hi, theres something not quite right about FR 2.2.1 downloaded the latest version from freeradius.org, compiled it with same flags as 2.2.0, installed it onto a production server thats getting a fair amount of traffic...and the logs arent happy Wed Sep 18 19:10:27 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 135 due to unfinished request 14 Wed Sep 18 19:10:27 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 131 due to unfinished request 9 Wed Sep 18 19:10:27 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 134 due to unfinished request 13 Wed Sep 18 19:10:27 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 133 due to unfinished request 12 Wed Sep 18 19:10:27 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 132 due to unfinished request 11 Wed Sep 18 19:10:27 2013 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 18 19:10:28 2013 : Error: Discarding duplicate request from client wism-3 port 32770 - ID: 241 due to unfinished request 21 Wed Sep 18 19:10:28 2013 : Error: Discarding duplicate request from client wism-3 port 32770 - ID: 242 due to unfinished request 28 Wed Sep 18 19:10:29 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 126 due to unfinished request 7 Wed Sep 18 19:10:29 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 127 due to unfinished request 16 Wed Sep 18 19:10:29 2013 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 18 19:10:29 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 128 due to unfinished request 22 Wed Sep 18 19:10:29 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 129 due to unfinished request 26 Wed Sep 18 19:10:30 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 130 due to unfinished request 29 Wed Sep 18 19:10:30 2013 : Error: Discarding duplicate request from client wism-3 port 32770 - ID: 241 due to unfinished request 21 Wed Sep 18 19:10:30 2013 : Error: Discarding duplicate request from client wism-3 port 32770 - ID: 242 due to unfinished request 28 Wed Sep 18 19:10:31 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 131 due to unfinished request 9 Wed Sep 18 19:10:31 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 135 due to unfinished request 14 Wed Sep 18 19:10:31 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 134 due to unfinished request 13 Wed Sep 18 19:10:31 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 86 due to unfinished request 79 Wed Sep 18 19:10:31 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 133 due to unfinished request 12 Wed Sep 18 19:10:31 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 132 due to unfinished request 11 Wed Sep 18 19:10:32 2013 : Error: Discarding duplicate request from client wism-3 port 32770 - ID: 247 due to unfinished request 86 Wed Sep 18 19:10:32 2013 : Error: Discarding duplicate request from client wism-3 port 32770 - ID: 241 due to unfinished request 21 Wed Sep 18 19:10:32 2013 : Error: Discarding duplicate request from client wism-3 port 32770 - ID: 242 due to unfinished request 28 Wed Sep 18 19:10:33 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 86 due to unfinished request 79 Wed Sep 18 19:10:34 2013 : Error: Discarding duplicate request from client wism-3 port 32770 - ID: 247 due to unfinished request 86 Wed Sep 18 19:10:34 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 136 due to unfinished request 148 Wed Sep 18 19:10:34 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 123 due to unfinished request 46 Wed Sep 18 19:10:34 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 122 due to unfinished request 41 Wed Sep 18 19:10:35 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 124 due to unfinished request 57 Wed Sep 18 19:10:35 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 86 due to unfinished request 79 Wed Sep 18 19:10:36 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 125 due to unfinished request 56 Wed Sep 18 19:10:36 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 226 due to unfinished request 183 Wed Sep 18 19:10:36 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 126 due to unfinished request 7 Wed Sep 18 19:10:36 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 123 due to unfinished request 46 Wed Sep 18 19:10:36 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 127 due to unfinished request 16 Wed Sep 18 19:10:36 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 122 due to unfinished request 41 Wed Sep 18 19:10:36 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 129 due to unfinished request 26 Wed Sep 18 19:10:37 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 227 due to unfinished request 192 Wed Sep 18 19:10:37 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 130 due to unfinished request 29 Wed Sep 18 19:10:37 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 124 due to unfinished request 57 Wed Sep 18 19:10:37 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 128 due to unfinished request 22 Wed Sep 18 19:10:37 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 86 due to unfinished request 79 Wed Sep 18 19:10:37 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 125 due to unfinished request 56 Wed Sep 18 19:10:38 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 136 due to unfinished request 148 Wed Sep 18 19:10:38 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 226 due to unfinished request 183 Wed Sep 18 19:10:38 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 126 due to unfinished request 7 Wed Sep 18 19:10:38 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 127 due to unfinished request 16 Wed Sep 18 19:10:38 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 131 due to unfinished request 9 Wed Sep 18 19:10:38 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 129 due to unfinished request 26 Wed Sep 18 19:10:39 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 134 due to unfinished request 13 Wed Sep 18 19:10:39 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 227 due to unfinished request 192 Wed Sep 18 19:10:39 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 135 