sr-dev April 2015

sr-dev@lists.kamailio.org

36 participants
248 discussions

git:master:6e260446: sqlops: fix use-after-free by deep copying result name

by Timo TerÃ¤s

Module: kamailio Branch: master Commit: 6e2604464e64cfaaf1e0327228f53f4787b69470 URL: https://github.com/kamailio/kamailio/commit/6e2604464e64cfaaf1e0327228f53f4… Author: Timo TerÃ¤s <timo.teras(a)iki.fi> Committer: Timo TerÃ¤s <timo.teras(a)iki.fi> Date: 2015-04-16T12:08:20+03:00 sqlops: fix use-after-free by deep copying result name When creating a new result handle, deep copy the result name. Otherwise we might end up accessing the name after it's freed. --- Modified: modules/sqlops/sql_api.c --- Diff: https://github.com/kamailio/kamailio/commit/6e2604464e64cfaaf1e0327228f53f4… Patch: https://github.com/kamailio/kamailio/commit/6e2604464e64cfaaf1e0327228f53f4… --- diff --git a/modules/sqlops/sql_api.c b/modules/sqlops/sql_api.c index cf0efee..db87fbf 100644 --- a/modules/sqlops/sql_api.c +++ b/modules/sqlops/sql_api.c @@ -197,14 +197,16 @@ sql_result_t* sql_get_result(str *name) return sr; sr = sr->next; } - sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t)); + sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t) + name->len); if(sr==NULL) { LM_ERR("no pkg memory\n"); return NULL; } memset(sr, 0, sizeof(sql_result_t)); - sr->name = *name; + memcpy(sr+1, name->s, name->len); + sr->name.s = (char *)(sr + 1); + sr->name.len = name->len; sr->resid = resid; sr->next = _sql_result_root; _sql_result_root = sr; @@ -683,6 +685,7 @@ void sql_destroy(void) pkg_free(r); r = r0; } + _sql_result_root = NULL; } /**

9 years, 7 months

git:4.2:d3005687: uac: reset the ongoing registration flags in case of error in tm callback

by Daniel-Constantin Mierla

Module: kamailio Branch: 4.2 Commit: d3005687cc7d52ef689592391a19fc89c59aa312 URL: https://github.com/kamailio/kamailio/commit/d3005687cc7d52ef689592391a19fc8… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2015-04-16T11:02:20+02:00 uac: reset the ongoing registration flags in case of error in tm callback - resulted in being stuck in a state that didn't retry registration - reported by AndyJRobinson, GH#124 (cherry picked from commit 08d7b66310e7c09a70db296f533f98b32d2e4ad8) --- Modified: modules/uac/uac_reg.c --- Diff: https://github.com/kamailio/kamailio/commit/d3005687cc7d52ef689592391a19fc8… Patch: https://github.com/kamailio/kamailio/commit/d3005687cc7d52ef689592391a19fc8… --- diff --git a/modules/uac/uac_reg.c b/modules/uac/uac_reg.c index 1f47ee5..d295dbb 100644 --- a/modules/uac/uac_reg.c +++ b/modules/uac/uac_reg.c @@ -878,6 +878,7 @@ void uac_reg_tm_callback( struct cell *t, int type, struct tmcb_params *ps) } error: + ri->flags &= ~(UAC_REG_ONGOING|UAC_REG_AUTHSENT); if(reg_retry_interval) ri->timer_expires = time(NULL) + reg_retry_interval; else

9 years, 7 months

git:master:08d7b663: uac: reset the ongoing registration flags in case of error in tm callback

