Regarding backport fix of https://github.com/FreeRADIUS/freeradius-server/issues/3501 to 3.0.x branches.
Hi, I'm using the version 3.0.16, facing similar issue as https://github.com/FreeRADIUS/freeradius-server/issues/3501. https://github.com/FreeRADIUS/freeradius-server/issues/3501#issuecomment-152... It's difficult to upgrade to 3.2.x where these fixes are available. May I know if fix available in 3.0.x branches to use, I need it immediately. Thanks, Saurabha
On 2 May 2023, at 04:02, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Hi,
I'm using the version 3.0.16, facing similar issue as https://github.com/FreeRADIUS/freeradius-server/issues/3501. https://github.com/FreeRADIUS/freeradius-server/issues/3501#issuecomment-152... It's difficult to upgrade to 3.2.x where these fixes are available.
What’s the difficult to move to 3.2.x? Even the official packages are available in https://networkradius.com/packages/ <https://networkradius.com/packages/> `
May I know if fix available in 3.0.x branches to use, I need it immediately.
Well, the only way to have those packages now is to build your own packages directly from https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x <https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x>
Thanks, Saurabha - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Jorge Pereira jpereira@networkradius.com
Hi Jorge, Thanks for your response. I have already integrated 3.0.16 with local application and is already deployed in the production environment. It requires more time to upgrade to 3.2.x version. Surely will upgrade after some time, maybe a couple months later. But for now, is there any plan to backport to 3.0.x from yoru sdie, else if not can I get the relevant PRs applicable for this fix, I can take those changes and backport manually. Thanks, Saurabha On Tue, May 2, 2023 at 5:31 PM Jorge Pereira via Freeradius-Devel < freeradius-devel@lists.freeradius.org> wrote:
On 2 May 2023, at 04:02, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Hi,
I'm using the version 3.0.16, facing similar issue as https://github.com/FreeRADIUS/freeradius-server/issues/3501.
https://github.com/FreeRADIUS/freeradius-server/issues/3501#issuecomment-152...
It's difficult to upgrade to 3.2.x where these fixes are available.
What’s the difficult to move to 3.2.x? Even the official packages are available in https://networkradius.com/packages/ < https://networkradius.com/packages/> `
May I know if fix available in 3.0.x branches to use, I need it immediately.
Well, the only way to have those packages now is to build your own packages directly from https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x < https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x>
Thanks, Saurabha - List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/devel.html
Jorge Pereira jpereira@networkradius.com
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
On May 2, 2023, at 2:12 PM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Thanks for your response. I have already integrated 3.0.16 with local application and is already deployed in the production environment. It requires more time to upgrade to 3.2.x version. Surely will upgrade after some time, maybe a couple months later.
Version 3.2 will read the 3.0 configuration files with no changes. You could upgrade in 5 minutes if you wanted to do that.
But for now, is there any plan to backport to 3.0.x from yoru sdie, else if not can I get the relevant PRs applicable for this fix, I can take those changes and backport manually.
Not all of the commits are marked up with the relevant bug report (#3501). But you're welcome to do the back-port. Alan DeKok.
Hi Alan, Thanks for your reply, is it possible you to share all PRs relevant to fix #3501, if yes I can backport, else will wait 2-3 weeks for you to take care. Thanks, Saurabha On Tue, May 2, 2023 at 6:09 PM Alan DeKok <aland@deployingradius.com> wrote:
On May 2, 2023, at 2:12 PM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Thanks for your response. I have already integrated 3.0.16 with local application and is already deployed in the production environment. It requires more time to upgrade to 3.2.x version. Surely will upgrade after some time, maybe a couple months later.
Version 3.2 will read the 3.0 configuration files with no changes. You could upgrade in 5 minutes if you wanted to do that.
But for now, is there any plan to backport to 3.0.x from yoru sdie, else if not can I get the relevant PRs applicable for this fix, I can take those changes and backport manually.
Not all of the commits are marked up with the relevant bug report (#3501). But you're welcome to do the back-port.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
On May 2, 2023, at 3:01 PM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Thanks for your reply, is it possible you to share all PRs relevant to fix #3501, if yes I can backport, else will wait 2-3 weeks for you to take care.
I didn't say there were multiple PRs. I said that there were multiple commits. Not all commits have the PR #3501 in the commit message. Your best bet is to just upgrade to 3.2. It has many fixes over 3.0.16. Alan DeKok,.
