THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
A user has added themself to the list of users assigned to this task.
FS#92 - is_int() function
User who did this - Juha Heinanen (jh)
http://sip-router.org/tracker/index.php?do=details&task_id=92
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
Module: sip-router
Branch: master
Commit: d34a464ba0c17f2189a20a72e95b314339ea6937
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=d34a464…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Fri Oct 15 11:47:51 2010 +0200
auth: minor log messages, comments and sanity fixes
- use sizeof(nc_t) when initializing a nonce count tracking entry
(do not assume nc_t is char). This does not affect existing code.
- removed a debugging ERR message
- various minor comment fixes
---
modules/auth/nc.c | 4 ++--
modules/auth/nid.h | 4 ++--
modules/auth/nonce.c | 2 --
modules/auth/nonce.h | 2 +-
4 files changed, 5 insertions(+), 7 deletions(-)
diff --git a/modules/auth/nc.c b/modules/auth/nc.c
index f2fc05c..671ef55 100644
--- a/modules/auth/nc.c
+++ b/modules/auth/nc.c
@@ -162,7 +162,7 @@ void destroy_nonce_count()
* nc array corresponding to p.
* WARNING: the result is an index in the nc_array converted to nc_t
* (unsigned char by default), to get the index of the unsigned int in which
- * nc is packed, call
+ * nc is packed, call get_nc_array_uint_idx(get_nc_array_raw_idx(i,p))).
*/
#define get_nc_array_raw_idx(i,p) \
(((i)&nc_partition_mask)+((p)<<nc_partition_k))
@@ -204,7 +204,7 @@ nid_t nc_new(nid_t id, unsigned char p)
do{
v=atomic_get_int(&nc_array[i]);
/* new_value = old_int with the corresponding byte or short zeroed*/
- new_v=v & ~(((1<<(sizeof(nc_t)*8))-1)<< (r*8));
+ new_v=v & ~(((1<<(sizeof(nc_t)*8))-1)<< (r*sizeof(nc_t)*8));
}while(atomic_cmpxchg_int((int*)&nc_array[i], v, new_v)!=v);
return id;
}
diff --git a/modules/auth/nid.h b/modules/auth/nid.h
index 837372a..995f37c 100644
--- a/modules/auth/nid.h
+++ b/modules/auth/nid.h
@@ -47,8 +47,8 @@ extern unsigned nid_pool_no; /* number of index pools */
* array locations it should be a number prime with the array size and
* bigger then the cacheline. Since this is used also for onetime nonces
* => NID_INC/8 > CACHELINE
- * This number also limit the maximum pool/partition size, since the
- * id overlfow checks check if crt_id - nonce_id >= partition_size*NID_INC
+ * This number also limits the maximum pool/partition size, since the
+ * id overflow check checks if crt_id - nonce_id >= partition_size*NID_INC
* => maximum partition size is (nid_t)(-1)/NID_INC*/
#define NID_INC 257
diff --git a/modules/auth/nonce.c b/modules/auth/nonce.c
index 369a41d..72c156a 100644
--- a/modules/auth/nonce.c
+++ b/modules/auth/nonce.c
@@ -406,8 +406,6 @@ int check_nonce(auth_body_t* auth, str* secret1, str* secret2,
auth->digest.nc.len){
if (str2int(&auth->digest.nc, &nc)!=0){
/* error, bad nc */
- ERR("FIXME:check_nonce: bad nc value %.*s\n",
- auth->digest.nc.len, auth->digest.nc.s);
return 5; /* invalid nc */
}
switch(nc_check_val(n_id, pf & NF_POOL_NO_MASK, nc)){
diff --git a/modules/auth/nonce.h b/modules/auth/nonce.h
index 5dd85bf..2201b49 100644
--- a/modules/auth/nonce.h
+++ b/modules/auth/nonce.h
@@ -134,7 +134,7 @@ union bin_nonce{
/* maximum nonce length in binary form (not converted to base64/hex):
* expires_t | since_t | MD5(expires_t | since_t | s1) | \
- * MD5(info(auth_extra_checks, s2) => 4 + 4 + 16 + 16 = 40 bytes
+ * MD5(info(auth_extra_checks, s2)) => 4 + 4 + 16 + 16 = 40 bytes
* or if nc_enabled:
* expires_t | since_t | MD5...| MD5... | nonce_id | flag+pool_no(1 byte)
* => 4 + 4 + 16 + 16 + 4 + 1 = 45 bytes
I had the following code as a register handler:
t_check_request();
if(!www_authorize("$td", "subscriber")) {
switch($rc) {
case -1:
xlog(something about authentication error);
break;
case -2:
xlog(something about invalid password);
send_reply("403", "Forbidden");
exit;
case -3:
xlog(something about invalid user);
send_reply("403", "Forbidden");
exit;
default:
xlog(something else)
}
www_challenge("$td", "1");
t_release();
exit;
}
It worked fine with the initial 3.1.0 tarball from last week. But it
crashes with the tarball that is on the website right now:
Core was generated by `/usr/local/sbin/kamailio -P
/var/run/kamailio/kamailio.pid -m 64 -u root -g roo'.
