SBC Core 07.02.05R005 Release Notes

Portfix SBX-104126: The re-INVITE when 200 OK with crypto line other than 1.

Impact: When the SBC offers multiple crypto suites in the INVITE (offer), and the egress sends an answer with the crypto suite which is other than the top priority crypto offered by the SBC, the SBC sends an unnecessary re-INVITE to egress when minimizeRelayingOfMediaChangesFromOtherCallLegAll flag is enabled.

Root Cause: The SBC does not update media subsystem structures correctly.

Steps to Replicate: Configuration:

1. minimizeRelayingOfMediaChangesFromOtherCallLegAll flag is enabled on ingress and egress TG.
2. Multiple crypto suite configured on PSP.
3. The SBC sends INVITE to egress with multiple crypto and egress endpoint answers with crypto, which is other than the top priority crypto that the SBC sent.

Without a fix, the SBC sends re-INVITE to egress.
With a fix, the SBC suppresses re-INVITE to egress.

The code is modified to ensure the SBC suppresses the re-INVITE when egress answer has crypto that is not the top priority crypto as per the Packet Service Profile configuration.

Workaround: N/A

A one-way audio issue occurred on hairpinned calls.

Impact: A one-way audio problem is seen in a AMR-AMR transcoded call with DTMF interworking when "Different2833PTType" is enabled. This problem is visible for all HD codecs (AMR,AMR-WB, EVS, SILK)which uses dynamic payload in SDP offer.

Root Cause: A one-way audio problem is seen in a AMR-AMR transcoded call with DTMF interworking when "Different2833PTType" is enabled. This occurs because the SBC incorrectly configures the DSP channel with an incorrect payload type, not the payload type which was negotiated during the Offer Answer exchange on the Egress leg.

Steps to Replicate: Enable

1. "Different2833PTType" and TransCode conditional in PSP and set Prefered DTMF payload to 102 on both the PSP.
2. Send AMR payload 96,AMR-WB with DTMF 110 (8k) from Ingress.
3. Ensure Egress answer sends AMR 96 and DTMF 102 in answer.
4. Ensure that the call is transcoded and there is one-way audio problem.

The SBC is enhanced to configure the DSP with a pass-through payload type in the following scenario:

• The SBC completes the Offer/Answer cycle on the Egress leg
  If the Egress Peer selects the pass-through dynamic payload in its Answer SDP.
• The call is transcoded due to "Different2833PT" (or any other flag) under "condition in addition to No common codec".

Workaround: N/A

The SBC Radius changes for the 07.02.05 release.

Impact: The radius password sent to the server has no zero characters at the end following the password and a NULL. The retryTimer for radius authentication requests can only be set for values between 500 and 3000 milliseconds.

Root Cause: The radius passwords are padded to 16 characters. The existing implementation did not set those padded characters to 0.

Steps to Replicate:

1. Configure a radius authentication server.
2. Use a password that is less than 15 characters long for the external radius user.
3. Set externalAuthententication to true.
4. Run a tshark session.
5. Login to the CLI.
6. Stop the Tshark.
7. View the radius password element in wireshark after configuring the shared secret in wireshark under protocol preferences.

The code is modified for the following sections:

• The padded characters are now set to 0.
• The range for the retryTimer is now 500-45000 milliseconds.

Workaround: N/A

OpenSSL RSA decrypt errors logged due to padding check failures after increased handshake load during a mass registration event – sometimes the errors become persistent and the SBC may not recover on its own – switchover required.

Impact: Registration and Call failures occur and a switchover may be required to clear condition.

Root Cause: There is a known memory corruption issue known to cause RSA decrypt errors that can lead to the state of inability to perform new TLS handshakes.

Steps to Replicate: Various TLS handshake simulators can generate enough HPS to cause the issue.

The code is modified from the openssl1.0 (1.0.2l) to openssl1.0 (1.0.2u)

Workaround: N/A

Portfix SBX-105961: The SBC reinvite with sendonly causing one-way audio.

Impact: The SBC unexpectedly send out reInvite sendonly when relay DPM is disabled.

Root Cause: There was an internal logical error to queue the sdp on ingress when egress send 18x (sendonly)

Steps to Replicate: 

1. Enable minimize and disable relay DPM on ingress.
2. A call B, B answer 183 (sendrecv), 183 (sendonly), 183 (sendrecv)...200 (sendrecv).

The code is modified so when subsequent 183 (sendonly) received on egress, the SBC updates the queue sdp (recvonly). Since the relay DPM is disable, the SBC should not change the direction of datapath on ingress.

Workaround: n/a. This is application bug per rfc, and the SDP should not change in subsequent 18x.

The call drops when being placed on hold - IPV6.

Impact: The "anonymous.invalid" in IPV6 media is not considered as hold and rejected.

Root Cause: There is no handling for "anonymous.invalid" while handling hold.

Steps to Replicate: 

1. Establish a normal IPV6 media call.
2. Send a reInvite with "anonymous.invalid" in the c line of the media.
3. Check that the reInvite is not rejected and handled as call hold.

Check for "anonymous.invalid" and if the phrase is present, consider it as call hold and avoid going for DNS resolution to address the issue.

Workaround: Use the SMM to modify "anonymous.invalid" to "::" on the incoming side.

The SCM process core dumped on the SIGABRT.

Impact: The SCM has cored due to a memory corruption issue.

Root Cause: The SCM core is the result of a memory corruption caused by a function that is overwriting the end of the buffer that it allocated.
The root cause is that a bad pointer is being passed into this function. This pointer points to memory that had been previously freed without clearing the field that points to it.

Steps to Replicate: This issue is not reproducible because there is a race condition that contributes to it.

In order for this issue to cause a core, the memory that had been freed would also have to have been immediately re-allocated by the function that is copying past the end of it's buffer. We cannot predict when this memory will be re-allocated and therefore this issue is not reproducible.

The code is modified so there is no memory freed and then leaves around a pointer to this free memory.

This prevents us from passing a bad pointer into a function that would have attempted to copy from this invalid address.

Workaround: This issue will only happen when the customer is running calls that require registration. The registration must have at least one uri parameter (ex: transport) in both to and from header.
But, even in this scenario, most customer will probably not hit this core.

Portfix SBX-102115: The SBC modifies the Replaces parameter with wrong Call-ID and tags if the Replaced call was looped back to SBC through a SIP Proxy that does not modify SIP Call-ID and tags.

Impact: Relay refer with replaces for loopback call, the SBC picks up the wrong call leg.

Root Cause: The SBC query for the replaces callId, and found matching both legs (loopback).

The SBC pick up the wrong leg.

Steps to Replicate: 

1. A to B call
2. B to C call
3. B attempted to bridge A and C together, the SBC is configured to relay the REFER with Replaces. The SBC modified the Replaces with the correct Call-ID and tags
4. The proxy looped the REFER back to the SBC and the SBC relayed it. This time, the SBC modified the Replaces parameter with a wrong dialog ID.

If loopback is detect, only pick the one with to-tag match local-tag. This is per RFC-3891, section 3.

Workaround: None.

There were various display issues related to media port range modifications.

Impact: Issue 1,2,3: The CLI display of mediaPortRangeUnassigned to TGs was not regulated by the system media port range setting, causing the mediaPortRangeUnassigned CLI command displaying the wrong ports.

Issue 4: If the basePorts for different TGs are the same in a same zone, their maxPorts will be added up in CLI display of mediaPortRangeAssigned. tcpPortRangeAssigned has the same problem.

Root Cause: Issue 1,2,3: The root cause was that the SBC had not considered the system media port range setting as restriction when calculating unassigned ports.

Issue 4: The root cause was that assigned media port range map had not been indexed by TG, but by basePort had been a mistake.

Steps to Replicate: While working on the SBC CLI

1. Show configuration details system media mediaPortRange
2. Show table addressContext addressContextName ipInterfaceGroup IG_name mediaPortRangeUnassigned
3. Modify configuration details system media mediaPortRange to much smaller range.
4. Repeat step 2, to make sure that mediaPortRangeUnassigned gives ports always within the range of "show configuration details system media mediaPortRange"
5. Create multiple TGs in each zone. Assign mediaPortRanges to these TGs. Some range with the same basePort in the same zone. Some with different basePorts in the same zone.
6. Repeat step 2 to make sure that mediaPortRangeUnassigned gives ports always within the range of "show configuration details system media mediaPortRange"
7. Show table addressContext addressContextName ipInterfaceGroup IG_name mediaPortRangeByTGNameAssigned / mediaPortRangeUnassigned. Ensure that the outputs are correct.
8. Repeat steps 2-7 with tcpPortRangeByTGNameAssigned / tcpPortRangeUnassigned
9. Repeat the display steps above in EMA.

The code is modified for the following issues:

1. Added system wide media port range into SBC SIPSG cache, so that the restriction will be checked before display of mediaPortRangeUnassigned.
2. Changed the map of the assigned mediaPortRange to indexed by TG name, not basePort any more.
   Therefore, the CLI/EMA syntax becomes mediaPortRangeByTGNameAssigned/ tcpPortRangeByTGNameAssigned, instead of mediaPortRangeAssigned / tcpPortRangeAssigned.

Workaround: It is a display issue, does not impact call.

The MCF was sent back to the ingress as MPS.

Impact: Some fax T.38 endpoints send entire DCS V.21 signal in one packet as opposed to 1 octet per packet. This can cause the fax failures.

Root Cause: A burst of octets in a single packet is essentially a burst, and causes potential problems as these packets get queued for modulation and cause delay and later TCF (high speed) signal some packets get dropped.

Steps to Replicate: This can only be reproduced with a customer data.

The code is modified to accommodate such larger bursts.

Workaround: None.

Portfix SBX-104851: The SBC is down and the standby registration with active failed, error 160004.

Impact: Standby is not allowed to join cluster and fails to start

Root Cause: The safplus checkpoint file is corrupt and the section needing to be overwritten is not found.

Steps to Replicate: The root cause of the checkpoint corruption is unknown/checkpoint corruption cannot be forced and therefore directly testing this fix is not possible.

The code is modified to re-add the missing section if it is not found.

Workaround: A complete outage is required in order to restart the active server.

Portfix SBX-98177: Issue with the SBC 7000 TCP window size. 

Impact: Add the CLI support to set kernel parameter net.ipv4.tcp_window_scaling.

Root Cause: In certain SBC deployment scenarios (a large number of devices running SIP-TLS), tcp_window_scaling caused small TCP window size.

In such cases, the operator had to use a command to disable tcp_window_scaling on each SBC node.

Steps to Replicate: 

(1). Show initial setting for tcp_window_scaling on both active and standby 
# cat /proc/sys/net/ipv4/tcp_window_scaling
1
# cat /proc/sys/net/ipv4/tcp_window_scaling
1

(2). Use CLI to change the kernel param value and display the changed value on both active and standby.
set system admin SBCSWE01 kernelParams tcpWindowScaling disable commit
Commit complete.

# cat /proc/sys/net/ipv4/tcp_window_scaling
0

# cat /proc/sys/net/ipv4/tcp_window_scaling
0

The code is modified to fix the issue and the Linux command is no longer needed with the modified code.

Workaround: Use the Linux command to set the kernel parameter on both active and standby.

# sysctl net.ipv4.tcp_window_scaling
1
# sysctl -w net.ipv4.tcp_window_scaling=0
# sysctl net.ipv4.tcp_window_scaling
1
# sysctl -w net.ipv4.tcp_window_scaling=0

To be persistent across the SBC restart and system reboot, use the Linux the following shell command on both active and standby.
# echo "net.ipv4.tcp_window_scaling=0" >> /etc/sysctl.conf
# echo "net.ipv4.tcp_window_scaling=0" >> /etc/sysctl.conf

The code is modified to disable the Path MTU Discovery by setting kernel parameter net.ipv4.ip_no_pmtu_disc to 2. When set to 2, the DF bit is set to 0 for the transmitted packets on every created socket. The configuration parameter is "systerm admin <name of system> kernelParams ipNoPmtuDisc".

Workaround: The workaround is a hack. It can be used as a one time test only. The hack will not survive Linux reboots.
1. Make changes on the current Standby (assuming SBC1 is currently active, and SBC2 is currently standby)
[root@SBC2 ~]# date; cat /proc/sys/net/ipv4/ip_no_pmtu_disc
[root@SBC2 ~]# date; echo “2” > cat /proc/sys/net/ipv4/ip_no_pmtu_disc
[root@SBC2 ~]# date; sbxrestart
2. Wait until the SBC is up and synched. Ensure the p_no_pmtu_disc is set to 2.
[root@SBC2 ~]# date; sbxstatus | tail -4
[root@SBC2 ~]# cat /proc/sys/net/ipv4/ip_no_pmtu_disc
2
[root@SBC2 ~]#
3. Make changes on the current Active.
[root@SBC1 ~]# date; cat /proc/sys/net/ipv4/ip_no_pmtu_disc
[root@SBC1 ~]# date; echo “2” > cat /proc/sys/net/ipv4/ip_no_pmtu_disc
[root@SBC1 ~]# date; sbxrestart
4. Wait until the SBC is up and synched. Ensure the p_no_pmtu_disc is set to 2.
[root@SBC1 ~]# date; sbxstatus | tail -4
[root@SBC1 ~]# cat /proc/sys/net/ipv4/ip_no_pmtu_disc
2
[root@SBC1 ~]#
5. May perform a switchover to make the SBC to be active.
6. Run customer tests.

