[Spce-user] catch null useragent in register or invite.

[Barry Flanagan]

On 15 Feb 2016 13:07, "gerry kernan" <gerry.kernan at infinityit.ie> wrote:
>
> Hi
>
>
>
> I’m using the line in below kamailio-loadbalancer to catch any malicious
registers or invites from known malicious UA types. I’ve noticed recently
that we are getting invites and registers without any UA, I’m trying to
catch these attempts with
>
>
>
> $ua == "<null>"  but I’m not catching them, is the syntax correct ?. all
other regex are catching correctly so maybe <null> is incorrect.
>

Hi Gerry,

I think it is $null you are looking for

-Barry Flanagan
>
>
>
>
> if(is_method("REGISTER|INVITE") && ($ua =~ "^friendly.+" || $ua =~
"^sipvici.+" || $ua =~ "^sipcli.+" || $ua =~ "^VaxSIPUser.+" || $ua ==
"MizuPhone" || $ua == "voip" || $ua == "<null>"))
>
>         {
>
>                 xlog("L_WARN", "Request rejected, malicious UA='$ua'
IP='$si' - [% logreq_init -%]\n");
>
>                 exit;
>
>
>
>
>
>
>
>
>
> Gerry Kernan
>
>
>
>
>
> Infinity IT   |   17 The Mall   |   Beacon Court   |   Sandyford   |
Dublin D18 E3C8   |   Ireland
>
> Tel:  +353 - (0)1 - 293 0090   |   E-Mail:  gerry.kernan at infinityit.ie
>
>
>
> Managed IT Services       Infinity IT - www.infinityit.ie
>
> IP Telephony                    Asterisk Consulting –
www.asteriskconsulting.com
>
> Contact Centre                Total Interact – www.totalinteract.com
>
>
>
>
> _______________________________________________
> Spce-user mailing list
> Spce-user at lists.sipwise.com
> https://lists.sipwise.com/listinfo/spce-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20160215/6d54e6dd/attachment-0001.html>