Merge pull request #323 from nuclearcat/stability-fixes

Stability fixes

4 files changed, 68 insertions, 27 deletions

diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c
index d543a129..0cc23180 100644
--- a/accel-pppd/ctrl/pppoe/pppoe.c
+++ b/accel-pppd/ctrl/pppoe/pppoe.c
@@ -298,9 +298,15 @@ static void pppoe_conn_ctx_switch(struct triton_context_t *ctx, void *arg)
 
 static struct pppoe_conn_t *allocate_channel(struct pppoe_serv_t *serv, const uint8_t *addr, const struct pppoe_tag *host_uniq, const struct pppoe_tag *relay_sid, const struct pppoe_tag *service_name, const struct pppoe_tag *tr101, const uint8_t *cookie, uint16_t ppp_max_payload)
 {
+	struct pppoe_tag empty_service_name = {
+		.tag_type = htons(TAG_SERVICE_NAME),
+	};
 	struct pppoe_conn_t *conn;
 	unsigned long *old_sid_ptr;
 
+	if (!service_name)
+		service_name = &empty_service_name;
+
 	conn = mempool_alloc(conn_pool);
 	if (!conn) {
 		log_error("pppoe: out of memory\n");
diff --git a/accel-pppd/ctrl/sstp/sstp.c b/accel-pppd/ctrl/sstp/sstp.c
index 21c519fa..6c2b9ca9 100644
--- a/accel-pppd/ctrl/sstp/sstp.c
+++ b/accel-pppd/ctrl/sstp/sstp.c
@@ -1240,7 +1240,7 @@ static int ppp_write(struct triton_md_handler_t *h)
 	ssize_t n;
 	int i;
 
-	if (!list_empty(&conn->ppp_queue)) {
+	while (!list_empty(&conn->ppp_queue)) {
 		i = n = 0;
 		list_for_each_entry(buf, &conn->ppp_queue, entry) {
 			if (i < PPP_BUF_IOVEC && n < PPP_BUF_SIZE) {
@@ -1272,9 +1272,6 @@ static int ppp_write(struct triton_md_handler_t *h)
 			list_del(&buf->entry);
 			free_buf(buf);
 		} while (n > 0);
-
-		if (!list_empty(&conn->ppp_queue))
-			goto defer;
 	}
 	triton_md_disable_handler(h, MD_MODE_WRITE);
 	return 0;
@@ -1849,7 +1846,7 @@ static int sstp_recv_data_packet(struct sstp_conn_t *conn, struct sstp_hdr *hdr)
 
 	buf_put_data(buf, hdr->data, size);
 #else
-	buf = alloc_buf(size*2 + 2 + PPP_FCSLEN);
+	buf = alloc_buf(size*2 + 2 + PPP_FCSLEN*2);
 	if (!buf) {
 		log_error("sstp: no memory\n");
 		return -1;
diff --git a/accel-pppd/ipv6/dhcpv6_packet.c b/accel-pppd/ipv6/dhcpv6_packet.c
index 1890bc11..e0f2b5d9 100644
--- a/accel-pppd/ipv6/dhcpv6_packet.c
+++ b/accel-pppd/ipv6/dhcpv6_packet.c
@@ -551,21 +551,40 @@ static void print_dnssl(struct dhcpv6_option *opt, void (*print)(const char *fmt
 
 }
 
-static void print_aftr_gw(struct dhcpv6_option *opt, void (*print)(const char *fmt, ...)) {
+static void print_aftr_gw(struct dhcpv6_option *opt, void (*print)(const char *fmt, ...))
+{
 	int len = ntohs(opt->hdr->len);
 	int offset = 0;
-	char domain[255];
+	int pos = 0;
+	int done = 0;
+	char domain[256];
 	uint8_t label_len;
 
-	memset(domain, 0, 255);
+	memset(domain, 0, sizeof(domain));
 	while (offset < len) {
-		label_len = opt->hdr->data[offset];
-		if (label_len == 0)
+		label_len = opt->hdr->data[offset++];
+		if (label_len == 0) {
+			done = 1;
 			break;
-		memcpy(&domain[offset], &opt->hdr->data[offset + 1], label_len);
+		}
+
+		if (label_len > 63 || offset + label_len > len ||
+		    pos + label_len + 1 >= sizeof(domain)) {
+			print(" <invalid>");
+			return;
+		}
+
+		memcpy(&domain[pos], &opt->hdr->data[offset], label_len);
 		offset += label_len;
-		domain[offset++] = '.';
+		pos += label_len;
+		domain[pos++] = '.';
 	}
+
+	if (!done || offset != len) {
+		print(" <invalid>");
+		return;
+	}
+
 	print(" %s", domain);
 }
 
