From 49a94430c090068ca96f1dc38ed24cd93c2e324d Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Sun, 9 Aug 2026 06:54:53 +0300 Subject: pptp: drop the out-of-tree kernel driver drivers/pptp is version 0.8.5 of the PPTP driver, the direct ancestor of mainline drivers/net/ppp/pptp.c. Mainline merged that code in 2.6.37 (2011) from the same author and has maintained it since; this copy received none of the subsequent fixes and is no longer worth carrying: - It cannot be built. struct flowi's nl_u union, the 3-argument ip_route_output_key(), sock_no_poll, the old ip_select_ident() signature and nf_reset() all disappeared long ago, so nothing past roughly 2.6.36 compiles and -DBUILD_PPTP_DRIVER=TRUE is a build failure everywhere. - It is not needed. The PPTP bits of accel-pppd/include/if_pppox.h are identical to the mainline UAPI header, so ctrl/pptp's socket(AF_PPPOX, SOCK_STREAM, PX_PROTO_PPTP) reaches the in-kernel module (alias net-pf-24-proto-2) unchanged. The daemon uses no interface the bundled driver added. The deleted drivers/pptp/if_pppox.h was included only by drivers/pptp/pptp.c; all other if_pppox.h includes use either the kernel UAPI header or accel-pppd's userspace copy. - It is unsafe. Among others: the pskb_may_pull() in pptp_rcv() is commented out, so the GRE header is parsed with no length validation at all; the skb->len - headersize comparison in pptp_rcv_core() underflows and leads to an out-of-bounds read and a negative skb_pull(); pptp_getname() copies uninitialised stack to userspace; and pptp_bind()/pptp_connect() never check sockaddr_len (CVE-2015-8569). Mainline fixed each of these years ago. Remove the directory along with the BUILD_PPTP_DRIVER option, the accel-pptp-kmod package and the ip_gre conflict warning, which only existed because this module claimed IPPROTO_GRE. accel-pppd/ctrl/pptp and accel-pppd/include/if_pppox.h are unaffected. PPTP now requires the kernel's own pptp module; kernels older than 2.6.37 are no longer supported. --- README.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index a78cb145..b4df0bce 100644 --- a/README.md +++ b/README.md @@ -65,7 +65,6 @@ Use an out-of-tree build directory: Useful build options: -* BUILD_PPTP_DRIVER=TRUE builds the PPTP kernel module. * BUILD_IPOE_DRIVER=TRUE builds the IPoE kernel module. * BUILD_VLAN_MON_DRIVER=TRUE builds the VLAN monitoring kernel module. * BUILD_PPPOSEQ_DRIVER=TRUE builds the PPPoSEQ kernel module. @@ -238,8 +237,8 @@ digest is stored as hexadecimal. Kernel module warning ===================== -The out-of-tree PPTP module conflicts with the kernel's ip_gre module. Do not -build ip_gre into the kernel or load it at runtime when using that PPTP module. +PPTP requires the kernel's own pptp module (drivers/net/ppp/pptp.c, present +since Linux 2.6.37); ACCEL-PPP no longer ships an out-of-tree replacement. Do not mix ACCEL-PPP PPTP connections with poptop's pptpd; stop existing pptpd sessions before starting ACCEL-PPP. -- cgit v1.2.3 From 9505f3fe72f7930e94aec51188babcabe783e4da Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Sun, 9 Aug 2026 13:33:03 +0300 Subject: pptp: use the kernel PPPoX UAPI header Linux 2.6.37 and later provide the PPTP socket address and protocol definitions in linux/if_pppox.h. Use that header directly instead of carrying an old private copy containing obsolete kernel-internal declarations. --- README.md | 4 +- accel-pppd/ctrl/pptp/pptp.c | 2 +- accel-pppd/include/if_pppox.h | 234 ------------------------------------------ 3 files changed, 3 insertions(+), 237 deletions(-) delete mode 100644 accel-pppd/include/if_pppox.h (limited to 'README.md') diff --git