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: 08d7b66310e7c09a70db296f533f98b32d2e4ad8 URL: https://github.com/kamailio/kamailio/commit/08d7b66310e7c09a70db296f533f98b… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2015-04-16T10:53:17+02:00 uac: reset the ongoing registration flags in case of error in tm callback - resulted in being stuck in a state that didn't retry registration - reported by AndyJRobinson, GH#124 --- Modified: modules/uac/uac_reg.c --- Diff: https://github.com/kamailio/kamailio/commit/08d7b66310e7c09a70db296f533f98b… Patch: https://github.com/kamailio/kamailio/commit/08d7b66310e7c09a70db296f533f98b… --- diff --git a/modules/uac/uac_reg.c b/modules/uac/uac_reg.c index 07081d4..5bf24eb 100644 --- a/modules/uac/uac_reg.c +++ b/modules/uac/uac_reg.c @@ -898,6 +898,7 @@ void uac_reg_tm_callback( struct cell *t, int type, struct tmcb_params *ps) } error: + ri->flags &= ~(UAC_REG_ONGOING|UAC_REG_AUTHSENT); if(reg_retry_interval) { ri->timer_expires = time(NULL) + reg_retry_interval; } else {

9 years, 7 months

git:master:572d4c8e: modules/dialog_ng: add release_dlg api function

by jaybeepee

Module: kamailio Branch: master Commit: 572d4c8e886b7b7d0bbc975ecf1a4d20bf9e18b9 URL: https://github.com/kamailio/kamailio/commit/572d4c8e886b7b7d0bbc975ecf1a4d2… Author: jaybeepee <jason.penton(a)gmail.com> Committer: jaybeepee <jason.penton(a)gmail.com> Date: 2015-04-15T21:35:36+02:00 modules/dialog_ng: add release_dlg api function --- Modified: modules/dialog_ng/dialog.c Modified: modules/dialog_ng/dlg_hash.c Modified: modules/dialog_ng/dlg_hash.h Modified: modules/dialog_ng/dlg_load.h --- Diff: https://github.com/kamailio/kamailio/commit/572d4c8e886b7b7d0bbc975ecf1a4d2… Patch: https://github.com/kamailio/kamailio/commit/572d4c8e886b7b7d0bbc975ecf1a4d2… --- diff --git a/modules/dialog_ng/dialog.c b/modules/dialog_ng/dialog.c index 412ef71..77e97ebc 100644 --- a/modules/dialog_ng/dialog.c +++ b/modules/dialog_ng/dialog.c @@ -343,6 +343,7 @@ int load_dlg(struct dlg_binds *dlgb) { dlgb->lookup_terminate_dlg = w_api_lookup_terminate_dlg; dlgb->get_dlg_expires = api_get_dlg_expires; dlgb->get_dlg = dlg_get_msg_dialog; + dlgb->release_dlg = dlg_release; return 1; } diff --git a/modules/dialog_ng/dlg_hash.c b/modules/dialog_ng/dlg_hash.c index 763b225..38c623b 100644 --- a/modules/dialog_ng/dlg_hash.c +++ b/modules/dialog_ng/dlg_hash.c @@ -1716,6 +1716,18 @@ struct mi_root * mi_print_dlgs_ctx(struct mi_root *cmd_tree, void *param) { return NULL; } +/*! + * \brief decrement dialog ref counter by 1 + * \see dlg_unref + * \param dlg dialog + */ +void dlg_release(struct dlg_cell *dlg) +{ + if(dlg==NULL) + return; + unref_dlg(dlg, 1); +} + time_t api_get_dlg_expires(str *callid, str *ftag, str *ttag) { struct dlg_cell *dlg; time_t expires = 0; diff --git a/modules/dialog_ng/dlg_hash.h b/modules/dialog_ng/dlg_hash.h index 9efc3a0..2a5fe5d 100644 --- a/modules/dialog_ng/dlg_hash.h +++ b/modules/dialog_ng/dlg_hash.h @@ -610,6 +610,8 @@ int update_dlg_did(struct dlg_cell *dlg, str *new_did); time_t api_get_dlg_expires(str *callid, str *ftag, str *ttag); +void dlg_release(struct dlg_cell *dlg); + char* state_to_char(unsigned int state); #endif diff --git a/modules/dialog_ng/dlg_load.h b/modules/dialog_ng/dlg_load.h index cbdf94e..8de4c43 100644 --- a/modules/dialog_ng/dlg_load.h +++ b/modules/dialog_ng/dlg_load.h @@ -43,15 +43,18 @@ typedef struct dlg_cell *(*get_dlg_f)(struct sip_msg *msg); /* get_dlg_lifetime function prototype */ typedef time_t (*get_dlg_expires_f)(str *callid, str *ftag, str *ttag); +typedef void (*release_dlg_f)(struct dlg_cell *dlg); + struct dlg_binds { register_dlgcb_f register_dlgcb; - register_dlgcb_nodlg_f register_dlgcb_nodlg; + register_dlgcb_nodlg_f register_dlgcb_nodlg; terminate_dlg_f terminate_dlg; - lookup_terminate_dlg_f lookup_terminate_dlg; + lookup_terminate_dlg_f lookup_terminate_dlg; set_dlg_variable_f set_dlg_var; get_dlg_variable_f get_dlg_var; get_dlg_expires_f get_dlg_expires; - get_dlg_f get_dlg; + get_dlg_f get_dlg; + release_dlg_f release_dlg; };

