sr-dev April 2019

sr-dev@lists.kamailio.org

23 participants
317 discussions

by Daniel-Constantin Mierla

Hello, Kamailio SIP Server v5.0.8 stable release is out. This is a maintenance release of the old stable branch 5.0, that includes fixes since the release of v5.0.7. There is no change to database schema or configuration language structure that you have to do on previous installations of v5.0.x. Deployments running previous v5.0.x versions are strongly recommended to be upgraded to v5.0.8 or even better directly to v5.1.x or v5.2.x because v5.0.x is getting out of the official maintenance time frame. Important note: this is the last planned release from branch5.0. For more details about version 5.0.8 (including links and guidelines to download the tarball or from GIT repository), visit: * https://www.kamailio.org/w/2019/04/kamailio-v5-0-8-released/ RPM, Debian/Ubuntu packages will be available soon as well. Note: the latest stable branch is 5.2, at this moment with its latest release v5.2.2. See more details about it at: * https://www.kamailio.org/w/kamailio-v5-2-0-release-notes/ Many thanks to all contributing and using Kamailio! Cheers, Daniel -- Daniel-Constantin Mierla -- www.asipto.com www.twitter.com/miconda -- www.linkedin.com/in/miconda Kamailio World Conference - May 6-8, 2019 -- www.kamailioworld.com

5 years, 8 months

[kamailio/kamailio] dialog: segfault with db_mode = 1 and broken SIP message (#1899)

by Bastian Triller

### Description `dialog` module is configured with `db_mode` 1 (realtime). When receiving following broken SIP `200` response (missing 6 bytes between header and body), Kamailio crashes: ``` SIP/2.0 200 OK Via: SIP/2.0/UDP 1.2.3.4;branch=z9hG4bKa185.ad1e5804a90a4f79fa2b09b3b2118053.0 Via: SIP/2.0/UDP 2.3.4.5:7016;received=2.3.4.5;branch=z9hG4bK370933d4;rport=7016 Record-Route: <sip:1.2.3.4;lr=on;did=c41.dee> From: "1234" <sip:1234@example.com>;tag=as4cbf81fd To: <sip:2345@example.com>;tag=3450065082 Call-ID: 727ca44f1e962eb321143475380dfbd9(a)example.com CSeq: 102 INVITE Contact: <sip:2345@3.4.5.6:12500> Content-Type: application/sdp Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE Content-Length: 2170 o=- 20568 20568 IN IP4 3.4.5.6 s=SDP data c=IN IP4 3.4.5.6 t=0 0 m=audio 13002 RTP/AVP 8 101 a=rtpmap:8 PCMA/8000 a=ptime:20 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=sendrecv ``` Crash happens in [dlg_db_handler.c](https://github.com/kamailio/kamailio/blob/master/src/modu… ``` LM_DBG("sock_info is %.*s\n", cell->bind_addr[DLG_CALLER_LEG]->sock_str.len, cell->bind_addr[DLG_CALLEE_LEG]->sock_str.s); SET_STR_VALUE(values+7, cell->bind_addr[DLG_CALLER_LEG]->sock_str); SET_STR_VALUE(values+8, cell->bind_addr[DLG_CALLEE_LEG]->sock_str); ``` #### Debugging Data ``` Thread 1 (Thread 0x7fc64b620700 (LWP 2333)): +bt #0 0x00007fc641675b63 in update_dialog_dbinfo_unsafe (cell=0x7fc619a71ff8) at dlg_db_handler.c:784 #1 0x00007fc641676852 in update_dialog_dbinfo (cell=0x7fc619a71ff8) at dlg_db_handler.c:881 #2 0x00007fc64167c861 in dlg_onreply (t=0x7fc61d7888f0, type=1048576, param=0x7ffe1ce712f0) at dlg_handlers.c:509 #3 0x00007fc6443f4f17 in run_trans_callbacks_internal (cb_lst=0x7fc61d788960, type=1048576, trans=0x7fc61d7888f0, params=0x7ffe1ce712f0) at t_hooks.c:260 #4 0x00007fc6443f5144 in run_trans_callbacks_with_buf (type=1048576, rbuf=0x7fc61d7889b0, req=0x7fc61ec43928, repl=0x7fc646dcbd80, flags=0) at t_hooks.c:305 #5 0x00007fc6443aaabc in relay_reply (t=0x7fc61d7888f0, p_msg=0x7fc646dcbd80, branch=0, msg_status=200, cancel_data=0x7ffe1ce71580, do_put_on_wait=1) at t_reply.c:1950 #6 0x00007fc6443ae844 in reply_received (p_msg=0x7fc646dcbd80) at t_reply.c:2521 #7 0x000055fd54405df6 in do_forward_reply (msg=0x7fc646dcbd80, mode=0) at core/forward.c:749 #8 0x000055fd5440784b in forward_reply (msg=0x7fc646dcbd80) at core/forward.c:851 #9 0x000055fd544522d2 in receive_msg (buf=0x55fd5492d080 <buf> "SIP/2.0 200 OK\r\nVia: SIP/2.0/UDP ...", len=960, rcv_info=0x7ffe1ce71ad0) at core/receive.c:341 #10 0x000055fd5436e207 in udp_rcv_loop () at core/udp_server.c:515 #11 0x000055fd542dc608 in main_loop () at main.c:1623 #12 0x000055fd542e46a9 in main (argc=13, argv=0x7ffe1ce71f78) at main.c:2642 ``` ### Possible Solutions Check `bind_addr` before accessing. ### Additional Information Version was 5.0.x, but at least code in `dlg_handler.c` wasn't modified in `master` since then. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/1899

