Forum Discussion

Evelin_195902's avatar
Evelin_195902
Icon for Nimbostratus rankNimbostratus
Aug 21, 2015

SIP irule for checking dialed string

Hi guys, Please help me with creating na irule for checking a dialed string in SIP INVITE request. I need to drop every call that has !=8 or !=0 symbols in the SIP INVITE. Like this:

sip:3286184@206.81.166.10

I need to strip only "3286184" portion, then check if it has 8 or 0 symbols, if not I have to drop the call.

That's the irule I've made but it's not working for some reason...

when SIP_REQUEST {
set meeting_nbr [findstr [SIP::header "INVITE"] ":" 1 "@"]
if { not [string length $meeting_nbr] == 8} || { not [string length $meeting_nbr] == 0} {
log local0. "SIP Drop [SIP::uri]"
    drop
        }
}

Please help.

thanks.

application delivery
devops
irule
iRules
LTM
sip
  • SyedNazir_20946's avatar
    SyedNazir_20946
    Historic F5 Account
    Aug 23, 2015

    Hi Evelin,

    Check below rule. Correct the syntax for regexp if there is any issue.

    when SIP_REQUEST {

   set meeting_nbr [findstr [SIP::to] ":" 1 "@"]
   if { [regexp {^([0-9]+)$} $meeting_nbr]} {
       log local0. "SIP Drop [SIP::uri]"
       drop
   }
}

    -- Syed Nazir

  • Evelin_195902's avatar
    Evelin_195902
    Icon for Nimbostratus rankNimbostratus
    Sep 17, 2015

    Thanks Syed, It's a bit more complicated because we may have valid SIP request without any meeting number: like sip: or sip:.

    Here is the final version of my irule:

    when SIP_REQUEST {
    if { [SIP::method] == "INVITE" && [SIP::uri] matches_regex {^.+@.+$} }
    {
        if { not ([SIP::uri] matches_regex {^(sip:|sips:)[0-9]{7}@}) }
        {            
            log local0. "SIP Drop for [SIP::uri] from [IP::remote_addr] - possible frauder"
            drop   
        }

    }
}

    I hope this can be useful for other people having similar case.

    regards, Evelin