rlm_ldap & TCP KeepAlive

[Fred MAISON]

Le vendredi 30 avril 2010 à 14:19 +0200, Fred MAISON a écrit :
> > Message: 4
> > Date: Fri, 30 Apr 2010 11:56:25 +0200
> > From: Alan DeKok <aland at deployingradius.com>
> > Subject: Re: rlm_ldap & TCP KeepAlive
> > To: FreeRadius developers mailing list
> > 	<freeradius-devel at lists.freeradius.org>
> > Message-ID: <4BDAA949.3020100 at deployingradius.com>
> > Content-Type: text/plain; charset=ISO-8859-1
> > 
> > Fred MAISON wrote:
> > > Some stateful equipments like firewall or load-balancers tends to drop
> > > long-time idle tcp session to protect their session tables.
> > > To keep idle tcp session active and avoid this kind of deconnections, I
> > > found it could be useful to be able to configure TCP KeepAlive from
> > > rlm_ldap config file, exposing TCP KeepAlive options available in
> > > Openldap libraries to rlm_ldap config file :
> > > LDAP_OPT_X_KEEPALIVE_IDLE, LDAP_OPT_X_KEEPALIVE_PROBES,
> > > LDAP_OPT_X_KEEPALIVE_INTERVAL
> > 
> >   Yup.
> > 
> > > Unfortunately, as Redhat released his 5.5, I don't have anymore access
> > > to jdennis binary repository, so I am in trouble to recompile 2.1.8 for
> > > CentOS 5.4 on x86_64.
> > > I have tried to recompile freeradius 2.1.8 with this patch from
> > > fedoraproject cvs sources, but I don't know how to integrate this patch
> > > in the source tree.
> > 
> >   Use the "patch" program:
> > 
> > $ hg diff > patch
> > $ cd src/modules/rlm_ldap
> > $ patch -p1 < ../../patch
> > 
> >   Then build it.
> > 
> >   This can be done after the "configure" stage.
> > 
> > > Once validated, could this kind of code be integrated in a future
> > > release ?
> > 
> >   Yes.  John has a number of LDAP patches pending.
> > 
> >   Alan DeKok.
> 
> I am interested with John's patches.
> Where are they available ?
> I am also interested with Alexander Coulter patches you talked about in
> a post dated 28 Jan 2010 17:36:46 +0100 regarding ldap redundancy &
> Ldap-Group checkItem in user file (message
> 4B61BD1E.1090005 at deployingradius.com)
> 
> As you talked about integration of those patches in 2.2.0, How can I
> access freeradius 2.2.x cvs ?
> I tried cvs -d :pserver:anoncvs at cvs.freeradius.org:/source checkout
> radiusd, but the version retrieved there seems to be 2.0.6 ...
> 
> Best regards,
> Fred MAISON
> 

Hello freeradius-devel,

I have successfully tested this weekend my ldap keepalive patch for
freeradius 2.1.8.
Among some other issues, those options are only available since openldap
library version 2.4.18, so I have enclosed all my code's sections with 
#ifdef LDAP_OPT_X_KEEPALIVE_IDLE ..... #endif to avoid build problem if
only older openldap version not supporting those settings is there.
I tested in a VMWare under Debian Squeeze (32bits) and CentOS 5.4
(32bits) , after a manual build, install, ldd ... of the last stable
openldap source tree, as I don't have enought RPM and SRPMS knowledge to
cleanly rebuild all dependencies for both openldap libraries and
freeradius tree.

I have verified that configured keepalive are correctly taken into
account, observing TCP KeepAlive packets at configured interval on ldap
sockets with wireshark.
I also checked that keepalive_idle, keepalive_probes and
keepalive_interval parameter are correctly applied if configured in
rlm_ldap module configuration files.

As a resume, 
* this patch correctly protect from unsollicitated disconnections by
firewalls or load-balancers traversed by ldap sessions when idle for
some time ...
* As most majors linux distros does not have 2.4.18+ openldap library
version yet, this can be a problem to cleanly use this patch, as this
means it's necessary to also rebuild openldap 2.4.18+ library from
source tarball ...

Best regards,
Fred MAISON