Merge branch 'master' of ssh://git.code.sf.net/p/accel-ppp/code

16 files changed, 198 insertions, 103 deletions

diff --git a/accel-pppd/accel-ppp.conf.5 b/accel-pppd/accel-ppp.conf.5
index 2397023..9f7740a 100644
--- a/accel-pppd/accel-ppp.conf.5
+++ b/accel-pppd/accel-ppp.conf.5
@@ -462,7 +462,11 @@ AVPs that support it).
 Specifies if an arbitrary source port is used when replying to a tunnel
 establishment request. When this option is deactivated, the destination
 port of the incoming request (SCCRQ) is used as source port for the
-reply (SCCRP). Default value is 1.
+reply (SCCRP). Default value is 0.
+.TP
+.BI "ppp-max-mtu=" n
+Set the maximun MTU value that can be negociated for PPP over L2TP
+sessions. Default value is 1420.
 .SH [radius]
 .br
 Configuration of RADIUS module.
diff --git a/accel-pppd/auth/auth_chap_md5.c b/accel-pppd/auth/auth_chap_md5.c
index 7e14b8d..8aa3018 100644
--- a/accel-pppd/auth/auth_chap_md5.c
+++ b/accel-pppd/auth/auth_chap_md5.c
@@ -404,7 +404,7 @@ static void chap_recv(struct ppp_handler_t *h)
 	struct chap_auth_data_t *d = container_of(h, typeof(*d), h);
 	struct chap_hdr_t *hdr = (struct chap_hdr_t *)d->ppp->buf;
 
-	if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) < d->ppp->buf_size - 2)	{
+	if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) > d->ppp->buf_size - 2)	{
 		log_ppp_warn("chap-md5: short packet received\n");
 		return;
 	}
diff --git a/accel-pppd/auth/auth_mschap_v1.c b/accel-pppd/auth/auth_mschap_v1.c
index adfbc60..0dcaffd 100644
--- a/accel-pppd/auth/auth_mschap_v1.c
+++ b/accel-pppd/auth/auth_mschap_v1.c
@@ -470,7 +470,7 @@ static void chap_recv(struct ppp_handler_t *h)
 	struct chap_auth_data_t *d = container_of(h, typeof(*d), h);
 	struct chap_hdr_t *hdr = (struct chap_hdr_t *)d->ppp->buf;
 
-	if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) < d->ppp->buf_size - 2) {
+	if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) > d->ppp->buf_size - 2) {
 		log_ppp_warn("mschap-v1: short packet received\n");
 		return;
 	}
diff --git a/accel-pppd/auth/auth_mschap_v2.c b/accel-pppd/auth/auth_mschap_v2.c
index 444a9df..3ee2adc 100644
--- a/accel-pppd/auth/auth_mschap_v2.c
+++ b/accel-pppd/auth/auth_mschap_v2.c
@@ -607,7 +607,7 @@ static void chap_recv(struct ppp_handler_t *h)
 	struct chap_auth_data_t *d = container_of(h, typeof(*d), h);
 	struct chap_hdr_t *hdr = (struct chap_hdr_t *)d->ppp->buf;
 
-	if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) < d->ppp->buf_size - 2) {
+	if (d->ppp->buf_size < sizeof(*hdr) || ntohs(hdr->len) < HDR_LEN || ntohs(hdr->len) > d->ppp->buf_size - 2) {
 		log_ppp_warn("mschap-v2: short packet received\n");
 		return;
 	}
diff --git a/accel-pppd/ctrl/ipoe/ipoe.c b/accel-pppd/ctrl/ipoe/ipoe.c
index e553719..7f92501 100644
--- a/accel-pppd/ctrl/ipoe/ipoe.c
+++ b/accel-pppd/ctrl/ipoe/ipoe.c
@@ -427,6 +427,9 @@ static void ipoe_session_start(struct ipoe_session *ses)
 		}
 	}
 
