chan_iax2.c

Go to the documentation of this file.

/*
 * Asterisk -- An open source telephony toolkit.
 *
 * Copyright (C) 1999 - 2006, Digium, Inc.
 *
 * Mark Spencer <markster@digium.com>
 *
 * See http://www.asterisk.org for more information about
 * the Asterisk project. Please do not directly contact
 * any of the maintainers of this project for assistance;
 * the project provides a web site, mailing lists and IRC
 * channels for your use.
 *
 * This program is free software, distributed under the terms of
 * the GNU General Public License Version 2. See the LICENSE file
 * at the top of the source tree.
 */

/*! \file
 *
 * \brief Implementation of Inter-Asterisk eXchange Version 2
 *        as specified in RFC 5456
 *
 * \author Mark Spencer <markster@digium.com>
 *
 * \par See also
 * \arg \ref Config_iax
 *
 * \ingroup channel_drivers
 */

/*** MODULEINFO
   <use>dahdi</use>
        <depend>res_features</depend>
 ***/

#include "asterisk.h"

ASTERISK_FILE_VERSION(__FILE__, "$Revision: 324627 $")

#include <stdlib.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <dirent.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <sys/time.h>
#include <sys/signal.h>
#include <signal.h>
#include <string.h>
#include <strings.h>
#include <errno.h>
#include <unistd.h>
#include <netdb.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <regex.h>

#if defined(HAVE_ZAPTEL) || defined (HAVE_DAHDI)
#include <sys/ioctl.h>
#include "asterisk/dahdi_compat.h"
#endif

#include "asterisk/lock.h"
#include "asterisk/frame.h" 
#include "asterisk/channel.h"
#include "asterisk/logger.h"
#include "asterisk/module.h"
#include "asterisk/pbx.h"
#include "asterisk/sched.h"
#include "asterisk/io.h"
#include "asterisk/config.h"
#include "asterisk/options.h"
#include "asterisk/cli.h"
#include "asterisk/translate.h"
#include "asterisk/md5.h"
#include "asterisk/cdr.h"
#include "asterisk/crypto.h"
#include "asterisk/acl.h"
#include "asterisk/manager.h"
#include "asterisk/callerid.h"
#include "asterisk/app.h"
#include "asterisk/astdb.h"
#include "asterisk/musiconhold.h"
#include "asterisk/features.h"
#include "asterisk/utils.h"
#include "asterisk/causes.h"
#include "asterisk/localtime.h"
#include "asterisk/aes.h"
#include "asterisk/dnsmgr.h"
#include "asterisk/devicestate.h"
#include "asterisk/netsock.h"
#include "asterisk/stringfields.h"
#include "asterisk/linkedlists.h"
#include "asterisk/astobj2.h"

#include "iax2.h"
#include "iax2-parser.h"
#include "iax2-provision.h"
#include "jitterbuf.h"

/* Define SCHED_MULTITHREADED to run the scheduler in a special
   multithreaded mode. */
#define SCHED_MULTITHREADED

/* Define DEBUG_SCHED_MULTITHREADED to keep track of where each
   thread is actually doing. */
#define DEBUG_SCHED_MULTITHREAD

#ifndef IPTOS_MINCOST
#define IPTOS_MINCOST 0x02
#endif

#ifdef SO_NO_CHECK
static int nochecksums = 0;
#endif


#define PTR_TO_CALLNO(a) ((unsigned short)(unsigned long)(a))
#define CALLNO_TO_PTR(a) ((void *)(unsigned long)(a))

#define DEFAULT_THREAD_COUNT 10
#define DEFAULT_MAX_THREAD_COUNT 100
#define DEFAULT_RETRY_TIME 1000
#define MEMORY_SIZE 100
#define DEFAULT_DROP 3

#define DEBUG_SUPPORT

#define MIN_REUSE_TIME     60 /* Don't reuse a call number within 60 seconds */

/* Sample over last 100 units to determine historic jitter */
#define GAMMA (0.01)

static struct ast_codec_pref prefs;

static const char tdesc[] = "Inter Asterisk eXchange Driver (Ver 2)";

static char context[80] = "default";

static char language[MAX_LANGUAGE] = "";
static char regcontext[AST_MAX_CONTEXT] = "";

static int maxauthreq = 3;
static int max_retries = 4;
static int ping_time = 21;
static int lagrq_time = 10;
static int maxjitterbuffer=1000;
static int resyncthreshold=1000;
static int maxjitterinterps=10;
static int trunkfreq = 20;
static int authdebug = 1;
static int autokill = 0;
static int iaxcompat = 0;
static int last_authmethod = 0;

static int iaxdefaultdpcache=10 * 60;  /* Cache dialplan entries for 10 minutes by default */

static int iaxdefaulttimeout = 5;      /* Default to wait no more than 5 seconds for a reply to come back */

static unsigned int tos = 0;

static int min_reg_expire;
static int max_reg_expire;

static int timingfd = -1;           /* Timing file descriptor */

static struct ast_netsock_list *netsock;
static struct ast_netsock_list *outsock;     /*!< used if sourceaddress specified and bindaddr == INADDR_ANY */
static int defaultsockfd = -1;
static int unloading;

int (*iax2_regfunk)(const char *username, int onoff) = NULL;

/* Ethernet, etc */
#define IAX_CAPABILITY_FULLBANDWIDTH   (0xFFFF & ~AST_FORMAT_AUDIO_UNDEFINED)
/* T1, maybe ISDN */
#define IAX_CAPABILITY_MEDBANDWIDTH    (IAX_CAPABILITY_FULLBANDWIDTH &  \
                ~AST_FORMAT_SLINEAR &        \
                ~AST_FORMAT_ULAW &        \
                ~AST_FORMAT_ALAW &        \
                ~AST_FORMAT_G722) 
/* A modem */
#define IAX_CAPABILITY_LOWBANDWIDTH (IAX_CAPABILITY_MEDBANDWIDTH &      \
                ~AST_FORMAT_G726 &        \
                ~AST_FORMAT_G726_AAL2 &      \
                ~AST_FORMAT_ADPCM)

#define IAX_CAPABILITY_LOWFREE      (IAX_CAPABILITY_LOWBANDWIDTH &      \
                ~AST_FORMAT_G723_1)


#define DEFAULT_MAXMS      2000     /* Must be faster than 2 seconds by default */
#define DEFAULT_FREQ_OK    60 * 1000   /* How often to check for the host to be up */
#define DEFAULT_FREQ_NOTOK 10 * 1000   /* How often to check, if the host is down... */

static   struct io_context *io;
static   struct sched_context *sched;

static int iax2_capability = IAX_CAPABILITY_FULLBANDWIDTH;

static int iaxdebug = 0;

static int iaxtrunkdebug = 0;

static int test_losspct = 0;
#ifdef IAXTESTS
static int test_late = 0;
static int test_resync = 0;
static int test_jit = 0;
static int test_jitpct = 0;
#endif /* IAXTESTS */

static char accountcode[AST_MAX_ACCOUNT_CODE];
static char mohinterpret[MAX_MUSICCLASS];
static char mohsuggest[MAX_MUSICCLASS];
static int amaflags = 0;
static int adsi = 0;
static int delayreject = 0;
static int iax2_encryption = 0;

static struct ast_flags globalflags = { 0 };

static pthread_t netthreadid = AST_PTHREADT_NULL;
static pthread_t schedthreadid = AST_PTHREADT_NULL;
#ifndef AST_MUTEX_INIT_W_CONSTRUCTORS
AST_MUTEX_DEFINE_STATIC(sched_lock);
#else
static ast_mutex_t sched_lock;
#endif
static ast_cond_t sched_cond;

enum {
   IAX_STATE_STARTED =        (1 << 0),
   IAX_STATE_AUTHENTICATED =  (1 << 1),
   IAX_STATE_TBD =            (1 << 2),
} iax2_state;

struct iax2_context {
   char context[AST_MAX_CONTEXT];
   struct iax2_context *next;
};

enum {
   IAX_HASCALLERID =    (1 << 0),   /*!< CallerID has been specified */
   IAX_DELME =    (1 << 1),   /*!< Needs to be deleted */
   IAX_TEMPONLY =    (1 << 2),   /*!< Temporary (realtime) */
   IAX_TRUNK =    (1 << 3),   /*!< Treat as a trunk */
   IAX_NOTRANSFER =  (1 << 4),   /*!< Don't native bridge */
   IAX_USEJITTERBUF =   (1 << 5),   /*!< Use jitter buffer */
   IAX_DYNAMIC =     (1 << 6),   /*!< dynamic peer */
   IAX_SENDANI =     (1 << 7),   /*!< Send ANI along with CallerID */
        /* (1 << 8) is currently unused due to the deprecation of an old option. Go ahead, take it! */
   IAX_ALREADYGONE = (1 << 9),   /*!< Already disconnected */
   IAX_PROVISION =      (1 << 10),  /*!< This is a provisioning request */
   IAX_QUELCH =      (1 << 11),  /*!< Whether or not we quelch audio */
   IAX_ENCRYPTED =      (1 << 12),  /*!< Whether we should assume encrypted tx/rx */
   IAX_KEYPOPULATED =   (1 << 13),  /*!< Whether we have a key populated */
   IAX_CODEC_USER_FIRST =  (1 << 14),  /*!< are we willing to let the other guy choose the codec? */
   IAX_CODEC_NOPREFS =     (1 << 15),  /*!< Force old behaviour by turning off prefs */
   IAX_CODEC_NOCAP =    (1 << 16),  /*!< only consider requested format and ignore capabilities*/
   IAX_RTCACHEFRIENDS =    (1 << 17),  /*!< let realtime stay till your reload */
   IAX_RTUPDATE =       (1 << 18),  /*!< Send a realtime update */
   IAX_RTAUTOCLEAR =    (1 << 19),  /*!< erase me on expire */ 
   IAX_FORCEJITTERBUF = (1 << 20),  /*!< Force jitterbuffer, even when bridged to a channel that can take jitter */ 
   IAX_RTIGNOREREGEXPIRE = (1 << 21),  /*!< When using realtime, ignore registration expiration */
   IAX_TRUNKTIMESTAMPS =   (1 << 22),  /*!< Send trunk timestamps */
   IAX_TRANSFERMEDIA =  (1 << 23),      /*!< When doing IAX2 transfers, transfer media only */
   IAX_MAXAUTHREQ =        (1 << 24),      /*!< Maximum outstanding AUTHREQ restriction is in place */
   IAX_DELAYPBXSTART =  (1 << 25),  /*!< Don't start a PBX on the channel until the peer sends us a
                       response, so that we've achieved a three-way handshake with
                       them before sending voice or anything else*/
   IAX_ALLOWFWDOWNLOAD = (1 << 26), /*!< Allow the FWDOWNL command? */
   IAX_SHRINKCALLERID  = (1 << 27),   /*!< Turn on and off caller id shrinking */
} iax2_flags;

static int global_rtautoclear = 120;

static int reload_config(void);
static int iax2_reload(int fd, int argc, char *argv[]);

/*!
 * \brief Call token validation settings.
 */
enum calltoken_peer_enum {
   /*! \brief Default calltoken required unless the ip is in the ignorelist */
   CALLTOKEN_DEFAULT = 0,
   /*! \brief Require call token validation. */
   CALLTOKEN_YES = 1,
   /*! \brief Require call token validation after a successful registration
    *         using call token validation occurs. */
   CALLTOKEN_AUTO = 2,
   /*! \brief Do not require call token validation. */
   CALLTOKEN_NO = 3,
};

struct iax2_user {
   AST_DECLARE_STRING_FIELDS(
      AST_STRING_FIELD(name);
      AST_STRING_FIELD(secret);
      AST_STRING_FIELD(dbsecret);
      AST_STRING_FIELD(accountcode);
      AST_STRING_FIELD(mohinterpret);
      AST_STRING_FIELD(mohsuggest);
      AST_STRING_FIELD(inkeys);               /*!< Key(s) this user can use to authenticate to us */
      AST_STRING_FIELD(language);
      AST_STRING_FIELD(cid_num);
      AST_STRING_FIELD(cid_name);
   );
   
   int authmethods;
   int encmethods;
   int amaflags;
   int adsi;
   unsigned int flags;
   int capability;
   int maxauthreq; /*!< Maximum allowed outstanding AUTHREQs */
   int curauthreq; /*!< Current number of outstanding AUTHREQs */
   struct ast_codec_pref prefs;
   struct ast_ha *ha;
   struct iax2_context *contexts;
   struct ast_variable *vars;
   enum calltoken_peer_enum calltoken_required;        /*!< Is calltoken validation required or not, can be YES, NO, or AUTO */
};

struct iax2_peer {
   AST_DECLARE_STRING_FIELDS(
      AST_STRING_FIELD(name);
      AST_STRING_FIELD(username);
      AST_STRING_FIELD(secret);
      AST_STRING_FIELD(dbsecret);
      AST_STRING_FIELD(outkey);      /*!< What key we use to talk to this peer */

      AST_STRING_FIELD(regexten);     /*!< Extension to register (if regcontext is used) */
      AST_STRING_FIELD(context);      /*!< For transfers only */
      AST_STRING_FIELD(peercontext);  /*!< Context to pass to peer */
      AST_STRING_FIELD(mailbox);     /*!< Mailbox */
      AST_STRING_FIELD(mohinterpret);
      AST_STRING_FIELD(mohsuggest);
      AST_STRING_FIELD(inkeys);     /*!< Key(s) this peer can use to authenticate to us */
      /* Suggested caller id if registering */
      AST_STRING_FIELD(cid_num);    /*!< Default context (for transfer really) */
      AST_STRING_FIELD(cid_name);      /*!< Default context (for transfer really) */
      AST_STRING_FIELD(zonetag);    /*!< Time Zone */
   );
   struct ast_codec_pref prefs;
   struct ast_dnsmgr_entry *dnsmgr;    /*!< DNS refresh manager */
   struct sockaddr_in addr;
   int formats;
   int sockfd;             /*!< Socket to use for transmission */
   struct in_addr mask;
   int adsi;
   unsigned int flags;

   /* Dynamic Registration fields */
   struct sockaddr_in defaddr;         /*!< Default address if there is one */
   int authmethods;           /*!< Authentication methods (IAX_AUTH_*) */
   int encmethods;               /*!< Encryption methods (IAX_ENCRYPT_*) */

   int expire;             /*!< Schedule entry for expiry */
   int expiry;             /*!< How soon to expire */
   int capability;               /*!< Capability */

   /* Qualification */
   int callno;             /*!< Call number of POKE request */
   int pokeexpire;               /*!< Scheduled qualification-related task (ie iax2_poke_peer_s or iax2_poke_noanswer) */
   int lastms;             /*!< How long last response took (in ms), or -1 for no response */
   int maxms;              /*!< Max ms we will accept for the host to be up, 0 to not monitor */

   int pokefreqok;               /*!< How often to check if the host is up */
   int pokefreqnotok;            /*!< How often to check when the host has been determined to be down */
   int historicms;               /*!< How long recent average responses took */
   int smoothing;             /*!< Sample over how many units to determine historic ms */
   uint16_t maxcallno;              /*!< Max call number limit for this peer.  Set on registration */
   
   struct ast_ha *ha;
   enum calltoken_peer_enum calltoken_required;        /*!< Is calltoken validation required or not, can be YES, NO, or AUTO */
};

#define IAX2_TRUNK_PREFACE (sizeof(struct iax_frame) + sizeof(struct ast_iax2_meta_hdr) + sizeof(struct ast_iax2_meta_trunk_hdr))

static struct iax2_trunk_peer {
   ast_mutex_t lock;
   int sockfd;
   struct sockaddr_in addr;
   struct timeval txtrunktime;      /*!< Transmit trunktime */
   struct timeval rxtrunktime;      /*!< Receive trunktime */
   struct timeval lasttxtime;    /*!< Last transmitted trunktime */
   struct timeval trunkact;      /*!< Last trunk activity */
   unsigned int lastsent;        /*!< Last sent time */
   /* Trunk data and length */
   unsigned char *trunkdata;
   unsigned int trunkdatalen;
   unsigned int trunkdataalloc;
   struct iax2_trunk_peer *next;
   int trunkerror;
   int calls;
} *tpeers = NULL;

AST_MUTEX_DEFINE_STATIC(tpeerlock);

struct iax_firmware {
   struct iax_firmware *next;
   int fd;
   int mmaplen;
   int dead;
   struct ast_iax2_firmware_header *fwh;
   unsigned char *buf;
};

enum iax_reg_state {
   REG_STATE_UNREGISTERED = 0,
   REG_STATE_REGSENT,
   REG_STATE_AUTHSENT,
   REG_STATE_REGISTERED,
   REG_STATE_REJECTED,
   REG_STATE_TIMEOUT,
   REG_STATE_NOAUTH
};

enum iax_transfer_state {
   TRANSFER_NONE = 0,
   TRANSFER_BEGIN,
   TRANSFER_READY,
   TRANSFER_RELEASED,
   TRANSFER_PASSTHROUGH,
   TRANSFER_MBEGIN,
   TRANSFER_MREADY,
   TRANSFER_MRELEASED,
   TRANSFER_MPASSTHROUGH,
   TRANSFER_MEDIA,
   TRANSFER_MEDIAPASS
};

struct iax2_registry {
   struct sockaddr_in addr;      /*!< Who we connect to for registration purposes */
   char username[80];
   char secret[80];        /*!< Password or key name in []'s */
   char random[80];
   int expire;          /*!< Sched ID of expiration */
   int refresh;            /*!< How often to refresh */
   enum iax_reg_state regstate;
   int messages;           /*!< Message count, low 8 bits = new, high 8 bits = old */
   int callno;          /*!< Associated call number if applicable */
   struct sockaddr_in us;        /*!< Who the server thinks we are */
   struct ast_dnsmgr_entry *dnsmgr; /*!< DNS refresh manager */
   AST_LIST_ENTRY(iax2_registry) entry;
};

static AST_LIST_HEAD_STATIC(registrations, iax2_registry);

/* Don't retry more frequently than every 10 ms, or less frequently than every 5 seconds */
#define MIN_RETRY_TIME     100
#define MAX_RETRY_TIME     10000

#define MAX_JITTER_BUFFER  50
#define MIN_JITTER_BUFFER  10

#define DEFAULT_TRUNKDATA  640 * 10 /*!< 40ms, uncompressed linear * 10 channels */
#define MAX_TRUNKDATA      640 * 200   /*!< 40ms, uncompressed linear * 200 channels */

#define MAX_TIMESTAMP_SKEW 160      /*!< maximum difference between actual and predicted ts for sending */

/* If consecutive voice frame timestamps jump by more than this many milliseconds, then jitter buffer will resync */
#define TS_GAP_FOR_JB_RESYNC  5000

/* used for first_iax_message and last_iax_message.  If this bit is set it was TX, else RX */
#define MARK_IAX_SUBCLASS_TX  0x8000

static int iaxthreadcount = DEFAULT_THREAD_COUNT;
static int iaxmaxthreadcount = DEFAULT_MAX_THREAD_COUNT;
static int iaxdynamicthreadcount = 0;
static int iaxdynamicthreadnum = 0;
static int iaxactivethreadcount = 0;

struct iax_rr {
   int jitter;
   int losspct;
   int losscnt;
   int packets;
   int delay;
   int dropped;
   int ooo;
};

struct chan_iax2_pvt {
   /*! Socket to send/receive on for this call */
   int sockfd;
   /*! Last received voice format */
   int voiceformat;
   /*! Last received video format */
   int videoformat;
   /*! Last sent voice format */
   int svoiceformat;
   /*! Last sent video format */
   int svideoformat;
   /*! What we are capable of sending */
   int capability;
   /*! Last received timestamp */
   unsigned int last;
   /*! Last sent timestamp - never send the same timestamp twice in a single call */
   unsigned int lastsent;
   /*! Timestamp of the last video frame sent */
   unsigned int lastvsent;
   /*! Next outgoing timestamp if everything is good */
   unsigned int nextpred;
   /*! iax frame subclass that began iax2_pvt entry. 0x8000 bit is set on TX */
   int first_iax_message;
   /*! Last iax frame subclass sent or received for a iax2_pvt. 0x8000 bit is set on TX */
   int last_iax_message;
   /*! True if the last voice we transmitted was not silence/CNG */
   int notsilenttx;
   /*! Ping time */
   unsigned int pingtime;
   /*! Max time for initial response */
   int maxtime;
   /*! Peer Address */
   struct sockaddr_in addr;
   /*! Actual used codec preferences */
   struct ast_codec_pref prefs;
   /*! Requested codec preferences */
   struct ast_codec_pref rprefs;
   /*! Our call number */
   unsigned short callno;
   /*! Our callno_entry entry */
   struct callno_entry *callno_entry;
   /*! Peer callno */
   unsigned short peercallno;
   /*! Negotiated format, this is only used to remember what format was
       chosen for an unauthenticated call so that the channel can get
       created later using the right format */
   int chosenformat;
   /*! Peer selected format */
   int peerformat;
   /*! Peer capability */
   int peercapability;
   /*! timeval that we base our transmission on */
   struct timeval offset;
   /*! timeval that we base our delivery on */
   struct timeval rxcore;
   /*! The jitterbuffer */
        jitterbuf *jb;
   /*! active jb read scheduler id */
        int jbid;
   /*! LAG */
   int lag;
   /*! Error, as discovered by the manager */
   int error;
   /*! Owner if we have one */
   struct ast_channel *owner;
   /*! What's our state? */
   struct ast_flags state;
   /*! Expiry (optional) */
   int expiry;
   /*! Next outgoing sequence number */
   unsigned char oseqno;
   /*! Next sequence number they have not yet acknowledged */
   unsigned char rseqno;
   /*! Next incoming sequence number */
   unsigned char iseqno;
   /*! Last incoming sequence number we have acknowledged */
   unsigned char aseqno;

   AST_DECLARE_STRING_FIELDS(
      /*! Peer name */
      AST_STRING_FIELD(peer);
      /*! Default Context */
      AST_STRING_FIELD(context);
      /*! Caller ID if available */
      AST_STRING_FIELD(cid_num);
      AST_STRING_FIELD(cid_name);
      /*! Hidden Caller ID (i.e. ANI) if appropriate */
      AST_STRING_FIELD(ani);
      /*! DNID */
      AST_STRING_FIELD(dnid);
      /*! RDNIS */
      AST_STRING_FIELD(rdnis);
      /*! Requested Extension */
      AST_STRING_FIELD(exten);
      /*! Expected Username */
      AST_STRING_FIELD(username);
      /*! Expected Secret */
      AST_STRING_FIELD(secret);
      /*! MD5 challenge */
      AST_STRING_FIELD(challenge);
      /*! Public keys permitted keys for incoming authentication */
      AST_STRING_FIELD(inkeys);
      /*! Private key for outgoing authentication */
      AST_STRING_FIELD(outkey);
      /*! Preferred language */
      AST_STRING_FIELD(language);
      /*! Hostname/peername for naming purposes */
      AST_STRING_FIELD(host);

      AST_STRING_FIELD(dproot);
      AST_STRING_FIELD(accountcode);
      AST_STRING_FIELD(mohinterpret);
      AST_STRING_FIELD(mohsuggest);
   );
   /*! AUTHREJ all AUTHREP frames */
   int authrej;
   /*! permitted authentication methods */
   int authmethods;
   /*! permitted encryption methods */
   int encmethods;
   /*! Encryption AES-128 Key */
   aes_encrypt_ctx ecx;
   /*! Decryption AES-128 Key corresponding to ecx */
   aes_decrypt_ctx mydcx;
   /*! Decryption AES-128 Key used to decrypt peer frames */
   aes_decrypt_ctx dcx;
   /*! 32 bytes of semi-random data */
   unsigned char semirand[32];
   /*! Associated registry */
   struct iax2_registry *reg;
   /*! Associated peer for poking */
   struct iax2_peer *peerpoke;
   /*! IAX_ flags */
   unsigned int flags;
   int adsi;

   /*! Transferring status */
   enum iax_transfer_state transferring;
   /*! Transfer identifier */
   int transferid;
   /*! Who we are IAX transfering to */
   struct sockaddr_in transfer;
   /*! What's the new call number for the transfer */
   unsigned short transfercallno;
   /*! Transfer decrypt AES-128 Key */
   aes_encrypt_ctx tdcx;

   /*! Status of knowledge of peer ADSI capability */
   int peeradsicpe;

   /*! Who we are bridged to */
   unsigned short bridgecallno;
   
   int pingid;       /*!< Transmit PING request */
   int lagid;        /*!< Retransmit lag request */
   int autoid;       /*!< Auto hangup for Dialplan requestor */
   int authid;       /*!< Authentication rejection ID */
   int authfail;        /*!< Reason to report failure */
   int initid;       /*!< Initial peer auto-congest ID (based on qualified peers) */
   int calling_ton;
   int calling_tns;
   int calling_pres;
   int amaflags;
   struct iax2_dpcache *dpentries;
   struct ast_variable *vars;
   /*! last received remote rr */
   struct iax_rr remote_rr;
   /*! Current base time: (just for stats) */
   int min;
   /*! Dropped frame count: (just for stats) */
   int frames_dropped;
   /*! received frame count: (just for stats) */
   int frames_received;
   /*! num bytes used for calltoken ie, even an empty ie should contain 2 */
   unsigned char calltoken_ie_len;
   /*! hold all signaling frames from the pbx thread until we have a destination callno */
   char hold_signaling;
   /*! frame queue for signaling frames from pbx thread waiting for destination callno */
   AST_LIST_HEAD_NOLOCK(signaling_queue, signaling_queue_entry) signaling_queue;
};

struct signaling_queue_entry {
   struct ast_frame f;
   AST_LIST_ENTRY(signaling_queue_entry) next;
};

/*! table of available call numbers */
static struct ao2_container *callno_pool;

/*! table of available trunk call numbers */
static struct ao2_container *callno_pool_trunk;

static const unsigned int CALLNO_POOL_BUCKETS = 2699;

static struct ast_iax2_queue {
   AST_LIST_HEAD(, iax_frame) queue;
   int count;
} iaxq;

static int randomcalltokendata;

static const time_t MAX_CALLTOKEN_DELAY = 10;

/*!
 * This module will get much higher performance when doing a lot of
 * user and peer lookups if the number of buckets is increased from 1.
 * However, to maintain old behavior for Asterisk 1.4, these are set to
 * 1 by default.  When using multiple buckets, search order through these
 * containers is considered random, so you will not be able to depend on
 * the order the entires are specified in iax.conf for matching order. */
#ifdef LOW_MEMORY
#define MAX_PEER_BUCKETS 1
/* #define MAX_PEER_BUCKETS 17 */
#else
#define MAX_PEER_BUCKETS 1
/* #define MAX_PEER_BUCKETS 563 */
#endif
static struct ao2_container *peers;

#define MAX_USER_BUCKETS MAX_PEER_BUCKETS
static struct ao2_container *users;


/*! Table containing peercnt objects for every ip address consuming a callno */
static struct ao2_container *peercnts;

/*! Table containing custom callno limit rules for a range of ip addresses. */
static struct ao2_container *callno_limits;

/*! Table containing ip addresses not requiring calltoken validation */
static struct ao2_container *calltoken_ignores;

static uint16_t DEFAULT_MAXCALLNO_LIMIT = 2048;

static uint16_t DEFAULT_MAXCALLNO_LIMIT_NONVAL = 8192;

static uint16_t global_maxcallno;

/*! Total num of call numbers allowed to be allocated without calltoken validation */
static uint16_t global_maxcallno_nonval;

static uint16_t total_nonval_callno_used = 0;

/*! peer connection private, keeps track of all the call numbers
 *  consumed by a single ip address */
struct peercnt {
   /*! ip address consuming call numbers */
   unsigned long addr;
   /*! Number of call numbers currently used by this ip address */
   uint16_t cur;
   /*! Max call numbers allowed for this ip address */
   uint16_t limit;
   /*! Specifies whether limit is set by a registration or not, if so normal
    *  limit setting rules do not apply to this address. */
   unsigned char reg;
};

/*! used by both callno_limits and calltoken_ignores containers */
struct addr_range {
   /*! ip address range for custom callno limit rule */
   struct ast_ha ha;
   /*! callno limit for this ip address range, only used in callno_limits container */
   uint16_t limit;
   /*! delete me marker for reloads */
   unsigned char delme;
};

struct callno_entry {
   /*! callno used for this entry */
   uint16_t callno;
   /*! was this callno calltoken validated or not */
   unsigned char validated;
};

static struct ast_firmware_list {
   struct iax_firmware *wares;
   ast_mutex_t lock;
} waresl;

/*! Extension exists */
#define CACHE_FLAG_EXISTS     (1 << 0)
/*! Extension is nonexistent */
#define CACHE_FLAG_NONEXISTENT      (1 << 1)
/*! Extension can exist */
#define CACHE_FLAG_CANEXIST      (1 << 2)
/*! Waiting to hear back response */
#define CACHE_FLAG_PENDING    (1 << 3)
/*! Timed out */
#define CACHE_FLAG_TIMEOUT    (1 << 4)
/*! Request transmitted */
#define CACHE_FLAG_TRANSMITTED      (1 << 5)
/*! Timeout */
#define CACHE_FLAG_UNKNOWN    (1 << 6)
/*! Matchmore */
#define CACHE_FLAG_MATCHMORE     (1 << 7)

static struct iax2_dpcache {
   char peercontext[AST_MAX_CONTEXT];
   char exten[AST_MAX_EXTENSION];
   struct timeval orig;
   struct timeval expiry;
   int flags;
   unsigned short callno;
   int waiters[256];
   struct iax2_dpcache *next;
   struct iax2_dpcache *peer; /*!< For linking in peers */
} *dpcache;

AST_MUTEX_DEFINE_STATIC(dpcache_lock);

static void reg_source_db(struct iax2_peer *p);
static struct iax2_peer *realtime_peer(const char *peername, struct sockaddr_in *sin);
static struct iax2_user *realtime_user(const char *username, struct sockaddr_in *sin);

static int ast_cli_netstats(struct mansession *s, int fd, int limit_fmt);

#define IAX_IOSTATE_IDLE      0
#define IAX_IOSTATE_READY     1
#define IAX_IOSTATE_PROCESSING   2
#define IAX_IOSTATE_SCHEDREADY   3

#define IAX_TYPE_POOL    1
#define IAX_TYPE_DYNAMIC 2

struct iax2_pkt_buf {
   AST_LIST_ENTRY(iax2_pkt_buf) entry;
   size_t len;
   unsigned char buf[1];
};

struct iax2_thread {
   AST_LIST_ENTRY(iax2_thread) list;
   int type;
   int iostate;
#ifdef SCHED_MULTITHREADED
   void (*schedfunc)(const void *);
   const void *scheddata;
#endif
#ifdef DEBUG_SCHED_MULTITHREAD
   char curfunc[80];
#endif   
   int actions;
   pthread_t threadid;
   int threadnum;
   struct sockaddr_in iosin;
   unsigned char readbuf[4096]; 
   unsigned char *buf;
   ssize_t buf_len;
   size_t buf_size;
   int iofd;
   time_t checktime;
   ast_mutex_t lock;
   ast_cond_t cond;
   unsigned int ready_for_signal:1;
   /*! if this thread is processing a full frame,
     some information about that frame will be stored
     here, so we can avoid dispatching any more full
     frames for that callno to other threads */
   struct {
      unsigned short callno;
      struct sockaddr_in sin;
      unsigned char type;
      unsigned char csub;
   } ffinfo;
   /*! Queued up full frames for processing.  If more full frames arrive for
    *  a call which this thread is already processing a full frame for, they
    *  are queued up here. */
   AST_LIST_HEAD_NOLOCK(, iax2_pkt_buf) full_frames;
};

