accel-ppp.git/accel-pppd/ctrl/pppoe, branch master

ppp: add remaining discovery and buffer reuse safeguards

2026-09-07T19:08:04+00:00

Require exactly one PADR Service-Name, drop Echo-Requests exceeding the negotiated MTU, and clear pooled payloads before reuse. Retain upstream's silent malformed-PADR rejection and received-packet length checks. Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8464/T8830. Co-authored-by: Ritika Chopra

utils: centralize unaligned integer accessors

2026-09-01T06:08:47+00:00

pppoe: decode tag integers alignment-safely

2026-09-01T05:55:54+00:00

Read peer-controlled PPPoE tag and TR-101 integer fields through aligned temporaries, validate PPP-Max-Payload before formatting, and avoid unaligned cookie timestamp accesses.

utils: centralize min macro

2026-08-11T18:42:07+00:00

Several userspace translation units carry identical local min() definitions. Move the guarded definition to utils.h and include it from each user so there is one implementation to maintain. The Linux min() macro lives in kernel-internal headers and is not part of the userspace UAPI. Clang/LLVM does not provide a compatible min macro either: C++ code uses std::min and Clang's similarly named operations use explicit builtin names. The userspace interface, where available, exposes uppercase MIN instead. Keep the #ifndef guard to preserve the behavior of the existing local definitions and avoid redefining a lowercase min macro supplied by an unrelated third-party header.

pppoe: check for a truncated tag header in PADI

2026-08-11T18:29:49+00:00

The PADI tag loop read tag_len before checking that the tag header itself fits into the declared payload length, so a PADI ending with a partial tag made it read up to 2 bytes past the receive buffer. print_packet() and the PADR loop already have this check, add the missing one.

pppoe: account for the tag header in the add_tag2 bound

2026-08-11T18:29:36+00:00

add_tag2() checked that the tag payload fits into the packet buffer, but the memcpy() copied the 4 byte tag header as well, so the check was short by sizeof(struct pppoe_tag) - 1 bytes. All callers build the packet in a ETHER_MAX_LEN stack buffer and pass tags taken from the received discovery packet. A PADI carrying a Host-Uniq tag of 1454..1456 bytes therefore made pppoe_send_PADO() write up to 3 bytes of peer supplied data past the end of the buffer. The PADS, PADT and error paths are affected in the same way. Include the tag header in the bound, and drop the tag_len < 0 test which can never be true since ntohs() returns an unsigned value.

pppoe: fix use-after-free in mac_filter_load()

2026-07-06T08:28:53+00:00

When a mac-filter file line contained an octet > 255, the error path freed the entry but kept writing to it and linked it into mac_list. Validate all octets before allocating so invalid lines are skipped entirely. This is not considered a security vulnerability: the mac-filter file can only be configured by an administrator with access to the daemon config, or the CLI, both of which require privileged access. Fixes #307 Signed-off-by: Denys Fedoryshchenko

Merge pull request #323 from nuclearcat/stability-fixes

2026-06-23T15:58:26+00:00

Stability fixes

Merge pull request #315 from nuclearcat/khedor-fixes

2026-06-23T15:33:09+00:00

Several bugfixes for problems reported by Khodor Tahech

pppoe: handle missing service-name tag

2026-06-23T14:36:34+00:00