reSIProcate commits

August 10, 2026

Commits Fix integer overflow and resource exhaustion in WsFrameExtractor (#478)

Fix integer overflow and resource exhaustion in WsFrameExtractor (#478)

The WebSocket frame parser is reachable pre-authentication, before any
SIP credentials are exchanged, so every one of these is remotely
triggerable by an unauthenticated peer.

Reported in https://github.com/resiprocate/resiprocate/issues/478 (thanks to @afldl):

* The frame size check computed mMessageSize + mPayloadLength and
  compared it against mMaxMessage. mPayloadLength comes straight off the
  wire as a 64 bit field, so a fragment followed by a frame declaring a
  length near 2^64 wrapped the sum to a small value and slipped past the
  check, leading to an uncaught std::bad_alloc or a huge allocation per
  connection. Rewritten to test the two bounds separately without
  overflowing. mPayloadLength was also a Data::size_type, which silently
  truncated the wire value on 32 bit builds; it is now a uint64_t and is
  narrowed only once mMaxMessage has bounded it.

* The 64 bit length was assembled with || instead of | on the last byte.
  Since || has the lowest precedence, the whole expression collapsed to
  0 or 1 and lengths over 65535 never parsed at all.

Found while writing the regression tests, in the same code path:

* parseHeader() required only 8 header bytes before reading the 64 bit
  length, which actually occupies bytes 2 through 9. A masked frame split
  across reads could leave mHeaderLen at 8 or 9, and the length and the
  mask key were then built out of uninitialized bytes of the header
  buffer (mHeaderLen - hdrPos underflowed past the mask guard). Every
  branch now guarantees mHeaderLen >= hdrPos.

* A complete header of 14 bytes, the maximum, was rejected as "header too
  long", so any masked frame using a 64 bit length - which is what a
  browser sends for a message over 64 KB - dropped the connection. Only
  an incomplete header that would exceed the buffer is rejected now, and
  the header is re-parsed as soon as its bytes arrive so an oversized
  frame is refused when its header is known rather than when its payload
  starts turning up.

* joinFrames() deleted the Data of the first fragment without freeing the
  buffer it had borrowed, leaking it on every multi-frame message, and
  the destructor never freed a partially received mPayload. mPayload,
  mPayloadPos, mPayloadLength, mMasked and mFinalFrame were left
  uninitialized by the constructor.

* Empty continuation frames never advance mMessageSize, so the size limit
  could not terminate a flood of them: two bytes on the wire bought
  unbounded heap. Bounded the number of fragments per message at 1024.

Adds resip/stack/test/testWsFrameExtractor.cxx, which covers 7, 16 and 64
bit lengths masked and unmasked, fragmentation, the overflowing lengths
from the report, the mMaxMessage boundaries, the fragment flood,
destructor safety and malformed input, feeding the bytes at every chunk
size from one byte up so each split point of the header is exercised.
214 of its checks fail against the unfixed parser.

Commits Merge pull request #479 from jmariasc/fix/cmake-soci

Merge pull request #479 from jmariasc/fix/cmake-soci

Fix to CMakeList.txt for soci inclusion when reConServer is built

August 01, 2026

Commits CMake: Fix soci inclusion for reConServer.

CMake: Fix soci inclusion for reConServer.

reConServer's B2BCallManager includes soci.h unconditionally, so soci_core is needed whenever BUILD_RECONSERVER is on, even without USE_SOCI_POSTGRESQL OR USE_SOCI_MYSQL are  ON.

July 29, 2026

Commits Merge branch 'master' of https://github.com/resiprocate/resiprocate
```
Merge branch 'master' of https://github.com/resiprocate/resiprocate
```

Commits Fix digest auth failing when the user file has CRLF line endings

Fix digest auth failing when the user file has CRLF line endings

std::getline strips only the LF, so a CRLF file leaves a trailing CR in the
last field each of these parsers reads. Windows opens the file in text mode
and the CRT translates CRLF to LF, so the CR never arrives; on POSIX there is
no translation. .gitattributes marks both files text=auto, so a Windows
checkout has CRLF in the working tree - running a Linux build against that
tree, as WSL on /mnt/c does, is enough to hit this.

In WebAdmin::parseUserFile() the affected field is the HA1. dbA1 became 33
bytes against a 32 byte computed A1, Data::operator== rejected the pair on
its size check before memcmp, and every web admin login failed with

    user admin failed to authenticate to web server
     compA1=587c67fddee5b46eef47c36d93016965
     dbA1=587c67fddee5b46eef47c36d93016965

which reads as though the two matched. The CR is the last byte of the
message, so it prints in the one position where nothing renders it.

ReTurnConfig::authParse() has the same defect in its state field, which
already stopped on \n but not \r. There the CR leaves state unequal to
"authorized" and the record is dropped with "Invalid state value at line N",
so the account goes missing rather than failing to authenticate.

Add the EOL characters to both skipToOneOf() sets, which is what
ConfigParse::parseConfigFile() and ReproAuthenticatorFactory::parseFile()
already do for their line-final fields. Tab joins the repro set as well - the
username and realm there reach skipWhitespace() after their colon, but the
HA1 had no equivalent.

Also replace a stray CP-1252 em dash (0x97) in .gitattributes with an ASCII
hyphen. It is not valid UTF-8 and rendered as a replacement character.

July 28, 2026

Commits Quiet the post-debify apt-get update; retry install on mirror failures

Quiet the post-debify apt-get update; retry install on mirror failures

apt-get update -qq still prints errors, so un-quieting it only added the
Hit:/Get: chatter.  The verify step's apt-cache policy libsipxtapi-dev
reports the same thing more directly - which version won, and from which
origin - so put the -qq back.

