[Spce-user] kamailio hangs out after got call from anonymous

Tue May 5 04:03:23 EDT 2015

Hi,
I just checked and tested with mr3.8.1 the IP ban and failing
authentication and both works fine.
I can see IP and user banned in the web interface and I can remove them
from the list.

--
Daniel Grotti
VoIP Engineer

Sipwise GmbH
Europaring F15 | 2345 Brunn am Gebirge, Austria | www.sipwise.com

On 05/05/2015 01:06 AM, Tóth Csaba wrote:
> Dear Daniel, and SipWise Support Team,
> 
> during weekend i believe i pointed to two errors in the NGCP system
> (first is about a wrong auth request answer and the second is banned ips
> not shows up in the web interface).
> 
> I know this is a free support channel - and i really appreciate it! -
> but, will you confirm these are real bugs, and will you sometimes
> (preferably in the near future) come out with an official fix, or i
> shouldn't wait for it and should i do it for my own?
> 
> I already sended to Daniel in private pcap and log files, if you need
> any more information please let me know.
> 
> Thanks in advance,
> Csaba
> 
> 
> 
> 
> 2015.05.03. 0:45 keltezéssel, Daniel Grotti írta:
>> You can use:
>>
>> ngcp-kamctl lb fifo sht_dump ipban
>>
>> Daniel
>> On May 2, 2015 8:23 PM, Tóth Csaba <tsabi at tsabi.hu> wrote:
>>>
>>> Hi,
>>>
>>> one more thing, after NGCP bans this IP - as it says in the log - i
>>> don't see it in the "Security Bans" page of the web admin. Actually, it
>>> is completely empty - only the "XMLRPC not allowed" is in the IP Bans.
>>>
>>> Shouldn't it show up there? How can i decide whether the IP is banned or
>>> not? Is there a bash command to query the internal bans?
>>>
>>> At the moment only the restart of the kamailio processes helps to clear
>>> the ban.
>>>
>>> BR,
>>> Csaba
>>>
>>>
>>>
>>> 2015.04.30. 22:33 keltezéssel, Daniel Grotti írta:
>>>> Hi,
>>>> I don't see a crash.
>>>> The IP fails to register and also is sending a flood of INVITEs at the
>>>> same second, and the IP gets banned.
>>>>
>>>>
>>>> Apr 30 14:12:37 sip proxy[13651]: WARNING: <script>: Mark host as banned
>>>> - S=<null> SS='<null>' M=INVITE R=sip:06203225742 at sip.entelefonom.hu
>>>>
>>>>
>>>> this is why ngcp does not accept any other request from that ip.
>>>>
>>>>
>>>>
>>>> --
>>>> Daniel Grotti
>>>> VoIP Engineer
>>>>
>>>>
>>>> Sipwise GmbH
>>>> Europaring F15 | 2345 Brunn am Gebirge, Austria | www.sipwise.com
>>>>
>>>> On 04/30/2015 05:41 PM, Tóth Csaba wrote:
>>>>> Hi,
>>>>>
>>>>> they attached.
>>>>> If you need full log i can send ofc.
>>>>>
>>>>> BR,
>>>>> Csaba
>>>>>
>>>>>
>>>>>
>>>>> 2015.04.30. 17:26 keltezéssel, Daniel Grotti írta:
>>>>>> Please share the kamailio-proxy.log.
>>>>>>
>>>>>> Daniel
>>>>>> On Apr 30, 2015 4:47 PM, Tóth Csaba <tsabi at tsabi.hu> wrote:
>>>>>>>
>>>>>>> Dear SipWise Team, 
>>>>>>>
>>>>>>> i use mr3.8.1 version. 
>>>>>>> Have a new customer, who uses a Avaya IP Office. When they make an 
>>>>>>> anonymous call the kamailio "crash", and from that don't accept any 
