[asterisk/asterisk.git] / channels / chan_iax2.c

/*
 * Asterisk -- An open source telephony toolkit.
 *
 * Copyright (C) 1999 - 2006, Digium, Inc.
 *
 * Mark Spencer <markster@digium.com>
 *
 * See http://www.asterisk.org for more information about
 * the Asterisk project. Please do not directly contact
 * any of the maintainers of this project for assistance;
 * the project provides a web site, mailing lists and IRC
 * channels for your use.
 *
 * This program is free software, distributed under the terms of
 * the GNU General Public License Version 2. See the LICENSE file
 * at the top of the source tree.
 */

/*! \file
 *
 * \brief Implementation of Inter-Asterisk eXchange Version 2
 *
 * \author Mark Spencer <markster@digium.com>
 *
 * \par See also
 * \arg \ref Config_iax
 *
 * \ingroup channel_drivers
 */

/*** MODULEINFO
        <use>zaptel</use>
        <use>crypto</use>
 ***/

#include "asterisk.h"

ASTERISK_FILE_VERSION(__FILE__, "$Revision$")

#include <sys/mman.h>
#include <dirent.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <sys/time.h>
#include <sys/signal.h>
#include <signal.h>
#include <strings.h>
#include <netdb.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <regex.h>

#include "asterisk/zapata.h"
#include "asterisk/paths.h"     /* need ast_config_AST_DATA_DIR for firmware */

#include "asterisk/lock.h"
#include "asterisk/frame.h" 
#include "asterisk/channel.h"
#include "asterisk/module.h"
#include "asterisk/pbx.h"
#include "asterisk/sched.h"
#include "asterisk/io.h"
#include "asterisk/config.h"
#include "asterisk/cli.h"
#include "asterisk/translate.h"
#include "asterisk/md5.h"
#include "asterisk/cdr.h"
#include "asterisk/crypto.h"
#include "asterisk/acl.h"
#include "asterisk/manager.h"
#include "asterisk/callerid.h"
#include "asterisk/app.h"
#include "asterisk/astdb.h"
#include "asterisk/musiconhold.h"
#include "asterisk/features.h"
#include "asterisk/utils.h"
#include "asterisk/causes.h"
#include "asterisk/localtime.h"
#include "asterisk/aes.h"
#include "asterisk/dnsmgr.h"
#include "asterisk/devicestate.h"
#include "asterisk/netsock.h"
#include "asterisk/stringfields.h"
#include "asterisk/linkedlists.h"
#include "asterisk/event.h"
#include "asterisk/astobj2.h"

#include "iax2.h"
#include "iax2-parser.h"
#include "iax2-provision.h"
#include "jitterbuf.h"

/* Define SCHED_MULTITHREADED to run the scheduler in a special
   multithreaded mode. */
#define SCHED_MULTITHREADED

/* Define DEBUG_SCHED_MULTITHREADED to keep track of where each
   thread is actually doing. */
#define DEBUG_SCHED_MULTITHREAD


#ifdef SO_NO_CHECK
static int nochecksums = 0;
#endif


#define PTR_TO_CALLNO(a) ((unsigned short)(unsigned long)(a))
#define CALLNO_TO_PTR(a) ((void *)(unsigned long)(a))

#define DEFAULT_THREAD_COUNT 10
#define DEFAULT_MAX_THREAD_COUNT 100
#define DEFAULT_RETRY_TIME 1000
#define MEMORY_SIZE 100
#define DEFAULT_DROP 3
/* Flag to use with trunk calls, keeping these calls high up.  It halves our effective use
   but keeps the division between trunked and non-trunked better. */
#define TRUNK_CALL_START        0x4000

#define DEBUG_SUPPORT

#define MIN_REUSE_TIME          60      /* Don't reuse a call number within 60 seconds */

/* Sample over last 100 units to determine historic jitter */
#define GAMMA (0.01)

static struct ast_codec_pref prefs;

static const char tdesc[] = "Inter Asterisk eXchange Driver (Ver 2)";


/*! \brief Maximum transmission unit for the UDP packet in the trunk not to be
    fragmented. This is based on 1516 - ethernet - ip - udp - iax minus one g711 frame = 1240 */
#define MAX_TRUNK_MTU 1240 

static int global_max_trunk_mtu;        /*!< Maximum MTU, 0 if not used */
static int trunk_timed, trunk_untimed, trunk_maxmtu, trunk_nmaxmtu ;    /*!< Trunk MTU statistics */


static char context[80] = "default";

static char language[MAX_LANGUAGE] = "";
static char regcontext[AST_MAX_CONTEXT] = "";

static int maxauthreq = 3;
static int max_retries = 4;
static int ping_time = 21;
static int lagrq_time = 10;
static int maxtrunkcall = TRUNK_CALL_START;
static int maxnontrunkcall = 1;
static int maxjitterbuffer=1000;
static int resyncthreshold=1000;
static int maxjitterinterps=10;
static int jittertargetextra = 40; /* number of milliseconds the new jitter buffer adds on to its size */

#define MAX_TRUNKDATA           640 * 200       /*!< 40ms, uncompressed linear * 200 channels */

static int trunkfreq = 20;
static int trunkmaxsize = MAX_TRUNKDATA;

static int authdebug = 1;
static int autokill = 0;
static int iaxcompat = 0;

static int iaxdefaultdpcache=10 * 60;   /* Cache dialplan entries for 10 minutes by default */

static int iaxdefaulttimeout = 5;               /* Default to wait no more than 5 seconds for a reply to come back */

static unsigned int tos = 0;

static unsigned int cos = 0;

static int min_reg_expire;
static int max_reg_expire;

static int srvlookup = 0;

static int timingfd = -1;                               /* Timing file descriptor */

static struct ast_netsock_list *netsock;
static struct ast_netsock_list *outsock;                /*!< used if sourceaddress specified and bindaddr == INADDR_ANY */
static int defaultsockfd = -1;

int (*iax2_regfunk)(const char *username, int onoff) = NULL;

/* Ethernet, etc */
#define IAX_CAPABILITY_FULLBANDWIDTH    0xFFFF
/* T1, maybe ISDN */
#define IAX_CAPABILITY_MEDBANDWIDTH     (IAX_CAPABILITY_FULLBANDWIDTH &         \
                                         ~AST_FORMAT_SLINEAR &                  \
                                         ~AST_FORMAT_ULAW &                     \
                                         ~AST_FORMAT_ALAW &                     \
                                         ~AST_FORMAT_G722) 
/* A modem */
#define IAX_CAPABILITY_LOWBANDWIDTH     (IAX_CAPABILITY_MEDBANDWIDTH &          \
                                         ~AST_FORMAT_G726 &                     \
                                         ~AST_FORMAT_G726_AAL2 &                \
                                         ~AST_FORMAT_ADPCM)

#define IAX_CAPABILITY_LOWFREE          (IAX_CAPABILITY_LOWBANDWIDTH &          \
                                         ~AST_FORMAT_G723_1)


#define DEFAULT_MAXMS           2000            /* Must be faster than 2 seconds by default */
#define DEFAULT_FREQ_OK         60 * 1000       /* How often to check for the host to be up */
#define DEFAULT_FREQ_NOTOK      10 * 1000       /* How often to check, if the host is down... */

static  struct io_context *io;
static  struct sched_context *sched;

static int iax2_capability = IAX_CAPABILITY_FULLBANDWIDTH;

static int iaxdebug = 0;

static int iaxtrunkdebug = 0;

static int test_losspct = 0;
#ifdef IAXTESTS
static int test_late = 0;
static int test_resync = 0;
static int test_jit = 0;
static int test_jitpct = 0;
#endif /* IAXTESTS */

static char accountcode[AST_MAX_ACCOUNT_CODE];
static char mohinterpret[MAX_MUSICCLASS];
static char mohsuggest[MAX_MUSICCLASS];
static int amaflags = 0;
static int adsi = 0;
static int delayreject = 0;
static int iax2_encryption = 0;

static struct ast_flags globalflags = { 0 };

static pthread_t netthreadid = AST_PTHREADT_NULL;
static pthread_t schedthreadid = AST_PTHREADT_NULL;
AST_MUTEX_DEFINE_STATIC(sched_lock);
static ast_cond_t sched_cond;

enum iax2_state {
        IAX_STATE_STARTED =             (1 << 0),
        IAX_STATE_AUTHENTICATED =       (1 << 1),
        IAX_STATE_TBD =                 (1 << 2),
        IAX_STATE_UNCHANGED =           (1 << 3),
};

struct iax2_context {
        char context[AST_MAX_CONTEXT];
        struct iax2_context *next;
};

enum iax2_flags {
        IAX_HASCALLERID =       (1 << 0),       /*!< CallerID has been specified */
        IAX_DELME =             (1 << 1),       /*!< Needs to be deleted */
        IAX_TEMPONLY =          (1 << 2),       /*!< Temporary (realtime) */
        IAX_TRUNK =             (1 << 3),       /*!< Treat as a trunk */
        IAX_NOTRANSFER =        (1 << 4),       /*!< Don't native bridge */
        IAX_USEJITTERBUF =      (1 << 5),       /*!< Use jitter buffer */
        IAX_DYNAMIC =           (1 << 6),       /*!< dynamic peer */
        IAX_SENDANI =           (1 << 7),       /*!< Send ANI along with CallerID */
        /* (1 << 8) is currently unused due to the deprecation of an old option. Go ahead, take it! */
        IAX_ALREADYGONE =       (1 << 9),       /*!< Already disconnected */
        IAX_PROVISION =         (1 << 10),      /*!< This is a provisioning request */
        IAX_QUELCH =            (1 << 11),      /*!< Whether or not we quelch audio */
        IAX_ENCRYPTED =         (1 << 12),      /*!< Whether we should assume encrypted tx/rx */
        IAX_KEYPOPULATED =      (1 << 13),      /*!< Whether we have a key populated */
        IAX_CODEC_USER_FIRST =  (1 << 14),      /*!< are we willing to let the other guy choose the codec? */
        IAX_CODEC_NOPREFS =     (1 << 15),      /*!< Force old behaviour by turning off prefs */
        IAX_CODEC_NOCAP =       (1 << 16),      /*!< only consider requested format and ignore capabilities*/
        IAX_RTCACHEFRIENDS =    (1 << 17),      /*!< let realtime stay till your reload */
        IAX_RTUPDATE =          (1 << 18),      /*!< Send a realtime update */
        IAX_RTAUTOCLEAR =       (1 << 19),      /*!< erase me on expire */ 
        IAX_FORCEJITTERBUF =    (1 << 20),      /*!< Force jitterbuffer, even when bridged to a channel that can take jitter */ 
        IAX_RTIGNOREREGEXPIRE = (1 << 21),      /*!< When using realtime, ignore registration expiration */
        IAX_TRUNKTIMESTAMPS =   (1 << 22),      /*!< Send trunk timestamps */
        IAX_TRANSFERMEDIA =     (1 << 23),      /*!< When doing IAX2 transfers, transfer media only */
        IAX_MAXAUTHREQ =        (1 << 24),      /*!< Maximum outstanding AUTHREQ restriction is in place */
        IAX_DELAYPBXSTART =     (1 << 25),      /*!< Don't start a PBX on the channel until the peer sends us a
                                                     response, so that we've achieved a three-way handshake with
                                                     them before sending voice or anything else*/
};

static int global_rtautoclear = 120;

static int reload_config(void);

struct iax2_user {
        AST_DECLARE_STRING_FIELDS(
                AST_STRING_FIELD(name);
                AST_STRING_FIELD(secret);
                AST_STRING_FIELD(dbsecret);
                AST_STRING_FIELD(accountcode);
                AST_STRING_FIELD(mohinterpret);
                AST_STRING_FIELD(mohsuggest);
                AST_STRING_FIELD(inkeys);               /*!< Key(s) this user can use to authenticate to us */
                AST_STRING_FIELD(language);
                AST_STRING_FIELD(cid_num);
                AST_STRING_FIELD(cid_name);
        );
        
        int authmethods;
        int encmethods;
        int amaflags;
        int adsi;
        unsigned int flags;
        int capability;
        int maxauthreq; /*!< Maximum allowed outstanding AUTHREQs */
        int curauthreq; /*!< Current number of outstanding AUTHREQs */
        struct ast_codec_pref prefs;
        struct ast_ha *ha;
        struct iax2_context *contexts;
        struct ast_variable *vars;
};

struct iax2_peer {
        AST_DECLARE_STRING_FIELDS(
                AST_STRING_FIELD(name);
                AST_STRING_FIELD(username);
                AST_STRING_FIELD(secret);
                AST_STRING_FIELD(dbsecret);
                AST_STRING_FIELD(outkey);           /*!< What key we use to talk to this peer */

                AST_STRING_FIELD(regexten);     /*!< Extension to register (if regcontext is used) */
                AST_STRING_FIELD(context);      /*!< For transfers only */
                AST_STRING_FIELD(peercontext);  /*!< Context to pass to peer */
                AST_STRING_FIELD(mailbox);          /*!< Mailbox */
                AST_STRING_FIELD(mohinterpret);
                AST_STRING_FIELD(mohsuggest);
                AST_STRING_FIELD(inkeys);               /*!< Key(s) this peer can use to authenticate to us */
                /* Suggested caller id if registering */
                AST_STRING_FIELD(cid_num);              /*!< Default context (for transfer really) */
                AST_STRING_FIELD(cid_name);             /*!< Default context (for transfer really) */
                AST_STRING_FIELD(zonetag);              /*!< Time Zone */
        );
        struct ast_codec_pref prefs;
        struct ast_dnsmgr_entry *dnsmgr;                /*!< DNS refresh manager */
        struct sockaddr_in addr;
        int formats;
        int sockfd;                                     /*!< Socket to use for transmission */
        struct in_addr mask;
        int adsi;
        unsigned int flags;

        /* Dynamic Registration fields */
        struct sockaddr_in defaddr;                     /*!< Default address if there is one */
        int authmethods;                                /*!< Authentication methods (IAX_AUTH_*) */
        int encmethods;                                 /*!< Encryption methods (IAX_ENCRYPT_*) */

        int expire;                                     /*!< Schedule entry for expiry */
        int expiry;                                     /*!< How soon to expire */
        int capability;                                 /*!< Capability */

        /* Qualification */
        int callno;                                     /*!< Call number of POKE request */
        int pokeexpire;                                 /*!< Scheduled qualification-related task (ie iax2_poke_peer_s or iax2_poke_noanswer) */
        int lastms;                                     /*!< How long last response took (in ms), or -1 for no response */
        int maxms;                                      /*!< Max ms we will accept for the host to be up, 0 to not monitor */

        int pokefreqok;                                 /*!< How often to check if the host is up */
        int pokefreqnotok;                              /*!< How often to check when the host has been determined to be down */
        int historicms;                                 /*!< How long recent average responses took */
        int smoothing;                                  /*!< Sample over how many units to determine historic ms */

        struct ast_event_sub *mwi_event_sub;

        struct ast_ha *ha;
};

#define IAX2_TRUNK_PREFACE (sizeof(struct iax_frame) + sizeof(struct ast_iax2_meta_hdr) + sizeof(struct ast_iax2_meta_trunk_hdr))

struct iax2_trunk_peer {
        ast_mutex_t lock;
        int sockfd;
        struct sockaddr_in addr;
        struct timeval txtrunktime;             /*!< Transmit trunktime */
        struct timeval rxtrunktime;             /*!< Receive trunktime */
        struct timeval lasttxtime;              /*!< Last transmitted trunktime */
        struct timeval trunkact;                /*!< Last trunk activity */
        unsigned int lastsent;                  /*!< Last sent time */
        /* Trunk data and length */
        unsigned char *trunkdata;
        unsigned int trunkdatalen;
        unsigned int trunkdataalloc;
        int trunkmaxmtu;
        int trunkerror;
        int calls;
        AST_LIST_ENTRY(iax2_trunk_peer) list;
};

static AST_LIST_HEAD_STATIC(tpeers, iax2_trunk_peer);

struct iax_firmware {
        AST_LIST_ENTRY(iax_firmware) list;
        int fd;
        int mmaplen;
        int dead;
        struct ast_iax2_firmware_header *fwh;
        unsigned char *buf;
};

enum iax_reg_state {
        REG_STATE_UNREGISTERED = 0,
        REG_STATE_REGSENT,
        REG_STATE_AUTHSENT,
        REG_STATE_REGISTERED,
        REG_STATE_REJECTED,
        REG_STATE_TIMEOUT,
        REG_STATE_NOAUTH
};

enum iax_transfer_state {
        TRANSFER_NONE = 0,
        TRANSFER_BEGIN,
        TRANSFER_READY,
        TRANSFER_RELEASED,
        TRANSFER_PASSTHROUGH,
        TRANSFER_MBEGIN,
        TRANSFER_MREADY,
        TRANSFER_MRELEASED,
        TRANSFER_MPASSTHROUGH,
        TRANSFER_MEDIA,
        TRANSFER_MEDIAPASS
};

struct iax2_registry {
        struct sockaddr_in addr;                /*!< Who we connect to for registration purposes */
        char username[80];
        char secret[80];                        /*!< Password or key name in []'s */
        int expire;                             /*!< Sched ID of expiration */
        int refresh;                            /*!< How often to refresh */
        enum iax_reg_state regstate;
        int messages;                           /*!< Message count, low 8 bits = new, high 8 bits = old */
        int callno;                             /*!< Associated call number if applicable */
        struct sockaddr_in us;                  /*!< Who the server thinks we are */
        struct ast_dnsmgr_entry *dnsmgr;        /*!< DNS refresh manager */
        AST_LIST_ENTRY(iax2_registry) entry;
};

static AST_LIST_HEAD_STATIC(registrations, iax2_registry);

