From 6d73752ab1b4d937ac787c8f1206f3a857d61faf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Fri, 21 Feb 2020 17:34:33 +0100 Subject: [PATCH 01/57] New version Changed sources to github Dropped 0028-pppoe-include-netinet-in.h-before-linux-in.h, ppp-2.4.7-DES-openssl, ppp-2.4.7-honor-ldflags, ppp-2.4.7-coverity-scan-fixes patches (all upstreamed) Fixed buffer overflow in the eap_request and eap_response functions Resolves: CVE-2020-8597 --- .gitignore | 1 + ...clude-netinet-in.h-before-linux-in.h.patch | 35 -- ppp-2.4.7-DES-openssl.patch | 79 --- ppp-2.4.7-coverity-scan-fixes.patch | 453 ------------------ ppp-2.4.7-honor-ldflags.patch | 170 ------- ppp-2.4.8-CVE-2020-8597.patch | 37 ++ ...e-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch | 2 +- ...pile-pppol2tp-with-multilink-support.patch | 2 +- ...hardcode-LIBDIR-but-set-it-according.patch | 2 +- ...p-2.4.8-build-sys-enable-PAM-support.patch | 2 +- ...e-compiler-flags-handed-to-us-by-rpm.patch | 6 +- ...patch => ppp-2.4.8-eaptls-mppe-1.102.patch | 2 +- ...pp-2.4.8-everywhere-O_CLOEXEC-harder.patch | 4 +- ...pppd-binary-using-standard-perms-755.patch | 2 +- ....8-pppd-introduce-ipv6-accept-remote.patch | 6 +- ...-don-t-want-to-accidentally-leak-fds.patch | 2 +- ...-sys-linux-rework-get_first_ethernet.patch | 8 +- ppp.spec | 46 +- sources | 4 +- 19 files changed, 84 insertions(+), 779 deletions(-) delete mode 100644 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch delete mode 100644 ppp-2.4.7-DES-openssl.patch delete mode 100644 ppp-2.4.7-coverity-scan-fixes.patch delete mode 100644 ppp-2.4.7-honor-ldflags.patch create mode 100644 ppp-2.4.8-CVE-2020-8597.patch rename 0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch => ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch (96%) rename 0022-build-sys-compile-pppol2tp-with-multilink-support.patch => ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch (96%) rename 0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch => ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch (98%) rename 0002-build-sys-enable-PAM-support.patch => ppp-2.4.8-build-sys-enable-PAM-support.patch (97%) rename 0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch => ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch (97%) rename ppp-2.4.7-eaptls-mppe-1.102.patch => ppp-2.4.8-eaptls-mppe-1.102.patch (99%) rename 0013-everywhere-O_CLOEXEC-harder.patch => ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch (99%) rename 0025-pppd-install-pppd-binary-using-standard-perms-755.patch => ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch (91%) rename 0009-pppd-introduce-ipv6-accept-remote.patch => ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch (89%) rename 0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch => ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch (98%) rename 0019-sys-linux-rework-get_first_ethernet.patch => ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch (97%) diff --git a/.gitignore b/.gitignore index aa03936..94b2a80 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ ppp-2.4.5.tar.gz /ppp-2.4.6.tar.gz /ppp-watch.tar.xz /ppp-2.4.7.tar.gz +/ppp-2.4.8.tar.gz diff --git a/0028-pppoe-include-netinet-in.h-before-linux-in.h.patch b/0028-pppoe-include-netinet-in.h-before-linux-in.h.patch deleted file mode 100644 index 9b0920d..0000000 --- a/0028-pppoe-include-netinet-in.h-before-linux-in.h.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 33797aa193a2751da26f9af120e39c110defe4d1 Mon Sep 17 00:00:00 2001 -From: Lubomir Rintel -Date: Sat, 10 Dec 2016 19:53:56 +0100 -Subject: [PATCH] pppoe: include netinet/in.h before linux/in.h - -To fix build breakage. ---- - pppd/plugins/rp-pppoe/pppoe.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h -index 9ab2eee..f77f5b7 100644 ---- a/pppd/plugins/rp-pppoe/pppoe.h -+++ b/pppd/plugins/rp-pppoe/pppoe.h -@@ -15,6 +15,8 @@ - - #include "config.h" - -+#include -+ - #if defined(HAVE_NETPACKET_PACKET_H) || defined(HAVE_LINUX_IF_PACKET_H) - #define _POSIX_SOURCE 1 /* For sigaction defines */ - #endif -@@ -84,8 +86,6 @@ typedef unsigned long UINT32_t; - #include - #endif - --#include -- - #ifdef HAVE_NETINET_IF_ETHER_H - #include - --- -2.9.3 - diff --git a/ppp-2.4.7-DES-openssl.patch b/ppp-2.4.7-DES-openssl.patch deleted file mode 100644 index ad3b268..0000000 --- a/ppp-2.4.7-DES-openssl.patch +++ /dev/null @@ -1,79 +0,0 @@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 534ccc2..cf11b74 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -41,7 +41,7 @@ COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" - # Uncomment the next 2 lines to include support for Microsoft's - # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. - CHAPMS=y --USE_CRYPT=y -+#USE_CRYPT=y - # Don't use MSLANMAN unless you really know what you're doing. - #MSLANMAN=y - # Uncomment the next line to include support for MPPE. CHAPMS (above) must -@@ -147,7 +147,8 @@ endif - - ifdef NEEDDES - ifndef USE_CRYPT --LIBS += -ldes $(LIBS) -+CFLAGS += -I/usr/include/openssl -+LIBS += -lcrypto - else - CFLAGS += -DUSE_CRYPT=1 - endif -diff --git a/pppd/pppcrypt.c b/pppd/pppcrypt.c -index 8b85b13..6b35375 100644 ---- a/pppd/pppcrypt.c -+++ b/pppd/pppcrypt.c -@@ -64,7 +64,7 @@ u_char *des_key; /* OUT 64 bit DES key with parity bits added */ - des_key[7] = Get7Bits(key, 49); - - #ifndef USE_CRYPT -- des_set_odd_parity((des_cblock *)des_key); -+ DES_set_odd_parity((DES_cblock *)des_key); - #endif - } - -@@ -158,25 +158,25 @@ u_char *clear; /* OUT 8 octets */ - } - - #else /* USE_CRYPT */ --static des_key_schedule key_schedule; -+static DES_key_schedule key_schedule; - - bool - DesSetkey(key) - u_char *key; - { -- des_cblock des_key; -+ DES_cblock des_key; - MakeKey(key, des_key); -- des_set_key(&des_key, key_schedule); -+ DES_set_key(&des_key, &key_schedule); - return (1); - } - - bool --DesEncrypt(clear, key, cipher) -+DesEncrypt(clear, cipher) - u_char *clear; /* IN 8 octets */ - u_char *cipher; /* OUT 8 octets */ - { -- des_ecb_encrypt((des_cblock *)clear, (des_cblock *)cipher, -- key_schedule, 1); -+ DES_ecb_encrypt((DES_cblock *)clear, (DES_cblock *)cipher, -+ &key_schedule, 1); - return (1); - } - -@@ -185,8 +185,8 @@ DesDecrypt(cipher, clear) - u_char *cipher; /* IN 8 octets */ - u_char *clear; /* OUT 8 octets */ - { -- des_ecb_encrypt((des_cblock *)cipher, (des_cblock *)clear, -- key_schedule, 0); -+ DES_ecb_encrypt((DES_cblock *)cipher, (DES_cblock *)clear, -+ &key_schedule, 0); - return (1); - } - diff --git a/ppp-2.4.7-coverity-scan-fixes.patch b/ppp-2.4.7-coverity-scan-fixes.patch deleted file mode 100644 index 4f61a27..0000000 --- a/ppp-2.4.7-coverity-scan-fixes.patch +++ /dev/null @@ -1,453 +0,0 @@ -diff --git a/chat/chat.c b/chat/chat.c -index 710dba9..bf10733 100644 ---- a/chat/chat.c -+++ b/chat/chat.c -@@ -512,6 +512,7 @@ void msgf __V((const char *fmt, ...)) - syslog(LOG_INFO, "%s", line); - if (to_stderr) - fprintf(stderr, "%s\n", line); -+ va_end(args); - } - - /* -@@ -537,6 +538,7 @@ void fatal __V((int code, const char *fmt, ...)) - syslog(LOG_ERR, "%s", line); - if (to_stderr) - fprintf(stderr, "%s\n", line); -+ va_end(args); - terminate(code); - } - -diff --git a/pppd/auth.c b/pppd/auth.c -index 656ffe9..9a7e32d 100644 ---- a/pppd/auth.c -+++ b/pppd/auth.c -@@ -464,6 +464,7 @@ setupapfile(argv) - euid = geteuid(); - if (seteuid(getuid()) == -1) { - option_error("unable to reset uid before opening %s: %m", fname); -+ free(fname); - return 0; - } - ufile = fopen(fname, "re"); -@@ -471,6 +472,7 @@ setupapfile(argv) - fatal("unable to regain privileges: %m"); - if (ufile == NULL) { - option_error("unable to open user login data file %s", fname); -+ free(fname); - return 0; - } - check_access(ufile, fname); -@@ -481,6 +483,7 @@ setupapfile(argv) - || fgets(p, MAXSECRETLEN - 1, ufile) == NULL) { - fclose(ufile); - option_error("unable to read user login data file %s", fname); -+ free(fname); - return 0; - } - fclose(ufile); -@@ -502,6 +505,7 @@ setupapfile(argv) - explicit_passwd = 1; - } - -+ free(fname); - return (1); - } - -diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c -index 1b79abf..f7f42fd 100644 ---- a/pppd/eap-tls.c -+++ b/pppd/eap-tls.c -@@ -693,6 +693,7 @@ int eaptls_init_ssl_server(eap_state * esp) - } - - strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); -+ ets->peer[MAXWORDLEN - 1] = 0; - - dbglog( "getting eaptls secret" ); - if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, -@@ -780,7 +781,10 @@ int eaptls_init_ssl_client(eap_state * esp) - * verify - */ - if (esp->es_client.ea_peer) -+ { - strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); -+ ets->peer[MAXWORDLEN - 1] = 0; -+ } - else - ets->peer[0] = 0; - -@@ -835,7 +839,10 @@ int eaptls_init_ssl_client(eap_state * esp) - * ssl_verify_callback() - */ - if (servcertfile[0]) -+ { - strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); -+ ets->peercertfile[MAXWORDLEN - 1] = 0; -+ } - else - ets->peercertfile[0] = 0; - -diff --git a/pppd/multilink.c b/pppd/multilink.c -index 2f0ed50..67200ba 100644 ---- a/pppd/multilink.c -+++ b/pppd/multilink.c -@@ -445,9 +445,13 @@ get_default_epdisc(ep) - if (p != 0 && get_if_hwaddr(ep->value, p) >= 0) { - ep->class = EPD_MAC; - ep->length = 6; -+ free(p); - return 1; - } - -+ if (p) -+ free(p); -+ - /* see if our hostname corresponds to a reasonable IP address */ - hp = gethostbyname(hostname); - if (hp != NULL) { -diff --git a/pppd/options.c b/pppd/options.c -index 1cef314..bc264d6 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -1735,7 +1735,7 @@ user_unsetenv(argv) - option_error("unexpected = in name: %s", arg); - return 0; - } -- if (arg == '\0') { -+ if (*arg == '\0') { - option_error("missing variable name for unset"); - return 0; - } -diff --git a/pppd/plugins/pppol2tp/openl2tp.c b/pppd/plugins/pppol2tp/openl2tp.c -index 1099575..7c4fe8b 100644 ---- a/pppd/plugins/pppol2tp/openl2tp.c -+++ b/pppd/plugins/pppol2tp/openl2tp.c -@@ -246,6 +246,9 @@ out: - (*old_pppol2tp_ip_updown_hook)(tunnel_id, session_id, up); - } - -+ if (user_name != NULL) -+ free(user_name); -+ - return; - } - -diff --git a/pppd/plugins/radius/avpair.c b/pppd/plugins/radius/avpair.c -index 716d23f..ec48eb8 100644 ---- a/pppd/plugins/radius/avpair.c -+++ b/pppd/plugins/radius/avpair.c -@@ -121,7 +121,8 @@ VALUE_PAIR *rc_avpair_new (int attrid, void *pval, int len, int vendorcode) - if ((vp = (VALUE_PAIR *) malloc (sizeof (VALUE_PAIR))) - != (VALUE_PAIR *) NULL) - { -- strncpy (vp->name, pda->name, sizeof (vp->name)); -+ strncpy (vp->name, pda->name, NAME_LENGTH); -+ vp->name[NAME_LENGTH] = 0; - vp->attribute = attrid; - vp->vendorcode = vendorcode; - vp->next = (VALUE_PAIR *) NULL; -diff --git a/pppd/plugins/radius/config.c b/pppd/plugins/radius/config.c -index a29e5e8..6e36d89 100644 ---- a/pppd/plugins/radius/config.c -+++ b/pppd/plugins/radius/config.c -@@ -153,6 +153,7 @@ static int set_option_auo(char *filename, int line, OPTION *option, char *p) - *iptr = AUTH_RADIUS_FST; - else { - error("%s: auth_order: unknown keyword: %s", filename, p); -+ free(iptr); - return (-1); - } - -@@ -165,6 +166,7 @@ static int set_option_auo(char *filename, int line, OPTION *option, char *p) - *iptr = (*iptr) | AUTH_RADIUS_SND; - else { - error("%s: auth_order: unknown or unexpected keyword: %s", filename, p); -+ free(iptr); - return (-1); - } - } -@@ -272,7 +274,7 @@ char *rc_conf_str(char *optname) - - if (option == NULL) - fatal("rc_conf_str: unkown config option requested: %s", optname); -- return (char *)option->val; -+ return (char *)option->val; - } - - int rc_conf_int(char *optname) -diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c -index 4ba5f52..6f2a0bd 100644 ---- a/pppd/plugins/radius/radius.c -+++ b/pppd/plugins/radius/radius.c -@@ -898,7 +898,8 @@ radius_acct_start(void) - - rstate.start_time = time(NULL); - -- strncpy(rstate.session_id, rc_mksid(), sizeof(rstate.session_id)); -+ strncpy(rstate.session_id, rc_mksid(), MAXSESSIONID); -+ rstate.session_id[MAXSESSIONID] = 0; - - rc_avpair_add(&send, PW_ACCT_SESSION_ID, - rstate.session_id, 0, VENDOR_NONE); -diff --git a/pppd/plugins/radius/radiusclient.h b/pppd/plugins/radius/radiusclient.h -index 51b959a..cff0c26 100644 ---- a/pppd/plugins/radius/radiusclient.h -+++ b/pppd/plugins/radius/radiusclient.h -@@ -440,6 +440,7 @@ UINT4 rc_get_ipaddr __P((char *)); - int rc_good_ipaddr __P((char *)); - const char *rc_ip_hostname __P((UINT4)); - UINT4 rc_own_ipaddress __P((void)); -+UINT4 rc_own_bind_ipaddress __P((void)); - - - /* sendserver.c */ -diff --git a/pppd/plugins/radius/radrealms.c b/pppd/plugins/radius/radrealms.c -index 7a30370..cd006fd 100644 ---- a/pppd/plugins/radius/radrealms.c -+++ b/pppd/plugins/radius/radrealms.c -@@ -68,10 +68,12 @@ lookup_realm(char const *user, - - if ((fd = fopen(radrealms_config, "r")) == NULL) { - option_error("cannot open %s", radrealms_config); -+ free(auths); -+ free(accts); - return; -- } -+ } - info("Reading %s", radrealms_config); -- -+ - while ((fgets(buffer, sizeof(buffer), fd) != NULL)) { - line++; - -@@ -87,6 +89,8 @@ lookup_realm(char const *user, - fclose(fd); - option_error("%s: invalid line %d: %s", radrealms_config, - line, buffer); -+ free(auths); -+ free(accts); - return; - } - info("Parsing '%s' entry:", p); -@@ -101,6 +105,8 @@ lookup_realm(char const *user, - fclose(fd); - option_error("%s: realm name missing on line %d: %s", - radrealms_config, line, buffer); -+ free(auths); -+ free(accts); - return; - } - -@@ -111,6 +117,8 @@ lookup_realm(char const *user, - fclose(fd); - option_error("%s: server address missing on line %d: %s", - radrealms_config, line, buffer); -+ free(auths); -+ free(accts); - return; - } - s->name[s->max] = strdup(p); -@@ -119,6 +127,8 @@ lookup_realm(char const *user, - fclose(fd); - option_error("%s: server port missing on line %d: %s", - radrealms_config, line, buffer); -+ free(auths); -+ free(accts); - return; - } - s->port[s->max] = atoi(p); -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 5e06b52..5f79284 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -34,10 +34,10 @@ pppoe-discovery: pppoe-discovery.o debug.o common.o - $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev - - pppoe-discovery.o: pppoe-discovery.c -- $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c -+ $(CC) $(CFLAGS) -I../../.. -c -o pppoe-discovery.o pppoe-discovery.c - - debug.o: debug.c -- $(CC) $(CFLAGS) -c -o debug.o debug.c -+ $(CC) $(CFLAGS) -I../../.. -c -o debug.o debug.c - - rp-pppoe.so: plugin.o discovery.o if.o common.o - $(CC) $(LDFLAGS) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o -diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c -index 72aba41..50d5693 100644 ---- a/pppd/plugins/rp-pppoe/if.c -+++ b/pppd/plugins/rp-pppoe/if.c -@@ -133,7 +133,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - - /* Fill in hardware address */ - if (hwaddr) { -- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { - error("Can't get hardware address for %s: %m", ifname); - close(fd); -@@ -152,7 +153,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - } - - /* Sanity check on MTU */ -- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(fd, SIOCGIFMTU, &ifr) < 0) { - error("Can't get MTU for %s: %m", ifname); - } else if (ifr.ifr_mtu < ETH_DATA_LEN) { -@@ -166,7 +168,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - sa.sll_family = AF_PACKET; - sa.sll_protocol = htons(type); - -- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { - error("Could not get interface index for %s: %m", ifname); - close(fd); -diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c -index 24bdf8f..1856c6b 100644 ---- a/pppd/plugins/rp-pppoe/plugin.c -+++ b/pppd/plugins/rp-pppoe/plugin.c -@@ -153,7 +153,7 @@ PPPOEConnectDevice(void) - error("Can't get MTU for %s: %m", conn->ifName); - goto errout; - } -- strncpy(ifr.ifr_name, conn->ifName, sizeof(ifr.ifr_name)); -+ strlcpy(ifr.ifr_name, conn->ifName, sizeof(ifr.ifr_name)); - if (ioctl(s, SIOCGIFMTU, &ifr) < 0) { - error("Can't get MTU for %s: %m", conn->ifName); - close(s); -@@ -326,7 +326,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) - - /* Try getting interface index */ - if (r) { -- strncpy(ifr.ifr_name, cmd, sizeof(ifr.ifr_name)); -+ strlcpy(ifr.ifr_name, cmd, sizeof(ifr.ifr_name)); - if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { - r = 0; - } else { -@@ -345,7 +345,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) - /* Close socket */ - close(fd); - if (r && doit) { -- strncpy(devnam, cmd, sizeof(devnam)); -+ strlcpy(devnam, cmd, sizeof(devnam)); - if (the_channel != &pppoe_channel) { - - the_channel = &pppoe_channel; -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c -index 2bd910f..502e17f 100644 ---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c -@@ -177,7 +177,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - sa.sll_family = AF_PACKET; - sa.sll_protocol = htons(type); - -- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { - fatalSys("ioctl(SIOCFIGINDEX): Could not get interface index"); - } -diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h -index f77f5b7..6118e27 100644 ---- a/pppd/plugins/rp-pppoe/pppoe.h -+++ b/pppd/plugins/rp-pppoe/pppoe.h -@@ -24,6 +24,8 @@ - #include /* For FILE */ - #include /* For pid_t */ - -+#include "pppd/pppd.h" /* For error */ -+ - /* How do we access raw Ethernet devices? */ - #undef USE_LINUX_PACKET - #undef USE_BPF -diff --git a/pppd/plugins/winbind.c b/pppd/plugins/winbind.c -index bb05acd..4638f46 100644 ---- a/pppd/plugins/winbind.c -+++ b/pppd/plugins/winbind.c -@@ -432,6 +432,7 @@ unsigned int run_ntlm_auth(const char *username, - - /* parent */ - if (close(child_out[0]) == -1) { -+ close(child_in[1]); - notice("error closing pipe?!? for child OUT[0]"); - return NOT_AUTHENTICATED; - } -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 9a1d8a6..ef92486 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -2236,7 +2236,6 @@ int ppp_available(void) - } - } - -- close (s); - if (!ok) { - slprintf(route_buffer, sizeof(route_buffer), - "Sorry - PPP driver version %d.%d.%d is out of date\n", -@@ -2246,6 +2245,7 @@ int ppp_available(void) - } - } - } -+ close(s); - return ok; - } - -@@ -2722,7 +2722,10 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) - warn("Couldn't unlock pty slave %s: %m", pty_name); - #endif - if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) -+ { - warn("Couldn't open pty slave %s: %m", pty_name); -+ close(mfd); -+ } - } - } - #endif /* TIOCGPTN */ -@@ -3011,6 +3014,7 @@ ether_to_eui64(eui64_t *p_eui64) - if (get_first_ethernet(ð_dev) < 0) - { - warn("no ethernet device present on the host"); -+ close(skfd); - return 0; - } - -diff --git a/pppstats/pppstats.c b/pppstats/pppstats.c -index 6367988..4aaa319 100644 ---- a/pppstats/pppstats.c -+++ b/pppstats/pppstats.c -@@ -150,7 +150,8 @@ get_ppp_stats(curp) - #define ifr_name ifr__name - #endif - -- strncpy(req.ifr_name, interface, sizeof(req.ifr_name)); -+ strncpy(req.ifr_name, interface, IFNAMSIZ); -+ req.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(s, SIOCGPPPSTATS, &req) < 0) { - fprintf(stderr, "%s: ", progname); - if (errno == ENOTTY) -@@ -176,7 +177,8 @@ get_ppp_cstats(csp) - #define ifr_name ifr__name - #endif - -- strncpy(creq.ifr_name, interface, sizeof(creq.ifr_name)); -+ strncpy(creq.ifr_name, interface, IFNAMSIZ); -+ creq.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(s, SIOCGPPPCSTATS, &creq) < 0) { - fprintf(stderr, "%s: ", progname); - if (errno == ENOTTY) { -@@ -526,7 +528,8 @@ main(argc, argv) - #undef ifr_name - #define ifr_name ifr_ifrn.ifrn_name - #endif -- strncpy(ifr.ifr_name, interface, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, interface, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(s, SIOCGIFFLAGS, (caddr_t)&ifr) < 0) { - fprintf(stderr, "%s: nonexistent interface '%s' specified\n", - progname, interface); diff --git a/ppp-2.4.7-honor-ldflags.patch b/ppp-2.4.7-honor-ldflags.patch deleted file mode 100644 index 2c3e20d..0000000 --- a/ppp-2.4.7-honor-ldflags.patch +++ /dev/null @@ -1,170 +0,0 @@ -diff --git a/chat/Makefile.linux b/chat/Makefile.linux -index 2445637..83114f1 100644 ---- a/chat/Makefile.linux -+++ b/chat/Makefile.linux -@@ -18,7 +18,7 @@ INSTALL= install - all: chat - - chat: chat.o -- $(CC) -o chat chat.o -+ $(CC) $(LDFLAGS) -o chat chat.o - - chat.o: chat.c - $(CC) -c $(CFLAGS) -o chat.o chat.c -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index cf11b74..089f164 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -188,7 +188,7 @@ endif - - ifdef PLUGIN - CFLAGS += -DPLUGIN --LDFLAGS += -Wl,-E -+LDFLAGS_PLUGIN += -Wl,-E - LIBS += -ldl - endif - -@@ -230,7 +230,7 @@ install: pppd - $(INSTALL) -c -m 644 pppd.8 $(MANDIR) - - pppd: $(PPPDOBJS) -- $(CC) $(CFLAGS) $(LDFLAGS) -o pppd $(PPPDOBJS) $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) $(LDFLAGS_PLUGIN) -o pppd $(PPPDOBJS) $(LIBS) - - srp-entry: srp-entry.c - $(CC) $(CFLAGS) $(LDFLAGS) -o $@ srp-entry.c $(LIBS) -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index 303833a..04fe876 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -1,7 +1,7 @@ - #CC = gcc - COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I.. -I../../include -fPIC --LDFLAGS = -shared -+LDFLAGS_SHARED = -shared - INSTALL = install - - # EAP-TLS -@@ -33,7 +33,7 @@ all: $(PLUGINS) - for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done - - %.so: %.c -- $(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^ -+ $(CC) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED) $(CFLAGS) $^ - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../patchlevel.h) - -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 4c5826f..1961e0e 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -1,7 +1,7 @@ - #CC = gcc - COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC --LDFLAGS = -shared -+LDFLAGS_SHARED = -shared - INSTALL = install - - #*********************************************************************** -@@ -33,7 +33,7 @@ endif - all: $(PLUGIN) - - $(PLUGIN): $(PLUGIN_OBJS) -- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(LDFLAGS_SHARED) $^ $(LIBS) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index 9cb316d..7b23b25 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -1,7 +1,7 @@ - #CC = gcc - COPTS = $(RPM_OPT_FLAGS) -DHAVE_MULTILINK - CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC --LDFLAGS = -shared -+LDFLAGS_SHARED = -shared - INSTALL = install - - #*********************************************************************** -@@ -16,7 +16,7 @@ PLUGINS := pppol2tp.so openl2tp.so - all: $(PLUGINS) - - %.so: %.o -- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(LDFLAGS_SHARED) $^ $(LIBS) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 707326b..2150332 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -43,13 +43,13 @@ install: all - $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) - - radius.so: radius.o libradiusclient.a -- $(CC) -o radius.so -shared radius.o libradiusclient.a -+ $(CC) $(LDFLAGS) -o radius.so -shared radius.o libradiusclient.a - - radattr.so: radattr.o -- $(CC) -o radattr.so -shared radattr.o -+ $(CC) $(LDFLAGS) -o radattr.so -shared radattr.o - - radrealms.so: radrealms.o -- $(CC) -o radrealms.so -shared radrealms.o -+ $(CC) $(LDFLAGS) -o radrealms.so -shared radrealms.o - - CLIENTOBJS = avpair.o buildreq.o config.o dict.o ip_util.o \ - clientid.o sendserver.o lock.o util.o md5.o -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index fa49efb..5e06b52 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -31,7 +31,7 @@ CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' - all: rp-pppoe.so pppoe-discovery - - pppoe-discovery: pppoe-discovery.o debug.o common.o -- $(CC) -o pppoe-discovery pppoe-discovery.o debug.o -ludev -+ $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev - - pppoe-discovery.o: pppoe-discovery.c - $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c -@@ -40,7 +40,7 @@ debug.o: debug.c - $(CC) $(CFLAGS) -c -o debug.o debug.c - - rp-pppoe.so: plugin.o discovery.o if.o common.o -- $(CC) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o -+ $(CC) $(LDFLAGS) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux -index 95c6805..33e5107 100644 ---- a/pppdump/Makefile.linux -+++ b/pppdump/Makefile.linux -@@ -10,7 +10,7 @@ INSTALL= install - all: pppdump - - pppdump: $(OBJS) -- $(CC) -o pppdump $(OBJS) -+ $(CC) $(LDFLAGS) -o pppdump $(OBJS) - - clean: - rm -f pppdump $(OBJS) *~ -diff --git a/pppstats/Makefile.linux b/pppstats/Makefile.linux -index c5ba3b1..eeccf83 100644 ---- a/pppstats/Makefile.linux -+++ b/pppstats/Makefile.linux -@@ -26,7 +26,7 @@ install: pppstats - $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) - - pppstats: $(PPPSTATSRCS) -- $(CC) $(CFLAGS) -o pppstats pppstats.c $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) -o pppstats pppstats.c $(LIBS) - - clean: - rm -f pppstats *~ #* core diff --git a/ppp-2.4.8-CVE-2020-8597.patch b/ppp-2.4.8-CVE-2020-8597.patch new file mode 100644 index 0000000..5d7c51b --- /dev/null +++ b/ppp-2.4.8-CVE-2020-8597.patch @@ -0,0 +1,37 @@ +From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Mon, 3 Feb 2020 15:53:28 +1100 +Subject: [PATCH] pppd: Fix bounds check in EAP code + +Given that we have just checked vallen < len, it can never be the case +that vallen >= len + sizeof(rhostname). This fixes the check so we +actually avoid overflowing the rhostname array. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Paul Mackerras +--- + pppd/eap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/pppd/eap.c b/pppd/eap.c +index 94407f56..1b93db01 100644 +--- a/pppd/eap.c ++++ b/pppd/eap.c +@@ -1420,7 +1420,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; +@@ -1846,7 +1846,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch b/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch similarity index 96% rename from 0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch rename to ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch index 8340271..fd53ac7 100644 --- a/0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch +++ b/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch @@ -16,7 +16,7 @@ index 4339566..9a635b8 100644 -COPTS = -O2 -g +COPTS = $(RPM_OPT_FLAGS) CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install -- 1.8.3.1 diff --git a/0022-build-sys-compile-pppol2tp-with-multilink-support.patch b/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch similarity index 96% rename from 0022-build-sys-compile-pppol2tp-with-multilink-support.patch rename to ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch index 945933e..d801308 100644 --- a/0022-build-sys-compile-pppol2tp-with-multilink-support.patch +++ b/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch @@ -17,7 +17,7 @@ index 9a635b8..9cb316d 100644 -COPTS = $(RPM_OPT_FLAGS) +COPTS = $(RPM_OPT_FLAGS) -DHAVE_MULTILINK CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install -- 1.8.3.1 diff --git a/0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch similarity index 98% rename from 0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch rename to ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch index 48190ed..2d6bdd6 100644 --- a/0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch @@ -33,7 +33,7 @@ index 63872eb..8ed56c1 100644 -COPTS = -Wall $(RPM_OPT_FLAGS) +COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" - # Uncomment the next 2 lines to include support for Microsoft's + # Uncomment the next line to include support for Microsoft's # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. diff --git a/pppd/pathnames.h b/pppd/pathnames.h index a33f046..a427cb8 100644 diff --git a/0002-build-sys-enable-PAM-support.patch b/ppp-2.4.8-build-sys-enable-PAM-support.patch similarity index 97% rename from 0002-build-sys-enable-PAM-support.patch rename to ppp-2.4.8-build-sys-enable-PAM-support.patch index 2f1c53b..355410c 100644 --- a/0002-build-sys-enable-PAM-support.patch +++ b/ppp-2.4.8-build-sys-enable-PAM-support.patch @@ -12,7 +12,7 @@ index 1d9ea78..5a44d30 100644 --- a/pppd/Makefile.linux +++ b/pppd/Makefile.linux @@ -61,7 +61,7 @@ HAVE_MULTILINK=y - USE_TDB=y + #SYSTEMD=y HAS_SHADOW=y -#USE_PAM=y diff --git a/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch similarity index 97% rename from 0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch rename to ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch index 87da38b..dc0c5df 100644 --- a/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +++ b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch @@ -40,7 +40,7 @@ index 5a44d30..63872eb 100644 -LIBS = +COPTS = -Wall $(RPM_OPT_FLAGS) - # Uncomment the next 2 lines to include support for Microsoft's + # Uncomment the next line to include support for Microsoft's # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux index 0a7ec7b..e09a369 100644 @@ -51,7 +51,7 @@ index 0a7ec7b..e09a369 100644 -COPTS = -O2 -g +COPTS = $(RPM_OPT_FLAGS) CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux index 20f62e6..5a81447 100644 @@ -62,7 +62,7 @@ index 20f62e6..5a81447 100644 -COPTS = -O2 -g +COPTS = $(RPM_OPT_FLAGS) CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux index 24ed3e5..45b3b8d 100644 diff --git a/ppp-2.4.7-eaptls-mppe-1.102.patch b/ppp-2.4.8-eaptls-mppe-1.102.patch similarity index 99% rename from ppp-2.4.7-eaptls-mppe-1.102.patch rename to ppp-2.4.8-eaptls-mppe-1.102.patch index 598d1da..c594eba 100644 --- a/ppp-2.4.7-eaptls-mppe-1.102.patch +++ b/ppp-2.4.8-eaptls-mppe-1.102.patch @@ -3174,7 +3174,7 @@ diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/ppp --- ppp-2.4.7/pppd/plugins/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 +++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux 2018-10-30 16:47:59.539263095 +0100 @@ -4,6 +4,9 @@ - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install +# EAP-TLS diff --git a/0013-everywhere-O_CLOEXEC-harder.patch b/ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch similarity index 99% rename from 0013-everywhere-O_CLOEXEC-harder.patch rename to ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch index d720c36..87613af 100644 --- a/0013-everywhere-O_CLOEXEC-harder.patch +++ b/ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch @@ -146,9 +146,9 @@ index 8a12fa0..00a2cf5 100644 #endif - if ((sfd = open(pty_name, O_RDWR | O_NOCTTY)) < 0) + if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) + { warn("Couldn't open pty slave %s: %m", pty_name); - } - } + close(mfd); @@ -2592,10 +2592,10 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) for (i = 0; i < 64; ++i) { slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", diff --git a/0025-pppd-install-pppd-binary-using-standard-perms-755.patch b/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch similarity index 91% rename from 0025-pppd-install-pppd-binary-using-standard-perms-755.patch rename to ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch index 428d71a..bedb902 100644 --- a/0025-pppd-install-pppd-binary-using-standard-perms-755.patch +++ b/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch @@ -23,7 +23,7 @@ index 0e8107f..534ccc2 100644 + $(INSTALL) -c -m 644 pppd.8 $(MANDIR) pppd: $(PPPDOBJS) - $(CC) $(CFLAGS) $(LDFLAGS) -o pppd $(PPPDOBJS) $(LIBS) + $(CC) $(CFLAGS) $(LDFLAGS) $(LDFLAGS_PLUGIN) -o pppd $(PPPDOBJS) $(LIBS) -- 1.8.3.1 diff --git a/0009-pppd-introduce-ipv6-accept-remote.patch b/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch similarity index 89% rename from 0009-pppd-introduce-ipv6-accept-remote.patch rename to ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch index af0f015..eddef5b 100644 --- a/0009-pppd-introduce-ipv6-accept-remote.patch +++ b/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch @@ -19,8 +19,8 @@ index caa2b26..5a56c95 100644 + { "ipv6cp-accept-remote", o_bool, &ipv6cp_allowoptions[0].accept_remote, + "Accept peer's interface identifier for itself", 1 }, - { "ipv6cp-use-ipaddr", o_bool, &ipv6cp_allowoptions[0].use_ip, - "Use (default) IPv4 address as interface identifier", 1 }, + { "defaultroute6", o_bool, &ipv6cp_wantoptions[0].default_route, + "Add default IPv6 route", OPT_ENABLE|1, &ipv6cp_allowoptions[0].default_route }, @@ -437,6 +439,7 @@ ipv6cp_init(unit) memset(ao, 0, sizeof(*ao)); @@ -43,9 +43,9 @@ index cc4568d..8c7552e 100644 --- a/pppd/ipv6cp.h +++ b/pppd/ipv6cp.h @@ -150,7 +150,8 @@ - typedef struct ipv6cp_options { int neg_ifaceid; /* Negotiate interface identifier? */ int req_ifaceid; /* Ask peer to send interface identifier? */ + int default_route; /* Assign default route through interface? */ - int accept_local; /* accept peer's value for iface id? */ + int accept_local; /* accept peer's value for our iface id? */ + int accept_remote; /* accept peer's value for his iface id? */ diff --git a/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch b/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch similarity index 98% rename from 0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch rename to ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch index cf25dba..1b4a9cd 100644 --- a/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch +++ b/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch @@ -14,7 +14,7 @@ index 4271af6..9e957fa 100644 --- a/pppd/auth.c +++ b/pppd/auth.c @@ -428,7 +428,7 @@ setupapfile(argv) - option_error("unable to reset uid before opening %s: %m", fname); + free(fname); return 0; } - ufile = fopen(fname, "r"); diff --git a/0019-sys-linux-rework-get_first_ethernet.patch b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch similarity index 97% rename from 0019-sys-linux-rework-get_first_ethernet.patch rename to ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch index 9a8c3dd..780e068 100644 --- a/0019-sys-linux-rework-get_first_ethernet.patch +++ b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch @@ -68,12 +68,12 @@ index 9918091..b949716 100644 all: rp-pppoe.so pppoe-discovery -pppoe-discovery: pppoe-discovery.o debug.o -- $(CC) -o pppoe-discovery pppoe-discovery.o debug.o +- $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o +pppoe-discovery: pppoe-discovery.o debug.o common.o -+ $(CC) -o pppoe-discovery pppoe-discovery.o debug.o -ludev ++ $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev pppoe-discovery.o: pppoe-discovery.c - $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c + $(CC) $(CFLAGS) -I../../.. -c -o pppoe-discovery.o pppoe-discovery.c diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c index c0d927d..2bd910f 100644 --- a/pppd/plugins/rp-pppoe/pppoe-discovery.c @@ -111,7 +111,7 @@ index c0d927d..2bd910f 100644 conn->discoverySocket = -1; conn->sessionSocket = -1; @@ -722,3 +734,104 @@ void usage(void) - fprintf(stderr, "Usage: pppoe-discovery [options]\n"); + " -h -- Print usage information.\n"); fprintf(stderr, "\nVersion " RP_VERSION "\n"); } + diff --git a/ppp.spec b/ppp.spec index 97715b7..23b6229 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,13 +1,13 @@ %global _hardened_build 1 Name: ppp -Version: 2.4.7 -Release: 33%{?dist} +Version: 2.4.8 +Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp -Source0: ftp://ftp.samba.org/pub/ppp/ppp-%{version}.tar.gz +Source0: https://github.com/paulusmack/ppp/archive/ppp-%{version}.tar.gz Source1: ppp-pam.conf Source2: ppp-logrotate.conf Source3: ppp-tmpfiles.conf @@ -23,37 +23,32 @@ Source12: ppp-watch.tar.xz # Fedora-specific Patch0001: 0001-build-sys-use-gcc-as-our-compiler-of-choice.patch -Patch0002: 0002-build-sys-enable-PAM-support.patch -Patch0003: 0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +Patch0002: ppp-2.4.8-build-sys-enable-PAM-support.patch +Patch0003: ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch Patch0004: 0004-doc-add-configuration-samples.patch -Patch0005: 0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +Patch0005: ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch Patch0006: 0006-scritps-use-change_resolv_conf-function.patch Patch0007: 0007-build-sys-don-t-strip-binaries-during-installation.patch Patch0008: 0008-build-sys-use-prefix-usr-instead-of-usr-local.patch -Patch0009: 0009-pppd-introduce-ipv6-accept-remote.patch +Patch0009: ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch Patch0010: 0010-build-sys-enable-CBCP.patch Patch0011: 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch -Patch0012: 0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch -Patch0013: 0013-everywhere-O_CLOEXEC-harder.patch +Patch0012: ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch +Patch0013: ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch Patch0018: 0018-scritps-fix-ip-up.local-sample.patch -Patch0019: 0019-sys-linux-rework-get_first_ethernet.patch +Patch0019: ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch -Patch0021: 0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch -Patch0022: 0022-build-sys-compile-pppol2tp-with-multilink-support.patch +Patch0021: ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch +Patch0022: ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch -Patch0025: 0025-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: ppp-2.4.7-eaptls-mppe-1.102.patch -Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch +Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch +Patch0026: ppp-2.4.8-eaptls-mppe-1.102.patch -# rhbz#1556132 -Patch0029: ppp-2.4.7-DES-openssl.patch -# https://github.com/paulusmack/ppp/pull/95 -Patch0030: ppp-2.4.7-honor-ldflags.patch -Patch0031: ppp-2.4.7-coverity-scan-fixes.patch +Patch0032: ppp-2.4.8-CVE-2020-8597.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -87,7 +82,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release} This package contains the header files for building plugins for ppp. %prep -%setup -q +%setup -qn %{name}-%{name}-%{version} %autopatch -p1 tar -xJf %{SOURCE12} @@ -184,6 +179,15 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Feb 21 2020 Jaroslav Škarvada - 2.4.8-1 +- New version +- Changed sources to github +- Dropped 0028-pppoe-include-netinet-in.h-before-linux-in.h, + ppp-2.4.7-DES-openssl, ppp-2.4.7-honor-ldflags, + ppp-2.4.7-coverity-scan-fixes patches (all upstreamed) +- Fixed buffer overflow in the eap_request and eap_response functions + Resolves: CVE-2020-8597 + * Thu Jan 30 2020 Fedora Release Engineering - 2.4.7-33 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index 30dba5f..f30d28e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -78818f40e6d33a1d1de68a1551f6595a ppp-2.4.7.tar.gz -166cdfbce3391746fde60e86752c7bc7 ppp-watch.tar.xz +SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a +SHA512 (ppp-2.4.8.tar.gz) = a99b3b6c7bd80cd133bda4e29d33c793a76f3b67e1f8db774547e88932ce29564fad390a4f51d3fe30a75e006499b95000b042ae0f64cd360548426f8091a478 From 7a9494039d2d8e263f417f7e908e4cefcde5aaf5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Fri, 21 Feb 2020 17:39:51 +0100 Subject: [PATCH 02/57] Fixed buffer overflow in the eap_request and eap_response functions Resolves: CVE-2020-8597 --- ppp-2.4.7-CVE-2020-8597.patch | 37 +++++++++++++++++++++++++++++++++++ ppp.spec | 7 ++++++- 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.7-CVE-2020-8597.patch diff --git a/ppp-2.4.7-CVE-2020-8597.patch b/ppp-2.4.7-CVE-2020-8597.patch new file mode 100644 index 0000000..5d7c51b --- /dev/null +++ b/ppp-2.4.7-CVE-2020-8597.patch @@ -0,0 +1,37 @@ +From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Mon, 3 Feb 2020 15:53:28 +1100 +Subject: [PATCH] pppd: Fix bounds check in EAP code + +Given that we have just checked vallen < len, it can never be the case +that vallen >= len + sizeof(rhostname). This fixes the check so we +actually avoid overflowing the rhostname array. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Paul Mackerras +--- + pppd/eap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/pppd/eap.c b/pppd/eap.c +index 94407f56..1b93db01 100644 +--- a/pppd/eap.c ++++ b/pppd/eap.c +@@ -1420,7 +1420,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; +@@ -1846,7 +1846,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/ppp.spec b/ppp.spec index 97715b7..086b66e 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 33%{?dist} +Release: 34%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -54,6 +54,7 @@ Patch0029: ppp-2.4.7-DES-openssl.patch # https://github.com/paulusmack/ppp/pull/95 Patch0030: ppp-2.4.7-honor-ldflags.patch Patch0031: ppp-2.4.7-coverity-scan-fixes.patch +Patch0032: ppp-2.4.7-CVE-2020-8597.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -184,6 +185,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Feb 21 2020 Jaroslav Škarvada - 2.4.7-34 +- Fixed buffer overflow in the eap_request and eap_response functions + Resolves: CVE-2020-8597 + * Thu Jan 30 2020 Fedora Release Engineering - 2.4.7-33 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 47c6e80e42ed7360d59ea3abed79a4c810214096 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 26 Feb 2020 11:26:32 +0100 Subject: [PATCH 03/57] Fixed ghost directories verification --- ppp.spec | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/ppp.spec b/ppp.spec index 23b6229..fda59c0 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -127,6 +127,10 @@ install -d %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ install -p %{SOURCE10} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdown-ppp +# ghosts +mkdir -p %{buildroot}%{_rundir}/ppp +mkdir -p %{buildroot}%{_rundir}/lock/ppp + %pre /usr/bin/getent group dip >/dev/null 2>&1 || /usr/sbin/groupadd -r -g 40 dip >/dev/null 2>&1 || : @@ -157,8 +161,8 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %{_mandir}/man8/pppoe-discovery.8* %{_mandir}/man8/ppp-watch.8* %{_libdir}/pppd -%ghost %dir /run/ppp -%ghost %dir /run/lock/ppp +%ghost %dir %{_rundir}/ppp +%ghost %dir %{_rundir}/lock/ppp %dir %{_sysconfdir}/logrotate.d %attr(700, root, root) %dir %{_localstatedir}/log/ppp %config(noreplace) %{_sysconfdir}/ppp/eaptls-client @@ -179,6 +183,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Wed Feb 26 2020 Jaroslav Škarvada - 2.4.8-2 +- Fixed ghost directories verification + * Fri Feb 21 2020 Jaroslav Škarvada - 2.4.8-1 - New version - Changed sources to github From a5cfee84bdf2a1178e66b08302f12623e0573103 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Fri, 28 Feb 2020 02:37:01 +0000 Subject: [PATCH 04/57] Use make_build macro https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make --- ppp.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/ppp.spec b/ppp.spec index fda59c0..9c8f483 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 2%{?dist} +Release: 3%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -91,8 +91,8 @@ tar -xJf %{SOURCE12} export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" export RPM_LD_FLAGS="$LDFLAGS" %configure -make %{?