summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--accel-pppd/ctrl/pppoe/pppoe.c6
-rw-r--r--accel-pppd/ifcfg.c15
-rw-r--r--accel-pppd/ipv6/dhcpv6.c80
-rw-r--r--accel-pppd/ipv6/dhcpv6.h1
-rw-r--r--accel-pppd/ipv6/dhcpv6_packet.c54
-rw-r--r--accel-pppd/net.c8
-rw-r--r--accel-pppd/ppp/ppp_lcp.c7
-rw-r--r--accel-pppd/radius/acct.c33
-rw-r--r--accel-pppd/radius/auth.c16
-rw-r--r--accel-pppd/radius/dm_coa.c8
-rw-r--r--accel-pppd/radius/packet.c1
-rw-r--r--accel-pppd/radius/radius.c7
-rw-r--r--accel-pppd/radius/req.c71
-rw-r--r--accel-pppd/radius/serv.c38
-rw-r--r--accel-pppd/triton/mempool.c2
-rw-r--r--docs/ng40-safeguards-review.md135
-rw-r--r--tests/unit/dhcpv6_safeguards_test.c154
-rw-r--r--tests/unit/lcp_safeguards_test.c40
-rw-r--r--tests/unit/mempool_safeguards_test.c38
-rw-r--r--tests/unit/radius_safeguards_test.c119
-rw-r--r--tests/unit/run_safeguards.sh21
-rw-r--r--tests/unit/vrf_safeguards_test.c72
22 files changed, 815 insertions, 111 deletions
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c
index bd92cbf8..6161cc03 100644
--- a/accel-pppd/ctrl/pppoe/pppoe.c
+++ b/accel-pppd/ctrl/pppoe/pppoe.c
@@ -1156,6 +1156,7 @@ static void pppoe_recv_PADR(struct pppoe_serv_t *serv, uint8_t *pack, int size)
struct pppoe_tag *service_name_tag = NULL;
struct pppoe_tag *tr101_tag = NULL;
int n, service_match = 0;
+ int service_name_count = 0;
struct pppoe_conn_t *conn;
int vendor_id;
uint16_t ppp_max_payload = 0;
@@ -1204,6 +1205,7 @@ static void pppoe_recv_PADR(struct pppoe_serv_t *serv, uint8_t *pack, int size)
goto padr_tags_done;
case TAG_SERVICE_NAME:
service_name_tag = tag;
+ service_name_count++;
if (tag->tag_len == 0)
service_match = 1;
else if (conf_service_name[0]) {
@@ -1251,9 +1253,9 @@ padr_tags_done:
return;
}
- if (!service_name_tag) {
+ if (service_name_count != 1) {
if (conf_verbose)
- log_warn("pppoe: discard PADR packet (no Service-Name tag present)\n");
+ log_warn("pppoe: discard PADR packet (expected exactly one Service-Name tag)\n");
return;
}
diff --git a/accel-pppd/ifcfg.c b/accel-pppd/ifcfg.c
index 66f5cc6b..c672f6c0 100644
--- a/accel-pppd/ifcfg.c
+++ b/accel-pppd/ifcfg.c
@@ -349,12 +349,21 @@ int __export ap_session_rename(struct ap_session *ses, const char *ifname, int l
#ifdef HAVE_VRF
int __export ap_session_vrf(struct ap_session *ses, const char *vrf_name, int len)
{
- if (len == -1)
- len = strlen(vrf_name);
-
int vrf_ifindex = 0;
+ char name[IFNAMSIZ];
+
+ if (len == -1)
+ len = vrf_name ? strnlen(vrf_name, IFNAMSIZ) : 0;
+ if (len < 0 || len >= IFNAMSIZ || (len && !vrf_name) ||
+ (len && memchr(vrf_name, 0, len))) {
+ log_ppp_error("invalid vrf name\n");
+ return -1;
+ }
if (len) {
+ memcpy(name, vrf_name, len);
+ name[len] = 0;
+ vrf_name = name;
vrf_ifindex = ses->net->get_ifindex(vrf_name);
if (vrf_ifindex < 0) {
log_ppp_error("vrf '%s' not found\n", vrf_name);
diff --git a/accel-pppd/ipv6/dhcpv6.c b/accel-pppd/ipv6/dhcpv6.c
index a0b159cf..9b957f0f 100644
--- a/accel-pppd/ipv6/dhcpv6.c
+++ b/accel-pppd/ipv6/dhcpv6.c
@@ -205,7 +205,7 @@ static void insert_dp_routes(struct ap_session *ses, struct dhcpv6_pd *pd, struc
pd->dp_active = 1;
}
-static void insert_status(struct dhcpv6_packet *pkt, struct dhcpv6_option *opt, int code)
+static int insert_status(struct dhcpv6_packet *pkt, struct dhcpv6_option *opt, int code)
{
struct dhcpv6_option *opt1;
struct dhcpv6_opt_status *status;
@@ -215,11 +215,15 @@ static void insert_status(struct dhcpv6_packet *pkt, struct dhcpv6_option *opt,
else
opt1 = dhcpv6_option_alloc(pkt, D6_OPTION_STATUS_CODE, sizeof(struct dhcpv6_opt_status) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt1)
+ return -1;
+
status = (struct dhcpv6_opt_status *)opt1->hdr;
status->code = htons(code);
+ return 0;
}
-static void insert_oro(struct dhcpv6_packet *reply, struct dhcpv6_option *opt)
+static int insert_oro(struct dhcpv6_packet *reply, struct dhcpv6_option *opt)
{
struct dhcpv6_option *opt1;
int i, j, dns_count;
@@ -236,21 +240,28 @@ static void insert_oro(struct dhcpv6_packet *reply, struct dhcpv6_option *opt)
dns, MAX_DNS_COUNT);
if (dns_count) {
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_DNS_SERVERS, dns_count * sizeof(addr));
+ if (!opt1)
+ return -1;
for (j = 0, addr_ptr = opt1->hdr->data; j < dns_count; j++, addr_ptr += sizeof(addr))
memcpy(addr_ptr, dns + j, sizeof(addr));
}
} else if (code == D6_OPTION_DOMAIN_LIST) {
if (conf_dnssl_size) {
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_DOMAIN_LIST, conf_dnssl_size);
+ if (!opt1)
+ return -1;
memcpy(opt1->hdr->data, conf_dnssl, conf_dnssl_size);
}
} else if (code == D6_OPTION_AFTR_NAME) {
if (conf_aftr_gw_size) {
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_AFTR_NAME, conf_aftr_gw_size);
+ if (!opt1)
+ return -1;
memcpy(opt1->hdr->data, conf_aftr_gw, conf_aftr_gw_size);
}
}
}
+ return 0;
}
static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, int code)
@@ -277,6 +288,8 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
continue;
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_IA_NA, sizeof(struct dhcpv6_opt_ia_na) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt1)
+ goto out;
memcpy(opt1->hdr + 1, opt->hdr + 1, ntohs(opt1->hdr->len));
ia_na = (struct dhcpv6_opt_ia_na *)opt1->hdr;
@@ -284,9 +297,11 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
ia_na->T2 = conf_pref_lifetime == -1 ? -1 : htonl((conf_pref_lifetime * 4) / 5);
if (req->hdr->type == D6_RENEW && pd->addr_iaid != ia_na->iaid) {
- insert_status(reply, opt1, D6_STATUS_NoBinding);
+ if (insert_status(reply, opt1, D6_STATUS_NoBinding))
+ goto out;
} else if (list_empty(&ses->ipv6->addr_list) || f) {
- insert_status(reply, opt1, D6_STATUS_NoAddrsAvail);
+ if (insert_status(reply, opt1, D6_STATUS_NoAddrsAvail))
+ goto out;
} else {
if (req->hdr->type == D6_REQUEST || req->rapid_commit)
@@ -296,6 +311,8 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
list_for_each_entry(a, &ses->ipv6->addr_list, entry) {
opt2 = dhcpv6_nested_option_alloc(reply, opt1, D6_OPTION_IAADDR, sizeof(*ia_addr) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt2)
+ goto out;
ia_addr = (struct dhcpv6_opt_ia_addr *)opt2->hdr;
build_ip6_addr(a, ses->ipv6->peer_intf_id, &addr);
@@ -342,13 +359,16 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
if (!f1) {
opt3 = dhcpv6_nested_option_alloc(reply, opt1, D6_OPTION_IAADDR, sizeof(*ia_addr) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt3)
+ goto out;
memcpy(opt3->hdr->data, opt2->hdr->data, sizeof(*ia_addr) - sizeof(struct dhcpv6_opt_hdr));
ia_addr = (struct dhcpv6_opt_ia_addr *)opt3->hdr;
ia_addr->pref_lifetime = 0;
ia_addr->valid_lifetime = 0;
- insert_status(reply, opt3, D6_STATUS_NotOnLink);
+ if (insert_status(reply, opt3, D6_STATUS_NotOnLink))
+ goto out;
}
