accel-ppp.git/accel-pppd/radius/dm_coa.c, branch marekm72-patch-1-printf-hHigh performance PPTP/L2TP/SSTP/PPPoE/IPoE server for Linux (mirror of https://github.com/marekm72/accel-ppp.git)
https://git.amelek.net/marekm72/accel-ppp.git/atom?h=marekm72-patch-1-printf-h2025-12-22T22:48:30+00:00radius: Implement DM/CoA security hardening by restricting source ip addresses2025-12-22T22:48:30+00:00Denys Fedoryshchenkodenys.f@collabora.com2025-12-21T08:44:22+00:00urn:sha1:2550fe6cd9de9734cbc41179931fd029d8d132d6
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
crypto: Removed internal tomcat crypto.2025-12-10T17:16:42+00:00Andrii Melnychenkoa.melnychenko@vyos.io2025-09-29T16:14:48+00:00urn:sha1:c912d09018828745e3bcba268cd02a611e324d54
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
Add RADIUS blast attack protection with Message-Authenticator2025-07-01T11:32:13+00:00Denys Fedoryshchenkodenys.f@collabora.com2025-06-25T19:31:08+00:00urn:sha1:1ce263f13ac0b3aed3b14b4a9bb6a51afe210684
Recently FreeRadius started to complain accel-ppp doesn't pass
BlastRADIUS check. This commit fixes that.
This commit implements protection against RADIUS blast attacks
by adding support for the Message-Authenticator attribute in
Access-Request packets. This security enhancement helps
prevent unauthorized access attempts and replay attacks
on RADIUS authentication.
- Added new configuration option `blast-protection=1`
in [radius] to enable Message-Authenticator inclusion
- Implemented HMAC-MD5 calculation for
Message-Authenticator attribute (RFC 2869)
- Modified packet building to include 18-byte Message-Authenticator
attribute when enabled
- Updated packet structure to support signing with shared secret
Enable blast protection by adding to the `[radius]` section:
```
blast-protection=1
```
When enabled, all Access-Request packets will include a
Message-Authenticator attribute with HMAC-MD5 signature,
providing cryptographic integrity verification and protection
against packet modification attacks.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
These changes are in response to PR comments2021-12-28T12:35:08+00:00rootroot@debian11-vyos-build.polycomm.net2021-12-28T12:35:08+00:00urn:sha1:2bbeb7eb0a56ea34a8a3d2f7aba81836bcb50835Added VRF support for radius request and DM/CoA server.2021-12-28T09:50:44+00:00rootroot@debian11-vyos-build.polycomm.net2021-12-28T09:50:44+00:00urn:sha1:2804a115fc2cd0d785d9a6dcb0be247c97c32d69
New configuration format:
[radius]
server=address,secret[,auth-port=1812][,acct-port=1813][,vrf=VRF_NAME][,req-limit=0][,fail-timeout=0,max-fail=0,][,weight=1][,backup]
dae-server=x.x.x.x:port,secret[,vrf=VRF_NAME]
By default, VRF name is undefined.
vrf: T10: Add VRF support2021-12-16T20:03:52+00:00DmitriyEshenkodmitriy.eshenko@vyos.io2021-12-10T16:43:42+00:00urn:sha1:737bf4d8b6e9e1bf50be69e8c99028bb2696190c
Co-authored-by: Sergey V. Lobanov <svlobanov@users.noreply.github.com>
Co-authored-by: Vladislav Grishenko <themiron@users.noreply.github.com>
radius: dm/coa: add invalid packet logging2019-08-30T11:49:07+00:00Vladislav Grishenkothemiron@mail.ru2019-08-30T11:49:07+00:00urn:sha1:76819cf1dceb6f4181536073e0e42da0d2f89134radius: fixed bug (inserting empty Class)2019-03-08T09:48:41+00:00Dmitry Kozlovxeb@mail.ru2019-03-08T09:48:41+00:00urn:sha1:fbac1573d3def4eef27e55272125242e5a1711e1radius: update Session-Timeout by CoA2016-06-07T17:40:55+00:00Dmitry Kozlovxeb@mail.ru2016-06-07T17:40:55+00:00urn:sha1:429ca0e6188594e5ccbce639d2d22576e5256e62remove trailing whitespaces2014-11-22T05:56:40+00:00Dmitry Kozlovxeb@mail.ru2014-11-22T05:56:40+00:00urn:sha1:81ca3923a29ea9b67f7291be23b210019546aa5f