Recent changes to support-requests

#7 thebridge1.09 and 1.06 .disconnect crash

Charles Blackburn — Sat, 08 Feb 2020 11:14:15 -0000

no problem. i don't mind testing i can help. i haven't had time to look at the code yet, but it's a (relatively) simple buffer overflow so maybe einstead of using strcpy, use strncpy with the size of the buffer should fix it.

oh and it's the bridge, not TLB, unless im missing something :D

#7 thebridge1.09 and 1.06 .disconnect crash

Skip Hansen — Fri, 07 Feb 2020 23:54:31 -0000

Hi Charles,

Thanks for the detailed report! This might be enough to fix the issue. I'll try to find time in the next week or so.

I no longer have a running testbed and I never ran thelinkbox on a 64 bit machine in any case so I will need help testing. If you can help test a future fix I'll send you some code.

BTW I've moved to github: https://github.com/skiphansen/thelinkbox

73's Skip WB6YMH

#7 thebridge1.09 and 1.06 .disconnect crash

Charles Blackburn — Fri, 07 Feb 2020 19:14:40 -0000

ok update.. had chance to take a quick look at the core dump. it appears that the buffer used for messages coming from the server for disconnects is too small you can see where in line #6 where strcpy takes a crap because of the buffer overflow

charlesb@UbuntuDev:~/echolink$ gdb /usr/local/bin/tbd core.current
Reading symbols from /usr/local/bin/tbd...done.
[New LWP 10187]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `tbd -d -d -h -f tbd.conf'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffb2dced801 in __GI_abort () at abort.c:79
#2  0x00007ffb2dd36897 in __libc_message (action=action@entry=(do_abort | do_backtrace), fmt=fmt@entry=0x7ffb2de63988 "*** %s ***: %s terminated\n") at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffb2dde1cff in __GI___fortify_fail_abort (need_backtrace=need_backtrace@entry=true, msg=msg@entry=0x7ffb2de63905 "buffer overflow detected") at fortify_fail.c:33
#4  0x00007ffb2dde1d21 in __GI___fortify_fail (msg=msg@entry=0x7ffb2de63905 "buffer overflow detected") at fortify_fail.c:44
#5  0x00007ffb2dddfa10 in __GI___chk_fail () at chk_fail.c:28
#6  0x00007ffb2dddeca2 in __strcpy_chk (dest=dest@entry=0x5614e6b7d401 "\bCALLSIGN\002\022DG4BBP         Uwe\003\bCALLSIGN\004\b208B60FA\006\006E2.12C\b\006\001P5198\b\003\001D0",
    src=src@entry=0x5614e6792cb2 "Bye Bye", destlen=destlen@entry=0) at strcpy_chk.c:30
#7  0x00005614e6779fe9 in strcpy (__src=0x5614e6792cb2 "Bye Bye", __dest=0x5614e6b7d401 "\bCALLSIGN\002\022DG4BBP         Uwe\003\bCALLSIGN\004\b208B60FA\006\006E2.12C\b\006\001P5198\b\003\001D0")
    at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:90
#8  GenBye (pCC=pCC@entry=0x5614e6d108b0, Temp=0x5614e6b7d3f0 "\300", <incomplete sequence \311>, Reason=Reason@entry=0x5614e6792cb2 "Bye Bye") at conference.c:3651
#9  0x00005614e677fdea in RTCP_Rx (p=p@entry=0x5614e6b7d360) at conference.c:2212
#10 0x00005614e67807f0 in RTCP_Handler (p=0x5614e6b7d360) at conference.c:2614
#11 0x00005614e678c593 in CallCurrentState (pClient=0x5614e6b7d360) at main.c:684
#12 0x00005614e678cd76 in MainLoop () at main.c:508
#13 0x00005614e67877fe in StartRunning () at thebridge.c:522
#14 0x00005614e6775d26 in main (argc=6, argv=0x7ffc78939ea8, envp=<optimized out>) at thebridge.c:381