Portfix SBX-102837: The SipSignalingPorts was listed as OutOfService after a switchover.

Impact: The SIP sigPorts were stuck in OOS after a switchover.

Root Cause: The operator had a network/pkt port issue, on one of their HA nodes, that caused pkt port(s) to bounce randomly, that is, the pkt port went DOWN and came back UP within 2 to 3 seconds. The operator has been keeping that node as a standby node. They also have link detection enabled for pkt port(s) and have around 100 LIFs per pkt port, one per SIP SIGPORT. When the pkt port went down, the NRS delays the port down event processing for 2 seconds to allow link failure detection to be ready and also to avoid the race condition between NRS and LVM. When the 2 second delay timer is up, the NRS starts to take down affected LIFs and notifies local SIPCM and SIPFE so the operator can take down affected SIP SIGPORTs.

In SIPCM, all the sockets on the affected sigPort are put in a delete pending table and starts a 1 tick timer. Then the socket(s) is being deleted after 1 tick timer is up.

When pkt port came back up, NRS processes the event with no delay and notifies SIPCM and SIPFE as well. Since there are around 100 LIFs, there were many messages exchanges between NRS/XRM/SIPCM/SIPFE. NRS LIF FSM has the mechanism in place to handle the timing issue and LIFs were all back in service. But SIPCM failed to activate some SIP SIGPORT(s) while binding the socket(s). These error messages indicated that SIPCM tried to activate the SIGPORT while it was still pending delete. Therefore SIGPORT got stuck in OOS(broken state) in both SIPCM and SIPFE on standby node. If there was a switchover happened later, user would then noticed one or more SIGPORTs were OOS. They have to manually bounce those SIGPORTs to bring them back in service.

Steps to Replicate: The nature of the problem was the timing caused race condition. There is no proper way to re-create/verify the fixes. 

The code is modified:

1. To introduce a new 1 tick timer in SIPCM_DATA_STR, activateRetryTimerId.
2. So if sigPort is found in the table, then start the 1 tick timer. When the timer is up, SipCmActivateCallSigPort() is invoked again. Once the sigPort is activated successfully, the SIPCM notifies the SIPFE as usual.

Workaround: N/A

The DSP Threshold setting is not generating a trap on SBC5400.

Impact: The g711PacketThreshold, g729Threshold, and g726Threshold onset and abate traps are not sent.

Root Cause: The NRM did not receive CLI updates to the g711PacketThreshold, g729Threshold, and g726Threshold, and the trap generation code used wrong trap names.

Steps to Replicate: 

1. Provision the threshold levels:
   set oam traps dspAdmin dspAvailabilityTrap g729Threshold 40
   set oam traps dspAdmin dspAvailabilityTrap g726Threshold 60
   set oam traps dspAdmin dspAvailabilityTrap g711PacketThreshold 80
   commit set oam traps admin sonusSbxDspAvailG729OnSetCrossThresholdNotification state enabled
   commit
   set oam traps admin sonusSbxDspAvailG729AbateCrossThresholdNotification state enabled
   commit
   set oam traps admin sonusSbxDspAvailG726AbateCrossThresholdNotification state enabled
   commit
   set oam traps admin sonusSbxDspAvailG726OnSetCrossThresholdNotification state enabled
   commit
   set oam traps admin sonusSbxDspAvailG711OnSetCrossThresholdNotification state enabled
   commit
   set oam traps admin sonusSbxDspAvailG711PacketAbateCrossThresholdNotification state enabled
   commit
2. Configure the trap target: set oam snmp trapTarget EMS160 ipAddress 10.xxx.xx.xxx port 162 trapType v2 state enabled commit
3. Limit the compression resources to make the issue readily occur: set system mediaProfile tone 98 compression 2 commit
4. Perform transcoded (e.g. G711 to G729) calls that exceed threshold limits, and verify that onset traps are sent to the trap target.
5. Clear the transcoded calls, and see abate traps are sent to the trap target.

The code is modified to support g711PacketThreshold, g729Threshold, and g726Threshold values.

Deprecated the support for allThreshold, as it was never implemented in the SBC.

Workaround: N/A

The RE-REGISTAR was shorter than 3600 secs due to a child AoR. 

Impact: When the 200 OK response to REGISTER request contains a P-Associated-URI
header, the SBC creates a child AOR and forwards all REGISTER refresh requests to the registrar (effectively disabling the SBC fast refresh response).

Root Cause: The creation of child AORs cause all REGISTER refresh requests to be sent to the registrar (effectively disabling the SBC fast refresh response).

Steps to Replicate: 

1. Configure the SBC to perform registration.
2. The 200 OK response to REGISTER request contains a P-ASSOCIATED-URI header.
3. In the error case, the refresh REGISTER requests are all forwarded to the registrar.

Removed the child AOR check from SipRaRegisterRequestCompletedAorNfy(), permitting the SBC to send fast refresh responses.

Workaround: N/A

SM Process core on the Server.

Impact: The SM Process crashed while executing the "show table system syncStatus" command.

Root Cause: The shell script used to get the Oracle sync status - PolicyDBSyncStatus.sh - did not return within 10 seconds, causing a healthcheck timeout that caused the coredump.

Steps to Replicate: This problem is not reproducible.

Disable heathchecks while fetching the syncStatus to address the issue.

Workaround: None.

Portfix SBX-103273: Dual NUMA support in the SWe SBC.

Impact: Multiple NUMA were not allowed in general (except few cases).

Root Cause: A restriction was imposed not to allow multiple NUMA in HostCheck.

Steps to Replicate: 

1. Configure a KVM instance with dual NUMA and install in Non-Gold/Non-GPU setup.
2. Let it come in default traffic profile.
3. Verify that the SBC would come up fine without any HostCheck errors.

The code is modified to allow multiple NUMA in general, irrespective of personality and profile.

Workaround: No workaround. Need to use correct build.

Portfix SBX-96649: Failover due to a SAM Process core.

Impact: There were reports of a SAM Process crash stack indicating a Cave Creek QAT driver API may have caused memory segmentation, causing a switchover on the SBC7000 while verifying a TLS client's certificates during a TLS handshake.

Root Cause: Incompatible third-party QAT crypto driver with the current OpenSSL version, Linux kernel, and cipher suites was used in the current certificates.

Steps to Replicate: After an App installation or an Upgrade, ensure that the QAT engine is no longer used by the SIMCM (SAM Process) by checking DBG log.

Example: The following DBG message should be seen:
087 06232020 062948.762154:1.01.00.00609.MAJOR .SIPCM: *Dynamic engine not supported

Due to Cave Creek QAT and its driver being End-of-Life and improved OpenSSL performance in RSA key operations, use the OpenSSL optimization in the RSA key operations to support TLS handshake. The QAT crypto engine is no longer used by the SAM Process and IkeProcess on the SBC7000 and SBC5400.

Workaround: None.

Portfix SBX-103763: The upgradeSBX.properties causes the EMA to report a presistent upgrade in progress.

Impact: The upgrade is completed but the Platform Manager Install/Upgrade screen gets stuck on the previous upgrade and cannot perform the new upgrade operation.

Root Cause: The issue is being faced due to the SBC upgrade steps as part of SBX-56893 Jira in 6.1.0. Whenever the SBC is upgraded from 6.0.x to 8.2.x, Design will see the issue because there are different steps in 6.0.x and 8.2.x that is causing the issue. When upgading the SBC using 6.0.x code that has the old upgrade steps, once the pre install check step is executed, the PM API updates the upgradeSBX.properties file with next step(INSTALL_DB), the SBC goes for reboot and platform manager code gets replaced with upgraded version, which is 8.2.x.

Currently, the PM API reads upgradeSBX.properties file to read the steps value that is in INSTALL_DB and match the check but in 8.2.x PM code. There is no INSTALL_DB check in the PM code and because of that, we are unable to update the upgradeSBX.properties file with next steps. Once the upgrade gets complete and PM code updates upgradeSBX.properties file with finished as steps, we move the upgradeSBX.properties file into upgradeSBX.properties.1, which is not occurring, and the Platform Manager UI is unable to mark as complete, getting stuck on install/upgrade screen with the previous upgrade.

Steps to Replicate: 

1. The ISO/app installs the SBC 6.0.0F6 on a HW box. It was installed as a standby SBC on a SBC5110.
2. Go to EMA Administration > System Administration > Software Install/Upgrade and start an offline upgrade. Leave the browser alone, do not click anywhere in the EMA GUI once the upgrade has started.

The code is modified to handle the INSTALL_DB step check to mark the upgrade as complete from the Platform Manager UI.

Workaround: To perform the upgrade operation again, Ribbon must delete the upgradeSBX.properties file from the SBC.

The SBC SWe 8.2.0F1 duplicates audio from call B to call A.

Impact: If the CN is not negotiated for G711 codec and remote peer still sends the CN packets that match default CN payload type (13), then the user on other end may hear cross talk audio of completely unrelated channel or may hear their own audio.

Root Cause: When a g711 side does not negotiate CN in signaling, the DSP does not initialize Comfort Noise Generation object. However, if a remote peer still sends CN packet that matches the g711 SID payload type configured in PSP (default 13), DSP accepts the packet. It processes that CN packet incorrectly and as a result uses stale voice buffer which happens to be of another channel. This continues until the next voice packet for that channel arrives. As a result, cross talk audio is observed from other calls during a silence period. In some cases, the user may hear their own audio also and that is different manifestation of the same problem. This issue is specific to the SWe.

Steps to Replicate: 

1. Run a CN that is not negotiated for G711 codec.
2. Send a default remote peer CN packets that matches the default CN payload type (13).
3. The user on other end may hear cross talk audio of completely unrelated channel and hear the user's own audio.

The code is modified to initialize the comfort noise object even though the CN is not negotiated and processes the CN packets correctly.

Workaround: 

1.Change the default payload type of comfort noise from 13 to something else (say 15) in PSP of peer that is sending CN packets. This will make DSP drop CN packets because payload type will not match.

PSP configuration:
show configuration profiles media packetServiceProfile G711_NONE_NONE_NONE
..
silenceInsertionDescriptor {
g711SidRtpPayloadType 13;
heartbeat enable;
}

2. Enable silence suppression on PSP of peer that is sending CN packets and keep CN payload type that matches with CN payload type.

The DBG logs in the 7.2.4R0 SBCs filling up with the T38 logs.

Impact: When the call trace is enabled, the T38 messages are logged in a .DBG file. However, even after a call trace is disabled, T38 log messages continue to appear in .DBG file.

Root Cause: A gevelobal variable to set t38 log messages was set for call traces but never reset.

Steps to Replicate: 

1. Enable call tracing and make a T38 fax call.
   See that .DBG file has T38 log messages.
2. Disable call tracing and make a T38 fax call.
   T38 log messages do not appear in .DBG file.

The code is modified so after the call tracing is disabled, T38 log messages will not appear in .DBG file.

Workaround: Use 'unhide debug' command to disable T38 log message after call tracing is no longer needed.
> request sbx drm debug command "dspdebugt38 state disable"

Portfix SBX-103561 (Originated in Release 8.2.4) The tgrp parameter was not passing transparently when the SIP in the core is enabled.

Impact: SipCore calls are passing the wrong tgrp parameter value.

Root Cause: There was missing logic to support SipCore.

Steps to Replicate: 

1. Configure the SipCore feature. Both IPSP core and egress leg have "originating Trunk Group Options" set to "Include tgrp with IP address"
2. Make an SipCore call.

The code is modified to support the SipCore feature.

Workaround: N/A

The code is modified for the Allow message body QSIG Content-Type: multipart/mixed, Resource/Lists across GW-GW to address the issue.

Workaround: N/A

Portfix SBX-102470 (Originated in Release 9.1.0) Observed a SAM Process memory leak while running the TLS/SRTP load on an OpenStack SBC.

Impact: The SIP-TLS with an Client Authentication (authClient=true in tlsProfle) causes about 1.2 KB of memory leak per TLS handshake on the SBC.

Root Cause: After verifying the peer certificate, the SBC SAM process did not free memory allocated for accessing the public key.

Steps to Replicate: 

1. Run 50,000 SIP-TLS sessions with Client Authentication, and observe the memory used by a SAM Process.
2. Run another 100,000 SIP-TLS sessions with Client Authentication, and observe the memory used by a SAM Process.
3. Compute the extra memory used for additional 100,000 SIP-TLS sessions.

The code is modified to free the memory allocated for accessing public key after its use.

Workaround: N/A

Portfix SBX-103939 (Originated in Release 9.2.0) The NAPT timer was not armed properly in MoH.

Impact: The NAPT timer did not start as NRMA requested.

Root Cause: The RTP flow mode was xmt-only. Then NRMA requested flow change to enable NAPT timer expiry because we have already learned source address. But the XRM did not start NAPT timer because it was a learning next request.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to start NAPT timer for learning next if NRMA has set XRM_NAPT_MEDIA_NAPT_TIMER_ACT_ENAB.

Workaround: N/A

There was an incorrect license usage count for Encrypt license.

Impact: An incorrect Encrypt license was consuming for IPSEC/TLS calls.

Root Cause: For IPSEC, the SPD is configured with an IP prefix for localIpAddr and remoteIpAddr. But while comparing an IP address, the prefix length/subnet mask was not taken in to account. As a result, the IP comparison was failing, and in turn the license was not consuming for IPSEC calls.

For the TLS, the issue is observed in TEAMS calls only, When calls come, a specific internal flag was not setting, which the license was consuming.

