accel-ppp.git/accel-pppd/ppp/ppp.c, branch sstp-alloc-invariant

ppp: close unit fd only after session cleanup finishes

2026-07-08T10:21:14+00:00

destablish_ppp() closed the ppp unit fd (via triton_md_unregister_handler(..., 1)) before calling ap_session_finished(). Closing the fd releases the ppp unit index, so the kernel can assign the same unit (and thus the same pppX ifname) to a new session while the old session's cleanup is still running. pppd_compat performs its cleanup from the EV_SES_FINISHED handler: it runs the ip-down script (blocking the context until the script exits) and then deletes radattr.pppX. If the unit index is reused in that window, the ip-down script is executed with an IFNAME that now belongs to a different, active session, and remove_radattr() deletes the radattr file of that new session. External accounting/shaper scripts that read radattr.pppX then fail for a live session. Fix this by unregistering the unit fd handler without closing the fd and closing it only after ap_session_finished() returns, unless the fd was handed to the unit cache. This keeps the unit index reserved until session cleanup has finished, so the ifname cannot be reused early. The unit-cache path is not affected (the cached fd already keeps the unit reserved); the race only hits configurations with unit-cache disabled. Only PPP sessions (PPPoE/PPTP/L2TP/SSTP) go through this path; IPoE is unaffected. Note the unit index is now held slightly longer during teardown (while ip-down runs) - this is intentional. Signed-off-by: Denys Fedoryshchenko

ppp: Defend from possible ppp init failure

2026-02-06T15:34:54+00:00

ppp init might fail due malloc failure, missing or invalid runtime state, failure to setup resources (sockers, timers, handler registration), etc. This is quite unlikely now, but some floating(hard to catch) bugs says better to be safe than sorry. Signed-off-by: Denys Fedoryshchenko

fix(ppp): Uninitialized struct fields

2026-02-06T15:34:54+00:00

Initialized the ifreq in destablish_ppp to avoid the uninitialized-struct warning before use. Signed-off-by: Denys Fedoryshchenko

ppp: classic TOCTOU, as uc_size not guarded by mutex

2026-02-06T15:34:54+00:00

It was a micro-optimization to skip taking the mutex when uc_size was 0. But because uc_size isnt atomic and wasnt read under the lock, it created a TOCTOU window. Signed-off-by: Denys Fedoryshchenko

crypto: Removed internal tomcat crypto.

2025-12-10T17:16:42+00:00

Signed-off-by: Andrii Melnychenko

ppp_chan_read: check unit_hnd avoiding proto rej

2022-03-04T12:11:03+00:00

When receiving IPCP packet on channel handler, check unit handler to avoid sending a LCP Protocol Reject because ppp unit has not been created yet. This patch allows accel-ppp to handle higher pressure (handle 300 connections per second). Signed-off-by: Gabriel Jeanneau

ppp: reset the ifindex when moving back to the default namespace

2020-03-18T08:07:38+00:00

If you move an interface into a namespace where there is alreay an interface with the same index, the moved interface will get a new index assigned to it. We need to update our data structure accordingly. Signed-off-by: Simon Chopin

ppp: fix mtu/mru negotiation in preallocate/unit-cache modes

2018-01-31T18:02:15+00:00

ppp: fixed bug in ppp_terminate

2018-01-24T07:25:33+00:00

ppp: code simplification

2016-07-14T17:49:00+00:00