summaryrefslogtreecommitdiff
path: root/accel-pppd/radius/dm_coa.c
AgeCommit message (Collapse)Author
2025-12-23radius: Implement DM/CoA security hardening by restricting source ip addressesDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-10crypto: Removed internal tomcat crypto.Andrii Melnychenko
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
2025-07-01Add RADIUS blast attack protection with Message-AuthenticatorDenys Fedoryshchenko
Recently FreeRadius started to complain accel-ppp doesn't pass BlastRADIUS check. This commit fixes that. This commit implements protection against RADIUS blast attacks by adding support for the Message-Authenticator attribute in Access-Request packets. This security enhancement helps prevent unauthorized access attempts and replay attacks on RADIUS authentication. - Added new configuration option `blast-protection=1` in [radius] to enable Message-Authenticator inclusion - Implemented HMAC-MD5 calculation for Message-Authenticator attribute (RFC 2869) - Modified packet building to include 18-byte Message-Authenticator attribute when enabled - Updated packet structure to support signing with shared secret Enable blast protection by adding to the `[radius]` section: ``` blast-protection=1 ``` When enabled, all Access-Request packets will include a Message-Authenticator attribute with HMAC-MD5 signature, providing cryptographic integrity verification and protection against packet modification attacks. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2021-12-28These changes are in response to PR commentsroot
2021-12-28Added VRF support for radius request and DM/CoA server.root
New configuration format: [radius] server=address,secret[,auth-port=1812][,acct-port=1813][,vrf=VRF_NAME][,req-limit=0][,fail-timeout=0,max-fail=0,][,weight=1][,backup] dae-server=x.x.x.x:port,secret[,vrf=VRF_NAME] By default, VRF name is undefined.
2021-12-16vrf: T10: Add VRF supportDmitriyEshenko
Co-authored-by: Sergey V. Lobanov <svlobanov@users.noreply.github.com> Co-authored-by: Vladislav Grishenko <themiron@users.noreply.github.com>
2019-08-30radius: dm/coa: add invalid packet loggingVladislav Grishenko
2019-03-08radius: fixed bug (inserting empty Class)Dmitry Kozlov
2016-06-07radius: update Session-Timeout by CoADmitry Kozlov
2014-11-22remove trailing whitespacesDmitry Kozlov
2014-05-12triton: improved epoll events handlingDmitry Kozlov
2012-08-03fixed complilation for 3.4 kernelKozlov Dmitry
2012-07-13Merge commit '178b27b0b6d60afdc5039dc3d995f4ad000b5486'Kozlov Dmitry
* commit '178b27b0b6d60afdc5039dc3d995f4ad000b5486': radius: update Class attribute by CoA request
2012-07-13radius: update Class attribute by CoA requestKozlov Dmitry
2012-06-19general preparation for IPoE integrationKozlov Dmitry
2012-01-13set FD_CLOEXEC on opened file descriptorsKozlov Dmitry
2011-09-03implemented crypto library selection: -DCRYPTO=OPENSSL|TOMCRYPT|INTERNAL ↵Kozlov Dmitry
(default OPENSSL)
2011-08-24radius: better radius server fails handlingKozlov Dmitry
2011-05-301.3.6 releaseKozlov Dmitry
2011-05-30rewrited initialization procedure (fix gcc-4.6 builds)Kozlov Dmitry
2011-01-05rename accel-pptp to accel-pppDmitry Kozlov
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-14 19:30:03 +0000