accel-ppp.git/accel-pppd/ipv6/nd.c, branch 1.15.0

ipv6: remove obsolete three-server DNS limit

2026-10-05T23:19:48+00:00

The legacy limit matches RFC 6106's recommendation that hosts treat three learned RDNSS addresses as sufficient. That was host-side repository guidance, not a limit in the RADIUS, DHCPv6, or RDNSS encodings. RFC 8106 obsoletes RFC 6106 and explicitly removes the recommendation to limit learned RDNSS addresses to three, leaving the number to local policy. It instead recommends the ability to store at least three addresses when DNS information comes from multiple sources. Store both configured and per-session servers in reusable contiguous arrays. Start with a four-address, 64-byte allocation, grow geometrically, retain capacity across reload or reauthorization, and free session storage only at teardown. Bound advertised lists by actual DHCPv6 and router-advertisement packet space. Warn when servers have to be dropped for lack of room, as the fixed limit used to, skip the DNS search list rather than write it past the end of a full advertisement, and drop the stale three-server wording from the [ipv6-dns] documentation. Link: https://github.com/accel-ppp/accel-ppp/commit/4f562467dbdf819395e138617c2a057e02595b9e#r197212083 Link: https://www.rfc-editor.org/rfc/rfc6106.html#section-5.3.1 Link: https://www.rfc-editor.org/rfc/rfc8106.html#section-5.3.1 Link: https://www.rfc-editor.org/rfc/rfc8106.html#appendix-A

ipv6_nd: do not overrun the advertisement buffer with prefix information

2026-10-05T23:18:41+00:00

The prefix information options are written into a fixed 1024 byte pool buffer with no bound at all, one 32 byte option per address on the session. A session carrying more than about thirty addresses therefore writes past the end of the buffer. Skip the prefix information of the addresses which no longer fit and warn about them. The loop also installs the addresses on the interface, so keep doing that regardless of how much room is left in the advertisement.

ipv6: assign DNS servers per session from RADIUS

2026-08-12T07:42:35+00:00

The ipv6_nd and ipv6_dhcp modules could only advertise the DNS servers configured in [ipv6-dns], the same set for every subscriber. RFC 6911 defines DNS-Server-IPv6-Address (attribute 169) for exactly this, and the attribute was already in the shipped dictionary and in attr_defs.h; nothing read it. Give struct ap_session an ipv6_dns list, filled by the radius module from that attribute, and have both modules advertise it when the session has one: in the RDNSS option of the router advertisements, and in the DNS_SERVERS option of DHCPv6 replies. Sessions without a list of their own keep getting the configured servers, so nothing changes for anyone not sending the attribute. The selection is a single ipv6_dns_get() shared by both modules rather than a copy in each: they already duplicate the whole [ipv6-dns] parser, and two copies of a precedence rule are two chances to drift. It caps what it returns, so neither the RDNSS option length (one byte, in units of 8) nor the router advertisement buffer can be pushed around by what a RADIUS server sends. The radius module caps at the same 3 servers as [ipv6-dns] accepts and warns once when a reply carries more. An Access-Accept which carries the attribute replaces the whole previously assigned list rather than appending to it, so a re-authorized session ends up with the servers of the latest reply and not with a concatenation. One which does not carry it leaves the current list alone, which is how the IPv4 MS-Primary-DNS-Server attribute already behaves. ipv6_dns_test.c covers the selection: assigned wins over configured, empty list means "nothing assigned" rather than "no DNS", the cap holds for both sources, and a caller with no room gets nothing rather than a stomped buffer. Wired into the ASAN/UBSAN workflow. Inspired by the per-session IPv6 DNS support in accel-ppp-ng (commit 2df6eb99), reimplemented against mainline's ap_session and ipdb types.

