Re: rlm_ldap & TCP KeepAlive
Message: 4 Date: Fri, 30 Apr 2010 11:56:25 +0200 From: Alan DeKok <aland at deployingradius.com> Subject: Re: rlm_ldap & TCP KeepAlive To: FreeRadius developers mailing list <freeradius-devel at lists.freeradius.org> Message-ID: <4BDAA949.3020100 at deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1
Fred MAISON wrote:
Some stateful equipments like firewall or load-balancers tends to drop long-time idle tcp session to protect their session tables. To keep idle tcp session active and avoid this kind of deconnections, I found it could be useful to be able to configure TCP KeepAlive from rlm_ldap config file, exposing TCP KeepAlive options available in Openldap libraries to rlm_ldap config file : LDAP_OPT_X_KEEPALIVE_IDLE, LDAP_OPT_X_KEEPALIVE_PROBES, LDAP_OPT_X_KEEPALIVE_INTERVAL
Yup.
Unfortunately, as Redhat released his 5.5, I don't have anymore access to jdennis binary repository, so I am in trouble to recompile 2.1.8 for CentOS 5.4 on x86_64. I have tried to recompile freeradius 2.1.8 with this patch from fedoraproject cvs sources, but I don't know how to integrate this patch in the source tree.
Use the "patch" program:
$ hg diff > patch $ cd src/modules/rlm_ldap $ patch -p1 < ../../patch
Then build it.
This can be done after the "configure" stage.
Once validated, could this kind of code be integrated in a future release ?
Yes. John has a number of LDAP patches pending.
Alan DeKok.
I am interested with John's patches. Where are they available ? I am also interested with Alexander Coulter patches you talked about in a post dated 28 Jan 2010 17:36:46 +0100 regarding ldap redundancy & Ldap-Group checkItem in user file (message 4B61BD1E.1090005 at deployingradius.com) As you talked about integration of those patches in 2.2.0, How can I access freeradius 2.2.x cvs ? I tried cvs -d :pserver:anoncvs at cvs.freeradius.org:/source checkout radiusd, but the version retrieved there seems to be 2.0.6 ... Best regards, Fred MAISON
Fred MAISON wrote:
I am interested with John's patches. Where are they available ?
fedorasource CVS.
I am also interested with Alexander Coulter patches you talked about in a post dated 28 Jan 2010 17:36:46 +0100 regarding ldap redundancy & Ldap-Group checkItem in user file (message 4B61BD1E.1090005 at deployingradius.com)
As you talked about integration of those patches in 2.2.0, How can I access freeradius 2.2.x cvs ? I tried cvs -d :pserver:anoncvs at cvs.freeradius.org:/source checkout radiusd, but the version retrieved there seems to be 2.0.6 ...
See the main web page... the "download" link has instructions for checking the code out of source control. Alan DeKok.
On 04/30/2010 09:26 AM, Alan DeKok wrote:
Fred MAISON wrote:
I am interested with John's patches. Where are they available ?
fedorasource CVS.
It the file called "freeradius-1.1.7-ipa.patch" So here are some caveats: It was never deployed, thus it's only had minimal testing. I took a quick look at the patch yesterday and I see it has both sasl and krb5 support I don't recall the reasoning why. The krb5 code should be reviewed by our kerberos guru because using krb5 is not always intuitive and it's easy to make a mistake, that review has not been done yet. The code to load the NAS client list is independent of authentication support in the same patch, however I seem to recall it was tied pretty closely to the NAS client code in 1.1.7, that might need to be reexamined for the 2.x code base, also I think some of the code in rlm_ldap has changed in 2.x. I'd like to port the patch to 2.x and get it reviewed internally, I just don't have the cycles at the moment. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
Le vendredi 30 avril 2010 à 14:19 +0200, Fred MAISON a écrit :
Message: 4 Date: Fri, 30 Apr 2010 11:56:25 +0200 From: Alan DeKok <aland at deployingradius.com> Subject: Re: rlm_ldap & TCP KeepAlive To: FreeRadius developers mailing list <freeradius-devel at lists.freeradius.org> Message-ID: <4BDAA949.3020100 at deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1
Fred MAISON wrote:
Some stateful equipments like firewall or load-balancers tends to drop long-time idle tcp session to protect their session tables. To keep idle tcp session active and avoid this kind of deconnections, I found it could be useful to be able to configure TCP KeepAlive from rlm_ldap config file, exposing TCP KeepAlive options available in Openldap libraries to rlm_ldap config file : LDAP_OPT_X_KEEPALIVE_IDLE, LDAP_OPT_X_KEEPALIVE_PROBES, LDAP_OPT_X_KEEPALIVE_INTERVAL
Yup.
Unfortunately, as Redhat released his 5.5, I don't have anymore access to jdennis binary repository, so I am in trouble to recompile 2.1.8 for CentOS 5.4 on x86_64. I have tried to recompile freeradius 2.1.8 with this patch from fedoraproject cvs sources, but I don't know how to integrate this patch in the source tree.
Use the "patch" program:
$ hg diff > patch $ cd src/modules/rlm_ldap $ patch -p1 < ../../patch
Then build it.
This can be done after the "configure" stage.
Once validated, could this kind of code be integrated in a future release ?
Yes. John has a number of LDAP patches pending.
Alan DeKok.
I am interested with John's patches. Where are they available ? I am also interested with Alexander Coulter patches you talked about in a post dated 28 Jan 2010 17:36:46 +0100 regarding ldap redundancy & Ldap-Group checkItem in user file (message 4B61BD1E.1090005 at deployingradius.com)
As you talked about integration of those patches in 2.2.0, How can I access freeradius 2.2.x cvs ? I tried cvs -d :pserver:anoncvs at cvs.freeradius.org:/source checkout radiusd, but the version retrieved there seems to be 2.0.6 ...
Best regards, Fred MAISON
Hello freeradius-devel, I have successfully tested this weekend my ldap keepalive patch for freeradius 2.1.8. Among some other issues, those options are only available since openldap library version 2.4.18, so I have enclosed all my code's sections with #ifdef LDAP_OPT_X_KEEPALIVE_IDLE ..... #endif to avoid build problem if only older openldap version not supporting those settings is there. I tested in a VMWare under Debian Squeeze (32bits) and CentOS 5.4 (32bits) , after a manual build, install, ldd ... of the last stable openldap source tree, as I don't have enought RPM and SRPMS knowledge to cleanly rebuild all dependencies for both openldap libraries and freeradius tree. I have verified that configured keepalive are correctly taken into account, observing TCP KeepAlive packets at configured interval on ldap sockets with wireshark. I also checked that keepalive_idle, keepalive_probes and keepalive_interval parameter are correctly applied if configured in rlm_ldap module configuration files. As a resume, * this patch correctly protect from unsollicitated disconnections by firewalls or load-balancers traversed by ldap sessions when idle for some time ... * As most majors linux distros does not have 2.4.18+ openldap library version yet, this can be a problem to cleanly use this patch, as this means it's necessary to also rebuild openldap 2.4.18+ library from source tarball ... Best regards, Fred MAISON
participants (3)
-
Alan DeKok -
Fred MAISON -
John Dennis