THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
The following task has a new comment added:
FS#128 - Debian / Ubuntu Packages for Kamailio 3.1.3 Broken
User who did this - Ali Onur Uyar (aouyar)
----------
Luckily found the old debs hanging around in the apt cache directory and after uninstalling the 3.1.3 debs and installing 3.1.2 debs manually, finally managed to get a working installation again.
The problem is that the 3.1.2 debs are not published anywhere and anyone doing a clean install using debs or upgrading to the new version will end up with a broken installation.
----------
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=128#comment204
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
A new Flyspray task has been opened. Details are below.
User who did this - Francesco Castellano (fcastellano)
Attached to Project - sip-router
Summary - Segfault parsing STUN body
Task Type - Bug Report
Category - stun
Status - Assigned
Assigned To - Andrei Pelinescu-Onciul
Operating System - Linux
Severity - High
Priority - Normal
Reported Version - 3.1
Due in Version - Undecided
Due Date - Undecided
Details - After upgrading to kamailio 3.1.3, with STUN enabled, our proxy experienced random segfault to udp worker processes. Recompiling with symbols and extra_debug, and analysing the coredumps with a collegue of mine, it appeared that the problem lies somewhere in ser_stun.c (actually after our findings tunrning off stun_allow_stun, the segfaults ended).
(gdb) bt
#0 0x00007f6e54964785 in memcpy () from /lib/libc.so.6
#1 0x00000000004ced6c in stun_parse_body (req=0x7fffa26a7140, unknown=0x7fffa26a70a8, error_code=0x7fffa26a70a6) at ser_stun.c:268
#2 0x00000000004ce427 in stun_process_msg (buf=0x8dee20 "", len=36, ri=0x7fffa26a71e0) at ser_stun.c:127
#3 0x000000000051a3eb in udp_rcv_loop () at udp_server.c:526
#4 0x000000000045ecce in main_loop () at main.c:1554
#5 0x0000000000461aad in main (argc=13, argv=0x7fffa26a7508) at main.c:2398
Ah, our system is x86_64; kamailio, as apparent, was compiled by ourselves for having STUN enabled. For the version with symbols the core flags were:
version: kamailio 3.1.3 (x86_64/linux) 8b3506
flags: STATS: Off, EXTRA_DEBUG, USE_IPV6, USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, USE_STUN, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, DBG_QM_MALLOC, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, PKG_SIZE 32MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: 8b3506
compiled on 03:32:10 Apr 28 2011 with gcc 4.4.5
But the segfaults were firstly noticed on a core with:
version: kamailio 3.1.3 (x86_64/linux) 8b3506
flags: STATS: Off, USE_IPV6, USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, USE_STUN, DISABLE_NAGLE, USE_MCAST, NO_DEBUG, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, F_MALLOC, DBG_QM_MALLOC, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, PKG_SIZE 32MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: 8b3506
compiled on 03:37:09 Apr 28 2011 with gcc 4.4.5
In particular, during the while loop for processing the STUN body attributes, it seems that something wrong prevented breaking the loop. Our attention focused on an attr.type 0x8022 (in the file it matched SERVER_ATTR, and, if I understand correctly, it is the same as the SOFTWARE attribute in rfc5389). Calculating the padded_len in ser_stun.c:307 via the PADDED_TO_FOUR macro; and being in our case ntohs(attr.len) = 12; the padded_len resulted in 16 (is this correct? The PADDED_TO_FOUR name suggests that 12 *is* padded to four); so that not_parsed (it was 12, and it was declared UINT_T) bacame something odd: (UINT_T) (12 - 16).
I'm sorry having be a little detailed; but I hope this can help the developers in fixing it.
I don't attach any cores because they are quite large (2GB each); but having them, I can add informations if you please. Moreover, even if I haven't replicated it yet in a controlled manner; I don't think it is a complex task.
Best regards,
Francesco Castellano
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=129
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
A user has added themself to the list of users assigned to this task.
