Add an opt-in rollback message to the NG protocol. It lets a signalling
application undo an SDP offer that rtpengine has applied but the remote
endpoint subsequently rejects, without deleting the established call.
A client enables checkpointing with track-state on an offer. rtpengine
snapshots the affected dialogue before applying it; an answer commits the
exchange and discards the snapshot, and rollback restores and consumes it.
A dialogue holds at most one outstanding checkpoint, so offers arriving
before an exchange completes keep the existing snapshot and a rollback
returns to the last completed offer/answer.
A checkpoint holds a snapshot in the call record format the Redis encoder
already produces, so there is one definition of what a call's state looks
like and no second encoder to keep in step. Decoding a snapshot needs the
field readers the Redis restore path already had, so those are shared
rather than duplicated; json_restore_call() reads the same fields, in the
same order, with the same strict-return behaviour.
Applying a snapshot copies negotiated state back onto the live objects,
matched by unique id. The objects are never recreated, so local sockets
and ports survive. State a rejected offer introduced is removed as well as
overwritten: a field the encoder writes only when set is absent from a
snapshot taken before it existed, and that absence clears it.
ICE and DTLS reconverge rather than being rewound, since applying the
offer has already reset the agent and shut down the DTLS association.
Restoring the accepted credentials and candidates lets connectivity checks
rebuild ICE state, and restoring the fingerprint, TLS id and setup permits
a fresh handshake.
Outstanding checkpoints are stored in the Redis call record so they
survive takeover. Checkpoint data is auxiliary: one that cannot be read is
discarded in full while the call itself is restored without rollback
capability.
The preload shims no longer inherit the sanitizer options from CFLAGS.
They are loaded by the harness into the test scripts' own interpreter,
where a sanitizer runtime crashed the daemon tests on aarch64 during
library initialisation. Everything else in CFLAGS, the Debian hardening
flags included, still applies to them.
The Redis tests no longer assume the record length is four digits, and
read the record across as many reads as it takes.
Squashed:
commit ad49459152
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Fri Aug 28 13:33:17 2026 +0200
MT#55283 address review comments
Snapshots are now bencode, GLib macros are used throughout, and keys and
offsets are built with the existing helpers rather than by hand.
New tests cover the snapshot format and the state that exists only inside
a snapshot.
commit ff47944ad5
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Fri Aug 28 15:24:56 2026 +0200
MT#55283 scope snapshots to the dialogue
A snapshot now holds only the two monologues being checkpointed, and only
the entries the decoder reads: the socket and endpoint map pools, sinks,
subscriptions and aliases are left out.
The from-tag check in the rollback handler is dropped, since
call_get_monologue() is keyed on the tag.
commit 3bb19f2804
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Mon Aug 31 08:41:08 2026 +0200
MT#55283 give each monologue its own checkpoint
The checkpoint moves from a list on the call to a pointer on the monologue,
and its snapshot covers only that monologue. Checkpoints are stored in the
call record as checkpoint-<monologue id>; num_checkpoints and the offerer
and answerer ids are gone.
A monologue is shared between the branches of a forked call, so rolling one
branch back no longer reinstates what rolling another back had undone.
The call-level json dict is no longer written into snapshots, since nothing
reads it back.
commit 0c986a81e2
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Mon Aug 31 10:01:54 2026 +0200
MT#55283 do not report a rollback that did not happen
call_merge() renumbers every unique id, and a snapshot is keyed on them, so
a checkpoint taken before a merge no longer describes anything. It is
dropped with the ids it refers to, and rollback reports none outstanding
rather than a success that restored nothing.
Both sides of a dialogue are checkpointed together. A monologue is shared
between the branches of a forked call, so one side could already hold a
checkpoint while the other had never been tracked, leaving a rollback to
restore half a dialogue and still report success.
Each fix has a test that fails without it.
commit dfe7a72aff
Author: Daniel Donoghue <oneofsomany@hotmail.com>
Date: Mon Aug 31 10:41:50 2026 +0200
MT#55283 document that merging a call drops its checkpoints
Merging renumbers the state a snapshot refers to, so an outstanding
checkpoint is discarded and a later rollback reports none.
Closes#2159
Change-Id: Ie773e2cd4a39fc1c8f39fafe959784e269c0c80e
Forcing the DTLS role to passive only makes sense for the backwards
(torwards the offerer) direction anyway, as towards the answerer (in an
offer) it's not allowed by the RFC, and in an answer it's not possible
as the active DTLS connection would already be in progress.
Convert DTLS= processing into a list as multiple flags might be
required.
Change-Id: I54239280460e1bbce1966bc17a384489eb978618
Amends: 78ee0451 / Ib1d07831
Related: #2156
Related: #2145
Add the 'all' keyword for the codec accept option in publish mode:
- 'all': keep all codecs supported for transcoding and their
supplemental codecs, removing only unsupported ones
- 'all' + 'any': keep all codecs from the offer without removing any
Closes#2105
Change-Id: Ic271a5e461703e3b9dba3c0717bfbb9da89a03ca
New NG protocol commands that mix audio from a source participant
into a destination participant's stream without a full offer/answer
exchange.