@@ -577,4 +596,3 @@ static void print_ia_prefix(struct dhcpv6_option *opt, void (*print)(const char
 	inet_ntop(AF_INET6, &o->prefix, str, sizeof(str));
 	print(" %s/%i pref_lifetime=%i valid_lifetime=%i", str, o->prefix_len, ntohl(o->pref_lifetime), ntohl(o->valid_lifetime));
 }
-
diff --git a/accel-pppd/libnetlink/iputils.c b/accel-pppd/libnetlink/iputils.c
index 34181e2a..a5e3bc51 100644
--- a/accel-pppd/libnetlink/iputils.c
+++ b/accel-pppd/libnetlink/iputils.c
@@ -469,20 +469,24 @@ static int ipvrf_get_table(uint32_t *tb_id, const char *vrf_name)
 		struct ifinfomsg i;
 		char buf[4096];
 	} req;
-	struct rtnl_handle *rth = net->rtnl_get();
 	struct rtattr *tb[IFLA_MAX+1];
 	struct rtattr *li[IFLA_INFO_MAX+1];
 	struct rtattr *vrf_attr[IFLA_VRF_MAX + 1];
 	struct ifinfomsg *ifi;
+	struct rtnl_handle *rth;
 	int len;
 	int r = -1;
 	*tb_id = RT_TABLE_MAIN;
 
-	log_ppp_info2("utils: getting route table for %s\n", vrf_name);
-
 	if (!vrf_name)
 		return 0;
 
+	log_ppp_info2("utils: getting route table for %s\n", vrf_name);
+
+	rth = net->rtnl_get();
+	if (!rth)
+		return -1;
+
 	memset(&req, 0, sizeof(req) - 4096);
 
 	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
@@ -495,7 +499,7 @@ static int ipvrf_get_table(uint32_t *tb_id, const char *vrf_name)
 	r = rtnl_talk(rth, &req.n, 0, 0, &req.n, NULL, NULL, 0);
 	if (r < 0) {
 		log_ppp_error("BUG: route table \"%s\" not found\n", vrf_name);
-		return r;
+		goto out;
 	}
 
 	ifi = NLMSG_DATA(&req.n);
@@ -529,9 +533,13 @@ static int ipvrf_get_table(uint32_t *tb_id, const char *vrf_name)
 	if (*tb_id == 0)
 		log_ppp_error("BUG: VRF %s is missing table id\n", vrf_name);
 
-	return 0;
+	r = 0;
+	goto out;
 error:
-	return -1;
+	r = -1;
+out:
+	net->rtnl_put(rth);
+	return r;
 }
 #endif
 
@@ -552,8 +560,10 @@ int __export iproute_add(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw
 
 	uint32_t rt_table = RT_TABLE_MAIN;
 #ifdef HAVE_VRF
-	if (ipvrf_get_table(&rt_table, vrf_name) < 0)
-		return -1;
+	if (ipvrf_get_table(&rt_table, vrf_name) < 0) {
+		r = -1;
+		goto out;
+	}
 #endif
 
 	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
@@ -581,6 +591,7 @@ int __export iproute_add(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw
 	if (rtnl_talk(rth, &req.n, 0, 0, NULL, NULL, NULL, 0) < 0)
 		r = -1;
 
+out:
 	net->rtnl_put(rth);
 
 	return r;
@@ -603,8 +614,10 @@ int __export iproute_del(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw
 
 	uint32_t rt_table = RT_TABLE_MAIN;
 #ifdef HAVE_VRF
-	if (ipvrf_get_table(&rt_table, vrf_name) < 0)
-		return -1;
+	if (ipvrf_get_table(&rt_table, vrf_name) < 0) {
+		r = -1;
+		goto out;
+	}
 #endif
 
 	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
@@ -632,6 +645,7 @@ int __export iproute_del(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw
 	if (rtnl_talk(rth, &req.n, 0, 0, NULL, NULL, NULL, 0) < 0)
 		r = -1;
 
+out:
 	net->rtnl_put(rth);
 
 	return r;
@@ -654,8 +668,10 @@ int __export ip6route_add(int ifindex, const struct in6_addr *dst, int pref_len,
 
 	uint32_t rt_table = RT_TABLE_MAIN;
 #ifdef HAVE_VRF
-	if (ipvrf_get_table(&rt_table, vrf_name) < 0)
-		return -1;
+	if (ipvrf_get_table(&rt_table, vrf_name) < 0) {
+		r = -1;
+		goto out;
+	}
 #endif
 
 	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
@@ -681,6 +697,7 @@ int __export ip6route_add(int ifindex, const struct in6_addr *dst, int pref_len,
 	if (rtnl_talk(rth, &req.n, 0, 0, NULL, NULL, NULL, 0) < 0)
 		r = -1;
 
+out:
 	net->rtnl_put(rth);
 
 	return r;
@@ -703,8 +720,10 @@ int __export ip6route_del(int ifindex, const struct in6_addr *dst, int pref_len,
 
 	uint32_t rt_table = RT_TABLE_MAIN;
 #ifdef HAVE_VRF
-	if (ipvrf_get_table(&rt_table, vrf_name) < 0)
-		return -1;
+	if (ipvrf_get_table(&rt_table, vrf_name) < 0) {
+		r = -1;
+		goto out;
+	}
 #endif
 
 	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
@@ -730,6 +749,7 @@ int __export ip6route_del(int ifindex, const struct in6_addr *dst, int pref_len,
 	if (rtnl_talk(rth, &req.n, 0, 0, NULL, NULL, NULL, 0) < 0)
 		r = -1;
 
+out:
 	net->rtnl_put(rth);
 
 	return r;