Table of Contents

Click here to view and download a PDF copy of these Release Notes.

About SBC Release Notes

This release note describes new features, the latest hardware and software requirements, known limitations and other pertinent release information for the latest release of SBC Core.

Please note that all Ribbon bugs reported by customers on a given software release will be fixed in the latest release on that software release branch.

To view and download the latest End of Product Sale (EoPS) and other End Of Life (EOL) notices, navigate to the Resource Library on the corporate website (https://ribboncommunications.com/company/get-help/resource-library).

Release Notes Use and Distribution

Ribbon Release Notes are protected under the copyright laws of the United States of America. This work contains proprietary information of Ribbon Communications, Plano, TX 75023, USA. Use, disclosure, or reproduction in any form is strictly prohibited without prior authorization from Ribbon Communications.

Associated Ribbon Announcements

The following Ribbon announcements (formerly known as WBAs) are referenced in this release note:

Bulletin IDDescriptionFixed In Release
Warning-14-00020748

Verify system and databases are fully in sync prior to Live Software Upgrade (LSWU). Applies to all SBC platforms (HW, SWe, Cloud) except the SBCs deployed in a Distributed SBC (D-SBC) architecture.

N/A
Warning-21-00029972The SBC upgrade may truncate the SQL configuration database due to too many historical alarms.N/A


To view/download Ribbon announcements, do the following:

  1. Log on to the Ribbon Support Portal (https://ribboncommunications.com/services/ribbon-support-portal-login).
  2. From the Quick Access menu, click and download the "Ribbon Support Portal User Guide", and navigate to the "ANNOUNCEMENTS tab" section for instructions to search for and view announcements.

Problems or Questions

For problems or questions, contact the Global Support Assistance Center:

Ribbon Support Portal: https://ribboncommunications.com/services/ribbon-support-portal

Voice: +1-833-RIBBON1 (1-833-742-2661)

About SBC Core

The SBC Core platforms address the next-generation needs of SIP communications by delivering media transcoding, robust security and advanced call routing in a high-performance, 2RU, and 5RU form-factor devices enabling service providers and enterprises to quickly and securely enhance their network by implementing services like SIP trunking, secure Unified Communications and Voice over IP (VoIP).

For more product information, refer to the section About SBC Core in the main documentation space.

H.323-SIP and SIP-H323 Calls

When using H.323-SIP and SIP-H.323 call flows, an additional Re-invite/Update may get generated towards the SIP side. To suppress this, enable the IP Signaling Profile (IPSP) flag Minimize Relaying Of Media Changes From Other Call Leg at the SIP side.

Note

H.323 is not supported on SBC SWe cloud deployments.

Compatibility with Ribbon Products

Tip

When upgrading your network, ensure to upgrade each product to the most current release to take advantage of the latest features, enhancements, and fixes.

Info

For complete interoperability details between various Ribbon products, including backwards compatibility, refer to Ribbon Product Interoperability.

Refer to the SBC Core Portfolio Interoperability Matrix for the latest and minimum compatible product versions supporting this release.


New Features

New Features in Release 09.02.05R006

There are no new features in this release. 

New Features in Previous Releases

To view features in previous releases, refer to the following release notes:


Sample Heat Templates Included in This Release

To instantiate the SBC instances, the following templates can be used:

SBC Heat Templates

 Template NameDescription
heatRgNoDhcp.yamlUsed to instantiate no DHCP, IPv4 or IPv6 deployments. The template supports I-SBC, M-SBC, S-SBC, MRFP and SLB node types. This template includes instructions to enable port redundancy.
heatOamNoDhcp.yamlUsed to instantiate an OAM node.
heatRgNoDhcp-TSBC-template.yamlUsed to instantiate a T-SBC node.


Note

Example template files are packaged together in .tar.gz and .sha256 files separate from the SBC Core application installation and upgrade files:

  • cloudTemplates.tar.gz
  • cloudTemplates.tar.gz.sha256

SBC SWe Cloud Hardware and Software Requirements 

The system hosting the SBC SWe Cloud must meet the following requirements.

OpenStack

OpenStack Hardware

ConfigurationRequirement
Processor

Intel Xeon processors (Nehalem micro-architecture or above) with 6 cores and above (processors should support hyper-threading).

Note

Ribbon recommends Westmere (or newer) processors for better SRTP performance. These processors have the AES-NI instruction set for performing cryptographic operations in hardware. 

 RAMMinimum 24 GiB
 Hard DiskMinimum 100 GB
Network Interface Cards (NICs)

Minimum 4 NICs.

Note

Make sure NICs have multi-queue support which enhances network performance by allowing RX and TX queues to scale with the number of CPUs on multi-processor systems.

Note

The Intel I350, x540, x550, and 82599 Ethernet adapters are supported for configuring as SR-IOV and DirectPath I/O pass-through devices.

Note

The PKT ports must be 10 Gbps SR-IOV enabled ports.

Note

6 NICs are required to support PKT port redundancy.

Note

To configure VLAN on SRIOV and PCI Passthrough Ethernet interfaces, disable the Data Center Bridging (DCB) on the switch connected to the interfaces.

OpenStack Software

The SBC SWe supports the following OpenStack environments:

  • Newton with RHOSP 10 and RHEL 7.4
  • Queens with RHOSP 13 and RHEL 7.5
  • Train with RHOSP 16.1 and RHEL 8.2
Note

The SBC SWe was tested on OpenStack Queens with RHOSP 13 and RHEL 7.5.

S-SBC

The system hosting the SBC SWe must meet the following requirements to achieve the performance targets listed: 

S-SBC SWe Requirements
for 1000 CPS/120K Signaling Sessions 
Notes

32 vCPUs

Due to the workload characteristics, allocate 20 physical cores with two hyper-threaded CPUs from each core to the SBC.

128 GiB RAM

Must be Huge Page memory. The minimum page size is 2048 KiB, but 1048576 is recommended.

100 GB Disk

None

4 vNICs/6 vNICs

Attach MGT0 port to the Management VirtIO Tenant network.

HA port has to be on IPv4 VirtIO Tenant network.

Attach PKT0 and PKT1 ports to SR-IOV and Provider network.

Note

All NIC ports must come from the NUMA node 0. The S-SBC SWe instance is hosted on dual-socket physical server with 10 physical cores coming from each NUMA node.


M-SBC

M-SBC SWe Requirements
for 40K Media Sessions
Notes

16 vCPUs

Due to the workload characteristics, allocate 10 physical cores with two hyper-threaded CPUs from each core and from single NUMA node to the SBC.

32 GiB RAM

Must be Huge Page memory. The minimum page size is 2048 KiB, but 1048576 is recommended.

100 GB Disk

None

4 vNICs/ 6 vNICs

Attach MGT0 port to the Management VirtIO Tenant network.

HA port has to be on IPv4 VirtIO Tenant network.

Note

All NIC ports must come from the same NUMA node from which the M-SBC SWe instance is hosted.

OAM Node

OAM Node (minimum)Notes

4 vCPUs

None

16 GiB RAM

None

80 GB Disk

None

4 vNICs

None

I-SBC

I-SBC SWe RequirementsNotes

20 vCPUs


32 GiB RAM

Must be Huge Page memory. The minimum page size is 2048 KiB, but 1048576 is recommended.

100 GB Disk

None

4 vNICs/ 6 vNICs

Attach MGT0 port to the Management VirtIO Tenant network.

HA port has to be on IPv4 VirtIO Tenant network.


KVM/RHV

KVM/RHV Hardware

The following table lists the server hardware requirements.

Configuration Requirement
Processor

Intel Xeon processors (Nehalem micro-architecture or above) with 6 cores and above (processors should support hyper threading).

Note

Ribbon recommends using Westmere (or newer) processors for better SRTP performance. These processors have the AES-NI instruction set for performing cryptographic operations in hardware.

Note

The supported CPU Family number is 6 and CPU Model number must be newer than 26. Refer to the Intel Architecture and Processor Identification document for more information.


 RAMMinimum 24 GB
Hard DiskMinimum 500 GB
Network Interface Cards (NICs)
Minimum 4 NICs
Note

Make sure NICs have multi-queue support which enhances network performance by allowing RX and TX queues to scale with the number of CPUs on multi-processor systems.

Note

The Intel I350, x540, x550, x710, and 82599 Ethernet adapters are supported for configuring as SR-IOV and DirectPath I/O pass-through devices.


Ports

Number of ports allowed:

Warning

The SBC SWe software runs only on platforms using Intel processors. Platforms using AMD processors are not supported.

KVM/RHV Software

The SBC SWe requirements for a KVM hypervisor environment are shown in the following table:

SoftwareVersionTested or Qualified Version
KVM Module 3.10.0 or above3.10.0
QEMU Emulator  1.5.31.5.3
libvirtd (libvirt)1.1.11.1.1
virt-manager0.10.00.10.0

VMware

VMware Hardware

Warning

The SBC SWe software only runs on platforms using Intel processors. Platforms using AMD processors are not supported.

The following table lists the server hardware requirements:

SBC SWe for VMware – Server Hardware Requirements

 ConfigurationRequirement
Processor

Intel Xeon processors (Nehalem micro-architecture or above) with 6 cores and above (processors should support hyper threading).

Note

Ribbon recommends using Westmere (or newer) processors for better SRTP performance. These processors have the AES-NI instruction set for performing cryptographic operations in hardware.

Note

The supported CPU Family number is 6 and CPU Model number must be newer than 26. Refer to the Intel Architecture and Processor Identification document for more information.

Note

ESXi 6.5 and later releases require approximately 2 physical cores to be set aside for hypervisor functionality. The number of VMs which can be hosted on a server must be planned for accordingly.

 RAMMinimum 24 GB
Hard DiskMinimum 500 GB
Network Interface Cards (NICs)
Minimum 4 NICs, if physical NIC redundancy is not required.
Note

Make sure NICs have multi-queue support which enhances network performance by allowing RX and TX queues to scale with the number of CPUs on multi-processor systems.

Note
  • The following NICs are supported for configuring as SR-IOV and DirectPath I/O pass-through devices. SR-IOV is supported only with 10 Gbps interfaces (x540/82599/x710):

Intel I350, x540, x550, x710 and 82599, Mellanox Connect - 4x, Mellanox Connect - 5x, and CISCO VIC. 

  • The VMware Enterprise Plus license is required for SR-IOV.
Ports

Number of ports allowed:

VMware Software

Warning

Using older versions of ESXi can trigger a VM instance shutdown. To prevent this from occurring, you must upgrade the VMware ESXi -- refer to the End of General Support column on https://lifecycle.vmware.com/#/ for supported versions.

The following are the SBC SWe requirements for VMware ESXi environments:


SoftwareVersionTested and Qualified VersionFor More Information
vSphere ESXi

The version must be supported.

See the End of General Support column at  https://lifecycle.vmware.com/#/ for supported versions.

  • VMware 6.7.3 tested with virtual hardware version 14
  • VMware 7.0.2 tested with virtual hardware version 19
  • Customized ESXi images for various server platforms are available on VMware and hardware platform vendor sites.
    • These ensure that all the required drivers for network and storage controllers are available to run ESXi server.
    • Most of the customized ESXi images come with customized management software to manage the server running the ESXi software.
  • Customized ESXi images for HP ProLiant and IBM servers are available at:
vCenter Server
vCenter Server
Note

The VMware Enterprise Plus license is required for SR-IOV.


Requirements for Using the IaC Environment with SBC SWe

The following tarball file is required to use the Infrastucture as Code IaC environment to deploy SWe N:1 deployments on VMware:

  • raf-20.12-iac1.0_sustaining-240.tar.gz

The environment in which you place and expand the IaC tarball must include:

  • A Linux server running RedHat Enterprise Linux (RHEL), CentOS 7 or Debian 9
  • Python 2.7 or later
  • An internet connection for downloading and installing additional files that may be required for your deployment
  • Root access on the instance or ability to become root (for example, using sudo su -)
  • Access to the vSphere ESXi host IP from the Linux server where the IaC environment is set up.

For more information on IaC, refer to  Using the Ribbon IaC Environment to Deploy SBC SWe on VMware.

Required Software and Firmware Versions

The following SBC 5400 and SBC 7000 software and firmware versions are required for this release. For 5xx0, the BIOS is installed during application installation; whereas, for 5400 and 7000, the BMC/BIOS is included in the firmware package and installed during the firmware upgrade. 

Required Software and Firmware Versions

Components

Software/Firmware

Version

SBC Platform

  

SBC 51x0/52x0 BMC

V03.23.00-R000

Kernel: 3.10.108

Busybox: v1.27.2

Openssh: 7.9p1

Openssl: 1.0.2n

Lighttpd: 1.4.48-r0

Qualys security issues

Password encryption method is SHA512

Lighttpd is secured and supports only TLS1.2 cipher.

SBC 51x0/52x0 BIOSV2.7.0
SBC 5400 Firmware

BMC: V03.23.00-R000

BIOS: V1.18.0

SBC 7000 Firmware

BMC: V03.23.00-R000

BIOS: V2.14.0

SBC Application

 


Operating System (OS) Version

V08.02.04-R003
SonusDB

V09.02.05-R006

SBC Application

V09.02.05-R006


Note

The firmware package of SBC 5400 and 7000 includes BMC, BIOS, and other binaries. The firmware is upgraded from the BMC.

How to Verify Currently Installed Software/Firmware Versions

Use the EMA to verify the currently installed software and firmware versions.

Log on to the EMA, and from the main screen navigate to Monitoring > Dashboard >  System and Software Info.

Software Bundles

The following software release bundles are available for download from the Customer Portal:

  • SBC5x7x_9.2
  • SBCSWe_9.2

Download the appropriate software packages for your desired configuration from the Customer Portal (https://ribboncommunications.com/services/ribbon-support-portal-login) to your PC.


Note

Beginning with version 9.0, the pre-install script now uses the .sha256 checksum files when validating file integrity. Previous versions (7.x and 8.x) use the .md5 checksums.

SBC 5000 Series (51x0/52x0) Firmware

  • firmware-5XX0-V03.23.00-R000.img

  • firmware-5XX0-V03.23.00-R000.img.md5

  • bmc5X00_v3.23.0-R0.rom.md5sum

  • bmc5X00_v3.23.0-R0.rom

SBC 5400 Firmware

  • firmware-5400-V03.23.00-R000.img
  • firmware-5400-V03.23.00-R000.img.md5

SBC 7000 Firmware

  • firmware-7X00-V03.23.00-R000.img
  • firmware-7X00-V03.23.00-R000.img.md5

Note

Perform the Method Of Procedure (MOP) only for upgrading the FPGA image of an SBC 7000 DSP-LC card when the SBC 7000 DSP-LC FPGA version is 0x14. The MOP can be applied at any version time, with the only restriction being that the BMC firmware version is at least 1.25.0. However, if the SBC application is running version V05.01.00R000 or higher, then the DSPs will be set to disabled and transcoding and transrating calls will fail if the SBC 7000 DSP-LC FPGA version is 0x14. Therefore, it is necessary to upgrade the SBC 7000 DSP-LC FPGA if the version is 0x14, before upgrading the SBC to 5.1.0. However, the MOP can be applied if the application version is higher than 5.1.0. Click Here to view the 550-06210_DSP-LC_FPGA_Upgrade_MOP.

SBC Core Operating System Installation Package

The ConnexIP Operating System installation package for SBC Core:

  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.iso
  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.iso.sha256
  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.iso.md5


Note

 Once the ConnexIP ISO procedure is completed, the SBC application package is automatically uploaded to SBC platforms.

Release 9.2 OS Patches

Release 9.2 includes a new set of OS security patches, and also a new version of confD. Release 9.2.1 includes a new set of OS security patches including the fix for CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit).


SBC Core Application Package

The SBC Core application installation and upgrade package includes the files:

  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.qcow2
  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.qcow2.sha256

  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.qcow2.md5
  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.ova
  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.ova.sha256
  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.ova.md5
  • sbc-V09.02.05-R006.x86_64.tar.gz

  • sbc-V09.02.05-R006.x86_64.sha256
  • sbc-V09.02.05-R006.x86_64.md5

  • sbc-V09.02.05-R006.x86_64.signature

For detailed information on installation and upgrade procedures, refer to SBC Core Software Installation and Upgrade Guide.

Accessing Public Cloud Images

Error rendering macro 'excerpt-include'

User 'null' does not have permission to view the page.

https://rbbncustomerimagestorage.blob.core.windows.net/swe-initial-image-share/release-sbc-v09-02-05r006-04-12-23-20-24.vhd?st=2023-04-12T20%3A49%3A38Z&se=2023-10-11T20%3A49%3A38Z&sp=r&sv=2021-06-08&sr=c&sig=3AHFFhCd46pM2gHyoyoc4X7vh3teLgXyDrBw6MAu7dA%3D

Snapshot name: /subscriptions/ce8b3f68-2147-49db-acef-8da635e6960a/resourceGroups/SBC-Core-Images-RG/providers/Microsoft.Compute/snapshots/release-sbc-v09-02-05r006-04-12-23-20-24.snap

Ribbon OEM Host Operating System (ROHOS)

ROHOS is the hardened and tested Host OS that Ribbon provides for qualified servers. ROHOS is the operating system component of Ribbon "whole-box" offerings containing the server hardware, solution software, and operating system. 

The latest version of ROHOS is Version 02.04.01

Cloud Service Archive (CSAR) Packages for VNFM Deployment on OpenStack

These files are for SBC SWe deployments in the OpenStack cloud using VNFM.

For VNFM deployment, the VNF Descriptor (VNFD) file is provided in a Cloud Service Archive (CSAR) package for the type of SBC cluster being deploying. VNFs are independent and CSAR definitions are imported into the VNFM via an Onboarding mechanism. There is a procedure for producing the required CSAR variant, for different personalities (S-SBC, M-SBC), different interface types (virtio, sriov).

Files required for CSAR creation: 

  • createVnfmCsar.py
  • vnfmSol001VnfdTemplate.yaml
  • sbc-V09.02.05R006-connexip-os_08.02.04-R003_982_amd64.qcow2

For detailed information on installation and upgrade procedures, refer to SBC Core Software Installation and Upgrade Guide.

For details on CSAR creation, refer to Creating a CSAR Package File. 

Upgrade Notes

Warning

Using older versions of ESXi can trigger a VM instance shutdown. To prevent this from occurring, you must upgrade the VMware ESXi -- refer to the End of General Support column on https://lifecycle.vmware.com/#/ for supported versions.


Warning

A LSWU on an SBC 7000 should only be performed when the total number of active calls on the system is below 18,000. If the criteria is not met, a double failure during the upgrade may occur, thereby losing all active calls. If such a failure occurs, both active and standby SBC services will go down. Contact Ribbon Support immediately.

Warning

Customers upgrading from 9.2.2R1 using VMware or KVM need to run the following command as root user on both the active and standby instances:

touch /opt/sonus/conf/swe/capacityEstimates/.indexMarker

This is not required for upgrades from earlier releases.


Note

Once the installation or upgrade completes on the SBC SWe platform, the copy of the installation package (SBC Core Installation and Upgrade Package) is automatically removed from the system.


Note

Release 9.2 and later requires additional user account security practices for SBC SWe deployments in Openstack cloud environments. During upgrade of SBC SWe cloud instances deployed using Heat templates, you must use a template that includes SSH keys or passwords for the admin and linuxadmin accounts. The example Heat templates have been updated to include information on how to specify this type of data in the userdata section of a template.

Note

In order to take advantage of performance improvements due to hyper-threading refer to the following MOP to increase the number of vCPUs prior to SBC SWe (KVM Hypervisor or VMware) upgrades from pre-07.01.00R000 release to 07.01.00R000 or higher.

Note

The number of rules across SMM profiles in a system is limited to 10000, and the number of actions across profiles in a system is limited to 50000.

Ensure the above conditions are met before LSWU.

Note

In NFV environments, the method used for upgrades involves rebuilding the instance, which requires additional disk space on the host. The minimum disk space needed for this operation is listed in the table below.

Disk Space Requirements

Flavor

Extra Space Required (GB)

S-SBC80
M-SBC80
PSX-M360
PSX-S360
PSX-Test360
EMS_SA150

Note

SWe SBC software enforces I-SBC instances to run only with a single vNUMA node in order to achieve deterministic performance. SWe SBC VM having >8 vCPUs hosted on dual-socket physical server with VMware ESXi software needs to follow the steps below to correct vNUMA topology before upgrading to latest SWe SBC software: 

  • Check ‘numa.nodeAffinity’ settings on VM. It should be either 0 or 1 based on which NUMA node PKT ports are connected. The following command on ESXi host can be used to check PKT port NUMA affinity:

     vsish -e get /net/pNics/<PKT port name - vmnicX>/properties | grep "NUMA"

 If any of the above settings requires modification, follow the steps below on SWe SBC HA system:

  • Shutdown the standby instance.
  • If ‘numa.nodeAffinity’ settings are missing, add the following rows:

numa.autosize.once  = FALSE

numa.nodeAffinity’   =  0 or 1 (based on PKT port NIC affinity)

On ESXi 6.5 and above releases, vSphere web client can be used to add above rows under  Edit settings > VM options > configuration parameters > add parameters;

On ESXi 6.0 and below releases, it can be added under Edit > Advanced > general > configuration parameters > add rows using vSphere client.

  • Power-on standby instance.
  • Once standby instance is up and running, do manual switchover through CLI and repeat above steps to modify ‘number of virtual sockets’ , ‘numa.nodeAffinity’ and ‘numa.autosize.once’ settings.

For more information, refer to:

Note

Before beginning the upgrade on a SBC running code prior to 8.2R0, the following commands on all the DNS Groups needs to be issued if “ednsSupport” is enabled.

Failure statistics are not being mirrored correctly, and the LSWU state may stay in “syncing” if the “ednsFailures “ count is non-zero.

  1. Issue the following CLI command to clear the EDNS statistics for all DNS Groups in the system. 

admin@PLUM> request addressContext default dnsGroup DnsGrp dnsServerReset
reason DNS Server statistics are Reset
[ok][2020-11-06 04:08:13]
admin@PLUM> show status addressContext default dnsGroup DnsGrp
dnsServerStatistics 2

{ ipAddress 10.xx.xx.xx; queries 0; timeouts 0; errors 0; referrals 0; totalTcpConnection 0; tcpConnectionFailed 0; tcpConnectionSuccess 0; tcpConnectiontorndown 0; tcpFallback 0; ednsStatus supported; ednsFailures 0; }

[ok][2020-11-06 04:08:22]
admin@PLUM>

2. Disable the ednsSupport to stop mirroring of the statistics if the error count is constantly incrementing or likely to increase during the upgrade.

set addressContext default dnsGroup DnsGrp ednsSupport disabled

Note: The ednsServer stats will be lost/reset during the upgrade.

Note

If the TRF/MRB Features are configured and enabled – some calls are unable to be cleared post upgrade if using the TRF/MRB attributes.

The upgrade is successful and calls continue but some calls may fail to clean up release post upgrade. Session KeepAlive and RTP Inactivity functions will clean any stale calls.

Enable the sessionKeepalive or rtpInactivity monitoring to ensure that mirrored calls are cleaned up post upgrade. 

set addressContext default zone ZONE_AS sipTrunkGroup TG_AS_SIPP signaling timers sessionKeepalive <value>

OR

set system media mediaPeerInactivity <value>

set profiles media packetServiceProfile DEFAULT peerAbsenceAction peerAbsenceTrapAndDisconnect

Note

Upgrade from a pre 8.2 release with globalization support for registration enabled will see a registration drop during an upgrade.

If the following localNumberSupport is enabled, those registrations will be dropped after first switchover during LSWU.

% set addressContext <name> zone <name> sipTrunkGroup <name> signaling localNumberSupport <disabled | enabled>


Upgrade Information

Warning

Prior to performing an upgrade to this release, you must remove usernames that do not conform to the SBC user-naming rules to prevent upgrade failure. Upgrade can proceed successfully after removing all invalid usernames. The following user-naming rules apply:

  • Usernames can begin with A-Z a-z _ only.
  • Usernames cannot start with a period, dash, or digit.
  • Usernames can contain a period(.), dash(-), alphabetic characters, digits, or underscore(_).
  • Usernames cannot consist of digits only.
  • Usernames can contain a maximum of 23 characters.

The following names are not allowed:

tty disk kmem dialout fax voice cdrom floppy tape sudo audio dip src utmp video sasl plugdev staff users nogroup i2c dba operator

Note: Any CLI usernames consisting of digits only or not conforming to new user naming rules will be removed after performing a restore config. 

SBC SWe Pre-Upgrade Requirements

VM CPU Resource Allocation Requirements

CPU resource allocation requirements for SBC SWe VM are strictly enforced. You must review and verify these VM settings (including co-hosted VMs) against the documented "VM Configuration Recommendations" on the For VMware page in the Hardware and Software Requirements section before upgrading.

If you encounter a problem, correct the CPU reservation settings as specified in step 6 of the "Adjust Resource Allocations" procedure on Creating a New SBC SWe VM Instance with VMXNET3:

Set the CPU reservation for the VM so that it equals the physical processor CPU speed, multiplied by the number of vCPUs divided by two.

For example, a configuration of 4 vCPUs with a processor of 2.99 GHz CPU speed, reserve: 2992 * 4/2 = 5984 MHz

If the VM uses the same number of vCPUs as the number of physical processors on the server, this reservation may not be possible. In this case, reduce the number of vCPUs assigned to VM by one and set the CPU reservation to the appropriate value.

When using the show table system serverSoftwareUpgradeStatus command during the upgrade, the Standby server's LSWU status will always display "Upgrading" even though the upgrade may have failed due to host checker validation. To check if host validation failed for the Standby, check for HostCheck Validation Failed message in the upgrade.out log.

Disable Call Trace Feature Prior to LSWU/upgrade

As a prerequisite for SWe LSWU/upgrade, disable the Call Trace feature prior to performing the LSWU/upgrade and re-enable it once the LSWU/upgrade is completed.

Manually Check for Hostcheck Validation Failed message

Perform the following procedure on the Standby to check for the Hostcheck Validation Failed message in the upgrade.out log.

  1. Log on to ESXi of the Standby SBC SWe.
  2. Check in/opt/sonus/staging/upgrade.out (this log shows the Hostcheck Validation Failed error).
  3. Power off the VM.
  4. Reduce the number of vCPUs assigned to VM by one and set the CPU reservation to the appropriate value.
  5. Power on the VM. The SBC SWe successfully upgrades to the latest version 6.2.0. 
  6. Run the command show table system serverSoftwareUpgradeStatus to confirm the successful upgrade.
  7. Perform similar procedure for LSWU on Active.

Preparing for Upgrade (All Platforms)

Note

As of release 9.2.0R1, the Platform Manager (PM) runs an LSWU infrastructure, providing the ability to perform LSWU upgrades to later releases using the PM. However, this feature is not currently supported in 4.2.x releases and should not be used at this time.

Warning

Operators who are using the SBC to interoperate with MS Teams need to review and compare their configuration against the latest configuration guide, especially the SMM, as it might result in call failures after upgrade if the older SMM is left in place. For more information, refer to SBC 9.2 - MS Teams Solution Guide.

Supported Live Software Upgrade (LSWU) Paths

Attention

This release includes all bug fixes implemented in the releases which are documented in the Supported Upgrade Paths table of this release note.

To view bug fixes in previous releases, refer to the release note(s) of interest from the SBC 5xx0-7000-SWe Documentation Home page.

Note

The 7.x and 8.x software is EOSL as of Q3 2022.


The SBC Core supports Live Software Upgrade from releases listed in the table below:

Supported Upgrade Paths

 V07.00.00Rx -
V07.01.00Rx
V07.02.00Rx -
V07.02.01Rx
V07.02.02Rx -
V07.02.05Rx
V08.00.x -
V08.01.x
V08.02.xV09.00.x -
V09.02.01x
V09.02.02x -
V09.02.05x
V07.00.00R000V07.02.00R000V07.02.02R000V08.00.00R000 V08.02.00R000V09.00.00R000V09.02.02R001
V07.00.00F001V07.02.00R001V07.02.02R001V08.01.00R000V08.02.00F001V09.01.00R000V09.02.02R002
V07.00.00F002V07.02.00R002V07.02.02R002V08.01.00F001V08.02.00F002V09.01.00R001V09.02.02R003
V07.00.00F003V07.02.00S400V07.02.02R003V08.01.00R001V08.02.00R001V09.01.00R002V09.02.02R004
V07.00.00F004V07.02.00S401V07.02.02R004V08.01.00R002V08.02.00R002V09.01.00R003V09.02.02R005
V07.00.00F005V07.02.00S809V07.02.02R005V08.01.00R003V08.02.01R000V09.02.00R000V09.02.02R006
V07.00.00F006V07.02.00S810V07.02.02F001V08.01.00R004V08.02.01F001V09.02.00R001V09.02.02R007
V07.00.00S400V07.02.01R000V07.02.03R000V08.01.00R005V08.02.01F002V09.02.00R002V09.02.02R008
V07.00.00S401V07.02.01R001V07.02.03R001V08.01.00R006V08.02.01F003V09.02.01R000V09.02.02R009
V07.00.00S402V07.02.01R002V07.02.03R002V08.01.00R007V08.02.02R000V09.02.01R001V09.02.03R000
V07.00.00S404V07.02.01R003V07.02.03R003V08.01.00R008V08.02.02R001V09.02.01R002V09.02.03R001
V07.00.00S405V07.02.01R004V07.02.03R004
V08.02.02R002V09.02.01R003V09.02.03R002
V07.00.00S406V07.02.01F001 V07.02.03S400
V08.02.02R003V09.02.01R004V09.02.03R003
V07.00.00S407V07.02.01F002 V07.02.03S401
V08.02.02R004V09.02.01R005V09.02.03R004
V07.01.00R000V07.02.01F004 V07.02.04R000
V08.02.02R005V09.02.01R006V09.02.03R005
V07.01.00R001V07.02.01F005 V07.02.04R001
V08.02.03R000V09.02.01R007V09.02.03R006
V07.01.00R002V07.02.01S400V07.02.04R002
V08.02.03R001V09.02.01R008V09.02.03R007
V07.01.00R003 V07.02.01R005V07.02.04R003
V08.02.03F001V09.02.01R009V09.02.03R008
V07.01.00R004V07.02.01R006V07.02.04R004
V08.02.04R000V09.02.01R010V09.02.03R009
V07.01.00F001V07.02.01R007V07.02.05R000
V08.02.04F001
V09.02.04R000
V07.01.00F002V07.02.01R008V07.02.05R001
V08.02.04R001
V09.02.04R001
V07.01.00F003V07.02.01R009V07.02.05R002
V08.02.04R002
V09.02.04R002

V07.02.01R010V07.02.05R003
V08.02.04R003
V09.02.04R003


V07.02.05R004
V08.02.04R004
V09.02.04R004


V07.02.05R005
V08.02.05R000
V09.02.04R005


V07.02.05R006
V08.02.05R001
V09.02.04R006


V07.02.05R007
V08.02.05R002
V09.02.05R000


V07.02.05R008
V08.02.05R003
V09.02.05R001


V07.02.05R009
V08.02.05R004
V09.02.05R002


V07.02.05R010
V08.02.05R005
V09.02.05R003


V07.02.05R011
V08.02.05R006
V09.02.05R004


V07.02.05R012


V09.02.05R005

Security Vulnerabilities

The following security vulnerabilities were resolved in V09.02.05R000 with an OS patch update as of 8/12/2022:

CVE IDSeverityDescription
CVE-2017-12562CriticalHeap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVE-2021-39713CriticalProduct: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel
CVE-2022-29155CriticalIn OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping.
CVE-2022-1292CriticalThe c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
CVE-2022-1664CriticalDpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
CVE-2022-1968 HighUse After Free in GitHub repository vim/vim prior to 8.2.
CVE-2022-23038HighLinux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains wh  ich aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removi  ng access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malici  ous backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing   whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will alw  ays succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend ca  n keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus drive  r has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-230  36 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, us  bfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in   use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep a  ccess to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG  _ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which   can be triggered by the backend. CVE-2022-23042
CVE-2022-0413 HighUse After Free in GitHub repository vim/vim prior to 8.2.
CVE-2019-2201 HighIn generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. Th  is could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is n  eeded for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338
CVE-2022-0417 HighHeap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.
CVE-2022-1621 HighHeap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing   software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
CVE-2021-4156 HighAn out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted fi  le (via tricking a user to open or otherwise) to an application linked with libsndfile and using the FLAC codec, could trigger an out-o  f-bounds read that would most likely cause a crash but could potentially leak memory information that could be used in further exploita  tion of other flaws.
CVE-2021-23177HighAn improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the li  nk. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A loc  al attacker may use this flaw to change the ACL of a file on the system and gain more privileges.
CVE-2022-1898 HighUse After Free in GitHub repository vim/vim prior to 8.2.
CVE-2022-23039HighLinux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains wh  ich aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removi  ng access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malici  ous backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing   whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will alw  ays succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend ca  n keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus drive  r has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-230  36 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, us  bfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in   use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep a  ccess to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG  _ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which   can be triggered by the backend. CVE-2022-23042
CVE-2022-0443 HighUse After Free in GitHub repository vim/vim prior to 8.2.
CVE-2021-27219HighAn issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bi  t platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.
CVE-2022-0351 HighAccess of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
CVE-2020-1712 HighA heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while   handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and el  evate their privileges, by sending specially crafted dbus messages.
CVE-2021-26720Highavahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allo  ws a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon.   NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.
CVE-2022-1720 HighBuffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing t  he software, memory modification, and possible remote execution.
CVE-2021-3903 Highvim is vulnerable to Heap-based Buffer Overflow
CVE-2017-16932Highparser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
CVE-2022-23040HighLinux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains wh  ich aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removi  ng access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malici  ous backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing   whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will alw  ays succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend ca  n keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus drive  r has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-230  36 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, us  bfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in   use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep a  ccess to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG  _ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which   can be triggered by the backend. CVE-2022-23042
CVE-2022-23041HighLinux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains wh  ich aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removi  ng access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malici  ous backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing   whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will alw  ays succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend ca  n keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus drive  r has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-230  36 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, us  bfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in   use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep a  ccess to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG  _ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which   can be triggered by the backend. CVE-2022-23042
CVE-2022-23042HighLinux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains wh  ich aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removi  ng access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malici  ous backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing   whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will alw  ays succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend ca  n keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus drive  r has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-230  36 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, us  bfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in   use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep a  ccess to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG  _ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which   can be triggered by the backend. CVE-2022-23042
CVE-2022-1851 HighOut-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVE-2022-0572 HighHeap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVE-2022-23037HighLinux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains wh  ich aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removi  ng access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malici  ous backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing   whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will alw  ays succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend ca  n keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus drive  r has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-230  36 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, us  bfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in   use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep a  ccess to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG  _ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which   can be triggered by the backend. CVE-2022-23042
CVE-2021-27218HighAn issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4G  B or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.
CVE-2022-0943 HighHeap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
CVE-2022-2126 HighOut-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVE-2022-24958Highdrivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev-&gt;buf release.
CVE-2022-23036HighLinux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains wh  ich aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removi  ng access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malici  ous backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing   whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will alw  ays succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend ca  n keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus drive  r has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-230  36 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, us  bfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in   use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep a  ccess to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG  _ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which   can be triggered by the backend. CVE-2022-23042
CVE-2022-2124 HighBuffer Over-read in GitHub repository vim/vim prior to 8.2.
CVE-2022-21476HighVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported vers  ions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.  0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle   Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical dat  a or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java   deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted   code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by   using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidenti  ality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2017-5130 HighAn integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed   a remote attacker to potentially exploit heap corruption via a crafted XML file.
CVE-2021-31566HighAn improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flag  s of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when tryi  ng to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
CVE-2022-1616 HighUse after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, By  pass Protection Mechanism, Modify Memory, and possible remote execution
CVE-2022-0261 HighHeap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVE-2022-23308Highvalid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVE-2022-27223HighIn drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated   by the host for out-of-array access.
CVE-2022-1154 HighUse after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
CVE-2022-1619 HighHeap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are cap  able of crashing software, modify memory, and possible remote execution
CVE-2022-21426MediumVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2022-29824MediumIn libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
CVE-2022-21496MediumVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2018-1108 Mediumkernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
CVE-2019-19221MediumIn Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.
CVE-2021-4149 MediumA vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem.
CVE-2022-26691MediumA logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
CVE-2017-5969 Medium** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.  NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser."
CVE-2022-21434MediumVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2021-28153MediumAn issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
CVE-2016-9318 Mediumlibxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVE-2021-3468 MediumA flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.
CVE-2022-26966MediumAn issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.
CVE-2022-21443LowVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Security Vulnerabilities in Previous Releases

To view security vulnerabilities in previous releases, refer to the following release notes:

Resolved Issues

Resolved Issues in 09.02.05R006 Release

Severity 1 Resolved Issues

The following Severity 1 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-109466 | SBX-1239581

PortFix SBX-109466: Services are going down after SIP Adapter Profile creation

Impact: The CHM process could core when creating a new SMM profile via the EMA.

Root Cause: When the EMA creates the sipAdapterProfile and the rule comment is not set, the EMA sends a comment of undefined. When the CHM receives a notification of that change and the comment field was left blank, the CHM cores while displaying that field in the audit log message.

Steps to Replicate: 

  1. Log into the EMA as an admin user.
  2. Navigate to Profiles > Signaling > SIP Adaptor Profile.
  3. Click the "New SIP Adaptor Profile" button.
  4. Provide the following values:
    Name: testSP
    Profile Type: messageManipulation
    for: all me
    Type: Header
          store SIP Param
    named: testSP1
           store the: field value
    to the: local variable
           named: var1
  5. Click the "Save" button.


Expected Results: The SIP Adaptor Profile is created successfully.

Observed Issue: The SIP Adaptor Profile is created successfully but services go down.

The code is modified to allow the CHM code to check for NULL values.

Workaround: None.

SBX-1191031

Abnormally long duration when CDRs are generated for the I-SBC

Impact: Abnormally long duration CDRs are generated on switchover for calls that were previously released prior to switchover. A regular STOP record was generated on the active SBC, but on switchover, another STOP record was generated for the same GCID with a disconnect time as the switchover time.

Root Cause: While processing the call connect (sending 200 OK on ingress side) and call disconnect (receiving CANCEL) at the same time, CC believed the call was established and made the call data redundant. However, NRM never got to a stable state to make its data redundant. Owing to some CDR processing changes in 9.0 release, the standby CC did not clean up its data until it got a confirmation from NRM that it also cleaned up its standby data. When this did not occur, the CC was left with stale redundant data and resulted in an abnormal CDR getting generated on switchover due to call audit running.

Steps to Replicate: Run a continuous call load where the A-party is releasing the call at the same time as the SBC is sending out the 200 OK to answer the call.

The code is modified to check for inconsistencies in call data during redundant call terminations to avoid CC getting left with stale data.

Workaround: None.

SBX-1219691

Options PING receives Error: No clients are registered to process this request

Impact: Options PING receives the following error: "No clients are registered to process this request."

Root Cause: If the S-SBC or I-SBC is deployed in an N-1 configuration where N is greater than one, then the action command for the options ping is not registered.

Steps to Replicate:

  1. Install an N-1 system with two configured active S-SBC or I-SBC nodes.
  2. Input the following CLI command:
    request addressContext default cmds optionsPing peerIpAddress <address> 3 sigPort 3 peerPort <port>
  3. Verify that the a status response is received.

The code is modified to properly register the action command so that the first SCM process (CE_2N_Comp_ScmProcess_0) will register for the action command.

Workaround: Perform the options ping request on the first SBC node with a serviceId of "0."

SBX-1233761

Monitoring and the HistoryStatus alarm show a time jump in failover and SM process cores

Impact: A double failure occurs because both the active and standby encountered a Healthcheck at the same time while processing a user status command that only the active should process.

Root Cause: Both the active and standby encountered a Healthcheck at the same time while processing a user status command that only the active should process.

Steps to Replicate: The steps are not reproducible.

The code is modified to prevent the standby from processing the user status command.

Workaround: Increase the Healthcheck timers to every two seconds, which is released in release v9.2.3 and higher..

SBX-1235351

One-way audio observed after a second hold/offhold sequence

Impact: The SBC is not able to resume a g711 fax call with the silence suppression treatment set to FAX.

Root Cause: The off hold is suppressed by the fax treatment logic and results in the SBC responding locally.

Steps to Replicate: This is specific to a customer g711 call flow and its interaction with fax settings.

The code is modified to forward the new offer to NRMA for resuming the call, since the data path direction is different from the previous offer-answer.

Workaround: Turn off silence suppression using the following CLI command:

signaling silenceSuppTreatment treatAsG711SilenceSuppOff

SBX-1235711

An SBC switchover occurred due to an SCM process core

Impact: A pcrf call with many offer/answer exchanges (>10) between two legs may cause the SCM process to core.

Root Cause: The logic of adding the access-network-charging-info parameter to the PCV header continued increasing memory allocated for every SBC offer (re-INVITE), which caused memory corruption.

Steps to Replicate: Make a pcrf call and generate multiple ingress re-INVITES that are sent to egress more than ten times.

The code is modified to keep only one access-network-charging-info parameter in the PCV for re-INVITE.

Workaround: Use the following CLI command:

set media pcrf pcrfCommitment none

SBX-1238311

SWE ActiveProfile linux files are gone following openstack rebuilds

Impact: On a VM rebuild, 1-to-1 direct Cloud SBC fails to acquire the configuration related to the SWe traffic/config profile. 

Root Cause: The downloaded configuration (from EMS) was not parsed to fetch and apply the SWe traffic/config profile in 1-to-1 SBC scenario.

Steps to Replicate: 

  1. Launch Openstack with a 1-to-1 SBC configured to download the configuration from EMS.
  2. From the EMS, modify the SWe traffic profile configurations - both SBC instances will reboot upon applying the profile.
  3. After the reboot, once both SBC VM applications come up in sync, click "Apply saved changes and close" from the EMS dashboard. This will save the latest SBC configuration file in the EMS.
  4. Rebuild the standby instance with the same versioned image.

    Without the changes, the standby instance comes up with the default traffic profile.
    With the changes, the standby instance will come up with the latest activated traffic profile.

The code is modified to introduce configuration parsing logic for 1-to-1 direct SBC scenarios where the configuration is directly downloaded from EMS.

Workaround: Upon rebuild of the active/standby SBC, reactivate the required traffic profile once the application comes up in sync. Both the instances of the 1-to-1 SBC will reboot.

SBX-1238771

A customer outage for 3 minutes

Impact: The PRS cores as a result of the code accessing an invalid memory location.

Root Cause: The code attempts to access a structure that is not allocated yet. This is a very rare race condition that can occur when a specific timer expires shortly after a switchover.

Steps to Replicate: This problem is triggered by a race condition and is therefore not reproducible.

The code is modified to add a NULL pointer check to prevent the code from accessing invalid memory.

Workaround: None.

SBX-1238801

SBC sends INFO even though egress is not supporting

Impact: The SBC sends INFO to a peer which is not allowed to receive INFO.

Root Cause: The SBC was missing logic to check if the peer is allowed to receive INFO.

Steps to Replicate:

  1. Stage a call between A and B, with B disallowed from receiving INFO.
  2. A sends relay INFO to B.

The code is modified to add logic that checks if a peer allows INFO methods.

Workaround: Use SMM to respond to 200 OK for INFO.

SBX-1242111

Session Version not increased in 200 OK causing peer to drop the call

Impact: A call with the Selected Codec in Session Refresh may not increment the session version properly when sending the subsequent SDP.

Root Cause: When the SBC suppressed the codec due to the Selected Codec in Session Refresh, the internal flag did not reset properly which prevented the session version increment in response.

Steps to Replicate:

  1. A call B with multiple codecs (0, 18, 101) and with  Selected Codec in Session Refresh turned on at Egress. Called connect with codec (0, 101).
  2. B re-INVITE (0 101) to A triggers the SBC to answer with the same previous selected codec (0).
  3. B re-INVITE (0 18 101), and A answers 0 only.
    The SBC only sends 200 OK(0) and is not able to increment the session version.

The code is modified to reset the internal flag when the SBC sends SDP.

Workaround: Disable the Selected Codec in Session Refresh.

SBX-1244501

ImProcess cores frequently

Impact: The ImProcess cores when attempting to send a Redundancy message related to the PacketCable 2.0 Lawful Interception while the Mediation Server was unreachable.

Root Cause: A bug in the IM mirroring code caused memory corruption which results in a core. The code allocates a message buffer that is not large enough for the Redundancy message that will be written into this buffer. The causes memory corruption when the code writes past the end of the buffer.

Steps to Replicate: The bug was found by code inspection.

The code is modified to increase the size of the buffer for the Redundancy message to ensure that it is large enough for the data written into it.

Workaround: Make sure the Mediation Server is reachable.


Severity 2-4 Resolved Issues

The following Severity 2-4 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-120845 | SBX-1218363

PortFix SBX-120845: Daily logrotate job interrupts the SBC configuration export, which then never completes

Impact: The logrotate process interrupts the export of the configuration started through the EMA. The Export Configuration process does not successfully complete.

Root Cause: The logrotate process closes and reopens the apache logs by sending a HUP to Apache. This results in the Export Configuration process failing.

Steps to Replicate: Manually run the logrotate process using the command "/usr/sbin/logrotate /etc/logrotate.conf" while the Export Configuration process (started through the EMA) is running.

The code is modified to run the Export Configuration process with NOHUP when started through the EMA.

Workaround: In the "/var/log/sonus/export/history/" path, check the status file in the folder with the time stamp related to the task. The status should report "Success."

SBX-121891 | SBX-1232882

PortFix SBX-121891: Switch to FAX (T.38) rejected by SBX 488

Impact: A fax call fails if it involves a mid-call modification before fax re-INVITE.

Root Cause: If the route PSP is configured with fax tone treatment as ignoreDetectAllowFaxRelay and the call involves a mid-call modification, then the SBC ignores this fax tone treatment. This results in the SBC rejecting the fax call.

Steps to Replicate: Configure an Ingress Route with FTT=faxRelay.
Configure an Egress Route with FTT=ignoreDetectAllowFaxRelay.

To re-create the issue:

  1. Set up an A-B transcoded call via the SBC.
  2. B sends re-INVITE to convert the call to pass-thru at the SBC.
  3. B sends T.38 re-INVITE to the SBC.

Expected Result: The SBC accepts T.38 re-INVITE and the call transitions to a fax call.

Actual Result: The SBC rejects the T.38 re-INVITE.

The code is modified to apply the fax tone treatment configuration during mid-call modification as well.

Workaround: None.

SBX-1219722

A SWE switchover loss of media on hairpin calls

Impact: Loss of media on hairpin calls after a switchover to a redundant SBC SWe.

Root Cause: There are two issues:

  • The NRS task monitors IP stack on both active and standby nodes. However, the NRS only processes the kernel ARP change event on the active node. The NRS uses the legacy routine SmaActiveMns() to determine whether the local node is in active mode. SmaActiveMns() checks the local node's redundancyRole, but the node's redundancyRole is only updated during the AMF switchover event. So if the kernel ARP change event came before AMF_EVENT_SWITCHOVER, then the SmaActiveMns() routine will return FALSE, and the kernel event will drop.
  • The BRM task incorrectly sets the hot standby mode to FALSE because it used SmaIsCloudOrNto1() instead of SmaIsNto1() to determine the hot standby mode. Because of this, the BRESs were not activated properly on the standby node.

Steps to Replicate: Run a loopback call across multiple LIFs and perform switchover.

The code is modified to replace SmaActiveMns() with SmaIsMgmtActive() to properly determine the node's redundancy role during the notification phase of switchover. As well, SmaIsCloudOrNto1() is replaced with SmaIsNto1() in the BRM task.

Workaround: None.

SBX-1230732

The SBC Application is not starting due to incorrect NIC type

Impact: A 9.2.x SBC SWe VM X710 SRIOV interface fails to come up because of an incorrect NIC type.

Root Cause: Under certain error conditions, the ethtool command displays the firmware-version of the SRIOV NICs as "N/A". If this occurs, the corresponding SRIOV NICs are incorrectly considered as virtual interfaces, resulting in the incorrect renaming of interfaces.

Steps to Replicate: Launch a 9.2.x SBC SWe on the Openstack VM with X710 SRIOV VFs as the PKT interfaces. The application should come up with the assigned role and with the interfaces in the correct order.

The code is modified to update the interface renaming logic to avoid considering the firmware-version output of the ethtool command for determining the given interface as a virtual interface.

Workaround: None.

SBX-123569 | SBX-1243942

Portfix SBX-123569: Video/Data stream was not relayed on egress side in both bundled and unbundled scenarios

Impact: In a bundled call with audio, video, and data, 'show status global callDetailStatus ' command shows egressDtlsStream3 as DISABLED instead of RELAYED.

Also, fingerprint was missing in the INVITE SDP of video and data stream.

Root Cause: Issue occurs as dtlsSrtpParams and srtpParams are getting cleared due to a code fix in SBX-121550 in the 9.2.5R5 release.

Steps to Replicate: 

  1. Run a call that sends bundled media: audio, video and data channel.
    1. Answer accepts bundling on all three.
    2. While the call is running, command "show status global callDetailStatus" should show egressDtlsStream3' => 'RELAYED.
  2. Verify the SBX-121550 fix in the steps below:
    1. Make RTP to SRTP configuration.
      The set up should be HA. The RTP leg should not have any security PSP attached.
    2. Configure the session timer as the session expires for SRTP leg first.
    3. Establish an A--B call and then perform switchover.
    4. Wait for a switchover to occur.
    5. Wait for the session timer to expire and see an INVITE towards SRTP to successfully answer with a 200 OK.
    6. Wait for an INVITE towards the RTP side.

Observed results: The SBC sends BYE.
Expected results: The SBC sends INVITE to ingress.

The code is modified to revert to the changes in SBX-121550.

Workaround: None.

SBX-1238262

The StunDtlsPacketsReceived count in the callMediaStatus shows incorrect values

Impact: The values for ingress/egressMediaStream1StunDtlsPacketsReceived and ingress/egressMediaStream1StunDtlsPacketsDiscarded are incorrect in "show status global callMediaStatus" and the CDR.

Root Cause: The Network Process was copying the wrong area of the media statistics for the ReadMedia API response and caused incorrect values for the two StunDtls statistics.

Steps to Replicate: 

  1. Start a call.
  2. Display "show status global callMediaStatus" and verify that StunDtlsPacketsReceived is correct.
  3. Stop the call.
  4. Gather CDR and verify that StunDtlsPacketsReceived is correct.

The code is modified to align the media statistics area correctly and copy the correct area to the ReadMedia API response.

Workaround: None.

SBX-124033 | SBX-1241122

PortFix SBX-124033: An SBC MSRP call is failing with a truncated egress INVITE

Impact: The SBC truncates the SDP in an outgoing INVITE for the MSRP calls when the DNS query is involved in the call.

Root Cause: In non-DNS scenarios, the outgoing INVITE on egress leg is formed only once. The SIP stack in the SBC forms this outgoing INVITE correctly for the first time so there are no issues.

In DNS scenarios, since the FQDN is resolved to IP, the DNS request is sent to DNS server for getting the IP. The DNS response from the DNS server is sometimes delayed. On the SIP stack – if the DNS response is immediate then SIP stack will form the outgoing INVITE with the received IP addresses from the DNS server.

If the DNS response is delayed, SIP stack will form the outgoing INVITE without IP addresses and saves it. Once the SIP stack receives the IP addresses, it de-constructs the saved outgoing INVITE message and re-constructs it with the received IP addresses.

In summary, the de-construction and re-construction logic was not working properly with respect to the “a=path” header for MSRP calls.

Steps to Replicate: Test an MSRP call with FQDN IP Peer.

The code is modified to correct the error in the de-construction and re-construction logic of the outgoing INVITE.

Workaround: Calls will not fail if the IP address is used instead of the FQDN address so that no DNS query is involved with the call.

SBX-1245272

The SBC sends re-INVITE (session-refresh) without SDP after a switchover event

Impact: The MRF releases a call when the SBC sends an INVITE to refresh the session following a switchover on the SBC, due to the SBC sending INVITE without SDP.

Root Cause: The SBC does not make the SDP information redundant for the MRF call leg. Following a switchover, the SBC generates an INVITE without SDP when the session refresh timer expires.

Steps to Replicate: Make a call using MRF and then perform a switchover on the SBC. Wait for the session refresh timer to expire and check if the SBC sends out an UPDATE message without SDP instead of an INVITE without SDP.

The code is modified to generate an UPDATE message instead of an INVITE to handle the session refresh when no SDP is available.

Workaround: None.

Resolved Issues in 09.02.05R005 Release

Severity 1 Resolved Issues

The following Severity 1 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-122469 | SBX-1229151

Portfix SBX-122469: An EG UAT SWe SBC switchover occurs when SRTP and SRTCP calls are made.

Impact: SWe_NP process cores and a switchover occurs when the SBC processes certain types of malformed RTCP packets for SDES CNAME replacement with RTCP passthrough.

Root Cause: A defect in the RTCP SDES parsing code resulted in memory corruption.

Steps to Replicate: 

  1. Configure the SBC for passthrough SRTP calls.
  2. Set RTCP mode to passthrough.
  3. Enable the ssrcRandomizeForSrtp flag in PSP.
  4. Make a call and send in various valid and invalid format RTCP packets for the call, including an RTCP packet with a single-chunk SDES with non-zero pad bytes at the end.

The code is modified to alter the RTCP SDES CNAME replacement code in order to correct (if possible) or drop various types of malformed RTCP packets.

Workaround: Disable CNAME replacement and ssrcRandomizeForSrtp features in PSP (if possible).

SBX-1209821

An SCM process core occurred on the Server.

Impact: An SCM process cores due to a double free of an internal structure.

Root Cause: An SCM cores due to a double free of an internal structure.

The structure is in an array of these structures. The array is a fixed size. When attempting to add a new entry to this array, we consolidate the array by removing some of the free entries.

In the unlikely event that all of the array entries are in use, we remove the oldest entry and consolidate the array by moving the other entries up.

There is a bug in this consolidation code that causes a double free when the entire array is later freed.

Steps to Replicate: The steps are not reproducible.

The code is modified to clear out the pointers in an array entry after it moves up to the previous entry during consolidation.

This ensures that there are no leftover/stale pointers that might cause a double free.

Workaround: None..

SBX-122577

1

A core dump occurs on a customer SBC with a processAbnormalTermination.

Impact: The CPX cores when deleting a CDR server.

Root Cause: The code was missing a check for element type when processing a deletion in the CDR server.

Steps to Replicate: The steps are not reproducible. 

The code is modified so the element type is processed before deleting.

Workaround: None.

SBX-122225 | SBX-1234551

PortFix SBX-122225: Call trace status getting enabled after a switchover using the EMA.

Impact: Call Trace staying enabled in new active node when switching over, when disabled on the current active.

Root Cause: No notifications were getting sent to the standby SBC after issuing a stop command.

Steps to Replicate: 

  1. Enable call trace through the EMA/CLI, and then disable it with a stop command.
  2. Perform a switchover and check the status on the new active SBC.
  3. Try the same with the Call filter enabled.

Test Result: The call trace state is disabled on the new active.

The code is modified so the correct notification is sent to update the standby node when Call Trace is being disabled.

Workaround: Without the fix, the workaround is to disable call trace using new active node's EMA or CLI on, if it is enabled after switchover.

SBX-1223311

A customer SBC switchover occurred due to an SCM core.

Impact: The SCM cores when processing a call that is using SIP Recording.

Root Cause: The code is attempting to access a SIP Recorder call block that is already freed. This occurs because of an edge case call scenario where the call block is freed.

Steps to Replicate: This bug was found using the back-trace and through code inspection. The core is happening after the call block gets freed. Attempts to recreate the issue are unsuccessful.

The code is modified to always remove the SIP Recorder call block from the hash table before freeing the call block.

Workaround: None.

SBX-1202181

The SBC is slow to relay the first register.

Impact: PES process is slow to process a D+ request when no call notification group attached to TG.

Root Cause: While processing the call notification criteria matching, PES processes all the required strings from called and calling number and then it used to check if there is a call notification group attached to the TG. This is done for each and every route. This process previously took up the processing time when there is no call notification group is attached.

Steps to Replicate: Make a basic call and find the difference between the start and end time of PES processing the call. Performance related - may only see difference under a load.

The code is modified to check if the call notification criteria is attached to the TG, and then only process the rest of the required strings.

Workaround: None.

SBX-122304 | SBX-1228651

PortFix SBX-122304: The standby M-SBC did not take over when the active SBC rebooted in an N:1 cluster.

Impact: Switchover did not occur after the SWENP process crashed due to a race condition.

Root Cause: Infrequently, a switchover event may not be sent to the standby in specific case of SWENP process crash on an active SBC.

Steps to Replicate: The steps are not reproducible.

The code is modified to ensure a switchover event is sent and processed by standby on SWENP crash and other switchover scenarios.

Workaround: None.

SBX-1231751

In the 925R4, a few calls fail with "NrmaAllocResCmd: paramInsert failed" error

Impact: Multi-streams call with large SDP (due to crypto and other attributes) fails if DM and DTLS enabled at the SBC.

Root Cause: Interprocess communication buffer requirements for multi-stream call is higher compared to other call flows. However, at present, higher buffer is allocated only if number of streams in call is six.

Since the number of streams is not six, higher buffer is not allocated resulting in failure.

Steps to Replicate: 

Enable SRTP/DTLS/DM at the SBC.

To re-create the issue: UAC sends INVITE to the SBC with 5 streams (mix of audio/video/application) with crypto and other attributes.

Expected Result: The call is accepted by the SBC and succeeds.

Actual Result: The call is rejected by the SBC.

The code is modified to allocate a higher buffer if the call involves four or more streams.

Workaround: None.

SBX-1224031

SWE PAID and FROM translation tables not working post 9.2.4R2 upgrade

Impact: The SWE PAID and FROM number translation criteria (cpe type: tgWithCallingNumber) are failing to match after an upgrade or restoration of the backup.

Root Cause: When the backup is restored, the info table of tollfree prefix info is not populated properly with the length of the calling number (call processing element type 3). It is getting populated with the length of the trunk group (call processing element type 1). In call processing, when trying to find the record of the trunk group with the calling number, the SBC uses the length of the calling number and not the length of the Trunk group. The same series of events occurs in the upgrade scenario, so the customer encountered this issue post upgrade.

Steps to Replicate:

  1. Take a backup with the existing config.
  2. Restore the backup or upgrade to the next release.
  3. Test the calls with tgWithCallingNumber as criteria.

The code is modified to populate the toll-free prefix info table properly for restore and upgrade cases.

Workaround: None.

SBX-1230811

The SBC cores after upgrade to v09.02.05R003

Impact: The SBC PRS Process cores with NP indicating multiple cores failing. Memory dump analysis shows problem in the RFC2833 DTMF digit detection area of the code.

Root Cause: The problem happens when an ICE/DTLS call is established followed by the endpoint sending RFC2833 DTMF digit packets and with DTMF Trigger Profile is enabled. A pointer to store the digit detected in memory is getting reset to zero after the ICE/DTLS call is established.

Steps to Replicate: 

  1. Enable DTMF Trigger Profile.
  2. Make an ICE/DTLS call.
  3. Send an RFC2833 digit packet to the SBC within the ICE/DTLS call.

The code is modified to set the pointer to store digits detected properly after the ICE/DTLS call is established.

Workaround: Disable DTMF Trigger Profile.

SBX-1232451

The SCM Process cores and switched over

Impact: Direct Media with multiple audio and ICE call may cause the SBC to core.

Root Cause: When receiving multiple audios with ICEs, Ingress is passing only one ICE info of active stream to egress. When the egress leg tries to retrieve the ICE info, it expected to receive two ICE info for two streams. As a result, it reads garbage data which may cause the SBC core.

Steps to Replicate: 

  1. Enable Direct Media, ICE support, multipleAudioSupport.
  2. A call B with multiple audio streams+ICE.
  3. B re-IVITE with multiple audio stream+ICE. The SBC may core.

The code is modified to correct the logic on the ingress leg that passes all ICE info for each stream to the egress leg.

Workaround: Disable ICE.

SBX-1237201

No Beep Tone issue

Impact: The egress endpoint did not hear a Beep Tone from ingress.

Root Cause: When the ingress leg switched to tone player to play beep tone, the resource chain was rebuilt and NAPT learning was restarted on egress leg with RTP flow mode = rcv-only. Hence, no RTP packets are sent to the egress endpoint.

Steps to Replicate:

  1. Make a SRTP call with egress endpoint behind the NAT.
  2. Switch to a different media server to play the tone via re-INVITE, and check the audio at egress endpoint.

The code is modified to set RTP flow mode to duplex, if the SBC already learns the remote IP address, when enabling NAPT re-learning process.

Workaround: None.

SBX-1236281

Transparency profile causes a core dump SBC-GW-GW-SBC

Impact: SCM may core during a GW-GW call while transparently forwarding P-Sig-Info header:

  • A call is GW-GW and contains P-Sig-Info
  • Transparency Profile on Egress GW contains P-Sig-Info header

Root Cause: The core occurs because the code that is processing the P-Sig-Info header is attempting to access invalid memory.

Steps to Replicate: 

- Call is GW-GW
- INVITE contains P-Sig-Info
- Transparency Profile on Egress GW contains P-Sig-Info header

NOTE: This may not be easily reproducible. This code hasn't changed in a long time - but we haven't seen this issue before. This is probably because most of the time this bug may not cause a core. Sometimes it will simply set the pointers in P-Sig_info to addresses that are incorrect but still within the valid memory space (which will NOT cause a core).

The code is modified to ensure that the internal representation of the P-Sig-Info header points to valid memory.

Workaround: Remove P-Sig-Info from Transparency Profile.

SBX-1226061

There was an SSN issue with ICE/TLS/SRTP/P2P

Impact: Possible audio issue involving an incorrect SSN when using ICE/TLS/SRTP/P2P.

Root Cause: The SSN value 0 was incorrectly saved in XRES on deactivation for the case when the RID was never enabled in NP while performing NAPT or ICE learning.

Steps to Replicate: Use on hold and transfer signaling to interrupt learning during the early stages of the call to potentially get a random SSN and ROC values, which the far end rejects.

The code is modified after the NAPT or ICE learning of a remote address is completed, ignoreRocSsn is set and causes NP to use the random SSN/ROC values from RID memory block. This fix is a similar fix to SBX-119900. 

Workaround: None.

SBX-123228 | SBX-1234111

PortFix SBX-123228: DTMF Intermittently not working post upgrade.

Impact: Audio loss after DTMF digits.

Root Cause: After ingress received a re-INVITE for a media reconfig, we used a new RID to replace the previous RID. But when the resource chain was re-activated, the new RID was programed SSN = 0 that caused the audio loss.

Steps to Replicate: The steps are not reproducible.

The code is modified to:

  1. Assign a valid SSN/ROC for the new RID.
  2. Ensure the SSN value is greater than, or equal to, the last saved SSN on the deactivation for anti-replay protection.

Workaround: Enable “SSRC Randomize For Srtp”.

Severity 2-4 Resolved Issues

The following Severity 2-4 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-1231422

Unnecessary re-INVITE was removing a 2833 message

Impact: A DTMF telephony-event gets dropped in response to a mid-call re-INVITE.

Root Cause: A previous enhancement to support both 8K and 16K DTMF and to transcode 16K, when necessary, contained a defect in the logic that resulted in a call appearing to be a pass-through call.

Steps to Replicate: 

  1. Ingress UAC endpoint offers DTMF 8K PT 100 to SBC1 , SBC2 offers DTMF 8K PT 101 to UAS endpoint (SIPP).
  2. Egress UAS endpoint(Sipp) answers without DTMF/8000 (DTMF) to SBC 2.
  3. SBC 1 answers with DTMF PT 100 to the Ingress UAC endpoint (SIPP).
  4. Call is setup as xcoded between SBC 1-SBC2.
  5. Egress UAS endpoint re-INVITES to add DTMF PT101 to SBC 2.
  6. SBC 1 re-INVITES with PT 100 to Ingress UAC endpoint.

The code is modified to correct the logic that was not correctly identifying a call as transcoded between DTMF payload types 100 and 101.

Workaround: None.

SBX-1223222

SWe_NP - NP crashed with SIGSEGV

Impact: The SWe_NP crashes due to a SIGSEGV event.

Root Cause: The Segmentation table (a table that points to announcement buffers and has meta data for a call) gets initialized during ANN PLAY command.

Since an ANN play command was never issued for a given call, the segmentation table was never initialized. The state machine in NP allowed the execution of a second disable command to proceed (which ideally should not be allowed) and tried to flush and build an announcement packet. Since the Segmentation table was never initialized, the source buffer pointer was NULL and crashed with SIGSEGV.

Steps to Replicate: The steps are not reproducible.

The code is modified to the flush and disable the code to handle such conditions.

Workaround: None.

SBX-1232253

An EMA Prefix Profile display issue occurred after upgrading to 9.2.5R1

Impact: In the Prefix Profile Entry, the values for the following parameters (Matching Pattern, Match Start Location, Total Min Digits, Total Max Digits, Digit Type, DM PM Rule, Apply DM Rule and Determine Area) are not displayed for matching pattern starting with '+'.

Root Cause: The URLDecoder was replacing the symbol '+' with blank space ' ' in the method decodeTextFromUI.

Steps to Replicate:

  1. Log into EMA as admin user.
  2. Go to All -> Profiles -> Digit Parameter Handling -> Prefix Profile -> Entry.
  3. Under the Entry list, select any matching pattern starting with '+'.

Values for the following parameters display (Matching Pattern, Match Start Location, Total Min Digits, Total Max Digits, Digit Type, DM PM Rule, Apply DM Rule and Determine Area).

The code is modified to replace the symbol '+' with '%2B' before decoding in the method decodeTextFromUI.

Workaround: None.

SBX-1225162

A customer SBC failed-over

Impact: For t140<=>baudot interworking, if the t.140 packet with a t.140 block contains a long string with alternating letter and numbers, then it can cause a DSP core dump (Swe_UXPAD). The following string was observed to cause crash "q1q1q2q1q1q221q1q1q1q1q1q2 1q".

The SBC allows maximum length of 36 bytes for a t140 block.

Root Cause: The buffer allocated to convert t140 block to baudot characters was insufficient for a long character string with frequent transition between figure and letter characters.

Baudot character sets have FIGURE and LETTER modes and to switch between the two, a mode switch character has to be inserted. A long character string with frequent transitions resulted in buffer overflow and caused crash.

Steps to Replicate:

  1. Setup a AMRWB+t140 =>g711 (baudot) call.
  2. Send a t140 packet with a t140block consisting of following characters. This is the character string that was observed in crash.
    "q1q1q2q1q1q221q1q1q1q1q1q2 1q"

The code is modified to increase the buffer size to the maximum possible baudot string size (i.e. 72 baudot characters).

