diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/acl_wl.conf.sample | 5 | ||||
| -rw-r--r-- | doc/dbg_loglevel.conf.sample | 13 | ||||
| -rw-r--r-- | doc/dict_json.json.sample | 17 | ||||
| -rw-r--r-- | doc/freediameter.conf.sample | 71 | ||||
| -rw-r--r-- | doc/rt_default.conf.sample | 4 | ||||
| -rw-r--r-- | doc/rt_deny_by_size.conf.sample | 11 | ||||
| -rw-r--r-- | doc/rt_ereg.conf.sample | 10 | ||||
| -rw-r--r-- | doc/rt_rewrite.conf.sample | 23 |
8 files changed, 140 insertions, 14 deletions
diff --git a/doc/acl_wl.conf.sample b/doc/acl_wl.conf.sample index 6686f1a..e80039a 100644 --- a/doc/acl_wl.conf.sample +++ b/doc/acl_wl.conf.sample @@ -3,6 +3,11 @@ # This extension is meant to allow connection from remote peers, without actively # maintaining this connection ourselves (as it would be the case by declaring the # peer in a ConnectPeer directive). +# +# This extension supports configuration reload at runtime. Send +# signal SIGUSR1 to the process to cause the process to reload its +# config. +# # The format of this file is very simple. It contains a list of peer names # separated by spaces or newlines. # diff --git a/doc/dbg_loglevel.conf.sample b/doc/dbg_loglevel.conf.sample new file mode 100644 index 0000000..201543c --- /dev/null +++ b/doc/dbg_loglevel.conf.sample @@ -0,0 +1,13 @@ +# This file contains information for configuring the dbg_loglevel extension. +# +# The dbg_loglevel extension allows changing the logging level at startup, +# and then changing it at runtime. +# +# This extension supports configuration reload at runtime. Send +# signal SIGUSR1 to the process to cause the process to reload its +# config. +# +# 3 is the default log level (FD_LOG_NOTICE) +# smaller values increase the logging +# bigger values reduce the logging +LogLevel=3; diff --git a/doc/dict_json.json.sample b/doc/dict_json.json.sample new file mode 100644 index 0000000..c8c87bf --- /dev/null +++ b/doc/dict_json.json.sample @@ -0,0 +1,17 @@ +# Configuration for the JSON dictionary extension (no config file needed) +# +# This extension allows configuration of diameter dictionaries +# in JSON format. +# +# To load the JSON dictionaries, list their paths, separated with a semicolon (';') +# as argument when loading the extension in the freeDiameter config file, i.e.: +# +# LoadExtension = "dict_json.so":"/path/to/dictionary.json;/path/to/another/dictionary_2.json"; +# +# Relative paths work but are hard to get right because they are +# relative to where you started the freeDiameter daemon. +# +# The dictionaries must conform to the JSON schema in +# extensions/dict_json/dict_json_dict_schema.json +# +# Example dictionaries are in contrib/dict_json. diff --git a/doc/freediameter.conf.sample b/doc/freediameter.conf.sample index 4b2ba9e..e6a6146 100644 --- a/doc/freediameter.conf.sample +++ b/doc/freediameter.conf.sample @@ -5,12 +5,12 @@ # It is possible to use "include" keyword to import additional files # e.g.: include "/etc/freeDiameter.d/*.conf" -# This is exactly equivalent as copy & paste the content of the included file(s) +# This is exactly equivalent as copy & paste the content of the included file(s) # where the "include" keyword is found. ############################################################## -## Peer identity and realm +## Peer identity and realm # The Diameter Identity of this daemon. # This must be a valid FQDN that resolves to the local host. @@ -34,10 +34,10 @@ # Default: 5868. Use 0 to disable. #SecPort = 5868; -# Use RFC3588 method for TLS protection, where TLS is negociated after CER/CEA exchange is completed -# on the unsecure connection. The alternative is RFC6733 mechanism, where TLS protects also the +# Use RFC3588 method for TLS protection, where TLS is negociated after CER/CEA exchange is completed +# on the unsecure connection. The alternative is RFC6733 mechanism, where TLS protects also the # CER/CEA exchange on a dedicated secure port. -# This parameter only affects outgoing connections. +# This parameter only affects outgoing connections. # The setting can be also defined per-peer (see Peers configuration section). # Default: use RFC6733 method with separate port for TLS. #TLS_old_method; @@ -88,6 +88,19 @@ # Default: 5 unidentified clients in paralel. #ThreadsPerServer = 5; +# If this host is used as relay or proxy, it can be useful to limit +# connections from "outside" until enough processing nodes are available. +# This parameter defines