From beeefb2bc617f1a871dd05c4cc00ff20bb5374c2 Mon Sep 17 00:00:00 2001
From: Vladislav Grishenko <themiron@mail.ru>
Date: Wed, 29 Jun 2016 13:29:33 +0500
Subject: accel-cmd: add -P/--password support

---
 accel-cmd/accel-cmd.1 |  5 ++++
 accel-cmd/accel_cmd.c | 63 ++++++++++++++++++++++++++++++++++++---------------
 2 files changed, 50 insertions(+), 18 deletions(-)

diff --git a/accel-cmd/accel-cmd.1 b/accel-cmd/accel-cmd.1
index 634b4e35..9f2f56b3 100644
--- a/accel-cmd/accel-cmd.1
+++ b/accel-cmd/accel-cmd.1
@@ -46,6 +46,11 @@ Set the service name or port number on which connection should be done.
 .RI "If this option is not supplied, or if " TIMEOUT " is zero, then no"
 timeout is set.
 .TP
+.BR \-P " \fIPASSWORD\fR, " \-\-password "=\fIPASSWORD\fR"
+.RB "Set the password."
+.RB "If this option is supplied and if " PASSWORD " is not empty, then"
+.RB "password will be used for client authentication."
+.TP
 .BR \-v ", " \-\-verbose
 Verbose output.
 .TP
diff --git a/accel-cmd/accel_cmd.c b/accel-cmd/accel_cmd.c
index d73c9c24..e0ca7d41 100644
--- a/accel-cmd/accel_cmd.c
+++ b/accel-cmd/accel_cmd.c
@@ -21,6 +21,7 @@
 struct host_params {
 	const char *str_addr;
 	const char *str_port;
+	char *passwd;
 	sa_family_t family;
 	int fd;
 };
@@ -183,7 +184,7 @@ static int accel_talk(int cmdfd, int accelfd, const struct msghdr *mhdr,
 	fd_set rfds;
 	fd_set wfds;
 	ssize_t res;
-	char last_char;
+	char last_char = '\0';
 	int cmdflg = -1;
 	int accelflg = -1;
 	size_t bytes_rd = 0;
@@ -360,11 +361,16 @@ out:
 	return err;
 }
 
-static struct msghdr *argv_to_msghdr(int argc, char * const *argv)
+static struct msghdr *argv_to_msghdr(int argc, char * const *argv, const char *passwd)
 {
 	struct msghdr *mh = NULL;
 	struct iovec *iv = NULL;
-	int indx;
+	int indx, ividx = 0, ivlen = 0;
+
+	if (passwd && *passwd)
+		ivlen += 2;
+	if (argc)
+		ivlen += argc * 2 - 1;
 
 	mh = calloc(1, sizeof(struct msghdr));
 	if (mh == NULL) {
@@ -373,7 +379,7 @@ static struct msghdr *argv_to_msghdr(int argc, char * const *argv)
 			__func__, __LINE__, strerror(errno));
 		return NULL;
 	}
-	iv = calloc(argc * 2 - 1, sizeof(struct iovec));
+	iv = calloc(ivlen, sizeof(struct iovec));
 	if (iv == NULL) {
 		fprintf(stderr, "%s,%i: Impossible to allocate buffer:"
 			" calloc() failed: %s\n",
@@ -382,17 +388,23 @@ static struct msghdr *argv_to_msghdr(int argc, char * const *argv)
 		return NULL;
 	}
 
-	for (indx = 0; indx < argc - 1; ++indx) {
-		iv[indx * 2].iov_base = argv[indx];
-		iv[indx * 2].iov_len = strlen(argv[indx]);
-		iv[indx * 2 + 1].iov_base = " ";
-		iv[indx * 2 + 1].iov_len = 1;
+	if (passwd && *passwd) {
+		iv[ividx].iov_base = (void *) passwd;
+		iv[ividx++].iov_len = strlen(passwd);
+		iv[ividx].iov_base = "\n";
+		iv[ividx++].iov_len = 1;
+	}
+	for (indx = 0; indx < argc; ++indx) {
+		if (indx) {
+		    iv[ividx].iov_base = " ";
+		    iv[ividx++].iov_len = 1;
+		}
+		iv[ividx].iov_base = argv[indx];
+		iv[ividx++].iov_len = strlen(argv[indx]);
 	}
-	iv[indx * 2].iov_base = argv[indx];
-	iv[indx * 2].iov_len = strlen(argv[indx]);
 
 	mh->msg_iov = iv;
-	mh->msg_iovlen = argc * 2 - 1;
+	mh->msg_iovlen = ivlen;
 
 	return mh;
 }
@@ -553,6 +565,7 @@ static void print_help(const char *name)
 	printf("\t-p, --port\t- Set remote port to use for communicating"
 	       " with HOST. Defaults to \"%s\".\n", DEFAULT_PORT);
 	printf("\t-t, --timeout\t- Set inactivity timeout.\n");
+	printf("\t-P, --password\t- Set password for accessing HOST.\n");
 	printf("\t-v, --verbose\t- Verbose output.\n");
 	printf("\t-V, --version\t- Display version number and exit.\n");
 	printf("\t-h, --help\t- Display this help message and exit.\n");
@@ -591,6 +604,11 @@ int main(int argc, char **argv)
 		 .flag = NULL,
 		 .val = 't'
 		},
+		{.name = "password",
+		 .has_arg = required_argument,
+		 .flag = NULL,
+		 .val = 'P'
+		},
 		{.name = "verbose",
 		 .has_arg = no_argument,
 		 .flag = NULL,
@@ -630,7 +648,7 @@ int main(int argc, char **argv)
 	char ochar;
 	int rv;
 
-	while ((ochar = getopt_long(argc, argv, "f:46ni:H:p:t:vVh-",
+	while ((ochar = getopt_long(argc, argv, "f:46ni:H:p:t:P:vVh-",
 				    long_opts, &oindx)) != -1) {
 		if (ochar == '-')
 			/* End of options, interpret the following arguments
@@ -674,6 +692,12 @@ int main(int argc, char **argv)
 				return XSTATUS_BADPARAM;
 			}
 			break;
+		case 'P':
+			if (peer.passwd)
+				free(peer.passwd);
+			peer.passwd = strdup(optarg);
+			memset(optarg, '*', strlen(optarg));
+			break;
 		case 'v':
 			verbose = true;
 			break;
@@ -689,14 +713,16 @@ int main(int argc, char **argv)
 		};
 	}
 
-	if (optind < argc) {
-		mh = argv_to_msghdr(argc - optind, argv + optind);
+	if (optind < argc || peer.passwd) {
+		mh = argv_to_msghdr(argc - optind, argv + optind, peer.passwd);
 		if (mh == NULL) {
 			rv = XSTATUS_INTERNAL;
 			goto out;
 		}
+	}
+	if (optind < argc)
 		inputstream = -1;
-	} else
+	else
 		inputstream = STDIN_FILENO;
 
 	rv = accel_connect(&peer, numeric);
@@ -711,9 +737,10 @@ int main(int argc, char **argv)
 	rv = accel_talk(inputstream, peer.fd, mh, timeo);
 
 out:
-	if (peer.fd >= 0) {
+	if (peer.fd >= 0)
 		close(peer.fd);
-	}
+	if (peer.passwd)
+		free(peer.passwd);
 	if (mh)
 		msghdr_free(mh);
 
-- 
cgit v1.2.3


From 8ab2f623fa1d11a2aaec35226cb7a1456fc257d8 Mon Sep 17 00:00:00 2001
From: Guillaume Nault <g.nault@alphalink.fr>
Date: Tue, 20 Feb 2018 18:50:25 +0100
Subject: radius: add support for route priority (metric) in Framed-Route

Let an optional route priority (aka metric) be defined in RADIUS
Framed-Route attributes.
The priority is an integer placed at the end of the route string. This
is backward compatible with the previous format and also conforms with
the recommended format defined by RFC 2865 (although we don't allow
multiple metrics).

Framed-Route format is:
<network> [<gateway> [<priority>]]

For example, 'Framed-Route = "192.0.2.0/24 203.0.113.1 8"' will let
the following route be installed (assuming 203.0.113.1 is routed
through eth0):
$ ip route show
[...]
192.0.2.0/24 via 203.0.113.1 dev eth0 metric 8

It's possible to use the unspecified gateway (0.0.0.0) if one wants to
set a priority without specifying a gateway address.

Finally, route deletion now also takes the priority into account, in
order to avoid removing a different route accidentally.

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
---
 accel-pppd/ctrl/ipoe/ipoe.c     | 10 +++++-----
 accel-pppd/libnetlink/iputils.c |  8 ++++++--
 accel-pppd/libnetlink/iputils.h |  4 ++--
 accel-pppd/radius/radius.c      | 16 +++++++++++++---
 accel-pppd/radius/radius_p.h    |  1 +
 5 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/accel-pppd/ctrl/ipoe/ipoe.c b/accel-pppd/ctrl/ipoe/ipoe.c
index 35f97d83..5fd64e2a 100644
--- a/accel-pppd/ctrl/ipoe/ipoe.c
+++ b/accel-pppd/ctrl/ipoe/ipoe.c
@@ -977,9 +977,9 @@ static void __ipoe_session_activate(struct ipoe_session *ses)
 
 	if (ses->ifindex == -1) {
 		if (!conf_ip_unnumbered)
-			iproute_add(serv->ifindex, ses->router, ses->yiaddr, 0, conf_proto, ses->mask);
+			iproute_add(serv->ifindex, ses->router, ses->yiaddr, 0, conf_proto, ses->mask, 0);
 		else if (!serv->opt_ifcfg)
-			iproute_add(serv->ifindex, serv->opt_src ?: ses->router, ses->yiaddr, 0, conf_proto, 32);
+			iproute_add(serv->ifindex, serv->opt_src ?: ses->router, ses->yiaddr, 0, conf_proto, 32, 0);
 	}
 
 	if (ses->l4_redirect)
@@ -1078,7 +1078,7 @@ static void ipoe_session_started(struct ap_session *s)
 
 	if (ses->ses.ipv4->peer_addr != ses->yiaddr)
 		//ipaddr_add_peer(ses->ses.ifindex, ses->router, ses->yiaddr); // breaks quagga
-		iproute_add(ses->ses.ifindex, ses->router, ses->yiaddr, 0, conf_proto, 32);
+		iproute_add(ses->ses.ifindex, ses->router, ses->yiaddr, 0, conf_proto, 32, 0);
 
 	if (ses->ifindex != -1 && ses->xid) {
 		ses->dhcpv4 = dhcpv4_create(ses->ctrl.ctx, ses->ses.ifname, "");
@@ -1163,9 +1163,9 @@ static void ipoe_session_finished(struct ap_session *s)
 		if (serv->opt_ifcfg)
 			ipaddr_del(serv->ifindex, ses->router, conf_ip_unnumbered ? 32 : ses->mask);
 		else if (conf_ip_unnumbered)
-			iproute_del(serv->ifindex, ses->yiaddr, conf_proto, 32);
+			iproute_del(serv->ifindex, ses->yiaddr, conf_proto, 32, 0);
 		else
-			iproute_del(serv->ifindex, ses->yiaddr, conf_proto, ses->mask);
+			iproute_del(serv->ifindex, ses->yiaddr, conf_proto, ses->mask, 0);
 	}
 
 	if (ses->dhcp_addr)
diff --git a/accel-pppd/libnetlink/iputils.c b/accel-pppd/libnetlink/iputils.c
index 7d20f672..ad6005f1 100644
--- a/accel-pppd/libnetlink/iputils.c
+++ b/accel-pppd/libnetlink/iputils.c
@@ -457,7 +457,7 @@ int __export ipaddr_del_peer(int ifindex, in_addr_t addr, in_addr_t peer)
 	return r;
 }
 
-int __export iproute_add(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw, int proto, int mask)
+int __export iproute_add(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw, int proto, int mask, uint32_t prio)
 {
 	struct ipaddr_req {
 		struct nlmsghdr n;
@@ -488,6 +488,8 @@ int __export iproute_add(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw
 		addattr32(&req.n, sizeof(req), RTA_PREFSRC, src);
 	if (gw)
 		addattr32(&req.n, sizeof(req), RTA_GATEWAY, gw);
+	if (prio)
+		addattr32(&req.n, sizeof(req), RTA_PRIORITY, prio);
 	addattr32(&req.n, sizeof(req), RTA_DST, dst);
 
 	if (rtnl_talk(rth, &req.n, 0, 0, NULL, NULL, NULL, 0) < 0)
@@ -498,7 +500,7 @@ int __export iproute_add(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw
 	return r;
 }
 
-int __export iproute_del(int ifindex, in_addr_t dst, int proto, int mask)
+int __export iproute_del(int ifindex, in_addr_t dst, int proto, int mask, uint32_t prio)
 {
 	struct ipaddr_req {
 		struct nlmsghdr n;
@@ -527,6 +529,8 @@ int __export iproute_del(int ifindex, in_addr_t dst, int proto, int mask)
 
 	if (ifindex)
 		addattr32(&req.n, sizeof(req), RTA_OIF, ifindex);
+	if (prio)
+		addattr32(&req.n, sizeof(req), RTA_PRIORITY, prio);
 
 	if (rtnl_talk(rth, &req.n, 0, 0, NULL, NULL, NULL, 0) < 0)
 		r = -1;
diff --git a/accel-pppd/libnetlink/iputils.h b/accel-pppd/libnetlink/iputils.h
index 3211cfb7..66aa9747 100644
--- a/accel-pppd/libnetlink/iputils.h
+++ b/accel-pppd/libnetlink/iputils.h
@@ -18,8 +18,8 @@ int ipaddr_add_peer(int ifindex, in_addr_t addr, in_addr_t peer_addr);
 int ipaddr_del(int ifindex, in_addr_t addr, int mask);
 int ipaddr_del_peer(int ifindex, in_addr_t addr, in_addr_t peer);
 
-int iproute_add(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw, int proto, int mask);
-int iproute_del(int ifindex, in_addr_t dst, int proto, int mask);
+int iproute_add(int ifindex, in_addr_t src, in_addr_t dst, in_addr_t gw, int proto, int mask, uint32_t prio);
+int iproute_del(int ifindex, in_addr_t dst, int proto, int mask, uint32_t prio);
 in_addr_t iproute_get(in_addr_t dst, in_addr_t *gw);
 
 int ip6route_add(int ifindex, struct in6_addr *dst, int prefix_len, int proto);
diff --git a/accel-pppd/radius/radius.c b/accel-pppd/radius/radius.c
index b8706015..5c650b28 100644
--- a/accel-pppd/radius/radius.c
+++ b/accel-pppd/radius/radius.c
@@ -62,6 +62,7 @@ static void parse_framed_route(struct radius_pd_t *rpd, const char *attr)
 {
 	char str[32];
 	char *ptr;
+	long int prio = 0;
 	in_addr_t dst;
 	in_addr_t gw;
 	int mask;
@@ -118,6 +119,14 @@ static void parse_framed_route(struct radius_pd_t *rpd, const char *attr)
 			gw = 0;
 		else
 			goto out_err;
+
+		/* Parse priority, if any */
+		if (*ptr) {
+			for (++ptr; *ptr && *ptr != ' '; ptr++);
+			if (*ptr == ' ')
+				if (u_readlong(&prio, ptr + 1, 0, UINT32_MAX) < 0)
+					goto out_err;
+		}
 	} else {
 		mask = 32;
 		gw = 0;
@@ -127,6 +136,7 @@ static void parse_framed_route(struct radius_pd_t *rpd, const char *attr)
 	fr->dst = dst;
 	fr->mask = mask;
 	fr->gw = gw;
+	fr->prio = prio;
 	fr->next = rpd->fr;
 	rpd->fr = fr;
 
@@ -444,11 +454,11 @@ static void ses_started(struct ap_session *ses)
 	}
 
 	for (fr = rpd->fr; fr; fr = fr->next) {
-		if (iproute_add(fr->gw ? 0 : rpd->ses->ifindex, 0, fr->dst, fr->gw, 3, fr->mask)) {
+		if (iproute_add(fr->gw ? 0 : rpd->ses->ifindex, 0, fr->dst, fr->gw, 3, fr->mask, fr->prio)) {
 			char dst[17], gw[17];
 			u_inet_ntoa(fr->dst, dst);
 			u_inet_ntoa(fr->gw, gw);
-			log_ppp_warn("radius: failed to add route %s/%i%s\n", dst, fr->mask, gw);
+			log_ppp_warn("radius: failed to add route %s/%i %s %u\n", dst, fr->mask, gw, fr->prio);
 		}
 	}
 
@@ -472,7 +482,7 @@ static void ses_finishing(struct ap_session *ses)
 
 	for (fr = rpd->fr; fr; fr = fr->next) {
 		if (fr->gw)
-			iproute_del(0, fr->dst, 3, fr->mask);
+			iproute_del(0, fr->dst, 3, fr->mask, fr->prio);
 	}
 
 	if (rpd->acct_started || rpd->acct_req)
diff --git a/accel-pppd/radius/radius_p.h b/accel-pppd/radius/radius_p.h
index cdbb57b8..1ce31c03 100644
--- a/accel-pppd/radius/radius_p.h
+++ b/accel-pppd/radius/radius_p.h
@@ -29,6 +29,7 @@ struct framed_route {
 	in_addr_t dst;
 	int mask;
 	in_addr_t gw;
+	uint32_t prio;
 	struct framed_route *next;
 };
 
-- 
cgit v1.2.3


From 64f65c44772176292de943176843abed7d61202f Mon Sep 17 00:00:00 2001
From: Vladislav Grishenko <themiron@mail.ru>
Date: Fri, 2 Mar 2018 19:43:38 +0500
Subject: triton: more general fix of thread wake up crash

after commit 287adbfc205c02eac375f55fb94f13c073faec97 gcc
still may reorder alloca() and memset() calls.
fix that with volatile access & memory barrier.
---
 accel-pppd/triton/triton.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/accel-pppd/triton/triton.c b/accel-pppd/triton/triton.c
index a4567464..999a38b2 100644
--- a/accel-pppd/triton/triton.c
+++ b/accel-pppd/triton/triton.c
@@ -54,7 +54,6 @@ struct triton_context_t default_ctx;
 static __thread struct triton_context_t *this_ctx;
 static __thread jmp_buf jmp_env;
 static __thread void *thread_frame;
-static volatile void *thread_stack;
 
 #define log_debug2(fmt, ...)
 
@@ -134,7 +133,9 @@ static void* triton_thread(struct _triton_thread_t *thread)
 				if (this_ctx->before_switch)
 					this_ctx->before_switch(this_ctx, thread->ctx->bf_arg);
 
-				thread_stack = alloca(thread->ctx->uc->uc_stack.ss_size + 64);
+				*(void *volatile *)alloca(thread->ctx->uc->uc_stack.ss_size + 64);
+				barrier();
+
 				memcpy(thread_frame - thread->ctx->uc->uc_stack.ss_size, thread->ctx->uc->uc_stack.ss_sp, thread->ctx->uc->uc_stack.ss_size);
 				setcontext(thread->ctx->uc);
 				abort();
@@ -478,7 +479,7 @@ static ucontext_t *alloc_context()
 	void *frame = __builtin_frame_address(0);
 	size_t stack_size = thread_frame - frame;
 
-	uc = malloc(sizeof(*uc) + stack_size);
+	uc = _malloc(sizeof(*uc) + stack_size);
 	uc->uc_stack.ss_sp = (void *)(uc + 1);
 	uc->uc_stack.ss_size = stack_size;
 	memcpy(uc->uc_stack.ss_sp, frame, stack_size);
@@ -505,7 +506,7 @@ void __export triton_context_schedule()
 	if (ctx->wakeup) {
 		ctx->wakeup = 0;
 		spin_unlock(&threads_lock);
-		free(ctx->uc);
+		_free(ctx->uc);
 		ctx->uc = NULL;
 		__sync_sub_and_fetch(&triton_stat.context_sleeping, 1);
 		log_debug2("ctx %p: exit schedule\n", ctx);
@@ -630,7 +631,7 @@ static void ru_update(struct triton_timer_t *t)
 
 void __export triton_register_init(int order, void (*func)(void))
 {
-	struct _triton_init_t *i1, *i = malloc(sizeof(*i));
+	struct _triton_init_t *i1, *i = _malloc(sizeof(*i));
 	struct list_head *p = init_list.next;
 
 
@@ -690,7 +691,7 @@ int __export triton_load_modules(const char *mod_sect)
 		i = list_entry(init_list.next, typeof(*i), entry);
 		i->func();
 		list_del(&i->entry);
-		free(i);
+		_free(i);
 	}
 
 	return 0;
-- 
cgit v1.2.3


From 6e7c20d8b1eaca421793cc3876c84a0ab718282e Mon Sep 17 00:00:00 2001
From: Dmitry Kozlov <xeb@mail.ru>
Date: Sat, 3 Mar 2018 12:06:06 +0300
Subject: pppoe: fixed PADO delaying function

---
 accel-pppd/ctrl/pppoe/pppoe.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c
index 11a6ea1f..7ab20e35 100644
--- a/accel-pppd/ctrl/pppoe/pppoe.c
+++ b/accel-pppd/ctrl/pppoe/pppoe.c
@@ -1055,7 +1055,8 @@ static void pppoe_recv_PADI(struct pppoe_serv_t *serv, uint8_t *pack, int size)
 		pado->ppp_max_payload = ppp_max_payload;
 
 		pado->timer.expire = pado_timer;
-		pado->timer.period = pado_delay;
+		pado->timer.expire_tv.tv_sec = pado_delay / 1000;
+		pado->timer.expire_tv.tv_usec = (pado_delay % 1000) * 1000;
 
 		triton_timer_add(&serv->ctx, &pado->timer, 0);
 
-- 
cgit v1.2.3


From 22b24dc6ceb93dca800c687e72bba89fe68a78ee Mon Sep 17 00:00:00 2001
From: Guillaume Nault <g.nault@alphalink.fr>
Date: Wed, 21 Feb 2018 17:55:53 +0100
Subject: ppp: fix use-after-free in ppp_auth_failed()

The 'username' variable can be freed at the beginning of the function.
We have to use ppp->ses.username instead.

Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
---
 accel-pppd/ppp/ppp_auth.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel-pppd/ppp/ppp_auth.c b/accel-pppd/ppp/ppp_auth.c
index 27138748..0eaac35a 100644
--- a/accel-pppd/ppp/ppp_auth.c
+++ b/accel-pppd/ppp/ppp_auth.c
@@ -364,8 +364,8 @@ void __export ppp_auth_failed(struct ppp_t *ppp, char *username)
 			_free(username);
 		ppp->ses.terminate_cause = TERM_AUTH_ERROR;
 		pthread_rwlock_unlock(&ses_lock);
-		log_ppp_info1("%s: authentication failed\n", username);
-		log_info1("%s: authentication failed\n", username);
+		log_ppp_info1("%s: authentication failed\n", ppp->ses.username);
+		log_info1("%s: authentication failed\n", ppp->ses.username);
 		triton_event_fire(EV_SES_AUTH_FAILED, ppp);
 	} else
 		log_ppp_info1("authentication failed\n");
-- 
cgit v1.2.3


