Index: doc/acl_wl.conf.sample
===================================================================
--- doc/acl_wl.conf.sample	(revision 161)
+++ doc/acl_wl.conf.sample	(revision 162)
@@ -16,3 +16,4 @@
 # It is specified for example as:
 # ALLOW_IPSEC vpn.example.net vpn2.example.net *.vpn.example.net
+# These flag take effect from their position, until the end of the line.
 
Index: extensions/acl_wl/CMakeLists.txt
===================================================================
--- extensions/acl_wl/CMakeLists.txt	(revision 161)
+++ extensions/acl_wl/CMakeLists.txt	(revision 162)
@@ -8,5 +8,5 @@
 
 # List of source files
-SET( APP_TEST_SRC
+SET( ACL_WL_SRC
 	acl_wl.h
 	acl_wl.c
@@ -18,3 +18,3 @@
 
 # Compile as a module
-FD_ADD_EXTENSION(acl_wl ${APP_TEST_SRC})
+FD_ADD_EXTENSION(acl_wl ${ACL_WL_SRC})
Index: extensions/acl_wl/acl_wl.c
===================================================================
--- extensions/acl_wl/acl_wl.c	(revision 161)
+++ extensions/acl_wl/acl_wl.c	(revision 162)
@@ -71,6 +71,28 @@
 	
 	/* Now, if we did not specify any flag, reject */
+	if (res == 0) {
+		TRACE_DEBUG(INFO, "Peer '%s' rejected, only TLS-protected connection is whitelisted.", info->pi_diamid);
+		/* We don't actually set *auth = -1, leave space for a further extension to validate the peer */
+		return 0;
+	}
 	
-
+	/* Check the Inband-Security-Id value */
+	res &= info->runtime.pir_isi;
+	if (res == 0) {
+		TRACE_DEBUG(INFO, "Peer '%s' rejected, remotely advertised Inband-Security-Id is not compatible with whitelist flags.", info->pi_diamid);
+		/* We don't actually set *auth = -1, leave space for a further extension to validate the peer */
+		return 0;
+	}
+	
+	/* Ok, the peer is whitelisted */
+	*auth = 1;
+	
+	/* Now, configure the peer for the authorized mechanism */
+	if ((res & PI_SEC_NONE) && (res & PI_SEC_TLS_OLD))
+		res = PI_SEC_NONE; /* If we authorized it, we must have an IPsec tunnel setup, no need for TLS in this case */
+	
+	/* Save information about the security mechanism to use after CER/CEA exchange */
+	info->config.pic_flags.sec = res;
+	return 0;
 }
 
@@ -79,5 +101,4 @@
 {
 	TRACE_ENTRY("%p", conffile);
-	
 	CHECK_PARAMS(conffile);
 	
@@ -86,8 +107,11 @@
 	
 	TRACE_DEBUG(INFO, "Extension ACL_wl initialized with configuration: '%s'", conffile);
-	aw_tree_dump();
+	if (TRACE_BOOL(ANNOYING)) {
+		aw_tree_dump();
+	}
 	
 	/* Register the validator function */
-	
+	CHECK_FCT( fd_peer_validate_register ( aw_validate ) );
+
 	return 0;
 }
@@ -96,8 +120,6 @@
 void fd_ext_fini(void)
 {
-	/* Unregister the validator function */
-
 	/* Destroy the tree */
-
+	aw_tree_destroy();
 }
 
