Module: kamailio
Branch: 5.6
Commit: a914333bbac7b52943dc8d9d58bf15614b6497d5
URL: https://github.com/kamailio/kamailio/commit/a914333bbac7b52943dc8d9d58bf156…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2023-02-24T13:54:17+01:00
ctl: doc - binrpc_buffer_size can get only integer value
(cherry picked from commit 44381746e0e826e8db04597942fa4cee6cbf9175)
---
Modified: src/modules/ctl/doc/ctl_params.xml
---
Diff: https://github.com/kamailio/kamailio/commit/a914333bbac7b52943dc8d9d58bf156…
Patch: https://github.com/kamailio/kamailio/commit/a914333bbac7b52943dc8d9d58bf156…
---
diff --git a/src/modules/ctl/doc/ctl_params.xml b/src/modules/ctl/doc/ctl_params.xml
index 558d706464c..5f944d79857 100644
--- a/src/modules/ctl/doc/ctl_params.xml
+++ b/src/modules/ctl/doc/ctl_params.xml
@@ -90,7 +90,7 @@ modparam("ctl", "binrpc", "udp:*:3012") # udp any , port 3012
</section>
<section id="binrpc_buffer_size">
- <title><varname>binrpc_buffer_size</varname> (integer or string)</title>
+ <title><varname>binrpc_buffer_size</varname> (integer)</title>
<para>
The size of the internal buffer used for printing elements of the RPC
response (e.g., internal RPC printf()). The value is given in bytes.
Module: kamailio
Branch: 5.6
Commit: 1107423f6af0df4d788216324d6547247fa22224
URL: https://github.com/kamailio/kamailio/commit/1107423f6af0df4d788216324d65472…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2023-02-24T13:52:57+01:00
rr: doc - fixed typos and use the proper param name add_username instead of enable_username
(cherry picked from commit 022fa0cfc75d150fde219b8ae4f9a99b3fa2f132)
---
Modified: src/modules/rr/doc/rr_admin.xml
Modified: src/modules/rr/doc/rr_devel.xml
---
Diff: https://github.com/kamailio/kamailio/commit/1107423f6af0df4d788216324d65472…
Patch: https://github.com/kamailio/kamailio/commit/1107423f6af0df4d788216324d65472…
---
diff --git a/src/modules/rr/doc/rr_admin.xml b/src/modules/rr/doc/rr_admin.xml
index 98bad1239f2..c1ad84277ed 100644
--- a/src/modules/rr/doc/rr_admin.xml
+++ b/src/modules/rr/doc/rr_admin.xml
@@ -12,7 +12,7 @@
<section>
<title>Overview</title>
- <para>The module contains record routing logic</para>
+ <para>The module contains record routing logic.</para>
</section>
<section id="RR-dialog-id">
@@ -20,7 +20,7 @@
<para>&kamailio; is basically <emphasis>only</emphasis> a transaction
stateful proxy, without any dialog support build in. There are many
- features/services which actually requires a dialog awareness, like storing
+ features/services which actually require a dialog awareness, like storing
the information in the dialog creation stage, information which will be
used during the whole dialog existence.</para>
@@ -246,7 +246,7 @@ modparam("rr", "enable_socket_mismatch_warning", 0)
<section id="rr.p.custom_user_avp">
<title><varname>custom_user_avp</varname> (avp string)</title>
- <para>When enable_username is enabled, a call to record_route will add
+ <para>When add_username is enabled, a call to record_route will add
the username of the RequestURI to the Record-Route URI. This parameter
allows you to setup an AVP with which you can customise the username to
be added in the Record-Route URI.</para>
@@ -664,7 +664,7 @@ add_rr_param(";nat=yes");
<para>The function checks if the URI parameters of the local Route
header (corresponding to the local server) matches the given regular
- expression. It must be call after loose_route() (see <xref
+ expression. It must be called after loose_route() (see <xref
linkend="rr.f.loose_route"/>).</para>
<para>Meaning of the parameters is as follows:</para>
diff --git a/src/modules/rr/doc/rr_devel.xml b/src/modules/rr/doc/rr_devel.xml
index 9d16ea0791f..a451c4fb4dd 100644
--- a/src/modules/rr/doc/rr_devel.xml
+++ b/src/modules/rr/doc/rr_devel.xml
@@ -128,7 +128,7 @@ record_route_advertised_address("1.2.3.4:5090");
The function checks for the request <quote>msg</quote> if the URI
parameters of the local Route header (corresponding to the local
server) matches the given regular expression <quote>re</quote>.
- It must be call after the loose_route was done.
+ It must be called after the loose_route was done.
</para>
<para>
The function returns 0 on success. Otherwise, -1 is returned.