Separately, deb.debian.org reset the connection partway through two .deb
downloads, and a single failed archive aborts apt-get install and with it
the whole job:

  E: Failed to fetch .../cmake_3.18.4-2+deb11u1_amd64.deb  Error reading
     from server - read (104: Connection reset by peer)

Nothing about that run was wrong - the debify repository was added and its
indexes fetched normally - so a retry is the whole fix.  Move the package
list into $PACKAGES and wrap the install in an until loop that makes up to
three attempts, sleeping and refreshing the lists in between.  $PACKAGES
is expanded unquoted so that it word splits into arguments.  The loop
condition is exempt from set -e, so a failed attempt does not abort the
step before the retry runs.

Commits Fetch add-apt-debify to a file and run it rather than piping it into a

Fetch add-apt-debify to a file and run it rather than piping it into a
shell, so a failed download fails the step: a pipeline reports only the
shell's exit status, and an empty script exits 0.

Commits Fail Linux CI at setup when libsipxtapi-dev is the wrong one

Fail Linux CI at setup when libsipxtapi-dev is the wrong one

recon includes <CpTopologyGraphFactoryImpl.h>, a sipXtapi header that
upstream kept in noinst_HEADERS - deliberately not installed - until
commit 6efe991 (Nov 2025) moved it to nobase_include_HEADERS. The only
package that provides it is libsipxtapi-dev 3.3.0~test20-2 from
apt.debify.org; Debian bullseye's own 3.3.0~test18+dfsg.1-0.1 does not.

Adding the debify repository is therefore not optional, but every way it
can fail is silent:

  - wget -O - http://apt.debify.org/add-apt-debify | bash reports only
    bash's exit status, so a failed fetch pipes an empty script into a
    shell that exits 0 and the repository is never added.
  - apt-get update -qq suppresses the Err:/W: lines that would name a
    broken source.
  - FindsipXtapi.cmake probes for CpTopologyGraphInterface.h, which both
    versions ship, so configure succeeds against either.

The build then dies ~86% in on a missing include, pointing at recon
rather than at the dependency that was never installed.

Set pipefail so the wget failure fails the step, drop -qq from the update
that follows the repository being added (the earlier one only covers
Debian's own sources), and add a verification step that records
apt-cache policy libsipxtapi-dev and hard-fails if the header is absent.
Assert on the header rather than on a version string: it is the actual
requirement, and it stays correct if debify ever ships a different
version that still works.

This does not fix the underlying exposure - a third-party repository
whose indexes have not moved since 2022, on a Debian release that is
nearly EOL - it only makes the failure legible and immediate.

Commits Warn instead of aborting for POSIX-only settings on Windows

Warn instead of aborting for POSIX-only settings on Windows

All four ServerProcess subclasses - repro, reConServer, registrationAgent and
reTurnServer - called these unguarded, so all four were affected.

Add ServerProcess::checkPosixProcessControl(dependentSettings), which reports
whether this build has fork(), setuid/setgid and PID file handling, and on
Windows logs a warning naming the settings before returning false.

Commits Fix RPM packaging overrides broken by the repro.config cleanup

Fix RPM packaging overrides broken by the repro.config cleanup

Commit 68651a3 commented out every repro.config setting that was already at
its default. The %install section applied its packaging values with 13 sed
expressions anchored to exact uncommented lines, so 7 of them quietly became
no-ops - sed says nothing when a pattern misses, and the package kept
building.

Rewriting lines is simply the wrong mechanism now - after the cleanup there
are, by design, no uncommented lines to rewrite. Append the values instead,
under a "Packaging overrides" heading: later settings win, and a future
repro.config edit cannot silently disable an override again. All of them move
into the block, including the few whose sed still matched, so there is one
mechanism rather than two.

TlsDHParamsFilename is the exception and stays a sed. It is an active line in
repro.config, and ConfigParse::insertConfigValue() throws on a repeated key,
so appending it would abort startup instead. The block warns about this, since
uncommenting an example that also appears below fails the same way.

Commits Add repro/dh2048.pem; group .pem with config files in IDE projects

Add repro/dh2048.pem; group .pem with config files in IDE projects

repro.config ships TlsDHParamsFilename = dh2048.pem, but no such file
existed anywhere in the repro source tree. Running repro from a build tree
therefore logged two warnings for every SSL context created

    Unable to load DH parameters (required for PFS): BIO_new_file failed to
    open file dh2048.pem

Add it to CONFIG_FILES so the existing POST_BUILD step copies it next to the
binary, and to the Windows install(FILES) list, whose stated purpose is
letting repro be run in place. Both were already doing this for users.txt and
repro.config.

The Linux packages deliberately do not ship this file and are unchanged:
debian/repro.postinst and the %post scriptlet in resiprocate.spec.in each
generate a fresh /etc/repro/dh2048.pem at install time, so no two
installations share parameters. The spec already rewrites TlsDHParamsFilename
to that absolute path, and the RPM lists it %ghost. A comment in
repro/CMakeLists.txt records this so the in-tree copy is not mistaken for
something the packages install.

Extend the "Config and Text Files" source_group regex to match .pem as well as
.config and .txt. A .pem is configuration in the same sense those are, and
without this the new file would fall back to the generated project root
instead of grouping with users.txt and repro.config. CMake classifies the
unknown extension as a <None> item, so Visual Studio lists it without trying
to compile it.

July 27, 2026

Commits Clean up repro.config: document defaults, comment out default settings

Clean up repro.config: document defaults, comment out default settings

Every setting in the shipped repro.config now ends its documentation block
with a "# Default:" line stating the value repro applies when the setting is
absent.

Settings whose value already matched the default are commented out, since a
default-valued assignment carries no information, and their example values
were changed to differ from the default so an uncommented line always means
something.

Fix documentation that was wrong:

- OpenSSLCTXSetOptions claimed its flags "are added (logical OR) to any
  existing flags already set by default". They are not.
  ReproRunner::setOpenSSLCTXOptionsFromConfig assigns opts = 0 before OR'ing,
  so the setting replaces the defaults entirely and every required flag must
  be listed. The default set also includes SSL_OP_NO_COMPRESSION, which was
  undocumented.
- MessageSiloExpirationTime said "Default (259200 seconds = 30 days)". The
  default is 2592000; 259200 seconds is 3 days.
- LogFilename's default is argv[0] + ".log", not a fixed repro.log.
- The LogLevel value list omitted EMERG, ALERT and NOTICE, and did not
  mention that an unrecognized level falls back to DEBUG.

