Allow for dynamically expanded PSK.

[freeradius.git] / raddb / sites-available / tls

diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
index 94f3957..d62893d 100644 (file)
--- a/raddb/sites-available/tls
+++ b/raddb/sites-available/tls
@@ -7,7 +7,16 @@
 listen {
        ipaddr = *
        port = 2083
-       type = auth
+
+       #
+       #  TCP and TLS sockets can accept Access-Request and
+       #  Accounting-Request on the same socket.
+       #
+       #       auth      = only Access-Request
+       #       acct      = only Accounting-Request
+       #       auth+acct = both
+       #
+       type = auth+acct
 
        # For now, only TCP transport is allowed.
        proto = tcp
@@ -17,10 +26,60 @@ listen {
 
        clients = radsec
 
+       #
+       #  Connection limiting for sockets with "proto = tcp".
+       #
+       limit {
+             #
+             #  Limit the number of simultaneous TCP connections to the socket
+             #
+             #  The default is 16.
+             #  Setting this to 0 means "no limit"
+             max_connections = 16
+
+             #  The per-socket "max_requests" option does not exist.
+
+             #
+             #  The lifetime, in seconds, of a TCP connection.  After
+             #  this lifetime, the connection will be closed.
+             #
+             #  Setting this to 0 means "forever".
+             lifetime = 0
+
+             #
+             #  The idle timeout, in seconds, of a TCP connection.
+             #  If no packets have been received over the connection for
+             #  this time, the connection will be closed.
+             #
+             #  Setting this to 0 means "no timeout".
+             #
+             #  We STRONGLY RECOMMEND that you set an idle timeout.
+             #
+             idle_timeout = 30
+       }
+
        #  This is *exactly* the same configuration as used by the EAP-TLS
        #  module.  It's OK for testing, but for production use it's a good
        #  idea to use different server certificates for EAP and for RADIUS
        #  transport.
+       #
+       #  If you want only one TLS configuration for multiple sockets,
+       #  then we suggest putting "tls { ...}" into radiusd.conf.
+       #  The subsection below can then be changed into a reference:
+       #
+       #       tls = ${tls}
+       #
+       #  Which means "the tls sub-section is not here, but instead is in
+       #  the top-level section called 'tls'".
+       #
+       #  If you have multiple tls configurations, you can put them into
+       #  sub-sections of a top-level "tls" section.  There's no need to
+       #  call them all "tls".  You can then use:
+       #
+       #       tls = ${tls.site1}
+       #
+       #  to refer to the "site1" sub-section of the "tls" section.
+       #
        tls {
                private_key_password = whatever
                private_key_file = ${certdir}/server.pem
@@ -292,22 +351,32 @@ listen {
 clients radsec {
        client 127.0.0.1 {
                ipaddr = 127.0.0.1
-               proto = tcp
+
+               #
+               #  Ensure that this client is TLS *only*.
+               #
+               proto = tls
 
                #
                #  TCP clients can have any shared secret.
                #
                #  TLS clients MUST have the shared secret
-               #  set to "radsec"
+               #  set to "radsec".  Or, for "proto = tls",
+               #  you can omit the secret, and it will
+               #  automatically be set to "radsec".
                #
                secret = radsec
-       }
-}
 
-listen {
-       ipaddr = 127.0.0.1
-       port = 4000
-       type = auth
+               #
+               #  You can also use a "limit" section here.
+               #  See raddb/clients.conf for examples.
+               #
+               #  Note that BOTH limits are applied.  You
+               #  should therefore set the "listen" limits
+               #  higher than the ones for each individual
+               #  client.
+               #
+       }
 }
 
 home_server tls {
@@ -352,6 +421,20 @@ home_server tls {
                ca_file = ${cadir}/ca.pem
 
                #
+               #  For TLS-PSK, the key should be specified
+               #  dynamically, instead of using a hard-coded
+               #  psk_identity and psk_hexphrase.
+               #
+               #  The input to the dynamic expansion will be the PSK
+               #  identity supplied by the client, in the
+               #  TLS-PSK-Identity attribute.  The output of the
+               #  expansion should be a hex string, of no more than
+               #  512 characters.  The string should not be prefixed
+               #  with "0x".  e.g. "abcdef" is OK.  "0xabcdef" is not.
+               #
+       #       psk_query = "%{psksql:select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'}"
+
+               #
                #  For DH cipher suites to work, you have to
                #  run OpenSSL to create the DH file first:
                #