Add an opt-in rollback message to the NG protocol. It lets a signalling
application undo an SDP offer that rtpengine has applied but the remote
endpoint subsequently rejects, without deleting the established call.
A client enables checkpointing with track-state on an offer. rtpengine
snapshots the affected dialogue before applying it; an answer commits the
exchange and discards the snapshot, and rollback restores and consumes it.
A dialogue holds at most one outstanding checkpoint, so offers arriving
before an exchange completes keep the existing snapshot and a rollback
returns to the last completed offer/answer.
A checkpoint holds a snapshot in the call record format the Redis encoder
already produces, so there is one definition of what a call's state looks
like and no second encoder to keep in step. Decoding a snapshot needs the
field readers the Redis restore path already had, so those are shared
rather than duplicated; json_restore_call() reads the same fields, in the
same order, with the same strict-return behaviour.
Applying a snapshot copies negotiated state back onto the live objects,
matched by unique id. The objects are never recreated, so local sockets
and ports survive. State a rejected offer introduced is removed as well as
overwritten: a field the encoder writes only when set is absent from a
snapshot taken before it existed, and that absence clears it.
ICE and DTLS reconverge rather than being rewound, since applying the
offer has already reset the agent and shut down the DTLS association.
Restoring the accepted credentials and candidates lets connectivity checks
rebuild ICE state, and restoring the fingerprint, TLS id and setup permits
a fresh handshake.
Outstanding checkpoints are stored in the Redis call record so they
survive takeover. Checkpoint data is auxiliary: one that cannot be read is
discarded in full while the call itself is restored without rollback
capability.
The preload shims no longer inherit the sanitizer options from CFLAGS.
They are loaded by the harness into the test scripts' own interpreter,
where a sanitizer runtime crashed the daemon tests on aarch64 during
library initialisation. Everything else in CFLAGS, the Debian hardening
flags included, still applies to them.
The Redis tests no longer assume the record length is four digits, and
read the record across as many reads as it takes.
Squashed:
commit ad49459152
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Fri Aug 28 13:33:17 2026 +0200
MT#55283 address review comments
Snapshots are now bencode, GLib macros are used throughout, and keys and
offsets are built with the existing helpers rather than by hand.
New tests cover the snapshot format and the state that exists only inside
a snapshot.
commit ff47944ad5
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Fri Aug 28 15:24:56 2026 +0200
MT#55283 scope snapshots to the dialogue
A snapshot now holds only the two monologues being checkpointed, and only
the entries the decoder reads: the socket and endpoint map pools, sinks,
subscriptions and aliases are left out.
The from-tag check in the rollback handler is dropped, since
call_get_monologue() is keyed on the tag.
commit 3bb19f2804
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Mon Aug 31 08:41:08 2026 +0200
MT#55283 give each monologue its own checkpoint
The checkpoint moves from a list on the call to a pointer on the monologue,
and its snapshot covers only that monologue. Checkpoints are stored in the
call record as checkpoint-<monologue id>; num_checkpoints and the offerer
and answerer ids are gone.
A monologue is shared between the branches of a forked call, so rolling one
branch back no longer reinstates what rolling another back had undone.
The call-level json dict is no longer written into snapshots, since nothing
reads it back.
commit 0c986a81e2
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Mon Aug 31 10:01:54 2026 +0200
MT#55283 do not report a rollback that did not happen
call_merge() renumbers every unique id, and a snapshot is keyed on them, so
a checkpoint taken before a merge no longer describes anything. It is
dropped with the ids it refers to, and rollback reports none outstanding
rather than a success that restored nothing.
Both sides of a dialogue are checkpointed together. A monologue is shared
between the branches of a forked call, so one side could already hold a
checkpoint while the other had never been tracked, leaving a rollback to
restore half a dialogue and still report success.
Each fix has a test that fails without it.
commit dfe7a72aff
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Mon Aug 31 10:41:50 2026 +0200
MT#55283 document that merging a call drops its checkpoints
Merging renumbers the state a snapshot refers to, so an outstanding
checkpoint is discarded and a later rollback reports none.
