From 1ce263f13ac0b3aed3b14b4a9bb6a51afe210684 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Wed, 25 Jun 2025 22:31:08 +0300 Subject: Add RADIUS blast attack protection with Message-Authenticator Recently FreeRadius started to complain accel-ppp doesn't pass BlastRADIUS check. This commit fixes that. This commit implements protection against RADIUS blast attacks by adding support for the Message-Authenticator attribute in Access-Request packets. This security enhancement helps prevent unauthorized access attempts and replay attacks on RADIUS authentication. - Added new configuration option `blast-protection=1` in [radius] to enable Message-Authenticator inclusion - Implemented HMAC-MD5 calculation for Message-Authenticator attribute (RFC 2869) - Modified packet building to include 18-byte Message-Authenticator attribute when enabled - Updated packet structure to support signing with shared secret Enable blast protection by adding to the `[radius]` section: ``` blast-protection=1 ``` When enabled, all Access-Request packets will include a Message-Authenticator attribute with HMAC-MD5 signature, providing cryptographic integrity verification and protection against packet modification attacks. Signed-off-by: Denys Fedoryshchenko --- accel-pppd/radius/dm_coa.c | 1 + 1 file changed, 1 insertion(+) (limited to 'accel-pppd/radius/dm_coa.c') diff --git a/accel-pppd/radius/dm_coa.c b/accel-pppd/radius/dm_coa.c index e88cc347..8eb45a60 100644 --- a/accel-pppd/radius/dm_coa.c +++ b/accel-pppd/radius/dm_coa.c @@ -106,6 +106,7 @@ static int dm_coa_send_nak(int fd, struct rad_packet_t *req, struct sockaddr_in if (err_code) rad_packet_add_int(reply, NULL, "Error-Cause", err_code); + // TODO: We need to add Message-Authenticator attribute here if (rad_packet_build(reply, RA)) { rad_packet_free(reply); return -1; -- cgit v1.2.3