sr-dev

sr-dev@lists.kamailio.org

44307 discussions

[ openser-Patches-3035808 ] Add rfc1918 test for source ip to nat_uac_test

by SourceForge.net

Patches item #3035808, was opened at 2010-07-28 11:13 Message generated for change (Comment added) made by miconda You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=743022&aid=3035808&group_… Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: modules >Group: ver devel >Status: Closed >Resolution: Accepted Priority: 5 Private: No Submitted By: Alex Hermann (axlh) >Assigned to: Daniel-Constantin Mierla (miconda) Summary: Add rfc1918 test for source ip to nat_uac_test Initial Comment: Expand nathelper function nat_uac_test with function to test for rfc1918 address in source ip of SIP message. Move some code to helper functions to prevent duplication of code. ---------------------------------------------------------------------- >Comment By: Daniel-Constantin Mierla (miconda) Date: 2010-09-24 12:20 Message: I committed the patch on git master, slightly modified to keep the for loops going up to null filed. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=743022&aid=3035808&group_…

14 years, 4 months

git:master: nathelper(k): added test for src_ip in rfc1918

by Daniel-Constantin Mierla

Module: sip-router Branch: master Commit: 7de84b2d4e988114b9b0d71aa689f808acf4e46e URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=7de84b2… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Fri Sep 24 11:09:29 2010 +0200 nathelper(k): added test for src_ip in rfc1918 - new flag for nat_uac_test() to detect if source ip is in a rfc1918 network - adapted from patch by Alex Hermann, SF#3035808 --- modules_k/nathelper/README | 217 ++++++++++++++++++--------- modules_k/nathelper/doc/nathelper_admin.xml | 6 +- modules_k/nathelper/nathelper.c | 49 +++++-- 3 files changed, 190 insertions(+), 82 deletions(-) Diff: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commitdiff;h=7de…

14 years, 4 months

git:master: core: function for getting the name of a protocol

by Andrei Pelinescu-Onciul

Module: sip-router Branch: master Commit: 10117562935ffef52126cce5b290213e327442bb URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=1011756… Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Date: Wed Sep 22 12:44:06 2010 +0200 core: function for getting the name of a protocol Added a new function to ip_addr.h, for converting the internal protocol number to an ascii name (proto2a(...)). --- ip_addr.c | 23 +++++++++++++++++++++++ ip_addr.h | 4 ++++ 2 files changed, 27 insertions(+), 0 deletions(-) diff --git a/ip_addr.c b/ip_addr.c index 5651809..331bfaa 100644 --- a/ip_addr.c +++ b/ip_addr.c @@ -330,3 +330,26 @@ int is_mcast(struct ip_addr* ip) } #endif /* USE_MCAST */ + + + +/** get protocol name (asciiz). + * @param proto - protocol number + * @return string with the protocol name or "unknown". + */ +char* proto2a(enum sip_protos proto) +{ + switch(proto){ + case PROTO_NONE: + return "*"; + case PROTO_UDP: + return "udp"; + case PROTO_TCP: + return "tcp"; + case PROTO_TLS: + return "tls"; + case PROTO_SCTP: + return "sctp"; + } + return "unknown"; +} diff --git a/ip_addr.h b/ip_addr.h index d751781..2f04693 100644 --- a/ip_addr.h +++ b/ip_addr.h @@ -250,6 +250,10 @@ void print_ip(char* prefix, struct ip_addr* ip, char* suffix); void stdout_print_ip(struct ip_addr* ip); void print_net(struct net* net); +char* proto2a(enum sip_protos proto); + + + #ifdef USE_MCAST /* Returns 1 if the given address is a multicast address */ int is_mcast(struct ip_addr* ip);

