Re: Help on PrefixAuth::unexpected behaviour

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Pierlu,

authenticating endpoints by their alias is always problematic.

As you can see in the ARQ, the calling endpoint has two.
GnuGk finds the prefix match, looks at the first alias, notices
that it doesn't match the alias pattern and moves on to the next
rule. If the endpoint had only 3194 as alias, the rule would
block the call.

If you want to block a prefix, I'd suggest you try to find a
better matching criteria, eg. by caller IP.

Regards,
Jan

-- 
Jan Willamowius, Founder of the GNU Gatekeeper Project
EMail  : jan@xxxxxxxxxxxxxx
Website: http://www.gnugk.org
Support: http://www.willamowius.com/gnugk-support.html

Relaxed Communications GmbH
Frahmredder 91
22393 Hamburg
Geschäftsführer: Jan Willamowius
HRB 125261 (Amtsgericht Hamburg)
USt-IdNr: DE286003584


pierlu wrote:
> Hi everyone.
> I read in the manual that by adding the followind lines to the
> configuration
> 
> 09=deny alias:^188884.*
> ALL=allow ipv4:0/0|allow ipv6:::/0
> 
> will end up in "endpoints having an alias beginning with 188884 are
> not allowed to call prefix 09"
> 
> So I expected that by adding the following lines to my configuration,
> I would have prevented endpoint 3194 from calling the endpoint 8501
> (which is an MCU ad hoc room actually)
> 
> [Gatekeeper::Auth]
> PrefixAuth=required;ARQ
> 
> [PrefixAuth]
> 8501=deny alias:^3194.*
> ALL=allow ipv4:0/0
> 
> But this does not work; I also try setting the rule to 8501=deny
> alias:^3194 to no avail.
> 
> So I dug into logs and what I see is perplexing me: because it says that
> 
> *GKAUTH	PrefixAuth rule matched and could not reject or accept
> destination prefix '8501' for alias '8501'*
> 
> i.e. the alias for the caller and the callee is the same; this is the
> actual output (where ip address has been blanked out)
> 
> 2016/03/11 12:38:07.515	3	      RasSrv.cxx(251)	RAS
> admissionRequest {
>     requestSeqNum = 8596
>     callType = pointToPoint <<null>>
>     callModel = gatekeeperRouted <<null>>
>     endpointIdentifier =  9 characters {
>       0037 0038 0038 0036 005f 0065 006e 0064   7886_end
>       0070                                      p
>     }
>     destinationInfo = 2 entries {
>       [0]=dialedDigits "8501"
>       [1]=dialedDigits "8501"
>     }
>     srcInfo = 2 entries {
>       [0]=h323_ID  10 characters {
>         0044 0043 0020 0050 0045 0052 0053 0020   DC PERS
>         0053 0049                                 SI
>       }
>       [1]=dialedDigits "3194"
>     }
>     srcCallSignalAddress = ipAddress {
>       ip =  4 octets {
>         xx xx xx xx                                        ....
>       }
>       port = 60008
>     }
>     bandWidth = 15360
>     callReferenceValue = 2331
>     conferenceID =  16 octets {
>       02 87 73 31 e2 b2 03 14  1d a9 56 34 34 34 34 ef   ..s1......V4444.
>     }
>     activeMC = false
>     answerCall = false
>     canMapAlias = false
>     callIdentifier = {
>       guid =  16 octets {
>         02 87 73 31 e2 b2 03 14  1d a8 56 34 34 34 34 ef   ..s1......V4444.
>       }
>     }
>     gatekeeperIdentifier =  5 characters {
>       0047 006e 0075 0047 006b                  GnuGk
>     }
>     willSupplyUUIEs = false
>   }
> 2016/03/11 12:38:07.531	5	         job.cxx(338)	JOB	Worker threads: 15
> total - 15 busy, 0 idle
> 2016/03/11 12:38:07.531	5	         job.cxx(180)	JOB	Starting Job ARQ
> at Worker thread 364
> 2016/03/11 12:38:07.531	1	      RasSrv.cxx(382)	RAS	ARQ Received from
> xx.xx.xx.xx:1719*2016/03/11 12:38:07.531	4	
> gkauth.cxx(1941)	GKAUTH	PrefixAuth rule matched and could not reject
> or accept destination prefix '8501' for alias '8501'*
> 2016/03/11 12:38:07.531	5	      gkauth.cxx(1735)	GKAUTH	Prefix auth
> rule 'allow ip(32):0/0' matched
> 2016/03/11 12:38:07.531	4	      gkauth.cxx(1926)	GKAUTH	PrefixAuth
> rule matched and accepted destination prefix 'ALL' for alias '8501'
> 2016/03/11 12:38:07.531	3	      gkauth.cxx(795)	GKAUTH	PrefixAuth ARQ check ok
> 
> 
> The output is the same even when the calling endpoint is a different
> one from 3194.
> 
> What am I not understading?
> 
> My Gnugk Version is Gatekeeper(GNU) Version(3.4.0)
> Ext(pthreads=0,radius=1,mysql=1,pgsql=1,firebird=1,odbc=1,sqlite=1,large_fdset=0,crypto/ssl=1,h46018=1,h46023=1,ldap=1,ssh=0,ipv6=1,h235media=1,lua=0,h46017=1,snmp=1,h46026=0)
> H323Plus(1.25.3) PTLib(2.10.1) Build(Sep 19 2013, 19:57:17) Sys(Server
> 2003 i586 (Model=1 Stepping=2) v5.2.3790)
> 
> 
> Thank you very much. Pierlu


------------------------------------------------------------------------------
Transform Data into Opportunity.
Accelerate data analysis in your applications with
Intel Data Analytics Acceleration Library.
Click to learn more.
http://pubads.g.doubleclick.net/gampad/clk?id=278785111&iu=/4140
_______________________________________________________

Posting: mailto:Openh323gk-users@xxxxxxxxxxxxxxxxxxxxx
Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=openh323gk-users
Unsubscribe: http://lists.sourceforge.net/lists/listinfo/openh323gk-users
Homepage: http://www.gnugk.org/




[Index of Archives]     [SIP]     [Open H.323]     [Gnu Gatekeeper]     [Asterisk PBX]     [ISDN Cause Codes]     [Yosemite News]

  Powered by Linux