{"action":"created","issue":{"url":"https://api.github.com/repos/inverse-inc/packetfence/issues/510","labels_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/510/labels{/name}","comments_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/510/comments","events_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/510/events","html_url":"https://github.com/inverse-inc/packetfence/issues/510","id":71337987,"number":510,"title":"Issue with inline network detection/redirect in 5.0.1","user":{"login":"sinusoidal","id":4446290,"avatar_url":"https://avatars.githubusercontent.com/u/4446290?v=3","gravatar_id":"","url":"https://api.github.com/users/sinusoidal","html_url":"https://github.com/sinusoidal","followers_url":"https://api.github.com/users/sinusoidal/followers","following_url":"https://api.github.com/users/sinusoidal/following{/other_user}","gists_url":"https://api.github.com/users/sinusoidal/gists{/gist_id}","starred_url":"https://api.github.com/users/sinusoidal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sinusoidal/subscriptions","organizations_url":"https://api.github.com/users/sinusoidal/orgs","repos_url":"https://api.github.com/users/sinusoidal/repos","events_url":"https://api.github.com/users/sinusoidal/events{/privacy}","received_events_url":"https://api.github.com/users/sinusoidal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-04-27T16:35:34Z","updated_at":"2015-04-28T18:35:36Z","closed_at":null,"body":"I've had a go at tracing this issue, but not quite got to the bottom of it.  This is an inline captive portal with no dot1x (just a basic captive portal but with no nat).\r\n\r\nWhen I've got always_use_redirecturl=disabled in profiles.conf, after about 10 seconds of waiting on the 'timer bar' screen during activation, my client reaches the:\r\n\r\n\"Your network should be enabled within a minute or two. If it is not reboot your computer\"\r\n\r\n...rather than redirecting to the requested page, which means it's reached the 'unknownState' function in CaptivePortal.pm. Looking at the logs, there is also a line referencing 'redir.cgi' which as far as I know, is no longer used?\r\n`re-evaluating access (redir.cgi called)` \r\n.. though I don't think that's related.\r\n\r\nSee log (anonymised):\r\n\r\n`\r\nApr 27 17:31:11 httpd.portal(32126) INFO: [00:00:00:78:b8:5c] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 17:31:11 httpd.portal(32130) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:11 httpd.portal(32130) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:12 httpd.portal(32126) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:12 httpd.portal(32126) WARN: Unable to perform a Fingerbank lookup for device with MAC address '00:00:00:78:b8:5c' (pf::fingerbank::process)\r\nApr 27 17:31:12 httpd.portal(32126) INFO: [00:00:00:78:b8:5c] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 17:31:14 httpd.portal(32126) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:14 httpd.portal(32126) WARN: Unable to perform a Fingerbank lookup for device with MAC address '00:00:00:78:b8:5c' (pf::fingerbank::process)\r\nApr 27 17:31:14 httpd.portal(32126) INFO: [00:00:00:78:b8:5c] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 17:31:18 httpd.portal(32139) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:18 httpd.portal(32139) WARN: Unable to perform a Fingerbank lookup for device with MAC address '00:00:00:78:b8:5c' (pf::fingerbank::process)\r\nApr 27 17:31:18 httpd.portal(32139) INFO: [00:00:00:78:b8:5c] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 17:31:20 httpd.portal(32141) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:20 httpd.portal(32141) INFO: Password validation failed for 24114102323418: passwords don't match (pf::password::validate_password)\r\nApr 27 17:31:20 httpd.portal(32141) ERROR: unable to read password file '/usr/local/pf/conf/admin.conf' (pf::Authentication::Source::HtpasswdSource::authenticate)\r\nApr 27 17:31:26 httpd.portal(32083) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:26 httpd.portal(32083) WARN: Unable to