[OpenSIPS-Users] Attack with UA: firendly-scanner

[Ovidiu Sas]

Put an exit after sl_send_reply().  You are looping the REGISTER
through your server.
Or just don't even bother sending a reply back, just exit.

Regards,
Ovidiu Sas

On Tue, Jun 28, 2011 at 5:55 PM, Mike Tesliuk <mike at ultra.net.br> wrote:
> Hello,
>
>
> Im new to Opensips and im getting an attack that i can read the ip just on
> the first register, the attacker are sending my own ip on the sip package
>
>
> on the begin of my main route i put the rule below
>
>
>
>         if($ua=~"friendly-scanner"){
>                 xlog("L_NOTICE","Auth error for $fU@$fd from $Ri cause
> $var(auth_code)");
>                 xlog("FRIENDLY-SCANNER: UA: $ua From_TAG: $ft From_URI: $fu
> Received IP: $Ri IP Source: $si");
>                 sl_send_reply("403", "Access Denied");
>         }
>
>
> Small time later the attacker start the attack i get this message
>
>
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:_reply_light: failed
> to allocate shmem buffer
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc: Not
> enough free memory, will atempt defragmenation
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:relay_reply: no more
> share memory
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc: Not
> enough free memory, will atempt defragmenation
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:_reply_light: failed
> to allocate shmem buffer
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc: Not
> enough free memory, will atempt defragmenation
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:relay_reply: no more
> share memory
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc: Not
> enough free memory, will atempt defragmenation
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:_reply_light: failed
> to allocate shmem buffer
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc: Not
> enough free memory, will atempt defragmenation
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:relay_reply: no more
> share memory
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc: Not
> enough free memory, will atempt defragmenation
> Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:_reply_light: failed
> to allocate shmem buffer
>
>
>
> i can get the log, but the ip that i show is my own, how can i block this
> kind of attack ?
>
> Thanks
>
>
> below you have the firs 3 packages that i can get on ngrep (the
> XXX.XXX.XXX.XXX is my IP)
>
> U 2011/06/28 17:46:11.898262 60.171.75.147:5100 -> XXX.XXX.XXX.XXX:5060
> REGISTER sip:XXX.XXX.XXX.XXX SIP/2.0.
> Via: SIP/2.0/UDP 127.0.0.1:5100;branch=z9hG4bK-693079904;rport.
> Content-Length: 0.
> From: "6362" <sip:6362 at XXX.XXX.XXX.XXX>.
> Accept: application/sdp.
> User-Agent: friendly-scanner.
> To: "6362" <sip:6362 at XXX.XXX.XXX.XXX>.
> Contact: sip:123 at 1.1.1.1.
> CSeq: 1 REGISTER.
> Call-ID: 1696826551.
> Max-Forwards: 70.
> .
>
> #
> U 2011/06/28 17:46:11.899246 XXX.XXX.XXX.XXX:5060 -> XXX.XXX.XXX.XXX:5060
> REGISTER sip:XXX.XXX.XXX.XXX SIP/2.0.
> Via: SIP/2.0/UDP XXX.XXX.XXX.XXX;branch=z9hG4bKe9e1.7864db01.0.
> Via: SIP/2.0/UDP
> 127.0.0.1:5100;received=60.171.75.147;branch=z9hG4bK-693079904;rport=5100.
> Content-Length: 0.
> From: "6362" <sip:6362 at XXX.XXX.XXX.XXX>.
> Accept: application/sdp.
> User-Agent: friendly-scanner.
> To: "6362" <sip:6362 at XXX.XXX.XXX.XXX>.
> Contact: sip:123 at 1.1.1.1.
> CSeq: 1 REGISTER.
> Call-ID: 1696826551.
> Max-Forwards: 69.
> P-hint: outbound.
>
>
> #
> U 2011/06/28 17:46:11.899388 XXX.XXX.XXX.XXX:5060 -> XXX.XXX.XXX.XXX:5060
> REGISTER sip:XXX.XXX.XXX.XXX SIP/2.0.
> Via: SIP/2.0/UDP XXX.XXX.XXX.XXX;branch=z9hG4bKe9e1.8864db01.0.
> Via: SIP/2.0/UDP
> XXX.XXX.XXX.XXX;rport=5060;received=XXX.XXX.XXX.XXX;branch=z9hG4bKe9e1.7864db01.0.
> Via: SIP/2.0/UDP
> 127.0.0.1:5100;received=60.171.75.147;branch=z9hG4bK-693079904;rport=5100.
> Content-Length: 0.
> From: "6362" <sip:6362 at XXX.XXX.XXX.XXX>.
> Accept: application/sdp.
> User-Agent: friendly-scanner.
> To: "6362" <sip:6362 at XXX.XXX.XXX.XXX>.
> Contact: sip:123 at 1.1.1.1.
> CSeq: 1 REGISTER.
> Call-ID: 1696826551.
> Max-Forwards: 68.
> P-hint: outbound.
> P-hint: outbound.
> .
>
>
>
> _______________________________________________
> Users mailing list
> Users at lists.opensips.org
> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>
>