Changeset 543:40141acabee7 in freeDiameter

Timestamp:

Sep 14, 2010, 1:31:27 PM (14 years ago)

Author:

Sebastien Decugis <sdecugis@nict.go.jp>

Branch:

default

Phase:

public

Message:

Fix behavior of TLS/SCTP when only one peer does not accept the remote certificate

Location:

freeDiameter

Files:

• cnxctx.c (modified) (8 diffs)
• cnxctx.h (modified) (1 diff)
• sctps.c (modified) (2 diffs)

freeDiameter/cnxctx.c

@@ -995 +995 @@
 int fd_tls_verify_credentials(gnutls_session_t session, struct cnxctx * conn, int verbose)
 {
-        int i;
+        int i, ret = 0;
         unsigned int gtret;
         const gnutls_datum_t *cert_list;
@@ -1176 +1176 @@
                 CHECK_GNUTLS_DO( gnutls_x509_crt_import (cert, &cert_list[i], GNUTLS_X509_FMT_DER), return EINVAL);
                 
-                /* When gnutls 2.10.1 is around, we should use gnutls_certificate_set_verify_function */
-                
                 GNUTLS_TRACE( deadline = gnutls_x509_crt_get_expiration_time(cert) );
                 if ((deadline != (time_t)-1) && (deadline < now)) {
@@ -1184 +1182 @@
                                 fd_log_debug(" - The certificate %d in the chain is expired\n", i);
                         }
-                        return EINVAL;
+                        ret = EINVAL;
                 }
                 
@@ -1193 +1191 @@
                                 fd_log_debug(" - The certificate %d in the chain is not yet activated\n", i);
                         }
-                        return EINVAL;
+                        ret = EINVAL;
                 }
                 
@@ -1202 +1200 @@
                                         fd_log_debug(" - The certificate hostname does not match '%s'\n", conn->cc_tls_para.cn);
                                 }
-                                return EINVAL;
+                                ret = EINVAL;
                         }
                 }
@@ -1209 +1207 @@
         }
 
-        return 0;
+        return ret;
 }
 
@@ -1256 +1254 @@
                 int ret;
                 
-                /* When gnutls 2.10.1 is around, we should use gnutls_certificate_set_verify_function */
+                /* When gnutls 2.10.1 is around, we should use gnutls_certificate_set_verify_function and fd_tls_verify_credentials, so that handshake fails directly. */
                 
                 CHECK_GNUTLS_DO( ret = gnutls_handshake(conn->cc_tls_para.session),
@@ -1279 +1277 @@
         if (conn->cc_sctp_para.pairs > 1) {
 #ifndef DISABLE_SCTP
+                /* Start reading the messages from the master session. That way, if the remote peer closed, we are not stuck inside handshake */
+                CHECK_FCT(fd_sctps_startthreads(conn, 0));
+                
                 /* Resume all additional sessions from the master one. */
                 CHECK_FCT(fd_sctps_handshake_others(conn, priority, alt_creds));
 
                 /* Start decrypting the messages from all threads and queuing them in target queue */
-                CHECK_FCT(fd_sctps_startthreads(conn));
+                CHECK_FCT(fd_sctps_startthreads(conn, 1));
 #endif /* DISABLE_SCTP */
         } else {

freeDiameter/cnxctx.h

@@ -128 +128 @@
 int fd_sctps_init(struct cnxctx * conn);
 int fd_sctps_handshake_others(struct cnxctx * conn, char * priority, void * alt_creds);
-int fd_sctps_startthreads(struct cnxctx * conn);
+int fd_sctps_startthreads(struct cnxctx * conn, int others);
 void fd_sctps_bye(struct cnxctx * conn);
 void fd_sctps_waitthreadsterm(struct cnxctx * conn);

freeDiameter/sctps.c

@@ -598 +598 @@
 }
 
-/* Receive messages from all stream pairs */
-int fd_sctps_startthreads(struct cnxctx * conn)
+/* Receive messages from others ? all other stream pairs : the master pair */
+int fd_sctps_startthreads(struct cnxctx * conn, int others)
 {
         uint16_t i;
@@ -606 +606 @@
         CHECK_PARAMS( conn && conn->cc_sctps_data.array );
         
-        for (i = 0; i < conn->cc_sctp_para.pairs; i++) {
-                
-                /* Start the decipher thread */
-                CHECK_POSIX( pthread_create( &conn->cc_sctps_data.array[i].thr, NULL, decipher, &conn->cc_sctps_data.array[i] ) );
+        if (others) {
+                for (i = 1; i < conn->cc_sctp_para.pairs; i++) {
+
+                        /* Start the decipher thread */
+                        CHECK_POSIX( pthread_create( &conn->cc_sctps_data.array[i].thr, NULL, decipher, &conn->cc_sctps_data.array[i] ) );
+                }
+        } else {
+                CHECK_POSIX( pthread_create( &conn->cc_sctps_data.array[0].thr, NULL, decipher, &conn->cc_sctps_data.array[0] ) );
         }
         return 0;