DHCP Radius proxy (IPv4 and IPv6)
Hi all, I have a relay-agent which does only DHCP and is not capable of talking to RADIUS server (using auth/acct). However the requirement is to be able to use freeradius with it for the additional functionalities and configurability, over both IPv4 and IPv6. The "authentication" should be done only by checking Option82 circuit-id/remote-id against configured user in freeradius. What are the options for configuring it over IPv6? Probably some dhcp to radius proxy able to do message conversion like: DHCP Discover/Solicit -> RADIUS Access-Request RADIUS Access-Accept -> DHCP Offer/Advertise What would be the best approach to handle this use case (unfortunately I cannot change the hardware). Regards -- Ludo Mikula
On May 23, 2023, at 3:45 AM, Ľudovít Mikula <ludovit.mikula@mikori.sk> wrote:
I have a relay-agent which does only DHCP and is not capable of talking to RADIUS server (using auth/acct).
However the requirement is to be able to use freeradius with it for the additional functionalities and configurability, over both IPv4 and IPv6. The "authentication" should be done only by checking Option82 circuit-id/remote-id against configured user in freeradius.
What are the options for configuring it over IPv6? Probably some dhcp to radius proxy able to do message conversion like: DHCP Discover/Solicit -> RADIUS Access-Request RADIUS Access-Accept -> DHCP Offer/Advertise
Or, configure FreeRADIUS to do DHCP? See sites-available/dhcp It can accept DHCPv4 packets and process them. No RADIUS is needed. Alan DeKok.
So, I have succesfully configured DHCPv4 as you suggested. I am trying hard to configure DHCPv6 with freeradius v4 (current master), but I must be missing something as even the basic configuration is not working. This is my config - pretty much the very basic as defined in sites-available: server dhcpv6 { namespace = dhcpv6 all_dhcp_servers_and_relays = FF02::1:2 interface = eth0 port = 547 listen multicast { type = Solicit transport = udp udp { max_attributes = 200 ipaddr = ${...all_dhcp_servers_and_relays} port = ${...port} interface = ${...interface} } } listen unicast { type = Request type = Information-Request transport = udp udp { max_attributes = 200 ipaddr = 2001:3200:3200::10 port = ${...port} interface = ${...interface} } } dhcpv6 { } # recv and send parts unchanged and removed for brevity } I'm using ISC DHCP Client 4.4.1 for testing: dhclient -v -d -6 and I get this errors in freeradius: freeradius | Mon May 29 10:09:32 2023: Debug : proto_dhcpv6_udp - Received Solicit XID 00db48c1 length 56 dhcpv6_udp server ff02::1:2 port 547 on interface eth0 freeradius | Mon May 29 10:09:32 2023: ERROR : (0) ERROR: Virtual server "(null)" not compiled freeradius | Mon May 29 10:09:32 2023: ERROR : (0) ERROR: Protocol failed to set 'process' function freeradius | Mon May 29 10:09:32 2023: Debug : proto_dhcpv6_udp - cleaning up request in 5.000000s Ludo
On May 29, 2023, at 6:29 AM, Ľudovít Mikula <ludovit.mikula@mikori.sk> wrote:
So, I have succesfully configured DHCPv4 as you suggested.
I am trying hard to configure DHCPv6 with freeradius v4 (current master), but I must be missing something as even the basic configuration is not working.
The example virtual servers should work.
This is my config - pretty much the very basic as defined in sites-available:
You've made a number of changes for reasons I don't understand. You should really start with the example, and then change as little as possible. If the default doesn't work, then the default is wrong. But if the default works and your changes break it, well... you know what happened. When you start off by changing random things and "it doesn't work", then you have no idea what the problem is.
server dhcpv6 { namespace = dhcpv6 all_dhcp_servers_and_relays = FF02::1:2 interface = eth0 port = 547
listen multicast {
Why not just "listen {" as per the default?
listen unicast {
Same thing here.
