#include "asterisk.h"

ASTERISK_REGISTER_FILE()

#include <sys/mman.h>
#include <dirent.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <sys/time.h>
#include <sys/signal.h>
#include <signal.h>
#include <strings.h>
#include <netdb.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <regex.h>

#include "asterisk/paths.h"

#include "asterisk/lock.h"
#include "asterisk/frame.h"
#include "asterisk/channel.h"
#include "asterisk/module.h"
#include "asterisk/pbx.h"
#include "asterisk/sched.h"
#include "asterisk/io.h"
#include "asterisk/config.h"
#include "asterisk/cli.h"
#include "asterisk/translate.h"
#include "asterisk/md5.h"
#include "asterisk/crypto.h"
#include "asterisk/acl.h"
#include "asterisk/manager.h"
#include "asterisk/callerid.h"
#include "asterisk/app.h"
#include "asterisk/astdb.h"
#include "asterisk/musiconhold.h"
#include "asterisk/features.h"
#include "asterisk/utils.h"
#include "asterisk/causes.h"
#include "asterisk/localtime.h"
#include "asterisk/dnsmgr.h"
#include "asterisk/devicestate.h"
#include "asterisk/netsock.h"
#include "asterisk/stringfields.h"
#include "asterisk/linkedlists.h"
#include "asterisk/astobj2.h"
#include "asterisk/timing.h"
#include "asterisk/taskprocessor.h"
#include "asterisk/test.h"
#include "asterisk/data.h"
#include "asterisk/security_events.h"
#include "asterisk/stasis_endpoints.h"
#include "asterisk/bridge.h"
#include "asterisk/stasis.h"
#include "asterisk/stasis_system.h"
#include "asterisk/stasis_channels.h"
#include "asterisk/format_cache.h"
#include "asterisk/format_compatibility.h"
#include "asterisk/format_cap.h"

#include "iax2/include/iax2.h"
#include "iax2/include/firmware.h"
#include "iax2/include/parser.h"
#include "iax2/include/provision.h"
#include "iax2/include/codec_pref.h"
#include "iax2/include/format_compatibility.h"

#include "jitterbuf.h"

/*** DOCUMENTATION
        <application name="IAX2Provision" language="en_US">
                <synopsis>
                        Provision a calling IAXy with a given template.
                </synopsis>
                <syntax>
                        <parameter name="template">
                                <para>If not specified, defaults to <literal>default</literal>.</para>
                        </parameter>
                </syntax>
                <description>
                        <para>Provisions the calling IAXy (assuming the calling entity is in fact an IAXy) with the
                        given <replaceable>template</replaceable>. Returns <literal>-1</literal> on error
                        or <literal>0</literal> on success.</para>
                </description>
        </application>
        <function name="IAXPEER" language="en_US">
                <synopsis>
                        Gets IAX peer information.
                </synopsis>
                <syntax>
                        <parameter name="peername" required="true">
                                <enumlist>
                                        <enum name="CURRENTCHANNEL">
                                                <para>If <replaceable>peername</replaceable> is specified to this value, return the IP address of the
                                                endpoint of the current channel</para>
                                        </enum>
                                </enumlist>
                        </parameter>
                        <parameter name="item">
                                <para>If <replaceable>peername</replaceable> is specified, valid items are:</para>
                                <enumlist>
                                        <enum name="ip">
                                                <para>(default) The IP address.</para>
                                        </enum>
                                        <enum name="status">
                                                <para>The peer's status (if <literal>qualify=yes</literal>)</para>
                                        </enum>
                                        <enum name="mailbox">
                                                <para>The configured mailbox.</para>
                                        </enum>
                                        <enum name="context">
                                                <para>The configured context.</para>
                                        </enum>
                                        <enum name="expire">
                                                <para>The epoch time of the next expire.</para>
                                        </enum>
                                        <enum name="dynamic">
                                                <para>Is it dynamic? (yes/no).</para>
                                        </enum>
                                        <enum name="callerid_name">
                                                <para>The configured Caller ID name.</para>
                                        </enum>
                                        <enum name="callerid_num">
                                                <para>The configured Caller ID number.</para>
                                        </enum>
                                        <enum name="codecs">
                                                <para>The configured codecs.</para>
                                        </enum>
                                        <enum name="codec[x]">
                                                <para>Preferred codec index number <replaceable>x</replaceable> (beginning
                                                with <literal>0</literal>)</para>
                                        </enum>
                                </enumlist>
                        </parameter>
                </syntax>
                <description>
                        <para>Gets information associated with the specified IAX2 peer.</para>
                </description>
                <see-also>
                        <ref type="function">SIPPEER</ref>
                </see-also>
        </function>
        <function name="IAXVAR" language="en_US">
                <synopsis>
                        Sets or retrieves a remote variable.
                </synopsis>
                <syntax>
                        <parameter name="varname" required="true" />
                </syntax>
                <description>
                        <para>Gets or sets a variable that is sent to a remote IAX2 peer during call setup.</para>
                </description>
        </function>
        <manager name="IAXpeers" language="en_US">
                <synopsis>
                        List IAX peers.
                </synopsis>
                <syntax>
                        <xi:include xpointer="xpointer(/docs/manager[@name='Login']/syntax/parameter[@name='ActionID'])" />
                </syntax>
                <description>
                </description>
        </manager>
        <manager name="IAXpeerlist" language="en_US">
                <synopsis>
                        List IAX Peers.
                </synopsis>
                <syntax>
                        <xi:include xpointer="xpointer(/docs/manager[@name='Login']/syntax/parameter[@name='ActionID'])" />
                </syntax>
                <description>
                        <para>List all the IAX peers.</para>
                </description>
        </manager>
        <manager name="IAXnetstats" language="en_US">
                <synopsis>
                        Show IAX Netstats.
                </synopsis>
                <syntax />
                <description>
                        <para>Show IAX channels network statistics.</para>
                </description>
        </manager>
        <manager name="IAXregistry" language="en_US">
                <synopsis>
                        Show IAX registrations.
                </synopsis>
                <syntax>
                        <xi:include xpointer="xpointer(/docs/manager[@name='Login']/syntax/parameter[@name='ActionID'])" />
                </syntax>
                <description>
                        <para>Show IAX registrations.</para>
                </description>
        </manager>
 ***/

/* Define SCHED_MULTITHREADED to run the scheduler in a special
   multithreaded mode. */
#define SCHED_MULTITHREADED

/* Define DEBUG_SCHED_MULTITHREADED to keep track of where each
   thread is actually doing. */
#define DEBUG_SCHED_MULTITHREAD


#ifdef SO_NO_CHECK
static int nochecksums = 0;
#endif

#define PTR_TO_CALLNO(a) ((unsigned short)(unsigned long)(a))
#define CALLNO_TO_PTR(a) ((void *)(unsigned long)(a))

#define DEFAULT_THREAD_COUNT 10
#define DEFAULT_MAX_THREAD_COUNT 100
#define DEFAULT_RETRY_TIME 1000
#define MEMORY_SIZE 100
#define DEFAULT_DROP 3

#define DEBUG_SUPPORT

#define MIN_REUSE_TIME          60      /* Don't reuse a call number within 60 seconds */

/* Sample over last 100 units to determine historic jitter */
#define GAMMA (0.01)

static struct iax2_codec_pref prefs_global;

static const char tdesc[] = "Inter Asterisk eXchange Driver (Ver 2)";


/*! \brief Maximum transmission unit for the UDP packet in the trunk not to be
    fragmented. This is based on 1516 - ethernet - ip - udp - iax minus one g711 frame = 1240 */
#define MAX_TRUNK_MTU 1240

static int global_max_trunk_mtu;        /*!< Maximum MTU, 0 if not used */
static int trunk_timed, trunk_untimed, trunk_maxmtu, trunk_nmaxmtu ;    /*!< Trunk MTU statistics */

#define DEFAULT_CONTEXT "default"

static char default_parkinglot[AST_MAX_CONTEXT];

static char language[MAX_LANGUAGE] = "";
static char regcontext[AST_MAX_CONTEXT] = "";

static struct stasis_subscription *network_change_sub; /*!< subscription id for network change events */
static struct stasis_subscription *acl_change_sub; /*!< subscription id for ACL change events */
static int network_change_sched_id = -1;

static int maxauthreq = 3;
static int max_retries = 4;
static int ping_time = 21;
static int lagrq_time = 10;
static int maxjitterbuffer=1000;
static int resyncthreshold=1000;
static int maxjitterinterps=10;
static int jittertargetextra = 40; /* number of milliseconds the new jitter buffer adds on to its size */

#define MAX_TRUNKDATA           640 * 200       /*!< 40ms, uncompressed linear * 200 channels */

static int trunkfreq = 20;
static int trunkmaxsize = MAX_TRUNKDATA;

static int authdebug = 0;
static int autokill = 0;
static int iaxcompat = 0;
static int last_authmethod = 0;

static int iaxdefaultdpcache=10 * 60;   /* Cache dialplan entries for 10 minutes by default */

static int iaxdefaulttimeout = 5;               /* Default to wait no more than 5 seconds for a reply to come back */

static struct {
        unsigned int tos;
        unsigned int cos;
} qos = { 0, 0 };

static int min_reg_expire;
static int max_reg_expire;

static int srvlookup = 0;

static struct ast_timer *timer;                         /* Timer for trunking */

static struct ast_netsock_list *netsock;
static struct ast_netsock_list *outsock;                /*!< used if sourceaddress specified and bindaddr == INADDR_ANY */
static int defaultsockfd = -1;

static int (*iax2_regfunk)(const char *username, int onoff) = NULL;

/* Ethernet, etc */
#define IAX_CAPABILITY_FULLBANDWIDTH    0xFFFF
/* T1, maybe ISDN */
#define IAX_CAPABILITY_MEDBANDWIDTH (IAX_CAPABILITY_FULLBANDWIDTH & \
                     ~AST_FORMAT_SLIN &      \
                     ~AST_FORMAT_SLIN16 &    \
                     ~AST_FORMAT_SIREN7 &       \
                     ~AST_FORMAT_SIREN14 &      \
                     ~AST_FORMAT_G719 &         \
                     ~AST_FORMAT_ULAW &         \
                     ~AST_FORMAT_ALAW &         \
                     ~AST_FORMAT_G722)
/* A modem */
#define IAX_CAPABILITY_LOWBANDWIDTH (IAX_CAPABILITY_MEDBANDWIDTH & \
                     ~AST_FORMAT_G726 &         \
                     ~AST_FORMAT_G726_AAL2 &    \
                     ~AST_FORMAT_ADPCM)

#define IAX_CAPABILITY_LOWFREE      (IAX_CAPABILITY_LOWBANDWIDTH & \
                     ~AST_FORMAT_G723)


#define DEFAULT_MAXMS           2000            /* Must be faster than 2 seconds by default */
#define DEFAULT_FREQ_OK         60 * 1000       /* How often to check for the host to be up */
#define DEFAULT_FREQ_NOTOK      10 * 1000       /* How often to check, if the host is down... */

/* if a pvt has encryption setup done and is running on the call */
#define IAX_CALLENCRYPTED(pvt) \
        (ast_test_flag64(pvt, IAX_ENCRYPTED) && ast_test_flag64(pvt, IAX_KEYPOPULATED))

#define IAX_DEBUGDIGEST(msg, key) do { \
                int idx; \
                char digest[33] = ""; \
                \
                if (!iaxdebug) \
                        break; \
                \
                for (idx = 0; idx < 16; idx++) \
                        sprintf(digest + (idx << 1), "%02hhx", (unsigned char) key[idx]); \
                \
                ast_log(LOG_NOTICE, msg " IAX_COMMAND_RTKEY to rotate key to '%s'\n", digest); \
        } while(0)

static struct io_context *io;
static struct ast_sched_context *sched;

static iax2_format iax2_capability = IAX_CAPABILITY_FULLBANDWIDTH;

static int iaxdebug = 0;

static int iaxtrunkdebug = 0;

static int test_losspct = 0;
#ifdef IAXTESTS
static int test_late = 0;
static int test_resync = 0;
static int test_jit = 0;
static int test_jitpct = 0;
#endif /* IAXTESTS */

static char accountcode[AST_MAX_ACCOUNT_CODE];
static char mohinterpret[MAX_MUSICCLASS];
static char mohsuggest[MAX_MUSICCLASS];
static int amaflags = 0;
static int adsi = 0;
static int delayreject = 0;
static int iax2_encryption = 0;

static struct ast_flags64 globalflags = { 0 };

static pthread_t netthreadid = AST_PTHREADT_NULL;

enum iax2_state {
        IAX_STATE_STARTED =                     (1 << 0),
        IAX_STATE_AUTHENTICATED =       (1 << 1),
        IAX_STATE_TBD =                         (1 << 2),
};

struct iax2_context {
        char context[AST_MAX_CONTEXT];
        struct iax2_context *next;
};


#define IAX_HASCALLERID         (uint64_t)(1LLU << 0)    /*!< CallerID has been specified */
#define IAX_DELME               (uint64_t)(1LLU << 1)    /*!< Needs to be deleted */
#define IAX_TEMPONLY            (uint64_t)(1LLU << 2)    /*!< Temporary (realtime) */
#define IAX_TRUNK               (uint64_t)(1LLU << 3)    /*!< Treat as a trunk */
#define IAX_NOTRANSFER          (uint64_t)(1LLU << 4)    /*!< Don't native bridge */
#define IAX_USEJITTERBUF        (uint64_t)(1LLU << 5)    /*!< Use jitter buffer */
#define IAX_DYNAMIC             (uint64_t)(1LLU << 6)    /*!< dynamic peer */
#define IAX_SENDANI             (uint64_t)(1LLU << 7)    /*!< Send ANI along with CallerID */
#define IAX_RTSAVE_SYSNAME      (uint64_t)(1LLU << 8)    /*!< Save Systname on Realtime Updates */
#define IAX_ALREADYGONE         (uint64_t)(1LLU << 9)    /*!< Already disconnected */
#define IAX_PROVISION           (uint64_t)(1LLU << 10)   /*!< This is a provisioning request */
#define IAX_QUELCH              (uint64_t)(1LLU << 11)   /*!< Whether or not we quelch audio */
#define IAX_ENCRYPTED           (uint64_t)(1LLU << 12)   /*!< Whether we should assume encrypted tx/rx */
#define IAX_KEYPOPULATED        (uint64_t)(1LLU << 13)   /*!< Whether we have a key populated */
#define IAX_CODEC_USER_FIRST    (uint64_t)(1LLU << 14)   /*!< are we willing to let the other guy choose the codec? */
#define IAX_CODEC_NOPREFS       (uint64_t)(1LLU << 15)   /*!< Force old behaviour by turning off prefs */
#define IAX_CODEC_NOCAP         (uint64_t)(1LLU << 16)   /*!< only consider requested format and ignore capabilities*/
#define IAX_RTCACHEFRIENDS      (uint64_t)(1LLU << 17)   /*!< let realtime stay till your reload */
#define IAX_RTUPDATE            (uint64_t)(1LLU << 18)   /*!< Send a realtime update */
#define IAX_RTAUTOCLEAR         (uint64_t)(1LLU << 19)   /*!< erase me on expire */
#define IAX_RTIGNOREREGEXPIRE   (uint64_t)(1LLU << 21)   /*!< When using realtime, ignore registration expiration */
#define IAX_TRUNKTIMESTAMPS     (uint64_t)(1LLU << 22)   /*!< Send trunk timestamps */
#define IAX_TRANSFERMEDIA       (uint64_t)(1LLU << 23)   /*!< When doing IAX2 transfers, transfer media only */
#define IAX_MAXAUTHREQ          (uint64_t)(1LLU << 24)   /*!< Maximum outstanding AUTHREQ restriction is in place */
#define IAX_DELAYPBXSTART       (uint64_t)(1LLU << 25)   /*!< Don't start a PBX on the channel until the peer sends us a response, so that we've achieved a three-way handshake with them before sending voice or anything else */
#define IAX_ALLOWFWDOWNLOAD     (uint64_t)(1LLU << 26)   /*!< Allow the FWDOWNL command? */
#define IAX_IMMEDIATE           (uint64_t)(1LLU << 27)   /*!< Allow immediate off-hook to extension s */
#define IAX_SENDCONNECTEDLINE   (uint64_t)(1LLU << 28)   /*!< Allow sending of connected line updates */
#define IAX_RECVCONNECTEDLINE   (uint64_t)(1LLU << 29)   /*!< Allow receiving of connected line updates */
#define IAX_FORCE_ENCRYPT       (uint64_t)(1LLU << 30)   /*!< Forces call encryption, if encryption not possible hangup */
#define IAX_SHRINKCALLERID      (uint64_t)(1LLU << 31)   /*!< Turn on and off caller id shrinking */
static int global_rtautoclear = 120;

static int reload_config(int forced_reload);