/* Don't retry more frequently than every 10 ms, or less frequently than every 5 seconds */
#define MIN_RETRY_TIME          100
#define MAX_RETRY_TIME          10000

#define MAX_JITTER_BUFFER       50
#define MIN_JITTER_BUFFER       10

#define DEFAULT_TRUNKDATA       640 * 10        /*!< 40ms, uncompressed linear * 10 channels */

#define MAX_TIMESTAMP_SKEW      160             /*!< maximum difference between actual and predicted ts for sending */

/* If consecutive voice frame timestamps jump by more than this many milliseconds, then jitter buffer will resync */
#define TS_GAP_FOR_JB_RESYNC    5000

static int iaxthreadcount = DEFAULT_THREAD_COUNT;
static int iaxmaxthreadcount = DEFAULT_MAX_THREAD_COUNT;
static int iaxdynamicthreadcount = 0;
static int iaxactivethreadcount = 0;

struct iax_rr {
        int jitter;
        int losspct;
        int losscnt;
        int packets;
        int delay;
        int dropped;
        int ooo;
};

struct iax2_pvt_ref;

struct chan_iax2_pvt {
        /*! Socket to send/receive on for this call */
        int sockfd;
        /*! Last received voice format */
        int voiceformat;
        /*! Last received video format */
        int videoformat;
        /*! Last sent voice format */
        int svoiceformat;
        /*! Last sent video format */
        int svideoformat;
        /*! What we are capable of sending */
        int capability;
        /*! Last received timestamp */
        unsigned int last;
        /*! Last sent timestamp - never send the same timestamp twice in a single call */
        unsigned int lastsent;
        /*! Next outgoing timestamp if everything is good */
        unsigned int nextpred;
        /*! True if the last voice we transmitted was not silence/CNG */
        unsigned int notsilenttx:1;
        /*! Ping time */
        unsigned int pingtime;
        /*! Max time for initial response */
        int maxtime;
        /*! Peer Address */
        struct sockaddr_in addr;
        /*! Actual used codec preferences */
        struct ast_codec_pref prefs;
        /*! Requested codec preferences */
        struct ast_codec_pref rprefs;
        /*! Our call number */
        unsigned short callno;
        /*! Peer callno */
        unsigned short peercallno;
        /*! Negotiated format, this is only used to remember what format was
            chosen for an unauthenticated call so that the channel can get
            created later using the right format */
        int chosenformat;
        /*! Peer selected format */
        int peerformat;
        /*! Peer capability */
        int peercapability;
        /*! timeval that we base our transmission on */
        struct timeval offset;
        /*! timeval that we base our delivery on */
        struct timeval rxcore;
        /*! The jitterbuffer */
        jitterbuf *jb;
        /*! active jb read scheduler id */
        int jbid;                       
        /*! LAG */
        int lag;
        /*! Error, as discovered by the manager */
        int error;
        /*! Owner if we have one */
        struct ast_channel *owner;
        /*! What's our state? */
        struct ast_flags state;
        /*! Expiry (optional) */
        int expiry;
        /*! Next outgoing sequence number */
        unsigned char oseqno;
        /*! Next sequence number they have not yet acknowledged */
        unsigned char rseqno;
        /*! Next incoming sequence number */
        unsigned char iseqno;
        /*! Last incoming sequence number we have acknowledged */
        unsigned char aseqno;

        AST_DECLARE_STRING_FIELDS(
                /*! Peer name */
                AST_STRING_FIELD(peer);
                /*! Default Context */
                AST_STRING_FIELD(context);
                /*! Caller ID if available */
                AST_STRING_FIELD(cid_num);
                AST_STRING_FIELD(cid_name);
                /*! Hidden Caller ID (i.e. ANI) if appropriate */
                AST_STRING_FIELD(ani);
                /*! DNID */
                AST_STRING_FIELD(dnid);
                /*! RDNIS */
                AST_STRING_FIELD(rdnis);
                /*! Requested Extension */
                AST_STRING_FIELD(exten);
                /*! Expected Username */
                AST_STRING_FIELD(username);
                /*! Expected Secret */
                AST_STRING_FIELD(secret);
                /*! MD5 challenge */
                AST_STRING_FIELD(challenge);
                /*! Public keys permitted keys for incoming authentication */
                AST_STRING_FIELD(inkeys);
                /*! Private key for outgoing authentication */
                AST_STRING_FIELD(outkey);
                /*! Preferred language */
                AST_STRING_FIELD(language);
                /*! Hostname/peername for naming purposes */
                AST_STRING_FIELD(host);

                AST_STRING_FIELD(dproot);
                AST_STRING_FIELD(accountcode);
                AST_STRING_FIELD(mohinterpret);
                AST_STRING_FIELD(mohsuggest);
                /*! received OSP token */
                AST_STRING_FIELD(osptoken);
        );
        
        /*! permitted authentication methods */
        int authmethods;
        /*! permitted encryption methods */
        int encmethods;
        /*! Encryption AES-128 Key */
        ast_aes_encrypt_key ecx;
        /*! Decryption AES-128 Key */
        ast_aes_decrypt_key dcx;
        /*! 32 bytes of semi-random data */
        unsigned char semirand[32];
        /*! Associated registry */
        struct iax2_registry *reg;
        /*! Associated peer for poking */
        struct iax2_peer *peerpoke;
        /*! IAX_ flags */
        unsigned int flags;
        int adsi;

        /*! Transferring status */
        enum iax_transfer_state transferring;
        /*! Transfer identifier */
        int transferid;
        /*! Who we are IAX transferring to */
        struct sockaddr_in transfer;
        /*! What's the new call number for the transfer */
        unsigned short transfercallno;
        /*! Transfer encrypt AES-128 Key */
        ast_aes_encrypt_key tdcx;

        /*! Status of knowledge of peer ADSI capability */
        int peeradsicpe;

        /*! Who we are bridged to */
        unsigned short bridgecallno;
        
        int pingid;                     /*!< Transmit PING request */
        int lagid;                      /*!< Retransmit lag request */
        int autoid;                     /*!< Auto hangup for Dialplan requestor */
        int authid;                     /*!< Authentication rejection ID */
        int authfail;                   /*!< Reason to report failure */
        int initid;                     /*!< Initial peer auto-congest ID (based on qualified peers) */
        int calling_ton;
        int calling_tns;
        int calling_pres;
        int amaflags;
        AST_LIST_HEAD_NOLOCK(, iax2_dpcache) dpentries;
        struct ast_variable *vars;
        /*! last received remote rr */
        struct iax_rr remote_rr;
        /*! Current base time: (just for stats) */
        int min;
        /*! Dropped frame count: (just for stats) */
        int frames_dropped;
        /*! received frame count: (just for stats) */
        int frames_received;
};

/*!
 * \brief a list of frames that may need to be retransmitted
 *
 * \note The contents of this list do not need to be explicitly destroyed
 * on module unload.  This is because all active calls are destroyed, and
 * all frames in this queue will get destroyed as a part of that process.
 */
static AST_LIST_HEAD_STATIC(frame_queue, iax_frame);

/*!
 * This module will get much higher performance when doing a lot of
 * user and peer lookups if the number of buckets is increased from 1.
 * However, to maintain old behavior for Asterisk 1.4, these are set to
 * 1 by default.  When using multiple buckets, search order through these
 * containers is considered random, so you will not be able to depend on
 * the order the entires are specified in iax.conf for matching order. */
#ifdef LOW_MEMORY
#define MAX_PEER_BUCKETS 17
#else
#define MAX_PEER_BUCKETS 563
#endif
static struct ao2_container *peers;

#define MAX_USER_BUCKETS MAX_PEER_BUCKETS
static struct ao2_container *users;

static AST_LIST_HEAD_STATIC(firmwares, iax_firmware);

enum {
        /*! Extension exists */
        CACHE_FLAG_EXISTS      = (1 << 0),
        /*! Extension is nonexistent */
        CACHE_FLAG_NONEXISTENT = (1 << 1),
        /*! Extension can exist */
        CACHE_FLAG_CANEXIST    = (1 << 2),
        /*! Waiting to hear back response */
        CACHE_FLAG_PENDING     = (1 << 3),
        /*! Timed out */
        CACHE_FLAG_TIMEOUT     = (1 << 4),
        /*! Request transmitted */
        CACHE_FLAG_TRANSMITTED = (1 << 5),
        /*! Timeout */
        CACHE_FLAG_UNKNOWN     = (1 << 6),
        /*! Matchmore */
        CACHE_FLAG_MATCHMORE   = (1 << 7),
};

struct iax2_dpcache {
        char peercontext[AST_MAX_CONTEXT];
        char exten[AST_MAX_EXTENSION];
        struct timeval orig;
        struct timeval expiry;
        int flags;
        unsigned short callno;
        int waiters[256];
        AST_LIST_ENTRY(iax2_dpcache) cache_list;
        AST_LIST_ENTRY(iax2_dpcache) peer_list;
};

static AST_LIST_HEAD_STATIC(dpcache, iax2_dpcache);

static void reg_source_db(struct iax2_peer *p);
static struct iax2_peer *realtime_peer(const char *peername, struct sockaddr_in *sin);

static int ast_cli_netstats(struct mansession *s, int fd, int limit_fmt);
static char *complete_iax2_show_peer(const char *line, const char *word, int pos, int state);
static char *complete_iax2_unregister(const char *line, const char *word, int pos, int state);

enum iax2_thread_iostate {
        IAX_IOSTATE_IDLE,
        IAX_IOSTATE_READY,
        IAX_IOSTATE_PROCESSING,
        IAX_IOSTATE_SCHEDREADY,
};

enum iax2_thread_type {
        IAX_THREAD_TYPE_POOL,
        IAX_THREAD_TYPE_DYNAMIC,
};

struct iax2_pkt_buf {
        AST_LIST_ENTRY(iax2_pkt_buf) entry;
        size_t len;
        unsigned char buf[1];
};

struct iax2_thread {
        AST_LIST_ENTRY(iax2_thread) list;
        enum iax2_thread_type type;
        enum iax2_thread_iostate iostate;
#ifdef SCHED_MULTITHREADED
        void (*schedfunc)(const void *);
        const void *scheddata;
#endif
#ifdef DEBUG_SCHED_MULTITHREAD
        char curfunc[80];
#endif  
        int actions;
        pthread_t threadid;
        int threadnum;
        struct sockaddr_in iosin;
        unsigned char readbuf[4096]; 
        unsigned char *buf;
        ssize_t buf_len;
        size_t buf_size;
        int iofd;
        time_t checktime;
        ast_mutex_t lock;
        ast_cond_t cond;
        unsigned int ready_for_signal:1;
        /*! if this thread is processing a full frame,
          some information about that frame will be stored
          here, so we can avoid dispatching any more full
          frames for that callno to other threads */
        struct {
                unsigned short callno;
                struct sockaddr_in sin;
                unsigned char type;
                unsigned char csub;
        } ffinfo;
        /*! Queued up full frames for processing.  If more full frames arrive for
         *  a call which this thread is already processing a full frame for, they
         *  are queued up here. */
        AST_LIST_HEAD_NOLOCK(, iax2_pkt_buf) full_frames;
};

/* Thread lists */
static AST_LIST_HEAD_STATIC(idle_list, iax2_thread);
static AST_LIST_HEAD_STATIC(active_list, iax2_thread);
static AST_LIST_HEAD_STATIC(dynamic_list, iax2_thread);

static void *iax2_process_thread(void *data);

static void signal_condition(ast_mutex_t *lock, ast_cond_t *cond)
{
        ast_mutex_lock(lock);
        ast_cond_signal(cond);
        ast_mutex_unlock(lock);
}

static void iax_debug_output(const char *data)
{
        if (iaxdebug)
                ast_verbose("%s", data);
}

static void iax_error_output(const char *data)
{
        ast_log(LOG_WARNING, "%s", data);
}

static void jb_error_output(const char *fmt, ...)
{
        va_list args;
        char buf[1024];

        va_start(args, fmt);
        vsnprintf(buf, sizeof(buf), fmt, args);
        va_end(args);

        ast_log(LOG_ERROR, buf);
}

static void jb_warning_output(const char *fmt, ...)
{
        va_list args;
        char buf[1024];

        va_start(args, fmt);
        vsnprintf(buf, sizeof(buf), fmt, args);
        va_end(args);

        ast_log(LOG_WARNING, buf);
}

static void jb_debug_output(const char *fmt, ...)
{
        va_list args;
        char buf[1024];

        va_start(args, fmt);
        vsnprintf(buf, sizeof(buf), fmt, args);
        va_end(args);

        ast_verbose(buf);
}

/*!
 * \brief an array of iax2 pvt structures
 *
 * The container for active chan_iax2_pvt structures is implemented as an
 * array for extremely quick direct access to the correct pvt structure
 * based on the local call number.  The local call number is used as the
 * index into the array where the associated pvt structure is stored.
 */
static struct chan_iax2_pvt *iaxs[IAX_MAX_CALLS];
/*!
 * \brief chan_iax2_pvt structure locks
 *
 * These locks are used when accessing a pvt structure in the iaxs array.
 * The index used here is the same as used in the iaxs array.  It is the
 * local call number for the associated pvt struct.
 */
static ast_mutex_t iaxsl[IAX_MAX_CALLS];
/*!
 * \brief The last time a call number was used
 *
 * It is important to know the last time that a call number was used locally so
 * that it is not used again too soon.  The reason for this is the same as the
 * reason that the TCP protocol state machine requires a "TIME WAIT" state.
 *
 * For example, say that a call is up.  Then, the remote side sends a HANGUP,
 * which we respond to with an ACK.  However, there is no way to know whether
 * the ACK made it there successfully.  If it were to get lost, the remote
 * side may retransmit the HANGUP.  If in the meantime, this call number has
 * been reused locally, given the right set of circumstances, this retransmitted
 * HANGUP could potentially improperly hang up the new session.  So, to avoid
 * this potential issue, we must wait a specified timeout period before reusing
 * a local call number.
 *
 * The specified time that we must wait before reusing a local call number is
 * defined as MIN_REUSE_TIME, with a default of 60 seconds.
 */
static struct timeval lastused[IAX_MAX_CALLS];

static enum ast_bridge_result iax2_bridge(struct ast_channel *c0, struct ast_channel *c1, int flags, struct ast_frame **fo, struct ast_channel **rc, int timeoutms);
static int expire_registry(const void *data);
static int iax2_answer(struct ast_channel *c);
static int iax2_call(struct ast_channel *c, char *dest, int timeout);
static int iax2_devicestate(void *data);
static int iax2_digit_begin(struct ast_channel *c, char digit);
static int iax2_digit_end(struct ast_channel *c, char digit, unsigned int duration);
static int iax2_do_register(struct iax2_registry *reg);
static int iax2_fixup(struct ast_channel *oldchannel, struct ast_channel *newchan);
static int iax2_hangup(struct ast_channel *c);
static int iax2_indicate(struct ast_channel *c, int condition, const void *data, size_t datalen);
static int iax2_poke_peer(struct iax2_peer *peer, int heldcall);
static int iax2_provision(struct sockaddr_in *end, int sockfd, char *dest, const char *template, int force);
static int iax2_send(struct chan_iax2_pvt *pvt, struct ast_frame *f, unsigned int ts, int seqno, int now, int transfer, int final);
static int iax2_sendhtml(struct ast_channel *c, int subclass, const char *data, int datalen);
static int iax2_sendimage(struct ast_channel *c, struct ast_frame *img);
static int iax2_sendtext(struct ast_channel *c, const char *text);
static int iax2_setoption(struct ast_channel *c, int option, void *data, int datalen);
static int iax2_transfer(struct ast_channel *c, const char *dest);
static int iax2_write(struct ast_channel *c, struct ast_frame *f);
static int send_trunk(struct iax2_trunk_peer *tpeer, struct timeval *now);
static int send_command(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_final(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_immediate(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_locked(unsigned short callno, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_transfer(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int);
static struct ast_channel *iax2_request(const char *type, int format, void *data, int *cause);
static struct ast_frame *iax2_read(struct ast_channel *c);
static struct iax2_peer *build_peer(const char *name, struct ast_variable *v, struct ast_variable *alt, int temponly);
static struct iax2_user *build_user(const char *name, struct ast_variable *v, struct ast_variable *alt, int temponly);
static void realtime_update_peer(const char *peername, struct sockaddr_in *sin, time_t regtime);
static void prune_peers(void);
static void *iax2_dup_variable_datastore(void *);
static void iax2_free_variable_datastore(void *);

static int acf_channel_read(struct ast_channel *chan, const char *funcname, char *preparse, char *buf, size_t buflen);
static int acf_channel_write(struct ast_channel *chan, const char *function, char *data, const char *value);

static const struct ast_channel_tech iax2_tech = {
        .type = "IAX2",
        .description = tdesc,
        .capabilities = IAX_CAPABILITY_FULLBANDWIDTH,
        .properties = AST_CHAN_TP_WANTSJITTER,
        .requester = iax2_request,
        .devicestate = iax2_devicestate,
        .send_digit_begin = iax2_digit_begin,
        .send_digit_end = iax2_digit_end,
        .send_text = iax2_sendtext,
        .send_image = iax2_sendimage,
        .send_html = iax2_sendhtml,
        .call = iax2_call,
        .hangup = iax2_hangup,
        .answer = iax2_answer,
        .read = iax2_read,
        .write = iax2_write,
        .write_video = iax2_write,
        .indicate = iax2_indicate,
        .setoption = iax2_setoption,
        .bridge = iax2_bridge,
        .transfer = iax2_transfer,
        .fixup = iax2_fixup,
        .func_channel_read = acf_channel_read,
        .func_channel_write = acf_channel_write,
};

static void mwi_event_cb(const struct ast_event *event, void *userdata)
{
        /* The MWI subscriptions exist just so the core knows we care about those
         * mailboxes.  However, we just grab the events out of the cache when it
         * is time to send MWI, since it is only sent with a REGACK. */
}

