[OpenSIPS-Users] Help trace source of error: unknown URI param list excedeed

[Ovidiu Sas]

Nobody suggested to investigate this via error_route.
The suggestion was to increase the opensips logging verbosity.
Once you do that, you should be able to catch the bad URI.

Regards,
Ovidiu Sas

On Wed, Feb 20, 2013 at 5:12 AM, Adam Raszynski <netcentrica at gmail.com> wrote:
> As suggested I enabled error logging via error_route to put in log full SIP
> message bodies
>
> Unfortunetly it doesn't seem to work with this type of error:
> ERROR:core:parse_uri: unknown URI param list excedeed
>
> For other parse errors I see message dumps, but not for this
>
> So for some reason I'm unable to catch this errors using error_route
>
> Any hints?
>
>
> 2013/2/15 Bogdan-Andrei Iancu <bogdan at opensips.org>
>>
>> Hi Ovidiu,
>>
>> Indeed, investigating a bit around would make sense :)
>>
>> Let;s see if Adam has some info for us.
>>
>>
>> Regards,
>>
>> Bogdan-Andrei Iancu
>> OpenSIPS Founder and Developer
>> http://www.opensips-solutions.com
>>
>>
>> On 02/14/2013 04:24 PM, Ovidiu Sas wrote:
>>>
>>> Hello Bogdan,
>>>
>>> Bumping the default value from 5 to 10 shouldn't be a problem,
>>> although I've never seen URIs with more than 5 unknown params.  Before
>>> bumping the default value, we should investigate to see if those
>>> unknown params are really 'unknown'.  Maybe some of those params
>>> aren't really unknown and should be parsed.
>>>
>>> @Adam
>>> Did you had a chance to enable debug logs and collect such a URI?
>>> All you need is to do is to enable the debug logs for a short period
>>> of time and check syslogs.
>>>
>>> -ovidiu
>>>
>>> On Thu, Feb 14, 2013 at 3:33 AM, Bogdan-Andrei Iancu
>>> <bogdan at opensips.org>  wrote:
>>>>
>>>> Hi Ovidiu,
>>>>
>>>> It might be wiser to have a default value of 10 to avoid such issues in
>>>> the
>>>> future. What do you think ?
>>>>
>>>> Regards,
>>>>
>>>> Bogdan-Andrei Iancu
>>>> OpenSIPS Founder and Developer
>>>> http://www.opensips-solutions.com
>>>>
>>>>
>>>>
>>>> On 02/14/2013 01:08 AM, Ovidiu Sas wrote:
>>>>>
>>>>> It seems that you are having more then 5 unknown URI params.
>>>>> One thing that you can do is to recompile with an increased number of
>>>>> URI_MAX_U_PARAMS.
>>>>> See parser/msg_parser.h and increase the URI_MAX_U_PARAMS from 5 to 10.
>>>>> #define URI_MAX_U_PARAMS 10
>>>>>
>>>>> If you enable debug logs, you should be able to see the URI that is
>>>>> causing issues.
>>>>> you can temporarily increase the debug log and the restore it via fifo:
>>>>> opensipsctl fifo debug 9
>>>>> opensipsctl fifo debug 3
>>>>>
>>>>> Regards,
>>>>> Ovidiu Sas
>>>>>
>>>>> On Wed, Feb 13, 2013 at 5:05 PM, Adam Raszynski<netcentrica at gmail.com>
>>>>> wrote:
>>>>>>
>>>>>> Hi
>>>>>>
>>>>>> Recently I have discovered increasing amount of the following errors
>>>>>> in
>>>>>> my
>>>>>> logs:
>>>>>>
>>>>>> Feb 13 09:36:59 node1 /usr/sbin/opensips[10458]: ERROR:core:parse_uri:
>>>>>> unknown URI param list exceeded
>>>>>>
>>>>>> I see this error is repeated many thousands of times in my log
>>>>>>
>>>>>> Questions:
>>>>>> - What does this error mean?
>>>>>> - How to add source IP address of SIP request that caused error to
>>>>>> log?
>>>>>> Or
>>>>>> how to add full SIP request body causing that error to log?
>>>>>> - Is it a sign of any type of DOS attack?