[CRASH] b2b_init_request crash server after notify_on_event

[igoryeroshev]

OpenSIPS version you are running
version: opensips 3.3.5 (x86_64/linux)
flags: STATS: On, DISABLE_NAGLE, USE_MCAST, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, HP_MALLOC, DBG_MALLOC, FAST_LOCK-ADAPTIVE_WAIT
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535
poll method support: poll, epoll, sigio_rt, select.
main.c compiled on 01:07:59 Apr 20 2023 with gcc 8

Crash Core Dump
https://storage.yandexcloud.net/opensips/core.opensips.987.c0b6e25c82a74300baf5e1d8369b9a8f.3317363.1684915611000000

Describe the traffic that generated the bug
I make call from autodialer to application on mobile device which must register on opensips instance.
When opensips recieve INVITE we send push notification on the user app and subscribe for user registration notification with notify_on_event function to continue call after user has registered.
When mobile user register and answer the call then autodiler send REFER request for transfer called user to another destination.
For handle REFER I use b2b_logic module.
b2b_client_new and b2b_init_request executed in route that specified in notify_on_event.

To Reproduce
My config example
if (isflagset("FLAG_DIALER_SOURCE")) {
remove_hf("Require");
create_dialog();
set_dlg_profile("dialer");
b2b_server_new("caller");
t_newtran();
t_wait_for_new_branches();
$avp(filter) = "aor="+$rU;
notify_on_event("E_UL_CONTACT_INSERT",$avp(filter),"fork_call_dialer", 20);
if (lookup("location")) {
route(RELAY);
}
exit;
}

route[fork_call_dialer] {

xlog("b2b_server_new\n");
#b2b_server_new("caller");
xlog("user $avp(aor) registered a new contact $avp(uri) for dialer call, injecting\n");
b2b_client_new("callee", $avp(uri));
xlog("!!!!!!!!!! b2b_init_request\n");
b2b_init_request("refer");
exit;

}

Relevant System Logs
May 24 14:06:51 /usr/sbin/opensips[3317363]: b2b_server_new
May 24 14:06:51 /usr/sbin/opensips[3317363]: user username registered a new contact sip:username@...:45550;transport=udp for dialer call, injecting
May 24 14:06:51 /usr/sbin/opensips[3317363]: !!!!!!!!!! b2b_init_request
May 24 14:06:51 /usr/sbin/opensips[3317363]: CRITICAL:core:sig_usr: segfault in process pid: 3317363, id: 7
May 24 14:06:51 kernel: opensips[3317363]: segfault at c8 ip 00007f9cac2e9cb8 sp 00007ffc22cd4f40 error 4 in b2b_logic.so[7f9cac2d3000+52000]
May 24 14:06:51 systemd-coredump[3318509]: Process 3317363 (opensips) of user 987 dumped core.#12#012Stack trace of thread 3317363:#12#0 0x00007f9cac2e9cb8 b2bl_insert_new (b2b_logic.so)#12#1 0x00007f9cac30a912 b2b_process_scenario_init (b2b_logic.so)#12#2 0x00007f9cac30c2a2 init_request (b2b_logic.so)#12#3 0x00007f9cac30d1d5 b2b_init_request (b2b_logic.so)#12#4 0x000055907e066462 do_action (opensips)#12#5 0x000055907e069890 run_action_list (opensips)#12#6 0x000055907e069bfd run_top_route (opensips)#12#7 0x00007f9cabe87794 handle_ebr_ipc (event_routing.so)#12#8 0x000055907e0885fd ipc_handle_job (opensips)#12#9 0x000055907e1c5359 io_wait_loop_epoll.constprop.5 (opensips)#12#10 0x000055907e1ca973 udp_start_processes (opensips)#12#11 0x000055907e0366db main (opensips)#12#12 0x00007f9cb6efad85 __libc_start_main (libc.so.6)#12#13 0x000055907e03724e _start (opensips)
May 24 14:06:51 /usr/sbin/opensips[3317356]: INFO:core:handle_sigs: child process 3317363 exited by a signal 11
May 24 14:06:51 /usr/sbin/opensips[3317356]: INFO:core:handle_sigs: core was generated
May 24 14:06:51 /usr/sbin/opensips[3317356]: INFO:core:handle_sigs: terminating due to SIGCHLD
May 24 14:06:51 /usr/sbin/opensips[3317359]: INFO:core:sig_usr: signal 15 received

OS/environment information

• Operating System: Linux 4.18.0-425.19.2.el8_7.x86_64

• OpenSIPS installation: packages from http://yum.opensips.org/

Additional context
May be I make something wrong with b2b module. I dont't know.
If there another way how I can handle this scenario and with handling REFER request provide me please

[bogdan-iancu]

You cannot user for the same call both the dialog support (meaning call proxying) and B2B support (meaning acting as B2B). It is a logical conflict. If you need B2B support, remove the dialog one

