<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I want to understand why that variable is not populated and see if it can be instead of adding a new channel variable, correct.<div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 12, 2015, at 4:02 PM, Sergey Safarov <<a href="mailto:s.safarov@gmail.com" class="">s.safarov@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Ken pull request has been created <a href="https://freeswitch.org/stash/projects/FS/repos/freeswitch/pull-requests/159/overview" class="">https://freeswitch.org/stash/projects/FS/repos/freeswitch/pull-requests/159/overview</a><div class="">Mike rightly said that it is necessary to use a variable network_addr in caller profile</div><div class=""><div class=""><br class=""></div></div></div><div class="gmail_extra" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class=""><div class="gmail_quote">On Thu, Mar 12, 2015 at 11:46 PM, Ken Rice<span class="Apple-converted-space"> </span><span dir="ltr" class=""><<a href="mailto:krice@freeswitch.org" target="_blank" class="">krice@freeswitch.org</a>></span><span class="Apple-converted-space"> </span>wrote:<br class=""><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;"><div class=""><font face="Monaco, Courier New" class=""><span style="font-size: 11pt;" class="">Is there a pull request on that?<span class=""><br class=""><br class=""><br class="">On 3/12/15, 1:27 PM, "Ítalo Rossi" <<a href="http://italorossib@gmail.com/" target="_blank" class="">italorossib@gmail.com</a>> wrote:<br class=""><br class=""></span></span></font><blockquote class=""><span class=""><font face="Monaco, Courier New" class=""><span style="font-size: 11pt;" class="">I set the JIRA status as Needs Review, hope it get merged soon.<br class=""><br class="">On Thu, Mar 12, 2015 at 4:03 PM, Sergey Safarov <<a href="http://s.safarov@gmail.com/" target="_blank" class="">s.safarov@gmail.com</a>> wrote:<br class=""></span></font></span><blockquote class=""><span class=""><font face="Monaco, Courier New" class=""><span style="font-size: 11pt;" class="">Ítalo I am not rewrite patch set use network_addr in caller profile and path not merget to master.<br class=""><font color="#888888" class=""><br class="">Sergey<br class=""></font><br class="">On Thu, Mar 12, 2015 at 7:51 PM, Ítalo Rossi <<a href="http://italorossib@gmail.com/" target="_blank" class="">italorossib@gmail.com</a>> wrote:<br class=""></span></font></span><blockquote class=""><span class=""><font face="Monaco, Courier New" class=""><span style="font-size: 11pt;" class=""><br class="">Version?<br class=""><br class="">I'm almost sure this is already implemented in master.<span class="Apple-converted-space"> </span><br class=""><br class="">Em 12/03/2015 13:43, "Kyle King" <<a href="http://kyle.king@quentustech.com/" target="_blank" class="">kyle.king@quentustech.com</a>> escreveu:<br class=""></span></font></span><blockquote class=""><span class=""><font face="Monaco, Courier New" class=""><span style="font-size: 11pt;" class="">Have you tried mod_fail2ban?<span class="Apple-converted-space"> </span><br class=""><br class="">On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <<a href="http://lists@telefaks.de/" target="_blank" class="">lists@telefaks.de</a>> wrote:<br class=""></span></font></span><blockquote class=""><font face="Monaco, Courier New" class=""><span style="font-size: 11pt;" class=""><span class=""> Hello,<br class=""> <br class=""> we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers<br class=""> Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.<br class=""> <br class=""> In the Freeswitch log we see:<br class=""> 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel<span class="Apple-converted-space"> </span><a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>[167bb9ee-c8d0-11e4-9f31-b39e581405c5]<br class=""> 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal<span class="Apple-converted-space"> </span><a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>[BREAK]<br class=""> 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal<span class="Apple-converted-space"> </span><a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>[BREAK]<br class=""> 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 (<a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>) Running State Change CS_NEW<br class=""></span> 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841<span class="Apple-converted-space"> </span><a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>receiving invite from<span class="Apple-converted-space"> </span><a href="http://155.94.64.26:5076/" target="_blank" class="">155.94.64.26:5076</a><<a href="http://155.94.64.26:5076/" target="_blank" class="">http://155.94.64.26:5076</a>> version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit<span class=""><br class=""> 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth.<br class=""> 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 (<a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>) State NEW<br class=""> 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal<span class="Apple-converted-space"> </span><a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>[BREAK]<br class=""> 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5<br class=""> 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5<span class="Apple-converted-space"> </span><a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>Abandoned <span class="Apple-converted-space"> </span><br class=""> <br class=""> The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.<br class=""> <br class=""> The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.<span class="Apple-converted-space"> </span><br class=""> <br class=""> So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"?<br class=""> Example for extending a current log line<br class=""> <span class="Apple-converted-space"> </span>2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5<span class="Apple-converted-space"> </span><a href="http://sofia/internal/149@10.11.12.13" target="_blank" class="">sofia/internal/149@10.11.12.13</a>Abandoned for IP 15.194.164.26<span class="Apple-converted-space"> </span><br class=""> This would enable us to process this entry with fail2ban and block this IP in the Firewall.<br class=""> <br class=""> Any other hint is welcome.<br class=""> <br class=""></span></span></font></blockquote></blockquote></blockquote></blockquote></blockquote></div></blockquote></div></div></div></blockquote></div><br class=""></div></body></html>