Changeset 1155:d00b5914351e in freeDiameter for libfdcore/p_ce.c

Timestamp:

May 28, 2013, 1:11:27 PM (11 years ago)

Author:

Sebastien Decugis <sdecugis@freediameter.net>

Branch:

default

Phase:

public

Message:

Allow running freeDiameter without TLS credentials if the following conditions are verified:

• The Secure Diameter port is disabled (SecPort? = 0;)
• The old TLS mechanism is not used (TLS_old_method; not defined)

Note that in this context only connections to peers explicitely authorized for 'No_TLS' are
permitted.

File:

• libfdcore/p_ce.c (modified) (3 diffs)

libfdcore/p_ce.c

@@ -596 +596 @@
         if (!fd_cnx_getTLS(cnx)) {
                 isi_none = peer->p_hdr.info.config.pic_flags.sec & PI_SEC_NONE; /* we add it even if the peer does not use the old mechanism, it is impossible to distinguish */
-                isi_tls  = peer->p_hdr.info.config.pic_flags.sec & PI_SEC_TLS_OLD;
+
+                if (peer->p_hdr.info.config.pic_flags.sec & PI_SEC_TLS_OLD) {
+                        if (fd_g_config->cnf_sec_data.tls_disabled) {
+                                LOG_N("TLS disabled locally, so Inband-Security-Id (TLS) not included for peer %s", peer->p_hdr.info.pi_diamid);
+                        } else {
+                                isi_tls  = 1;
+                        }
+                }
         }
         
@@ -771 +778 @@
                         TRACE_DEBUG(INFO, "No TLS protection negotiated with peer '%s'.", peer->p_hdr.info.pi_diamid);
                         CHECK_FCT( fd_cnx_start_clear(peer->p_cnxctx, 1) );
+                        
+                } else if (fd_g_config->cnf_sec_data.tls_disabled) {
+                        LOG_E("Clear connection with remote peer '%s' is not (explicitly) allowed, and TLS is disabled. Giving up...", peer->p_hdr.info.pi_diamid);
+                        fd_hook_call(HOOK_PEER_CONNECT_FAILED, NULL, peer, "TLS is disabled and peer is not configured for IPsec", NULL);
+                        goto cleanup;
+                        
                 } else {
-                        
                         fd_psm_change_state(peer, STATE_OPEN_HANDSHAKE);
                         CHECK_FCT_DO( fd_cnx_handshake(peer->p_cnxctx, GNUTLS_CLIENT, peer->p_hdr.info.config.pic_priority, NULL),
@@ -900 +912 @@
                                         /* We have allowed IPsec */
                                         isi = PI_SEC_NONE;
+                                } else if (fd_g_config->cnf_sec_data.tls_disabled) {
+                                        /* We can agree on TLS */
+                                        TRACE_DEBUG(INFO, "Remote peer is not allowed for IPsec and TLS is disabled.");;
                                 } else if (peer->p_hdr.info.runtime.pir_isi & PI_SEC_TLS_OLD) {
                                         /* We can agree on TLS */