Hi Ronald,

Thanks for the useful information - find attached a patch that should fix the problem - please apply it, recompile and let me know if works ok - if yes, I will update on SVN.

The crash seams to be triggered by a bogus SIP message where the parsing of the first line fails - and this message hits the pike route crashing in some parsing functions.

Regards,
Bogdan

On 01/16/2012 06:08 AM, Ronald Cepres wrote:
Hi Bogdan,

Thanks for your reply.

The crash happened often (every less than hour) on live traffic, but I was not able to reproduce the bug on my own.
Here's the last part of OpenSIPS logs that I saved after the crash:

Jan 13 09:31:39 ASTPROD-03 kernel: [25303999.864022] opensips[12133]: segfault at 0 ip 080f639c sp bfffc620 error 4 in opensips[8048000+139000] Jan 13 09:31:39 ASTPROD-03 /sbin/opensips[12133]: INFO:core:parse_first_line: method not followed by SP Jan 13 09:31:39 ASTPROD-03 /sbin/opensips[12133]: INFO:core:parse_first_line: bad message Jan 13 09:31:39 ASTPROD-03 /sbin/opensips[12133]: ERROR:core:parse_msg: message=<-15#015#012REGISTER sip:server.example.com <http://server.example.com>;transport=tcp SIP/2.0#015#012Via: SIP/2.0/TCP client.example.com:13851;rport;branch=z9hG4bKPj-HwYov6D5txKI6aVe5WxpubPXFTKtkHM#015#012Max-Forwards: 70#015#012From: <sip:[email protected] <mailto:sip%[email protected]>>;tag=e3o0uokXbnsOsn0HWFiw2Pn5D2TuAcmB#015#012To: <sip:[email protected] <mailto:sip%[email protected]>>#015#012Call-ID: m2n.UnXe-HLK-XaiL0m6sWnOF1lQ71O.#015#012CSeq: 26361 REGISTER#015#012User-Agent: 12Connect Lite SIP v3.0#015#012Contact: <sip:[email protected]:13851;transport=tcp;ob>#015#012Expires: 300#015#012Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS#015#012Content-Length: 0#015#012#015#012> Jan 13 09:31:39 ASTPROD-03 /sbin/opensips[12133]: ERROR:core:receive_msg: parse_msg failed Jan 13 09:31:40 ASTPROD-03 /sbin/opensips[12145]: CRITICAL:core:receive_fd: EOF on 38 Jan 13 09:31:40 ASTPROD-03 /sbin/opensips[12106]: INFO:core:handle_sigs: child process 12133 exited by a signal 11 Jan 13 09:31:40 ASTPROD-03 /sbin/opensips[12106]: INFO:core:handle_sigs: core was generated Jan 13 09:31:40 ASTPROD-03 /sbin/opensips[12106]: INFO:core:handle_sigs: terminating due to SIGCHLD

On Sun, Jan 15, 2012 at 8:45 PM, Bogdan-Andrei Iancu <[email protected] <mailto:[email protected]>> wrote:

    Hi Ronald,

    The crash happens on a reply and not a request - see the frame 14,
    where "buf" (the buffer containing the
    sip message) shows a reply like text.

    But the is_method() should not crash at all....before diving into
    debugging:
        1) can you reproduce this crash ?
        2) before the crash, do you see any errors in the logs

    Regards,
    Bogdan


    On 01/13/2012 01:16 PM, Ronald Cepres wrote:
    Hi all,

    I'm using OpenSIPS 1.7.1 and based from the attached back trace,
    it crashed when it is trying to parse the method of a REGISTER
    message received by the server, triggered by pike route.

    Here is a snippet of my opensips.cfg:
    ...
    loadmodule "pike.so"
    modparam("pike", "sampling_time_unit", 30)
    modparam("pike", "reqs_density_per_unit", 75)
    modparam("pike", "check_route", "pike")
    ...
    route[pike] {
            if (($si == $Ri) || ($si == "192.168.1.60") || ($si == "
    192.168.1.61") || ($si == " 192.168.1.65")) {
                            drop;
            }
            if (!is_method("REGISTER")) {
                    drop;
            }
    }
    ...

    Basically, I just want to check REGISTER messages only on the
    pike route. Does anyone have a workaround on this?

    FWIW, should I also post this on the dev list?

    Thanks!

    Regards,
    Ronald


    _______________________________________________
    Users mailing list
    [email protected]  <mailto:[email protected]>
    http://lists.opensips.org/cgi-bin/mailman/listinfo/users


-- Bogdan-Andrei Iancu
    OpenSIPS Founder and Developer
    OpenSIPS solutions and "know-how"




--
Bogdan-Andrei Iancu
OpenSIPS Founder and Developer
OpenSIPS solutions and "know-how"

Index: parser/msg_parser.c
===================================================================
--- parser/msg_parser.c	(revision 8666)
+++ parser/msg_parser.c	(working copy)
@@ -563,6 +563,10 @@
 	switch(fl->type){
 		case SIP_INVALID:
 			LM_DBG("invalid message\n");
+			/* if failed to parse the first line, we simply consider that the whole 
+			   buffer was parsed, so that nothing is left to be parsed :) - this will
+			   do the trick and make "msg" struct acceptable for following parsing attempts */
+			msg->unparsed = msg->buf + msg->len;
 			goto error;
 			break;
 		case SIP_REQUEST:
_______________________________________________
Users mailing list
[email protected]
http://lists.opensips.org/cgi-bin/mailman/listinfo/users

Reply via email to