type = Request type = Information-Request transport = udp
udp { max_attributes = 200 ipaddr = 2001:3200:3200::10 port = ${...port} interface = ${...interface} } }
dhcpv6 { }
# recv and send parts unchanged and removed for brevity }
I'm using ISC DHCP Client 4.4.1 for testing: dhclient -v -d -6 and I get this errors in freeradius:
freeradius | Mon May 29 10:09:32 2023: Debug : proto_dhcpv6_udp - Received Solicit XID 00db48c1 length 56 dhcpv6_udp server ff02::1:2 port 547 on interface eth0 freeradius | Mon May 29 10:09:32 2023: ERROR : (0) ERROR: Virtual server "(null)" not compiled freeradius | Mon May 29 10:09:32 2023: ERROR : (0) ERROR: Protocol failed to set 'process' function freeradius | Mon May 29 10:09:32 2023: Debug : proto_dhcpv6_udp - cleaning up request in 5.000000s
You've broken it in unexpected ways. Also, are there *other* errors or warnings in the debug output? Alan DeKok.
You should really start with the example, and then change as little as possible. If the default doesn't work, then the default is wrong. But if the default works and your changes break it, well... you know what happened.
When you start off by changing random things and "it doesn't work", then you have no idea what the problem is.
Actually I have started with the default configuration, but it did not work. Here is a diff of the two changes I did compared to master: @@ -38,7 +38,7 @@ # use the same interface. So it is defined here once, and used # below. # - interface = en0 + interface = eth0 # # port:: The port where we accept packets. @@ -197,7 +197,7 @@ # "link local" address on that interface, # and use that as the value for `ipaddr`. # -# ipaddr = 2001:db8:: + ipaddr = 2001:3200:3200::10 port = ${...port} interface = ${...interface} I've got this error: freeradius | Mon May 29 13:51:10 2023: Debug : Loaded module proto_dhcpv6_udp freeradius | Mon May 29 13:51:10 2023: Debug : udp { freeradius | Mon May 29 13:51:10 2023: Debug : ipaddr = FF02::1:2 freeradius | Mon May 29 13:51:10 2023: Debug : interface = eth0 freeradius | Mon May 29 13:51:10 2023: Debug : port = 547 freeradius | Mon May 29 13:51:10 2023: Debug : networks { freeradius | Mon May 29 13:51:10 2023: Debug : } freeradius | Mon May 29 13:51:10 2023: Debug : max_packet_size = 8192 freeradius | Mon May 29 13:51:10 2023: Debug : max_attributes = DHCPV6_MAX_ATTRIBUTES freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[93]: Invalid value "DHCPV6_MAX_ATTRIBUTES" for config item max_attributes: Failed parsing string as type 'uint32' freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[93]: Failed evaluating configuration for module "proto_dhcpv6_udp" freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[65]: Failed evaluating configuration for module "proto_dhcpv6" freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[65]: Failed parsing config for listener So I've added: max_attributes = 200 to the udp part of both listeners (it's probably possible to set the DHCPV6_MAX_ATTRIBUTES somewhere, but an environment variable did not work, so I've set it directly. Then it threw this error: freeradius | Mon May 29 13:57:23 2023: Error : Duplicate proto_dhcpv6 instance "dhcpv6.dhcpv6", previous instance defined at /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[65] So I thought having two listeners without name is not allowed, so I have added names to both (hence multicast and unicast) This finally made it to work in a way that the server starts - no errors, only these warnings: Mon May 29 14:01:43 2023: Warn : trigger { ... } subsection not found, triggers will be disabled Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[793]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[809]: Ignoring "-ldap" as the "ldap" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[1115]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[1228]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[1443]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[978]: Ignoring "-ldap" as the "ldap" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[80]: radius { ... } section is unused Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[212]: dhcpv6 { ... } section is unused Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[301]: send Offer { ... } section is unused Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[124]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[134]: Ignoring "-ldap" as the "ldap" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[267]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[302]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : src/lib/server/virtual_servers.c[311]: radius { ... } section is unused Mon May 29 14:01:43 2023: Warn : inner-eap - Failed to find 'authenticate inner-eap {...