@@ -18,7 +18,7 @@ auto_gen=lex.yy.c cfg.tab.c   #lexx, yacc etc

 #include  source related defs

 include Makefile.sources

-override exclude_modules:=CVS cpl cpl-c ext radius_acc radius_auth snmp \

+override exclude_modules:=CVS cpl cpl-c ext radius_acc radius_auth snmp jabber sms pa extcmd msilo auth \

 	$(exclude_modules)

 static_modules=

 static_modules_path=$(addprefix modules/, $(static_modules))

@@ -175,8 +175,6 @@ DEFS+= -DNAME='"$(NAME)"' -DVERSION='"$(RELEASE)"' -DARCH='"$(ARCH)"' \

 	 -DADAPTIVE_WAIT -DADAPTIVE_WAIT_LOOPS=1024 \

 	 -DDNS_IP_HACK \

 	 -DUSE_IPV6 \

-	 -DVOICE_MAIL \

-	 -D_TOTAG \

 	 -DUSE_TCP \

 	 -DDISABLE_NAGLE \

 	 -DDIGEST_DOMAIN \

@@ -197,7 +195,7 @@ DEFS+= -DNAME='"$(NAME)"' -DVERSION='"$(RELEASE)"' -DARCH='"$(ARCH)"' \

 	 #-DNO_LOG

 #PROFILE=  -pg #set this if you want profiling

-#mode = debug

+mode = debug

 ifeq ($(mode),)

 	mode = release

 endif

@@ -55,7 +55,7 @@ else

 fi

 # address of user wishing to initiate conversation

 if [ -z "$1" ] ; then

-	URI="sip:113311@192.168.2.16"

+	URI="sip:44@192.168.2.16"

 	echo "caller unspecified -- taking default value $URI"

 else

 	URI="$1"

@@ -43,12 +43,26 @@

 #include "t_cancel.h"

 #include "t_stats.h"

+static enum kill_reason kr;

+

 /* pointer to the big table where all the transaction data

    lives

 */

 static struct s_table*  tm_table;

+void set_kr( enum kill_reason _kr )

+{

+	if (kr!=0 && _kr!=0) {

+			DBG("DEBUG: set_kr: kill reason reset: "

+					"old=%d update=%d\n", kr, _kr );

+	}

+	kr|=_kr;

+}

+enum kill_reason get_kr() {

+	return kr;

+}

+

 void lock_hash(int i) 

 {

 	lock(&tm_table->entrys[i].mutex);

@@ -84,6 +98,7 @@ void free_cell( struct cell* dead_cell )

 	char *b;

 	int i;

 	struct sip_msg *rpl;

+	struct totag_elem *tt, *foo;

 	release_cell_lock( dead_cell );

 	shm_lock();

@@ -116,6 +131,15 @@ void free_cell( struct cell* dead_cell )

 		}

 	}

+	/* collected to tags */

+	tt=dead_cell->fwded_totags;

+	while(tt) {

+		foo=tt->next;

+		shm_free_unsafe(tt->tag.s);

+		shm_free_unsafe(tt);

+		tt=foo;

+	}

+

 	/* the cell's body */

 	shm_free_unsafe( dead_cell );

@@ -158,6 +182,9 @@ struct cell*  build_cell( struct sip_msg* p_msg )

 	/*fprintf(stderr,"before clone VIA |%.*s|\n",via_len(p_msg->via1),

 		via_s(p_msg->via1,p_msg));*/

+	callback_event(TMCB_REQUEST_IN, new_cell, p_msg, 

+			p_msg ? p_msg->REQ_METHOD : METHOD_UNDEF );

+

 	if (p_msg) {

 		new_cell->uas.request = sip_msg_cloner(p_msg);

 		if (!new_cell->uas.request)

@@ -120,10 +120,16 @@ typedef struct ua_server

 	struct sip_msg   *request;

 	struct retr_buf  response;

 	unsigned int     status;

+	/* keep to-tags for local 200 replies for INVITE -- 

+	 * we need them for dialog-wise matching of ACKs;

+	 * the pointer shows to shmem-ed reply */

+	str				 local_totag;

 #ifdef _TOTAG

 	str              to_tag;

 #endif

+#ifdef _OBSO

 	unsigned int     isACKed;

+#endif

 }ua_server_type;

@@ -151,6 +157,11 @@ typedef struct ua_client

 }ua_client_type;

+struct totag_elem {

+	str tag;

+	short acked;

+	struct totag_elem *next;

+};

 /* transaction context */

@@ -205,7 +216,8 @@ typedef struct cell

 	/* number of forks */

 	int nr_of_outgoings;

