sr-dev November 2011

sr-dev@lists.kamailio.org

31 participants
340 discussions

git:master: Doc fixes for reg_timer_interval patch. I' ll try not to break things
by Alex Balashov 21 Nov '11

21 Nov '11

Module: sip-router Branch: master Commit: f6f42b24c2df7d3840ebe42be262b1dc5092b86a URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=f6f42b2… Author: Alex Balashov <abalashov(a)evaristesys.com> Committer: Alex Balashov <abalashov(a)evaristesys.com> Date: Mon Nov 21 07:10:21 2011 -0500 Doc fixes for reg_timer_interval patch. I'll try not to break things again. --- modules_k/uac/README | 131 ++++++++++++++++++++++----------------- modules_k/uac/doc/uac_admin.xml | 16 ----- 2 files changed, 73 insertions(+), 74 deletions(-) diff --git a/modules_k/uac/README b/modules_k/uac/README index 1dcf3b7..91cc281 100644 --- a/modules_k/uac/README +++ b/modules_k/uac/README @@ -39,20 +39,21 @@ Ramona-Elena Modroiu 3.6. auth_username_avp (string) 3.7. auth_password_avp (string) 3.8. reg_db_url (string) - 3.9. reg_contact_addr (string) + 3.9. reg_timer_interval (string) - 4. Functions + 4. reg_contact_addr (string) + 5. Functions - 4.1. uac_replace_from(display,uri) - 4.2. uac_replace_from(uri) - 4.3. uac_restore_from() - 4.4. uac_auth() - 4.5. uac_req_send() - 4.6. uac_reg_lookup(uuid, dst) - 4.7. uac_reg_request_to(user, mode) + 5.1. uac_replace_from(display,uri) + 5.2. uac_replace_from(uri) + 5.3. uac_restore_from() + 5.4. uac_auth() + 5.5. uac_req_send() + 5.6. uac_reg_lookup(uuid, dst) + 5.7. uac_reg_request_to(user, mode) - 5. Exported pseudo-variables - 6. Remote Registration + 6. Exported pseudo-variables + 7. Remote Registration List of Examples @@ -64,15 +65,16 @@ Ramona-Elena Modroiu 1.6. Set auth_username_avp parameter 1.7. Set auth_password_avp parameter 1.8. Set reg_db_url parameter - 1.9. Set reg_contact_addr parameter - 1.10. uac_replace_from usage + 1.9. Set reg_timer_inteval parameter + 1.10. Set reg_contact_addr parameter 1.11. uac_replace_from usage - 1.12. uac_restore_from usage - 1.13. uac_auth usage - 1.14. uac_req_send usage - 1.15. uac_reg_lookup usage - 1.16. uac_reg_request_to usage - 1.17. lookup remote registrations usage + 1.12. uac_replace_from usage + 1.13. uac_restore_from usage + 1.14. uac_auth usage + 1.15. uac_req_send usage + 1.16. uac_reg_lookup usage + 1.17. uac_reg_request_to usage + 1.18. lookup remote registrations usage Chapter 1. Admin Guide @@ -94,20 +96,21 @@ Chapter 1. Admin Guide 3.6. auth_username_avp (string) 3.7. auth_password_avp (string) 3.8. reg_db_url (string) - 3.9. reg_contact_addr (string) + 3.9. reg_timer_interval (string) - 4. Functions + 4. reg_contact_addr (string) + 5. Functions - 4.1. uac_replace_from(display,uri) - 4.2. uac_replace_from(uri) - 4.3. uac_restore_from() - 4.4. uac_auth() - 4.5. uac_req_send() - 4.6. uac_reg_lookup(uuid, dst) - 4.7. uac_reg_request_to(user, mode) + 5.1. uac_replace_from(display,uri) + 5.2. uac_replace_from(uri) + 5.3. uac_restore_from() + 5.4. uac_auth() + 5.5. uac_req_send() + 5.6. uac_reg_lookup(uuid, dst) + 5.7. uac_reg_request_to(user, mode) - 