sr-dev December 2011

sr-dev@lists.kamailio.org

32 participants
231 discussions

[tracker] Task opened: a74f12d6 (3.2) registrar breaks save(..., 0x4) functionality (Attachment added)
by sip-router 19 Dec '11

19 Dec '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. A new Flyspray task has been opened. Details are below. User who did this - Walter Doekes (wdoekes) Attached to Project - sip-router Summary - a74f12d6 (3.2) registrar breaks save(..., 0x4) functionality Task Type - Bug Report Category - registrar (k) Status - Assigned Assigned To - Daniel-Constantin Mierla Operating System - All Severity - Medium Priority - Normal Reported Version - Development Due in Version - Undecided Due Date - Undecided … [View More]

1 0

[tracker] Assignee added: a74f12d6 (3.2) registrar breaks save(..., 0x4) functionality
by sip-router 19 Dec '11

19 Dec '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. A user has added themself to the list of users assigned to this task. FS#192 - a74f12d6 (3.2) registrar breaks save(..., 0x4) functionality User who did this - Walter Doekes (wdoekes) http://sip-router.org/tracker/index.php?do=details&task_id=192 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your … [View More]

1 0

mediaproxy module and ACK with SDP
by Jasmin Schnatterbeck 19 Dec '11

19 Dec '11

Hello, I've just recognized, that the mediaproxy module does not adjust the SDP connection info of dialog-confirming ACKs (kamailio 3.2.1). mediaproxy.c registers for the following dialog req callbacks: mediaproxy.c:1955 if (dlg_api.register_dlgcb(dlg, DLGCB_REQ_WITHIN, __dialog_requests, (void*)ice_data, __free_dialog_data) != 0) But in dlg_handlers.c 1194 if (old_state==DLG_STATE_CONFIRMED_NA) { 1195 LM_DBG("confirming ACK successfully processed\n"… [View More]

1 0

git:master: lib/srdb1: Enable non-pooled database connections to be defined .
by Peter Dunkley 18 Dec '11