#7 thebridge1.09 and 1.06 .disconnect crash

Charles Blackburn — Fri, 07 Feb 2020 19:05:57 -0000

so here is what i get... been happening more lately now as far as the IP address, it doesn't matter that was just the last one, it appears to be mainly people that are coming in via a proxy or via cell phone etc. (my only way of testing). i've attached the core dump if anyone's interested

Feb 7 2:38:30 RTP_Data: Failed to find client 44.190.12.83
Feb 7 2:38:30 Rejecting N1FBF, dir IP 44.137.75.243 != IP 44.190.12.83.
Feb 7 2:38:30 Disconnecting unauthorized user N1FBF.

CORE DUMPED - Buffer overflow

#7 thebridge1.09 and 1.06 .disconnect crash

Charles Blackburn — Wed, 15 Jan 2020 18:52:24 -0000

is there any update to this? Just installed the latest version from SF and each time a user disconnects or times out the bridge core dumps. i'm working on getting some logs, but it's pretty much exactly as already been posted in here

charlesb@UbuntuDev:~/echolink$ uname -a
Linux UbuntuDev 4.15.0-64-generic #73-Ubuntu SMP Thu Sep 12 13:16:13 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
charlesb@UbuntuDev:~/echolink$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.3 LTS"
charlesb@UbuntuDev:~/echolink$

#9 Incorrect padding calculation in GenBye()

Scott Miller — Wed, 12 Dec 2018 20:21:45 -0000

Thanks Skip. It's certainly not a show stopper, just one of several things I wish there was some kind of definitive answer for. Jonathan hasn't been able to give me much beyond "read the source code for theBridge" and "read the RFCs".

If I start crashing clients, I'll deal with that when the time comes. It looks like some of the padding was selected for the sake of encryption, but of course we're not using encryption in EchoLink.

#9 Incorrect padding calculation in GenBye()

Skip Hansen — Wed, 12 Dec 2018 20:04:13 -0000

Hi Scott,

It's clear that Echolink is based on RTP, RTCP etc, but that was never stated. Echolink is a copy of an older Ham radio linking project called iLink and the protocol was considered a secret. EchoLink and thebridge, etc were based on reverse enginerring the over the air protocol, not RFCs or any other documentation. All I can say is that "it works", if changes were make to make it RFC compliant it may well stop working. Additionally I'm no longer developing this code and I'm no longer active on Echolink.

BTW Good luck with your project!

#7 thebridge1.09 and 1.06 .disconnect crash

Skip Hansen — Wed, 12 Dec 2018 19:57:10 -0000

Hi Drew,

I appreciate the effort in reporting the crash, but basically neither thelinkbox nor thebridge were ever tested on 64 bit machines. The code was originally written 14 years ago when 64 bit machines were rare and expensive. I am not longer developing this code. If someone comes up with a fix I'd be more than happy to merge it, otherwise it's unlikely to get fixed anytime soon.

73's Skip WB6YMH

#7 thebridge1.09 and 1.06 .disconnect crash

Drew — Mon, 10 Dec 2018 03:11:49 -0000

I've got some debug information here that may help with this .disconnect issue.
- thebridge-1.09
- Ubuntu 18.04.1 LTS 64bit
- Intel(R) Xeon(R) CPU E5-2650L v3 @ 1.80GHz

make output:
https://pastebin.com/pMpcCkAS

syslog:
systemd[1]: tbd.service: Main process exited, code=dumped, status=6/ABRT
systemd[1]: tbd.service: Failed with result 'core-dump'.

output from tbd -d:
2:50:49 DX-LINK disconnected by tbdcmd
buffer overflow detected : tbd terminated
Aborted (core dumped)

#7 thebridge1.09 and 1.06 .disconnect crash

Drew — Sat, 01 Dec 2018 04:17:56 -0000

Hi. Did you ever resolve this issue? I'm getting the same error. .disconnect will crash thebridge 1.06 running on Ubuntu 18.04.1 LTS 64 bit