fix(radius): allow OpenVPN TLS re-authentication for existing sessions

- exclude the current Acct-Session-Id from simultaneous-use checks
- prevent TLS renegotiation from being rejected as a second login
- keep Simultaneous-Use limited to fresh concurrent OpenVPN connections
- preserve the existing RADIUS accounting session during TLS re-authentication

files/mods-config/postgres-queries.conf

@@ -237,6 +237,7 @@ simul_count_query = "\
         LEFT OUTER JOIN nasreload n USING (NASIPAddress) \
         WHERE UserName='%{SQL-User-Name}' \
         AND AcctStopTime IS NULL \
+        AND AcctSessionId != '%{Acct-Session-Id}' \
         AND (a.AcctStartTime > n.ReloadTime OR n.ReloadTime IS NULL)"
 
 simul_verify_query = "\
@@ -246,6 +247,7 @@ simul_verify_query = "\
         LEFT OUTER JOIN nasreload n USING (nasipaddress) \
         WHERE UserName='%{SQL-User-Name}' \
         AND AcctStopTime IS NULL \
+        AND AcctSessionId != '%{Acct-Session-Id}' \
         AND (a.AcctStartTime > n.reloadtime OR n.reloadtime IS NULL)"
 
 #######################################################################