Re: [SR-Users] Core crash in del_lump() "offset exceeds message size" when using subst() inside tm:local-request route.

[Cody Herzog]

My pleasure. Thanks very much.

From: Daniel-Constantin Mierla [mailto:mico...@gmail.com]
Sent: Tuesday, August 8, 2017 1:17 AM
To: Cody Herzog ; Kamailio (SER) - Users Mailing 
List 
Subject: Re: [SR-Users] Core crash in del_lump() "offset exceeds message size" 
when using subst() inside tm:local-request route.


I pushed a patch to add 0 at the end of tm uac buffer -- somehow memory was 
allocated to accommodate it but not set.

Thanks for troubleshooting this in detail ...

Cheers,
Daniel

On 07.08.17 22:13, Cody Herzog wrote:
Yes. The crash was happening when using subst() or subst_body() inside of 
event_route[tm:local-request].

From: Daniel-Constantin Mierla [mailto:mico...@gmail.com]
Sent: Monday, August 7, 2017 12:55 PM
To: Cody Herzog ; 
Kamailio (SER) - Users Mailing List 

Subject: Re: [SR-Users] Core crash in del_lump() "offset exceeds message size" 
when using subst() inside tm:local-request route.


Were you using the subst() in event_route[...]?

Cheers,
Daniel

On 07.08.17 19:47, Cody Herzog wrote:
Thanks for the response.

I will make a pull request soon.

>are you using msg_apply_changes()?

No. I tried to use it, but it does not seem to be allowed in the 
tm:local-request route.

>do you receive traffic over tcp/tls?

Yes. We are using TLS.

Thanks.
-Cody

From: Daniel-Constantin Mierla [mailto:mico...@gmail.com]
Sent: Monday, August 7, 2017 12:15 AM
To: Cody Herzog ; 
Kamailio (SER) - Users Mailing List 

Subject: Re: [SR-Users] Core crash in del_lump() "offset exceeds message size" 
when using subst() inside tm:local-request route.


Hello,

can you make a pull request with the patch you did to terminate the buffer with 
'\0'? It is a valid fix if there are situations when the buffer is not 
zero-terminated.

To figure out when it is not zero-terminated, if you don't know already, in 
order to analyze if it has impact on other part of code, few questions:

  - are you using msg_apply_changes()?

  - do you receive traffic over tcp/tls?

Cheers,
Daniel

On 31.07.17 19:43, Cody Herzog wrote:
Hello.

We are running Kamailio 4.3.5 on Ubuntu 14.04 LTS 64-bit.

Sorry, I should have included that information in my first email.

I have done more debugging, and I believe the problem is caused by the 
subst_run() function being used on a message buffer which is not null 
terminated at msg->len.

The subst_f() and subst_body_f() functions both call  subst_run(), and most of 
the time, everything seems fine. However, in our use case, the msg->buf does 
not always seem to be null terminated at msg->len.

In other words: msg->buf[msg->len] != '\0'

It seems there is sometimes some extra data in the buffer beyond msg->len, and 
subst_run() may abort() if it ever moves beyond msg->len.

I found a few places in textops.c where a buffer is being temporarily null 
terminated in order to perform a regexec () search, then restored later, as in:

body = hf->body;
c = body.s[body.len];
body.s[body.len] = '\0';
ret = regexec((regex_t*) re, body.s, 1, , 0);
body.s[body.len] = c;

I've tried making the same type of change to subst_f() and subst_body_f(), and 
now I am not seeing the crash.

If I guarantee that msg->buf[msg->len] == '\0' when subst_run() is called, then 
everything seems to be OK.

What do you think? Is that a valid change to make?

Let me know if you'd like me to make a pull request on the main branch with 
those changes.

Thanks very much.
-Cody






From: Daniel-Constantin Mierla [mailto:mico...@gmail.com]
Sent: Sunday, July 30, 2017 11:12 PM
To: Kamailio (SER) - Users Mailing List 
; Cody Herzog 

Subject: Re: [SR-Users] Core crash in del_lump() "offset exceeds message size" 
when using subst() inside tm:local-request route.


