res_pjsip: Fix leak on error in ast_sip_auth_vector_init.
[asterisk/asterisk.git] / res / res_pjsip_refer.c
index 399e9e6..62f8b67 100644 (file)
@@ -20,7 +20,6 @@
        <depend>pjproject</depend>
        <depend>res_pjsip</depend>
        <depend>res_pjsip_session</depend>
-       <depend>res_pjsip_pubsub</depend>
        <support_level>core</support_level>
  ***/
 
@@ -38,6 +37,7 @@
 #include "asterisk/framehook.h"
 #include "asterisk/stasis_bridges.h"
 #include "asterisk/stasis_channels.h"
+#include "asterisk/causes.h"
 
 /*! \brief REFER Progress structure */
 struct refer_progress {
@@ -55,8 +55,14 @@ struct refer_progress {
        struct ast_taskprocessor *serializer;
        /*! \brief Stasis subscription for bridge events */
        struct stasis_subscription *bridge_sub;
+       /*! \brief Reference to transfer_channel_data related to the refer */
+       struct transfer_channel_data *transfer_data;
        /*! \brief Uniqueid of transferee channel */
        char *transferee;
+       /*! \brief Non-zero if the 100 notify has been sent */
+       int sent_100;
+       /*! \brief Whether to notifies all the progress details on blind transfer */
+       unsigned int refer_blind_progress;
 };
 
 /*! \brief REFER Progress notification structure */
@@ -110,7 +116,7 @@ static int refer_progress_notify(void *data)
 
        /* If the subscription has already been terminated we can't send a notification */
        if (!(sub = notification->progress->sub)) {
-               ast_debug(3, "Not sending NOTIFY of response '%d' and state '%d' on progress monitor '%p' as subscription has been terminated\n",
+               ast_debug(3, "Not sending NOTIFY of response '%d' and state '%u' on progress monitor '%p' as subscription has been terminated\n",
                        notification->response, notification->state, notification->progress);
                return 0;
        }
@@ -131,7 +137,19 @@ static int refer_progress_notify(void *data)
                notification->progress->sub = NULL;
        }
 
-       ast_debug(3, "Sending NOTIFY with response '%d' and state '%d' on subscription '%p' and progress monitor '%p'\n",
+       /* Send a deferred initial 100 Trying SIP frag NOTIFY if we haven't already. */
+       if (!notification->progress->sent_100) {
+               notification->progress->sent_100 = 1;
+               if (notification->response != 100) {
+                       ast_debug(3, "Sending initial 100 Trying NOTIFY for progress monitor '%p'\n",
+                               notification->progress);
+                       if (pjsip_xfer_notify(sub, PJSIP_EVSUB_STATE_ACTIVE, 100, NULL, &tdata) == PJ_SUCCESS) {
+                               pjsip_xfer_send_request(sub, tdata);
+                       }
+               }
+       }
+
+       ast_debug(3, "Sending NOTIFY with response '%d' and state '%u' on subscription '%p' and progress monitor '%p'\n",
                notification->response, notification->state, sub, notification->progress);
 
        /* Actually send the notification */
@@ -148,6 +166,7 @@ static void refer_progress_bridge(void *data, struct stasis_subscription *sub,
        struct refer_progress *progress = data;
        struct ast_bridge_blob *enter_blob;
        struct refer_progress_notification *notification;
+       struct ast_channel *chan;
 
        if (stasis_subscription_final_message(sub, message)) {
                ao2_ref(progress, -1);
@@ -165,6 +184,12 @@ static void refer_progress_bridge(void *data, struct stasis_subscription *sub,
                return;
        }
 
+       if (!progress->transfer_data->completed) {
+               /* We can't act on this message because the transfer_channel_data doesn't show that
+                * the transfer is ready to progress */
+               return;
+       }
+
        /* OMG the transferee is joining a bridge. His call got answered! */
        notification = refer_progress_notification_alloc(progress, 200, PJSIP_EVSUB_STATE_TERMINATED);
        if (notification) {
@@ -173,6 +198,20 @@ static void refer_progress_bridge(void *data, struct stasis_subscription *sub,
                }
                progress->bridge_sub = stasis_unsubscribe(progress->bridge_sub);
        }
+
+       chan = ast_channel_get_by_name(progress->transferee);
+       if (!chan) {
+               /* The channel is already gone */
+               return;
+       }
+
+       ast_channel_lock(chan);
+       ast_debug(3, "Detaching REFER progress monitoring hook from '%s' as it has joined a bridge\n",
+               ast_channel_name(chan));
+       ast_framehook_detach(chan, progress->framehook);
+       ast_channel_unlock(chan);
+
+       ast_channel_unref(chan);
 }
 
 /*! \brief Progress monitoring frame hook - examines frames to determine state of transfer */
@@ -186,12 +225,16 @@ static struct ast_frame *refer_progress_framehook(struct ast_channel *chan, stru
                return f;
        }
 
+       /* If the completed flag hasn't been raised, skip this pass. */
+       if (!progress->transfer_data->completed) {
+               return f;
+       }
+
        /* Determine the state of the REFER based on the control frames (or voice frames) passing */
        if (f->frametype == AST_FRAME_VOICE && !progress->subclass) {
                /* Media is passing without progress, this means the call has been answered */
                notification = refer_progress_notification_alloc(progress, 200, PJSIP_EVSUB_STATE_TERMINATED);
        } else if (f->frametype == AST_FRAME_CONTROL) {
-
                /* Based on the control frame being written we can send a NOTIFY advising of the progress */
                if ((f->subclass.integer == AST_CONTROL_RING) || (f->subclass.integer == AST_CONTROL_RINGING)) {
                        progress->subclass = f->subclass.integer;
@@ -216,16 +259,16 @@ static struct ast_frame *refer_progress_framehook(struct ast_channel *chan, stru
 