/*!
 * \brief Call token validation settings.
 */
enum calltoken_peer_enum {
        /*! \brief Default calltoken required unless the ip is in the ignorelist */
        CALLTOKEN_DEFAULT = 0,
        /*! \brief Require call token validation. */
        CALLTOKEN_YES = 1,
        /*! \brief Require call token validation after a successful registration
         *         using call token validation occurs. */
        CALLTOKEN_AUTO = 2,
        /*! \brief Do not require call token validation. */
        CALLTOKEN_NO = 3,
};

struct iax2_user {
        AST_DECLARE_STRING_FIELDS(
                AST_STRING_FIELD(name);
                AST_STRING_FIELD(secret);
                AST_STRING_FIELD(dbsecret);
                AST_STRING_FIELD(accountcode);
                AST_STRING_FIELD(mohinterpret);
                AST_STRING_FIELD(mohsuggest);
                AST_STRING_FIELD(inkeys);               /*!< Key(s) this user can use to authenticate to us */
                AST_STRING_FIELD(language);
                AST_STRING_FIELD(cid_num);
                AST_STRING_FIELD(cid_name);
                AST_STRING_FIELD(parkinglot);           /*!< Default parkinglot for device */
        );

        int authmethods;
        int encmethods;
        int amaflags;
        int adsi;
        uint64_t flags;
        iax2_format capability;
        int maxauthreq; /*!< Maximum allowed outstanding AUTHREQs */
        int curauthreq; /*!< Current number of outstanding AUTHREQs */
        struct iax2_codec_pref prefs;
        struct ast_acl_list *acl;
        struct iax2_context *contexts;
        struct ast_variable *vars;
        enum calltoken_peer_enum calltoken_required;        /*!< Is calltoken validation required or not, can be YES, NO, or AUTO */
};

struct iax2_peer {
        AST_DECLARE_STRING_FIELDS(
                AST_STRING_FIELD(name);
                AST_STRING_FIELD(username);
                AST_STRING_FIELD(description);          /*!< Description of the peer */
                AST_STRING_FIELD(secret);
                AST_STRING_FIELD(dbsecret);
                AST_STRING_FIELD(outkey);           /*!< What key we use to talk to this peer */

                AST_STRING_FIELD(regexten);     /*!< Extension to register (if regcontext is used) */
                AST_STRING_FIELD(context);      /*!< For transfers only */
                AST_STRING_FIELD(peercontext);  /*!< Context to pass to peer */
                AST_STRING_FIELD(mailbox);          /*!< Mailbox */
                AST_STRING_FIELD(mohinterpret);
                AST_STRING_FIELD(mohsuggest);
                AST_STRING_FIELD(inkeys);               /*!< Key(s) this peer can use to authenticate to us */
                /* Suggested caller id if registering */
                AST_STRING_FIELD(cid_num);              /*!< Default context (for transfer really) */
                AST_STRING_FIELD(cid_name);             /*!< Default context (for transfer really) */
                AST_STRING_FIELD(zonetag);              /*!< Time Zone */
                AST_STRING_FIELD(parkinglot);   /*!< Default parkinglot for device */
        );
        struct iax2_codec_pref prefs;
        struct ast_dnsmgr_entry *dnsmgr;                /*!< DNS refresh manager */
        struct ast_sockaddr addr;
        int formats;
        int sockfd;                                     /*!< Socket to use for transmission */
        struct ast_sockaddr mask;
        int adsi;
        uint64_t flags;

        /* Dynamic Registration fields */
        struct ast_sockaddr defaddr;                    /*!< Default address if there is one */
        int authmethods;                                /*!< Authentication methods (IAX_AUTH_*) */
        int encmethods;                                 /*!< Encryption methods (IAX_ENCRYPT_*) */

        int expire;                                     /*!< Schedule entry for expiry */
        int expiry;                                     /*!< How soon to expire */
        iax2_format capability;                         /*!< Capability */

        /* Qualification */
        int callno;                                     /*!< Call number of POKE request */
        int pokeexpire;                                 /*!< Scheduled qualification-related task (ie iax2_poke_peer_s or iax2_poke_noanswer) */
        int lastms;                                     /*!< How long last response took (in ms), or -1 for no response */
        int maxms;                                      /*!< Max ms we will accept for the host to be up, 0 to not monitor */

        int pokefreqok;                                 /*!< How often to check if the host is up */
        int pokefreqnotok;                              /*!< How often to check when the host has been determined to be down */
        int historicms;                                 /*!< How long recent average responses took */
        int smoothing;                                  /*!< Sample over how many units to determine historic ms */
        uint16_t maxcallno;                             /*!< Max call number limit for this peer.  Set on registration */

        struct stasis_subscription *mwi_event_sub;      /*!< This subscription lets pollmailboxes know which mailboxes need to be polled */

        struct ast_acl_list *acl;
        enum calltoken_peer_enum calltoken_required;    /*!< Is calltoken validation required or not, can be YES, NO, or AUTO */

        struct ast_endpoint *endpoint; /*!< Endpoint structure for this peer */
};

#define IAX2_TRUNK_PREFACE (sizeof(struct iax_frame) + sizeof(struct ast_iax2_meta_hdr) + sizeof(struct ast_iax2_meta_trunk_hdr))

struct iax2_trunk_peer {
        ast_mutex_t lock;
        int sockfd;
        struct ast_sockaddr addr;
        struct timeval txtrunktime;             /*!< Transmit trunktime */
        struct timeval rxtrunktime;             /*!< Receive trunktime */
        struct timeval lasttxtime;              /*!< Last transmitted trunktime */
        struct timeval trunkact;                /*!< Last trunk activity */
        unsigned int lastsent;                  /*!< Last sent time */
        /* Trunk data and length */
        unsigned char *trunkdata;
        unsigned int trunkdatalen;
        unsigned int trunkdataalloc;
        int trunkmaxmtu;
        int trunkerror;
        int calls;
        AST_LIST_ENTRY(iax2_trunk_peer) list;
};

static AST_LIST_HEAD_STATIC(tpeers, iax2_trunk_peer);

enum iax_reg_state {
        REG_STATE_UNREGISTERED = 0,
        REG_STATE_REGSENT,
        REG_STATE_AUTHSENT,
        REG_STATE_REGISTERED,
        REG_STATE_REJECTED,
        REG_STATE_TIMEOUT,
        REG_STATE_NOAUTH
};

enum iax_transfer_state {
        TRANSFER_NONE = 0,
        TRANSFER_BEGIN,
        TRANSFER_READY,
        TRANSFER_RELEASED,
        TRANSFER_PASSTHROUGH,
        TRANSFER_MBEGIN,
        TRANSFER_MREADY,
        TRANSFER_MRELEASED,
        TRANSFER_MPASSTHROUGH,
        TRANSFER_MEDIA,
        TRANSFER_MEDIAPASS
};

struct iax2_registry {
        struct ast_sockaddr addr;               /*!< Who we connect to for registration purposes */
        char username[80];
        char secret[80];                        /*!< Password or key name in []'s */
        int expire;                             /*!< Sched ID of expiration */
        int refresh;                            /*!< How often to refresh */
        enum iax_reg_state regstate;
        int messages;                           /*!< Message count, low 8 bits = new, high 8 bits = old */
        int callno;                             /*!< Associated call number if applicable */
        struct ast_sockaddr us;                 /*!< Who the server thinks we are */
        struct ast_dnsmgr_entry *dnsmgr;        /*!< DNS refresh manager */
        AST_LIST_ENTRY(iax2_registry) entry;
        int port;
        char hostname[];
};

static AST_LIST_HEAD_STATIC(registrations, iax2_registry);

/* Don't retry more frequently than every 10 ms, or less frequently than every 5 seconds */
#define MIN_RETRY_TIME          100
#define MAX_RETRY_TIME          10000

#define MAX_JITTER_BUFFER       50
#define MIN_JITTER_BUFFER       10

#define DEFAULT_TRUNKDATA       640 * 10        /*!< 40ms, uncompressed linear * 10 channels */

#define MAX_TIMESTAMP_SKEW      160             /*!< maximum difference between actual and predicted ts for sending */

/* If consecutive voice frame timestamps jump by more than this many milliseconds, then jitter buffer will resync */
#define TS_GAP_FOR_JB_RESYNC    5000

/* used for first_iax_message and last_iax_message.  If this bit is set it was TX, else RX */
#define MARK_IAX_SUBCLASS_TX    0x8000

static int iaxthreadcount = DEFAULT_THREAD_COUNT;
static int iaxmaxthreadcount = DEFAULT_MAX_THREAD_COUNT;
static int iaxdynamicthreadcount = 0;
static int iaxdynamicthreadnum = 0;
static int iaxactivethreadcount = 0;

struct iax_rr {
        int jitter;
        int losspct;
        int losscnt;
        int packets;
        int delay;
        int dropped;
        int ooo;
};

struct iax2_pvt_ref;

/* We use the high order bit as the validated flag, and the lower 15 as the
 * actual call number */
typedef uint16_t callno_entry;

struct chan_iax2_pvt {
        /*! Socket to send/receive on for this call */
        int sockfd;
        /*! ast_callid bound to dialog */
        ast_callid callid;
        /*! Last received voice format */
        iax2_format voiceformat;
        /*! Last received video format */
        iax2_format videoformat;
        /*! Last sent voice format */
        iax2_format svoiceformat;
        /*! Last sent video format */
        iax2_format svideoformat;
        /*! What we are capable of sending */
        iax2_format capability;
        /*! Last received timestamp */
        unsigned int last;
        /*! Last sent timestamp - never send the same timestamp twice in a single call */
        unsigned int lastsent;
        /*! Timestamp of the last video frame sent */
        unsigned int lastvsent;
        /*! Next outgoing timestamp if everything is good */
        unsigned int nextpred;
        /*! iax frame subclass that began iax2_pvt entry. 0x8000 bit is set on TX */
        int first_iax_message;
        /*! Last iax frame subclass sent or received for a iax2_pvt. 0x8000 bit is set on TX */
        int last_iax_message;
        /*! True if the last voice we transmitted was not silence/CNG */
        unsigned int notsilenttx:1;
        /*! Ping time */
        unsigned int pingtime;
        /*! Max time for initial response */
        int maxtime;
        /*! Peer Address */
        struct ast_sockaddr addr;
        /*! Actual used codec preferences */
        struct iax2_codec_pref prefs;
        /*! Requested codec preferences */
        struct iax2_codec_pref rprefs;
        /*! Our call number */
        unsigned short callno;
        /*! Our callno_entry entry */
        callno_entry callno_entry;
        /*! Peer callno */
        unsigned short peercallno;
        /*! Negotiated format, this is only used to remember what format was
            chosen for an unauthenticated call so that the channel can get
            created later using the right format */
        iax2_format chosenformat;
        /*! Peer selected format */
        iax2_format peerformat;
        /*! Peer capability */
        iax2_format peercapability;
        /*! timeval that we base our transmission on */
        struct timeval offset;
        /*! timeval that we base our delivery on */
        struct timeval rxcore;
        /*! The jitterbuffer */
        jitterbuf *jb;
        /*! active jb read scheduler id */
        int jbid;
        /*! LAG */
        int lag;
        /*! Error, as discovered by the manager */
        int error;
        /*! Owner if we have one */
        struct ast_channel *owner;
        /*! What's our state? */
        struct ast_flags state;
        /*! Expiry (optional) */
        int expiry;
        /*! Next outgoing sequence number */
        unsigned char oseqno;
        /*! Next sequence number they have not yet acknowledged */
        unsigned char rseqno;
        /*! Next incoming sequence number */
        unsigned char iseqno;
        /*! Last incoming sequence number we have acknowledged */
        unsigned char aseqno;

        AST_DECLARE_STRING_FIELDS(
                /*! Peer name */
                AST_STRING_FIELD(peer);
                /*! Default Context */
                AST_STRING_FIELD(context);
                /*! Caller ID if available */
                AST_STRING_FIELD(cid_num);
                AST_STRING_FIELD(cid_name);
                /*! Hidden Caller ID (i.e. ANI) if appropriate */
                AST_STRING_FIELD(ani);
                /*! DNID */
                AST_STRING_FIELD(dnid);
                /*! RDNIS */
                AST_STRING_FIELD(rdnis);
                /*! Requested Extension */
                AST_STRING_FIELD(exten);
                /*! Expected Username */
                AST_STRING_FIELD(username);
                /*! Expected Secret */
                AST_STRING_FIELD(secret);
                /*! MD5 challenge */
                AST_STRING_FIELD(challenge);
                /*! Public keys permitted keys for incoming authentication */
                AST_STRING_FIELD(inkeys);
                /*! Private key for outgoing authentication */
                AST_STRING_FIELD(outkey);
                /*! Preferred language */
                AST_STRING_FIELD(language);
                /*! Hostname/peername for naming purposes */
                AST_STRING_FIELD(host);

                AST_STRING_FIELD(dproot);
                AST_STRING_FIELD(accountcode);
                AST_STRING_FIELD(mohinterpret);
                AST_STRING_FIELD(mohsuggest);
                /*! received OSP token */
                AST_STRING_FIELD(osptoken);
                /*! Default parkinglot */
                AST_STRING_FIELD(parkinglot);
        );
        /*! AUTHREJ all AUTHREP frames */
        int authrej;
        /*! permitted authentication methods */
        int authmethods;
        /*! permitted encryption methods */
        int encmethods;
        /*! Encryption AES-128 Key */
        ast_aes_encrypt_key ecx;
        /*! Decryption AES-128 Key corresponding to ecx */
        ast_aes_decrypt_key mydcx;
        /*! Decryption AES-128 Key used to decrypt peer frames */
        ast_aes_decrypt_key dcx;
        /*! scheduler id associated with iax_key_rotate
         * for encrypted calls*/
        int keyrotateid;
        /*! 32 bytes of semi-random data */
        unsigned char semirand[32];
        /*! Associated registry */
        struct iax2_registry *reg;
        /*! Associated peer for poking */
        struct iax2_peer *peerpoke;
        /*! IAX_ flags */
        uint64_t flags;
        int adsi;

        /*! Transferring status */
        enum iax_transfer_state transferring;
        /*! Transfer identifier */
        int transferid;
        /*! Who we are IAX transferring to */
        struct ast_sockaddr transfer;
        /*! What's the new call number for the transfer */
        unsigned short transfercallno;
        /*! Transfer encrypt AES-128 Key */
        ast_aes_encrypt_key tdcx;

        /*! Status of knowledge of peer ADSI capability */
        int peeradsicpe;

        /*! Callno of native bridge peer. (Valid if nonzero) */
        unsigned short bridgecallno;

        int pingid;                     /*!< Transmit PING request */
        int lagid;                      /*!< Retransmit lag request */
        int autoid;                     /*!< Auto hangup for Dialplan requestor */
        int authid;                     /*!< Authentication rejection ID */
        int authfail;                   /*!< Reason to report failure */
        int initid;                     /*!< Initial peer auto-congest ID (based on qualified peers) */
        int calling_ton;
        int calling_tns;
        int calling_pres;
        int amaflags;
        AST_LIST_HEAD_NOLOCK(, iax2_dpcache) dpentries;
        /*! variables inherited from the user definition */
        struct ast_variable *vars;
        /*! variables transmitted in a NEW packet */
        struct ast_variable *iaxvars;
        /*! last received remote rr */
        struct iax_rr remote_rr;
        /*! Current base time: (just for stats) */
        int min;
        /*! Dropped frame count: (just for stats) */
        int frames_dropped;
        /*! received frame count: (just for stats) */
        int frames_received;
        /*! Destroying this call initiated. */
        int destroy_initiated;
        /*! num bytes used for calltoken ie, even an empty ie should contain 2 */
        unsigned char calltoken_ie_len;
        /*! hold all signaling frames from the pbx thread until we have a destination callno */
        char hold_signaling;
        /*! frame queue for signaling frames from pbx thread waiting for destination callno */
        AST_LIST_HEAD_NOLOCK(signaling_queue, signaling_queue_entry) signaling_queue;
};

struct signaling_queue_entry {
        struct ast_frame f;
        AST_LIST_ENTRY(signaling_queue_entry) next;
};

enum callno_type {
        CALLNO_TYPE_NORMAL,
        CALLNO_TYPE_TRUNK,
};

