accel-ppp.git/accel-pppd/ctrl/ipoe/dhcpv4_options.c, branch 1.15.0

ipoe: harden DHCPv4 option decoding

2026-09-01T05:55:54+00:00

Validate known options before extracting fields, bound Relay-Agent and classless-route subformats, and replace unaligned DHCP option accesses in notification, relay, and session paths.

ipoe: bounds check classless routes and avoid unaligned reads

2026-08-10T05:44:13+00:00

The destination was always read as a 32 bit word regardless of how many significant octets the prefix length implies, and the gateway was read without checking that four bytes remain in the option. Neither read was bounded by the end of the option, so a client could make the decoder run past it. dhcpv4_check_options() only enforces a minimum length of 5 for option 121, which is short of the 9 bytes a /32 route needs. Reading the destination as a word was also wrong for any prefix shorter than /32, as it pulled in the first octets of the gateway: 10.0.1.0/24 via 1.1.1.1 printed as 10.0.0.1/24. Read only the significant octets, check the remaining length before both reads, and copy the gateway rather than dereferencing a possibly unaligned pointer.

ipoe: fix netmask computation for classless routes

2026-08-10T05:43:17+00:00

The netmask was built with a loop shifting 1 into place, which was wrong in three ways. At i == 0 it evaluated 1 << 32, undefined for a 32 bit int, and at i == 1 it shifted into the sign bit of a signed value. The shift amount was off by one, so a /24 produced 0xfffffe00 rather than 0xffffff00. And mask1 was initialized once before the loop over the routes and only ever OR'ed into, so the mask of every route accumulated into the routes that followed it. A well formed option carrying 10.0.1.0/24 via 1.1.1.1 and 172.16.0.0/12 via 2.2.2.2 printed as 10.0.0.1/24 and 172.16.2.0/12. Compute the mask directly instead, and reject a prefix length above 32 rather than shifting by a negative amount.

ci: add tests execution with asan and ubsan

2025-08-19T18:59:40+00:00

ipoe: fixed DHCP option 42 (ntp servers)

2025-01-22T13:52:30+00:00

Allowed using multiple NTP servers in DHCP option 42

remove trailing whitespaces

2014-11-22T05:56:40+00:00

ipoe: various fixes

2013-01-26T12:40:53+00:00

initial ipoe implementation

2012-06-22T14:11:19+00:00