pptp: fix truncated control messages on partial write

post_msg() copies the unsent tail of a message into conn->out_buf and
enables the write handler, but never sets conn->out_size. pptp_write()
then computes out_size - out_pos as 0, writes nothing, sees out_pos ==
out_size, disables itself and returns, so the buffered remainder is
silently dropped. post_msg() still returns 0, so the caller believes the
message was sent.

The usual trigger is a peer that stops reading: once the send buffer
fills, write() returns EAGAIN, n is set to 0 and the whole message is
buffered and then discarded, losing replies such as
Start-Ctrl-Conn-Reply, Outgoing-Call-Reply and Call-Disconnect-Notify.

Record the remaining length so pptp_write() can flush it. out_pos is
already 0 here: post_msg() returns early unless out_size is 0, which
holds only before the first send or after pptp_write() has drained the
buffer and reset both fields.

0 files changed, 0 insertions, 0 deletions