accel-ppp.git/accel-pppd/radius/req.c, branch stable

radius: Fix use after free and more

2026-03-22T22:04:34+00:00

Situation is a bit complex. Even one problem we fix easily, such as saving server as variable, rad_req_free might free server in theory, and s will be invalid. This is a bit of rewrite, but proper fix. Fixes problem in 2 functions. Signed-off-by: Denys Fedoryshchenko

radius: Fix to same type of allocator and deallocator

2026-03-22T22:04:34+00:00

Signed-off-by: Denys Fedoryshchenko

fixup! Add RADIUS blast attack protection with Message-Authenticator

2025-11-26T18:29:52+00:00

Not a bug, but to supress warnings. Signed-off-by: Denys Fedoryshchenko

Add RADIUS blast attack protection with Message-Authenticator

2025-07-01T11:32:13+00:00

Recently FreeRadius started to complain accel-ppp doesn't pass BlastRADIUS check. This commit fixes that. This commit implements protection against RADIUS blast attacks by adding support for the Message-Authenticator attribute in Access-Request packets. This security enhancement helps prevent unauthorized access attempts and replay attacks on RADIUS authentication. - Added new configuration option `blast-protection=1` in [radius] to enable Message-Authenticator inclusion - Implemented HMAC-MD5 calculation for Message-Authenticator attribute (RFC 2869) - Modified packet building to include 18-byte Message-Authenticator attribute when enabled - Updated packet structure to support signing with shared secret Enable blast protection by adding to the `[radius]` section: ``` blast-protection=1 ``` When enabled, all Access-Request packets will include a Message-Authenticator attribute with HMAC-MD5 signature, providing cryptographic integrity verification and protection against packet modification attacks. Signed-off-by: Denys Fedoryshchenko

Adding support to Radius IPV6 address

2023-11-30T11:54:54+00:00

This change enables ipv6 connections between accel-ppp and radius server

add switch to disable sending NAS-Port-Id

2022-04-20T12:09:58+00:00

This patch introduces nas-port-id-in-req switch to disable sending NAS-Port-Id attribute in radauth and radacct messages. New switch might be useful if radius server cannot properly handle this attrubite. Signed-off-by: Sergey V. Lobanov

These changes are in response to PR comments

2021-12-28T12:35:08+00:00

Added VRF support for radius request and DM/CoA server.

2021-12-28T09:50:44+00:00

New configuration format: [radius] server=address,secret[,auth-port=1812][,acct-port=1813][,vrf=VRF_NAME][,req-limit=0][,fail-timeout=0,max-fail=0,][,weight=1][,backup] dae-server=x.x.x.x:port,secret[,vrf=VRF_NAME] By default, VRF name is undefined.

Send Delegated-IPv6-Prefix attribute in Accounting-Start message

2020-04-21T10:16:45+00:00

If Delegated-IPv6-Prefix was received in Access-Accept message, it is necessary to send it in radacct Start message

radius: add support for Access-Accept username

2019-08-29T12:37:15+00:00

once radius server has returned User-Name attribute in Access-Accept packet, it'll be used for any subsequent Accounting-Request packets instead of internal username per RFC2865 5.1 other way of just replacing session username is possible, but not desired at the moment due potential issues with single-session modes in case of different ppp logins / ipoe macs and same contract number returned by radius for that accounts.