/* Thread lists */
static AST_LIST_HEAD_STATIC(idle_list, iax2_thread);
static AST_LIST_HEAD_STATIC(active_list, iax2_thread);
static AST_LIST_HEAD_STATIC(dynamic_list, iax2_thread);

static void *iax2_process_thread(void *data);

static void signal_condition(ast_mutex_t *lock, ast_cond_t *cond)
{
   ast_mutex_lock(lock);
   ast_cond_signal(cond);
   ast_mutex_unlock(lock);
}

static void iax_debug_output(const char *data)
{
   if (iaxdebug)
      ast_verbose("%s", data);
}

static void iax_error_output(const char *data)
{
   ast_log(LOG_WARNING, "%s", data);
}

static void __attribute__((format(printf, 1, 2))) jb_error_output(const char *fmt, ...)
{
   va_list args;
   char buf[1024];

   va_start(args, fmt);
   vsnprintf(buf, 1024, fmt, args);
   va_end(args);

   ast_log(LOG_ERROR, "%s", buf);
}

static void __attribute__((format(printf, 1, 2))) jb_warning_output(const char *fmt, ...)
{
   va_list args;
   char buf[1024];

   va_start(args, fmt);
   vsnprintf(buf, 1024, fmt, args);
   va_end(args);

   ast_log(LOG_WARNING, "%s", buf);
}

static void __attribute__((format(printf, 1, 2))) jb_debug_output(const char *fmt, ...)
{
   va_list args;
   char buf[1024];

   va_start(args, fmt);
   vsnprintf(buf, 1024, fmt, args);
   va_end(args);

   ast_verbose("%s", buf);
}

/* IAX_MAX_CALLS + 1 to avoid the off by one error case when accessing the max call number */
static struct chan_iax2_pvt *iaxs[IAX_MAX_CALLS + 1];
static ast_mutex_t iaxsl[ARRAY_LEN(iaxs)];

/*!
 * \brief Another container of iax2_pvt structures
 *
 * Active IAX2 pvt structs are also stored in this container, if they are a part
 * of an active call where we know the remote side's call number.  The reason
 * for this is that incoming media frames do not contain our call number.  So,
 * instead of having to iterate the entire iaxs array, we use this container to
 * look up calls where the remote side is using a given call number.
 */
static struct ao2_container *iax_peercallno_pvts;

/*!
 *  * \brief Another container of iax2_pvt structures
 *  
 *  Active IAX2 pvt stucts used during transfering a call are stored here.  
 */
static struct ao2_container *iax_transfercallno_pvts;

/* Flag to use with trunk calls, keeping these calls high up.  It halves our effective use
   but keeps the division between trunked and non-trunked better. */
#define TRUNK_CALL_START   IAX_MAX_CALLS / 2

static int maxtrunkcall = TRUNK_CALL_START;
static int maxnontrunkcall = 1;

static enum ast_bridge_result iax2_bridge(struct ast_channel *c0, struct ast_channel *c1, int flags, struct ast_frame **fo, struct ast_channel **rc, int timeoutms);
static int expire_registry(const void *data);
static int iax2_answer(struct ast_channel *c);
static int iax2_call(struct ast_channel *c, char *dest, int timeout);
static int iax2_devicestate(void *data);
static int iax2_digit_begin(struct ast_channel *c, char digit);
static int iax2_digit_end(struct ast_channel *c, char digit, unsigned int duration);
static int iax2_do_register(struct iax2_registry *reg);
static int iax2_fixup(struct ast_channel *oldchannel, struct ast_channel *newchan);
static int iax2_hangup(struct ast_channel *c);
static int iax2_indicate(struct ast_channel *c, int condition, const void *data, size_t datalen);
static int iax2_poke_peer(struct iax2_peer *peer, int heldcall);
static int iax2_provision(struct sockaddr_in *end, int sockfd, char *dest, const char *template, int force);
static int iax2_send(struct chan_iax2_pvt *pvt, struct ast_frame *f, unsigned int ts, int seqno, int now, int transfer, int final);
static int iax2_sendhtml(struct ast_channel *c, int subclass, const char *data, int datalen);
static int iax2_sendimage(struct ast_channel *c, struct ast_frame *img);
static int iax2_sendtext(struct ast_channel *c, const char *text);
static int iax2_setoption(struct ast_channel *c, int option, void *data, int datalen);
static int iax2_transfer(struct ast_channel *c, const char *dest);
static int iax2_write(struct ast_channel *c, struct ast_frame *f);
static int send_command(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_final(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_immediate(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_locked(unsigned short callno, char, int, unsigned int, const unsigned char *, int, int);
static int send_command_transfer(struct chan_iax2_pvt *, char, int, unsigned int, const unsigned char *, int);
static struct ast_channel *iax2_request(const char *type, int format, void *data, int *cause);
static struct ast_frame *iax2_read(struct ast_channel *c);
static struct iax2_peer *build_peer(const char *name, struct ast_variable *v, struct ast_variable *alt, int temponly);
static struct iax2_user *build_user(const char *name, struct ast_variable *v, struct ast_variable *alt, int temponly);
static void realtime_update_peer(const char *peername, struct sockaddr_in *sin, time_t regtime);
static void prune_peers(void);
static void prune_users(void);
static int decode_frame(aes_decrypt_ctx *dcx, struct ast_iax2_full_hdr *fh, struct ast_frame *f, int *datalen);
static int encrypt_frame(aes_encrypt_ctx *ecx, struct ast_iax2_full_hdr *fh, unsigned char *poo, int *datalen);
static void build_ecx_key(const unsigned char *digest, struct chan_iax2_pvt *pvt);
static void build_rand_pad(unsigned char *buf, ssize_t len);
static struct callno_entry *get_unused_callno(int trunk, int validated);
static int replace_callno(const void *obj);
static void sched_delay_remove(struct sockaddr_in *sin, struct callno_entry *callno_entry);

static const struct ast_channel_tech iax2_tech = {
   .type = "IAX2",
   .description = tdesc,
   .capabilities = IAX_CAPABILITY_FULLBANDWIDTH,
   .properties = AST_CHAN_TP_WANTSJITTER,
   .requester = iax2_request,
   .devicestate = iax2_devicestate,
   .send_digit_begin = iax2_digit_begin,
   .send_digit_end = iax2_digit_end,
   .send_text = iax2_sendtext,
   .send_image = iax2_sendimage,
   .send_html = iax2_sendhtml,
   .call = iax2_call,
   .hangup = iax2_hangup,
   .answer = iax2_answer,
   .read = iax2_read,
   .write = iax2_write,
   .write_video = iax2_write,
   .indicate = iax2_indicate,
   .setoption = iax2_setoption,
   .bridge = iax2_bridge,
   .transfer = iax2_transfer,
   .fixup = iax2_fixup,
};

/*!
 * \internal
 * \brief Obtain the owner channel lock if the owner exists.
 *
 * \param callno IAX2 call id.
 *
 * \note Assumes the iaxsl[callno] lock is already obtained.
 *
 * \note
 * IMPORTANT NOTE!!!  Any time this function is used, even if
 * iaxs[callno] was valid before calling it, it may no longer be
 * valid after calling it.  This function may unlock and lock
 * the mutex associated with this callno, meaning that another
 * thread may grab it and destroy the call.
 *
 * \return Nothing
 */
static void iax2_lock_owner(int callno)
{
   for (;;) {
      if (!iaxs[callno] || !iaxs[callno]->owner) {
         /* There is no owner lock to get. */
         break;
      }
      if (!ast_mutex_trylock(&iaxs[callno]->owner->lock)) {
         /* We got the lock */
         break;
      }
      /* Avoid deadlock by pausing and trying again */
      DEADLOCK_AVOIDANCE(&iaxsl[callno]);
   }
}

/* WARNING: insert_idle_thread should only ever be called within the
 * context of an iax2_process_thread() thread.
 */
static void insert_idle_thread(struct iax2_thread *thread)
{
   if (thread->type == IAX_TYPE_DYNAMIC) {
      AST_LIST_LOCK(&dynamic_list);
      AST_LIST_INSERT_TAIL(&dynamic_list, thread, list);
      AST_LIST_UNLOCK(&dynamic_list);
   } else {
      AST_LIST_LOCK(&idle_list);
      AST_LIST_INSERT_TAIL(&idle_list, thread, list);
      AST_LIST_UNLOCK(&idle_list);
   }

   return;
}

static struct iax2_thread *find_idle_thread(void)
{
   pthread_attr_t attr;
   struct iax2_thread *thread = NULL;

   /* Pop the head of the list off */
   AST_LIST_LOCK(&idle_list);
   thread = AST_LIST_REMOVE_HEAD(&idle_list, list);
   AST_LIST_UNLOCK(&idle_list);

   /* If no idle thread is available from the regular list, try dynamic */
   if (thread == NULL) {
      AST_LIST_LOCK(&dynamic_list);
      thread = AST_LIST_REMOVE_HEAD(&dynamic_list, list);
      /* Make sure we absolutely have a thread... if not, try to make one if allowed */
      if (thread == NULL && iaxmaxthreadcount > iaxdynamicthreadcount) {
         /* We need to MAKE a thread! */
         if ((thread = ast_calloc(1, sizeof(*thread)))) {
            thread->threadnum = iaxdynamicthreadnum++;
            thread->type = IAX_TYPE_DYNAMIC;
            ast_mutex_init(&thread->lock);
            ast_cond_init(&thread->cond, NULL);
            pthread_attr_init(&attr);
            pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);   
            if (ast_pthread_create(&thread->threadid, &attr, iax2_process_thread, thread)) {
               free(thread);
               thread = NULL;
            } else {
               /* All went well and the thread is up, so increment our count */
               iaxdynamicthreadcount++;
               
               /* Wait for the thread to be ready before returning it to the caller */
               while (!thread->ready_for_signal)
                  usleep(1);
            }
         }
      }
      AST_LIST_UNLOCK(&dynamic_list);
   }

   /* this thread is not processing a full frame (since it is idle),
      so ensure that the field for the full frame call number is empty */
   if (thread)
      memset(&thread->ffinfo, 0, sizeof(thread->ffinfo));

   return thread;
}

#ifdef SCHED_MULTITHREADED
static int __schedule_action(void (*func)(const void *data), const void *data, const char *funcname)
{
   struct iax2_thread *thread = NULL;
   static time_t lasterror;
   static time_t t;

   thread = find_idle_thread();

   if (thread != NULL) {
      thread->schedfunc = func;
      thread->scheddata = data;
      thread->iostate = IAX_IOSTATE_SCHEDREADY;
#ifdef DEBUG_SCHED_MULTITHREAD
      ast_copy_string(thread->curfunc, funcname, sizeof(thread->curfunc));
#endif
      signal_condition(&thread->lock, &thread->cond);
      return 0;
   }
   time(&t);
   if (t != lasterror && option_debug) 
      ast_log(LOG_DEBUG, "Out of idle IAX2 threads for scheduling!\n");
   lasterror = t;

   return -1;
}
#define schedule_action(func, data) __schedule_action(func, data, __PRETTY_FUNCTION__)
#endif

static int iax2_sched_add(struct sched_context *con, int when, ast_sched_cb callback, const void *data)
{
   int res;

   ast_mutex_lock(&sched_lock);
   res = ast_sched_add(con, when, callback, data);
   ast_cond_signal(&sched_cond);
   ast_mutex_unlock(&sched_lock);

   return res;
}

static int send_ping(const void *data);

static void __send_ping(const void *data)
{
   int callno = (long) data;

   ast_mutex_lock(&iaxsl[callno]);

   if (iaxs[callno]) {
      if (iaxs[callno]->peercallno) {
         send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_PING, 0, NULL, 0, -1);
         iaxs[callno]->pingid = iax2_sched_add(sched, ping_time * 1000, send_ping, data);
      } else {
         /* I am the schedule, so I'm allowed to do this */
         iaxs[callno]->pingid = -1;
      }
   } else if (option_debug > 0) {
      ast_log(LOG_DEBUG, "I was supposed to send a PING with callno %d, but no such call exists (and I cannot remove pingid, either).\n", callno);
   }

   ast_mutex_unlock(&iaxsl[callno]);
}

static int send_ping(const void *data)
{
#ifdef SCHED_MULTITHREADED
   if (schedule_action(__send_ping, data))
#endif      
      __send_ping(data);

   return 0;
}

static int get_encrypt_methods(const char *s)
{
   int e;
   if (!strcasecmp(s, "aes128"))
      e = IAX_ENCRYPT_AES128;
   else if (ast_true(s))
      e = IAX_ENCRYPT_AES128;
   else
      e = 0;
   return e;
}

static int send_lagrq(const void *data);

static void __send_lagrq(const void *data)
{
   int callno = (long) data;

   ast_mutex_lock(&iaxsl[callno]);

   if (iaxs[callno]) {
      if (iaxs[callno]->peercallno) {
         send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_LAGRQ, 0, NULL, 0, -1);
         iaxs[callno]->lagid = iax2_sched_add(sched, lagrq_time * 1000, send_lagrq, data);
      } else {
         /* I am the schedule, so I'm allowed to do this */
         iaxs[callno]->lagid = -1;
      }
   } else {
      ast_log(LOG_WARNING, "I was supposed to send a LAGRQ with callno %d, but no such call exists (and I cannot remove lagid, either).\n", callno);
   }

   ast_mutex_unlock(&iaxsl[callno]);
}

static int send_lagrq(const void *data)
{
#ifdef SCHED_MULTITHREADED
   if (schedule_action(__send_lagrq, data))
#endif      
      __send_lagrq(data);
   
   return 0;
}

static unsigned char compress_subclass(int subclass)
{
   int x;
   int power=-1;
   /* If it's 128 or smaller, just return it */
   if (subclass < IAX_FLAG_SC_LOG)
      return subclass;
   /* Otherwise find its power */
   for (x = 0; x < IAX_MAX_SHIFT; x++) {
      if (subclass & (1 << x)) {
         if (power > -1) {
            ast_log(LOG_WARNING, "Can't compress subclass %d\n", subclass);
            return 0;
         } else
            power = x;
      }
   }
   return power | IAX_FLAG_SC_LOG;
}

static int uncompress_subclass(unsigned char csub)
{
   /* If the SC_LOG flag is set, return 2^csub otherwise csub */
   if (csub & IAX_FLAG_SC_LOG) {
      /* special case for 'compressed' -1 */
      if (csub == 0xff)
         return -1;
      else
         return 1 << (csub & ~IAX_FLAG_SC_LOG & IAX_MAX_SHIFT);
   }
   else
      return csub;
}

/*!
 * \note The only member of the peer passed here guaranteed to be set is the name field
 */
static int peer_hash_cb(const void *obj, const int flags)
{
   const struct iax2_peer *peer = obj;

   return ast_str_hash(peer->name);
}

/*!
 * \note The only member of the peer passed here guaranteed to be set is the name field
 */
static int peer_cmp_cb(void *obj, void *arg, int flags)
{
   struct iax2_peer *peer = obj, *peer2 = arg;

   return !strcmp(peer->name, peer2->name) ? CMP_MATCH | CMP_STOP : 0;
}

/*!
 * \note The only member of the user passed here guaranteed to be set is the name field
 */
static int user_hash_cb(const void *obj, const int flags)
{
   const struct iax2_user *user = obj;

   return ast_str_hash(user->name);
}

/*!
 * \note The only member of the user passed here guaranteed to be set is the name field
 */
static int user_cmp_cb(void *obj, void *arg, int flags)
{
   struct iax2_user *user = obj, *user2 = arg;

   return !strcmp(user->name, user2->name) ? CMP_MATCH | CMP_STOP : 0;
}

/*!
 * \note This funtion calls realtime_peer -> reg_source_db -> iax2_poke_peer -> find_callno,
 *       so do not call it with a pvt lock held.
 */
static struct iax2_peer *find_peer(const char *name, int realtime) 
{
   struct iax2_peer *peer = NULL;
   struct iax2_peer tmp_peer = {
      .name = name,
   };

   peer = ao2_find(peers, &tmp_peer, OBJ_POINTER);

   /* Now go for realtime if applicable */
   if(!peer && realtime)
      peer = realtime_peer(name, NULL);

   return peer;
}

static struct iax2_peer *peer_ref(struct iax2_peer *peer)
{
   ao2_ref(peer, +1);
   return peer;
}

static inline struct iax2_peer *peer_unref(struct iax2_peer *peer)
{
   ao2_ref(peer, -1);
   return NULL;
}

static struct iax2_user *find_user(const char *name)
{
   struct iax2_user tmp_user = {
      .name = name,
   };

   return ao2_find(users, &tmp_user, OBJ_POINTER);
}

static inline struct iax2_user *user_ref(struct iax2_user *user)
{
   ao2_ref(user, +1);
   return user;
}

static inline struct iax2_user *user_unref(struct iax2_user *user)
{
   ao2_ref(user, -1);
   return NULL;
}

static int iax2_getpeername(struct sockaddr_in sin, char *host, int len)
{
   struct iax2_peer *peer = NULL;
   int res = 0;
   struct ao2_iterator i;

   i = ao2_iterator_init(peers, 0);
   while ((peer = ao2_iterator_next(&i))) {
      if ((peer->addr.sin_addr.s_addr == sin.sin_addr.s_addr) &&
          (peer->addr.sin_port == sin.sin_port)) {
         ast_copy_string(host, peer->name, len);
         peer_unref(peer);
         res = 1;
         break;
      }
      peer_unref(peer);
   }
   ao2_iterator_destroy(&i);

   if (!peer) {
      peer = realtime_peer(NULL, &sin);
      if (peer) {
         ast_copy_string(host, peer->name, len);
         peer_unref(peer);
         res = 1;
      }
   }

   return res;
}

static void iax2_destroy_helper(struct chan_iax2_pvt *pvt)
{
   /* Decrement AUTHREQ count if needed */
   if (ast_test_flag(pvt, IAX_MAXAUTHREQ)) {
      struct iax2_user *user;
      struct iax2_user tmp_user = {
         .name = pvt->username,
      };

      user = ao2_find(users, &tmp_user, OBJ_POINTER);
      if (user) {
         ast_atomic_fetchadd_int(&user->curauthreq, -1);
         user = user_unref(user);       
      }

      ast_clear_flag(pvt, IAX_MAXAUTHREQ);
   }

   /* No more pings or lagrq's */
   AST_SCHED_DEL(sched, pvt->pingid);
   AST_SCHED_DEL(sched, pvt->lagid);
   AST_SCHED_DEL(sched, pvt->autoid);
   AST_SCHED_DEL(sched, pvt->authid);
   AST_SCHED_DEL(sched, pvt->initid);
   AST_SCHED_DEL(sched, pvt->jbid);
}

static void store_by_transfercallno(struct chan_iax2_pvt *pvt)
{
   if (!pvt->transfercallno) {
      ast_log(LOG_ERROR, "This should not be called without a transfer call number.\n");
      return;
   }

   ao2_link(iax_transfercallno_pvts, pvt);
}

static void remove_by_transfercallno(struct chan_iax2_pvt *pvt)
{
   if (!pvt->transfercallno) {
      ast_log(LOG_ERROR, "This should not be called without a transfer call number.\n");
      return;
   }

   ao2_unlink(iax_transfercallno_pvts, pvt);
}
static void store_by_peercallno(struct chan_iax2_pvt *pvt)
{
   if (!pvt->peercallno) {
      ast_log(LOG_ERROR, "This should not be called without a peer call number.\n");
      return;
   }

   ao2_link(iax_peercallno_pvts, pvt);
}

static void remove_by_peercallno(struct chan_iax2_pvt *pvt)
{
   if (!pvt->peercallno) {
      ast_log(LOG_ERROR, "This should not be called without a peer call number.\n");
      return;
   }

   ao2_unlink(iax_peercallno_pvts, pvt);
}

static void update_max_trunk(void)
{
   int max = TRUNK_CALL_START;
   int x;

   /* XXX Prolly don't need locks here XXX */
   for (x = TRUNK_CALL_START; x < ARRAY_LEN(iaxs) - 1; x++) {
      if (iaxs[x]) {
         max = x + 1;
      }
   }

   maxtrunkcall = max;
   if (option_debug && iaxdebug)
      ast_log(LOG_DEBUG, "New max trunk callno is %d\n", max);
}

static void iax2_frame_free(struct iax_frame *fr)
{
   AST_SCHED_DEL(sched, fr->retrans);
   iax_frame_free(fr);
}

static void iax2_destroy(int callno)
{
   struct chan_iax2_pvt *pvt;
   struct ast_channel *owner;

retry:
   pvt = iaxs[callno];

   owner = pvt ? pvt->owner : NULL;

   if (owner) {
      if (ast_mutex_trylock(&owner->lock)) {
         if (option_debug > 2)
            ast_log(LOG_DEBUG, "Avoiding IAX destroy deadlock\n");
         DEADLOCK_AVOIDANCE(&iaxsl[callno]);
         goto retry;
      }
   }

   /* SPINLOCK gives up the pvt lock so the scheduler and iax2_pvt don't deadlock. Since we
    * give up the pvt lock, the pvt could be destroyed from underneath us. To guarantee
    * the pvt stays around, a ref count is added to it. */
   if (!owner && pvt) {
      ao2_ref(pvt, +1);
      AST_SCHED_DEL_SPINLOCK(sched, pvt->lagid, &iaxsl[pvt->callno]);
      AST_SCHED_DEL_SPINLOCK(sched, pvt->pingid, &iaxsl[pvt->callno]);
      ao2_ref(pvt, -1);
      if (iaxs[callno]) {
         iaxs[callno] = NULL;
      } else {
         pvt = NULL;
      }
   }

   if (pvt) {
      if (!owner) {
         pvt->owner = NULL;
      } else {
         /* If there's an owner, prod it to give up */
         /* It is ok to use ast_queue_hangup() here instead of iax2_queue_hangup()
          * because we already hold the owner channel lock. */
         ast_queue_hangup(owner);
      }

      if (pvt->peercallno) {
         remove_by_peercallno(pvt);
      }

      if (pvt->transfercallno) {
         remove_by_transfercallno(pvt);
      }

      if (!owner) {
         ao2_ref(pvt, -1);
         pvt = NULL;
      }
   }

   if (owner) {
      ast_mutex_unlock(&owner->lock);
   }

   if (callno & 0x4000) {
      update_max_trunk();
   }
}

static int scheduled_destroy(const void *vid)
{
   unsigned short callno = PTR_TO_CALLNO(vid);
   ast_mutex_lock(&iaxsl[callno]);
   if (iaxs[callno]) {
      if (option_debug) {
         ast_log(LOG_DEBUG, "Really destroying %d now...\n", callno);
      }
      iax2_destroy(callno);
   }
   ast_mutex_unlock(&iaxsl[callno]);
   return 0;
}

static void free_signaling_queue_entry(struct signaling_queue_entry *s)
{
   ast_free(s->f.data);
   ast_free(s);
}

/*! \brief This function must be called once we are sure the other side has
 *  given us a call number.  All signaling is held here until that point. */
static void send_signaling(struct chan_iax2_pvt *pvt)
{
   struct signaling_queue_entry *s = NULL;

   while ((s = AST_LIST_REMOVE_HEAD(&pvt->signaling_queue, next))) {
      iax2_send(pvt, &s->f, 0, -1, 0, 0, 0);
      free_signaling_queue_entry(s);
   }
   pvt->hold_signaling = 0;
}

/*! \brief All frames other than that of type AST_FRAME_IAX must be held until
 *  we have received a destination call number. */
static int queue_signalling(struct chan_iax2_pvt *pvt, struct ast_frame *f)
{
   struct signaling_queue_entry *new;

   if (f->frametype == AST_FRAME_IAX || !pvt->hold_signaling) {
      return 1; /* do not queue this frame */
   } else if (!(new = ast_calloc(1, sizeof(struct signaling_queue_entry)))) {
      return -1;  /* out of memory */
   }

   memcpy(&new->f, f, sizeof(new->f)); /* copy ast_frame into our queue entry */

   if (new->f.datalen) { /* if there is data in this frame copy it over as well */
      if (!(new->f.data = ast_calloc(1, new->f.datalen))) {
         free_signaling_queue_entry(new);
         return -1;
      }
      memcpy(new->f.data, f->data, sizeof(*new->f.data));
   }
   AST_LIST_INSERT_TAIL(&pvt->signaling_queue, new, next);

   return 0;
}

static void pvt_destructor(void *obj)
{
   struct chan_iax2_pvt *pvt = obj;
   struct iax_frame *cur = NULL;
   struct signaling_queue_entry *s = NULL;

   iax2_destroy_helper(pvt);
   sched_delay_remove(&pvt->addr, pvt->callno_entry);
   pvt->callno_entry = NULL;

   /* Already gone */
   ast_set_flag(pvt, IAX_ALREADYGONE); 

   AST_LIST_LOCK(&iaxq.queue);
   AST_LIST_TRAVERSE(&iaxq.queue, cur, list) {
      /* Cancel any pending transmissions */
      if (cur->callno == pvt->callno) { 
         cur->retries = -1;
      }
   }
   AST_LIST_UNLOCK(&iaxq.queue);

   while ((s = AST_LIST_REMOVE_HEAD(&pvt->signaling_queue, next))) {
      free_signaling_queue_entry(s);
   }

   if (pvt->reg) {
      pvt->reg->callno = 0;
   }

   if (!pvt->owner) {
      jb_frame frame;
      if (pvt->vars) {
          ast_variables_destroy(pvt->vars);
          pvt->vars = NULL;
      }

      while (jb_getall(pvt->jb, &frame) == JB_OK) {
         iax2_frame_free(frame.data);
      }

      jb_destroy(pvt->jb);
      ast_string_field_free_memory(pvt);
   }
}

static struct chan_iax2_pvt *new_iax(struct sockaddr_in *sin, const char *host)
{
   struct chan_iax2_pvt *tmp;
   jb_conf jbconf;

   if (!(tmp = ao2_alloc(sizeof(*tmp), pvt_destructor))) {
      return NULL;
   }

   if (ast_string_field_init(tmp, 32)) {
      ao2_ref(tmp, -1);
      tmp = NULL;
      return NULL;
   }
      
   tmp->prefs = prefs;
   tmp->callno = 0;
   tmp->peercallno = 0;
   tmp->transfercallno = 0;
   tmp->bridgecallno = 0;
   tmp->pingid = -1;
   tmp->lagid = -1;
   tmp->autoid = -1;
   tmp->authid = -1;
   tmp->initid = -1;

   ast_string_field_set(tmp,exten, "s");
   ast_string_field_set(tmp,host, host);

   tmp->jb = jb_new();
   tmp->jbid = -1;
   jbconf.max_jitterbuf = maxjitterbuffer;
   jbconf.resync_threshold = resyncthreshold;
   jbconf.max_contig_interp = maxjitterinterps;
   jb_setconf(tmp->jb,&jbconf);

   tmp->hold_signaling = 1;
   AST_LIST_HEAD_INIT_NOLOCK(&tmp->signaling_queue);

   return tmp;
}

static struct iax_frame *iaxfrdup2(struct iax_frame *fr)
{
   struct iax_frame *new = iax_frame_new(DIRECTION_INGRESS, fr->af.datalen, fr->cacheable);
   if (new) {
      size_t afdatalen = new->afdatalen;
      memcpy(new, fr, sizeof(*new));
      iax_frame_wrap(new, &fr->af);
      new->afdatalen = afdatalen;
      new->data = NULL;
      new->datalen = 0;
      new->direction = DIRECTION_INGRESS;
      new->retrans = -1;
   }
   return new;
}

/* keep these defined in this order.  They are used in find_callno to
 * determine whether or not a new call number should be allowed. */
enum {
   /* do not allow a new call number, only search ones in use for match */
   NEW_PREVENT = 0,
   /* search for match first, then allow a new one to be allocated */
   NEW_ALLOW = 1,
   /* do not search for match, force a new call number */
   NEW_FORCE = 2,
   /* do not search for match, force a new call number.  Signifies call number
    * has been calltoken validated */
   NEW_ALLOW_CALLTOKEN_VALIDATED = 3,
};

static int match(struct sockaddr_in *sin, unsigned short callno, unsigned short dcallno, struct chan_iax2_pvt *cur, int check_dcallno)
{
   if ((cur->addr.sin_addr.s_addr == sin->sin_addr.s_addr) &&
      (cur->addr.sin_port == sin->sin_port)) {
      /* This is the main host */
      if ( (cur->peercallno == 0 || cur->peercallno == callno) &&
          (check_dcallno ? dcallno == cur->callno : 1) ) {
         /* That's us.  Be sure we keep track of the peer call number */
         return 1;
      }
   }
   if ((cur->transfer.sin_addr.s_addr == sin->sin_addr.s_addr) &&
       (cur->transfer.sin_port == sin->sin_port) && (cur->transferring)) {
      /* We're transferring */
      if ((dcallno == cur->callno) || (cur->transferring == TRANSFER_MEDIAPASS && cur->transfercallno == callno))
         return 1;
   }
   return 0;
}

static void update_max_nontrunk(void)
{
   int max = 1;
   int x;
   /* XXX Prolly don't need locks here XXX */
   for (x=1;x<TRUNK_CALL_START - 1; x++) {
      if (iaxs[x])
         max = x + 1;
   }
   maxnontrunkcall = max;
   if (option_debug && iaxdebug)
      ast_log(LOG_DEBUG, "New max nontrunk callno is %d\n", max);
}

static int make_trunk(unsigned short callno, int locked)
{
   int x;
   int res= 0;
   struct callno_entry *callno_entry;
   if (iaxs[callno]->oseqno) {
      ast_log(LOG_WARNING, "Can't make trunk once a call has started!\n");
      return -1;
   }
   if (callno & TRUNK_CALL_START) {
      ast_log(LOG_WARNING, "Call %d is already a trunk\n", callno);
      return -1;
   }
   if (!(callno_entry = get_unused_callno(1, iaxs[callno]->callno_entry->validated))) {
      ast_log(LOG_WARNING, "Unable to trunk call: Insufficient space\n");
      return -1;
   }

   x = callno_entry->callno;
   ast_mutex_lock(&iaxsl[x]);

   /*!
    * \note We delete these before switching the slot, because if
    * they fire in the meantime, they will generate a warning.
    */
   AST_SCHED_DEL(sched, iaxs[callno]->pingid);
   AST_SCHED_DEL(sched, iaxs[callno]->lagid);
   iaxs[x] = iaxs[callno];
   iaxs[x]->callno = x;

   /* since we copied over the pvt from a different callno, make sure the old entry is replaced
    * before assigning the new one */
   if (iaxs[x]->callno_entry) {
      iax2_sched_add(sched, MIN_REUSE_TIME * 1000, replace_callno, iaxs[x]->callno_entry);
   }
   iaxs[x]->callno_entry = callno_entry;

   iaxs[callno] = NULL;
   /* Update the two timers that should have been started */
   iaxs[x]->pingid = iax2_sched_add(sched, 
      ping_time * 1000, send_ping, (void *)(long)x);
   iaxs[x]->lagid = iax2_sched_add(sched, 
      lagrq_time * 1000, send_lagrq, (void *)(long)x);

   if (locked)
      ast_mutex_unlock(&iaxsl[callno]);
   res = x;
   if (!locked)
      ast_mutex_unlock(&iaxsl[x]);

   if (option_debug)
      ast_log(LOG_DEBUG, "Made call %d into trunk call %d\n", callno, x);
   /* We move this call from a non-trunked to a trunked call */
   update_max_trunk();
   update_max_nontrunk();
   return res;
}

static int addr_range_delme_cb(void *obj, void *arg, int flags)
{
   struct addr_range *lim = obj;
   lim->delme = 1;
   return 0;
}

static int addr_range_hash_cb(const void *obj, const int flags)
{
   const struct addr_range *lim = obj;
   return abs((int) lim->ha.netaddr.s_addr);
}

static int addr_range_cmp_cb(void *obj, void *arg, int flags)
{
   struct addr_range *lim1 = obj, *lim2 = arg;
   return ((lim1->ha.netaddr.s_addr == lim2->ha.netaddr.s_addr) &&
      (lim1->ha.netmask.s_addr == lim2->ha.netmask.s_addr)) ?
      CMP_MATCH | CMP_STOP : 0;
}

static int peercnt_hash_cb(const void *obj, const int flags)
{
   const struct peercnt *peercnt = obj;
   return abs((int) peercnt->addr);
}

static int peercnt_cmp_cb(void *obj, void *arg, int flags)
{
   struct peercnt *peercnt1 = obj, *peercnt2 = arg;
   return (peercnt1->addr == peercnt2->addr) ? CMP_MATCH | CMP_STOP : 0;
}

static int addr_range_match_address_cb(void *obj, void *arg, int flags)
{
   struct addr_range *addr_range = obj;
   struct sockaddr_in *sin = arg;

   if ((sin->sin_addr.s_addr & addr_range->ha.netmask.s_addr) == addr_range->ha.netaddr.s_addr) {
      return CMP_MATCH | CMP_STOP;
   }
   return 0;
}