5 years, 8 months

git:5.0:9e14e589: ChangeLog: content prepared for v5.0.8

by Daniel-Constantin Mierla

Module: kamailio Branch: 5.0 Commit: 9e14e589624d839873a82d0b626a74d6fd9461f8 URL: https://github.com/kamailio/kamailio/commit/9e14e589624d839873a82d0b626a74d… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2019-04-04T13:02:05+02:00 ChangeLog: content prepared for v5.0.8 --- Modified: ChangeLog --- Diff: https://github.com/kamailio/kamailio/commit/9e14e589624d839873a82d0b626a74d… Patch: https://github.com/kamailio/kamailio/commit/9e14e589624d839873a82d0b626a74d… --- diff --git a/ChangeLog b/ChangeLog index 5275d4281f..eb07869807 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,6 +2,32 @@ ===================== Changes Since Version 5.0.7 =========================== +commit 17dab52919e161e0820a835771ee63ffd20cf57c (HEAD -> 5.0) +Author: Daniel-Constantin Mierla <miconda(a)gmail.com> +Date: Fri Mar 22 04:34:26 2019 +0100 + + dialog: parse headers for request and transfer reply for errors + + (cherry picked from commit 4e1ebc6b446e6264f91c96deaed0548de353d731) + (cherry picked from commit b4df4fc4b0401b522b7fce516e286aec85d4ad96) + (cherry picked from commit 5e7201ef86ab6152034989728272204ef02a4685) + +commit a32b6da224872bb831ff3014ad553336c7d295cb +Author: Daniel-Constantin Mierla <miconda(a)gmail.com> +Date: Fri Mar 22 04:17:23 2019 +0100 + + dialog: parse tm callback reply in early phase to detect broken format + + (cherry picked from commit 6b9837c30f9d2a2ca937d7e6d8c1c496fe4d7d30) + (cherry picked from commit c2995f731ab3a94f302af63bdad9c3bf61d4e995) + (cherry picked from commit a9fb58a83ec8738a371d6be995d457b88e16a2f4) + +commit 56696a65fb69940ffe9f8aeff6a90b37826393e7 (origin/5.0) +Author: Daniel-Constantin Mierla <miconda(a)gmail.com> +Date: Thu Apr 4 12:10:06 2019 +0200 + + ChangeLog: content updated for v5.0.8 + commit 36a7fc87e3523de23d3af3523fb08c41596543c2 Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Thu Apr 4 12:07:25 2019 +0200

