September 2020 - Freeradius-Users - lists.freeradius.org

3.0.21 consistency check failed
by adrian.p.smith＠bt.com 02 Sep '20

02 Sep '20

We have recently attempted to upgrade from 3.0.15 to 3.0.21 but are seeing very frequent crashes. Config unchanged from 3.0.15. Any ideas appreciated. Regards, Adrian Smith Examples from the radius.log: CONSISTENCY CHECK FAILED src/lib/cursor.c[219]: VALUE_PAIR "BTOpenzone-Roaming-Direction" length 42696464 is greater than char buffer length 7 SOFT ASSERT FAILED src/lib/pair.c[2341]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 15 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7fab75ae7490] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_assert_cond+0x4c)[0x7fab75ae7f50] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_pair_verify+0x3af)[0x7fab75af8c52] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_cursor_next+0x58)[0x7fab75ae641f] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_pair_list_verify+0x151)[0x7fab75af9169] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x25482)[0x7fab75d4c482] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(verify_request+0x16c)[0x7fab75d4c5f8] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d3f0] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d1f6] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_run+0x144)[0x7fab75b0f7d4] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_loop+0x509)[0x7fab75b10117] /opt/freeradius-server-3.0.21/sbin/radiusd(radius_event_process+0x26)[0x4492d5] /opt/freeradius-server-3.0.21/sbin/radiusd(main+0xcbb)[0x43274b] /lib64/libc.so.6(__libc_start_main+0xfd)[0x3a0081ed1d] /opt/freeradius-server-3.0.21/sbin/radiusd[0x40f489] No panic action set and Mon Aug 24 01:20:40 2020 : Error: CONSISTENCY CHECK FAILED src/main/process.c[639]: Expected RADIUS_PACKET request to be parented by 0xd1f5d0 (REQUEST), but parented by 0xd04680 (null_context) Talloc chunk lineage: 0xd1f230 (RADIUS_PACKET) < 0xd04680 (null_context) Talloc context level 0: full talloc report on 'null_context' (total 466556 bytes in 3189 blocks) session-state contains 14 bytes in 2 blocks (ref 0) 0xd8c690 .name contains 14 bytes in 1 blocks (ref 0) 0xd79b20 acct_listener_pool contains 15485 bytes in 101 blocks (ref 0) 0xd77ab0 REQUEST contains 7277 bytes in 100 blocks (ref 0) 0xd77e30 RADIUS_PACKET contains 3340 bytes in 48 blocks (ref 0) 0x7f090001f090 uint8_t contains 481 bytes in 1 blocks (ref 0) 0x7f090000fd40 <snip> Mon Aug 24 01:20:40 2020 : Error: ASSERT FAILED src/main/util.c[1095]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 12 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f092d5aa490] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(rad_assert_fail+0x46)[0x7f092d80e438] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x25437)[0x7f092d80f437] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(verify_request+0x10a)[0x7f092d80f596] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d3f0] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d1f6] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_run+0x144)[0x7f092d5d27d4] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_loop+0x509)[0x7f092d5d3117] /opt/freeradius-server-3.0.21/sbin/radiusd(radius_event_process+0x26)[0x4492d5] /opt/freeradius-server-3.0.21/sbin/radiusd(main+0xcbb)[0x43274b] /lib64/libc.so.6(__libc_start_main+0xfd)[0x3a0081ed1d] /opt/freeradius-server-3.0.21/sbin/radiusd[0x40f489] No panic action set and CONSISTENCY CHECK FAILED src/lib/cursor.c[219]: VALUE_PAIR "NAS-Identifier" char buffer is not parented by VALUE_PAIR 0x7fc3f0014480, instead parented by 0x231dee0 (null_context) SOFT ASSERT FAILED src/lib/pair.c[2358]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 15 