From 5ccf2f0409c18e216c4da5c7cce5e9fcf14ebf54 Mon Sep 17 00:00:00 2001
From: Dmitry Kozlov <xeb@mail.ru>
Date: Sat, 3 Mar 2018 12:42:02 +0300
Subject: removed accel-dp mentioning from config file

---
 accel-pppd/accel-ppp.conf | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/accel-pppd/accel-ppp.conf b/accel-pppd/accel-ppp.conf
index 468fac35..dd74ef5d 100644
--- a/accel-pppd/accel-ppp.conf
+++ b/accel-pppd/accel-ppp.conf
@@ -31,8 +31,6 @@ pppd_compat
 #ipv6_dhcp
 #ipv6pool
 
-#net-accel-dp
-
 [core]
 log-error=/var/log/accel-ppp/core.log
 thread-count=4
@@ -88,7 +86,7 @@ called-sid=mac
 #vlan-mon=eth0,10-200
 #vlan-timeout=60
 #vlan-name=%I.%N
-#interface=eth1,padi-limit=1000,net=accel-dp
+#interface=eth1,padi-limit=1000
 interface=eth0
 
 [l2tp]
@@ -298,6 +296,3 @@ verbose=1
 pref-lifetime=604800
 valid-lifetime=2592000
 route-via-gw=1
-
-[accel-dp]
-socket=/var/run/accel-dp.sock
-- 
cgit v1.2.3


From 939e952452dd856a574a1d78c15181a93a593996 Mon Sep 17 00:00:00 2001
From: Vladislav Grishenko <themiron@mail.ru>
Date: Sun, 4 Mar 2018 02:29:46 +0500
Subject: fix possible null pointer dereferences

---
 accel-pppd/ctrl/ipoe/dhcpv4.c | 4 +++-
 accel-pppd/ctrl/l2tp/l2tp.c   | 2 +-
 accel-pppd/lua/session.c      | 6 ++++--
 accel-pppd/radius/backup.c    | 7 +++++--
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/accel-pppd/ctrl/ipoe/dhcpv4.c b/accel-pppd/ctrl/ipoe/dhcpv4.c
index dde50603..8a395ea8 100644
--- a/accel-pppd/ctrl/ipoe/dhcpv4.c
+++ b/accel-pppd/ctrl/ipoe/dhcpv4.c
@@ -1145,7 +1145,7 @@ void dhcpv4_reserve_ip(struct dhcpv4_serv *serv, uint32_t ip)
 struct dhcpv4_packet *dhcpv4_clone_radius(struct rad_packet_t *rad)
 {
 	struct dhcpv4_packet *pkt = dhcpv4_packet_alloc();
-	uint8_t *ptr = pkt->data, *endptr = ptr + BUF_SIZE;
+	uint8_t *ptr, *endptr;
 	struct dhcpv4_option *opt;
 	struct rad_attr_t *attr;
 
@@ -1153,6 +1153,8 @@ struct dhcpv4_packet *dhcpv4_clone_radius(struct rad_packet_t *rad)
 		return NULL;
 
 	pkt->refs = 1;
+	ptr = pkt->data;
+	endptr = ptr + BUF_SIZE;
 
 	list_for_each_entry(attr, &rad->attrs, entry) {
 		if (attr->vendor && attr->vendor->id == VENDOR_DHCP && attr->attr->id < 256) {
diff --git a/accel-pppd/ctrl/l2tp/l2tp.c b/accel-pppd/ctrl/l2tp/l2tp.c
index 55881b8d..cbb9de6b 100644
--- a/accel-pppd/ctrl/l2tp/l2tp.c
+++ b/accel-pppd/ctrl/l2tp/l2tp.c
@@ -3119,7 +3119,7 @@ static int rescode_get_data(const struct l2tp_attr_t *result_attr,
 		return 2;
 
