Hi, we use freeradius (currently 2.2.0) status server feature to gather statistics from our RADIUS servers (and plot it with rrdtool), which works quite nice, with a single flaw: As documented in the status server example config, "The Status-Server packets are also counted in the total requests && responses.". This falsifies the numbers, especially since we use two different stats (one global, one separated by client). There is a packet code for Status-Client (13) besides Status-Server (12), so I modified the code to use and accept that one (patch attached, only slightly tested). So I wondered, is there a specific reason for using Access-Accept instead of Status-Client? (Ok, the reply code could also be Access-Reject, but AFAICS this only used for Status-Server requests on non-status port, which would be an unusual situation, so I guess that's ok.) Regards Jakob
Jakob Hirsch wrote:
we use freeradius (currently 2.2.0) status server feature to gather statistics from our RADIUS servers (and plot it with rrdtool), which works quite nice, with a single flaw: As documented in the status server example config, "The Status-Server packets are also counted in the total requests && responses.".
That could be fixed with minor code changes.
This falsifies the numbers, especially since we use two different stats (one global, one separated by client). There is a packet code for Status-Client (13) besides Status-Server (12), so I modified the code to use and accept that one (patch attached, only slightly tested).
RFC 5997 says that the response to Status-Server is Access-Accept
So I wondered, is there a specific reason for using Access-Accept instead of Status-Client? (Ok, the reply code could also be Access-Reject, but AFAICS this only used for Status-Server requests on non-status port, which would be an unusual situation, so I guess that's ok.)
It came out of discussion on the IETF RADEXT list. It's easier just to fix the code so that the Status-Server packets aren't counted. Alan DeKok.
On 05.03.2013 18:53, Alan DeKok wrote:
we use freeradius (currently 2.2.0) status server feature to gather statistics from our RADIUS servers (and plot it with rrdtool), which works quite nice, with a single flaw: As documented in the status server example config, "The Status-Server packets are also counted in the total requests && responses.". That could be fixed with minor code changes.
We could check the original packet code before incrementing the counter. Would you accept a patch that does this?
There is a packet code for Status-Client (13) besides Status-Server (12), so I modified the code to use and accept that one (patch attached, only slightly tested). RFC 5997 says that the response to Status-Server is Access-Accept
Ok, we surely don't want to break RFCs when this could easily be fixed in the code. And sorry, I didn't even bother to look if there was an RFC for this, I just thought this is a FreeRADIUS-specific extension. At least I then guessed the person that wrote this RFC right. :) But what is Status-Client used for? Just for future extensions? Regards Jakob
Jakob Hirsch wrote:
We could check the original packet code before incrementing the counter. Would you accept a patch that does this?
Sure. github is preferred.
Ok, we surely don't want to break RFCs when this could easily be fixed in the code. And sorry, I didn't even bother to look if there was an RFC for this, I just thought this is a FreeRADIUS-specific extension. At least I then guessed the person that wrote this RFC right. :)
Yup.
But what is Status-Client used for? Just for future extensions?
No one knows. Alan DeKok.
participants (2)
-
Alan DeKok -
Jakob Hirsch