-	/* nr of replied branch */

+	/* nr of replied branch; 0..MAX_BRANCHES=branch value,

+	 * -1 no reply, -2 local reply */

 	int relaied_reply_branch;

 	/* UA Server */

 	struct ua_server  uas;

@@ -221,16 +233,9 @@ typedef struct cell

 	   dropping when C timer hits

 	*/

 	int noisy_ctimer;

-	/* is it a local transaction ? */

+	/* is it a local UAC transaction ? */

 	int local;

-#ifdef _XWAIT

-	/* protection against reentering WAIT state */

-	ser_lock_t	wait_mutex;

-	/* has the transaction been put on wait status ? */

-	int on_wait;

-#endif

-

 	/* MD5checksum  (meaningful only if syn_branch=0 */

 	char md5[MD5_LEN];

@@ -239,7 +244,12 @@ typedef struct cell

 	short damocles;

 #endif

 	/* has the transaction been scheduled to die? */

-	enum kill_reason kr;

+/*	enum kill_reason kr; */

+

+	/* to-tags of 200/INVITEs which were received from downstream and 

+	 * forwarded or passed to UAC; note that there can be arbitrarily 

+	 * many due to downstream forking; */

+	struct totag_elem *fwded_totags;

 }cell_type;

@@ -266,14 +276,9 @@ struct s_table

 	struct entry   entrys[ TABLE_ENTRIES ];

 };

-inline static void set_kr( struct cell *t, enum kill_reason kr )

-{

-	if (t->kr!=0) {

-		LOG(L_ERR, "ERROR: set_kr: kill_reason reset: from=%d to=%d\n",

-		t->kr, kr);

-	}

-	t->kr|=kr;

-}

+

+void set_kr( enum kill_reason kr );

+enum kill_reason get_kr();

 struct s_table* get_tm_table();

 struct s_table* init_hash_table();

@@ -101,7 +101,7 @@ void tm_shutdown()

 */

 int t_release_transaction( struct cell *trans )

 {

-	set_kr(trans,REQ_RLSD);

+	set_kr(REQ_RLSD);

 	reset_timer( & trans->uas.response.fr_timer );

 	reset_timer( & trans->uas.response.retr_timer );

@@ -92,10 +92,12 @@ int send_pr_buffer( struct retr_buf *rb,

 	UNREF_UNSAFE(_T_cell); \

 	UNLOCK_HASH( (_T_cell)->hash_index ); })

 #define REF_UNSAFE(_T_cell) ({  (_T_cell)->ref_count++; })

+#ifdef _OBSO

 #define REF(_T_cell) ({ \

 	LOCK_HASH( (_T_cell)->hash_index ); \

 	REF_UNSAFE(_T_cell); \

 	UNLOCK_HASH( (_T_cell)->hash_index ); })

+#endif

 #define INIT_REF_UNSAFE(_T_cell) (_T_cell)->ref_count=1

 #define IS_REFFED_UNSAFE(_T_cell) ((_T_cell)->ref_count!=0)

@@ -111,19 +113,14 @@ void tm_shutdown();

 int  t_add_transaction( struct sip_msg* p_msg  );

-/* returns 1 if everything was OK or -1 for error

- */

+/* returns 1 if everything was OK or -1 for error */

 int t_release_transaction( struct cell *trans );

-/* int forward_serial_branch(struct cell* Trans,int branch); */

-int t_put_on_wait(  struct cell  *Trans  );

 int get_ip_and_port_from_uri( str* uri , unsigned int *param_ip,

 	unsigned int *param_port);

-int t_newtran( struct sip_msg* p_msg );

-

 void put_on_wait(  struct cell  *Trans  );

 void start_retr( struct retr_buf *rb );

@@ -75,7 +75,7 @@ char *print_uac_request( struct cell *t, struct sip_msg *i_req,

 	i_req->new_uri=*uri;

 	/* ... give apps a chance to change things ... */

-	callback_event( TMCB_REQUEST_OUT, t, i_req, -i_req->REQ_METHOD);

+	callback_event( TMCB_REQUEST_FWDED, t, i_req, -i_req->REQ_METHOD);

 	/* ... and build it now */

 	buf=build_req_buf_from_sip_req( i_req, len, send_sock, i_req->rcv.proto );

@@ -110,6 +110,45 @@ error01:

 	return shbuf;

 }

+/* introduce a new uac, which is blind -- it only creates the

+   data structures and starts FR timer, but that's it; it does

+   not print messages and send anything anywhere; that is good

+   for FIFO apps -- the transaction must look operationally

+   and FR must be ticking, whereas the request is "forwarded"

+   using a non-SIP way and will be replied the same way

+*/

+int add_blind_uac( /*struct cell *t*/ )

