accel-ppp.git/accel-pppd/radius, branch 1.14.0

dae-allowed: Remove nagging about making option mandatory

2026-01-24T16:20:37+00:00

Signed-off-by: Denys Fedoryshchenko

radius: Implement DM/CoA security hardening by restricting source ip addresses

2025-12-22T22:48:30+00:00

Signed-off-by: Denys Fedoryshchenko

fix(radius): refresh session stats in req_set_stat

2025-12-15T20:49:18+00:00

Signed-off-by: Denys Fedoryshchenko

Merge pull request #279 from nuclearcat/fix-acct

2025-12-13T15:06:13+00:00

acct: Fix losing some data on interface down due wrong sequence

fix(accounting): preserve last counters on disconnect

2025-12-13T13:40:59+00:00

Ensure accounting values include the most recent traffic sample when a session disconnects, preventing the final interval from being dropped and avoiding under-reported totals in usage/billing. Big thanks Dmitriy Eshenko for patch and testing Author: Dmitriy Eshenko Signed-off-by: Denys Fedoryshchenko

crypto: Removed internal tomcat crypto.

2025-12-10T17:16:42+00:00

Signed-off-by: Andrii Melnychenko

Merge pull request #267 from nuclearcat/fix-ssl-warnings

2025-11-28T06:39:54+00:00

Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIs

fixup! Add RADIUS blast attack protection with Message-Authenticator

2025-11-26T18:29:52+00:00

Not a bug, but to supress warnings. Signed-off-by: Denys Fedoryshchenko

Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIs

2025-11-26T18:23:38+00:00

We are using similar approach as in other projects, easiest one, but probably in future it will break as soon as this functions will be removed completely. Signed-off-by: Denys Fedoryshchenko

Add RADIUS blast attack protection with Message-Authenticator

2025-07-01T11:32:13+00:00

Recently FreeRadius started to complain accel-ppp doesn't pass BlastRADIUS check. This commit fixes that. This commit implements protection against RADIUS blast attacks by adding support for the Message-Authenticator attribute in Access-Request packets. This security enhancement helps prevent unauthorized access attempts and replay attacks on RADIUS authentication. - Added new configuration option `blast-protection=1` in [radius] to enable Message-Authenticator inclusion - Implemented HMAC-MD5 calculation for Message-Authenticator attribute (RFC 2869) - Modified packet building to include 18-byte Message-Authenticator attribute when enabled - Updated packet structure to support signing with shared secret Enable blast protection by adding to the `[radius]` section: ``` blast-protection=1 ``` When enabled, all Access-Request packets will include a Message-Authenticator attribute with HMAC-MD5 signature, providing cryptographic integrity verification and protection against packet modification attacks. Signed-off-by: Denys Fedoryshchenko