Steps to Replicate: 

1. Run a PSTN to TEAMS call.
2. PSTN disconnects the call while TEAMS ringing.
   >>Encrypt counter got incremented as below each time when call is disconnected.

The code is modified to check the IP address prefix validation so that the IP address within the prefix is considered as an IPsec call and updates the internal flag, so that the request method is updated properly.

Workaround: N/A

Portfix SBX-102795 (Originated in Release 9.1.0) In the Asymmetric PRACK interworking, the configuration flag "Sdp100relIwkForPrack" behavior is not proper.

Impact: In a latemedia passthrough call, the SBC is not sending ACK for 200 OK when the Asymmetric PRACK Interworking features is used.

Root Cause: The SBC fails to relay 200 OK for an UPDATE in late media passthrough and reverse offer scenario. This issue is fixed but the given fix breaks the Asymmetric PRACK feature functionality.

Steps to Replicate: 

Configuration:
Set the flag lateMediaSupport to passthru on the ingress TG.
Enable 100rel Support on the ingress TG.
Enable the flag Sdp100relIwkForPrack on the egress TG.

set addressContext default zone <ZoneName> sipTrunkGroup <ING_TG_Name> media lateMediaSupport passthru
set addressContext default zone <ZoneName> sipTrunkGroup <ING_TG_Name> signaling rel100Support enabled.
set addressContext default zone <ZONEName> sipTrunkGroup <EGR_TG_Name> signaling Sdp100relIwkForPrack enabled.

Procedure:

1. UAC sends the Initial INTIVE request to the SBC without SDP and has 100rel in Require header.
2. UAS sends the 180 towards the SBC with no SDP after receiving offer less Invite.
3. UAC sends PRACK with SDP answer after receiving 180 with SDP offer.
4. UAS sends the 200 OK towards the SBC with the SDP offer.
5. UAC sends ACK after receiving 200 OK.

Expected Result:
The SBC should send ACK with SDP answer on the egress side.
After a re-negotiation, the media communication should be done as per final offer answer communication.

The code is modified to cover both scenarios. 

Workaround: N/A

Portfix SBX-103237 (Originated in Release 7.2.5) The peer is failing to choose proper leader/leadership algorithm while recovering from a splitbrain.

Impact: A restart of the primary node during a split-brain can cause the nodes to choose different leaders when the split-brain is resolved.

Root Cause: A restart during the split-brain may cause the node to revert to the default algorithm rather than using the enhanced leadership algorithm when coming out of split-brain.

Steps to Replicate: Execute the following scenario:
AA-SS >> AA & SA >> cause split-brain >> restarting AA >> recover split-brain >> AS-SA

The code is modified to properly maintain the agreed upon leadership algorithm so that the correct algorithm is utilized, even after a restart.

Workaround: N/A

Portfix SBX-98336 (Originated in Release 9.0.0) Memory changes for the PAI header userinfo modification for a transparency case.

Impact: When the PAI header userinfo is modified using DM/PM rule and also when transparency is enabled, the SBC is copying the userinfo from DM/PM rules into out-of-memory, if the DM/PM userinfo is longer than the ingress INVITE PAI userinfo.

Root Cause: The transparency buffer for PAI header is only allocated for the size of the ingress PAI userinfo. When the PSX returns DM/PM rule with larger number of characters in the userinfo, the SBC while copying it to the egress PAI transparency buffer, scribbles over the memory.

Steps to Replicate: 

1. Configure STI profile on the SBX and PSX.
2. Send an INVITE with PAI header and perform the STIR/SHAKEN signing/tagging.
3. Enable Privacy->Transparency configuration.
4. Configure DM/PM rule to change the PAI userinfo with a longer number of characters.

The code is modified by allocating a new memory block for the PAI userinfo and updating the PAI header pointer.

Workaround: N/A

The Out of Memory caused an SBC switchover.

Impact: Memory leaks when 3xx relay and reject 3xx on egress IPSP

Root Cause: Contact Headers in 3xx memory did not free properly.

Steps to Replicate: 

1. Enable 3xx relay and reject 3xx, trigger the SBC sends 503 to ingress.
2. A call B, B response 3xx with contact headers.
3. Or Enable 3xx relay and configure ingress "do not send 3xx", trigger SBC sends 503.
   

Ensure the memory of contact headers in 3xx are properly free when config to reject 3xx.

Workaround: Customer may using SMM to change the status 3xx to 503 instead.

Portfix SBX-103175 (Originated in Release 8.2.4) A large microflow profile was not getting enabled in the Custom Traffic Profile.

Impact: 

1. For a default profile, the max subs was always set to 256K.
2. For custom and standard traffic profiles, the micro flow count in NP resource was not proper.
3. There is limited support of 2M micro flows for standard profiles

Root Cause: 

1. The large micro flow support was not there for custom traffic profiles.
2. For standard and default traffic profiles, there was restricted/incomplete support of large micro flow that is made generic as part of this JIRA.

Steps to Replicate: 

1. Create a instance with 10GB memory and 16vpcu with default traffic profile. Check microflow limits using "/opt/sonus/bin/cpsi -d summary" command.
2. Increase the memory to 50GB memory and check microflow limits using "/opt/sonus/bin/cpsi -d summary" command.
3. Create a instance with 20GB memory and 16vpcu. Create and activate a custom traffic profile with access enabled in call mix. Check microflow limits using "/opt/sonus/bin/cpsi -d summary" command.

The code is modified to:

1. Introduce a new estimation parameter maxSubs where the micro flow count is decided and the NP hugepages is reserved.
2. Enable a large micro flow support for all standard/default profiles where mem > 48GB and vcpu_count >10.

Workaround: N/A

The "request sbx xrm debug command sec -stat gcid <gcid>" was not showing the enc and dec details on the SBC SWe.

Impact: This debug command in unhide section is not showing all the required fields populated in the SBC SWe.

Root Cause: The NP response is not framed in expected order to application layer.

Steps to Replicate: Run a SRTP call and the issue this debug command. The debug command does not show all the populated fields.

The code is modified so the NP Response is correctly framed in expected order to application layer.

Workaround: This debug command is to see SSN field value with RoC, all other details can be seen from show call mediastatus.

The SBC relays STUN packets in RTP streams on pass-thru calls (no transcoding); on RTP to SRTP calls, the relayed STUN packet causes the ROC to reset back to 0 and the remote peer discards the encrypted media packets.

Impact: When Non_RTP packets mixed/relayed in SRTP stream are sent out from the SBC, it was resulting in one way audio at the endpoints in longer duration calls.

Root Cause: These non-RTP packets relayed eg. STUN packet causes resetting of encryption ROC back to 0 on the SRTP stream sent out. This issue results in the remote peer discarding the encrypted media packet in long duration calls from the SBC, where ROC is expected to be non-zero.

Steps to Replicate: Run a SRTP passthrough call with media for more than 15 mins, with 10 uptime audio. Then send a non-RTP packet (STUN, UDP TL t.38) in that stream for pass-thru relay, and observe the media in that call.

The code is modified for Non-RTP packets to not mix with SRTP encryption/decryption processing, SRTP media stream ROC does not reset with these packets mixed, and endpoint will not have media issues in longer duration calls.

Workaround: If longer duration calls are expected to relay STUN messages as well, disabling the SRTP will solve media issue. But for secure reasons, if SRTP has to be enabled, there is no workaround for this.

Portfix SBX-85808 (Originated in Release 8.0.0) The SBC is not sending a DTMF telephonic event to SIPREC server when the CS is negotiated on a telephonic event.

Impact: The DTMF tones are not being sent to the SIPREC server.

Root Cause: The SBC was sending only one preferred codec and not the telephone event towards the SIPREC server. As a result, the telephone event are not being negotiated and not being sent to SIPREC server.

Steps to Replicate: Enable the SIPREC on the SBC, make a CS call with a telephone event and send the DTMF tones.

The code is modified to send all the negotiated codec towards the SRS server that also includes the DTMF.

Workaround: N/A

Portfix SBX-95919 (originated in Release 7.2): The Max Forward Header Support feature is not working for requests from terminating side.

Impact: The Max Forward Header Support feature is not working for requests from the terminating side. The SBC does not subtract 1 in the Max-Forwards header despite the rfc7332ValidateMaxForwards is set to enable.

Root Cause: This issue is caused when a BYE request that comes from the terminating side. Any other requests from the originating side are decreased correctly including the BYE request.
Handling the BYE from terminating side was not taken care of.

Steps to Replicate: Enable fc7332ValidateMaxForwards on both TG.

1. Initiate a call from A to B, B sends a 200 OK to connect the call.
2. B sends the Bye request. The SBC sends the Bye request to A.
   The Max forward header in the Bye is set to 70.
3. Check the Max forward SBC sends to A. The Max forward header should be decremented by one.

The code is modified so when BYE is received from the terminating side, decrease the max forward header by one.

Workaround: N/A

Portfix SBX-94762 (originated in Release 8.2.0): The basic Relay-Relay of RTCP for T140 is not working in the latest build.

Impact: The RTCP NAPT PORT learning alone is not working in the SWe.

Root Cause: RTCP NAPT PORT learning flags ports definitions endian mismatch in the SWeNP was not triggering the learning and causing drops.

Steps to Replicate: Run calls with RTCP NAPT port learning alone call flows and ensure the RTCP packets are learnt and relayed accordingly.

The code is modified in the SWeNP media flow processing to fix the issue.

Workaround: N/A

Portfix SBX-96484 (originated in Release 8.1.0): The MRFRM SIPSG standby CCB hash had multiple insert failures.

Impact: When there is hash insert failure, the case is not being handled properly.

Root Cause: There are a few major logs that came as part of load run that relates to the gcid hash insert failures in the MRFRM.

Steps to Replicate: Run a SBC call flow with 12 codecs with the GW signaling and configure the system in Sensitive mode.

The code is modified to perform a hash swap when there is hash collision.

Workaround: Run an MRF load and issue may be reproduced.

The DBG file was filling up with messages "SIPCM: *ThreadPool: messageSequence "

Impact: The DBG logs can be overrun with "SIPCM: *ThreadPool: messageSequence" messages.

Root Cause: The DBG logs can be overrun with "SIPCM: *ThreadPool: messageSequence" messages, when the double CRLF "pings" are received by the SBC over a UDP transport.

Steps to Replicate: Send double CRLF "pings" over UDP to the SBC.

The code is modified to properly dispose of double CRLF "pings" received by the SBC over the UDP.

Workaround: Inhibit the transmission (or reception) of Double CRLF "pings" over the UDP.

Portfix SBX-96323 (originated in Release 8.1.0): The version header is removed on the SBC even though the transparency was enabled.

Impact: When running an OOD message call flow with MIME Header and Transparency is enabled for MIME Header, the MIME Header is not going in the egress message.

Root Cause: The MIME header is ignored by the SIP Parser.

Steps to Replicate: Run an OOD Message call-flow with Mime header.

The code is modified to add MIME header as a Transparent header.

Workaround: Use the SMM Message Scope Variables to store and add it in the outgoing message.

Portfix SBX-98367 (originated in Release 8.1.0): The SBC lost connections to other SBCs.

Impact: The X710 SR-IOV PKT0 interface on the M-SBC stops receiving packets, resulting in connectivity loss with the SBC and other M-SBCs.

Root Cause: The default TX Free threshold setting for the DPDK X710 PMD holds up a larger number of packet buffers leading to buffer starvation and thereby stopping of packet rx on pkt0 port. The issue is particularly aggravated when the majority of calls have both legs on PKT0 and few calls have one leg on PKT1 and another on PKT0.

Steps to Replicate: 

1. Run calls with both media legs on the pkt0.
2. Run 100-200 calls with one media leg on pkt0 and another on pkt1.
3. Re-run calls with both legs on the pkt0.

The code is modified to prevent retaining a large number of packet buffers in the TX done queues.

Workaround: There is no guaranteed workaround, but enabling the LDG may help in reducing the chances of the reoccurrence of this issue.

Portfix SBX-100331 (originated in Release 8.2.1): After adding the second mgmt port in the 23vcpu I-SBC (in RHEV platform 8.2.1 build), pkt and the mgmt port messes up.

Impact: On adding extra management port in large instance without redundant PKT ports, the SWe_NP process crashes.

Root Cause: There was a bug in the code that pulled non-existent port id on adding extra management port resulting in crash.

Steps to Replicate:

1. Make a large instance >15vCPU(default profile) without redundant packet ports.
2. Add extra management port and reboot.

The code is modified so the polling of extra management interface properly manages large instances in the SWe_NP code.

Workaround: N/A

The From header wrongly impacted by the SMM.

Impact: The SMM adding duplicated generic parameters in the header with tel scheme.

Root Cause: After the first rule, the treat header as URI, the second rule treat as generic, the SMM format the 2nd rule actions with duplicated generic parameters.

Steps to Replicate: The first rule testing with the URI parameter type. The second rule store the header value into local var and create a new header based on local var.

There were logical error on the 2nd rule when try to reconstruct the uri header into generic header that adding duplicated generic parameters.

Workaround: Avoid using the URI parameter from the first rule. One may want to use regex instead.

Portfix SBX-99321 (originated in Release 7.2.0S400): There is node resource congestion alarms after upgrading to 7.2S400.

Impact: Performing a time zone change from CLI can cause node resource congestion alarms in 7.2S400.

Root Cause: The problem was found to be caused due to a system daemon(cron) running in signaling group and exhausting signaling resources.