        /* If a notification is due to be sent push it to the thread pool */
        if (notification) {
-               if (ast_sip_push_task(progress->serializer, refer_progress_notify, notification)) {
-                       ao2_cleanup(notification);
-               }
-
                /* If the subscription is being terminated we don't need the frame hook any longer */
                if (notification->state == PJSIP_EVSUB_STATE_TERMINATED) {
                        ast_debug(3, "Detaching REFER progress monitoring hook from '%s' as subscription is being terminated\n",
                                ast_channel_name(chan));
                        ast_framehook_detach(chan, progress->framehook);
                }
+
+               if (ast_sip_push_task(progress->serializer, refer_progress_notify, notification)) {
+                       ao2_cleanup(notification);
+               }
        }
 
        return f;
@@ -241,6 +284,10 @@ static void refer_progress_framehook_destroy(void *data)
                ao2_cleanup(notification);
        }
 
+       if (progress->bridge_sub) {
+               progress->bridge_sub = stasis_unsubscribe(progress->bridge_sub);
+       }
+
        ao2_cleanup(progress);
 }
 
@@ -297,6 +344,8 @@ static void refer_progress_destroy(void *obj)
                progress->bridge_sub = stasis_unsubscribe(progress->bridge_sub);
        }
 
+       ao2_cleanup(progress->transfer_data);
+
        ast_free(progress->transferee);
        ast_taskprocessor_unreference(progress->serializer);
 }
@@ -307,8 +356,8 @@ static int refer_progress_alloc(struct ast_sip_session *session, pjsip_rx_data *
        const pj_str_t str_refer_sub = { "Refer-Sub", 9 };
        pjsip_generic_string_hdr *refer_sub = NULL;
        const pj_str_t str_true = { "true", 4 };
-       pjsip_tx_data *tdata;
        pjsip_hdr hdr_list;
+       char tps_name[AST_TASKPROCESSOR_MAX_NAME + 1];
 
        *progress = NULL;
 
@@ -325,12 +374,18 @@ static int refer_progress_alloc(struct ast_sip_session *session, pjsip_rx_data *
        ast_debug(3, "Created progress monitor '%p' for transfer occurring from channel '%s' and endpoint '%s'\n",
                progress, ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint));
 
+       (*progress)->refer_blind_progress = session->endpoint->refer_blind_progress;
+
        (*progress)->framehook = -1;
 
        /* To prevent a potential deadlock we need the dialog so we can lock/unlock */
        (*progress)->dlg = session->inv_session->dlg;
 
-       if (!((*progress)->serializer = ast_sip_create_serializer())) {
+       /* Create name with seq number appended. */
+       ast_taskprocessor_build_name(tps_name, sizeof(tps_name), "pjsip/refer/%s",
+               ast_sorcery_object_get_id(session->endpoint));
+
+       if (!((*progress)->serializer = ast_sip_create_serializer(tps_name))) {
                goto error;
        }
 
@@ -354,12 +409,6 @@ static int refer_progress_alloc(struct ast_sip_session *session, pjsip_rx_data *
        ast_debug(3, "Accepting REFER request for progress monitor '%p'\n", *progress);
        pjsip_xfer_accept((*progress)->sub, rdata, 202, &hdr_list);
 
-       /* Send initial NOTIFY Request */
-       ast_debug(3, "Sending initial 100 Trying NOTIFY for progress monitor '%p'\n", *progress);
-       if (pjsip_xfer_notify((*progress)->sub, PJSIP_EVSUB_STATE_ACTIVE, 100, NULL, &tdata) == PJ_SUCCESS) {
-               pjsip_xfer_send_request((*progress)->sub, tdata);
-       }
-
        return 0;
 
 error:
@@ -375,7 +424,7 @@ struct refer_attended {
        /*! \brief Transferer channel */
        struct ast_channel *transferer_chan;
        /*! \brief Second transferer session */
-       struct ast_sip_session *transferer_second       ;
+       struct ast_sip_session *transferer_second;
        /*! \brief Optional refer progress structure */
        struct refer_progress *progress;
 };
@@ -386,16 +435,20 @@ static void refer_attended_destroy(void *obj)
        struct refer_attended *attended = obj;
 
        ao2_cleanup(attended->transferer);
-       ast_channel_unref(attended->transferer_chan);
+       ast_channel_cleanup(attended->transferer_chan);
        ao2_cleanup(attended->transferer_second);
+       ao2_cleanup(attended->progress);
 }
 
 /*! \brief Allocator for attended transfer task */
-static struct refer_attended *refer_attended_alloc(struct ast_sip_session *transferer, struct ast_sip_session *transferer_second,
+static struct refer_attended *refer_attended_alloc(struct ast_sip_session *transferer,
+       struct ast_sip_session *transferer_second,
        struct refer_progress *progress)
 {
-       struct refer_attended *attended = ao2_alloc(sizeof(*attended), refer_attended_destroy);
+       struct refer_attended *attended;
 