- inject start: creates one-way subscription with audio_player mixing
- inject stop: removes injection and restores original codec routing
- Supports cross-call injection via source-call-id (merges calls internally)
- inject attribute persisted through Redis for HA failover
- Audio-only; matches media by media-id, index, then type fallback
Closes#2082
Change-Id: Ib88113b021a4b76bf98892eb1af60c0b36c0d6d3
Introduce three new NG protocol flags that automatically select the matching
configured rtpengine interface based on the system's routing table:
- inbound-peer=<ip>: resolves to interface for inbound (from) direction
- outbound-peer=<ip>: resolves to interface for outbound (to) direction
- peer=<ip> resolves to interface when only one interface is required
When these flags are used, the system:
- Uses a temporary UDP socket to determine the local address assigned by routing
- Finds the first configured rtpengine interface matching that local address
- Uses that interface for the media stream
This allows dynamic interface selection based on network topology without
requiring explicit interface names in the signaling.
Closes#2033
Change-Id: I211806b9cef9d028fdb689d90ea3fe627bdf5d0d
The codec `strip` option used to remove codecs not only from the
destination (offer to) monologue, but also from the source (offered by)
monologue. Change this to only affect codecs on the destination
(offering to) side. This fixes a problem of not being able to have
different `strip` options set for different branches.
As a side effect, this breaks existing use cases of using `strip` to
ignore codecs on the source monologue side. This functionality is
restored by adding `codec-ignore` in the following commit.
Change-Id: I022748fffc29caa3a8c96f514b2021f152e43686
Make `moh-max-duration` available for both
music-on-hold functionality as well as
for the media player.
For that to work, do the following:
- keep `moh-max-duration` config option only for MoH,
if not set (so 0) by default is 1800000ms (half an hour)
- for the play media functionality introduce flag option
`repeat-duration`, by default is disabled
Policy changes:
- duration counter can be used in common with repeats
counter, but then takes a precedence over it.
Hence if first a duration is underflown, then EOF triggered.
Otherwise if the duration counter is still positive, but
repeats are negative, then do EOF based on repeats.
- the repeats counter will always count down during each
iteration, even when used together with the duration counter
For MoH to survive, the repeats counter is simple set to 999
to let the duration counter always win over repeats one
- MoH cannot take duration disabled, since otherwise
would make no sense for it. Hence always takes internally
defined value 1800000ms (half an hour) if not defined
by the configuration option
Backwards compatibility:
- is kept in regards of repeats counter
- is kept in regards of the play media functionality
Change-Id: I48ff3c17c9bed31f80c3106b275b703a9ccb4b26
Allow to-tag updates in answers only until a non-provisional response is
received. Add a flag to optionally suppress this feature.
Change-Id: I67110ede662f618ba5a355500d3d84050e6318cc
If we receive an answer from a to-tag that hasn't previously seen and no
corresponding monologue exists (created from a previous offer),
previously we would treat this is a separate and new call branch, create
a brand new monologue and dissociate the previous one. This may lead to
unexpected results as this new monologue has been created without the
same initialisation as was done for the original one, and so may be left
with incorrect or incomplete data (e.g. SRTP keys, codec information,
interface bindings, etc).
Improve this by treating an unexpected and unseen to-tag as an alias to
the already existing to-tag. Going forward both tags can be used
interchangeably to refer to the same monologue.
Add a flag to suppress this new behaviour, in case some situation is
made worse by it.
Change-Id: Ie8f838eebd50d29d3549031998a2eb1f610b04bb
The option flag `replace-origin-full` should replace whole
origin (o=) line of the SDP body, so that all origin fields
in the `o=` line always remain the same in all SDPs going to a
particular RTP endpoint.
So, not just a straight-forward replacing with own values.
A behavior in relation to the address field is the same
as by the `origin` option flag.
Correct according tests and add one more.
Change-Id: I4bcb740db5cd68a75fb754f5f6b5d21e19b05e1b
Two version of the origin replace exist from now on:
- `origin-replace` - replaces only the origin address
- `origin-replace-full` - replaces all the values,
so name, id, version and IP family with address.
Values for replacing are taken from the rtpengine instance,
so local values provided by the daemon.
Additionally: documentation updated accordingly.
Additionally: revert changes in pub-sub test.
Change-Id: I4d068944726d1ab82683ca5aa641a954890aefcf
Since the `replace-session-connection` has been
deprecated by the 9f8820bd36 then the docs have
to be updated accordingly.
Change-Id: I57200440f360b7e72168989f9dde8c3a38a18867
Daniel Donoghue
Richard Fuchs
Ashwin
Orgad Shaneh
Nikolay Feshenko
Denys Pozniak
Matteo Brancaleoni
Donat Zenichev
Michal Hajek