[igoryeroshev]

I have try to remove the dialog. But got the same behaviour.
Now my config looks:
route{
if (is_method("INVITE")){
xlog("L_INFO", "1. Go to route(CLASSIFY_SOURCE)\n");
route(CLASSIFY_SOURCE);
}

if (isflagset("FLAG_CISCODIALER_SOURCE")) {
remove_hf("Require");
xlog("3. t_newtran\n");
t_newtran();
xlog("4. b2b_server_new\n");
b2b_server_new("caller");
xlog("L_INFO", "5. t_wait_for_new_branches\n");
t_wait_for_new_branches();
$avp(filter) = "aor="+$rU;
xlog("L_INFO", "5. notify_on_event\n");
notify_on_event("E_UL_CONTACT_INSERT",$avp(filter),"fork_call_dialer", 20);
xlog("L_INFO", "6. if lookup location)\n");
if (lookup("location")) {
xlog("L_INFO", "Go to RELAY after PUSH\n");
route(RELAY);
}
exit;
}
}

route[fork_call_dialer]
{
xlog("7. user $avp(aor) registered a new contact $avp(uri) for dialer call, injecting\n");
b2b_client_new("callee", $avp(uri));
xlog("8. b2b_init_request\n");
b2b_init_request("refer","t300");
exit;
}

route[CLASSIFY_SOURCE]
{
if (search("User-Agent: Cisco-SIPDialer")) {
xlog("L_INFO", "2. Classifyed as request from Cisco Dialer\n");
setflag("FLAG_CISCODIALER_SOURCE");
return;
}

Logs:
Jun 8 11:33:44 /usr/sbin/opensips[3729551]: 1. Go to route(CLASSIFY_SOURCE)
Jun 8 11:33:44 /usr/sbin/opensips[3729551]: 2. Classifyed as request from Cisco Dialer
Jun 8 11:33:44 /usr/sbin/opensips[3729551]: 3. t_newtran
Jun 8 11:33:44 /usr/sbin/opensips[3729551]: 4. b2b_server_new
Jun 8 11:33:44 /usr/sbin/opensips[3729551]: 5. t_wait_for_new_branches
Jun 8 11:33:44 /usr/sbin/opensips[3729551]: 5. notify_on_event
Jun 8 11:33:44 /usr/sbin/opensips[3729551]: 6. if lookup location)
Jun 8 11:33:49 /usr/sbin/opensips[3729551]: 7. user 87010260809 registered a new contact sip:87010260809@xxx.xxx.xxx.xxx:58693;transport=udp for dialer call, injecting
Jun 8 11:33:49 kernel: opensips[3729551]: segfault at c8 ip 00007fad9d8b4cb8 sp 00007ffc266c3360 error 4 in b2b_logic.so[7fad9d89e000+52000]
Jun 8 11:33:49 /usr/sbin/opensips[3729551]: 8. b2b_init_request
Jun 8 11:33:49 /usr/sbin/opensips[3729551]: CRITICAL:core:sig_usr: segfault in process pid: 3729551, id: 5
Jun 8 11:33:49 systemd-coredump[3730026]: Process 3729551 (opensips) of user 987 dumped core.#12#012Stack trace of thread 3729551:#12#0 0x00007fad9d8b4cb8 get_local_contact (b2b_logic.so)#12#1 0x00007fad9d8d5912 b2b_process_scenario_init (b2b_logic.so)#12#2 0x00007fad9d8d72a2 init_request (b2b_logic.so)#12#3 0x00007fad9d8d81d5 b2b_init_request (b2b_logic.so)#12#4 0x0000558b86c50462 do_action (opensips)#12#5 0x0000558b86c53890 run_action_list (opensips)#12#6 0x0000558b86c53bfd run_actions (opensips)#12#7 0x00007fad9d452794 handle_ebr_ipc (event_routing.so)#12#8 0x0000558b86c725fd ipc_handle_job (opensips)#12#9 0x0000558b86daf359 handle_io (opensips)#12#10 0x0000558b86db4973 udp_start_processes (opensips)#12#11 0x0000558b86c206db main_loop (opensips)#12#12 0x00007fada84c5d85 __libc_start_main (libc.so.6)#12#13 0x0000558b86c2124e _start (opensips)
Jun 8 11:33:49 /usr/sbin/opensips[3729546]: INFO:core:handle_sigs: child process 3729551 exited by a signal 11

[rvlad-patrascu]

Hi @igoryeroshev ,

I've pushed a fix that prevents the crash by not allowing the b2b_init_request() function to be used from such a route.

Unfortunately I don't think your scenario can be achieved with the b2b_logic module currently. The notification route provided to notify_on_event() does not have the actual SIP message or full context of the initial INVITE transaction when it is executed. The t_inject_branches() function is an exception and can be used from the notification route but that is based on a special mechanism that uses a transaction ID that's inherited in the notification route.