Pull the Database settings out of the Misc section into their own section
above it, and split the Transport section, which had accumulated the HTTP
admin interface, the command server and registration/publication replication
under a heading none of them belong to. Add DatabasePath, which was
undocumented despite being the fallback for Database<N>Path, the BerkeleyDB
location when no indexed database is declared, and the location of the
accounting event queues.

Normalize formatting: uniform section bars, one blank line between settings,
two before a section header, "#Name = value" for every commented example
(previously a mix of "#Name" and "# Name"), comments wrapped near 79 columns,
no tabs or trailing whitespace. Add a preamble documenting the file syntax,
including that trailing '#' comments are not supported - ConfigParse only
honours '#' as the first non-whitespace character on a line, so anything after
'=' becomes part of the value.

Two placeholder values that shipped uncommented are now commented out, the
only behavioural change in this commit:

- CommandEventTopic = localhost:5672/topic/sip.repro.event, which would open
  a broker connection on a Qpid Proton build, while every comparable AMQP
  setting (CommandQueue, RegSyncBrokerTopic) ships commented out.
- GeoProximityRequestUriFilter = ^sip:mediaserver.*@mydomain.com$, an example
  regex naming mydomain.com, effective only if GeoProximityTargetSorting is
  enabled.

July 20, 2026

Commits Merge pull request #476 from mykhailopopivniak/preserve-user-part-esc…

Merge pull request #476 from mykhailopopivniak/preserve-user-part-escaping

Problem
Uri decodes percent-escapes in the user part at parse time
(dataUnescaped into mUser) and re-encodes them on serialization via the
process-global user-encoding table. When that table is configured not to
escape a character through setUriUserEncoding() — e.g. to let a literal #
pass through unescaped — an inbound percent-escaped form of that character is
silently unquoted on output: sip:1234%2300@h parses mUser to 1234#00 and
then serializes as sip:1234#00@h. The user part no longer round-trips, and a
strict RFC 3261 parser rejects the result because # is not allowed unescaped
in the user part.

Fix
Keep the as-received user-part bytes (mUserRaw) whenever the user part
contains a percent-escape, and emit them verbatim on encode as long as they
still decode (via the same dataUnescaped) to the current mUser. A
post-parse modification of the user part breaks that equality and falls back to
the existing table-based escaping. The raw bytes are propagated across the copy
constructor, operator=, and getAorAsUri, and cleared in
setUserAsTelephoneSubscriber.

An escaped character now round-trips unchanged regardless of the
encoding-table configuration, while an unescaped character is still encoded per
the table exactly as before. The common path is unaffected — mUserRaw is only
populated when the user part contains a %.

Compatibility
This also changes serialization under the default encoding table: a user
part containing any percent-escape is now emitted with its escaping preserved
rather than canonicalized (e.g. sip:12%2a34@h stays 12%2a34 instead of
becoming 12*34). This is RFC 3261-equivalent — user parts compare after
unescaping and operator==/aorEqual compare the decoded value — but it is a
visible on-wire change for every caller, not only those that customize the table
via setUriUserEncoding().

Tests
testUri extended: an escaped # survives a host retarget, a copy, an
assignment, and getAorAsUri; a post-parse modification falls back to
table-based escaping; a password-bearing user part and a lowercase escape are
preserved byte-for-byte.

July 18, 2026

Commits Preserve percent-escaping in the URI user part

Preserve percent-escaping in the URI user part

Uri decodes percent-escapes in the user part when it parses a message
(dataUnescaped into mUser) and re-encodes them on serialization through
the process-global user-encoding table. When that table is configured
not to escape a character via setUriUserEncoding() (for example to let a
literal '#' pass through), an inbound percent-escaped form of that
character is silently unquoted on output: "%23" is decoded to '#' at
parse and then written back as a bare '#'. The user part no longer
round-trips, and a strict RFC 3261 parser rejects it because '#' is not
allowed unescaped there.

Keep the as-received user-part bytes (mUserRaw) whenever the user part
contains a percent-escape, and emit them verbatim on encode as long as
they still decode to the current user value; a later modification of the
user part falls back to table-based escaping. The raw bytes are carried
across copy, assignment, and getAorAsUri, and cleared when the user part
is rewritten via setUserAsTelephoneSubscriber. An escaped character now
round-trips unchanged regardless of the encoding-table configuration,
while an unescaped character is still encoded per the table as before.

Note that this also changes serialization under the default encoding
table: a user part containing any percent-escape is now emitted with its
escaping preserved rather than canonicalized through the table (e.g.
"sip:12%2a34@h" stays "12%2a34" instead of becoming "12*34"). This is
RFC 3261-equivalent -- user parts are compared after unescaping and
operator==/aorEqual compare the decoded value -- but it is a visible
on-wire change for every caller, not only those that customize the table
via setUriUserEncoding().

Extend testUri: an escaped '#' survives a host retarget, a copy, an
assignment, and getAorAsUri; a post-parse modification falls back to
table escaping; a password-bearing user part and a lowercase escape are
preserved byte-for-byte.

July 16, 2026

Commits Fix session-level SDP direction attribute overriding media-level

Fix session-level SDP direction attribute overriding media-level

SdpHelper::parseMediaLine resolved a media line's direction with an if/else
chain over resipMedia.exists(), testing "sendrecv" first. Medium::exists()
falls back to the session level, so a session-level a=sendrecv short-circuited
the chain before the medium's own a=sendonly was ever considered, and the
media line came out SENDRECV.

This inverts RFC 4566: a session-level attribute is only a default for media
sections that do not state their own, so a media-level direction must win.
Firefox emits a session-level a=sendrecv alongside media-level directions, so
any offer from it was mis-parsed.