5. Exported pseudo-variables - 6. Remote Registration + 6. Exported pseudo-variables + 7. Remote Registration 1. Overview @@ -155,7 +158,7 @@ Chapter 1. Admin Guide 3.6. auth_username_avp (string) 3.7. auth_password_avp (string) 3.8. reg_db_url (string) - 3.9. reg_contact_addr (string) + 3.9. reg_timer_interval (string) 3.1. rr_store_param (string) @@ -263,27 +266,39 @@ modparam("uac", "reg_db_url", "mysql://openser:openserrw@localhost/openser") ... -3.9. reg_contact_addr (string) +3.9. reg_timer_interval (string) + + Timer interval (in seconds) at which registrations are managed, e.g. + renewed as needed. + + The default value is 90 seconds. + + Example 1.9. Set reg_timer_inteval parameter +... +modparam("uac", "reg_timer_interval", 60) +... + +4. reg_contact_addr (string) Address to be used to build contact address. Must be at least host part, can have port and parameters. Must not include 'sip:'. - Example 1.9. Set reg_contact_addr parameter + Example 1.10. Set reg_contact_addr parameter ... modparam("uac", "reg_contact_addr", "192.168.1.2:5080") ... -4. Functions +5. Functions - 4.1. uac_replace_from(display,uri) - 4.2. uac_replace_from(uri) - 4.3. uac_restore_from() - 4.4. uac_auth() - 4.5. uac_req_send() - 4.6. uac_reg_lookup(uuid, dst) - 4.7. uac_reg_request_to(user, mode) + 5.1. uac_replace_from(display,uri) + 5.2. uac_replace_from(uri) + 5.3. uac_restore_from() + 5.4. uac_auth() + 5.5. uac_req_send() + 5.6. uac_reg_lookup(uuid, dst) + 5.7. uac_reg_request_to(user, mode) -4.1. uac_replace_from(display,uri) +5.1. uac_replace_from(display,uri) Replace in FROM header the display name and the URI part. @@ -291,7 +306,7 @@ modparam("uac", "reg_contact_addr", "192.168.1.2:5080") This function can be used from REQUEST_ROUTE and from BRANCH_ROUTE. - Example 1.10. uac_replace_from usage + Example 1.11. uac_replace_from usage ... # replace both display and uri uac_replace_from("$avp(s:display)","$avp(s:uri)"); @@ -303,7 +318,7 @@ uac_replace_from("","sip:robin@gotham.org"); uac_replace_from("",""); ... -4.2. uac_replace_from(uri) +5.2. uac_replace_from(uri) Replace in FROM header the URI part without altering the display name. @@ -311,12 +326,12 @@ uac_replace_from("",""); This function can be used from REQUEST_ROUTE and from BRANCH_ROUTE. - Example 1.11. uac_replace_from usage + Example 1.12. uac_replace_from usage ... uac_replace_from("sip:batman@gotham.org"); ... -4.3. uac_restore_from() +5.3. uac_restore_from() This function will check if the FROM URI was modified and will use the information stored in header parameter to restore the original FROM URI @@ -324,12 +339,12 @@ uac_replace_from("sip:batman@gotham.org"); This function can be used from REQUEST_ROUTE. - Example 1.12. uac_restore_from usage + Example 1.13. uac_restore_from usage ... uac_restore_from(); ... -4.4. uac_auth() +5.4. uac_auth() This function can be called only from failure route and will build the authentication response header and insert it into the request without @@ -337,12 +352,12 @@ uac_restore_from(); This function can be used from FAILURE_ROUTE. - Example 