Subject: [XCON] CPCP issue 3: Wildcards in ACL

From: [email-masked]
Date: Thu, 20 May 2004 18:39:04 +0300

The current version of the draft states:

"Wildcards are allowed in ACL as follows.  The domain part is allowed
   to be wildcard only if the username is a wildcard.  Wildcard in the
   domain part MUST be immediately after the @-sign.  A wildcard in the
   domain is interpreted as multiple zones.  For example:
   sip:*@*.example.com includes sip:[email-masked] as well as
   sip:[email-masked].  The use of wildcarding has
   been restricted to avoid ambiguous entries in the access control
   list.

   Examples of allowed wildcards are -  sip:[email-masked], *@*.com, *@*.

   Examples are not allowed wildcards are -  sip:bob@example.*,
   sip:bob@*.com, sip:*@example.*.com."

It has occurred to me that instead of wildcarding entries in the ACL, a domain can be entered instead, so instead of:

   	<conference-acl:ACL>
   		<ACL-target-URI Access-type="Allowed">sip:[email-masked]</ACL-target-URI>
   	</conference-acl:ACL>

We can have:

   	<conference-acl:ACL>
   		<ACL-target-URI Access-type="Allowed">sip:example.com</ACL-target-URI>
   	</conference-acl:ACL>

It's a little trickier to indicate all domains. Currently, it is defined to look like this: *@*

   	<conference-acl:ACL>
   		<ACL-target-URI Access-type="Allowed">sip:*@*</ACL-target-URI>
   	</conference-acl:ACL>

The question is: How to indicate that?

Proposal 1: allow the URI entry to be * as follows (* is a valid URI character)

   	<conference-acl:ACL>
   		<ACL-target-URI Access-type="Allowed">*</ACL-target-URI>
   	</conference-acl:ACL>

Proposal 2: have a Marco ANYURI be defined.

   	<conference-acl:ACL>
   		<ACL-target-URI Access-type="Allowed">ANYURI</ACL-target-URI>
   	</conference-acl:ACL>

I prefer 1 in this case, but would welcome other ideas.

Regards,
Hisham

_______________________________________________
XCON mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/xcon

---

From: Aki Niemi <[email-masked]>
Date: Fri, 21 May 2004 10:50:54 +0300

Hi,

Rather than having to parse URIs, I'd much rather see explicit elements
defined for "widlcarding" certain things. Like in common-policy, you
could have <domain> to match domains, and in addition have <user> to
match a userpart, and <any> to match any identity, maybe also <key> for
matching certain keywords.

Cheers,
Aki

ext [email-masked] wrote:
> It has occurred to me that instead of wildcarding entries in the ACL,
>  a domain can be entered instead, so instead of:
> 
> <conference-acl:ACL> <ACL-target-URI 
> Access-type="Allowed">sip:[email-masked]</ACL-target-URI> 
> </conference-acl:ACL>
> 
> We can have:
> 
> <conference-acl:ACL> <ACL-target-URI 
> Access-type="Allowed">sip:example.com</ACL-target-URI> 
> </conference-acl:ACL>
> 
> <conference-acl:ACL> <ACL-target-URI 
> Access-type="Allowed">sip:*@*</ACL-target-URI> </conference-acl:ACL>
> 
> <conference-acl:ACL> <ACL-target-URI 
> Access-type="Allowed">*</ACL-target-URI> </conference-acl:ACL>
> 
> <conference-acl:ACL> <ACL-target-URI 
> Access-type="Allowed">ANYURI</ACL-target-URI> </conference-acl:ACL>
> 
> Regards, Hisham
> _______________________________________________ XCON mailing list 
> [email-masked] https://www1.ietf.org/mailman/listinfo/xcon