18 Dec '11

Module: sip-router Branch: master Commit: 2dad021502d0f931fabde0e4c220baf70898a877 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=2dad021… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Sun Dec 18 21:13:19 2011 +0000 lib/srdb1: Enable non-pooled database connections to be defined. - Kamailio pools database connections, but sometimes this causes problems. For example, we (Crocodile) observed … [View More]an issue with many different queries happening on the same connection while using db_fetch_next(). - This change enables you to specify a DB connection as non-pooled by putting a '*' at the start of the DB URL in kamailio.cfg. - Feature added by Paul Pankhurst @ Crocodile RCS --- lib/srdb1/db.c | 13 +++++++++++-- lib/srdb1/db_id.c | 27 ++++++++++++++++++++++++--- lib/srdb1/db_id.h | 1 + 3 files changed, 36 insertions(+), 5 deletions(-) diff --git a/lib/srdb1/db.c b/lib/srdb1/db.c index 892a849..5905bb0 100644 --- a/lib/srdb1/db.c +++ b/lib/srdb1/db.c @@ -182,8 +182,17 @@ int db_bind_mod(const str* mod, db_func_t* mydbf) return -1; } memcpy(name, "db_", 3); - memcpy(name+3, mod->s, mod->len); - name[mod->len+3] = 0; + + if (mod->s[0]=='*' ) + { + memcpy(name+3, (mod->s)+1, (mod->len)-1); + name[mod->len-1+3] = 0; + } + else + { + memcpy(name+3, mod->s, mod->len); + name[mod->len+3] = 0; + } /* for safety we initialize mydbf with 0 (this will cause * a segfault immediately if someone tries to call a function diff --git a/lib/srdb1/db_id.c b/lib/srdb1/db_id.c index 8c8b2a3..4aa564b 100644 --- a/lib/srdb1/db_id.c +++ b/lib/srdb1/db_id.c @@ -65,12 +65,13 @@ static int dupl_string(char** dst, const char* begin, const char* end) * \param url parsed URL * \return 0 if parsing was successful and -1 otherwise */ -static int parse_db_url(struct db_id* id, const str* url) +static int parse_db_url(struct db_id* id, const str* url, int *poolid ) { #define SHORTEST_DB_URL "s://a/b" #define SHORTEST_DB_URL_LEN (sizeof(SHORTEST_DB_URL) - 1) enum state { + ST_NONPOOL, /* Non pooling flag */ ST_SCHEME, /* Scheme part */ ST_SLASH1, /* First slash */ ST_SLASH2, /* Second slash */ @@ -99,11 +100,25 @@ static int parse_db_url(struct db_id* id, const str* url) /* Initialize all attributes to 0 */ memset(id, 0, sizeof(struct db_id)); - st = ST_SCHEME; + st = ST_NONPOOL; begin = url->s; for(i = 0; i < len; i++) { switch(st) { + case ST_NONPOOL: + st = ST_SCHEME; + switch(url->s[i]) { + case '*': + id->poolid = ++(*poolid); + begin++; + break; + + default: + id->poolid = 0; + break; + } + break; + case ST_SCHEME: switch(url->s[i]) { case ':': @@ -229,6 +244,7 @@ static int parse_db_url(struct db_id* id, const str* url) */ struct db_id* new_db_id(const str* url) { + static int poolid=0; struct db_id* ptr; if (!url || !url->s) { @@ -243,7 +259,7 @@ struct db_id* new_db_id(const str* url) } memset(ptr, 0, sizeof(struct db_id)); - if (parse_db_url(ptr, url) < 0) { + if (parse_db_url(ptr, url, &poolid) < 0) { LM_ERR("error while parsing database URL: '%.*s' \n", url->len, url->s); goto err; } @@ -286,6 +302,11 @@ unsigned char cmp_db_id(const struct db_id* id1, const struct db_id* id2) id1->pid, id2->pid); return 0; } + if(id1->poolid!=id2->poolid) { + LM_DBG("identical DB URLs, but different poolids [%d/%d]\n", + id1->poolid, id2->poolid); + return 0; + } return 1; } diff --git a/lib/srdb1/db_id.h b/lib/srdb1/db_id.h index 20ab846..b7427a7 100644 --- a/lib/srdb1/db_id.h +++ b/lib/srdb1/db_id.h @@ -41,6 +41,7 @@ struct db_id { unsigned short port; /**< Port number */ char* database; /**< Database, case sensitive */ int pid; /**< Process ID (detect cross connections) */ + int poolid; /**< poolid within a pid */ }; [View Less]

2 2

git:master: modules_k/presence: Added additional return value to pres_auth_status() for polite-block
by Peter Dunkley 18 Dec '11

18 Dec '11

Module: sip-router Branch: master Commit: 27ab10b4c61593ae544b7c24633840d0deafff92 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=27ab10b… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Sun Dec 18 21:08:45 2011 +0000 modules_k/presence: Added additional return value to pres_auth_status() for polite-block - pres_auth_status() currently returns just the status of presence relationship. - However, … [View More]

1 0

git:master: tls: new parameter 'renegotiation' to enable/ disable client renegotiation
by Daniel-Constantin Mierla 17 Dec '11

