diff options
Diffstat (limited to 'accel-pppd/radius/dm_coa.c')
| -rw-r--r-- | accel-pppd/radius/dm_coa.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/accel-pppd/radius/dm_coa.c b/accel-pppd/radius/dm_coa.c index e88cc347..df8cdf3e 100644 --- a/accel-pppd/radius/dm_coa.c +++ b/accel-pppd/radius/dm_coa.c @@ -10,7 +10,7 @@ #include <netinet/in.h> #include <sys/socket.h> -#include "crypto.h" +#include <openssl/md5.h> #include "triton.h" #include "events.h" @@ -106,6 +106,7 @@ static int dm_coa_send_nak(int fd, struct rad_packet_t *req, struct sockaddr_in if (err_code) rad_packet_add_int(reply, NULL, "Error-Cause", err_code); + // TODO: We need to add Message-Authenticator attribute here if (rad_packet_build(reply, RA)) { rad_packet_free(reply); return -1; @@ -266,6 +267,15 @@ static int dm_coa_read(struct triton_md_handler_t *h) rad_packet_print(pack, NULL, log_debug); } + if (rad_dae_src_check(addr.sin_addr.s_addr)) { + char ipbuf[INET_ADDRSTRLEN]; + const char *ipstr; + + ipstr = inet_ntop(AF_INET, &addr.sin_addr, ipbuf, sizeof(ipbuf)); + log_warn("radius:dm_coa: source %s not allowed\n", ipstr ? ipstr : "unknown"); + goto out_err_no_reply; + } + if (dm_coa_check_RA(pack, conf_dm_coa_secret)) { log_warn("radius:dm_coa: RA validation failed\n"); goto out_err_no_reply; |