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7fc46fbd8490] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_assert_cond+0x4c)[0x7fc46fbd8f50] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_pair_verify+0x4cc)[0x7fc46fbe9d6f] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_cursor_next+0x58)[0x7fc46fbd741f] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_pair_list_verify+0x151)[0x7fc46fbea169] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x25482)[0x7fc46fe3d482] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(verify_request+0x16c)[0x7fc46fe3d5f8] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d3f0] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d1f6] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_run+0x144)[0x7fc46fc007d4] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_loop+0x509)[0x7fc46fc01117] /opt/freeradius-server-3.0.21/sbin/radiusd(radius_event_process+0x26)[0x4492d5] /opt/freeradius-server-3.0.21/sbin/radiusd(main+0xcbb)[0x43274b] /lib64/libc.so.6(__libc_start_main+0xfd)[0x33d121ed1d] /opt/freeradius-server-3.0.21/sbin/radiusd[0x40f489] No panic action set and Mon Aug 24 01:20:49 2020 : Error: CONSISTENCY CHECK FAILED src/main/process.c[2919]: Expected RADIUS_PACKET request to be parented by 0x1878490 (REQUEST), but parented by 0x184bee0 (null_context) Talloc chunk lineage: 0x1878170 (RADIUS_PACKET) < 0x184bee0 (null_context) Talloc context level 0: full talloc report on 'null_context' (total 64956 bytes in 465 blocks) session-state contains 14 bytes in 2 blocks (ref 0) 0x1873070 .name contains 14 bytes in 1 blocks (ref 0) 0x187e190 acct_listener_pool contains 15323 bytes in 94 blocks (ref 0) 0x196f200 <snip> Mon Aug 24 01:20:49 2020 : Error: ASSERT FAILED src/main/util.c[1095]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 9 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f74c5e88490] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(rad_assert_fail+0x46)[0x7f74c60ec438] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x25437)[0x7f74c60ed437] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(verify_request+0x10a)[0x7f74c60ed596] /opt/freeradius-server-3.0.21/sbin/radiusd[0x44221c] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43f5a3] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43af5c] /lib64/libpthread.so.0(+0x33d1607aa1)[0x7f74c5840aa1] /lib64/libc.so.6(clone+0x6d)[0x33d12e8bcd] No panic action set And Mon Aug 24 01:22:08 2020 : Error: CONSISTENCY CHECK FAILED src/main/process.c[1159]: Expected RADIUS_PACKET request to be parented by 0xe77dc0 (REQUEST), but parented by 0xd94ee0 (null_context) Talloc chunk lineage: 0xe77ab0 (RADIUS_PACKET) < 0xd94ee0 (null_context) Talloc context level 0: full talloc report on 'null_context' (total 594675 bytes in 3880 blocks) session-state contains 14 bytes in 2 blocks (ref 0) 0xe21380 .name contains 14 bytes in 1 blocks (ref 0) 0xda9720 acct_listener_pool contains 16303 bytes in 114 blocks (ref 0) 0xda3b10 REQUEST contains 8095 bytes in 113 blocks (ref 0) 0xda3ed0 RADIUS_PACKET contains 258 bytes in 4 blocks (ref 0) 0xe18100 VALUE_PAIR contains 82 bytes in 2 blocks (ref 0) 0x7f55f00076f0 uint8_t contains 2 bytes in 1 blocks (ref 0) 0x7f55f0006170 src/lib/radius.c:495 contains 24 bytes in 1 blocks (ref 0) 0xda9370 RADIUS_PACKET contains 3610 bytes in 52 blocks (ref 0) 0x7f5610028b50n and Mon Aug 24 01:22:11 2020 : Error: ASSERT FAILED src/main/util.c[566]: !request->in_request_hash CAUGHT SIGNAL: Aborted Backtrace of last 17 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f31e3310490] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(rad_assert_fail+0x46)[0x7f31e3574438] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x24481)[0x7f31e3574481] /usr/lib64/libtalloc.so.2(+0x2dbe)[0x7f31e2ee2dbe] /usr/lib64/libtalloc.so.2(+0x2c4b)[0x7f31e2ee2c4b] /usr/lib64/libtalloc.so.2(+0x2c4b)[0x7f31e2ee2c4b] /usr/lib64/libtalloc.so.2(+0x2c4b)[0x7f31e2ee2c4b] /usr/lib64/libtalloc.so.2(_talloc_free+0xfb)[0x7f31e2ee32db] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d2e2] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43db8c] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d1f6] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_run+0x144)[0x7f31e33387d4] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_loop+0x509)[0x7f31e3339117] /opt/freeradius-server-3.0.21/sbin/radiusd(radius_event_process+0x26)[0x4492d5] /opt/freeradius-server-3.0.21/sbin/radiusd(main+0xcbb)[0x43274b] /lib64/libc.so.6(__libc_start_main+0xfd)[0x33d121ed1d] /opt/freeradius-server-3.0.21/sbin/radiusd[0x40f489] No panic action set