Consult the medium's own attributes first, falling back to the session only
when the medium states no direction of its own. Medium::exists() cannot
distinguish an inherited attribute from a media-level one, but Session::exists()
consults only session-level attributes, so media.exists(k) && !session.exists(k)
isolates a media-level declaration. An attribute stated at both levels reports
false and falls through to the session, which yields the same direction.

Add tests to testSdpHelper covering the full matrix: media overriding a
conflicting session, session applying when the medium is silent, media applying
when the session is silent, both stating the same direction, neither stating
one, and independent per-m-line resolution in a multi-line offer.

Misc:
CMake: for Visual Studio
- Flatten header and source files into a single location
- Add .config and .txt files to a "Config and Text Files" folder

July 04, 2026

Commits Fix stunRand() seeding on unlisted platforms; delegate to Random (Iss…

Fix stunRand() seeding on unlisted platforms; delegate to Random (Issue #150)

stunRand() in rutil/stun/Stun.cxx hand-rolled a platform-specific seed for
the C library RNG (rdtsc on x86, gethrtime on Solaris, /dev/random or
/dev/urandom on macOS/Linux) and #error'd on any platform not in that list.
On OpenBSD/arm64 none of the branches match, so the build failed on the
"Need some way to seed the random number generator" #error (resiprocate
issue #150).

Replace the whole seed-and-generate body with a call to the resip Random
class, which is already included in this file (rutil/Random.hxx) and in the
same namespace. Random::getRandom() self-initializes, seeds portably from
/dev/urandom (present on OpenBSD), and has no platform #error, so this fixes
OpenBSD/arm64 and any other unlisted target while removing the fragile
per-platform code. Behavior is equivalent (a positive ~31-bit int consumed
modulo a range by stunRandomPort), and it now uses the better-maintained
generator instead of the self-described "weak" one.

All rand()/random()/srand()/srandom() usage in the file was confined to
stunRand(), so nothing else depended on its seeding side effect.

Commits Enable Data move semantics; remove obsolete RESIP_HAS_RVALUE_REFS guard

Enable Data move semantics; remove obsolete RESIP_HAS_RVALUE_REFS guard

resip::Data's move constructor and move-assignment operator were both
gated behind RESIP_HAS_RVALUE_REFS, a define the build never sets (it was
only listed in build/BuildSystem.txt as a define "outside the build
system"). As a result Data had only copy operations on every platform,
and every std::move(Data) across the codebase silently copied.

The guard was a C++03-era relic: rvalue references are C++11, which the
rest of the codebase already requires everywhere (std::move, noexcept,
unique_ptr, lambdas, override), so its disabled branch was unreachable on
any compiler that can build this project. Remove the guards in Data.hxx
and Data.cxx so the move constructor and move-assignment are always
compiled, and drop the stale entry from build/BuildSystem.txt.

Also fix the move-assignment before enabling it: the hand-rolled
operator=(Data&&) overwrote mBuf without freeing the buffer *this already
owned (a leak) and left the moved-from object aliasing the stolen buffer
with stale size/capacity. It now delegates to takeBuf(), which releases
the current buffer, steals the source's (or copies a local-buffer
source), and resets the source to a valid empty state.

Add move-semantics tests to testData.cxx covering buffer stealing, the
move-assign-into-a-heap-owning-target case (the one the old code leaked),
local-buffer moves, and a safe self-move.

Effect: Data now genuinely moves throughout the codebase (return-by-value,
std::move, container growth), and the clang-tidy performance-move-const-arg
warnings in reTurn/client/TurnAsyncSocket.cxx are resolved at the source.

Commits Speed up Windows CI: pin, cache, and Debug-only sipXtapi build

Speed up Windows CI: pin, cache, and Debug-only sipXtapi build

The Windows build clones and msbuilds sipXtapi from GitHub via
ExternalProject on every CI run, building both Debug and Release from an
unpinned default-branch HEAD. That is the bulk of Windows CI time.

- Pin sipXtapi to a specific upstream commit. The SHA lives in
  build/sipxtapi-commit.txt (single source of truth for the CMake pin and
  the CI cache key); CMake reads the first pure-hex line and passes it as
  ExternalProject GIT_TAG. If no SHA is present it falls back to the
  default branch HEAD and warns. -DSIPXTAPI_GIT_TAG=<ref> still overrides.
  This makes the sipXtapi version reproducible and gives CI a stable key.

- Build only the configuration CI needs. New SIPXTAPI_CONFIGURATIONS cache
  variable (default "Debug;Release", unchanged for local/dev) drives the
  msbuild invocations; the Windows workflow passes
  -DSIPXTAPI_CONFIGURATIONS=Debug, roughly halving the sipXtapi build.

- Cache the built sipXtapi tree. windows-ci.yml adds an actions/cache step
  for _build/sipXtapi-prefix keyed on the pinned commit + runner OS +
  toolchain salt. tar preserves the ExternalProject stamp mtimes, so on a
  hit the build step sees sipXtapi as up to date and skips the clone and
  msbuild; bumping the pin invalidates the key and rebuilds once.

Only the Windows build is affected: the Linux build links against the
system libsipxtapi-dev via find_package(sipXtapi) and does not use any of
this (noted in build/sipxtapi-commit.txt).

