Hi!
With kamailio 3.0 I encounter lots of crashes. I am using SNOM 320 and
eyebeam clients. I think crashes are mostly correlated with SNOM 320.
Server is CentOS5.4. OpenSSL is openssl-0.9.8e-12.el5_4.1.
First crashed Kamailio always with the same backtrace:
Program terminated with signal 11, Segmentation fault.
[New process 1580]
#0 0x0017451d in kssl_keytab_is_available () from /lib/libssl.so.6
(gdb) bt
#0 0x0017451d in kssl_keytab_is_available () from /lib/libssl.so.6
#1 0x00156d01 in ssl3_choose_cipher () from /lib/libssl.so.6
#2 0x00151b45 in ssl3_get_client_hello () from /lib/libssl.so.6
#3 0x00152525 in ssl3_accept () from /lib/libssl.so.6
#4 0x00167eda in SSL_accept () from /lib/libssl.so.6
#5 0x004a6cff in tls_accept (c=0xb60ff4a0, error=0x0) at tls_server.c:327
#6 0x004ac15b in tls_h_fix_read_conn (c=0xb60ff4a0) at tls_server.c:1005
#7 0x0813d146 in tcp_read_req (con=0xb60ff4a0, bytes_read=0xbfe248b4,
read_flags=0xbfe248b0) at tcp_read.c:654
#8 0x0813d8ef in handle_io (fm=0x82aa9d0, events=1, idx=-1) at
tcp_read.c:930
#9 0x08141513 in tcp_receive_loop (unix_sock=27) at io_wait.h:1057
#10 0x0810fc1b in tcp_init_children () at tcp_main.c:4253
#11 0x0809ae69 in main_loop () at main.c:1525
#12 0x0809bc02 in main (argc=1, argv=0xbfe24cc4) at main.c:2251
(gdb) quit
Then I configured RSA ciphers (as suggested by others) and now I get
different backtraces. Here is an example where Kamailio wrote 2 core files:
1. Program terminated with signal 11, Segmentation fault.
[New process 1735]
#0 0x004d01d3 in free_hash_table () at h_table.c:423
423
clist_foreach_safe(&_tm_table->entries[i], p_cell, tmp_cell,
(gdb) bt
#0 0x004d01d3 in free_hash_table () at h_table.c:423
#1 0x004de1a0 in tm_shutdown () at t_funcs.c:126
#2 0x08104ef2 in destroy_modules () at sr_module.c:635
#3 0x08098400 in cleanup (show_status=1) at main.c:509
#4 0x0809912e in shutdown_children (sig=<value optimized out>,
show_status=1) at main.c:649
#5 0x08099aa4 in handle_sigs () at main.c:740
#6 0x0809aab9 in main_loop () at main.c:1562
#7 0x0809bc02 in main (argc=1, argv=0xbfc70b74) at main.c:2251
2. Program terminated with signal 11, Segmentation fault.
[New process 1759]
#0 0x004f24ce in t_reply_matching (p_msg=0x8298cf0,
p_branch=0xbfc70424) at t_lookup.c:983
983 if (p_cell->label != entry_label)
(gdb) bt
#0 0x004f24ce in t_reply_matching (p_msg=0x8298cf0,
p_branch=0xbfc70424) at t_lookup.c:983
#1 0x004f5559 in t_check_msg (p_msg=0x8298cf0, param_branch=0xbfc70424)
at t_lookup.c:1138
#2 0x004f5e94 in t_check (p_msg=0x8298cf0, param_branch=0xbfc70424) at
t_lookup.c:1180
#3 0x005140d9 in reply_received (p_msg=0x8298cf0) at t_reply.c:1897
#4 0x0808c764 in forward_reply (msg=0x8298cf0) at forward.c:689
#5 0x080c401e in receive_msg (
buf=0xb60fe088 "SIP/2.0 200 Ok\r\nVia: SIP/2.0/TLS
83.136.32.167:5061;branch=z9hG4bKcc38.0a7d6be7.0;i=2\r\nVia: SIP/2.0/TLS
10.10.0.51:40487;received=83.136.33.3;branch=z9hG4bK-d8754z-7b0f1727475bda32-1---d8754z-;rport=2"...,
len=1150, rcv_info=0xb60fded4) at receive.c:257
#6 0x0813cf41 in tcp_read_req (con=0xb60fdec0, bytes_read=0xbfc70768,
read_flags=0xbfc70760) at tcp_read.c:761
#7 0x0813da0b in handle_io (fm=0x82aa708, events=1, idx=-1) at
tcp_read.c:980
#8 0x08141513 in tcp_receive_loop (unix_sock=25) at io_wait.h:1057
#9 0x0810fc1b in tcp_init_children () at tcp_main.c:4253
#10 0x0809ae69 in main_loop () at main.c:1525
#11 0x0809bc02 in main (argc=1, argv=0xbfc70b74) at main.c:2251
Attached is the log file.