/*! 
 * \internal
 *
 * \brief compares sin to calltoken_ignores table to determine if validation is required.
 */
static int calltoken_required(struct sockaddr_in *sin, const char *name, int subclass)
{
   struct addr_range *addr_range;
   struct iax2_peer *peer = NULL;
   struct iax2_user *user = NULL;
   /* if no username is given, check for guest accounts */
   const char *find = S_OR(name, "guest");
   int res = 1;  /* required by default */
   int optional = 0;
   enum calltoken_peer_enum calltoken_required = CALLTOKEN_DEFAULT;
   /* There are only two cases in which calltoken validation is not required.
    * Case 1. sin falls within the list of address ranges specified in the calltoken optional table and
    *         the peer definition has not set the requirecalltoken option.
    * Case 2. Username is a valid peer/user, and that peer has requirecalltoken set either auto or no.
    */

   /* ----- Case 1 ----- */
   if ((addr_range = ao2_callback(calltoken_ignores, 0, addr_range_match_address_cb, sin))) {
      ao2_ref(addr_range, -1);
      optional = 1;
   }

   /* ----- Case 2 ----- */
   if ((subclass == IAX_COMMAND_NEW) && (user = find_user(find))) {
      calltoken_required = user->calltoken_required;
   } else if ((subclass == IAX_COMMAND_NEW) && (user = realtime_user(find, sin))) {
      calltoken_required = user->calltoken_required;
   } else if ((subclass != IAX_COMMAND_NEW) && (peer = find_peer(find, 0))) {
      calltoken_required = peer->calltoken_required;
   } else if ((subclass != IAX_COMMAND_NEW) && (peer = realtime_peer(find, sin))) {
      calltoken_required = peer->calltoken_required;
   }

   if (peer) {
      peer_unref(peer);
   }
   if (user) {
      user_unref(user);
   }
   if (option_debug) {
   ast_log(LOG_DEBUG, "Determining if address %s with username %s requires calltoken validation.  Optional = %d  calltoken_required = %d \n", ast_inet_ntoa(sin->sin_addr), name, optional, calltoken_required);
   }
   if (((calltoken_required == CALLTOKEN_NO) || (calltoken_required == CALLTOKEN_AUTO)) ||
      (optional && (calltoken_required == CALLTOKEN_DEFAULT))) {
      res = 0;
   }

   return res;
}

/*! 
 * \internal
 *
 * \brief set peercnt callno limit.
 *
 * \details 
 * First looks in custom definitions. If not found, global limit
 * is used.  Entries marked as reg already have
 * a custom limit set by a registration and are not modified.
 */
static void set_peercnt_limit(struct peercnt *peercnt)
{
   uint16_t limit = global_maxcallno;
   struct addr_range *addr_range;
   struct sockaddr_in sin = {
      .sin_addr.s_addr = peercnt->addr,
   };


   if (peercnt->reg && peercnt->limit) {
      return; /* this peercnt has a custom limit set by a registration */
   }

   if ((addr_range = ao2_callback(callno_limits, 0, addr_range_match_address_cb, &sin))) {
      limit = addr_range->limit;
      if (option_debug) {
         ast_log(LOG_DEBUG, "custom addr_range %d found for %s\n", limit, ast_inet_ntoa(sin.sin_addr));
      }
      ao2_ref(addr_range, -1);
   }

   peercnt->limit = limit;
}

/*! 
 * \internal
 * \brief sets limits for all peercnts in table. done on reload to reflect changes in conf.
 */
static int set_peercnt_limit_all_cb(void *obj, void *arg, int flags)
{
   struct peercnt *peercnt = obj;

   set_peercnt_limit(peercnt);
   if (option_debug) {
      ast_log(LOG_DEBUG, "Reset limits for peercnts table\n");
   }
   return 0;
}

/*! 
 * \internal
 * \brief returns match if delme is set. 
 */
static int prune_addr_range_cb(void *obj, void *arg, int flags)
{
   struct addr_range *addr_range = obj;

   return addr_range->delme ? CMP_MATCH : 0;
}

/*! 
 * \internal
 * \brief modifies peercnt entry in peercnts table. Used to set custom limit or mark a registered ip
 */
static void peercnt_modify(unsigned char reg, uint16_t limit, struct sockaddr_in *sin)
{
   /* this function turns off and on custom callno limits set by peer registration */
   struct peercnt *peercnt;
   struct peercnt tmp = {
      .addr = sin->sin_addr.s_addr,
   };

   if ((peercnt = ao2_find(peercnts, &tmp, OBJ_POINTER))) {
      peercnt->reg = reg;
      if (limit) {
         peercnt->limit = limit;
      } else {
         set_peercnt_limit(peercnt);
      }
      if (option_debug) {
         ast_log(LOG_DEBUG, "peercnt entry %s modified limit:%d registered:%d", ast_inet_ntoa(sin->sin_addr), peercnt->limit, peercnt->reg);
      }
      ao2_ref(peercnt, -1); /* decrement ref from find */
   }
}

/*! 
 * \internal
 * \brief adds an ip to the peercnts table, increments connection count if it already exists
 *
 * \details First searches for the address in the peercnts table.  If found
 * the current count is incremented.  If not found a new peercnt is allocated
 * and linked into the peercnts table with a call number count of 1.
 */
static int peercnt_add(struct sockaddr_in *sin)
{
   struct peercnt *peercnt;
   unsigned long addr = sin->sin_addr.s_addr;
   int res = 0;
   struct peercnt tmp = {
      .addr = addr,
   };

   /* Reasoning for peercnts container lock:  Two identical ip addresses
    * could be added by different threads at the "same time". Without the container
    * lock, both threads could alloc space for the same object and attempt
    * to link to table.  With the lock, one would create the object and link
    * to table while the other would find the already created peercnt object
    * rather than creating a new one. */
   ao2_lock(peercnts);
   if ((peercnt = ao2_find(peercnts, &tmp, OBJ_POINTER))) {
      ao2_lock(peercnt);
   } else if ((peercnt = ao2_alloc(sizeof(*peercnt), NULL))) {
      ao2_lock(peercnt);
      /* create and set defaults */
      peercnt->addr = addr;
      set_peercnt_limit(peercnt);
      /* guarantees it does not go away after unlocking table
       * ao2_find automatically adds this */
      ao2_link(peercnts, peercnt);
   } else {
      ao2_unlock(peercnts);
      return -1;
   }

   /* check to see if the address has hit its callno limit.  If not increment cur. */
   if (peercnt->limit > peercnt->cur) {
      peercnt->cur++;
      if (option_debug) {
         ast_log(LOG_DEBUG, "ip callno count incremented to %d for %s\n", peercnt->cur, ast_inet_ntoa(sin->sin_addr));
      }
   } else { /* max num call numbers for this peer has been reached! */
      ast_log(LOG_ERROR, "maxcallnumber limit of %d for %s has been reached!\n", peercnt->limit, ast_inet_ntoa(sin->sin_addr));
      res = -1;
   }

   /* clean up locks and ref count */
   ao2_unlock(peercnt);
   ao2_unlock(peercnts);
   ao2_ref(peercnt, -1); /* decrement ref from find/alloc, only the container ref remains. */

   return res;
}

/*! 
 * \internal
 * \brief decrements a peercnts table entry
 */
static void peercnt_remove(struct peercnt *peercnt)
{
   struct sockaddr_in sin = {
      .sin_addr.s_addr = peercnt->addr,
   };

   if (peercnt) {
      /* Container locked here since peercnt may be unlinked from list.  If left unlocked,
       * peercnt_add could try and grab this entry from the table and modify it at the
       * "same time" this thread attemps to unlink it.*/
      ao2_lock(peercnts);
      peercnt->cur--;
      if (option_debug) {
         ast_log(LOG_DEBUG, "ip callno count decremented to %d for %s\n", peercnt->cur, ast_inet_ntoa(sin.sin_addr));
      }
      /* if this was the last connection from the peer remove it from table */
      if (peercnt->cur == 0) {
         ao2_unlink(peercnts, peercnt);/* decrements ref from table, last ref is left to scheduler */
      }
      ao2_unlock(peercnts);
   }
}

/*! 
 * \internal
 * \brief called by scheduler to decrement object
 */
static int peercnt_remove_cb(const void *obj)
{
   struct peercnt *peercnt = (struct peercnt *) obj;

   peercnt_remove(peercnt);
   ao2_ref(peercnt, -1); /* decrement ref from scheduler */

   return 0;
}

/*! 
 * \internal
 * \brief decrements peercnts connection count, finds by addr
 */
static int peercnt_remove_by_addr(struct sockaddr_in *sin)
{
   struct peercnt *peercnt;
   struct peercnt tmp = {
      .addr = sin->sin_addr.s_addr,
   };

   if ((peercnt = ao2_find(peercnts, &tmp, OBJ_POINTER))) {
      peercnt_remove(peercnt);
      ao2_ref(peercnt, -1); /* decrement ref from find */
   }
   return 0;
}

/*! 
 * \internal
 * \brief Create callno_limit entry based on configuration
 */
static void build_callno_limits(struct ast_variable *v)
{
   struct addr_range *addr_range = NULL;
   struct addr_range tmp;
   struct ast_ha *ha;
   int limit;
   int found;

   for (; v; v = v->next) {
      limit = -1;
      found = 0;
      ha = ast_append_ha("permit", v->name, NULL);

      /* check for valid config information */
      if (!ha) {
         ast_log(LOG_ERROR, "Call number limit for %s could not be added, Invalid address range\n.", v->name);
         continue;
      } else if ((sscanf(v->value, "%d", &limit) != 1) || (limit < 0)) {
         ast_log(LOG_ERROR, "Call number limit for %s could not be added. Invalid limit %s\n.", v->name, v->value);
         ast_free_ha(ha);
         continue;
      }

      ast_copy_ha(ha, &tmp.ha);
      /* find or create the addr_range */
      if ((addr_range = ao2_find(callno_limits, &tmp, OBJ_POINTER))) {
         ao2_lock(addr_range);
         found = 1;
      } else if (!(addr_range = ao2_alloc(sizeof(*addr_range), NULL))) {
         ast_free_ha(ha);
         return; /* out of memory */
      }

      /* copy over config data into addr_range object */
      ast_copy_ha(ha, &addr_range->ha); /* this is safe because only one ha is possible for each limit */
      ast_free_ha(ha); /* cleanup the tmp ha */
      addr_range->limit = limit;
      addr_range->delme = 0;

      /* cleanup */
      if (found) {
         ao2_unlock(addr_range);
      } else {
         ao2_link(callno_limits, addr_range);
      }
      ao2_ref(addr_range, -1); /* decrement ref from ao2_find and ao2_alloc, only container ref remains */
   }
}

/*! 
 * \internal
 * \brief Create calltoken_ignores entry based on configuration
 */
static int add_calltoken_ignore(const char *addr)
{
   struct addr_range tmp;
   struct addr_range *addr_range = NULL;
   struct ast_ha *ha = NULL;

   if (ast_strlen_zero(addr)) {
      ast_log(LOG_WARNING, "invalid calltokenoptional %s\n", addr);
      return -1;
   }

   ha = ast_append_ha("permit", addr, NULL);

   /* check for valid config information */
   if (!ha) {
      ast_log(LOG_WARNING, "Error creating calltokenoptional entry %s\n", addr);
      return -1;
   }

   ast_copy_ha(ha, &tmp.ha);
   /* find or create the addr_range */
   if ((addr_range = ao2_find(calltoken_ignores, &tmp, OBJ_POINTER))) {
      ao2_lock(addr_range);
      addr_range->delme = 0;
      ao2_unlock(addr_range);
   } else if ((addr_range = ao2_alloc(sizeof(*addr_range), NULL))) {
      /* copy over config data into addr_range object */
      ast_copy_ha(ha, &addr_range->ha); /* this is safe because only one ha is possible */
      ao2_link(calltoken_ignores, addr_range);
   } else {
      ast_free_ha(ha);
      return -1;
   }

   ast_free_ha(ha);
   ao2_ref(addr_range, -1); /* decrement ref from ao2_find and ao2_alloc, only container ref remains */

   return 0;
}

static int iax2_show_callnumber_usage(int fd, int argc, char *argv[])
{
   struct ao2_iterator i;
   struct peercnt *peercnt;
   struct sockaddr_in sin;
   int found = 0;

   if (argc < 4 || argc > 5)
      return RESULT_SHOWUSAGE;

   ast_cli(fd, "%-15s %-12s %-12s\n", "Address", "Callno Usage", "Callno Limit");
   i = ao2_iterator_init(peercnts, 0);
   while ((peercnt = ao2_iterator_next(&i))) {
      sin.sin_addr.s_addr = peercnt->addr;
      if (argc == 5 && (!strcasecmp(argv[4], ast_inet_ntoa(sin.sin_addr)))) {
            ast_cli(fd, "%-15s %-12d %-12d\n", ast_inet_ntoa(sin.sin_addr), peercnt->cur, peercnt->limit);
            found = 1;
            break;
      } else {
         ast_cli(fd, "%-15s %-12d %-12d\n", ast_inet_ntoa(sin.sin_addr), peercnt->cur, peercnt->limit);
      }
      ao2_ref(peercnt, -1);
   }
   ao2_iterator_destroy(&i);
   if (argc == 4) {
      ast_cli(fd, "\nNon-CallToken Validation Limit: %d\nNon-CallToken Validated: %d\n", global_maxcallno_nonval, total_nonval_callno_used);
   } else if (argc == 5 && !found) {
      ast_cli(fd, "No callnumber table entries for %s found\n", argv[4] );
   }
   return RESULT_SUCCESS;
}

static struct callno_entry *get_unused_callno(int trunk, int validated)
{
   struct callno_entry *callno_entry = NULL;
   if ((!ao2_container_count(callno_pool) && !trunk) || (!ao2_container_count(callno_pool_trunk) && trunk)) {
      ast_log(LOG_WARNING, "Out of CallNumbers\n");
      /* Minor optimization for the extreme case. */
      return NULL;
   }

   /* the callno_pool container is locked here primarily to ensure thread
    * safety of the total_nonval_callno_used check and increment */
   ao2_lock(callno_pool);

   /* only a certain number of nonvalidated call numbers should be allocated.
    * If there ever is an attack, this separates the calltoken validating
    * users from the non calltoken validating users. */
   if (!validated && (total_nonval_callno_used >= global_maxcallno_nonval)) {
      ast_log(LOG_WARNING, "NON-CallToken callnumber limit is reached. Current:%d Max:%d\n", total_nonval_callno_used, global_maxcallno_nonval);
      ao2_unlock(callno_pool);
      return NULL;
   }

   /* unlink the object from the container, taking over ownership
    * of the reference the container had to the object */
   callno_entry = ao2_find((trunk ? callno_pool_trunk : callno_pool), NULL, OBJ_POINTER | OBJ_UNLINK | OBJ_CONTINUE);

   if (callno_entry) {
      callno_entry->validated = validated;
      if (!validated) {
         total_nonval_callno_used++;
      }
   }

   ao2_unlock(callno_pool);
   return callno_entry;
}

static int replace_callno(const void *obj)
{
   struct callno_entry *callno_entry = (struct callno_entry *) obj;

   /* the callno_pool container is locked here primarily to ensure thread
    * safety of the total_nonval_callno_used check and decrement */
   ao2_lock(callno_pool);

   if (!callno_entry->validated && (total_nonval_callno_used != 0)) {
      total_nonval_callno_used--;
   } else if (!callno_entry->validated && (total_nonval_callno_used == 0)) {
      ast_log(LOG_ERROR, "Attempted to decrement total non calltoken validated callnumbers below zero... Callno is:%d \n", callno_entry->callno);
   }

   if (callno_entry->callno < TRUNK_CALL_START) {
      ao2_link(callno_pool, callno_entry);
   } else {
      ao2_link(callno_pool_trunk, callno_entry);
   }
   ao2_ref(callno_entry, -1); /* only container ref remains */

   ao2_unlock(callno_pool);
   return 0;
}

static int callno_hash(const void *obj, const int flags)
{
   return abs(ast_random());
}

static int create_callno_pools(void)
{
   uint16_t i;

   if (!(callno_pool = ao2_container_alloc(CALLNO_POOL_BUCKETS, callno_hash, NULL))) {
      return -1;
   }

   if (!(callno_pool_trunk = ao2_container_alloc(CALLNO_POOL_BUCKETS, callno_hash, NULL))) {
      return -1;
   }

   /* start at 2, 0 and 1 are reserved */
   for (i = 2; i <= IAX_MAX_CALLS; i++) {
      struct callno_entry *callno_entry;

      if (!(callno_entry = ao2_alloc(sizeof(*callno_entry), NULL))) {
         return -1;
      }

      callno_entry->callno = i;

      if (i < TRUNK_CALL_START) {
         ao2_link(callno_pool, callno_entry);
      } else {
         ao2_link(callno_pool_trunk, callno_entry);
      }

      ao2_ref(callno_entry, -1);
   }

   return 0;
}

/*!
 * \internal
 * \brief Schedules delayed removal of iax2_pvt call number data
 *
 * \note After MIN_REUSE_TIME has passed for a destroyed iax2_pvt, the callno is
 * avaliable again, and the address from the previous connection must be decremented
 * from the peercnts table.  This function schedules these operations to take place.
 */
static void sched_delay_remove(struct sockaddr_in *sin, struct callno_entry *callno_entry)
{
   int i;
   struct peercnt *peercnt;
   struct peercnt tmp = {
      .addr = sin->sin_addr.s_addr,
   };

   if ((peercnt = ao2_find(peercnts, &tmp, OBJ_POINTER))) {
      if (unloading) {
         peercnt_remove_cb(peercnt);
         replace_callno(callno_entry);
         return;
      }

      /* refcount is incremented with ao2_find.  keep that ref for the scheduler */
      if (option_debug) {
         ast_log(LOG_DEBUG, "schedule decrement of callno used for %s in %d seconds\n", ast_inet_ntoa(sin->sin_addr), MIN_REUSE_TIME);
      }
      i = iax2_sched_add(sched, MIN_REUSE_TIME * 1000, peercnt_remove_cb, peercnt);
      if (i == -1) {
         ao2_ref(peercnt, -1);
      }
   }

   iax2_sched_add(sched, MIN_REUSE_TIME * 1000, replace_callno, callno_entry);
}

/*! 
 * \internal
 * \brief returns whether or not a frame is capable of starting a new IAX2 dialog. 
 *
 * \note For this implementation, inbound pokes should _NOT_ be capable of allocating
 * a new callno.
 */
static inline int attribute_pure iax2_allow_new(int frametype, int subclass, int inbound)
{
   if (frametype != AST_FRAME_IAX) {
      return 0;
   }
   switch (subclass) {
   case IAX_COMMAND_NEW:
   case IAX_COMMAND_REGREQ:
   case IAX_COMMAND_FWDOWNL:
   case IAX_COMMAND_REGREL:
      return 1;
   case IAX_COMMAND_POKE:
      if (!inbound) {
         return 1;
      }
      break;
   }
   return 0;
}

/*!
 * \note Calling this function while holding another pvt lock can cause a deadlock.
 */
static int __find_callno(unsigned short callno, unsigned short dcallno, struct sockaddr_in *sin, int new, int sockfd, int return_locked, int check_dcallno)
{
   int res = 0;
   int x;
   /* this call is calltoken validated as long as it is either NEW_FORCE
    * or NEW_ALLOW_CALLTOKEN_VALIDATED */
   int validated = (new > NEW_ALLOW) ? 1 : 0;
   char host[80];

   if (new <= NEW_ALLOW) {
      if (callno) {
         struct chan_iax2_pvt *pvt;
         struct chan_iax2_pvt tmp_pvt = {
            .callno = dcallno,
            .peercallno = callno,
            .transfercallno = callno,
            /* hack!! */
            .frames_received = check_dcallno,
         };

         memcpy(&tmp_pvt.addr, sin, sizeof(tmp_pvt.addr));
         /* this works for finding normal call numbers not involving transfering */ 
         if ((pvt = ao2_find(iax_peercallno_pvts, &tmp_pvt, OBJ_POINTER))) {
            if (return_locked) {
               ast_mutex_lock(&iaxsl[pvt->callno]);
            }
            res = pvt->callno;
            ao2_ref(pvt, -1);
            pvt = NULL;
            return res;
         }
         /* this searches for transfer call numbers that might not get caught otherwise */
         memset(&tmp_pvt.addr, 0, sizeof(tmp_pvt.addr));
         memcpy(&tmp_pvt.transfer, sin, sizeof(tmp_pvt.transfer));
         if ((pvt = ao2_find(iax_transfercallno_pvts, &tmp_pvt, OBJ_POINTER))) {
            if (return_locked) {
               ast_mutex_lock(&iaxsl[pvt->callno]);
            }
            res = pvt->callno;
            ao2_ref(pvt, -1);
            pvt = NULL;
            return res;
         }
      }
      /* This will occur on the first response to a message that we initiated,
       * such as a PING. */
      if (dcallno) {
         ast_mutex_lock(&iaxsl[dcallno]);
      }
      if (callno && dcallno && iaxs[dcallno] && !iaxs[dcallno]->peercallno && match(sin, callno, dcallno, iaxs[dcallno], check_dcallno)) {
         iaxs[dcallno]->peercallno = callno;
         res = dcallno;
         store_by_peercallno(iaxs[dcallno]);
         if (!res || !return_locked) {
            ast_mutex_unlock(&iaxsl[dcallno]);
         }
         return res;
      }
      if (dcallno) {
         ast_mutex_unlock(&iaxsl[dcallno]);
      }
#ifdef IAX_OLD_FIND
      /* If we get here, we SHOULD NOT find a call structure for this
         callno; if we do, it means that there is a call structure that
         has a peer callno but did NOT get entered into the hash table,
         which is bad.

         If we find a call structure using this old, slow method, output a log
         message so we'll know about it. After a few months of leaving this in
         place, if we don't hear about people seeing these messages, we can
         remove this code for good.
      */

      for (x = 1; !res && x < maxnontrunkcall; x++) {
         ast_mutex_lock(&iaxsl[x]);
         if (iaxs[x]) {
            /* Look for an exact match */
            if (match(sin, callno, dcallno, iaxs[x], check_dcallno)) {
               res = x;
            }
         }
         if (!res || !return_locked)
            ast_mutex_unlock(&iaxsl[x]);
      }

      for (x = TRUNK_CALL_START; !res && x < maxtrunkcall; x++) {
         ast_mutex_lock(&iaxsl[x]);
         if (iaxs[x]) {
            /* Look for an exact match */
            if (match(sin, callno, dcallno, iaxs[x], check_dcallno)) {
               res = x;
            }
         }
         if (!res || !return_locked)
            ast_mutex_unlock(&iaxsl[x]);
      }

      if (res) {
         ast_log(LOG_WARNING, "Old call search code found call number %d that was not in hash table!\n", res);
      }
#endif
   }
   if (!res && (new >= NEW_ALLOW)) {
      struct callno_entry *callno_entry;
      /* It may seem odd that we look through the peer list for a name for
       * this *incoming* call.  Well, it is weird.  However, users don't
       * have an IP address/port number that we can match against.  So,
       * this is just checking for a peer that has that IP/port and
       * assuming that we have a user of the same name.  This isn't always
       * correct, but it will be changed if needed after authentication. */
      if (!iax2_getpeername(*sin, host, sizeof(host)))
         snprintf(host, sizeof(host), "%s:%d", ast_inet_ntoa(sin->sin_addr), ntohs(sin->sin_port));

      if (peercnt_add(sin)) {
         /* This address has hit its callnumber limit.  When the limit
          * is reached, the connection is not added to the peercnts table.*/
         return 0;
      }

      if (!(callno_entry = get_unused_callno(0, validated))) {
         /* since we ran out of space, remove the peercnt
          * entry we added earlier */
         peercnt_remove_by_addr(sin);
         ast_log(LOG_WARNING, "No more space\n");
         return 0;
      }
      x = callno_entry->callno;
      ast_mutex_lock(&iaxsl[x]);

      iaxs[x] = new_iax(sin, host);
      update_max_nontrunk();
      if (iaxs[x]) {
         if (option_debug && iaxdebug)
            ast_log(LOG_DEBUG, "Creating new call structure %d\n", x);
         iaxs[x]->callno_entry = callno_entry;
         iaxs[x]->sockfd = sockfd;
         iaxs[x]->addr.sin_port = sin->sin_port;
         iaxs[x]->addr.sin_family = sin->sin_family;
         iaxs[x]->addr.sin_addr.s_addr = sin->sin_addr.s_addr;
         iaxs[x]->peercallno = callno;
         iaxs[x]->callno = x;
         iaxs[x]->pingtime = DEFAULT_RETRY_TIME;
         iaxs[x]->expiry = min_reg_expire;
         iaxs[x]->pingid = iax2_sched_add(sched, ping_time * 1000, send_ping, (void *)(long)x);
         iaxs[x]->lagid = iax2_sched_add(sched, lagrq_time * 1000, send_lagrq, (void *)(long)x);
         iaxs[x]->amaflags = amaflags;
         ast_copy_flags(iaxs[x], (&globalflags), IAX_NOTRANSFER | IAX_TRANSFERMEDIA | IAX_USEJITTERBUF | IAX_FORCEJITTERBUF);
         
         ast_string_field_set(iaxs[x], accountcode, accountcode);
         ast_string_field_set(iaxs[x], mohinterpret, mohinterpret);
         ast_string_field_set(iaxs[x], mohsuggest, mohsuggest);

         if (iaxs[x]->peercallno) {
            store_by_peercallno(iaxs[x]);
         }
      } else {
         ast_log(LOG_WARNING, "Out of resources\n");
         ast_mutex_unlock(&iaxsl[x]);
         replace_callno(callno_entry);
         return 0;
      }
      if (!return_locked)
         ast_mutex_unlock(&iaxsl[x]);
      res = x;
   }
   return res;
}

static int find_callno(unsigned short callno, unsigned short dcallno, struct sockaddr_in *sin, int new, int sockfd, int full_frame) {

   return __find_callno(callno, dcallno, sin, new, sockfd, 0, full_frame);
}

static int find_callno_locked(unsigned short callno, unsigned short dcallno, struct sockaddr_in *sin, int new, int sockfd, int full_frame) {

   return __find_callno(callno, dcallno, sin, new, sockfd, 1, full_frame);
}

/*!
 * \brief Queue a frame to a call's owning asterisk channel
 *
 * \pre This function assumes that iaxsl[callno] is locked when called.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_frame(int callno, struct ast_frame *f)
{
   iax2_lock_owner(callno);
   if (iaxs[callno] && iaxs[callno]->owner) {
      ast_queue_frame(iaxs[callno]->owner, f);
      ast_mutex_unlock(&iaxs[callno]->owner->lock);
   }
   return 0;
}

/*!
 * \brief Queue a hangup frame on the ast_channel owner
 *
 * This function queues a hangup frame on the owner of the IAX2 pvt struct that
 * is active for the given call number.
 *
 * \pre Assumes lock for callno is already held.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_hangup(int callno)
{
   iax2_lock_owner(callno);
   if (iaxs[callno] && iaxs[callno]->owner) {
      ast_queue_hangup(iaxs[callno]->owner);
      ast_mutex_unlock(&iaxs[callno]->owner->lock);
   }
   return 0;
}

/*!
 * \brief Queue a control frame on the ast_channel owner
 *
 * This function queues a control frame on the owner of the IAX2 pvt struct that
 * is active for the given call number.
 *
 * \pre Assumes lock for callno is already held.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function may unlock and lock the mutex associated with this callno,
 * meaning that another thread may grab it and destroy the call.
 */
static int iax2_queue_control_data(int callno, 
   enum ast_control_frame_type control, const void *data, size_t datalen)
{
   iax2_lock_owner(callno);
   if (iaxs[callno] && iaxs[callno]->owner) {
      ast_queue_control_data(iaxs[callno]->owner, control, data, datalen);
      ast_mutex_unlock(&iaxs[callno]->owner->lock);
   }
   return 0;
}
static void destroy_firmware(struct iax_firmware *cur)
{
   /* Close firmware */
   if (cur->fwh) {
      munmap((void*)cur->fwh, ntohl(cur->fwh->datalen) + sizeof(*(cur->fwh)));
   }
   close(cur->fd);
   free(cur);
}

static int try_firmware(char *s)
{
   struct stat stbuf;
   struct iax_firmware *cur;
   int ifd;
   int fd;
   int res;
   
   struct ast_iax2_firmware_header *fwh, fwh2;
   struct MD5Context md5;
   unsigned char sum[16];
   unsigned char buf[1024];
   int len, chunk;
   char *s2;
   char *last;
   s2 = alloca(strlen(s) + 100);
   if (!s2) {
      ast_log(LOG_WARNING, "Alloca failed!\n");
      return -1;
   }
   last = strrchr(s, '/');
   if (last)
      last++;
   else
      last = s;
   snprintf(s2, strlen(s) + 100, "/var/tmp/%s-%ld", last, (unsigned long)ast_random());
   res = stat(s, &stbuf);
   if (res < 0) {
      ast_log(LOG_WARNING, "Failed to stat '%s': %s\n", s, strerror(errno));
      return -1;
   }
   /* Make sure it's not a directory */
   if (S_ISDIR(stbuf.st_mode))
      return -1;
   ifd = open(s, O_RDONLY);
   if (ifd < 0) {
      ast_log(LOG_WARNING, "Cannot open '%s': %s\n", s, strerror(errno));
      return -1;
   }
   fd = open(s2, O_RDWR | O_CREAT | O_EXCL, 0600);
   if (fd < 0) {
      ast_log(LOG_WARNING, "Cannot open '%s' for writing: %s\n", s2, strerror(errno));
      close(ifd);
      return -1;
   }
   /* Unlink our newly created file */
   unlink(s2);
   
