3 Dec
2019
3 Dec
'19
6:37 p.m.
Hi Aymeric
Try to use force_rport() after sl_send_reply:
secf_check_ua();
if ($? == -2) {
force_rport();
sl_send_reply("200", "OK");
exit;
}
For secf_check_sqli_all() the module drops the packet if a sqli is
detected in any header but for other functions as secf_check_sqli_ua() it
returns a negative code for detection and you choose if you want to drop
the packet or not
Regards
On Tue, 3 Dec 2019 at 15:48, Aymeric Moizard <amoizard(a)gmail.com> wrote:
Hi all,
I'm testing and moving my kamailio script to use the newer secfilter
module.
In the past, I was replying "200 Ok" to "friendly scanners"...
With the newer secfilter module, it looks like I can't send a reply with
"sl_send_reply("200", "OK")"
secf_check_ua();
if ($? == -2) {
sl_send_reply("200", "OK");
exit;
}
I have read the code of the secfilter, but I was not able to see any
specific code to silently discard the SIP request.
I can see in the documentation about "secf_check_sqli_all", that the SIP
message is supposed to be "dropped". I can see "w_check_sqli_all"
returns 0
on detection and w_check_ua returns -2 upon detection.
Are the message discarded because a negative value was returned?
Would it be doable, using the secfilter, to still reply 200 Ok?
Regards
Aymeric
--
Antisip - http://www.antisip.com
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users(a)lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users