<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi <div><br></div><div>Found this </div><div><br></div><div><a href="https://www.marshut.net/kqyrtz/reaped-processes-still-timing-out-in-rad-waitpid.html">https://www.marshut.net/kqyrtz/reaped-processes-still-timing-out-in-rad-waitpid.html</a></div><div><br></div><div><br></div><div>regarding the following error being seen in radius.log. We've just discovered that this is happening a lot here and wondered if anyone has had a chance to look at his proposed patch/ produced another one that rectified the problem.</div><div>Rgds</div><div>Alex </div><div><br></div><div><span class="Apple-style-span" style="font-size: 11px;">....<span style="color: rgb(51, 51, 51); font-family: Consolas, Courier, Helvetica, Arial; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 20px; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: rgb(255, 255, 255); ">I have hit upon a case where some ntlm_auth processes would return (and write the NT_KEY to the connecting pipe) but FR still complains that it failed and denies authentication (this is on 2.2.5).</span></span></div><span style="color: rgb(51, 51, 51); font-family: Consolas, Courier, Helvetica, Arial; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 20px; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: rgb(255, 255, 255); font-size: 11px;">
This manifests in the logs like the following:
Tue Oct 28 11:10:15 2014 : Auth: Login incorrect (mschap: External script says NT_KEY: 4BCE6CA72058BA7EE500D1A68A8771C0): [tstRad9] (from client 155.98.204.47 port 0 cli 02-00-00-00-00-01 via TLS tunnel)
Since this is actually the output for a valid and successful authentication, it appears that the exit code is the real issue.
That exit code is either that of the process itself or 2 if rad_waitpid times out while waiting for the child.
After adding some debugging statements and recompiling I found that there were cases where reap_children would reap a child process but the pid would not be found in thread_pool.waiters. This only happened when there were a significant number of auths per seconds and still not consistently. Some head scratching ensued and a colleague then suggested there may be a race condition between rad_fork (where it calls fr_hash_table_insert) and reap_children (where it calls fr_hash_table_finddata).</span><span style="color: rgb(51, 51, 51); font-family: Consolas, Courier, Helvetica, Arial; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 20px; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: rgb(255, 255, 255);">
</span><div><br></div><div>.......</div><div><br></div><div><br></div><div><br></div><div><br></div></body></html>