_smp_mflags} LDFLAGS="%{?build_ldflags}" -make -C ppp-watch %{?_smp_mflags} LDFLAGS="%{?build_ldflags}" +%{make_build} LDFLAGS="%{?build_ldflags}" +%{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags}" %install make INSTROOT=%{buildroot} install install-etcppp @@ -183,6 +183,10 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Fri Feb 28 2020 Tom Stellard - 2.4.8-3 +- Use make_build macro +- https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make + * Wed Feb 26 2020 Jaroslav Škarvada - 2.4.8-2 - Fixed ghost directories verification From ad5e2374ccee99e11b6c942e635d775615a5093e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 6 Apr 2020 18:33:17 +0200 Subject: [PATCH 05/57] Updated EAP-TLS patch to v1.201 --- ...patch => ppp-2.4.8-eaptls-mppe-1.201.patch | 863 ++++++++++++++---- ppp.spec | 8 +- 2 files changed, 697 insertions(+), 174 deletions(-) rename ppp-2.4.8-eaptls-mppe-1.102.patch => ppp-2.4.8-eaptls-mppe-1.201.patch (78%) diff --git a/ppp-2.4.8-eaptls-mppe-1.102.patch b/ppp-2.4.8-eaptls-mppe-1.201.patch similarity index 78% rename from ppp-2.4.8-eaptls-mppe-1.102.patch rename to ppp-2.4.8-eaptls-mppe-1.201.patch index c594eba..ca3e872 100644 --- a/ppp-2.4.8-eaptls-mppe-1.102.patch +++ b/ppp-2.4.8-eaptls-mppe-1.201.patch @@ -1,7 +1,7 @@ -diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls ---- ppp-2.4.7/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls 2018-11-02 17:14:08.101636586 +0100 -@@ -0,0 +1,291 @@ +diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls +--- ppp-2.4.8/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls 2020-04-03 14:02:19.334905035 +0200 +@@ -0,0 +1,301 @@ +EAP-TLS authentication support for PPP +====================================== + @@ -293,9 +293,19 @@ diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls + - Print warning when certificate is either not yet valid or has expired. + - Perform better peer certificate checks. + - Allow certificate chain files to be used. -diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-client ---- ppp-2.4.7/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-client 2018-10-30 16:47:59.527263750 +0100 ++v1.200 (28-Feb-2020) ++ - First version of patch that was used to create a github PR against the main ppp code base. ++ - Add client-side 'capath' option to allow a directory with trusted CA certificates. ++ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or ++ use the ones supplied by OpenSSL. ++ - Code now also builds on Solaris (x86 tested) but has not been tested yet, as the Solaris ppp ++ kernel driver does not support MPPE. ++v1.201 (03-Apr-2020) ++ - Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that ++ you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation. +diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-client +--- ppp-2.4.8/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-client 2020-04-03 14:02:19.334905035 +0200 @@ -0,0 +1,10 @@ +# Parameters for authentication using EAP-TLS (client) + @@ -307,9 +317,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/e +# client private key file (required) + +#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-server ---- ppp-2.4.7/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-server 2018-10-30 16:47:59.527263750 +0100 +diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-server +--- ppp-2.4.8/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-server 2020-04-03 14:02:19.334905035 +0200 @@ -0,0 +1,11 @@ +# Parameters for authentication using EAP-TLS (server) + @@ -322,9 +332,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/e +# allowed addresses (required, can be *) + +#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/openssl.cnf ---- ppp-2.4.7/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/openssl.cnf 2018-10-30 16:47:59.527263750 +0100 +diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/openssl.cnf +--- ppp-2.4.8/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/openssl.cnf 2020-04-03 14:02:19.334905035 +0200 @@ -0,0 +1,14 @@ +openssl_conf = openssl_def + @@ -340,9 +350,9 @@ diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/ope +MODULE_PATH = /usr/lib64/libeTPkcs11.so +init = 0 + -diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.102/linux/Makefile.top ---- ppp-2.4.7/linux/Makefile.top 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/linux/Makefile.top 2018-10-30 16:47:59.528263707 +0100 +diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.201/linux/Makefile.top +--- ppp-2.4.8/linux/Makefile.top 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/linux/Makefile.top 2020-04-03 14:02:19.334905035 +0200 @@ -26,7 +26,7 @@ cd pppdump; $(MAKE) $(MFLAGS) install @@ -363,39 +373,134 @@ diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.102/linux/Makefi $(BINDIR): $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/pppd/Makefile.linux ---- ppp-2.4.7/pppd/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/Makefile.linux 2018-10-30 16:47:59.528263707 +0100 -@@ -76,6 +76,9 @@ +diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.linux +--- ppp-2.4.8/pppd/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.linux 2020-04-03 14:02:19.335905034 +0200 +@@ -11,16 +11,16 @@ + + TARGETS = pppd + +-PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c md5.c ccp.c \ +- ecp.c ipxcp.c auth.c options.c sys-linux.c md4.c chap_ms.c \ ++PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c ccp.c \ ++ ecp.c ipxcp.c auth.c options.c sys-linux.c chap_ms.c \ + demand.c utils.c tty.c eap.c chap-md5.c session.c + + HEADERS = ccp.h session.h chap-new.h ecp.h fsm.h ipcp.h \ +- ipxcp.h lcp.h magic.h md5.h patchlevel.h pathnames.h pppd.h \ ++ ipxcp.h lcp.h magic.h patchlevel.h pathnames.h pppd.h \ + upap.h eap.h + + MANPAGES = pppd.8 +-PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o md5.o ccp.o \ ++PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o ccp.o \ + ecp.o auth.o options.o demand.o utils.o sys-linux.o ipxcp.o tty.o \ + eap.o chap-md5.o session.o + +@@ -81,6 +81,13 @@ # Use libutil USE_LIBUTIL=y -+# Enable EAP-TLS authentication (requires libssl and libcrypto) ++# Enable EAP-TLS authentication (requires MPPE support, libssl and libcrypto) +USE_EAPTLS=y ++ ++# Either use the internal {md5,sha1} routines or use the openssl versions ++USE_OPENSSL_MD5=y ++USE_OPENSSL_SHA1=y + MAXOCTETS=y INCLUDE_DIRS= -I../include -@@ -115,6 +118,15 @@ - PPPDOBJS += sha1.o +@@ -92,8 +99,9 @@ + ifdef CHAPMS + CFLAGS += -DCHAPMS=1 + NEEDDES=y +-PPPDOBJS += md4.o chap_ms.o ++PPPDSRC += md4.c chap_ms.c + HEADERS += md4.h chap_ms.h ++PPPDOBJS += md4.o chap_ms.o + ifdef MSLANMAN + CFLAGS += -DMSLANMAN=1 endif - +@@ -111,11 +119,31 @@ + MANPAGES += srp-entry.8 + EXTRACLEAN += srp-entry.o + NEEDDES=y ++endif ++ +# EAP-TLS +ifdef USE_EAPTLS -+CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include ++CFLAGS += -DUSE_EAPTLS=1 +LIBS += -lssl -lcrypto +PPPDSRC += eap-tls.c +HEADERS += eap-tls.h +PPPDOBJS += eap-tls.o +endif + - ifdef HAS_SHADOW - CFLAGS += -DHAS_SHADOW - #LIBS += -lshadow $(LIBS) -diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c ---- ppp-2.4.7/pppd/auth.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c 2018-10-30 16:47:59.530263608 +0100 -@@ -109,6 +109,9 @@ ++ifdef USE_OPENSSL_MD5 ++CFLAGS += -DUSE_OPENSSL_MD5=1 ++LIBS += -lcrypto ++else ++PPPDSRC += md5.c ++HEADERS += md5.h ++PPPDOBJS += md5.o ++endif ++ ++ifdef USE_OPENSSL_SHA1 ++CFLAGS += -DUSE_OPENSSL_SHA1=1 ++LIBS += -lcrypto + else +-# OpenSSL has an integrated version of SHA-1, and its implementation +-# is incompatible with this local SHA-1 implementation. We must use +-# one or the other, not both. +-PPPDSRCS += sha1.c ++PPPDSRC += sha1.c + HEADERS += sha1.h + PPPDOBJS += sha1.o + endif +diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.sol2 +--- ppp-2.4.8/pppd/Makefile.sol2 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.sol2 2020-04-03 14:02:19.335905034 +0200 +@@ -5,10 +5,10 @@ + + include ../Makedefs.com + +-CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="@DESTDIR@"' ++CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="/usr/local"' + LIBS = -lsocket -lnsl + +-OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o md5.o \ ++OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o \ + tty.o ccp.o ecp.o auth.o options.o demand.o utils.o sys-solaris.o \ + chap-md5.o session.o + +@@ -37,7 +37,21 @@ + + # Uncomment to enable MS-CHAP + CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H +-OBJS += chap_ms.o pppcrypt.o md4.o sha1.o ++OBJS += chap_ms.o pppcrypt.o md4.o ++ ++# Uncomment to enable MPPE (in both CHAP and EAP-TLS) ++CFLAGS += -DMPPE ++ ++# Uncomment to use the OpenSSL {md5,sha1} routines ++#CFLAGS += -DUSE_OPENSSL_MD5 -DUSE_OPENSSL_SHA1 ++#LIBS += -lcrypto ++# else ++OBJS += md5.o sha1.o ++ ++# Uncomment to enable EAP-TLS ++CFLAGS += -DUSE_EAPTLS ++LIBS += -lcrypto -lssl ++OBJS += eap-tls.o + + # Uncomment for CBCP + #CFLAGS += -DCBCP_SUPPORT +diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c +--- ppp-2.4.8/pppd/auth.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c 2020-04-03 14:02:19.337905032 +0200 +@@ -113,6 +113,9 @@ #include "upap.h" #include "chap-new.h" #include "eap.h" @@ -405,7 +510,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c #ifdef CBCP_SUPPORT #include "cbcp.h" #endif -@@ -183,6 +186,11 @@ +@@ -186,6 +189,11 @@ /* Hook for a plugin to get the CHAP password for authenticating us */ int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; @@ -417,12 +522,13 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c /* Hook for a plugin to say whether it is OK if the peer refuses to authenticate. */ int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -238,6 +246,14 @@ +@@ -241,6 +249,15 @@ bool explicit_user = 0; /* Set if "user" option supplied */ bool explicit_passwd = 0; /* Set if "password" option supplied */ char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ +#ifdef USE_EAPTLS +char *cacert_file = NULL; /* CA certificate file (pem format) */ ++char *ca_path = NULL; /* directory with CA certificates */ +char *cert_file = NULL; /* client certificate file (pem format) */ +char *privkey_file = NULL; /* client private key file (pem format) */ +char *crl_dir = NULL; /* directory containing CRL files */ @@ -432,7 +538,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c static char *uafname; /* name of most recent +ua file */ -@@ -254,6 +270,19 @@ +@@ -257,6 +274,19 @@ static int have_chap_secret __P((char *, char *, int, int *)); static int have_srp_secret __P((char *client, char *server, int need_ip, int *lacks_ipp)); @@ -452,12 +558,13 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); static int scan_authfile __P((FILE *, char *, char *, char *, struct wordlist **, struct wordlist **, -@@ -401,6 +430,15 @@ +@@ -404,6 +434,16 @@ "Set telephone number(s) which are allowed to connect", OPT_PRIV | OPT_A2LIST }, +#ifdef USE_EAPTLS + { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, ++ { "capath", o_string, &ca_path, "EAP-TLS CA certificate directory" }, + { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, + { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, + { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, @@ -468,7 +575,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c { NULL } }; -@@ -730,6 +768,9 @@ +@@ -737,6 +777,9 @@ lcp_options *wo = &lcp_wantoptions[unit]; lcp_options *go = &lcp_gotoptions[unit]; lcp_options *ho = &lcp_hisoptions[unit]; @@ -478,7 +585,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c int i; struct protent *protp; -@@ -764,6 +805,22 @@ +@@ -771,6 +814,22 @@ } } @@ -501,7 +608,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c new_phase(PHASE_AUTHENTICATE); auth = 0; if (go->neg_eap) { -@@ -1277,6 +1334,15 @@ +@@ -1291,6 +1350,15 @@ our_name, 1, &lacks_ip); } @@ -517,7 +624,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c if (auth_required && !can_auth && noauth_addrs == NULL) { if (default_auth) { option_error( -@@ -1331,7 +1397,11 @@ +@@ -1345,7 +1413,11 @@ passwd[0] != 0 || (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, (explicit_remote? remote_name: NULL), 0, NULL))) || @@ -530,7 +637,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c hadchap = -1; if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1346,8 +1416,14 @@ +@@ -1360,8 +1432,14 @@ !have_chap_secret((explicit_remote? remote_name: NULL), our_name, 1, NULL))) && !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, @@ -546,7 +653,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c } -@@ -1707,6 +1783,7 @@ +@@ -1721,6 +1799,7 @@ } @@ -554,7 +661,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c /* * get_secret - open the CHAP secret file and return the secret * for authenticating the given client on the given server. -@@ -2359,3 +2436,335 @@ +@@ -2373,3 +2452,345 @@ auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); } @@ -631,7 +738,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + else if (server != NULL && server[0] == 0) + server = NULL; + -+ if (cacert_file && cert_file && privkey_file) ++ if ((cacert_file || ca_path) && cert_file && privkey_file) + return 1; + + filename = _PATH_EAPTLSCLIFILE; @@ -823,13 +930,14 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + +int +get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, am_server) ++ cacertfile, capath, pkfile, am_server) + int unit; + char *client; + char *server; + char *clicertfile; + char *servcertfile; + char *cacertfile; ++ char *capath; + char *pkfile; + int am_server; +{ @@ -839,13 +947,22 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + struct wordlist *addrs = NULL; + struct wordlist *opts = NULL; + -+ /* in client mode the ca+cert+privkey can also be specified as options */ -+ if (!am_server && cacert_file && cert_file && privkey_file ) ++ /* maybe overkill, but it eases debugging */ ++ bzero(clicertfile, MAXWORDLEN); ++ bzero(servcertfile, MAXWORDLEN); ++ bzero(cacertfile, MAXWORDLEN); ++ bzero(capath, MAXWORDLEN); ++ bzero(pkfile, MAXWORDLEN); ++ ++ /* the ca+cert+privkey can also be specified as options */ ++ if (!am_server && (cacert_file || ca_path) && cert_file && privkey_file ) + { + strlcpy( clicertfile, cert_file, MAXWORDLEN ); -+ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); ++ if (cacert_file) ++ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); ++ if (ca_path) ++ strlcpy( capath, ca_path, MAXWORDLEN ); + strlcpy( pkfile, privkey_file, MAXWORDLEN ); -+ servcertfile[0] = '\0'; + } + else + { @@ -890,10 +1007,10 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c +} +#endif + -diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c ---- ppp-2.4.7/pppd/ccp.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c 2018-10-30 16:47:59.531263554 +0100 -@@ -540,6 +540,9 @@ +diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c +--- ppp-2.4.8/pppd/ccp.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c 2020-04-03 14:02:19.337905032 +0200 +@@ -539,6 +539,9 @@ if (go->mppe) { ccp_options *ao = &ccp_allowoptions[f->unit]; int auth_mschap_bits = auth_done[f->unit]; @@ -903,7 +1020,7 @@ diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c int numbits; /* -@@ -567,8 +570,23 @@ +@@ -566,8 +569,23 @@ lcp_close(f->unit, "MPPE required but not available"); return; } @@ -928,28 +1045,68 @@ diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c lcp_close(f->unit, "MPPE required but not available"); return; } -diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.102/pppd/chap-md5.c ---- ppp-2.4.7/pppd/chap-md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/chap-md5.c 2018-10-30 16:47:59.532263499 +0100 +diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c +--- ppp-2.4.8/pppd/chap-md5.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c 2020-04-03 14:02:19.337905032 +0200 @@ -36,7 +36,11 @@ #include "chap-new.h" #include "chap-md5.h" #include "magic.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" ++#ifdef USE_OPENSSL_MD5 ++#include "openssl/md5.h" +#else #include "md5.h" -+#endif /* USE_EAPTLS */ ++#endif /* USE_OPENSSL_MD5 */ #define MD5_HASH_SIZE 16 #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c ---- ppp-2.4.7/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c 2018-11-02 16:53:05.996742547 +0100 -@@ -0,0 +1,1383 @@ +diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c +--- ppp-2.4.8/pppd/chap_ms.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c 2020-04-03 14:02:19.338905030 +0200 +@@ -534,7 +534,7 @@ + char *username, u_char Challenge[8]) + + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char sha1Hash[SHA1_SIGNATURE_SIZE]; + char *user; + +@@ -670,7 +670,7 @@ + 0x6E }; + + int i; +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char Digest[SHA1_SIGNATURE_SIZE]; + u_char Challenge[8]; + +@@ -724,7 +724,7 @@ + void + mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + + SHA1_Init(&sha1Context); +@@ -768,7 +768,7 @@ + mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], + u_char NTResponse[24], int IsServer) + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + +diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +--- ppp-2.4.8/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c 2020-04-03 14:02:19.338905030 +0200 +@@ -0,0 +1,1442 @@ +/* * eap-tls.c - EAP-TLS implementation for PPP + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * Jan Just Keijser 2006-2019 All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions @@ -978,6 +1135,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + */ + +#include ++#include +#include +#include +#include @@ -1001,10 +1159,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c +static ENGINE *cert_engine = NULL; +static ENGINE *pkey_engine = NULL; + -+#ifdef MPPE -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ +/* + * The following stuff is only needed if SSL_export_keying_material() is not available + */ @@ -1178,9 +1332,41 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + +#define SSL3_RT_HEADER 0x100 + ++#ifndef SSL_CTX_set_max_proto_version ++/** Mimics SSL_CTX_set_max_proto_version for OpenSSL < 1.1 */ ++static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) ++{ ++ long sslopt = 0; ++ ++ if (tls_ver_max < TLS1_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1; ++ } ++#ifdef SSL_OP_NO_TLSv1_1 ++ if (tls_ver_max < TLS1_1_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1_1; ++ } ++#endif ++#ifdef SSL_OP_NO_TLSv1_2 ++ if (tls_ver_max < TLS1_2_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1_2; ++ } ++#endif ++ SSL_CTX_set_options(ctx, sslopt); ++ ++ return 1; ++} ++#endif /* SSL_CTX_set_max_proto_version */ ++ +#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + + ++#ifdef MPPE ++ ++#define EAPTLS_MPPE_KEY_LEN 32 ++ +/* + * Generate keys according to RFC 2716 and add to reply + */ @@ -1220,7 +1406,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + mppe_keys_set = 1; +} + -+#endif ++#endif /* MPPE */ + +void log_ssl_errors( void ) +{ @@ -1327,7 +1513,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + * Initialize the SSL stacks and tests if certificates, key and crl + * for client or server use can be loaded. + */ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, + char *certfile, char *peer_certfile, char *privkeyfile) +{ + char *cert_engine_name = NULL; @@ -1340,25 +1526,32 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + X509_LOOKUP *lookup; + X509 *tmp; + int ret; ++#if defined(TLS1_2_VERSION) ++ long tls_version = TLS1_2_VERSION; ++#elif defined(TLS1_1_VERSION) ++ long tls_version = TLS1_1_VERSION; ++#else ++ long tls_version = TLS1_VERSION; ++#endif + + /* + * Without these can't continue + */ -+ if (!cacertfile[0]) ++ if (!(cacertfile[0] || capath[0])) + { -+ error("EAP-TLS: CA certificate missing"); ++ error("EAP-TLS: CA certificate file or path missing"); + return NULL; + } + + if (!certfile[0]) + { -+ error("EAP-TLS: User certificate missing"); ++ error("EAP-TLS: Certificate missing"); + return NULL; + } + + if (!privkeyfile[0]) + { -+ error("EAP-TLS: User private key missing"); ++ error("EAP-TLS: Private key missing"); + return NULL; + } + @@ -1458,9 +1651,14 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + SSL_CTX_set_default_passwd_cb (ctx, password_callback); + -+ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) ++ if (strlen(cacertfile) == 0) cacertfile = NULL; ++ if (strlen(capath) == 0) capath = NULL; ++ ++ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, capath)) + { -+ error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); ++ error("EAP-TLS: Cannot load verify locations"); ++ if (cacertfile) dbglog("CA certificate file = [%s]", cacertfile); ++ if (capath) dbglog("CA certificate path = [%s]", capath); + goto fail; + } + @@ -1583,6 +1781,9 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c +#endif + ); + ++ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); ++ SSL_CTX_set_max_proto_version(ctx, tls_version); ++ + SSL_CTX_set_verify_depth(ctx, 5); + SSL_CTX_set_verify(ctx, + SSL_VERIFY_PEER | @@ -1685,6 +1886,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + char servcertfile[MAXWORDLEN]; + char clicertfile[MAXWORDLEN]; + char cacertfile[MAXWORDLEN]; ++ char capath[MAXWORDLEN]; + char pkfile[MAXWORDLEN]; + /* + * Allocate new eaptls session @@ -1704,7 +1906,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog( "getting eaptls secret" ); + if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, + esp->es_server.ea_name, clicertfile, -+ servcertfile, cacertfile, pkfile, 1)) { ++ servcertfile, cacertfile, capath, pkfile, 1)) { + error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", + esp->es_server.ea_peer, esp->es_server.ea_name ); + return 0; @@ -1712,7 +1914,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + ets->mtu = eaptls_get_mtu(esp->es_unit); + -+ ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); ++ ets->ctx = eaptls_init_ssl(1, cacertfile, capath, servcertfile, clicertfile, pkfile); + if (!ets->ctx) + goto fail; + @@ -1772,6 +1974,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + char servcertfile[MAXWORDLEN]; + char clicertfile[MAXWORDLEN]; + char cacertfile[MAXWORDLEN]; ++ char capath[MAXWORDLEN]; + char pkfile[MAXWORDLEN]; + + /* @@ -1796,14 +1999,14 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog( "calling get_eaptls_secret" ); + if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, + ets->peer, clicertfile, -+ servcertfile, cacertfile, pkfile, 0)) { ++ servcertfile, cacertfile, capath, pkfile, 0)) { + error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", + esp->es_client.ea_name, ets->peer ); + return 0; + } + + dbglog( "calling eaptls_init_ssl" ); -+ ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); ++ ets->ctx = eaptls_init_ssl(0, cacertfile, capath, clicertfile, servcertfile, pkfile); + if (!ets->ctx) + goto fail; + @@ -2255,6 +2458,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + strcat(string, "ChangeCipherSpec"); + break; + ++#ifdef SSL3_RT_INNER_CONTENT_TYPE ++ case SSL3_RT_INNER_CONTENT_TYPE: ++ strcat(string, "InnerContentType (TLS1.3)"); ++ break; ++#endif ++ + case SSL3_RT_HANDSHAKE: + + strcat(string, "Handshake: "); @@ -2309,6 +2518,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + case TLS1_2_VERSION: + strcat(string, "TLS 1.2"); + break; ++#ifdef TLS1_3_VERSION ++ case TLS1_3_VERSION: ++ strcat(string, "TLS 1.3 (not supported)"); ++ break; ++#endif ++ + default: + strcat(string, "Unknown version"); + } @@ -2330,14 +2545,15 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog("%s", string); +} + -diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h ---- ppp-2.4.7/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h 2018-10-30 16:47:59.534263383 +0100 +diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h +--- ppp-2.4.8/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h 2020-04-03 14:02:19.338905030 +0200 @@ -0,0 +1,107 @@ +/* + * eap-tls.h + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * Jan Just Keijser 2006-2019 All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions @@ -2372,7 +2588,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h + +#include +#include -+#include + +#define EAP_TLS_FLAGS_LI 128 /* length included flag */ +#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ @@ -2416,7 +2631,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h +X509 *get_X509_from_file(char *filename); +int ssl_cmp_certs(char *filename, X509 * a); + -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, + char *certfile, char *peer_certfile, char *privkeyfile); +int eaptls_init_ssl_server(eap_state * esp); +int eaptls_init_ssl_client(eap_state * esp); @@ -2428,7 +2643,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h + +int get_eaptls_secret(int unit, char *client, char *server, + char *clicertfile, char *servcertfile, char *cacertfile, -+ char *pkfile, int am_server); ++ char *capath, char *pkfile, int am_server); + +#ifdef MPPE +#include "mppe.h" /* MPPE_MAX_KEY_LEN */ @@ -2441,9 +2656,9 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h +#endif + +#endif -diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c ---- ppp-2.4.7/pppd/eap.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c 2018-10-30 16:47:59.537263209 +0100 +diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c +--- ppp-2.4.8/pppd/eap.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c 2020-04-03 14:02:19.339905029 +0200 @@ -43,6 +43,11 @@ * Based on draft-ietf-pppext-eap-srp-03.txt. */ @@ -2462,15 +2677,30 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #include "pathnames.h" -#include "md5.h" #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" ++#ifdef USE_OPENSSL_MD5 ++#include "openssl/md5.h" +#else +#include "md5.h" -+#endif /* USE_EAPTLS */ ++#endif /* USE_OPENSSL_MD5 */ #ifdef USE_SRP #include -@@ -209,6 +218,9 @@ +@@ -72,8 +81,12 @@ + #include "pppcrypt.h" + #endif /* USE_SRP */ + +-#ifndef SHA_DIGESTSIZE +-#define SHA_DIGESTSIZE 20 ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#endif /* USE_EAPTLS */ ++ ++#ifndef SHA_DIGEST_LENGTH ++#define SHA_DIGEST_LENGTH 20 + #endif + + +@@ -208,6 +221,9 @@ esp->es_server.ea_id = (u_char)(drand48() * 0x100); esp->es_client.ea_timeout = EAP_DEFREQTIME; esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; @@ -2480,7 +2710,18 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c } /* -@@ -436,8 +448,16 @@ +@@ -316,8 +332,8 @@ + { + struct tm *tp; + char tbuf[9]; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + time_t reftime; + + if (pn_secret == NULL) +@@ -435,8 +451,16 @@ u_char vals[2]; struct b64state bs; #endif /* USE_SRP */ @@ -2497,7 +2738,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c switch (esp->es_server.ea_state) { case eapBadAuth: return; -@@ -562,9 +582,79 @@ +@@ -561,9 +585,79 @@ break; } #endif /* USE_SRP */ @@ -2577,7 +2818,20 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case eapSRP1: #ifdef USE_SRP ts = (struct t_server *)esp->es_server.ea_session; -@@ -718,6 +808,30 @@ +@@ -647,10 +741,10 @@ + char *str; + #ifdef USE_SRP + struct t_server *ts; +- u_char clear[8], cipher[8], dig[SHA_DIGESTSIZE], *optr, *cp; ++ u_char clear[8], cipher[8], dig[SHA_DIGEST_LENGTH], *optr, *cp; + int i, j; + struct b64state b64; +- SHA1_CTX ctxt; ++ SHA_CTX ctxt; + #endif /* USE_SRP */ + + /* Handle both initial auth and restart */ +@@ -717,6 +811,30 @@ INCPTR(esp->es_server.ea_namelen, outp); break; @@ -2608,7 +2862,48 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP case eapSRP1: PUTCHAR(EAPT_SRP, outp); -@@ -904,11 +1018,57 @@ +@@ -763,8 +881,8 @@ + PUTLONG(SRPVAL_EBIT, outp); + ts = (struct t_server *)esp->es_server.ea_session; + assert(ts != NULL); +- BCOPY(t_serverresponse(ts), outp, SHA_DIGESTSIZE); +- INCPTR(SHA_DIGESTSIZE, outp); ++ BCOPY(t_serverresponse(ts), outp, SHA_DIGEST_LENGTH); ++ INCPTR(SHA_DIGEST_LENGTH, outp); + + if (pncrypt_setkey(0)) { + /* Generate pseudonym */ +@@ -804,9 +922,9 @@ + /* Set length and pad out to next 20 octet boundary */ + i = outp - optr - 1; + *optr = i; +- i %= SHA_DIGESTSIZE; ++ i %= SHA_DIGEST_LENGTH; + if (i != 0) { +- while (i < SHA_DIGESTSIZE) { ++ while (i < SHA_DIGEST_LENGTH) { + *outp++ = drand48() * 0x100; + i++; + } +@@ -822,14 +940,14 @@ + while (optr < outp) { + SHA1Final(dig, &ctxt); + cp = dig; +- while (cp < dig + SHA_DIGESTSIZE) ++ while (cp < dig + SHA_DIGEST_LENGTH) + *optr++ ^= *cp++; + SHA1Init(&ctxt); + SHA1Update(&ctxt, &esp->es_server.ea_id, 1); + SHA1Update(&ctxt, esp->es_server.ea_skey, + SESSION_KEY_LEN); +- SHA1Update(&ctxt, optr - SHA_DIGESTSIZE, +- SHA_DIGESTSIZE); ++ SHA1Update(&ctxt, optr - SHA_DIGEST_LENGTH, ++ SHA_DIGEST_LENGTH); + } + } + break; +@@ -903,11 +1021,57 @@ eap_server_timeout(arg) void *arg; { @@ -2666,7 +2961,20 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c /* EAP ID number must not change on timeout. */ eap_send_request(esp); } -@@ -1166,6 +1326,81 @@ +@@ -1154,17 +1318,92 @@ + PUTCHAR(id, outp); + esp->es_client.ea_id = id; + msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) + +- SHA_DIGESTSIZE; ++ SHA_DIGEST_LENGTH; + PUTSHORT(msglen, outp); + PUTCHAR(EAPT_SRP, outp); + PUTCHAR(EAPSRP_CVALIDATOR, outp); + PUTLONG(flags, outp); +- BCOPY(str, outp, SHA_DIGESTSIZE); ++ BCOPY(str, outp, SHA_DIGEST_LENGTH); + + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen); } #endif /* USE_SRP */ @@ -2748,7 +3056,44 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c static void eap_send_nak(esp, id, type) eap_state *esp; -@@ -1320,6 +1555,11 @@ +@@ -1251,8 +1490,8 @@ + { + u_char val; + u_char *datp, *digp; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + int dsize, fd, olen = len; + + /* +@@ -1261,21 +1500,21 @@ + */ + val = id; + while (len > 0) { +- if ((dsize = len % SHA_DIGESTSIZE) == 0) +- dsize = SHA_DIGESTSIZE; ++ if ((dsize = len % SHA_DIGEST_LENGTH) == 0) ++ dsize = SHA_DIGEST_LENGTH; + len -= dsize; + datp = inp + len; + SHA1Init(&ctxt); + SHA1Update(&ctxt, &val, 1); + SHA1Update(&ctxt, esp->es_client.ea_skey, SESSION_KEY_LEN); + if (len > 0) { +- SHA1Update(&ctxt, datp, SHA_DIGESTSIZE); ++ SHA1Update(&ctxt, datp, SHA_DIGEST_LENGTH); + } else { + SHA1Update(&ctxt, esp->es_client.ea_name, + esp->es_client.ea_namelen); + } + SHA1Final(dig, &ctxt); +- for (digp = dig; digp < dig + SHA_DIGESTSIZE; digp++) ++ for (digp = dig; digp < dig + SHA_DIGEST_LENGTH; digp++) + *datp++ ^= *digp; + } + +@@ -1319,12 +1558,17 @@ char rhostname[256]; MD5_CTX mdContext; u_char hash[MD5_SIGNATURE_SIZE]; @@ -2760,7 +3105,15 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP struct t_client *tc; struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1456,6 +1696,100 @@ + u_char vals[2]; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + int fd; + #endif /* USE_SRP */ + +@@ -1455,6 +1699,100 @@ esp->es_client.ea_namelen); break; @@ -2861,8 +3214,41 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP case EAPT_SRP: if (len < 1) { -@@ -1737,6 +2071,11 @@ - u_char dig[SHA_DIGESTSIZE]; +@@ -1639,7 +1977,7 @@ + esp->es_client.ea_id, id); + } + } else { +- len -= sizeof (u_int32_t) + SHA_DIGESTSIZE; ++ len -= sizeof (u_int32_t) + SHA_DIGEST_LENGTH; + if (len < 0 || t_clientverify(tc, inp + + sizeof (u_int32_t)) != 0) { + error("EAP: SRP server verification " +@@ -1649,7 +1987,7 @@ + GETLONG(esp->es_client.ea_keyflags, inp); + /* Save pseudonym if user wants it. */ + if (len > 0 && esp->es_usepseudo) { +- INCPTR(SHA_DIGESTSIZE, inp); ++ INCPTR(SHA_DIGEST_LENGTH, inp); + write_pseudonym(esp, inp, len, id); + } + } +@@ -1676,7 +2014,7 @@ + esp->es_client.ea_namelen); + SHA1Final(dig, &ctxt); + eap_srp_response(esp, id, EAPSRP_LWRECHALLENGE, dig, +- SHA_DIGESTSIZE); ++ SHA_DIGEST_LENGTH); + break; + + default: +@@ -1732,10 +2070,15 @@ + #ifdef USE_SRP + struct t_server *ts; + struct t_num A; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ eHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; #endif /* USE_SRP */ +#ifdef USE_EAPTLS @@ -2873,7 +3259,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (esp->es_server.ea_id != id) { dbglog("EAP: discarding Response %d; expected ID %d", id, esp->es_server.ea_id); -@@ -1776,6 +2115,64 @@ +@@ -1775,6 +2118,64 @@ eap_figure_next_state(esp, 0); break; @@ -2938,7 +3324,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_NOTIFICATION: dbglog("EAP unexpected Notification; response discarded"); break; -@@ -1807,6 +2204,13 @@ +@@ -1806,6 +2207,13 @@ esp->es_server.ea_state = eapMD5Chall; break; @@ -2952,7 +3338,37 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c default: dbglog("EAP: peer requesting unknown Type %d", vallen); switch (esp->es_server.ea_state) { -@@ -2018,13 +2422,27 @@ +@@ -1923,9 +2331,9 @@ + eap_figure_next_state(esp, 1); + break; + } +- if (len < sizeof (u_int32_t) + SHA_DIGESTSIZE) { ++ if (len < sizeof (u_int32_t) + SHA_DIGEST_LENGTH) { + error("EAP: M1 length %d < %d", len, +- sizeof (u_int32_t) + SHA_DIGESTSIZE); ++ sizeof (u_int32_t) + SHA_DIGEST_LENGTH); + eap_figure_next_state(esp, 1); + break; + } +@@ -1962,7 +2370,7 @@ + info("EAP: unexpected SRP Subtype 4 Response"); + return; + } +- if (len != SHA_DIGESTSIZE) { ++ if (len != SHA_DIGEST_LENGTH) { + error("EAP: bad Lightweight rechallenge " + "response"); + return; +@@ -1976,7 +2384,7 @@ + SHA1Update(&ctxt, esp->es_server.ea_peer, + esp->es_server.ea_peerlen); + SHA1Final(dig, &ctxt); +- if (BCMP(dig, inp, SHA_DIGESTSIZE) != 0) { ++ if (BCMP(dig, inp, SHA_DIGEST_LENGTH) != 0) { + error("EAP: failed Lightweight rechallenge"); + eap_send_failure(esp); + break; +@@ -2017,13 +2425,27 @@ int id; int len; { @@ -2981,7 +3397,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (esp->es_client.ea_timeout > 0) { UNTIMEOUT(eap_client_timeout, (void *)esp); } -@@ -2150,6 +2568,9 @@ +@@ -2149,6 +2571,9 @@ int code, id, len, rtype, vallen; u_char *pstart; u_int32_t uval; @@ -2991,7 +3407,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (inlen < EAP_HEADERLEN) return (0); -@@ -2214,6 +2635,24 @@ +@@ -2213,6 +2638,24 @@ } break; @@ -3016,7 +3432,21 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_SRP: if (len < 3) goto truncated; -@@ -2325,6 +2764,25 @@ +@@ -2280,10 +2723,10 @@ + if (uval != 0) { + printer(arg, " f<%X>", uval); + } +- if ((vallen = len) > SHA_DIGESTSIZE) +- vallen = SHA_DIGESTSIZE; ++ if ((vallen = len) > SHA_DIGEST_LENGTH) ++ vallen = SHA_DIGEST_LENGTH; + printer(arg, " ", len, inp, +- len < SHA_DIGESTSIZE ? "?" : ""); ++ len < SHA_DIGEST_LENGTH ? "?" : ""); + INCPTR(vallen, inp); + len -= vallen; + if (len > 0) { +@@ -2324,6 +2767,25 @@ } break; @@ -3042,14 +3472,36 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_NAK: if (len <= 0) { printer(arg, " "); -@@ -2426,3 +2884,4 @@ +@@ -2387,7 +2849,7 @@ + printer(arg, " f<%X>", uval); + } + printer(arg, " ", len, inp, +- len == SHA_DIGESTSIZE ? "" : "?"); ++ len == SHA_DIGEST_LENGTH ? "" : "?"); + INCPTR(len, inp); + len = 0; + break; +@@ -2397,9 +2859,9 @@ + + case EAPSRP_LWRECHALLENGE: + printer(arg, " ", len, inp, +- len == SHA_DIGESTSIZE ? "" : "?"); +- if ((vallen = len) > SHA_DIGESTSIZE) +- vallen = SHA_DIGESTSIZE; ++ len == SHA_DIGEST_LENGTH ? "" : "?"); ++ if ((vallen = len) > SHA_DIGEST_LENGTH) ++ vallen = SHA_DIGEST_LENGTH; + INCPTR(vallen, inp); + len -= vallen; + break; +@@ -2425,3 +2887,4 @@ return (inp - pstart); } + -diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h ---- ppp-2.4.7/pppd/eap.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h 2018-10-30 16:47:59.537263209 +0100 +diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h +--- ppp-2.4.8/pppd/eap.h 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h 2020-04-03 14:02:19.340905028 +0200 @@ -84,6 +84,16 @@ eapClosed, /* Authentication not in use */ eapListen, /* Client ready (and timer running) */ @@ -3118,44 +3570,9 @@ diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ -diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.c ---- ppp-2.4.7/pppd/md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.c 2018-10-30 16:47:59.538263156 +0100 -@@ -33,6 +33,8 @@ - *********************************************************************** - */ - -+#ifndef USE_EAPTLS -+ - #include - #include "md5.h" - -@@ -305,3 +307,5 @@ - ** End of md5.c ** - ******************************** (cut) ******************************** - */ -+#endif /* USE_EAPTLS */ -+ -diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.h ---- ppp-2.4.7/pppd/md5.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.h 2018-10-30 16:47:59.538263156 +0100 -@@ -36,6 +36,7 @@ - ** documentation and/or software. ** - *********************************************************************** - */ -+#ifndef USE_EAPTLS - - #ifndef __MD5_INCLUDE__ - -@@ -63,3 +64,5 @@ - - #define __MD5_INCLUDE__ - #endif /* __MD5_INCLUDE__ */ -+ -+#endif /* USE_EAPTLS */ -diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames.h ---- ppp-2.4.7/pppd/pathnames.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames.h 2018-10-30 16:47:59.539263095 +0100 +diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames.h +--- ppp-2.4.8/pppd/pathnames.h 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames.h 2020-04-03 14:02:19.340905028 +0200 @@ -21,6 +21,13 @@ #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" @@ -3170,9 +3587,9 @@ diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux ---- ppp-2.4.7/pppd/plugins/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux 2018-10-30 16:47:59.539263095 +0100 +diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/Makefile.linux +--- ppp-2.4.8/pppd/plugins/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/Makefile.linux 2020-04-03 14:02:19.340905028 +0200 @@ -4,6 +4,9 @@ LDFLAGS_SHARED = -shared INSTALL = install @@ -3183,9 +3600,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/ppp DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passprompt.c ---- ppp-2.4.7/pppd/plugins/passprompt.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passprompt.c 2018-10-30 16:47:59.540263023 +0100 +diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passprompt.c +--- ppp-2.4.8/pppd/plugins/passprompt.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passprompt.c 2020-04-03 14:02:19.340905028 +0200 @@ -107,4 +107,7 @@ { add_options(options); @@ -3194,9 +3611,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ + eaptls_passwd_hook = promptpass; +#endif } -diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passwordfd.c ---- ppp-2.4.7/pppd/plugins/passwordfd.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passwordfd.c 2018-10-30 16:47:59.540263023 +0100 +diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passwordfd.c +--- ppp-2.4.8/pppd/plugins/passwordfd.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passwordfd.c 2020-04-03 14:02:19.340905028 +0200 @@ -79,4 +79,8 @@ chap_check_hook = pwfd_check; @@ -3206,10 +3623,21 @@ diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ + eaptls_passwd_hook = pwfd_passwd; +#endif } -diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 ---- ppp-2.4.7/pppd/pppd.8 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 2018-10-30 16:47:59.542262870 +0100 -@@ -248,6 +248,12 @@ +diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c +--- ppp-2.4.8/pppd/pppcrypt.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c 2020-04-03 14:02:19.340905028 +0200 +@@ -31,6 +31,7 @@ + */ + + #include ++#include + #include "pppd.h" + #include "pppcrypt.h" + +diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 +--- ppp-2.4.8/pppd/pppd.8 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 2020-04-03 14:02:19.341905027 +0200 +@@ -260,6 +260,12 @@ compression in the corresponding direction. Use \fInobsdcomp\fR or \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. .TP @@ -3222,7 +3650,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B cdtrcts Use a non-standard hardware flow control (i.e. DTR/CTS) to control the flow of data on the serial port. If neither the \fIcrtscts\fR, -@@ -259,6 +265,12 @@ +@@ -271,6 +277,12 @@ bi-directional flow control. The sacrifice is that this flow control mode does not permit using DTR as a modem control line. .TP @@ -3235,7 +3663,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B chap\-interval \fIn If this option is given, pppd will rechallenge the peer every \fIn\fR seconds. -@@ -287,6 +299,18 @@ +@@ -299,6 +311,18 @@ 1000 (1 second). This wait period only applies if the \fBconnect\fR or \fBpty\fR option is used. .TP @@ -3254,7 +3682,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B debug Enables connection debugging facilities. If this option is given, pppd will log the contents of all -@@ -551,6 +575,12 @@ +@@ -563,6 +587,12 @@ the kernel are logged by syslog(1) to a file as directed in the /etc/syslog.conf configuration file. .TP @@ -3267,7 +3695,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B ktune Enables pppd to alter kernel settings as appropriate. Under Linux, pppd will enable IP forwarding (i.e. set /proc/sys/net/ipv4/ip_forward -@@ -709,6 +739,9 @@ +@@ -721,6 +751,9 @@ Disable Address/Control compression in both directions (send and receive). .TP @@ -3277,10 +3705,10 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B noauth Do not require the peer to authenticate itself. This option is privileged. -diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h ---- ppp-2.4.7/pppd/pppd.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h 2018-10-30 16:47:59.542262870 +0100 -@@ -325,6 +325,11 @@ +diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h +--- ppp-2.4.8/pppd/pppd.h 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h 2020-04-03 14:02:19.341905027 +0200 +@@ -341,6 +341,11 @@ extern bool dryrun; /* check everything, print options, exit */ extern int child_wait; /* # seconds to wait for children at end */ @@ -3292,7 +3720,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h #ifdef MAXOCTETS extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ extern int maxoctets_dir; /* Direction : -@@ -741,6 +746,10 @@ +@@ -763,6 +768,10 @@ extern int (*chap_passwd_hook) __P((char *user, char *passwd)); extern void (*multilink_join_hook) __P((void)); @@ -3303,3 +3731,94 @@ diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h /* Let a plugin snoop sent and received packets. Useful for L2TP */ extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); extern void (*snoop_send_hook) __P((unsigned char *p, int len)); +diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c +--- ppp-2.4.8/pppd/sha1.