+{

+	unsigned short branch;

+	struct cell *t;

+

+	t=get_t();

+	if (t==T_UNDEFINED || !t ) {

+		LOG(L_ERR, "ERROR: add_blind_uac: no transaction context\n");

+		return -1;

+	}

+

+	branch=t->nr_of_outgoings;	

+	if (branch==MAX_BRANCHES) {

+		LOG(L_ERR, "ERROR: add_blind_uac: "

+			"maximum number of branches exceeded\n");

+		return -1;

+	}

+	/* make sure it will be replied */

+	t->noisy_ctimer=1; 

+	t->nr_of_outgoings++;

+	/* start FR timer -- protocol set by default to PROTO_NONE,

+       which means retransmission timer will not be started

+    */

+	start_retr(&t->uac[branch].request);

+	/* we are on a timer -- don't need to put on wait on script

+	   clean-up	

+	*/

+	set_kr(REQ_FWDED); 

+

+	return 1; /* success */

+}

+

 /* introduce a new uac to transaction; returns its branch id (>=0)

    or error (<0); it doesn't send a message yet -- a reply to it

    might interfere with the processes of adding multiple branches

@@ -343,7 +382,7 @@ int t_forward_nonack( struct cell *t, struct sip_msg* p_msg ,

 	/* make -Wall happy */

 	current_uri.s=0;

-	set_kr(t, REQ_FWDED);

+	set_kr(REQ_FWDED);

 	if (p_msg->REQ_METHOD==METHOD_CANCEL) {

 		t_invite=t_lookupOriginalT(  p_msg );

@@ -40,6 +40,7 @@

 #include "../../proxy.h"

 typedef int (*tfwd_f)(struct sip_msg* p_msg , struct proxy_l * proxy );

+typedef int (*taddblind_f)( /*struct cell *t */ );

 int t_replicate(struct sip_msg *p_msg, struct proxy_l * proxy, int proto);

 char *print_uac_request( struct cell *t, struct sip_msg *i_req,

@@ -48,6 +49,7 @@ void e2e_cancel( struct sip_msg *cancel_msg, struct cell *t_cancel, struct cell

 int e2e_cancel_branch( struct sip_msg *cancel_msg, struct cell *t_cancel, struct cell *t_invite, int branch );

 int add_uac(	struct cell *t, struct sip_msg *request, str *uri,

 				struct proxy_l *proxy, int proto );

+int add_blind_uac( /* struct cell *t */ );

 int t_forward_nonack( struct cell *t, struct sip_msg* p_msg,

 						struct proxy_l * p, int proto);

 int t_forward_ack( struct sip_msg* p_msg );

@@ -35,83 +35,95 @@

 struct sip_msg;

 struct cell;

-typedef enum { TMCB_REPLY,  TMCB_E2EACK, TMCB_REPLY_IN, 

-	TMCB_REQUEST_OUT, TMCB_LOCAL_COMPLETED, TMCB_ON_NEGATIVE,

-	TMCB_END } tmcb_type;

+typedef enum { 

+		/* input events */

+		TMCB_RESPONSE_IN=1, TMCB_REQUEST_IN, TMCB_E2EACK_IN, 

+		/* routing decisions in progress */

+		TMCB_REQUEST_FWDED, TMCB_RESPONSE_FWDED, TMCB_ON_FAILURE,

+		/* completion events */

+		TMCB_RESPONSE_OUT, TMCB_LOCAL_COMPLETED, 

+		TMCB_END } tmcb_type;

 /* 

-	TMCB_REPLY	-  a reply has been sent out

-	  no chance to change anything in the message; 

-	  still good enough for many uses, such as accounting

-	  of completed transactions; note well that the message

-	  passed to the callback may also have value FAKED_REPLY,

-	  i.e., refering to it will segfault

-	TMCB_REPLY_IN - a reply was received and is about to be forwarded;

-	  compared to TMCB_REPLY, it is a very internal callback and

-	  you should use it with lot of caution

-	  - it allows you to change the message (called before printing

-	    the relayed message)

-	  - it is called from a reply lock -- it is mroe dangerous and

-	    anything you do makes the processes spend more time in

-	    the lock, decreasing overall performance

-	  - is is called only for replies >100, <300 (final replies

-	    might be cached on forking, stored in shmem -- then, there

-		is no more easy way to change messages)

