summaryrefslogtreecommitdiff
path: root/accel-pppd
AgeCommit message (Collapse)Author
2026-03-23radius: fix stop accounting timeout flow and request cleanupDenys Fedoryshchenko
When sending accounting STOP requests, the timer callback was incorrectly set to the START timeout handler. This caused stop retries to follow the wrong termination path. Also clear rpd->acct_req before freeing on stop timeout/shutdown failures to avoid leaving a stale pointer. This bug is very nasty, revealed during stress tests, leading to memory corruption and other bad stuff when there is noticeable loss of radius "Stop" packets. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23Replace linux/if.h with net/if.h includemarekm72
2026-03-23Replace linux/if.h with net/if.h in ipoe.hmarekm72
2026-03-23Update header includes in ipoe.cmarekm72
Replaced Linux-specific headers with their net counterparts.
2026-03-23Refactor ARP header includes in arp.cmarekm72
Replaced conditional inclusion of if_arp.h and if_packet.h with direct includes.
2026-03-23Refactor session free function pointer in l2tp.cmarekm72
2026-03-23Clean up CMakeLists.txt by removing unused checksmarekm72
Removed checks for __free_fn_t and good ifarp in CMakeLists.txt.
2026-03-23Remove printf.h check from CMakeLists.txtmarekm72
Removed check for printf.h and related definitions.
2026-03-23Remove unused printf.h includemarekm72
Removed conditional inclusion of printf.h.
2026-03-23radius: Fix use after free and moreDenys Fedoryshchenko
Situation is a bit complex. Even one problem we fix easily, such as saving server as variable, rad_req_free might free server in theory, and s will be invalid. This is a bit of rewrite, but proper fix. Fixes problem in 2 functions. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23radius: Invalid integer and date parsingDenys Fedoryshchenko
Actually 3 fixes in same place: INTEGER: size mismatch now breaks instead of falling through - a malformed INTEGER attribute is rejected rather than silently parsed with a wrong size INTEGER/DATE split: each case has its own break, no more fallthrough DATE: strictly requires len == 4 (per RFC 2865), warns and skips otherwise instead of silently accepting 1 or 2-byte dates Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23radius: Fix to same type of allocator and deallocatorDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23radius: Fix invalid check after mempool allocationDenys Fedoryshchenko
This check left old, relevant to mmap, migrate to proper check. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23radius: MS-CHAP2-Success unchecked memcpy(40 bytes)Denys Fedoryshchenko
Also fix small typo. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23radius: Vendor attribute parsing over-readsDenys Fedoryshchenko
When parsing vendor-specific attributes (type 26), the code reads internal structure without checking that the attribute data is long enough. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23ppp: Defend from possible ppp init failureDenys Fedoryshchenko
ppp init might fail due malloc failure, missing or invalid runtime state, failure to setup resources (sockers, timers, handler registration), etc. This is quite unlikely now, but some floating(hard to catch) bugs says better to be safe than sorry. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23fix(ppp): Uninitialized struct fieldsDenys Fedoryshchenko
Initialized the ifreq in destablish_ppp to avoid the uninitialized-struct warning before use. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23ppp: classic TOCTOU, as uc_size not guarded by mutexDenys Fedoryshchenko
It was a micro-optimization to skip taking the mutex when uc_size was 0. But because uc_size isnt atomic and wasnt read under the lock, it created a TOCTOU window. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23ppp: guard LCP logging field readsDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-03-23cli: clear show sessions cell buffer to avoid stale outputDenys Fedoryshchenko
2026-03-23Update accel-pppd/radius/radius.cDenys Fedoryshchenko
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-03-23Update accel-pppd/radius/radius.cDenys Fedoryshchenko
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-03-23radius: Fix buggy Framed-Route parsingDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2026-01-24dae-allowed: Remove nagging about making option mandatoryDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-23radius: Implement DM/CoA security hardening by restricting source ip addressesDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-15fix(radius): refresh session stats in req_set_statDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-13Merge pull request #277 from nuclearcat/minor-rfc2516-complianceDenys Fedoryshchenko