>>>>>>> other register from that host. Just a restart helps (but i restart both 
>>>>>>> of the proxy and lb, don't know which one solvs the issue). 
>>>>>>>
>>>>>>> The subscriber makes this call: 
>>>>>>>
>>>>>>> INVITE sip:BNUMBER at DOMAIN SIP/2.0 
>>>>>>> Via: SIP/2.0/UDP 
>>>>>>> 89.xx.xx.xx:5060;rport;branch=z9hG4bK9471122e5c5572b28fffd346d1f642f8 
>>>>>>> From: "Anonymous" <sip:anonymous at anonymous.invalid>;tag=7de012ee906d7bd5 
>>>>>>> To: <sip:BNUMBER at DOMAIN> 
>>>>>>> Call-ID: b6d1c9ab095bdf9e975810897ae3010a 
>>>>>>> CSeq: 153349233 INVITE 
>>>>>>> Contact: <sip:anonymous at 89.xx.xx.xx:5060;transport=udp> 
>>>>>>> Authorization: Digest 
>>>>>>> username="USERNAME",realm="DOMAIN",nonce="NONCE",response="RESP",uri="sip:BNUMBER at DOMAIN" 
>>>>>>> Max-Forwards: 70 
>>>>>>> Allow: INVITE,ACK,CANCEL,OPTIONS,BYE,INFO,NOTIFY,UPDATE 
>>>>>>> Content-Type: application/sdp 
>>>>>>> Supported: timer 
>>>>>>> User-Agent: IP Office 9.0.5.0 build 972 
>>>>>>> Privacy: id 
>>>>>>> P-Asserted-Identity: "USERNAME" <sip:USERNAME at 192.168.48.3:5060> 
>>>>>>> Content-Length: 300 
>>>>>>>
>>>>>>> v=0 
>>>>>>> o=UserA ..... ..... IN IP4 89.xx.xx.xx 
>>>>>>> s=Session SDP 
>>>>>>> c=IN IP4 89.xx.xx.xx 
>>>>>>> t=0 0 
>>>>>>> m=audio 49154 RTP/AVP 8 0 18 4 101 
>>>>>>> a=rtpmap:8 PCMA/8000 
>>>>>>> a=rtpmap:0 PCMU/8000 
>>>>>>> a=rtpmap:18 G729/8000 
>>>>>>> a=fmtp:18 annexb=no 
>>>>>>> a=rtpmap:4 G723/8000 
>>>>>>> a=rtpmap:101 telephone-event/8000 
>>>>>>> a=fmtp:101 0-15 
>>>>>>>
>>>>>>>
>>>>>>> SipWise NGCP system sends back a 407 reauth: 
>>>>>>>
>>>>>>> SIP/2.0 407 Proxy Authentication Required 
>>>>>>> Via: SIP/2.0/UDP 
>>>>>>> 89.xx.xx.xx:5060;rport=5060;branch=z9hG4bK9471122e5c5572b28fffd346d1f642f8 
>>>>>>> From: "Anonymous" <sip:anonymous at anonymous.invalid>;tag=7de012ee906d7bd5 
>>>>>>> To: <sip:BNUMBER at DOMAIN>;tag=1d24a28a0bded6c40d31e6db8aab9ac6.f9b1 
>>>>>>> Call-ID: b6d1c9ab095bdf9e975810897ae3010a 
>>>>>>> CSeq: 153349233 INVITE 
>>>>>>> P-NGCP-Auth-IP: 89.xx.xx.xx 
>>>>>>> P-NGCP-Auth-UA: IP Office 9.0.5.0 build 972 
>>>>>>> P-NGCP-Caller-Info: <sip:USER at DOMAIN>;ip=89.xx.xx.xx;port=5060 
>>>>>>> Proxy-Authenticate: Digest realm="anonymous.invalid", nonce="NONCE" 
>>>>>>> Server: Sipwise NGCP Proxy 3.X 
>>>>>>> Content-Length: 0 
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> Here the realm changed. And after this the Avaya tries to authenticate 
>>>>>>> using this realm, but fails all the time. Only the restart of the two 
>>>>>>> kamailio helps. 
>>>>>>>
>>>>>>> What can be wrong? 
>>>>>>>
>>>>>>> I can send the full pcap in private if that helps. 
>>>>>>>
>>>>>>> Thanks in advance! 
>>>>>>> Csaba Tóth 
>>>>>>> _______________________________________________ 
>>>>>>> Spce-user mailing list 
>>>>>>> Spce-user at lists.sipwise.com 
>>>>>>> https://lists.sipwise.com/listinfo/spce-user 
>>>>
>>>>
>>> _______________________________________________
>>> Spce-user mailing list
>>> Spce-user at lists.sipwise.com
>>> https://lists.sipwise.com/listinfo/spce-user