I had the following code as a register handler:
t_check_request();
if(!www_authorize("$td", "subscriber")) {
switch($rc) {
case -1:
xlog(something about authentication error);
break;
case -2:
xlog(something about invalid password);
send_reply("403", "Forbidden");
exit;
case -3:
xlog(something about invalid user);
send_reply("403", "Forbidden");
exit;
default:
xlog(something else)
}
www_challenge("$td", "1");
t_release();
exit;
}
It worked fine with the initial 3.1.0 tarball from last week. But it
crashes with the tarball that is on the website right now:
Core was generated by `/usr/local/sbin/kamailio -P
/var/run/kamailio/kamailio.pid -m 64 -u root -g roo'.
Program terminated with signal 11, Segmentation fault.
#0 atomic_and_int (id=2116215340, p=128 '\200')
at ../../atomic/atomic_x86.h:227
227 ../../atomic/atomic_x86.h: No such file or directory.
in ../../atomic/atomic_x86.h
(gdb) where
#0 atomic_and_int (id=2116215340, p=128 '\200')
at ../../atomic/atomic_x86.h:227
#1 otn_new (id=2116215340, p=128 '\200') at ot_nonce.c:196
#2 0xb6fe5bba in get_challenge_hf (msg=0x836a63c, stale=0,
realm=0xbffb0ad4,
nonce=0x0, algorithm=0x0, qop=0xb6fee9d0, hftype=13, ahf=0xbffb0acc)
at challenge.c:181
#3 0xb6fe3c4f in auth_challenge (msg=0x836a63c, p1=<value optimized out>,
p2=0x835fd8c "`\022\060\b\001", hftype=13) at auth_mod.c:613
#4 0x08059de4 in do_action (h=0xbffb2098, a=0x830453c, msg=0x836a63c)
at action.c:1099
#5 0x080615b0 in run_actions (h=0xbffb2098, a=0x8304498, msg=0x836a63c)
at action.c:1553
#6 0x0805a530 in do_action (h=0xbffb2098, a=0x830720c, msg=0x836a63c)
at action.c:1259
#7 0x080615b0 in run_actions (h=0xbffb2098, a=0x830720c, msg=0x836a63c)
at action.c:1553
#8 0x0805a61d in do_action (h=0xbffb2098, a=0x830787c, msg=0x836a63c)
at action.c:1084
#9 0x080615b0 in run_actions (h=0xbffb2098, a=0x8304090, msg=0x836a63c)
at action.c:1553
#10 0x0805a26c in do_action (h=0xbffb2098, a=0x82ea7d8, msg=0x836a63c)
at action.c:711
#11 0x080615b0 in run_actions (h=0xbffb2098, a=0x82ea7d8, msg=0x836a63c)
at action.c:1553
#12 0x0805a61d in do_action (h=0xbffb2098, a=0x82eb090, msg=0x836a63c)
at action.c:1084
#13 0x080615b0 in run_actions (h=0xbffb2098, a=0x82eb090, msg=0x836a63c)
at action.c:1553
#14 0x0805caff in do_action (h=0xbffb2098, a=0x82eb134, msg=0x836a63c)
at action.c:1088
#15 0x080615b0 in run_actions (h=0xbffb2098, a=0x82eb134, msg=0x836a63c)
at action.c:1553
#16 0x0805caff in do_action (h=0xbffb2098, a=0x82eb1d8, msg=0x836a63c)
---Type <return> to continue, or q <return> to quit---
at action.c:1088
#17 0x080615b0 in run_actions (h=0xbffb2098, a=0x82e9124, msg=0x836a63c)
at action.c:1553
#18 0x0805a61d in do_action (h=0xbffb2098, a=0x82ebbb0, msg=0x836a63c)
at action.c:1084
#19 0x080615b0 in run_actions (h=0xbffb2098, a=0x82df70c, msg=0x836a63c)
at action.c:1553
#20 0x08061854 in run_top_route (a=0x82df70c, msg=0x836a63c, c=0x0)
at action.c:1626
#21 0x080d5866 in receive_msg (
buf=0x827e880 "REGISTER sip:sip.evaristesys.com SIP/2.0\r\nVia:
SIP/2.0/UDP
208.52.173.7:5060;branch=z9hG4bK39b78214;rport\r\nMax-Forwards:
32\r\nFrom: <sip:abalashov@sip.evaristesys.com>;tag=as4854d363\r\nTo:
<sip:abalasho"...,
len=678, rcv_info=0xbffb22dc) at receive.c:205
#22 0x0815b512 in udp_rcv_loop () at udp_server.c:532
#23 0x080a2917 in main_loop () at main.c:1554
#24 0x080a5142 in main (argc=13, argv=0xbffb2574) at main.c:2398
I have not tried with sip-router:master:HEAD yet.