ipv6: fix NULL deref and OOB read in dnssl/AFTR-Name config parsing

2026-07-06T22:41:01+00:00

add_dnssl() in nd.c and dhcpv6.c, and its copy add_aftr_gw() in dhcpv6.c, call strlen(val) before the "if (!val)" guard, so a dnssl option without a value crashes on config load before the check is ever reached (also reported by cppcheck: "Either the condition '!val' is redundant or there is possible null pointer dereference"). Moving strlen() after the guard is not enough: an empty value such as a bare "dnssl=" or "aftr-gw=" passes the NULL check with n == 0 and the following "val[n - 1]" reads one byte before the string. Reject both NULL and empty values before taking the length. Note these functions are only reached from the config parser (the [ipv6-dns] section and the ipv6-dhcp "aftr-gw" option) at startup or on config reload; nothing from received packets flows into them. So this is a robustness fix for invalid/malformed configuration files (local DoS at worst), not a remotely triggerable issue. The NULL-check ordering in add_dnssl() was originally fixed by [anp/hsw] in PR #13; this extends it to empty values and to the same pattern in add_aftr_gw(). Co-authored-by: [anp/hsw]

ipv6_nd: fix ipv6 auto-configuration in netns

2022-06-22T14:55:48+00:00

ipv6 auto-configuration generate error when link is terminated inside netns. The error message is : "ipv6_nd: setsockopt(SO_BINDTODEVICE): No such device" This error is generated because socket is not created inside the netns but it’s created in the default netns. This fix allow to create the socket in the right place. to propose this fix, i was inspired by : issue : https://phabricator.accel-ppp.org/T68 commit : https://github.com/accel-ppp/accel-ppp/commit/f1d616d91914be493b6a32a96323fa871733f8e0

Fixed some errors found by valgrind and pvs-studio (#11)

