<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#ffffff" text="#000000">
    <tt>Hi Adam,<br>
      <br>
      It does not jump into error_route as currently this capture only
      "sip parsing" errors, and it your case it is not a parsing error,
      but rather an internal error.<br>
      <br>
      So,<br>
      1) were you able to get the actual URI so see all the params ?<br>
      2) managed to extend the size of the array of unknown params as
      Ovidiu suggested ?<br>
      <br>
      Regards,<br>
    </tt>
    <pre class="moz-signature" cols="72">Bogdan-Andrei Iancu
OpenSIPS Founder and Developer
<a class="moz-txt-link-freetext" href="http://www.opensips-solutions.com">http://www.opensips-solutions.com</a></pre>
    <br>
    On 02/20/2013 12:12 PM, Adam Raszynski wrote:
    <blockquote
cite="mid:CAJWEF2aupubrfc1=ALxz64ary-hhSnQ5cjcECaoHHbjCcWF6yg@mail.gmail.com"
      type="cite">
      <div>As suggested I enabled error logging via error_route to put
        in log full SIP message bodies</div>
      <div><br>
      </div>
      Unfortunetly it doesn't seem to work with this type of error:
      <div>ERROR:core:parse_uri: unknown URI param list excedeed</div>
      <div><br>
      </div>
      <div>For other parse errors I see message dumps, but not for this</div>
      <div><br>
      </div>
      <div>So for some reason I'm unable to catch this errors using
        error_route</div>
      <div><br>
      </div>
      <div>Any hints?</div>
      <div>
        <div><br>
          <br>
          <div class="gmail_quote">2013/2/15 Bogdan-Andrei Iancu <span
              dir="ltr">&lt;<a moz-do-not-send="true"
                href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>&gt;</span><br>
            <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt
              0.8ex; border-left: 1px solid rgb(204, 204, 204);
              padding-left: 1ex;">
              Hi Ovidiu,<br>
              <br>
              Indeed, investigating a bit around would make sense :)<br>
              <br>
              Let;s see if Adam has some info for us.
              <div class="im HOEnZb"><br>
                <br>
                Regards,<br>
                <br>
                Bogdan-Andrei Iancu<br>
                OpenSIPS Founder and Developer<br>
                <a moz-do-not-send="true"
                  href="http://www.opensips-solutions.com"
                  target="_blank">http://www.opensips-solutions.com</a><br>
                <br>
                <br>
              </div>
              <div class="HOEnZb">
                <div class="h5">
                  On 02/14/2013 04:24 PM, Ovidiu Sas wrote:<br>
                  <blockquote class="gmail_quote" style="margin: 0pt 0pt
                    0pt 0.8ex; border-left: 1px solid rgb(204, 204,
                    204); padding-left: 1ex;">
                    Hello Bogdan,<br>
                    <br>
                    Bumping the default value from 5 to 10 shouldn't be
                    a problem,<br>
                    although I've never seen URIs with more than 5
                    unknown params. &nbsp;Before<br>
                    bumping the default value, we should investigate to
                    see if those<br>
                    unknown params are really 'unknown'. &nbsp;Maybe some of
                    those params<br>
                    aren't really unknown and should be parsed.<br>
                    <br>
                    @Adam<br>
                    Did you had a chance to enable debug logs and
                    collect such a URI?<br>
                    All you need is to do is to enable the debug logs
                    for a short period<br>
                    of time and check syslogs.<br>
                    <br>
                    -ovidiu<br>
                    <br>
                    On Thu, Feb 14, 2013 at 3:33 AM, Bogdan-Andrei Iancu<br>
                    &lt;<a moz-do-not-send="true"
                      href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>&gt;
                    &nbsp;wrote:<br>
                    <blockquote class="gmail_quote" style="margin: 0pt
                      0pt 0pt 0.8ex; border-left: 1px solid rgb(204,
                      204, 204); padding-left: 1ex;">
                      Hi Ovidiu,<br>
                      <br>
                      It might be wiser to have a default value of 10 to
                      avoid such issues in the<br>
                      future. What do you think ?<br>
                      <br>
                      Regards,<br>
                      <br>
                      Bogdan-Andrei Iancu<br>
                      OpenSIPS Founder and Developer<br>
                      <a moz-do-not-send="true"
                        href="http://www.opensips-solutions.com"
                        target="_blank">http://www.opensips-solutions.com</a><br>
                      <br>
                      <br>
                      <br>
                      On 02/14/2013 01:08 AM, Ovidiu Sas wrote:<br>
                      <blockquote class="gmail_quote" style="margin: 0pt
                        0pt 0pt 0.8ex; border-left: 1px solid rgb(204,
                        204, 204); padding-left: 1ex;">
                        It seems that you are having more then 5 unknown
                        URI params.<br>
                        One thing that you can do is to recompile with
                        an increased number of<br>
                        URI_MAX_U_PARAMS.<br>
                        See parser/msg_parser.h and increase the
                        URI_MAX_U_PARAMS from 5 to 10.<br>
                        #define URI_MAX_U_PARAMS 10<br>
                        <br>
                        If you enable debug logs, you should be able to
                        see the URI that is<br>
                        causing issues.<br>
                        you can temporarily increase the debug log and
                        the restore it via fifo:<br>
                        opensipsctl fifo debug 9<br>
                        opensipsctl fifo debug 3<br>
                        <br>
                        Regards,<br>
                        Ovidiu Sas<br>
                        <br>
                        On Wed, Feb 13, 2013 at 5:05 PM, Adam
                        Raszynski&lt;<a moz-do-not-send="true"
                          href="mailto:netcentrica@gmail.com"
                          target="_blank">netcentrica@gmail.com</a>&gt;<br>
                        wrote:<br>
                        <blockquote class="gmail_quote" style="margin:
                          0pt 0pt 0pt 0.8ex; border-left: 1px solid
                          rgb(204, 204, 204); padding-left: 1ex;">
                          Hi<br>
                          <br>
                          Recently I have discovered increasing amount
                          of the following errors in<br>
                          my<br>
                          logs:<br>
                          <br>
                          Feb 13 09:36:59 node1
                          /usr/sbin/opensips[10458]:
                          ERROR:core:parse_uri:<br>
                          unknown URI param list exceeded<br>
                          <br>
                          I see this error is repeated many thousands of
                          times in my log<br>
                          <br>
                          Questions:<br>
                          - What does this error mean?<br>
                          - How to add source IP address of SIP request
                          that caused error to log?<br>
                          Or<br>
                          how to add full SIP request body causing that
                          error to log?<br>
                          - Is it a sign of any type of DOS attack?<br>
                        </blockquote>
                      </blockquote>
                    </blockquote>
                  </blockquote>
                </div>
              </div>
            </blockquote>
          </div>
          <br>
        </div>
      </div>
      <pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a>
<a class="moz-txt-link-freetext" href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a>
</pre>
    </blockquote>
  </body>
</html>