Program terminated with signal 11, Segmentation fault.
#0 atomic_and_int (id=2116215340, p=128 '\200')
at ../../atomic/atomic_x86.h:227
227 ../../atomic/atomic_x86.h: No such file or directory.
in ../../atomic/atomic_x86.h
(gdb) where
#0 atomic_and_int (id=2116215340, p=128 '\200')
at ../../atomic/atomic_x86.h:227
#1 otn_new (id=2116215340, p=128 '\200') at ot_nonce.c:196
#2 0xb6fe5bba in get_challenge_hf (msg=0x836a63c, stale=0,
realm=0xbffb0ad4,
nonce=0x0, algorithm=0x0, qop=0xb6fee9d0, hftype=13, ahf=0xbffb0acc)
at challenge.c:181
#3 0xb6fe3c4f in auth_challenge (msg=0x836a63c, p1=<value optimized out>,
p2=0x835fd8c "`\022\060\b\001", hftype=13) at auth_mod.c:613
#4 0x08059de4 in do_action (h=0xbffb2098, a=0x830453c, msg=0x836a63c)
at action.c:1099
#5 0x080615b0 in run_actions (h=0xbffb2098, a=0x8304498, msg=0x836a63c)
at action.c:1553
#6 0x0805a530 in do_action (h=0xbffb2098, a=0x830720c, msg=0x836a63c)
at action.c:1259
#7 0x080615b0 in run_actions (h=0xbffb2098, a=0x830720c, msg=0x836a63c)
at action.c:1553
#8 0x0805a61d in do_action (h=0xbffb2098, a=0x830787c, msg=0x836a63c)
at action.c:1084
#9 0x080615b0 in run_actions (h=0xbffb2098, a=0x8304090, msg=0x836a63c)
at action.c:1553
#10 0x0805a26c in do_action (h=0xbffb2098, a=0x82ea7d8, msg=0x836a63c)
at action.c:711
#11 0x080615b0 in run_actions (h=0xbffb2098, a=0x82ea7d8, msg=0x836a63c)
at action.c:1553
#12 0x0805a61d in do_action (h=0xbffb2098, a=0x82eb090, msg=0x836a63c)
at action.c:1084
#13 0x080615b0 in run_actions (h=0xbffb2098, a=0x82eb090, msg=0x836a63c)
at action.c:1553
#14 0x0805caff in do_action (h=0xbffb2098, a=0x82eb134, msg=0x836a63c)
at action.c:1088
#15 0x080615b0 in run_actions (h=0xbffb2098, a=0x82eb134, msg=0x836a63c)
at action.c:1553
#16 0x0805caff in do_action (h=0xbffb2098, a=0x82eb1d8, msg=0x836a63c)
---Type <return> to continue, or q <return> to quit---
at action.c:1088
#17 0x080615b0 in run_actions (h=0xbffb2098, a=0x82e9124, msg=0x836a63c)
at action.c:1553
#18 0x0805a61d in do_action (h=0xbffb2098, a=0x82ebbb0, msg=0x836a63c)
at action.c:1084
#19 0x080615b0 in run_actions (h=0xbffb2098, a=0x82df70c, msg=0x836a63c)
at action.c:1553
#20 0x08061854 in run_top_route (a=0x82df70c, msg=0x836a63c, c=0x0)
at action.c:1626
#21 0x080d5866 in receive_msg (
buf=0x827e880 "REGISTER sip:sip.evaristesys.com SIP/2.0\r\nVia:
SIP/2.0/UDP
208.52.173.7:5060;branch=z9hG4bK39b78214;rport\r\nMax-Forwards:
32\r\nFrom: <sip:abalashov@sip.evaristesys.com>;tag=as4854d363\r\nTo:
<sip:abalasho"...,
len=678, rcv_info=0xbffb22dc) at receive.c:205
#22 0x0815b512 in udp_rcv_loop () at udp_server.c:532
#23 0x080a2917 in main_loop () at main.c:1554
#24 0x080a5142 in main (argc=13, argv=0xbffb2574) at main.c:2398
I have not tried with sip-router:master:HEAD yet.