Details:
Whenever there is a timezone change, cron is restarted and when it is restarted from a process running in the SIG core(SM), cron gets scheduled in the SIG core. SIG cores are monitored for resource usage periodically and due to cron taking more resources while running cron jobs, the resource congestion alarms were getting raised by the SBC.

Steps to Replicate: 

1. Perform a timezone change from the CLI on SWE.
2. Note the pid of cron and check which cgroup it is apart of by running the following scripts:
   cat /cpusets/sig/tasks | grep `pidof cron`
   cat /cpusets/system/tasks | grep `pidof cron`

The code is modified so the scripts responsible for the timeZone change and cron restart are moved to the system cgroup.

Workaround:

1. Reboot the SBC after a timezone change, (or) 
2. Run below command to move cron to system cgroup:
   /usr/bin/cset proc -m -p `pidof cron` -t system --thread

A PRS process core occurred on the Standby Server.

Impact: The PRS process cored due to the XRM accessing a NULL pointer inside of the XRES data structure.

Root Cause: The root problem was that the pkt2 on standby node was stuck in DOWN state due to possible network switch issue, while the pkt2 on active node was functioning as normal. All the activated XRESs selected on LIFs of the pkt2 were mirrored to standby and got inserted in the deferredXresList waiting for the standby pkt2 to be UP.

Then when one of those XRESs is reused for a different call and mirror to the standby node, that XRES may be stuck in the deferred XRESList because the deallocate request may have not been processed yet on the standby node. As a result, the PRS hit coredump was caused by the XRM accessing the NULL pointer inside of the XRES data structure.

Steps to Replicate: The SBC HA pair, active node has pkt ports all UP, and standby node has at least one of the pkt port DOWN.

Start with a fairly high call load, and ensure calls are picking LIFs of pkt1 on the active node. Also ensure XRES on pkt1 are being re-used.

Note: The standby pkt1 should stay DOWN all the time during the test.

The code is modified to correctly free the XRES in deferred XresList so that it can be re-used for the new call.

Workaround: Manually keep the pkt ports sync between the active and standby nodes.

The SBC was adding an extra application/ISUP ACM content.

Impact: The 200 OK Bye has duplicated the ISUP body.

Root Cause: When the e2e Bye is enabled, 200 OK has duplicated the ISUP body.

Steps to Replicate:

1. Configure the isupMimeBodyRelay and e2e bye.
2. Run a sipi-sipi call, and the SBC sends 200 OK bye has duplicated isup body.

The code is modified so the SBC does not create an isup body internally for the e2e Bye and isupMimeBodyRelay.

Workaround: Disable the e2e Bye.

Both applications (iceSupport and SMM storeIPTG) coredumped.

Impact: The SMM drops an incoming call.

Root Cause: After a response failure to an invalid call, the SBC still tries to initiate a setup call. As a result, it accesses an invalid address.

Steps to Replicate: Configure the iceSupport, SMM storeIPTG, and an incoming call with the invalid candidate (no UDP).

The code is modified to add a address validation and not try to initiate a setup call if the call fails.

Workaround: N/A

Portfix SBX-99874 (originated in Release 7.2.2): A second INVITE with a REPLACES collects the wrong PSX route.

Impact: A second INVITE with REPLACES collects the wrong PSX route.

Root Cause: There was a design gap, in case of multilevel INVITE with REPLACES, that the SBC was sending a light weight PSX look up with the incorrect source and destination trunk group. As a result, the SBC is receiving the incorrect TG configuration from PSX.

Steps to Replicate: 

1. A and B are connected.
2. C sends INVITE with REPLACES to replace A.
3. D sends INVITE with REPLACES to replace C.
4. D sends Re-INVITE with a=inactive.

The code is modified so the SBC sends light weight PSX lookup with the correct source and destination trunks to get the corresponding TG level configuration.

Workaround: N/A

There was a back-to-back coredump on the Server.

Impact: The SCM process cored due to memory corruption while parsing an INVITE with a very long and invalid CallId field, while the parseError trace logging was enabled.

Root Cause: The SCM process coredump is caused by memory corruption that is the result of the Trace Logging code overwriting a buffer.

This can happen when the SIP parser encounters an invalid CallId that is also very long.
It is also possible that other parsing errors can trigger this core, especially if the parse error was encountered for a particular header that is very long.

Steps to Replicate: This can be reproduced by enabling the parseError trace logging and then sending a INVITE that includes a badly formatted CallId, which is the maximum allowed size for a CallId:
"set global callTrace errorFilter errorType parseError"

The code is modified to not overwrite the end of the buffer when it is attempting to write a very long error message string.

Workaround: Disable the parseError tracing.

Portfix SBX-96001 (originated in Release 6.2.1): The SBC 7000 has the wrong value for call duration.

Impact: The call service duration (CDR field numbers 10 and 14) has wrong values causing a billing issue.

Root Cause: This issue is seen when there is mid-call message in this case session refresh. Due to this session refresh, there are mid-call messages(INV/200OK/ACK) happens end to end. This makes the "callServiceEstTime" in the function CcRelayInfoMsg() overwritten every time causing the CDR fields 10 and 14 wrong values.

Steps to Replicate: 

1. Enable IPSP flag "End to End ACK" on both TGs.
2. Disable the flag "No CDR Change in End to End Ack".
3. Make a call from A to B and let the call be connected with session refresh enabled.
4. Once the session refresh happens, disconnect the call and check the CDR.

The code is modified such that the "callServiceEstTime" does not get overwritten once its recorded initially during the initial offer-answer.

Workaround: Enable the flag "No CDR Change in End to End Ack"

There was a switchover with the PRS process coredumping.

Impact: The PRS process coredumped due to memory corruption.

Root Cause: Customer encountered a PRS process core due to the memory corruption that happened earlier in processing. The core is the after effect of earlier corruption.

Steps to Replicate: None.

The code is modified to avoid the core, and to collect more diagnostic data if a core happens again.

Workaround: N/A

Intermittently, the SBC SWe accesses the sipSigPort for sending the SIP messages to the core side.

Impact: The relay options with registration may route to the wrong Sip Signaling Port and causing call fails from AS to IAD.

Root Cause: When the IAD sends a registration arrive from the SSP1 and relay options from an other SSP2. Since the options from the SSP2 do not match with RCB from SSP1, the SBC treat the options from the AS and triggering invalid routing to the wrong destination.

Steps to Replicate: Configure the SSP1 and SSP2, and enable maskRcbPort. The registration from SSP1 succeeds. Options from the SSP2 will trigger a relay back to the IAD (not AS). Subsequent calls from AS may fail or refresh registration.

The code is modified to detect the relay messages from the IAD or AS based on RCB looks up (not just based on SSP).

Workaround: Disable the maskRCBPort. Or use the SMM to make the SBC response to Options (not relay).

The dual system SCM process cores and causes a complete outage.

Impact: The SCM process may coredump during two stag SRTP calls.

Root Cause: The NULL pointer access caused the SCM process to coredump.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to include additional NULL pointer protection to the SRTP licensing code.

Workaround: Disable the SRTP.

The eSBC  crashed.

Impact: The root cause has an incorrect initialization in the third party T.38 stack.

Root Cause: The issue occurs when Version 3 T.38 fax is enabled. In such a case, in case a CED 2100 Hz is sent by the SBC to G711 leg while it gets T.38 ANSAM packets from T.38 side, the DSP hardware stack can crash.

Steps to Replicate: The test setup to recreate this problem involves special SIPP scenarios and the SBC configuration.

The SBC is configured for the ingress as G711 and egress G711 with T.38 for Version 3.
Also configure the ingress PSP as transcode only and ensure that the codecs allowed for transcoding for ingress has G711 and egress has both G711 and T.38.

The code is modified by getting a third-party stack that has proper initializations and protection code to avoid a crash.

Workaround: N/A

An SCM process coredump occurred on the SBC in sensitive mode, while running a call flow with 12 codecs over a GW signaling call flow.

Impact:The SCM process experienced a coredump.

Root Cause: In the SgCondenseAudioWildcard, scenarios may occur where the audioEnd and audio1 have the same IP address.

Steps to Replicate: Run an SBC call flow with 12 codecs with the GW signaling and configure the system in sensitive mode.

The code is modified to remove the equal condition between audioEnd and audio1.

Workaround: Configure the SBC in normal mode.

Observed DSP coredumps and MAJOR logs on 7000 Platform while running ICM Scaling suite.

Impact: The DSP coredumps were observed during the switchover tests.

Root Cause: Certain variables used in the interrupt context were not protected while being modified outside the interrupt. This impacted the inter-core health-check logic at DSP and incorrectly led to error being reported, eventually leading to core-dump.

Steps to Replicate: HA Pair of fully loaded SBC-5100/5200/5110/5210/5400/7000

1. Run a transcode load.
2. Initiate a switchover.

The code is modified so the variables are protected from interruption.

Workaround: N/A

Portfix SBX-99020 (originated in Release 9.0.0): Observed Major logs with the error prints of 488 on the SBC 5210 platform while running direct media.

Impact: Calls stop working as the LIF bandwidth is not freed.

Root Cause: In case of a multi-stream direct media call with the last media stream as non-RTP stream, the SBC does not release the session bandwidth even when the call is released. This leads to a leakage in the interface bandwidth resulting in call failures after some time.

Steps to Replicate: Run direct media calls with multiple streams with last media stream as a non-RTP stream (BFCP, MSRP).

The code is modified to release the session bandwidth even when the last media stream is non RTP stream in a direct media call.

Workaround: N/A

A BYE message was sent to the wrong port.

Impact: The SBC does not update remote connection address when refresh INVITE is received from different port.

Root Cause: When the endpoint is registered over TLS initiating a call and after the call is established, the endpoint sends a refresh register from a modified port. When a refresh INVITE is sent with no SDP change, the SBC does not send BYE to a modified port when the call disconnects.

Steps to Replicate: 

1. Register endpoint over TLS.
2. Endpoint initiates a call, call gets connected.
3. Endpoint sends refresh register from modified port.
4. Endpoint sends refresh re-INVITE from modified port.
5. Called party disconnects the call.
6. Verify that the SBC sends BYE to modified port towards caller.

The code is modified to ensure the SBC updates the remote address when a refresh INVITE is received from a modified port.

Workaround: N/A

Portfix SBX-99791 (originated in Release 9.0.0): The AddressSanitizer detected a heap-use-after-free on the address 0x62a000396280 at pc 0x563d8352c45c bp 0x7f03c92740b0 sp 0x7f03c92740a8.

Impact: On the D-SBC setup, when disabling the signaling port used for the SBC to the M-SBC communication and then making further configuration changes it was resulting in an invalid memory read.

Root Cause: When the signaling port was disabled, the code was freeing up a list of sockets that were using the port. However, it did not set the primary socket pointer to be NULL when the associated socket memory was freed up. This resulted in an invalid read when trying to re-enable the signaling port.

Steps to Replicate: This issue is only highlighted in the lab when using ASAN enabled images and then disabling the signaling port and making further configuration changes.

The code is modified to ensure that the internal pointer to the primary socket used for the connection is set to NULL when the socket memory is released.

Workaround: Do not disable the signaling ports.

Portfix SBX-100650 (originated in Release 8.2.2): The INVITE with replaces failure for the G722 only call.

Impact: Originally, the SBC/GSX only supported a small subset of codecs, such as G711, G711_SILENCE_SUPPRESS, G723, G729A, G729AB, FAX_RELAY, G723A, G726. Then, additional codecs including ILBC/G722 were added in. When these new codecs were added, the SBC/GSX started to pass a flag to the PSX that is supporting the new codecs. This indicator bit is only being passed up when processing an INVITE and not when processing a REFER message. This can result in call failures when processing REFER messages if the Packet service profiles used for the new egress call leg only support codecs that are not in the list above because the PSX drops any other codecs since the REFER does not indicate the newer codecs are supported.

Root Cause: The REFER call handling fails when only G722 codec is selected in the packet service profile for all the required routes.

Steps to Replicate: Configure a call flow where the ingress and egress trunk groups only support G722 set up the A to B call and then try to do a REFER to C that should exist on either the ingress or egress trunk group.

The code is modified to pass the indicator to the PSX when processing the REFER that the SBC supports in newer codecs.

Workaround: N/A

Portfix SBX-99773 (originated in Release 9.0.0): The ASAN detected a heap-buffer-overflow in the Ss7LibGenerateCarrierCode while running a SIP to SIP-I call with PCV header.

Impact: For the Customer ISUP when the code was generating the carrier information transfer (CIT) parameter, it was reading off the end of an allocated memory buffer.

Root Cause: If the PSX does not provide the carrier code information to include in the CIT parameter, the SBC was not allocating a large enough memory block. The memory block was used to hold the potential CIT parameter being generated. The SBC was reading of the end of the memory block at the position where the CIT parameter would have been, to decide if a carrier code had been generated.

Steps to Replicate: This issue is only reproduced when running call flows with ASAN images in the engineering lab, it was observed when running regression for ttc-charging parameter in the P-charging-vector header.

The code is modified to avoid reading off the end of the memory buffer.

Workaround: N/A

Portfix SBX-99457 (originated in Release 9.0.0): The AddressSanitizer detected a heap-use-after-free on address 0x6070001153f0 at pc 0x5588611ec65d bp 0x7fbd2d86daa0 sp 0x7fbd2d86da98.

