accel-ppp.git/accel-pppd/ctrl/pppoe/pppoe.c, branch 1.15.0

ppp: add remaining discovery and buffer reuse safeguards

2026-09-07T19:08:04+00:00

Require exactly one PADR Service-Name, drop Echo-Requests exceeding the negotiated MTU, and clear pooled payloads before reuse. Retain upstream's silent malformed-PADR rejection and received-packet length checks. Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8464/T8830. Co-authored-by: Ritika Chopra

utils: centralize unaligned integer accessors

2026-09-01T06:08:47+00:00

pppoe: decode tag integers alignment-safely

2026-09-01T05:55:54+00:00

Read peer-controlled PPPoE tag and TR-101 integer fields through aligned temporaries, validate PPP-Max-Payload before formatting, and avoid unaligned cookie timestamp accesses.

utils: centralize min macro

2026-08-11T18:42:07+00:00

Several userspace translation units carry identical local min() definitions. Move the guarded definition to utils.h and include it from each user so there is one implementation to maintain. The Linux min() macro lives in kernel-internal headers and is not part of the userspace UAPI. Clang/LLVM does not provide a compatible min macro either: C++ code uses std::min and Clang's similarly named operations use explicit builtin names. The userspace interface, where available, exposes uppercase MIN instead. Keep the #ifndef guard to preserve the behavior of the existing local definitions and avoid redefining a lowercase min macro supplied by an unrelated third-party header.

pppoe: check for a truncated tag header in PADI

2026-08-11T18:29:49+00:00

The PADI tag loop read tag_len before checking that the tag header itself fits into the declared payload length, so a PADI ending with a partial tag made it read up to 2 bytes past the receive buffer. print_packet() and the PADR loop already have this check, add the missing one.

pppoe: account for the tag header in the add_tag2 bound

2026-08-11T18:29:36+00:00

add_tag2() checked that the tag payload fits into the packet buffer, but the memcpy() copied the 4 byte tag header as well, so the check was short by sizeof(struct pppoe_tag) - 1 bytes. All callers build the packet in a ETHER_MAX_LEN stack buffer and pass tags taken from the received discovery packet. A PADI carrying a Host-Uniq tag of 1454..1456 bytes therefore made pppoe_send_PADO() write up to 3 bytes of peer supplied data past the end of the buffer. The PADS, PADT and error paths are affected in the same way. Include the tag header in the bound, and drop the tag_len < 0 test which can never be true since ntohs() returns an unsigned value.

Merge pull request #323 from nuclearcat/stability-fixes

2026-06-23T15:58:26+00:00

Stability fixes

pppoe: handle missing service-name tag

2026-06-23T14:36:34+00:00

Rejecting any PADR lacking a Service-Name tag (RFC 2516 compliance)

2026-05-29T05:58:41+00:00

Signed-off-by: Denys Fedoryshchenko

session: encapsulate statistics counters

2026-05-04T00:09:49+00:00

Group the core session starting, active, and finishing statistics behind the private ap_session_stat storage in session.c instead of exposing writable counters through ap_session.h. This keeps ownership inside the session core while preserving the existing CLI and ACCEL-PPP-MIB counter semantics. Route session counter updates through ap_session_stat_*() helpers. Session start, activation, termination, finish, and shutdown-idle paths no longer open-code individual counter increments/decrements; the update policy now lives beside the session-owned storage and uses relaxed atomic operations for the simple state counters. Make the CLI show-stat path render from a local snapshot and convert the PPP SNMP starting/active/finishing scalars from watched raw pointers to scalar handlers. PPP controllers now read max-session limits through ap_session_stat_starting() and ap_session_stat_active(), removing external direct access to ap_session_stat. Signed-off-by: Denys Fedoryshchenko