Workaround: None.

SBX-122070 2

SO-SBC (4+1) sends out-of-order 200-OK (SUB) and NOTIFY

Impact: The SBC is processing the NOTIFY ahead of the 200 OK for SUBSCRIBE message in certain scenarios where there is no delay between the 200 OK and NOTIFY messages arriving at the SBC.

Root Cause: The SBC uses the two digits before the B in the following branch prefix = z9hG4bK18B. In this example, '18' identifies the SCM process which handled the 200 OK response. Due to a bug in the code, the SBC was only looking at one digit, and so the SCM process could not be determined. The SBC had to hold up the 200 OK response until it did a TRM query to determine the SCM process that handled the message.

In the meantime, the NOTIFY arrived and it was processed immediately based on the same digits in the tag parameter i.e. tag=gK18e.

Steps to Replicate: 

Continually run a call flow where the SBC relays SUBSCRIBE messages and the remote party sends back 200 OK SUBSCRIBE and NOTIFY at the same time.

Check that the SBC forwards the messages in the same order; i.e., a 200 OK SUBSCRIBE first, and then a NOTIFY to the A-party.

The code is modified to use the two digits of the branch parameter to route the 200 OK for SUBSCRIBE so there is no delay in processing and the messages are processed in order.

Workaround: None.

SBX-121606 | SBX-1232543

PortFix SBX-121606: Allow user-config-import on the OAM

Impact: The user-config-import command is unavailable on an OAM node.

Root Cause: This limitation is being removed as part of an enhancement request.

Steps to Replicate:

  1. Run user-config-export on one OAM node.
  2. Update the configuration to fit with the new OAM node.
  3. Import the configuration into the new OAM node.

The code is modified to allow for the user-config-import command on an OAM node. This should only be used for greenfield deployment of a new cluster using the configuration from an existing golden configuration of another cluster.

Workaround: Back up the configuration in CLI format and then edit the CLI to use the correct import order into the new cluster. Update the new cluster specific configuration in the CLI file and then source it in.

SBX-122159 | SBX-1222802

PortFix SBX-122159: The ICE process does not immediately respond to a call audit 

Impact: The call cleanup process always takes the full five seconds to complete, even when all the expected processes respond.

Root Cause: The five-second timer for a process starts, but a response never occurs. As a result, the cleanup process is delayed by five minutes.

Steps to Replicate:

  1. Set up a call with RTP inactivity of 40 seconds with a trap and disconnect. This should result in approximately 1,000 calls with a 40-second gap between calls.
  2. Attach a LRBT and duration of call should be around 42-44 seconds.
  3. Search for repeated occurrences of logs "not known by NRM".

The code is modified to reduce the amount of unnecessary calls in the ICE process

Workaround: None.

SBX-122674 3

Rework on the SBX-115152 logic.

Impact: Additional logic change for SBX-118384/SBX-115152 resolved originally in 9.2.5R0.

Root Cause: In certain call scenarios, the call control block gets reset on the egress side. This results in the SBC deleting a data pointer to one call leg, thus affecting the SBX-115152/SBX-118384 9.2.5R0 bug fix..

Steps to Replicate: 

  1. Establish a SIP-SIP call with G711 U law.
    1. Enable "Minimize Relaying Of Media Changes From Other Call Leg" flag in Ingress IPSP.
    2. Enable "Unknown Header" transparency in IPSPs.
  2. After establishing the session, send a re-INVITE from the Egress peer with G711U law for call hold (a=sendonly).
  3. Send BYE from the Ingress peer with Unknown Header.
  4. Verify if the unknown header in BYE message is sent transparently to the other leg.

The code is modified to add the call control block based on the call direction.

Workaround: None.

SBX-1193192

The GSX generates a STOP CDR while corresponding with ATTEMPT CDR and not STOP record in the SBC

Impact: In a SBX-GSX GW call, the GSX generates a STOP CDR while the SBC generates an ATTEMPT CDR instead of a STOP CDR.

Root Cause: This issue is not fully understood and cannot be recreated.

Steps to Replicate: Not identified.

The code is modified to add enhanced logging to collect more info.

Workaround: None.

SBX-1227342

The SBC 5400 is stuck in a LSWU after a switchover or restart

Impact: Sync does not complete after a switchover or restart when using Call Notify functionality.

Root Cause: Sync does not complete after a switchover or restart when using Call Notify functionality because the standby code detects a duplicate entry in the Call Notify array and returns an error.

Steps to Replicate: 

  1. Configure the SBC to send unsolicited call notifications to Application Servers.
  2. Run a load test with Call Notify functionality enabled and force a switchover.
  3. "set addressContext <ac name> zone <zone name> sipTrunkGroup <tg name> services sipCallNotificationMetadataProfile <meta data profile name>"
    Note: This is a race condition that will only occur if Notifications are being processed during a switchover or sync.

For more details on this configuration, see Configuring the SBC to Send Unsolicited Call Notifications to Application Servers.

The code is modified to replace the existing entry in the Call Notify array with the new one when a duplicate is detected.

Workaround: None.

SBX-123550 | SBX-1237132

PortFix SBX-123550: During a LSWU, audio was lost for incoming calls, but was present for outgoing calls

Impact: When ssrcRandomizeForSrtp is enabled, a one-way audio issue occurs after the SBC switches over to the standby node

Root Cause: If ssrcRandomizeForSrtp is enabled, the NRMA generates an SSRC for the SRTP leg. The SSRC is sent to the NP when enabling the associated RID. In a hot standby setup, that SSRC is mirrored to standby, but it is not sent to the NP when enabling the same RID on the standby. Instead, the NP adapts the SSRC from the incoming RTP stream or the DSP's SSRC. Once the standby node becomes active, the NP changes the SSRC.

If the endpoint sees a new SSRC, it starts decrypting using ROC=0. However, the NP was encrypting on send on the SRTP leg with ROC=2 that prevented the endpoint from decrypting, which resulted in one-way audio.

Steps to Replicate: 

  1. Run an HA set up.
  2. Enable the ssrcRandomizeForSrtp.
  3. Make a long duration RTP to SRTP transcode call, and then check audio.

  4. Switch over to the standby node after the call has been up for over 25 minutes.

  5. Revert back, and then check audio.

  6. Repeat above step 1 to 5 for a long duration pass-through call.

  7. Repeat above step 1 to 5 for a short duration transcode call.

  8. Repeat above step 1 to 5 for a short duration pass-through call.

The code is modified to send NRMA generated SSRC to NP when enabling the RID on standby node so that NP does not adapt incoming RTP stream's SSRC.

Workaround: None.

SBX-1236272

Special characters incorrectly display using the "View CLI" option

Impact: In the SMM GUI, a couple of special characters incorrectly display in the "View CLI" option.

Root Cause: The '<' character is sent as '&amp' instead of '&lt;' and the \\r\\n => double backslash escaped properly but display as a single backslash in HTML.

Steps to Replicate:

  1. Log into the EMA and navigate to the SMM screen.
  2. Select the profile that includes the characters < \\.121394
  3. Click the View CLI button for the selected profile.

The CLI commands display as expected.

The code is modified to replace those occurrences with correct responses to address the issue.

Workaround: None.

SBX-1234592

Multiple PRS process cores occurred on the server

Impact: The PRS process cored due to a XRM task failed health check.

Root Cause: The sigPortList in the XRM got corrupted. Numerous freed XRESs were left in it. When trying to activate a new signaling port, the XRM task got stuck in the loop and failed a health check.

Steps to Replicate: The steps are not reproducible. 

The code is modified to properly free already allocated XRES for other pool(s) during a signaling port allocation routine

Workaround: None. 

 SBX-1213942

A call transfer (REFER with Replaces) fails with an OA status 0x54

Impact: An attended call transfer failed due to a race condition when the transferor sends an off-hold INVITE and REFER with Replaces in rapid succession.

Root Cause: While the SBC is in the process of bridging a transferee and transfer target, the off-hold INVITE from the transferor triggered a new modify request towards transferee, which caused an offer-answer timeout internally due to previous modify still being processed that leads to a call failure (OA status 0x54).

Steps to Replicate:

  1. A calls B and the call is connected.
  2. B puts A on hold.
  3. B (you can also assume B' as User C) calls D and the call is connected.
  4. B sends an off-hold INVITE to the SBC.
  5. C sends REFER with Replaces of B to the SBC.

The code is modified so that the internal offer-answer timeout is handled to avoid call transfer failure.

Workaround: None.

SBX-1235953

A unique tag is created for a Notify when the 200 OK was not sent yet in response to a Subscribe

Impact: When a Notify received before the initial 200 OK response to Subscribe, the SBC may send an invalid tag in 200 OK Subscribe.

Root Cause: After receiving a Notify from Egress, the SBC is using egress service group id as part of tag in 200 OK Subscribe for sending to the ingress.

Steps to Replicate: Run the following configuration:

Subscribe ->Subscribe
                 <-Notify
                 <-200 Subscribe

The code is modified to relay a 200k Subscribe to the Ingress service group id.

Workaround: None.

Resolved Issues in 09.02.05R004 Release

Severity 1 Resolved Issues

The following Severity 1 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-120361
1

Receiving a syslog spam about ACL Stats from the SBC1b.

Impact: /var/log/syslog fills up with cpsi log entries about unable to read ACL statistics.

Root Cause: A problem was found in CPS (Common Platform Service) library retrieving the next resource. CPS keeps a list of allocated resources and the CpsXyzGetNext API is used to grab the next entry in the list. The next resource information was stored in common shared memory and was not thread safe. If multiple threads invoked the same API simultaneously, the result would be unpredictable.

Steps to Replicate: The steps are not reproducible.

The code is modified to add a limit to the loop count for the number of allocated resources to ensure the caller of the function passes in a CpsXyzGetNext API storage location to make it thread-safe.

Workaround: None. If the kernel syslog gets filled, you must reboot Linux to stop the problem.

SBX-121444
1

The LWRESD process keeps restarting causing the SBC app to not come up.

Impact: The LWRESD Process continues to restart as the interface used by it for ENUM/DNS signaling was down.

Root Cause: When a SIP SIG port is selected as the signaling interface for LWRESD, by design the SBC uses the query-source-address parameter in the slwresd.conf file. Upon getting this parameter, the bind stack tries to create a socket on that IP and port. If it is unable to create the socket, the bind stack exits abnormally.

Example sysdump syslog failure indication:

<27> 1 2022-08-30T09:45:05.191451-04:00 vsbcSystem lwresd 29904 - - could not get query source dispatcher (10.0.4.248#988)
<26> 1 2022-08-30T09:45:05.191769-04:00 vsbcSystem lwresd 29904 - - loading configuration: address not available
<26> 1 2022-08-30T09:45:05.191962-04:00 vsbcSystem lwresd 29904 - - exiting (due to fatal error)
<29> 1 2022-08-30T09:45:05.195760-04:00 vsbcSystem lwresd 29904 - - running

Steps to Replicate: 

  1. Set up the LWRESD profile to use the SIP signaling interface.
  2. Bring the SIP signaling interface mode or state to outOfService/disabled state.
  3. Restart the SBC application.

The SBC app does not come up in service as the LWRESD process keep on restarting.

The code is modified to generate the default slwresd conf file if both the SIP signaling port type is 'SIP Signaling IP' and if the signaling port is disabled, since LWRESD cannot perform DNS signaling. The process generates the slwresd.conf based on the configuration when the interface is changed to the in-service state using the CLI.

The LWRESD Profile now maintains two different bit masks for the interface mode and state. Consequently, after upgrading to an SBC version that includes this fix, use the following steps if the LWRESD Profile type is set to signaling IP:

  1. Set both the state and mode of the sipSigPort that is configured in the LWRESD profile to disable and outOfService respectively.
  2. Set both the state and mode of the sipSigPort that is configured in the LWRESD profile to enable and inService respectively.

Note: These steps are only required for an upgrade procedure if the signaling type is 'signalingIP' for the LWRESD Profile.

Workaround: None.

SBX-120330 | SBX-121955
1

PortFix SBX-120330: UX_PAD is dumping core while running evrc to g729 load.

Impact: A UXPAD Crash observed while running EVRC calls on GPU.

Root Cause: As an oversight, the GPU software does not initialize all GPU EVRC decoder context variables, including the variable used as an index to an array. This led to an illegal memory access occurrence.

Steps to Replicate: The steps are not reproducible. 

The code is modified so the decoder context variables are initialized to their default values.

Workaround: None.

SBX-115363 | SBX-122011
1

PortFix SBX-115363: AWS: eth1 and eth2 subnets are getting interchanged in an HFE instance.

Impact: The AWS HFE Node can sometimes have the wrong IPs assigned to the interface.

Root Cause: The AMI image incorrectly sets the interface configuration.

Steps to Replicate: 

  1. Delete the default route for eth2.
  2. Re-run the HFE script to ensure it completes correctly.

The code is modified to:

  1. Correct the 'Debug SBC SWe in AWS' page on how to correctly reconfigure the interfaces.
  2. Handle finding the gateway IP, when the default routes are not available for the interface.

Workaround: None.

SBX-122149
1

Dead air after call is resumed from hold

Impact: SSN/ROC reset after hold that caused one-way audio.

Root Cause: In order to prevent reading random values of SSN/ROC in the RID’s memory block, XRM has cleared the remote address saved in XRES's security context. But that change should only apply to the case when the call flow uses a new RID after call modification.

In this call flow, the same RID was used after hold. But the SSN/ROC got reset unnecessarily after hold.

Steps to Replicate: 

  1. Enable NAPT learning on egress SRTP call leg.
  2. There is no S-SRC change.
  3. Run call hold and resume test.

The code is modified to introduce a new flag in XRES's security context. The flag is only set to "true" when XRM detects a new RID. Then when NAPT learning times out, XRM checks this flag to determine whether or not to clear the XRES-saved remote address.

Workaround: None.

SBX-122352
1

GW-GW calls are failing after an upgrade from 9.2.3R3 to 9.2.5R2. The SBC stops processing the call after parsing the MCS EST_CONF message from the egress GSX.

Impact: Calls between the SBC and GSX may cause an SCM core dump.

Root Cause: A bug was introduced in an internal function. CpcMsgInfoCreateCopy(), which copies the CPC Optional Parameters that are used to pass information about a call between processes and between systems.

This bug causes us to calculate the offset to the next parameter incorrectly. When the pointer is incorrect, the code that validates the CPC Optional Parameter will detect an error and cause a core dump.

Steps to Replicate: This issue was found by code inspection. The steps are not reproducible.

The code is modified so that it now calculates the offset to the next parameter correctly.

Workaround: None.

SBX-113502 | SBX-122359
1

PortFix SBX-113502: CE_2N_Comp_ScmP SYS_ERR generated

Impact: Calls between the SBC and GSX may cause an SYS_ERR and not process the internal parameter content correctly.

Root Cause: A bug was introduced in an internal function - CpcMsgInfoCreateCopy(), which copies the CPC Optional Parameters that are used to pass information about a call between processes and between systems.

This bug causes us to calculate the offset to the next parameter incorrectly. When the pointer is incorrect, the code that validates the CPC Optional Parameter will detect an error and cause a core dump.

Steps to Replicate: This issue was found by code inspection.

The code is modified so that it now calculates the offset to the next parameter correctly.

Workaround: None.

SBX-122509
1

There was a core and failover on the SCM Process coredump and the SBC failed over.

Impact: The SCM process cores after an attempt to free a memory block that is already free.

Root Cause: A memory block was freed but did not clear the pointer to that freed memory block that is stored in the main Call Block.

As a result, the app does not know that this memory block has already been freed. If the app tries to free it a second time, a core is caused.

Steps to Replicate: This bug was found by code inspection, and is therefore not reproducible.

The code is modified to clear the pointer to the freed memory block that is stored in the main Call Block.

Workaround: None.


The following Severity 2-4 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-120807
2

A memory leak occurred in an Advanced SMM dialog variable.

Impact: A memory leak occurred in an Advanced SMM dialog variable.

Root Cause: When the egress leg responds with 18x, the SBC fails to update the call control block with new dialog variable ID. As a result of the call teardown before 2xx, the SBC fails to delete the memory of SMM dialog variable.

Steps to Replicate: 

  1. Configure an Advanced SMM with dialog variables and dialog transparency.
  2. Run an A call.
  3. B reply 1xx and wait for the timeout for the SBC to tear down the call.

The code is modified to always update the call control block with new dialog variable ID when received the responds from peer.

Workaround: Disable Advanced SMM.

SBX-120826 | SBX-121159
2

Portfix SBX-120826: ASAN - run-time error " runtime error: load of value 32524, which is not a valid value for type 'SIP_TRANSPORT_ENUM' in sanitizer logs

Impact: ASAN reported "runtime error" error while reading a value related to the transport type while processing a 407 response to a REGISTER message.

Root Cause: The code was reading from uninitialised memory while processing the 407 message, which led to reading an unexpected value.

Steps to Replicate: Only reproducible while running failed registrations in Ribbon lab using ASAN build.

The code is modified to ensure data is initialised correctly to avoid the problem.

Workaround: None.

SBX-121897
2

The SBC sent SYN to a client port instead of port 5060

Impact: The SBC tried to reopen TCP connection to the client for an incoming call and with the SBC in role of server side using TCP and the connection is already closed. The SBC should not try to reopen connection.

Root Cause: The same logic will be applied for the SBC TCP connection as a client

Steps to Replicate: 

  1. User A (TCP) calls to user B.
  2. User A disconnects/closes the TCP connection.

The packet capture shows the SBC trying to reopen the connection in order to send a status message.

The code is modified to prevent the SBC from reopening a connection for an SBC TCP connection as a server.

Workaround: None.

SBX-121620 | SBX-122000
2

PortFix SBX-121620: The SBC is not adding country code +81 in Request URI while sending out INVITE towards egress peer in E2E call flow.

Impact: The SBC is not adding country code in Request URI of INVITE.

Root Cause: The SBC is not globalizing the number by assuming that calledURI is already globalized.

Steps to Replicate:

  1. Set the country code as 81 in TG.
  2. Run a basic call.

Expected Result: Check whether the SBC is adding the country code in RURI, the SBC does add country code for RURI.

The code is modified to check whether the calledURI globalized or not. If it is not globalized, the SBC does globalize it and adds a country code.

Workaround: None.

SBX-121633 | SBX-122029
2

PortFix SBX-121633: Missing UI control for Level 4 Trace Messages configuration

Impact:

  1. Login to EMA.
  2. Go to All -> Global -> Call Trace.
  3. Level 4 Trace Messages configuration is missing in Call Trace Status and Settings.

Root Cause: Level 4 Trace Message has been added as an Enhancement in EMA.

Steps to Replicate:

  1. Login to EMA.
  2. Go to All -> Global -> Call Trace.
  3. Go to Call Trace Status and Settings.
  4. Choose All Messages or Received Invite under Level4 Trace Messages.

The code is modified to add Level 4 Trace Message configuration:

  • allMessages - Level 4 call traces contain all matching messages.
  • rcvdinvite - Level 4 call traces contain only matching received INVITE messages.

Workaround: None.

SBX-122013 | SBX-122086
2

PortFix SBX-122013: RCS SBC - Dropping ingress TCP-segmented MSRP packets (parsing error)

Impact: Dropping ingress TCP-segmented MSRP packets (parsing error).

Root Cause: The transaction ID was getting mismatched due to low buffer ENUM used for the transaction ID copy, truncating the transaction ID that is later compare to match the End of the Packet.

Steps to Replicate: Test the MSRP message having Transaction ID of length 32 characters.

The code is modified to increase the buffer size to 4 bytes to compensate for the full length of the transaction ID that can be at maximum length of 32.

Workaround: None.

SBX-122015 | SBX-122140
2

PortFix SBX-122015: The P-charging vector header has ipx3.xxx.com.1 instead of ipx3.xxx.com.2

Impact: On the egress Leg, the SBC is sending wrong PCV values in the PCV Header.

Root Cause: On the egress leg, the SBC was supposed to add PCV header. However, the SBC is applying transparency logic to PCV header and as a result, the SBC send wrong values in PCV header.

Steps to Replicate: 

An INVITE is received with PCV header

P-Charging-Vector: icid-value=a9fbd640-30e4-1032-00-00-00-10-6b-03-18-01;icid-generated-at=10.xx.yy.zz;orig-ioi=operatorb.com;transit-ioi="operator_A.1"

The sendPCVHeader is enabled on egress leg and PCV transparency is enabled. The SBC sends the generated PCV header and not transparently.

The code is modified so when the SBC adds a PCV header, the transparency is not applied again.

Workaround: None.

SBX-122182
3

SBC manager path check URL character violation

Impact: An SBC Configuration Manager path check creates a URL character violation.

Root Cause: Since the values are not encoded, the ^ symbol creates an issue.

Steps to Replicate: 

  1. Go to SBC Configuration Manager in the EMA.
  2. Navigate to pathCheck screen.
  3. Select addressContext -> Zone -> IP Peer values.
  4. Scroll down to Commands section.
  5. Select value from the dropdown and click Select.
    The SBC manager starts accepting requests from EMS in the URL.

The code is modified to encode the values of form elements, which resolves the URL character violation.

Workaround: None.

SBX-122178 | SBX-122219
2

PortFix SBX-122178: The SBC is not rejecting the INVITE received over unsupported transport protocol

Impact: The SBC is not rejecting the INVITE received over unsupported transport protocol.

Root Cause: The SBC returns a failure in an early stage that causes the SBC to select the default sipSigPort. Due to this, the SBC is further processing the INVITE.

Steps to Replicate: 

  1. Set the allowed transport on sipSigPort as TCP.
  2. Send registration over TCP and INVITE over UDP from the same script.

The code is modified to not select the default sipSigPort.

Workaround: None.

SBX-120767 | SBX-122368
2

PortFix SBX-120767: RESTAPI having 'set' operation limitation when using POST API commands.

Impact: RESTAPI having 'set' operation limitation when using POST API commands.

Root Cause: The validation point for the /META:metadata table was counting all changes in the current transaction, not just changes to the META:metadata table. This caused the limit of metadata table transactions of 1000 to be exceeded.

Steps to Replicate: 

  1. Create a rest request that creates a sipSigPort and three sipTrunkGroups.
  2. Execute that command.
  3. Verify that all items are correctly added to the confd database.

The code is modified to only count changes to the META:metadata table.

Workaround: Split the REST request into smaller requests to avoid this issue.

SBX-122399
3

API packets dropped at the kernel layer

Impact: NP continuously reports badRidCb errors.

Root Cause: RTCP RID is enabled at the same time as RTP RID is enabled in NP. But when BRM is deactivating the LE2LE_RTCPTERM BRES, it incorrectly sets disableRtcpRid flag to "true" in the RTCP Gen disable command. Even the corresponding RTCP RID was not enabled due to XRM having not resolved the destination MAC address.

Steps to Replicate: 

  1. Run negative call tests to reproduce and verify the fix.
  2. Make at least 65 of those calls with a remote IP address that is not reachable (i.e., the NRS does resolve the route).
    Note: Considering the NP's badRidCb error reporting threshold is set to 64, ensure to run at least 65 calls in order to see the error in the logs.

The code is modified to allow the BRM code to set disableRtcpRid flag properly in the RTCP Gen disable command.

Workaround: None.

Resolved Issues in 09.02.05R003 Release

Severity 1 Resolved Issues

The following Severity 1 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-1218541

A MAJOR event containing "PORT_RANGE: id xxxxx not found" regularly seen in DBG log

Impact: A MAJOR event containing "PORT_RANGE: id xxxxx not found" is regularly seen in the DBG log.

Root Cause: When a registration expires, there is a 52-second window (based on default retry counts) after the port range control block is deleted and before registration control block is freed. Any SIP subscribe request received within this window is forwarded to egress to use the connection ID of an already-freed port range control block, and results in this error message.

Steps to Replicate:

  1. Enable usePortRangeFlag on egress TG.
  2. Establish a new registration.
  3. Wait for registration to expire (For example, set expiration value to 2100s. You can use the tail command to check the info level DBG log to see the retry message starting).
  4. When the retry timer starts, run scripts to send at least 10 subscribe requests.

In addition to above tests, please also verify following:

    1. Subscribe refresh is working as expected.
    2. Subscribe request when port range is disabled.

Corrected the logic which only checked registration status when the usePortRangeFlag feature is enabled.

Workaround: None.

SBX-1218891

ScmProcess may coredump when logging an INFO level message (or Call Trace message) related to secure media IP change after on-hold/off-hold signal sequence

Impact: The ScmProcess may core when logging an INFO level message (or Call Trace message) related to a secure media IP change after a on-hold/off-hold signal sequence.

Root Cause: The IPUtilGetStr function was called to retrieve the previous and current IP for logging, which was used as an argument that got passed into the logging function without any additional parameters. In this scenario, the function uses local memory for storing the value. 

Without specifying a buffer to store the data, the local buffer gets overwritten when called two consecutive times. Consequently, when stringcopy or write is called, the first dataset is gone resulting in a null pointer access that causes a core.

Steps to Replicate: Run at INFO level logging and put secure media leg on-hold and take off-hold to reproduce the core.

The code is modified to remove the IPUtilGetStr from the call to log the DBG message.

Workaround: None.

Resolved Issues in 09.02.05R002 Release

Severity 1 Resolved Issues

The following Severity 1 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-1211211

The SBC application is not coming up

Impact: Synchronization of the SIP REC call data may fail due to deficiencies in the synchronization algorithm.

Root Cause: The algorithm used to the synchronize of SIP REC call data to the standby system suffered from deficiencies, making the algorithm unreliable.

Steps to Replicate:

  1. Provision the SBC to perform a SIP REC.
  2. Run SIP REC calls.
  3. Bring up the SBC's Standby system and/or perform an LSWU upgrade.

The code is modified to correct the algorithm's reliability issues.

Workaround: Disable (inhibit) SIP REC calls before bringing up the Standby system or performing LSWU upgrade.

SBX-1210311

The SBC 5400 failover occurred on server

Impact: The SCM cores due to memory corruption.

Root Cause: The memory corruption is caused by a bug where the length field of a structure wrapped around the size of the USHORT that it is stored in is causing an incorrect length value.

We use this length to calculate the address where we’re going to copy data into. Therefore, when the length is incorrect the incorrect location data is copied, causing memory corruption.

Steps to Replicate: The steps are not reproducible. 

The code is modified to prevent the length field from wrapping when it becomes very large.

Workaround: None.

SBX-1182901

SWE Traffic Profile sync problem in HA

Impact: The traffic profile fails to get applied on 1-to-1 SBC 9.2.3R0 Openstack VM registered with V13.02.06R000 EMS when the SBC VM is spawned with the large memory config Profile.

Root Cause: 1-to-1 mode SBC registered with EMS fails to apply the large config profile as part of init operations on an active SBC. This results in the creation of a marker file (skipRebootMarker). The presence of this marker file causes the application to reject the traffic profile activation from CLI/EMS on an active SBC.

Steps to Replicate:

  1. Launch 1:1 Openstack SBC with V09.02.03-R0 Build, registered with EMS V13.02.06R000.
  2. Log into Active SBC and change sweConfiguration profile to large (both SBCs go for a reboot).
  3. Run saveAndactivate from the SBC CLI -- EMS gets synced with the SBC's configuration.
  4. Log into Openstack console, and rebuild both Active and Standby SBC instances with same V09.02.03-R0 build image.
  5. Log in to the active SBC and check sweConfiguration profile – the profile will be shown as small, rather than large.
  6. Try activating the standard_passthrough Profile – none of the SBCs go for reboot for activation of traffic profile.
  7. Reboot both active and standby SBC instances manually - only the old active will come up with the activated traffic profile from the previous step.

The code is modified to update the logic for introducing the marker file. The marker file was introduced incorrectly as part of the large config profile activation.

Workaround:

  1. Log in to SBCs as root user and remove the marker file from both active and standby instances:
    rm -f /opt/sonus/conf/swe/capacityEstimates/.skipRebootMarker
  2. Re-activate the large sweConfigProfile from the active SBCs CLI console by running the following command:
    set system sweConfigProfileSelection name large
SBX-1217231

Incoming SIP SUBSCRIBE requests from registered endpoints were incorrectly rejected with a SIP 403 Forbidden response 

Impact: The SBC incorrectly rejects incoming SIP SUBSCRIBE requests from registered endpoints with a SIP 403 Forbidden response.

Root Cause: The logic that was added for SBX-119915 to check an endpoint's registration status while processing the incoming SIP SUBSCRIBE request should only apply when the usePortRangeFlag feature is enabled.

Steps to Replicate:

  1. Establish a new SIP registration, followed by a new SIP subscription for an event of your choice.
  2. Verify that the SBC relays the SIP SUBSCRIBE to the registrar and that the SBC doesn't reject the SIP SUBSCRIBE with a SIP 403 Forbidden response.

Reverted the SBX-119915 code change.

Workaround: None.

Severity 2-3 Resolved Issues

The following issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-106015 | SBX-1204932/3

Ingress T.38 Fax fails when the Egress is SIP or TDM (SBX-12043) / T.4 data size exceeds expected size based on fax speed (SBX-106015)

Impact:

  • SBX-106015 (Sev. 2): The UDP packets for the 14.4 rate are 84 bytes instead of 72 bytes corresponding to a 40 ms payload. This is not a bug, but is considered an unnecessary change that was introduced as a part of T.38 3.35 (This is getting rolled back to the original 72-byte packet size).
  • SBX-120493 (Sev. 3): Certain T.38 endpoints send TCF much earlier relative to DCS packets (e.g. fax server, as indicated by 'SIP User-Agent: VFAXSUA/IPFAX-9.0.7806.611'). The current stack handles it by dropping TCF while its still modulating the DCS signal. This results in a shorter modulated TCF, which causes the receiving fax machines to indicate a failure via an FTT message.

Root Cause:

  • SBX-106015: The T.38 stack upgrade to 3.35 induced an unnecessary change. While this is not a bug, the best approach is to avoid unnecessary changes.
  • SBX-120493: Incorrect DCS message lengths and TCF message timings (TCF messages arrive while the stack is still modulating DCS) are sent from some T.38 endpoints.

Steps to Replicate:

SBX-106015:

  1. Establish a. 14.4 rate T.38-G711 fax call so that the SBC stack G.711 leg is Ingress.
    The SBC stack then generates TCF UDPTL packets.
  2. Using wireshark, inspect the media packets payload size.
    1. Without the fix, the payload size for media packets is 82 bytes.
    2. With the fix, the payload size is 72 bytes.

SBX-120493:

  • If a failure occurs with VFAXSUA/IPFAX type device, and the TCF packets arrive before modulating an earlier DCS, than the generated TCF tends to be shorter than the standard 1.5 seconds.
  • With this fix, the TCF duration matches the actual received TCF duration payload.

To overcome when T.38 peers send TCFs earlier than expected, the stack code is modified to delay TCF generation until the DCS is modulated.

Additionally, the T.38 stack code changes are rolled back to produce 72-byte packets for 14.4. TCF.

Workaround:

  • SBX-106015: N/A
  • SBX-120493: No workaround


SBX-121662 | SBX-1124372

PortFix SBX-112437: The SCM Process and SAM Process core observed for Enhanced Local Redirection

Impact: SCM cores when processing a SIP message that contained 10 Contact Headers and Multiple Identity headers.

Root Cause: The length of the data became too large to be stored in a length field that is a USHORT. The contents of the length field wrapped around the size of the USHORT that it is stored in, causing an incorrect length value.

This length is used to calculate the address where it is going to copy data into. Therefore, when the length is incorrect it copies into an incorrect location causing memory corruption.

Steps to Replicate: Run a test where a SIP message that contained 10 Contact Headers and Multiple Identity headers is sent to the SBC. This message is processed correctly and there was no core.

The code is modified to add defensive code to prevent the length field from wrapping when it becomes very large.

Workaround: None.

SBX-121509 | SBX-1144222

PortFix SBX-114422: SBC 7000 Trunk Group Stats contain Parent CAC trunk group (a.k.a Shared CAC-Limits Pool) stats with strings "key not found in" instead of Zone name and AC name

Impact: SBC 7000 Trunk Group Stats contain Parent CAC trunk group (Shared CAC-Limits Pool) stats with strings "key not found in" instead of Zone name and AC name

Root Cause: The Trunk Group Stats considers sharedCacLimitsPool as a TG and since sharedCacLimitsPool is not linked to address context or zone, those fields are populated with 000, and later while trying to fetch value for the TrunkGroupStatusStats file it is updated as "key not found in."

Steps to Replicate:

  1. Set up basic SIP-SIP call.
  2. Configure sharedCacLimitsPool.
  3. Attach the sharedCacLimitsPool to an Ingress Trunk Group.
    TrunkGroupStatusStats does not contain an Entry for sharedCacLimitsPool.

The code is modified to skip the TrunkGroupStatusStats entry for sharedCacLimitsPool.

Workaround: None.

Resolved Issues in 09.02.05R001 Release

Severity 1 Resolved Issues

The following Severity 1 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-1213001

Back-to-back cores occurring on the SBC

Impact: The SBC experiences back-to-back cores while applying disconnect treatment to calls.

Root Cause: The disconnect treatment action is invoked twice for the same call while a new control block is created. This second control block includes updated pointers to for the disconnect treatment resources. The pointers in the first block are now invalid. Consequently, a core results if the first block is used.

Steps to Replicate:

Configure calls behind NAT with a disconnect treatment applied.

(You may need to run a simulated load to reproduce the issue)

Expected result:

A call fails due to the busy trigger invoking the disconnect treatment.

A core may not occur because the failure condition is timing-related.

The code is modified to avoid allocating a second control block and will now log a message.

Workaround: Remove the Disconnect Treatment Profile.

SBX-1212981

SBC3 SBC 7000 switchover and ScmP process crashes

Impact: ScmProcess cores after receiving a re-Invite without SDP.

Root Cause: The SIP code is attempting to reference a NULL pointer because the initial Invite does not include SDP details. Since the SBC does not have anything in the sessPtr of the pActiveSgPspStr, updates to these elements results in reading a null pointer.

Steps to Replicate: This issue was found by code inspection.

The code is modified to prevent referencing a NULL pointer.

Workaround: None.

SBX-1209601

SIP to SIP call - no response sent for PRACK

Impact: While the call is playing disconnect treatment, the SBC receives an SDP offer in the PRACK, but was not able to respond.

Root Cause: The application is already in a disconnecting state and is not able to accept a new SDP offer.

Steps to Replicate:

  1. Configure call disconnected treatment
  2. A (prack support) call B, B answer 486.
  3. The SBC sends 18x with sdp to A for disconnected treatment.
  4. A send new offer in PRACK.

The code is modified so that SIPS answers the 200 OK for PRACK using the same SDP send out(18x) for disconnect treatment.

Workaround: Disaple PRACK on ingress or disconnected treatment.

SBX-1211691

Transcoding of DTMF stopped working after upgrade to 9.2.5R0

Impact: Transcoding of DTMF stopped working after upgrade to 9.2.5R0

Root Cause: A code change was made involving the NP to do a payload type substitution because the PT2833 field is set to the received value, and is told to substitute it with a new value. Since the DSP expects the original value, it drops the new value.

Steps to Replicate:

  1. Make a transcoded call with a different DTMF PT on the ingress and egress legs.
  2. Send DTMF digit events in each direction and verify the DTMF PTs are correctly modified.
  3. Make a pass-through call with different DTMF PTs on the ingress and egress legs
  4. Send DTMF digit events in each direction and verify the DTMF PTs are correctly modified.

The code is modified to add a check for transcoded calls when setting dtmfPTSubEnable flag. So that dtmfPTSubEnable = FALSE will be sent to XRM when activating XRES.. NP is not supposed to do PT sub for transcoded calls because the DSP will effectively do it.

This is the fix for WBA Number = Warning-22-00036730

Workaround: None.

SBX-1189461

The Service Instance X2 message does not specify which party put a call on hold in a multi-party call

Impact: If an intercepted (legacy LI) call is put on hold, the Service instance message is sent to the mediation server. But the call hold direction is not specified in Service instance message.

Root Cause: Currently, the SBC sends a service instance message for CALL_HOLD if any leg is intercepted. Also as per packet cable specification, there is no call direction parameter in the Service instance message.

Steps to Replicate: Provision the SBC for LI on the ingress leg where a calling party number is the target.

Test-1:

  1. Make an A-to-B call.
    Since A is the target, signaling Interception starts.
  2. Send a re-invite from B (egress) side for a call hold.
    The SBC sends a service instance message with service name "Call_Hold" and called party number.
  3. Send a re-invite from B (egress) side for call retrieve.
    The SBC sends a service instance message with service name "Call_Retrieve" and called party number.

Test-2:

  1. Make an A-to-B call.
    Since A is the target, signaling Interception starts.
  2. Send a re-invite from A (ingress) side for call hold.
    The SBC sends a service instance message with only service name "Call_Hold".
  3. Send a re-invite from B(ingress) side for call retrieve.
    The SBC sends a service instance message with only service name "Call_Retrieve".

The code is modified such that currently only the "Service name" parameter is populated by the In Service instance message for call hold/retrieve. After the fix, if the call hold/retrieve is received from egress side, the "called party number" parameter is also added to the Service instance message. If the Call hold/retrieve is received from ingress side, the called party number is not added to the Service instance message.

Workaround: None.

SBX-121065 | SBX-1209791

Portfix SBX-120979: Standby SLB not coming up after upgrading the SBC due to API changes in Azure cloud.

Impact: The SBC application fails to come up after running an upgrade.

Root Cause: The generated cloudinit configuration is incorrect for the swapped disk due to cloudinit script API changes.

Steps to Replicate: Perform an upgrade on the SBC using the IaC package.

The code is modified to remove the incorrectly generated cloudinit config and link to the correct config.

Workaround: None.


Severity 2-4 Resolved Issues

The following Severity 2-4 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-114422 | SBX-1215092

PortFix SBX-114422: The SBC 7000 Trunk Group Stats contain the Parent CAC trunk group (a.k.a Shared CAC-Limits Pool) stats with strings "key not found in" instead of Zone name and AC name.

Impact: The SBC 7000 Trunk Group Stats contain the Parent CAC trunk group (a.k.a Shared CAC-Limits Pool) stats with strings "key not found in" instead of Zone name and AC name.

Root Cause: The Trunk Group Stats considers sharedCacLimitsPool as a TG and since sharedCacLimitsPool is not linked to address context or zone, those fields are populated with 000. While trying to fetch value for the TrunkGroupStatusStats file, the TG is updated as "key not found in".

Steps to Replicate: 

  1. Set up a basic SIP-SIP call.
  2. Configure sharedCacLimitsPool.
  3. Attach the sharedCacLimitsPool to Ingress Trunk Group.

TrunkGroupStatusStats does not contain an Entry for sharedCacLimitsPool.

The code is modified to skip the TrunkGroupStatusStats entry for sharedCacLimitsPool. 

Workaround: None.

SBX-1196122

200 OK for re-INVITE contains telephone-event although the previous offer/answer does not have it

Impact: The SBC sends telephone-event in 200 OK for re-INVITE/UPDATE though previous offer/answer does not have it.

Root Cause: This issue is observed mainly when auto answering happens on the opposite call leg. While auto answering, the SBC is not checking whether the modify offer contains DTMF set or not. Due to this, if the Peer contains DTMF already, then SBC is sending response with DTMF set.

Steps to Replicate: None.

The code is modified to alter the auto answering logic, such that the SBC explicitly checks whether offer contains any DTMF or not and responds accordingly.

Workaround: None.

SBX-121156 | SBX-1205602

Portfix SBX-120560: RunTime errors and leaks observed during SBX_4948 suite execution.

Impact: RunTime errors and leaks observed during running calls with PAreaInfo header.

Root Cause: Missing null checks in the clone function for PAreaInfo header.

Steps to Replicate: Run Invite callflow containing PAreaInfo header in ASAN build.

The code is modified to add null checks in the clone function for PAreaInfo header.

Workaround: None.

SBX-1189722

AWS SBC application went down

Impact: The SBC applicaton hit a deadlock due to the SbcSftp executable crashing while it still had access to a lock for updating the ACL table.

Root Cause: This appears to be due to the command being called from a cronjob and used in conjunction with expect script to provide password. The SbcSftp command was terminated while it still had access to the SBC lock to update the ACL table and the SBC timed out while waiting for the lock to become available.

Steps to Replicate: The problem could not be reproduced.

The code is modified to allow the SbcSftp utility to be extended with a new option to supply the key file with -I option. The new usage will look like below:

Usage: SbcSftp <<IP>> <<port>> <<username>> <<upload/download>> <<local SBC path>> <<remote Server path>> [<<-I certificate file with path>>]

The certificate option is in the end just to keep the same order for existing options.

This should avoid the need to expect script to provide password input. It is also recommended to run the SbcSftp command via "nohup" to make it completes even if the linux ssh session terminates e.g.:

nohup SbcSftp

Workaround: Use "nohup" command in conjunction with SbcSftp so it completes successfully and releases resources. Avoid running the command from a cronjob.

SBX-120984 | SBX-1208953

PortFix SBX-120895: Clicking Noise on calls transcoded between PCMU+CN to AMR-WB

Impact: Clicking sound observed on AMRWB leg in G711U to AMRWB call.

Root Cause: Some packets in the G711U stream contained a G711 payload which was not in multiple of 10ms or 80 bytes. The Playout Buffer at DSP does not handle G711 payload which are not in multiples of 10ms.

Steps to Replicate:

  1. Make a G711 to GPU AMRWB call.
  2. Configure G711 MULAW with Silence Suppression enabled (CN with PT 13) in SDP.
  3. Stream the attached PKT file (MULAW_p20_SBX102895.pkt) on G711 leg. This file corresponds to field capture srcPort45200.pcap which is attached in the JIRA.
  4. Capture the output on AMRWB leg.

The code is modified so that the G711 payload is made to be a multiple of 10ms by appending silence to the payload while copying it into Playout Buffer if the G711 payload is not in multiples of 10ms.

Workaround: None.

SBX-1207712

SBC fails to reset ROC to 0 on the DTLS/SRTP call leg upon INVITE w/ Replaces on the RTP leg when the RTP peer started using a new SSRC

Impact: The SBC fails to reset ROC to 0 on the DTLS/SRTP call leg upon INVITE w/ Replaces on the RTP leg when the RTP peer started using a new SSRC

Root Cause: The call modification caused by the re-INVITE causes the NP media RID resource to be disabled and a new RID enabled for the same call leg.

The logic in the NP is such that if LAST_SSRC is 0, it does learning and latches the SSRC of the first packet and does not reset the ROC.

If the ssrcRandomizeForSrtp flag were enabled, XRM would apply a new randomly-generated initial LAST_SSRC value to the NP RID and instruct NP to reset SSN and ROC when enabling the new RID.
But as per initial impementation, ssrcRandomizeForSrtp does not apply to DTLS/SRTP.

Steps to Replicate:

  1. Enable ssrcRandomizeForSrtp in packet service profile.
  2. Make a long duration RTP(AS side) to DTLS/SRTP passthrough call.
  3. After 27 mins, trigger AS switchover to sent an INVITE w/ Replaces to the SBC.
  4. Check for one way audio.

The code is modified to add dtlsSrtpAdminState in NRMA while enabling ssrcRandomizeForSrtp for non dtlsSrtpRelay/dtlsSctpRelay cases. As well, in XRM, check is added for SSRC change when encId has changed.

Workaround: None.

SBX-120624 | SBX-1194682

Portfix SBX-119468:2833 DTMF PT is default instead of negotiated on call leg

Impact: During mid-call modification, the SBC uses the configured 2833 PT rather than the previously negotiated DTMF PT if either of the endpoints chooses to remove DTMF PT in subsequent mid-call modifications.

Root Cause: If either of the endpoints removes the DTMF during mid-call modifications, the SBC is picking the configured 2833 PT while generating offer towards the other endpoint rather than the previously negotiated PT.

Steps to Replicate: 

  1. Enable "Difference in DTMF" flag under p2p control.
  2. Setup a pass-through call with DTMF PT=110.
  3. Send a late media re-invite from UAS.
  4. The SBC sends offer to UAS with 2833 PT.
  5. UAS sends answer SDP in ACK but without 2833 PT.
  6. The SBC generates offer towards UAC with configured DTMF PT (instead of 110). However, after this fix, SBC continues to uses the negotiated PT (110) on ingress leg.

The code is modified to use the already negotiated DTMF PT during mid-call modifications.

Workaround: None.

SBX-120822 | SBX-1180732

PortFix SBX-118073: SBC did not use the protected port in some of the headers

Impact: When IPSEC connection is created the port allocated for the connection is known as protected port, this is different to the standard 5060/5061 port used for signaling. The SBC was not sending the protected port information correctly in all the via/record-route headers.

  • When the SBC sends INVITE/UPDATE to UE, the port in Via and Record-Route headers are protected port.
  • When the SBC sends NOTIFY to UE, the port in via is protected port, but port in record-route is 5060.
  • When the SBC sends 180/183/200 to UE, the port in via is protected port, but port in record-route is 5060.
  • When the SBC sends BYE to UE, the port in via is 5060, the SBC was not.

Per test result and observation:

  • When the SBC sends INVITE/UPDATE to UE, the port in Via and Record-Route headers are protected port.
  • When the SBC sends NOTIFY to UE, the port in via is protected port, but port in record-route is 5060.
  • When the SBC sends 180/183/200 to UE, the port in via is protected port, but port in record-route is 5060.
  • When the SBC sends BYE to UE, the port in via is 5060.

Currently, SMM is used to store the port-s in variable, then:

  • If via port is 5060 for request sending by SBC to UE, then uses SMM to change the port in via to protected port.
  • If record-route is 5060 in 18x~200 for response sending from SBC to UE, then use SMM to replace it with protected port.

Root Cause: The SBC was using the wrong port information due to an interaction with contact header transparency logic.

Steps to Replicate:

  1. Setup IPSEC config on ingress interface(LIG1).
  2. Enable passCompleteContactHeader transparency flag.
  3. Setup basic SIP-SIP call.

    Check that the IPSEC port is used correctly in via and record-route headers.

The code is modified to remove the logic related to contact header transparency while selecting the correct protected port information to include the SIP headers.

Workaround: Disable "passCompleteContactHeader" flag under IPSP.

SBX-120980 | SBX-1209713

Portfix SBX-120971: Standby services not starting after upgrade with FIPS enabled.

Impact: Services not starting up after upgrade due to CRITICAL FIPS-140-3 error.

Root Cause: Integrity check was failing due to missing /home/oracle/product/oracleDB.sha256sums.

Steps to Replicate: 

  1. Enable FIPS mode.
  2. Perform upgrade.
  3. Verify if services are up.
  4. Verify if FIPS mode is enabled.

The code is modified so /home/oracle/product/oracleDB.sha256sums is now present in /home/oracle/oracleDB.sha256sums. Updated file paths in checkFipsSoftwareIntegrity.sh to check in correct locations.

Workaround: None.


Resolved Issues in 09.02.05R000 Release

Severity 1 Resolved Issues

The following Severity 1 issues are resolved in this release:

Issue
ID

Problem DescriptionResolution
SBX-120433

Unexpected switchover on the SBC SWe pair.

Impact: The SCM process coredumps after processing a Dialog Event.

Root Cause: The cause of the coredump is the code accessing a structure where elements are freed.

As a result, the code de-references pointers in this structure that is set to NULL.

Steps to Replicate: This issue is not reproducible.

The code is modified to free the Dialog structure only after freeing the elements it points to. This fix prevents dereferencing pointers in this structure that are set to NULL. Multiple stack traces show the same routine in the code as being deficient - this is where additional checking logic is added. 

Workaround: There is no workaround.

SBX-119679

SBC Switchover processAbnormalTermination with core

Impact: Subscribe relay with multiple crank back failures may cause the SBC to core.

Root Cause: When retransition eventually times out and multiple application crank back failures take place for Subscribe Relay, there may be a core observed due to a stack recursion. This results in a duplicate free of the relay control block.

Steps to Replicate: Not able to reproduce due to specific customer configuration.

The code is modified to process the freeing of the relay control block in a separate thread.

Workaround: Avoid crank back.

SBX-118299

Load Testing - Packet Loss

Impact: SWe_NP was not able to handle traffic burst, and observed packet loss.

Root Cause: Due to high wakeup latencies in SWe_NP caused by scheduling and CPU idle time management, the packets accumulated in the hardware queue are not drained by SWe_NP in time.
The hardware queue is quickly filled up when there is traffic burst, and due the latencies caused by scheduling, SWe_NP could not read the packets in time, and the previous packets were overwritten in the hardware queue.

Steps to Replicate: The reproduction of this test requires simulating the traffic burst.
One way is to use multiple call generators.

The code is modified to change the scheduling policy of SWe_NP to Realtime (SCHED_FIFO) and change the idle behavior of the CPU to poll, instead of halt.

Workaround: Reduce the number of calls and number of call generators.

SBX-117435

Running a sysdump on a SBC 5400 triggers packet port down/up condition

Impact: Port link failure observed while running sysdump on the SBC 5400. This could cause an SBC switchover.

Root Cause: Enhancements made to collect more Network Processor (NP) memory area caused interference for the interface driver reading the port link status. This interference caused the driver to falsely report link down. The link status is obtained from the NP processor's (Octeon) register.

Steps to Replicate: Run np_mem_dump.pl while the SBC application is running while the mgt/pkt interfaces are in a link up state.

Sample command line to run 100x:
[root@yf04a np]# x=1; while [ $x -le 100 ]; do echo $x; date; ./np_mem_dump.pl/var/log/sonus/np/npMem0_d$x.log >& npdump.log ; date; $(( x++ )); done

Note: This command creates npMem0_d[1..100].log files and could fill up the disk.

The code is modified to allow the utility function to collect NP memory and NP registers in order to access the Octeon register through the driver instead of directly accessing the register. This avoids concurrent access of the register which caused the false link failure.

Workaround: Do not run sysdump or /opt/sonus/bin/np/np_mem_dump.pl while the SBC is running.

You can obtain an updated /opt/sonus/bin/np/oct-remote-memory and /opt/sonus/bin/np/oct-remote-csr binary to avoid the link bounce while running sysdump.

SBX-119464

The SBC performed switchover with processAbnormalTermination error code

Impact: The SCM process cored due to a Healthcheck timeout.

Root Cause: An infinite loop is encountered when mirroring Subscription CBs.

Steps to Replicate: The steps are not reproducible.

The code is modified to prevent the SBC from spinning in this particular loop.

Workaround: None.

SBX-118608

After a 491 response due to re-INVITE contention, the SBC continues the call even though the SDP is unmatched.

Impact: After 491 response, the SBC sends re-INVITEs with invalid application media format.

Root Cause: When the application processes the queued request internally, it loses the other leg application media format that it used for the remote to send out.

Steps to Replicate:

  1. Enable e2e re-INVITE.
  2. Run multimedia SDP applications.
    After the call connects with both media, both ends try to re-INVITE with one media active that will trigger the SBC to send 491 and re-INVITE.

The code is modified to properly store the other leg application media format in SIPS, so that it can send out correctly when it processes the queued message.

Workaround: None.

SBX-117393

The SCM Process cores and causes a switchover.

Impact: The SCM Process cores when attempting to allocate memory.

Root Cause: The SCM Process cores when attempting to allocate memory because the memory management code has detected memory corruption.
The memory corruption occurred because the code was written into a memory block after it had been freed. This appears to have occurred when the SRS gets blacklisted during setup and the call needs to route advance to the next SRS.

Steps to Replicate: The steps are not reproducible.

The code is modified to prevent writing into this memory block after it is freed.

Workaround: None.

SBX-119111

The SBC Core has a switchover twice during the day.

Impact: SCM cores in SIP code when using SIP Refer Relay.

Root Cause: The core is due to an attempt to dereference a NULL pointer while processing a message related to SIP Refer Relay.

Steps to Replicate: The root cause was found by code inspection.
The exact call flow that will causes the pointer to be NULL when entering the affected code is unknown.
(With this fix, the code will not core in the future if the pointer is NULL.)

The code is modified to make sure the pointer is valid before attempting to dereference it.

Workaround: Disable the SIP Refer Relay.

SBX-120416

SIPSG code cores due to accessing pktCcb pointer that has been set to NULL

Impact: SIPSG code cores due to accessing the pktCcb pointer that has been set to NULL.
This issue can show up with a number of different stack traces (depending on the call flow).

Root Cause: The fix in the past included a change that sets fsmCcb->pktCcb to NULL after clearing out the contents of the pktCcb.

The reason for setting fsmCcb->pktCcb to NULL after clearing out the contents of the pktCcb was to prevent executing the code in SgOaClearPktCcb() more than once.

The previous fix was unnecessary because SgOaClearPktCcb() already checks every field for NULL before attempting to free it.

This change causes new cores because there is code that is accessing pktCcb pointer after it was set to NULL (in the past it was safe to assume that pktCcb pointer would not be NULL).

This bug was introduced in the 9.2.4R3 release.

Steps to Replicate: The steps are not reproducible

The code is modified to remove the change that sets fsmCcb->pktCcb to NULL.

Workaround: None.

SBX-117476


Congestion Memory issue.

Impact: The SCM process leaks memory when "sendSBCSupportedCodecsForLateMediaReInvite" is enabled in the IP Signaling Profile.

Root Cause: The SCM process may not free internally allocated structure when "sendSBCSupportedCodecsForLateMediaReInvite" is enabled in IP Signaling Profile.

Steps to Replicate: Run load with “sendSBCSupportedCodecsForLateMediaReInvite” enabled in the IP Signaling Profile and confirm the leak.

NOTE: The call flow must result with sending a "NRMA Modify" internally.

The code is modified to ensure that these structures are freed when "sendSBCSupportedCodecsForLateMediaReInvite" is enabled in IP Signaling Profile.

Workaround: Disabling "sendSBCSupportedCodecsForLateMediaReInvite" may prevent this issue.

However, there may be other code paths or scenarios which may trigger this leak.

SBX-115937

A switchover occurs on the SBC due to a deadlock issue.

Impact: A switchover occurs on the SBC due to a deadlock issue.
The CPX process deadlocks while calling CpxTrunkGroupMediaIpSecondaryInterfaceGroupNameValidate to validate the SecondaryInterfaceGroupName while the customer was making lots of calls to get the authPassword, for example:

show table addressContext <context> zone <zone> sipTrunkGroup <trunkgroup> signaling authentication authPassword

Root Cause: When the the authPassword is being fetched multiple times a second, that call was occuring at the exact same time as the CpxTrunkGroupMediaIpSecondaryInterfaceGroupNameValidate was called. Both routines use the same global maapiSocket to do maapi calls to read the confd database. Since the same global socket was being used, the maapi_exists call is hung.

Steps to Replicate: In one CLI session, make a lot of calls to get the authPassword:
show table addressContext <context> zone <zone> sipTrunkGroup <trunkgroup> signaling authentication authPassword

In another CLI session, do a:
set addressContext <context> zone <zone> sipTrunkGroup <trunk group> media mediaIpSecondaryInterfaceGroupName <groupname>

Observe that the CPX does not crash.

The code is modified so that the CpxTrunkGroupPassGetElem function performs a 'cdb get' action to get the authPassword, so there is no contention for the global maapiSocket.

Workaround: Do not get the authPassword at the same time as setting the mediaIpSecondaryInterfaceGroupName.

SBX-118999

After an SBC 9.2.3 SW upgrade, the ACLs are blocking traffic when enabled.

Impact: The IPACL rule is incorrectly installed in the NP.

Root Cause: You can configure the IPACL rules with or without an ipInterface. If an IPACL rule is configured with an ipInterface, it is not installed in the NP until the associated ipInterface is created and enabled in the NP. The IPACL task tries to re-add those rules that are waiting on the ipInterface for it to receive a 'port up' notification from the NRS.

When mixing a set of IPACL rules, some rules that are not defined with the ipInterface are installed in the NP during the startup of the applications, while other rules that are defined with the ipInterface may get delayed while waiting for the associated ipInterfaces to become ready. All of the IPACL rules are ordered by precedence in the CPS context and will be programed in the NP in the same order.

When the IPACL task tries to re-add the rules that are waiting on ipInterface, the order of the rules is changed. The new rules are inserted at the proper location in the CPS context, based on their precedence. But there is no corresponding shuffling at the NP layer which causes some newly-added rules to randomly overwrite some existing rules.

Steps to Replicate:

  1. Configure the following three IPACL rules:
    rule 1: Define the LIF and the ipInterfaceGroup that contains this LIF, and assign the smallest precedence value among three rules.
    rule 2: Use the same ipInterfaceGroup as rule1, protocol = ICMP, assign precedence value > rule1, do not define as ipInterface.
    rule 3: Same as rule 2, except assign the precedence value > rule2.
  2. Take the LIF OOS and disable.
  3. Restart the application.
  4. Enable and in-service LIF.
  5. Ping the next hop address through pkt port of the LIF.
  6. Check the stats using the following command:
    "show table addressContext ADDR_CONTEXT_1 ipAccessControlList ipAclRulesByPrecedence"

This should result in rule 3 showing match counts instead of rule 2.

The code is modified to add all the rules in the NP, including the ones already added on the IPACL retry.

Workaround: None.

SBX-119106

The SBC application restarts.

Impact: A SAM process encounters a core due to a Healthcheck timeout when the SIPCM attempts to open a TLS connection. The security certificate named in the tlsProfile is expired.

Root Cause: Two threads are hung while attempting to write a security certificate update () to the DB using the same socket. The purpose of the update is to change the state of the certificate to EXPIRED.

Steps to Replicate: 

  1. Run a TLS load that will attempt to use an expired PKI security certificate (tlsProfile includes the name of the security certificate).
  2. Look for the following messages in the DBG logs:

100000B.DBG:076 05262022 000010.545176:1.02.00.18170.MAJOR .SEC: *Certificate expired

The code is modified to add a lock preventing two threads from writing to the DB using the same socket.

Workaround: Renew PKI Security Certificates before they expire.

SBX-118402

SBC Ethernet Port Packet Port Statistics have peak value equal zero.

Impact: SBC Ethernet Port Packet Port Statistics have incorrect peak value equal to zero.

Root Cause: The SBC has reset the bandwidth peak value after statistics collection.

Steps to Replicate: Execute a call load for hours and collect ethernet port packet stat.

The code is modified allowing the SBC to reset the bandwidth counter before it collects the real data.

Workaround: None.

SBX-115213

Node B unexpectedly restarts when Node A is in SyncInProgress for a long time.

Impact: The Call/Registration Data on the SBC shows syncInProgress for an extended period of time.

Root Cause: A redundancy message buffer is not large enough to hold the data and causes the sync to be incomplete. This results in the Call/Registration Data to remain in a syncInProgress state.

Steps to Replicate: Run multiple Registration/Calls on the SBC.

The code is modified to address the issue. 

Workaround: None

SBX-115911

Application restarted due to processAbnormalTermination

Impact: SSREq process coredumped while receiving message with length =0.

Root Cause: When the message length is =0, the third party software, Xalan, crashes when allocating memory.

Steps to Replicate: Perform SSREq request to ERE when configured for external PSX.

The code is modified to add a check to not process messages with length=0.

Workaround: Stop the SSREq process.

SBX-118473

The SBC resets SRTP encryption sequence number after a re-INVITE; the anti-replay protection at the far end (on another SBC) discards the incoming SRTP packets until the sequence number approaches the highest recorded sequence number.

Impact: Intermittent one-way audio with a duration of more than 10 seconds may occur during call transfers when the remote connection media IP address changed on the secure RTP (SRTP) call leg. The RTP sequence number (SSN) of the outgoing SRTP stream encrypted by the SBC may roll back to a lower value that causes the SRTP packets being discarded by SRTP anti-replay protection at the receiver's end. Once the SSN of the SRTP stream reached the highest recorded value, the audio was back and both parties could hear each other.

Root Cause: After the call transfer, the remote connection media IP address on the SRTP call leg was modified without deactivating the media resource chain. This caused the delay in applying the security configuration to the media resource chain, which in turn caused the first one of several SRTP packets being sent with a high SSN number and the roll back of the SSN to a lower value. The remote end discarded the SRTP packets with a lower SSN than the highest recorded SSN.

Steps to Replicate: 

  1. Make a SRTP-to-RTP call between A and B through the SBC under test.
  2. A puts B on hold and calls C through a different SBC/device.
  3. A bridges B and C together and uses a late-media re-INVITE towards B to modify the original connection media IP address with the C's media IP address.
  4. The SBC sends a re-INVITE with a SDP offer to B.
  5. Once the SBC receives a 200 OK with a SDP answer from B, it starts sending the SRTP packets to C's connection media IP address.
  6. The first SRTP packet sent to C has a SSN of around 1000 and the second SRTP packet has a SSN of less than 256. C discards all received SRTP packets until the SSN reaches the highest recorded SSN, which is 1000.

The code is modified so in a modify offer or answer for a SRTP call, if the remote connection media IP address is modified on the SRTP call leg, the new IP and security configuration are applied at the same time, without a delay.

Workaround: None.

SBX-119079

SBC delay in processing Late Media re-INVITE

Impact: The SBC is not able to relay/responds to the late media re-INVITE after call is connected.

Root Cause: There is a race condition where ingress connects first before egress. The SBC received reInvite and forwards to egress. Egress internally responds 491 because egress is not in the connected state yet. However, internally the CC subsystem is ignoring to relay the 491 and responds due to the wrong state.

Steps to Replicate: Configure the passthru latemedia:

  1. Late media call
  2. Ingress sends latemedia re-INVITE immediately after sending ACK for the first Invite.

The code is modified to correct the CC logic to relay the 491 responds to ingress.

Workaround: Disable passthru latemedia.

SBX-118991

Transcoding is failing for T.38 involving SRTP

Impact: The SBC is not sending SRTP attributes in an outgoing offer for the G711 fax call.

Root Cause: This issue is specific to a call flow where the initial audio call is a pass-through with non-G711 codec and later transitions to fax using G711. In this call flow, the SBC fails to offer SRTP crypto attributes during the fax call.

Steps to Replicate: Configuration:

Ingress Route PSP -
Fax Tone Treatment: FAX_TONE_TREATMENT_FALLBACK_G711

Egress Route PSP -
Fax Tone Treatment: FAX_TONE_TREATMENT_IGNORE_DETECT_ALLOW_FAX_RELAY

PSP -> Enable flag "Apply Fax Tone Treatment"

  1. Setup G.722 pass-through call with SRTP on ingress leg.
  2. Once audio call is stable, send T.38 re-invite from UAS.
  3. The SBC sends G711 fax re-Invite towards ingress leg.

Without fix: The re-Invite at step 3 is sent with out SRTP.

With fix: The re-Invite at step 3 is sent with SRTP.

The code is modified to offer crypto attributes even when the initial audio call is using a non-G711 codec.

Workaround: None.

SBX-119574

SIP to SIP call had no response to PRACK.

Impact: The SBC is unable to respond to PRACK with new SDP offer while the call is in terminating state.

Root Cause: Call is in terminating state.

Steps to Replicate: The Ingress configuration disconnected the treatment.

  1. A (PRACK support) call B, B answer failure response (ex: 486)
  2. SBC sends 183 to play disconnected treatment.
  3. Peer sends PRACK with SDP new offer.

The code is modified so the SBC rejects a 500 error response to a PRACK request with an SDP offer.

Workaround: Disable PRACK or disable disconnected treatment.

SBX-119797

Video call disconnects abruptly due to ACK not getting propagated

Impact: The SBC is unable to answer ACK for re-INVITE on ingress leg.

Root Cause: The Egress leg is resetting the end-to-end ACK feature after receiving 200 OK offer for latemedia call. As a result, this causes the ACK to not send on Ingress for re-INVITE.

Steps to Replicate:

  1. Configure the latemedia passthrough, enable e2e ACK, and e2e re-INVITE
  2. Run a late media call
  3. Egress sends a re-INVITE to Ingress
  4. Ingress answer 200 OK
  5. Egress answer ACK

The code is modified to turn on the e2e ACK feature back after the ACK send out for latemedia call.

Workaround: Disable e2e re-INVITE or e2e ACK.

SBX-117963

SAM Process coredumps are causing a switchover if FAC enabled and call Id is longer than 24 characters.

Impact: While reporting statistics for a Fault Avalanche Control (FAC), the SAM process may core if reporting on a call with a callId larger than 24 characters.

Root Cause: While reporting statistics for FAC, an incorrect "maximum size" is used when copying a callId - resulting in the code writing past the end of an allocated buffer and corrupting memory.

Steps to Replicate: Run some calls with FAC while collecting FAC statistics.

The callids for these calls should be longer than 24 characters.

The code is modified to use the correct "maximum size" when copying the callId.

Workaround: Disable FAC.

The FAC feature blocks SIP messages of certain key elements that caused multiple coredumps in the past. Disabling FAC will block them from getting processed again

SBX-119885

An SCM Process core occurred on both servers.

Impact: The SIPCM process cores.

Root Cause: The SIPCM process cores because it was accessing a Packet CCB that had already been freed.

Steps to Replicate: The steps are not reproducible.

The code is modified to add defensive code to prevent SIPSG from accessing a Packet CCB that is already freed.

Workaround: None.

SBX-120363

The SBC cores along with disk errors seen (2ndcore)

Impact: The SCM cores while attempting to update SIP protocol specific fields in the accounting record.

Root Cause: The code is using the wrong function to get a pointer to the URL header structure.

Therefore, the SBC is using an invalid pointer and operating on invalid data.. This resulted in an attempt to dereference a NULL pointer, which caused a Segmentation Fault.

This code path is executed when writing SIP protocol specific fields into accounting record.

Steps to Replicate: This issue is not reproducible. The code has been the same since prior to the 7.2 release and this issue hasn't been seen before. Low risk of reoccurrence.

The code is modified to use the correct function to get the pointer to the header.

Workaround: Disable CDRs.

SBX-119908

sanitizer.CE_2N_Comp_CpxAppProc & CE_2N_Comp_DiamProcess

Impact: A small amount of memory leaks while configuring diameter peer IP addresses

Root Cause: The configuration validation routines were allocating memory while cross-checking the new CDB configuration and this memory was not freed at the end of the validation.

Steps to Replicate: Create diameter peer IPs and check for no memory leaks in an ASAN enabled build.

The code is modified to update the validation routines to make sure the memory is freed so there is no leak.

Workaround: None.

SBX-119912


LeakSanitizer in CE_2N_Comp_CpxAppProc, CE_2N_Comp_ScmProcess0,1,2,3

Impact: While sending a SIP SUBSCRIBE message, the code was leaking memory if there were PATH headers in the associated subscribed registration data.

Root Cause: The code was creating copies of the PATH header information to map into the P-Asserted-ID header and not freeing up all the associated information once the subscription processing completed.

Steps to Replicate: Run various SUBSCIRBE for REGISTER event test cases and check there are no memory leaks.

The code is modified to make sure all P-Asserted-ID header memory is correctly freed up.

Workaround: None.