Impact: In an M-SBC deployment when making the M-SBC out of service (such as 'set global system action force mode outOfService'), the code was accessing free memory.

Root Cause: As part of the deactivation process, the M-SBC memory block was getting freed up in a child function. The parent function still had access to the pointer, and was reading from it on returning back up the stack.

Steps to Replicate: This issue is only highlighted in engineering lab when using ASAN images and taking the M-SBC out of service.

The code is modified to avoid reading from the memory block after it is free.

Workaround: Do not take M-SBC out of service.

Portfix SBX-100624 (originated in Release 8.2.0): The trunk group routing was not working when a SIP-I call is received.

Impact: The tgrp/trunk-context information in the R-URI and contact headers of an INVITE are not passed to the PSX/ERE as the originating and destination trunk group parameters if the INVITE contains ISUP MIME content.

Root Cause: The parameter were only being processed when there was no ISUP MIME content. There was not prior requirement for them to be used with ISUP MIME content.

Steps to Replicate: Send an INVITE message to the SBC that contains ISUP MIME contact as well as tgrp/trunk-context parameters in the R-URI | contact header and ensure they appear in the INPUT DATA section of the policy request.

The code is modified to process the tgrp/trunk-context information in the R-URI and contact headers and pass up in the policy request to PSX/ERE.

Workaround: The SMM can be used to convert the tgrp parameters to DTG/OTG parameters that are supported with SIP-I content.

Portfix SBX-101547 (originated in Release 8.2.2): On a switchover, a coredump occurred after a call was placed on hold.

Impact: The code was dereferencing a NULL pointer and causing the SCM process to crash.

Root Cause: The customer had the passThruPrivacyInfo control enabled on both the ingress and egress privacy profiles. But the ingress side of the call did not pass through some expected information related to the INVITE message and it caused the code to dereference a NULL pointer.

Steps to Replicate: Unable to reproduce this issue, the code has been fixed based on code review and coredump analysis.

The code is modified to validate the pointer is not NULL before trying to use it.

Workaround: Disable the passThruPrivacyInfo controls.

Portfix SBX-98991 (originated in Release 9.0.0): The AddressSanitizer detected a global-buffer-overflow on the address 0x55c93b015fa4.

Impact: While checking for two IPs in the same direct media NAT table, the code was reading off the end of an internal buffer.

Root Cause: While trying to process the net mask for the IP addresses, the code was using an index of 33 and reading of the end of the internal table with 32 entries.

Steps to Replicate: This issue is only highlighted in the development lab when testing direct media NAT call flows with an ASAN enabled build. 

The code is modified to no longer read of the end of the table.

Workaround: N/A

The SBC failed to send ACK to the right IP.

Impact: After a call was connected with egress received RR in 2xx, the SBC sends a reInvite, and received the rexmit of 2xx. Later on, the SBC sends ACK to the wrong destination.

Root Cause: A rexmit of 200OK, accidentally deletes the previous RR.

Steps to Replicate:

1. A calls B.
2. B responds with a 200OK with RR.
3. A reInvite triggers the SBC reInvite to B.
4. B responds with 2xx and rexmit 2xx.
5. The SBC sends ACK to the wrong destination (based on contact not from previous RR received).

The code is modified so the SBC ignores updating the data of the dialog.

Workaround: N/A

The SIPFE lookup returned the rcb pointing to wrong SCM post-upgrade.

Impact: After an upgrade, registrations mirroring on SIPFE is corrupted. As a result, incoming traffic for the AOR that may route to the wrong SCM and rejected by the SBC.

Root Cause: The packing redundancy data structure that was sent to the standby were incorrect due to word alignment issue (using sizeof() to pack the data).

Steps to Replicate: Multiple of the same AOR registers from a different source. After an upgrade, call for register end point may route to the wrong SCM.

The code is modified to re-implement the packing logic and avoid using sizeof() to calc the size of data structure.

Workaround: N/A

Portfix SBX-100223 (originated in Release 7.2.2, 7.2.4): The SMM for changing the ISUP message inside a SIP-I does not work properly.

Impact: When a message is received with the mime content having single msgbody. After the SMM application on the message body, the SBC reformats it as a normal msgbody instead on mime content.

Root Cause: When a message is received with the mime content having single msgbody. After the SMM application on the message body, the SBC reformats it as a normal msgbody instead on mime content. The reformatting is not handled properly.

Steps to Replicate: Add the SMM rules that applies to the message body. Send a message with mime content having single msgbody in it.

The code is modified so that the SBC reformats mime body after the SMM application is formatted correctly.

Workaround: N/A

The P-Early-Media header with sendrecv was sent back to the ingress before the SDP was established.

Impact: When the makeInBandToneAvailable is disabled, on Tone And Announcement profile, the SBC sends the 180 Ringing with the PEM header as sendRecv even when the egress 180 has no SDP. This causes ring back issues on the ingress endpoints.

Root Cause: When the makeInBandToneAvailable is disabled, the SBC does not include SDP in the 180 message sent to the ingress but still sends a PEM header as sendRecv.

Steps to Replicate: With a fix, the SBC is sending PEM header as inactive when the makeInBandToneAvailable is disabled and the egress 180 Ringing has no SDP.

The code is modified to ensure the SBC sends PEM header as inactive when the makeInBandToneAvailable is disabled and egress 180 Ringing has no SDP.

Workaround: Enable the makeInBandToneAvailable on Tone And Announcement Profile.

Portfix SBX-101145 (originated in Release 8.2.1): The SBC is not sending the 183 (Dialog-2) to the ingress when the Downstream Forking and Loopback TG is configured.

Impact: The SBC is not sending the 183 (Dialog-2) to the ingress when preconditions and  Downstream Forking and Loopback TG is configured.

Root Cause: The preconditions are not handled in the ccE8S4 state when cc receives proc_msg.

Steps to Replicate: Configure preconditions, downstream forking and loopback TG. The egress leg receives a 183 for second dialog from UAS.

The code is modified to send the 18x message towards the ingress.

Workaround: N/A

The code is modified by getting a 3rd party stack that has the proper initialization and protection code to avoid a crash.

Workaround: N/A

Portfix SBX-99982 (originated in Release 9.0): Observed the SCM process core on OpenStack T-SBC while running load.

Impact: Observed the SCM process core on OpenStack T-SBC while running load.

Root Cause: Missing the NULL check for the epRes before invoking IS_RES_AUDIOLESS,

Steps to Replicate: The steps cannot be reproduced.

The code is modified to add the missing NULL checks in all the places in NRMA for epRes before invoking the IS_RES_AUDIOLESS.

Workaround: N/A

Portfix SBX-93697 (originated in Release 8.2.0): The PRS process cored on the M-SBC

Impact: The SCM coredump occurred when running the following test suite SBX-56559/Interwork P-Early-Media with a network that does not support the P-Early-Media and Relay.

Root Cause: The length of the string is not enough for logging and is causing the issue.

Steps to Replicate: Configure the system in sensitive mode and run the following test suite 56559/Interwork P-Early-Media with network that does not support P-Early-Media and Relay.

The code is modified to fit the required size and fix the issue.

Workaround: Configure the system in normal mode.

A SCM leak on the Standby.

Impact: The SCM may leak memory in calls with a SIP Relay and FQDN. The memory used to store the Domain information may be leaked.

Root Cause: There is an edge case where the memory used to store the Domain information for a SIP Relay call is not being freed.

Steps to Replicate: This issue has been found by a code inspection and the steps to reproduce this case have not been identified.

Platform/Feature: SBC

Portfix SBX-94512: The RTCP packets count is not getting populated consistently in the callMediaStatus.

Impact: With the RTCP relay monitoring feature, sometimes the RTCP packets are not relayed or discarded.

Root Cause: In the SWe NP, due to endian alignment code issue, the RTCP mode configuration flags were not set as per the call flows enable/modifications.

Steps to Replicate: This is sporadic, when multiple times RTCP REL MON call flows, modifications tried it might occur.

Platform/Feature: SBC

The SipSgProcessRelayRequestPrimitive: relay an INVITE without the cpcOrigMsgInfoPtr.

Impact: A increase in the DBG logs filling up with SipSgProcessRelayRequestPrimitive messages.

Root Cause: In case of an End2End Re-INVITE, the log message does not have any impact.

Steps to Replicate: The log level changed on the basis of code analysis and description.

Platform/Feature: SBC

A large increase in sonusSbxSscsRouteFailureWithoutGapNotification2 traps.

Impact: When the PSX has more than 10 routes configured and the SBC receives those routes in multiple PSX responses and if all the routes fail, the SBC still makes additional diameter query towards the PSX. This causes the PSX to send an error: No Routes in Cache to the SBC. The SBC logs a trap after receiving No routes in the cache error.

Root Cause: The SBC makes an additional query to the PSX even after the PSX sent all the routes.

Steps to Replicate:

1. Configure more than 10 routes on the PSX Routing Label (11 routes for example).
2. All 10 routes fail.
3. The SBC sends another query to get more route and those fail as well.
4. The SBC still send additional query to the PSX which fails because the PSX have returned all the

Platform/Feature: SBC

Portfix SBX-93967: Direct dial to a call queue, and then transfer to agent fails.

Impact: For the PSTN to Teams calls, when Teams was triggering an INVITE with replaces, perform a subsequent REFER. The SBC was not relaying the REFER-TO information from the REFER message to the subsequent INVITE. This was resulting in the wrong information being sent back to MS Teams and the call failed.

Root Cause: The SBC was not relaying the REFER-TO information from the REFER message to the subsequent INVITE.

Steps to Replicate: In a MS Teams setup run a call Q and transfer scenario where the call originates from the PSTN side.

Platform/Feature: SBC

External PSX became active after a switch over, though it was the OOS prior to the switch over.

Impact: When changing the multiple remote policy servers' mode together in one "commit", some of the server's operational stats in the standby node might not be synced.

Root Cause: When one of the remote policy servers' mode was being changed from the OOS to active, the standby node will not try to register with this server, and the iteration of all mode change servers will be stopped. This causes the rest of the servers, whose operStats have not been changed and remain unchanged. Therefore, the operStats of these servers at standby node will be out of sync with the active node.

Steps to Replicate:

1. In a working HA, provision at least 3 working remote policy servers.
2. While keeping the admin stat at enabled, only keep 1 of the servers mode as active, and rest are out of service.
3. Change those servers' mode, commit only after all the set commands finished.
4. Display the status using the 2 commands below:
   "show table system policyServer remoteServer"
   "show table system policyServer policyServerStatus"
5. Perform a switchover.
6. Repeat step 4. The operStat will be different from step 4.
7. Making call load, may be a load call rate, when the Node A is active, and then when the Node B is active. When the Node B is active, the policy request may still be sent to the remote server that you have already made the OOS when the Node A was active.

Platform/Feature: SBC

Calculated the size of a buffer as too small and error logs were being generated post upgrade.

Impact: Removes this incorrect log message:

SipsRedGetCallControlSizeCmd()
Minor .SIPSG: *SipsRedMirrorCallControlCmd: Potential for buffer
format ERROR. Available:16076 Calculated:383 Packed:277

Root Cause: This message is logged incorrectly when the code is calculating the size for a Redundancy message.

Steps to Replicate: The steps cannot be replicated.

Platform/Feature: SBC

The code is modified to remove this incorrect log message:

SipsRedGetCallControlSizeCmd()
Minor .SIPSG: *SipsRedMirrorCallControlCmd: Potential for buffer
format ERROR. Available:16076 Calculated:383 Packed:277

Portfix SBX-93456: The SWe NP worker has a segfault.

Impact: There is an issue in the SBX-93456, where the SWe_NP was crashing multiple times due to the skb_work->skb corruption.

Root Cause: There is a point in normal media processing ( RTP and RTCP path), where an update to skb_work->skb from addr_ptr that is not necessary, may corrupt the skb_work->skb.

The corruption occurs in the path of processing RTCP XR packets, where the addr_ptr moves ahead by a few bytes, but the UPP processing expects the mbuf address to be present back at the 58 bytes from addr_ptr.

Steps to Replicate: Run JIO scenarios.

Platform/Feature: SBC

The RTP Inactivity Timer fires early upon performing a port switch-over on the M-SBC.

Impact: If a call starts out with no RTP packet at all, the RTP Inactivity Notification is triggered earlier than the configured threshold. This is only observed on the SWe SBC.

Root Cause: The timestamp used for inactivity detection is not set when the media resource is enabled in the network processor code.

Steps to Replicate: Run a test that establishes a call where the ingress peer does not send RTP. There are no switchovers or other events and the calls are disconnected before the timer expires. The timer is set to 30 seconds.

Call service Duration with a disconnect 145.

Platform/Feature: SBC

The SBC fails to route in advance to the 13th route.

Impact: When the PSX has more than 10 routes configured and all routes in the first policy response fail due to an internal cause, the call fails because the SBC cannot handle more routes correctly.

Root Cause: When the PSX has more than 10 routes configured and all routes in the first policy response fail due to an internal cause, the SBC's NRMA subsytem returns with an allocation failure.

Steps to Replicate:

1. Configure more than 10 routes on the PSX.
2. Force a failure on the first 10 routes due to an internal error.
3. Verify the call gets established on the routes in second policy response.

Platform/Feature: SBC

Portfix SBX-91398: The ASAN heap-use-after-free on the address DnsClientQueryServerCmd.

Impact: The DNS client running in the SBC while trying to query the DNS server, tries to identify the transport protocol used. If the query fails on the first server, it accesses the first DNS server's data structure to get the type of transport protocol.