Closes#2159
Change-Id: Ie773e2cd4a39fc1c8f39fafe959784e269c0c80e
When accessing the array members via the pointer they
are still read-only, but the entries themselves are mutable.
So just make the elements constant pointers.
Also comply with the indentation style, and use tabs, not spaces.
Change-Id: I2165d0bf0b7b3ee4ad053c235dae4f60f36c1a43
In case the allocation of pcre for streams regex
fails, but not for the info, we never free
the latter one, because on returning an error,
just calling `die()`, hence no de-allocation
procedures are fulfilled.
Change-Id: I4a39b2c3043798c59fa6ec2fe0d70b1b1b27517f
Introduce a common NG commands table `ng_command_defs`
for all type of things: OP enum, name, escaped name,
short name and most important the handler.
This table operates on and returns a dedicated struct `ng_command_def`,
which has all the information required on the command (like
all type of things mentioned above) and may have either
single-parameter or double-parameter signature (for cases with
the `addr` requiring commands such as the offer command).
Also add unified signatures for X and XA handlers,
they will be used later accordingly. Most of those use single-parameter,
and those exceptional use the second one.
Also add dummy plug-functions for ping and block/unblock silence media.
The ping one doesn't have any particular handler, but because a new
structure of NG commands wants to see a real declaration of the func
handler, just give it. For the block/unblock silence media, there aren't
even handling of commands in the control NG, they are just dummy OPs,
so fulfill the actual NG commands structure, and give them dummy funcs.
Change-Id: I2064ddca1595079959a6c6843119556a8b6bf5d5
When iterating through medias, check whether there is something in;
- `->streams.head`
- `->selected_sfd`
- `->socket.local.address.family`
before to blidnly appeal to it.
If transform setup can ever produce incomplete media,
this might crash while building the response.
Change-Id: Ie75f20b111634ee3faa0af58c1eebfddbbcc843e
When iterating through the monologues medias while
looking for the media sink, filter those, which aren't audio.
Such a media type will likely have no audio subscriber,
and most probably will return with:
"There is no sink media capable of DTMF playback"
Change-Id: I86e64105e520f2a6f3ee9bbb0271830ae8d8cc69
For-cycle expects the `sink_ml` for setting the `call_media`
at the upper level of the cycle, but instead the `monologue`
is used, which is supposed to be used in the nested for-cycle.
Looks like a copy-paste typo. Major fix.
Change-Id: I225a51fde7fa8d10bac832ce5fc5444ee544e882
The loop is 1-based, but checks the outside
of bounds with `i <= 1`. If the length is 1 and
iterator is 1, this already fails.
Hence allow `i` to be 1, and also check it's not
beyound the media array length.
Change-Id: I9112fc88155fa53205c04ef35b00f6573b6816b3
If someone wants to stop the media for this particular monologue,
and it already has the MP allocated, which is marked for MoH,
then just ignore the stop media command.
This is to not let the play media/stop media procedures
overlap with potentially (previously) triggered MP via MoH.
Change-Id: If0bf4264b9c640b99f844efe5c2c8bc201a6ad16
To show that player has been created.
Additionally: add one more log line
to track that the play media is being requested.
Change-Id: I4e8eb8f282654902a96bffb70c7c241e9c78b8d5
Resolve file name conflicts between different components
Ensure shared log levels are identical across components
Encapsulates lib/*
Change-Id: If848d6fa0e4cd8eac88ce9e63ee77fc5a7a481fd
The `dialog_unconfirm()` func simply does similar
work as `__monologue_unconfirm()` but works instead
on subscriptions additionally.
So just deprecate it and then `__monologue_unconfirm()`
just takes the work on subscribers/subscriptions as well.
Change-Id: I047fd86b8eba700d0347b21137a2aa40fab01643
This wrapper should likely call the `__unsubscribe_all_from_monologue()`
instead of the `__unsubscribe_monologue_from_all()`, because
the latter is already used by another wrapper of the same name.
And "unsubscriber all from monologue" name hints that
we unsubscribe our subscribers from us.
Change-Id: I6a16ab7320c619adedd9ba7c05e0d9a401971bfe
Richard Fuchs
Daniel Donoghue
Donat Zenichev