<html>
<head>
<base href="https://wiki.asterisk.org/wiki">
<link rel="stylesheet" href="/wiki/s/en/2172/18/9/_/styles/combined.css?spaceKey=AST&forWysiwyg=true" type="text/css">
</head>
<body style="background: white;" bgcolor="white" class="email-body">
<div id="pageContent">
<div id="notificationFormat">
<div class="wiki-content">
<div class="email">
<h2><a href="https://wiki.asterisk.org/wiki/display/AST/Named+ACLs">Named ACLs</a></h2>
<h4>Page <b>edited</b> by <a href="https://wiki.asterisk.org/wiki/display/~mjordan">Matt Jordan</a>
</h4>
<br/>
<h4>Changes (1)</h4>
<div id="page-diffs">
<table class="diff" cellpadding="0" cellspacing="0">
<tr><td class="diff-snipped" >...<br></td></tr>
<tr><td class="diff-unchanged" >h1. Overview <br> <br></td></tr>
<tr><td class="diff-changed-lines" >The primary goal for Named ACLs (Access Control Lists) is to provide users with a way to create commonly used ACL profiles and to be able to use those profiles wherever ACLs are consumed without the need to duplicate the list each time it is used (often with varying keywords for defining the ACLs). This will make the creation and maintainence of complex ACLs an easier, less error prone process. An implementation of this concept exists within a team branch written by Olle E. <span class="diff-changed-words">Johansson<span class="diff-deleted-chars"style="color:#999;background-color:#fdd;text-decoration:line-through;">, though to what degree the scope of the current implementation will match that of Olle's is still uncertain</span>.</span> <br></td></tr>
<tr><td class="diff-unchanged" > <br>h1. Table of Contents <br></td></tr>
<tr><td class="diff-snipped" >...<br></td></tr>
</table>
</div> <h4>Full Content</h4>
<div class="notificationGreySide">
<h1><a name="NamedACLs-Overview"></a>Overview</h1>
<p>The primary goal for Named ACLs (Access Control Lists) is to provide users with a way to create commonly used ACL profiles and to be able to use those profiles wherever ACLs are consumed without the need to duplicate the list each time it is used (often with varying keywords for defining the ACLs). This will make the creation and maintainence of complex ACLs an easier, less error prone process. An implementation of this concept exists within a team branch written by Olle E. Johansson.</p>
<h1><a name="NamedACLs-TableofContents"></a>Table of Contents</h1>
<style type='text/css'>/*<![CDATA[*/
div.rbtoc1339605235621 {margin-left: 1.5em;padding: 0px;}
div.rbtoc1339605235621 ul {list-style: disc;margin-left: 0px;padding-left: 20px;}
div.rbtoc1339605235621 li {margin-left: 0px;padding-left: 0px;}
/*]]>*/</style><div class='rbtoc1339605235621'>
<ul>
<li><a href='#NamedACLs-Overview'>Overview</a></li>
<li><a href='#NamedACLs-TableofContents'>Table of Contents</a></li>
<li><a href='#NamedACLs-UseCasesInitialImplementation'>Use Cases - Initial Implementation</a></li>
<ul>
<li><a href='#NamedACLs-Actors'>Actors</a></li>
<li><a href='#NamedACLs-NamedACLandConsumersModuleLoad'>Named ACL and Consumers - Module Load</a></li>
<ul>
<ul>
<li><a href='#NamedACLs-Actors'>Actors</a></li>
<li><a href='#NamedACLs-Preconditions'>Preconditions</a></li>
<li><a href='#NamedACLs-Scenario'>Scenario</a></li>
<li><a href='#NamedACLs-PostConditions'>Post Conditions</a></li>
</ul>
<li><a href='#NamedACLs-NamedACLReload'>Named ACL - Reload</a></li>
<ul>
<li><a href='#NamedACLs-Actors'>Actors</a></li>
<li><a href='#NamedACLs-Preconditions'>Preconditions</a></li>
<li><a href='#NamedACLs-Scenario'>Scenario</a></li>
<li><a href='#NamedACLs-Postconditions'>Postconditions</a></li>
</ul>
<li><a href='#NamedACLs-ConsumerasksfornamedACLinformation'>Consumer asks for named ACL information</a></li>
<ul>
<li><a href='#NamedACLs-Actors'>Actors</a></li>
<li><a href='#NamedACLs-Preconditions'>Preconditions</a></li>
<li><a href='#NamedACLs-ScenarionamedACLexists'>Scenario - named ACL exists</a></li>
<li><a href='#NamedACLs-ScenarionamedACLdoesnotexistinNamedACLSubsystem'>Scenario - named ACL does not exist in Named ACL Subsystem</a></li>
</ul>
</ul>
</ul>
<li><a href='#NamedACLs-UseCasesDynamicNamedACLUpdating'>Use Cases - Dynamic Named ACL Updating</a></li>
<ul>
<li><a href='#NamedACLs-Actors'>Actors</a></li>
<ul>