14 years, 4 months

git:master: core: more verbose logs when get_send_socket fails

by Andrei Pelinescu-Onciul

Module: sip-router Branch: master Commit: 20a8b62b515ac00bebf00177d0971be11dbedd08 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=20a8b62… Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Date: Wed Sep 22 12:45:53 2010 +0200 core: more verbose logs when get_send_socket fails All the get_send_socket() errors or warnings include now the forced socket and the destination (protocol:ip:port). --- forward.c | 31 ++++++++++++++++++++++++------- 1 files changed, 24 insertions(+), 7 deletions(-) diff --git a/forward.c b/forward.c index 9e675da..25bc11d 100644 --- a/forward.c +++ b/forward.c @@ -234,26 +234,36 @@ struct socket_info* get_send_socket2(struct socket_info* force_send_socket, enum ss_mismatch* mismatch) { struct socket_info* send_sock; + struct socket_info* orig; if (likely(mismatch)) *mismatch=0; /* check if send interface is not forced */ if (unlikely(force_send_socket)){ if (unlikely(force_send_socket->proto!=proto)){ + orig=force_send_socket; force_send_socket=find_si(&(force_send_socket->address), force_send_socket->port_no, proto); if (unlikely(force_send_socket == 0)){ if (likely(mismatch)) *mismatch=SS_MISMATCH_ADDR; LOG(L_WARN, "WARNING: get_send_socket: " - "protocol/port mismatch\n"); + "protocol/port mismatch (forced %s:%s:%d," + " to %s:%s)\n", + proto2a(orig->proto), ip_addr2a(&orig->address), + orig->port_no, + proto2a(proto), su2a(to, sizeof(*to))); goto not_forced; } if (likely(mismatch)) *mismatch=SS_MISMATCH_PROTO; } if (unlikely(force_send_socket->address.af!=to->s.sa_family)){ - DBG("get_send_socket: force_send_socket of different af (dst %d," - " forced %d)\n", - to->s.sa_family, force_send_socket->address.af); + DBG("get_send_socket: force_send_socket of different af" + " (dst %d - %s:%s forced %d -%s:%s:%d)\n", + to->s.sa_family, proto2a(proto), su2a(to, sizeof(*to)), + force_send_socket->address.af, + proto2a(force_send_socket->proto), + ip_addr2a(&force_send_socket->address), + force_send_socket->port_no); if (likely(mismatch)) *mismatch=SS_MISMATCH_AF; goto not_forced; } @@ -268,7 +278,11 @@ struct socket_info* get_send_socket2(struct socket_info* force_send_socket, else{ if (!(force_send_socket->flags & SI_IS_MCAST)) LOG(L_WARN, "WARNING: get_send_socket: not listening" - " on the requested socket, no fork mode?\n"); + " on the requested socket (%s:%s:%d)," + " no fork mode?\n", + proto2a(force_send_socket->proto), + ip_addr2a(&force_send_socket->address), + force_send_socket->port_no); else if (likely(mismatch)) *mismatch=SS_MISMATCH_MCAST; } }; @@ -279,7 +293,9 @@ not_forced: return send_sock; /* found or error*/ else if (send_sock->socket==-1){ LOG(L_WARN, "WARNING: get_send_socket: not listening on the" - " requested socket, no fork mode?\n"); + " requested socket (%s:%s:%d), no fork mode?\n", + proto2a(send_sock->proto), ip_addr2a(&send_sock->address), + send_sock->port_no); /* continue: try to use some socket */ } } @@ -358,7 +374,8 @@ not_forced: }else send_sock=bind_address; break; default: - LOG(L_CRIT, "BUG: get_send_socket: unknown proto %d\n", proto); + LOG(L_CRIT, "BUG: get_send_socket: unsupported proto %d (%s)\n", + proto, proto2a(proto)); } return send_sock; }

14 years, 4 months

git:master: pike(k): more notes about remove_latency

by Daniel-Constantin Mierla

Module: sip-router Branch: master Commit: ea4ff090f11938010b3b150ebf59099b02a9d6db URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=ea4ff09… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Thu Sep 23 20:30:36 2010 +0200 pike(k): more notes about remove_latency - clarification about the meaning of this parameter upon report by Miguel Baptista --- modules_k/pike/README | 222 +++++++++++++++++++++---------------- modules_k/pike/doc/pike_admin.xml | 7 +- 2 files changed, 131 insertions(+), 98 deletions(-) Diff: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commitdiff;h=ea4…

