lisglosips/tests/reports/REMOTE_PERFORMANCE_SECURITY_DISRUPTIVE_20260629T062920Z.md

Remote Performance, Fault, and Security Disruptive Test Report

Date: 2026-06-29T06:29:20Z Base URL: https://100.90.90.91 Scope: 8.9 disruptive / SIP-side follow-up after REMOTE_PERFORMANCE_SECURITY_20260629T061621Z.md

Baseline

Result	Check	Detail
PASS	B services active before/after run	lisglosips@api, lisglosips@cdr-worker, lisglosips@recording-worker, mysql, redis-server all active
PASS	A services active before run	opensips, rtpengine-daemon, rtpengine-recording-daemon, lisglosips-redis-auth-proxy all active
PASS	T services active before run	lisglosips-s28-uas, opensips active
PASS	Final HTTPS smoke	/, /api/v2/health/live, /api/v2/health/ready, /api/v2/auth/captcha all PASS; latest smoke report REMOTE_SMOKE_20260629T062920Z.md

SIP Concurrency

Result	Check	Detail
PASS	PERF-001 5 concurrent calls	5/5 received 100 Giving it a try, 200 OK, and BYE 200 OK
PASS	PERF-001 CDR verification	5/5 call IDs found in /api/v2/cdrs?take=100
PASS	PERF-001 recording verification	5/5 call IDs found in /api/v2/recordings?limit=100
PASS	PERF-002 12 short-burst calls	12/12 received 100 Giving it a try, 200 OK, and BYE 200 OK
PASS	PERF-002 CDR verification	12/12 call IDs found in /api/v2/cdrs?take=100
PASS	PERF-002 recording verification	12/12 call IDs found in /api/v2/recordings?limit=100 after worker catch-up wait

5-call IDs:

• s28-1782714314674-tprj1vk2@lisglosips-t
• s28-1782714314655-ye44k7c7@lisglosips-t
• s28-1782714314670-zqsgouuh@lisglosips-t
• s28-1782714314677-vkrthfau@lisglosips-t
• s28-1782714314679-j47gb9tl@lisglosips-t

12-call IDs:

• s28-1782714339590-pi088vy9@lisglosips-t
• s28-1782714339585-t0wbt40b@lisglosips-t
• s28-1782714339580-ooqd773x@lisglosips-t
• s28-1782714339585-b38gwxb1@lisglosips-t
• s28-1782714339585-wn61wl1x@lisglosips-t
• s28-1782714339573-w6xxwzmp@lisglosips-t
• s28-1782714339589-lxrh6ht3@lisglosips-t
• s28-1782714339581-usu8mnjx@lisglosips-t
• s28-1782714339590-51r89nel@lisglosips-t
• s28-1782714339589-63h8mpr7@lisglosips-t
• s28-1782714339584-kmbwlurm@lisglosips-t
• s28-1782714339575-kv082r5b@lisglosips-t

Security Probes

Result	Check	Detail
PASS	SEC-001 illegal-source SIP probe	From B to A 100.90.90.90:15060, Call-ID codex89-illegal-1782714470-8090@lisglosips-b, no response within 3s
WARN	SEC-002 20-call CPS burst	20/20 INVITE received 200 OK, but 20/20 BYE returned 403 Rate Limited
PASS	SEC-002 recovery after burst	One normal call after 5s recovered and received BYE 200 OK; Call-ID s28-1782714527323-zdscgrrx@lisglosips-t

Fault Injection

Result	Check	Detail
BLOCKED	FAIL-001 Recording Worker stop/recover	B sudo -n true returns sudo-needs-password; current SSH user cannot stop/start services non-interactively
BLOCKED	FAIL-002 CDR Worker stop/recover	Same sudo blocker
BLOCKED	FAIL-003 MySQL short outage	Same sudo blocker
BLOCKED	FAIL-004 Redis short outage	Same sudo blocker

Findings

• CPS burst behavior needs review: rate limiting appears to affect in-dialog BYE requests after the INVITE has already succeeded with 200 OK. The system recovers for subsequent calls, but BYE 403 Rate Limited can leave call teardown semantics ambiguous.
• Service-stop fault tests remain blocked until non-interactive sudo is available or the sudo password is provided through an approved secure channel. I did not attempt to guess or bypass sudo.

Final State

• B services checked active after the run.
• HTTPS smoke after the run passed.
• No service was left intentionally stopped.