RADIUS Server redundant MySQL - mysql

Question

I am currently building a test setup for a RADIUS application running FreeRADIUS V.3.xx in combination with MySQL. The entire setup is to be redundant. All servers are running on virtual machines running openSUSE 13.1
My problem is that I can't seem to find the correct configuration for redundant MySQL servers. Does anyone have experience with this ?
What I've done up until now, is basically follow the relevant portion of the official freeradius wiki... tried coming up with variations using group, detail, direkt manipulation of rlm_sql_mysql socket... anything I could think of.. but without success. Currently it's back to the "wiki status"
That is:
I removed the link to sql from .../mods-enabled/ as that caused the redundant servers to fail even the instantiation...
File: .../radius.conf
Section: modules {...}
Added entries:
sql sql1{ ...#config...}
sql sql2{ ...#config...}
Section: instantiate {...} Added entry:
redundant redundant_sql {
sql1
sql2
handled
}
And then added redundant_sql in File: .../sites-available/default (linked to sites-enabled)
Sections: authorize {...} & post-auth{...} (I don't need accounting)
Here is some of the debug output:
Instantiation (Both sql1 and sql2 have to be accessible for the RADIUS server to start.. which is shitty but not the current problem):
radiusd: #### Instantiating modules ####
instantiate {
}
modules {
# Loaded module rlm_sql
# Instantiating module "sql1" from file /etc/raddb/radiusd.conf
sql sql1 {
driver = "rlm_sql_mysql"
server = "**IP sql1**"
port = "3306"
login = "radius"
password = <<< secret >>>
radius_db = "radius"
read_groups = yes
read_clients = no
delete_stale_sessions = yes
sql_user_name = "%{User-Name}"
default_user_profile = ""
client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"
authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id"
authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id"
authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id"
authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id"
group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority"
simul_count_query = ""
simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
safe_characters = "#abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
}
rlm_sql (sql1): Creating new attribute sql1-SQL-Group
rlm_sql (sql1): Registering sql_groupcmp for sql1-SQL-Group
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}.query}"
}
post-auth {
reference = ".query"
}
mysql {
tls {
}
}
rlm_sql (sql1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql1): Attempting to connect to database "radius"
rlm_sql (sql1): Initialising connection pool
pool {
start = 5
min = 4
max = 32
spare = 3
uses = 0
lifetime = 0
cleanup_interval = 30
idle_timeout = 60
retry_delay = 1
spread = no
}
rlm_sql (sql1): Opening additional connection (0)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql (sql1): Opening additional connection (1)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql (sql1): Opening additional connection (2)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql (sql1): Opening additional connection (3)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql (sql1): Opening additional connection (4)
rlm_sql_mysql: Starting connect to MySQL server
# Instantiating module "sql2" from file /etc/raddb/radiusd.conf
sql sql2 {
driver = "rlm_sql_mysql"
server = "**IP sql2**"
port = "3306"
login = "radius"
password = <<< secret >>>
radius_db = "radius"
read_groups = yes
read_clients = no
delete_stale_sessions = yes
sql_user_name = "%{User-Name}"
default_user_profile = ""
client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"
authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id"
authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id"
authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id"
authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id"
group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority"
simul_count_query = ""
simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
safe_characters = "#abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
}
rlm_sql (sql2): Creating new attribute sql2-SQL-Group
rlm_sql (sql2): Registering sql_groupcmp for sql2-SQL-Group
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}.query}"
}
post-auth {
reference = ".query"
}
mysql {
tls {
}
}
rlm_sql (sql2): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql2): Attempting to connect to database "radius"
rlm_sql (sql2): Initialising connection pool
pool {
start = 5
min = 4
max = 32
spare = 3
uses = 0
lifetime = 0
cleanup_interval = 30
idle_timeout = 60
retry_delay = 1
spread = no
}
rlm_sql (sql2): Opening additional connection (0)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql (sql2): Opening additional connection (1)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql (sql2): Opening additional connection (2)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql (sql2): Opening additional connection (3)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql (sql2): Opening additional connection (4)
rlm_sql_mysql: Starting connect to MySQL server
After stopping sql1 and sending a request this happens:
...#irrelevant stuff
Received Access-Request Id 36 from **IP switch**:8345 to **IP RADIUS**:1812 length 128
User-Name = '**mac-address**'