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c 2020-04-03 14:02:19.341905027 +0200 +@@ -101,7 +101,7 @@ + /* SHA1Init - Initialize new context */ + + void +-SHA1_Init(SHA1_CTX *context) ++SHA1_Init(SHA_CTX *context) + { + /* SHA1 initialization constants */ + context->state[0] = 0x67452301; +@@ -116,7 +116,7 @@ + /* Run your data through this. */ + + void +-SHA1_Update(SHA1_CTX *context, const unsigned char *data, unsigned int len) ++SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len) + { + unsigned int i, j; + +@@ -140,7 +140,7 @@ + /* Add padding and return the message digest. */ + + void +-SHA1_Final(unsigned char digest[20], SHA1_CTX *context) ++SHA1_Final(unsigned char *digest, SHA_CTX *context) + { + u_int32_t i, j; + unsigned char finalcount[8]; +diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h +--- ppp-2.4.8/pppd/sha1.h 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h 2020-04-03 14:02:19.341905027 +0200 +@@ -1,11 +1,5 @@ + /* sha1.h */ + +-/* If OpenSSL is in use, then use that version of SHA-1 */ +-#ifdef OPENSSL +-#include +-#define __SHA1_INCLUDE_ +-#endif +- + #ifndef __SHA1_INCLUDE_ + + #ifndef SHA1_SIGNATURE_SIZE +@@ -20,11 +14,11 @@ + u_int32_t state[5]; + u_int32_t count[2]; + unsigned char buffer[64]; +-} SHA1_CTX; ++} SHA_CTX; + +-extern void SHA1_Init(SHA1_CTX *); +-extern void SHA1_Update(SHA1_CTX *, const unsigned char *, unsigned int); +-extern void SHA1_Final(unsigned char[SHA1_SIGNATURE_SIZE], SHA1_CTX *); ++extern void SHA1_Init(SHA_CTX *context); ++extern void SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len); ++extern void SHA1_Final(unsigned char *data, SHA_CTX *context); + + #define __SHA1_INCLUDE_ + #endif /* __SHA1_INCLUDE_ */ +diff -Naur ppp-2.4.8/pppd/sys-solaris.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sys-solaris.c +--- ppp-2.4.8/pppd/sys-solaris.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sys-solaris.c 2020-04-03 14:02:19.342905025 +0200 +@@ -1550,6 +1550,26 @@ + #endif /* defined(INET6) && defined(SOL2) */ + } + ++ ++ ++/* ++ * netif_get_mtu - get the MTU on the PPP network interface. ++ */ ++int ++netif_get_mtu(int unit) ++{ ++ struct ifreq ifr; ++ ++ memset (&ifr, '\0', sizeof (ifr)); ++ strlcpy(ifr.ifr_name, ifname, sizeof (ifr.ifr_name)); ++ ++ if (ioctl(ipfd, SIOCGIFMTU, (caddr_t) &ifr) < 0) { ++ error("ioctl(SIOCGIFMTU): %m (line %d)", __LINE__); ++ return 0; ++ } ++ return ifr.ifr_mtu; ++} ++ + /* + * tty_send_config - configure the transmit characteristics of + * the ppp interface. diff --git a/ppp.spec b/ppp.spec index 9c8f483..320796d 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 3%{?dist} +Release: 4%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -46,7 +46,8 @@ Patch0022: ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patc Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: ppp-2.4.8-eaptls-mppe-1.102.patch +# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.8-eaptls-mppe-1.201.patch +Patch0026: ppp-2.4.8-eaptls-mppe-1.201.patch Patch0032: ppp-2.4.8-CVE-2020-8597.patch @@ -183,6 +184,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Mon Apr 6 2020 Jaroslav Škarvada - 2.4.8-4 +- Updated EAP-TLS patch to v1.201 + * Fri Feb 28 2020 Tom Stellard - 2.4.8-3 - Use make_build macro - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make From e4e647d22e5a59110322c4112fce3eb4f07c8a14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 7 Apr 2020 10:23:05 +0200 Subject: [PATCH 06/57] Updated EAP-TLS patch to v1.300 --- ...patch => ppp-2.4.8-eaptls-mppe-1.300.patch | 432 +++++++++++------- ppp.spec | 9 +- 2 files changed, 284 insertions(+), 157 deletions(-) rename ppp-2.4.8-eaptls-mppe-1.201.patch => ppp-2.4.8-eaptls-mppe-1.300.patch (90%) diff --git a/ppp-2.4.8-eaptls-mppe-1.201.patch b/ppp-2.4.8-eaptls-mppe-1.300.patch similarity index 90% rename from ppp-2.4.8-eaptls-mppe-1.201.patch rename to ppp-2.4.8-eaptls-mppe-1.300.patch index ca3e872..65b1434 100644 --- a/ppp-2.4.8-eaptls-mppe-1.201.patch +++ b/ppp-2.4.8-eaptls-mppe-1.300.patch @@ -1,7 +1,7 @@ -diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls +diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.300/README.eap-tls --- ppp-2.4.8/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls 2020-04-03 14:02:19.334905035 +0200 -@@ -0,0 +1,301 @@ ++++ ppp-2.4.8-eaptls-mppe-1.300/README.eap-tls 2020-04-07 10:09:50.565118206 +0200 +@@ -0,0 +1,307 @@ +EAP-TLS authentication support for PPP +====================================== + @@ -296,16 +296,22 @@ diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls +v1.200 (28-Feb-2020) + - First version of patch that was used to create a github PR against the main ppp code base. + - Add client-side 'capath' option to allow a directory with trusted CA certificates. -+ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or ++ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or + use the ones supplied by OpenSSL. + - Code now also builds on Solaris (x86 tested) but has not been tested yet, as the Solaris ppp + kernel driver does not support MPPE. +v1.201 (03-Apr-2020) + - Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that + you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation. -diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-client ++v1.300 (03-Apr-2020) ++ - Add (experimental) TLS 1.3 support. This is based on draft-ietf-emu-eap-tls13-05 (expired) and ++ requires OpenSSL 1.1.1+ to be effective. ++ - Add new option 'max-tls-version' to specify the highest version of the TLS protocol to use ++ (defaults to TLS1.2 for now - so to use TLS1.3 you need to explicitly add 'max-tls-version 1.3') ++ +diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-client --- ppp-2.4.8/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-client 2020-04-03 14:02:19.334905035 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-client 2020-04-07 10:09:50.566118204 +0200 @@ -0,0 +1,10 @@ +# Parameters for authentication using EAP-TLS (client) + @@ -317,9 +323,9 @@ diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/e +# client private key file (required) + +#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-server +diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-server --- ppp-2.4.8/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-server 2020-04-03 14:02:19.334905035 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-server 2020-04-07 10:09:50.566118204 +0200 @@ -0,0 +1,11 @@ +# Parameters for authentication using EAP-TLS (server) + @@ -332,9 +338,9 @@ diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/e +# allowed addresses (required, can be *) + +#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/openssl.cnf +diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/openssl.cnf --- ppp-2.4.8/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/openssl.cnf 2020-04-03 14:02:19.334905035 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/openssl.cnf 2020-04-07 10:09:50.566118204 +0200 @@ -0,0 +1,14 @@ +openssl_conf = openssl_def + @@ -350,9 +356,9 @@ diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/ope +MODULE_PATH = /usr/lib64/libeTPkcs11.so +init = 0 + -diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.201/linux/Makefile.top +diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.300/linux/Makefile.top --- ppp-2.4.8/linux/Makefile.top 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/linux/Makefile.top 2020-04-03 14:02:19.334905035 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/linux/Makefile.top 2020-04-07 10:09:50.566118204 +0200 @@ -26,7 +26,7 @@ cd pppdump; $(MAKE) $(MFLAGS) install @@ -373,9 +379,9 @@ diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.201/linux/Makefi $(BINDIR): $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.linux +diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.linux --- ppp-2.4.8/pppd/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.linux 2020-04-03 14:02:19.335905034 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.linux 2020-04-07 10:10:01.427104384 +0200 @@ -11,16 +11,16 @@ TARGETS = pppd @@ -458,9 +464,9 @@ diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefi HEADERS += sha1.h PPPDOBJS += sha1.o endif -diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.sol2 +diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.sol2 --- ppp-2.4.8/pppd/Makefile.sol2 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.sol2 2020-04-03 14:02:19.335905034 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.sol2 2020-04-07 10:09:50.566118204 +0200 @@ -5,10 +5,10 @@ include ../Makedefs.com @@ -497,9 +503,9 @@ diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefil # Uncomment for CBCP #CFLAGS += -DCBCP_SUPPORT -diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c +diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.300/pppd/auth.c --- ppp-2.4.8/pppd/auth.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c 2020-04-03 14:02:19.337905032 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/auth.c 2020-04-07 10:09:50.567118203 +0200 @@ -113,6 +113,9 @@ #include "upap.h" #include "chap-new.h" @@ -522,7 +528,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c /* Hook for a plugin to say whether it is OK if the peer refuses to authenticate. */ int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -241,6 +249,15 @@ +@@ -241,6 +249,16 @@ bool explicit_user = 0; /* Set if "user" option supplied */ bool explicit_passwd = 0; /* Set if "password" option supplied */ char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ @@ -533,12 +539,13 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c +char *privkey_file = NULL; /* client private key file (pem format) */ +char *crl_dir = NULL; /* directory containing CRL files */ +char *crl_file = NULL; /* Certificate Revocation List (CRL) file (pem format) */ ++char *max_tls_version = NULL; /* Maximum TLS protocol version (default=1.2) */ +bool need_peer_eap = 0; /* Require peer to authenticate us */ +#endif static char *uafname; /* name of most recent +ua file */ -@@ -257,6 +274,19 @@ +@@ -257,6 +275,19 @@ static int have_chap_secret __P((char *, char *, int, int *)); static int have_srp_secret __P((char *client, char *server, int need_ip, int *lacks_ipp)); @@ -558,7 +565,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); static int scan_authfile __P((FILE *, char *, char *, char *, struct wordlist **, struct wordlist **, -@@ -404,6 +434,16 @@ +@@ -404,6 +435,18 @@ "Set telephone number(s) which are allowed to connect", OPT_PRIV | OPT_A2LIST }, @@ -569,13 +576,15 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c + { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, + { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, + { "crl", o_string, &crl_file, "Use specific CRL file" }, ++ { "max-tls-version", o_string, &max_tls_version, ++ "Maximum TLS version (1.0/1.1/1.2 (default)/1.3)" }, + { "need-peer-eap", o_bool, &need_peer_eap, + "Require the peer to authenticate us", 1 }, +#endif /* USE_EAPTLS */ { NULL } }; -@@ -737,6 +777,9 @@ +@@ -737,6 +780,9 @@ lcp_options *wo = &lcp_wantoptions[unit]; lcp_options *go = &lcp_gotoptions[unit]; lcp_options *ho = &lcp_hisoptions[unit]; @@ -585,7 +594,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c int i; struct protent *protp; -@@ -771,6 +814,22 @@ +@@ -771,6 +817,22 @@ } } @@ -608,7 +617,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c new_phase(PHASE_AUTHENTICATE); auth = 0; if (go->neg_eap) { -@@ -1291,6 +1350,15 @@ +@@ -1291,6 +1353,15 @@ our_name, 1, &lacks_ip); } @@ -624,7 +633,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c if (auth_required && !can_auth && noauth_addrs == NULL) { if (default_auth) { option_error( -@@ -1345,7 +1413,11 @@ +@@ -1345,7 +1416,11 @@ passwd[0] != 0 || (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, (explicit_remote? remote_name: NULL), 0, NULL))) || @@ -637,7 +646,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c hadchap = -1; if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1360,8 +1432,14 @@ +@@ -1360,8 +1435,14 @@ !have_chap_secret((explicit_remote? remote_name: NULL), our_name, 1, NULL))) && !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, @@ -653,7 +662,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c } -@@ -1721,6 +1799,7 @@ +@@ -1721,6 +1802,7 @@ } @@ -661,7 +670,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c /* * get_secret - open the CHAP secret file and return the secret * for authenticating the given client on the given server. -@@ -2373,3 +2452,345 @@ +@@ -2373,3 +2455,345 @@ auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); } @@ -1007,9 +1016,9 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c +} +#endif + -diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c +diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.300/pppd/ccp.c --- ppp-2.4.8/pppd/ccp.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c 2020-04-03 14:02:19.337905032 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/ccp.c 2020-04-07 10:09:50.567118203 +0200 @@ -539,6 +539,9 @@ if (go->mppe) { ccp_options *ao = &ccp_allowoptions[f->unit]; @@ -1045,9 +1054,9 @@ diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c lcp_close(f->unit, "MPPE required but not available"); return; } -diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c +diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.300/pppd/chap-md5.c --- ppp-2.4.8/pppd/chap-md5.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c 2020-04-03 14:02:19.337905032 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/chap-md5.c 2020-04-07 10:09:50.567118203 +0200 @@ -36,7 +36,11 @@ #include "chap-new.h" #include "chap-md5.h" @@ -1060,9 +1069,9 @@ diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c #define MD5_HASH_SIZE 16 #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c +diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.300/pppd/chap_ms.c --- ppp-2.4.8/pppd/chap_ms.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c 2020-04-03 14:02:19.338905030 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/chap_ms.c 2020-04-07 10:09:50.567118203 +0200 @@ -534,7 +534,7 @@ char *username, u_char Challenge[8]) @@ -1099,10 +1108,10 @@ diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ -diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.c --- ppp-2.4.8/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c 2020-04-03 14:02:19.338905030 +0200 -@@ -0,0 +1,1442 @@ ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.c 2020-04-07 10:09:50.568118202 +0200 +@@ -0,0 +1,1560 @@ +/* * eap-tls.c - EAP-TLS implementation for PPP + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. @@ -1154,11 +1163,32 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +#include "lcp.h" +#include "pathnames.h" + ++typedef struct pw_cb_data ++{ ++ const void *password; ++ const char *prompt_info; ++} PW_CB_DATA; ++ +/* The openssl configuration file and engines can be loaded only once */ +static CONF *ssl_config = NULL; +static ENGINE *cert_engine = NULL; +static ENGINE *pkey_engine = NULL; + ++/* TLSv1.3 do we have a session ticket ? */ ++static int have_session_ticket = 0; ++ ++int ssl_verify_callback(int, X509_STORE_CTX *); ++void ssl_msg_callback(int write_p, int version, int ct, const void *buf, ++ size_t len, SSL * ssl, void *arg); ++int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); ++ ++X509 *get_X509_from_file(char *filename); ++int ssl_cmp_certs(char *filename, X509 * a); ++ ++#ifdef MPPE ++ ++#define EAPTLS_MPPE_KEY_LEN 32 ++ +/* + * The following stuff is only needed if SSL_export_keying_material() is not available + */ @@ -1363,21 +1393,35 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + + -+#ifdef MPPE -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ +/* + * Generate keys according to RFC 2716 and add to reply + */ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, -+ int client) ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) +{ + unsigned char out[4*EAPTLS_MPPE_KEY_LEN]; -+ size_t prf_size = strlen(prf_label); ++ const char *prf_label; ++ size_t prf_size; ++ unsigned char eap_tls13_context[] = { EAPT_TLS }; ++ unsigned char *context = NULL; ++ size_t context_len = 0; + unsigned char *p; + -+ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, NULL, 0, 0) != 1) ++ dbglog("EAP-TLS generating MPPE keys"); ++ if (ets->tls_v13) ++ { ++ prf_label = "EXPORTER_EAP_TLS_Key_Material"; ++ context = eap_tls13_context; ++ context_len = 1; ++ } ++ else ++ { ++ prf_label = "client EAP encryption"; ++ } ++ ++ dbglog("EAP-TLS PRF label = %s", prf_label); ++ prf_size = strlen(prf_label); ++ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, ++ context, context_len, 0) != 1) + { + warn( "EAP-TLS: Failed generating keying material" ); + return; @@ -1525,13 +1569,13 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + X509_STORE *certstore; + X509_LOOKUP *lookup; + X509 *tmp; -+ int ret; ++ int ret; +#if defined(TLS1_2_VERSION) -+ long tls_version = TLS1_2_VERSION; ++ long tls_version = TLS1_2_VERSION; +#elif defined(TLS1_1_VERSION) -+ long tls_version = TLS1_1_VERSION; ++ long tls_version = TLS1_1_VERSION; +#else -+ long tls_version = TLS1_VERSION; ++ long tls_version = TLS1_VERSION; +#endif + + /* @@ -1781,8 +1825,51 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +#endif + ); + -+ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); -+ SSL_CTX_set_max_proto_version(ctx, tls_version); ++ /* OpenSSL 1.1.1+ does not include RC4 ciphers by default. ++ * This causes totally obsolete WinXP clients to fail. If you really ++ * need ppp+EAP-TLS+openssl 1.1.1+WinXP then enable RC4 cipers and ++ * make sure that you use an OpenSSL that supports them ++ ++ SSL_CTX_set_cipher_list(ctx, "RC4"); ++ */ ++ ++ ++ /* Set up a SSL Session cache with a callback. This is needed for TLSv1.3+. ++ * During the initial handshake the server signals to the client early on ++ * that the handshake is finished, even before the client has sent its ++ * credentials to the server. The actual connection (and moment that the ++ * client sends its credentials) only starts after the arrival of the first ++ * session ticket. The 'ssl_new_session_cb' catches this ticket. ++ */ ++ SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL_STORE); ++ SSL_CTX_sess_set_new_cb(ctx, ssl_new_session_cb); ++ ++ /* As EAP-TLS+TLSv1.3 is highly experimental we offer the user a chance to override */ ++ if (max_tls_version) ++ { ++ if (strncmp(max_tls_version, "1.0", 3) == 0) ++ tls_version = TLS1_VERSION; ++ else if (strncmp(max_tls_version, "1.1", 3) == 0) ++ tls_version = TLS1_1_VERSION; ++ else if (strncmp(max_tls_version, "1.2", 3) == 0) ++#ifdef TLS1_2_VERSION ++ tls_version = TLS1_2_VERSION; ++#else ++ { ++ warn("TLSv1.2 not available. Defaulting to TLSv1.1"); ++ tls_version = TLS_1_1_VERSION; ++ } ++#endif ++ else if (strncmp(max_tls_version, "1.3", 3) == 0) ++#ifdef TLS1_3_VERSION ++ tls_version = TLS1_3_VERSION; ++#else ++ warn("TLSv1.3 not available."); ++#endif ++ } ++ ++ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); ++ SSL_CTX_set_max_proto_version(ctx, tls_version); + + SSL_CTX_set_verify_depth(ctx, 5); + SSL_CTX_set_verify(ctx, @@ -1944,6 +2031,8 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + + SSL_set_accept_state(ets->ssl); + ++ ets->tls_v13 = 0; ++ + ets->data = NULL; + ets->datalen = 0; + ets->alert_sent = 0; @@ -2034,6 +2123,8 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + + SSL_set_connect_state(ets->ssl); + ++ ets->tls_v13 = 0; ++ + ets->data = NULL; + ets->datalen = 0; + ets->alert_sent = 0; @@ -2069,6 +2160,20 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + free(ets); +} + ++ ++int eaptls_is_init_finished(struct eaptls_session *ets) ++{ ++ if (ets->ssl && SSL_is_init_finished(ets->ssl)) ++ { ++ if (ets->tls_v13) ++ return have_session_ticket; ++ else ++ return 1; ++ } ++ ++ return 0; ++} ++ +/* + * Handle a received packet, reassembling fragmented messages and + * passing them to the ssl engine @@ -2189,10 +2294,12 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + + start = *outp; + -+ if (!ets->data) { -+ ++ if (!ets->data) ++ { + if(!ets->alert_sent) -+ SSL_read(ets->ssl, fromtls, 65536); ++ { ++ res = SSL_read(ets->ssl, fromtls, 65536); ++ } + + /* + * Read from ssl @@ -2435,7 +2542,7 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + strcat(string, "TLS 1.2"); + break; + default: -+ strcat(string, "Unknown version"); ++ sprintf(string, "SSL/TLS Header: Unknown version (%d)", hvers); + } + break; + @@ -2459,9 +2566,9 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + break; + +#ifdef SSL3_RT_INNER_CONTENT_TYPE -+ case SSL3_RT_INNER_CONTENT_TYPE: -+ strcat(string, "InnerContentType (TLS1.3)"); -+ break; ++ case SSL3_RT_INNER_CONTENT_TYPE: ++ strcat(string, "InnerContentType (TLS1.3)"); ++ break; +#endif + + case SSL3_RT_HANDSHAKE: @@ -2484,6 +2591,16 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + strcat(string,"New Session Ticket"); + break; +#endif ++#ifdef SSL3_MT_END_OF_EARLY_DATA ++ case SSL3_MT_END_OF_EARLY_DATA: ++ strcat(string,"End of Early Data"); ++ break; ++#endif ++#ifdef SSL3_MT_ENCRYPTED_EXTENSIONS ++ case SSL3_MT_ENCRYPTED_EXTENSIONS: ++ strcat(string,"Encryped Extensions"); ++ break; ++#endif + case SSL3_MT_CERTIFICATE: + strcat(string,"Certificate"); + break; @@ -2519,11 +2636,11 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + strcat(string, "TLS 1.2"); + break; +#ifdef TLS1_3_VERSION -+ case TLS1_3_VERSION: -+ strcat(string, "TLS 1.3 (not supported)"); -+ break; ++ case TLS1_3_VERSION: ++ strcat(string, "TLS 1.3 (experimental)"); ++ ets->tls_v13 = 1; ++ break; +#endif -+ + default: + strcat(string, "Unknown version"); + } @@ -2545,10 +2662,20 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + dbglog("%s", string); +} + -diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h ++int ++ssl_new_session_cb(SSL *s, SSL_SESSION *sess) ++{ ++ dbglog("EAP-TLS: Post-Handshake New Session Ticket arrived:"); ++ have_session_ticket = 1; ++ ++ /* always return success */ ++ return 1; ++} ++ +diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.h --- ppp-2.4.8/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h 2020-04-03 14:02:19.338905030 +0200 -@@ -0,0 +1,107 @@ ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.h 2020-04-07 10:09:50.568118202 +0200 +@@ -0,0 +1,96 @@ +/* + * eap-tls.h + * @@ -2599,11 +2726,12 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h +{ + u_char *data; /* buffered data */ + int datalen; /* buffered data len */ -+ int offset; /* from where to send */ -+ int tlslen; /* total length of tls data */ -+ bool frag; /* packet is fragmented */ ++ int offset; /* from where to send */ ++ int tlslen; /* total length of tls data */ ++ bool frag; /* packet is fragmented */ ++ bool tls_v13; /* whether we've negotiated TLSv1.3 */ + SSL_CTX *ctx; -+ SSL *ssl; /* ssl connection */ ++ SSL *ssl; /* ssl connection */ + BIO *from_ssl; + BIO *into_ssl; + char peer[MAXWORDLEN]; /* peer name */ @@ -2612,24 +2740,11 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h + u_char alert_sent_desc; + bool alert_recv; + u_char alert_recv_desc; -+ char rtx[65536]; /* retransmission buffer */ ++ char rtx[EAP_TLS_MAX_LEN]; /* retransmission buffer */ + int rtx_len; + int mtu; /* unit mtu */ +}; + -+typedef struct pw_cb_data -+{ -+ const void *password; -+ const char *prompt_info; -+} PW_CB_DATA; -+ -+ -+int ssl_verify_callback(int, X509_STORE_CTX *); -+void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -+ size_t len, SSL * ssl, void *arg); -+ -+X509 *get_X509_from_file(char *filename); -+int ssl_cmp_certs(char *filename, X509 * a); + +SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, + char *certfile, char *peer_certfile, char *privkeyfile); @@ -2637,6 +2752,8 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h +int eaptls_init_ssl_client(eap_state * esp); +void eaptls_free_session(struct eaptls_session *ets); + ++int eaptls_is_init_finished(struct eaptls_session *ets); ++ +int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); +int eaptls_send(struct eaptls_session *ets, u_char ** outp); +void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); @@ -2651,14 +2768,13 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h +extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +extern int mppe_keys_set; + -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); -+ ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); +#endif + +#endif -diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c +diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.c --- ppp-2.4.8/pppd/eap.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c 2020-04-03 14:02:19.339905029 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.c 2020-04-07 10:09:50.569118201 +0200 @@ -43,6 +43,11 @@ * Based on draft-ietf-pppext-eap-srp-03.txt. */ @@ -2738,7 +2854,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c switch (esp->es_server.ea_state) { case eapBadAuth: return; -@@ -561,9 +585,79 @@ +@@ -561,9 +585,81 @@ break; } #endif /* USE_SRP */ @@ -2794,18 +2910,20 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + if(SSL_is_init_finished(ets->ssl)) + esp->es_server.ea_state = eapTlsRecvClient; + else -+ esp->es_server.ea_state = eapTlsRecv; ++ /* JJK Add "TLS empty record" message here ??? */ ++ esp->es_server.ea_state = eapTlsRecv; + break; + + case eapTlsSendAck: -+ esp->es_server.ea_state = eapTlsRecv; ++ esp->es_server.ea_state = eapTlsRecv; + break; + + case eapTlsRecvAck: -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } ++ if (status) ++ { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } + + esp->es_server.ea_state = eapTlsSend; + break; @@ -2818,7 +2936,18 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c case eapSRP1: #ifdef USE_SRP ts = (struct t_server *)esp->es_server.ea_session; -@@ -647,10 +741,10 @@ +@@ -629,6 +725,10 @@ + } + if (esp->es_server.ea_state == eapBadAuth) + eap_send_failure(esp); ++ ++#ifdef USE_EAPTLS ++ dbglog("EAP id=0x%2x '%s' -> '%s'", esp->es_server.ea_id, eap_state_name(esp->es_server.ea_prev_state), eap_state_name(esp->es_server.ea_state)); ++#endif /* USE_EAPTLS */ + } + + /* +@@ -647,10 +747,10 @@ char *str; #ifdef USE_SRP struct t_server *ts; @@ -2831,7 +2960,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c #endif /* USE_SRP */ /* Handle both initial auth and restart */ -@@ -717,6 +811,30 @@ +@@ -717,6 +817,30 @@ INCPTR(esp->es_server.ea_namelen, outp); break; @@ -2862,7 +2991,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c #ifdef USE_SRP case eapSRP1: PUTCHAR(EAPT_SRP, outp); -@@ -763,8 +881,8 @@ +@@ -763,8 +887,8 @@ PUTLONG(SRPVAL_EBIT, outp); ts = (struct t_server *)esp->es_server.ea_session; assert(ts != NULL); @@ -2873,7 +3002,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c if (pncrypt_setkey(0)) { /* Generate pseudonym */ -@@ -804,9 +922,9 @@ +@@ -804,9 +928,9 @@ /* Set length and pad out to next 20 octet boundary */ i = outp - optr - 1; *optr = i; @@ -2885,7 +3014,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c *outp++ = drand48() * 0x100; i++; } -@@ -822,14 +940,14 @@ +@@ -822,14 +946,14 @@ while (optr < outp) { SHA1Final(dig, &ctxt); cp = dig; @@ -2903,7 +3032,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c } } break; -@@ -903,11 +1021,57 @@ +@@ -903,11 +1027,57 @@ eap_server_timeout(arg) void *arg; { @@ -2961,7 +3090,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c /* EAP ID number must not change on timeout. */ eap_send_request(esp); } -@@ -1154,17 +1318,92 @@ +@@ -1154,17 +1324,90 @@ PUTCHAR(id, outp); esp->es_client.ea_id = id; msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) + @@ -2987,16 +3116,16 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c +eap_state *esp; +u_char id; +{ -+ u_char *outp; -+ int outlen; ++ u_char *outp; ++ int outlen; + u_char *lenloc; + -+ outp = outpacket_buf; ++ outp = outpacket_buf; + -+ MAKEHEADER(outp, PPP_EAP); ++ MAKEHEADER(outp, PPP_EAP); + -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); ++ PUTCHAR(EAP_RESPONSE, outp); ++ PUTCHAR(id, outp); + + lenloc = outp; + INCPTR(2, outp); @@ -3016,7 +3145,6 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); + + esp->es_client.ea_id = id; -+ +} + +/* @@ -3049,14 +3177,13 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + PUTSHORT(outlen, lenloc); + + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ +} +#endif /* USE_EAPTLS */ + static void eap_send_nak(esp, id, type) eap_state *esp; -@@ -1251,8 +1490,8 @@ +@@ -1251,8 +1494,8 @@ { u_char val; u_char *datp, *digp; @@ -3067,7 +3194,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c int dsize, fd, olen = len; /* -@@ -1261,21 +1500,21 @@ +@@ -1261,21 +1504,21 @@ */ val = id; while (len > 0) { @@ -3093,7 +3220,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c *datp++ ^= *digp; } -@@ -1319,12 +1558,17 @@ +@@ -1319,12 +1562,17 @@ char rhostname[256]; MD5_CTX mdContext; u_char hash[MD5_SIGNATURE_SIZE]; @@ -3113,7 +3240,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c int fd; #endif /* USE_SRP */ -@@ -1455,6 +1699,100 @@ +@@ -1455,6 +1703,96 @@ esp->es_client.ea_namelen); break; @@ -3134,11 +3261,11 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + + esp->es_client.ea_using_eaptls = 1; + -+ if (explicit_remote){ -+ esp->es_client.ea_peer = strdup(remote_name); -+ esp->es_client.ea_peerlen = strlen(remote_name); -+ } else -+ esp->es_client.ea_peer = NULL; ++ if (explicit_remote){ ++ esp->es_client.ea_peer = strdup(remote_name); ++ esp->es_client.ea_peerlen = strlen(remote_name); ++ } else ++ esp->es_client.ea_peer = NULL; + + /* Init ssl session */ + if(!eaptls_init_ssl_client(esp)) { @@ -3150,8 +3277,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + + ets = esp->es_client.ea_session; + eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); + break; + } + @@ -3161,8 +3287,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + + case eapTlsRecvAck: + eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); + break; + + case eapTlsRecv: @@ -3186,9 +3311,9 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + } + + /* Check if TLS handshake is finished */ -+ if(SSL_is_init_finished(ets->ssl)){ ++ if(eaptls_is_init_finished(ets)) { +#ifdef MPPE -+ eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); ++ eaptls_gen_mppe_keys(ets, 1); +#endif + eaptls_free_session(ets); + eap_tls_sendack(esp, id); @@ -3197,10 +3322,8 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + } + + eap_tls_response(esp,id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ -+ break; ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); ++ break; + + default: + eap_send_nak(esp, id, EAPT_TLS); @@ -3270,6 +3393,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + case eapTlsRecv: + + ets = (struct eaptls_session *) esp->es_server.ea_session; ++ + eap_figure_next_state(esp, + eaptls_receive(esp->es_server.ea_session, inp, len)); + @@ -3288,13 +3412,12 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + + case eapTlsRecvClient: + /* Receive authentication response from client */ -+ + if (len > 0) { + GETCHAR(flags, inp); + + if(len == 1 && !flags) { /* Ack = ok */ +#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); ++ eaptls_gen_mppe_keys( esp->es_server.ea_session, 0 ); +#endif + eap_send_success(esp); + } @@ -3499,9 +3622,9 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c return (inp - pstart); } + -diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h +diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.h --- ppp-2.4.8/pppd/eap.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.h 2020-04-07 10:09:50.569118201 +0200 @@ -84,6 +84,16 @@ eapClosed, /* Authentication not in use */ eapListen, /* Client ready (and timer running) */ @@ -3570,9 +3693,9 @@ diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ -diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames.h +diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.300/pppd/pathnames.h --- ppp-2.4.8/pppd/pathnames.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames.h 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pathnames.h 2020-04-07 10:09:50.569118201 +0200 @@ -21,6 +21,13 @@ #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" @@ -3587,9 +3710,9 @@ diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/Makefile.linux +diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/Makefile.linux --- ppp-2.4.8/pppd/plugins/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/Makefile.linux 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/Makefile.linux 2020-04-07 10:09:50.569118201 +0200 @@ -4,6 +4,9 @@ LDFLAGS_SHARED = -shared INSTALL = install @@ -3600,9 +3723,9 @@ diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/ppp DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passprompt.c +diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passprompt.c --- ppp-2.4.8/pppd/plugins/passprompt.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passprompt.c 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passprompt.c 2020-04-07 10:09:50.569118201 +0200 @@ -107,4 +107,7 @@ { add_options(options); @@ -3611,9 +3734,9 @@ diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ + eaptls_passwd_hook = promptpass; +#endif } -diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passwordfd.c +diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passwordfd.c --- ppp-2.4.8/pppd/plugins/passwordfd.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passwordfd.c 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passwordfd.c 2020-04-07 10:09:50.569118201 +0200 @@ -79,4 +79,8 @@ chap_check_hook = pwfd_check; @@ -3623,9 +3746,9 @@ diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ + eaptls_passwd_hook = pwfd_passwd; +#endif } -diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c +diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.300/pppd/pppcrypt.c --- ppp-2.4.8/pppd/pppcrypt.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppcrypt.c 2020-04-07 10:09:50.569118201 +0200 @@ -31,6 +31,7 @@ */ @@ -3634,9 +3757,9 @@ diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c #include "pppd.h" #include "pppcrypt.h" -diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 +diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.8 --- ppp-2.4.8/pppd/pppd.8 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 2020-04-03 14:02:19.341905027 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.8 2020-04-07 10:09:50.570118199 +0200 @@ -260,6 +260,12 @@ compression in the corresponding direction. Use \fInobsdcomp\fR or \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. @@ -3705,22 +3828,23 @@ diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 .B noauth Do not require the peer to authenticate itself. This option is privileged. -diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h +diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.h --- ppp-2.4.8/pppd/pppd.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h 2020-04-03 14:02:19.341905027 +0200 -@@ -341,6 +341,11 @@ ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.h 2020-04-07 10:09:50.570118199 +0200 +@@ -341,6 +341,12 @@ extern bool dryrun; /* check everything, print options, exit */ extern int child_wait; /* # seconds to wait for children at end */ +#ifdef USE_EAPTLS +extern char *crl_dir; +extern char *crl_file; ++extern char *max_tls_version; +#endif /* USE_EAPTLS */ + #ifdef MAXOCTETS extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ extern int maxoctets_dir; /* Direction : -@@ -763,6 +768,10 @@ +@@ -763,6 +769,10 @@ extern int (*chap_passwd_hook) __P((char *user, char *passwd)); extern void (*multilink_join_hook) __P((void)); @@ -3731,9 +3855,9 @@ diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h /* Let a plugin snoop sent and received packets. Useful for L2TP */ extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); extern void (*snoop_send_hook) __P((unsigned char *p, int len)); -diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c +diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.c --- ppp-2.4.8/pppd/sha1.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c 2020-04-03 14:02:19.341905027 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.c 2020-04-07 10:09:50.570118199 +0200 @@ -101,7 +101,7 @@ /* SHA1Init - Initialize new context */ @@ -3761,9 +3885,9 @@ diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c { u_int32_t i, j; unsigned char finalcount[8]; -diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h +diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.h --- ppp-2.4.8/pppd/sha1.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h 2020-04-03 14:02:19.341905027 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.h 2020-04-07 10:09:50.570118199 +0200 @@ -1,11 +1,5 @@ /* sha1.h */ @@ -3792,9 +3916,9 @@ diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h #define __SHA1_INCLUDE_ #endif /* __SHA1_INCLUDE_ */ -diff -Naur ppp-2.4.8/pppd/sys-solaris.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sys-solaris.c +diff -Naur ppp-2.4.8/pppd/sys-solaris.c ppp-2.4.8-eaptls-mppe-1.300/pppd/sys-solaris.c --- ppp-2.4.8/pppd/sys-solaris.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sys-solaris.c 2020-04-03 14:02:19.342905025 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sys-solaris.c 2020-04-07 10:09:50.571118198 +0200 @@ -1550,6 +1550,26 @@ #endif /* defined(INET6) && defined(SOL2) */ } diff --git a/ppp.spec b/ppp.spec index 320796d..42eb0e7 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 4%{?dist} +Release: 5%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -46,8 +46,8 @@ Patch0022: ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patc Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch -# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.8-eaptls-mppe-1.201.patch -Patch0026: ppp-2.4.8-eaptls-mppe-1.201.patch +# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.8-eaptls-mppe-1.300.patch +Patch0026: ppp-2.4.8-eaptls-mppe-1.300.patch Patch0032: ppp-2.4.8-CVE-2020-8597.patch @@ -184,6 +184,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Tue Apr 7 2020 Jaroslav Škarvada - 2.4.8-5 +- Updated EAP-TLS patch to v1.300 + * Mon Apr 6 2020 Jaroslav Škarvada - 2.4.8-4 - Updated EAP-TLS patch to v1.201 From ffcbbaf03226ab2aa6a9bf230a0746091d9d1ead Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 7 Apr 2020 10:54:48 +0200 Subject: [PATCH 07/57] Updated EAP-TLS patch to v1.300 --- ...patch => ppp-2.4.7-eaptls-mppe-1.300.patch | 1047 +++++++++++++---- ppp.spec | 8 +- 2 files changed, 851 insertions(+), 204 deletions(-) rename ppp-2.4.7-eaptls-mppe-1.102.patch => ppp-2.4.7-eaptls-mppe-1.300.patch (75%) diff --git a/ppp-2.4.7-eaptls-mppe-1.102.patch b/ppp-2.4.7-eaptls-mppe-1.300.patch similarity index 75% rename from ppp-2.4.7-eaptls-mppe-1.102.patch rename to ppp-2.4.7-eaptls-mppe-1.300.patch index 598d1da..d635696 100644 --- a/ppp-2.4.7-eaptls-mppe-1.102.patch +++ b/ppp-2.4.7-eaptls-mppe-1.300.patch @@ -1,7 +1,7 @@ -diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls +diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.300/README.eap-tls --- ppp-2.4.7/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls 2018-11-02 17:14:08.101636586 +0100 -@@ -0,0 +1,291 @@ ++++ ppp-2.4.7-eaptls-mppe-1.300/README.eap-tls 2020-04-03 11:52:15.686777964 +0200 +@@ -0,0 +1,307 @@ +EAP-TLS authentication support for PPP +====================================== + @@ -293,9 +293,25 @@ diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls + - Print warning when certificate is either not yet valid or has expired. + - Perform better peer certificate checks. + - Allow certificate chain files to be used. -diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-client ++v1.200 (28-Feb-2020) ++ - First version of patch that was used to create a github PR against the main ppp code base. ++ - Add client-side 'capath' option to allow a directory with trusted CA certificates. ++ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or ++ use the ones supplied by OpenSSL. ++ - Code now also builds on Solaris (x86 tested) but has not been tested yet, as the Solaris ppp ++ kernel driver does not support MPPE. ++v1.201 (03-Apr-2020) ++ - Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that ++ you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation. ++v1.300 (03-Apr-2020) ++ - Add (experimental) TLS 1.3 support. This is based on draft-ietf-emu-eap-tls13-05 (expired) and ++ requires OpenSSL 1.1.1+ to be effective. ++ - Add new option 'max-tls-version' to specify the highest version of the TLS protocol to use ++ (defaults to TLS1.2 for now - so to use TLS1.3 you need to explicitly add 'max-tls-version 1.3') ++ +diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.300/etc.ppp/eaptls-client --- ppp-2.4.7/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-client 2018-10-30 16:47:59.527263750 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/etc.ppp/eaptls-client 2020-03-23 09:20:59.000000000 +0100 @@ -0,0 +1,10 @@ +# Parameters for authentication using EAP-TLS (client) + @@ -307,9 +323,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/e +# client private key file (required) + +#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-server +diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.300/etc.ppp/eaptls-server --- ppp-2.4.7/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-server 2018-10-30 16:47:59.527263750 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/etc.ppp/eaptls-server 2020-03-23 09:20:59.000000000 +0100 @@ -0,0 +1,11 @@ +# Parameters for authentication using EAP-TLS (server) + @@ -322,9 +338,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/e +# allowed addresses (required, can be *) + +#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/openssl.cnf +diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.300/etc.ppp/openssl.cnf --- ppp-2.4.7/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/openssl.cnf 2018-10-30 16:47:59.527263750 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/etc.ppp/openssl.cnf 2020-03-23 09:20:59.000000000 +0100 @@ -0,0 +1,14 @@ +openssl_conf = openssl_def + @@ -340,9 +356,9 @@ diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/ope +MODULE_PATH = /usr/lib64/libeTPkcs11.so +init = 0 + -diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.102/linux/Makefile.top +diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.300/linux/Makefile.top --- ppp-2.4.7/linux/Makefile.top 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/linux/Makefile.top 2018-10-30 16:47:59.528263707 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/linux/Makefile.top 2020-03-23 09:20:59.000000000 +0100 @@ -26,7 +26,7 @@ cd pppdump; $(MAKE) $(MFLAGS) install @@ -363,38 +379,133 @@ diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.102/linux/Makefi $(BINDIR): $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/pppd/Makefile.linux +diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.300/pppd/Makefile.linux --- ppp-2.4.7/pppd/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/Makefile.linux 2018-10-30 16:47:59.528263707 +0100 -@@ -76,6 +76,9 @@ ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/Makefile.linux 2020-03-23 09:20:59.000000000 +0100 +@@ -11,16 +11,16 @@ + + TARGETS = pppd + +-PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c md5.c ccp.c \ +- ecp.c ipxcp.c auth.c options.c sys-linux.c md4.c chap_ms.c \ ++PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c ccp.c \ ++ ecp.c ipxcp.c auth.c options.c sys-linux.c chap_ms.c \ + demand.c utils.c tty.c eap.c chap-md5.c session.c + + HEADERS = ccp.h session.h chap-new.h ecp.h fsm.h ipcp.h \ +- ipxcp.h lcp.h magic.h md5.h patchlevel.h pathnames.h pppd.h \ ++ ipxcp.h lcp.h magic.h patchlevel.h pathnames.h pppd.h \ + upap.h eap.h + + MANPAGES = pppd.8 +-PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o md5.o ccp.o \ ++PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o ccp.o \ + ecp.o auth.o options.o demand.o utils.o sys-linux.o ipxcp.o tty.o \ + eap.o chap-md5.o session.o + +@@ -76,6 +76,13 @@ # Use libutil USE_LIBUTIL=y -+# Enable EAP-TLS authentication (requires libssl and libcrypto) ++# Enable EAP-TLS authentication (requires MPPE support, libssl and libcrypto) +USE_EAPTLS=y ++ ++# Either use the internal {md5,sha1} routines or use the openssl versions ++USE_OPENSSL_MD5=y ++USE_OPENSSL_SHA1=y + MAXOCTETS=y INCLUDE_DIRS= -I../include -@@ -115,6 +118,15 @@ - PPPDOBJS += sha1.o +@@ -87,8 +94,9 @@ + ifdef CHAPMS + CFLAGS += -DCHAPMS=1 + NEEDDES=y +-PPPDOBJS += md4.o chap_ms.o ++PPPDSRC += md4.c chap_ms.c + HEADERS += md4.h chap_ms.h ++PPPDOBJS += md4.o chap_ms.o + ifdef MSLANMAN + CFLAGS += -DMSLANMAN=1 endif - +@@ -106,11 +114,31 @@ + MANPAGES += srp-entry.8 + EXTRACLEAN += srp-entry.o + NEEDDES=y ++endif ++ +# EAP-TLS +ifdef USE_EAPTLS -+CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include ++CFLAGS += -DUSE_EAPTLS=1 +LIBS += -lssl -lcrypto +PPPDSRC += eap-tls.c +HEADERS += eap-tls.h +PPPDOBJS += eap-tls.o +endif + - ifdef HAS_SHADOW - CFLAGS += -DHAS_SHADOW - #LIBS += -lshadow $(LIBS) -diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c ++ifdef USE_OPENSSL_MD5 ++CFLAGS += -DUSE_OPENSSL_MD5=1 ++LIBS += -lcrypto ++else ++PPPDSRC += md5.c ++HEADERS += md5.h ++PPPDOBJS += md5.o ++endif ++ ++ifdef USE_OPENSSL_SHA1 ++CFLAGS += -DUSE_OPENSSL_SHA1=1 ++LIBS += -lcrypto + else +-# OpenSSL has an integrated version of SHA-1, and its implementation +-# is incompatible with this local SHA-1 implementation. We must use +-# one or the other, not both. +-PPPDSRCS += sha1.c ++PPPDSRC += sha1.c + HEADERS += sha1.h + PPPDOBJS += sha1.o + endif +diff -Naur ppp-2.4.7/pppd/Makefile.sol2 ppp-2.4.7-eaptls-mppe-1.300/pppd/Makefile.sol2 +--- ppp-2.4.7/pppd/Makefile.sol2 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/Makefile.sol2 2020-03-23 09:20:59.000000000 +0100 +@@ -5,10 +5,10 @@ + + include ../Makedefs.com + +-CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="@DESTDIR@"' ++CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="/usr/local"' + LIBS = -lsocket -lnsl + +-OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o md5.o \ ++OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o \ + tty.o ccp.o ecp.o auth.o options.o demand.o utils.o sys-solaris.o \ + chap-md5.o session.o + +@@ -37,7 +37,21 @@ + + # Uncomment to enable MS-CHAP + CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H +-OBJS += chap_ms.o pppcrypt.o md4.o sha1.o ++OBJS += chap_ms.o pppcrypt.o md4.o ++ ++# Uncomment to enable MPPE (in both CHAP and EAP-TLS) ++CFLAGS += -DMPPE ++ ++# Uncomment to use the OpenSSL {md5,sha1} routines ++#CFLAGS += -DUSE_OPENSSL_MD5 -DUSE_OPENSSL_SHA1 ++#LIBS += -lcrypto ++# else ++OBJS += md5.o sha1.o ++ ++# Uncomment to enable EAP-TLS ++CFLAGS += -DUSE_EAPTLS ++LIBS += -lcrypto -lssl ++OBJS += eap-tls.o + + # Uncomment for CBCP + #CFLAGS += -DCBCP_SUPPORT +diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.300/pppd/auth.c --- ppp-2.4.7/pppd/auth.