21 Oct
2015
21 Oct
'15
3:59 p.m.
On 21 Oct 2015, at 14:51, Guillaume
<tetram100(a)hotmail.fr> wrote:
But why don't you implement this feature after your demo at kamailio world? Do you
think it's useless at the end?
I have it implemented, but in a routing script.
It’s not useless, but not the full function. You need to be able to reuse
breadth and a script can’t easily do that - only TM knows if there’s a branch failure and
can restart another branch that was previously blocked. Move to kind of semi-serial
forking based on available resources instead of going parallell.
And how your script was working with kamailio ?
Just fine :-)
But I guess you want another answer. I calculated the number of branches in each fork and
added the required headers when sending downstream. Without it Kamailio would eat up my
laptop and eventually explode and crash.
With it, a lot of branches was blocked and the network (and my laptop) saved.
I will have to dig up the scripts, written on the flights back home from SIPit, to be able
to remember exactly how I did it.
I do believe we will have to do something to TM so that TM knows the allowed number of
branches and keeps control of it. We have some hooks for branch failures now that may be
used to improve my script - so it may be easier to get it done properly without source
code changes today.
Max-breadth is critical to avoid flooding of a network when forking.
/O
Thanks for your response
Guillaume
From: oej(a)edvina.net <mailto:oej@edvina.net>
Date: Wed, 21 Oct 2015 14:15:43 +0200
To: miconda(a)gmail.com <mailto:miconda@gmail.com>
CC: sr-users(a)lists.sip-router.org <mailto:sr-users@lists.sip-router.org>
Subject: Re: [SR-Users] Implementation of RFC 5393
On 21 Oct 2015, at 14:09, Daniel-Constantin Mierla <miconda(a)gmail.com
<mailto:miconda@gmail.com>> wrote:
Hello,
checking the IP in the Via headers can be done in config file using a while loop:
$var(i) = 0;
while($(hdr(Via)[$var(i)])!=$null) {
# use transformations to extract the IP in $(hdr(Via)[$var(i)]) and test it against
$Ri
...
$var(i) = $var(i) + 1;
}
Also, checking the max-breadth should be possible in config file -- iirc, Olle played
with it at one of the SIPit events I attended, maybe he can add more details here. I
haven't read the RFC 5393 to be able to provide an example here.
I have a kind-of working solution in script, that I used in the Dangerous Demos at
kamailio world.
If someone wants to add a module to simplify the config, he/she is welcome to do it.
:-)
I think it needs to have hooks into tm.
/O
Cheers,
Daniel
On 21/10/15 10:35, Guillaume wrote:
Hi guys,
What do you think about the RFC 5393 on loop detection and amplification attack
protection?
The RFC is short and still a proposed standard but don't you think it could be useful
to prevent loop and amplification attack? Because even if the max-forward field reduces
the loop to ~70 hosts (in most cases) with some techniques we could fork the message up to
2^70 messages (as described in the RFC) to crash the servers.
Basically the server has to do 2 things:
* check if it is not already in the via of the message
* the previous check is not enough as a B2BUA could have replace the via headers, so the
RFC introduces a new field called max-breadth to limit the forking.
I have not seen a lot of implementation of this RFC on the free SIP software and I think
it could be a good way to improve kamailio making a module for it (the easier way to
implement this feature I think).
In fact I'm in a research internship about VoIP security and I have time to develop
such a module for kamailio if you think it's a good idea (I'm looking for some
security improvements in free software solutions so if you have other idea don't
hesitate to tell me).
Cheers,
Tetram
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users(a)lists.sip-router.org <mailto:sr-users@lists.sip-router.org>
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
<http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users>
--
Daniel-Constantin Mierla
http://twitter.com/#!/miconda <http://twitter.com/#%21/miconda> -
http://www.linkedin.com/in/miconda <http://www.linkedin.com/in/miconda>
Book: SIP Routing With Kamailio - http://www.asipto.com <http://www.asipto.com/>
_______________________________________________ SIP Express Router (SER) and Kamailio
(OpenSER) - sr-users mailing list sr-users(a)lists.sip-router.org
<mailto:sr-users@lists.sip-router.org>
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
<http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users>_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users(a)lists.sip-router.org <mailto:sr-users@lists.sip-router.org>
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
<http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users>