/*! \brief Send manager event at call setup to link between Asterisk channel name
        and IAX2 call identifiers */
static void iax2_ami_channelupdate(struct chan_iax2_pvt *pvt) 
{
        manager_event(EVENT_FLAG_SYSTEM, "ChannelUpdate",
                "Channel: %s\r\nChanneltype: IAX2\r\nIAX2-callno-local: %d\r\nIAX2-callno-remote: %d\r\nIAX2-peer: %s\r\n",
                pvt->owner ? pvt->owner->name : "",
                pvt->callno, pvt->peercallno, pvt->peer ? pvt->peer : "");
}


static struct ast_datastore_info iax2_variable_datastore_info = {
        .type = "IAX2_VARIABLE",
        .duplicate = iax2_dup_variable_datastore,
        .destroy = iax2_free_variable_datastore,
};

static void *iax2_dup_variable_datastore(void *old)
{
        AST_LIST_HEAD(, ast_var_t) *oldlist = old, *newlist;
        struct ast_var_t *oldvar, *newvar;

        newlist = ast_calloc(sizeof(*newlist), 1);
        if (!newlist) {
                ast_log(LOG_ERROR, "Unable to duplicate iax2 variables\n");
                return NULL;
        }

        AST_LIST_HEAD_INIT(newlist);
        AST_LIST_LOCK(oldlist);
        AST_LIST_TRAVERSE(oldlist, oldvar, entries) {
                newvar = ast_var_assign(ast_var_name(oldvar), ast_var_value(oldvar));
                if (newvar)
                        AST_LIST_INSERT_TAIL(newlist, newvar, entries);
                else
                        ast_log(LOG_ERROR, "Unable to duplicate iax2 variable '%s'\n", ast_var_name(oldvar));
        }
        AST_LIST_UNLOCK(oldlist);
        return newlist;
}

static void iax2_free_variable_datastore(void *old)
{
        AST_LIST_HEAD(, ast_var_t) *oldlist = old;
        struct ast_var_t *oldvar;

        AST_LIST_LOCK(oldlist);
        while ((oldvar = AST_LIST_REMOVE_HEAD(oldlist, entries))) {
                ast_free(oldvar);
        }
        AST_LIST_UNLOCK(oldlist);
        AST_LIST_HEAD_DESTROY(oldlist);
        ast_free(oldlist);
}


/* WARNING: insert_idle_thread should only ever be called within the
 * context of an iax2_process_thread() thread.
 */
static void insert_idle_thread(struct iax2_thread *thread)
{
        if (thread->type == IAX_THREAD_TYPE_DYNAMIC) {
                AST_LIST_LOCK(&dynamic_list);
                AST_LIST_INSERT_TAIL(&dynamic_list, thread, list);
                AST_LIST_UNLOCK(&dynamic_list);
        } else {
                AST_LIST_LOCK(&idle_list);
                AST_LIST_INSERT_TAIL(&idle_list, thread, list);
                AST_LIST_UNLOCK(&idle_list);
        }

        return;
}

static struct iax2_thread *find_idle_thread(void)
{
        struct iax2_thread *thread = NULL;

        /* Pop the head of the idle list off */
        AST_LIST_LOCK(&idle_list);
        thread = AST_LIST_REMOVE_HEAD(&idle_list, list);
        AST_LIST_UNLOCK(&idle_list);

        /* If we popped a thread off the idle list, just return it */
        if (thread) {
                memset(&thread->ffinfo, 0, sizeof(thread->ffinfo));
                return thread;
        }

        /* Pop the head of the dynamic list off */
        AST_LIST_LOCK(&dynamic_list);
        thread = AST_LIST_REMOVE_HEAD(&dynamic_list, list);
        AST_LIST_UNLOCK(&dynamic_list);

        /* If we popped a thread off the dynamic list, just return it */
        if (thread) {
                memset(&thread->ffinfo, 0, sizeof(thread->ffinfo));
                return thread;
        }

        /* If we can't create a new dynamic thread for any reason, return no thread at all */
        if (iaxdynamicthreadcount >= iaxmaxthreadcount || !(thread = ast_calloc(1, sizeof(*thread))))
                return NULL;

        /* Set default values */
        thread->threadnum = ast_atomic_fetchadd_int(&iaxdynamicthreadcount, 1);
        thread->type = IAX_THREAD_TYPE_DYNAMIC;

        /* Initialize lock and condition */
        ast_mutex_init(&thread->lock);
        ast_cond_init(&thread->cond, NULL);

        /* Create thread and send it on it's way */
        if (ast_pthread_create_detached_background(&thread->threadid, NULL, iax2_process_thread, thread)) {
                ast_cond_destroy(&thread->cond);
                ast_mutex_destroy(&thread->lock);
                ast_free(thread);
                return NULL;
        }

        /* this thread is not processing a full frame (since it is idle),
           so ensure that the field for the full frame call number is empty */
        memset(&thread->ffinfo, 0, sizeof(thread->ffinfo));

        /* Wait for the thread to be ready before returning it to the caller */
        while (!thread->ready_for_signal)
                usleep(1);

        return thread;
}

#ifdef SCHED_MULTITHREADED
static int __schedule_action(void (*func)(const void *data), const void *data, const char *funcname)
{
        struct iax2_thread *thread = NULL;
        static time_t lasterror;
        static time_t t;

        thread = find_idle_thread();

        if (thread != NULL) {
                thread->schedfunc = func;
                thread->scheddata = data;
                thread->iostate = IAX_IOSTATE_SCHEDREADY;
#ifdef DEBUG_SCHED_MULTITHREAD
                ast_copy_string(thread->curfunc, funcname, sizeof(thread->curfunc));
#endif
                signal_condition(&thread->lock, &thread->cond);
                return 0;
        }
        time(&t);
        if (t != lasterror) 
                ast_log(LOG_NOTICE, "Out of idle IAX2 threads for scheduling!\n");
        lasterror = t;

        return -1;
}
#define schedule_action(func, data) __schedule_action(func, data, __PRETTY_FUNCTION__)
#endif

static int iax2_sched_replace(int old_id, struct sched_context *con, int when, ast_sched_cb callback, const void *data)
{
        int res;

        res = ast_sched_replace(old_id, con, when, callback, data);
        signal_condition(&sched_lock, &sched_cond);

        return res;
}

static int iax2_sched_add(struct sched_context *con, int when, ast_sched_cb callback, const void *data)
{
        int res;

        res = ast_sched_add(con, when, callback, data);
        signal_condition(&sched_lock, &sched_cond);

        return res;
}

static int send_ping(const void *data);

static void __send_ping(const void *data)
{
        int callno = (long)data;
        ast_mutex_lock(&iaxsl[callno]);
        if (iaxs[callno] && iaxs[callno]->pingid != -1) {
                send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_PING, 0, NULL, 0, -1);
                iaxs[callno]->pingid = iax2_sched_add(sched, ping_time * 1000, send_ping, data);
        }
        ast_mutex_unlock(&iaxsl[callno]);
}

static int send_ping(const void *data)
{
#ifdef SCHED_MULTITHREADED
        if (schedule_action(__send_ping, data))
#endif          
                __send_ping(data);
        return 0;
}

static int get_encrypt_methods(const char *s)
{
        int e;
        if (!strcasecmp(s, "aes128"))
                e = IAX_ENCRYPT_AES128;
        else if (ast_true(s))
                e = IAX_ENCRYPT_AES128;
        else
                e = 0;
        return e;
}

static int send_lagrq(const void *data);

static void __send_lagrq(const void *data)
{
        int callno = (long)data;
        /* Ping only if it's real not if it's bridged */
        ast_mutex_lock(&iaxsl[callno]);
        if (iaxs[callno] && iaxs[callno]->lagid != -1) {
                send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_LAGRQ, 0, NULL, 0, -1);
                iaxs[callno]->lagid = iax2_sched_add(sched, lagrq_time * 1000, send_lagrq, data);
        }
        ast_mutex_unlock(&iaxsl[callno]);
}

static int send_lagrq(const void *data)
{
#ifdef SCHED_MULTITHREADED
        if (schedule_action(__send_lagrq, data))
#endif          
                __send_lagrq(data);
        return 0;
}

static unsigned char compress_subclass(int subclass)
{
        int x;
        int power=-1;
        /* If it's 128 or smaller, just return it */
        if (subclass < IAX_FLAG_SC_LOG)
                return subclass;
        /* Otherwise find its power */
        for (x = 0; x < IAX_MAX_SHIFT; x++) {
                if (subclass & (1 << x)) {
                        if (power > -1) {
                                ast_log(LOG_WARNING, "Can't compress subclass %d\n", subclass);
                                return 0;
                        } else
                                power = x;
                }
        }
        return power | IAX_FLAG_SC_LOG;
}

static int uncompress_subclass(unsigned char csub)
{
        /* If the SC_LOG flag is set, return 2^csub otherwise csub */
        if (csub & IAX_FLAG_SC_LOG) {
                /* special case for 'compressed' -1 */
                if (csub == 0xff)
                        return -1;
                else
                        return 1 << (csub & ~IAX_FLAG_SC_LOG & IAX_MAX_SHIFT);
        }
        else
                return csub;
}

/*!
 * \note The only member of the peer passed here guaranteed to be set is the name field
 */
static int peer_hash_cb(const void *obj, const int flags)
{
        const struct iax2_peer *peer = obj;

        return ast_str_hash(peer->name);
}

/*!
 * \note The only member of the peer passed here guaranteed to be set is the name field
 */
static int peer_cmp_cb(void *obj, void *arg, int flags)
{
        struct iax2_peer *peer = obj, *peer2 = arg;

        return !strcasecmp(peer->name, peer2->name) ? CMP_MATCH : 0;
}

/*!
 * \note The only member of the user passed here guaranteed to be set is the name field
 */
static int user_hash_cb(const void *obj, const int flags)
{
        const struct iax2_user *user = obj;

        return ast_str_hash(user->name);
}

/*!
 * \note The only member of the user passed here guaranteed to be set is the name field
 */
static int user_cmp_cb(void *obj, void *arg, int flags)
{
        struct iax2_user *user = obj, *user2 = arg;

        return !strcasecmp(user->name, user2->name) ? CMP_MATCH : 0;
}

/*!
 * \note This funtion calls realtime_peer -> reg_source_db -> iax2_poke_peer -> find_callno,
 *       so do not call it with a pvt lock held.
 */
static struct iax2_peer *find_peer(const char *name, int realtime) 
{
        struct iax2_peer *peer = NULL;
        struct iax2_peer tmp_peer = {
                .name = name,
        };

        peer = ao2_find(peers, &tmp_peer, OBJ_POINTER);

        /* Now go for realtime if applicable */
        if(!peer && realtime)
                peer = realtime_peer(name, NULL);

        return peer;
}

static struct iax2_peer *peer_ref(struct iax2_peer *peer)
{
        ao2_ref(peer, +1);
        return peer;
}

static inline struct iax2_peer *peer_unref(struct iax2_peer *peer)
{
        ao2_ref(peer, -1);
        return NULL;
}

static inline struct iax2_user *user_ref(struct iax2_user *user)
{
        ao2_ref(user, +1);
        return user;
}

static inline struct iax2_user *user_unref(struct iax2_user *user)
{
        ao2_ref(user, -1);
        return NULL;
}

static int iax2_getpeername(struct sockaddr_in sin, char *host, int len)
{
        struct iax2_peer *peer = NULL;
        int res = 0;
        struct ao2_iterator i;

        i = ao2_iterator_init(peers, 0);
        while ((peer = ao2_iterator_next(&i))) {
                if ((peer->addr.sin_addr.s_addr == sin.sin_addr.s_addr) &&
                    (peer->addr.sin_port == sin.sin_port)) {
                        ast_copy_string(host, peer->name, len);
                        peer_unref(peer);
                        res = 1;
                        break;
                }
                peer_unref(peer);
        }

        if (!peer) {
                peer = realtime_peer(NULL, &sin);
                if (peer) {
                        ast_copy_string(host, peer->name, len);
                        peer_unref(peer);
                        res = 1;
                }
        }

        return res;
}

static struct chan_iax2_pvt *new_iax(struct sockaddr_in *sin, const char *host)
{
        struct chan_iax2_pvt *tmp;
        jb_conf jbconf;

        if (!(tmp = ast_calloc(1, sizeof(*tmp))))
                return NULL;

        if (ast_string_field_init(tmp, 32)) {
                ast_free(tmp);
                tmp = NULL;
                return NULL;
        }
                
        tmp->prefs = prefs;
        tmp->pingid = -1;
        tmp->lagid = -1;
        tmp->autoid = -1;
        tmp->authid = -1;
        tmp->initid = -1;

        ast_string_field_set(tmp,exten, "s");
        ast_string_field_set(tmp,host, host);

        tmp->jb = jb_new();
        tmp->jbid = -1;
        jbconf.max_jitterbuf = maxjitterbuffer;
        jbconf.resync_threshold = resyncthreshold;
        jbconf.max_contig_interp = maxjitterinterps;
        jbconf.target_extra = jittertargetextra;
        jb_setconf(tmp->jb,&jbconf);

        AST_LIST_HEAD_INIT_NOLOCK(&tmp->dpentries);

        return tmp;
}

static struct iax_frame *iaxfrdup2(struct iax_frame *fr)
{
        struct iax_frame *new = iax_frame_new(DIRECTION_INGRESS, fr->af.datalen, fr->cacheable);
        if (new) {
                size_t afdatalen = new->afdatalen;
                memcpy(new, fr, sizeof(*new));
                iax_frame_wrap(new, &fr->af);
                new->afdatalen = afdatalen;
                new->data = NULL;
                new->datalen = 0;
                new->direction = DIRECTION_INGRESS;
                new->retrans = -1;
        }
        return new;
}

