SVN 165 - unwanted UAM redirects

lc chilli at silverserver.at
Sat Apr 26 20:38:53 UTC 2008 

This means that the trigger could be a dis- and reassociation of a  
WiFi client during an active session - sounds reasonable. Your latest  
SVN will be in action very soon, will keep you updated - thanks!

Am 26.04.2008 um 21:02 schrieb wlan at mac.com:

> I found a potential cause, and fixed it in rev 166. If the client  
> requested a new IP via DHCP instead of confirming an existing ip, it  
> would be sent down the 'dnat' state. If you are willing, give it a go.
>
> On Apr 26, 2008, at 7:37 PM, lc wrote:
>
>>
>> Some time ago I reported a strange behavior of SVN 155 and later 159.
>>
>> We found that under unknown and rare circumstances chilli starts to  
>> redirect to the UAM server with res=already although the session is  
>> active. No matther what is entered in the web browser, the user is  
>> redirected. This behaviour does not start right away after a login,  
>> but some minutes later.
>>
>> Today we ran another test at a heavy used location. And we got  
>> lucky (if you can call this luck) - the problem occured at one  
>> Vista user.
>>
>> Here are two corresponding lines of our UAM-Server log. There was  
>> no other communication with our UAM Server within this timeframe.
>>
>> [26/Apr/2008:16:50:31 +0200] "GET /?res=success
>> [26/Apr/2008:16:59:44 +0200] "GET /?res=already
>> After this line many "already" lines followed - a few minutes  
>> later, the user gave up. But for 9 minutes chilli worked as it  
>> should.
>>
>> His computer info: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT  
>> 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; .NET CLR  
>> 1.1.4322)
>>
>> We do not know for sure but so far we only noticed this problem  
>> when Vista was used.
>>
>> But we know for sure that
>>
>> - affected users do not go to the login page (=the problem starts  
>> suddenly without the user doing anything)
>> - no matter which URL they enter they are always redirected to the  
>> UAM server with res=already
>> - chilli keeps sending acct-interim updates, so this is an  
>> indication that chilli knows the session is active
>> - chilli closes the session correctly after the affected users give  
>> up
>> - chilli does not send any radius requests when it keeps redirecting
>> - there must be something which triggers this behaviour
>>
>> A few days ago I was at a location and by chance a user was having  
>> this problem. So I sat next to him and tried it myself - no matter  
>> what I did, chilli redirected me. After this I stopped chilli and  
>> started it in debug mode. And guess what: The problem did not  
>> occur. After I left the user stayed for quite a long time. He  
>> logged on and was logged off (timeout), but this issue did not  
>> happen again.
>>
>> We have reason to believe what it does not happen with the current  
>> 1.0.11 release.
>>
>> Questions: did anybody use chilli SVN 155 or newer out on the  
>> field?  Are there any ideas what could trigger this behavior? How  
>> can we help to gather more information? Is there a special debug  
>> mode to watch closer why chilli starts to redirect?
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>> Hi David,
>>>
>>> I just returned to my office and checked the logs of this  
>>> location. Funny: the same user is still there and he opened new  
>>> sessions and it seems the problem did not occur so far. This  
>>> leaves me even more clueless.
>>>
>>> Could a miscommunication between chilli and the radius server  
>>> cause such a behaviour? It is strange because if it occurs for a  
>>> few minutes everything looks fine, and then suddenly the effect  
>>> starts. The start of the session means chilli got a green light  
>>> from Radius. Maybe immediatly if the communication is somehow not  
