accel-ppp.git/accel-pppd/radius/packet.c, branch stable

radius: Invalid integer and date parsing

2026-03-22T22:04:34+00:00

Actually 3 fixes in same place: INTEGER: size mismatch now breaks instead of falling through - a malformed INTEGER attribute is rejected rather than silently parsed with a wrong size INTEGER/DATE split: each case has its own break, no more fallthrough DATE: strictly requires len == 4 (per RFC 2865), warns and skips otherwise instead of silently accepting 1 or 2-byte dates Signed-off-by: Denys Fedoryshchenko

radius: Fix invalid check after mempool allocation

2026-03-22T22:04:34+00:00

This check left old, relevant to mmap, migrate to proper check. Signed-off-by: Denys Fedoryshchenko

radius: Vendor attribute parsing over-reads

2026-03-22T22:04:34+00:00

When parsing vendor-specific attributes (type 26), the code reads internal structure without checking that the attribute data is long enough. Signed-off-by: Denys Fedoryshchenko

Merge pull request #267 from nuclearcat/fix-ssl-warnings

2025-11-28T06:39:54+00:00

Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIs

fixup! Add RADIUS blast attack protection with Message-Authenticator

2025-11-26T18:29:52+00:00

Not a bug, but to supress warnings. Signed-off-by: Denys Fedoryshchenko

Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIs

2025-11-26T18:23:38+00:00

We are using similar approach as in other projects, easiest one, but probably in future it will break as soon as this functions will be removed completely. Signed-off-by: Denys Fedoryshchenko

Add RADIUS blast attack protection with Message-Authenticator

2025-07-01T11:32:13+00:00

Recently FreeRadius started to complain accel-ppp doesn't pass BlastRADIUS check. This commit fixes that. This commit implements protection against RADIUS blast attacks by adding support for the Message-Authenticator attribute in Access-Request packets. This security enhancement helps prevent unauthorized access attempts and replay attacks on RADIUS authentication. - Added new configuration option `blast-protection=1` in [radius] to enable Message-Authenticator inclusion - Implemented HMAC-MD5 calculation for Message-Authenticator attribute (RFC 2869) - Modified packet building to include 18-byte Message-Authenticator attribute when enabled - Updated packet structure to support signing with shared secret Enable blast protection by adding to the `[radius]` section: ``` blast-protection=1 ``` When enabled, all Access-Request packets will include a Message-Authenticator attribute with HMAC-MD5 signature, providing cryptographic integrity verification and protection against packet modification attacks. Signed-off-by: Denys Fedoryshchenko

build: fix compile errors on GCC 14

2024-08-27T22:41:58+00:00

This patch fixes compile errors on GCC 14 like the following /root/accel-ppp/accel-pppd/radius/packet.c: In function 'rad_packet_recv': /root/accel-ppp/accel-pppd/radius/packet.c:142:72: error: passing argument 5 of 'recvfrom' from incompatible pointer type [-Wincompatible-pointer-types] 142 | n = recvfrom(fd, pack->buf, REQ_LENGTH_MAX, 0, addr, &addr_len); | ^~~~ | | | struct sockaddr_in * In file included from /usr/include/netinet/in.h:10, from /usr/include/arpa/inet.h:9, from /root/accel-ppp/accel-pppd/radius/packet.c:10: /usr/include/sys/socket.h:397:55: note: expected 'struct sockaddr * restrict' but argument is of type 'struct sockaddr_in *' Reference: https://gcc.gnu.org/gcc-14/porting_to.html

fix buffer overflow when receive radius packet

2021-12-29T06:54:13+00:00

This patch fixes buffer overflow if radius packet contains invalid atribute length and attrubute type from the following list: ipv4addr, ipv6addr, ipv6prefix or ifid Reported-by: Chloe Ong Reported-by: Eugene Lim Reported-by: Kar Wei Loh Signed-off-by: Sergey V. Lobanov

radius: sanity check for vendor attribute length

2020-10-21T09:40:26+00:00