-	  - as it is called before printing and forwarding, there is

-	    no guarantee the message will be sent out -- either can

-	    fail

-

-		Note: none of the reply callbacks will be evoked if

-		"silent C timer" hits. Silent C timer is a feature which

-		prevents cancellation of a call in progress by a server

-		in the middle, when C timer expires. On one side, 

-		INVITE transactional state cannot be kept for ever,

-		on the other side you want to allow long ringing 

-		uninterrupted by a proxy server. The silent_c feature

-		-- if circumstances allow -- simply discards transaction

-		state when C timer hits, the transaction can then complete

-		statelessly. Then, however, the stateful callback will

-		NOT be called. If you do not wish this behaviour (e.g.,

-		for sake of transaction accounting, in which you do

-		not desire users to wait until silent C hits and

-		eventually complete an unaccounted transaction), turn

-		silent C off either globaly (TM option "noisy_ctimer"

-		set to 1) or for a specific transaction (you can for

-		example set the transaction member "noisy_timer"

-		from request callback.)

-

-	TMCB_E2EACK - presumably, an end2end ACK was received and

-		is about to be processed statelessly; you better don't

-	    use this callback as there is no reliable way to match

-	    an e2e ACK to an INVITE transaction, we just try it for

-	    those, who believe they can't live without knowing about

-	    the ACK; There are more reasons why the e2e ACK callback

-	    is never triggered: 1) the e2eACK does not pass the server

-	    at all 2) the e2e ACK does not match an INVITE transaction

-		because its r-uri or via is different

-	TMCB_REQUEST_OUT - a request was received and is about to be fwd-ed;

-		it is not called on retransmissions; it is called prior to

-		printing the relayed message, i.e., changes to it can

-		be done

-	TMCB_LOCAL_COMPLETED - a local transaction completed; note that

-	    the callback parameter may be FAKED_REPLY

-	TMCB_MISSED -- transaction was replied with a negative value;

-		called from within a REPLY_LOCK, message may be FAKED_REPLY

-	TMCB_ON_NEGATIVE -- called whenever a transaction is about to complete

-	    with a negative result; it's a great time to introduce a new

-	    uac (serial forking) or change the reply code; be cautions

-	    though -- it is called from within REPLY_LOCK and careless

-	    usage of the callback can easily result in a deadlock; msg

-	    is always 0 (callback refers to whole transaction and not

-	    to individual message), code is the currently lowest status

-	    code

-	TMCB_END	- just a bumper

+ *  Caution: most of the callbacks work with shmem-ized messages

+ *  which you can no more change (e.g., lumps are fixed). Most

+ *  reply-processing callbacks are also called from a mutex,

+ *  which may cause deadlock if you are not careful. Also, reply

+ *  callbacks may pass the value of FAKED_REPLY messages, which

+ *  is a non-dereferencable pointer indicating that no message

+ *  was received and a timer hit instead.

+ *

+ *  Callback description:

+ *  ---------------------

+ *

+ * TMCB_REQUEST_IN -- a brand-new request was received and is

+ * about to establish transaction; it is not yet cloned and

+ * lives in pkg mem -- your last chance to mangle it before

+ * it gets shmem-ized (then, it's read-only); it's called from

+ * HASH_LOCK, so be careful. It is guaranteed not to be

+ * a retransmission.

+ *

+ * TMCB_RESPONSE_IN -- a brand-new reply was received which matches

+ * an existing transaction. It may or may not be a retranmisssion.

+ *

+ *  TMCB_RESPONSE_OUT -- a final reply was sent out (eiter local 

+ *  or proxied) -- there is nothing more you can change from

+ *  the callback, it is good for accounting-like uses.

+ *

+ *    Note: the message passed to callback may also have

+ *    value FAKED_REPLY (like other reply callbacks) which

+ *    indicates a psedo_reply caused by a timer. Check for

+ *    this value before derefing -- you will cause a segfault

+ *    otherwise.

+ *

+ *  TMCB_ON_FAILURE -- called on receipt of a reply or timer;

+ *  it means all branches completed with a failure; that's 

+ *  a chance for example to add new transaction branches

+ *

+ *  TMCB_RESPONSE_FWDED -- called when a reply is about to be

+ *  forwarded; it is called after a message is received but before

+ *  a message is sent out: it is called when the decision is 

+ *  made to forward a reply; it is parametrized by pkg message 

+ *  which caused the transaction to complete (which is not 

+ *  necessarily the same which will be forwarded). As forwarding

+ *  has not been executed and may fail, there is no guarentee

+ *  a reply will be successfuly sent out at this point of time.

+ *

+ *     Note: TMCB_REPLY_ON_FAILURE and TMCB_REPLY_FWDED are

+ *     called from reply mutex which is used to deterministically

+ *     process multiple replies received in parallel. A failure

+ *     to set the mutex again or stay too long in the callback

+ *     may result in deadlock.

