Skip to content

pjsua: preserve ephemeral TLS and IPv6 ports - #5325

Merged
nanangizz merged 2 commits into
pjsip:masterfrom
cgsmith:fix/pjsua-ephemeral-ports
Oct 9, 2026
Merged

nanangizz merged 2 commits into
pjsip:masterfrom
cgsmith:fix/pjsua-ephemeral-ports

Conversation

@cgsmith

@cgsmith cgsmith commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Description

Closes #5324

When pjsua is configured with --local-port=0, port 0 should be preserved for transports that use automatic port selection.

Currently, pjsua derives IPv6 and TLS transport ports by applying fixed offsets:

  • TCP6: TCP port + 10
  • TLS: TCP port + 1
  • TLS6: TCP port + 10

When the base port is 0, this can result in fixed ports such as 10, 1, or 11 instead of OS-selected ephemeral ports. This may cause startup failures for unprivileged users and makes --local-port=0 behave unexpectedly.

This change applies the offsets only when the configured port is nonzero. Existing behavior for explicitly configured ports is unchanged.

Testing

  • Built pjsua successfully on macOS.

@nanangizz nanangizz left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, the fix works for the --no-udp case. Tested as an unprivileged user on Linux, with --local-port=0:

Options master this PR
--no-udp --use-tls TLS listener: Permission denied (port 1) ephemeral ports
--no-udp --ipv6 --use-tls TCP6 listener: Permission denied (port 10) ephemeral ports
--ipv6 --use-tls (UDP on) UDP6 5060, TCP 5060, TCP6 5070, TLS 5071, TLS6 5080 same

With UDP enabled, the UDP6 block still maps port 0 to a fixed 5060 (udp_cfg.port = 5060), which is then copied into tcp_cfg.port, so none of the new checks apply and every port is fixed. A second instance started the same way fails with "address in use". Could you handle it the same way, i.e. if (udp_cfg.port != 0) udp_cfg.port += 10;? The 5060 dates back to a 2010 SIPit change (3f4b8d7), so it doesn't look like intended behaviour for port 0.

@cgsmith

cgsmith commented Oct 8, 2026

Copy link
Copy Markdown
Contributor Author

Thanks, good catch. Pushed bf0352b - the UDP6 block no longer maps port 0 to 5060. It now only adds the +10 offset when the port is nonzero.

Tested on macOS (arm64, OpenSSL, PJ_HAS_IPV6=1), all with --use-tls:

Options Result
--local-port=0 --ipv6 UDP, UDP6, TCP, TCP6, TLS and TLS6 all on ephemeral ports
--local-port=0 --no-udp TCP and TLS ephemeral
--local-port=0 --no-udp --ipv6 TCP, TCP6, TLS and TLS6 ephemeral
--local-port=5060 --ipv6 unchanged (UDP 5060, UDP6 5070, TCP 5060, TCP6 5070, TLS 5071, TLS6 5080)

Two instances started with --local-port=0 --ipv6 --use-tls at the same time both come up with no "address in use".

Terminal output

--local-port=0 --ipv6 --use-tls

SIP UDP transport started, published address is 192.168.2.110:56945
SIP UDP IPv6 transport started, published address is [...]:64486
SIP TCP listener ready for incoming connections at 192.168.2.110:64486
SIP TCP listener ready for incoming connections at [...]:64496
SIP TLS listener is ready for incoming connections at 192.168.2.110:64497
SIP TLS listener is ready for incoming connections at [...]:64506

--local-port=0 --no-udp --ipv6 --use-tls

SIP TCP listener ready for incoming connections at 192.168.2.110:52191
SIP TCP listener ready for incoming connections at [...]:52192
SIP TLS listener is ready for incoming connections at 192.168.2.110:52193
SIP TLS listener is ready for incoming connections at [...]:52194

@nanangizz
nanangizz requested a review from sauwming October 9, 2026 02:52
@nanangizz
nanangizz merged commit 3bc680a into pjsip:master Oct 9, 2026
67 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

pjsua: preserve ephemeral port selection for IPv6 and TLS transports

3 participants