I can provided intensive logs (memdbg) too.
thanks
klaus
Module: sip-router
Branch: master
Commit: 5a620b105b62e48631e9248906e00b4b2c7b4081
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5a620b1…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Mon Feb 22 19:41:33 2010 +0100
tmx(k): core & tm onreply route support
- support for core onreply route (like for tm onreply route, but
with extra t_unref).
- use get_route_type() instead of directly accessing route_type.
---
modules_k/tmx/t_var.c | 12 +++++++++---
1 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/modules_k/tmx/t_var.c b/modules_k/tmx/t_var.c
index 6441763..7f537ff 100644
--- a/modules_k/tmx/t_var.c
+++ b/modules_k/tmx/t_var.c
@@ -404,12 +404,18 @@ int pv_get_tm_reply_code(struct sip_msg *msg, pv_param_t *param,
/* no T */
code = 0;
} else {
- switch (route_type) {
+ switch (get_route_type()) {
case REQUEST_ROUTE:
/* use the status of the last sent reply */
code = t->uas.status;
break;
- case ONREPLY_ROUTE:
+ case CORE_ONREPLY_ROUTE:
+ /* t_check() above has the side effect of setting T and
+ REFerencing T => we must unref and unset it for the
+ main/core onreply_route. */
+ _tmx_tmb.t_unref(msg);
+ /* no break */
+ case TM_ONREPLY_ROUTE:
/* use the status of the current reply */
code = msg->first_line.u.reply.statuscode;
break;
@@ -424,7 +430,7 @@ int pv_get_tm_reply_code(struct sip_msg *msg, pv_param_t *param,
}
break;
default:
- LM_ERR("unsupported route_type %d\n", route_type);
+ LM_ERR("unsupported route_type %d\n", get_route_type());
code = 0;
}
}
Module: sip-router
Branch: master
Commit: 75e52b43af0a445b18ccf17e0558da1f41e10337
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=75e52b4…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Mon Feb 22 19:38:40 2010 +0100
tm: t_check_status & t_reply main onreply_route fix
- t_check_status: in some situations t_check_status left the
transaction referenced when called from main onreply_route (e.g.
t_check_status(); drop )
- t_reply: unref the transaction only when called from the main
onreply_route and not from tm onreply route
---
modules/tm/tm.c | 22 ++++++++++++++++++----
1 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/modules/tm/tm.c b/modules/tm/tm.c
index 513dc99..2b35681 100644
--- a/modules/tm/tm.c
+++ b/modules/tm/tm.c
@@ -902,7 +902,7 @@ static int t_check_status(struct sip_msg* msg, char *p1, char *foo)
str tmp;
fp = (fparam_t*)p1;
-
+ t = 0;
/* first get the transaction */
if (t_check(msg, 0 ) == -1) return -1;
if ((t = get_t()) == 0) {
@@ -989,11 +989,23 @@ static int t_check_status(struct sip_msg* msg, char *p1, char *foo)
regfree(re);
pkg_free(re);
}
-
+
+ if (unlikely(t && is_route_type(CORE_ONREPLY_ROUTE))){
+ /* t_check() above has the side effect of setting T and
+ REFerencing T => we must unref and unset it. */
+ UNREF( t );
+ set_t(T_UNDEFINED, T_BR_UNDEFINED);
+ }
if (n!=0) return -1;
return 1;
error:
+ if (unlikely(t && is_route_type(CORE_ONREPLY_ROUTE))){
+ /* t_check() above has the side effect of setting T and
+ REFerencing T => we must unref and unset it. */
+ UNREF( t );
+ set_t(T_UNDEFINED, T_BR_UNDEFINED);
+ }
if (s) pkg_free(s);
if ((fp->type != FPARAM_REGEX) && re) {
regfree(re);
@@ -1268,8 +1280,10 @@ inline static int w_t_reply(struct sip_msg* msg, char* p1, char* p2)
Note: this is needed only in the CORE_ONREPLY_ROUTE and not also in
the TM_ONREPLY_ROUTE.
*/
- UNREF( t );
- set_t(T_UNDEFINED, T_BR_UNDEFINED);
+ if (is_route_type(CORE_ONREPLY_ROUTE)) {
+ UNREF( t );
+ set_t(T_UNDEFINED, T_BR_UNDEFINED);
+ }
} else {
LOG(L_CRIT, "BUG: w_t_reply entered in unsupported mode\n");
ret = -1;
Module: sip-router
Branch: master
Commit: 099a29532ed7c9c8ce736eb1f989a5af8bba4b4f
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=099a295…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Mon Feb 22 18:00:30 2010 +0100
NEWS: note about onreply_route changes & tm
---
NEWS | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/NEWS b/NEWS
index b52d505..5f193c4 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ $Id$
sip-router 3.1 chages
core:
+ - onreply_route {...} is now equivalent with onreply_route[0] {...}
- global, per protocol blacklist ignore masks (via extended send_flags).
