| Age | Commit message (Collapse) | Author |
|---|
|
release: 1.15.0
|
|
Set the 1.15.0 changelog date and the fallback versions used when
building without git metadata (CMakeLists.txt and cmake/cpack.cmake;
the latter was left at 1.13.0 by the 1.14.0 release). List the
metrics module among README features.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Doc validation fixes
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
ICQ has stopped operating, so remove the unusable contact from the README.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Add the missing PPPoSEQ install rules and standalone driver metadata. Supply the running kernel release as the default RPM module destination. Extend the rootless install regression to verify Debian/CentOS packaging names, staged module paths, and exclusion after disabling the build flag.
Validation: CTest passes; generated full and standalone DEBs contain ppposeq.ko and have the expected package names. RPM install rules were staged and checked; an RPM archive was not built because rpmbuild is unavailable.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Use the shared DNS storage and production allocator in the DHCPv6 fixture. Check bounded large DNS replies, preserve the repeated-ORO overflow regression, and check domain-list allocation failure in both reply builders. Link ipv6_dns.c and stub the truncation warning. Run the standalone suites and CTest in sanitizer CI, and replace the stale documented failure with current instructions.
Validation: all six standalone suites pass with ASan/UBSan (LCP uses UBSan); both CTest checks pass.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
The fractional part of a millisecond timeout was multiplied by 1000 instead of 1000000, so 1500ms became 1.0005 seconds. Correct the conversion and add a CTest regression covering subsecond values, second boundaries, microseconds, and invalid input. Initialize CTest before configuring the client subdirectory.
Validation: Release build and CTest pass. The regression fails against upstream master at 1ms.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Explain that LUA=TRUE uses FindLua51, while numeric LUA values use non-EXACT FindLua version matching. Name the Lua 5.1 development package required by the test build examples.
Validation: checked against accel-pppd/CMakeLists.txt and the installed FindLua51 module.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Keep the CMake 3.10 project minimum while documenting the newer CLI requirements. Add a build-directory/install-target alternative for older CMake and state the CTest requirement in the test guide.
Validation: shell examples pass bash -n; local documentation links resolve.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Doc updates
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
log: bound log lines and share target unpacking
|
|
A log line is flushed only when its text ends in a newline, so it can be
assembled from any number of log calls. Packet printers make one call per
attribute, so a single line could grow far beyond LOG_MAX_SIZE, while the
tcp, syslog and pgsql targets each copied the whole chunk list into a
fixed size buffer without checking its length.
Cap the accumulated line at LOG_MAX_SIZE in do_log(), keeping the
trailing newline so the line is still flushed, and replace the three
duplicated unpack loops with log_unpack_msg(), which never writes past
the size it is given. The syslog bound is needed on its own: a session
header plus a full length line does not fit its buffer.
Also skip empty formatted strings, which made do_log() read the byte
before its buffer.
When a single call is cut short by vsnprintf its newline is lost; restore
it when the format ends in one, so the line is closed instead of
swallowing the next one. The syslog and pgsql targets now strip the
trailing newline only when it is there, instead of dropping the last
character of a line cut to fit.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
IPv6 DNS fixes
|
|
The legacy limit matches RFC 6106's recommendation that hosts treat three learned RDNSS addresses as sufficient. That was host-side repository guidance, not a limit in the RADIUS, DHCPv6, or RDNSS encodings.
RFC 8106 obsoletes RFC 6106 and explicitly removes the recommendation to limit learned RDNSS addresses to three, leaving the number to local policy. It instead recommends the ability to store at least three addresses when DNS information comes from multiple sources.
Store both configured and per-session servers in reusable contiguous arrays. Start with a four-address, 64-byte allocation, grow geometrically, retain capacity across reload or reauthorization, and free session storage only at teardown. Bound advertised lists by actual DHCPv6 and router-advertisement packet space.
Warn when servers have to be dropped for lack of room, as the fixed limit used to, skip the DNS search list rather than write it past the end of a full advertisement, and drop the stale three-server wording from the [ipv6-dns] documentation.
Link: https://github.com/accel-ppp/accel-ppp/commit/4f562467dbdf819395e138617c2a057e02595b9e#r197212083
Link: https://www.rfc-editor.org/rfc/rfc6106.html#section-5.3.1
Link: https://www.rfc-editor.org/rfc/rfc8106.html#section-5.3.1
Link: https://www.rfc-editor.org/rfc/rfc8106.html#appendix-A
|
|
DNS-Server-IPv6-Address carries a full IPv6 address, so storing it in
ipv6db_addr_t also carried an unused prefix length and flags. Introduce
dedicated DNS list and address types so the representation matches the data.
Suggested-by: Vladislav Grishenko <566150+themiron@users.noreply.github.com>
Link: https://github.com/accel-ppp/accel-ppp/commit/4f562467dbdf819395e138617c2a057e02595b9e#r197215804
|
|
The prefix information options are written into a fixed 1024 byte pool
buffer with no bound at all, one 32 byte option per address on the
session. A session carrying more than about thirty addresses therefore
writes past the end of the buffer.
