kamailio 3.0.3 tls problems

List overview All Threads
Download

newer

older

auth module README t_newtran()...

authenticating users based on IP...

Rouskol Andrey

28 Sep 2010 28 Sep '10

1:15 p.m.

Hello, I have a problem running kamailio with tls support. I can successfully register only for the first time, all further registration fails with the following message in the log: Sep 28 11:53:55 siptest /usr/sbin/kamailio[16963]: ERROR: tls [tls_server.c:392]: SSL error:error:07064041:memory buffer routines:BUF_MEM_grow:malloc failure The system is a default kamailio installation on a Debian 5.0.6 system. Does somebody know what could cause the problem? Regards, Andrey.

Show replies by date

Daniel-Constantin Mierla

28 Sep 28 Sep

1:23 p.m.

Hello, On 9/28/10 10:15 AM, Rouskol Andrey wrote:

...

is it a loaded server? Try to increase shared memory. Also, note that some modules conflict with tls module, such as auth_identity, utils ... listing loaded module will help to see if it is the case. Cheers, Daniel -- Daniel-Constantin Mierla http://www.asipto.com

Rouskol Andrey

1:55 p.m.

Daniel, Here is what I get. /etc/default/kamailio: MEMORY=64 # I've tried to set it to 192 - result was the same # grep loadmodule kamailio.cfg loadmodule "db_mysql.so" loadmodule "mi_fifo.so" loadmodule "kex.so" loadmodule "tm.so" loadmodule "tmx.so" loadmodule "sl.so" loadmodule "rr.so" loadmodule "pv.so" loadmodule "maxfwd.so" loadmodule "usrloc.so" loadmodule "registrar.so" loadmodule "textops.so" loadmodule "uri_db.so" loadmodule "siputils.so" loadmodule "xlog.so" loadmodule "sanity.so" loadmodule "ctl.so" loadmodule "mi_rpc.so" loadmodule "acc.so" loadmodule "auth.so" loadmodule "auth_db.so" #loadmodule "alias_db.so" loadmodule "domain.so" loadmodule "presence.so" loadmodule "presence_xml.so" loadmodule "nathelper.so" loadmodule "tls.so" Regards, Andrey. 28.09.10, 12:23, "Daniel-Constantin Mierla" <miconda(a)gmail.com>om>:

...

Hello, On 9/28/10 10:15 AM, Rouskol Andrey wrote:

Daniel-Constantin Mierla

2:02 p.m.

Hello, connect with sercmd and send the output of core.shmem to see if there is enough free memory. I remember I got in similar issue at some point on a virtual machine with ubuntu, but then I haven't gotten back in that system. Cheers, Daniel On 9/28/10 10:55 AM, Rouskol Andrey wrote:

...

Hello, On 9/28/10 10:15 AM, Rouskol Andrey wrote:

_______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users(a)lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

-- Daniel-Constantin Mierla http://www.asipto.com

Rouskol Andrey

3:15 p.m.

Daniel, Here it is: after startup: sercmd> core.shmmem { total: 67108864 free: 65509960 used: 1532120 real_used: 1598904 max_used: 1600184 fragments: 8 } after 1st registration: sercmd> core.shmmem { total: 67108864 free: 65395520 used: 1645720 real_used: 1713344 max_used: 1713888 fragments: 31 } after 1st dis-registration: sercmd> core.shmmem { total: 67108864 free: 65433648 used: 1607584 real_used: 1675216 max_used: 1713888 fragments: 52 } after 2nd registration (reg failed): sercmd> core.shmmem { total: 67108864 free: 65505416 used: 1535816 real_used: 1603448 max_used: 1713888 fragments: 71 } Andrey. 28.09.10, 13:02, "Daniel-Constantin Mierla" <miconda(a)gmail.com>om>:

...

Hello, On 9/28/10 10:15 AM, Rouskol Andrey wrote:

Klaus Darilion

2:29 p.m.

Am 28.09.2010 10:15, schrieb Rouskol Andrey:

...

