Reuse the same ID for both auth-less and auth-ful INVITEs #488
Conversation
| inviteOKRetryAttemptsNoACK = 2 | ||
| inviteOkAckLateTimeout = inviteOkRetryIntervalMax | ||
|
|
||
| inviteCredentialValidity = 60 * time.Minute // Allow reuse of credentials for 1h |
There was a problem hiding this comment.
Not sure this is smart, might want to extend this to max_call_duration or something.
Also, keep in mind that this is per Call-ID for now, so new calls would still need re-auth.
| tr := callTransportFromReq(req) | ||
| legTr := legTransportFromReq(req) | ||
| log := s.log.WithValues( | ||
| "callID", callID, |
There was a problem hiding this comment.
The one log line that will not have callID now is "Bad request", when validation fails.
alexlivekit
changed the title
| if err != nil { | ||
| return nil, fmt.Errorf("invalid challenge %q: %w", challengeStr, err) | ||
| } | ||
| toHeader := resp.To() |
There was a problem hiding this comment.
Now that we're doing the right validation on the inbound side, the outbound side E2E test caught this error!
But this also means out clients might run into the same issue, in case some of them are not spec-compliant.
pkg/sip/inbound.go
Outdated
| log: log, | ||
| s: s, | ||
| id: id, | ||
| id: "unassigned", |
There was a problem hiding this comment.
Would be helpful if it logs/panics if something tries to read this unassigned ID.
There was a problem hiding this comment.
I would rather not add shims or verification for this. Unless it's real clean, I'd rather leave it blank. Would that be better in your opinion?
alexlivekit
changed the title
alexlivekit
force-pushed
the
reuse-callid-auth
branch
from
0658b5d to
de0faf0
Compare
alexlivekit
force-pushed
the
reuse-callid-auth
branch
from
6570314 to
225dab8
Compare
alexlivekit
force-pushed
the
reuse-callid-auth
branch
from
225dab8 to
9118c31
Compare
See this thread for more details. Main point:
When we authenticate for the purposes of a SIP session (when credentials are not being cached), the following happens:
If we happen to count the 407 response as a failed call, and we generate unique SCL_* ids for both.