diff options
| author | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-09-07 22:08:04 +0300 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-09-07 22:08:04 +0300 |
| commit | 7cf7432017bf5386e8b8907aa3abb9e6c45f12bb (patch) | |
| tree | 74c0c60d71426e8f9f47dee3dbe0e48bd2bbc812 /accel-pppd/ppp | |
| parent | e014cb2cb46f9a5778fbf8a819a1ad263a911c84 (diff) | |
| download | accel-ppp-7cf7432017bf5386e8b8907aa3abb9e6c45f12bb.tar.gz accel-ppp-7cf7432017bf5386e8b8907aa3abb9e6c45f12bb.zip | |
ppp: add remaining discovery and buffer reuse safeguards
Require exactly one PADR Service-Name, drop Echo-Requests exceeding the
negotiated MTU, and clear pooled payloads before reuse. Retain upstream's
silent malformed-PADR rejection and received-packet length checks.
Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8464/T8830.
Co-authored-by: Ritika Chopra <r.chopra@vyos.io>
Diffstat (limited to 'accel-pppd/ppp')
| -rw-r--r-- | accel-pppd/ppp/ppp_lcp.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/accel-pppd/ppp/ppp_lcp.c b/accel-pppd/ppp/ppp_lcp.c index 2424ca94..4af28dd0 100644 --- a/accel-pppd/ppp/ppp_lcp.c +++ b/accel-pppd/ppp/ppp_lcp.c @@ -634,7 +634,10 @@ static void lcp_recv_echo_repl(struct ppp_lcp_t *lcp, uint8_t *data, int size) static void send_echo_reply(struct ppp_lcp_t *lcp) { struct lcp_hdr_t *hdr = (struct lcp_hdr_t*)lcp->ppp->buf; - //uint32_t magic = *(uint32_t *)(hdr + 1); + uint16_t len = ntohs(hdr->len); + + if (len > lcp->ppp->mtu) + return; lcp->echo_sent = 0; lcp->last_echo_ts = _time(); @@ -646,7 +649,7 @@ static void send_echo_reply(struct ppp_lcp_t *lcp) if (conf_ppp_verbose) log_ppp_debug("send [LCP EchoRep id=%x <magic %08x>]\n", hdr->id, lcp->magic); - ppp_chan_send(lcp->ppp, hdr, min(ntohs(hdr->len), lcp->ppp->mtu) + 2); + ppp_chan_send(lcp->ppp, hdr, len + 2); } static void send_echo_request(struct triton_timer_t *t) |