Skip to content

drivers/net/telnet: Ignore unsupported subnegotiation data #18590

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anchao merged 1 commit into from
Mar 25, 2026
+44 −9
Merged

drivers/net/telnet: Ignore unsupported subnegotiation data #18590

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 44 additions & 9 deletions drivers/net/telnet.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,8 +107,8 @@ enum telnet_state_e
STATE_DO,
STATE_DONT,
STATE_SB,
STATE_SB_NAWS,
STATE_SE
STATE_SB_DATA,
STATE_SB_NAWS
};

/* This structure describes the internal state of the driver */
Expand All @@ -118,6 +118,7 @@ struct telnet_dev_s
uint8_t td_state; /* (See telnet_state_e) */
uint8_t td_crefs; /* The number of open references to the session */
uint8_t td_minor; /* Minor device number */
bool td_sb_iac; /* Saw IAC within sub-negotiation payload */
uint16_t td_offset; /* Offset to the valid, pending bytes in the rxbuffer */
uint16_t td_pending; /* Number of valid, pending bytes in the rxbuffer */
#ifdef CONFIG_TELNET_SUPPORT_NAWS
Expand Down Expand Up @@ -372,16 +373,17 @@ static ssize_t telnet_receive(FAR struct telnet_dev_s *priv,
priv->td_state = STATE_DONT;
break;

#ifdef CONFIG_TELNET_SUPPORT_NAWS
case TELNET_SB:
priv->td_state = STATE_SB;
priv->td_sb_iac = false;
#ifdef CONFIG_TELNET_SUPPORT_NAWS
priv->td_sb_count = 0;
#endif
break;

case TELNET_SE:
priv->td_state = STATE_NORMAL;
break;
#endif

default:
priv->td_state = STATE_NORMAL;
Expand Down Expand Up @@ -458,25 +460,58 @@ static ssize_t telnet_receive(FAR struct telnet_dev_s *priv,
}
break;

#ifdef CONFIG_TELNET_SUPPORT_NAWS
/* Handle Telnet Sub negotiation request */
/* Handle Telnet sub-negotiation requests. */

case STATE_SB:
switch (ch)
{
#ifdef CONFIG_TELNET_SUPPORT_NAWS
case TELNET_NAWS:
priv->td_state = STATE_SB_NAWS;
break;
#endif

default:
priv->td_state = STATE_NORMAL;
priv->td_state = STATE_SB_DATA;
break;
}
break;

/* Ignore unsupported sub-negotiation payload until IAC SE. */

case STATE_SB_DATA:
if (priv->td_sb_iac)
{
priv->td_sb_iac = false;
if (ch == TELNET_SE)
{
priv->td_state = STATE_NORMAL;
}
}
else if (ch == TELNET_IAC)
{
priv->td_sb_iac = true;
}
break;

#ifdef CONFIG_TELNET_SUPPORT_NAWS
/* Handle NAWS sub-option negotiation */

case STATE_SB_NAWS:
if (priv->td_sb_iac)
{
priv->td_sb_iac = false;
if (ch == TELNET_SE)
{
priv->td_state = STATE_NORMAL;
break;
}
}
else if (ch == TELNET_IAC)
{
priv->td_sb_iac = true;
break;
}
Comment thread
cederom marked this conversation as resolved.

/* Update cols / rows based on received byte count */

Expand All @@ -500,11 +535,11 @@ static ssize_t telnet_receive(FAR struct telnet_dev_s *priv,
break;
}

/* Increment SB count and switch to NORMAL when complete */
/* Increment SB count and keep discarding until IAC SE. */

if (++priv->td_sb_count == 4)
{
priv->td_state = STATE_NORMAL;
priv->td_state = STATE_SB_DATA;
}

break;
Expand Down
Loading