Wrong Vlan assignment by freeradius, threading issue?!
Hi Folks, I'm running into some very bad issue: when running freeradius in threaded mode (default) it's mixing up CONCURRENT requests resulting in a wrong vlan assignment. Here are the logs of two clients (OSX and Ubuntu). The Ubuntu supplicant (wpa-suppl.) always fails the first login try, but this is normal. This is with reauthentification interval of 10 seconds, so requests seem to overlap: Tue Sep 7 16:45:36 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:45:38 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:45:38 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:45:39 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:45:41 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB) Tue Sep 7 16:45:44 2010 : Error: Discarding duplicate request from client swba1-00-test port 1645 - ID: 208 due to unfinished request 267 Tue Sep 7 16:45:53 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:45:56 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:45:59 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB) Tue Sep 7 16:46:01 2010 : Error: Discarding duplicate request from client swba1-00-test port 1645 - ID: 232 due to unfinished request 291 Now let's check what Vlans got assigned (this is the vmps log, vmps gets only this MAC via rad2vmps and looks up the vlan in a mysql db): ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 So freeradius takes the MAC of the OSX client and inserts it into the request that is associated with the Ubuntu client - VERY BAD. Now I only changed the reauthentification interval to 20 seconds, so the requests do not overlap anymore for sure. Tue Sep 7 16:46:50 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:46:53 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:46:53 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:46:57 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:46:57 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB) Tue Sep 7 16:47:17 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:47:20 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:47:20 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50037 cli 00-1C-25-A2-10-3C) Tue Sep 7 16:47:25 2010 : Auth: Login OK: [jan/<via Auth-Type = mschap>] (from client swba1-00-test port 0 via TLS tunnel) Tue Sep 7 16:47:25 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50039 cli 00-16-CB-AA-0F-CB) Vmps log: ALLOW: 00:1c:25:a2:10:3c -> FBIB, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/37 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 ALLOW: 00:1c:25:a2:10:3c -> FBIB, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/37 ALLOW: 00:16:cb:aa:0f:cb -> Management, switch swba1-00-test.sb.dfki.de [172.16.0.24] port Gi0/39 The short reauthentification interval is just to simulate a few more clients for stresstesting purposes. Can anyone help? The operating system is FreeBSD 8.1-RELEASE i386 and always las load averages of 0.00, 0.00, 0.00 Switch hardware is cisco WS-C3560G-48PS with firmware (12.2(53)SE2 C3560-IPSERVICESK9-M). Best, Jan
Jan Zacharias wrote:
I'm running into some very bad issue: when running freeradius in threaded mode (default) it's mixing up CONCURRENT requests resulting in a wrong vlan assignment.
That sounds bad.
Now let's check what Vlans got assigned (this is the vmps log, vmps gets only this MAC via rad2vmps and looks up the vlan in a mysql db):
Hmm... rad2vmps is *not* a FreeRADIUS piece of software. FreeRADIUS implements VMPS internally, so rad2vmps is *not* necessary.
Can anyone help? The operating system is FreeBSD 8.1-RELEASE i386 and always las load averages of 0.00, 0.00, 0.00 Switch hardware is cisco WS-C3560G-48PS with firmware (12.2(53)SE2 C3560-IPSERVICESK9-M).
And the FreeRADIUS version is... ? This is the FreeRADIUS list, so it might help to post the FreeRADIUS version, too. Alan DeKok.
Version is "radiusd: FreeRADIUS Version 2.1.9, for host i386-portbld-freebsd8.1, built on Aug 5 2010 at 14:17:48" rad2vmps is part of freenac. Can freerad and freenac work w/a this thing in between out of the box?! That would be great! Maybe I should post full debug output of freerad, but I'm concerned that flooding the list is not very nice. Best, Jan Alan DeKok <aland@deployingradius.com> hat am 7. September 2010 um 17:29 geschrieben:
Jan Zacharias wrote:
I'm running into some very bad issue: when running freeradius in threaded mode (default) it's mixing up CONCURRENT requests resulting in a wrong vlan assignment.