See dst_blacklist_udp_imask a.s.o (dst_blacklist_*_imask).
- per message blacklist ignore masks
@@ -36,6 +37,9 @@ modules:
the mask for possible local replies to the current message.
blst_rpl_clear_ignore(mask): like blst_rpl_ignore(mask), but
clears instead of setting.
+tm:
+ - t_reply() can be used both from the main/core onreply_route{} and tm
+ onreply_route[...]{}s.
Module: sip-router
Branch: master
Commit: 9e2873513df7d4fc2fee192f47629b81301f5012
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=9e28735…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Mon Feb 22 17:50:40 2010 +0100
tm: t_reply can now be used from onreply_routes
t_reply can now be used both from the main onreply_route
(onreply_route{}) or from tm onreply_routes (onreply_route[x]{},
where x!=0).
In general it should be followed by a DROP. If not you might get
some log warning messages (but besides that nothing bad will
happen).
---
modules/tm/tm.c | 17 ++++++++++++++++-
1 files changed, 16 insertions(+), 1 deletions(-)
diff --git a/modules/tm/tm.c b/modules/tm/tm.c
index 16275c8..513dc99 100644
--- a/modules/tm/tm.c
+++ b/modules/tm/tm.c
@@ -315,7 +315,7 @@ static cmd_export_t cmds[]={
{"t_lookup_cancel", w_t_lookup_cancel, 1, fixup_int_1,
REQUEST_ROUTE},
{T_REPLY, w_t_reply, 2, fixup_t_reply,
- REQUEST_ROUTE | FAILURE_ROUTE },
+ REQUEST_ROUTE | ONREPLY_ROUTE | FAILURE_ROUTE },
{"t_retransmit_reply", w_t_retransmit_reply, 0, 0,
REQUEST_ROUTE},
{"t_release", w_t_release, 0, 0,
@@ -1255,6 +1255,21 @@ inline static int w_t_reply(struct sip_msg* msg, char* p1, char* p2)
ret = t_reply_unsafe(t, msg, code, r);
} else if (is_route_type(REQUEST_ROUTE)) {
ret = t_reply( t, msg, code, r);
+ } else if (is_route_type(ONREPLY_ROUTE)) {
+ if (likely(t->uas.request)){
+ if (is_route_type(CORE_ONREPLY_ROUTE))
+ ret=t_reply(t, t->uas.request, code, r);
+ else
+ ret=t_reply_unsafe(t, t->uas.request, code, r);
+ }else
+ ret=-1;
+ /* t_check() above has the side effect of setting T and
+ REFerencing T => we must unref and unset it.
+ Note: this is needed only in the CORE_ONREPLY_ROUTE and not also in
+ the TM_ONREPLY_ROUTE.
+ */
+ UNREF( t );
+ set_t(T_UNDEFINED, T_BR_UNDEFINED);
} else {
LOG(L_CRIT, "BUG: w_t_reply entered in unsupported mode\n");
ret = -1;
Module: sip-router
Branch: master
Commit: ba15378ef66a11d3cbd6862aa2bfb060d099ca03
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=ba15378…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Mon Feb 22 18:01:26 2010 +0100
tm: onreply_route: fix cleanup after DROP
After a DROP in the onreply_route the avp lists where not restored
to their original values and the possible msg flags changes in the
script were dropped.
---
modules/tm/t_reply.c | 17 ++++++++++-------
1 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/modules/tm/t_reply.c b/modules/tm/t_reply.c
index f37903a..9fbe6c3 100644
--- a/modules/tm/t_reply.c
+++ b/modules/tm/t_reply.c
@@ -2053,13 +2053,6 @@ int reply_received( struct sip_msg *p_msg )
LOCK_REPLIES( t );
replies_locked=1;
run_top_route(onreply_rt.rlist[t->on_reply], p_msg, &ctx);
- if ((ctx.run_flags&DROP_R_F) && (msg_status<200)) {
- if (unlikely(replies_locked)) {
- replies_locked = 0;
- UNLOCK_REPLIES( t );
- }
- goto done;
- }
/* transfer current message context back to t */
if (t->uas.request) t->uas.request->flags=p_msg->flags;
getbflagsval(0, &uac->branch_flags);
@@ -2074,6 +2067,16 @@ int reply_received( struct sip_msg *p_msg )
#ifdef WITH_XAVP
xavp_set_list(backup_xavps);
#endif
+ /* handle a possible DROP in the script, but only if this
+ is not a final reply (final replies already stop the timers
+ and droping them might leave a transaction living forever) */
+ if ((ctx.run_flags&DROP_R_F) && (msg_status<200)) {
+ if (unlikely(replies_locked)) {
+ replies_locked = 0;
+ UNLOCK_REPLIES( t );
+ }
+ goto done;
+ }
}
#ifdef USE_DST_BLACKLIST
/* add temporary to the blacklist the source of a 503 reply */