+	log_ppp_info1("%s: authentication succeeded\n", ses->ses.username);
+	triton_event_fire(EV_SES_AUTHORIZED, &ses->ses);
+
 	if (ses->serv->opt_nat)
 		ses->ses.ipv4 = ipdb_get_ipv4(&ses->ses);
 	
@@ -841,6 +844,8 @@ static void ipoe_session_finished(struct ap_session *s)
 	
 	if (ses->dhcpv4)
 		dhcpv4_free(ses->dhcpv4);
+
+	triton_event_fire(EV_CTRL_FINISHED, s);
 	
 	triton_context_call(&ses->ctx, (triton_event_func)ipoe_session_free, ses);
 }
@@ -870,7 +875,7 @@ static struct ipoe_session *ipoe_session_create_dhcpv4(struct ipoe_serv *serv, s
 {
 	struct ipoe_session *ses;
 	int dlen = 0;
-	uint8_t *ptr;
+	uint8_t *ptr = NULL;
 	
 	ses = mempool_alloc(ses_pool);
 	if (!ses) {
diff --git a/accel-pppd/ctrl/l2tp/l2tp.c b/accel-pppd/ctrl/l2tp/l2tp.c
index 5f73193..b4b20b7 100644
--- a/accel-pppd/ctrl/l2tp/l2tp.c
+++ b/accel-pppd/ctrl/l2tp/l2tp.c
@@ -48,11 +48,14 @@
 #define STATE_FIN        9
 #define STATE_CLOSE      0
 
+#define DEFAULT_PPP_MAX_MTU 1420
+
 int conf_verbose = 0;
 int conf_hide_avps = 0;
 int conf_avp_permissive = 0;
+static int conf_ppp_max_mtu = DEFAULT_PPP_MAX_MTU;
 static int conf_port = L2TP_PORT;
-static int conf_ephemeral_ports = 1;
+static int conf_ephemeral_ports = 0;
 static int conf_timeout = 60;
 static int conf_rtimeout = 5;
 static int conf_retransmit = 5;
@@ -97,8 +100,6 @@ struct l2tp_conn_t
 	struct triton_timer_t rtimeout_timer;
 	struct triton_timer_t hello_timer;
 
-	int tunnel_fd;
-
 	struct sockaddr_in peer_addr;
 	struct sockaddr_in host_addr;
 	uint16_t tid;
@@ -706,9 +707,6 @@ static void l2tp_tunnel_free(struct l2tp_conn_t *conn)
 	l2tp_conn[conn->tid] = NULL;
 	pthread_mutex_unlock(&l2tp_lock);
 
-	if (conn->tunnel_fd != -1)
-		close(conn->tunnel_fd);
-
 	if (conn->ctx.tpd)
 		triton_context_unregister(&conn->ctx);
 
@@ -883,7 +881,7 @@ static struct l2tp_sess_t *l2tp_tunnel_alloc_session(struct l2tp_conn_t *conn)
 	sess->ctrl.started = l2tp_ppp_started;
 	sess->ctrl.finished = l2tp_ppp_finished;
 	sess->ctrl.terminate = ppp_terminate;
-	sess->ctrl.max_mtu = 1420;
+	sess->ctrl.max_mtu = conf_ppp_max_mtu;
 	sess->ctrl.mppe = conf_mppe;
 	sess->ctrl.calling_station_id = _malloc(17);
 	sess->ctrl.called_station_id = _malloc(17);
@@ -1123,8 +1121,6 @@ static struct l2tp_conn_t *l2tp_tunnel_alloc(const struct sockaddr_in *peer,
 	conn->hello_timer.expire = l2tp_send_HELLO;
 	conn->hello_timer.period = conf_hello_interval * 1000;
 