Root Cause: This issue was reported as part of the ASAN Testing on the DNS regression suite in the SBC lab.

Steps to Replicate: This issue was found while running the DNS regression test suites.

Platform/Feature: SBC

The SBC fails to relay the 4xx-6xx responses when the IPTG authentication is enabled - all SIP causes are mapped to the CPC176 CPC_DISC_TG_AUTH_FAIL.

Impact: When the IPTG authentication is enabled, the SBC maps all the 4xx-6xx SIP codes to the CPC 176. The SBC is unable to relay the cause code from the egress to ingress endpoint.

Root Cause: When the IPTG authentication is enabled, the SBC maps all the 4xx-6xx SIP codes to the CPC 176.

Steps to Replicate:

1. Egress sends the 183 Session Progress.
2. Egress sends the 486 Busy Here.
3. The SBC does not send the 486 Busy code to Ingress.
4. Instead, sends the 599 that is mapping of 176 ( CPC_DISC_TG_AUTH_FAIL, which is CPC code) to Ingress.

With a fix, the SBC sends the 486 buys to the ingress correctly.

Platform/Feature: SBC

The SAM Process cores when the SNMP walk commands are executed during the TLS load.

Impact: When the getTlsSessionStatus command is executed when the TLS load is running, it will result in a SAM Process core.

Root Cause: The issue is because the SIPCM expects the SSL_get1_session() to increment the reference count of the SSL socketPtr. After the SIPCM returns from the SSL_get1_session() tries to decrement, the reference count during the time the socketPtr was deleted by another thread, which results in a double free.

Steps to Replicate: The steps cannot be reproduced.

Platform/Feature: SBC

The SIP OPTIONS was not responding after a failover.

Impact: A syntax error message during a switch over is unable to respond.

Root Cause: Internal messages drop due to other subsystems not being ready to process the message. Subsequent messages are stuck in the queue.

Steps to Replicate: Simple ping Options messages during a switchover.

Platform/Feature: SBC

The IPv4 Path MTU Discovery (RFC1191) was not working.

Impact: The IPv4 Path MTU Discovery (RFC1191) does not work.

The SBC uses the MTU of the outgoing network interface as the Path MTU.
Without the fix, the SBC does not update the Path MTU properly even if a router in the path sends "ICMP Destination Unreachable Fragmentation Needed" message with a smaller Path MTU value. The large packets requiring fragmentation to fit the Path MTU from the SBC will not reach the SIP peer.

Root Cause: In performing a route/fib, lookup in the updating Path MTU from "ICMP Destination Unreachable Fragmentation Needed" message did not consider the ipInterfaceGroup and addressContext. This resulted in not updating Path MTU of the proper route entry to the peer.

Steps to Replicate: The SBC sends IP packets of a length 1500 bytes toward the SIP peer when a path to the peer has a smaller MTU (e.g. 1400 bytes). A router with the smaller MTU sends "ICMP Destination Unreachable Fragmentation Needed" to the SBC. The SBC, with the fix, adjusts the Path MTU, performs the fragmentation and sends fragments to the SIP peer.

Platform/Feature: SBC

The lwresd process on the active node is killed when a reboot is issued.

Impact: When a reboot is issued at the command prompt on the active node, the slwresd process is killed prior to it being properly shutdown. This causes a delay in reboot processing as the system goes through a fault recovery processes rather than an expedited shutdown.

Root Cause: The reboot wrapper that kills a non-SBC processes and using the drbd mount point was inadvertently killing the swlresd process.

Steps to Replicate: On the active CE, issue a reboot at a command prompt.

Platform/Feature: SBC

A large number of TLS error messages were in DBG log.

Impact: The following log message was filling logs due to being incorrectly logged at the MINOR level (when it should have been at INFO level):

Minor .SIPSG: sipsgUtils.c (-27373) 27050. SipSgLogLevel4: missing callId need to parse

Root Cause: The following log message was incorrectly being logged at the MINOR level (when it should have been at INFO level):

Minor .SIPSG: sipsgUtils.c (-27373) 27050. SipSgLogLevel4: missing callId need to parse

Steps to Replicate: The only change was to change a log message from MINOR to INFO - there was no testing necessary.

Platform/Feature: SBC

The code is modified to change the following log message from MINOR to INFO:
Minor .SIPSG: sipsgUtils.c (-27373) 27050. SipSgLogLevel4: missing callId need to parse

Portfix SBX-89018: The ASAN heap-buffer-overflow in the CpcOptionalParameterSave from the SipSgCopySipUrlToCpc

Impact: When an INVITE arrived to start a new call, the SIP service group control "callRouting useRouteSet" is set to the value of "received" to try and route the call based on the routeset in the INVITE. While processing the URI information in the header and trying to map it into internal structures, the code was reading off the end of a memory block. This setup can cause a crash if the memory block is at the end of the heap.

Root Cause: The code was trying to apply a 4 byte alignment to the internal parameter length after the memory had already been allocated. This meant that sometimes, the parameter length got set to a larger value than the memory block size.

Steps to Replicate: This problem was identified while running ASAN testing in the Ribbon lab and cannot be reproduced using normal images.

Platform/Feature: SBC

A backup/restore file cannot be downloaded from the EMA if the file name contains a dot (.).

Impact: A backup/restore file cannot be downloaded from the EMA if the file name contains a dot (.).

Root Cause: In the downloadSavedConfig block, making an API call both the time (Running on the SBC or running on the EMS).

Steps to Replicate:

1. Login into EMA.
2. Navigate to
   Administration -> System Administration -> Backup/Restore
3. Download the Backup file.

Platform/Feature: SBC: EMA

Portfix SBX-72499: The PesP cored on the active node.

Impact: The PesP cored on the active node.

Root Cause: The Ref count is getting incremented and once it reached the max value, it is becoming zero and destroying the object in one thread. At the same time, the other thread is accessing the object and crashing.

Steps to Replicate: Keep running calls for a longer time by using only one IpSignalingProfile.

Platform/Feature: SBC: Application, ERE

Portfix SBX-95097: The SBC is sending incorrect RACK in the PRACK for a Late Media Call.

Impact: The SBC is sending incorrect RACK in the PRACK for a Late Media Call.

Root Cause: Whenever the PRACK with SDP comes as an answer, the PRACK entry holding RSEQ details is not getting removed from the list while being sent out, because of any subsequent 18x/PRACK without SDP coming out at the same time; the SBC is adding old RSEQ in RACK.

Steps to Replicate: Late Media call with first 18x and PRACK with SDP followed by an 18x and PRACK without SDP.

Platform/Feature: SBC

Missing the Egress Response Code in the Field 59.19.

Impact: Egress error response code is not updated for the SIP response “487 Request Cancelled” in the field number 59.19 in ATTEMPT CDR record.

Root Cause: In the “487 Request Cancelled” case, because there is no CANCEL sent for the INVITE, the correct function is not called that is responsible for adding field number 59.19 in the ATTEMPT CDR record.

Steps to Replicate: Set up the SBC to make a simple call flow as below, and check the CDR for field 45.19/20 and 59.19/20:

UAC.xml SBX UAS.xml
| | |
| INVITE | |
|=======>| |
| 100 | |
|<=======| |
| | INVITE |
| |=====>|
| | 487 |
| |<=====|
| | ACK |
| |=====>|
| | |
|480 | |
|<=======| |
| ACK | |
|=======>| |

Platform/Feature: SBC

Portfix SBX-95749: The SBC is not adding the Contact header in the 200 OK of UPDATE for a session refresh UPDATE.

Impact: The contact header is missing in the 200OK sent by the SBC for a session refresh UPDATE (an UPDATE without SDP or an UPDATE with the same SDP as last SDP).

Root Cause: The contact header is missing in the 200OK sent by the SBC for a session refresh UPDATE (an UPDATE without SDP or an UPDATE with the same SDP as last SDP).

Steps to Replicate:

1. Enable the E2E Update.
2. Trigger an UPDATE without SDP or an UPDATE with same SDP as last SDP.

Platform/Feature: SBC

The SBC was using the incorrect SIP signaling port for the challenged SUBSCRIBE.

Impact: When the usePortRangeFlag is enabled, the SBC may use an incorrect SIP Signaling Port when handling a SUBSCRIBE request with an Authorization header, in the REGISTER - SUBSCRIBE scenarios when the initial SUBSCRIBE request is challenged.

Root Cause: When the usePortRangeFlag is enabled, the SBC may use an incorrect SIP Signaling Port when handling a SUBSCRIBE request with an Authorization header to the egress peer.

Steps to Replicate:

Provision the SBC to support CUCM (Cisco Unified Connection Manager) .
Ingress zone | sipTrunkGroup:
set addressContext default zone ZONE2 sipTrunkGroup SBXSUS4_LABSIP1 signaling registration requireRegistration required
set addressContext default zone ZONE2 sipTrunkGroup SBXSUS4_LABSIP1 signaling usePortRangeFlag disabled
set addressContext default zone ZONE2 sipTrunkGroup SBXSUS4_LABSIP1 signaling psxRouteForSubscribe enabled
commit

Egress zone | sipTrunkGroup:
set addressContext default zone ZONE4 sipTrunkGroup SBXSUS4_LABSIP2 signaling registration requireRegistration none
set addressContext default zone ZONE4 sipTrunkGroup SBXSUS4_LABSIP2 signaling usePortRangeFlag enabled
set addressContext default zone ZONE4 sipTrunkGroup SBXSUS4_LABSIP2 signaling psxRouteForSubscribe disabled
commit

set profiles signaling ipSignalingProfile DEFAULT_SIP commonIpAttributes relayFlags dialogEventPackage enable
commit

Perform REGISTRATION.

Perform a challenged SUBSCRIBE.

Platform/Feature: SBC

Co-existence of 4xx-6xx IPSP flag and Subscribe crankback is not working.

Impact: Out of dialog message fails to crankback when the relay 4xx-6xx is enabled.

Root Cause: The relay flag must not take precedent.

Steps to Replicate: Configure the crankback and enable relay 4xx-6xx flag. The subscribe response with failure must be able to crankback.

Platform/Feature: SBC: SIP

Portfix SBX-95941: An unknown header transparency flag interaction with Tagging.

Impact: STIR-SHAKEN related headers are duplicated when the STI service type is tagging and transparency is enabled.

Root Cause: This scenario was not handled when STIR-SHAKEN was supported in 7.2.0.

Steps to Replicate: STI Profile is assigned on Ingress and Egress TG, on Ingress STI Profile “Override P-Headers with configured values”  flag is enabled.

In egress IPSP (IPTG section) “Unknown header” transparency flag is enabled.

Platform/Feature: SBC

Portfix SBX-91996: The SBC fails to send a=fmtp parameter towards the UAC, when the SBC received a=fmtp parameter above a=rtpmap in the answer from UAS.

Impact: The SBC fails to send a=fmtp parameter towards the UAC, when the SBC received a=fmtp parameter above a=rtpmap for the Dynamic Payload in answer from the UAS.

Root Cause: When the FMTP line is received prior to the RTP line for a dynamic payload, Internal Logical issue is causing the issue. When the string holding FMTP line is terminated with \0, the SBC unable to parse manually.

Steps to Replicate:

Test Configuration:
==============

1. The SBC must be configured to handle the AMR passthru call.
2. The transcoding must be set as conditional.

Test Procedure:
=============

1. The UAC sends Invite with AMR WB codec.
2. The UAS sends 180 Ringing with AMR with following SDP:

m=audio 6084 RTP/AVP 106 100
a=fmtp:106 mode-set=0,2,5,7;max-red=0
a=rtpmap:106 AMR/8000
a=rtpmap:100 telephone-event/8000

Platform/Feature: SBC

Portfix SBX-93360: The SBC was sending an INVITE with the SRTP instead of RTP.

Impact: The SBC is sending the SRTP instead of RTP.

Root Cause: The intersection of working PSP and peer PSP does not take place in the stream absent case. The SRTP values are never updated.

Steps to Replicate:

1. Create a UAC with RTP.
2. Create two UAS with SRTP param.
3. Send a port =0 for hold response.
4. Check if the SBC is misbehaving while sending an INVITE to release hold from the far end.

Platform/Feature: SBC

Portfix SBX-71623: The SMM header criteria not matching complete header value.

Impact: The SMM header criteria was not matching complete header value, it is only checking for the value between <>.

Root Cause: The SMM value being checked is enclosed between <>.

Steps to Replicate: Write a criteria on the header value and the issue will be displayed.

Platform/Feature: SBC: Application

Portfix SBX-85852: The "Timeout detected -- Forcing read/write access" occurred during switchovers.

Impact: The message "Timeout detected -- Forcing read/write access" is observed during switchovers.

Root Cause: This message is logged on the NBI timer expiry (after 2mins) and configuration changes were allowed before the DBs are in sync. This occurs when standby initialization takes longer.

Steps to Replicate: Install the SBC with the fix build and perform a switchover. Ensure there is no timeout message and that configuration changes are allowed only after the DBs are in sync.

Platform/Feature: SBC

Disable media lockdown does not suppress the media lockdown re-INVITE when the SRTP is enabled.

Impact: If the SBC offers crypto, and peer does not reply with crypto in the answer, a re-INVITE is sent to lockdown the crypto attribute (no crypto). If NAT is enabled, there is one second media drop while re-learning for the new re-INVITE is happening. For non-NAT cases, nothing will be observable except for signaling change.

