Bug "No CRLF found in the buffer"

tobiass · Post by **tobiass** » Mon Dec 12, 2022 4:02 am

1. Brekeke Product Name and Version: see below

2. Java version: see below

3. OS type and the version: see below

4. UA (phone), gateway or other hardware/software involved: unknown, see below

5. Your problem:

We are running two SIP servers with Advanced License in different data centers on different Brekeke versions. Both have the same bug.

Brekeke is a critical element in our infrastructure. Therefore, we hope you can pinpoint and fix this bug soon. Please let me know if you require further information.

Bug "No CRLF found in the buffer"
Once a month, the Brekeke Java process reaches 50% CPU usage (i.e. full usage of one CPU core on our 2-core VM). This slows down the Windows server. Sometimes up to a point where connecting via RDP is not possible anymore.

Logs "sv.TIMESTAMP.log" show many entries in sub-millisecond intervals of

Code: Select all

    tcp-con.654: Exception: 09/23/22 00:00:00.000
        java.lang.Exception: No CRLF found in the buffer: idx=0/2000:  (depth=5)
        com.brekeke.common.buffer.ByteBufferReader.readLine (null:-1)
        com.brekeke.common.buffer.ByteBufferReader.readLine (null:-1)
        com.brekeke.net.sip.SIPpacket.init (null:-1)
        com.brekeke.net.sip.SIPpacket.<init> (null:-1)
        com.brekeke.net.sip.sv.transport.tcp.SIPtcpConnection.run (null:-1)

Example log: "sv.20220923 - truncated.log": https://pastebin.com/x8GKbMKw

Restarting Brekeke via "Restart/Shutdown" in Web interface solves the problem.
Afterwards the CPU usage is normal again.

System details
Brekeke versions affected:
- 3.14.3.5/560 OpenJDK 64-Bit Server VM v11.0.13, Apache Tomcat v9.0.44 on Windows Server
- 3.14.1.2/557, Eclipse Adoptium OpenJDK 64-Bit Server VM, Version 11.0.16.1, Apache Tomcat/9.0.58 on "Windows Server 2019 data center"
- No longer used by us: 3.9.5.8/517-9, Oracle Java 8 on "Windows Server 2019 data center"

Best regards
Tobias Schubert

Mike · Post by **Mike** » Mon Dec 12, 2022 1:03 pm

It seems someone sent non-SIP large data over TCP.
If you know the IP addresses of these malicious activities, block them in the SIP Server's BlockList or firewall.
Or if you know trusted IP addresses, add them in the firewall as white list.

If you are not using TCP, disable it in the SIP Server's settings.

The new update version we release this week can prevent this issue without any tunings.

tobiass · Post by **tobiass** » Wed Dec 14, 2022 6:39 am

Great, thank you Mike! As we require TCP and the IPs are always changing, we'll wait for the update version.

tobiass · Post by **tobiass** » Thu Dec 22, 2022 7:01 am

Hi Mike!

According to Version history the bug fix has not yet been released (https://docs.brekeke.com/sip/sip-history).

Can you give an estimate when it will be released?

Best regards
Tobias Schubert

Mike · Post by **Mike** » Fri Dec 23, 2022 5:49 pm

The new release will be available next week.

Mike · Post by **Mike** » Tue Dec 27, 2022 8:06 pm

Hi Tobias,
The new release, version 3.14.4.12, was released.
https://brekeke.com/downloads/sip-server.php
https://docs.brekeke.com/sip/sip-history

tobiass · Post by **tobiass** » Mon Jan 09, 2023 4:18 am

Hi Mike,

thank you for the bugfix and the information! We'll update our Brekeke servers.