}
}
@@ -363,6 +383,8 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
continue;
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_IA_PD, sizeof(struct dhcpv6_opt_ia_na) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt1)
+ goto out;
memcpy(opt1->hdr + 1, opt->hdr + 1, ntohs(opt1->hdr->len));
ia_na = (struct dhcpv6_opt_ia_na *)opt1->hdr;
@@ -380,9 +402,11 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
}
if ((req->hdr->type == D6_RENEW) && pd->dp_iaid != ia_na->iaid) {
- insert_status(reply, opt1, D6_STATUS_NoBinding);
+ if (insert_status(reply, opt1, D6_STATUS_NoBinding))
+ goto out;
} else if (!ses->ipv6_dp || list_empty(&ses->ipv6_dp->prefix_list) || f2) {
- insert_status(reply, opt1, D6_STATUS_NoPrefixAvail);
+ if (insert_status(reply, opt1, D6_STATUS_NoPrefixAvail))
+ goto out;
} else {
if (req->hdr->type == D6_REQUEST || req->rapid_commit) {
@@ -395,6 +419,8 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
list_for_each_entry(a, &ses->ipv6_dp->prefix_list, entry) {
opt2 = dhcpv6_nested_option_alloc(reply, opt1, D6_OPTION_IAPREFIX, sizeof(*ia_prefix) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt2)
+ goto out;
ia_prefix = (struct dhcpv6_opt_ia_prefix *)opt2->hdr;
memcpy(&ia_prefix->prefix, &a->addr, sizeof(a->addr));
@@ -424,12 +450,15 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
if (!f1) {
opt3 = dhcpv6_nested_option_alloc(reply, opt1, D6_OPTION_IAPREFIX, sizeof(*ia_prefix) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt3)
+ goto out;
memcpy(opt3->hdr->data, opt2->hdr->data, sizeof(*ia_prefix) - sizeof(struct dhcpv6_opt_hdr));
ia_prefix = (struct dhcpv6_opt_ia_prefix *)opt3->hdr;
ia_prefix->pref_lifetime = 0;
ia_prefix->valid_lifetime = 0;
- insert_status(reply, opt3, D6_STATUS_NotOnLink);
+ if (insert_status(reply, opt3, D6_STATUS_NotOnLink))
+ goto out;
}
}
}
@@ -444,21 +473,27 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
continue;
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_IA_TA, sizeof(struct dhcpv6_opt_ia_ta) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt1)
+ goto out;
memcpy(opt1->hdr + 1, opt->hdr + 1, ntohs(opt1->hdr->len));
- insert_status(reply, opt1, D6_STATUS_NoAddrsAvail);
+ if (insert_status(reply, opt1, D6_STATUS_NoAddrsAvail))
+ goto out;
// Option Request
} else if (ntohs(opt->hdr->code) == D6_OPTION_ORO) {
- insert_oro(reply, opt);
-
- } else if (ntohs(opt->hdr->code) == D6_OPTION_RAPID_COMMIT) {
- if (req->hdr->type == D6_SOLICIT)
- dhcpv6_option_alloc(reply, D6_OPTION_RAPID_COMMIT, 0);
+ if (insert_oro(reply, opt))
+ goto out;
}
}
+ if (req->hdr->type == D6_SOLICIT && req->rapid_commit &&
+ !dhcpv6_option_alloc(reply, D6_OPTION_RAPID_COMMIT, 0))
+ goto out;
+
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_PREFERENCE, 1);
+ if (!opt1)
+ goto out;
*(uint8_t *)opt1->hdr->data = 255;
//insert_status(reply, NULL, D6_STATUS_Success);
@@ -472,6 +507,7 @@ static void dhcpv6_send_reply(struct dhcpv6_packet *req, struct dhcpv6_pd *pd, i
net->sendto(pd->hnd.fd, reply->hdr, reply->endptr - (void *)reply->hdr, 0, (struct sockaddr *)&req->addr, sizeof(req->addr));
+out:
dhcpv6_packet_free(reply);
}
@@ -496,6 +532,8 @@ static void dhcpv6_send_reply2(struct dhcpv6_packet *req, struct dhcpv6_pd *pd,
// IA_NA
if (ntohs(opt->hdr->code) == D6_OPTION_IA_NA) {
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_IA_NA, sizeof(struct dhcpv6_opt_ia_na) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt1)
+ goto out;
memcpy(opt1->hdr + 1, opt->hdr + 1, ntohs(opt1->hdr->len));
ia_na = (struct dhcpv6_opt_ia_na *)opt1->hdr;
@@ -525,6 +563,8 @@ static void dhcpv6_send_reply2(struct dhcpv6_packet *req, struct dhcpv6_pd *pd,
}
opt3 = dhcpv6_nested_option_alloc(reply, opt1, D6_OPTION_IAADDR, sizeof(*ia_addr) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt3)
+ goto out;
memcpy(opt3->hdr->data, opt2->hdr->data, sizeof(*ia_addr) - sizeof(struct dhcpv6_opt_hdr));
ia_addr = (struct dhcpv6_opt_ia_addr *)opt3->hdr;
@@ -549,6 +589,8 @@ static void dhcpv6_send_reply2(struct dhcpv6_packet *req, struct dhcpv6_pd *pd,
// IA_PD
} else if (ntohs(opt->hdr->code) == D6_OPTION_IA_PD) {
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_IA_PD, sizeof(struct dhcpv6_opt_ia_na) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt1)
+ goto out;
memcpy(opt1->hdr + 1, opt->hdr + 1, ntohs(opt1->hdr->len));
ia_na = (struct dhcpv6_opt_ia_na *)opt1->hdr;
@@ -589,6 +631,8 @@ static void dhcpv6_send_reply2(struct dhcpv6_packet *req, struct dhcpv6_pd *pd,
}
opt3 = dhcpv6_nested_option_alloc(reply, opt1, D6_OPTION_IAPREFIX, sizeof(*ia_prefix) - sizeof(struct dhcpv6_opt_hdr));
+ if (!opt3)
+ goto out;
memcpy(opt3->hdr->data, opt2->hdr->data, sizeof(*ia_prefix) - sizeof(struct dhcpv6_opt_hdr));
ia_prefix = (struct dhcpv6_opt_ia_prefix *)opt3->hdr;
@@ -609,11 +653,15 @@ static void dhcpv6_send_reply2(struct dhcpv6_packet *req, struct dhcpv6_pd *pd,
f2 = 1;
}
// Option Request
- } else if (ntohs(opt->hdr->code) == D6_OPTION_ORO)
- insert_oro(reply, opt);
+ } else if (ntohs(opt->hdr->code) == D6_OPTION_ORO) {
+ if (insert_oro(reply, opt))
+ goto out;
+ }
}
opt1 = dhcpv6_option_alloc(reply, D6_OPTION_PREFERENCE, 1);
+ if (!opt1)
+ goto out;
*(uint8_t *)opt1->hdr->data = 255;
//insert_status(reply, NULL, D6_STATUS_Success);
diff --git a/accel-pppd/ipv6/dhcpv6.h b/accel-pppd/ipv6/dhcpv6.h
index 2326e639..7dfc71a1 100644
--- a/accel-pppd/ipv6/dhcpv6.h
+++ b/accel-pppd/ipv6/dhcpv6.h
@@ -10,6 +10,7 @@
#define DHCPV6_CLIENT_PORT 546
#define DHCPV6_SERV_PORT 547
+#define DHCPV6_HOP_COUNT_LIMIT 8
#define D6_OPTION_CLIENTID 1
#define D6_OPTION_SERVERID 2
diff --git a/accel-pppd/ipv6/dhcpv6_packet.c b/accel-pppd/ipv6/dhcpv6_packet.c
index f1c168b6..9190c505 100644
--- a/accel-pppd/ipv6/dhcpv6_packet.c
+++ b/accel-pppd/ipv6/dhcpv6_packet.c
@@ -63,6 +63,26 @@ static struct dict_option known_options[] = {
{ 0 }
};
+/* RFC 6334: one uncompressed, terminated DNS name. */
+static int validate_aftr_name(const uint8_t *data, unsigned int len)
+{
+ unsigned int offset = 0, label_len;
+
+ if (len <= 3 || len > 255)
+ return 0;
+
+ while (offset < len) {
+ label_len = data[offset++];
+ if (!label_len)
+ return offset > 1 && offset == len;
+ if (label_len > 63 || label_len > len - offset)
+ return 0;
+ offset += label_len;
+ }
+
+ return 0;
+}
+
static void *parse_option(void *ptr, void *endptr, struct list_head *opt_list)
{
struct dict_option *dopt;
@@ -75,6 +95,12 @@ static void *parse_option(void *ptr, void *endptr, struct list_head *opt_list)
return NULL;
}
+ if (opth->code == htons(D6_OPTION_AFTR_NAME) &&
+ !validate_aftr_name(opth->data, ntohs(opth->len))) {
+ log_warn("dhcpv6: invalid AFTR-Name option\n");
+ return NULL;
+ }
+
opt = _malloc(sizeof(*opt));
if (!opt) {
log_emerg("out of memory\n");
