<div dir="ltr">Hello Henning,<div><br></div><div>Thanks again for your clarification.</div><div><br></div><div>As for 1)</div><div>There is no error that appears if I don't explicitly set "mask".</div><div>The JSON output from "kamctl address dump" on K5.5 simply doesn't display this attribute.</div><div><br></div><div>As for 2)</div><div>I see the code change and I can confirm it does what it's supposed to. I registered $MY_IP/0 in the address table and it does interpret it at a /32 (and returns true).</div><div>In other words, it does detect the subnet "0" and converts it to "32" behind the scenes.</div><div>Next, it does not appear in the kamcmd permissions.subnetDump (which makes sense because /32 is not a subnet) but appears in the kamcmd permissions.addressDump.</div><div><br></div><div>I'll try to raise an issue via GitHub and in the meantime, I'll tweak my logic around.</div><div><br></div><div>Thanks again. Tom</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 14, 2021 at 10:16 AM Henning Westerholt <<a href="mailto:hw@skalatan.de">hw@skalatan.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="DE" style="overflow-wrap: break-word;">
<div class="gmail-m_1301918364191272972WordSection1">
<p class="MsoNormal"><span>Hello,<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">please keep the list in CC.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Let’s look into the two issues one by one:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-GB">1) I had to explicitly configure the parameter:<u></u><u></u></span></p>
<div style="border:1pt solid rgb(153,204,204);padding:0cm 0cm 0cm 15pt;background:rgb(252,255,252);margin-left:35.4pt;margin-right:0cm">
<pre style="background:rgb(252,255,252);border:none;padding:0cm;border-radius:2.5px;overflow:auto"><span lang="EN-GB" style="font-size:11.5pt;color:black">modparam("permissions", "mask_col", "mask")<u></u><u></u></span></pre>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-GB">Although the documentation suggests "mask" is the default - the JSON output from "kamctl address dump" did not output this value on K5.5. (On K5.3 it outputted properly) <u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Do you get an error if you do not specify the mask_col like this, or something else? From the source code the default should be “mask”.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-GB">When I run the "kamcmd permissions.subnetDump" on Kamailio 5.3, it returns everything as expected - including the
</span><a href="http://0.0.0.0/0" target="_blank"><span lang="EN-GB">0.0.0.0/0</span></a><span lang="EN-GB"> subnets.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-GB">However, when running the same commands on Kamailio 5.5, it only returns a small subset (of only 20) subnets/groups - and the selection does not appear to follow a logical selection criteria.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-GB">Additionally, it does not return any groups with a
</span><a href="http://0.0.0.0/0" target="_blank"><span lang="EN-GB">0.0.0.0/0</span></a><span lang="EN-GB"> subnet either.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">It seems that the behaviour has changed regarding the “0” subnet, checkout the docs:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><a href="https://kamailio.org/docs/modules/devel/modules/permissions.html#permissions.p.mask_col" target="_blank">https://kamailio.org/docs/modules/devel/modules/permissions.html#permissions.p.mask_col</a><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">It will convert them to 32/128 respectively. Can you see a <a href="http://0.0.0./32" target="_blank">0.0.0./32</a> in your dump?<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">This was changed in commit f376c82a9f8 during an extension for text files. Maybe Daniel can comment here if this was done by purpose.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Otherwise, you can open an issue on our tracker about it.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Cheers,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Henning<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">-- <u></u>
<u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Henning Westerholt –
</span><span><a href="https://skalatan.de/blog/" target="_blank"><span lang="EN-GB" style="color:rgb(5,99,193)">https://skalatan.de/blog/</span></a></span><span lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Kamailio services –
</span><span><a href="https://gilawa.com/" target="_blank"><span lang="EN-GB" style="color:rgb(5,99,193)">https://gilawa.com</span></a></span><span>
<span lang="EN-GB"><u></u><u></u></span></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-left:35.4pt"><b>From:</b> Tom Dworakowski <<a href="mailto:dworakowski.tom@gmail.com" target="_blank">dworakowski.tom@gmail.com</a>>
<br>
<b>Sent:</b> Tuesday, September 14, 2021 5:00 PM<br>
<b>To:</b> Henning Westerholt <<a href="mailto:hw@skalatan.de" target="_blank">hw@skalatan.de</a>><br>
<b>Subject:</b> Re: [SR-Users] Empty Subnets in Permissions Module<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Hello Henning,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Thank you for looking into this for me.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I made two interesting discoveries this morning:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">1) I had to explicitly configure the parameter:<u></u><u></u></p>
</div>
<div>
<div style="border:1pt solid rgb(153,204,204);padding:0cm 0cm 0cm 15pt;background:rgb(252,255,252);margin-left:35.4pt;margin-right:0cm">
<pre style="background:rgb(252,255,252);border:none;padding:0cm;border-radius:2.5px;overflow:auto"><span style="font-size:11.5pt;color:black">modparam("permissions", "mask_col", "mask")<u></u><u></u></span></pre>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Although the documentation suggests "mask" is the default - the JSON output from "kamctl address dump" did not output this value on K5.5. (On K5.3 it outputted properly) <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">2)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">When I run the "kamcmd permissions.subnetDump" on Kamailio 5.3, it returns everything as expected - including the
