Hello,

is there a mechanism to provoke a DELAY for certain incoming INVITES before passing them to the callee???

Just the single message needs to be delayed as the caller might be suspicios. I do already have a list in database and can check the caller against the list.

I do need something in routing logic to delay the current message WITHOUT slowing down kamailio and kill performance.

something like in this pseudo_code:

route{

if (is_method("INVITE") && !has_totag() ) { if (user_delaylist == TRUE){

delay_message_for(30 sec.);

} } }

Any ideas and suggestions are appreciated!

Regards,

Nicolas

On 10/26/2010 05:09 PM, Alex Balashov wrote:

Pike or ratelimit modules may facilitate this; otherwise, no.

-- Alex Balashov - Principal Evariste Systems LLC 1170 Peachtree Street 12th Floor, Suite 1200 Atlanta, GA 30309 Tel: +1-678-954-0670 Fax: +1-404-961-1892 Web: http://www.evaristesys.com/

On Oct 26, 2010, at 9:55 AM, "Nicolas Rüger"NicolasRueger@gmx.de wrote:

...

Hello,

is there a mechanism to provoke a DELAY for certain incoming INVITES before passing them to the callee???

Hello, It is not a good design practice to do it synchronously, mainly because the worker process will remain blocked for 30s . Imagine an attacker sending 30 requests and DoS the whole server , because of the limited number of worker process (not to mention that 30s delay means retrasmits from the TM layer- so these need to be handled by tm before the "sleep").

Anyway I wouldn't recommend a design like this. As others suggested pike and ratelimite (mostly ratelimit) will allow you to drop calls from attackers. You could add a Retry-After header so to inform a normal UA to retry the request after a number of seconds.

Marius

...

Just the single message needs to be delayed as the caller might be suspicios. I do already have a list in database and can check the caller against the list.

I do need something in routing logic to delay the current message WITHOUT slowing down kamailio and kill performance.

something like in this pseudo_code:

route{

if (is_method("INVITE")&& !has_totag() ) { if (user_delaylist == TRUE){

     delay_message_for(30 sec.);

}

} }

Any ideas and suggestions are appreciated!

Regards,

Nicolas

-- GRATIS! Movie-FLAT mit über 300 Videos. Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome

---

SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

---

SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

On 10/26/10 5:34 PM, "Nicolas Rüger" wrote:

Hello,

thank you. I see the problem with the worker processes now. I had a look at PIKE module and RATELIMIT module as well.

My idea was to delay the call WITHOUT sending any reply-message to the caller, as I wanted to save performance and I can identify suspicios users by a reputation that I compute before.

It seems the only way to do so, might be to store the INVITE information somewhere and keep on routing it again after a certain timeout.

Do you agree?

there is support in the code to suspend the transaction and resume the processing, iirc, look in tm module for t_suspend() function.

Right now you can do following: - set timeout to 30 sec - set failure route timeout - send the invite via udp to a invalid destination (e.g., your ip port 9) - when the 30sec will pass, the failure route timeout will be executed and you can do further routing.

Drawbacks - for the 30sec tm will do retransmission. To avoid that, run another kamailio on a different port where you send the invite and reply back 100 trying so first kamailio stops the retransmission.

Cheers, Daniel

Regards,

Nicolas

...

On 10/26/2010 05:09 PM, Alex Balashov wrote:

...

Pike or ratelimit modules may facilitate this; otherwise, no.

...

...

Hello, It is not a good design practice to do it synchronously, mainly because the worker process will remain blocked for 30s . Imagine an attacker sending 30 requests and DoS the whole server , because of the limited number of worker process (not to mention that 30s delay means retrasmits from the TM layer- so these need to be handled by tm before the "sleep").

Anyway I wouldn't recommend a design like this. As others suggested pike and ratelimite (mostly ratelimit) will allow you to drop calls from attackers. You could add a Retry-After header so to inform a normal UA to retry the request after a number of seconds.

Marius

Hi Alex,

NO that definitely NOT the motive!!!

I do write my master's thesis about SPIT prevention (SPAM over Internet Telephony) and I try to implement several ideas in kamailio to detect SIP-URI's that try to "spit".

So don't worry...I won't use your help to do illegal stuff! Hope that's clarified.

Amongst other ideas I try to implement a functionality that matches a suspicios caller's identity on a list in the database.

Afterwards the caller is either rejected or delayed, depending on his reputation that I compute before using other ideas.

I want to delay some of these suspicios calls instead of rejecting them completly as rejecting a call is really hard.

Further I expect automatically initiated calls to have a timeout. If the "spitting" party won't get an answer fast enough it might walk on and try another IP.

The idea is indeed adapted from the "e-mail world".

Regards,

Nicolas

-------- Original-Nachricht --------

Datum: Tue, 26 Oct 2010 11:47:52 -0400 Von: Alex Balashov abalashov@evaristesys.com An: sr-users@lists.sip-router.org Betreff: Re: [SR-Users] provoke delay?

I get this question a lot privately from people who want to play games to pad out the billable time in a call by sitting on it for a while before passing it up to their vendors/upstreams.

If by chance that is the real motive, don't do it. :-) It's far more trouble than it's worth.

-- Alex Balashov - Principal Evariste Systems LLC 1170 Peachtree Street 12th Floor, Suite 1200 Atlanta, GA 30309 Tel: +1-678-954-0670 Fax: +1-404-961-1892 Web: http://www.evaristesys.com/

---

SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

Interesting stuff!

Just to clarify, I was not accusing you. I was being a little tongue- in-cheek. :)

-- Alex Balashov - Principal Evariste Systems LLC 1170 Peachtree Street 12th Floor, Suite 1200 Atlanta, GA 30309 Tel: +1-678-954-0670 Fax: +1-404-961-1892 Web: http://www.evaristesys.com/

On Oct 26, 2010, at 1:33 PM, "Nicolas Rüger" NicolasRueger@gmx.de wrote:

Hi Alex,

NO that definitely NOT the motive!!!

I do write my master's thesis about SPIT prevention (SPAM over Internet Telephony) and I try to implement several ideas in kamailio to detect SIP-URI's that try to "spit".

So don't worry...I won't use your help to do illegal stuff! Hope that's clarified.

Amongst other ideas I try to implement a functionality that matches a suspicios caller's identity on a list in the database.

Afterwards the caller is either rejected or delayed, depending on his reputation that I compute before using other ideas.

I want to delay some of these suspicios calls instead of rejecting them completly as rejecting a call is really hard.

Further I expect automatically initiated calls to have a timeout. If the "spitting" party won't get an answer fast enough it might walk on and try another IP.

The idea is indeed adapted from the "e-mail world".

Regards,

Nicolas

-------- Original-Nachricht --------

...

Datum: Tue, 26 Oct 2010 11:47:52 -0400 Von: Alex Balashov abalashov@evaristesys.com An: sr-users@lists.sip-router.org Betreff: Re: [SR-Users] provoke delay?

...

I get this question a lot privately from people who want to play games to pad out the billable time in a call by sitting on it for a while before passing it up to their vendors/upstreams.

If by chance that is the real motive, don't do it. :-) It's far more trouble than it's worth.

-- Alex Balashov - Principal Evariste Systems LLC 1170 Peachtree Street 12th Floor, Suite 1200 Atlanta, GA 30309 Tel: +1-678-954-0670 Fax: +1-404-961-1892 Web: http://www.evaristesys.com/

---

SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

-- Neu: GMX De-Mail - Einfach wie E-Mail, sicher wie ein Brief! Jetzt De-Mail-Adresse reservieren: http://portal.gmx.net/de/go/demail