From 34559030250f53d7bb3a12a24fb515c6e78a8876 Mon Sep 17 00:00:00 2001 From: Ritika Chopra Date: Tue, 1 Sep 2026 15:42:41 -0700 Subject: T9351: Accel-PPP-NG: RADIUS: CLI support for Message Authenticator attribute in Access packets Add CLI options to control Message-Authenticator handling for Access packets. The new options allow including Message-Authenticator in Access-Request packets and requiring it in Access-Accept, Access-Reject and Access-Challenge responses. Render the corresponding accel-ppp-ng configuration options and warn when response validation is configured as required while Access-Request packets are not configured to include Message-Authenticator. --- python/vyos/accel_ppp_util.py | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'python') diff --git a/python/vyos/accel_ppp_util.py b/python/vyos/accel_ppp_util.py index c70f3b017..01da7ab5c 100644 --- a/python/vyos/accel_ppp_util.py +++ b/python/vyos/accel_ppp_util.py @@ -162,6 +162,15 @@ def verify_accel_ppp_authentication(config, local_users=True): if not dict_search("authentication.radius.server", config): raise ConfigError("RADIUS authentication requires at least one server") + ma_include_request = dict_search( + 'authentication.radius.message_authenticator.include_access_request', config) + ma_require_response = dict_search( + 'authentication.radius.message_authenticator.require_access_response', config) + if ma_require_response is not None and ma_include_request is None: + Warning( + 'Message-Authenticator is not included in Access-Request packets; ' + 'so the RADIUS server might omit it from Access response packets') + for server in dict_search("authentication.radius.server", config): radius_config = config["authentication"]["radius"]["server"][server] if "key" not in radius_config: -- cgit v1.2.3