#define NEW_PREVENT     0
#define NEW_ALLOW       1
#define NEW_FORCE       2

static int match(struct sockaddr_in *sin, unsigned short callno, unsigned short dcallno, const struct chan_iax2_pvt *cur)
{
        if ((cur->addr.sin_addr.s_addr == sin->sin_addr.s_addr) &&
                (cur->addr.sin_port == sin->sin_port)) {
                /* This is the main host */
                if ((cur->peercallno == callno) ||
                        ((dcallno == cur->callno) && !cur->peercallno)) {
                        /* That's us.  Be sure we keep track of the peer call number */
                        return 1;
                }
        }
        if ((cur->transfer.sin_addr.s_addr == sin->sin_addr.s_addr) &&
            (cur->transfer.sin_port == sin->sin_port) && (cur->transferring)) {
                /* We're transferring */
                if ((dcallno == cur->callno) || (cur->transferring == TRANSFER_MEDIAPASS && cur->transfercallno == callno))
                        return 1;
        }
        return 0;
}

static void update_max_trunk(void)
{
        int max = TRUNK_CALL_START;
        int x;
        /* XXX Prolly don't need locks here XXX */
        for (x=TRUNK_CALL_START;x<IAX_MAX_CALLS - 1; x++) {
                if (iaxs[x])
                        max = x + 1;
        }
        maxtrunkcall = max;
        if (iaxdebug)
                ast_debug(1, "New max trunk callno is %d\n", max);
}

static void update_max_nontrunk(void)
{
        int max = 1;
        int x;
        /* XXX Prolly don't need locks here XXX */
        for (x=1;x<TRUNK_CALL_START - 1; x++) {
                if (iaxs[x])
                        max = x + 1;
        }
        maxnontrunkcall = max;
        if (iaxdebug)
                ast_debug(1, "New max nontrunk callno is %d\n", max);
}

static int make_trunk(unsigned short callno, int locked)
{
        int x;
        int res= 0;
        struct timeval now = ast_tvnow();
        if (iaxs[callno]->oseqno) {
                ast_log(LOG_WARNING, "Can't make trunk once a call has started!\n");
                return -1;
        }
        if (callno & TRUNK_CALL_START) {
                ast_log(LOG_WARNING, "Call %d is already a trunk\n", callno);
                return -1;
        }
        for (x=TRUNK_CALL_START;x<IAX_MAX_CALLS - 1; x++) {
                ast_mutex_lock(&iaxsl[x]);
                if (!iaxs[x] && ((now.tv_sec - lastused[x].tv_sec) > MIN_REUSE_TIME)) {
                        iaxs[x] = iaxs[callno];
                        iaxs[x]->callno = x;
                        iaxs[callno] = NULL;
                        /* Update the two timers that should have been started */
                        iaxs[x]->pingid = iax2_sched_replace(iaxs[x]->pingid, sched, 
                                ping_time * 1000, send_ping, (void *)(long)x);
                        iaxs[x]->lagid = iax2_sched_replace(iaxs[x]->lagid, sched, 
                                lagrq_time * 1000, send_lagrq, (void *)(long)x);
                        if (locked)
                                ast_mutex_unlock(&iaxsl[callno]);
                        res = x;
                        if (!locked)
                                ast_mutex_unlock(&iaxsl[x]);
                        break;
                }
                ast_mutex_unlock(&iaxsl[x]);
        }
        if (x >= IAX_MAX_CALLS - 1) {
                ast_log(LOG_WARNING, "Unable to trunk call: Insufficient space\n");
                return -1;
        }
        ast_debug(1, "Made call %d into trunk call %d\n", callno, x);
        /* We move this call from a non-trunked to a trunked call */
        update_max_trunk();
        update_max_nontrunk();
        return res;
}

/*!
 * \todo XXX Note that this function contains a very expensive operation that
 * happens for *every* incoming media frame.  It iterates through every
 * possible call number, locking and unlocking each one, to try to match the
 * incoming frame to an active call.  Call numbers can be up to 2^15, 32768.
 * So, for a call with a local call number of 20000, every incoming audio
 * frame would require 20000 mutex lock and unlock operations.  Ouch.
 *
 * It's a shame that IAX2 media frames carry the source call number instead of
 * the destination call number.  If they did, this lookup wouldn't be needed.
 * However, it's too late to change that now.  Instead, we need to come up with
 * a better way of indexing active calls so that these frequent lookups are not
 * so expensive.
 *
 * \note Calling this function while holding another pvt lock can cause a deadlock.
 */
static int find_callno(unsigned short callno, unsigned short dcallno, struct sockaddr_in *sin, int new, int sockfd)
{
        int res = 0;
        int x;
        struct timeval now;
        char host[80];

        if (new <= NEW_ALLOW) {
                for (x=1;(res < 1) && (x<maxnontrunkcall);x++) {
                        ast_mutex_lock(&iaxsl[x]);
                        if (iaxs[x]) {
                                /* Look for an exact match */
                                if (match(sin, callno, dcallno, iaxs[x])) {
                                        res = x;
                                }
                        }
                        ast_mutex_unlock(&iaxsl[x]);
                }
                for (x=TRUNK_CALL_START;(res < 1) && (x<maxtrunkcall);x++) {
                        ast_mutex_lock(&iaxsl[x]);
                        if (iaxs[x]) {
                                /* Look for an exact match */
                                if (match(sin, callno, dcallno, iaxs[x])) {
                                        res = x;
                                }
                        }
                        ast_mutex_unlock(&iaxsl[x]);
                }
        }
        if ((res < 1) && (new >= NEW_ALLOW)) {
                /* It may seem odd that we look through the peer list for a name for
                 * this *incoming* call.  Well, it is weird.  However, users don't
                 * have an IP address/port number that we can match against.  So,
                 * this is just checking for a peer that has that IP/port and
                 * assuming that we have a user of the same name.  This isn't always
                 * correct, but it will be changed if needed after authentication. */
                if (!iax2_getpeername(*sin, host, sizeof(host)))
                        snprintf(host, sizeof(host), "%s:%d", ast_inet_ntoa(sin->sin_addr), ntohs(sin->sin_port));
                now = ast_tvnow();
                for (x=1;x<TRUNK_CALL_START;x++) {
                        /* Find first unused call number that hasn't been used in a while */
                        ast_mutex_lock(&iaxsl[x]);
                        if (!iaxs[x] && ((now.tv_sec - lastused[x].tv_sec) > MIN_REUSE_TIME)) break;
                        ast_mutex_unlock(&iaxsl[x]);
                }
                /* We've still got lock held if we found a spot */
                if (x >= TRUNK_CALL_START) {
                        ast_log(LOG_WARNING, "No more space\n");
                        return 0;
                }
                iaxs[x] = new_iax(sin, host);
                update_max_nontrunk();
                if (iaxs[x]) {
                        if (iaxdebug)
                                ast_debug(1, "Creating new call structure %d\n", x);
                        iaxs[x]->sockfd = sockfd;
                        iaxs[x]->addr.sin_port = sin->sin_port;
                        iaxs[x]->addr.sin_family = sin->sin_family;
                        iaxs[x]->addr.sin_addr.s_addr = sin->sin_addr.s_addr;
                        iaxs[x]->peercallno = callno;
                        iaxs[x]->callno = x;
                        iaxs[x]->pingtime = DEFAULT_RETRY_TIME;
                        iaxs[x]->expiry = min_reg_expire;
                        iaxs[x]->pingid = iax2_sched_add(sched, ping_time * 1000, send_ping, (void *)(long)x);
                        iaxs[x]->lagid = iax2_sched_add(sched, lagrq_time * 1000, send_lagrq, (void *)(long)x);
                        iaxs[x]->amaflags = amaflags;
                        ast_copy_flags(iaxs[x], (&globalflags), IAX_NOTRANSFER | IAX_TRANSFERMEDIA | IAX_USEJITTERBUF | IAX_FORCEJITTERBUF);
                        
                        ast_string_field_set(iaxs[x], accountcode, accountcode);
                        ast_string_field_set(iaxs[x], mohinterpret, mohinterpret);
                        ast_string_field_set(iaxs[x], mohsuggest, mohsuggest);
                } else {
                        ast_log(LOG_WARNING, "Out of resources\n");
                        ast_mutex_unlock(&iaxsl[x]);
                        return 0;
                }
                ast_mutex_unlock(&iaxsl[x]);
                res = x;
        }
        return res;
}

static void iax2_frame_free(struct iax_frame *fr)
{
        if (fr->retrans > -1)
                ast_sched_del(sched, fr->retrans);
        iax_frame_free(fr);
}

/*!
 * \brief Queue a frame to a call's owning asterisk channel
 *
 * \pre This function assumes that iaxsl[callno] is locked when called.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_frame(int callno, struct ast_frame *f)
{
        for (;;) {
                if (iaxs[callno] && iaxs[callno]->owner) {
                        if (ast_channel_trylock(iaxs[callno]->owner)) {
                                /* Avoid deadlock by pausing and trying again */
                                ast_mutex_unlock(&iaxsl[callno]);
                                usleep(1);
                                ast_mutex_lock(&iaxsl[callno]);
                        } else {
                                ast_queue_frame(iaxs[callno]->owner, f);
                                ast_channel_unlock(iaxs[callno]->owner);
                                break;
                        }
                } else
                        break;
        }
        return 0;
}

/*!
 * \brief Queue a hangup frame on the ast_channel owner
 *
 * This function queues a hangup frame on the owner of the IAX2 pvt struct that
 * is active for the given call number.
 *
 * \pre Assumes lock for callno is already held.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_hangup(int callno)
{
        for (;;) {
                if (iaxs[callno] && iaxs[callno]->owner) {
                        if (ast_channel_trylock(iaxs[callno]->owner)) {
                                /* Avoid deadlock by pausing and trying again */
                                ast_mutex_unlock(&iaxsl[callno]);
                                usleep(1);
                                ast_mutex_lock(&iaxsl[callno]);
                        } else {
                                ast_queue_hangup(iaxs[callno]->owner);
                                ast_channel_unlock(iaxs[callno]->owner);
                                break;
                        }
                } else
                        break;
        }
        return 0;
}

/*!
 * \brief Queue a control frame on the ast_channel owner
 *
 * This function queues a control frame on the owner of the IAX2 pvt struct that
 * is active for the given call number.
 *
 * \pre Assumes lock for callno is already held.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_control_data(int callno, 
        enum ast_control_frame_type control, const void *data, size_t datalen)
{
        for (;;) {
                if (iaxs[callno] && iaxs[callno]->owner) {
                        if (ast_channel_trylock(iaxs[callno]->owner)) {
                                /* Avoid deadlock by pausing and trying again */
                                ast_mutex_unlock(&iaxsl[callno]);
                                usleep(1);
                                ast_mutex_lock(&iaxsl[callno]);
                        } else {
                                ast_queue_control_data(iaxs[callno]->owner, control, data, datalen);
                                ast_channel_unlock(iaxs[callno]->owner);
                                break;
                        }
                } else
                        break;
        }
        return 0;
}
static void destroy_firmware(struct iax_firmware *cur)
{
        /* Close firmware */
        if (cur->fwh) {
                munmap((void*)cur->fwh, ntohl(cur->fwh->datalen) + sizeof(*(cur->fwh)));
        }
        close(cur->fd);
        ast_free(cur);
}

static int try_firmware(char *s)
{
        struct stat stbuf;
        struct iax_firmware *cur = NULL;
        int ifd, fd, res, len, chunk;
        struct ast_iax2_firmware_header *fwh, fwh2;
        struct MD5Context md5;
        unsigned char sum[16], buf[1024];
        char *s2, *last;

        if (!(s2 = alloca(strlen(s) + 100))) {
                ast_log(LOG_WARNING, "Alloca failed!\n");
                return -1;
        }

        last = strrchr(s, '/');
        if (last)
                last++;
        else
                last = s;

        snprintf(s2, strlen(s) + 100, "/var/tmp/%s-%ld", last, (unsigned long)ast_random());

        if ((res = stat(s, &stbuf) < 0)) {
                ast_log(LOG_WARNING, "Failed to stat '%s': %s\n", s, strerror(errno));
                return -1;
        }

        /* Make sure it's not a directory */
        if (S_ISDIR(stbuf.st_mode))
                return -1;
        ifd = open(s, O_RDONLY);
        if (ifd < 0) {
                ast_log(LOG_WARNING, "Cannot open '%s': %s\n", s, strerror(errno));
                return -1;
        }
        fd = open(s2, O_RDWR | O_CREAT | O_EXCL, AST_FILE_MODE);
        if (fd < 0) {
                ast_log(LOG_WARNING, "Cannot open '%s' for writing: %s\n", s2, strerror(errno));
                close(ifd);
                return -1;
        }
        /* Unlink our newly created file */
        unlink(s2);
        
        /* Now copy the firmware into it */
        len = stbuf.st_size;
        while(len) {
                chunk = len;
                if (chunk > sizeof(buf))
                        chunk = sizeof(buf);
                res = read(ifd, buf, chunk);
                if (res != chunk) {
                        ast_log(LOG_WARNING, "Only read %d of %d bytes of data :(: %s\n", res, chunk, strerror(errno));
                        close(ifd);
                        close(fd);
                        return -1;
                }
                res = write(fd, buf, chunk);
                if (res != chunk) {
                        ast_log(LOG_WARNING, "Only write %d of %d bytes of data :(: %s\n", res, chunk, strerror(errno));
                        close(ifd);
                        close(fd);
                        return -1;
                }
                len -= chunk;
        }
        close(ifd);
        /* Return to the beginning */
        lseek(fd, 0, SEEK_SET);
        if ((res = read(fd, &fwh2, sizeof(fwh2))) != sizeof(fwh2)) {
                ast_log(LOG_WARNING, "Unable to read firmware header in '%s'\n", s);
                close(fd);
                return -1;
        }
        if (ntohl(fwh2.magic) != IAX_FIRMWARE_MAGIC) {
                ast_log(LOG_WARNING, "'%s' is not a valid firmware file\n", s);
                close(fd);
                return -1;
        }
        if (ntohl(fwh2.datalen) != (stbuf.st_size - sizeof(fwh2))) {
                ast_log(LOG_WARNING, "Invalid data length in firmware '%s'\n", s);
                close(fd);
                return -1;
        }
        if (fwh2.devname[sizeof(fwh2.devname) - 1] || ast_strlen_zero((char *)fwh2.devname)) {
                ast_log(LOG_WARNING, "No or invalid device type specified for '%s'\n", s);
                close(fd);
                return -1;
        }
        fwh = (struct ast_iax2_firmware_header*)mmap(NULL, stbuf.st_size, PROT_READ, MAP_PRIVATE, fd, 0); 
        if (fwh == (void *) -1) {
                ast_log(LOG_WARNING, "mmap failed: %s\n", strerror(errno));
                close(fd);
                return -1;
        }
        MD5Init(&md5);
        MD5Update(&md5, fwh->data, ntohl(fwh->datalen));
        MD5Final(sum, &md5);
        if (memcmp(sum, fwh->chksum, sizeof(sum))) {
                ast_log(LOG_WARNING, "Firmware file '%s' fails checksum\n", s);
                munmap((void*)fwh, stbuf.st_size);
                close(fd);
                return -1;
        }

        AST_LIST_TRAVERSE(&firmwares, cur, list) {
                if (!strcmp((char *)cur->fwh->devname, (char *)fwh->devname)) {
                        /* Found a candidate */
                        if (cur->dead || (ntohs(cur->fwh->version) < ntohs(fwh->version)))
                                /* The version we have on loaded is older, load this one instead */
                                break;
                        /* This version is no newer than what we have.  Don't worry about it.
                           We'll consider it a proper load anyhow though */
                        munmap((void*)fwh, stbuf.st_size);
                        close(fd);
                        return 0;
                }
        }
        
        if (!cur && ((cur = ast_calloc(1, sizeof(*cur))))) {
                cur->fd = -1;
                AST_LIST_INSERT_TAIL(&firmwares, cur, list);
        }
        
        if (cur) {
                if (cur->fwh)
                        munmap((void*)cur->fwh, cur->mmaplen);
                if (cur->fd > -1)
                        close(cur->fd);
                cur->fwh = fwh;
                cur->fd = fd;
                cur->mmaplen = stbuf.st_size;
                cur->dead = 0;
        }
        
        return 0;
}

static int iax_check_version(char *dev)
{
        int res = 0;
        struct iax_firmware *cur = NULL;

        if (ast_strlen_zero(dev))
                return 0;

        AST_LIST_LOCK(&firmwares);
        AST_LIST_TRAVERSE(&firmwares, cur, list) {
                if (!strcmp(dev, (char *)cur->fwh->devname)) {
                        res = ntohs(cur->fwh->version);
                        break;
                }
        }
        AST_LIST_UNLOCK(&firmwares);

        return res;
}

static int iax_firmware_append(struct iax_ie_data *ied, const unsigned char *dev, unsigned int desc)
{
        int res = -1;
        unsigned int bs = desc & 0xff;
        unsigned int start = (desc >> 8) & 0xffffff;
        unsigned int bytes;
        struct iax_firmware *cur;

        if (ast_strlen_zero((char *)dev) || !bs)
                return -1;

        start *= bs;
        
        AST_LIST_LOCK(&firmwares);
        AST_LIST_TRAVERSE(&firmwares, cur, list) {
                if (strcmp((char *)dev, (char *)cur->fwh->devname))
                        continue;
                iax_ie_append_int(ied, IAX_IE_FWBLOCKDESC, desc);
                if (start < ntohl(cur->fwh->datalen)) {
                        bytes = ntohl(cur->fwh->datalen) - start;
                        if (bytes > bs)
                                bytes = bs;
                        iax_ie_append_raw(ied, IAX_IE_FWBLOCKDATA, cur->fwh->data + start, bytes);
                } else {
                        bytes = 0;
                        iax_ie_append(ied, IAX_IE_FWBLOCKDATA);
                }
                if (bytes == bs)
                        res = 0;
                else
                        res = 1;
                break;
        }
        AST_LIST_UNLOCK(&firmwares);

        return res;
}


static void reload_firmware(int unload)
{
        struct iax_firmware *cur = NULL;
        DIR *fwd;
        struct dirent *de;
        char dir[256], fn[256];

        AST_LIST_LOCK(&firmwares);

