accel-ppp.git/accel-pppd/radius/dm_coa.c, branch 1.15.0High performance PPTP/L2TP/SSTP/PPPoE/IPoE server for Linux (mirror of https://github.com/accel-ppp/accel-ppp.git)
https://git.amelek.net/accel-ppp/accel-ppp.git/atom?h=1.15.02026-09-07T19:08:04+00:00radius: validate VRF names through Access-Accept and CoA2026-09-07T19:08:04+00:00Denys Fedoryshchenkodenys.f@collabora.com2026-09-07T19:08:04+00:00urn:sha1:e014cb2cb46f9a5778fbf8a819a1ad263a911c84
Reject oversized and embedded-NUL VRF attributes and allocation failures.
Keep explicit CoA lengths, restrict removal to literal 0, and bound the
session API and shared interface lookup. Preserve default VRF removal.
Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8611, with the same
validation boundary extended to the CoA path.
Co-authored-by: Ritika Chopra <r.chopra@vyos.io>
radius: Implement DM/CoA security hardening by restricting source ip addresses2025-12-22T22:48:30+00:00Denys Fedoryshchenkodenys.f@collabora.com2025-12-21T08:44:22+00:00urn:sha1:2550fe6cd9de9734cbc41179931fd029d8d132d6
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
crypto: Removed internal tomcat crypto.2025-12-10T17:16:42+00:00Andrii Melnychenkoa.melnychenko@vyos.io2025-09-29T16:14:48+00:00urn:sha1:c912d09018828745e3bcba268cd02a611e324d54
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
Add RADIUS blast attack protection with Message-Authenticator2025-07-01T11:32:13+00:00Denys Fedoryshchenkodenys.f@collabora.com2025-06-25T19:31:08+00:00urn:sha1:1ce263f13ac0b3aed3b14b4a9bb6a51afe210684
Recently FreeRadius started to complain accel-ppp doesn't pass
BlastRADIUS check. This commit fixes that.
This commit implements protection against RADIUS blast attacks
by adding support for the Message-Authenticator attribute in
Access-Request packets. This security enhancement helps
prevent unauthorized access attempts and replay attacks
on RADIUS authentication.
- Added new configuration option `blast-protection=1`
in [radius] to enable Message-Authenticator inclusion
- Implemented HMAC-MD5 calculation for
Message-Authenticator attribute (RFC 2869)
- Modified packet building to include 18-byte Message-Authenticator
attribute when enabled
- Updated packet structure to support signing with shared secret
Enable blast protection by adding to the `[radius]` section:
```
blast-protection=1
```
When enabled, all Access-Request packets will include a
Message-Authenticator attribute with HMAC-MD5 signature,
providing cryptographic integrity verification and protection
against packet modification attacks.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
These changes are in response to PR comments2021-12-28T12:35:08+00:00rootroot@debian11-vyos-build.polycomm.net2021-12-28T12:35:08+00:00urn:sha1:2bbeb7eb0a56ea34a8a3d2f7aba81836bcb50835Added VRF support for radius request and DM/CoA server.2021-12-28T09:50:44+00:00rootroot@debian11-vyos-build.polycomm.net2021-12-28T09:50:44+00:00urn:sha1:2804a115fc2cd0d785d9a6dcb0be247c97c32d69
New configuration format:
[radius]
server=address,secret[,auth-port=1812][,acct-port=1813][,vrf=VRF_NAME][,req-limit=0][,fail-timeout=0,max-fail=0,][,weight=1][,backup]
dae-server=x.x.x.x:port,secret[,vrf=VRF_NAME]
By default, VRF name is undefined.
vrf: T10: Add VRF support2021-12-16T20:03:52+00:00DmitriyEshenkodmitriy.eshenko@vyos.io2021-12-10T16:43:42+00:00urn:sha1:737bf4d8b6e9e1bf50be69e8c99028bb2696190c
Co-authored-by: Sergey V. Lobanov <svlobanov@users.noreply.github.com>
Co-authored-by: Vladislav Grishenko <themiron@users.noreply.github.com>
radius: dm/coa: add invalid packet logging2019-08-30T11:49:07+00:00Vladislav Grishenkothemiron@mail.ru2019-08-30T11:49:07+00:00urn:sha1:76819cf1dceb6f4181536073e0e42da0d2f89134radius: fixed bug (inserting empty Class)2019-03-08T09:48:41+00:00Dmitry Kozlovxeb@mail.ru2019-03-08T09:48:41+00:00urn:sha1:fbac1573d3def4eef27e55272125242e5a1711e1radius: update Session-Timeout by CoA2016-06-07T17:40:55+00:00Dmitry Kozlovxeb@mail.ru2016-06-07T17:40:55+00:00urn:sha1:429ca0e6188594e5ccbce639d2d22576e5256e62