-	conn->tunnel_fd = -1;
-
 	conn->sessions = NULL;
 	conn->sess_count = 0;
 	conn->lns_mode = lns_mode;
@@ -1164,7 +1160,6 @@ static int l2tp_session_connect(struct l2tp_sess_t *sess)
 	struct l2tp_conn_t *conn = sess->paren_conn;
 	int lns_mode = sess->lns_mode;
 	int flg;
-	int chan_sz;
 	uint16_t peer_port;
 	char addr[17];
 
@@ -1216,23 +1211,10 @@ static int l2tp_session_connect(struct l2tp_sess_t *sess)
 
 	u_inet_ntoa(conn->peer_addr.sin_addr.s_addr, addr);
 	peer_port = ntohs(conn->peer_addr.sin_port);
-	chan_sz = snprintf(NULL, 0, "%s:%i session %i",
-		       addr, peer_port, sess->peer_sid);
-	if (chan_sz < 0) {
-		log_session(log_error, sess, "impossible to connect session:"
-			    " snprintf() failed: %s\n", strerror(errno));
-		goto out_err;
-	}
-	sess->ppp.ses.chan_name = _malloc(chan_sz + 1);
-	if (sess->ppp.ses.chan_name == NULL) {
-		log_session(log_error, sess, "impossible to connect session:"
-			    " memory allocation failed\n");
-		goto out_err;
-	}
-	if (snprintf(sess->ppp.ses.chan_name, chan_sz + 1, "%s:%i session %i",
-		     addr, peer_port, sess->peer_sid) < 0) {
+	if (_asprintf(&sess->ppp.ses.chan_name, "%s:%i session %i",
+		      addr, peer_port, sess->peer_sid) < 0) {
 		log_session(log_error, sess, "impossible to connect session:"
-			    " snprintf(%i) failed\n", chan_sz + 1);
+			    " setting session's channel name failed\n");
 		goto out_err;
 	}
 
@@ -1269,6 +1251,7 @@ out_err:
 static int l2tp_tunnel_connect(struct l2tp_conn_t *conn)
 {
 	struct sockaddr_pppol2tp pppox_addr;
+	int tunnel_fd;
 	int flg;
 
 	memset(&pppox_addr, 0, sizeof(pppox_addr));
@@ -1280,31 +1263,31 @@ static int l2tp_tunnel_connect(struct l2tp_conn_t *conn)
 	pppox_addr.pppol2tp.s_tunnel = conn->tid;
 	pppox_addr.pppol2tp.d_tunnel = conn->peer_tid;
 
-	conn->tunnel_fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
-	if (conn->tunnel_fd < 0) {
+	tunnel_fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
+	if (tunnel_fd < 0) {
 		log_tunnel(log_error, conn, "impossible to connect tunnel:"
 			   " socket(AF_PPPOX) failed: %s\n", strerror(errno));
-		goto out_err;
+		goto err;
 	}
 
-	flg = fcntl(conn->tunnel_fd, F_GETFD);
+	flg = fcntl(tunnel_fd, F_GETFD);
 	if (flg < 0) {
 		log_tunnel(log_error, conn, "impossible to connect tunnel:"
 			   " fcntl(F_GETFD) failed: %s\n", strerror(errno));
-		goto out_err;
+		goto err_fd;
 	}
-	flg = fcntl(conn->tunnel_fd, F_SETFD, flg | FD_CLOEXEC);
+	flg = fcntl(tunnel_fd, F_SETFD, flg | FD_CLOEXEC);
 	if (flg < 0) {
 		log_tunnel(log_error, conn, "impossible to connect tunnel:"
 			   " fcntl(F_SETFD) failed: %s\n", strerror(errno));
-		goto out_err;
+		goto err_fd;
 	}
 
