<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<font face="monospace">Hi Vincent,<br>
<br>
Welcome with the first post.<br>
<br>
Just a wild guess about your issue - the detection of what SIP
domains are to be locally handled. For example, in your pastebin,
like 249 you have the block for doing user authentication and
authorization. And the logic there is : if the caller belongs to a
local SIP domain, do auth - fine; but if the caller is not local,
the call is allowed if the callee SIP domain is local. So if some
foo caller is calling <a class="moz-txt-link-freetext" href="sip:DID@your_sip_domain">sip:DID@your_sip_domain</a>, your configuration
will allow the call to go further in the script (as it is
targeting a local domain of yours).<br>
And later, like 354 you do diversion to PSTN, but without checking
who the caller is (a local or foreign domain, which was auth'ed or
not). Do you see the issue?<br>
<br>
Fixes are: <br>
<br>
a) on the 267 `else` branch (if the caller is not local), do all
the time the 403 reply, disregarding what the called number is. So
you will accept only calls from your users.<br>
<br>
or <br>
<br>
b) when doing the PSTN diversion at 354 line, check if the caller
is a local user, to be sure PSTN calls are available only for your
own users. Add `</font><font face="monospace">is_from_local()` to
the condition there.<br>
<br>
Best regards,<br>
</font>
<pre class="moz-signature" cols="72">Bogdan-Andrei Iancu
OpenSIPS Founder and Developer
<a class="moz-txt-link-freetext" href="https://www.opensips-solutions.com">https://www.opensips-solutions.com</a>
OpenSIPS eBootcamp
<a class="moz-txt-link-freetext" href="https://www.opensips.org/Training/Bootcamp">https://www.opensips.org/Training/Bootcamp</a></pre>
<div class="moz-cite-prefix">On 1/18/22 3:23 PM, Vincent Swart
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAJxPoCeapVfuumT0eXXxJ7VSjYXMgk2xgCaPjAtcvUoJMBj84g@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div>First post!</div>
<div><br>
</div>
<div>So yesterday I installed the latest from Debian 10 repo and
the latest cp web app using a method similar to
powerpbxdotorg howto.</div>
<div>I had 5060 open in my firewall, two user phones configured
with strong passwords, and a gateway with IP auth for
termination.</div>
<div>Within 10 minutes calls were being placed via
unauthenticated invites I think. </div>
<div><br>
</div>
<div>I used the residential config script with a minor beginner
destination number pattern match difference:<br>
</div>
<a href="https://pastebin.com/GPrMcWYK" moz-do-not-send="true">https://pastebin.com/GPrMcWYK</a>
<div><br>
<div>if
($rU=~"^[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]+$")
{<br>
#if (dp_translate(10,"$rU/$rU") ) {<br>
#strip(1);
<div><br>
</div>
<div>The opensips log has a lot of this in it all the time:</div>
<div>Jan 17 15:56:04 dsip1 /usr/sbin/opensips[24971]:
CRITICAL:db_mysql:wrapper_single_mysql_stmt_execute:
driver error (1048): Column 'to_tag' cannot be null<br>
Jan 17 15:56:04 dsip1 /usr/sbin/opensips[24971]:
ERROR:acc:acc_db_request: failed to insert into acc table<br>
</div>
<div><br>
</div>
<div>The illicit calls start in the log like this:</div>
<div><a href="https://pastebin.com/mCNXqK7T"
moz-do-not-send="true">https://pastebin.com/mCNXqK7T</a></div>
<div>I can post the full log but it will take some time to
sanitize.</div>
<div><br>
</div>
<div>Sip call ID links in CDR viewer show this: "Sorry , sip
trace for this call is unavailable."</div>
<div>There are also only 0 durations on all legs however
they incurred duration and billing on termination.</div>
<div>I'm fairly certain the calls were not placed via the
user phone accounts because of strong passwords.</div>
<div>My next steps are to disable the gateway and packet
capture on the interface to investigate illicit invites.</div>
<div><br>
</div>
<div>
<div>Where do I even start investigating how
unauthenticated invites were placed and prevent it in
the opensips config?</div>
<div>Any suggestions would be greatly appreciated.</div>
</div>
<div><br>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a>
<a class="moz-txt-link-freetext" href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a>
</pre>
</blockquote>
<br>
</body>
</html>