Hello,

what's the version of Kamailio and the operating system you run on?

Cheers,
Daniel

On 28.07.17 23:53, Cody Herzog wrote:
Hello.

Inside the tm:local-request route, I am trying to modify the body of outgoing 
NOTIFY messages using the subst_body() function.

Things seem to work fine most of the time. The NOTIFY messages are correctly 
modified. However, I will very rarely hit a crash.

I can force the crash to happen more quickly by stress testing with thousands 
of NOTIFY messages being modified.

Is it safe to call subst() or subst_body() inside the tm:local-request route? 
If not, is there another way I can modify the outgoing NOTIFY messages safely?

Note that I am also calling append_hf() inside the same tm:local-request route, 
but that has been working for a very long time without causing any problems. 

[SR-Users] How do I add a record to a group table ?

[leslie mekiyess]

Hi,
I am working with the last kamilio integrated with MySQL.
Is there any configuration , db cmds instructions in order to simulate a
group call ?
BR,
Leslie.
___
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

[SR-Users] kamailio + dispatcher asterisks + pstn gateways

[Aidar Kamalov]

Hello,

Whats the best way to provide subject?
Now I have central kamailio server and (asterisk "media" servers + asterisk
pstn gateway in different cities).
Kamailio default config with some changes in route[LOCATION]
if (!lookup("location")) {
$var(rc) = $rc;
route(TOVOICEMAIL);

t_newtran();
switch ($var(rc)) {
case -1:
xwarn("Contact $rU not registered.
Forwarding call to dispatcher");
append_hf("X-External: true\r\n");
$rU = "00"+$rU;
break;
case -3:
send_reply("404", "Not Found");
exit;
case -2:
send_reply("405", "Method Not Allowed");
exit;
}
}
..
# when routing via usrloc, log the missed calls also
if (is_method("INVITE")) {
setflag(FLT_ACCMISSED);
}

if(!ds_is_from_list()) {
route(DISPATCH);
}
route(RELAY);

So all calls going to asterisk server. Not local calls with 00 prefix.
And asterisk context:
context kamailio {
_X. => {
Noop(CALL to kamailio user ${EXTEN});
Dial(SIP/${EXTEN}@${SIPDOMAIN},60,RTt);
Hangup;
}

_00X. => {
Noop(CALL to external user ${EXTEN});
Dial(SIP/PSTN-SERVER/${EXTEN:2},60,RTt);
Hangup;
}
}

Is it right way? Maybe any better approach? How to keep route logic at
kamailio, but use dispatcher asterisk to proccess the calls to pstn(all
endpoints at one city to pstn asterisk at this city. In others city there
are other pstn gateways)?
-- 
Aydar A. Kamalov
___
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

[SR-Users] [ *SPAM* 3.0 ] Re: [ *SPAM* 2.2 ] Re: carrierroute and failure route

[yu]

Can you provide 100% working Kami config with correct NAT traversal and 
REINVITE please?
--
Отправлено из myMail для Android понедельник, 07 августа 2017г., 13:08 +03:00 
от Sebastian Damm  d...@sipgate.de :

>Hi,
>
>On Sat, Aug 5, 2017 at 7:00 PM, Yu Boot < y...@yu-boot.ru > wrote:
>> Gotcha! I've added fix_nated_contact() to [NATDETECT] route and now all
>> messages UNTIL reinvite occurs are with correct NATed IP in "Contact" field.
>
>while fix_nated_contact() may work in your scenario, it is generally a
>"bad variant" to use. The set_contact_alias() method is much less
>invasive. Depending on the client, it could reject reINVITEs or other
>in-call messages (like BYE) because the contact header initially sent
>differs from the request URI of the incoming message.
>
>That's why set_contact_alias() only appends the real IP of the client,
>and handle_ruri_alias() takes care that the original contact is set
>correctly.
>
>As said, if it works in your environment, everything is fine. Just be
>careful if you don't know what devices will be talking to your
>service.
>
>BR
>Sebastian
>
>___
>Kamailio (SER) - Users Mailing List
>sr-users@lists.kamailio.org
>https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
___
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

[SR-Users] Kamailio Server not relaying any message

[Rahman Afzal]

Hi,
 I have an ongoing issue with kamailio...my softclient registered with
kamilio originates a call which gets routed to another switch from kamilio
and that switch terminates the call to B party side. Now once calls is
established, B party sends BYE messages or (any re-INVITE during the
dialog) which comes to the kamailio but kamailio is not relaying it to the
A party...Can someone please help in this regard.