9 years, 7 months

Re: [sr-dev] [kamailio] dialog: run both DLGCB_TERMINATED and DLGCB_TERMINATED_CONFIRMED callbacks for local BYE (265dc95)

by mikomarrache

Hi Daniel, If I understand correctly, for cases where a dialog timeout occurs and send_bye=1, you rely on the DLGCB_TERMINATED_CONFIRMED (cdr_on_end_confirmed) to write the CDR? Therefore, the DLGCB_EXPIRED (cdr_on_expired) callback is not executed in such case? In any case, this change produces a warning in the ACC module (see acc_cdr.c line 297). I think the level should be DEBUG? Also, I tested and the CDR is now written in this case. Thanks, Mickael --- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/commit/265dc95aac8eb4b5cee7992dde55ff0…

9 years, 7 months

git:master:265dc95a: dialog: run both DLGCB_TERMINATED and DLGCB_TERMINATED_CONFIRMED callbacks for local BYE

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: 265dc95aac8eb4b5cee7992dde55ff08c92a7ac5 URL: https://github.com/kamailio/kamailio/commit/265dc95aac8eb4b5cee7992dde55ff0… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2015-04-15T18:04:10+02:00 dialog: run both DLGCB_TERMINATED and DLGCB_TERMINATED_CONFIRMED callbacks for local BYE - only DLGCB_TERMINATED was run, but that resulted in CDRs not being stored by acc for that situation - on a report by Mickael Marrache --- Modified: modules/dialog/dlg_handlers.c Modified: modules/dialog/dlg_req_within.c --- Diff: https://github.com/kamailio/kamailio/commit/265dc95aac8eb4b5cee7992dde55ff0… Patch: https://github.com/kamailio/kamailio/commit/265dc95aac8eb4b5cee7992dde55ff0… --- diff --git a/modules/dialog/dlg_handlers.c b/modules/dialog/dlg_handlers.c index fdfc3c3..ae101e0 100644 --- a/modules/dialog/dlg_handlers.c +++ b/modules/dialog/dlg_handlers.c @@ -1405,6 +1405,7 @@ void dlg_ontimeout(struct dlg_tl *tl) dlg_unref(dlg, 1); /* run event route for end of dlg */ dlg_run_event_route(dlg, NULL, dlg->state, DLG_STATE_DELETED); + dlg_unref(dlg, 1); if_update_stat(dlg_enable_stats, expired_dlgs, 1); return; diff --git a/modules/dialog/dlg_req_within.c b/modules/dialog/dlg_req_within.c index ae620b4..9473938 100644 --- a/modules/dialog/dlg_req_within.c +++ b/modules/dialog/dlg_req_within.c @@ -216,7 +216,7 @@ void bye_reply_cb(struct cell* t, int type, struct tmcb_params* ps){ unref++; } /* dialog terminated (BYE) */ - run_dlg_callbacks( DLGCB_TERMINATED, dlg, ps->req, ps->rpl, DLG_DIR_NONE, 0); + run_dlg_callbacks( DLGCB_TERMINATED_CONFIRMED, dlg, ps->req, ps->rpl, DLG_DIR_NONE, 0); LM_DBG("first final reply\n"); /* derefering the dialog */ @@ -549,6 +549,9 @@ int dlg_bye_all(struct dlg_cell *dlg, str *hdrs) str all_hdrs = { 0, 0 }; int ret; + /* run dialog terminated callbacks */ + run_dlg_callbacks( DLGCB_TERMINATED, dlg, NULL, NULL, DLG_DIR_NONE, 0); + if ((build_extra_hdr(dlg, hdrs, &all_hdrs)) != 0) { LM_ERR("failed to build dlg headers\n");

