Attempt to parse each src/dst leg only once (which is a JSON document
these days) and use the same logic for determining whether to create a
CDR for both intermediate and final CDRs.
Change-Id: If8afae812585cb8624799b0d2f4e6be64980cea9
The MySQL INSERT statements to move processed Redis acc records from
Redis to the respective backup/trash MySQL tables are always issued
within a MySQL transaction (med_handler via medmysql_batch_start), but
the deletions from Redis were done immediately. Therefore if mediator
were to abort within a processing loop, the MySQL transaction would be
rolled back after the entries had already been deleted from Redis,
therefore losing the acc entries.
Solve this by using an internal queue for Redis entries to hold the
lists of entries to be deleted until the MySQL transaction is commited.
Change-Id: Ib41d0e2ca722c66f9e078ca31f7e5ca2b9d9fe2d
(cherry picked from commit bbbe2c9a7b)
Use a struct with globally defined instances instead of a literal string
name to distinguish the two destination tables. This makes it possible
to unify record handling between the two tables.
Change-Id: I900debf3a28f262b4503d79562d69b69502b7aa8
(cherry picked from commit d87f661f00)
This makes it possible to trace which CDR record was created from which
acc records and at which point.
Change-Id: I3645ccf244bf7d86b6f70181c57e47dfa204f7b9
(cherry picked from commit 64d50ee701)
json_tokener_parse returns a newly created JSON object (tree) which must
be freed by decreasing the ref count before the variable goes out of
scope.
Fix-up for Ia7e8446fe4953d1391f99ea1530990e3d385c056
Change-Id: I2e4b17086df468f66401a71a836d37ed821944e5
(cherry picked from commit 056f1ae610)
The `cdr_index` variable already tracks the number of created CDRs, as
it points to the slot for the next CDR record to be inserted. It's
increased by one at the start of the processing loop, so if we end up
skipping over an entry after it's been increased, it must be decreased
again, which keeps the count intact and prevents empty CDR records from
being created.
Fix-up for Ia7e8446fe4953d1391f99ea1530990e3d385c056
Change-Id: Ibb650a4b00978a272ef8f60751f6efda0491a912
(cherry picked from commit 4ffa758826)
* If there are multiple call leg acc records for a call, ones
that do not contain valid src + dst leg data (either JSON or th
old format), these acc records are skipped and intermediate cdrs
are created for the remaining records that contain valid src and dst
leg data
Change-Id: Ia7e8446fe4953d1391f99ea1530990e3d385c056
(cherry picked from commit b0e94168f73d88126e8b90822a29d928186d3fcc)
We are migrating from redis to keydb so for now we need to support both
so we should not depend on specific key-value storage in unit file but
should use database.key_value.flavor value in override file.
But we can't redefine dependencies in override file just add additional
ones. So remove it from unit file.
Change-Id: I16e94e938bd9f1da14e1068bc6b94485b08a4ca5
As the number of subscribers grows, the current approach of doing a full
table dump of the subscribers DB and caching it in memory becomes less
and less feasible. The new approach is to simply do a straight DB query
for each subscriber as records are processed, and then cache the result
in memory for a little while.
Change-Id: I19a6271d779bd0abccc29e3548e7bcdb2e00baa3
ubuntu-20.04 doesn't provide debhelper-compat (= 13), therefore fails with:
| The following packages have unmet dependencies:
| builddeps:. : Depends: debhelper-compat (= 13)
| E: Unable to correct problems, you have held broken packages.
Let's switch from ubuntu-20.04 to ubuntu-latest, which
currently still points to ubuntu-20.04, but should reduce
our maintenance efforts.
Furthermore enabled the ubuntu-cloud-archive/yoga-staging PPA,
which provides a backport of debhelper v13:
https://launchpad.net/~ubuntu-cloud-archive/+archive/ubuntu/yoga-staging/+packages
and fixes our failing coverity builds on github.
Change-Id: I3bba166843f164b67b90c403cc772dfd939eeae7
Using apt-get with `-qq` displays only the following message
on package installation problems:
| E: Unable to correct problems, you have held broken packages.
Whereas with `-q`, we get the actual underlying problem, being:
| The following packages have unmet dependencies:
| builddeps:. : Depends: debhelper-compat (= 13)
| E: Unable to correct problems, you have held broken packages.
Change-Id: Ibadc483f1cb324c83d7616d009bcc932876a25a3
Use a macro in combination with an included file to define the list of
all string fields used in the CDR struct.
Change-Id: Ic0b93c005b792eadf00544768c74382fa3307577
We cannot overwrite the reallocated variable, otherwise on failure we
leak it.