Index: extensions/acl_wl/aw_tree.c
===================================================================
--- extensions/acl_wl/aw_tree.c	(revision 161)
+++ extensions/acl_wl/aw_tree.c	(revision 162)
@@ -230,5 +230,5 @@
 		ti = (struct tree_item *)(senti->next);
 		if (ti->str == NULL) {
-			fd_log_debug("[acl_wl] Warning: entry '%s' is superseeded by a generic entry at level %d, ignoring.\n", name, lbl);
+			fd_log_debug("[acl_wl] Warning: entry '%s' is superseeded by a generic entry at label %d, ignoring.\n", name, lbl + 1);
 			return 0;
 		}
@@ -287,5 +287,5 @@
 			ti = (struct tree_item *)(senti->next);
 			if (ti->str == NULL) {
-				fd_log_debug("[acl_wl] Warning: entry '%s' is superseeded by a generic entry at level 0, ignoring.\n", name);
+				fd_log_debug("[acl_wl] Warning: entry '%s' is superseeded by a generic entry at label 1, ignoring.\n", name);
 				return 0;
 			}
@@ -367,5 +367,5 @@
 		ti = (struct tree_item *)(senti->next);
 		if (ti->str == NULL) {
-			TRACE_DEBUG(FULL, "[acl_wl] %s matched at level %d with a generic entry.", name, lbl);
+			TRACE_DEBUG(ANNOYING, "[acl_wl] %s matched at label %d with a generic entry.", name, lbl + 1);
 			*result = ti->flags;
 			return 0;
@@ -407,5 +407,5 @@
 		return 0;
 	
-	TRACE_DEBUG(FULL, "[acl_wl] %s matched exactly.", name);
+	TRACE_DEBUG(ANNOYING, "[acl_wl] %s matched exactly.", name);
 	*result = ti->flags;
 	return 0;
Index: freeDiameter/p_ce.c
===================================================================
--- freeDiameter/p_ce.c	(revision 160)
+++ freeDiameter/p_ce.c	(revision 162)
@@ -782,10 +782,29 @@
 	}
 	
-	/* Do we send ISI back ? */
+	/* Do we agree on ISI ? */
 	if ( ! fd_cnx_getTLS(peer->p_cnxctx) ) {
-		if (peer->p_hdr.info.config.pic_flags.sec & PI_SEC_NONE)
-			isi = PI_SEC_NONE; /* Maybe we should also look at peer->p_hdr.info.runtime.pir_isi here ? */
-		else
+		/* In case of responder, the validate callback must have set the config.pic_flags.sec value already */
+		if (!peer->p_hdr.info.config.pic_flags.sec) {
+			/* The peer did not send the Inband-Security-Id AVP, reject */
+			TRACE_DEBUG(INFO, "No security mechanism advertised by peer '%s', sending DIAMETER_NO_COMMON_SECURITY", peer->p_hdr.info.pi_diamid);
+			ec = "DIAMETER_NO_COMMON_SECURITY";
+			fatal = 1;
+			goto error_abort;
+		}
+		
+		/* Now, check if we agree on the value IPsec */
+		if ((peer->p_hdr.info.config.pic_flags.sec & PI_SEC_NONE) && (peer->p_hdr.info.runtime.pir_isi & PI_SEC_NONE)) {
+			isi = PI_SEC_NONE;
+		} else if ((peer->p_hdr.info.config.pic_flags.sec & PI_SEC_TLS_OLD) && (peer->p_hdr.info.runtime.pir_isi & PI_SEC_TLS_OLD)) {
 			isi = PI_SEC_TLS_OLD;
+		}
+		
+		/* If we did not find an agreement */
+		if (!isi) {
+			TRACE_DEBUG(INFO, "No common security mechanism with '%s', sending DIAMETER_NO_COMMON_SECURITY", peer->p_hdr.info.pi_diamid);
+			ec = "DIAMETER_NO_COMMON_SECURITY";
+			fatal = 1;
+			goto error_abort;
+		}
 	}
 	
Index: include/freeDiameter/freeDiameter.h
===================================================================
--- include/freeDiameter/freeDiameter.h	(revision 142)
+++ include/freeDiameter/freeDiameter.h	(revision 162)
@@ -303,5 +303,5 @@
 
 /*
- * FUNCTION:	peer_validate_register
+ * FUNCTION:	fd_peer_validate_register
  *
  * PARAMETERS:
@@ -342,4 +342,6 @@
  * or an error code otherwise. If the error code is received, the connection is closed and the 
  * peer is destroyed.
+ * Note that freeDiameter already achieves some usual checks. The callback may be used to enforce
+ * additional restrictions.
  *
  * RETURN VALUE:
