<!--
Kamailio Project uses GitHub Issues only for bugs in the code or feature requests.
If you have questions about using Kamailio or related to its configuration file,
ask on sr-users mailing list:
* http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
If you have questions about developing extensions to Kamailio or its existing
C code, ask on sr-dev mailing list
* http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev
Please try to fill this template as much as possible for any issue. It helps the
developers to troubleshoot the issue.
If you submit a feature request (or enhancement), you can delete the text of
the template and only add the description of what you would like to be added.
If there is no content to be filled in a section, the entire section can be removed.
You can delete the comments from the template sections when filling.
You can delete next line and everything above before submitting (it is a comment).
-->
### Description
<!--
Explain what you did, what you expected to happen, and what actually happened.
-->
I have just updated kamailio to 5.1.2 and have bunch of messages on OPTIONS request without Contact header because of commit ce9f67581f45a00fd879329ffc918b2a7ef9b8d0:
WARNING: topos [tps_storage.c:385]: tps_storage_record(): no local address - do record routing for all initial requests
In [RFC 3261](https://www.ietf.org/rfc/rfc3261.txt) in 11.1 section is stated that Contact header is optional not mandatory.
So maybe a workaround will be suppress such messages for OPTIONS and other SIP requests without mandatory Contact header or move it to DEBUG from WARNING?
### Troubleshooting
#### Reproduction
<!--
If the issue can be reproduced, describe how it can be done.
-->
#### Log Messages
<!--
Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
Mar 15 04:17:31 kamailio-0-0 /usr/sbin/kamailio[1078]: WARNING: topos [tps_storage.c:385]: tps_storage_record(): no local address - do record routing for all initial requests
Mar 15 04:17:31 kamailio-0-0 /usr/sbin/kamailio[1078]: WARNING: topos [tps_storage.c:385]: tps_storage_record(): no local address - do record routing for all initial requests
Mar 15 04:17:31 kamailio-0-0 /usr/sbin/kamailio[1078]: WARNING: topos [tps_storage.c:385]: tps_storage_record(): no local address - do record routing for all initial requests
Mar 15 04:17:31 kamailio-0-0 /usr/sbin/kamailio[1078]: WARNING: topos [tps_storage.c:385]: tps_storage_record(): no local address - do record routing for all initial requests
Mar 15 04:17:31 kamailio-0-0 /usr/sbin/kamailio[1078]: WARNING: topos [tps_storage.c:385]: tps_storage_record(): no local address - do record routing for all initial requests
Mar 15 04:17:31 kamailio-0-0 /usr/sbin/kamailio[1078]: WARNING: topos [tps_storage.c:385]: tps_storage_record(): no local address - do record routing for all initial requests
```
#### SIP Traffic
<!--
If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
2018/03/15 04:17:31.833335 x.x.x.x:5060 -> y.y.y.y:5060
OPTIONS sip:y.y.y.y:5060;user=phone SIP/2.0
Via: SIP/2.0/UDP x.x.x.x:5060;branch=z9hG4bKehyhoockece8okibyb7ej8vvj
Call-ID: ixheb7uuunjeulhocj8n8oiheynvojnl@SE2000
From: <sip:SBC@x.x.x.x;user=phone>;tag=ucljxn87
To: <sip:y.y.y.y;user=phone>
CSeq: 1 OPTIONS
Max-Forwards: 70
Content-Length: 0
2018/03/15 04:17:31.833740 y.y.y.y:5060 -> x.x.x.x:5060
SIP/2.0 200 OK
Via: SIP/2.0/UDP x.x.x.x:5060;branch=z9hG4bKehyhoockece8okibyb7ej8vvj
Call-ID: ixheb7uuunjeulhocj8n8oiheynvojnl@SE2000
From: <sip:SBC@x.x.x.x;user=phone>;tag=ucljxn87
To: <sip:y.y.y.y;user=phone>;tag=3403be34b817f61be8d0522eb11c0e7a.58f4
CSeq: 1 OPTIONS
Content-Length: 0
```
### Possible Solutions
<!--
If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix.
-->
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
```
version: kamailio 5.1.2 (x86_64/linux)
flags: STATS: Off, USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown
compiled on 05:07:55 Mar 15 2018 with gcc 4.8.5
```
* **Operating System**:
<!--
Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...;
Kernel details (output of `uname -a`)
-->
```
Red Hat Enterprise Linux Server release 7.4 (Maipo)
Linux kamailio-0-0 2.6.32-042stab113.21 #1 SMP Wed Mar 23 11:05:25 MSK 2016 x86_64 x86_64 x86_64 GNU/Linux
```
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1483
Hello,
as already announced from Daniel-Constantin Mierla on the lists last Wednesday
[1], we strongly advise you to update your Kamailio installation to the latest
stable release for security reasons.
All supported releases (4.4, 5.0. and 5.1) contains two important security
fixes related to the tmx and lcr module.
Technical details for the tmx issue:
A specially crafted REGISTER message with a malformed branch or From tag
triggers a so called "off-by-one heap overflow". This vulnerability existed in
the tmx module and makes it possible to remotely crash the Kamailio service.
If an attacker sends many of this messages this would lead to a Denial of
Service of the attacked infrastructure. This is especially critical as no
authentication for the remote source is needed.