+       attended = ao2_alloc_options(sizeof(*attended), refer_attended_destroy,
+               AO2_ALLOC_OPT_LOCK_NOLOCK);
        if (!attended) {
                return NULL;
        }
@@ -415,20 +468,30 @@ static struct refer_attended *refer_attended_alloc(struct ast_sip_session *trans
        return attended;
 }
 
-/*! \brief Task for attended transfer */
-static int refer_attended(void *data)
+static int defer_termination_cancel(void *data)
 {
-       RAII_VAR(struct refer_attended *, attended, data, ao2_cleanup);
-       int response = 0;
+       struct ast_sip_session *session = data;
 
-       if (!attended->transferer_second->channel) {
-               return -1;
-       }
+       ast_sip_session_defer_termination_cancel(session);
+       ao2_ref(session, -1);
+       return 0;
+}
 
-       ast_debug(3, "Performing a REFER attended transfer - Transferer #1: %s Transferer #2: %s\n",
-               ast_channel_name(attended->transferer_chan), ast_channel_name(attended->transferer_second->channel));
+/*!
+ * \internal
+ * \brief Convert transfer enum to SIP response code.
+ * \since 13.3.0
+ *
+ * \param xfer_code Core transfer function enum result.
+ *
+ * \return SIP response code
+ */
+static int xfer_response_code2sip(enum ast_transfer_result xfer_code)
+{
+       int response;
 
-       switch (ast_bridge_transfer_attended(attended->transferer_chan, attended->transferer_second->channel)) {
+       response = 503;
+       switch (xfer_code) {
        case AST_BRIDGE_TRANSFER_INVALID:
                response = 400;
                break;
@@ -440,21 +503,56 @@ static int refer_attended(void *data)
                break;
        case AST_BRIDGE_TRANSFER_SUCCESS:
                response = 200;
-               ast_sip_session_defer_termination(attended->transferer);
                break;
        }
+       return response;
+}
 
-       ast_debug(3, "Final response for REFER attended transfer - Transferer #1: %s Transferer #2: %s is '%d'\n",
-               ast_channel_name(attended->transferer_chan), ast_channel_name(attended->transferer_second->channel), response);
+/*! \brief Task for attended transfer executed by attended->transferer_second serializer */
+static int refer_attended_task(void *data)
+{
+       struct refer_attended *attended = data;
+       int response;
+
+       if (attended->transferer_second->channel) {
+               ast_debug(3, "Performing a REFER attended transfer - Transferer #1: %s Transferer #2: %s\n",
+                       ast_channel_name(attended->transferer_chan),
+                       ast_channel_name(attended->transferer_second->channel));
 
-       if (attended->progress && response) {
-               struct refer_progress_notification *notification = refer_progress_notification_alloc(attended->progress, response, PJSIP_EVSUB_STATE_TERMINATED);
+               response = xfer_response_code2sip(ast_bridge_transfer_attended(
+                       attended->transferer_chan,
+                       attended->transferer_second->channel));
 
+               ast_debug(3, "Final response for REFER attended transfer - Transferer #1: %s Transferer #2: %s is '%d'\n",
+                       ast_channel_name(attended->transferer_chan),
+                       ast_channel_name(attended->transferer_second->channel),
+                       response);
+       } else {
+               ast_debug(3, "Received REFER request on channel '%s' but other channel has gone.\n",
+                       ast_channel_name(attended->transferer_chan));
+               response = 603;
+       }
+
+       if (attended->progress) {
+               struct refer_progress_notification *notification;
+
+               notification = refer_progress_notification_alloc(attended->progress, response,
+                       PJSIP_EVSUB_STATE_TERMINATED);
                if (notification) {
                        refer_progress_notify(notification);
                }
        }
 
+       ast_sip_session_end_if_deferred(attended->transferer);
+       if (response != 200) {
+               if (!ast_sip_push_task(attended->transferer->serializer,
+                       defer_termination_cancel, attended->transferer)) {
+                       /* Gave the ref to the pushed task. */
+                       attended->transferer = NULL;
+               }
+       }
+
+       ao2_ref(attended, -1);
        return 0;
 }
 
@@ -470,24 +568,38 @@ struct refer_blind {
        pjsip_replaces_hdr *replaces;
        /*! \brief Optional Refer-To header */
        pjsip_sip_uri *refer_to;
+       /*! \brief Attended transfer flag */
+       unsigned int attended:1;
 };
 
 /*! \brief Blind transfer callback function */
-static void refer_blind_callback(struct ast_channel *chan, void *user_data, enum ast_transfer_type transfer_type)
+static void refer_blind_callback(struct ast_channel *chan, struct transfer_channel_data *user_data_wrapper,
+       enum ast_transfer_type transfer_type)
 {
-       struct refer_blind *refer = user_data;
-       const pj_str_t str_referred_by = { "Referred-By", 11 };
-       pjsip_generic_string_hdr *referred_by = pjsip_msg_find_hdr_by_name(refer->rdata->msg_info.msg, &str_referred_by, NULL);
+       struct refer_blind *refer = user_data_wrapper->data;
+       pjsip_generic_string_hdr *referred_by;
+
+       static const pj_str_t str_referred_by = { "Referred-By", 11 };
+       static const pj_str_t str_referred_by_s = { "b", 1 };
 
        pbx_builtin_setvar_helper(chan, "SIPTRANSFER", "yes");
 
