After trying 2.0.0-pre2 in a number of scenarios... I've committed some more code. - realm "authhost" parsing was broken - radclient doesn't die on receiving packets with bad signatures - client sections can now have "ipaddr" or "ipv6addr" fields, to use the same syntax as home servers, listen, etc. The old syntax is still allowed - documentation for virtual servers in sites-available/README - updated ChangeLog I've also tested multiple virtual servers proxying requests to themselves with load balancing && failover. Nice. It makes a number of tests much easier to perform. Alan DeKok.
Alan DeKok wrote:
After trying 2.0.0-pre2 in a number of scenarios... I've committed some more code.
- realm "authhost" parsing was broken
- radclient doesn't die on receiving packets with bad signatures - client sections can now have "ipaddr" or "ipv6addr" fields, to use the same syntax as home servers, listen, etc.
Awesome, this makes things much easier .... Now when proxy IPs and shared secrets change, you can just update them in a single config stanza and have it filter out to the rest of the config.
The old syntax is still allowed - documentation for virtual servers in sites-available/README - updated ChangeLog
I've also tested multiple virtual servers proxying requests to themselves with load balancing && failover. Nice. It makes a number of tests much easier to perform.
"Added explicit $template foo.bar.baz function, which means that you no longer have to put those things into a separate file." Is that templates as in set default values for a stanza templates, that you added a few months back ? Previously I noticed you could only use one templates section in the entire config... and although that works ok, it's harder to maintain. So allowing multiple template stanzas would be a good thing.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Arran
Arran Cudbard-Bell wrote:
- client sections can now have "ipaddr" or "ipv6addr" fields, to use the same syntax as home servers, listen, etc.
Awesome, this makes things much easier .... Now when proxy IPs and shared secrets change, you can just update them in a single config stanza and have it filter out to the rest of the config.
It gets better: templates { foo { ipaddr = 127.0.0.1 secret = "testing123 type = auth port = 1812 } } ... client foo { $template templates.foo } listen { $template templates.foo } home_server foo { $template templates.foo } The example isn't complete, of course, but it's pretty close.
"Added explicit $template foo.bar.baz function, which means that you no longer have to put those things into a separate file."
Is that templates as in set default values for a stanza templates, that you added a few months back ?
Yes, but better. Some simple examples with the existing templates work. More complex ones are problematic. That's why I added the new syntax as described above. It's much cleaner in many respects.
Previously I noticed you could only use one templates section in the entire config... and although that works ok, it's harder to maintain. So allowing multiple template stanzas would be a good thing.
The new one allows the $template syntax to reference absolutely anything in the configuration files. Alan DeKok.
Alan DeKok wrote:
Arran Cudbard-Bell wrote:
- client sections can now have "ipaddr" or "ipv6addr" fields, to use the same syntax as home servers, listen, etc.
Awesome, this makes things much easier .... Now when proxy IPs and shared secrets change, you can just update them in a single config stanza and have it filter out to the rest of the config.
It gets better:
templates { foo { ipaddr = 127.0.0.1 secret = "testing123 type = auth port = 1812 } } ... client foo { $template templates.foo }
listen { $template templates.foo }
home_server foo { $template templates.foo }
The example isn't complete, of course, but it's pretty close.
And it makes more sense for people who haven't used FR templates before, which is everyone...
"Added explicit $template foo.bar.baz function, which means that you no longer have to put those things into a separate file."
Is that templates as in set default values for a stanza templates, that you added a few months back ?
Yes, but better. Some simple examples with the existing templates work. More complex ones are problematic. That's why I added the new syntax as described above. It's much cleaner in many respects.
Previously I noticed you could only use one templates section in the entire config... and although that works ok, it's harder to maintain. So allowing multiple template stanzas would be a good thing.
The new one allows the $template syntax to reference absolutely anything in the configuration files.
So you could have In radiusd.conf templates { foo { ipaddr = 127.0.0.1 secret = "testing123 type = auth port = 1812 } } And templates { bar { ipaddr = 127.0.0.2 etc.. } } in proxy.conf ? So it'll parse additional template stanzas into the template struct ? But yes awesome feature :)
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Arran
Arran Cudbard-Bell wrote: ...
The new one allows the $template syntax to reference absolutely anything in the configuration files.
So you could have
In radiusd.conf templates { ... And templates { ... in proxy.conf ?
No. The sections are still defined globally. So the first section with the name "templates" will shadow all later ones. Alan DeKok.
Alan DeKok said:
It gets better:
templates { foo { ipaddr = 127.0.0.1 secret = "testing123 type = auth port = 1812 } } ... client foo { $template templates.foo }
listen { $template templates.foo }
home_server foo { $template templates.foo }
Apologies if this has been asked and answered, but just to make sure I'm understanding templates properly ... I assume I can override individual template settings, like this: test_server bar { $template templates.foo port = 6666 }
Alan DeKok.
-- hugh
Hugh Messenger wrote:
Apologies if this has been asked and answered, but just to make sure I'm understanding templates properly ... I assume I can override individual template settings, like this:
Yes. 1) local config applies 2) if no local config, look in template 3) if not in template, panic! :) Alan DeKok.
Previously I noticed you could only use one templates section in the entire config... and although that works ok, it's harder to maintain. So allowing multiple template stanzas would be a good thing.
The new one allows the $template syntax to reference absolutely anything in the configuration files.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Just wondering, did you ever come up with a resolution to the, clearing of reply attributes ? Arran
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Hugh Messenger