[OpenSIPS-Users] Help trace source of error: unknown URI param list excedeed

[Adam Raszynski]

As suggested I enabled error logging via error_route to put in log full SIP
message bodies

Unfortunetly it doesn't seem to work with this type of error:
ERROR:core:parse_uri: unknown URI param list excedeed

For other parse errors I see message dumps, but not for this

So for some reason I'm unable to catch this errors using error_route

Any hints?


2013/2/15 Bogdan-Andrei Iancu <bogdan at opensips.org>

> Hi Ovidiu,
>
> Indeed, investigating a bit around would make sense :)
>
> Let;s see if Adam has some info for us.
>
>
> Regards,
>
> Bogdan-Andrei Iancu
> OpenSIPS Founder and Developer
> http://www.opensips-solutions.**com <http://www.opensips-solutions.com>
>
>
> On 02/14/2013 04:24 PM, Ovidiu Sas wrote:
>
>> Hello Bogdan,
>>
>> Bumping the default value from 5 to 10 shouldn't be a problem,
>> although I've never seen URIs with more than 5 unknown params.  Before
>> bumping the default value, we should investigate to see if those
>> unknown params are really 'unknown'.  Maybe some of those params
>> aren't really unknown and should be parsed.
>>
>> @Adam
>> Did you had a chance to enable debug logs and collect such a URI?
>> All you need is to do is to enable the debug logs for a short period
>> of time and check syslogs.
>>
>> -ovidiu
>>
>> On Thu, Feb 14, 2013 at 3:33 AM, Bogdan-Andrei Iancu
>> <bogdan at opensips.org>  wrote:
>>
>>> Hi Ovidiu,
>>>
>>> It might be wiser to have a default value of 10 to avoid such issues in
>>> the
>>> future. What do you think ?
>>>
>>> Regards,
>>>
>>> Bogdan-Andrei Iancu
>>> OpenSIPS Founder and Developer
>>> http://www.opensips-solutions.**com <http://www.opensips-solutions.com>
>>>
>>>
>>>
>>> On 02/14/2013 01:08 AM, Ovidiu Sas wrote:
>>>
>>>> It seems that you are having more then 5 unknown URI params.
>>>> One thing that you can do is to recompile with an increased number of
>>>> URI_MAX_U_PARAMS.
>>>> See parser/msg_parser.h and increase the URI_MAX_U_PARAMS from 5 to 10.
>>>> #define URI_MAX_U_PARAMS 10
>>>>
>>>> If you enable debug logs, you should be able to see the URI that is
>>>> causing issues.
>>>> you can temporarily increase the debug log and the restore it via fifo:
>>>> opensipsctl fifo debug 9
>>>> opensipsctl fifo debug 3
>>>>
>>>> Regards,
>>>> Ovidiu Sas
>>>>
>>>> On Wed, Feb 13, 2013 at 5:05 PM, Adam Raszynski<netcentrica at gmail.**com<netcentrica at gmail.com>
>>>> >
>>>> wrote:
>>>>
>>>>> Hi
>>>>>
>>>>> Recently I have discovered increasing amount of the following errors in
>>>>> my
>>>>> logs:
>>>>>
>>>>> Feb 13 09:36:59 node1 /usr/sbin/opensips[10458]: ERROR:core:parse_uri:
>>>>> unknown URI param list exceeded
>>>>>
>>>>> I see this error is repeated many thousands of times in my log
>>>>>
>>>>> Questions:
>>>>> - What does this error mean?
>>>>> - How to add source IP address of SIP request that caused error to log?
>>>>> Or
>>>>> how to add full SIP request body causing that error to log?
>>>>> - Is it a sign of any type of DOS attack?
>>>>>
>>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/users/attachments/20130220/2ba5ec91/attachment.htm>