-	if (connect(conn->tunnel_fd,
+	if (connect(tunnel_fd,
 		    (struct sockaddr *)&pppox_addr, sizeof(pppox_addr)) < 0) {
 		log_tunnel(log_error, conn, "impossible to connect tunnel:"
 			   " connect() failed: %s\n", strerror(errno));
-		goto out_err;
+		goto err_fd;
 	}
 
 	if (conf_hello_interval)
@@ -1312,19 +1295,19 @@ static int l2tp_tunnel_connect(struct l2tp_conn_t *conn)
 			log_tunnel(log_error, conn,
 				   "impossible to connect tunnel:"
 				   " setting HELLO timer failed\n");
-			goto out_err;
+			goto err_fd;
 		}
 
 	if (conn->timeout_timer.tpd)
 		triton_timer_del(&conn->timeout_timer);
 
+	close(tunnel_fd);
+
 	return 0;
 
-out_err:
-	if (conn->tunnel_fd >= 0) {
-		close(conn->tunnel_fd);
-		conn->tunnel_fd = -1;
-	}
+err_fd:
+	close(tunnel_fd);
+err:
 	return -1;
 }
 
@@ -3833,6 +3816,12 @@ static void load_config(void)
 	if (opt && atoi(opt) > 0)
 		conf_retransmit = atoi(opt);
 
+	opt = conf_get_opt("l2tp", "ppp-max-mtu");
+	if (opt && atoi(opt) > 0)
+		conf_ppp_max_mtu = atoi(opt);
+	else
+		conf_ppp_max_mtu = DEFAULT_PPP_MAX_MTU;
+
 	opt = conf_get_opt("l2tp", "host-name");
 	if (opt)
 		conf_host_name = opt;
diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c
index b01369d..21051ed 100644
--- a/accel-pppd/ctrl/pppoe/pppoe.c
+++ b/accel-pppd/ctrl/pppoe/pppoe.c
@@ -1478,7 +1478,7 @@ static void load_config(void)
 		conf_padi_limit = atoi(opt);
 
 	conf_mppe = MPPE_UNSET;
-	opt = conf_get_opt("l2tp", "mppe");
+	opt = conf_get_opt("pppoe", "mppe");
 	if (opt) {
 		if (strcmp(opt, "deny") == 0)
 			conf_mppe = MPPE_DENY;
diff --git a/accel-pppd/include/connlimit.h b/accel-pppd/include/connlimit.h
index a5645ee..8711cf8 100644
--- a/accel-pppd/include/connlimit.h
+++ b/accel-pppd/include/connlimit.h
@@ -11,7 +11,7 @@ static inline uint64_t cl_key_from_mac(uint8_t hw[6])
 	union {
 		uint8_t hw[6];
 		uint64_t key;
-	} key;
+	} key = {{ 0 }};
 
 	memcpy(key.hw, hw, sizeof(key.hw));
 
diff --git a/accel-pppd/main.c b/accel-pppd/main.c
index 365aee0..3b94353 100644
--- a/accel-pppd/main.c
+++ b/accel-pppd/main.c
@@ -146,9 +146,9 @@ void core_restart(int soft)
 	char *argv[16];
 	char *ptr = cmdline, *endptr;
 
-	if (fork()) {
+	if (soft && fork()) {
 		//close_all_fd();
-		_exit(0);
+		return;
 	}
 
 	pthread_sigmask(SIG_SETMASK, &orig_set, NULL);
@@ -224,11 +224,7 @@ static void sigsegv(int num)
 	}
 
 out:
-#ifdef USE_BACKUP
 	core_restart(1);
-#else
-	core_restart(0);
-#endif
 
 	if (conf_dump) {
 		lim.rlim_cur = RLIM_INFINITY;
diff --git a/accel-pppd/memdebug.c b/accel-pppd/memdebug.c
index 8e9dd4b..1f4af36 100644
--- a/accel-pppd/memdebug.c
+++ b/accel-pppd/memdebug.c
@@ -1,5 +1,6 @@
 #undef MEMDEBUG
 
+#include <stdarg.h>
 #include <stdlib.h>
 #include <stdint.h>
 #include <string.h>
@@ -25,7 +26,7 @@
 	(type *)( (char *)__mptr - offsetof(type,member) );})
 
