- Update SessionID allocator to use freed session IDs

[todo]

connectedhomeip/src/protocols/secure_channel/SessionIDAllocator.cpp

Lines 29 to 39 in 6c1f43a

	// TODO - Update SessionID allocator to use freed session IDs
	mNextAvailable++;
	return CHIP_NO_ERROR;
	}
	void SessionIDAllocator::Free(uint16_t id)
	{
	if (mNextAvailable > 0 && (mNextAvailable - 1) == id)
	{
	mNextAvailable--;

---

This issue was generated by todo based on a TODO comment in 6c1f43a when #7666 was merged. cc @pan-apple.

[msandstedt]

This may not be well known. Until we implement this, a node can be DOSed with this pattern:

nodeA;
nodeB;
victimNode;
nodeA::EstablishCASE(victimNode); // occupy initial key ID
nodeB::EstablishCASE(victimNode); // occupy key ID + 1
while (true) // repeat until we can occupy key ID 65535
{
    nodeA::DisconnectCASE(victimNode); // release initial key ID
    nodeA::EstablishCASE(victimNode); // occupy key ID + 2
    nodeB::DisconnectCASE(victimNode); // release key ID + 1
    nodeB::EstablishCASE(victimNode); // occupy key ID + 3
}
// Now the node is deaf

CC @cecille , @kpschoedel

[msandstedt]

I think this may have been closed inadvertently.

[msandstedt]

Taking this as it's related to #12821 and we can have a pretty straight forward solution by addressing both together.

If the session manager can assign session IDs itself, all of these problems go away. Session manager has complete visibility of occupied and available session IDs, so can easily assign new ones. With this approach, there need be no session ID exhaustion problem as we currently have.

And this can fix #12821 as well, because then session manager can make sure there aren't session ID collisions between fabrics.