-       /* If progress monitoring is being done attach a frame hook so we can monitor it */
-       if (refer->progress) {
+       if (refer->progress && !refer->attended && !refer->progress->refer_blind_progress) {
+               /* If blind transfer and endpoint doesn't want to receive all the progress details */
+               struct refer_progress_notification *notification = refer_progress_notification_alloc(refer->progress, 200,
+                       PJSIP_EVSUB_STATE_TERMINATED);
+
+               if (notification) {
+                       refer_progress_notify(notification);
+               }
+       } else if (refer->progress) {
+               /* If attended transfer and progress monitoring is being done attach a frame hook so we can monitor it */
                struct ast_framehook_interface hook = {
                        .version = AST_FRAMEHOOK_INTERFACE_VERSION,
                        .event_cb = refer_progress_framehook,
                        .destroy_cb = refer_progress_framehook_destroy,
                        .data = refer->progress,
+                       .disable_inheritance = 1,
                };
 
                refer->progress->transferee = ast_strdup(ast_channel_uniqueid(chan));
@@ -503,11 +615,18 @@ static void refer_blind_callback(struct ast_channel *chan, void *user_data, enum
                        }
                }
 
+               /* Progress needs a reference to the transfer_channel_data so that it can track the completed status of the transfer */
+               ao2_ref(user_data_wrapper, +1);
+               refer->progress->transfer_data = user_data_wrapper;
+
                /* We need to bump the reference count up on the progress structure since it is in the frame hook now */
                ao2_ref(refer->progress, +1);
 
                /* If we can't attach a frame hook for whatever reason send a notification of success immediately */
-               if ((refer->progress->framehook = ast_framehook_attach(chan, &hook)) < 0) {
+               ast_channel_lock(chan);
+               refer->progress->framehook = ast_framehook_attach(chan, &hook);
+               ast_channel_unlock(chan);
+               if (refer->progress->framehook < 0) {
                        struct refer_progress_notification *notification = refer_progress_notification_alloc(refer->progress, 200,
                                PJSIP_EVSUB_STATE_TERMINATED);
 
@@ -526,7 +645,7 @@ static void refer_blind_callback(struct ast_channel *chan, void *user_data, enum
                /* We also will need to detect if the transferee enters a bridge. This is currently the only reliable way to
                 * detect if the transfer target has answered the call
                 */
-               refer->progress->bridge_sub = stasis_subscribe(ast_bridge_topic_all(), refer_progress_bridge, refer->progress);
+               refer->progress->bridge_sub = stasis_subscribe_pool(ast_bridge_topic_all(), refer_progress_bridge, refer->progress);
                if (!refer->progress->bridge_sub) {
                        struct refer_progress_notification *notification = refer_progress_notification_alloc(refer->progress, 200,
                                PJSIP_EVSUB_STATE_TERMINATED);
@@ -538,38 +657,74 @@ static void refer_blind_callback(struct ast_channel *chan, void *user_data, enum
                                refer_progress_notify(notification);
                        }
 
+                       ast_channel_lock(chan);
                        ast_framehook_detach(chan, refer->progress->framehook);
+                       ast_channel_unlock(chan);
 
                        ao2_cleanup(refer->progress);
                }
        }
 
-       if (!ast_strlen_zero(refer->context)) {
-               pbx_builtin_setvar_helper(chan, "SIPREFERRINGCONTEXT", refer->context);
-       }
+       pbx_builtin_setvar_helper(chan, "SIPREFERRINGCONTEXT", S_OR(refer->context, NULL));
 
+       referred_by = pjsip_msg_find_hdr_by_names(refer->rdata->msg_info.msg,
+               &str_referred_by, &str_referred_by_s, NULL);
        if (referred_by) {
-               char *uri = referred_by->hvalue.ptr;
+               size_t uri_size = pj_strlen(&referred_by->hvalue) + 1;
+               char *uri = ast_alloca(uri_size);
 
-               uri[referred_by->hvalue.slen] = '\0';
-               pbx_builtin_setvar_helper(chan, "SIPREFERREDBYHDR", uri);
+               ast_copy_pj_str(uri, &referred_by->hvalue, uri_size);
+               pbx_builtin_setvar_helper(chan, "__SIPREFERREDBYHDR", S_OR(uri, NULL));
+       } else {
+               pbx_builtin_setvar_helper(chan, "SIPREFERREDBYHDR", NULL);
        }
 
        if (refer->replaces) {
                char replaces[512];
-
-               pjsip_hdr_print_on(refer->replaces, replaces, sizeof(replaces));
-               pbx_builtin_setvar_helper(chan, "SIPREPLACESHDR", replaces);
+               char *replaces_val = NULL;
+               int len;
+
+               len = pjsip_hdr_print_on(refer->replaces, replaces, sizeof(replaces) - 1);
+               if (len != -1) {
+                       /* pjsip_hdr_print_on does not NULL terminate the buffer */
+                       replaces[len] = '\0';
+                       replaces_val = replaces + sizeof("Replaces:");
+               }
+               pbx_builtin_setvar_helper(chan, "__SIPREPLACESHDR", replaces_val);
+       } else {
+               pbx_builtin_setvar_helper(chan, "SIPREPLACESHDR", NULL);
        }
 
        if (refer->refer_to) {
                char refer_to[PJSIP_MAX_URL_SIZE];
 
                pjsip_uri_print(PJSIP_URI_IN_REQ_URI, refer->refer_to, refer_to, sizeof(refer_to));
-               pbx_builtin_setvar_helper(chan, "SIPREFERTOHDR", refer_to);
+               pbx_builtin_setvar_helper(chan, "SIPREFERTOHDR", S_OR(refer_to, NULL));
+       } else {
+               pbx_builtin_setvar_helper(chan, "SIPREFERTOHDR", NULL);
        }
 }
 
