accel-ppp.git/accel-pppd/ctrl/l2tp/l2tp_prot.h, branch stableHigh performance PPTP/L2TP/SSTP/PPPoE/IPoE server for Linux (mirror of https://github.com/accel-ppp/accel-ppp.git)
https://git.amelek.net/accel-ppp/accel-ppp.git/atom?h=stable2020-09-05T21:38:35+00:00l2tp: fix RCE through buffer overflow & fix LE/BE compatibility2020-09-05T21:38:35+00:00Vladislav Grishenkothemiron@mail.ru2020-09-05T21:38:35+00:00urn:sha1:2324bcd5ba12cf28f47357a8f03cd41b7c04c52b
Unsufficent checks of valid l2tp header & avp length cause possible
RCE through buffer overflow, reported by https://github.com/WinMin
swings & leommxj, Chaitin Security Research Lab. Add missed header
length and avp length validation to fix the issue.
Order of struct bitfields is implementation-defined so current code
doesn't play well with big-endian arch. switch to explicit flag bit
checking/gathering to fix the issue.
RFC 2661 and 3931 requires that length, seqeuence flags must be set
and offset flag must not be set, so avp-premissive can't help in
this cases.
l2tp: Take StopCCN's AVPs into account2013-02-13T13:24:03+00:00Guillaume Naultg.nault@alphalink.fr2013-02-13T12:50:14+00:00urn:sha1:cb6680609a6e9c66d709c028d00f89fcf3ccb703
Use the Assigned Tunnel ID and Result Code AVPs when handling StopCCN
messages.
The Result Code AVP is used to improve log messages, while the Assigned
Tunnel ID is used to set the tunnel's peer-tid field.
Setting peer-tid makes the ZLB to be sent to the right tunnel in case
no Assigned Tunnel ID had been received yet (this happens when the host
sends an SCCRQ but the peer directly rejects the connection with
StopCCN).
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
rename accel-pptp to accel-ppp2011-01-05T12:18:59+00:00Dmitry Kozlovxeb@mail.ru2011-01-05T12:18:59+00:00urn:sha1:f28cb1b0a926f1ea98700b7871537ad1793511fd