accel-ppp.git/accel-pppd/radius/radius.c, branch stableHigh performance PPTP/L2TP/SSTP/PPPoE/IPoE server for Linux (mirror of https://github.com/accel-ppp/accel-ppp.git)
https://git.amelek.net/accel-ppp/accel-ppp.git/atom?h=stable2026-03-22T22:04:21+00:00Update accel-pppd/radius/radius.c2026-03-22T22:04:21+00:00Denys Fedoryshchenkonuclearcat@nuclearcat.com2026-01-27T14:59:09+00:00urn:sha1:13bebd891391a61571f6d60967feab2db8262519
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>Update accel-pppd/radius/radius.c2026-03-22T22:04:16+00:00Denys Fedoryshchenkonuclearcat@nuclearcat.com2026-01-27T14:59:00+00:00urn:sha1:68185e58d16069e393edcf6503bb4171f56a1151
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>radius: Fix buggy Framed-Route parsing2026-03-22T22:04:12+00:00Denys Fedoryshchenkodenys.f@collabora.com2026-01-24T18:07:47+00:00urn:sha1:48fa58ce6d6f2e785b547c9766bef8a9d6ae3e00
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
dae-allowed: Remove nagging about making option mandatory2026-01-24T16:20:37+00:00Denys Fedoryshchenkodenys.f@collabora.com2026-01-24T16:20:37+00:00urn:sha1:1addd77cf73bef943175648d534cce2e1a66497f
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
radius: Implement DM/CoA security hardening by restricting source ip addresses2025-12-22T22:48:30+00:00Denys Fedoryshchenkodenys.f@collabora.com2025-12-21T08:44:22+00:00urn:sha1:2550fe6cd9de9734cbc41179931fd029d8d132d6
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
Add RADIUS blast attack protection with Message-Authenticator2025-07-01T11:32:13+00:00Denys Fedoryshchenkodenys.f@collabora.com2025-06-25T19:31:08+00:00urn:sha1:1ce263f13ac0b3aed3b14b4a9bb6a51afe210684
Recently FreeRadius started to complain accel-ppp doesn't pass
BlastRADIUS check. This commit fixes that.
This commit implements protection against RADIUS blast attacks
by adding support for the Message-Authenticator attribute in
Access-Request packets. This security enhancement helps
prevent unauthorized access attempts and replay attacks
on RADIUS authentication.
- Added new configuration option `blast-protection=1`
in [radius] to enable Message-Authenticator inclusion
- Implemented HMAC-MD5 calculation for
Message-Authenticator attribute (RFC 2869)
- Modified packet building to include 18-byte Message-Authenticator
attribute when enabled
- Updated packet structure to support signing with shared secret
Enable blast protection by adding to the `[radius]` section:
```
blast-protection=1
```
When enabled, all Access-Request packets will include a
Message-Authenticator attribute with HMAC-MD5 signature,
providing cryptographic integrity verification and protection
against packet modification attacks.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
radius: implemented accounting delay option (acct-delay-start)2023-01-27T08:05:26+00:00Dmitry Kozlovxeb@mail.ru2023-01-27T08:05:26+00:00urn:sha1:cc8f2bada5635768d425e2fa2bafb095acda8ca9add switch to disable sending NAS-Port-Id2022-04-20T12:09:58+00:00Sergey V. Lobanovsergey@lobanov.in2022-04-20T10:36:08+00:00urn:sha1:6f5f75e70ce10dd41c47af8a3b4b179813020d4c
This patch introduces nas-port-id-in-req switch to disable sending
NAS-Port-Id attribute in radauth and radacct messages. New switch
might be useful if radius server cannot properly handle this
attrubite.
Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
These changes are in response to PR comments2021-12-28T12:35:08+00:00rootroot@debian11-vyos-build.polycomm.net2021-12-28T12:35:08+00:00urn:sha1:2bbeb7eb0a56ea34a8a3d2f7aba81836bcb50835Added VRF support for radius request and DM/CoA server.2021-12-28T09:50:44+00:00rootroot@debian11-vyos-build.polycomm.net2021-12-28T09:50:44+00:00urn:sha1:2804a115fc2cd0d785d9a6dcb0be247c97c32d69
New configuration format:
[radius]
server=address,secret[,auth-port=1812][,acct-port=1813][,vrf=VRF_NAME][,req-limit=0][,fail-timeout=0,max-fail=0,][,weight=1][,backup]
dae-server=x.x.x.x:port,secret[,vrf=VRF_NAME]
By default, VRF name is undefined.