FS-10009: mod_fail2ban - Added logging of network_ip for abandoned calls

This commit is contained in:
Sergey Safarov 2017-02-05 19:01:09 -05:00
parent c9befbeae6
commit 6c12f69e0c
4 changed files with 5 additions and 0 deletions

View File

@ -611,6 +611,7 @@ switch_status_t sofia_on_hangup(switch_core_session_t *session)
if (cause == SWITCH_CAUSE_WRONG_CALL_STATE) {
switch_event_t *s_event;
if (switch_event_create_subclass(&s_event, SWITCH_EVENT_CUSTOM, MY_EVENT_WRONG_CALL_STATE) == SWITCH_STATUS_SUCCESS) {
switch_event_add_header_string(s_event, SWITCH_STACK_BOTTOM, "from_user", tech_pvt->from_user);
switch_event_add_header_string(s_event, SWITCH_STACK_BOTTOM, "network_ip", tech_pvt->mparams.remote_ip);
switch_event_add_header(s_event, SWITCH_STACK_BOTTOM, "network_port", "%d", tech_pvt->mparams.remote_port);
switch_event_fire(&s_event);

View File

@ -796,6 +796,7 @@ struct private_object {
sofia_profile_t *profile;
char *reply_contact;
char *from_uri;
char *from_user;
char *to_uri;
char *callid;
char *contact_url;

View File

@ -10214,6 +10214,7 @@ void sofia_handle_sip_i_invite(switch_core_session_t *session, nua_t *nua, sofia
}
tech_pvt->from_user = switch_core_session_strdup(session, sip->sip_from->a_url->url_user);
tech_pvt->mparams.remote_ip = switch_core_session_strdup(session, network_ip);
tech_pvt->mparams.remote_port = network_port;

View File

@ -84,6 +84,8 @@ static void fail2ban_event_handler(switch_event_t *event)
fail2ban_logger("A registration was attempted", switch_event_get_header(event, "to-user"), switch_event_get_header(event, "network-ip"));
} else if (strncmp(event->subclass_name, "sofia::register_failure",23) == 0) {
fail2ban_logger("A registration failed", switch_event_get_header(event, "to-user"), switch_event_get_header(event, "network-ip"));
} else if (strncmp(event->subclass_name, "sofia::wrong_call_state",23) == 0) {
fail2ban_logger("Abandoned call from ", switch_event_get_header(event, "from_user"), switch_event_get_header(event, "network_ip"));
}
}
}