Maybe it is related to this bug (verify if you have already a patched version): Module: sip-router Branch: sr_3.0 Commit: 513c21f67f88484dd12dd6adce6d6ddc7fb60c31 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=513c21f… Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Date: Fri Aug 20 12:22:56 2010 +0200 tls: fix state change while waiting for lock return tls_h_fix_read_conn() did not return the right thing if the state changed while waiting for the lock (the fall-through return was error instead of success). Reported-by: Couprie Geoffroy geoffroy couprie atosorigin com --- modules/tls/tls_server.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules/tls/tls_server.c b/modules/tls/tls_server.c index 6d32af6..52b62e3 100644 --- a/modules/tls/tls_server.c +++ b/modules/tls/tls_server.c @@ -971,7 +971,7 @@ int tls_h_fix_read_conn(struct tcp_connection *c) int ret; struct tls_extra_data* tls_c; - ret = -1; + ret = 1; tls_c = 0; if (unlikely(c->extra_data==0)){ lock_get(&c->write_lock); _______________________________________________ sr-dev mailing list sr-dev(a)lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev

Rouskol Andrey

3:32 p.m.

Klaus, I've installed binary distribution from kamailio.org site (3.0.3+lenny1), so, I'm not sure is it fixed in _my_ binary. But looking into kamailio-3.0.3 source - it was not fixed. And it also crashes the same way - before switching to binary package I've installed kamailio from sources. I'll try to recompile it with this patch applied. I've also tried to install sip-router, it's tls module doesn't crash, but kamailio has more features. In sip-router's tls sources there is no more function tls_h_fix_read_conn() at all. Regards, Andrey. 28.09.10, 13:29, "Klaus Darilion" <klaus.mailinglists(a)pernau.at>at>:

...

Am 28.09.2010 10:15, schrieb Rouskol Andrey:

Maybe it is related to this bug (verify if you have already a patched version): Module: sip-router Branch: sr_3.0 Commit: 513c21f67f88484dd12dd6adce6d6ddc7fb60c31 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=513c21f… Author: Andrei Pelinescu-Onciul Committer: Andrei Pelinescu-Onciul Date: Fri Aug 20 12:22:56 2010 +0200 tls: fix state change while waiting for lock return tls_h_fix_read_conn() did not return the right thing if the state changed while waiting for the lock (the fall-through return was error instead of success). Reported-by: Couprie Geoffroy geoffroy couprie atosorigin com --- modules/tls/tls_server.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules/tls/tls_server.c b/modules/tls/tls_server.c index 6d32af6..52b62e3 100644 --- a/modules/tls/tls_server.c +++ b/modules/tls/tls_server.c @@ -971,7 +971,7 @@ int tls_h_fix_read_conn(struct tcp_connection *c) int ret; struct tls_extra_data* tls_c; - ret = -1; + ret = 1; tls_c = 0; if (unlikely(c->extra_data==0)){ lock_get(&c->write_lock); _______________________________________________ sr-dev mailing list sr-dev(a)lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev

Andrei Pelinescu-Onciul

5:28 p.m.

On Sep 28, 2010 at 14:32, Rouskol Andrey <anry-dev(a)yandex.ru> wrote:

...

Yes, it's not fixed in 3.0.3 (but you if you don't use git directly you can get newer tarballs from http://sip-router.org/tarballs/sr/ ). Anyway that patch is not related with that mem. allocation problem. Could you try compiling from sources, with debugging and memory debugging enabled? make cfg mode=debug MEMDBG=1 include_modules="tls db_mysql" make all (note that if you want to make install, the default path is under /usr/local, e.g. /usr/local/sbin/{kamailio,ser} ) Add also to your config: memlog=1 memdbg=1 After that try again sending the REGISTERs and then please send me the log (it will be quite big, all memory allocation attempts will be dumped into it).

...

I've also tried to install sip-router, it's tls module doesn't crash, but kamailio has more features. In sip-router's tls sources there is no more function tls_h_fix_read_conn() at all.

If by sip-router you mean sip-router 3.0, then it has exactly the same features as kamailio 3.0 (only some defaults and minor stuff are changed). If you mean sip-router 3.0.99 or 3.1, then it should have more features then kamailio 3.0 (being the newer soon to be release). Note that in 3.1 the tls module was mostly re-written (to support async mode) and some module parameters which had equivalents in the tcp config options were removed. Are these your missing features? Andrei

...

