| Age | Commit message (Collapse) | Author |
|---|
|
Missing docs more
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
l2tp: fix buffer overflow and type errors in Calling/Called Number handling
|
|
chap dont have errors like mschap
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIs
|
|
fixup! Add RADIUS blast attack protection with Message-Authenticator
|
|
Fix issues introduced in 88a2ebdb:
- Fix type declaration: uint8_t *calling[254] declared an array of 254
pointers instead of an array of 254 bytes. Remove erroneous asterisks.
- Fix buffer overflow vulnerability: L2TP AVP values can be up to 1017
bytes (L2TP_AVP_LEN_MASK - sizeof(avp_header)), but buffers were only
254(*4?) bytes. A malicious packet could cause stack buffer overflow.
Use L2TP_AVP_LEN_MASK (1023) for buffer size to handle maximum AVP length.
- Remove useless NULL checks: Stack-allocated arrays can never be NULL,
causing compiler warnings. The existence check is n > 0 / m > 1.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Not a bug, but to supress warnings.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
We are using similar approach as in other projects, easiest one,
but probably in future it will break as soon as this functions
will be removed completely.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
mempool: Fix 32-bit stats
|
|
Raised cmake_minimum_required to 3.5
|
|
docs: Improve ippool documentation
|
|
Improve ippool documentation based on users feedback.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
docs: Update accel-ppp.conf about certificate configuration
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
We are living in 64-bit world long time, so there is very likely mempool
stats might overflow past 4GB and report incorrect values.
Updated mempool stats to use 64-bit counters so they don’t
wrap past 4 GB and print correctly in CLI.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
This is follow-up for https://github.com/accel-ppp/accel-ppp/pull/238
Adding missing documentation update.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
SSTP: load certificate chain instead of single one
|
|
pppoe: add missing break, ignore vendor-specific tags when parsing PADR
|
|
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Part of a long-term kernel networking cleanup is the kernel is moving to a strict type called dscp_t.
1)Macros like flowi4_tos are being removed to break compilation of old drivers (like accel-ppp) that treat the field as a raw byte.
2)This forces developers to use the new accessor functions (like ip4_dst_hoplimit or inet_dscp_to_dsfield) ensuring ECN bits are preserved.
We need to maintain compatibility with older kernel as well.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
It should look like:
[ 99%] Generating driver/ipoe.ko for kernel $(make -s -C ${KDIR}
kernelrelease 2>/dev/null || uname -r)" right before the module build
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
targets CMake 3.5+ and inherits the correct modern policy set
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Added an explicit break after handling TAG_VENDOR_SPECIFIC,
so vendor-specific PADR tags (e.g., TR-101) no longer fall
through and get misinterpreted as other tags like TAG_PPP_MAX_PAYLOAD.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
ci: add tests execution with asan and ubsan
|
|
|
|
ci: add build in debian:forky container
|
|
|
|
feat(build): Add MUSL detection and conditional linking
|
|
cmd: implement show ippool command
|
|
ipoe: dhcp: Fix username for noauth session
|
|
This commit introduces the ability to detect if the project is being
built with the MUSL C library.
A new variable `MUSL` is set to `ON` if MUSL is detected, and `OFF`
otherwise. This is achieved by checking the output of `ldd --version`.
The `accel-pppd/ctrl/pppoe/CMakeLists.txt` file is updated to
conditionally link the `connlimit` library only when building with MUSL.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
|
|
Command Usage:
accel-ppp# show ippool
IP Pool Usage Report
====================
<default>
total: 16384
used: 0
available: 16384
usage: 0%
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Add RADIUS blast attack protection with Message-Authenticator
|
|
ci: add fedora:rawhide build to build with latest kernel
|
|
|
|
Recently FreeRadius started to complain accel-ppp doesn't pass
BlastRADIUS check. This commit fixes that.
This commit implements protection against RADIUS blast attacks
by adding support for the Message-Authenticator attribute in
Access-Request packets. This security enhancement helps
prevent unauthorized access attempts and replay attacks
on RADIUS authentication.
- Added new configuration option `blast-protection=1`
in [radius] to enable Message-Authenticator inclusion
- Implemented HMAC-MD5 calculation for
Message-Authenticator attribute (RFC 2869)
- Modified packet building to include 18-byte Message-Authenticator
attribute when enabled
- Updated packet structure to support signing with shared secret
Enable blast protection by adding to the `[radius]` section:
```
blast-protection=1
```
When enabled, all Access-Request packets will include a
Message-Authenticator attribute with HMAC-MD5 signature,
providing cryptographic integrity verification and protection
against packet modification attacks.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
Add build fixes
|
|
NETIF_F_NETNS_LOCAL existed in <=6.11, then converted to
dev->netns_local, and then renamed to netns_immutable in
0c493da86374dffff7505e67289ad75b21f5b301.
This commit address this properly.
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
del_timer() was renamed to timer_delete() by commit bb663f0f3c396c6d
(“timers: Rename del_timer() to timer_delete()”) authored by Thomas Gleixner
on 23 Nov 2022, merged via the timers/core branch and included in the Linux
6.2-rc1 merge window; the change therefore reached users with the Linux 6.2
final release on 19 Feb 2023.
(The legacy inline wrappers del_timer() / del_timer_sync() stayed in place
for compatibility until they were dropped by the tree-wide cleanup commit
8fa7292fee5c on 5 Apr 2025, merged for Linux 6.15-rc1.)
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
|
|
ci: remove ubuntu 20 builds due to EOL of Standard Support
|
|
|
|
(workflows): Ubuntu 20.04 is deprecated, removing it
|
