Vouchers getting Expired before remaining Time

wazim4u

I can confirm System time is correct there is no issue with it.

secondly its Voucher so i cannot see any option under Diagnostics--->Authentication to test voucher but local DB with username and password. I instead tested with Status--->Captive Portal ----> Test Vouchers and it showed expired.

While creating vouchers ( 1 Month " 43200 Minutes ) when person activate the voucher remaining time shows correctly

voucher active.jpg

free4

Hello @wazim4u ,

That's strange...
one question, could you open the file /var/db/voucher_{$cpzone}_active_{$roll}.db & check what's inside?

The format of this file is {voucher_number},{timestamp_of_activation_time},{allowed_time_in_minutes}.

Could you specifically check :

For "in use vouchers", do the allowed time in minutes & the activation timestamp correspond to the reality ?
Is there any expired voucher still inside? (It should not be the case, but just in case, could you check?)

Here is (in simplified version, the exact code can be found here) how the voucher expiration is performed in pfSense :

// This code is executed automatically every minute
// and manually for some rare events (pfSense shudown, submit on the voucher edit page of the GUI, HA Sync between 2 pfSense, etc...)

$roll = '5'; // The voucher roll
$cpzone = 'myCpZone'; // The Captive Portal zone

$file = fopen("/var/db/voucher_{$cpzone}_active_{$roll}.db", "r");
while (!feof($file)) {
	$line = trim(fgets($file));
	list($voucher, $timestamp, $minutes) = explode(",", $line); // voucher,timestamp,allowed time
	if ((($timestamp + (60*$minutes)) - time()) =< 0) { // (The maximum int on PHP is 9223372036854775807, which mean an integer overflow is not possible here)
			$expired = True;
	}
}

That's why I see two possibilities :

The timestamp / allowed time is not correct in the file
or the time() function of PHP does not give correct results

Honestly, my bet on this issue is that the allowed time in the file are somehow not correct.
Could you confirm me that ?

wazim4u

@free4
Here is the output of active voucher roll as requested. roll no.1 having only 6 active vouchers and output of file is given below

cat /var/db/voucher_platinum_active_1.db

793338274,1616951824,14400
474432784,1617051821,14400
82728594,1617125331,14400
1434727374,1617193376,14400
723599534,1617209155,14400
9883922256,1617692216,14400

I am unable to understand timestamp format but voucher and given time is fine. all expired voucher roll shows nothing it means no active voucher remain in roll.

as i mentioned almost 2500 active users few of them getting this issue. yesterday active voucher we disconnected because mobile was broken and as we entered this code in other device it shows expired even 6 days still to go we seen while disconnecting.

free4

@wazim4u

The timestamp (also called epoch) is the number of seconds that have elapsed since January 1, 1970 at midnight UTC.

You can convert a timestamp to date on website like https://www.epochconverter.com/

I'm not seeing anything wrong in the 6 active vouchers...

refugeesonline

Hello,

I am having a similar strange problem: We operate around 170 sites with a wide variety of HW and PFSense releases. The following problem appears ONLY for one site with stable version of 2.5.1 on APU1D4 hardware: A voucher roll of 50.000 vouchers has been created, validity is 43.200 minutes = 30 days. The system has gone live on April 7. So far around 80 voucher have been activated over the course of April. When I look into the Captive Portal now it says 272 vouchers already expired. How can that be? I am getting complaints from users that their vouchers expired earlier that 30 days. And they are right: Today is May 1st, the system has gone live on April 6. This is certainly less than 30 days ... Any idea? We are operating the same config (50.000 vouchers in the local db) in many sites with release 2.4 oder even 2.3.x without any problem.

Any idea is appreciated. My customer hotline folks are somewhat annoyed...

BR,

Volker

free4

@refugeesonline hi,

Same reply as before : could you open the file /var/db/voucher_{$cpzone}_active_{$roll}.db & check what's inside?

The format of this file is {voucher_number},{timestamp_of_activation_time},{allowed_time_in_minutes}.

Could you specifically check :

For "in use vouchers", do the allowed time in minutes & the activation timestamp correspond to the reality ?
Is there any expired voucher still inside? (It should not be the case, but just in case, could you check?)
Is the time on the pfSense appliance is correct?

Also, are you in an "High Avaliability" configuration (two pfSense appliances, one master & one backup) ? or that's not the case?

refugeesonline

Hi!

I checked the file and inserted my answers to your questions below:

For "in use vouchers", do the allowed time in minutes & the activation timestamp correspond to the reality ?

Volker: The allowed time in minutes is fine (43200), however, the activation timestamp is not. It seems all vouchers have been activated between May 1st and May 2nd. This is weired and nonsense.

Is there any expired voucher still inside? (It should not be the case, but just in case, could you check?)

Volker: No, none of the expired voucher is inside this file.

Is the time on the pfSense appliance is correct?

Volker: Yes, it is.

Also, are you in an "High Avaliability" configuration (two pfSense appliances, one master & one backup) ? or that's not the case?

Volker: No high availabilty config.