@@ -157,7 +157,7 @@ record_route_advertised_address("1.2.3.4:5090");
<quote>msg</quote>. As for checking it's used the <quote>ftag</quote>
Route header parameter, the append_fromtag (see
<xref linkend="append-fromtag-id"/> module parameter
- must be enables. Also this must be call only after the loose_route is
+ must be enables. Also this must be called only after the loose_route is
done.
</para>
<para>
@@ -185,9 +185,9 @@ record_route_advertised_address("1.2.3.4:5090");
<function moreinfo="none">get_route_param( msg, name, val)</function>
</title>
<para>
- The function search in to the <quote>msg</quote>'s Route header
+ The function searches in the <quote>msg</quote>'s Route header
parameters the parameter called <quote>name</quote> and returns its
- value into <quote>val</quote>. It must be call only after the
+ value into <quote>val</quote>. It must be called only after the
loose_route is done.
</para>
<para>
@@ -220,7 +220,7 @@ record_route_advertised_address("1.2.3.4:5090");
<function moreinfo="none">register_rrcb( callback, param)</function>
</title>
<para>
- The function register a new callback (along with its parameter). The
+ The function registers a new callback (along with its parameter). The
callback will be called when a loose route will be performed for the
local address.
</para>
Module: kamailio
Branch: 5.6
Commit: b2e872799d8a694bd433193ec8157ab1d329edaa
URL: https://github.com/kamailio/kamailio/commit/b2e872799d8a694bd433193ec8157ab…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2023-02-24T13:52:43+01:00
core: typos in comments and EoL after log when parse msg fails
- GH #3348
(cherry picked from commit 51fa3da96c1eacd4d679598a3305180c9e818cfb)
---
Modified: src/core/msg_translator.c
---
Diff: https://github.com/kamailio/kamailio/commit/b2e872799d8a694bd433193ec8157ab…
Patch: https://github.com/kamailio/kamailio/commit/b2e872799d8a694bd433193ec8157ab…
---
diff --git a/src/core/msg_translator.c b/src/core/msg_translator.c
index bc1b9736df8..3ab6fae4725 100644
--- a/src/core/msg_translator.c
+++ b/src/core/msg_translator.c
@@ -53,7 +53,7 @@
* lookup is performed on the host part and the reply is sent to the
* resulting ip. If a port is present or the host part is an ip address
* the dns lookup will be a "normal" one (A or AAAA).
- * - if rport is present, it's value will be used as the destination port
+ * - if rport is present, its value will be used as the destination port
* (and this will also disable srv lookups)
* - if no port is present the destination port will be taken from the srv
* lookup. If the srv lookup fails or is not performed (e.g. ip address
@@ -1459,7 +1459,7 @@ void process_lumps( struct sip_msg* msg,
/* skip len bytes from orig msg */
s_offset+=t->len;
} else if (t->op==LUMP_DEL && flag == FLAG_MSG_LUMPS_ONLY) {
- /* copy lump value and indent as necessarely */
+ /* copy lump value and indent as necessarily */
memcpy(new_buf+offset, orig + t->u.offset, t->len);
offset+=t->len;
if (new_buf[offset-1] != '\n') {
@@ -1592,7 +1592,7 @@ static inline int adjust_clen(struct sip_msg* msg, int body_delta, int proto)
/* The body has been changed, try to find
* existing Content-Length
*/
- /* no need for Content-Length if it's and UDP packet and
+ /* no need for Content-Length if it's an UDP packet and
* it hasn't Content-Length already */
if (msg->content_length==0){
/* content-length doesn't exist, append it */
@@ -1938,7 +1938,7 @@ int check_boundaries(struct sip_msg *msg, struct dest_info *send_info)
/** builds a request in memory from another sip request.
*
* Side-effects: - it adds lumps to the msg which are _not_ cleaned.
- * The added lumps are HDR_VIA_T (almost always added), HDR_CONTENLENGTH_T
+ * The added lumps are HDR_VIA_T (almost always added), HDR_CONTENTLENGTH_T
* and HDR_ROUTE_T (when a Route: header is added as a result of a non-null
* msg->path_vec).
