Re: [lwip-devel] Announce: WireGuard implementation for lwIP

[- Neustradamus -]

Hello Simon,

Thanks for your reply!

I have seen "The lwIP PPP support is based from pppd 2.4.5":
- https://github.com/lwip-tcpip/lwip/blob/master/src/netif/ppp/PPPD_FOLLOWUP

PPP 2.4.5 (Nov 17, 2009, 11 years and 2 months) : 
https://github.com/paulusmack/ppp/releases/tag/ppp-2.4.5

CVEs but not only PPP from Paul here:
- https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ppp

Can you add PPP 2.4.9 which has since 2.4.5: CVE fixes, and improvements?

In more, it is possible to add https://github.com/lwip-tcpip/lwip-contrib?
A mirror of: https://git.savannah.nongnu.org/cgit/lwip/lwip-contrib.git/

Thanks in advance.

Regards,

Neustradamus
________________________________________
De : lwip-devel <lwip-devel-bounces+neustradamus=hotmail.com@nongnu.org> de la 
part de goldsimon@gmx.de <goldsimon@gmx.de>
Envoyé : mardi 19 janvier 2021 16:54
À : lwip-devel
Objet : Re: [lwip-devel] Announce: WireGuard implementation for lwIP

Am 19.01.2021 um 14:36 schrieb - Neustradamus -:
> Hello Daniel,
>
> Nice, good job!
> But there are no people here, I think :/

Well, it's true there has been not enough time for lwIP lately, but
you're probably being a bit pessimistic here...

>
> There are several CVEs...

Really? Which ones are you talking about?

>
> If you can update PPP to 2.4.9:
> - https://lists.nongnu.org/archive/html/lwip-users/2021-01/msg00001.html
> - https://lists.nongnu.org/archive/html/lwip-devel/2021-01/msg00004.html

Up to my knowledge (I'm not mainainting our ppp stack), these are false
positives. Our PPP stack started with pppd but has been forked from it
since long ago (since the upstream project was unresponsive at that
time). We have been informed early about the issues in pppd, and long
ago reported back that we are not affected.

Regards,
Simon

_______________________________________________
lwip-devel mailing list
lwip-devel@nongnu.org
https://lists.nongnu.org/mailman/listinfo/lwip-devel