--
Alex Balashov - Principal
Evariste Systems LLC
1170 Peachtree Street
12th Floor, Suite 1200
Atlanta, GA 30309
Tel: +1-678-954-0670
Fax: +1-404-961-1892
Web: http://www.evaristesys.com/
In Kamailio 3.1.0, I get an occasional crash that appears to be due to
topoh. Here is the backtrace from the core file, though the binary was
not compiled with debug symbols and so some things have definitely been
optimised out:
Core was generated by `/usr/local/sbin/kamailio -P
/var/run/kamailio/kamailio.pid -m 1024 -u root -g r'.
Program terminated with signal 11, Segmentation fault.
[New process 11535]
#0 th_del_via_cookie (msg=0x7fffcca2bbe0, via=0x0) at th_msg.c:951
951 for(p=via->param_lst; p; p=p->next)
(gdb) where
#0 th_del_via_cookie (msg=0x7fffcca2bbe0, via=0x0) at th_msg.c:951
#1 0x00007f528da90eb4 in th_del_cookie (msg=0x7fffcca2bbe0) at th_msg.c:972
#2 0x00007f528da97748 in th_msg_sent (data=<value optimized out>)
at topoh_mod.c:288
#3 0x00007f528f98d1d7 in send_pr_buffer (rb=0x7f5249acc0d8,
buf=0x7f528fbe50a0, len=3) at ../../forward.h:133
#4 0x00007f528f9bdffd in t_retransmit_reply (t=0x7f5249acc018)
at t_reply.c:1411
#5 0x00007f528f998c17 in retr_buf_handler (ticks=291591695,
tl=0x7f5249acc0f8, p=<value optimized out>) at timer.c:367
#6 0x0000000000513e7f in timer_main () at timer.c:894
#7 0x0000000000464c7b in main_loop () at main.c:1618
#8 0x00000000004674d3 in main (argc=<value optimized out>,
argv=0x7fffcca2c638) at main.c:2398
This is not a bug I can easily reproduce, and is probably due to an
extremely unusual situation. This particular peer that is being
interoperated with has a history of eccentric behaviour that makes no
sense. Nevertheless, here is a print of msg->buf.
(gdb) set print elements 1024
(gdb) print msg->buf
$3 = 0x7f528fbe50a0 "SIP/2.0 487 Request Terminated\r\nFrom:
<sip:7324231212@66.6.136.41;user=phone>;tag=ff754700ff76ff10ff00003048ff62ff\r\nTo:
<sip:234805449114@70.34.96.20:5060;user=phone>;tag=774fdcea2960b2b7\r\nServer:
VOS2009 V2.1.1.5\r\nCSeq: 1 INVITE\r\nCall-ID:
4e744700d676b71080000030488062e0@MERA3\r\nContact:
<sip:234805449114@208.38.165.139:5060>\r\nMax-Forwards:
70\r\nContent-Length: 0\r\nTH: uch\r\n\r\n"
I do not see a Via header here at all, though I do not know if that is
because the proxy has stripped it off by this point, so I won't comment
on the cause.
The core file is available if anyone is interested, but I am not going
to obnoxiously attach it like last time. :-)
Cheers,
-- Alex
--
Alex Balashov - Principal
Evariste Systems LLC
1170 Peachtree Street
12th Floor, Suite 1200
Atlanta, GA 30309
Tel: +1-678-954-0670
Fax: +1-404-961-1892
Web: http://www.evaristesys.com/
Module: sip-router
Branch: 3.1
Commit: 3cf51efaab04a9c008e50c58d9abc8eaf41ee0ed
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=3cf51ef…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Fri Oct 15 10:09:03 2010 +0200
auth: fix pool no. when both nc and otn are enabled
When both nonce_count and one_time_nonce are enabled in the same
time, the pool number was corrupted leading to crashes.