   /* Now copy the firmware into it */
   len = stbuf.st_size;
   while(len) {
      chunk = len;
      if (chunk > sizeof(buf))
         chunk = sizeof(buf);
      res = read(ifd, buf, chunk);
      if (res != chunk) {
         ast_log(LOG_WARNING, "Only read %d of %d bytes of data :(: %s\n", res, chunk, strerror(errno));
         close(ifd);
         close(fd);
         return -1;
      }
      res = write(fd, buf, chunk);
      if (res != chunk) {
         ast_log(LOG_WARNING, "Only write %d of %d bytes of data :(: %s\n", res, chunk, strerror(errno));
         close(ifd);
         close(fd);
         return -1;
      }
      len -= chunk;
   }
   close(ifd);
   /* Return to the beginning */
   lseek(fd, 0, SEEK_SET);
   if ((res = read(fd, &fwh2, sizeof(fwh2))) != sizeof(fwh2)) {
      ast_log(LOG_WARNING, "Unable to read firmware header in '%s'\n", s);
      close(fd);
      return -1;
   }
   if (ntohl(fwh2.magic) != IAX_FIRMWARE_MAGIC) {
      ast_log(LOG_WARNING, "'%s' is not a valid firmware file\n", s);
      close(fd);
      return -1;
   }
   if (ntohl(fwh2.datalen) != (stbuf.st_size - sizeof(fwh2))) {
      ast_log(LOG_WARNING, "Invalid data length in firmware '%s'\n", s);
      close(fd);
      return -1;
   }
   if (fwh2.devname[sizeof(fwh2.devname) - 1] || ast_strlen_zero((char *)fwh2.devname)) {
      ast_log(LOG_WARNING, "No or invalid device type specified for '%s'\n", s);
      close(fd);
      return -1;
   }
   fwh = (struct ast_iax2_firmware_header*)mmap(NULL, stbuf.st_size, PROT_READ, MAP_PRIVATE, fd, 0); 
   if (fwh == MAP_FAILED) {
      ast_log(LOG_WARNING, "mmap failed: %s\n", strerror(errno));
      close(fd);
      return -1;
   }
   MD5Init(&md5);
   MD5Update(&md5, fwh->data, ntohl(fwh->datalen));
   MD5Final(sum, &md5);
   if (memcmp(sum, fwh->chksum, sizeof(sum))) {
      ast_log(LOG_WARNING, "Firmware file '%s' fails checksum\n", s);
      munmap((void*)fwh, stbuf.st_size);
      close(fd);
      return -1;
   }
   cur = waresl.wares;
   while(cur) {
      if (!strcmp((char *)cur->fwh->devname, (char *)fwh->devname)) {
         /* Found a candidate */
         if (cur->dead || (ntohs(cur->fwh->version) < ntohs(fwh->version)))
            /* The version we have on loaded is older, load this one instead */
            break;
         /* This version is no newer than what we have.  Don't worry about it.
            We'll consider it a proper load anyhow though */
         munmap((void*)fwh, stbuf.st_size);
         close(fd);
         return 0;
      }
      cur = cur->next;
   }
   if (!cur) {
      /* Allocate a new one and link it */
      if ((cur = ast_calloc(1, sizeof(*cur)))) {
         cur->fd = -1;
         cur->next = waresl.wares;
         waresl.wares = cur;
      }
   }
   if (cur) {
      if (cur->fwh) {
         munmap((void*)cur->fwh, cur->mmaplen);
      }
      if (cur->fd > -1)
         close(cur->fd);
      cur->fwh = fwh;
      cur->fd = fd;
      cur->mmaplen = stbuf.st_size;
      cur->dead = 0;
   }
   return 0;
}

static int iax_check_version(char *dev)
{
   int res = 0;
   struct iax_firmware *cur;
   if (!ast_strlen_zero(dev)) {
      ast_mutex_lock(&waresl.lock);
      cur = waresl.wares;
      while(cur) {
         if (!strcmp(dev, (char *)cur->fwh->devname)) {
            res = ntohs(cur->fwh->version);
            break;
         }
         cur = cur->next;
      }
      ast_mutex_unlock(&waresl.lock);
   }
   return res;
}

static int iax_firmware_append(struct iax_ie_data *ied, const unsigned char *dev, unsigned int desc)
{
   int res = -1;
   unsigned int bs = desc & 0xff;
   unsigned int start = (desc >> 8) & 0xffffff;
   unsigned int bytes;
   struct iax_firmware *cur;
   if (!ast_strlen_zero((char *)dev) && bs) {
      start *= bs;
      ast_mutex_lock(&waresl.lock);
      cur = waresl.wares;
      while(cur) {
         if (!strcmp((char *)dev, (char *)cur->fwh->devname)) {
            iax_ie_append_int(ied, IAX_IE_FWBLOCKDESC, desc);
            if (start < ntohl(cur->fwh->datalen)) {
               bytes = ntohl(cur->fwh->datalen) - start;
               if (bytes > bs)
                  bytes = bs;
               iax_ie_append_raw(ied, IAX_IE_FWBLOCKDATA, cur->fwh->data + start, bytes);
            } else {
               bytes = 0;
               iax_ie_append(ied, IAX_IE_FWBLOCKDATA);
            }
            if (bytes == bs)
               res = 0;
            else
               res = 1;
            break;
         }
         cur = cur->next;
      }
      ast_mutex_unlock(&waresl.lock);
   }
   return res;
}


static void reload_firmware(int unload)
{
   struct iax_firmware *cur, *curl, *curp;
   DIR *fwd;
   struct dirent *de;
   char dir[256];
   char fn[256];
   /* Mark all as dead */
   ast_mutex_lock(&waresl.lock);
   cur = waresl.wares;
   while(cur) {
      cur->dead = 1;
      cur = cur->next;
   }

   /* Now that we've freed them, load the new ones */
   if (!unload) {
      snprintf(dir, sizeof(dir), "%s/firmware/iax", (char *)ast_config_AST_DATA_DIR);
      fwd = opendir(dir);
      if (fwd) {
         while((de = readdir(fwd))) {
            if (de->d_name[0] != '.') {
               snprintf(fn, sizeof(fn), "%s/%s", dir, de->d_name);
               if (!try_firmware(fn)) {
                  if (option_verbose > 1)
                     ast_verbose(VERBOSE_PREFIX_2 "Loaded firmware '%s'\n", de->d_name);
               }
            }
         }
         closedir(fwd);
      } else 
         ast_log(LOG_WARNING, "Error opening firmware directory '%s': %s\n", dir, strerror(errno));
   }

   /* Clean up leftovers */
   cur = waresl.wares;
   curp = NULL;
   while(cur) {
      curl = cur;
      cur = cur->next;
      if (curl->dead) {
         if (curp) {
            curp->next = cur;
         } else {
            waresl.wares = cur;
         }
         destroy_firmware(curl);
      } else {
         curp = cur;
      }
   }
   ast_mutex_unlock(&waresl.lock);
}

/*!
 * \note This function assumes that iaxsl[callno] is locked when called.
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 * This function calls iax2_queue_frame(), which may unlock and lock the mutex 
 * associated with this callno, meaning that another thread may grab it and destroy the call.
 */
static int __do_deliver(void *data)
{
   /* Just deliver the packet by using queueing.  This is called by
     the IAX thread with the iaxsl lock held. */
   struct iax_frame *fr = data;
   fr->retrans = -1;
   ast_clear_flag(&fr->af, AST_FRFLAG_HAS_TIMING_INFO);
   if (iaxs[fr->callno] && !ast_test_flag(iaxs[fr->callno], IAX_ALREADYGONE))
      iax2_queue_frame(fr->callno, &fr->af);
   /* Free our iax frame */
   iax2_frame_free(fr);
   /* And don't run again */
   return 0;
}

static int handle_error(void)
{
   /* XXX Ideally we should figure out why an error occured and then abort those
      rather than continuing to try.  Unfortunately, the published interface does
      not seem to work XXX */
#if 0
   struct sockaddr_in *sin;
   int res;
   struct msghdr m;
   struct sock_extended_err e;
   m.msg_name = NULL;
   m.msg_namelen = 0;
   m.msg_iov = NULL;
   m.msg_control = &e;
   m.msg_controllen = sizeof(e);
   m.msg_flags = 0;
   res = recvmsg(netsocket, &m, MSG_ERRQUEUE);
   if (res < 0)
      ast_log(LOG_WARNING, "Error detected, but unable to read error: %s\n", strerror(errno));
   else {
      if (m.msg_controllen) {
         sin = (struct sockaddr_in *)SO_EE_OFFENDER(&e);
         if (sin) 
            ast_log(LOG_WARNING, "Receive error from %s\n", ast_inet_ntoa(sin->sin_addr));
         else
            ast_log(LOG_WARNING, "No address detected??\n");
      } else {
         ast_log(LOG_WARNING, "Local error: %s\n", strerror(e.ee_errno));
      }
   }
#endif
   return 0;
}

static int transmit_trunk(struct iax_frame *f, struct sockaddr_in *sin, int sockfd)
{
   int res;
   res = sendto(sockfd, f->data, f->datalen, 0,(struct sockaddr *)sin,
               sizeof(*sin));
   if (res < 0) {
      if (option_debug)
         ast_log(LOG_DEBUG, "Received error: %s\n", strerror(errno));
      handle_error();
   } else
      res = 0;
   return res;
}

static int send_packet(struct iax_frame *f)
{
   int res;
   int callno = f->callno;

   /* Don't send if there was an error, but return error instead */
   if (!callno || !iaxs[callno] || iaxs[callno]->error)
       return -1;
   
   /* Called with iaxsl held */
   if (option_debug > 2 && iaxdebug)
      ast_log(LOG_DEBUG, "Sending %d on %d/%d to %s:%d\n", f->ts, callno, iaxs[callno]->peercallno, ast_inet_ntoa(iaxs[callno]->addr.sin_addr), ntohs(iaxs[callno]->addr.sin_port));
   if (f->transfer) {
      if (iaxdebug)
         iax_showframe(f, NULL, 0, &iaxs[callno]->transfer, f->datalen - sizeof(struct ast_iax2_full_hdr));
      res = sendto(iaxs[callno]->sockfd, f->data, f->datalen, 0,(struct sockaddr *)&iaxs[callno]->transfer,
               sizeof(iaxs[callno]->transfer));
   } else {
      if (iaxdebug)
         iax_showframe(f, NULL, 0, &iaxs[callno]->addr, f->datalen - sizeof(struct ast_iax2_full_hdr));
      res = sendto(iaxs[callno]->sockfd, f->data, f->datalen, 0,(struct sockaddr *)&iaxs[callno]->addr,
               sizeof(iaxs[callno]->addr));
   }
   if (res < 0) {
      if (option_debug && iaxdebug)
         ast_log(LOG_DEBUG, "Received error: %s\n", strerror(errno));
      handle_error();
   } else
      res = 0;
   return res;
}

/*!
 * \note Since this function calls iax2_queue_hangup(), the pvt struct
 *       for the given call number may disappear during its execution.
 */
static int iax2_predestroy(int callno)
{
   struct ast_channel *c;
   struct chan_iax2_pvt *pvt = iaxs[callno];

   if (!pvt)
      return -1;
   if (!ast_test_flag(pvt, IAX_ALREADYGONE)) {
      iax2_destroy_helper(pvt);
      ast_set_flag(pvt, IAX_ALREADYGONE); 
   }
   c = pvt->owner;
   if (c) {
      c->tech_pvt = NULL;
      iax2_queue_hangup(callno);
      pvt->owner = NULL;
      ast_module_unref(ast_module_info->self);
   }
   return 0;
}

static int update_packet(struct iax_frame *f)
{
   /* Called with iaxsl lock held, and iaxs[callno] non-NULL */
   struct ast_iax2_full_hdr *fh = f->data;
   struct ast_frame af;

   /* if frame is encrypted. decrypt before updating it. */
   if (f->encmethods) {
      decode_frame(&f->mydcx, fh, &af, &f->datalen);
   }
   /* Mark this as a retransmission */
   fh->dcallno = ntohs(IAX_FLAG_RETRANS | f->dcallno);
   /* Update iseqno */
   f->iseqno = iaxs[f->callno]->iseqno;
   fh->iseqno = f->iseqno;

   /* Now re-encrypt the frame */
   if (f->encmethods) {
   /* since this is a retransmit frame, create a new random padding
    * before re-encrypting. */
      build_rand_pad(f->semirand, sizeof(f->semirand));
      encrypt_frame(&f->ecx, fh, f->semirand, &f->datalen);
   }
   return 0;
}

static int attempt_transmit(const void *data);
static void __attempt_transmit(const void *data)
{
   /* Attempt to transmit the frame to the remote peer...
      Called without iaxsl held. */
   struct iax_frame *f = (struct iax_frame *)data;
   int freeme=0;
   int callno = f->callno;
   /* Make sure this call is still active */
   if (callno) 
      ast_mutex_lock(&iaxsl[callno]);
   if (callno && iaxs[callno]) {
      if ((f->retries < 0) /* Already ACK'd */ ||
          (f->retries >= max_retries) /* Too many attempts */) {
            /* Record an error if we've transmitted too many times */
            if (f->retries >= max_retries) {
               if (f->transfer) {
                  /* Transfer timeout */
                  send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_TXREJ, 0, NULL, 0, -1);
               } else if (f->final) {
                  if (f->final) 
                     iax2_destroy(callno);
               } else {
                  if (iaxs[callno]->owner)
                     ast_log(LOG_WARNING, "Max retries exceeded to host %s on %s (type = %d, subclass = %d, ts=%d, seqno=%d)\n", ast_inet_ntoa(iaxs[f->callno]->addr.sin_addr),iaxs[f->callno]->owner->name , f->af.frametype, f->af.subclass, f->ts, f->oseqno);
                  iaxs[callno]->error = ETIMEDOUT;
                  if (iaxs[callno]->owner) {
                     struct ast_frame fr = { 0, };
                     /* Hangup the fd */
                     fr.frametype = AST_FRAME_CONTROL;
                     fr.subclass = AST_CONTROL_HANGUP;
                     iax2_queue_frame(callno, &fr); // XXX
                     /* Remember, owner could disappear */
                     if (iaxs[callno] && iaxs[callno]->owner)
                        iaxs[callno]->owner->hangupcause = AST_CAUSE_DESTINATION_OUT_OF_ORDER;
                  } else {
                     if (iaxs[callno]->reg) {
                        memset(&iaxs[callno]->reg->us, 0, sizeof(iaxs[callno]->reg->us));
                        iaxs[callno]->reg->regstate = REG_STATE_TIMEOUT;
                        iaxs[callno]->reg->refresh = IAX_DEFAULT_REG_EXPIRE;
                     }
                     iax2_destroy(callno);
                  }
               }

            }
            freeme++;
      } else {
         /* Update it if it needs it */
         update_packet(f);
         /* Attempt transmission */
         send_packet(f);
         f->retries++;
         /* Try again later after 10 times as long */
         f->retrytime *= 10;
         if (f->retrytime > MAX_RETRY_TIME)
            f->retrytime = MAX_RETRY_TIME;
         /* Transfer messages max out at one second */
         if (f->transfer && (f->retrytime > 1000))
            f->retrytime = 1000;
         f->retrans = iax2_sched_add(sched, f->retrytime, attempt_transmit, f);
      }
   } else {
      /* Make sure it gets freed */
      f->retries = -1;
      freeme++;
   }
   if (callno)
      ast_mutex_unlock(&iaxsl[callno]);
   /* Do not try again */
   if (freeme) {
      /* Don't attempt delivery, just remove it from the queue */
      AST_LIST_LOCK(&iaxq.queue);
      AST_LIST_REMOVE(&iaxq.queue, f, list);
      iaxq.count--;
      AST_LIST_UNLOCK(&iaxq.queue);
      f->retrans = -1; /* this is safe because this is the scheduled function */
      /* Free the IAX frame */
      iax2_frame_free(f);
   }
}

static int attempt_transmit(const void *data)
{
#ifdef SCHED_MULTITHREADED
   if (schedule_action(__attempt_transmit, data))
#endif      
      __attempt_transmit(data);
   return 0;
}

static int iax2_prune_realtime(int fd, int argc, char *argv[])
{
   struct iax2_peer *peer = NULL;
   struct iax2_user *user = NULL;

   if (argc != 4)
        return RESULT_SHOWUSAGE;
   if (!strcmp(argv[3],"all")) {
      prune_users();
      prune_peers();
      ast_cli(fd, "OK cache is flushed.\n");
      return RESULT_SUCCESS;
   }
   peer = find_peer(argv[3], 0);
   user = find_user(argv[3]);
   if (peer || user) {
      if (peer) {
         if (ast_test_flag(peer, IAX_RTCACHEFRIENDS)) {
            ast_set_flag(peer, IAX_RTAUTOCLEAR);
            expire_registry(peer_ref(peer));
            ast_cli(fd, "Peer %s was removed from the cache.\n", argv[3]);
         } else {
            ast_cli(fd, "Peer %s is not eligible for this operation.\n", argv[3]);
         }
         peer_unref(peer);
      }
      if (user) {
         if (ast_test_flag(user, IAX_RTCACHEFRIENDS)) {
            ast_set_flag(user, IAX_RTAUTOCLEAR);
            ast_cli(fd, "User %s was removed from the cache.\n", argv[3]);
         } else {
            ast_cli(fd, "User %s is not eligible for this operation.\n", argv[3]);
         }
         ao2_unlink(users,user);
         user_unref(user);
      }
   } else {
      ast_cli(fd, "%s was not found in the cache.\n", argv[3]);
   }

   return RESULT_SUCCESS;
}

static int iax2_test_losspct(int fd, int argc, char *argv[])
{
       if (argc != 4)
               return RESULT_SHOWUSAGE;

       test_losspct = atoi(argv[3]);

       return RESULT_SUCCESS;
}

#ifdef IAXTESTS
static int iax2_test_late(int fd, int argc, char *argv[])
{
   if (argc != 4)
      return RESULT_SHOWUSAGE;

   test_late = atoi(argv[3]);

   return RESULT_SUCCESS;
}

static int iax2_test_resync(int fd, int argc, char *argv[])
{
   if (argc != 4)
      return RESULT_SHOWUSAGE;

   test_resync = atoi(argv[3]);

   return RESULT_SUCCESS;
}

static int iax2_test_jitter(int fd, int argc, char *argv[])
{
   if (argc < 4 || argc > 5)
      return RESULT_SHOWUSAGE;

   test_jit = atoi(argv[3]);
   if (argc == 5) 
      test_jitpct = atoi(argv[4]);

   return RESULT_SUCCESS;
}
#endif /* IAXTESTS */

/*! \brief  peer_status: Report Peer status in character string */
/*    returns 1 if peer is online, -1 if unmonitored */
static int peer_status(struct iax2_peer *peer, char *status, int statuslen)
{
   int res = 0;
   if (peer->maxms) {
      if (peer->lastms < 0) {
         ast_copy_string(status, "UNREACHABLE", statuslen);
      } else if (peer->lastms > peer->maxms) {
         snprintf(status, statuslen, "LAGGED (%d ms)", peer->lastms);
         res = 1;
      } else if (peer->lastms) {
         snprintf(status, statuslen, "OK (%d ms)", peer->lastms);
         res = 1;
      } else {
         ast_copy_string(status, "UNKNOWN", statuslen);
      }
   } else { 
      ast_copy_string(status, "Unmonitored", statuslen);
      res = -1;
   }
   return res;
}

/*! \brief Show one peer in detail */
static int iax2_show_peer(int fd, int argc, char *argv[])
{
   char status[30];
   char cbuf[256];
   struct iax2_peer *peer;
   char codec_buf[512];
   int x = 0, codec = 0, load_realtime = 0;

   if (argc < 4)
      return RESULT_SHOWUSAGE;

   load_realtime = (argc == 5 && !strcmp(argv[4], "load")) ? 1 : 0;

   peer = find_peer(argv[3], load_realtime);
   if (peer) {
      ast_cli(fd,"\n\n");
      ast_cli(fd, "  * Name       : %s\n", peer->name);
      ast_cli(fd, "  Secret       : %s\n", ast_strlen_zero(peer->secret)?"<Not set>":"<Set>");
      ast_cli(fd, "  Context      : %s\n", peer->context);
      ast_cli(fd, "  Mailbox      : %s\n", peer->mailbox);
      ast_cli(fd, "  Dynamic      : %s\n", ast_test_flag(peer, IAX_DYNAMIC) ? "Yes":"No");
      ast_cli(fd, "  Callnum limit: %d\n", peer->maxcallno);
      ast_cli(fd, "  Calltoken req: %s\n", (peer->calltoken_required == CALLTOKEN_YES) ? "Yes" : ((peer->calltoken_required == CALLTOKEN_AUTO) ? "Auto" : "No"));


      ast_cli(fd, "  Trunk        : %s\n", ast_test_flag(peer, IAX_TRUNK) ? "Yes" : "No");
      ast_cli(fd, "  Callerid     : %s\n", ast_callerid_merge(cbuf, sizeof(cbuf), peer->cid_name, peer->cid_num, "<unspecified>"));
      ast_cli(fd, "  Expire       : %d\n", peer->expire);
      ast_cli(fd, "  ACL          : %s\n", (peer->ha?"Yes":"No"));
      ast_cli(fd, "  Addr->IP     : %s Port %d\n",  peer->addr.sin_addr.s_addr ? ast_inet_ntoa(peer->addr.sin_addr) : "(Unspecified)", ntohs(peer->addr.sin_port));
      ast_cli(fd, "  Defaddr->IP  : %s Port %d\n", ast_inet_ntoa(peer->defaddr.sin_addr), ntohs(peer->defaddr.sin_port));
      ast_cli(fd, "  Username     : %s\n", peer->username);
      ast_cli(fd, "  Codecs       : ");
      ast_getformatname_multiple(codec_buf, sizeof(codec_buf) -1, peer->capability);
      ast_cli(fd, "%s\n", codec_buf);

      ast_cli(fd, "  Codec Order  : (");
      for(x = 0; x < 32 ; x++) {
         codec = ast_codec_pref_index(&peer->prefs,x);
         if(!codec)
            break;
         ast_cli(fd, "%s", ast_getformatname(codec));
         if(x < 31 && ast_codec_pref_index(&peer->prefs,x+1))
            ast_cli(fd, "|");
      }

      if (!x)
         ast_cli(fd, "none");
      ast_cli(fd, ")\n");

      ast_cli(fd, "  Status       : ");
      peer_status(peer, status, sizeof(status));   
      ast_cli(fd, "%s\n",status);
      ast_cli(fd, "  Qualify      : every %dms when OK, every %dms when UNREACHABLE (sample smoothing %s)\n", peer->pokefreqok, peer->pokefreqnotok, peer->smoothing ? "On" : "Off");
      ast_cli(fd,"\n");
      peer_unref(peer);
   } else {
      ast_cli(fd,"Peer %s not found.\n", argv[3]);
      ast_cli(fd,"\n");
   }

   return RESULT_SUCCESS;
}

static char *complete_iax2_show_peer(const char *line, const char *word, int pos, int state)
{
   int which = 0;
   struct iax2_peer *peer;
   char *res = NULL;
   int wordlen = strlen(word);
   struct ao2_iterator i;

   /* 0 - iax2; 1 - show; 2 - peer; 3 - <peername> */
   if (pos != 3)
      return NULL;

   i = ao2_iterator_init(peers, 0);
   while ((peer = ao2_iterator_next(&i))) {
      if (!strncasecmp(peer->name, word, wordlen) && ++which > state) {
         res = ast_strdup(peer->name);
         peer_unref(peer);
         break;
      }
      peer_unref(peer);
   }
   ao2_iterator_destroy(&i);

   return res;
}

static int iax2_show_stats(int fd, int argc, char *argv[])
{
   struct iax_frame *cur;
   int cnt = 0, dead=0, final=0;

   if (argc != 3)
      return RESULT_SHOWUSAGE;

   AST_LIST_LOCK(&iaxq.queue);
   AST_LIST_TRAVERSE(&iaxq.queue, cur, list) {
      if (cur->retries < 0)
         dead++;
      if (cur->final)
         final++;
      cnt++;
   }
   AST_LIST_UNLOCK(&iaxq.queue);

   ast_cli(fd, "    IAX Statistics\n");
   ast_cli(fd, "---------------------\n");
   ast_cli(fd, "Outstanding frames: %d (%d ingress, %d egress)\n", iax_get_frames(), iax_get_iframes(), iax_get_oframes());
   ast_cli(fd, "Packets in transmit queue: %d dead, %d final, %d total\n\n", dead, final, cnt);
   
   return RESULT_SUCCESS;
}

static int iax2_show_cache(int fd, int argc, char *argv[])
{
   struct iax2_dpcache *dp;
   char tmp[1024], *pc;
   int s;
   int x,y;
   struct timeval tv;
   gettimeofday(&tv, NULL);
   ast_mutex_lock(&dpcache_lock);
   dp = dpcache;
   ast_cli(fd, "%-20.20s %-12.12s %-9.9s %-8.8s %s\n", "Peer/Context", "Exten", "Exp.", "Wait.", "Flags");
   while(dp) {
      s = dp->expiry.tv_sec - tv.tv_sec;
      tmp[0] = '\0';
      if (dp->flags & CACHE_FLAG_EXISTS)
         strncat(tmp, "EXISTS|", sizeof(tmp) - strlen(tmp) - 1);
      if (dp->flags & CACHE_FLAG_NONEXISTENT)
         strncat(tmp, "NONEXISTENT|", sizeof(tmp) - strlen(tmp) - 1);
      if (dp->flags & CACHE_FLAG_CANEXIST)
         strncat(tmp, "CANEXIST|", sizeof(tmp) - strlen(tmp) - 1);
      if (dp->flags & CACHE_FLAG_PENDING)
         strncat(tmp, "PENDING|", sizeof(tmp) - strlen(tmp) - 1);
      if (dp->flags & CACHE_FLAG_TIMEOUT)
         strncat(tmp, "TIMEOUT|", sizeof(tmp) - strlen(tmp) - 1);
      if (dp->flags & CACHE_FLAG_TRANSMITTED)
         strncat(tmp, "TRANSMITTED|", sizeof(tmp) - strlen(tmp) - 1);
      if (dp->flags & CACHE_FLAG_MATCHMORE)
         strncat(tmp, "MATCHMORE|", sizeof(tmp) - strlen(tmp) - 1);
      if (dp->flags & CACHE_FLAG_UNKNOWN)
         strncat(tmp, "UNKNOWN|", sizeof(tmp) - strlen(tmp) - 1);
      /* Trim trailing pipe */
      if (!ast_strlen_zero(tmp))
         tmp[strlen(tmp) - 1] = '\0';
      else
         ast_copy_string(tmp, "(none)", sizeof(tmp));
      y=0;
      pc = strchr(dp->peercontext, '@');
      if (!pc)
         pc = dp->peercontext;
      else
         pc++;
      for (x=0;x<sizeof(dp->waiters) / sizeof(dp->waiters[0]); x++)
         if (dp->waiters[x] > -1)
            y++;
      if (s > 0)
         ast_cli(fd, "%-20.20s %-12.12s %-9d %-8d %s\n", pc, dp->exten, s, y, tmp);
      else
         ast_cli(fd, "%-20.20s %-12.12s %-9.9s %-8d %s\n", pc, dp->exten, "(expired)", y, tmp);
      dp = dp->next;
   }
   ast_mutex_unlock(&dpcache_lock);
   return RESULT_SUCCESS;
}

static unsigned int calc_rxstamp(struct chan_iax2_pvt *p, unsigned int offset);

static void unwrap_timestamp(struct iax_frame *fr)
{
   /* Video mini frames only encode the lower 15 bits of the session
    * timestamp, but other frame types (e.g. audio) encode 16 bits. */
   const int ts_shift = (fr->af.frametype == AST_FRAME_VIDEO) ? 15 : 16;
   const int lower_mask = (1 << ts_shift) - 1;
   const int upper_mask = ~lower_mask;
   const int last_upper = iaxs[fr->callno]->last & upper_mask;

   if ( (fr->ts & upper_mask) == last_upper ) {
      const int x = fr->ts - iaxs[fr->callno]->last;
      const int threshold = (ts_shift == 15) ? 25000 : 50000;

      if (x < -threshold) {
         /* Sudden big jump backwards in timestamp:
            What likely happened here is that miniframe timestamp has circled but we haven't
            gotten the update from the main packet.  We'll just pretend that we did, and
            update the timestamp appropriately. */
         fr->ts = (last_upper + (1 << ts_shift)) | (fr->ts & lower_mask);
         if (option_debug && iaxdebug)
            ast_log(LOG_DEBUG, "schedule_delivery: pushed forward timestamp\n");
      } else if (x > threshold) {
         /* Sudden apparent big jump forwards in timestamp:
            What's likely happened is this is an old miniframe belonging to the previous
            top 15 or 16-bit timestamp that has turned up out of order.
            Adjust the timestamp appropriately. */
         fr->ts = (last_upper - (1 << ts_shift)) | (fr->ts & lower_mask);
         if (option_debug && iaxdebug)
            ast_log(LOG_DEBUG, "schedule_delivery: pushed back timestamp\n");
      }
   }
}

static int get_from_jb(const void *p);

static void update_jbsched(struct chan_iax2_pvt *pvt)
{
   int when;
   
   when = ast_tvdiff_ms(ast_tvnow(), pvt->rxcore);
   
   when = jb_next(pvt->jb) - when;

   AST_SCHED_DEL(sched, pvt->jbid);

   if(when <= 0) {
      /* XXX should really just empty until when > 0.. */
      when = 1;
   }
   
   pvt->jbid = iax2_sched_add(sched, when, get_from_jb, CALLNO_TO_PTR(pvt->callno));
}

static void __get_from_jb(const void *p) 
{
   int callno = PTR_TO_CALLNO(p);
   struct chan_iax2_pvt *pvt = NULL;
   struct iax_frame *fr;
   jb_frame frame;
   int ret;
   long now;
   long next;
   struct timeval tv;
   
   /* Make sure we have a valid private structure before going on */
   ast_mutex_lock(&iaxsl[callno]);
   pvt = iaxs[callno];
   if (!pvt) {
      /* No go! */
      ast_mutex_unlock(&iaxsl[callno]);
      return;
   }

   pvt->jbid = -1;
   
   gettimeofday(&tv,NULL);
   /* round up a millisecond since ast_sched_runq does; */
   /* prevents us from spinning while waiting for our now */
   /* to catch up with runq's now */
   tv.tv_usec += 1000;
   
   now = ast_tvdiff_ms(tv, pvt->rxcore);
   
   if(now >= (next = jb_next(pvt->jb))) {
      ret = jb_get(pvt->jb,&frame,now,ast_codec_interp_len(pvt->voiceformat));
      switch(ret) {
      case JB_OK:
         fr = frame.data;
         __do_deliver(fr);
         /* __do_deliver() can cause the call to disappear */
         pvt = iaxs[callno];
         break;
      case JB_INTERP:
      {
         struct ast_frame af = { 0, };
         
         /* create an interpolation frame */
         af.frametype = AST_FRAME_VOICE;
         af.subclass = pvt->voiceformat;
         af.samples  = frame.ms * (ast_format_rate(pvt->voiceformat) / 1000);
         af.src  = "IAX2 JB interpolation";
         af.delivery = ast_tvadd(pvt->rxcore, ast_samp2tv(next, 1000));
         af.offset = AST_FRIENDLY_OFFSET;
         
         /* queue the frame:  For consistency, we would call __do_deliver here, but __do_deliver wants an iax_frame,
          * which we'd need to malloc, and then it would free it.  That seems like a drag */
         if (!ast_test_flag(iaxs[callno], IAX_ALREADYGONE)) {
            iax2_queue_frame(callno, &af);
            /* iax2_queue_frame() could cause the call to disappear */
            pvt = iaxs[callno];
         }
      }
         break;
      case JB_DROP:
         iax2_frame_free(frame.data);
         break;
      case JB_NOFRAME:
      case JB_EMPTY:
         /* do nothing */
         break;
      default:
         /* shouldn't happen */
         break;
      }
   }
   if (pvt)
      update_jbsched(pvt);
   ast_mutex_unlock(&iaxsl[callno]);
}

static int get_from_jb(const void *data)
{
#ifdef SCHED_MULTITHREADED
   if (schedule_action(__get_from_jb, data))
#endif      
      __get_from_jb(data);
   return 0;
}

/*!
 * \note This function assumes fr->callno is locked
 *
 * \note IMPORTANT NOTE!!! Any time this function is used, even if iaxs[callno]
 * was valid before calling it, it may no longer be valid after calling it.
 */
static int schedule_delivery(struct iax_frame *fr, int updatehistory, int fromtrunk, unsigned int *tsout)
{
   int type, len;
   int ret;
   int needfree = 0;
   struct ast_channel *owner = NULL;
   struct ast_channel *bridge = NULL;
   
   /* Attempt to recover wrapped timestamps */
   unwrap_timestamp(fr);