+/*!
+ * \internal
+ * \brief Set the passed in context variable to the determined transfer context.
+ * \since 13.3.0
+ *
+ * \param context Set to the determined transfer context.
+ * \param session INVITE dialog SIP session.
+ */
+#define DETERMINE_TRANSFER_CONTEXT(context, session)                                                                   \
+       do {                                                                                                                                                            \
+               ast_channel_lock((session)->channel);                                                                                   \
+               context = pbx_builtin_getvar_helper((session)->channel, "TRANSFER_CONTEXT");    \
+               if (ast_strlen_zero(context)) {                                                                                                 \
+                       context = (session)->endpoint->context;                                                                         \
+               } else {                                                                                                                                                \
+                       context = ast_strdupa(context);                                                                                         \
+               }                                                                                                                                                               \
+               ast_channel_unlock((session)->channel);                                                                                 \
+       } while (0)                                                                                                                                                     \
+
 static int refer_incoming_attended_request(struct ast_sip_session *session, pjsip_rx_data *rdata, pjsip_sip_uri *target_uri,
        pjsip_param *replaces_param, struct refer_progress *progress)
 {
@@ -609,8 +764,17 @@ static int refer_incoming_attended_request(struct ast_sip_session *session, pjsi
                        return 500;
                }
 
+               if (ast_sip_session_defer_termination(session)) {
+                       ast_log(LOG_ERROR, "Received REFER request on channel '%s' from endpoint '%s' for local dialog but could not defer termination, rejecting\n",
+                               ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint));
+                       ao2_cleanup(attended);
+                       return 500;
+               }
+
                /* Push it to the other session, which will have both channels with minimal locking */
-               if (ast_sip_push_task(other_session->serializer, refer_attended, attended)) {
+               if (ast_sip_push_task(other_session->serializer, refer_attended_task, attended)) {
+                       ast_sip_session_end_if_deferred(session);
+                       ast_sip_session_defer_termination_cancel(session);
                        ao2_cleanup(attended);
                        return 500;
                }
@@ -620,16 +784,15 @@ static int refer_incoming_attended_request(struct ast_sip_session *session, pjsi
 
                return 200;
        } else {
-               const char *context = (session->channel ? pbx_builtin_getvar_helper(session->channel, "TRANSFER_CONTEXT") : "");
+               const char *context;
                struct refer_blind refer = { 0, };
+               int response;
 
-               if (ast_strlen_zero(context)) {
-                       context = session->endpoint->context;
-               }
+               DETERMINE_TRANSFER_CONTEXT(context, session);
 
                if (!ast_exists_extension(NULL, context, "external_replaces", 1, NULL)) {
-                       ast_log(LOG_ERROR, "Received REFER for remote session on channel '%s' from endpoint '%s' but 'external_replaces' context does not exist for handling\n",
-                               ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint));
+                       ast_log(LOG_ERROR, "Received REFER for remote session on channel '%s' from endpoint '%s' but 'external_replaces' extension not found in context %s\n",
+                               ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint), context);
                        return 404;
                }
 
@@ -638,39 +801,54 @@ static int refer_incoming_attended_request(struct ast_sip_session *session, pjsi
                refer.rdata = rdata;
                refer.replaces = replaces;
                refer.refer_to = target_uri;
+               refer.attended = 1;
 
-               switch (ast_bridge_transfer_blind(1, session->channel, "external_replaces", context, refer_blind_callback, &refer)) {
-               case AST_BRIDGE_TRANSFER_INVALID:
-                       return 400;
-               case AST_BRIDGE_TRANSFER_NOT_PERMITTED:
-                       return 403;
-               case AST_BRIDGE_TRANSFER_FAIL:
+               if (ast_sip_session_defer_termination(session)) {
+                       ast_log(LOG_ERROR, "Received REFER for remote session on channel '%s' from endpoint '%s' but could not defer termination, rejecting\n",
+                               ast_channel_name(session->channel),
+                               ast_sorcery_object_get_id(session->endpoint));
                        return 500;
-               case AST_BRIDGE_TRANSFER_SUCCESS:
-                       ast_sip_session_defer_termination(session);
-                       return 200;
                }
 
-               return 503;
-       }
+               response = xfer_response_code2sip(ast_bridge_transfer_blind(1, session->channel,
+                       "external_replaces", context, refer_blind_callback, &refer));
 
-       return 0;
+               ast_sip_session_end_if_deferred(session);
+               if (response != 200) {
+                       ast_sip_session_defer_termination_cancel(session);
+               }
+
+               return response;
+       }
 }
 
 static int refer_incoming_blind_request(struct ast_sip_session *session, pjsip_rx_data *rdata, pjsip_sip_uri *target,
        struct refer_progress *progress)
 {
-       const char *context = (session->channel ? pbx_builtin_getvar_helper(session->channel, "TRANSFER_CONTEXT") : "");
+       const char *context;
        char exten[AST_MAX_EXTENSION];
        struct refer_blind refer = { 0, };
+       int response;
 
