accel-ppp.git/accel-pppd/radius/req.c, branch sstp-alloc-invariant

radius: update server secret on config reload

2026-06-05T19:42:06+00:00

On EV_CONFIG_RELOAD, __add_server() re-parses each server line into a fresh rad_server_t and, when it matches an existing server by addr/auth_port/acct_port, copied over only the timeout/limit/bind fields before freeing the new struct. The freshly parsed secret was discarded, so editing a shared secret and reloading had no effect until a full restart. The strdup'd secret on the freed struct was also leaked on every matched reload. Adopt the new secret into the existing server (freeing the old one) so secret changes take effect on reload. New requests read req->serv->secret directly, so they pick up the update immediately. This covers both the modern "server=" path and the legacy auth-server/acct-server path, which both funnel through __add_server().

Merge pull request #297 from nuclearcat/fixes-radius

2026-03-16T16:07:36+00:00

Various radius fixes

radius: Fix use after free and more

2026-02-18T17:35:13+00:00

Situation is a bit complex. Even one problem we fix easily, such as saving server as variable, rad_req_free might free server in theory, and s will be invalid. This is a bit of rewrite, but proper fix. Fixes problem in 2 functions. Signed-off-by: Denys Fedoryshchenko

radius: Fix to same type of allocator and deallocator

2026-02-06T16:07:20+00:00

Signed-off-by: Denys Fedoryshchenko

fixup! Add RADIUS blast attack protection with Message-Authenticator

2025-11-26T18:29:52+00:00

Not a bug, but to supress warnings. Signed-off-by: Denys Fedoryshchenko

Add RADIUS blast attack protection with Message-Authenticator

2025-07-01T11:32:13+00:00

Recently FreeRadius started to complain accel-ppp doesn't pass BlastRADIUS check. This commit fixes that. This commit implements protection against RADIUS blast attacks by adding support for the Message-Authenticator attribute in Access-Request packets. This security enhancement helps prevent unauthorized access attempts and replay attacks on RADIUS authentication. - Added new configuration option `blast-protection=1` in [radius] to enable Message-Authenticator inclusion - Implemented HMAC-MD5 calculation for Message-Authenticator attribute (RFC 2869) - Modified packet building to include 18-byte Message-Authenticator attribute when enabled - Updated packet structure to support signing with shared secret Enable blast protection by adding to the `[radius]` section: ``` blast-protection=1 ``` When enabled, all Access-Request packets will include a Message-Authenticator attribute with HMAC-MD5 signature, providing cryptographic integrity verification and protection against packet modification attacks. Signed-off-by: Denys Fedoryshchenko

Adding support to Radius IPV6 address

2023-11-30T11:54:54+00:00

This change enables ipv6 connections between accel-ppp and radius server

add switch to disable sending NAS-Port-Id

2022-04-20T12:09:58+00:00

This patch introduces nas-port-id-in-req switch to disable sending NAS-Port-Id attribute in radauth and radacct messages. New switch might be useful if radius server cannot properly handle this attrubite. Signed-off-by: Sergey V. Lobanov

These changes are in response to PR comments

2021-12-28T12:35:08+00:00

Added VRF support for radius request and DM/CoA server.

2021-12-28T09:50:44+00:00

New configuration format: [radius] server=address,secret[,auth-port=1812][,acct-port=1813][,vrf=VRF_NAME][,req-limit=0][,fail-timeout=0,max-fail=0,][,weight=1][,backup] dae-server=x.x.x.x:port,secret[,vrf=VRF_NAME] By default, VRF name is undefined.