2 Commits

Author	SHA1	Message	Date
Ryan Malloy	4050b3f7c5	Fix ACK loss: bypass all security checks for mid-dialog ACKs ... Resolves production issue where ACK messages triggered rate-limiting and enumeration detection, causing calls to die at ~64s (Timer H expiry). ### Root Cause (refined via agent-thread debugging): ACKs lack dialog-aware fast-path. Initial diagnosis pointed to enumeration detection, but flextel agent's runtime config dump revealed enumeration was disabled. **Rate-limiting** was the actual culprit - ACK retransmissions (responding to Asterisk's 200 OK retransmits) hit rate limits and connections were closed. ### The Fix (l4handler.go:231-246): ACKs now fast-path through ALL security checks: - ✅ Bypass rate-limiting (ACK retransmissions don't trigger limits) - ✅ Bypass enumeration detection (no false-positive rapid-fire bans) - ✅ Bypass validation/pattern matching (unnecessary for mid-dialog) - ✅ Debug logging for troubleshooting - ✅ Metrics tracking (ACKs count as "allowed") ### Agent-Thread Debugging Protocol: Cross-project debugging via immutable message threads: - 001: flextel reports calls dying at 64s, hypothesizes ACK loss - 002: Our diagnosis - ACK → enumeration false-positives - 003: flextel deploys temporary Caddyfile bypass, requests Option B - 004: flextel refines diagnosis - rate-limiting, not enumeration - 005: Our reply - ACK fast-path shipped, bypasses ALL checks ### Security Documentation: Added README warning about SIP trunk whitelisting security: - ⚠️ Don't whitelist entire carrier ranges (bypasses protection for ANY customer) - ✅ Use narrow trunk-specific IPs only (54.172.60.0/30, 54.244.51.0/30) - Documents Twilio-specific example with security rationale ### Impact: - **Production fix**: Calls no longer die at 64s - **Architecture**: Proper mid-dialog handling for all ACKs - **Security**: Narrow whitelist guidance prevents bypass abuse - **Future**: Dialog-aware fast-path (Option A) for all in-dialog messages ### Test Results: All 196 tests passing ✅ (1.213s) See: docs/agent-threads/ack-loss-from-twilio-trunk/ for full debugging trail	2026-06-22 00:37:57 -06:00
Ryan Malloy	f295c19e06	Fix ACK loss from enumeration detection false-positives ... Resolves production issue where legitimate ACK messages were triggering enumeration detection, causing calls to die at ~64s (Timer H expiry). ### Root Cause: ACK messages lack dialog-aware fast-path in l4handler.go. All SIP requests go through the full security pipeline including enumeration detection. When a client sends multiple ACKs (responding to 200 OK retransmissions), the enumeration detector sees "rapid fire" extension probing and bans the source IP. ### The Fix: Exempt ACK from enumeration detection (l4handler.go:254-258): - ACK is a mid-dialog request, not an extension probe - ACKs arrive in response to 200 OK retransmissions (RFC 3261) - False-positive rapid-fire/sequential detection blocked legitimate traffic ### Impact: - **For Twilio trunk:** Whitelisting is the operational fix - **For dynamic IP clients:** This architectural fix enables calls to work (residential users, mobile clients, peer-to-peer scenarios) ### Agent Thread Protocol: Added docs/agent-threads/ for cross-project debugging: - 001-flextel-ack-being-dropped.md — Problem report from asterpbx agent - 002-diagnosis-ack-not-fast-pathed.md — Root cause analysis and fix options - PROTOCOL.md — Agent communication protocol documentation See: docs/agent-threads/ack-loss-from-twilio-trunk/ for full diagnosis ### Test Results: All 196 tests passing ✅ (1.213s)	2026-06-22 00:08:25 -06:00