14 years, 4 months

git:master: kamailio.cfg: added flood detection

by Daniel-Constantin Mierla

Module: sip-router Branch: master Commit: f77093de4f3111cbc7171e61443c7d1c0cee50d0 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=f77093d… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Thu Sep 23 18:40:48 2010 +0200 kamailio.cfg: added flood detection - can be enabled via #!define WITH_ANTIFLOOD - uses pike to detect flood and htable to ban the IP for a while --- etc/kamailio.cfg | 41 +++++++++++++++++++++++++++++++++++++++++ 1 files changed, 41 insertions(+), 0 deletions(-) diff --git a/etc/kamailio.cfg b/etc/kamailio.cfg index 0e48dd4..c2ef9e9 100644 --- a/etc/kamailio.cfg +++ b/etc/kamailio.cfg @@ -59,6 +59,11 @@ # - adjust CFGDIR/tls.cfg as needed # - define WITH_TLS # +# *** To enable anti-flood detection execute: +# - adjust pike and htable=>ipban settings as needed (default is +# block if more than 16 requests in 2 seconds and ban for 300 seconds) +# - define WITH_ANTIFLOOD +# # *** To enhance accounting execute: # - enable mysql # - define WITH_ACCDB @@ -223,6 +228,11 @@ loadmodule "rtpproxy.so" loadmodule "tls.so" #!endif +#!ifdef WITH_ANTIFLOOD +loadmodule "htable.so" +loadmodule "pike.so" +#!endif + # ----------------- setting module-specific parameters --------------- @@ -353,6 +363,16 @@ modparam("usrloc", "nat_bflag", FLB_NATB) modparam("tls", "config", "/usr/local/etc/kamailio/tls.cfg") #!endif +#!ifdef WITH_ANTIFLOOD +# ----- pike params ----- +modparam("pike", "sampling_time_unit", 2) +modparam("pike", "reqs_density_per_unit", 16) +modparam("pike", "remove_latency", 4) + +# ----- htable params ----- +# ip ban htable with autoexpire after 5 minutes +modparam("htable", "htable", "ipban=>size=8;autoexpire=300;") +#!endif ####### Routing Logic ######## @@ -450,6 +470,27 @@ route[RELAY] { # Per SIP request initial checks route[REQINIT] { +#!ifdef WITH_ANTIFLOOD + # flood dection from same IP and traffic ban for a while + # be sure you exclude checking trusted peers, such as pstn gateways + # - local host excluded (e.g., loop to self) + if(src_ip!=myself) + { + if($sht(ipban=>$si)!=$null) + { + # ip is already blocked + xdbg("request from blocked IP - $rm from $fu (IP:$si:$sp)\n"); + exit; + } + if (!pike_check_req()) + { + xlog("L_ALERT","ALERT: pike blocking $rm from $fu (IP:$si:$sp)\n"); + $sht(ipban=>$si) = 1; + exit; + } + } +#!endif + if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); exit;

