accel-ppp.git/accel-pppd/ppp, branch master

ppp: add remaining discovery and buffer reuse safeguards

2026-09-07T19:08:04+00:00

Require exactly one PADR Service-Name, drop Echo-Requests exceeding the negotiated MTU, and clear pooled payloads before reuse. Retain upstream's silent malformed-PADR rejection and received-packet length checks. Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8464/T8830. Co-authored-by: Ritika Chopra

Merge pull request #359 from nuclearcat/ipcp-ccp-delay-ack

2026-09-07T17:55:02+00:00

Ipcp ccp delay ack

ppp: say why a malformed ConfReq drops the session

2026-09-01T06:32:30+00:00

The option walkers of lcp_recv_conf_req() and its IPCP, IPV6CP and CCP counterparts bail out with *_OPT_FAIL as soon as an option header does not fit in the remaining bytes or carries an impossible length, and the caller turns that into ap_session_terminate(TERM_USER_ERROR). The bail out happens before the "recv [LCP ConfReq id=..." line is emitted, so the session simply disappeared with nothing in the log to point at the peer. The ConfAck, ConfNak and ConfRej walkers break out of their loop instead and at least close the line they had already started. Log the offending length, option id and the number of bytes left before returning, so a peer sending malformed options can be told apart from the other reasons a session ends with TERM_USER_ERROR.

ppp: bound IPCP and IPV6CP packets by the received size

2026-09-01T06:31:53+00:00

ipcp_recv() and ipv6cp_recv() only rejected packets whose header length field was below PPP_HEADERLEN. The upper bound was missing, so the option walker was handed a size derived purely from the peer chosen hdr->len. ppp->buf is a fixed 8192 byte mempool block and ppp->buf_size holds the number of bytes actually read, so a short frame declaring hdr->len 0xffff made the option loop run off the end of the block: it kept fetching option headers from whatever followed in the heap and stored pointers to them in the ropt list. The read is harmless in itself but easily reaches unmapped memory and kills the daemon. Reject any packet whose declared length does not fit in what was received, the way lcp_recv() and ccp_recv() already do. The two byte slack accounts for the protocol field that precedes the header inside the buffer, and the existing buf_size >= PPP_HEADERLEN + 2 test just above keeps the subtraction from underflowing.

utils: centralize unaligned integer accessors

2026-09-01T06:08:47+00:00

ipv6: avoid integer access through address bytes

2026-09-01T05:55:54+00:00

Copy interface IDs and prefix words between aligned temporaries and byte arrays instead of casting IPv6 address storage to uint64_t pointers.

ppp: cover alignment-safe MPPE prefer setup

2026-09-01T05:53:54+00:00

Serialize the MPPE option through an aligned temporary and exercise mppe=prefer in the existing unauthenticated PPPoE session test.

ppp: harden control packet decoding

2026-09-01T05:53:54+00:00

Bound LCP and CCP declared lengths by the received frame, reject truncated option headers across all control protocols, and decode LCP payload integers without alignment assumptions. IPCP and IPv6CP outer frame bounds remain owned by the delayed-ack change in PR #359.

ppp: do not answer IPCP/IPV6CP ConfReq with TermAck while CCP negotiates

2026-09-01T04:13:12+00:00

When the peer's IPCP (or IPV6CP) ConfReq arrives before CCP negotiation has finished, delay_ack is set and send_conf_ack() answers with a TermAck instead of the ConfAck. A TermAck is only a valid response to a TermReq, and the trick relies on the peer retransmitting its ConfReq: conformant peers recover only after their restart timer (3 seconds added to session setup), while some clients (MikroTik RouterOS over L2TP, see issue #353) treat it as a failure and drop the session. Withhold the ConfAck instead and send it as soon as CCP settles. CCP now notifies IPCP/IPV6CP when it comes up or gives up (passive); that clears delay_ack, brings the layer up if the FSM is already Opened, and flushes the withheld ConfAck. Nothing is sent to the peer while CCP is still in progress, so IP data cannot flow before MPPE is set up. Verified with pppoe + mschap-v2: with mppe=prefer and a client that does not require MPPE, the peer's ConfReq used to be answered with a TermAck and the session came up 3 seconds later; now the ConfAck is emitted right after ccp_layer_started and the session comes up immediately. mppe=require and mppe=deny sessions are unaffected.

utils: centralize min macro

2026-08-11T18:42:07+00:00

Several userspace translation units carry identical local min() definitions. Move the guarded definition to utils.h and include it from each user so there is one implementation to maintain. The Linux min() macro lives in kernel-internal headers and is not part of the userspace UAPI. Clang/LLVM does not provide a compatible min macro either: C++ code uses std::min and Clang's similarly named operations use explicit builtin names. The userspace interface, where available, exposes uppercase MIN instead. Keep the #ifndef guard to preserve the behavior of the existing local definitions and avoid redefining a lowercase min macro supplied by an unrelated third-party header.