SO_REUSEADDR for dhcp listener - goog idea?
Recently strongswan folks changed behavior of charon regarding dhcp. https://lists.strongswan.org/pipermail//dev/2018-June/001918.html side effect is, that freeradius refuses to start when charon is working. According to link SO_REUSEADDR on dhcp server socket should be enough, I roughly tested it (shamelessly copy #v+ { int on = 1; if (setsockopt(this->fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) < 0) { close(this->fd); ERROR("Failed to reuse address: %s", fr_syserror(errno)); return -1; } } #v- in listen.c ) and it seem to work, although is rather ugly solution. I do not know if strongswan people are right but if so, maybe it would be good idea to put SO_REUSEADDR for dhcp listener? KJ -- http://wolnelektury.pl/wesprzyj/teraz/ DYSLEXICS OF THE WORLD, UNTIE!
On Jul 12, 2018, at 2:06 PM, Kamil Jońca <kjonca@o2.pl> wrote:
Recently strongswan folks changed behavior of charon regarding dhcp.
https://lists.strongswan.org/pipermail//dev/2018-June/001918.html
That's not good. They should bind to a specific interface and IP address. That avoids all of these issues. It's what web servers do after all.. you can run multiple web servers on port 80, if they all listen on different IP addresses. FreeRADIUS has been able to bind to a specific interface for ages. For precisely this reason.
side effect is, that freeradius refuses to start when charon is working.
As it should.
According to link SO_REUSEADDR on dhcp server socket should be enough,
That will let it bind. However, the packets sent *to* that port will randomly go to to either FreeRADIUS, or to strongswan.
I do not know if strongswan people are right but if so, maybe it would be good idea to put SO_REUSEADDR for dhcp listener?
It's not. It's a bad idea to have two *completely* different processes use SO_REUSADDR, Instead, Strongswan should have a configuration to listen on a given ip/interface. You can then use one IP for strongswan, and a different IP for FreeRADIUS. Alan DeKok.
aland@deployingradius.com (Alan DeKok) writes: [...]
FreeRADIUS has been able to bind to a specific interface for ages. For precisely this reason.
But when dhcp is bind to (say) 192.168.1.200 it do not receive DHCPDISCOVER messages (like this) #v+ 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:f5:6b:72:90 (oui Unknown), length 300, xid 0xc748c5f7, secs 17, Flags [none] Client-Ethernet-Address 00:0a:f5:6b:72:90 (oui Unknown) Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message Option 53, length 1: Discover Client-ID Option 61, length 7: ether 00:0a:f5:6b:72:90 MSZ Option 57, length 2: 1500 Vendor-Class Option 60, length 18: "android-dhcp-6.0.1" Hostname Option 12, length 9: "skowronek" Parameter-Request Option 55, length 9: Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name MTU, BR, Lease-Time, RN RB #v- is it normal? -- http://wolnelektury.pl/wesprzyj/teraz/ What kind of sordid business are you on now? I mean, man, whither goest thou? Whither goest thou, America, in thy shiny car in the night? -- Jack Kerouac
participants (2)
-
Alan DeKok -
kjonca＠o2.pl