From e2aa1c91a34745adca1a4805c8bb7e69e7f07023 Mon Sep 17 00:00:00 2001 From: Caeies Date: Mon, 1 Sep 2025 11:59:32 +0200 Subject: [PATCH 1/7] Tun: don't play with the route at the wrong time. --- src/io.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/io.c b/src/io.c index d3c61d30..8dc3d6ea 100644 --- a/src/io.c +++ b/src/io.c @@ -935,7 +935,6 @@ int ipcp_packet(struct tunnel *tunnel, void *packet, int len) } tun_ifup(tunnel->tun_iface, ip_address, peer_address); - ipv4_set_tunnel_routes(tunnel); break; } case IPCP_CONF_NAK: { From 6b2931853cb74f736b0fff22f9d52d9c963ad8be Mon Sep 17 00:00:00 2001 From: Caeies Date: Mon, 1 Sep 2025 16:18:15 +0200 Subject: [PATCH 2/7] Io: avoid shadowing variables. --- src/io.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/io.c b/src/io.c index 8dc3d6ea..ac7027dc 100644 --- a/src/io.c +++ b/src/io.c @@ -759,8 +759,8 @@ int ipcp_option_send(struct tunnel *tunnel, int id, int code, int ret = -1; if (optlist && optlist->head) { - uint8_t *packet = (uint8_t *)optlist->head; - struct ipcp_header *header = ((struct ipcp_header *)packet) - 1; + uint8_t *ppacket = (uint8_t *)optlist->head; + struct ipcp_header *header = ((struct ipcp_header *)ppacket) - 1; unsigned short *ppp_type = ((unsigned short *)header) - 1; const size_t hdrlen = sizeof(struct ipcp_header) + sizeof(uint16_t); const int len = conf_option_length(optlist); @@ -799,7 +799,7 @@ int ipcp_option_send(struct tunnel *tunnel, int id, int code, int ipcp_packet(struct tunnel *tunnel, void *packet, int len) { - int ret = 0; + int ret = -1; struct ipcp_header *header = packet; log_debug("packet %s\n", ipcp_code_name[header->code]); @@ -846,7 +846,6 @@ int ipcp_packet(struct tunnel *tunnel, void *packet, int len) co = (struct conf_option *)((uint8_t *)co + co->length); } if (header->code == IPCP_CONF_REQUEST) { - int ret = -1; ret = ipcp_option_send(tunnel, header->id, IPCP_CONF_ACK, &ack, 0); From 3c5a6c058b998bf37836651aa9d1fac89d850bdf Mon Sep 17 00:00:00 2001 From: Caeies Date: Mon, 1 Sep 2025 16:19:16 +0200 Subject: [PATCH 3/7] Io: fixes a missing call to free. * Thanks valgrind for pinning this out. --- src/io.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/io.c b/src/io.c index ac7027dc..e8fd48c7 100644 --- a/src/io.c +++ b/src/io.c @@ -1052,6 +1052,7 @@ int ipcp_packet(struct tunnel *tunnel, void *packet, int len) errno, strerror(errno)); exit(EXIT_FAILURE); } + conf_option_free(&request); } while (0); break; } From 6ee145f3c7ceb39841dc21c6dd8b4439bca0a7ae Mon Sep 17 00:00:00 2001 From: Caeies Date: Mon, 1 Sep 2025 16:22:13 +0200 Subject: [PATCH 4/7] Io: reduce hdlc_bufsize scope. --- src/io.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/io.c b/src/io.c index e8fd48c7..baa7632e 100644 --- a/src/io.c +++ b/src/io.c @@ -1232,7 +1232,7 @@ static void *pppd_write(void *arg) while (1) { struct ppp_packet *packet; - ssize_t hdlc_bufsize, len, n, written; + ssize_t len, n, written; uint8_t *hdlc_buffer; // This waits until a packet has arrived from the gateway @@ -1241,7 +1241,7 @@ static void *pppd_write(void *arg) if (tunnel->config->tun) { void *pkt_type = pkt_data(packet); - hdlc_bufsize = len = packet->len; + len = packet->len; switch (ntohs(*(uint16_t *)pkt_type)) { case PPP_LCP: lcp_packet(tunnel, pkt_data(packet) + 2, len - 2); @@ -1264,7 +1264,8 @@ static void *pppd_write(void *arg) memcpy(hdlc_buffer, pkt_data(packet) + 2, packet->len - 2); } else { - hdlc_bufsize = estimated_encoded_size(packet->len); + size_t hdlc_bufsize = estimated_encoded_size(packet->len); + hdlc_buffer = malloc(hdlc_bufsize); if (hdlc_buffer == NULL) { log_error("malloc: %s\n", strerror(errno)); From 161d64c30bd67623499aa37d5f85ba0eb35a5039 Mon Sep 17 00:00:00 2001 From: Caeies Date: Mon, 1 Sep 2025 16:23:24 +0200 Subject: [PATCH 5/7] Io: fixes missing packet free. * Thanks valgrind for pinning this out. --- src/io.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/io.c b/src/io.c index baa7632e..1604ad7b 100644 --- a/src/io.c +++ b/src/io.c @@ -1245,9 +1245,11 @@ static void *pppd_write(void *arg) switch (ntohs(*(uint16_t *)pkt_type)) { case PPP_LCP: lcp_packet(tunnel, pkt_data(packet) + 2, len - 2); + free(packet); continue; case PPP_IPCP: ipcp_packet(tunnel, pkt_data(packet) + 2, len - 2); + free(packet); continue; case PPP_IP: case PPP_IPV6: From 7663335c5c92e048738b2ae4d056b1330ce96bcd Mon Sep 17 00:00:00 2001 From: Caeies Date: Mon, 1 Sep 2025 16:24:50 +0200 Subject: [PATCH 6/7] Io: don't write garbage at the end of the stream. * Thanks valgrind for pinning this out. --- src/io.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/io.c b/src/io.c index 1604ad7b..51929298 100644 --- a/src/io.c +++ b/src/io.c @@ -1241,14 +1241,14 @@ static void *pppd_write(void *arg) if (tunnel->config->tun) { void *pkt_type = pkt_data(packet); - len = packet->len; + len = packet->len - 2; switch (ntohs(*(uint16_t *)pkt_type)) { case PPP_LCP: - lcp_packet(tunnel, pkt_data(packet) + 2, len - 2); + lcp_packet(tunnel, pkt_data(packet) + 2, len); free(packet); continue; case PPP_IPCP: - ipcp_packet(tunnel, pkt_data(packet) + 2, len - 2); + ipcp_packet(tunnel, pkt_data(packet) + 2, len); free(packet); continue; case PPP_IP: @@ -1258,13 +1258,13 @@ static void *pppd_write(void *arg) goto out_free_packet; } - hdlc_buffer = malloc(packet->len); + hdlc_buffer = malloc(len); if (hdlc_buffer == NULL) { log_error("malloc: %s\n", strerror(errno)); break; } - memcpy(hdlc_buffer, pkt_data(packet) + 2, packet->len - 2); + memcpy(hdlc_buffer, pkt_data(packet) + 2, len); } else { size_t hdlc_bufsize = estimated_encoded_size(packet->len); From 556a6618f5bfafd9aad28bf96ecef7ce4a182b2c Mon Sep 17 00:00:00 2001 From: Caeies Date: Mon, 1 Sep 2025 17:03:07 +0200 Subject: [PATCH 7/7] Http fixes potential null dereference. * NOTE: this might not works if we don't have the remote idea of our ip. * Let's try it with a fake local ip. * credits goes to coverity for this one. --- src/http.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/http.c b/src/http.c index 48f2ccf2..043b0b6c 100644 --- a/src/http.c +++ b/src/http.c @@ -875,7 +875,10 @@ static int parse_xml_config(struct tunnel *tunnel, const char *buffer) log_warn("No gateway address, using interface for routing\n"); if (tunnel->config->tun) { - tunnel->ipv4.ip_addr.s_addr = inet_addr(gateway); + if (!gateway) + tunnel->ipv4.ip_addr.s_addr = inet_addr("192.0.2.2"); + else + tunnel->ipv4.ip_addr.s_addr = inet_addr(gateway); tunnel->ipv4.peer_addr.s_addr = inet_addr("192.0.2.1"); }