I tried to find the differences between the appliances working fine (ie pfSense 2.3.5_2) and the APU1D4 running 2.5.1. The older versions have all created voucher rolls represented by files in /var/db/voucher_zone_xyz_active_roll#.db and /var/db/voucher_zone_xyz_used_roll#.db. The one running 2.5.1. only has the file corresponding to the voucher roll in use.

Best,

Volker

wazim4u

2.4 & 2.5 Development have no issue. only facing this issue with 2.5 Stable & now 2.5.1 Stable. everyday people coming with expired voucher complaints. One month voucher is getting expire in few days ( not specific time )

another issue there is no reporting for expired vouchers only from LOGS you can trace which is not convenient for clients.

refugeesonline

Hi!

I tried to investigate this a little deeper. Here is what I suspect: If voucher rolls are created running 2.4.x the upgrade to 2.5.x deletes the db-files in /var/db. On the first login of an existing voucher, the respective db-files will be re-created, but with wrong activation time stamps. (No evidence. just a thought!)

What helps:

Delete all voucher rolls. Upgrade to 2.5.x. Create all voucher rolls again. Check if all corresponding db-files are present in /var/db.

However, there is a BIG disadvantage: All voucher history gets lost, especially vouchers which were expired will be valid again unless you manually expire them!!!

BR,

Volker

Gertjan

@refugeesonline

You might be right
I can't / didn't test an upgrade, as I'm on 2.5.1 already. I'm not using voucher neither.
DB files ate filled with the time info, when vouchers are used or activated.

But :

With the option set, DB files are backed up ....

wazim4u

I have Fresh Install and everything created from Scratch. I have two site still running development version of 2.5 and there is no issue

I planned to upgrade them to 2.5 stable but facing problem with vouchers early expiring in two new deployments ( Built on FEB-2021 ). so Postponed it.

There is some kind of bug unable to trace yet.

viktor_g

@wazim4u said in Vouchers getting Expired before remaining Time:

I have Fresh Install and everything created from Scratch. I have two site still running development version of 2.5 and there is no issue

What is the actual snapshot date?
Could you provide more information and create a bugreport?
https://docs.netgate.com/pfsense/en/latest/development/bug-reports.html

May be related to https://redmine.pfsense.org/issues/97

wazim4u

@viktor_g

Voucher system working perfectly on this snapshot

2.5.0.a.20210107.2142 ( Development )

up to 2500 captive portal users renew monthly basis and there is not a single issue reported about voucher's early expiry.

refugeesonline

Aaargghhh. It happended again. Even the way I though will work (delete vouchers, upgrade to 2.5.1, create vouchers again) is failing. Around 280 vouchers expired way before the end of its validity period. And we have a lot of happy customers on our hotline ... :-(

The system was rebooted due to a power outage and this reboot may have caused the corruption of the voucher db. Just a thought ...

I am going to roll back all the respective sites to 2.4.5 now. This bug is severe - at least if vouchers are being used.

Regards,

Volker

viktor_g

Please create a bugreport:
https://docs.netgate.com/pfsense/en/latest/development/bug-reports.html

refugeesonline

Done!

https://redmine.pfsense.org/issues/11894

serbus

Hello!

Are you using RAM disks?

John

viktor_g

@refugeesonline said in Vouchers getting Expired before remaining Time:

Aaargghhh. It happended again. Even the way I though will work (delete vouchers, upgrade to 2.5.1, create vouchers again) is failing. Around 280 vouchers expired way before the end of its validity period. And we have a lot of happy customers on our hotline ... :-(

The system was rebooted due to a power outage and this reboot may have caused the corruption of the voucher db. Just a thought ...

I am going to roll back all the respective sites to 2.4.5 now. This bug is severe - at least if vouchers are being used.

Regards,

Volker

What is your complete configuration?
Are you using RAM disks or Captive Portal HA sync?
Please provide more info

wazim4u

I can prove now that there is serious bug in system . given below are details for two vouchers showing expired today.

Voucher : 976522494 ( Expired after 2 days )

May 6 01:14:49	logportalauth	14356	Zone: smg_camp - FAILURE: 976522494, 6c:c7:ec:4b:11:c3, 172.17.228.225, voucher expired
May 6 01:14:49	logportalauth	14356	Zone: smg_camp - 976522494 (6/50) already used and expired

May  4 04:28:01 smg logportalauth[24061]: Zone: smg_camp - Voucher login good for 516420 min.: 976522494, 6c:c7:ec:4b:11:c3, 172.17.228.225

Voucher : 7929393872 ( Expired after 6 days )

May 6 08:04:05	logportalauth	61082	Zone: smg_camp - FAILURE: 7929393872, 2e:64:bd:c8:d3:4f, 172.17.120.210, voucher expired
May 6 08:04:05	logportalauth	61082	Zone: smg_camp - 7929393872 (6/18) already used and expired

Apr 29 12:03:47 smg logportalauth[46095]: Zone: smg_camp - Voucher login good for 517452 min.: 7929393872, 52:62:b0:80:78:00, 172.17.230.152

refugeesonline

@serbus
Yes, /tmp and /var are RAM disks