PRACK is sent to the wrong UAS when 100rel is used and the dialog forks (thanks Ruud Klaver for the report)

[bennylp]

Ruud Klaver reports ​this in pjsip mailing list:

First off, let me describe the scenario that led me to this. I have three endpoints, two of which are my application that is using PJSIP, let's call them endpoint A and B. Endpoint C is a third party SIP UA that sets 100rel in the Required header. I am using endpoint A to send an INVITE to a SIP address to which both endpoint B and C have REGISTERed. This leads to the following sequence of events:

• Endpoint B sends a 180 Trying in response to the INVITE
• Endpoint A records the Contact header of endpoint B as target for the dialog
• Endpoint C is a little slower and also sends a 180 Trying, including Required: 100rel
• Endpoint A sends a PRACK in response to the 180 from endpoint C, but puts as the request URI the target recorded for the dialog, which is the URi in the Contact header of endpoint B.
• The PRACK ends up at endpoint B instead of C, which promptly crashes with an assertion failure, as the PJSIP_INV_REQUIRE_100REL option was not set on pjsip_inv_verify_request().

[bennylp]

Fixed in r2271:

• Update the target and routeset on receipt of 1xx response when the To tag is different than current remote tag.
• Reply unexpected PRACK with 400 "Unexpected PRACK" rather than throwing out assertion.

Thanks Ruud for the report.