#define PTR_TO_CALLNO_ENTRY(a) ((uint16_t)(unsigned long)(a))
#define CALLNO_ENTRY_TO_PTR(a) ((void *)(unsigned long)(a))

#define CALLNO_ENTRY_SET_VALIDATED(a) ((a) |= 0x8000)
#define CALLNO_ENTRY_IS_VALIDATED(a)  ((a) & 0x8000)
#define CALLNO_ENTRY_GET_CALLNO(a)    ((a) & 0x7FFF)

struct call_number_pool {
        size_t capacity;
        size_t available;
        callno_entry numbers[IAX_MAX_CALLS / 2 + 1];
};

AST_MUTEX_DEFINE_STATIC(callno_pool_lock);

/*! table of available call numbers */
static struct call_number_pool callno_pool;

/*! table of available trunk call numbers */
static struct call_number_pool callno_pool_trunk;

/*!
 * \brief a list of frames that may need to be retransmitted
 *
 * \note The contents of this list do not need to be explicitly destroyed
 * on module unload.  This is because all active calls are destroyed, and
 * all frames in this queue will get destroyed as a part of that process.
 *
 * \note Contents protected by the iaxsl[] locks
 */
static AST_LIST_HEAD_NOLOCK(, iax_frame) frame_queue[IAX_MAX_CALLS];

static struct ast_taskprocessor *transmit_processor;

static int randomcalltokendata;

static time_t max_calltoken_delay = 10;

/*!
 * This module will get much higher performance when doing a lot of
 * user and peer lookups if the number of buckets is increased from 1.
 * However, to maintain old behavior for Asterisk 1.4, these are set to
 * 1 by default.  When using multiple buckets, search order through these
 * containers is considered random, so you will not be able to depend on
 * the order the entires are specified in iax.conf for matching order. */
#ifdef LOW_MEMORY
#define MAX_PEER_BUCKETS 17
#else
#define MAX_PEER_BUCKETS 563
#endif
static struct ao2_container *peers;

#define MAX_USER_BUCKETS MAX_PEER_BUCKETS
static struct ao2_container *users;

/*! Table containing peercnt objects for every ip address consuming a callno */
static struct ao2_container *peercnts;

/*! Table containing custom callno limit rules for a range of ip addresses. */
static struct ao2_container *callno_limits;

/*! Table containing ip addresses not requiring calltoken validation */
static struct ao2_container *calltoken_ignores;

static uint16_t DEFAULT_MAXCALLNO_LIMIT = 2048;

static uint16_t DEFAULT_MAXCALLNO_LIMIT_NONVAL = 8192;

static uint16_t global_maxcallno;

/*! Total num of call numbers allowed to be allocated without calltoken validation */
static uint16_t global_maxcallno_nonval;

static uint16_t total_nonval_callno_used = 0;

/*! peer connection private, keeps track of all the call numbers
 *  consumed by a single ip address */
struct peercnt {
        /*! ip address consuming call numbers */
        struct ast_sockaddr addr;
        /*! Number of call numbers currently used by this ip address */
        uint16_t cur;
        /*! Max call numbers allowed for this ip address */
        uint16_t limit;
        /*! Specifies whether limit is set by a registration or not, if so normal
         *  limit setting rules do not apply to this address. */
        unsigned char reg;
};

/*! used by both callno_limits and calltoken_ignores containers */
struct addr_range {
        /*! ip address range for custom callno limit rule */
        struct ast_ha ha;
        /*! callno limit for this ip address range, only used in callno_limits container */
        uint16_t limit;
        /*! delete me marker for reloads */
        unsigned char delme;
};

enum {
        /*! Extension exists */
        CACHE_FLAG_EXISTS      = (1 << 0),
        /*! Extension is nonexistent */
        CACHE_FLAG_NONEXISTENT = (1 << 1),
        /*! Extension can exist */
        CACHE_FLAG_CANEXIST    = (1 << 2),
        /*! Waiting to hear back response */
        CACHE_FLAG_PENDING     = (1 << 3),
        /*! Timed out */
        CACHE_FLAG_TIMEOUT     = (1 << 4),
        /*! Request transmitted */
        CACHE_FLAG_TRANSMITTED = (1 << 5),
        /*! Timeout */
        CACHE_FLAG_UNKNOWN     = (1 << 6),
        /*! Matchmore */
        CACHE_FLAG_MATCHMORE   = (1 << 7),
};

struct iax2_dpcache {
        char peercontext[AST_MAX_CONTEXT];
        char exten[AST_MAX_EXTENSION];
        struct timeval orig;
        struct timeval expiry;
        int flags;
        unsigned short callno;
        int waiters[256];
        AST_LIST_ENTRY(iax2_dpcache) cache_list;
        AST_LIST_ENTRY(iax2_dpcache) peer_list;
};

static AST_LIST_HEAD_STATIC(dpcache, iax2_dpcache);

static void reg_source_db(struct iax2_peer *p);
static struct iax2_peer *realtime_peer(const char *peername, struct ast_sockaddr *addr);
static struct iax2_user *realtime_user(const char *username, struct ast_sockaddr *addr);

static int ast_cli_netstats(struct mansession *s, int fd, int limit_fmt);
static char *complete_iax2_peers(const char *line, const char *word, int pos, int state, uint64_t flags);
static char *complete_iax2_unregister(const char *line, const char *word, int pos, int state);

enum iax2_thread_iostate {
        IAX_IOSTATE_IDLE,
        IAX_IOSTATE_READY,
        IAX_IOSTATE_PROCESSING,
        IAX_IOSTATE_SCHEDREADY,
};

enum iax2_thread_type {
        IAX_THREAD_TYPE_POOL,
        IAX_THREAD_TYPE_DYNAMIC,
};

struct iax2_pkt_buf {
        AST_LIST_ENTRY(iax2_pkt_buf) entry;
        size_t len;
        unsigned char buf[1];
};

struct iax2_thread {
        AST_LIST_ENTRY(iax2_thread) list;
        enum iax2_thread_type type;
        enum iax2_thread_iostate iostate;
#ifdef SCHED_MULTITHREADED
        void (*schedfunc)(const void *);
        const void *scheddata;
#endif
#ifdef DEBUG_SCHED_MULTITHREAD
        char curfunc[80];
#endif
        int actions;
        pthread_t threadid;
        int threadnum;
        struct ast_sockaddr ioaddr;
        unsigned char readbuf[4096];
        unsigned char *buf;
        ssize_t buf_len;
        size_t buf_size;
        int iofd;
        time_t checktime;
        ast_mutex_t lock;
        ast_cond_t cond;
        ast_mutex_t init_lock;
        ast_cond_t init_cond;
        /*! if this thread is processing a full frame,
          some information about that frame will be stored
          here, so we can avoid dispatching any more full
          frames for that callno to other threads */
        struct {
                unsigned short callno;
                struct ast_sockaddr addr;
                unsigned char type;
                unsigned char csub;
        } ffinfo;
        /*! Queued up full frames for processing.  If more full frames arrive for
         *  a call which this thread is already processing a full frame for, they
         *  are queued up here. */
        AST_LIST_HEAD_NOLOCK(, iax2_pkt_buf) full_frames;
        unsigned char stop;
};

/* Thread lists */
static AST_LIST_HEAD_STATIC(idle_list, iax2_thread);
static AST_LIST_HEAD_STATIC(active_list, iax2_thread);
static AST_LIST_HEAD_STATIC(dynamic_list, iax2_thread);

static void *iax2_process_thread(void *data);
static void iax2_destroy(int callno);

static void signal_condition(ast_mutex_t *lock, ast_cond_t *cond)
{
        ast_mutex_lock(lock);
        ast_cond_signal(cond);
        ast_mutex_unlock(lock);
}

/*!
 * \brief an array of iax2 pvt structures
 *
 * The container for active chan_iax2_pvt structures is implemented as an
 * array for extremely quick direct access to the correct pvt structure
 * based on the local call number.  The local call number is used as the
 * index into the array where the associated pvt structure is stored.
 */
static struct chan_iax2_pvt *iaxs[IAX_MAX_CALLS];

static ast_callid iax_pvt_callid_get(int callno)
{
        return iaxs[callno]->callid;
}

static void iax_pvt_callid_set(int callno, ast_callid callid)
{
        iaxs[callno]->callid = callid;
}

static void iax_pvt_callid_new(int callno)
{
        ast_callid callid = ast_create_callid();
        char buffer[AST_CALLID_BUFFER_LENGTH];
        ast_callid_strnprint(buffer, sizeof(buffer), callid);
        iax_pvt_callid_set(callno, callid);
}

/*!
 * \brief Another container of iax2_pvt structures
 *
 * Active IAX2 pvt structs are also stored in this container, if they are a part
 * of an active call where we know the remote side's call number.  The reason
 * for this is that incoming media frames do not contain our call number.  So,
 * instead of having to iterate the entire iaxs array, we use this container to
 * look up calls where the remote side is using a given call number.
 */
static struct ao2_container *iax_peercallno_pvts;

/*!
 * \brief chan_iax2_pvt structure locks
 *
 * These locks are used when accessing a pvt structure in the iaxs array.
 * The index used here is the same as used in the iaxs array.  It is the
 * local call number for the associated pvt struct.
 */
static ast_mutex_t iaxsl[ARRAY_LEN(iaxs)];

/*!
 *  * \brief Another container of iax2_pvt structures
 *
 *  Active IAX2 pvt stucts used during transfering a call are stored here.
 */
static struct ao2_container *iax_transfercallno_pvts;

/* Flag to use with trunk calls, keeping these calls high up.  It halves our effective use
   but keeps the division between trunked and non-trunked better. */
#define TRUNK_CALL_START        (IAX_MAX_CALLS / 2)

/* Debug routines... */
static struct ast_sockaddr debugaddr;

static void iax_outputframe(struct iax_frame *f, struct ast_iax2_full_hdr *fhi, int rx, struct ast_sockaddr *addr, int datalen)
{
        if (iaxdebug ||
            (addr && !ast_sockaddr_isnull(&debugaddr) &&
                (!ast_sockaddr_port(&debugaddr) ||
                  ast_sockaddr_port(&debugaddr) == ast_sockaddr_port(addr)) &&
                  !ast_sockaddr_cmp_addr(&debugaddr, addr))) {

                if (iaxdebug) {
                        iax_showframe(f, fhi, rx, addr, datalen);
                } else {
                        iaxdebug = 1;
                        iax_showframe(f, fhi, rx, addr, datalen);
                        iaxdebug = 0;
                }
        }
}

static void iax_debug_output(const char *data)
{
        if (iaxdebug)
                ast_verbose("%s", data);
}

static void iax_error_output(const char *data)
{
        ast_log(LOG_WARNING, "%s", data);
}

static void __attribute__((format(printf, 1, 2))) jb_error_output(const char *fmt, ...)
{
        va_list args;
        char buf[1024];

        va_start(args, fmt);
        vsnprintf(buf, sizeof(buf), fmt, args);
        va_end(args);

        ast_log(LOG_ERROR, "%s", buf);
}

static void __attribute__((format(printf, 1, 2))) jb_warning_output(const char *fmt, ...)
{
        va_list args;
        char buf[1024];

        va_start(args, fmt);
        vsnprintf(buf, sizeof(buf), fmt, args);
        va_end(args);

        ast_log(LOG_WARNING, "%s", buf);
}

static void __attribute__((format(printf, 1, 2))) jb_debug_output(const char *fmt, ...)
{
        va_list args;
        char buf[1024];

        va_start(args, fmt);
        vsnprintf(buf, sizeof(buf), fmt, args);
        va_end(args);

        ast_verbose("%s", buf);
}

static int expire_registry(const void *data);
static int iax2_answer(struct ast_channel *c);
static int iax2_call(struct ast_channel *c, const char *dest, int timeout);
static int iax2_devicestate(const char *data);
static int iax2_digit_begin(struct ast_channel *c, char digit);
static int iax2_digit_end(struct ast_channel *c, char digit, unsigned int duration);
static int iax2_do_register(struct iax2_registry *reg);
static int iax2_fixup(struct ast_channel *oldchannel, struct ast_channel *newchan);
static int iax2_hangup(struct ast_channel *c);
static int iax2_indicate(struct ast_channel *c, int condition, const void *data, size_t datalen);
static int iax2_poke_peer(struct iax2_peer *peer, int heldcall);
static int iax2_provision(struct ast_sockaddr *end, int sockfd, const char *dest, const char *template, int force);
static int iax2_send(struct chan_iax2_pvt *pvt, struct ast_frame *f, unsigned int ts, int seqno, int now, int transfer, int final);
static int iax2_sendhtml(struct ast_channel *c, int subclass, const char *data, int datalen);
static int iax2_sendimage(struct ast_channel *c, struct ast_frame *img);
static int iax2_sendtext(struct ast_channel *c, const char *text);
static int iax2_setoption(struct ast_channel *c, int option, void *data, int datalen);
static int iax2_queryoption(struct ast_channel *c, int option, void *data, int *datalen);
static int iax2_transfer(struct ast_channel *c, const char *dest);
static int iax2_write(struct ast_channel *c, struct ast_frame *f);
static int iax2_sched_add(struct ast_sched_context *sched, int when, ast_sched_cb callback, const void *data);

static int send_trunk(struct iax2_trunk_peer *tpeer, struct timeval *now);
static int send_command(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_final(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_immediate(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_locked(unsigned short callno, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_transfer(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int);
static struct ast_channel *iax2_request(const char *type, struct ast_format_cap *cap, const struct ast_assigned_ids *assignedids, const struct ast_channel *requestor, const char *data, int *cause);
static struct ast_frame *iax2_read(struct ast_channel *c);
static struct iax2_peer *build_peer(const char *name, struct ast_variable *v, struct ast_variable *alt, int temponly);
static struct iax2_user *build_user(const char *name, struct ast_variable *v, struct ast_variable *alt, int temponly);
static void realtime_update_peer(const char *peername, struct ast_sockaddr *sockaddr, time_t regtime);
static void *iax2_dup_variable_datastore(void *);
static void prune_peers(void);
static void prune_users(void);
static void iax2_free_variable_datastore(void *);

static int acf_channel_read(struct ast_channel *chan, const char *funcname, char *preparse, char *buf, size_t buflen);
static int decode_frame(ast_aes_decrypt_key *dcx, struct ast_iax2_full_hdr *fh, struct ast_frame *f, int *datalen);
static int encrypt_frame(ast_aes_encrypt_key *ecx, struct ast_iax2_full_hdr *fh, unsigned char *poo, int *datalen);
static void build_ecx_key(const unsigned char *digest, struct chan_iax2_pvt *pvt);
static void build_rand_pad(unsigned char *buf, ssize_t len);
static int get_unused_callno(enum callno_type type, int validated, callno_entry *entry);
static int replace_callno(const void *obj);
static void sched_delay_remove(struct ast_sockaddr *addr, callno_entry entry);
static void network_change_stasis_cb(void *data, struct stasis_subscription *sub, struct stasis_message *message);
static void acl_change_stasis_cb(void *data, struct stasis_subscription *sub, struct stasis_message *message);

static struct ast_channel_tech iax2_tech = {
        .type = "IAX2",
        .description = tdesc,
        .properties = AST_CHAN_TP_WANTSJITTER,
        .requester = iax2_request,
        .devicestate = iax2_devicestate,
        .send_digit_begin = iax2_digit_begin,
        .send_digit_end = iax2_digit_end,
        .send_text = iax2_sendtext,
        .send_image = iax2_sendimage,
        .send_html = iax2_sendhtml,
        .call = iax2_call,
        .hangup = iax2_hangup,
        .answer = iax2_answer,
        .read = iax2_read,
        .write = iax2_write,
        .write_video = iax2_write,
        .indicate = iax2_indicate,
        .setoption = iax2_setoption,
        .queryoption = iax2_queryoption,
        .transfer = iax2_transfer,
        .fixup = iax2_fixup,
        .func_channel_read = acf_channel_read,
};

