High performance PPTP/L2TP/SSTP/PPPoE/IPoE server for Linux (mirror of https://github.com/accel-ppp/accel-ppp.git) https://git.amelek.net/accel-ppp/accel-ppp.git/atom?h=master 2026-09-09T15:42:09+00:00 2026-09-09T15:42:09+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-29T23:46:44+00:00 urn:sha1:78d75b1dcf0d42e6ad5ce8b7203a19e17b9c87dc Closes #354 2026-08-16T06:13:39+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-16T06:13:39+00:00 urn:sha1:89637ee2417fc7f42e4213d417da38aa814047e4 PPTP fixes 2026-08-09T22:31:12+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-09T10:33:03+00:00 urn:sha1:9505f3fe72f7930e94aec51188babcabe783e4da Linux 2.6.37 and later provide the PPTP socket address and protocol definitions in linux/if_pppox.h. Use that header directly instead of carrying an old private copy containing obsolete kernel-internal declarations. 2026-08-09T05:58:08+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-09T04:16:38+00:00 urn:sha1:9d47f220a09eb30750f85973dc2f0d4157eb78be An unparsable bind= value went through inet_addr() unchecked and became 255.255.255.255, so the only symptom was bind() failing with "Cannot assign requested address", which does not point at the configuration. Parse with inet_aton() and name the offending value instead. Also zero the address before filling it in, so the padding passed to bind() is not stack garbage. 2026-08-09T05:58:08+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-09T04:16:14+00:00 urn:sha1:0d7cd3a4ae6beed4eab485052a5e27b0772f15c6 The option value was the address of the listening descriptor rather than a boolean, so the effect depended on the descriptor number: it enabled SO_REUSEADDR only because that number happened to be non-zero, and would disable it if the daemon were ever started with the lower descriptors closed. Use a dedicated flag, as cli/telnet.c does. 2026-08-09T05:58:08+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-09T04:15:43+00:00 urn:sha1:a9f666ea84927427a27261b81aa77435d4296d28 load_config() accepts echo-failure=0, but the test for it was "++echo_sent == conf_echo_failure", which can never match once the counter has been incremented, so a zero left dead peers undetected without saying so anywhere. Test the option first and compare with >=, which keeps the behaviour for every configured value and makes the disabled case readable, and document it in accel-ppp.conf.5. 2026-08-09T05:58:08+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-09T04:07:39+00:00 urn:sha1:d76b2f6c6b8f2c510fae5beb24e261901a221d3c conn->peer_call_id is assigned msg->call_id straight from the wire, so it holds a network order value, but send_pptp_call_disconnect_notify() then applies htons() to it. On little-endian hosts the field is swapped twice and a peer call id of 0x1234 is sent as 0x3412, so the peer cannot match the notify to its call. Big-endian hosts are unaffected, as both swaps are no-ops there. Store the call id in host order, which is what the htons() at the point of use expects. Nothing else reads the field. 2026-08-09T05:58:08+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-09T04:14:41+00:00 urn:sha1:a62e3abe2aae259f90289b431e086490020d49ed Both calls were issued on an uninitialised struct sockaddr_in and their results ignored, so a failure would build the tunnel endpoints, and the call socket's local call id, out of stack garbage. Fail the call instead. In pptp_connect() the local address was fetched into the same variable that held the peer address obtained from accept(), so a failure there would silently set called-station-id to the calling station. Read it into its own variable before the connection is set up, and re-arm the address length before each accept() rather than leaving it at whatever the previous iteration wrote. 2026-08-09T05:58:08+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-09T04:13:45+00:00 urn:sha1:f49ed06b26b2b3ea3a97589be2e51ceb2a084243 The PPPoX socket created for the call is only handed to conn->ppp.fd after the reply has been posted, so returning early on a post_msg() failure leaks the descriptor: disconnect() knows nothing about it and establish_ppp() has not run yet. The establish_ppp() failure path just below already closes it. 2026-08-09T05:58:08+00:00 Denys Fedoryshchenko denys.f@collabora.com 2026-08-09T04:15:01+00:00 urn:sha1:2ad648c3cdde7c5b439abde9566c6dedce966c9e PPTP_CTRL_SIZE() evaluates to 0 for unrecognised control types, so a message declaring length 0 with such a type passed the length check, reached process_packet() and was logged as unknown, after which in_size -= 0 consumed nothing. The stale header stayed at the head of the buffer and every later byte queued behind it, so the connection could never make progress: it stalled until in_size reached PPTP_CTRL_SIZE_MAX, at which point read() was called with a zero-length buffer, returned 0 and was misreported as "disconnect by peer". Require the declared length to cover the header, alongside the existing upper bound.