Include Acct-Session-Id (session id) in RADIUS Access-Request packets

Description of problem:

RADIUS Access-Request packets sent by ocserv do not contain any per-session unique identifier. ocserv generates a session id (acct_info.safe_id) and includes it as Acct-Session-Id in Accounting-Request packets, but the same id is never sent during authentication. As a result there is no attribute that is present in both the Access-Request and the Accounting-Request and is unique per session. This breaks IP-pool accounting with FreeRADIUS rlm_ippool. That module allocates an address from an MD5 hash of a key built from RADIUS attributes, and releases it on Acct-Status-Type = Stop only if the key hashes identically. With the attributes ocserv sends today (User-Name, Calling-Station-Id, Connect-Info), two concurrent sessions of the same user with the same client (e.g. two identical machines behind one NAT) produce the same key. rlm_ippool then releases the in-use lease of the first session and reallocates it, leading to duplicate IP assignments.

Version of ocserv used:

Sending the session id (safe_id) as Acct-Session-Id in the Access-Request would make a single identifier available in both auth and accounting, allowing rlm_ippool to allocate by a unique per-session key and release it correctly on Stop.

Client used:

ocserv 1.3.0 OpenConnect VPN Agent (Java) v9.12-unknown"

Distributor of ocserv

Ubuntu

How reproducible:

Setup: ocserv with auth = "radius[...]" and acct = "radius[...]", FreeRADIUS using rlm_ippool with a key composed of attributes ocserv sends in the Access-Request (e.g. key = "%{User-Name} %{Calling-Station-Id}").

Steps:

Run freeradius -X and connect a client; note the attributes in the Access-Request — there is no per-session unique id (no Acct-Session-Id). Connect a second session for the same user from the same client/IP; the rlm_ippool key hashes to the same value, the first session's IP is released and a new one is allocated. Observe the Accounting-Request (Start/Stop): Acct-Session-Id is present there, but it was never seen in the Access-Request, so it cannot be used as the pool key.

Actual results:

The session id (safe_id / Acct-Session-Id) appears only in Accounting-Request packets, never in the Access-Request. No unique-per-session attribute is common to both auth and accounting, so rlm_ippool cannot key on the session

Expected results:

ocserv includes the session id (Acct-Session-Id = safe_id) in the Access-Request — preferably enabled via a configuration option — so the same identifier is available during both authentication and accounting. This lets rlm_ippool allocate addresses by a unique per-session key and release them on Acct-Status-Type = Stop. freeradius -X should show the same Acct-Session-Id value in the Access-Request and in the corresponding Accounting Start/Stop.