Changeset 20:277ec00d793e in freeDiameter for include/freeDiameter/freeDiameter.h

Timestamp:

Oct 7, 2009, 7:31:39 PM (15 years ago)

Author:

Sebastien Decugis <sdecugis@nict.go.jp>

Branch:

default

Phase:

public

Message:

Backup before typhoon... Progress on server side

File:

• include/freeDiameter/freeDiameter.h (modified) (7 diffs)

include/freeDiameter/freeDiameter.h

@@ -118 +118 @@
 struct fd_endpoint {
         struct fd_list  chain;  /* link in cnf_endpoints list */
-        sSS             ss;     /* the socket information. */
+        sSS             ss;     /* the socket information. List is always ordered by ss value (memcmp) */
         struct {
                 unsigned conf : 1; /* This endpoint is statically configured in a configuration file */
@@ -175 +175 @@
         ,FDEV_DUMP_DICT         /* Dump the content of the dictionary */
         ,FDEV_DUMP_EXT          /* Dump state of extensions */
+        ,FDEV_DUMP_SERV         /* Dump the server socket status */
         ,FDEV_DUMP_QUEUES       /* Dump the message queues */
         ,FDEV_DUMP_CONFIG       /* Dump the configuration */
         ,FDEV_DUMP_PEERS        /* Dump the list of peers */
 };
-const char * fd_ev_str(int event);
+const char * fd_ev_str(int event); /* defined in freeDiameter/main.c */
 
 
@@ -202 +203 @@
                                    If we win the election, we must disconnect the initiated connection and send a CEA on the other => we go to OPEN state.
                                    If we lose, we disconnect the other connection (receiver) and fallback to WAITCEA state. */
+        STATE_OPEN_HANDSHAKE,   /* TLS Handshake and validation are in progress in open state */
         
         /* Failover state machine */
@@ -211 +213 @@
 #define STATE_MAX STATE_ZOMBIE
 };
-extern const char *peer_state_str[];
+extern const char *peer_state_str[]; /* defined in freeDiameter/p_psm.c */
 #define STATE_STR(state) \
         (((unsigned)(state)) <= STATE_MAX ? peer_state_str[((unsigned)(state)) ] : "<Invalid>")
@@ -245 +247 @@
                 unsigned        exp :1;
                 
-                /* Following flags are read-only and received from remote peer */
-                #define PI_INB_NONE     1       /* Remote peer advertised inband-sec-id 0 (None) */
-                #define PI_INB_TLS      2       /* Remote peer advertised inband-sec-id 1 (TLS) */
-                unsigned        inband :2;      /* This is only meaningful with pi_flags.sec == 3 */
+                unsigned        inband_none :1; /* This is only meaningful with pi_flags.sec == 3 */
+                unsigned        inband_tls  :1; /* This is only meaningful with pi_flags.sec == 3 */
                 
                 unsigned        relay :1;       /* The remote peer advertized the relay application */
@@ -338 +338 @@
  * !0   : An error occurred.
  */
-int fd_peer_validate_register ( int (*peer_validate)(struct peer_info * /* info */, int * /* auth */) );
+int fd_peer_validate_register ( int (*peer_validate)(struct peer_info * /* info */, int * /* auth */, int (**cb2)(struct peer_info *)) );
 /*
  * CALLBACK:    peer_validate
@@ -345 +345 @@
  *   info     : Structure containing information about the peer attempting the connection.
  *   auth     : Store there the result if the peer is accepted (1), rejected (-1), or unknown (0).
+ *   cb2      : If != NULL and in case of PI_SEC_TLS_OLD, another callback to call after handshake (if auth = 1).
  *
  * DESCRIPTION: 
  *   This callback is called when a new connection is being established from an unknown peer,
- *  after the CER is received. An extension must register such callback with peer_validate_register.
+ * after the CER is received. An extension must register such callback with peer_validate_register.
+ *
+ *   If (info->pi_flags.sec == PI_SEC_TLS_OLD) the extension may instruct the daemon explicitely
+ * to not use TLS by clearing info->pi_flags.inband_tls -- only if inband_none is set.
+ *
+ *   If (info->pi_flags.sec == PI_SEC_TLS_OLD) and info->pi_flags.inband_tls is set,
+ * the extension may also need to check the credentials provided during the TLS
+ * exchange (remote certificate). For this purpose, it may set the address of a new callback
+ * to be called once the handshake is completed. This new callback receives the information
+ * structure as parameter (with pi_sec_data set) and returns 0 if the credentials are correct,
+ * or an error code otherwise. If the error code is received, the connection is closed and the 
+ * peer is destroyed.
  *
  * RETURN VALUE: