Porting rlm_eap_tls to GnuTLS - eaptls_handle_idx only needed for session caching?
Hi everybody, I am examining the rlm_eap_tls source code in order to replace the OpenSSL calls with GnuTLS calls. That seems to work pretty straight forward, but I found some lines of code, where I am not sure, whether I understood them right or not: /* * Register the application indices. We can't use * hard-coded "0" and "1" as before, because we need to * set up a "free" handler for the cached session * information. */ if (eaptls_handle_idx < 0) { eaptls_handle_idx = SSL_get_ex_new_index(0, "eaptls_handle_idx", NULL, NULL, NULL); } if (eaptls_conf_idx < 0) { eaptls_conf_idx = SSL_get_ex_new_index(0, "eaptls_conf_idx", NULL, NULL, NULL); } if (eaptls_session_idx < 0) { eaptls_session_idx = SSL_get_ex_new_index(0, "eaptls_session_idx", NULL, NULL, eaptls_session_free); } I would say, these lines are needed in order to implement session caching. Is that right? If yes, I would delete them first in order to get a simple setup for the first test and replace them later. Regards Carolin
Carolin Latze wrote:
I would say, these lines are needed in order to implement session caching. Is that right? If yes, I would delete them first in order to get a simple setup for the first test and replace them later.
The indexes are used to associate data structures with the SSL session context. It *might* work if you delete them... but you will likely need to replace them with static values. i.e eaptls_handle_ix = 0; eaptls_conf_ix = 1; ... Alan DeKok.
I have a single freeradius server with 1.1.7, its stable, but I would like to upgrade it to 2.1.4 version. Is it a sacrilege or mistake to use radius.conf and sites-available/default files to configure my single aaa server? Thanks !
Toledo, Luis Carlos wrote:
I have a single freeradius server with 1.1.7, its stable, but I would like to upgrade it to 2.1.4 version.
Is it a sacrilege or mistake to use radius.conf and sites-available/default files to configure my single aaa server?
What does that mean? Alan DeKok.
Hi,
Is it a sacrilege or mistake to use radius.conf and sites-available/default files to configure my single aaa server?
What does that mean?
thats what i was thinking ;-) to migrate from 1.1.x to 2.1.x you take 2.1.x and then configur it to do what your 1.1.x was doing - using the new location of configuration options alan
On Mon, 11 May 2009 15:01:22 +0200, Alan DeKok <aland@deployingradius.com> wrote:
Toledo, Luis Carlos wrote:
I have a single freeradius server with 1.1.7, its stable, but I would like to upgrade it to 2.1.4 version.
Is it a sacrilege or mistake to use radius.conf and sites-available/default files to configure my single aaa server?
What does that mean?
Could be asking whether it's wrong to use the sites-available include folder, instead of bundling it all into radiusd.conf when you have a single sever ? -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk), Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2
On Mon, 11 May 2009 15:01:22 +0200, Alan DeKok <aland@deployingradius.com> wrote:
Toledo, Luis Carlos wrote:
I have a single freeradius server with 1.1.7, its stable, but I would like to upgrade it to 2.1.4 version.
Is it a sacrilege or mistake to use radius.conf and sites-available/default files to configure my single aaa server?
What does that mean?
Could be asking whether it's wrong to use the sites-available include folder, instead of bundling it all into radiusd.conf when you have a single sever ?
I would like to say: Is it correct to use sites-available/default config file to put my configures? Or is it more correct to create a new config file?
On 12/5/09 14:01, Toledo, Luis Carlos wrote:
On Mon, 11 May 2009 15:01:22 +0200, Alan DeKok <aland@deployingradius.com> wrote:
Toledo, Luis Carlos wrote:
I have a single freeradius server with 1.1.7, its stable, but I would like to upgrade it to 2.1.4 version.
Is it a sacrilege or mistake to use radius.conf and sites-available/default files to configure my single aaa server? What does that mean?
Could be asking whether it's wrong to use the sites-available include folder, instead of bundling it all into radiusd.conf when you have a single sever ?
I would like to say: Is it correct to use sites-available/default config file to put my configures? Or is it more correct to create a new config file?
It's up to you. I'd recommend you keep the default file for reference, but there's a copy included with the src so it'd fine to go ahead and edit it. In general, policy configuration goes in the sites-available file, then module instance configuration is done in the various raddb/*.conf files and raddb/modules/*.conf. -- Arran Cudbard-Bell (A.Cudbard-Bell@sussex.ac.uk), Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Carolin Latze -
Toledo, Luis Carlos