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c 2018-10-30 16:47:59.530263608 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/auth.c 2020-04-02 15:28:19.000000000 +0200 @@ -109,6 +109,9 @@ #include "upap.h" #include "chap-new.h" @@ -417,22 +528,24 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c /* Hook for a plugin to say whether it is OK if the peer refuses to authenticate. */ int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -238,6 +246,14 @@ +@@ -238,6 +246,16 @@ bool explicit_user = 0; /* Set if "user" option supplied */ bool explicit_passwd = 0; /* Set if "password" option supplied */ char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ +#ifdef USE_EAPTLS +char *cacert_file = NULL; /* CA certificate file (pem format) */ ++char *ca_path = NULL; /* directory with CA certificates */ +char *cert_file = NULL; /* client certificate file (pem format) */ +char *privkey_file = NULL; /* client private key file (pem format) */ +char *crl_dir = NULL; /* directory containing CRL files */ +char *crl_file = NULL; /* Certificate Revocation List (CRL) file (pem format) */ ++char *max_tls_version = NULL; /* Maximum TLS protocol version (default=1.2) */ +bool need_peer_eap = 0; /* Require peer to authenticate us */ +#endif static char *uafname; /* name of most recent +ua file */ -@@ -254,6 +270,19 @@ +@@ -254,6 +272,19 @@ static int have_chap_secret __P((char *, char *, int, int *)); static int have_srp_secret __P((char *client, char *server, int need_ip, int *lacks_ipp)); @@ -452,23 +565,26 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); static int scan_authfile __P((FILE *, char *, char *, char *, struct wordlist **, struct wordlist **, -@@ -401,6 +430,15 @@ +@@ -401,6 +432,18 @@ "Set telephone number(s) which are allowed to connect", OPT_PRIV | OPT_A2LIST }, +#ifdef USE_EAPTLS + { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, ++ { "capath", o_string, &ca_path, "EAP-TLS CA certificate directory" }, + { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, + { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, + { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, + { "crl", o_string, &crl_file, "Use specific CRL file" }, ++ { "max-tls-version", o_string, &max_tls_version, ++ "Maximum TLS version (1.0/1.1/1.2 (default)/1.3)" }, + { "need-peer-eap", o_bool, &need_peer_eap, + "Require the peer to authenticate us", 1 }, +#endif /* USE_EAPTLS */ { NULL } }; -@@ -730,6 +768,9 @@ +@@ -730,6 +773,9 @@ lcp_options *wo = &lcp_wantoptions[unit]; lcp_options *go = &lcp_gotoptions[unit]; lcp_options *ho = &lcp_hisoptions[unit]; @@ -478,7 +594,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c int i; struct protent *protp; -@@ -764,6 +805,22 @@ +@@ -764,6 +810,22 @@ } } @@ -501,7 +617,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c new_phase(PHASE_AUTHENTICATE); auth = 0; if (go->neg_eap) { -@@ -1277,6 +1334,15 @@ +@@ -1277,6 +1339,15 @@ our_name, 1, &lacks_ip); } @@ -517,7 +633,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c if (auth_required && !can_auth && noauth_addrs == NULL) { if (default_auth) { option_error( -@@ -1331,7 +1397,11 @@ +@@ -1331,7 +1402,11 @@ passwd[0] != 0 || (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, (explicit_remote? remote_name: NULL), 0, NULL))) || @@ -530,7 +646,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c hadchap = -1; if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1346,8 +1416,14 @@ +@@ -1346,8 +1421,14 @@ !have_chap_secret((explicit_remote? remote_name: NULL), our_name, 1, NULL))) && !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, @@ -546,7 +662,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c } -@@ -1707,6 +1783,7 @@ +@@ -1707,6 +1788,7 @@ } @@ -554,7 +670,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c /* * get_secret - open the CHAP secret file and return the secret * for authenticating the given client on the given server. -@@ -2359,3 +2436,335 @@ +@@ -2359,3 +2441,345 @@ auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); } @@ -631,7 +747,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + else if (server != NULL && server[0] == 0) + server = NULL; + -+ if (cacert_file && cert_file && privkey_file) ++ if ((cacert_file || ca_path) && cert_file && privkey_file) + return 1; + + filename = _PATH_EAPTLSCLIFILE; @@ -823,13 +939,14 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + +int +get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, am_server) ++ cacertfile, capath, pkfile, am_server) + int unit; + char *client; + char *server; + char *clicertfile; + char *servcertfile; + char *cacertfile; ++ char *capath; + char *pkfile; + int am_server; +{ @@ -839,13 +956,22 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + struct wordlist *addrs = NULL; + struct wordlist *opts = NULL; + -+ /* in client mode the ca+cert+privkey can also be specified as options */ -+ if (!am_server && cacert_file && cert_file && privkey_file ) ++ /* maybe overkill, but it eases debugging */ ++ bzero(clicertfile, MAXWORDLEN); ++ bzero(servcertfile, MAXWORDLEN); ++ bzero(cacertfile, MAXWORDLEN); ++ bzero(capath, MAXWORDLEN); ++ bzero(pkfile, MAXWORDLEN); ++ ++ /* the ca+cert+privkey can also be specified as options */ ++ if (!am_server && (cacert_file || ca_path) && cert_file && privkey_file ) + { + strlcpy( clicertfile, cert_file, MAXWORDLEN ); -+ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); ++ if (cacert_file) ++ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); ++ if (ca_path) ++ strlcpy( capath, ca_path, MAXWORDLEN ); + strlcpy( pkfile, privkey_file, MAXWORDLEN ); -+ servcertfile[0] = '\0'; + } + else + { @@ -890,9 +1016,9 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c +} +#endif + -diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c +diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.300/pppd/ccp.c --- ppp-2.4.7/pppd/ccp.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c 2018-10-30 16:47:59.531263554 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/ccp.c 2020-03-23 09:20:59.000000000 +0100 @@ -540,6 +540,9 @@ if (go->mppe) { ccp_options *ao = &ccp_allowoptions[f->unit]; @@ -928,28 +1054,68 @@ diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c lcp_close(f->unit, "MPPE required but not available"); return; } -diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.102/pppd/chap-md5.c +diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.300/pppd/chap-md5.c --- ppp-2.4.7/pppd/chap-md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/chap-md5.c 2018-10-30 16:47:59.532263499 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/chap-md5.c 2020-03-23 09:20:59.000000000 +0100 @@ -36,7 +36,11 @@ #include "chap-new.h" #include "chap-md5.h" #include "magic.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" ++#ifdef USE_OPENSSL_MD5 ++#include "openssl/md5.h" +#else #include "md5.h" -+#endif /* USE_EAPTLS */ ++#endif /* USE_OPENSSL_MD5 */ #define MD5_HASH_SIZE 16 #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c +diff -Naur ppp-2.4.7/pppd/chap_ms.c ppp-2.4.7-eaptls-mppe-1.300/pppd/chap_ms.c +--- ppp-2.4.7/pppd/chap_ms.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/chap_ms.c 2020-03-23 09:20:59.000000000 +0100 +@@ -535,7 +535,7 @@ + char *username, u_char Challenge[8]) + + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char sha1Hash[SHA1_SIGNATURE_SIZE]; + char *user; + +@@ -671,7 +671,7 @@ + 0x6E }; + + int i; +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char Digest[SHA1_SIGNATURE_SIZE]; + u_char Challenge[8]; + +@@ -725,7 +725,7 @@ + void + mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + + SHA1_Init(&sha1Context); +@@ -769,7 +769,7 @@ + mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], + u_char NTResponse[24], int IsServer) + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + +diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.300/pppd/eap-tls.c --- ppp-2.4.7/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c 2018-11-02 16:53:05.996742547 +0100 -@@ -0,0 +1,1383 @@ ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/eap-tls.c 2020-04-03 11:27:59.116631426 +0200 +@@ -0,0 +1,1560 @@ +/* * eap-tls.c - EAP-TLS implementation for PPP + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * Jan Just Keijser 2006-2019 All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions @@ -978,6 +1144,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + */ + +#include ++#include +#include +#include +#include @@ -996,13 +1163,30 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c +#include "lcp.h" +#include "pathnames.h" + ++typedef struct pw_cb_data ++{ ++ const void *password; ++ const char *prompt_info; ++} PW_CB_DATA; ++ +/* The openssl configuration file and engines can be loaded only once */ +static CONF *ssl_config = NULL; +static ENGINE *cert_engine = NULL; +static ENGINE *pkey_engine = NULL; + -+#ifdef MPPE ++/* TLSv1.3 do we have a session ticket ? */ ++static int have_session_ticket = 0; + ++int ssl_verify_callback(int, X509_STORE_CTX *); ++void ssl_msg_callback(int write_p, int version, int ct, const void *buf, ++ size_t len, SSL * ssl, void *arg); ++int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); ++ ++X509 *get_X509_from_file(char *filename); ++int ssl_cmp_certs(char *filename, X509 * a); ++ ++#ifdef MPPE ++ +#define EAPTLS_MPPE_KEY_LEN 32 + +/* @@ -1178,20 +1362,66 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + +#define SSL3_RT_HEADER 0x100 + ++#ifndef SSL_CTX_set_max_proto_version ++/** Mimics SSL_CTX_set_max_proto_version for OpenSSL < 1.1 */ ++static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) ++{ ++ long sslopt = 0; ++ ++ if (tls_ver_max < TLS1_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1; ++ } ++#ifdef SSL_OP_NO_TLSv1_1 ++ if (tls_ver_max < TLS1_1_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1_1; ++ } ++#endif ++#ifdef SSL_OP_NO_TLSv1_2 ++ if (tls_ver_max < TLS1_2_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1_2; ++ } ++#endif ++ SSL_CTX_set_options(ctx, sslopt); ++ ++ return 1; ++} ++#endif /* SSL_CTX_set_max_proto_version */ ++ +#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + + +/* + * Generate keys according to RFC 2716 and add to reply + */ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, -+ int client) ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) +{ + unsigned char out[4*EAPTLS_MPPE_KEY_LEN]; -+ size_t prf_size = strlen(prf_label); ++ const char *prf_label; ++ size_t prf_size; ++ unsigned char eap_tls13_context[] = { EAPT_TLS }; ++ unsigned char *context = NULL; ++ size_t context_len = 0; + unsigned char *p; + -+ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, NULL, 0, 0) != 1) ++ dbglog("EAP-TLS generating MPPE keys"); ++ if (ets->tls_v13) ++ { ++ prf_label = "EXPORTER_EAP_TLS_Key_Material"; ++ context = eap_tls13_context; ++ context_len = 1; ++ } ++ else ++ { ++ prf_label = "client EAP encryption"; ++ } ++ ++ dbglog("EAP-TLS PRF label = %s", prf_label); ++ prf_size = strlen(prf_label); ++ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, ++ context, context_len, 0) != 1) + { + warn( "EAP-TLS: Failed generating keying material" ); + return; @@ -1220,7 +1450,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + mppe_keys_set = 1; +} + -+#endif ++#endif /* MPPE */ + +void log_ssl_errors( void ) +{ @@ -1327,7 +1557,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + * Initialize the SSL stacks and tests if certificates, key and crl + * for client or server use can be loaded. + */ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, + char *certfile, char *peer_certfile, char *privkeyfile) +{ + char *cert_engine_name = NULL; @@ -1339,26 +1569,33 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + X509_STORE *certstore; + X509_LOOKUP *lookup; + X509 *tmp; -+ int ret; ++ int ret; ++#if defined(TLS1_2_VERSION) ++ long tls_version = TLS1_2_VERSION; ++#elif defined(TLS1_1_VERSION) ++ long tls_version = TLS1_1_VERSION; ++#else ++ long tls_version = TLS1_VERSION; ++#endif + + /* + * Without these can't continue + */ -+ if (!cacertfile[0]) ++ if (!(cacertfile[0] || capath[0])) + { -+ error("EAP-TLS: CA certificate missing"); ++ error("EAP-TLS: CA certificate file or path missing"); + return NULL; + } + + if (!certfile[0]) + { -+ error("EAP-TLS: User certificate missing"); ++ error("EAP-TLS: Certificate missing"); + return NULL; + } + + if (!privkeyfile[0]) + { -+ error("EAP-TLS: User private key missing"); ++ error("EAP-TLS: Private key missing"); + return NULL; + } + @@ -1458,9 +1695,14 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + SSL_CTX_set_default_passwd_cb (ctx, password_callback); + -+ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) ++ if (strlen(cacertfile) == 0) cacertfile = NULL; ++ if (strlen(capath) == 0) capath = NULL; ++ ++ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, capath)) + { -+ error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); ++ error("EAP-TLS: Cannot load verify locations"); ++ if (cacertfile) dbglog("CA certificate file = [%s]", cacertfile); ++ if (capath) dbglog("CA certificate path = [%s]", capath); + goto fail; + } + @@ -1583,6 +1825,52 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c +#endif + ); + ++ /* OpenSSL 1.1.1+ does not include RC4 ciphers by default. ++ * This causes totally obsolete WinXP clients to fail. If you really ++ * need ppp+EAP-TLS+openssl 1.1.1+WinXP then enable RC4 cipers and ++ * make sure that you use an OpenSSL that supports them ++ ++ SSL_CTX_set_cipher_list(ctx, "RC4"); ++ */ ++ ++ ++ /* Set up a SSL Session cache with a callback. This is needed for TLSv1.3+. ++ * During the initial handshake the server signals to the client early on ++ * that the handshake is finished, even before the client has sent its ++ * credentials to the server. The actual connection (and moment that the ++ * client sends its credentials) only starts after the arrival of the first ++ * session ticket. The 'ssl_new_session_cb' catches this ticket. ++ */ ++ SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL_STORE); ++ SSL_CTX_sess_set_new_cb(ctx, ssl_new_session_cb); ++ ++ /* As EAP-TLS+TLSv1.3 is highly experimental we offer the user a chance to override */ ++ if (max_tls_version) ++ { ++ if (strncmp(max_tls_version, "1.0", 3) == 0) ++ tls_version = TLS1_VERSION; ++ else if (strncmp(max_tls_version, "1.1", 3) == 0) ++ tls_version = TLS1_1_VERSION; ++ else if (strncmp(max_tls_version, "1.2", 3) == 0) ++#ifdef TLS1_2_VERSION ++ tls_version = TLS1_2_VERSION; ++#else ++ { ++ warn("TLSv1.2 not available. Defaulting to TLSv1.1"); ++ tls_version = TLS_1_1_VERSION; ++ } ++#endif ++ else if (strncmp(max_tls_version, "1.3", 3) == 0) ++#ifdef TLS1_3_VERSION ++ tls_version = TLS1_3_VERSION; ++#else ++ warn("TLSv1.3 not available."); ++#endif ++ } ++ ++ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); ++ SSL_CTX_set_max_proto_version(ctx, tls_version); ++ + SSL_CTX_set_verify_depth(ctx, 5); + SSL_CTX_set_verify(ctx, + SSL_VERIFY_PEER | @@ -1685,6 +1973,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + char servcertfile[MAXWORDLEN]; + char clicertfile[MAXWORDLEN]; + char cacertfile[MAXWORDLEN]; ++ char capath[MAXWORDLEN]; + char pkfile[MAXWORDLEN]; + /* + * Allocate new eaptls session @@ -1704,7 +1993,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog( "getting eaptls secret" ); + if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, + esp->es_server.ea_name, clicertfile, -+ servcertfile, cacertfile, pkfile, 1)) { ++ servcertfile, cacertfile, capath, pkfile, 1)) { + error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", + esp->es_server.ea_peer, esp->es_server.ea_name ); + return 0; @@ -1712,7 +2001,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + ets->mtu = eaptls_get_mtu(esp->es_unit); + -+ ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); ++ ets->ctx = eaptls_init_ssl(1, cacertfile, capath, servcertfile, clicertfile, pkfile); + if (!ets->ctx) + goto fail; + @@ -1742,6 +2031,8 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + SSL_set_accept_state(ets->ssl); + ++ ets->tls_v13 = 0; ++ + ets->data = NULL; + ets->datalen = 0; + ets->alert_sent = 0; @@ -1772,6 +2063,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + char servcertfile[MAXWORDLEN]; + char clicertfile[MAXWORDLEN]; + char cacertfile[MAXWORDLEN]; ++ char capath[MAXWORDLEN]; + char pkfile[MAXWORDLEN]; + + /* @@ -1796,14 +2088,14 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog( "calling get_eaptls_secret" ); + if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, + ets->peer, clicertfile, -+ servcertfile, cacertfile, pkfile, 0)) { ++ servcertfile, cacertfile, capath, pkfile, 0)) { + error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", + esp->es_client.ea_name, ets->peer ); + return 0; + } + + dbglog( "calling eaptls_init_ssl" ); -+ ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); ++ ets->ctx = eaptls_init_ssl(0, cacertfile, capath, clicertfile, servcertfile, pkfile); + if (!ets->ctx) + goto fail; + @@ -1831,6 +2123,8 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + SSL_set_connect_state(ets->ssl); + ++ ets->tls_v13 = 0; ++ + ets->data = NULL; + ets->datalen = 0; + ets->alert_sent = 0; @@ -1866,6 +2160,20 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + free(ets); +} + ++ ++int eaptls_is_init_finished(struct eaptls_session *ets) ++{ ++ if (ets->ssl && SSL_is_init_finished(ets->ssl)) ++ { ++ if (ets->tls_v13) ++ return have_session_ticket; ++ else ++ return 1; ++ } ++ ++ return 0; ++} ++ +/* + * Handle a received packet, reassembling fragmented messages and + * passing them to the ssl engine @@ -1986,10 +2294,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + start = *outp; + -+ if (!ets->data) { -+ ++ if (!ets->data) ++ { + if(!ets->alert_sent) -+ SSL_read(ets->ssl, fromtls, 65536); ++ { ++ res = SSL_read(ets->ssl, fromtls, 65536); ++ } + + /* + * Read from ssl @@ -2232,7 +2542,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + strcat(string, "TLS 1.2"); + break; + default: -+ strcat(string, "Unknown version"); ++ sprintf(string, "SSL/TLS Header: Unknown version (%d)", hvers); + } + break; + @@ -2255,6 +2565,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + strcat(string, "ChangeCipherSpec"); + break; + ++#ifdef SSL3_RT_INNER_CONTENT_TYPE ++ case SSL3_RT_INNER_CONTENT_TYPE: ++ strcat(string, "InnerContentType (TLS1.3)"); ++ break; ++#endif ++ + case SSL3_RT_HANDSHAKE: + + strcat(string, "Handshake: "); @@ -2275,6 +2591,16 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + strcat(string,"New Session Ticket"); + break; +#endif ++#ifdef SSL3_MT_END_OF_EARLY_DATA ++ case SSL3_MT_END_OF_EARLY_DATA: ++ strcat(string,"End of Early Data"); ++ break; ++#endif ++#ifdef SSL3_MT_ENCRYPTED_EXTENSIONS ++ case SSL3_MT_ENCRYPTED_EXTENSIONS: ++ strcat(string,"Encryped Extensions"); ++ break; ++#endif + case SSL3_MT_CERTIFICATE: + strcat(string,"Certificate"); + break; @@ -2309,6 +2635,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + case TLS1_2_VERSION: + strcat(string, "TLS 1.2"); + break; ++#ifdef TLS1_3_VERSION ++ case TLS1_3_VERSION: ++ strcat(string, "TLS 1.3 (experimental)"); ++ ets->tls_v13 = 1; ++ break; ++#endif + default: + strcat(string, "Unknown version"); + } @@ -2330,14 +2662,25 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog("%s", string); +} + -diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h ++int ++ssl_new_session_cb(SSL *s, SSL_SESSION *sess) ++{ ++ dbglog("EAP-TLS: Post-Handshake New Session Ticket arrived:"); ++ have_session_ticket = 1; ++ ++ /* always return success */ ++ return 1; ++} ++ +diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.300/pppd/eap-tls.h --- ppp-2.4.7/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h 2018-10-30 16:47:59.534263383 +0100 -@@ -0,0 +1,107 @@ ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/eap-tls.h 2020-04-02 17:24:02.000000000 +0200 +@@ -0,0 +1,96 @@ +/* + * eap-tls.h + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * Jan Just Keijser 2006-2019 All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions @@ -2372,7 +2715,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h + +#include +#include -+#include + +#define EAP_TLS_FLAGS_LI 128 /* length included flag */ +#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ @@ -2384,11 +2726,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h +{ + u_char *data; /* buffered data */ + int datalen; /* buffered data len */ -+ int offset; /* from where to send */ -+ int tlslen; /* total length of tls data */ -+ bool frag; /* packet is fragmented */ ++ int offset; /* from where to send */ ++ int tlslen; /* total length of tls data */ ++ bool frag; /* packet is fragmented */ ++ bool tls_v13; /* whether we've negotiated TLSv1.3 */ + SSL_CTX *ctx; -+ SSL *ssl; /* ssl connection */ ++ SSL *ssl; /* ssl connection */ + BIO *from_ssl; + BIO *into_ssl; + char peer[MAXWORDLEN]; /* peer name */ @@ -2397,38 +2740,27 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h + u_char alert_sent_desc; + bool alert_recv; + u_char alert_recv_desc; -+ char rtx[65536]; /* retransmission buffer */ ++ char rtx[EAP_TLS_MAX_LEN]; /* retransmission buffer */ + int rtx_len; + int mtu; /* unit mtu */ +}; + -+typedef struct pw_cb_data -+{ -+ const void *password; -+ const char *prompt_info; -+} PW_CB_DATA; + -+ -+int ssl_verify_callback(int, X509_STORE_CTX *); -+void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -+ size_t len, SSL * ssl, void *arg); -+ -+X509 *get_X509_from_file(char *filename); -+int ssl_cmp_certs(char *filename, X509 * a); -+ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, + char *certfile, char *peer_certfile, char *privkeyfile); +int eaptls_init_ssl_server(eap_state * esp); +int eaptls_init_ssl_client(eap_state * esp); +void eaptls_free_session(struct eaptls_session *ets); + ++int eaptls_is_init_finished(struct eaptls_session *ets); ++ +int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); +int eaptls_send(struct eaptls_session *ets, u_char ** outp); +void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); + +int get_eaptls_secret(int unit, char *client, char *server, + char *clicertfile, char *servcertfile, char *cacertfile, -+ char *pkfile, int am_server); ++ char *capath, char *pkfile, int am_server); + +#ifdef MPPE +#include "mppe.h" /* MPPE_MAX_KEY_LEN */ @@ -2436,14 +2768,13 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h +extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +extern int mppe_keys_set; + -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); -+ ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); +#endif + +#endif -diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c +diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.300/pppd/eap.c --- ppp-2.4.7/pppd/eap.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c 2018-10-30 16:47:59.537263209 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/eap.c 2020-04-02 12:05:33.000000000 +0200 @@ -43,6 +43,11 @@ * Based on draft-ietf-pppext-eap-srp-03.txt. */ @@ -2462,15 +2793,30 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #include "pathnames.h" -#include "md5.h" #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" ++#ifdef USE_OPENSSL_MD5 ++#include "openssl/md5.h" +#else +#include "md5.h" -+#endif /* USE_EAPTLS */ ++#endif /* USE_OPENSSL_MD5 */ #ifdef USE_SRP #include -@@ -209,6 +218,9 @@ +@@ -72,8 +81,12 @@ + #include "pppcrypt.h" + #endif /* USE_SRP */ + +-#ifndef SHA_DIGESTSIZE +-#define SHA_DIGESTSIZE 20 ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#endif /* USE_EAPTLS */ ++ ++#ifndef SHA_DIGEST_LENGTH ++#define SHA_DIGEST_LENGTH 20 + #endif + + static const char rcsid[] = RCSID; +@@ -209,6 +222,9 @@ esp->es_server.ea_id = (u_char)(drand48() * 0x100); esp->es_client.ea_timeout = EAP_DEFREQTIME; esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; @@ -2480,7 +2826,18 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c } /* -@@ -436,8 +448,16 @@ +@@ -317,8 +333,8 @@ + { + struct tm *tp; + char tbuf[9]; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + time_t reftime; + + if (pn_secret == NULL) +@@ -436,8 +452,16 @@ u_char vals[2]; struct b64state bs; #endif /* USE_SRP */ @@ -2497,7 +2854,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c switch (esp->es_server.ea_state) { case eapBadAuth: return; -@@ -562,9 +582,79 @@ +@@ -562,9 +586,81 @@ break; } #endif /* USE_SRP */ @@ -2553,18 +2910,20 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + if(SSL_is_init_finished(ets->ssl)) + esp->es_server.ea_state = eapTlsRecvClient; + else -+ esp->es_server.ea_state = eapTlsRecv; ++ /* JJK Add "TLS empty record" message here ??? */ ++ esp->es_server.ea_state = eapTlsRecv; + break; + + case eapTlsSendAck: -+ esp->es_server.ea_state = eapTlsRecv; ++ esp->es_server.ea_state = eapTlsRecv; + break; + + case eapTlsRecvAck: -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } ++ if (status) ++ { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } + + esp->es_server.ea_state = eapTlsSend; + break; @@ -2577,7 +2936,31 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case eapSRP1: #ifdef USE_SRP ts = (struct t_server *)esp->es_server.ea_session; -@@ -718,6 +808,30 @@ +@@ -630,6 +726,10 @@ + } + if (esp->es_server.ea_state == eapBadAuth) + eap_send_failure(esp); ++ ++#ifdef USE_EAPTLS ++ dbglog("EAP id=0x%2x '%s' -> '%s'", esp->es_server.ea_id, eap_state_name(esp->es_server.ea_prev_state), eap_state_name(esp->es_server.ea_state)); ++#endif /* USE_EAPTLS */ + } + + /* +@@ -648,10 +748,10 @@ + char *str; + #ifdef USE_SRP + struct t_server *ts; +- u_char clear[8], cipher[8], dig[SHA_DIGESTSIZE], *optr, *cp; ++ u_char clear[8], cipher[8], dig[SHA_DIGEST_LENGTH], *optr, *cp; + int i, j; + struct b64state b64; +- SHA1_CTX ctxt; ++ SHA_CTX ctxt; + #endif /* USE_SRP */ + + /* Handle both initial auth and restart */ +@@ -718,6 +818,30 @@ INCPTR(esp->es_server.ea_namelen, outp); break; @@ -2608,7 +2991,48 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP case eapSRP1: PUTCHAR(EAPT_SRP, outp); -@@ -904,11 +1018,57 @@ +@@ -764,8 +888,8 @@ + PUTLONG(SRPVAL_EBIT, outp); + ts = (struct t_server *)esp->es_server.ea_session; + assert(ts != NULL); +- BCOPY(t_serverresponse(ts), outp, SHA_DIGESTSIZE); +- INCPTR(SHA_DIGESTSIZE, outp); ++ BCOPY(t_serverresponse(ts), outp, SHA_DIGEST_LENGTH); ++ INCPTR(SHA_DIGEST_LENGTH, outp); + + if (pncrypt_setkey(0)) { + /* Generate pseudonym */ +@@ -805,9 +929,9 @@ + /* Set length and pad out to next 20 octet boundary */ + i = outp - optr - 1; + *optr = i; +- i %= SHA_DIGESTSIZE; ++ i %= SHA_DIGEST_LENGTH; + if (i != 0) { +- while (i < SHA_DIGESTSIZE) { ++ while (i < SHA_DIGEST_LENGTH) { + *outp++ = drand48() * 0x100; + i++; + } +@@ -823,14 +947,14 @@ + while (optr < outp) { + SHA1Final(dig, &ctxt); + cp = dig; +- while (cp < dig + SHA_DIGESTSIZE) ++ while (cp < dig + SHA_DIGEST_LENGTH) + *optr++ ^= *cp++; + SHA1Init(&ctxt); + SHA1Update(&ctxt, &esp->es_server.ea_id, 1); + SHA1Update(&ctxt, esp->es_server.ea_skey, + SESSION_KEY_LEN); +- SHA1Update(&ctxt, optr - SHA_DIGESTSIZE, +- SHA_DIGESTSIZE); ++ SHA1Update(&ctxt, optr - SHA_DIGEST_LENGTH, ++ SHA_DIGEST_LENGTH); + } + } + break; +@@ -904,11 +1028,57 @@ eap_server_timeout(arg) void *arg; { @@ -2666,7 +3090,20 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c /* EAP ID number must not change on timeout. */ eap_send_request(esp); } -@@ -1166,6 +1326,81 @@ +@@ -1155,17 +1325,90 @@ + PUTCHAR(id, outp); + esp->es_client.ea_id = id; + msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) + +- SHA_DIGESTSIZE; ++ SHA_DIGEST_LENGTH; + PUTSHORT(msglen, outp); + PUTCHAR(EAPT_SRP, outp); + PUTCHAR(EAPSRP_CVALIDATOR, outp); + PUTLONG(flags, outp); +- BCOPY(str, outp, SHA_DIGESTSIZE); ++ BCOPY(str, outp, SHA_DIGEST_LENGTH); + + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen); } #endif /* USE_SRP */ @@ -2679,16 +3116,16 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c +eap_state *esp; +u_char id; +{ -+ u_char *outp; -+ int outlen; ++ u_char *outp; ++ int outlen; + u_char *lenloc; + -+ outp = outpacket_buf; ++ outp = outpacket_buf; + -+ MAKEHEADER(outp, PPP_EAP); ++ MAKEHEADER(outp, PPP_EAP); + -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); ++ PUTCHAR(EAP_RESPONSE, outp); ++ PUTCHAR(id, outp); + + lenloc = outp; + INCPTR(2, outp); @@ -2708,7 +3145,6 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); + + esp->es_client.ea_id = id; -+ +} + +/* @@ -2741,14 +3177,50 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + PUTSHORT(outlen, lenloc); + + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ +} +#endif /* USE_EAPTLS */ + static void eap_send_nak(esp, id, type) eap_state *esp; -@@ -1320,6 +1555,11 @@ +@@ -1252,8 +1495,8 @@ + { + u_char val; + u_char *datp, *digp; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + int dsize, fd, olen = len; + + /* +@@ -1262,21 +1505,21 @@ + */ + val = id; + while (len > 0) { +- if ((dsize = len % SHA_DIGESTSIZE) == 0) +- dsize = SHA_DIGESTSIZE; ++ if ((dsize = len % SHA_DIGEST_LENGTH) == 0) ++ dsize = SHA_DIGEST_LENGTH; + len -= dsize; + datp = inp + len; + SHA1Init(&ctxt); + SHA1Update(&ctxt, &val, 1); + SHA1Update(&ctxt, esp->es_client.ea_skey, SESSION_KEY_LEN); + if (len > 0) { +- SHA1Update(&ctxt, datp, SHA_DIGESTSIZE); ++ SHA1Update(&ctxt, datp, SHA_DIGEST_LENGTH); + } else { + SHA1Update(&ctxt, esp->es_client.ea_name, + esp->es_client.ea_namelen); + } + SHA1Final(dig, &ctxt); +- for (digp = dig; digp < dig + SHA_DIGESTSIZE; digp++) ++ for (digp = dig; digp < dig + SHA_DIGEST_LENGTH; digp++) + *datp++ ^= *digp; + } + +@@ -1320,12 +1563,17 @@ char rhostname[256]; MD5_CTX mdContext; u_char hash[MD5_SIGNATURE_SIZE]; @@ -2760,7 +3232,15 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP struct t_client *tc; struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1456,6 +1696,100 @@ + u_char vals[2]; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + int fd; + #endif /* USE_SRP */ + +@@ -1456,6 +1704,96 @@ esp->es_client.ea_namelen); break; @@ -2781,11 +3261,11 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + + esp->es_client.ea_using_eaptls = 1; + -+ if (explicit_remote){ -+ esp->es_client.ea_peer = strdup(remote_name); -+ esp->es_client.ea_peerlen = strlen(remote_name); -+ } else -+ esp->es_client.ea_peer = NULL; ++ if (explicit_remote){ ++ esp->es_client.ea_peer = strdup(remote_name); ++ esp->es_client.ea_peerlen = strlen(remote_name); ++ } else ++ esp->es_client.ea_peer = NULL; + + /* Init ssl session */ + if(!eaptls_init_ssl_client(esp)) { @@ -2797,8 +3277,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + + ets = esp->es_client.ea_session; + eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); + break; + } + @@ -2808,8 +3287,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + + case eapTlsRecvAck: + eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); + break; + + case eapTlsRecv: @@ -2833,9 +3311,9 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + } + + /* Check if TLS handshake is finished */ -+ if(SSL_is_init_finished(ets->ssl)){ ++ if(eaptls_is_init_finished(ets)) { +#ifdef MPPE -+ eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); ++ eaptls_gen_mppe_keys(ets, 1); +#endif + eaptls_free_session(ets); + eap_tls_sendack(esp, id); @@ -2844,10 +3322,8 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + } + + eap_tls_response(esp,id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ -+ break; ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); ++ break; + + default: + eap_send_nak(esp, id, EAPT_TLS); @@ -2861,8 +3337,41 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP case EAPT_SRP: if (len < 1) { -@@ -1737,6 +2071,11 @@ - u_char dig[SHA_DIGESTSIZE]; +@@ -1640,7 +1978,7 @@ + esp->es_client.ea_id, id); + } + } else { +- len -= sizeof (u_int32_t) + SHA_DIGESTSIZE; ++ len -= sizeof (u_int32_t) + SHA_DIGEST_LENGTH; + if (len < 0 || t_clientverify(tc, inp + + sizeof (u_int32_t)) != 0) { + error("EAP: SRP server verification " +@@ -1650,7 +1988,7 @@ + GETLONG(esp->es_client.ea_keyflags, inp); + /* Save pseudonym if user wants it. */ + if (len > 0 && esp->es_usepseudo) { +- INCPTR(SHA_DIGESTSIZE, inp); ++ INCPTR(SHA_DIGEST_LENGTH, inp); + write_pseudonym(esp, inp, len, id); + } + } +@@ -1677,7 +2015,7 @@ + esp->es_client.ea_namelen); + SHA1Final(dig, &ctxt); + eap_srp_response(esp, id, EAPSRP_LWRECHALLENGE, dig, +- SHA_DIGESTSIZE); ++ SHA_DIGEST_LENGTH); + break; + + default: +@@ -1733,10 +2071,15 @@ + #ifdef USE_SRP + struct t_server *ts; + struct t_num A; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ eHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; #endif /* USE_SRP */ +#ifdef USE_EAPTLS @@ -2873,7 +3382,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (esp->es_server.ea_id != id) { dbglog("EAP: discarding Response %d; expected ID %d", id, esp->es_server.ea_id); -@@ -1776,6 +2115,64 @@ +@@ -1776,6 +2119,64 @@ eap_figure_next_state(esp, 0); break; @@ -2884,6 +3393,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + case eapTlsRecv: + + ets = (struct eaptls_session *) esp->es_server.ea_session; ++ + eap_figure_next_state(esp, + eaptls_receive(esp->es_server.ea_session, inp, len)); + @@ -2902,13 +3412,12 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c + + case eapTlsRecvClient: + /* Receive authentication response from client */ -+ + if (len > 0) { + GETCHAR(flags, inp); + + if(len == 1 && !flags) { /* Ack = ok */ +#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); ++ eaptls_gen_mppe_keys( esp->es_server.ea_session, 0 ); +#endif + eap_send_success(esp); + } @@ -2938,7 +3447,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_NOTIFICATION: dbglog("EAP unexpected Notification; response discarded"); break; -@@ -1807,6 +2204,13 @@ +@@ -1807,6 +2208,13 @@ esp->es_server.ea_state = eapMD5Chall; break; @@ -2952,7 +3461,37 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c default: dbglog("EAP: peer requesting unknown Type %d", vallen); switch (esp->es_server.ea_state) { -@@ -2018,13 +2422,27 @@ +@@ -1924,9 +2332,9 @@ + eap_figure_next_state(esp, 1); + break; + } +- if (len < sizeof (u_int32_t) + SHA_DIGESTSIZE) { ++ if (len < sizeof (u_int32_t) + SHA_DIGEST_LENGTH) { + error("EAP: M1 length %d < %d", len, +- sizeof (u_int32_t) + SHA_DIGESTSIZE); ++ sizeof (u_int32_t) + SHA_DIGEST_LENGTH); + eap_figure_next_state(esp, 1); + break; + } +@@ -1963,7 +2371,7 @@ + info("EAP: unexpected SRP Subtype 4 Response"); + return; + } +- if (len != SHA_DIGESTSIZE) { ++ if (len != SHA_DIGEST_LENGTH) { + error("EAP: bad Lightweight rechallenge " + "response"); + return; +@@ -1977,7 +2385,7 @@ + SHA1Update(&ctxt, esp->es_server.ea_peer, + esp->es_server.ea_peerlen); + SHA1Final(dig, &ctxt); +- if (BCMP(dig, inp, SHA_DIGESTSIZE) != 0) { ++ if (BCMP(dig, inp, SHA_DIGEST_LENGTH) != 0) { + error("EAP: failed Lightweight rechallenge"); + eap_send_failure(esp); + break; +@@ -2018,13 +2426,27 @@ int id; int len; { @@ -2981,7 +3520,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (esp->es_client.ea_timeout > 0) { UNTIMEOUT(eap_client_timeout, (void *)esp); } -@@ -2150,6 +2568,9 @@ +@@ -2150,6 +2572,9 @@ int code, id, len, rtype, vallen; u_char *pstart; u_int32_t uval; @@ -2991,7 +3530,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (inlen < EAP_HEADERLEN) return (0); -@@ -2214,6 +2635,24 @@ +@@ -2214,6 +2639,24 @@ } break; @@ -3016,7 +3555,21 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_SRP: if (len < 3) goto truncated; -@@ -2325,6 +2764,25 @@ +@@ -2281,10 +2724,10 @@ + if (uval != 0) { + printer(arg, " f<%X>", uval); + } +- if ((vallen = len) > SHA_DIGESTSIZE) +- vallen = SHA_DIGESTSIZE; ++ if ((vallen = len) > SHA_DIGEST_LENGTH) ++ vallen = SHA_DIGEST_LENGTH; + printer(arg, " ", len, inp, +- len < SHA_DIGESTSIZE ? "?" : ""); ++ len < SHA_DIGEST_LENGTH ? "?" : ""); + INCPTR(vallen, inp); + len -= vallen; + if (len > 0) { +@@ -2325,6 +2768,25 @@ } break; @@ -3042,14 +3595,36 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_NAK: if (len <= 0) { printer(arg, " "); -@@ -2426,3 +2884,4 @@ +@@ -2388,7 +2850,7 @@ + printer(arg, " f<%X>", uval); + } + printer(arg, " ", len, inp, +- len == SHA_DIGESTSIZE ? "" : "?"); ++ len == SHA_DIGEST_LENGTH ? "" : "?"); + INCPTR(len, inp); + len = 0; + break; +@@ -2398,9 +2860,9 @@ + + case EAPSRP_LWRECHALLENGE: + printer(arg, " ", len, inp, +- len == SHA_DIGESTSIZE ? "" : "?"); +- if ((vallen = len) > SHA_DIGESTSIZE) +- vallen = SHA_DIGESTSIZE; ++ len == SHA_DIGEST_LENGTH ? "" : "?"); ++ if ((vallen = len) > SHA_DIGEST_LENGTH) ++ vallen = SHA_DIGEST_LENGTH; + INCPTR(vallen, inp); + len -= vallen; + break; +@@ -2426,3 +2888,4 @@ return (inp - pstart); } + -diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h +diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.300/pppd/eap.h --- ppp-2.4.7/pppd/eap.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h 2018-10-30 16:47:59.537263209 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/eap.h 2020-03-23 09:20:59.000000000 +0100 @@ -84,6 +84,16 @@ eapClosed, /* Authentication not in use */ eapListen, /* Client ready (and timer running) */ @@ -3118,44 +3693,9 @@ diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ -diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.c ---- ppp-2.4.7/pppd/md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.c 2018-10-30 16:47:59.538263156 +0100 -@@ -33,6 +33,8 @@ - *********************************************************************** - */ - -+#ifndef USE_EAPTLS -+ - #include - #include "md5.h" - -@@ -305,3 +307,5 @@ - ** End of md5.c ** - ******************************** (cut) ******************************** - */ -+#endif /* USE_EAPTLS */ -+ -diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.h ---- ppp-2.4.7/pppd/md5.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.h 2018-10-30 16:47:59.538263156 +0100 -@@ -36,6 +36,7 @@ - ** documentation and/or software. ** - *********************************************************************** - */ -+#ifndef USE_EAPTLS - - #ifndef __MD5_INCLUDE__ - -@@ -63,3 +64,5 @@ - - #define __MD5_INCLUDE__ - #endif /* __MD5_INCLUDE__ */ -+ -+#endif /* USE_EAPTLS */ -diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames.h +diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.300/pppd/pathnames.h --- ppp-2.4.7/pppd/pathnames.