Document TCP options for clients and home servers.

[freeradius.git] / raddb / proxy.conf

diff --git a/raddb/proxy.conf b/raddb/proxy.conf
index 6133d67..26ade44 100644 (file)
--- a/raddb/proxy.conf
+++ b/raddb/proxy.conf
@@ -169,6 +169,18 @@ home_server localhost {
        port = 1812
 
        #
+       #  The transport protocol.
+       #
+       #  If unspecified, defaults to "udp", which is the traditional
+       #  RADIUS transport.  It may also be "tcp", in which case TCP
+       #  will be used to talk to this home server.
+       #
+       #  When home servers are put into pools, the pool can contain
+       #  home servers with both UDP and TCP transports.
+       #
+       #proto = udp
+
+       #
        #  The shared secret use to "encrypt" and "sign" packets between
        #  FreeRADIUS and the home server.
        #
@@ -193,21 +205,66 @@ home_server localhost {
        ############################################################
 
        #
-       #  If the home server doesn't respond to the request within
-       #  this time, this server will consider the request dead, and
-       #  respond to the NAS with an Access-Reject.
+       #  You can optionally specify the source IP address used when
+       #  proxying requests to this home server.  When the src_ipaddr
+       #  it set, the server will automatically create a proxy
+       #  listener for that IP address.
+       #
+       #  If you specify this field for one home server, you will
+       #  likely need to specify it for ALL home servers.
+       #
+       #  If you don't care about the source IP address, leave this
+       #  entry commented.
+       #
+#      src_ipaddr = 127.0.0.1
+
+       #  RFC 5080 suggests that all clients SHOULD include it in an
+       #  Access-Request.  The configuration item below tells the
+       #  proxying server (i.e. this one) whether or not the home
+       #  server requires a Message-Authenticator attribute.  If it
+       #  is required (value set to "yes"), then all Access-Request
+       #  packets sent to that home server will have a
+       #  Message-Authenticator attribute.
+       #
+       #  allowed values: yes, no
+       require_message_authenticator = no
+
+       #
+       #  If the home server does not respond to a request within
+       #  this time, this server will initiate "zombie_period".
        #
-       #  If NO responses are received to any requests sent within this
-       #  time period, the home server will be marked "zombie", as below.
+       #  The response window is large because responses MAY be slow,
+       #  especially when proxying across the Internet.
        #
        #  Useful range of values: 5 to 60
        response_window = 20
 
        #
-       #  If the home server does not respond to ANY packets for
-       #  a certain time, consider it dead.  This time period is
-       #  called the "zombie" period, because the server is neither
-       #  alive nor dead.
+       #  If you want the old behavior of the server rejecting
+       #  proxied requests after "response_window" timeout, set
+       #  the following configuration item to "yes".
+       #
+       #  This configuration WILL be removed in a future release
+       #  If you believe you need it, email the freeradius-users
+       #  list, and explain why it should stay in the server.
+       #
+#      no_response_fail = no
+
+       #
+       #  If the home server does not respond to ANY packets during
+       #  the "zombie period", it will be considered to be dead.
+       #
+       #  A home server that is marked "zombie" will be used for
+       #  proxying as a low priority.  If there are live servers,
+       #  they will always be preferred to a zombie.  Requests will
+       #  be proxied to a zombie server ONLY when there are no
+       #  live servers.
+       #
+       #  Any request that is proxied to a home server will continue
+       #  to be sent to that home server until the home server is
+       #  marked dead.  At that point, it will fail over to another
+       #  server, if a live server is available.  If none is available,
+       #  then the "post-proxy-type fail" handler will be called.
        #
        #  If "status_check" below is something other than "none", then
        #  the server will start sending status checks at the start of
@@ -372,6 +429,46 @@ home_server localhost {
                # Maximum Retransmit Duration: 5..60
                mrd = 30
        }
+
+       #
+       #  Connection limiting for home servers with "proto = tcp".
+       #
+       #  This section is ignored for other home servers.
+       #
+       limit {
+             #
+             #  Limit the number of TCP connections to the home server.
+             #
+             #  The default is 16.
+             #  Setting this to 0 means "no limit"
+             max_connections = 16
+
+             #
+             #  Limit the total number of requests sent over one
+             #  TCP connection.  After this number of requests, the
+             #  connection will be closed.  Any new packets that are
+             #  proxied to the home server will result in a new TCP
+             #  connection being made.
+             #
+             #  Setting this to 0 means "no limit"
+             max_requests = 0
+
+             #
+             #  The lifetime, in seconds, of a TCP connection.  After
+             #  this lifetime, the connection will be closed.
+             #
+             #  Setting this to 0 means "forever".
+             lifetime = 0
+
+             #
+             #  The idle timeout, in seconds, of a TCP connection.
+             #  If no packets have been sent over the connection for
+             #  this time, the connection will be closed.
+             #
+             #  Setting this to 0 means "no timeout".
+             idle_timeout = 0
+       }
+
 }
 
 # Sample virtual home server.