SBX-115152 | SBX-118384

PortFix SBX-115152: Unknown header is not relayed with re-INVITE call flow in PSX.

Impact: Unknown Header Transparency for BYE message do not work in call scenario where SBC receives a re-INVITE from Egress peer and BYE is received from Ingress Peer. Issue is observed only when Re-INVITE is auto-answered by SBC

Root Cause: SIP request data for Re-INVITE is not cleared from SIP call control block after Re-INVITE offer-answer completion. This results in duplicate entries for SIP request data in the SIP call control block when the SBC receives the BYE message. During handling of the BYE message at Egress leg, request data pointer is retrieved from call control block to set transparency mask for unknown header, request data pointer of Re-INVITE is picked always instead of BYE message. This results in unknown header transparency issues for BYE.

Steps to Replicate: 

  1. Make SIP-SIP call setup with G711 U law.
  2. Enable "Minimize Relaying Of Media Changes From Other Call Leg" flag in Ingress IPSP.
  3. Enable "Unknown Header" transparency in IPSPs.
  4. After session establishment, send Re-INVITE from Egress peer with G711U law for call hold ( a=sendonly).
  5. Send BYE from Ingress peer with Unknown Header.
  6. Verify if unknown header in BYE message is sent transparently to other leg.

The code is modified so that SIP request data is cleared properly for Re-INVITE.

Workaround: None.

SBX-120128 | SBX-120335

PortFix SBX-120128: The SBC 5400 switchovers occur after an upgrade to v09.02.04R003.

Impact: The SCM process may core while attempting to set the original peer SDP address when either NAPT for Media is enabled and the SDP is received, or if ICE is enabled and ICE is in the SDP.

Root Cause: In the above two scenarios, the software did not protect against using a NULL packet SG control block address.

Steps to Replicate: The steps are not reproducible.

The code is modified to prevent the NULL packet SG control block address from causing the SCM process to core.

Workaround: None.

SBX-115304 | SBX-118371

PortFix SBX-115304: The SBC replies with a 481 message for INVITE with occasional replaces.

Impact: The SBC replies a 481 message for INVITE with occasional replaces.

Root Cause: In early dialogue, the state to-tag is not updated in the Hashtable but the from-tag is updated. This issue is why when we tried to look up using only the call ID. As a result, it fails to fetch original call as the original INVITE and the INVITE with replaces had the same call ID.

Steps to Replicate: 

  1. Prepare a SIP-to-SIP call setup with INVITE with replaces from the client side having the same call ID for original INVITE and INVITE with replaces.
  2. Check if the INVITE with replaces is replacing the original call and if the lookup is successful or not.

The code is modified to look up both the call ID and from-tag for the ingress leg.

Workaround: None.

SBX-118049 | SBX-118081

PortFix SBX-118049 - The SRTP decryption and encryption fail after an upgrade to 9.2.4R0/10.1.0R2.

Impact: The SBC fails to decrypt the incoming SRTP packets, causing a static noise instead of audio on the SRTP calls. 

Root Cause: Since 9.2.0x, one flag is used in the XRM. XRM_SRTP_SESS_UNENCRYPTED is used for both the unencrypted SRTP and unencrypted SRTCP. When this flag is set, the XRM sends cipherType = NP_CIPHER_TYPE_sRTP_NULL to the NP. The SBC does not to decrypt the incoming SRTP packets.

Steps to Replicate: 

  1. Enable the UNENCRYPTED_SRTCP in the cryptoSuiteProfile.
  2. Enable the INFO level DBG logging and make calls.
  3. Check the DBG log for NpMediaRidEnable and NpMediaFlowEnable messages
  4. Ensure that:
    • RTCP = cipher/size 0x8000000/0x40000
    • RTP = cipher/size 0x6000000/0x40000

A new flag is added, for unencrypted SRTCP: XRM_SRTCP_SESS_UNENCRYPTED

The modified NRMA and XRM adopt the new flag for SRTCP.

Workaround: Disable the UNENCRYPTED_SRTCP in the cryptoSuiteProfile

SBX-115231 | SBX-118086

PortFix SBX-115231: Possible stack overflow vulnerability in the RTCP processing.

Impact: Potential stack overflow vulnerability was identified through the internal code review in the RTCP generation subsystem of SWe NP module.

Root Cause: The root cause of the problem was identified to the use of variables of an incorrect storage size.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to address the vulnerabilities.

Workaround: No workaround.

SBX-114456 | SBX-118382

PortFix SBX-114456: The AMRWB is transcoded although negotiated end-to-end.

Impact: The Transcode option for "different2833PayloadType" feature considers only the 8,000 DTMF payload and the 16,000 DTMF payload is not compared with the opposite leg Peer PSP DTMF, unlike the 8,000 DTMF in earlier releases. This leads to unnecessary transcoding when the same 16,000 DTMF is present in both Ingress Offer and Egress Answer.

Root Cause: The SBC does not compare the 16,000 DTMF payload type of Ingress and Egress Leg when "different2833PayloadType:" is enabled, unlike 8,000 DTMF. The SBC should only transcode the call only when the 16,000 DTMF payload is different for both Ingress and Egress; otherwise, the SBC should treat the call for pass-through (PT).

Steps to Replicate: 

TC1:

  1. Set preferred DTMF to 101 and enable different2833PayloadType flag.
  2. From Ingress Peer send PCMU and AMRWB with 8,000 PT 101 and dtmf PT 16,000 102.
  3. Egress Peer send AMR-WB 102 in answer.
  4. The call should be pass-through with DTMF 102.


TC2:

  1. Set preferred DTMF to 101 and enable different2833PayloadType flag.
  2. From Ingress Peer send PCMU and AMRWB with DTMF 8,000 PT- 104 and DTMF16K PT - 102.
  3. Egress Peer send AMR-WB 102 in answer.
  4. The call should be pass-through with DTMF 102.

TC3:

  1. Set preferred DTMF to 101 and enable different2833PayloadType flag.
  2. From Ingress Peer send PCMU and AMRWB with DTMF 8,000 PT- 104 and DTMF16K PT - 105.
  3. Egress Peer send AMR-WB 102 in answer.
  4. The call should be transcoded for difference in DTMF - 102 in Egress and 105 in Ingress.

The code is modified to check both the 8,000 and 16,000 DTMF for a difference in payload type with the corresponding answered DTMF payload types, sent by Egress Peer in Offer Answer function to determine whether the call should be transcode or pas-through. If the DTMF payload types are same, the call is passed through and transcoded if the DTMF payload types are different. These checks are done when "different2833PayloadType" feature flag is enabled.

Workaround: None.

SBX-115616 | SBX-116769

PortFix SBX-115616: Routing label settings could not be changed in the EMA if created by the CLI.

Impact: Unable to change Routing label settings from the EMA UI if they were created using special characters  in the CLI.

Root Cause: CLI was allowing _ + - . : @ characters in the Routing Label name. The EMA, however, was only allowing  _ character in Routing Label name. As a result, attempts to update the Routing Label from the EMA failed.

Steps to Replicate: 

  1. Log in to CLI.
  2. Created Routing Label with following special characters (+:.@-) from CLI.
  3. Log in to the EMA.
  4. Navigate to Routing and select the Routing Label and edit the same.
  5. Edit is successful.

The code is modified to allow special characters + - . : @ in the EMA.

Workaround: No workaround.

SBX-117637 | SBX-117969

PortFix SBX-117637: The SCM Process generates a core and a switchover occurs due to null pointer in a forked call.

Impact: The SCM is coring when trying to free memory that has already been freed.

Root Cause: The SCM process cores when trying to free memory because of a non-reproducible edge case scenario which causes the memory to be freed before returning from a subroutine. The calling function doesn't handle this correctly.

NOTE: This scenario only happens if a downstreamForkingSupport is enabled on the SIP Trunk Group.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to prevent the scenario.

Workaround:  None.

SBX-115262 | SBX-118383

PortFix SBX-115262: Unexpected UPDATE from the SBC after UPDATE with media inactive.

Impact: Delayed RBT with the monitor profile in early dialog with DylRBT, there is an update from the caller to set the media to inactive. That triggers an UPDATE towards the called with media inactive. Just after that, the SBC sends a new UPDATE with the media direction "sendrcv" to the caller.

Root Cause: Since in this case tone is playing and dlrbt is enabled, Update from ingress with DPM inactive is processed by the SBC and sent to egress. Egress responds with 200 OK with Media as inactive which is passed to ingress.

The SIPSG sends notification to CC to STOP tone. Tone stops and cut-thru is set in CC. CC sends activate to NRMA and NRMA swaps tone context with cut-through context that has a DPM of sendrecv. NRMA sends update notify ingress with DPM of sendrecv, which is sent to ingress peer as an Update.

Steps to Replicate: 

  1. Run the Customer configuration.
  2. Run the Customer Scenario DelayedRBT enable with Tone continuation and Monitoring profile is enable.
  3. Run an additional update to stop after an UPDATE with media = inactive.

The code is modified to address the issue. 

Workaround: No workaround.

SBX-114764 | SBX-118380

PortFix SBX-114764: The G711 codec is used incorrectly during a G729 UPDATE.

Impact: The SBC plays the incorrect media towards Ingress End Point after a call is established.

Root Cause: Issue 1: Port is not updated after an UPDATE during tone play.

After the SBC receives an UPDATE from Ingress End Point during tone play, the SBC updates the codecs and port information. But after a 200 OK for UPDATE is sent out, the SBC overwrites the new information with old information.

Issue 2: The wrong codec is used after the call is established.

After an UPDATE is received during a tone play, the SBC tends to suppress sending UPDATE/re-INVITE towards ingress during cut-thru (after tone play) by re-using the last tone codec on ingress leg.

However, it does not preserve/re-use the transcoding resources which results in wrong media being played towards Ingress EP.

Steps to Replicate: 

  1. Configure the SBC with Basic call configuration.
  2. Attach TONE_GENERATION_CRITERIA to Tone and Announcement Profile.
  3. Configure earlyMedia in Egress TG.


Procedure:

  1. The SBC receives INVITE with 0,8,18 from Ingress EP.
  2. The SBC receives 180 Ringing with 0 from Egress EP.
  3. The SBC receives UPDATE from Ingress EP with 18 and with new media port.
  4. The SBC receives 200 OK for INVITE without SDP from egress EP.

Expected Results:

  1. The SBC will forward the INVITE to Egress EP.
  2. Once the SBC receives 180 with SDP, it will forward to Ingress EP.
    The SBC starts monitoring RTP from Egress. Once timeout happens, the SBC will start generating tone towards Ingress EP.
  3. Once an UPDATE is received, the SBC will change the codec to 18 and port to new media port.
  4. The SBC receives 200 OK for an INVITE.
    The SBC will use the same codec combination used during tone play.
    A call gets established successfully as G729-PCMU.

The code is modified for the following issues: 

Issue 1: The SBC now changes the port towards Ingress EP.

Issue 2: The correct media is played at the tone play Ingress EP, based on whether or not the call needs transcoding resources..

Workaround: None.

SBX-118191 | SBX-119175

PortFix SBX-118191: An upgrade is successful but revert operation failed - V10.1.0R2 to V11.0.

Impact: The SBC application does not come up after revert on cloud 1:1 mode.

Root Cause: The SBC application gets stuck due to Openclovis model update cache on old active disk.

Steps to Replicate: 

  1. Perform an upgrade on an SBC HA 1:1 on public cloud (such as AWS) from a pre-9.2 to a 9.2 release.
  2. Revert the SBC HA 1:1 to a pre-9.2 release.

The code is modified to indicate this model update cache and perform a model update on standby after revert to remove any component that is not needed.

Workaround: 

  1. Bring up SBC HA application with a pre-9.2 release on public cloud, such as AWS.
  2. Upgrade both active and standby SBC to this release using the recommended upgrade method.
  3. Revert the SBC application to pre 9.2 release.
  4. After revert operation, check to see if application is coming up fine on both active or standby.
  5. If the application is stuck and not able to get the assigned role, stop SBC application on both active and standby nodes using ‘sbxstop’ command.
  6. Remove the following file/directories from both active and standby SBC if existing:
    1. rm -rf /home/cnxipmadmin/peerDynamicHANewComps
    2. rm -rf /opt/sonus/sbx/openclovis/var
  7. Start the SBC application on both active and standby nodes using ‘sbxstart’ command.
  8. Check to ensure that application is coming up fine on both nodes.
SBX-111832 | SBX-116538

PortFix SBX-111832: PRS Process and ENM Process coredumps observed in SLB during REGISTER Performance run

Impact: The PRS and CHM processes were allowing switchover even when the sync was in progress, causing failures in restoring context in XRM.

Root Cause: The sync completion check was incorrect and incomplete, thereby allowing a switchover to occur even when the sync is in progress.

Steps to Replicate: Trigger the switchover while the sync is still in progress to check if standby either takes over, or if it restarts to prevent the switchover.

The code is modified to add a thorough sync completion check to the PRS and CHM processes to prevent a switchover when a sync is in progress.

Workaround: None.

SBX-118118 | SBX-118169

PortFix SBX-118118: Both of the SBC units went down after an unregister from the EMS.

Impact: Both of the SBC units went down after an unregister from the EMS

Root Cause: The code in the ENM process notifies the deletion of the SnmpAgent snmpTargetMib snmpTargetAddrTable snmpTargetAddrEntry. The ENM process code spawns a thread to delete the corresponding trap from the oam snmp trapTarget table that shares a CDB socket with the SonusSnmpTrapTarget::ProcSubDelete.

Steps to Replicate: 

  1. Register an SBC instance with an EMS.
  2. Unregister the same SBC instance with the EMS.
  3. Observe that the ENM process does not crash.

The SonusSnmpTrapTarget::DeleteTrapTargetThread routine is modified to use its own CDB socket to prevent contention from two threads for the same socket.

Workaround: None

SBX-114778 | SBX-116976

PortFix SBX-114778: The STOP RECORD is missing from CDR VIEWER after a switchover.

Impact: STOP RECORD IS MISSING from CDR VIEWER after a switchover.

Root Cause: With the current Logstash configuration, the logstash reads the TRC and ACT files only from the time when the logstash was started, which means older data is not read by logstash. When a switchover occurs, by the time logstash is started all the calls would have completed thereby updates to TRC and ACT would have stopped.

Logstash does not read the TRC and ACT files until they are updated again. When the updates start, logstash does read from the point where the new data is written and not the old data. This is the reason why stop record of the calls are not shown after the switchover

Steps to Replicate: 

  1. Log in to the EMA of an active SBC and Enable CDR Viewer.
  2. Run a call with a duration (about 50 seconds) such that it gets stopped before EMA is started in the standby SBC after the switchover.
  3. Initiate a switchover.
  4. Log in to EMA of a standby SBC (which is the active now).
  5. Navigate to CDR viewer screen.

The STOP record should display.

The code is modified to read the older data and not just the new data.

Workaround: None.

SBX-110857 | SBX-118378

PortFix SBX-110857: The RTP stream with unknown port (5004) with Delayed RBT after 180.

Impact: RTP packets being sent to port 5004 after 180.

Root Cause: The RTP packet was the silence packet generated from DSP. Before RTP monitoring was enabled, the call had already been cut through. When RTP monitoring was enabled, NRMA sent a flow change to XRM to change the remote port to 5004. As a result, the DSP-generated silence packet got sent out to remote peer on port 5004.

Steps to Replicate: 

  1. Enabled INFO debug logging.
  2. Establish a simple transcode call with RTP monitoring enabled on egress side.
  3. Check the DBG log for the port number in message "NpMediaFlowModify: Src RTP port modified port 5004 enSrcVal 0x1"

The code is modified so the XRM ignores the remote RTP port change. So the RTP packets are sent to resolved remote IP and port.

Workaround: None.

SBX-105749 | SBX-106518

PortFix SBX-105749: The RTP monitoring failed when the iteration is set to 1 or 2.

Impact: The RTP Monitoring is not working as expected when the iteration is set to 1 or 2

Root Cause: When the monitoring period is over, it sends FIRST expiry and FINAL expiry together. As a result, this is not being handled properly leading to non-playing of LRBT.

Steps to Replicate: Configure monitoring cycle to 1 and make calls. Ensure that LRBT is heard when monitoring cycle gets over.

The code is modified to play the tone.

Workaround: Use n=3 or more.

SBX-120264 | SBX-120270

PortFix SBX-120264: The SCM Process continually cores on two SBC 7000s - possibly PCV IOI related.

Impact: The SCM Process coredumped due to NULL pointer access for a (GSX) ISUP-GW-GW-SIP call after enabling Generate or Replace PCV feature.

Root Cause: The code was trying to read a CPC parameter from the ingress side of the call and the parameter is NULL when the ingress side is ISUP.

Steps to Replicate: 

  1. Set up a GW-GW call from GSX using ISUP as ingress
  2. Enable Signaling > Generate or Replace PCV

Expected result: The SCM Process cores.

The code is modified to ensure the CPC parameter is not NULL before accessing it.

Workaround: Disable Signaling > Generate or Replace PCV and apply the fix.

SBX-118822 | SBX-119267

PortFix SBX-118822: The HA SBC fails to start on version 09.02.04R001 when the Direct IO Passthrough is used.

Impact: The SBC application fails to start on a 44 vCPU instance.

Root Cause: The maximum number of vCPUs supported is set to 40 in the SM module. This leads to corruption and a subsequent core-dump on instances with a size greater than 40 vCPUs.

Steps to Replicate: 

  1. Install the SBC application on an instance with a vCPU size greater than 40.
  2. Make sure the application starts and there are no core dumps observed.

The code is modified and now set to be in sync with other modules.

Workaround: None

SBX-118367 | SBX-118789

PortFix SBX-118367: Missing CDR sub fields from Column: Ingress Protocol Variant Specific Data.

Impact: Missing CDR sub fields from Column: Ingress Protocol Variant Specific Data.

Root Cause: The CDR fields were not updated in SipSgFillProtocolSpecData function from where CDR was getting populated.

Steps to Replicate: 

  1. Replicate the issue by running a basic SIP-to-SIP call and removing any mandatory header field.
  2. Check if all of the 86 sub fields are getting populated in CDR of 45th field (Ingress Protocol Variant Spec Data).

Updated SipSgFillProtocolSpecData function with the CDR field that were missing to address the issue.

Workaround: None.

SBX-119525 | SBX-119957

PortFix SBX-119525: Observed the SCM Process core while running callflow sanity on the SBC 7000

Impact: Application gets crashed while running call flow sanity on the SBC 7000.

Root Cause: During Call Progress when a timeout is hit and CANCEL is triggered towards endpoint then due to invalid/null pointer access core dump is observed.

Steps to Replicate: Run a call flow sanity on an SBC 7000.

The code is modified to ensure the pointer is validated for NULL before accessing it.

Workaround: None.

SBX-114415 | SBX-118368

PortFix SBX-114415: The SBC 7000 standby CE stopped functioning with file corruption and "read only" mode.

Impact: When the file system turned to Read Only mode the server did not go for reboot.

Root Cause: The SBC became stuck during the read only file system checking but the root cause cannot be determined.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to use different commands to check for read only status to try and ensure the SBC automatically reboots to recover.

Workaround: An operator needs to manually reboot the SBC in order to recover it.

SBX-113060 | SBX-119252

PortFix SBX-113060: The SBC needs to open both protected TCP and UDP port in AKA mode.

Impact: The SBC drops messages coming on the TCP when some phone does initial registration over UDP but later sends message over TCP in IMS AKA scenario.

Root Cause: When initial REGISTER comes on UDP in IMS AKA scenario, the SBC does not open protected ports on TCP. This will cause problem with some phones, which do initial registration over UDP, but later may send some messages over TCP during call.

Steps to Replicate: 

  1. Run an IMS AKA registration over UDP.
  2. Check netstat on the SBC to see if the negotiated protected ports are opened on both UDP and TCP.

The code is modified so that the SBC opens protected ports on both TCP and UDP when the initial registration is over UDP.

Workaround: None.

SBX-118988 | SBX-119249

PortFix SBX-118988: The sysDump saved with an owner as root even though sbcDiagnostic 2 is run with linuxadmin as user.

Impact: In the Cloud SBC when sysdumps are generated using sbcDiagnostic command as linuxadmin user, linuxadmin is unable to copy the sysdumps due to restricted permissions.

Root Cause: sbcDiagnostic was generating sysdumps with root ownership, which did not allow linuxadmin to copy them.

Steps to Replicate: 

  1. Run sbcDiagnostic 2 command as linuxadmin user in the cloud SBC.
  2. Try copying generated sysdumps from /opt/sonus/external/ location.

With a fix, linuxadmin should be able to copy sysdumps.

The code is modified to allow copying.

Workaround: None.

SBX-118635 | SBX-118704

PortFix SBX-118635: Observed the IpSockAddr (0.0.0.0) and Port (0) for Egress leg in GW1 and Ingress leg in GW2 for GW-GW HPC call scenario.

Impact: The IpSockAddr and Port fields are 0 in the global callDetailStatus status command in a GW-GW HPC call scenario.

Root Cause: In 9.2.4R001, the code is added to not send CPC_OP structures unknown to the GW-GW encoder layer over the GW-GW link to reduce the size of the GW-GW message sent to older SBCs and the GSX. However, it was found that at least one of these unknown CPC_OP Structures, CPC_OP_SIP_ZONE_AC_NAME_STR was used to transfer information used in the global callDetailStatus status command.

Steps to Replicate: 

  1. Set up two SBCs that communicate over the GW-GW.
  2. Place a GW-GW HPC call scenario call.
  3. Observe that the IpSockAddr and Port fields are not 0 after running the global callDetailStatus status command.

The code is modified to send the CPC_OP structures unknown to the GW-GW encoder layer over the GW-GW link.

Workaround: None.

SBX-116340 | SBX-118932

PortFix SBX-116340: Customer reported DNS failures on 3 different occasions that appears to be related to "time to live" and negative cache functionality.

Impact: DNS records (requests) can become stuck in RESOLVING state within the Agent, which causes the FQDN to become unreachable forever.

Root Cause: A DNS request (or it's response), sent between the Agent (e.g., ScmProcess) and the Client (DNS Process), becomes lost. This causes the DNS record to become stuck in RESOLVING state, and the FQDN to become unreachable.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to:

  • Add a default value of 60 seconds for the DNS record when the DNS request is sent by the Agent to the Client.
  • In the error case, delete the DNS record when the timer expires in order to recover.
  • In the working case, reset the expiration time to the TTL received in the DNS data.

Workaround: Manually clear the DNS cache or manually query the "stuck" FQDN.

SBX-117469 | SBX-119169

PortFix SBX-117469: Azure: Upgrade is failing from 9.2.3R4 build to 11.0.0 on standalone.

Impact: Upgrades are failing in Azure using Ribbon IaC package.

Root Cause: Newer versions of the Azure CLI change the way it authenticates, meaning it no longer works with the Ribbon IaC package.

Steps to Replicate: 

  1. Log in to the Azure CLI.
  2. Attempt to upgrade the Azure SBC using Ribbon IaC.
  3. The upgrade fails due to lack of credentials.

The code is modified to install Azure CLI version 2.24.0

Workaround: 

  1. Uninstall the current Azure CLI version.
  2. Install the Azure CLI version 2.24.0 using the system package manager.
SBX-118683 | SBX-119434

PortFix SBX-118683: The active T-SBC switches over to the standby T-SBC with a health check failure.

Impact: The SWe UXPAD core-dumps due to an arithmetic exception.

Root Cause: 

  1. The arithmetic exception is the result of a denominator of a divide operation with a zero value.
  2. The denominator is a sum of two energy values, both of which are expected to be positive. The issue occurs when one of the energy values is negative.
  3. The negative energy value is attributed to the incorrect handling of overflow when computing the energy value. The incorrect handling of the overflow makes a large positive number appear to have a negative value.

Steps to Replicate: The issue is not reproducible.

The code is modified by setting the energy value to the maximum positive value if an overflow occurs.

Workaround: None.

SBX-117762 | SBX-120079

PortFix SBX-117762: If there is only one m-line in the SDP of UPDATE with port ZERO, the SBC is having different behavior for Audio, Video and Application call flows

Impact:
Ingress is sending UPDATE and setting Media Port to ZERO.

1> For m-line application
The SBC is rejecting this UPDATE with 488.

2> For m-line Audio
The SBC is passing this UPDATE to other side with valid port and c-line is present.

3> For m-line Video
The SBC is passing UPDATE to other side but removing C-line

The SBC must pass an update for m-line application and also c-line should be present in all the cases.

Root Cause: The code was written to reject update when media is application and port is zero.

Steps to Replicate: Send update with m-line application, video and audio with port as zero. The update should pass to the other side and C-line should be present in all the cases and port should be zero.

The code is modified to allow the call flow to function accordingly after the fix:

1> For m-line application
The SBC is passing this UPDATE to the other side with valid c-line.

2> For m-line Audio
The SBC is passing this UPDATE to other side and c-line is present.

3> For m-line Video
The SBC is passing this UPDATE to other side without removing C-line.

In all the above scenarios if UPDATE is sent from ingress side with port zero, it is received on the other side with port zero.

Workaround: The call flow after the fix:

1> For m-line application
The SBC is passing this UPDATE to the other side with valid c-line.

2> For m-line Audio
The SBC is passing this UPDATE to other side and c-line is present.

3> For m-line Video
The SBC is passing this UPDATE to other side without removing C-line.

In all the above scenarios if UPDATE is sent from ingress side with port zero, it is received on the other side with port zero.

SBX-118425 | SBX-118930

PortFix SBX-118425: The SBC as a TLS server fails a TLS handshake attempt if an ECDHE cipher is used and the TLS client specifies an elliptic curve other than secp256r1 (prime256v1)

Impact: The SBC as a TLS server fails a TLS handshake attempt if an ECDHE cipher is used and the TLS client specifies an elliptic curve name other than secp256r1 (prime256v1).

Root Cause: The SBC uses the default elliptic curve name secp256r1 (prime256v1) when acting as a TLS server.

Steps to Replicate: Use "openssl s_client" to trigger TLS handshake with ECDHE ciphers with curve names secp384r1 and secp521r1.

The following commands assume the SBC's SIP-TLS address/port number is 10.x.yy.zz:5061:
$ openssl s_client -showcerts -connect 10.x.yy.zz:5061 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' -curves secp384r1 | egrep "i:\s:"
$ openssl s_client -showcerts -connect 10.x.yy.zz:5061 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' -curves secp521r1 | egrep "i:\s:"

A. Failed case shows the the SBC TLS server fails to find matching cipher suite and curve name:
$ openssl s_client -showcerts -connect 10.x.yy.zz:5061 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' -curves secp384r1 | egrep "i:\s:"
140485529323328:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40
...
Packet capture will not show Server Hello Message.

B. Successful case displays the SBC TLS server's certificate chain after TLS server properly selects cipher suite and curve name.
$ openssl s_client -showcerts -connect 10.x.yy.zz:5061 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' -curves secp521r1 | egrep "i:\s:"
depth=2 C = US, O = Sonus, OU = SonusProductPKI, CN = SonusProductRootCA
...
The packet capture will show Server Hello after the SBC TLS server selects the matching cipher suite and curve name.

The code is modified to allow the SBC TLS server to select the Elliptic curve name automatically.

Workaround: Do not specify the curve name, or use curve name prime256v1 (openssl 1.0's default on TLS server) when using a tls_ecdhe* cipher suite.

SBX-116997 | SBX-117538

PortFix SBX-116997: Late media pass-through calls fail after an upgrade from 8.2.2R0 to 8.2.6R0.

Impact: Late media pass-through calls with "RTCP termination for passthrough" flag enabled failed.

Root Cause: There are two receiver IDs in the RTCP termination Bus RESource definition. If one of the RIDs was not enabled during the BRES activation because the ingress XRES (ethernet resource) had not learned the destination MAC address yet, then the RTCP Gen was left enabled according to the design.

When that BRES gets deactivated, we skip sending RID disable command to NP for that not enabled RID, and also missed issuing RTCP Gen disable command to NP.

So when that BRES gets re-activated, the logic detected that RTCP Gen has already been enabled and failed the activation process, which then fails the call.

Steps to Replicate: Establish a late media pass-through call with "RTCP termination for pass-through" flag enabled.

The SBC sends a SIP BYE once it receives the SDP answer in the SIP ACK SDP.

The code is modified to send the RTCP Gen disable command to NP even when RID is not enabled.

Workaround: Turn off the "RTCP termination for pass-through" flag.

SBX-113233 | SBX-117578

PortFix SBX-113233: Getting bulk alarms of "sonusSbxNodeResourcesNoPacketsReceivedNotification"

Impact: The patch includes additional stats from SWe_NP, which can help in triaging false reporting of RTP inactivity issues better.

In addition to this, the patch also includes fixes to prevent false reporting of RTP inactivity when policer mode is set to “Bypass” (from release 9.2.3), and preventing false RTP inactivity reporting in “call hold and unhold scenario” (from release 10.1.2R0).

Root Cause: There is no root cause identified.

Steps to Replicate: The steps are not reproducible. 

The code is modified to add additional NP stats to help in triaging false reporting of RTP inactivity, and also backported some known false detection fixes.

Workaround: None.

SBX-118331 | SBX-119250

Portfix SBX-118331: EMS re-Synchronization feature not working fine with SBC 7000

Impact: EMS trap resync logic does not work for standard SNMP traps e.g linkUp, linkDown.

Root Cause: The EMA was not aware of the mapping from the standard OID traps to trap name and as a result it was unable to resync trap information to EMS.

Steps to Replicate: 

  1. Bring down mgt1 interface on the SBC side, critical alarm raised on the SBC and same has been reached to EMS.
    ip l set mgt1 down
  2. Teardown the connectivity between EMS & SBC by creating the static route at SBC side (no trap will be reached to EMS).
  3. Bring the mgt1 interface up on SBC side. (Clear trap generated on SBC but not reached to EMS because link between EMS & SBC is down so which is expected).
  4. Bring the connectivity between EMS & SBC up (trap re-sync should work and EMS should clear the critical alarm raised on Step 1).

The code is modified so that the EMA now understands the OID values for the standard SNMP traps and can resync the info to the EMS.

Workaround: None.

SBX-114533 | SBX-119172

Portfix SBX-114533: CPX not handling the notification correctly from SDR

Impact: SNMP traps destinations set by FQDN are not resolved correctly to IP

Root Cause: ConfD CDB API return inconsistent data when reading from CDB_RUNNING.

Steps to Replicate:

  1. Deploy the SBC.
  2. Add DNS records for SNMP trap target.
  3. Configure DNS nameserver in the SBC.
  4. Configure SNMP trap target fqdn.
  5. Validate that the SBC resolve the fqdn and add the corresponding IP address and port.

The code is modified so that the Management Agent API (MAAPI) is now being used to read the SNMP trap target information instead of the CDB API.

Workaround: Restart the SBC.

SBX-116895 | SBX-118614

PortFix SBX-116895: A SWe SBC switchover occurred because of an ENM Process core.

Impact: The ENM Process crashed when an accounting file rolled over.

Root Cause: If the fileCount for the accounting files is reduced substantially (ex. 2048 to 1024), and a rollover occurs, then a shell script is run for each file that needs to be deleted to reduce the file count to the new file count configured. This shell script deletes any hash files in the eventLogValidation directory associated with the deleted accounting file.

Steps to Replicate: 

  1. Set the fileCount for accounting files to 2048.
  2. Enable eventLogValidation for account files.
  3. Rollover the log repeated to created 2028 accounting files.
  4. Set the fileCount for accounting files to 32.
  5. Rollover the account log.
  6. Ensure the SBC has not crashed.

The code is modified so that instead of calling a shell script to delete the hash files, the EvmFileDeleteLogfiles routine has been changed to get a list of all the hash files of accounting files in the eventLogValidation, and deletes the associated hash file when an accounting file is deleted. This reduces the time to delete ~2000 files to less than a second.

Workaround: Do not reduce that fileCount for the accounting log files more than 300 files at a time. Rollover the accounting file each time the count is reduced.

Severity 2-4 Resolved Issues

The following Severity 2-4 issues are resolved in this release:

Issue

ID

SevProblem DescriptionResolution
SBX-119975 | SBX-1187552

PortFix SBX-118755: The S-SBC drops calls with 404 (Reason: Q.850;cause=3) with disconnected initiator is internal.

Impact: If there is a connection issue with one of the TSBC, the S-SBC fails calls often trying to send allocation requests.

Root Cause: This event had 8 T-SBCs:

  • If an allocation failed to one T-SBC because of a connection issue, the S-SBC removes the node from the cache but when cache expires for this LIF, fetch the same node again in bad state and once again try to send more requests

Steps to Replicate: Configure the S-SBC with 8 T-SBC's. Add an ACL in one of the T-SBC for the port from the S-SBC and then make a few calls and monitor if the calls are not failing.

When attempting to se4nd the request, the RRM:

  • checks if the remote IP Address is mandated by NRM and if so tries to send the request out if it is connected. Otherwise, the RRM rejects it.
  • checks if the remote IP Address is provided and preferred, if the remote node is connected then the request is sent out.
  • checks if the remote IP address is provided and preferred but not connected then it tries to fetch a Connected Node with matching LIF group; or if finds a node which is in connecting state with matching LIF and queues the request and starts timer; or if the cache for the LIF group is not existent and is initial request, request Leader Node for the Cache.

On receiving GW indication, the possible following scenarios can occur: 

  • If it is connected, fetch the queued messages and sends the request.
  • If it is disconnected, fetch the queue and rejects the messages so that NRMA can retry.
  • If the GW Connection timer expires, fetch the queue and rejects the messages so that NRMA can retry.

Workaround: None.

SBX-105332 | SBX-1051372

PortFix SBX-105137: The SBC is not able to parse MSRP media packet 200

Impact: When the SBC received "200" as an MSRP response, it did not forward the same to the other end as it considers 200 as a invalid response in absence of "OK" string in 200.

Root Cause: The SBC was strictly parsing "200 OK" for MSRP success response. Due to that, if it received "200" as a response, it did not forward the same to other end.

Steps to Replicate: 

Test 1

  1. Configure SBC for MSRP-B2BUA support.
  2. Complete the INVITE signaling message for MSRP
  3. Send MSRP request message from UAC to SBC, SBC Should forward this to UAS.
  4. From UAS send "MSRP <transaction-id> 200" response message to SBC.
  5. SBC should successfully send it to UAC.

Test 2

  1. Configure SBC for MSRP-B2BUA support.
  2. Complete the INVITE signaling message for MSRP
  3. Send MSRP request message from UAC to SBC, SBC Should forward this to UAS.
  4. From UAS send "MSRP <transaction-id> 200 OK" response message to SBC.
  5. SBC should successfully send it to UAC.

The code is modified to update the parsing logic to consider 200 as valid MSRP response.

Workaround: UAC/UAS needs to send MSRP response as "MSRP <transaction-id> 200 OK" to avoid this issue.

SBX-114818

2

18x/200 Contact header sent by the SBC contains port number different than 5061

Impact: The SBC includes an incorrect port number in the Contact header of the outgoing SIP messages towards registered endpoints when the endpoints use TLS as a transport protocol and a Call Data Channel (CDC; a lawful intercept component) is enabled on the SBC. This behavior results in call failures since the endpoints send SIP requests to unused TCP port numbers. As an example, the SBC includes port numbers 5062, 5063 and others while the configured port number is 5061 (and SBC listens on that port number).

Root Cause: A Lawful Intercept related subroutine changes the port numbers in the signaling port table which should always be the configured signaling port.

Steps to Replicate: To reproduce the problem, create a basic SIP access scenario where an endpoint registers over TLS (REGISTER – 401 – REGISTER – 200). Then, as calea user, provision the following (the assumption is that you already created an IP interface group named LIG with at least 1 IP interface in it):

set addressContext default intercept nodeNumber 10001
comm
set addressContext default intercept callDataChannel LigCDC interceptStandard etsi ipInterfaceGroupName LIG
set addressContext default intercept callDataChannel LigCDC mediaIpInterfaceGroupName LIG
comm
set addressContext default intercept callDataChannel LigCDC vendorId utimaco
set addressContext default intercept callDataChannel LigCDC dsrProtocolVersion 1
comm
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp ipAddress 11.22.33.44
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp portNumber 37373
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp dscpValue 16
comm
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp mode inService
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp state ena
comm
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling ipAddress 11.22.33.44
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling portNumber 38154
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling dscpValue 16
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling protocolType tcp
comm
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling mode inService
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling state ena
commit

Once the CDC is configured, register the endpoint. The symptoms of the issue is that the SBC includes an incorrect port number (5062, 5063 and similar) in the Contact header of all messages sent to the endpoint. You don’t need to make calls though: the presence of port number 5061 in the event which is printed after the SBC received the REGISTER w/ Auth header is a sufficient proof that the issue is present:

195 03022022 092259.154049:1.01.07.12989.Info .SIPSG: sipsgCallProcCommonUtils.c (-6170) 3777. SipSgSelectTransportAndSigPort: Selected address 10.0.1.9:5060 for Sig port:1107 AddrType 1
195 03022022 092259.284953:1.01.07.14012.Info .SIPSG: sipsgCallProcCommonUtils.c (-6170) 4022. SipSgSelectTransportAndSigPort: Selected address 10.0.1.9:5061 for Sig port:1107 AddrType 1

The code is modified so that the configured signaling port table is not changed.

Workaround: This problem happens only when the CDC is configured and a SIP endpoint uses TLS as a transport protocol. If one of the conditions is not met, the problem will not happen.

SBX-116271 | SBX-1161842

PortFix SBX-116184: Call is getting failed with 500 error while running call to Verify the Signalling latency in CNF cluster

Impact: SLB was not able to determine the SBC instance name when dialogue transparency was enabled.

Root Cause: With the ‘dialogTransparency’ flag enabled on both the ingress and egress zones of ISBC and SLB, the instance-ID tag is not stored correctly in an internal hash for the Dialogue data.

Steps to Replicate: The fix has been verified for the following scenarios:

  1. With the ‘dialogTransparency’ flag enabled on both the ingress and egress zones of ISBC and SLB.
  2. With the ‘dialogTransparency’’ and ‘generateCallIdWithDialogTransparency’ flags enabled on both the ingress and egress zones of ISBC and SLB, both for a basic call flow and call flow with PRACK, UPDATE, Re-INV.

The code is modified to extract the the instance ID from Call Info from request Message in case of dialog transparency call flow.

Workaround: None.

SBX-118104 | SBX-1159942

PortFix SBX-115994: Configuring the last trunk as incoming/outgoing direction wise is causing the SBC to remove DTG info on receipt of 3xx

Impact: Configuring last trunk as incoming/outgoing direction wise is causing the SBC to remove DTG info on receipt of 3xx

Root Cause: During a TRM lookup for DTG information in TrmProcessIpLookupCmd() in case TRM_IP_LOOKUP_EGRESS_TYPE_DTGNAME_ONLY, the SBC iterates through all the Contact headers and saves DTG information (such as TG name, blocking status and Trunk Type ) in CPC_OP_TRM_IP_TRUNKGROUP_LOOKUP_DATA_STR *entry.

The same CPC structure is used in SipSgFillDestTgrpToCpcMsgInfo() to copy DTG information of all TGs in CPC_MSG. This DTG information is then used to route the call where TRM lookup is done through DTG name.

But in the TrmProcessIpLookupCmd(), TG blocking status "status" and TRM_IPTG_CB_STR *ipTgCbPtr of last Contact header is used to send TRM reply. Since, the DTG of Last Contact is blocked, the TRM reply fails and causes the DTG to lose information.

Steps to Replicate: 

  1. Make SIP-SIP call configuration using the PSX.
  2. At Egress zone, in addition with Egress TG, create three more TGs.
  3. On the SBC, configure the "ingressIpPrefix" of all three TGs (TG1, TG2, TG3) with different server IPs address (IP1, IP2, IP3).
  4. Send 3xx with three Contact headers.
  5. Configure same ingressIpPrefix address in Contact Headers of 3xx message so that the first Contact header is set to IP1, the second Contact Header is set to IP2 and the third Contact Header is set to IP3.
  6. Set "blockDirection" of TG3 to outgoing.
  7. On PSX, Enable "Force Re-query for Redirection" flag in IPSP of Egress Trunkgroup.
    For example:
    Contact: <sip:14135;tgrp=<trunk_group>;trunk-context=meta1001-1002.<domain_name>@IP1>;q=1
    Contact: <sip:14135;tgrp=<trunk_group>;trunk-context=10.xxx.yyy.zz@IP2>;q=0.9
    Contact: <sip:14135;tgrp=<trunk_group>;trunk-context=meta3001-3002.<domain_name>@IP3>;q=0.8
  8. Make an SIP-SIP call, send 3xx from Egress peer with these 3 Contact headers.
  9. The SBC sends INVITE to first Contact header through TG1.
  10. If the first Contact is not reachable, the SBC tries with the second Contact using TG2 and so on.
  11. Verify that after receipt of 3xx with multiple contact headers, the TRM debugs are logged in DBG with trunk group names of all 3 Contact headers and there is no TRM failure message.

Two new local variables TRM_IPTG_CB_STR *ipTgCbPtrTemp and UCHAR statusTemp are created in caseTRM_IP_LOOKUP_EGRESS_TYPE_DTGNAME_ONLY.

After each iteration, when the status is != FOUND_BLOCKING, these new local variables are populated and then used in TrmIpSendLookupRpyNfy() for TRM reply.

Then while the loop has to iterate for each contact header, the user must populate CPC_OP_TRM_IP_TRUNKGROUP_LOOKUP_DATA_STR.

Because we are passing good values of status and ipTgCbPtr in TrmIpSendLookupRpyNfy(), the TRM reply does not fail.

Workaround: None.

SBX-120784

2

The SBC call fail: Extra +1 added to globalized INV R-URI and To header (+1+1)

Impact: The SBC sends "+1+1..." in user part of To and Ruri.

Root Cause: When the flag related to "Use Called URI as R-URI" is enabled, the SBC duplicates globalization of the user part.

Steps to Replicate: 

  1. Enable "Used Called URI as R-URI".
  2. Incoming call with userpart of To header and RURI have "+1...".
  3. Outgoing call will have "+1+1..." in userpart of To and Ruri.

The code is modified so that there is no need to perform globalization if the flag is enabled.

Workaround: Disable "Used Called URI as R-URI".

SBX-120494

2

The S-SBC is dropping few calls after the S-SBC restart operation.

Impact: The SBC was releasing more than one standby call instance when the active call instance was released due to the call cleanup procedure:

Root Cause: The standby instance was deleting call instances based on the lowest 24 bits of the GCID while processing the call clean up scenario and check for the same value in all standby contexts. The bottom 24 bits of the GCID are not unique across all standby contexts which resulted in other standby call instances being removed. The code has now been updated to check for the full GCID value while removing instances as part of the call clean up procedure.

This was not a problem when the call was released normally on the active instance because it was only removed from the specific context on the standby instance.

Steps to Replicate: 

  1. Make 8 calls on a cloud S-SBC 1:1 setup to to 8 different T-SBCs.
  2. While the calls are stable and redundant apply an ACL to block the traffic to one of the T-SBCs. This will trigger a call cleanup to release the call on both the active and standby SBCs.
  3. Perform a switchover and check the 7 other calls are preserved over the switchover.

The code is modified so that the standby process code verifies the full GCID value between the standby instance and the call cleanup message so that only the unique call is deleted from the standby.

Workaround: None.

SBX-120758

2

I-SBC is not framing the "P-Charging-Vector" header correctly in UPDATE message

Impact: The SBC was incorrectly sending a truncated P-charging-vector header in a SIP UPDATE message, resulting in the UPDATE message causing a parsing error at the next SBC and the call being released.

Received:
P-Charging-Vector: icid-value="PCSF:1-UHN3kli1asbc0000cfed-0-3-000000005f7d96fc-0000000000000581";orig-ioi=domainname.org

Sent:
P-Charging-Vector: icid-value="PCSF:1-UHN3kli1asbc0000cfed-0-3-000000005f7d96fc-0000000000000;orig-ioi=domainname.org

Root Cause: The functionality introduced in 9.2.3 supports a maximum of 63 characters when processing each of the fields in the P-charging-vector header. Functionality was always passing the PCV information over from the ingress side of the call to the egress side of the call and using it even if the feature was not enabled.

Steps to Replicate:

  1. Send an INVITE to the SBC that contains a PCV header and check that the PCV header is sent out of the egress side without the PCV header being added.
  2. Respond with 183 to complete the offer/answer processing and then send forward an UPDATE message to change the SDP content with SDP and PCV.
  3. Check that the egress UPDATE message should not include the PCV header.

The code is modified to only use the internal data associated with SBX-107845 at the egress side when the configuration is enabled so it is no longer being used for PCV header creation at egress unless it's enabled. This avoids the SBC sending the PCV header in the UPDATE message.

Workaround: None.

SBX-117605 | SBX-1175923

PortFix SBX-117592: An end-to-end re-INVITE is not working after a 491.

Impact: After the SBC responds with an 491 and sends out a re-INVITE, some transparency headers were missing.

Root Cause: A logical error that did not check the state of the call correctly. As result, the SBC treats this re-INVITE as an internal re-INVITE (not e2e).

Steps to Replicate:

  1. Run an e2e re-INVITE enable, A call B.
  2. Both A and B send re-INVITE at the same time. SBC answer 491 on egress and send a re-INVITE on Egress. At the same time, answer 200 OK to the ingress.

As a result, the transparent headers may missing.

The code is modified to address the issue.

Workaround: None.

SBX-117302 | SBX-1207652

PortFix SBX-117302: PRS Process and the SMC Process are crashing. 

Impact: The PRS process was crashing while processing an MRSP message due to the first header line not being present:

"MSRP 0100543f85f SEND
"
"To-Path: msrp://17000000000.example.com:10000/%s;tcp
"
"From-Path: msrp://11.2.3.44:37001/1789102;tcp
"
"Message-ID: 016f28000567
"
"Byte-Range: 1-25/25
"
"Success-Report: yes
"
"Failure-Report: no
"
"Content-Type: text/plain
"


"Caller sent this message.
"
"-------0100543f85f$
"

Root Cause: If the SBC does not receive the MSRP header, line it was coring while processing the transaction id later.

Steps to Replicate: Verified with MSRP message without header line.

The code is modified to add a NULL check for transaction ID before processing.

Workaround: None.

SBX-1154442

CDR jitter value incorrectly calculated if DTMF 2833 packets in the stream

Impact: The SBC media jitter stats as reported in the CDRs are calculated incorrectly for received media flow containing DTMF digit events that span multiple DTMF digit packets.

Root Cause: For DTMF digit events that span multiple packets, all of the DTMF packets for that event contain the same RTP timestamp (corresponding to the beginning of the event), despite being sent over an interval that could span multiple seconds (for long digit events). The SBC previously included all DTMF digit packets in the media flow's jitter calculations, which in this case would be much larger than the actual jitter.

Steps to Replicate: Validate media jitter stats when the DTMF digit events spanning multiple DTMF packets are injected into a media flow received by the SBC.

The code is modified so that the SBC now omits DTMF digit packets (identified by their DTMF payload type) from media jitter stats calculations.

Workaround: None.

SBX-1190582

Call forking - XRM has at least two XRESs referencing same media resource

Impact: The NP reports 0xF0 error for set grace command(0x2C) because the associated media flow has already been enabled. The call works, but this error in turn triggers unsolicited call cleanup.

Root Cause: For ATCF or SIP Forking calls, XRM allocates a single IP address/UDP with multiple XRES resources (w/ different GCIDs) all referencing the same Media Resource structure. The XRM process uses a reference count in the XRM_MEDIA_RES_STR.

The media flow is enabled when the parent XRES is activated. Then when allocating child XRES, XRM sends a set grace command to NP for the same media flow after it has been enabled in NP.

Steps to Replicate: Watch for "Unsolicited Call Cleanup" log messages to be written in DBG upon activation of resource chain involving forked calls.

The code is modified to add a check for media flow reference count, and only sends the 'set grace' command to the NP when the reference count equals "1".

Workaround: None.

SBX-1183352

*NP 0 error counter macError, mgt0 static route missing and the rx_errors are increasing

Impact: Customer upgraded the SBC 5400 from 7.2.x to 9.2.3R4 and the management ports went from 100Mbps to 1Gbps due to feature located in the SBC 8.0.0 release. On some occasions, the management port become inaccessible and CRC errors are reported in the port statistics [ethtool -S mgt0].

Root Cause: The problem is specific to the SBC 5400.

When the NRS (Network Resource Service) thread issues an interface stop, followed immediately by an interface start request for all management (mgt) ports, resulting in the following behavior:

  • When a port stop request is received, the mgt port driver puts the PHY in "super-isolate" mode where the receive and transmit (rx/tx) are stopped. This causes the remote link to go down.
  • When a port start request is received, the mgt port driver takes the PHY out of "super-isolate" mode and the rx/tx are started. This results in the remote link to go up.

However, if the rx/tx are stopped and started in a short time (< 10 milliseconds), the remote link ignores the notification and does not renegotiate the clock/speed/duplex. This leads to the data becoming out of sync with the remote end, which causes CRC errors on the packets received.

Steps to Replicate: Run the sbxrestart command multiple times. When the SBC application is running, issue "ethtool -S mgt0" and ensure rx_crc_errors is still 0.

The code is modified to power down the PHY to a low power state when the port stop request is received. Thus, when the port start request is issued, the PHY is powered up to a normal power state. This forces the remote end to detect a link down and then a link up.

Workaround: If rx_crc_errors is increasing, disable and enable the mgt port.

Use the following Linux commands:

ifconfig mgt0 down

ifconfig mgt0 up

(Replace mgt0 with the mgt port name where rx_crc_errors is increasing.)

SBX-1180512

The DTLS client Hello was being ignored.

Impact: The SBC may ignore DTLS Client Hello message and cause no audio in STUN/ICE/DTLS calls when the endpoint performs STUN checks for two candidates and the two checks overlap.

Root Cause: The SBC is storing remote IP/port in the nominated candidate list, even if BREQ/BREQ_UC messages are already sent.

Then when resending the BREQ message, the SBC uses the remote IP/port from the stored nominated candidate array and that is causing confusion.

Steps to Replicate: Establish a STUN/ICE/DTLS call and have the endpoint initiate STUN connection checks with two candidates. The STUN checks should overlap in the following manner:

  • A Binding Request from candidate 1 (C1) received at the SBC, the SBC replies with a Binding Success Response to C1 and initiates a Binding Request to C1.
  • A Binding Request from candidate 2 (C2) received at the SBC, the SBC overwrites the stored candidate with C2, sends a Binding Success Response to C2 and initiates a Binding Request to C2.
  • The SBC receives a Binding Success Response from C2 and sends a new Binding Request with the USE-CANDIDATE attribute to C2.
  • At this moment, the SBC receives a Binding Success Response from C1.

The code is modified to:

  1. Avoid updating the nominated candidate list if we already sent out BREQ or BREQ_UC.
  2. Not to send BREQ during the window where the SBC has switched from sending BREQ to BREQ_UC.
  3. Wait for timer to be fired before resending BREQ.

Workaround: None.

SBX-1179002

The Azure-SWe SLB reboots as a result of memory corruption.

Impact: The Azure-SWe SLB reboots as a result of memory corruption.

Root Cause: A memory corruption issue produces a memcpy into a buffer that isn't large enough. This memcpy is in code related to the SLB function.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to verify the buffer size before the memcpy.

Workaround: None.

SBX-1199002

A potential SRTP encryption issue that may lead to one-way audio in media NAT scenarios

Impact: While debugging SRTP call logs collected from a customer's network, a potential risk is noticed that random values read from RID's memory block can be used as new SRTP sequence number and roll-over counter (SSN/ROC) when RID is enabled. If it happens, customers may experience one-way audio due to remote peer's anti-replay protection discarding SRTP packets or the remote peer's inability to decrypt SRTP packets.

Root Cause: The problem is triggered by NAPT timer expiry and the XRM notification to NRMA with previously learned remote IP address and port number.

Steps to Replicate: There are no exact steps to test this.
It is suggested to:

  1. Run SRTP regression tests.
  2. Perform SIP registrar switchover while running SRTP calls.

The code is modified to clear out previous saved remote IP address in XRES's SRTP/SRTCP encryption/decryption configuration to set correct SSN/ROC values in RID enable command.

Workaround: None.

SBX-1175462

The SBC is adding phone-context=private for a globalized number in the RURI and To Header.

Impact: The SBC adds phone-context=private in the RURI for a globalized number when it is modified using a DM rule.

Root Cause: Using a DM rule to add '+' in called number does not result in number being treated as globalized.

Steps to Replicate: Configure the DM rule to add a '+' sign. Run SIP-SIP call. The SBC sends a INVITE with globalization in RURI and has phone-context=private.

Do not add phone-context=private in the RURI when the RURI is already in globalized format, including when the userpart of globalization number has a '+' sign.

Workaround: Disable DM rule or use SMM to delete the phone-context parameter.

SBX-1177992

The SBC fails to recognize the Prack in a multi-dialog (different TO tags) if an 18X and 200(Inv) are received simultaneously.

Impact: For a dialog transparency and forked call, the SBC may reject the Prack request due to race condition of back to back 18x and 200 OK messages.

Root Cause: After receiving a 200 OK message, the SBC finalizes the active remote tag and queues up the send packet to the ingress due to a pending Prack. When the Prack is received, the SBC rejects it because the compare for the Prack comes from a different remote tag than the one already stored in the 200 OK message.

Steps to Replicate: 

  1. Configure the dialog transparency, forking, and E2E Prack to enable.
  2. Leg A calls Leg B.
  3. B1, B2 answer 18x
  4. B2 18x, B1 200 OK (no SDP) (back to back)

The code is modified to validate the remote tag based on the forking list not the final one.

Workaround: Disable the Prack.

SBX-1191072

The SBC in a TLS Client role does not verify the peer's certificate if authClient is set to "false"

Impact: The SBC in a TLS client role does not verify the peer's certificate if the authClient flag in the tisProfile is set to "false".

Root Cause: The issue is caused by an invalid configuration. For an SBC in SIP Peering environment, the recommended value of the authClient flag is "true". For an SBC in SIP Access environment, the recommended value of the authClient is "false".

In a SIP Peering case, the tlsProfile's authClient may be set to "false" inadvertently and the SBC in a TLS client role does not verify the peer's certificate.

Steps to Replicate: 

  1. Configure SIP-TLS in Peering case with authClient=false without configuring the peer's certificate chain's Root CA in the SBC.
  2. Attempt to make a SIP-TLS call to peer.

The TLS session is established without verifying peer's certificate chain.

The code is modified to verify the peer TLS server's certificate when the SBC acts as a SIP-TLS client, irrespective of the authClient setting.

Workaround: Correct the configuration by setting authClient to "true" in SBC Peering case.

SBX-1175062

The SCM Process was leaking a resource related to a NRMA sessPtr.

Impact: The SCM process may leak memory in some early call failure scenarios.

Root Cause: In early call failure scenarios, a different function is called to free the Call Block (and the memory linked off of it) than the function that frees the Call Block in successful call scenario.

The function that is called in some early call failure scenario was not freeing all of the memory that had been allocated for the call.

Steps to Replicate: The steps cannot be reproduced.

The code is modified so that all the memory that is allocated for a call is freed in all early call failure scenarios.

Workaround: None.

SBX-1199652

RtmSbyIcmHandle PRS cores, standby PRS cores when modifying IP Header

Impact: Standby PRS process cores in 1 to 1 HA mode.

Root Cause: The standby BRM mirrors modified IP hdr structure to standby.

Steps to Replicate: There are no steps to recreate the PRS core.

The code is modified to check redundancy mode and set mirroring flag accordingly since XrmFlowChange() can be invoked from active and standby context. The BRM mirroring function was originally invoked from XrmFlowChange().

Workaround: None.

SBX-1119342

A 300 response with embedded Identity header size of over 512 bytes in the contact is discarded with Force-Requery Redirection

Impact: The SBC drops embedded Contact header in 3xx responds when larger than 2k bytes.

Root Cause: Currently buffer support for embedded header is too small (max = 2k bytes).

Steps to Replicate: 

  1. Enable embedded header in 3xx.
  2. Egress responds to 3xx with embedded header size large.

The code is modified to increase buffer support up to 6,000 bytes.

Workaround: None.

SBX-1194632

The remote DTLS/SRTP Peer discards the SRTP packets due to an unexpected increase in ROC encryption. 

Impact: There is a one-way audio issue on the DTLS/SRTP call leg after an INVITE is sent with Replaces on the RTP call leg.

Root Cause: When the SIP registrar switched over, it signaled a call hold combined with an INVITE with Replaces method to modify the media path. The call was put on hold and existing Ethernet Resource (XRESs) and Bus Resources (BRES) were deactivated. A new BRES with new RID was allocated and replaced the previous BRES. Before activating the new BRES, Ethernet Resource Manager (XRM) calculated the new SSN/ROC based on XRES's saved SSN/ROC. But in the calculation, the XRM incorrectly increased ROC value which caused one way audio after the call is re-activated. 

Steps to Replicate: The steps are not reproducible. 

The code is modified to correct the resource allocation logic in XRM.

Workaround: None.

SBX-1181453

The "EMA - System Administration - File Upload" does not allow a .pfx certificate file to be uploaded.

Impact: The EMA does not support the uploading of a certificate file with a .pfx extension through the "EMA - System Administration - File Upload" page.

Root Cause: There is no requirement to allow a file to be uploaded with a .pfx extension, hence the support for the same is not available.

Steps to Replicate: 

  1. Log into the EMA.
  2. Navigate to the "System Administration - File Upload" screen.
  3. Select a file with a .pfx extension.
  4. Upload the file.

The upload of the file will be successful.

The code is modified to allow a file with a .pfx extension to be uploaded.

Workaround: The file has to be manually copied to the SBC through the SSH.

SBX-1181803

A duplicate MIME-Version header is added on a SIP over Core call.

Impact: A duplicate MIME-version header is added by the SBC when an incoming INVITE already has the MIIME-version header.

Root Cause: When the SBC encounters MIME content it adds the MIME-version by default. When an unknown header transparency is enabled at the egress IPSP and the incoming message has a MIME version header, it is transparently passed to the egress. This results in A duplicate MIME-version header at the egress side.

Steps to Replicate: 

  1. Setup a basic SIP-SIP call.
  2. Send an INVITE message having the MIME content and MIME-version header.
  3. Enable a PIDF transparency at the ingress IPSP.
  4. Enable the PIDF and an unknown header transparency at the egress IPSP.
  5. Verify if a duplicate MIME-version header is present inthe  egress INVITE.
    This can be tested without sending the MIME-version in the INVITE as well.

The code is modified to check for the MIME content and the MIME-version header.  If there is an unknown header transparency then it is not added it to message. Only the MIME-version will be added by the SBC.

Workaround: None

SBX-1183533

An incorrect DSP insertion/rejection reason can be seen recorded in the ACT record in the case of an incomplete offer/answer.

Impact: An incorrect DSP insertion/rejection reason is the result of an incomplete offer/answer. 

Root Cause:

Example:

  1. A T.38 is present in the Leg A and Leg B in the PSP.
  2. The egress peer rejects the offer.
  3. A 4xx message attempt record is updated with the DSP reject reason as "Call Rejected Unlicensed."

In the problem scenario where the T.38 is enabled as transcodable codec during an initial offer/answer, the SBC is not able to find the heaviest transcodable codec. The setting for the dspRejectionReason is "Rejected codec unlicensed".

Steps to Replicate: 

  1. Set up a basic SIP-SIP call configuration using the PSX.
  2. Enable the T.38 and G711 u in Leg A and Leg B in the PSP .
  3. Check the CDR and verify the DSP Rejection Reason.

The code is modified to update the dspRejectionReason to "Rejected codec unlicensed" for only the cases where the license is unavailable .

Workaround: None

SBX-1179013

Log is incorrect when using regex to filter value to be stored.

Impact: After adding an SMM rule for a value to a variable, there is a logging problem only - the wrong value is being written in the DBG log.

Root Cause: Logging the wrong data.

Steps to Replicate: Configure the SMM rule to store a value to a variable and look for the debug log message: "SipsMmUtilStoreValue ..."

The code is modified so the data log is stored to a variable correctly.

Workaround: Ignore the logging message.

SBX-1190322

Parsing the ttc-charging-params in the P-Charging-Vector only succeeds if the parameters have a certain order.

Impact: Parsing of ttc-charging-params in P-Charging-Vector succeeds only if the parameters have a certain order.

Root Cause: The issue is with the contractor parameter that is also picking up all subsequent parameters.

Steps to Replicate: 

  1. Run incoming ttc-charging-params in P-Charging-Vector.
  2. Run subsequent parameters after the contractor param.

All the subsequent parameters are ignored.

The code is modified to correct the Contractor parameter to be telephone number only.

Workaround: Use the SMM to reorder the parameters.

SBX-1197092

ASAN : ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004.

Impact: While generating early attempt CDR records, the code was trying to read ingress remote gateway information that was not available and this resulted in trying to deter a NULL pointer.

Root Cause: The code did not account for an edge case scenario where ingress remote gateway information was not available and tried to access a NULL pointer, which can result in a coredump.

Steps to Replicate: Run some call scenarios where the incoming call is queued and then processed later.

The code is modified to check if the pointer is valid before trying to read from it.

Workaround: Disable early attempt CDRs to avoid this issue.

SBX-1168202

The LDG goes down and triggers ARS - IP ACL.

Impact: The XRM debug command failed to dump static discard ACL stats.

Root Cause: The existing logic only dumps maximum 100 entries of each allocated ACL list. If a user has more than 100 allocated ACL list in admit TCAM ACL list, then the entry 101 to 200 is dumped for next category of ACL list, and so on.

Steps to Replicate: 

  1. Configure a set of SIP sigPorts.
  2. Unhide debug command.
  3. Issue a command "request sbx xrm debug command acl\ -stat", or "request sbx xrm debug command acl\ -cfg\ 50"

The code is modified to:

  1. Return the count of allocated ACL list.
  2. Specify number of entries to display, which is limited to <= 100. If user does not specify the number of entries, then we will default to 100.
  3. Display allocated ACL rules of each category, either from the beginning of the list, or continue from last entry of previous request.
  4. Have the user repeat the request multiple times to reach the end of the list. 

The change applies to both ACL config and stats.

Workaround: Configure less than 10 signaling ports.

SBX-1183932

The SBC is not sending message over IP Sec tunnel to UE when UE idles around one hour.

Impact: In IMS AKA connections, the SBC was sending a response to UE in clear when UE switched communication from UDP to TCP

Root Cause: The SBC was not opening IMS AKA ports for TCP communication when initial registration happened over UDP

Steps to Replicate: Run initial registration over UDP. Send INVITE/PRACK over TCP and UDP. Repeat the test with initial registration over TCP.

The code is modified to allow communication on both UDP and TCP irrespective of whether initial registration was on UDP or TCP.

Workaround: None.

SBX-1161633

G722 is in 183/200 SDP to ingress peer but 711U audio packets sent

Impact: When the SBC is playing tone and in subsequent response the Codec is changed, the SBC is not sending updated codec toward Ingress.

Root Cause: When the codec is changed in 183 after 180 w/o SDP, the SBC sends old codec in 183 and tries to send the updated codec in the Update. However, since offer answer is not completed the SBC queues the update. After 200 OK the SBC should release the queued SDP. However, in the earlier release the queued SDP was not released

Steps to Replicate:

  1. Invite is received with multiple codec i.e ( 0 18 8 9 102 101), the SBC sends Invite toward egress.
  2. From egress 180 without SDP is received, the SBC starts playing tone in G722 codec.
  3. From egress 183 is received with new codec i.e(0), the SBC sends 183 with SDP with old codec (G722).
  4. 200 OK with SDP(0) is received from egress.

The SBC should trigger re-INVITE toward ingress with updated codec (g722).

The code is modified to release the queued SDP when 200 OK is received

Workaround: None.

SBX-1176393

Uploading a .p12 file through the Configuration --> Security Configuration --> Commands --> Upload Certificate logs the user out.

Impact: Uploading a .p12 certificate through the "EMA - Configuration - Security Configuration - Commands - Upload Certificate" results into logging out the user and failing to upload the certificate.

Root Cause: The CSRF token was not passed in the certificate upload request. Due to this, the upload request was rejected and the user is logged out.

Steps to Replicate:

  1. Login to EMA.
  2. Navigate to Configuration --> Security Configuration --> Commands --> Upload Certificate screen.
  3. Select a certificate file to upload.
  4. Click Save.
  5. The upload should be successful.

The code is modified to pass the csrf token in the certificate upload request.

Workaround: Upload the file through the Administration --> System Administration --> File Upload --> Add Files to Queue --> Upload All Files.

SBX-1201142

LeakSanitizer error found in sanitizer.CE_2N_Comp_ScmProcess_0,1,2,3

Impact: The SBC leaks a small amount of memory while loading the ISUP signaling profile from CDB.

Root Cause: The functions which read the ISUP signaling profile from CDB were allocating memory to store the information before storing internally and did not free up the memory at the end of processing.

Steps to Replicate: This issue was only observed while testing with an ASAN enabled build as the amount of memory leaked is so small.

The code is modified to make sure that memory is correctly freed at the end of reading the ISUP signaling profile information from CDB.

Workaround: None.

SBX-1196032

LeakSanitizer: detected memory leaks.

Impact: The SBC was leaking memory while processing MTRM configuration data.

Root Cause: While processing the MTRM configuration, the SBC was reading data to internal memory for validation and not freeing up the memory at the end of the validation process.

Steps to Replicate: Run various MTRM configuration changes and check there are no memory leaks.

The code is modified to make sure the configuration validation memory is correctly freed up at the end of processing.

Workaround: None.

SBX-1199642

The SCM Process cored during call execution of re-INVITE/UPDATE call scenarios.

Impact: The SCM process was coring during re-INVITE/UPDATE call scenarios.

Root Cause: The code was trying to update packet ccb information, resulting in the dereferencing of a NULL pointer and a coredump.

Steps to Replicate: Re-run a selection of re-INVITE/UPDATE test cases to confirm no coredump occurred.

The code is modified to ensure that the pointer is not NULL before dereferencing the pointer to avoid a coredump.

Workaround: None.

SBX-118373 | SBX-1189283

PortFix SBX-118373: There was an Active SBC 7000 DNS Process core.

Impact: The DNS Process on the active CE on a system switchover may coredump.

Root Cause: A NULL DNS TCB (transaction control block) was encountered while the Active CE was shutting down (during restart).

Steps to Replicate: The steps cannot be reproduced.

The code is modified to guard against using a NULL DNS TCB.

Workaround: None.

SBX-110756 | SBX-1169043

PortFix SBX-110756: Wrong behavior with sipAdaptiveTransparencyProfile enabled.

Impact: When the SipAdaptiveTransparencyProfile was enabled and the SBC received 200 OK with SDP, it was sending ACK without SDP in late media scenario cases.

