<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi Gerry,<br>
please try this in kamilio/proxy/kamailio.cfg it works for me.<br>
For the null, try to check <span
style="font-size:10.0pt;font-family:"Lucida Console"">$ua
== $null:</span><br>
<br>
<br>
if( is_method("REGISTER|INVITE") && $sp != "5080" &&
!has_totag() )<br>
{<br>
if(<span
style="font-size:10.0pt;font-family:"Lucida Console"">$ua
=~ "^friendly.+" || $ua =~ "^sipvici.+" || $ua =~ "^sipcli.+" ||
$ua =~ "^VaxSIPUser.+" || $ua == "MizuPhone" || $ua == "voip" ||
$ua == $null</span> )<br>
{<br>
xlog("L_NOTICE", "UA='$ua' rejected - S=$rs
SS='$rr' M=$rm R=$ru F=$fu T=$tu IP=$pr:$si:$sp UAIP=$si UA='$ua'
ID=$ci \n");<br>
exit;<br>
}<br>
}<br>
##end<br>
<br>
<br>
<br>
I would be careful for the $null, cause you may reject good
messages, just without User-Agent header.<br>
<br>
<br>
<br>
<br>
<div class="moz-signature">
<div style="line-height:16px; margin:6px 0; padding:8px 8px 8px
8px; border-top:1px #aeb1a6 dotted; border-bottom:1px #aeb1a6
dotted; font-family: 'Lucida Sans', Lucida Grande, Verdana,
Arial, Sans-Serif; font-size:11px; color:#555555;"> <strong
style="color:#333333; text-transform:uppercase;
font-size:10px;"> Daniel Grotti </strong> <br>
Head of Customer Support
<p> <a href="http://www.sipwise.com" style="color:rgb(0, 136,
204) !important; text-decoration:none !important;
border-bottom:1px dotted #AAA;"> Sipwise GmbH </a> , Campus
21/Europaring F15<br>
AT-2345 Brunn am Gebirge </p>
<p> Phone: <a href="callto:+4313012032" style="color:rgb(0,
136, 204) !important; text-decoration:none !important;
border-bottom:1px dotted #AAA;"> +43(0)1 301 2032 </a> <br>
Email: <a href="mailto:dgrotti@sipwise.com"
style="color:rgb(0, 136, 204) !important;
text-decoration:none !important; border-bottom:1px dotted
#AAA;"> dgrotti@sipwise.com </a> <br>
Website: <a href="http://www.sipwise.com"
style="color:rgb(0, 136, 204) !important;
text-decoration:none !important; border-bottom:1px dotted
#AAA;"> www.sipwise.com </a> </p>
<p>
Particulars according Austrian Companies Code paragraph 14<br>
"Sipwise GmbH" - Europaring F15 - 2345 Brunn am Gebirge<br>
FN:305595f, Commercial Court Vienna, ATU64002206
</p>
</div>
</div>
<div class="moz-cite-prefix">On 02/15/2016 02:06 PM, gerry kernan
wrote:<br>
</div>
<blockquote
cite="mid:1e44bc87-3db2-46c3-a7b0-ef8ed228d351@infinityit.ie"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Century Gothic";
panose-1:2 11 5 2 2 2 2 2 2 4;}
@font-face
{font-family:"Lucida Console";
panose-1:2 11 6 9 4 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m using the line in below
kamailio-loadbalancer to catch any malicious registers or
invites from known malicious UA types. I’ve noticed recently
that we are getting invites and registers without any UA, I’m
trying to catch these attempts with <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Lucida
Console"">$ua == "<null>" but I’m not catching
them, is the syntax correct ?. all other regex are catching
correctly so maybe <null> is incorrect.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Lucida
Console"">if(is_method("REGISTER|INVITE") &&
($ua =~ "^friendly.+" || $ua =~ "^sipvici.+" || $ua =~
"^sipcli.+" || $ua =~ "^VaxSIPUser.+" || $ua == "MizuPhone"
|| $ua == "voip" || $ua == "<null>"))<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Lucida
Console""> {<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Lucida
Console""> xlog("L_WARN", "Request
rejected, malicious UA='$ua' IP='$si' - [% logreq_init
-%]\n");<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span
style="font-size:10.0pt;font-family:"Lucida
Console""> exit;<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span
style="font-size:12.0pt;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE"
lang="NL">Gerry Kernan</span></b><span