1.13. uac_auth usage + Example 1.14. uac_auth usage ... uac_auth(); ... -4.5. uac_req_send() +5.5. uac_req_send() This function sends a SIP message from the configuration file. The message is built out of $uac_req(...) pseudo-variable. @@ -350,7 +365,7 @@ uac_auth(); This function can be used from REQUEST_ROUTE, FAILURE_ROUTE, BRANCH_ROUTE, ONREPLY_ROUTE, LOCAL_ROUTE. - Example 1.14. uac_req_send usage + Example 1.15. uac_req_send usage ... $uac_req(method)="OPTIONS"; $uac_req(ruri)="sip:kamailio.org"; @@ -359,14 +374,14 @@ $uac_req(turi)="sip:kamailio.org"; uac_req_send(); ... -4.6. uac_reg_lookup(uuid, dst) +5.6. uac_reg_lookup(uuid, dst) This function sets the PV dst to SIP URI that correspond to uuid in uac registations table. uuid and dst must be pseudo-variables. This function can be used from ANY_ROUTE. - Example 1.15. uac_reg_lookup usage + Example 1.16. uac_reg_lookup usage ... if(uac_reg_lookup("$rU", "$ru")) @@ -375,7 +390,7 @@ if(uac_reg_lookup("$rU", "$ru")) } ... -4.7. uac_reg_request_to(user, mode) +5.7. uac_reg_request_to(user, mode) This function can be used to send an authenticated request to a remote user in the uac registrations table. It sets the request-uri, dst-uri @@ -389,7 +404,7 @@ if(uac_reg_lookup("$rU", "$ru")) This function can be used from REQUEST_ROUTE, FAILURE_ROUTE, BRANCH_ROUTE. - Example 1.16. uac_reg_request_to usage + Example 1.17. uac_reg_request_to usage ... if(uac_reg_request_to("$fU", 0)) @@ -408,14 +423,14 @@ failure_route[REMOTE_AUTH] { } ... -5. Exported pseudo-variables +6. Exported pseudo-variables * $uac_req(key) Exported pseudo-variables are documented at http://www.kamailio.org/dokuwiki/. -6. Remote Registration +7. Remote Registration The module can register contact addresses to remote REGISTRAR servers. You have to add records to uacreg table. The table stores following @@ -448,7 +463,7 @@ failure_route[REMOTE_AUTH] { if the call is coming from a remote SIP provider and can change the R-URI to local username@domain. Afterwards you can run location lookup. - Example 1.17. lookup remote registrations usage + Example 1.18. lookup remote registrations usage ... if(uac_reg_lookup("$rU", "$ru")) { xlog("request from a remote SIP provider [$ou => $ru]\n"); diff --git a/modules_k/uac/doc/uac_admin.xml b/modules_k/uac/doc/uac_admin.xml index e278be6..6abbaea 100644 --- a/modules_k/uac/doc/uac_admin.xml +++ b/modules_k/uac/doc/uac_admin.xml @@ -273,22 +273,6 @@ modparam("uac", "reg_db_url", </example> </section> - <section id="reg-contact-addr-id"> - <title><varname>reg_contact_addr</varname> (string)</title> - <para> - Address to be used to build contact address. Must be at least - host part, can have port and parameters. Must not include 'sip:'. - </para> - <example> - <title>Set <varname>reg_contact_addr</varname> parameter</title> - <programlisting format="linespecific"> -... -modparam("uac", "reg_contact_addr", "192.168.1.2:5080") -... - </programlisting> - </example> - </section> - <section id="reg-timer-interval-id"> <title><varname>reg_timer_interval</varname> (string)</title> <para>