        /* Mark all as dead */
        AST_LIST_TRAVERSE(&firmwares, cur, list)
                cur->dead = 1;

        /* Now that we have marked them dead... load new ones */
        if (!unload) {
                snprintf(dir, sizeof(dir), "%s/firmware/iax", (char *)ast_config_AST_DATA_DIR);
                fwd = opendir(dir);
                if (fwd) {
                        while((de = readdir(fwd))) {
                                if (de->d_name[0] != '.') {
                                        snprintf(fn, sizeof(fn), "%s/%s", dir, de->d_name);
                                        if (!try_firmware(fn)) {
                                                ast_verb(2, "Loaded firmware '%s'\n", de->d_name);
                                        }
                                }
                        }
                        closedir(fwd);
                } else 
                        ast_log(LOG_WARNING, "Error opening firmware directory '%s': %s\n", dir, strerror(errno));
        }

        /* Clean up leftovers */
        AST_LIST_TRAVERSE_SAFE_BEGIN(&firmwares, cur, list) {
                if (!cur->dead)
                        continue;
                AST_LIST_REMOVE_CURRENT(list);
                destroy_firmware(cur);
        }
        AST_LIST_TRAVERSE_SAFE_END;

        AST_LIST_UNLOCK(&firmwares);
}

/*!
 * \note This function assumes that iaxsl[callno] is locked when called.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function calls iax2_queue_frame(), which may unlock and lock the mutex 
 * associated with this callno, meaning that another thread may grab it and destroy the call.
 */
static int __do_deliver(void *data)
{
        /* Just deliver the packet by using queueing.  This is called by
          the IAX thread with the iaxsl lock held. */
        struct iax_frame *fr = data;
        fr->retrans = -1;
        fr->af.has_timing_info = 0;
        if (iaxs[fr->callno] && !ast_test_flag(iaxs[fr->callno], IAX_ALREADYGONE))
                iax2_queue_frame(fr->callno, &fr->af);
        /* Free our iax frame */
        iax2_frame_free(fr);
        /* And don't run again */
        return 0;
}

static int handle_error(void)
{
        /* XXX Ideally we should figure out why an error occurred and then abort those
           rather than continuing to try.  Unfortunately, the published interface does
           not seem to work XXX */
#if 0
        struct sockaddr_in *sin;
        int res;
        struct msghdr m;
        struct sock_extended_err e;
        m.msg_name = NULL;
        m.msg_namelen = 0;
        m.msg_iov = NULL;
        m.msg_control = &e;
        m.msg_controllen = sizeof(e);
        m.msg_flags = 0;
        res = recvmsg(netsocket, &m, MSG_ERRQUEUE);
        if (res < 0)
                ast_log(LOG_WARNING, "Error detected, but unable to read error: %s\n", strerror(errno));
        else {
                if (m.msg_controllen) {
                        sin = (struct sockaddr_in *)SO_EE_OFFENDER(&e);
                        if (sin) 
                                ast_log(LOG_WARNING, "Receive error from %s\n", ast_inet_ntoa(sin->sin_addr));
                        else
                                ast_log(LOG_WARNING, "No address detected??\n");
                } else {
                        ast_log(LOG_WARNING, "Local error: %s\n", strerror(e.ee_errno));
                }
        }
#endif
        return 0;
}

static int transmit_trunk(struct iax_frame *f, struct sockaddr_in *sin, int sockfd)
{
        int res;
        res = sendto(sockfd, f->data, f->datalen, 0,(struct sockaddr *)sin,
                                        sizeof(*sin));
        if (res < 0) {
                ast_debug(1, "Received error: %s\n", strerror(errno));
                handle_error();
        } else
                res = 0;
        return res;
}

static int send_packet(struct iax_frame *f)
{
        int res;
        int callno = f->callno;

        /* Don't send if there was an error, but return error instead */
        if (!callno || !iaxs[callno] || iaxs[callno]->error)
            return -1;
        
        /* Called with iaxsl held */
        if (iaxdebug)
                ast_debug(3, "Sending %d on %d/%d to %s:%d\n", f->ts, callno, iaxs[callno]->peercallno, ast_inet_ntoa(iaxs[callno]->addr.sin_addr), ntohs(iaxs[callno]->addr.sin_port));
        if (f->transfer) {
                if (iaxdebug)
                        iax_showframe(f, NULL, 0, &iaxs[callno]->transfer, f->datalen - sizeof(struct ast_iax2_full_hdr));
                res = sendto(iaxs[callno]->sockfd, f->data, f->datalen, 0,(struct sockaddr *)&iaxs[callno]->transfer,
                                        sizeof(iaxs[callno]->transfer));
        } else {
                if (iaxdebug)
                        iax_showframe(f, NULL, 0, &iaxs[callno]->addr, f->datalen - sizeof(struct ast_iax2_full_hdr));
                res = sendto(iaxs[callno]->sockfd, f->data, f->datalen, 0,(struct sockaddr *)&iaxs[callno]->addr,
                                        sizeof(iaxs[callno]->addr));
        }
        if (res < 0) {
                if (iaxdebug)
                        ast_debug(1, "Received error: %s\n", strerror(errno));
                handle_error();
        } else
                res = 0;
        return res;
}

static void iax2_destroy_helper(struct chan_iax2_pvt *pvt)
{
        /* Decrement AUTHREQ count if needed */
        if (ast_test_flag(pvt, IAX_MAXAUTHREQ)) {
                struct iax2_user *user;
                struct iax2_user tmp_user = {
                        .name = pvt->username,
                };

                user = ao2_find(users, &tmp_user, OBJ_POINTER);
                if (user) {
                        ast_atomic_fetchadd_int(&user->curauthreq, -1);
                        user_unref(user);       
                }

                ast_clear_flag(pvt, IAX_MAXAUTHREQ);
        }
        /* No more pings or lagrq's */
        if (pvt->pingid > -1)
                ast_sched_del(sched, pvt->pingid);
        pvt->pingid = -1;
        if (pvt->lagid > -1)
                ast_sched_del(sched, pvt->lagid);
        pvt->lagid = -1;
        if (pvt->autoid > -1)
                ast_sched_del(sched, pvt->autoid);
        pvt->autoid = -1;
        if (pvt->authid > -1)
                ast_sched_del(sched, pvt->authid);
        pvt->authid = -1;
        if (pvt->initid > -1)
                ast_sched_del(sched, pvt->initid);
        pvt->initid = -1;
        if (pvt->jbid > -1)
                ast_sched_del(sched, pvt->jbid);
        pvt->jbid = -1;
}

/*!
 * \note Since this function calls iax2_queue_hangup(), the pvt struct
 *       for the given call number may disappear during its execution.
 */
static int iax2_predestroy(int callno)
{
        struct ast_channel *c = NULL;
        struct chan_iax2_pvt *pvt = iaxs[callno];

        if (!pvt)
                return -1;

        if (!ast_test_flag(pvt, IAX_ALREADYGONE)) {
                iax2_destroy_helper(pvt);
                ast_set_flag(pvt, IAX_ALREADYGONE);     
        }

        if ((c = pvt->owner)) {
                c->tech_pvt = NULL;
                iax2_queue_hangup(callno);
                pvt->owner = NULL;
                ast_module_unref(ast_module_info->self);
        }

        return 0;
}

static void iax2_destroy(int callno)
{
        struct chan_iax2_pvt *pvt = NULL;
        struct iax_frame *cur = NULL;
        struct ast_channel *owner = NULL;

retry:
        pvt = iaxs[callno];
        lastused[callno] = ast_tvnow();
        
        owner = pvt ? pvt->owner : NULL;

        if (owner) {
                if (ast_channel_trylock(owner)) {
                        ast_log(LOG_NOTICE, "Avoiding IAX destroy deadlock\n");
                        ast_mutex_unlock(&iaxsl[callno]);
                        usleep(1);
                        ast_mutex_lock(&iaxsl[callno]);
                        goto retry;
                }
        }
        if (!owner)
                iaxs[callno] = NULL;
        if (pvt) {
                if (!owner)
                        pvt->owner = NULL;
                iax2_destroy_helper(pvt);

                /* Already gone */
                ast_set_flag(pvt, IAX_ALREADYGONE);     

                if (owner) {
                        /* If there's an owner, prod it to give up */
                        /* It is ok to use ast_queue_hangup() here instead of iax2_queue_hangup()
                         * because we already hold the owner channel lock. */
                        ast_queue_hangup(owner);
                }

                AST_LIST_LOCK(&frame_queue);
                AST_LIST_TRAVERSE(&frame_queue, cur, list) {
                        /* Cancel any pending transmissions */
                        if (cur->callno == pvt->callno) 
                                cur->retries = -1;
                }
                AST_LIST_UNLOCK(&frame_queue);

                if (pvt->reg)
                        pvt->reg->callno = 0;
                if (!owner) {
                        jb_frame frame;
                        if (pvt->vars) {
                            ast_variables_destroy(pvt->vars);
                            pvt->vars = NULL;
                        }

                        while (jb_getall(pvt->jb, &frame) == JB_OK)
                                iax2_frame_free(frame.data);
                        jb_destroy(pvt->jb);
                        /* gotta free up the stringfields */
                        ast_string_field_free_memory(pvt);
                        ast_free(pvt);
                }
        }
        if (owner) {
                ast_channel_unlock(owner);
        }
        if (callno & 0x4000)
                update_max_trunk();
}

static int update_packet(struct iax_frame *f)
{
        /* Called with iaxsl lock held, and iaxs[callno] non-NULL */
        struct ast_iax2_full_hdr *fh = f->data;
        /* Mark this as a retransmission */
        fh->dcallno = ntohs(IAX_FLAG_RETRANS | f->dcallno);
        /* Update iseqno */
        f->iseqno = iaxs[f->callno]->iseqno;
        fh->iseqno = f->iseqno;
        return 0;
}

static int attempt_transmit(const void *data);
static void __attempt_transmit(const void *data)
{
        /* Attempt to transmit the frame to the remote peer...
           Called without iaxsl held. */
        struct iax_frame *f = (struct iax_frame *)data;
        int freeme = 0;
        int callno = f->callno;
        /* Make sure this call is still active */
        if (callno) 
                ast_mutex_lock(&iaxsl[callno]);
        if (callno && iaxs[callno]) {
                if ((f->retries < 0) /* Already ACK'd */ ||
                    (f->retries >= max_retries) /* Too many attempts */) {
                                /* Record an error if we've transmitted too many times */
                                if (f->retries >= max_retries) {
                                        if (f->transfer) {
                                                /* Transfer timeout */
                                                send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_TXREJ, 0, NULL, 0, -1);
                                        } else if (f->final) {
                                                if (f->final) 
                                                        iax2_destroy(callno);
                                        } else {
                                                if (iaxs[callno]->owner)
                                                        ast_log(LOG_WARNING, "Max retries exceeded to host %s on %s (type = %d, subclass = %d, ts=%d, seqno=%d)\n", ast_inet_ntoa(iaxs[f->callno]->addr.sin_addr),iaxs[f->callno]->owner->name , f->af.frametype, f->af.subclass, f->ts, f->oseqno);
                                                iaxs[callno]->error = ETIMEDOUT;
                                                if (iaxs[callno]->owner) {
                                                        struct ast_frame fr = { 0, };
                                                        /* Hangup the fd */
                                                        fr.frametype = AST_FRAME_CONTROL;
                                                        fr.subclass = AST_CONTROL_HANGUP;
                                                        iax2_queue_frame(callno, &fr); /* XXX */
                                                        /* Remember, owner could disappear */
                                                        if (iaxs[callno] && iaxs[callno]->owner)
                                                                iaxs[callno]->owner->hangupcause = AST_CAUSE_DESTINATION_OUT_OF_ORDER;
                                                } else {
                                                        if (iaxs[callno]->reg) {
                                                                memset(&iaxs[callno]->reg->us, 0, sizeof(iaxs[callno]->reg->us));
                                                                iaxs[callno]->reg->regstate = REG_STATE_TIMEOUT;
                                                                iaxs[callno]->reg->refresh = IAX_DEFAULT_REG_EXPIRE;
                                                        }
                                                        iax2_destroy(callno);
                                                }
                                        }

                                }
                                freeme = 1;
                } else {
                        /* Update it if it needs it */
                        update_packet(f);
                        /* Attempt transmission */
                        send_packet(f);
                        f->retries++;
                        /* Try again later after 10 times as long */
                        f->retrytime *= 10;
                        if (f->retrytime > MAX_RETRY_TIME)
                                f->retrytime = MAX_RETRY_TIME;
                        /* Transfer messages max out at one second */
                        if (f->transfer && (f->retrytime > 1000))
                                f->retrytime = 1000;
                        f->retrans = iax2_sched_add(sched, f->retrytime, attempt_transmit, f);
                }
        } else {
                /* Make sure it gets freed */
                f->retries = -1;
                freeme = 1;
        }
        if (callno)
                ast_mutex_unlock(&iaxsl[callno]);
        /* Do not try again */
        if (freeme) {
                /* Don't attempt delivery, just remove it from the queue */
                AST_LIST_LOCK(&frame_queue);
                AST_LIST_REMOVE(&frame_queue, f, list);
                AST_LIST_UNLOCK(&frame_queue);
                f->retrans = -1;
                /* Free the IAX frame */
                iax2_frame_free(f);
        }
}

static int attempt_transmit(const void *data)
{
#ifdef SCHED_MULTITHREADED
        if (schedule_action(__attempt_transmit, data))
#endif          
                __attempt_transmit(data);
        return 0;
}

static char *handle_cli_iax2_prune_realtime(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        struct iax2_peer *peer;

        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 prune realtime";
                e->usage =
                        "Usage: iax2 prune realtime [<peername>|all]\n"
                        "       Prunes object(s) from the cache\n";
                return NULL;
        case CLI_GENERATE:
                return complete_iax2_show_peer(a->line, a->word, a->pos, a->n);
        }

        if (a->argc != 4)
        return CLI_SHOWUSAGE;
        if (!strcmp(a->argv[3], "all")) {
                reload_config();
                ast_cli(a->fd, "Cache flushed successfully.\n");
        } else if ((peer = find_peer(a->argv[3], 0))) {
                if(ast_test_flag(peer, IAX_RTCACHEFRIENDS)) {
                        ast_set_flag(peer, IAX_RTAUTOCLEAR);
                        expire_registry(peer_ref(peer));
                        ast_cli(a->fd, "Peer %s was removed from the cache.\n", a->argv[3]);
                } else {
                        ast_cli(a->fd, "Peer %s is not eligible for this operation.\n", a->argv[3]);
                }
                peer_unref(peer);
        } else {
                ast_cli(a->fd, "Peer %s was not found in the cache.\n", a->argv[3]);
        }
        
        return CLI_SUCCESS;
}

static char *handle_cli_iax2_test_losspct(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 test losspct";
                e->usage =
                        "Usage: iax2 test losspct <percentage>\n"
                        "       For testing, throws away <percentage> percent of incoming packets\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }
        if (a->argc != 4)
                return CLI_SHOWUSAGE;

        test_losspct = atoi(a->argv[3]);

        return CLI_SUCCESS;
}

#ifdef IAXTESTS
static char *handle_cli_iax2_test_late(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 test late";
                e->usage =
                        "Usage: iax2 test late <ms>\n"
                        "       For testing, count the next frame as <ms> ms late\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        if (a->argc != 4)
                return CLI_SHOWUSAGE;

        test_late = atoi(a->argv[3]);

        return CLI_SUCCESS;
}

static char *handle_cli_iax2_test_resync(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 test resync";
                e->usage =
                        "Usage: iax2 test resync <ms>\n"
                        "       For testing, adjust all future frames by <ms> ms\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        if (a->argc != 4)
                return CLI_SHOWUSAGE;

        test_resync = atoi(a->argv[3]);

        return CLI_SUCCESS;
}

static char *handle_cli_iax2_test_jitter(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 test jitter";
                e->usage =
                        "Usage: iax2 test jitter <ms> <pct>\n"
                        "       For testing, simulate maximum jitter of +/- <ms> on <pct>\n"
                        "       percentage of packets. If <pct> is not specified, adds\n"
                        "       jitter to all packets.\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        if (a->argc < 4 || a->argc > 5)
                return CLI_SHOWUSAGE;

        test_jit = atoi(a->argv[3]);
        if (a->argc == 5)
                test_jitpct = atoi(a->argv[4]);

        return CLI_SUCCESS;
}
#endif /* IAXTESTS */

/*! \brief  peer_status: Report Peer status in character string */
/*      returns 1 if peer is online, -1 if unmonitored */
static int peer_status(struct iax2_peer *peer, char *status, int statuslen)
{
        int res = 0;
        if (peer->maxms) {
                if (peer->lastms < 0) {
                        ast_copy_string(status, "UNREACHABLE", statuslen);
                } else if (peer->lastms > peer->maxms) {
                        snprintf(status, statuslen, "LAGGED (%d ms)", peer->lastms);
                        res = 1;
                } else if (peer->lastms) {
                        snprintf(status, statuslen, "OK (%d ms)", peer->lastms);
                        res = 1;
                } else {
                        ast_copy_string(status, "UNKNOWN", statuslen);
                }
        } else { 
                ast_copy_string(status, "Unmonitored", statuslen);
                res = -1;
        }
        return res;
}

