Subject: [IPTEL] CPL log nodes

From: James Undery <[email-masked]>
Date: Fri, 01 Sep 2000 09:20:51 +0100

Hi,
    This isn't really a bug, but may I suggest some text be added to 8.2
to the effect of "name SHOULD be a legal filename without any path
specification", the reason for this is to prevent the modification of
any files outside of the script owners file space. e.g.

<log name="/etc/hosts.allow" comment="   <-- intentional line break
blackhathost">

Could be very bad for security. Also it is questionable how useful log
is to anyone outside of administrators and developers of CPL (non UA)
servers as the users will require an account on the server and access to
the log files, doesn't mail provide a more useful "logging" mechanism
for users. Log would appear to be useful for UAs only as is.

James Undery

_______________________________________________
IPTEL mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/iptel

---

From: Henning Schulzrinne <[email-masked]>
Date: Fri, 01 Sep 2000 09:16:56 -0400

I would even argue that absolute file name references are bad in the
context. This should be a *logical* name, which the system should
translate in whatever way it sees fit.

I believe this feature is useful only under two circumstances:

- the ability to retrieve the log file and/or

- the ability to check whether a new call matches an existing call in
one of the logs

That way, for example, one can easily build a service such as "only
allow this person to call me if I have called the person before". This
type of abstraction is fully within the scope of CPL and easy to express
as a switch.

One could imagine that a CPL-implementing server makes the log file
available as a web page, say, so maybe we just need to recommend or
mention the access issue.

Having such a service is very useful if all you have is an Ethernet
phone. It won't be able to store long call lists.

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 01 Sep 2000 22:23:07 -0400

> translate in whatever way it sees fit.

I agree completely. In fact, I don't even think its really a requirement
that the log be a physically separate file; it could just be content
labeled in some way within a larger CPL-wide log.

> type of abstraction is fully within the scope of CPL and easy to express

I'd rather keep things simple and stick to what we have in CPL now; this
can wait till the next rev or an extension or something.

-Jonathan R.
-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com