Root Cause: The SDP was not being added in ACK in late media cases.

Steps to Replicate: The following are the test cases used in the call flow:

  1. Send a 200 OK for re-INVITE from EGRESS PEER without SDP.
  2. Send a 200 OK for re-INVITE from EGRESS PEER with SDP but changed CODEC.
  3. Send a 200 OK for re-INVITE from EGRESS PEER with SDP.
  4. Send a 4xx (for re-INVITE) from EGRESS PEER.

The code is modified to add SDP in ACK for late media cases.

Workaround: None.

SBX-117280 | SBX-1177582

PortFix SBX-117280 to 8.2.5R007: Apache Axis security issues

Impact: The following vulnerabilities related to Apache 1.2 were identified with in the Ribbon SBC application:

Issue 1: The LI uses unsupported Apache Axis 1.2 (2005) on JBoss 5.1 (2009).

Issue 2: The LI exposes the Apache Axis AdminServlet without authentication (default for Axis 1.2).

Issue 3: The LI runs as the sonusadmin user, a privileged account.

Root Cause: The LI uses unsupported Apache Axis 1.2 (2005), exposes the Apache Axis AdminServlet without authentication and runs as the sonusadmin user, a privileged account.

Steps to Replicate: 

  1. Access the url https://{SBC hostname}/liTargetProvisioning/services/AdminService from the browser.
    1. Result: An Axis error "No service is available at this URL" is displayed.
  2. Access the url https://{SBChostname}/liTargetProvisioning/services/AdminService?wsdl from the browser.
    1. Result: An Axis error "Could not generate WSDL! There is no SOAP service at this location" is displayed.

The Apache Axis cannot be upgraded to version 1.4 for issue 1 due to the following:

The Axis 1.2 has 3 vulnerabilities CVE-2018-8032, CVE-2014-3596 and CVE-2012-5784 and the SBC application is not impacted by any of these.

Axis 1.4 has four vulnerabilities (3 from version 1.2 plus 1 new) out of which CVE-2019-0227 (this is the new one in version 1.4) could impact the SBC application.

As a result, for issue 1 no fix is required.

For issue 2 and 3, the code is modified to remove the AdminService.

Workaround: None.

SBX-117293 | SBX-1180343

PortFix SBX-117293: Unable to import a large SSL certificate to the standby node

Impact: Unable to import a large SSL certificate to the standby node.

Root Cause: Certificate was not getting restored on standby as its content was getting corrupted due to bufferoverflow.

Steps to Replicate: 

  1. Import certificate with large DER content (more than 6400 bytes) and verify that action is aborted and user is presented with error.
  2. Create a local-internal certificate with subjectAlternativeDnsName of size 512 chars to 4096 chars.

The code is modified to add validation to prevent bufferoverflow. Increased size of subjectAlternativeDnsName entries to 4096 chars.

Workaround: None.

SBX-112042 | SBX-1175253

PortFix SBX-112042: The SAM hangs and crashes during a correct switchover attempt.

Impact: After a switchover, the SAM process was not being terminated correctly.

Root Cause: SIPCM Terminate was taking longer time than AMF specified time value of two minutes and as a result, the AMF was forcefully aborting the SAM process.

Steps to Replicate: 

  1. Launch the SBC HA.
  2. Run the mix load.
  3. Perform a switchover.

Incremented the AMF terminate timer from 2 min to 4 min for SAM process.

Workaround: Run the below cmd to increase the AMF timer value without any code changes.
removeenv.pl -n TERMINATE_TIMEOUT sam
addenv.pl -n TERMINATE_TIMEOUT -v 240000 sam

SBX-111141 | SBX-1182383

PortFix SBX-111141: The SBC 7000 softwareUpgradeStatus shows invalid characters for upgradeCompleteTime

Impact: After performing an upgrade, the upgradeCompleteTime field was not getting populated with the correct value. 'upgradeCompleteTime' showed invalid characters.

Root Cause: A variable ‘tmp’ defined within SonusSmSoftwareUpgradeCsv::populateTime has a pointer reference to SonusSmSoftwareUpgradeCsv::setSoftwareUpgradeCompleteTime function. Since ‘tmp’ variable’s scope was limited to SonusSmSoftwareUpgradeCsv::populateTime we were getting corrupted value when we access that in SonusSmSoftwareUpgradeCsv::setSoftwareUpgradeCompleteTime.

Steps to Replicate: Perform an upgrade and check upgradeCompleteTime through the CLI command:
show table system softwareUpgradeStatus

The code is modified by making the ‘tmp’ variable a static variable, so that gets allocated for the lifetime of program.

Workaround: None.

SBX-116240 | SBX-1173433

PortFix SBX-116240: EMA TLS profile certificates handling is not working properly.

Impact: The EMA TLS profile certificates handling is not working properly.

Root Cause: The EMA TLS profile certificates were not getting restored if incorrectly configured.

Steps to Replicate: Try configuring EmaTlsProfile clientCaCert and serverCert incorrectly:

  1. Set remote cert as serverCert.
  2. Set local cert as clientCaCert.
  3. Verify that validation fails and user is prompted.

The code is modified to perform validation to ensure user doesn't configure emaTlsProfile.

Workaround: Reconfigure EmaTlsProfile with correct certificate types for clientCaCert (remote) and serverCert (local/local-internal).

SBX-119224 | SBX-1192932

Microsoft Azure reserves port 65330.

Impact: Some DNS queries fail to get a response in an Azure deployment. 

Root Cause: Microsoft does not allow VMs to use port 65330. The DNS queries are sent using this local port  and are dropped.

Steps to Replicate: Run DNS queries for a long period of time and check that port 65330 is not used.


The code is modified to mark port 65330 as reserved.

Workaround: The Linux configuration can be manually updated to reserve the port. 

  1. The following actions need to be run as root on the SBC.
    echo '5041,5043,65330' > /proc/sys/net/ipv4/ip_local_reserved_ports
  2. Edit the following line in /etc/sysctl.conf
    net.ipv4.ip_local_reserved_ports=5041,5043
    to append “,65330”
    net.ipv4.ip_local_reserved_ports=5041,5043,65330
  3. There is no need to reboot.
SBX-117921 | SBX-1179232

PortFix SBX-117921: A de-reference a NULL return value.

Impact: The SCM process allocates a null pointer resulting in a crash.

Root Cause: While trying to remove the EVS codecs from a call with a leg associated to the MRF/MRFP, the associated call leg is removed due to a race condition and the code dereferences a NULL pointer.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to defend against the race condition and validates that the associated call leg pointer is not NULL before dereferencing it to avoid a coredump.

Workaround: None.

SBX-119262 | SBX-1192952

PortFix SBX-119262: ednsPayloadSize value is not applicable after S-SBC switchover

Impact: The ednsPayloadSize value is not taking effort following a switchover.

Root Cause: The SBC was missing code to restore the ednsPayloadSize value in an N:1 configuration.

Steps to Replicate: Assign a value to the ednsPayloadSize of the DNS configuration check that it is taking effect and then perform multiple switchovers and check that the configuration is still taking effect:

set global servers dns global ednsPayloadSize <512-4096 bytes>

The code is modified to correctly restore this configuration value.

Workaround: Following a switchover, the operator needs to remove and reapply the edns configuration value.

SBX-118109 | SBX-1181392

PortFix SBX-118109: EMA: Terminate call is not working from EMA

Impact: Terminate call command is failing from EMA

Root Cause: When terminate call operation is performed, the terminate call xpath is encoded by the UI and sent to the backend. The backend, however was not decoding the xpath due to which the operation was failing.

Steps to Replicate:

  1. Run a long duration call (approximately for two mins or more).
  2. Log in to EMA and go to All->Address Context ->Call Media Status Detail and note the GCID.
  3. Click on All->Global and from commands, drop down select Terminate Call and give the value of GCID in the popup.
  4. Click on terminateCall.

The call should get terminated

The code is modified to decode the xpath in the backend.

Workaround: No workaround.

SBX-113593 | SBX-1173842

PortFix SBX-113593: Observed that callResources are not properly clearing after the call is complete.

Impact: In a DSBC setup with multiple nodes in the T-SBC cluster, for the initial INVITE processing, resources (DSP, public xres and private xres) were allocated from TSBC1 (for codecs G729 on offer leg, G711 on answer leg). After receiving an answer with 729, the resources from TSBC1 were cleared up properly and the new resources allocated on a TSBC2 for G729 on leg0 and G729 on leg1, with priv xres(s) cleared up since it is a single DSP call. The call turns to be G729-G729 transcode.

Upon receiving a re-INVITE with G711, resources (dsp+priv xres+public xres) were allocated from TSBC1, and upon receiving answer (200 OK) from UAS, new resources were allocated from another TSBC (TSBC2). Before activating these new resources from TSBC2, the TSBC1 resources on the call leg have to be deallocated. However, this was not being done correctly.

Root Cause: While freeing up resources for initial offer-answer on TSBC1, an incorrect resource mask (only dsp, and not the public/private xres) was being set in the deallocation command by S-SBC to TSBC1. This resulted in the call structure on TSBC1 being held despite the call being terminated and resources being freed.

Steps to Replicate: Set up:

Run D-SBC with multiple nodes in TSBC cluster.
Route the PSP has codecs in order- G711, G729.

Scenario:

  1. Make a UAC-SBC-UAS call where initially call is established as G729-G729 transcode call with PSP setting is transcode only and G711.
  2. Send a re-INVITE through the UAC by changing codec to G711U call with transcode flag is transcode only.
  3. Observe if there are any hung resources/active call count in the callResourceDetailsStatus / callCountStatus after a call has terminated.

The code is modified to reduce the number of DSP re-allocations between TSBCs by not allocating fresh DSPs for every new offer, unless absolutely required. This is achieved by performing the following tasks:

  1. Setting the correct resource mask (dres+priv xres+public xres) in the deallocate command from the S-SBC to the T-SBC to free resources on the T-SBC.
  2. Prevent the codec capability mask from being overwritten during reallocation based on answer (The codec mask for answer is frequently a subset or partial mask of that in the initial offer). This retains the codec capability mask set during previous offer-answer and retains the old DSP resource if it is capable in servicing the new offer instead of going for new resource allocation just because of the restricted capability mask set during answer processing.

Also, while deallocating resources on the T-SBC from the earlier offer-answer,
in the current working context, the S-SBC structure holding details of the resource being freed that includes the TSBC node gcid, node IP, and resource info pertaining to the DSP, private xres and public xres, is set to NULL if it is also referenced in any other existing contexts. This is to prevent the private xres also referenced in another context from being incorrectly freed.

Workaround: None.

SBX-117948 | SBX-1191672

PortFix SBX-117948: Deletion of a SMM Profile with 768 rules is failing.

Impact: Deletion of a SMM Profile with 768 rules is failing

Root Cause: There was a restriction of 1000 transactions per commit to avoid health check issues leading to failure while deleting SMM profile with large number of rules.

Steps to Replicate: Validate that deletion of SMM profile with 768 rule succeeds.

The code is modified as the operation was already being performed by disabling the healthcheck timeout for the duration of operation.

Workaround: No workaround.

SBX-116605 | SBX-1167372

PortFix SBX-116605: The SBC does not log SIP messages to the TRC file when routing calls using the DNS Lookup.

Impact: The SBC does not log SIP messages to the TRC file when routing calls using the DNS Lookup.

Root Cause: During a DNS lookup, the LogInfoSpec is not set with the proper logging details in the SIPCall data structure.

Steps to Replicate: Make a call from the Ingress side with the DNSLookup enabled. Post the call as successful and check the TRC file.

The code is modified to address the issue.

Workaround: None.

SBX-118922 | SBX-1191463

PortFix SBX-118922: There was a problem on the EMS SBC Manager's SIP Active Register Name Status List.

Impact: There was a problem on the EMS SBC Manager's SIP Active Register Name Status List.

Root Cause: The SBC browser reloads the screen when clicking the search button. On a reload functionality check for previous search text, if any available it will trigger search button. As a result, this loops continuously. 

Steps to Replicate: 

  1. Log in to the EMA.
  2. Navigate to All -> Address Context -> SIP Active Register Name Status.
  3. Enter search text and click the Search button.

The page returns an entry according to the search text. The page does not refresh (loop).

The code is modified to stop the default browser behavior by clicking the Search button.

Workaround: No workaround.

SBX-116335 | SBX-1175722

PortFix SBX-116335: The SBC EMA presents only the SSL server certificate, instead of the full certificate chain.

Impact: The SBC EMA/PM web server isn't sending the full certificate chain while negotiating the TLS with clients.

Root Cause: The SSLCACertificateFile option is commented in SBC which makes the EMA/PM server send only its serverCertificate to the clients.

Steps to Replicate:

  1. Initiate the TLS connection from the browser to the SBC EMA/PM server and capture packets using Wireshark on the client.
  2. The CA certificate does not show up in the packets.

The code is modified to add the SSLCACertificateFile option. Now the EMA/PM web servers will send the CA certificate along with the server certificate during TLS negotiations.

Workaround: None.

SBX-114056 | SBX-1164112

PortFix SBX-114056: An RTCP goodbye message is sent after a 183 RESPONSE.

Impact: When monitoring a profile is enabled with an early media configuration, the early media from the endpoint is triggered. The
RTCP Bye packet is sent with the SSRC of the endpoint. The media continues with the same SSRC, resulting in issues because it is not compliant to the RFC.

Root Cause: The indication to stop monitoring is passed as soon as the early media is received. The deactivation and reactivation of resources cause it to send the RTCP bye packet with the SSRC. The SSRC is received from the endpoint.

Steps to Replicate:

  1.  Configure monitoring profile with an early media authorization (EMA) flag enabled and the RTCP gen.
  2. Configure the early media and create scripts with the P- early media supported.
  3. The UAC sends an invite with the p-early media supported,
  4. The UAS sends a 183 with a SDP that has a local PRACK and media with the SSRC1.
  5. The UAS sends a 200 OK and media with the SSRC1.

The RTCP bye packet is suppressed for early media when the endpoint is playing the media.

Workaround: Disable the monitoring profile.

SBX-118050 | SBX-1200322

PortFix SBX-118050: The TERM IOI value has not returned in 18x/200 OK to the caller as expected in the IPX PCV header management.

Impact: Part of a feature introduced in the SBC Core 9.2.3 release contained these requirements:

Customer network

  1. All messages toward the customer MUST be sent with a PCV header and use provisioned ioi values.
  2. ioi in the PCV header will be the customer's assigned value for the PARTNER generating it.
  3. When messages from PARTNER have a PCV with ioi, the ioi needs to be overwritten with the customer assigned PARTNER value.
  4. Messages from the SBC may have a PCV but without ioi params in it.

Partner network

  1. PCV may/may not be received from PARTNER with/without ioi params
  2. PCV is not sent toward PARTNER in most cases but some PARTNER networks may want this in the future
  3. So, this needs to be configurable and where applicable, provisioned ioi values used in the PCV in messages to the PARTNER
  4. However in testing, when the far end is not set to sendPCV, the 18x/200 OK back to the Ingress trunk does not get sent the Term-IOI value, only the Orig-IOI in the 18x/200 OK. However, on the 200 OK from the BYE there is both Term/Orig IOI.

Ingress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.Server.iqntipx;
termIOI term.Server.iqntipx;
sendPCVHeader enabled;

Both SIPCORE TGs.
generateOrReplacePCV {
state disabled;
sendPCVHeader enabled;

Egress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.cust.iqntipx;
termIOI term.cust.iqntipx;
sendPCVHeader disabled;


A Call Flow Partner Peer PARTNER TG on the SBC TG on the SBC peer
4 <------- INVITE w/o PCV -------
-------- 18x w/o PCV ---------> <------------ INV w/o PCV ----------
---- 18x w [PCV w prov term-ioi] -→

Root Cause: The following configuration must be enabled:

Ingress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.Server.abcdefg;
termIOI term.Server.abcdefg;
sendPCVHeader enabled;

Both SIPCORE TGs.
generateOrReplacePCV {
state disabled;
sendPCVHeader enabled;

Egress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.cust.abcdefg;
termIOI term.cust.abcdefg;
sendPCVHeader disabled;

The issue is noticed for the following call flow:

Call Flow Partner Peer PARTNER TG on the SBC TG on the SBC peer
4 <------- INVITE w/o PCV -------
-------- 18x w/o PCV ---------> <------------ INV w/o PCV ----------
---- 18x w [PCV w prov term-ioi] -→

Steps to Replicate: The issue can be replicated by configuring the following:

Ingress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.Server.abcdefg;
termIOI term.Server.abcdefg;
sendPCVHeader enabled;

Both SIPCORE TGs.
generateOrReplacePCV {
state disabled;
sendPCVHeader enabled;

Egress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.cust.abcdefg;
termIOI term.cust.abcdefg;
sendPCVHeader disabled;

The issue is noticed for the following call flow:

A Call Flow Partner Peer PARTNER TG on the SBC TG on the SBC peer
4 <------- INVITE w/o PCV -------
-------- 18x w/o PCV ---------> <------------ INV w/o PCV ----------
---- 18x w [PCV w prov term-ioi] --->

The code is modified so when the generateOrReplacePCV functionality is enabled, carry forward the data like the original ioi, icid, etc. in the call block. This is used while processing 18x/200 OK and appropriately adds Term-IOI if configured and when sendPCVHeader is enabled.

Workaround: Enable sendPCVHeader on both trunk groups.

SBX-117119 | SBX-1179552

PortFix SBX-117119: The removeSavedConfig does not delete a saved config file unless 'show table system savedConfigList' is called beforehand.

Impact: The removeSavedConfig does not delete a saved config file unless 'show table system savedConfigList' is called beforehand.

Root Cause: When savedConfig and removeSavedConfig called one after the other, the internal list did not have the path to delete the file.

Steps to Replicate: 

  1. Run the Saveconfig.
  2. Run the removeSavedConfig.

The code is modified to update the internal list with path and file name.

Workaround: Before calling the removeSavedConfig, call the "show table system savedConfigList"

SBX-115853 | SBX-1178942

PortFix SBX-115853: The SBC sent an UPDATE with payload (128 101) that caused calling party to fail the call.

Impact: This is a SIP-GW1-GW2-SIP call. The issue is GW1 sends an UPDATE to client for codec G.729 but Payload Type as 128.

Root Cause: UPDATE is sent by GW1 to ingress because at ingress, there was Tone and Announcement profile configured and playing the Tone triggered by an UPDATE.

An UPDATE was sent to client with G729 as G729 was the first codec offered by Server in it's UPDATE message, as the Honor Remote Precedence flag was enabled in Ingress GW's PSP. The G729 PT is updated with wrong value of 128 instead of 18 in the NRMA code. The selected codec's rx PT was assigned with tx PT that contained invalid PT.

Steps to Replicate: 

  1. Set up a SIP-GW-GW-SIP call.
  2. Set up Tone and Announcement in Ingress GW TG.
  3. Set Honor Remote Precedence flag enabled in Ingress TG PSP.
  4. Sent an UPDATE from server with a codec other than G711 and a codec which is different from previously negotiated codec.
  5. An UPDATE should be sent to client with correct PT.

The code is modified with a valid PT value.

Workaround: Set the Honor Remote Precedence flag disabled.

SBX-101758 | SBX-1135512

PortFix SBX-101758: There was an issue regarding field Ingress Codec inside the CDR for some calls with CLEARMODE.

Impact: The SIPI INVITE call fails when CLEARMODE as CODEC feature is enabled.

Root Cause: The call failed as CLEARMODE in the PSP was becoming NULL.

Steps to Replicate: Run the CLEARMODE as CODEC enabled and PSP has CLEARMODE as entry.

Test steps:

  1. Use the SIPI scripts.
  2. Enable ClearModeAsCodec flag in both ingress and egress TG. Add a CLEARMODE codec in ingress and egress PSP.
  3. Use the scripts and make a SIPI-SIPI call.
  4. The call should connect and CDR should be populated as DATA, CLEARMODE (P:71:0).

Tests can be done to verify different call flows:

  1. SIPI-SIPI call with ingress offers CLEARMODE, Egress responds CLEARMODE.
    expected output: CDR and Call media status cli command should show data and CLEARMODE.
  2. SIPI-SIP call with ingress offers CLEARMODE, Egress responds CLEARMODE.
    expected output: CDR and Call media status cli command should show data and CLEARMODE.
  3. SIPI-SIP call with ingress offers CLEARMODE + G711U, Egress responds G711U.
    expected output: CDR and Call media status cli command should show audio and G711U.

The code is modified so that when the CLEARMODE as CODEC is enabled and the SIPI with CLEARMODE is received, the call is processed and the CDR gets updated with CLEARMODE (p:71:0).

Workaround: Not available.

SBX-114396 | SBX-1173922

PortFix SBX-114396: An UPDATE to modify AMR-NB to the AMR-WB failed in cases where a multi active TSBC was involved.

Impact: In a multiple T-SBC cluster setup, when receiving a modify offer (ex: with Update/reinvite) to change from a lower codec (AMR-NB) to a heavier codec (AMR-WB), the SBC was reallocating a new DSP to support the heavier codec. This DSP could be from the same T-SBC as the initial offer-answer DSPs (TSBC1), or a different T-SBC (TSBC2). In this case, the new DSP on offer leg was from TSBC2.

While processing an answer leg, the SBC incorrectly chose to reuse the existing DSP though it is from the first TSBC1 instead of TSBC2, the node from which the new DSP for the offer leg is allocated.

Root Cause: While processing the answer leg, when the SBC chooses to either reuse the previously-active DSP on the call leg, or reallocate a new DSP, the SBC did not check the node IP address of the T-SBC (where the DSP on the offer leg was allocated) against the previously-active DSP on the current answer leg.

Steps to Replicate: 

Set up:

  1. Set up a D-SBC having multiple T-SBC nodes.
  2. Transcode the PSP setting only.

Call flow:

  1. Run an initial call after an INVITE, list 183/Prack and UPDATE for preconditions is AMR-NB–AMR transcode. DSPs for this call are from TSBC1.
  2. Send an UPDATE to the change codec on egress leg from AMR to AMR-WB.

The DSP on offer leg is from TSBC2.

The code is modified so the SBC compares the node IP address of the T-SBC for a newly-allocated DSP on the offer leg with that of the previously-active DSP on the current answer leg. The SBC reuses the latter only if both of the IPs match; otherwise, a new DSP is allocated, and the previous DSP frees up later on.

Workaround: Run a single T-SBC in a cluster.

SBX-117279 | SBX-1182182

PortFix SBX-117279: The SBC init.d script checkForUpgradeRevert() file parsing is forgiving and can facilitate arbitrary command execution.

Impact: One of the scripts on the SBC has a security issue that in a particular scenario can cause potential privilege escalation from sonusadmin to root.

Root Cause: Script was running a marker content without input validation and location of marker was not secure.

Steps to Replicate: This code block gets executed only when an upgrade from version which has single debian root partition to three partition model. It is not applicable for any 6.0 or later installations.

The code modified to move the marker to a secure location owned by root and input validation is added in script as a added measure.

Workaround: No workaround.

SBX-114194 | SBX-1181442

PortFix SBX-114194:Observing memory leak in ScmProcess of active S-SBC during precondition update call flow

Impact: On the D-SBC, there was a memory leak in the cluster transcoding capability during Update with preconditions call flow.

Root Cause: On the D-SBC, the reference to cluster transcoding capability held in the current working PSP context was being lost, hence leading to memory leak.

Steps to Replicate: Run an Update with preconditions call flow on a D-SBC setup and monitor the memory on the active S-SBC node. Without the fix, there would be an increase in the memory usage of SCM Process indicating a memory leak.

The code is modified to avoid losing a reference to the current working PSP context cluster transcoding capability memory, by saving it to the pending Ack PSP context and ensuring to free this memory during the offer answer processing.

Workaround: None.

SBX-118108 | SBX-1191662

PortFix SBX-118108: The SBC is not sending SDP offer in outgoing INVITE with all the codecs that are configured in PSP.

Impact: The SBC is not sending out INVITE with all configured codecs (passthru + transcodable) when Audio + Text is received.

Root Cause: The issue only occurs when the D-SBC ( S/M/T ) set up receives an INVITE from Ingress peer with Audio and T.140 stream.

During offer processing, the SBC was checking the transcode capabilities for both Audio and text stream, causing this issue.

Steps to Replicate: 

  1. Configure multiple codecs in Ingress and Egress PSPs.
  2. Send multiple codecs in INVITE from Ingress Peer. (Audio + Text )
  3. The SBC should sent all passthru and transcodable codecs configured in the PSP to Egress Peer.

The code is modified to address the issue.

Workaround: None.

SBX-114693 | SBX-1191612

Portfix SBX-114693: Need to Update all the Application code to set the V6 loopback address.

Impact: The SBC fails to identify an address as loopback address for an IPV6 call

Root Cause: New feature that was added in the 10.1 release exposes this issue.

Steps to Replicate: Run a NATed call from IPV6 end point.

The call must be established successfully and media should flow from EP1 to EP2 through the SBC.

The code is modified so that the SBC identifies the loopback address for an IPV6 call correctly.

Workaround: None.

SBX-117842 | SBX-1191732

PortFix SBX-117842: Number Translation criteria was not appearing after importing the file that contains number translation criteria.

Impact: Number Translation criteria was not appearing after importing the file that contains number translation criteria.

Root Cause: This issue is caused by a feature code check-in, in the SBC release 9.2.3.

Steps to Replicate: 

  1. Log into the PM.
  2. Navigate to Administration --> System Administration --> Profile Import/Export.
  3. Click on Export Profile button.
  4. Provide a File Name and Select the Type "Number Translation Criteria".
  5. Check if all instances of that profile are listed.
  6. Select an instance of the profile.
  7. Click on the Export button.
  8. Delete the profile from Number Translation Criteria.
  9. Import the exported file that contains the Number Translation Criteria.

Expected Results: The number translation criteria should appear after the import.

Observed Issue: The number translation criteria is not appearing after the import.

The code is removed from all occurrences policy/SBXPIPE/SbxNumberTranslationCriteriaEntity.cpp

tfpem.serviceDmPmRuleIb.setData((char *)CONFD_GET_BUFPTR(key));
tfpem.serviceDmPmRuleIb.setDataNull(GUISVR_BOOL_FALSE);
tfpem.serviceDmPmRuleIb.setLoaded(GUISVR_BOOL_TRUE);

Workaround: No workaround.

SBX-115421 | SBX-1191592

PortFix SBX-115421: Serf Logs and Upgrade marker files are missing from sysDump.

Impact: Serf logs and upgrade marker files were missing from sysDump.

Root Cause: Capturing only specific log files without * regex.

Steps to Replicate: Run sysDump.pl script.

The code is modified to capture all the files including rolled over files.

Workaround: No workaround.

SBX-117972 | SBX-1191642

PortFix SBX-117972: While expecting BYE, the SBC is sending an INVITE to egress side.

Impact: The SBC sending a re-INVITE with text stream disabled when the egress EP sends 200 OK with Audio stream alone.

Root Cause: Since, the egress EP sent 200 OK with only audio stream, SBC internally disables the text stream on both call legs that is resulting in triggering of a Re-INV with text stream disabled towards UAS side.

Steps to Replicate: 

  1. UAC sends INVITE Audio + Text to the SBC.
  2. The SBC sends INVITE Audio + Text to UAS.
  3. UAS sends 18x Audio + Text (port=0) to the SBC.
  4. The SBC sends an INVITE to MRF server and MRF server responds back with valid Audio and Text Ports.
  5. The SBC sends 18x Audio + Text to UAC.
  6. UAS sends 200 OK Audio stream alone.

The code is modified so that if the peer already disables any media stream and if the SBC tries to trigger a re-INVITE towards the peer for disabling the same media stream, then suppress the triggering of the re-INVITE.

Workaround: None.

SBX-116190 | SBX-1170722

PortFix SBX-116190: Egress congestion handling should only be enabled for the 503 with a retry.

Impact: The SBC was treating 503 with or without Retry-After header as a peer overload scenario. But the SBC should only treat 503 responses with retry-after because those are unambiguously overload related.

Root Cause: The SBC was not verifying for the presence of Retry-After header to consider it as a peer overload scenario.

Steps to Replicate: Send a 503 with Retry-After header for a SIP INVITE.

The code is modified to address the issue.

Workaround: None.

SBX-117985 | SBX-1191712

Portfix SBX-117985: DSP Reload: Active SBC went down when dsp coredump was issued

Impact: Manual DSP coredump initiated via CLI fails to collect core-dump and initiates switchover in case of the SBC 5400.

Root Cause: While initiating manual DSP coredump, the DSP should be notified to copy the concerned memories to core-dump section for core-dump collection to happen successfully.
In case of the SBC 5400, sending of notification to DSPs were skipped due to non-support.

Steps to Replicate: * SBC 5400 with at least one DSP card.

  1. Once the application is active, assuming DSP card to be present in slot #1, issue manual DSP core-dump command.
  2. Enable debug commands (unhide debug).
  3. Execute the following command.
  4. Request an SBC drm debug command "dspcoredump dsp 1".

The code is modified to add support for SBC 5400 to notify DSP in case of manual DSP core-dump initiated through the  CLI.

Workaround: None.

SBX-90704 | SBX-1192552

PortFix SBX-90704: Ingress octets sent/egress octet rcvd for T.38 calls

Impact: When stopping CDRs for T.38 calls, the Ingress octets sent and received values are not correct.

Root Cause: For T38 packets, NP calculates incorrect packets when there is no RTP header for the T38 and as a result, some packets may be less than 12 bytes.

Steps to Replicate: Stop CDRs for T.38 calls. 

The code is modified to address the issue.

Workaround: None.

SBX-118302 | SBX-1197172

PortFix SBX-118302: MS TEAMS to PSTN call failed when SILK codec is enabled.

Impact: An MS TEAMS to PSTN call failed when SILK codec is configured and the lockdown preferred codec IPSP flag is enabled.

Root Cause: When the lock down preferred codec IPSP flag is enabled, one of the codec attributes related to the payload type is not copied properly during an auto answer on the egress call leg. As a result, the call is terminated.

Steps to Replicate:

  1. Enable "Lock down Preferred codec" flag on the egress trunk.
  2. Configure the packet service profile with "Transcode only" option.
  3. Configure ingress route with SILK codec and egress route with PCMU codec.
  4. UAC sends an INVITE with the SILK codec.
  5. The SBC sends an INVITE with PCMU codec to UAS.
  6. UAS sends a 200 OK with PCMU to the SBC.
  7. The SBC sends a 200 OK with SILK to UAC.
  8. UAC sends ACK to the SBC.
  9. The SBC sends ACK to UAS.

The code is modified to copy the codec payload type value during an auto answer.

Workaround: If "Lock Down Preferred Codec" IPSP flag is disabled then the call scenario works fine.

SBX-116256 | SBX-1191622

PortFix SBX-116256: Observed a heap-buffer-overflow on address 0x6260000bf802 at pc 0x56063d63cca4 bp 0x7fe633ce2b00 sp 0x7fe633ce2af8.

Impact: A heap-buffer-overflow is observed when Option header with too many spaces or tab is received.

Root Cause: When too many space are inserted after Option header.

Pdullen is calculated wrongly and include all the spaces also so while doing pre parsing pdulen reaches beyond PDU and leads to coredump.

Steps to Replicate: Send option Message with large no spaces or tab such as: 
OPTIONS \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \t \tsip:9611912691@10.xx.yy.zzz:7050 SIP/2.0

The code is modified to change the startIndex so that it points to Offset Length that is equivalent to the Header length.

Now while calculating the PDU length, it is taken from Offset. With these changes, all spaces are taken into consideration and the length is correct.

Workaround: None.

SBX-116942 | SBX-1174812

PortFix SBX-116942: D-SBC (M-SBC) - The XRM/NP CPUs are also being used by a system task causing slowness in media tasks.

Impact: In the SWe, a few sbxPerf processes (example: top2) run on the media cgroup causing congestion issues.

Root Cause: Segregation of media and non-media processes at initialization time may fail, leading to non-media processes landing on a VCPUS that is meant for media processing.

Steps to Replicate: Install a fix build in the SWe and check whether the sbxPerf process (example: top2, atop) runs on the core0.

The code is modified to move the sbxPerf processes to the system cgroup. The segregation of processes is fixed as part of a separate issue.

Workaround: Reboot the SBC.

SBX-112980 | SBX-1150532

PortFix SBX-112980: The SBC interworks the extra precondition UPDATE towards the Egress.

Impact: The downstream forking and preconditions interwork using an UPDATE method are enabled.

When multiple 18x with a precondition are received by the SBC, the SBC sends an UPDATE request to complete the preconditions. The SBC sends an additional precondition UPDATE towards the egress, even though the preconditions are already completed.

Root Cause: There was an issue in the code when an UPDATE request is triggered a second time without checking whether preconditions are met already.

Steps to Replicate: Run the call flow per the customer's setup.

The code is modified to suppress the additional precondition UPDATE request, if preconditions are already met.

Workaround: None.

SBX-117803 | SBX-1188082

PortFix SBX-117803: MOH call failure for non core stream

Impact: Media On Hold (MOH) Call is failing for non core stream when NAT is enabled.

Root Cause: Call is failing because of frequent deactivation and reactivation of resources for a non core stream at the time of NAT relearning causing resources to go into asynchronous error

Steps to Replicate: 

  1. Configure the NAT media and signalling.
  2. RUN a hold resume with a two media stream (audio + video).
  3. Check if it throws a BRM sync Error or if the resources are deactivated and reactivated frequently.

The code is modified for non core stream in a NAT call so that deactivation and reactivation of resources does not take place.

Workaround: 

  1. Run the call with only core audio
  2. Run the call without configuring NAT
SBX-114293 | SBX-1182372

PortFix SBX-114293: The S-SBC is unable to clear a call when there are multiple codec changes with RE-INVITES in call.

Impact: On the D-SBC, a two DSP transcode call involving multiple re-INVITEs has a hung private respone and a call termination takes more time than expected.  For example: a call hold/off-hold with a codec change from narrowband to wideband and vice versa.

Root Cause: On the T-SBC, for every DSP, two XRESs are allocated during a re-Invite: a public and a private XRES.
In a single DSP call, the private XRES is retained. But if the call requires both DSPs, the private XRES(s) on each call leg is released.
In the two DSP call scenario, after multiple re-Invites(hold/off hold with codec change) , a stale private XRES(s) is held unnecessarily in the previous pending ACK PSP context. The SBC is unable to terminate the call smoothly.

Steps to Replicate: 

  1. Run the call flow with the initial call being a 2 DSP transcode call with AMRWB-AMRWB codecs.
  2. Send multiple re-INVITES from the endpoint to change the codec to AMR and AMRWB and so on.
  3. The output of the callResDetailStatus shows a hung private XRES(s).
  4. After receiving a BYE message from the  end point, a call termination takes an unreasonably long time.

The code is modified to address a two DSP transcode call. The private XRES(s) is freed appropriately and the call is terminated smoothly when a BYE message is received from the endpoint.

Workaround: None.

SBX-118283 | SBX-1192482

Portfix SBX-118283: Azure : Observed Availability set gets created when parameter "create_availability_set_for_sbcs" =false

Impact: Availability Set being created when associated flags are set to "false".

Root Cause: Incomplete Azure terraform scripts allowing Availability Sets to be created.

Steps to Replicate: Re-run terraform in the SBC HFE 2.2 setup to ensure Availability Set being created or not created as per the setting of the appropriate flags.

The code is modified to add new Availability Set modules in terraform to support creating or not creating them correctly based on the Availability Set flags.

Workaround: None.

SBX-117097 | SBX-1185652

PortFix SBX-117097: A DTLS SRTP call fails after the remote peer modifies the session - the SBC fails to process the incoming DTLS Client Hello.

Impact: The DTLS SRTP call fails after remote peer modified session.

Root Cause: The DTLS SRTP task maintains two contexts, one for client and one for server. They are being passed in when the SBC initiates/re-initiates the session. In this case, the SBC was initiating server session. But in DTLS SRTP session reinitiate function, we passed in client context instead that caused call failure. Also when reinitiating the session, the remote RTP address was not saved in CCB.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to:

  1. Use the proper context when starting a server or client session.
  2. Save remote RTP address in the CCB.

Workaround: None.

SBX-117911 | SBX-1191632

PortFix SBX-117911: A call between Cisco EP and PSTN failed as the SBC is sending incorrect attribute value for Video port 0.

Impact: The SBC sends a=sendrecv instead of a=inactive when video stream is received with port 0.

Root Cause: When changes were made to support additional video parameters in 9.2.x release, the datapath mode WSA set to default(a=sendrecv) when video stream was marked as absent. This was causing the SBC to send a=sendrecv.

Steps to Replicate: 

  1. Initiating call from Cisco phone to PSTN endpoint and PSTN sends back 180 Ringing.
  2. The SBC added SDP in the 180 Ringing for LRBT and sent back to CUCM Cisco phone.
  3. Ensure SBC added audio m line with valid IP and port, and for Video added port Zero with a=inactive.
  4. Answering the call from PSTN phone.
  5. Now ensure that POLYCOM phone is in CONNECTED state after answering call.
  6. Media Validation for Call between PSTN user and Cisco User on Cisco Phone.

The code is modified to inactive when video stream is marked as absent when port 0 is received.

Workaround: None.

SBX-118662 | SBX-1192562

PortFix SBX-118662: The LSWU failed due to Action Command Timeout

Impact: The LSWU failed from V10.01.01R3 to V10.01.02A3
admin@EMERALD> request system serverAdmin GARNET startSoftwareUpgrade <sbc package>

This command will start a live software upgrade. Do you want to proceed [no,yes] yes
Error: Action Command Timeout.

Root Cause: The issue is with media codec related packet size validations in appPreChecks during the LSWU was taking longer time.

Steps to Replicate: Run the following command: % request system serverAdmin GARNET startSoftwareUpgrade package <sbc package name>

The code is modified to address the issue.

Workaround: None.

SBX-117235 | SBX-1191652

PortFix SBX-117235: An additional UPDATE is being triggered by the SBC when the server side sends 18x with Valid Video Port.

Impact: In a delayed tone play scenario, the SBC is sending an additional UPDATE when egress EP sends 18x with valid audio and video ports

Root Cause: The SBC completed an initial offer-answer in INV and 18x with valid Audio and Video ports.

Later, due to delayed tone play logic, the SBC started playing the tone. As part of this tone play activation, the SBC is trying to switch OFF the video stream by triggering an UPDATE with video port as zero. The 200 OK (for UPDATE) is causing the SBC to abort the tone which is not supposed to happen.

Steps to Replicate: 

  1. UAC sends INVITE with Audio and Video.
  2. UAS sends 183 with Audio and Video
  3. The SBC starts playing tone due to delayed ring back tone configuration.
  4. The SBC triggers an UPDATE with video port as zero towards ingress EP.
  5. A 200 OK (for UPDATE) response makes the SBC abort the tone.

The code is modified so that the SBC does not stop the tone play upon receiving a 200 OK (for UPDATE) response from the ingress EP.

Workaround: None.

SBX-116974 | SBX-1181002

PortFix SBX-116974: S-SBC is unable to send the 200 OK for 2nd re-INVITE during the 4:1 redundancy with 2 RGs

Impact: S-SBC is not sending 200 O.K for RE-INVITE in 4:1 redundancy setup leading to call time-out from remote peer and subsequent call failure.

Root Cause: S-SBC is not able to locate the remoteGCID for the call in the DFE module.

Steps to Replicate:

  1. Configure the setup to transparent precondition interworking + transcode scenario.
  2. Send an initial INVITE with precondition attributes from UAC.
  3. Now preconditions met. Now, call is with AMR-WB to AMR transcode scenario.
  4. From UAS, send the 183 without SDP.
  5. From UAS, send the UPDATE message, change the codec from AMR to AMR-WB.
  6. Now, AMR-WB and AMR-WB transcoding call got established.
  7. From UAS, send the 183 without SDP.
  8. From UAS, send the UPDATE message , by changing the codec from AMR-WB to AMR.
  9. Now, AMR-WB and AMR transcoding call established.
  10. From UAS, send the 180 without SDP.
  11. From UAS, send the UPDATE message, by changing the codec from AMR to AMR-WB.
  12. 200 OK of INVITE without SDP sent from UAS. Call got established.
  13. From UAS, change the codec from AMRWB to AMR with Re-INVITE.
  14. Now the call is established with AMR-WB and AMR transcoding call.
  15. From UAS, change the codec from AMR to AMRWB with Re-INVITE.
  16. Now the call is established with AMR-WB and AMR-WB transcoding call.
  17. Send the BYE from UAC.

The code is modified so that the DFE module of the S-SBC retains the RemoteGCID unless the call is not unstable. Prior to the fix, the Remote GCID was internally deleted by DFE in the DFE Sync message

Workaround: None.

SBX-118155 | SBX-1182602

PortFix SBX-118155: The S-SBC is unable to send the UPDATE towards the UAS endpoint for 183 dialog-3 during EGRESS precondition interworking scenario.

Impact: The S-SBC is unable to send the UPDATE towards the UAS endpoint for 183 dialog-3.

Root Cause: When ingress was not supporting UPDATE, the SBC was trying to send out and stuck in this state.

Steps to Replicate: 

  1. Send the initial INVITE message without precondition attributes.
  2. The SBC sends the INVITE to UAS with precondition attributes.
  3. Send a 183 dialog-1 from UAS with precondition attributes.
  4. Before preconditions met for 183 dialog-1 , Send the 183 dialog-2
  5. Once preconditions met for 183 dialog-1, Send the 183 dialog-3 after the 183 dialog-2 (retransmission)
  6. Now, the SBC process the 183 dialog-2 and send it UAC.
  7. Before completing the preconditions for 183 dialog-2, send the 183 dialog-3 again from UAS (retransmission).
  8. After preconditions met for 183 dialog-2, the SBC should dequeue the 183 dialog-3 and process it.
  9. The SBC should generate UPDATE message for 183 dialog-3 and send to UAS.

The code is modified to locally answer the UPDATE when ingress peer does not allow UPDATE

Workaround: None

SBX-113553 | SBX-1178352

Portfix SBX-113553: Interworking between a 100 REL compliant UAS and a non 100 REL UAC. 

Impact: Interworking between a 100 REL compliant UAS and a non 100 REL UAC

Root Cause: The UAC is not 100 REL compliant and the SBC cannot forward the UPDATE to the UAC. It fakes a local answer 200 OK for this UPDATE with all the supported codecs of the UAC. This makes the SBC pick a pass through codec which is different from the codec already communicated to the UAC. An audio issue results until the call gets connected.

Steps to Replicate:

  1. The UAC doesn't have a 100 REL support and UAS support 100 REL. Enable SendSingleCodecinAns for both the legs
  2. The UAC sends an INVITE with the G729, AMR, AMRWB and PCMA to the SBC.
  3. The SBC sends INVITE with G729 AMR, AMRWB and PCMA to the UAS.
  4. The UAS sends 18x G729 and PCMA to the SBC.
  5. The SBC sends 18x G729 to the SBC.
  6. The UAS sends an UPDATE PCMA to the SBC.
  7. The SBC sends a 200 OK Update message with the PCMA.
  8. The call is transcoded from G729 to the PCMA.

The code is modified so that the SBC fakes the local answer 200 OK (for UPDATE here) with the last negotiated codec which is already communicated to the peer. The codec selection remains the same even after the offer-answer completion during an UPDATE-200 OK handshake and there will not be any audio mismatch.

Workaround: None.

SBX-116062 | SBX-1195132

PortFix SBX-116062: SIPREC - Recorded streams cannot be decrypted successfully after call hold/unhold when the SIPREC server prefers a different SRTP crypto suite than the SBC

Impact: With SRTP is enabled for SIPREC: in the scenario mentioned below, SRTP Keys towards SIPREC Servers is corrupted and SIPREC server fails to decrypt the recorded audio stream.

  1. The SBC offers more than one crypto suite towards SIPREC Server in the initial INVITE.
  2. The SBC receives answer with the crypto suite other than the first preference.
  3. The main call/CS call goes on hold/unhold.
  4. The SBC sends a Re-INVITE towards the SRS with corrupted crypto key values and SIPREC server fails to decrypt the streams.

Root Cause: When the SBC receives the answer from SIPREC server with the crypto suite other than the first preference from the offer, the SBC Recorder control block would be updated with the key as received in the answer. However, the crypto suite continued to reflect the offer's top most crypto, thus resulting in corrupted key in further offers towards SRS.
The crypto suite from the answer was supposed to be updated in the recorder control block along with the answer key and maintain the correct pair of key and suite values.

Steps to Replicate: 

  1. Configure the crypto suite profile with more than one crypto entry, attach it to the srsGroupProfile and enable SRTP.
  2. Put the main call on/off hold and simulate the SIPREC server to send different crypto preference form the offer.
  3. Make sure that the SBC is not sending corrupted key values in the Re-INVITEs towards SIPREC server.

The code is modified so that when the SBC receives an answer with crypto suite other than 1st preference form the offer, it updates the negotiated crypto in the control block.
When the CS call is put on hold/unhold, the SBC sends a re-INVITE towards the SRS with negotiated crypto key values.

Workaround: None.

SBX-118329 | SBX-1191742

PortFix SBX-118329: A call between CUCM EP and PSTN failed as the SBC is adding additional codecs that are not configured during 18x LRBT play.

Impact: The SBC sending all codecs received in the initial INVITE, in the 18x LRBT play.

Root Cause: The root cause for this issue is, when TFT and Audio Transparency is enabled, the SBC uses the codec in NSD, during tone play rather from PSP.

As part of multi-audio and other bug fixes, the NSD generation for tone Play changed, which is causing this issue.

Steps to Replicate: 

  1. Configure the SBC for A-B call with Tone.
    Enable transcoderFressTransparency and seectiveSdpRelay flag.
  2. Send multiple codecs in INVITE from UAC.
  3. The SBC should send an INVITE out and should receive 18x from UAS.
  4. The SBC should play tone with whatever codec that is configured in the PSP.

The code is modified so when the TFT and Audio Transparency is enabled, the SBC uses the older way to generate the codecs.

Workaround: None.

SBX-116123 | SBX-1191762

PortFix SBX-116123: The value set against GPU flag in /opt/sonus/conf/swe/capacityEstimates/.activeCallMixInput.json file is not an integer value" error message in DBG

Impact: On Managed N:1 MRFP node, when a custom CPU profile is applied, from OAM, by specifying the value against the useGPUForTranscoding field to false, following critical level message is logged in the .DBG file: 

" The value set against GPU flag in /opt/sonus/conf/swe/capacityEstimates/.activeCallMixInput.json file is not an integer value. "

This log does not indicate any issue with the the functionality of the profile activation.

Root Cause: On N:1 Managed MRFP node, the CDB gives the value against the filed useGPUForTranscoding as False(string), rather than 0(integer).

Application takes the value for the corresponding field as 0 by default, but a critical error message is logged in .DBG log.

Note: For the useGPUForTranscoding field value set to True, the corresponding logic was already in place, no issues in this scenario.

Steps to Replicate: For reproducing the issue on Managed N:1 MRFP, activate a traffic profile with useGPUForTranscoding value set to false, from the OAM, as shown below:

%set system sweTrafficProfiles VzW_callmix_profile useGPUForTranscoding false
%commit

% request system admin vsbcSystem saveAndActivate rebootSBCs true
%commit

All the N:1 MRFP nodes will go for a reboot and once the application comes up, observe the following logs in latest DBG logs:

" The value set against GPU flag in /opt/sonus/conf/swe/capacityEstimates/.activeCallMixInput.json file is not an integer value. "

The code is modified to address the issue.

Workaround: None.

Note: The log does not indicate an error in the functionality of profile activation.

SBX-116698 | SBX-1175092

PortFix SBX-116698: The SBC is sending out an Error-Info header in a 400 Bad Request even when the suppressErrorInfoHdr flag is enabled.

Impact: The SBC is sending out an Error-Info header in a 400 Bad Request even when the suppressErrorInfoHdr flag is enabled.

Root Cause: After the SBC restarts, the suppressErrorInfoHdr flag value is not updated correctly.

Steps to Replicate:

  1. Enable the suppressErrorInfoHdr flag:
    --set global signaling sipSigControls suppressErrorInfoHdr enabled
  2. Restart the SBC.
  3. Send a Malformed INVITE from the UAC.
  4. The SBC sends a 400 bad request in response to the malformed INVITE when the Error-Info header is eliminated.

The suppressErrorInfoHdr Flag value is updated properly after a restart.

Workaround: None.

SBX-119428 | SBX-1203902

PortFix SBX-119428: Frame Lost indication not set for AMRNB.

Impact: The frame lost flag is not being set based on talkState for AMRNB decoder.

Root Cause: When there is no frame to be fed to the AMRNB decoder, an indication of either 'frame loss' or 'no data' should be provided to the decoder. This indication should be determined based on the decoder's talk state. Currently, the 'no data' indication is set even if there is a frame loss, which is incorrect.

Steps to Replicate: 

  1. Run a AMRNB to G711 call.
  2. Stream a media with packet loss on the AMRNB leg.
  3. Capture the media on the G711 leg.
    The media quality should be good which can be validated using PESQ analysis.

The code is modified to allow the frame loss flag to be set based on the decoder's talk state.

Workaround: None.

SBX-120625 | SBX-1206672

PortFix SBX-120625: SRTP one-way audio - SBC not resetting SRTP encryption ROC to zero when ssrcRandomizeForSrtp is enabled

Impact: One-way audio on SRTP calls; the far end is unable to decrypt SRTP packets due to ROC mismatch.

Root Cause: Once the SBC received re-INVITE on the egress call leg, BRM issued RID modify command to NP on ingress call leg to update SSRC in RID.

In the RID modify command, the clear last SSRC flag was not initialized properly which caused NP NOT to clear the ROC.

Steps to Replicate: ssrcRandomizeForSRTP Enabled/ passthru:

  • Long call scenario (25 min) with SRTP, switchover.
  • Long call scenario (25 min) with SRTP, re-invites.

ssrcRandomizeForSRTP Enabled/ transcode:

  • Long call scenario (25 min) with SRTP, switchover.
  • Long call scenario (25 min) with SRTP, re-invites.

ssrcRandomizeForSRTP disabled/ passthru:

  • Long call scenario (25 min) with SRTP, switchover.
  • Long call scenario (25 min) with SRTP, re-invites.

ssrcRandomizeForSRTP disabled/ transcode:

  • Long call scenario (25 min) with SRTP, switchover.
  • Long call scenario (25 min) with SRTP, re-invites.

The code is modified so that the NP RID enable and modify interface functions ignore the clear last SSRC flag - keeping ROC reset in sync with clear last SSRC.

Workaround: Disable ssrcRandomizeForSRTP.

SBX-119426 | SBX-1205912

PortFix SBX-11942: Frame Lost indicator not set for AMRWB & V 1.4 Library Upgrade

Impact: 

  1. Frame lost flag is not being set based on talkState in AMRWB decoder
  2. Divide by zero issue in AMRWB energy computation which can lead to a crash

Root Cause: 

  1. When there is no frame to be fed to the AMRWB decoder, an indication of either 'frame loss' of 'no data' should be provided to the decoder. This indication should be determined based on decoder's talk state. Currently, 'no data' indication is set even if there is a frame loss, which is incorrect.
  2. The denominator is a sum of two energy values, both of which were expected to be positive. However one of the energy values turned out to be negative. The negative energy value is attributed to incorrect handling of overflow when computing the energy value. The incorrect handling of the overflow makes a large positive number appear to be a negative value.

Steps to Replicate:

  1. Run a AMRWB to G711 call.
  2. Stream a media with packet loss on the AMRWB leg
  3. Capture the media on the G711 leg. The media quality should be good which can be validated using PESQ analysis.

The code is modified so that the frame loss flag is set based on the decoder's talk state. As well, the divide by zero issue is addressed in the AMRWB library upgrade.

Workaround: None.

Resolved Issues in 09.02.04R004 Release

The following issue is resolved in this release:

Issue IDSevProblem DescriptionResolution
SBX-1202641

The SCM Process continually cores on two SBC 7000s - possibly PCV IOI related.

Impact: The SCM Process coredumped due to NULL pointer access for a (GSX) ISUP-GW-GW-SIP call after enabling Generate or Replace PCV feature.

Root Cause: The code was trying to read a CPC parameter from the ingress side of the call and the parameter is NULL when the ingress side is ISUP.

Steps to Replicate: 

  1. Set up a GW-GW call from GSX using ISUP as ingress
  2. Enable Signaling > Generate or Replace PCV

Expected result: The SCM Process cores.

The code is modified to ensure the CPC parameter is not NULL before accessing it.

Workaround: Disable Signaling > Generate or Replace PCV and apply the fix.

SBX-1201281

SBC 5400 switchovers occur after an upgrade to v09.02.04R003.

Impact: The SCM process may core while attempting to set the original peer SDP address when either NAPT for Media is enabled and the SDP is received, or if ICE is enabled and ICE is in the SDP.

Root Cause: In the above two scenarios, the software did not protect against using a NULL packet SG control block address.

Steps to Replicate: The steps are not reproducible.

The code is modified to prevent the NULL packet SG control block address from causing the SCM process to coredump.

Workaround: None.

SBX-118999 | SBX-1197741

PortFix SBX-118999: After an SBC 9.2.3 SW upgrade, the ACLs are blocking traffic when enabled.

Impact: The IPACL rule is incorrectly installed in the NP.

Root Cause: You can configure the IPACL rules with or without an ipInterface. If an IPACL rule is configured with an ipInterface, it is not installed in the NP until the associated ipInterface is created and enabled in the NP. The IPACL task tries to re-add those rules that are waiting on the ipInterface for it to receive a 'port up' notification from the NRS.

When mixing a set of IPACL rules, some rules that are not defined with the ipInterface are installed in the NP during the startup of the applications, while other rules that are defined with the ipInterface may get delayed while waiting for the associated ipInterfaces to become ready. All of the IPACL rules are ordered by precedence in the CPS context and will be programed in the NP in the same order.

When the IPACL task tries to re-add the rules that are waiting on ipInterface, the order of the rules is changed. The new rules are inserted at the proper location in the CPS context, based on their precedence. But there is no corresponding shuffling at the NP layer which causes some newly-added rules to randomly overwrite some existing rules.

Steps to Replicate:

  1. Configure the following three IPACL rules:
    rule 1: Define the LIF and the ipInterfaceGroup that contains this LIF, and assign the smallest precedence value among three rules.
    rule 2: Use the same ipInterfaceGroup as rule1, protocol = ICMP, assign precedence value > rule1, do not define as ipInterface.
    rule 3: Same as rule 2, except assign the precedence value > rule2.
  2. Take the LIF OOS and disable.
  3. Restart the application.
  4. Enable and in-service LIF.
  5. Ping the next hop address through pkt port of the LIF.
  6. Check the stats using the following command:
    "show table addressContext ADDR_CONTEXT_1 ipAccessControlList ipAclRulesByPrecedence"

This should result in rule 3 showing match counts instead of rule 2.

The code is modified to add all the rules in the NP, including the ones already added on the IPACL retry.

Workaround: None.

SBX-118335 | SBX-118880 2

PortFix SBX-118335: SBC 5400 redundancy switchover: "NP 0 error counter macError" messages received, mgt0 static route missing, and rx_errors are increasing

Impact: Customer upgraded the SBC 5400 from 7.2.x to 9.2.3R4 and the management ports went from 100Mbps to 1Gbps due to feature located in the SBC 8.0.0 release. On some occasions, the management port become inaccessible and CRC errors are reported in the port statistics [ethtool -S mgt0].

Root Cause: The problem is specific to the SBC 5400.

When the NRS (Network Resource Service) thread issues an interface stop, followed immediately by an interface start request for all management (mgt) ports, resulting in the following behavior:

  • When a port stop request is received, the mgt port driver puts the PHY in "super-isolate" mode where the receive and transmit (rx/tx) are stopped. This causes the remote link to go down.
  • When a port start request is received, the mgt port driver takes the PHY out of "super-isolate" mode and the rx/tx are started. This results in the remote link to go up.

However, if the rx/tx are stopped and started in a short time (< 10 milliseconds), the remote link ignores the notification and does not renegotiate the clock/speed/duplex. This leads to the data becoming out of sync with the remote end, which causes CRC errors on the packets received.

Steps to Replicate: Run the sbxrestart multiple times. When the SBC application is running, issue "ethtool -S mgt0" and ensure rx_crc_errors is still 0.

The code is modified to power down the PHY to a low power state when the port stop request is received. Thus, when the port start request is issued, the PHY is powered up to a normal power state. This forces the remote end to detect a link down and then a link up.

Workaround: If rx_crc_errors is increasing, disable and enable the mgt port.

Use the following Linux commands:

ifconfig mgt0 down

ifconfig mgt0 up

(Replace mgt0 with the mgt port name where rx_crc_errors is increasing.)

SBX-117475 | SBX-1192701

PortFix SBX-117475: Event log type SYS is filling up in less than 3 hours with SYS errors.

Impact: Event log type SYS is filling up in less than 3 hours with SYS errors

Root Cause: The root cause cannot be found.

Steps to Replicate: Run the call as it is and check if a MAJOR level log is getting printed instead of SYS errors.

The code is modified so the SYS errors add the Max number of association as a MAJOR level Debug log in ccCallGroupMgr.c and an EventNotify in ccHndl.c to track the call that is causing the issue.

Workaround: Add the maximum number of association as a MAJOR level Debug log in ccCallGroupMgr.c and an EventNotify in ccHndl.c .

Resolved Issues in 09.02.04R003 Release

Severity 1 Resolved Issues

The following Severity 1 issues are resolved in this release:

Issue IDSevProblem DescriptionResolution
SBX-1163401

Customer reported DNS failures on 3 different occasions and it appears to be related to "time to live" and negative cache functionality.

Impact: DNS records (requests) can become stuck in RESOLVING state within the Agent, which causes the FQDN to become unreachable forever.

Root Cause: A DNS request (or it's response), sent between the Agent (e.g., ScmProcess) and the Client (DNS Process), becomes lost. This causes the DNS record to become stuck in RESOLVING state, and the FQDN to become unreachable.

Steps to Replicate: The steps cannot be reproduced.

The code is modified so the DNS record defaults to 60 seconds when the DNS request is sent by the Agent to Client. In the error case, delete the DNS record when the timer expires in order to recover. In the working case,
reset the expiration time to the TTL received in the DNS data.

Workaround: The workaround is to manually clear the DNS cache or manually query the "stuck" FQDN.

SBX-1173931

An SCM Process coredumps and causes a switchover.

Impact: SCM Process cores when attempting to allocate memory.

Root Cause: An SCM Process cores when attempting to allocate memory because the memory management code detects memory corruption.
The memory corruption occurs because the code writes into a memory block after it is freed. This appears to occur when the SRS gets blacklisted during a setup and the call needs to route advance to the next SRS.

Steps to Replicate: The root cause is found by code inspection and can note be reproduced.

The code is modified to prevent writing into the memory block after it is freed.

Workaround: None

SBX-1191061

The SBC application restarts.

Impact: A SAM process encounters a core due to a Healthcheck timeout when the SIPCM attempts to open a TLS connection. The security certificate named in the tlsProfile is expired.

Root Cause: Two threads are hung while attempting to write a security certificate update () to the DB using the same socket. The purpose of the update is to change the state of the certificate to EXPIRED.

Steps to Replicate: 

  1. Run a TLS load that will attempt to use an expired PKI security certificate (tlsProfile includes the name of the security certificate).
  2. Look for the following messages in the DBG logs:

100000B.DBG:076 05262022 000010.545176:1.02.00.18170.MAJOR .SEC: *Certificate expired

The code is modified to add a lock preventing two threads from writing to the DB using the same socket.

Workaround: Renew PKI Security Certificates before they expire.

SBX-1191111

The SBC encountered a coredump and switched over when processing a transferred call.

Impact: The SCM cores in the SIP code processing a SIP REFER message.

Root Cause: The SCM process cored when attempting to dereference a NULL pointer after processing a message related to the SIP refer/relay.

Steps to Replicate: The root cause is found by code inspection and the steps cannot be reproduced.

The code is modified to ensure that the pointer is valid before attempting to dereference it.

Workaround: Disable the SIP Refer Relay.

SBX-1188221

The HA SBC fails to start on version 09.02.04R001 when the Direct IO Passthrough is used.

Impact: The SBC application fails to start on a 44 vCPU instance.

Root Cause: The maximum number of vCPUs supported is set to 40 in the SM module. This leads to corruption and a subsequent core-dump on instances with a size greater than 40 vCPUs.

Steps to Replicate: 

  1. Install the SBC application on an instance with a vCPU size greater than 40.
  2. Make sure the application starts and there are no core dumps observed.

The code is modified and now set to be in sync with other modules.

Workaround: None

SBX-1184731

The SBC resets SRTP encryption sequence number after a re-INVITE; the anti-replay protection at the far end (on another SBC) discards the incoming SRTP packets until the sequence number approaches the highest recorded sequence number.

Impact: Intermittent one-way audio with a duration of more than 10 seconds may occur during call transfers when the remote connection media IP address changed on the secure RTP (SRTP) call leg. The RTP sequence number (SSN) of the outgoing SRTP stream encrypted by the SBC may roll back to a lower value that causes the SRTP packets being discarded by SRTP anti-replay protection at the receiver's end. Once the SSN of the SRTP stream reached the highest recorded value, the audio was back and both parties could hear each other.

Root Cause: After the call transfer, the remote connection media IP address on the SRTP call leg was modified without deactivating the media resource chain. This caused the delay in applying the security configuration to the media resource chain, which in turn caused the first one of several SRTP packets being sent with a high SSN number and the roll back of the SSN to a lower value. The remote end discarded the SRTP packets with a lower SSN than the highest recorded SSN.

Steps to Replicate: 

  1. Make a SRTP-to-RTP call between A and B through the SBC under test.
  2. A puts B on hold and calls C through a different SBC/device.
  3. A bridges B and C together and uses a late-media re-INVITE towards B to modify the original connection media IP address with the C's media IP address.
  4. The SBC sends a re-INVITE with a SDP offer to B.
  5. Once the SBC receives a 200 OK with a SDP answer from B, it starts sending the SRTP packets to C's connection media IP address.
  6. The first SRTP packet sent to C has a SSN of around 1000 and the second SRTP packet has a SSN of less than 256. C discards all received SRTP packets until the SSN reaches the highest recorded SSN, which is 1000.

The code is modified so in a modify offer or answer for a SRTP call, if the remote connection media IP address is modified on the SRTP call leg, the new IP and security configuration are applied at the same time, without a delay.

Workaround: None.

Severity 2-4 Resolved Issues

The following Severity 2-4 issues are resolved in this release:

Issue IDSevProblem DescriptionResolution

SBX-117506

2

The SCM Process was leaking a resource related to a NRMA sessPtr.

Impact: The SCM process may leak memory in some early call failure scenarios.

Root Cause: In early call failure scenarios, a different function is called to free the Call Block (and the memory linked off of it) than the function that frees the Call Block in successful call scenario.

The function that is called in some early call failure scenario was not freeing all of the memory that had been allocated for the call.

Steps to Replicate: The steps cannot be reproduced.

The code is modified so that all the memory that is allocated for a call is freed in all early call failure scenarios.

Workaround: None.

SBX-117901 | SBX-1192753

PortFix SBX-117901: Log is incorrect when using regex to filter value to be stored.

Impact: After storing an SMM rule for a value to a variable, the wrong value is being logged.

Root Cause: Logging the wrong data.

Steps to Replicate: Configure the SMM rule to store a value to a variable and look for the debug log message:
"SipsMmUtilStoreValue ..."

The code is modified so the data log is stored to a variable correctly.

Workaround: Ignore the logging message.

SBX-1192882

PortFix SBX-117546: The SBC is adding phone-context=private for a globalized number in the RURI and To Header.

Impact: The SBC adds phone-context=private in the RURI for a globalized number when it is modified using a DM rule.

Root Cause: Using a DM rule to add '+' in called number does not result in number being treated as globalized.

Steps to Replicate: Configure the DM rule to add a '+' sign. Run SIP-SIP call. The SBC sends a INVITE with globalization in RURI and has phone-context=private.

Do not add phone-context=private in the RURI when the RURI is already in globalized format, including when the userpart of globalization number has a '+' sign.

Workaround: Disable DM rule or use SMM to delete the phone-context parameter.

SBX-1192242

Microsoft Azure reserves port 65330.

Impact: Some DNS queries fail to get a response in an Azure deployment. 

Root Cause: Microsoft does not allow VMs to use port 65330. The DNS queries are sent using this local port  and are dropped.

Steps to Replicate: Run DNS queries for a long period of time and check that port 65330 is not used.


The code is modified to mark port 65330 as reserved.

Workaround: The Linux configuration can be manually updated to reserve the port. 

  1. The following actions need to be run as root on the SBX.
    echo '5041,5043,65330' > /proc/sys/net/ipv4/ip_local_reserved_ports
  2. Edit the following line in /etc/sysctl.conf
    net.ipv4.ip_local_reserved_ports=5041,5043
    to append “,65330”
    net.ipv4.ip_local_reserved_ports=5041,5043,65330
  3. There is no need to reboot.
SBX-119054 | SBX-1169422

PortFix SBX-116942: D-SBX (M-SBX) - The XRM/NP CPUs are also being used by a system task causing slowness in media tasks.

Impact: In the SWe, a few sbxPerf processes (example: top2) run on the media cgroup causing congestion issues.

Root Cause: Segregation of media and non-media processes at initialization time may fail, leading to non-media processes landing on a VCPUS that is meant for media processing.

Steps to Replicate: Install a fix build in the SWe and check whether the sbxPerf process (example: top2, atop) runs on the core0.

The code is modified to move the sbxPerf processes to the system cgroup. The segregation of processes is fixed as part of a separate issue.

Workaround: Reboot the SBC.

SBX-119157 | SBX-1183533

PortFix SBX-118353: An inccorrect DSP insertion/rejection reason can be seen recorded in the ACT record in the case of an incomplete offer/answer.

Impact: An inccorrect DSP insertion/rejection reason is the result of an incomplete offer/answer. 

Root Cause:

Example:

  1. A T38 is present in the Leg A and Leg B in the PSP.
  2. The egress peer rejects the offer.
  3. A 4xx message attempt record is updated with the DSP reject reason as "Call Rejected Unlicensed."

In the problem scenario where the T.38 is enabled as transcodable codec during an initial offer/answer, the SBC is not able to find the heaviest transcodable codec. The setting for the dspRejectionReason is "Rejected codec unlicensed".

Steps to Replicate: 

  1. Setup a basic SIP-SIP call configuration using the PSX.
  2. Enable the T.38 and G711 u in Leg A and Leg B in the PSP .
  3. Check the CDR and verify the DSP Rejection Reason.

The code is modified to update the dspRejectionReason to "Rejected codec unlicensed" for only the cases where the license is unavailable .

Workaround: None

SBX-119048 | SBX-1181803

PortFix SBX-118180: A duplicate MIME-Version header is added on a SIP over Core call.

