<p dir="ltr">Hi Matthew,<br>
This has never been included in templates even in the latest 3.8.1. So you have to backported.</p>
<p dir="ltr">Daniel</p>
<div class="gmail_quote">On May 10, 2015 7:14 PM, Matthew Ogden <matthew@tenacit.net> wrote:<br type='attribution'><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi<div><br /></div><div>Thought, I'd raise this again. I've upgraded to to the lastest templates for 2.8 LTS, I see I still need to use my own Stale nonce check. Did you guys decide not to handle this, or is it an option based setting in version 3?</div><div><br /></div><div>Kind Regards</div></div><div><br /><div class="elided-text">On 31 January 2014 at 15:26, Daniel Grotti <span dir="ltr"><<a href="mailto:dgrotti@sipwise.com">dgrotti@sipwise.com</a>></span> wrote:<br /><blockquote style="margin:0 0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex">Yes,<br />
see my last email:<br />
<br />
<br />
Matthew,<br />
the case is here:<br />
<br />
/etc/ngcp-config/templates/etc/kamailio/proxy/kamailio.cfg.tt2<br />
<br />
Search for "stale".<br />
<br />
The second change you have to do in LB is here:<br />
<br />
/etc/ngcp-config/templates/etc/kamailio/lb/kamailio.cfg.tt2<br />
<br />
<br />
#!ifdef ENABLE_AUTHCHECK<br />
if((status == "401" || status == "407") &&<br />
is_present_hf("P-NGCP-Authorization") && !is_present_hf("P-NGCP-Stale"))<br />
<br />
<br />
adding the last string "&& !is_present_hf("P-NGCP-Stale")", so count the<br />
number of 407 if and only if it's a non-Stale 407.<br />
<font color="#888888"><br />
<br />
Daniel<br />
</font><div><div><br />
<br />
<br />
<br />
<br />
<br />
On 01/31/2014 02:15 PM, Matthew Ogden wrote:<br />
> Hi Daniel,<br />
><br />
> Did you manage to check that out in 2.8?<br />
><br />
> REgards<br />
><br />
>> -----Original Message-----<br />
>> From: Daniel Grotti [mailto:<a href="mailto:dgrotti@sipwise.com">dgrotti@sipwise.com</a>]<br />
>> Sent: 29 January 2014 12:17 PM<br />
>> To: <a href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</a><br />
>> Cc: Matthew Ogden<br />
>> Subject: Re: [Spce-user] Asterisk client issues<br />
>><br />
>> Hi,<br />
>> I briefly checked 3.0 templates.<br />
>> let me check 2.8.<br />
>><br />
>> Daniel<br />
>><br />
>><br />
>><br />
>><br />
>> On 01/29/2014 10:16 AM, Matthew Ogden wrote:<br />
>>> I'm not sure where the proxy case statement is supposed to be, on<br />
>>> 2.8.18 templates, in proxy config there is no other case statements.<br />
>>> (LB modification was easy enough to find)<br />
>>><br />
>>> So not sure which route section it should be in, or what the previous<br />
>>> case statement was checking against.<br />
>>><br />
>>> Kind Regards<br />
>>><br />
>>>> -----Original Message-----<br />
>>>> From: Matthew Ogden [mailto:<a href="mailto:matthew@tenacit.net">matthew@tenacit.net</a>]<br />
>>>> Sent: 29 January 2014 11:07 AM<br />
>>>> To: 'Daniel Grotti'; '<a href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</a>'<br />
>>>> Subject: RE: [Spce-user] Asterisk client issues<br />
>>>><br />
>>>> Thanks Daniel<br />
>>>><br />
>>>> Can I just put this in words of what you have explained to make sure<br />
>>>> I understand?<br />
>>>><br />
>>>> The proxy is what is checking the for the stale nonce. So we make it<br />
>>> tag it.<br />
>>>> Then we are modifying the authban on the LB to ignore 401 and 407<br />
>>>> requests that have that flag.<br />
>>>><br />
>>>> I just wanted to also check, what are the risks of ingoring the stale<br />
>>> nonce?<br />
>>>> Since in any event, the DOS attack prevention will still check for<br />
>>> someone<br />
>>>> sending too many requests per second anyway? So additional risks is<br />
> low?<br />
>>>><br />
>>>> Kind Regards<br />
>>>><br />
>>>>> -----Original Message-----<br />
>>>>> From: Daniel Grotti [mailto:<a href="mailto:dgrotti@sipwise.com">dgrotti@sipwise.com</a>]<br />