Regards, Andrey. 28.09.10, 13:29, "Klaus Darilion" <klaus.mailinglists(a)pernau.at>at>:

Am 28.09.2010 10:15, schrieb Rouskol Andrey:

Maybe it is related to this bug (verify if you have already a patched version): Module: sip-router Branch: sr_3.0 Commit: 513c21f67f88484dd12dd6adce6d6ddc7fb60c31 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=513c21f… Author: Andrei Pelinescu-Onciul Committer: Andrei Pelinescu-Onciul Date: Fri Aug 20 12:22:56 2010 +0200 tls: fix state change while waiting for lock return tls_h_fix_read_conn() did not return the right thing if the state changed while waiting for the lock (the fall-through return was error instead of success). Reported-by: Couprie Geoffroy geoffroy couprie atosorigin com --- modules/tls/tls_server.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules/tls/tls_server.c b/modules/tls/tls_server.c index 6d32af6..52b62e3 100644 --- a/modules/tls/tls_server.c +++ b/modules/tls/tls_server.c @@ -971,7 +971,7 @@ int tls_h_fix_read_conn(struct tcp_connection *c) int ret; struct tls_extra_data* tls_c; - ret = -1; + ret = 1; tls_c = 0; if (unlikely(c->extra_data==0)){ lock_get(&c->write_lock); _______________________________________________ sr-dev mailing list sr-dev(a)lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev

Rouskol Andrey

7:04 p.m.

Andrei, When I recompile kamailio with debug options you specified, it works just fine! (no memdbg and memlog options in cfg file). If I compile it as usual, it fails. Here is the difference: # make cfg mode=debug MEMDBG=1 \ - works fine make cfg \ - fails include_modules="tls db_mysql presence presence_xml nathelper" I've tried sip-router 3.0.99 (from git). Regarding missed features I mean no useful documentation (for newbees), and no presence support (I haven't managed to understand what is presence_b2b). Regards, Andrey.

Andrei Pelinescu-Onciul

8:10 p.m.

On Sep 28, 2010 at 18:04, Rouskol Andrey <anry-dev(a)yandex.ru> wrote:

...

Try with make cfg extra_defs="-DDBG_F_MALLOC" include_modules="tls ..." and then with memdbg=1 (either by writing it in the cfg, or using sercmd at runtime: sercmd cfg.set_now_int core memlog 1 ).

...

I've tried sip-router 3.0.99 (from git). Regarding missed features I mean no useful documentation (for newbees), and no presence support (I haven't managed to understand what is presence_b2b).

You mean there are no presence modules in the default config (which right now uses common modules + modules comming from ser). You can use the presence modules under modules_k (the ones comming from kamailio), although they might not mix well with the ser-like DB (ser presence modules are obsolete). You can also use a kamailio config (e.g. sip-router/etc/kamailio.cfg), making it effectively kamailio 3.1. Andrei

Ovidiu Sas

8:29 p.m.

On Tue, Sep 28, 2010 at 11:10 AM, Andrei Pelinescu-Onciul <andrei(a)iptel.org> wrote:

...

On Sep 28, 2010 at 18:04, Rouskol Andrey <anry-dev(a)yandex.ru> wrote:

Try with make cfg extra_defs="-DDBG_F_MALLOC" include_modules="tls ..." and then with memdbg=1 (either by writing it in the cfg, or using sercmd at runtime: sercmd cfg.set_now_int core memlog 1 ).

I've tried sip-router 3.0.99 (from git). Regarding missed features I mean no useful documentation (for newbees), and no presence support (I haven't managed to understand what is presence_b2b).

If ser presence modules are obsolete, can we move them to the obsolete directory and promote k ones to stadard? Ovidiu

...

You can also use a kamailio config (e.g. sip-router/etc/kamailio.cfg), making it effectively kamailio 3.1. Andrei

Andrei Pelinescu-Onciul

8:38 p.m.

On Sep 28, 2010 at 11:29, Ovidiu Sas <osas(a)voipembedded.com> wrote:

...