Root Cause: This issue was SBC's original behavior.

Steps to Replicate:

1. Setup the SBC so that it sends a crypto in offer.
2. In the answer from the peer - do not send any crypto attribute.

Without a fix, the SBC will send another re-INVITE if the fallback to unencrypted is allowed. With a fix, this extra re-INVITE will be suppressed.

Platform/Feature: SBC

The R-URI in NOTIFY messages was not using the correct port number in case of TLS.

Impact: The SIP NOTIFY messages relayed through the TLS, may contain a R-URI that uses the SIP signaling port number verses the TLS port number.

Root Cause: The relay software used the SIP signaling port number instead of using the TLS port number.

Steps to Replicate: The steps cannot be reproduced.

Platform/Feature: SBC: Call Control

When the SBC receives route header with a port and TLS, it increments the port number.

Impact: When the SBC receives route header with a port and TLS, it increments the port number.

Root Cause: The SipSgPopulateAndSendToEgress() incorrectly increments the TLS signaling port number, when an out-of-dialog SIP OPTIONS message being relayed contains a "transport=TLS" parameter in the top most ROUTE header, and TLS transport is used.

Steps to Replicate: When the SBC receives OPTIONS with the Route header, the SBC relays that OPTIONS to a Port+1.

Platform/Feature: SBC: SIP

The PrsP cored on the standby SBC node.

Impact: The standby PRS process core was triggered from the XRM, when processing the XRM_DEALLOCATE_CMD_MSG from the standby SIPFE before the XRM has received the RTM_SYNC_TO_ACT_START_NFY_MSG.

Root Cause: There were many registration bind timeouts reported on the active SIPFE that triggered deallocation of the registration blocks and closing of port range connections. An active SIPFE mirrored the port range connection close requests to the standby SIPFE that triggered XRM_DEALLOCATE_CMD_MSG being sent to the standby XRM. The bug was that active SIPFE used regular ICM alloc/send mechanism to send the redundancy requests while standby node was in the middle of sync to active node.

Steps to Replicate:

1. HA pair, SIP registration load test, with high number of registrations.
2. Cause registration binding timeouts.
3. Restart the standby node.

Platform/Feature: SBC

The 4 SCMs cored after switchover.

Impact: The SCMs have cored after a switchover.

Root Cause: There is a bug that allows the RTM to attempt to process the Call Audit fault while still in the STANDBY mode. Since the Call Audit fault must only be processed while in the Active Mode - this causes a core.

Steps to Replicate: The steps cannot be reproduced.

Platform/Feature: SBC

Portfix SBX-74922: Modem calls failing when the DSP engaged in the ingress SBC.

Impact: The Bell 103 Modems in a G711-G711 transcoded call does not succeed.

Root Cause: The SBC G711-G711 transcoded calls perform a DTMF detection and the removal operation that can falsely remove some short signals, which is fine for speech perception but can affect modem signals that have similar characteristics of some modem signals. The SBC has signal detector for more modern modem that send a 2100 Hz tone to precede actual modem transmission. Once that is detected, the DSP media handling disables the DTMF removal. The SBC, however, does not detect older modems that sends a 2225 Hz signal in the beginning.

Steps to Replicate: 

1. Make a G711-G711 forced transcoded call. Ensure that both legs have the DTMF remove enabled (dspchanstat).
2. Use modem2225g711.pcap that has the modem signal captured from the customer in the ingress.
3. Collect the media capture for the call and inspect the dspchanstat, as well as the output signal from egress.
4. The dspchanstat and faxconfirmed field show 0x0. Signal output shows drops in the FSK modem signal between 18.72 and 19.65.

Platform/Feature: SBC

Port the fix for SBX-86420 to 6.2 and 7.2 code branch.

Impact: Whenever the TLS transport is selected, the SBC is trying to increment FQDN port by 1. In this case, even when FQDNPort is Zero in SIPSG/SIPS, the port is incremented by 1. So the FQDN port is set 1 because of this SRV query is not sent to the DNS server.

Root Cause: Whenever the TLS transport is selected, the SBC is trying to increment FQDN port by 1. In this case, even when FQDNPort is Zero in SIPSG/SIPS, the port is incremented by 1. So the FQDN port is set 1 because of this SRV query is not sent to the DNS server.

Steps to Replicate:

1. Send an INVITE with the TGRP parameters in R-URI.
2. The SBC sends the TGRP information to the PSX.
3. The PSX does TGRP based routing and sends route.
4. The SBC must send the SRV query to the DNS to resolve port and IP details when egress peer is FQDN.

Platform/Feature: SBC

Portfix SBX-96170: When the SBC executes a "Teardown" to UPDATE request by the SMM, the To header and From header of response are malformed.

Impact: Write an SMM Rule to do a teardown on an UPDATE Request and Error Response has Malformed headers.

Root Cause: When a server request of UPDATE request is saved, optional headers are not being saved.

Steps to Replicate: Write a SMM rule to tear down update request with the 415 and the issue will be reproduced.

Platform/Feature: SBC

The direct media (release) not working, no x-dmi to BSFT in the 200 OK while the 18x has it.

Impact: The 200OK behindNapt and direct Media support is unable to treat as direct media.

Root Cause: The issue is due to an internal offer/answer update after the first 18x, the previous flags for behind NAPT was lost.

Steps to Replicate:

1. Ingress configuration behind Napt and direct Media support.
2. Egress sends the SRTP Invite and peer response 18x with non-secure RTP. Subsequent 18x/2xx sent to ingress is missing x-dmi line.

Platform/Feature: SBC: Media, Platform, SIP

To TAG broken when dialogTransp enabled and downStreamForking enabled.

Impact: When the dialog transparency, downstream forking and end to end PRACK is enabled, the SBC intermittently sends incorrect tagging in outgoing PRACK towards the egress.

Root Cause: A previous fix (SBX-63508) tries to address the scenario where downstream forking is enabled, dialog transparency is enabled and the 183 for the second dialog comes before PRACK when the first dialog is sent. But the pstCall structure was pointing to memory that may have been freed and re-used for storing some other SIP Message. So the To Tag sent from the SBC in an ACK message was incorrect.

Steps to Replicate:

1. Enable Downstream forking, dialog transparency and E2E PRACK.
2. Outgoing ACK from the SBC to egress has incorrect to Tag.

Platform/Feature: SBC: SIP

Portfix SBX-96448: ICE not getting completed when the simultaneous ringing is enabled.

Impact: When simultaneous ringing is enabled to multiple MS teams endpoints, in certain cases where the ICE STUN requests are received by the SBC before an SDP is received in signaling messages, ICE is not getting completed for the endpoint that answers the call resulting in media to and from that endpoint not flowing through the SBC.

Root Cause: The SBC answers the first STUN message with a use candidate and completes ICE learning for that endpoint. Subsequent stun messages from other endpoints with use candidate were answered but ignored for ICE learning.

Steps to Replicate: With simultaneous ringing enabled to two MS teams endpoints, initiate call through the SBC to MS teams and verify that irrespective of when the endpoint answers the call voice media can flow through the SBC. Test must be repeated around 10 times and call answered from a different end point each time.

Platform/Feature: SBC

Portfix SBX-95170: To allow early RTP ICE learning for the MS teams DLRBT media bypass scenarios.

Impact: In a media bypass call flow with the DLRBT enabled, if the MS Teams client takes a long time to answer the call, then the ICE processing does not complete. The MS Teams client never sends STUN with a useCandidate = 1 because it did not get responses to the previous STUN messages in the first ten seconds for the call.

Root Cause: For an outgoing call, the SBC was not enabling ICE learning and not responding to STUNs until an answer SDP is received.

Steps to Replicate: With MS Teams media bypass and DLRBT configuration on the SBC, make a call from PSTN to MS Teams and delay answering of the call for 30 seconds.

Platform/Feature: SBC

Upgrade set all the CNAM Trunks to a Subscribe Rate of 1.

Impact: When the LSWU upgrade is completed, the SIP Trunk Group CAC ingress/egress subscribeRateMax and subscribeBurstMax are over written with the registerRateMax and registerBurstMax values.

Root Cause: This is functionality that was added in the SBC V3.1 when the SIP Trunk Group CAC ingress/egress subscribeRateMax and subscribeBurstMax were first added (but the values were not set).

Steps to Replicate:

Configure SIP Trunk Group CAC ingress/egress subscribeRateMax and subscribeBurstMax, for example:
% set addressContext default zone ZONE sipTrunkGroup SIPTRUNK cac ingress callRateMax 1 callBurstMax 1 registerRateMax 1 registerBurstMax 1 callLimit 0 emergencyOversubscription 0 extendedEmergencyIpLimit 0 subscribeRateMax 10 subscribeBurstMax 20 otherReqRateMax unlimited otherReqBurstMax unlimited hpcOversubscription 0
% commit
% set addressContext default zone ZONE sipTrunkGroup SIPTRUNK cac egress callRateMax 1 callBurstMax 1 registerRateMax 1 registerBurstMax 1 callLimit 0 emergencyOversubscription 0 extendedEmergencyIpLimit 0 subscribeRateMax 10 subscribeBurstMax 20 otherReqRateMax unlimited otherReqBurstMax unlimited hpcOversubscription 0

Perform an LSWU upgrade.

See that the SIP Trunk Group CAC ingress/egress subscribeRateMax and subscribeBurstMax are now set equal to registerRateMax and registerBurstMax values.

Platform/Feature: SBC

After an upgrade, the SWAP partition has a wrong UUID.

Impact: The file /etc/fstab had an incorrect UUID for SWAP partition due to the timeout logs were seen on the boot-up.

Root Cause: As part of multiple upgrades going through different versions, the SWAP partition UUID has somehow been changed but the same is not reflected in fstab file.

Steps to Replicate: Install/upgrade to fix version and ensure there is no swap entry in fstab file and also there is no timeout logs.

Platform/Feature: SBC

The SMM writeCdr was failing to write to ATTEMPT CDR when acting upon 300 Multiple Choice.

Impact: The SBC is failing to write the SMM fields in the ATTEMPT CDR when acting upon the 300 Multiple Choice.

Root Cause: The code was missing to handle the SMM information for a Redirect Scenario in the CDR.

Steps to Replicate: Test Redirect cases, and ensure SMM CDR write operation is successful in ATTEMPT record.

Platform/Feature: SBC

Portfix SBX-94662: The SBC is unable to handle emergency calls (E911) when ICE is enabled.

Impact: When the call limit for ordinary calls is already consumed on a trunk group, a new 911 emergency call on that trunk group does not complete using the emergency call bandwidth if ICE is also configured on the trunk group.

Root Cause: An issue in software was not processing ICE data correctly when the call was transitioning from using ordinary bandwidth to using emergency bandwidth.

Steps to Replicate: With the SBC trunk group configured with ordinary call limit and additional emergency call limit and ICE enabled:

1. Establish as many calls as required routed via the trunk group to consume the ordinary call limit on that trunk group.
2. While the previous calls are active, initiate a new 911 emergency call to be routed via the trunk group and verify the call succeeds.

Platform/Feature: SBC: Media, SIP

Portfix SBX-96723: The Zone SMM Profile was not working when performing a sbxrestart/reboot.

Impact: The Zone SMM is not getting applied when performing a SBC restart.

Root Cause: The Zone SMM profile is not being restored during an SBC restart.

Steps to Replicate: Attach a Zone Profile with the fixed order, and run a call. The Zone SMM profile will be applied, and when performing a  SBC restart and running the call, the Zone SMM is not getting applied.

Platform/Feature: SBC

Portfix SBX-96937: Running the sysDump.pl on OpenStack restarts the SBC.

Impact: Running the sysDump.pl on the 8.2.0R0 release on the SBC OpenStack cloud platforms causes the SBC application to restart.

Root Cause: The openclovis is monitoring some files as markers, using notify and taking it down when the file open operations are done.

Steps to Replicate: Once the SBC application is up and running:

1. Run sysDump.pl and enter the default inputs.
2. The SBC application will not go down.

Platform/Feature: SBC

Portfix SBX-96939: The ImPr cored when the SBC was running a call load.

Impact: The SBC ImProcess cored when the LI server became unavailable.

Root Cause: When the LI server becomes unavailable and a large number of packets are queued up for that server, the ImProcess takes more than 10 seconds to clean up all those packets, and the process coredumps.

Steps to Replicate:

1. Establish a large number of LI calls.
2. Bring the LI server down.
3. Ensure that the ImProcess does not coredump.

Platform/Feature: SBC

7k DSP falsely detecting fax tone on music.

Impact: SBC falsely detects a modem tone (2100 Hz with phase reversals) for certain type of music.

Root Cause: Algorithm for modem tone detection first looks for 2100 Hz tone for 630 ms and a non-zero number of phase reversals. In certain type of rich harmonic tones, this results in large number of phase reversals. Typically for modem tones we expect no more than 2 phase reversals in 630 ms.

Steps to Replicate: Make g729 to g711 calls and stream the pcmu_stream1_withsilence3.pcap from the g711 leg.
Before a fix, a modem is detected on this signal as indicated in the dspchanstat.
tone2100PhaseRevCnt: 1.

Platform/Feature: SBC: DSP

The SBC does not send invite to subsequent routes in native forking when the SBC receives Invite with call-ID as "i".

Impact: An incoming short callId header "i" fails to send subsequent Invite for multi routes.

Root Cause: There was missing logic to look for callId header with a short name.

Steps to Replicate: Configure the native forking call and have incoming call with short name "i' for callId header.

