<div dir="ltr"><div dir="ltr">Hi Ben<div><br></div><div>I think that's the problem, it should be identifying $retcode 1 at which point I'd see a log entry "CUSTOM_LOG: Client authenticated" but instead it's falling into the cases for -1, -2, -3</div><div><br></div><div>The 2nd log line shows the return code.</div><div><br></div><div>TIA</div><div>Mark.</div><div><br></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 3 Sep 2019 at 14:32, Ben Newlin <<a href="mailto:Ben.Newlin@genesys.com">Ben.Newlin@genesys.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-3202784979326153166WordSection1">
<p class="MsoNormal">Mark,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The logs you provided don’t show the code hitting the case for 1 at all. Have you verified the value of $retcode is what you think it is? You might consider adding it to the log print.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="color:black">Ben Newlin </span><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-style:solid none none;border-top-width:1pt;border-top-color:rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">Users <<a href="mailto:users-bounces@lists.opensips.org" target="_blank">users-bounces@lists.opensips.org</a>> on behalf of Mark Farmer <<a href="mailto:farmorg@gmail.com" target="_blank">farmorg@gmail.com</a>><br>
<b>Reply-To: </b>OpenSIPS users mailling list <<a href="mailto:users@lists.opensips.org" target="_blank">users@lists.opensips.org</a>><br>
<b>Date: </b>Tuesday, September 3, 2019 at 9:25 AM<br>
<b>To: </b>OpenSIPS users mailling list <<a href="mailto:users@lists.opensips.org" target="_blank">users@lists.opensips.org</a>><br>
<b>Subject: </b>[OpenSIPS-Users] Switch Statement Trouble<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Hi everyone, can anyone tell me what's going wrong here please?
<u></u><u></u></p>
<div>
<p class="MsoNormal">I'm having a problem with my switch statement in that $retcode 1 ends up falling into the processing for -1, -2, -3<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"># If the client is not already authenticated, check the return code and look for multiple failures<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> www_authorize("", "subscriber");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> switch ($retcode)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> case 0: # false<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: Client NOT authenticated");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> break;<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> case 1: # true<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: Client authenticated");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> break;<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> case -3: # stale nonce<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> case -2: # invalid passwd<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> case -1: # no such user<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: Failed Authentication Attempt (Return Code: $retcode) for $ru To: $tu - Checking for Dictionary attack");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> # Is the attribute AuthFail_$si present in cache?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> if ( cache_fetch("local","AuthFail_$si",$avp(failed_no)) ) {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: Failure Attempts for $ru ($fU) is now $avp(failed_no) (Return Code: $retcode)");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> # If so, how many failures so far?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> if ( $(avp(failed_no){<a href="http://s.int" target="_blank">s.int</a>}) >= $var(max_auth_fail) ) {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: SECURITY ALERT: $var(max_auth_fail) failed auth attempts for $fU from $si - Blocking IP Address");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> # Looks like bad people - Block the source IP<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> exec("sudo /sbin/ipset add $var(ipset) $$SIP_SRCIP");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: $si added to ipset $var(ipset))");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> exit;<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> }<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> # If authentication is failing, increment the value of AuthFail_$si by 1<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: Incrementing AuthFail_$si");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> cache_add("local","AuthFail_$si",1,60);<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> } else {<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> # If the attribute AuthFail_$si is not present - add it<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: Adding Cache entry AuthFail_$si");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> cache_store("local","AuthFail_$si","1",60);<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> }<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> break;<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> default:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> # If non of the above is true, try to authenticate the user<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> xlog("CUSTOM_LOG: No Subscriber in database for $ru ($fU) - Challenging");<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> www_challenge("", 0);<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> }<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">--------------<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">From my logs:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">CUSTOM_LOG: Failed Authentication Attempt (Return Code: 1) for sip:XXX.XXX.XXX.XXX To: sip:5003@XXX.XXX.XXX.XXX - Checking for Dictionary attack<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">CUSTOM_LOG: Failure Attempts for sip:XXX.XXX.XXX.XXX (5003) is now 1 (Return Code: 1)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">CUSTOM_LOG: Incrementing AuthFail_XXX.XXX.XXX.XXX<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Version info:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">version: opensips 3.0.0 (x86_64/linux)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">flags: STATS: On, DISABLE_NAGLE, USE_MCAST, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, HP_MALLOC, DBG_MALLOC, CC_O0, FAST_LOCK-ADAPTIVE_WAIT<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">poll method support: poll, epoll, sigio_rt, select.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">git revision: 435890a06<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">main.c compiled on 13:19:25 Jun 21 2019 with gcc 7<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Many thanks<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Mark.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Mark Farmer<br><a href="mailto:farmorg@gmail.com" target="_blank">farmorg@gmail.com</a></div>