Can I use a domain name in an ACL list?
Suppose I have a switch with DNS hostname of "myswitch.company.com" and an IP address of 10.11.12.13. If I want to allow this switch's phones to call FreeSwitch, I have to update the acl.conf.xml file with an entry that looks like this: <list name="domains" default="deny"> <node type="allow" cidr="10.11.12.13/32" /> </list> What I would like to do is use the DNS hostname of the switch instead. So the above entry should look something like this: <list name="domains" default="deny"> <node type="allow" host="myswitch.company.com" /> </list> When I try the above, the calls are rejected by FreeSwitch. When creating its Access Control List, is there a way to tell FreeSwitch to do a hostname lookup when hosts are specified? Regards, Steve -- This e-mail (including any attachments) is for the sole use of the intended recipient(s) and may contain information that is confidential and/or protected by legal privilege. Any unauthorized review, use, copy, disclosure or distribution of this e-mail is strictly prohibited. If you are not the intended recipient, please notify Mitel immediately and destroy all copies of this e-mail. Mitel does not accept any liability for breach of security, error or virus that may result from the transmission of this message.
Looking at the code it looks like it would accept host. On Thu, Feb 5, 2015 at 9:59 AM, Szeto, Steven <steven.szeto@mitel.com> wrote:
Suppose I have a switch with DNS hostname of "myswitch.company.com" and an IP address of 10.11.12.13.
If I want to allow this switch's phones to call FreeSwitch, I have to update the acl.conf.xml file with an entry that looks like this:
<list name="domains" default="deny">
<node type="allow" cidr="10.11.12.13/32" />
</list>
What I would like to do is use the DNS hostname of the switch instead. So the above entry should look something like this:
<list name="domains" default="deny">
<node type="allow" host="myswitch.company.com" />
</list>
When I try the above, the calls are rejected by FreeSwitch.
When creating its Access Control List, is there a way to tell FreeSwitch to do a hostname lookup when hosts are specified?
Regards, Steve
This e-mail (including any attachments) is for the sole use of the intended recipient(s) and may contain information that is confidential and/or protected by legal privilege. Any unauthorized review, use, copy, disclosure or distribution of this e-mail is strictly prohibited. If you are not the intended recipient, please notify Mitel immediately and destroy all copies of this e-mail. Mitel does not accept any liability for breach of security, error or virus that may result from the transmission of this message. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
I've tried entering this in acl.conf.xml: <list name="domains" default="deny"> <node type="allow" host="miccgw1.design.mitel.com" mask="255.255.255.0"/> </list> After reloadacl (no errors), I tried making a call: 2015-02-06 15:47:51.831958 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/5401@miccgw1.design.mitel.com [fbcbdde0-6b3e-43e1-9fcf-f592c83b0efb] but the incoming call still gets rejected: 2015-02-06 15:47:51.831958 [DEBUG] sofia.c:8775 IP 10.47.41.109 Rejected by acl "domains". Falling back to Digest auth. 2015-02-06 15:47:51.871962 [DEBUG] sofia.c:8775 IP 10.47.41.109 Rejected by acl "domains". Falling back to Digest auth. 2015-02-06 15:47:51.871962 [WARNING] sofia_reg.c:2752 Can't find user [@ 10.47.26.44] from 10.47.41.109 You must define a domain called '10.47.26.44' in your directory and add a user with the id="" attribute and you must configure your device to use the proper domain in it's authentication credentials. If I want to get rid of the error, I need to specify the IP address of the originating pbx: <node type="allow" cidr="10.47.41.109/32" /> Any thoughts on how to get the acl file to support hostnames? On Thu, Feb 5, 2015 at 11:42 AM, Brian West <brian@freeswitch.org> wrote:
Looking at the code it looks like it would accept host.
On Thu, Feb 5, 2015 at 9:59 AM, Szeto, Steven <steven.szeto@mitel.com> wrote:
Suppose I have a switch with DNS hostname of "myswitch.company.com" and an IP address of 10.11.12.13.
If I want to allow this switch's phones to call FreeSwitch, I have to update the acl.conf.xml file with an entry that looks like this:
<list name="domains" default="deny">
<node type="allow" cidr="10.11.12.13/32" />
</list>
What I would like to do is use the DNS hostname of the switch instead. So the above entry should look something like this:
<list name="domains" default="deny">
<node type="allow" host="myswitch.company.com" />
</list>
When I try the above, the calls are rejected by FreeSwitch.
When creating its Access Control List, is there a way to tell FreeSwitch to do a hostname lookup when hosts are specified?
Regards, Steve
This e-mail (including any attachments) is for the sole use of the intended recipient(s) and may contain information that is confidential and/or protected by legal privilege. Any unauthorized review, use, copy, disclosure or distribution of this e-mail is strictly prohibited. If you are not the intended recipient, please notify Mitel immediately and destroy all copies of this e-mail. Mitel does not accept any liability for breach of security, error or virus that may result from the transmission of this message. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- This e-mail (including any attachments) is for the sole use of the intended recipient(s) and may contain information that is confidential and/or protected by legal privilege. Any unauthorized review, use, copy, disclosure or distribution of this e-mail is strictly prohibited. If you are not the intended recipient, please notify Mitel immediately and destroy all copies of this e-mail. Mitel does not accept any liability for breach of security, error or virus that may result from the transmission of this message.
participants (2)
-
Brian West
-
Szeto, Steven