pppoe: Fix RFC2516 non-compilance in PADI tags parsing
2025-12-13Merge pull request #279 from nuclearcat/fix-acctDenys Fedoryshchenko
acct: Fix losing some data on interface down due wrong sequence
2025-12-13fix(accounting): preserve last counters on disconnectDmitriy Eshenko
Ensure accounting values include the most recent traffic sample when a session disconnects, preventing the final interval from being dropped and avoiding under-reported totals in usage/billing. Big thanks Dmitriy Eshenko for patch and testing Author: Dmitriy Eshenko <dmitriy.eshenko@accel-ppp.org> Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-11pppoe: Fix RFC2516 non-compilance in PADI tags parsingDenys Fedoryshchenko
We currently only break out of the switch, so the for loop keeps parsing tags after TAG_END_OF_LIST (accel-pppd/ctrl/pppoe/pppoe.c: around pppoe_recv_PADI). RFC 2516 (paragraph 5, Tag Types: End-of-List) says an End-of-List tag MAY appear in PADI/PADR and "any TAGs after an End-of-List MUST be ignored." Since we continue processing them, this behavior is technically non-compliant with the RFC. Same in pppoe_recv_PADR. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-10Minor compile fix, we have only OpenSSL version nowDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-10crypto: Removed CRYPTO_OPENSSL definition.Andrii Melnychenko
OpenSSL is now mandatory. Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
2025-12-10crypto: Removed internal tomcat crypto.Andrii Melnychenko
Signed-off-by: Andrii Melnychenko <a.melnychenko@vyos.io>
2025-12-07Merge pull request #270 from nuclearcat/static-analyzer-fixesDenys Fedoryshchenko
auth_chap_md5: unused variable, mschap_error likely copy paste error, plain chap dont have errors like mschap
2025-12-07Merge pull request #271 from nuclearcat/sstp-improvementsDenys Fedoryshchenko
Sstp improvements
2025-12-01radius: Improve documentationDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-01ppp: Add missing documentation, improve clarityDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-01pppoe: Add missing documentationDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-01l2tp: Add missing documentationDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-01sstp: Improve documentation about proxy protocolDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-01sstp: Update documentation for missing optionsDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-12-01sstp: Add config option enum for better code readabilityDenys Fedoryshchenko
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-11-30Merge pull request #269 from nuclearcat/fix-buffer-overflowDenys Fedoryshchenko
l2tp: fix buffer overflow and type errors in Calling/Called Number handling
2025-11-30auth_chap_md5: unused variable, mschap_error likely copy paste error, plain ↵Denys Fedoryshchenko
chap dont have errors like mschap Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-11-28Merge pull request #267 from nuclearcat/fix-ssl-warningsDenys Fedoryshchenko
Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIs
2025-11-26l2tp: fix buffer overflow and type errors in Calling/Called Number handlingDenys Fedoryshchenko
Fix issues introduced in 88a2ebdb: - Fix type declaration: uint8_t *calling[254] declared an array of 254 pointers instead of an array of 254 bytes. Remove erroneous asterisks. - Fix buffer overflow vulnerability: L2TP AVP values can be up to 1017 bytes (L2TP_AVP_LEN_MASK - sizeof(avp_header)), but buffers were only 254(*4?) bytes. A malicious packet could cause stack buffer overflow. Use L2TP_AVP_LEN_MASK (1023) for buffer size to handle maximum AVP length. - Remove useless NULL checks: Stack-allocated arrays can never be NULL, causing compiler warnings. The existence check is n > 0 / m > 1. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-11-26fixup! Add RADIUS blast attack protection with Message-AuthenticatorDenys Fedoryshchenko
Not a bug, but to supress warnings. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-11-26Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIsDenys Fedoryshchenko
We are using similar approach as in other projects, easiest one, but probably in future it will break as soon as this functions will be removed completely. Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
2025-11-26Merge pull request #265 from nuclearcat/fix-mempoolDenys Fedoryshchenko
mempool: Fix 32-bit stats
2025-11-26Merge pull request #266 from nuclearcat/docs-ippoolDenys Fedoryshchenko
docs: Improve ippool documentation
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-14 07:33:18 +0000