/*! \brief Show one peer in detail */
static char *handle_cli_iax2_show_peer(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        char status[30];
        char cbuf[256];
        struct iax2_peer *peer;
        char codec_buf[512];
        int x = 0, codec = 0, load_realtime = 0;

        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 show peer";
                e->usage =
                        "Usage: iax2 show peer <name>\n"
                        "       Display details on specific IAX peer\n";
                return NULL;
        case CLI_GENERATE:
                return complete_iax2_show_peer(a->line, a->word, a->pos, a->n);
        }

        if (a->argc < 4)
                return CLI_SHOWUSAGE;

        load_realtime = (a->argc == 5 && !strcmp(a->argv[4], "load")) ? 1 : 0;

        peer = find_peer(a->argv[3], load_realtime);
        if (peer) {
                ast_cli(a->fd, "\n\n");
                ast_cli(a->fd, "  * Name       : %s\n", peer->name);
                ast_cli(a->fd, "  Secret       : %s\n", ast_strlen_zero(peer->secret) ? "<Not set>" : "<Set>");
                ast_cli(a->fd, "  Context      : %s\n", peer->context);
                ast_cli(a->fd, "  Mailbox      : %s\n", peer->mailbox);
                ast_cli(a->fd, "  Dynamic      : %s\n", ast_test_flag(peer, IAX_DYNAMIC) ? "Yes" : "No");
                ast_cli(a->fd, "  Callerid     : %s\n", ast_callerid_merge(cbuf, sizeof(cbuf), peer->cid_name, peer->cid_num, "<unspecified>"));
                ast_cli(a->fd, "  Expire       : %d\n", peer->expire);
                ast_cli(a->fd, "  ACL          : %s\n", (peer->ha ? "Yes" : "No"));
                ast_cli(a->fd, "  Addr->IP     : %s Port %d\n",  peer->addr.sin_addr.s_addr ? ast_inet_ntoa(peer->addr.sin_addr) : "(Unspecified)", ntohs(peer->addr.sin_port));
                ast_cli(a->fd, "  Defaddr->IP  : %s Port %d\n", ast_inet_ntoa(peer->defaddr.sin_addr), ntohs(peer->defaddr.sin_port));
                ast_cli(a->fd, "  Username     : %s\n", peer->username);
                ast_cli(a->fd, "  Codecs       : ");
                ast_getformatname_multiple(codec_buf, sizeof(codec_buf) -1, peer->capability);
                ast_cli(a->fd, "%s\n", codec_buf);

                ast_cli(a->fd, "  Codec Order  : (");
                for(x = 0; x < 32 ; x++) {
                        codec = ast_codec_pref_index(&peer->prefs,x);
                        if(!codec)
                                break;
                        ast_cli(a->fd, "%s", ast_getformatname(codec));
                        if(x < 31 && ast_codec_pref_index(&peer->prefs,x+1))
                                ast_cli(a->fd, "|");
                }

                if (!x)
                        ast_cli(a->fd, "none");
                ast_cli(a->fd, ")\n");

                ast_cli(a->fd, "  Status       : ");
                peer_status(peer, status, sizeof(status));      
                ast_cli(a->fd, "%s\n",status);
                ast_cli(a->fd, "  Qualify      : every %dms when OK, every %dms when UNREACHABLE (sample smoothing %s)\n", peer->pokefreqok, peer->pokefreqnotok, peer->smoothing ? "On" : "Off");
                ast_cli(a->fd, "\n");
                peer_unref(peer);
        } else {
                ast_cli(a->fd, "Peer %s not found.\n", a->argv[3]);
                ast_cli(a->fd, "\n");
        }

        return CLI_SUCCESS;
}

static char *complete_iax2_show_peer(const char *line, const char *word, int pos, int state)
{
        int which = 0;
        struct iax2_peer *peer;
        char *res = NULL;
        int wordlen = strlen(word);
        struct ao2_iterator i;

        /* 0 - iax2; 1 - show; 2 - peer; 3 - <peername> */
        if (pos != 3)
                return NULL;

        i = ao2_iterator_init(peers, 0);
        while ((peer = ao2_iterator_next(&i))) {
                if (!strncasecmp(peer->name, word, wordlen) && ++which > state) {
                        res = ast_strdup(peer->name);
                        peer_unref(peer);
                        break;
                }
                peer_unref(peer);
        }

        return res;
}

static char *handle_cli_iax2_show_stats(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        struct iax_frame *cur;
        int cnt = 0, dead = 0, final = 0;

        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 show stats";
                e->usage =
                        "Usage: iax2 show stats\n"
                        "       Display statistics on IAX channel driver.\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        if (a->argc != 3)
                return CLI_SHOWUSAGE;

        AST_LIST_LOCK(&frame_queue);
        AST_LIST_TRAVERSE(&frame_queue, cur, list) {
                if (cur->retries < 0)
                        dead++;
                if (cur->final)
                        final++;
                cnt++;
        }
        AST_LIST_UNLOCK(&frame_queue);

        ast_cli(a->fd, "    IAX Statistics\n");
        ast_cli(a->fd, "---------------------\n");
        ast_cli(a->fd, "Outstanding frames: %d (%d ingress, %d egress)\n", iax_get_frames(), iax_get_iframes(), iax_get_oframes());
        ast_cli(a->fd, "%d timed and %d untimed transmits; MTU %d/%d/%d\n", trunk_timed, trunk_untimed,
                trunk_maxmtu, trunk_nmaxmtu, global_max_trunk_mtu);
        ast_cli(a->fd, "Packets in transmit queue: %d dead, %d final, %d total\n\n", dead, final, cnt);

        trunk_timed = trunk_untimed = 0;
        if (trunk_maxmtu > trunk_nmaxmtu)
                trunk_nmaxmtu = trunk_maxmtu;

        return CLI_SUCCESS;
}

/*! \brief Set trunk MTU from CLI */
static char *handle_cli_iax2_set_mtu(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        int mtuv;

        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 set mtu";
                e->usage =
                        "Usage: iax2 set mtu <value>\n"
                        "       Set the system-wide IAX IP mtu to <value> bytes net or\n"
                        "       zero to disable. Disabling means that the operating system\n"
                        "       must handle fragmentation of UDP packets when the IAX2 trunk\n"
                        "       packet exceeds the UDP payload size. This is substantially\n"
                        "       below the IP mtu. Try 1240 on ethernets. Must be 172 or\n"
                        "       greater for G.711 samples.\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        if (a->argc != 4)
                return CLI_SHOWUSAGE; 
        if (strncasecmp(a->argv[3], "default", strlen(a->argv[3])) == 0)
                mtuv = MAX_TRUNK_MTU;
        else
                mtuv = atoi(a->argv[3]);

        if (mtuv == 0) {
                ast_cli(a->fd, "Trunk MTU control disabled (mtu was %d)\n", global_max_trunk_mtu); 
                global_max_trunk_mtu = 0; 
                return CLI_SUCCESS; 
        }
        if (mtuv < 172 || mtuv > 4000) {
                ast_cli(a->fd, "Trunk MTU must be between 172 and 4000\n"); 
                return CLI_SHOWUSAGE; 
        }
        ast_cli(a->fd, "Trunk MTU changed from %d to %d\n", global_max_trunk_mtu, mtuv); 
        global_max_trunk_mtu = mtuv; 
        return CLI_SUCCESS;
}

static char *handle_cli_iax2_show_cache(struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
{
        struct iax2_dpcache *dp = NULL;
        char tmp[1024], *pc = NULL;
        int s, x, y;
        struct timeval tv = ast_tvnow();

        switch (cmd) {
        case CLI_INIT:
                e->command = "iax2 show cache";
                e->usage =
                        "Usage: iax2 show cache\n"
                        "       Display currently cached IAX Dialplan results.\n";
                return NULL;
        case CLI_GENERATE:
                return NULL;
        }

        AST_LIST_LOCK(&dpcache);

        ast_cli(a->fd, "%-20.20s %-12.12s %-9.9s %-8.8s %s\n", "Peer/Context", "Exten", "Exp.", "Wait.", "Flags");

        AST_LIST_TRAVERSE(&dpcache, dp, cache_list) {
                s = dp->expiry.tv_sec - tv.tv_sec;
                tmp[0] = '\0';
                if (dp->flags & CACHE_FLAG_EXISTS)
                        strncat(tmp, "EXISTS|", sizeof(tmp) - strlen(tmp) - 1);
                if (dp->flags & CACHE_FLAG_NONEXISTENT)
                        strncat(tmp, "NONEXISTENT|", sizeof(tmp) - strlen(tmp) - 1);
                if (dp->flags & CACHE_FLAG_CANEXIST)
                        strncat(tmp, "CANEXIST|", sizeof(tmp) - strlen(tmp) - 1);
                if (dp->flags & CACHE_FLAG_PENDING)
                        strncat(tmp, "PENDING|", sizeof(tmp) - strlen(tmp) - 1);
                if (dp->flags & CACHE_FLAG_TIMEOUT)
                        strncat(tmp, "TIMEOUT|", sizeof(tmp) - strlen(tmp) - 1);
                if (dp->flags & CACHE_FLAG_TRANSMITTED)
                        strncat(tmp, "TRANSMITTED|", sizeof(tmp) - strlen(tmp) - 1);
                if (dp->flags & CACHE_FLAG_MATCHMORE)
                        strncat(tmp, "MATCHMORE|", sizeof(tmp) - strlen(tmp) - 1);
                if (dp->flags & CACHE_FLAG_UNKNOWN)
                        strncat(tmp, "UNKNOWN|", sizeof(tmp) - strlen(tmp) - 1);
                /* Trim trailing pipe */
                if (!ast_strlen_zero(tmp))
                        tmp[strlen(tmp) - 1] = '\0';
                else
                        ast_copy_string(tmp, "(none)", sizeof(tmp));
                y = 0;
                pc = strchr(dp->peercontext, '@');
                if (!pc)
                        pc = dp->peercontext;
                else
                        pc++;
                for (x = 0; x < sizeof(dp->waiters) / sizeof(dp->waiters[0]); x++)
                        if (dp->waiters[x] > -1)
                                y++;
                if (s > 0)
                        ast_cli(a->fd, "%-20.20s %-12.12s %-9d %-8d %s\n", pc, dp->exten, s, y, tmp);
                else
                        ast_cli(a->fd, "%-20.20s %-12.12s %-9.9s %-8d %s\n", pc, dp->exten, "(expired)", y, tmp);
        }

        AST_LIST_LOCK(&dpcache);

        return CLI_SUCCESS;
}

static unsigned int calc_rxstamp(struct chan_iax2_pvt *p, unsigned int offset);

static void unwrap_timestamp(struct iax_frame *fr)
{
        int x;

        if ( (fr->ts & 0xFFFF0000) == (iaxs[fr->callno]->last & 0xFFFF0000) ) {
                x = fr->ts - iaxs[fr->callno]->last;
                if (x < -50000) {
                        /* Sudden big jump backwards in timestamp:
                           What likely happened here is that miniframe timestamp has circled but we haven't
                           gotten the update from the main packet.  We'll just pretend that we did, and
                           update the timestamp appropriately. */
                        fr->ts = ( (iaxs[fr->callno]->last & 0xFFFF0000) + 0x10000) | (fr->ts & 0xFFFF);
                        if (iaxdebug)
                                ast_debug(1, "schedule_delivery: pushed forward timestamp\n");
                }
                if (x > 50000) {
                        /* Sudden apparent big jump forwards in timestamp:
                           What's likely happened is this is an old miniframe belonging to the previous
                           top-16-bit timestamp that has turned up out of order.
                           Adjust the timestamp appropriately. */
                        fr->ts = ( (iaxs[fr->callno]->last & 0xFFFF0000) - 0x10000) | (fr->ts & 0xFFFF);
                        if (iaxdebug)
                                ast_debug(1, "schedule_delivery: pushed back timestamp\n");
                }
        }
}

static int get_from_jb(const void *p);

static void update_jbsched(struct chan_iax2_pvt *pvt)
{
        int when;
        
        when = ast_tvdiff_ms(ast_tvnow(), pvt->rxcore);
        
        when = jb_next(pvt->jb) - when;
        
        if(when <= 0) {
                /* XXX should really just empty until when > 0.. */
                when = 1;
        }
        
        pvt->jbid = iax2_sched_replace(pvt->jbid, sched, when, get_from_jb, 
                CALLNO_TO_PTR(pvt->callno));
}

static void __get_from_jb(const void *p) 
{
        int callno = PTR_TO_CALLNO(p);
        struct chan_iax2_pvt *pvt = NULL;
        struct iax_frame *fr;
        jb_frame frame;
        int ret;
        long now;
        long next;
        struct timeval tv = ast_tvnow();
        
        /* Make sure we have a valid private structure before going on */
        ast_mutex_lock(&iaxsl[callno]);
        pvt = iaxs[callno];
        if (!pvt) {
                /* No go! */
                ast_mutex_unlock(&iaxsl[callno]);
                return;
        }

        pvt->jbid = -1;
        
        /* round up a millisecond since ast_sched_runq does; */
        /* prevents us from spinning while waiting for our now */
        /* to catch up with runq's now */
        tv.tv_usec += 1000;
        
        now = ast_tvdiff_ms(tv, pvt->rxcore);
        
        if(now >= (next = jb_next(pvt->jb))) {
                ret = jb_get(pvt->jb,&frame,now,ast_codec_interp_len(pvt->voiceformat));
                switch(ret) {
                case JB_OK:
                        fr = frame.data;
                        __do_deliver(fr);
                        /* __do_deliver() can cause the call to disappear */
                        pvt = iaxs[callno];
                        break;
                case JB_INTERP:
                {
                        struct ast_frame af = { 0, };
                        
                        /* create an interpolation frame */
                        af.frametype = AST_FRAME_VOICE;
                        af.subclass = pvt->voiceformat;
                        af.samples  = frame.ms * 8;
                        af.src  = "IAX2 JB interpolation";
                        af.delivery = ast_tvadd(pvt->rxcore, ast_samp2tv(next, 1000));
                        af.offset = AST_FRIENDLY_OFFSET;
                        
                        /* queue the frame:  For consistency, we would call __do_deliver here, but __do_deliver wants an iax_frame,
                         * which we'd need to malloc, and then it would free it.  That seems like a drag */
                        if (!ast_test_flag(iaxs[callno], IAX_ALREADYGONE)) {
                                iax2_queue_frame(callno, &af);
                                /* iax2_queue_frame() could cause the call to disappear */
                                pvt = iaxs[callno];
                        }
                }
                        break;
                case JB_DROP:
                        iax2_frame_free(frame.data);
                        break;
                case JB_NOFRAME:
                case JB_EMPTY:
                        /* do nothing */
                        break;
                default:
                        /* shouldn't happen */
                        break;
                }
        }
        if (pvt)
                update_jbsched(pvt);
        ast_mutex_unlock(&iaxsl[callno]);
}

static int get_from_jb(const void *data)
{
#ifdef SCHED_MULTITHREADED
        if (schedule_action(__get_from_jb, data))
#endif          
                __get_from_jb(data);
        return 0;
}

/*!
 * \note This function assumes fr->callno is locked
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 */
static int schedule_delivery(struct iax_frame *fr, int updatehistory, int fromtrunk, unsigned int *tsout)
{
        int type, len;
        int ret;
        int needfree = 0;

        /* Attempt to recover wrapped timestamps */
        unwrap_timestamp(fr);

        /* delivery time is sender's sent timestamp converted back into absolute time according to our clock */
        if ( !fromtrunk && !ast_tvzero(iaxs[fr->callno]->rxcore))
                fr->af.delivery = ast_tvadd(iaxs[fr->callno]->rxcore, ast_samp2tv(fr->ts, 1000));
        else {
#if 0
                ast_debug(1, "schedule_delivery: set delivery to 0 as we don't have an rxcore yet, or frame is from trunk.\n");
#endif
                fr->af.delivery = ast_tv(0,0);
        }

        type = JB_TYPE_CONTROL;
        len = 0;

        if(fr->af.frametype == AST_FRAME_VOICE) {
                type = JB_TYPE_VOICE;
                len = ast_codec_get_samples(&fr->af) / 8;
        } else if(fr->af.frametype == AST_FRAME_CNG) {
                type = JB_TYPE_SILENCE;
        }

        if ( (!ast_test_flag(iaxs[fr->callno], IAX_USEJITTERBUF)) ) {
                if (tsout)
                        *tsout = fr->ts;
                __do_deliver(fr);
                return -1;
        }

