ben.carrasco/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2026-07-24 21:22:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
allowlist
freeswitch/.gitignore
T
Chris Rienzo 28f251f634 [Core, mod_commands] Interface allowlist 
* [core] Add interface allowlist to gate module app/api registration

Adds an optional, presence-activated allowlist in switch.conf.xml that
controls which modules may register application / api / json_api /
chat-application interfaces. With no <interface-allowlist> configured
nothing is enforced; when at least one <allow> entry is present, only
listed interfaces register at load time and all others are refused (the
module still loads and switch_loadable_module_process still returns
SUCCESS -- the blocked interface is simply never exposed).

Entries match at three levels of precision:
  mod_commands            - whole module
  mod_commands.system     - any interface named "system"
  mod_commands.system.api - a specific type (app|api|json_api|chat_app)

Enforcement lives in switch_loadable_module_process() so every module, at
boot and at runtime `load`, is subject to the same policy. This gives
operators a way to disable the "system"/"spawn" shell-exec API commands
(and equivalents) system-wide.

Also adds the `interface_allowlist_dump [modules] [plain]` API, which
walks the loaded modules and prints their interfaces in the allowlist key
format so the current state can be captured and pruned offline into config.

* [mod_commands] Add tests for the interface allowlist

New test_interface_allowlist boots the core with an active
<interface-allowlist> (conf_interface_allowlist/) that permits only a
couple of mod_commands interfaces, then loads mod_commands and verifies:

- listed commands register and run (status, version) while unlisted and
  shell-exec commands are refused (system, spawn, uptime) -- refusal
  surfaces as switch_api_execute returning FALSE / command-not-found,
  with the command function never invoked;
- a "module.name.type" entry gates by type: the API "status" loads while
  the JSON API of the same name stays blocked;
- interface_allowlist_dump prints the config format in its xml, modules
  and plain variants, and reflects module capabilities (system appears in
  the dump even though it was blocked from registering).

* [config] Fix interior -- in interface-allowlist comment breaking XML parse

The explanatory comment used -- as em-dash pairs. The XML parser treats
-- inside a comment as the comment close, causing an "unclosed <!--"
error that prevents the whole freeswitch.xml from parsing (boot and
reloadxml both fail). Replace the -- pairs with ordinary punctuation.

* update .gitignore

* [core] Warn when interface-allowlist section is present but parses no entries
2026-07-22 18:43:10 +03:00