>>>>> Sent: 28 January 2014 04:40 PM<br />
>>>>> To: <a href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</a><br />
>>>>> Cc: Matthew Ogden<br />
>>>>> Subject: Re: [Spce-user] Asterisk client issues<br />
>>>>><br />
>>>>> Of course, sorry, dos...you have the block of the user.<br />
>>>>><br />
>>>>> You can add a custom header in /proxy/kamailio.cfg.customtt.tt2 in<br />
>>>>> case of stale nonce error, like "NGCP-X: Stale".<br />
>>>>><br />
>>>>> So when you process the 407 reply on LB kamailio.cfg only if that<br />
>>>>> header is not present.<br />
>>>>><br />
>>>>> Try to add the following in /proxy/<a href="http://kamailio.cfg.customtt.tt">kamailio.cfg.customtt.tt</a>:<br />
>>>>><br />
>>>>><br />
>>>>> case -4:<br />
>>>>> xlog("L_NOTICE", "Authentication failed, stale nonce - [%<br />
>>>>> logreq<br />
>>> -%]\n");<br />
>>>>> append_to_reply("P-NGCP-Stale: yes\r\n");<br />
>>>>><br />
>>>>><br />
>>>>><br />
>>>>><br />
>>>>> then in lb/kamailio.cfg.customtt.tt2, you can test if the header<br />
>>> exist:<br />
>>>>><br />
>>>>><br />
>>>>> #!ifdef ENABLE_AUTHCHECK<br />
>>>>> if((status == "401" || status == "407") &&<br />
>>>>> is_present_hf("P-NGCP-Authorization") &&<br />
>>>>> !is_present_hf("P-NGCP-Stale"))<br />
>>>>><br />
>>>>><br />
>>>>><br />
>>>>> Daniel<br />
>>>>><br />
>>>>><br />
>>>>><br />
>>>>><br />
>>>>> On 01/28/2014 03:20 PM, Matthew Ogden wrote:<br />
>>>>>> I don't have many static IP subscribers, though in the case of this<br />
>>>>>> one, it is already in dos_whitelisted_ips of config.yml, but the<br />
>>>>>> nonce issue still happens to it.<br />
>>>>>><br />
>>>>>><br />
>>>>>><br />
>>>>>>> -----Original Message-----<br />
>>>>>>> From: <a href="mailto:spce-user-bounces@lists.sipwise.com">spce-user-bounces@lists.sipwise.com</a> [mailto:<a href="mailto:spce-user-">spce-user-</a><br />
>>>>>>> <a href="mailto:bounces@lists.sipwise.com">bounces@lists.sipwise.com</a>] On Behalf Of Daniel Grotti<br />
>>>>>>> Sent: 28 January 2014 04:17 PM<br />
>>>>>>> To: <a href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</a><br />
>>>>>>> Subject: Re: [Spce-user] Asterisk client issues<br />
>>>>>>><br />
>>>>>>> Hi Matthew,<br />
>>>>>>> what if you insert your Asterisk's IP in "dos_whitelisted_ips:"<br />
>>> line ?<br />
>>>>>>><br />
>>>>>>> Daniel<br />
>>>>>>><br />
>>>>>>><br />
>>>>>>><br />
>>>>>>><br />
>>>>>>><br />
>>>>>>><br />
>>>>>>> On 01/27/2014 04:35 PM, Matthew Ogden wrote:<br />
>>>>>>>> Did you guys end up making a decision on this? I still have<br />
>>>>>>>> Asterisk subscribers causing auth fail with stale nonce<br />
>>> situations.<br />
>>>>>>>><br />
>>>>>>>><br />
>>>>>>>><br />
>>>>>>>><br />
>>>>>>>> On Fri, Jul 19, 2013 at 4:12 PM, Jon Bonilla<br />
>>>>>>>> <<a href="mailto:jbonilla@sipwise.com">jbonilla@sipwise.com</a> <mailto:<a href="mailto:jbonilla@sipwise.com">jbonilla@sipwise.com</a>>> wrote:<br />
>>>>>>>><br />
>>>>>>>> El Fri, 19 Jul 2013 16:11:22 +0200<br />
>>>>>>>> Jon Bonilla (Manwe) <<a href="mailto:jbonilla@sipwise.com">jbonilla@sipwise.com</a><br />
>>>>>>>> <mailto:<a href="mailto:jbonilla@sipwise.com">jbonilla@sipwise.com</a>>> escribió:<br />
>>>>>>>><br />
>>>>>>>> > El Fri, 19 Jul 2013 16:03:54 +0200<br />
>>>>>>>> > Matthew Ogden <<a href="mailto:matthew@tenacit.net">matthew@tenacit.net</a><br />
>>>>>>> <mailto:<a href="mailto:matthew@tenacit.net">matthew@tenacit.net</a>>><br />
>>>>>>>> escribió:<br />
>>>>>>>> ><br />
>>>>>>>> > > Thanks<br />
>>>>>>>> > ><br />
>>>>>>>> > > What will happen if I disable it, and a outside IP<br />
>>>>>>>> attacks<br />
>>>>>> using<br />
>>>>>>>> this<br />
>>>>>>>> > > username?<br />
>>>>>>>> > ><br />
>>>>>>>> > > Will they be caught by flooding auth packets?<br />
>>>>>>>> > ><br />
>>>>>>>> ><br />
>>>>>>>> ><br />
>>>>>>>> > The auth_ban protection check failed auth attepmts from<br />
>>> multiple<br />