5 years, 8 months

git:5.0:17dab529: dialog: parse headers for request and transfer reply for errors

by Daniel-Constantin Mierla

Module: kamailio Branch: 5.0 Commit: 17dab52919e161e0820a835771ee63ffd20cf57c URL: https://github.com/kamailio/kamailio/commit/17dab52919e161e0820a835771ee63f… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2019-04-04T12:59:59+02:00 dialog: parse headers for request and transfer reply for errors (cherry picked from commit 4e1ebc6b446e6264f91c96deaed0548de353d731) (cherry picked from commit b4df4fc4b0401b522b7fce516e286aec85d4ad96) (cherry picked from commit 5e7201ef86ab6152034989728272204ef02a4685) --- Modified: src/modules/dialog/dlg_handlers.c Modified: src/modules/dialog/dlg_transfer.c --- Diff: https://github.com/kamailio/kamailio/commit/17dab52919e161e0820a835771ee63f… Patch: https://github.com/kamailio/kamailio/commit/17dab52919e161e0820a835771ee63f… --- diff --git a/src/modules/dialog/dlg_handlers.c b/src/modules/dialog/dlg_handlers.c index 303513b065..80f9a9890d 100644 --- a/src/modules/dialog/dlg_handlers.c +++ b/src/modules/dialog/dlg_handlers.c @@ -849,6 +849,11 @@ int dlg_new_dialog(sip_msg_t *req, struct cell *t, const int run_initial_cbs) if(req->first_line.u.request.method_value != METHOD_INVITE) return -1; + if(parse_headers(req, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the request headers\n"); + return -1; + } + if(pre_match_parse( req, &callid, &ftag, &ttag, 0)<0) { LM_WARN("pre-matching failed\n"); return -1; diff --git a/src/modules/dialog/dlg_transfer.c b/src/modules/dialog/dlg_transfer.c index f3e594bcbe..a920eb52c1 100644 --- a/src/modules/dialog/dlg_transfer.c +++ b/src/modules/dialog/dlg_transfer.c @@ -252,6 +252,10 @@ void dlg_bridge_tm_callback(struct cell *t, int type, struct tmcb_params *ps) /* 2xx - build dialog/send refer */ msg = ps->rpl; + if(parse_headers(msg, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the reply headers\n"); + goto error; + } if((msg->cseq==NULL || parse_headers(msg,HDR_CSEQ_F,0)<0) || msg->cseq==NULL || msg->cseq->parsed==NULL) {

5 years, 8 months

git:5.0:a32b6da2: dialog: parse tm callback reply in early phase to detect broken format

by Daniel-Constantin Mierla

Module: kamailio Branch: 5.0 Commit: a32b6da224872bb831ff3014ad553336c7d295cb URL: https://github.com/kamailio/kamailio/commit/a32b6da224872bb831ff3014ad55333… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2019-04-04T12:59:49+02:00 dialog: parse tm callback reply in early phase to detect broken format (cherry picked from commit 6b9837c30f9d2a2ca937d7e6d8c1c496fe4d7d30) (cherry picked from commit c2995f731ab3a94f302af63bdad9c3bf61d4e995) (cherry picked from commit a9fb58a83ec8738a371d6be995d457b88e16a2f4) --- Modified: src/modules/dialog/dlg_handlers.c --- Diff: https://github.com/kamailio/kamailio/commit/a32b6da224872bb831ff3014ad55333… Patch: https://github.com/kamailio/kamailio/commit/a32b6da224872bb831ff3014ad55333… --- diff --git a/src/modules/dialog/dlg_handlers.c b/src/modules/dialog/dlg_handlers.c index 8621836ad2..303513b065 100644 --- a/src/modules/dialog/dlg_handlers.c +++ b/src/modules/dialog/dlg_handlers.c @@ -435,6 +435,13 @@ static void dlg_onreply(struct cell* t, int type, struct tmcb_params *param) if(dlg==0) return; + if (rpl != FAKED_REPLY) { + if(parse_headers(rpl, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the reply headers\n"); + goto done_early; + } + } + unref = 0; if (type & (TMCB_RESPONSE_IN|TMCB_ON_FAILURE)) { /* Set the dialog context so it is available in onreply_route and failure_route*/

