[SR-Users] Hop by hop CANCEL, wrong to header

Hi all, I have a question about CANCEL message processing. My call sceraio: When an INVITE request comes I need to rewrite a domain part of the several headers(to, from, contact, SDP ip) according to the outgoing interface. I can do it before t_relay(), but when destination user has more then one locations and they are reachable through different interfaces all forked INVITEs will have the same domain. To avoid that problem i have tried to move rewriting part(subst from the textops module) to the branch_route. Unfortunately that solution didn't helped me, because "To" header of the outgoing CANCEL messages is wrong (unchanged. as it was at the moment when transaction was created by the t_relay() ). As i understood from the documentation and mailing list kamailio builds CANCEL based on outgoing INVITE. I did a small research and found that Kamailio really takes outgoing INVITE from each branch (invite_transaction_cell -> uac[b_id].request.buffer) and builds CANCEL (build_local_reparse() from tm/t_msgbuilder.c) based on it. But kamailio does an exception for the To header which is described below: ***cancel_branch* function (from t_cancel.c) calls *build_local_reparse*() and fills one of the parameters with a pointer to unmodified To header. * build_local_reparse*() uses received To header to construct outgoing CANCEL. I have changed: cancel = build_local_reparse(t, branch, &len, CANCEL, CANCEL_LEN, &t->to, reason); to: cancel = build_local_reparse(t, branch, &len, CANCEL, CANCEL_LEN, NULL, reason); and it works for me now. It looks like if E2E_CANCEL_HOP_BY_HOP *e2e_cancel()* (t_fwd.c) will call *e2e_cancel_branch()* which works as i want instead of *cancel_branch()*, but it is just my assumption. Why does kamailio generate CANCEL requests in such a way ? Did i miss something from the RFC3261 or kamailio documentation ? Thanks in advance for any help !