test Session-Timeout

- exclude the current Acct-Session-Id from simultaneous-use checks
- prevent TLS renegotiation from being rejected as a second login
- keep Simultaneous-Use limited to fresh concurrent OpenVPN connections
- preserve the existing RADIUS accounting session during TLS re-authentication

files/mods-config/postgres-queries.conf

@@ -237,6 +237,7 @@ simul_count_query = "\
         LEFT OUTER JOIN nasreload n USING (NASIPAddress) \
         WHERE UserName='%{SQL-User-Name}' \
         AND AcctStopTime IS NULL \
+        AND AcctSessionId != '%{Acct-Session-Id}' \
         AND (a.AcctStartTime > n.ReloadTime OR n.ReloadTime IS NULL)"
 
 simul_verify_query = "\
@@ -246,6 +247,7 @@ simul_verify_query = "\
         LEFT OUTER JOIN nasreload n USING (nasipaddress) \
         WHERE UserName='%{SQL-User-Name}' \
         AND AcctStopTime IS NULL \
+        AND AcctSessionId != '%{Acct-Session-Id}' \
         AND (a.AcctStartTime > n.reloadtime OR n.reloadtime IS NULL)"
 
 #######################################################################

files/sites-available/default

@@ -648,13 +648,24 @@ accounting {
 	#  Ensure that &control:Pool-Name is set to determine which pool of IPs are used.
 	# sqlippool
 
-    ### rebuild Pool-Name 
+    #
+    # Determine the client type.
+    # Devices use a fixed IP from radreply.
+    # Engineers use an IP from sqlippool/radippool.
+    #
     update control {
-        Pool-Name := "engineers-%{sql:SELECT split_part('%{User-Name}', '@', 2)}"
+        Tmp-String-1 := "%{sql:SELECT client_type FROM node_assignments WHERE username='%{User-Name}'}"
     }
 
-    ### apply only for engineers
-    if (&control:Pool-Name =~ /^engineers-/) {
+    #
+    # Return the IP to the pool only for engineers.
+    #
+    if (&control:Tmp-String-1 == "engineer") {
+
+        update control {
+            Pool-Name := "engineers-%{sql:SELECT split_part('%{User-Name}', '@', 2)}"
+        }
+
         sqlippool
     }
 	#  Log traffic to an SQL database.
@@ -791,16 +802,28 @@ post-auth {
 	# sqlippool
 
 	# Engineers → dynamic IP
-    #
+	#
 	if (&control:Pool-Name =~ /^engineers-/) {
 
 		update reply {
-			Session-Timeout := 3600
+			Session-Timeout := 1200
+			Acct-Interim-Interval := 60
 		}
 
 		sqlippool
 	}
+
 	#
+	# Devices → fixed IP
+	# authorize --> post-auth: reuse Tmp-String-1
+	elsif (&control:Tmp-String-1 == "device") {
+
+		update reply {
+			Acct-Interim-Interval := 300
+		}
+	}
+
+    #
 	# HARD CHECK: must have IP
 	#
 	if (!&reply:Framed-IP-Address) {
@@ -809,9 +832,10 @@ post-auth {
 		}
 		reject
 	}
-
+	
 	# Query VLAN ID from your DB
-	vlan_test
+	# VLAN assignment is no longer used
+	#vlan_test
 
 	#  Create the CUI value and add the attribute to Access-Accept.
 	#  Uncomment the line below if *returning* the CUI.