Okay got it, But for me as I have local source file changes on top of 3.0.16 which deployed in the production, so it looks difficult to go for 3.2.x immediately. Thanks, Saurabha On Tue, May 2, 2023 at 6:34 PM Alan DeKok <aland@deployingradius.com> wrote:
On May 2, 2023, at 3:01 PM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Thanks for your reply, is it possible you to share all PRs relevant to fix #3501, if yes I can backport, else will wait 2-3 weeks for you to take care.
I didn't say there were multiple PRs.
I said that there were multiple commits. Not all commits have the PR #3501 in the commit message.
Your best bet is to just upgrade to 3.2. It has many fixes over 3.0.16.
Alan DeKok,.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Hi All, Any chance to back port to 3.0.x branches. Thanks, Saurabha On Tue, May 2, 2023 at 6:39 PM saurabha badhai <saurabha.badhai@gmail.com> wrote:
Okay got it, But for me as I have local source file changes on top of 3.0.16 which deployed in the production, so it looks difficult to go for 3.2.x immediately.
Thanks, Saurabha
On Tue, May 2, 2023 at 6:34 PM Alan DeKok <aland@deployingradius.com> wrote:
On May 2, 2023, at 3:01 PM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Thanks for your reply, is it possible you to share all PRs relevant to fix #3501, if yes I can backport, else will wait 2-3 weeks for you to take care.
I didn't say there were multiple PRs.
I said that there were multiple commits. Not all commits have the PR #3501 in the commit message.
Your best bet is to just upgrade to 3.2. It has many fixes over 3.0.16.
Alan DeKok,.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Thanks for your reply. I can do but need to get the list of PRs for this issue. As you said not all PRs have the #3501, then how to identify ? Thanks, Saurabha Badhai On Fri, May 19, 2023 at 6:29 PM Alan DeKok <aland@deployingradius.com> wrote:
On May 19, 2023, at 1:55 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Any chance to back port to 3.0.x branches.
Perhaps soon.
Or, the source code is available. You're free to redo the patches and submit a pull request on GitHub.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Hi All, I see this update. [FreeRADIUS/freeradius-server] Port TLS nonblocking fixes from 3.2.x to 3.0.x, including TLS tests (PR #5013) Does PR #5013 include complete fixes for issue 3501 ? Can I take all changes directly from this PR ? Thanks, Saurabha Badhai On Mon, May 22, 2023 at 10:06 AM saurabha badhai <saurabha.badhai@gmail.com> wrote:
Thanks for your reply. I can do but need to get the list of PRs for this issue. As you said not all PRs have the #3501, then how to identify ?
Thanks, Saurabha Badhai
On Fri, May 19, 2023 at 6:29 PM Alan DeKok <aland@deployingradius.com> wrote:
On May 19, 2023, at 1:55 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Any chance to back port to 3.0.x branches.
Perhaps soon.
Or, the source code is available. You're free to redo the patches and submit a pull request on GitHub.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
On Jun 1, 2023, at 5:04 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
I see this update. [FreeRADIUS/freeradius-server] Port TLS nonblocking fixes from 3.2.x to 3.0.x, including TLS tests (PR #5013)
Does PR #5013 include complete fixes for issue 3501 ? Can I take all changes directly from this PR ?
I suggest looking at the v3.0.x branch in git. Alan DeKok.
Sure. Will do that. Thanks, Saurabha Badhai On Thu, Jun 1, 2023 at 5:35 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jun 1, 2023, at 5:04 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
I see this update. [FreeRADIUS/freeradius-server] Port TLS nonblocking fixes from 3.2.x to 3.0.x, including TLS tests (PR #5013)
Does PR #5013 include complete fixes for issue 3501 ? Can I take all changes directly from this PR ?
I suggest looking at the v3.0.x branch in git.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Hi All, I was going through the codebase 3.0.x which includes TLS non blocking fix. I see still TCP is blocking as set to False below. this->fd = fr_socket_client_tcp(&home->src_ipaddr, &home->ipaddr, home->port, *false*); In my case, issue is when AAA server not reachable, service thread get stuck in the above TCP connect for around 2 mins and no other messge get processed for that time. Is the PR #5013 (Fix for issue #3501) having this fix as well ? Thanks, Saurabha On Thu, Jun 1, 2023 at 9:30 PM saurabha badhai <saurabha.badhai@gmail.com> wrote:
Sure. Will do that.
