<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body smarttemplateinserted="true" text="#000000" bgcolor="#FFFFFF">
<div id="smartTemplate4-quoteHeader">
<div style="font-size:10.0pt;font-family:Verdana,Arial">Hi
Vallimamod,<br>
<br>
Thanks a lot for your detailed explanation, sure it helps! It
would be great to add these details to the documentation (not
sure whom to ask about this). IMO the behavior you describe
can't be inferred from the current documentation and it deals
with security/authentication.<br>
<br>
Could you please explain what would be the effect of <font
face="Courier New">auth-calls=true + auth-acl=<ip_range></font>?<br>
I suppose if the IP matches, it goes through the digest auth. If
the IP doesn't match, sofia responds with 403 forbidden, right?<br>
<br>
Thanks,<br>
Anatoli<br>
<br>
</div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0cm 0cm
0cm;font-size:10.0pt;font-family:"Tahoma","sans-serif""><b>From:</b>
Vallimamod Abdullah<br>
<b>Sent:</b> Tuesday, November 21, 2017 09:35<br>
<b>To:</b> Freeswitch Users Help<br>
<b>Subject:</b> Re: [Freeswitch-users] ACL: auth_calls +
apply-inbound-acl/auth-acl<br>
</div>
<br>
</div>
<span type="cite"
cite="mid:6BFB29AD-1424-4F13-A0DD-385C6C48DF6D@vallimamod.org"
style="display: block; word-break: break-all; margin: 7px 0 0 0;
padding: 0; line-height:0"></span>
<pre wrap="">Hi,
Your mail is dense, I will try to answer at my best from my understanding of the source code:
- the default value for auth-call is false.
- When a call arrives, the apply-inbound-acl is checked first:
* If the IP is approved by the acl, the access is granted
* If the IP is rejected by the acl and auth-call is false, sofia responds with 403 forbidden (I skip the proxy-acl and X-AUTH-IP checks for simplicity)
* If the IP is rejected by the acl and auth-call is true, it falls back to digest auth.
- If accept-blind-auth is set with auth-call, freeswitch only checks if the From user is defined in directory. If so, user is authorized (without any password check)
- If auth-cal is set without the acl, the call go through digest authentication
- If neither is set, the call is accepted.
In your case, even if you can define directly a cidr in the apply-inbound-acl param value, it would be best to set it to a list name defined in autoload_configs/acl.conf.xml.
Hope this helps!
</pre>
<br>
</body>
</html>