17 Dec '11

Module: sip-router Branch: master Commit: 5731486ac973324f25b091367a573d710f4fe71f URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5731486… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Sat Dec 17 22:22:04 2011 +0100 tls: new parameter 'renegotiation' to enable/disable client renegotiation - default is 0 (renegotiation disabled), to protect against SSL renegotiation attack - … [View More]can be enabled by setting it to 1 --- modules/tls/tls_domain.c | 36 ++++++++++++++++++++++++++++++++++++ modules/tls/tls_mod.c | 3 +++ modules/tls/tls_mod.h | 2 ++ modules/tls/tls_server.c | 32 ++++++++++++++++++++++++-------- modules/tls/tls_server.h | 4 +++- 5 files changed, 68 insertions(+), 9 deletions(-) diff --git a/modules/tls/tls_domain.c b/modules/tls/tls_domain.c index a61149d..d353b81 100644 --- a/modules/tls/tls_domain.c +++ b/modules/tls/tls_domain.c @@ -591,6 +591,40 @@ static int set_verification(tls_domain_t* d) } +/* This callback function is executed when libssl processes the SSL + * handshake and does SSL record layer stuff. It's used to trap + * client-initiated renegotiations. + */ + +static void sr_ssl_ctx_info_callback(const SSL *ssl, int event, int ret) +{ + struct tls_extra_data* data = 0; + int tls_dbg; + + if (event & SSL_CB_HANDSHAKE_START) { + tls_dbg = cfg_get(tls, tls_cfg, debug); + LOG(tls_dbg, "SSL handshake started\n"); + if(data==0) + data = (struct tls_extra_data*)SSL_get_app_data(ssl); + if(data->flags & F_TLS_CON_HANDSHAKED) { + LOG(tls_dbg, "SSL renegotiation initiated by client\n"); + data->flags |= F_TLS_CON_RENEGOTIATION; + } + } + if (event & SSL_CB_HANDSHAKE_DONE) { + tls_dbg = cfg_get(tls, tls_cfg, debug); + if(data==0) + data = (struct tls_extra_data*)SSL_get_app_data(ssl); + LOG(tls_dbg, "SSL handshake done\n"); + /* CVE-2009-3555 - disable renegotiation */ + if (ssl->s3) { + LOG(tls_dbg, "SSL disable renegotiation\n"); + ssl->s3->flags |= SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS; + } + data->flags |= F_TLS_CON_HANDSHAKED; + } +} + /** * @brief Configure generic SSL parameters * @param d domain @@ -635,6 +669,8 @@ static int set_ssl_options(tls_domain_t* d) #endif for(i = 0; i < procs_no; i++) { SSL_CTX_set_options(d->ctx[i], options); + if(sr_tls_renegotiation==0) + SSL_CTX_set_info_callback(d->ctx[i], sr_ssl_ctx_info_callback); } return 0; } diff --git a/modules/tls/tls_mod.c b/modules/tls/tls_mod.c index 2f7d626..e0c05d8 100644 --- a/modules/tls/tls_mod.c +++ b/modules/tls/tls_mod.c @@ -175,6 +175,8 @@ tls_domains_cfg_t** tls_domains_cfg = NULL; gen_lock_t* tls_domains_cfg_lock = NULL; +int sr_tls_renegotiation = 0; + /* * Exported functions */ @@ -218,6 +220,7 @@ static param_export_t