Thanks, Saurabha Badhai
On Thu, Jun 1, 2023 at 5:35 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jun 1, 2023, at 5:04 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
I see this update. [FreeRADIUS/freeradius-server] Port TLS nonblocking fixes from 3.2.x to 3.0.x, including TLS tests (PR #5013)
Does PR #5013 include complete fixes for issue 3501 ? Can I take all changes directly from this PR ?
I suggest looking at the v3.0.x branch in git.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
On Jun 6, 2023, at 7:32 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
I was going through the codebase 3.0.x which includes TLS non blocking fix. I see still TCP is blocking as set to False below.
this->fd = fr_socket_client_tcp(&home->src_ipaddr, &home->ipaddr, home->port, *false*);
In my case, issue is when AAA server not reachable, service thread get stuck in the above TCP connect for around 2 mins and no other messge get processed for that time. Is the PR #5013 (Fix for issue #3501) having this fix as well ?
That should probably be "!sock->nonblock" instead of a hard-coded "false". Alan DeKok.
Yes got it, so in TLS connection, TCP connect can be used as non-Blocking mode now with the PR #5013 without any issue, Could you please confirm ? Thanks, Saurabha On Tue, Jun 6, 2023 at 11:13 AM Alan DeKok <aland@deployingradius.com> wrote:
On Jun 6, 2023, at 7:32 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
I was going through the codebase 3.0.x which includes TLS non blocking fix. I see still TCP is blocking as set to False below.
this->fd = fr_socket_client_tcp(&home->src_ipaddr, &home->ipaddr, home->port, *false*);
In my case, issue is when AAA server not reachable, service thread get stuck in the above TCP connect for around 2 mins and no other messge get processed for that time. Is the PR #5013 (Fix for issue #3501) having this fix as well ?
That should probably be "!sock->nonblock" instead of a hard-coded "false".
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
On Jun 6, 2023, at 7:57 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Yes got it, so in TLS connection, TCP connect can be used as non-Blocking mode now with the PR #5013 without any issue, Could you please confirm ?
If you read the code, you'll see that bare TCP cannot be used in non-blocking mode. The non-blocking code uses the internal TLS buffers to write data when the TCP connection is blocked. Those TLS buffers don't exist for RADIUS/TCP. So they're not used. In short: don't use RADIUS/TCP. It's insecure. It offers no value over RADIUS/UDP, or RADIUS/TLS. Just use RADIUS/TLS. Alan DeKok.
Yes I am using RADSEC which uses TLS. I see in TLS establishment procedure first part is TCP connection and then starts TLS handshake to make a secure connection. I am facing an issue in the first part in TCP connect, thread get stuck here in *fr_socket_client_tcp and *does not come out for 2 mins if AAA server is down or network is unavailable which impacts other radius messages to process around that time. This blocks the complete server to process any message. My doubt is whether this TCP blocking for 2 mins before the TLS handshake procedure gets fixed with this TLS non-blocking PRs ? Thanks, Saurabha On Tue, Jun 6, 2023 at 11:32 AM Alan DeKok <aland@deployingradius.com> wrote:
On Jun 6, 2023, at 7:57 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Yes got it, so in TLS connection, TCP connect can be used as non-Blocking mode now with the PR #5013 without any issue, Could you please confirm ?
If you read the code, you'll see that bare TCP cannot be used in non-blocking mode.
The non-blocking code uses the internal TLS buffers to write data when the TCP connection is blocked. Those TLS buffers don't exist for RADIUS/TCP. So they're not used.
In short: don't use RADIUS/TCP. It's insecure. It offers no value over RADIUS/UDP, or RADIUS/TLS.
Just use RADIUS/TLS.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
I mean the below part: /* * FIXME:* connect() is blocking!* * We do this with the proxy mutex locked, which may * cause large delays! * * http://www.developerweb.net/forum/showthread.php?p=13486 */ this->fd = *fr_socket_client_tcp*(&home->src_ipaddr, &home->ipaddr, home->port, *false*); Thanks, Saurabha On Tue, Jun 6, 2023 at 2:49 PM saurabha badhai <saurabha.badhai@gmail.com> wrote:
Yes I am using RADSEC which uses TLS. I see in TLS establishment procedure first part is TCP connection and then starts TLS handshake to make a secure connection.