a regex pattern for recognizing such nodes; +# Default: NO DEFAULT +#ProcessingPeersPattern = "worker[0-9]*.example.com"; + +# This next parameter defines how many of these processing peers +# must be connected before CERs from other hosts are accepted. +# If this is set, ProcessingPeersPattern must also be defined. +# If unset or less than 1, ProcessingPeersPattern and this variable do nothing. +# Default: 0 +#ProcessingPeersMinimum = 0; + ############################################################## ## TLS Configuration @@ -113,14 +126,14 @@ TLS_Cred = "/etc/ssl/certs/freeDiameter.pem", "/etc/ssl/private/freeDiameter.key # Certificate Revocation List file # The information about revoked certificates. -# The file contains a list of trusted CRLs in PEM format. They should have been verified before. +# The file contains a list of trusted CRLs in PEM format. They should have been verified before. # (This parameter is passed to gnutls_certificate_set_x509_crl_file function) # Note: openssl CRL format might have interoperability issue with GNUTLS format. # Default : GNUTLS default behavior #TLS_CRL = "<file.PEM>"; # GNU TLS Priority string -# This string allows to configure the behavior of GNUTLS key exchanges +# This string allows to configure the behavior of GNUTLS key exchanges # algorithms. See gnutls_priority_init function documentation for information. # You should also refer to the Diameter required TLS support here: # http://tools.ietf.org/html/rfc6733#section-13.1 @@ -131,13 +144,13 @@ TLS_Cred = "/etc/ssl/certs/freeDiameter.pem", "/etc/ssl/private/freeDiameter.key # Diffie-Hellman parameters size # Set the number of bits for generated DH parameters # Valid value should be 768, 1024, 2048, 3072 or 4096. -# (This parameter is passed to gnutls_dh_params_generate2 function, +# (This parameter is passed to gnutls_dh_params_generate2 function, # it usually should match RSA key size) # Default : 1024 #TLS_DH_Bits = 1024; # Alternatively, you can specify a file to load the PKCS#3 encoded -# DH parameters directly from. This accelerates the daemon start +# DH parameters directly from. This accelerates the daemon start # but is slightly less secure. If this file is provided, the # TLS_DH_Bits parameters has no effect. # Default : no default. @@ -165,8 +178,8 @@ TLS_Cred = "/etc/ssl/certs/freeDiameter.pem", "/etc/ssl/private/freeDiameter.key # Disable the relaying of Diameter messages? # For messages not handled locally, the default behavior is to forward the -# message to another peer if any is available, according to the routing -# algorithms. In addition the "0xffffff" application is advertised in CER/CEA +# message to another peer if any is available, according to the routing +# algorithms. In addition the "0xffffff" application is advertised in CER/CEA # exchanges. # Default: Relaying is enabled. #NoRelay; @@ -175,6 +188,29 @@ TLS_Cred = "/etc/ssl/certs/freeDiameter.pem", "/etc/ssl/private/freeDiameter.key # Default: 4 #AppServThreads = 4; +# Number of server threads that can handle incoming message routing at the same time. +# Default: 1 +#RoutingInThreads = 1; + +# Number of server threads that can handle outgoing message routing at the same time. +# Default: 1 +#RoutingOutThreads= 1; + +# Maximum size of the incoming queue (messages queued after accepting +# them from the network) before blocking +# Default: 20 +#IncomingQueueLimit = 20; + +# Maximum size of the outgoing queue (messages queued for sending to +# the network) before blocking +# Default: 30 +#OutgoingQueueLimit = 30; + +# Maximum size of the local queue (messages queued for local handling) +# before blocking +# Default: 25 +#LocalQueueLimit = 25; + # Other applications are configured by loaded extensions. ############################################################## @@ -184,7 +220,7 @@ TLS_Cred = "/etc/ssl/certs/freeDiameter.pem", "/etc/ssl/private/freeDiameter.key # Diameter Base Protocol. The specific application behaviors, # as well as advanced functions, are provided # by loadable extensions (plug-ins). -# These extensions may in addition receive the name of a +# These extensions may in addition receive the name of a # configuration file, the format of which is extension-specific. # # Format: @@ -223,9 +259,9 @@ TLS_Cred = "/etc/ssl/certs/freeDiameter.pem", "/etc/ssl/private/freeDiameter.key # The local server listens for incoming connections. By default, # all unknown connecting peers are