2021-03-20T14:14:59+00:00

* Fix errors found by valgrind ==12312== Syscall param sendmsg(msg.msg_iov[0]) points to uninitialised byte(s) ==12312== at 0x486CCF0: sendmsg (in /lib/libpthread-2.22.so) ==12312== by 0x12F57F: rtnl_talk (libnetlink.c:316) ==12312== by 0x132DA3: genl_resolve_mcg (genl.c:52) ==12312== by 0x484E1CB: init (vlan_mon.c:528) ==12312== by 0x484CDC0: vlan_mon_register_proto (vlan_mon.c:48) ==12312== by 0x510B763: load_vlan_mon (pppoe.c:1914) ==12312== by 0x510BFF2: load_config (pppoe.c:2064) ==12312== by 0x510C22A: pppoe_init (pppoe.c:2108) ==12312== by 0x483E9EB: triton_load_modules (triton.c:704) ==12312== by 0x1384B2: main (main.c:339) ==12312== Address 0xbedacdd8 is on thread 1's stack ==12312== in frame #2, created by genl_resolve_mcg (genl.c:23) ==12312== 15 bytes in 1 blocks are definitely lost in loss record 352 of 836 ==12312== at 0x482A9A9: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==12312== by 0x4B97524: strdup (in /lib/libc-2.22.so) ==12312== by 0x12C30C: init (telnet.c:769) ==12312== by 0x483E9EB: triton_load_modules (triton.c:704) ==12312== by 0x1384B2: main (main.c:339) ==12312== ==12312== 15 bytes in 1 blocks are definitely lost in loss record 353 of 836 ==12312== at 0x482A9A9: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==12312== by 0x4B97524: strdup (in /lib/libc-2.22.so) ==12312== by 0x12D60A: init (tcp.c:392) ==12312== by 0x483E9EB: triton_load_modules (triton.c:704) ==12312== by 0x1384B2: main (main.c:339) * Fix another warnings by cppcheck [accel-pppd/ctrl/ipoe/arp.c:256]: (error) Uninitialized variable: n [accel-pppd/ctrl/pppoe/mac_filter.c:90]: (warning) %x in format string (no. 1) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:90]: (warning) %x in format string (no. 2) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:90]: (warning) %x in format string (no. 3) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:90]: (warning) %x in format string (no. 4) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:90]: (warning) %x in format string (no. 5) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:90]: (warning) %x in format string (no. 6) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:129]: (warning) %x in format string (no. 1) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:129]: (warning) %x in format string (no. 2) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:129]: (warning) %x in format string (no. 3) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:129]: (warning) %x in format string (no. 4) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:129]: (warning) %x in format string (no. 5) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:129]: (warning) %x in format string (no. 6) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:158]: (warning) %x in format string (no. 1) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:158]: (warning) %x in format string (no. 2) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:158]: (warning) %x in format string (no. 3) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:158]: (warning) %x in format string (no. 4) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:158]: (warning) %x in format string (no. 5) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/mac_filter.c:158]: (warning) %x in format string (no. 6) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ctrl/pppoe/pppoe.c:738]: (warning) Possible null pointer dereference [accel-pppd/ipv6/dhcpv6.c:911]: (warning) %x in format string (no. 1) requires 'unsigned int *' but the argument type is 'int *'. [accel-pppd/ipv6/dhcpv6.c:911]: (warning) %x in format string (no. 2) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ipv6/dhcpv6.c:911]: (warning) %x in format string (no. 3) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ipv6/dhcpv6.c:911]: (warning) %x in format string (no. 4) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/libnetlink/libnetlink.c:515]: (warning) Possible null pointer dereference [accel-pppd/ppp/ipv6cp_opt_intfid.c:185]: (warning) %x in format string (no. 1) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ppp/ipv6cp_opt_intfid.c:298]: (warning) %x in format string (no. 1) requires 'unsigned int *' but the argument type is 'int *'. [accel-pppd/ppp/ipv6cp_opt_intfid.c:298]: (warning) %x in format string (no. 2) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ppp/ipv6cp_opt_intfid.c:298]: (warning) %x in format string (no. 3) requires 'unsigned int *' but the argument type is 'signed int *'. [accel-pppd/ppp/ipv6cp_opt_intfid.c:298]: (warning) %x in format string (no. 4) requires 'unsigned int *' but the argument type is 'signed int *'. * Suppress compiler warnings * Fix locking errors /opt/pvs/accel-ppp/accel-pppd/extra/pppd_compat.c 279 warn V1020 The function exited without calling the 'sigchld_unlock' function. Check lines: 279, 249. /opt/pvs/accel-ppp/accel-pppd/extra/pppd_compat.c 333 warn V1020 The function exited without calling the 'sigchld_unlock' function. Check lines: 333, 315. /opt/pvs/accel-ppp/accel-pppd/extra/pppd_compat.c 422 warn V1020 The function exited without calling the 'sigchld_unlock' function. Check lines: 422, 372. /opt/pvs/accel-ppp/accel-pppd/extra/pppd_compat.c 488 warn V1020 The function exited without calling the 'sigchld_unlock' function. Check lines: 488, 