3 5

Errors reading /etc/raddb/mods-config/attr_filter/post-proxy
by lingctam 02 Sep '20

02 Sep '20

Hi, I am in the initial debugging process and came across this error I cannot resolve: /etc/raddb/mods-config/attr_filter/post-proxy[127]: Entry does not begin with a user name Errors reading /etc/raddb/mods-config/attr_filter/post-proxy /etc/raddb/mods-enabled/attr_filter[12]: Instantiation failed for module "attr_filter.post-proxy" I have done some edits on the "post-proxy" file and "/mods-enabled/attr_filter" to no avail. Can anyone please point me to the right direction? Thanks.

1 1

Freeradius 3.x - CoA proxy and dynamic-client
by Alex 01 Sep '20

01 Sep '20

Hi everyone, I'm trying to solve a litte issue with my freeradius scenario. My scenario is like this Client ----- proxy (FR 3.x) ------ AAA (FR 3.x) |----------------- COA generator (Java) So, I have a proxy frontend with dynamc-clients virtualserver wich forwards the authentication and accounting requests to the backend via realm module. this is working like a charm. I would like to use also coa requests to the client. this requests are generated by a java software, then they should be proxied by the frontend and forwarded to the client. from my understanding the realm module needs a static client definition to proxy the coa requests, but this is not applicable to my scenario. so now I'm trying to find some kind of workaround, but i'm not able to find any documentation on known pattern on the documentation. is someone facing the same problem or had solved it in the past? thank you and best regards! Alex

2 3

Multiple Logins
by Aurélio de Souza Ribeiro Neto 01 Sep '20

01 Sep '20

Hello all, How can I assign an IP of a specific pool to clients trying to connect with multiple logins? Thanks

2 3

Re: Does Pam_Radius support Acct-Interim-Interval?
by Mark Antony 01 Sep '20

01 Sep '20

Hi Alan, Now I understand the limitations. I noticed that whenever I make a new connection, rather than inserting a new row in Radacct it is updating the existing entry. This makes the accounting useless. Unless I have somewhere a configuration mistake on my part, which I should investigate. I also noticed the servicetype shows as Authenticate-Only instead of Framed-User. But as you say I may need to look for something else to get full-featured accounting on the users activity. Thanks, Mark On Aug 4, 2020, at 6:30 AM, Mark Antony via Freeradius-Users < [freeradius-users at lists.freeradius.org](http://lists.freeradius.org/mailman/listinfo/freeradi… > wrote: > I have a question about Pam_Radius plugin and Freeradius. Does it only support authentication? It supports accounting, but it's not well documented or tested. > I'm asking because while authentication seem to work, Acct-Interim-Interval seem to be completely ignored. Yes. The module sends RADIUS packets when the PAM framework calls it. The module does NOT start up any new process or thread to periodically send packets. The PAM framework can call the module on open session, and close session. That's it. There is no "session still open" capability in PAM. If you want full-featured accounting on the users activity, interim updates, etc., then you will have to use something else. Both PAM and the standard Unix APIs don't support that. > post-auth { > update reply { > Acct-Interim-Interval = 10 > } > } > > For testing purposes I have set it to 10 seconds and I was expecting it to fire update-requests every 10 seconds, but this isn't happening. No RADIUS NAS on the planet will send accounting packets every 10 seconds. RFC 2866 suggests a 5 minute minimum on Acct-Interim-Interval. Most NASes enforce that. Alan DeKok.

2 1