 
-#define MAGIC1 0x1122334455667788llu
+#define MAGIC1 UINT64_C(0x1122334455667788)
 
 struct mem_t
 {
@@ -41,10 +42,13 @@ struct mem_t
 static LIST_HEAD(mem_list);
 static spinlock_t mem_list_lock = SPINLOCK_INITIALIZER;
 
-struct mem_t *_md_malloc(size_t size, const char *fname, int line)
+static struct mem_t *_md_malloc(size_t size, const char *fname, int line)
 {
 	struct mem_t *mem = malloc(sizeof(*mem) + size + 8);
 
+	if (mem == NULL)
+		return NULL;
+
 	if (size > 4096)
 		line = 0;
 
@@ -66,25 +70,26 @@ void __export *md_malloc(size_t size, const char *fname, int line)
 {
 	struct mem_t *mem = _md_malloc(size, fname, line);
 
-	return mem->data;
+	return mem ? mem->data : NULL;
 }
 
 void __export md_free(void *ptr, const char *fname, int line)
 {
-	struct mem_t *mem = container_of(ptr, typeof(*mem), data);
+	struct mem_t *mem;
+
+	if (!ptr)
+		return;
+
+	mem = container_of(ptr, typeof(*mem), data);
 
-	if (!ptr) {
-		printf("free null pointer at %s:%i\n", fname, line);
-		abort();
-	}
-	
 	if (mem->magic1 != MAGIC1) {
 		printf("memory corruption:\nfree at %s:%i\n", fname, line);
 		abort();
 	}
 
 	if (mem->magic2 != *(uint64_t*)(mem->data + mem->size)) {
-		printf("memory corruption:\nmalloc(%lu) at %s:%i\nfree at %s:%i\n", (long unsigned)mem->size, mem->fname, mem->line, fname, line);
+		printf("memory corruption:\nmalloc(%zu) at %s:%i\nfree at %s:%i\n",
+		       mem->size, mem->fname, mem->line, fname, line);
 		abort();
 	}
 	
@@ -101,40 +106,98 @@ void __export md_free(void *ptr, const char *fname, int line)
 
 void __export *md_realloc(void *ptr, size_t size, const char *fname, int line)
 {
-	struct mem_t *mem = container_of(ptr, typeof(*mem), data);
+	struct mem_t *mem = ptr ? container_of(ptr, typeof(*mem), data) : NULL;
 	struct mem_t *mem2;
-	
-	if (mem->magic1 != MAGIC1) {
-		printf("memory corruption:\nfree at %s:%i\n", fname, line);
-		abort();
-	}
 
-	if (mem->magic2 != *(uint64_t*)(mem->data + mem->size)) {
-		printf("memory corruption:\nmalloc(%lu) at %s:%i\nfree at %s:%i\n", (long unsigned)mem->size, mem->fname, mem->line, fname, line);
-		abort();
+	if (mem) {
+		if (mem->magic1 != MAGIC1) {
+			printf("memory corruption:\nfree at %s:%i\n",
+			       fname, line);
+			abort();
+		}
+
+		if (mem->magic2 != *(uint64_t*)(mem->data + mem->size)) {
+			printf("memory corruption:\nmalloc(%zu) at %s:%i\nfree at %s:%i\n",
+			       mem->size, mem->fname, mem->line, fname, line);
+			abort();
+		}
+
+		if (size == 0) {
+			md_free(mem->data, fname, line);
+			return NULL;
+		}
 	}
 
 	mem2 = _md_malloc(size, fname, line);
-	memcpy(mem2->data, mem->data, mem->size);
-	
-	md_free(mem->data, fname, line);
+	if (mem2 == NULL)
+		return NULL;
+
+	if (mem) {
+		memcpy(mem2->data, mem->data,
+		       (size < mem->size) ? size : mem->size);
+		md_free(mem->data, fname, line);
+	}
 