perform a Fingerbank lookup for device with MAC address '00:00:00:78:b8:5c' (pf::fingerbank::process)\r\nApr 27 17:31:26 httpd.portal(32083) INFO: [00:00:00:78:b8:5c] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 17:31:29 httpd.portal(31963) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:29 httpd.portal(31963) WARN: Unable to perform a Fingerbank lookup for device with MAC address '00:00:00:78:b8:5c' (pf::fingerbank::process)\r\nApr 27 17:31:29 httpd.portal(31963) INFO: [00:00:00:78:b8:5c] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 17:31:34 httpd.portal(32142) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.portal(32142) INFO: Authentication successful for 24114102417673 in source local (SQL) (pf::authentication::authenticate)\r\nApr 27 17:31:34 httpd.portal(32142) WARN: Can't find provisioner for 00:00:00:78:b8:5c since we don't have it's OS (pf::Portal::Profile::findProvisioner)\r\nApr 27 17:31:34 httpd.portal(32142) INFO: creating person 24114102417673 because it doesn't exist (pf::node::node_register)\r\nApr 27 17:31:34 httpd.portal(32142) INFO: person 24114102417673 added (pf::person::person_add)\r\nApr 27 17:31:34 httpd.portal(32142) INFO: Unable to locate PID in LDAP '24114102417673' (pf::lookup::person::lookup_person)\r\nApr 27 17:31:34 httpd.portal(32142) WARN: Can't find provisioner for 00:00:00:78:b8:5c since we don't have it's OS (pf::Portal::Profile::findProvisioner)\r\nApr 27 17:31:34 httpd.portal(32142) ERROR: WARNING ! Unknown switch(es) 172.28.64.1 (pf::SwitchFactory::instantiate)\r\nApr 27 17:31:34 httpd.portal(32142) INFO: [00:00:00:78:b8:5c] re-evaluating access (manage_register called) (pf::enforcement::reevaluate_access)\r\nApr 27 17:31:34 httpd.portal(32142) INFO: Instantiate a new iptables modification method. pf::ipset (pf::inline::get_technique)\r\nApr 27 17:31:34 httpd.portal(32142) INFO: Matched MAC '00:00:00:78:b8:5c' to IP address '172.28.64.13' using OMAPI (pf::iplog::mac2ip)\r\nApr 27 17:31:34 httpd.webservices(31797) INFO: Instantiate a new iptables modification method. pf::ipset (pf::inline::get_technique)\r\nApr 27 17:31:34 httpd.portal(32142) WARN: Can't find provisioner for 00:00:00:78:b8:5c since we don't have it's OS (pf::Portal::Profile::findProvisioner)\r\nApr 27 17:31:34 httpd.webservices(31797) INFO: Matched MAC '00:00:00:78:b8:5c' to IP address '172.28.64.13' using OMAPI (pf::iplog::mac2ip)\r\nApr 27 17:31:34 httpd.webservices(31797) INFO: Matched MAC '00:00:00:78:b8:5c' to IP address '172.28.64.13' using OMAPI (pf::iplog::mac2ip)\r\nApr 27 17:31:34 httpd.webservices(31797) INFO: Node 00:00:00:78:b8:5c registered and allowed to pass the Firewall (pf::firewallsso::FortiGate::action)\r\nApr 27 17:31:34 httpd.webservices(31797) INFO: [00:00:00:78:b8:5c] stated changed, adapting firewall rules for proper enforcement (pf::inline::performInlineEnforcement)\r\nApr 27 17:31:34 httpd.portal(32125) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.webservices(31797) INFO: Flushed connections for 172.28.64.13. (pf::ipset::iptables_unmark_node)\r\nApr 27 17:31:34 httpd.webservices(31797) INFO: Matched MAC '00:00:00:78:b8:5c' to IP address '172.28.64.13' using OMAPI (pf::iplog::mac2ip)\r\nApr 27 17:31:34 httpd.portal(32139) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.portal(32125) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.portal(32141) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.portal(32147) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.portal(32145) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.portal(32147) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.portal(32147) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:34 httpd.portal(32147) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:36 httpd.portal(32148) INFO: Matched IP '172.28.64.12' to MAC address '00:1f:3b:43:54:f7' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:36 httpd.portal(32148) INFO: [00:1f:3b:43:54:f7] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 17:31:36 httpd.portal(32130) INFO: Matched IP '172.28.64.12' to MAC address '00:1f:3b:43:54:f7' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:36 httpd.portal(32130) INFO: [00:1f:3b:43:54:f7] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 17:31:49 httpd.portal(32174) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 17:31:49 httpd.portal(32174) WARN: Unable to perform a Fingerbank lookup for device with MAC address '00:00:00:78:b8:5c' (pf::fingerbank::process)\r\nApr 27 17:31:49 httpd.portal(32174) INFO: [00:00:00:78:b8:5c] shouldn't reach here. Calling access re-evaluation. Make sure your network device configuration is correct. (captiveportal::PacketFence::Controller::CaptivePortal::unknownState)\r\nApr 27 17:31:49 httpd.portal(32174) ERROR: WARNING ! Unknown switch(es) 172.28.64.1 (pf::SwitchFactory::instantiate)\r\nApr 27 17:31:49 httpd.portal(32174) INFO: [00:00:00:78:b8:5c] re-evaluating access (redir.cgi called) (pf::enforcement::reevaluate_access)\r\nApr 27 17:31:49 httpd.portal(32174) INFO: Instantiate a new iptables modification method. pf::ipset (pf::inline::get_technique)\r\nApr 27 17:31:49 httpd.portal(32174) INFO: Matched MAC '00:00:00:78:b8:5c' to IP address '172.28.64.13' using OMAPI (pf::iplog::mac2ip)\r\nApr 27 17:31:50 httpd.portal(32174) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\n`\r\n\r\nIf however I set always_use_redirecturl=enabled, the redirect works as expected and I get forwarded to the correct page:\r\n\r\n`\r\nApr 27 16:55:37 httpd.portal(31412) WARN: Unable to perform a Fingerbank lookup for device with MAC address '00:00:00:78:b8:5c' (pf::fingerbank::process)\r\nApr 27 16:55:37 httpd.portal(31412) INFO: [00:00:00:78:b8:5c] redirected to authentication page on default portal (captiveportal::PacketFence::Controller::CaptivePortal::checkIfNeedsToRegister)\r\nApr 27 16:55:45 httpd.portal(31542) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:45 httpd.portal(31542) INFO: Authentication successful for 24114102800514 in source local (SQL) (pf::authentication::authenticate)\r\nApr 27 16:55:45 httpd.portal(31542) WARN: Can't find provisioner for 00:00:00:78:b8:5c since we don't have it's OS (pf::Portal::Profile::findProvisioner)\r\nApr 27 16:55:45 httpd.portal(31542) INFO: creating person 24114102800514 because it doesn't exist (pf::node::node_register)\r\nApr 27 16:55:45 httpd.portal(31542) INFO: person 24114102800514 added (pf::person::person_add)\r\nApr 27 16:55:45 httpd.portal(31542) INFO: Unable to locate PID in LDAP '24114102800514' (pf::lookup::person::lookup_person)\r\nApr 27 16:55:45 httpd.portal(31542) WARN: Can't find provisioner for 00:00:00:78:b8:5c since we don't have it's OS (pf::Portal::Profile::findProvisioner)\r\nApr 27 16:55:45 httpd.portal(31542) ERROR: WARNING ! Unknown switch(es) 172.28.64.1 (pf::SwitchFactory::instantiate)\r\nApr 27 16:55:45 httpd.portal(31542) INFO: [00:00:00:78:b8:5c] re-evaluating access (manage_register called) (pf::enforcement::reevaluate_access)\r\nApr 27 16:55:45 httpd.portal(31542) INFO: Instantiate a new iptables modification method. pf::ipset (pf::inline::get_technique)\r\nApr 27 16:55:45 httpd.portal(31542) INFO: Matched MAC '00:00:00:78:b8:5c' to IP address '172.28.64.13' using OMAPI (pf::iplog::mac2ip)\r\nApr 27 16:55:45 httpd.webservices(31420) INFO: Instantiate a new iptables modification method. pf::ipset (pf::inline::get_technique)\r\nApr 27 16:55:45 httpd.portal(31542) WARN: Can't find provisioner for 00:00:00:78:b8:5c since we don't have it's OS (pf::Portal::Profile::findProvisioner)\r\nApr 27 16:55:45 httpd.webservices(31420) INFO: Matched MAC '00:00:00:78:b8:5c' to IP address '172.28.64.13' using OMAPI (pf::iplog::mac2ip)\r\nApr 27 16:55:45 httpd.webservices(31420) INFO: Node 00:00:00:78:b8:5c registered and allowed to pass the Firewall (pf::firewallsso::FortiGate::action)\r\nApr 27 16:55:45 httpd.webservices(31420) INFO: [00:00:00:78:b8:5c] stated changed, adapting firewall rules for proper enforcement (pf::inline::performInlineEnforcement)\r\nApr 27 16:55:45 httpd.portal(31543) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:45 