14 years, 4 months

git:master: kamctl: include .base lib before sercmd detection

by Daniel-Constantin Mierla

Module: sip-router Branch: master Commit: f89005faf1fa47745a4bdb9770d23476fbfe891d URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=f89005f… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Thu Sep 23 13:27:27 2010 +0200 kamctl: include .base lib before sercmd detection - merr() function is declared there --- utils/kamctl/kamctl | 20 ++++++++++---------- 1 files changed, 10 insertions(+), 10 deletions(-) diff --git a/utils/kamctl/kamctl b/utils/kamctl/kamctl index e5252a5..be65363 100755 --- a/utils/kamctl/kamctl +++ b/utils/kamctl/kamctl @@ -50,6 +50,16 @@ if [ -z "$MYLIBDIR" ] ; then fi fi +##### ------------------------------------------------ ##### +### load base functions +# +if [ -f "$MYLIBDIR/kamctl.base" ]; then + . "$MYLIBDIR/kamctl.base" +else + echo -e "Cannot load core functions '$MYLIBDIR/kamctl.base' - exiting ...\n" + exit -1 +fi + # locate sercmd if [ -z "$SERCMD" ] ; then # try same dir as kamctl @@ -77,16 +87,6 @@ else fi fi -##### ------------------------------------------------ ##### -### load base functions -# -if [ -f "$MYLIBDIR/kamctl.base" ]; then - . "$MYLIBDIR/kamctl.base" -else - echo -e "Cannot load core functions '$MYLIBDIR/kamctl.base' - exiting ...\n" - exit -1 -fi - # ##### ------------------------------------------------ ##### ### DBENGINE

14 years, 4 months

git:master: modules_k/regex Fixed a memory leak when using pcre regex

by Marius Zbihlei

Module: sip-router Branch: master Commit: d1d17a9c02ed4ff7d69024d4eb92369da66c3e20 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=d1d17a9… Author: Marius Zbihlei <marius.zbihlei(a)1and1.ro> Committer: Marius Zbihlei <marius.zbihlei(a)1and1.ro> Date: Wed Sep 22 18:35:37 2010 +0300 modules_k/regex Fixed a memory leak when using pcre regex The compiled regular expression when using pcre_match was not freed. (cherry picked from commit 61f4d7f12723c4a3d989d37a414433e5ed71abff) --- modules_k/regex/regex_mod.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules_k/regex/regex_mod.c b/modules_k/regex/regex_mod.c index fcefa51..3610646 100644 --- a/modules_k/regex/regex_mod.c +++ b/modules_k/regex/regex_mod.c @@ -575,9 +575,10 @@ static int w_pcre_match(struct sip_msg* _msg, char* _s1, char* _s2) LM_DBG("matching error '%d'\n", pcre_rc); break; } + pcre_free(pcre_re); return -1; } - + pcre_free(pcre_re); LM_DBG("'%s' matches '%s'\n", string.s, regex.s); return 1; }

14 years, 4 months

SF.net SVN: openser:[6043] branches/1.5/modules/regex/regex_mod.c

by Inaki Baz Castillo

Revision: 6043 http://openser.svn.sourceforge.net/openser/?rev=6043&view=rev Author: ibc_sf Date: 2010-09-22 21:23:04 +0000 (Wed, 22 Sep 2010) Log Message: ----------- - regex module: Fixed memory leak in pcre_match(). Backported from Kamailio 3.0 (credits to marius zbihlei) http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=61f4d7f… Modified Paths: -------------- branches/1.5/modules/regex/regex_mod.c This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

14 years, 4 months

git:kamailio_3.0: modules_k/regex Fixed a memory leak when using pcre regex

by Marius Zbihlei

Module: sip-router Branch: kamailio_3.0 Commit: 61f4d7f12723c4a3d989d37a414433e5ed71abff URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=61f4d7f… Author: Marius Zbihlei <marius.zbihlei(a)1and1.ro> Committer: Marius Zbihlei <marius.zbihlei(a)1and1.ro> Date: Wed Sep 22 18:35:37 2010 +0300 modules_k/regex Fixed a memory leak when using pcre regex The compiled regular expression when using pcre_match was not freed. --- modules_k/regex/regex_mod.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules_k/regex/regex_mod.c b/modules_k/regex/regex_mod.c index fcefa51..3610646 100644 --- a/modules_k/regex/regex_mod.c +++ b/modules_k/regex/regex_mod.c @@ -575,9 +575,10 @@ static int w_pcre_match(struct sip_msg* _msg, char* _s1, char* _s2) LM_DBG("matching error '%d'\n", pcre_rc); break; } + pcre_free(pcre_re); return -1; } - + pcre_free(pcre_re); LM_DBG("'%s' matches '%s'\n", string.s, regex.s); return 1; }

14 years, 4 months

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev