From c5493be157f71e83ed725dc7f768d90321589c8e Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Mon, 1 Dec 2025 02:46:20 +0200 Subject: sstp: Add config option enum for better code readability Signed-off-by: Denys Fedoryshchenko --- accel-pppd/ctrl/sstp/sstp.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/accel-pppd/ctrl/sstp/sstp.c b/accel-pppd/ctrl/sstp/sstp.c index 9239da30..3c831f64 100644 --- a/accel-pppd/ctrl/sstp/sstp.c +++ b/accel-pppd/ctrl/sstp/sstp.c @@ -181,7 +181,13 @@ static struct hash_t conf_hash_sha1 = { .len = 0 }; static struct hash_t conf_hash_sha256 = { .len = 0 }; //static int conf_bypass_auth = 0; static const char *conf_hostname = NULL; -static int conf_http_mode = -1; +enum { + HTTP_ERR_ALLOW = -1, + HTTP_ERR_DENY = 0, + HTTP_ERR_REDIRECT = 1, + HTTP_ERR_REDIRECT_APPEND = 2, +}; +static int conf_http_mode = HTTP_ERR_ALLOW; static const char *conf_http_url = NULL; static mempool_t conn_pool; @@ -885,17 +891,17 @@ static int http_recv_request(struct sstp_conn_t *conn, uint8_t *data, int len) log_ppp_info2("recv [HTTP <%s>]\n", line); if (vstrsep(line, " ", &method, &request, &proto) < 3) { - if (conf_http_mode) + if (conf_http_mode != HTTP_ERR_DENY) http_send_response(conn, "HTTP/1.1", "400 Bad Request", NULL); return -1; } if (strncasecmp(proto, "HTTP/1", sizeof("HTTP/1") - 1) != 0) { - if (conf_http_mode) + if (conf_http_mode != HTTP_ERR_DENY) http_send_response(conn, "HTTP/1.1", "400 Bad Request", NULL); return -1; } if (strcasecmp(method, SSTP_HTTP_METHOD) != 0 && strcasecmp(method, "GET") != 0) { - if (conf_http_mode) + if (conf_http_mode != HTTP_ERR_DENY) http_send_response(conn, proto, "501 Not Implemented", NULL); return -1; } @@ -917,7 +923,7 @@ static int http_recv_request(struct sstp_conn_t *conn, uint8_t *data, int len) } if (host_error) { - if (conf_http_mode) + if (conf_http_mode != HTTP_ERR_DENY) http_send_response(conn, proto, "404 Not Found", NULL); return -1; } @@ -925,11 +931,11 @@ static int http_recv_request(struct sstp_conn_t *conn, uint8_t *data, int len) if (strcasecmp(method, SSTP_HTTP_METHOD) != 0 || strcasecmp(request, SSTP_HTTP_URI) != 0) { if (conf_http_mode > 0) { if (_asprintf(&line, "Location: %s%s\r\n", - conf_http_url, (conf_http_mode == 2) ? request : "") < 0) + conf_http_url, (conf_http_mode == HTTP_ERR_REDIRECT_APPEND) ? request : "") < 0) return -1; http_send_response(conn, proto, "301 Moved Permanently", line); _free(line); - } else if (conf_http_mode < 0) + } else if (conf_http_mode == HTTP_ERR_ALLOW) http_send_response(conn, proto, "404 Not Found", NULL); return -1; } @@ -2809,15 +2815,15 @@ static void load_config(void) opt = conf_get_opt("sstp", "http-error"); if (opt) { if (strcmp(opt, "deny") == 0) - conf_http_mode = 0; + conf_http_mode = HTTP_ERR_DENY; else if (strcmp(opt, "allow") == 0) - conf_http_mode = -1; + conf_http_mode = HTTP_ERR_ALLOW; else if (strstr(opt, "://") != NULL) { conf_http_url = opt; opt = strstr(opt, "://") + 3; while (*opt == '/') opt++; - conf_http_mode = strchr(opt, '/') ? 1 : 2; + conf_http_mode = strchr(opt, '/') ? HTTP_ERR_REDIRECT : HTTP_ERR_REDIRECT_APPEND; } } -- cgit v1.2.3 From 5bfb65c652a62993b5374e325dda79ceb8a36da1 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Mon, 1 Dec 2025 02:47:20 +0200 Subject: sstp: Update documentation for missing options Signed-off-by: Denys Fedoryshchenko --- accel-pppd/accel-ppp.conf.5 | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/accel-pppd/accel-ppp.conf.5 b/accel-pppd/accel-ppp.conf.5 index c9666206..d9c05653 100644 --- a/accel-pppd/accel-ppp.conf.5 +++ b/accel-pppd/accel-ppp.conf.5 @@ -900,6 +900,21 @@ as a template, i.e sstp%d => sstp0. Set the maximum MTU value that can be negotiated for PPP over SSTP sessions. Default value is 1452, maximum is 4087. .TP +.BI "ip-pool=" pool_name +Specifies the name of the IPv4 pool to use for allocating client addresses. +.TP +.BI "ipv6-pool=" pool_name +Specifies the name of the IPv6 pool to use for allocating client addresses. +.TP +.BI "ipv6-pool-delegate=" pool_name +Specifies the name of the IPv6 prefix delegation pool to use. +.TP +.BI "sndbuf=" n +Specifies the TCP send buffer size (SO_SNDBUF) for the SSTP socket. +.TP +.BI "rcvbuf=" n +Specifies the TCP receive buffer size (SO_RCVBUF) for the SSTP socket. +.TP .BI "session-timeout=" n Specifies max sessions time in seconds, after this time session will be terminated. .br -- cgit v1.2.3 From 8c9a4c4cdd68d3ab3fa1d6cd2e44577107bcd69c Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Mon, 1 Dec 2025 02:50:25 +0200 Subject: sstp: Improve documentation about proxy protocol Signed-off-by: Denys Fedoryshchenko --- accel-pppd/accel-ppp.conf.5 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/accel-pppd/accel-ppp.conf.5 b/accel-pppd/accel-ppp.conf.5 index d9c05653..f25b6f85 100644 --- a/accel-pppd/accel-ppp.conf.5 +++ b/accel-pppd/accel-ppp.conf.5 @@ -823,6 +823,13 @@ Specifies incoming connection acceptance mode. .br .B proxy - enable PROXY protocol 1 & 2 support. +.br +This is useful when accel-ppp is running behind a load balancer (like HAProxy or Nginx) or a reverse proxy. It allows accel-ppp to receive the original client IP address and port instead of the proxy's IP. The extracted real client IP is then used for: +.br +- \fBconnlimit\fR module checks (limiting connections per source IP). +- \fBclient-ip-range\fR verification. +- \fBCalling-Station-Id\fR attribute in RADIUS and logs. +.br .TP .BI "ssl-protocol=" ssl2|ssl3|tls1|tls1.1|tls1.2|tls1.3 Specifies the enabled SSL/TLS protocols supported by OpenSSL library. -- cgit v1.2.3