Platform/Feature: SBC

TLS call failures were observed due to a port value set to 1 instead of 5061.

Impact: The SBC uses Port 1 for sending an INVITE out for the TLS protocol when the route header was received without a port.

Root Cause: The issue is because when the route header is received without a port in it, the SIPSG was incrementing the port for the TLS. Since the port was not received, the port received is considered as 0. For the TLS, increment by 1. When incremented, the port becomes 1 and this gets used for sending an INVITE that is resulting in calls failing.

Steps to Replicate: Send the Route Header without port Route: <sip:ipaddr:;lr>. The SBC will use port 1 for sending an INVITE that is causing the issue.

Platform/Feature: SBC

The code is modified to check when the port is received in route header or not.
If port is received, then increment the port for the TLS. If it is not received, then increment and allow the SIP stack to handle it.

Asymmetric PRACK Interworking was not working as described.

Impact: Whenever any codec entry is deleted from codec list in the PSP and in the PSX, it rearranges the codec list immediately. There will not be any empty codec entry in the list.

The same issue is in the ERE, so it can be treated as a bug in the ERE.

Root Cause: When any CodecEntry is deleted, it is not rearranging the CodecEntry, which causes a NULL value in that place.

Steps to Replicate:

1. Configure the CodecEntry1 ,CodecEntry2 to CodecEntry12
2. Delete any CodecEntry.

Result: The call will be successful.

Platform/Feature: SBC: ERE

Update scripts in the common/debian/install/sbx-install and orca/install.

Impact: Monit paths needed to be updated with the new definitions.

Root Cause: New definitions were introduced for monit paths.

Steps to Replicate: The steps cannot be replicated.

Platform/Feature: SBC

The LCA errors seen when the SBC is spawned.

Impact: A sbcDiagnostic.sh flags error in the LCA, because it greps for ERROR.

Root Cause: The keyKeeper.py prints in the lca.log ERROR whenever it is unable to delete a file that contains a pswd. The file may already be deleted or not even created, this may also throw error.

Steps to Replicate: Run the sbcDiagonostic.sh and check no errors are present from keyKeeper.py.

Platform/Feature: SBC

Portfix SBX-96471: While trying to become active on a switchover, the systrem rebooted since the DRBD could not be switched to the primary.

Impact: While trying to become active on a switchover, the systrem rebooted since the DRBD could not be switched to the primary.

Root Cause: The DRBD is configured so that whenever a low level error occurs, the DRBD will be detached and the dstate will become "diskless". This scenario was leading the standby for reboot.

Steps to Replicate:

1. Run "drbdadm detach mirror" on standby.
2. Perform a switchover.
3. The switchover will be successful.

Platform/Feature: SBC

Portfix SBX-70059: Support the HOLD/RESUME INVITE from the SIPREC SRS to pause and start pumping media towards the SRS.

Impact: With a second SIPREC server call hold, the RTP recording is not paused/stopped towards recording server.

Root Cause: With the RTCP snoop enabled, the NP API handler has an issue in handling the media snoop configuration update with a SIPREC hold.

Steps to Replicate: Test the SIPREC hold features with the RTCP snoop enabled.

Platform/Feature: SBC

Portfix SBX-90855: The ASAN has a new-delete-type-mismatch on the SrchCriteriaIb.

Impact: The ASAN has a new-delete-type-mismatch on the SrchCriteriaIb.

Root Cause: The srchCriteriaIbArray is a dynamically allocated array in the GUISERVER, but it was not released using delete, so it is reported by ASAN.

Steps to Replicate: Re-run the testcase in the ASAN build and verify that the issue is not reported again.

Platform/Feature: SBC

The IPACL causes a PRS deadlock.

Impact: The PRS process may coredump after the state disabling and enabling ACL rule(s), performing a switchover by powering the CE off immediately, and state disabling and enabling ACL rule(s).

Root Cause: The PRS used stale socket connections after the power off immediate switchover.

Steps to Replicate: Reproduce the PRS coredump issue by performing the following:

1. Create the ACL rule using the installed role active CE when the HA system is synchronized (full redundancy protection).
2. Perform a switchover to the installed roll standby CE.
3. Wait until the HA becomes synchronized (full redundancy protection).
4. Using EMA to installed roll standby CE:
   Disable the ACL rule
   Enable the ACL rule
   Disable the ACL rule
   Enable the ACL rule
5. Verify that the system is synchronized.
6. Power off the installed roll standby CE "Power Off Server - Immediate" using the BMC.
7. Using EMA to installed roll active CE:
   Disable the ACL rule
   Enable the ACL rule <--- PRS CORED

Platform/Feature: SBC

The SBC was not releasing the other leg when a call is disconnected during hold( MOH enabled).

Impact: The SBC was not releasing the other leg when a call is disconnected during hold( MOH enabled).

Root Cause: This is a race condition in the CC where the handler for the event ASG_DISC_CMD is not present, and for the CC state CC_VIRT_ESCR_VDREQ due the call being hung.

Steps to Replicate:

1. Make a TEAMS to PSTN call.
2. TEAMS holds the call (MOH).
3. TEAMS disconnects the call during MOH.

Platform/Feature: SBC

Portfix SBX-94562: The ASAN has a heap-buffer-overflow in the SipSgACDMNaptQualTblAddEntry.

Impact: There was a Heap Buffer Overflow in the function SipSgACDMNaptQualTblAddEntry().

Root Cause: The Memcpy is being used instead of StrnCpyZ().

Steps to Replicate: Run the PCR 5637 regression on an ASAN Build.

Platform/Feature: SBC

Portfix SBX-94402: The SBC was not throwing a parse error in TLS if the content-length is not sent in a PRACK message.

Impact: The SBC is not throwing a parse error when the content-length Header is not sent in PRACK request using the TLS transport.

Root Cause: Similar code is present in the TCP Transport but not in the TLS-TCP transport.

Steps to Replicate: 

1. Make a TLS call with the 100rel enabled.
2. Send PRACK without content-length header for 18x.

Platform/Feature: SBC

Portfix SBX-94403: Unable to establish the same number of sessions after the switchover.

Impact: Calls were getting cleared under load conditions after a switchover in the first gateway in a GW-GW setup.

Root Cause: When the sessionKeepAlive is set and when the SBC switched over, the SBC starts sending refresh INVITEs to the endpoints. Since this is a GW-GW setup, a newly active GW-1 will send call processing messages to the GW-2. There was an issue in call processing at GW-2 that resulted in call failures.

Steps to Replicate:

1. Create a SBC GW-GW setup and enable the sessionKeepAlive,
2. Establish a call load of more than 25K and once call is stable, perform a switchover at the GW-1.
3. Calls now start failing.

Platform/Feature: SBC

Portfix SBX-94389: When call transferring to the PSTN, the SBC was sending RTP/AVP instead of RTP/SAVP towards Teams in the ReINVITE.

Impact: The SBC was sending a Re-INVITE towards Teams with m= line protocol as RTP/AVP instead of RTP/SAVP. Because of this, Teams is sending a 488 call was failed.

Root Cause: After an abort_ann_tone event, the CC was not moving to cutthru mode.

Steps to Replicate:

1. The 'Announcement based tones' flag is enabled.
2. Make a call from the PSTN - Teams n/w.
3. After a call connect, a Teams user transfers the call to another Teams user, and the call will succeed.

Platform/Feature: SBC

The Scm Process coredumps when there is NO ROUTE from the PSX = 0.

Impact: The Scm process coredumps when there is a call clearing with "no route found" from the PSX/ERE.

Root Cause: There was a bug in the call disconnect handler that resulted in the Scm crash for a non-configured number.

Steps to Replicate: Run a basic SIP call with a non-configured number and the Scm Process must not crash while handling the disconnect.

Platform/Feature: SBC: Application

The early media PEM has a behavior issue if there is no PEM in 18x.

Impact: When the egress TG early media method is P Early Media and the P Early Media header is not received, the SBC does not send media to the ingress caller.

Root Cause: The audio data path mode is set to inactive for the PEM structure.

Steps to Replicate: 

1. PEM Header transparency is enabled and the egress TG configuration is listed below:

set addressContext default zone IPX_SIGNALING_VOLTE sipTrunkGroup 1009074301 media earlyMedia method pEarlyMedia
set addressContext default zone IPX_SIGNALING_VOLTE sipTrunkGroup 1009074301 media earlyMedia egressSupport enabled
set addressContext default zone IPX_SIGNALING_VOLTE sipTrunkGroup 1009074301 media earlyMedia defaultGatingMethod sendrecv
set addressContext default zone IPX_SIGNALING_VOLTE sipTrunkGroup 1009074301 media earlyMedia forkingBehaviour firstProvResponse

Call Flow: The 183 Session Progress from the egress contains SDP and no PEM header.
Issue: The SBC does not send media from egress to ingress and the caller receives dead air.

Platform/Feature: SBC

Portfix SBX-94324: In the SBC to GW to SBC scenario, the first SBC coredumps when the ingress invite contains four identity headers.

Impact: Making a GW-GW call that contains multiple identity headers will cause a crash.

Root Cause: There was a validation code to check that the internal CPC structures that carries the identity header information was correctly padded to a 4 byte alignment. This validation code was correct for one identity header but failed when more than one was present and as a result, triggered the system to crash.

Steps to Replicate: Send in an INVITE that contains two identity headers of type SHAKEN and route the call over a GW-GW connection to a second SBC.

Platform/Feature: SBC

Portfix SBX-98356: There was a SEGV on an unknown address 0x0000000000e5 (pc 0x5653a715fdde bp 0x7f84a52bfea0 sp 0x7f84a52bfe70 T9).

Impact: After a successful surrogate registration, if any configuration related to the IP Peers/TGs/Surrogate registration is deleted, the Scm Process will coredump.

Root Cause: The code was dereferencing a null pointer when the trunk group configuration data was no longer present and the surrogate registration response came back.

Steps to Replicate: Trigger the SBC to send out surrogate registration request and delete all the associated trunk group configurations before sending back a response from the remote server.

Platform/Feature: SBC

The trunks data cannot be displayed on the live monitor.

Impact: The Zone and Trunk Group based live monitor charts does not show any data if the trunk group name contains hyphen.

Root Cause: The Elastic Search interprets 'hypen' as a delimiter and as a result, the string is broken down into tokens for indexing. When a query is put in the ElasticSearch for data with trunkgroup name containing 'hyphen', no data is retrieved as the Elastic Search has stored the data not with the actual trunkgroup name but with tokens

Steps to Replicate: 

1. Create a trunkgroup with name containing hyphen.
2. Enable the Live Monitor.
3. Run Calls and wait for sometime.
4. Verify data is shown in Zone and Trunk Group based charts.

Platform/Feature: SBC

The ipRecMetadataProfile does not work for the request-uri in the V07.02.02.

Impact: INVITE SIPREC or SIPREC INVITE may not have a request-uri beta or core.

Root Cause: The logical error that access the wrong data structure.

Steps to Replicate: Configure the metadataProfile with a request-uri and enable the SIPREC on ingress.

Platform/Feature: SBC

The MAINTAIN ONLY CDR .ACT file extension during atomic write process was not utilizing the .TMP.

Impact: When the CDR files are copied to the remote server, the file is copied with a temporary extension .TMP. For some installations, the software running on the remote server moves those files with the .TMP extension before the SBC software renames them with an .ACT extension.

Root Cause: A temporary extension is used during the time files are copied to the remote server.

Steps to Replicate: Perform the following step:

1. Unhide debug
2. Set OAM accounting cdrServer admin primary useFilePostfix disable
3. Transfer a large file.

Note that the file that is being uploaded to the remote server has an ACT extension while it is being transferred.

Platform/Feature: SBC

A new option is added to fix the issue:

1. Unhide debug
2. Set oam accounting cdrServer admin primary useFilePostfix disable

By default, the useFilePostfix is set to enabled.

When set to disable, a temporary extension is not used when copying the file to the remote server.

The SBC application restarted twice.

Impact: The SCM cored due to a segmentation fault.

Root Cause: The SCM hit a segmentation fault due to an attempt to dereference a NULL pointer.

Steps to Replicate: The steps cannot be reproduced.

Platform/Feature: SBC

The PrsP cored on both the active and standby nodes at the same time.

Impact: The PRS process cored due to accessing a non accessible memory location while processing the MONSEC response from NP.

Root Cause: Based on the core analysis, the core dump was caused by an invalid MONSEC response from NP. There were many read media stats commands sent to NP at the same time with the MONSEC request. The response that was processing appeared like a valid PNPS_NP_RSP_RD_MEDIA_FLOW_STR response.Due to this observation, there may be some timing issue that sent media flow stat response to MONSEC.

Steps to Replicate: The steps cannot be reproduced.

Platform/Feature: SBC

The SBC adds a media IP address in the outgoing SDP although the call is a direct media call.

Impact: When a direct media is enabled when handling the re-INVITE from ingress endpoint without a SDP change, the SBC sends a 200OK answer to ingress with the SBC's own media IP address. This causes a one way audio issue.

Root Cause: When the direct media is enabled, while handling a re-INVITE relay transaction, the SBC does not update the SIPStack SDP correctly.

Steps to Replicate: 

Configure for Direct media and enable the e2e Re-Invite.

1. Send an Invite from A to B.

   
   

2. B sends a re-Invite to A.

   
   

3. A sends a re-Invite to B with SDP of 200 OK that is sent for previous re-Invite