+ *

+ *     Note: the reply callbacks will not be evoked if "silent

+ *     C-timer hits". That's a feature to clean transactional

+ *     state from a proxy quickly -- transactions will then

+ *     complete statelessly. If you wish to disable this

+ *     feature, either set the global option "noisy_ctimer"

+ *     to 1, or set t->noisy_ctimer for selected transaction.

+ *

+ *  TMCB_E2EACK_IN -- called when an ACK belonging to a proxied

+ *  INVITE transaction completed with 200 arrived. Note that

+ *  because it can be only dialog-wise matched, only the first

+ *  transaction occurence will be matched with spirals. If

+ *  record-routing is not enabled, you will never receive the

+ *  ACK and the callback will be never triggered.

+ *

+ *

+ *  TMCB_REQUEST_FWDED -- request is being forwarded out. It is 

+ *  called before a message is forwarded and it is your last

+ *  chance to change its shape. 

+ *

+ *  TMCB_LOCAL COMPLETED -- final reply for localy initiated

+ *  transaction arrived. Message may be FAKED_REPLY.

+ *

+ *  TMCB_END	- just a bumper

 	see the 'acc' module for an example of callback usage

 	note that callbacks MUST be installed before forking

     (callback lists do not live in shmem and have no access

-	protection)

+	protection), i.e., at best from mod_init functions.

 */

 typedef void (transaction_cb) ( struct cell* t, struct sip_msg* msg, 

@@ -71,6 +71,7 @@

 #include "../../dprint.h"

 #include "../../config.h"

 #include "../../parser/parser_f.h"

+#include "../../parser/parse_from.h"

 #include "../../ut.h"

 #include "../../timer.h"

 #include "../../hash_func.h"

@@ -141,54 +142,178 @@ struct cell *get_t() { return T; }

 void set_t(struct cell *t) { T=t; }

 void init_t() {global_msg_id=0; set_t(T_UNDEFINED);}

+static inline int parse_dlg( struct sip_msg *msg )

+{

+	if (parse_headers(msg, HDR_FROM | HDR_CSEQ | HDR_TO, 0)==-1) {

+		LOG(L_ERR, "ERROR: tid_matching: From or Cseq or To invalid\n");

+		return 0;

+	}

+	if (parse_from_header(msg)==-1) {

+		LOG(L_ERR, "ERROR: tid_matching: From broken\n");

+		return 0;

+	}

+	/* To is automatically parsed through HDR_TO in parse bitmap,

+	 * we don't need to worry about it now

+	if (parse_to_header(msg)==-1) {

+		LOG(L_ERR, "ERROR: tid_matching: To broken\n");

+		return 0;

+	}

+	*/

+	return 1;

+}

+

+/* is the ACK (p_msg) in p_msg dialog-wise equal to the INVITE (t_msg) 

+ * except to-tags? */

+static inline int partial_dlg_matching(struct sip_msg *t_msg, struct sip_msg *p_msg)

+{

+	struct to_body *inv_from;

+

+	if (!EQ_LEN(callid)) return 0;

+	if (get_cseq(t_msg)->number.len!=get_cseq(p_msg)->number.len)

+		return 0;

+	inv_from=get_from(t_msg);

+	if (!inv_from) {

+		LOG(L_ERR, "ERROR: partial_dlg_matching: INV/From not parsed\n");

+		return 0;

+	}

+	if (inv_from->tag_value.len!=get_from(p_msg)->tag_value.len)

+		return 0;

+	if (!EQ_STR(callid)) 

+		return 0;

+	if (memcmp(get_cseq(t_msg)->number.s, get_cseq(p_msg)->number.s,

+			get_cseq(p_msg)->number.len)!=0)

+		return 0;

+	if (memcmp(inv_from->tag_value.s, get_from(p_msg)->tag_value.s,

+			get_from(p_msg)->tag_value.len)!=0)

+		return 0;

+	return 1;

+}

+

+/* are to-tags in ACK/200 same as those we sent out? */

+static inline int dlg_matching(struct cell *p_cell, struct sip_msg *ack )

+{

+	if (get_to(ack)->tag_value.len!=p_cell->uas.local_totag.len)

+		return 0;

+	if (memcmp(get_to(ack)->tag_value.s,p_cell->uas.local_totag.s,

+				p_cell->uas.local_totag.len)!=0)

+		return 0;

+	return 1;

+}

+

+static inline int ack_matching(struct cell *p_cell, struct sip_msg *p_msg) 

+{

+	/* partial dialog matching -- no to-tag, only from-tag, 

+	 * callid, cseq number ; */

+	if (!partial_dlg_matching(p_cell->uas.request, p_msg)) 