Reported-by: Alex Balashov abalashov evaristesys com
(cherry picked from commit 7aea949e1d1101b87d4327a86f026e119cd0ae8b)
---
modules/auth/challenge.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/modules/auth/challenge.c b/modules/auth/challenge.c
index 1e4dfe6..9bd4ce0 100644
--- a/modules/auth/challenge.c
+++ b/modules/auth/challenge.c
@@ -89,6 +89,7 @@ int get_challenge_hf(struct sip_msg* msg, int stale, str* realm,
#if defined USE_NC || defined USE_OT_NONCE
unsigned int n_id;
unsigned char pool;
+ unsigned char pool_flags;
#endif
if(!ahf)
@@ -170,23 +171,26 @@ int get_challenge_hf(struct sip_msg* msg, int stale, str* realm,
if (nc_enabled || otn_enabled){
pool=nid_get_pool();
n_id=nid_inc(pool);
+ pool_flags=0;
#ifdef USE_NC
if (nc_enabled){
nc_new(n_id, pool);
- pool|= NF_VALID_NC_ID;
+ pool_flags|= NF_VALID_NC_ID;
}
#endif
#ifdef USE_OT_NONCE
if (otn_enabled){
otn_new(n_id, pool);
- pool|= NF_VALID_OT_ID;
+ pool_flags|= NF_VALID_OT_ID;
}
#endif
}else{
pool=0;
+ pool_flags=0;
n_id=0;
}
- if (calc_nonce(p, &l, cfg, t, t + nonce_expire, n_id, pool,
+ if (calc_nonce(p, &l, cfg, t, t + nonce_expire, n_id,
+ pool | pool_flags,
&secret1, &secret2, msg) != 0)
#else /* USE_NC || USE_OT_NONCE*/
if (calc_nonce(p, &l, cfg, t, t + nonce_expire,
Module: sip-router
Branch: master
Commit: 7aea949e1d1101b87d4327a86f026e119cd0ae8b
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=7aea949…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Fri Oct 15 10:09:03 2010 +0200
auth: fix pool no. when both nc and otn are enabled
When both nonce_count and one_time_nonce are enabled in the same
time, the pool number was corrupted leading to crashes.
Reported-by: Alex Balashov abalashov evaristesys com
---
modules/auth/challenge.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/modules/auth/challenge.c b/modules/auth/challenge.c
index 1e4dfe6..9bd4ce0 100644
--- a/modules/auth/challenge.c
+++ b/modules/auth/challenge.c
@@ -89,6 +89,7 @@ int get_challenge_hf(struct sip_msg* msg, int stale, str* realm,
#if defined USE_NC || defined USE_OT_NONCE
unsigned int n_id;
unsigned char pool;
+ unsigned char pool_flags;
#endif
if(!ahf)
@@ -170,23 +171,26 @@ int get_challenge_hf(struct sip_msg* msg, int stale, str* realm,
if (nc_enabled || otn_enabled){
pool=nid_get_pool();
n_id=nid_inc(pool);
+ pool_flags=0;
#ifdef USE_NC
if (nc_enabled){
nc_new(n_id, pool);
- pool|= NF_VALID_NC_ID;
+ pool_flags|= NF_VALID_NC_ID;
}
#endif
#ifdef USE_OT_NONCE
if (otn_enabled){
otn_new(n_id, pool);
- pool|= NF_VALID_OT_ID;
+ pool_flags|= NF_VALID_OT_ID;
}
#endif
}else{
pool=0;
+ pool_flags=0;
n_id=0;
}
- if (calc_nonce(p, &l, cfg, t, t + nonce_expire, n_id, pool,
+ if (calc_nonce(p, &l, cfg, t, t + nonce_expire, n_id,
+ pool | pool_flags,
&secret1, &secret2, msg) != 0)
#else /* USE_NC || USE_OT_NONCE*/
if (calc_nonce(p, &l, cfg, t, t + nonce_expire,