accel-ppp.git, branch master

Merge pull request #333 from nuclearcat/triton-reload-race

2026-07-13T22:09:13+00:00

triton: reject concurrent config reload requests

Merge pull request #325 from nuclearcat/cli-ipv6-fixes

2026-07-13T22:08:54+00:00

cli: proper ipv6 support for cli interface

Merge pull request #337 from nuclearcat/fix-ipv6-ifid

2026-07-13T22:07:23+00:00

Fix ipv6 ifid and UB shift

ipdb: fix undefined shift in build_ip6_addr() host-bits mask

2026-07-12T20:12:03+00:00

For prefix lengths 65..127 the mask for the host bits was built with (1 << (128 - prefix_len)) - 1 using a plain int literal, which is undefined behavior for shift counts of 31 and above, i.e. for any prefix length from 65 to 97. Use a 64-bit constant for the shift.

ipv6cp: fix byte order of default interface-id values

2026-07-12T20:11:39+00:00

The default fixed interface-ids conf_intf_id_val=1 and conf_peer_intf_id_val=2 were plain host-order integers, while every consumer (build_ip6_addr(), ifcfg.c, nd.c, dhcpv6.c) treats intf_id as an opaque 8-byte value in network byte order and copies it verbatim into the low 64 bits of the IPv6 address. parse_intfid() also produces network byte order, so only the built-in defaults were affected. On little-endian hosts this produced fe80::100:0:0:0 (and ::200:0:0:0 for the peer) instead of the intended fe80::1 / ::2 whenever ipv6-intf-id / ipv6-peer-intf-id were not set in the config. Store the defaults with htobe64() so the resulting addresses are ::1 and ::2 regardless of host endianness. The assignment is done in init() because htobe64() is not a constant expression on all libcs. Note: on little-endian deployments this changes the server link-local address from fe80::100:0:0:0 to fe80::1 when ipv6-intf-id is unset.

triton: reject concurrent config reload requests

2026-07-07T23:53:26+00:00

triton_conf_reload() kept the notify callback in a single global slot, and the CLI reload command likewise stored its wakeup context in a global. A second reload issued while the first was still pending (from another CLI connection or SIGUSR1) overwrote both, so only the last requester was notified when the reload completed; the earlier CLI context slept forever in triton_context_schedule() and that connection hung while the rest of the daemon kept running. Make triton_conf_reload() return -1 when a reload is already pending, checked atomically under threads_lock, and pass a caller-provided arg through to the notify callback so each requester keeps its own state instead of sharing globals. The CLI reload's request struct is heap-allocated rather than kept on reload_exec's stack, since triton_context_schedule() can migrate a suspended context onto a different worker thread's stack before the notify callback runs, which would otherwise leave conf_reload_notify() writing through a stale stack pointer. Also mark the reload as running (need_config_reload = 2) before dropping threads_lock to call __config_reload(). Previously a worker woken during the reload (e.g. by the notify callback waking the CLI context, or any stray context wakeup) could loop through the idle path, decrement the active count back to zero and re-enter __config_reload() while need_config_reload was still set, running a second concurrent conf_reload() and invoking the notify callback twice - corrupting the wakeup list and, with the CLI's heap request, writing through freed memory. The SIGUSR1 handler used to call triton_conf_reload() directly from signal context, taking spinlocks and potentially running the whole config parse inside the handler. It now only sets a flag; the main thread waits with sigtimedwait() and performs the reload (and logs a warning when one is already in progress) from normal thread context. The CLI now replies "reload is already in progress" instead of losing the first requester's wakeup.

Merge pull request #327 from nuclearcat/mac-filter-uaf-fix

2026-07-06T10:36:46+00:00

pppoe: fix use-after-free in mac_filter_load()

Merge pull request #326 from nuclearcat/ipv6-disable-fix

2026-07-06T10:05:57+00:00

ipoe: Fix OOPS if ipv6.disable=1

pppoe: fix use-after-free in mac_filter_load()

2026-07-06T08:28:53+00:00

When a mac-filter file line contained an octet > 255, the error path freed the entry but kept writing to it and linked it into mac_list. Validate all octets before allocating so invalid lines are skipped entirely. This is not considered a security vulnerability: the mac-filter file can only be configured by an administrator with access to the daemon config, or the CLI, both of which require privileged access. Fixes #307 Signed-off-by: Denys Fedoryshchenko

ipoe: Fix OOPS if ipv6.disable=1

2026-07-06T08:07:00+00:00

ipoe_recv() handles every ETH_P_IPV6 frame arriving on an IPoE by calling ipoe_lookup_rt6()/ip6_route_output(). On ipv6.disable=1 IPv6 FIB is not initialized. We can detect that by ipv6_mod_enabled() since kernel 4.8, and return RX_HANDLER_PASS, so packet falls thru normal stack and get discarded. Fixes: https://github.com/accel-ppp/accel-ppp/issues/313 Signed-off-by: Denys Fedoryshchenko