Changeset 935:6072619402a3 in freeDiameter

Timestamp:

Mar 9, 2013, 11:43:33 PM (11 years ago)

Author:

Sebastien Decugis <sdecugis@freediameter.net>

Branch:

default

Phase:

public

Message:

New CMake option WORKAROUND_ACCEPT_INVALID_VSAI for those invalids Vendor-Specific-Application-Id out there

Files:

• include/freeDiameter/CMakeLists.txt (modified) (1 diff)
• include/freeDiameter/freeDiameter-host.h.in (modified) (1 diff)
• libfdcore/p_ce.c (modified) (3 diffs)

include/freeDiameter/CMakeLists.txt

@@ -29 +29 @@
 OPTION(DISABLE_PEER_EXPIRY "Disable RFC3539 Peers Connections Expiration after inactivity?" OFF)
 
-
-MARK_AS_ADVANCED(DISABLE_SCTP DEBUG_SCTP SCTP_USE_MAPPED_ADDRESSES ERRORS_ON_TODO DIAMID_IDNA_IGNORE DIAMID_IDNA_REJECT DISABLE_PEER_EXPIRY)
+# The following workaround increases compatibility with some implementations without breaking anything in freeDiameter, 
+# so it can be enabled without risk. We keep it disabled by default anyway for those people who use freeDiameter to check the 
+# compliancy of their implementation with the Diameter RFC...
+OPTION(WORKAROUND_ACCEPT_INVALID_VSAI "Do not reject a CER/CEA with a Vendor-Specific-Application-Id AVP containing both Auth- and Acct- application AVPs?" OFF)
+
+MARK_AS_ADVANCED(DISABLE_SCTP DEBUG_SCTP SCTP_USE_MAPPED_ADDRESSES ERRORS_ON_TODO DIAMID_IDNA_IGNORE DIAMID_IDNA_REJECT DISABLE_PEER_EXPIRY WORKAROUND_ACCEPT_INVALID_VSAI)
 
 ########################

include/freeDiameter/freeDiameter-host.h.in

@@ -60 +60 @@
 #cmakedefine DIAMID_IDNA_REJECT
 #cmakedefine DISABLE_PEER_EXPIRY
+#cmakedefine WORKAROUND_ACCEPT_INVALID_VSAI
 #cmakedefine GNUTLS_VERSION_210
 #cmakedefine GNUTLS_VERSION_300

libfdcore/p_ce.c

@@ -455 +455 @@
                                 {
                                         struct avp * inavp = NULL;
-                                        application_id_t aid = 0;
                                         vendor_id_t vid = 0;
-                                        int auth = 0;
-                                        int acct = 0;
+                                        application_id_t auth_aid = 0;
+                                        application_id_t acct_aid = 0;
+                                        int invalid=0;
 
                                         /* get the first child AVP */
@@ -482 +482 @@
                                                 switch (inhdr->avp_code) {
                                                         case AC_VENDOR_ID: /* Vendor-Id */
+                                                                if (vid != 0)
+                                                                        invalid++; /* We already had one such AVP */
                                                                 vid = inhdr->avp_value->u32;
                                                                 break;
                                                         case AC_AUTH_APPLICATION_ID: /* Auth-Application-Id */
-                                                                aid = inhdr->avp_value->u32;
-                                                                auth += 1;
+                                                                if (auth_aid != 0)
+                                                                        invalid++; /* We already had one such AVP */
+#ifndef WORKAROUND_ACCEPT_INVALID_VSAI
+                                                                if (acct_aid != 0)
+                                                                        invalid++; /* Only 1 *-Application-Id AVP is allowed */
+#endif /* WORKAROUND_ACCEPT_INVALID_VSAI */
+                                                                auth_aid = inhdr->avp_value->u32;
                                                                 break;
                                                         case AC_ACCT_APPLICATION_ID: /* Acct-Application-Id */
-                                                                aid = inhdr->avp_value->u32;
-                                                                acct += 1;
+                                                                if (acct_aid != 0)
+                                                                        invalid++; /* We already had one such AVP */
+#ifndef WORKAROUND_ACCEPT_INVALID_VSAI
+                                                                if (auth_aid != 0)
+                                                                        invalid++; /* Only 1 *-Application-Id AVP is allowed */
+#endif /* WORKAROUND_ACCEPT_INVALID_VSAI */
+                                                                acct_aid = inhdr->avp_value->u32;
                                                                 break;
                                                         /* ignore other AVPs */
+                                                }
+                                                
+                                                if (invalid) {
+                                                        TRACE_DEBUG(FULL, "Invalid Vendor-Specific-Application-Id AVP received, ignored");
+                                                        fd_msg_dump_one(FULL, avp);
+                                                        error->pei_errcode = "DIAMETER_INVALID_AVP_VALUE";
+                                                        error->pei_avp = avp;
+                                                        return EINVAL;
                                                 }
 
@@ -500 +520 @@
                                         }
                                         
-                                        if (auth + acct != 1) {
-                                                TRACE_DEBUG(FULL, "Invalid Vendor-Specific-Application-Id AVP received, ignored");
-                                                fd_msg_dump_one(FULL, avp);
-                                                error->pei_errcode = "DIAMETER_INVALID_AVP_VALUE";
-                                                error->pei_avp = avp;
-                                                return EINVAL;
-                                        } else {
-                                                /* Add an entry in the list */
-                                                CHECK_FCT( fd_app_merge(&peer->p_hdr.info.runtime.pir_apps, aid, vid, auth, acct) );
+                                        /* Add entry in the list */
+                                        if (auth_aid) {
+                                                CHECK_FCT( fd_app_merge(&peer->p_hdr.info.runtime.pir_apps, auth_aid, vid, 1, 0) );
+                                        }
+                                        if (acct_aid) {
+                                                CHECK_FCT( fd_app_merge(&peer->p_hdr.info.runtime.pir_apps, acct_aid, vid, 0, 1) );
                                         }
                                 }