diff options
| author | Ritika Chopra <r.chopra@vyos.io> | 2026-09-01 15:42:41 -0700 |
|---|---|---|
| committer | Ritika Chopra <r.chopra@vyos.io> | 2026-09-29 00:04:05 -0700 |
| commit | 34559030250f53d7bb3a12a24fb515c6e78a8876 (patch) | |
| tree | b13354065e222099f71502c9ccdb35124430290d /python | |
| parent | f15b8b2eebd4afa9ece0ed8034f08f279726c854 (diff) | |
| download | vyos-1x-34559030250f53d7bb3a12a24fb515c6e78a8876.tar.gz vyos-1x-34559030250f53d7bb3a12a24fb515c6e78a8876.zip | |
T9351: Accel-PPP-NG: RADIUS: CLI support for Message Authenticator attribute in Access packets
Add CLI options to control Message-Authenticator handling for Access
packets.
The new options allow including Message-Authenticator in Access-Request
packets and requiring it in Access-Accept, Access-Reject and
Access-Challenge responses. Render the corresponding accel-ppp-ng
configuration options and warn when response validation is configured as
required while Access-Request packets are not configured to include
Message-Authenticator.
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/accel_ppp_util.py | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/python/vyos/accel_ppp_util.py b/python/vyos/accel_ppp_util.py index c70f3b017..01da7ab5c 100644 --- a/python/vyos/accel_ppp_util.py +++ b/python/vyos/accel_ppp_util.py @@ -162,6 +162,15 @@ def verify_accel_ppp_authentication(config, local_users=True): if not dict_search("authentication.radius.server", config): raise ConfigError("RADIUS authentication requires at least one server") + ma_include_request = dict_search( + 'authentication.radius.message_authenticator.include_access_request', config) + ma_require_response = dict_search( + 'authentication.radius.message_authenticator.require_access_response', config) + if ma_require_response is not None and ma_include_request is None: + Warning( + 'Message-Authenticator is not included in Access-Request packets; ' + 'so the RADIUS server might omit it from Access response packets') + for server in dict_search("authentication.radius.server", config): radius_config = config["authentication"]["radius"]["server"][server] if "key" not in radius_config: |