        /* If no explicit transfer context has been provided use their configured context */
-       if (ast_strlen_zero(context)) {
-               context = session->endpoint->context;
-       }
+       DETERMINE_TRANSFER_CONTEXT(context, session);
 
        /* Using the user portion of the target URI see if it exists as a valid extension in their context */
        ast_copy_pj_str(exten, &target->user, sizeof(exten));
+
+       /*
+        * We may want to match in the dialplan without any user
+        * options getting in the way.
+        */
+       AST_SIP_USER_OPTIONS_TRUNCATE_CHECK(exten);
+
+       /* Uri without exten */
+       if (ast_strlen_zero(exten)) {
+               ast_copy_string(exten, "s", sizeof(exten));
+               ast_debug(3, "Channel '%s' from endpoint '%s' attempted blind transfer to a target without extension. Target was set to 's@%s'\n",
+                       ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint), context);
+       }
+
        if (!ast_exists_extension(NULL, context, exten, 1, NULL)) {
                ast_log(LOG_ERROR, "Channel '%s' from endpoint '%s' attempted blind transfer to '%s@%s' but target does not exist\n",
                        ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint), exten, context);
@@ -680,20 +858,25 @@ static int refer_incoming_blind_request(struct ast_sip_session *session, pjsip_r
        refer.context = context;
        refer.progress = progress;
        refer.rdata = rdata;
+       refer.refer_to = target;
+       refer.attended = 0;
 
-       switch (ast_bridge_transfer_blind(1, session->channel, exten, context, refer_blind_callback, &refer)) {
-       case AST_BRIDGE_TRANSFER_INVALID:
-               return 400;
-       case AST_BRIDGE_TRANSFER_NOT_PERMITTED:
-               return 403;
-       case AST_BRIDGE_TRANSFER_FAIL:
+       if (ast_sip_session_defer_termination(session)) {
+               ast_log(LOG_ERROR, "Channel '%s' from endpoint '%s' attempted blind transfer but could not defer termination, rejecting\n",
+                       ast_channel_name(session->channel),
+                       ast_sorcery_object_get_id(session->endpoint));
                return 500;
-       case AST_BRIDGE_TRANSFER_SUCCESS:
-               ast_sip_session_defer_termination(session);
-               return 200;
        }
 
-       return 503;
+       response = xfer_response_code2sip(ast_bridge_transfer_blind(1, session->channel,
+               exten, context, refer_blind_callback, &refer));
+
+       ast_sip_session_end_if_deferred(session);
+       if (response != 200) {
+               ast_sip_session_defer_termination_cancel(session);
+       }
+
+       return response;
 }
 
 /*! \brief Structure used to retrieve channel from another session */
@@ -732,13 +915,13 @@ static int refer_incoming_invite_request(struct ast_sip_session *session, struct
        int response = 0;
        RAII_VAR(struct ast_sip_session *, other_session, NULL, ao2_cleanup);
        struct invite_replaces invite;
-       RAII_VAR(struct ast_bridge *, bridge, NULL, ao2_cleanup);
 
        /* If a Replaces header is present make sure it is valid */
        if (pjsip_replaces_verify_request(rdata, &other_dlg, PJ_TRUE, &packet) != PJ_SUCCESS) {
                response = packet->msg->line.status.code;
+               ast_assert(response != 0);
                pjsip_tx_data_dec_ref(packet);
-               goto end;
+               goto inv_replace_failed;
        }
 
        /* If no other dialog exists then this INVITE request does not have a Replaces header */
@@ -749,18 +932,24 @@ static int refer_incoming_invite_request(struct ast_sip_session *session, struct
        other_session = ast_sip_dialog_get_session(other_dlg);
        pjsip_dlg_dec_lock(other_dlg);
 
+       /* Don't accept an in-dialog INVITE with Replaces as it does not make much sense */
+       if (session->inv_session->dlg->state == PJSIP_DIALOG_STATE_ESTABLISHED) {
+               response = 488;
+               goto inv_replace_failed;
+       }
+
        if (!other_session) {
-               response = 481;
                ast_debug(3, "INVITE with Replaces received on channel '%s' from endpoint '%s', but requested session does not exist\n",
                        ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint));
-               goto end;
+               response = 481;
+               goto inv_replace_failed;
        }
 
        invite.session = other_session;
 
        if (ast_sip_push_task_synchronous(other_session->serializer, invite_replaces, &invite)) {
                response = 481;
-               goto end;
+               goto inv_replace_failed;
        }
 
        ast_channel_lock(session->channel);
@@ -768,42 +957,70 @@ static int refer_incoming_invite_request(struct ast_sip_session *session, struct
        ast_channel_unlock(session->channel);
        ast_raw_answer(session->channel);
 
+       ast_debug(3, "INVITE with Replaces being attempted.  '%s' --> '%s'\n",
+               ast_channel_name(session->channel), ast_channel_name(invite.channel));
+
        if (!invite.bridge) {
                struct ast_channel *chan = session->channel;
 