/*!
 * \internal
 * \brief Obtain the owner channel lock if the owner exists.
 *
 * \param callno IAX2 call id.
 *
 * \note Assumes the iaxsl[callno] lock is already obtained.
 *
 * \note
 * IMPORTANT NOTE!!!  Any time this function is used, even if
 * iaxs[callno] was valid before calling it, it may no longer be
 * valid after calling it.  This function may unlock and lock
 * the mutex associated with this callno, meaning that another
 * thread may grab it and destroy the call.
 *
 * \return Nothing
 */
static void iax2_lock_owner(int callno)
{
        for (;;) {
                if (!iaxs[callno] || !iaxs[callno]->owner) {
                        /* There is no owner lock to get. */
                        break;
                }
                if (!ast_channel_trylock(iaxs[callno]->owner)) {
                        /* We got the lock */
                        break;
                }
                /* Avoid deadlock by pausing and trying again */
                DEADLOCK_AVOIDANCE(&iaxsl[callno]);
        }
}

/*!
 * \internal
 * \brief Check if a control subtype is allowed on the wire.
 *
 * \param subtype Control frame subtype to check if allowed to/from the wire.
 *
 * \retval non-zero if allowed.
 */
static int iax2_is_control_frame_allowed(int subtype)
{
        enum ast_control_frame_type control = subtype;
        int is_allowed;

        /*
         * Note: If we compare the enumeration type, which does not have any
         * negative constants, the compiler may optimize this code away.
         * Therefore, we must perform an integer comparison here.
         */
        if (subtype == -1) {
                return -1;
        }

        /* Default to not allowing control frames to pass. */
        is_allowed = 0;

        /*
         * The switch default is not present in order to take advantage
         * of the compiler complaining of a missing enum case.
         */
        switch (control) {
        /*
         * These control frames make sense to send/receive across the link.
         */
        case AST_CONTROL_HANGUP:
        case AST_CONTROL_RING:
        case AST_CONTROL_RINGING:
        case AST_CONTROL_ANSWER:
        case AST_CONTROL_BUSY:
        case AST_CONTROL_TAKEOFFHOOK:
        case AST_CONTROL_OFFHOOK:
        case AST_CONTROL_CONGESTION:
        case AST_CONTROL_FLASH:
        case AST_CONTROL_WINK:
        case AST_CONTROL_OPTION:
        case AST_CONTROL_RADIO_KEY:
        case AST_CONTROL_RADIO_UNKEY:
        case AST_CONTROL_PROGRESS:
        case AST_CONTROL_PROCEEDING:
        case AST_CONTROL_HOLD:
        case AST_CONTROL_UNHOLD:
        case AST_CONTROL_VIDUPDATE:
        case AST_CONTROL_CONNECTED_LINE:
        case AST_CONTROL_REDIRECTING:
        case AST_CONTROL_T38_PARAMETERS:
        case AST_CONTROL_AOC:
        case AST_CONTROL_INCOMPLETE:
        case AST_CONTROL_MCID:
                is_allowed = -1;
                break;

        /*
         * These control frames do not make sense to send/receive across the link.
         */
        case _XXX_AST_CONTROL_T38:
                /* The control value is deprecated in favor of AST_CONTROL_T38_PARAMETERS. */
        case AST_CONTROL_SRCUPDATE:
                /* Across an IAX link the source is still the same. */
        case AST_CONTROL_TRANSFER:
                /* A success/fail status report from calling ast_transfer() on this machine. */
        case AST_CONTROL_CC:
                /* The payload contains pointers that are valid for the sending machine only. */
        case AST_CONTROL_SRCCHANGE:
                /* Across an IAX link the source is still the same. */
        case AST_CONTROL_READ_ACTION:
                /* The action can only be done by the sending machine. */
        case AST_CONTROL_END_OF_Q:
                /* This frame would cause the call to unexpectedly hangup. */
        case AST_CONTROL_UPDATE_RTP_PEER:
                /* Only meaningful across a bridge on this machine for direct-media exchange. */
        case AST_CONTROL_PVT_CAUSE_CODE:
                /* Intended only for the sending machine's local channel structure. */
        case AST_CONTROL_MASQUERADE_NOTIFY:
                /* Intended only for masquerades when calling ast_indicate_data(). */
        case AST_CONTROL_STREAM_STOP:
        case AST_CONTROL_STREAM_SUSPEND:
        case AST_CONTROL_STREAM_RESTART:
        case AST_CONTROL_STREAM_REVERSE:
        case AST_CONTROL_STREAM_FORWARD:
                /* None of these playback stream control frames should go across the link. */
        case AST_CONTROL_RECORD_CANCEL:
        case AST_CONTROL_RECORD_STOP:
        case AST_CONTROL_RECORD_SUSPEND:
        case AST_CONTROL_RECORD_MUTE:
                /* None of these media recording control frames should go across the link. */
                break;
        }
        return is_allowed;
}

static void network_change_stasis_subscribe(void)
{
        if (!network_change_sub) {
                network_change_sub = stasis_subscribe(ast_system_topic(),
                        network_change_stasis_cb, NULL);
        }
}

static void network_change_stasis_unsubscribe(void)
{
        network_change_sub = stasis_unsubscribe_and_join(network_change_sub);
}

static void acl_change_stasis_subscribe(void)
{
        if (!acl_change_sub) {
                acl_change_sub = stasis_subscribe(ast_security_topic(),
                        acl_change_stasis_cb, NULL);
        }
}

static void acl_change_stasis_unsubscribe(void)
{
        acl_change_sub = stasis_unsubscribe_and_join(acl_change_sub);
}

static int network_change_sched_cb(const void *data)
{
        struct iax2_registry *reg;
        network_change_sched_id = -1;
        AST_LIST_LOCK(&registrations);
        AST_LIST_TRAVERSE(&registrations, reg, entry) {
                iax2_do_register(reg);
        }
        AST_LIST_UNLOCK(&registrations);

        return 0;
}

static void network_change_stasis_cb(void *data, struct stasis_subscription *sub,
        struct stasis_message *message)
{
        /* This callback is only concerned with network change messages from the system topic. */
        if (stasis_message_type(message) != ast_network_change_type()) {
                return;
        }

        ast_verb(1, "IAX, got a network change message, renewing all IAX registrations.\n");
        if (network_change_sched_id == -1) {
                network_change_sched_id = iax2_sched_add(sched, 1000, network_change_sched_cb, NULL);
        }
}

static void acl_change_stasis_cb(void *data, struct stasis_subscription *sub,
        struct stasis_message *message)
{
        if (stasis_message_type(message) != ast_named_acl_change_type()) {
                return;
        }

        ast_log(LOG_NOTICE, "Reloading chan_iax2 in response to ACL change event.\n");
        reload_config(1);
}

static const struct ast_datastore_info iax2_variable_datastore_info = {
        .type = "IAX2_VARIABLE",
        .duplicate = iax2_dup_variable_datastore,
        .destroy = iax2_free_variable_datastore,
};

static void *iax2_dup_variable_datastore(void *old)
{
        AST_LIST_HEAD(, ast_var_t) *oldlist = old, *newlist;
        struct ast_var_t *oldvar, *newvar;

        newlist = ast_calloc(sizeof(*newlist), 1);
        if (!newlist) {
                ast_log(LOG_ERROR, "Unable to duplicate iax2 variables\n");
                return NULL;
        }

        AST_LIST_HEAD_INIT(newlist);
        AST_LIST_LOCK(oldlist);
        AST_LIST_TRAVERSE(oldlist, oldvar, entries) {
                newvar = ast_var_assign(ast_var_name(oldvar), ast_var_value(oldvar));
                if (newvar)
                        AST_LIST_INSERT_TAIL(newlist, newvar, entries);
                else
                        ast_log(LOG_ERROR, "Unable to duplicate iax2 variable '%s'\n", ast_var_name(oldvar));
        }
        AST_LIST_UNLOCK(oldlist);
        return newlist;
}

static void iax2_free_variable_datastore(void *old)
{
        AST_LIST_HEAD(, ast_var_t) *oldlist = old;
        struct ast_var_t *oldvar;

        AST_LIST_LOCK(oldlist);
        while ((oldvar = AST_LIST_REMOVE_HEAD(oldlist, entries))) {
                ast_free(oldvar);
        }
        AST_LIST_UNLOCK(oldlist);
        AST_LIST_HEAD_DESTROY(oldlist);
        ast_free(oldlist);
}


/* WARNING: insert_idle_thread should only ever be called within the
 * context of an iax2_process_thread() thread.
 */
static void insert_idle_thread(struct iax2_thread *thread)
{
        if (thread->type == IAX_THREAD_TYPE_DYNAMIC) {
                AST_LIST_LOCK(&dynamic_list);
                AST_LIST_INSERT_TAIL(&dynamic_list, thread, list);
                AST_LIST_UNLOCK(&dynamic_list);
        } else {
                AST_LIST_LOCK(&idle_list);
                AST_LIST_INSERT_TAIL(&idle_list, thread, list);
                AST_LIST_UNLOCK(&idle_list);
        }

        return;
}

static struct iax2_thread *find_idle_thread(void)
{
        struct iax2_thread *thread = NULL;

        /* Pop the head of the idle list off */
        AST_LIST_LOCK(&idle_list);
        thread = AST_LIST_REMOVE_HEAD(&idle_list, list);
        AST_LIST_UNLOCK(&idle_list);

        /* If we popped a thread off the idle list, just return it */
        if (thread) {
                memset(&thread->ffinfo, 0, sizeof(thread->ffinfo));
                return thread;
        }

        /* Pop the head of the dynamic list off */
        AST_LIST_LOCK(&dynamic_list);
        thread = AST_LIST_REMOVE_HEAD(&dynamic_list, list);
        AST_LIST_UNLOCK(&dynamic_list);

        /* If we popped a thread off the dynamic list, just return it */
        if (thread) {
                memset(&thread->ffinfo, 0, sizeof(thread->ffinfo));
                return thread;
        }

        /* If we can't create a new dynamic thread for any reason, return no thread at all */
        if (iaxdynamicthreadcount >= iaxmaxthreadcount || !(thread = ast_calloc(1, sizeof(*thread))))
                return NULL;

        /* Set default values */
        ast_atomic_fetchadd_int(&iaxdynamicthreadcount, 1);
        thread->threadnum = ast_atomic_fetchadd_int(&iaxdynamicthreadnum, 1);
        thread->type = IAX_THREAD_TYPE_DYNAMIC;

        /* Initialize lock and condition */
        ast_mutex_init(&thread->lock);
        ast_cond_init(&thread->cond, NULL);
        ast_mutex_init(&thread->init_lock);
        ast_cond_init(&thread->init_cond, NULL);
        ast_mutex_lock(&thread->init_lock);

        /* Create thread and send it on it's way */
        if (ast_pthread_create_background(&thread->threadid, NULL, iax2_process_thread, thread)) {
                ast_cond_destroy(&thread->cond);
                ast_mutex_destroy(&thread->lock);
                ast_mutex_unlock(&thread->init_lock);
                ast_cond_destroy(&thread->init_cond);
                ast_mutex_destroy(&thread->init_lock);
                ast_free(thread);
                return NULL;
        }

        /* this thread is not processing a full frame (since it is idle),
           so ensure that the field for the full frame call number is empty */
        memset(&thread->ffinfo, 0, sizeof(thread->ffinfo));

        /* Wait for the thread to be ready before returning it to the caller */
        ast_cond_wait(&thread->init_cond, &thread->init_lock);

        /* Done with init_lock */
        ast_mutex_unlock(&thread->init_lock);

        return thread;
}

#ifdef SCHED_MULTITHREADED
static int __schedule_action(void (*func)(const void *data), const void *data, const char *funcname)
{
        struct iax2_thread *thread;
        static time_t lasterror;
        time_t t;

        thread = find_idle_thread();
        if (thread != NULL) {
                thread->schedfunc = func;
                thread->scheddata = data;
                thread->iostate = IAX_IOSTATE_SCHEDREADY;
#ifdef DEBUG_SCHED_MULTITHREAD
                ast_copy_string(thread->curfunc, funcname, sizeof(thread->curfunc));
#endif
                signal_condition(&thread->lock, &thread->cond);
                return 0;
        }
        time(&t);
        if (t != lasterror) {
                lasterror = t;
                ast_debug(1, "Out of idle IAX2 threads for scheduling! (%s)\n", funcname);
        }

        return -1;
}
#define schedule_action(func, data) __schedule_action(func, data, __PRETTY_FUNCTION__)
#endif

static int iax2_sched_replace(int id, struct ast_sched_context *con, int when,
                ast_sched_cb callback, const void *data)
{
        return ast_sched_replace(id, con, when, callback, data);
}

static int iax2_sched_add(struct ast_sched_context *con, int when,
                ast_sched_cb callback, const void *data)
{
        return ast_sched_add(con, when, callback, data);
}

/*
 * \brief Acquire the iaxsl[callno] if call exists and not having ongoing hangup.
 * \param callno Call number to lock.
 * \return 0 If call disappeared or has ongoing hangup procedure. 1 If call found and mutex is locked.
 */
static int iax2_lock_callno_unless_destroyed(int callno)
{
        ast_mutex_lock(&iaxsl[callno]);

        /* We acquired the lock; but the call was already destroyed (we came after full hang up procedures)
         * or destroy initiated (in middle of hang up procedure. */
        if (!iaxs[callno] || iaxs[callno]->destroy_initiated) {
                ast_debug(3, "I wanted to lock callno %d, but it is dead or going to die.\n", callno);
                ast_mutex_unlock(&iaxsl[callno]);
                return 0;
        }

        /* Lock acquired, and callno is alive and kicking. */
        return 1;
}

static int send_ping(const void *data);

static void __send_ping(const void *data)
{
        int callno = PTR_TO_CALLNO(data);

        if (iax2_lock_callno_unless_destroyed(callno) == 0) {
                ast_debug(3, "Hangup initiated on call %d, aborting __send_ping\n", callno);
                return;
        }

        /* Mark pingid as invalid scheduler id. */
        iaxs[callno]->pingid = -1;

        /* callno is now locked. */
        if (iaxs[callno]->peercallno) {
                /* Send PING packet. */
                send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_PING, 0, NULL, 0, -1);

                /* Schedule sending next ping. */
                iaxs[callno]->pingid = iax2_sched_add(sched, ping_time * 1000, send_ping, data);
        }

        ast_mutex_unlock(&iaxsl[callno]);
}

static int send_ping(const void *data)
{
#ifdef SCHED_MULTITHREADED
        if (schedule_action(__send_ping, data))
#endif
                __send_ping(data);

        return 0;
}

static void encmethods_to_str(int e, struct ast_str **buf)
{
        ast_str_set(buf, 0, "(");
        if (e & IAX_ENCRYPT_AES128) {
                ast_str_append(buf, 0, "aes128");
        }
        if (e & IAX_ENCRYPT_KEYROTATE) {
                ast_str_append(buf, 0, ",keyrotate");
        }
        if (ast_str_strlen(*buf) > 1) {
                ast_str_append(buf, 0, ")");
        } else {
                ast_str_set(buf, 0, "No");
        }
}

static int get_encrypt_methods(const char *s)
{
        int e;
        if (!strcasecmp(s, "aes128"))
                e = IAX_ENCRYPT_AES128 | IAX_ENCRYPT_KEYROTATE;
        else if (ast_true(s))
                e = IAX_ENCRYPT_AES128 | IAX_ENCRYPT_KEYROTATE;
        else
                e = 0;
        return e;
}

static int send_lagrq(const void *data);

static void __send_lagrq(const void *data)
{
        int callno = PTR_TO_CALLNO(data);

        if (iax2_lock_callno_unless_destroyed(callno) == 0) {
                ast_debug(3, "Hangup initiated on call %d, aborting __send_lagrq\n", callno);
                return;
        }

        /* Mark lagid as invalid scheduler id. */
        iaxs[callno]->lagid = -1;

        /* callno is now locked. */
        if (iaxs[callno]->peercallno) {
                /* Send LAGRQ packet. */
                send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_LAGRQ, 0, NULL, 0, -1);

