Freeradius 3.0.10 sigsegv

5 Jan 2016

      Hi,
we are experiencing a lot of segmentation fault in freeradius 3.0.10. It 
seems to be  something in proxy because we have other freeradius server 
running without problem. Those one (other two servers) with proxy 
enabled crash with the same backtrace.

Hosts configuration and backtrace follows.

Any idea?

Thanks in advance
Luca

Freeradius version is: freeradius: FreeRADIUS Version 3.0.10, for host 
x86_64-pc-linux-gnu, built on Dec 15 2015 at 10:46:38

The proxy.conf is:

proxy server {
	default_fallback = yes
}

home_server radius.radius.net {
	type = auth+acct
	ipaddr = xxxx
	port = 1812
	secret = "password"
	status_check = status-server
	check_interval = 30
	num_answers_to_alive = 3
}

home_server radius2.radius.net {
	type = auth+acct
	ipaddr = xxx
	port = 1812
	secret = "password"
	status_check = status-server
	check_interval = 30
	num_answers_to_alive = 3
}

home_server_pool EDUROAM-IT {
	type = fail-over
	home_server = radius.radius.net
	home_server = radius2.radius.net
}

realm unict.it {
	# nostrip
}

realm NULL {
  	nostrip
}

realm LOCAL {
  	nostrip
}

realm DEFAULT {
	pool	= EDUROAM-IT
	nostrip
	type	= radius
}

eduroam virtual server is:

server eduroam {
	authorize {
   		auth_log
   		suffix
   		if ((control:Proxy-To-Realm == "DEFAULT") && (User-Name =~ 
/.*@.*.unict.it$/)) {
     			update control {
	  			Proxy-To-Realm := NULL
     			}
   		}
		eap
	}

	authenticate {
   		Auth-Type EAP {
			eap
   		}
	}

	preacct {
     		# detail
   		suffix
   		if ((control:Proxy-To-Realm == "DEFAULT") && (User-Name =~ 
/.*@.*.unict.it$/)) {
     			update control {
	  			Proxy-To-Realm := NULL
     			}
		}
	}

	accounting {
		sql
	}

	post-auth {
   		reply_log
   		Post-Auth-Type REJECT {
             		# reply_log
   		}
	}

	pre-proxy {
         	attr_filter.pre-proxy
         	pre_proxy_log
	}

	post-proxy {
         	post_proxy_log
         	attr_filter.post-proxy
	}
}

Here is the backtrace (the same for both of servers):

#0  0x00007ffff7bc77a0 in paircompare (request=request@entry=0xa531c0, 
req_list=0xa53470, check=check@entry=0xa54ce0, rep_list=rep_list@entry=0x0)
     at src/main/pair.c:536
#1  0x00007ffff7bb95d7 in cond_cmp_values (request=0xa531c0, 
lhs_type=<optimized out>, lhs=<optimized out>, lhs_len=<optimized out>,
     rhs_type=PW_TYPE_STRING, rhs=0x7fffffffd2d0, rhs_len=8, 
c=<optimized out>, c=<optimized out>) at src/main/evaluate.c:315
#2  0x00007ffff7bb992a in cond_normalise_and_cmp (request=0x0, 
c=0x8bd4a0, lhs_type=PW_TYPE_INVALID, lhs_enumv=0x7ffff7bd4230, 
lhs_enumv@entry=0x0,
     lhs=0x0, lhs_len=1, lhs_len@entry=0) at src/main/evaluate.c:544
#3  0x00007ffff7bba3ac in radius_evaluate_map 
(request=request@entry=0xa531c0, modreturn=modreturn@entry=10, 
depth=depth@entry=0,
     c=c@entry=0x8bd4a0) at src/main/evaluate.c:612
#4  0x00007ffff7bba4a0 in radius_evaluate_cond (request=0xa531c0, 
modreturn=10, depth=0, c=0x8bd4a0) at src/main/evaluate.c:708
#5  0x0000000000425228 in modcall_recurse (request=0xa531c0, 
component=22, depth=22, entry=0x7fffffffdec8, do_next_sibling=false)
     at src/main/modcall.c:479
#6  0x0000000000424fa9 in modcall_child (request=<optimized out>, 
component=<optimized out>, depth=<optimized out>, entry=0x7fffffffdeb0,
     c=<optimized out>, result=0x7fffffffd724, do_next_sibling=true) at 
src/main/modcall.c:408
#7  0x00000000004252c4 in modcall_recurse (request=0xa531c0, 
component=22, depth=22, entry=0x7fffffffdeb0, do_next_sibling=false)
     at src/main/modcall.c:785
#8  0x0000000000424fa9 in modcall_child (request=<optimized out>, 
component=<optimized out>, depth=<optimized out>, entry=0x7fffffffde98,
     c=<optimized out>, result=0x7fffffffd9c4, do_next_sibling=true) at 
src/main/modcall.c:408
#9  0x00000000004252c4 in modcall_recurse (request=0xa531c0, 
component=22, depth=22, entry=0x7fffffffde98, do_next_sibling=false)
     at src/main/modcall.c:785
#10 0x0000000000424fa9 in modcall_child (request=<optimized out>, 
component=<optimized out>, depth=<optimized out>, entry=0x7fffffffde80,
     c=<optimized out>, result=0x7fffffffdc64, do_next_sibling=true) at 
src/main/modcall.c:408
#11 0x00000000004252c4 in modcall_recurse (request=0xa531c0, 
component=22, component@entry=MOD_AUTHORIZE, depth=22, depth@entry=0,
     entry=0x7fffffffde80, do_next_sibling=false, 
do_next_sibling@entry=true) at src/main/modcall.c:785
#12 0x0000000000426416 in modcall 
(component=component@entry=MOD_AUTHORIZE, c=c@entry=0x9c22b0, 
request=request@entry=0xa531c0)
     at src/main/modcall.c:1130
#13 0x00000000004210dd in indexed_modcall (comp=MOD_AUTHORIZE, 
idx=<optimized out>, request=0xa531c0) at src/main/modules.c:1009
#14 0x0000000000410911 in rad_authenticate (request=0xa531c0) at 
src/main/auth.c:490
#15 0x000000000043409a in request_running (request=0xa531c0, 
action=<optimized out>) at src/main/process.c:1527
#16 0x0000000000430126 in request_queue_or_run 
(request=request@entry=0xa531c0, process=process@entry=0x433ee0 
<request_running>)
     at src/main/process.c:1015
#17 0x0000000000431815 in request_receive (ctx=ctx@entry=0xa52a40, 
listener=listener@entry=0x9ef500, packet=0xa52aa0, 
client=client@entry=0x972b20,
     fun=fun@entry=0x4104b0 <rad_authenticate>) at src/main/process.c:1782
#18 0x000000000041bd5e in auth_socket_recv (listener=0x9ef500) at 
src/main/listen.c:1568
---Type <return> to continue, or q <return> to quit---
#19 0x000000000042e72e in event_socket_handler (xel=<optimized out>, 
fd=<optimized out>, ctx=<optimized out>) at src/main/process.c:4556
#20 0x00007ffff7994025 in fr_event_loop (el=0x8e4640) at src/lib/event.c:641
#21 0x0000000000435531 in radius_event_process () at src/main/process.c:5621
#22 0x000000000040f7cc in main (argc=<optimized out>, 
argv=0x7fffffffecc8) at src/main/radiusd.c:579

Freeradius 3.0.10 sigsegv

Luca Palazzo