Alex ProtskoandNikos Mavrogiannopoulos
5a50aecedc
A session that reconnects under the same cookie (roaming, DPD, a new-tunnel rekey) reported an Acct-Session-Time far larger than the real duration. Each connection segment reported uptime measured from the original session start (now - e->created, as session_start_time is not reset across reconnects), and sec-mod summed these per-segment cumulative values, so the reported time grew ~= D*(N+1)/2 with the number of reconnects. Acct-Session-Time is the wall-clock lifetime of the logical session and is a pure function of the session creation time, so it does not need to be reported by the worker, carried through cli_stats_msg / secm_session_close_msg, or accumulated alongside the byte counters. Drop stats_st.uptime and the uptime fields of both IPC messages, and compute it in sec-mod as now - e->created: live for each interim update, and snapshotted at disconnect for the Stop so the cookie-timeout lingering period is not counted. The byte counters keep their per-segment report-and-sum handling. Signed-off-by: Alex Protsko <fidget2015@yahoo.com>
5.3 KiB
Using Radius with ocserv
For radius support the radcli library is required. The minimum requirement is version 1.2.0. Alternatively the freeradius-client library can be used (1.1.7 is the minimum requirement), but not all radius features may be available.
radcli uses a configuration file to setup the server configuration. That is typically found at: /etc/radcli/radiusclient.conf and is best to copy the default installed as radiusclient-ocserv.conf and edit it accordingly.
The important options for ocserv usage are the following:
dictionary /etc/radcli/dictionary
servers /etc/radcli/servers
The dictionary should contain at least the attributes shown below, and the servers file should contain the radius server to use.
NOTE
Note, that ocserv since 1.0.0 does not provide the 'NAS-Port' attribute to server. In the previous versions the NAS-Port value was corresponding to the worker process ID (PID), which changed on client reconnect (e.g., due to roaming). That caused accounting problems, and as there is no notion of ports in ocserv, it is no longer sent. This breaks the default configuration of freeradius servers which assumes that the NAS-Port is sent. To make ocserv authentication and accounting work with freeradius, you must configure the server not to account NAS-Port by removing the NAS-Port attribute from the acct_unique section.
Ocserv configuration
For authentication the following line should be enabled.
auth = "radius[config=/etc/radcli/radiusclient.conf,groupconfig=true]"
Check the ocserv manpage for the meaning of the various options such as groupconfig.
To enable accounting, use
acct = "radius[config=/etc/radcli/radiusclient.conf]"
and modify the following option to the time (in seconds), that accounting information should be reported.
stats-report-time = 360
That value will be overridden by Acct-Interim-Interval if sent by the server.
Note that the accounting session is reported as terminated as soon as
possible when the user disconnects explicitly. When the disconnection
is due to timeout or other network reasons, the users have their connection
remain valid until the cookie-timeout value expires.
The Acct-Session-Time reported is the wall-clock lifetime of the logical
session: the time from the initial authentication to the last activity of
the session. A single logical session spans all reconnections performed
under the same cookie (e.g. roaming, DTLS rekey, or a brief link loss), so
an idle gap between such reconnections is included in Acct-Session-Time.
The value is bounded by session-timeout (the session is torn down once it
is reached), and any idle gap that can be folded in is bounded by
cookie-timeout, after which a fresh authentication starts a new accounting
session.
Dictionary
Ocserv supports the following radius attributes.
# Standard attributes
ATTRIBUTE User-Name 1 string
ATTRIBUTE Password 2 string
ATTRIBUTE NAS-Port 5 integer
ATTRIBUTE Framed-Protocol 7 integer
ATTRIBUTE NAS-Identifier 32 string
ATTRIBUTE Acct-Input-Octets 42 integer
ATTRIBUTE Acct-Output-Octets 43 integer
ATTRIBUTE Acct-Session-Id 44 string
ATTRIBUTE Acct-Input-Gigawords 52 integer
ATTRIBUTE Acct-Output-Gigawords 53 integer
ATTRIBUTE Acct-Interim-Interval 85 integer
ATTRIBUTE Connect-Info 77 string
###########################
# IPv4 attributes #
###########################
# sets local IPv4 address in link:
ATTRIBUTE NAS-IP-Address 4 ipaddr
# sets remote IPv4 address in link:
ATTRIBUTE Framed-IP-Address 8 ipaddr
ATTRIBUTE Framed-IP-Netmask 9 ipaddr
# sets routes (quite a kludge as it requires to have
# a CIDR string)
ATTRIBUTE Framed-Route 22 string
# There are two ways to set a group, either in the
# format "OU=group1;group2" or by a single group name
# in the attribute. It is possible to specify multiple
# groups in separate class attributes.
# The separator used in the OU= format defaults to ';' and can
# be changed via the group-separator option (accepted values:
# 'semicolon', 'comma'). For example, to use comma-separated
# groups as sent by Freeradius:
# auth = "radius[config=...,group-separator=comma]"
# Note that this works only when groupconfig is set to
# true, and if the groups sent by the server are made known
# to ocserv, via the select-group config variable.
ATTRIBUTE Class 25 string
# sets DNS servers
VENDOR Microsoft 311
BEGIN-VENDOR Microsoft
ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr
ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr
END-VENDOR Microsoft
############################
# IPv6 attributes #
############################
# sets local IPv6 address in link:
ATTRIBUTE NAS-IPv6-Address 95 string
# sets remote IPv6 subnet in link:
ATTRIBUTE Delegated-IPv6-Prefix 123 ipv6prefix
# sets remote IPv6 address in link:
ATTRIBUTE Framed-IPv6-Address 168 ipv6addr
# sets DNS servers
ATTRIBUTE DNS-Server-IPv6-Address 169 ipv6addr
# Sets IPv6 routes
ATTRIBUTE Framed-IPv6-Prefix 97 ipv6prefix
ATTRIBUTE Route-IPv6-Information 170 ipv6prefix
############################
# Traffic shaping #
############################
VENDOR Roaring-Penguin 10055
BEGIN-VENDOR Roaring-Penguin
# tx speed limit in kb/s
ATTRIBUTE RP-Upstream-Speed-Limit 1 integer
# rx speed limit in kb/s
ATTRIBUTE RP-Downstream-Speed-Limit 2 integer
END-VENDOR Roaring-Penguin