Impact: A duplicate MIME-version header is added by the SBC when an incoming INVITE already has the MIIME-version header.

Root Cause: When the SBC encounters MIME content it adds the MIME-version by default. When an unknown header transparency is enabled at the egress IPSP and the incoming message has a MIME version header, it is transparently passed to the egress. This results in A duplicate MIME-version header at the egress side.

Steps to Replicate: 

  1. Setup a basic SIP-SIP call.
  2. Send an INVITE message having the MIME content and MIME-version header.
  3. Enable a PIDF transparency at the ingress IPSP.
  4. Enable the PIDF and an unknown header transparency at the egress IPSP.
  5. Verify if a duplicate MIME-version header is present inthe  egress INVITE.
    This can be tested without sending the MIME-version in the INVITE as well.

The code is modified to check for the MIME content and the MIME-version header.  If there is an unknown header transparency then it isn't added it to message. Only the MIME-version will be added by the SBC.

Workaround: None

SBX-119052 | SBX-1177992

PortFix SBX-117799: The SBC fails to recognize the Prack in a multi-dialog (different TO tags) if an 18X and 200(Inv) are received simultaneously.

Impact: For a dialog transparency and forked call, the SBC may reject the Prack request due to race condition of back to back 18x and 200 OK messages.

Root Cause: After receiving a 200 OK message, the SBC finalizes the active remote tag and queues up the send packet to the ingress due to a pending Prack. When the Prack is received, the SBC rejects it because the compare for the Prack comes from a different remote tag than the one already stored in the 200 OK message.

Steps to Replicate: 

  1. Configure the dialog transparency, forking, and E2E Prack to enable.
  2. Leg A calls Leg B.
  3. B1, B2 answer 18x
  4. B2 18x, B1 200 OK(no sdp) (back to back)

The code is modified to validate the remote tag based on the forking list not the final one.

Workaround: Disable the Prack.

SBX-118989 | SBX-1187642

PortFix SBX-118764: Cac calls are rejected with a 503 Service Unavailable message, instead of a 403.

Impact: Cac calls are rejected with a 503 Service Unavailable message instead of a 403.

Root Cause: The Sip Call Status is always overwritten with a 503 message.

Steps to Replicate: 

  1. Create a Cac profile.

    set profiles sipCacProfile SIPCAC1 state enabled;
    callLimit 1

  2. Attach the Cac profile to the ingress Sip Trunk group.

    addressContext default zone ZONE1 sipTrunkGroup PA_ZONE cac
    registeredEndpointCacProfile SIPCAC1;
    unRegisteredEndpointCacProfile SIPCAC1;

  3. Attach the egress peer to the Cac profile.

    set addressContext default zone ZONE2 ipPeer EGRESS_PEER sip cacProfile SIPCAC1;

  4. Test a basic Sip-Sip call (two calls) and verify that the second call fails with a 503 message.

    After the code changes for the fix, verify that the second call fails with a 403 message.

The code is modified so that the Sip Call Status has the correct error code.

Workaround: None

Resolved Issues in 09.02.04R002 Release

The following severity 1 issues are resolved in this release:

Issue IDSevProblem DescriptionResolution
SBX-118635 | SBX-1187051

PortFix SBX-118635: Observed the IpSockAddr (0.0.0.0) and Port (0) for Egress leg in GW1 and Ingress leg in GW2 for GW-GW HPC call scenario.

Impact: The IpSockAddr and Port fields are 0 in the global callDetailStatus status command in a GW-GW HPC call scenario.

Root Cause: In 9.2.4R001, the code is added to not send CPC_OP structures unknown to the GW-GW encoder layer over the GW-GW link to reduce the size of the GW-GW message sent to older SBCs and the GSX. However, it was found that at least one of these unknown CPC_OP Structures, CPC_OP_SIP_ZONE_AC_NAME_STR was used to transfer information used in the global callDetailStatus status command.

Steps to Replicate: 

  1. Set up two SBCs that communicate over the GW-GW.
  2. Place a GW-GW HPC call scenario call.
  3. Observe that the IpSockAddr and Port fields are not 0 after running the global callDetailStatus status command.

The code is modified to send the CPC_OP structures unknown to the GW-GW encoder layer over the GW-GW link.

Workaround: None.

SBX-1183671

Missing CDR sub fields from Column: Ingress Protocol Variant Specific Data.

Impact: Missing CDR sub fields from Column: Ingress Protocol Variant Specific Data.

Root Cause: The CDR fields were not updated in SipSgFillProtocolSpecData function from where CDR was getting populated.

Steps to Replicate: 

  1. Replicate the issue by running a basic SIP-to-SIP call and removing any mandatory header field.
  2. Check if all of the 86 sub fields are getting populated in CDR of 45th field (Ingress Protocol Variant Spec Data).

Updated SipSgFillProtocolSpecData function with the CDR field that were missing to address the issue.

Workaround: None.

SBX-1159111

Application restarted due to a processAbnormalTermination.

Impact: The SSReq process coredumped while receiving a message with length = 0.

Root Cause: While inputting message length =0, a third-party software Xalan crashes at allocating memory.

Steps to Replicate: Perform a SSReq request to the ERE when configured for the external PSX.

The code is modified to not process messages with length = 0.

Workaround: Stop the SSReq process.

SBX-114415 | SBX-1183691

PortFix SBX-114415: The SBC 7000 standby CE stopped functioning with file corruption and "read only" mode.

Impact: When the file system turned to Read Only mode the server did not go for reboot.

Root Cause: The SBC became stuck during the read only file system checking but the root cause cannot be determined.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to use different commands to check for read only status to try and ensure the SBC automatically reboots to recover.

Workaround: An operator needs to manually reboot the SBC in order to recover it.

SBX-115304 | SBX-1183721

PortFix SBX-115304: The SBC replies with a 481 message for INVITE with occasional replaces.

Impact: The SBC replies a 481 message for INVITE with occasional replaces.

Root Cause: In early dialogue, the state to-tag is not updated in the Hashtable but the from-tag is updated. This issue is why when we tried to look up using only the call ID. As a result, it fails to fetch original call as the original INVITE and the INVITE with replaces had the same call ID.

Steps to Replicate: 

  1. Prepare a SIP-to-SIP call setup with INVITE with replaces from the client side having the same call ID for original INVITE and INVITE with replaces.
  2. Check if the INVITE with replaces is replacing the original call and if the lookup is successful or not.

The code is modified to look up both the call ID and from-tag for the ingress leg.

Workaround: None.

SBX-1184251

The SBC as a TLS server fails a TLS handshake attempt if an ECDHE cipher is used and the TLS client specifies an elliptic curve other than secp256r1 (prime256v1).

Impact: The SBC as a TLS server fails a TLS handshake attempt if an ECDHE cipher is used and the TLS client specifies an elliptic curve name other than secp256r1 (prime256v1).

Root Cause: The SBC uses the default elliptic curve name secp256r1 (prime256v1) when acting as a TLS server.

Steps to Replicate: Use an "openssl s_client" to trigger TLS handshake with ECDHE ciphers with curve names secp384r1 and secp521r1.

  1. The following commands assume the SBC's SIP-TLS address/port number is 10.x.yy.zz:5061.
    $ openssl s_client -showcerts -connect 10.x.yy.zz:5061 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' -curves secp384r1 | egrep "i:\s:"
    $ openssl s_client -showcerts -connect 10.x.yy.zz:5061 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' -curves secp521r1 | egrep "i:\s:"
  2. A failed case shows the the SBC TLS server fails to find matching cipher suite and curve name.
    $ openssl s_client -showcerts -connect 10.x.yy.zz:5061 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' -curves secp384r1 | egrep "i:\s:"
    140485529323328:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40
    ...
  3. The Packet capture will not show Server Hello Message.
  4. A successful case displays the SBC TLS server's certificate chain after TLS server properly selects cipher suite and curve name.
    $ openssl s_client -showcerts -connect 10.x.yy.zz:5061 -cipher 'ECDHE-RSA-AES128-GCM-SHA256' -curves secp521r1 | egrep "i:\s:"
    depth=2 C = US, O = Sonus, OU = SonusProductPKI, CN = SonusProductRootCA
    ...

The packet capture will show Server Hello after SBC TLS server selects the matching cipher suite and curve name.

The code is modified so the SBC TLS server selects the Elliptic curve name automatically.

Workaround: Do not specify curve name, or use curve name prime256v1 (openssl 1.0's default on TLS server) when using a tls_ecdhe* cipher suite.

SBX-1187311

A PES Process core occurred while configuring the npaNxx.

Impact: A PES Process coredump could occur while bulk provisioning npaNxx, LocalCallingArea or Tollfree table using API.

Root Cause: Postgres tried to clear memory of a NULL pointer.

Steps to Replicate: Bulk provision the system using API.

The code is modified to not attempt to call PGclear() with a NULL pointer.

Workaround: None.

SBX-1176371

The ScmProcess generates a core and a switchover occurs due to null pointer in a forked call.

Impact: The SCM is coring when trying to free memory that has already been freed.

Root Cause: The Scm process cores when trying to free memory because of a non-reproducible edge case scenario which causes the memory to be freed before returning from a subroutine. The calling function doesn't handle this correctly.

NOTE: This scenario only happens if a downstreamForkingSupport is enabled on the SIP Trunk Group.

Steps to Replicate: The steps cannot be reproduced. 


The code is modified to prevent the scenario.

Workaround:  None.

SBX-119425 | SBX-1187771

Portfix SBX-118473: SRTP one-way audio. SBC resets

Impact: TBD

Root Cause: TBD

Steps to Replicate: TBD


Workaround: 

The following severity 2-3 issues are resolved in this release:

Issue IDSevProblem DescriptionResolution

SBX-117319 | SBX-118777

3

Portfix SBX-117319: IMS AKA issues.

Impact: When the egress request is timed out, the SBC timeout handling failed when IMS AKA security is enabled. Due to this issue, the SBC is unable to release the call immediately.

Root Cause: When IMS AKA security is enabled, once the egress request is timed out, some parameters are not set in internally generated timeout message. Due this issue, the SIPSTACK layer ignored the timeout message.

Steps to Replicate: 

  1. Enable all required configuration along with IMS AKA configuration.
  2. Make end-to-end call. Do not answer from egress endpoint.

The request is timed out and the call should clear immediately.

The code is modified to set the required IMS AKA security params for timeout message.

Workaround: None.

SBX-1170972

A DTLS SRTP call fails after the remote peer modifies the session - the SBC fails to process the incoming DTLS Client Hello.

Impact: The DTLS SRTP call fails after remote peer modified session.

Root Cause: The DTLS SRTP task maintains two contexts, one for client and one for server. They are being passed in when the SBC initiates/re-initiates the session. In this case, the SBC was initiating server session. But in DTLS SRTP session reinitiate function, we passed in client context instead that caused call failure. Also when reinitiating the session, the remote RTP address was not saved in CCB.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to:

  1. Use the proper context when starting a server or client session.
  2. Save remote RTP address in the CCB.

Workaround: None.

SBX-117280 | SBX-1176532

PortFix SBX-117280 to 8.2.5R007: Apache Axis security issues

Impact: The following vulnerabilities related to Apache 1.2 were identified with in the Ribbon SBC application:

Issue 1: The LI uses unsupported Apache Axis 1.2 (2005) on JBoss 5.1 (2009).

Issue 2: The LI exposes the Apache Axis AdminServlet without authentication (default for Axis 1.2).

Issue 3: The LI runs as the sonusadmin user, a privileged account.

Root Cause: The LI uses unsupported Apache Axis 1.2 (2005), exposes the Apache Axis AdminServlet without authentication and runs as the sonusadmin user, a privileged account.

Steps to Replicate: 

  1. Access the url https://{SBC hostname}/liTargetProvisioning/services/AdminService from the browser.
    1. Result: An Axis error "No service is available at this URL" is displayed.
  2. Access the url https://{SBChostname}/liTargetProvisioning/services/AdminService?wsdl from the browser.
    1. Result: An Axis error "Could not generate WSDL! There is no SOAP service at this location" is displayed.

The Apache Axis cannot be upgraded to version 1.4 for issue 1 due to the following:

The Axis 1.2 has 3 vulnerabilities CVE-2018-8032, CVE-2014-3596 and CVE-2012-5784 and the SBC application is not impacted by any of these.

Axis 1.4 has four vulnerabilities (3 from version 1.2 plus 1 new) out of which CVE-2019-0227 (this is the new one in version 1.4) could impact the SBC application.

As a result, for issue 1 no fix is required.

For issue 2 and 3, the code is modified to remove the AdminService.

Workaround: None.

SBX-115853 | SBX-1188292

PortFix SBX-115853: The SBC sent an UPDATE with payload (128 101) that caused calling party to fail the call.

Impact: This is a SIP-GW1-GW2-SIP call. The issue is GW1 sends an UPDATE to client for codec G.729 but Payload Type as 128.

Root Cause: UPDATE is sent by GW1 to ingress because at ingress, there was Tone & Announcement profile configured and playing the Tone triggered by an UPDATE.

An UPDATE was sent to client with G729 as G729 was the first codec offered by Server in it's UPDATE message, as the Honor Remote Precedence flag was enabled in Ingress GW's PSP. The G729 PT is updated with wrong value of 128 instead of 18 in the NRMA code. The selected codec's rx PT was assigned with tx PT that contained invalid PT.

Steps to Replicate: 

  1. Set up a SIP-GW-GW-SIP call.
  2. Set up Tone and Announcement in Ingress GW TG.
  3. Set Honor Remote Precedence flag enabled in Ingress TG PSP.
  4. Sent an UPDATE from server with a codec other than G711 and a codec which is different from previously negotiated codec.
  5. An UPDATE should be sent to client with correct PT.

The code is modified with a valid PT value.

Workaround: Set the Honor Remote Precedence flag disabled.

SBX-1183733

There was an Active SBC 7000 DNS Process core.

Impact: The DNS Process on the active CE on a system switchover may coredump.

Root Cause: A NULL DNS TCB (transaction control block) was encountered while the Active CE was shutting down (during restart).

Steps to Replicate: The steps cannot be reproduced.

The code is modified to guard against using a NULL DNS TCB.

Workaround: None.

SBX-118281 | SBX-118051

2

PortFix SBX-118051: The DTLS client Hello was being ignored.

Impact: The SBC may ignore DTLS Client Hello message and cause no audio in STUN/ICE/DTLS calls when the endpoint performs STUN checks for two candidates and the two checks overlap.

Root Cause: The SBC is storing remote IP/port in the nominated candidate list, even if BREQ/BREQ_UC messages are already sent.

Then when resending the BREQ message, the SBC uses the remote IP/port from the stored nominated candidate array and that is causing confusion.

Steps to Replicate: Establish a STUN/ICE/DTLS call and have the endpoint initiate STUN connection checks with two candidates. The STUN checks should overlap in the following manner:

  • A Binding Request from candidate 1 (C1) received at the SBC, the SBC replies with a Binding Success Response to C1 and initiates a Binding Request to C1.
  • A Binding Request from candidate 2 (C2) received at the SBC, the SBC overwrites the stored candidate with C2, sends a Binding Success Response to C2 and initiates a Binding Request to C2.
  • The SBC receives a Binding Success Response from C2 and sends a new Binding Request with the USE-CANDIDATE attribute to C2.
  • At this moment, the SBC receives a Binding Success Response from C1.

The code is modified to:

  1. Avoid updating the nominated candidate list if we already sent out BREQ or BREQ_UC.
  2. Not to send BREQ during the window where the SBC has switched from sending BREQ to BREQ_UC.
  3. Wait for timer to be fired before resending BREQ.

Workaround: None.

SBX-119050 | SBX-1181453

PortFix SBX-118145: The "EMA - System Administration - File Upload" does not allow a .pfx certificate file to be uploaded.

Impact: The EMA does not support the uploading of a certificate file with a .pfx extension.

Root Cause: There is no requirement to allow a file to be uploaded with a .pfx extension, hence the support for the same is not available.

Steps to Replicate: 

  1. Login to the EMA.
  2. Navigate to the File Upload screen.
  3. Select a file with a .pfx extension.
  4. Upload the file.

The code is modified to allow a file with a .pfx extension to be uploaded.

Workaround: The file has to be manually copied to the SBC through the SSH.

Resolved Issues in 09.02.04R001 Release

The following Severity 1 issues are resolved in this release:

Severity 1 Resolved Issues

Issue ID

Sev

Problem Description

Resolution

SBX-1181181

Both of the SBC units went down after an unregister from the EMS.

Impact: Both of the SBC units went down after an unregister from the EMS

Root Cause: The code in the ENM process notifies the deletion of the SnmpAgent snmpTargetMib snmpTargetAddrTable snmpTargetAddrEntry. The ENM process code spawns a thread to delete the corresponding trap from the oam snmp trapTarget table that shares a CDB socket with the SonusSnmpTrapTarget::ProcSubDelete.

Steps to Replicate: 

  1. Register an SBC instance with an EMS.
  2. Unregister the same SBC instance with the EMS.
  3. Observe that the ENM process does not crash.

The SonusSnmpTrapTarget::DeleteTrapTargetThread routine is modified to use its own CDB socket to prevent contention from two threads for the same socket.

Workaround: None

SBX-118076 | SBX-1159371

PortFix SBX-115937- The SBC switches over due to a deadlock issue.

Impact: The CPX process deadlocks when the customer is making several calls to get the authPassword, while calling the CpxTrunkGroupMediaIpSecondaryInterfaceGroupNameValidate to validate the SecondaryInterfaceGroupName. 

For example:
show table addressContext <context> zone <zone> sipTrunkGroup <trunkgroup> signaling authentication authPassword

Root Cause: 

  1. The authPassword fetches calls several times a second.
  2. The call occurs at the same time that the CpxTrunkGroupMediaIpSecondaryInterfaceGroupNameValidate is called.
  3. Both routines use the same global maapiSocket for maapi calls to read the confd database.
  4. Since the same global socket is used, the maapi_exists call is hung.

Steps to Replicate: 

  1. In one CLI session, make several calls to get the authPassword.
  2. show table addressContext <context> zone <zone> sipTrunkGroup <trunkgroup> signaling authentication authPassword
  3. In another CLI session, do a
    set addressContext <context> zone <zone> sipTrunkGroup <trunk group> media mediaIpSecondaryInterfaceGroupName <groupname>
  4. Observe that the CPX does not crash.

The code is modified to perform a cdb get to obtain the authPassword. 

Workaround: Do not call for the authPassword while setting the mediaIpSecondaryInterfaceGroupName.

SBX-118082 | SBX-1180491

PortFix SBX-118049 - The SRTP decryption and encryption fail after an upgrade to 9.2.4R0/10.1.0R2.

Impact: The SBC fails to decrypt the incoming SRTP packets, causing a static noise instead of audio on the SRTP calls. 

Root Cause: Since 9.2.0x, one flag is used in the XRM. XRM_SRTP_SESS_UNENCRYPTED is used for both the unencrypted SRTP and unencrypted SRTCP. When this flag is set, the XRM sends cipherType = NP_CIPHER_TYPE_sRTP_NULL to the NP. The SBC does not to decrypt the incoming SRTP packets.

Steps to Replicate: 

  1. Enable the UNENCRYPTED_SRTCP in the cryptoSuiteProfile.
  2. Enable the INFO level DBG logging and make calls.
  3. Check the DBG log for NpMediaRidEnable and NpMediaFlowEnable messages
  4. Ensure that:
    • RTCP = cipher/size 0x8000000/0x40000
    • RTP = cipher/size 0x6000000/0x40000

A new flag is added, for unencrypted SRTCP: XRM_SRTCP_SESS_UNENCRYPTED

The modified NRMA and XRM adopt the new flag for SRTCP.

Workaround: Disable the UNENCRYPTED_SRTCP in the cryptoSuiteProfile

SBX-118074 | SBX-1152131

PortFix SBX-115213 - Node B unexpectedly restarts when Node A is in SyncInProgress for a long time.

Impact: The Call/Registration Data on the SBC shows syncInProgress for an extended period of time.

Root Cause: A redundancy message buffer is not large enough to hold the data and causes the sync to be incomplete. This results in the Call/Registration Data to remain in a syncInProgress state.

Steps to Replicate: Run multiple Registration/Calls on the SBC.

The code is modified to address the issue. 

Workaround: None

SBX-118089 | SBX-1174351

PortFix SBX-117435 - Running a sysdump on the SBC 5400 triggers a packet port down/up condition.

Impact: A port link failure occurs while running a sysdump on the SBC 5400. This may cause an SBC switchover.

Root Cause: 

  1. Enhancements made to collect more Network Processor (NP) memory area, introduced in a previous fix in 9.2.3R4, causes interference to the interface driver reading the port link status.
  2. The interference causes the driver to falsely report a link down.
  3. The link status is obtained from the NP processor's (Octeon) register.

Steps to Replicate: 

When the mgt/pkt interfaces are in a link up state in the SBC, run an np_mem_dump.pl.

Sample command line to run 100x:

[root@xxxxx np]# x=1; while [ $x -le 100 ]; do echo $x; date; ./np_mem_dump.pl /var/log/sonus/np/npMem0_d$x.log >& npdump.log ; date; $(( x++ )); done

Note: This command creates npMem0_d[1..100].log files and will fill up the disk.

The code is modified to access the Octeon register through the driver instead of directly accessing the register. This avoids a concurrent access of the register.

Workaround: 

Do not run a sysdump or /opt/sonus/bin/np/np_mem_dump.pl while  the SBC is running.

You can obtain an updated /opt/sonus/bin/np/oct-remote-memory and /opt/sonus/bin/np/oct-remote-csr binary to avoid the link bounce while running a sysdump.

SBX-113233 | SBX-1175781

PortFix SBX-113233 - Getting bulk alarms of "sonusSbxNodeResourcesNoPacketsReceivedNotification"

Impact: The patch includes additional stats from SWe_NP which can help in triaging false reporting of RTP inactivity issues better. In addition to this, the patch also includes fixes to prevent false reporting of RTP inactivity when policer mode is set to “Bypass” (SBX-110362), and preventing false RTP inactivity reporting in “call hold and unhold scenario” (SBX-112867).

Root Cause: Not yet RCAed.

Steps to Replicate: Issue was not locally reproducible.

The code is modified to add additional NP stats to help in triaging false reporting of RTP inactivity, and also backported some known false detection fixes (SBX-110362, SBX-112867).

Workaround: None.

SBX-118331 | SBX-1192501

Portfix SBX-118331 - EMS re-Synchronization feature not working fine with SBC7K

Impact: EMS trap resync logic does not work for standard SNMP traps e.g linkUp, linkDown.

Root Cause: The EMA was not aware of the mapping from the standard OID traps to trap name and as a result it was unable to resync trap information to EMS.

Steps to Replicate: 

  1. Bring down mgt1 interface on the SBX side, critical alarm raised on SBX and same has been reached to EMS
    ip l set mgt1 down
  2. Teardown the connectivity between EMS and the SBC by creating the static route at the SBX side (no trap will be reached to EMS).
  3. Bring the mgt1 interface up on the SBX side. (Clear trap generated on the SBC but not reached to EMS because link between EMS and the SBC is down so which is expected).
  4. Bring the connectivity between EMS and the SBC up (trap re-sync should work and EMS should clear the critical alarm raised on Step 1).

The code is modified so that the EMA now understands the OID values for the standard SNMP traps and can resync the info to the EMS.

Workaround: None.

SBX-114533 | SBX-1191721

Portfix SBX-114533 - CPX not handling the notification correctly from SDR

Impact: SNMP traps destinations set by FQDN are not resolved correctly to IP.

Root Cause: ConfD CDB API return inconsistent data when reading from CDB_RUNNING.

Steps to Replicate:

  1. Deploy the SBC.
  2. Add DNS records for SNMP trap target.
  3. Configure DNS nameserver in the SBC.
  4. Configure SNMP trap target fqdn.
  5. Validate that the SBC resolves the fqdn and add the corresponding IP address and port.

The code is modified to ensure that the Management Agent API (MAAPI) is now being used to read the SNMP trap target information instead of the CDB API.

Workaround: Restart the SBC.

SBX-116895 | SBX-1186141

PortFix SBX-116895 - SBCSWE switchover occurred because of EnmP core

Impact: The EnmProcess crashed when an accounting file rolled over.

Root Cause: If the fileCount for the accounting files is reduced substantially ( ex. 2048 to 1024), and a rollover occurs, then a shell script is run for each file that needs to be deleted to reduce the file count to the new configured file count. This shell script deletes any hash files in the eventLogValidation directory associated with the deleted accounting file.

Steps to Replicate: 

  1. Set the fileCount for accounting files to 2048.
  2. Enable eventLogValidation for account files.
  3. Rollover the log repeated to created 2028 accounting files.
  4. Set the fileCount for accounting files to 32.
  5. Rollover the account log.
  6. Make sure the SBX has not crashed.

The code is modified to ensure that instead of calling a shell script to delete the hash files, the EvmFileDeleteLogfiles routine gets a list of all the hash files of accounting files in the eventLogValidation, and deletes the associated hash file when an accounting file is deleted. This reduces the time to delete ~2000 files to less than a second.

Workaround: Do not reduce that fileCount for the accounting log files more than 300 files at a time. Rollover the accounting file each time the count is reduced.

The following Severity 2-4 issues are resolved in this release:

Severity 2-4 Resolved Issues

Issue ID

Sev

Problem Description

Resolution

SBX-118336 | SBX-1181193

PortFix SBX-118119: Do not send CPC_OP_TYPE_NRMA_SESSION_DESCRIPTION to old GSX/SBC.

Impact: A large parameter called CPC_OP_TYPE_NRMA_SESSION_DESCRIPTION is not used on the GSX and not used in any SBC prior to 9.1 and could potentially cause a PDU to be sent over a GW link to be too large.

Root Cause: In GW Connection Manager (GWCM), information is obtained for the farend if the oldGsxSupport control flag is enabled and if the CPC_OP_TYPE_BUFFER_SIZE parameter from the peer is present. 

Steps to Replicate: Send calls over GW-GW link with lots of optional parameters to induce call drops due to buffer overrun.

The code is modified to check if the oldGsxSupport flag is enabled and the ulPeerBuflen is still set to the smaller GSX size, so the CPC_OP_TYPE_NRMA_SESSION_DESCRIPTION parameter is marked as to notsend when desired.

Workaround: None.

SBX-118077 | SBX-1168202

PortFix SBX-116820: The LDG goes down and triggers ARS - IP ACL.

Impact: The XRM debug command failed to dump static discard ACL stats.

Root Cause: The existing logic only dumps maximum 100 entries of each allocated ACL list. If a user has more than 100 allocated ACL list in admit TCAM ACL list, then the entry 101 to 200 is dumped for next category of ACL list, and so on.

Steps to Replicate: 

  1. Configure a set of SIP sigPorts.
  2. Unhide debug command.
  3. Issue a command "request sbx xrm debug command acl\ -stat", or "request sbx xrm debug command acl\ -cfg\ 50"

The code is modified to:

  1. Return the count of allocated ACL list.
  2. Specify number of entries to display, which is limited to <= 100. If user does not specify the number of entries, then we will default to 100.
  3. Display allocated ACL rules of each category, either from the beginning of the list, or continue from last entry of previous request.
  4. Have the user repeat the request multiple times to reach the end of the list. 

The change applies to both ACL config and stats.

Workaround: configure less than 10 signaling ports.

SBX-118131 | SBX-1173022

PortFix SBX-117302: The PRS Process and the SM Process is crashing.

ImpactThe PRS process was crashing while processing an MRSP message due to the first header line not being present.

"MSRP 0100543f85f SEND\r\n"
"To-Path: msrp://17000000000.example.com:10000/%s;tcp\r\n"
"From-Path: msrp://12.1.1.71:37001/1789102;tcp\r\n"
"Message-ID: 016f28000567\r\n"
"Byte-Range: 1-25/25\r\n"
"Success-Report: yes\r\n"
"Failure-Report: no\r\n"
"Content-Type: text/plain\r\n"


"Caller sent this message.\r\n"
"-------0100543f85f$\r\n"

Root Cause: The code is always assuming that the header line will be present and is missing some defensive checks, which resulted in the code reading from a null pointer.

Steps to Replicate: Send in an MSRP message with the header line missing.

The code is modified to defend against this unexpected scenario and not to coredump.

Workaround: None.

SBX-1179002

The Azure-SWe SLB Reboot due to SAM process coredump, possibly memory corruption.

Impact: This is a SamProcess core caused by memory corruption.

Root Cause: This is a memory corruption issue caused by using memcpy to copy data into a buffer that was not large enough. ThE memcpy is in code related to the SIP Load Balancer (SLB) function.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to verify the buffer size before doing the memcpy.

Workaround: None.

SBX-118101 | SBX-1177362

PortFix SBX-117736: A GW message parameter is having sending issues.

Impact: Calls that arrive at the SBC with m=text SDP content and are routed to a GSX through a GW-GW can be released with a disconnection reason CPC_DISC_GW_GW_MSG_PDU_TOO_LONG_FOR_PEER(0xD6) due to the GW-GW message being too large for the GSX to handle.

Root Cause: The SBC was sending parameters to the GSX that the GSX could not use and this was making the GW-GW PDU message larger than the GSX could process.

Steps to Replicate: Make a call with m=audio and m=text in the SDP of the INVITE and try to route over GW-GW to a GSX. Check that the call is successful.

The following control should be enabled:
set global signaling oldGsxSupport enabled

The code is modified to delete certain parameters that are not required on the GSX to reduce the GW-GW PDU size and avoid calls being released when the PDU is too big.

Workaround: Use SMM to delete m=text SDP content coming into the SBC that is potentially routed over GW-GW to a GSX.

SBX-118104 | SBX-1159942

PortFix SBX-115994: Configuring the last trunk as incoming/outgoing direction wise is causing the SBC to remove DTG info on receipt of 3xx

Impact: Configuring last trunk as incoming/outgoing direction wise is causing the SBC to remove DTG info on receipt of 3xx

Root Cause: During a TRM lookup for DTG information in TrmProcessIpLookupCmd() in case TRM_IP_LOOKUP_EGRESS_TYPE_DTGNAME_ONLY, the SBC iterates through all the Contact headers and saves DTG information (such as TG name, blocking status and Trunk Type ) in CPC_OP_TRM_IP_TRUNKGROUP_LOOKUP_DATA_STR *entry.

The same CPC structure is used in SipSgFillDestTgrpToCpcMsgInfo() to copy DTG information of all TGs in CPC_MSG. This DTG information is then used to route the call where TRM lookup is done through DTG name.

But in the TrmProcessIpLookupCmd(), TG blocking status "status" and TRM_IPTG_CB_STR *ipTgCbPtr of last Contact header is used to send TRM reply. Since, the DTG of Last Contact is blocked, the TRM reply fails and causes the DTG to lose information.

Steps to Replicate: 

  1. Make SIP-SIP call configuration using the PSX.
  2. At Egress zone, in addition with Egress TG, create three more TGs.
  3. On the SBC, configure the "ingressIpPrefix" of all three TGs (TG1, TG2, TG3) with different server IPs address (IP1, IP2, IP3).
  4. Send 3xx with three Contact headers.
  5. Configure same ingressIpPrefix address in Contact Headers of 3xx message so that the first Contact header is set to IP1, the second Contact Header is set to IP2 and the third Contact Header is set to IP3.
  6. Set "blockDirection" of TG3 to outgoing.
  7. On PSX, Enable "Force Re-query for Redirection" flag in IPSP of Egress Trunkgroup.
    For example:
    Contact: <sip:14135;tgrp=<trunk_group>;trunk-context=meta1001-1002.<domain_name>@IP1>;q=1
    Contact: <sip:14135;tgrp=<trunk_group>;trunk-context=10.xxx.yyy.zz@IP2>;q=0.9
    Contact: <sip:14135;tgrp=<trunk_group>;trunk-context=meta3001-3002.<domain_name>@IP3>;q=0.8
  8. Make an SIP-SIP call, send 3xx from Egress peer with these 3 Contact headers.
  9. The SBC sends INVITE to first Contact header through TG1.
  10. If the first Contact is not reachable, the SBC tries with the second Contact using TG2 and so on.
  11. Verify that after receipt of 3xx with multiple contact headers, the TRM debugs are logged in DBG with trunk group names of all 3 Contact headers and there is no TRM failure message.

Two new local variables TRM_IPTG_CB_STR *ipTgCbPtrTemp and UCHAR statusTemp are created in caseTRM_IP_LOOKUP_EGRESS_TYPE_DTGNAME_ONLY.

After each iteration, when the status is != FOUND_BLOCKING, these new local variables are populated and then used in TrmIpSendLookupRpyNfy() for TRM reply.

Then while the loop has to iterate for each contact header, the user must populate CPC_OP_TRM_IP_TRUNKGROUP_LOOKUP_DATA_STR.

Because we are passing good values of status and ipTgCbPtr in TrmIpSendLookupRpyNfy(), the TRM reply does not fail.

Workaround: None.

SBX-118075 | SBX-1148182

PortFix SBX-114818: A 18x/200 Contact header sent by the SBC contains port number different than 5061.

Impact: The SBC includes an incorrect port number in the Contact header of the outgoing SIP messages towards registered endpoints when the endpoints use TLS as a transport protocol and a Call Data Channel (CDC; a lawful intercept component) is enabled on the SBC. This behavior results in call failures since the endpoints send SIP requests to unused TCP port numbers. As an example, the SBC includes port numbers 5062, 5063 and other while the configured port number is 5061 (and the SBC listens on that port number).

Root Cause: The Lawful Intercept related piece of SW changes the port numbers in the SIG port table that should be configured to the SIG port.

Steps to Replicate: To reproduce the problem, create a basic SIP access scenario where an endpoint registers over TLS (REGISTER – 401 – REGISTER – 200). Then, as calea user, provision the following (the assumption is that you already created an IP interface group named LIG with at least 1 IP interface in it):

set addressContext default intercept nodeNumber 10001
comm
set addressContext default intercept callDataChannel LigCDC interceptStandard etsi ipInterfaceGroupName LIG
set addressContext default intercept callDataChannel LigCDC mediaIpInterfaceGroupName LIG
comm
set addressContext default intercept callDataChannel LigCDC vendorId utimaco
set addressContext default intercept callDataChannel LigCDC dsrProtocolVersion 1
comm
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp ipAddress 10.xxx.yy.zzz
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp portNumber 37502
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp dscpValue 16
comm
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp mode inService
set addressContext default intercept callDataChannel LigCDC mediationServer dfxa media udp state ena
comm
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling ipAddress 10.xxx.yy.zzz
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling portNumber 38154
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling dscpValue 16
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling protocolType tcp
comm
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling mode inService
set addressContext default intercept callDataChannel LigCDC mediationServer imsa signaling state ena
commit

Once the CDC is configured, register the endpoint. The symptoms of the issue is that SBC includes an incorrect port number (5062, 5063 and similar) in the Contact header of all messages sent to the endpoint. The user does not need to make calls though; the presence of port number 5061 in the event, which is printed after the SBC received the REGISTER with an Auth header is a sufficient proof that the issue is present:

195 03022022 092259.154049:1.01.07.12989.Info .SIPSG: sipsgCallProcCommonUtils.c (-6170) 3777. SipSgSelectTransportAndSigPort: Selected address 10.xxx.yy.zz:5060 for Sig port:1107 AddrType 1
195 03022022 092259.284953:1.01.07.14012.Info .SIPSG: sipsgCallProcCommonUtils.c (-6170) 4022. SipSgSelectTransportAndSigPort: Selected address 10.xxx.yy.zz:5061 for Sig port:1107 AddrType 1

The code is modified so that the configured SIG port table is not changed.

Workaround: This problem happens only when the CDC is configured and a SIP endpoint uses TLS as a transport protocol. If one of the conditions is not met, the problem will not happen.

SBX-118050 2

The TERM IOI value has not returned in 18x/200 OK to the caller as expected in the IPX PCV header management.

Impact: Part of a feature introduced in the SBC Core 9.2.3 release contained these requirements:

Customer network

  1. All messages toward the customer MUST be sent with a PCV header and use provisioned ioi values.
  2. ioi in the PCV header will be the customer's assigned value for the PARTNER generating it.
  3. When messages from PARTNER have a PCV with ioi, the ioi needs to be overwritten with the customer assigned PARTNER value.
  4. Messages from the SBC may have a PCV but without ioi params in it.

Partner network

  1. PCV may/may not be received from PARTNER with/without ioi params
  2. PCV is not sent toward PARTNER in most cases but some PARTNER networks may want this in the future
  3. So, this needs to be configurable and where applicable, provisioned ioi values used in the PCV in messages to the PARTNER
  4. However in testing, when the far end is not set to sendPCV, the 18x/200 OK back to the Ingress trunk does not get sent the Term-IOI value, only the Orig-IOI in the 18x/200 OK. However, on the 200 OK from the BYE there is both Term/Orig IOI.

Ingress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.Toledo.iqntipx;
termIOI term.Toledo.iqntipx;
sendPCVHeader enabled;

Both SIPCORE TGs.
generateOrReplacePCV {
state disabled;
sendPCVHeader enabled;

Egress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.cust.iqntipx;
termIOI term.cust.iqntipx;
sendPCVHeader disabled;


A Call Flow Partner Peer PARTNER TG on the SBC TG on the SBC peer
4 <------- INVITE w/o PCV -------
-------- 18x w/o PCV ---------> <------------ INV w/o PCV ----------
---- 18x w [PCV w prov term-ioi] -→

Root Cause: The following configuration must be enabled:

Ingress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.Toledo.iqntipx;
termIOI term.Toledo.iqntipx;
sendPCVHeader enabled;

Both SIPCORE TGs.
generateOrReplacePCV {
state disabled;
sendPCVHeader enabled;

Egress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.cust.iqntipx;
termIOI term.cust.iqntipx;
sendPCVHeader disabled;

The issue is noticed for the following call flow:

Call Flow Partner Peer PARTNER TG on the SBC TG on the SBC peer
4 <------- INVITE w/o PCV -------
-------- 18x w/o PCV ---------> <------------ INV w/o PCV ----------
---- 18x w [PCV w prov term-ioi] -→

Steps to Replicate: The issue can be replicated by configuring the following:

Ingress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.Toledo.iqntipx;
termIOI term.Toledo.iqntipx;
sendPCVHeader enabled;

Both SIPCORE TGs.
generateOrReplacePCV {
state disabled;
sendPCVHeader enabled;

Egress TG:
generateOrReplacePCV {
state enabled;
origIOI orig.cust.iqntipx;
termIOI term.cust.iqntipx;
sendPCVHeader disabled;

The issue is noticed for the following call flow:

A Call Flow Partner Peer PARTNER TG on the SBC TG on the SBC peer
4 <------- INVITE w/o PCV -------
-------- 18x w/o PCV ---------> <------------ INV w/o PCV ----------
---- 18x w [PCV w prov term-ioi] --->

The code is modified so when the generateOrReplacePCV functionality is enabled, carry forward the data like the original ioi, icid, etc. in the call block. This is used while processing 18x/200 OK and appropriately adds Term-IOI if configured and when sendPCVHeader is enabled.

Workaround: Enable sendPCVHeader on both trunk groups.

Resolved Issues in 09.02.04R000 Release

The following Severity 1 issues are resolved in this release:

Severity 1 Resolved Issues


Issue IDSevProblem DescriptionResolution
1SBX-1165681

The SBC is sending 183 with precondition mandating without SDP.

Impact: Observed call failures when the SBC sends a precondition option tag in 183 Session Progress message when there is no SDP.

Root Cause: During precondition interworking, the SBC attempts to add precondition option tag in Require/Supported header even if there is no SDP in the outgoing 18x response.

Steps to Replicate: 

  1. Simulate ingress precondition interworking scenario with preconditions set to supported under trunk group configurations.
  2. Send mandatory preconditions in the SDP.
  3. Send multiple 18x towards ingress and do not send SDP in subsequent 18x messages.
  4. The second 18x message without SDP may contain Require preconditions.

The code is modified to clear the precondition option tag (if any) in Required/Supported header when there is no SDP in 18x.

Workaround: Remove the precondition option tag using SMM in the outgoing 18x message if there is no SDP.

2SBX-114048 | SBX-114279


1

PORTFIX SBX-114048: The SBC Reports a service discovery error message.

Impact: The SBC reports a service discovery error when the service discovery is not being used.

Root Cause: The LCA sends an empty ConfigureBackends request to the SDR, causing an error.

Steps to Replicate: 

  1. Start the SBC.
  2. Review the LCA log.

Skip the configuration process if there is nothing to configure.

Workaround: None

3SBX-114771 | SBX-115767


1

Portfix SBX-114771: An SCM process core dump occurs on the server.

Impact: An SCM process core dump occurs as a result of a Segmentation Fault.

Root Cause: The SIPSG code creates a segmentation fault when sending a 200 OK in response to a REGISTER. The code is attempting to dereference an invalid pointer.

Steps to Replicate: Regression testing is all that is necessary. 

The code that causes the Segmentation Fault is removed.

Workaround: None

4SBX-112149 | SBX-115035


1

Portfix SBX-112149: The Comp_Emap Processes cored on the SBC.

Impact: In sensitive mode, an SCM Process core dumps when an Un-Hold UPDATE is received from the UAC during Tone Play.

Root Cause: When an Un-HOLD UPDATE code is received from the UAC, the SBC tries to activate end to end resources. There is no answer received from the UAS, causing a core dump.

Steps to Replicate: 

  1. The  UAC sends an INVITE to the SBC.
  2. The SBC sends an INVITE to the UAS.
  3. The UAS sends a 180 Ringing code without a SDP.
  4. The SBC starts playing a tone towards the UAC due to a delayed LRBT.
  5. The UAC sends an UPDATE for HOLD.
  6. The SBC stops playing the tone and sends a 200 OK for UPDATE code.
  7. The UAC sends an UPDATE for un-HOLD to the SBC.
  8. The SBC sends 200 OK for UPDATE code.

The code is modified to check whether an answer is received from the UAS before activating the end to end resources.

Workaround: This issue occurs when the SBC is running in sensitive mode. Configure the SBC in normal mode.

5SBX-112091 | SBX-115168


1

Portfix SBX-112091: The SBC is not passing an UPDATE to the Egress.

Impact: If the SBC receives two 180 responses with the same SDP (one unreliable and one reliable), then the SBC doesn't send an UPDATE to the Egress.

Root Cause: The SBC has received two 180 responses with the same SDP.  The first is unreliable and the second is reliable. If the SBC sends out an SDP using the unreliable 180, then the offer/answer state will not get updated upon receipt of the second 180.

Steps to Replicate: 

  1. Set sendSdpInSubsequent18x to disable.
  2. Set sendSdpInSubsequent18x to enable.
  3. Change the SDP in the first unreliable 180 and the second reliable 180.
  4. The SDP is queued.
  5. A 180 ringing code with current SDP is sent out to Ingress and an offeranswer is completed.
  6. The same SDP offeranswer in the first unreliable 180 and the second reliable 180 state is completed.

The code is modified to address the issue.

Workaround: None

6SBX-114012 | SBX-114298


1

Portfix SBX-114012: The SMM is not working when the From section contains an escape character.

Impact: The SMM may fail to parse a display name in a double quote string where the inside may have more than one escape character next to each other in a header.

Root Cause: A logical error in parsing that causes a parsing fail.

Steps to Replicate: 

  1. Configure the rule to access a double quote string display name of URI header, or any parameter.
  2. After it is input, display the name.
    Example:
    From: "PhoneLite \\\"test1\\\"test2 " <sip:[field0]@dns.com>;tag=testing

The code is modified to address the issue.

Workaround: There is no workaround.

7SBX-109056 | SBX-114339


1

Portfix SBX-109056: The SBC 5400 TEAMS CQ is having transfer issues.

Impact: When a call with DLRBT enabled undergoes more than one transfer with REFER signaling and the final transferee doesn't accept the call, the SBC does not correctly reconnect the call back to the transferor.

Root Cause: 

  1. During a Leg A to Leg B call, Leg B successfully REFERS the call to leg C.
  2. Leg C attempts to REFER the call to leg D (or back to leg B).
  3. The SBC plays a ringtone towards leg A while the REFER is taking place.
  4. When Leg D rejects the call with a 480 "Temporarily not available" the SBC software is not correctly disabling the call context that is playing the tone and not correctly re-enabling the Leg A to Leg C call association.

Steps to Replicate: 

  1. The DLRBT is configured on ingress and egress of the SBC.
  2. Establish a Leg A to Leg B call via the SBC.
  3. Send a REFER from Leg B Leg C and complete the refer related signaling. This results in a Leg A to Leg C call.
  4. Send a REFER from Leg C to Leg D.
  5. Do not answer the call at Leg D, but reject it with a 480 "Temporarily not available".
  6. Verify that the SBC stops playing a tone towards Leg A and re-establishes the Leg A to Leg C call again and media can correctly flow between  Leg A and Leg C.

The code is modified to address the issue.

Workaround: Not available

8SBX-114842 | SBX-115012


1

Portfix SBX-114842: There is a Microsoft Teams Shared Line/Hold issue.

Impact: The SBC fails to send an ACK after mix of replace and refer Invites (Microsoft Teams Shared line/hold feature).

Root Cause:  The SBC fails to release a tone announcement after receiving a 200 OK from the refer Invite.

Steps to Replicate: The steps can not be reproduced.

Properly release the tone resource.

Workaround: Disable the tone as an announcement.

9SBX-114426 | SBX-115189


1

Portfix SBX-114426: There is a standby SBC coredump CE_2N_Comp_SamP

Impact: Memory Corruption may occur in the SAM process if an IP Peer is deleted and then added back into a different zone.

Root Cause: The code responsible for adding a new configured IP Peer may write into freed memory.

Steps to Replicate: The root cause of this bug was found by code inspection. The problem could not be reproduced.

The code is modified to address the issue.

Workaround: None.

10SBX-113876 | SBX-115061



1

Portfix SBX-115061: Fraud Mitigation on the SBC requires a specific cause code response. 

Impact: The functionality works and a call is released with 480 Temporarily Unavailable. There is a regulatory requirement that a specific Cause Code should be released when a Fraud Call is blocked.

Root Cause: The ERE needs to have a new SEEDED script for call termination with results in the 607/608 status code being sent to the network.

Steps to Replicate: 

  1. Configure the call routing profile with new scripts and run a call.
  2. The ERE should send the script in policy response.
  3. The SBC should play the announcement .

Two new scripts are seeded:

  • RBBN_CALL_REJECT_217
  • RBBN_CALL_REJECT_ANN217

Workaround: None

11SBX-111620 | SBX-115025


1

Portfix SBX-111620: During a T140 call there is one-way stream with a zero media port (NAPT media).

Impact: A one-way stream is observed with a zero media port when the RTCP NAPT learning is complete before the RTP NAPT learning.

Root Cause: 
When the RTCP NAPT learning is completed before the RTP NAPT learning for the T.140 stream, the RTP port is set to 0 instead of 5004. 5004 is required for the RTP NAPT learning to continue.
As the remote RTP port is set to 0, instead of 5004 for the T.140 stream, the RTP NAPT learning is disabled, resulting in one way media for the stream.

Steps to Replicate: 

  1. Run a basic SIP to SIP call with multiple streams (Audio+T.140) and NAPT & RTCP enabled.
  2. Send the RTCP packets from the far end before the RTP packets to ensure that the RTCP NAPT learning happens prior to the RTP NAPT learning.

In a multiple stream scenario, when the RTP Port is 0, set it to loop back port 5004.

NOTE: The issue is observed only when the NAPT is enabled on both sides.

Workaround: 

  • Disable  the RTCP
    or
  • Ensure endpoint sends the RTP before the RTCP.
12SBX-115316 | SBX-115429



1

PortFix SBX-115316: The upgrade is related to marker files that are not being removed even after a successful upgrade on the public cloud.

Impact: On a public cloud like Azure and AWS, a couple of marker files are created to indicate that a model update is needed after an upgrade. These marker files should be removed once the upgrade is completed, but are not.

Root Cause: . If a system is being upgraded to 9.x or later releases while on public cloud platforms, these marker files will still exist and can cause the system to go through a model update on every SBC application restart.

Steps to Replicate: 

  1. Perform an upgrade.
  2. Logs will show the model update being done on every restart.

The marker files are deleted correctly after an upgrade.

Workaround: Contact TAC through a SFDC ticket to ask for the procedure. It is not a normal activity and will require Linux shell access.

13SBX-97435 | SBX-115056



1

Portfix SBX-97435: During an LRBT scenario, the SBC is not processing a sendrecv in a SIP re-Invite message causing a one-way audio.

Impact: A Gateway to Gateway call scenario with a local ring back, causes a one way audio issue.

Root Cause: As part of enabling the media end to end, the SBC initiates a Re-INV with an SDP attribute as sendonly for which the UAC responds with receonly. This causes the SBC to start a new modify offer-answer cycle towards the Egress GW. 

Steps to Replicate: 

  1. The UAC sends an INV to the UAS via GW1-GW2.
  2. The UAS sends a 180 Ringing.
  3. GW1 starts a tone play.
  4. The UAS sends a 200 OK with a sendonly.
  5. GW2 sends an ACK to UAS.
  6. GW1 sends a 200 OK for INV.
  7. The UAC sends an ACK.
  8. GW sends a Re-INV with a sendonly.
  9. The UAC sends a 200 OK with a recvonly.
  10. The UAS sends a Re-INV with a sendrecv.

The code is modified to address the issue.

Workaround: None

14SBX-115939 | SBX-116048



1

Portfix SBX-115939: The SBC uses an incorrect branch parameter from the last transaction.

Impact: The SBC retransmits an ACK for 200 OK with a different branch parameter from the  previous ACK.

Root Cause: Transactions occur before the retransmit ACK and overwrite the previous branch parameter transaction.

Steps to Replicate: 

  1. Leg A calls leg B.
  2. Leg B sends an ACK and reInvite.
  3. The ACK drops the peer response 491 for reInvite.
  4. The  SBC sends an ACK for 491.
  5. The Peer sends a 200 OK from the initial Invite.
  6. The SBC sends an ACK.

Save the ACK branch parameter in a separate transaction to avoid being overwritten

Workaround: If a reInvite is due to a media lock down, then disable the media lock down, or use a reliable transport.

15

SBX-114393 | SBX-114801 | SBX-114802



1

Portfix SBX-114393: The TLS Session ID has all zeros on the new 9.2.2R3 code.

Impact: The TLS Session IDs are not printed in the TLS Session Status command output.

Root Cause: The code is removed in the latest releases.

Steps to Replicate: 

  1. Execute the TLS Session Status command with active TLS calls on the SBC.
  2. Session IDs will be printed with a zero instead of the valid Session IDs.

The code is added to print Session IDs in TLS Session Status command output.

Workaround: None

16SBX-113065 | SBX-115040



1

Portfix SBX-113065: A Critical alarm is showing as Urgent under the "EMA > Monitoring > Alarm > Current Alarm."

Impact: A Critical alarm is showing as Urgent under the "EMA > Monitoring > Alarm > Current Alarm."

Root Cause: The screen text of a critical alarm appears as Urgent instead of Critical.

Steps to Replicate: 

  1. Login to the EMA.  
  2. Navigate to Monitoring > Alarm > Current Alarm.
  3. Alarm Severity shows as  Urgent instead of Critical.

The code is modified to address the issue.

Workaround: None

17SBX-116166 | SBX-116580



1

Portfix SBX-116166: The SBC intermittently fails to handle a "Packet Too Big" event and sends an unfragmented packet to the gateway.

Impact: The IPv6 Path MTU Discovery does not work.

  • The SBC uses the MTU of the outgoing network interface as the Path MTU.
  • The SBC does not update IPv6 Path MTU properly even if a router in the path sends an "ICMPv6 Packet Too Big" message with a  smaller Path MTU value. The large IPv6 packets requiring fragmentation to fit the Path MTU from the SBC will not reach the SIP peer.

Root Cause: When performing an IPv6 route/fib lookup while updating the Path MTU from the "ICMPv6 Packet Too Big" message, it doesn't consider the ipInterfaceGroup and the  addressContext. This results in not updating the Path MTU with the proper route entry to the peer.

Steps to Replicate: 

  1. The SBC sends IPv6 packets of 1500 bytes toward the SIP peer when a path to the peer has a smaller MTU (e.g. 1280 bytes).
  2. A router with the smaller MTU sends an "ICMPv6 Packet Too Big" to the SBC.

The code is modified for handling "ICMPv6 Packet Too Big" messages by adding:

  • ipInterfaceGroup
    and
  • addressContext 


Workaround: Add subnet routes on packet interfaces to the peer.

18SBX-114981 | SBX-115572



1

Portfix SBX-114981: The Block Direction does not work when selecting a secondary trunk group with a SIP Parameter Based Action Profile.

Impact: The TG Block Direction feature is not applied on a newly selected Ingress TG. The new Ingress TG is selected by the SMM's storeIpTg or by using a sipParamBasedAction Profile.

Root Cause: The TG Block Direction feature is not applied on a newly selected Ingress TG due to a design issue.

Steps to Replicate: 

  1. Create a SMM profile to select new a Ingress TG using sipParamBasedActionProfile.
  2. Attach a SMM profile to the expected original ingress TG.
  3. Enable a block direction feature on the expected new ingress TG.
  4. Run a basic call, registration, or any non-invite scenario.
  5. Once the new ingress TG  is selected using sipParamBasedActionProfile, The SBC should reject the INVITE or non-INVITE message with a 503.

The code is modified to address the issue.

Workaround: None.

19SBX-115317 | SBX-115683



1

PortFix SBX-115317: Error 0x6 Line 2932 File /sonus/p4/ws/release/sbx5000_V08.02.05R004/marlin/SIPSG/sipsgLibUtils.c

Impact: The following command does not work correctly after a switchover:

set oam accounting admin eventAcctMethods [eventRegister | eventSubscribe | eventMessage | eventPublish | eventRefer | eventOptions ] [enable | disable]

Root Cause: The accounting functionality for Out of Dialog messages uses a specific hash table that does not exist on the new active after a switchover. This hash table is not created on a Standby because it is not needed. But, it should be created when the standby becomes active.

Steps to Replicate:

  1. Execute the following CLI command:
    set oam accounting admin eventAcctMethods eventOptions enable
  2. Send a SIP OPTIONs message.
  3. Options Ping get a 480 response.

The code is modified to create the necessary hash table after a switchover.

Workaround: Disable accounting for PUBLISH, MESSAGE, OPTIONS or NOTIFY using the command syntax below:

set oam accounting admin eventAcctMethods [eventRegister | eventSubscribe | eventMessage | eventPublish | eventRefer | eventOptions ] [enable | disable]

20SBX-113280 | SBX-114630



1

Portfix SBX-113280: An alarm is issued on the M-SBC. The M-SBC resets the VF after the user stops the Tshark.

Impact: The Tshark start/stop operations sporadically cause link failure events in theSWe.

Root Cause: A Link status of "link down" for DPDK API occurs if it finds the VF<>PF mailbox busy due to another activity In this case it is due to a multicast mac address programming that is triggered by the Tshark.

Steps to Replicate: 

  1. Bring up a SWe port redundancy setup.
  2. Configure the pkt0 and pkt1 interfaces with different VLAN's.
  3. Run a script for a long duration (2 -3 days) which would start/stop the  Tshark continuously on a tagged interface.
  4. Check that there is not a link down event reported.

The code is modified to address the issue.

Workaround: None.

21SBX-111908 | SBX-115254



1

PortFix SBX-111908: The Standby SBC has the same pkt0/pkt1 IPs as an Active SBC and is sending a response to the HFE.

Impact: In the Azure HFE, if a connection is created before implementing the routes for CUSTOM_ROUTE natvar, the HFE does not input the source IP correctly.

Root Cause: The connection tracking table in Linux caches the connection to go via the eth0 instead of what is set in the CUSTOM_ROUTE, which breaks the source NAT matching rules.

Steps to Replicate: 

  1. Create an HFE2.0 set up with private endpoint in a subnet different from any of the HFE interfaces.

  2. Set the CUSTOM_ROUTE natvar to route to this endpoint using eth1,e.g. 10.x.xx.x/xx_eth1.

  3. During the startup, ensure that traffic is occurring between the SBC PKT1 and the private endpoint during HFE startup.

The code is modified to address the issue. 

Workaround: After starting up the HFE, run 'sudo conntrack -F conntrack', to refresh the connection tracking rules. This will need to be done after every reboot.

22SBX-110574



1

The RURI is populated with an INTL CC of a calling number to the egress carrier.

Impact: The country code in the RURI username is populated incorrectly. The first route fails and a second route is selected after a number translation. The second route has the Undo LNP flag checked in its IP signaling profile.

Root Cause: When a second or subsequent route is used, some of the number translation information from the first route is applied.

Steps to Replicate: 

  1. The ingress SIP trunk has an enabled stiProfile assigned.
  2. Make a SIP-SIP call with a PSX query.
  3. The PSX does an LNP lookup to a SIP SCP which returns multiple routes.
  4. The second route has the "Undo LNP" flag checked on its IP signaling profile.
  5. When the SBC sends the INVITE on the first route, no response is received. This causes the second route to be selected.

The code is modified to address the issue.

Workaround: None.

23SBX-113238



1

The location of PAI CPC is not positioned consistently.

Impact: When a presentation is allowed, the SBC sends an egress INVITE with a PAI header. The PAI CPC is put between the username and hostname of a SIP URI. When a presentation is restricted, it is present after the hostname in the SIP URI.

Root Cause: When a presentation is restricted, the code is checking that the "Disable 2806 compliance" configuration is enabled. It populates a CPC parameter in the PAI after the SIP hostname.

Steps to Replicate: 

  1. Run a basic SBC and PSX configuration to allow SIP to SIP calls.
  2. On a PSX egress IP signaling profile, the following commands need to be enabled: 
    Egress IP Attributes > SIP Headers and Parameters > Flags > include CPC information
    Egress IP Attributes > SIP Headers and Parameters > CPC Mapping Flags > Map CPC when Presentation is Restricted
    Egress IP Attributes > SIP Headers and Parameters > CPC Mapping Flags > Send CPC Param In→PAI
    Egress IP Attributes > Flags > Disable 2806 compliance
    Egress IP Attributes > Flags > TTC ISUP Mapping
    Egress IP Attributes > Privacy > Privacy Information > P Assert Id
    Egress IP Attributes > Privacy >Flags > Include Privacy
  3. On the SBC ingress and egress TG’s, enable the cpcInterworkingForNNI, such as:
    set addressContext default zone ZONE2 sipTrunkGroup PCR5001_SBX_EXT signaling cpcInterworkingForNNI enabled
  4. Send a basic INVITE from peer A to SBX ingress TG.
  5. In addition to basic headers, the following should be included: 
    Privacy: id
    P-Asserted-Identity: "0363572050"<tel:+88888888888;cpc=ordinary>, "Anonymous"<sip:n363572050@username.xxxx.xx.xx>
  6. Verify that the SBC sends an INVITE to egress.
  7. The egress INVITE should include a PAI header with cpc=ordinary placed in the URI before the @<ip address>, such as: 
    P-Asserted-Identity: "Anonymous" <sip:363572050;cpc=ordinary@10.xx.x.xx:xxxx>, <tel:88888888888;cpc=ordinary>

The code is modified to address the issue.

Workaround: 

  • If "Disable 2806 compliance" is set to "disabled", the issue is not present.
  • If "Disable 2806 compliance" is enabled (as a requirement), there is no workaround.
24SBX-114410



1

The SBC-SOSBC-RTU license is displayed as 0 on the EMA.

Impact: The SBC-SOSBC-RTU license is applied to the SBC, but it's not displayed in the EMA/EMS License Manager.

Root Cause: A license with the feature name SBC-SOSBC-RTU is not considered.

Steps to Replicate: Not applicable

The code is modified to recognize the SBC-SOSBC-RTU license. 

Workaround: None

25SBX-114393



1

A TLS Session ID has all zeros on the new 9.2.2R3 code.

Impact: The TLS Session IDs are not printed in the TLS Session Status command output.

Root Cause: The code is removed in the latest releases.

Steps to Replicate: 

  1. Execute a TLS Session Status command with active TLS calls on the SBC.
  2. Session IDs are printed as a zero instead of as valid session IDs.

The code is modified to address the issue.

Workaround: None

26SBX-113702



1

Accounting Logs are not escaping the special characters in the calling name fields.

Impact: Accounting Logs are not escaping the special characters in the calling name fields.

Root Cause: If a non-alpha numeric character is included in the calling name, the SBC is not escaping the character in the Accounting Record. This leads to an incorrect "called asserted identity" field.

Steps to Replicate: 

  1. Make a simple SIP-SIP call and validate the CDR subfield 60.
  2. The Called Asserted Identity displays the  name as "%XXX CUSTOMER RD%".
  3. The Called Asserted Identity [sf:60] "CUSTOMER ROAD"
    NNI-Type [sf:61] <sip:+12345678912@162. xxx.yy.zzz;user=phone>.

The code is modified to address the issue.

Workaround: None

27SBX-113170



1

A Call fails with the NRM error "could not find a card for IP call."

Impact: Some calls start failing after a switchover and continue to fail until a manual switchover is performed.

Root Cause: No root cause found.  

The following log message is an indicator of this issue:

.SIPSG: sipsgSbyMsgProc.c (-863) 179922. UNRECOGNIZED message received on standby, message type=0x23D47, rcvIcm=0xF00E003E, txIcm=0xC0

Steps to Replicate: The steps cannot be reproduced.

The code is modified to gather more information to find a root cause and address the issue.

Workaround: This issue can be resolved by a manual switchover.

28SBX-113448



1

A Back to back SAM Process coredump occurs on the system.

Impact: A SAM Process coredumps while doing the OCSP queries when the SBC is under Denial-of-Service (DoS) attacks.

Root Cause: A Linux file descriptor value in an OCSP query is out of range for select() call, used by OpenSSL API, causing memory corruption.

Steps to Replicate: 

  1. Modify a Sam Process source code to create several socket file descriptors to simulate a DoS condition.
  2. Perform the OCSP queries for SIP-TLS sessions. 

Do not perform the OCSP query when the file descriptor value used in the OCSP is out of range for a select() call to prevent memory corruption.

Workaround: Disable the OCSP.

29SBX-113986



1

A User-to-User parameter is duplicated in a Refer-To header.

Impact: When a REFER message is relayed while transparency for all headers is active, the URI parameters appear twice in the Refer-To header.

Root Cause: An interaction between the transparency of all the headers and a relay of the Refer-To header.

Steps to Replicate: 

  1. Have relay of REFER message enabled in the IP signaling profile.
  2. Have a SIP transparency profile with an "all" entry assigned to the SIP trunk groups.
  3. Make a SIP to SIP call.
  4. From the UAS, send a REFER to perform a blind transfer.
  5. The REFER contains a Refer-To header with the URI User-To-User parameter.
    Example:
    Refer-To: <sip:+12345678@ john.smith.com?User-to-User=0059a390f3d2b7310023a2%3Bencoding%3Dhex>

The code is modified so that the URI parameters appear only once.

Workaround: An SMM rule workaround is possible, if the Refer-To is relayed transparently.

30SBX-112031



1

A SAM Process coredump occurs on the server.

Impact: A SAM Process coredump occurs when an AOR entry is deleted.

Root Cause: When an AOR entry is deleted, the SBC starts a registration cache timer after saving an AOR in the cache. If the registration timer fails to start, an AOR cache entry is freed but the hash entry is not removed from the hash table. This results in a corrupted list in the hash table.


When a new hash entry is inserted into the hash table, the hash table logic tries to insert the new hash entry after the corrupted list. This results in a SAM coredump.

Steps to Replicate: 

  1. Make a SIP-SIP with an ERE call setup.
  2. Disable the "multipleContactsPerAor"
    set global signaling sipSigControls multipleContactsPerAor is disabled.
  3. Disable "surrogateRegistration".
    set addressContext <addressContext_name> zone <zone_name> ipPeer <peer name> surrogateRegistration state is disabled.
  4. Do a few SIP registrations and delete the entries.
  5. Deletion of SIP Registration works without any issue.

The code is modified to remove the cache entry from the hash table before freeing up the complete cache RCB block.

Workaround: None

31SBX-113883



1

On the SBC SWe, there is a CPU Usage display error in the web page.

Impact: On the SBC SWe, the CPU Usage page on the EMA throws out an error indicating an invalid value for the row containing unused vCPUs.

Root Cause: When the number of vCPUs allocated to the SBC SWe VM are over-provisioned, some of the cores remain unused.


Since the core is unused, it's function type(oam/sig/media/xcode/thirdparty) is not defined, rendering the field with a null value. The EMA reads this information from the backend and parses the fields incorrectly.  Field values are unintentionally shifted towards the left, resulting in a corresponding field's validation error.

Steps to Replicate: 

  1. reate an SBC SWe with an over-provisioned vCPU (depending on your traffic profile).
  2. Navigate to Monitoring > Dashboard > CPU Usage.
    A pop-up window appears.
  3. Observe the results.

In an SBC SWe with over-provisioned vCPUs, the unused vCPUs are explicitly defined as "unused" even on the EMA page's CPU usage tables.

Workaround: None.
This issue is not observed on an SBC SWe when none of the vCPUs allocated to the SBC SWe VM are left unused.

32SBX-115484



1

An SCM Process coredumps when accessing a null pointer.

Impact: An SCM coredump occurs when there is an attempt to dereference a NULL pointer.

Root Cause: This coredump occurs when there is an attempt to dereference a NULL pointer in code that is added. The race condition and coredump results from changes to the MOH for MS Teams after a call legPtr is accessed and the call leg is released.

Steps to Replicate: The steps cannot be reproduced. The bug is found by code inspection.

The code is modified to address the issue.

Workaround: None

33SBX-114315



1

A failover occurs on the SBC because of a SCM Process coredump.

Impact: An SCM coredump occurs if the hostName in the From header is longer than 64 bytes.

Root Cause: The code is copying the host name into an array that is not long enough to hold it, resulting in memory corruption.

Steps to Replicate: 

  1. Make a call.  
  2. Enter a hostName in the From header that is longer than 64 bytes.

The code is modified to address the issue.

Workaround: None

34SBX-115082



1

A bug is found in the CDR Viewer Sip Ladder Diagram message contents.

Impact: A Ladder diagram is not showing the full message. Different parts of a SIP message that should be shown as a single message instead multiple messages, are displayed in the ladder diagram

Root Cause: The implementation assumes that the different parts of a single message are logged in the TRC file in sequence one after the other. In some cases different parts of the SIP message are logged randomly, causing the implementation to break.

Steps to Replicate: 

  1. Login to the EMA.
  2. Enable the CDR Viewer and SIP Ladder.
  3. Verify that all the parts of the SIP message are displayed as a single message in the ladder diagram.

The code is modified to address the issue.

Workaround: None

35SBX-113436



1

The Alarm History is not cleared in the EMA after clearing in the CLI.