5 years, 8 months

git:5.1:5e7201ef: dialog: parse headers for request and transfer reply for errors

by Daniel-Constantin Mierla

Module: kamailio Branch: 5.1 Commit: 5e7201ef86ab6152034989728272204ef02a4685 URL: https://github.com/kamailio/kamailio/commit/5e7201ef86ab6152034989728272204… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2019-04-04T12:58:30+02:00 dialog: parse headers for request and transfer reply for errors (cherry picked from commit 4e1ebc6b446e6264f91c96deaed0548de353d731) (cherry picked from commit b4df4fc4b0401b522b7fce516e286aec85d4ad96) --- Modified: src/modules/dialog/dlg_handlers.c Modified: src/modules/dialog/dlg_transfer.c --- Diff: https://github.com/kamailio/kamailio/commit/5e7201ef86ab6152034989728272204… Patch: https://github.com/kamailio/kamailio/commit/5e7201ef86ab6152034989728272204… --- diff --git a/src/modules/dialog/dlg_handlers.c b/src/modules/dialog/dlg_handlers.c index a2f50b7e3e..296a2d5c61 100644 --- a/src/modules/dialog/dlg_handlers.c +++ b/src/modules/dialog/dlg_handlers.c @@ -852,6 +852,11 @@ int dlg_new_dialog(sip_msg_t *req, struct cell *t, const int run_initial_cbs) if(req->first_line.u.request.method_value != METHOD_INVITE) return -1; + if(parse_headers(req, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the request headers\n"); + return -1; + } + if(pre_match_parse( req, &callid, &ftag, &ttag, 0)<0) { LM_WARN("pre-matching failed\n"); return -1; diff --git a/src/modules/dialog/dlg_transfer.c b/src/modules/dialog/dlg_transfer.c index f3e594bcbe..a920eb52c1 100644 --- a/src/modules/dialog/dlg_transfer.c +++ b/src/modules/dialog/dlg_transfer.c @@ -252,6 +252,10 @@ void dlg_bridge_tm_callback(struct cell *t, int type, struct tmcb_params *ps) /* 2xx - build dialog/send refer */ msg = ps->rpl; + if(parse_headers(msg, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the reply headers\n"); + goto error; + } if((msg->cseq==NULL || parse_headers(msg,HDR_CSEQ_F,0)<0) || msg->cseq==NULL || msg->cseq->parsed==NULL) {

5 years, 8 months

git:5.1:a9fb58a8: dialog: parse tm callback reply in early phase to detect broken format

by Daniel-Constantin Mierla

Module: kamailio Branch: 5.1 Commit: a9fb58a83ec8738a371d6be995d457b88e16a2f4 URL: https://github.com/kamailio/kamailio/commit/a9fb58a83ec8738a371d6be995d457b… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2019-04-04T12:58:21+02:00 dialog: parse tm callback reply in early phase to detect broken format (cherry picked from commit 6b9837c30f9d2a2ca937d7e6d8c1c496fe4d7d30) (cherry picked from commit c2995f731ab3a94f302af63bdad9c3bf61d4e995) --- Modified: src/modules/dialog/dlg_handlers.c --- Diff: https://github.com/kamailio/kamailio/commit/a9fb58a83ec8738a371d6be995d457b… Patch: https://github.com/kamailio/kamailio/commit/a9fb58a83ec8738a371d6be995d457b… --- diff --git a/src/modules/dialog/dlg_handlers.c b/src/modules/dialog/dlg_handlers.c index c80ca7d59f..a2f50b7e3e 100644 --- a/src/modules/dialog/dlg_handlers.c +++ b/src/modules/dialog/dlg_handlers.c @@ -438,6 +438,13 @@ static void dlg_onreply(struct cell* t, int type, struct tmcb_params *param) if(dlg==0) return; + if (rpl != FAKED_REPLY) { + if(parse_headers(rpl, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the reply headers\n"); + goto done_early; + } + } + unref = 0; if (type & (TMCB_RESPONSE_IN|TMCB_ON_FAILURE)) { /* Set the dialog context so it is available in onreply_route and failure_route*/