FS#129 - Segfault parsing STUN body
User who did this - Francesco Castellano (fcastellano)
http://sip-router.org/tracker/index.php?do=details&task_id=129
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
Module: sip-router
Branch: master
Commit: d9753df9fc8d969dcc28a5cc7e9e5b82e2410074
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=d9753df…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: Fri Apr 29 12:14:42 2011 +0200
sdpops: added mapping table with codecs names and ids
---
modules/sdpops/sdpops_data.c | 98 ++++++++++++++++++++++++++++++++++++++++++
modules/sdpops/sdpops_data.h | 30 +++++++++++++
2 files changed, 128 insertions(+), 0 deletions(-)
diff --git a/modules/sdpops/sdpops_data.c b/modules/sdpops/sdpops_data.c
new file mode 100644
index 0000000..72646d4
--- /dev/null
+++ b/modules/sdpops/sdpops_data.c
@@ -0,0 +1,98 @@
+/*
+ * $Id$
+ *
+ * Copyright (C) 2011 Daniel-Constantin Mierla (asipto.com)
+ *
+ * This file is part of Kamailio, a free SIP server.
+ *
+ * Kamailio is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version
+ *
+ * Kamailio is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "../../dprint.h"
+#include "sdpops_data.h"
+
+#if 0
+
+http://www.iana.org/assignments/rtp-parameters
+
+Registry Name: RTP Payload types (PT) for standard audio and video encodings - Closed
+Reference: [RFC3551]
+Registration Procedures: Registry closed; see [RFC3551], Section 3
+
+Note:
+The RFC "RTP Profile for Audio and Video Conferences with Minimal
+Control" [RFC3551] specifies an initial set "payload types". This
+list maintains and extends that list.
+
+Registry:
+PT encoding name audio/video (A/V) clock rate (Hz) channels (audio) Reference
+-------- -------------- ----------------- --------------- ---------------- ---------
+0 PCMU A 8000 1 [RFC3551]
+1 Reserved
+2 Reserved
+3 GSM A 8000 1 [RFC3551]
+4 G723 A 8000 1 [Kumar][RFC3551]
+5 DVI4 A 8000 1 [RFC3551]
+6 DVI4 A 16000 1 [RFC3551]
+7 LPC A 8000 1 [RFC3551]
+8 PCMA A 8000 1 [RFC3551]
+9 G722 A 8000 1 [RFC3551]
+10 L16 A 44100 2 [RFC3551]
+11 L16 A 44100 1 [RFC3551]
+12 QCELP A 8000 1 [RFC3551]
+13 CN A 8000 1 [RFC3389]
+14 MPA A 90000 [RFC3551][RFC2250]
+15 G728 A 8000 1 [RFC3551]
+16 DVI4 A 11025 1 [DiPol]
+17 DVI4 A 22050 1 [DiPol]
+18 G729 A 8000 1 [RFC3551]
+19 Reserved A
+20 Unassigned A
+21 Unassigned A
+22 Unassigned A
+23 Unassigned A
+24 Unassigned V
+25 CelB V 90000 [RFC2029]
+26 JPEG V 90000 [RFC2435]
+27 Unassigned V
+28 nv V 90000 [RFC3551]
+29 Unassigned V
+30 Unassigned V
+31 H261 V 90000 [RFC4587]
+32 MPV V 90000 [RFC2250]
+33 MP2T AV 90000 [RFC2250]
+34 H263 V 90000 [Zhu]
+35-71 Unassigned ?
+72-76 Reserved for RTCP conflict avoidance [RFC3551]
+77-95 Unassigned ?
+96-127 dynamic ? [RFC3551]
+
+
+Registry Name: RTP Payload Format media types
+Reference: [RFC4855]
+Registration Procedures: Standards Action Process or expert approval
+
+#endif
+
+int sdpops_get_id_by_name(str *name, str *id)
+{
+ return 0;
+}
diff --git a/modules/sdpops/sdpops_data.h b/modules/sdpops/sdpops_data.h
new file mode 100644
index 0000000..a00a5d8
--- /dev/null
+++ b/modules/sdpops/sdpops_data.h
@@ -0,0 +1,30 @@
+/*
+ * $Id$
+ *
+ * Copyright (C) 2011 Daniel-Constantin Mierla (asipto.com)
+ *
+ * This file is part of Kamailio, a free SIP server.
+ *
+ * Kamailio is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version
+ *
+ * Kamailio is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+
+#ifndef _SDPOPS_DATA_H_
+#define _SDPOPS_DATA_H_
+#include "../../str.h"
+
+int sdpops_get_id_by_name(str *name, str *id);
+#endif