Impact: The Alarm History is not cleared in the EMA after clearing in the CLI.

Root Cause: A cleared alarm list is deleted in the CDB and the postgres entries are not ignored, causing the UI to display the entries.

Steps to Replicate: 

  1. From the SBC CLI run: show table alarms historyStatus.
  2. A list of cleared alarms is displayed.
  3. Clear the alarm history by using the Request Alarms Clear History.
  4. In the EMA under section:  Monitoring > Dashboard > Alarms > Cleared Alarms. The list should be empty.

The code is modified to address the issue.

Workaround: None

36SBX-112945



1

The SRTP and the ENCRYPT "IN USE" counters leak for call flows with two transfers that use the INVITE with Replaces.

Impact: 

  1. In a multiple call pick-up (multiple INVITE w/ Replaces) scenario, "IN USE" counters of the SRTP and the ENCRYPT license do not decrement after the call termination, which causes the counter to leak.
  2. In a multiple call pick-up (multiple INVITE w/ Replaces) scenario, after the second call pick-up, the SBC-RTU "IN USE" counter decrements.

Root Cause: The logic for auditing the consultative refer calls does not work properly for a call pick-up. This logic creates one extra virtual leg for a second pick-up call, making a three virtual leg creation for two pick-up calls. This also results in a license adjustment. The licenseCall becomes 0 and the SBC-RTU "IN USE" decrements.
This also affects the ENCRYPT and the SRTP licenses when the "IN USE" counter does not reset after a call termination.

Steps to Replicate: 

  1. Setup: Phonerlite (TLS/SRTP) - SBC - SIPp (UDP).
  2. Leg A calls Leg B.
  3. Leg C sends an INVITE with Replaces (Replace header contains the Call-ID, From, and To tags of Leg B) to replace Leg B. This makes the first call pick-up.
  4. Once the first call pick-up completes, Leg B drops out of the call making Leg A - Leg C in the active call.
  5. Leg D sends an INVITE with Replaces (the Replaces header contains the Call-ID, From, and To tags of Leg C) to replace Leg C. This makes the second call pick-up. The second pick-up call is established between Leg A - Leg D.
  6. Observe that the SBC-RTU "IN USE" counter is reset to 0 after the second pickup is successful.
  7. Use the licenseInfo CLI command.
  8. Leg A disconnects the call by sending a SIP BYE.
  9. The Call is terminated gracefully.
  10. Observe that the ENCRYPT and the SRTP license "IN USE" counter does not decrement after the call termination.
  11. Use the licenseInfo CLI command.

A new internal flag is introduced to identify a pick-up call. This flag is set for every pick-up call after a virtual call leg creation and license adjustment. A check for the same flag is added in the audit logic to avoid the audit logic for pick-up calls.

Workaround: None.

37SBX-112374



1

The SBC is intermittently stripping the last 'm=' line from the Egress Invite.

Impact: The SBC strips off the lines after the m =application line when present in the SDP of the incoming Invite, and at Egress the SBC does a DNS lookup.

Root Cause: There is a NULL termination after the m=application line, causing the SDP to truncate SDP after the m=application line.

Steps to Replicate: 

  1. In the Ingress Invite of the offer SDP, add the m=application line along with audio m line.
  2. At the Egress, the SBC should do a DNS lookup (cache should be cleared before, so that the SBC queries the DNS.)

The code is modified to address the issue.

Workaround: Use the actual IP address in the IP peer, instead of the FQDN.

38SBX-116476



1

After an SBC switchover, the standby SBC is not recognized.

Impact: There is a PRS core dump in the XrmIPsecSACmdAdd() process.

Root Cause: There is a PRS core dump in the XrmIPsecSACmdAdd() process because the process is attempting to de-reference a NULL pointer. This is because the code is not handling an error condition correctly.

Steps to Replicate: The steps cannot be replicated. This is found by code inspection.

This code is modified to address the issue.

Workaround: None

39SBX-113853



1

There is an SBC Intermittent crash.

Impact: When multiple duplicate Diversion headers are received and the stiProfile is enabled and configured on the ingress trunk group, the SBC coredumps core.
The issue only happens if 6 or more Diversion headers are received but fewer than 5 of them are unique.

Root Cause: Removing duplicate Diversion headers from information sent to the PSX causes a crash.

Steps to Replicate: 

  1. Configure the stiProfile by enabling and assigning to the Ingress trunk group.
  2. Send a SIP INVITE containing 6 Diversion headers, but only 2 of them are unique. 

The code is modified to address the issue.

Workaround: None.

40SBX-115115



1

The SBC disconnects the call when offering a LRBT using the first codec in 180 and the received Egress 200 contains a different codec set.

Impact: The SBC internally tears down the call if the Egress peer answers with a different first codec than in the 180.

Root Cause: The SBC auto answers using the first codec back to Ingress. The SBC cannot reInvite when changed by the Egress because the SBC is not ready to receive the reInvite/Update.

Steps to Replicate: 

  1. Enable the LRBT with no transcode support.
  2. The Ingress is 0 18.
  3. The Egress is 0 18.
  4. The Egress responds with a 180, and a trigger tone.
  5. The Egress sends a 180 with a 0 on the Ingress.
  6. The Egress then sends a 200 with a 18.
  7. The Call is cleared by the SBC.

The code is modified to address the issue.

Workaround: None

41SBX-115749



1

Video calls are being disconnected. A call transfer is failing when using both audio and video.

Impact: Audio and Video calls are disconnected after a REFER.

Root Cause: This issue happens when:

  1. Leg A is an Audio and Video Call.
  2. Leg B rejects the Video by putting the media Port to "Zero."
  3. Then Leg B REFERs Leg C to Leg A, without putting Leg A on Hold.
  4. The SBC offers a Leg with both Audio and Video.
  5. Leg C also answers back with both Audio and Video.
  6. The SBC is not able to map the video legs after the Refer.

Steps to Replicate: 

  1. Make  an Audio and Video Call from Leg A to Leg B.
  2. Reject the Video from Leg B.
  3. Send a REFER from Leg B, referring Leg C to Leg A.
  4. From Leg C, answer with both Audio and Video,

The code is modified so that the SBC can now map to the correct video leg post REFER.

Workaround: None

42SBX-110716



1

The SBC sends the wrong payload type.

Impact: The Egress GW sends the wrong payload in a 200 OK response for an incoming Re-INVITE from the Egress peer in a GW-GW scenario.

Root Cause: The issue is observed when the "Lockdown Preferred Codec" is enabled at the Ingress IPSP (at ingress GW). When this flag is enabled, the PSP is updated with selected codec containing an incorrect payload type (rx/tx as 0x00/00). This results in the Ingress SG sending a modified answer to the NRMA with an incorrect payload type

Steps to Replicate: 

  1. In a GW-GW call, GW2 receives a Re-INVITE with a G711A from the Egress peer.
  2. The Ingress GW auto answers.
  3. "Minimize Relaying Of Media Changes From Other Call leg" and "Lockdown Preferred Codec" is enabled in the Ingress IPSP of GW1.
  4. GW2 sends a 200 OK response with a G711A  and correct payload type 8.

The code is modified to address the issue.

Workaround: None

43SBX-115329



1

The SWe has unexpected switchovers.

Impact: A SCM core dump occurs while the SIPSG is processing a "401 Unauthorized".

Root Cause: The code is attempting to dereference a NULL pointer and send an UNSUBSCRIBE while processing the "401 Unauthorized" message.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to prevent an attempt to dereference a NULL pointer.

Workaround: None

44SBX-115074



1

A SCM core dump may occur when using the SIPREC.

Impact: A SCM core dump may occur when using the SIPREC.

Root Cause: Memory corruption is caused by a double MemFree() in the SIPREC code.

Steps to Replicate: The steps cannot be reproduced. This bug is found by code inspection.

The code is modified to address the issue.

Workaround: None.

45SBX-114398


1

A core dump occurs on the SBC.

Impact: During a P2P call scenario, a codec change from the PCMA to the PCMU is requested via a reInvite for Leg B. The application sends an audio modify request for both Leg A and Leg B. The DSP crashes for codecs like SILK and OPUS.

Root Cause: The merging of an audio modify request for Leg A and Leg B on the application end and the lack of a check in the DSP code for a modify request on Leg A to the same codec causes a core dump.

Steps to Replicate: 

  1. Run a G711<=>OPUS call beginning the call as a PCMU.
  2. Send a re-invite on the G711 leg to change the call to a PCMA.
  3. This triggers a modify on both the legs, with the modifyAudioCodec flag set.

The code is modified to address the issue.

Workaround: None

46SBX-114323



1

No routes are displayed for the EMA configuration > System Provisioning > Routing > Routes screen function.

Impact: The function does not work in the EMA configuration > System Provisioning > Routing > Routes.

Root Cause: An old browser version does not apply the replaceAll function. and the "replaceAll is not a function" exception is activated.

Steps to Replicate: The steps cannot be replicated.

The code is modified to ensure that the replaceAll functionality is working.

Workaround: None

47SBX-115952



1

The SBC memory utilization goes up under the load with all the IP Redirect calls and the SMM variableScope rule.

Impact: An IP Redirect call and a SMM variableScope may result in a memory leak.

Root Cause: When the SBC redirects a call to Leg C, the SBC does not release an SMM variableScope resource that is created/stored for Leg B.

Steps to Replicate: 

  1. Configure an SMM variableScope rule on an output message, Egress (Leg B and Leg C).
  2. Leg A calls Leg B.
  3. Leg B redirects to Leg C.
  4. Memory will increase slowly over time.

The code is modified to address the issue.

Workaround: Remove the SMM rule

48SBX-113305



1

The DNS recovery packet count of a DSCP with a value of "0."

Impact: The DNS probe packet's are sent from the SBC with a DSCP value of 0.

Root Cause: The configured DSCP value's are not set for the DNS probe keepalive packets .

Steps to Replicate: 

  1. Configure the DNS server with a DSCP value.
  2. The DNS server blacklisting is enabled.
  3. The DNS query is configured to the DNS server.
  4. The DNS server should be down during this process.
  5. The configured DNS server is blacklisted and sending a DNS probe packet towards the DNS server with a configured DSCP value.

The code is modified to set a configured DSCP value for the packets, including the DNS probe packets.

Workaround: None

49SBX-1171221

Syncing CallData for gcid 0x1E0E4D36 failed: Available buffer (size 27204) exhausted.

Impact: A LSWU fails when Direct Media is enabled and the SBC is processing calls that have more than four media streams.

Root Cause: A LSWU fails because an error occurred when syncing an SIP call block.

SYNC of SIPSG Call Blocks is failing because an individual Call Block does not fit in the 64K buffer that is allocated for mirroring a Call Block. When the mirrored data for a single call does not fit into the buffer, the code currently stops syncing the call blocks.

Steps to Replicate: Enable Direct Media and send a call with more than four Media Streams.

Look for these messages in the logs:

MAJOR .SIPSG: sipsgRedund.c (-2424) 2530. Ingress: Mirroring CallData for GCID 0x443B48 failed: Available buffer space (msg size=64172) exhausted?
AND
MAJOR .EVLOG: SYS ERR - Error 0x3a3c Line 2426 File /sonus/p4/ws/release/release.we.sbx5000_V08.02.03A012/marlin/SIPSG/sipsgRedund.c.

Then attempt and upgrade and look for this message in the logs:
MAJOR .SIPSG: sipsgRedund.c (-1613) 1967147514. Syncing CallData for gcid 0x1E0E4D36 failed: Available buffer (size 27204) exhausted

The code is modified so that the entire SYNC does not fail if we cannot mirror a single Call Block. Instead, the original Call Block moves onto the next available Call Block and continues the SYNC.

Workaround: Disable Direct Media.

50SBX-1144581

Node A failed to take over after node B had issues with hard disk.

Impact: The trap was not generated for HardDisk fault on the SBC.

Root Cause: Although the trap was getting generated for some harddisk/FS errors, a new error with 'failed command: FLUSH CACHE EXT' was being considered when generating a trap.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to address the issue.

Workaround: None.

51SBX-1161561

A LSWU through the EMA GUI is stuck at post upgrade check and did not continue upgrading to the active EMA.

Impact: If the upgrade is in progress when the daily cronjobs run, it may cause the upgrade to stop.

Root Cause: As part of the log rotation, Apache/Platform Manager logs gets rotated and apache gets signal HUP and restarts. This causes the upgrade script to terminate because the parent(apache) is restarted.

Steps to Replicate: Install and upgrade from a pre 9.2.4 to 9.2.4

The code is modified to skip apache log rotation if the upgrade is in progress and to use nohup with an upgrade and revert scripts.

Workaround: Restart the upgrade or revert and retry upgrade.

52SBX-117099


1

A SCM Process core dump occurred on the SBC server.

Impact: The SCM Process cored. 

Root Cause: The SCM Process has cored because of an attempt to de-reference a NULL pointer.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to check the value of the pointer before accessing it.

Workaround: There is no known workaround.

53SBX-1171871

The config Export is failing because of the DM/PM Rule.

Impact: The config export is failing due to a confd error occurring while reading a DM/PM Rule.

Root Cause: The subRule being exported had a subRule type of uri. However, the export reads all of data for all subRule types, and the data in the digitStringManipulation->replacement->type was 2, which is an invalid value. This value is retrieved from the postgres database table pm_rule, which stores the replace->type value from the uri subrule as the invalid value 2.

Steps to Replicate: 

  1. Create a digitParameterHandling dmPmRule with a subRule type of uri.
  2. Set the uriParameterManipulation->userInfoManipulation->replacement->type field to noChange.
  3. Export the configuration through the EMA.

The code is modified when the digitStringManipulation container is being read, if the replacement->type value is 2, it is set to 0.

Workaround: Before exporting, change all dmPmRules with a subRule type of uri to set the uriParameterManipulation->userInfoManipulation->replacement->type field to constant and then do the export. Change the value back after the export.

54SBX-1164681

An SIP.Instance parameter is missing from Contact Header for De-Registration Message generated by the SBC locally.

Impact: When the SBC generate the unregister message to registrar, the +sip.instance and reg-id parameters are missing in Contact header.

Root Cause: The root cause was missing functionality.

Steps to Replicate: 

  1. Enable transparency contact header.
  2. The Iad register to registrar where contact header has +sip.instance and reg-id.
  3. The Iad did not send refresh in time trigger SBC to send unregister to registrar.

The code is modified to address the issue.

Workaround: None.

55SBX-116299



1

A restart with a Comp_SAM Process Coredump.

Impact: Memory corruption causes a SAM Process coredump when processing a GW-GW message.

Root Cause: Memory corruption causes a SAM Process coredump when processing a GW-GW message. Code doesn't allocate enough memory for an outgoing message. When the data is copied into the message, the code writes past the end of the allocated buffer because there isn't enough space in the buffer.

Steps to Replicate: The steps cannot be replicated. The root cause is found by code inspection.

The code is modified to allocate enough space for the outgoing message.

Workaround: None

56SBX-114045


1

The SBC is failing to come up with a "cps is not initialized:failed" message after a shut down.

Impact: The Virtual SBC fails to startup due to a missing file link for an OS binary.

Root Cause: There is a missing OS level soft link that is required for the SBC startup code. The OS level soft link may have been lost as a result of multiple reboots while the SBC is trying to startup in a virtual deployment.

Steps to Replicate: The steps cannot be replicated.

The code is modified to address the issue.

Workaround: 

  1. The soft link can be manually created:
    ln -s /bin/kmod /sbin/insmod
  2. Then the instance can be rebooted.
57SBX-114367



1

An Announcement Package Element cannot be deleted.

Impact: An element within an announcement package cannot be deleted.

Root Cause: The code for handling the announcement package element Delete command is incorrect.

Steps to Replicate: Perform following configuration changes through the CLI:

  1. Create an announcementPackage test_pkg_1 with an element test_element_1.
    Example:
    set profiles media announcementPackage test_pkg_1 packageId 101 element test_element_1 segmentId 11111
  2. Show the announcementPackage to verify it is created correctly. 
    Example:
    Show the profiles media announcementPackage test_pkg_1.
    It should display as:
    packageId 101;
    element test_element_1 {
    segmentId 11111;
    }
  3. Delete a test_element_1 from the package. 
    Example:
    Delete the profiles media announcementPackage test_pkg_1 element test_element_1
  4. Show the announcementPackage to verify test_element_1 is removed. 
    Example:
    Show the profiles media announcementPackage test_pkg_1.
    It should display as (without any elements)
    packageId 101
  5. Delete the package and verify it is successfully deleted. 
    Example:
    Delete the profiles media announcementPackage test_pkg_1.

The code is modified to address the issue.

Workaround: The announcement package can be deleted and then re-created without the required element.

58SBX-114301



1

In the EMA GUI, a Destination National is not showing "+" when it is configured in a Route through the EMA.

Impact: In the EMA GUI, a Destination National is not showing the plus symbol when it is configured in a Route through the EMA.

Root Cause: In the frontend, symbols like the "+"are replaced with a space before sending to the backend.

Steps to Replicate: None

The code is modified to address the issue.

Workaround: Replace the "+" with "%2B" using the replace function. The plus symbol will appear in the EMA GUI.

59SBX-114980



1

An SBC 7000 memory leak in CE_2N_Comp_ScmProcess_x processes occured.

Impact: An SCM memory leak can occur when processing the Contact Headers if the honorEmbeddedHeadersin3xx flag is enabled in the ipSignaling Profile.

"set profiles signaling ipSignalingProfile <SIP profile name> egressIpAttributes redirect flags honorEmbeddedHeadersin3xx"

This leak will not always happen when this flag is enabled. There are several other conditions that must be met in order to expose this leak.

This leak may also exposed by enabling the flag "includeEmbeddedPAIheaderInRedirectedInvite" in the ipSignalingProfile.

Root Cause: The leak is caused by a missing call to the MemFree().

Steps to Replicate: The steps cannot be replicated. The root cause is found by code inspection.

The code is modified to ensure that the internal structure is always freed.

Workaround: Disable the following flags in the IPSP:

  • honorEmbeddedHeadersin3xx
  • includeEmbeddedPAIheaderInRedirectedInvite
60SBX-116060



1

Unable to login to the HFE_PKT1 in Azure.

Impact: The HFE_AZ.sh script fails on the HFE PKT1 in Azure when a public IP address is attached on the mgmt (eth1) interface.

Root Cause: The repository fails to install the required utilities for Linux and fails to create a temporary default route through the eth1.

Steps to Replicate: 

  1. Create the HFE PKT1 with a public IP on the eth1.
  2. Verify that the HFE_PKT1 successfully comes up and does not have error logs in the /opt/HFE/log/HFE_conf.log.

The code is modified to add the default route through eth1.

Workaround: 

  1. Create an HFE without a public address.
  2. Attach a public address after the HFE instance configures.

The following Severity 2-4 issues are resolved in this release:

Severity 2-4 Resolved Issues


Issue IDSevProblem DescriptionResolution
1SBX-116735


2

Editing a route with DN using '@ 'and '&' characters is duplicating the same route.

Impact: Using '@' and '&' characters in the DN field is duplicating the same route.

Root Cause: A few special characters were not decoded while editing and as a result, a route has been duplicated.

Steps to Replicate: 

  1. Log in to the EMA.
  2. Navigate to Routing and click the Route tab.
  3. Create a route with & and @ in Destination National.
  4. Edit the same and change the Routing label.


The code is modified to address the issue.

Workaround: No workaround.

2SBX-114429


2

The data_type properties fields should not have a "dot" in the identifier.

Impact: The data_type properties fields should not have a "dot" in the identifier.

Root Cause: MongoDb uses "dot" notation to locate fields within structures. When the NVFO posts the VNFD through the VNFM API, MongoDb incorrctly uses the identifier as a field name, which causes MongoDb to throw an exception.

Steps to Replicate: Run VNFM, NFVO and HPE Orchestration, and check communication with the EMS.

The code is modified so the "dot" in the "SBC:EMSPRIVNODEPARMS.cluster_id" is replaced with "hyphen" . The new parameter is listed as  "SBC:EMSPRIVNODEPARMS-cluster_id".

Workaround: None.

3SBX-117091


2

Discrepancy between ‘View CLI’ from GUI and the SBC CLI output.

Impact: If you are viewing the CLI version of the content, the GUI stops displaying the CLI when it hits the ‘type sdpContent’ operation. 

Root Cause: The CLIRules.xml file were not updated with latest changes in in the CLI.

Steps to Replicate: Check CLI commands in CLI is same as commands in UI after selecting the view CLI.

The code is modified to address the issue.

Workaround: None.

4SBX-1170512

There is no planned cluster switchover.

Impact: The SCM process coredumps while comparing codec information.

Root Cause: In a race condition while comparing codec information, the SCM process is dereferencing a null pointer that resulted in a coredump.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to verify that the pointer is not null before dereferencing it to avoid the coredump.

Workaround: None.

5SBX-115897 | SBX-116288



3

PortFix SBX-115897: The SBC sends one of the SIP NOTIFY messages with Event: Dialog body back to the registrar instead of relaying it to the subscriber.

Impact: Back-to-Back NOTIFY messagesfrom the registrar with dialog event (DialogInfo data) that requires an internal query across distributed ScmProcesses may cause the SBC to send the NOTIFY relay back to the registrar.

Root Cause: While doing an off board query (distributed lookup in the SBC), the SBC received a message from IAD and relays to Registrar. After an off board query, the SBC is using the same direction from IAD to registrar for relaying the next Notify

Steps to Replicate: A subscribe to registrar, registrar sends multiple back-to-back Notify (around 50ms delay) with dialog event to A.

The code is modified to save the direction of relay before off board query, and restore after off board query reply and using that direction for relaying subsequent messages.

Workaround: There is no workaround.

6SBX-111461 | SBX-117346



2

PortFix SBX-111461: The SBC plays LRBT using PCMU when negotiations occurred with AMRWB in a LM call.

Impact: The tone played is with old negotiated codec instead of the codec selected by ingress endpoint in Prack. The issue is seen only when multiple codecs are sent in late media offer in 180 with sendSbcSupportedCodecsForLateMediaReinvite flag enabled.

Root Cause: The initial DSP resource allocated only has capability to play tone with G711. After AMRWB is selected as the new codec for tone play in Prack, the old DSP resource is found unusable and new DSP resource is allocated with capability to play tone with the new selected codec. However, though a new compatible DSP is allocated, the old DSP resource/XPAD is incorrectly retained in the resource chain and as a result, the tone is with the old codec.

Steps to Replicate: 

  1. Enable sendSbcSupportedCodecsForLateMediaReinvite in ingress TG IPSP and with multiple codecs supported in PSP, make a late media call.
  2. Prack from ingress endpoint has a codec different from the first codec in late media offer sent by the SBC with multiple codecs in 180.
  3. Check tone is with the selected codec in Prack.

The code is modified so that when Prack is received with SDP in LM scenarios, SWEA events are issued from PC-FSM to play tone.

The ASG has a sequence of events like NRMA allocate reply/activate reply/deactivate reply/dealloc reply that drives these SWEA events to DSP.

Workaround: No workaround.

7SBX-116164 | SBX-117373


3

PortFix SBX-116164: Autonomous fail over of the SBC 5210.

Impact: There was an SCM core while processing Register request during an IMS intercept.

Root Cause: The register looks like a retransmission and the SBC has found an existing TCB for the register. While accessing the Apphandle of TCB (which points to RCB data) the SBC cored. This is due to the RCB is not being present and address is reused for something else.

Steps to Replicate: 

  1. Have an IMS LI setup ready.
  2. Make a complete Registration. (Reg,401,Reg,200).
  3. Delete the Registration by a De-Reg from client.
  4. Retransmit the same De-reg from client (we can have some pause of say 10 secs) 

Without this fix, the SCM cores when the SBC tries to access the deleted RCB.

As an additional test, alter the fourth step to, instead of De-reg, try sending the old register that received an 200 OK [branch, call-id, cseq should be exactly the same].

The code is modified so once a response is sent to a register, IMS intercepts the message. After an interception, reset the correlationTag (i.e, AppHandle) to NULL.

Workaround: None.

8SBX-114151 | SBX-1169462

PortFix SBX-114151: Pre-upgrade BMC version check issues

Impact: During pre-upgrade checks, an invalid BMC version error message is displayed and reports pre-upgrade checks as failure.

Root Cause: The BMC version check is run during pre-upgrade checks, and reports a failure for an invalid BMC version.

Steps to Replicate: Run pre-upgrade checks and ensure BMC version check error is displayed as a warning and not a failure.

The code is modified to make it a warning rather than a failure for pre-upgrade checks.

Workaround: None.

9SBX-113966 | SBX-116994


2

PortFix SBX-113966: RCBs are not synced to the STANDBY.

Impact: Some Registrations were not being mirrored to the STANDBY SBC due to buffer not large enough for amount of info obtained from the messaging.

Root Cause: If/Then/Else statement was modified to check if certain info (Child AOR) present, which allocates a LARGE buffer all the time now.

Steps to Replicate: 

  1. Bring up an HA setup.
  2. Run a basic Registration.
  3. Perform a switchover.

Expected Results:
After a switchover, all the RCBs should be present in new active box.

Actual Results:
Not all RCBs are not synced to the SBC box.
Log message being seen:
.SIPSG: sipsgRedund.c (7734) 1621. SipsgRedundLoadRegAgentData: insufficient Buffer Size(15972) Required Size is (20195)

The code is modified to address the issue.

Workaround: None.

10SBX-113840 | SBX-114372


2

PortFix SBX-113840: Reset the fields in the nrmacalleg.

Impact: Certain fields in a data structure are not reset to default values during a call tear down.

Root Cause: Due to performance reasons, one of the sub-system re-uses this memory block again for new calls. Since, the fields from previous call were not reset during tear down, these fields continue to be set even for the new call and could result in undesired behavior.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to correctly reset missing fields during call tear down.

Workaround: None.

11SBX-109315 | SBX-116588


2

PortFix SBX-109315: There are SBC sync issues. 

Impact: There is no event/alarm to indicate a Postgres transition failure during a switchover.

Root Cause: The Postgres Transition failed within the timeout period, but the switchover continued. Subsequently, the SSDB became active, but failed within the timeout duration (20 seconds). As a result, the SSDB became unrecognizable due to a missing replication slot.

Steps to Replicate: Return a non-zero value from WaitActive function in startPGDB.sh to simulate Postgres transition failure. Attempt a switchover. Check event logs and startPGDB.log.

The code is modified to indicate a Postgres transition failure during switchover.

Workaround: None.

12SBX-115243 | SBX-115847


3

PortFix SBX-115243L The Automatic AD Sync is not completing.

Impact: The Automatic AD Sync is not completing.

Root Cause: During the change from Daylight Savings Time in the Fall, the addMinsToTime routine returns a time that is greater than the passed-in time. Consequentially, the code loops calling addMinsToTime expecting the time returned by addMinsToTime to be greater than the current time.

Steps to Replicate: 

  1. Configure AD sync.
  2. Set the time to 1:00 AM on the day of the current year where daylight saving time ends.
  3. After 2:00 AM on that day, turn on info level logging.
  4. Observed in the debug logs that the message:
    DAP_CONFIG: Performing Sync Interval AD Sync Success appears.

The code is modified to return a time greater than the passed-in time when switching from Daylight Saving Time.

Workaround: None.

13SBX-110756 | SBX-113982


3

PortFix SBX-110756: Wrong behavior with sipAdaptiveTransparencyProfile enabled.

Impact: When the SipAdaptiveTransparencyProfile was enabled and the SBC received 200 OK with SDP, it was sending ACK without SDP in late media scenario cases.

Root Cause: The SDP was not being added in ACK in late media cases.

Steps to Replicate: The following are the test cases used in the call flow:

  1. Send a 200 OK for re-INVITE from EGRESS PEER without SDP.
  2. Send a 200 OK for re-INVITE from EGRESS PEER with SDP but changed CODEC.
  3. Send a 200 OK for re-INVITE from EGRESS PEER with SDP.
  4. Send a 4xx (for re-INVITE) from EGRESS PEER.

The code is modified to add SDP in ACK for late media cases.

Workaround: None.

14SBX-108609 | SBX-110025


2

PortFix SBX-108609: The SBC failed to send telephone-event when payload type number overlaps with configured in PSP for any codec.

Impact: The SBC fails to send 16,000 2833 payload type in outgoing INVITE when the 16,000 PT value received from ingress conflicts with the configured PT value for one of the codecs in egress route PSP.

Root Cause: The SBC failed to detect and resolve the conflict between 16,000 DTMF PT and egress route codec PT which resulted in the SBC dropping the 16,000 PT in outgoing INVITE.

Steps to Replicate: 

Configuration:

  1. Enable honorSdpClockRate TG flag.
  2. Disable different2833palyloadtype flag.
  3. Configure multiple codecs including EVRCB0(103) in Egress Route-PSP.

To re-create the issue:

  1. Ingress offer received by the SBC:
    m=audio 48820 RTP/AVP 102 0 103 105 97 8
    102 AMR-WB/16000 (b/w efficient / open mode-set)
    0 PCMU/8000
    103 telephone-event/16000
    105 telephone-event/8000
    97 AMR/8000 (b/w efficient / open mode-set)
    8 PCMA/8000
  2. Egress offer sent by the SBC on the egress

m=audio 5096 RTP/AVP 102 97 0 110 101 107 103 98 96 105
102 AMR-WB/16000 (b/w efficient, mode-set=0,1,2)
97 AMR/8000 (b/w efficient / open mode-set)
0 PCMU/8000
110 AMR-WB/16000 (octet-align, mode-set=0,1,2)
101 AMR/8000 b/w efficient / open mode-set)
107 EVRCB/8000
103 EVRCB0/8000
98 EVRC/8000
96 EVRC0/8000
105 telephone-event/8000

Test Result without a fix: The SBC chooses to follow egress PSP configuration, which means it drops the telephone-event/16000 payload type.

The code is modified to prefer the pass-through DTMF PT value over the route configured codec PT by extending the PT conflict resolution to all the dynamic codecs.

Workaround: As a workaround, the conflicted PT value can be modified at egress Route PSP.

15SBX-114691 | SBX-115064


2

Portfix SBX-11469: "Challenge-SMM" is not added in the NOTIFY to the Ingress side of the SBC.

Impact: Challenge SUBSCRIBE is not processed when it does not contain a to-tag.

Root Cause: When a challenge SUBSCRIBE comes without a to-tag, we are unable to find RelayCb, creating new RelayCb and processing as a new request.

Steps to Replicate: 

  1. Send a SUBSCRIBE from the UAC.
  2. Send a challenge SUBSCRIBE without a to-tag.

In DBG logs, we can see there will be two relayCbs will be creating for the same SUBSCRIBE flow.

The code is modified to address the issue. 

Workaround: Send a challenge SUBSCRIBE with the received to-tag.

16SBX-114019 | SBX-114071


2

PortFix SBX-114019: The DBG logs are rolling rapidly with UacSendUpdate messages.

Impact: The SBC DBG logs were filling up quickly with the following log message:

114 10192021 114119.823662:1.01.03.16703.MAJOR .SIPSG: UacSendUpdate - local answer for UPDATE: LegSide=Ingress

Root Cause: The code was mistakenly printing logs at the MAJOR level.

Steps to Replicate: The log is generated during a call where the SBC attempts to send UPDATE out to ingress leg while the PRACK is pending for previous 18x sent.

The following control also needs to be disabled on the trunk group the messages are being sent on:
set addressContext default zone <zone name> sipTrunkGroup <TG name> signaling doNotAutoAnswer <enable/disable>

The code is modified to only print the logs at INFO level.

Workaround: None.

17SBX-113524 | SBX-113910


2

PortFix SBX-113524: The SBC is not forwarding the received 200 OK and fails the call.

Impact: When using a GW-GW for direct media calls between signaling-only SBCs, the 200 OK is not being passed through and the call fails.

Root Cause: The code is unable to process the outgoing 200 OK because it cannot find any local IP information.

Steps to Replicate: Make a direct media call between two signaling-only SBCs with the following control enabled.
set global signaling sigOnlyMode sigOnlyModeValue global

If the sigOnlyMode flag is set to global, copy the local IP information.

Workaround: Disable the following control:

set global signaling sigOnlyMode sigOnlyModeValue off

18SBX-111357 | SBX-113041


2

PortFix SBX-111357: Cleared Alarms functionality is not working properly in the EMA.

Impact: Cleared alarms are not listed in "Cleared Alarms" screen under Monitoring > Alarms in the EMA.

Root Cause: Cleared Alarms screen combines alarms from both the CDB and Postgres. However, there was a fix made for a customer issue related to an alarm in 9.2.2, resulting in ignored alarms in the CDB.

Steps to Replicate: 

  1. Login to EMA. Generate an alarm by disabling PSX_LOCAL_SERVER.
  2. Navigate to Monitoring > Alarms > Current Alarms. Alarm will appear in the Current Alarms screen.
  3. Clear the alarm by enabling PSX_LOCAL_SERVER.
  4. Navigate to Monitoring > Alarms > Cleared Alarms. Alarm cleared will appear

The code is modified to retrieve the alarms from CDB and return them to UI for display purpose.

Workaround: No workaround.

19SBX-114303 | SBX-114385


2

PortFix SBX-114303: Customer PSTN is incorrectly listed as Busy.

Impact: The SBC attempts to map non-E164 display Name of a p-asserted-Identity TEL to generic address for called user.

Root Cause: When the SBCs received both pai (tel)and pai(sip) headers, it tries to treat the headers as a customer TTC even though the display name in pai(tel) is not in E164 format.

Steps to Replicate: 

  1. Run the following configuration:
    sipTrunkGroup IAD signaling callingPalingParty enabled
    Incoming msg has:
    P-Asserted-Identity: "12345 test user " <tel:+18038830789;rn=214960>, "12345 test user" <sip:+18038830789;rn=214960@test.com>
  2. Use the outgoing INVITE
    From, contact userpart is 12345

The code is modified to address the issue.

Workaround: Use the SMM to delete incoming display name in pai(tel) header. For an out going INVITE, add it back if pai is config transparency.

20SBX-111984 | SBX-115026


2

Portfix SBX-111984: The SBC box is not coming up with the latest ASAN build.

Impact: The SBC box is not starting up in ASAN build. The SBC code that is used to generate traps was accessing memory after it is freed while processing traps that contained an IP address parameter.

Root Cause: The IP parameter passed to confd as part of the trap information was stored in a location that was freed before the confd processed the trap API call.

Steps to Replicate: 

  1. Start up the SBC with an ASAN build.
  2. Ensure that the SBC comes up.
  3. In non-ASAN builds, this does not prevent the SBC from starting up although it could be accessing previously freed memory.

Store the IP parameter in a location that is not freed before the call was made to send the trap.

Workaround: None.

21SBX-111773 | SBX-115044


2

Portfix SBX-111773: Coverity Issues in SIPSG - Cause Map CPC - SIP

Impact: In the SipSgDiscReasonMapCpcToSip, the API pointer is checked against a NULL pointer but then is dereferenced again.

Root Cause: The Pointer validation was missing for a particular flow, which led to invalid memory access.

Steps to Replicate: 

  1. Make a A-B Normal call.
  2. Send 200 OK from User B.
  3. Send ACK towards User B.
  4. Send BYE from A and terminate the call.

The code is modified to avoid unwanted flow to get executed.

Workaround: None.

22SBX-114110 | SBX-115808


2

PortFix SBX-114110: A call from the child AOR fails after a switchover.

Impact: A user is registered on the UDP and INVITE comes in (different port) on the TCP fails with a 403 message. Original bug was fixed in the 8.2.6 release, but the same problem is seen after a switchover. This additional fix is related to the RCB (registration control block) mirrored to the standby.

Root Cause: Once the maskportforRcb flag is enabled, a parent RCB is found but the child RCB is not. Mask port and mask IP were not considered during child creation. This additional fix mirrors the child info correctly.

Steps to Replicate: 

  1. Enable the maskportforRcb Flag and on ingress side set require registration to required.
  2. Send register and receive a 200 OK with p-Associated URI (To create child RCB) on UDP.
  3. Send an INVITE with child user on TCP without specifying the port.
  4. Verify that the RCB is found and INVITE is routed properly.

Update the child information correctly based on the masking flags, then mirror to standby.

Workaround: Not available.

23SBX-115151 | SBX-116768


2

PortFix SBX-115151: Addressing log4j vulnerability - CVE-2019-17571 in 10.x.

Impact: Addressing the Log4j vulnerability reported in CVE-2019-17571, CVE-2021-45105 and CVE-2021-44832.

Root Cause: CVE-2019-17571 is reported in log4j 1.2 up to 1.2.17
CVE-2021-45105 and CVE-2021-44832 are reported against log4j 2 versions 2.16 and prior.

Steps to Replicate: The steps cannot be replicated. 

The code is modified so the Log4j is 2.17.1 to resolve all the listed CVE vulnerabilities.

Workaround: None.

24SBX-111077 | SBX-114786


2

PortFix SBX-111077: The Power LED is OFF instead of AMBER when the BMC is ON.

Impact: The SBC 51xx/52xx front panel power LED is off, when it should be AMBER. 

Root Cause: The power LED is set to off when the host is powered off.

Steps to Replicate: Power off the host and check the power LED status.

Setting power led to amber after power off host.

Workaround: None. 

25SBX-115320 | SBX-115570


2

PortFix SBX-115320: Compressed CDR filename should use a readable timestamp.

Impact: The filename for compressed CDR filenames does not contain a human readable timestamp.

Root Cause: The timestamp contained in the filename is the number of seconds since the unix epoch time.

Steps to Replicate: Configure the SBC to write out compressed CDRs: 
set oam eventLog typeAdmin acct compressionSupport only

Rollover the accounting log twice
request oam eventLog typeAdmin acct rolloverLogNow
request oam eventLog typeAdmin acct rolloverLogNow

Verify that the timestamp in .ACT.gz file in the log file directory has a timestamp of the form: yyyymmddhhmmss

The code is modified so the file name form is now yyyymmddhhmmss
Ex: 20220118125936
18th January 2022 12:59:36
The hours are in 24 hour format

On a Nto1 system, the filename is of the form:

<Actual Server Name>_yyyymmddhhmmss_<SequenceNumber>.ACT.gz
The Actual Server Name can be viewed with the cli command
show table system serverAdmin <Server Name> actualCeName

Workaround: The timestamp in the logs can be converted to a human reading form with the linux command
date -d@<linux style timestamp>

26SBX-112867 | SBX-113456


2

PortFix SBX-112867: The SBC is monitoring for RTP inactivity when a call is on hold.

Impact: The SBC is reporting media inactivity immediately after a call un-hold. The configured timeout value is not being reported after an un-hold when media is not present.

Root Cause: With a call un-hold, the SBC NP API handling inactivity detection restart timestamp is not being updated, and it used old timestamp, reporting the inactivity notification earlier than expected.

Steps to Replicate: With inactivity detections enabled, make a call, put the call on hold for the configured threshold, and observe the results after call un-hold without sending media.

The code is modified to report the inactivity after a configured interval as expected.

Workaround: Inactivity detections can be disabled, or action can be changed from disconnecting the calls in this scenarios.

27SBX-115576 | SBX-115680


3

PortFix SBX-115576: Hitting restart limit during software upgrade leaves the model locked.

Impact: AMF model remains locked after an update.

Root Cause: System startup failure results in soft restart limit being hit, stopping the AMF model update process.

Steps to Replicate: Model update marker needs to be in place, and then repeatedly kill the service after startup but prior to five minutes passing. On the 6th attempt to restart, the soft restart limit will be hit and the service will not attempt restart and the model will remain unlocked.

The code is modified to prevent killing the AMF model update process.

Workaround: Fix the instability issue causing the system to repeatedly crash and restart.

28SBX-112162 | SBX-115070


2

PortFix SBX-112162: [ASAN]: AddressSanitizer: unknown-crash on address 0x7f0f40a9d280 at pc 0x5640ea4b71de bp 0x7f0f40a78700 sp 0x7f0f40a786f8 in SipsGetSmmProfileForDlgScopehashUpdate.

Impact: The ASAN reported "runtime error" error for an enum.

Root Cause: The load value was exceeding the defined enum value.

Steps to Replicate: Run the ANSI-88 ISUP INVITE-CANCEL SIP-I codenomicon suite.

The code is modified to add checks to ensure that we do not exceed the defined value.

Workaround: None.

29SBX-115908 | SBX-116248


2

PortFix SBX-115908: Dialer SBC - media forking/call recording and high memory usage

Impact: There are call failures due to a memory leak in NICE Recording scenarios.

Root Cause: The memory leak is caused by a bug in the code that handles mirrored Recorder Call Blocks on the Standby.

The Recorder Call Block isn't cleaned up on the Standby until the call goes down. If a second recorder session is started while a call is still up, some of the information about the first Recorder session will be overwritten. This prevents the first Recorder Call Block from ever being freed.

When the standby transitions to active as the result of a switchover, these leaked Recorder Call Blocks are carried over to the active because the information needed to initiate the cleanup is still missing.

Calls are rejected after surpassing the 55,000 call block per SCM process limit. This limits the number of calls that SCM can process to 55,000 minus the number of leaked call blocks.

Steps to Replicate: 

  1. Establish a scenario in which NICE server starts/stops multiple recording sessions for each call.

  2. Monitor memory on the Standby to see if is growing.

The code is modified to handle mirrored Recorder Call Blocks on the Standby. When a second Recorder Call Block is received on the Standby, the first Recorder Call Block is freed.

Workaround: Prevent the NICE server from starting multiple recording sessions for the same call.

30SBX-114833 | SBX-116057


2

PortFix SBX-114833: Extreme congestion causes blocked end points.

Impact: Extreme congestion causes end points to become blocked due to a mishap in ARS (address reachability service) handling and does not recover automatically.

Root Cause: The ARS state machine does not process some unexpected internal events which leads to it not broadcasting the correct block containing the clear status to all the SCM processes. This results in some end points being stuck in a blocked state.

Steps to Replicate: This issue is only reproducible under extreme congestion scenarios.

The code is modified to address the issue.

Workaround: Manually recover end points blocked by ARS logic using one of the following commands:

request addressContext <context name> zone <zone name> sipArsEndpointRecoveryAll

or

request addressContext <context name> zone <zone name> sipArsEndpointRecoveryByIp ipAddress <ip> port <port>

31SBX-114276 | SBX-115055


2

PortFix SBX-114276: The 'show status oam radiusAuthentication radiusServerStatus availableAt' command disploys the wrong value during Daylight Saving Time (DST)

Impact: The show status oam radiusAuthentication radiusServerStatus availableAt command shows the wrong value during DST.

Root Cause: Converting the unAvailableFrom time read from from confd to local time in seconds, adding the out of service duration, and converting to back to a local time struct tm did not result in a correct time.

Steps to Replicate: 

  1. Configure a radius authentication server to point to a radius server that is unavailable.
  2. Configure the outOfService time to be 60 minutes.
  3. Run the ssh into the CLI.
  4. Run a show status oam radiusAuthentication radiusServerStatus and verify that the availableAt time is one hour in the future.

The code is modified to the current seconds in GMT time and converted back to a time structure using a the localtime_r call. This results in the correct time being displayed.

Workaround: None

32SBX-113893 | SBX-114406


2

PortFix SBX-113893: The SBC returned an 500 Internal Server Error and many calls failed.

Impact: Observed a memory leak when the ACK sending failed towards the SIP recording server due to a DNS resolution failure.

Root Cause: Once the 200 OK received from SIP Rec server for initial INVITE/Re-INVITE, current design assumes that INVITE/re-INVITE transaction is success and it is designed to free call control block only on completing BYE transactions.
But if ACK sending failed due to DNS resolution, then the SBC does not trigger BYE during call cleanup and in this case call control block is not getting freed, causing a memory leak.

Steps to Replicate

Basic call with SIP Rec feature enabled.
Simulate the SIP Rec server to send FQDN in 200 OK (200 OK of INVITE) and make sure DNS resolutions fails and this causes memory leak.

The code is modified to clear call control bock when a cleanup timer expires.

Workaround: Not applicable.

33SBX-112830 | SBX-115068


2

PortFix SBX-112830: The pattern mismatch search pattern 'Media\ Attribute\ \(a\)\:\ maxptime\:20' was not found 1 -> INVITE

Impact: The max Ptime value was being sent in the egress INVITE's Ptime header though the preferPtime flag was enabled.

Root Cause: The datatype of the previous field doNotAnswer was incorrect and the Ptime value was overwritten as proper size was not used.

Steps to Replicate: 

  1. Run a direct media call.
  2. Enable the sendPtimeInSdp and preferPtimeInSdp.
  3. Send ptime value of 20 in ingress INVITE.

The code is modified so the doNotAnswer field is the right value.

Workaround: None.

34SBX-112597 | SBX-115069


2

PortFix SBX-112597: I-SBC: "runtime error: shift exponent 48 is too large for 32-bit type 'int' " in np.log.

Impact: The ASAN builds reported an integer overflow error in calculation of standard deviation for jitter for RTP packets.

Root Cause: Integer overflow during standard deviation calculation.

Steps to Replicate: The problem can be reproduced by streaming RTP stream with high jitter.

The code is modified to prevent integer overflow during standard deviation calculation.

Workaround: No workaround is available. This metric however, is not written into CDRs. It is currently available using Ribbon Protect.

35SBX-110665 | SBX-114798


2

PortFix SBX-110665: Internal IP peers blacklisted after switchover despite that OPTIONS ping worked fine.

Impact: When the system experiences a Split Brain condition, the ipPeer(s) using a pathCheck may become BLACKLISTED and may not be RECOVERED.

This can result in some ipPeer(s) becoming BLACKLISTED permanently.

Root Cause: During a Split Brain, both CEs are running in ACTIVE state. In the error case, the PATHCHK sends BLACKLIST event(s) to the ARS on both systems (CEs). This can result in a PATHCHK and ARS being out-of-sync with respect to the ipPeer(s) BLACKLISTED/RECOVERED state.

Steps to Replicate: This issue is very difficult to reproduce. We have only been able to reproduce the issue by performing “kill-stop 2” on a KVM based system, that has a number of ipPeer(s) with pathCheck profile state enabled.

The code is modified so that the PATHCHK sends events to the ARS only on the system (CE) that is being executed. The PATHCHK is prevented from sending events to ARS on the other system (CE).

Workaround: If this issue occurs, the ipPeer(s) that are stuck on BLACKLISTED may be RECOVERED through the CLI by disabling the ipPeer(s) pathCheck state.
Customers can state disable and state enable the ipPeer(s) pathCheck state.

36SBX-114395 | SBX-114826


2

PortFix SBX-114395: OA FSM timeout - call transfer with e2eAck enabled (ACK not sent by the SBC).

Impact: After a call transfer from legB to legC, the e2e re-INVITE and ACK are not working.

Root Cause: LegC incorrectly disables the e2e ACK, while legA still enables the e2e ACK.

Steps to Replicate: This is specific to customer configurations.

  1. A call B, B refer to C, with tone places and various codec setup.
  2. Once the LegC received 183 with the SDP, it triggers the SBC to send UPDATE to legC.
  3. LegC answer 200 OK INVITE, 200 OK Update.
  4. LegC sends keepalive trigger a re-INVITE to legA.

The SBC is unable to sends ACK to legA.

The code is modified to address the issue.

Workaround: Disable the e2eAck.

37SBX-113242 | SBX-113350


2

Portfix SBX-113242: The SLB/SBC is not fetching the correct branch param from merged VIA header.

Impact: Due to merge VIA headers, the SLB/SBC was not getting the correct instance id and response messages were not being routed to backend SBCs.

Root Cause: If the SLB/SBC receives a VIA header as merge of two VIA headers, it was overwriting the first via branch param from the second VIA branch param, and due to this SLB was not getting the correct instance id.

Steps to Replicate: 

  1. UAC will send an INVITE towards the SLB/SBC.
  2. The SLB/SBC sends the INVITE towards UAS.
  3. UAS will send 183 response messages with merged the VIA headers (including received param) after From and To header towards the SLB/SBC.
  4. The 183 should be routed to the SBC and then towards UAC.

The code is modified to set the SLB/SBC read only in the first branch param, that is what we need from top VIA and ignore the rest branch param.

Workaround: None.

38SBX-91194 | SBX-115048


2

PortFix SBX-91194: Difference in Energy/power level is observed across the SWe and HW platform.

Impact: The power of the tone generated by SWe is 3dBm0 higher than the configured value.

Root Cause: The root cause of the issue is the configuration of tonePower/amplitude at the DSP interface.

Steps to Replicate: 

  1. Configure the SBC to run LRBT (local ringback tone).
    config
    set profiles media toneAndAnnouncementProfile EXAMPLE localRingBackTone signalingTonePackageState enable
    set profiles media toneAndAnnouncementProfile EXAMPLE localRingBackTone makeInbandToneAvailable enable
    set profiles media toneAndAnnouncementProfile EXAMPLE localRingBackTone flags useThisLrbtForIngress enable
    commit.
    set addressContext default zone <IngressZone> sipTrunkGroup <IngressTG> policy media toneAndAnnouncementProfile EXAMPLE
    set profiles media toneProfile defRing generationMethod singleTone singleTone tone1Power 0 tone1Frequency 200
  2. Run a G711<=>G711 call such that the Egress Leg sends a 200 OK after some delay. During this Delay, LRBT will be played using TPAD.
  3. Capture the media on UAC and analyze the tone generated for its power.

The code is modified to properly configure the tone Power at DSP.

Workaround: Not applicable.

39SBX-105751 | SBX-115045


2

PortFix SBX-105751: There are errors in the CE_node logs.

Impact: The"ioctl: No such device" errors seen in CE_Node logs when creating VLAN interfaces on Cloud SBC or N-to-1 SBC with VLAN packet interfaces.

Root Cause: The error messages are benign, since a check is made for the VLAN existence before creating a VLAN packet interface.

Steps to Replicate: 

A. Show the issue through logs:
On Cloud SBC or N-to-1 SBC with VLAN packet interfaces, check CE_Node2.log and observe "ioctl: No such device" message for each VLAN interface.
[root@vsbcSystem-ISBC 172.16.16.39 ~]# hwinfo | grep -v "==="
Device Description : Virtual Platform
Chassis Serial : 855f41ee-68be-46c0-8e7a-9e9911a689f4
Product Name : Sonus SBC SWe
Platform : OpenStack Compute
System Memory : 10237248 kB
System Hard Disk : 80 GiB
54.7 GiB

With VLAN the interfaces configured, look for ioctl message in CE_Node logs:
[root@vsbcSystem-ISBC 172.xxx.yy.zz openclovis]# cat CE_Node2.log
Wed Sep 1 17:30:34.337 2021: Welcome to OpenClovis SAFplus Availability/Scalability Platform! Starting up version openclovis-safplus-sdk-6.0-202001031351_42f5846
This file is the standard output of all applications.
ioctl: No such device
ioctl: No such device
[root@vsbcSystem-ISBC 172.xx.xx.xx openclovis]#

B. Show the fix through logs:
CE_Node2.log does not have "ioctl: No such device". Instead DBG log file has the ioctl messages from Sma.
[root@vsbcSystem-ISBC 172.xx.yy.zz ~]# glog
[root@vsbcSystem-ISBC 172.xx.yy.zz openclovis]# cat CE_Node2.log
Wed Sep 1 20:11:19.001 2021: Welcome to OpenClovis SAFplus Availability/Scalability Platform! Starting up version openclovis-safplus-sdk-6.0-202001031351_42f5846
This file is the standard output of all applications.
[root@vsbcSystem-ISBC 172.xx.yy.zz openclovis]# grep Sma /var/log/sonus/sbx/evlog/1000016.DBG | grep ioctl
116 09012021 201307.968434:1.01.00.00115.MAJOR .SMA: *SmaIfIoctl: ioctl returned errno=19. request=35123. ret=-1.
116 09012021 201308.996176:1.01.00.00139.MAJOR .SMA: *SmaIfIoctl: ioctl returned errno=19. request=35123. ret=-1.
[root@vsbcSystem-ISBC 172.xx.yy.zz openclovis]#

The code is modified to log the benign error messages in DBG logs instead of CE_Node log.

Workaround: None.

40SBX-111034 | SBX-115050


2

PortFix SBX-111034: Unable to login as an admin user using keys after cleanDB.

Impact: User is unable to login into Confd CLI using 'admin' user private SSH key after running clearDBs.sh script.

Root Cause: Cloud-init fails to run as part of clearDBs.sh script and fails to restore SSH public key for 'admin' user.

Steps to Replicate: Run a clearDBs.sh script after launching the instance and then try to log into Confd CLI using 'admin' user private key.

The code is modified to skip the redundant port for mac address validation in the case of packet port redundancy.

Workaround: Do not run the clearDBs.sh script

41SBX-110046 | SBX-115046


2

PortFix SBX-110046: Passing a key size for unencrypted, authenticated SRTP/SRTCP to the NP.

Impact: The RTP packets drop were occurring between the DUT and SBC.

Root Cause: In the SRTP, for unencrypted, authenticated combinations, cipher key size was unable to pass to the NP and due to this session, the authentication key was incorrectly calculated.

Steps to Replicate: Test all the SRTP call flows with UNENCRYPTED_SRTP flag enabled in the SBC and UNENCRYPTED_SRTP received from UEs as part of crypto attributes.

The code is modified for the NP to calculate session authentication key.

Workaround: No workaround.

42SBX-115261 | SBX-115440


2

PortFix SBX-115261: The SBC is modifying the Warning header even when transparency is enabled.

Impact: When the SBC sends a SIP Warning header with IPv6 addresses, it does not including the square brackets around the IPv6 addresses.

Root Cause: The code for adding square brackets around an IPv6 address in a Warning header was missing.

Steps to Replicate: 

  1. On egress ipSignalingProfile, enable transparencyFlags warningHeader and relayFlags statusCode4xx6xx:

    1. set profiles signaling ipSignalingProfile DEFAULT_SIP commonIpAttributes transparencyFlags warningHeader enable

    2. set profiles signaling ipSignalingProfile DEFAULT_SIP commonIpAttributes relayFlags statusCode4xx6xx enable

Procedure
--------------

  1. Send an INVITE to the SBC that should be routed to egress endpoint.

  2. On receipt of an INVITE, respond from egress endpoint with 603 Decline including the following warning header:

    Warning: 307 [2607:fxxx:c:xxxx::xx]:xxxx "Session parameter 'foo' not understood", 399 [2607:fxxx:c:xxxx::xx]:xxxx "Robocall Block pl String 1"

  3. Verify that 603 Decline is forwarded to ingress side with the same warning header including the square brackets around both the IPv6 addresses

The code is modified to include square brackets around IPv6 addresses in a Warning header.

Workaround: None.

43SBX-110918 | SBX-113939


2

PortFix SBX-110918: The SBC 7000 is showing DSP insertion with the reason DTMF, but the DTMF should not be displayed.

Impact: The status of the following fields are not desired and contains the Junk value when running a correct amount of calls (20,000 calls):

  1. Ingress DSP reason.
  2. Egress DSP reason.

Root Cause: The following fields are not Reset when the call is terminated and as a result, the junk values are preserved in these deallocated spaces.

Steps to Replicate: 

  1. Run 20k A---B Transcoded call with ingress DSP reason as DTMF.
  2. Change the configuration to pass-through.
  3. Check the logs to see Ingress DSP reason is populated as "No DSP inserted" for a pass-through call.

The code is modified so that the junk value is not populated to the fields.

Workaround: None.

44SBX-115712 | SBX-115926


2

PortFix SBX-115712: There are SIP message relay issues in an INVITE with a replaces call flow, where an early dialog is replaced.

Impact: EarlyDialog replaces on ingress causes the SBC to fail and to send ACK out on the Egress when the e2eAck is enabled.

Root Cause: The e2eAck flag did not turn on on Ingress yet, therefore once the ingress connected, it did not notify the Egress side to send out ACK.

Steps to Replicate: Run the following configuration to reproduce the issue

  1. Set e2eAck to enabled.
  2. A calls B.
  3. B answers with a 18x message.
  4. C replaces A.
  5. B answers with a 200 OK message.

The SBC fails to send Ack to B

Update the e2eAck flag on the ingress when the query requests a reply, so that the ingress and the egress are in sync.

Workaround: Disable the e2eAck.

45SBX-113573 | SBX-115057


2

PortFix SBX-113573: The Call Media Status/ACT Log was showing media count as 0 for Ingress/Egress Packet Sent.

Impact: For the egress intercepted (IMS LI/ PC2LI) call, when the RTP monitoring and delayed RBT is configured in the PSX. The Call Media Status is showing a media count as 0 for Ingress/Egress Packet Sent.

Root Cause: For the egress intercepted (IMS LI/ PC2LI) call, when the RTP monitoring and delayed RBT is configured in the PSX. The main media along with RBT is impacted, so respective statistics are shown as zero.

Steps to Replicate: 

  1. Configure the PC2.0 LI/IMSLI for egress interception.
  2. The delayed RBT is configured for 183 with SDP with RTP Monitoring enabled on Egress Leg.
  3. An INVITE followed by a 180 without an SDP followed by 183, with an SDP followed by RTP followed by 200 OK.

When a 183 is received, the SBC plays the Delayed Ring Back Tone towards the UAC.
When a 200 OK INVITE is received, the SBC stops the Tone and does the media cut through.

The code is modified to not stop the main media along with intercepted media for the this call.

Workaround: Not applicable.

46SBX-114831 | SBX-115801


2

PortFix SBX-114831: No fallback to G711 for a fax call flow upon receipt of a 488 response.

Impact: The SBC is not sending fax fallback re-INVITE upon receiving 488 error response (for T38 re-INVITE) from UAS.

Root Cause: New code had been introduced in 8.02 of the SBC to address a few customer requirements related to the flag - bIsOlineSame flag.  None of those customer scenarios had any use cases involving Gw-Gw scenarios. There is a miss in the test coverage as a result. This new code has a missing initialization of one field that was being used for Gw-Gw scenarios, which is causing this issue.

Steps to Replicate: 

  1. Establish a call over Gw-Gw with codec negotiated as G711.

  2. Send T38 re-INVITE from UAC to SBC1.

  3. The SBC2 sends out this T38 re-INVITE to UAS.

  4. UAS responds back with 488 Not Acceptable.

  5. The SBC2 sends ACK to UAS.

The SBC2 is failing to send a fax fall back re-INVITE to UAS.

Initialization code is added for the new field.

Workaround: None.

47SBX-115742 | SBX-115829


2

PortFix SBX-115742: Follow-up fix for SBX-114771 that was a SCM core related to refreshAfter.

Impact: There is a segmentation fault in SBX-114771 due to code added to avoid hack during fast refresh in SBX-111209. As the code is reverted, the SBC is open to registration hacks during fast refresh.

Root Cause: The SIPSG code hit a Segmentation fault while sending a 200 OK response to a REGISTER because it is attempting to dereference an invalid pointer.

Steps to Replicate: Test steps are same as SBX-111209.

The fast refresh is handled in the SIPCM for any register. So the fix for the fast refresh hack is moved to the SIPCM Module.

Workaround: No workaround.

48SBX-114557 | SBX-115063


2

PortFix SBX-114557: While running a suite for a previous issue on the ASAN, the Build Number: 1252 found this issue in the SCM Process.

Impact: The "AddressSanitizer:stck-use-after-scope" while accessing the structure SIPSG_CONTACT_HDR_MEMORY_STR.

Root Cause: The SBC was trying to access the structure SIPSG_CONTACT_HDR_MEMORY_STR outside the scope that is defined.

Steps to Replicate: Run ASAN call flows.

The code is modified such that SIP_ERROR_INFO_STR structure is defined at the starting of function.

Workaround: None.

49SBX-114081 | SBX-114353


2

PortFix SBX-114081: The SecGetTlsProfileDataByName() selects a TLS profile other than the configured one.

Impact: The SBC uses the wrong TLS profile.

Root Cause: The 'lookup by name' function returned with the wrong profile.

Steps to Replicate: 

  1. Enable DBG INFO level logging.
  2. Create two TLS profiles as described in the example below:
    set profiles security tlsProfile TEST_ACCESS cipherSuite1 rsa-with-aes-128-cbc-sha
    set profiles security tlsProfile TEST_ACCESS allowedRoles server
    set profiles security tlsProfile TEST_ACCESS authClient false
    set profiles security tlsProfile TEST_ACCESS v1_0 enabled
    commit
    set profiles security tlsProfile TEST cipherSuite1 rsa-with-aes-128-cbc-sha
    set profiles security tlsProfile TEST allowedRoles clientandserver
    set profiles security tlsProfile TEST authClient false
    set profiles security tlsProfile TEST v1_0 enabled
    commit
  3. Assign a second profile to one of the sipSigPort.
  4. Send PDU through the sipSigPort used in Step 3.
  5. Check DBG log and look for error messages and compare the profile ID assigned in Step 2.

The code is modified for both TLS and DTLS profile lookup by name routines to return the requested profile.

Workaround: None.

50SBX-113592 | SBX-115071


2

PortFix SBX-113592: The [ASAN]: AddressSanitizer: stack-buffer-overflow on address 0x7fb9742c6270 at pc 0x555db61239fb bp 0x7fb9742c5fa0 sp 0x7fb9742c5f98 in.

Impact: There was a Stack Buffer overflow. 

Root Cause: The boundary check was missing before running a StrNCpyZ.

Steps to Replicate: Run the ANSI-00 ISUP INVITE-BYE SIP-I codenomicon suite.

The code is modified to prevent the overflow.

Workaround: Not applicable. 

51SBX-111460 | SBX-115067


2

PortFix SBX-111460: The SBC does not offer 16K dtmf in a LM call when SDP is present in 2xx.

Impact: The SBC is not sending 16k 2833 Payload type in initial offer towards ingress when SDP is present in 2xx during a Late media "convert" call.

Root Cause: The answer received from the egress contained both 8000 and 16000 2833 Payload type and that resulted in the SBC wrongly assigning the 8000 PT value to 16000 as well while generating offer towards ingress. As a result, the 16000 PT get dropped by SIP stack.

Steps to Replicate: 

  1. The UE initiates Late media convert call.
  2. The SBC sends out 200 answer with the below SDP:
    m=audio 1338 RTP/AVP 0 96 100 101
    a=rtpmap:0 PCMU/8000
    a=rtpmap:96 AMR-WB/16000
    a=fmtp:96 mode-set=0,1,2;mode-change-capability=2;max-red=0
    a=rtpmap:100 telephone-event/8000
    a=fmtp:100 0-15
    a=rtpmap:101 telephone-event/16000
    a=fmtp:101 0-15
    a=sendrecv

Test Result without Fix: The SBC drops the telephone-event/16000 payload type when generating offer towards ingress in 180.

The code is modified to prevent the same PT value getting assigned to both 8000 and 16000 DTMF in this call flow.

Workaround: None.

52SBX-112092 | SBX-115036


2

PortFix SBX-112092: The CallMediaStatus does not display the codec information of t38 image stream.

Impact: The SBC does not display codec as "T.38" in callMediaStatus, when the Fax/Image stream is received as a non-core stream.

Root Cause: The issue is caused because, by default, the SBC does not populate the codec information for Image streams, if an image is received as non-core stream.

Steps to Replicate: 

  1. Perform an A-B call, (Audio + Fax), where Audio is core stream and Fax is non-core stream.
  2. Check for callMediaStatus, once the call is stable.

For Fax/Image stream, the codec should be updated as "T.38".

The code is modified so the codec as "T.38" for Image stream received as non-core stream for a call.

Workaround: No workaround.

53SBX-90156 | SBX-115030


2

PortFix SBX-90156: Observed the Major logs "MAJOR .CHM: *send_notification: unknown variable name sonusAlarmNodeID".

Impact: Major logs "MAJOR .CHM: *send_notification: unknown variable name" are seen on the sbxrestart.

Root Cause: These type of logs are seen when the queued traps are flushed out but the corresponding MIBS are not loaded yet, as a result unknown variable names/faulty varbind logs are seen.

Steps to Replicate: 

  1. Spawn a OAM-MSBC setup as seen in the reported case and configure an SNMP trap target.
  2. Perform a sbxrestart on the MSBC standby node.
  3. Verify that the reported logs are not seen.
  4. Verify the timeline for enabling of northbound interface from .SYS log and the timeline for flushing of queued traps from the level log and ensure the difference between them to be >=15 seconds.

The code is modified from ConfdSnmpStartupDelay from 5 seconds to 15 seconds to introduce a buffer for the loading of the MIBS, after the Northbound interface is enabled.

Workaround: Not applicable.

54SBX-109692 | SBX-115037


2

PortFix SBX-109692: The EMS fails to send authentication token while pushing licenses to the SBC.

Impact: The EMS fails to send authentication token while pushing licenses to the SBC.

Root Cause: To validate the license bundles, the CDB API's are used and in race condition, one of the CDB API is returning unexpected value and as a result, this issue is seen.

Steps to Replicate: 

  1. Create a OAM/SLB cluster and bring up up nodes in this cluster.
  2. Navigate Administration-> License Management-> Nodes.
  3. Select the node and select few licenses and click on set selected.

Expected result: The license should get associated.

Observed result: Receiving an error pop up saying "SBCRestManager - Received error code 400".

The code is modified to validate the license bundles instead of CDB API’s.

Workaround: Not applicable.

55SBX-114273 | SBX-114330


2

Portfix SBX-114273: The SBC is sending unexpected UPDATE towards UAS in Support Preconditions Interworking on SIP CORE scenario. (tms927936).

Impact: An additional UPDATE is seen towards the egress endpoint during egress precondition interworking scenario.

Root Cause: An internal bug fix used to mitigate the egress SIP UPDATE is not being delivered to the endpoint during precondition transparency. This created a side effect of sending additional UPDATE towards egress during egress precondition interworking scenario.

Steps to Replicate: 

  1. Configure the SBC for a basic call.
  2. Configure the Egress precondition interworking related settings.
  3. Run an egress precondition call flow.

While releasing the UPDATE, additional conditions have been added to correctly identify the scenario which needs UPDATE to be sent to the egress endpoint

Workaround: Not applicable.

56SBX-109059 | SBX-115039


2

PortFix SBX-109059: The SIPSG FAX multiple streams initiated fax call fails (muted T.38 and audio)

Impact: The multi-stream fax call is failing with muted T38 and audio.

Root Cause: There is a mismatch in the media streams of the SBC offer and the peer answer. Due to this, the images media stream received from UAS is mapped incorrectly to the audio stream in the SBC offer. This is happening when advertise audio only flag is enabled.

Steps to Replicate: 

  1. UAC sends an INVITE with Audio and Image.
  2. The SBC sends an INVITE with Audio to UAS due to Advertizeaudio flag is enabled.
  3. UAS responds 200 OK with Audio and call gets connected as audio.
  4. UAS sends re-INVITE with Image.
  5. The SBC sends a re-INVITE with both Audio and Image muted causing call teardown.

The code is modified so the SBC maps the media streams in offer and answer correctly when advertise audio only flag is enabled.

Workaround: None.

