strange behavior in proxy when some backend servers down
Hello, I've just been assigned a task regarding a problem with freeradius. Bear with me if my understanding of freeradius terminology is a bit weak, as I have just started familiarizing myself with this software today. The situation is that we have a freeradius instance running as a proxy. This instance is configured to proxy requests to a pool of four freeradius servers. Right now three are down, so we are testing the failover conditions. IIUC, the desired behavior is that it tries one backend server, and fails, marks it as a zombie, and then upon receiving another request from the user logging in, it should try a different backend server. What we're seeing is that once no response comes back from a server, it marks the server as a zombie, but it marks the request as completed. Subsequent authentication requests that come in are looked up in the response hash, finds that the response has been completed, and ignores the request. I could use any help in tracking this down. If it requires a code change to fix, I'll be contributing that back to the project. Does anyone have any suggestions on how to track this down? -- Obama Nation | My emails do not have attachments; it's a digital signature that your mail program doesn't understand. | http://www.subspacefield.org/~travis/ If you are a spammer, please email john@subspacefield.org to get blacklisted.
The situation is that we have a freeradius instance running as a proxy.
This instance is configured to proxy requests to a pool of four freeradius servers.
Right now three are down, so we are testing the failover conditions.
IIUC, the desired behavior is that it tries one backend server, and fails, marks it as a zombie, and then upon receiving another request from the user logging in, it should try a different backend server.
What we're seeing is that once no response comes back from a server, it marks the server as a zombie, but it marks the request as completed.
No, request should fail and server should respond with Access-Reject.
Subsequent authentication requests that come in are looked up in the response hash, finds that the response has been completed, and ignores the request.
That should go on for a limited period (cleanup_delay).
I could use any help in tracking this down. If it requires a code change to fix, I'll be contributing that back to the project.
So, post the debug and point out what you think should happen. Ivan Kalik Kalik Informatika ISP
travis+ml-freeradius-users@subspacefield.org wrote:
IIUC, the desired behavior is that it tries one backend server, and fails, marks it as a zombie, and then upon receiving another request from the user logging in, it should try a different backend server.
See recent threads on this list... It mostly does that. If you are testing with ONE request at a time, you might see behavior you don't expect. If you have MANY requests simultaneously, they do get switched from one home server to another.
What we're seeing is that once no response comes back from a server, it marks the server as a zombie, but it marks the request as completed.
i.e. "the proxy responds to the client". The request is marked as completed ONLY because it responds to the client.
Subsequent authentication requests that come in are looked up in the response hash, finds that the response has been completed, and ignores the request.
It ONLY ignores the request if you configure the "do not respond" policy. If you want it to continue processing requests... DON'T set the "do not respond" policy.
I could use any help in tracking this down. If it requires a code change to fix, I'll be contributing that back to the project.
Does anyone have any suggestions on how to track this down?
The source code is publicly available. You can use gdb and code introspection to see what it's doing. See src/main/event.c for the internal state machine. Alan DeKok.
participants (3)
-
Alan DeKok -
Ivan Kalik -
travis+ml-freeradius-users＠subspacefield.org