<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello all,<br>
<br>
While checking and tuning our FreeSWITCH configuration, I found out
that there is big difference of behaviour between the
apply-inbound-acl and apply-register-acl sofia sip profile
parameters.<br>
=> in the case of 'apply-inbound-acl', requests coming from an IP
present in the acl profile list will be authentified as the matching
account, which is OK.<br>
=> in the case of 'apply-register-acl', register requests coming
from an IP present in the acl profile list will be authorized (which
is OK), while being 'authentified' as the user specified in the SIP
request. I would have imagined that register requests would be
identified as the matching account as well. We end up in getting
crazy registrations (devices registered as user not existing in the
directory for instance), when customers' hardware are not permissive
enough to allow from (user@domain) field customisation (while
outgoing calls are perfectly working).<br>
<br>
Is that behaviour wanted by the community?<br>
<br>
I checked the source code which I reckon I am not familiar with at
all, and I found that:<br>
* apply-inbound-acl (sofia.c):<br>
<blockquote><small><tt>if (profile->acl_count) {</tt><tt><br>
</tt><tt> uint32_t x = 0;</tt><tt><br>
</tt><tt> int ok = 1;</tt><tt><br>
</tt><tt> char *last_acl = NULL;</tt><tt><br>
</tt><tt> const char *token = NULL;</tt><tt><br>
</tt><tt><br>
</tt><tt> for (x = 0; x <
profile->acl_count; x++) {</tt><tt><br>
</tt><tt> last_acl = profile->acl[x];</tt><tt><br>
</tt><tt> if ((ok =
switch_check_network_list_ip_token(network_ip, last_acl,
&token))) {</tt><tt><br>
</tt><tt><br>
</tt><tt> if
(profile->acl_pass_context[x]) {</tt><tt><br>
</tt><tt> acl_context =
profile->acl_pass_context[x];</tt><tt><br>
</tt><tt> }</tt><tt><br>
</tt><tt><br>
</tt><tt> break;</tt><tt><br>
</tt><tt> }</tt><tt><br>
</tt><tt><br>
</tt><tt> if
(profile->acl_fail_context[x]) {</tt><tt><br>
</tt><tt> acl_context =
profile->acl_fail_context[x];</tt><tt><br>
</tt><tt> } else {</tt><tt><br>
</tt><tt> acl_context = NULL;</tt><tt><br>
</tt><tt> }</tt><tt><br>
</tt><tt> }</tt><tt><br>
</tt><tt><br>
</tt><tt> if (ok) {</tt><tt><br>
</tt><tt> if (token) {</tt><tt><br>
</tt><tt>
switch_set_string(acl_token, token);</tt><tt><br>
</tt><tt> }</tt><tt><br>
</tt><tt> if (sofia_test_pflag(profile,
PFLAG_AUTH_CALLS)) {</tt><tt><br>
</tt><tt>
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "IP %s
Approved by acl \"%s[%s]\". Access Granted.\n",</tt><tt><br>
</tt><tt>
network_ip, switch_str_nil(last_acl), acl_token);</tt><tt><br>
</tt><tt>
switch_set_string(sip_acl_authed_by, last_acl);</tt><tt><br>
</tt><tt>
switch_set_string(sip_acl_token, acl_token);</tt><tt><br>
</tt><tt> is_auth = 1;</tt><tt><br>
</tt><tt> }</tt></small><tt><br>
</tt></blockquote>
* apply-register-acl (sofia_reg.c):<br>
<blockquote><small><tt>if (profile->reg_acl_count) {</tt><tt><br>
</tt><tt> uint32_t x = 0;</tt><tt><br>
</tt><tt> int ok = 1;</tt><tt><br>
</tt><tt> char *last_acl = NULL;</tt><tt><br>
</tt><tt><br>
</tt><tt> for (x = 0; x <
profile->reg_acl_count; x++) {</tt><tt><br>
</tt><tt> last_acl =
profile->reg_acl[x];</tt><tt><br>
</tt><tt> if (!(ok =
switch_check_network_list_ip(network_ip, last_acl))) {</tt><tt><br>
</tt><tt> break;</tt><tt><br>
</tt><tt> }</tt><tt><br>
</tt><tt> }</tt><tt><br>
</tt><tt><br>
</tt><tt> if (ok &&
!sofia_test_pflag(profile, PFLAG_BLIND_REG)) {</tt><tt><br>
</tt><tt> type = REG_AUTO_REGISTER;</tt><tt><br>
</tt></small></blockquote>
<br>
Is what I expect (similar behaviour in both cases) crazy to you? Or
does it sound right? <br>
<br>
In the latter case, should I open a JIRA case for somebody to push a
fix? <br>
I could try to 'fix' it myself (in case you consider it as a bug as
I do) but I am not really familiar with C development as well.<br>
<br>
Thank for your points of view!<br>
Regards<br>
Florent<br>
</body>
</html>