soap timeout & license gone !

[fonny]

I am bumping in some problem with soap requests

 

When using the example from https://wiki.snomone.com/index.php?title=Access_to_the_Database#Example_of_Tables_and_respective_columns ,a response is returned back after 30 seconds what looks to me like a timeout.

 

changing the part from the pbx_soap function:

 

fputs($dbhandle, $request); 
$data = "";

while(!feof($dbhandle)) 
{
	$data .= fread($dbhandle, 128);
}
fclose($dbhandle);

to:

 

      stream_set_timeout($dbhandle, 0, 20000); 
fputs($dbhandle, $request); 
$data = "";
       while ($line = fgets($dbhandle)) $data .= $line;
fclose($dbhandle);

 

I get a response back almost immediately.

Is the pbx sending the EOF ?

 

 

But another problem bothering me is that I managed to kill the pbx. On 2 different pbx I no longer could register until I saw the license was gone!

Rebooting the pbx or deleting 1 extension was sufficient to bring the license back.

Are the soap requests also counting as extension ?

 

Server version 2011-4.5.0.1050 Coma Berenicids (MacOS)

[fonny]

I have looked further into this.

 

Sending

<?xml version="1.0" standalone="yes"?>
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sns="http://www.pbxnsip.com/soap/pbx"><env:Body><sns:DBSet><Table>extensions</Table><Index>40</Index><Column><Name>email_address</Name><Value>mail@company.com</Value></Column><Column><Name>display_name</Name><Value>My Name</Value></Column></sns:DBSet></env:Body></env:Envelope>

Results in

results: HTTP/1.1 200 Ok
Content-Type: application/xml
Content-Length: 194

<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sns="http://soap.com/pbx"><env:Body><sns:DBSetResponse><Index>42</Index></sns:DBSetResponse></env:Body></env:Envelope>

 

Nothing changes at the extension. I don't know why.

But when I look at the System Status Overview the line Additional license information: goes from

Extensions: 10/10 Accounts: 25/30 Upgrade: 01 01 2013

to

Accounts 25/30 Upgrade: 01 01 2013

 

After awhile the License Status goes from sone ONE free tot No license.

 

I can understand something is wrong in the soap request or when I create an additional extension (which is not the case here) I get an error message like 'max numer of extensions exceeded' but not that the pbx get unlicensed and all communication stops until reboot of the pbx.

 

Looks like a bug here !

[pbx support]

Is 40 is the index of the extension or the account number? If it is the account number, you need to first get the index and then try to get the other parameters.

 

Look at the DBSearch function in the same page.

[fonny]

I was indeed looking to the extension and not the index. With the right index this works. Thanks.

 

The 2 other problems remain

 

- time-out when sending soap request

- loosing the license which disables the pbx.

 

OK, I know now that a set_pbx with a wrong index is incorrect but I find it not tolerable this is crashing the pbx.

[Vodia PBX]

- time-out when sending soap request

- loosing the license which disables the pbx.

 

OK, I know now that a set_pbx with a wrong index is incorrect but I find it not tolerable this is crashing the pbx.

 

Did you write global settings through SOAP?! Maybe you "nuked" the PBX by overwriting to the global settings. Also keep in mind that PBX might blacklist you when you do talk to it without authentication (make sure that you whitelist the IP address you are coming from).

[fonny]

Yes! I certainly 'nuked' it as I can recreate the problem but I don't know how I to write global settings through soap.

I just wanted to change the name & email of an extension. OK, it was not the right one

But is there no error checking on pbx site ? I found it worrying that one can bring down the whole system with entering a wrong extension number !

 

 

And there is still the timeout problem. This has nothing with white or blacklist as it works perfect when using stream_set_timeout.

But that means I just catch what arrives the first second (which is usual the full response on a light loaded system) but I would prefer to wait on an EOF to be sure I have the full response.

