From 54e88b0096658369d6ddf68a35f9d3e29d1fa431 Mon Sep 17 00:00:00 2001 From: Linus Nordberg Date: Tue, 17 Apr 2012 09:49:03 +0200 Subject: [PATCH] Document the IPv4Only and IPv6Only options. RADSECPROXY-37. --- ChangeLog | 4 ++- radsecproxy.conf.5.xml | 72 +++++++++++++++++++++++++++++++++++++++----------- 2 files changed, 59 insertions(+), 17 deletions(-) diff --git a/ChangeLog b/ChangeLog index 57cb95c..dff851a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -2011-04-16 1.6-dev +2011-04-17 1.6-dev Incompatible changes: - The default shared secret for TLS and DTLS connections change from "mysecret" to "radsec" as per draft-ietf-radext-radsec-12 @@ -20,6 +20,8 @@ - Preliminary support for DynamicLookupCommand. It's for TLS servers only at this point. Also, beware of risks for memory leaks. + - Address family (IPv4 or IPv6) can now be specified for clients + and servers. (RADSECPROXY-37) Bug fixes: - Stop the autoconfery from warning about defining variables diff --git a/radsecproxy.conf.5.xml b/radsecproxy.conf.5.xml index 0a2f7b8..4095e61 100644 --- a/radsecproxy.conf.5.xml +++ b/radsecproxy.conf.5.xml @@ -414,6 +414,23 @@ blocktype name { + IPv4Only and IPv6Only + + + These can be set to on or + off with off being + the default. At most one of IPv4Only + and IPv6Only can be enabled. Enabling + IPv4Only or IPv6Only + makes radsecproxy resolve DNS names to the corresponding + address family only, and not the other. This is done for + both clients and servers. Note that this can be + overridden in client and + server blocks, see below. + + + + Include @@ -454,8 +471,11 @@ blocktype name { that client. The name of the client block must (with one exception, see below) be either the IP address (IPv4 or IPv6) of the client, an IP prefix (IPv4 or IPv6) on the form - IpAddress/PrefixLength, or a domain name (FQDN). Note that - literal IPv6 addresses must be enclosed in brackets. + IpAddress/PrefixLength, or a domain name (FQDN). The way an + FQDN is resolved into an IP address may be influenced by the use + of the IPv4Only and + IPv6Only options. Note that literal IPv6 + addresses must be enclosed in brackets. If a domain name is specified, then this will be resolved @@ -486,17 +506,26 @@ blocktype name { The allowed options in a client block are - host, type, + host, IPv4Only, + IPv6Only, type, secret, tls, certificateNameCheck, matchCertificateAttribute, duplicateInterval, AddTTL, - fticksVISCOUNTRY, fticksVISINST, - rewrite, rewriteIn, - rewriteOut, and rewriteAttribute. + fticksVISCOUNTRY, + fticksVISINST, rewrite, + rewriteIn, rewriteOut, and + rewriteAttribute. + + We already discussed the host option. To + specify how radsecproxy should resolve a host + given as a DNS name, the IPv4Only or the + IPv6Only can be set to on. + At most one of these options can be enabled. Enabling + IPv4Only or IPv6Only here + overrides any basic settings set at the top level. - We already discussed the host option. The - value of type must be one of + The value of type must be one of udp, tcp, tls or dtls. The value of secret is the shared RADIUS key used with @@ -612,9 +641,11 @@ blocktype name { after startup. If the domain name resolves to multiple addresses, then for UDP/DTLS the first address is used. For TCP/TLS, the proxy will loop through the addresses until it can - connect to one of them. In the case of TLS/DTLS, the name of the - server must match the FQDN or IP address in the server - certificate. + connect to one of them. The way an FQDN is resolved into an IP + address may be influenced by the use of the + IPv4Only and IPv6Only + options. In the case of TLS/DTLS, the name of the server must + match the FQDN or IP address in the server certificate. Alternatively one may use the host option @@ -638,6 +669,7 @@ blocktype name { The allowed options in a server block are host, port, + IPv4Only, IPv6Only, type, secret, tls, certificateNameCheck, matchCertificateAttribute, @@ -649,11 +681,19 @@ blocktype name { LoopPrevention. - We already discussed the host option. The - port option allows you to specify which port - number the server uses. The usage of type, - secret, tls, - certificateNameCheck, + + We already discussed the host option. To + specify how radsecproxy should resolve a host + given as a DNS name, the IPv4Only or the + IPv6Only can be set to on. + At most one of these options can be enabled. Enabling + IPv4Only or IPv6Only here + overrides any basic settings set at the top level. + + The port option allows you to specify which + port number the server uses. The usage of + type, secret, + tls, certificateNameCheck, matchCertificateAttribute, AddTTL, rewrite, rewriteIn and rewriteOut -- 2.1.4