                /* Schedule sending next lagrq. */
                iaxs[callno]->lagid = iax2_sched_add(sched, lagrq_time * 1000, send_lagrq, data);
        }

        ast_mutex_unlock(&iaxsl[callno]);
}

static int send_lagrq(const void *data)
{
#ifdef SCHED_MULTITHREADED
        if (schedule_action(__send_lagrq, data))
#endif
                __send_lagrq(data);
        return 0;
}

static unsigned char compress_subclass(iax2_format subclass)
{
        int x;
        int power=-1;
        /* If it's 64 or smaller, just return it */
        if (subclass < IAX_FLAG_SC_LOG)
                return subclass;
        /* Otherwise find its power */
        for (x = 0; x < IAX_MAX_SHIFT; x++) {
                if (subclass & (1LL << x)) {
                        if (power > -1) {
                                ast_log(LOG_WARNING, "Can't compress subclass %lld\n", (long long) subclass);
                                return 0;
                        } else
                                power = x;
                }
        }
        return power | IAX_FLAG_SC_LOG;
}

static iax2_format uncompress_subclass(unsigned char csub)
{
        /* If the SC_LOG flag is set, return 2^csub otherwise csub */
        if (csub & IAX_FLAG_SC_LOG) {
                /* special case for 'compressed' -1 */
                if (csub == 0xff)
                        return -1;
                else
                        return 1LL << (csub & ~IAX_FLAG_SC_LOG & IAX_MAX_SHIFT);
        }
        else
                return csub;
}

static struct ast_format *codec_choose_from_prefs(struct iax2_codec_pref *pref, struct ast_format_cap *cap)
{
        int x;
        struct ast_format *found_format = NULL;

        for (x = 0; x < ARRAY_LEN(pref->order); ++x) {
                struct ast_format *pref_format;
                uint64_t pref_bitfield;

                pref_bitfield = iax2_codec_pref_order_value_to_format_bitfield(pref->order[x]);
                if (!pref_bitfield) {
                        break;
                }

                pref_format = ast_format_compatibility_bitfield2format(pref_bitfield);
                if (!pref_format) {
                        /* The bitfield is not associated with any format. */
                        continue;
                }
                found_format = ast_format_cap_get_compatible_format(cap, pref_format);
                if (found_format) {
                        break;
                }
        }

        if (found_format && (ast_format_get_type(found_format) == AST_MEDIA_TYPE_AUDIO)) {
                return found_format;
        }

        ast_debug(4, "Could not find preferred codec - Returning zero codec.\n");
        ao2_cleanup(found_format);
        return NULL;
}

static iax2_format iax2_codec_choose(struct iax2_codec_pref *pref, iax2_format formats)
{
        struct ast_format_cap *cap;
        struct ast_format *tmpfmt;
        iax2_format format = 0;

        if ((cap = ast_format_cap_alloc(AST_FORMAT_CAP_FLAG_DEFAULT))) {
                iax2_format_compatibility_bitfield2cap(formats, cap);
                tmpfmt = codec_choose_from_prefs(pref, cap);
                if (!tmpfmt) {
                        ao2_ref(cap, -1);
                        return 0;
                }

                format = ast_format_compatibility_format2bitfield(tmpfmt);
                ao2_ref(tmpfmt, -1);
                ao2_ref(cap, -1);
        }

        return format;
}

const char *iax2_getformatname(iax2_format format)
{
        struct ast_format *tmpfmt;

        tmpfmt = ast_format_compatibility_bitfield2format(format);
        if (!tmpfmt) {
                return "Unknown";
        }

        return ast_format_get_name(tmpfmt);
}

static const char *iax2_getformatname_multiple(iax2_format format, struct ast_str **codec_buf)
{
        struct ast_format_cap *cap = ast_format_cap_alloc(AST_FORMAT_CAP_FLAG_DEFAULT);

        if (!cap) {
                return "(Nothing)";
        }
        iax2_format_compatibility_bitfield2cap(format, cap);
        ast_format_cap_get_names(cap, codec_buf);
        ao2_ref(cap, -1);

        return ast_str_buffer(*codec_buf);
}

static int iax2_parse_allow_disallow(struct iax2_codec_pref *pref, iax2_format *formats, const char *list, int allowing)
{
        int res, i;
        struct ast_format_cap *cap;

        /* We want to add the formats to the cap in the preferred order */
        cap = ast_format_cap_alloc(AST_FORMAT_CAP_FLAG_DEFAULT);
        if (!cap || iax2_codec_pref_to_cap(pref, cap)) {
                ao2_cleanup(cap);
                return 1;
        }

        res = ast_format_cap_update_by_allow_disallow(cap, list, allowing);

        /* Adjust formats bitfield and pref list to match. */
        *formats = iax2_format_compatibility_cap2bitfield(cap);
        iax2_codec_pref_remove_missing(pref, *formats);

        for (i = 0; i < ast_format_cap_count(cap); i++) {
                struct ast_format *fmt = ast_format_cap_get_format(cap, i);

                iax2_codec_pref_append(pref, fmt, ast_format_cap_get_format_framing(cap, fmt));
                ao2_ref(fmt, -1);
        }

        ao2_ref(cap, -1);

        return res;
}

static int iax2_data_add_codecs(struct ast_data *root, const char *node_name, iax2_format formats)
{
        int res;
        struct ast_format_cap *cap = ast_format_cap_alloc(AST_FORMAT_CAP_FLAG_DEFAULT);
        if (!cap) {
                return -1;
        }
        iax2_format_compatibility_bitfield2cap(formats, cap);
        res = ast_data_add_codecs(root, node_name, cap);
        ao2_ref(cap, -1);
        return res;
}

/*!
 * \note The only member of the peer passed here guaranteed to be set is the name field
 */
static int peer_hash_cb(const void *obj, const int flags)
{
        const struct iax2_peer *peer = obj;
        const char *name = obj;

        return ast_str_hash(flags & OBJ_KEY ? name : peer->name);
}

/*!
 * \note The only member of the peer passed here guaranteed to be set is the name field
 */
static int peer_cmp_cb(void *obj, void *arg, int flags)
{
        struct iax2_peer *peer = obj, *peer2 = arg;
        const char *name = arg;

        return !strcmp(peer->name, flags & OBJ_KEY ? name : peer2->name) ?
                        CMP_MATCH | CMP_STOP : 0;
}

/*!
 * \note The only member of the user passed here guaranteed to be set is the name field
 */
static int user_hash_cb(const void *obj, const int flags)
{
        const struct iax2_user *user = obj;
        const char *name = obj;

        return ast_str_hash(flags & OBJ_KEY ? name : user->name);
}

/*!
 * \note The only member of the user passed here guaranteed to be set is the name field
 */
static int user_cmp_cb(void *obj, void *arg, int flags)
{
        struct iax2_user *user = obj, *user2 = arg;
        const char *name = arg;

        return !strcmp(user->name, flags & OBJ_KEY ? name : user2->name) ?
                        CMP_MATCH | CMP_STOP : 0;
}

/*!
 * \note This funtion calls realtime_peer -> reg_source_db -> iax2_poke_peer -> find_callno,
 *       so do not call it with a pvt lock held.
 */
static struct iax2_peer *find_peer(const char *name, int realtime)
{
        struct iax2_peer *peer = NULL;

        peer = ao2_find(peers, name, OBJ_KEY);

        /* Now go for realtime if applicable */
        if (!peer && realtime) {
                peer = realtime_peer(name, NULL);
        }
        return peer;
}

static struct iax2_peer *peer_ref(struct iax2_peer *peer)
{
        ao2_ref(peer, +1);
        return peer;
}

static inline struct iax2_peer *peer_unref(struct iax2_peer *peer)
{
        ao2_ref(peer, -1);
        return NULL;
}

static struct iax2_user *find_user(const char *name)
{
        return ao2_find(users, name, OBJ_KEY);
}

static inline struct iax2_user *user_unref(struct iax2_user *user)
{
        ao2_ref(user, -1);
        return NULL;
}

static int iax2_getpeername(struct ast_sockaddr addr, char *host, int len)
{
        struct iax2_peer *peer = NULL;
        int res = 0;
        struct ao2_iterator i;

        i = ao2_iterator_init(peers, 0);
        while ((peer = ao2_iterator_next(&i))) {

                if (!ast_sockaddr_cmp(&peer->addr, &addr)) {
                        ast_copy_string(host, peer->name, len);
                        peer_unref(peer);
                        res = 1;
                        break;
                }
                peer_unref(peer);
        }
        ao2_iterator_destroy(&i);

        if (!peer) {
                peer = realtime_peer(NULL, &addr);
                if (peer) {
                        ast_copy_string(host, peer->name, len);
                        peer_unref(peer);
                        res = 1;
                }
        }

        return res;
}

/* Call AST_SCHED_DEL on a scheduled task if it is found in scheduler. */
static int iax2_delete_from_sched(const void* data)
{
        int sched_id = (int)(long)data;

        AST_SCHED_DEL(sched, sched_id);

        return 0;
}

/*!\note Assumes the lock on the pvt is already held, when
 * iax2_destroy_helper() is called. */
static void iax2_destroy_helper(struct chan_iax2_pvt *pvt)
{
        /* Decrement AUTHREQ count if needed */
        if (ast_test_flag64(pvt, IAX_MAXAUTHREQ)) {
                struct iax2_user *user;

                user = ao2_find(users, pvt->username, OBJ_KEY);
                if (user) {
                        ast_atomic_fetchadd_int(&user->curauthreq, -1);
                        user_unref(user);
                }

                ast_clear_flag64(pvt, IAX_MAXAUTHREQ);
        }


        /* Mark call destroy initiated flag. */
        pvt->destroy_initiated = 1;

        /*
         * Schedule deleting the scheduled (but didn't run yet) PINGs or LAGRQs.
         * Already running tasks will be terminated because of destroy_initiated.
         *
         * Don't call AST_SCHED_DEL from this thread for pingid and lagid because
         * it leads to a deadlock between the scheduler thread callback locking
         * the callno mutex and this thread which holds the callno mutex one or
         * more times.  It is better to have another thread delete the scheduled
         * callbacks which doesn't lock the callno mutex.
         */
        iax2_sched_add(sched, 0, iax2_delete_from_sched, (void*)(long)pvt->pingid);
        iax2_sched_add(sched, 0, iax2_delete_from_sched, (void*)(long)pvt->lagid);

        pvt->pingid = -1;
        pvt->lagid = -1;

        AST_SCHED_DEL(sched, pvt->autoid);
        AST_SCHED_DEL(sched, pvt->authid);
        AST_SCHED_DEL(sched, pvt->initid);
        AST_SCHED_DEL(sched, pvt->jbid);
        AST_SCHED_DEL(sched, pvt->keyrotateid);
}

static void iax2_frame_free(struct iax_frame *fr)
{
        AST_SCHED_DEL(sched, fr->retrans);
        iax_frame_free(fr);
}

static int scheduled_destroy(const void *vid)
{
        unsigned short callno = PTR_TO_CALLNO(vid);
        ast_mutex_lock(&iaxsl[callno]);
        if (iaxs[callno]) {
                ast_debug(1, "Really destroying %d now...\n", callno);
                iax2_destroy(callno);
        }
        ast_mutex_unlock(&iaxsl[callno]);
        return 0;
}

static void free_signaling_queue_entry(struct signaling_queue_entry *s)
{
        if (s->f.datalen) {
                ast_free(s->f.data.ptr);
        }
        ast_free(s);
}

/*! \brief This function must be called once we are sure the other side has
 *  given us a call number.  All signaling is held here until that point. */
static void send_signaling(struct chan_iax2_pvt *pvt)
{
        struct signaling_queue_entry *s = NULL;

        while ((s = AST_LIST_REMOVE_HEAD(&pvt->signaling_queue, next))) {
                iax2_send(pvt, &s->f, 0, -1, 0, 0, 0);
                free_signaling_queue_entry(s);
        }
        pvt->hold_signaling = 0;
}

/*! \brief All frames other than that of type AST_FRAME_IAX must be held until
 *  we have received a destination call number. */
static int queue_signalling(struct chan_iax2_pvt *pvt, struct ast_frame *f)
{
        struct signaling_queue_entry *qe;

        if (f->frametype == AST_FRAME_IAX || !pvt->hold_signaling) {
                return 1; /* do not queue this frame */
        } else if (!(qe = ast_calloc(1, sizeof(struct signaling_queue_entry)))) {
                return -1;  /* out of memory */
        }

        /* copy ast_frame into our queue entry */
        qe->f = *f;
        if (qe->f.datalen) {
                /* if there is data in this frame copy it over as well */
                if (!(qe->f.data.ptr = ast_malloc(qe->f.datalen))) {
                        free_signaling_queue_entry(qe);
                        return -1;
                }
                memcpy(qe->f.data.ptr, f->data.ptr, qe->f.datalen);
        }
        AST_LIST_INSERT_TAIL(&pvt->signaling_queue, qe, next);

        return 0;
}

static void pvt_destructor(void *obj)
{
        struct chan_iax2_pvt *pvt = obj;
        struct iax_frame *cur = NULL;
        struct signaling_queue_entry *s = NULL;

        ast_mutex_lock(&iaxsl[pvt->callno]);

        iax2_destroy_helper(pvt);

        sched_delay_remove(&pvt->addr, pvt->callno_entry);
        pvt->callno_entry = 0;

        /* Already gone */
        ast_set_flag64(pvt, IAX_ALREADYGONE);

        AST_LIST_TRAVERSE(&frame_queue[pvt->callno], cur, list) {
                /* Cancel any pending transmissions */
                cur->retries = -1;
        }

        ast_mutex_unlock(&iaxsl[pvt->callno]);

        while ((s = AST_LIST_REMOVE_HEAD(&pvt->signaling_queue, next))) {
                free_signaling_queue_entry(s);
        }

        if (pvt->reg) {
                pvt->reg->callno = 0;
        }

        if (!pvt->owner) {
                jb_frame frame;
                if (pvt->vars) {
                    ast_variables_destroy(pvt->vars);
                    pvt->vars = NULL;
                }

                while (jb_getall(pvt->jb, &frame) == JB_OK) {
                        iax2_frame_free(frame.data);
                }

                jb_destroy(pvt->jb);
                ast_string_field_free_memory(pvt);
        }
}

static struct chan_iax2_pvt *new_iax(struct ast_sockaddr *addr, const char *host)
{
        struct chan_iax2_pvt *tmp;
        jb_conf jbconf;

        if (!(tmp = ao2_alloc(sizeof(*tmp), pvt_destructor))) {
                return NULL;
        }

        if (ast_string_field_init(tmp, 32)) {
                ao2_ref(tmp, -1);
                tmp = NULL;
                return NULL;
        }

        tmp->prefs = prefs_global;
        tmp->pingid = -1;
        tmp->lagid = -1;
        tmp->autoid = -1;
        tmp->authid = -1;
        tmp->initid = -1;
        tmp->keyrotateid = -1;

        ast_string_field_set(tmp,exten, "s");
        ast_string_field_set(tmp,host, host);

        tmp->jb = jb_new();
        tmp->jbid = -1;
        jbconf.max_jitterbuf = maxjitterbuffer;
        jbconf.resync_threshold = resyncthreshold;
        jbconf.max_contig_interp = maxjitterinterps;
        jbconf.target_extra = jittertargetextra;
        jb_setconf(tmp->jb,&jbconf);

        AST_LIST_HEAD_INIT_NOLOCK(&tmp->dpentries);

        tmp->hold_signaling = 1;
        AST_LIST_HEAD_INIT_NOLOCK(&tmp->signaling_queue);

        return tmp;
}

static struct iax_frame *iaxfrdup2(struct iax_frame *fr)
{
        struct iax_frame *new = iax_frame_new(DIRECTION_INGRESS, fr->af.datalen, fr->cacheable);
        if (new) {
                size_t afdatalen = new->afdatalen;
                memcpy(new, fr, sizeof(*new));
                iax_frame_wrap(new, &fr->af);
                new->afdatalen = afdatalen;
                new->data = NULL;
                new->datalen = 0;
                new->direction = DIRECTION_INGRESS;
                new->retrans = -1;
        }
        return new;
}
/* keep these defined in this order.  They are used in find_callno to
 * determine whether or not a new call number should be allowed. */
enum {
        /* do not allow a new call number, only search ones in use for match */
        NEW_PREVENT = 0,
        /* search for match first, then allow a new one to be allocated */
        NEW_ALLOW = 1,
        /* do not search for match, force a new call number */
        NEW_FORCE = 2,
        /* do not search for match, force a new call number.  Signifies call number
         * has been calltoken validated */
        NEW_ALLOW_CALLTOKEN_VALIDATED = 3,
};

static int match(struct ast_sockaddr *addr, unsigned short callno, unsigned short dcallno, const struct chan_iax2_pvt *cur, int check_dcallno)
{
        if (!ast_sockaddr_cmp(&cur->addr, addr)) {
                /* This is the main host */
                if ( (cur->peercallno == 0 || cur->peercallno == callno) &&
                         (check_dcallno ? dcallno == cur->callno : 1) ) {
                        /* That's us.  Be sure we keep track of the peer call number */
                        return 1;
                }
        }
        if (!ast_sockaddr_cmp(&cur->transfer, addr) && cur->transferring) {
                /* We're transferring */
                if ((dcallno == cur->callno) || (cur->transferring == TRANSFER_MEDIAPASS && cur->transfercallno == callno))
                        return 1;
        }
        return 0;
}

static int make_trunk(unsigned short callno, int locked)
{
        int x;
        int res= 0;
        callno_entry entry;
        if (iaxs[callno]->oseqno) {
                ast_log(LOG_WARNING, "Can't make trunk once a call has started!\n");
                return -1;
        }
        if (callno >= TRUNK_CALL_START) {
                ast_log(LOG_WARNING, "Call %d is already a trunk\n", callno);
                return -1;
        }

        if (get_unused_callno(
                        CALLNO_TYPE_TRUNK,
                        CALLNO_ENTRY_IS_VALIDATED(iaxs[callno]->callno_entry),
                        &entry)) {
                ast_log(LOG_WARNING, "Unable to trunk call: Insufficient space\n");
                return -1;
        }

        x = CALLNO_ENTRY_GET_CALLNO(entry);
        ast_mutex_lock(&iaxsl[x]);