Regards,
Abdul Rahman
___
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

[SR-Users] how to remove a line in sdp

[Sunil More]

Hello All,

I have the following SDP coming in from a carrier and would like to remove
the following line. Cant figure how to go about it.

line to remove : *a=cdsc: 1 image udptl t38*
sdp is as below

Content-Type: application/sdp.
Content-Length: 293.
.
v=0.
o=hiQ9200 5859020170708143552 1175715965 IN IP4 X.Y.Z.A.
s=Phone Call via hiQ9200 SIPCA.
c=IN IP4 X.Y.Z.A.
t=0 0.
m=audio 16648 RTP/AVP 8 101.
a=rtpmap:8 PCMA/8000.
a=rtpmap:101 telephone-event/8000.
a=fmtp:101 0-15.
a=sqn: 0.
*a=cdsc: 1 image udptl t38.*
a=sendrecv.
a=ptime:20.

This reply comes from a upstream carrier in session progress and 200ok
causing one-way audio for me.


Thanking You,
Sunil More
Ph : 9503338275
___
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

[SR-Users] issue in Dialplan

[Logeshwaran G]

Please find the below rules I am using:

++--++--+--+---+
---+--+---+
| id | dpid | pr | match_op | match_exp| match_len | subst_exp |
repl_exp | attrs |
++--++--+--+---+
---+--+---+
|  1 |1 |  1 |1 | ^000[0-9]+$  | 0 | ^000([0-9]+)$ |
1|   |


Correct me If I am Wrong,
___
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

Re: [SR-Users] "kamctl restart" fails

[David Villasmil]

You need to configure kamctlrc properly, it probably doesn't know where the
pid file is.
On Tue, Aug 8, 2017 at 10:22 AM Yu Boot  wrote:

> # kamctl restart
>
> INFO: Stopping Kamailio :
> INFO: stopped
>
> INFO: Starting Kamailio :
>   2292 pts/0S+ 0:00 /bin/egrep kamailio
> -rw-r--r--. 1 kamailio kamailio 5 Aug  8 11:15 /var/run/kamailio.pid
> INFO: PID file exists (/var/run/kamailio.pid)! Kamailio already running?
>
>
> "service kamailio restart" works fine. What's wrong?
>
> Centos 6.9 x64, Kamailio 4.3 installed from official repo.
>
>
> ___
> Kamailio (SER) - Users Mailing List
> sr-users@lists.kamailio.org
> https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
>
___
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

[SR-Users] "kamctl restart" fails

[Yu Boot]

# kamctl restart

INFO: Stopping Kamailio :
INFO: stopped

INFO: Starting Kamailio :
 2292 pts/0S+ 0:00 /bin/egrep kamailio
-rw-r--r--. 1 kamailio kamailio 5 Aug  8 11:15 /var/run/kamailio.pid
INFO: PID file exists (/var/run/kamailio.pid)! Kamailio already running?


"service kamailio restart" works fine. What's wrong?

Centos 6.9 x64, Kamailio 4.3 installed from official repo.


___
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

Re: [SR-Users] Core crash in del_lump() "offset exceeds message size" when using subst() inside tm:local-request route.

[Daniel-Constantin Mierla]

I pushed a patch to add 0 at the end of tm uac buffer -- somehow memory
was allocated to accommodate it but not set.

Thanks for troubleshooting this in detail ...