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames.h 2018-10-30 16:47:59.539263095 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/pathnames.h 2020-03-23 09:20:59.000000000 +0100 @@ -21,6 +21,13 @@ #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" @@ -3170,9 +3710,9 @@ diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux +diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.300/pppd/plugins/Makefile.linux --- ppp-2.4.7/pppd/plugins/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux 2018-10-30 16:47:59.539263095 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/plugins/Makefile.linux 2020-03-23 09:20:59.000000000 +0100 @@ -4,6 +4,9 @@ LDFLAGS = -shared INSTALL = install @@ -3183,9 +3723,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/ppp DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passprompt.c +diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.300/pppd/plugins/passprompt.c --- ppp-2.4.7/pppd/plugins/passprompt.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passprompt.c 2018-10-30 16:47:59.540263023 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/plugins/passprompt.c 2020-03-23 09:20:59.000000000 +0100 @@ -107,4 +107,7 @@ { add_options(options); @@ -3194,9 +3734,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ + eaptls_passwd_hook = promptpass; +#endif } -diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passwordfd.c +diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.300/pppd/plugins/passwordfd.c --- ppp-2.4.7/pppd/plugins/passwordfd.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passwordfd.c 2018-10-30 16:47:59.540263023 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/plugins/passwordfd.c 2020-03-23 09:20:59.000000000 +0100 @@ -79,4 +79,8 @@ chap_check_hook = pwfd_check; @@ -3206,9 +3746,20 @@ diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ + eaptls_passwd_hook = pwfd_passwd; +#endif } -diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 +diff -Naur ppp-2.4.7/pppd/pppcrypt.c ppp-2.4.7-eaptls-mppe-1.300/pppd/pppcrypt.c +--- ppp-2.4.7/pppd/pppcrypt.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/pppcrypt.c 2020-03-23 09:20:59.000000000 +0100 +@@ -31,6 +31,7 @@ + */ + + #include ++#include + #include "pppd.h" + #include "pppcrypt.h" + +diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.300/pppd/pppd.8 --- ppp-2.4.7/pppd/pppd.8 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 2018-10-30 16:47:59.542262870 +0100 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/pppd.8 2020-03-23 09:20:59.000000000 +0100 @@ -248,6 +248,12 @@ compression in the corresponding direction. Use \fInobsdcomp\fR or \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. @@ -3277,22 +3828,23 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B noauth Do not require the peer to authenticate itself. This option is privileged. -diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h +diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.300/pppd/pppd.h --- ppp-2.4.7/pppd/pppd.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h 2018-10-30 16:47:59.542262870 +0100 -@@ -325,6 +325,11 @@ ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/pppd.h 2020-04-02 14:57:50.000000000 +0200 +@@ -325,6 +325,12 @@ extern bool dryrun; /* check everything, print options, exit */ extern int child_wait; /* # seconds to wait for children at end */ +#ifdef USE_EAPTLS +extern char *crl_dir; +extern char *crl_file; ++extern char *max_tls_version; +#endif /* USE_EAPTLS */ + #ifdef MAXOCTETS extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ extern int maxoctets_dir; /* Direction : -@@ -741,6 +746,10 @@ +@@ -741,6 +747,10 @@ extern int (*chap_passwd_hook) __P((char *user, char *passwd)); extern void (*multilink_join_hook) __P((void)); @@ -3303,3 +3855,94 @@ diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h /* Let a plugin snoop sent and received packets. Useful for L2TP */ extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); extern void (*snoop_send_hook) __P((unsigned char *p, int len)); +diff -Naur ppp-2.4.7/pppd/sha1.c ppp-2.4.7-eaptls-mppe-1.300/pppd/sha1.c +--- ppp-2.4.7/pppd/sha1.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/sha1.c 2020-03-23 09:20:59.000000000 +0100 +@@ -100,7 +100,7 @@ + /* SHA1Init - Initialize new context */ + + void +-SHA1_Init(SHA1_CTX *context) ++SHA1_Init(SHA_CTX *context) + { + /* SHA1 initialization constants */ + context->state[0] = 0x67452301; +@@ -115,7 +115,7 @@ + /* Run your data through this. */ + + void +-SHA1_Update(SHA1_CTX *context, const unsigned char *data, unsigned int len) ++SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len) + { + unsigned int i, j; + +@@ -139,7 +139,7 @@ + /* Add padding and return the message digest. */ + + void +-SHA1_Final(unsigned char digest[20], SHA1_CTX *context) ++SHA1_Final(unsigned char *digest, SHA_CTX *context) + { + u_int32_t i, j; + unsigned char finalcount[8]; +diff -Naur ppp-2.4.7/pppd/sha1.h ppp-2.4.7-eaptls-mppe-1.300/pppd/sha1.h +--- ppp-2.4.7/pppd/sha1.h 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/sha1.h 2020-03-23 09:20:59.000000000 +0100 +@@ -1,11 +1,5 @@ + /* sha1.h */ + +-/* If OpenSSL is in use, then use that version of SHA-1 */ +-#ifdef OPENSSL +-#include +-#define __SHA1_INCLUDE_ +-#endif +- + #ifndef __SHA1_INCLUDE_ + + #ifndef SHA1_SIGNATURE_SIZE +@@ -20,11 +14,11 @@ + u_int32_t state[5]; + u_int32_t count[2]; + unsigned char buffer[64]; +-} SHA1_CTX; ++} SHA_CTX; + +-extern void SHA1_Init(SHA1_CTX *); +-extern void SHA1_Update(SHA1_CTX *, const unsigned char *, unsigned int); +-extern void SHA1_Final(unsigned char[SHA1_SIGNATURE_SIZE], SHA1_CTX *); ++extern void SHA1_Init(SHA_CTX *context); ++extern void SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len); ++extern void SHA1_Final(unsigned char *data, SHA_CTX *context); + + #define __SHA1_INCLUDE_ + #endif /* __SHA1_INCLUDE_ */ +diff -Naur ppp-2.4.7/pppd/sys-solaris.c ppp-2.4.7-eaptls-mppe-1.300/pppd/sys-solaris.c +--- ppp-2.4.7/pppd/sys-solaris.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.300/pppd/sys-solaris.c 2020-03-23 09:20:59.000000000 +0100 +@@ -1534,6 +1534,26 @@ + #endif /* defined(INET6) && defined(SOL2) */ + } + ++ ++ ++/* ++ * netif_get_mtu - get the MTU on the PPP network interface. ++ */ ++int ++netif_get_mtu(int unit) ++{ ++ struct ifreq ifr; ++ ++ memset (&ifr, '\0', sizeof (ifr)); ++ strlcpy(ifr.ifr_name, ifname, sizeof (ifr.ifr_name)); ++ ++ if (ioctl(ipfd, SIOCGIFMTU, (caddr_t) &ifr) < 0) { ++ error("ioctl(SIOCGIFMTU): %m (line %d)", __LINE__); ++ return 0; ++ } ++ return ifr.ifr_mtu; ++} ++ + /* + * tty_send_config - configure the transmit characteristics of + * the ppp interface. diff --git a/ppp.spec b/ppp.spec index 086b66e..ffa513c 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 34%{?dist} +Release: 35%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -46,7 +46,8 @@ Patch0022: 0022-build-sys-compile-pppol2tp-with-multilink-support.patch Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: 0025-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: ppp-2.4.7-eaptls-mppe-1.102.patch +# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.7-eaptls-mppe-1.300.patch +Patch0026: ppp-2.4.7-eaptls-mppe-1.300.patch Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch # rhbz#1556132 @@ -185,6 +186,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Tue Apr 7 2020 Jaroslav Škarvada - 2.4.7-35 +- Updated EAP-TLS patch to v1.300 + * Fri Feb 21 2020 Jaroslav Škarvada - 2.4.7-34 - Fixed buffer overflow in the eap_request and eap_response functions Resolves: CVE-2020-8597 From 568dc9d422eb69cd289098028efe6a60b54a7540 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Thu, 21 May 2020 20:03:30 +0200 Subject: [PATCH 08/57] Added missing options to man pages --- ppp-2.4.8-man-fix.patch | 46 +++++++++++++++++++++++++++++++++++++++++ ppp.spec | 7 ++++++- 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.8-man-fix.patch diff --git a/ppp-2.4.8-man-fix.patch b/ppp-2.4.8-man-fix.patch new file mode 100644 index 0000000..4ecf1f5 --- /dev/null +++ b/ppp-2.4.8-man-fix.patch @@ -0,0 +1,46 @@ +diff --git a/pppdump/pppdump.8 b/pppdump/pppdump.8 +index 4072e68..1116b85 100644 +--- a/pppdump/pppdump.8 ++++ b/pppdump/pppdump.8 +@@ -13,6 +13,8 @@ pppdump \- convert PPP record file to readable format + ]] [ + .B \-r + ] [ ++.B \-a ++] [ + .B \-m \fImru + ] [ + .I file \fR... +@@ -54,6 +56,9 @@ Reverses the direction indicators, so that `sent' is printed for + bytes or packets received, and `rcvd' is printed for bytes or packets + sent. + .TP ++.B \-a ++Prints absolute times. ++.TP + .B \-m \fImru + Use \fImru\fR as the MRU (maximum receive unit) for both directions of + the link when checking for over-length PPP packets (with the \fB\-p\fR +diff --git a/pppstats/pppstats.8 b/pppstats/pppstats.8 +index 4ac101e..cabf4d7 100644 +--- a/pppstats/pppstats.8 ++++ b/pppstats/pppstats.8 +@@ -7,6 +7,8 @@ pppstats \- print PPP statistics + [ + .B \-a + ] [ ++.B \-d ++] [ + .B \-v + ] [ + .B \-r +@@ -41,6 +43,9 @@ reports show statistics for the time since the link was initiated. + Without this option, the second and subsequent reports show statistics + for the time since the last report. + .TP ++.B \-d ++Show data rate (kB/s) instead of bytes. ++.TP + .B \-c \fIcount + Repeat the display + .I count diff --git a/ppp.spec b/ppp.spec index 42eb0e7..51e577f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 5%{?dist} +Release: 6%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -50,6 +50,8 @@ Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patc Patch0026: ppp-2.4.8-eaptls-mppe-1.300.patch Patch0032: ppp-2.4.8-CVE-2020-8597.patch +# rhbz#1612918, https://github.com/paulusmack/ppp/pull/149 +Patch0033: ppp-2.4.8-man-fix.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -184,6 +186,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Thu May 21 2020 Jaroslav Škarvada - 2.4.8-6 +- Added missing options to man pages + * Tue Apr 7 2020 Jaroslav Škarvada - 2.4.8-5 - Updated EAP-TLS patch to v1.300 From 22365d4cf2dfb4afdb38ad3ae46b98bbf35adf3e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 22:56:17 +0000 Subject: [PATCH 09/57] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 51e577f..5c006f5 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 6%{?dist} +Release: 7%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -186,6 +186,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 2.4.8-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Thu May 21 2020 Jaroslav Škarvada - 2.4.8-6 - Added missing options to man pages From a9d0d03ee8d59233b76365dfb4cb0e345e8eaf70 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 10 Aug 2020 19:51:14 +0200 Subject: [PATCH 10/57] Added workaround for Windows Server 2019 Resolves: rhbz#1867047 --- ppp-2.4.8-ws-2019-workaround.patch | 27 +++++++++++++++++++++++++++ ppp.spec | 8 +++++++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.8-ws-2019-workaround.patch diff --git a/ppp-2.4.8-ws-2019-workaround.patch b/ppp-2.4.8-ws-2019-workaround.patch new file mode 100644 index 0000000..837a206 --- /dev/null +++ b/ppp-2.4.8-ws-2019-workaround.patch @@ -0,0 +1,27 @@ +From 3cd95baf3f1de1d5a9bc89be0f4c3215ceb5aefe Mon Sep 17 00:00:00 2001 +From: yannayl +Date: Sun, 12 Jul 2020 12:12:08 +0300 +Subject: [PATCH] Accept Malformed Windows Success Message + +Windows Server 2019 skip a space when sending a success message. +This commit accepts such a malformed message and continues normally. + +Signed-off-by: Yannay Linveh +Signed-off-by: yannayl +--- + pppd/chap_ms.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c +index 1de50428..ffb6bd13 100644 +--- a/pppd/chap_ms.c ++++ b/pppd/chap_ms.c +@@ -423,6 +423,8 @@ chapms2_check_success(int id, unsigned char *msg, int len) + len -= MS_AUTH_RESPONSE_LENGTH; + if ((len >= 3) && !strncmp((char *)msg, " M=", 3)) { + msg += 3; /* Eat the delimiter */ ++ } else if ((len >= 2) && !strncmp((char *)msg, "M=", 2)) { ++ msg += 2; /* Eat the delimiter */ + } else if (len) { + /* Packet has extra text which does not begin " M=" */ + error("MS-CHAPv2 Success packet is badly formed."); diff --git a/ppp.spec b/ppp.spec index 5c006f5..537625c 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 7%{?dist} +Release: 8%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -52,6 +52,8 @@ Patch0026: ppp-2.4.8-eaptls-mppe-1.300.patch Patch0032: ppp-2.4.8-CVE-2020-8597.patch # rhbz#1612918, https://github.com/paulusmack/ppp/pull/149 Patch0033: ppp-2.4.8-man-fix.patch +# rhbz#1867047, https://github.com/paulusmack/ppp/commit/3cd95baf3f1de1d5a9bc89be0f4c3215ceb5aefe.patch +Patch0034: ppp-2.4.8-ws-2019-workaround.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -186,6 +188,10 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Mon Aug 10 2020 Jaroslav Škarvada - 2.4.8-8 +- Added workaround for Windows Server 2019 + Resolves: rhbz#1867047 + * Tue Jul 28 2020 Fedora Release Engineering - 2.4.8-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 4c460e431e75c97b753683c8d13f549d326b0c5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 10 Nov 2020 14:50:51 +0100 Subject: [PATCH 11/57] Remove patch setting CC to gcc This is automatically done these days, so no need for us to do it --- ...ys-use-gcc-as-our-compiler-of-choice.patch | 25 ------------------- ...hardcode-LIBDIR-but-set-it-according.patch | 2 +- ...e-compiler-flags-handed-to-us-by-rpm.patch | 2 +- ...-sys-linux-rework-get_first_ethernet.patch | 2 +- ppp.spec | 1 - 5 files changed, 3 insertions(+), 29 deletions(-) delete mode 100644 0001-build-sys-use-gcc-as-our-compiler-of-choice.patch diff --git a/0001-build-sys-use-gcc-as-our-compiler-of-choice.patch b/0001-build-sys-use-gcc-as-our-compiler-of-choice.patch deleted file mode 100644 index b8a76ca..0000000 --- a/0001-build-sys-use-gcc-as-our-compiler-of-choice.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 486e36d184cbaee7e34bb582ea6fdf3bfa9ca531 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 11:23:42 +0200 -Subject: [PATCH 01/27] build-sys: use gcc as our compiler of choice - ---- - pppd/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index a74c914..1d9ea78 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -30,7 +30,7 @@ ifeq (.depend,$(wildcard .depend)) - include .depend - endif - --# CC = gcc -+CC = gcc - # - COPTS = -O2 -pipe -Wall -g - LIBS = --- -1.8.3.1 - diff --git a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch index 2d6bdd6..8544d60 100644 --- a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch @@ -28,7 +28,7 @@ index 63872eb..8ed56c1 100644 @@ -32,7 +33,7 @@ endif - CC = gcc + # CC = gcc # -COPTS = -Wall $(RPM_OPT_FLAGS) +COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" diff --git a/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch index dc0c5df..d38b9d8 100644 --- a/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +++ b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch @@ -34,7 +34,7 @@ index 5a44d30..63872eb 100644 +++ b/pppd/Makefile.linux @@ -32,8 +32,7 @@ endif - CC = gcc + # CC = gcc # -COPTS = -O2 -pipe -Wall -g -LIBS = diff --git a/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch index 780e068..18bfecf 100644 --- a/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch +++ b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch @@ -33,7 +33,7 @@ index 53df4d2..0e8107f 100644 @@ -32,6 +32,9 @@ include .depend endif - CC = gcc + # CC = gcc + +LIBS = -ludev + diff --git a/ppp.spec b/ppp.spec index 537625c..3c75dec 100644 --- a/ppp.spec +++ b/ppp.spec @@ -22,7 +22,6 @@ Source11: ifdown-ppp Source12: ppp-watch.tar.xz # Fedora-specific -Patch0001: 0001-build-sys-use-gcc-as-our-compiler-of-choice.patch Patch0002: ppp-2.4.8-build-sys-enable-PAM-support.patch Patch0003: ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch Patch0004: 0004-doc-add-configuration-samples.patch From 02c8201efb6783c57e42e53d0361f40ccd5d3703 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 10 Nov 2020 14:57:56 +0100 Subject: [PATCH 12/57] Use gcc directly for -print-multi-os-directory The patch uses gcc directly everywhere else. --- ...8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch index 8544d60..016e310 100644 --- a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch @@ -57,7 +57,7 @@ index e09a369..b474a19 100644 BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell $(CC) -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) ++LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) SUBDIRS := rp-pppoe pppoatm pppol2tp # Uncomment the next line to include the radius authentication plugin From 61c3711488b5a982bc412a593d48697287c0ecf4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 10 Nov 2020 15:13:48 +0100 Subject: [PATCH 13/57] spec: Remove unused export RPM_LD_FLAGS is not used anywhere. --- ppp.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 3c75dec..cdc1456 100644 --- a/ppp.spec +++ b/ppp.spec @@ -93,7 +93,6 @@ tar -xJf %{SOURCE12} %build export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" -export RPM_LD_FLAGS="$LDFLAGS" %configure %{make_build} LDFLAGS="%{?build_ldflags}" %{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags}" From bf3c4131752b08d47ddd9c22bd21cc96a16ae770 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 10 Nov 2020 15:17:07 +0100 Subject: [PATCH 14/57] spec: Pass -pie via LDFLAGS Makes the clang build pass --- ppp.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ppp.spec b/ppp.spec index cdc1456..cb0a87a 100644 --- a/ppp.spec +++ b/ppp.spec @@ -94,8 +94,8 @@ tar -xJf %{SOURCE12} %build export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" %configure -%{make_build} LDFLAGS="%{?build_ldflags}" -%{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags}" +%{make_build} LDFLAGS="%{?build_ldflags} -pie" +%{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" %install make INSTROOT=%{buildroot} install install-etcppp From 23f594e00896a75b4cf3690aa4a32e0d11917cf7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 5 Jan 2021 22:35:54 +0100 Subject: [PATCH 15/57] New version Resolves: rhbz#1912617 --- .gitignore | 1 + ...t-strip-binaries-during-installation.patch | 111 - ...-use-prefix-usr-instead-of-usr-local.patch | 89 - 0010-build-sys-enable-CBCP.patch | 26 - ...se-SOCK_CLOEXEC-when-creating-socket.patch | 47 +- ...ppoe-add-manpage-for-pppoe-discovery.patch | 23 +- ...l-rp-pppoe-plugin-files-with-standar.patch | 30 +- ppp-2.4.8-CVE-2020-8597.patch | 37 - ...e-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch | 23 - ...pile-pppol2tp-with-multilink-support.patch | 24 - ppp-2.4.8-build-sys-enable-PAM-support.patch | 25 - ...e-compiler-flags-handed-to-us-by-rpm.patch | 121 - ppp-2.4.8-eaptls-mppe-1.300.patch | 3948 ----------------- ppp-2.4.8-man-fix.patch | 46 - ....8-pppd-introduce-ipv6-accept-remote.patch | 57 - ...-sys-linux-rework-get_first_ethernet.patch | 383 -- ppp-2.4.8-ws-2019-workaround.patch | 27 - ...hardcode-LIBDIR-but-set-it-according.patch | 119 +- ppp-2.4.9-config.patch | 21 + ppp-2.4.9-configure-cflags-allow-commas.patch | 17 + ...pp-2.4.9-everywhere-O_CLOEXEC-harder.patch | 4 +- ppp.spec | 58 +- sources | 2 +- 23 files changed, 140 insertions(+), 5099 deletions(-) delete mode 100644 0007-build-sys-don-t-strip-binaries-during-installation.patch delete mode 100644 0008-build-sys-use-prefix-usr-instead-of-usr-local.patch delete mode 100644 0010-build-sys-enable-CBCP.patch delete mode 100644 ppp-2.4.8-CVE-2020-8597.patch delete mode 100644 ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch delete mode 100644 ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch delete mode 100644 ppp-2.4.8-build-sys-enable-PAM-support.patch delete mode 100644 ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch delete mode 100644 ppp-2.4.8-eaptls-mppe-1.300.patch delete mode 100644 ppp-2.4.8-man-fix.patch delete mode 100644 ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch delete mode 100644 ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch delete mode 100644 ppp-2.4.8-ws-2019-workaround.patch rename ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch => ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch (58%) create mode 100644 ppp-2.4.9-config.patch create mode 100644 ppp-2.4.9-configure-cflags-allow-commas.patch rename ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch => ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch (99%) diff --git a/.gitignore b/.gitignore index 94b2a80..3a9dd7f 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ ppp-2.4.5.tar.gz /ppp-watch.tar.xz /ppp-2.4.7.tar.gz /ppp-2.4.8.tar.gz +/ppp-2.4.9.tar.gz diff --git a/0007-build-sys-don-t-strip-binaries-during-installation.patch b/0007-build-sys-don-t-strip-binaries-during-installation.patch deleted file mode 100644 index 9f542a6..0000000 --- a/0007-build-sys-don-t-strip-binaries-during-installation.patch +++ /dev/null @@ -1,111 +0,0 @@ -From b9fb631a493c5f1b490c8e9645eb6ebab4b25cc8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 18:37:00 +0200 -Subject: [PATCH 07/27] build-sys: don't strip binaries during installation - -We don't want that when building rpms. rpmbuild does final stripping of binaries -for us and generetes debuginfo rpm. ---- - chat/Makefile.linux | 2 +- - pppd/Makefile.linux | 4 ++-- - pppd/plugins/radius/Makefile.linux | 6 +++--- - pppd/plugins/rp-pppoe/Makefile.linux | 4 ++-- - pppdump/Makefile.linux | 2 +- - pppstats/Makefile.linux | 2 +- - 6 files changed, 10 insertions(+), 10 deletions(-) - -diff --git a/chat/Makefile.linux b/chat/Makefile.linux -index 848cd8d..2445637 100644 ---- a/chat/Makefile.linux -+++ b/chat/Makefile.linux -@@ -25,7 +25,7 @@ chat.o: chat.c - - install: chat - mkdir -p $(BINDIR) $(MANDIR) -- $(INSTALL) -s -c chat $(BINDIR) -+ $(INSTALL) -c chat $(BINDIR) - $(INSTALL) -c -m 644 chat.8 $(MANDIR) - - clean: -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 8ed56c1..4f27100 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -102,7 +102,7 @@ ifdef USE_SRP - CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include - LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto - TARGETS += srp-entry --EXTRAINSTALL = $(INSTALL) -s -c -m 555 srp-entry $(BINDIR)/srp-entry -+EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry - MANPAGES += srp-entry.8 - EXTRACLEAN += srp-entry.o - NEEDDES=y -@@ -208,7 +208,7 @@ all: $(TARGETS) - install: pppd - mkdir -p $(BINDIR) $(MANDIR) - $(EXTRAINSTALL) -- $(INSTALL) -s -c -m 555 pppd $(BINDIR)/pppd -+ $(INSTALL) -c -m 555 pppd $(BINDIR)/pppd - if chgrp pppusers $(BINDIR)/pppd 2>/dev/null; then \ - chmod o-rx,u+s $(BINDIR)/pppd; fi - $(INSTALL) -c -m 444 pppd.8 $(MANDIR) -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 179d0b7..707326b 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -36,9 +36,9 @@ all: $(PLUGIN) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -s -c -m 755 radius.so $(LIBDIR) -- $(INSTALL) -s -c -m 755 radattr.so $(LIBDIR) -- $(INSTALL) -s -c -m 755 radrealms.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radius.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radattr.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radrealms.so $(LIBDIR) - $(INSTALL) -c -m 444 pppd-radius.8 $(MANDIR) - $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) - -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 1305ed8..3cd9101 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -43,9 +43,9 @@ rp-pppoe.so: plugin.o discovery.o if.o common.o - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -s -c -m 4550 rp-pppoe.so $(LIBDIR) -+ $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR) - $(INSTALL) -d -m 755 $(BINDIR) -- $(INSTALL) -s -c -m 555 pppoe-discovery $(BINDIR) -+ $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) - - clean: - rm -f *.o *.so pppoe-discovery -diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux -index d0a5032..95c6805 100644 ---- a/pppdump/Makefile.linux -+++ b/pppdump/Makefile.linux -@@ -17,5 +17,5 @@ clean: - - install: - mkdir -p $(BINDIR) $(MANDIR) -- $(INSTALL) -s -c pppdump $(BINDIR) -+ $(INSTALL) -c pppdump $(BINDIR) - $(INSTALL) -c -m 444 pppdump.8 $(MANDIR) -diff --git a/pppstats/Makefile.linux b/pppstats/Makefile.linux -index 42aba73..c5ba3b1 100644 ---- a/pppstats/Makefile.linux -+++ b/pppstats/Makefile.linux -@@ -22,7 +22,7 @@ all: pppstats - - install: pppstats - -mkdir -p $(MANDIR) -- $(INSTALL) -s -c pppstats $(BINDIR) -+ $(INSTALL) -c pppstats $(BINDIR) - $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) - - pppstats: $(PPPSTATSRCS) --- -1.8.3.1 - diff --git a/0008-build-sys-use-prefix-usr-instead-of-usr-local.patch b/0008-build-sys-use-prefix-usr-instead-of-usr-local.patch deleted file mode 100644 index e82c957..0000000 --- a/0008-build-sys-use-prefix-usr-instead-of-usr-local.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 343728d5de6e44bd67923503e62eefaad50760a4 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 18:47:01 +0200 -Subject: [PATCH 08/27] build-sys: use prefix /usr instead of /usr/local - ---- - configure | 2 +- - pppd/Makefile.linux | 4 ++-- - scripts/ppp-on-rsh | 2 +- - scripts/ppp-on-ssh | 4 ++-- - scripts/secure-card | 2 +- - 5 files changed, 7 insertions(+), 7 deletions(-) - -diff --git a/configure b/configure -index 6a55e0f..db54d77 100755 ---- a/configure -+++ b/configure -@@ -2,7 +2,7 @@ - # $Id: configure,v 1.38 2008/06/15 07:08:49 paulus Exp $ - - # Where to install stuff by default --DESTDIR=/usr/local -+DESTDIR=/usr - SYSCONF=/etc - - # if [ -d /NextApps ]; then -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 4f27100..95c2598 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -99,8 +99,8 @@ endif - - # EAP SRP-SHA1 - ifdef USE_SRP --CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include --LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto -+CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/include/openssl -+LIBS += -lsrp -L/usr/lib -lcrypto - TARGETS += srp-entry - EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry - MANPAGES += srp-entry.8 -diff --git a/scripts/ppp-on-rsh b/scripts/ppp-on-rsh -index 30a50db..a80616a 100755 ---- a/scripts/ppp-on-rsh -+++ b/scripts/ppp-on-rsh -@@ -26,7 +26,7 @@ PPPD_RHOST=myremotehost - # For this example, we assume that pppd on both local and remote - # machines reside in the same place, /usr/local/bin/pppd - # --PPPD_LOC=/usr/local/bin/pppd -+PPPD_LOC=/usr/sbin/pppd - - # - # The location of local options file (where rsh client is running). -diff --git a/scripts/ppp-on-ssh b/scripts/ppp-on-ssh -index 0e41aca..c27e80a 100755 ---- a/scripts/ppp-on-ssh -+++ b/scripts/ppp-on-ssh -@@ -26,7 +26,7 @@ PPPD_RHOST=myremotehost - # For this example, we assume that pppd on both local and remote - # machines reside in the same place, /usr/local/bin/pppd - # --PPPD_LOC=/usr/local/bin/pppd -+PPPD_LOC=/usr/sbin/pppd - - # - # The location of local options file (where ssh client is running). -@@ -52,7 +52,7 @@ PPPD_REM_OPT=/etc/ppp/options-ssh-rem - # - # The location of ssh client on the local machine - # --SSH_LOC=/usr/local/bin/ssh -+SSH_LOC=/usr/bin/ssh - - export PPPD_LOC PPPD_LOC_OPT PPPD_REM_OPT PPPD_RHOST SSH_LOC - -diff --git a/scripts/secure-card b/scripts/secure-card -index 0002365..ae3ae50 100755 ---- a/scripts/secure-card -+++ b/scripts/secure-card -@@ -1,4 +1,4 @@ --#!/usr/local/bin/expect -f -+#!/usr/bin/expect -f - # - # This script was written by Jim Isaacson . It is - # designed to work as a script to use the SecureCARD(tm) device. This --- -1.8.3.1 - diff --git a/0010-build-sys-enable-CBCP.patch b/0010-build-sys-enable-CBCP.patch deleted file mode 100644 index 87c3b72..0000000 --- a/0010-build-sys-enable-CBCP.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 8015a0ef23a874f288d5e77ffafe1d7f4281725d Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 18:59:24 +0200 -Subject: [PATCH 10/27] build-sys: enable CBCP - -Resolves: #199278 ---- - pppd/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 95c2598..65700fa 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -68,7 +68,7 @@ HAVE_INET6=y - PLUGIN=y - - # Enable Microsoft proprietary Callback Control Protocol --#CBCP=y -+CBCP=y - - # Enable EAP SRP-SHA1 authentication (requires libsrp) - #USE_SRP=y --- -1.8.3.1 - diff --git a/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch index 08d67f7..1352370 100644 --- a/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +++ b/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch @@ -1,19 +1,3 @@ -From 2a97ab28ee00586e5f06b3ef3a0e43ea0c7c6499 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 14:21:41 +0200 -Subject: [PATCH 14/27] everywhere: use SOCK_CLOEXEC when creating socket - ---- - pppd/plugins/pppoatm/pppoatm.c | 2 +- - pppd/plugins/pppol2tp/openl2tp.c | 2 +- - pppd/plugins/pppol2tp/pppol2tp.c | 2 +- - pppd/plugins/rp-pppoe/if.c | 2 +- - pppd/plugins/rp-pppoe/plugin.c | 6 +++--- - pppd/plugins/rp-pppoe/pppoe-discovery.c | 2 +- - pppd/sys-linux.c | 10 +++++----- - pppd/tty.c | 2 +- - 8 files changed, 14 insertions(+), 14 deletions(-) - diff --git a/pppd/plugins/pppoatm/pppoatm.c b/pppd/plugins/pppoatm/pppoatm.c index d693350..c31bb34 100644 --- a/pppd/plugins/pppoatm/pppoatm.c @@ -53,10 +37,10 @@ index a7e3400..e64a778 100644 if (fd >= 0) { memset (&ifr, '\0', sizeof (ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c +diff --git a/pppd/plugins/pppoe/if.c b/pppd/plugins/pppoe/if.c index 91e9a57..72aba41 100644 ---- a/pppd/plugins/rp-pppoe/if.c -+++ b/pppd/plugins/rp-pppoe/if.c +--- a/pppd/plugins/pppoe/if.c ++++ b/pppd/plugins/pppoe/if.c @@ -116,7 +116,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) stype = SOCK_PACKET; #endif @@ -66,10 +50,10 @@ index 91e9a57..72aba41 100644 /* Give a more helpful message for the common error case */ if (errno == EPERM) { fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c +diff --git a/pppd/plugins/pppoe/plugin.c b/pppd/plugins/pppoe/plugin.c index a8c2bb4..24bdf8f 100644 ---- a/pppd/plugins/rp-pppoe/plugin.c -+++ b/pppd/plugins/rp-pppoe/plugin.c +--- a/pppd/plugins/pppoe/plugin.c ++++ b/pppd/plugins/pppoe/plugin.c @@ -137,7 +137,7 @@ PPPOEConnectDevice(void) /* server equipment). */ /* Opening this socket just before waitForPADS in the discovery() */ @@ -97,10 +81,10 @@ index a8c2bb4..24bdf8f 100644 r = 0; } -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c +diff --git a/pppd/plugins/pppoe/pppoe-discovery.c b/pppd/plugins/pppoe/pppoe-discovery.c index 3d3bf4e..c0d927d 100644 ---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c +--- a/pppd/plugins/pppoe/pppoe-discovery.c ++++ b/pppd/plugins/pppoe/pppoe-discovery.c @@ -121,7 +121,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) stype = SOCK_PACKET; #endif @@ -109,7 +93,7 @@ index 3d3bf4e..c0d927d 100644 + if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { /* Give a more helpful message for the common error case */ if (errno == EPERM) { - rp_fatal("Cannot create raw socket -- pppoe must be run as root."); + fatal("Cannot create raw socket -- pppoe must be run as root."); diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c index 00a2cf5..0690019 100644 --- a/pppd/sys-linux.c @@ -136,7 +120,7 @@ index 00a2cf5..0690019 100644 - sock_fd = socket(AF_INET, SOCK_DGRAM, 0); + sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); if (sock_fd < 0) - return 0; + return -1; memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr)); @@ -2067,7 +2067,7 @@ int ppp_available(void) /* @@ -147,15 +131,6 @@ index 00a2cf5..0690019 100644 if (s < 0) return 0; -@@ -2860,7 +2860,7 @@ ether_to_eui64(eui64_t *p_eui64) - int skfd; - const unsigned char *ptr; - -- skfd = socket(PF_INET6, SOCK_DGRAM, 0); -+ skfd = socket(PF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if(skfd == -1) - { - warn("could not open IPv6 socket"); diff --git a/pppd/tty.c b/pppd/tty.c index bc96695..8e76a5d 100644 --- a/pppd/tty.c diff --git a/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch b/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch index a13fe79..b7f7c91 100644 --- a/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch +++ b/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch @@ -1,18 +1,7 @@ -From a30efa2cc99a5b6ab220de04cbcc7db38888a17a Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 14:29:45 +0200 -Subject: [PATCH 16/27] rp-pppoe: add manpage for pppoe-discovery - ---- - pppd/plugins/rp-pppoe/Makefile.linux | 2 + - pppd/plugins/rp-pppoe/pppoe-discovery.8 | 86 +++++++++++++++++++++++++++++++++ - 2 files changed, 88 insertions(+) - create mode 100644 pppd/plugins/rp-pppoe/pppoe-discovery.8 - -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux +diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux index 3cd9101..9918091 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux +--- a/pppd/plugins/pppoe/Makefile.linux ++++ b/pppd/plugins/pppoe/Makefile.linux @@ -16,6 +16,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ @@ -22,18 +11,18 @@ index 3cd9101..9918091 100644 PPPDVERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) @@ -46,6 +47,7 @@ install: all - $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR) + $(LN_S) pppoe.so $(LIBDIR)/rp-pppoe.so $(INSTALL) -d -m 755 $(BINDIR) $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) + $(INSTALL) -c -m 444 pppoe-discovery.8 $(MANDIR) clean: rm -f *.o *.so pppoe-discovery -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.8 b/pppd/plugins/rp-pppoe/pppoe-discovery.8 +diff --git a/pppd/plugins/pppoe/pppoe-discovery.8 b/pppd/plugins/pppoe/pppoe-discovery.8 new file mode 100644 index 0000000..d0a93db --- /dev/null -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.8 ++++ b/pppd/plugins/pppoe/pppoe-discovery.8 @@ -0,0 +1,86 @@ +.\" pppoe-discovery.8 written by +.\" Ben Hutchings , based on pppoe.8. diff --git a/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch b/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch index 7a18e07..23b1f93 100644 --- a/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch +++ b/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch @@ -1,24 +1,15 @@ -From 769521a3798fd554ddc7333cb1255cd1b40790e8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Thu, 10 Apr 2014 10:00:55 +0200 -Subject: [PATCH 23/27] build-sys: install rp-pppoe plugin files with standard - perms - -This is needed to properly generate debuginfo package. ---- - pppd/plugins/rp-pppoe/Makefile.linux | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index b949716..fa49efb 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -44,10 +44,10 @@ rp-pppoe.so: plugin.o discovery.o if.o common.o +diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux +index 2df887b..6cb8397 100644 +--- a/pppd/plugins/pppoe/Makefile.linux ++++ b/pppd/plugins/pppoe/Makefile.linux +@@ -43,12 +43,12 @@ pppoe.so: plugin.o discovery.o if.o common.o install: all $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR) -+ $(INSTALL) -c -m 755 rp-pppoe.so $(LIBDIR) +- $(INSTALL) -c -m 4550 pppoe.so $(LIBDIR) ++ $(INSTALL) -c -m 755 pppoe.so $(LIBDIR) + # Symlink for backward compatibility + $(LN_S) pppoe.so $(LIBDIR)/rp-pppoe.so $(INSTALL) -d -m 755 $(BINDIR) - $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) - $(INSTALL) -c -m 444 pppoe-discovery.8 $(MANDIR) @@ -27,6 +18,3 @@ index b949716..fa49efb 100644 clean: rm -f *.o *.so pppoe-discovery --- -1.8.3.1 - diff --git a/ppp-2.4.8-CVE-2020-8597.patch b/ppp-2.4.8-CVE-2020-8597.patch deleted file mode 100644 index 5d7c51b..0000000 --- a/ppp-2.4.8-CVE-2020-8597.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001 -From: Paul Mackerras -Date: Mon, 3 Feb 2020 15:53:28 +1100 -Subject: [PATCH] pppd: Fix bounds check in EAP code - -Given that we have just checked vallen < len, it can never be the case -that vallen >= len + sizeof(rhostname). This fixes the check so we -actually avoid overflowing the rhostname array. - -Reported-by: Ilja Van Sprundel -Signed-off-by: Paul Mackerras ---- - pppd/eap.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/eap.c b/pppd/eap.c -index 94407f56..1b93db01 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -1420,7 +1420,7 @@ int len; - } - - /* Not so likely to happen. */ -- if (vallen >= len + sizeof (rhostname)) { -+ if (len - vallen >= sizeof (rhostname)) { - dbglog("EAP: trimming really long peer name down"); - BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); - rhostname[sizeof (rhostname) - 1] = '\0'; -@@ -1846,7 +1846,7 @@ int len; - } - - /* Not so likely to happen. */ -- if (vallen >= len + sizeof (rhostname)) { -+ if (len - vallen >= sizeof (rhostname)) { - dbglog("EAP: trimming really long peer name down"); - BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); - rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch b/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch deleted file mode 100644 index fd53ac7..0000000 --- a/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch +++ /dev/null @@ -1,23 +0,0 @@ -From d69eb9a8aa284014dd7dd282813989eda9d84d74 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Wed, 9 Apr 2014 09:56:09 +0200 -Subject: [PATCH 21/27] build-sys: compile pppol2tp plugin with RPM_OPT_FLAGS - ---- - pppd/plugins/pppol2tp/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index 4339566..9a635b8 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = -O2 -g -+COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC - LDFLAGS_SHARED = -shared - INSTALL = install --- -1.8.3.1 - diff --git a/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch b/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch deleted file mode 100644 index d801308..0000000 --- a/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch +++ /dev/null @@ -1,24 +0,0 @@ -From a0060c5d48ef742bff4fe9ba9c276a5c21795ce8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Wed, 9 Apr 2014 09:58:38 +0200 -Subject: [PATCH 22/27] build-sys: compile pppol2tp with multilink support - -Resolves: #817013 ---- - pppd/plugins/pppol2tp/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index 9a635b8..9cb316d 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = $(RPM_OPT_FLAGS) -+COPTS = $(RPM_OPT_FLAGS) -DHAVE_MULTILINK - CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC - LDFLAGS_SHARED = -shared - INSTALL = install --- -1.8.3.1 - diff --git a/ppp-2.4.8-build-sys-enable-PAM-support.patch b/ppp-2.4.8-build-sys-enable-PAM-support.patch deleted file mode 100644 index 355410c..0000000 --- a/ppp-2.4.8-build-sys-enable-PAM-support.