57SBX-113096 | SBX-115042


2

PortFix SBX-113096: The RTP inactivity timer kicks in during tone play.

Impact: With a short RTP inactivity timeout configuration (five seconds in the test), the SBC generated RTP peer loss trap when the ringback tone was being played during the call setup procedure (after the SBC receiving 180 and before the final 200 OK for the INVITE completed the call setup).

Root Cause: The RTP peer loss detection was enabled on the media flow in media plane while ringback tone was being played.

Steps to Replicate: Procedure:

Configure "media peer inactivity timeout" value in the "Packet Service Profile" entry in PSX to five seconds.
Configure the DLRBT.
Configure "Peer Absence Action" as "Trap and Disconnect" in the PSP.

  1. Send INVITE with SDP(PCMU)from A.
  2. Send from B 180 with SDP.
  3. Send PRACK from A and respond with 200 OK for PRACK from B.
  4. Do not send any RTP from A & B.
  5. Send 200 OK for INVITE from B and send ACK from A.
  6. Do not send any RTP from A & B.

Observed at Step 4, when tone was being played RTP inactivity was detected and the call was torn down.

Disable the media flow RTP peer loss detection when the ringback tone is played.

Workaround: No workaround.

58SBX-112547 | SBX-112954


2

PortFix SBX-112547: The SBC routes call to 2nd DNS record if 503 is received after 18x.

Impact: The SBC routes an INVITE to next DNS record if 503 is received after 18x.

Also, even when the dnsCrankback flag is disabled, on getting 503/INVITE timeout case, the SBC reroutes an INVITE to next DNS record.

Root Cause: Due to a design defect, the SBC tries the next DNS record even if an error response is received after an 18x.

Also, retrying the next DNS record during a 503/timeout when dnsCrankback flag is disabled is legacy behavior. This behaviour is changed to retry the next DNS record only when the dnsCrankback flag is enabled.

Steps to Replicate: 

  1. Configure the DNS server with two routes for the FQDN route.
  2. Make an A-to-B call.
  3. The SBC sends an INVITE to first DNS record of and B sends 18x and the 503.

The code is modified to not apply the DNS crankback procedure if an error response is received after a 18x. Additionally, the default behavior of handling timeout/503 when the dnsCrankback is disabled is updated as part of this fix.

With this fix, the SBC retries for the next DNS record only when dnsCrankback is enabled to ensure the error responses match the reasons configured in the crankback profile.

Workaround: None.

59SBX-115370 | SBX-115517


2

PortFix SBX-115370: The SBC is unable to generate UPDATE message towards the UAS for the 183 dialog-3, during the call forwarding scenario.

Impact:  The SBC is unable to generate the Update towards the ingress side during a Prack 200 OK delay scenario.

Root Cause: The Update is queued in a 200 OK delay Prack scenario. The queue Update is never released.

Steps to Replicate: 

  1. Bring the Application up in the SBC.
  2. Set up the SBC to run the Transparent precondition interworking and downstream forking scenario.
  3. Run a multiple 18x scenario with a delay in the Prack 200 OK response.

The code is modified to release the queued Update in the 200 OK Prack Delay Scenario.

Workaround: None

60SBX-111176 | SBX-115051


2

PortFix SBX-111176: No media was seen during tone play with the LRBT when the DPM for tone is changed from inactive to sendrecv from an ingress peer with an UPDATE.

Impact: An initial INVITE is received with the c=0.0.0.0 connection media IP and datapathmode a=inactive in the SDP. With an LRBT enabled, when the client/ingress endpoint sends an Update with non-zero c=<valid IP> and datapathmode a=sendrecv, the remote media IP maintained in the ingress call leg was being overwritten with zero IP though a valid non-zero IP was received in Update.

Without a valid remote IP, tone packets will not be generated by the SBC.

Root Cause: After the UPDATE is received, the new non-zero remote IP is updated to the circuit information maintained on the ingress call leg as part of a modify request in tone context.

However, an additional allocation request was also triggered to start the tone play with the old zero remoteIp 0.0.0.0 that was overwriting the valid remoteIp and tone play was disabled.As a result, the datapathmode has changed to sendrecv and valid remoteIP is received with the latest UPDATE from a remote endpoint.

Steps to Replicate:Run the following call flow to replicate the issue:
INV(a=inactive)->
INV(a=inactive)->
<-180(no sdp)/prack/200 OK
180(a=inactive)/Prack/200 OK<-
<--x-no media for tone as expected
Update(a=sendrecv)
->200 OK(a=sendrecv)
<-no media for tone though DPM changed to sendrecv

The code is modified to prevent an existing non-zero valid remoteIp saved in call leg circuit info from being overwritten by zero remote IP during a tone play.

Workaround: None.

61SBX-114728 | SBX-115065


2

PortFix SBX-114728: The SBC did not send Terminating IOI value in P-Charging-Vector header for 183, 180, BYE, and 200 OK.

Impact: The SBC was not sending the Terminating IOI value in P-Charging-Vector header for 183, 180, 200 OK, and BYE toward the ingress.

Root Cause: The SBC should add term-ioi in PCV header when the term-ioi is configured, irrespective of whether the operator Id is configured or not.

However, due to recent code changes, this functionality was broken and when the operator Id is not configured the SBC was not copying term-ioi value in PCV properly.

Steps to Replicate: Run the SBC configuration:

  1. Configure the PSX scripts under the psxScriptProfile CLI command:
    Set profile signaling psxScriptProfile <pspname> scriptName1 ATT.xml scriptName2 <name2> scriptName3 <name3>
  2. Associate the psxScriptProfile to the TrunkGroup
    set addressContext <acname> zone <zonename> sipTrunkGroup <tgname> signaling psxScriptProfile <pspname>
  3. Configure the tonepackage having toneProfile as DefaultRingBack and DefaultDialTone.
    set profiles media tonePackage <TonePackagename> packageId <Id> toneType dialtone toneProfile defDial
    set profiles media tonePackage <TonePackagename> packageId <Id> toneType ringbacktone toneProfile defRing
  4. Ensure the 100rel support is enabled
    set addressContext default zone <Ingress_Zone> sipTrunkGroup <IngressTG> signaling rel100Support enabled
  5. Run the preconditionIntwkUsing183 enabled on ingressTG
    set addressContext default zone <Ingress_Zone> sipTrunkGroup <Ingress_TG> services preconditionIntwkUsing183 enabled
  6. Configure term-ioi parameter in the SIP signaling service group
    set addressContext <acname> zone <zonename> sipTrunkGroup <tgname> signaling termIOI <termioiname>


Run the PSX configuration:

  1. Precondition Profile PP_ACCESS associated to Ingress TrunkGroup config:-
    * Preconditions Support If Egress IPTG:disabled
    * Preconditions Strength Mandatory: Policy: enabled ; Priority: 1
    * Preconditions Strength Optional: Policy: disabled ; Priority: 1
    * Use UPDATE when Signaling Preconditions Locally Met:Policy: disabled ; Priority: 1
  2. Configure the RoutingLable with the customer script for terminating the call at PsxScriptProfile

The customer script should be configured with DefaultDialTone and DefaultRingBackTone profiles.

Run the following call:

  1. Make a call that matches the routinglable configured previously with offer having the precondition attributes as follows:
    a=curr:qos local none
    a=curr:qos remote none
    a=des:qos mandatory local sendrecv
    a=des:qos mandatory remote sendrecv
    INVITE should contain : P-charing vector header with orig-ioi.
  2. Verify that the SBC sends p-charing vector with term-ioi in 18x response to ingress EP.

The code is modified to send term-ioi when it is configured without having dependency on the operator Id.

Workaround: None.

62SBX-111609 | SBX-115028


2

PortFix SBX-111609: The GCID value of '100 Trying" sent is logged with value '0xffffffff' in POST-SMM SMM L4 Trace.

Impact: The POST-SMM Level 4 trace log for 100 Trying has GCID incorrectly set to 0xffffffff.

Root Cause: Level 4 call trace is active with a configuration to match 100 Trying and a SMM rule is applied that modifies 100 Trying.

Steps to Replicate: 

  1. Configure a Level 4 call trace to match all messages.
  2. Configure a SMM rule to modify the 100 Trying sent by the SBC.
  3. Make a SIP-SIP call.

The code is modified so that the correct GCID value is printed in both PRE and POST-SMM traces.

Workaround: None.

63SBX-112363 | SBX-115033


2

PortFix SBX-112363: [ASAN]: runtime error: member access within null pointer of type 'struct CC_SG_PROGRESS_UIND_MSG_STR' in CcSgProgressHndl.

Impact: Run a basic Update CallModification scenario. After the call was completed, the ASAN runtime error is observed in the system logs indicating that the code is taking the address of a field within a NULL pointer.

Root Cause: When a Call Progress message is received from the network, the code was taking the address of a field within the NULL pointer.

Steps to Replicate: Run an update CallModification scenario.

The code is modified to validate that the pointer is not null taking the address of a field within the pointer.

Workaround: No workaround.

64SBX-113839 | SBX-114138


2

PortFix SBX-113839: The customer setup is going for continuous reboot after upgrading (Stack Delete and Create) from 8.2.2R7 and 8.2.2R8 to 10.1.

Impact: The SWe_NP process exits during DPDK ACL tries to build operation causing the SBC to go for reboots.

Root Cause: postgres process is eating up significant number of huge pages from the quota allocated for SWe_NP. As a result, SWe_NP runs short of huge pages for DPDK ACL trie build operations and exits.

Steps to Replicate: 

1. Bring up a SBC instance with 10.1 release.
2. Apply the same customer configuration. (primarily having same set of ACLs)
3. Verify that the SBC is stable after the configuration.

The code is modified to restrict the postgres process from consuming huge pages.

Workaround: Increasing number of huge pages could be a possible work around.

65SBX-112163 | SBX-115054


2

PortFix SBX-112163: [ASAN]: AddressSanitizer: stack-use-after-scope on address 0x7f7e3d1a4510 at pc 0x55cec34efba0 bp 0x7f7e3d1948a0 sp 0x7f7e3d194898 in SipsPSFormatErrorInfoHeaderCmd.

Impact: ASAN detected "AddressSanitizer:stck-use-after-scope" while accessing the structure SIP_ERROR_INFO_STR.

Root Cause: The SBC was trying to access the structure SIP_ERROR_INFO_STR outside the scope that is defined.

Steps to Replicate: Run a call with initial INVITE having no contact header.

The code is modified such that SIP_ERROR_INFO_STR structure is defined at the starting of the SipsTSParseMsgCmd function.

Workaround: None.

66SBX-114373 | SBX-115062


2

PortFix SBX-114373: The S-SBC is generating an extra UPDATE towards UAC for 3rd 183 dialog during downstream forking scenario

Impact: An additional UPDATE was seen towards ingress endpoint during downstream forking with multiple dialog scenario.

Root Cause: When simultaneous 183 messages from different dialog is received, the SBC queues the second 183 message. This is released after the completion of precondition or offer-answer negotiation for current dialog. Due to a previous fix, there were changes introduced in this framework that causes the early release of 183 message, thereby inducing issues in the OA FSM.

Steps to Replicate: 

  1. Run a customer call scenario.
  2. Run the scenario with SIP_FW.
  3. Respond to the INVITE with 183 (Dialog-1) from UAS.
  4. Send an UPDATE from UAC, by updating the precondition attributes.
  5. Respond to the UPDATE message with the 200 OK from UAS.
  6. Send back two back-to-back 183(Dialog-2) and 183(Dialog-3) from UAS. The SBC sends an UPDATE message to UAC for the Dialog-2.
  7. Once precondition done for 183 (Dialog-2), the SBC generates a UPDATE for 183 (Dialog-3).
  8. Respond to the UPDATE message from UAC and complete the preconditions for 183 dialog-3 from UAC.
  9. The SBC generates the UPDATE towards the UAS, Send the 200 OK for that UPDATE and complete the preconditions.
  10. Send 200 OK with the Dialog-2 from the UAS.

The call should be established.

The code is modified so the 183 message is released correctly before releasing the second 183 message. 

Workaround: None.

67SBX-110891 | SBX-115027


2

PortFix SBX-110891: The 'gzip' should run with a nice value of >15 for lesser resource consumption.

Impact: The SBC performance monitoring tools like top2 at times take a large percentage of CPU core, there by reducing the total available CPU resources for management activities on the SBC.

Root Cause: The gzip, that compress files, currently runs periodically without any Linux value configured.

Steps to Replicate: Install the fix build and ensure top2 gzip processes are running with a correct value of 15 using top2 command.

The code is modified to reduce the priority of processes compared to other management processes on the SBC.

Workaround: None.

68SBX-110324 | SBX-115049


2

PortFix SBX-110324: The SBC fails to set up a DTLS-SRTP call if dtlsProfile --> CertName is configured with a local-internal certificate. The call works correctly if a "local" certificate is used.

Impact: When local-internal type certificate is configured from the EMA, the certificate is updated in the SAM process correctly but not updated in the PRS process. As a result, the DTLS SRTP calls are unable to get certificate and the call fails.

Root Cause: When local-internal type certificate is configured from the EMA, the certificate is updated in the SAM process correctly but not updated in the PRS process. As a result, the DTLS SRTP calls are unable to get certificate and the call fails.

Steps to Replicate: Configure the local-Internal type certificate from EMA and make DTLS_SRTP call.

DTLS_SRTP connection will fail because of certificate not being available.

The code is modified to read the certData from DB and update x509 when pki certificate state is enabled.

Workaround: After configuring a certificate from the EMA, perform an SBC restart. This restores the certificate from DB and the DTLS_SRTP call is successful.

69SBX-108416 | SBX-115059


2

PortFix SBX-108416: Importing of local and remote certificates on the Cloud SBC platforms requires .der and .p12 to be placed on both the active and standby nodes. This is not the case for HW and VMware SBC platforms.

Impact: On cloud 1:1 HA, importing of TLS certificate failed on the STANDBY.

Root Cause: Importing of local and remote certificates on the Cloud SBC platforms requires .der and .p12 to be placed on both active and standby nodes. This is not the case for HW and VMWare SBC platforms.

Steps to Replicate: 

  1. Bring up 1:1 on cloud.
  2. Import certificates on the Active instance and configure for TLS calls.
  3. Make calls to the active instance.
  4. Perform a switchover.
  5. Make calls to instance that become active.

Expected Result:

  1. Check configuration is successful.
  2. TLS calls on active and standby should be successful.

The code is modified to update the HW and VMware SBC platforms similar to H/W for cloud 1:1 HA and N:1.

Workaround: Configure the certificate on both instances.

70SBX-114618 | SBX-114960


2

PortFix SBX-114618: The SBC did not send Terminating IOI value in P-Charging-Vector header for BYE message and STOP CDR record (69.30 field).

Impact: The SBC did not send Terminating IOI value in P-Charging-Vector header for BYE message

Root Cause: Upon receiving a 200 OK, the SBC is not saving term-ioi, there by causing this issue.

Steps to Replicate: 

  1. Bring up SBC with the 10.1 Release.
  2. Configure the P-Charging-Vector related configuration.
  3. Send term-ioi in the 200 OK Response.

The code is modified to save the term ioi in a 200 OK Response.

Workaround: we can try adding missing term-ioi by SMM.

71SBX-110245 | SBX-115060


2

PortFix SBX-110245: The AddressSanitizer: heap-use-after-free /sonus/p4/ws/jenkinsbuild/sbxAsan100/marlin/SIPSG/sipsgMsgProc.c:7097 in SipSgProcessNrmaUpdateNfy(SIPSG_CONTEXT_STR*, nrma_update_nfy_msg_str*)

Impact: The ASAN detected "AddressSanitizer: heap-use-after-free" while accessing SG_CCB_STR pointer.

Root Cause: The SBC was trying to access the SG_CCB_STR pointer that is already been freed.

Steps to Replicate: Run a basic call where ICID value of P-Chargingector header in INVITE message is NULL or absent.

The code is modified to check the pointer is null or not before accessing it.

Workaround: None.

72SBX-109808 | SBX-115073


2

PortFix SBX-109808: [ASAN] SBC: Scm process gave ERROR: AddressSanitizer: heap-use-after-free on address 0x6150000d6488 at pc 0x5585e065bdec bp 0x7f3900ad0e10 sp 0x7f3900ad0e08 on the SBC standby.

Impact: The ASAN error is coming on the standby SBC when the standby is going down anyway.

Root Cause: Packet collector is checking requests queue when system is shutting down.

Steps to Replicate: Run the same scenario again and check that ASAN error is not seen now on standby MRFP

The code is modified to not check the requests queue when system is going down.

Workaround: None.

73SBX-114184 | SBX-114519


3

PortFix SBX-114184: The SMM store/regstore/regsub SMM operations add an extra CRLF if the operation is executed against a header that contains a SIP URI.

Impact: The SMM inserted double EOL after using regex for header value operations.

Root Cause: After modifying the header value, the SMM logics did not strip off EOL. As resulted when it try to format back, additional EOL was inserted.

Steps to Replicate: An incoming message has invalid from header syntax
From: "phoneLite" <sip:1245@son.com;tag=legA
Use regsub to add missng '>' after .com.

set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 criterion 1 type message
set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 criterion 1 message messageTypes request
set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 criterion 1 message methodTypes invite
set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 criterion 1 message condition exist
set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 criterion 2 type header header name From condition regex-match regexp string > numMatch notmatch
set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 action 1 type header operation regsub
set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 action 1 regexp string ";tag"
set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 action 1 from type value value ">;tag"
set profiles signaling sipAdaptorProfile FIX_MISSING_GT rule 1 action 1 to type header value From
set profiles signaling sipAdaptorProfile FIX_MISSING_GT state enable
commit

The code is modified to address the issue. 

Workaround: No workaround.

74SBX-112706 | SBX-113554


3

PortFix SBX-112706: The SBC populates the NOTIFY XML body using pre-SMM INVITE PDU for outgoing messages.

Impact: The SBC was using pre-SMM outbound INVITE PDU for populating the XML body of NOTIFY for the Call Notification feature in the XML Metadata body of the SIPREC INVITE.

Root Cause: The SBC considers pre-SMM outbound INVITE PDU instead of the post-SMM PDU for SIPREC and call Notification features.

Steps to Replicate: 

  1. Enable the Call Notification feature (or SIPREC recording on egress TG).
  2. Configure SMM profile for outbound messages on egress TG.
  3. Make a basic call.

Observation: The SBC should use post-SMM outbound INVITE PDU for populating XML body of NOTIFY for Call Notification feature (and for SIPREC INVITE).

The code is modified to consider the post-SMM outbound INVITE PDU for populating the XML body of NOTIFY for the Call Notification feature and SIPREC.

Workaround: Not applicable.

75SBX-108326 | SBX-115047


2

PortFix SBX-108326: The SBC sends ACK with "a=inactive" when PRACK is enabled only on ingress leg and an outgoing INVITE towards the egress leg that does not have offer, and 18x towards ingress that has offer based on the configuration flag "Sdp100relIwkForPrack" scenario.

Impact: The SBC is not triggering a re-INVITE after sending ACK with "a=inactive" on the egress side for an asymmetric PRACK interworking scenario.

Root Cause: Since the SBC creates the offer SDP internally, 18x is sent with "a=inactive" on the ingress side. The SBC sets the datapathmode as inactive on the egress side.

So even after receiving a 200 OK with "a=sendrecv". it sends ACK with "a=inactive".

Steps to Replicate: 

  1. Late media pass-through call and PRACK is supported only on the ingress leg.
  2. Send Invite without SDP offer from ingress side.
  3. Send 18x without SDP offer from egress side.
  4. After receiving 18x with SDP, respond with PRACK from ingress side.
  5. Send 200 OK from egress side with SDP "a=sendrecv".
  6. Respond with 200 OK with ACK on the ingress side.

The code is modified so the SBC creates offer and sends in 18x on the ingress side.

On the egress side, after receiving 200 OK with "a=sendrecv",
ACK is sent with "a=inactive".

So a fix is given to send a re-invite on egress side with "a=sendrecv".

Workaround: Not applicable.

76SBX-115476


2

The SBC fails to send ACK in the Re-invite call flow when E2E ACK and E2E re-Invite flags are enabled.

Impact: E2eAck not working after Invite with a replace.

Root Cause: Currently, the E2eAck configuration is applicable only on egress leg. After receiving an Invite with replace (ingress legC), legC does not support e2eAck.

Steps to Replicate:

  1. A calls B, C replaces A.
  2. C re-Invite to B.
  3. The Ack from C fails to trigger the SBC to send Ack to B.

The code is modified to address the issue.

Workaround: Disable the e2eAck.

77SBX-116421


2

flexiblePolicyAdapterProfile breaks transparency in GW-GW scenarios.

Impact: A SMM with action flexiblePolicy assigned at the ingress trunk group may break SIP header transparency for SIP-GW-GW-SIP calls. SIP headers are not sent transparently to the egress SIP peer.

Root Cause: The SBC is unable to pack and send flexible routing headers to the GW-GW call leg. As a result, all SIP headers where the transparency is enabled, are not relayed.

Steps to Replicate: Enable the flexiblePolicyAdapterProfile and enable either "Unknown Header transparency" in the egress IP signaling profile or configure the egress transparencyProfile with transparency for all headers.

Make a SIP-GW-GW-SIP call and observe that the headers are not relayed.

The code is modified to ignore when packing the transparency content.

Workaround: Disable the SMM flexible routing.

78SBX-116551


2

Memory leak in the PES process. 

Impact: The PES Process has leaking memory.

Root Cause: In Postgres searching result object was not properly cleared for TRUNK.

Steps to Replicate: To reproduce the issue, attempt to make call loads that Trunkgroup has ZZPROFILE assigned.

To test the fix, do the same.

The code iis modified to clear the search result object.

Workaround: Use a Trunkgroup without ZZPROFILE should help.

79SBX-113053


2

There was a race condition when the 183 and 200 OK (INVITE) are received simultaneously. The 200 OK is not relayed to the other side.

Impact: After a 200 OK (UPDATE) received followed immediately by receipt of 183 Session progress, the subsequent 200 OK (INVITE) containing P-Early-Media header is queued indefinitely at egress when downstreamForking is enabled and earlyMedia forkingBehaviour is pemPriority.

Root Cause: There was a race condition between internal processing of the 200 OK for an UPDATE and a received 183 Session Progress.

Steps to Replicate: Set up the Egress SIP trunk group has downstreamForking is enabled and earlyMedia forkingBehaviour is pemPriority.

Make a call so that egress signaling is as follows:
--> INVITE (with SDP and P-Early-Media: supported)
<-- 100 Trying
<-- 183 Session Progress (with SDP and no P-Early-Media)
--> PRACK
<-- 200 OK (for PRACK)
--> UPDATE (with SDP)
<-- 200 OK (for UPDATE with SDP)
<-- 183 Session Progress (no SDP but P-Early-Media: sendrecv)
--> PRACK
<-- 200 OK (for PRACK)
<-- 200 OK (for INVITE) (This message gets queued forever)

The code is modified to eliminate the race condition.

Workaround: None.

80SBX-112483


2

After call transfer 7000 fails to send media stream to new term resulting in dead air to term end - ingress in fax mode.

Impact: If the call is in fax mode and if a Re-INV is received with new media address then the SBC is not sending RTP to the new media address. Instead, it is sending RTP to the old media address.

Root Cause: When the call is in fax mode and if the SBC receives a Re-INV from the peer, then it responds locally with 200 OK SDP to the peer. The current logic was not checking for any change in the media address received in the re-INVITE. Hence, the SBC was sending RTP to the old media address.

Steps to Replicate: 

  1. Call is established between A and B with codec PCMU.
  2. User A initiated a fax a re-INVITE and the call is transitioned to fax.
  3. User B initiates a re-INVITE with change in IP/Port.

The code is modified so that when the call is in FAX mode and if any re-INVITE is received from the peer, then the SBC compares the media addresses. If there is any change in it, then it starts a modify offer-answer cycle to get this new media address updated.

Workaround: None.

81SBX-114948


2

Post 9.2.3 upgrade, the T.38 has faxing issues.

Impact: Customer experienced some fax failures after moving to 9.2 from 7.2 release.

Root Cause: Inspection of Traces from field supplied by customer shows this file has 3 DCS and TCF packet captures, and the packets are large with a payload of 176 bytes of V.29-9600.

The root cause is that T.38 stack gets stuck in generating a very long TCF instead of 1.5 seconds long, resulting in a fax failure.

Steps to Replicate: For test steps refer to unit test for this JIRA and test files loaded in the JIRA.

The code is modified to address the issue.

Workaround: Increase the Maxdatagram size to 72 instead of 176. This was tried by customer and found to work. However, this setting is on the peer T.38 device and not always available.

82SBX-114352


2

One way audio when a call starts as a=recvonly and RTP NAT learning completes before the call is switched to a=sendrecv. This happens with RTP coming from port number 5004 or 5006 only.

Impact: The RTP NAT learning completes while the call is in a=recvonly mode (SBC is in receive-only mode). Once the called party switches the call to a=sendrecv mode, the XRM stays in rcv-only instead of switching to duplex. This is why the SBC does not send any RTP packets towards the endpoint that is behind NAPT and the endpoint doesn't receive any audio.

Root Cause: Port 5004 is defined as LOOPBACK_IP_PORT in the SBC and being used for NAPT. When RTP is coming on port 5004, NAPT re-learning will not be completed. If NRMA is waiting for NAPT re-learning to complete before changing rtpMode to duplex, then one way audio occurs.

Steps to Replicate: Configure the SBC as:

  1. The ingress endpoint is behind NAPT, media NAT learning is enabled on the ingress sipTrunkGroup.
  2. The called party answers the call as "recvonly" and switches to "sendrecv" by sending a re-INVITE.
  3. The ingress endpoint sends RTP packets from the UDP port number 5004.

The code is modified so that when RTP is coming on port 5004, the NAPT re-learning is completed and the rtpMode updates as expected.

Workaround:Change the endpoint configuration and/or the NAT device configuration so that the SBC receives RTP packets from the UDP port numbers other than 5004 and 5006.

83SBX-112119


2

The SBC is timing out when creating a route through the EMA.

Impact: The SBC is timing out when creating a route through the EMA

Root Cause: While creating route current system is fetching all the created routes. Due to this issue, the timeout issue is caused as a result.

Steps to Replicate: Getting an "Error Saving From Details, TimeoutError: timeout has occurred" while creating a route through the EMA.

The code is modified to address the issue. 

Workaround: No workaround.

84SBX-114722


2

There was a SCM Process core in SipSgIsEgressPrecondUpdateEnabled.

Impact: There was a SCM Process core in SipSgIsEgressPrecondUpdateEnabled. The core occurs when the SBC receives a NULL to function SipSgIsEgressPrecondUpdateEnabled().

Root Cause: The core occurs when the SBC receives a NULL to SipSgIsEgressPrecondUpdateEnabled(pvApplHandle=0x0) and inside that function, the SBC dereferences the NULL pointer.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to address the issue.

Workaround: None.

85SBX-114725


2

The MIME part headers do not pass over a GW-GW with body transparency.

Impact: In the GW-GW call when the PIDF MIME body parts are passed over a GW-GW with the SBC body transparency enabled, the MIME part headers other than Content-Type are not passed.

Root Cause: The code for packing unknown headers in first gateway and code for unpacking it at second gateway was absent.

Steps to Replicate: 

  1. Enable transparency for PIDF body at ingress side (Gateway 1).
  2. Run GW-GW call sending PIDF MIME Content with unknown content header "content -ID" from ingress.
  3. Check logs at Gateway 2 to verify the unknown headers in MIME are relayed to Gateway 2.

The code is modified to address the issue.

Workaround: No workaround.

86SBX-114020


2

A core dump occurred on a Standby SBC 5210 after a healthcheck failure - ENM Deadlock - while attempting register with the EMS.

Impact: Running multiple registers and deregisters of a high availability SBC pair, in a rare case can cause the standby SBC to core dump and restart.

Root Cause: The code on the standby SBC for processing the delete of an SNMP trap target can potentially cause a core dump.

Steps to Replicate: Internal code debugging mechanisms were used to verify that create and delete of SNMP trap target processing code is bypassed on the standby SBC.

The code is modified to bypass the processing on a standby SBC.

Workaround: None.

87SBX-116431


2

The events in the NRMA logging are not printed to the TRC.

Impact: Some NRMA call trace log entries are missing.

Root Cause: The complete set of NRMA call trace log entries are only generated if the oam eventLog typeAdmin debug filterLevel is set to info or the NRMA subsystem has infoLogState enabled.

Steps to Replicate: 

  1. Set debug log filterLevel to info.
  2. Configure a call trace filter to match a call.
  3. Make the call.
  4. Set debug log filterLevel to major.
  5. Make the call.
  6. Compare the two traces.

The code is modified to decouple the generation of NRMA call trace logs from the filtering of debug logs.

Workaround: None.

88SBX-115002


2

There is a SIPSG sync failure after both nodes update to 9.2.

Impact: There is a SIPSG sync failure with this message:

MAJOR .EVLOG: SYS ERR - Error 0x3a3c Line 6304 File /sonus/p4/ws/jenkinsbuild/sbx923R0fix/marlin/SIPSG/sipsgRedund.c.

Root Cause: The SIPSG is failing to sync Registration data.

The failure is due to the fact that the buffer that is allocated for mirroring the Registration data is not large enough.

This is because the structures have grown over time and no longer fit in the allocated memory.

Steps to Replicate: Enable this configuration:
set oam accounting admin eventAcctState enabled
Include five Contact headers

Look for this message in the logs:
MAJOR .EVLOG: SYS ERR - Error 0x3a3c Line 6304 File /sonus/p4/ws/jenkinsbuild/sbx923R0fix/marlin/SIPSG/sipsgRedund.c.

Increase the amount of memory for the message that is used for mirroring the Registration data to address the issue.

Workaround: It may be possible to avoid this issue by disabling the following configuration parameter:
set oam accounting admin eventAcctState enabled

89SBX-116728


2

Failed to create LIF when applications are starting up.

Impact: Failed to create a LIF when an application starting up.

Root Cause: The LIF name, IPIF_pkt1b, was used in 2 different address contexts which is not allowed.

Steps to Replicate: 

1. Configure two LIFs with the same name in two different address context.
2. Start the application.
3. Check the DBG log.

The code is modified to validate LIF's name against assigned address context and log a detailed major DBG message when finding the bad configuration.

Workaround: No workaround.

90SBX-116747


2

No audio in STUN/ICE/DTLS calls and the SBC ignoring DTLS Client Hello requests

Impact: There is no audio in STUN/ICE/DTLS calls.

Root Cause: During the process of BIND response message, ICE FSM did not verify the remote IP address against stored nominated candidate's IP address. So when the SBC received the response message from a different remote entity other than the nominated candidate, ICE FSM overwrites RTP candidate and notified NRMA with the different remote IP and caused the issue.

Steps to Replicate: 

  1. Establish STUN/ICE/DTLS call with two candidates.
  2. Check the audio.

The code is modified to check the remote IP address in the response message. If the remote IP address is different from stored nominated candidate's IP address, log a debug message and drop the response.

Workaround: N/A

91SBX-113807


3

The CIN-5400-PJ Application is restarting every 30 minutes.

Impact: The CIN-5400-PJ Application is restarting every 30 minutes.

Root Cause: The CPX process does not respond within 180 seconds to the confd process because the CPX process received a malformed response from the TRM process on a show addressContext zone trunkGroupStatus request.

Steps to Replicate: Perform an snmpwalk on addressContext zone trunkGroupStatus
Observe that the SBC does not shutdown.

If the TRM response has a cpxIndex of 0, respond to confd immediately with an error to address the issue.

Workaround: Do not run an SNMP getnextrequest on addressContext zone trunkGroupStatus

92SBX-112808


3

Serial Number display issue in the EMA, Azure

Impact: In a virtual cloud HA setup, the Serial Number displayed in EMA is incorrect.

Root Cause: In a virtual cloud HA setup, the EMA was using the serial number of the standby node instead of active node and the same was displayed in the UI.

Steps to Replicate: In a virtual cloud HA setup, log in to the EMA.

The serial number should be displayed.

The code is modified to retrieve the serial number of the active instead of standby node.

Workaround: None.

93SBX-112252


3

The Verstat parameter is coming before the CPC in PAI header that is not in lexicographical order.

Impact: In the SIP P-Asserted-Identity header, in the TEL URI, the verstat parameter appears prior to the CPC parameter.

Root Cause: Order of parameters in P-Asserted-Identity header was not in lexicographical order.

Steps to Replicate: Make a SIP-SIP call.

Egress SIP trunk is configured with JJ9030 interworking profile flavor jj9030.

IP Signaling profile for egress trunk has "Include CPC Information" checked.

IP Signaling profile for egress trunk has "Include Privacy" checked.

The code is modified so the CPC appears first.

Workaround: None.

94SBX-113355


3

The SBC does not change the status of the certificate from "SUCCESS" to "FAILED" when the certificate expires.

Impact: The SBC CLI and EMA display the status of the certificate as "SUCCESS" for certificates that expired and are no longer valid.

Root Cause: The SBC did not update the certificate status to "FAILED" although the SBC detected the certificate expiry.

Steps to Replicate: 

  1. Create a PKI certificate object and import a certificate that's going to expire soon.
  2. Once the certificate expires, use the "show table system security pki certificate" command to check its status.

The code is modified so that the status of expired certificates is updated from "SUCCESS" to "FAILED" upon a certificate expiry.

In addition to the code changes, the "expired" status is added to the pki > certificate > status statistic in the Security table on the page Show Table System.

Workaround: No workaround.

95SBX-114944


3

The SBC does not add "term-ioi" to the PCV of the SIP 503 response when the SIP 503 response is caused by the TG being blocked.

Impact: The SBC does not add the "term-ioi" parameter to the PCV header of the SIP 503 response when the SIP 503 response is caused by the ingress TG being configured with "blockDirection: incoming".

Root Cause: The code that would update the term-ioi parameter in case the TG is blocked was missing.

Steps to Replicate: 

  1. Make a SIP-SIP Japan call setup.
  2. Configure a sipJJ9030InterworkingProfile with sipFlavor as JJ9030 along with origIoi and termIoi.
  3. Attach sipJJ9030InterworkingProfile to the ingress TG.
  4. Set the ingress TG's flag "blockDirection" to "incoming".
  5. Make the call and check the presence of the term-ioi paramter in the PCV header of the outgoing SIP 503 response.

The code is modified to update the term-ioi in a call control block from locally configured sipJJ9030InterworkingProfile.

Workaround: No workaround.

96SBX-115603


3

There was a SCM process coredump in SipSgRecFormSipRecSDP.

Impact: The SCM process core in SIPREC code after a switchover.

Root Cause: The SIPREC code is attempting to dereference a NULL pointer.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to prevent the attempt to dereference a NULL pointer.

Workaround: There is currently no workaround.

97SBX-113733


3

The SBC SWe with larger disks get stuck at boot after reset or powercycle.

Impact: When an SBC on SWe is powered off, without soft shutdown, on reboot system goes into emergency mode and waits for user input on console.

On the VMWare, it hangs forever.
On the KVM, when user hits Enter the system boots up.

Root Cause: On reboot after unclean shutdown, the systemd-root-fsck service runs to chec root file system.

When the root file system is large (>200GB), it takes more than 90 seconds (default service start time) to start file system check and subsequent devices' file system checks mentioned in /etc/fstab fail pushing the system into emergency mode.

Steps to Replicate: 

  1. Install the SBC on the SWe.
  2. Wait for the system to boot and the SBC app to be up and running.
  3. Reset the system. (Pull the plug)
  4. Wait for the system to boot.
  5. The system should boot up fine with the SBC app up and running.

The code is modified to remove the console=ttyS0 from kernel command line.

Workaround: On VMware on reboot, enter into the grub menu and remove console==ttyS0 option from the command line.

98SBX-114540


3

The checkDrbdMountStatus.sh was still in the crontab.

Impact: On the SBC startup or switchover, crontab is erroneously updated to contain a call to checkDrbdMountStatus.sh.

Root Cause: The legacy call to checkDrbdMountStatus.sh is no longer needed in cron.

Steps to Replicate: Start the SBC. At the linux prompt, run command crontab -l to check crontab contents.

The code is modified to no longer add checkDrbdMountStatus.sh.

Workaround: None.

99SBX-113564


3

Incomplete data is shown in the "DNS Entry Data Status List" in the EMA.

Impact: Incomplete data is shown in the "DNS Entry Data Status List" in the EMA.

Root Cause: The data type of key 2 needed to retrieve DNS data entry status from hash is incorrect.

Steps to Replicate: 

  1. Create a DNS group , make entries and configure ipAddress, transportProtocol, priority, weight.
  2. Go to unhide debug. Give following commands to make the DNS requests.
    request sbx dns debug command "dig _sip._udp.gateway-us.redmatter.com Google_DNS_Group srv"
    request sbx dns debug command "dig G01-103.redmatter.com Google_DNS_Group a"
    request sbx dns debug command "dig S02-1.redmatter.com Google_DNS_Group a"
    request sbx dns debug command "dig S01-2.redmatter.com Google_DNS_Group a".
  3. Give the following command to display the populated data of DNS Entry Data Status table in the CLI.
    "show table addressContext default dnsGroup <dns_group_name> dnsEntryDataStatus".
  4. Check the DNS Entry Data Status in the EMA, the DNS Entry Data Status table reflects with the data that is there in the CLI.

The code is modified to 1 byte.

Workaround: No workaround.

100SBX-114376


3

The SBC does not follow the Q.1912.5 spec for privacy of the display name.

Impact: When trunk group variantType is q1912, the SBC includes display name in SIP From: header, even though privacy is enforced. The display name should be set to "Anonymous" in this scenario.

Root Cause: The display name in the From: header is mapped from the P-Asserted-Identity: header, rather than being set to "Anonymous".

Steps to Replicate: 

  1. Configure ingress and egress SIP trunk groups to have variantType q1912.
  2. Make SIP-SIP call. In the initial INVITE, include:
    From: "Anonymous" <SIP URI>
    P-Asserted-Identity: "display name" <SIP URI>
    Privacy: user,id

The code is modified to set the display name in From: to "Anonymous" when privacy is enforced for variantType q1912. When the variantType is uk and privacy is enforced, the display name in From: is not included.

Workaround: A SMM rule may be configured to anonymize the From: header.

101SBX-111650


3

The SBC fails to write SMM values into the CDR when STI profile is attached.

Impact: When STI is enabled and attached, we are not writing SMM details to the CDR.
The SMM details are written when STI profile is disabled.

Root Cause: SMM fields are impacted when STI profile is enabled as part of SipSgFillStiCdrData -> SipSgSendAcctUpdateToCc -> SipSgFillInProtSpecificString -> SipSgFillSmmCdrString, in sipsgIncomingCallNfy. The SBC fails to write SMM values as ccbPtr→commonFsmCb.ccHndl, and after the fetching values of SMM, free up the SMM-CDR memory and thus we fail to update the SMM data when the normal update happens through the NrmaAllocRpy.

Steps to Replicate: Run a normal STI call with SMM rules applied.
Check for the SMM in CDR.

The code is modified to control SipSgSendAcctUpdateToCc.

Workaround: None.

102SBX-115340


3

FAILURES and LINK FAILURES counts increase by two from portMonitorStatus command in V09.

Impact: After a switchover, the failure counts reported in by portMonitorStatus command are doubled.

Root Cause: The portMonitorStatus was being registered twice with the CPX process.

Steps to Replicate: 

  1. Set up an SBC 1to1 system.
  2. Failover to the standby.
  3. Take pkt0 out of service.
  4. Run a show table show table system ethernetPort portMonitorStatus.
  5. Ensure that the failure count for pk0 is 1, not 2.

The code is modified to detect and reject duplicate registrations.

Workaround: None.

103SBX-108952


3

Making IP interface OOS/disabled stops sending traffic over interface in other AC.

Impact: For the SBC SWe running on VMware platform with X710 SRIO NICs, create two IP interface groups in two different address contexts with different VLANs but with the same packet port.

As a result, this makes two different VLAN interfaces from the same packet port.

When we make an IP interface OOS/disabled in one address context, the SBC packet port was unreachable in another address context.

Root Cause: When we make an IP interface OOS/disabled in one address context, the SBC packet port was unreachable in another address context because the packet port started getting untagged (stripped VLAN) packets.

The problem is unique to VMware host X710 NIC (i40en) driver version 1.8.6 and this problem is not found in driver versions 1.10.9.0 or above.

Steps to Replicate: 

Set up: Upgrade X710 NIC driver 'i40en' version to 1.10.9.0 and firmware 7.20 on VMware host server.

Test scenario:

  1. Bring up a SWe instance with the fixed build.
  2. Create two IP interface groups in two different address contexts with different VLANs but with the same packet port. Which makes two different VLAN interfaces from the same packet port.
  3. Disable one of the IP interface groups and run a ping test (network reachability) from the other VLAN interface.

    Observations: The SBC packet port was reachable in another address context.

The code is modified in the SBC NP code for compatibility with the newer host drivers, since the newer host drivers do not allow the dissimilar number of Rx and Tx queues.

NOTE: The customer first needs to upgrade the SBC software with the fix and then upgrade i40en VMWare host driver to version 1.10.9.0 or above along with compatible NIC firmware upgrades.

Workaround: Make IP interfaces OOS/disabled in all address context of the packet port and then enable the required IP interface.

104SBX-114300


2

No trap is generated when the Max System Call Limit is set.

Impact: No trap is generated when the Max System Call Limit is set.

Root Cause: The "Max System Call Limit Set/Clear" notifications referred to incorrect trap definitions.

Steps to Replicate: Verify the traps are generated for the following CLI commands once the max system call limit is reached.

set oam traps admin sonusSbxNodeResourcesMaxSysCallLimitSetNotification state enabled
set oam traps admin sonusSbxNodeResourcesMaxSysCallLimitSetNotification priorityLevel default

set oam traps admin sonusSbxNodeResourcesMaxSysCallLimitClearNotification state enabled
set oam traps admin sonusSbxNodeResourcesMaxSysCallLimitClearNotification priorityLevel default

The code is modified to generate traps for Max System Call Limit Set/Clear.

Workaround: None.

105SBX-111177


2

The SBC wrongly interprets RTCP packets as RTP when using the DLRBT.

Impact: The RBT (ring back tone) can be terminated early when the DLRBT (dynamic local ring back tone) is enabled and RTCP packets or comfort noise packets arrive with the B-party.

Root Cause: When the DLRBT functionality was initiated, it was not informed that RTCP could be received. This resulted in RTCP packets being treated as RTP and caused the SBC to think RTP was learned. Unexpected, the RTP comfort noise packets can also cause the SBC to think RTP was learned.As soon as SDP was received in 183, the SBC triggered cut through and the RBT was stopped even though the call was not answered. This left the A-party with silence until the call was answered.

Steps to Replicate: Make a PSTN to MS Teams call with the DLRBT enabled. Leave the call in ringing state with MS Teams for a long time and check that the ring tone is continually generated.

The code is modified to correctly identify RTCP packets and not use this as an indication to media being learned so that the ring tone continues to be played until real RTP packets arrive. The learning mechanism has also been updated to look for five or more RTP packets within a five second period to establish that RTP is learned - this is to assure that occasional unexpected comfort noise packets are not used for learning.

Workaround: If RTCP is not required on the egress leg then disable it. If RTCP is required there is no work around.

106SBX-113704


2

There was a PRS core dump.

Impact: The standby PRS cored in the XRM.

Root Cause: There were some XRESs stuck in LIF's deferred active list that caused standby XRM to access NUL pointer when processing redundant modify request.

Steps to Replicate: Run regular regression tests.

The code is modified to validate XRES's state and remove it from LIF's deferred list if LIF is already in-service, then continue to process redundant modify request.

Workaround: None.

107SBX-115496


2

An NP error occurs during a 9.2.3R2 test: .IPM: *NP 1 error counter badRidCb incremented: cnt 1624898 last error 0x1a15

Impact: NP badRidCb error counts continue to increase.

Root Cause: In this call flow, NAPT learning is enabled on ingress leg. But the RTP flow mode on egress leg was already set to DUPLEX before ingress leg has finished NAPT learning to enable RID. So egress started to send packets to ingress RID while NAPT learning and caused badRidCb error.

Steps to Replicate: 

  1. Enable NAPT learning on ingress side.
  2. Run SIP-TLS to SIP-UDP call load, small load should be ok.
  3. Check badRidCb in DBG log.

The code is modified to address the issue.

Workaround: None.

108SBX-116532


2

The DSP activation/deactivation errors in the SBC 7000.

Impact: Under certain conditions of transcode overload testing on SBC 7000 intermittent DSP activation/deactivation failures were observed.

Root Cause: The size of netlink socket buffer that is used for communication between DSP H/W subsystem and the DSP resource manager process was found to be insufficient for handling intermittent bursts messages.

Steps to Replicate: The steps cannot be reproduced.

The code is modified to handle increased burst of messages from the H/W subsystem during intermittent spikes in incoming calls.

Workaround: None.

109SBX-112597


2

I-SBC: "runtime error: shift exponent 48 is too large for 32-bit type 'int' " in the np.log.

Impact: The ASAN builds reported integer overflow error in calculation of standard deviation for jitter for RTP packets.

Root Cause: Integer overflow during standard deviation calculation.

Steps to Replicate: The problem can be reproduced by streaming RTP stream with high jitter.

The code is modified to prevent an integer overflow during standard deviation calculation.

Workaround: No workaround is available. This metric, however is not written into CDRs. It is currently only being used by Ribbon Protect.

110SBX-114446


2

The SBC is not performing more routes request for Ip signaling peer group 2 in a 3xx scenario.

Impact: When configuring multiple routes for the 3xx dip, the SBC does not process any routes after the first set of routes

Root Cause: When configuring multiple routes, the SBC has a counter to determine if all routes are fetched.
This counter was not reset once we are done fetching all routes, so it was causing issue for subsequent 3xx dips.

Steps to Replicate: 

  1. Configure a routing label for the first number containing more than 10 routes.

  2. Configure another routing label (for 3xx) with a second number containikng more than 10 routes.

  3. Make a call with the first number, and send 3xx with the second number in the contact header.

The SBC should fetch all routes for the 3xx dip.

The code is modified to reset the counter once all routes are fetched from the PSX to address the issue.

Workaround: None.

111SBX-116685


2

No space left on the instance, /var/log 100%.

Impact: When VMware/KVM deployed the SBC is provisioned with an additional log partition, this extra partition is not being monitored for space correctly and can fill up leading to ssh failing.

In all platforms, a misbehaving process could write to the /var/log files leading to unexpected large content in /var/log partition.

Root Cause: As bug in the code meant the size of the log partition was only check for cloud deployments and not for virtualized deployments in VMware/KVM, this was now been corrected.
The log rotation criteria has been modified from daily/weekly for the /var/log files to 50M size based and the size of the files are checked hourly.

Steps to Replicate: Start a process to continually write to syslog very quickly and leave it running. This will eventually fill up the disk space. The SBC should generate traps for disk filling up and should automatically stop the application.

The code is modified to correctly monitor log partition in VMware/KVM deployments and the SBC application is shutdown if the log or root partition reaches 95% usage.

The code is also modified to rotate the /var/log files based on a 50M file size and the size is checked every hour.

Workaround: The log rotation configuration could be updated to rotate based on a 50M size rather than the previous daily or weekly time based rotation that was being used.

112SBX-117020


2

CDR mismatch is happening with respect to Ingress codecParams1 and Egress codecParams1

Impact: The CDR record of EVS codec is incorrectly set for AMR-WB io mode-set.

Root Cause: The EVS codec AMRWB-IO mode-set initialization was incorrectly done due to recent changes done by SBX-105793.

Steps to Replicate: Test Case Specific Configuration:

Case Procedure:
1. Configure MRF Routing type as IpAddress in MRF cluster Profile.
2. Initiate a EVS passthrugh call between User A and User B.
3. User A initiates a call with AMR-NB, AMR-WB and EVS codec
m=audio 50012 RTP/AVP 115 104 102 105
Media Attribute (a): rtpmap:115 EVS/16000
Media Attribute (a): fmtp:115 br=5.9-128;bw=nb
Media Attribute (a): rtpmap:102 AMR/8000/1
Media Attribute (a): fmtp:102 mode-set=7
Media Attribute (a): ptime:20
Media Attribute (a): rtpmap:104 AMR-WB/16000/1
Media Attribute (a): fmtp:104 mode-set=2
Media Attribute (a): rtpmap:105 telephone-event/16000
Media Attribute (a): a=fmtp:105 0-15
Media Attribute (a): maxptime:240

4. User B responds with EVS codec.
m=audio 50012 RTP/AVP 115 105
a=rtpmap:115 EVS/16000
a=fmtp:115 br=5.9; bw=nb
a=rtpmap:105 telephone-event/16000
a=fmtp:105 0-15
a=sendrecv
a=ptime:20

5. Call is established as EVS-EVS Passthrough call.
6. Media is exchanged between User A and User B.
7. User A initiates BYE to tear down the call.

The AMRWB-IO mode-set initialization is set correctly

Workaround: Not applicable

113SBX-115322


2

DFW3-CUSBC-28 - Sip Sig Ports Down

Impact: Multiple sip sigports are configured with same IP address but different UDP ports. SIP sigPorts went down after one of them was deleted.

Root Cause: In NRS, we use a refCount to manage multiple signaling ports with the same IP address. The logical binding and CpsLAddrCreate() is invoked when refCount equals 0, i.e. the time when first logical signaling address is added. If user deletes the first logical signaling address, NRS removes it from related hash table. But it's ID is still being referenced in binding structure. Then if user adds another signaling address in the group, a zero CPS laddr handle will be assigned to the new logical address which will pass wrong ACL handle when adding or deleting ACL rules and in turn caused logical address failure.

Steps to Replicate:
configure 2 sip sigport with same IP address, different UDP ports in the same LIF group
turn on INFO debug logging
for the first fix:
1. bring down pkt port associated with the LIF group
2. restart application to trigger the configuration restore
3. if on SBC7k, check nspmgr log in NP to make sure not -1 error associated with that IP address. Otherwise, check sip sigPort operational status.
for the second fix
1. find out which sigport is added first, for example, sigport 1
2. OOS and disable sigport 1
3. re-enable and inservice sigport 1
4. check DBG log for below message logged from NrsLAddrAllocate() and make sure laddrHndl !=0. The example message here is without fix.
143 03092022 161237.124306:1.01.00.39320.Minor .NRS: *NrsLAddrAllocate(): 682, refCount 2 found CPS laddrHndl 0 for la 0xc0a87eea lifGroup 3

Two fixes added
1. fix to avoid sending multiple add ACL rule requests to NSP manager before packet port(s) UP.
2. added code to update logical address ID in binding structure when a logical address is being deleted.

Workaround: no workaround


Resolved Issues in 09.02.03R003 Release

The following Severity 1 issues are resolved in this release:

Severity 1 Resolved Issues

Issue IDSevProblem DescriptionResolution
SBX-112374 | SBX-1149451

Portfix SBX-112374: The SBC is intermittently stripping the last 'm=' line from an egress INVITE.

Impact: When "m=application" line is present in the SDP present in an incoming INVITE, and at the egress, the SBC does a DNS lookup. As a result, the SBC strips off the lines after m =application line.

Root Cause: As part of the fix introduced by a bug in 8.2.1, the NULL termination was added after the m=application line. This is causing the SDP to be truncated after the m=application line.

Steps to Replicate: 

  1. In the offer SDP present in ingress Invite, add m=application line along with audio m-line.
  2. At egress, the SBC should do a DNS lookup (the cache should be cleared before so that the SBC queries DNS.)

The code is modified to address the issue.

Workaround: Use an actual IP address in IP peer instead of a FQDN.

SBX-113238 | SBX-1149631

PortFix SBX-113238: An incorrect PAI CPC position.

Impact: When the SBC sends an egress INVITE with a PAI header, and presentation is allowed, the PAI CPC is put between the username and hostname of SIP URI. However, when presentation is restricted, it is present after the hostname in the SIP URI.

Root Cause: When a presentation is restricted, the code is checking the "Disable 2806 compliance" configuration and if that was enabled, it is populating the CPC parameter in PAI after the SIP hostname.

Steps to Replicate: 

  1. Run a basic SBC and PSX configuration for a SIP to SIP calls to test the scenario.
  2. On a PSX egress IP signaling profile, the following commands must be enabled:
    Egress IP Attributes->SIP Headers and Parameters->Flags->include CPC information
    Egress IP Attributes->SIP Headers and Parameters->CPC Mapping Flags->Map CPC when Presentation is Restricted
    Egress IP Attributes->SIP Headers and Parameters->CPC Mapping Flags->Send CPC Param In→PAI
    Egress IP Attributes->Flags->Disable 2806 compliance
    Egress IP Attributes->Flags->TTC ISUP Mapping
    Egress IP Attributes->Privacy->Privacy Information->P Assert IdEgress IP Attributes->Privacy->Flags->Include Privacy
  3. On the SBC ingress and egress TGs, enable the cpcInterworkingForNNI, such as:
    set addressContext default zone ZONE2 sipTrunkGroup PCR5001_SBX_EXT signaling cpcInterworkingForNNI enabled
  4. Send basic INVITE from peer A to the SBC ingress TG, in addition to basic headers, the following should be included:
    Privacy: id
    P-Asserted-Identity: "0xxxxxxxxx"<tel:+8xxxxxxxxx;cpc=ordinary>, "Anonymous"<sip:n3xxxxxxxxx@username.xxxx.xx.xx>
  5. Verify that the SBC sends an INVITE to egress. The egress INVITE should include PAI header with cpc=ordinary placed in the URI before the @<ip address>, such as:
    P-Asserted-Identity: "Anonymous" <sip:3xxxxxxxx;cpc=ordinary@10.xx.x.xx:xxxx>, <tel:8xxxxxxxxxx;cpc=ordinary>

The code is modified so that if the cpcInterworkingForNNI is enabled on the trunk group, the CPC parameter is populated between the username and hostname of SIP URI in PAI header, irrespective of the "Disable 2806 compliance" setting.

Workaround: If "Disable 2806 compliance" is set to disabled, the issue is not present. However, if "Disable 2806 compliance" is required to be enabled, there is no workaround.

SBX-113702 | SBX-1149471

PortFix SBX-113702: Accounting Logs are not escaping special characters in calling name fields.

Impact: Accounting Logs not escaping special characters in calling name fields.

Root Cause: The SBC did not escape the non-alpha numeric character in the calling name, leading to incorrect "called asserted identity" field.

Steps to Replicate: 

Make a simple SIP-SIP call and validate the CDR subfield 60 - Called Asserted Identity display name comes as "%22NORTH SHORE RD%2CLLC%the 22".

Called Asserted Identity [sf:60] "NORTH SHORE RD, LLC"
NNI-Type [sf:61] <sip:+1xxxxxxxxxx@xxx.xxx.xx.xxx;user=phone>

The code is modified to escape non-alpha numeric characters in the calling name.

Workaround: None.

SBX-113986 | SBX-1149561

PortFix SBX-113986: The User-to-User parameter is duplicated in the Refer-To header.

Impact: When a REFER message is relayed, if transparency for all headers is active, URI parameters appear twice in the Refer-To header.

Root Cause: Interaction between transparency of all headers and relay of Refer-To header.

Steps to Replicate: 

  1. Perform a relay of REFER message enabled in the IP signaling profile.
  2. Run a SIP transparency profile with an "all" entry assigned to the SIP trunk groups.
  3. Make a SIP to SIP call. From the UAS, send REFER to perform blind transfer. The REFER contains Refer-To header with URI User-To-User parameter, e.g.:
    Refer-To: <sip:+1xxxxxxx@john.smith.com?User-to-User=0059a390f3d2b7310023a2%3Bencoding%3Dhex>

The code is modified so that URI parameters only appear once.

Workaround: An SMM rule workaround is possible, if the Refer-To is relayed transparently.

SBX-114393 | SBX-1145961

PortFix SBX-114393: The TLS Session ID is listed as all zeros on the new 9.2.2R3 code.

Impact: The TLS Session IDs were not printed in the TLS Session Status command output.

Root Cause: The code was commented out in latest releases.

Steps to Replicate: Execute the TLS Session Status command with active TLS calls on the SBC. When the command is executed, the session Ids are printed as zero instead of valid session Ids.

The code is modified to print Session IDs in the TLS Session Status command output.

Workaround: None.

SBX-114426 | SBX-1151891

PortFix SBX-114426: There was a Standby SBC core dump on the CE_2N_Comp_SamP.

Impact: Memory corruption may occur in the SAM process if an IP Peer is deleted and then added back into a different zone.

Root Cause: The root cause is that the code that handles adding a new configured IP Peer may write into memory that has already been freed.

Steps to Replicate: The root cause of this bug was found by code inspection. There is a race condition that must occur for this bug to be exposed.

To attempt to reproduce:

  1. Add four IP Peers.
  2. Delete all four IP Peers.
  3. Add the IP Peers back, but in a different zone.

The code is modified to prevent writing into an IP Peer structure which is freed.

Workaround: Avoid deleting an IP Peer and adding the exact same IP Peer back in a different zone.

SBX-1148311

No fallback to G711 for a fax call flow upon receipt of a 488 response.

Impact: The SBC is not sending fax fallback re-INVITE upon receiving 488 error response (for T38 re-INVITE) from UAS.

Root Cause: New code had been introduced in 8.02 of the SBC to address a few customer requirements related to the flag - bIsOlineSame.  None of those customer scenarios had any use cases involving Gw-Gw scenarios. There is a miss in the test coverage as a result. This new code has a missing initialization of one field that was being used for Gw-Gw scenarios, which is causing this issue.

Steps to Replicate: 

  1. Establish a call over Gw-Gw with codec negotiated as G711.
  2. Send T38 re-INVITE from UAC to SBC1.
  3. The SBC2 sends out this T38 re-INVITE to UAS.
  4. UAS responds back with 488 Not Acceptable.
  5. The SBC2 sends ACK to UAS.

The SBC2 is failing to send a fax fall back re-INVITE to UAS.

The code is modified to address the issue.

Workaround: None.

SBX-1148421

Microsoft Teams has a Shared Line/Hold issue.

Impact: The SBC fails to send ACK after the mix of INVITE replaces and refer (Microsoft Teams Shared line/hold) feature.

Root Cause: After receiving a 200 OK from the refer INVITE, the SBC fails to release tone announcement.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to correctly release the tone resource.

Workaround: Disable the tone as an announcement.

SBX-114367 | SBX-114964


1

PortFix SBX-114367: Unable to delete an Announcement Package Element.

Impact: Deleting an element within an announcement package does not work.

Root Cause: The code for handling the announcement package element delete command was incorrect.

Steps to Replicate: Perform following configuration changes through the CLI:

  1. Create announcementPackage test_pkg_1 with element test_element_1 .
    set profiles media announcementPackage test_pkg_1 packageId 101 element test_element_1 segmentId 11111
  2. Show announcementPackage to verify it is created correctly.
    show profiles media announcementPackage test_pkg_1
    should display
    packageId 101;
    element test_element_1 {
    segmentId 11111;
    }
  3. Delete test_element_1 from the package. 
    delete profiles media announcementPackage test_pkg_1 element test_element_1
  4. Show announcementPackage to verify test_element_1 is removed.
    show profiles media announcementPackage test_pkg_1
    should display (without any elements)
    packageId 101;
  5. Delete the package and verify it is successfully deleted.
    delete profiles media announcementPackage test_pkg_1

The code is modified to handle delete command for announcement package element correctly.

Workaround: Delete the announcement package, and then re-create it without the required element.

The following Severity 2-4 issues are resolved in this release:

Severity 2-4 Resolved Issues

Issue IDSevProblem DescriptionResolution
SBX-114303 | SBX-1149782

PortFix SBX-114303: Call to landline number was incorrectly listed as busy.

Impact: The SBCs try to map the non-E164 display name of p-asserted-Identity TEL to generic address for called user.

Root Cause: When the SBCs received both pai (tel) and pai (sip) headers, it attempts to treat as a Japan ttc even though the display name in pai(tel) is not E164 format.

Steps to Replicate: Run the following command string to replicate the issue:

config
sipTrunkGroup IAD signaling callingPalingParty enabled
Incoming msg has:
P-Asserted-Identity: "12345 test user " <tel:+1xxxxxxxxxx;rn=214960>, "12345 test user" <sip:+1xxxxxxxxxx;rn=214960@test.com>

outgoing INVITE
From, contact userpart is 12345

Validate if the display name is E164 format, then try to map display name as generic address for called user to address the issue.

Workaround: Use the SMM to delete incoming display name in pai(tel) header.

For an outgoing message, add it back if pai is config transparency.

SBX-110918 | SBX-1151202

PortFix SBX-110918: The SBC 7000 is showing DSP insertion with the reason DTMF, but the DTMF should not be displayed.

Impact: The following fields contain incorrect values when running a correct amount of calls (20,000 calls)

  1. Ingress DSP reason.
  2. Egress DSP reason.

Root Cause: These two fields are not Reset when the call is terminated and as a result, the values are preserved in this memory location from previous use.

Steps to Replicate: 

  1. Run 20k A---B Transcoded call with ingress DSP reason as DTMF.
  2. Change the configuration to pass-through.
  3. Check the logs to see Ingress DSP reason is populated as "No DSP inserted" for a pass-through call.

The code is modified so that the value is not populated to the fields.

Workaround: None.

SBX-114020 | SBX-1151212

PortFix SBX-114020: A core dump occurred on a Standby SBC 5210 after a healthcheck failure - ENM Deadlock - while attempting register with the EMS.

Impact: Running multiple registers and deregisters of a high availability SBC pair, in a rare case can cause the standby SBC to core dump and restart.

Root Cause: The code on the standby SBC for processing the delete of an SNMP trap target can potentially cause a core dump.

Steps to Replicate: Internal code debugging mechanisms were used to verify that create and delete of SNMP trap target processing code is bypassed on the standby SBC.

The code is modified to bypass the processing on a standby SBC.

Workaround: None.

SBX-112252 | SBX-114957 3

PortFix SBX-112252: The Verstat parameter is coming before the CPC in PAI header that is not in lexicographical order.

Impact: In the SIP P-Asserted-Identity header, in the TEL URI, the verstat parameter appears prior to the CPC parameter.

Root Cause: Order of parameters in P-Asserted-Identity header was not in lexicographical order.

Steps to Replicate: 

Make a SIP-SIP call.

Egress SIP trunk is configured with JJ9030 interworking profile flavor jj9030.

IP Signaling profile for egress trunk has "Include CPC Information" checked.

IP Signaling profile for egress trunk has "Include Privacy" checked.

The code is modified so the CPC appears first.

Workaround: None. 

Resolved Issues in 09.02.03R002 Release

The following Severity 1 issues are resolved in this release:

Severity 1 Resolved Issues

Issue IDSevProblem DescriptionResolution
SBX-113305 | SBX-1144251

PortFix SBX-113305: DNS recovery packet count of DSCP as "0".

Impact: The DNS probe packets are sent from the SBC with a DSCP value of "0".

Root Cause: The configured DSCP values were not set for DNS probe keepalive packets.

Steps to Replicate: 

  1. Configure DNS server with a DSCP value.
  2. Ensure the DNS server blacklisting is enabled.
  3. Ensure the DNS query is configured DNS server.
  4. Shut down the DNS server during this process.

Result: Observe that the configured DNS server is blacklisted and sending DNS probe packet towards a DNS server with configured DSCP value.

The code is modified to set a configured DSCP value for packets, including DNS probe packets.

Workaround: None.

SBX-114012 | SBX-1143201

PortFix SBX-114012: The SMM is not working when the From contains an escape character.

Impact: The SMM may fail to parse a display name in double quote string when the string has more than one escape characters next to each other of a header.

Root Cause: Logical error in parsing logic that causes a parsing failure.

Steps to Replicate: Configure a rule to access double quote string display name of uri header, or any parameter.

Ensure there is an input display name, such as From: "PhoneLite \\\"test1\\\"test2 " <sip:[field0]@dns.com>;tag=testing

The code is modified to address the issue.

Workaround: None.

SBX-109056 | SBX-1145681

PortFix SBX-109056: The SBC 5400 MS Teams CQ has transfers issues.

Impact: When a call with DLRBT enabled undergoes more than one transfer with REFER signaling and the final transferee does not accept the call, the SBC does not correctly reconnect the call back to the transferor.

Root Cause: For an A-to-B call, if B, for example, successfully REFERS the call to C, and then C attempts to REFER the call to D (or back to B), the SBC plays a ringtone towards A while the REFER is taking place.

However, when D rejects the call with a 480 "Temporarily not available" message, the SBC does not correctly disable the call context that is playing the tone, nor does it correctly re-enable the A-to-C call association.

Steps to Replicate: 

  1. With DLRBT configured on ingress and egress of SBC. Establish an A-to-B call through the SBC.
  2. Send a REFER from B to refer the call to C and complete the refer related signaling. This results in an A-to-C call.
  3. Send a REFER from C to refer the call to D. Do not answer the call at D but reject it with a 480 "Temporarily not available" message.
  4. Verify that the SBC stops playing tone towards A and re-establishes the A-to-C call again and media can correctly flow between A and C.

The code is modified to disable the tone playing towards A when a 480 is received and then correctly re-enable the call association back to the transferor.

Workaround: None.

SBX-114315 | SBX-1144271

PortFix SBX-114315: An SBC failover occurred because of an SCM Process core.

Impact: An SCM core can occur if the hostName in the From Header is longer than 64 bytes.

Root Cause: The code is copying the host name into an array that is not long enough to hold it. This results in memory corruption.

Steps to Replicate: Make a call where the hostName in the From Header is longer than 64 bytes.

The code is modified to use the correct size when copying the host name.

Workaround: None.

The following Severity 2 - 4 issues are resolved in this release:

Severity 2-4 Resolved Issues

Issue IDSevProblem DescriptionResolution
SBX-112547 | SBX-1144052

PortFix SBX-112547: The SBC routes call to 2nd DNS record if 503 is received after 18x.

Impact: The SBC routes an INVITE to next DNS record if 503 is received after 18x.

Also, even when the dnsCrankback flag is disabled, on getting 503/INVITE timeout case, the SBC reroutes an INVITE to next DNS record.

Root Cause: Due to a design defect, the SBC tries the next DNS record even if an error response is received after an 18x.

Also, retrying the next DNS record during a 503/timeout when dnsCrankback flag is disabled is legacy behavior. This behaviour is changed to retry the next DNS record only when the dnsCrankback flag is enabled.

Steps to Replicate: 

  1. Configure the DNS server with two routes for the FQDN route.
  2. Make an A-to-B call.
  3. The SBC sends an INVITE to first DNS record of and B sends 18x and the 503.

The code is modified to not apply the DNS crankback procedure if an error response is received after a 18x. Additionally, the default behavior of handling timeout/503 when the dnsCrankback is disabled is updated as part of this fix.

