summaryrefslogtreecommitdiff
path: root/accel-pppd/radius/dm_coa.c
AgeCommit message (Collapse)Author
2026-09-07radius: validate VRF names through Access-Accept and CoADenys Fedoryshchenko
Reject oversized and embedded-NUL VRF attributes and allocation failures. Keep explicit CoA lengths, restrict removal to literal 0, and bound the session API and shared interface lookup. Preserve default VRF removal. Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8611, with the same validation boundary extended to the CoA path. Co-authored-by: Ritika Chopra <r.chopra@vyos.io>
2025-12-23radius: Implement DM/CoA security hardening by restricting source ip addressesDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-10crypto: Removed internal tomcat crypto.Andrii Melnychenko
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
2025-07-01Add RADIUS blast attack protection with Message-AuthenticatorDenys Fedoryshchenko
Recently FreeRadius started to complain accel-ppp doesn't pass BlastRADIUS check. This commit fixes that. This commit implements protection against RADIUS blast attacks by adding support for the Message-Authenticator attribute in Access-Request packets. This security enhancement helps prevent unauthorized access attempts and replay attacks on RADIUS authentication. - Added new configuration option `blast-protection=1` in [radius] to enable Message-Authenticator inclusion - Implemented HMAC-MD5 calculation for Message-Authenticator attribute (RFC 2869) - Modified packet building to include 18-byte Message-Authenticator attribute when enabled - Updated packet structure to support signing with shared secret Enable blast protection by adding to the `[radius]` section: ``` blast-protection=1 ``` When enabled, all Access-Request packets will include a Message-Authenticator attribute with HMAC-MD5 signature, providing cryptographic integrity verification and protection against packet modification attacks. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2021-12-28These changes are in response to PR commentsroot
2021-12-28Added VRF support for radius request and DM/CoA server.root
New configuration format: [radius] server=address,secret[,auth-port=1812][,acct-port=1813][,vrf=VRF_NAME][,req-limit=0][,fail-timeout=0,max-fail=0,][,weight=1][,backup] dae-server=x.x.x.x:port,secret[,vrf=VRF_NAME] By default, VRF name is undefined.
2021-12-16vrf: T10: Add VRF supportDmitriyEshenko
Co-authored-by: Sergey V. Lobanov <svlobanov@users.noreply.github.com> Co-authored-by: Vladislav Grishenko <themiron@users.noreply.github.com>
2019-08-30radius: dm/coa: add invalid packet loggingVladislav Grishenko
2019-03-08radius: fixed bug (inserting empty Class)Dmitry Kozlov
2016-06-07radius: update Session-Timeout by CoADmitry Kozlov
2014-11-22remove trailing whitespacesDmitry Kozlov
2014-05-12triton: improved epoll events handlingDmitry Kozlov
2012-08-03fixed complilation for 3.4 kernelKozlov Dmitry
2012-07-13Merge commit '178b27b0b6d60afdc5039dc3d995f4ad000b5486'Kozlov Dmitry
* commit '178b27b0b6d60afdc5039dc3d995f4ad000b5486': radius: update Class attribute by CoA request
2012-07-13radius: update Class attribute by CoA requestKozlov Dmitry
2012-06-19general preparation for IPoE integrationKozlov Dmitry
2012-01-13set FD_CLOEXEC on opened file descriptorsKozlov Dmitry
2011-09-03implemented crypto library selection: -DCRYPTO=OPENSSL|TOMCRYPT|INTERNAL ↵Kozlov Dmitry
(default OPENSSL)
2011-08-24radius: better radius server fails handlingKozlov Dmitry
2011-05-301.3.6 releaseKozlov Dmitry
2011-05-30rewrited initialization procedure (fix gcc-4.6 builds)Kozlov Dmitry
2011-01-05rename accel-pptp to accel-pppDmitry Kozlov
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-30 21:35:05 +0000