Skip to content

Conversation

@hajekmi
Copy link
Contributor

@hajekmi hajekmi commented Dec 10, 2025

Currently, endpoints created via the PJSIP Config Wizard do not update their ACL rules if the underlying Named ACL (in acl.conf) changes. This occurs because the wizard relies on file timestamp and content caching of pjsip_wizard.conf, which remains unchanged during an external ACL update. As a result, endpoints retain stale ACL rules even after a reload.

This patch updates res_pjsip_config_wizard to subscribe to the ast_named_acl_change_type Stasis event. A local generation counter is incremented whenever an ACL change event is received.

During a reload, the wizard compares the current local generation against the generation stored in the wizard object. If a change is detected:

  1. The file cache optimization (CONFIG_FLAG_FILEUNCHANGED) is bypassed.
  2. Wizard objects utilizing 'acl' or 'contact_acl' are forced to update, ensuring they pick up the new IP rules.

Signed-off-by: Michal Hajek michal.hajek@daktela.com
Fixes: #1641

@phoneben
Copy link
Contributor

phoneben commented Dec 10, 2025

i think cherry-pick should be in a separate comment .
not in the original .

Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Attention! This pull request may contain issues that could prevent it from being accepted. Please review the checklist below and take the recommended action. If you believe any of these are not applicable, just add a comment and let us know.

  • The PR description does not match the commit message body. This can cause confusion for reviewers and future maintainers. GitHub doesn't automatically update the PR description when you update the commit message so if you've updated the commit with a force-push, please update the PR description to match the new commit message body.
  • The PR description and/or commit message has a malformed Fixes or Resolves trailer. The Fixes and Resolves keywords MUST be preceeded by a blank line and followed immediately by a colon, a space, a hash sign(#), and the issue number. If you have multiple issues to reference, you can add additional Fixes and Resolves trailers on consecutive lines as long as the first one has the preceeding blank line. A malformed trailer will prevent the issue from being automatically closed when the PR merges and from being listed in the release change logs.
    Regular expression: ^(Fixes|Resolves): #[0-9]+$.
    Example: Fixes: #9999.

Documentation:

@github-actions github-actions bot added the has-pr-checklist A PR Checklist is present on the PR label Dec 10, 2025
@github-actions
Copy link

Workflow PRCheck completed successfully

@hajekmi
Copy link
Contributor Author

hajekmi commented Dec 10, 2025

cherry-pick-to: 20
cherry-pick-to: 22
cherry-pick-to: 23

@phoneben
Copy link
Contributor

can not be cherry picked to 20 ?

@hajekmi
Copy link
Contributor Author

hajekmi commented Dec 10, 2025

can not be cherry picked to 20 ?

Unfortunately, I don't know... version 20 - I don't know how good the Stasis is there... :)

@jcolp
Copy link
Member

jcolp commented Dec 10, 2025

The specific pattern of subscribing for ACL change events has been in use since 2013.

@hajekmi hajekmi force-pushed the fix_pjsip_wizard_acl_2 branch from 1e7350d to f4969bf Compare December 10, 2025 14:49
@jcolp
Copy link
Member

jcolp commented Dec 10, 2025

21 is security fix only and does not receive bug fixes. You should also not add an additional comment, but edit your existing one.

@github-actions
Copy link

Workflow PRCheck completed successfully

@hajekmi
Copy link
Contributor Author

hajekmi commented Dec 15, 2025

Does my last commit look okay? :)

@jcolp
Copy link
Member

jcolp commented Dec 15, 2025

It has yet to be reviewed, when it is then you'll see updates/comments/etc.

@github-actions
Copy link

github-actions bot commented Jan 7, 2026

Workflow PRCheck failed
master-pjs1: FAILED TEST: channels/pjsip/geolocation/incoming/basic
master-pjs1: FAILED TEST: channels/pjsip/geolocation/incoming/profile_precedence

Currently, endpoints created via the PJSIP Config Wizard do not update
their ACL rules if the underlying Named ACL (in acl.conf) changes.
This occurs because the wizard relies on file timestamp and content
caching of pjsip_wizard.conf, which remains unchanged during an external
ACL update. As a result, endpoints retain stale ACL rules even after
a reload.

This patch updates res_pjsip_config_wizard to subscribe to the
ast_named_acl_change_type Stasis event. A local generation counter is
incremented whenever an ACL change event is received.

During a reload, the wizard compares the current local generation against
the generation stored in the wizard object. If a change is detected:
1. The file cache optimization (CONFIG_FLAG_FILEUNCHANGED) is bypassed.
2. Wizard objects utilizing 'acl' or 'contact_acl' are forced to update,
   ensuring they pick up the new IP rules.

Signed-off-by: Michal Hajek michal.hajek@daktela.com

Fixes: asterisk#1641
@hajekmi hajekmi force-pushed the fix_pjsip_wizard_acl_2 branch from 7161035 to d66cff4 Compare January 9, 2026 08:46
@github-actions
Copy link

github-actions bot commented Jan 9, 2026

Workflow PRCheck failed
master-pjs1: FAILED TEST: channels/pjsip/geolocation/incoming/basic
master-pjs1: FAILED TEST: channels/pjsip/geolocation/incoming/profile_precedence
master-pjs1: FAILED TEST: channels/pjsip/message/message_redirect
master-pjs1: FAILED TEST: channels/pjsip/message/message_redirect_multiple
master-pjs2: FAILED TEST: channels/pjsip/transfers/attended_transfer/nominal/callee_local

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

has-pr-checklist A PR Checklist is present on the PR pr-submit-tests-failed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[bug]: res_pjsip_config_wizard: Endpoints fail to update when Named ACLs change after reload

3 participants