@@ -117,6 +143,7 @@ struct dhcpv6_packet *dhcpv6_packet_parse(const void *buf, size_t size)
struct dhcpv6_relay *rel;
struct dhcpv6_relay_hdr *rhdr;
struct dhcpv6_msg_hdr *inner_hdr;
+ int aftr_name_seen = 0, relay_depth = 0;
void *ptr, *endptr, *relay_end, *inner_end;
if (size < sizeof(struct dhcpv6_msg_hdr)) {
@@ -141,6 +168,10 @@ struct dhcpv6_packet *dhcpv6_packet_parse(const void *buf, size_t size)
endptr = ((void *)pkt->hdr) + size;
while (pkt->hdr->type == D6_RELAY_FORW) {
+ if (relay_depth++ >= DHCPV6_HOP_COUNT_LIMIT) {
+ log_warn("dhcpv6: relay nesting limit exceeded\n");
+ goto error;
+ }
rhdr = (struct dhcpv6_relay_hdr *)pkt->hdr;
if (((void *)rhdr) + sizeof(*rhdr) > endptr) {
log_warn("dhcpv6: invalid packet received\n");
@@ -205,8 +236,18 @@ struct dhcpv6_packet *dhcpv6_packet_parse(const void *buf, size_t size)
pkt->clientid = ptr;
else if (opth->code == htons(D6_OPTION_SERVERID))
pkt->serverid = ptr;
- else if (opth->code == htons(D6_OPTION_RAPID_COMMIT))
+ else if (opth->code == htons(D6_OPTION_AFTR_NAME)) {
+ if (aftr_name_seen++) {
+ log_warn("dhcpv6: duplicate AFTR-Name option\n");
+ goto error;
+ }
+ } else if (opth->code == htons(D6_OPTION_RAPID_COMMIT)) {
+ if (pkt->rapid_commit || opth->len) {
+ log_warn("dhcpv6: invalid or duplicate Rapid-Commit option\n");
+ goto error;
+ }
pkt->rapid_commit = 1;
+ }
ptr = parse_option(ptr, endptr, &pkt->opt_list);
if (!ptr)
@@ -224,7 +265,8 @@ struct dhcpv6_option *dhcpv6_option_alloc(struct dhcpv6_packet *pkt, int code, i
{
struct dhcpv6_option *opt;
- if ((void *)pkt->hdr->data + BUF_SIZE - pkt->endptr < sizeof(struct dhcpv6_opt_hdr) + len)
+ if (len < 0 || len > BUF_SIZE ||
+ (char *)(pkt + 1) + BUF_SIZE - (char *)pkt->endptr < sizeof(struct dhcpv6_opt_hdr) + (size_t)len)
return NULL;
opt = _malloc(sizeof(*opt));
@@ -251,7 +293,8 @@ struct dhcpv6_option *dhcpv6_nested_option_alloc(struct dhcpv6_packet *pkt, stru
{
struct dhcpv6_option *opt;
- if ((void *)pkt->hdr->data + BUF_SIZE - pkt->endptr < sizeof(struct dhcpv6_opt_hdr) + len)
+ if (len < 0 || len > BUF_SIZE ||
+ (char *)(pkt + 1) + BUF_SIZE - (char *)pkt->endptr < sizeof(struct dhcpv6_opt_hdr) + (size_t)len)
return NULL;
opt = _malloc(sizeof(*opt));
@@ -297,7 +340,7 @@ void dhcpv6_fill_relay_info(struct dhcpv6_packet *pkt)
memcpy(&rhdr->peer_addr, &rel->peer_addr, sizeof(rhdr->peer_addr));
opt = (struct dhcpv6_opt_hdr *)rhdr->data;
opt->code = htons(D6_OPTION_RELAY_MSG);
- opt->len = (uint8_t *)pkt->endptr - rhdr->data;
+ opt->len = htons((uint8_t *)pkt->endptr - opt->data);
}
rel = list_entry(pkt->relay_list.next, typeof(*rel), entry);
@@ -325,6 +368,9 @@ struct dhcpv6_packet *dhcpv6_packet_alloc_reply(struct dhcpv6_packet *req, int t
while (!list_empty(&req->relay_list)) {
rel = list_entry(req->relay_list.next, typeof(*rel), entry);
+ if ((char *)(pkt + 1) + BUF_SIZE - (char *)pkt->hdr <
+ sizeof(struct dhcpv6_relay_hdr) + sizeof(struct dhcpv6_opt_hdr) + sizeof(*pkt->hdr))
+ goto error;
rel->hdr = (void *)pkt->hdr;
pkt->hdr = (void *)rel->hdr + sizeof(struct dhcpv6_relay_hdr) + sizeof(struct dhcpv6_opt_hdr);
list_move_tail(&rel->entry, &pkt->relay_list);
diff --git a/accel-pppd/net.c b/accel-pppd/net.c
index c619deed..b31cdf44 100644
--- a/accel-pppd/net.c
+++ b/accel-pppd/net.c
@@ -223,9 +223,15 @@ static int def_get_ifindex(const char *ifname)
{
struct kern_net *n = container_of(net, typeof(*n), net);
struct ifreq ifr;
+ size_t len;
+
+ if (!ifname || (len = strnlen(ifname, IFNAMSIZ)) >= IFNAMSIZ) {
+ log_ppp_error("invalid interface name\n");
+ return -1;
+ }
memset(&ifr, 0, sizeof(ifr));
- strcpy(ifr.ifr_name, ifname);
+ memcpy(ifr.ifr_name, ifname, len);
if (ioctl(n->sock, SIOCGIFINDEX, &ifr)) {
log_ppp_error("ioctl(SIOCGIFINDEX): %s\n", strerror(errno));
diff --git a/accel-pppd/ppp/ppp_lcp.c b/accel-pppd/ppp/ppp_lcp.c
index 2424ca94..4af28dd0 100644
--- a/accel-pppd/ppp/ppp_lcp.c
+++ b/accel-pppd/ppp/ppp_lcp.c
@@ -634,7 +634,10 @@ static void lcp_recv_echo_repl(struct ppp_lcp_t *lcp, uint8_t *data, int size)
static void send_echo_reply(struct ppp_lcp_t *lcp)
{
struct lcp_hdr_t *hdr = (struct lcp_hdr_t*)lcp->ppp->buf;
- //uint32_t magic = *(uint32_t *)(hdr + 1);
+ uint16_t len = ntohs(hdr->len);
+
+ if (len > lcp->ppp->mtu)
+ return;
lcp->echo_sent = 0;
lcp->last_echo_ts = _time();
@@ -646,7 +649,7 @@ static void send_echo_reply(struct ppp_lcp_t *lcp)
if (conf_ppp_verbose)
log_ppp_debug("send [LCP EchoRep id=%x <magic %08x>]\n", hdr->id, lcp->magic);
- ppp_chan_send(lcp->ppp, hdr, min(ntohs(hdr->len), lcp->ppp->mtu) + 2);
+ ppp_chan_send(lcp->ppp, hdr, len + 2);
}
static void send_echo_request(struct triton_timer_t *t)
diff --git a/accel-pppd/radius/acct.c b/accel-pppd/radius/acct.c
index 0448fc95..8a344516 100644
--- a/accel-pppd/radius/acct.c
+++ b/accel-pppd/radius/acct.c
@@ -6,7 +6,6 @@
#include <sys/ioctl.h>
#include <netinet/in.h>
-#include <openssl/md5.h>
#include "linux_ppp.h"
@@ -22,30 +21,6 @@
#define INTERIM_SAFE_TIME 10
-static int req_set_RA(struct rad_req_t *req)
-{
- char *secret;
- MD5_CTX ctx;
-
- secret = rad_server_secret_dup(req->serv);
- if (!secret)
- return -1;
-
- if (rad_packet_build(req->pack, req->RA)) {
- _free(secret);
- return -1;
- }
-
- MD5_Init(&ctx);
- MD5_Update(&ctx, req->pack->buf, req->pack->len);
- MD5_Update(&ctx, secret, strlen(secret));
- MD5_Final(req->pack->buf + 4, &ctx);
-
- _free(secret);
-
- return 0;
-}
-
static int req_set_stat(struct rad_req_t *req, struct ap_session *ses)
{
struct timespec ts;
@@ -185,9 +160,6 @@ static void rad_acct_interim_update(struct triton_timer_t *t)
rpd->acct_req->ts = ts.tv_sec;
rpd->acct_req->pack->id++;
- if (!rpd->acct_req->before_send)
- req_set_RA(rpd->acct_req);
-
rpd->acct_req->timeout.expire_tv.tv_sec = conf_timeout;
rpd->acct_req->try = 0;
@@ -218,8 +190,6 @@ static int rad_acct_before_send(struct rad_req_t *req)
clock_gettime(CLOCK_MONOTONIC, &ts);
rad_packet_change_int(req->pack, NULL, "Acct-Delay-Time", ts.tv_sec - req->ts + conf_acct_delay_start);
- req_set_RA(req);
-
return 0;
}
@@ -314,8 +284,6 @@ static int __rad_acct_start(struct radius_pd_t *rpd)
if (conf_acct_delay_time)
req->before_send = rad_acct_before_send;
- else if (req_set_RA(req))
- goto out_err;
req->recv = rad_acct_start_recv;
req->timeout.expire = rad_acct_start_timeout;
@@ -547,7 +515,6 @@ int rad_acct_stop(struct radius_pd_t *rpd)
rad_packet_change_val(req->pack, NULL, "Acct-Status-Type", "Stop");
req_set_stat(req, rpd->ses);
- req_set_RA(req);
req->recv = rad_acct_stop_recv;
req->timeout.expire = rad_acct_stop_timeout;
diff --git a/accel-pppd/radius/auth.c b/accel-pppd/radius/auth.c
index d2cb9803..63b1345e 100644
--- a/accel-pppd/radius/auth.c
+++ b/accel-pppd/radius/auth.c
@@ -22,7 +22,7 @@ static int decrypt_chap_mppe_keys(struct rad_req_t *req, struct rad_attr_t *attr