[fonny]

I've been testing further and having results. Change pbx_soap function from the examples

 

function pbx_soap( $req ) 
{
global $dbadr, $dbport, $dbdebug, $debug_tbl;

$dbhandle = fsockopen($dbadr, $dbport, $errno, $errstr);
if (!$dbhandle) 
{ 
	if($dbdebug) 
	{
		echo "<font color=red>$errstr ($errno)</font><br>\n"; 
	}
	return false;
 	}

$request = "POST /soap.xml HTTP/1.1\r\n";
$request .= "Content-Type: application/xml\r\n";
$request .= "Content-Length: " . strlen($req) . "\r\n\r\n";
$request .= $req;

fputs($dbhandle, $request); 
$data = "";
while(!feof($dbhandle)) 
{
	$data .= fread($dbhandle, 128);
}
fclose($dbhandle);

$pos = strpos($data,"\r\n\r\n");
if($pos != false) 
{
	$body = substr($data, $pos);
	return $body;
}
} // pbx_soap

 

to following

 

function pbx_soap( $req ) 
{
global $dbadr, $dbport, $dbdebug, $debug_tbl;

$dbhandle = fsockopen($dbadr, $dbport, $errno, $errstr);
if (!$dbhandle) 
{ 
	if($dbdebug) 
	{
		echo "<font color=red>$errstr ($errno)</font><br>\n"; 
	}
	return false;
 	}

$request = "POST /soap.xml HTTP/1.1\r\n";
$request .= "Content-Type: application/xml\r\n";
$request .= "Content-Length: " . strlen($req) . "\r\n";
$request .= "Connection: Close\r\n\r\n";

fputs($dbhandle, $request); 
fputs($dbhandle, $req); 
$data = "";
while(!feof($dbhandle)) 
{
	$data .= fread($dbhandle, 128);
}
fclose($dbhandle);

$pos = strpos($data,"\r\n\r\n");
if($pos != false) 
{
	$body = substr($data, $pos);
	return $body;
}
} // pbx_soap

 

No more timeout now.

[Vodia PBX]

Yes! I certainly 'nuked' it as I can recreate the problem but I don't know how I to write global settings through soap.

I just wanted to change the name & email of an extension. OK, it was not the right one

But is there no error checking on pbx site ? I found it worrying that one can bring down the whole system with entering a wrong extension number !

 

How do you define bringing the PBX down? Was it just blacklisted, so that your server could not access the PBX any more or was the process gone? The SOAP interface has not as much exposure as the other stuff; however there should be no way to bring the PBX down from the SOAP side, ever. If you have found a way, we would be very interested and we would fix it of course.

[fonny]

Sorry to have taken my time. I finally found some free time to check this further.

 

Yes, I can bring down the PBX by nuking the license settings.

 

See my post of 08 May 2012 - 12:34 PM where I explain this.

 

Running the free version and setting some info but using an extension index greater than allowed results in loosing the license settings for the PBX.

After 5 till 40 minutes the license disappears but I don't have any clue what exactly is triggering this. The PBX itself is idle (no calls, ... just waiting)

 

The PBX is still running but if no extensions or trunks are allowed any more to register I classify this as 'having bring down the PBX'

The only way to get the PBX working again is restarting.

 

This is the command send:

$columns_args = array( email_address=>"me@example.com", display_name=>"My", first_name=>"Name" );

$result_set = pbx_set( "extensions", "40", $columns_args, $dbadr, $dbport );

 

And this shows after x minutes in the log:

[0] 2012/06/03 15:31:53: License suspended: There are too many extensions

[8] 2012/06/03 15:31:53: HTTP client: Connect to 188.40.44.96:443, pending requests 0

[0] 2012/06/03 15:32:11: Cannot send packet: No license

[0] 2012/06/03 15:32:53: Last message repeated 32 times

[4] 2012/06/03 15:32:53: HTTP client: Timeout on 188.40.44.96:443

[0] 2012/06/03 15:32:55: Cannot send packet: No license

[Vodia PBX]

Interesting DoS . I guess we need to check if a SOAP operation like this can exceed the license.

[pbx support]

Sorry to have taken my time. I finally found some free time to check this further.

.

.

[0] 2012/06/03 15:32:55: Cannot send packet: No license

 

SOAP access is restricted at the system level using "SOAP trusted IP address" field. So, we assume that the admin knows exactly what he/she is doing when it comes to database access using SOAP messages(especially, DBSet). Note that you can use ModifyAccount (http://wiki.snomone.com/index.php?title=Access_to_the_Database#ModifyAccount) to do similar operations and it does have some error checking.

[fonny]

Hmm, is like BMW saying: 'You have a driver license? OK you know how to drive a car'. So we deliver a car without brakes

 

If I change extension info and I use wrong numbering, OK agree that 'the wrong' extension is changed or nothing at all happens because the extension doesn't exists.

But I really do not see any correlation between an extension and the license number disappearing !

 

Sorry, a minimum of error checking is necessary.

[pbx support]

Well, "If I jump from a 10 story build, I will break my legs or worse..... But I will still jump" :-)