rejected. Extensions can override this behavior (e.g., acl_wl). -# +# # In addition to incoming connections, the local peer can -# be configured to establish and maintain connections to some +# be configured to establish and maintain connections to some # Diameter nodes and allow connections from these nodes. # This is achieved with the ConnectPeer directive described below. # @@ -250,3 +286,10 @@ TLS_Cred = "/etc/ssl/certs/freeDiameter.pem", "/etc/ssl/private/freeDiameter.key ############################################################## +## General settings + +# If Route-Record AVPs should be added in Answers. +# Possible values: Always, Never +# Default: Always +#RouteRecordInAnswers = Never; + diff --git a/doc/rt_default.conf.sample b/doc/rt_default.conf.sample index c211100..f3b471d 100644 --- a/doc/rt_default.conf.sample +++ b/doc/rt_default.conf.sample @@ -2,6 +2,10 @@ # # This extension provides configurable routing properties for freeDiameter. +# This extension supports configuration reload at runtime. Send +# signal SIGUSR1 to the process to cause the process to reload its +# config. + # Lines starting with a # are comments and ignored. ############################################################################## diff --git a/doc/rt_deny_by_size.conf.sample b/doc/rt_deny_by_size.conf.sample new file mode 100644 index 0000000..010e848 --- /dev/null +++ b/doc/rt_deny_by_size.conf.sample @@ -0,0 +1,11 @@ +# This file contains information for configuring the rt_deny_by_size extension. +# +# The rt_deny_by_size extension returns errors for messages above a particular size. +# +# This extension supports configuration reload at runtime. Send +# signal SIGUSR1 to the process to cause the process to reload its +# config. +# +# Configure the maximum allowed message size to still pass through; +# defaults to 4096, if config file is empty +#MaximumSize=4096; diff --git a/doc/rt_ereg.conf.sample b/doc/rt_ereg.conf.sample index fd9d4d9..fbcb370 100644 --- a/doc/rt_ereg.conf.sample +++ b/doc/rt_ereg.conf.sample @@ -3,9 +3,15 @@ # # The rt_ereg extension allows creation of routing rules based on AVP value matching regular expressions. +# This extension supports configuration reload at runtime. Send +# signal SIGUSR1 to the process to cause the process to reload its +# config. + # First, one must indicate which AVP should be used for matching. # At the moment, only AVP with OCTETSTRING types are valid. # AVP = "User-Name"; +# It is possible to specify AVPs below GROUPED AVPs with the by separating AVPs with a colon (':'): +# AVP = "Grouped-AVP1" : "Grouped-AVP2" : "Octetstring-AVP"; # This parameter is mandatory. There is no default value. # Then a list of rules follow. A rule has this format: @@ -19,3 +25,7 @@ # means that if the AVP value is only numeric, the ServerA will have its score decreased by 3 points. # (reminder: the server with the peer with the highest score gets the message) # Note that all rules are tested for each message that contain the AVP, not only the first match. + +# There can be multiple blocks of AVPs and rules; just start the next one with another AVP line: +# AVP = "Other-AVP"; +# and continue with rules as above. diff --git a/doc/rt_rewrite.conf.sample b/doc/rt_rewrite.conf.sample new file mode 100644 index 0000000..a6475e8 --- /dev/null +++ b/doc/rt_rewrite.conf.sample @@ -0,0 +1,23 @@ +# This file contains information for configuring the rt_rewrite extension +# To find how to have freeDiameter load this extension, please refer to the freeDiameter documentation. +# +# The rt_rewrite extension allows moving data from one AVP into another one, or dropping AVPs altogether. + +# This extension supports configuration reload at runtime. Send +# signal SIGUSR1 to the process to cause the process to reload its +# config. + +# The config consists of MAP for AVP pairs of source/target, or DROP for a source. +# +# MAP = "Source-AVP" > "Destination-AVP"; +# +# It is possible to specify AVPs below GROUPED AVPs with the by separating AVPs with a colon (':'): +# MAP = "Grouped-AVP1" : "Octetstring-AVP1" > "Grouped-AVP2" : "Grouped-AVP3" : "Octetstring-AVP2"; +# Intermediate destination grouped AVPs will be created automatically. +# +# NOTE: you can not move grouped AVPs as a unit, you have to move each separate AVP. +# i.e., this will not work: +# MAP = "Grouped-AVP1" > "Grouped-AVP2"; +# +# For removing AVPs, use DROP: +# DROP = "Grouped-AVP1" : "Octetstring-AVP1"; |