NSAPI changes Acct-Session-Id from upstream provider

Matthew Newton mcn at freeradius.org
Mon Feb 24 09:56:56 UTC 2025


On 24/02/2025 07:05, Gabriel Marais wrote:
>> Authentication Request Received
> < Access Accept sent back
>> Accounting Start Packet Received with a Acct-Session-Id
> < Acknowledgement sent back
>> Interim Accounting Packet Received - This time with a different Acct-Session-Id for the same connection

That's just broken. RFC 2866 s5.5 and 2869 s2.1 make it clear that 
Acct-Session-Id must match across the whole session. Those documents 
have only been published for nearly 25 years :(

Common sense says the same, too.

> ** At this point, things start going bad as we are not able to update
> the original DB entry created with the Acct Start Packet, since the
> Acct-Session-Id differs between the packet received in the Accounting
> Start Packet and the Interim Accounting Packet.

Yeah, quite. The behaviour needs fixing or the kit needs throwing in the 
bin and replacing with something sane.

-- 
Matthew


More information about the Freeradius-Users mailing list