<li><a href='#NamedACLs-InitiatorupdatesanamedACL'>Initiator updates a named ACL</a></li>
<ul>
<li><a href='#NamedACLs-Actors'>Actors</a></li>
<li><a href='#NamedACLs-Preconditions'>Preconditions</a></li>
<li><a href='#NamedACLs-Scenario'>Scenario</a></li>
<li><a href='#NamedACLs-Postconditions'>Postconditions</a></li>
</ul>
<li><a href='#NamedACLs-ConsumerupdatesanamedACL'>Consumer updates a named ACL</a></li>
<ul>
<li><a href='#NamedACLs-Actors'>Actors</a></li>
<li><a href='#NamedACLs-Preconditions'>Preconditions</a></li>
<li><a href='#NamedACLs-ScenarioAddorUpdateAccepted'>Scenario - Add or Update Accepted</a></li>
<li><a href='#NamedACLs-Postconditions'>Postconditions</a></li>
<li><a href='#NamedACLs-ScenarioAddorUpdateRejected'>Scenario - Add or Update Rejected</a></li>
<li><a href='#NamedACLs-Postconditions'>Postconditions</a></li>
</ul>
</ul>
</ul>
</ul></div>
<h1><a name="NamedACLs-UseCasesInitialImplementation"></a>Use Cases - Initial Implementation</h1>
<h2><a name="NamedACLs-Actors"></a>Actors</h2>
<ul>
<li>Named ACL Subsystem - the ACL subsystem that owns the definition of the named ACLs. Currently, this is acl.c.</li>
<li>ACL Consumers - subsystems that use named ACLs to make internal decisions, e.g., chan_sip.</li>
</ul>
<p>Note that the configuration information for these actors could come from a variety of sources, such as .conf files, RealTime backends, etc.</p>
<h2><a name="NamedACLs-NamedACLandConsumersModuleLoad"></a>Named ACL and Consumers - Module Load</h2>
<h5><a name="NamedACLs-Actors"></a>Actors</h5>
<ul>
<li>Named ACL Subsystem.</li>
<li>One or more Consumers.</li>
</ul>
<h5><a name="NamedACLs-Preconditions"></a>Preconditions</h5>
<ul>
<li>Configuration exists for all actors.</li>
</ul>
<h5><a name="NamedACLs-Scenario"></a>Scenario</h5>
<ol>
<li>The Named ACL Subsystem is initialized.</li>
<li>The Named ACL Subsystem loads configuration information.</li>
<li>Each category in the configuration specifies a unique named ACL. Key/value pairs within that category define the rules for that ACL.</li>
<li>A Consumer is initialized (from here, steps are repeated for each consumer).</li>
<li>The Consumer loads its configuration information.</li>
<li>The Consumer's configuration specifies the usage of a named ACL defined by the Named ACL Subsystem.</li>
</ol>
<h5><a name="NamedACLs-PostConditions"></a>Post Conditions</h5>
<ol>
<li>The Consumers have a key by which they can determine whether or not an address is allowable by that named ACL.</li>
</ol>
<h3><a name="NamedACLs-NamedACLReload"></a>Named ACL - Reload</h3>
<h5><a name="NamedACLs-Actors"></a>Actors</h5>
<ul>
<li>Named ACL Subsystem.</li>
<li>User or AMI connection.</li>
<li>Consumers</li>
</ul>
<h5><a name="NamedACLs-Preconditions"></a>Preconditions</h5>
<ul>
<li>Updated configuration exists for the Named ACL Subsystem.</li>
</ul>
<h5><a name="NamedACLs-Scenario"></a>Scenario</h5>
<ol>
<li>The User or an AMI connection initiates a reload operation on the Named ACL Subsystem.</li>
<li>The Named ACL subsystem reloads configuration information from its configuration.</li>
<li>Atomically, the ACL subsystem replaces its named ACLs with those from its updated configuration.</li>
<li>The Named ACL Subsystem notifies Consumers that its configuration was updated.</li>
</ol>
<h5><a name="NamedACLs-Postconditions"></a>Postconditions</h5>
<ol>
<li>The Named ACL subsystem is reloaded with an updated configuration.</li>
<li>Consumers are notified that the Named ACL subsystem was updated.</li>
</ol>
<h3><a name="NamedACLs-ConsumerasksfornamedACLinformation"></a>Consumer asks for named ACL information</h3>
<h5><a name="NamedACLs-Actors"></a>Actors</h5>
<ul>
<li>Named ACL Subsystem.</li>
<li>A single Consumer.</li>
</ul>
<h5><a name="NamedACLs-Preconditions"></a>Preconditions</h5>
<ul>
<li>A loaded and configured Named ACL Subsystem and Consumer.</li>
</ul>
<h5><a name="NamedACLs-ScenarionamedACLexists"></a>Scenario - named ACL exists</h5>
<ol>
<li>The Consumer receives an address that it must verify against a named ACL.</li>
<li>The Consumer verifies the address using the named ACL information from the Named ACL Subsystem.</li>
</ol>
<h5><a name="NamedACLs-ScenarionamedACLdoesnotexistinNamedACLSubsystem"></a>Scenario - named ACL does not exist in Named ACL Subsystem</h5>
