Add RADIUS blast attack protection with Message-Authenticator

Recently FreeRadius started to complain accel-ppp doesn't pass
BlastRADIUS check. This commit fixes that.

This commit implements protection against RADIUS blast attacks
by adding support for the Message-Authenticator attribute in
Access-Request packets. This security enhancement helps
prevent unauthorized access attempts and replay attacks
on RADIUS authentication.

- Added new configuration option `blast-protection=1`
  in [radius] to enable Message-Authenticator inclusion
- Implemented HMAC-MD5 calculation for
  Message-Authenticator attribute (RFC 2869)
- Modified packet building to include 18-byte Message-Authenticator
  attribute when enabled
- Updated packet structure to support signing with shared secret

Enable blast protection by adding to the `[radius]` section:
```
blast-protection=1
```

When enabled, all Access-Request packets will include a
Message-Authenticator attribute with HMAC-MD5 signature,
providing cryptographic integrity verification and protection
against packet modification attacks.

Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/accel-pppd/radius/dm_coa.c b/accel-pppd/radius/dm_coa.c
index e88cc347..8eb45a60 100644
--- a/accel-pppd/radius/dm_coa.c
+++ b/accel-pppd/radius/dm_coa.c
@@ -106,6 +106,7 @@ static int dm_coa_send_nak(int fd, struct rad_packet_t *req, struct sockaddr_in
 	if (err_code)
 		rad_packet_add_int(reply, NULL, "Error-Cause", err_code);
 
+	// TODO: We need to add Message-Authenticator attribute here
 	if (rad_packet_build(reply, RA)) {
 		rad_packet_free(reply);
 		return -1;