- config file: don't complain on line s with only whitespaces

- fix: Via branch calculation
- security.c: increased max acceptable line length
- security.c: prevent libosip2 to die with "out of memory"
  on some malformed headers

ChangeLog

@@ -1,5 +1,10 @@
 0.5.5
 =====
+   5-Apr-2004:  - config file: don't complain on line s with only whitespaces
+                - fix: Via branch calculation
+                - security.c: increased max acceptable line length
+                - security.c: prevent libosip2 to die with "out of memory"
+                  on some malformed headers
    4-Apr-2004:  - Realtime Scheduling for RTP proxy
    3-Apr-2004:  - fix: SDP 'c=' items in media part
    2-Apr-2004:  - PID file

config.h.in

@@ -72,12 +72,6 @@
 /* Define to 1 if you have the `osipparser2' library (-losipparser2). */
 #undef HAVE_LIBOSIPPARSER2
 
-/* Define to 1 if you have the <linux/ip_masq.h> header file. */
-#undef HAVE_LINUX_IP_MASQ_H
-
-/* Define to 1 if you have the <linux/netfilter.h> header file. */
-#undef HAVE_LINUX_NETFILTER_H
-
 /* Define to 1 if you have the <memory.h> header file. */
 #undef HAVE_MEMORY_H
 

configure.in

@@ -120,8 +120,6 @@ case "$target" in
   *-*-linux*)
     AC_MSG_RESULT(Linux)
     AC_DEFINE(_LINUX,,[building on Linux platform])
-    AC_CHECK_HEADERS(linux/ip_masq.h)
-    AC_CHECK_HEADERS(linux/netfilter.h)
     ;;
   *-*-freebsd*)
     AC_MSG_RESULT(FreeBSD)

src/readconf.c

@@ -181,12 +181,12 @@ static int parse_config (FILE *configfile) {
       /* strip newline if present */
       if (buff[strlen(buff)-1]=='\n') buff[strlen(buff)-1]='\0';
 
-      /* strip emty lines */
+      /* strip emtpy lines */
       if (strlen(buff) == 0) continue;
 
       /* strip comments and line with only whitespaces */
       for (i=0;i<strlen(buff);i++) {
-         if ((buff[i] == ' ') && (buff[i] == '\t')) continue;
+         if ((buff[i] == ' ') || (buff[i] == '\t')) continue;
          if (buff[i] =='#') i=strlen(buff);
          break;
       }

src/rtpproxy_relay.c

@@ -115,6 +115,7 @@ int rtp_relay_init( void ) {
 
       uid=getuid();
       euid=geteuid();
+      DEBUGC(DBCLASS_RTP,"uid=%i, euid=%i", uid, euid);
       if (uid != euid) seteuid(0);
 
       if (geteuid()==0) {
@@ -130,7 +131,8 @@ int rtp_relay_init( void ) {
             ERROR("pthread_setschedparam failed: %s", strerror(errno));
          }
       } else {
-         WARN("Cannot set realtime scheduling for RTP (start siproxd as root)");
+         INFO("Unable to use realtime scheduling for RTP proxy");
+         INFO("You may want to start siproxd as root and switch UID afterwards");
       }
       if (uid != euid)  seteuid(euid);
    }

src/security.c

@@ -70,7 +70,35 @@ int security_check_raw(char *sip_buffer, int size) {
          return STS_FAILURE;
       }
    }
-      
+
+
+   /* As libosip2 is *VERY* sensitive to corrupt imput data, we need to
+      do more stuff here. For example, libosip2 can be crashed (with a
+      "<port_malloc.c> virtual memory exhausted" error - God knows why)
+      by sending the following few bytes. It will die in osip_message_parse()
+      ---BUFFER DUMP follows---
+        6e 74 2f 38 30 30 30 0d 0a 61 3d 66 6d 74 70 3a nt/8000..a=fmtp:
+        31 30 31 20 30 2d 31 35 0d 0a                   101 0-15..      
+      ---end of BUFFER DUMP---
+
+      By looking at the code in osip_message_parse.c, I'd guess it is
+      the 'only one space present' that leads to a faulty size
+      calculation (VERY BIG NUMBER), which in turn then dies inside 
+      osip_malloc.
+      So, we need at least 2 spaces to survive that coda part of libosip2.
+    */
+   p1 = strchr(sip_buffer, ' ');
+   if (p1 && ((p1+1) < (sip_buffer+size))) {
+      p2 = strchr(p1+1, ' ');
+   } else {
+         DEBUGC(DBCLASS_SIP,"security_check_raw: found no space");
+         return STS_FAILURE;
+   }
+   if (p2==NULL) {
+         DEBUGC(DBCLASS_SIP,"security_check_raw: found only one space");
+         return STS_FAILURE;
+   }
+    
 
    /* TODO: still way to go here ... */
    return STS_SUCCESS;

src/sip_utils.c

@@ -773,8 +773,9 @@ int  sip_calculate_branch_id (osip_message_t *sip_msg, char *id) {
    param=NULL;
    osip_via_param_get_byname(via, "branch", &param);
    if (param && param->gvalue) {
+      DEBUGC(DBCLASS_BABBLE, "looking for magic cookie [%s]",param->gvalue);
       if (strncmp(param->gvalue, magic_cookie,
-                  strlen(magic_cookie))) {
+                  strlen(magic_cookie))==0) {
          /* calculate MD5 hash */
          MD5_CTX Md5Ctx;
          HASH HA1;

src/siproxd.h

@@ -186,8 +186,10 @@ struct siproxd_config {
 
 /* constants for security testing */
 #define SEC_MINLEN	16	/* minimum received length */
-#define SEC_MAXLINELEN	256	/* maximum acceptable length of one line
-				   in the SIP telegram (security check) */
+#define SEC_MAXLINELEN	1024	/* maximum acceptable length of one line
+				   in the SIP telegram (security check)
+                                   Careful: Proxy-Authorization lines may
+                                   get quite long */
 
 /* symbols for access control */
 #define ACCESSCTL_SIP	1	/* for access control - SIP allowed	*/

tools/extract_sip.pl

@@ -21,6 +21,6 @@ while (<>) {
 
    for (my $i=0; $i<16; $i++) {
       # write HEX byte as character
-      print chr(hex($hex[$i]));
+      if (hex($hex[$i]) != "") {print chr(hex($hex[$i]));}
    }
 }