| Age | Commit message (Collapse) | Author |
|---|
|
(size + PPP_FCSLEN) * 2 + 2 equals 8b781b94's size*2 + 2 + PPP_FCSLEN*2
but can't collapse back to the 1801847a under-allocating form.
|
|
The ipoe-level ses->username always holds an allocated string
(_strdup of ifname/calling-station-id, u_inet_ntoa buffer or lua
result), but ipoe_session_free() never released it. Ownership is
normally transferred in auth_result() via ap_session_set_username(),
so the string was leaked whenever a session died before auth_result()
ran: termination while starting, PWDB_WAIT never completing, or
ipoe_create_interface() failure.
The create-interface failure path also leaked the freshly allocated
local copy outright, since it returned before the string was stored
anywhere.
Store the string in ses->username as soon as it is obtained and free
it in ipoe_session_free(). auth_result() clears ses->username before
handing ownership to ap_session_set_username(), so no double free is
possible.
Reported-by: Louis Scalbert (#101)
|
|
dhcpv4_relay_read() takes a reference on the reply packet for every
registered listener context and hands it over via triton_context_call().
The receiving ipoe_ses_recv_dhcpv4_relay() consumes that reference by
storing the packet in ses->dhcpv4_relay_reply, but the early-return
branch taken when the original request is already gone dropped the
reference without freeing the packet.
This leaks one packet every time a relay reply races with the request
being released, which happens regularly on busy relay-mode deployments.
Reported-by: Louis Scalbert (#101)
|
|
When a mac-filter file line contained an octet > 255, the error path freed
the entry but kept writing to it and linked it into mac_list. Validate all
octets before allocating so invalid lines are skipped entirely.
This is not considered a security vulnerability: the mac-filter file can
only be configured by an administrator with access to the daemon config,
or the CLI, both of which require privileged access.
Fixes #307
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Stability fixes
|
|
Several bugfixes for problems reported by Khodor Tahech
|
|
|
|
|
|
|
|
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
The unsupported-PPPoE-type branch in disc_read() logs a warning but
falls through to forward() instead of dropping the packet. Compare
with the unsupported-version branch immediately above, which has the
same shape but continues:
if (hdr->ver != 1) {
if (conf_verbose)
log_warn(...unsupported version...);
continue;
}
if (hdr->type != 1) {
if (conf_verbose)
log_warn(...unsupported type...);
/* falls through into forward() */
}
Add the missing continue so malformed packets are dropped instead of
processed.
Signed-off-by: khedor <khedor@gmail.com>
|
|
free_net() compacts the nets[] array by sliding entries left after
removing one:
memcpy(nets + i, nets + i + 1, net_cnt - i - 1);
Two bugs:
1. The count is a raw element count, not a byte count. nets[] holds
'struct disc_net *' pointers, so only (net_cnt - i - 1) bytes are
moved instead of (net_cnt - i - 1) * sizeof(nets[0]). On the usual
8-byte-pointer build, 7 of every 8 surviving pointers are lost,
leaving uninitialised holes in the array.
2. Source and destination overlap (nets + i and nets + i + 1), so
memcpy is undefined behaviour. The correct primitive is memmove.
Switch to memmove and multiply the count by sizeof(nets[0]).
Signed-off-by: khedor <khedor@gmail.com>
|
|
In init_net(), the buffer for struct disc_net was sized as
n = _malloc(sizeof(*net) + (HASH_BITS + 1) * sizeof(struct tree));
but 'net' is the const struct ap_net * argument, not the disc_net being
allocated. sizeof(*net) is therefore sizeof(struct ap_net), which is
substantially smaller than sizeof(struct disc_net). Every field of *n
written past the ap_net-sized prefix (ctx, hnd, net, refs, etc.) lands
in unallocated heap memory.
Use sizeof(*n) so the allocation matches the actual destination type.
Signed-off-by: khedor <khedor@gmail.com>
|
|
strip() memmove count was one short, dropping the NULL terminator;
dpado_parse error path leaked already-parsed range entries.
Also affects ipoe.
Since strip is identical in both, we can place fixed common function in utils.
