cellular-infrastructure
/
osmo-sgsn
mirror of https://gerrit.osmocom.org/osmo-sgsn
9
0
Fork 0
Code Issues Releases Wiki Activity

sgsn: Have authentication required on by default 

Previous commit introduced command "authentication (optional|required)",
which is only meaningful if auth-policy is remote. Upon adding the cmd,
it changed the default logic for remote policy to not require
authentication, which broke TTCN3 tests because sgsn no longer tries to
authenticate the users.

Since it's actually good to enable authentication by default where
possible, let's enable it by default when on auth-policy remote.

In order to do so, let's simply not care about the value of variable
require_authentication if auth_policy is not REMOTE. As a result, we
drop parts of the previous patch and remove unneeded checks (which are
only partially useful based on order of commands during VTY read).

Fixes: 794f446a28
Change-Id: Ic707a95af178b44f08809df3d3bc8354bf34273c
This commit is contained in:
Pau Espin 2019-06-13 19:03:25 +02:00
parent 794f446a28
commit d1463bc365
4 changed files with 11 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
doc/manuals/vty/sgsn_vty_reference.xml
View File

@ -2232,9 +2232,9 @@
</command>
<command id='authentication (optional|required)'>
<params>
<param name='authentication' doc='Whether to enforce MS authentication in GERAN' />
<param name='optional' doc='Allow MS to attach via GERAN without authentication' />
<param name='required' doc='Always require authentication' />
<param name='authentication' doc='Whether to enforce MS authentication in GERAN (only with auth-policy remote)' />
<param name='optional' doc='Allow MS to attach via GERAN without authentication (default and only possible value for non-remote auth-policy)' />
<param name='required' doc='Always require authentication (only available for auth-policy remote, default with that auth-policy)' />
</params>
</command>
<command id='encryption (GEA0|GEA1|GEA2|GEA3|GEA4)'>

2
include/osmocom/sgsn/sgsn.h
View File

@ -78,7 +78,9 @@ struct sgsn_config {
struct sockaddr_in gsup_server_addr;
int gsup_server_port;
/* Only meaningful if auth_policy is SGSN_AUTH_POLICY_REMOTE */
int require_authentication;
int require_update_location;
/* CDR configuration */

1
src/gprs/gprs_sgsn.c
View File

@ -987,6 +987,7 @@ struct sgsn_instance *sgsn_instance_alloc(void *talloc_ctx)
inst = talloc_zero(talloc_ctx, struct sgsn_instance);
inst->cfg.gtp_statedir = talloc_strdup(inst, "./");
inst->cfg.auth_policy = SGSN_AUTH_POLICY_CLOSED;
inst->cfg.require_authentication = true; /* only applies if auth_policy is REMOTE */
inst->cfg.gsup_server_port = OSMO_GSUP_PORT;
return inst;
}

22
src/gprs/sgsn_vty.c
View File

@ -211,8 +211,8 @@ static int config_write_sgsn(struct vty *vty)
if (g_cfg->gsup_server_port)
vty_out(vty, " gsup remote-port %d%s",
g_cfg->gsup_server_port, VTY_NEWLINE);
vty_out(vty, " authentication %s%s",
g_cfg->require_authentication ? "required" : "optional", VTY_NEWLINE);
if (g_cfg->auth_policy == SGSN_AUTH_POLICY_REMOTE && !g_cfg->require_authentication)
vty_out(vty, " authentication optional%s", VTY_NEWLINE);
vty_out(vty, " auth-policy %s%s",
get_value_string(sgsn_auth_pol_strs, g_cfg->auth_policy),
VTY_NEWLINE);
@ -697,9 +697,9 @@ DEFUN(cfg_encrypt, cfg_encrypt_cmd,
DEFUN(cfg_authentication, cfg_authentication_cmd,
"authentication (optional|required)",
"Whether to enforce MS authentication in GERAN\n"
"Allow MS to attach via GERAN without authentication\n"
"Always require authentication\n")
"Whether to enforce MS authentication in GERAN (only with auth-policy remote)\n"
"Allow MS to attach via GERAN without authentication (default and only possible value for non-remote auth-policy)\n"
"Always require authentication (only available for auth-policy remote, default with that auth-policy)\n")
{
int required = (argv[0][0] == 'r');
@ -730,10 +730,6 @@ DEFUN(cfg_auth_policy, cfg_auth_policy_cmd,
g_cfg->auth_policy = val;
g_cfg->require_update_location = (val == SGSN_AUTH_POLICY_REMOTE);
/* Authentication is not possible without HLR */
if (val != SGSN_AUTH_POLICY_REMOTE)
g_cfg->require_authentication = 0;
return CMD_SUCCESS;
}
@ -1489,14 +1485,6 @@ int sgsn_parse_config(const char *config_file)
return rc;
}
if (g_cfg->auth_policy != SGSN_AUTH_POLICY_REMOTE
&& g_cfg->require_authentication) {
fprintf(stderr, "Configuration error:"
" authentication is not possible without HLR."
" Consider setting 'auth-policy' to 'remote'\n");
return -EINVAL;
}
if (g_cfg->auth_policy == SGSN_AUTH_POLICY_REMOTE
&& !(g_cfg->gsup_server_addr.sin_addr.s_addr
&& g_cfg->gsup_server_port)) {