uint8_t md5[MD5_DIGEST_LENGTH];
uint8_t sha1[SHA_DIGEST_LENGTH];
uint8_t plain[32];
- char *secret;
+ const char *secret;
int i;
if (attr->len != 32) {
@@ -30,7 +30,7 @@ static int decrypt_chap_mppe_keys(struct rad_req_t *req, struct rad_attr_t *attr
return -1;
}
- secret = rad_server_secret_dup(req->serv);
+ secret = (const char *)req->pack->secret;
if (!secret)
return -1;
@@ -59,7 +59,6 @@ static int decrypt_chap_mppe_keys(struct rad_req_t *req, struct rad_attr_t *attr
SHA1_Final(sha1, &sha1_ctx);
memcpy(key, sha1, 16);
- _free(secret);
return 0;
}
@@ -69,7 +68,7 @@ static int decrypt_mppe_key(struct rad_req_t *req, struct rad_attr_t *attr, uint
MD5_CTX md5_ctx;
uint8_t md5[16];
uint8_t plain[32];
- char *secret;
+ const char *secret;
int i;
if (attr->len != 34) {
@@ -82,7 +81,7 @@ static int decrypt_mppe_key(struct rad_req_t *req, struct rad_attr_t *attr, uint
return -1;
}
- secret = rad_server_secret_dup(req->serv);
+ secret = (const char *)req->pack->secret;
if (!secret)
return -1;
@@ -99,7 +98,6 @@ static int decrypt_mppe_key(struct rad_req_t *req, struct rad_attr_t *attr, uint
if (plain[0] != 16) {
log_ppp_warn("radius: %s: incorrect key length (%i)\n", attr->attr->name, plain[0]);
- _free(secret);
return -1;
}
@@ -111,7 +109,6 @@ static int decrypt_mppe_key(struct rad_req_t *req, struct rad_attr_t *attr, uint
plain[16] ^= md5[0];
memcpy(key, plain + 1, 16);
- _free(secret);
return 0;
}
@@ -288,17 +285,16 @@ int rad_auth_pap(struct radius_pd_t *rpd, const char *username, va_list args)
const char *passwd = va_arg(args, const char *);
uint8_t *epasswd;
int epasswd_len;
- char *secret;
+ const char *secret;
if (!req)
return PWDB_DENIED;
- secret = rad_server_secret_dup(req->serv);
+ secret = (const char *)req->pack->secret;
if (!secret)
return PWDB_DENIED;
epasswd = encrypt_password(passwd, secret, req->RA, &epasswd_len);
- _free(secret);
if (!epasswd)
return PWDB_DENIED;
diff --git a/accel-pppd/radius/dm_coa.c b/accel-pppd/radius/dm_coa.c
index df8cdf3e..728fd938 100644
--- a/accel-pppd/radius/dm_coa.c
+++ b/accel-pppd/radius/dm_coa.c
@@ -146,16 +146,16 @@ static void disconnect_request(struct radius_pd_t *rpd)
}
#ifdef HAVE_VRF
-int rad_update_vrf(struct radius_pd_t *rpd, const char *vrf_name)
+static int rad_update_vrf(struct radius_pd_t *rpd, const char *vrf_name, int len)
{
- if (*vrf_name == '0') {
+ if (len == 1 && *vrf_name == '0') {
// Delete interface from VRF
if (!ap_session_vrf(rpd->ses, NULL, 0))
return 1;
}
else {
// Add interface to VRF
- if(!ap_session_vrf(rpd->ses, vrf_name, -1))
+ if(!ap_session_vrf(rpd->ses, vrf_name, len))
return 1;
}
@@ -215,7 +215,7 @@ static void coa_request(struct radius_pd_t *rpd)
#ifdef HAVE_VRF
attr = rad_packet_find_attr(rpd->dm_coa_req, "Accel-PPP", "Accel-VRF-Name");
if (attr){
- if(!rad_update_vrf(rpd, attr->val.string)){
+ if(!rad_update_vrf(rpd, attr->val.string, attr->len)){
goto out;
}
}
diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c
index 4a0ab244..9f135507 100644
--- a/accel-pppd/radius/packet.c
+++ b/accel-pppd/radius/packet.c
@@ -881,6 +881,7 @@ int rad_packet_send(struct rad_packet_t *pack, int fd, struct sockaddr_in *addr)
uint8_t hmac[HMAC_MD5_LEN];
uint8_t *ptr = pack->buf;
uint8_t *hmac_ptr = ptr + PACKET_SIGNED_OFFSET;
+ memset(hmac_ptr, 0, HMAC_MD5_LEN);
if (hmac_md5((const uint8_t *)pack->secret, strlen((const char *)pack->secret), pack->buf, pack->len, hmac) < 0) {
log_emerg("radius:packet: failed to calculate HMAC\n");
return -1;
diff --git a/accel-pppd/radius/radius.c b/accel-pppd/radius/radius.c
index fa77a916..89f1e398 100644
--- a/accel-pppd/radius/radius.c
+++ b/accel-pppd/radius/radius.c
@@ -545,9 +545,16 @@ int rad_proc_attrs(struct rad_req_t *req)
} else if (attr->vendor->id == VENDOR_Accel_PPP) {
switch (attr->attr->id) {
case Accel_VRF_Name:
+ if (attr->len < 0 || attr->len >= IFNAMSIZ ||
+ memchr(attr->val.string, 0, attr->len)) {
+ log_ppp_warn("radius: invalid Accel-VRF-Name, rejecting Access-Accept\n");
+ return -1;
+ }
if (rpd->ses->vrf_name)
_free(rpd->ses->vrf_name);
rpd->ses->vrf_name = _malloc(attr->len + 1);
+ if (!rpd->ses->vrf_name)
+ return -1;
memcpy(rpd->ses->vrf_name, attr->val.string, attr->len);
rpd->ses->vrf_name[attr->len] = 0;
break;
diff --git a/accel-pppd/radius/req.c b/accel-pppd/radius/req.c
index 72c46b16..9a957493 100644
--- a/accel-pppd/radius/req.c
+++ b/accel-pppd/radius/req.c
@@ -5,6 +5,8 @@
#include <fcntl.h>
#include <unistd.h>
#include <assert.h>
+#include <openssl/md5.h>
+#include <openssl/crypto.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
@@ -17,6 +19,49 @@
#define HMAC_MD5_LEN 16
+/* Keep the signing secret and authenticator with the packet across reloads. */
+static int rad_req_set_RA(struct rad_req_t *req)
+{
+ char *secret = rad_server_secret_dup(req->serv);
+ MD5_CTX ctx;
+
+ if (!secret)
+ return -1;
+
+ memset(req->RA, 0, sizeof(req->RA));
+ if (rad_packet_build(req->pack, req->RA)) {
+ _free(secret);
+ return -1;
+ }
+
+ MD5_Init(&ctx);
+ MD5_Update(&ctx, req->pack->buf, req->pack->len);
+ MD5_Update(&ctx, secret, strlen(secret));
+ MD5_Final(req->pack->buf + 4, &ctx);
+ memcpy(req->RA, req->pack->buf + 4, sizeof(req->RA));
+ _free(req->pack->secret);
+ req->pack->secret = (uint8_t *)secret;
+ return 0;
+}
+
+static int verify_response_authenticator(struct rad_req_t *req, struct rad_packet_t *pack)
+{
+ uint8_t expected[MD5_DIGEST_LENGTH];
+ MD5_CTX ctx;
+
+ if (!pack || !pack->buf || pack->len < 20 ||
+ !req->pack->buf || !req->pack->secret)
+ return -1;
+
+ MD5_Init(&ctx);
+ MD5_Update(&ctx, pack->buf, 4);
+ MD5_Update(&ctx, req->pack->buf + 4, 16);
+ MD5_Update(&ctx, pack->buf + 20, pack->len - 20);
+ MD5_Update(&ctx, req->pack->secret, strlen((char *)req->pack->secret));
+ MD5_Final(expected, &ctx);
+ return CRYPTO_memcmp(expected, pack->buf + 4, sizeof(expected));
+}
+
static int make_socket(struct rad_req_t *req);
static mempool_t req_pool;
@@ -75,12 +120,15 @@ static struct rad_req_t *__rad_req_alloc(struct radius_pd_t *rpd, int code, cons
if (!req->pack)
goto out_err;
- if (code == CODE_ACCESS_REQUEST && conf_blast_protection) {
- uint8_t buf[HMAC_MD5_LEN] = {0};
- req->pack->message_authenticator = 1;
+ if (code == CODE_ACCESS_REQUEST) {
req->pack->secret = (uint8_t *)rad_server_secret_dup(req->serv);
if (!req->pack->secret)
goto out_err;
+ }
+
+ if (code == CODE_ACCESS_REQUEST && conf_blast_protection) {
+ uint8_t buf[HMAC_MD5_LEN] = {0};
+ req->pack->message_authenticator = 1;
if (rad_packet_add_octets(req->pack, NULL, "Message-Authenticator", buf, HMAC_MD5_LEN)) {
_free(req->pack->secret);
req->pack->secret = NULL;
@@ -380,6 +428,10 @@ int __rad_req_send(struct rad_req_t *req, int async)
if (req->before_send && req->before_send(req))