        /*!
         * \note We delete these before switching the slot, because if
         * they fire in the meantime, they will generate a warning.
         */
        AST_SCHED_DEL(sched, iaxs[callno]->pingid);
        AST_SCHED_DEL(sched, iaxs[callno]->lagid);
        iaxs[callno]->lagid = iaxs[callno]->pingid = -1;
        iaxs[x] = iaxs[callno];
        iaxs[x]->callno = x;

        /* since we copied over the pvt from a different callno, make sure the old entry is replaced
         * before assigning the new one */
        if (iaxs[x]->callno_entry) {
                iax2_sched_add(
                        sched,
                        MIN_REUSE_TIME * 1000,
                        replace_callno,
                        CALLNO_ENTRY_TO_PTR(iaxs[x]->callno_entry));

        }
        iaxs[x]->callno_entry = entry;

        iaxs[callno] = NULL;
        /* Update the two timers that should have been started */
        iaxs[x]->pingid = iax2_sched_add(sched,
                ping_time * 1000, send_ping, (void *)(long)x);
        iaxs[x]->lagid = iax2_sched_add(sched,
                lagrq_time * 1000, send_lagrq, (void *)(long)x);

        if (locked)
                ast_mutex_unlock(&iaxsl[callno]);
        res = x;
        if (!locked)
                ast_mutex_unlock(&iaxsl[x]);

        /* We moved this call from a non-trunked to a trunked call */
        ast_debug(1, "Made call %d into trunk call %d\n", callno, x);

        return res;
}

static void store_by_transfercallno(struct chan_iax2_pvt *pvt)
{
        if (!pvt->transfercallno) {
                ast_log(LOG_ERROR, "This should not be called without a transfer call number.\n");
                return;
        }

        ao2_link(iax_transfercallno_pvts, pvt);
}

static void remove_by_transfercallno(struct chan_iax2_pvt *pvt)
{
        if (!pvt->transfercallno) {
                ast_log(LOG_ERROR, "This should not be called without a transfer call number.\n");
                return;
        }

        ao2_unlink(iax_transfercallno_pvts, pvt);
}
static void store_by_peercallno(struct chan_iax2_pvt *pvt)
{
        if (!pvt->peercallno) {
                ast_log(LOG_ERROR, "This should not be called without a peer call number.\n");
                return;
        }

        ao2_link(iax_peercallno_pvts, pvt);
}

static void remove_by_peercallno(struct chan_iax2_pvt *pvt)
{
        if (!pvt->peercallno) {
                ast_log(LOG_ERROR, "This should not be called without a peer call number.\n");
                return;
        }

        ao2_unlink(iax_peercallno_pvts, pvt);
}

static int addr_range_delme_cb(void *obj, void *arg, int flags)
{
        struct addr_range *lim = obj;
        lim->delme = 1;
        return 0;
}

static int addr_range_hash_cb(const void *obj, const int flags)
{
        const struct addr_range *lim = obj;
        return abs(ast_sockaddr_hash(&lim->ha.addr));
}

static int addr_range_cmp_cb(void *obj, void *arg, int flags)
{
        struct addr_range *lim1 = obj, *lim2 = arg;
        return (!(ast_sockaddr_cmp_addr(&lim1->ha.addr, &lim2->ha.addr)) &&
                        !(ast_sockaddr_cmp_addr(&lim1->ha.netmask, &lim2->ha.netmask))) ?
                        CMP_MATCH | CMP_STOP : 0;
}

static int peercnt_hash_cb(const void *obj, const int flags)
{
        const struct peercnt *peercnt = obj;

        if (ast_sockaddr_isnull(&peercnt->addr)) {
                return 0;
        }
        return ast_sockaddr_hash(&peercnt->addr);
}

static int peercnt_cmp_cb(void *obj, void *arg, int flags)
{
        struct peercnt *peercnt1 = obj, *peercnt2 = arg;
        return !ast_sockaddr_cmp_addr(&peercnt1->addr, &peercnt2->addr) ? CMP_MATCH | CMP_STOP : 0;
}

static int addr_range_match_address_cb(void *obj, void *arg, int flags)
{
        struct addr_range *addr_range = obj;
        struct ast_sockaddr *addr = arg;
        struct ast_sockaddr tmp_addr;

        ast_sockaddr_apply_netmask(addr, &addr_range->ha.netmask, &tmp_addr);

        if (!ast_sockaddr_cmp_addr(&tmp_addr, &addr_range->ha.addr)) {
                return CMP_MATCH | CMP_STOP;
        }
        return 0;
}

/*!
 * \internal
 *
 * \brief compares addr to calltoken_ignores table to determine if validation is required.
 */
static int calltoken_required(struct ast_sockaddr *addr, const char *name, int subclass)
{
        struct addr_range *addr_range;
        struct iax2_peer *peer = NULL;
        struct iax2_user *user = NULL;
        /* if no username is given, check for guest accounts */
        const char *find = S_OR(name, "guest");
        int res = 1;  /* required by default */
        int optional = 0;
        enum calltoken_peer_enum calltoken_required = CALLTOKEN_DEFAULT;
        /* There are only two cases in which calltoken validation is not required.
         * Case 1. sin falls within the list of address ranges specified in the calltoken optional table and
         *         the peer definition has not set the requirecalltoken option.
         * Case 2. Username is a valid peer/user, and that peer has requirecalltoken set either auto or no.
         */

        /* ----- Case 1 ----- */
        if ((addr_range = ao2_callback(calltoken_ignores, 0, addr_range_match_address_cb, addr))) {
                ao2_ref(addr_range, -1);
                optional = 1;
        }

        /* ----- Case 2 ----- */
        if ((subclass == IAX_COMMAND_NEW) && (user = find_user(find))) {
                calltoken_required = user->calltoken_required;
        } else if ((subclass == IAX_COMMAND_NEW) && (user = realtime_user(find, addr))) {
                calltoken_required = user->calltoken_required;
        } else if ((subclass != IAX_COMMAND_NEW) && (peer = find_peer(find, 0))) {
                calltoken_required = peer->calltoken_required;
        } else if ((subclass != IAX_COMMAND_NEW) && (peer = realtime_peer(find, addr))) {
                calltoken_required = peer->calltoken_required;
        }

        if (peer) {
                peer_unref(peer);
        }
        if (user) {
                user_unref(user);
        }

        ast_debug(1, "Determining if address %s with username %s requires calltoken validation.  Optional = %d  calltoken_required = %u \n", ast_sockaddr_stringify_addr(addr), name, optional, calltoken_required);
        if (((calltoken_required == CALLTOKEN_NO) || (calltoken_required == CALLTOKEN_AUTO)) ||
                (optional && (calltoken_required == CALLTOKEN_DEFAULT))) {
                res = 0;
        }

        return res;
}

/*!
 * \internal
 *
 * \brief set peercnt callno limit.
 *
 * \details
 * First looks in custom definitions. If not found, global limit
 * is used.  Entries marked as reg already have
 * a custom limit set by a registration and are not modified.
 */
static void set_peercnt_limit(struct peercnt *peercnt)
{
        uint16_t limit = global_maxcallno;
        struct addr_range *addr_range;
        struct ast_sockaddr addr;

        ast_sockaddr_copy(&addr, &peercnt->addr);

        if (peercnt->reg && peercnt->limit) {
                return; /* this peercnt has a custom limit set by a registration */
        }

        if ((addr_range = ao2_callback(callno_limits, 0, addr_range_match_address_cb, &addr))) {
                limit = addr_range->limit;
                ast_debug(1, "custom addr_range %d found for %s\n", limit, ast_sockaddr_stringify(&addr));
                ao2_ref(addr_range, -1);
        }

        peercnt->limit = limit;
}

/*!
 * \internal
 * \brief sets limits for all peercnts in table. done on reload to reflect changes in conf.
 */
static int set_peercnt_limit_all_cb(void *obj, void *arg, int flags)
{
        struct peercnt *peercnt = obj;

        set_peercnt_limit(peercnt);
        ast_debug(1, "Reset limits for peercnts table\n");

        return 0;
}

/*!
 * \internal
 * \brief returns match if delme is set.
 */
static int prune_addr_range_cb(void *obj, void *arg, int flags)
{
        struct addr_range *addr_range = obj;

        return addr_range->delme ? CMP_MATCH : 0;
}

/*!
 * \internal
 * \brief modifies peercnt entry in peercnts table. Used to set custom limit or mark a registered ip
 */
static void peercnt_modify(unsigned char reg, uint16_t limit, struct ast_sockaddr *sockaddr)
{
        /* this function turns off and on custom callno limits set by peer registration */
        struct peercnt *peercnt;
        struct peercnt tmp;

        ast_sockaddr_copy(&tmp.addr, sockaddr);

        if ((peercnt = ao2_find(peercnts, &tmp, OBJ_POINTER))) {
                peercnt->reg = reg;
                if (limit) {
                        peercnt->limit = limit;
                } else {
                        set_peercnt_limit(peercnt);
                }
                ast_debug(1, "peercnt entry %s modified limit:%d registered:%d", ast_sockaddr_stringify_addr(sockaddr), peercnt->limit, peercnt->reg);
                ao2_ref(peercnt, -1); /* decrement ref from find */
        }
}

/*!
 * \internal
 * \brief adds an ip to the peercnts table, increments connection count if it already exists
 *
 * \details First searches for the address in the peercnts table.  If found
 * the current count is incremented.  If not found a new peercnt is allocated
 * and linked into the peercnts table with a call number count of 1.
 */
static int peercnt_add(struct ast_sockaddr *addr)
{
        struct peercnt *peercnt;
        int res = 0;
        struct peercnt tmp;

        ast_sockaddr_copy(&tmp.addr, addr);

        /* Reasoning for peercnts container lock:  Two identical ip addresses
         * could be added by different threads at the "same time". Without the container
         * lock, both threads could alloc space for the same object and attempt
         * to link to table.  With the lock, one would create the object and link
         * to table while the other would find the already created peercnt object
         * rather than creating a new one. */
        ao2_lock(peercnts);
        if ((peercnt = ao2_find(peercnts, &tmp, OBJ_POINTER))) {
                ao2_lock(peercnt);
        } else if ((peercnt = ao2_alloc(sizeof(*peercnt), NULL))) {
                ao2_lock(peercnt);
                /* create and set defaults */
                ast_sockaddr_copy(&peercnt->addr, addr);
                set_peercnt_limit(peercnt);
                /* guarantees it does not go away after unlocking table
                 * ao2_find automatically adds this */
                ao2_link(peercnts, peercnt);
        } else {
                ao2_unlock(peercnts);
                return -1;
        }

        /* check to see if the address has hit its callno limit.  If not increment cur. */
        if (peercnt->limit > peercnt->cur) {
                peercnt->cur++;
                ast_debug(1, "ip callno count incremented to %d for %s\n", peercnt->cur, ast_sockaddr_stringify_addr(addr));
        } else { /* max num call numbers for this peer has been reached! */
                ast_log(LOG_ERROR, "maxcallnumber limit of %d for %s has been reached!\n", peercnt->limit, ast_sockaddr_stringify_addr(addr));
                res = -1;
        }

        /* clean up locks and ref count */
        ao2_unlock(peercnt);
        ao2_unlock(peercnts);
        ao2_ref(peercnt, -1); /* decrement ref from find/alloc, only the container ref remains. */

        return res;
}

/*!
 * \internal
 * \brief decrements a peercnts table entry
 */
static void peercnt_remove(struct peercnt *peercnt)
{
        struct ast_sockaddr addr;

        ast_sockaddr_copy(&addr, &peercnt->addr);

        /*
         * Container locked here since peercnt may be unlinked from
         * list.  If left unlocked, peercnt_add could try and grab this
         * entry from the table and modify it at the "same time" this
         * thread attemps to unlink it.
         */
        ao2_lock(peercnts);
        peercnt->cur--;
        ast_debug(1, "ip callno count decremented to %d for %s\n", peercnt->cur, ast_sockaddr_stringify_addr(&addr));
        /* if this was the last connection from the peer remove it from table */
        if (peercnt->cur == 0) {
                ao2_unlink(peercnts, peercnt);/* decrements ref from table, last ref is left to scheduler */
        }
        ao2_unlock(peercnts);
}

/*!
 * \internal
 * \brief called by scheduler to decrement object
 */
static int peercnt_remove_cb(const void *obj)
{
        struct peercnt *peercnt = (struct peercnt *) obj;

        peercnt_remove(peercnt);
        ao2_ref(peercnt, -1); /* decrement ref from scheduler */

        return 0;
}

/*!
 * \internal
 * \brief decrements peercnts connection count, finds by addr
 */
static int peercnt_remove_by_addr(struct ast_sockaddr *addr)
{
        struct peercnt *peercnt;
        struct peercnt tmp;

        ast_sockaddr_copy(&tmp.addr, addr);

        if ((peercnt = ao2_find(peercnts, &tmp, OBJ_POINTER))) {
                peercnt_remove(peercnt);
                ao2_ref(peercnt, -1); /* decrement ref from find */
        }
        return 0;
}

/*!
 * \internal
 * \brief Create callno_limit entry based on configuration
 */
static void build_callno_limits(struct ast_variable *v)
{
        struct addr_range *addr_range = NULL;
        struct addr_range tmp;
        struct ast_ha *ha;
        int limit;
        int error;
        int found;

        for (; v; v = v->next) {
                limit = -1;
                error = 0;
                found = 0;
                ha = ast_append_ha("permit", v->name, NULL, &error);

                /* check for valid config information */
                if (error) {
                        ast_log(LOG_ERROR, "Call number limit for %s could not be added, Invalid address range\n.", v->name);
                        continue;
                } else if ((sscanf(v->value, "%d", &limit) != 1) || (limit < 0)) {
                        ast_log(LOG_ERROR, "Call number limit for %s could not be added. Invalid limit %s\n.", v->name, v->value);
                        ast_free_ha(ha);
                        continue;
                }

                ast_copy_ha(ha, &tmp.ha);
                /* find or create the addr_range */
                if ((addr_range = ao2_find(callno_limits, &tmp, OBJ_POINTER))) {
                        ao2_lock(addr_range);
                        found = 1;
                } else if (!(addr_range = ao2_alloc(sizeof(*addr_range), NULL))) {
                        ast_free_ha(ha);
                        return; /* out of memory */
                }

                /* copy over config data into addr_range object */
                ast_copy_ha(ha, &addr_range->ha); /* this is safe because only one ha is possible for each limit */
                ast_free_ha(ha); /* cleanup the tmp ha */
                addr_range->limit = limit;
                addr_range->delme = 0;

                /* cleanup */
                if (found) {
                        ao2_unlock(addr_range);
                } else {
                        ao2_link(callno_limits, addr_range);
                }
                ao2_ref(addr_range, -1); /* decrement ref from ao2_find and ao2_alloc, only container ref remains */
        }
}

/*!
 * \internal
 * \brief Create calltoken_ignores entry based on configuration
 */
static int add_calltoken_ignore(const char *addr)
{
        struct addr_range tmp;
        struct addr_range *addr_range = NULL;
        struct ast_ha *ha = NULL;
        int error = 0;

        if (ast_strlen_zero(addr)) {
                ast_log(LOG_WARNING, "invalid calltokenoptional %s\n", addr);
                return -1;
        }

        ha = ast_append_ha("permit", addr, NULL, &error);

        /* check for valid config information */
        if (error) {
                ast_log(LOG_WARNING, "Error %d creating calltokenoptional entry %s\n", error, addr);
                return -1;
        }

        ast_copy_ha(ha, &tmp.ha);
        /* find or create the addr_range */
        if ((addr_range = ao2_find(calltoken_ignores, &tmp, OBJ_POINTER))) {
                ao2_lock(addr_range);
                addr_range->delme = 0;
                ao2_unlock(addr_range);
        } else if ((addr_range = ao2_alloc(sizeof(*addr_range), NULL))) {
                /* copy over config data into addr_range object */
                ast_copy_ha(ha, &addr_range->ha); /* this is safe because only one ha is possible */
                ao2_link(calltoken_ignores, addr_range);
        } else {
                ast_free_ha(ha);
                return -1;
        }

        ast_free_ha(ha);
        ao2_ref(addr_range, -1); /* decrement ref from ao2_find and ao2_alloc, only container ref remains */

        return 0;
}

static char *handle_cli_iax2_show_callno_limits(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        struct ao2_iterator i;
        struct peercnt *peercnt;
        struct ast_sockaddr addr;
        int found = 0;

        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 show callnumber usage";
                e->usage =
                        "Usage: iax2 show callnumber usage [IP address]\n"
                        "       Shows current IP addresses which are consuming iax2 call numbers\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        case CLI_HANDLER:
                if (a->argc < 4 || a->argc > 5)
                        return CLI_SHOWUSAGE;

                if (a->argc == 4) {
                        ast_cli(a->fd, "%-45s %-12s %-12s\n", "Address", "Callno Usage", "Callno Limit");
                }

                i = ao2_iterator_init(peercnts, 0);
                while ((peercnt = ao2_iterator_next(&i))) {
                        ast_sockaddr_copy(&addr, &peercnt->addr);

                        if (a->argc == 5) {
                                if (!strcasecmp(a->argv[4], ast_sockaddr_stringify(&addr))) {
                                        ast_cli(a->fd, "%-45s %-12s %-12s\n", "Address", "Callno Usage", "Callno Limit");
                                        ast_cli(a->fd, "%-45s %-12d %-12d\n", ast_sockaddr_stringify(&addr), peercnt->cur, peercnt->limit);
                                        ao2_ref(peercnt, -1);
                                        found = 1;
                                        break;
                                }
                        } else {
                                ast_cli(a->fd, "%-45s %-12d %-12d\n", ast_sockaddr_stringify(&addr), peercnt->cur, peercnt->limit);
                        }
                        ao2_ref(peercnt, -1);
                }
                ao2_iterator_destroy(&i);

                if (a->argc == 4) {
                        size_t pool_avail = callno_pool.available;
                        size_t trunk_pool_avail = callno_pool_trunk.available;

                        ast_cli(a->fd, "\nNon-CallToken Validation Callno Limit: %d\n"
                                         "Non-CallToken Validated Callno Used:   %d\n",
                                global_maxcallno_nonval,
                                total_nonval_callno_used);

                        ast_cli(a->fd,   "Total Available Callno:                %zu\n"
                                         "Regular Callno Available:              %zu\n"
                                         "Trunk Callno Available:                %zu\n",
                                pool_avail + trunk_pool_avail,
                                pool_avail,
                                trunk_pool_avail);
                } else if (a->argc == 5 && !found) {
                        ast_cli(a->fd, "No call number table entries for %s found\n", a->argv[4] );
                }


                return CLI_SUCCESS;
        default:
                return NULL;
        }
}

static int get_unused_callno(enum callno_type type, int validated, callno_entry *entry)
{
        struct call_number_pool *pool = NULL;
        callno_entry swap;
        size_t choice;

        switch (type) {
        case CALLNO_TYPE_NORMAL:
                pool = &callno_pool;
                break;
        case CALLNO_TYPE_TRUNK:
                pool = &callno_pool_trunk;
                break;
        default:
                ast_assert(0);
                break;
        }

        /* If we fail, make sure this has a defined value */
        *entry = 0;

        /* We lock here primarily to ensure thread safety of the
         * total_nonval_callno_used check and increment */
        ast_mutex_lock(&callno_pool_lock);

        /* Bail out if we don't have any available call numbers */
        if (!pool->available) {
                ast_log(LOG_WARNING, "Out of call numbers\n");
                ast_mutex_unlock(&callno_pool_lock);
                return 1;
        }

        /* Only a certain number of non-validated call numbers should be allocated.
         * If there ever is an attack, this separates the calltoken validating users
         * from the non-calltoken validating users. */
        if (!validated && total_nonval_callno_used >= global_maxcallno_nonval) {
                ast_log(LOG_WARNING,
                        "NON-CallToken callnumber limit is reached. Current: %d Max: %d\n",
                        total_nonval_callno_used,
                        global_maxcallno_nonval);
                ast_mutex_unlock(&callno_pool_lock);
                return 1;
        }

        /* We use a modified Fisher-Yates-Durstenfeld Shuffle to maintain a list of
         * available call numbers.  The array of call numbers begins as an ordered
         * list from 1 -> n, and we keep a running tally of how many remain unclaimed
         * - let's call that x.  When a call number is needed we pick a random index
         * into the array between 0 and x and use that as our call number.  In a
         * typical FYD shuffle, we would swap the value that we are extracting with
         * the number at x, but in our case we swap and don't touch the value at x
         * because it is effectively invisible.  We rely on the rest of the IAX2 core
         * to return the number to us at some point.  Finally, we decrement x by 1
         * which establishes our new unused range.
         *
         * When numbers are returned to the pool, we put them just past x and bump x
         * by 1 so that this number is now available for re-use. */

        choice = ast_random() % pool->available;

        *entry = pool->numbers[choice];
        swap = pool->numbers[pool->available - 1];

        pool->numbers[choice] = swap;
        pool->available--;

        if (validated) {
                CALLNO_ENTRY_SET_VALIDATED(*entry);
        } else {
                total_nonval_callno_used++;
        }

        ast_mutex_unlock(&callno_pool_lock);

        return 0;
}

static int replace_callno(const void *obj)
{
        callno_entry entry = PTR_TO_CALLNO_ENTRY(obj);
        struct call_number_pool *pool;

        /* We lock here primarily to ensure thread safety of the
         * total_nonval_callno_used check and decrement */
        ast_mutex_lock(&callno_pool_lock);

        if (!CALLNO_ENTRY_IS_VALIDATED(entry)) {
                if (total_nonval_callno_used) {
                        total_nonval_callno_used--;
                } else {
                        ast_log(LOG_ERROR,
                                "Attempted to decrement total non calltoken validated "
                                "callnumbers below zero.  Callno is: %d\n",
                                CALLNO_ENTRY_GET_CALLNO(entry));
                }
        }

        if (CALLNO_ENTRY_GET_CALLNO(entry) < TRUNK_CALL_START) {
                pool = &callno_pool;
        } else {
                pool = &callno_pool_trunk;
        }

        ast_assert(pool->capacity > pool->available);

        /* This clears the validated flag */
        entry = CALLNO_ENTRY_GET_CALLNO(entry);

        pool->numbers[pool->available] = entry;
        pool->available++;

        ast_mutex_unlock(&callno_pool_lock);

        return 0;
}

static int create_callno_pools(void)
{
        uint16_t i;

        callno_pool.available = callno_pool_trunk.available = 0;

        /* We start at 2.  0 and 1 are reserved. */
        for (i = 2; i < TRUNK_CALL_START; i++) {
                callno_pool.numbers[callno_pool.available] = i;
                callno_pool.available++;
        }

        for (i = TRUNK_CALL_START; i < IAX_MAX_CALLS; i++) {
                callno_pool_trunk.numbers[callno_pool_trunk.available] = i;
                callno_pool_trunk.available++;
        }

        callno_pool.capacity = callno_pool.available;
        callno_pool_trunk.capacity = callno_pool_trunk.available;

        ast_assert(callno_pool.capacity && callno_pool_trunk.capacity);

        return 0;
}

/*!
 * \internal
 * \brief Schedules delayed removal of iax2_pvt call number data
 *
 * \note After MIN_REUSE_TIME has passed for a destroyed iax2_pvt, the callno is
 * available again, and the address from the previous connection must be decremented
 * from the peercnts table.  This function schedules these operations to take place.
 */
static void sched_delay_remove(struct ast_sockaddr *addr, callno_entry entry)
{
        int i;
        struct peercnt *peercnt;
        struct peercnt tmp;

        ast_sockaddr_copy(&tmp.addr, addr);

        if ((peercnt = ao2_find(peercnts, &tmp, OBJ_POINTER))) {
                /* refcount is incremented with ao2_find.  keep that ref for the scheduler */
                ast_debug(1, "schedule decrement of callno used for %s in %d seconds\n", ast_sockaddr_stringify_addr(addr), MIN_REUSE_TIME);
                i = iax2_sched_add(sched, MIN_REUSE_TIME * 1000, peercnt_remove_cb, peercnt);
                if (i == -1) {
                        ao2_ref(peercnt, -1);
                }
        }

        iax2_sched_add(
                sched,
                MIN_REUSE_TIME * 1000,
                replace_callno,
                CALLNO_ENTRY_TO_PTR(entry));
}

/*!
 * \internal
 * \brief returns whether or not a frame is capable of starting a new IAX2 dialog.
 *
 * \note For this implementation, inbound pokes should _NOT_ be capable of allocating
 * a new callno.
 */
static inline int attribute_pure iax2_allow_new(int frametype, int subclass, int inbound)
{
        if (frametype != AST_FRAME_IAX) {
                return 0;
        }
        switch (subclass) {
        case IAX_COMMAND_NEW:
        case IAX_COMMAND_REGREQ:
        case IAX_COMMAND_FWDOWNL:
        case IAX_COMMAND_REGREL:
                return 1;
        case IAX_COMMAND_POKE:
                if (!inbound) {
                        return 1;
                }
                break;
        }
        return 0;
}

/*
 * \note Calling this function while holding another pvt lock can cause a deadlock.
 */
static int __find_callno(unsigned short callno, unsigned short dcallno, struct ast_sockaddr *addr, int new, int sockfd, int return_locked, int check_dcallno)
{
        int res = 0;
        int x;
        /* this call is calltoken validated as long as it is either NEW_FORCE
         * or NEW_ALLOW_CALLTOKEN_VALIDATED */
        int validated = (new > NEW_ALLOW) ? 1 : 0;
        char host[80];

        if (new <= NEW_ALLOW) {
                if (callno) {
                        struct chan_iax2_pvt *pvt;
                        struct chan_iax2_pvt tmp_pvt = {
                                .callno = dcallno,
                                .peercallno = callno,
                                .transfercallno = callno,
                                /* hack!! */
                                .frames_received = check_dcallno,
                        };

                        ast_sockaddr_copy(&tmp_pvt.addr, addr);
                        /* this works for finding normal call numbers not involving transfering */
                        if ((pvt = ao2_find(iax_peercallno_pvts, &tmp_pvt, OBJ_POINTER))) {
                                if (return_locked) {
                                        ast_mutex_lock(&iaxsl[pvt->callno]);
                                }
                                res = pvt->callno;
                                ao2_ref(pvt, -1);
                                pvt = NULL;
                                return res;
                        }
                        /* this searches for transfer call numbers that might not get caught otherwise */
                        memset(&tmp_pvt.addr, 0, sizeof(tmp_pvt.addr));
                        ast_sockaddr_copy(&tmp_pvt.transfer, addr);
                        if ((pvt = ao2_find(iax_transfercallno_pvts, &tmp_pvt, OBJ_POINTER))) {
                                if (return_locked) {
                                        ast_mutex_lock(&iaxsl[pvt->callno]);
                                }
                                res = pvt->callno;
                                ao2_ref(pvt, -1);
                                pvt = NULL;
                                return res;
                        }
                }
                        /* This will occur on the first response to a message that we initiated,
                 * such as a PING. */
                if (dcallno) {
                        ast_mutex_lock(&iaxsl[dcallno]);
                }
                if (callno && dcallno && iaxs[dcallno] && !iaxs[dcallno]->peercallno && match(addr, callno, dcallno, iaxs[dcallno], check_dcallno)) {
                        iaxs[dcallno]->peercallno = callno;
                        res = dcallno;
                        store_by_peercallno(iaxs[dcallno]);
                        if (!res || !return_locked) {
                                ast_mutex_unlock(&iaxsl[dcallno]);
                        }
                        return res;
                }
                if (dcallno) {
                        ast_mutex_unlock(&iaxsl[dcallno]);
                }
        }
        if (!res && (new >= NEW_ALLOW)) {
                callno_entry entry;

                /* It may seem odd that we look through the peer list for a name for
                 * this *incoming* call.  Well, it is weird.  However, users don't
                 * have an IP address/port number that we can match against.  So,
                 * this is just checking for a peer that has that IP/port and
                 * assuming that we have a user of the same name.  This isn't always
                 * correct, but it will be changed if needed after authentication. */
                if (!iax2_getpeername(*addr, host, sizeof(host)))
                        snprintf(host, sizeof(host), "%s", ast_sockaddr_stringify(addr));

                if (peercnt_add(addr)) {
                        /* This address has hit its callnumber limit.  When the limit
                         * is reached, the connection is not added to the peercnts table.*/
                        return 0;
                }

                if (get_unused_callno(CALLNO_TYPE_NORMAL, validated, &entry)) {
                        /* since we ran out of space, remove the peercnt
                         * entry we added earlier */
                        peercnt_remove_by_addr(addr);
                        ast_log(LOG_WARNING, "No more space\n");
                        return 0;
                }
                x = CALLNO_ENTRY_GET_CALLNO(entry);
                ast_mutex_lock(&iaxsl[x]);

                iaxs[x] = new_iax(addr, host);
                if (iaxs[x]) {
                        if (iaxdebug)
                                ast_debug(1, "Creating new call structure %d\n", x);
                        iaxs[x]->callno_entry = entry;
                        iaxs[x]->sockfd = sockfd;
                        ast_sockaddr_copy(&iaxs[x]->addr, addr);
                        iaxs[x]->peercallno = callno;
                        iaxs[x]->callno = x;
                        iaxs[x]->pingtime = DEFAULT_RETRY_TIME;
                        iaxs[x]->expiry = min_reg_expire;
                        iaxs[x]->pingid = iax2_sched_add(sched, ping_time * 1000, send_ping, (void *)(long)x);
                        iaxs[x]->lagid = iax2_sched_add(sched, lagrq_time * 1000, send_lagrq, (void *)(long)x);
                        iaxs[x]->amaflags = amaflags;
                        ast_copy_flags64(iaxs[x], &globalflags, IAX_NOTRANSFER | IAX_TRANSFERMEDIA | IAX_USEJITTERBUF | IAX_SENDCONNECTEDLINE | IAX_RECVCONNECTEDLINE | IAX_FORCE_ENCRYPT);
                        ast_string_field_set(iaxs[x], accountcode, accountcode);
                        ast_string_field_set(iaxs[x], mohinterpret, mohinterpret);
                        ast_string_field_set(iaxs[x], mohsuggest, mohsuggest);
                        ast_string_field_set(iaxs[x], parkinglot, default_parkinglot);

                        if (iaxs[x]->peercallno) {
                                store_by_peercallno(iaxs[x]);
                        }
                } else {
                        ast_log(LOG_WARNING, "Out of resources\n");
                        ast_mutex_unlock(&iaxsl[x]);
                        replace_callno(CALLNO_ENTRY_TO_PTR(entry));
                        return 0;
                }
                if (!return_locked)
                        ast_mutex_unlock(&iaxsl[x]);
                res = x;
        }
        return res;
}

static int find_callno(unsigned short callno, unsigned short dcallno, struct ast_sockaddr *addr, int new, int sockfd, int full_frame) {
        return __find_callno(callno, dcallno, addr, new, sockfd, 0, full_frame);
}

static int find_callno_locked(unsigned short callno, unsigned short dcallno, struct ast_sockaddr *addr, int new, int sockfd, int full_frame) {

        return __find_callno(callno, dcallno, addr, new, sockfd, 1, full_frame);
}

/*!
 * \brief Queue a frame to a call's owning asterisk channel
 *
 * \pre This function assumes that iaxsl[callno] is locked when called.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_frame(int callno, struct ast_frame *f)
{
        iax2_lock_owner(callno);
        if (iaxs[callno] && iaxs[callno]->owner) {
                ast_queue_frame(iaxs[callno]->owner, f);
                ast_channel_unlock(iaxs[callno]->owner);
        }
        return 0;
}