1 0

git:master: Fixed equivocation of STR_PARAM / INT_PARAM for reg_timer_interval patch.
by Alex Balashov 21 Nov '11

21 Nov '11

Module: sip-router Branch: master Commit: 3097c7878d395988e137253d77f7fb30707929b0 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=3097c78… Author: Alex Balashov <abalashov(a)evaristesys.com> Committer: Alex Balashov <abalashov(a)evaristesys.com> Date: Mon Nov 21 06:21:24 2011 -0500 Fixed equivocation of STR_PARAM / INT_PARAM for reg_timer_interval patch. --- modules_k/uac/uac.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules_k/uac/uac.c b/modules_k/uac/uac.c index e1d2209..3074c5f 100644 --- a/modules_k/uac/uac.c +++ b/modules_k/uac/uac.c @@ -135,7 +135,7 @@ static param_export_t params[] = { {"auth_password_avp", STR_PARAM, &auth_password_avp }, {"reg_db_url", STR_PARAM, &reg_db_url.s }, {"reg_contact_addr", STR_PARAM, &reg_contact_addr.s }, - {"reg_timer_interval", STR_PARAM, &reg_timer_interval }, + {"reg_timer_interval", INT_PARAM, &reg_timer_interval }, {0, 0, 0} };

1 0

GIT committing and backporting
by Daniel-Constantin Mierla 21 Nov '11

21 Nov '11

Hello, I put together a wiki page to help people porting patches between branches, exemplified with master and 3.2 branches -- the typical patch backporting these days: * http://www.kamailio.org/wiki/devel/backporting-to-3.2.x They are useful also for people with no write access, in case they want to try patches committed to devel branch in their local git repo clones. In additions, I added to kamailio wiki the page with guidelines for commits, trying to give the generic suggestions of how to do it in order to keep the coherence of the development: * http://www.kamailio.org/wiki/devel/git-commit-guidelines Updates and enhancements are welcome! If one has more suggestions or want to debate some of the proposed guidelines, feel free to start the discussion on the mailing list. Cheers, Daniel -- Daniel-Constantin Mierla -- http://www.asipto.com Kamailio Advanced Training, Dec 5-8, Berlin: http://asipto.com/u/kat http://linkedin.com/in/miconda -- http://twitter.com/miconda

1 0

[tracker] Comment added: Double Free -- Crash/Coredump and possible security vulnerability
by sip-router 21 Nov '11

21 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#173 - Double Free -- Crash/Coredump and possible security vulnerability User who did this - Bayan Towfiq (btowfiq) ---------- Just as a note both Brandon Armstead and I are using dlg_manage() in the script. Could this have something to do with it? Bayan ---------- More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=173#comment370 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