goto out_err;
+ /* Re-sign accounting after server selection, including retries without delay-time. */
+ if (req->pack->code == CODE_ACCOUNTING_REQUEST && rad_req_set_RA(req))
+ goto out_err;
+
if (!req->pack->buf && rad_packet_build(req->pack, req->RA))
goto out_err;
@@ -461,12 +513,15 @@ int rad_req_read(struct triton_md_handler_t *h)
if (rad_packet_recv(h->fd, &pack, NULL))
return 0;
- rad_server_reply(req->serv);
-
- if (pack->id == req->pack->id)
- break;
+ if (!pack)
+ return 0;
+ if (pack->id != req->pack->id || verify_response_authenticator(req, pack)) {
+ rad_packet_free(pack);
+ continue;
+ }
- rad_packet_free(pack);
+ rad_server_reply(req->serv);
+ break;
}
req->reply = pack;
diff --git a/accel-pppd/radius/serv.c b/accel-pppd/radius/serv.c
index 71398c82..34367731 100644
--- a/accel-pppd/radius/serv.c
+++ b/accel-pppd/radius/serv.c
@@ -11,7 +11,6 @@
#include <netinet/in.h>
#include <arpa/inet.h>
-#include <openssl/md5.h>
#include "log.h"
#include "triton.h"
@@ -315,10 +314,19 @@ void rad_server_req_exit(struct rad_req_t *req)
int rad_server_realloc(struct rad_req_t *req)
{
struct rad_server_t *s = __rad_server_get(req->type, req->serv, 0, 0);
+ char *secret;
if (!s)
return -1;
+ secret = rad_server_secret_dup(s);
+ if (!secret) {
+ rad_server_put(s, req->type);
+ return -1;
+ }
+ _free(req->pack->secret);
+ req->pack->secret = (uint8_t *)secret;
+
if (req->serv)
rad_server_put(req->serv, req->type);
@@ -449,30 +457,6 @@ void rad_server_stat_interim_query(struct rad_server_t *s, unsigned int dt)
stat_accm_add(s->stat.interim_query_5m, dt);
}
-static int req_set_RA(struct rad_req_t *req)
-{
- char *secret;
- MD5_CTX ctx;
-
- secret = rad_server_secret_dup(req->serv);
- if (!secret)
- return -1;
-
- if (rad_packet_build(req->pack, req->RA)) {
- _free(secret);
- return -1;
- }
-
- MD5_Init(&ctx);
- MD5_Update(&ctx, req->pack->buf, req->pack->len);
- MD5_Update(&ctx, secret, strlen(secret));
- MD5_Final(req->pack->buf + 4, &ctx);
-
- _free(secret);
-
- return 0;
-}
-
static void acct_on_sent(struct rad_req_t *req, int res)
{
if (!res && !req->hnd.tpd) {
@@ -556,11 +540,9 @@ static void send_acct_on(struct rad_server_t *s)
if (rad_packet_add_ipaddr(req->pack, NULL, "NAS-IP-Address", conf_nas_ip_address))
goto out_err;
- if (req_set_RA(req))
+ if (__rad_req_send(req, 0))
goto out_err;
- __rad_req_send(req, 0);
-
triton_timer_add(&s->ctx, &req->timeout, 0);
return;
diff --git a/accel-pppd/triton/mempool.c b/accel-pppd/triton/mempool.c
index a3c72dae..c37b66da 100644
--- a/accel-pppd/triton/mempool.c
+++ b/accel-pppd/triton/mempool.c
@@ -162,6 +162,8 @@ void __export mempool_free(void *ptr)
it->magic1 = 0;
#endif
+ memset(it->ptr, 0, p->size);
+
spin_lock(&p->lock);
#ifdef MEMDEBUG
list_del(&it->entry);
diff --git a/docs/ng40-safeguards-review.md b/docs/ng40-safeguards-review.md
new file mode 100644
index 00000000..592869c6
--- /dev/null
+++ b/docs/ng40-safeguards-review.md
@@ -0,0 +1,135 @@
+# Additional safeguards from accel-ppp-ng PR #40
+
+Compared against freshly fetched accel-ppp `upstream/master` at
+`c414f0a7` (2026-09-07). Reference:
+[accel-ppp-ng PR #40](https://github.com/accel-ppp/accel-ppp-ng/pull/40/commits),
+base `c7b67eb010a99ceefe13d2f74fc672cb91ce0af9`, head
+`3843773f15af477c39a326720ac5f3e713b373fb`.
+
+The reference contains 20 commits. Several reported vulnerabilities already
+have independent upstream fixes by Denys Fedoryshchenko. This branch adds the
+remaining safeguards while retaining upstream's existing parsing and policy.
+
+## What was missing
+
+- PPPoE rejected missing Service-Name tags but accepted duplicates. A matching
+ earlier tag could validate a different final selection. Require exactly one
+ tag. Preserve silent rejection before cookie validation; no error response
+ is sent for an unauthenticated request.
+- DHCPv6 accepted duplicate/nonempty Rapid-Commit options and emitted one
+ response option per occurrence. Reject malformed requests and emit at most
+ one Rapid-Commit. AFTR printing was already bounded, but parsing did not
+ validate the uncompressed, terminated DNS name or reject duplicate AFTR
+ options. Add those checks and an eight-layer relay nesting limit.
+- DHCPv6 reply bounds were measured from a moving inner-message pointer.
+ Bound relay headers and both option allocators by the actual 4096-byte
+ allocation, including the inner header. Propagate allocation failures
+ through both reply builders, status insertion, and ORO expansion; discard
+ an incomplete reply. Encode Relay-Message length in network byte order,
+ excluding its option header, so valid relayed replies remain usable.
+- RADIUS accepted replies based only on the identifier. Verify the Response
+ Authenticator using the request's wire authenticator and secret snapshot
+ before updating server health, releasing the request slot, or invoking its
+ callback. Use constant-time comparison. This is independent of the existing
+ outbound Message-Authenticator/`blast-protection` setting.
+- Accounting signing did not preserve its computed Request Authenticator.
+ Centralize signing after server selection and delay updates, zero the
+ authenticator before each hash, and retain the result and signing secret.
+ This covers Start/Interim/Stop and Accounting-On/Off, including retransmits
+ with `acct-delay-time` disabled. Snapshot Access-Request secrets too; use
+ that snapshot for PAP encryption and MPPE decryption, refresh it on server
+ changes, and zero Message-Authenticator before each retransmit calculation.
+- Accel-VRF-Name could reach an unbounded interface-name copy. Reject oversized
+ and embedded-NUL Access-Accept values and handle allocation failure. Enforce
+ the same boundary at interface lookup and the length-delimited session API.
+ Preserve the CoA attribute length instead of silently accepting a prefix
+ before NUL. Only the literal CoA value `0` removes the VRF; names such as
+ `0blue` are now treated as interface names. Empty names and `(NULL, 0)` still
+ select the default VRF.
+- LCP already bounded received packets and mandatory fields, but an Echo-Request
+ larger than the peer's MTU produced a truncated response with the old length
+ field. Discard it before modifying the packet or echo state.
+- Normal pooled allocations retained their former contents after free. Clear
+ the payload before returning it to the pool as defense in depth. This adds a
+ write proportional to object size; it does not replace protocol bounds checks.
+ The separate MEMDEBUG allocator is unchanged.
+
+## Reference commit coverage
+
+Reference hashes link to the original authors' commits. “Present” identifies
+upstream code already providing the relevant safeguard, not necessarily an
+identical patch.