/*!
 * \brief Queue a hold frame on the ast_channel owner
 *
 * This function queues a hold frame on the owner of the IAX2 pvt struct that
 * is active for the given call number.
 *
 * \pre Assumes lock for callno is already held.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_hold(int callno, const char *musicclass)
{
        iax2_lock_owner(callno);
        if (iaxs[callno] && iaxs[callno]->owner) {
                ast_queue_hold(iaxs[callno]->owner, musicclass);
                ast_channel_unlock(iaxs[callno]->owner);
        }
        return 0;
}

/*!
 * \brief Queue an unhold frame on the ast_channel owner
 *
 * This function queues an unhold frame on the owner of the IAX2 pvt struct that
 * is active for the given call number.
 *
 * \pre Assumes lock for callno is already held.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_unhold(int callno)
{
        iax2_lock_owner(callno);
        if (iaxs[callno] && iaxs[callno]->owner) {
                ast_queue_unhold(iaxs[callno]->owner);
                ast_channel_unlock(iaxs[callno]->owner);
        }
        return 0;
}

/*!
 * \brief Queue a hangup frame on the ast_channel owner
 *
 * This function queues a hangup frame on the owner of the IAX2 pvt struct that
 * is active for the given call number.
 *
 * \pre Assumes lock for callno is already held.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_hangup(int callno)
{
        iax2_lock_owner(callno);
        if (iaxs[callno] && iaxs[callno]->owner) {
                ast_queue_hangup(iaxs[callno]->owner);
                ast_channel_unlock(iaxs[callno]->owner);
        }
        return 0;
}

/*!
 * \note This function assumes that iaxsl[callno] is locked when called.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function calls iax2_queue_frame(), which may unlock and lock the mutex
 * associated with this callno, meaning that another thread may grab it and destroy the call.
 */
static int __do_deliver(void *data)
{
        /* Just deliver the packet by using queueing.  This is called by
          the IAX thread with the iaxsl lock held. */
        struct iax_frame *fr = data;
        fr->retrans = -1;
        ast_clear_flag(&fr->af, AST_FRFLAG_HAS_TIMING_INFO);
        if (iaxs[fr->callno] && !ast_test_flag64(iaxs[fr->callno], IAX_ALREADYGONE))
                iax2_queue_frame(fr->callno, &fr->af);
        /* Free our iax frame */
        iax2_frame_free(fr);
        /* And don't run again */
        return 0;
}

static int handle_error(void)
{
        /* XXX Ideally we should figure out why an error occurred and then abort those
           rather than continuing to try.  Unfortunately, the published interface does
           not seem to work XXX */
#if 0
        struct sockaddr_in *sin;
        int res;
        struct msghdr m;
        struct sock_extended_err e;
        m.msg_name = NULL;
        m.msg_namelen = 0;
        m.msg_iov = NULL;
        m.msg_control = &e;
        m.msg_controllen = sizeof(e);
        m.msg_flags = 0;
        res = recvmsg(netsocket, &m, MSG_ERRQUEUE);
        if (res < 0)
                ast_log(LOG_WARNING, "Error detected, but unable to read error: %s\n", strerror(errno));
        else {
                if (m.msg_controllen) {
                        sin = (struct sockaddr_in *)SO_EE_OFFENDER(&e);
                        if (sin)
                                ast_log(LOG_WARNING, "Receive error from %s\n", ast_inet_ntoa(sin->sin_addr));
                        else
                                ast_log(LOG_WARNING, "No address detected??\n");
                } else {
                        ast_log(LOG_WARNING, "Local error: %s\n", strerror(e.ee_errno));
                }
        }
#endif
        return 0;
}

static int transmit_trunk(struct iax_frame *f, struct ast_sockaddr *addr, int sockfd)
{
        int res;
        res = ast_sendto(sockfd, f->data, f->datalen, 0, addr);

        if (res < 0) {
                ast_debug(1, "Received error: %s\n", strerror(errno));
                handle_error();
        } else
                res = 0;
        return res;
}

static int send_packet(struct iax_frame *f)
{
        int res;
        int callno = f->callno;

        /* Don't send if there was an error, but return error instead */
        if (!callno || !iaxs[callno] || iaxs[callno]->error)
            return -1;

        /* Called with iaxsl held */
        if (iaxdebug) {
                ast_debug(3, "Sending %u on %d/%d to %s\n", f->ts, callno, iaxs[callno]->peercallno, ast_sockaddr_stringify(&iaxs[callno]->addr));
        }
        if (f->transfer) {
                iax_outputframe(f, NULL, 0, &iaxs[callno]->transfer, f->datalen - sizeof(struct ast_iax2_full_hdr));
                res = ast_sendto(iaxs[callno]->sockfd, f->data, f->datalen, 0, &iaxs[callno]->transfer);
        } else {
                iax_outputframe(f, NULL, 0, &iaxs[callno]->addr, f->datalen - sizeof(struct ast_iax2_full_hdr));
                res = ast_sendto(iaxs[callno]->sockfd, f->data, f->datalen, 0, &iaxs[callno]->addr);
        }
        if (res < 0) {
                if (iaxdebug)
                        ast_debug(1, "Received error: %s\n", strerror(errno));
                handle_error();
        } else
                res = 0;

        return res;
}

/*!
 * \note Since this function calls iax2_queue_hangup(), the pvt struct
 *       for the given call number may disappear during its execution.
 */
static int iax2_predestroy(int callno)
{
        struct ast_channel *c = NULL;
        struct chan_iax2_pvt *pvt = iaxs[callno];

        if (!pvt)
                return -1;

        if (!ast_test_flag64(pvt, IAX_ALREADYGONE)) {
                iax2_destroy_helper(pvt);
                ast_set_flag64(pvt, IAX_ALREADYGONE);
        }

        if ((c = pvt->owner)) {
                ast_channel_tech_pvt_set(c, NULL);
                iax2_queue_hangup(callno);
                pvt->owner = NULL;
                ast_module_unref(ast_module_info->self);
        }

        return 0;
}

static void iax2_destroy(int callno)
{
        struct chan_iax2_pvt *pvt = NULL;
        struct ast_channel *owner = NULL;

retry:
        if ((pvt = iaxs[callno])) {
#if 0
                /* iax2_destroy_helper gets called from this function later on.  When
                 * called twice, we get the (previously) familiar FRACK! errors in
                 * devmode, from the scheduler.  An alternative to this approach is to
                 * reset the scheduler entries to -1 when they're deleted in
                 * iax2_destroy_helper().  That approach was previously decided to be
                 * "wrong" because "the memory is going to be deallocated anyway.  Why
                 * should we be resetting those values?" */
                iax2_destroy_helper(pvt);
#endif
        }

        owner = pvt ? pvt->owner : NULL;

        if (owner) {
                if (ast_channel_trylock(owner)) {
                        ast_debug(3, "Avoiding IAX destroy deadlock\n");
                        DEADLOCK_AVOIDANCE(&iaxsl[callno]);
                        goto retry;
                }
        }

        if (!owner) {
                iaxs[callno] = NULL;
        }

        if (pvt) {
                if (!owner) {
                        pvt->owner = NULL;
                } else {
                        /* If there's an owner, prod it to give up */
                        /* It is ok to use ast_queue_hangup() here instead of iax2_queue_hangup()
                         * because we already hold the owner channel lock. */
                        ast_queue_hangup(owner);
                }

                if (pvt->peercallno) {
                        remove_by_peercallno(pvt);
                }

                if (pvt->transfercallno) {
                        remove_by_transfercallno(pvt);
                }

                if (!owner) {
                        ao2_ref(pvt, -1);
                        pvt = NULL;
                }
        }

        if (owner) {
                ast_channel_unlock(owner);
        }
}

static int update_packet(struct iax_frame *f)
{
        /* Called with iaxsl lock held, and iaxs[callno] non-NULL */
        struct ast_iax2_full_hdr *fh = f->data;
        struct ast_frame af;

        /* if frame is encrypted. decrypt before updating it. */
        if (f->encmethods) {
                decode_frame(&f->mydcx, fh, &af, &f->datalen);
        }
        /* Mark this as a retransmission */
        fh->dcallno = ntohs(IAX_FLAG_RETRANS | f->dcallno);
        /* Update iseqno */
        f->iseqno = iaxs[f->callno]->iseqno;
        fh->iseqno = f->iseqno;

        /* Now re-encrypt the frame */
        if (f->encmethods) {
        /* since this is a retransmit frame, create a new random padding
         * before re-encrypting. */
                build_rand_pad(f->semirand, sizeof(f->semirand));
                encrypt_frame(&f->ecx, fh, f->semirand, &f->datalen);
        }
        return 0;
}

static int attempt_transmit(const void *data);
static void __attempt_transmit(const void *data)
{
        /* Attempt to transmit the frame to the remote peer...
           Called without iaxsl held. */
        struct iax_frame *f = (struct iax_frame *)data;
        int freeme = 0;
        int callno = f->callno;

        /* Make sure this call is still active */
        if (callno)
                ast_mutex_lock(&iaxsl[callno]);
        if (callno && iaxs[callno]) {
                if (f->retries < 0) {
                        /* Already ACK'd */
                        freeme = 1;
                } else if (f->retries >= max_retries) {
                        /* Too many attempts.  Record an error. */
                        if (f->transfer) {
                                /* Transfer timeout */
                                send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_TXREJ, 0, NULL, 0, -1);
                        } else if (f->final) {
                                iax2_destroy(callno);
                        } else {
                                if (iaxs[callno]->owner) {
                                        ast_log(LOG_WARNING, "Max retries exceeded to host %s on %s (type = %u, subclass = %d, ts=%u, seqno=%d)\n",
                                                ast_sockaddr_stringify_addr(&iaxs[f->callno]->addr),
                                                ast_channel_name(iaxs[f->callno]->owner),
                                                f->af.frametype,
                                                f->af.subclass.integer,
                                                f->ts,
                                                f->oseqno);
                                }
                                iaxs[callno]->error = ETIMEDOUT;
                                if (iaxs[callno]->owner) {
                                        struct ast_frame fr = { AST_FRAME_CONTROL, { AST_CONTROL_HANGUP }, .data.uint32 = AST_CAUSE_DESTINATION_OUT_OF_ORDER };
                                        /* Hangup the fd */
                                        iax2_queue_frame(callno, &fr); /* XXX */
                                        /* Remember, owner could disappear */
                                        if (iaxs[callno] && iaxs[callno]->owner)
                                                ast_channel_hangupcause_set(iaxs[callno]->owner, AST_CAUSE_DESTINATION_OUT_OF_ORDER);
                                } else {
                                        if (iaxs[callno]->reg) {
                                                memset(&iaxs[callno]->reg->us, 0, sizeof(iaxs[callno]->reg->us));
                                                iaxs[callno]->reg->regstate = REG_STATE_TIMEOUT;
                                                iaxs[callno]->reg->refresh = IAX_DEFAULT_REG_EXPIRE;
                                        }
                                        iax2_destroy(callno);
                                }
                        }
                        freeme = 1;
                } else {
                        /* Update it if it needs it */
                        update_packet(f);
                        /* Attempt transmission */
                        send_packet(f);
                        f->retries++;
                        /* Try again later after 10 times as long */
                        f->retrytime *= 10;
                        if (f->retrytime > MAX_RETRY_TIME)
                                f->retrytime = MAX_RETRY_TIME;
                        /* Transfer messages max out at one second */
                        if (f->transfer && (f->retrytime > 1000))
                                f->retrytime = 1000;
                        f->retrans = iax2_sched_add(sched, f->retrytime, attempt_transmit, f);
                }
        } else {
                /* Make sure it gets freed */
                f->retries = -1;
                freeme = 1;
        }

        if (freeme) {
                /* Don't attempt delivery, just remove it from the queue */
                AST_LIST_REMOVE(&frame_queue[callno], f, list);
                ast_mutex_unlock(&iaxsl[callno]);
                f->retrans = -1; /* this is safe because this is the scheduled function */
                /* Free the IAX frame */
                iax2_frame_free(f);
        } else if (callno) {
                ast_mutex_unlock(&iaxsl[callno]);
        }
}

static int attempt_transmit(const void *data)
{
#ifdef SCHED_MULTITHREADED
        if (schedule_action(__attempt_transmit, data))
#endif
                __attempt_transmit(data);
        return 0;
}

static char *handle_cli_iax2_prune_realtime(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        struct iax2_peer *peer = NULL;
        struct iax2_user *user = NULL;
        static const char * const choices[] = { "all", NULL };
        char *cmplt;

        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 prune realtime";
                e->usage =
                        "Usage: iax2 prune realtime [<peername>|all]\n"
                        "       Prunes object(s) from the cache\n";
                return NULL;
        case CLI_GENERATE:
                if (a->pos == 3) {
                        cmplt = ast_cli_complete(a->word, choices, a->n);
                        if (!cmplt)
                                cmplt = complete_iax2_peers(a->line, a->word, a->pos, a->n - sizeof(choices), IAX_RTCACHEFRIENDS);
                        return cmplt;
                }
                return NULL;
        }
        if (a->argc != 4)
                return CLI_SHOWUSAGE;
        if (!strcmp(a->argv[3], "all")) {
                prune_users();
                prune_peers();
                ast_cli(a->fd, "Cache flushed successfully.\n");
                return CLI_SUCCESS;
        }
        peer = find_peer(a->argv[3], 0);
        user = find_user(a->argv[3]);
        if (peer || user) {
                if (peer) {
                        if (ast_test_flag64(peer, IAX_RTCACHEFRIENDS)) {
                                ast_set_flag64(peer, IAX_RTAUTOCLEAR);
                                expire_registry(peer_ref(peer));
                                ast_cli(a->fd, "Peer %s was removed from the cache.\n", a->argv[3]);
                        } else {
                                ast_cli(a->fd, "Peer %s is not eligible for this operation.\n", a->argv[3]);
                        }
                        peer_unref(peer);
                }
                if (user) {
                        if (ast_test_flag64(user, IAX_RTCACHEFRIENDS)) {
                                ast_set_flag64(user, IAX_RTAUTOCLEAR);
                                ast_cli(a->fd, "User %s was removed from the cache.\n", a->argv[3]);
                        } else {
                                ast_cli(a->fd, "User %s is not eligible for this operation.\n", a->argv[3]);
                        }
                        ao2_unlink(users,user);
                        user_unref(user);
                }
        } else {
                ast_cli(a->fd, "%s was not found in the cache.\n", a->argv[3]);
        }

        return CLI_SUCCESS;
}

static char *handle_cli_iax2_test_losspct(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 test losspct";
                e->usage =
                        "Usage: iax2 test losspct <percentage>\n"
                        "       For testing, throws away <percentage> percent of incoming packets\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }
        if (a->argc != 4)
                return CLI_SHOWUSAGE;

        test_losspct = atoi(a->argv[3]);

        return CLI_SUCCESS;
}

#ifdef IAXTESTS
static char *handle_cli_iax2_test_late(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 test late";
                e->usage =
                        "Usage: iax2 test late <ms>\n"
                        "       For testing, count the next frame as <ms> ms late\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        if (a->argc != 4)
                return CLI_SHOWUSAGE;

        test_late = atoi(a->argv[3]);

        return CLI_SUCCESS;
}

static char *handle_cli_iax2_test_resync(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 test resync";
                e->usage =
                        "Usage: iax2 test resync <ms>\n"
                        "       For testing, adjust all future frames by <ms> ms\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        if (a->argc != 4)
                return CLI_SHOWUSAGE;

        test_resync = atoi(a->argv[3]);

        return CLI_SUCCESS;
}

static char *handle_cli_iax2_test_jitter(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 test jitter";
                e->usage =
                        "Usage: iax2 test jitter <ms> <pct>\n"
                        "       For testing, simulate maximum jitter of +/- <ms> on <pct>\n"
                        "       percentage of packets. If <pct> is not specified, adds\n"
                        "       jitter to all packets.\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        if (a->argc < 4 || a->argc > 5)
                return CLI_SHOWUSAGE;

        test_jit = atoi(a->argv[3]);
        if (a->argc == 5)
                test_jitpct = atoi(a->argv[4]);

        return CLI_SUCCESS;
}
#endif /* IAXTESTS */