 	*err_msg = _malloc(msglen + 1);
-	if (err_msg) {
+	if (*err_msg) {
 		memcpy(*err_msg, resavp->error_msg, msglen);
 		(*err_msg)[msglen] = '\0';
 	}
diff --git a/accel-pppd/lua/session.c b/accel-pppd/lua/session.c
index d65a67bd..277b299f 100644
--- a/accel-pppd/lua/session.c
+++ b/accel-pppd/lua/session.c
@@ -217,11 +217,12 @@ static int session_rx_bytes(lua_State *L)
 {
 	struct ap_session *ses = luaL_checkudata(L, 1, LUA_AP_SESSION);
 	uint64_t gword_sz = (uint64_t)UINT32_MAX + 1;
-	uint64_t bytes = gword_sz*ses->acct_input_gigawords + ses->acct_rx_bytes;
+	uint64_t bytes;
 
 	if (!ses)
 		return 0;
 
+	bytes = gword_sz*ses->acct_input_gigawords + ses->acct_rx_bytes;
 	lua_pushnumber(L, bytes);
 
 	return 1;
@@ -231,11 +232,12 @@ static int session_tx_bytes(lua_State *L)
 {
 	struct ap_session *ses = luaL_checkudata(L, 1, LUA_AP_SESSION);
 	uint64_t gword_sz = (uint64_t)UINT32_MAX + 1;
-	uint64_t bytes = gword_sz*ses->acct_output_gigawords + ses->acct_tx_bytes;
+	uint64_t bytes;
 
 	if (!ses)
 		return 0;
 
+	bytes = gword_sz*ses->acct_output_gigawords + ses->acct_tx_bytes;
 	lua_pushnumber(L, bytes);
 
 	return 1;
diff --git a/accel-pppd/radius/backup.c b/accel-pppd/radius/backup.c
index 93ab3eb0..46041d78 100644
--- a/accel-pppd/radius/backup.c
+++ b/accel-pppd/radius/backup.c
@@ -30,8 +30,8 @@
 static int session_save(struct ap_session *ses, struct backup_mod *m)
 {
 	struct radius_pd_t *rpd = find_pd(ses);
-	uint64_t session_timeout = ses->start_time + rpd->session_timeout.expire_tv.tv_sec;
-	uint32_t idle_timeout = rpd->idle_timeout.period / 1000;
+	uint64_t session_timeout;
+	uint32_t idle_timeout;
 
 	if (!rpd)
 		return 0;
@@ -39,6 +39,9 @@ static int session_save(struct ap_session *ses, struct backup_mod *m)
 	if (!rpd->authenticated)
 		return -2;
 
+	session_timeout = ses->start_time + rpd->session_timeout.expire_tv.tv_sec;
+	idle_timeout = rpd->idle_timeout.period / 1000;
+
 	add_tag(RAD_TAG_INTERIM_INTERVAL, &rpd->acct_interim_interval, 4);
 
 	if (rpd->session_timeout.tpd)
-- 
cgit v1.2.3


From ca152efa0c0b1a3a2cecfcdc0a72959e670b9f45 Mon Sep 17 00:00:00 2001
From: Vladislav Grishenko <themiron@mail.ru>
Date: Sun, 4 Mar 2018 02:31:42 +0500
Subject: fix build error with VALGRIND defined

---
 accel-pppd/triton/mempool.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/accel-pppd/triton/mempool.c b/accel-pppd/triton/mempool.c
index ecc91f34..ac444c5c 100644
--- a/accel-pppd/triton/mempool.c
+++ b/accel-pppd/triton/mempool.c
@@ -107,9 +107,6 @@ void __export *mempool_alloc(mempool_t *pool)
 		__sync_sub_and_fetch(&triton_stat.mempool_available, size);
 
 		return it->ptr;
-#ifdef VALGRIND
-		}
-#endif
 	}
 	spin_unlock(&p->lock);
 
@@ -123,7 +120,7 @@ void __export *mempool_alloc(mempool_t *pool)
 		mmap_ptr += size;
 		spin_unlock(&mmap_lock);
 		__sync_sub_and_fetch(&triton_stat.mempool_available, size);
-	}	else {
+	} else {
 		it = _malloc(size);
 		__sync_add_and_fetch(&triton_stat.mempool_allocated, size);
 	}
-- 
cgit v1.2.3