9 years, 7 months

git:master:1e7e0279: acc: DLGCB_TERMINATED callback can be run without received request

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: 1e7e0279bbf53c4a530aa3a8c1d322a68d8090f9 URL: https://github.com/kamailio/kamailio/commit/1e7e0279bbf53c4a530aa3a8c1d322a… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2015-04-15T18:03:40+02:00 acc: DLGCB_TERMINATED callback can be run without received request - the case of local generated bye --- Modified: modules/acc/acc_cdr.c --- Diff: https://github.com/kamailio/kamailio/commit/1e7e0279bbf53c4a530aa3a8c1d322a… Patch: https://github.com/kamailio/kamailio/commit/1e7e0279bbf53c4a530aa3a8c1d322a… --- diff --git a/modules/acc/acc_cdr.c b/modules/acc/acc_cdr.c index 845fc12..0532174 100644 --- a/modules/acc/acc_cdr.c +++ b/modules/acc/acc_cdr.c @@ -643,7 +643,7 @@ void cdr_on_end_confirmed( struct dlg_cell* dialog, int type, struct dlg_cb_params* params) { - if( !dialog || !params || !params->req) + if( !dialog || !params ) { LM_ERR("invalid values\n!"); return;

9 years, 7 months

git:master:74c93c2f: Merge pull request #129 from mikomarrache/patch-8

by Daniel-Constantin Mierla

Module: kamailio Branch: master Commit: 74c93c2f11dbf70e108f0a5a568f957b953a5efd URL: https://github.com/kamailio/kamailio/commit/74c93c2f11dbf70e108f0a5a568f957… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2015-04-15T17:33:28+02:00 Merge pull request #129 from mikomarrache/patch-8 dialog: add new flag for expired dialogs --- Modified: modules/dialog/dlg_handlers.c Modified: modules/dialog/dlg_hash.h --- Diff: https://github.com/kamailio/kamailio/commit/74c93c2f11dbf70e108f0a5a568f957… Patch: https://github.com/kamailio/kamailio/commit/74c93c2f11dbf70e108f0a5a568f957… --- diff --git a/modules/dialog/dlg_handlers.c b/modules/dialog/dlg_handlers.c index 34551a5..fdfc3c3 100644 --- a/modules/dialog/dlg_handlers.c +++ b/modules/dialog/dlg_handlers.c @@ -1376,6 +1376,9 @@ void dlg_ontimeout(struct dlg_tl *tl) dlg = ((struct dlg_cell*)((char *)(tl) - (unsigned long)(&((struct dlg_cell*)0)->tl))); + /* mark dialog as expired */ + dlg->dflags |= DLG_FLAG_EXPIRED; + if(dlg->state==DLG_STATE_CONFIRMED_NA || dlg->state==DLG_STATE_CONFIRMED) { diff --git a/modules/dialog/dlg_hash.h b/modules/dialog/dlg_hash.h index e142027..d79d994 100644 --- a/modules/dialog/dlg_hash.h +++ b/modules/dialog/dlg_hash.h @@ -67,6 +67,7 @@ #define DLG_FLAG_DEL (1<<8) /*!< delete this var */ #define DLG_FLAG_TM (1<<9) /*!< dialog is set in transaction */ +#define DLG_FLAG_EXPIRED (1<<10)/*!< dialog is expired */ /* internal flags stored in db */ #define DLG_IFLAG_TIMEOUTBYE (1<<0) /*!< send bye on time-out */