Reported-by: Khedor <khedor@gmail.com>
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Group the core session starting, active, and finishing statistics behind the private ap_session_stat storage in session.c instead of exposing writable counters through ap_session.h. This keeps ownership inside the session core while preserving the existing CLI and ACCEL-PPP-MIB counter semantics.
Route session counter updates through ap_session_stat_*() helpers. Session start, activation, termination, finish, and shutdown-idle paths no longer open-code individual counter increments/decrements; the update policy now lives beside the session-owned storage and uses relaxed atomic operations for the simple state counters.
Make the CLI show-stat path render from a local snapshot and convert the PPP SNMP starting/active/finishing scalars from watched raw pointers to scalar handlers. PPP controllers now read max-session limits through ap_session_stat_starting() and ap_session_stat_active(), removing external direct access to ap_session_stat.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Group the SSTP starting and active statistics in struct sstp_stat_t and keep the storage under the SSTP server object instead of exposing writable stat_* globals. This keeps ownership inside the SSTP control code while preserving the existing CLI and ACCEL-PPP-MIB counter semantics.
Route counter updates through sstp_stat_*() helpers. Connection accept, transition to PPP setup, and disconnect paths no longer open-code individual counter increments/decrements; the update policy now lives beside the SSTP-owned storage and uses relaxed atomic operations for the simple state counters.
Make the CLI show-stat path render from a local snapshot and convert the SSTP SNMP starting/active scalars from watched raw pointers to scalar handlers. SNMP now reads through sstp_stat_starting() and sstp_stat_active(), removing the old sstp_get_stat() pointer escape hatch.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Group the IPOE starting, active, and delayed offer statistics in struct ipoe_stat_t and keep the storage private to ipoe.c instead of exposing writable stat_* globals. This keeps ownership inside the IPOE control code while preserving the existing CLI and ACCEL-PPP-MIB counter semantics.
Route counter updates through ipoe_stat_*() helpers. Session setup, activation, teardown, and delayed offer queue paths no longer open-code individual counter increments/decrements; the update policy now lives beside the IPOE-owned storage and uses relaxed atomic operations for the simple state counters.
Make the CLI show-stat path render from a local snapshot and convert the IPOE SNMP starting/active scalars from watched raw pointers to scalar handlers. SNMP now reads through ipoe_stat_starting() and ipoe_stat_active(), removing the old ipoe_get_stat() pointer escape hatch.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Group the PPTP starting and active statistics in struct pptp_stat_t and keep the storage under the PPTP server object instead of exposing writable stat_* globals. This keeps ownership inside the PPTP control code while preserving the existing CLI and ACCEL-PPP-MIB counter semantics.
Route counter updates through pptp_stat_*() helpers. Connection setup, transition to PPP, and teardown paths no longer open-code individual counter increments/decrements; the update policy now lives beside the PPTP-owned storage and uses relaxed atomic operations for the simple state counters.
Make the CLI show-stat path render from a local snapshot and convert the PPTP SNMP starting/active scalars from watched raw pointers to scalar handlers. SNMP now reads through pptp_stat_starting() and pptp_stat_active(), removing the old pptp_get_stat() pointer escape hatch.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Group the L2TP tunnel, control-session, and data-session statistics in struct l2tp_stat_t and keep the storage private to l2tp.c instead of spreading writable stat_* globals through the module. This keeps the ownership boundary in the L2TP control code while preserving the existing CLI and ACCEL-PPP-MIB counter semantics.
Route counter updates through l2tp_stat_*() helpers. Tunnel, control-session, and data-session state transitions no longer open-code individual counter increments/decrements; the update policy now lives beside the L2TP-owned storage and uses relaxed atomic operations for the simple state counters.
Make the CLI show-stat path render from a local snapshot and convert the L2TP SNMP starting/active scalars from watched raw pointers to scalar handlers. SNMP now reads through l2tp_stat_starting() and l2tp_stat_active(), removing the old l2tp_get_stat() pointer escape hatch.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Group the PPPoE statistics in struct pppoe_stat_t and keep the storage private to pppoe.c instead of exporting writable counter globals through pppoe.h. The CLI now reads a snapshot with pppoe_stat_get(), while the packet/control paths update the counters through the PPPoE-owned storage using relaxed atomic operations.