On Tue, Sep 28, 2010 at 11:10 AM, Andrei Pelinescu-Onciul <andrei(a)iptel.org> wrote:

On Sep 28, 2010 at 18:04, Rouskol Andrey <anry-dev(a)yandex.ru> wrote:

Try with make cfg extra_defs="-DDBG_F_MALLOC" include_modules="tls ..." and then with memdbg=1 (either by writing it in the cfg, or using sercmd at runtime: sercmd cfg.set_now_int core memlog 1 ).

I've tried sip-router 3.0.99 (from git). Regarding missed features I mean no useful documentation (for newbees), and no presence support (I haven't managed to understand what is presence_b2b).

If ser presence modules are obsolete, can we move them to the obsolete directory and promote k ones to stadard?

They already under obsolete/, except for presence_b2b. Moving the k ones to standard should be ok, as soon as someone can check that they do not depend on some modules still under modules_k (e.g. using an API implemented in one of them) and they are independent from the DB tables point of view (they use their own tables or tables that are the same both in k and ser). Basically if someone introduces them in a ser config, they wouldn't cause any problems. Andrei

Ovidiu Sas

10:29 p.m.

Daniel, What do you think about moving the (k) presence modules to standard for the next 3.1 kamailio release? Regards, Ovidiu Sas On Tue, Sep 28, 2010 at 11:38 AM, Andrei Pelinescu-Onciul <andrei(a)iptel.org> wrote:

...

On Sep 28, 2010 at 11:29, Ovidiu Sas <osas(a)voipembedded.com> wrote:

On Tue, Sep 28, 2010 at 11:10 AM, Andrei Pelinescu-Onciul <andrei(a)iptel.org> wrote:

If ser presence modules are obsolete, can we move them to the obsolete directory and promote k ones to stadard?

Daniel-Constantin Mierla

29 Sep 29 Sep

1:44 p.m.

Hello, On 9/28/10 7:29 PM, Ovidiu Sas wrote:

...

Daniel, What do you think about moving the (k) presence modules to standard for the next 3.1 kamailio release?

there is the pua_ursrloc that is related to kamailio version of usrloc. The others might be ok, but haven't really looked at all dependencies. Maybe we keep current locations of presence modules for this release and with next one we try to merge some more modules like location ones. Also, I plan to put quite some work in the near future to presence, mainly to scalability, now that starting with 3.1 we have complete solution with the new embedded xcap server. It would be good to move to obsolete folder all modules that are not maintained. Cheers, Daniel

...

Regards, Ovidiu Sas On Tue, Sep 28, 2010 at 11:38 AM, Andrei Pelinescu-Onciul <andrei(a)iptel.org> wrote: > On Sep 28, 2010 at 11:29, Ovidiu Sas<osas(a)voipembedded.com> wrote: >> On Tue, Sep 28, 2010 at 11:10 AM, Andrei Pelinescu-Onciul >> <andrei(a)iptel.org> wrote: >>> You mean there are no presence modules in the default config (which >>> right now uses common modules + modules comming from ser). >>> You can use the presence modules under modules_k (the ones comming from >>> kamailio), although they might not mix well with the ser-like DB (ser >>> presence modules are obsolete). >> If ser presence modules are obsolete, can we move them to the obsolete >> directory and promote k ones to stadard? > They already under obsolete/, except for presence_b2b. > > Moving the k ones to standard should be ok, as soon as someone can check > that they do not depend on some modules still under modules_k (e.g. > using an API implemented in one of them) and they are independent from > the DB tables point of view (they use their own tables or tables that > are the same both in k and ser). > Basically if someone introduces them in a ser config, they wouldn't > cause any problems. > > > Andrei >

-- Daniel-Constantin Mierla http://www.asipto.com

Andrei Pelinescu-Onciul

30 Sep 30 Sep

4:56 a.m.

On Sep 28, 2010 at 17:10, Andrei Pelinescu-Onciul <andrei(a)iptel.org> wrote:

...

On Sep 28, 2010 at 18:04, Rouskol Andrey <anry-dev(a)yandex.ru> wrote:

Try with make cfg extra_defs="-DDBG_F_MALLOC" include_modules="tls ..." and then with memdbg=1 (either by writing it in the cfg, or using sercmd at runtime: sercmd cfg.set_now_int core memlog 1 ).