-               /* This will use a synchronous task but we aren't operating in the serializer at this point in time, so it
-                * won't deadlock */
-               if (!ast_channel_move(invite.channel, session->channel)) {
+               /*
+                * This will use a synchronous task but we aren't operating in
+                * the serializer at this point in time, so it won't deadlock.
+                */
+               if (!ast_channel_move(invite.channel, chan)) {
+                       /*
+                        * We can't directly use session->channel because ast_channel_move()
+                        * does a masquerade which changes session->channel to a different
+                        * channel.  To ensure we work on the right channel we store a
+                        * pointer locally before we begin so it remains valid.
+                        */
                        ast_hangup(chan);
                } else {
-                       response = 500;
+                       response = AST_CAUSE_FAILURE;
                }
        } else {
                if (ast_bridge_impart(invite.bridge, session->channel, invite.channel, NULL,
                        AST_BRIDGE_IMPART_CHAN_INDEPENDENT)) {
-                       response = 500;
+                       response = AST_CAUSE_FAILURE;
                }
        }
 
+       ast_channel_unref(invite.channel);
+       ao2_cleanup(invite.bridge);
+
        if (!response) {
-               ast_debug(3, "INVITE with Replaces successfully completed on channels '%s' and '%s'\n",
-                       ast_channel_name(session->channel), ast_channel_name(invite.channel));
+               /*
+                * On success we cannot use session->channel in the debug message.
+                * This thread either no longer has a ref to session->channel or
+                * session->channel is no longer the original channel.
+                */
+               ast_debug(3, "INVITE with Replaces successfully completed.\n");
+       } else {
+               ast_debug(3, "INVITE with Replaces failed on channel '%s', hanging up with cause '%d'\n",
+                       ast_channel_name(session->channel), response);
+               ast_channel_lock(session->channel);
+               ast_channel_hangupcause_set(session->channel, response);
+               ast_channel_unlock(session->channel);
+               ast_hangup(session->channel);
        }
 
-       ast_channel_unref(invite.channel);
-       ao2_cleanup(invite.bridge);
+       return 1;
 
-end:
-       if (response) {
+inv_replace_failed:
+       if (session->inv_session->dlg->state != PJSIP_DIALOG_STATE_ESTABLISHED) {
                ast_debug(3, "INVITE with Replaces failed on channel '%s', sending response of '%d'\n",
                        ast_channel_name(session->channel), response);
                session->defer_terminate = 1;
                ast_hangup(session->channel);
-               session->channel = NULL;
 
-               if (pjsip_inv_end_session(session->inv_session, response, NULL, &packet) == PJ_SUCCESS) {
+               if (pjsip_inv_end_session(session->inv_session, response, NULL, &packet) == PJ_SUCCESS
+                       && packet) {
                        ast_sip_session_send_response(session, packet);
                }
+       } else {
+               ast_debug(3, "INVITE with Replaces in-dialog on channel '%s', hanging up\n",
+                       ast_channel_name(session->channel));
+               ast_queue_hangup(session->channel);
        }
 
        return 1;
@@ -811,17 +1028,27 @@ end:
 
 static int refer_incoming_refer_request(struct ast_sip_session *session, struct pjsip_rx_data *rdata)
 {
-       const pj_str_t str_refer_to = { "Refer-To", 8 };
        pjsip_generic_string_hdr *refer_to;
        char *uri;
-       const pj_str_t str_to = { "To", 2 };
-       pjsip_fromto_hdr *target;
+       size_t uri_size;
+       pjsip_uri *target;
        pjsip_sip_uri *target_uri;
        RAII_VAR(struct refer_progress *, progress, NULL, ao2_cleanup);
-       const pj_str_t str_replaces = { "Replaces", 8 };
        pjsip_param *replaces;
        int response;
 
+       static const pj_str_t str_refer_to = { "Refer-To", 8 };
+       static const pj_str_t str_refer_to_s = { "r", 1 };
+       static const pj_str_t str_replaces = { "Replaces", 8 };
+
+       if (!session->channel) {
+               /* No channel to refer.  Likely because the call was just hung up. */
+               pjsip_dlg_respond(session->inv_session->dlg, rdata, 404, NULL, NULL, NULL);
+               ast_debug(3, "Received a REFER on a session with no channel from endpoint '%s'.\n",
+                       ast_sorcery_object_get_id(session->endpoint));
+               return 0;
+       }
+
        if (!session->endpoint->allowtransfer) {
                pjsip_dlg_respond(session->inv_session->dlg, rdata, 603, NULL, NULL, NULL);
                ast_log(LOG_WARNING, "Endpoint %s transfer attempt blocked due to configuration\n",
@@ -830,24 +1057,34 @@ static int refer_incoming_refer_request(struct ast_sip_session *session, struct
        }
 
        /* A Refer-To header is required */
-       if (!(refer_to = pjsip_msg_find_hdr_by_name(rdata->msg_info.msg, &str_refer_to, NULL))) {
+       refer_to = pjsip_msg_find_hdr_by_names(rdata->msg_info.msg, &str_refer_to, &str_refer_to_s, NULL);
+       if (!refer_to) {
                pjsip_dlg_respond(session->inv_session->dlg, rdata, 400, NULL, NULL, NULL);
                ast_debug(3, "Received a REFER without Refer-To on channel '%s' from endpoint '%s'\n",
                        ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint));
                return 0;
        }
-       uri = refer_to->hvalue.ptr;
-       uri[refer_to->hvalue.slen] = '\0';
 