   /* delivery time is sender's sent timestamp converted back into absolute time according to our clock */
   if ( !fromtrunk && !ast_tvzero(iaxs[fr->callno]->rxcore))
      fr->af.delivery = ast_tvadd(iaxs[fr->callno]->rxcore, ast_samp2tv(fr->ts, 1000));
   else {
#if 0
      if (option_debug)
         ast_log(LOG_DEBUG, "schedule_delivery: set delivery to 0 as we don't have an rxcore yet, or frame is from trunk.\n");
#endif
      fr->af.delivery = ast_tv(0,0);
   }

   type = JB_TYPE_CONTROL;
   len = 0;

   if(fr->af.frametype == AST_FRAME_VOICE) {
      type = JB_TYPE_VOICE;
      len = ast_codec_get_samples(&fr->af) / (ast_format_rate(fr->af.subclass) / 1000);
   } else if(fr->af.frametype == AST_FRAME_CNG) {
      type = JB_TYPE_SILENCE;
   }

   if ( (!ast_test_flag(iaxs[fr->callno], IAX_USEJITTERBUF)) ) {
      if (tsout)
         *tsout = fr->ts;
      __do_deliver(fr);
      return -1;
   }

   iax2_lock_owner(fr->callno);
   if (!iaxs[fr->callno]) {
      /* The call dissappeared so discard this frame that we could not send. */
      iax2_frame_free(fr);
      return -1;
   }
   if ((owner = iaxs[fr->callno]->owner))
      bridge = ast_bridged_channel(owner);

   /* if the user hasn't requested we force the use of the jitterbuffer, and we're bridged to
    * a channel that can accept jitter, then flush and suspend the jb, and send this frame straight through */
   if ( (!ast_test_flag(iaxs[fr->callno], IAX_FORCEJITTERBUF)) && owner && bridge && (bridge->tech->properties & AST_CHAN_TP_WANTSJITTER) ) {
      jb_frame frame;

      ast_mutex_unlock(&owner->lock);

      /* deliver any frames in the jb */
      while (jb_getall(iaxs[fr->callno]->jb, &frame) == JB_OK) {
         __do_deliver(frame.data);
         /* __do_deliver() can make the call disappear */
         if (!iaxs[fr->callno])
            return -1;
      }

      jb_reset(iaxs[fr->callno]->jb);

      AST_SCHED_DEL(sched, iaxs[fr->callno]->jbid);

      /* deliver this frame now */
      if (tsout)
         *tsout = fr->ts;
      __do_deliver(fr);
      return -1;
   }
   if (owner) {
      ast_mutex_unlock(&owner->lock);
   }

   /* insert into jitterbuffer */
   /* TODO: Perhaps we could act immediately if it's not droppable and late */
   ret = jb_put(iaxs[fr->callno]->jb, fr, type, len, fr->ts,
         calc_rxstamp(iaxs[fr->callno],fr->ts));
   if (ret == JB_DROP) {
      needfree++;
   } else if (ret == JB_SCHED) {
      update_jbsched(iaxs[fr->callno]);
   }
   if (tsout)
      *tsout = fr->ts;
   if (needfree) {
      /* Free our iax frame */
      iax2_frame_free(fr);
      return -1;
   }
   return 0;
}

static int iax2_transmit(struct iax_frame *fr)
{
   /* Lock the queue and place this packet at the end */
   /* By setting this to 0, the network thread will send it for us, and
      queue retransmission if necessary */
   fr->sentyet = 0;
   AST_LIST_LOCK(&iaxq.queue);
   AST_LIST_INSERT_TAIL(&iaxq.queue, fr, list);
   iaxq.count++;
   AST_LIST_UNLOCK(&iaxq.queue);
   /* Wake up the network and scheduler thread */
   if (netthreadid != AST_PTHREADT_NULL)
      pthread_kill(netthreadid, SIGURG);
   signal_condition(&sched_lock, &sched_cond);
   return 0;
}



static int iax2_digit_begin(struct ast_channel *c, char digit)
{
   return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_DTMF_BEGIN, digit, 0, NULL, 0, -1);
}

static int iax2_digit_end(struct ast_channel *c, char digit, unsigned int duration)
{
   return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_DTMF_END, digit, 0, NULL, 0, -1);
}

static int iax2_sendtext(struct ast_channel *c, const char *text)
{
   
   return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_TEXT,
      0, 0, (unsigned char *)text, strlen(text) + 1, -1);
}

static int iax2_sendimage(struct ast_channel *c, struct ast_frame *img)
{
   return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_IMAGE, img->subclass, 0, img->data, img->datalen, -1);
}

static int iax2_sendhtml(struct ast_channel *c, int subclass, const char *data, int datalen)
{
   return send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_HTML, subclass, 0, (unsigned char *)data, datalen, -1);
}

static int iax2_fixup(struct ast_channel *oldchannel, struct ast_channel *newchan)
{
   unsigned short callno = PTR_TO_CALLNO(newchan->tech_pvt);
   ast_mutex_lock(&iaxsl[callno]);
   if (iaxs[callno])
      iaxs[callno]->owner = newchan;
   else
      ast_log(LOG_WARNING, "Uh, this isn't a good sign...\n");
   ast_mutex_unlock(&iaxsl[callno]);
   return 0;
}

/*!
 * \note This function calls reg_source_db -> iax2_poke_peer -> find_callno,
 *       so do not call this with a pvt lock held.
 */
static struct iax2_peer *realtime_peer(const char *peername, struct sockaddr_in *sin)
{
   struct ast_variable *var = NULL;
   struct ast_variable *tmp;
   struct iax2_peer *peer=NULL;
   time_t regseconds = 0, nowtime;
   int dynamic=0;

   if (peername) {
      var = ast_load_realtime("iaxpeers", "name", peername, "host", "dynamic", NULL);
      if (!var && sin)
         var = ast_load_realtime("iaxpeers", "name", peername, "host", ast_inet_ntoa(sin->sin_addr), NULL);
   } else if (sin) {
      char porta[25];
      sprintf(porta, "%d", ntohs(sin->sin_port));
      var = ast_load_realtime("iaxpeers", "ipaddr", ast_inet_ntoa(sin->sin_addr), "port", porta, NULL);
      if (var) {
         /* We'll need the peer name in order to build the structure! */
         for (tmp = var; tmp; tmp = tmp->next) {
            if (!strcasecmp(tmp->name, "name"))
               peername = tmp->value;
         }
      }
   }
   if (!var && peername) { /* Last ditch effort */
      var = ast_load_realtime("iaxpeers", "name", peername, NULL);
      /*!\note
       * If this one loaded something, then we need to ensure that the host
       * field matched.  The only reason why we can't have this as a criteria
       * is because we only have the IP address and the host field might be
       * set as a name (and the reverse PTR might not match).
       */
      if (var && sin) {
         for (tmp = var; tmp; tmp = tmp->next) {
            if (!strcasecmp(tmp->name, "host")) {
               struct ast_hostent ahp;
               struct hostent *hp;
               if (!(hp = ast_gethostbyname(tmp->value, &ahp)) || (memcmp(hp->h_addr, &sin->sin_addr, sizeof(hp->h_addr)))) {
                  /* No match */
                  ast_variables_destroy(var);
                  var = NULL;
               }
               break;
            }
         }
      }
   }
   if (!var)
      return NULL;

   peer = build_peer(peername, var, NULL, ast_test_flag((&globalflags), IAX_RTCACHEFRIENDS) ? 0 : 1);
   
   if (!peer) {
      ast_variables_destroy(var);
      return NULL;
   }

   for (tmp = var; tmp; tmp = tmp->next) {
      /* Make sure it's not a user only... */
      if (!strcasecmp(tmp->name, "type")) {
         if (strcasecmp(tmp->value, "friend") &&
             strcasecmp(tmp->value, "peer")) {
            /* Whoops, we weren't supposed to exist! */
            peer = peer_unref(peer);
            break;
         } 
      } else if (!strcasecmp(tmp->name, "regseconds")) {
         ast_get_time_t(tmp->value, &regseconds, 0, NULL);
      } else if (!strcasecmp(tmp->name, "ipaddr")) {
         inet_aton(tmp->value, &(peer->addr.sin_addr));
      } else if (!strcasecmp(tmp->name, "port")) {
         peer->addr.sin_port = htons(atoi(tmp->value));
      } else if (!strcasecmp(tmp->name, "host")) {
         if (!strcasecmp(tmp->value, "dynamic"))
            dynamic = 1;
      }
   }

   ast_variables_destroy(var);

   if (!peer)
      return NULL;

   if (ast_test_flag((&globalflags), IAX_RTCACHEFRIENDS)) {
      ast_copy_flags(peer, &globalflags, IAX_RTAUTOCLEAR|IAX_RTCACHEFRIENDS);
      if (ast_test_flag(peer, IAX_RTAUTOCLEAR)) {
         if (peer->expire > -1) {
            if (!ast_sched_del(sched, peer->expire)) {
               peer->expire = -1;
               peer_unref(peer);
            }
         }
         peer->expire = iax2_sched_add(sched, (global_rtautoclear) * 1000, expire_registry, peer_ref(peer));
         if (peer->expire == -1)
            peer_unref(peer);
      }
      ao2_link(peers, peer);
      if (ast_test_flag(peer, IAX_DYNAMIC))
         reg_source_db(peer);
   } else {
      ast_set_flag(peer, IAX_TEMPONLY);   
   }

   if (!ast_test_flag(&globalflags, IAX_RTIGNOREREGEXPIRE) && dynamic) {
      time(&nowtime);
      if ((nowtime - regseconds) > IAX_DEFAULT_REG_EXPIRE) {
         memset(&peer->addr, 0, sizeof(peer->addr));
         realtime_update_peer(peer->name, &peer->addr, 0);
         if (option_debug)
            ast_log(LOG_DEBUG, "realtime_peer: Bah, '%s' is expired (%d/%d/%d)!\n",
                  peername, (int)(nowtime - regseconds), (int)regseconds, (int)nowtime);
      }
      else {
         if (option_debug)
            ast_log(LOG_DEBUG, "realtime_peer: Registration for '%s' still active (%d/%d/%d)!\n",
                  peername, (int)(nowtime - regseconds), (int)regseconds, (int)nowtime);
      }
   }

   return peer;
}

static struct iax2_user *realtime_user(const char *username, struct sockaddr_in *sin)
{
   struct ast_variable *var;
   struct ast_variable *tmp;
   struct iax2_user *user=NULL;

   var = ast_load_realtime("iaxusers", "name", username, "host", "dynamic", NULL);
   if (!var)
      var = ast_load_realtime("iaxusers", "name", username, "host", ast_inet_ntoa(sin->sin_addr), NULL);
   if (!var && sin) {
      char porta[6];
      snprintf(porta, sizeof(porta), "%d", ntohs(sin->sin_port));
      var = ast_load_realtime("iaxusers", "name", username, "ipaddr", ast_inet_ntoa(sin->sin_addr), "port", porta, NULL);
      if (!var)
         var = ast_load_realtime("iaxusers", "ipaddr", ast_inet_ntoa(sin->sin_addr), "port", porta, NULL);
   }
   if (!var) { /* Last ditch effort */
      var = ast_load_realtime("iaxusers", "name", username, NULL);
      /*!\note
       * If this one loaded something, then we need to ensure that the host
       * field matched.  The only reason why we can't have this as a criteria
       * is because we only have the IP address and the host field might be
       * set as a name (and the reverse PTR might not match).
       */
      if (var) {
         for (tmp = var; tmp; tmp = tmp->next) {
            if (!strcasecmp(tmp->name, "host")) {
               struct ast_hostent ahp;
               struct hostent *hp;
               if (!(hp = ast_gethostbyname(tmp->value, &ahp)) || (memcmp(hp->h_addr, &sin->sin_addr, sizeof(hp->h_addr)))) {
                  /* No match */
                  ast_variables_destroy(var);
                  var = NULL;
               }
               break;
            }
         }
      }
   }
   if (!var)
      return NULL;

   tmp = var;
   while(tmp) {
      /* Make sure it's not a peer only... */
      if (!strcasecmp(tmp->name, "type")) {
         if (strcasecmp(tmp->value, "friend") &&
             strcasecmp(tmp->value, "user")) {
            return NULL;
         } 
      }
      tmp = tmp->next;
   }

   user = build_user(username, var, NULL, !ast_test_flag((&globalflags), IAX_RTCACHEFRIENDS));

   ast_variables_destroy(var);

   if (!user)
      return NULL;

   if (ast_test_flag((&globalflags), IAX_RTCACHEFRIENDS)) {
      ast_set_flag(user, IAX_RTCACHEFRIENDS);
      ao2_link(users, user);
   } else {
      ast_set_flag(user, IAX_TEMPONLY);   
   }

   return user;
}

static void realtime_update_peer(const char *peername, struct sockaddr_in *sin, time_t regtime)
{
   char port[10];
   char regseconds[20];
   
   snprintf(regseconds, sizeof(regseconds), "%d", (int)regtime);
   snprintf(port, sizeof(port), "%d", ntohs(sin->sin_port));
   ast_update_realtime("iaxpeers", "name", peername, 
      "ipaddr", ast_inet_ntoa(sin->sin_addr), "port", port, 
      "regseconds", regseconds, NULL);
}

struct create_addr_info {
   int capability;
   unsigned int flags;
   int maxtime;
   int encmethods;
   int found;
   int sockfd;
   int adsi;
   char username[80];
   char secret[80];
   char outkey[80];
   char timezone[80];
   char prefs[32];
   char context[AST_MAX_CONTEXT];
   char peercontext[AST_MAX_CONTEXT];
   char mohinterpret[MAX_MUSICCLASS];
   char mohsuggest[MAX_MUSICCLASS];
};

static int create_addr(const char *peername, struct ast_channel *c, struct sockaddr_in *sin, struct create_addr_info *cai)
{
   struct ast_hostent ahp;
   struct hostent *hp;
   struct iax2_peer *peer;
   int res = -1;
   struct ast_codec_pref ourprefs;

   ast_clear_flag(cai, IAX_SENDANI | IAX_TRUNK);
   cai->sockfd = defaultsockfd;
   cai->maxtime = 0;
   sin->sin_family = AF_INET;

   if (!(peer = find_peer(peername, 1))) {
      cai->found = 0;

      hp = ast_gethostbyname(peername, &ahp);
      if (hp) {
         memcpy(&sin->sin_addr, hp->h_addr, sizeof(sin->sin_addr));
         sin->sin_port = htons(IAX_DEFAULT_PORTNO);
         /* use global iax prefs for unknown peer/user */
         /* But move the calling channel's native codec to the top of the preference list */
         memcpy(&ourprefs, &prefs, sizeof(ourprefs));
         if (c)
            ast_codec_pref_prepend(&ourprefs, c->nativeformats, 1);
         ast_codec_pref_convert(&ourprefs, cai->prefs, sizeof(cai->prefs), 1);
         return 0;
      } else {
         ast_log(LOG_WARNING, "No such host: %s\n", peername);
         return -1;
      }
   }

   cai->found = 1;
   
   /* if the peer has no address (current or default), return failure */
   if (!(peer->addr.sin_addr.s_addr || peer->defaddr.sin_addr.s_addr))
      goto return_unref;

   /* if the peer is being monitored and is currently unreachable, return failure */
   if (peer->maxms && ((peer->lastms > peer->maxms) || (peer->lastms < 0)))
      goto return_unref;

   ast_copy_flags(cai, peer, IAX_SENDANI | IAX_TRUNK | IAX_NOTRANSFER | IAX_TRANSFERMEDIA | IAX_USEJITTERBUF | IAX_FORCEJITTERBUF);
   cai->maxtime = peer->maxms;
   cai->capability = peer->capability;
   cai->encmethods = peer->encmethods;
   cai->sockfd = peer->sockfd;
   cai->adsi = peer->adsi;
   memcpy(&ourprefs, &peer->prefs, sizeof(ourprefs));
   /* Move the calling channel's native codec to the top of the preference list */
   if (c) {
      ast_log(LOG_DEBUG, "prepending %x to prefs\n", c->nativeformats);
      ast_codec_pref_prepend(&ourprefs, c->nativeformats, 1);
   }
   ast_codec_pref_convert(&ourprefs, cai->prefs, sizeof(cai->prefs), 1);
   ast_copy_string(cai->context, peer->context, sizeof(cai->context));
   ast_copy_string(cai->peercontext, peer->peercontext, sizeof(cai->peercontext));
   ast_copy_string(cai->username, peer->username, sizeof(cai->username));
   ast_copy_string(cai->timezone, peer->zonetag, sizeof(cai->timezone));
   ast_copy_string(cai->outkey, peer->outkey, sizeof(cai->outkey));
   ast_copy_string(cai->mohinterpret, peer->mohinterpret, sizeof(cai->mohinterpret));
   ast_copy_string(cai->mohsuggest, peer->mohsuggest, sizeof(cai->mohsuggest));
   if (ast_strlen_zero(peer->dbsecret)) {
      ast_copy_string(cai->secret, peer->secret, sizeof(cai->secret));
   } else {
      char *family;
      char *key = NULL;

      family = ast_strdupa(peer->dbsecret);
      key = strchr(family, '/');
      if (key)
         *key++ = '\0';
      if (!key || ast_db_get(family, key, cai->secret, sizeof(cai->secret))) {
         ast_log(LOG_WARNING, "Unable to retrieve database password for family/key '%s'!\n", peer->dbsecret);
         goto return_unref;
      }
   }

   if (peer->addr.sin_addr.s_addr) {
      sin->sin_addr = peer->addr.sin_addr;
      sin->sin_port = peer->addr.sin_port;
   } else {
      sin->sin_addr = peer->defaddr.sin_addr;
      sin->sin_port = peer->defaddr.sin_port;
   }

   res = 0;

return_unref:
   peer_unref(peer);

   return res;
}

static void __auto_congest(const void *nothing)
{
   int callno = PTR_TO_CALLNO(nothing);
   struct ast_frame f = { AST_FRAME_CONTROL, AST_CONTROL_CONGESTION };
   ast_mutex_lock(&iaxsl[callno]);
   if (iaxs[callno]) {
      iaxs[callno]->initid = -1;
      iax2_queue_frame(callno, &f);
      ast_log(LOG_NOTICE, "Auto-congesting call due to slow response\n");
   }
   ast_mutex_unlock(&iaxsl[callno]);
}

static int auto_congest(const void *data)
{
#ifdef SCHED_MULTITHREADED
   if (schedule_action(__auto_congest, data))
#endif      
      __auto_congest(data);
   return 0;
}

static unsigned int iax2_datetime(const char *tz)
{
   time_t t;
   struct tm tm;
   unsigned int tmp;
   time(&t);
   if (!ast_strlen_zero(tz))
      ast_localtime(&t, &tm, tz);
   else
      ast_localtime(&t, &tm, NULL);
   tmp  = (tm.tm_sec >> 1) & 0x1f;        /* 5 bits of seconds */
   tmp |= (tm.tm_min & 0x3f) << 5;        /* 6 bits of minutes */
   tmp |= (tm.tm_hour & 0x1f) << 11;      /* 5 bits of hours */
   tmp |= (tm.tm_mday & 0x1f) << 16;      /* 5 bits of day of month */
   tmp |= ((tm.tm_mon + 1) & 0xf) << 21;     /* 4 bits of month */
   tmp |= ((tm.tm_year - 100) & 0x7f) << 25; /* 7 bits of year */
   return tmp;
}

struct parsed_dial_string {
   char *username;
   char *password;
   char *key;
   char *peer;
   char *port;
   char *exten;
   char *context;
   char *options;
};

static int send_apathetic_reply(unsigned short callno, unsigned short dcallno,
      struct sockaddr_in *sin, int command, int ts, unsigned char seqno,
      int sockfd, struct iax_ie_data *ied)
{
   struct {
      struct ast_iax2_full_hdr f;
      struct iax_ie_data ied;
   } data;
   size_t size = sizeof(struct ast_iax2_full_hdr);

   if (ied) {
      size += ied->pos;
      memcpy(&data.ied, ied->buf, ied->pos);
   }

   data.f.scallno = htons(0x8000 | callno);
   data.f.dcallno = htons(dcallno);
   data.f.ts = htonl(ts);
   data.f.iseqno = seqno;
   data.f.oseqno = 0;
   data.f.type = AST_FRAME_IAX;
   data.f.csub = compress_subclass(command);

   return sendto(sockfd, &data, size, 0, (struct sockaddr *)sin, sizeof(*sin));
}

static void add_empty_calltoken_ie(struct chan_iax2_pvt *pvt, struct iax_ie_data *ied)
{
   /* first make sure their are two empty bytes left in ied->buf */
   if (pvt && ied && (2 < ((int) sizeof(ied->buf) - ied->pos))) {
      ied->buf[ied->pos++] = IAX_IE_CALLTOKEN;  /* type */
      ied->buf[ied->pos++] = 0;   /* data size,  ZERO in this case */
      pvt->calltoken_ie_len = 2;
   }
}

static void resend_with_token(int callno, struct iax_frame *f, const char *newtoken)
{
   struct chan_iax2_pvt *pvt = iaxs[callno];
   int frametype = f->af.frametype;
   int subclass = f->af.subclass;
   struct {
      struct ast_iax2_full_hdr fh;
      struct iax_ie_data ied;
   } data = {
      .ied.buf = { 0 },
      .ied.pos = 0,
   };
   /* total len - header len gives us the frame's IE len */
   int ie_data_pos = f->datalen - sizeof(struct ast_iax2_full_hdr);

   if (!pvt) {
      return;  /* this should not be possible if called from socket_process() */
   }

   /* 
    * Check to make sure last frame sent is valid for call token resend
    * 1. Frame should _NOT_ be encrypted since it starts the IAX dialog 
    * 2. Frame should _NOT_ already have a destination callno
    * 3. Frame must be a valid iax_frame subclass capable of starting dialog
    * 4. Pvt must have a calltoken_ie_len which represents the number of
    *    bytes at the end of the frame used for the previous calltoken ie.
    * 5. Pvt's calltoken_ie_len must be _LESS_ than the total IE length
    * 6. Total length of f->data must be _LESS_ than size of our data struct
    *    because f->data must be able to fit within data. 
    */
   if (f->encmethods || f->dcallno || !iax2_allow_new(frametype, subclass, 0)
      || !pvt->calltoken_ie_len || (pvt->calltoken_ie_len > ie_data_pos) ||
      (f->datalen > sizeof(data))) {

      return;  /* ignore resend, token was not valid for the dialog */
   }

   /* token is valid
    * 1. Copy frame data over
    * 2. Redo calltoken IE, it will always be the last ie in the frame.
    *    NOTE: Having the ie always be last is not protocol specified,
    *    it is only an implementation choice.  Since we only expect the ie to
    *    be last for frames we have sent, this can no way be affected by
    *    another end point.
    * 3. Remove frame from queue
    * 4. Free old frame
    * 5. Clear previous seqnos
    * 6. Resend with CALLTOKEN ie.
    */

   /* ---1.--- */
   memcpy(&data, f->data, f->datalen);
   data.ied.pos = ie_data_pos;

   /* ---2.--- */
   /* move to the beginning of the calltoken ie so we can write over it */
   data.ied.pos -= pvt->calltoken_ie_len;
   iax_ie_append_str(&data.ied, IAX_IE_CALLTOKEN, newtoken);

   /* make sure to update token length incase it ever has to be stripped off again */
   pvt->calltoken_ie_len = data.ied.pos - ie_data_pos; /* new pos minus old pos tells how big token ie is */

   /* ---3.--- */
   AST_LIST_LOCK(&iaxq.queue);
   AST_LIST_REMOVE(&iaxq.queue, f, list);
   AST_LIST_UNLOCK(&iaxq.queue);

   /* ---4.--- */
   iax2_frame_free(f);

   /* ---5.--- */
   pvt->oseqno = 0;
   pvt->rseqno = 0;
   pvt->iseqno = 0;
   pvt->aseqno = 0;
   if (pvt->peercallno) {
      remove_by_peercallno(pvt);
      pvt->peercallno = 0;
   }

   /* ---6.--- */
   send_command(pvt, AST_FRAME_IAX, subclass, 0, data.ied.buf, data.ied.pos, -1);
}

static void requirecalltoken_mark_auto(const char *name, int subclass)
{
   struct iax2_user *user = NULL;
   struct iax2_peer *peer = NULL;

   if (ast_strlen_zero(name)) {
      return; /* no username given */
   }

   if ((subclass == IAX_COMMAND_NEW) && (user = find_user(name)) && (user->calltoken_required == CALLTOKEN_AUTO)) {
      user->calltoken_required = CALLTOKEN_YES;
   } else if ((subclass != IAX_COMMAND_NEW) && (peer = find_peer(name, 1)) && (peer->calltoken_required == CALLTOKEN_AUTO)) {
      peer->calltoken_required = CALLTOKEN_YES;
   }

   if (peer) {
      peer_unref(peer);
   }
   if (user) {
      user_unref(user);
   }
}

/*!
 * \internal
 *
 * \brief handles calltoken logic for a received iax_frame.
 * 
 * \note frametype must be AST_FRAME_IAX.
 * 
 * \note
 * Three different cases are possible here.
 * Case 1. An empty calltoken is provided. This means the client supports
 *         calltokens but has not yet received one from us.  In this case
 *         a full calltoken IE is created and sent in a calltoken fullframe.
 * Case 2. A full calltoken is received and must be checked for validity.
 * Case 3. No calltoken is received indicating that the client does not
 *         support calltokens.  In this case it is up to the configuration
 *         to decide how this should be handled (reject or permit without calltoken)
 */
static int handle_call_token(struct ast_iax2_full_hdr *fh, struct iax_ies *ies,
      struct sockaddr_in *sin, int fd)
{
#define CALLTOKEN_HASH_FORMAT "%s%d%u%d"  /* address + port + ts + randomcalldata */
#define CALLTOKEN_IE_FORMAT   "%u?%s"     /* time + ? + (40 char hash) */
   char buf[256] = { 0 };
   time_t t = time(NULL);
   char hash[41]; /* 40 char sha1 hash */
   int subclass = uncompress_subclass(fh->csub);

   /* ----- Case 1 ----- */
   if (ies->calltoken && !ies->calltokendata) {  /* empty calltoken is provided, client supports calltokens */
      struct iax_ie_data ied = {
         .buf = { 0 },
         .pos = 0,
      };

      /* create the hash with their address data and our timestamp */
      snprintf(buf, sizeof(buf), CALLTOKEN_HASH_FORMAT, ast_inet_ntoa(sin->sin_addr), sin->sin_port, (unsigned int) t, randomcalltokendata);
      ast_sha1_hash(hash, buf);

      snprintf(buf, sizeof(buf), CALLTOKEN_IE_FORMAT, (unsigned int) t, hash);
      iax_ie_append_str(&ied, IAX_IE_CALLTOKEN, buf);
      send_apathetic_reply(1, ntohs(fh->scallno), sin, IAX_COMMAND_CALLTOKEN, ntohl(fh->ts), fh->iseqno + 1, fd, &ied);

      return 1;

   /* ----- Case 2 ----- */
   } else if (ies->calltoken && ies->calltokendata) { /* calltoken received, check to see if it is valid */
      char *rec_hash = NULL;    /* the received hash, make sure it matches with ours. */
      char *rec_ts = NULL;      /* received timestamp */
      unsigned int rec_time;  /* received time_t */

      /* split the timestamp from the hash data */
      rec_hash = strchr((char *) ies->calltokendata, '?');
      if (rec_hash) {
         *rec_hash++ = '\0';
         rec_ts = (char *) ies->calltokendata;
      }

      /* check that we have valid data before we do any comparisons */
      if (!rec_hash || !rec_ts) {
         goto reject;
      } else if (sscanf(rec_ts, "%u", &rec_time) != 1) {
         goto reject;
      }

      /* create a hash with their address and the _TOKEN'S_ timestamp */
      snprintf(buf, sizeof(buf), CALLTOKEN_HASH_FORMAT, ast_inet_ntoa(sin->sin_addr), sin->sin_port, (unsigned int) rec_time, randomcalltokendata);
      ast_sha1_hash(hash, buf);

      /* compare hashes and then check timestamp delay */
      if (strcmp(hash, rec_hash)) {
         ast_log(LOG_WARNING, "Address %s failed CallToken hash inspection\n", ast_inet_ntoa(sin->sin_addr));
         goto reject; /* received hash does not match ours, reject */
      } else if ((t < rec_time) || ((t - rec_time) >= MAX_CALLTOKEN_DELAY)) {
         ast_log(LOG_WARNING, "Too much delay in IAX2 calltoken timestamp from address %s\n", ast_inet_ntoa(sin->sin_addr));
         goto reject; /* too much delay, reject */
      }

      /* at this point the call token is valid, returning 0 
       * will allow socket_process to continue as usual */
      requirecalltoken_mark_auto(ies->username, subclass);
      return 0;

   /* ----- Case 3 ----- */
   } else { /* calltokens are not supported for this client, how do we respond? */
      if (calltoken_required(sin, ies->username, subclass)) {
         ast_log(LOG_ERROR, "Call rejected, CallToken Support required. If unexpected, resolve by placing address %s in the calltokenoptional list or setting user %s requirecalltoken=no\n", ast_inet_ntoa(sin->sin_addr), S_OR(ies->username, "guest"));
         goto reject;
      }
      return 0; /* calltoken is not required for this addr, so permit it. */
   }

reject:
   /* received frame has failed calltoken inspection, send apathetic reject messages */
   if (subclass == IAX_COMMAND_REGREQ || subclass == IAX_COMMAND_REGREL) {
      send_apathetic_reply(1, ntohs(fh->scallno), sin, IAX_COMMAND_REGREJ, ntohl(fh->ts), fh->iseqno + 1, fd, NULL);
   } else {
      send_apathetic_reply(1, ntohs(fh->scallno), sin, IAX_COMMAND_REJECT, ntohl(fh->ts), fh->iseqno + 1, fd, NULL);
   }

   return 1;
}

/*!
 * \brief Parses an IAX dial string into its component parts.
 * \param data the string to be parsed
 * \param pds pointer to a \c struct \c parsed_dial_string to be filled in
 * \return nothing
 *
 * This function parses the string and fills the structure
 * with pointers to its component parts. The input string
 * will be modified.
 *
 * \note This function supports both plaintext passwords and RSA
 * key names; if the password string is formatted as '[keyname]',
 * then the keyname will be placed into the key field, and the
 * password field will be set to NULL.
 *
 * \note The dial string format is:
 *       [username[:password]@]peer[:port][/exten[@@context]][/options]
 */
static void parse_dial_string(char *data, struct parsed_dial_string *pds)
{
   if (ast_strlen_zero(data))
      return;

   pds->peer = strsep(&data, "/");
   pds->exten = strsep(&data, "/");
   pds->options = data;

   if (pds->exten) {
      data = pds->exten;
      pds->exten = strsep(&data, "@");
      pds->context = data;
   }

   if (strchr(pds->peer, '@')) {
      data = pds->peer;
      pds->username = strsep(&data, "@");
      pds->peer = data;
   }

   if (pds->username) {
      data = pds->username;
      pds->username = strsep(&data, ":");
      pds->password = data;
   }

   data = pds->peer;
   pds->peer = strsep(&data, ":");
   pds->port = data;

   /* check for a key name wrapped in [] in the secret position, if found,
      move it to the key field instead
   */
   if (pds->password && (pds->password[0] == '[')) {
      pds->key = ast_strip_quoted(pds->password, "[", "]");
      pds->password = NULL;
   }
}

static int iax2_call(struct ast_channel *c, char *dest, int timeout)
{
   struct sockaddr_in sin;
   char *l=NULL, *n=NULL, *tmpstr;
   struct iax_ie_data ied;
   char *defaultrdest = "s";
   unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
   struct parsed_dial_string pds;
   struct create_addr_info cai;

   if ((c->_state != AST_STATE_DOWN) && (c->_state != AST_STATE_RESERVED)) {
      ast_log(LOG_WARNING, "Channel is already in use (%s)?\n", c->name);
      return -1;
   }

   memset(&cai, 0, sizeof(cai));
   cai.encmethods = iax2_encryption;

   memset(&pds, 0, sizeof(pds));
   tmpstr = ast_strdupa(dest);
   parse_dial_string(tmpstr, &pds);

   if (ast_strlen_zero(pds.peer)) {
      ast_log(LOG_WARNING, "No peer provided in the IAX2 dial string '%s'\n", dest);
      return -1;
   }

   if (!pds.exten) {
      pds.exten = defaultrdest;
   }

   if (create_addr(pds.peer, c, &sin, &cai)) {
      ast_log(LOG_WARNING, "No address associated with '%s'\n", pds.peer);
      return -1;
   }

   if (!pds.username && !ast_strlen_zero(cai.username))
      pds.username = cai.username;
   if (!pds.password && !ast_strlen_zero(cai.secret))
      pds.password = cai.secret;
   if (!pds.key && !ast_strlen_zero(cai.outkey))
      pds.key = cai.outkey;
   if (!pds.context && !ast_strlen_zero(cai.peercontext))
      pds.context = cai.peercontext;