>>>>>>>> destinations<br />
>>>>>>>> > and protects against ddos attacks bypassing dos protection.<br />
>>>>>> These<br />
>>>>>>>> are quite<br />
>>>>>>>> > uncommon. The dos protection bans ip addresses if they send<br />
>>>> more<br />
>>>>>>>> than x<br />
>>>>>>>> > requests per second. This is more useful and it's the most<br />
>>>>>> common<br />
>>>>>>>> scenario.<br />
>>>>>>>> ><br />
>>>>>>>> > If an ip address tries to bruteforce attack your system,<br />
>>> that ip<br />
>>>>>>>> address will<br />
>>>>>>>> > be banned.<br />
>>>>>>>> ><br />
>>>>>>>><br />
>>>>>>>><br />
>>>>>>>> Anyways, we're discussing internally if the stale_nonce<br />
>>> situation<br />
>>>>>>>> should be<br />
>>>>>>>> excluded from the auth_check_ban protection for these<br />
>>> situations.<br />
>>>>>> We<br />
>>>>>>>> might<br />
>>>>>>>> change the ddos protection a little bit in future versions<br />
>>>>>>>><br />
>>>>>>>><br />
>>>>>>>><br />
>>>>>>>><br />
>>>>>>>> _______________________________________________<br />
>>>>>>>> Spce-user mailing list<br />
>>>>>>>> <a href="mailto:Spce-user@lists.sipwise.com">Spce-user@lists.sipwise.com</a><br />
>>>>>>>> <a href="http://lists.sipwise.com/listinfo/spce-user">http://lists.sipwise.com/listinfo/spce-user</a><br />
>>>>>>>><br />
>>>>>>><br />
>>>>>>> _______________________________________________<br />
>>>>>>> Spce-user mailing list<br />
>>>>>>> <a href="mailto:Spce-user@lists.sipwise.com">Spce-user@lists.sipwise.com</a><br />
>>>>>>> <a href="http://lists.sipwise.com/listinfo/spce-user">http://lists.sipwise.com/listinfo/spce-user</a><br />
</div></div></blockquote></div><br /><br clear="all" /><div><br /></div>-- <br /><div><div dir="ltr"><p> </p>
<p><span style="font-size:10pt;color:gray"><img src="http://www.tenacit.net/googlesig/tenacit.png" width="200" height="65" /></span><span style="font-size:10pt;color:gray"></span></p>
<p><span style="font-size:10pt;color:black"> </span></p>
<p><b><span style="font-size:12pt;color:#79ae52">Matthew Ogden</span></b></p>
<p><span style="font-size:10pt;color:gray">Management</span></p>
<p><span style="font-size:10pt;color:gray">TenacIT
</span></p>
<p><span style="font-size:10pt;color:gray"> </span></p>
<p><span style="color:gray;font-size:10pt"> </span><br /></p>
<p><b>Strategic IT Consulting </b><span style="font-size:12pt;color:#79ae52">•</span><b> Advanced Networking </b><span style="font-size:12pt;color:#79ae52">• </span><b>Virtualisation</b><span style="font-size:12pt;color:#79ae52"> </span><b></b></p>
<p><b>Custom Development </b><span style="font-size:12pt;color:#79ae52">•</span><b> </b><b>Hosting </b><span style="font-size:12pt;color:#79ae52">•</span><b> </b><b>Syspro Support </b><span style="font-size:12pt;color:#79ae52">• </span><b>MS Licensing</b><span style="font-size:12pt;color:#79ae52"> </span><b></b></p>
<p><span style="font-size:9pt;color:#a6a6a6">National Tel: </span><span style="font-size:9pt;color:gray">041 10 10 100
| </span><span style="font-size:9pt;color:#a6a6a6">Cell: </span><span style="font-size:9pt;color:gray">084 205 4445 | </span><span style="font-size:9pt;color:#a6a6a6">Email: </span><a href="mailto:matthew@tenacit.net"><span style="font-size:9pt;color:gray;text-decoration:none">matthew@tenacit.net</span></a><span style="font-size:9pt;color:#44546a"> </span><span style="font-size:9pt;color:gray"></span></p>
<p><span style="font-size:9pt;color:#a6a6a6">CT Tel: </span><span style="font-size:9pt;color:gray">021 201 0333 | </span><span style="font-size:9pt;color:#a6a6a6">Skype Name: </span><span style="font-size:9pt;color:gray">matthew.ogden | </span><span style="font-size:9pt;color:#a6a6a6">Web: </span><span style="font-size:9pt;color:#bce292;text-decoration:none"><a href="http://www.tenacit.net/">http://www.tenacit.net</a></span></p><p> <img src="http://www.tenacit.net/googlesig/bottom.png" /></p></div></div>
</div>
</blockquote></div>