Commits Clean up clang and clang-tidy warnings across the tree

Clean up clang and clang-tidy warnings across the tree

Compiler (clang) warnings:
- Add RESIP_LAMBDA_CAPTURE_ALL_AND_THIS to rutil/compat.hxx and use it in
  reTurn/client/TurnAsyncSocket.cxx. It expands to '=, this' on C++20+ and
  '=' otherwise, so the lambda captures are warning-free from C++11 through
  C++20 (fixes -Wc++20-extensions without regressing older standards).
- reTurn TurnLoadGenClient: return 1 instead of 'false' from main (-Wmain;
  also corrects a success exit code on a config-parse failure).
- Add missing 'override' specifiers in repro pyroute plugin (PyRoutePlugin,
  PyRouteWorker) and tfm DumUserAgent (-Winconsistent-missing-override).
- Mark the sipXtapi include directory SYSTEM in resip/recon so third-party
  header pragmas (e.g. GCC's -Wclass-memaccess, unknown to clang) stop
  warning, and so it links into the shared recon library.

clang-tidy findings:
- rutil/stun Stun.hxx: replace the constructor's memset(this,0,sizeof(*this))
  with default member initializers. The struct is not trivially copyable
  (user-declared destructor), so the memset was undefined behavior; value-
  initializing each member is equivalent but well defined
  (bugprone-undefined-memory-manipulation).
- bugprone-exception-escape: guard destructors that do cleanup/logging
  (~TurnAllocation, ~TurnAsyncSocket, ~RequestEntry) with an inner try/catch
  so they cannot throw; wrap the real main() entry points (stunTestVectors,
  reConServer) in a function-try-block; suppress the name-heuristic match on
  the virtual method ReConServerProcess::main with NOLINT (its exceptions are
  handled by the real main()).

clang-tidy third-party noise:
- Mark the Python3/PyCXX include directories SYSTEM (rutil, repro pyroute,
  reConServer) so PyCXX header findings (self-assignment, exception-escape)
  are no longer reported.

Commits Build Netxx from contrib on Linux; drop libnetxx-dev dependency

Build Netxx from contrib on Linux; drop libnetxx-dev dependency

libnetxx-dev is no longer available on modern distributions and the CI
was fetching it from a third-party apt repo (apt.debify.org) that
frequently fails. Build Netxx from the in-tree contrib copy instead, as
we already do on Windows.

- Add USE_CONTRIB_NETXX option (default ON on all platforms) that
  decouples building Netxx from contrib from the global USE_CONTRIB, so
  Linux gets contrib Netxx without pulling in every other contrib lib.
- Mark the contrib Netxx target position-independent so it links into
  the shared tfm library on Linux, and relax warnings/-Werror and add
  -fpermissive for this old third-party code (no-op on MSVC).
- Remove libnetxx-dev from the Linux CI apt list and the README package
  list, and document USE_CONTRIB_NETXX in the README.

Also fix two latent build failures surfaced by building the full tree
with -Werror on Linux:

- TFM and REND use popt unconditionally, so force USE_POPT on when
  BUILD_TFM/BUILD_REND are enabled (mirrors how BUILD_TFM already forces
  USE_NETXX/USE_CPPUNIT). Fixes undefined popt symbols when linking
  sanityTests.
- Replace deprecated std::auto_ptr with std::unique_ptr in
  testSdpHelper.cxx (clean drop-in; createSdpFromResipSdp returns a raw
  pointer).

July 03, 2026

Commits .gitattrbutes change to exclude resip/stack/test/*.dat and testTFSM-*…

.gitattrbutes change to exclude resip/stack/test/*.dat and testTFSM-* fixtures, where CRLF is protocol-significant for the SIP parser tests.

Commits Normalize line endings to LF per .gitattributes. Excludes resip/stack…

Normalize line endings to LF per .gitattributes. Excludes resip/stack/test/*.dat and testTFSM-* fixtures, where CRLF is protocol-significant for the SIP parser tests.

Commits Merge branch 'master' of https://github.com/resiprocate/resiprocate
```
Merge branch 'master' of https://github.com/resiprocate/resiprocate
```
Commits Add .gitattributes to normalize line endings across platforms
```
Add .gitattributes to normalize line endings across platforms
```

Commits Merge pull request #475 from resiprocate/no-deprecations

Merge pull request #475 from resiprocate/no-deprecations

rutil: downgrade c-ares deprecation errors to warnings

Commits rutil: downgrade c-ares deprecation errors to warnings
```
rutil: downgrade c-ares deprecation errors to warnings
```

July 02, 2026

Commits Merge pull request #474 from resiprocate/close-exec

Merge pull request #474 from resiprocate/close-exec

Properly set close on exec for BSDs

Commits Fix non-deterministic SIP header encoding order

Fix non-deterministic SIP header encoding order

PR #438 (https://github.com/resiprocate/resiprocate/pull/438) replaced the
fixed-size, enum-indexed header array with a std::vector<HeaderInfo> in the
new KnownHeaders class. That vector stores headers in first-access/insertion
order, and encode()/encodeEmbedded() iterated it directly, so headers were
emitted on the wire in whatever order they happened to be touched first when
building the message -- varying from call to call.

Restore deterministic, enum-declared ordering by iterating both encode() and
encodeEmbedded() over the Headers::Type enum values (0 .. MAX_HEADERS-1) and
looking each type up via KnownHeaders::find(), which is O(1) via mHeaderIndices
and therefore no slower than the old array approach. This matches the behavior
documented in HeaderTypes.hxx ("The Type enum controls the order of output").

June 30, 2026

Commits Properly set close on exec for BSDs
```
Properly set close on exec for BSDs
```

June 26, 2026

Commits Merge branch 'master' of https://github.com/resiprocate/resiprocate
```
Merge branch 'master' of https://github.com/resiprocate/resiprocate
```

Commits Improve gain calculations in SipXBridgeMixer

Improve gain calculations in SipXBridgeMixer

Updated `outputGain` and `inputGain` calculations in
`SipXBridgeMixer::calculateMixWeightsForParticipant` to use
a precise scaling factor based on the bridge's fixed-point
unity (1024). This ensures accurate and consistent gain
scaling. Added detailed comments to explain the new logic.

June 24, 2026

Commits Update README with build configuration options

Update README with build configuration options

Added information about disabling QPID Proton and TFM test framework in the build process.