This vulnerability was found from Sandro Gauci and Alfred Farrugia from the
Security Company Enable Security. Many thanks to them for finding the issue
and reporting it to us.
You find all the details including a proof of concept code in the published
security announcement from them:
https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio…
Technical details for the lcr issue:
A vulnerability existed in the lcr next_gw() function. It happens when
a very long R-URI username is sent with an INVITE due to an mistake in the
function error code handling. It can be triggered from a remote source, but
should be only from a trusted peer, as it expected that calls going
through lcr are authenticated by user or IP address.
This vulnerability was reported from an user in the Netherlands to us, thanks
as well for the bug report.
So far we are not aware of any public exploits of this errors. But as already
mentioned, we advise you to update your Kamailio servers to the latest stable
release as soon as possible, especially as the tmx vulnerability will reported
to more security lists later today.
Please address any detailed technical questions related to the two bugs to the
developer list at sr-dev(a)lists.kamailio.org .
In case of confidential remarks related to this or other security issues,
please address them to the Kamailio Management at management(a)kamailio.org .
Best regards,
Henning Westerholt
Kamailio Project
[1] https://lists.kamailio.org/pipermail/sr-users/2018-March/100672.html
Module: kamailio
Branch: master
Commit: 77beeb5d765119f46589a9d519123256fb8a9138
URL: https://github.com/kamailio/kamailio/commit/77beeb5d765119f46589a9d51912325…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2018-03-19T18:17:31+01:00
core: new parameter kemi.event_route_callback
- set the name of kemi function to be executed for core event route
equivalet
- default value is not set (no callback function name). If set to
"none", it is also not executed.
- callback function receives a string parameter with the name of the event
- execute kemi event callback for "core:worker-one-init"
---
Modified: src/core/action.c
Modified: src/core/cfg.lex
Modified: src/core/cfg.y
Modified: src/core/kemi.c
Modified: src/core/kemi.h
---
Diff: https://github.com/kamailio/kamailio/commit/77beeb5d765119f46589a9d51912325…
Patch: https://github.com/kamailio/kamailio/commit/77beeb5d765119f46589a9d51912325…
Module: kamailio
Branch: master
Commit: eda57ef94bf79605d7b15fe50379913bf76f4fa5
URL: https://github.com/kamailio/kamailio/commit/eda57ef94bf79605d7b15fe50379913…
Author: Kamailio Dev <kamailio.dev(a)kamailio.org>
Committer: Kamailio Dev <kamailio.dev(a)kamailio.org>
Date: 2018-03-18T11:17:06+01:00
modules: readme files regenerated - p_usrloc ... [skip ci]
---
Modified: src/modules/p_usrloc/README
Modified: src/modules/speeddial/README
Modified: src/modules/uri_db/README
---
Diff: https://github.com/kamailio/kamailio/commit/eda57ef94bf79605d7b15fe50379913…
Patch: https://github.com/kamailio/kamailio/commit/eda57ef94bf79605d7b15fe50379913…
---
diff --git a/src/modules/p_usrloc/README b/src/modules/p_usrloc/README
index 5effbeab55..9256c22c57 100644
--- a/src/modules/p_usrloc/README
+++ b/src/modules/p_usrloc/README
@@ -687,8 +687,8 @@ modparam("p_usrloc", "db_mode", 2)
databases. For that, if the table was not created by the installation
script or you choose to install everything by yourself you can use the
p_usrloc-create.sql SQL script in the database directories in the
- openser/scripts folder as template. Database and table name can be set
- with module parameters so they can be changed, but the name of the
+ utils/kamctl/mysql/ folder as template. Database and table name can be
+ set with module parameters so they can be changed, but the name of the
columns must be as they are in the SQL script. You can also find the
complete database documentation on the project webpage,
https://www.kamailio.org/docs/db-tables/kamailio-db-devel.html.
diff --git a/src/modules/speeddial/README b/src/modules/speeddial/README
index 1711d7d968..be0efe4db5 100644
--- a/src/modules/speeddial/README
+++ b/src/modules/speeddial/README
@@ -126,7 +126,7 @@ Chapter 1. Admin Guide
Example 1.1. Set db_url parameter
...
-modparam("speeddial", "db_url", "mysql://openser:xxx@localhost/openser")
+modparam("speeddial", "db_url", "mysql://kamailio:xxx@localhost/kamailio")
...
3.2. user_column (string)
@@ -231,7 +231,7 @@ modparam("speeddial", "use_domain", 1)
Example 1.9. sd_lookup usage
...
-# 'speed_dial' is the default table name created by openser db script
+# 'speed_dial' is the default table name created by kamailio db script
if(uri=~"sip:[0-9]{2}@.*")
sd_lookup("speed_dial");
# use auth username
diff --git a/src/modules/uri_db/README b/src/modules/uri_db/README
index b11772e641..589fba5b0a 100644
--- a/src/modules/uri_db/README
+++ b/src/modules/uri_db/README
@@ -125,7 +125,7 @@ Chapter 1. Admin Guide
Example 1.1. Set db_url parameter
...
-modparam("uri_db", "db_url", "mysql://username:password@localhost/openser")
+modparam("uri_db", "db_url", "mysql://username:password@localhost/kamailio")
...
3.2. db_table (string)