22.05 - CP clients have connectivity issues after x amount of time

[heper]

@gertjan

i've monitored cp-situation fairly closely the entire day.
i didn't notice any dropouts throughout the day with the workaround i have in place.

thanks for looking into this & figuring out what the issue is

[stephenw10]

I have replicated this and we are reviewing it. I'll open a bug report that better describes the issue momentarily:

https://redmine.pfsense.org/issues/13488

Please add anything there that may be pertinent.

Steve

[heper]

@stephenw10

the same thing happens when per-user-bw is disabled:

• all users use the same pipe
  • on disconnect that pipe gets removed

should i add this to the redmine myself or will you change the summary ?

[Gertjan]

@heper

Actually, bandwidth set, for all users, or not, or set individually when using FreeRadius, it doesn't matter.
The issue has nothing to do with bandwidth, but bandwidth usage made it more 'visible'.
Your video was spot on : all connected users together use the set bandwidth of one user (10 Mbits down). Looking again at the limiters list did the rest.

Solving this one is easy.

I'm often think about what jimp said ones in the past : we will have to re write all this captive portal (Italian food) 'code', he mentioned Python if I recall well. As "/etc/inc/captiveportal.inc" is a bit .... messy.

[stephenw10]

Ah, OK, that is likely a hangover from ipfw where all traffic had to use a pipe in order to be filtered at L2. Though the pipe was set at unlimited bandwidth.
Yes, add that or I can when I've tested it later today.

Steve

[stephenw10]

Ok, yup, it's exactly that. Adding it.

[level4]

@gertjan said in 22.05 - CP clients have connectivity issues after x amount of time:

I did this to restore unique pipeno usage :

/usr/local/captiveportal/index.html

	$pipeno = captiveportal_get_next_dn_ruleno('auth', 2000, 64500, true);
.......
	}
	
	$auth_result = captiveportal_authenticate_user($user, $passwd, $clientmac, $clientip, $pipeno, $context);

I changed the true for false on the first line
Added an 'else' condition.

	$pipeno = captiveportal_get_next_dn_ruleno('auth', 2000, 64500, false);
.......

	} else
		$auth_result = captiveportal_authenticate_user($user, $passwd, $clientmac, $clientip, $pipeno, $context);

Now, if a pipe gets attributed, but the login fails, the pipe will get freed up again.

My users have now unique pipes.

@Gertjan
Would you be so kind to share the modified 22.05- index.php ?
(Or a real diff)

I'm having the same issue, and would like to try this fix, but dont really understand what should be changed.

[Gertjan]

@level4

Sorry, never managed to make a "diff" - tried many times, but the obtained patch file isn't usefull (for me) otherwise I would use that myself, and it would be easier to communicate here, I agree.

The original code (from github):

🔒 Log in to view

Step 1: before the first line "$pipeno = captiveportal_get_next_dn_ruleno('auth',......", add

$auth_result = array();

Step 2 : change the (now second) line

$pipeno = captiveportal_get_next_dn_ruleno('auth', 2000, 64500, true);

for

$pipeno = captiveportal_get_next_dn_ruleno('auth', 2000, 64500, false);

Step 3 - goto the closing line 262 "}"
and add an "else" behind and remove the following empty line.

The result looks like :

🔒 Log in to view

[level4]

@gertjan Thanks!

I'm a total php noob, but;

That "} else" ..

shouldn't be a "} else {"

with a "}" below the "$auth_result =" line ?

[Gertjan]

@level4 said in 22.05 - CP clients have connectivity issues after x amount of time:

That "} else" ..
shouldn't be a "} else {"
with a "}" below the "$auth_result =" line ?

You can place

$auth_result = captiveportal_authenticate_user($user, $passwd, $clientmac, $clientip, $pipeno, $context);

between { .... }, true. Like :

	.......
	} else
	{
		$auth_result = captiveportal_authenticate_user($user, $passwd, $clientmac, $clientip, $pipeno, $context);
	}

Or

	.......
	} else { $auth_result = captiveportal_authenticate_user($user, $passwd, $clientmac, $clientip, $pipeno, $context); }

But as this is just one line, so no need.