dialog: accurate match of outgoing legs

The initial code assumes that for each transaction branch, we serially
create a dialog leg - therefore, when a reply is received for a specific
branch, we match the leg based on its index.
This logic breaks when having a branch that has no outgoing leg/message
(i.e. when push notification is used), because the dialog legs id gets
offsetted by the number of "blind" branches, thus we are no longer able
to properly match the reply with the leg.
This fix makes sure that when creating a let, it has the same index as
the transaction's branch id, hence the reply is properly matched.

modules/dialog/dlg_handlers.c

@@ -1423,12 +1423,12 @@ static void dlg_onreq_out(struct cell* t, int type, struct tmcb_params *ps)
 	 */
 	dlg_lock_dlg(dlg);
 
-	if (ensure_leg_array(dlg->legs_no[DLG_LEGS_USED] + 1, dlg) != 0)
+	callee_leg = d_tmb.get_branch_index() + 1;
+	if (ensure_leg_array(callee_leg + 1, dlg) != 0)
 		goto out_free;
 
 	/* store the caller SDP into each callee leg, useful for Re-INVITE pings */
-	leg = &dlg->legs[dlg->legs_no[DLG_LEGS_USED]];
-	callee_leg = dlg->legs_no[DLG_LEGS_USED];
+	leg = &dlg->legs[callee_leg];
 
 	dlg_unlock_dlg(dlg);
 

modules/tm/t_cancel.c

@@ -36,6 +36,7 @@
 
 
 str _extra_cancel_hdrs = {NULL,0};
+extern int _tm_branch_index;
 
 
 /* determine which branches should be canceled; do it
@@ -116,9 +117,11 @@ void cancel_branch( struct cell *t, int branch )
 	crb->activ_type=TYPE_LOCAL_CANCEL;
 
 	if ( has_tran_tmcbs( t, TMCB_REQUEST_BUILT) ) {
+		_tm_branch_index = branch;
 		set_extra_tmcb_params( &crb->buffer, &crb->dst);
 		run_trans_callbacks( TMCB_REQUEST_BUILT,
 			t, t->uas.request, 0, 0);
+		_tm_branch_index = 0;
 	}
 
 	LM_DBG("sending cancel...\n");

modules/tm/t_fwd.c

@@ -824,10 +824,12 @@ int t_forward_nonack( struct cell *t, struct sip_msg* p_msg ,
 
 			/* successfully sent out -> run callbacks */
 			if ( has_tran_tmcbs( t, TMCB_REQUEST_BUILT) ) {
+				_tm_branch_index = i;
 				set_extra_tmcb_params( &t->uac[i].request.buffer,
 					&t->uac[i].request.dst);
 				run_trans_callbacks( TMCB_REQUEST_BUILT, t,
 					p_msg, 0, 0);
+				_tm_branch_index = 0;
 			}
 
 			do {