Skip the prefix information of the addresses which no longer fit and warn
about them. The loop also installs the addresses on the interface, so keep
doing that regardless of how much room is left in the advertisement.
|
|
cmake: fix kernel module installation
|
|
Additional safeguards
|
|
Remove debian11 from CI (as EoL), add ubuntu 26:04 (build, test), remove qemu src-build for big-endian test
|
|
|
|
|
|
tests: give the veth pair fixed MAC addresses
|
|
utils: centralize max macro
|
|
Closes #354
|
|
The tests create the veth pair with 'ip link add ... type veth peer name
...' and let the kernel pick random hardware addresses, then start
accel-pppd right away. On distributions where systemd-udevd rewrites the
address of a freshly created veth (MACAddressPolicy in its .link rules,
seen on Ubuntu 22.04) this is a race: accel-pppd reads the address of the
interface it serves once, at startup, and when udev wins it advertises an
address the interface no longer has.
Discovery still completes - the client copies the advertised address into
its kernel PPPoE session as the peer address - but from then on the two
ends disagree about it, no PPP frame is exchanged in either direction, and
the session dies on LCP timeouts. Every PPPoE session test can fail this
way; test_pppoe_ccp_ipcp_race failed 8 times out of 12 runs in one qemu
Ubuntu-22.04 job.
Create the pair with fixed, locally administered addresses derived from
the name the pair already gets, so udev has nothing to change. The same
job passes 12 out of 12 with this.
This only removes the trigger in the tests. accel-pppd not following the
address of the interface it serves is tracked in #363 and needs a fix of
its own.
|
|
Add standalone regression coverage for DHCPv6 parsing/replies, RADIUS
response authentication/signing, VRF/CoA name bounds, LCP Echo MTU and
pool reuse. Document all 20 reference commits, upstream coverage, author
credits, adaptations and validation limits.
Validation: default userspace Debug build; five standalone suites with
ASan/UBSan (LCP UBSan only), including LeakSanitizer for ASan tests;
existing IPv6 DNS test; git diff --check. All passed.
Baseline duplicate Rapid-Commit and forged Access-Accept assertions fail
as expected. Full privileged session integration was not run.
|
|
Require exactly one PADR Service-Name, drop Echo-Requests exceeding the
negotiated MTU, and clear pooled payloads before reuse. Retain upstream's
silent malformed-PADR rejection and received-packet length checks.
Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8464/T8830.
Co-authored-by: Ritika Chopra <r.chopra@vyos.io>
|
|
Reject oversized and embedded-NUL VRF attributes and allocation failures.
Keep explicit CoA lengths, restrict removal to literal 0, and bound the
session API and shared interface lookup. Preserve default VRF removal.
Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8611, with the same
validation boundary extended to the CoA path.
Co-authored-by: Ritika Chopra <r.chopra@vyos.io>
|
|
Verify replies before callbacks and server-health updates. Keep the secret
with the request and centralize accounting signing after server selection,
including retransmits and Accounting-On/Off. Reset the outbound
Message-Authenticator field before recalculating it on retries.
Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8526/T8545, with
upstream's OpenSSL API and secret-reload ownership. Existing accounting
callback lifetime fixes are retained.
Co-authored-by: Ritika Chopra <r.chopra@vyos.io>
|
|
Reject duplicate Rapid-Commit/AFTR options, validate AFTR labels, and
limit relay nesting. Measure reply space from the allocation, propagate
allocation failure through reply builders, and encode relay lengths correctly.
Adapted from Ritika Chopra's accel-ppp-ng PR #40, T8473/T8474/T8475.
Upstream already has the status, AFTR-printing and inner relay bounds fixes.
Co-authored-by: Ritika Chopra <r.chopra@vyos.io>
|
|
Ipcp ccp delay ack
|
|
Fix several unsafe or unaligned integer accesses found in protocol parsing paths, including option-gated MPPE, DHCP, PPPoE, RADIUS, IPCP and IPv6CP code.
|
|
The option walkers of lcp_recv_conf_req() and its IPCP, IPV6CP and CCP
counterparts bail out with *_OPT_FAIL as soon as an option header does not
fit in the remaining bytes or carries an impossible length, and the caller
turns that into ap_session_terminate(TERM_USER_ERROR).
The bail out happens before the "recv [LCP ConfReq id=..." line is emitted,
so the session simply disappeared with nothing in the log to point at the
peer. The ConfAck, ConfNak and ConfRej walkers break out of their loop
instead and at least close the line they had already started.
Log the offending length, option id and the number of bytes left before
returning, so a peer sending malformed options can be told apart from the
other reasons a session ends with TERM_USER_ERROR.
|
|
ipcp_recv() and ipv6cp_recv() only rejected packets whose header length
field was below PPP_HEADERLEN. The upper bound was missing, so the option
walker was handed a size derived purely from the peer chosen hdr->len.
ppp->buf is a fixed 8192 byte mempool block and ppp->buf_size holds the
number of bytes actually read, so a short frame declaring hdr->len 0xffff
made the option loop run off the end of the block: it kept fetching option
headers from whatever followed in the heap and stored pointers to them in
the ropt list. The read is harmless in itself but easily reaches unmapped
memory and kills the daemon.
Reject any packet whose declared length does not fit in what was received,
the way lcp_recv() and ccp_recv() already do. The two byte slack accounts
for the protocol field that precedes the header inside the buffer, and the
existing buf_size >= PPP_HEADERLEN + 2 test just above keeps the
subtraction from underflowing.
|
|
|
|
Allocation sizes are arbitrary, so store and load the trailing uint64_t canary with memcpy instead of dereferencing a potentially unaligned pointer.
|
|
Copy interface IDs and prefix words between aligned temporaries and byte arrays instead of casting IPv6 address storage to uint64_t pointers.
|