[tracker] Task opened: segfault in tm/timers?
by sip-router 21 Nov '11

21 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. A new Flyspray task has been opened. Details are below. User who did this - Bayan Towfiq (btowfiq) Attached to Project - sip-router Summary - segfault in tm/timers? Task Type - Bug Report Category - tm Status - Assigned Assigned To - Andrei Pelinescu-Onciul Operating System - All Severity - High Priority - Normal Reported Version - 3.1 Due in Version - Undecided Due Date - Undecided Details - Running kamailio 3.1.4 (x86_64/linux) Log messages and backtraces posted below Nov 21 01:18:55 localhost /usr/local/sbin/kamailio[3389]: ERROR: tm [t_reply.c:1169]: ERROR: t_should_relay_response: status rewrite by UAS: stored: 408, received: 200 Nov 21 01:18:55 localhost /usr/local/sbin/kamailio[3393]: ERROR: tm [t_reply.c:1169]: ERROR: t_should_relay_response: status rewrite by UAS: stored: 408, received: 200 Nov 21 01:18:55 localhost /usr/local/sbin/kamailio[3398]: ERROR: tm [t_reply.c:1169]: ERROR: t_should_relay_response: status rewrite by UAS: stored: 408, received: 200 Nov 21 01:18:55 localhost /usr/local/sbin/kamailio[3388]: ERROR: tm [t_reply.c:1169]: ERROR: t_should_relay_response: status rewrite by UAS: stored: 408, received: 200 Nov 21 01:18:55 localhost /usr/local/sbin/kamailio[3399]: ERROR: tm [t_reply.c:1169]: ERROR: t_should_relay_response: status rewrite by UAS: stored: 408, received: 200 Nov 21 01:21:53 localhost /usr/local/sbin/kamailio[3402]: ERROR: <core> [timer.c:972]: ERROR: slow timer too slow: overflow (44155 - 43132 = 1023) Nov 21 01:23:18 localhost /usr/local/sbin/kamailio[3402]: last message repeated 3 times Nov 21 01:33:45 localhost /usr/local/sbin/kamailio[3401]: WARNING: db_flatstore [km_flatstore.c:240]: error number: 110 Nov 21 01:33:47 localhost /usr/local/sbin/kamailio[3402]: WARNING: db_flatstore [km_flatstore.c:240]: error number: 110 Nov 21 01:34:06 localhost /usr/local/sbin/kamailio[3401]: ERROR: db_flatstore [km_tcp_connection.c:105]: unable to connect to host: Connection timed out Nov 21 01:34:06 localhost /usr/local/sbin/kamailio[3401]: WARNING: db_flatstore [km_flatstore.c:242]: unable to connect to send over tcp Nov 21 01:34:06 localhost kernel: [14918465.360194] kamailio[3401] general protection ip:7fab7d6307bf sp:7fff8ae30f20 error:0 in tm.so[7fab7d601000+7a000] Nov 21 01:34:07 localhost /usr/local/sbin/kamailio[3422]: : <core> [pass_fd.c:293]: ERROR: receive_fd: EOF on 41 Nov 21 01:34:07 localhost /usr/local/sbin/kamailio[3367]: ALERT: <core> [main.c:741]: child process 3401 exited by a signal 11 Nov 21 01:34:07 localhost /usr/local/sbin/kamailio[3367]: ALERT: <core> [main.c:744]: core was generated Nov 21 01:34:13 localhost /usr/local/sbin/kamailio[3367]: ERROR: ctl [ctl.c:379]: ERROR: ctl: could not delete unix socket /tmp/ser_ctl: Operation not permitted (1) Nov 21 01:34:13 localhost init: kamailio main process ended, respawning Core was generated by `/usr/local/sbin/kamailio -P /var/run/kamailio/kamailio.pid -m 256 -u kamailio -'. Program terminated with signal 11, Segmentation fault. #0 run_trans_callbacks_internal (cb_lst=<value optimized out>, type=128, trans=0x7fab66fceae0, params=0x7fff8ae30fc0) at t_hooks.c:286 286 if ( (cbp->types)&type ) { (gdb) bt #0 run_trans_callbacks_internal (cb_lst=<value optimized out>, type=128, trans=0x7fab66fceae0, params=0x7fff8ae30fc0) at t_hooks.c:286 #1 0x00007fab7d630be3 in run_trans_callbacks (type=0, trans=<value optimized out>, req=<value optimized out>, rpl=0x4000, code=2016588416) at t_hooks.c:317 #2 0x00007fab7d65cee2 in relay_reply (t=0x7fab66fceae0, p_msg=<value optimized out>, branch=2106131784, msg_status=<value optimized out>, cancel_data=<value optimized out>, do_put_on_wait=<value optimized out>) at t_reply.c:1808 #3 0x00007fab7d632172 in fake_reply (t=0x7fab66fceae0, branch=1, code=<value optimized out>) at timer.c:316 #4 0x00007fab7d6324fb in final_response_handler (ticks=360, tl=0x7fab66fcedd8, p=<value