[Spce-user] Upgrade from 5.5.5 to 6.5.3 - Block Useragent Edit

[Hohl Matthias]

Thanks for the info:

 

Btw, if anybody need it, here is a list of malicious UA for copy&paste:

 

      ua_patterns: []

      - friendly-scanner

      - friendly-request

      - sipvicious

      - ^sipcli.+

      - sip-scan

      - sipsak

      - sundayddr

      - iWar

      - CSipSimple

      - SIVuS

      - Gulp

      - sipv

      - smap

      - VaxIPUserAgent

      - VaxSIPUserAgent

      - siparmyknife

      - Test Agent

 

Von: Spce-user <spce-user-bounces at lists.sipwise.com> Im Auftrag von Alex Lutay
Gesendet: Mittwoch, 20. März 2019 11:47
An: spce-user at lists.sipwise.com
Betreff: Re: [Spce-user] Upgrade from 5.5.5 to 6.5.3 - Block Useragent Edit

 

Hi,
On 3/20/19 11:40 AM, Hohl Matthias wrote:
> Oh okay thank you. In version 6.5.3 I didn’t found this information in
> the handbook 😊

Correct, it is new documentation and has been backported to mr6.5 LTS
already. It will be the part of the next mr6.5 build: mr6.5.4

> Thanks again. BTW: the xlog entry is also there then if something got
> blocked?

You can check it in kamailio tt2 config yourself ;-)

> if([% IF kamailio.proxy.block_useragents.mode == "whitelist" %]![% END %]([% FOREACH item IN kamailio.proxy.block_useragents.ua_patterns -%]$x_hdr(User-Agent) =~ "[% item %]"[% IF kamailio.proxy.block_useragents.ua_patterns.last != item %] || [% END %][% END -%]))
> {
> xlog("L_INFO", "Request rejected, bad UA='$x_hdr(User-Agent)' - [% logreq_init -%]\n");

-- 
Alex Lutay
_______________________________________________
Spce-user mailing list
Spce-user at lists.sipwise.com <mailto:Spce-user at lists.sipwise.com> 
https://lists.sipwise.com/listinfo/spce-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20190320/d7ede9b8/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6564 bytes
Desc: not available
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20190320/d7ede9b8/attachment-0001.p7s>