Hi, Is there anyway that I can instruct FS, not to send response to OPTIONS message that it has received from an IP or any IP. Thanks & Regards Suneel ************************************************************************* Please consider the environment before printing this e-mail ************************************************************************* This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.mettoni.com Mettoni Ltd Registered in England and Wales: 4485956 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN *************************************************************************
Hi Mic, In my set-up there is a gateway that is sending calls to FS. GW is configured with primary as FS1 and secondary as FS2. Here gateway sends OPTIONS message to both FS1 And FS2. If FS1 is responding then it is treated as alive and calls will be sent to FS1 only. If FS1 is not responding for 2 -3 OPTION messages, gateway treats it as dead and calls are sent to FS2. when there is any modification or upgrade needed to FS1, then I want stop responding to OPTIONS (so GW can send new calls to FS2) and wait till all existing calls at FS1 are cleared. Then I can perform upgrade on FS1. So is there anyway to instruct FS (through event sockets), not to respond to OPTIONS message received from the GW. Thanks & Regards Suneel From: freeswitch-dev-bounces@lists.freeswitch.org [mailto:freeswitch-dev-bounces@lists.freeswitch.org] On Behalf Of Michael Jerris Sent: 18 November 2009 17:53 To: freeswitch-dev@lists.freeswitch.org Subject: Re: [Freeswitch-dev] OPTIONS Why would you not want to respond to those? On Nov 18, 2009, at 12:07 PM, Suneel Papineni wrote: Hi, Is there anyway that I can instruct FS, not to send response to OPTIONS message that it has received from an IP or any IP. Thanks & Regards Suneel ************************************************************************* Please consider the environment before printing this e-mail ************************************************************************* This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.mettoni.com Mettoni Ltd Registered in England and Wales: 4485956 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN *************************************************************************
On Thu, 2009-11-19 at 13:23 +0000, Suneel Papineni wrote:
So is there anyway to instruct FS (through event sockets), not to respond to OPTIONS message received from the GW.
I would think that adding code to do that would cause some breakage. The better solution would be to have a trigger on your gateway to tell it to fail all calls over. If you did an ACL or packet filter or anything else, important messages may be lost. The exception would be if it does OPTIONS to a different port and you block that port only, so normal sip traffic goes through but the ping is stopped. This would be to a 2nd profile but the same instance of freeswitch, so it should work the same in terms of availability. You could modify sofia so that it could block this, but I do not think that it would be committed as a result you would have to maintain this out of tree. I could be wrong, it might get committed, but given that there are other solutions, and this one has some potential to create headaches for others I do not believe that it would.
-- Trixter http://www.0xdecafbad.com Bret McDanel pgp key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE5C721
Thanks Bret, but unfortunately I didn't have control on Gateway because it is a 3rd party (Except for adding primary and secondary FS IP addresses). So I need to do something at FS end only. -----Original Message----- From: freeswitch-dev-bounces@lists.freeswitch.org [mailto:freeswitch-dev-bounces@lists.freeswitch.org] On Behalf Of Trixter aka Bret McDanel Sent: 19 November 2009 13:44 To: freeswitch-dev@lists.freeswitch.org Subject: Re: [Freeswitch-dev] OPTIONS On Thu, 2009-11-19 at 13:23 +0000, Suneel Papineni wrote:
So is there anyway to instruct FS (through event sockets), not to respond to OPTIONS message received from the GW.
I would think that adding code to do that would cause some breakage. The better solution would be to have a trigger on your gateway to tell it to fail all calls over. If you did an ACL or packet filter or anything else, important messages may be lost. The exception would be if it does OPTIONS to a different port and you block that port only, so normal sip traffic goes through but the ping is stopped. This would be to a 2nd profile but the same instance of freeswitch, so it should work the same in terms of availability. You could modify sofia so that it could block this, but I do not think that it would be committed as a result you would have to maintain this out of tree. I could be wrong, it might get committed, but given that there are other solutions, and this one has some potential to create headaches for others I do not believe that it would.
-- Trixter http://www.0xdecafbad.com Bret McDanel pgp key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE5C721 _______________________________________________ FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org ************************************************************************* Please consider the environment before printing this e-mail ************************************************************************* This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.mettoni.com Mettoni Ltd Registered in England and Wales: 4485956 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN *************************************************************************
You cant block options but you can block new invites with "fsctl pause" That would cause the calls to fail over to the2nd route at least until the current calls are over. That is the only solution there is no way to not reply to options and there is nothing we can do to make that possible as it's a violation of the SIP spec. you would have to use a sip router like openser for that. On Thu, Nov 19, 2009 at 8:45 AM, Suneel Papineni < Suneel.Papineni@mettoni.com> wrote:
Thanks Bret, but unfortunately I didn't have control on Gateway because it is a 3rd party (Except for adding primary and secondary FS IP addresses). So I need to do something at FS end only.
