Hi All,
Kamailio is resetting when we do TLS renegotiation dos attack using the
tool available at http://www.thc.org/thc-ssl-dos/.
Anybody looked at this issue? How we could resolve it. Any idea?
The core generated for 3 pid's as below
Pid 1:
Core was generated by `/usr/sbin/kamailio -u swrun -g sw -m 120 -f
/etc/kamailio/kamailio.cfg'.
Program terminated with signal 11, Segmentation fault.
#0 atomic_inc_int () at atomic/atomic_x86.h:225
(gdb) bt
#0 atomic_inc_int () at atomic/atomic_x86.h:225
#1 cfg_update_local () at cfg/cfg_struct.h:228
#2 timer_main () at timer.c:994
#3 0x080b0579 in main_loop () at main.c:1632
#4 0x080b1be4 in main (argc=9, argv=0xbfd61e54) at main.c:2446
Pid 2:
Core was generated by `/usr/sbin/kamailio -u swrun -g sw -m 120 -f
/etc/kamailio/kamailio.cfg'.
Program terminated with signal 11, Segmentation fault.
#0 0x0819bfe8 in qm_insert_free (qm=0xaf6c5000, p=0xb05eec30,
file=0xb6fb4140 "tls: tls_init.c", func=0xb6fb4ce0 "ser_free", line=296)
at mem/q_malloc.c:184
184 if (frag->size <= f->size) break;
(gdb) bt
#0 0x0819bfe8 in qm_insert_free (qm=0xaf6c5000, p=0xb05eec30,
file=0xb6fb4140 "tls: tls_init.c", func=0xb6fb4ce0 "ser_free", line=296)
at mem/q_malloc.c:184
#1 qm_free (qm=0xaf6c5000, p=0xb05eec30, file=0xb6fb4140 "tls:
tls_init.c", func=0xb6fb4ce0 "ser_free", line=296) at mem/q_malloc.c:518
#2 0xb6f95404 in ser_free (ptr=0xb05eec30) at tls_init.c:296
#3 0xb732e9ba in CRYPTO_free (str=0xb05eec30) at mem.c:391
#4 0xb7330bee in int_new_ex_data (class_index=5, obj=0xbfd414f4,
ad=0xbfd41574) at ex_data.c:440
#5 0xb7330443 in CRYPTO_new_ex_data (class_index=5, obj=0xbfd414f4,
ad=0xbfd41574) at ex_data.c:575
#6 0xb73dfde3 in X509_STORE_CTX_init (ctx=0xbfd414f4, store=0xafd8b3d0,
x509=0xafe08ff0, chain=0x0) at x509_vfy.c:2114
#7 0xb74b0f31 in ssl3_output_cert_chain (s=0xb0553a10, x=0xafe08ff0) at
s3_both.c:349
#8 0xb74a4728 in ssl3_send_server_certificate (s=0xb0553a10) at
s3_srvr.c:3034
#9 0xb74a5879 in ssl3_accept (s=0xb0553a10) at s3_srvr.c:353
#10 0xb74afa8f in ssl3_read_bytes (s=0xb0553a10, type=23, buf=0xb0ad44ec
"", len=4095, peek=0) at s3_pkt.c:1266
#11 0xb74ac9c9 in ssl3_read_internal (s=0xb0553a10, buf=0xb0ad44ec,
len=4095, peek=0) at s3_lib.c:3265
#12 0xb74c24a9 in SSL_read (s=0xb0553a10, buf=0xb0ad44ec, num=4095) at
ssl_lib.c:954
#13 0xb6fad1c3 in tls_read_f (c=0xb0ad431c, flags=0xbfd619c4) at
tls_server.c:1058
#14 0x08171c0e in tcp_read_headers (c=0xb0ad431c, read_flags=0xbfd619c4) at
tcp_read.c:406
#15 0x08171db8 in tcp_read_req (con=0xb0ad431c, bytes_read=0xbfd619cc,
read_flags=0xbfd619c4) at tcp_read.c:885
#16 0x08172f67 in handle_io (fm=<value optimized out>, events=1, idx=<value
optimized out>) at tcp_read.c:1234
#17 0x0817583b in io_wait_loop_epoll (unix_sock=89) at io_wait.h:1092
#18 tcp_receive_loop (unix_sock=89) at tcp_read.c:1345
#19 0x0816e2e9 in tcp_init_children () at tcp_main.c:4867
#20 0x080affb1 in main_loop () at main.c:1646
#21 0x080b1be4 in main (argc=9, argv=0xbfd61e54) at main.c:2446
Pid 3:
Core was generated by `/usr/sbin/kamailio -u swrun -g sw -m 120 -f
/etc/kamailio/kamailio.cfg'.