Commits Add ACL configuration logic to HttpProvider so that implementations c…
```
Add ACL configuration logic to HttpProvider so that implementations can use it
```

Commits Add new utility method isAddressAllowed to Tuple class

Add new utility method isAddressAllowed to Tuple class

- allows passing an ACL of allow/deny addresses/masks to check if tuple is allowed

June 19, 2026

Commits A couple of minor changes to make Coverity a bit happier

A couple of minor changes to make Coverity a bit happier

- initialize hmac arrays to 0's
- Random - change LoadLibrary to GetModuleHandle to avoid leaking single hLib handle

Commits Fix POSIX build error:

Fix POSIX build error:

strerror_r has two incompatible signatures depending on feature-test macros and the platform's libc. The GNU variant returns char* (the message, which may not be 'buf'); the XSI/POSIX variant returns int (0 on success) and writes the message into 'buf'. Let overload resolution pick the right one.

June 18, 2026

Commits Update README with C++11 version requirement

Update README with C++11 version requirement

Added a note in the README.md file to specify that the minimum
required C++ version for the reSIProcate repository is currently
C++11. This ensures developers are aware of the version
requirement when working with the repository.

Commits Merge pull request #471 from portsip/fix/invite-2xx-ack-correlation

Merge pull request #471 from portsip/fix/invite-2xx-ack-correlation

resip/dum: correlate the 2xx ACK to mInvite200 (fix endless 200 OK reâ€¦

Commits Fix: Remove [[nodiscard]] from isAckForCurrent200 for C++11/C++14 com…

Fix: Remove [[nodiscard]] from isAckForCurrent200 for C++11/C++14 compatibility

fix: Remove [[nodiscard]] from isAckForCurrent200 for C++11/C++14 compatibility

June 17, 2026

Commits resip/dum: correlate the 2xx ACK to mInvite200 (fix endless 200 OK re…

resip/dum: correlate the 2xx ACK to mInvite200 (fix endless 200 OK retransmission on overlapping/glare re-INVITE)

Summary

InviteSession decided whether an inbound ACK should stop retransmission of an outstanding 200 OK to an INVITE/re-INVITE by comparing mLastRemoteSessionModification's CSeq against the ACK's CSeq.

The previous logic was effectively:

lastRemote.CSeq > ack.CSeq means drop as stale.

That is the wrong correlator. The response being retransmitted is held in mInvite200, and RFC 3261 sections 13.2.2.4 and 17.1.1.3 require the ACK for a 2xx INVITE response to carry the same CSeq sequence number as the INVITE/2xx it acknowledges.

This PR correlates the ACK against mInvite200, applies the same key to the Retransmit200 and WaitForAck timers, and adds two defensive checks.

Symptoms

* A UAS-sent 200 OK to a re-INVITE retransmits forever, using T1, 2*T1, and then capped at T2, even though the peer's ACK is received and routed to the dialog.
* No onAckReceived callback is triggered; the log shows either no clear, or dropped stale ACK.
* After about 32 seconds, Timer H or the ACK wait timer expires and the call is torn down.
* This was observed in production against an SBC that hairpins a B2BUA call and emits bidirectional session-timer refresh re-INVITEs, causing re-INVITE glare.

Root cause

The clear-on-ACK logic in dispatchConnected, dispatchSentReinvite, dispatchReceivedReinviteSentOffer, dispatchWaitingToHangup, dispatchOthers, and the WaitForAck timer were keyed on mLastRemoteSessionModification.

That value can diverge from mInvite200 whenever:

1. Re-INVITE glare occurs.

We sent our own re-INVITE, so the state is now SentReinvite or a glare-related state, while we are still waiting for the ACK to a 2xx response we sent for the remote's re-INVITE.

2. Overlapping remote session-modification traffic occurs.

For example, the remote sends re-INVITE B with CSeq N+1 before the ACK for our 200 OK to re-INVITE A with CSeq N arrives.

dispatchConnected overwrites mLastRemoteSessionModification with B. When A's ACK with CSeq N arrives, the old guard evaluates N+1 > N as true, treats the ACK as stale, logs dropped stale ACK, and the retransmission never stops. The WaitForAck failsafe is armed with sequence N but is compared against CSeq N+1, so it also fails to fire.

3. A peer reuses, or does not strictly increase, the in-dialog CSeq.

Minimal reproducible sequence:

Remote sends INVITE with CSeq N:
re-INVITE A

DUM sends 200 OK with CSeq N:
starts Retransmit200 and WaitForAck with seq N
mInvite200 is 200(A)

Remote sends INVITE with CSeq N+1:
re-INVITE B
mLastRemoteSessionModification is updated to B

DUM sends 200 OK with CSeq N+1.

Remote sends ACK with CSeq N:
ACK for A

The old logic evaluates N+1 > N as true, treats the ACK as stale, and 200(A) retransmits until Timer H. The call then fails.

Fix

Add a new helper:

InviteSession::isAckForCurrent200(const SipMessage&) const

The helper returns true only if all of the following are true:

1. The message is an ACK request.
2. A 2xx retransmission is outstanding.
3. mCurrentRetransmit200 is non-zero.
4. mInvite200 is valid.
5. The ACK's CSeq sequence number equals mInvite200's CSeq sequence number.

Replace the stale guard with !isAckForCurrent200(msg) at all relevant ACK sites.

Each branch keeps its existing side effects, including clearing the retransmission state, calling onAckReceived, delivering answer-in-ACK, or sending BYE.

dispatchOthers is the universal fallback for re-INVITE and glare states, so this also covers states that do not special-case OnAck.

Key the timers off mInvite200.

WaitForAck and startRetransmit200Timer now use mInvite200's CSeq instead of mLastRemoteSessionModification's CSeq. This ensures the timers identify the specific 2xx response and continue to work even if mLastRemoteSessionModification is overwritten by later remote session-modification traffic.

Suppress stale Retransmit200 timer events.

The Retransmit200 branch now retransmits only when timeout.seq() still matches the current mInvite200's CSeq. This prevents a leftover timer for a superseded mInvite200 from retransmitting a replaced response.

The benign post-ACK case, where mCurrentRetransmit200 is zero, stays silent as before. Only genuine stale-chain suppression is logged.

The stale ACK log message is updated to:

dropped stale or duplicate ACK

Why this is safe

mInvite200 is constructor-initialised with new SipMessage, and all startRetransmit200Timer callers populate it via makeResponse(*mInvite200, ...) immediately before arming the timer. There is no null dereference.