optimized out>) at timer.c:490 #5 retr_buf_handler (ticks=360, tl=0x7fab66fcedd8, p=<value optimized out>) at timer.c:547 #6 0x0000000000514d51 in slow_timer_main () at timer.c:1149 #7 0x0000000000463601 in main_loop () at main.c:1602 #8 0x00000000004649c3 in main (argc=11, argv=0x7fff8ae314c8) at main.c:2398 Here is also a full backtrace with the phone number modified to zeros and the IP in the from field changed to xx.xx.xxx.xxx (gdb) bt full #0 run_trans_callbacks_internal (cb_lst=<value optimized out>, type=128, trans=0x7fab66fceae0, params=0x7fff8ae30fc0) at t_hooks.c:286 cbp = 0x732d336c6576656c backup_from = 0x8ae150 backup_to = 0x8ae158 backup_dom_from = 0x8ae160 backup_dom_to = 0x8ae168 backup_uri_from = 0x8ae140 backup_uri_to = 0x8ae148 #1 0x00007fab7d630be3 in run_trans_callbacks (type=0, trans=<value optimized out>, req=<value optimized out>, rpl=0x4000, code=2016588416) at t_hooks.c:317 params = {req = 0x7fab672dca88, rpl = 0xffffffffffffffff, param = 0x7fab67049e40, code = 408, flags = 0, branch = 0, t_rbuf = 0x0, dst = 0x0, send_buf = {s = 0x0, len = 0}} #2 0x00007fab7d65cee2 in relay_reply (t=0x7fab66fceae0, p_msg=<value optimized out>, branch=2106131784, msg_status=<value optimized out>, cancel_data=<value optimized out>, do_put_on_wait=<value optimized out>) at t_reply.c:1808 relay = 1 save_clone = 0 buf = <value optimized out> res_len = 371 relayed_code = 408 relayed_msg = 0xffffffffffffffff reply_bak = 0x0 bm = {to_tag_val = { s = 0xa4d254 "b834aad01f286c898b2a5685a5823214-9083\r\nFrom: <sip:+18150000000@xx.xx.xxx.xxx>;tag=3530827147-842404\r\nCall-ID: 2710327-3530827147-842398(a)gsbc05-lsan.mdsg-pacwest.com\r\nCSeq: 1 INVITE\r\nVia: SIP/2.0/UDP 6"..., len = 37}} totag_retr = 0 reply_status = RPS_COMPLETED uas_rb = 0x7fab66fceba0 to_tag = <value optimized out> reason = {s = 0x5903db "Request Timeout", len = 15} onsend_params = {req = 0x7fab7fd24480, rpl = 0x7fff8ae31110, param = 0x7fff8ae31128, code = -1964830432, flags = 1, branch = 0, t_rbuf = 0x7fff8ae31138, dst = 0x40d959, send_buf = { s = 0x7fab7cfc9240 "AWAVAUATUSH\211\373H\203\354HL\213-H\275!", len = 1727496864}} __FUNCTION__ = "relay_reply" #3 0x00007fab7d632172 in fake_reply (t=0x7fab66fceae0, branch=1, code=<value optimized out>) at timer.c:316 cancel_data = {cancel_bitmap = 0, reason = {cause = 0, u = {text = {s = 0x0, len = 362111}, e2e_cancel = 0x0, packed_hdrs = {s = 0x0, len = 362111}}}} reply_status = <value optimized out> #4 0x00007fab7d6324fb in final_response_handler (ticks=360, tl=0x7fab66fcedd8, p=<value optimized out>) at timer.c:490 prev_branch = 8333648 now = 0 #5 retr_buf_handler (ticks=360, tl=0x7fab66fcedd8, p=<value optimized out>) at timer.c:547 rbuf = 0x7fab66fcedb8 retr_remainder = <value optimized out> retr_interval = <value optimized out> new_retr_interval = <value optimized out> #6 0x0000000000514d51 in slow_timer_main () at timer.c:1149 n = 0 ret = <value optimized out> tl = 0x7fab66fcedd8 #7 0x0000000000463601 in main_loop () at main.c:1602 i = 16 pid = <value optimized out> si = 0x0 si_desc = "udp receiver child=15 sock=70.167.153.134:5060\000\000Pޏ", '\000' <repeats 13 times>, "P\215Y\000\000\000\000\000\016\b\000\000\001\000\000\000&\000\000\000\000\000\000\000\030\325\307f\253\177\000\000\030\325\307f\253\177\000\000\000\234\037\n\372\220X\363\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000" #8 0x00000000004649c3 in main (argc=11, argv=0x7fff8ae314c8) at main.c:2398 ---Type <return> to continue, or q <return> to quit--- cfg_stream = 0x22 c = <value optimized out> r = <value optimized out> tmp = 0x7fff8ae32e76 "" tmp_len = 0 port = <value optimized out> proto = <value optimized out> ret = <value optimized out> seed = 3237932148 rfd = <value optimized out> debug_save = 0 debug_flag = <value optimized out> dont_fork_cnt = 0 n_lst = 0x22 p = <value optimized out> (gdb) More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=179 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