+		return 0;

+

+  	/* if this transaction is proxied (as opposed to UAS) we're

+	 * done now -- we ignore to-tags; the ACK simply belongs to

+	 * this UAS part of dialog, whatever to-tag it gained

+	 */

+	if (p_cell->relaied_reply_branch!=-2) {

+		return 2; /* e2e proxied ACK */

+	}

+	/* it's a local dialog -- we wish to verify to-tags too */

+	if (dlg_matching(p_cell, p_msg)) {

+		return 1;

+	}

+	return 0;

+}

+

+/* branch-based transaction matching */

+static inline int via_matching( struct via_body *inv_via, 

+				struct via_body *ack_via )

+{

+	if (inv_via->tid.len!=ack_via->tid.len)

+		return 0;

+	if (memcmp(inv_via->tid.s, ack_via->tid.s,

+				ack_via->tid.len)!=0)

+		return 0;

+	/* ok, tid matches -- now make sure that the

+	 * originater matches too to avoid confusion with

+	 * different senders generating the same tid

+	 */

+	if (inv_via->host.len!=ack_via->host.len)

+		return 0;;

+	if (memcmp(inv_via->host.s, ack_via->host.s,

+			ack_via->host.len)!=0)

+		return 0;

+	if (inv_via->port!=ack_via->port)

+		return 0;

+	if (inv_via->transport.len!=ack_via->transport.len)

+		return 0;

+	if (memcmp(inv_via->transport.s, ack_via->transport.s,

+			ack_via->transport.len)!=0)

+		return 0;

+	/* everything matched -- we found it */

+	return 1;

+}

+

 /* transaction matching a-la RFC-3261 using transaction ID in branch

- * (the function assumes there is magic cookie in branch) */

+   (the function assumes there is magic cookie in branch) 

+   It returns:

+	 2 if e2e ACK for a proxied transaction found

+     1  if found (covers ACK for local UAS)

+	 0  if not found (trans undefined)

+*/

-static struct cell *tid_matching( int hash_index, 

-		struct via_body *via1, 

-		enum request_method skip_method)

+static int matching_3261( struct sip_msg *p_msg, struct cell **trans,

+			enum request_method skip_method)

 {

 	struct cell *p_cell;

 	struct sip_msg  *t_msg;

+	struct via_body *via1;

+	int is_ack;

+	int dlg_parsed;

+	int ret;

-

+	via1=p_msg->via1;

+	is_ack=p_msg->REQ_METHOD==METHOD_ACK;

+	dlg_parsed=0;

 	/* update parsed tid */

 	via1->tid.s=via1->branch->value.s+MCOOKIE_LEN;

 	via1->tid.len=via1->branch->value.len-MCOOKIE_LEN;

-	for ( p_cell = get_tm_table()->entrys[hash_index].first_cell;

+	for ( p_cell = get_tm_table()->entrys[p_msg->hash_index].first_cell;

 		p_cell; p_cell = p_cell->next_cell ) 

 	{

 		t_msg=p_cell->uas.request;

 		if (skip_method & t_msg->REQ_METHOD)

 			continue;

-		if (t_msg->via1->tid.len!=via1->tid.len)

-			continue;

-		if (memcmp(t_msg->via1->tid.s, via1->tid.s,

-				via1->tid.len)!=0)

-			continue;

-		/* ok, tid matches -- now make sure that the

-		 * originater matches too to avoid confusion with

-		 * different senders generating the same tid

-		 */

-		if (via1->host.len!=t_msg->via1->host.len)

-			continue;

-		if (memcmp(via1->host.s, t_msg->via1->host.s,

-					via1->host.len)!=0)

-			continue;

-		if (via1->port!=t_msg->via1->port)

-			continue;

-		if (via1->transport.len!=t_msg->via1->transport.len)

+

+		/* dialog matching needs to be applied for ACK/200s */

+		if (is_ack && p_cell->uas.status<300) {

+			/* make sure we have parsed all things we need for dialog

+			 * matching */

+			if (!dlg_parsed) {

+				dlg_parsed=1;

+				if (!parse_dlg(p_msg)) {

+					LOG(L_ERR, "ERROR: tid_matching: dlg parsing failed\n");

+					return 0;

+				}

+			}

+			ret=ack_matching(p_cell /* t w/invite */, p_msg /* ack */);

+			if (ret>0) {

+				*trans=p_cell;

+				return ret; /* 2: e2e proxied ACK, 1 e2e UAS ACK */

+			}

+			/* this ACK is neither local "negative" one, nor a proxied

+			 * end-2-end one, nor an end-2-end one for a UAS transaction

+			 * -- we failed to match */

 			continue;

