Conversation
…t group
simul_verify_query filters radacct on %{SQL-Group}, which is empty on an
Access-Request, so the verify step finds no live session and Simultaneous-Use
never rejects: every extra login is accepted even with the sessions in radacct.
The count query beside it already uses %{SQL-User-Name}, and so does the stock
FreeRADIUS sqlite dialect. Use the same here.
Measured on 26.7.3 with the captive portal as the client, radiusd -X: with two
open rows and Simultaneous-Use := 2, before this change Access-Accept; after it,
"Multiple logins (max 2)" and Access-Reject.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important notices
Before you submit a pull request, we ask you kindly to acknowledge the following:
If AI was used, please disclose:
radiusd -X, proposed the one-line change, and drafted this text. The change and every measurement below were reviewed and reproduced by the author.Describe the problem
simul_verify_queryinnet/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/queries.conffiltersradaccton%{${group_attribute}}, which renders as%{SQL-Group}. That attribute is empty on an Access-Request, so the verify step finds no live session andSimultaneous-Usenever rejects: every extra login is accepted even when the sessions are sitting inradacctwith no stop time. The count query directly above it already uses%{SQL-User-Name}, and so does the stock FreeRADIUS 3.2 sqlite dialect, so the count says N and the verify says 0, and the verify wins.Measured on OPNsense 26.7.3_11, plugin 1.10.2, the captive portal as the RADIUS client over 127.0.0.1, sqlite store and the session limit both on, a user with
Simultaneous-Use := 2, two open rows inradacct,radiusd -Xrunning: the verify query expands toWHERE username = ''and the request gets Access-Accept.Describe the proposed solution
One line: use
%{SQL-User-Name}insimul_verify_query, as the count query and the stock dialect do. After the change the same request expands toWHERE username = '<the user>', returns both rows, and getsMultiple logins (max 2)and Access-Reject. Confirmed end to end through the captive portal from three real devices: the first two sign in, the third is refused before it connects. Template only; no version bump.Related issue
None opened; the fix is a single substitution.