--
Alex Balashov - Principal
Evariste Systems LLC
1170 Peachtree Street
12th Floor, Suite 1200
Atlanta, GA 30309
Tel: +1-678-954-0670
Fax: +1-404-961-1892
Web: http://www.evaristesys.com/
In Kamailio 3.1.0, I get an occasional crash that appears to be due to
topoh. Here is the backtrace from the core file, though the binary was
not compiled with debug symbols and so some things have definitely been
optimised out:
Core was generated by `/usr/local/sbin/kamailio -P
/var/run/kamailio/kamailio.pid -m 1024 -u root -g r'.
Program terminated with signal 11, Segmentation fault.
[New process 11535]
#0 th_del_via_cookie (msg=0x7fffcca2bbe0, via=0x0) at th_msg.c:951
951 for(p=via->param_lst; p; p=p->next)
(gdb) where
#0 th_del_via_cookie (msg=0x7fffcca2bbe0, via=0x0) at th_msg.c:951
#1 0x00007f528da90eb4 in th_del_cookie (msg=0x7fffcca2bbe0) at th_msg.c:972
#2 0x00007f528da97748 in th_msg_sent (data=<value optimized out>)
at topoh_mod.c:288
#3 0x00007f528f98d1d7 in send_pr_buffer (rb=0x7f5249acc0d8,
buf=0x7f528fbe50a0, len=3) at ../../forward.h:133
#4 0x00007f528f9bdffd in t_retransmit_reply (t=0x7f5249acc018)
at t_reply.c:1411
#5 0x00007f528f998c17 in retr_buf_handler (ticks=291591695,
tl=0x7f5249acc0f8, p=<value optimized out>) at timer.c:367
#6 0x0000000000513e7f in timer_main () at timer.c:894
#7 0x0000000000464c7b in main_loop () at main.c:1618
#8 0x00000000004674d3 in main (argc=<value optimized out>,
argv=0x7fffcca2c638) at main.c:2398
This is not a bug I can easily reproduce, and is probably due to an
extremely unusual situation. This particular peer that is being
interoperated with has a history of eccentric behaviour that makes no
sense. Nevertheless, here is a print of msg->buf.
(gdb) set print elements 1024
(gdb) print msg->buf
$3 = 0x7f528fbe50a0 "SIP/2.0 487 Request Terminated\r\nFrom:
<sip:7324231212@66.6.136.41;user=phone>;tag=ff754700ff76ff10ff00003048ff62ff\r\nTo:
<sip:234805449114@70.34.96.20:5060;user=phone>;tag=774fdcea2960b2b7\r\nServer:
VOS2009 V2.1.1.5\r\nCSeq: 1 INVITE\r\nCall-ID:
4e744700d676b71080000030488062e0@MERA3\r\nContact:
<sip:234805449114@208.38.165.139:5060>\r\nMax-Forwards:
70\r\nContent-Length: 0\r\nTH: uch\r\n\r\n"
I do not see a Via header here at all, though I do not know if that is
because the proxy has stripped it off by this point, so I won't comment
on the cause.
The core file is available if anyone is interested, but I am not going
to obnoxiously attach it like last time. :-)
Cheers,
-- Alex
--
Alex Balashov - Principal
Evariste Systems LLC
1170 Peachtree Street
12th Floor, Suite 1200
Atlanta, GA 30309
Tel: +1-678-954-0670
Fax: +1-404-961-1892
Web: http://www.evaristesys.com/
Module: sip-router
Branch: 3.1
Commit: 3cf51efaab04a9c008e50c58d9abc8eaf41ee0ed
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=3cf51ef…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Fri Oct 15 10:09:03 2010 +0200
auth: fix pool no. when both nc and otn are enabled
When both nonce_count and one_time_nonce are enabled in the same
time, the pool number was corrupted leading to crashes.
