Siproxd is not affected by the Log4Shell vulnerability.

CVE-2021-44228: Apache Log4j 2 JNDI features do not protect against attacker-controlled LDAP and other JNDI related endpoints

Siproxd, as packaged by the siproxd project, is written primarily in C and does not include any JAVA components. Therefore, it is not affected by the Log4Shell vulnerability.

If you use siproxd with any 3rd party addons or appliances, please check with the respective suppliers if they are affected by Log4Shell.

Siproxd code is now available at GitHub: https://github.com/hb9xar/siproxd

And finally - it's time again for a release. This release includes performance improvements and various bugfixes. Also some new plug-ins have been included. Check the release notes for more details on what's new!

In August 2002, the first siproxd release (0.1.0) was published. So this year siproxd does celebrate its 15th anniversary.

15 years ago, starting to play around with VoIP and SIP, I did not find any usable and reliable way to deal with NAT issues. Forget about STUN and all the obscure guesswork of clients just did not work. There was a kenrel module

"Bah, it can't be *that* difficult - lets just do it myself." - that's how it began.

No, we wre not dead!

A long time has gone by since the last official siproxd release. But development has not stood still. But behind the curtains of public releases, work has continued and some exciting new features have been implemented.

Check the release notes for more details on what's new!

This release fixes some bugs, one of them concerns building (libltdl). As a feature for small embedded systems, the pthread stack size is configurable to minimize the memory footprint (RAM). Another highlight is the new plugin_regex that allows rewriting the SIP "To" header (call target) of outgoing calls using regular expressions.

As the Bug Tracker is increasingly mis-used to deposit SPAM and other useless stuff, it is now required to login to sourceforge before being able to add a bug report or support request. Anonymous postings are no longer posible.
Sorry for the inconvenience.

This release fixes CVE-2009-3736, includes a better handling of symmetric RTP and provides support for the UPDATE method. Everybody, please move ahead to this version.

Siproxd does include a so called convenience copy of libldtl. Recently a local privilege escalation issue has been found and reported:

"ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file."

Find out more about CVE-2009-3736 from MITRE CVE.

Two measures have been implemented with siproxd:
- Siproxd does use a system provided libltdl, if available. The included convenienve copy will only be used as a fallback if no libltdl is provided on the building host.
- The included convenience copy in the siproxd package has been updated to a version that has this issue fixed.

Upgrade either to the current snapshot version of siproxd or stay tuned for the next release (0.8.0) that will be coming shortly.

This siproxd release includes some STP related bugfixes (dropped RTP streams). Please move ahead to this version.

Current siproxd snapshots will again build under Cygwin - including plugins. The plugins are statically linked in using libltdl mechanisms. Configurationwise there is no difference for the user (the plugins must still be loaded from the configuration file).

Libosip2 has to be linked in statically:

./configure --enable-static-libosip2

Note: The Cygwin packages minires and minires-devel packages must be installed to have siproxd build properly (resolve.c).

Second Note: The fact that siproxd does build under Cygwin does not mean that Windows OS is officially supported or will be supported in future. If you use siproxd with Cygwin you are on your own, no official support will be provided from the siproxd development team.

This siproxd release introduces dynamically loadable plug-ins. The API consists of 3 mandatory functions that a plug-in has to implement. A plugin can take control at every important point of the processing. Siproxd now builds with libosip2-3.1.x - some function names have been renamed.

Libosip2-3.1.x contains some changes in function names (MD5 related functions). This causes siproxd-0.7.0 compilation to fail. The next release of siproxd will include detection of what set of MD5 functions is present and compile properly again. Meanwhile please use the latest siproxd snapshot or a version of libosip2 that is pre 3.1.

Siproxd will get a new plugin API. Plugins will be dynamic loadable libraries that are loaded during runtime. What plugins are loaded and the load order are given in the siproxd configuration file. This will make it easier for those of you that want to add new functionality to siproxd. So go ahead and have a look at it (check the current snapshot).
Your imagination is the limit. Register SIP call records in a database, a simple costing/billing plugin, CID masquerading - just to mention a few ideas.

Minor changes and some fixes are included in the 0.6.1 release.

Note: This is the last release supporting libosip2-2.x.x.

With the next release of siproxd (0.7.0) we will switch to the new version 3 of libosip2. Siproxd 0.7.0 is functionally equivalent to 0.6.1 with the only difference of using the new libosip2 version.

If you can, upgrade directly to siproxd 0.7.0 with the new libosip2 library. If for some reason you cannot yet update your libosip2 use siproxd-0.6.1.

voipnow.org has as quiet nice overview of VoIP applications and resources that are available.
"74 Open Source VoIP Apps & Resources" covers the H.323, SIP, IAX and RTP protocols and include clients, libraries, gatekeepers, and any other open source resource available for those specific protocols plus PBX and IVR platforms.

Binaries for the on(e)-disk-router fli4l are available here. The binaries are provided "as is" and have not yet been tested.

Note: The TAR archive only contains the siproxd binary itself and not the full OPT_SIP package.