        /* if the user hasn't requested we force the use of the jitterbuffer, and we're bridged to
         * a channel that can accept jitter, then flush and suspend the jb, and send this frame straight through */
        if( (!ast_test_flag(iaxs[fr->callno], IAX_FORCEJITTERBUF)) &&
            iaxs[fr->callno]->owner && ast_bridged_channel(iaxs[fr->callno]->owner) &&
            (ast_bridged_channel(iaxs[fr->callno]->owner)->tech->properties & AST_CHAN_TP_WANTSJITTER)) {
                jb_frame frame;

                /* deliver any frames in the jb */
                while (jb_getall(iaxs[fr->callno]->jb, &frame) == JB_OK) {
                        __do_deliver(frame.data);
                        /* __do_deliver() can make the call disappear */
                        if (!iaxs[fr->callno])
                                return -1;
                }

                jb_reset(iaxs[fr->callno]->jb);

                if (iaxs[fr->callno]->jbid > -1)
                        ast_sched_del(sched, iaxs[fr->callno]->jbid);

                iaxs[fr->callno]->jbid = -1;

                /* deliver this frame now */
                if (tsout)
                        *tsout = fr->ts;
                __do_deliver(fr);
                return -1;
        }

        /* insert into jitterbuffer */
        /* TODO: Perhaps we could act immediately if it's not droppable and late */
        ret = jb_put(iaxs[fr->callno]->jb, fr, type, len, fr->ts,
                        calc_rxstamp(iaxs[fr->callno],fr->ts));
        if (ret == JB_DROP) {
                needfree++;
        } else if (ret == JB_SCHED) {
                update_jbsched(iaxs[fr->callno]);
        }
        if (tsout)
                *tsout = fr->ts;
        if (needfree) {
                /* Free our iax frame */
                iax2_frame_free(fr);
                return -1;
        }
        return 0;
}

static int iax2_transmit(struct iax_frame *fr)
{
        /* Lock the queue and place this packet at the end */
        /* By setting this to 0, the network thread will send it for us, and
           queue retransmission if necessary */
        fr->sentyet = 0;
        AST_LIST_LOCK(&frame_queue);
        AST_LIST_INSERT_TAIL(&frame_queue, fr, list);
        AST_LIST_UNLOCK(&frame_queue);
        /* Wake up the network and scheduler thread */
        if (netthreadid != AST_PTHREADT_NULL)
                pthread_kill(netthreadid, SIGURG);
        signal_condition(&sched_lock, &sched_cond);
        return 0;
}



static int iax2_digit_begin(struct ast_channel *c, char digit)
{
        return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_DTMF_BEGIN, digit, 0, NULL, 0, -1);
}

static int iax2_digit_end(struct ast_channel *c, char digit, unsigned int duration)
{
        return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_DTMF_END, digit, 0, NULL, 0, -1);
}

static int iax2_sendtext(struct ast_channel *c, const char *text)
{
        
        return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_TEXT,
                0, 0, (unsigned char *)text, strlen(text) + 1, -1);
}

static int iax2_sendimage(struct ast_channel *c, struct ast_frame *img)
{
        return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_IMAGE, img->subclass, 0, img->data, img->datalen, -1);
}

static int iax2_sendhtml(struct ast_channel *c, int subclass, const char *data, int datalen)
{
        return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_HTML, subclass, 0, (unsigned char *)data, datalen, -1);
}

static int iax2_fixup(struct ast_channel *oldchannel, struct ast_channel *newchan)
{
        unsigned short callno = PTR_TO_CALLNO(newchan->tech_pvt);
        ast_mutex_lock(&iaxsl[callno]);
        if (iaxs[callno])
                iaxs[callno]->owner = newchan;
        else
                ast_log(LOG_WARNING, "Uh, this isn't a good sign...\n");
        ast_mutex_unlock(&iaxsl[callno]);
        return 0;
}

/*!
 * \note This function calls reg_source_db -> iax2_poke_peer -> find_callno,
 *       so do not call this with a pvt lock held.
 */
static struct iax2_peer *realtime_peer(const char *peername, struct sockaddr_in *sin)
{
        struct ast_variable *var;
        struct ast_variable *tmp;
        struct iax2_peer *peer=NULL;
        time_t regseconds = 0, nowtime;
        int dynamic=0;

        if (peername)
                var = ast_load_realtime("iaxpeers", "name", peername, NULL);
        else {
                char porta[25];
                sprintf(porta, "%d", ntohs(sin->sin_port));
                var = ast_load_realtime("iaxpeers", "ipaddr", ast_inet_ntoa(sin->sin_addr), "port", porta, NULL);
                if (var) {
                        /* We'll need the peer name in order to build the structure! */
                        for (tmp = var; tmp; tmp = tmp->next) {
                                if (!strcasecmp(tmp->name, "name"))
                                        peername = tmp->value;
                        }
                }
        }
        if (!var)
                return NULL;

        peer = build_peer(peername, var, NULL, ast_test_flag((&globalflags), IAX_RTCACHEFRIENDS) ? 0 : 1);
        
        if (!peer) {
                ast_variables_destroy(var);
                return NULL;
        }

        for (tmp = var; tmp; tmp = tmp->next) {
                /* Make sure it's not a user only... */
                if (!strcasecmp(tmp->name, "type")) {
                        if (strcasecmp(tmp->value, "friend") &&
                            strcasecmp(tmp->value, "peer")) {
                                /* Whoops, we weren't supposed to exist! */
                                peer = peer_unref(peer);
                                break;
                        } 
                } else if (!strcasecmp(tmp->name, "regseconds")) {
                        ast_get_time_t(tmp->value, &regseconds, 0, NULL);
                } else if (!strcasecmp(tmp->name, "ipaddr")) {
                        inet_aton(tmp->value, &(peer->addr.sin_addr));
                } else if (!strcasecmp(tmp->name, "port")) {
                        peer->addr.sin_port = htons(atoi(tmp->value));
                } else if (!strcasecmp(tmp->name, "host")) {
                        if (!strcasecmp(tmp->value, "dynamic"))
                                dynamic = 1;
                }
        }

        ast_variables_destroy(var);

        if (!peer)
                return NULL;

        if (ast_test_flag((&globalflags), IAX_RTCACHEFRIENDS)) {
                ast_copy_flags(peer, &globalflags, IAX_RTAUTOCLEAR|IAX_RTCACHEFRIENDS);
                if (ast_test_flag(peer, IAX_RTAUTOCLEAR)) {
                        if (peer->expire > -1) {
                                if (!ast_sched_del(sched, peer->expire)) {
                                        peer->expire = -1;
                                        peer_unref(peer);
                                }
                        }
                        peer->expire = iax2_sched_add(sched, (global_rtautoclear) * 1000, expire_registry, peer_ref(peer));
                        if (peer->expire == -1)
                                peer_unref(peer);
                }
                ao2_link(peers, peer);
                if (ast_test_flag(peer, IAX_DYNAMIC))
                        reg_source_db(peer);
        } else {
                ast_set_flag(peer, IAX_TEMPONLY);       
        }

        if (!ast_test_flag(&globalflags, IAX_RTIGNOREREGEXPIRE) && dynamic) {
                time(&nowtime);
                if ((nowtime - regseconds) > IAX_DEFAULT_REG_EXPIRE) {
                        memset(&peer->addr, 0, sizeof(peer->addr));
                        realtime_update_peer(peer->name, &peer->addr, 0);
                        ast_debug(1, "realtime_peer: Bah, '%s' is expired (%d/%d/%d)!\n",
                                peername, (int)(nowtime - regseconds), (int)regseconds, (int)nowtime);
                }
                else {
                        ast_debug(1, "realtime_peer: Registration for '%s' still active (%d/%d/%d)!\n",
                                peername, (int)(nowtime - regseconds), (int)regseconds, (int)nowtime);
                }
        }

        return peer;
}

static struct iax2_user *realtime_user(const char *username)
{
        struct ast_variable *var;
        struct ast_variable *tmp;
        struct iax2_user *user=NULL;

        var = ast_load_realtime("iaxusers", "name", username, NULL);
        if (!var)
                return NULL;

        tmp = var;
        while(tmp) {
                /* Make sure it's not a peer only... */
                if (!strcasecmp(tmp->name, "type")) {
                        if (strcasecmp(tmp->value, "friend") &&
                            strcasecmp(tmp->value, "user")) {
                                return NULL;
                        } 
                }
                tmp = tmp->next;
        }

        user = build_user(username, var, NULL, !ast_test_flag((&globalflags), IAX_RTCACHEFRIENDS));

        ast_variables_destroy(var);

        if (!user)
                return NULL;

        if (ast_test_flag((&globalflags), IAX_RTCACHEFRIENDS)) {
                ast_set_flag(user, IAX_RTCACHEFRIENDS);
                ao2_link(users, user);
        } else {
                ast_set_flag(user, IAX_TEMPONLY);       
        }

        return user;
}

static void realtime_update_peer(const char *peername, struct sockaddr_in *sin, time_t regtime)
{
        char port[10];
        char regseconds[20];
        
        snprintf(regseconds, sizeof(regseconds), "%d", (int)regtime);
        snprintf(port, sizeof(port), "%d", ntohs(sin->sin_port));
        ast_update_realtime("iaxpeers", "name", peername, 
                "ipaddr", ast_inet_ntoa(sin->sin_addr), "port", port, 
                "regseconds", regseconds, NULL);
}

struct create_addr_info {
        int capability;
        unsigned int flags;
        int maxtime;
        int encmethods;
        int found;
        int sockfd;
        int adsi;
        char username[80];
        char secret[80];
        char outkey[80];
        char timezone[80];
        char prefs[32];
        char context[AST_MAX_CONTEXT];
        char peercontext[AST_MAX_CONTEXT];
        char mohinterpret[MAX_MUSICCLASS];
        char mohsuggest[MAX_MUSICCLASS];
};

static int create_addr(const char *peername, struct sockaddr_in *sin, struct create_addr_info *cai)
{
        struct iax2_peer *peer;
        int res = -1;

        ast_clear_flag(cai, IAX_SENDANI | IAX_TRUNK);
        cai->sockfd = defaultsockfd;
        cai->maxtime = 0;
        sin->sin_family = AF_INET;

        if (!(peer = find_peer(peername, 1))) {
                cai->found = 0;
                if (ast_get_ip_or_srv(sin, peername, srvlookup ? "_iax._udp" : NULL)) {
                        ast_log(LOG_WARNING, "No such host: %s\n", peername);
                        return -1;
                }
                sin->sin_port = htons(IAX_DEFAULT_PORTNO);
                /* use global iax prefs for unknown peer/user */
                ast_codec_pref_convert(&prefs, cai->prefs, sizeof(cai->prefs), 1);
                return 0;
        }

        cai->found = 1;
        
        /* if the peer has no address (current or default), return failure */
        if (!(peer->addr.sin_addr.s_addr || peer->defaddr.sin_addr.s_addr))
                goto return_unref;

        /* if the peer is being monitored and is currently unreachable, return failure */
        if (peer->maxms && ((peer->lastms > peer->maxms) || (peer->lastms < 0)))
                goto return_unref;

        ast_copy_flags(cai, peer, IAX_SENDANI | IAX_TRUNK | IAX_NOTRANSFER | IAX_TRANSFERMEDIA | IAX_USEJITTERBUF | IAX_FORCEJITTERBUF);
        cai->maxtime = peer->maxms;
        cai->capability = peer->capability;
        cai->encmethods = peer->encmethods;
        cai->sockfd = peer->sockfd;
        cai->adsi = peer->adsi;
        ast_codec_pref_convert(&peer->prefs, cai->prefs, sizeof(cai->prefs), 1);
        ast_copy_string(cai->context, peer->context, sizeof(cai->context));
        ast_copy_string(cai->peercontext, peer->peercontext, sizeof(cai->peercontext));
        ast_copy_string(cai->username, peer->username, sizeof(cai->username));
        ast_copy_string(cai->timezone, peer->zonetag, sizeof(cai->timezone));
        ast_copy_string(cai->outkey, peer->outkey, sizeof(cai->outkey));
        ast_copy_string(cai->mohinterpret, peer->mohinterpret, sizeof(cai->mohinterpret));
        ast_copy_string(cai->mohsuggest, peer->mohsuggest, sizeof(cai->mohsuggest));
        if (ast_strlen_zero(peer->dbsecret)) {
                ast_copy_string(cai->secret, peer->secret, sizeof(cai->secret));
        } else {
                char *family;
                char *key = NULL;

                family = ast_strdupa(peer->dbsecret);
                key = strchr(family, '/');
                if (key)
                        *key++ = '\0';
                if (!key || ast_db_get(family, key, cai->secret, sizeof(cai->secret))) {
                        ast_log(LOG_WARNING, "Unable to retrieve database password for family/key '%s'!\n", peer->dbsecret);
                        goto return_unref;
                }
        }

        if (peer->addr.sin_addr.s_addr) {
                sin->sin_addr = peer->addr.sin_addr;
                sin->sin_port = peer->addr.sin_port;
        } else {
                sin->sin_addr = peer->defaddr.sin_addr;
                sin->sin_port = peer->defaddr.sin_port;
        }

        res = 0;

return_unref:
        peer_unref(peer);

        return res;
}

static void __auto_congest(const void *nothing)
{
        int callno = PTR_TO_CALLNO(nothing);
        struct ast_frame f = { AST_FRAME_CONTROL, AST_CONTROL_CONGESTION };
        ast_mutex_lock(&iaxsl[callno]);
        if (iaxs[callno]) {
                iaxs[callno]->initid = -1;
                iax2_queue_frame(callno, &f);
                ast_log(LOG_NOTICE, "Auto-congesting call due to slow response\n");
        }
        ast_mutex_unlock(&iaxsl[callno]);
}

static int auto_congest(const void *data)
{
#ifdef SCHED_MULTITHREADED
        if (schedule_action(__auto_congest, data))
#endif          
                __auto_congest(data);
        return 0;
}

static unsigned int iax2_datetime(const char *tz)
{
        struct timeval t = ast_tvnow();
        struct ast_tm tm;
        unsigned int tmp;
        ast_localtime(&t, &tm, ast_strlen_zero(tz) ? NULL : tz);
        tmp  = (tm.tm_sec >> 1) & 0x1f;                 /* 5 bits of seconds */
        tmp |= (tm.tm_min & 0x3f) << 5;                 /* 6 bits of minutes */
        tmp |= (tm.tm_hour & 0x1f) << 11;               /* 5 bits of hours */
        tmp |= (tm.tm_mday & 0x1f) << 16;               /* 5 bits of day of month */
        tmp |= ((tm.tm_mon + 1) & 0xf) << 21;           /* 4 bits of month */
        tmp |= ((tm.tm_year - 100) & 0x7f) << 25;       /* 7 bits of year */
        return tmp;
}

struct parsed_dial_string {
        char *username;
        char *password;
        char *key;
        char *peer;
        char *port;
        char *exten;
        char *context;
        char *options;
};

/*!
 * \brief Parses an IAX dial string into its component parts.
 * \param data the string to be parsed
 * \param pds pointer to a \c struct \c parsed_dial_string to be filled in
 * \return nothing
 *
 * This function parses the string and fills the structure
 * with pointers to its component parts. The input string
 * will be modified.
 *
 * \note This function supports both plaintext passwords and RSA
 * key names; if the password string is formatted as '[keyname]',
 * then the keyname will be placed into the key field, and the
 * password field will be set to NULL.
 *
 * \note The dial string format is:
 *       [username[:password]@]peer[:port][/exten[@@context]][/options]
 */
static void parse_dial_string(char *data, struct parsed_dial_string *pds)
{
        if (ast_strlen_zero(data))
                return;

        pds->peer = strsep(&data, "/");
        pds->exten = strsep(&data, "/");
        pds->options = data;

        if (pds->exten) {
                data = pds->exten;
                pds->exten = strsep(&data, "@");
                pds->context = data;
        }

        if (strchr(pds->peer, '@')) {
                data = pds->peer;
                pds->username = strsep(&data, "@");
                pds->peer = data;
        }

        if (pds->username) {
                data = pds->username;
                pds->username = strsep(&data, ":");
                pds->password = data;
        }

        data = pds->peer;
        pds->peer = strsep(&data, ":");
        pds->port = data;