User-Password = '**mac-address**'
NAS-IP-Address = **IP switch**
NAS-Port = 3
NAS-Port-Id = 'Port 3'
NAS-Port-Type = Ethernet
NAS-Identifier = '**nas name**'
Service-Type = Call-Check
Framed-MTU = 1500
Called-Station-Id = '**mac-address**'
Calling-Station-Id = '**mac-address**'
(1) # Executing section authorize from file /etc/raddb/sites-enabled/default
(1) authorize {
(1) [preprocess] = ok
(1) update request {
(1) EXPAND %{tolower:%{1}%{2}%{3}%{4}%{5}%{6}}
(1) --> **mac-address**
(1) Calling-Station-Id := '"**mac-address**"'
(1) User-Name := '&Calling-Station-Id -> '**mac-address**''
(1) User-Password := '&Calling-Station-Id -> '**mac-address**''
(1) } # update request = noop
(1) [updated] = updated
(1) } # if (Calling-Station-Id =~ **Syntax check** = updated
(1) ... skipping else for request 1: Preceding "if" was taken
(1) } # rewrite_calling_station_id rewrite_calling_station_id = updated
(1) detail : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
(1) detail : --> /var/log/radius/radacct/**IP switch**/detail-20151019
(1) detail : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/**IP switch**/detail-20151019
(1) detail : EXPAND %t
(1) detail : --> Mon Oct 19 15:03:18 2015
(1) [detail] = ok
(1) redundant redundant_sql {
(1) sql1 : EXPAND %{User-Name}
(1) sql1 : --> **mac-address**
(1) sql1 : SQL-User-Name set to '**mac-address**'
rlm_sql (sql1): Reserved connection (4)
(1) sql1 : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(1) sql1 : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '**mac-address**' ORDER BY id
rlm_sql (sql1): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '**mac-address**' ORDER BY id'
rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT
rlm_sql (sql1): Reconnecting (4)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Couldn't connect socket to MySQL server radius#**IP sql1**:radius
rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '**IP sql1**' (111 "Connection refused")'
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql1): Reserved connection (3)
rlm_sql (sql1): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '**mac-address**' ORDER BY id'
rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT
rlm_sql (sql1): Reconnecting (3)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Couldn't connect socket to MySQL server radius#**IP sql1**:radius
rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '**IP sql1**' (111 "Connection refused")'
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql1): Reserved connection (2)
rlm_sql (sql1): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '**mac-address**' ORDER BY id'
rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT
rlm_sql (sql1): Reconnecting (2)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Couldn't connect socket to MySQL server radius#**IP sql1**:radius
rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '**IP sql1**' (111 "Connection refused")'
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql1): Reserved connection (1)
rlm_sql (sql1): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '**mac-address**' ORDER BY id'
rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT
rlm_sql (sql1): Reconnecting (1)
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Couldn't connect socket to MySQL server radius#**IP sql1**:radius
rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '**IP sql1**' (111 "Connection refused")'
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql1): Failed to reconnect (1), no free connections are available
rlm_sql (sql1): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '**mac-address**' ORDER BY id'
Segmentation fault
After destructing the last connection to sql1 I'd expect the "redundant" to kick in and sql2 to be contacted... but RADIUS aborts instead.
I know I only ** the IP and macs, but everything else will be reset properly anyway if this project graduates the "test-setup-stage".
I'd really appreciate any help as I'm kinda at the end of my rope here.
Thanks a lot if you've even read up to here!

Answer 1

This is a defect in FreeRADIUS and you should open an issue ticket on the FreeRADIUS issue tracker with the information you posted above, and if you can, the backtrace from running it under a debugger.
For gdb you should be able to do:
gdb --args <path to radiusd> -X
run
bt
The backtrace will show where the issue is. I had a quick attempt at reproducing it on the v3.1.x branch, and couldn't, but that may be because the bug requires connections to be open before hand, to trigger the defect.

Answer 2

First of all, thank you for your help Arran Cudbard-Bell!
For anyone else who has run into the same problem; using the newest tarball (Version 3.0.10: tar.bz2 (PGP Signature)) and building from that includes bugfixes that solve the redundancy issue.
Also note, that the entry in the wiki is not complete. If more than one instance of sql is to be used, the following must be done in addition:
If you were formerly running a single instance of sql, remove the sql softlink from raddb/mods-enabled/
When configuring the sql1 and sql2 moldules write: group_attribute = "${.:instance}-SQL-Group" before $INCLUDE
${modconfdir}/${.:name}/main/${dialect}/queries.conf", as the standard config will throw errors if you don't.
Though this is documented in the config files themselves, the wiki doesn't mention it.
--Thanks # all & closed--