[Freeswitch-users] ACLs through proxy

[Bill W.]

Hey Metik,

Yes.  Well, actually, I can have the cidr in two places in the directory.

<user cidr="190.218.97.83/32" id="testphone01">
   <params>
     <param name="auth-acl" value="190.218.97.83/32"></param>

>From what I understand the cidr= parmeter is used in conjunction with
the apply-inbound-acl parameter in the sofia profile to just allow
someone to make calls from a certain IP without authenticating.

And from what I understand the auth-acl= parameter is used to restrict a
user to a particular cidr, but the user has to authenticate as well.

*The second feature is the one I want to use.*  I want to force users to
authenticate, but only allow that authentication from a particular cidr
as an added measure against toll fraud.

And this appears to be causing the issue.  Because once I specify the
auth-acl parameter in the directory, sofia-reg enforces that acl.  And
unfortunately it's using the IP of the proxy, not of the user-agent.

I looked in sofia.c and found this comment:
/*
 * if network_ip is a proxy allowed to send calls, check for auth
 * ip header and see if it matches against the inbound acl
*/

And this coincides with my testing.
I have <param name="apply-proxy-acl" value="ip_of_proxy"/> in my
profile.  I have my proxy sending the X-AUTH-IP header (verified with
tcpdump).  And yet the REGISTER is still being denied.

So it appears that the apply-proxy-acl is set up to work with the
apply-inbound-acl ( to allow users from an IP without authenticating)

But that hasn't been carried over to sofia_reg.c, which appears to
simply check the IP of who FreeSWITCH is talking to against the auth-acl
cidr specified in the directory. (Line 1926)

So I guess the question is, is my analysis correct?

Thoughts anyone?

Thanks,
Bill






Metik wrote:
> Bill,
> 
> I think you would add this to the user profile in the directory. The 
> "brian.xml" example (located in ${confdir}/directory/) provided with the 
> default/sample configuration files demonstrates how to to do this by 
> introducing a "cidr" attribute to the the "user" element.
> 
> Example:
> 
> <user id="7105551212" cidr="127.0.0.0/8//">
>     <params>
>       <param name="password" value="opensaysme"/>
>       <param name="vm-password" value="14916"/>
>     </params>
>     <variables>
>       <variable name="user_context" value="default"/>
>     </variables>
>   </user>
> 
> "http://wiki.freeswitch.org/wiki/Acl" contains some great info 
> (including a relevant example).
> 
> -metik
>