accel-ppp.git/accel-pppd/ctrl/ipoe/ipoe.c, branch 1.15.0

ipoe: harden DHCPv4 option decoding

2026-09-01T05:55:54+00:00

Validate known options before extracting fields, bound Relay-Agent and classless-route subformats, and replace unaligned DHCP option accesses in notification, relay, and session paths.

ipoe: harden local-net prefix length parsing

2026-08-10T05:55:22+00:00

The netmask was built by shifting ~0, which is a signed int holding -1, and left shifting a negative value is undefined in C. Every compiler we build with produces the expected mask, so this is not a behaviour fix, but it trips -fsanitize=shift and relies on latitude the standard does not grant. Shift an unsigned operand instead. The prefix length itself was not validated properly either. strtoul() accepts a leading minus and negates, so 'local-net=10.0.0.0/-1' yields ULONG_MAX, which truncates to -1 in the int and passes the 'mask > 32' test. The shift count then becomes 33, which is out of range whether the operand is signed or unsigned. endptr was set but never looked at, so trailing garbage was silently ignored and '/abc' quietly became a /0. Keep the parsed value unsigned, reject anything that is not a complete number in 0..32, and only then narrow it.

ipoe: fix username string leak on early session teardown

2026-07-06T22:15:06+00:00

The ipoe-level ses->username always holds an allocated string (_strdup of ifname/calling-station-id, u_inet_ntoa buffer or lua result), but ipoe_session_free() never released it. Ownership is normally transferred in auth_result() via ap_session_set_username(), so the string was leaked whenever a session died before auth_result() ran: termination while starting, PWDB_WAIT never completing, or ipoe_create_interface() failure. The create-interface failure path also leaked the freshly allocated local copy outright, since it returned before the string was stored anywhere. Store the string in ses->username as soon as it is obtained and free it in ipoe_session_free(). auth_result() clears ses->username before handing ownership to ap_session_set_username(), so no double free is possible. Reported-by: Louis Scalbert (#101)

ipoe: fix dhcpv4 relay reply packet leak

2026-07-06T22:15:06+00:00

dhcpv4_relay_read() takes a reference on the reply packet for every registered listener context and hands it over via triton_context_call(). The receiving ipoe_ses_recv_dhcpv4_relay() consumes that reference by storing the packet in ses->dhcpv4_relay_reply, but the early-return branch taken when the original request is already gone dropped the reference without freeing the packet. This leaks one packet every time a relay reply races with the request being released, which happens regularly on busy relay-mode deployments. Reported-by: Louis Scalbert (#101)

strip: Fix invalid parsing

2026-05-21T12:50:42+00:00

strip() memmove count was one short, dropping the NULL terminator; dpado_parse error path leaked already-parsed range entries. Also affects ipoe. Since strip is identical in both, we can place fixed common function in utils. Reported-by: Khedor Signed-off-by: Denys Fedoryshchenko

session: encapsulate statistics counters

2026-05-04T00:09:49+00:00

Group the core session starting, active, and finishing statistics behind the private ap_session_stat storage in session.c instead of exposing writable counters through ap_session.h. This keeps ownership inside the session core while preserving the existing CLI and ACCEL-PPP-MIB counter semantics. Route session counter updates through ap_session_stat_*() helpers. Session start, activation, termination, finish, and shutdown-idle paths no longer open-code individual counter increments/decrements; the update policy now lives beside the session-owned storage and uses relaxed atomic operations for the simple state counters. Make the CLI show-stat path render from a local snapshot and convert the PPP SNMP starting/active/finishing scalars from watched raw pointers to scalar handlers. PPP controllers now read max-session limits through ap_session_stat_starting() and ap_session_stat_active(), removing external direct access to ap_session_stat. Signed-off-by: Denys Fedoryshchenko

ipoe: encapsulate statistics counters

2026-05-04T00:09:49+00:00

Group the IPOE starting, active, and delayed offer statistics in struct ipoe_stat_t and keep the storage private to ipoe.c instead of exposing writable stat_* globals. This keeps ownership inside the IPOE control code while preserving the existing CLI and ACCEL-PPP-MIB counter semantics. Route counter updates through ipoe_stat_*() helpers. Session setup, activation, teardown, and delayed offer queue paths no longer open-code individual counter increments/decrements; the update policy now lives beside the IPOE-owned storage and uses relaxed atomic operations for the simple state counters. Make the CLI show-stat path render from a local snapshot and convert the IPOE SNMP starting/active scalars from watched raw pointers to scalar handlers. SNMP now reads through ipoe_stat_starting() and ipoe_stat_active(), removing the old ipoe_get_stat() pointer escape hatch. Signed-off-by: Denys Fedoryshchenko

Update header includes in ipoe.c

2026-02-22T20:45:20+00:00

Replaced Linux-specific headers with their net counterparts.

netlink: Added VRF support

2026-01-30T03:25:54+00:00

Added VRF support to the iproute routines. Updated iproute* calls in the ipoe, radius, and dhcpv6 code. Signed-off-by: Andrii Melnychenko

ci: add tests execution with asan and ubsan

2025-08-19T18:59:40+00:00