   /* Keep track of the context for outgoing calls too */
   ast_copy_string(c->context, cai.context, sizeof(c->context));

   if (pds.port)
      sin.sin_port = htons(atoi(pds.port));

   l = c->cid.cid_num;
   n = c->cid.cid_name;

   /* Now build request */ 
   memset(&ied, 0, sizeof(ied));

   /* On new call, first IE MUST be IAX version of caller */
   iax_ie_append_short(&ied, IAX_IE_VERSION, IAX_PROTO_VERSION);
   iax_ie_append_str(&ied, IAX_IE_CALLED_NUMBER, pds.exten);
   if (pds.options && strchr(pds.options, 'a')) {
      /* Request auto answer */
      iax_ie_append(&ied, IAX_IE_AUTOANSWER);
   }

   iax_ie_append_str(&ied, IAX_IE_CODEC_PREFS, cai.prefs);

   if (l) {
      iax_ie_append_str(&ied, IAX_IE_CALLING_NUMBER, l);
      iax_ie_append_byte(&ied, IAX_IE_CALLINGPRES, c->cid.cid_pres);
   } else {
      if (n)
         iax_ie_append_byte(&ied, IAX_IE_CALLINGPRES, c->cid.cid_pres);
      else
         iax_ie_append_byte(&ied, IAX_IE_CALLINGPRES, AST_PRES_NUMBER_NOT_AVAILABLE);
   }

   iax_ie_append_byte(&ied, IAX_IE_CALLINGTON, c->cid.cid_ton);
   iax_ie_append_short(&ied, IAX_IE_CALLINGTNS, c->cid.cid_tns);

   if (n)
      iax_ie_append_str(&ied, IAX_IE_CALLING_NAME, n);
   if (ast_test_flag(iaxs[callno], IAX_SENDANI) && c->cid.cid_ani)
      iax_ie_append_str(&ied, IAX_IE_CALLING_ANI, c->cid.cid_ani);

   if (!ast_strlen_zero(c->language))
      iax_ie_append_str(&ied, IAX_IE_LANGUAGE, c->language);
   if (!ast_strlen_zero(c->cid.cid_dnid))
      iax_ie_append_str(&ied, IAX_IE_DNID, c->cid.cid_dnid);
   if (!ast_strlen_zero(c->cid.cid_rdnis))
      iax_ie_append_str(&ied, IAX_IE_RDNIS, c->cid.cid_rdnis);

   if (pds.context)
      iax_ie_append_str(&ied, IAX_IE_CALLED_CONTEXT, pds.context);

   if (pds.username)
      iax_ie_append_str(&ied, IAX_IE_USERNAME, pds.username);

   if (cai.encmethods)
      iax_ie_append_short(&ied, IAX_IE_ENCRYPTION, cai.encmethods);

   ast_mutex_lock(&iaxsl[callno]);

   if (!ast_strlen_zero(c->context))
      ast_string_field_set(iaxs[callno], context, c->context);

   if (pds.username)
      ast_string_field_set(iaxs[callno], username, pds.username);

   iaxs[callno]->encmethods = cai.encmethods;

   iaxs[callno]->adsi = cai.adsi;
   
   ast_string_field_set(iaxs[callno], mohinterpret, cai.mohinterpret);
   ast_string_field_set(iaxs[callno], mohsuggest, cai.mohsuggest);

   if (pds.key)
      ast_string_field_set(iaxs[callno], outkey, pds.key);
   if (pds.password)
      ast_string_field_set(iaxs[callno], secret, pds.password);

   iax_ie_append_int(&ied, IAX_IE_FORMAT, c->nativeformats);
   iax_ie_append_int(&ied, IAX_IE_CAPABILITY, iaxs[callno]->capability);
   iax_ie_append_short(&ied, IAX_IE_ADSICPE, c->adsicpe);
   iax_ie_append_int(&ied, IAX_IE_DATETIME, iax2_datetime(cai.timezone));

   if (iaxs[callno]->maxtime) {
      /* Initialize pingtime and auto-congest time */
      iaxs[callno]->pingtime = iaxs[callno]->maxtime / 2;
      iaxs[callno]->initid = iax2_sched_add(sched, iaxs[callno]->maxtime * 2, auto_congest, CALLNO_TO_PTR(callno));
   } else if (autokill) {
      iaxs[callno]->pingtime = autokill / 2;
      iaxs[callno]->initid = iax2_sched_add(sched, autokill * 2, auto_congest, CALLNO_TO_PTR(callno));
   }

   /* send the command using the appropriate socket for this peer */
   iaxs[callno]->sockfd = cai.sockfd;

   /* Transmit the string in a "NEW" request */
   add_empty_calltoken_ie(iaxs[callno], &ied); /* this _MUST_ be the last ie added */
   send_command(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_NEW, 0, ied.buf, ied.pos, -1);

   ast_mutex_unlock(&iaxsl[callno]);
   ast_setstate(c, AST_STATE_RINGING);
   
   return 0;
}

static int iax2_hangup(struct ast_channel *c) 
{
   unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
   struct iax_ie_data ied;
   int alreadygone;
   memset(&ied, 0, sizeof(ied));
   ast_mutex_lock(&iaxsl[callno]);
   if (callno && iaxs[callno]) {
      if (option_debug)
         ast_log(LOG_DEBUG, "We're hanging up %s now...\n", c->name);
      alreadygone = ast_test_flag(iaxs[callno], IAX_ALREADYGONE);
      /* Send the hangup unless we have had a transmission error or are already gone */
      iax_ie_append_byte(&ied, IAX_IE_CAUSECODE, (unsigned char)c->hangupcause);
      if (!iaxs[callno]->error && !alreadygone) {
         if (send_command_final(iaxs[callno], AST_FRAME_IAX, IAX_COMMAND_HANGUP, 0, ied.buf, ied.pos, -1)) {
            ast_log(LOG_WARNING, "No final packet could be sent for callno %d\n", callno);
         }
         if (!iaxs[callno]) {
            ast_mutex_unlock(&iaxsl[callno]);
            return 0;
         }
      }
      /* Explicitly predestroy it */
      iax2_predestroy(callno);
      /* If we were already gone to begin with, destroy us now */
      if (iaxs[callno] && alreadygone) {
         if (option_debug)
            ast_log(LOG_DEBUG, "Really destroying %s now...\n", c->name);
         iax2_destroy(callno);
      } else if (iaxs[callno]) {
         iax2_sched_add(sched, 10000, scheduled_destroy, CALLNO_TO_PTR(callno));
      }
   } else if (c->tech_pvt) {
      /* If this call no longer exists, but the channel still
       * references it we need to set the channel's tech_pvt to null
       * to avoid ast_channel_free() trying to free it.
       */
      c->tech_pvt = NULL;
   }
   ast_mutex_unlock(&iaxsl[callno]);
   if (option_verbose > 2) 
      ast_verbose(VERBOSE_PREFIX_3 "Hungup '%s'\n", c->name);
   return 0;
}

/*!
 * \note expects the pvt to be locked
 */
static int wait_for_peercallno(struct chan_iax2_pvt *pvt)
{
   unsigned short callno = pvt->callno;

   if (!pvt->peercallno) {
      /* We don't know the remote side's call number, yet.  :( */
      int count = 10;
      while (count-- && pvt && !pvt->peercallno) {
         DEADLOCK_AVOIDANCE(&iaxsl[callno]);
         pvt = iaxs[callno];
      }
      if (!pvt->peercallno) {
         return -1;
      }
   }

   return 0;
}

static int iax2_setoption(struct ast_channel *c, int option, void *data, int datalen)
{
   struct ast_option_header *h;
   int res;

   switch (option) {
   case AST_OPTION_TXGAIN:
   case AST_OPTION_RXGAIN:
      /* these two cannot be sent, because they require a result */
      errno = ENOSYS;
      return -1;
   /* These options are sent to the other side across the network where
    * they will be passed to whatever channel is bridged there. Don't
    * do anything silly like pass an option that transmits pointers to
    * memory on this machine to a remote machine to use */
   case AST_OPTION_TONE_VERIFY:
   case AST_OPTION_TDD:
   case AST_OPTION_RELAXDTMF:
   case AST_OPTION_AUDIO_MODE:
   {
      unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
      struct chan_iax2_pvt *pvt;

      ast_mutex_lock(&iaxsl[callno]);
      pvt = iaxs[callno];

      if (wait_for_peercallno(pvt)) {
         ast_mutex_unlock(&iaxsl[callno]);
         return -1;
      }

      ast_mutex_unlock(&iaxsl[callno]);

      if (!(h = ast_malloc(datalen + sizeof(*h)))) {
         return -1;
      }

      h->flag = AST_OPTION_FLAG_REQUEST;
      h->option = htons(option);
      memcpy(h->data, data, datalen);
      res = send_command_locked(PTR_TO_CALLNO(c->tech_pvt), AST_FRAME_CONTROL,
                 AST_CONTROL_OPTION, 0, (unsigned char *) h,
                 datalen + sizeof(*h), -1);
      free(h);
      return res;
   }
   default:
      return -1;
   }

   /* Just in case someone does a break instead of a return */
   return -1;
}

static struct ast_frame *iax2_read(struct ast_channel *c) 
{
   ast_log(LOG_NOTICE, "I should never be called!\n");
   return &ast_null_frame;
}

static int iax2_start_transfer(unsigned short callno0, unsigned short callno1, int mediaonly)
{
   int res;
   struct iax_ie_data ied0;
   struct iax_ie_data ied1;
   unsigned int transferid = (unsigned int)ast_random();
   memset(&ied0, 0, sizeof(ied0));
   iax_ie_append_addr(&ied0, IAX_IE_APPARENT_ADDR, &iaxs[callno1]->addr);
   iax_ie_append_short(&ied0, IAX_IE_CALLNO, iaxs[callno1]->peercallno);
   iax_ie_append_int(&ied0, IAX_IE_TRANSFERID, transferid);

   memset(&ied1, 0, sizeof(ied1));
   iax_ie_append_addr(&ied1, IAX_IE_APPARENT_ADDR, &iaxs[callno0]->addr);
   iax_ie_append_short(&ied1, IAX_IE_CALLNO, iaxs[callno0]->peercallno);
   iax_ie_append_int(&ied1, IAX_IE_TRANSFERID, transferid);
   
   res = send_command(iaxs[callno0], AST_FRAME_IAX, IAX_COMMAND_TXREQ, 0, ied0.buf, ied0.pos, -1);
   if (res)
      return -1;
   res = send_command(iaxs[callno1], AST_FRAME_IAX, IAX_COMMAND_TXREQ, 0, ied1.buf, ied1.pos, -1);
   if (res)
      return -1;
   iaxs[callno0]->transferring = mediaonly ? TRANSFER_MBEGIN : TRANSFER_BEGIN;
   iaxs[callno1]->transferring = mediaonly ? TRANSFER_MBEGIN : TRANSFER_BEGIN;
   return 0;
}

static void lock_both(unsigned short callno0, unsigned short callno1)
{
   ast_mutex_lock(&iaxsl[callno0]);
   while (ast_mutex_trylock(&iaxsl[callno1])) {
      DEADLOCK_AVOIDANCE(&iaxsl[callno0]);
   }
}

static void unlock_both(unsigned short callno0, unsigned short callno1)
{
   ast_mutex_unlock(&iaxsl[callno1]);
   ast_mutex_unlock(&iaxsl[callno0]);
}

static enum ast_bridge_result iax2_bridge(struct ast_channel *c0, struct ast_channel *c1, int flags, struct ast_frame **fo, struct ast_channel **rc, int timeoutms)
{
   struct ast_channel *cs[3];
   struct ast_channel *who, *other;
   int to = -1;
   int res = -1;
   int transferstarted=0;
   struct ast_frame *f;
   unsigned short callno0 = PTR_TO_CALLNO(c0->tech_pvt);
   unsigned short callno1 = PTR_TO_CALLNO(c1->tech_pvt);
   struct timeval waittimer = {0, 0}, tv;

   lock_both(callno0, callno1);
   if (!iaxs[callno0] || !iaxs[callno1]) {
      unlock_both(callno0, callno1);
      return AST_BRIDGE_FAILED;
   }
   /* Put them in native bridge mode */
   if (!(flags & (AST_BRIDGE_DTMF_CHANNEL_0 | AST_BRIDGE_DTMF_CHANNEL_1))) {
      iaxs[callno0]->bridgecallno = callno1;
      iaxs[callno1]->bridgecallno = callno0;
   }
   /* If the bridge got retried, don't queue up more packets - the transfer request will be retransmitted as necessary */
   if (iaxs[callno0]->transferring && iaxs[callno1]->transferring) {
      transferstarted = 1;
   }
   unlock_both(callno0, callno1);

   /* If not, try to bridge until we can execute a transfer, if we can */
   cs[0] = c0;
   cs[1] = c1;
   for (/* ever */;;) {
      /* Check in case we got masqueraded into */
      if ((c0->tech != &iax2_tech) || (c1->tech != &iax2_tech)) {
         if (option_verbose > 2)
            ast_verbose(VERBOSE_PREFIX_3 "Can't masquerade, we're different...\n");
         /* Remove from native mode */
         if (c0->tech == &iax2_tech) {
            ast_mutex_lock(&iaxsl[callno0]);
            iaxs[callno0]->bridgecallno = 0;
            ast_mutex_unlock(&iaxsl[callno0]);
         }
         if (c1->tech == &iax2_tech) {
            ast_mutex_lock(&iaxsl[callno1]);
            iaxs[callno1]->bridgecallno = 0;
            ast_mutex_unlock(&iaxsl[callno1]);
         }
         return AST_BRIDGE_FAILED_NOWARN;
      }
      if (c0->nativeformats != c1->nativeformats) {
         if (option_verbose > 2) {
            char buf0[255];
            char buf1[255];
            ast_getformatname_multiple(buf0, sizeof(buf0) -1, c0->nativeformats);
            ast_getformatname_multiple(buf1, sizeof(buf1) -1, c1->nativeformats);
            ast_verbose(VERBOSE_PREFIX_3 "Operating with different codecs %d[%s] %d[%s] , can't native bridge...\n", c0->nativeformats, buf0, c1->nativeformats, buf1);
         }
         /* Remove from native mode */
         lock_both(callno0, callno1);
         if (iaxs[callno0])
            iaxs[callno0]->bridgecallno = 0;
         if (iaxs[callno1])
            iaxs[callno1]->bridgecallno = 0;
         unlock_both(callno0, callno1);
         return AST_BRIDGE_FAILED_NOWARN;
      }
      /* check if transfered and if we really want native bridging */
      if (!transferstarted && !ast_test_flag(iaxs[callno0], IAX_NOTRANSFER) && !ast_test_flag(iaxs[callno1], IAX_NOTRANSFER)) {
         /* Try the transfer */
         if (iax2_start_transfer(callno0, callno1, (flags & (AST_BRIDGE_DTMF_CHANNEL_0 | AST_BRIDGE_DTMF_CHANNEL_1)) ||
                     ast_test_flag(iaxs[callno0], IAX_TRANSFERMEDIA) | ast_test_flag(iaxs[callno1], IAX_TRANSFERMEDIA)))
            ast_log(LOG_WARNING, "Unable to start the transfer\n");
         transferstarted = 1;
      }
      if ((iaxs[callno0]->transferring == TRANSFER_RELEASED) && (iaxs[callno1]->transferring == TRANSFER_RELEASED)) {
         /* Call has been transferred.  We're no longer involved */
         gettimeofday(&tv, NULL);
         if (ast_tvzero(waittimer)) {
            waittimer = tv;
         } else if (tv.tv_sec - waittimer.tv_sec > IAX_LINGER_TIMEOUT) {
            c0->_softhangup |= AST_SOFTHANGUP_DEV;
            c1->_softhangup |= AST_SOFTHANGUP_DEV;
            *fo = NULL;
            *rc = c0;
            res = AST_BRIDGE_COMPLETE;
            break;
         }
      }
      to = 1000;
      who = ast_waitfor_n(cs, 2, &to);
      if (timeoutms > -1) {
         timeoutms -= (1000 - to);
         if (timeoutms < 0)
            timeoutms = 0;
      }
      if (!who) {
         if (!timeoutms) {
            res = AST_BRIDGE_RETRY;
            break;
         }
         if (ast_check_hangup(c0) || ast_check_hangup(c1)) {
            res = AST_BRIDGE_FAILED;
            break;
         }
         continue;
      }
      f = ast_read(who);
      if (!f) {
         *fo = NULL;
         *rc = who;
         res = AST_BRIDGE_COMPLETE;
         break;
      }
      if ((f->frametype == AST_FRAME_CONTROL) && !(flags & AST_BRIDGE_IGNORE_SIGS) && (f->subclass != AST_CONTROL_SRCUPDATE)) {
         *fo = f;
         *rc = who;
         res =  AST_BRIDGE_COMPLETE;
         break;
      }
      other = (who == c0) ? c1 : c0;  /* the 'other' channel */
      if ((f->frametype == AST_FRAME_VOICE) ||
         (f->frametype == AST_FRAME_TEXT) ||
         (f->frametype == AST_FRAME_VIDEO) || 
         (f->frametype == AST_FRAME_IMAGE) ||
         (f->frametype == AST_FRAME_DTMF) ||
         (f->frametype == AST_FRAME_CONTROL)) {
         /* monitored dtmf take out of the bridge.
          * check if we monitor the specific source.
          */
         int monitored_source = (who == c0) ? AST_BRIDGE_DTMF_CHANNEL_0 : AST_BRIDGE_DTMF_CHANNEL_1;
         if (f->frametype == AST_FRAME_DTMF && (flags & monitored_source)) {
            *rc = who;
            *fo = f;
            res = AST_BRIDGE_COMPLETE;
            /* Remove from native mode */
            break;
         }
         /* everything else goes to the other side */
         ast_write(other, f);
      }
      ast_frfree(f);
      /* Swap who gets priority */
      cs[2] = cs[0];
      cs[0] = cs[1];
      cs[1] = cs[2];
   }
   lock_both(callno0, callno1);
   if(iaxs[callno0])
      iaxs[callno0]->bridgecallno = 0;
   if(iaxs[callno1])
      iaxs[callno1]->bridgecallno = 0;
   unlock_both(callno0, callno1);
   return res;
}

static int iax2_answer(struct ast_channel *c)
{
   unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
   if (option_debug)
      ast_log(LOG_DEBUG, "Answering IAX2 call\n");
   return send_command_locked(callno, AST_FRAME_CONTROL, AST_CONTROL_ANSWER, 0, NULL, 0, -1);
}

static int iax2_indicate(struct ast_channel *c, int condition, const void *data, size_t datalen)
{
   unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
   struct chan_iax2_pvt *pvt;
   int res = 0;

   if (option_debug && iaxdebug)
      ast_log(LOG_DEBUG, "Indicating condition %d\n", condition);

   ast_mutex_lock(&iaxsl[callno]);
   pvt = iaxs[callno];

   if (wait_for_peercallno(pvt)) {
      res = -1;
      goto done;
   }

   switch (condition) {
   case AST_CONTROL_HOLD:
      if (strcasecmp(pvt->mohinterpret, "passthrough")) {
         ast_moh_start(c, data, pvt->mohinterpret);
         goto done;
      }
      break;
   case AST_CONTROL_UNHOLD:
      if (strcasecmp(pvt->mohinterpret, "passthrough")) {
         ast_moh_stop(c);
         goto done;
      }
   }

   res = send_command(pvt, AST_FRAME_CONTROL, condition, 0, data, datalen, -1);

done:
   ast_mutex_unlock(&iaxsl[callno]);

   return res;
}
   
static int iax2_transfer(struct ast_channel *c, const char *dest)
{
   unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
   struct iax_ie_data ied;
   char tmp[256], *context;
   ast_copy_string(tmp, dest, sizeof(tmp));
   context = strchr(tmp, '@');
   if (context) {
      *context = '\0';
      context++;
   }
   memset(&ied, 0, sizeof(ied));
   iax_ie_append_str(&ied, IAX_IE_CALLED_NUMBER, tmp);
   if (context)
      iax_ie_append_str(&ied, IAX_IE_CALLED_CONTEXT, context);
   if (option_debug)
      ast_log(LOG_DEBUG, "Transferring '%s' to '%s'\n", c->name, dest);
   return send_command_locked(callno, AST_FRAME_IAX, IAX_COMMAND_TRANSFER, 0, ied.buf, ied.pos, -1);
}
   
static int iax2_getpeertrunk(struct sockaddr_in sin)
{
   struct iax2_peer *peer;
   int res = 0;
   struct ao2_iterator i;

   i = ao2_iterator_init(peers, 0);
   while ((peer = ao2_iterator_next(&i))) {
      if ((peer->addr.sin_addr.s_addr == sin.sin_addr.s_addr) &&
          (peer->addr.sin_port == sin.sin_port)) {
         res = ast_test_flag(peer, IAX_TRUNK);
         peer_unref(peer);
         break;
      }
      peer_unref(peer);
   }
   ao2_iterator_destroy(&i);

   return res;
}

/*! \brief  Create new call, interface with the PBX core */
static struct ast_channel *ast_iax2_new(int callno, int state, int capability)
{
   struct ast_channel *tmp;
   struct chan_iax2_pvt *i;
   struct ast_variable *v = NULL;

   if (!(i = iaxs[callno])) {
      ast_log(LOG_WARNING, "No IAX2 pvt found for callno '%d' !\n", callno);
      return NULL;
   }

   /* Don't hold call lock */
   ast_mutex_unlock(&iaxsl[callno]);
   tmp = ast_channel_alloc(1, state, i->cid_num, i->cid_name, i->accountcode, i->exten, i->context, i->amaflags, "IAX2/%s-%d", i->host, i->callno);
   ast_mutex_lock(&iaxsl[callno]);
   if (i != iaxs[callno]) {
      if (tmp) {
         /* unlock and relock iaxsl[callno] to preserve locking order */
         ast_mutex_unlock(&iaxsl[callno]);
         ast_channel_free(tmp);
         ast_mutex_lock(&iaxsl[callno]);
      }
      return NULL;
   }

   if (!tmp)
      return NULL;
   tmp->tech = &iax2_tech;
   /* We can support any format by default, until we get restricted */
   tmp->nativeformats = capability;
   tmp->readformat = tmp->rawreadformat = ast_best_codec(capability);
   tmp->writeformat = tmp->rawwriteformat = ast_best_codec(capability);
   tmp->tech_pvt = CALLNO_TO_PTR(i->callno);

   /* Don't use ast_set_callerid() here because it will
    * generate a NewCallerID event before the NewChannel event */
   if (!ast_strlen_zero(i->ani))
      tmp->cid.cid_ani = ast_strdup(i->ani);
   else
      tmp->cid.cid_ani = ast_strdup(i->cid_num);
   tmp->cid.cid_dnid = ast_strdup(i->dnid);
   tmp->cid.cid_rdnis = ast_strdup(i->rdnis);
   tmp->cid.cid_pres = i->calling_pres;
   tmp->cid.cid_ton = i->calling_ton;
   tmp->cid.cid_tns = i->calling_tns;
   if (!ast_strlen_zero(i->language))
      ast_string_field_set(tmp, language, i->language);
   if (!ast_strlen_zero(i->accountcode))
      ast_string_field_set(tmp, accountcode, i->accountcode);
   if (i->amaflags)
      tmp->amaflags = i->amaflags;
   ast_copy_string(tmp->context, i->context, sizeof(tmp->context));
   ast_copy_string(tmp->exten, i->exten, sizeof(tmp->exten));
   if (i->adsi)
      tmp->adsicpe = i->peeradsicpe;
   else
      tmp->adsicpe = AST_ADSI_UNAVAILABLE;
   i->owner = tmp;
   i->capability = capability;

   for (v = i->vars ; v ; v = v->next)
      pbx_builtin_setvar_helper(tmp, v->name, v->value);

   if (state != AST_STATE_DOWN) {
      if (ast_pbx_start(tmp)) {
         ast_log(LOG_WARNING, "Unable to start PBX on %s\n", tmp->name);
         ast_hangup(tmp);
         i->owner = NULL;
         return NULL;
      }
   }

   ast_module_ref(ast_module_info->self);
   
   return tmp;
}

static unsigned int calc_txpeerstamp(struct iax2_trunk_peer *tpeer, int sampms, struct timeval *tv)
{
   unsigned long int mssincetx; /* unsigned to handle overflows */
   long int ms, pred;

   tpeer->trunkact = *tv;
   mssincetx = ast_tvdiff_ms(*tv, tpeer->lasttxtime);
   if (mssincetx > 5000 || ast_tvzero(tpeer->txtrunktime)) {
      /* If it's been at least 5 seconds since the last time we transmitted on this trunk, reset our timers */
      tpeer->txtrunktime = *tv;
      tpeer->lastsent = 999999;
   }
   /* Update last transmit time now */
   tpeer->lasttxtime = *tv;
   
   /* Calculate ms offset */
   ms = ast_tvdiff_ms(*tv, tpeer->txtrunktime);
   /* Predict from last value */
   pred = tpeer->lastsent + sampms;
   if (abs(ms - pred) < MAX_TIMESTAMP_SKEW)
      ms = pred;
   
   /* We never send the same timestamp twice, so fudge a little if we must */
   if (ms == tpeer->lastsent)
      ms = tpeer->lastsent + 1;
   tpeer->lastsent = ms;
   return ms;
}

static unsigned int fix_peerts(struct timeval *tv, int callno, unsigned int ts)
{
   long ms; /* NOT unsigned */
   if (ast_tvzero(iaxs[callno]->rxcore)) {
      /* Initialize rxcore time if appropriate */
      gettimeofday(&iaxs[callno]->rxcore, NULL);
      /* Round to nearest 20ms so traces look pretty */
      iaxs[callno]->rxcore.tv_usec -= iaxs[callno]->rxcore.tv_usec % 20000;
   }
   /* Calculate difference between trunk and channel */
   ms = ast_tvdiff_ms(*tv, iaxs[callno]->rxcore);
   /* Return as the sum of trunk time and the difference between trunk and real time */
   return ms + ts;
}

static unsigned int calc_timestamp(struct chan_iax2_pvt *p, unsigned int ts, struct ast_frame *f)
{
   int ms;
   int voice = 0;
   int genuine = 0;
   int adjust;
   int rate = ast_format_rate(f->subclass) / 1000;
   struct timeval *delivery = NULL;


   /* What sort of frame do we have?: voice is self-explanatory
      "genuine" means an IAX frame - things like LAGRQ/RP, PING/PONG, ACK
      non-genuine frames are CONTROL frames [ringing etc], DTMF
      The "genuine" distinction is needed because genuine frames must get a clock-based timestamp,
      the others need a timestamp slaved to the voice frames so that they go in sequence
   */
   if (f) {
      if (f->frametype == AST_FRAME_VOICE) {
         voice = 1;
         delivery = &f->delivery;
      } else if (f->frametype == AST_FRAME_IAX) {
         genuine = 1;
      } else if (f->frametype == AST_FRAME_CNG) {
         p->notsilenttx = 0;  
      }
   }
   if (ast_tvzero(p->offset)) {
      gettimeofday(&p->offset, NULL);
      /* Round to nearest 20ms for nice looking traces */
      p->offset.tv_usec -= p->offset.tv_usec % 20000;
   }
   /* If the timestamp is specified, just send it as is */
   if (ts)
      return ts;
   /* If we have a time that the frame arrived, always use it to make our timestamp */
   if (delivery && !ast_tvzero(*delivery)) {
      ms = ast_tvdiff_ms(*delivery, p->offset);
      if (ms < 0) {
         ms = 0;
      }
      if (option_debug > 2 && iaxdebug)
         ast_log(LOG_DEBUG, "calc_timestamp: call %d/%d: Timestamp slaved to delivery time\n", p->callno, iaxs[p->callno]->peercallno);
   } else {
      ms = ast_tvdiff_ms(ast_tvnow(), p->offset);
      if (ms < 0)
         ms = 0;
      if (voice) {
         /* On a voice frame, use predicted values if appropriate */
         if (p->notsilenttx && abs(ms - p->nextpred) <= MAX_TIMESTAMP_SKEW) {
            /* Adjust our txcore, keeping voice and non-voice synchronized */
            /* AN EXPLANATION:
               When we send voice, we usually send "calculated" timestamps worked out
               on the basis of the number of samples sent. When we send other frames,
               we usually send timestamps worked out from the real clock.
               The problem is that they can tend to drift out of step because the 
                  source channel's clock and our clock may not be exactly at the same rate.
               We fix this by continuously "tweaking" p->offset.  p->offset is "time zero"
               for this call.  Moving it adjusts timestamps for non-voice frames.
               We make the adjustment in the style of a moving average.  Each time we
               adjust p->offset by 10% of the difference between our clock-derived
               timestamp and the predicted timestamp.  That's why you see "10000"
               below even though IAX2 timestamps are in milliseconds.
               The use of a moving average avoids offset moving too radically.
               Generally, "adjust" roams back and forth around 0, with offset hardly
               changing at all.  But if a consistent different starts to develop it
               will be eliminated over the course of 10 frames (200-300msecs) 
            */
            adjust = (ms - p->nextpred);
            if (adjust < 0)
               p->offset = ast_tvsub(p->offset, ast_samp2tv(abs(adjust), 10000));
            else if (adjust > 0)
               p->offset = ast_tvadd(p->offset, ast_samp2tv(adjust, 10000));

            if (!p->nextpred) {
               p->nextpred = ms; /*f->samples / rate;*/
               if (p->nextpred <= p->lastsent)
                  p->nextpred = p->lastsent + 3;
            }
            ms = p->nextpred;
         } else {
                /* in this case, just use the actual
            * time, since we're either way off
            * (shouldn't happen), or we're  ending a
            * silent period -- and seed the next
            * predicted time.  Also, round ms to the
            * next multiple of frame size (so our
            * silent periods are multiples of
            * frame size too) */

            if (option_debug && iaxdebug && abs(ms - p->nextpred) > MAX_TIMESTAMP_SKEW )
               ast_log(LOG_DEBUG, "predicted timestamp skew (%u) > max (%u), using real ts instead.\n",
                  abs(ms - p->nextpred), MAX_TIMESTAMP_SKEW);

            if (f->samples >= rate) /* check to make sure we dont core dump */
            {
               int diff = ms % (f->samples / rate);
               if (diff)
                   ms += f->samples/rate - diff;
            }

            p->nextpred = ms;
            p->notsilenttx = 1;
         }
      } else if ( f->frametype == AST_FRAME_VIDEO ) {
         /*
         * IAX2 draft 03 says that timestamps MUST be in order.
         * It does not say anything about several frames having the same timestamp
         * When transporting video, we can have a frame that spans multiple iax packets
         * (so called slices), so it would make sense to use the same timestamp for all of
         * them
         * We do want to make sure that frames don't go backwards though
         */
         if ( (unsigned int)ms < p->lastsent )
            ms = p->lastsent;
      } else {
         /* On a dataframe, use last value + 3 (to accomodate jitter buffer shrinking) if appropriate unless
            it's a genuine frame */
         if (genuine) {
            /* genuine (IAX LAGRQ etc) must keep their clock-based stamps */
            if (ms <= p->lastsent)
               ms = p->lastsent + 3;
         } else if (abs(ms - p->lastsent) <= MAX_TIMESTAMP_SKEW) {
            /* non-genuine frames (!?) (DTMF, CONTROL) should be pulled into the predicted stream stamps */
            ms = p->lastsent + 3;
         }
      }
   }
   p->lastsent = ms;
   if (voice)
      p->nextpred = p->nextpred + f->samples / rate;
   return ms;
}

static unsigned int calc_rxstamp(struct chan_iax2_pvt *p, unsigned int offset)
{
   /* Returns where in "receive time" we are.  That is, how many ms
      since we received (or would have received) the frame with timestamp 0 */
   int ms;
#ifdef IAXTESTS
   int jit;
#endif /* IAXTESTS */
   /* Setup rxcore if necessary */
   if (ast_tvzero(p->rxcore)) {
      p->rxcore = ast_tvnow();
      if (option_debug && iaxdebug)
         ast_log(LOG_DEBUG, "calc_rxstamp: call=%d: rxcore set to %d.%6.6d - %dms\n",
               p->callno, (int)(p->rxcore.tv_sec), (int)(p->rxcore.tv_usec), offset);
      p->rxcore = ast_tvsub(p->rxcore, ast_samp2tv(offset, 1000));
#if 1
      if (option_debug && iaxdebug)
         ast_log(LOG_DEBUG, "calc_rxstamp: call=%d: works out as %d.%6.6d\n",
               p->callno, (int)(p->rxcore.tv_sec),(int)( p->rxcore.tv_usec));
#endif
   }

   ms = ast_tvdiff_ms(ast_tvnow(), p->rxcore);
#ifdef IAXTESTS
   if (test_jit) {
      if (!test_jitpct || ((100.0 * ast_random() / (RAND_MAX + 1.0)) < test_jitpct)) {
         jit = (int)((float)test_jit * ast_random() / (RAND_MAX + 1.0));
         if ((int)(2.0 * ast_random() / (RAND_MAX + 1.0)))
            jit = -jit;
         ms += jit;
      }
   }
   if (test_late) {
      ms += test_late;
      test_late = 0;
   }
#endif /* IAXTESTS */
   return ms;
}

static struct iax2_trunk_peer *find_tpeer(struct sockaddr_in *sin, int fd)
{
   struct iax2_trunk_peer *tpeer;
   