Reported-by: Alex Balashov abalashov evaristesys com
(cherry picked from commit 7aea949e1d1101b87d4327a86f026e119cd0ae8b)
---
modules/auth/challenge.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/modules/auth/challenge.c b/modules/auth/challenge.c
index 1e4dfe6..9bd4ce0 100644
--- a/modules/auth/challenge.c
+++ b/modules/auth/challenge.c
@@ -89,6 +89,7 @@ int get_challenge_hf(struct sip_msg* msg, int stale, str* realm,
#if defined USE_NC || defined USE_OT_NONCE
unsigned int n_id;
unsigned char pool;
+ unsigned char pool_flags;
#endif
if(!ahf)
@@ -170,23 +171,26 @@ int get_challenge_hf(struct sip_msg* msg, int stale, str* realm,
if (nc_enabled || otn_enabled){
pool=nid_get_pool();
n_id=nid_inc(pool);
+ pool_flags=0;
#ifdef USE_NC
if (nc_enabled){
nc_new(n_id, pool);
- pool|= NF_VALID_NC_ID;
+ pool_flags|= NF_VALID_NC_ID;
}
#endif
#ifdef USE_OT_NONCE
if (otn_enabled){
otn_new(n_id, pool);
- pool|= NF_VALID_OT_ID;
+ pool_flags|= NF_VALID_OT_ID;
}
#endif
}else{
pool=0;
+ pool_flags=0;
n_id=0;
}
- if (calc_nonce(p, &l, cfg, t, t + nonce_expire, n_id, pool,
+ if (calc_nonce(p, &l, cfg, t, t + nonce_expire, n_id,
+ pool | pool_flags,
&secret1, &secret2, msg) != 0)
#else /* USE_NC || USE_OT_NONCE*/
if (calc_nonce(p, &l, cfg, t, t + nonce_expire,
Module: sip-router
Branch: master
Commit: 7aea949e1d1101b87d4327a86f026e119cd0ae8b
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=7aea949…
Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org>
Date: Fri Oct 15 10:09:03 2010 +0200
auth: fix pool no. when both nc and otn are enabled
When both nonce_count and one_time_nonce are enabled in the same
time, the pool number was corrupted leading to crashes.
Reported-by: Alex Balashov abalashov evaristesys com
---
modules/auth/challenge.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/modules/auth/challenge.c b/modules/auth/challenge.c
index 1e4dfe6..9bd4ce0 100644
--- a/modules/auth/challenge.c
+++ b/modules/auth/challenge.c
@@ -89,6 +89,7 @@ int get_challenge_hf(struct sip_msg* msg, int stale, str* realm,
#if defined USE_NC || defined USE_OT_NONCE
unsigned int n_id;
unsigned char pool;
+ unsigned char pool_flags;
#endif
if(!ahf)
@@ -170,23 +171,26 @@ int get_challenge_hf(struct sip_msg* msg, int stale, str* realm,
if (nc_enabled || otn_enabled){
pool=nid_get_pool();
n_id=nid_inc(pool);
+ pool_flags=0;
#ifdef USE_NC
if (nc_enabled){
nc_new(n_id, pool);
- pool|= NF_VALID_NC_ID;
+ pool_flags|= NF_VALID_NC_ID;
}
#endif
#ifdef USE_OT_NONCE
if (otn_enabled){
otn_new(n_id, pool);
- pool|= NF_VALID_OT_ID;
+ pool_flags|= NF_VALID_OT_ID;
}
#endif
}else{
pool=0;
+ pool_flags=0;
n_id=0;
}
- if (calc_nonce(p, &l, cfg, t, t + nonce_expire, n_id, pool,
+ if (calc_nonce(p, &l, cfg, t, t + nonce_expire, n_id,
+ pool | pool_flags,
&secret1, &secret2, msg) != 0)
#else /* USE_NC || USE_OT_NONCE*/
if (calc_nonce(p, &l, cfg, t, t + nonce_expire,