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 0d71a32b73b71c9793d0b304320858062faf00d1 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 11:25:43 +0200 -Subject: [PATCH 02/27] build-sys: enable PAM support - ---- - pppd/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 1d9ea78..5a44d30 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -61,7 +61,7 @@ HAVE_MULTILINK=y - #SYSTEMD=y - - HAS_SHADOW=y --#USE_PAM=y -+USE_PAM=y - HAVE_INET6=y - - # Enable plugins --- -1.8.3.1 - diff --git a/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch deleted file mode 100644 index d38b9d8..0000000 --- a/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +++ /dev/null @@ -1,121 +0,0 @@ -From d729b06f0ac7a5ebd3648ef60bef0499b59bf82d Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 11:29:39 +0200 -Subject: [PATCH 03/27] build-sys: utilize compiler flags handed to us by - rpmbuild - ---- - chat/Makefile.linux | 2 +- - pppd/Makefile.linux | 3 +-- - pppd/plugins/Makefile.linux | 2 +- - pppd/plugins/pppoatm/Makefile.linux | 2 +- - pppd/plugins/radius/Makefile.linux | 2 +- - pppd/plugins/rp-pppoe/Makefile.linux | 2 +- - pppdump/Makefile.linux | 2 +- - pppstats/Makefile.linux | 2 +- - 8 files changed, 8 insertions(+), 9 deletions(-) - -diff --git a/chat/Makefile.linux b/chat/Makefile.linux -index 1065ac5..848cd8d 100644 ---- a/chat/Makefile.linux -+++ b/chat/Makefile.linux -@@ -10,7 +10,7 @@ CDEF3= -UNO_SLEEP # Use the usleep function - CDEF4= -DFNDELAY=O_NDELAY # Old name value - CDEFS= $(CDEF1) $(CDEF2) $(CDEF3) $(CDEF4) - --COPTS= -O2 -g -pipe -+COPTS= $(RPM_OPT_FLAGS) - CFLAGS= $(COPTS) $(CDEFS) - - INSTALL= install -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 5a44d30..63872eb 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -32,8 +32,7 @@ endif - - # CC = gcc - # --COPTS = -O2 -pipe -Wall -g --LIBS = -+COPTS = -Wall $(RPM_OPT_FLAGS) - - # Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index 0a7ec7b..e09a369 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = -O2 -g -+COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS_SHARED = -shared - INSTALL = install -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 20f62e6..5a81447 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = -O2 -g -+COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC - LDFLAGS_SHARED = -shared - INSTALL = install -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 24ed3e5..45b3b8d 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -12,7 +12,7 @@ VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - INSTALL = install - - PLUGIN=radius.so radattr.so radrealms.so --CFLAGS=-I. -I../.. -I../../../include -O2 -fPIC -DRC_LOG_FACILITY=LOG_DAEMON -+CFLAGS=-I. -I../.. -I../../../include $(RPM_OPT_FLAGS) -DRC_LOG_FACILITY=LOG_DAEMON - - # Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 5d7a271..352991a 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -25,7 +25,7 @@ INSTALL = install - # Version is set ONLY IN THE MAKEFILE! Don't delete this! - RP_VERSION=3.8p - --COPTS=-O2 -g -+COPTS=$(RPM_OPT_FLAGS) - CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' - all: rp-pppoe.so pppoe-discovery - -diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux -index ac028f6..d0a5032 100644 ---- a/pppdump/Makefile.linux -+++ b/pppdump/Makefile.linux -@@ -2,7 +2,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 - --CFLAGS= -O -I../include/net -+CFLAGS= $(RPM_OPT_FLAGS) -I../include/net - OBJS = pppdump.o bsd-comp.o deflate.o zlib.o - - INSTALL= install -diff --git a/pppstats/Makefile.linux b/pppstats/Makefile.linux -index cca6f0f..42aba73 100644 ---- a/pppstats/Makefile.linux -+++ b/pppstats/Makefile.linux -@@ -10,7 +10,7 @@ PPPSTATSRCS = pppstats.c - PPPSTATOBJS = pppstats.o - - #CC = gcc --COPTS = -O -+COPTS = $(RPM_OPT_FLAGS) - COMPILE_FLAGS = -I../include - LIBS = - --- -1.8.3.1 - diff --git a/ppp-2.4.8-eaptls-mppe-1.300.patch b/ppp-2.4.8-eaptls-mppe-1.300.patch deleted file mode 100644 index 65b1434..0000000 --- a/ppp-2.4.8-eaptls-mppe-1.300.patch +++ /dev/null @@ -1,3948 +0,0 @@ -diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.300/README.eap-tls ---- ppp-2.4.8/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/README.eap-tls 2020-04-07 10:09:50.565118206 +0200 -@@ -0,0 +1,307 @@ -+EAP-TLS authentication support for PPP -+====================================== -+ -+1. Intro -+ -+ The Extensible Authentication Protocol (EAP; RFC 3748) is a -+ security protocol that can be used with PPP. It provides a means -+ to plug in multiple optional authentication methods. -+ -+ Transport Level Security (TLS; RFC 5216) provides for mutual -+ authentication, integrity-protected ciphersuite negotiation and -+ key exchange between two endpoints. It also provides for optional -+ MPPE encryption. -+ -+ EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets, -+ allowing TLS mutual authentication to be used as a generic EAP -+ mechanism. It also provides optional encryption using the MPPE -+ protocol. -+ -+ This patch provide EAP-TLS support to pppd. -+ This authentication method can be used in both client or server -+ mode. -+ -+2. Building -+ -+ To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org) -+ is required. Any version from 0.9.7 should work. -+ -+ Configure, compile, and install as usual. -+ -+3. Configuration -+ -+ On the client side there are two ways to configure EAP-TLS: -+ -+ 1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters -+ -+ 2. edit the /etc/ppp/eaptls-client file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ The file containing the certificate chain for the -+ client in PEM format -+ - Server certificate file -+ If you want to specify the certificate that the -+ server is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM -+ format. -+ - Client private key file -+ The file containing the client private key in PEM format. -+ -+ -+ On the server side edit the /etc/ppp/eaptls-server file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ If you want to specify the certificate that the -+ client is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - Server certificate file -+ The file containing the certificate chain for the -+ server in PEM format -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM format. -+ - Client private key file -+ The file containing the server private key in PEM format. -+ - addresses -+ A list of IP addresses the client is allowed to use. -+ -+ -+ OpenSSL engine support is included starting with v0.95 of this patch. -+ Currently the only engine tested is the 'pkcs11' engine (hardware token -+ support). To use the 'pksc11' engine: -+ - Use a special private key fileiname in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - The certificate can also be loaded from the 'pkcs11' engine using -+ a special client certificate filename in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior -+ to starting 'pppd'. A sample openssl.cnf file is -+ -+ openssl_conf = openssl_def -+ -+ [ openssl_def ] -+ engines = engine_section -+ -+ [ engine_section ] -+ pkcs11 = pkcs11_section -+ -+ [ pkcs11_section ] -+ engine_id = pkcs11 -+ dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+ MODULE_PATH = /usr/lib64/libeTPkcs11.so -+ init = 0 -+ -+ - There are two ways to specify a password/PIN for the PKCS11 engine: -+ - inside the openssl.cnf file using -+ PIN = your-secret-pin -+ Note The keyword 'PIN' is case sensitive! -+ - Using the 'password' in the ppp options file. -+ From v0.97 of the eap-tls patch the password can also be supplied -+ using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c -+ for an example). -+ -+ -+4. Options -+ -+ These pppd options are available: -+ -+ ca -+ Use the CA public certificate found in in PEM format -+ cert -+ Use the client public certificate found in in PEM format -+ or in engine:engine_id format -+ key -+ Use the client private key found in in PEM format -+ or in engine:engine_id format -+ crl -+ Use the Certificate Revocation List (CRL) file in PEM format. -+ crl-dir -+ Use CRL files from directory . It contains CRL files in PEM -+ format and each file contains a CRL. The files are looked up -+ by the issuer name hash value. Use the c_rehash utility -+ to create necessary links. -+ need-peer-eap -+ If the peer doesn't ask us to authenticate or doesn't use eap -+ to authenticate us, disconnect. -+ -+ Note: -+ password-encrypted certificates can be used as of v0.94 of this -+ patch. The password for the eap-tls.key file is specified using -+ the regular -+ password .... -+ statement in the ppp options file, or by using the appropriate -+ plugin which supplies a 'eaptls_passwd_hook' routine. -+ -+5. Connecting -+ -+ If you're setting up a pppd server, edit the EAP-TLS configuration file -+ as written above and then run pppd with the 'auth' option to authenticate -+ the client. The EAP-TLS method will be used if the other eap methods can't -+ be used (no secrets). -+ -+ If you're setting up a client, edit the configuration file and then run -+ pppd with 'remotename' option to specify the server name. Add the -+ 'need-peer-eap' option if you want to be sure the peer ask you to -+ authenticate (and to use eap) and to disconnect if it doesn't. -+ -+6. Example -+ -+ The following example can be used to connect a Linux client with the 'pptp' -+ package to a Linux server running the 'pptpd' (PoPToP) package. The server -+ was configured with a certificate with name (CN) 'pptp-server', the client -+ was configured with a certificate with name (CN) 'pptp-client', both -+ signed by the same Certificate Authority (CA). -+ -+ Server side: -+ - /etc/pptpd.conf file: -+ option /etc/ppp/options-pptpd-eaptls -+ localip 172.16.1.1 -+ remoteip 172.16.1.10-20 -+ - /etc/ppp/options-pptpd-eaptls file: -+ name pptp-server -+ lock -+ mtu 1500 -+ mru 1450 -+ auth -+ lcp-echo-failure 3 -+ lcp-echo-interval 5 -+ nodeflate -+ nobsdcomp -+ nopredictor1 -+ nopcomp -+ noaccomp -+ -+ require-eap -+ require-mppe-128 -+ -+ crl /home/janjust/ppp/keys/crl.pem -+ -+ debug -+ logfile /tmp/pppd.log -+ -+ - /etc/ppp/eaptls-server file: -+ * pptp-server - /etc/ppp/pptp-server.crt /etc/ppp/ca.crt /etc/ppp/pptp-server.key * -+ -+ - On the server, run -+ pptdp --conf /etc/pptpd.conf -+ -+ Client side: -+ - Run -+ pppd noauth require-eap require-mppe-128 \ -+ ipcp-accept-local ipcp-accept-remote noipdefault \ -+ cert /etc/ppp/keys/pptp-client.crt \ -+ key /etc/ppp/keys/pptp-client.key \ -+ ca /etc/ppp/keys/ca.crt \ -+ name pptp-client remotename pptp-server \ -+ debug logfile /tmp/pppd.log -+ pty "pptp pptp-server.example.com --nolaunchpppd" -+ -+ Check /var/log/messages and the files /tmp/pppd.log on both sides for debugging info. -+ -+7. Notes -+ -+ This is experimental code. -+ Send suggestions and comments to Jan Just Keijser -+ -+8. Changelog of ppp-<>-eaptls-mppe-* patches -+ -+v0.7 (22-Nov-2005) -+ - First version of the patch to include MPPE support -+ - ppp-2.4.3 only -+v0.9 (25-Jul-2006) -+ - Bug fixes -+ - First version for ppp-2.4.4 -+v0.91 (03-Sep-2006) -+ - Added missing #include for md5.h -+ - Last version for ppp-2.4.3 -+v0.92 (22-Apr-2008) -+ - Fix for openssl 0.9.8 issue with md5 function overload. -+v0.93 (14-Aug-2008) -+ - Make sure 'noauth' option can be used to bypass server certificate verification. -+v0.94 (15-Oct-2008) -+ - Added support for password-protected private keys by (ab)using the 'password' field. -+v0.95 (23-Dec-2009) -+ - First version with OpenSSL engine support. -+v0.96 (27-Jan-2010) -+ - Added fully functional support for OpenSSL engines (PKCS#11) -+ - First version for ppp-2.4.5 -+v0.97 (20-Apr-2010) -+ - Some bug fixes for v0.96 -+ - Added support for entering the password via a plugin. The sample plugin -+ .../pppd/plugins/passprompt.c has been extended with EAP-TLS support. -+ The "old" methods using the password option or the /etc/ppp/openssl.cnf file still work. -+ - Added support for specifying the client CA, certificate and private key on the command-line -+ or via the ppp config file. -+v0.98 (20-Apr-2010) -+ - Fix initialisation bug when using ca/cert/key command-line options. -+ - Last version for ppp-2.4.4 -+v0.99 (05-Oct-2010) -+ - Fix coredump when using multilink option. -+v0.991 (08-Aug-2011) -+ - Fix compilation issue with openssl 1.0. -+v0.992 (01-Dec-2011) -+ - Fix compilation issue with eaptls_check_hook and passwordfd plugin. -+v0.993 (24-Apr-2012) -+ - Fix compilation issue when EAP_TLS=n in pppd/Makefile. -+v0.994 (11-Jun-2012) -+ - Fix compilation issue on Ubuntu 11.10. -+v0.995 (27-May-2014) -+ - Add support for a CRL file using the command-line option 'crl' -+ (prior only 'crl-dir' was supported). -+ - Fix segfault when pkcs11 enginename was not specified correctly. -+ - Fix segfault when client was misconfigured. -+ - Disable SSL Session Ticket support as Windows 8 does not support this. -+v0.996 (28-May-2014) -+ - Fix minor bug where SessionTicket message was printed as 'Unknown SSL3 code 4' -+ - Add EAP-TLS-specific options to pppd.8 manual page. -+ - Updated README.eap-tls file with new options and provide an example. -+v0.997 (19-Jun-2014) -+ - Change SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET -+ - Fix bug in initialisation code with fragmented packets. -+v0.998 (13-Mar-2015) -+ - Add fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620 -+v0.999 (11-May-2017) -+ - Add support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x. -+v1.101 (1-Jun-2018) -+ - Fix vulnerabilities CVE-2018-11574. -+v1.102 (2-Nov-2018) -+ - Add TLS 1.2 support. Windows 7/8 will connect using TLS 1.0, Windows 10 clients using TLS 1.2. -+ This works both when compiling against OpenSSL 1.0.1+ and 1.1+. -+ - Print warning when certificate is either not yet valid or has expired. -+ - Perform better peer certificate checks. -+ - Allow certificate chain files to be used. -+v1.200 (28-Feb-2020) -+ - First version of patch that was used to create a github PR against the main ppp code base. -+ - Add client-side 'capath' option to allow a directory with trusted CA certificates. -+ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or -+ use the ones supplied by OpenSSL. -+ - Code now also builds on Solaris (x86 tested) but has not been tested yet, as the Solaris ppp -+ kernel driver does not support MPPE. -+v1.201 (03-Apr-2020) -+ - Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that -+ you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation. -+v1.300 (03-Apr-2020) -+ - Add (experimental) TLS 1.3 support. This is based on draft-ietf-emu-eap-tls13-05 (expired) and -+ requires OpenSSL 1.1.1+ to be effective. -+ - Add new option 'max-tls-version' to specify the highest version of the TLS protocol to use -+ (defaults to TLS1.2 for now - so to use TLS1.3 you need to explicitly add 'max-tls-version 1.3') -+ -diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-client ---- ppp-2.4.8/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-client 2020-04-07 10:09:50.566118204 +0200 -@@ -0,0 +1,10 @@ -+# Parameters for authentication using EAP-TLS (client) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (required) -+# server certificate file (optional, if unused put '-') -+# CA certificate file (required) -+# client private key file (required) -+ -+#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-server ---- ppp-2.4.8/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-server 2020-04-07 10:09:50.566118204 +0200 -@@ -0,0 +1,11 @@ -+# Parameters for authentication using EAP-TLS (server) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (optional, if unused put '-') -+# server certificate file (required) -+# CA certificate file (required) -+# server private key file (required) -+# allowed addresses (required, can be *) -+ -+#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/openssl.cnf ---- ppp-2.4.8/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/openssl.cnf 2020-04-07 10:09:50.566118204 +0200 -@@ -0,0 +1,14 @@ -+openssl_conf = openssl_def -+ -+[ openssl_def ] -+engines = engine_section -+ -+[ engine_section ] -+pkcs11 = pkcs11_section -+ -+[ pkcs11_section ] -+engine_id = pkcs11 -+dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+MODULE_PATH = /usr/lib64/libeTPkcs11.so -+init = 0 -+ -diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.300/linux/Makefile.top ---- ppp-2.4.8/linux/Makefile.top 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/linux/Makefile.top 2020-04-07 10:09:50.566118204 +0200 -@@ -26,7 +26,7 @@ - cd pppdump; $(MAKE) $(MFLAGS) install - - install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ -- $(ETCDIR)/chap-secrets -+ $(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client - - install-devel: - cd pppd; $(MAKE) $(MFLAGS) install-devel -@@ -37,6 +37,10 @@ - $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ - $(ETCDIR)/chap-secrets: - $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ -+$(ETCDIR)/eaptls-server: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-server $@ -+$(ETCDIR)/eaptls-client: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-client $@ - - $(BINDIR): - $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.linux ---- ppp-2.4.8/pppd/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.linux 2020-04-07 10:10:01.427104384 +0200 -@@ -11,16 +11,16 @@ - - TARGETS = pppd - --PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c md5.c ccp.c \ -- ecp.c ipxcp.c auth.c options.c sys-linux.c md4.c chap_ms.c \ -+PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c ccp.c \ -+ ecp.c ipxcp.c auth.c options.c sys-linux.c chap_ms.c \ - demand.c utils.c tty.c eap.c chap-md5.c session.c - - HEADERS = ccp.h session.h chap-new.h ecp.h fsm.h ipcp.h \ -- ipxcp.h lcp.h magic.h md5.h patchlevel.h pathnames.h pppd.h \ -+ ipxcp.h lcp.h magic.h patchlevel.h pathnames.h pppd.h \ - upap.h eap.h - - MANPAGES = pppd.8 --PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o md5.o ccp.o \ -+PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o ccp.o \ - ecp.o auth.o options.o demand.o utils.o sys-linux.o ipxcp.o tty.o \ - eap.o chap-md5.o session.o - -@@ -81,6 +81,13 @@ - # Use libutil - USE_LIBUTIL=y - -+# Enable EAP-TLS authentication (requires MPPE support, libssl and libcrypto) -+USE_EAPTLS=y -+ -+# Either use the internal {md5,sha1} routines or use the openssl versions -+USE_OPENSSL_MD5=y -+USE_OPENSSL_SHA1=y -+ - MAXOCTETS=y - - INCLUDE_DIRS= -I../include -@@ -92,8 +99,9 @@ - ifdef CHAPMS - CFLAGS += -DCHAPMS=1 - NEEDDES=y --PPPDOBJS += md4.o chap_ms.o -+PPPDSRC += md4.c chap_ms.c - HEADERS += md4.h chap_ms.h -+PPPDOBJS += md4.o chap_ms.o - ifdef MSLANMAN - CFLAGS += -DMSLANMAN=1 - endif -@@ -111,11 +119,31 @@ - MANPAGES += srp-entry.8 - EXTRACLEAN += srp-entry.o - NEEDDES=y -+endif -+ -+# EAP-TLS -+ifdef USE_EAPTLS -+CFLAGS += -DUSE_EAPTLS=1 -+LIBS += -lssl -lcrypto -+PPPDSRC += eap-tls.c -+HEADERS += eap-tls.h -+PPPDOBJS += eap-tls.o -+endif -+ -+ifdef USE_OPENSSL_MD5 -+CFLAGS += -DUSE_OPENSSL_MD5=1 -+LIBS += -lcrypto -+else -+PPPDSRC += md5.c -+HEADERS += md5.h -+PPPDOBJS += md5.o -+endif -+ -+ifdef USE_OPENSSL_SHA1 -+CFLAGS += -DUSE_OPENSSL_SHA1=1 -+LIBS += -lcrypto - else --# OpenSSL has an integrated version of SHA-1, and its implementation --# is incompatible with this local SHA-1 implementation. We must use --# one or the other, not both. --PPPDSRCS += sha1.c -+PPPDSRC += sha1.c - HEADERS += sha1.h - PPPDOBJS += sha1.o - endif -diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.sol2 ---- ppp-2.4.8/pppd/Makefile.sol2 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.sol2 2020-04-07 10:09:50.566118204 +0200 -@@ -5,10 +5,10 @@ - - include ../Makedefs.com - --CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="@DESTDIR@"' -+CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="/usr/local"' - LIBS = -lsocket -lnsl - --OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o md5.o \ -+OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o \ - tty.o ccp.o ecp.o auth.o options.o demand.o utils.o sys-solaris.o \ - chap-md5.o session.o - -@@ -37,7 +37,21 @@ - - # Uncomment to enable MS-CHAP - CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H --OBJS += chap_ms.o pppcrypt.o md4.o sha1.o -+OBJS += chap_ms.o pppcrypt.o md4.o -+ -+# Uncomment to enable MPPE (in both CHAP and EAP-TLS) -+CFLAGS += -DMPPE -+ -+# Uncomment to use the OpenSSL {md5,sha1} routines -+#CFLAGS += -DUSE_OPENSSL_MD5 -DUSE_OPENSSL_SHA1 -+#LIBS += -lcrypto -+# else -+OBJS += md5.o sha1.o -+ -+# Uncomment to enable EAP-TLS -+CFLAGS += -DUSE_EAPTLS -+LIBS += -lcrypto -lssl -+OBJS += eap-tls.o - - # Uncomment for CBCP - #CFLAGS += -DCBCP_SUPPORT -diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.300/pppd/auth.c ---- ppp-2.4.8/pppd/auth.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/auth.c 2020-04-07 10:09:50.567118203 +0200 -@@ -113,6 +113,9 @@ - #include "upap.h" - #include "chap-new.h" - #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#endif - #ifdef CBCP_SUPPORT - #include "cbcp.h" - #endif -@@ -186,6 +189,11 @@ - /* Hook for a plugin to get the CHAP password for authenticating us */ - int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; - -+#ifdef USE_EAPTLS -+/* Hook for a plugin to get the EAP-TLS password for authenticating us */ -+int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL; -+#endif -+ - /* Hook for a plugin to say whether it is OK if the peer - refuses to authenticate. */ - int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -241,6 +249,16 @@ - bool explicit_user = 0; /* Set if "user" option supplied */ - bool explicit_passwd = 0; /* Set if "password" option supplied */ - char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ -+#ifdef USE_EAPTLS -+char *cacert_file = NULL; /* CA certificate file (pem format) */ -+char *ca_path = NULL; /* directory with CA certificates */ -+char *cert_file = NULL; /* client certificate file (pem format) */ -+char *privkey_file = NULL; /* client private key file (pem format) */ -+char *crl_dir = NULL; /* directory containing CRL files */ -+char *crl_file = NULL; /* Certificate Revocation List (CRL) file (pem format) */ -+char *max_tls_version = NULL; /* Maximum TLS protocol version (default=1.2) */ -+bool need_peer_eap = 0; /* Require peer to authenticate us */ -+#endif - - static char *uafname; /* name of most recent +ua file */ - -@@ -257,6 +275,19 @@ - static int have_chap_secret __P((char *, char *, int, int *)); - static int have_srp_secret __P((char *client, char *server, int need_ip, - int *lacks_ipp)); -+ -+#ifdef USE_EAPTLS -+static int have_eaptls_secret_server -+__P((char *client, char *server, int need_ip, int *lacks_ipp)); -+static int have_eaptls_secret_client __P((char *client, char *server)); -+static int scan_authfile_eaptls __P((FILE * f, char *client, char *server, -+ char *cli_cert, char *serv_cert, -+ char *ca_cert, char *pk, -+ struct wordlist ** addrs, -+ struct wordlist ** opts, -+ char *filename, int flags)); -+#endif -+ - static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); - static int scan_authfile __P((FILE *, char *, char *, char *, - struct wordlist **, struct wordlist **, -@@ -404,6 +435,18 @@ - "Set telephone number(s) which are allowed to connect", - OPT_PRIV | OPT_A2LIST }, - -+#ifdef USE_EAPTLS -+ { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, -+ { "capath", o_string, &ca_path, "EAP-TLS CA certificate directory" }, -+ { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, -+ { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, -+ { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, -+ { "crl", o_string, &crl_file, "Use specific CRL file" }, -+ { "max-tls-version", o_string, &max_tls_version, -+ "Maximum TLS version (1.0/1.1/1.2 (default)/1.3)" }, -+ { "need-peer-eap", o_bool, &need_peer_eap, -+ "Require the peer to authenticate us", 1 }, -+#endif /* USE_EAPTLS */ - { NULL } - }; - -@@ -737,6 +780,9 @@ - lcp_options *wo = &lcp_wantoptions[unit]; - lcp_options *go = &lcp_gotoptions[unit]; - lcp_options *ho = &lcp_hisoptions[unit]; -+#ifdef USE_EAPTLS -+ lcp_options *ao = &lcp_allowoptions[unit]; -+#endif - int i; - struct protent *protp; - -@@ -771,6 +817,22 @@ - } - } - -+#ifdef USE_EAPTLS -+ if (need_peer_eap && !ao->neg_eap) { -+ warn("eap required to authenticate us but no suitable secrets"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_AUTH_TOPEER_FAILED; -+ return; -+ } -+ -+ if (need_peer_eap && !ho->neg_eap) { -+ warn("peer doesn't want to authenticate us with eap"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_PEER_AUTH_FAILED; -+ return; -+ } -+#endif -+ - new_phase(PHASE_AUTHENTICATE); - auth = 0; - if (go->neg_eap) { -@@ -1291,6 +1353,15 @@ - our_name, 1, &lacks_ip); - } - -+#ifdef USE_EAPTLS -+ if (!can_auth && wo->neg_eap) { -+ can_auth = -+ have_eaptls_secret_server((explicit_remote ? remote_name : -+ NULL), our_name, 1, &lacks_ip); -+ -+ } -+#endif -+ - if (auth_required && !can_auth && noauth_addrs == NULL) { - if (default_auth) { - option_error( -@@ -1345,7 +1416,11 @@ - passwd[0] != 0 || - (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, - (explicit_remote? remote_name: NULL), 0, NULL))) || -- have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)); -+ have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL) -+#ifdef USE_EAPTLS -+ || have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL)) -+#endif -+ ); - - hadchap = -1; - if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1360,8 +1435,14 @@ - !have_chap_secret((explicit_remote? remote_name: NULL), our_name, - 1, NULL))) && - !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, -- NULL)) -+ NULL) -+#ifdef USE_EAPTLS -+ && !have_eaptls_secret_server((explicit_remote? remote_name: NULL), -+ our_name, 1, NULL) -+#endif -+ ) - go->neg_eap = 0; -+ - } - - -@@ -1721,6 +1802,7 @@ - } - - -+ - /* - * get_secret - open the CHAP secret file and return the secret - * for authenticating the given client on the given server. -@@ -2373,3 +2455,345 @@ - - auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); - } -+ -+ -+#ifdef USE_EAPTLS -+static int -+have_eaptls_secret_server(client, server, need_ip, lacks_ipp) -+ char *client; -+ char *server; -+ int need_ip; -+ int *lacks_ipp; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ filename = _PATH_EAPTLSSERVFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile, -+ clicertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (ret >= 0 && need_ip && !some_ip_ok(addrs)) { -+ if (lacks_ipp != 0) -+ *lacks_ipp = 1; -+ ret = -1; -+ } -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+have_eaptls_secret_client(client, server) -+ char *client; -+ char *server; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs = NULL; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ if ((cacert_file || ca_path) && cert_file && privkey_file) -+ return 1; -+ -+ filename = _PATH_EAPTLSCLIFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile, -+ servcertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk, -+ addrs, opts, filename, flags) -+ FILE *f; -+ char *client; -+ char *server; -+ char *cli_cert; -+ char *serv_cert; -+ char *ca_cert; -+ char *pk; -+ struct wordlist **addrs; -+ struct wordlist **opts; -+ char *filename; -+ int flags; -+{ -+ int newline; -+ int got_flag, best_flag; -+ struct wordlist *ap, *addr_list, *alist, **app; -+ char word[MAXWORDLEN]; -+ -+ if (addrs != NULL) -+ *addrs = NULL; -+ if (opts != NULL) -+ *opts = NULL; -+ addr_list = NULL; -+ if (!getword(f, word, &newline, filename)) -+ return -1; /* file is empty??? */ -+ newline = 1; -+ best_flag = -1; -+ for (;;) { -+ /* -+ * Skip until we find a word at the start of a line. -+ */ -+ while (!newline && getword(f, word, &newline, filename)); -+ if (!newline) -+ break; /* got to end of file */ -+ -+ /* -+ * Got a client - check if it's a match or a wildcard. -+ */ -+ got_flag = 0; -+ if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) { -+ newline = 0; -+ continue; -+ } -+ if (!ISWILD(word)) -+ got_flag = NONWILD_CLIENT; -+ -+ /* -+ * Now get a server and check if it matches. -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (!ISWILD(word)) { -+ if (server != NULL && strcmp(word, server) != 0) -+ continue; -+ got_flag |= NONWILD_SERVER; -+ } -+ -+ /* -+ * Got some sort of a match - see if it's better than what -+ * we have already. -+ */ -+ if (got_flag <= best_flag) -+ continue; -+ -+ /* -+ * Get the cli_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(cli_cert, word, MAXWORDLEN); -+ } else -+ cli_cert[0] = 0; -+ -+ /* -+ * Get serv_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(serv_cert, word, MAXWORDLEN); -+ } else -+ serv_cert[0] = 0; -+ -+ /* -+ * Get ca_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(ca_cert, word, MAXWORDLEN); -+ -+ /* -+ * Get pk -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(pk, word, MAXWORDLEN); -+ -+ -+ /* -+ * Now read address authorization info and make a wordlist. -+ */ -+ app = &alist; -+ for (;;) { -+ if (!getword(f, word, &newline, filename) || newline) -+ break; -+ ap = (struct wordlist *) -+ malloc(sizeof(struct wordlist) + strlen(word) + 1); -+ if (ap == NULL) -+ novm("authorized addresses"); -+ ap->word = (char *) (ap + 1); -+ strcpy(ap->word, word); -+ *app = ap; -+ app = &ap->next; -+ } -+ *app = NULL; -+ /* -+ * This is the best so far; remember it. -+ */ -+ best_flag = got_flag; -+ if (addr_list) -+ free_wordlist(addr_list); -+ addr_list = alist; -+ -+ if (!newline) -+ break; -+ } -+ -+ /* scan for a -- word indicating the start of options */ -+ for (app = &addr_list; (ap = *app) != NULL; app = &ap->next) -+ if (strcmp(ap->word, "--") == 0) -+ break; -+ /* ap = start of options */ -+ if (ap != NULL) { -+ ap = ap->next; /* first option */ -+ free(*app); /* free the "--" word */ -+ *app = NULL; /* terminate addr list */ -+ } -+ if (opts != NULL) -+ *opts = ap; -+ else if (ap != NULL) -+ free_wordlist(ap); -+ if (addrs != NULL) -+ *addrs = addr_list; -+ else if (addr_list != NULL) -+ free_wordlist(addr_list); -+ -+ return best_flag; -+} -+ -+ -+int -+get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -+ cacertfile, capath, pkfile, am_server) -+ int unit; -+ char *client; -+ char *server; -+ char *clicertfile; -+ char *servcertfile; -+ char *cacertfile; -+ char *capath; -+ char *pkfile; -+ int am_server; -+{ -+ FILE *fp; -+ int ret; -+ char *filename = NULL; -+ struct wordlist *addrs = NULL; -+ struct wordlist *opts = NULL; -+ -+ /* maybe overkill, but it eases debugging */ -+ bzero(clicertfile, MAXWORDLEN); -+ bzero(servcertfile, MAXWORDLEN); -+ bzero(cacertfile, MAXWORDLEN); -+ bzero(capath, MAXWORDLEN); -+ bzero(pkfile, MAXWORDLEN); -+ -+ /* the ca+cert+privkey can also be specified as options */ -+ if (!am_server && (cacert_file || ca_path) && cert_file && privkey_file ) -+ { -+ strlcpy( clicertfile, cert_file, MAXWORDLEN ); -+ if (cacert_file) -+ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); -+ if (ca_path) -+ strlcpy( capath, ca_path, MAXWORDLEN ); -+ strlcpy( pkfile, privkey_file, MAXWORDLEN ); -+ } -+ else -+ { -+ filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE); -+ addrs = NULL; -+ -+ fp = fopen(filename, "r"); -+ if (fp == NULL) -+ { -+ error("Can't open eap-tls secret file %s: %m", filename); -+ return 0; -+ } -+ -+ check_access(fp, filename); -+ -+ ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, &opts, filename, 0); -+ -+ fclose(fp); -+ -+ if (ret < 0) return 0; -+ } -+ -+ if (eaptls_passwd_hook) -+ { -+ dbglog( "Calling eaptls password hook" ); -+ if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0) -+ { -+ error("Unable to obtain EAP-TLS password for %s (%s) from plugin", -+ client, pkfile); -+ return 0; -+ } -+ } -+ if (am_server) -+ set_allowed_addrs(unit, addrs, opts); -+ else if (opts != NULL) -+ free_wordlist(opts); -+ if (addrs != NULL) -+ free_wordlist(addrs); -+ -+ return 1; -+} -+#endif -+ -diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.300/pppd/ccp.c ---- ppp-2.4.8/pppd/ccp.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/ccp.c 2020-04-07 10:09:50.567118203 +0200 -@@ -539,6 +539,9 @@ - if (go->mppe) { - ccp_options *ao = &ccp_allowoptions[f->unit]; - int auth_mschap_bits = auth_done[f->unit]; -+#ifdef USE_EAPTLS -+ int auth_eap_bits = auth_done[f->unit]; -+#endif - int numbits; - - /* -@@ -566,8 +569,23 @@ - lcp_close(f->unit, "MPPE required but not available"); - return; - } -+ -+#ifdef USE_EAPTLS -+ /* -+ * MPPE is also possible in combination with EAP-TLS. -+ * It is not possible to detect if we're doing EAP or EAP-TLS -+ * at this stage, hence we accept all forms of EAP. If TLS is -+ * not used then the MPPE keys will not be derived anyway. -+ */ -+ /* Leave only the eap auth bits set */ -+ auth_eap_bits &= (EAP_WITHPEER | EAP_PEER ); -+ -+ if ((numbits == 0) && (auth_eap_bits == 0)) { -+ error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed."); -+#else - if (!numbits) { -- error("MPPE required, but MS-CHAP[v2] auth not performed."); -+ error("MPPE required, but MS-CHAP[v2] auth not performed."); -+#endif - lcp_close(f->unit, "MPPE required but not available"); - return; - } -diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.300/pppd/chap-md5.c ---- ppp-2.4.8/pppd/chap-md5.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/chap-md5.c 2020-04-07 10:09:50.567118203 +0200 -@@ -36,7 +36,11 @@ - #include "chap-new.h" - #include "chap-md5.h" - #include "magic.h" -+#ifdef USE_OPENSSL_MD5 -+#include "openssl/md5.h" -+#else - #include "md5.h" -+#endif /* USE_OPENSSL_MD5 */ - - #define MD5_HASH_SIZE 16 - #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.300/pppd/chap_ms.c ---- ppp-2.4.8/pppd/chap_ms.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/chap_ms.c 2020-04-07 10:09:50.567118203 +0200 -@@ -534,7 +534,7 @@ - char *username, u_char Challenge[8]) - - { -- SHA1_CTX sha1Context; -+ SHA_CTX sha1Context; - u_char sha1Hash[SHA1_SIGNATURE_SIZE]; - char *user; - -@@ -670,7 +670,7 @@ - 0x6E }; - - int i; -- SHA1_CTX sha1Context; -+ SHA_CTX sha1Context; - u_char Digest[SHA1_SIGNATURE_SIZE]; - u_char Challenge[8]; - -@@ -724,7 +724,7 @@ - void - mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) - { -- SHA1_CTX sha1Context; -+ SHA_CTX sha1Context; - u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ - - SHA1_Init(&sha1Context); -@@ -768,7 +768,7 @@ - mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], - u_char NTResponse[24], int IsServer) - { -- SHA1_CTX sha1Context; -+ SHA_CTX sha1Context; - u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ - u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ - -diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.c ---- ppp-2.4.8/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.c 2020-04-07 10:09:50.568118202 +0200 -@@ -0,0 +1,1560 @@ -+/* * eap-tls.c - EAP-TLS implementation for PPP -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * Jan Just Keijser 2006-2019 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "pppd.h" -+#include "eap.h" -+#include "eap-tls.h" -+#include "fsm.h" -+#include "lcp.h" -+#include "pathnames.h" -+ -+typedef struct pw_cb_data -+{ -+ const void *password; -+ const char *prompt_info; -+} PW_CB_DATA; -+ -+/* The openssl configuration file and engines can be loaded only once */ -+static CONF *ssl_config = NULL; -+static ENGINE *cert_engine = NULL; -+static ENGINE *pkey_engine = NULL; -+ -+/* TLSv1.3 do we have a session ticket ? */ -+static int have_session_ticket = 0; -+ -+int ssl_verify_callback(int, X509_STORE_CTX *); -+void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -+ size_t len, SSL * ssl, void *arg); -+int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); -+ -+X509 *get_X509_from_file(char *filename); -+int ssl_cmp_certs(char *filename, X509 * a); -+ -+#ifdef MPPE -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ -+/* -+ * The following stuff is only needed if SSL_export_keying_material() is not available -+ */ -+ -+#if OPENSSL_VERSION_NUMBER < 0x10001000L -+ -+/* -+ * https://wiki.openssl.org/index.php/1.1_API_Changes -+ * tries to provide some guidance but ultimately falls short. -+ * -+ */ -+ -+static void HMAC_CTX_free(HMAC_CTX *ctx) -+{ -+ if (ctx != NULL) { -+ HMAC_CTX_cleanup(ctx); -+ OPENSSL_free(ctx); -+ } -+} -+ -+static HMAC_CTX *HMAC_CTX_new(void) -+{ -+ HMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx)); -+ if (ctx != NULL) -+ HMAC_CTX_init(ctx); -+ return ctx; -+} -+ -+static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, -+ size_t outlen) -+{ -+ if (outlen == 0) -+ return sizeof(ssl->s3->client_random); -+ if (outlen > sizeof(ssl->s3->client_random)) -+ outlen = sizeof(ssl->s3->client_random); -+ memcpy(out, ssl->s3->client_random, outlen); -+ return outlen; -+} -+ -+static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, -+ size_t outlen) -+{ -+ if (outlen == 0) -+ return sizeof(ssl->s3->server_random); -+ if (outlen > sizeof(ssl->s3->server_random)) -+ outlen = sizeof(ssl->s3->server_random); -+ memcpy(out, ssl->s3->server_random, outlen); -+ return outlen; -+} -+ -+static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, -+ unsigned char *out, size_t outlen) -+{ -+ if (outlen == 0) -+ return session->master_key_length; -+ if (outlen > session->master_key_length) -+ outlen = session->master_key_length; -+ memcpy(out, session->master_key, outlen); -+ return outlen; -+} -+ -+ -+/* -+ * TLS PRF from RFC 2246 -+ */ -+static void P_hash(const EVP_MD *evp_md, -+ const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned int out_len) -+{ -+ HMAC_CTX *ctx_a, *ctx_out; -+ unsigned char a[HMAC_MAX_MD_CBLOCK]; -+ unsigned int size; -+ -+ ctx_a = HMAC_CTX_new(); -+ ctx_out = HMAC_CTX_new(); -+ HMAC_Init_ex(ctx_a, secret, secret_len, evp_md, NULL); -+ HMAC_Init_ex(ctx_out, secret, secret_len, evp_md, NULL); -+ -+ size = HMAC_size(ctx_out); -+ -+ /* Calculate A(1) */ -+ HMAC_Update(ctx_a, seed, seed_len); -+ HMAC_Final(ctx_a, a, NULL); -+ -+ while (1) { -+ /* Calculate next part of output */ -+ HMAC_Update(ctx_out, a, size); -+ HMAC_Update(ctx_out, seed, seed_len); -+ -+ /* Check if last part */ -+ if (out_len < size) { -+ HMAC_Final(ctx_out, a, NULL); -+ memcpy(out, a, out_len); -+ break; -+ } -+ -+ /* Place digest in output buffer */ -+ HMAC_Final(ctx_out, out, NULL); -+ HMAC_Init_ex(ctx_out, NULL, 0, NULL, NULL); -+ out += size; -+ out_len -= size; -+ -+ /* Calculate next A(i) */ -+ HMAC_Init_ex(ctx_a, NULL, 0, NULL, NULL); -+ HMAC_Update(ctx_a, a, size); -+ HMAC_Final(ctx_a, a, NULL); -+ } -+ -+ HMAC_CTX_free(ctx_a); -+ HMAC_CTX_free(ctx_out); -+ memset(a, 0, sizeof(a)); -+} -+ -+static void PRF(const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned char *buf, unsigned int out_len) -+{ -+ unsigned int i; -+ unsigned int len = (secret_len + 1) / 2; -+ const unsigned char *s1 = secret; -+ const unsigned char *s2 = secret + (secret_len - len); -+ -+ P_hash(EVP_md5(), s1, len, seed, seed_len, out, out_len); -+ P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len); -+ -+ for (i=0; i < out_len; i++) { -+ out[i] ^= buf[i]; -+ } -+} -+ -+static int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, -+ const char *label, size_t llen, -+ const unsigned char *p, size_t plen, -+ int use_context) -+{ -+ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; -+ unsigned char buf[4*EAPTLS_MPPE_KEY_LEN]; -+ unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH]; -+ size_t master_key_length; -+ unsigned char *pp; -+ -+ pp = seed; -+ -+ memcpy(pp, label, llen); -+ pp += llen; -+ -+ llen += SSL_get_client_random(s, pp, SSL3_RANDOM_SIZE); -+ pp += SSL3_RANDOM_SIZE; -+ -+ llen += SSL_get_server_random(s, pp, SSL3_RANDOM_SIZE); -+ -+ master_key_length = SSL_SESSION_get_master_key(SSL_get_session(s), master_key, -+ sizeof(master_key)); -+ PRF(master_key, master_key_length, seed, llen, out, buf, olen); -+ -+ return 1; -+} -+ -+#endif /* OPENSSL_VERSION_NUMBER < 0x10001000L */ -+ -+ -+/* -+ * OpenSSL 1.1+ introduced a generic TLS_method() -+ * For older releases we substitute the appropriate method -+ */ -+ -+#if OPENSSL_VERSION_NUMBER < 0x10100000L -+ -+#define TLS_method SSLv23_method -+ -+#define SSL3_RT_HEADER 0x100 -+ -+#ifndef SSL_CTX_set_max_proto_version -+/** Mimics SSL_CTX_set_max_proto_version for OpenSSL < 1.1 */ -+static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) -+{ -+ long sslopt = 0; -+ -+ if (tls_ver_max < TLS1_VERSION) -+ { -+ sslopt |= SSL_OP_NO_TLSv1; -+ } -+#ifdef SSL_OP_NO_TLSv1_1 -+ if (tls_ver_max < TLS1_1_VERSION) -+ { -+ sslopt |= SSL_OP_NO_TLSv1_1; -+ } -+#endif -+#ifdef SSL_OP_NO_TLSv1_2 -+ if (tls_ver_max < TLS1_2_VERSION) -+ { -+ sslopt |= SSL_OP_NO_TLSv1_2; -+ } -+#endif -+ SSL_CTX_set_options(ctx, sslopt); -+ -+ return 1; -+} -+#endif /* SSL_CTX_set_max_proto_version */ -+ -+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ -+ -+ -+/* -+ * Generate keys according to RFC 2716 and add to reply -+ */ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) -+{ -+ unsigned char out[4*EAPTLS_MPPE_KEY_LEN]; -+ const char *prf_label; -+ size_t prf_size; -+ unsigned char eap_tls13_context[] = { EAPT_TLS }; -+ unsigned char *context = NULL; -+ size_t context_len = 0; -+ unsigned char *p; -+ -+ dbglog("EAP-TLS generating MPPE keys"); -+ if (ets->tls_v13) -+ { -+ prf_label = "EXPORTER_EAP_TLS_Key_Material"; -+ context = eap_tls13_context; -+ context_len = 1; -+ } -+ else -+ { -+ prf_label = "client EAP encryption"; -+ } -+ -+ dbglog("EAP-TLS PRF label = %s", prf_label); -+ prf_size = strlen(prf_label); -+ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, -+ context, context_len, 0) != 1) -+ { -+ warn( "EAP-TLS: Failed generating keying material" ); -+ return; -+ } -+ -+ /* -+ * We now have the master send and receive keys. -+ * From these, generate the session send and receive keys. -+ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) -+ */ -+ if (client) -+ { -+ p = out; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ } -+ else -+ { -+ p = out; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ } -+ -+ mppe_keys_set = 1; -+} -+ -+#endif /* MPPE */ -+ -+void log_ssl_errors( void ) -+{ -+ unsigned long ssl_err = ERR_get_error(); -+ -+ if (ssl_err != 0) -+ dbglog("EAP-TLS SSL error stack:"); -+ while (ssl_err != 0) { -+ dbglog( ERR_error_string( ssl_err, NULL ) ); -+ ssl_err = ERR_get_error(); -+ } -+} -+ -+ -+int password_callback (char *buf, int size, int rwflag, void *u) -+{ -+ if (buf) -+ { -+ strncpy (buf, passwd, size); -+ return strlen (buf); -+ } -+ return 0; -+} -+ -+ -+CONF *eaptls_ssl_load_config( void ) -+{ -+ CONF *config; -+ int ret_code; -+ long error_line = 33; -+ -+ config = NCONF_new( NULL ); -+ dbglog( "Loading OpenSSL config file" ); -+ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); -+ if (ret_code == 0) -+ { -+ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); -+ NCONF_free( config ); -+ config = NULL; -+ ERR_clear_error(); -+ } -+ -+ dbglog( "Loading OpenSSL built-ins" ); -+ ENGINE_load_builtin_engines(); -+ OPENSSL_load_builtin_modules(); -+ -+ dbglog( "Loading OpenSSL configured modules" ); -+ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) -+ { -+ warn( "EAP-TLS: Error loading OpenSSL modules" ); -+ log_ssl_errors(); -+ config = NULL; -+ } -+ -+ return config; -+} -+ -+ENGINE *eaptls_ssl_load_engine( char *engine_name ) -+{ -+ ENGINE *e = NULL; -+ -+ dbglog( "Enabling OpenSSL auto engines" ); -+ ENGINE_register_all_complete(); -+ -+ dbglog( "Loading OpenSSL '%s' engine support", engine_name ); -+ e = ENGINE_by_id( engine_name ); -+ if (!e) -+ { -+ dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); -+ e = ENGINE_by_id( "dynamic" ); -+ if (e) -+ { -+ if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0) -+ || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) -+ { -+ warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ else -+ { -+ warn( "EAP-TLS: Cannot load dynamic engine support" ); -+ } -+ } -+ -+ if (e) -+ { -+ dbglog( "Initialising engine" ); -+ if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) -+ { -+ warn( "EAP-TLS: Cannot use that engine" ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ -+ return e; -+} -+ -+/* -+ * Initialize the SSL stacks and tests if certificates, key and crl -+ * for client or server use can be loaded. -+ */ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, -+ char *certfile, char *peer_certfile, char *privkeyfile) -+{ -+ char *cert_engine_name = NULL; -+ char *cert_identifier = NULL; -+ char *pkey_engine_name = NULL; -+ char *pkey_identifier = NULL; -+ SSL_CTX *ctx; -+ SSL *ssl; -+ X509_STORE *certstore; -+ X509_LOOKUP *lookup; -+ X509 *tmp; -+ int ret; -+#if defined(TLS1_2_VERSION) -+ long tls_version = TLS1_2_VERSION; -+#elif defined(TLS1_1_VERSION) -+ long tls_version = TLS1_1_VERSION; -+#else -+ long tls_version = TLS1_VERSION; -+#endif -+ -+ /* -+ * Without these can't continue -+ */ -+ if (!