Every mInvite200 mutation is paired with startRetransmit200Timer, so the live retransmit chain always matches and is never suppressed.

States whose ACK branch does more than clear are reached only with mCurrentRetransmit200 != 0.

WaitingToHangup and UAS_WaitingToHangup are entered only inside if(mCurrentRetransmit200), so BYE and termination still fire.

ReceivedReinviteSentOffer is entered through provideOffer(), which sends mInvite200 and starts the timer, so answer-in-ACK delivery still fires.

ServerInviteSession::dispatchAccepted, ServerInviteSession::dispatchWaitingToOffer, and ServerInviteSession::dispatchWaitingToHangup clear mCurrentRetransmit200 unconditionally. They do not use the fragile correlator and are not touched. The UAS initial-INVITE and queued-offer paths are unchanged.

This PR does not alter the main InviteSession state transitions.

The behavioral delta is limited to:

1. The ACK correlation bug fix.
2. Duplicate or stale ACKs no longer re-fire onAckReceived for the outstanding 2xx response.
3. Stale Retransmit200 timer events can no longer retransmit a replaced mInvite200.

Files changed

* resip/dum/InviteSession.cxx
* resip/dum/InviteSession.hxx

Testing

Verified by source audit of every ACK dispatch path and the Retransmit200 / WaitForAck timers. The new helper and timer guards compile clean under -std=c++20 -Wall -Wextra -Werror.

Recommended tests:

1. Run the existing DUM test suite under resip/dum/test.

2. Add a regression test for interleaved or glare re-INVITE.

The test should cover this sequence:

DUM sends 200 OK to re-INVITE A and starts Retransmit200 / WaitForAck.
mLastRemoteSessionModification advances because of re-INVITE B before ACK A arrives.
ACK A is received.

Assert that mCurrentRetransmit200 is cleared, onAckReceived is called once, and no further 200 OK is sent.

3. Add a stale Retransmit200 test.

The test should deliver a Retransmit200 timeout where timeout.seq() no longer matches the current mInvite200 CSeq.

Assert that no retransmission is sent.

June 16, 2026

Commits reTurn: implement real HMAC when USE_SSL isn't defined, add MESSAGE-I…

reTurn: implement real HMAC when USE_SSL isn't defined, add MESSAGE-INTEGRITY-SHA256 (RFC 8489)

- computeHmac(): replace the "hmac-not-implemented" placeholder used in
  non-USE_SSL builds with a real HMAC-SHA1 (RFC 2104) built on the bundled
  Sha1 class; OpenSSL is still used when USE_SSL is defined. Previously STUN
  MESSAGE-INTEGRITY was non-functional without OpenSSL.
- checkMessageIntegrity(): use a constant-time comparison instead of memcmp
  so the expected HMAC can't be recovered via a timing side channel.
- Add MESSAGE-INTEGRITY-SHA256 (attribute 0x001C) for the short-term
  credential mechanism (USE_SSL only; no SHA-256 is available otherwise):
  - parse and store the attribute (full 32-byte value), encode it after
    MESSAGE-INTEGRITY and before FINGERPRINT, and verify it
    (checkMessageIntegritySha256, constant-time, fail-closed without OpenSSL).
  - rewrite the header length field per integrity attribute when computing
    each HMAC, so MESSAGE-INTEGRITY covers up to itself and
    MESSAGE-INTEGRITY-SHA256 covers up to itself (RFC 8489 sec 14.5-14.7).
  - computeHmacSha256() via HMAC(EVP_sha256()).
Enabling SHA256 on outgoing messages (setting mHasMessageIntegritySha256)
and any ICE/long-term algorithm negotiation are left to callers / follow-up.

Misc
- fix typo in DialogUsageManager logging for content validation

Commits Use CSPRNG for security-sensitive SIP/STUN/TURN tokens (CWE-338)

Use CSPRNG for security-sensitive SIP/STUN/TURN tokens (CWE-338)

Random::initialize() seeded random()/rand() solely from time+PID via
getSimpleSeed(); the /dev/urandom bytes that were read got passed only to
RAND_add() and never reached srandom(), leaving the random() stream
predictable to an attacker who can approximate process start time and PID.

- Random.cxx: read /dev/urandom before seeding and XOR its entropy into the
  srandom()/initstate_r() seed. For the RESIP_RANDOM_THREAD_LOCAL build,
  capture that entropy process-wide and mix it into each thread's seed.
- Random.hxx: enable RESIP_RANDOM_WIN32_RTL by default so getRandom() uses
  RtlGenRandom (XP+) instead of srand()/rand(), with automatic fallback.
- Stun.cxx: generate the STUN transaction ID (stunBuildReqSimple) and the
  username nonce (stunCreateUserName) with Random::getCryptoRandom()
  instead of the weak stunRand() (also compounds the CWE-345 STUN work).
- ChannelManager.cxx: pick the initial TURN channel number with
  getCryptoRandom().
Completes the migration started for SIP tags/Call-IDs/branches/GRUU salt
(Helper.cxx) and Via branch transaction IDs (BranchParameter.cxx).

