dfskoll / rp-pppoe

Public repository for RP-PPPoE PPPoE client and server software
https://dianne.skoll.ca/projects/rp-pppoe/
47 stars 15 forks source link

Ability to update the IP pool without restart #9

Closed jkroonza closed 2 years ago

jkroonza commented 2 years ago

Currently the -p argument takes a file, which gets loaded once-off during startup, there are two possible strategies that can be followed for dynamic reload:

  1. explicit signal for reload (which then has the potential to reload more than simply the pool).
  2. Automatically whenever the file changes (stat, mtime newer than last load).

Both strategies to me seems sensible the former is probably a safer option as it requires explicit action from the administrator to make things effective.

Just looking at the code, it looks like:

  1. It's possible that during a reload, NumSessionsSlots may increase or decrease, with potentially catastrophic consequences, especially for increase.
  2. The IP addresses may be in a different ordering, and an active session will on ppp side at least retain the OLD IP, thus duplicate IP addresses are suddenly possible unless care is taken.
  3. The address count in the pool file overrides -N (which is probably by design).

Given the above, it may just be simpler to implement ip address delegation (#8), and rely on an ip pool daemon / radius rather than implement this.

jkroonza commented 2 years ago

After inspection of the code base this is going to be non-trivial, as such, I recommend that if you need this, delegate to pppd by using -R 0.0.0.0, properly setting -N (with delegation you can in theory use a larger value than your pool, but obviously don't be stupid) and then using some other mechanism (radius, or some pool daemon) to assign IP addresses. Literally this allows ANY other mechanism supported by pppd to assign IPs, even {pap,chap}-secrets.

dfskoll commented 2 years ago

I agree; the server IP pool is really for small or test environments. A production environment should use RADIUS to assign IPs rather than leaving it to pppoe-server.