PacketFence - Support - ISSUES

0001361: Emptying a configuration parameter doesn't work from web admin and pfcmd

For example:

Trying to get rid of guest self registration from the web admin results in:

Unable to change guests_self_registration_modes from 'sms,email' to ''

Trying from the command line (pfcmd config set ...) also fails. Actually the problem resides there.

0001376: Administrative UI pages

Some typos in the administrative ui were corrected but the page title and page file name cannot be modified due to some major changes required.

0001375: Activation link appears to be valid even if node did not confirm within the proper time period

It appears that the activation link sent to self-registering node is still valid even if the node did not confirm within the determined time frame (default 10min)

Registering at 13:49
Unreg by pfmon at 13:59
...
Feb 03 14:13:18 email_activation.cgi(0) INFO: Activation code sent to email xxxx successfully verified! Node authorized: xxx (pf::email_activation::validate_code)

0001374: Inline mode should work as VLAN mode regarding DNS blackholing

Inline mode, as currently implemented, can be improved regarding DNS blackholing.

Right now you choose in configuration, either:
a) you use the portal in an IP-based way, and you provide a valid external DNS in
b) you use the portal with DNS but you might provide a valid internal DNS and add an FQDN to PacketFence's IP inline interface

It's more trouble to configure but also it causes problems because IP-based can't use an SSL-based portal and because of that configurable difference we have two different portal apache config.

Inecting a DNAT rule to refer to the local DNS on an inline network when the user is unreg (or in violation) would fix that problem: when DNAT'ed DNS blackholing makes the redirection dance happening again otherwise if not DNAT'ed DNS goes to the real DNS which should work.

Potential problem: named might not like to answer to the DNAT request or the client might refuse the reply from another IP (remember this is UDP.. thus rewriting source IP might be in order).

Once fixed don't forget to:
- drop the parameter regarding ip or dns based portal redirect from pf.conf
- drop apache config duplication
- update documentation accordingly

0001352: Misleading error message if missing management type

Instead of saying that there is a typo or that the management type is missing from pf.conf, we have this misleading error message :

Can't call method "tag" on an undefined value at

/usr/local/pf/lib/pf/pfcmd/checkup.pm line 169 (0000001)

(F) You used the syntax of a method call, but the slot filled by the

object reference or package name contains an undefined value. Something

like this will reproduce the error:

$BADREF = undef;

process $BADREF 1,2,3;

$BADREF->process(1,2,3);

Uncaught exception from user code:

Can't call method "tag" on an undefined value at /usr/local/pf/lib/pf/pfcmd/checkup.pm line 169.

at /usr/local/pf/lib/pf/pfcmd/checkup.pm line 169

pf::pfcmd::checkup::interfaces() called at /usr/local/pf/lib/pf/pfcmd/checkup.pm line 87

pf::pfcmd::checkup::sanity_check('httpd', 'snmptrapd', 'pfsetvlan', 'pfdhcplistener', 'pfmon') called at /usr/local/pf/bin/pfcmd line 1357

main::checkup('httpd', 'snmptrapd', 'pfsetvlan', 'pfdhcplistener', 'pfmon') called at /usr/local/pf/bin/pfcmd line 1280

main::service() called at /usr/local/pf/bin/pfcmd line 201

main::__ANON__() called at /usr/local/pf/bin/pfcmd line 218

0001373: Non-Alphanumeric chars will make Disconnect-Message Fail

Seeing on a client server, the shared secret was containing the following chars:
- @ $

It made the RADIUS dynauth unusable, PF was complaining about a bad secret, when it was working fine using radclient.

0001363: DHCPd slow startup

Seen in inline mode when there's huge lease files (a lot of devices).
PacketFence can take up to 3 minutes to start due to the slow start up of dhcpd.

0001307: Redirection after registration is not working well

As seen on site with a client lately, more browsers appears to have issues with the Javascript redirection after the registration :
- IE8 - that one we already knew
- IE9 - We are receiving a 403 after the redirection
- Safari (Lion) - We are not redirected
- BlackBerry Browser - We are not redirected

As a work-around you can disable the broken javascript-based redirection by adding the following in conf/pf.conf:

[captive_portal]
network_detection=disabled

0001250: pfcmd_vlan getSwitch location

Small patch below

Allowing pfcmd_vlan to show the SNMP location string

Think its handy to get it in more mainstream pf. Probably needs to be moved in pfcmd since ifIndex is not really needed

/usr/local/pf/bin/pfcmd_vlan -getSwitchLocation -ifIndex 6 -switch 192.168.10.10

Amsterdam; Nice Road; Building; Room

With this, the Ip shown for the switch, can now also be parsed into a more human readable form

0001372: unable to parse DHCP packet: Invalid DHCP Option 53 (Message Type)

here's what's logged:

Jan 27 14:41:39 pfdhcplistener(6609) WARN: Unable to parse DHCP packet: Invalid DHCP Option 53 (Mess
age Type) received from 0000f0ab96ea00000000000000000000 at /usr/local/pf/lib/pf/util/dhcp.pm line 1
69. (main::__ANON__)

0001369: thread crash with floating network devices with VoIP through SSH transport

Net::Appliance::Session doesn't seem thread-safe.