+
+| Reference commit | Topic | Upstream baseline and this branch |
+| --- | --- | --- |
+| [ef7323fd](https://github.com/accel-ppp/accel-ppp-ng/commit/ef7323fd6dfe5655a46581733c86f4abcbfee548) | T8464 Service-Name | Missing-name rejection present (`f8dfbeca`, `4deb615d`); add duplicate rejection. |
+| [371e7f0a](https://github.com/accel-ppp/accel-ppp-ng/commit/371e7f0a3e21d3040941330858274e104f1dfdcd) | T8473 Rapid-Commit | Add parser checks and single response option. |
+| [10a3e72d](https://github.com/accel-ppp/accel-ppp-ng/commit/10a3e72d523c7fe910a23febe979a3de9cd55d8f) | T8474 AFTR | Printer bounds present (`3004db8b`); add parser semantics and duplicate checks. |
+| [bd1806e7](https://github.com/accel-ppp/accel-ppp-ng/commit/bd1806e74baff0ef9b6a24a1a73741f8b7ca5125) | T8475 relay layers | Inner bounds/progress present (`b0e7444c`, `a9bfcdb8`, `94993558`); add depth and physical reply bounds, including caller failure handling. |
+| [248e7caa](https://github.com/accel-ppp/accel-ppp-ng/commit/248e7caa2cf5c2e1fcaad60abedd7ccfc6365d3b) | T8526 response authentication | Add verification with upstream's OpenSSL API and reload-safe secret ownership. |
+| [7ce6244f](https://github.com/accel-ppp/accel-ppp-ng/commit/7ce6244f044f10650adadfcb34e8b6f095a8967b) | T8543 Framed-Route | Present (`a4c79494`, `027bff94`); retain configurable strictness. |
+| [be2f54db](https://github.com/accel-ppp/accel-ppp-ng/commit/be2f54dbf8272d6bdd3da1c98c7d9838b95dc27b) | T8545 accounting RA | Add shared zero/hash/save signing. |
+| [24afb859](https://github.com/accel-ppp/accel-ppp-ng/commit/24afb859e0a28a509d930a6cf9bea1d8f5baf732) | T8549 status printing | Present (`6019e1d1`, `52a01730`). |
+| [2fa64759](https://github.com/accel-ppp/accel-ppp-ng/commit/2fa647594e9d2c64e2f75e3e1537a748e5568d73) | T8550 SSTP lengths | Present (`1719b4ab`). |
+| [55a804af](https://github.com/accel-ppp/accel-ppp-ng/commit/55a804afaaddd671fbb58290977a59c03369ab5e) | T8611 VRF | Add Access-Accept, CoA, session API, and shared lookup safeguards. |
+| [c93b3675](https://github.com/accel-ppp/accel-ppp-ng/commit/c93b36755c285ef05400fa7be34f7560f02fe2e3) | T8825 tag copy | Present (`c32518d7`); no duplicate port. |
+| [1a42ab40](https://github.com/accel-ppp/accel-ppp-ng/commit/1a42ab408da86acde9292120835bd76eb82e8809) | T8830 PPP lengths/pool clear | Packet bounds present (`028b942d`, `d22666a8`); add pool payload clearing. |
+| [1957e7d1](https://github.com/accel-ppp/accel-ppp-ng/commit/1957e7d1c131b65768f9fc4b3881e5fdb544f159) | T8830 LCP fields/Echo | Mandatory-field access checks present (`028b942d`); add Echo MTU rejection. |
+| [64311652](https://github.com/accel-ppp/accel-ppp-ng/commit/64311652003f719a16cecbb1d5be71af02f57370) | T8545 Accounting-On/Off | Use shared signing; callback UAF already fixed by `7bd6843c`. |
+| [01baa010](https://github.com/accel-ppp/accel-ppp-ng/commit/01baa010a45b01ff067405646da89411fd2cc02a) | T8464 cookie ordering | Upstream silently rejects malformed Service-Name; preserve that safe behavior. |
+| [8305387d](https://github.com/accel-ppp/accel-ppp-ng/commit/8305387d80c7a5009988106702b23c6eeca8f57a) | T8825 tag fixup | Existing capacity check protects the write; no duplicate port. |
+| [f52607d4](https://github.com/accel-ppp/accel-ppp-ng/commit/f52607d4ae216e7d84d7bdacd8581a136248b3e2) | T8545 EVP cleanup | Upstream uses stack MD5 contexts; no EVP allocation to free here. |
+| [177238b1](https://github.com/accel-ppp/accel-ppp-ng/commit/177238b1799456510d56637eaa210d62eedef353) | T8611 allocation failure | Include VRF allocation failure handling. |
+| [2f18c76d](https://github.com/accel-ppp/accel-ppp-ng/commit/2f18c76d92eef9d09805146847ee690234371963) | T8550 cast fixup | SSTP safeguard already present. |
+| [3843773f](https://github.com/accel-ppp/accel-ppp-ng/commit/3843773f15af477c39a326720ac5f3e713b373fb) | T8474 log indentation | New parser log follows upstream style; no standalone cosmetic port. |
+
+## Credits
+
+Original safeguard patches: **Ritika Chopra** `<r.chopra@vyos.io>`.
+The tag fixup `8305387d` is authored as **RC** `<ritika0313@gmail.com>` and
+carries the original trailer
+`Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>`.
+That fixup is already covered upstream and was not copied into this branch.
+Adaptations retain Ritika's credit in their commit messages. Existing upstream
+fixes and this integration are by **Denys Fedoryshchenko**.
+
+## Validation
+
+Run from the repository root:
+
+```sh
+cmake -S . -B /tmp/accel-ppp-ng40-build -DCMAKE_BUILD_TYPE=Debug \
+ -DBUILD_IPOE_DRIVER=FALSE -DBUILD_VLAN_MON_DRIVER=FALSE
+cmake --build /tmp/accel-ppp-ng40-build -j 8
+sh tests/unit/run_safeguards.sh /tmp/accel-ppp-ng40-build
+git diff --check
+```
+
+Build, the existing IPv6 DNS selection test, and five standalone suites passed. Tests compile production code with
+small external-service stubs. DHCPv6, RADIUS, VRF, and pool tests use ASan,
+UBSan, and LeakSanitizer; the LCP test uses UBSan (ASan's global registration
+otherwise retains the entire daemon's layer table). No sanitizer failures.
+The VRF harness emits an unused-path compiler warning about the uninitialized
+namespace configuration in `alloc_net`; that path is not executed.
+
+Covered: duplicate/nonempty Rapid-Commit, valid single Rapid-Commit replies,
+malformed/duplicate AFTR, direct and eight-layer replies, excessive nesting,
+exact buffer fill and overflow rejection, negative allocation lengths, ORO
+expansion exhaustion in both reply builders, response digests for Accept/
+Reject/Challenge/Accounting, forged reply rejection before callbacks/health,
+valid reply delivery, Message-Authenticator retransmission, accounting digest
+recomputation and secret changes,
+VRF boundaries/embedded NUL/CoA/default removal, Echo MTU boundaries, and pool
+payload clearing on reuse.
+
+Baseline reproductions against `c414f0a7` failed as expected: the duplicate
+Rapid-Commit rejection assertion and the forged Access-Accept rejection
+assertion. The corresponding patched checks pass.
+
+Limits: these are focused in-process tests, not a complete deployed NAS or
+network-namespace session suite. PPPoE duplicate rejection was reviewed against
+its real parser and callers but was not exercised over an Ethernet interface.
+Live RADIUS server failover, full PAP/MPPE interoperability, and pool-clearing
+throughput were not measured. In particular, upstream already sends PAP's
+original encrypted password when changing to a server with a different secret;
+this branch does not redesign that pre-existing failover behavior.
diff --git a/tests/unit/dhcpv6_safeguards_test.c b/tests/unit/dhcpv6_safeguards_test.c
new file mode 100644
index 00000000..63692ee3
--- /dev/null
+++ b/tests/unit/dhcpv6_safeguards_test.c
@@ -0,0 +1,154 @@
+/* Standalone tests of the production parser and reply builders. See run_safeguards.sh. */
+#include <assert.h>
+#include "triton.h"
+#undef DEFINE_INIT
+#define DEFINE_INIT(o, f)
+#include "../../accel-pppd/ipv6/dhcpv6_packet.c"
+#undef BUF_SIZE
+#include "../../accel-pppd/ipv6/dhcpv6.c"
+
+__thread struct ap_net *net;
+static unsigned int sent;
+static unsigned char response[4096];
+static size_t response_len;
+void log_warn(const char *fmt, ...) {}
+void log_emerg(const char *fmt, ...) {}
+void log_ppp_error(const char *fmt, ...) {}
+void log_ppp_info2(const char *fmt, ...) {}
+int ip6addr_add_peer(int i, struct in6_addr *a, struct in6_addr *p) { return 0; }
+int ip6route_add(int i, const struct in6_addr *a, int p, const struct in6_addr *g, int m, uint32_t prio, const char *v) { return 0; }
+struct ipv6db_prefix_t *ipdb_get_ipv6_prefix(struct ap_session *s) { return NULL; }
+
+static ssize_t capture_send(int fd, const void *buf, size_t len, int flags,
+ const struct sockaddr *addr, socklen_t addrlen)
+{
+ assert(len <= sizeof(response));
+ memcpy(response, buf, len);