That sounds bad.
Now let's check what Vlans got assigned (this is the vmps log, vmps gets only this MAC via rad2vmps and looks up the vlan in a mysql db):
Hmm... rad2vmps is *not* a FreeRADIUS piece of software. FreeRADIUS implements VMPS internally, so rad2vmps is *not* necessary.
Can anyone help? The operating system is FreeBSD 8.1-RELEASE i386 and always las load averages of 0.00, 0.00, 0.00 Switch hardware is cisco WS-C3560G-48PS with firmware (12.2(53)SE2 C3560-IPSERVICESK9-M).
And the FreeRADIUS version is... ? This is the FreeRADIUS list, so it might help to post the FreeRADIUS version, too.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jan Zacharias wrote:
Version is "radiusd: FreeRADIUS Version 2.1.9, for host i386-portbld-freebsd8.1, built on Aug 5 2010 at 14:17:48"
Maybe the Perl installation on your system isn't thread-safe. This is possible...
rad2vmps is part of freenac. Can freerad and freenac work w/a this thing in between out of the box?! That would be great!
Freenac is dead. Use the VMPS functionality that is included with FreeRADIUS. Alan DeKok.
Hey, is the vmps functionality in freerad really a substitute for freenac? Is there a Gui that I missed? After reading the sample configuration in sites-available/vmps I get the impression that freerad can just handle vmps requests as well. For me, vmps is not required at all, the clients use 802.1x as the switches do. Rad2vmps is just necessary as freenac can not speak radius natively - maybe this was not clear :) Back to the topic: if rad2vmps gets the wrong mac from the freerad thread this is no perl issue, right? Maybe I manage to get debug mode on rad2vmps working - then we know for sure. Best, Jan Alan DeKok <aland@deployingradius.com> hat am 7. September 2010 um 17:58 geschrieben:
Jan Zacharias wrote:
Version is "radiusd: FreeRADIUS Version 2.1.9, for host i386-portbld-freebsd8.1, built on Aug 5 2010 at 14:17:48"
Maybe the Perl installation on your system isn't thread-safe. This is possible...
rad2vmps is part of freenac. Can freerad and freenac work w/a this thing in between out of the box?! That would be great!
Freenac is dead. Use the VMPS functionality that is included with FreeRADIUS.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jan Zacharias wrote:
is the vmps functionality in freerad really a substitute for freenac?
For some of it.
Is there a Gui that I missed?
FreeRADIUS doesn't include a GUI for VMPS.
After reading the sample configuration in sites-available/vmps I get the impression that freerad
Please use the right name. It's not "freerad".
can just handle vmps requests as well. For me, vmps is not required at all, the clients use 802.1x as the switches do. Rad2vmps is just necessary as freenac can not speak radius natively - maybe this was not clear :)
I'm familiar with freenac.
Back to the topic: if rad2vmps gets the wrong mac from the freerad thread this is no perl issue, right?
What did I say it was? Did you read my previous message? Alan DeKok.
So the program (freeradius?!) that is calling rad2vmps is a perl script? Best, Jan Alan DeKok <aland@deployingradius.com> hat am 8. September 2010 um 14:19 geschrieben:
Jan Zacharias wrote:
is the vmps functionality in freerad really a substitute for freenac?
For some of it.
Is there a Gui that I missed?
FreeRADIUS doesn't include a GUI for VMPS.
After reading the sample configuration in sites-available/vmps I get the impression that freerad
Please use the right name. It's not "freerad".
can just handle vmps requests as well. For me, vmps is not required at all, the clients use 802.1x as the switches do. Rad2vmps is just necessary as freenac can not speak radius natively - maybe this was not clear :)
I'm familiar with freenac.
Back to the topic: if rad2vmps gets the wrong mac from the freerad thread this is no perl issue, right?
What did I say it was? Did you read my previous message?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Jan Zacharias