9 years, 7 months

git:master:fa90ad3d: dialog: set DLG_FLAG_EXPIRED flag when timeout

by mikomarrache

Module: kamailio Branch: master Commit: fa90ad3daef2dc34b97c4c13c0b97bf5f04165d5 URL: https://github.com/kamailio/kamailio/commit/fa90ad3daef2dc34b97c4c13c0b97bf… Author: mikomarrache <mikomarrache(a)users.noreply.github.com> Committer: mikomarrache <mikomarrache(a)users.noreply.github.com> Date: 2015-04-15T16:28:47+03:00 dialog: set DLG_FLAG_EXPIRED flag when timeout --- Modified: modules/dialog/dlg_handlers.c --- Diff: https://github.com/kamailio/kamailio/commit/fa90ad3daef2dc34b97c4c13c0b97bf… Patch: https://github.com/kamailio/kamailio/commit/fa90ad3daef2dc34b97c4c13c0b97bf… --- diff --git a/modules/dialog/dlg_handlers.c b/modules/dialog/dlg_handlers.c index 34551a5..fdfc3c3 100644 --- a/modules/dialog/dlg_handlers.c +++ b/modules/dialog/dlg_handlers.c @@ -1376,6 +1376,9 @@ void dlg_ontimeout(struct dlg_tl *tl) dlg = ((struct dlg_cell*)((char *)(tl) - (unsigned long)(&((struct dlg_cell*)0)->tl))); + /* mark dialog as expired */ + dlg->dflags |= DLG_FLAG_EXPIRED; + if(dlg->state==DLG_STATE_CONFIRMED_NA || dlg->state==DLG_STATE_CONFIRMED) {

9 years, 7 months

git:master:216fc94c: dialog: add new flag for expired dialogs

by mikomarrache

Module: kamailio Branch: master Commit: 216fc94cf3f2aa708f50797de3c74e58e28cc6fe URL: https://github.com/kamailio/kamailio/commit/216fc94cf3f2aa708f50797de3c74e5… Author: mikomarrache <mikomarrache(a)users.noreply.github.com> Committer: mikomarrache <mikomarrache(a)users.noreply.github.com> Date: 2015-04-15T16:00:47+03:00 dialog: add new flag for expired dialogs --- Modified: modules/dialog/dlg_hash.h --- Diff: https://github.com/kamailio/kamailio/commit/216fc94cf3f2aa708f50797de3c74e5… Patch: https://github.com/kamailio/kamailio/commit/216fc94cf3f2aa708f50797de3c74e5… --- diff --git a/modules/dialog/dlg_hash.h b/modules/dialog/dlg_hash.h index e142027..d79d994 100644 --- a/modules/dialog/dlg_hash.h +++ b/modules/dialog/dlg_hash.h @@ -67,6 +67,7 @@ #define DLG_FLAG_DEL (1<<8) /*!< delete this var */ #define DLG_FLAG_TM (1<<9) /*!< dialog is set in transaction */ +#define DLG_FLAG_EXPIRED (1<<10)/*!< dialog is expired */ /* internal flags stored in db */ #define DLG_IFLAG_TIMEOUTBYE (1<<0) /*!< send bye on time-out */

9 years, 7 months

← Newer
1
...
14
15
16
17
18
19
20
...
25
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev April 2015