>>> successful immediately after chilli starts to think after a few  
>>> minutes that the session is actually not ok? I ask because  
>>> sometimes it seems that chilli is not getting radius replies,  
>>> therefore keeps retransmitting. This does not happen very often,  
>>> but it happens.
>>>
>>> I am kind of desperate because I saw it with my own eyes but after  
>>> restarting chilli I could not reproduce it today :(
>>>
>>> Cheers,
>>> lc
>>>
>>> Am 23.04.2008 um 17:13 schrieb lc:
>>>
>>>>
>>>> Hi David,
>>>>
>>>> Today I spent a few hours at one of those locations and  
>>>> unfortunately the redirection problem popped up again!
>>>>
>>>> The user logged in and worked for a few minutes (gmail). Suddenly  
>>>> chilli started redirecting him to the uam-page which was  
>>>> displayed with res=already. I tried it - no matter which URL I  
>>>> entered, I ended up there.
>>>>
>>>> The guy had Windows Vista and IE. After this I killed chilli and  
>>>> restared it in debug mode - this time unfortunately I could not  
>>>> reproduce it. However it was defenitly the same behaviour as with  
>>>> the older SVN (I reported the issue to the mailing list).
>>>>
>>>> I will revert one location back to 1.0.11. For the other  
>>>> location: how can I start chilli in Debug mode without getting  
>>>> the leaky bucket messages? What can I do to help finding the issue?
>>>>
>>>> I keep wondering what could cause chilli to act this way? Why  
>>>> would it suddenly think the session is not yet open?
>>>>
>>>> Cheers,
>>>> lc
>>>>
>>>> Am 22.04.2008 um 14:34 schrieb lc:
>>>>
>>>>> Hi David,
>>>>>
>>>>> finally I managed to put SVN 165 out on two heavy-use locations.  
>>>>> Will keep you updated on the results!
>>>>>
>>>>> Cheers,
>>>>> lc
>>>>>
>>>>> Am 18.04.2008 um 15:53 schrieb David Bird:
>>>>>
>>>>>> Thanks for that... good to hear there are no (or little)  
>>>>>> problems in the field with 1.0.11. I believe gmayer isn't  
>>>>>> getting his RADIUS responses (if your following the mailing  
>>>>>> list) and chilli is retransmitting, as expected.
>>>>>>
>>>>>> cheers,
>>>>>> david
>>>>>>
>>>>>> On Apr 18, 2008, at 3:46 PM, lc wrote:
>>>>>>
>>>>>>> Hi David,
>>>>>>>
>>>>>>> I tested it only for 5 Mins to check whether the DNS bug has  
>>>>>>> gone (and it has - thanks a lot!!!!). But I did't do anything  
>>>>>>> more with it.
>>>>>>>
>>>>>>> I read the issues in the Mailing list and I want to test the  
>>>>>>> latest SVN against it. Actually I was thinking to put it on at  
>>>>>>> a few live systems tonight.
>>>>>>> What worries me a bit is the other effect I had with some  
>>>>>>> older SVN (the Windows Vista issue - redirection although  
>>>>>>> session was active). I tried to get hold of those Vista  
>>>>>>> machines but was unlucky: one got stolen and the other one was  
>>>>>>> sold by the owner. So I could not reproduce it on my own.
>>>>>>>
>>>>>>> So far I run the 1.0.11 release out there. I see some error  
>>>>>>> messages which are reported by the Radius Server but I have  
>>>>>>> not had the time to look further into it.
>>>>>>>
>>>>>>> Early next week I will give you an update.
>>>>>>>
>>>>>>> Cheers,
>>>>>>> lc
>>>>>>>
>>>>>>> Am 18.04.2008 um 15:33 schrieb David Bird:
>>>>>>>
>>>>>>>> Are you having issues with it?
>>>>>>>>
>>>>>>>> cheers,
>>>>>>>> David
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: chilli-unsubscribe at coova.org
>> For additional commands, e-mail: chilli-help at coova.org
>> Wiki: http://coova.org/wiki/index.php/CoovaChilli
>> Forum: http://coova.org/phpBB3/viewforum.php?f=4
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: chilli-unsubscribe at coova.org
> For additional commands, e-mail: chilli-help at coova.org
> Wiki: http://coova.org/wiki/index.php/CoovaChilli
> Forum: http://coova.org/phpBB3/viewforum.php?f=4
>

More information about the Chilli mailing list