* - it might change send_info->proto and send_info->send_socket
@@ -2109,7 +2109,7 @@ char * build_req_buf_from_sip_req(struct sip_msg* msg,
}
received_buf = NULL;
}
- /* if rport needs to be updated, delete it if present and add it's value */
+ /* if rport needs to be updated, delete it if present and add its value */
if (rport_buf){
if (msg->via1->rport){ /* rport already present */
via_insert_param=del_lump(msg,
@@ -3075,7 +3075,7 @@ char* create_via_hf(unsigned int *len,
/* builds a char* buffer from message headers without body
* first line is excluded in case of skip_first_line=1
- * error is set -1 if the memory allocation failes
+ * error is set -1 if the memory allocation fails
*/
char * build_only_headers( struct sip_msg* msg, int skip_first_line,
unsigned int *returned_len,
@@ -3127,7 +3127,7 @@ char * build_only_headers( struct sip_msg* msg, int skip_first_line,
}
/* builds a char* buffer from message body
- * error is set -1 if the memory allocation failes
+ * error is set -1 if the memory allocation fails
*/
char * build_body( struct sip_msg* msg,
unsigned int *returned_len,
@@ -3253,7 +3253,7 @@ int build_sip_msg_from_buf(struct sip_msg *msg, char *buf, int len,
msg->buf = buf;
msg->len = len;
if (parse_msg(buf, len, msg)!=0) {
- LM_ERR("parsing failed");
+ LM_ERR("parsing failed\n");
return -1;
}
msg->set_global_address=default_global_address;
Module: kamailio
Branch: 5.6
Commit: ee7d314422003fc6edfbc364015499e38e18ae62
URL: https://github.com/kamailio/kamailio/commit/ee7d314422003fc6edfbc364015499e…
Author: Sandro Gauci <sandro(a)enablesecurity.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2023-02-24T13:50:24+01:00
exec: docs - added security warning
- Added warning about potential for OS Command Injection
- Updated invalid examples
previous example gives the following error:
pv_parse_spec2(): error searching pvar "rU.txt"
(cherry picked from commit f81f0e77c5ab67431af1f62f0e027379a3445951)
---
Modified: src/modules/exec/doc/exec_admin.xml
---
Diff: https://github.com/kamailio/kamailio/commit/ee7d314422003fc6edfbc364015499e…
Patch: https://github.com/kamailio/kamailio/commit/ee7d314422003fc6edfbc364015499e…
---
diff --git a/src/modules/exec/doc/exec_admin.xml b/src/modules/exec/doc/exec_admin.xml
index 12249d5104a..9dee3522d66 100644
--- a/src/modules/exec/doc/exec_admin.xml
+++ b/src/modules/exec/doc/exec_admin.xml
@@ -77,6 +77,23 @@
Otherwise they will be evaluated as &kamailio; pseudo-variables,
throwing errors.
</para>
+ <para>
+ WARNING: if the exec functions are passed variables that might include
+ malicious input, then remote attackers may abuse the exec functions to
+ execute arbitrary code. Specifically, this may result in OS command injection.
+ In such cases, input validation is required to prevent the vulnerability.
+ The following is an example of how input validation and exec module
+ functions may be used together to prevent exploitation:
+ </para>
+ <programlisting format="linespecific">
+...
+if !($rU =~ "^[0-9]{1,15}$") {
+ xlog("Malformed R-URI username: '$rU'\n");
+ exit;
+}
+exec_msg("echo TEST >> /tmp/$(rU).txt");
+...
+ </programlisting>
</section>
<section>
@@ -186,7 +203,7 @@ modparam("exec", "time_to_kill", 20)
<programlisting format="linespecific">
...
exec_dset("echo TEST > /tmp/test.txt");
-exec_dset("echo TEST > /tmp/$rU.txt");
+exec_dset("echo TEST > /tmp/$(rU).txt");
...
</programlisting>
</example>
@@ -225,7 +242,7 @@ exec_dset("echo TEST > /tmp/$rU.txt");
<programlisting format="linespecific">
...
exec_msg("echo TEST > /tmp/test.txt");
-exec_msg("echo TEST > /tmp/$rU.txt");
+exec_msg("echo TEST > /tmp/$(rU).txt");
...
</programlisting>
</example>
@@ -300,7 +317,7 @@ exec_avp("echo TEST", "$avp(s:test)");
<programlisting format="linespecific">
...
exec_cmd("echo TEST > /tmp/test.txt");
-exec_cmd("echo TEST > /tmp/$rU.txt");
+exec_cmd("echo TEST > /tmp/$(rU).txt");
...
</programlisting>
</example>
@@ -315,4 +332,3 @@ exec_cmd("echo TEST > /tmp/$rU.txt");
</para>
</section>
</chapter>
-
Hello,
a quick note to the community forums to announce that the registration
for the next Kamailio World Conference (June 5-7, 2022, in Berlin,
Germany) is now open! The event returns to an in-person conference
format, at the same wonderful location in the city center of Berlin!
More details are available at:
* https://www.kamailioworld.com/k2023/registration/
Call for presentations is also open, there is already a group of very
interesting submissions, we aim to publish details about them in the
near future.
Looking forward to meeting many of you in Berlin!
Cheers,
Daniel
--
Daniel-Constantin Mierla -- www.asipto.comwww.twitter.com/miconda -- www.linkedin.com/in/miconda
Kamailio World Conference - June 5-7, 2023 - www.kamailioworld.com
Kamailio Advanced Training - Online - March 27-30, 2023 - www.asipto.com