aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--doc/manuals/vty/sgsn_vty_reference.xml6
-rw-r--r--include/osmocom/sgsn/sgsn.h2
-rw-r--r--src/gprs/gprs_sgsn.c1
-rw-r--r--src/gprs/sgsn_vty.c22
4 files changed, 11 insertions, 20 deletions
diff --git a/doc/manuals/vty/sgsn_vty_reference.xml b/doc/manuals/vty/sgsn_vty_reference.xml
index ed117778e..e9cd32241 100644
--- a/doc/manuals/vty/sgsn_vty_reference.xml
+++ b/doc/manuals/vty/sgsn_vty_reference.xml
@@ -2232,9 +2232,9 @@
</command>
<command id='authentication (optional|required)'>
<params>
- <param name='authentication' doc='Whether to enforce MS authentication in GERAN' />
- <param name='optional' doc='Allow MS to attach via GERAN without authentication' />
- <param name='required' doc='Always require authentication' />
+ <param name='authentication' doc='Whether to enforce MS authentication in GERAN (only with auth-policy remote)' />
+ <param name='optional' doc='Allow MS to attach via GERAN without authentication (default and only possible value for non-remote auth-policy)' />
+ <param name='required' doc='Always require authentication (only available for auth-policy remote, default with that auth-policy)' />
</params>
</command>
<command id='encryption (GEA0|GEA1|GEA2|GEA3|GEA4)'>
diff --git a/include/osmocom/sgsn/sgsn.h b/include/osmocom/sgsn/sgsn.h
index c80355dba..0a6ea29ea 100644
--- a/include/osmocom/sgsn/sgsn.h
+++ b/include/osmocom/sgsn/sgsn.h
@@ -78,7 +78,9 @@ struct sgsn_config {
struct sockaddr_in gsup_server_addr;
int gsup_server_port;
+ /* Only meaningful if auth_policy is SGSN_AUTH_POLICY_REMOTE */
int require_authentication;
+
int require_update_location;
/* CDR configuration */
diff --git a/src/gprs/gprs_sgsn.c b/src/gprs/gprs_sgsn.c
index f725811d0..58011078d 100644
--- a/src/gprs/gprs_sgsn.c
+++ b/src/gprs/gprs_sgsn.c
@@ -987,6 +987,7 @@ struct sgsn_instance *sgsn_instance_alloc(void *talloc_ctx)
inst = talloc_zero(talloc_ctx, struct sgsn_instance);
inst->cfg.gtp_statedir = talloc_strdup(inst, "./");
inst->cfg.auth_policy = SGSN_AUTH_POLICY_CLOSED;
+ inst->cfg.require_authentication = true; /* only applies if auth_policy is REMOTE */
inst->cfg.gsup_server_port = OSMO_GSUP_PORT;
return inst;
}
diff --git a/src/gprs/sgsn_vty.c b/src/gprs/sgsn_vty.c
index 29c97718e..edc5b09f9 100644
--- a/src/gprs/sgsn_vty.c
+++ b/src/gprs/sgsn_vty.c
@@ -211,8 +211,8 @@ static int config_write_sgsn(struct vty *vty)
if (g_cfg->gsup_server_port)
vty_out(vty, " gsup remote-port %d%s",
g_cfg->gsup_server_port, VTY_NEWLINE);
- vty_out(vty, " authentication %s%s",
- g_cfg->require_authentication ? "required" : "optional", VTY_NEWLINE);
+ if (g_cfg->auth_policy == SGSN_AUTH_POLICY_REMOTE && !g_cfg->require_authentication)
+ vty_out(vty, " authentication optional%s", VTY_NEWLINE);
vty_out(vty, " auth-policy %s%s",
get_value_string(sgsn_auth_pol_strs, g_cfg->auth_policy),
VTY_NEWLINE);
@@ -697,9 +697,9 @@ DEFUN(cfg_encrypt, cfg_encrypt_cmd,
DEFUN(cfg_authentication, cfg_authentication_cmd,
"authentication (optional|required)",
- "Whether to enforce MS authentication in GERAN\n"
- "Allow MS to attach via GERAN without authentication\n"
- "Always require authentication\n")
+ "Whether to enforce MS authentication in GERAN (only with auth-policy remote)\n"
+ "Allow MS to attach via GERAN without authentication (default and only possible value for non-remote auth-policy)\n"
+ "Always require authentication (only available for auth-policy remote, default with that auth-policy)\n")
{
int required = (argv[0][0] == 'r');
@@ -730,10 +730,6 @@ DEFUN(cfg_auth_policy, cfg_auth_policy_cmd,
g_cfg->auth_policy = val;
g_cfg->require_update_location = (val == SGSN_AUTH_POLICY_REMOTE);
- /* Authentication is not possible without HLR */
- if (val != SGSN_AUTH_POLICY_REMOTE)
- g_cfg->require_authentication = 0;
-
return CMD_SUCCESS;
}
@@ -1489,14 +1485,6 @@ int sgsn_parse_config(const char *config_file)
return rc;
}
- if (g_cfg->auth_policy != SGSN_AUTH_POLICY_REMOTE
- && g_cfg->require_authentication) {
- fprintf(stderr, "Configuration error:"
- " authentication is not possible without HLR."
- " Consider setting 'auth-policy' to 'remote'\n");
- return -EINVAL;
- }
-
if (g_cfg->auth_policy == SGSN_AUTH_POLICY_REMOTE
&& !(g_cfg->gsup_server_addr.sin_addr.s_addr
&& g_cfg->gsup_server_port)) {