[tracker] Assignee added: segfault in tm/timers?
by sip-router 21 Nov '11

21 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. A user has added themself to the list of users assigned to this task. FS#179 - segfault in tm/timers? User who did this - Bayan Towfiq (btowfiq) http://sip-router.org/tracker/index.php?do=details&task_id=179 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

git:master: modules_k/xcap_server: xcaps_buf sometimes freed in w_xcaps_put ()
by Peter Dunkley 20 Nov '11

20 Nov '11

Module: sip-router Branch: master Commit: 1a72ea1d450062e618eeab04655e7cbc742313f2 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=1a72ea1… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Sat Nov 19 22:44:21 2011 +0000 modules_k/xcap_server: xcaps_buf sometimes freed in w_xcaps_put() - The buffer is alloc'd at module startup so should not be freed here. - When freed here the buffer memory can be alloc'd for other things and then future XCAP server operations will trample over it causing segmentation faults. - Fix by Hugh Waite @ Crocodile RCS. --- modules_k/xcap_server/xcap_server.c | 16 +++++++--------- 1 files changed, 7 insertions(+), 9 deletions(-) diff --git a/modules_k/xcap_server/xcap_server.c b/modules_k/xcap_server/xcap_server.c index 33f5629..66dac1f 100644 --- a/modules_k/xcap_server/xcap_server.c +++ b/modules_k/xcap_server/xcap_server.c @@ -474,29 +474,25 @@ static int w_xcaps_put(sip_msg_t* msg, char* puri, char* ppath, xm = (pv_elem_t*)pbody; body.len = xcaps_buf.len - 1; - body.s = xcaps_buf.s; - if(pv_printf(msg, xm, body.s, &body.len)<0) + if(pv_printf(msg, xm, xcaps_buf.s, &body.len)<0) { LM_ERR("unable to get body\n"); goto error; } - if(body.s==NULL || body.len <= 0) + if(body.len <= 0) { LM_ERR("invalid body parameter\n"); goto error; } - nbuf.s = (char*)pkg_malloc(body.len+1); - if(nbuf.s==NULL) + body.s = (char*)pkg_malloc(body.len+1); + if(body.s==NULL) { LM_ERR("no more pkg\n"); - body.s = NULL; goto error; } - memcpy(nbuf.s, body.s, body.len); - body.s = nbuf.s; + memcpy(body.s, xcaps_buf.s, body.len); body.s[body.len] = '\0'; - nbuf.s = NULL; if(parse_uri(uri.s, uri.len, &turi)!=0) { @@ -517,6 +513,8 @@ static int w_xcaps_put(sip_msg_t* msg, char* puri, char* ppath, { xcaps_send_reply(msg, 412, &xcaps_str_precon, &xcaps_str_empty, &xcaps_str_empty, &xcaps_str_empty); + + pkg_free(body.s); return -2; }

2 4

[tracker] Comment added: Double Free -- Crash/Coredump and possible security vulnerability
by sip-router 20 Nov '11

20 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#173 - Double Free -- Crash/Coredump and possible security vulnerability User who did this - Brandon Armstead (CRYY2010) ---------- Timo, To be honest - after the crash occurred I've tried like 10 different builds from the top of the origin/3.1 origin/3.2 branch downwards - trying to see if one of them would not reproduce the crash. So I can not say without a doubt that this log info is from a 3.1 or a 3.2 branch. However the crash has happened with latest git 3.1 and 3.2 and several commits downwards from these branches. *** MOD PARAM *** # dialog modparam("dialog", "enable_stats", 1) modparam("dialog", "dlg_flag", 4) modparam("dialog", "timeout_avp", "$avp(s:dialog-timeout)") modparam("dialog", "default_timeout", 3600) modparam("dialog", "dlg_match_mode", 1) modparam("dialog", "db_mode", 1) modparam("dialog", "detect_spirals", 1) *** SCENARIO *** The only thing that I am doing in configuration with dialog is three things. 1) I call dlg_manage right before t_relay() 2) I have the following code ABOVE loose_route: if(dlg_get("$ci", "$ft", "$tt")){ xlog("L_INFO", "[$ci] forceful call hangup"); dlg_bye("all"); } 3) I am using various dialog pseudo variables through out the config, typically to insert information into the database via avp_db_query. That is the extent of my dialog scripting. Here is another interesting .... thought this issue seems specific to the following call scenario: UAC -> outbound call -> REGISTRAR -> (CORE PROXY / LCR *CRASHING*) -> PSTN PSTN responds with 503 "Service Unavailable" CORE / PROXY advance routes -> SECOND PSTN *CRASH* Also - another interesting note is that it seems it only happens in this scenario when sending the call to the explicit "SECOND PSTN". If I trade out SECOND PSTN for THIRD PSTN (an alternate carrier) then the crash does not happen. I hope this provides some more light on the situation, let me know if I can provide any additional information, thanks! ---------- More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=173#comment369 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

git:3.2: modules_k/presence_xml: Fixed segmentation fault in pres_check_activities()
by Peter Dunkley 20 Nov '11

