pfSense

This is the RFC:
http://freeradius.org/rfc/rfc2866.html#Acct-Terminate-Cause

There seems to be a function in /etc/inc/captiveportal.inc which has "Acct-Terminate-Cause = 7" but it seems not to work when CP restarts.

function captiveportal_radius_stop_all() {
    global $config;

    if (!isset($config['captiveportal']['radacct_enable']))
        return;

    $radiusservers = captiveportal_get_radius_servers();
    if (!empty($radiusservers)) {
        $cpdb = captiveportal_read_db();
        foreach ($cpdb as $cpentry) {
            RADIUS_ACCOUNTING_STOP($cpentry[1], // ruleno
                $cpentry[4], // username
                $cpentry[5], // sessionid
                $cpentry[0], // start time
                $radiusservers,
                $cpentry[2], // clientip
                $cpentry[3], // clientmac
                7); // Admin Reboot
        }
    }
}

We need to add an accounting on packet like this after the CP service has restarted:

Frame 25 (113 bytes on wire, 113 bytes captured)
Ethernet II, Src: D-Link_f2:47:f1 (00:22:b0:f2:47:f1), Dst: Vmware_61:cc:a7 (00:0c:29:61:cc:a7)
Internet Protocol, Src: 192.168.0.20 (192.168.0.20), Dst: 192.168.0.22 (192.168.0.22)
User Datagram Protocol, Src Port: filenet-nch (32770), Dst Port: radius-acct (1813)
Radius Protocol
Code: Accounting-Request (4)
Packet identifier: 0x0 (0)
Length: 71
Authenticator: ED5D642062C77D3B4D67A4B2580F703E
[The response to this request is in frame 26]
Attribute Value Pairs
AVP: l=6 t=Acct-Status-Type(40): Accounting-On(7)
Acct-Status-Type: Accounting-On (7)
AVP: l=6 t=Acct-Authentic(45): RADIUS(1)
Acct-Authentic: RADIUS (1)
AVP: l=6 t=NAS-IP-Address(4): 192.168.0.20
NAS-IP-Address: 192.168.0.20 (192.168.0.20)
AVP: l=27 t=Called-Station-Id(30): 00-22-B0-F2-47-F1:TEST-AP
Called-Station-Id: 00-22-B0-F2-47-F1:TEST-AP
AVP: l=6 t=Acct-Terminate-Cause(49): NAS-Reboot(11)
Acct-Terminate-Cause: NAS-Reboot (11)

We need add an accounting OFF packet when CP is shutting down and after CP has restarted and before the accounting ON packet is send.

We have done this on our installations, but the only patch file I have is rather comprehensive and covers all our RADIUS-related changes. I'll look at breaking out the NAS accounting bit.

The original request should not be for Acct-Terminate-Cause -- this must only be sent when ending individual client sessions, and is already included in stop packets. I'm not familiar with FreeRADIUS in particular, but sync problems typically show up when the NAS is unexpectedly restarted and doesn't get a chance to send those stop packets for the user sessions. I expect what the requester wants pfSense to be sending is an Accounting-Off packet at shutdown of the NAS, Accounting-On at boot, and both when the CP service is restarted. The server can use the Accounting-On packet as a signal to reset any active sessions for that NAS.

See https://github.com/bsdperimeter/pfsense/pull/236

Pull request is still up to date, if there is any interest in checking it in.

Pull request https://github.com/pfsense/pfsense/pull/236 has been merged in 2013.
The feature is working well.

This feature request can be safely marked as resolved.