FR 2.1.9 - segfault using status server

[John Horne]

Hello,

We are running FR 2.1.9 on CentOS 5, and are proxying requests to MS IAS
2003 servers. However, it seems the IAS servers do not support
'status-server' requests until a slightly later version. As such, I have
configured FR to send a dummy userid/pwd instead. FR seems to receive a
reply, but then segfaults.

Running 'radiusd -X' shows:

=============================================
Marking home server 141.163.66.101 port 1812 as zombie (it looks like it
is dead).
Sending Access-Request of id 168 to 141.163.66.101 port 1812
        User-Name := "xxxxxx"
        User-Password := "xxxxxx"
        Service-Type := Authenticate-Only
        Message-Authenticator := 0x00000000000000000000000000000000
        NAS-Identifier := "Status Check. Are you alive?"
Waking up in 1.2 seconds.
rad_recv: Access-Reject packet from host 141.163.66.101 port 1812,
id=168, length=20
=============================================

So a reply was received, but radiusd has now died.

Getting radiusd to dump a core file shows:

=============================================
# gdb /usr/sbin/radiusd core.8509
GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-23.el5_5.1)
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show
copying"
and "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/sbin/radiusd...(no debugging symbols
found)...done.
Reading symbols
from /usr/lib/freeradius/libfreeradius-radius-2.1.9.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/libfreeradius-radius-2.1.9.so
Reading symbols from /lib/libnsl.so.1...(no debugging symbols
found)...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libresolv.so.2...(no debugging symbols
found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /lib/libpthread.so.0...(no debugging symbols
found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols
found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /usr/lib/libltdl.so.3...(no debugging symbols
found)...done.
Loaded symbols for /usr/lib/libltdl.so.3
Reading symbols from /lib/libdl.so.2...(no debugging symbols
found)...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libssl.so.6...(no debugging symbols
found)...done.
Loaded symbols for /lib/libssl.so.6
Reading symbols from /lib/libcrypto.so.6...(no debugging symbols
found)...done.
Loaded symbols for /lib/libcrypto.so.6
Reading symbols from /lib/libc.so.6...(no debugging symbols
found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols
found)...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/libgssapi_krb5.so.2
Reading symbols from /usr/lib/libkrb5.so.3...(no debugging symbols
found)...done.
Loaded symbols for /usr/lib/libkrb5.so.3
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols
found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libk5crypto.so.3...(no debugging symbols
found)...done.
Loaded symbols for /usr/lib/libk5crypto.so.3
Reading symbols from /usr/lib/libz.so.1...(no debugging symbols
found)...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /usr/lib/libkrb5support.so.0...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/libkrb5support.so.0
Reading symbols from /lib/libkeyutils.so.1...(no debugging symbols
found)...done.
Loaded symbols for /lib/libkeyutils.so.1
Reading symbols from /lib/libselinux.so.1...(no debugging symbols
found)...done.
Loaded symbols for /lib/libselinux.so.1
Reading symbols from /lib/libsepol.so.1...(no debugging symbols
found)...done.
Loaded symbols for /lib/libsepol.so.1
Reading symbols from /lib/libnss_files.so.2...(no debugging symbols
found)...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /lib/libnss_dns.so.2...(no debugging symbols
found)...done.
Loaded symbols for /lib/libnss_dns.so.2
Reading symbols from /usr/lib/freeradius/rlm_exec.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_exec.so
Reading symbols from /usr/lib/freeradius/rlm_expr.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_expr.so
Reading symbols from /usr/lib/freeradius/rlm_expiration.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_expiration.so
Reading symbols from /usr/lib/freeradius/rlm_logintime.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_logintime.so
Reading symbols from /usr/lib/freeradius/rlm_pap.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_pap.so
Reading symbols from /usr/lib/freeradius/rlm_mschap.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_mschap.so
Reading symbols from /usr/lib/freeradius/rlm_eap.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_eap.so
Reading symbols
from /usr/lib/freeradius/libfreeradius-eap-2.1.9.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/libfreeradius-eap-2.1.9.so
Reading symbols from /usr/lib/freeradius/rlm_eap_tls.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_eap_tls.so
Reading symbols from /usr/lib/freeradius/rlm_eap_ttls.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_eap_ttls.so
Reading symbols from /usr/lib/freeradius/rlm_eap_peap.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_eap_peap.so
Reading symbols from /usr/lib/freeradius/rlm_eap_mschapv2.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_eap_mschapv2.so
Reading symbols from /usr/lib/freeradius/rlm_realm.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_realm.so
Reading symbols from /usr/lib/freeradius/rlm_files.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_files.so
Reading symbols from /usr/lib/freeradius/rlm_radutmp.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_radutmp.so
Reading symbols from /usr/lib/freeradius/rlm_attr_filter.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_attr_filter.so
Reading symbols from /usr/lib/freeradius/rlm_preprocess.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_preprocess.so
Reading symbols from /usr/lib/freeradius/rlm_acct_unique.so...(no
debugging symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_acct_unique.so
Reading symbols from /usr/lib/freeradius/rlm_detail.so...(no debugging
symbols found)...done.
Loaded symbols for /usr/lib/freeradius/rlm_detail.so
Core was generated by `/usr/sbin/radiusd -X'.
Program terminated with signal 11, Segmentation fault.
#0  0x0806c936 in received_proxy_response ()
(gdb) bt
#0  0x0806c936 in received_proxy_response ()
#1  0x0805a041 in ?? ()
#2  0x0806b110 in ?? ()
#3  0x00ac1f0d in fr_event_loop ()
   from /usr/lib/freeradius/libfreeradius-radius-2.1.9.so
#4  0x0806bd26 in radius_event_process ()
#5  0x08063f6a in main ()
(gdb) q
=============================================


The proxy.conf part just has:

=============================================
       status_check = request
       username = xxxxxx
       password = xxxxxx
=============================================



Has anyone else seen this problem?

At the moment we are running FR with the 'status_check = status-server'
enabled, since it seems better to receive no reply at all rather than
having radiusd segfaulting.


Thanks,

John.

-- 
John Horne                   Tel: +44 (0)1752 587287
University of Plymouth, UK   Fax: +44 (0)1752 587001