httpd.webservices(31420) INFO: Matched MAC '00:00:00:78:b8:5c' to IP address '172.28.64.13' using OMAPI (pf::iplog::mac2ip)\r\nApr 27 16:55:45 httpd.portal(31543) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:45 httpd.portal(31400) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:45 httpd.portal(31405) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:45 httpd.portal(31416) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:45 httpd.portal(31405) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:45 httpd.portal(31533) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:45 httpd.portal(31544) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:46 httpd.portal(31533) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:46 httpd.portal(31533) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:55 httpd.portal(31411) INFO: Matched IP '172.28.64.13' to MAC address '00:00:00:78:b8:5c' using OMAPI (pf::iplog::ip2mac)\r\nApr 27 16:55:55 httpd.portal(31411) INFO: [00:00:00:78:b8:5c] Updating node user_agent with useragent: 'Mozilla/5.0 (X11; CrOS x86_64 6457.94.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.114 Safari/537.36' (captiveportal::PacketFence::Controller::CaptivePortal::nodeRecordUserAgent)\r\nApr 27 16:55:55 httpd.portal(31411) INFO: Static User-Agent lookup data initialized (pf::useragent::_init)\r\nApr 27 16:55:56 httpd.portal(31411) WARN: Unable to perform a Fingerbank lookup for device with MAC address '00:00:00:78:b8:5c' (pf::fingerbank::process)\r\nApr 27 16:55:56 httpd.portal(31411) INFO: [00:00:00:78:b8:5c] shouldn't reach here. Calling access re-evaluation. Make sure your network device configuration is correct. (captiveportal::PacketFence::Controller::CaptivePortal::unknownState)\r\nApr 27 16:55:56 httpd.portal(31411) ERROR: WARNING ! Unknown switch(es) 172.28.64.1 (pf::SwitchFactory::instantiate)\r\nApr 27 16:55:56 httpd.portal(31411) INFO: [00:00:00:78:b8:5c] re-evaluating access (redir.cgi called) (pf::enforcement::reevaluate_access)\r\nApr 27 16:55:56 httpd.portal(31411) INFO: Instantiate a new iptables modification method. pf::ipset (pf::inline::get_technique)\r\n`\r\n\r\nAny ideas what could be causing this?  When redirect is disabled, it seems to be dropping right through to 'unknownState'.\r\n\r\nThanks,\r\nRobin.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/inverse-inc/packetfence/issues/comments/97164778","html_url":"https://github.com/inverse-inc/packetfence/issues/510#issuecomment-97164778","issue_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/510","id":97164778,"user":{"login":"sinusoidal","id":4446290,"avatar_url":"https://avatars.githubusercontent.com/u/4446290?v=3","gravatar_id":"","url":"https://api.github.com/users/sinusoidal","html_url":"https://github.com/sinusoidal","followers_url":"https://api.github.com/users/sinusoidal/followers","following_url":"https://api.github.com/users/sinusoidal/following{/other_user}","gists_url":"https://api.github.com/users/sinusoidal/gists{/gist_id}","starred_url":"https://api.github.com/users/sinusoidal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sinusoidal/subscriptions","organizations_url":"https://api.github.com/users/sinusoidal/orgs","repos_url":"https://api.github.com/users/sinusoidal/repos","events_url":"https://api.github.com/users/sinusoidal/events{/privacy}","received_events_url":"https://api.github.com/users/sinusoidal/received_events","type":"User","site_admin":false},"created_at":"2015-04-28T18:35:36Z","updated_at":"2015-04-28T18:35:36Z","body":"I worked around this issue by modifying the line in networkAccessCallback to include a 5 second delay, like it does for Firefox and for IE.  This seems to suggest the problem was being caused by the network detection script attempting to get out before the network has been enabled?\r\n\r\n    // Other browsers, try a direct redirection\r\n    performRedirect.delay(5, destination_url);\r\n}\r\n\r\ninstead of\r\n\r\n\r\n    // Other browsers, try a direct redirection\r\n    performRedirect(destination_url);\r\n\r\n\r\n"}}