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> subnets.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">However, when running the same commands on Kamailio 5.5, it only returns a small subset (of only 20) subnets/groups - and the selection does not appear to follow a logical selection criteria.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Additionally, it does not return any groups with a
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> subnet either.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">From my logs - I have noted this:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4353, 0.0.0.0, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <3769, 0.0.0.0, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4355, 0.0.0.0, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4359, 0.0.0.0, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <1955, 84.XX.XX.66, 0> inserted into address hash table <br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4361, 91.X.X.231, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4361, 91.X.X.33, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4361, 91.X.X.34, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4363, 80.X.X.25, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4363, 85.X.X.124, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4363, 212.X.X.19, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4365, 0.0.0.0, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4367, 0.0.0.0, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <4371, 0.0.0.0, 0> inserted into address hash table<br>
Sep 14 03:07:25 webrtc kamailio[5407]: 0(5407) DEBUG: permissions [address.c:118]: reload_address_insert(): Tuple <3991, 0.0.0.0, 0> inserted into address hash table<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">At the moment of querying group id 3983 (where there is only
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>), the function returns false:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">DEBUG: permissions [address.c:671]: allow_source_address(): looking for <3983, [IPv4 in hex, reversed octet order], 62281><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">However, None of those addresses appear in the "kamcmd permissions.subnetDump" output.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Moreover, if "my" group has the address
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> listed as an approved address - it will fail the test; but if I register
<a href="http://0.0.0.0/1" target="_blank">0.0.0.0/1</a> it will let me through (as my IP is < 128.0.0.0), kamcmd permissions.subnetDump will display this address.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">My thoughts are that there might be another table that is not being populated - or there is a filter during the import that either drops
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> or filters it out completely? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Regards, Tom<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">On Tue, Sep 14, 2021 at 4:10 AM Henning Westerholt <<a href="mailto:hw@skalatan.de" target="_blank">hw@skalatan.de</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">
Hello Tom,<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB">I’ve done a quick comparison of the main function and the called function. On a first view it looked identically, but I looked only a few levels deep.</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB">Do you have maybe some means to reproduce this on a test system? Then it would be probably interesting to look to the DEBUG logging of this cases. Maybe you can compare if you spot some obvious differences from the logic.</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB">Cheers,</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB">Henning</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:35.4pt">
<span lang="EN-GB"> </span><u></u><u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-left:70.8pt">
<b><span lang="EN-GB">From:</span></b><span lang="EN-GB"> sr-users <<a href="mailto:sr-users-bounces@lists.kamailio.org" target="_blank">sr-users-bounces@lists.kamailio.org</a>>
<b>On Behalf Of </b>Tom Dworakowski<br>
<b>Sent:</b> Tuesday, September 14, 2021 4:10 AM<br>
<b>To:</b> <a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
<b>Subject:</b> [SR-Users] Empty Subnets in Permissions Module</span><u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-left:70.8pt">
<span lang="EN-GB"> </span><u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
Greetings all!<u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
I have two deployments of Kamailio: one running version 5.3 and one 5.5 with practically identical configurations, same (MySQL and REDIS) data sources.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
We have customers that we assign an ACL "group" to, where the ID of this group resolves to records in the "address" table in our MySQL database - using the "grp" field.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
On the box running Kamailio 5.5, we have noticed that if a group has ip_addr=0.0.0.0, mask=0, port=0 - and we try to run the allow_source_address() - it will return false, thus failing this phase of the authentication process.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
However, on Kamailio 5.3 we are not seeing this issue, i.e. if a customer is assigned a group where the ACL is
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> - it will let him through.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
Has something changed that I'm not aware of?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
Any suggestions on how to resolve this?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:70.8pt">
My best, Tom<u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>