params[] = { {"tls_force_run", PARAM_INT, &default_tls_cfg.force_run}, {"low_mem_threshold1", PARAM_INT, &default_tls_cfg.low_mem_threshold1}, {"low_mem_threshold2", PARAM_INT, &default_tls_cfg.low_mem_threshold2}, + {"renegotiation", PARAM_INT, &sr_tls_renegotiation}, {0, 0, 0} }; diff --git a/modules/tls/tls_mod.h b/modules/tls/tls_mod.h index a19e9aa..462e5d0 100644 --- a/modules/tls/tls_mod.h +++ b/modules/tls/tls_mod.h @@ -53,4 +53,6 @@ extern tls_domain_t srv_defaults; extern str tls_domains_cfg_file; +extern int sr_tls_renegotiation; + #endif /* _TLS_MOD_H */ diff --git a/modules/tls/tls_server.c b/modules/tls/tls_server.c index 5ccf545..e3d0a61 100644 --- a/modules/tls/tls_server.c +++ b/modules/tls/tls_server.c @@ -209,6 +209,10 @@ static int tls_complete_init(struct tcp_connection* c) #endif SSL_set_bio(data->ssl, data->rwbio, data->rwbio); c->extra_data = data; + + /* link the extra data struct inside ssl connection*/ + SSL_set_app_data(data->ssl, data); + return 0; error: @@ -908,6 +912,7 @@ int tls_read_f(struct tcp_connection* c, int* flags) int n, flush_flags; char* err_src; int x; + int tls_dbg; TLS_RD_TRACE("(%p, %p (%d)) start (%s -> %s:%d*)\n", c, flags, *flags, @@ -1092,15 +1097,26 @@ continue_ssl_read: * In the later case, this whole function should be called again * once there is more output space (set RD_CONN_REPEAT_READ). */ - if (unlikely(n <= 0)) { - ssl_error = SSL_get_error(ssl, n); - err_src = "TLS read:"; - /* errors handled below, outside the lock */ + + if (unlikely(tls_c->flags & F_TLS_CON_RENEGOTIATION)) { + /* Fix CVE-2009-3555 - disable renegotiation if started by client + * - simulate SSL EOF to force close connection*/ + tls_dbg = cfg_get(tls, tls_cfg, debug); + LOG(tls_dbg, "Reading on a renegotiation of connection (n:%d) (%d)\n", + n, SSL_get_error(ssl, n)); + err_src = "TLS R-N read:"; + ssl_error = SSL_ERROR_ZERO_RETURN; } else { - ssl_error = SSL_ERROR_NONE; - r->pos += n; - ssl_read += n; - bytes_free -=n; + if (unlikely(n <= 0)) { + ssl_error = SSL_get_error(ssl, n); + err_src = "TLS read:"; + /* errors handled below, outside the lock */ + } else { + ssl_error = SSL_ERROR_NONE; + r->pos += n; + ssl_read += n; + bytes_free -=n; + } } TLS_RD_TRACE("(%p, %p) SSL_read() => %d (err=%d) ssl_read=%d" " *flags=%d tls_c->flags=%d\n", diff --git a/modules/tls/tls_server.h b/modules/tls/tls_server.h index 62047d5..4b00d06 100644 --- a/modules/tls/tls_server.h +++ b/modules/tls/tls_server.h @@ -49,7 +49,9 @@ struct tls_rd_buf { }; /* tls conn flags */ -#define F_TLS_CON_WR_WANTS_RD 1 /* write wants read */ +#define F_TLS_CON_WR_WANTS_RD 1 /* write wants read */ +#define F_TLS_CON_HANDSHAKED 2 /* connection is handshaked */ +#define F_TLS_CON_RENEGOTIATION 4 /* renegotiation by clinet */ struct tls_extra_data { tls_domains_cfg_t* cfg; /* Configuration used for this connection */ [View Less]