With this fix, the SBC retries for the next DNS record only when dnsCrankback is enabled to ensure the error responses match the reasons configured in the crankback profile.

Workaround: None.

SBX-113053 | SBX-114355 2

PortFix SBX-113053: Race Condition when 183 and 200 OK (INVITE) are received simultaneously. 200 OK is not relayed to other side.

Impact: Race condition between internal processing of the 200 OK for an UPDATE and a received 183 Session Progress.

Root Cause: After a 200 OK (UPDATE) is received, followed immediately by receipt of 183 Session progress, a subsequent 200 OK (INVITE) containing P-Early-Media header is queued indefinitely at egress when downstreamForking is enabled and earlyMedia forkingBehaviour is pemPriority.

Steps to Replicate: Egress SIP trunk group has downstreamForking is enabled and earlyMedia forkingBehaviour is pemPriority.

Make a call so that egress signaling is as follows:
--> INVITE (with SDP and P-Early-Media: supported)
<-- 100 Trying
<-- 183 Session Progress (with SDP and no P-Early-Media)
--> PRACK
<-- 200 OK (for PRACK)
--> UPDATE (with SDP)
<-- 200 OK (for UPDATE with SDP)
<-- 183 Session Progress (no SDP but P-Early-Media: sendrecv)
--> PRACK
<-- 200 OK (for PRACK)
<-- 200 OK (for INVITE) (This message gets queued forever).

The code is modified to eliminate the race condition.

Workaround: None.

SBX-113614 | SBX-1145463

PortFix SBX-113614: The ActiveRegCount is greater on the INGRESS side.

Impact: When registration(s) take longer than 90 seconds to complete, the ingress zone’s activeRegs count can increment, but not decrement, when the registration terminates. This may cause the ingress zone’s activeRegs count to grow incorrectly, and never reach ZERO (even after all registrations are terminated).

Root Cause: The SIPFE and SIPSG RCB allocation/deallocation become out of sync, indirectly causing the ingress zone's activeRegs count to increment and not decrement.

Steps to Replicate: Perform the endless REGISTER/403, or REGISTER/503, or REGISTER/603 sequence.

The code is modified to handle registration(s) that take longer then 90 seconds to complete. In this case, the SIPFE restarts the registration bind timer and avoids "prematurely" deallocating the RCB so that the FE and SG RCB(s) stay "in-sync".

Workaround: None.

GSX-54479 | SBX-1145284

PortFix GSX-54479: The isup-oli parameter is sending a single digit OLI value in isup-oli parameter for values 0-9.

Impact: The SBC sends all OLI digits as a single digit.

Root Cause: This functionality is not within spec.

Steps to Replicate: Make a call that uses OLI parameter.

The code is modified to add a leading 0 for OLI digits 0-9.

Workaround: None.

Resolved Issues in 09.02.03R001 Release

The following Severity 1 issues are resolved in this release:

Severity 1 Resolved Issues

Issue IDSevProblem DescriptionResolution
SBX-113954 | SBX-104348 1

PortFix SBX-104348: STUN was received on the SBC and the SBC considers these packets are arriving on another IP. And as a result, the STUN wasn't processed. 

Impact: The SBC passes the STUN packets to wrong IP address when it received them on the alternate IP.

Root Cause: The SBC always uses the primary IP address of LIF to send out the packet, even when it receives the STUN packets on the alternate LIF IP.

Steps to Replicate: STUN received on alternate IP of LIF and the SBC does not respond correctly, which appears as the SBC not processing it.

The code is modified so the XRM traverses the IP address list to match the address where it received the packet, instead of directly using the primary IP to send the packets.

Workaround: None.

SBX-114073 | SBX-1138531

PortFix SBX-113853: The SBC experienced an intermittent crash.

Impact: When multiple duplicate Diversion headers are received and stiProfile is enabled and configured on the ingress trunk group, the SBC dumps core.

The issue only occurs if six or more Diversion headers are received but fewer than five of them are unique.

Root Cause: Removing duplicated Diversion headers from information sent to the PSX causes crash.

Steps to Replicate: 

  1. Configure the stiProfile, enable, and assign to ingress trunk group.
  2. Send an SIP INVITE containing six Diversion headers but only two of them are unique. In other words, send in two Diversion headers repeated three times.

The code is modified to remove the duplicate Diversion headers from information sent to the PSX.

Workaround: None.

The following Severity 2 issue is resolved in this release:

Severity 2 Resolved Issue

Issue IDSevProblem DescriptionResolution
SBX-1140192

The DBG logs was rolling rapidly with UacSendUpdate messages.

Impact: The SBC DBG logs were filling up quickly with the following log message.

114 10192021 114119.823662:1.01.03.16703.MAJOR .SIPSG: UacSendUpdate - local answer for UPDATE: LegSide=Ingress

Root Cause: The code was mistakenly printing logs at the MAJOR level.

Steps to Replicate: The log is generated during a call where the SBC tries to send an UPDATE out to ingress leg while the PRACK is pending for previous 18x sent.

The following control also needs to be disabled on the trunk group the messages are being sent on.
set addressContext default zone <zone name> sipTrunkGroup <TG name> signaling doNotAutoAnswer <enable/disable>.

The code is modified to only print the logs at an INFO level.

Workaround: None.

Resolved Issues in 09.02.03R000 Release

The following Severity 1 issues are resolved in this release:

Severity 1 Resolved Issues

Issue IDSevProblem DescriptionResolution
SBX-112996 | SBX-113115


1

PortFix SBX-112996: There was a SCM core dump.

Impact: A rare race condition triggers a bug that caused SCM to core.

Root Cause: A bug in the code causes an attempt to access freed memory. This Gateway-to-Gateway bug has has existed for a very long time, but was not encountered until now.

The bug is triggered by a rare race condition.

Steps to Replicate: This bug was found through code inspection.

The bug is triggered by a rare race condition that is not reproducible.

The code is modified to avoid accessing freed memory.

Workaround: There is no workaround.

SBX-112366 | SBX-112738


1

PortFix SBX-112366: A customer's redundancy had an unexpected switchover.

Impact: The SBC is coring in the IPsec/IKE code when a call is using an IKE Protection Profile that was configured without any algorithms.

Root Cause: The SBC coredumped in the IPsec/IKE code due to an attempt to de-reference a NULL pointer. The pointer is NULL because the IKE Protection Profile being used was configured without any algorithms.

Steps to Replicate: 

  1. Configure an IKE Protection Profile without any algorithms.
  2. Run a call that will use this profile.

The code is modified to check for a NULL pointer and take the correct error path when the pointer is NULL.

Workaround: When configuring the IKE Protection Profiles, ensure that an algorithm is configured for this profile.

SBX-112349 | SBX-112847


1

PortFix SBX-112349: The SBC releases a 132 Release code (MODULE FAILURE) message when running an audit call.

Impact: An Async CMD Error reported by XRM that triggered call being torn down with release code 132 when running a  call audit.

Root Cause: Ribbon lacks the necessary level of detail to conclusively determine the root cause.

Steps to Replicate: Since we do not know the exact condition and what types of resources were involved, we cannot provide detailed test steps for this case.

Suggest running regular regression tests to attempt to reproduce the issue.

The code is modified for LE2MCAST, LE2MCAST_RTCP, LE2SPLITTER. The changes provided are based on source code inspection.

Workaround: N/A

SBX-112677 | SBX-112715


1

PortFix SBX-112677: The SCMP cored in Late media passthrough calls over a GW-GW.

Impact: There was a coredump for a late media passthrough case.

Root Cause: Dereferences a NULL Pointer.

Steps to Replicate: For the SBC GW-GW setup.

Enable the LM passthrough flag.

Run the following procedure:

  1. Ingress sends LM Invite.
  2. Egress sends 18x with SDP.
  3. Ingress sends SDP in Prack.
  4. Once call is established, send LM re-Invite request from Egress.
  5. Ingress responds with 200 Ok and receives ACK with SDP.
  6. Ingress sends LM re-Invite request towards egress.

The code is modified to stop the coredump.

Workaround: None.

SBX-107747 | SBX-112649


1

PortFix SBX-107747: Cyclic switchover tests - Observed a PRS Process core dump on the M-SBC1.

Impact: If an M-SBC instance transitions to active shortly after the instance comes up as standby, when certain performance stats are collected, the PRS process will crash.

Root Cause: When the instance comes up as a standby, the active instances send their metavariable information to the new standby instance. This information is sent twice for each active instances. The first metavariable information for each active instance is not received by the PRS process because the PRS process is not ready to receive it. If the instance switches to active before the second set of metavariable information is received, then the new active will not have metavariable information from the former active, which causes the PRS crash.

Steps to Replicate: 

  1. Bring up an MSBC 4-1 cluster.
  2. Restart the standby instance.
  3. Immediately after the standby instance is fully up, restart one of the active instances.
  4. After the standby instance is fully up as the active instance, in the CLI run the following command:

unhide debug
show table global icmpGeneralGroupCurrentStatistics

The code is modified so the CHM process queues the first set of metavariable information until the PRS process is ready to receive it, and then sends the information to the PRS process.

Workaround: None.

SBX-112445 | SBX-112880


1

PortFix SBX-112445: Conference calls fail when taking a recorded (SIPREC) path, but they work when SIPREC settings are not enabled.

Impact: The SBC cleanup call during hold retrieval for the transferred call. This issue is observed only when the SIP Rec is enabled.

Root Cause: Invalid operation on media resource during call hold/unhold for the transferred call leads call to cleanup. This issue is observed only when the SIP Rec is enabled.

Steps to Replicate: 

  1. Enable the SIP Rec.
  2. Make a blind/attended call transfer and after successful transfer, perform a call hold and unhold.

The code is modified to not perform any invalid operation on media resources during call hold/unhold for the transferred call.

Workaround: NA.

SBX-112561 | SBX-112836


1

PortFix SBX-112561: Regexp string was not exported by “user-config-export”

Impact: In the Regex, the SMM is lost while exporting a configuration using the user-config-export CLI command.

Root Cause: The XML formatting is trimming empty node values.

Steps to Replicate: 

  1. Create the SMM Profile using the following command strings:

    set profiles signaling sipAdaptorProfile ESMM state disabled
    set profiles signaling sipAdaptorProfile ESMM advancedSMM disabled
    set profiles signaling sipAdaptorProfile ESMM profileType messageManipulation
    set profiles signaling sipAdaptorProfile ESMM rule 1 applyMatchHeader one
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 1 type message
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 1 message
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 1 message messageTypes requestAll
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 2 type header
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 2 header
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 2 header name WWW-Authenticate
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 2 header condition exist
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 2 header numberOfInstances number 1
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 2 header numberOfInstances qualifier equal
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 3 type parameter
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 3 parameter
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 3 parameter condition exist
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 3 parameter paramType generic
    set profiles signaling sipAdaptorProfile ESMM rule 1 criterion 3 parameter name realm
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 type header
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 operation regsub
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 headerInfo headerValue
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 from
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 from type value
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 from value 172.xx.xx.xxx
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 to
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 to type header
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 to value WWW-Authenticate
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 regexp
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 regexp string "
    "
    set profiles signaling sipAdaptorProfile ESMM rule 1 action 1 regexp matchInstance all
    commit
  2. Run the following CLI command to export the configuration:
    user-config-export test.xml /profiles/signaling/sipAdaptorProfile
  3. Delete the exported profile from the CLI with the following command:
    delete profiles signaling sipAdaptorProfile ESMM
    commit
    user-config-import test.xml
  4. Run the following command:
    show configuration profiles signaling sipAdaptorProfile | display set | match string
  5. Check if the Regex string field, and restore the original value.

The code is modified to use the external tool "xmllint" to format the XML.

Workaround: Manually edit the field in the XML file after an export and before an import to correct the issue.

SBX-111126 | SBX-112531


1

PortFix SBX-111126: In the case of delayed offer, the SBC changes the attribute “a=sendonly” into “a=recvonly” before relaying the 200 OK INVITE.

Impact: The direction attribute in 200 OK sent in response to late media reinvite is set to an incorrect value when the direction attribute received in 200 OK from other side is a value other than a=sendrecv.

Root Cause: The datapathmode on the side receiving the late media invite is incorrectly copied from the SBC local datapathmode from the answer leg PSP receiving 200 OK when sendSbcSupportedCodecsInLateMediaReinvite flag is enabled.

Steps to Replicate: 

  1. Enable the sendSbcSupportedCodecsInLateMediaReinvite on the TG towards UAC.
  2. Send a direction attribute a=sendonly/recvonly/inactive from the UAS.
  3. Send the 200 OK to UAC should have direction attribute as expected (a=sendonly/recvonly/inactive respectively) and media is as per expectation.
    UAC---------------------------------SBC------------------------------------------------UAS
    INV(no sdp)->
    INV(a=sendrecv)->
    <-200 OK(a=sendonly/recvonly/inactive)
    <-200 OK(a=sendonly/recvonly/inactive)
    ACK(sdp)->
    ACK(no sdp)->

The code is modified so the datapathmode in the active PSP on late media offer side is recomputed when the sendSbcSupportedCodecsInLateMediaReinvite flag is enabled.

Workaround: Disable the sendSbcSupportedCodecsInLateMediaReinvite IPSP flag on TG receiving late media reinvite.

SBX-112624


1

The SBC is unable to recognize a PRACK message, when call hunts to a secondary route.

Impact: The PRACK was rejected with a 481 when the end-to-end PRACK is active if a call is cranked-back following a successful end-to-end PRACK on the earlier route.

Root Cause: If end-to-end PRACK is performed on the first route and then a late crank-back occurs, subsequent PRACK is rejected because stale information is present from the first route.

Steps to Replicate: 

  1. Ensure the end-to-end PRACK is supported.
  2. Make a SIP-SIP call that routes and 18x is received on the first route. As a result, the PRACK procedure is successful.
  3. Have the call fail on the first route, e.g. with 404, and the SBC configured to crank-back to a second route.

The 18x is received on the second route. When the calling party responds with PRACK, the call has a  481 in response.

The code is modified so that end-to-end PRACK information is started fresh for each route.

Workaround: None.

SBX-112307


1

A customer's SBC 7000 SIPREC metadata did not contain an ‘AOR’ parameter value.

Impact: In the SIPREC, the metadata sender and receiver's AOR fields for the tel URI were not populated properly.

Root Cause: Due to defect in the design, these fields were populated incorrectly.

Steps to Replicate: 

  1. Configure the SBC with SIP Rec server.
  2. Run a basic call with "tel" URI in From and To header.

The code is modified to populate as per requirements/standard.

Workaround: Not Applicable.

SBX-106316


1

The call established prior to a switchover fails when put on hold after a switchover.

Impact: The call established prior to a switchover with a dynamic payload type fails when put on hold after switchover.

Root Cause: After a switchover, while processing the hold request, it was unable to locate the codec due to an issue in reconstruction of some flags in PSP data.

Steps to Replicate: 

  1. Have a HA setup.
  2. In IPSP, enable "Minimize relay of media changes from other call leg" flag and "lockdown preferred codec" is enabled.
  3. Establish a call with dynamic codec like AMR.
  4. Perform a switchover, once standby becomes active send a call hold request.
  5. After a short period of time, send an call-un-hold request.

result: Call hold invite should be successful with 200 ok for that and call un-hold should also be successful.

The code is modified so that necessary flag for dynamic payloads in PSP data are reconstructed properly.

Workaround: Disable“Lock Down Preferred Codec” and enable “Relay Data Path Mode Changes".

SBX-111498


1

The SBC Ladder diagram (.TRC file) shows a response from the wrong IP for a 400 Bad Request.

Impact: When an INVITE (with malformed syntax) is sent to a leg1 (pkt1) SIP signaling IP for the SBC, the SBC responds with a 400 Bad request. In the TRC log, for a 400 Bad request PDU, the Local IP/port is printed with a leg 0 (pkt0) SIP Signaling IP Address instead of leg 1 SIP Signaling IP Address. This occurs only when the SBC sends error response message.

Root Cause: During formatting of Error message, the code is incorrectly using the pkt0 SIP Signaling IP Address instead of a pkt1 SIP Signaling IP Address resulting in the incorrect value being printed in the TRC log.

Steps to Replicate: 

  1. Set up a SIP-SBC-SIP.
  2. Enable trace logging with level4 and key "peerIpAddress"
  3. Run a SIP-SIP call, send INVITE with malformed syntax to pkt1 SIP signaling IP address such that the SBC sends a 400 Bad Request.
  4. Verify that in the TRC log, for 400 Bad request PDU, the local IP value is pkt 1 SIP signaling IP address, same source IP where the INVITE message lands.

The code is modified to correctly read the SIP Signaling IP Address of the leg where the call lands.

Workaround: None.

SBX-106037


1

The SBC 7000 is sending a re-INVITE before receiving an ACK to the 200 OK - multi-stream call.

Impact: The SBC removes transcodable codecs when the application media m-line is present with port as 0. This results in the SBC sending a re-INVITE without SDP.

Root Cause: By default, the SBC does not support transcoding on multi-stream calls. The problem here was that the code incorrectly identified that there was an application stream present even when the port was set to 0. This made it appear as a multi-stream call and resulted in the transcodable codecs being removed.

Steps to Replicate: Test Case 1: GW-GW Scenario

  1. Make a G711-G711 GW-GW call.
    The SBC will send BYE to peers. The call will fail.
    Test Case 2: Non GW-GW Scenario
  2. Configure below PSPs on ingress and Egress legs
    Ingress PSP:
    G729, G711U, G711A
    This Leg – G711U, G711A, EFR, EVRC,
    Other Leg – G711U, G711A,
    Enable Transcode if different pktsize, dtmf, silence suppression and honor preference.

    Egress PSP:
    G711SS
    This Leg – G711U, G711A,
    Other Leg – G711U, G711A,
    Enable Transcode if different pktsize, silence suppression
  3. Make a G711-G711 call.

The user observes logs in TRC file and the SBC will send BYE to peers. The call will fail.

The code is modified so that the stream with a port 0 is effectively ignored when processing transcodable codecs.

Workaround: Enabling "AllowAudioTranscodeForMultiStreamCalls" flag on both ingress and egress PSPs will solve the issue.

SBX-112557


1

The password policy is not recognized by the SBC.

Impact: The password policy not recognized by the SBC. By default, the admin rules were taken.

Root Cause: Password policy was assigned based on roles of the user.

Steps to Replicate: Go to Administration/Application Management. In Configure Password Rules tab, check by enable or disable "Use Separate Password Rules for Administrators" where you are able to change the password policy or not in change password model.

The code is modified to use the state variable in PasswordRule class

Workaround: Add new variable named "state" to PasswordRule Class as a workaround.

SBX-111743


1

The SBC block list IP with the wrong port.

Impact: The ARS block lists port 0, when an INVITE contains a Route header without a port number, and 503 response contains a Retry-After header.

Root Cause: The code did not support a case where no port number is provided.

Steps to Replicate: 

  1. Configure ARS Retry-After profile.
  2. Enable callRouting useRouteSet received in ingress and egress trunk groups.
  3. Use the UAC to send an INVITE containing Route without port number:
    Route: <sip:172.xx.xxx.xx;lr;dtg=SBX_EXAMPLE>

The UAS responds with 503 Service Unavailable with Retry-After header use CLI to check egress zone sipArsStatus.

The code is modified so when no port number is set, we now retrieve the port number from the transaction control block.

Workaround: Define an SMM rule that adds the port number (5060) if the Route header in the initial INVITE does not contain a port number.

SBX-113471


1

Multiple SBC core dumps were detected.

Impact: There was forking hashtable corrupted memory.

Root Cause: Possibility of forking control fails to remove from hashtable when the resource is cleaned up.

Steps to Replicate: Unable to reproduce. Run high load with a NAPT, upstream forking and registration and taking a SIP signaling port down/up.

The code is modified to ensure the forking call is removed from hashtable when free.

Workaround: None.

SBX-112322


1

The SBC cored when the subscribe crankback failure.

Impact: When a relay Subscribe tried to crank back for the second route and if the SBC does not find trunk group, the SBC may core.

Root Cause: The SBC cores due to duplicated memory freed.

Steps to Replicate: Configure two routes for the relay Subscribe. The second route is invalid.

After the first route exhausted, the SBC try to cranked back for the second route. The SBC fails to find trunk group for the second route.

The code is modified to prevent duplicated memory to be freed.

Workaround: Correct the second route.

SBX-113183 | SBX-1077531

PortFix SBX-107753: After the LSWU, the apache2 not coming up, resulting in an EMA or PM access issue.

Impact: After an upgrade, the Apache did not start.

Root Cause: Apache did not start due to a timeout while requesting a password. The Apache would need to be restarted manually especially in case of a failed upgrade.

Steps to Replicate: 

  1. Perform an upgrade (LSWU/standalone).
  2. If upgrade has failed, verify that the apache has come up properly with default keys and cert.
  3. If upgrade has succeeded, verify that first Apache came up properly with default keys, then after app start, the installed keys and certs are being used by the Apache.

The code is modified to find any occurrence of the one-time-issue of server key getting corrupted in the future.

Workaround: In case of a failed upgrade or apache startup failure restart apache or apply the workaround mentioned in an issue relating to the apache2 failing after an LSWU. 

SBX-113426 | SBX-1124471

PortFix SBX-112447: The SIPRec recording failed for an EGRESS call with GCID 291515755.

Impact: The SIPREC sessions fail with the following "MAJOR" logs when a CS call is going for call a modification with re-INVITE and a corresponding re-INIVTE is triggered for this towards the SRS while a previous SRS SIP transaction is pending.

159 08192021 154751.374314:1.02.00.26912.MAJOR .SIPSG: sipsgRec.c (-5062) 529606794. [SipSgSendSRSMetadataUpdateCmd] SipSgSendSdpCmd Failed with status 491
185 08192021 154751.375973:1.02.00.26913.Minor .SIPSG: SIPRec Recording failed for EGRESS call with GCID 291518377 for Recorder 10.xx.xxx.xx:xxxx. Trunkgroup of Recorder: NICE_PRI_TG

Root Cause: The SBC always attempted to send another offer towards SRS even when a offer-answer was pending and this resulted in SRS session failure.

Steps to Replicate: Use the following set up to reproduce the issue.

  1. Main Call (CS) session established.
  2. SIPREC session (RS) is established.
  3. CS call goes for modification with re-INVITE (Hold/Codec change).
    A SIPREC re-INVITE is triggered (based on CS re-INVITE).
  4. The SRS does not respond for SIPREC re-INVITE.
  5. Before the SRS answers the re-INVITE, a CS call triggers yet another modification with re-INVITE (unhold/codec change).
  6. The SBC attempts to trigger SIPREC RE-INVITE again even when the previous transaction is pending and results in SRS session failure.

When a SIP Offer-Answer towards SRS is in progress, SBC shall not attempt to send another offer and instead shall queue the latest event until the current offer-answer is complete.

Workaround: None.

SBX-1131961

A SCM Process coreump occurred on the SIGABRT.

Impact: When the INVITE message contains trunk group/trunk context parameter information and the context is an FQDN, then the SBC can use this information to formulate the IP Peer information if there is none supplied from the PSX. This can result in an SCM process coredump, if multiple routes are returned from the PSX.

Root Cause: The internal processing code did not account for multiple routes and it was always freeing memory that was possibly assigned to the first route. However, when processing the second or subsequent routes in a crankback scenario, the memory on the first route freed once when routing the call on the second route and then again when the call was actually released. This second freed memory was invalid and results in a coredump.

Steps to Replicate: 

  1. Pass in the trunk group and trunk context parameters that use FQDN information.
  2. Ensure the PSX returns 3 routes and no IP Peer IP or FQDN information.
  3. Return a crankback status code in response to the INVITEs sent on route 1 and route 2.
  4. Release the call.

The code is modified to correctly manage the memory on the route being used for the call. The code change frees and allocates memory consistently for a route to avoid freeing the memory twice.

Workaround: Remove the trunk group/context using the SMM from the received INVITE.

Ensure the PSX only returns one route when processing trunk group/context information.

The following Severity 2-4 issues are resolved in this release:

Severity 2-4 Resolved Issues

Issue IDSevProblem DescriptionResolution
SBX-112857 | SBX-113197


3

PortFix SBX-112857: Increase the VNFM response timeout.

Impact: By default, the VNFR logic had a 5 second timeout to get responses from VNFM for the REST requests that it sent, but it has been observed that in certain networks this timeout value is not enough. This leads to the VNFR timing out while the VNFM was still trying to send back a response and the VNFR never reported ready state in the VNFM.

Root Cause: A delay of 5 seconds was originally thought to be long enough but across multiple networks, this was insufficient.

Steps to Replicate: Try a relocation operation with VNFM across multiple sites and ensure the VNFR status returns to ready.

The code is modified so the timeout is now increased to 20 seconds.

Workaround: None.

SBX-112487 | SBX-113200


2

PortFix SBX-112487: The LI connection to media server was not connected on a switchover.

Impact: When using a PCSILI (P-com-session-info flavour of LI) in an N:1 M-SBC setup and running the SBC release 8.2 or later, if there is a switchover, the connection to the LI server might not be re-established.

Root Cause: The standby instance was trying to maintain information about the operational status of the interface used for LI processing. But this was only happening correctly for the first instance. The status of the other instances was being misinterpreted and lost. So during the transition to active the LI code thought the interface was not available and did not try to establish the connection to the LI server.

Steps to Replicate: In an N:1 setup perform switchovers from each active instance to the standby and check that the connection to the LI server is restored.

The code is modified to collect the status of the interface after the instance is transitioned from standby to active, so that accurate interface information is available for LI processing.

Workaround: Bouncing the interface (e.g. ifup/ifdown that is used for LI connection), will help to recover the connection.

SBX-109006 | SBX-110819


2

PortFix SBX-109006: The DSP DHC had a Failure and failed to coredump.

Impact: The FPGA based DSP Health Check (DHC) fails and as a result, no DSP coredump is collected. 

Root Cause: The root cause for DHC failure is not known. However, subsequent coredumps failed due to a lack of reception of the DSP BOOTP packets, which is a hard failure. It is speculated that both issues are related.

Steps to Replicate: Instrument the code to replicate the issue.

Reboot the node instead of running an application restart to address the issue.

Note: This is not a fix for the original issue, but just a proposed workaround to prevent or reduce further failures.

Workaround: None.

SBX-112971 | SBX-113352


2

PortFix SBX-112971: The diameter process cored continuously when creating the diamNode entry.

Impact: The diameter process acts as a client and server. When it acts as server, on accepting TCP connection from the remote diameter client, the diameter process crashes due to an invalid operation.

Note: There is no use case where the diam process accept connection from remote diameter client, so this scenario not covered in our earlier testing. This issue observed during misconfiguration.

Root Cause: On accepting TCP connection from the remote diameter client, the diameter process tries to perform an invalid operation (null pointer access) and due to this, the diameter process crashes.

Steps to Replicate: Configure the diameter node in the SBC and simulate TCP client application that connects the diameter server (on port 3868).

The code is modified so the diameter process does not perform any invalid operation.

Workaround: Do not configure same IP address for the peer and for diameter node.

SBX-113413 | SBX-113535


2

PortFix SBX-113413: The call failure with an extra INVITE is sending.

Impact: If A calls B over the SBC, the SBC sends INV with sendrecv to B. B sends 180/200 with recvonly. After call is established, the SBC sends a re-INVITE to B with data path mode as sendonly.

Root Cause: As part of a previous issue, a behavior change was introduced so that the SBC sends a hold re-INVITE (received from the network) to the other end. This was only for the cases where call is already on hold but data path mode is changed.

Steps to Replicate: 

  1. Send an INVITE from A to B. The SBC sends sendrev to egress.
  2. From B, send a 180 with recvonly.
  3. From B, send a 200 Ok with recvonly.

A to B is connected.

When call is connected, there should not be an re-INV towards egress leg (with recvonly).

The code is modified so in the case when the SBC receives a re-INVITE from network and data path mode is changed, it triggers a new re-INVITE to the other leg.

In other cases, it would be same behavior (prior to SBX-111611).

Workaround: None.

SBX-107396 | SBX-112247


2

PortFix SBX-107396: Error "SYS ERR - Error 0x3b Line 666" was being printed frequently.

Impact: SYS ERR repeatedly logged in SYS logs.

Root Cause: The SYS ERR seems to only occur for audio encoding type 0x3b, which is SPEEX_8. But we don't have enough information to determine the call flow that triggered it.

Steps to Replicate: The steps cannot be reproduced. 

The code is modified to replace the SYS ERR with a major level debug message with the GCID and audio encoding type to help future debugging.

Workaround: None.

SBX-110592 | SBX-112526


3

PortFix SBX-110592: There was a misleading TRC message when issuing the callTrace action command start command.

Impact: The misleading TRC message when issuing a "callTrace action command start command".

Root Cause: There was no alarm/log message indicating a global call trace start action command.

Steps to Replicate: Issue the callTrace action command and observe the Trace log.

admin@vsbxsus2> request global callTrace action command start

Sonus Networks, Inc.0000000001600000000000000000000128V08.02.06A002 0000000000000000000000000000TRC2021082014593700000000000000
072 08202021 145941.298910:1.01.00.00002.Info .NRM: Call Trace Reset

The code is modified to display correct message indicating call trace being reset.

Workaround: None.

SBX-110755 | SBX-112791


2

Portfix SBX-110755: The ACL rules configured with ipInterface are disabled on every SBC start/restart in SBC5400/10GB pkt configuration.

Impact: The IPACL rules created with ipInterface defined are not getting installed on the SBC 5400 systems when there is no license present, or after a license is added.

Root Cause: The NP will not install an IPACL rule with an ipInterface defined if that interface is not UP and active. The SBC will retry to install failed rules when it sees the port come up. In this scenario the timing is off, however, it tries too soon as the physical port is up but the associated ipInterface is not yet up.

Steps to Replicate: The test involves a SBC 5400 without a license for its 10G packet port. The IPACL rules with ipInterface defined on that packet port will then fail to install. Once the license is successfully added, the IPACL rules should be installed.

The code is modified to add an additional delay before attempting to reinstall the failed IPACL rules when the port comes up and to look for an additional failure that starts a timer and try again.

Workaround: Do not use IPACL rules with ipInterface defined.

SBX-110490 | SBX-113016


2

PortFix SBX-110490: The IMS preconditions are failing due to UPDATE message race condition.

Impact: An UPDATE from the calling party is queued by the SBC because the SBC is waiting for 200 OK for the previous update sent to called party, and when the 200 OK is received, the SBC did not forward the queued Update.

Root Cause: Precondition parameters received as part of UPDATE from ingress endpoint is not updated in the egress CCB.

Steps to Replicate: 

  1. Configure preconditions to transparent on both legs.
  2. Configure transmitpreconditions to supported on both legs.
  3. Run the script so that there is difference in precondition parameters in an INVITE and UPDATE messages from ingress.

    invite: a=des:qos mandatory local sendrecv
    a=curr:qos local none
    a=des:qos optional remote sendrecv
    a=curr:qos remote none

    (AS script)183 in Progress: a=curr:qos local sendrecv
    a=curr:qos remote none
    a=des:qos optional local sendrecv
    a=des:qos mandatory remote sendrecv
    a=conf:qos local sendrecv

    (IAD script)update : a=curr:qos local sendrecv
    a=curr:qos remote sendrecv
    a=des:qos mandatory local sendrecv
    a=des:qos optional remote sendrecv
  4. Send the update from the Ingress when the SBC is waiting for 200 of the previous update it sent to egress.

Verify that the SBC sends the queued update, once it receives the 200 ok for the 1st update.

The code is modified so the precondition level of support was set to transparent on both legs in configuration.

When the SBC receives precondition parameters as part of an UPDATE and preconditions are transparent, then the SBC saves the precondition parameters into the egress CCB. When the queued update message is being processed there is check for preconditions flag and comparison of precondition variables is done to send the update to called party.

Workaround: Enable the "Disable media lockdown" flag in IPSP for egress leg so that the SBC does not send the first update.

SBX-109364 | SBX-111831


2

PortFix SBX-109364: The SBC ERE was unable to handle "sonusdomain.IP" as a keepalive response from DNS.

Impact: The SBC ERE was unable to handle "sonusdomain.IP" as a keepalive response from DNS.

Root Cause: A format Error (dns_rcode_formerr) return code of a DNS server was unable to whitelist a server that was block listed.

The DNS server is not getting whitelisted from a block list since the Format Error (dns_rcode_formerr) return code is not handled in the code.

Steps to Replicate: 

  1. Configure the ARS profile.
  2. Make a DNS server query with invalid format.
  3. Verify the alarm to check that the server is on a block list.
  4. Check after sending an ICMP message,the  server is on a permit list.

The code is modified to fix the issue.

Workaround: None.

SBX-112429 | SBX-112818


2

Portfix SBX-112429: The NrmGetCallCount was returning max global callcount, instead of the current stable calls.

Impact: The I-SBC sends the total (cumulative) number of stable calls instead of current stable calls to the SLB in its utilization message. This could result in the SLB dropping messages if it thinks the I-SBC has reached 100% utilization.

Root Cause: The I-SBC was providing the wrong number of stable calls to the SLB.

Steps to Replicate: 

  1. Bring up the SLB-ISBC setup.
  2. Run a call load.
  3. Check in the SLB about current utilization of the I-SBC.

The code is modified to provide the current number of stable calls in the utilization message to the SLB.

Workaround: None.

SBX-111740 | SBX-112570


2

Portfix SBX-11174: The SBC takes 72 seconds to send BYE to transferor after call termination.

Impact: The SBC is taking 72 seconds to send BYE to the transferor when the transferee disconnects before a transfer target accepts the call.

Root Cause: One of the disconnect events towards transfer target is getting ignored in the call control state machine. As a result, a release timer of 70 seconds is getting triggered later and the SBC is sending BYE towards transferor.

Steps to Replicate: 

  1. A and B call is connected.
  2. B sends a REFER to the SBC.
  3. The SBC sends a new INV to transfer target C.
  4. C sends 180 Ringing to the SBC.
  5. A sends BYE to the SBC before C answers the call.

The code is modified so that the SBC sends a disconnect immediately towards the transferor.

Workaround: None.

SBX-98627 | SBX-113514


2

PortFix SBX-98627: The Min-SE header is getting added to the ingress metaDataProfile even though it is not in the initial INVITE.

Impact: For the SIPREC, the Min-SE and Session-Expires headers are added to the metaDataProfile even though it is not received in the initial INVITE.

Root Cause: When receiving an INVITE, the SBC was incorrectly inserted Min-SE and Session-Expires headers as part of an incoming INVITE.

Steps to Replicate: 

  1. Configure the SIPREC set up and Min-SE and Session-Expires in sipRecMetadataProfile.
  2. Receive an incoming INVITE without the support timer and no Min-SE, no Session-Expires.

The code is modified so if an incoming INVITE is missing support for a Timer, the SBC resets the value of the Min-SE and Session-Expires only if it is received.

Workaround: Use the SMM to delete the Metadata in the SIPREC INVITE.

SBX-105688 | SBX-110152


2

Portfix SBX-105688: The TAP ID of an ingress target was not getting embedded in the CCID for IMSLI (both leg interception).

Impact: When a call has matched the ingress and egress LI criteria/target for a SIP Out of Dialog message and if each of the criteria was configure with different TAP IDs over the X1 interface, only one of the TAP IDs was processed by the SBC.
This resulted in an incorrect TAP ID being sent out for one of the intercepted leg in the Correlation-ID (CCID) and in the TAP ID AVP field (202) of the X2 messages.

Root Cause: The SBC always stored only one TAP ID, the TAP ID present in the 0th index of the LI criteria table that is returned by the PSX and it did not store the TAP IDs corresponding to ingress and egress criteria separately.

As a result, whenever both legs are intercepted for OOD messages, one of leg would have the incorrect TAP ID in the CCID for X2 messages.

Steps to Replicate: 

  1. Configure the SBC with the PSX and EMS for IMSLI Lawful interception.
  2. Configure the IMSLI for both Leg and set targets using EMS with different TAP ID.
  3. Make a subscribe request with the same targets configured.
  4. Verify that TAP ID received for both legs are correct.

The code is modified to store and process the TAP ID for both the ingress and egress target criteria.

Workaround: None.

SBX-109103 | SBX-111454


2

PortFix SBX-109103: There was an incorrect UDP port used in the Record-Route and Contact on the core side.

Impact: The SBC populates an invalid port in the Contact/Record-Route header towards the IMS Core side in call progress (180/200) responses.

Root Cause: The signaling engine in the SBC, during a call, progress command modifies the ports without validating the direction of message flow and causes the SBC to populate an invalid port in the SIP responses.

Steps to Replicate: 

  1. Send an IMS-AKA registration request from a UE device.
  2. Ensure the IMS-AKA registration is successful.
  3. Let the registered user receive call from IMS network.
  4. When UE accepts the call, we can observe in the call progress response sent from the SBC towards the IMS Core will have the invalid port in contact/Record-Route headers.

    Flow: IMS Core --(SIP UDP)-> SBC ---(SIP IPSec TCP)--> Peer (UE)

The code is modified to identify the direction before changing ports, change only when the flow is towards the UE.

Workaround: Use the SMM to change the ports in Contact and Record-Route headers.

SBX-101255 | SBX-112998


2

PortFix SBX-101255: The OAM should not configure the same IP for two different pkt interfaces.

Impact: The OAM is allowing the same IP and alternate IP to be configured under the same address context.

Root Cause: During an address context, the interface creation OAM was allowing the configure of the same IP address (IpV4/IpV6) and alternate IP address for different interfaces.

Steps to Replicate: The meta table is added for ipVarV4/ipVarV6/altIpVars value. When creating the ipInterface table, we  should also observe ipInterfaceIpVarVMeta(hidden)

The meta table is created for ipVarV4/ipVarV6/altIpVars. For all test cases, the following table can be observed:

Case 1: Create ipInterfaceGroup,ipInterface and assign ipVarV4
Create 2nd ipInterfaceGroup,ipInterface and assign same ipVarV4 value, confd should throw an error for unique value in a address context.

Case 2: Create ipInterfaceGroup,ipInterface assign ipVarV4 and altIpVars same as the one in ipVarV4
should throw an error for unique value.

Case 3: Create ipInterfaceGroup,ipInterface assign ipVarV4 and altIpVars
Create 2nd ipInterfaceGroup,ipInterface assign ipVarV4 and same altIpVars value as previous
confd should throw error for unique value.

Case 4: Create ipInterfaceGroup,ipInterface assign ipVarV4 and altIpVars
Delete ipInterfaceGroup,ipInterface ipVarV4
Delete ipInterfaceGroup,ipInterface altIpVars
Delete ipInterfaceGroup,ipInterface
All combination of delete should work

Case 5: The same test to be done for ipVarV6.

Any other tests are related to ipVarV4/ipVarV6/altIpVars creation/deletion

The code is modified to have a unique IP address (IpV4/IpV6) and alternate IP address for an address context. New meta data is created for validating uniqueness efficiently.

Workaround: Do not configure the ipVarV4/ipVarV6/altIpVars

SBX-111019 | SBX-113030


2

PortFix SBX-111019: The SBC should not allow to configure the same IP for two different pkt interfaces.

Impact: The SBC should not allow to configure same IP for two different pkt interfaces.

Root Cause: After a playback file pushed to the SC nodes, the dummy validate is invoked before creation of the addresscontext table, ipInterfaceIpMetaVar table to be moved out of addresscontext yang.

Steps to Replicate: The meta table is added for ipVarV4/ipVarV6/altIpVars value. When creating the ipInterface table, we  should also observe ipInterfaceIpVarVMeta(hidden)

The meta table is created for ipVarV4/ipVarV6/altIpVars. For all test cases, the following table can be observed:


Case 1: Create ipInterfaceGroup,ipInterface and assign ipVarV4
Create 2nd ipInterfaceGroup,ipInterface and assign same ipVarV4 value, confd should throw an error for unique value in a address context.

Case 2: Create ipInterfaceGroup,ipInterface assign ipVarV4 and altIpVars same as the one in ipVarV4
should throw an error for unique value.

Case 3: Create ipInterfaceGroup,ipInterface assign ipVarV4 and altIpVars
Create 2nd ipInterfaceGroup,ipInterface assign ipVarV4 and same altIpVars value as previous
confd should through error for unique value.

Case 4: Create ipInterfaceGroup,ipInterface assign ipVarV4 and altIpVars
Delete ipInterfaceGroup,ipInterface ipVarV4
Delete ipInterfaceGroup,ipInterface altIpVars
Delete ipInterfaceGroup,ipInterface
All combination of delete should work

Case 5: The same test to be done for ipVarV6.
Once saveAndActivate is called data should reflect in SBC as well.

Case 6: Upgrade testing to be performed like from 9.x to 10.x.
case 7: error case for upgrade testing, configure ipVarV4/ipVarV6/altIpVars and use same values for different ipInterface within an address context and post upgrade should get an error log for contacting sonus customer service to make the values unique.

Run any tests related to ipVarV4/ipVarV6/altIpVars creation/deletion

The code is modified to move ipInterfaceIpMetaVar out of addresscontext yang.

Workaround: None.

SBX-111956 | SBX-113152


2

PortFix SBX-111956: An early media case in SIPREC re-INVITE is not triggered with latest values for metaDataSource=fromLatest.

Impact: Call modification events like codec change/hold/un-hold on the CS that occur before the RS Session is established is not propagated to the RS Call (SIPREC Session).

Root Cause: The SBC does not attempts to trigger SIPREC re-INVITE with updated session characteristics when initial SIPREC INVITE transaction itself is pending with SRS and Main Call received a re-INVITE.

Steps to Replicate: Run the following procedure to recreate the scenario:

  • Main Call (CS) session established.
  • SIPREC INVITE (RS) is sent towards SRS.
  • SRS does not respond for SIPREC INVITE. (SBC - SRS INVITE transaction is pending).
  • CS call goes for modification with RE-INVITE. (Hold/Codec change).
  • SRS answers the initial SIPREC INVITE after Main CS Call RE-INVITE.

The code is modified to queue the SIPREC RE-INVITE event when an initial SIRPEC INVITE transaction is pending.

When the initial SIPREC INVITE transaction is completed, the queued SIPREC RE-INVITE is sent towards the SRS (This contains the latest session characteristics).

Workaround: None.

SBX-110985 | SBX-111275


2

PortFix SBX-110985: If the VM name in the upper right corner of the "Configuration Manager" EMA/EMS SBC Manager is clicked, the browser freezes.

Impact: If the VM name in the upper right corner of the "Configuration Manager" EMA/EMS SBC Manager is clicked, the browser freezes.

Root Cause: The issue occurred because the peer setup was unreachable and to get the peer system info, the curl command that is executed was taking default timeout to get a connection timeout.

Steps to Replicate: 

  1. Log into EMS.
  2. Launch the SBC Node.
  3. Click on Monitoring -> System and Software info tab.

The code is modified to address the issue.

Workaround: Refresh the UI page.

SBX-112082 | SBX-112551


2

Portfix SBX-112082: There was an runtime error: member access within null pointer of type 'struct CC_SG_ALERTING_UIND_MSG_STR in CcSgAlertHndl.

Impact: Run a basic G711U pass-thru call. After the call got completed, ASAN runtime error is observed in the system logs indicating that the code is taking the address of a field within a null pointer. This could potentially lead to coredumps if using the SIP recording capabilities other than SIPREC.

Root Cause: When a call Progress/Alerting message is received from the network, the code was taking the address of a field within the pointer.

Steps to Replicate: Run a basic call.

The code is modified to validate that the pointer is not null taking the address of a field within the pointer.

Workaround: None.

SBX-113278 | SBX-113572


2

PortFix SBX-113278: Need a configurable item added to indicate a legacy meshed network on GW link to lower MAX_ICM value

Impact: A call sent from an SBC running 9.0 or above to a older GSX may cause the GSX to core.

Root Cause: In 9.0, the PDUs sent from the originating GW to the destination GW in a GW-GW call has increased in size.
When the destination GW is an older GSX, the PDU may be larger than the buffer allocated on the GSX for receiving this PDU.

In this case, the GSX does not expect a PDU this large and this will result in the GSX overwriting the allocated buffer causing memory corruption that eventually leads to a core.

Steps to Replicate: 

Send an SBC-GW-GW-GSX call involving text (T140) streams.

As a result, the GSX may crash.

To test the fix:

  1. Load the new code.
  2. Enable oldGsxSupport
    "set global signaling oldGsxSupport"
  3. Send an SBC-GW-GW-GSX call involving text (T140) streams (this is just 1 way to cause the large PDU to be sent).

The GSX should not crash.

The code is modified so the new configuration parameter is enabled if there are any older GSXs in the network:

set global signaling oldGsxSupport

When this parameter is enabled, the SBC reduces the max size of the PDUs that can be sent over a GW-GW connection to older GSXs and older SBCs.

Workaround: There is no workaround.

SBX-112708 | SBX-113492


3

PortFix SBX-112708: The NOTIFY XML body for 200 OK for INVITE does not contain new values that were updated between 180 and 200.

Impact: The SBC was not sending latest received P-Asserted-Identity in the call NOTIFY XML body.

Root Cause: The SBC was not considering the latest received P-Asserted-Identity and was always sending the first received message in call NOTIFY XML body.

Steps to Replicate: Steps:

  1. Enable the call Notification feature both legs.
  2. Send different PAI headers in the 18x and 200 OK.

Expected Result:

The SBC sends ringing NOTIFY with the XML body contains PAI element that received in 18x and while sending a connected NOTIFY should consider PAI received in 200 OK.

The code is modified to consider the latest received P-Asserted-Identity identity for populating a call NOTIFY XML body.

Workaround: None.

SBX-110997 | SBX-111367


2

PortFix SBX-110997: There are media problems due to same SSRC after hold/MOH/resume and a previous fix's flag was not helping.

Impact: The SBC is not changing local SSRC during a HOLD/RESUME of a Transcoded call.

Root Cause: During a HOLD/RESUME of a Transcoded call, the NP was not updated with the new SSRC generated by the SBC, and this resulting in the old SSRC being used in media packets.

Steps to Replicate: 

  1. Run a basic Basic transcoded HOLD/RESUME SRTP call with the flag enabled.
  2. Ensure that during a HOLD, only data-path-mode is changed to sendonly and recvonly respectively to trigger modify scenario and rest of the media attributes remains same.
  3. Validate the media packets for change in the SSRC.

The code is modified to update NP with the latest SSRC generated during mid-call modification due to HOLD/RESUME of Transcoded calls.

Workaround: If possible, switch to pass-through calls since this issue is specific to transcoded calls only.

SBX-113048 | SBX-113389


2

PortFix SBX-113048: Edited the External IP Interface group name disappearing in Visual First Call View as a diagramSetup. page

Impact: Edited the External IP Interface group name disappearing in Visual First Call View as a diagramSetup page.

Root Cause: The existing  system did not handle save functionality when an external "IP Interface Group" was not empty.

Steps to Replicate: 

  1. Login to EMA as an admin user.
  2. Go to Configuration->Configuration Wizards->Visual First Call Setup.
  3. Configure the fields in Carrier and save.
  4. Make changes to IP Interface Group and Save.
  5. Navigate to AllAdmin and then navigate back to Configuration->Configuration Wizards->Visual First Call Setup

After navigating back to Visual First Call Setup, the changes were saved i.e. Carrier type and IP Interface Group should be visible.

The code is modified for the External "IP Interface Group" for both empty and non-empty cases.

Workaround: None.

SBX-111721 | SBX-111722


2

PortFix SBX-111721: The EVS encoder picks up the initialCodecMode as the bitrate after switch to Compact Format.

Impact: The EVS encoder picks up the initialCodecMode as the current bitrate if a change in packet format from Header Full to Compact is triggered.

Root Cause: The root cause is the re-initialization of EVS encoder with bitrate as the initialCodecMode on change in packet format.

Steps to Replicate: 

  1. Run a EVS<=>AMRWB call.
    br=5.9-24.4; bw=nb-wb
  2. Stream a WB pcap with 13.2Kbps packets with CMR byte for 13.2 CA mode for the first 10s. After, the pcap has 24.4 Kbps packets without the CMR.

Results:
The mode of operation changes from 24.4Kbps to 13.2 Kbps with CA enabled on receiving the CMR. Once the Endpoint starts sending 24.4 Kbps packets without CMR, the SBC switches to Compact Mode while maintaining its bitrate as 13.2 Kbps with CA enabled.

Prior to the fix, when switching to the Compact mode, the SBC would use 24.4Kbps (initialCodecMode) as the bitrate.

The code is modified to the re-initialize the EVS encoder with bitrate as the localCodecMode rather than the initialCodecMode.

Workaround: None.

SBX-111896 | SBX-112373


2

PortFix SBX-111896: Automatic daily updates in HFE script for Azure/GCE were causing the network to reset.

Impact: Networking on the HFE can be reset by automatic updates.

Root Cause: Ubuntu, by default, has an automatic package updater. Some package upgrades can cause the networking to be reset on the HFE node.

Steps to Replicate: Check if the following timers are enabled:

  • sudo systemctl status apt-daily.timer
  • sudo systemctl status apt-daily-upgrade.timer

The code is modified to disable the timer that triggers the automatic updates. Package upgrades should only occur out of hours.

Workaround: Run the following commands to disable the the updates:

  • sudo systemctl stop apt-daily.service
  • sudo systemctl stop apt-daily.timer
  • sudo systemctl stop apt-daily-upgrade.timer
  • sudo systemctl stop apt-daily-upgrade.service
  • sudo systemctl disable apt-daily.service
  • sudo systemctl disable apt-daily.timer
  • sudo systemctl disable apt-daily-upgrade.timer
  • sudo systemctl disable apt-daily-upgrade.service
SBX-110291 | SBX-112568


2

Portfix SBX-110291: AddressSanitizer: The ASAN detected a heap-buffer-overflow-SipSgIncomingCallNfy (unsigned int, sip_addr_str*, sip_msgbody_str*, sip_options_str*, unsigned int, unsigned int, bool) /sonus/p4/ws/jenkinsbuild/sbxAsan100/marlin/.

Impact: The ASAN detected "AddressSanitizer: heap-buffer-overflow" while copying the contents of the SIP-I base version string internally.

Root Cause: The SIP code was always copying a fixed amount of memory when reading the SIP-I base and version strings to internal memory.

Steps to Replicate: Run a SIP-I call flow with INVITE and CANCEL messages.

The code is modified to copy exactly string length size of the SIP-I base and version content to avoid reading past the end of memory buffers as this can cause coredumps.

Workaround: None

SBX-105367


2

During a sRTP and fax call, the sRTP context is removed for G711 fax pass-thru.

Impact: The sRTP context is removed on the leg that has a G711 fax when there is a t38 to g711 fax call.

Root Cause: The sRTP context is not updated for G711-fax.

Steps to Replicate: 

  1. Run an A(SRTP)-B(RTP) CALL.
  2. Run a leg A is G711 fax and B is T38. B sends a re-INVITE with t38 fax.
  3. Check the re-INVITE that goes out with SRTP to endpoint A.
  4. A party sends 200 ok with SRTP.
  5. End the call.

The code is modified so the the SRTP context is updated only if the calleg has G711 fax.

Workaround: None.

SBX-112905


2

The SBC was answering on-hold call with the sendrecv then re-inviting.

Impact: On an incoming INVITE onhold, the SBC responds to the 18x offhold and later the re-INVITE onhold.

Root Cause: There was a logical error that converts from an inactive to sendrecv when the first 18x is sent out.
This issue was introduced a previous fix listed in the 9.2.1 release.

Steps to Replicate: 

On the ingress, configure the Minimize flag, and uncheck relay data path mode.

Incoming Invite onhold, egress response 18x.

The SBC send 18x to ingress with sendrecv.

The code is modified to apply for subsequent 18x only.

Workaround: Enable the relay data path mode.

SBX-110780


2

The SBC was sending Empty Packets when playing an Announcement.

Impact: Announcement packets are empty for two stage calls if the NAPT enabled on the ingress.

Root Cause: The ARM was not getting indication to start the announcement once NAPT learning was complete.

Steps to Replicate: Set up a two stage call and enable the NAT on ingress.

The code is modified to send an indication to start the announcement once NAPT learning was complete

Workaround: Disable the NAT.

SBX-111349


2

An SBC 7000 dual crash within 1 minute (old Active side - Fm, new Active - Scm).

Impact: The application on both active and standby switched over and the application reset in a short order of each other. Core files are created on both sides of the HA pair.

Root Cause: The issue occured during multiparty call processing where the SBC tries to determine a whether message was sent for the ingress or egress call segment. The code was accessing the pointer to the multi party call resource after it was freed up and set to NULL.

Steps to Replicate: This issue is not reproducible. Potentially due to a race condition in the code.

The code is modified so the multi party call pointer is not NULL before reading from it to avoid the coredump.

Workaround: There is no known workaround for this issue.

SBX-112953


2

The SRTP license counter did not incremented when the called side omits an SIP 18x response.

Impact: The license count for the SRTP license was not updated on a call from SRTP to RTP, if no 18x response message is received.

Root Cause: The SRTP license usage is not updated at the ingress when response to an INVITE is only 200 OK message. Therefore, if the egress is not using a SRTP, the call does not consume a license.

Steps to Replicate: Make an SIP-SIP call where the ingress leg uses SRTP and egress leg uses RTP.
The called side does not sent any 18x response.

The code is modified to correctly update the license count at ingress, even when no 18x is sent.

Workaround: None.

SBX-110359


2

No INFO Logging Warning is provided when enabling the info debug/sys.

Impact: The SBC CLI/EMA does not provide any warning when enabling INFO logging, indicating impact to system performance and call processing.

Root Cause: There was no code to provide the warning to user.

Steps to Replicate: Run the following script to reproduce the issue:

admin@sbxsus12% set system admin sbxsus12 cliSetWarningOnEnablingInfoLevelLogging
[disabled,enabled] (disabled): enabled
[ok][2021-08-19 17:12:13]

[edit]
admin@sbxsus12% com
Commit complete.


admin@sbxsus12% set oam eventLog typeAdmin debug filterLevel info
[ok][2021-08-19 17:14:51]

[edit]
admin@sbxsus12% com
The following warnings were generated:
'oam eventLog typeAdmin': Enabling INFO level logging can be service impacting. Do you want to continue?
Proceed? [yes,no] no
Aborted: by user
[ok][2021-08-19 17:15:41]

[edit]
admin@sbxsus12% com
The following warnings were generated:
'oam eventLog typeAdmin': Enabling INFO level logging can be service impacting. Do you want to continue?
Proceed? [yes,no] yes
Commit complete.
[ok][2021-08-19 17:15:46]

admin@sbxsus12% set oam eventLog typeAdmin system filterLevel info
[ok][2021-08-19 17:16:37]

[edit]
admin@sbxsus12% com
The following warnings were generated:
'oam eventLog typeAdmin': Enabling INFO level logging can be service impacting. Do you want to continue?
Proceed? [yes,no] yes
Commit complete.
[ok][2021-08-19 17:16:40]

The code is modified to provide a warning to the user when enabling INFO level logging for system or debug logs. To maintain backward compatibility and not break any customer scripts, a user needs to enable this extra prompt.

Workaround: None.

SBX-112060


2

STIR/SHAKEN services were failing in the second dip in 2-stage call (SIP-SIP).

Impact: The SBC was not sending STIR/SHAKEN parameters, such as identity headers, to the PSX in the trigger request portion of a two-stage call or processing the STIR/SHAKEN parameters in the response.

Root Cause: The SBC was missing code to handle the interaction between two-stage calls and STIR/SHAKEN logic.

Steps to Replicate: Make a two-stage call where the INVITE contains identity headers and check they are sent to the PSX in both the policy request and trigger request.

The code is modified to send STIR/SHAKEN parameters such as identity headers to the PSX in the trigger request portion of a two-stage call and process the STIR/SHAKEN parameters in the response.

Workaround: None.

SBX-110746


2

The SIP ACK was missing in TRC, although the SBC sent one.

Impact: The 200 OK for the INVITE received on the egress call leg contains a Record-Route header with an FQDN. The SBC resolves the Record-Route FQDN through the DNS and routes the ACK to the resolved target. The SIP ACK PDU that the SBC sent to the egress call leg is missing in the TRC log.

Root Cause: The root cause is in SipsDnsLookupRspForTCB() when the DNS response comes back.
SIP_CALL_STR *pstCall is set as NULL when SipsTXNDownstreamMsgToFsm is called. Due to the NULL check of pstCall in later functions, the SipSgTraceDumpSipPdu() is not called to log ACK PDU in TRC log.

Steps to Replicate: 

  1. Set up: SIP-SBX-SIP.
  2. Create a dnsgroup and configure the external DNS IP Address. Attach dnsgroup with egress zone.
  3. Create a global calltrace filter with "level1" and key "calling".
  4. Start the global calltrace and roll trace log event.
  5. Run SIP-SIP call. 200 OK for the INVITE received on the egress call leg contains Record-Route with an FQDN.
  6. Verify that egress ACK PDU is logged in TRC log.

The code is modified so in the function SipsDnsLookupRspForTCB, SIP_CALL_STR* pstCall is fetched and use in SipsTXNDownstreamMsgToFsm.

Workaround: None.

SBX-109614


2

There were  Error logs in DBG file after upgrade on 9.2.1

Impact: The SIPFE was reporting two kinds of major level error messages in the DBG logs:

  1. port range id not found from SipFePortRangeCnxSendDataReq()
    e.g. SipFePortRangeCnxSendDataReq 366] PORT_RANGE: id not found 412765
  2. port range id not found from SipFeRedundMirrorHashSync()
    e.g. SipFeRedundMirrorHashSync 1372] PORT_RANGE: failed to find Connection id in HAsh[4194719]

Root Cause: Port Range Support was added in a previous feature that involves four subsystems, SIPSG, SIPFE, SIPCM and XRM, among 3 processes. There were several message exchanges between the four subsystems before a port range connection is fully established.

Under certain circumstances, it is possible to hit some race conditions and find major DBG messages in DBG logs.

Steps to Replicate: The steps cannot be replicated.

The code is modified to print extra call related data in the current major level debug messages to help triage more if the problem occurs in the future.

When the issue occurs again, the call ID, signaling port Id, etc., is collected to help identify the call. The SipFeRedundMirrorHashSync() log is reduced from MAJOR level as well.

Workaround: N/A

SBX-111541


3

Reloading previous configuration fails when the LDAP delayedSync is enabled.

Impact: The delayed sync leaf used to accept only a future time if a configuration export and import is performed and if the system time is greater than the delayed sync time during import than import fails.

Root Cause: The delayed sync leaf used to accept only a future time if a configuration export and import is performed and if the system time is greater than the delayed sync time during import then import fails. It fails due to the check on the delayed sync leaf value that should be greater than the current system time.

Steps to Replicate: Use the following configuration:

  1. Add a profile with a future time value on the delayed sync leaf. Export the configuration.
  2. Clear the db.
  3. Import the configuration when the system time is greater than the configured delayed sync time.
  4. Import would fail without this fix.

Remove the restriction on the delayed sync leaf to be greater than the current system time to address the issue.

Workaround: Modify the delayed sync time in the export CLI.

SBX-112267


2

Correct the 92x serialization code for a registration control block.

Impact: When the registration control block is made redundant and the active/standby instances are running different software releases e.g. during upgrade, the redundancy logic might not work correctly if the registration control block contains a P-Charging-Vector (PCV) and/or P-Charging-Function-Addresses (PCFA) information. The redundancy logic will work correctly post upgrade when serialization of the redundancy data is not required.

Root Cause: The parameter lengths of the PCV and PCFA redundant parameters was not calculated correctly. This can lead to the redundancy code being unable to process all the redundancy information correctly.

Steps to Replicate: Run registration related tests with PCV and PCFA header parameters in an older release and then upgrade to 922R2 or later.

The code is modified to correctly set the length of these parameters to avoid problems with redundancy.

Workaround: None.

SBX-112493


2

The SBC is not decrypting the IPsec packet when a large PDU was sent over IPv6 from Strongswan.

Impact: The SBC is not decrypting the IPsec packet when a large PDU was sent from Strongswan IPSec endpoint.

Root Cause: The SBC SWe NP has a issue in last fragment data length processing w.r.t. This StrongSwan fragmented first and encrypted the next combination IPSec packets handling, which caused an ESP trailer offset being incorrect and resulted in call failures.

Steps to Replicate: Make large SIP PDU calls with the StrongSwan IPSec endpoint.

The code is modified to work for all combinations.

Workaround: Racoon/Navtel/SBC IPsec endpoints can be used if possible as a workaround.

SBX-113546


2

Policy server transactions were failing while running a load (3xx redirection with light dip) with 75K Number Translation criteria.

Impact: The postgres db is utilizing more CPU when a dmpm translation is executed at the service layer and as a result, impacting the performance.

Root Cause: Using a dmpm rule, either the calling or the called number can be modified at the prerouter layer. The PES previously analyzed the called and calling number completely even though it was exclusive to the called number or the calling. During an analysis of the call, the  PES used to perform direct DB fetch operations and this caused the postgres process to use more CPU.

Steps to Replicate: Create a dmpm rule service to modify the calling number. And then perform performance testing. The postgres process will utilize more CPU.

The code is modified so that, the PES analyzes either only the called number or only the calling number based on the rule type.

Workaround: none.

SBX-113610


2

A PES Process coredumps when deleting an adProfile entry.

Impact: The PES Process dumps core when the AD profile is deleted.

Root Cause: While synchronizing the data from remote domain controller, the PES fetches the AD profile once from the cache and uses the object for various decision making. So, if the AD profile is deleted, the object reference becomes NULL, and it dumps core.

Steps to Replicate: To create an AD profile, create its dependent profiles.

1. Create An AD Attribute Profile.
set profiles adAttributeMapProfile DEFAULT_AD_ATTRIBUTE_PROFILE adAttributeList adAttribute1 adAttributeName cn
set profiles adAttributeMapProfile DEFAULT_AD_ATTRIBUTE_PROFILE adAttributeList adAttribute2 adAttributeName displayName
commit

2. Create a domain controller profile
set global servers domainController dc0 userName DcUsername password DcPassword primaryAddress DcIpAddress searchScope base=engineering,dc=some,dc=com ldapQueryCriteria cn=*
commit

3. Create an AD profile:

set profiles adProfile DEFAULT_AD_PROFILE delayedSync 2021-09-29T14:00:00 syncInterval 1440 sync enable adServerList 1 dcServer dc0
commit

After 1-2 minutes of creating the AD profile, delete it.

The code is modified so the AD profile is not deleted. If, for some reason, the synchronization needs to be stopped, the sync opotion can be disabled on the AD profile. 

Workaround: If the AD profile is no more required, do not delete the AD Profile but disable the sync option on it. It will stop all the future auto sync operations.

SBX-112603


2

SBX-107111: Configured the DM/PM Rule not getting executed when the system is loaded with 75,000 number Translation criteria.

Impact: When there are more than 3,000 number translation criteria (NTC) objects are created, the PES cache goes for rebuild of the entire cache. The cache rebuild was not caching the NTC objects correctly.

Root Cause: During a rebuild of the NTC cache, a static variable was not reinitialized to zero. Since the static variable was not initialized to zero during a cache rebuild, it was using the last modified value, and this was causing the cache to not rebuild with the all the NTC objects.

Steps to Replicate: Create more than 3,000 NTC objects and make a call to match the NTC key. It will fail to find a match in the cache.

The code is modified to initialize the static variable to zero, when a fresh cache rebuild is triggered.

Workaround: None.

SBX-112670


2

The SBC is sending an unexpected INVITE towards the UAS.

Impact: In an SBX-GW-GW-SBX call flow (as described in the test setup), the SBC was sending unexpected re-INVITE to the network. The re-INVITE was internally generated in order to handle the change in SDP parameters triggered by the SMM rules.

Root Cause: This was a side effect of for a previous fix in the 9.2.1 release.

Steps to Replicate: 

  1. Create a GW-GW set up.
  2. From UAS send 183 with a=sendonly along with image and text lines with sendrecv.
  3. SBC sends 183 with audio line as a=sendonly (That is removed by the SMM).
  4. Send a 180 from the UAS that the SBC sends to UAC.
  5. Send a 200 from UAS without the sdp.
  6. The SBC sends a re-INVITE to ingress with audio m line sendonly along with image and text port as 0 (SMM changes the audio line to sendrecv).
  7. The SBC gets 200 for re-INVITE from UAC with audio line sendrecv.

After step 7, we should not see a re-INVITE towards the UAS.

The code is modified to take care of the case when holding a re-INVITE is actually received from a network or if it was locally generated. Only in a case where it was from network, we propagate the re-INVITE to the other end.

Workaround: None.

SBX-113385


2

An unexpected 504 response was received, after a crankback to "500".

Impact: When the SIP trunk group control UseNonDefaultCauseCodeForARSBlacklist is enabled and the outgoing message cannot be sent due to address unreachable status, the crankback to the next end point was not occurring.

Root Cause: The code was incorrectly updated during 9.2.2 to try and map from SIP to CPC using internal 7xx status codes which are generated by the stack for events such as timeouts. This lead to the disconnect reason code being mapped to 0 that did not exist in the crankback profile instead of 168 which was expected. So the crankback did not occur and the call was released with 504.

Steps to Replicate: 

  1. Run a test case with multiple trunk groups.
  2. Send in a subscribe message that is routed through the SBC and respond back with 500.

The message should be attempted to the next end point, but if that end point is blocklisted due to pathcheck configuration the message should be sent to the next again end point.

The code is modified to only consider the standard SIP status codes when trying to map from SIP to the CPC so that the correct disconnect reason code of 168 is used to trigger a crankback.

Workaround: None.

SBX-1137662

The SCM process crash was observed when trying to show the ARS blocklisted entries.

Impact: When too many peers are in ARS blocklisted table(more than 90 entries) and the "show status addressContext default zone <ZONE_NAME> sipArsStatus" command was issued, the SCM process crashed.

Root Cause: The code was incorrectly indexing to a negative location in an array that led to an invalid memory access and a coredump.

Steps to Replicate: Block list multiple peers and then run the status command. This was only seen once in lab testing.

The code is modified to avoid accessing the negative array location to avoid the coredump.

Workaround: None.

SBX-909892

EMA CDR Viewer: SIP Ladder diagram tool presenting incomplete packets

The SBC CDR Viewer is enhanced to overcome SIP Ladder diagram size limitations to ensure large messages display. 

Impact: Incomplete packets display in the SIP Ladder diagram tool because the EMA did not know to append the next block to the previous PDU in the tool, and dropped the secondary packet block.

Root Cause: Due to size limitations, large packets are getting split into two blocks, causing the second block to get prepended with information about the filter when it is written to the TRC log.

Steps to Replicate: Use call trace filter to capture some large messages i.e. more than 2K in size and check that they are displayed correctly in the SIP ladder diagram.

The code is modified to ensure large messages display in the SIP Ladder diagram.

Workaround: None.

Resolved Issues in 09.02.02R004 Release

The following Severity 1 issues are resolved in this release:

Severity 1 Resolved Issues