Re: [lwip-devel] Announce: WireGuard implementation for lwIP

[address@hidden]

Hi,

Am 20.01.2021 um 05:53 schrieb - Neustradamus -:
> Hello Simon,
>
> Thanks for your reply!
>
> I have seen "The lwIP PPP support is based from pppd 2.4.5":
> - https://github.com/lwip-tcpip/lwip/blob/master/src/netif/ppp/PPPD_FOLLOWUP

Well, you only cite the first half sentence. Sylvain has been doing a
great job so far in ensuring actual bugfixes in upstream pppd are synced
to lwIP. So while we're not 100% in sync with upstream pppd (which does
not work as is, since it would require huge changes in their codebase to
allow running it in an embedded system - not Linux plus not a 'main' in
its own process), I'm pretty sure we don't have any bugs open that are
both fixed in upstream and affect our usage of ppp.

>
> PPP 2.4.5 (Nov 17, 2009, 11 years and 2 months) : 
> https://github.com/paulusmack/ppp/releases/tag/ppp-2.4.5
>
> CVEs but not only PPP from Paul here:
> - https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ppp

Actually we were involve in some of them. They are either fixed in our
codebase or don't apply to our usage of the code.

>
> Can you add PPP 2.4.9 which has since 2.4.5: CVE fixes, and improvements?

Which CVEs are you actually referring to that apply to lwIP's PPP? And
which improvements?

We can *not* just copy PPP 2.4.9 code. As written above, it relies on
being executed on Linux in its own process. It would have to get a big
restructuring for us to be able to just copy the code.

>
> In more, it is possible to add https://github.com/lwip-tcpip/lwip-contrib?
> A mirror of: https://git.savannah.nongnu.org/cgit/lwip/lwip-contrib.git/

No. The extra contrib repository is outdated (only valid for the 2.1.x
tree) and does not receive any more commits. No point in adding it to
github. The code has been moved the the 'contrib' directory in our main
git tree.

Regards,
Simon