Cheers,
Daniel


On 07.08.17 22:13, Cody Herzog wrote:
>
> Yes. The crash was happening when using subst() or subst_body() inside
> of event_route[tm:local-request].
>
>  
>
> *From:*Daniel-Constantin Mierla [mailto:mico...@gmail.com]
> *Sent:* Monday, August 7, 2017 12:55 PM
> *To:* Cody Herzog ; Kamailio (SER) - Users
> Mailing List 
> *Subject:* Re: [SR-Users] Core crash in del_lump() "offset exceeds
> message size" when using subst() inside tm:local-request route.
>
>  
>
> Were you using the subst() in event_route[...]?
>
> Cheers,
> Daniel
>
>  
>
> On 07.08.17 19:47, Cody Herzog wrote:
>
> Thanks for the response.
>
>  
>
> I will make a pull request soon.
>
>  
>
> >are you using msg_apply_changes()?
>
>  
>
> No. I tried to use it, but it does not seem to be allowed in the
> tm:local-request route.
>
>  
>
> >do you receive traffic over tcp/tls?
>
>  
>
> Yes. We are using TLS.
>
>  
>
> Thanks.
>
> -Cody
>
>  
>
> *From:*Daniel-Constantin Mierla [mailto:mico...@gmail.com]
> *Sent:* Monday, August 7, 2017 12:15 AM
> *To:* Cody Herzog 
> ; Kamailio (SER) - Users Mailing
> List 
> 
> *Subject:* Re: [SR-Users] Core crash in del_lump() "offset exceeds
> message size" when using subst() inside tm:local-request route.
>
>  
>
> Hello,
>
> can you make a pull request with the patch you did to terminate
> the buffer with '\0'? It is a valid fix if there are situations
> when the buffer is not zero-terminated.
>
> To figure out when it is not zero-terminated, if you don't know
> already, in order to analyze if it has impact on other part of
> code, few questions:
>
>   - are you using msg_apply_changes()?
>
>   - do you receive traffic over tcp/tls?
>
> Cheers,
> Daniel
>
>  
>
> On 31.07.17 19:43, Cody Herzog wrote:
>
> Hello.
>
>  
>
> We are running Kamailio 4.3.5 on Ubuntu 14.04 LTS 64-bit.
>
>  
>
> Sorry, I should have included that information in my first email.
>
>  
>
> I have done more debugging, and I believe the problem is
> caused by the subst_run() function being used on a message
> buffer which is not null terminated at msg->len.
>
>  
>
> The subst_f() and subst_body_f() functions both call
>  subst_run(), and most of the time, everything seems fine.
> However, in our use case, the msg->buf does not always seem to
> be null terminated at msg->len.
>
>  
>
> In other words: msg->buf[msg->len] != '\0'
>
>  
>
> It seems there is sometimes some extra data in the buffer
> beyond msg->len, and subst_run() may abort() if it ever moves
> beyond msg->len.
>
>  
>
> I found a few places in textops.c where a buffer is being
> temporarily null terminated in order to perform a regexec ()
> search, then restored later, as in:
>
>  
>
> body = hf->body;
>
> c = body.s[body.len];
>
> body.s[body.len] = '\0';
>
> ret = regexec((regex_t*) re, body.s, 1, , 0);
>
> body.s[body.len] = c;
>
>  
>
> I've tried making the same type of change to subst_f() and
> subst_body_f(), and now I am not seeing the crash.
>
>  
>
> If I guarantee that msg->buf[msg->len] == '\0' when
> subst_run() is called, then everything seems to be OK.
>
>  
>
> What do you think? Is that a valid change to make?
>
>  
>
> Let me know if you'd like me to make a pull request on the
> main branch with those changes.
>
>  
>
> Thanks very much.
>
> -Cody
>
>  
>
>  
>
>  
>
>  
>
>  
>
>  
>
> *From:*Daniel-Constantin Mierla [mailto:mico...@gmail.com]
> *Sent:* Sunday, July 30, 2017 11:12 PM
> *To:* Kamailio (SER) - Users Mailing List
> 
> ; Cody Herzog
>  
> *Subject:* Re: [SR-Users] Core crash in del_lump() "offset
> exceeds message size" when using subst() inside
> tm:local-request route.
>
>  
>
> Hello,
>
> what's the version of Kamailio and the operating system you
> run on?
>
> Cheers,
> Daniel
>
>  
>
> On 28.07.17 23:53, Cody Herzog wrote:
>
> Hello.
>
>