-----Original Message----- From: freeswitch-dev-bounces@lists.freeswitch.org [mailto:freeswitch-dev-bounces@lists.freeswitch.org] On Behalf Of Trixter aka Bret McDanel Sent: 19 November 2009 13:44 To: freeswitch-dev@lists.freeswitch.org Subject: Re: [Freeswitch-dev] OPTIONS
On Thu, 2009-11-19 at 13:23 +0000, Suneel Papineni wrote:
So is there anyway to instruct FS (through event sockets), not to respond to OPTIONS message received from the GW.
I would think that adding code to do that would cause some breakage. The better solution would be to have a trigger on your gateway to tell it to fail all calls over.
If you did an ACL or packet filter or anything else, important messages may be lost. The exception would be if it does OPTIONS to a different port and you block that port only, so normal sip traffic goes through but the ping is stopped. This would be to a 2nd profile but the same instance of freeswitch, so it should work the same in terms of availability.
You could modify sofia so that it could block this, but I do not think that it would be committed as a result you would have to maintain this out of tree. I could be wrong, it might get committed, but given that there are other solutions, and this one has some potential to create headaches for others I do not believe that it would.
-- Trixter http://www.0xdecafbad.com Bret McDanel pgp key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE5C721
_______________________________________________ FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
************************************************************************* Please consider the environment before printing this e-mail ************************************************************************* This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.mettoni.com
Mettoni Ltd Registered in England and Wales: 4485956 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN *************************************************************************
_______________________________________________ FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
-- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:213-799-1400
Thanks Anthony, as you said it is a violation of SIP specs. I will try and see if your alternative suggestion works with my set-up. From: freeswitch-dev-bounces@lists.freeswitch.org [mailto:freeswitch-dev-bounces@lists.freeswitch.org] On Behalf Of Anthony Minessale Sent: 19 November 2009 15:24 To: freeswitch-dev@lists.freeswitch.org Subject: Re: [Freeswitch-dev] OPTIONS You cant block options but you can block new invites with "fsctl pause" That would cause the calls to fail over to the2nd route at least until the current calls are over. That is the only solution there is no way to not reply to options and there is nothing we can do to make that possible as it's a violation of the SIP spec. you would have to use a sip router like openser for that. On Thu, Nov 19, 2009 at 8:45 AM, Suneel Papineni <Suneel.Papineni@mettoni.com> wrote: Thanks Bret, but unfortunately I didn't have control on Gateway because it is a 3rd party (Except for adding primary and secondary FS IP addresses). So I need to do something at FS end only. -----Original Message----- From: freeswitch-dev-bounces@lists.freeswitch.org [mailto:freeswitch-dev-bounces@lists.freeswitch.org] On Behalf Of Trixter aka Bret McDanel Sent: 19 November 2009 13:44 To: freeswitch-dev@lists.freeswitch.org Subject: Re: [Freeswitch-dev] OPTIONS On Thu, 2009-11-19 at 13:23 +0000, Suneel Papineni wrote:
So is there anyway to instruct FS (through event sockets), not to respond to OPTIONS message received from the GW.
I would think that adding code to do that would cause some breakage. The better solution would be to have a trigger on your gateway to tell it to fail all calls over. If you did an ACL or packet filter or anything else, important messages may be lost. The exception would be if it does OPTIONS to a different port and you block that port only, so normal sip traffic goes through but the ping is stopped. This would be to a 2nd profile but the same instance of freeswitch, so it should work the same in terms of availability. You could modify sofia so that it could block this, but I do not think that it would be committed as a result you would have to maintain this out of tree. I could be wrong, it might get committed, but given that there are other solutions, and this one has some potential to create headaches for others I do not believe that it would.