Program terminated with signal 11, Segmentation fault.
#0 0xb76c9e7c in memmove () from /lib/libc.so.6
(gdb) bt
#0 0xb76c9e7c in memmove () from /lib/libc.so.6
#1 0x081724e7 in tcp_read_req (con=0xb022c8f0, bytes_read=0xbfd619cc,
read_flags=0xbfd619c4) at tcp_read.c:1026
#2 0x08172f67 in handle_io (fm=<value optimized out>, events=1, idx=<value
optimized out>) at tcp_read.c:1234
#3 0x0817583b in io_wait_loop_epoll (unix_sock=93) at io_wait.h:1092
#4 tcp_receive_loop (unix_sock=93) at tcp_read.c:1345
#5 0x0816e2e9 in tcp_init_children () at tcp_main.c:4867
#6 0x080affb1 in main_loop () at main.c:1646
#7 0x080b1be4 in main (argc=9, argv=0xbfd61e54) at main.c:2446
Module: sip-router
Branch: master
Commit: 4c52cf0577636fe6a202c255c3872e45b841dc06
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=4c52cf0…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: Mon Dec 19 21:58:24 2011 +0100
core: added function to help fixup of PVE, string and expressions
- existing function could convert single pv PVE in PVAR, which can cause
troubles as PVE value should be always zero terminated
---
sr_module.c | 37 +++++++++++++++++++++++++++++++++++++
sr_module.h | 3 +++
2 files changed, 40 insertions(+), 0 deletions(-)
diff --git a/sr_module.c b/sr_module.c
index 853c7a2..8bc52d9 100644
--- a/sr_module.c
+++ b/sr_module.c
@@ -1385,6 +1385,43 @@ int fixup_var_str_2(void** param, int param_no)
else return 0;
}
+/** fixup variable-pve-only-string.
+ * The parameter can be a PVE (pv based format string)
+ * or string.
+ * non-static PVEs identifiers will be resolved to
+ * their values during runtime.
+ * The parameter value will be converted to fparam structure
+ * @param param - double pointer to param, as for normal fixup functions.
+ * @param param_no - parameter number, ignored.
+ * @return -1 on an error, 0 on success.
+ */
+int fixup_var_pve_12(void** param, int param_no)
+{
+ int ret;
+ fparam_t* fp;
+ if (fixup_get_param_type(param) != STRING_RVE_ST) {
+ /* if called with a RVE already converted to string =>
+ don't try PVE again (to avoid double
+ deref., e.g.: $foo="$bar"; f($foo) ) */
+ if ((ret = fix_param(FPARAM_PVE, param)) <= 0) {
+ if (ret < 0)
+ return ret;
+ /* check if it resolved to a dynamic or "static" PVE.
+ If the resulting PVE is static (normal string), discard
+ it and use the normal string fixup (faster at runtime) */
+ fp = (fparam_t*)*param;
+ if (fp->v.pve->spec.getf == 0)
+ fparam_free_restore(param); /* fallback to STR below */
+ else
+ return ret; /* dynamic PVE => return */
+ }
+
+ }
+ if ((ret = fix_param(FPARAM_STR, param)) <= 0) return ret;
+ ERR("Error while fixing parameter - PVE or str conversions failed\n");
+ return -1;
+}
+
/** fixup variable-pve-string.
diff --git a/sr_module.h b/sr_module.h
index ce8c781..810008f 100644
--- a/sr_module.h
+++ b/sr_module.h
@@ -542,6 +542,9 @@ int fixup_var_str_1(void** param, int param_no);
/** Same as fixup_var_str_12 but applies to the 2nd parameter only */
int fixup_var_str_2(void** param, int param_no);
+/** fixup variable-pve-only-string. */
+int fixup_var_pve_12(void** param, int param_no);
+
/** fixup variable-pve-string.
* The parameter can be a PVAR, AVP, SELECT, PVE (pv based format string)
* or string.
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
The following task is now closed:
FS#192 - a74f12d6 (3.2) registrar breaks save(..., 0x4) functionality
User who did this - Daniel-Constantin Mierla (miconda)
Reason for closing: Implemented
Additional comments about closing: Patch applied on git master.
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=192
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
The following task has a new comment added:
FS#193 - no avpops bigint handling breaks custom select queries
User who did this - Walter Doekes (wdoekes)
----------
(Of course you could go with a third option: "auto", only cast to string if the value doesn't fit in a 32bits int, but that could be very unintuitive as well.)
----------
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=193#comment472
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.