Proxy listens to TCP home server on UDP port
Hi everyone, Red Hat QA has noticed that a FreeRADIUS v3.0.1 server set up to use TCP with a home server still listens for replies on UDP. I couldn't find any requirements for that in RFCs and I lack the necessary protocol knowledge to conclude if this is a correct behavior. Could someone say if this is right or not? Could this have been done to simplify handling of mixed-protocol server pools? Some more details follow. The default configuration was modified to use TCP everywhere. I.e. to have default server listen for authentication and accounting on TCP, to have inner-tunnel virtual server listen on TCP, and to have localhost home server protocol specified as TCP. See attached patch for exact changes done. After starting "radiusd -X" these are the last few lines printed: Listening on auth proto tcp address * port 1812 as server default Listening on acct proto tcp address * port 1813 as server default Listening on auth proto tcp address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 1814 Listening on proxy address * port 1814 And "lsof" outputs these lines for radiusd: radiusd 2728 radiusd 3u IPv4 21180 0t0 TCP *:1812 (LISTEN) radiusd 2728 radiusd 4u IPv4 21181 0t0 TCP *:1813 (LISTEN) radiusd 2728 radiusd 5u IPv4 21182 0t0 TCP 127.0.0.1:18120 (LISTEN) radiusd 2728 radiusd 6u IPv4 21183 0t0 UDP *:1814 The original bug reported by QA: https://bugzilla.redhat.com/show_bug.cgi?id=1115137 Thank you. Nick
Nikolai Kondrashov wrote:
Red Hat QA has noticed that a FreeRADIUS v3.0.1 server set up to use TCP with a home server still listens for replies on UDP.
No. It still opens a *port* on UDP. It only listens for replies on the same port that it sends packets from. In this case, since you only have TCP home servers, packets will be sent ONLY with TCP. The UDP proxy port will not be used for anything.
Could this have been done to simplify handling of mixed-protocol server pools?
No. It happens because the server doesn't notice that it has no UDP traffic. So it still opens a proxy UDP port. The only downside to the proxy UDP port is that you have another port open. The server will never use the port for anything. Alan DeKok.
Hi Alan, On 08/02/2014 12:56 PM, Alan DeKok wrote:
Nikolai Kondrashov wrote:
Red Hat QA has noticed that a FreeRADIUS v3.0.1 server set up to use TCP with a home server still listens for replies on UDP.
No. It still opens a *port* on UDP. It only listens for replies on the same port that it sends packets from.
In this case, since you only have TCP home servers, packets will be sent ONLY with TCP. The UDP proxy port will not be used for anything.
Understood, thank you, Alan.
Could this have been done to simplify handling of mixed-protocol server pools?
No. It happens because the server doesn't notice that it has no UDP traffic. So it still opens a proxy UDP port.
The only downside to the proxy UDP port is that you have another port open. The server will never use the port for anything.
Can you tell how hard would it be to fix this and would a fix for this be desirable? Thank you. Nick
On 04/08/14 10:22, Nikolai Kondrashov wrote:
Can you tell how hard would it be to fix this and would a fix for this be desirable?
I believe Alan committed a fix the other day Maybe see: https://github.com/FreeRADIUS/freeradius-server/commit/74a200514d6e380efbc5c... ...and matching commit on v3.0.x
On 08/04/2014 01:17 PM, Phil Mayers wrote:
On 04/08/14 10:22, Nikolai Kondrashov wrote:
Can you tell how hard would it be to fix this and would a fix for this be desirable?
I believe Alan committed a fix the other day Maybe see:
https://github.com/FreeRADIUS/freeradius-server/commit/74a200514d6e380efbc5c...
...and matching commit on v3.0.x
Thank you Phil, Alan. I've tested that commit and it does fix the issue. Nick
participants (3)
-
Alan DeKok -
Nikolai Kondrashov -
Phil Mayers