radius-auth: fix Framed-IPv6-Prefix routes being silently dropped

When processing a RADIUS Access-Accept with Framed-IPv6-Prefix, the code
passed the wrong value for it. Corrected by passing the actual prefix.

Fixes: #710

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

NEWS

@@ -3,6 +3,7 @@
 - Vhosts now inherit configuration options from the default vhost if
   they are not overridden (#705)
 - `tunnel-all-dns` now works correctly when set in per-user/group config (#708)
+- radius: fixed Framed-IPv6-Prefix routes being silently dropped (#710)
 
 
 * Version 1.4.2 (released 2026-04-16)

src/auth/radius.c

@@ -487,8 +487,8 @@ static int radius_auth_pass(void *ctx, const char *pass, unsigned int pass_len)
 							"%s/%u", txt,
 							(unsigned int)(unsigned char)
 								vp->strvalue[1]);
-						append_route(pctx, vp->strvalue,
-							     vp->lvalue);
+						append_route(pctx, route,
+							     strlen(route));
 					}
 				}
 			} else if (vp->attribute ==

tests/data/raddb/users

@@ -146,6 +146,14 @@ testtime	Cleartext-Password := "test"
 	RP-Upstream-Speed-Limit = 16,
 	RP-Downstream-Speed-Limit = 64
 
+test-ipv6prefix	Cleartext-Password := "test"
+	Service-Type = Framed-User,
+	Framed-Protocol = PPP,
+	Framed-IP-Address = 192.168.66.194,
+	Framed-IP-Netmask = 255.255.255.0,
+	Framed-IPv6-Prefix = fd00:abcd:ef00::/48,
+	Framed-MTU = 1500
+
 test1-otp            Cleartext-Password := "test1-otp-stage%{string:State}", Tmp-Integer-0 := 3
         Service-Type = Framed-User,
         Framed-Protocol = PPP,

tests/meson.build

@@ -297,7 +297,8 @@ if get_option('root-tests')
 
   if radcli_dep.found()
     foreach s : ['radius', 'radius-group', 'radius-multi-group',
-                 'radius-multi-group-comma', 'radius-otp', 'radius-config']
+                 'radius-multi-group-comma', 'radius-otp', 'radius-config',
+                 'radius-ipv6-prefix']
       test(s, find_program(s),
         env:     test_env,
         timeout: 300,

tests/radius-ipv6-prefix

@@ -0,0 +1,124 @@
+#!/bin/bash
+#
+# Copyright (C) 2026 Nikos Mavrogiannopoulos
+#
+# This file is part of ocserv.
+#
+# ocserv is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at
+# your option) any later version.
+#
+# ocserv is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# Reproducer for: Framed-IPv6-Prefix routes returned by RADIUS are silently
+# dropped because append_route() receives raw binary data instead of the
+# formatted "addr/prefix" string (issue #710).
+
+OCCTL="${OCCTL:-../src/occtl/occtl}"
+SERV="${SERV:-../src/ocserv}"
+srcdir=${srcdir:-.}
+PIDFILE=ocserv-pid.$$.tmp
+CLIPID=oc-pid.$$.tmp
+PATH=${PATH}:/usr/sbin
+IP=$(which ip)
+OUTFILE=traffic.$$.tmp
+RADIUSLOG=radius-ipv6-prefix.$$.log
+RADIUSD=$(which radiusd)
+
+if test -z "${RADIUSD}";then
+	RADIUSD=$(which freeradius)
+fi
+
+. `dirname $0`/common.sh
+
+eval "${GETPORT}"
+
+if test -z "${IP}";then
+	echo "no IP tool is present"
+	exit 77
+fi
+
+if test -z "${RADIUSD}";then
+	echo "no radiusd is present"
+	exit 77
+fi
+
+if test "$(id -u)" != "0";then
+	echo "This test must be run as root"
+	exit 77
+fi
+
+echo "Testing that RADIUS Framed-IPv6-Prefix routes are applied to the session..."
+
+function finish {
+  echo " * Cleaning up..."
+  cleanup_client_server
+  test -n "${RADIUSPID}" && kill ${RADIUSPID} >/dev/null 2>&1
+  rm -f ${OUTFILE} 2>&1
+  test -f "${RADIUSLOG}" && cat "${RADIUSLOG}"
+  rm -f "${RADIUSLOG}"
+}
+trap finish EXIT
+
+# server address
+. `dirname $0`/random-net.sh
+
+# These addresses must match the raddb/users entry for test-ipv6prefix
+VPNNET=192.168.66.0/24
+VPNADDR=192.168.66.1
+CLIVPNADDR=192.168.66.194
+VPNNET6=fd91:6d14:7241:dc6a::/112
+VPNADDR6=fd91:6d14:7241:dc6a::1
+OCCTL_SOCKET=./occtl-radius-ipv6-prefix-$$.socket
+
+. `dirname $0`/ns.sh
+
+${CMDNS2} ${IP} link set dev lo up
+
+# Run servers
+rm -f ${RADIUSLOG}
+${CMDNS2} ${RADIUSD} -d ${RADDB_DIR}/ -s -xx -l ${RADIUSLOG} &
+RADIUSPID=$!
+
+update_config radius.config
+if test "$VERBOSE" = 1;then
+	DEBUG="-d 3"
+fi
+
+${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$!
+
+wait_file_contents "${RADIUSLOG}" "Ready to process requests" 30
+wait_ns_port t ${PORT}
+
+echo " * Connecting to ${ADDRESS}:${PORT} as test-ipv6prefix..."
+USERNAME=test-ipv6prefix
+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} \
+	--servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= \
+	-s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} \
+	--passwd-on-stdin -b )
+if test $? != 0;then
+	echo "Could not connect to server"
+	exit 1
+fi
+
+sleep 3
+
+# Verify the IPv6 prefix route from RADIUS Framed-IPv6-Prefix appears in session
+MATCH="fd00:abcd:ef00::/48"
+${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME} >${OUTFILE} 2>&1
+grep "${MATCH}" ${OUTFILE}
+if test $? != 0;then
+	cat ${OUTFILE}
+	echo "IPv6 prefix route from RADIUS Framed-IPv6-Prefix not found in session"
+	exit 1
+fi
+
+exit 0