   /* Finds and locks trunk peer */
   ast_mutex_lock(&tpeerlock);
   for (tpeer = tpeers; tpeer; tpeer = tpeer->next) {
      /* We don't lock here because tpeer->addr *never* changes */
      if (!inaddrcmp(&tpeer->addr, sin)) {
         ast_mutex_lock(&tpeer->lock);
         break;
      }
   }
   if (!tpeer) {
      if ((tpeer = ast_calloc(1, sizeof(*tpeer)))) {
         ast_mutex_init(&tpeer->lock);
         tpeer->lastsent = 9999;
         memcpy(&tpeer->addr, sin, sizeof(tpeer->addr));
         tpeer->trunkact = ast_tvnow();
         ast_mutex_lock(&tpeer->lock);
         tpeer->next = tpeers;
         tpeer->sockfd = fd;
         tpeers = tpeer;
#ifdef SO_NO_CHECK
         setsockopt(tpeer->sockfd, SOL_SOCKET, SO_NO_CHECK, &nochecksums, sizeof(nochecksums));
#endif
         if (option_debug)
            ast_log(LOG_DEBUG, "Created trunk peer for '%s:%d'\n", ast_inet_ntoa(tpeer->addr.sin_addr), ntohs(tpeer->addr.sin_port));
      }
   }
   ast_mutex_unlock(&tpeerlock);
   return tpeer;
}

static int iax2_trunk_queue(struct chan_iax2_pvt *pvt, struct iax_frame *fr)
{
   struct ast_frame *f;
   struct iax2_trunk_peer *tpeer;
   void *tmp, *ptr;
   struct ast_iax2_meta_trunk_entry *met;
   struct ast_iax2_meta_trunk_mini *mtm;

   f = &fr->af;
   tpeer = find_tpeer(&pvt->addr, pvt->sockfd);
   if (tpeer) {
      if (tpeer->trunkdatalen + f->datalen + 4 >= tpeer->trunkdataalloc) {
         /* Need to reallocate space */
         if (tpeer->trunkdataalloc < MAX_TRUNKDATA) {
            if (!(tmp = ast_realloc(tpeer->trunkdata, tpeer->trunkdataalloc + DEFAULT_TRUNKDATA + IAX2_TRUNK_PREFACE))) {
               ast_mutex_unlock(&tpeer->lock);
               return -1;
            }
            
            tpeer->trunkdataalloc += DEFAULT_TRUNKDATA;
            tpeer->trunkdata = tmp;
            if (option_debug)
               ast_log(LOG_DEBUG, "Expanded trunk '%s:%d' to %d bytes\n", ast_inet_ntoa(tpeer->addr.sin_addr), ntohs(tpeer->addr.sin_port), tpeer->trunkdataalloc);
         } else {
            ast_log(LOG_WARNING, "Maximum trunk data space exceeded to %s:%d\n", ast_inet_ntoa(tpeer->addr.sin_addr), ntohs(tpeer->addr.sin_port));
            ast_mutex_unlock(&tpeer->lock);
            return -1;
         }
      }

      /* Append to meta frame */
      ptr = tpeer->trunkdata + IAX2_TRUNK_PREFACE + tpeer->trunkdatalen;
      if (ast_test_flag(&globalflags, IAX_TRUNKTIMESTAMPS)) {
         mtm = (struct ast_iax2_meta_trunk_mini *)ptr;
         mtm->len = htons(f->datalen);
         mtm->mini.callno = htons(pvt->callno);
         mtm->mini.ts = htons(0xffff & fr->ts);
         ptr += sizeof(struct ast_iax2_meta_trunk_mini);
         tpeer->trunkdatalen += sizeof(struct ast_iax2_meta_trunk_mini);
      } else {
         met = (struct ast_iax2_meta_trunk_entry *)ptr;
         /* Store call number and length in meta header */
         met->callno = htons(pvt->callno);
         met->len = htons(f->datalen);
         /* Advance pointers/decrease length past trunk entry header */
         ptr += sizeof(struct ast_iax2_meta_trunk_entry);
         tpeer->trunkdatalen += sizeof(struct ast_iax2_meta_trunk_entry);
      }
      /* Copy actual trunk data */
      memcpy(ptr, f->data, f->datalen);
      tpeer->trunkdatalen += f->datalen;

      tpeer->calls++;
      ast_mutex_unlock(&tpeer->lock);
   }
   return 0;
}

/* IAX2 encryption requires 16 to 32 bytes of random padding to be present
 * before the encryption data.  This function randomizes that data. */
static void build_rand_pad(unsigned char *buf, ssize_t len)
{
   long tmp;
   for (tmp = ast_random(); len > 0; tmp = ast_random()) {
      memcpy(buf, (unsigned char *) &tmp, (len > sizeof(tmp)) ? sizeof(tmp) : len);
      buf += sizeof(tmp);
      len -= sizeof(tmp);
   }
}

static void build_encryption_keys(const unsigned char *digest, struct chan_iax2_pvt *pvt)
{
   build_ecx_key(digest, pvt);
   aes_decrypt_key128(digest, &pvt->dcx);
}
  
static void build_ecx_key(const unsigned char *digest, struct chan_iax2_pvt *pvt)
{
   /* it is required to hold the corresponding decrypt key to our encrypt key
    * in the pvt struct because queued frames occasionally need to be decrypted and
    * re-encrypted when updated for a retransmission */
   build_rand_pad(pvt->semirand, sizeof(pvt->semirand));
   aes_encrypt_key128(digest, &pvt->ecx);
   aes_decrypt_key128(digest, &pvt->mydcx);
}

static void memcpy_decrypt(unsigned char *dst, const unsigned char *src, int len, aes_decrypt_ctx *dcx)
{
#if 0
   /* Debug with "fake encryption" */
   int x;
   if (len % 16)
      ast_log(LOG_WARNING, "len should be multiple of 16, not %d!\n", len);
   for (x=0;x<len;x++)
      dst[x] = src[x] ^ 0xff;
#else 
   unsigned char lastblock[16] = { 0 };
   int x;
   while(len > 0) {
      aes_decrypt(src, dst, dcx);
      for (x=0;x<16;x++)
         dst[x] ^= lastblock[x];
      memcpy(lastblock, src, sizeof(lastblock));
      dst += 16;
      src += 16;
      len -= 16;
   }
#endif
}

static void memcpy_encrypt(unsigned char *dst, const unsigned char *src, int len, aes_encrypt_ctx *ecx)
{
#if 0
   /* Debug with "fake encryption" */
   int x;
   if (len % 16)
      ast_log(LOG_WARNING, "len should be multiple of 16, not %d!\n", len);
   for (x=0;x<len;x++)
      dst[x] = src[x] ^ 0xff;
#else
   unsigned char curblock[16] = { 0 };
   int x;
   while(len > 0) {
      for (x=0;x<16;x++)
         curblock[x] ^= src[x];
      aes_encrypt(curblock, dst, ecx);
      memcpy(curblock, dst, sizeof(curblock)); 
      dst += 16;
      src += 16;
      len -= 16;
   }
#endif
}

static int decode_frame(aes_decrypt_ctx *dcx, struct ast_iax2_full_hdr *fh, struct ast_frame *f, int *datalen)
{
   int padding;
   unsigned char *workspace;

   workspace = alloca(*datalen);
   memset(f, 0, sizeof(*f));
   if (ntohs(fh->scallno) & IAX_FLAG_FULL) {
      struct ast_iax2_full_enc_hdr *efh = (struct ast_iax2_full_enc_hdr *)fh;
      if (*datalen < 16 + sizeof(struct ast_iax2_full_hdr))
         return -1;
      /* Decrypt */
      memcpy_decrypt(workspace, efh->encdata, *datalen - sizeof(struct ast_iax2_full_enc_hdr), dcx);

      padding = 16 + (workspace[15] & 0x0f);
      if (option_debug && iaxdebug)
         ast_log(LOG_DEBUG, "Decoding full frame with length %d (padding = %d) (15=%02x)\n", *datalen, padding, workspace[15]);
      if (*datalen < padding + sizeof(struct ast_iax2_full_hdr))
         return -1;

      *datalen -= padding;
      memcpy(efh->encdata, workspace + padding, *datalen - sizeof(struct ast_iax2_full_enc_hdr));
      f->frametype = fh->type;
      if (f->frametype == AST_FRAME_VIDEO) {
         f->subclass = uncompress_subclass(fh->csub & ~0x40) | ((fh->csub >> 6) & 0x1);
      } else {
         f->subclass = uncompress_subclass(fh->csub);
      }
   } else {
      struct ast_iax2_mini_enc_hdr *efh = (struct ast_iax2_mini_enc_hdr *)fh;
      if (option_debug && iaxdebug)
         ast_log(LOG_DEBUG, "Decoding mini with length %d\n", *datalen);
      if (*datalen < 16 + sizeof(struct ast_iax2_mini_hdr))
         return -1;
      /* Decrypt */
      memcpy_decrypt(workspace, efh->encdata, *datalen - sizeof(struct ast_iax2_mini_enc_hdr), dcx);
      padding = 16 + (workspace[15] & 0x0f);
      if (*datalen < padding + sizeof(struct ast_iax2_mini_hdr))
         return -1;
      *datalen -= padding;
      memcpy(efh->encdata, workspace + padding, *datalen - sizeof(struct ast_iax2_mini_enc_hdr));
   }
   return 0;
}

static int encrypt_frame(aes_encrypt_ctx *ecx, struct ast_iax2_full_hdr *fh, unsigned char *poo, int *datalen)
{
   int padding;
   unsigned char *workspace;
   workspace = alloca(*datalen + 32);
   if (!workspace)
      return -1;
   if (ntohs(fh->scallno) & IAX_FLAG_FULL) {
      struct ast_iax2_full_enc_hdr *efh = (struct ast_iax2_full_enc_hdr *)fh;
      if (option_debug && iaxdebug)
         ast_log(LOG_DEBUG, "Encoding full frame %d/%d with length %d\n", fh->type, fh->csub, *datalen);
      padding = 16 - ((*datalen - sizeof(struct ast_iax2_full_enc_hdr)) % 16);
      padding = 16 + (padding & 0xf);
      memcpy(workspace, poo, padding);
      memcpy(workspace + padding, efh->encdata, *datalen - sizeof(struct ast_iax2_full_enc_hdr));
      workspace[15] &= 0xf0;
      workspace[15] |= (padding & 0xf);
      if (option_debug && iaxdebug)
         ast_log(LOG_DEBUG, "Encoding full frame %d/%d with length %d + %d padding (15=%02x)\n", fh->type, fh->csub, *datalen, padding, workspace[15]);
      *datalen += padding;
      memcpy_encrypt(efh->encdata, workspace, *datalen - sizeof(struct ast_iax2_full_enc_hdr), ecx);
      if (*datalen >= 32 + sizeof(struct ast_iax2_full_enc_hdr))
         memcpy(poo, workspace + *datalen - 32, 32);
   } else {
      struct ast_iax2_mini_enc_hdr *efh = (struct ast_iax2_mini_enc_hdr *)fh;
      if (option_debug && iaxdebug)
         ast_log(LOG_DEBUG, "Encoding mini frame with length %d\n", *datalen);
      padding = 16 - ((*datalen - sizeof(struct ast_iax2_mini_enc_hdr)) % 16);
      padding = 16 + (padding & 0xf);
      memcpy(workspace, poo, padding);
      memcpy(workspace + padding, efh->encdata, *datalen - sizeof(struct ast_iax2_mini_enc_hdr));
      workspace[15] &= 0xf0;
      workspace[15] |= (padding & 0x0f);
      *datalen += padding;
      memcpy_encrypt(efh->encdata, workspace, *datalen - sizeof(struct ast_iax2_mini_enc_hdr), ecx);
      if (*datalen >= 32 + sizeof(struct ast_iax2_mini_enc_hdr))
         memcpy(poo, workspace + *datalen - 32, 32);
   }
   return 0;
}

static int decrypt_frame(int callno, struct ast_iax2_full_hdr *fh, struct ast_frame *f, int *datalen)
{
   int res=-1;
   if (!ast_test_flag(iaxs[callno], IAX_KEYPOPULATED)) {
      /* Search for possible keys, given secrets */
      struct MD5Context md5;
      unsigned char digest[16];
      char *tmppw, *stringp;
      
      tmppw = ast_strdupa(iaxs[callno]->secret);
      stringp = tmppw;
      while ((tmppw = strsep(&stringp, ";"))) {
         MD5Init(&md5);
         MD5Update(&md5, (unsigned char *)iaxs[callno]->challenge, strlen(iaxs[callno]->challenge));
         MD5Update(&md5, (unsigned char *)tmppw, strlen(tmppw));
         MD5Final(digest, &md5);
         build_encryption_keys(digest, iaxs[callno]);
         res = decode_frame(&iaxs[callno]->dcx, fh, f, datalen);
         if (!res) {
            ast_set_flag(iaxs[callno], IAX_KEYPOPULATED);
            break;
         }
      }
   } else 
      res = decode_frame(&iaxs[callno]->dcx, fh, f, datalen);
   return res;
}

static int iax2_send(struct chan_iax2_pvt *pvt, struct ast_frame *f, unsigned int ts, int seqno, int now, int transfer, int final)
{
   /* Queue a packet for delivery on a given private structure.  Use "ts" for
      timestamp, or calculate if ts is 0.  Send immediately without retransmission
      or delayed, with retransmission */
   struct ast_iax2_full_hdr *fh;
   struct ast_iax2_mini_hdr *mh;
   struct ast_iax2_video_hdr *vh;
   struct {
      struct iax_frame fr2;
      unsigned char buffer[4096];
   } frb;
   struct iax_frame *fr;
   int res;
   int sendmini=0;
   unsigned int lastsent;
   unsigned int fts;

   frb.fr2.afdatalen = sizeof(frb.buffer);

   if (!pvt) {
      ast_log(LOG_WARNING, "No private structure for packet?\n");
      return -1;
   }
   
   lastsent = pvt->lastsent;

   /* Calculate actual timestamp */
   fts = calc_timestamp(pvt, ts, f);

   /* Bail here if this is an "interp" frame; we don't want or need to send these placeholders out
    * (the endpoint should detect the lost packet itself).  But, we want to do this here, so that we
    * increment the "predicted timestamps" for voice, if we're predecting */
   if(f->frametype == AST_FRAME_VOICE && f->datalen == 0)
       return 0;


   if ((ast_test_flag(pvt, IAX_TRUNK) || 
         (((fts & 0xFFFF0000L) == (lastsent & 0xFFFF0000L)) ||
         ((fts & 0xFFFF0000L) == ((lastsent + 0x10000) & 0xFFFF0000L))))
      /* High two bytes are the same on timestamp, or sending on a trunk */ &&
       (f->frametype == AST_FRAME_VOICE) 
      /* is a voice frame */ &&
      (f->subclass == pvt->svoiceformat) 
      /* is the same type */ ) {
         /* Force immediate rather than delayed transmission */
         now = 1;
         /* Mark that mini-style frame is appropriate */
         sendmini = 1;
   }
   if ( f->frametype == AST_FRAME_VIDEO ) {
      /*
       * If the lower 15 bits of the timestamp roll over, or if
       * the video format changed then send a full frame.
       * Otherwise send a mini video frame
       */
      if (((fts & 0xFFFF8000L) == (pvt->lastvsent & 0xFFFF8000L)) &&
          ((f->subclass & ~0x1) == pvt->svideoformat)
         ) {
         now = 1;
         sendmini = 1;
      } else {
         now = 0;
         sendmini = 0;
      }
      pvt->lastvsent = fts;
   }
   if (f->frametype == AST_FRAME_IAX) {
      /* 0x8000 marks this message as TX:, this bit will be stripped later */
      pvt->last_iax_message = f->subclass | MARK_IAX_SUBCLASS_TX;
      if (!pvt->first_iax_message) {
         pvt->first_iax_message = pvt->last_iax_message;
      }
   }
   /* Allocate an iax_frame */
   if (now) {
      fr = &frb.fr2;
   } else
      fr = iax_frame_new(DIRECTION_OUTGRESS, ast_test_flag(pvt, IAX_ENCRYPTED) ? f->datalen + 32 : f->datalen, (f->frametype == AST_FRAME_VOICE) || (f->frametype == AST_FRAME_VIDEO));
   if (!fr) {
      ast_log(LOG_WARNING, "Out of memory\n");
      return -1;
   }
   /* Copy our prospective frame into our immediate or retransmitted wrapper */
   iax_frame_wrap(fr, f);

   fr->ts = fts;
   fr->callno = pvt->callno;
   fr->transfer = transfer;
   fr->final = final;
   fr->encmethods = 0;
   if (!sendmini) {
      /* We need a full frame */
      if (seqno > -1)
         fr->oseqno = seqno;
      else
         fr->oseqno = pvt->oseqno++;
      fr->iseqno = pvt->iseqno;
      fh = (struct ast_iax2_full_hdr *)(fr->af.data - sizeof(struct ast_iax2_full_hdr));
      fh->scallno = htons(fr->callno | IAX_FLAG_FULL);
      fh->ts = htonl(fr->ts);
      fh->oseqno = fr->oseqno;
      if (transfer) {
         fh->iseqno = 0;
      } else
         fh->iseqno = fr->iseqno;
      /* Keep track of the last thing we've acknowledged */
      if (!transfer)
         pvt->aseqno = fr->iseqno;
      fh->type = fr->af.frametype & 0xFF;
      if (fr->af.frametype == AST_FRAME_VIDEO)
         fh->csub = compress_subclass(fr->af.subclass & ~0x1) | ((fr->af.subclass & 0x1) << 6);
      else
         fh->csub = compress_subclass(fr->af.subclass);
      if (transfer) {
         fr->dcallno = pvt->transfercallno;
      } else
         fr->dcallno = pvt->peercallno;
      fh->dcallno = htons(fr->dcallno);
      fr->datalen = fr->af.datalen + sizeof(struct ast_iax2_full_hdr);
      fr->data = fh;
      fr->retries = 0;
      /* Retry after 2x the ping time has passed */
      fr->retrytime = pvt->pingtime * 2;
      if (fr->retrytime < MIN_RETRY_TIME)
         fr->retrytime = MIN_RETRY_TIME;
      if (fr->retrytime > MAX_RETRY_TIME)
         fr->retrytime = MAX_RETRY_TIME;
      /* Acks' don't get retried */
      if ((f->frametype == AST_FRAME_IAX) && (f->subclass == IAX_COMMAND_ACK))
         fr->retries = -1;
      else if (f->frametype == AST_FRAME_VOICE)
         pvt->svoiceformat = f->subclass;
      else if (f->frametype == AST_FRAME_VIDEO)
         pvt->svideoformat = f->subclass & ~0x1;
      if (ast_test_flag(pvt, IAX_ENCRYPTED)) {
         if (ast_test_flag(pvt, IAX_KEYPOPULATED)) {
            if (iaxdebug) {
               if (fr->transfer)
                  iax_showframe(fr, NULL, 2, &pvt->transfer, fr->datalen - sizeof(struct ast_iax2_full_hdr));
               else
                  iax_showframe(fr, NULL, 2, &pvt->addr, fr->datalen - sizeof(struct ast_iax2_full_hdr));
            }
            encrypt_frame(&pvt->ecx, fh, pvt->semirand, &fr->datalen);
            fr->encmethods = pvt->encmethods;
            fr->ecx = pvt->ecx;
            fr->mydcx = pvt->mydcx;
            memcpy(fr->semirand, pvt->semirand, sizeof(fr->semirand));
         } else
            ast_log(LOG_WARNING, "Supposed to send packet encrypted, but no key?\n");
      }

      if (now) {
         res = send_packet(fr);
      } else
         res = iax2_transmit(fr);
   } else {
      if (ast_test_flag(pvt, IAX_TRUNK)) {
         iax2_trunk_queue(pvt, fr);
         res = 0;
      } else if (fr->af.frametype == AST_FRAME_VIDEO) {
         /* Video frame have no sequence number */
         fr->oseqno = -1;
         fr->iseqno = -1;
         vh = (struct ast_iax2_video_hdr *)(fr->af.data - sizeof(struct ast_iax2_video_hdr));
         vh->zeros = 0;
         vh->callno = htons(0x8000 | fr->callno);
         vh->ts = htons((fr->ts & 0x7FFF) | (fr->af.subclass & 0x1 ? 0x8000 : 0));
         fr->datalen = fr->af.datalen + sizeof(struct ast_iax2_video_hdr);
         fr->data = vh;
         fr->retries = -1;
         res = send_packet(fr);        
      } else {
         /* Mini-frames have no sequence number */
         fr->oseqno = -1;
         fr->iseqno = -1;
         /* Mini frame will do */
         mh = (struct ast_iax2_mini_hdr *)(fr->af.data - sizeof(struct ast_iax2_mini_hdr));
         mh->callno = htons(fr->callno);
         mh->ts = htons(fr->ts & 0xFFFF);
         fr->datalen = fr->af.datalen + sizeof(struct ast_iax2_mini_hdr);
         fr->data = mh;
         fr->retries = -1;
         if (pvt->transferring == TRANSFER_MEDIAPASS)
            fr->transfer = 1;
         if (ast_test_flag(pvt, IAX_ENCRYPTED)) {
            if (ast_test_flag(pvt, IAX_KEYPOPULATED)) {
               encrypt_frame(&pvt->ecx, (struct ast_iax2_full_hdr *)mh, pvt->semirand, &fr->datalen);
            } else
               ast_log(LOG_WARNING, "Supposed to send packet encrypted, but no key?\n");
         }
         res = send_packet(fr);
      }
   }
   return res;
}

static int iax2_show_users(int fd, int argc, char *argv[])
{
   regex_t regexbuf;
   int havepattern = 0;

#define FORMAT "%-15.15s  %-20.20s  %-15.15s  %-15.15s  %-5.5s  %-5.10s\n"
#define FORMAT2 "%-15.15s  %-20.20s  %-15.15d  %-15.15s  %-5.5s  %-5.10s\n"

   struct iax2_user *user = NULL;
   char auth[90];
   char *pstr = "";
   struct ao2_iterator i;

   switch (argc) {
   case 5:
      if (!strcasecmp(argv[3], "like")) {
         if (regcomp(&regexbuf, argv[4], REG_EXTENDED | REG_NOSUB))
            return RESULT_SHOWUSAGE;
         havepattern = 1;
      } else
         return RESULT_SHOWUSAGE;
   case 3:
      break;
   default:
      return RESULT_SHOWUSAGE;
   }

   ast_cli(fd, FORMAT, "Username", "Secret", "Authen", "Def.Context", "A/C","Codec Pref");
   i = ao2_iterator_init(users, 0);
   for (user = ao2_iterator_next(&i); user; 
      user_unref(user), user = ao2_iterator_next(&i)) {
      if (havepattern && regexec(&regexbuf, user->name, 0, NULL, 0))
         continue;
      
      if (!ast_strlen_zero(user->secret)) {
         ast_copy_string(auth,user->secret,sizeof(auth));
      } else if (!ast_strlen_zero(user->inkeys)) {
         snprintf(auth, sizeof(auth), "Key: %-15.15s ", user->inkeys);
      } else
         ast_copy_string(auth, "-no secret-", sizeof(auth));
      
      if(ast_test_flag(user,IAX_CODEC_NOCAP))
         pstr = "REQ Only";
      else if(ast_test_flag(user,IAX_CODEC_NOPREFS))
         pstr = "Disabled";
      else
         pstr = ast_test_flag(user,IAX_CODEC_USER_FIRST) ? "Caller" : "Host";
      
      ast_cli(fd, FORMAT2, user->name, auth, user->authmethods, 
         user->contexts ? user->contexts->context : context,
         user->ha ? "Yes" : "No", pstr);
   }
   ao2_iterator_destroy(&i);

   if (havepattern)
      regfree(&regexbuf);

   return RESULT_SUCCESS;
#undef FORMAT
#undef FORMAT2
}

static int __iax2_show_peers(int manager, int fd, struct mansession *s, int argc, char *argv[])
{
   regex_t regexbuf;
   int havepattern = 0;
   int total_peers = 0;
   int online_peers = 0;
   int offline_peers = 0;
   int unmonitored_peers = 0;
   struct ao2_iterator i;

#define FORMAT2 "%-15.15s  %-15.15s %s  %-15.15s  %-8s  %s %-10s%s"
#define FORMAT "%-15.15s  %-15.15s %s  %-15.15s  %-5d%s  %s %-10s%s"

   struct iax2_peer *peer = NULL;
   char name[256];
   int registeredonly=0;
   char *term = manager ? "\r\n" : "\n";

   switch (argc) {
   case 6:
      if (!strcasecmp(argv[3], "registered"))
         registeredonly = 1;
      else
         return RESULT_SHOWUSAGE;
      if (!strcasecmp(argv[4], "like")) {
         if (regcomp(&regexbuf, argv[5], REG_EXTENDED | REG_NOSUB))
            return RESULT_SHOWUSAGE;
         havepattern = 1;
      } else
         return RESULT_SHOWUSAGE;
      break;
   case 5:
      if (!strcasecmp(argv[3], "like")) {
         if (regcomp(&regexbuf, argv[4], REG_EXTENDED | REG_NOSUB))
            return RESULT_SHOWUSAGE;
         havepattern = 1;
      } else
         return RESULT_SHOWUSAGE;
      break;
   case 4:
      if (!strcasecmp(argv[3], "registered"))
         registeredonly = 1;
      else
         return RESULT_SHOWUSAGE;
      break;
   case 3:
      break;
   default:
      return RESULT_SHOWUSAGE;
   }


   if (s)
      astman_append(s, FORMAT2, "Name/Username", "Host", "   ", "Mask", "Port", "   ", "Status", term);
   else
      ast_cli(fd, FORMAT2, "Name/Username", "Host", "   ", "Mask", "Port", "   ", "Status", term);

   i = ao2_iterator_init(peers, 0);
   for (peer = ao2_iterator_next(&i); peer; 
      peer_unref(peer), peer = ao2_iterator_next(&i)) {
      char nm[20];
      char status[20];
      char srch[2000];
      int retstatus;

      if (registeredonly && !peer->addr.sin_addr.s_addr)
         continue;
      if (havepattern && regexec(&regexbuf, peer->name, 0, NULL, 0))
         continue;

      if (!ast_strlen_zero(peer->username))
         snprintf(name, sizeof(name), "%s/%s", peer->name, peer->username);
      else
         ast_copy_string(name, peer->name, sizeof(name));
      
      retstatus = peer_status(peer, status, sizeof(status));
      if (retstatus > 0)
         online_peers++;
      else if (!retstatus)
         offline_peers++;
      else
         unmonitored_peers++;
      
      ast_copy_string(nm, ast_inet_ntoa(peer->mask), sizeof(nm));
      
      snprintf(srch, sizeof(srch), FORMAT, name, 
          peer->addr.sin_addr.s_addr ? ast_inet_ntoa(peer->addr.sin_addr) : "(Unspecified)",
          ast_test_flag(peer, IAX_DYNAMIC) ? "(D)" : "(S)",
          nm,
          ntohs(peer->addr.sin_port), ast_test_flag(peer, IAX_TRUNK) ? "(T)" : "   ",
          peer->encmethods ? "(E)" : "   ", status, term);
      
      if (s)
         astman_append(s, FORMAT, name, 
                  peer->addr.sin_addr.s_addr ? ast_inet_ntoa( peer->addr.sin_addr) : "(Unspecified)",
                  ast_test_flag(peer, IAX_DYNAMIC) ? "(D)" : "(S)",
                  nm,
                  ntohs(peer->addr.sin_port), ast_test_flag(peer, IAX_TRUNK) ? "(T)" : "   ",
                  peer->encmethods ? "(E)" : "   ", status, term);
      else
         ast_cli(fd, FORMAT, name, 
            peer->addr.sin_addr.s_addr ? ast_inet_ntoa(peer->addr.sin_addr) : "(Unspecified)",
            ast_test_flag(peer, IAX_DYNAMIC) ? "(D)" : "(S)",
            nm,
            ntohs(peer->addr.sin_port), ast_test_flag(peer, IAX_TRUNK) ? "(T)" : "   ",
            peer->encmethods ? "(E)" : "   ", status, term);
      total_peers++;
   }
   ao2_iterator_destroy(&i);

   if (s)
      astman_append(s,"%d iax2 peers [%d online, %d offline, %d unmonitored]%s", total_peers, online_peers, offline_peers, unmonitored_peers, term);
   else
      ast_cli(fd,"%d iax2 peers [%d online, %d offline, %d unmonitored]%s", total_peers, online_peers, offline_peers, unmonitored_peers, term);

   if (havepattern)
      regfree(&regexbuf);

   return RESULT_SUCCESS;
#undef FORMAT
#undef FORMAT2
}

static int iax2_show_threads(int fd, int argc, char *argv[])
{
   struct iax2_thread *thread = NULL;
   time_t t;
   int threadcount = 0, dynamiccount = 0;
   char type;

   if (argc != 3)
      return RESULT_SHOWUSAGE;
      
   ast_cli(fd, "IAX2 Thread Information\n");
   time(&t);
   ast_cli(fd, "Idle Threads:\n");
   AST_LIST_LOCK(&idle_list);
   AST_LIST_TRAVERSE(&idle_list, thread, list) {
#ifdef DEBUG_SCHED_MULTITHREAD
      ast_cli(fd, "Thread %d: state=%d, update=%d, actions=%d, func ='%s'\n", 
         thread->threadnum, thread->iostate, (int)(t - thread->checktime), thread->actions, thread->curfunc);
#else
      ast_cli(fd, "Thread %d: state=%d, update=%d, actions=%d\n", 
         thread->threadnum, thread->iostate, (int)(t - thread->checktime), thread->actions);
#endif
      threadcount++;
   }
   AST_LIST_UNLOCK(&idle_list);
   ast_cli(fd, "Active Threads:\n");
   AST_LIST_LOCK(&active_list);
   AST_LIST_TRAVERSE(&active_list, thread, list) {
      if (thread->type == IAX_TYPE_DYNAMIC)
         type = 'D';
      else
         type = 'P';
#ifdef DEBUG_SCHED_MULTITHREAD
      ast_cli(fd, "Thread %c%d: state=%d, update=%d, actions=%d, func ='%s'\n", 
         type, thread->threadnum, thread->iostate, (int)(t - thread->checktime), thread->actions, thread->curfunc);
#else
      ast_cli(fd, "Thread %c%d: state=%d, update=%d, actions=%d\n", 
         type, thread->threadnum, thread->iostate, (int)(t - thread->checktime), thread->actions);
#endif
      threadcount++;
   }
   AST_LIST_UNLOCK(&active_list);
   ast_cli(fd, "Dynamic Threads:\n");
        AST_LIST_LOCK(&dynamic_list);
        AST_LIST_TRAVERSE(&dynamic_list, thread, list) {
#ifdef DEBUG_SCHED_MULTITHREAD
                ast_cli(fd, "Thread %d: state=%d, update=%d, actions=%d, func ='%s'\n",
                        thread->threadnum, thread->iostate, (int)(t - thread->checktime), thread->actions, thread->curfunc);
#else
                ast_cli(fd, "Thread %d: state=%d, update=%d, actions=%d\n",
                        thread->threadnum, thread->iostate, (int)(t - thread->checktime), thread->actions);
#endif
      dynamiccount++;
        }
        AST_LIST_UNLOCK(&dynamic_list);
   ast_cli(fd, "%d of %d threads accounted for with %d dynamic threads\n", threadcount, iaxthreadcount, dynamiccount);
   return RESULT_SUCCESS;
}

static int iax2_show_peers(int fd, int argc, char *argv[])
{
   return __iax2_show_peers(0, fd, NULL, argc, argv);
}
static int manager_iax2_show_netstats(struct mansession *s, const struct message *m)
{
   ast_cli_netstats(s, -1, 0);
   astman_append(s, "\r\n");
   return RESULT_SUCCESS;
}

static int iax2_show_firmware(int fd, int argc, char *argv[])
{
#define FORMAT2 "%-15.15s  %-15.15s %-15.15s\n"
#if !defined(__FreeBSD__)
#define FORMAT "%-15.15s  %-15d %-15d\n"
#else /* __FreeBSD__ */
#define FORMAT "%-15.15s  %-15d %-15d\n" /* XXX 2.95 ? */
#endif /* __FreeBSD__ */
   struct iax_firmware *cur;
   if ((argc != 3) && (argc != 4))
      return RESULT_SHOWUSAGE;
   ast_mutex_lock(&waresl.lock);
   
   ast_cli(fd, FORMAT2, "Device", "Version", "Size");
   for (cur = waresl.wares;cur;cur = cur->next) {
      if ((argc == 3) || (!strcasecmp(argv[3], (char *)cur->fwh->devname))) 
         ast_cli(fd, FORMAT, cur->fwh->devname, ntohs(cur->fwh->version),
            (int)ntohl(cur->fwh->datalen));
   }
   ast_mutex_unlock(&waresl.lock);
   return RESULT_SUCCESS;
#undef FORMAT
#undef FORMAT2
}