-       /* Parse the provided URI string as a To header so we can get the target */
-       if (!(target = pjsip_parse_hdr(rdata->tp_info.pool, &str_to, refer_to->hvalue.ptr, refer_to->hvalue.slen, NULL)) ||
-               (!PJSIP_URI_SCHEME_IS_SIP(target->uri) && !PJSIP_URI_SCHEME_IS_SIPS(target->uri))) {
+       /* The ast_copy_pj_str to uri is needed because it puts the NULL terminator to the uri
+        * as pjsip_parse_uri require a NULL terminated uri
+        */
+
+       uri_size = pj_strlen(&refer_to->hvalue) + 1;
+       uri = ast_alloca(uri_size);
+       ast_copy_pj_str(uri, &refer_to->hvalue, uri_size);
+
+       target = pjsip_parse_uri(rdata->tp_info.pool, uri, uri_size - 1, 0);
+
+       if (!target
+               || (!PJSIP_URI_SCHEME_IS_SIP(target)
+                       && !PJSIP_URI_SCHEME_IS_SIPS(target))) {
+
                pjsip_dlg_respond(session->inv_session->dlg, rdata, 400, NULL, NULL, NULL);
                ast_debug(3, "Received a REFER without a parseable Refer-To ('%s') on channel '%s' from endpoint '%s'\n",
                        uri, ast_channel_name(session->channel), ast_sorcery_object_get_id(session->endpoint));
                return 0;
        }
-       target_uri = pjsip_uri_get_uri(target->uri);
+       target_uri = pjsip_uri_get_uri(target);
 
        /* Set up REFER progress subscription if requested/possible */
        if (refer_progress_alloc(session, rdata, &progress)) {
@@ -908,18 +1145,51 @@ static int refer_incoming_request(struct ast_sip_session *session, pjsip_rx_data
        }
 }
 
-static void refer_outgoing_request(struct ast_sip_session *session, struct pjsip_tx_data *tdata)
+/*!
+ * \brief Use the value of a channel variable as the value of a SIP header
+ *
+ * This looks up a variable name on a channel, then takes that value and adds
+ * it to an outgoing SIP request. If the header already exists on the message,
+ * then no action is taken.
+ *
+ * \pre chan is locked.
+ *
+ * \param chan The channel on which to find the variable.
+ * \param var_name The name of the channel variable to use.
+ * \param header_name The name of the SIP header to add to the outgoing message.
+ * \param tdata The outgoing SIP message on which to add the header
+ */
+static void add_header_from_channel_var(struct ast_channel *chan, const char *var_name, const char *header_name, pjsip_tx_data *tdata)
 {
-       const char *replaces;
+       const char *var_value;
+       pj_str_t pj_header_name;
+       pjsip_hdr *header;
 
-       if (pjsip_method_cmp(&tdata->msg->line.req.method, &pjsip_invite_method) ||
-               !session->channel ||
-               (session->inv_session->state != PJSIP_INV_STATE_CALLING) ||
-               !(replaces = pbx_builtin_getvar_helper(session->channel, "SIPREPLACESHDR"))) {
+       var_value = pbx_builtin_getvar_helper(chan, var_name);
+       if (ast_strlen_zero(var_value)) {
                return;
        }
 
-       ast_sip_add_header(tdata, "Replaces", replaces);
+       pj_cstr(&pj_header_name, header_name);
+       header = pjsip_msg_find_hdr_by_name(tdata->msg, &pj_header_name, NULL);
+       if (header) {
+               return;
+       }
+       ast_sip_add_header(tdata, header_name, var_value);
+}
+
+static void refer_outgoing_request(struct ast_sip_session *session, struct pjsip_tx_data *tdata)
+{
+       if (pjsip_method_cmp(&tdata->msg->line.req.method, &pjsip_invite_method)
+               || !session->channel
+               || session->inv_session->state != PJSIP_INV_STATE_NULL) {
+               return;
+       }
+
+       ast_channel_lock(session->channel);
+       add_header_from_channel_var(session->channel, "SIPREPLACESHDR", "Replaces", tdata);
+       add_header_from_channel_var(session->channel, "SIPREFERREDBYHDR", "Referred-By", tdata);
+       ast_channel_unlock(session->channel);
 }
 
 static struct ast_sip_session_supplement refer_supplement = {
@@ -932,6 +1202,8 @@ static int load_module(void)
 {
        const pj_str_t str_norefersub = { "norefersub", 10 };
 
+       CHECK_PJSIP_SESSION_MODULE_LOADED();
+
        pjsip_replaces_init_module(ast_sip_get_pjsip_endpoint());
        pjsip_xfer_init_module(ast_sip_get_pjsip_endpoint());
        pjsip_endpt_add_capability(ast_sip_get_pjsip_endpoint(), NULL, PJSIP_H_SUPPORTED, NULL, 1, &str_norefersub);
@@ -939,6 +1211,8 @@ static int load_module(void)
        ast_sip_register_service(&refer_progress_module);
        ast_sip_session_register_supplement(&refer_supplement);
 
+       ast_module_shutdown_ref(ast_module_info->self);
+
        return AST_MODULE_LOAD_SUCCESS;
 }
 
@@ -951,7 +1225,8 @@ static int unload_module(void)
 }
 
 AST_MODULE_INFO(ASTERISK_GPL_KEY, AST_MODFLAG_LOAD_ORDER, "PJSIP Blind and Attended Transfer Support",
-               .load = load_module,
-               .unload = unload_module,
-               .load_pri = AST_MODPRI_APP_DEPEND,
-                  );
+       .support_level = AST_MODULE_SUPPORT_CORE,
+       .load = load_module,
+       .unload = unload_module,
+       .load_pri = AST_MODPRI_APP_DEPEND,
+);