Fix problem where a hung channel could occur on a failed blind transfer.

Different clients react differently to being told that a blind transfer
has failed. Some will simply send a BYE and be done with it. Others will
attempt to reinvite themselves back onto the call.

In the latter case, we were creating a new channel and then leaving it to
sit forever doing nothing. With this code change, that new channel will
not be created and the dialog with the transferring channel will be cleaned
up properly.

ASTERISK-24624 #close
Reported by Zane Conkle

Review: https://reviewboard.asterisk.org/r/4339

Change-Id: I76e440e08e603c1eea40a14951e7b171c0472a55

diff --git a/channels/chan_pjsip.c b/channels/chan_pjsip.c
index 7617ae00cdc05c4c1a11c5ebb39ae251f92be15a..ac73375c68779dcfc46239a0868c676afdb6960a 100644 (file)
--- a/channels/chan_pjsip.c
+++ b/channels/chan_pjsip.c
@@ -2025,6 +2025,21 @@ static int chan_pjsip_incoming_request(struct ast_sip_session *session, struct p
                return 0;
        }
 
+       if (session->inv_session->state >= PJSIP_INV_STATE_CONFIRMED) {
+               /* Weird case. We've received a reinvite but we don't have a channel. The most
+                * typical case for this happening is that a blind transfer fails, and so the
+                * transferer attempts to reinvite himself back into the call. We already got
+                * rid of that channel, and the other side of the call is unrecoverable.
+                *
+                * We treat this as a failure, so our best bet is to just hang this call
+                * up and not create a new channel. Clearing defer_terminate here ensures that
+                * calling ast_sip_session_terminate() can result in a BYE being sent ASAP.
+                */
+               session->defer_terminate = 0;
+               ast_sip_session_terminate(session, 400);
+               return -1;
+       }
+
        datastore = ast_sip_session_alloc_datastore(&transport_info, "transport_info");
        if (!datastore) {
                return -1;

diff --git a/res/res_pjsip_session.c b/res/res_pjsip_session.c
index 9bcd311e1535bc01000b9a5cd7800b95ba42c460..bedb6061e33b0a4fa813313e16770c075d5337f8 100644 (file)
--- a/res/res_pjsip_session.c
+++ b/res/res_pjsip_session.c
@@ -808,7 +808,8 @@ static pj_bool_t session_reinvite_on_rx_request(pjsip_rx_data *rdata)
 
        if (rdata->msg_info.msg->line.req.method.id != PJSIP_INVITE_METHOD ||
                !(dlg = pjsip_ua_find_dialog(&rdata->msg_info.cid->id, &rdata->msg_info.to->tag, &rdata->msg_info.from->tag, PJ_FALSE)) ||
-               !(session = ast_sip_dialog_get_session(dlg))) {
+               !(session = ast_sip_dialog_get_session(dlg)) ||
+               !session->channel) {
                return PJ_FALSE;
        }