Jan 24 14:37:55 pfsetvlan(7) ERROR: Error connecting to ... using SSH. Error: Input/output error (pf
::SNMP::Cisco::Catalyst_2950::setPortSecurityMaxSecureMacAddrVlanAccessByIfIndex)
thread failed to start: Must connect before you can begin_privileged (0000001)
    (W threads)(S) The entry point function of threads->create() failed for some reason.

trying a small PoC of forking the call in a separate process

0001371: changing VLANs on trunk ports on the Cisco Catalyst product line might fail if through SSH

There are thread safety issues with Net::Appliance::Session with SSH.

_setVlan calls clearMacAddressTable() on trunk ports and clearMacAddressTable relies on the CLI through N::A::S.

0001370: Net::Appliance::Session privilege detection broken resulting into a thread crash

In setPortSecurityMaxSecureMacAddrVlanAccessByIfIndex (from lib/pf/SNMP/Cisco/Catalyst_2950.pm) the privilege detection doesn't work when a user gets in with an already privileged user (level 15).

thread failed to start: Failed to get first privileged prompt at
    /usr/local/pf/lib/pf/SNMP/Cisco/Catalyst_2950.pm line 678 (0000001)
    (W threads)(S) The entry point function of threads->create() failed for some reason.

0000900: we should detect if we are enabled everytime it's relevant for Net::Appliance::Session

right now, there is privilege_mode code in comments instead we should use in_privileged_mode() like I did in ISR_1800.pm:

    # are we in enabled mode?
    if (!$session->in_privileged_mode()) {
    
        # let's try to enable
        if (!$session->enable($this->{_cliEnablePwd})) {
            $logger->error("Cannot get into privileged mode on ".$this->{'ip'}.
                           ". Are you sure you provided enable password in configuration?"
);
            $session->close();
            return %macBridgePortHash;
        }
    }

0001368: passthrough doesn't work with domains without an ending slash (ex: http://www.google.co.uk) [^]

URL parser fails on them so no proper proxy statement are injected in apache config.

0001367: Javascript error using IE 8

When hitting the portal using IE 8, we see a javascript error. The portal still works tho :

Message: Object expected
Line: 22
Char: 1
Code: 0

0001354: snmp V3 multiple switch one username

generating only one user line in /usr/local/pf/var/snmptrapd.con

Several switches, each with different EngineId but same user ( pfv3read : read ;
pfv3write : write; pfv3read: trap)

The file /usr/local/pf/var/conf/snmptrapd.conf contains only two line of the
type“creatuser”:

createUser -e 0017837EEA21 pfv3write MD5 mypasswd AES mypasswd

createUser -e 001794094680 pfv3read MD5 mypasswd AES mypasswd

0001353: configurator not finding interfaces

The function get_networkinfos actualy parses the output of “/sbin/ifconfig –a”

Trying to match for “inet addr” and “mask” (to make the mater short)

But our system is localized (in French ) so addr -à adr and mask -> masque …

It gave us an empty networks.conf that we had to populate by hand…

Without that, rerunning configurator.pl gave the error “Invalid existing networks configuration file :” at ./configurator.pl line 89

Solution:

Line 465 we made a modification …

If ( ( /inet addr:((?:\d{1,3}\.){3}\d{1,3}).+Mask:((?:\d{1,3}\.){3}\d{1,3})/ ) || ( /inet adr:((?:\d{1,3}\.){3}\d{1,3}).+Masque:((?:\d{1,3}\.){3}\d{1,3})/ ) ) {

So now it detects the interfaces ….

Question:

1) why not using /sbin/ip (from iproute package)

2) the script include the Net::Interface module why not using this ?

0001366: Captive portal - self registration by email - access granted

When activating an account by email, the "access granted" page is missing the IP and MAC address in the footer (see attached screenshot).

0001365: Captive portal - email activation - Name the network by its catagorie

When using the self registration meganism, per default the category guest is used. But if in the config another category is used. It would be nicer to name the network instead off guest, the actual name.
So in email_activation.cgi send the catagory to this function:
pf::web::guest::generate_activation_confirmation_page

then the template and i18n message can be altered automatically

0001364: our Config::IniFiles usage is not bullet proof

See 0000960: "Using ->ReWriteConfig instead of ->WriteConfig in pfcmd could've fixed it however I just read that both don't perform locking or transaction control so it would be worse if we read an incompletely written file then modify it and write it back."

See https://metacpan.org/module/Config::IniFiles#BUGS [^]

Because Config::IniFiles performs no locking, the following would be possible: someone makes a change between the time pfcmd reads and write another change. The original change would be lost.

Because pfcmd reads, performs the change then writes. Chances are probably very low that someone ever got bitten by this.

0000960: pfcmd changes the config files ownership when called at command line

When I edit a switch using:
./pfcmd 'switchconfig edit 1.2.3.4 vlans="2,3"'

pfcmd changes switches.conf ownership from pf:pf to root:root.

Same behaviour with floating_network_devices.conf

0000963: Challenge the assumption that pfcmd must run as root setuid

A setuid root binary with so much code is a "bad thing". Lets try to move to a point where we don't need the setuid root anymore.

0000823: Nessus Scan page detection

Once the web scan works again,
- remove the behavior where the scan tab is only shown if we can "use Nessus::ScanLite"
- update the admin guide (no more deps, etc.)

0001359: Graphs presentation issue

On some occasion, graphs are not rendering properly. I believe this is happening when we have not a lot of data in PF.

See the screenshot for an example. In this SS, the data line goes below the axis to reach the proper number.