I am facing an issue in the first part in TCP connect, thread get stuck here in *fr_socket_client_tcp and *does not come out for 2 mins if AAA server is down or network is unavailable which impacts other radius messages to process around that time. This blocks the complete server to process any message.
My doubt is whether this TCP blocking for 2 mins before the TLS handshake procedure gets fixed with this TLS non-blocking PRs ?
Thanks, Saurabha
On Tue, Jun 6, 2023 at 11:32 AM Alan DeKok <aland@deployingradius.com> wrote:
On Jun 6, 2023, at 7:57 AM, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Yes got it, so in TLS connection, TCP connect can be used as
non-Blocking
mode now with the PR #5013 without any issue, Could you please confirm ?
If you read the code, you'll see that bare TCP cannot be used in non-blocking mode.
The non-blocking code uses the internal TLS buffers to write data when the TCP connection is blocked. Those TLS buffers don't exist for RADIUS/TCP. So they're not used.
In short: don't use RADIUS/TCP. It's insecure. It offers no value over RADIUS/UDP, or RADIUS/TLS.
Just use RADIUS/TLS.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
On 06/06/2023 10:19, saurabha badhai wrote:
My doubt is whether this TCP blocking for 2 mins before the TLS handshake procedure gets fixed with this TLS non-blocking PRs ?
Rather than keep asking questions about the code, you could save a lot of time and just actually try it. The known problems with this issue are fixed in 3.2.3, that's the best option to go for. It was backported to 3.0, so 3.0.x HEAD should also be fine. It's free software. You haven't got to pay any licence fee to upgrade. You can test it out and see if there is a problem with the versions that to our knowledge are all good. If there are bugs in the latest version then reporting that would actually be helpful. At some point you are just going to have to upgrade anyway as you know you've got a problem on your current version. You may as well do it now. Asking questions about code that you think might have a problem but haven't even tried is just wasting everyone's time. -- Matthew
The reason is because we still working in the issue #301, it’s almost 100% Maybe two…three weeks should be enough to validate everything and backport to v3.0.x, then release official packages.
On 2 May 2023, at 09:12, saurabha badhai <saurabha.badhai@gmail.com> wrote:
Hi Jorge,
Thanks for your response. I have already integrated 3.0.16 with local application and is already deployed in the production environment. It requires more time to upgrade to 3.2.x version. Surely will upgrade after some time, maybe a couple months later.
But for now, is there any plan to backport to 3.0.x from yoru sdie, else if not can I get the relevant PRs applicable for this fix, I can take those changes and backport manually.
Thanks, Saurabha
On Tue, May 2, 2023 at 5:31 PM Jorge Pereira via Freeradius-Devel <freeradius-devel@lists.freeradius.org <mailto:freeradius-devel@lists.freeradius.org>> wrote:
On 2 May 2023, at 04:02, saurabha badhai <saurabha.badhai@gmail.com <mailto:saurabha.badhai@gmail.com>> wrote:
Hi,
I'm using the version 3.0.16, facing similar issue as https://github.com/FreeRADIUS/freeradius-server/issues/3501 <https://github.com/FreeRADIUS/freeradius-server/issues/3501>. https://github.com/FreeRADIUS/freeradius-server/issues/3501#issuecomment-152... <https://github.com/FreeRADIUS/freeradius-server/issues/3501#issuecomment-1528795680> It's difficult to upgrade to 3.2.x where these fixes are available.
What’s the difficult to move to 3.2.x? Even the official packages are available in https://networkradius.com/packages/ <https://networkradius.com/packages/> <https://networkradius.com/packages/ <https://networkradius.com/packages/>> `
May I know if fix available in 3.0.x branches to use, I need it immediately.
Well, the only way to have those packages now is to build your own packages directly from https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x <https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x> <https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x <https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x>>
Thanks, Saurabha - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html <http://www.freeradius.org/list/devel.html>
Jorge Pereira jpereira@networkradius.com <mailto:jpereira@networkradius.com>
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html <http://www.freeradius.org/list/devel.html>
Jorge Pereira jpereira@networkradius.com
participants (4)
-
Alan DeKok -
Jorge Pereira -
Matthew Newton -
saurabha badhai