From 5c8c04700ea216f87718c6b00b6c48f990053280 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 24 Jul 2026 17:02:01 +0000 Subject: [PATCH] pstn-trunk: stop pinning the endpoint's static callerid to the DID itself Live trace confirmed every inbound call's CALLERID(num) came back identical to the DID that was dialed, regardless of who actually called - meaning every restricted-tier allowed_numbers check was structurally impossible to satisfy, since the "caller ID" Asterisk saw was never the real one. The [pstn-trunk] endpoint had a static `callerid=` default (redundant for outbound - the dialplan already sets CALLERID(num) on the calling channel before Dial(), which is what actually gets presented) with no trust_id_inbound setting. Removed the static default and added trust_id_inbound=yes so real caller identity the provider sends (P-Asserted-Identity/Remote-Party-ID, in addition to the From header) is honored for inbound calls instead of falling back to the DID. --- services/pstn-trunk.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/services/pstn-trunk.sh b/services/pstn-trunk.sh index 009b342..57e58f3 100644 --- a/services/pstn-trunk.sh +++ b/services/pstn-trunk.sh @@ -223,6 +223,18 @@ _pstn_write_pjsip_include() { ; If inbound calls stop matching after a provider-side change, re-run this ; service to re-resolve/re-enter them, or add extra match= lines here by ; hand for additional known source IPs. +; +; No static callerid= default on the endpoint below, on purpose. Confirmed +; live: with one set (pinned to the trunk DID, presumably meant only as a +; belt-and-suspenders default for outbound — the outbound dialplan already +; sets CALLERID(num) on the calling channel before Dial(), which is what +; actually gets presented), every INBOUND call's CALLERID(num) came back +; identical to the DID itself regardless of who really called — every +; restricted-tier allowed_numbers check was structurally unwinnable, since +; the caller ID Asterisk saw was never the real one. trust_id_inbound=yes +; below instead tells Asterisk to honor identity info the provider actually +; sends (P-Asserted-Identity/Remote-Party-ID, in addition to the From +; header) for this trunk, so real inbound Caller-ID reaches the dialplan. [pstn-trunk] type=aor @@ -247,7 +259,7 @@ allow=ulaw,alaw aors=pstn-trunk from_user=__PSTN_DID__ from_domain=__PSTN_SERVER__ -callerid=__PSTN_DID__ +trust_id_inbound=yes direct_media=no EOF sed -i "s/__PSTN_SERVER__/${SERVER}/g; s/__PSTN_DID__/${DID}/g" "$FILE"