Change-Id: I541537ade71086c9ceb851d8c5223364e3908b07
Warned-by: cppcheck (memleakOnRealloc)
While the code is not threaded, better be future-proof and use safer
APIs, which in addition has less side-effects as it does not set the
global TZ related variables.
Change-Id: I57fbe6683590cc2fbc0da508819553c040764739
Warned-by: lgtm
Whether a bit-field is signed or unsigned is implementation specific, so
we should be explicit about this.
Change-Id: I8bce847d6ece3d08fc93fa77227f6f970d1353de
Warned-by: lgtm
On Debian buster the latter contains transitive dependencies in Libs,
instead of in Libs.private, which leaks linking implementation details.
Change-Id: Ia131fe82444b8c2204976df75be047ab6d17c561
We need readonly access to /dev/urandom, otherwise the rand()
calls might fail, as seen in kamailio-config-tests.
Change-Id: Id132191994ae5fe74ec3ebb7d34a4a5d50769dbc
Thanks: Victor Seva for reporting
In carrier environments we have foreign DB hosts
configured in /etc/ngcp-mediator/ngcp-mediator.conf,
therefore we can't easily apply IP address filtering.
JFTR, new and current systemd hardening state for ngcp-mediator:
| $ sudo COLUMNS=142 systemd-analyze security ngcp-mediator | grep -v '✓'
| NAME DESCRIPTION EXPOSURE
| ✗ PrivateNetwork= Service has access to the host's … 0.5
| ✗ User=/DynamicUser= Service runs as root user 0.4
| ✗ RestrictAddressFamilies=~AF_(INET… Service may allocate Internet soc… 0.3
| ✗ RestrictAddressFamilies=~… Service may allocate exotic socke… 0.3
| ✗ DeviceAllow= Service has a device ACL with som… 0.1
| ✗ IPAddressDeny= Service does not define an IP add… 0.2
| ✗ RestrictAddressFamilies=~AF_PACKET Service may allocate packet socke… 0.2
| ✗ SystemCallFilter=~@privileged System call whitelist defined for… 0.2
| ✗ RestrictAddressFamilies=~AF_NETLI… Service may allocate netlink sock… 0.1
| ✗ RootDirectory=/RootImage= Service runs within the host's ro… 0.1
| SupplementaryGroups= Service runs as root, option does…
| RemoveIPC= Service runs as root, option does…
| ✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1
|
| → Overall exposure level for ngcp-mediator.service: 2.1 OK 🙂
Change-Id: I0e7c474eddd5d4d4c77b9bda157448294ed0a5c4
ngcp-mediator service state BEFORE this change:
| $ systemd-analyze security ngcp-mediator | tail -1
| → Overall exposure level for ngcp-mediator.service: 9.5 UNSAFE 😨
ngcp-mediator service state AFTER this change:
| $ sudo COLUMNS=142 systemd-analyze security ngcp-mediator | grep -v '✓'
| NAME DESCRIPTION EXPOSURE
| ✗ PrivateNetwork= Service has access to the host's network 0.5
| ✗ User=/DynamicUser= Service runs as root user 0.4
| ✗ RestrictAddressFamilies=~AF_(INET|INET6) Service may allocate Internet sockets 0.3
| ✗ RestrictAddressFamilies=~… Service may allocate exotic sockets 0.3
| ✗ DeviceAllow= Service has a device ACL with some special devices 0.1
| ✗ IPAddressDeny= Service defines IP address whitelits with only localhost entries 0.1
| ✗ RestrictAddressFamilies=~AF_PACKET Service may allocate packet sockets 0.2
| ✗ SystemCallFilter=~@privileged System call whitelist defined for service, and @privileged is included 0.2
| ✗ RestrictAddressFamilies=~AF_NETLINK Service may allocate netlink sockets 0.1
| ✗ RootDirectory=/RootImage= Service runs within the host's root directory 0.1
| SupplementaryGroups= Service runs as root, option does not matter
| RemoveIPC= Service runs as root, option does not apply
| ✗ RestrictAddressFamilies=~AF_UNIX Service may allocate local sockets 0.1
|
| → Overall exposure level for ngcp-mediator.service: 2.0 OK 🙂
Change-Id: If33c303b9df465393f15c0b685d1aab54a465df6
We only ever go into the error handling code before malloc has
succeeded, which means ‘entries’ will always be NULL.
Change-Id: Iaedd1ac668249b0e4516f782c24a2f420e8682a5
Warned-by: coverity
Sipwise Jenkins Builder
Richard Fuchs
Kirill Solomko
Mykola Malkov
Michael Prokop
Guillem Jover
Alessio Garzi