}' section. EAP authentication will likely not work Mon May 29 14:01:43 2023: Warn : tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" Mon May 29 14:01:43 2023: Warn : tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" but it does not process the requests, this is the only output I get when I run the dhclient: on May 29 14:01:43 2023: Debug : Scheduler created in single-threaded mode Mon May 29 14:01:43 2023: Debug : #### Opening listener interfaces #### Mon May 29 14:01:43 2023: Debug : Listening on radius_udp server * port 1812 bound to virtual server default Mon May 29 14:01:43 2023: Debug : Listening on radius_tcp server * port 1812 bound to virtual server default Mon May 29 14:01:43 2023: Debug : Listening on radius_udp server * port 1813 bound to virtual server default Mon May 29 14:01:43 2023: Debug : Listening on dhcpv6_udp server ff02::1:2 port 547 on interface eth0 bound to virtual server (null) Mon May 29 14:01:43 2023: Debug : Listening on dhcpv6_udp server 2001:3200:3200::10 port 547 on interface eth0 bound to virtual server (null) Mon May 29 14:01:43 2023: Debug : Listening on radius_udp server 127.0.0.1 port 18120 bound to virtual server inner-tunnel Mon May 29 14:01:43 2023: Info : Ready to process requests Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - Received Solicit XID 00e92f3c length 56 dhcpv6_udp server ff02::1:2 port 547 on interface eth0 Mon May 29 14:05:23 2023: ERROR : (0) ERROR: Virtual server "(null)" not compiled Mon May 29 14:05:23 2023: ERROR : (0) ERROR: Protocol failed to set 'process' function Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - cleaning up request in 5.000000s Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - Received Solicit XID 00566cdf length 56 dhcpv6_udp server ff02::1:2 port 547 on interface eth0 Mon May 29 14:05:23 2023: ERROR : (1) ERROR: Virtual server "(null)" not compiled Mon May 29 14:05:23 2023: ERROR : (1) ERROR: Protocol failed to set 'process' function Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - cleaning up request in 5.000000s Mon May 29 14:05:28 2023: Debug : TIMER - proto_dhcpv6_udp - cleanup delay Mon May 29 14:05:28 2023: Debug : TIMER - proto_dhcpv6_udp - cleanup delay Ludo
I've got this error: freeradius | Mon May 29 13:51:10 2023: Debug : Loaded module proto_dhcpv6_udp freeradius | Mon May 29 13:51:10 2023: Debug : udp { freeradius | Mon May 29 13:51:10 2023: Debug : ipaddr = FF02::1:2 freeradius | Mon May 29 13:51:10 2023: Debug : interface = eth0 freeradius | Mon May 29 13:51:10 2023: Debug : port = 547 freeradius | Mon May 29 13:51:10 2023: Debug : networks { freeradius | Mon May 29 13:51:10 2023: Debug : } freeradius | Mon May 29 13:51:10 2023: Debug : max_packet_size = 8192 freeradius | Mon May 29 13:51:10 2023: Debug : max_attributes = DHCPV6_MAX_ATTRIBUTES freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[93]: Invalid value "DHCPV6_MAX_ATTRIBUTES" for config item max_attributes: Failed parsing string as type 'uint32' freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[93]: Failed evaluating configuration for module "proto_dhcpv6_udp" freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[65]: Failed evaluating configuration for module "proto_dhcpv6" freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[65]: Failed parsing config for listener
Looks like a #define is missing in the header files: vagrant@radius:~/freeradius4$ grep DHCPV6_MAX_ATTRIBUTES src/* -R src/listen/dhcpv6/proto_dhcpv6_udp.c: { FR_CONF_OFFSET("max_attributes", FR_TYPE_UINT32, proto_dhcpv6_udp_t, max_attributes), .dflt = STRINGIFY(DHCPV6_MAX_ATTRIBUTES) } , compared to: vagrant@radius:~/freeradius4$ grep DHCPV4_MAX_ATTRIBUTES src/* -R src/freeradius-devel/dhcpv4/dhcpv4.h:#define DHCPV4_MAX_ATTRIBUTES 255 src/include/dhcpv4/dhcpv4.h:#define DHCPV4_MAX_ATTRIBUTES 255 src/listen/dhcpv4/proto_dhcpv4_udp.c: { FR_CONF_OFFSET("max_attributes", FR_TYPE_UINT32, proto_dhcpv4_udp_t, max_attributes), .dflt = STRINGIFY(DHCPV4_MAX_ATTRIBUTES) } , src/protocols/dhcpv4/dhcpv4.h:#define DHCPV4_MAX_ATTRIBUTES 255 Ludo
On May 29, 2023, at 10:07 AM, Ľudovít Mikula <ludovit.mikula@mikori.sk> wrote:
You should really start with the example, and then change as little as possible. If the default doesn't work, then the default is wrong. But if the default works and your changes break it, well... you know what happened. When you start off by changing random things and "it doesn't work", then you have no idea what the problem is. Actually I have started with the default configuration, but it did not work.
