[OpenSIPS-Users] is_method crash when used on pike triggered route

[Bogdan-Andrei Iancu]

Hi Ronald,

Thanks for the useful information - find attached a patch that should 
fix the problem - please apply it, recompile and let me know if works ok 
- if yes, I will update on SVN.

The crash seams to be triggered by a bogus SIP message where the parsing 
of the first line fails - and this message hits the pike route crashing 
in some parsing functions.

Regards,
Bogdan

On 01/16/2012 06:08 AM, Ronald Cepres wrote:
> Hi Bogdan,
>
> Thanks for your reply.
>
> The crash happened often (every less than hour) on live traffic, but I 
> was not able to reproduce the bug on my own.
> Here's the last part of OpenSIPS logs that I saved after the crash:
>
> Jan 13 09:31:39 ASTPROD-03 kernel: [25303999.864022] opensips[12133]: 
> segfault at 0 ip 080f639c sp bfffc620 error 4 in opensips[8048000+139000]
> Jan 13 09:31:39 ASTPROD-03 /sbin/opensips[12133]: 
> INFO:core:parse_first_line: method not followed by SP
> Jan 13 09:31:39 ASTPROD-03 /sbin/opensips[12133]: 
> INFO:core:parse_first_line: bad message
> Jan 13 09:31:39 ASTPROD-03 /sbin/opensips[12133]: 
> ERROR:core:parse_msg: message=<-15#015#012REGISTER 
> sip:server.example.com <http://server.example.com>;transport=tcp 
> SIP/2.0#015#012Via: SIP/2.0/TCP 
> client.example.com:13851;rport;branch=z9hG4bKPj-HwYov6D5txKI6aVe5WxpubPXFTKtkHM#015#012Max-Forwards: 
> 70#015#012From: <sip:user at server.example.com 
> <mailto:sip%3Auser at server.example.com>>;tag=e3o0uokXbnsOsn0HWFiw2Pn5D2TuAcmB#015#012To: 
> <sip:user at server.example.com 
> <mailto:sip%3Auser at server.example.com>>#015#012Call-ID: 
> m2n.UnXe-HLK-XaiL0m6sWnOF1lQ71O.#015#012CSeq: 26361 
> REGISTER#015#012User-Agent: 12Connect Lite SIP v3.0#015#012Contact: 
> <sip:user at client.example.com:13851;transport=tcp;ob>#015#012Expires: 
> 300#015#012Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, 
> NOTIFY, REFER, MESSAGE, OPTIONS#015#012Content-Length:  0#015#012#015#012>
> Jan 13 09:31:39 ASTPROD-03 /sbin/opensips[12133]: 
> ERROR:core:receive_msg: parse_msg failed
> Jan 13 09:31:40 ASTPROD-03 /sbin/opensips[12145]: 
> CRITICAL:core:receive_fd: EOF on 38
> Jan 13 09:31:40 ASTPROD-03 /sbin/opensips[12106]: 
> INFO:core:handle_sigs: child process 12133 exited by a signal 11
> Jan 13 09:31:40 ASTPROD-03 /sbin/opensips[12106]: 
> INFO:core:handle_sigs: core was generated
> Jan 13 09:31:40 ASTPROD-03 /sbin/opensips[12106]: 
> INFO:core:handle_sigs: terminating due to SIGCHLD
>
> On Sun, Jan 15, 2012 at 8:45 PM, Bogdan-Andrei Iancu 
> <bogdan at opensips.org <mailto:bogdan at opensips.org>> wrote:
>
>     Hi Ronald,
>
>     The crash happens on a reply and not a request - see the frame 14,
>     where "buf" (the buffer containing the
>     sip message) shows a reply like text.
>
>     But the is_method() should not crash at all....before diving into
>     debugging:
>         1) can you reproduce this crash ?
>         2) before the crash, do you see any errors in the logs
>
>     Regards,
>     Bogdan
>
>
>     On 01/13/2012 01:16 PM, Ronald Cepres wrote:
>>     Hi all,
>>
>>     I'm using OpenSIPS 1.7.1 and based from the attached back trace,
>>     it crashed when it is trying to parse the method of a REGISTER
>>     message received by the server, triggered by pike route.
>>
>>     Here is a snippet of my opensips.cfg:
>>     ...
>>     loadmodule "pike.so"
>>     modparam("pike", "sampling_time_unit", 30)
>>     modparam("pike", "reqs_density_per_unit", 75)
>>     modparam("pike", "check_route", "pike")
>>     ...
>>     route[pike] {
>>             if (($si == $Ri) || ($si == "192.168.1.60") || ($si == "
>>     192.168.1.61") || ($si == " 192.168.1.65")) {
>>                             drop;
>>             }
>>             if (!is_method("REGISTER")) {
>>                     drop;
>>             }
>>     }
>>     ...
>>
>>     Basically, I just want to check REGISTER messages only on the
>>     pike route. Does anyone have a workaround on this?
>>
>>     FWIW, should I also post this on the dev list?
>>
>>     Thanks!
>>
>>     Regards,
>>     Ronald
>>
>>
>>     _______________________________________________
>>     Users mailing list
>>     Users at lists.opensips.org  <mailto:Users at lists.opensips.org>
>>     http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>
>
>     -- 
>     Bogdan-Andrei Iancu
>     OpenSIPS Founder and Developer
>     OpenSIPS solutions and "know-how"
>
>


-- 
Bogdan-Andrei Iancu
OpenSIPS Founder and Developer
OpenSIPS solutions and "know-how"

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/users/attachments/20120117/b782c47e/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: msg_parse_fix.patch
Type: text/x-patch
Size: 600 bytes
Desc: not available
URL: <http://lists.opensips.org/pipermail/users/attachments/20120117/b782c47e/attachment.bin>