Commits Merge pull request #431 from Lastique/feature/increase_tid_quality

Merge pull request #431 from Lastique/feature/increase_tid_quality

Improve transaction ID uniqueness

Commits Merge pull request #432 from Lastique/feature/increase_ids_quality

Merge pull request #432 from Lastique/feature/increase_ids_quality

Use crypto RNG to generate various IDs that are supposed to be unique

Commits Authenticate STUN Binding responses (CWE-345)

Authenticate STUN Binding responses (CWE-345)

UdpTransport's STUN client accepted any datagram beginning 0x01 0x01 as a
Binding Success and stored its mapped address as the authoritative public
address, without checking the transaction id or the source. An on-path or
blind attacker could inject a spoofed response during a discovery cycle and
redirect the stack to an attacker-controlled address.

resip/stack/UdpTransport:
- Store the request's transaction id and the queried server address in
  stunSendTest(), and in processRxParse() reject responses that are
  unsolicited, come from an unexpected source, or whose transaction id does
  not match (RFC 5389 sec 10.1). A mismatch leaves the result unchanged so a
  genuine response can still be accepted; success consumes the request.
- Documented the single-outstanding-request restriction and that Short-term
  credentials and MESSAGE-INTEGRITY are intentionally not added to this SIP
   signaling transport (that belongs to ICE on the media path)

Misc changes (fix STUN MESSAGE-INTEGRITY in Stun.cxx/hxx):
- Implement computeHmac() as real HMAC-SHA1: OpenSSL when USE_SSL, otherwise
  the bundled Sha1 class via the RFC 2104 construction (previously it wrote a
  "hmac-not-implemented" placeholder in non-SSL builds).
- Fix MESSAGE-INTEGRITY encoding to be RFC 5389 sec 15.4 compliant (drop the
  bogus 64-byte zero padding from the HMAC input).
- Record the MESSAGE-INTEGRITY attribute offset during parsing and add
  stunVerifyMessageIntegrity(), which verifies the HMAC with a constant-time
  comparison.
- Fix server-side verification (even though it implements a deprecated
  authentication mechanism) . In stunServerProcessMsg(): it compared the
  wrong bytes, read an uninitialized buffer in non-SSL builds, and only ever
  recognized a hard-coded "test"/"1234" credential while silently accepting
  any other username. It now derives the password via stunCreatePassword(),
  verifies with stunVerifyMessageIntegrity(), and rejects failures with 431.

June 11, 2026

Commits Helper::getResponseCodeReason: Add SIP response code reason's for RFC…

Helper::getResponseCodeReason: Add SIP response code reason's for RFC8224 defined responses

Commits HttpProvider abstract base class expanded with get request timeout op…

HttpProvider abstract base class expanded with get request timeout options:
- ConnectTimeoutSeconds
- RequestTimeoutSeconds

Commits - basicClient sample app CMake update to include header files in IDE's
```
- basicClient sample app CMake update to include header files in IDE's
```

Commits Ensure reason-text complies with RFC 3326 formatting

Ensure reason-text complies with RFC 3326 formatting

Updated multiple methods to set the `reason-text` parameter as a quoted-string in compliance with RFC 3326. This includes changes to `ResponseContext::processResponse`, `ResponseContext::forwardBestResponse`, `DialogSet::addEndReasonToMessage`, and `InviteSession::sendBye` to ensure proper formatting of SIP headers.

May 27, 2026

Commits - stack: output multiple Identity headers as individual headers (not …

- stack: output multiple Identity headers as individual headers (not comma delimited)
- repro: don't strip PAssertedIdentityHeaders in IsTrustedNode processor if proxy had PAsstertedIdentityProcessing disabled

May 26, 2026

Commits - minor: remove non-ascii characters
```
- minor: remove non-ascii characters
```

Commits Add getByIndex method to ParserContainer

Add getByIndex method to ParserContainer

- added `getByIndex` to `ParserContainer` for retrieving header
field values by index with both const and non-const overloads.
- added tests
in `testSipMessage.cxx` to validate `getByIndex` functionality,
including in-range and out-of-range scenarios.

May 23, 2026

Commits -add support for rtcp-mux attribute to sdpcontainer

-add support for rtcp-mux attribute to sdpcontainer
-add support for SDP transport protocol: PROTOCOL_TYPE_UDP_TLS_RTP_SAVPF

May 19, 2026

Commits Misc fixes

Misc fixes

- move recon sdpTests to media/sdpcontainer/test/testSdpContainer
- fix issue in SipXRemoteParticipant that was discovered due to recent operator= change
- SdpHelper: modify multiple fingerprint handling to prefer SHA-256
- add unit test for multiple fingerprints

May 18, 2026

Commits Add SdpHelper unit tests and fix some issues with SDP capability nego…

Add SdpHelper unit tests and fix some issues with SDP capability negotiation handling

- improved SdpHelper to merge medium and session-level attributes for a=tcap and a=acap attributes (uses new method SdpContents::getMergedValues)
- process all potential configurations, not just the first one
- fix parsing when '|' symbol is used in pcfg
- fix SdpMediaLine assignment operator missing copy of potential media views/strings
- added support for RTP/AVPF protocol
- enhanced SDP parsing logic for capability negotiation scenarios

May 13, 2026

Commits Add RFC7714 crypto suites (WebRTC DTLS-SRTP) to SdpCryptoSuiteType
```
Add RFC7714 crypto suites (WebRTC DTLS-SRTP) to SdpCryptoSuiteType
```

May 08, 2026

Commits Add SIP Diversion header (RFC 5806) support

Add SIP Diversion header (RFC 5806) support

Implemented full support for the SIP Diversion header as specified in RFC 5806. This includes:
- Registration of Diversion as a multi-header in all relevant header and parsing files.
- Addition of Diversion header parameters: reason, counter, limit, privacy, and screen, with correct types and RFC references.
- New unit tests to verify Diversion header parsing and parameter access.

April 23, 2026

Commits Add REST API for SIP stack statistics (/api/v1/stats)

Add REST API for SIP stack statistics (/api/v1/stats)

Introduces /api/v1/stats endpoint for retrieving and resetting SIP stack statistics in JSON format. Implements async stats delivery using condition variables and mutexes, with timeout and HTTP 504 support. Updates WebAdmin and ReproRunner to handle and dispatch statistics messages. Adds helpers for compact JSON serialization of stats. Updates documentation and method signatures accordingly.

Commits Allow user/domain change with password on update

Allow user/domain change with password on update

Enhance RestAdmin user update logic to permit changing username and domain, but require a new password if either field is modified, since the password hash is bound to user+realm. Update error handling, record fetching, and user-facing messages to reflect this requirement. Update API documentation accordingly.  Add validation of this logic on the HTML WebAdmin side as well.

April 22, 2026

Commits -fix linux build issue
```
-fix linux build issue
```