 	return mem2->data;
 }
 
 char __export *md_strdup(const char *ptr, const char *fname, int line)
 {
-	struct mem_t *mem = _md_malloc(strlen(ptr) + 1, fname, line);
-	memcpy(mem->data, ptr, strlen(ptr) + 1);
-	return mem->data;
+	size_t len = strlen(ptr);
+	char *str = md_malloc(len + 1, fname, line);
+
+	if (str)
+		memcpy(str, ptr, len + 1);
+
+	return str;
 }
 
 char __export *md_strndup(const char *ptr, size_t n, const char *fname, int line)
 {
-	struct mem_t *mem = _md_malloc(n + 1, fname, line);
-	memcpy(mem->data, ptr, n);
-	mem->data[n] = 0;
-	return mem->data;
+	size_t len = strnlen(ptr, n);
+	char *str = md_malloc(len + 1, fname, line);
+
+	if (str) {
+		memcpy(str, ptr, len);
+		str[len] = '\0';
+	}
+
+	return str;
+}
+
+int __export md_asprintf(const char *fname, int line,
+			 char **strp, const char *fmt, ...)
+{
+	va_list ap;
+	va_list aq;
+	int len;
+
+	va_start(ap, fmt);
+	va_copy(aq, ap);
+
+	len = vsnprintf(NULL, 0, fmt, ap);
+	if (len < 0)
+		goto err;
+
+	*strp = md_malloc(len + 1, fname, line);
+	if (*strp == NULL)
+		goto err;
+
+	len = vsnprintf(*strp, len + 1, fmt, aq);
+	if (len < 0)
+		goto err_strp;
+
+	va_end(aq);
+	va_end(ap);
+
+	return len;
+
+err_strp:
+	md_free(*strp, fname, line);
+err:
+	va_end(aq);
+	va_end(ap);
+	return -1;
 }
 
 static void siginfo(int num)
diff --git a/accel-pppd/memdebug.h b/accel-pppd/memdebug.h
index 98e87d0..09978f4 100644
--- a/accel-pppd/memdebug.h
+++ b/accel-pppd/memdebug.h
@@ -10,12 +10,14 @@
 #define _free(ptr) md_free(ptr, __FILE__, __LINE__)
 #define _strdup(str) md_strdup(str, __FILE__, __LINE__)
 #define _strndup(str, size) md_strndup(str, size, __FILE__, __LINE__)
+#define _asprintf(strp, fmt, ...) md_asprintf(__FILE__, __LINE__, strp, fmt, ##__VA_ARGS__)
 
 void *md_malloc(size_t size, const char *fname, int line);
 void *md_realloc(void *ptr, size_t size, const char *fname, int line);
 void md_free(void *ptr, const char *fname, int line);
 char* md_strdup(const char *ptr, const char *fname, int line);
 char* md_strndup(const char *ptr, size_t size, const char *fname, int line);
+int md_asprintf(const char *fname, int line, char **strp, const char *fmt, ...) __attribute__((format(gnu_printf, 4, 5)));
 void md_check(void *ptr);
 
 #else
@@ -24,7 +26,7 @@ void md_check(void *ptr);
 #define _free(ptr) free(ptr)
 #define _strdup(str) strdup(str)
 #define _strndup(str, size) strndup(str, size)
+#define _asprintf(strp, fmt, ...) asprintf(strp, fmt, ##__VA_ARGS__)
 #endif
 