20 Nov '11

Module: sip-router Branch: 3.2 Commit: 97738606ba186fd41a4137e6b4c28f5d97a403e9 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=9773860… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Sun Nov 20 21:42:14 2011 +0000 modules_k/presence_xml: Fixed segmentation fault in pres_check_activities() --- modules_k/presence_xml/pres_check.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/modules_k/presence_xml/pres_check.c b/modules_k/presence_xml/pres_check.c index a43ad4b..eecb1c4 100644 --- a/modules_k/presence_xml/pres_check.c +++ b/modules_k/presence_xml/pres_check.c @@ -167,7 +167,9 @@ int presxml_check_activities(struct sip_msg *msg, str presentity_uri, str activi { retval = -2; } + break; } + if (activitiesNode->children == NULL) { LM_DBG("activities node has no children\n"); @@ -175,6 +177,7 @@ int presxml_check_activities(struct sip_msg *msg, str presentity_uri, str activi { retval = -2; } + break; } if ((activityNode = xmlNodeGetNodeByName(activitiesNode, nodeName, NULL)) != NULL)

1 0

git:3.2: modules_k/xcap_server: xcaps_buf sometimes freed in w_xcaps_put()
by Peter Dunkley 20 Nov '11

20 Nov '11

Module: sip-router Branch: 3.2 Commit: d50bf0933db8925d75da09de0036d559c9b34b64 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=d50bf09… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Sat Nov 19 22:44:21 2011 +0000 modules_k/xcap_server: xcaps_buf sometimes freed in w_xcaps_put() - The buffer is alloc'd at module startup so should not be freed here. - When freed here the buffer memory can be alloc'd for other things and then future XCAP server operations will trample over it causing segmentation faults. - Fix by Hugh Waite @ Crocodile RCS. --- modules_k/xcap_server/xcap_server.c | 16 +++++++--------- 1 files changed, 7 insertions(+), 9 deletions(-) diff --git a/modules_k/xcap_server/xcap_server.c b/modules_k/xcap_server/xcap_server.c index 33f5629..66dac1f 100644 --- a/modules_k/xcap_server/xcap_server.c +++ b/modules_k/xcap_server/xcap_server.c @@ -474,29 +474,25 @@ static int w_xcaps_put(sip_msg_t* msg, char* puri, char* ppath, xm = (pv_elem_t*)pbody; body.len = xcaps_buf.len - 1; - body.s = xcaps_buf.s; - if(pv_printf(msg, xm, body.s, &body.len)<0) + if(pv_printf(msg, xm, xcaps_buf.s, &body.len)<0) { LM_ERR("unable to get body\n"); goto error; } - if(body.s==NULL || body.len <= 0) + if(body.len <= 0) { LM_ERR("invalid body parameter\n"); goto error; } - nbuf.s = (char*)pkg_malloc(body.len+1); - if(nbuf.s==NULL) + body.s = (char*)pkg_malloc(body.len+1); + if(body.s==NULL) { LM_ERR("no more pkg\n"); - body.s = NULL; goto error; } - memcpy(nbuf.s, body.s, body.len); - body.s = nbuf.s; + memcpy(body.s, xcaps_buf.s, body.len); body.s[body.len] = '\0'; - nbuf.s = NULL; if(parse_uri(uri.s, uri.len, &turi)!=0) { @@ -517,6 +513,8 @@ static int w_xcaps_put(sip_msg_t* msg, char* puri, char* ppath, { xcaps_send_reply(msg, 412, &xcaps_str_precon, &xcaps_str_empty, &xcaps_str_empty, &xcaps_str_empty); + + pkg_free(body.s); return -2; }

1 0

← Newer
1
...
14
15
16
17
18
19
20
...
34
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev November 2011