-		if (memcmp(via1->transport.s, t_msg->via1->transport.s,

-					via1->transport.len)!=0)

+		}

+		/* now real tid matching occurs  for negative ACKs and any 

+	 	 * other requests */

+		if (!via_matching(t_msg->via1 /* inv via */, via1 /* ack */ ))

 			continue;

 		/* all matched -- we found the transaction ! */

 		DBG("DEBUG: RFC3261 transaction matched, tid=%.*s\n",

 			via1->tid.len, via1->tid.s);

-		return p_cell;

+		*trans=p_cell;

+		return 1;

 	}

 	/* :-( ... we didn't find any */

 	DBG("DEBUG: RFC3261 transaction matching failed\n");

@@ -209,6 +334,7 @@ int t_lookup_request( struct sip_msg* p_msg , int leave_new_locked )

 	struct sip_msg  *t_msg;

 	int ret;

 	struct via_param *branch;

+	int match_status;

 	/* parse all*/

 	if (check_transaction_quadruple(p_msg)==0)

@@ -221,8 +347,7 @@ int t_lookup_request( struct sip_msg* p_msg , int leave_new_locked )

 	/* start searching into the table */

 	if (!p_msg->hash_index)

-		p_msg->hash_index=hash( p_msg->callid->body , 

-			get_cseq(p_msg)->number ) ;

+		p_msg->hash_index=hash( p_msg->callid->body , get_cseq(p_msg)->number ) ;

 	isACK = p_msg->REQ_METHOD==METHOD_ACK;

 	DBG("t_lookup_request: start searching: hash=%d, isACK=%d\n",

 		p_msg->hash_index,isACK);

@@ -245,29 +370,20 @@ int t_lookup_request( struct sip_msg* p_msg , int leave_new_locked )

 			&& memcmp(branch->value.s,MCOOKIE,MCOOKIE_LEN)==0) {

 		/* huhuhu! the cookie is there -- let's proceed fast */

 		LOCK_HASH(p_msg->hash_index);

-		p_cell=tid_matching(p_msg->hash_index, p_msg->via1, 

-				/* skip transactions with different

-				 * method; otherwise CANCEL would 

-				 * match the previous INVITE trans.

-				 */

+		match_status=matching_3261(p_msg,&p_cell, 

+				/* skip transactions with different method; otherwise CANCEL would 

+	 	 		 * match the previous INVITE trans.  */

 				isACK ? ~METHOD_INVITE: ~p_msg->REQ_METHOD);

-		if (p_cell) {

-			/* ACK/200 */

-			if (isACK && p_cell->uas.status>=200 && p_cell->uas.status<300) {

-				/* perhaps there are some spirals on the synonym list, but

-				   it makes no sense to iterate the list until bitter end */

-				t_ack=p_cell;

-				ret=-2;

-				goto notfound;

-			}

-			/* all but 200/ACK */

-			goto found;

-		} 

-		/* new */

-		goto notfound;

+		switch(match_status) {

+				case 0:	goto notfound;	/* no match */

+				case 1:	goto found; 	/* match */

+				case 2:	goto e2e_ack;	/* e2e proxy ACK */

+		}

 	}

-	/* ok -- it's ugly old-fashioned transaction matching */

+	/* ok -- it's ugly old-fashioned transaction matching -- it is

+	 * a bit simplified to be fast -- we don't do all the comparisons

+	 * of parsed uri, which was simply too bloated */

 	DBG("DEBUG: proceeding to pre-RFC3261 transaction matching\n");

 	/* lock the whole entry*/

@@ -303,63 +419,39 @@ int t_lookup_request( struct sip_msg* p_msg , int leave_new_locked )

 			/* ACK's relate only to INVITEs */

 			if (t_msg->REQ_METHOD!=METHOD_INVITE) continue;

+			/* From|To URI , CallID, CSeq # must be always there */

 			/* compare lengths now */

 			if (!EQ_LEN(callid)) continue;

 			/* CSeq only the number without method ! */

 			if (get_cseq(t_msg)->number.len!=get_cseq(p_msg)->number.len)

 				continue;

 			if (! EQ_LEN(from)) continue;

-			/* To only the uri and ... */

+			/* To only the uri -- to many UACs screw up tags  */

 			if (get_to(t_msg)->uri.len!=get_to(p_msg)->uri.len)

 				continue;

-			/* don't care about to-tags -- many UAC screw them

-			 * up anyway, and it doesn't hurt if we ignore 

-			 * them */

-#ifdef ACKTAG

-			/* ... its to-tag compared to reply's tag */

-			if (p_cell->uas.to_tag.len!=get_to(p_msg)->tag_value.len)

