Changeset 1187:436e4342ecd0 in freeDiameter

Timestamp:

Jun 10, 2013, 1:04:50 PM (11 years ago)

Author:

Sebastien Decugis <sdecugis@freediameter.net>

Branch:

default

Phase:

public

Message:

Rollback to using TLS/SCTP in release 1.2.0. DTLS dev to happen in freeDiameter-dtls branch

Files:

• contrib/debian/changelog (modified) (1 diff)
• doc/freediameter.conf.sample (modified) (2 diffs)
• libfdcore/fdd.l (modified) (1 diff)
• libfdcore/p_cnx.c (modified) (1 diff)
• libfdcore/server.c (modified) (3 diffs)

contrib/debian/changelog

@@ -28 +28 @@
   * Upgraded SCTP code to comply with RFC 6458
   * Using default secure Diameter port number 5658 as per RFC 6733
+  * Updated TLS code for performance improvements with new GNU TLS.
 
- -- Sebastien Decugis <sdecugis@freediameter.net>  Mon, 03 Jun 2013 14:20:05 +0800
+ -- Sebastien Decugis <sdecugis@freediameter.net>  Mon, 10 Jun 2013 12:03:59 +0800
 
 freediameter (1.1.6) UNRELEASED; urgency=low

doc/freediameter.conf.sample

@@ -31 +31 @@
 # The port this peer is listening on for incoming TLS-protected connections (TCP and SCTP).
 # See TLS_old_method for more information about TLS flavours.
+# Note: we use TLS/SCTP instead of DTLS/SCTP at the moment. This will change in future version of freeDiameter.
 # Default: 5658. Use 0 to disable.
 #SecPort = 5658;
-
-# freeDiameter 1.2.0 introduces the support of DTLS over SCTP (RFC6083) instead of TLS over SCTP (RFC3436), 
-# as specified in RFC6733. If you need compatibility with older implementation that use TLS over SCTP, you 
-# can open an additional SCTP server port using TLS/SCTP by specifying the following parameter.
-# Note that no TCP server is started on the following port.
-# Default: 0 (disabled). Use 3869 for compatibility with freeDiameter < 1.2.0.
-#SctpSec3436 = 0;
 
 # Use RFC3588 method for TLS protection, where TLS is negociated after CER/CEA exchange is completed 
@@ -218 +212 @@
 # Parameters that can be specified in the peer's parameter list:
 #  No_TCP; No_SCTP; No_IP; No_IPv6; Prefer_TCP; TLS_old_method;
-#  No_TLS;       # assume transparent security instead of TLS
-#  SctpSec3436;  # Use TLS/SCTP instead of DTLS/SCTP to protect SCTP associations with this peer.
+#  No_TLS;       # assume transparent security instead of TLS. DTLS is not supported yet (will change in future versions).
 #  Port = 5658;  # The port to connect to
 #  TcTimer = 30;

libfdcore/fdd.l

@@ -246 +246 @@
 (?i:"Port")             { return PORT;          }
 (?i:"SecPort")          { return SECPORT;       }
-(?i:"SctpSec3436")      { return SEC3436;       }
+        /* (?i:"SctpSec3436")   { return SEC3436;       } */
 (?i:"No_IPv6")          { return NOIP6;         }
 (?i:"No_IP")            { return NOIP;          }

libfdcore/p_cnx.c

@@ -283 +283 @@
         if (nc->dotls) {
                 CHECK_FCT_DO( fd_cnx_handshake(cnx, GNUTLS_CLIENT, 
-                                                (peer->p_hdr.info.config.pic_flags.sctpsec == PI_SCTPSEC_3436) ? ALGO_HANDSHAKE_3436 : ALGO_HANDSHAKE_DEFAULT,
+                                                ALGO_HANDSHAKE_3436,
                                                 peer->p_hdr.info.config.pic_priority, NULL),
                         {

libfdcore/server.c

@@ -54 +54 @@
         struct cnxctx * conn;           /* server connection context (listening socket) */
         int             proto;          /* IPPROTO_TCP or IPPROTO_SCTP */
-        int             secur;          /* TLS is started immediatly after connection ? 0: no; 1: yes (TLS/TCP or DTLS/SCTP); 2: yes (TLS/TCP or TLS/SCTP) */
+        int             secur;          /* TLS is started immediatly after connection ? 0: no; 2: yes (TLS/TCP or TLS/SCTP) */
         
         pthread_t       thr;            /* The thread listening for new connections */
@@ -361 +361 @@
                 /* Create the server on secure port */
                 if (fd_g_config->cnf_port_tls) {
-                        CHECK_MALLOC( s = new_serv(IPPROTO_SCTP, 1) );
+                        CHECK_MALLOC( s = new_serv(IPPROTO_SCTP, 2 /* Change when DTLS is introduced */) );
                         CHECK_MALLOC( s->conn = fd_cnx_serv_sctp(fd_g_config->cnf_port_tls, empty_conf_ep ? NULL : &fd_g_config->cnf_endpoints) );
                         fd_list_insert_before( &FD_SERVERS, &s->chain );
@@ -368 +368 @@
                 
                 /* Create the other server on 3436 secure port */
-                if (fd_g_config->cnf_port_3436) {
+                /*if (fd_g_config->cnf_port_3436) {
                         CHECK_MALLOC( s = new_serv(IPPROTO_SCTP, 2) );
                         CHECK_MALLOC( s->conn = fd_cnx_serv_sctp(fd_g_config->cnf_port_3436, empty_conf_ep ? NULL : &fd_g_config->cnf_endpoints) );
                         fd_list_insert_before( &FD_SERVERS, &s->chain );
                         CHECK_POSIX( pthread_create( &s->thr, NULL, serv_th, s ) );
-                }
+                }*/
                 
 #endif /* DISABLE_SCTP */