SVN 165 - unwanted UAM redirects

[wlan at mac.com]

I found a potential cause, and fixed it in rev 166. If the client  
requested a new IP via DHCP instead of confirming an existing ip, it  
would be sent down the 'dnat' state. If you are willing, give it a go.

On Apr 26, 2008, at 7:37 PM, lc wrote:

>
> Some time ago I reported a strange behavior of SVN 155 and later 159.
>
> We found that under unknown and rare circumstances chilli starts to  
> redirect to the UAM server with res=already although the session is  
> active. No matther what is entered in the web browser, the user is  
> redirected. This behaviour does not start right away after a login,  
> but some minutes later.
>
> Today we ran another test at a heavy used location. And we got  
> lucky (if you can call this luck) - the problem occured at one  
> Vista user.
>
> Here are two corresponding lines of our UAM-Server log. There was  
> no other communication with our UAM Server within this timeframe.
>
> [26/Apr/2008:16:50:31 +0200] "GET /?res=success
> [26/Apr/2008:16:59:44 +0200] "GET /?res=already
> After this line many "already" lines followed - a few minutes  
> later, the user gave up. But for 9 minutes chilli worked as it should.
>
> His computer info: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT  
> 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; .NET CLR 1.1.4322)
>
> We do not know for sure but so far we only noticed this problem  
> when Vista was used.
>
> But we know for sure that
>
> - affected users do not go to the login page (=the problem starts  
> suddenly without the user doing anything)
> - no matter which URL they enter they are always redirected to the  
> UAM server with res=already
> - chilli keeps sending acct-interim updates, so this is an  
> indication that chilli knows the session is active
> - chilli closes the session correctly after the affected users give up
> - chilli does not send any radius requests when it keeps redirecting
> - there must be something which triggers this behaviour
>
> A few days ago I was at a location and by chance a user was having  
> this problem. So I sat next to him and tried it myself - no matter  
> what I did, chilli redirected me. After this I stopped chilli and  
> started it in debug mode. And guess what: The problem did not  
> occur. After I left the user stayed for quite a long time. He  
> logged on and was logged off (timeout), but this issue did not  
> happen again.
>
> We have reason to believe what it does not happen with the current  
> 1.0.11 release.
>
> Questions: did anybody use chilli SVN 155 or newer out on the  
> field?  Are there any ideas what could trigger this behavior? How  
> can we help to gather more information? Is there a special debug  
> mode to watch closer why chilli starts to redirect?
>
>
>
>
>
>
>
>
>
>> Hi David,
>>
>> I just returned to my office and checked the logs of this  
>> location. Funny: the same user is still there and he opened new  
>> sessions and it seems the problem did not occur so far. This  
>> leaves me even more clueless.
>>
>> Could a miscommunication between chilli and the radius server  
>> cause such a behaviour? It is strange because if it occurs for a  
>> few minutes everything looks fine, and then suddenly the effect  
>> starts. The start of the session means chilli got a green light  
>> from Radius. Maybe immediatly if the communication is somehow not  
>> successful immediately after chilli starts to think after a few  
>> minutes that the session is actually not ok? I ask because  
>> sometimes it seems that chilli is not getting radius replies,  
>> therefore keeps retransmitting. This does not happen very often,  
>> but it happens.
>>
>> I am kind of desperate because I saw it with my own eyes but after  
>> restarting chilli I could not reproduce it today :(
>>
>> Cheers,
>> lc
>>
>> Am 23.04.2008 um 17:13 schrieb lc:
>>
>>>
>>> Hi David,
>>>
>>> Today I spent a few hours at one of those locations and  
>>> unfortunately the redirection problem popped up again!
>>>
>>> The user logged in and worked for a few minutes (gmail). Suddenly  
>>> chilli started redirecting him to the uam-page which was  
>>> displayed with res=already. I tried it - no matter which URL I  
>>> entered, I ended up there.
>>>
>>> The guy had Windows Vista and IE. After this I killed chilli and  
>>> restared it in debug mode - this time unfortunately I could not  
>>> reproduce it. However it was defenitly the same behaviour as with  
>>> the older SVN (I reported the issue to the mailing list).
>>>
>>> I will revert one location back to 1.0.11. For the other  
>>> location: how can I start chilli in Debug mode without getting  
>>> the leaky bucket messages? What can I do to help finding the issue?
>>>
>>> I keep wondering what could cause chilli to act this way? Why  
>>> would it suddenly think the session is not yet open?
>>>
>>> Cheers,
>>> lc
>>>
>>> Am 22.04.2008 um 14:34 schrieb lc:
>>>
>>>> Hi David,
>>>>
>>>> finally I managed to put SVN 165 out on two heavy-use locations.  
>>>> Will keep you updated on the results!
>>>>
>>>> Cheers,
>>>> lc
>>>>
>>>> Am 18.04.2008 um 15:53 schrieb David Bird:
>>>>
>>>>> Thanks for that... good to hear there are no (or little)  
>>>>> problems in the field with 1.0.11. I believe gmayer isn't  
>>>>> getting his RADIUS responses (if your following the mailing  
>>>>> list) and chilli is retransmitting, as expected.
>>>>>
>>>>> cheers,
>>>>> david
>>>>>
>>>>> On Apr 18, 2008, at 3:46 PM, lc wrote:
>>>>>
>>>>>> Hi David,
>>>>>>
>>>>>> I tested it only for 5 Mins to check whether the DNS bug has  
>>>>>> gone (and it has - thanks a lot!!!!). But I did't do anything  
>>>>>> more with it.
>>>>>>
>>>>>> I read the issues in the Mailing list and I want to test the  
>>>>>> latest SVN against it. Actually I was thinking to put it on at  
>>>>>> a few live systems tonight.
>>>>>> What worries me a bit is the other effect I had with some  
>>>>>> older SVN (the Windows Vista issue - redirection although  
>>>>>> session was active). I tried to get hold of those Vista  
>>>>>> machines but was unlucky: one got stolen and the other one was  
>>>>>> sold by the owner. So I could not reproduce it on my own.
>>>>>>
>>>>>> So far I run the 1.0.11 release out there. I see some error  
>>>>>> messages which are reported by the Radius Server but I have  
>>>>>> not had the time to look further into it.
>>>>>>
>>>>>> Early next week I will give you an update.
>>>>>>
>>>>>> Cheers,
>>>>>> lc
>>>>>>
>>>>>> Am 18.04.2008 um 15:33 schrieb David Bird:
>>>>>>
>>>>>>> Are you having issues with it?
>>>>>>>
>>>>>>> cheers,
>>>>>>> David
>>>>>>
>>>>>
>>>>
>>>
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: chilli-unsubscribe at coova.org
> For additional commands, e-mail: chilli-help at coova.org
> Wiki: http://coova.org/wiki/index.php/CoovaChilli
> Forum: http://coova.org/phpBB3/viewforum.php?f=4
>