/* JDG: callback to display iax peers in manager */
static int manager_iax2_show_peers(struct mansession *s, const struct message *m)
{
   char *a[] = { "iax2", "show", "users" };
   int ret;
   const char *id = astman_get_header(m,"ActionID");

   if (!ast_strlen_zero(id))
      astman_append(s, "ActionID: %s\r\n",id);
   ret = __iax2_show_peers(1, -1, s, 3, a );
   astman_append(s, "\r\n\r\n" );
   return ret;
} /* /JDG */

static char *regstate2str(int regstate)
{
   switch(regstate) {
   case REG_STATE_UNREGISTERED:
      return "Unregistered";
   case REG_STATE_REGSENT:
      return "Request Sent";
   case REG_STATE_AUTHSENT:
      return "Auth. Sent";
   case REG_STATE_REGISTERED:
      return "Registered";
   case REG_STATE_REJECTED:
      return "Rejected";
   case REG_STATE_TIMEOUT:
      return "Timeout";
   case REG_STATE_NOAUTH:
      return "No Authentication";
   default:
      return "Unknown";
   }
}

static int iax2_show_registry(int fd, int argc, char *argv[])
{
#define FORMAT2 "%-20.20s  %-6.6s  %-10.10s  %-20.20s %8.8s  %s\n"
#define FORMAT  "%-20.20s  %-6.6s  %-10.10s  %-20.20s %8d  %s\n"
   struct iax2_registry *reg = NULL;

   char host[80];
   char perceived[80];
   if (argc != 3)
      return RESULT_SHOWUSAGE;
   ast_cli(fd, FORMAT2, "Host", "dnsmgr", "Username", "Perceived", "Refresh", "State");
   AST_LIST_LOCK(&registrations);
   AST_LIST_TRAVERSE(&registrations, reg, entry) {
      snprintf(host, sizeof(host), "%s:%d", ast_inet_ntoa(reg->addr.sin_addr), ntohs(reg->addr.sin_port));
      if (reg->us.sin_addr.s_addr) 
         snprintf(perceived, sizeof(perceived), "%s:%d", ast_inet_ntoa(reg->us.sin_addr), ntohs(reg->us.sin_port));
      else
         ast_copy_string(perceived, "<Unregistered>", sizeof(perceived));
      ast_cli(fd, FORMAT, host, 
               (reg->dnsmgr) ? "Y" : "N", 
               reg->username, perceived, reg->refresh, regstate2str(reg->regstate));
   }
   AST_LIST_UNLOCK(&registrations);
   return RESULT_SUCCESS;
#undef FORMAT
#undef FORMAT2
}

static int iax2_show_channels(int fd, int argc, char *argv[])
{
#define FORMAT2 "%-20.20s  %-15.15s  %-10.10s  %-11.11s  %-11.11s  %-7.7s  %-6.6s  %-6.6s  %s  %s  %9s\n"
#define FORMAT  "%-20.20s  %-15.15s  %-10.10s  %5.5d/%5.5d  %5.5d/%5.5d  %-5.5dms  %-4.4dms  %-4.4dms  %-6.6s  %s%s  %3s%s\n"
#define FORMATB "%-20.20s  %-15.15s  %-10.10s  %5.5d/%5.5d  %5.5d/%5.5d  [Native Bridged to ID=%5.5d]\n"
   int x;
   int numchans = 0;
   char first_message[10] = { 0, };
   char last_message[10] = { 0, };

   if (argc != 3)
      return RESULT_SHOWUSAGE;
   ast_cli(fd, FORMAT2, "Channel", "Peer", "Username", "ID (Lo/Rem)", "Seq (Tx/Rx)", "Lag", "Jitter", "JitBuf", "Format", "FirstMsg", "LastMsg");
   for (x = 0; x < ARRAY_LEN(iaxs); x++) {
      ast_mutex_lock(&iaxsl[x]);
      if (iaxs[x]) {
         int lag, jitter, localdelay;
         jb_info jbinfo;
         if(ast_test_flag(iaxs[x], IAX_USEJITTERBUF)) {
            jb_getinfo(iaxs[x]->jb, &jbinfo);
            jitter = jbinfo.jitter;
            localdelay = jbinfo.current - jbinfo.min;
         } else {
            jitter = -1;
            localdelay = 0;
         }

         iax_frame_subclass2str(iaxs[x]->first_iax_message & ~MARK_IAX_SUBCLASS_TX, first_message, sizeof(first_message));
         iax_frame_subclass2str(iaxs[x]->last_iax_message & ~MARK_IAX_SUBCLASS_TX, last_message, sizeof(last_message));
         lag = iaxs[x]->remote_rr.delay;
         ast_cli(fd, FORMAT,
            iaxs[x]->owner ? iaxs[x]->owner->name : "(None)",
            ast_inet_ntoa(iaxs[x]->addr.sin_addr),
            S_OR(iaxs[x]->username, "(None)"),
            iaxs[x]->callno, iaxs[x]->peercallno,
            iaxs[x]->oseqno, iaxs[x]->iseqno,
            lag,
            jitter,
            localdelay,
            ast_getformatname(iaxs[x]->voiceformat),
            (iaxs[x]->first_iax_message & MARK_IAX_SUBCLASS_TX) ? "Tx:" : "Rx:",
            first_message,
            (iaxs[x]->last_iax_message & MARK_IAX_SUBCLASS_TX) ? "Tx:" : "Rx:",
            last_message);
         numchans++;
      }
      ast_mutex_unlock(&iaxsl[x]);
   }
   ast_cli(fd, "%d active IAX channel%s\n", numchans, (numchans != 1) ? "s" : "");
   return RESULT_SUCCESS;
#undef FORMAT
#undef FORMAT2
#undef FORMATB
}

static int ast_cli_netstats(struct mansession *s, int fd, int limit_fmt)
{
   int x;
   int numchans = 0;
   char first_message[10] = { 0, };
   char last_message[10] = { 0, };
   for (x = 0; x < ARRAY_LEN(iaxs); x++) {
      ast_mutex_lock(&iaxsl[x]);
      if (iaxs[x]) {
         int localjitter, localdelay, locallost, locallosspct, localdropped, localooo;
         char *fmt;
         jb_info jbinfo;

         if(ast_test_flag(iaxs[x], IAX_USEJITTERBUF)) {
            jb_getinfo(iaxs[x]->jb, &jbinfo);
            localjitter = jbinfo.jitter;
            localdelay = jbinfo.current - jbinfo.min;
            locallost = jbinfo.frames_lost;
            locallosspct = jbinfo.losspct/1000;
            localdropped = jbinfo.frames_dropped;
            localooo = jbinfo.frames_ooo;
         } else {
            localjitter = -1;
            localdelay = 0;
            locallost = -1;
            locallosspct = -1;
            localdropped = 0;
            localooo = -1;
         }
         iax_frame_subclass2str(iaxs[x]->first_iax_message & ~MARK_IAX_SUBCLASS_TX, first_message, sizeof(first_message));
         iax_frame_subclass2str(iaxs[x]->last_iax_message & ~MARK_IAX_SUBCLASS_TX, last_message, sizeof(last_message));
         if (limit_fmt)
            fmt = "%-20.25s %4d %4d %4d %5d %3d %5d %4d %6d %4d %4d %5d %3d %5d %4d %6d %s%s %4s%s\n";
         else
            fmt = "%s %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %s%s %s%s\n";
         if (s)

            astman_append(s, fmt,
                     iaxs[x]->owner ? iaxs[x]->owner->name : "(None)",
                     iaxs[x]->pingtime,
                     localjitter,
                     localdelay,
                     locallost,
                     locallosspct,
                     localdropped,
                     localooo,
                     iaxs[x]->frames_received/1000,
                     iaxs[x]->remote_rr.jitter,
                     iaxs[x]->remote_rr.delay,
                     iaxs[x]->remote_rr.losscnt,
                     iaxs[x]->remote_rr.losspct,
                     iaxs[x]->remote_rr.dropped,
                     iaxs[x]->remote_rr.ooo,
                     iaxs[x]->remote_rr.packets/1000,
                          (iaxs[x]->first_iax_message & MARK_IAX_SUBCLASS_TX) ? "Tx:" : "Rx:",
                    first_message,
                    (iaxs[x]->last_iax_message & MARK_IAX_SUBCLASS_TX) ? "Tx:" : "Rx:",
                    last_message);
         else
            ast_cli(fd, fmt,
               iaxs[x]->owner ? iaxs[x]->owner->name : "(None)",
               iaxs[x]->pingtime,
               localjitter,
               localdelay,
               locallost,
               locallosspct,
               localdropped,
               localooo,
               iaxs[x]->frames_received/1000,
               iaxs[x]->remote_rr.jitter,
               iaxs[x]->remote_rr.delay,
               iaxs[x]->remote_rr.losscnt,
               iaxs[x]->remote_rr.losspct,
               iaxs[x]->remote_rr.dropped,
               iaxs[x]->remote_rr.ooo,
               iaxs[x]->remote_rr.packets/1000,
               (iaxs[x]->first_iax_message & MARK_IAX_SUBCLASS_TX) ? "Tx:" : "Rx:",
               first_message,
               (iaxs[x]->last_iax_message & MARK_IAX_SUBCLASS_TX) ? "Tx:" : "Rx:",
               last_message);
         numchans++;
      }
      ast_mutex_unlock(&iaxsl[x]);
   }
   return numchans;
}

static int iax2_show_netstats(int fd, int argc, char *argv[])
{
   int numchans = 0;
   if (argc != 3)
      return RESULT_SHOWUSAGE;
   ast_cli(fd, "                           -------- LOCAL ---------------------  -------- REMOTE --------------------\n");
   ast_cli(fd, "Channel               RTT  Jit  Del  Lost   %%  Drop  OOO  Kpkts  Jit  Del  Lost   %%  Drop  OOO  Kpkts FirstMsg    LastMsg\n");
   numchans = ast_cli_netstats(NULL, fd, 1);
   ast_cli(fd, "%d active IAX channel%s\n", numchans, (numchans != 1) ? "s" : "");
   return RESULT_SUCCESS;
}

static int iax2_do_debug(int fd, int argc, char *argv[])
{
   if (argc < 2 || argc > 3)
      return RESULT_SHOWUSAGE;
   iaxdebug = 1;
   ast_cli(fd, "IAX2 Debugging Enabled\n");
   return RESULT_SUCCESS;
}

static int iax2_do_trunk_debug(int fd, int argc, char *argv[])
{
   if (argc < 3 || argc > 4)
      return RESULT_SHOWUSAGE;
   iaxtrunkdebug = 1;
   ast_cli(fd, "IAX2 Trunk Debug Requested\n");
   return RESULT_SUCCESS;
}

static int iax2_do_jb_debug(int fd, int argc, char *argv[])
{
   if (argc < 3 || argc > 4)
      return RESULT_SHOWUSAGE;
   jb_setoutput(jb_error_output, jb_warning_output, jb_debug_output);
   ast_cli(fd, "IAX2 Jitterbuffer Debugging Enabled\n");
   return RESULT_SUCCESS;
}

static int iax2_no_debug(int fd, int argc, char *argv[])
{
   if (argc < 3 || argc > 4)
      return RESULT_SHOWUSAGE;
   iaxdebug = 0;
   ast_cli(fd, "IAX2 Debugging Disabled\n");
   return RESULT_SUCCESS;
}

static int iax2_no_trunk_debug(int fd, int argc, char *argv[])
{
   if (argc < 4 || argc > 5)
      return RESULT_SHOWUSAGE;
   iaxtrunkdebug = 0;
   ast_cli(fd, "IAX2 Trunk Debugging Disabled\n");
   return RESULT_SUCCESS;
}

static int iax2_no_jb_debug(int fd, int argc, char *argv[])
{
   if (argc < 4 || argc > 5)
      return RESULT_SHOWUSAGE;
   jb_setoutput(jb_error_output, jb_warning_output, NULL);
   jb_debug_output("\n");
   ast_cli(fd, "IAX2 Jitterbuffer Debugging Disabled\n");
   return RESULT_SUCCESS;
}

static int iax2_write(struct ast_channel *c, struct ast_frame *f)
{
   unsigned short callno = PTR_TO_CALLNO(c->tech_pvt);
   int res = -1;
   ast_mutex_lock(&iaxsl[callno]);
   if (iaxs[callno]) {
   /* If there's an outstanding error, return failure now */
      if (!iaxs[callno]->error) {
         if (ast_test_flag(iaxs[callno], IAX_ALREADYGONE))
            res = 0;
            /* Don't waste bandwidth sending null frames */
         else if (f->frametype == AST_FRAME_NULL)
            res = 0;
         else if ((f->frametype == AST_FRAME_VOICE) && ast_test_flag(iaxs[callno], IAX_QUELCH))
            res = 0;
         else if (!ast_test_flag(&iaxs[callno]->state, IAX_STATE_STARTED))
            res = 0;
         else
         /* Simple, just queue for transmission */
            res = iax2_send(iaxs[callno], f, 0, -1, 0, 0, 0);
      } else {
         if (option_debug)
            ast_log(LOG_DEBUG, "Write error: %s\n", strerror(errno));
      }
   }
   /* If it's already gone, just return */
   ast_mutex_unlock(&iaxsl[callno]);
   return res;
}

static int __send_command(struct chan_iax2_pvt *i, char type, int command, unsigned int ts, const unsigned char *data, int datalen, int seqno, 
      int now, int transfer, int final)
{
   struct ast_frame f = { 0, };
   int res = 0;
   f.frametype = type;
   f.subclass = command;
   f.datalen = datalen;
   f.src = __FUNCTION__;
   f.data = (void *) data;

   if ((res = queue_signalling(i, &f)) <= 0) {
      return res;
   }
   return iax2_send(i, &f, ts, seqno, now, transfer, final);
}

static int send_command(struct chan_iax2_pvt *i, char type, int command, unsigned int ts, const unsigned char *data, int datalen, int seqno)
{
   return __send_command(i, type, command, ts, data, datalen, seqno, 0, 0, 0);
}

static int send_command_locked(unsigned short callno, char type, int command, unsigned int ts, const unsigned char *data, int datalen, int seqno)
{
   int res;
   ast_mutex_lock(&iaxsl[callno]);
   res = send_command(iaxs[callno], type, command, ts, data, datalen, seqno);
   ast_mutex_unlock(&iaxsl[callno]);
   return res;
}

/*!
 * \note Since this function calls iax2_predestroy() -> iax2_queue_hangup(),
 *       the pvt struct for the given call number may disappear during its 
 *       execution.
 */
static int send_command_final(struct chan_iax2_pvt *i, char type, int command, unsigned int ts, const unsigned char *data, int datalen, int seqno)
{
   int call_num = i->callno;
   /* It is assumed that the callno has already been locked */
   iax2_predestroy(i->callno);
   if (!iaxs[call_num])
      return -1;
   return __send_command(i, type, command, ts, data, datalen, seqno, 0, 0, 1);
}

static int send_command_immediate(struct chan_iax2_pvt *i, char type, int command, unsigned int ts, const unsigned char *data, int datalen, int seqno)
{
   return __send_command(i, type, command, ts, data, datalen, seqno, 1, 0, 0);
}

static int send_command_transfer(struct chan_iax2_pvt *i, char type, int command, unsigned int ts, const unsigned char *data, int datalen)
{
   return __send_command(i, type, command, ts, data, datalen, 0, 0, 1, 0);
}

static int apply_context(struct iax2_context *con, const char *context)
{
   while(con) {
      if (!strcmp(con->context, context) || !strcmp(con->context, "*"))
         return -1;
      con = con->next;
   }
   return 0;
}


static int check_access(int callno, struct sockaddr_in *sin, struct iax_ies *ies)
{
   /* Start pessimistic */
   int res = -1;
   int version = 2;
   struct iax2_user *user = NULL, *best = NULL;
   int bestscore = 0;
   int gotcapability = 0;
   struct ast_variable *v = NULL, *tmpvar = NULL;
   struct ao2_iterator i;

   if (!iaxs[callno])
      return res;
   if (ies->called_number)
      ast_string_field_set(iaxs[callno], exten, ies->called_number);
   if (ies->calling_number) {
      if (ast_test_flag(&globalflags, IAX_SHRINKCALLERID)) { 
         ast_shrink_phone_number(ies->calling_number);
      }
      ast_string_field_set(iaxs[callno], cid_num, ies->calling_number);
   }
   if (ies->calling_name)
      ast_string_field_set(iaxs[callno], cid_name, ies->calling_name);
   if (ies->calling_ani)
      ast_string_field_set(iaxs[callno], ani, ies->calling_ani);
   if (ies->dnid)
      ast_string_field_set(iaxs[callno], dnid, ies->dnid);
   if (ies->rdnis)
      ast_string_field_set(iaxs[callno], rdnis, ies->rdnis);
   if (ies->called_context)
      ast_string_field_set(iaxs[callno], context, ies->called_context);
   if (ies->language)
      ast_string_field_set(iaxs[callno], language, ies->language);
   if (ies->username)
      ast_string_field_set(iaxs[callno], username, ies->username);
   if (ies->calling_ton > -1)
      iaxs[callno]->calling_ton = ies->calling_ton;
   if (ies->calling_tns > -1)
      iaxs[callno]->calling_tns = ies->calling_tns;
   if (ies->calling_pres > -1)
      iaxs[callno]->calling_pres = ies->calling_pres;
   if (ies->format)
      iaxs[callno]->peerformat = ies->format;
   if (ies->adsicpe)
      iaxs[callno]->peeradsicpe = ies->adsicpe;
   if (ies->capability) {
      gotcapability = 1;
      iaxs[callno]->peercapability = ies->capability;
   } 
   if (ies->version)
      version = ies->version;

   /* Use provided preferences until told otherwise for actual preferences */
   if(ies->codec_prefs) {
      ast_codec_pref_convert(&iaxs[callno]->rprefs, ies->codec_prefs, 32, 0);
      ast_codec_pref_convert(&iaxs[callno]->prefs, ies->codec_prefs, 32, 0);
   }

   if (!gotcapability) 
      iaxs[callno]->peercapability = iaxs[callno]->peerformat;
   if (version > IAX_PROTO_VERSION) {
      ast_log(LOG_WARNING, "Peer '%s' has too new a protocol version (%d) for me\n", 
         ast_inet_ntoa(sin->sin_addr), version);
      return res;
   }
   /* Search the userlist for a compatible entry, and fill in the rest */
   i = ao2_iterator_init(users, 0);
   while ((user = ao2_iterator_next(&i))) {
      if ((ast_strlen_zero(iaxs[callno]->username) ||          /* No username specified */
         !strcmp(iaxs[callno]->username, user->name)) /* Or this username specified */
         && ast_apply_ha(user->ha, sin)   /* Access is permitted from this IP */
         && (ast_strlen_zero(iaxs[callno]->context) ||         /* No context specified */
              apply_context(user->contexts, iaxs[callno]->context))) {        /* Context is permitted */
         if (!ast_strlen_zero(iaxs[callno]->username)) {
            /* Exact match, stop right now. */
            if (best)
               user_unref(best);
            best = user;
            break;
         } else if (ast_strlen_zero(user->secret) && ast_strlen_zero(user->dbsecret) && ast_strlen_zero(user->inkeys)) {
            /* No required authentication */
            if (user->ha) {
               /* There was host authentication and we passed, bonus! */
               if (bestscore < 4) {
                  bestscore = 4;
                  if (best)
                     user_unref(best);
                  best = user;
                  continue;
               }
            } else {
               /* No host access, but no secret, either, not bad */
               if (bestscore < 3) {
                  bestscore = 3;
                  if (best)
                     user_unref(best);
                  best = user;
                  continue;
               }
            }
         } else {
            if (user->ha) {
               /* Authentication, but host access too, eh, it's something.. */
               if (bestscore < 2) {
                  bestscore = 2;
                  if (best)
                     user_unref(best);
                  best = user;
                  continue;
               }
            } else {
               /* Authentication and no host access...  This is our baseline */
               if (bestscore < 1) {
                  bestscore = 1;
                  if (best)
                     user_unref(best);
                  best = user;
                  continue;
               }
            }
         }
      }
      user_unref(user);
   }
   ao2_iterator_destroy(&i);
   user = best;
   if (!user && !ast_strlen_zero(iaxs[callno]->username)) {
      user = realtime_user(iaxs[callno]->username, sin);
      if (user && !ast_strlen_zero(iaxs[callno]->context) &&         /* No context specified */
          !apply_context(user->contexts, iaxs[callno]->context)) {      /* Context is permitted */
         user = user_unref(user);
      }
   }
   if (user) {
      /* We found our match (use the first) */
      /* copy vars */
      for (v = user->vars ; v ; v = v->next) {
         if((tmpvar = ast_variable_new(v->name, v->value))) {
            tmpvar->next = iaxs[callno]->vars; 
            iaxs[callno]->vars = tmpvar;
         }
      }
      /* If a max AUTHREQ restriction is in place, activate it */
      if (user->maxauthreq > 0)
         ast_set_flag(iaxs[callno], IAX_MAXAUTHREQ);
      iaxs[callno]->prefs = user->prefs;
      ast_copy_flags(iaxs[callno], user, IAX_CODEC_USER_FIRST);
      ast_copy_flags(iaxs[callno], user, IAX_CODEC_NOPREFS);
      ast_copy_flags(iaxs[callno], user, IAX_CODEC_NOCAP);
      iaxs[callno]->encmethods = user->encmethods;
      /* Store the requested username if not specified */
      if (ast_strlen_zero(iaxs[callno]->username))
         ast_string_field_set(iaxs[callno], username, user->name);
      /* Store whether this is a trunked call, too, of course, and move if appropriate */
      ast_copy_flags(iaxs[callno], user, IAX_TRUNK);
      iaxs[callno]->capability = user->capability;
      /* And use the default context */
      if (ast_strlen_zero(iaxs[callno]->context)) {
         if (user->contexts)
            ast_string_field_set(iaxs[callno], context, user->contexts->context);
         else
            ast_string_field_set(iaxs[callno], context, context);
      }
      /* And any input keys */
      ast_string_field_set(iaxs[callno], inkeys, user->inkeys);
      /* And the permitted authentication methods */
      iaxs[callno]->authmethods = user->authmethods;
      iaxs[callno]->adsi = user->adsi;
      /* If the user has callerid, override the remote caller id. */
      if (ast_test_flag(user, IAX_HASCALLERID)) {
         iaxs[callno]->calling_tns = 0;
         iaxs[callno]->calling_ton = 0;
         ast_string_field_set(iaxs[callno], cid_num, user->cid_num);
         ast_string_field_set(iaxs[callno], cid_name, user->cid_name);
         ast_string_field_set(iaxs[callno], ani, user->cid_num);
         iaxs[callno]->calling_pres = AST_PRES_ALLOWED_USER_NUMBER_PASSED_SCREEN;
      } else if (ast_strlen_zero(iaxs[callno]->cid_num) && ast_strlen_zero(iaxs[callno]->cid_name)) {
         iaxs[callno]->calling_pres = AST_PRES_NUMBER_NOT_AVAILABLE;
      } /* else user is allowed to set their own CID settings */
      if (!ast_strlen_zero(user->accountcode))
         ast_string_field_set(iaxs[callno], accountcode, user->accountcode);
      if (!ast_strlen_zero(user->mohinterpret))
         ast_string_field_set(iaxs[callno], mohinterpret, user->mohinterpret);
      if (!ast_strlen_zero(user->mohsuggest))
         ast_string_field_set(iaxs[callno], mohsuggest, user->mohsuggest);
      if (user->amaflags)
         iaxs[callno]->amaflags = user->amaflags;
      if (!ast_strlen_zero(user->language))
         ast_string_field_set(iaxs[callno], language, user->language);
      ast_copy_flags(iaxs[callno], user, IAX_NOTRANSFER | IAX_TRANSFERMEDIA | IAX_USEJITTERBUF | IAX_FORCEJITTERBUF);   
      /* Keep this check last */
      if (!ast_strlen_zero(user->dbsecret)) {
         char *family, *key=NULL;
         char buf[80];
         family = ast_strdupa(user->dbsecret);
         key = strchr(family, '/');
         if (key) {
            *key = '\0';
            key++;
         }
         if (!key || ast_db_get(family, key, buf, sizeof(buf)))
            ast_log(LOG_WARNING, "Unable to retrieve database password for family/key '%s'!\n", user->dbsecret);
         else
            ast_string_field_set(iaxs[callno], secret, buf);
      } else
         ast_string_field_set(iaxs[callno], secret, user->secret);
      res = 0;
      user = user_unref(user);
   } else {
       /* user was not found, but we should still fake an AUTHREQ.
        * Set authmethods to the last known authmethod used by the system
        * Set a fake secret, it's not looked at, just required to attempt authentication.
        * Set authrej so the AUTHREP is rejected without even looking at its contents */
      iaxs[callno]->authmethods = last_authmethod ? last_authmethod : (IAX_AUTH_MD5 | IAX_AUTH_PLAINTEXT);
      ast_string_field_set(iaxs[callno], secret, "badsecret");
      iaxs[callno]->authrej = 1;
      if (!ast_strlen_zero(iaxs[callno]->username)) {
         /* only send the AUTHREQ if a username was specified. */
         res = 0;
      }
   }
   ast_set2_flag(iaxs[callno], iax2_getpeertrunk(*sin), IAX_TRUNK);  
   return res;
}

static int raw_hangup(struct sockaddr_in *sin, unsigned short src, unsigned short dst, int sockfd)
{
   struct ast_iax2_full_hdr fh;
   fh.scallno = htons(src | IAX_FLAG_FULL);
   fh.dcallno = htons(dst);
   fh.ts = 0;
   fh.oseqno = 0;
   fh.iseqno = 0;
   fh.type = AST_FRAME_IAX;
   fh.csub = compress_subclass(IAX_COMMAND_INVAL);
   if (iaxdebug)
       iax_showframe(NULL, &fh, 0, sin, 0);
   if (option_debug)
      ast_log(LOG_DEBUG, "Raw Hangup %s:%d, src=%d, dst=%d\n",
         ast_inet_ntoa(sin->sin_addr), ntohs(sin->sin_port), src, dst);
   return sendto(sockfd, &fh, sizeof(fh), 0, (struct sockaddr *)sin, sizeof(*sin));
}

static void merge_encryption(struct chan_iax2_pvt *p, unsigned int enc)
{
   /* Select exactly one common encryption if there are any */
   p->encmethods &= enc;
   if (p->encmethods) {
      if (p->encmethods & IAX_ENCRYPT_AES128)
         p->encmethods = IAX_ENCRYPT_AES128;
      else
         p->encmethods = 0;
   }
}

/*!
 * \pre iaxsl[call_num] is locked
 *
 * \note Since this function calls send_command_final(), the pvt struct for the given
 *       call number may disappear while executing this function.
 */
static int authenticate_request(int call_num)
{
   struct iax_ie_data ied;
   int res = -1, authreq_restrict = 0;
   char challenge[10];
   struct chan_iax2_pvt *p = iaxs[call_num];

   memset(&ied, 0, sizeof(ied));

   /* If an AUTHREQ restriction is in place, make sure we can send an AUTHREQ back */
   if (ast_test_flag(p, IAX_MAXAUTHREQ)) {
      struct iax2_user *user, tmp_user = {
         .name = p->username, 
      };

      user = ao2_find(users, &tmp_user, OBJ_POINTER);
      if (user) {
         if (user->curauthreq == user->maxauthreq)
            authreq_restrict = 1;
         else
            user->curauthreq++;
         user = user_unref(user);
      }
   }

   /* If the AUTHREQ limit test failed, send back an error */
   if (authreq_restrict) {
      iax_ie_append_str(&ied, IAX_IE_CAUSE, "Unauthenticated call limit reached");
      iax_ie_append_byte(&ied, IAX_IE_CAUSECODE, AST_CAUSE_CALL_REJECTED);
      send_command_final(p, AST_FRAME_IAX, IAX_COMMAND_REJECT, 0, ied.buf, ied.pos, -1);
      return 0;
   }

   iax_ie_append_short(&ied, IAX_IE_AUTHMETHODS, p->authmethods);
   if (p->authmethods & (IAX_AUTH_MD5 | IAX_AUTH_RSA)) {
      snprintf(challenge, sizeof(challenge), "%d", (int)ast_random());
      ast_string_field_set(p, challenge, challenge);
      /* snprintf(p->challenge, sizeof(p->challenge), "%d", (int)ast_random()); */
      iax_ie_append_str(&ied, IAX_IE_CHALLENGE, p->challenge);
   }
   if (p->encmethods)
      iax_ie_append_short(&ied, IAX_IE_ENCRYPTION, p->encmethods);

   iax_ie_append_str(&ied,IAX_IE_USERNAME, p->username);

   res = send_command(p, AST_FRAME_IAX, IAX_COMMAND_AUTHREQ, 0, ied.buf, ied.pos, -1);

   if (p->encmethods)
      ast_set_flag(p, IAX_ENCRYPTED);

   return res;
}

static int authenticate_verify(struct chan_iax2_pvt *p, struct iax_ies *ies)
{
   char requeststr[256];
   char md5secret[256] = "";
   char secret[256] = "";
   char rsasecret[256] = "";
   int res = -1; 
   int x;