5 years, 8 months

git:5.2:b4df4fc4: dialog: parse headers for request and transfer reply for errors

by Daniel-Constantin Mierla

Module: kamailio Branch: 5.2 Commit: b4df4fc4b0401b522b7fce516e286aec85d4ad96 URL: https://github.com/kamailio/kamailio/commit/b4df4fc4b0401b522b7fce516e286ae… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2019-04-04T12:57:10+02:00 dialog: parse headers for request and transfer reply for errors (cherry picked from commit 4e1ebc6b446e6264f91c96deaed0548de353d731) --- Modified: src/modules/dialog/dlg_handlers.c Modified: src/modules/dialog/dlg_transfer.c --- Diff: https://github.com/kamailio/kamailio/commit/b4df4fc4b0401b522b7fce516e286ae… Patch: https://github.com/kamailio/kamailio/commit/b4df4fc4b0401b522b7fce516e286ae… --- diff --git a/src/modules/dialog/dlg_handlers.c b/src/modules/dialog/dlg_handlers.c index 80389a3446..7e8d72b6c7 100644 --- a/src/modules/dialog/dlg_handlers.c +++ b/src/modules/dialog/dlg_handlers.c @@ -852,6 +852,11 @@ int dlg_new_dialog(sip_msg_t *req, struct cell *t, const int run_initial_cbs) if(req->first_line.u.request.method_value != METHOD_INVITE) return -1; + if(parse_headers(req, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the request headers\n"); + return -1; + } + if(pre_match_parse( req, &callid, &ftag, &ttag, 0)<0) { LM_WARN("pre-matching failed\n"); return -1; diff --git a/src/modules/dialog/dlg_transfer.c b/src/modules/dialog/dlg_transfer.c index f3e594bcbe..a920eb52c1 100644 --- a/src/modules/dialog/dlg_transfer.c +++ b/src/modules/dialog/dlg_transfer.c @@ -252,6 +252,10 @@ void dlg_bridge_tm_callback(struct cell *t, int type, struct tmcb_params *ps) /* 2xx - build dialog/send refer */ msg = ps->rpl; + if(parse_headers(msg, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the reply headers\n"); + goto error; + } if((msg->cseq==NULL || parse_headers(msg,HDR_CSEQ_F,0)<0) || msg->cseq==NULL || msg->cseq->parsed==NULL) {

5 years, 8 months

git:5.2:c2995f73: dialog: parse tm callback reply in early phase to detect broken format

by Daniel-Constantin Mierla

Module: kamailio Branch: 5.2 Commit: c2995f731ab3a94f302af63bdad9c3bf61d4e995 URL: https://github.com/kamailio/kamailio/commit/c2995f731ab3a94f302af63bdad9c3b… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2019-04-04T12:57:01+02:00 dialog: parse tm callback reply in early phase to detect broken format (cherry picked from commit 6b9837c30f9d2a2ca937d7e6d8c1c496fe4d7d30) --- Modified: src/modules/dialog/dlg_handlers.c --- Diff: https://github.com/kamailio/kamailio/commit/c2995f731ab3a94f302af63bdad9c3b… Patch: https://github.com/kamailio/kamailio/commit/c2995f731ab3a94f302af63bdad9c3b… --- diff --git a/src/modules/dialog/dlg_handlers.c b/src/modules/dialog/dlg_handlers.c index a52b62805b..80389a3446 100644 --- a/src/modules/dialog/dlg_handlers.c +++ b/src/modules/dialog/dlg_handlers.c @@ -438,6 +438,13 @@ static void dlg_onreply(struct cell* t, int type, struct tmcb_params *param) if(dlg==0) return; + if (rpl != FAKED_REPLY) { + if(parse_headers(rpl, HDR_EOH_F, 0) < 0) { + LM_ERR("failed to parse the reply headers\n"); + goto done_early; + } + } + unref = 0; if (type & (TMCB_RESPONSE_IN|TMCB_ON_FAILURE)) { /* Set the dialog context so it is available in onreply_route and failure_route*/

5 years, 8 months

git:5.0:56696a65: ChangeLog: content updated for v5.0.8

by Daniel-Constantin Mierla

Module: kamailio Branch: 5.0 Commit: 56696a65fb69940ffe9f8aeff6a90b37826393e7 URL: https://github.com/kamailio/kamailio/commit/56696a65fb69940ffe9f8aeff6a90b3… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2019-04-04T12:10:06+02:00 ChangeLog: content updated for v5.0.8 --- Modified: ChangeLog --- Diff: https://github.com/kamailio/kamailio/commit/56696a65fb69940ffe9f8aeff6a90b3… Patch: https://github.com/kamailio/kamailio/commit/56696a65fb69940ffe9f8aeff6a90b3…

5 years, 8 months

← Newer
1
...
24
25
26
27
28
29
30
31
32
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev April 2019