Changeset 162:79768bf7d208 in freeDiameter for extensions/acl_wl

Timestamp:

Jan 26, 2010, 1:23:03 PM (14 years ago)

Author:

Sebastien Decugis <sdecugis@nict.go.jp>

Branch:

default

Phase:

public

Message:

Completed whitelist extension

Location:

extensions/acl_wl

Files:

• CMakeLists.txt (modified) (2 diffs)
• acl_wl.c (modified) (4 diffs)
• aw_tree.c (modified) (4 diffs)

extensions/acl_wl/CMakeLists.txt

@@ -8 +8 @@
 
 # List of source files
-SET( APP_TEST_SRC
+SET( ACL_WL_SRC
         acl_wl.h
         acl_wl.c
@@ -18 +18 @@
 
 # Compile as a module
-FD_ADD_EXTENSION(acl_wl ${APP_TEST_SRC})
+FD_ADD_EXTENSION(acl_wl ${ACL_WL_SRC})

extensions/acl_wl/acl_wl.c

@@ -71 +71 @@
         
         /* Now, if we did not specify any flag, reject */
+        if (res == 0) {
+                TRACE_DEBUG(INFO, "Peer '%s' rejected, only TLS-protected connection is whitelisted.", info->pi_diamid);
+                /* We don't actually set *auth = -1, leave space for a further extension to validate the peer */
+                return 0;
+        }
         
-
+        /* Check the Inband-Security-Id value */
+        res &= info->runtime.pir_isi;
+        if (res == 0) {
+                TRACE_DEBUG(INFO, "Peer '%s' rejected, remotely advertised Inband-Security-Id is not compatible with whitelist flags.", info->pi_diamid);
+                /* We don't actually set *auth = -1, leave space for a further extension to validate the peer */
+                return 0;
+        }
+        
+        /* Ok, the peer is whitelisted */
+        *auth = 1;
+        
+        /* Now, configure the peer for the authorized mechanism */
+        if ((res & PI_SEC_NONE) && (res & PI_SEC_TLS_OLD))
+                res = PI_SEC_NONE; /* If we authorized it, we must have an IPsec tunnel setup, no need for TLS in this case */
+        
+        /* Save information about the security mechanism to use after CER/CEA exchange */
+        info->config.pic_flags.sec = res;
+        return 0;
 }
 
@@ -79 +101 @@
 {
         TRACE_ENTRY("%p", conffile);
-        
         CHECK_PARAMS(conffile);
         
@@ -86 +107 @@
         
         TRACE_DEBUG(INFO, "Extension ACL_wl initialized with configuration: '%s'", conffile);
-        aw_tree_dump();
+        if (TRACE_BOOL(ANNOYING)) {
+                aw_tree_dump();
+        }
         
         /* Register the validator function */
-        
+        CHECK_FCT( fd_peer_validate_register ( aw_validate ) );
+
         return 0;
 }
@@ -96 +120 @@
 void fd_ext_fini(void)
 {
-        /* Unregister the validator function */
-
         /* Destroy the tree */
-
+        aw_tree_destroy();
 }
 

extensions/acl_wl/aw_tree.c

@@ -230 +230 @@
                 ti = (struct tree_item *)(senti->next);
                 if (ti->str == NULL) {
-                        fd_log_debug("[acl_wl] Warning: entry '%s' is superseeded by a generic entry at level %d, ignoring.\n", name, lbl);
+                        fd_log_debug("[acl_wl] Warning: entry '%s' is superseeded by a generic entry at label %d, ignoring.\n", name, lbl + 1);
                         return 0;
                 }
@@ -287 +287 @@
                         ti = (struct tree_item *)(senti->next);
                         if (ti->str == NULL) {
-                                fd_log_debug("[acl_wl] Warning: entry '%s' is superseeded by a generic entry at level 0, ignoring.\n", name);
+                                fd_log_debug("[acl_wl] Warning: entry '%s' is superseeded by a generic entry at label 1, ignoring.\n", name);
                                 return 0;
                         }
@@ -367 +367 @@
                 ti = (struct tree_item *)(senti->next);
                 if (ti->str == NULL) {
-                        TRACE_DEBUG(FULL, "[acl_wl] %s matched at level %d with a generic entry.", name, lbl);
+                        TRACE_DEBUG(ANNOYING, "[acl_wl] %s matched at label %d with a generic entry.", name, lbl + 1);
                         *result = ti->flags;
                         return 0;
@@ -407 +407 @@
                 return 0;
         
-        TRACE_DEBUG(FULL, "[acl_wl] %s matched exactly.", name);
+        TRACE_DEBUG(ANNOYING, "[acl_wl] %s matched exactly.", name);
         *result = ti->flags;
         return 0;