        /* check for a key name wrapped in [] in the secret position, if found,
           move it to the key field instead
        */
        if (pds->password && (pds->password[0] == '[')) {
                pds->key = ast_strip_quoted(pds->password, "[", "]");
                pds->password = NULL;
        }
}

static int iax2_call(struct ast_channel *c, char *dest, int timeout)
{
        struct sockaddr_in sin;
        char *l=NULL, *n=NULL, *tmpstr;
        struct iax_ie_data ied;
        char *defaultrdest = "s";
        unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
        struct parsed_dial_string pds;
        struct create_addr_info cai;
        struct ast_var_t *var;
        struct ast_datastore *variablestore = ast_channel_datastore_find(c, &iax2_variable_datastore_info, NULL);
        const char* osp_token_ptr;
        unsigned int osp_token_length;
        unsigned char osp_block_index;
        unsigned int osp_block_length;
        unsigned char osp_buffer[256];

        if ((c->_state != AST_STATE_DOWN) && (c->_state != AST_STATE_RESERVED)) {
                ast_log(LOG_WARNING, "Channel is already in use (%s)?\n", c->name);
                return -1;
        }

        memset(&cai, 0, sizeof(cai));
        cai.encmethods = iax2_encryption;

        memset(&pds, 0, sizeof(pds));
        tmpstr = ast_strdupa(dest);
        parse_dial_string(tmpstr, &pds);

        if (!pds.exten)
                pds.exten = defaultrdest;

        if (create_addr(pds.peer, &sin, &cai)) {
                ast_log(LOG_WARNING, "No address associated with '%s'\n", pds.peer);
                return -1;
        }

        if (!pds.username && !ast_strlen_zero(cai.username))
                pds.username = cai.username;
        if (!pds.password && !ast_strlen_zero(cai.secret))
                pds.password = cai.secret;
        if (!pds.key && !ast_strlen_zero(cai.outkey))
                pds.key = cai.outkey;
        if (!pds.context && !ast_strlen_zero(cai.peercontext))
                pds.context = cai.peercontext;

        /* Keep track of the context for outgoing calls too */
        ast_copy_string(c->context, cai.context, sizeof(c->context));

        if (pds.port)
                sin.sin_port = htons(atoi(pds.port));

        l = c->cid.cid_num;
        n = c->cid.cid_name;

        /* Now build request */ 
        memset(&ied, 0, sizeof(ied));

        /* On new call, first IE MUST be IAX version of caller */
        iax_ie_append_short(&ied, IAX_IE_VERSION, IAX_PROTO_VERSION);
        iax_ie_append_str(&ied, IAX_IE_CALLED_NUMBER, pds.exten);
        if (pds.options && strchr(pds.options, 'a')) {
                /* Request auto answer */
                iax_ie_append(&ied, IAX_IE_AUTOANSWER);
        }

        iax_ie_append_str(&ied, IAX_IE_CODEC_PREFS, cai.prefs);

        if (l) {
                iax_ie_append_str(&ied, IAX_IE_CALLING_NUMBER, l);
                iax_ie_append_byte(&ied, IAX_IE_CALLINGPRES, c->cid.cid_pres);
        } else {
                if (n)
                        iax_ie_append_byte(&ied, IAX_IE_CALLINGPRES, c->cid.cid_pres);
                else
                        iax_ie_append_byte(&ied, IAX_IE_CALLINGPRES, AST_PRES_NUMBER_NOT_AVAILABLE);
        }

        iax_ie_append_byte(&ied, IAX_IE_CALLINGTON, c->cid.cid_ton);
        iax_ie_append_short(&ied, IAX_IE_CALLINGTNS, c->cid.cid_tns);

        if (n)
                iax_ie_append_str(&ied, IAX_IE_CALLING_NAME, n);
        if (ast_test_flag(iaxs[callno], IAX_SENDANI) && c->cid.cid_ani)
                iax_ie_append_str(&ied, IAX_IE_CALLING_ANI, c->cid.cid_ani);

        if (!ast_strlen_zero(c->language))
                iax_ie_append_str(&ied, IAX_IE_LANGUAGE, c->language);
        if (!ast_strlen_zero(c->cid.cid_dnid))
                iax_ie_append_str(&ied, IAX_IE_DNID, c->cid.cid_dnid);
        if (!ast_strlen_zero(c->cid.cid_rdnis))
                iax_ie_append_str(&ied, IAX_IE_RDNIS, c->cid.cid_rdnis);

        if (pds.context)
                iax_ie_append_str(&ied, IAX_IE_CALLED_CONTEXT, pds.context);

        if (pds.username)
                iax_ie_append_str(&ied, IAX_IE_USERNAME, pds.username);

        if (cai.encmethods)
                iax_ie_append_short(&ied, IAX_IE_ENCRYPTION, cai.encmethods);

        ast_mutex_lock(&iaxsl[callno]);

        if (!ast_strlen_zero(c->context))
                ast_string_field_set(iaxs[callno], context, c->context);

        if (pds.username)
                ast_string_field_set(iaxs[callno], username, pds.username);

        iaxs[callno]->encmethods = cai.encmethods;

        iaxs[callno]->adsi = cai.adsi;
        
        ast_string_field_set(iaxs[callno], mohinterpret, cai.mohinterpret);
        ast_string_field_set(iaxs[callno], mohsuggest, cai.mohsuggest);

        if (pds.key)
                ast_string_field_set(iaxs[callno], outkey, pds.key);
        if (pds.password)
                ast_string_field_set(iaxs[callno], secret, pds.password);

        iax_ie_append_int(&ied, IAX_IE_FORMAT, c->nativeformats);
        iax_ie_append_int(&ied, IAX_IE_CAPABILITY, iaxs[callno]->capability);
        iax_ie_append_short(&ied, IAX_IE_ADSICPE, c->adsicpe);
        iax_ie_append_int(&ied, IAX_IE_DATETIME, iax2_datetime(cai.timezone));

        if (iaxs[callno]->maxtime) {
                /* Initialize pingtime and auto-congest time */
                iaxs[callno]->pingtime = iaxs[callno]->maxtime / 2;
                iaxs[callno]->initid = iax2_sched_add(sched, iaxs[callno]->maxtime * 2, auto_congest, CALLNO_TO_PTR(callno));
        } else if (autokill) {
                iaxs[callno]->pingtime = autokill / 2;
                iaxs[callno]->initid = iax2_sched_add(sched, autokill * 2, auto_congest, CALLNO_TO_PTR(callno));
        }

        /* Check if there is an OSP token set by IAXCHANINFO function */
        osp_token_ptr = iaxs[callno]->osptoken;
        if (!ast_strlen_zero(osp_token_ptr)) {
                if ((osp_token_length = strlen(osp_token_ptr)) <= IAX_MAX_OSPTOKEN_SIZE) {
                        osp_block_index = 0;
                        while (osp_token_length > 0) {
                                osp_block_length = IAX_MAX_OSPBLOCK_SIZE < osp_token_length ? IAX_MAX_OSPBLOCK_SIZE : osp_token_length;
                                osp_buffer[0] = osp_block_index;
                                memcpy(osp_buffer + 1, osp_token_ptr, osp_block_length);
                                iax_ie_append_raw(&ied, IAX_IE_OSPTOKEN, osp_buffer, osp_block_length + 1);
                                osp_block_index++;
                                osp_token_ptr += osp_block_length;
                                osp_token_length -= osp_block_length;
                        } 
                } else
                        ast_log(LOG_WARNING, "OSP token is too long\n");
        } else if (iaxdebug)
                ast_debug(1, "OSP token is undefined\n");

        /* send the command using the appropriate socket for this peer */
        iaxs[callno]->sockfd = cai.sockfd;

        /* Add remote vars */
        if (variablestore) {
                AST_LIST_HEAD(, ast_var_t) *variablelist = variablestore->data;
                AST_LIST_LOCK(variablelist);
                AST_LIST_TRAVERSE(variablelist, var, entries) {
                        char tmp[256];
                        int i;
                        /* Automatically divide the value up into sized chunks */
                        for (i = 0; i < strlen(ast_var_value(var)); i += 255 - (strlen(ast_var_name(var)) + 1)) {
                                snprintf(tmp, sizeof(tmp), "%s=%s", ast_var_name(var), ast_var_value(var) + i);
                                iax_ie_append_str(&ied, IAX_IE_VARIABLE, tmp);
                        }
                }
                AST_LIST_UNLOCK(variablelist);
        }

        /* Transmit the string in a "NEW" request */
        send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_NEW, 0, ied.buf, ied.pos, -1);

        ast_mutex_unlock(&iaxsl[callno]);
        ast_setstate(c, AST_STATE_RINGING);

        return 0;
}

static int iax2_hangup(struct ast_channel *c) 
{
        unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
        int alreadygone;
        struct iax_ie_data ied;
        memset(&ied, 0, sizeof(ied));
        ast_mutex_lock(&iaxsl[callno]);
        if (callno && iaxs[callno]) {
                ast_debug(1, "We're hanging up %s now...\n", c->name);
                alreadygone = ast_test_flag(iaxs[callno], IAX_ALREADYGONE);
                /* Send the hangup unless we have had a transmission error or are already gone */
                iax_ie_append_byte(&ied, IAX_IE_CAUSECODE, (unsigned char)c->hangupcause);
                if (!iaxs[callno]->error && !alreadygone) {
                        send_command_final(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_HANGUP, 0, ied.buf, ied.pos, -1);
                        if (!iaxs[callno]) {
                                ast_mutex_unlock(&iaxsl[callno]);
                                return 0;
                        }
                }
                /* Explicitly predestroy it */
                iax2_predestroy(callno);
                /* If we were already gone to begin with, destroy us now */
                if (alreadygone && iaxs[callno]) {
                        ast_debug(1, "Really destroying %s now...\n", c->name);
                        iax2_destroy(callno);
                }
        }
        ast_mutex_unlock(&iaxsl[callno]);
        ast_verb(3, "Hungup '%s'\n", c->name);
        return 0;
}

static int iax2_setoption(struct ast_channel *c, int option, void *data, int datalen)
{
        struct ast_option_header *h;
        int res;

        switch (option) {
        case AST_OPTION_TXGAIN:
        case AST_OPTION_RXGAIN:
                /* these two cannot be sent, because they require a result */
                errno = ENOSYS;
                return -1;
        default:
                if (!(h = ast_malloc(datalen + sizeof(*h))))
                        return -1;

                h->flag = AST_OPTION_FLAG_REQUEST;
                h->option = htons(option);
                memcpy(h->data, data, datalen);
                res = send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_CONTROL,
                                          AST_CONTROL_OPTION, 0, (unsigned char *) h,
                                          datalen + sizeof(*h), -1);
                ast_free(h);
                return res;
        }
}

static struct ast_frame *iax2_read(struct ast_channel *c) 
{
        ast_log(LOG_NOTICE, "I should never be called!\n");
        return &ast_null_frame;
}

static int iax2_start_transfer(unsigned short callno0, unsigned short callno1, int mediaonly)
{
        int res;
        struct iax_ie_data ied0;
        struct iax_ie_data ied1;
        unsigned int transferid = (unsigned int)ast_random();
        memset(&ied0, 0, sizeof(ied0));
        iax_ie_append_addr(&ied0, IAX_IE_APPARENT_ADDR, &iaxs[callno1]->addr);
        iax_ie_append_short(&ied0, IAX_IE_CALLNO, iaxs[callno1]->peercallno);
        iax_ie_append_int(&ied0, IAX_IE_TRANSFERID, transferid);

        memset(&ied1, 0, sizeof(ied1));
        iax_ie_append_addr(&ied1, IAX_IE_APPARENT_ADDR, &iaxs[callno0]->addr);
        iax_ie_append_short(&ied1, IAX_IE_CALLNO, iaxs[callno0]->peercallno);
        iax_ie_append_int(&ied1, IAX_IE_TRANSFERID, transferid);
        
        res = send_command(iaxs[callno0], AST_FRAME_IAX, IAX_COMMAND_TXREQ, 0, ied0.buf, ied0.pos, -1);
        if (res)
                return -1;
        res = send_command(iaxs[callno1], AST_FRAME_IAX, IAX_COMMAND_TXREQ, 0, ied1.buf, ied1.pos, -1);
        if (res)
                return -1;
        iaxs[callno0]->transferring = mediaonly ? TRANSFER_MBEGIN : TRANSFER_BEGIN;
        iaxs[callno1]->transferring = mediaonly ? TRANSFER_MBEGIN : TRANSFER_BEGIN;
        return 0;
}

static void lock_both(unsigned short callno0, unsigned short callno1)
{
        ast_mutex_lock(&iaxsl[callno0]);
        while (ast_mutex_trylock(&iaxsl[callno1])) {
                ast_mutex_unlock(&iaxsl[callno0]);
                usleep(10);
                ast_mutex_lock(&iaxsl[callno0]);
        }
}

static void unlock_both(unsigned short callno0, unsigned short callno1)
{
        ast_mutex_unlock(&iaxsl[callno1]);
        ast_mutex_unlock(&iaxsl[callno0]);
}

static enum ast_bridge_result iax2_bridge(struct ast_channel *c0, struct ast_channel *c1, int flags, struct ast_frame **fo, struct ast_channel **rc, int timeoutms)
{
        struct ast_channel *cs[3];
        struct ast_channel *who, *other;
        int to = -1;
        int res = -1;
        int transferstarted=0;
        struct ast_frame *f;
        unsigned short callno0 = PTR_TO_CALLNO(c0->tech_pvt);
        unsigned short callno1 = PTR_TO_CALLNO(c1->tech_pvt);
        struct timeval waittimer = {0, 0}, tv;

        lock_both(callno0, callno1);
        if (!iaxs[callno0] || !iaxs[callno1]) {
                unlock_both(callno0, callno1);
                return AST_BRIDGE_FAILED;
        }
        /* Put them in native bridge mode */
        if (!flags & (AST_BRIDGE_DTMF_CHANNEL_0 | AST_BRIDGE_DTMF_CHANNEL_1)) {
                iaxs[callno0]->bridgecallno = callno1;
                iaxs[callno1]->bridgecallno = callno0;
        }
        unlock_both(callno0, callno1);

        /* If not, try to bridge until we can execute a transfer, if we can */
        cs[0] = c0;
        cs[1] = c1;
        for (/* ever */;;) {
                /* Check in case we got masqueraded into */
                if ((c0->tech != &iax2_tech) || (c1->tech != &iax2_tech)) {
                        ast_verb(3, "Can't masquerade, we're different...\n");
                        /* Remove from native mode */
                        if (c0->tech == &iax2_tech) {
                                ast_mutex_lock(&iaxsl[callno0]);
                                iaxs[callno0]->bridgecallno = 0;
                                ast_mutex_unlock(&iaxsl[callno0]);
                        }
                        if (c1->tech == &iax2_tech) {
                                ast_mutex_lock(&iaxsl[callno1]);
                                iaxs[callno1]->bridgecallno = 0;
                                ast_mutex_unlock(&iaxsl[callno1]);
                        }
                        return AST_BRIDGE_FAILED_NOWARN;
                }
                if (c0->nativeformats != c1->nativeformats) {
                                char buf0[255];
                                char buf1[255];
                                ast_getformatname_multiple(buf0, sizeof(buf0) -1, c0->nativeformats);
                                ast_getformatname_multiple(buf1, sizeof(buf1) -1, c1->nativeformats);
                        ast_verb(3, "Operating with different codecs %d[%s] %d[%s] , can't native bridge...\n", c0->nativeformats, buf0, c1->nativeformats, buf1);
                        /* Remove from native mode */
                        lock_both(callno0, callno1);
                        if (iaxs[callno0])
                                iaxs[callno0]->bridgecallno = 0;
                        if (iaxs[callno1])
                                iaxs[callno1]->bridgecallno = 0;
                        unlock_both(callno0, callno1);
                        return AST_BRIDGE_FAILED_NOWARN;
                }
                /* check if transfered and if we really want native bridging */
                if (!transferstarted && !ast_test_flag(iaxs[callno0], IAX_NOTRANSFER) && !ast_test_flag(iaxs[callno1], IAX_NOTRANSFER)) {
                        /* Try the transfer */
                        if (iax2_start_transfer(callno0, callno1, (flags & (AST_BRIDGE_DTMF_CHANNEL_0 | AST_BRIDGE_DTMF_CHANNEL_1)) ||
                                                        ast_test_flag(iaxs[callno0], IAX_TRANSFERMEDIA) | ast_test_flag(iaxs[callno1], IAX_TRANSFERMEDIA)))
                                ast_log(LOG_WARNING, "Unable to start the transfer\n");
                        transferstarted = 1;
                }
                if ((iaxs[callno0]->transferring == TRANSFER_RELEASED) && (iaxs[callno1]->transferring == TRANSFER_RELEASED)) {
                        /* Call has been transferred.  We're no longer involved */
                        tv = ast_tvnow();
                        if (ast_tvzero(waittimer)) {
                                waittimer = tv;
                        } else if (tv.tv_sec - waittimer.tv_sec > IAX_LINGER_TIMEOUT) {
                                c0->_softhangup |= AST_SOFTHANGUP_DEV;
                                c1->_softhangup |= AST_SOFTHANGUP_DEV;
                                *fo = NULL;
                                *rc = c0;
                                res = AST_BRIDGE_COMPLETE;
                                break;
                        }
                }
                to = 1000;
                who = ast_waitfor_n(cs, 2, &to);
                if (timeoutms > -1) {
                        timeoutms -= (1000 - to);
                        if (timeoutms < 0)
                                timeoutms = 0;
                }
                if (!who) {
                        if (!timeoutms) {
                                res = AST_BRIDGE_RETRY;
                                break;
                        }
                        if (ast_check_hangup(c0) || ast_check_hangup(c1)) {