+ response_len = len;
+ sent++;
+ return len;
+}
+
+static size_t option(unsigned char *p, unsigned int code, const void *data, size_t len)
+{
+ u_write_be16(p, code);
+ u_write_be16(p + 2, len);
+ if (len)
+ memcpy(p + 4, data, len);
+ return len + 4;
+}
+
+static size_t request(unsigned char *buf)
+{
+ static const unsigned char duid[] = {0, 3, 0, 1, 1, 2, 3, 4, 5, 6};
+ size_t len = 4;
+ memset(buf, 0, 4);
+ buf[0] = D6_SOLICIT;
+ len += option(buf + len, D6_OPTION_CLIENTID, duid, sizeof(duid));
+ len += option(buf + len, D6_OPTION_SERVERID, duid, sizeof(duid));
+ return len;
+}
+
+static size_t relay(unsigned char *buf, size_t len)
+{
+ size_t hdrlen = sizeof(struct dhcpv6_relay_hdr);
+ memmove(buf + hdrlen + 4, buf, len);
+ memset(buf, 0, hdrlen);
+ buf[0] = D6_RELAY_FORW;
+ u_write_be16(buf + hdrlen, D6_OPTION_RELAY_MSG);
+ u_write_be16(buf + hdrlen + 2, len);
+ return len + hdrlen + 4;
+}
+
+int main(void)
+{
+ unsigned char buf[16000], oro[4000], name[256];
+ const unsigned char valid_name[] = {2, 'g', 'w', 0};
+ struct dhcpv6_packet *pkt, *reply;
+ struct dhcpv6_option *opt;
+ struct ap_session ses = {0};
+ struct dhcpv6_pd pd = {0};
+ struct ap_net test_net = {.sendto = capture_send};
+ size_t len, base, avail;
+ int i;
+
+ net = &test_net;
+ base = request(buf);
+ len = base + option(buf + base, D6_OPTION_RAPID_COMMIT, NULL, 0);
+ pkt = dhcpv6_packet_parse(buf, len);
+ assert(pkt && pkt->rapid_commit);
+ pkt->ses = &ses;
+ dhcpv6_send_reply(pkt, &pd, D6_REPLY);
+ assert(sent == 1);
+ reply = dhcpv6_packet_parse(response, response_len);
+ assert(reply && reply->rapid_commit);
+ dhcpv6_packet_free(reply);
+ dhcpv6_packet_free(pkt);
+ len += option(buf + len, D6_OPTION_RAPID_COMMIT, NULL, 0);
+ assert(!dhcpv6_packet_parse(buf, len));
+ len = base + option(buf + base, D6_OPTION_RAPID_COMMIT, "x", 1);
+ assert(!dhcpv6_packet_parse(buf, len));
+
+ len = base + option(buf + base, D6_OPTION_AFTR_NAME, valid_name, sizeof(valid_name));
+ pkt = dhcpv6_packet_parse(buf, len);
+ assert(pkt);
+ dhcpv6_packet_free(pkt);
+ len += option(buf + len, D6_OPTION_AFTR_NAME, valid_name, sizeof(valid_name));
+ assert(!dhcpv6_packet_parse(buf, len));
+ memset(name, 'x', sizeof(name));
+ for (i = 0; i < 5; i++) {
+ const unsigned char invalid[][4] = {{0,0,0,0}, {0xc0,1,1,0}, {4,'a','b',0}, {2,'a','b',1}, {1,'a',0,1}};
+ len = base + option(buf + base, D6_OPTION_AFTR_NAME, invalid[i], 4);
+ assert(!dhcpv6_packet_parse(buf, len));
+ }
+ len = base + option(buf + base, D6_OPTION_AFTR_NAME, name, sizeof(name));
+ assert(!dhcpv6_packet_parse(buf, len));
+
+ len = request(buf);
+ for (i = 0; i <= DHCPV6_HOP_COUNT_LIMIT; i++) {
+ pkt = dhcpv6_packet_parse(buf, len);
+ assert(pkt);
+ reply = dhcpv6_packet_alloc_reply(pkt, D6_REPLY);
+ assert(reply);
+ /* The last legal byte is writable; both allocators reject overflow. */
+ avail = (char *)(reply + 1) + 4096 - (char *)reply->endptr;
+ opt = dhcpv6_option_alloc(reply, 65000, avail - 4);
+ assert(opt);
+ memset(opt->hdr->data, 1, avail - 4);
+ assert(!dhcpv6_option_alloc(reply, 65000, 0));
+ assert(!dhcpv6_nested_option_alloc(reply, opt, 65000, 0));
+ assert(!dhcpv6_option_alloc(reply, 65000, -1));
+ dhcpv6_fill_relay_info(reply);
+ assert((char *)reply->endptr == (char *)(reply + 1) + 4096);
+ /* Verify Relay-Message wire length in every enclosing layer. */
+ if (i) {
+ struct dhcpv6_relay_hdr *h = (void *)reply->hdr;
+ struct dhcpv6_opt_hdr *o = (void *)h->data;
+ assert(ntohs(o->len) == (char *)reply->endptr - (char *)o->data);
+ }
+ dhcpv6_packet_free(reply);
+ dhcpv6_packet_free(pkt);
+ len = relay(buf, len);
+ }
+ assert(!dhcpv6_packet_parse(buf, len));
+
+ /* An ORO can amplify a small request into more than 4096 response bytes. */
+ conf_dns_count = 1;
+ for (i = 0; i < sizeof(oro); i += 2)
+ u_write_be16(oro + i, D6_OPTION_DNS_SERVERS);
+ len = request(buf);
+ len += option(buf + len, D6_OPTION_ORO, oro, sizeof(oro));
+ pkt = dhcpv6_packet_parse(buf, len);
+ assert(pkt);
+ pkt->ses = &ses;
+ sent = 0;
+ dhcpv6_send_reply(pkt, &pd, D6_REPLY);
+ assert(!sent);
+ dhcpv6_send_reply2(pkt, &pd, D6_REPLY);
+ assert(!sent);
+ dhcpv6_packet_free(pkt);
+ puts("DHCPv6 safeguards: PASS");
+ return 0;
+}
+void build_ip6_addr(struct ipv6db_addr_t *a, uint64_t id, struct in6_addr *addr) { *addr = a->addr; }
+int ip6addr_add(int i, struct in6_addr *a, int p) { return 0; }
diff --git a/tests/unit/lcp_safeguards_test.c b/tests/unit/lcp_safeguards_test.c
new file mode 100644
index 00000000..32a14dfb
--- /dev/null
+++ b/tests/unit/lcp_safeguards_test.c
@@ -0,0 +1,40 @@
+/* Exercise production Echo-Reply handling at the negotiated MTU. */
+#include <assert.h>
+#include "triton.h"
+#undef DEFINE_INIT
+#define DEFINE_INIT(o, f)
+#include "../../accel-pppd/ppp/ppp_lcp.c"
+
+int conf_ppp_verbose;
+static int sent, sent_len;
+void log_ppp_debug(const char *fmt, ...) {}
+int ppp_chan_send(struct ppp_t *ppp, void *buf, int size)
+{
+ const struct lcp_hdr_t *hdr = buf;
+ assert(size == ntohs(hdr->len) + 2);
+ assert(hdr->code == ECHOREP);
+ sent++;
+ sent_len = size;
+ return 0;
+}
+int main(void)
+{
+ unsigned char buf[1502] = {0};
+ struct ppp_t ppp = {.buf = buf, .buf_size = sizeof(buf), .mtu = 1492};
+ struct ppp_lcp_t lcp = {.ppp = &ppp, .magic = 0x12345678};
+ struct lcp_hdr_t *hdr = (void *)buf;
+
+ hdr->len = htons(1493);
+ hdr->code = ECHOREQ;
+ send_echo_reply(&lcp);
+ assert(!sent && hdr->code == ECHOREQ);
+ hdr->len = htons(1492);
+ send_echo_reply(&lcp);
+ assert(sent == 1 && sent_len == 1494);
+ assert(u_read_be32(hdr + 1) == lcp.magic);
+ hdr->len = htons(8);
+ send_echo_reply(&lcp);
+ assert(sent == 2 && sent_len == 10);
+ puts("LCP safeguards: PASS");
+ return 0;
+}
diff --git a/tests/unit/mempool_safeguards_test.c b/tests/unit/mempool_safeguards_test.c
new file mode 100644
index 00000000..b0c6a3dc
--- /dev/null
+++ b/tests/unit/mempool_safeguards_test.c
@@ -0,0 +1,38 @@
+/* Pool reuse must not expose the previous object's payload. */
+#include <assert.h>
+#include <pthread.h>
+#include "triton.h"
+#undef __init
+#define __init
+#include "../../accel-pppd/triton/mempool.c"
+
+void triton_log_error(const char *fmt, ...) {}
+void triton_stat_mempool_allocated_add(uint64_t v) {}
+void triton_stat_mempool_allocated_sub(uint64_t v) {}
+void triton_stat_mempool_available_add(uint64_t v) {}
+void triton_stat_mempool_available_sub(uint64_t v) {}
+
+int main(void)
+{
+ mempool_t *pool;
+ unsigned char *p, *q;
+ int i;
+
+ spinlock_init(&pools_lock);
+ pool = mempool_create(128);
+ p = mempool_alloc(pool);
+ assert(p);
+ memset(p, 0xa5, 128);
+ mempool_free(p);
+ q = mempool_alloc(pool);
+ assert(q == p);
+ for (i = 0; i < 128; i++)
+ assert(!q[i]);
+ memset(q, 0x5a, 128);
+ mempool_free(q);
+ mempool_clean();
+ list_del(&((struct _mempool_t *)pool)->entry);
+ free(pool);
+ puts("Mempool safeguards: PASS");
+ return 0;
+}
diff --git a/tests/unit/radius_safeguards_test.c b/tests/unit/radius_safeguards_test.c
new file mode 100644
index 00000000..6b925bf4
--- /dev/null
+++ b/tests/unit/radius_safeguards_test.c
@@ -0,0 +1,119 @@
+/* Exercise production response verification and accounting signing with real packets. */
+#include <assert.h>
+#include "triton.h"
+#undef DEFINE_INIT
+#define DEFINE_INIT(o, f)
+#include "../../accel-pppd/radius/req.c"
+#include "../../accel-pppd/radius/packet.c"
+
+static const char *server_secret = "first-secret";
+static int healthy, delivered;
+int conf_verbose;
+char *rad_server_secret_dup(struct rad_server_t *s) { return strdup(server_secret); }
+void log_emerg(const char *fmt, ...) {}
+void log_ppp_error(const char *fmt, ...) {}
+void log_ppp_warn(const char *fmt, ...) {}
+void log_switch(struct triton_context_t *ctx, void *arg) {}
+struct triton_context_t *triton_context_self(void) { return NULL; }
+void rad_server_reply(struct rad_server_t *s) { healthy++; }
+void rad_server_req_exit(struct rad_req_t *r) { r->active = 0; }
