accel-ppp.git/accel-pppd/accel-ppp.conf, branch sstp-alloc-invariant

docs: synchronize config sample and man page

2026-07-10T12:37:37+00:00

ippool/ipv6pool: bitmap allocator + online reconfiguration

2026-06-03T11:57:45+00:00

Replace the pre-generated free-list (one heap node per allocatable address/prefix) with a per-pool bitmap. Each pool holds a list of contiguous ranges, each range owning one bitmap (1 bit per unit); a lease is a small per-session malloc wrapper around the ipdb item, so pool memory is no longer shared or mutated by sessions. Memory now scales with capacity at ~1 bit/unit instead of ~96B (v4) / ~128B (v6) per unit; startup, `show ippool`, and backup-restore are O(1) instead of O(N)/O(N*M). Oversized IPv6 ranges (prefix_len-mask > 24) are rejected at parse time instead of OOMing in the malloc loop. The ipdb_t vtable, the owner-based put dispatch, ipdb.h structs, and struct ap_session are unchanged; RADIUS and chap-secrets backends are untouched (reconcile filters by owner). Preserved behavior: p2p/net30 allocators (via a step/gw_offset/ peer_offset geometry triple), shuffle (randomized scan start), named pools, next-chains, gw-ip-address, RADIUS pool-name attrs, and the USE_BACKUP save/restore path. `gw=` is now accepted-and-ignored (its per-address local gateway was already overridden at allocation time). New: online reconfiguration. An EV_CONFIG_RELOAD handler rebuilds the pool set and reconciles live sessions (sessions are the source of truth, the bitmap is rebuilt from them) under pool_set_rwlock(write) -> ses_lock(read) -> per-pool spinlock. Sessions whose address left the pools are handled per a new `reload-orphan = keep|disconnect` knob (default keep); foreign in-range addresses are reserved to avoid duplicate assignment. Adds extra/bitpool.h (shared bit-array helpers) and a standalone extra/bitpool_test.c (not wired into cmake) covering the bitmap and the v4/v6 address<->bit math, cross-checked against an __int128 reference. Signed-off-by: Denys Fedoryshchenko

metrics: document module in conf, manpage, and CHANGELOG

2026-05-14T07:04:56+00:00

Add a commented `[metrics]` block to the example accel-ppp.conf and a matching `#metrics` entry in the [modules] list so operators see the feature when reading the sample config. Document the section in accel-ppp.conf(5) next to [connlimit]: the format/address/allowed_ips options, the path/method behaviour, and how the ACL accepts either the bracketed or bare comma-separated form. Add an Unreleased entry to CHANGELOG.md announcing the module. Signed-off-by: Denys Fedoryshchenko

radius: Add optional validation of Framed-Route

2026-01-24T18:14:44+00:00

Signed-off-by: Denys Fedoryshchenko

dae-allowed: Remove nagging about making option mandatory

2026-01-24T16:20:37+00:00

Signed-off-by: Denys Fedoryshchenko

radius: Implement DM/CoA security hardening by restricting source ip addresses

2025-12-22T22:48:30+00:00

Signed-off-by: Denys Fedoryshchenko

Add RADIUS blast attack protection with Message-Authenticator

2025-07-01T11:32:13+00:00

Recently FreeRadius started to complain accel-ppp doesn't pass BlastRADIUS check. This commit fixes that. This commit implements protection against RADIUS blast attacks by adding support for the Message-Authenticator attribute in Access-Request packets. This security enhancement helps prevent unauthorized access attempts and replay attacks on RADIUS authentication. - Added new configuration option `blast-protection=1` in [radius] to enable Message-Authenticator inclusion - Implemented HMAC-MD5 calculation for Message-Authenticator attribute (RFC 2869) - Modified packet building to include 18-byte Message-Authenticator attribute when enabled - Updated packet structure to support signing with shared secret Enable blast protection by adding to the `[radius]` section: ``` blast-protection=1 ``` When enabled, all Access-Request packets will include a Message-Authenticator attribute with HMAC-MD5 signature, providing cryptographic integrity verification and protection against packet modification attacks. Signed-off-by: Denys Fedoryshchenko

ci: run tests in alpine vm

2024-08-23T23:45:58+00:00

Alpine Linux uses musl libc so now accel-ppp is tested under musl Currently, Alpine Linux doesn't provide a link to the latest stable version so direct link to Alpine 3.20 is used Improved musl support might be used to run on platforms like openwrt without additional patches

workflows: Add CI build in Alpine

2024-04-09T22:34:05+00:00

As we fixed musl compatibility, we can add also basic check if accel keep working in Alpine Linux Also update default config, enable connlimit and place it before pptp, otherwise Alpine generate error: ``` [2024-04-09 22:30:09.911]loader: failed to load 'pptp': Error relocating /usr/local/lib64/accel-ppp/libpptp.so: connlimit_check: symbol not found ``` Signed-off-by: Denys Fedoryshchenko

CLI: PPPoE: Add possibility to display inbound interface and service-name in show sessions command

2023-06-29T17:48:39+00:00