288 lines
6.0 KiB
Plaintext
Raw Permalink Blame History

*~
*.o
*.so
*.lo
*.a
*.la
*.loT
*.orig
*.rej
.libs
.deps
*.dirstamp
.\#*
\#*
*.user
*.suo
*.ncb
*.pdb
*.map
*.lib
*.obj
*.idb
*.res
*.exp
*.exe
*.manifest
*.dep
*.dll
*.sbr
*.ilk
*.bsc
*.pch
*.opensdf
*.tar
*.gz
*.tgz
*.xz
*.bz2
*.tbz2
*.deb
*.swp
*.serial
aclocal.m4
autom4te.cache
config.cache
configure.lineno
config.log
config.status
test-driver
core.*
TAGS
*.2010.log
*.Build.CppClean.log
*.tlog
*.unsuccessfulbuild
*.cache
*.lastbuildstate
*.sdf
/w32/Library/lastversion
/w32/Library/tmpVersion.Bat
!/w32/Console/FreeSwitchConsole.vcproj.user
!/w32/Setup/inno_setup/vcredist_x64.exe
!/w32/Setup/inno_setup/vcredist_x86.exe
/.version
/.stamp-*
/a.out.dSYM
/AUTHORS
/ChangeLog
/configure
/COPYING
/freeswitch
/fs_cli
/fs_encode
/fs_tts
/fs_ivrd
/libtool
/Makefile
/Makefile.in
/modules.conf
/NEWS
/noreg
/Path
/quiet_libtool
/README
/TAGS
/tone2wav
/All/
Debug/
/bin/
Release/
/ipch/
/*.log
/build/config/compile
/build/config/config.guess
/build/config/config.sub
/build/config/depcomp
/build/config/install-sh
/build/config/ltmain.sh
/build/config/missing
/build/freeswitch.pc
/build/standalone_module/freeswitch.pc
/build/getlib.sh
/build/getg729.sh
/build/getsounds.sh
/build/Makefile
/build/Makefile.in
/build/modmake.rules
/build/print_git_revision
/libs/curl/lib/ca-bundle.h
/libs/esl/fs_cli
/libs/esl/fs_ivrd
/libs/esl/testclient
/libs/esl/testserver
/libs/fsg729-*-installer
/libs/g729/
/libs/libcodec2/compile
/libs/libcodec2/config.guess
/libs/libcodec2/config.sub
/libs/libcodec2/configure
/libs/libcodec2/depcomp
/libs/libcodec2/install-sh
/libs/libcodec2/libtool
/libs/libcodec2/ltmain.sh
/libs/libcodec2/Makefile
/libs/libcodec2/Makefile.in
/libs/libcodec2/missing
/libs/libcodec2/src/Makefile
/libs/libcodec2/src/Makefile.in
/libs/libcodec2/unittest/Makefile
/libs/libcodec2/unittest/Makefile.in
/libs/mpg123-1.13.2/
/scripts/fsxs
/scripts/gentls_cert
/src/mod/applications/mod_easyroute/Makefile
/src/mod/applications/mod_hash/Makefile
/src/mod/applications/mod_hash/Makefile.in
/src/mod/applications/mod_hash/mod_hash.log
/src/mod/applications/mod_lcr/Makefile
/src/mod/applications/mod_nibblebill/Makefile
/src/mod/applications/mod_osp/Makefile
/src/mod/applications/mod_osp/Makefile.in
/src/mod/applications/mod_snipe_hunt/Makefile
/src/mod/applications/mod_test/test/Makefile
/src/mod/applications/mod_test/test/Makefile.in
/src/mod/codecs/mod_com_g729/Makefile
/src/mod/codecs/mod_com_g729/Makefile.in
/src/mod/dialplans/mod_dialplan_directory/Makefile
/src/mod/formats/mod_shell_stream/Makefile
/src/mod/languages/mod_lua/mod_lua_wrap.cpp.orig
/src/mod/languages/mod_perl/mod_perl_wrap.cpp.orig
/src/mod/languages/mod_python3/mod_python_wrap.cpp.orig
/src/mod/say/mod_say_de/Makefile
/src/mod/say/mod_say_es/Makefile
/src/mod/say/mod_say_fr/Makefile
/src/mod/say/mod_say_it/Makefile
/src/mod/say/mod_say_nl/Makefile
/src/mod/say/mod_say_th/Makefile
/src/mod/say/mod_say_zh/Makefile
/src/mod/languages/mod_v8/Makefile
/src/mod/languages/mod_v8/Makefile.in
/src/mod/languages/mod_v8/mod_v8.log
src/mod/modules.inc
BuildLog.htm
!/libs/win32/
!/libs/speex/win32/
# 7-Zip extraction tool bootstrap (downloaded/extracted by w32/downloadpackage.task)
/libs/win32/7za/
/libs/win32/7z*-extra.7z
*.suo
*.sdf
x64/
ipch/
/libs/xmlrpc-c/tools/xml-rpc-api2txt
/w32/Setup/obj
*dSYM*
/UpgradeLog*.*
/_UpgradeReport_Files/
*.aps
/w32/Library/switch_version.inc
/w32/Setup/Fragments
/libs/win32/mpg123/Win32/Debug_Generic/libmpg123.*.log
/libs/win32/mpg123/Win32/Release_Generic/libmpg123.*.log
/libs/win32/pthread/Win32/Debug DLL/pthread.*.log
/libs/win32/pthread/Win32/Release DLL/pthread.*.log
/src/mod/codecs/mod_amr/Win32/Debug Passthrough/mod_amr.*.log
/src/mod/codecs/mod_amr/Win32/Release Passthrough/mod_amr.*.log
/src/mod/codecs/mod_g723_1/Win32/Debug Passthrough/mod_g723_1.*.log
/src/mod/codecs/mod_g723_1/Win32/Release Passthrough/mod_g723_1.*.log
/src/mod/codecs/mod_g729/Win32/Debug Passthrough/mod_g729.*.log
/src/mod/codecs/mod_g729/Win32/Release Passthrough/mod_g729.*.log
/src/mod/directories/mod_ldap/Win32/Debug MS-LDAP/mod_ldap.*.log
/src/mod/directories/mod_ldap/Win32/Release MS-LDAP/mod_ldap.*.log
/src/mod/languages/mod_managed/Win32/Debug_CLR/mod_managed.*.log
/src/mod/languages/mod_managed/Win32/Release_CLR/mod_managed.*.log
/src/.dirstamp
/src/mod/languages/mod_v8/src/.dirstamp
libs/libsndfile/Scripts/build-test-tarball.mk
libs/libsndfile/doc/libsndfile.css
libs/libsndfile/echo-install-dirs
libs/libsndfile/src/ALAC/.dirstamp
libs/libsndfile/src/G72x/.dirstamp
libs/libsndfile/src/GSM610/.dirstamp
libs/libsndfile/src/Symbols.gnu-binutils
libs/libsndfile/src/Symbols.static
libs/libsndfile/src/version-metadata.rc
libs/libsndfile/tests/pedantic-header-test.sh
yum/RPMS
yum/temp
.vs/
Freeswitch.2015.VC.db
Freeswitch.2015.VC.VC.opendb
libs/freetype/
libs/libpng/
libs/zlib/
libs/libav/
libs/libx264/
Win32/*.msi
x64/*.msi
libs/tiff-4.0.7/
libs/PaxHeaders.1693/
libs/lua-*/
libs/g722_1-*/
libs/ilbc-*/
libs/broadvoice-*/
libs/libcodec2-*/
libs/libsilk-*/
libs/rabbitmq-c-*/
libs/rabbitmq-c-*.zip
libs/SharpZipLib.*/
libs/SharpZipLib.*.nupkg
libs/nasm-*/
libs/nasm-*.zip
libs/ffmpeg-*/
libs/sofia-sip*/
libs/sofia-sip*
src/mod/applications/mod_test/test/test_asr
src/mod/applications/mod_test/test/test_tts
src/mod/applications/mod_http_cache/test/Makefile
src/mod/applications/mod_http_cache/test/Makefile.in
src/mod/applications/mod_http_cache/test/test-suite.log
src/mod/applications/mod_http_cache/test/test_aws
src/mod/applications/mod_http_cache/test/test_aws.log
src/mod/applications/mod_http_cache/test/test_aws.trs
src/mod/formats/mod_sndfile/test/test_sndfile
src/mod/formats/mod_sndfile/test/test_sndfile_conf
src/mod/*/*/test/*.log
src/mod/*/*/test/*.trs
src/mod/*/*/test/[0-9]*/*
test-suite.log
src/mod/applications/mod_av/test/test_BT7.mp4
src/mod/applications/mod_av/test/test_RGB.mp4
images/test-argb.png
images/test-rgb.png
images/test.png
images/test_patched.png
images/test_text.png
src/mod/codecs/mod_amrwb/test/test_amrwb
src/mod/endpoints/mod_sofia/test/sipp-based-tests
src/mod/applications/mod_commands/test/test_interface_allowlist
.DS_Store
Reference in New Issue View Git Blame Copy Permalink