[asterisk-dev] Asterisk Crash on Realtime + extension dialed '<exten>@<unknown context>' + rtcachefriends

[Laurent Tostain]

My asterisk boxe works on Fedora core 2 distrib.

kernel : 2.6.5-1.358smp i686 and 2.6.5-1.358 i686

My configuration of asterisk is :

Asterisk 1.2.4 or 1.2.1
asterisk-addons 1.2.1 (for RealTime)

I use realtime machine for iax users.

My iax.conf contains :

rtcachefriends=yes

When an iax user tries to dial something like that :

<extension>@<unknown context> (where "unknown context" is a context totaly
unknown for Asterisk),
a crash append on asterisk.

Before the first try, cached iax users list is something like that from the
Asterisk CLI :

leatry*CLI> iax2 show users
Username         Secret                Authen           Def.Context      A/C
Codec Pref
tester           *****                000000000000003  outgoing         No
Host 
27i6336g         *****             000000000000003  incoming         No
Host 
leatry*CLI>

If the iax user dials a normal extension, so the user is cached. Then the
cached list becomes :

leatry*CLI> iax2 show users
Username         Secret                Authen           Def.Context      A/C
Codec Pref
lorenzo          *****                000000000000002  default          No
Host 
tester           *****                000000000000003  outgoing         No
Host 
27i6336g         *****                000000000000003  incoming         No
Host 
leatry*CLI> 

After the first bad dial :

Feb 14 20:45:04 NOTICE[32713]: chan_iax2.c:6782 socket_read: Rejected
connect attempt from 192.168.0.144, who was trying to reach
'0674586600 at intern'
leatry*CLI> iax2 show users
Username         Secret                Authen           Def.Context      A/C
Codec Pref

?              *****               000000000000002  ???       ?          No
Host 
tester          *****                000000000000003  outgoing         No
Host 
27i6336g        *****                000000000000003  incoming         No
Host 
leatry*CLI>

We can see that lorenzo user's line has some problem to be screened.
(something should be wrong at this point).

So, if the iax user persists to dial the bad extension, an asterisk crash
appends.

This fault appends only if rtcachefriends is set to yes and if realtime is
used.
The problem is : if the context set in dialed extension is unknown from the
iax user's configuration, the user is deleted from the cache.
Then if several tries are made from iax user, asterisk tries to access to a
deleted memory segment, then crash appends (memory violation) :S

So, I worked on a patch, which works for me and fix the problem :

Test if IAX_TEMPONLY flags is set on the user, if yes, then we can delete
user from cache else we do nothing.


--- chan_iax2.c 2006-02-14 20:00:47.096666552 +0100
+++ chan_iax2.c 2006-02-14 20:01:08.380430928 +0100
@@ -4802,7 +4802,9 @@
                user = realtime_user(iaxs[callno]->username);
                if (user && !ast_strlen_zero(iaxs[callno]->context) &&
/* No context specified */
                             !apply_context(user->contexts,
iaxs[callno]->context)) {                   /* Context is permitted */
-                       destroy_user(user);
+                       if(ast_test_flag(user, IAX_TEMPONLY)) {
+                               destroy_user(user);
+                       }
                        user = NULL;
                }
        }

Patch works for Asterisk 1.2.4 and 1.2.1

Somone can check me and confirm me that problem appends on others OS ?

Regards.

__________________________
Laurent TOSTAIN

Plug&Tel
11 rue René Laënnec
78390 Bois D'Arcy
France

Tel. Direct : +331 7289 7101
Tel. Mobile : +336 7458 6600
Fax : +331 7080 1064