 #endif
-
diff --git a/accel-pppd/ppp/ipv6cp_opt_intfid.c b/accel-pppd/ppp/ipv6cp_opt_intfid.c
index a46ae17..11b35ff 100644
--- a/accel-pppd/ppp/ipv6cp_opt_intfid.c
+++ b/accel-pppd/ppp/ipv6cp_opt_intfid.c
@@ -37,6 +37,7 @@ static int ipaddr_send_conf_nak(struct ppp_ipv6cp_t *ipv6cp, struct ipv6cp_optio
 static int ipaddr_recv_conf_req(struct ppp_ipv6cp_t *ipv6cp, struct ipv6cp_option_t *opt, uint8_t *ptr);
 //static int ipaddr_recv_conf_ack(struct ppp_ipv6cp_t *ipv6cp, struct ipv6cp_option_t *opt, uint8_t *ptr);
 static void ipaddr_print(void (*print)(const char *fmt,...),struct ipv6cp_option_t*, uint8_t *ptr);
+static void put_ipv6_item(struct ap_session *ses, struct ipv6db_item_t *ip6);
 
 struct ipaddr_option_t
 {
@@ -55,6 +56,41 @@ static struct ipv6cp_option_handler_t ipaddr_opt_hnd =
 	.print         = ipaddr_print,
 };
 
+/* ipdb backend used for generating a link-local address when all other
+ * backends (like radius and ipv6pool) failed to assign IPv6 addresses.
+ * This backend isn't registered to ipdb as it's only used as a fallback
+ * during IPv6CP negociation.
+ */
+static struct ipdb_t ipv6db = {
+	.put_ipv6 = put_ipv6_item
+};
+
+static void put_ipv6_item(struct ap_session *ses, struct ipv6db_item_t *ip6)
+{
+	_free(ip6);
+}
+
+static int gen_ipv6_item(struct ap_session *ses)
+{
+	struct ipv6db_item_t *ip6 = NULL;
+
+	ip6 = _malloc(sizeof(*ip6));
+	if (ip6 == NULL) {
+		log_ppp_warn("ppp: allocation of IPv6 address failed\n");
+		return -1;
+	}
+
+	memset(ip6, 0, sizeof(*ip6));
+	ip6->owner = &ipv6db;
+	ip6->intf_id = 0;
+	ip6->peer_intf_id = 0;
+	INIT_LIST_HEAD(&ip6->addr_list);
+
+	ses->ipv6 = ip6;
+
+	return 0;
+}
+
 static struct ipv6cp_option_t *ipaddr_init(struct ppp_ipv6cp_t *ipv6cp)
 {
 	struct ipaddr_option_t *ipaddr_opt = _malloc(sizeof(*ipaddr_opt));
@@ -165,8 +201,10 @@ static int alloc_ip(struct ppp_t *ppp)
 {
 	ppp->ses.ipv6 = ipdb_get_ipv6(&ppp->ses);
 	if (!ppp->ses.ipv6) {
-		log_ppp_warn("ppp: no free IPv6 address\n");
-		return IPV6CP_OPT_CLOSE;
+		if (gen_ipv6_item(&ppp->ses) < 0) {
+			log_ppp_warn("ppp: no free IPv6 address\n");
+			return IPV6CP_OPT_CLOSE;
+		}
 	}
 
 	if (!ppp->ses.ipv6->intf_id)
diff --git a/accel-pppd/ppp/ppp_auth.c b/accel-pppd/ppp/ppp_auth.c
index 42bbbc6..0510358 100644
--- a/accel-pppd/ppp/ppp_auth.c
+++ b/accel-pppd/ppp/ppp_auth.c
@@ -329,7 +329,7 @@ static void __ppp_auth_started(struct ppp_t *ppp)
 
 
 	log_ppp_info1("%s: authentication succeeded\n", ppp->ses.username);
-	triton_event_fire(EV_SES_AUTHORIZED, ppp);
+	triton_event_fire(EV_SES_AUTHORIZED, &ppp->ses);
 }
 
 int __export ppp_auth_succeeded(struct ppp_t *ppp, char *username)
diff --git a/accel-pppd/session.c b/accel-pppd/session.c
index c6d0a3f..1efad5e 100644
--- a/accel-pppd/session.c
+++ b/accel-pppd/session.c
@@ -274,7 +274,6 @@ static void generate_sessionid(struct ap_session *ses)
 int __export ap_session_read_stats(struct ap_session *ses, struct rtnl_link_stats *stats)
 {
 	struct rtnl_link_stats lstats;
-	time_t t;
 
 	if (ses->ifindex == -1)
 		return -1;
@@ -282,8 +281,6 @@ int __export ap_session_read_stats(struct ap_session *ses, struct rtnl_link_stat
 	if (!stats)
 		stats = &lstats;
 