(cacertfile[0] || capath[0])) -+ { -+ error("EAP-TLS: CA certificate file or path missing"); -+ return NULL; -+ } -+ -+ if (!certfile[0]) -+ { -+ error("EAP-TLS: Certificate missing"); -+ return NULL; -+ } -+ -+ if (!privkeyfile[0]) -+ { -+ error("EAP-TLS: Private key missing"); -+ return NULL; -+ } -+ -+ SSL_library_init(); -+ SSL_load_error_strings(); -+ -+ ctx = SSL_CTX_new(TLS_method()); -+ -+ if (!ctx) { -+ error("EAP-TLS: Cannot initialize SSL CTX context"); -+ goto fail; -+ } -+ -+ /* if the certificate filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the certificate filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL ) -+ { -+ cert_identifier = index( certfile, ':' ); -+ -+ if (cert_identifier) -+ { -+ cert_engine_name = certfile; -+ *cert_identifier = '\0'; -+ cert_identifier++; -+ -+ dbglog( "Found certificate engine '%s'", cert_engine_name ); -+ dbglog( "Found certificate identifier '%s'", cert_identifier ); -+ } -+ } -+ -+ /* if the privatekey filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the privatekey filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL ) -+ { -+ pkey_identifier = index( privkeyfile, ':' ); -+ -+ if (pkey_identifier) -+ { -+ pkey_engine_name = privkeyfile; -+ *pkey_identifier = '\0'; -+ pkey_identifier++; -+ -+ dbglog( "Found privatekey engine '%s'", pkey_engine_name ); -+ dbglog( "Found privatekey identifier '%s'", pkey_identifier ); -+ } -+ } -+ -+ if (cert_identifier && pkey_identifier) -+ { -+ if (strlen( cert_identifier ) == 0) -+ { -+ if (strlen( pkey_identifier ) == 0) -+ error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" ); -+ else -+ { -+ dbglog( "Substituting privatekey identifier for certificate identifier" ); -+ cert_identifier = pkey_identifier; -+ } -+ } -+ else -+ { -+ if (strlen( pkey_identifier ) == 0) -+ { -+ dbglog( "Substituting certificate identifier for privatekey identifier" ); -+ pkey_identifier = cert_identifier; -+ } -+ } -+ -+ } -+ -+ /* load the openssl config file only once */ -+ if (!ssl_config) -+ { -+ if (cert_engine_name || pkey_engine_name) -+ ssl_config = eaptls_ssl_load_config(); -+ -+ if (ssl_config && cert_engine_name) -+ cert_engine = eaptls_ssl_load_engine( cert_engine_name ); -+ -+ if (ssl_config && pkey_engine_name) -+ { -+ /* don't load the same engine twice */ -+ if ( cert_engine && strcmp( cert_engine_name, pkey_engine_name) == 0 ) -+ pkey_engine = cert_engine; -+ else -+ pkey_engine = eaptls_ssl_load_engine( pkey_engine_name ); -+ } -+ } -+ -+ SSL_CTX_set_default_passwd_cb (ctx, password_callback); -+ -+ if (strlen(cacertfile) == 0) cacertfile = NULL; -+ if (strlen(capath) == 0) capath = NULL; -+ -+ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, capath)) -+ { -+ error("EAP-TLS: Cannot load verify locations"); -+ if (cacertfile) dbglog("CA certificate file = [%s]", cacertfile); -+ if (capath) dbglog("CA certificate path = [%s]", capath); -+ goto fail; -+ } -+ -+ if (init_server) -+ SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); -+ -+ if (cert_engine) -+ { -+ struct -+ { -+ const char *s_slot_cert_id; -+ X509 *cert; -+ } cert_info; -+ -+ cert_info.s_slot_cert_id = cert_identifier; -+ cert_info.cert = NULL; -+ -+ if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) ) -+ { -+ error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier ); -+ goto fail; -+ } -+ -+ if (cert_info.cert) -+ { -+ dbglog( "Got the certificate, adding it to SSL context" ); -+ dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) ); -+ if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_certificate_chain_file(ctx, certfile)) -+ { -+ error( "EAP-TLS: Cannot use public certificate %s", certfile ); -+ goto fail; -+ } -+ } -+ -+ -+ /* -+ * Check the Before and After dates of the certificate -+ */ -+ ssl = SSL_new(ctx); -+ tmp = SSL_get_certificate(ssl); -+ -+ ret = X509_cmp_time(X509_get_notBefore(tmp), NULL); -+ if (ret == 0) -+ { -+ warn( "EAP-TLS: Failed to read certificate notBefore field."); -+ } -+ if (ret > 0) -+ { -+ warn( "EAP-TLS: Your certificate is not yet valid!"); -+ } -+ -+ ret = X509_cmp_time(X509_get_notAfter(tmp), NULL); -+ if (ret == 0) -+ { -+ warn( "EAP-TLS: Failed to read certificate notAfter field."); -+ } -+ if (ret < 0) -+ { -+ warn( "EAP-TLS: Your certificate has expired!"); -+ } -+ SSL_free(ssl); -+ -+ if (pkey_engine) -+ { -+ EVP_PKEY *pkey = NULL; -+ PW_CB_DATA cb_data; -+ -+ cb_data.password = passwd; -+ cb_data.prompt_info = pkey_identifier; -+ -+ dbglog( "Loading private key '%s' from engine", pkey_identifier ); -+ pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data); -+ if (pkey) -+ { -+ dbglog( "Got the private key, adding it to SSL context" ); -+ if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM)) -+ { -+ error("EAP-TLS: Cannot use private key %s", privkeyfile); -+ goto fail; -+ } -+ } -+ -+ if (SSL_CTX_check_private_key(ctx) != 1) { -+ error("EAP-TLS: Private key %s fails security check", privkeyfile); -+ goto fail; -+ } -+ -+ /* Explicitly set the NO_TICKETS flag to support Win7/Win8 clients */ -+ SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 -+#ifdef SSL_OP_NO_TICKET -+ | SSL_OP_NO_TICKET -+#endif -+ ); -+ -+ /* OpenSSL 1.1.1+ does not include RC4 ciphers by default. -+ * This causes totally obsolete WinXP clients to fail. If you really -+ * need ppp+EAP-TLS+openssl 1.1.1+WinXP then enable RC4 cipers and -+ * make sure that you use an OpenSSL that supports them -+ -+ SSL_CTX_set_cipher_list(ctx, "RC4"); -+ */ -+ -+ -+ /* Set up a SSL Session cache with a callback. This is needed for TLSv1.3+. -+ * During the initial handshake the server signals to the client early on -+ * that the handshake is finished, even before the client has sent its -+ * credentials to the server. The actual connection (and moment that the -+ * client sends its credentials) only starts after the arrival of the first -+ * session ticket. The 'ssl_new_session_cb' catches this ticket. -+ */ -+ SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL_STORE); -+ SSL_CTX_sess_set_new_cb(ctx, ssl_new_session_cb); -+ -+ /* As EAP-TLS+TLSv1.3 is highly experimental we offer the user a chance to override */ -+ if (max_tls_version) -+ { -+ if (strncmp(max_tls_version, "1.0", 3) == 0) -+ tls_version = TLS1_VERSION; -+ else if (strncmp(max_tls_version, "1.1", 3) == 0) -+ tls_version = TLS1_1_VERSION; -+ else if (strncmp(max_tls_version, "1.2", 3) == 0) -+#ifdef TLS1_2_VERSION -+ tls_version = TLS1_2_VERSION; -+#else -+ { -+ warn("TLSv1.2 not available. Defaulting to TLSv1.1"); -+ tls_version = TLS_1_1_VERSION; -+ } -+#endif -+ else if (strncmp(max_tls_version, "1.3", 3) == 0) -+#ifdef TLS1_3_VERSION -+ tls_version = TLS1_3_VERSION; -+#else -+ warn("TLSv1.3 not available."); -+#endif -+ } -+ -+ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); -+ SSL_CTX_set_max_proto_version(ctx, tls_version); -+ -+ SSL_CTX_set_verify_depth(ctx, 5); -+ SSL_CTX_set_verify(ctx, -+ SSL_VERIFY_PEER | -+ SSL_VERIFY_FAIL_IF_NO_PEER_CERT, -+ &ssl_verify_callback); -+ -+ if (crl_dir) { -+ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { -+ error("EAP-TLS: Failed to get certificate store"); -+ goto fail; -+ } -+ -+ if (!(lookup = -+ X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) { -+ error("EAP-TLS: Store lookup for CRL failed"); -+ -+ goto fail; -+ } -+ -+ X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM); -+ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); -+ } -+ -+ if (crl_file) { -+ FILE *fp = NULL; -+ X509_CRL *crl = NULL; -+ -+ fp = fopen(crl_file, "r"); -+ if (!fp) { -+ error("EAP-TLS: Cannot open CRL file '%s'", crl_file); -+ goto fail; -+ } -+ -+ crl = PEM_read_X509_CRL(fp, NULL, NULL, NULL); -+ if (!crl) { -+ error("EAP-TLS: Cannot read CRL file '%s'", crl_file); -+ goto fail; -+ } -+ -+ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { -+ error("EAP-TLS: Failed to get certificate store"); -+ goto fail; -+ } -+ if (!X509_STORE_add_crl(certstore, crl)) { -+ error("EAP-TLS: Cannot add CRL to certificate store"); -+ goto fail; -+ } -+ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); -+ -+ } -+ -+ /* -+ * If a peer certificate file was specified, it must be valid, else fail -+ */ -+ if (peer_certfile[0]) { -+ if (!(tmp = get_X509_from_file(peer_certfile))) { -+ error("EAP-TLS: Error loading client certificate from file %s", -+ peer_certfile); -+ goto fail; -+ } -+ X509_free(tmp); -+ } -+ -+ return ctx; -+ -+fail: -+ log_ssl_errors(); -+ SSL_CTX_free(ctx); -+ return NULL; -+} -+ -+/* -+ * Determine the maximum packet size by looking at the LCP handshake -+ */ -+ -+int eaptls_get_mtu(int unit) -+{ -+ int mtu, mru; -+ -+ lcp_options *wo = &lcp_wantoptions[unit]; -+ lcp_options *go = &lcp_gotoptions[unit]; -+ lcp_options *ho = &lcp_hisoptions[unit]; -+ lcp_options *ao = &lcp_allowoptions[unit]; -+ -+ mtu = ho->neg_mru? ho->mru: PPP_MRU; -+ mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; -+ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; -+ -+ dbglog("MTU = %d", mtu); -+ return mtu; -+} -+ -+ -+/* -+ * Init the ssl handshake (server mode) -+ */ -+int eaptls_init_ssl_server(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char capath[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_server.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_server.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_server.ea_session; -+ -+ if (!esp->es_server.ea_peer) { -+ error("EAP-TLS: Error: client name not set (BUG)"); -+ return 0; -+ } -+ -+ strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); -+ -+ dbglog( "getting eaptls secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, clicertfile, -+ servcertfile, cacertfile, capath, pkfile, 1)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_server.ea_peer, esp->es_server.ea_name ); -+ return 0; -+ } -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ ets->ctx = eaptls_init_ssl(1, cacertfile, capath, servcertfile, clicertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ if (!(ets->ssl = SSL_new(ets->ctx))) -+ goto fail; -+ -+ /* -+ * Set auto-retry to avoid timeouts on BIO_read -+ */ -+ SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY); -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_accept_state(ets->ssl); -+ -+ ets->tls_v13 = 0; -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the client certificate file, store it in ets->peercertfile, -+ * so we can check it later in ssl_verify_callback() -+ */ -+ if (clicertfile[0]) -+ strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ SSL_CTX_free(ets->ctx); -+ return 0; -+} -+ -+/* -+ * Init the ssl handshake (client mode) -+ */ -+int eaptls_init_ssl_client(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char capath[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_client.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_client.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_client.ea_session; -+ -+ /* -+ * If available, copy server name in ets; it will be used in cert -+ * verify -+ */ -+ if (esp->es_client.ea_peer) -+ strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); -+ else -+ ets->peer[0] = 0; -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ dbglog( "calling get_eaptls_secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, -+ ets->peer, clicertfile, -+ servcertfile, cacertfile, capath, pkfile, 0)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_client.ea_name, ets->peer ); -+ return 0; -+ } -+ -+ dbglog( "calling eaptls_init_ssl" ); -+ ets->ctx = eaptls_init_ssl(0, cacertfile, capath, clicertfile, servcertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ ets->ssl = SSL_new(ets->ctx); -+ -+ if (!ets->ssl) -+ goto fail; -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ dbglog( "Initializing SSL BIOs" ); -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_connect_state(ets->ssl); -+ -+ ets->tls_v13 = 0; -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the server certificate file, store it in -+ * ets->peercertfile, so we can check it later in -+ * ssl_verify_callback() -+ */ -+ if (servcertfile[0]) -+ strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ dbglog( "eaptls_init_ssl_client: fail" ); -+ SSL_CTX_free(ets->ctx); -+ return 0; -+ -+} -+ -+void eaptls_free_session(struct eaptls_session *ets) -+{ -+ if (ets->ssl) -+ SSL_free(ets->ssl); -+ -+ if (ets->ctx) -+ SSL_CTX_free(ets->ctx); -+ -+ free(ets); -+} -+ -+ -+int eaptls_is_init_finished(struct eaptls_session *ets) -+{ -+ if (ets->ssl && SSL_is_init_finished(ets->ssl)) -+ { -+ if (ets->tls_v13) -+ return have_session_ticket; -+ else -+ return 1; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Handle a received packet, reassembling fragmented messages and -+ * passing them to the ssl engine -+ */ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) -+{ -+ u_char flags; -+ u_int tlslen = 0; -+ u_char dummy[65536]; -+ -+ if (len < 1) { -+ warn("EAP-TLS: received no or invalid data"); -+ return 1; -+ } -+ -+ GETCHAR(flags, inp); -+ len--; -+ -+ if (flags & EAP_TLS_FLAGS_LI && len > 4) { -+ /* -+ * LenghtIncluded flag set -> this is the first packet of a message -+ */ -+ -+ /* -+ * the first 4 octets are the length of the EAP-TLS message -+ */ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ -+ if (!ets->data) { -+ -+ if (tlslen > EAP_TLS_MAX_LEN) { -+ error("EAP-TLS: TLS message length > %d, truncated", EAP_TLS_MAX_LEN); -+ tlslen = EAP_TLS_MAX_LEN; -+ } -+ -+ /* -+ * Allocate memory for the whole message -+ */ -+ ets->data = malloc(tlslen); -+ if (!ets->data) -+ fatal("EAP-TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = tlslen; -+ } -+ else -+ warn("EAP-TLS: non-first LI packet? that's odd..."); -+ } -+ else if (!ets->data) { -+ /* -+ * A non fragmented message without LI flag -+ */ -+ -+ ets->data = malloc(len); -+ if (!ets->data) -+ fatal("EAP-TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = len; -+ } -+ -+ if (flags & EAP_TLS_FLAGS_MF) -+ ets->frag = 1; -+ else -+ ets->frag = 0; -+ -+ if (len < 0) { -+ warn("EAP-TLS: received malformed data"); -+ return 1; -+ } -+ -+ if (len + ets->datalen > ets->tlslen) { -+ warn("EAP-TLS: received data > TLS message length"); -+ return 1; -+ } -+ -+ BCOPY(inp, ets->data + ets->datalen, len); -+ ets->datalen += len; -+ -+ if (!ets->frag) { -+ -+ /* -+ * If we have the whole message, pass it to ssl -+ */ -+ -+ if (ets->datalen != ets->tlslen) { -+ warn("EAP-TLS: received data != TLS message length"); -+ return 1; -+ } -+ -+ if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1) -+ log_ssl_errors(); -+ -+ SSL_read(ets->ssl, dummy, 65536); -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Return an eap-tls packet in outp. -+ * A TLS message read from the ssl engine is buffered in ets->data. -+ * At each call we control if there is buffered data and send a -+ * packet of mtu bytes. -+ */ -+int eaptls_send(struct eaptls_session *ets, u_char ** outp) -+{ -+ bool first = 0; -+ int size; -+ u_char fromtls[65536]; -+ int res; -+ u_char *start; -+ -+ start = *outp; -+ -+ if (!ets->data) -+ { -+ if(!ets->alert_sent) -+ { -+ res = SSL_read(ets->ssl, fromtls, 65536); -+ } -+ -+ /* -+ * Read from ssl -+ */ -+ if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) -+ { -+ warn("EAP-TLS send: No data from BIO_read"); -+ return 1; -+ } -+ -+ ets->datalen = res; -+ -+ ets->data = malloc(ets->datalen); -+ BCOPY(fromtls, ets->data, ets->datalen); -+ -+ ets->offset = 0; -+ first = 1; -+ -+ } -+ -+ size = ets->datalen - ets->offset; -+ -+ if (size > ets->mtu) { -+ size = ets->mtu; -+ ets->frag = 1; -+ } else -+ ets->frag = 0; -+ -+ PUTCHAR(EAPT_TLS, *outp); -+ -+ /* -+ * Set right flags and length if necessary -+ */ -+ if (ets->frag && first) { -+ PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp); -+ PUTLONG(ets->datalen, *outp); -+ } else if (ets->frag) { -+ PUTCHAR(EAP_TLS_FLAGS_MF, *outp); -+ } else -+ PUTCHAR(0, *outp); -+ -+ /* -+ * Copy the data in outp -+ */ -+ BCOPY(ets->data + ets->offset, *outp, size); -+ INCPTR(size, *outp); -+ -+ /* -+ * Copy the packet in retransmission buffer -+ */ -+ BCOPY(start, &ets->rtx[0], *outp - start); -+ ets->rtx_len = *outp - start; -+ -+ ets->offset += size; -+ -+ if (ets->offset >= ets->datalen) { -+ -+ /* -+ * The whole message has been sent -+ */ -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->offset = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Get the sent packet from the retransmission buffer -+ */ -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp) -+{ -+ BCOPY(ets->rtx, *outp, ets->rtx_len); -+ INCPTR(ets->rtx_len, *outp); -+} -+ -+/* -+ * Verify a certificate. -+ * Most of the work (signatures and issuer attributes checking) -+ * is done by ssl; we check the CN in the peer certificate -+ * against the peer name. -+ */ -+int ssl_verify_callback(int ok, X509_STORE_CTX * ctx) -+{ -+ char subject[256]; -+ char cn_str[256]; -+ X509 *peer_cert; -+ int err, depth; -+ SSL *ssl; -+ struct eaptls_session *ets; -+ -+ peer_cert = X509_STORE_CTX_get_current_cert(ctx); -+ err = X509_STORE_CTX_get_error(ctx); -+ depth = X509_STORE_CTX_get_error_depth(ctx); -+ -+ dbglog("certificate verify depth: %d", depth); -+ -+ if (auth_required && !ok) { -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ dbglog("Certificate verification error:\n depth: %d CN: %s" -+ "\n err: %d (%s)\n", depth, cn_str, err, -+ X509_verify_cert_error_string(err)); -+ -+ return 0; -+ } -+ -+ ssl = X509_STORE_CTX_get_ex_data(ctx, -+ SSL_get_ex_data_X509_STORE_CTX_idx()); -+ -+ ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0); -+ -+ if (ets == NULL) { -+ error("Error: SSL_get_ex_data returned NULL"); -+ return 0; -+ } -+ -+ log_ssl_errors(); -+ -+ if (!depth) { /* This is the peer certificate */ -+ -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ /* -+ * If acting as client and the name of the server wasn't specified -+ * explicitely, we can't verify the server authenticity -+ */ -+ if (!ets->peer[0]) { -+ warn("Peer name not specified: no check"); -+ return ok; -+ } -+ -+ /* -+ * Check the CN -+ */ -+ if (strcmp(cn_str, ets->peer)) { -+ error -+ ("Certificate verification error: CN (%s) != peer_name (%s)", -+ cn_str, ets->peer); -+ return 0; -+ } -+ -+ warn("Certificate CN: %s , peer name %s", cn_str, ets->peer); -+ -+ /* -+ * If a peer certificate file was specified, here we check it -+ */ -+ if (ets->peercertfile[0]) { -+ if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert) -+ != 0) { -+ error -+ ("Peer certificate doesn't match stored certificate"); -+ return 0; -+ } -+ } -+ } -+ -+ return ok; -+} -+ -+/* -+ * Compare a certificate with the one stored in a file -+ */ -+int ssl_cmp_certs(char *filename, X509 * a) -+{ -+ X509 *b; -+ int ret; -+ -+ if (!(b = get_X509_from_file(filename))) -+ return 1; -+ -+ ret = X509_cmp(a, b); -+ X509_free(b); -+ -+ return ret; -+ -+} -+ -+X509 *get_X509_from_file(char *filename) -+{ -+ FILE *fp; -+ X509 *ret; -+ -+ if (!(fp = fopen(filename, "r"))) -+ return NULL; -+ -+ ret = PEM_read_X509(fp, NULL, NULL, NULL); -+ -+ fclose(fp); -+ -+ return ret; -+} -+ -+/* -+ * Every sent & received message this callback function is invoked, -+ * so we know when alert messages have arrived or are sent and -+ * we can print debug information about TLS handshake. -+ */ -+void -+ssl_msg_callback(int write_p, int version, int content_type, -+ const void *buf, size_t len, SSL * ssl, void *arg) -+{ -+ char string[256]; -+ struct eaptls_session *ets = (struct eaptls_session *)arg; -+ unsigned char code; -+ const unsigned char*msg = buf; -+ int hvers = msg[1] << 8 | msg[2]; -+ -+ if(write_p) -+ strcpy(string, " -> "); -+ else -+ strcpy(string, " <- "); -+ -+ switch(content_type) { -+ -+ case SSL3_RT_HEADER: -+ strcat(string, "SSL/TLS Header: "); -+ switch(hvers) { -+ case SSL3_VERSION: -+ strcat(string, "SSL 3.0"); -+ break; -+ case TLS1_VERSION: -+ strcat(string, "TLS 1.0"); -+ break; -+ case TLS1_1_VERSION: -+ strcat(string, "TLS 1.1"); -+ break; -+ case TLS1_2_VERSION: -+ strcat(string, "TLS 1.2"); -+ break; -+ default: -+ sprintf(string, "SSL/TLS Header: Unknown version (%d)", hvers); -+ } -+ break; -+ -+ case SSL3_RT_ALERT: -+ strcat(string, "Alert: "); -+ code = msg[1]; -+ -+ if (write_p) { -+ ets->alert_sent = 1; -+ ets->alert_sent_desc = code; -+ } else { -+ ets->alert_recv = 1; -+ ets->alert_recv_desc = code; -+ } -+ -+ strcat(string, SSL_alert_desc_string_long(code)); -+ break; -+ -+ case SSL3_RT_CHANGE_CIPHER_SPEC: -+ strcat(string, "ChangeCipherSpec"); -+ break; -+ -+#ifdef SSL3_RT_INNER_CONTENT_TYPE -+ case SSL3_RT_INNER_CONTENT_TYPE: -+ strcat(string, "InnerContentType (TLS1.3)"); -+ break; -+#endif -+ -+ case SSL3_RT_HANDSHAKE: -+ -+ strcat(string, "Handshake: "); -+ code = msg[0]; -+ -+ switch(code) { -+ case SSL3_MT_HELLO_REQUEST: -+ strcat(string,"Hello Request"); -+ break; -+ case SSL3_MT_CLIENT_HELLO: -+ strcat(string,"Client Hello"); -+ break; -+ case SSL3_MT_SERVER_HELLO: -+ strcat(string,"Server Hello"); -+ break; -+#ifdef SSL3_MT_NEWSESSION_TICKET -+ case SSL3_MT_NEWSESSION_TICKET: -+ strcat(string,"New Session Ticket"); -+ break; -+#endif -+#ifdef SSL3_MT_END_OF_EARLY_DATA -+ case SSL3_MT_END_OF_EARLY_DATA: -+ strcat(string,"End of Early Data"); -+ break; -+#endif -+#ifdef SSL3_MT_ENCRYPTED_EXTENSIONS -+ case SSL3_MT_ENCRYPTED_EXTENSIONS: -+ strcat(string,"Encryped Extensions"); -+ break; -+#endif -+ case SSL3_MT_CERTIFICATE: -+ strcat(string,"Certificate"); -+ break; -+ case SSL3_MT_SERVER_KEY_EXCHANGE: -+ strcat(string,"Server Key Exchange"); -+ break; -+ case SSL3_MT_CERTIFICATE_REQUEST: -+ strcat(string,"Certificate Request"); -+ break; -+ case SSL3_MT_SERVER_DONE: -+ strcat(string,"Server Hello Done"); -+ break; -+ case SSL3_MT_CERTIFICATE_VERIFY: -+ strcat(string,"Certificate Verify"); -+ break; -+ case SSL3_MT_CLIENT_KEY_EXCHANGE: -+ strcat(string,"Client Key Exchange"); -+ break; -+ case SSL3_MT_FINISHED: -+ strcat(string,"Finished: "); -+ hvers = SSL_version(ssl); -+ switch(hvers) { -+ case SSL3_VERSION: -+ strcat(string, "SSL 3.0"); -+ break; -+ case TLS1_VERSION: -+ strcat(string, "TLS 1.0"); -+ break; -+ case TLS1_1_VERSION: -+ strcat(string, "TLS 1.1"); -+ break; -+ case TLS1_2_VERSION: -+ strcat(string, "TLS 1.2"); -+ break; -+#ifdef TLS1_3_VERSION -+ case TLS1_3_VERSION: -+ strcat(string, "TLS 1.3 (experimental)"); -+ ets->tls_v13 = 1; -+ break; -+#endif -+ default: -+ strcat(string, "Unknown version"); -+ } -+ break; -+ default: -+ sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); -+ } -+ break; -+ -+ default: -+ sprintf( string, "SSL message contains unknown content type: %d", content_type ); -+ -+ } -+ -+ /* Alert messages must always be displayed */ -+ if(content_type == SSL3_RT_ALERT) -+ error("%s", string); -+ else -+ dbglog("%s", string); -+} -+ -+int -+ssl_new_session_cb(SSL *s, SSL_SESSION *sess) -+{ -+ dbglog("EAP-TLS: Post-Handshake New Session Ticket arrived:"); -+ have_session_ticket = 1; -+ -+ /* always return success */ -+ return 1; -+} -+ -diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.h ---- ppp-2.4.8/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.h 2020-04-07 10:09:50.568118202 +0200 -@@ -0,0 +1,96 @@ -+/* -+ * eap-tls.h -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * Jan Just Keijser 2006-2019 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#ifndef __EAP_TLS_H__ -+#define __EAP_TLS_H__ -+ -+#include "eap.h" -+ -+#include -+#include -+ -+#define EAP_TLS_FLAGS_LI 128 /* length included flag */ -+#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ -+#define EAP_TLS_FLAGS_START 32 /* start flag */ -+ -+#define EAP_TLS_MAX_LEN 65536 /* max eap tls packet size */ -+ -+struct eaptls_session -+{ -+ u_char *data; /* buffered data */ -+ int datalen; /* buffered data len */ -+ int offset; /* from where to send */ -+ int tlslen; /* total length of tls data */ -+ bool frag; /* packet is fragmented */ -+ bool tls_v13; /* whether we've negotiated TLSv1.3 */ -+ SSL_CTX *ctx; -+ SSL *ssl; /* ssl connection */ -+ BIO *from_ssl; -+ BIO *into_ssl; -+ char peer[MAXWORDLEN]; /* peer name */ -+ char peercertfile[MAXWORDLEN]; -+ bool alert_sent; -+ u_char alert_sent_desc; -+ bool alert_recv; -+ u_char alert_recv_desc; -+ char rtx[EAP_TLS_MAX_LEN]; /* retransmission buffer */ -+ int rtx_len; -+ int mtu; /* unit mtu */ -+}; -+ -+ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, -+ char *certfile, char *peer_certfile, char *privkeyfile); -+int eaptls_init_ssl_server(eap_state * esp); -+int eaptls_init_ssl_client(eap_state * esp); -+void eaptls_free_session(struct eaptls_session *ets); -+ -+int eaptls_is_init_finished(struct eaptls_session *ets); -+ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); -+int eaptls_send(struct eaptls_session *ets, u_char ** outp); -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); -+ -+int get_eaptls_secret(int unit, char *client, char *server, -+ char *clicertfile, char *servcertfile, char *cacertfile, -+ char *capath, char *pkfile, int am_server); -+ -+#ifdef MPPE -+#include "mppe.h" /* MPPE_MAX_KEY_LEN */ -+extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; -+extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; -+extern int mppe_keys_set; -+ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); -+#endif -+ -+#endif -diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.c ---- ppp-2.4.8/pppd/eap.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.c 2020-04-07 10:09:50.569118201 +0200 -@@ -43,6 +43,11 @@ - * Based on draft-ietf-pppext-eap-srp-03.txt. - */ - -+/* -+ * Modification by Beniamino Galvani, Mar 2005 -+ * Implemented EAP-TLS authentication -+ */ -+ - #define RCSID "$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $" - - /* -@@ -62,8 +67,12 @@ - - #include "pppd.h" - #include "pathnames.h" --#include "md5.h" - #include "eap.h" -+#ifdef USE_OPENSSL_MD5 -+#include "openssl/md5.h" -+#else -+#include "md5.h" -+#endif /* USE_OPENSSL_MD5 */ - - #ifdef USE_SRP - #include -@@ -72,8 +81,12 @@ - #include "pppcrypt.h" - #endif /* USE_SRP */ - --#ifndef SHA_DIGESTSIZE --#define SHA_DIGESTSIZE 20 -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#endif /* USE_EAPTLS */ -+ -+#ifndef SHA_DIGEST_LENGTH -+#define SHA_DIGEST_LENGTH 20 - #endif - - -@@ -208,6 +221,9 @@ - esp->es_server.ea_id = (u_char)(drand48() * 0x100); - esp->es_client.ea_timeout = EAP_DEFREQTIME; - esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; -+#ifdef USE_EAPTLS -+ esp->es_client.ea_using_eaptls = 0; -+#endif /* USE_EAPTLS */ - } - - /* -@@ -316,8 +332,8 @@ - { - struct tm *tp; - char tbuf[9]; -- SHA1_CTX ctxt; -- u_char dig[SHA_DIGESTSIZE]; -+ SHA_CTX ctxt; -+ u_char dig[SHA_DIGEST_LENGTH]; - time_t reftime; - - if (pn_secret == NULL) -@@ -435,8 +451,16 @@ - u_char vals[2]; - struct b64state bs; - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ int secret_len; -+ char secret[MAXWORDLEN]; -+#endif /* USE_EAPTLS */ - - esp->es_server.ea_timeout = esp->es_savedtime; -+#ifdef USE_EAPTLS -+ esp->es_server.ea_prev_state = esp->es_server.ea_state; -+#endif /* USE_EAPTLS */ - switch (esp->es_server.ea_state) { - case eapBadAuth: - return; -@@ -561,9 +585,81 @@ - break; - } - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ if (!get_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, secret, &secret_len, 1)) { -+ -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ /* Initialize ssl session */ -+ if(!eaptls_init_ssl_server(esp)) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecv: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->alert_sent) { -+ esp->es_server.ea_state = eapTlsSendAlert; -+ break; -+ } -+ -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsSendAck; -+ else -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSend: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsRecvAck; -+ else -+ if(SSL_is_init_finished(ets->ssl)) -+ esp->es_server.ea_state = eapTlsRecvClient; -+ else -+ /* JJK Add "TLS empty record" message here ??? */ -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsSendAck: -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecvAck: -+ if (status) -+ { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSendAlert: -+ esp->es_server.ea_state = eapTlsRecvAlertAck; -+ break; -+#endif /* USE_EAPTLS */ -+ - case eapSRP1: - #ifdef USE_SRP - ts = (struct t_server *)esp->es_server.ea_session; -@@ -629,6 +725,10 @@ - } - if (esp->es_server.ea_state == eapBadAuth) - eap_send_failure(esp); -+ -+#ifdef USE_EAPTLS -+ dbglog("EAP id=0x%2x '%s' -> '%s'", esp->es_server.ea_id, eap_state_name(esp->es_server.ea_prev_state), eap_state_name(esp->es_server.ea_state)); -+#endif /* USE_EAPTLS */ - } - - /* -@@ -647,10 +747,10 @@ - char *str; - #ifdef USE_SRP - struct t_server *ts; -- u_char clear[8], cipher[8], dig[SHA_DIGESTSIZE], *optr, *cp; -+ u_char clear[8], cipher[8], dig[SHA_DIGEST_LENGTH], *optr, *cp; - int i, j; - struct b64state b64; -- SHA1_CTX ctxt; -+ SHA_CTX ctxt; - #endif /* USE_SRP */ - - /* Handle both initial auth and restart */ -@@ -717,6 +817,30 @@ - INCPTR(esp->es_server.ea_namelen, outp); - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(EAP_TLS_FLAGS_START, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSend: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAck: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAlert: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case eapSRP1: - PUTCHAR(EAPT_SRP, outp); -@@ -763,8 +887,8 @@ - PUTLONG(SRPVAL_EBIT, outp); - ts = (struct t_server *)esp->es_server.ea_session; - assert(ts != NULL); -- BCOPY(t_serverresponse(ts), outp, SHA_DIGESTSIZE); -- INCPTR(SHA_DIGESTSIZE, outp); -+ BCOPY(t_serverresponse(ts), outp, SHA_DIGEST_LENGTH); -+ INCPTR(SHA_DIGEST_LENGTH, outp); - - if (pncrypt_setkey(0)) { - /* Generate pseudonym */ -@@ -804,9 +928,9 @@ - /* Set length and pad out to next 20 octet boundary */ - i = outp - optr - 1; - *optr = i; -- i %= SHA_DIGESTSIZE; -+ i %= SHA_DIGEST_LENGTH; - if (i != 0) { -- while (i < SHA_DIGESTSIZE) { -+ while (i < SHA_DIGEST_LENGTH) { - *outp++ = drand48() * 0x100; - i++; - } -@@ -822,14 +946,14 @@ - while (optr < outp) { - SHA1Final(dig, &ctxt); - cp = dig; -- while (cp < dig + SHA_DIGESTSIZE) -+ while (cp < dig + SHA_DIGEST_LENGTH) - *optr++ ^= *cp++; - SHA1Init(&ctxt); - SHA1Update(&ctxt, &esp->es_server.ea_id, 1); - SHA1Update(&ctxt, esp->es_server.ea_skey, - SESSION_KEY_LEN); -- SHA1Update(&ctxt, optr - SHA_DIGESTSIZE, -- SHA_DIGESTSIZE); -+ SHA1Update(&ctxt, optr - SHA_DIGEST_LENGTH, -+ SHA_DIGEST_LENGTH); - } - } - break; -@@ -903,11 +1027,57 @@ - eap_server_timeout(arg) - void *arg; - { -+#ifdef USE_EAPTLS -+ u_char *outp; -+ u_char *lenloc; -+ int outlen; -+#endif /* USE_EAPTLS */ -+ - eap_state *esp = (eap_state *) arg; - - if (!eap_server_active(esp)) - return; - -+#ifdef USE_EAPTLS -+ switch(esp->es_server.ea_prev_state) { -+ -+ /* -+ * In eap-tls the state changes after a request, so we return to -+ * previous state ... -+ */ -+ case(eapTlsStart): -+ case(eapTlsSendAck): -+ esp->es_server.ea_state = esp->es_server.ea_prev_state; -+ break; -+ -+ /* -+ * ... or resend the stored data -+ */ -+ case(eapTlsSend): -+ case(eapTlsSendAlert): -+ outp = outpacket_buf; -+ MAKEHEADER(outp, PPP_EAP); -+ PUTCHAR(EAP_REQUEST, outp); -+ PUTCHAR(esp->es_server.ea_id, outp); -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ eaptls_retransmit(esp->es_server.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN); -+ esp->es_server.ea_requests++; -+ -+ if (esp->es_server.ea_timeout > 0) -+ TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout); -+ -+ return; -+ default: -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - /* EAP ID number must not change on timeout. */ - eap_send_request(esp); - } -@@ -1154,17 +1324,90 @@ - PUTCHAR(id, outp); - esp->es_client.ea_id = id; - msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) + -- SHA_DIGESTSIZE; -+ SHA_DIGEST_LENGTH; - PUTSHORT(msglen, outp); - PUTCHAR(EAPT_SRP, outp); - PUTCHAR(EAPSRP_CVALIDATOR, outp); - PUTLONG(flags, outp); -- BCOPY(str, outp, SHA_DIGESTSIZE); -+ BCOPY(str, outp, SHA_DIGEST_LENGTH); - - output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen); - } - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+/* -+ * Send an EAP-TLS response message with tls data -+ */ -+static void -+eap_tls_response(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ /* -+ If the id in the request is unchanged, we must retransmit -+ the old data -+ */ -+ if(id == esp->es_client.ea_id) -+ eaptls_retransmit(esp->es_client.ea_session, &outp); -+ else -+ eaptls_send(esp->es_client.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ -+ esp->es_client.ea_id = id; -+} -+ -+/* -+ * Send an EAP-TLS ack -+ */ -+static void -+eap_tls_sendack(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ esp->es_client.ea_id = id; -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+} -+#endif /* USE_EAPTLS */ -+ - static void - eap_send_nak(esp, id, type) - eap_state *esp; -@@ -1251,8 +1494,8 @@ - { - u_char val; - u_char *datp, *digp; -- SHA1_CTX ctxt; -- u_char dig[SHA_DIGESTSIZE]; -+ SHA_CTX ctxt; -+ u_char dig[SHA_DIGEST_LENGTH]; - int dsize, fd, olen = len; - - /* -@@ -1261,21 +1504,21 @@ - */ - val = id; - while (len > 0) { -- if ((dsize = len % SHA_DIGESTSIZE) == 0) -- dsize = SHA_DIGESTSIZE; -+ if ((dsize = len % SHA_DIGEST_LENGTH) == 0) -+ dsize = SHA_DIGEST_LENGTH; - len -= dsize; - datp = inp + len; - SHA1Init(&ctxt); - SHA1Update(&ctxt, &val, 1); - SHA1Update(&ctxt, esp->es_client.ea_skey, SESSION_KEY_LEN); - if (len > 0) { -- SHA1Update(&ctxt, datp, SHA_DIGESTSIZE); -+ SHA1Update(&ctxt, datp, SHA_DIGEST_LENGTH); - } else { - SHA1Update(&ctxt, esp->es_client.ea_name, - esp->es_client.ea_namelen); - } - SHA1Final(dig, &ctxt); -- for (digp = dig; digp < dig + SHA_DIGESTSIZE; digp++) -+ for (digp = dig; digp < dig + SHA_DIGEST_LENGTH; digp++) - *datp++ ^= *digp; - } - -@@ -1319,12 +1562,17 @@ - char rhostname[256]; - MD5_CTX mdContext; - u_char hash[MD5_SIGNATURE_SIZE]; -+#ifdef USE_EAPTLS -+ u_char flags; -+ struct eaptls_session *ets = esp->es_client.ea_session; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - struct t_client *tc; - struct t_num sval, gval, Nval, *Ap, Bval; - u_char vals[2]; -- SHA1_CTX ctxt; -- u_char dig[SHA_DIGESTSIZE]; -+ SHA_CTX ctxt; -+ u_char dig[SHA_DIGEST_LENGTH]; - int fd; - #endif /* USE_SRP */ - -@@ -1455,6 +1703,96 @@ - esp->es_client.ea_namelen); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ -+ switch(esp->es_client.ea_state) { -+ -+ case eapListen: -+ -+ if (len < 1) { -+ error("EAP: received EAP-TLS Listen packet with no data"); -+ /* Bogus request; wait for something real. */ -+ return; -+ } -+ GETCHAR(flags, inp); -+ if(flags & EAP_TLS_FLAGS_START){ -+ -+ esp->es_client.ea_using_eaptls = 1; -+ -+ if (explicit_remote){ -+ esp->es_client.ea_peer = strdup(remote_name); -+ esp->es_client.ea_peerlen = strlen(remote_name); -+ } else -+ esp->es_client.ea_peer = NULL; -+ -+ /* Init ssl session */ -+ if(!eaptls_init_ssl_client(esp)) { -+ dbglog("cannot init ssl"); -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ ets = esp->es_client.ea_session; -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); -+ break; -+ } -+ -+ /* The server has sent a bad start packet. */ -+ eap_send_nak(esp, id, EAPT_TLS); -+ break; -+ -+ case eapTlsRecvAck: -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); -+ break; -+ -+ case eapTlsRecv: -+ if (len < 1) { -+ error("EAP: discarding EAP-TLS Receive packet with no data"); -+ /* Bogus request; wait for something real. */ -+ return; -+ } -+ eaptls_receive(ets, inp, len); -+ -+ if(ets->frag) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecv; -+ break; -+ } -+ -+ if(ets->alert_recv) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvFailure; -+ break; -+ } -+ -+ /* Check if TLS handshake is finished */ -+ if(eaptls_is_init_finished(ets)) { -+#ifdef MPPE -+ eaptls_gen_mppe_keys(ets, 1); -+#endif -+ eaptls_free_session(ets); -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvSuccess; -+ break; -+ } -+ -+ eap_tls_response(esp,id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); -+ break; -+ -+ default: -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case EAPT_SRP: - if (len < 1) { -@@ -1639,7 +1977,7 @@ - esp->es_client.ea_id, id); - } - } else { -- len -= sizeof (u_int32_t) + SHA_DIGESTSIZE; -+ len -= sizeof (u_int32_t) + SHA_DIGEST_LENGTH; - if (len < 0 || t_clientverify(tc, inp + - sizeof (u_int32_t)) != 0) { - error("EAP: SRP server verification " -@@ -1649,7 +1987,7 @@ - GETLONG(esp->es_client.ea_keyflags, inp); - /* Save pseudonym if user wants it. */ - if (len > 0 && esp->es_usepseudo) { -- INCPTR(SHA_DIGESTSIZE, inp); -+ INCPTR(SHA_DIGEST_LENGTH, inp); - write_pseudonym(esp, inp, len, id); - } - } -@@ -1676,7 +2014,7 @@ - esp->es_client.ea_namelen); - SHA1Final(dig, &ctxt); - eap_srp_response(esp, id, EAPSRP_LWRECHALLENGE, dig, -- SHA_DIGESTSIZE); -+ SHA_DIGEST_LENGTH); - break; - - default: -@@ -1732,10 +2070,15 @@ - #ifdef USE_SRP - struct t_server *ts; - struct t_num A; -- SHA1_CTX ctxt; -- u_char dig[SHA_DIGESTSIZE]; -+ eHA_CTX ctxt; -+ u_char dig[SHA_DIGEST_LENGTH]; - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ u_char flags; -+#endif /* USE_EAPTLS */ -+ - if (esp->es_server.ea_id != id) { - dbglog("EAP: discarding Response %d; expected ID %d", id, - esp->es_server.ea_id); -@@ -1775,6 +2118,64 @@ - eap_figure_next_state(esp, 0); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ switch(esp->es_server.ea_state) { -+ -+ case eapTlsRecv: -+ -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ eap_figure_next_state(esp, -+ eaptls_receive(esp->es_server.ea_session, inp, len)); -+ -+ if(ets->alert_recv) { -+ eap_send_failure(esp); -+ break; -+ } -+ break; -+ -+ case eapTlsRecvAck: -+ if(len > 1) { -+ dbglog("EAP-TLS ACK with extra data"); -+ } -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsRecvClient: -+ /* Receive authentication response from client */ -+ if (len > 0) { -+ GETCHAR(flags, inp); -+ -+ if(len == 1 && !flags) { /* Ack = ok */ -+#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, 0 ); -+#endif -+ eap_send_success(esp); -+ } -+ else { /* failure */ -+ warn("Server authentication failed"); -+ eap_send_failure(esp); -+ } -+ } -+ else -+ warn("Bogus EAP-TLS packet received from client"); -+ -+ eaptls_free_session(esp->es_server.ea_session); -+ -+ break; -+ -+ case eapTlsRecvAlertAck: -+ eap_send_failure(esp); -+ break; -+ -+ default: -+ eap_figure_next_state(esp, 1); -+ break; -+ } -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NOTIFICATION: - dbglog("EAP unexpected Notification; response discarded"); - break; -@@ -1806,6 +2207,13 @@ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ /* Send EAP-TLS start packet */ -+ case EAPT_TLS: -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+#endif /* USE_EAPTLS */ -+ - default: - dbglog("EAP: peer requesting unknown Type %d", vallen); - switch (esp->es_server.ea_state) { -@@ -1923,9 +2331,9 @@ - eap_figure_next_state(esp, 1); - break; - } -- if (len < sizeof (u_int32_t) + SHA_DIGESTSIZE) { -+ if (len < sizeof (u_int32_t) + SHA_DIGEST_LENGTH) { - error("EAP: M1 length %d < %d", len, -- sizeof (u_int32_t) + SHA_DIGESTSIZE); -+ sizeof (u_int32_t) + SHA_DIGEST_LENGTH); - eap_figure_next_state(esp, 1); - break; - } -@@ -1962,7 +2370,7 @@ - info("EAP: unexpected SRP Subtype 4 Response"); - return; - } -- if (len != SHA_DIGESTSIZE) { -+ if (len != SHA_DIGEST_LENGTH) { - error("EAP: bad Lightweight rechallenge " - "response"); - return; -@@ -1976,7 +2384,7 @@ - SHA1Update(&ctxt, esp->es_server.ea_peer, - esp->es_server.ea_peerlen); - SHA1Final(dig, &ctxt); -- if (BCMP(dig, inp, SHA_DIGESTSIZE) != 0) { -+ if (BCMP(dig, inp, SHA_DIGEST_LENGTH) != 0) { - error("EAP: failed Lightweight rechallenge"); - eap_send_failure(esp); - break; -@@ -2017,13 +2425,27 @@ - int id; - int len; - { -- if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) { -+ if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp) -+#ifdef USE_EAPTLS -+ && esp->es_client.ea_state != eapTlsRecvSuccess -+#endif /* USE_EAPTLS */ -+ ) { - dbglog("EAP unexpected success message in state %s (%d)", - eap_state_name(esp->es_client.ea_state), - esp->es_client.ea_state); - return; - } - -+#ifdef USE_EAPTLS -+ if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != -+ eapTlsRecvSuccess) { -+ dbglog("EAP-TLS unexpected success message in state %s (%d)", -+ eap_state_name(esp->es_client.ea_state), -+ esp->es_client.ea_state); -+ return; -+ } -+#endif /* USE_EAPTLS */ -+ - if (esp->es_client.ea_timeout > 0) { - UNTIMEOUT(eap_client_timeout, (void *)esp); - } -@@ -2149,6 +2571,9 @@ - int code, id, len, rtype, vallen; - u_char *pstart; - u_int32_t uval; -+#ifdef USE_EAPTLS -+ u_char flags; -+#endif /* USE_EAPTLS */ - - if (inlen < EAP_HEADERLEN) - return (0); -@@ -2213,6 +2638,24 @@ - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_SRP: - if (len < 3) - goto truncated; -@@ -2280,10 +2723,10 @@ - if (uval != 0) { - printer(arg, " f<%X>", uval); - } -- if ((vallen = len) > SHA_DIGESTSIZE) -- vallen = SHA_DIGESTSIZE; -+ if ((vallen = len) > SHA_DIGEST_LENGTH) -+ vallen = SHA_DIGEST_LENGTH; - printer(arg, " ", len, inp, -- len < SHA_DIGESTSIZE ? "?" : ""); -+ len < SHA_DIGEST_LENGTH ? "?" : ""); - INCPTR(vallen, inp); - len -= vallen; - if (len > 0) { -@@ -2324,6 +2767,25 @@ - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NAK: - if (len <= 0) { - printer(arg, " "); -@@ -2387,7 +2849,7 @@ - printer(arg, " f<%X>", uval); - } - printer(arg, " ", len, inp, -- len == SHA_DIGESTSIZE ? "" : "?"); -+ len == SHA_DIGEST_LENGTH ? "" : "?"); - INCPTR(len, inp); - len = 0; - break; -@@ -2397,9 +2859,9 @@ - - case EAPSRP_LWRECHALLENGE: - printer(arg, " ", len, inp, -- len == SHA_DIGESTSIZE ? "" : "?"); -- if ((vallen = len) > SHA_DIGESTSIZE) -- vallen = SHA_DIGESTSIZE; -+ len == SHA_DIGEST_LENGTH ? "" : "?"); -+ if ((vallen = len) > SHA_DIGEST_LENGTH) -+ vallen = SHA_DIGEST_LENGTH; - INCPTR(vallen, inp); - len -= vallen; - break; -@@ -2425,3 +2887,4 @@ - - return (inp - pstart); - } -+ -diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.h ---- ppp-2.4.8/pppd/eap.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.h 2020-04-07 10:09:50.569118201 +0200 -@@ -84,6 +84,16 @@ - eapClosed, /* Authentication not in use */ - eapListen, /* Client ready (and timer running) */ - eapIdentify, /* EAP Identify sent */ -+ eapTlsStart, /* Send EAP-TLS start packet */ -+ eapTlsRecv, /* Receive EAP-TLS tls data */ -+ eapTlsSendAck, /* Send EAP-TLS ack */ -+ eapTlsSend, /* Send EAP-TLS tls data */ -+ eapTlsRecvAck, /* Receive EAP-TLS ack */ -+ eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ -+ eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ -+ eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ -+ eapTlsRecvSuccess, /* Receive EAP success */ -+ eapTlsRecvFailure, /* Receive EAP failure */ - eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ - eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ - eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ -@@ -95,9 +105,18 @@ - - #define EAP_STATES \ - "Initial", "Pending", "Closed", "Listen", "Identify", \ -+ "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ -+ "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ - "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" - --#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#ifdef USE_EAPTLS -+#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial &&\ -+ (esp)->es_client.ea_state != eapPending &&\ -+ (esp)->es_client.ea_state != eapClosed) -+#else -+#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#endif /* USE_EAPTLS */ -+ - #define eap_server_active(esp) \ - ((esp)->es_server.ea_state >= eapIdentify && \ - (esp)->es_server.ea_state <= eapMD5Chall) -@@ -112,11 +131,17 @@ - u_short ea_namelen; /* Length of our name */ - u_short ea_peerlen; /* Length of peer's name */ - enum eap_state_code ea_state; -+#ifdef USE_EAPTLS -+ enum eap_state_code ea_prev_state; -+#endif - u_char ea_id; /* Current id */ - u_char ea_requests; /* Number of Requests sent/received */ - u_char ea_responses; /* Number of Responses */ - u_char ea_type; /* One of EAPT_* */ - u_int32_t ea_keyflags; /* SRP shared key usage flags */ -+#ifdef USE_EAPTLS -+ bool ea_using_eaptls; -+#endif - }; - - /* -@@ -139,7 +164,12 @@ - * Timeouts. - */ - #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ -+#ifdef USE_EAPTLS -+#define EAP_DEFTRANSMITS 30 /* max # times to transmit */ -+ /* certificates can be long ... */ -+#else - #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ -+#endif /* USE_EAPTLS */ - #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ - #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ - -diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.300/pppd/pathnames.h ---- ppp-2.4.8/pppd/pathnames.