1 0

git:master: tls: use pkg-config to get cflags and libs for compilation
by Daniel-Constantin Mierla 17 Dec '11

17 Dec '11

Module: sip-router Branch: master Commit: 62b824b10b6ff9a18e336ff20c55d2d6ea6cba3c URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=62b824b… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Sat Dec 17 21:32:22 2011 +0100 tls: use pkg-config to get cflags and libs for compilation --- modules/tls/Makefile | 30 ++++++++++++++++++++++-------- 1 files changed, 22 insertions(+), 8 … [View More]

1 0

rufuslefunk
by ade darmawan 17 Dec '11

17 Dec '11

How are you? Let us get down to business. http://www.leonardobieber.it/image/bdfedx.php?xukoprofID=49 Sat, 17 Dec 2011 12:37:35 __________________ "First, she would lay down the cover and put upon it a piece of tin, made to fill papers with, to keep it down smooth." (c) Millandra vollblutpferd

1 0

git:master: textopsx: documented keep_hf() function
by Daniel-Constantin Mierla 16 Dec '11

16 Dec '11

Module: sip-router Branch: master Commit: d05746ee5bfb1dee1e7cd206bfa08765225358ce URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=d05746e… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Fri Dec 16 22:30:08 2011 +0100 textopsx: documented keep_hf() function --- modules/textopsx/README | 23 +++++++++++++++++++---- modules/textopsx/doc/functions.xml | 27 ++++++++++… [View More]+++++++++++++++-- 2 files changed, 44 insertions(+), 6 deletions(-) diff --git a/modules/textopsx/README b/modules/textopsx/README index 6e28690..d4e51e8 100644 --- a/modules/textopsx/README +++ b/modules/textopsx/README @@ -9,7 +9,7 @@ Daniel-Constantin Mierla asipto.com <miconda(a)gmail.com> - Copyright © 2003 FhG FOKUS + Copyright � 2003 FhG FOKUS __________________________________________________________________ 1.1. Overview @@ -18,6 +18,7 @@ Daniel-Constantin Mierla 1.2.1. msg_apply_changes() 1.2.2. change_reply_status(code, reason) 1.2.3. remove_body() + 1.2.4. keep_hf(regexp) 1.1. Overview @@ -27,7 +28,7 @@ Daniel-Constantin Mierla 1.2. Functions -1.2.1. msg_apply_changes() +1.2.1. msg_apply_changes() Use this function to apply changes performed on SIP request content. Be careful when using this function; due to special handling of changes @@ -49,7 +50,7 @@ if(msg_apply_changes()) } ... -1.2.2. change_reply_status(code, reason) +1.2.2. change_reply_status(code, reason) Intercept a SIP reply (in an onreply_route) and change its status code and reason phrase prior to propogating it. @@ -70,7 +71,7 @@ onreply_route { } ... -1.2.3. remove_body() +1.2.3. remove_body() Use this function to remove body of SIP requests or replies. @@ -80,3 +81,17 @@ onreply_route { ... remove_body(); ... + +1.2.4. keep_hf(regexp) + + Remove headers that don't match the regular expression regexp. Several + header are ignored always (thus not removed): Via, From, To, Call-ID, + CSeq, Content-Lenght, Content-Type, Max-Forwards, Contact, Route, + Record-Route -- these can be removed one by one with remove_hf(). + + This function can be used from ANY_ROUTE. + + Example 4. keep_hf() usage +... +keep_hf("User-Agent"); +... diff --git a/modules/textopsx/doc/functions.xml b/modules/textopsx/doc/functions.xml index 0e837a1..eec3144 100644 --- a/modules/textopsx/doc/functions.xml +++ b/modules/textopsx/doc/functions.xml @@ -5,7 +5,7 @@ <section id="textopsx.functions" xmlns:xi="http://www.w3.org/2001/XInclude"> <title>Functions</title> - <section id="msg_apply_changes"> + <section id="textopsx.msg_apply_changes"> <title> <function moreinfo="none">msg_apply_changes()</function> </title> @@ -36,7 +36,7 @@ if(msg_apply_changes()) </example> </section> - <section id="change_reply_status"> + <section id="textopsx.change_reply_status"> <title> <function>change_reply_status(code, reason)</function> </title> @@ -93,5 +93,28 @@ remove_body(); </example> </section> + <section id="textopsx.keep_hf"> + <title> + <function moreinfo="none">keep_hf(regexp)</function> + </title> + <para> + Remove headers that don't match the regular expression regexp. + Several header are ignored always (thus not removed): Via, From, + To, Call-ID, CSeq, Content-Lenght, Content-Type, Max-Forwards, + Contact, Route, Record-Route -- these can be removed one by one + with remove_hf(). + </para> + <para> + This function can be used from ANY_ROUTE. + </para> + <example> + <title><function>keep_hf()</function> usage</title> + <programlisting format="linespecific"> +... +keep_hf("User-Agent"); +... +</programlisting> + </example> + </section> </section> [View Less]