It's best to say that. We can then fix the default configuration.
freeradius | Mon May 29 13:51:10 2023: Debug : max_attributes = DHCPV6_MAX_ATTRIBUTES freeradius | Mon May 29 13:51:10 2023: Error : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[93]: Invalid value "DHCPV6_MAX_ATTRIBUTES" for config item max_attributes: Failed parsing string as type 'uint32'
I've pushed a fix for that.
Then it threw this error: freeradius | Mon May 29 13:57:23 2023: Error : Duplicate proto_dhcpv6 instance "dhcpv6.dhcpv6", previous instance defined at /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[65]
I've pushed a fix for that, and made the error messages clearer.
So I thought having two listeners without name is not allowed, so I have added names to both (hence multicast and unicast)
This finally made it to work in a way that the server starts - no errors, only these warnings: Mon May 29 14:01:43 2023: Warn : trigger { ... } subsection not found, triggers will be disabled Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[793]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[809]: Ignoring "-ldap" as the "ldap" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[1115]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[1228]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[1443]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[978]: Ignoring "-ldap" as the "ldap" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/default[80]: radius { ... } section is unused Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[212]: dhcpv6 { ... } section is unused Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/dhcpv6[301]: send Offer { ... } section is unused Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[124]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[134]: Ignoring "-ldap" as the "ldap" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[267]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : /opt/freeradius/etc/raddb/sites-enabled/inner-tunnel[302]: Ignoring "-sql" as the "sql" module is not enabled. Mon May 29 14:01:43 2023: Warn : src/lib/server/virtual_servers.c[311]: radius { ... } section is unused Mon May 29 14:01:43 2023: Warn : inner-eap - Failed to find 'authenticate inner-eap {...}' section. EAP authentication will likely not work Mon May 29 14:01:43 2023: Warn : tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" Mon May 29 14:01:43 2023: Warn : tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless"
Those are all for RADIUS, and are unrelated to DHCPv6.
but it does not process the requests, this is the only output I get when I run the dhclient: ... Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - Received Solicit XID 00e92f3c length 56 dhcpv6_udp server ff02::1:2 port 547 on interface eth0 Mon May 29 14:05:23 2023: ERROR : (0) ERROR: Virtual server "(null)" not compiled Mon May 29 14:05:23 2023: ERROR : (0) ERROR: Protocol failed to set 'process' function Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - cleaning up request in 5.000000s Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - Received Solicit XID 00566cdf length 56 dhcpv6_udp server ff02::1:2 port 547 on interface eth0 Mon May 29 14:05:23 2023: ERROR : (1) ERROR: Virtual server "(null)" not compiled Mon May 29 14:05:23 2023: ERROR : (1) ERROR: Protocol failed to set 'process' function
That should work... it did work at one point. Clearly the tests need to be updated. I don't have more time to spend on this right now, but I'll take a look. Alan DeKok.
Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - Received Solicit XID 00e92f3c length 56 dhcpv6_udp server ff02::1:2 port 547 on interface eth0 Mon May 29 14:05:23 2023: ERROR : (0) ERROR: Virtual server "(null)" not compiled Mon May 29 14:05:23 2023: ERROR : (0) ERROR: Protocol failed to set 'process' function Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - cleaning up request in 5.000000s Mon May 29 14:05:23 2023: Debug : proto_dhcpv6_udp - Received Solicit XID 00566cdf length 56 dhcpv6_udp server ff02::1:2 port 547 on interface eth0 Mon May 29 14:05:23 2023: ERROR : (1) ERROR: Virtual server "(null)" not compiled Mon May 29 14:05:23 2023: ERROR : (1) ERROR: Protocol failed to set 'process' function
That should work... it did work at one point. Clearly the tests need to be updated.
I don't have more time to spend on this right now, but I'll take a look.
Have you had any chance to look at the issue? Ludo
participants (2)
-
Alan DeKok -
Ľudovít Mikula