April 2010 - Freeradius-Devel - lists.freeradius.org

Failed to insert event?
by Josip Almasi 09 Apr '10

09 Apr '10

Hi all, today my 2.0.2 died with 'Failed to insert event' message in wait_a_bit function (main/event.c). From what I've read, this can easily be fixed by assuring delay longer than timer resolution in fr_event_insert (lib/event.c). And, that was already fixed, during 2.0.3. Right? Thanks! Regards...

2 2

GIT Log for 2010-04-08 23:33 GMT
by aland＠deployingradius.com 08 Apr '10

08 Apr '10

commit 39f2b8581c9c6bb5a4142670b39f780be69589a3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Apr 8 09:59:55 2010 +0200 Make subdirs before modules Fixes "cannot build from clean directory" problem after switching to the new method of using "make" for recursing into subdirs Files changed: src/modules/Makefile | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) ====================================================================== commit 397533ff05725eef2c64898c15c34ad712041f9c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 7 01:59:57 2010 +0200 Add missing 'break' to escape '%' properly. Files changed: src/modules/rlm_sqlcounter/rlm_sqlcounter.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) ====================================================================== commit c5da5a8f1af076c690463b5fb5010163377a2a8b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 7 01:58:00 2010 +0200 On DHCP Discover fail, don't send a NAK Instead, just don't respond Files changed: src/modules/frs_dhcp/frs_dhcp.c | 12 ++++++++---- 1 files changed, 8 insertions(+), 4 deletions(-) ======================================================================

1 0

Re: Re: Radius server crash due to 35# bug
by Liu Linyong 08 Apr '10

08 Apr '10

Please refer to the following post. ========================= > Author: Alan DeKok > Date: 2010-04-07 19:52 +800 > To: FreeRadius developers mailing list > Subject: Re: Radius server crash due to 35# bug > > Liu Linyong wrote: > > The conclusion: > > The 35# bug can recur rather easily. > > Hmm... I've run the server at 40K packets/s for *days*, and have been > unable to reproduce it. > > > We found FreeRadius server crash sometimes with load. > ... > > Then use gdb to run 'radiusd', and do load test with LoadRunner, which sending thousands of requests per second. > > How many requests in parallel? How many threads is the server using? ====> 4K requests/sec. start_servers = 5 and max_servers = 32. But totally 9 threads were created.(That is: 3 more threads were created after initializing) Oh, I've set max_requests = 102400 in radiusd.conf. > > > FreeRadius will cost little mem(16M) and cpu(1.6%). > > After an hour or so, the server will crash. These can be repeated easily. gdb show the position: > > It looks like a race condition, where data is accessed after it's been > freed. However, tracking it down is hard. > > Alan DeKok. ================================= Liu Linyong 2010-04-08

2 1

Radius server crash due to 35# bug
by Liu Linyong 07 Apr '10

07 Apr '10

Hi, The conclusion: The 35# bug can recur rather easily. We found FreeRadius server crash sometimes with load. To test the stability of the FreeRadius architecture, I modify the two functions: rad_authenticate() / rad_accounting(), they will do very simple things, and will not use any modules. int rad_accounting(REQUEST *request) { request->reply->code = PW_ACCOUNTING_RESPONSE; return RLM_MODULE_OK; } int rad_authenticate(REQUEST *request) { VALUE_PAIR *reply_tmp = NULL; reply_tmp = pairmake( "Service-Type", "Framed-User", T_OP_EQ); if( reply_tmp ) { pairxlatmove(request, &request->reply->vps, &reply_tmp); pairfree(&reply_tmp); } if (request->reply->code == 0) { request->reply->code = PW_AUTHENTICATION_ACK; } return RLM_MODULE_OK; } Then use gdb to run 'radiusd', and do load test with LoadRunner, which sending thousands of requests per second. FreeRadius will cost little mem(16M) and cpu(1.6%). After an hour or so, the server will crash. These can be repeated easily. gdb show the position: Program received signal SIGSEGV, Segmentation fault. 0xff376a6c in fr_packet_cmp (a=0x3d4070, b=0x0) at packet.c:139 139 if (a->sockfd < b->sockfd) return -1; (gdb) (gdb) (gdb) bt #0 0xff376a6c in fr_packet_cmp (a=0x3d4070, b=0x0) at packet.c:139 #1 0xff3680ec in list_find (ht=0x156fc8, head=0x156fe4, reversed=2911412273, data=0xffbff808) at hash.c:191 #2 0xff3685ec in fr_hash_table_finddata (ht=0x2469d0, data=0x156fe4) at hash.c:491 #3 0xff3771d0 in fr_packet_list_find (pl=0x156aa8, request=0x3d4070) at packet.c:557 #4 0x00032b88 in received_request (listener=0x15b848, packet=0x3d4070, prequest=0xffbff938, client=0x1101d8) at event.c:2746 #5 0x0001d5bc in acct_socket_recv (listener=0x15b848, pfun=0xffbff93c, prequest=0xffbff938) at listen.c:908 #6 0x000337d0 in event_socket_handler (xel=0x158450, fd=10, ctx=0x15b848) at event.c:3316 #7 0xff377f84 in fr_event_loop (el=0x158450) at event.c:400 #8 0x000284b4 in main (argc=2, argv=0xffbffb3c) at radiusd.c:398 The problem seems to be the same with 35# bug. (https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=35) Environmnet: MEM: 24G phys mem OS: Solaris 5.10, sparc GCC: 3.3.2 GMAKE: 3.80 GDB: 6.8 CLIENT: LoadRunner (sending packages: auth & acct start & acct stop) FreeRadius server: 2-1-7 Is there any information else I should post here? *********************************************** Liu Linyong 2010-04-07

2 1

should discard packet when received AUTH header length < 20 ?
by WANG Tinggong 01 Apr '10

01 Apr '10

hi all, in src/main/listen.c , auth_socket_recv function, rad_recv_header uses MSG_PEEK flag. in case 0 <= rcode < 20, malfromed request still in the receive queue, should it be cleaned before line 757 ? 751 rcode = rad_recv_header(listener->fd, &src_ipaddr, &src_port, &code ); 752 if (rcode < 0) return 0; 753 754 RAD_STATS_TYPE_INC(listener, total_requests); 755 756 if (rcode < 20) { /* AUTH_HDR_LEN */ 757 RAD_STATS_TYPE_INC(listener, total_malformed_requests); 758 return 0; 759 } here is my patch against branch v2.1.x , does it make sense? thanks Tinggong --- src/main/listen.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/main/listen.c b/src/main/listen.c index 59ff314..855ee9c 100644 --- a/src/main/listen.c +++ b/src/main/listen.c @@ -754,6 +754,7 @@ static int auth_socket_recv(rad_listen_t *listener, RAD_STATS_TYPE_INC(listener, total_requests); if (rcode < 20) { /* AUTH_HDR_LEN */ + rad_recv_discard(listener->fd); RAD_STATS_TYPE_INC(listener, total_malformed_requests); return 0; }

2 1