1 0

git:master: textopsx: added keep_hf("regexp")
by Daniel-Constantin Mierla 16 Dec '11

16 Dec '11

Module: sip-router Branch: master Commit: 1b6d53726362de49065bbfaf11e0a5d07dae6b22 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=1b6d537… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Fri Dec 16 20:50:50 2011 +0100 textopsx: added keep_hf("regexp") - remove headers that don't match the regular expression regexp - several header are ignored always (thus not removed): Via, From, … [View More]To, Call-ID, CSeq, Content-Lenght, Content-Type, Max-Forwards, Contact, Route, Record-Route -- these can be removed one by one with remove_hf() - the new function helps reducing the size of the sip message, by removing not mandatory headers --- modules/textopsx/textopsx.c | 61 +++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 61 insertions(+), 0 deletions(-) diff --git a/modules/textopsx/textopsx.c b/modules/textopsx/textopsx.c index 2228d3b..687cce4 100644 --- a/modules/textopsx/textopsx.c +++ b/modules/textopsx/textopsx.c @@ -32,6 +32,7 @@ #include "../../dprint.h" #include "../../data_lump.h" #include "../../msg_translator.h" +#include "../../mod_fix.h" #include "api.h" @@ -42,6 +43,8 @@ static int msg_apply_changes_f(sip_msg_t *msg, char *str1, char *str2); static int change_reply_status_f(struct sip_msg*, char*, char *); static int change_reply_status_fixup(void** param, int param_no); +static int w_keep_hf_f(struct sip_msg*, char*, char *); + static int w_remove_body_f(struct sip_msg*, char*, char *); static int bind_textopsx(textopsx_api_t *tob); @@ -53,6 +56,8 @@ static cmd_export_t cmds[] = { change_reply_status_fixup, ONREPLY_ROUTE }, {"remove_body", (cmd_function)w_remove_body_f, 0, 0, ANY_ROUTE }, + {"keep_hf", (cmd_function)w_keep_hf_f, 1, + fixup_regexp_null, ANY_ROUTE }, {"bind_textopsx", (cmd_function)bind_textopsx, 1, 0, ANY_ROUTE }, @@ -262,6 +267,62 @@ static int w_remove_body_f(struct sip_msg *msg, char *p1, char *p2) return 1; } + +/** + * + */ +static int w_keep_hf_f(struct sip_msg* msg, char* key, char* foo) +{ + struct hdr_field *hf; + regex_t *re; + regmatch_t pmatch; + char c; + struct lump* l; + + re = (regex_t*)key; + + /* we need to be sure we have seen all HFs */ + parse_headers(msg, HDR_EOH_F, 0); + for (hf=msg->headers; hf; hf=hf->next) + { + switch(hf->type) { + case HDR_FROM_T: + case HDR_TO_T: + case HDR_CALLID_T: + case HDR_CSEQ_T: + case HDR_VIA_T: + case HDR_VIA2_T: + case HDR_CONTACT_T: + case HDR_CONTENTLENGTH_T: + case HDR_CONTENTTYPE_T: + case HDR_ROUTE_T: + case HDR_RECORDROUTE_T: + case HDR_MAXFORWARDS_T: + continue; + default: + ; + } + + c = hf->name.s[hf->name.len]; + hf->name.s[hf->name.len] = '\0'; + if (regexec(re, hf->name.s, 1, &pmatch, 0)!=0) + { + /* no match => remove */ + hf->name.s[hf->name.len] = c; + l=del_lump(msg, hf->name.s-msg->buf, hf->len, 0); + if (l==0) + { + LM_ERR("cannot remove header\n"); + return -1; + } + } else { + hf->name.s[hf->name.len] = c; + } + } + + return -1; +} + /* * Function to load the textops api. */ [View Less]

1 0

← Newer
1
...
7
8
9
10
11
12
13
...
24
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev December 2011