+int rad_server_req_cancel(struct rad_req_t *r, int full) { return 0; }
+void *mempool_alloc(mempool_t *p) { return calloc(1, (size_t)p); }
+void mempool_free(void *p) { free(p); }
+struct rad_dict_attr_t *rad_dict_find_attr_id(struct rad_dict_vendor_t *v, int id) { return NULL; }
+struct rad_dict_vendor_t *rad_dict_find_vendor_id(int id) { return NULL; }
+struct rad_dict_value_t *rad_dict_find_val(struct rad_dict_attr_t *a, rad_value_t v) { return NULL; }
+
+static void receive_reply(struct rad_req_t *req) { delivered++; }
+static void sign_response(unsigned char *buf, int code, const unsigned char *ra, const char *secret)
+{
+ unsigned char input[256];
+ size_t n = strlen(secret);
+ memset(buf, 0, 20);
+ buf[0] = code;
+ buf[1] = 1;
+ buf[3] = 20;
+ memcpy(input, buf, 4);
+ memcpy(input + 4, ra, 16);
+ memcpy(input + 20, secret, n);
+ MD5(input, 20 + n, buf + 4);
+}
+
+int main(void)
+{
+ struct rad_packet_t request = {.code = CODE_ACCOUNTING_REQUEST, .id = 1, .len = 20};
+ struct rad_packet_t response_packet = {.len = 20};
+ struct rad_server_t server = {0};
+ struct rad_req_t req = {.pack = &request, .serv = &server, .recv = receive_reply};
+ unsigned char response[20], expected[16], input[256], first_ra[16];
+ int pair[2], code, i;
+
+ packet_pool = (void *)sizeof(struct rad_packet_t);
+ buf_pool = (void *)REQ_LENGTH_MAX;
+ INIT_LIST_HEAD(&request.attrs);
+ assert(!rad_req_set_RA(&req));
+ memcpy(first_ra, req.RA, 16);
+ memcpy(input, request.buf, 20);
+ memset(input + 4, 0, 16);
+ memcpy(input + 20, server_secret, strlen(server_secret));
+ MD5(input, 20 + strlen(server_secret), expected);
+ assert(!memcmp(expected, req.RA, 16));
+ /* Rebuilding must zero the previous digest before hashing. */
+ assert(!rad_req_set_RA(&req));
+ assert(!memcmp(first_ra, req.RA, 16));
+ response_packet.buf = response;
+ for (i = 0; i < 4; i++) {
+ const int codes[] = {CODE_ACCESS_ACCEPT, CODE_ACCESS_REJECT, CODE_ACCESS_CHALLENGE, CODE_ACCOUNTING_RESPONSE};
+ code = codes[i];
+ sign_response(response, code, request.buf + 4, server_secret);
+ assert(!verify_response_authenticator(&req, &response_packet));
+ response[4] ^= 1;
+ assert(verify_response_authenticator(&req, &response_packet));
+ sign_response(response, code, first_ra, "wrong-secret");
+ assert(verify_response_authenticator(&req, &response_packet));
+ }
+ /* An in-flight response still verifies after the configuration changes. */
+ sign_response(response, CODE_ACCOUNTING_RESPONSE, first_ra, server_secret);
+ server_secret = "second-secret";
+ assert(!verify_response_authenticator(&req, &response_packet));
+ /* A new accounting send after failover/reload signs with the new secret. */
+ assert(!rad_req_set_RA(&req));
+ assert(memcmp(first_ra, req.RA, 16));
+ assert(verify_response_authenticator(&req, &response_packet));
+ sign_response(response, CODE_ACCOUNTING_RESPONSE, req.RA, server_secret);
+ assert(!verify_response_authenticator(&req, &response_packet));
+
+ assert(!socketpair(AF_UNIX, SOCK_DGRAM | SOCK_NONBLOCK, 0, pair));
+ req.hnd.fd = pair[1];
+ response[4] ^= 1;
+ assert(write(pair[0], response, 20) == 20);
+ assert(!rad_req_read(&req.hnd));
+ assert(!healthy && !delivered && !req.reply);
+ response[4] ^= 1;
+ assert(write(pair[0], response, 20) == 20);
+ assert(rad_req_read(&req.hnd) == 1);
+ assert(healthy == 1 && delivered == 1 && req.reply);
+ rad_packet_free(req.reply);
+ /* Outbound Message-Authenticator retransmits must hash a zeroed field. */
+ {
+ unsigned char wire[38] = {CODE_ACCESS_REQUEST, 1, 0, 38};
+ unsigned char first[38], second[38];
+ struct rad_packet_t access = {
+ .buf = wire, .len = sizeof(wire), .message_authenticator = 1,
+ .secret = (uint8_t *)"blast-secret"
+ };
+ wire[20] = 80;
+ wire[21] = 18;
+ assert(!rad_packet_send(&access, pair[0], NULL));
+ assert(read(pair[1], first, sizeof(first)) == sizeof(first));
+ assert(!rad_packet_send(&access, pair[0], NULL));
+ assert(read(pair[1], second, sizeof(second)) == sizeof(second));
+ assert(!memcmp(first, second, sizeof(first)));
+ }
+ close(pair[0]);
+ close(pair[1]);
+ free(request.secret);
+ free(request.buf);
+ puts("RADIUS safeguards: PASS");
+ return 0;
+}
diff --git a/tests/unit/run_safeguards.sh b/tests/unit/run_safeguards.sh
new file mode 100644
index 00000000..1c69efd7
--- /dev/null
+++ b/tests/unit/run_safeguards.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Run from any directory, passing a configured CMake build directory.
+set -eu
+root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
+build=${1:?usage: run_safeguards.sh /path/to/cmake-build}
+out=$(mktemp -d)
+trap 'rm -rf "$out"' EXIT HUP INT TERM
+cd "$root"
+for name in dhcpv6 radius vrf lcp mempool; do
+ extra=
+ # LCP's global layer table retains the whole daemon under ASan; its test
+ # checks wire lengths with UBSan. The packet/VRF tests also use ASan.
+ if [ "$name" = lcp ]; then extra=-fno-sanitize=address; fi
+ ${CC:-cc} -O1 -g -Wall -Wno-unused-function -Wno-unused-result -D_GNU_SOURCE -DAP_SESSIONID_LEN=16 \
+ -DOPENSSL_API_COMPAT=0x10100000L -fno-strict-aliasing \
+ -ffunction-sections -fdata-sections -Wl,--gc-sections \
+ -fsanitize=address,undefined -fno-sanitize-recover=all $extra \
+ -I "$build" -I accel-pppd -I accel-pppd/include -I accel-pppd/triton \
+ -o "$out/$name" "tests/unit/${name}_safeguards_test.c" -lcrypto -lpthread
+ "$out/$name"
+done
diff --git a/tests/unit/vrf_safeguards_test.c b/tests/unit/vrf_safeguards_test.c
new file mode 100644
index 00000000..1fa5a414
--- /dev/null
+++ b/tests/unit/vrf_safeguards_test.c
@@ -0,0 +1,72 @@
+/* Exercise the shared interface lookup and length-delimited VRF API. */
+#include <assert.h>
+#include <pthread.h>
+#include "triton.h"
+#undef DEFINE_INIT
+#undef __init
+#define __init
+#define DEFINE_INIT(o, f)
+#include "../../accel-pppd/net.c"
+#include "../../accel-pppd/ifcfg.c"
+#define init coa_init
+#include "../../accel-pppd/radius/dm_coa.c"
+#undef init
+
+static int lookups, changes, last_master;
+static char last_name[IFNAMSIZ];
+void log_ppp_error(const char *fmt, ...) {}
+void log_ppp_info2(const char *fmt, ...) {}
+
+static int lookup(const char *name)
+{
+ lookups++;
+ assert(strlen(name) < IFNAMSIZ);
+ strcpy(last_name, name);
+ return 7;
+}
+static int set_vrf(int index, int master)
+{
+ changes++;
+ last_master = master;
+ return 0;
+}
+
+int main(void)
+{
+ struct kern_net kn = {0};
+ struct ap_net backend = {.get_ifindex = lookup, .set_vrf = set_vrf};
+ struct ap_session ses = {.net = &backend};
+ struct radius_pd_t rpd = {.ses = &ses};
+ char name[IFNAMSIZ + 1];
+
+ net = &kn.net;
+ kn.sock = socket(AF_INET, SOCK_DGRAM, 0);
+ assert(kn.sock >= 0);
+ assert(def_get_ifindex("lo") > 0);
+ assert(def_get_ifindex(NULL) == -1);
+ memset(name, 'x', sizeof(name));
+ name[IFNAMSIZ] = 0;
+ assert(def_get_ifindex(name) == -1);
+ assert(ap_session_vrf(&ses, name, -1) == -1);
+ assert(ap_session_vrf(&ses, name, IFNAMSIZ) == -1);
+ assert(ap_session_vrf(&ses, NULL, 1) == -1);
+ assert(ap_session_vrf(&ses, name, -2) == -1);
+ assert(ap_session_vrf(&ses, "a\0b", 3) == -1);
+ assert(!lookups && !changes);
+ /* Explicit length need not be followed by a NUL in caller memory. */
+ assert(!ap_session_vrf(&ses, name, IFNAMSIZ - 1));
+ assert(strlen(last_name) == IFNAMSIZ - 1 && last_master == 7);
+ assert(!ap_session_vrf(&ses, NULL, 0));
+ assert(last_master == 0 && !ses.vrf_name);
+ assert(!ap_session_vrf(&ses, NULL, -1));
+ assert(lookups == 1 && changes == 3);
+ assert(!rad_update_vrf(&rpd, "blue\0junk", 9));
+ assert(!rad_update_vrf(&rpd, name, IFNAMSIZ));
+ assert(rad_update_vrf(&rpd, "0", 1));
+ assert(last_master == 0);
+ assert(rad_update_vrf(&rpd, "0blue", 5));
+ assert(last_master == 7 && !strcmp(last_name, "0blue"));
+ close(kn.sock);
+ puts("VRF safeguards: PASS");
+ return 0;
+}
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-30 08:58:56 +0000