From 6fbb4a900c17c28ecf2f6d0b620cfffe5bdd6b39 Mon Sep 17 00:00:00 2001 From: Denys Fedoryshchenko Date: Thu, 11 Dec 2025 00:59:51 +0200 Subject: pppoe: Fix RFC2516 non-compilance in PADI tags parsing We currently only break out of the switch, so the for loop keeps parsing tags after TAG_END_OF_LIST (accel-pppd/ctrl/pppoe/pppoe.c: around pppoe_recv_PADI). RFC 2516 (paragraph 5, Tag Types: End-of-List) says an End-of-List tag MAY appear in PADI/PADR and "any TAGs after an End-of-List MUST be ignored." Since we continue processing them, this behavior is technically non-compliant with the RFC. Same in pppoe_recv_PADR. Signed-off-by: Denys Fedoryshchenko --- accel-pppd/ctrl/pppoe/pppoe.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/accel-pppd/ctrl/pppoe/pppoe.c b/accel-pppd/ctrl/pppoe/pppoe.c index 93412b95..dfc79834 100644 --- a/accel-pppd/ctrl/pppoe/pppoe.c +++ b/accel-pppd/ctrl/pppoe/pppoe.c @@ -1017,7 +1017,7 @@ static void pppoe_recv_PADI(struct pppoe_serv_t *serv, uint8_t *pack, int size) return; switch (ntohs(tag->tag_type)) { case TAG_END_OF_LIST: - break; + goto tags_done; case TAG_SERVICE_NAME: if (tag->tag_len == 0 && conf_accept_blank_service) { service_match = 1; @@ -1048,6 +1048,7 @@ static void pppoe_recv_PADI(struct pppoe_serv_t *serv, uint8_t *pack, int size) break; } } +tags_done: if (conf_verbose) print_packet(serv->ifname, "recv", pack); @@ -1159,7 +1160,7 @@ static void pppoe_recv_PADR(struct pppoe_serv_t *serv, uint8_t *pack, int size) } switch (ntohs(tag->tag_type)) { case TAG_END_OF_LIST: - break; + goto padr_tags_done; case TAG_SERVICE_NAME: service_name_tag = tag; if (tag->tag_len == 0) @@ -1201,6 +1202,7 @@ static void pppoe_recv_PADR(struct pppoe_serv_t *serv, uint8_t *pack, int size) break; } } +padr_tags_done: if (!ac_cookie_tag) { if (conf_verbose) -- cgit v1.2.3