due to unfinished request 14 Wed Sep 18 19:10:39 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 132 due to unfinished request 11 Wed Sep 18 19:10:39 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 130 due to unfinished request 29 Wed Sep 18 19:10:39 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 128 due to unfinished request 22 Wed Sep 18 19:10:39 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 86 due to unfinished request 79 Wed Sep 18 19:10:39 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 133 due to unfinished request 12 Wed Sep 18 19:10:40 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 226 due to unfinished request 183 Wed Sep 18 19:10:40 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 123 due to unfinished request 46 Wed Sep 18 19:10:40 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 137 due to unfinished request 249 Wed Sep 18 19:10:40 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 122 due to unfinished request 41 Wed Sep 18 19:10:40 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 131 due to unfinished request 9 Wed Sep 18 19:10:40 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 134 due to unfinished request 13 Wed Sep 18 19:10:41 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 124 due to unfinished request 57 Wed Sep 18 19:10:41 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 227 due to unfinished request 192 Wed Sep 18 19:10:41 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 132 due to unfinished request 11 Wed Sep 18 19:10:41 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 135 due to unfinished request 14 Wed Sep 18 19:10:41 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 125 due to unfinished request 56 Wed Sep 18 19:10:41 2013 : Error: Discarding duplicate request from client west-park-switch port 1645 - ID: 138 due to unfinished request 257 Wed Sep 18 19:10:42 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 226 due to unfinished request 183 Wed Sep 18 19:10:42 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 228 due to unfinished request 271 Wed Sep 18 19:10:43 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 227 due to unfinished request 192 Wed Sep 18 19:10:43 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 116 due to unfinished request 298 Wed Sep 18 19:10:44 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 226 due to unfinished request 183 Wed Sep 18 19:10:44 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 228 due to unfinished request 271 Wed Sep 18 19:10:45 2013 : Error: Discarding duplicate request from client wism-2 port 32770 - ID: 227 due to unfinished request 192 Wed Sep 18 19:10:45 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 116 due to unfinished request 298 Wed Sep 18 19:10:47 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 116 due to unfinished request 298 Wed Sep 18 19:10:48 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 117 due to unfinished request 380 Wed Sep 18 19:10:49 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 116 due to unfinished request 298 Wed Sep 18 19:10:50 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 117 due to unfinished request 380 Wed Sep 18 19:10:51 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 116 due to unfinished request 298 Wed Sep 18 19:10:52 2013 : Error: Discarding duplicate request from client wism-1 port 32770 - ID: 117 due to unfinished request 380 did a 'make install' in 2.2.0 directory to revert and the server is 100% happy again. alan
A.L.M.Buxey@lboro.ac.uk wrote:
theres something not quite right about FR 2.2.1
downloaded the latest version from freeradius.org, compiled it with same flags as 2.2.0, installed it onto a production server thats getting a fair amount of traffic...and the logs arent happy
Can you supply any more information? Alan DeKok.
Hi,
Can you supply any more information?
yes. I think I've got to the crux of this matter already. i think theres been a change to the case handling... this is what the old server had <some logic in place to say if User-Name matches the following regex then set a Realm value> then switch "%{Realm}" { case "NULL" { } case "local" { eap { ok = return } } case "youth.org" { update control { Proxy-To-Realm := "youth.org" } update request { Realm := "youth.org" } } case "ecb-captive" { update control { Proxy-To-Realm := "ecb-captive" } update request { Realm := "ecb-captive" } } etc etc note the 'local' handler. now, what this resulted in was this (tiny snipper of radiusd -X) ++switch %{Realm} { expand: %{Realm} -> local ++switch %{Realm} { +++case local { [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++++[eap] = updated +++} # case local = updated +++case youth.org { ++++update control { ++++} # update control = noop ++++update request { ++++} # update request = noop +++} # case youth.org = updated ++} # switch %{Realm} = updated [eap] Request is supposed to be proxied to Realm youth.org. Not doing EAP. ....ah! err, urk. local requests were being proxied off to another server...which wasnt expecting them ot the realm etc so was barfing...and our server had lots of dead proxy attempts...timing out..and hence the duplicates. if changed the unlang to: switch "%{Realm}" { case "NULL" { } case "local" { update control { Proxy-To-Realm := "local" } update request { Realm := "local" } } case "youth.org" { update control { Proxy-To-Realm := "youth.org" } update request { Realm := "youth.org" } } ...etc etc and all appears to be working fine now.... so is the code at fault...or was the original unlang only just working due to luck/fortune (I didnt write it....but its based on earlier stuff that I did create - the reason for doing regex/unlang and case statements is to ensure we're in control of the proxy realm decision and now edge/corner cases creep in. many thanks alan
Alan DeKok, 2013-09-19 03:58:
yes. I think I've got to the crux of this matter already. i think theres been a change to the case handling... this is what the old server had I've pushed a fix to the v2.x.x branch. It corrects the "case" issue you ran into.