468. /opt/pvs/accel-ppp/accel-pppd/triton/mempool.c 119 warn V1020 The function exited without calling the 'pthread_spin_unlock' function. Check lines: 119, 116. * Fix array len errors /opt/pvs/accel-ppp/accel-pppd/triton/conf_file.c 75 warn V557 Array underrun is possible. The value of 'len - 1' index could reach -1. /opt/pvs/accel-ppp/accel-pppd/triton/conf_file.c 76 warn V557 Array underrun is possible. The value of '-- len' index could reach -1. * Fix possible memory leaks /opt/pvs/accel-ppp/accel-pppd/radius/radius.c 936 err V773 The function was exited without releasing the 'str' pointer. A memory leak is possible. /opt/pvs/accel-ppp/accel-pppd/radius/serv.c 622 err V773 The function was exited without releasing the 'str' pointer. A memory leak is possible. /opt/pvs/accel-ppp/accel-pppd/triton/conf_file.c 144 err V773 The function was exited without releasing the 'raw' pointer. A memory leak is possible. * Fix unsafe code /opt/pvs/accel-ppp/accel-pppd/cli/tcp.c 364 warn V1004 The 'host' pointer was used unsafely after it was verified against nullptr. Check lines: 338, 364. /opt/pvs/accel-ppp/accel-pppd/cli/telnet.c 701 warn V1004 The 'host' pointer was used unsafely after it was verified against nullptr. Check lines: 675, 701. /opt/pvs/accel-ppp/accel-pppd/extra/ippool.c 241 err V614 Potentially uninitialized pointer 'pos' used. /opt/pvs/accel-ppp/accel-pppd/radius/dict.c 165 err V614 Uninitialized pointer 'parent_items' used. * Remove duplicate code /opt/pvs/accel-ppp/accel-pppd/radius/serv.c 202 warn V547 Expression 'ts.tv_sec < req->serv->fail_time' is always false. * Fix treating signed bool variables as unsigned * Add nullptr checking /opt/pvs/accel-ppp/accel-pppd/ipv6/dhcpv6.c 886 err V595 The 'opt->val' pointer was utilized before it was verified against nullptr. Check lines: 886, 890. /opt/pvs/accel-ppp/accel-pppd/ipv6/nd.c 479 err V595 The 'opt->val' pointer was utilized before it was verified against nullptr. Check lines: 479, 483. /opt/pvs/accel-ppp/accel-pppd/radius/auth.c 152 err V595 The 'rpd->auth_ctx' pointer was utilized before it was verified against nullptr. Check lines: 152, 154. /opt/pvs/accel-ppp/accel-pppd/triton/conf_file.c 114 err V595 The 'cur_sect' pointer was utilized before it was verified against nullptr. Check lines: 114, 117. * Add logging of exit conditions * Clarify calculation [accel-pppd/ppp/ccp_mppe.c:281]: (style) Clarify calculation precedence for '&' and '?'. [accel-pppd/ppp/ccp_mppe.c:282]: (style) Clarify calculation precedence for '&' and '?'. [accel-pppd/ppp/ccp_mppe.c:283]: (style) Clarify calculation precedence for '&' and '?'. [accel-pppd/ppp/ccp_mppe.c:284]: (style) Clarify calculation precedence for '&' and '?'. [accel-pppd/ppp/ccp_mppe.c:285]: (style) Clarify calculation precedence for '&' and '?'. [accel-pppd/ppp/ccp_mppe.c:286]: (style) Clarify calculation precedence for '&' and '?'. [drivers/ipoe/ipoe.c:307]: (style) Clarify calculation precedence for '&' and '?'. * Fix void calculations [accel-pppd/ctrl/pppoe/disc.c:211]: (portability) 'pkt' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/ctrl/pptp/pptp.c:150]: (portability) 'buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/acct.c:37]: (portability) 'req.pack.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/auth.c:35]: (portability) 'req.pack.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/auth.c:79]: (portability) 'req.pack.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/dm_coa.c:43]: (portability) 'pack.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/dm_coa.c:47]: (portability) 'pack.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/dm_coa.c:57]: (portability) 'pack.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/dm_coa.c:65]: (portability) 'req.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/dm_coa.c:97]: (portability) 'req.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/radius/serv.c:364]: (portability) 'req.pack.buf' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/triton/mempool.c:115]: (portability) 'mmap_ptr' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/triton/mempool.c:122]: (portability) 'mmap_ptr' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/triton/mempool.c:276]: (portability) 'ptr' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. * Fix void part 2 [accel-pppd/ipv6/dhcpv6.c:844]: (portability) 'conf_dnssl' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/ipv6/nd.c:199]: (portability) '(void*)dnsslinfo' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [accel-pppd/ipv6/nd.c:432]: (portability) 'conf_dnssl' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. * Fix null pointer dereference [accel-pppd/ctrl/ipoe/ipoe.c:2048]: (warning) Possible null pointer dereference: eth [accel-pppd/ctrl/ipoe/ipoe.c:2049]: (warning) Possible null pointer dereference: iph * Remove redundant check /opt/pvs/accel-ppp/accel-pppd/ctrl/l2tp/packet.c 656 warn V547 Expression 'attr->length <= 16' is always false. * PR fixes * PR fixes 2

ipv6, shaper: fix possible NULL-pointer dereference

2021-03-20T13:25:15+00:00

ipv6: consolidate and fix interface-id address generation for non-/128

2018-01-12T21:07:50+00:00

ipv6: use macro for unspecified address ckecking

2018-01-12T21:07:45+00:00

ipv6: ignore "unspecified address" (::/128)

2017-12-29T11:26:38+00:00