-- Trixter http://www.0xdecafbad.com Bret McDanel pgp key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE5C721 _______________________________________________ FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org ************************************************************************ * Please consider the environment before printing this e-mail ************************************************************************ * This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.mettoni.com Mettoni Ltd Registered in England and Wales: 4485956 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN ************************************************************************ * _______________________________________________ FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org -- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com <mailto:MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com <mailto:PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <mailto:sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org <mailto:googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:213-799-1400 ************************************************************************* Please consider the environment before printing this e-mail ************************************************************************* This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.mettoni.com Mettoni Ltd Registered in England and Wales: 4485956 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN *************************************************************************
Hi Anthony, In case if an application is written to send continuous messages to FS, how to stop responding to that IP or stop messages reaching to FS from that IP. (like a DoS attack). Is there any provision at FS or do we need to take care at network router level with firewall configured properly. Thanks Suneel From: freeswitch-dev-bounces@lists.freeswitch.org [mailto:freeswitch-dev-bounces@lists.freeswitch.org] On Behalf Of Anthony Minessale Sent: 19 November 2009 15:24 To: freeswitch-dev@lists.freeswitch.org Subject: Re: [Freeswitch-dev] OPTIONS You cant block options but you can block new invites with "fsctl pause" That would cause the calls to fail over to the2nd route at least until the current calls are over. That is the only solution there is no way to not reply to options and there is nothing we can do to make that possible as it's a violation of the SIP spec. you would have to use a sip router like openser for that. On Thu, Nov 19, 2009 at 8:45 AM, Suneel Papineni <Suneel.Papineni@mettoni.com> wrote: Thanks Bret, but unfortunately I didn't have control on Gateway because it is a 3rd party (Except for adding primary and secondary FS IP addresses). So I need to do something at FS end only. -----Original Message----- From: freeswitch-dev-bounces@lists.freeswitch.org [mailto:freeswitch-dev-bounces@lists.freeswitch.org] On Behalf Of Trixter aka Bret McDanel Sent: 19 November 2009 13:44 To: freeswitch-dev@lists.freeswitch.org Subject: Re: [Freeswitch-dev] OPTIONS On Thu, 2009-11-19 at 13:23 +0000, Suneel Papineni wrote:
So is there anyway to instruct FS (through event sockets), not to respond to OPTIONS message received from the GW.
I would think that adding code to do that would cause some breakage. The better solution would be to have a trigger on your gateway to tell it to fail all calls over. If you did an ACL or packet filter or anything else, important messages may be lost. The exception would be if it does OPTIONS to a different port and you block that port only, so normal sip traffic goes through but the ping is stopped. This would be to a 2nd profile but the same instance of freeswitch, so it should work the same in terms of availability. You could modify sofia so that it could block this, but I do not think that it would be committed as a result you would have to maintain this out of tree. I could be wrong, it might get committed, but given that there are other solutions, and this one has some potential to create headaches for others I do not believe that it would.
-- Trixter http://www.0xdecafbad.com Bret McDanel pgp key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE5C721 _______________________________________________ FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org ************************************************************************ * Please consider the environment before printing this e-mail ************************************************************************ * This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.mettoni.com Mettoni Ltd Registered in England and Wales: 4485956 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN ************************************************************************ * _______________________________________________ FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org -- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com <mailto:MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com <mailto:PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <mailto:sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org <mailto:googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:213-799-1400 ************************************************************************* Please consider the environment before printing this e-mail ************************************************************************* This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.mettoni.com Mettoni Ltd Registered in England and Wales: 4485956 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN *************************************************************************
On Fri, 2009-11-20 at 11:15 +0000, Suneel Papineni wrote:
Hi Anthony,
In case if an application is written to send continuous messages to FS, how to stop responding to that IP or stop messages reaching to FS from that IP. (like a DoS attack). Is there any provision at FS or do we need to take care at network router level with firewall configured properly.
freeswitch is a switch and not a firewall. Because it runs in userspace, any packet that it gets goes through the kernel to the application. It would be better if you did it in the kernel (lower system load) but also network based problems like DoS attacks should be done on the network level and not the application level. If FS and similar programs had to do the DoS mitigation themselves for a flood of packets, in order to protect a network you would have to have several sets of code and it would be a nightmare. It would be better to look into it from a network perspective for that reason alone (presumably FS wont be the only thing on your network, you may have a database, and other items). With that in mind, you may want to look at fail2ban which is a linux iptable script which at least works with asterisk (so it should be able to be modified to properly work with FS) and it will automagically ban IPs for too many failed attempts to authenticate or other reasons. In addition you can set a threshold in most firewalls (even iptables) of how many packets per second per IP you allow. At one time I wrote a bunch of things on this subject, although I do not think I have them anymore, but when doing SIP you have to look at the exchange of packets per call, you may end up with several packets exchanged in a short period of time just to set up a call, but a generally safe rule of thumb is 10 packets per second per channel per ip for SIP (not RTP). RTP can easily be calculated based on the ptime you are using. This lets you do some DoS mitigation.
-- Trixter http://www.0xdecafbad.com Bret McDanel pgp key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x8AE5C721
man iptables /b On Nov 20, 2009, at 5:15 AM, Suneel Papineni wrote:
Hi Anthony,
In case if an application is written to send continuous messages to FS, how to stop responding to that IP or stop messages reaching to FS from that IP. (like a DoS attack). Is there any provision at FS or do we need to take care at network router level with firewall configured properly.
Thanks Suneel
participants (5)
-
Anthony Minessale
-
Brian West
-
Michael Jerris
-
Suneel Papineni
-
Trixter aka Bret McDanel