-				continue;

-#endif

-

-			/* we first skip r-uri and Via and proceed with

-			   content of other header-fields */

-

-			if ( memcmp(t_msg->callid->body.s, p_msg->callid->body.s,

-				p_msg->callid->body.len)!=0) continue;

-			if ( memcmp(get_cseq(t_msg)->number.s, get_cseq(p_msg)->number.s,

+			if (!EQ_STR(callid)) continue;

+			if (memcmp(get_cseq(t_msg)->number.s, get_cseq(p_msg)->number.s,

 				get_cseq(p_msg)->number.len)!=0) continue;

 			if (!EQ_STR(from)) continue;

 			if (memcmp(get_to(t_msg)->uri.s, get_to(p_msg)->uri.s,

 				get_to(t_msg)->uri.len)!=0) continue;

-#ifdef ACKTAG

-			if (

-#ifdef _BUG

-				p_cell->uas.to_tag.len!=0 /* to-tags empty */ || 

-#endif

-				memcmp(p_cell->uas.to_tag.s, get_to(p_msg)->tag_value.s,

-				p_cell->uas.to_tag.len)!=0) continue;

-#endif

-	

-			/* ok, now only r-uri or via can mismatch; they must match

-			   for non-2xx; if it is a 2xx, we don't try to match

-			   (we might have checked that earlier to speed-up, but

-			   we still want to see a diagnosti message telling

-			   "this ACK presumably belongs to this 2xx transaction";

-			   might change in future); the reason is 2xx ACKs are

-			   a separate transaction which may carry different

-			   r-uri/via1 and is thus also impossible to match it

-			   uniquely to a spiraled transaction;

-			*/

-			if (p_cell->uas.status>=200 && p_cell->uas.status<300) {

-				DBG("DEBUG: an ACK hit a 2xx transaction (T=%p); "

-					"considered mismatch\n", p_cell );

-				/* perhaps there are some spirals on the synonym list, but

-				   it makes no sense to iterate the list until bitter end */

-				t_ack=p_cell;

-				ret=-2;

-				break;

+

+			/* it is e2e ACK/200 */

+			if (p_cell->uas.status<300) {

+				/* all criteria for proxied ACK are ok */

+				if (p_cell->relaied_reply_branch!=-2) 

+					goto e2e_ack;

+				/* it's a local UAS transaction */

+				if (dlg_matching(p_cell, p_msg))

+					goto found;

+				continue;

 			}

-			/* its for a >= 300 ... everything must match ! */

+

+			/* it is not an e2e ACK/200 -- perhaps it is 

+			 * local negative case; in which case we will want

+			 * more elements to match: r-uri and via; allow

+			 * mismatching r-uri as an config option for broken

+			 * UACs */

 			if (ruri_matching && ! EQ_REQ_URI_LEN ) continue;

 			if (! EQ_VIA_LEN(via1)) continue;

 			if (ruri_matching && !EQ_REQ_URI_STR) continue;

@@ -378,12 +470,21 @@ notfound:

 		UNLOCK_HASH(p_msg->hash_index);

 	}

 	DBG("DEBUG: t_lookup_request: no transaction found\n");

-	return ret;

+	return -1;

+

+e2e_ack:

+	t_ack=p_cell;	/* e2e proxied ACK */

+	set_t(0);

+	if (!leave_new_locked) {

+		UNLOCK_HASH(p_msg->hash_index);

+	}

+	DBG("DEBUG: t_lookup_request: e2e proxy ACK found\n");

+	return -2;

 found:

 	set_t(p_cell);

 	REF_UNSAFE( T );

-	set_kr(T, REQ_EXIST);

+	set_kr(REQ_EXIST);

 	UNLOCK_HASH( p_msg->hash_index );

 	DBG("DEBUG: t_lookup_request: transaction found (T=%p)\n",T);

 	return 1;

@@ -402,6 +503,7 @@ struct cell* t_lookupOriginalT(  struct sip_msg* p_msg )

 	unsigned int     hash_index;

 	struct sip_msg  *t_msg;

 	struct via_param *branch;

+	int ret;

 	/* start searching in the table */

@@ -423,12 +525,12 @@ struct cell* t_lookupOriginalT(  struct sip_msg* p_msg )

 			&& memcmp(branch->value.s,MCOOKIE,MCOOKIE_LEN)==0) {

 		/* huhuhu! the cookie is there -- let's proceed fast */

 		LOCK_HASH(hash_index);

-		p_cell=tid_matching(hash_index, p_msg->via1, 

+		ret=matching_3261(p_msg, &p_cell,

 				/* we are seeking the original transaction --