In the meantime I managed to reproduce it. It should be fixed in all the versions now. Andrei

Rouskol Andrey

3:15 p.m.

Andrei, 30.09.10, 03:56, "Andrei Pelinescu-Onciul" <andrei(a)iptel.org>rg>:

...

In the meantime I managed to reproduce it. It should be fixed in all the versions now. Andrei

That's great! Because I could not reproduce this problem on system compiled with this debug flags. By the way, I don't know, is it a bug or feature, but if I try to run kamailio (3.0.3) with default config on non-standard port 5062, this check "if (!uri==myself)" is failed. On port 5060 it works without problems. With UDP connection and debug=4 syslog goes crazy, but I've got quite an interesting lines: Sep 30 13:51:40 siptest /usr/local/sbin/kamailio[21693]: DEBUG: <core> [socket_info.c:488]: grep_sock_info - checking if port 5061 matches port 5060 Sep 30 13:51:40 siptest /usr/local/sbin/kamailio[21692]: DEBUG: <core> [socket_info.c:488]: grep_sock_info - checking if port 5062 matches port 5060 If I enable multi-domain support it also works without problems even on non standard port. Regards, Andrey.

Andrei Pelinescu-Onciul

7 Oct 7 Oct

2:23 p.m.

On Sep 30, 2010 at 14:15, Rouskol Andrey <anry-dev(a)yandex.ru> wrote:

...

Andrei, 30.09.10, 03:56, "Andrei Pelinescu-Onciul" <andrei(a)iptel.org>rg>:

In the meantime I managed to reproduce it. It should be fixed in all the versions now. Andrei

It's a feature. If you don't listen on 5060 and the uri contains 5060 or no port at all it will not match (you could run several proxies on the same machine, on different ports).

...

With UDP connection and debug=4 syslog goes crazy, but I've got quite an interesting lines: Sep 30 13:51:40 siptest /usr/local/sbin/kamailio[21693]: DEBUG: <core> [socket_info.c:488]: grep_sock_info - checking if port 5061 matches port 5060 Sep 30 13:51:40 siptest /usr/local/sbin/kamailio[21692]: DEBUG: <core> [socket_info.c:488]: grep_sock_info - checking if port 5062 matches port 5060 If I enable multi-domain support it also works without problems even on non standard port.

You could also add alias=ip:5060 alias=domain:5060 and it will work. Andrei

Rouskol Andrey

28 Sep 28 Sep

3:57 p.m.

Klaus, I've applied this patch, it doesn't help in my case. Regards, Andrey. 28.09.10, 13:29, "Klaus Darilion" <klaus.mailinglists(a)pernau.at>at>:

...

Am 28.09.2010 10:15, schrieb Rouskol Andrey:

Maybe it is related to this bug (verify if you have already a patched version): Module: sip-router Branch: sr_3.0 Commit: 513c21f67f88484dd12dd6adce6d6ddc7fb60c31 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=513c21f… Author: Andrei Pelinescu-Onciul Committer: Andrei Pelinescu-Onciul Date: Fri Aug 20 12:22:56 2010 +0200 tls: fix state change while waiting for lock return tls_h_fix_read_conn() did not return the right thing if the state changed while waiting for the lock (the fall-through return was error instead of success). Reported-by: Couprie Geoffroy geoffroy couprie atosorigin com --- modules/tls/tls_server.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules/tls/tls_server.c b/modules/tls/tls_server.c index 6d32af6..52b62e3 100644 --- a/modules/tls/tls_server.c +++ b/modules/tls/tls_server.c @@ -971,7 +971,7 @@ int tls_h_fix_read_conn(struct tcp_connection *c) int ret; struct tls_extra_data* tls_c; - ret = -1; + ret = 1; tls_c = 0; if (unlikely(c->extra_data==0)){ lock_get(&c->write_lock); _______________________________________________ sr-dev mailing list sr-dev(a)lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev

4953

days inactive

4962

days old

sr-users@lists.kamailio.org

Manage subscription

17 comments

5 participants

tags (0)

participants (5)

Andrei Pelinescu-Onciul
Daniel-Constantin Mierla
Klaus Darilion
Ovidiu Sas
Rouskol Andrey