a/README.md b/README.md index b4df0bce..46b0bd0c 100644 --- a/README.md +++ b/README.md @@ -237,8 +237,8 @@ digest is stored as hexadecimal. Kernel module warning ===================== -PPTP requires the kernel's own pptp module (drivers/net/ppp/pptp.c, present -since Linux 2.6.37); ACCEL-PPP no longer ships an out-of-tree replacement. +PPTP requires the kernel's PPTP PPPoX support (CONFIG_PPTP, available since +Linux 2.6.37); ACCEL-PPP no longer ships an out-of-tree replacement. Do not mix ACCEL-PPP PPTP connections with poptop's pptpd; stop existing pptpd sessions before starting ACCEL-PPP. diff --git a/accel-pppd/ctrl/pptp/pptp.c b/accel-pppd/ctrl/pptp/pptp.c index f8e498d6..eb5b40f5 100644 --- a/accel-pppd/ctrl/pptp/pptp.c +++ b/accel-pppd/ctrl/pptp/pptp.c @@ -11,7 +11,7 @@ #include #include -#include "if_pppox.h" +#include #include "events.h" #include "list.h" diff --git a/accel-pppd/include/if_pppox.h b/accel-pppd/include/if_pppox.h deleted file mode 100644 index 0532d18f..00000000 --- a/accel-pppd/include/if_pppox.h +++ /dev/null @@ -1,234 +0,0 @@ -/*************************************************************************** - * Linux PPP over X - Generic PPP transport layer sockets - * Linux PPP over Ethernet (PPPoE) Socket Implementation (RFC 2516) - * - * This file supplies definitions required by the PPP over Ethernet driver - * (pppox.c). All version information wrt this file is located in pppox.c - * - * License: - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License - * as published by the Free Software Foundation; either version - * 2 of the License, or (at your option) any later version. - * - */ - -#ifndef __LINUX_IF_PPPOX_H -#define __LINUX_IF_PPPOX_H - - -#include -#include -#include -#include -#include - -#ifdef __KERNEL__ -#include -#include -#include -#endif /* __KERNEL__ */ - -/* For user-space programs to pick up these definitions - * which they wouldn't get otherwise without defining __KERNEL__ - */ -#ifndef AF_PPPOX -#define AF_PPPOX 24 -#define PF_PPPOX AF_PPPOX -#endif /* !(AF_PPPOX) */ - -struct pppoe_addr { - __be16 sid; - unsigned char remote[ETH_ALEN]; - char dev[IFNAMSIZ]; -}; - -struct pptp_addr { - __u16 call_id; - struct in_addr sin_addr; -}; -/************************************************************************ - * Protocols supported by AF_PPPOX - */ -#define PX_PROTO_OE 0 /* Currently just PPPoE */ -#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,22) -#define PX_PROTO_PPTP 1 -#define PX_MAX_PROTO 2 -#else -#define PX_PROTO_PPTP 2 -#define PX_MAX_PROTO 3 -#endif - -struct sockaddr_pppox { - sa_family_t sa_family; /* address family, AF_PPPOX */ - unsigned int sa_protocol; /* protocol identifier */ - union{ - struct pppoe_addr pppoe; - struct pptp_addr pptp; - }sa_addr; -}__attribute__ ((packed)); - - -/********************************************************************* - * - * ioctl interface for defining forwarding of connections - * - ********************************************************************/ - -#define PPPOEIOCSFWD _IOW(0xB1 ,0, size_t) -#define PPPOEIOCDFWD _IO(0xB1 ,1) -/*#define PPPOEIOCGFWD _IOWR(0xB1,2, size_t)*/ - -/* Codes to identify message types */ -#define PADI_CODE 0x09 -#define PADO_CODE 0x07 -#define PADR_CODE 0x19 -#define PADS_CODE 0x65 -#define PADT_CODE 0xa7 -struct pppoe_tag { - __u16 tag_type; - __u16 tag_len; - char tag_data[0]; -} __attribute ((packed)); - -/* Tag identifiers */ -#define PTT_EOL __constant_htons(0x0000) -#define PTT_SRV_NAME __constant_htons(0x0101) -#define PTT_AC_NAME __constant_htons(0x0102) -#define PTT_HOST_UNIQ __constant_htons(0x0103) -#define PTT_AC_COOKIE __constant_htons(0x0104) -#define PTT_VENDOR __constant_htons(0x0105) -#define PTT_RELAY_SID __constant_htons(0x0110) -#define PTT_SRV_ERR __constant_htons(0x0201) -#define PTT_SYS_ERR __constant_htons(0x0202) -#define PTT_GEN_ERR __constant_htons(0x0203) - -struct pppoe_hdr { -#if defined(__LITTLE_ENDIAN_BITFIELD) - __u8 ver : 4; - __u8 type : 4; -#elif defined(__BIG_ENDIAN_BITFIELD) - __u8 type : 4; - __u8 ver : 4; -#else -#error "Please fix " -#endif - __u8 code; - __u16 sid; - __u16 length; - struct pppoe_tag tag[0]; -} __attribute__ ((packed)); - - -/* Socket options */ -#define PPTP_SO_TIMEOUT 1 - - -#ifdef __KERNEL__ -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,0) -struct pppoe_opt { - struct net_device *dev; /* device associated with socket*/ - struct pppoe_addr pa; /* what this socket is bound to*/ - struct sockaddr_pppox relay; /* what socket data will be - relayed to (PPPoE relaying) */ -}; -#endif -struct pptp_opt { - struct pptp_addr src_addr; - struct pptp_addr dst_addr; - int timeout; - __u32 ack_sent, ack_recv; - __u32 seq_sent, seq_recv; - int ppp_flags; - int flags; - struct sk_buff_head skb_buf; - #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) - struct tq_struct buf_work; //check bufferd packets work - struct timer_list buf_timer; - #else - #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20) - struct delayed_work buf_work; //check bufferd packets work - #else - struct work_struct buf_work; //check bufferd packets work - #endif - #endif - struct gre_statistics *stat; - spinlock_t xmit_lock; - spinlock_t rcv_lock; -}; -#define PPTP_FLAG_PAUSE 0 -#define PPTP_FLAG_PROC 1 - -#include - -struct pppox_sock { - /* struct sock must be the first member of pppox_sock */ - #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) - struct ppp_channel chan; - struct sock *sk; - #else - struct sock sk; - struct ppp_channel chan; - #endif - struct pppox_sock *next; /* for hash table */ - union { - struct pppoe_opt pppoe; - struct pptp_opt pptp; - } proto; - unsigned short num; -}; -#define pppoe_dev proto.pppoe.dev -#define pppoe_pa proto.pppoe.pa -#define pppoe_relay proto.pppoe.relay - -static inline struct pppox_sock *pppox_sk(struct sock *sk) -{ - #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) - return (struct pppox_sock *)sk->protinfo.pppox; - #else - return (struct pppox_sock *)sk; - #endif -} - -static inline struct sock *sk_pppox(struct pppox_sock *po) -{ - #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) - return po->sk; - #else - return (struct sock *)po; - #endif -} - -struct module; - -struct pppox_proto { - #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24) - int (*create)(struct socket *sock); - #else - int (*create)(struct net *net, struct socket *sock); - #endif - int (*ioctl)(struct socket *sock, unsigned int cmd, - unsigned long arg); - #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,15) - struct module *owner; - #endif -}; - -extern int register_pppox_proto(int proto_num, struct pppox_proto *pp); -extern void unregister_pppox_proto(int proto_num); -extern void pppox_unbind_sock(struct sock *sk);/* delete ppp-channel binding */ -extern int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg); - -/* PPPoX socket states */ -enum { - PPPOX_NONE = 0, /* initial state */ - PPPOX_CONNECTED = 1, /* connection established ==TCP_ESTABLISHED */ - PPPOX_BOUND = 2, /* bound to ppp device */ - PPPOX_RELAY = 4, /* forwarding is enabled */ - PPPOX_ZOMBIE = 8, /* dead, but still bound to ppp device */ - PPPOX_DEAD = 16 /* dead, useless, please clean me up!*/ -}; - -#endif /* __KERNEL__ */ - -#endif /* !(__LINUX_IF_PPPOX_H) */ -- cgit v1.2.3