* [core] Add interface allowlist to gate module app/api registration
Adds an optional, presence-activated allowlist in switch.conf.xml that
controls which modules may register application / api / json_api /
chat-application interfaces. With no <interface-allowlist> configured
nothing is enforced; when at least one <allow> entry is present, only
listed interfaces register at load time and all others are refused (the
module still loads and switch_loadable_module_process still returns
SUCCESS -- the blocked interface is simply never exposed).
Entries match at three levels of precision:
mod_commands - whole module
mod_commands.system - any interface named "system"
mod_commands.system.api - a specific type (app|api|json_api|chat_app)
Enforcement lives in switch_loadable_module_process() so every module, at
boot and at runtime `load`, is subject to the same policy. This gives
operators a way to disable the "system"/"spawn" shell-exec API commands
(and equivalents) system-wide.
Also adds the `interface_allowlist_dump [modules] [plain]` API, which
walks the loaded modules and prints their interfaces in the allowlist key
format so the current state can be captured and pruned offline into config.
* [mod_commands] Add tests for the interface allowlist
New test_interface_allowlist boots the core with an active
<interface-allowlist> (conf_interface_allowlist/) that permits only a
couple of mod_commands interfaces, then loads mod_commands and verifies:
- listed commands register and run (status, version) while unlisted and
shell-exec commands are refused (system, spawn, uptime) -- refusal
surfaces as switch_api_execute returning FALSE / command-not-found,
with the command function never invoked;
- a "module.name.type" entry gates by type: the API "status" loads while
the JSON API of the same name stays blocked;
- interface_allowlist_dump prints the config format in its xml, modules
and plain variants, and reflects module capabilities (system appears in
the dump even though it was blocked from registering).
* [config] Fix interior -- in interface-allowlist comment breaking XML parse
The explanatory comment used -- as em-dash pairs. The XML parser treats
-- inside a comment as the comment close, causing an "unclosed <!--"
error that prevents the whole freeswitch.xml from parsing (boot and
reloadxml both fail). Replace the -- pairs with ordinary punctuation.
* update .gitignore
* [core] Warn when interface-allowlist section is present but parses no entries
Co-authored-by: Chris Rienzo <chris@signalwire.com>
Implement SIP 603+ (ATIS-1000099) support for FCC analytics-based call blocking compliance.
Detection:
- Detect incoming 603+ responses by checking "Network Blocked" phrase
and "v=analytics1;" in the `Reason` header text
- Set `sip_603plus_reason` channel variable on both legs for CDR visibility
Passthrough control:
- `sip_603plus_passthrough=true`: forward 603+ phrase and Reason header
- `sip_603plus_passthrough=false`: strip `Reason` header, send clean `603 Decline`
- Not set: existing behavior preserved
- Works independently of `disable_q850_reason` for selective forwarding
* [mod_opus] add cfg setting to overwrite the fmtp stereo param coming from remote. Eg: incoming SDP has stereo=1 but we want a mono call so we answer with stereo=0.
sprop-stereo will be set to 0 too.
* [core] opus: use switch_core_max_audio_channels() with remote fmtp stereo=1 to allow disabling of stereo.
Previously, the configuration file vars.xml set the TLS Cipher Suites only for internal SIP profiles. External SIP profiles used the 'DEFAULT' set of the underlying OpenSSL. Now, external SIP profiles copy to the general setting of vars.xml as well. Of course, you can overwrite this anytime, for example, to use different sets for internal and external.
[mod_sndfile] add stereo to mono support for file formats that need it (eg: gsm, vox), add unit test for stereo
[mod_sndfile] mono to stereo and stereo to mono unit tests.
[unit-tests] mod_sndfile: don't wait for recording file to be flushed to disk by the core, use switch_ivr_stop_record_session()
[mod_sndfile] fix format "wve" (Psion Series 3)
[mod_sndfile] fix format "htk" (Hidden Markov Model Tool Kit)
[mod_sndfile] fix file format "iff" (AIFF)
[mod_sndfile] fix file format "xi" (FastTracker 2)
[mod_sndfile] fix file format "sds" (Midi Sample Dump Standard)
[uni-tests] add more audio file extensions to sndfile unit tests.
[mod_sndfile] add config file support (with one param currently: "allowed-extensions")
[mod_sndfile] add sample file sndfile.conf.xml to 'testing' and 'vanilla' cfg trees.
[mod_sndfile] free() cfg xml
[unit-tests] mod_sndfile: unload module test.
[unit-tests] mod_sndfile: add conf file unit-test (param that allows only certain file extensions)
[unit-tests] adjusts Makefile.am for new CI (tests)
[unit-tests] adjust path to sound file.
[unit-tests] [mod_sndfile] remove Makefile.am from test/
[unit-tests] [mod_sndfile] fix build (Andrey)