-	time(&t);
-
 	if (iplink_get_stats(ses->ifindex, stats)) {
 		log_ppp_warn("failed to get interface statistics\n");
 		return -1;
diff --git a/accel-pppd/triton/mempool.c b/accel-pppd/triton/mempool.c
index 5323771..1ee00f3 100644
--- a/accel-pppd/triton/mempool.c
+++ b/accel-pppd/triton/mempool.c
@@ -29,9 +29,9 @@ struct _mempool_t
 	struct list_head items;
 #ifdef MEMDEBUG
 	struct list_head ditems;
+	uint64_t magic;
 #endif
 	spinlock_t lock;
-	uint64_t magic;
 	int mmap:1;
 	int objects;
 };
@@ -46,9 +46,9 @@ struct _item_t
 #ifdef MEMDEBUG
 	const char *fname;
 	int line;
-#endif
 	uint64_t magic2;
 	uint64_t magic1;
+#endif
 	char ptr[0];
 };
 
@@ -69,10 +69,10 @@ mempool_t __export *mempool_create(int size)
 	INIT_LIST_HEAD(&p->items);
 #ifdef MEMDEBUG
 	INIT_LIST_HEAD(&p->ditems);
+	p->magic = (uint64_t)random() * (uint64_t)random();
 #endif
 	spinlock_init(&p->lock);
 	p->size = size;
-	p->magic = (uint64_t)random() * (uint64_t)random();
 
 	spin_lock(&pools_lock);
 	list_add_tail(&p->entry, &pools);
@@ -106,8 +106,6 @@ void __export *mempool_alloc(mempool_t *pool)
 		--p->objects;
 		__sync_sub_and_fetch(&triton_stat.mempool_available, size);
 		
-		it->magic1 = MAGIC1;
-
 		return it->ptr;
 #ifdef VALGRIND
 		}
@@ -135,9 +133,6 @@ void __export *mempool_alloc(mempool_t *pool)
 		return NULL;
 	}
 	it->owner = p;
-	it->magic2 = p->magic;
-	it->magic1 = MAGIC1;
-	*(uint64_t*)(it->ptr + p->size) = it->magic2;
 
 	return it->ptr;
 }
diff --git a/accel-pppd/triton/triton.c b/accel-pppd/triton/triton.c
index 267cc2b..d4c21e2 100644
--- a/accel-pppd/triton/triton.c
+++ b/accel-pppd/triton/triton.c
@@ -185,11 +185,6 @@ static void ctx_thread(struct _triton_context_t *ctx)
 	uint64_t tt;
 
 	log_debug2("ctx %p %p: enter\n", ctx, ctx->thread);
-	if (ctx->need_close) {
-		if (ctx->ud->close)
-			ctx->ud->close(ctx->ud);
-		ctx->need_close = 0;
-	}
 
 	while (1) {
 		spin_lock(&ctx->lock);
@@ -234,6 +229,17 @@ static void ctx_thread(struct _triton_context_t *ctx)
 		break;	
 	}
 
+	spin_lock(&ctx->lock);
+	if (ctx->need_close) {
+		spin_unlock(&ctx->lock);
+		if (ctx->ud->close) {
+			ctx->ud->close(ctx->ud);
+		}
+		spin_lock(&ctx->lock);
+		ctx->need_close = 0;
+	}
+	spin_unlock(&ctx->lock);
+
 	log_debug2("ctx %p %p: exit\n", ctx, ctx->thread);
 }