Can you elaborate on what the problem is? We use 'case' like this: switch Huntgroup-Name { case hg1 { update reply { .. } } case hg1 { update reply { .. } } ... case { update control { .. } update request { ... } } } It seems to still work as intended, but I might have missed something...
It seems to still work as intended, but I might have missed something...
It appeared to be dropping through multiple case statements. This highlights why it's important for people to actually test pre-release versions when the announcements go out. There will eventually be unit tests and more functional tests for 3.x.x, but until we have more comprehensive coverage, community testing is still very useful. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 09/20/2013 05:12 AM, Arran Cudbard-Bell wrote:
It seems to still work as intended, but I might have missed something...
It appeared to be dropping through multiple case statements.
This highlights why it's important for people to actually test pre-release versions when the announcements go out.
This is a serious bug. One can always apply a patch to 2.2.1 but then it always becomes an ambiguous question, are you running the broken 2.2.1 or the patched 2.2.1? That makes version information very difficult to manage and confuses people who want to download and build 2.2.1, they'll have to know they have to patch it before building and then track the patch information. The best solution is to spin a new release with the fix and bump the version. Yeah that kinda sucks but there really isn't a better solution when problems like this come up. [1] [1] In the dim past a similar situation arose and the tarball was regenerated under the same name, that created it's own set of problems. -- John
On 20 Sep 2013, at 16:21, John Dennis <jdennis@redhat.com> wrote:
On 09/20/2013 05:12 AM, Arran Cudbard-Bell wrote:
It seems to still work as intended, but I might have missed something...
It appeared to be dropping through multiple case statements.
This highlights why it's important for people to actually test pre-release versions when the announcements go out.
This is a serious bug.
One can always apply a patch to 2.2.1 but then it always becomes an ambiguous question, are you running the broken 2.2.1 or the patched 2.2.1?
bash-3.2# cat VERSION 3.0.0+super_sexy_extra_things bash-3.2# grep -i version src/include/autoconf.h /* Define to the full name and version of this package. */ /* Define to the version of this package. */ #define PACKAGE_VERSION "$Id: c9fade5e7fbf3afbf28799ff7d53f7bf9fad9b76 $" /* Version integer in format <ma><ma><mi><mi><in><in> */ #define RADIUSD_VERSION 030000 #define RADIUSD_VERSION_COMMIT "a4c7809" /* Raw version string from VERSION file */ #define RADIUSD_VERSION_STRING "3.0.0+super_sexy_extra_things" bash-3.2# ./build/bin/local/radiusd -v radiusd: FreeRADIUS Version 3.0.0+super_sexy_extra_things (git #a4c7809), for host i386-apple-darwin12.5.0, built on Sep 20 2013 at 18:04:22 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT This was considered when doing the VERSION macros and associated autoconf code.
That makes version information very difficult to manage and confuses people who want to download and build 2.2.1, they'll have to know they have to patch it before building and then track the patch information.
Yes it's an issue.
The best solution is to spin a new release with the fix and bump the version. Yeah that kinda sucks but there really isn't a better solution when problems like this come up. [1]
We'll see what the project leader wants to do. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 09/20/2013 01:12 PM, Arran Cudbard-Bell wrote:
bash-3.2# cat VERSION 3.0.0+super_sexy_extra_things
That doesn't solve the tarball problem unless you name the tarball freeradius-server-3.0.0+super_sexy_extra_things.tar.bz2 at which point you might as well just bump the version. It's also critical that versionscollate in ascending order, something much easier to do with numbers rather than strings. -- John
Arran Cudbard-Bell, 2013-09-20 11:12:
It seems to still work as intended, but I might have missed something... It appeared to be dropping through multiple case statements.
I don't see this happening here. Maybe it only happens if a module is called in the section, as the eap module in the OP's config.
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Jakob Hirsch -
John Dennis