Convert the PPPoE SNMP starting/active scalars from watched raw pointers to scalar handlers. This removes the old pppoe_get_stat() pointer escape hatch and makes SNMP read the counters through pppoe_stat_starting() and pppoe_stat_active(), so the synchronization policy is applied consistently outside the PPPoE module.
This also fixes the long-standing PPPoE starting counter behavior. PPPoE used to expose starting in the CLI and ACCEL-PPP-MIB, but never updated it, so it always reported zero. Track a per-connection ppp_starting state, increment starting when the controller begins channel setup, move the session from starting to active after establish_ppp() succeeds, and decrement starting on setup failure before PPP becomes active. This matches the state accounting used by the other PPP controllers.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
|
|
|
|
Replaced Linux-specific headers with their net counterparts.
|
|
Replaced conditional inclusion of if_arp.h and if_packet.h with direct includes.
|
|
|
|
Removed conditional inclusion of printf.h.
|
|
Added VRF support to the iproute routines.
Updated iproute* calls in the ipoe, radius, and dhcpv6 code.
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
|
|
pppoe: Fix RFC2516 non-compilance in PADI tags parsing
|
|
We currently only break out of the switch, so the for loop keeps parsing tags after TAG_END_OF_LIST (accel-pppd/ctrl/pppoe/pppoe.c: around pppoe_recv_PADI).
RFC 2516 (paragraph 5, Tag Types: End-of-List) says an End-of-List tag MAY appear in PADI/PADR and "any TAGs after an End-of-List MUST be ignored."
Since we continue processing them, this behavior is technically non-compliant with the RFC.
Same in pppoe_recv_PADR.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
OpenSSL is now mandatory.
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
|
|
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
l2tp: fix buffer overflow and type errors in Calling/Called Number handling
|
|
Fix issues introduced in 88a2ebdb:
- Fix type declaration: uint8_t *calling[254] declared an array of 254
pointers instead of an array of 254 bytes. Remove erroneous asterisks.
- Fix buffer overflow vulnerability: L2TP AVP values can be up to 1017
bytes (L2TP_AVP_LEN_MASK - sizeof(avp_header)), but buffers were only
254(*4?) bytes. A malicious packet could cause stack buffer overflow.
Use L2TP_AVP_LEN_MASK (1023) for buffer size to handle maximum AVP length.
- Remove useless NULL checks: Stack-allocated arrays can never be NULL,
causing compiler warnings. The existence check is n > 0 / m > 1.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
We are using similar approach as in other projects, easiest one,
but probably in future it will break as soon as this functions
will be removed completely.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
SSTP: load certificate chain instead of single one
|
|
Added an explicit break after handling TAG_VENDOR_SPECIFIC,
so vendor-specific PADR tags (e.g., TR-101) no longer fall
through and get misinterpreted as other tags like TAG_PPP_MAX_PAYLOAD.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
|
|
feat(build): Add MUSL detection and conditional linking
|
|
This commit introduces the ability to detect if the project is being
built with the MUSL C library.
A new variable `MUSL` is set to `ON` if MUSL is detected, and `OFF`
otherwise. This is achieved by checking the output of `ldd --version`.
The `accel-pppd/ctrl/pppoe/CMakeLists.txt` file is updated to
conditionally link the `connlimit` library only when building with MUSL.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
|
|
|
|
Allowed using multiple NTP servers in DHCP option 42
|
|
|
|
I think the error handling code of `post_msg` is wrongly implemented due to coding typo. The `EPIPE` should be also considered and then return -1, just like `PPTP_write`:
https://github.com/xebd/accel-ppp/blob/1b8711cf75a7c278d99840112bc7a396398e0205/accel-pppd/ctrl/pptp/pptp.c#L539-L570
|
|
migrate from pcre to pcre2
|
|
build: fix compile errors on GCC 14
|
|
fix(musl/l2tp_session_free): Fix, likely typo
|