<ol>
<li>The Consumer receives an address that it must verify against a named ACL.</li>
<li>The Consumer is unable to obtain ACL information for that named ACL from the Named ACL Subsystem.</li>
<li>The Consumer warns the system (and relevant security frameworks) of a configuration error.</li>
</ol>
<h1><a name="NamedACLs-UseCasesDynamicNamedACLUpdating"></a>Use Cases - Dynamic Named ACL Updating</h1>
<h2><a name="NamedACLs-Actors"></a>Actors</h2>
<p>In addition to the previously defined actors, the following are also present in these use cases.</p>
<ul>
<li>Initiator - either a user initiating an update via a CLI command, a third party via an AMI connection, or some other external mechanism</li>
</ul>
<h3><a name="NamedACLs-InitiatorupdatesanamedACL"></a>Initiator updates a named ACL</h3>
<h5><a name="NamedACLs-Actors"></a>Actors</h5>
<ul>
<li>Initiator.</li>
<li>Named ACL Subsystem.</li>
<li>Consumers.</li>
</ul>
<h5><a name="NamedACLs-Preconditions"></a>Preconditions</h5>
<ul>
<li>A loaded and configured Named ACL Subsystem and Consumer.</li>
</ul>
<h5><a name="NamedACLs-Scenario"></a>Scenario</h5>
<ol>
<li>Initiator provides information that adds or modified an existing named ACL.</li>
<li>Named ACL Subsystem updates its information.</li>
<li>Named ACL Subsystem updates its backing storage.</li>
<li>The Named ACL Subsystem notifies Consumers that its configuration was updated.</li>
</ol>
<h5><a name="NamedACLs-Postconditions"></a>Postconditions</h5>
<ol>
<li>The Named ACL subsystem is updated with the new named ACL information.</li>
<li>Consumers are notified that the Named ACL subsystem was updated.</li>
</ol>
<h3><a name="NamedACLs-ConsumerupdatesanamedACL"></a>Consumer updates a named ACL</h3>
<h5><a name="NamedACLs-Actors"></a>Actors</h5>
<ul>
<li>Named ACL Subsystem.</li>
<li>Consumers.</li>
</ul>
<h5><a name="NamedACLs-Preconditions"></a>Preconditions</h5>
<ul>
<li>A loaded and configured Named ACL Subsystem and Consumer.</li>
<li>A Consumer has received information that a named ACL should be added or modified.</li>
</ul>
<h5><a name="NamedACLs-ScenarioAddorUpdateAccepted"></a>Scenario - Add or Update Accepted</h5>
<ol>
<li>Consumer requests that a named ACL be added or updated with the appropriate information.</li>
<li>Named ACL Subsystem determines that the ACL can be added or updated.</li>
<li>Named ACL Subsystem updates its information.</li>
<li>Named ACL Subsystem updates its backing storage.</li>
<li>The Named ACL Subsystem notifies Consumers that its configuration was updated.</li>
</ol>
<h5><a name="NamedACLs-Postconditions"></a>Postconditions</h5>
<ol>
<li>The Named ACL subsystem is updated with the new named ACL information.</li>
<li>Consumers are notified that the Named ACL subsystem was updated.</li>
</ol>
<h5><a name="NamedACLs-ScenarioAddorUpdateRejected"></a>Scenario - Add or Update Rejected</h5>
<ol>
<li>Consumer requests that a named ACL be added or updated with the appropriate information.</li>
<li>Named ACL Subsystem determines that the ACL should not be added or updated.</li>
<li>The Named ACL Subsystem rejects the request.</li>
<li>The Consumer warns the system (and relevant security frameworks) of a configuration error.</li>
</ol>
<h5><a name="NamedACLs-Postconditions"></a>Postconditions</h5>
<ol>
<li>No change in the configuration of the Consumer or the Named ACL Subsystem</li>
</ol>
</div>
<div id="commentsSection" class="wiki-content pageSection">
<div style="float: right;" class="grey">
<a href="https://wiki.asterisk.org/wiki/users/removespacenotification.action?spaceKey=AST">Stop watching space</a>
<span style="padding: 0px 5px;">|</span>
<a href="https://wiki.asterisk.org/wiki/users/editmyemailsettings.action">Change email notification preferences</a>
</div>
<a href="https://wiki.asterisk.org/wiki/display/AST/Named+ACLs">View Online</a>
|
<a href="https://wiki.asterisk.org/wiki/pages/diffpagesbyversion.action?pageId=20185274&revisedVersion=6&originalVersion=5">View Changes</a>
|
<a href="https://wiki.asterisk.org/wiki/display/AST/Named+ACLs?showComments=true&showCommentArea=true#addcomment">Add Comment</a>
</div>
</div>
</div>
</div>
</div>
</body>
</html>