[Spce-user] Upgrade from 5.5.5 to 6.5.3 - Block Useragent Edit

[Hohl Matthias]

Fixed:

 

xlog("L_NOTICE", "Request rejected, bad UA='$ua' from IP=$avp(s:ip) - [% logreq_init -%]\n");

 

Mar 26 12:47:51 spce proxy[29951]: NOTICE: <script>: Request rejected, bad UA='sipcli/v1.8' from IP=77.247.109.76 - M=INVITE R=sip:800970597655261 at 176.xxxxx F=sip:201 at 176.xxxxx T=sip:800970597655261 at 176.xxxxx IP=77.247.109.76:5070 (127.0.0.1:5060) ID=6193ce2a63fc92f81b2a09ed243c3cc9 UA='sipcli/v1.8' DESTIP=127.0.0.1:5062

 

Von: Spce-user <spce-user-bounces at lists.sipwise.com> Im Auftrag von Hohl Matthias
Gesendet: Dienstag, 26. März 2019 11:52
An: 'Alex Lutay' <alutay at sipwise.com>; spce-user at lists.sipwise.com
Betreff: Re: [Spce-user] Upgrade from 5.5.5 to 6.5.3 - Block Useragent Edit

 

Hmm… it looks like that the variable $si just show me the local ip 127.0.0.1

Can you tell me the variable for the IP address information in the logreq_init string?

 

xlog("L_NOTICE", "Request rejected, bad UA='$ua' from IP=$si - [% logreq_init -%]\n");

 

Mar 26 11:48:24 spce proxy[5311]: NOTICE: <script>: Request rejected, bad UA='sipcli/v1.8' from IP=127.0.0.1 - M=INVITE R=sip:900970597655261 at 176.xxx.xxx.xxx F=sip:201 at 176. xxx.xxx.xxx T=sip:900970597655261 at 176. xxx.xxx.xxx IP=77.247.109.76:5074 (127.0.0.1:5060) ID=7b16b03278e2d069914dc96fdce9b7ae UA='sipcli/v1.8' DESTIP=127.0.0.1:5062

 

 

Von: Spce-user <spce-user-bounces at lists.sipwise.com <mailto:spce-user-bounces at lists.sipwise.com> > Im Auftrag von Alex Lutay
Gesendet: Dienstag, 26. März 2019 10:35
An: spce-user at lists.sipwise.com <mailto:spce-user at lists.sipwise.com> 
Betreff: Re: [Spce-user] Upgrade from 5.5.5 to 6.5.3 - Block Useragent Edit

 

Hi,

I have requested debug level change here, TT#56052.
Meanwhile you have to use one of the ways you described.

INFO level will increase logs size but
it should not be a dramatical increase.

Sure you can change tt2 template, use patchtt framework for this.

Have fun!

On 3/26/19 10:29 AM, Hohl Matthias wrote:
> Oh okay..
> 
> so to get fail2ban to work for this, I have to change the debug level to
> 2, but this will produce very big log files, or I change the
> kamailio.tt2 from xlog(“L_INFO” to xlog(“L_NOTICE
> 
> Right?

-- 
Alex Lutay
_______________________________________________
Spce-user mailing list
Spce-user at lists.sipwise.com <mailto:Spce-user at lists.sipwise.com> 
https://lists.sipwise.com/listinfo/spce-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20190326/a096fc4a/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6564 bytes
Desc: not available
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20190326/a096fc4a/attachment-0001.p7s>