style="font-size:12.0pt;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE"
lang="NL"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Century
Gothic",sans-serif;color:gray;mso-fareast-language:EN-IE"
lang="NL"> <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Century
Gothic",sans-serif;color:gray;mso-fareast-language:EN-IE"><img
id="Picture_x0020_3"
src="cid:part5.06050906.04090202@sipwise.com"
alt="cid:image001.jpg@01D105A5.2701B0E0" height="51"
width="172"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Century
Gothic",sans-serif;color:gray;mso-fareast-language:EN-IE"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE">Infinity
IT | 17 The Mall | Beacon Court | Sandyford
| Dublin D18 E3C8 | Ireland<o:p></o:p></span></b></p>
<p class="MsoNormal" style="line-height:115%"><b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE">Tel:
+353 - (0)1 - 293 0090 | E-Mail: </span></b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;mso-fareast-language:EN-IE"><a
moz-do-not-send="true"
href="mailto:gerry.kernan@infinityit.ie"><span
style="color:#0563C1"><a class="moz-txt-link-abbreviated" href="mailto:gerry.kernan@infinityit.ie">gerry.kernan@infinityit.ie</a></span></a><b><span
style="color:red"><o:p></o:p></span></b></span></p>
<p class="MsoNormal" style="line-height:115%"><b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:red;mso-fareast-language:EN-IE"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="line-height:115%"><b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:red;mso-fareast-language:EN-IE">Managed IT
Services<u> </u>Infinity IT</span></b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:red;mso-fareast-language:EN-IE"> </span><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE">- </span><span
style="font-size:12.0pt;line-height:115%;mso-fareast-language:EN-IE"><a
moz-do-not-send="true" href="http://www.infinityit.ie/"><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#0563C1"><a class="moz-txt-link-abbreviated" href="http://www.infinityit.ie">www.infinityit.ie</a></span></a></span><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#767171;mso-fareast-language:EN-IE">IP
Telephony<u> </u>Asterisk Consulting</span></b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#767171;mso-fareast-language:EN-IE"> </span><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE">– </span><span
style="font-size:12.0pt;line-height:115%;mso-fareast-language:EN-IE"><a
moz-do-not-send="true"
href="http://www.asteriskconsulting.com"><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#0563C1"><a class="moz-txt-link-abbreviated" href="http://www.asteriskconsulting.com">www.asteriskconsulting.com</a></span></a></span><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:115%"><b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#FF8A15;mso-fareast-language:EN-IE">Contact
Centre<u> </u>Total Interact</span></b><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#FFC000;mso-fareast-language:EN-IE"> </span><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE">– </span><span
style="font-size:12.0pt;line-height:115%;mso-fareast-language:EN-IE"><a
moz-do-not-send="true" href="http://www.totalinteract.com"><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#0563C1"><a class="moz-txt-link-abbreviated" href="http://www.totalinteract.com">www.totalinteract.com</a></span></a></span><span
style="font-size:10.0pt;line-height:115%;font-family:"Century
Gothic",sans-serif;color:#4D4D4D;mso-fareast-language:EN-IE"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Spce-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Spce-user@lists.sipwise.com">Spce-user@lists.sipwise.com</a>
<a class="moz-txt-link-freetext" href="https://lists.sipwise.com/listinfo/spce-user">https://lists.sipwise.com/listinfo/spce-user</a>
</pre>
</blockquote>
<br>
</body>
</html>