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pathnames.h 2020-04-07 10:09:50.569118201 +0200 -@@ -21,6 +21,13 @@ - #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" - #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" - #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" -+ -+#ifdef USE_EAPTLS -+#define _PATH_EAPTLSCLIFILE _ROOT_PATH "/etc/ppp/eaptls-client" -+#define _PATH_EAPTLSSERVFILE _ROOT_PATH "/etc/ppp/eaptls-server" -+#define _PATH_OPENSSLCONFFILE _ROOT_PATH "/etc/ppp/openssl.cnf" -+#endif /* USE_EAPTLS */ -+ - #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" - #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" - #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/Makefile.linux ---- ppp-2.4.8/pppd/plugins/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/Makefile.linux 2020-04-07 10:09:50.569118201 +0200 -@@ -4,6 +4,9 @@ - LDFLAGS_SHARED = -shared - INSTALL = install - -+# EAP-TLS -+CFLAGS += -DUSE_EAPTLS=1 -+ - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passprompt.c ---- ppp-2.4.8/pppd/plugins/passprompt.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passprompt.c 2020-04-07 10:09:50.569118201 +0200 -@@ -107,4 +107,7 @@ - { - add_options(options); - pap_passwd_hook = promptpass; -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = promptpass; -+#endif - } -diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passwordfd.c ---- ppp-2.4.8/pppd/plugins/passwordfd.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passwordfd.c 2020-04-07 10:09:50.569118201 +0200 -@@ -79,4 +79,8 @@ - - chap_check_hook = pwfd_check; - chap_passwd_hook = pwfd_passwd; -+ -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = pwfd_passwd; -+#endif - } -diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.300/pppd/pppcrypt.c ---- ppp-2.4.8/pppd/pppcrypt.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppcrypt.c 2020-04-07 10:09:50.569118201 +0200 -@@ -31,6 +31,7 @@ - */ - - #include -+#include - #include "pppd.h" - #include "pppcrypt.h" - -diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.8 ---- ppp-2.4.8/pppd/pppd.8 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.8 2020-04-07 10:09:50.570118199 +0200 -@@ -260,6 +260,12 @@ - compression in the corresponding direction. Use \fInobsdcomp\fR or - \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. - .TP -+.B ca \fIca-file -+(EAP-TLS) Use the file \fIca-file\fR as the X.509 Certificate Authority -+(CA) file (in PEM format), needed for setting up an EAP-TLS connection. -+This option is used on the client-side in conjunction with the \fBcert\fR -+and \fBkey\fR options. -+.TP - .B cdtrcts - Use a non-standard hardware flow control (i.e. DTR/CTS) to control - the flow of data on the serial port. If neither the \fIcrtscts\fR, -@@ -271,6 +277,12 @@ - bi-directional flow control. The sacrifice is that this flow - control mode does not permit using DTR as a modem control line. - .TP -+.B cert \fIcertfile -+(EAP-TLS) Use the file \fIcertfile\fR as the X.509 certificate (in PEM -+format), needed for setting up an EAP-TLS connection. This option is -+used on the client-side in conjunction with the \fBca\fR and -+\fBkey\fR options. -+.TP - .B chap\-interval \fIn - If this option is given, pppd will rechallenge the peer every \fIn\fR - seconds. -@@ -299,6 +311,18 @@ - 1000 (1 second). This wait period only applies if the \fBconnect\fR - or \fBpty\fR option is used. - .TP -+.B crl \fIfilename -+(EAP-TLS) Use the file \fIfilename\fR as the Certificate Revocation List -+to check for the validity of the peer's certificate. This option is not -+mandatory for setting up an EAP-TLS connection. Also see the \fBcrl-dir\fR -+option. -+.TP -+.B crl-dir \fIdirectory -+(EAP-TLS) Use the directory \fIdirectory\fR to scan for CRL files in -+has format ($hash.r0) to check for the validity of the peer's certificate. -+This option is not mandatory for setting up an EAP-TLS connection. -+Also see the \fBcrl\fR option. -+.TP - .B debug - Enables connection debugging facilities. - If this option is given, pppd will log the contents of all -@@ -563,6 +587,12 @@ - the kernel are logged by syslog(1) to a file as directed in the - /etc/syslog.conf configuration file. - .TP -+.B key \fIkeyfile -+(EAP-TLS) Use the file \fIkeyfile\fR as the private key file (in PEM -+format), needed for setting up an EAP-TLS connection. This option is -+used on the client-side in conjunction with the \fBca\fR and -+\fBcert\fR options. -+.TP - .B ktune - Enables pppd to alter kernel settings as appropriate. Under Linux, - pppd will enable IP forwarding (i.e. set /proc/sys/net/ipv4/ip_forward -@@ -721,6 +751,9 @@ - Disable Address/Control compression in both directions (send and - receive). - .TP -+.B need-peer-eap -+(EAP-TLS) Require the peer to verify our authentication credentials. -+.TP - .B noauth - Do not require the peer to authenticate itself. This option is - privileged. -diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.h ---- ppp-2.4.8/pppd/pppd.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.h 2020-04-07 10:09:50.570118199 +0200 -@@ -341,6 +341,12 @@ - extern bool dryrun; /* check everything, print options, exit */ - extern int child_wait; /* # seconds to wait for children at end */ - -+#ifdef USE_EAPTLS -+extern char *crl_dir; -+extern char *crl_file; -+extern char *max_tls_version; -+#endif /* USE_EAPTLS */ -+ - #ifdef MAXOCTETS - extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ - extern int maxoctets_dir; /* Direction : -@@ -763,6 +769,10 @@ - extern int (*chap_passwd_hook) __P((char *user, char *passwd)); - extern void (*multilink_join_hook) __P((void)); - -+#ifdef USE_EAPTLS -+extern int (*eaptls_passwd_hook) __P((char *user, char *passwd)); -+#endif -+ - /* Let a plugin snoop sent and received packets. Useful for L2TP */ - extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); - extern void (*snoop_send_hook) __P((unsigned char *p, int len)); -diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.c ---- ppp-2.4.8/pppd/sha1.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.c 2020-04-07 10:09:50.570118199 +0200 -@@ -101,7 +101,7 @@ - /* SHA1Init - Initialize new context */ - - void --SHA1_Init(SHA1_CTX *context) -+SHA1_Init(SHA_CTX *context) - { - /* SHA1 initialization constants */ - context->state[0] = 0x67452301; -@@ -116,7 +116,7 @@ - /* Run your data through this. */ - - void --SHA1_Update(SHA1_CTX *context, const unsigned char *data, unsigned int len) -+SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len) - { - unsigned int i, j; - -@@ -140,7 +140,7 @@ - /* Add padding and return the message digest. */ - - void --SHA1_Final(unsigned char digest[20], SHA1_CTX *context) -+SHA1_Final(unsigned char *digest, SHA_CTX *context) - { - u_int32_t i, j; - unsigned char finalcount[8]; -diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.h ---- ppp-2.4.8/pppd/sha1.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.h 2020-04-07 10:09:50.570118199 +0200 -@@ -1,11 +1,5 @@ - /* sha1.h */ - --/* If OpenSSL is in use, then use that version of SHA-1 */ --#ifdef OPENSSL --#include --#define __SHA1_INCLUDE_ --#endif -- - #ifndef __SHA1_INCLUDE_ - - #ifndef SHA1_SIGNATURE_SIZE -@@ -20,11 +14,11 @@ - u_int32_t state[5]; - u_int32_t count[2]; - unsigned char buffer[64]; --} SHA1_CTX; -+} SHA_CTX; - --extern void SHA1_Init(SHA1_CTX *); --extern void SHA1_Update(SHA1_CTX *, const unsigned char *, unsigned int); --extern void SHA1_Final(unsigned char[SHA1_SIGNATURE_SIZE], SHA1_CTX *); -+extern void SHA1_Init(SHA_CTX *context); -+extern void SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len); -+extern void SHA1_Final(unsigned char *data, SHA_CTX *context); - - #define __SHA1_INCLUDE_ - #endif /* __SHA1_INCLUDE_ */ -diff -Naur ppp-2.4.8/pppd/sys-solaris.c ppp-2.4.8-eaptls-mppe-1.300/pppd/sys-solaris.c ---- ppp-2.4.8/pppd/sys-solaris.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sys-solaris.c 2020-04-07 10:09:50.571118198 +0200 -@@ -1550,6 +1550,26 @@ - #endif /* defined(INET6) && defined(SOL2) */ - } - -+ -+ -+/* -+ * netif_get_mtu - get the MTU on the PPP network interface. -+ */ -+int -+netif_get_mtu(int unit) -+{ -+ struct ifreq ifr; -+ -+ memset (&ifr, '\0', sizeof (ifr)); -+ strlcpy(ifr.ifr_name, ifname, sizeof (ifr.ifr_name)); -+ -+ if (ioctl(ipfd, SIOCGIFMTU, (caddr_t) &ifr) < 0) { -+ error("ioctl(SIOCGIFMTU): %m (line %d)", __LINE__); -+ return 0; -+ } -+ return ifr.ifr_mtu; -+} -+ - /* - * tty_send_config - configure the transmit characteristics of - * the ppp interface. diff --git a/ppp-2.4.8-man-fix.patch b/ppp-2.4.8-man-fix.patch deleted file mode 100644 index 4ecf1f5..0000000 --- a/ppp-2.4.8-man-fix.patch +++ /dev/null @@ -1,46 +0,0 @@ -diff --git a/pppdump/pppdump.8 b/pppdump/pppdump.8 -index 4072e68..1116b85 100644 ---- a/pppdump/pppdump.8 -+++ b/pppdump/pppdump.8 -@@ -13,6 +13,8 @@ pppdump \- convert PPP record file to readable format - ]] [ - .B \-r - ] [ -+.B \-a -+] [ - .B \-m \fImru - ] [ - .I file \fR... -@@ -54,6 +56,9 @@ Reverses the direction indicators, so that `sent' is printed for - bytes or packets received, and `rcvd' is printed for bytes or packets - sent. - .TP -+.B \-a -+Prints absolute times. -+.TP - .B \-m \fImru - Use \fImru\fR as the MRU (maximum receive unit) for both directions of - the link when checking for over-length PPP packets (with the \fB\-p\fR -diff --git a/pppstats/pppstats.8 b/pppstats/pppstats.8 -index 4ac101e..cabf4d7 100644 ---- a/pppstats/pppstats.8 -+++ b/pppstats/pppstats.8 -@@ -7,6 +7,8 @@ pppstats \- print PPP statistics - [ - .B \-a - ] [ -+.B \-d -+] [ - .B \-v - ] [ - .B \-r -@@ -41,6 +43,9 @@ reports show statistics for the time since the link was initiated. - Without this option, the second and subsequent reports show statistics - for the time since the last report. - .TP -+.B \-d -+Show data rate (kB/s) instead of bytes. -+.TP - .B \-c \fIcount - Repeat the display - .I count diff --git a/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch b/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch deleted file mode 100644 index eddef5b..0000000 --- a/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch +++ /dev/null @@ -1,57 +0,0 @@ -From abef895f9d144f05a83045136b77277352dc450f Mon Sep 17 00:00:00 2001 -From: David Woodhouse -Date: Fri, 4 Apr 2014 18:53:33 +0200 -Subject: [PATCH 09/27] pppd: introduce ipv6-accept-remote - ---- - pppd/ipv6cp.c | 5 ++++- - pppd/ipv6cp.h | 3 ++- - 2 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/pppd/ipv6cp.c b/pppd/ipv6cp.c -index caa2b26..5a56c95 100644 ---- a/pppd/ipv6cp.c -+++ b/pppd/ipv6cp.c -@@ -245,6 +245,8 @@ static option_t ipv6cp_option_list[] = { - - { "ipv6cp-accept-local", o_bool, &ipv6cp_allowoptions[0].accept_local, - "Accept peer's interface identifier for us", 1 }, -+ { "ipv6cp-accept-remote", o_bool, &ipv6cp_allowoptions[0].accept_remote, -+ "Accept peer's interface identifier for itself", 1 }, - - { "defaultroute6", o_bool, &ipv6cp_wantoptions[0].default_route, - "Add default IPv6 route", OPT_ENABLE|1, &ipv6cp_allowoptions[0].default_route }, -@@ -437,6 +439,7 @@ ipv6cp_init(unit) - memset(ao, 0, sizeof(*ao)); - - wo->accept_local = 1; -+ wo->accept_remote = 1; - wo->neg_ifaceid = 1; - ao->neg_ifaceid = 1; - -@@ -962,7 +965,7 @@ ipv6cp_reqci(f, inp, len, reject_if_disagree) - orc = CONFREJ; /* Reject CI */ - break; - } -- if (!eui64_iszero(wo->hisid) && -+ if (!eui64_iszero(wo->hisid) && !wo->accept_remote && - !eui64_equals(ifaceid, wo->hisid) && - eui64_iszero(go->hisid)) { - -diff --git a/pppd/ipv6cp.h b/pppd/ipv6cp.h -index cc4568d..8c7552e 100644 ---- a/pppd/ipv6cp.h -+++ b/pppd/ipv6cp.h -@@ -150,7 +150,8 @@ - int neg_ifaceid; /* Negotiate interface identifier? */ - int req_ifaceid; /* Ask peer to send interface identifier? */ - int default_route; /* Assign default route through interface? */ -- int accept_local; /* accept peer's value for iface id? */ -+ int accept_local; /* accept peer's value for our iface id? */ -+ int accept_remote; /* accept peer's value for his iface id? */ - int opt_local; /* ourtoken set by option */ - int opt_remote; /* histoken set by option */ - int use_ip; /* use IP as interface identifier */ --- -1.8.3.1 - diff --git a/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch deleted file mode 100644 index 18bfecf..0000000 --- a/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch +++ /dev/null @@ -1,383 +0,0 @@ -From 6edc865bd02ab591b9121d4a5f6dc3cdbe5af809 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Wed, 9 Apr 2014 09:18:24 +0200 -Subject: [PATCH 19/27] sys-linux: rework get_first_ethernet() - -We can't assume that host has ethernet NIC named "eth0". Rather than guessing we -better ask udev. We iterate over symlinks symlinks in /sys/class/net and -for each device we determine if it is ethernet device and additionally we query -udev database for sub-type of the device. If we find PCI or USB device which has -ethernet datalink type and appropriate sub-type we return its name. If we don't -succeed in determining more information about device we will return "good -enough" device which in turn is first device with ethernet datalink type. - -Note that we now have two copies of get_first_ethernet() in the source code. This -is bad and should be fixed in the future. - -This commit replaces ppp-2.4.5-eth.patch. - -Resolves: #682381 ---- - pppd/Makefile.linux | 3 + - pppd/multilink.c | 4 +- - pppd/plugins/rp-pppoe/Makefile.linux | 4 +- - pppd/plugins/rp-pppoe/pppoe-discovery.c | 117 +++++++++++++++++++++++++++++++- - pppd/pppd.h | 2 +- - pppd/sys-linux.c | 115 +++++++++++++++++++++++++++++-- - 6 files changed, 232 insertions(+), 13 deletions(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 53df4d2..0e8107f 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -32,6 +32,9 @@ include .depend - endif - - # CC = gcc -+ -+LIBS = -ludev -+ - # - COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" - -diff --git a/pppd/multilink.c b/pppd/multilink.c -index 135cab0..2f0ed50 100644 ---- a/pppd/multilink.c -+++ b/pppd/multilink.c -@@ -436,12 +436,12 @@ static int - get_default_epdisc(ep) - struct epdisc *ep; - { -- char *p; -+ char *p = NULL; - struct hostent *hp; - u_int32_t addr; - - /* First try for an ethernet MAC address */ -- p = get_first_ethernet(); -+ get_first_ethernet(&p); - if (p != 0 && get_if_hwaddr(ep->value, p) >= 0) { - ep->class = EPD_MAC; - ep->length = 6; -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 9918091..b949716 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -30,8 +30,8 @@ COPTS=$(RPM_OPT_FLAGS) - CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' - all: rp-pppoe.so pppoe-discovery - --pppoe-discovery: pppoe-discovery.o debug.o -- $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -+pppoe-discovery: pppoe-discovery.o debug.o common.o -+ $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev - - pppoe-discovery.o: pppoe-discovery.c - $(CC) $(CFLAGS) -I../../.. -c -o pppoe-discovery.o pppoe-discovery.c -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c -index c0d927d..2bd910f 100644 ---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c -@@ -47,8 +47,13 @@ - #include - #endif - -+#include -+#include -+#include -+ - char *xstrdup(const char *s); - void usage(void); -+int get_first_ethernet(char **_r); - - void die(int status) - { -@@ -681,8 +686,15 @@ int main(int argc, char *argv[]) - } - - /* default interface name */ -- if (!conn->ifName) -- conn->ifName = strdup("eth0"); -+ if (!conn->ifName) { -+ char *eth_dev; -+ if (get_first_ethernet(ð_dev) < 0) { -+ fprintf(stderr, "No ethernet device on the host.\n"); -+ exit(1); -+ } -+ conn->ifName = eth_dev; -+ } -+ - - conn->discoverySocket = -1; - conn->sessionSocket = -1; -@@ -722,3 +734,104 @@ void usage(void) - " -h -- Print usage information.\n"); - fprintf(stderr, "\nVersion " RP_VERSION "\n"); - } -+ -+/* -+ * get_first_ethernet - return the name of the first ethernet-style -+ * interface on this system. -+ */ -+int -+get_first_ethernet(char **_r) -+{ -+ int r = 0; -+ DIR *d = NULL; -+ struct dirent *entry = NULL; -+ struct udev *udev = NULL; -+ struct udev_device *dev = NULL; -+ char *eth_dev = NULL; -+ -+ d = opendir("/sys/class/net"); -+ if (!d) { -+ fprintf(stderr, "Failed to open dir /sys/class/net : %m\n"); -+ r = -errno; -+ goto fail; -+ } -+ -+ udev = udev_new(); -+ if (!udev) { -+ fprintf(stderr, "Failed to talk to systemd-udevd\n"); -+ r = -EIO; -+ goto fail; -+ } -+ -+ while ((entry = readdir(d)) != NULL) { -+ char syspath[PATH_MAX] = {}; -+ const char *type = NULL; -+ -+ if ((strcmp(entry->d_name, ".") == 0) || (strcmp(entry->d_name, "..") == 0)) -+ continue; -+ -+ sprintf(syspath, "/sys/class/net/%s", entry->d_name); -+ -+ dev = udev_device_new_from_syspath(udev, syspath); -+ if (!dev) -+ continue; -+ -+ type = udev_device_get_sysattr_value(dev, "type"); -+ if (strcmp(type, "1") == 0) { -+ const char *pci_dev_subclass = NULL, *usb_dev_subclass = NULL; -+ -+ pci_dev_subclass = udev_device_get_property_value(dev, -+ "ID_PCI_SUBCLASS_FROM_DATABASE"); -+ usb_dev_subclass = udev_device_get_property_value(dev, -+ "ID_USB_SUBCLASS_FROM_DATABASE"); -+ -+ if ((pci_dev_subclass && strcmp(pci_dev_subclass, "Ethernet controller") == 0) || -+ (usb_dev_subclass && (strcmp(usb_dev_subclass, "Ethernet Networking") == 0 || -+ strcmp(usb_dev_subclass, "Ethernet Emulation") == 0))) { -+ char *d = NULL; -+ -+ d = strdup(entry->d_name); -+ if (!d) { -+ r = -ENOMEM; -+ goto fail; -+ } -+ -+ free(eth_dev); -+ eth_dev = d; -+ break; -+ } else if (!eth_dev) { -+ eth_dev = strdup(entry->d_name); -+ if (!eth_dev) { -+ r = -ENOMEM; -+ goto fail; -+ } -+ } -+ } -+ -+ udev_device_unref(dev); -+ dev = NULL; -+ } -+ -+ if (dev) -+ udev_device_unref(dev); -+ udev_unref(udev); -+ closedir(d); -+ -+ *_r = eth_dev; -+ -+ return 0; -+ -+fail: -+ if (dev) -+ udev_device_unref(dev); -+ -+ if (udev) -+ udev_unref(udev); -+ -+ if (d) -+ closedir(d); -+ -+ free(eth_dev); -+ -+ return r; -+} -diff --git a/pppd/pppd.h b/pppd/pppd.h -index de271c1..aaddba1 100644 ---- a/pppd/pppd.h -+++ b/pppd/pppd.h -@@ -691,7 +691,7 @@ int sipxfaddr __P((int, unsigned long, unsigned char *)); - int cipxfaddr __P((int)); - #endif - int get_if_hwaddr __P((u_char *addr, char *name)); --char *get_first_ethernet __P((void)); -+int get_first_ethernet __P((char **_r)); - - /* Procedures exported from options.c */ - int setipaddr __P((char *, char **, int)); /* Set local/remote ip addresses */ -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 0690019..ec09c50 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -92,6 +92,9 @@ - #include - #include - #include -+#include -+ -+#include - - /* This is in netdevice.h. However, this compile will fail miserably if - you attempt to include netdevice.h because it has so many references -@@ -1873,10 +1876,101 @@ get_if_hwaddr(u_char *addr, char *name) - * get_first_ethernet - return the name of the first ethernet-style - * interface on this system. - */ --char * --get_first_ethernet() --{ -- return "eth0"; -+int -+get_first_ethernet(char **_r) -+{ -+ int r = 0; -+ DIR *d = NULL; -+ struct dirent *entry = NULL; -+ struct udev *udev = NULL; -+ struct udev_device *dev = NULL; -+ char *eth_dev = NULL; -+ -+ d = opendir("/sys/class/net"); -+ if (!d) { -+ fprintf(stderr, "Failed to open dir /sys/class/net : %m\n"); -+ r = -errno; -+ goto fail; -+ } -+ -+ udev = udev_new(); -+ if (!udev) { -+ fprintf(stderr, "Failed to talk to systemd-udevd\n"); -+ r = -EIO; -+ goto fail; -+ } -+ -+ while ((entry = readdir(d)) != NULL) { -+ char syspath[PATH_MAX] = {}; -+ const char *type = NULL; -+ -+ if ((strcmp(entry->d_name, ".") == 0) || (strcmp(entry->d_name, "..") == 0)) -+ continue; -+ -+ sprintf(syspath, "/sys/class/net/%s", entry->d_name); -+ -+ dev = udev_device_new_from_syspath(udev, syspath); -+ if (!dev) -+ continue; -+ -+ type = udev_device_get_sysattr_value(dev, "type"); -+ if (strcmp(type, "1") == 0) { -+ const char *pci_dev_subclass = NULL, *usb_dev_subclass = NULL; -+ -+ pci_dev_subclass = udev_device_get_property_value(dev, -+ "ID_PCI_SUBCLASS_FROM_DATABASE"); -+ usb_dev_subclass = udev_device_get_property_value(dev, -+ "ID_USB_SUBCLASS_FROM_DATABASE"); -+ -+ if ((pci_dev_subclass && strcmp(pci_dev_subclass, "Ethernet controller") == 0) || -+ (usb_dev_subclass && (strcmp(usb_dev_subclass, "Ethernet Networking") == 0 || -+ strcmp(usb_dev_subclass, "Ethernet Emulation") == 0))) { -+ char *d = NULL; -+ -+ d = strdup(entry->d_name); -+ if (!d) { -+ r = -ENOMEM; -+ goto fail; -+ } -+ -+ free(eth_dev); -+ eth_dev = d; -+ break; -+ } else if (!eth_dev) { -+ eth_dev = strdup(entry->d_name); -+ if (!eth_dev) { -+ r = -ENOMEM; -+ goto fail; -+ } -+ } -+ } -+ -+ udev_device_unref(dev); -+ dev = NULL; -+ } -+ -+ if (dev) -+ udev_device_unref(dev); -+ udev_unref(udev); -+ closedir(d); -+ -+ *_r = eth_dev; -+ -+ return 0; -+ -+fail: -+ if (dev) -+ udev_device_unref(dev); -+ -+ if (udev) -+ udev_unref(udev); -+ -+ if (d) -+ closedir(d); -+ -+ free(eth_dev); -+ -+ return r; - } - - /******************************************************************** -@@ -2859,6 +2953,7 @@ ether_to_eui64(eui64_t *p_eui64) - struct ifreq ifr; - int skfd; - const unsigned char *ptr; -+ char *eth_dev = NULL; - - skfd = socket(PF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if(skfd == -1) -@@ -2867,11 +2962,19 @@ ether_to_eui64(eui64_t *p_eui64) - return 0; - } - -- strcpy(ifr.ifr_name, "eth0"); -+ if (get_first_ethernet(ð_dev) < 0) -+ { -+ warn("no ethernet device present on the host"); -+ return 0; -+ } -+ -+ strcpy(ifr.ifr_name, eth_dev); -+ free(eth_dev); -+ - if(ioctl(skfd, SIOCGIFHWADDR, &ifr) < 0) - { - close(skfd); -- warn("could not obtain hardware address for eth0"); -+ warn("could not obtain hardware address for %s", ifr.ifr_name); - return 0; - } - close(skfd); --- -1.8.3.1 - diff --git a/ppp-2.4.8-ws-2019-workaround.patch b/ppp-2.4.8-ws-2019-workaround.patch deleted file mode 100644 index 837a206..0000000 --- a/ppp-2.4.8-ws-2019-workaround.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 3cd95baf3f1de1d5a9bc89be0f4c3215ceb5aefe Mon Sep 17 00:00:00 2001 -From: yannayl -Date: Sun, 12 Jul 2020 12:12:08 +0300 -Subject: [PATCH] Accept Malformed Windows Success Message - -Windows Server 2019 skip a space when sending a success message. -This commit accepts such a malformed message and continues normally. - -Signed-off-by: Yannay Linveh -Signed-off-by: yannayl ---- - pppd/chap_ms.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c -index 1de50428..ffb6bd13 100644 ---- a/pppd/chap_ms.c -+++ b/pppd/chap_ms.c -@@ -423,6 +423,8 @@ chapms2_check_success(int id, unsigned char *msg, int len) - len -= MS_AUTH_RESPONSE_LENGTH; - if ((len >= 3) && !strncmp((char *)msg, " M=", 3)) { - msg += 3; /* Eat the delimiter */ -+ } else if ((len >= 2) && !strncmp((char *)msg, "M=", 2)) { -+ msg += 2; /* Eat the delimiter */ - } else if (len) { - /* Packet has extra text which does not begin " M=" */ - error("MS-CHAPv2 Success packet is badly formed."); diff --git a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch similarity index 58% rename from ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch rename to ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch index 016e310..c2c8cce 100644 --- a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ b/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch @@ -1,24 +1,8 @@ -From 69711944745af0078da77e108d30f89fd7e06108 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 12:01:33 +0200 -Subject: [PATCH 05/27] build-sys: don't hardcode LIBDIR, but set it according - to the target platform - ---- - pppd/Makefile.linux | 3 ++- - pppd/pathnames.h | 2 +- - pppd/plugins/Makefile.linux | 2 +- - pppd/plugins/pppoatm/Makefile.linux | 2 +- - pppd/plugins/pppol2tp/Makefile.linux | 4 ++-- - pppd/plugins/radius/Makefile.linux | 2 +- - pppd/plugins/rp-pppoe/Makefile.linux | 2 +- - 7 files changed, 9 insertions(+), 8 deletions(-) - diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 63872eb..8ed56c1 100644 +index 6a4b897..8f29c1f 100644 --- a/pppd/Makefile.linux +++ b/pppd/Makefile.linux -@@ -8,6 +8,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ +@@ -12,6 +12,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 INCDIR = $(DESTDIR)/include @@ -26,20 +10,20 @@ index 63872eb..8ed56c1 100644 TARGETS = pppd -@@ -32,7 +33,7 @@ endif +@@ -93,7 +94,7 @@ INCLUDE_DIRS= -I../include - # CC = gcc - # --COPTS = -Wall $(RPM_OPT_FLAGS) -+COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" + COMPILE_FLAGS= -DHAVE_PATHS_H -DIPX_CHANGE -DHAVE_MMAP -pipe - # Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. +-CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS) '-DDESTDIR="@DESTDIR@"' ++CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS) '-DDESTDIR="@DESTDIR@"' -DLIBDIR=\""$(LIBDIR)"\" + + ifdef CHAPMS + CFLAGS += -DCHAPMS=1 diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index a33f046..a427cb8 100644 +index 524d608..c7eadbb 100644 --- a/pppd/pathnames.h +++ b/pppd/pathnames.h -@@ -57,7 +57,7 @@ +@@ -62,7 +62,7 @@ #ifdef PLUGIN #ifdef __STDC__ @@ -49,24 +33,24 @@ index a33f046..a427cb8 100644 #define _PATH_PLUGIN "/usr/lib/pppd" #endif /* __STDC__ */ diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index e09a369..b474a19 100644 +index 6403e3d..f42d18c 100644 --- a/pppd/plugins/Makefile.linux +++ b/pppd/plugins/Makefile.linux -@@ -7,7 +7,7 @@ INSTALL = install +@@ -5,7 +5,7 @@ COPTS=@CFLAGS@ DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) +LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - SUBDIRS := rp-pppoe pppoatm pppol2tp - # Uncomment the next line to include the radius authentication plugin + CFLAGS = $(COPTS) -I.. -I../../include -fPIC + LDFLAGS_SHARED = -shared diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 5a81447..769794b 100644 +index d3a8086..c2aff0c 100644 --- a/pppd/plugins/pppoatm/Makefile.linux +++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -7,7 +7,7 @@ INSTALL = install - #*********************************************************************** +@@ -4,7 +4,7 @@ CC=$(CROSS_COMPILE)@CC@ + COPTS=@CFLAGS@ DESTDIR = $(INSTROOT)@DESTDIR@ -LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) @@ -74,39 +58,11 @@ index 5a81447..769794b 100644 VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index ea3538e..4339566 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -6,8 +6,8 @@ INSTALL = install - - #*********************************************************************** - --DESTDIR = @DESTDIR@ --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+DESTDIR = $(INSTROOT)@DESTDIR@ -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 45b3b8d..179d0b7 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -5,7 +5,7 @@ - - DESTDIR = $(INSTROOT)@DESTDIR@ - MANDIR = $(DESTDIR)/share/man/man8 --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 352991a..1305ed8 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -16,7 +16,7 @@ +diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux +index c415ce3..d3b7392 100644 +--- a/pppd/plugins/pppoe/Makefile.linux ++++ b/pppd/plugins/pppoe/Makefile.linux +@@ -18,7 +18,7 @@ COPTS=@CFLAGS@ DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin @@ -115,6 +71,29 @@ index 352991a..1305ed8 100644 PPPDVERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) --- -1.8.3.1 - +diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux +index 1aa1c0b..e4442f9 100644 +--- a/pppd/plugins/pppol2tp/Makefile.linux ++++ b/pppd/plugins/pppol2tp/Makefile.linux +@@ -4,7 +4,7 @@ CC=$(CROSS_COMPILE)@CC@ + COPTS=@CFLAGS@ + + DESTDIR = $(INSTROOT)/@DESTDIR@ +-LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) ++LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) + + VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) + +diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux +index 489aef2..d2ef044 100644 +--- a/pppd/plugins/radius/Makefile.linux ++++ b/pppd/plugins/radius/Makefile.linux +@@ -9,7 +9,7 @@ COPTS=@CFLAGS@ + + DESTDIR = $(INSTROOT)@DESTDIR@ + MANDIR = $(DESTDIR)/share/man/man8 +-LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) ++LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) + + VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) + diff --git a/ppp-2.4.9-config.patch b/ppp-2.4.9-config.patch new file mode 100644 index 0000000..fc7c781 --- /dev/null +++ b/ppp-2.4.9-config.patch @@ -0,0 +1,21 @@ +diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux +index e77373e..07df6a7 100644 +--- a/pppd/Makefile.linux ++++ b/pppd/Makefile.linux +@@ -68,14 +68,14 @@ USE_TDB=y + #SYSTEMD=y + + HAS_SHADOW=y +-#USE_PAM=y ++USE_PAM=y + HAVE_INET6=y + + # Enable plugins + PLUGIN=y + + # Enable Microsoft proprietary Callback Control Protocol +-#CBCP=y ++CBCP=y + + # Enable EAP SRP-SHA1 authentication (requires libsrp) + #USE_SRP=y diff --git a/ppp-2.4.9-configure-cflags-allow-commas.patch b/ppp-2.4.9-configure-cflags-allow-commas.patch new file mode 100644 index 0000000..5a4ef98 --- /dev/null +++ b/ppp-2.4.9-configure-cflags-allow-commas.patch @@ -0,0 +1,17 @@ +diff --git a/configure b/configure +index f977663..c7031c2 100755 +--- a/configure ++++ b/configure +@@ -121,9 +121,9 @@ mkmkf() { + rm -f $2 + if [ -f $1 ]; then + echo " $2 <= $1" +- sed -e "s,@DESTDIR@,$DESTDIR,g" -e "s,@SYSCONF@,$SYSCONF,g" \ +- -e "s,@CROSS_COMPILE@,$CROSS_COMPILE,g" -e "s,@CC@,$CC,g" \ +- -e "s,@CFLAGS@,$CFLAGS,g" $1 >$2 ++ sed -e "s|@DESTDIR@|$DESTDIR|g" -e "s|@SYSCONF@|$SYSCONF|g" \ ++ -e "s|@CROSS_COMPILE@|$CROSS_COMPILE|g" -e "s|@CC@|$CC|g" \ ++ -e "s|@CFLAGS@|$CFLAGS|g" $1 >$2 + fi + } + diff --git a/ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch b/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch similarity index 99% rename from ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch rename to ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch index 87613af..84a3bdb 100644 --- a/ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch +++ b/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch @@ -43,8 +43,8 @@ index 6d50d1b..4880377 100644 if (log_to_fd >= 0) errfd = log_to_fd; else -- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0600); -+ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0600); +- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0644); ++ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0644); ++conn_running; pid = safe_fork(in, out, errfd); diff --git a/ppp.spec b/ppp.spec index cb0a87a..b2c7658 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ppp -Version: 2.4.8 -Release: 8%{?dist} +Version: 2.4.9 +Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -22,37 +22,22 @@ Source11: ifdown-ppp Source12: ppp-watch.tar.xz # Fedora-specific -Patch0002: ppp-2.4.8-build-sys-enable-PAM-support.patch -Patch0003: ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch -Patch0004: 0004-doc-add-configuration-samples.patch -Patch0005: ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch -Patch0006: 0006-scritps-use-change_resolv_conf-function.patch -Patch0007: 0007-build-sys-don-t-strip-binaries-during-installation.patch -Patch0008: 0008-build-sys-use-prefix-usr-instead-of-usr-local.patch -Patch0009: ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch -Patch0010: 0010-build-sys-enable-CBCP.patch -Patch0011: 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch -Patch0012: ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch -Patch0013: ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch -Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch -Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch -Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch -Patch0018: 0018-scritps-fix-ip-up.local-sample.patch -Patch0019: ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch -Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch -Patch0021: ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch -Patch0022: ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch -Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch -Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch -Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch -# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.8-eaptls-mppe-1.300.patch -Patch0026: ppp-2.4.8-eaptls-mppe-1.300.patch - -Patch0032: ppp-2.4.8-CVE-2020-8597.patch -# rhbz#1612918, https://github.com/paulusmack/ppp/pull/149 -Patch0033: ppp-2.4.8-man-fix.patch -# rhbz#1867047, https://github.com/paulusmack/ppp/commit/3cd95baf3f1de1d5a9bc89be0f4c3215ceb5aefe.patch -Patch0034: ppp-2.4.8-ws-2019-workaround.patch +Patch0002: ppp-2.4.9-config.patch +Patch0004: 0004-doc-add-configuration-samples.patch +Patch0005: ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +Patch0006: 0006-scritps-use-change_resolv_conf-function.patch +Patch0011: 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch +Patch0012: ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch +Patch0013: ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch +Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch +Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch +Patch0018: 0018-scritps-fix-ip-up.local-sample.patch +Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch +Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch +Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch +Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch +Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -92,8 +77,7 @@ This package contains the header files for building plugins for ppp. tar -xJf %{SOURCE12} %build -export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" -%configure +%configure --cflags="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" %{make_build} LDFLAGS="%{?build_ldflags} -pie" %{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" @@ -186,6 +170,10 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Tue Jan 5 2021 Jaroslav Škarvada - 2.4.9-1 +- New version + Resolves: rhbz#1912617 + * Mon Aug 10 2020 Jaroslav Škarvada - 2.4.8-8 - Added workaround for Windows Server 2019 Resolves: rhbz#1867047 diff --git a/sources b/sources index f30d28e..db4f244 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a -SHA512 (ppp-2.4.8.tar.gz) = a99b3b6c7bd80cd133bda4e29d33c793a76f3b67e1f8db774547e88932ce29564fad390a4f51d3fe30a75e006499b95000b042ae0f64cd360548426f8091a478 +SHA512 (ppp-2.4.9.tar.gz) = c309f8f69f534c05547cd2f66dade0e0f198ea4c2928a7e899e660280786b3e965437a67b8c5bb81c59d0fa1818b4eb7b701d2dce015a420d380422d2bca4e1a From f1667c8a0fd4e35830ef1f3835361a7520f4f618 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Fri, 8 Jan 2021 19:28:43 +0000 Subject: [PATCH 16/57] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- ppp.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ppp.spec b/ppp.spec index b2c7658..9dc28d7 100644 --- a/ppp.spec +++ b/ppp.spec @@ -39,6 +39,7 @@ Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch +BuildRequires: make BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel BuildRequires: openssl-devel From e8f51851e79460ecc0b303e5c4b367c3b148b4e9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 08:31:13 +0000 Subject: [PATCH 17/57] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 9dc28d7..c9ce30f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -171,6 +171,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 2.4.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Tue Jan 5 2021 Jaroslav Škarvada - 2.4.9-1 - New version Resolves: rhbz#1912617 From bfc43d320dcff8bfe352e38bf68b320143538c98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 8 Mar 2021 21:12:25 +0100 Subject: [PATCH 18/57] Keep lock files in /var/lock (https://github.com/ppp-project/ppp/pull/227) --- ...-pppd-put-lock-files-in-var-lock-ppp.patch | 26 ------------------- ppp-tmpfiles.conf | 1 - ppp.spec | 11 ++++---- 3 files changed, 5 insertions(+), 33 deletions(-) delete mode 100644 0020-pppd-put-lock-files-in-var-lock-ppp.patch diff --git a/0020-pppd-put-lock-files-in-var-lock-ppp.patch b/0020-pppd-put-lock-files-in-var-lock-ppp.patch deleted file mode 100644 index 93d26c5..0000000 --- a/0020-pppd-put-lock-files-in-var-lock-ppp.patch +++ /dev/null @@ -1,26 +0,0 @@ -From c5a5f795b1defcb6d168e79c4d1fc371dfc556ca Mon Sep 17 00:00:00 2001 -From: Jiri Skala -Date: Wed, 9 Apr 2014 09:29:50 +0200 -Subject: [PATCH 20/27] pppd: put lock files in /var/lock/ppp - -Resolves: #708260 ---- - pppd/utils.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/utils.c b/pppd/utils.c -index 6051b9a..8407492 100644 ---- a/pppd/utils.c -+++ b/pppd/utils.c -@@ -846,7 +846,7 @@ complete_read(int fd, void *buf, size_t count) - /* Procedures for locking the serial device using a lock file. */ - #ifndef LOCK_DIR - #ifdef __linux__ --#define LOCK_DIR "/var/lock" -+#define LOCK_DIR "/var/lock/ppp" - #else - #ifdef SVR4 - #define LOCK_DIR "/var/spool/locks" --- -1.8.3.1 - diff --git a/ppp-tmpfiles.conf b/ppp-tmpfiles.conf index a07719c..1097cbe 100644 --- a/ppp-tmpfiles.conf +++ b/ppp-tmpfiles.conf @@ -1,2 +1 @@ d /run/ppp 0755 root root -d /run/lock/ppp 0755 root root diff --git a/ppp.spec b/ppp.spec index c9ce30f..0db24f8 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 2%{?dist} +Release: 3%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -33,7 +33,6 @@ Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch Patch0018: 0018-scritps-fix-ip-up.local-sample.patch -Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch @@ -72,8 +71,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release} This package contains the header files for building plugins for ppp. %prep -%setup -qn %{name}-%{name}-%{version} -%autopatch -p1 +%autosetup -p1 -n %{name}-%{name}-%{version} tar -xJf %{SOURCE12} @@ -117,7 +115,6 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo # ghosts mkdir -p %{buildroot}%{_rundir}/ppp -mkdir -p %{buildroot}%{_rundir}/lock/ppp %pre /usr/bin/getent group dip >/dev/null 2>&1 || /usr/sbin/groupadd -r -g 40 dip >/dev/null 2>&1 || : @@ -150,7 +147,6 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %{_mandir}/man8/ppp-watch.8* %{_libdir}/pppd %ghost %dir %{_rundir}/ppp -%ghost %dir %{_rundir}/lock/ppp %dir %{_sysconfdir}/logrotate.d %attr(700, root, root) %dir %{_localstatedir}/log/ppp %config(noreplace) %{_sysconfdir}/ppp/eaptls-client @@ -171,6 +167,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Mon Mar 8 2021 Jaroslav Škarvada - 2.4.9-3 +- Keep lock files in /var/lock (https://github.com/ppp-project/ppp/pull/227) + * Wed Jan 27 2021 Fedora Release Engineering - 2.4.9-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From ebfb905788add703e4213479328f9f3335a8ce0b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 03:59:18 +0000 Subject: [PATCH 19/57] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 0db24f8..05abb1a 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 3%{?dist} +Release: 4%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -167,6 +167,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 2.4.9-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Mon Mar 8 2021 Jaroslav Škarvada - 2.4.9-3 - Keep lock files in /var/lock (https://github.com/ppp-project/ppp/pull/227) From 0221a70cad5679021d228ac75d4893d66d2b813d Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:12:00 +0200 Subject: [PATCH 20/57] Rebuilt with OpenSSL 3.0.0 --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 05abb1a..f12567f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 4%{?dist} +Release: 5%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -167,6 +167,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Tue Sep 14 2021 Sahana Prasad - 2.4.9-5 +- Rebuilt with OpenSSL 3.0.0 + * Fri Jul 23 2021 Fedora Release Engineering - 2.4.9-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 879a84b9d88ea14d680dd3f7b0c9640ae4d4829c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jan 2022 09:22:37 +0000 Subject: [PATCH 21/57] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index f12567f..2e9c6f3 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 5%{?dist} +Release: 6%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -167,6 +167,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Fri Jan 21 2022 Fedora Release Engineering - 2.4.9-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Tue Sep 14 2021 Sahana Prasad - 2.4.9-5 - Rebuilt with OpenSSL 3.0.0 From 8c079e9264451529856e83f483c9c00e33e98149 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcin=20Zaj=C4=85czkowski?= <148013+szpak@users.noreply.github.com> Date: Tue, 5 Apr 2022 23:45:18 +0200 Subject: [PATCH 22/57] Backport patches from master for SSTP and EAP-TLS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With those changes will allow pppd to connect to an Azure VnetGWay using SSTP (or using EAP-TLS to a Windows RAS server). Backport to Fedora endorsed by Eivind Næss, their author and the author of sstp-client and network-manager-sstp. Links to git commits used to generate patches: https://github.com/ppp-project/ppp/commit/e609ed8bb62e4648568eaa49fbbc858dfda6d122 https://github.com/ppp-project/ppp/commit/d706c95906d996534f13632a747af5dc617f306e https://github.com/ppp-project/ppp/commit/d7e62a8499c4032d79e05afbd8fd3efd51c5b148 (the first one is only needed to make the second apply in the original form from Git - those changed lines are removed anyway) --- ...MPPE-keys-generated-through-an-API-2.patch | 898 ++++++++++++++++++ ...-error-in-comparing-valid-encryption.patch | 37 + ...-causing-incorrect-response-length-3.patch | 32 + ppp.spec | 8 +- 4 files changed, 974 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch create mode 100644 ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch create mode 100644 ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch diff --git a/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch b/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch new file mode 100644 index 0000000..fb0bcc1 --- /dev/null +++ b/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch @@ -0,0 +1,898 @@ +From d706c95906d996534f13632a747af5dc617f306e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Eivind=20N=C3=A6ss?= +Date: Sat, 24 Apr 2021 03:00:34 -0700 +Subject: [PATCH] pppd: Expose the MPPE keys generated through an API (#267) + +The lengthy part of this fix is to refactor the handling of MPPE keys +by moving it into mppe.c and thus reducing the clutter in chap_ms.c. +It does so by renaming the mppe_set_keys/2 to the corresponding +mppe_set_chapv1/mppe_set_chapv2 versions and updates callers of these +functions. + +Having done so, it conveniently allows the name "mppe_set_keys" to be +re-used for this new purpose which will copy the key material up to +its size and then clear the input parameters (avoids leaving the MPPE +keys on the stack). + +Additional functiions added to the MPPE code allow plugins et al. to +access the MPPE keys, clear the keys, and check if they are set. All +plugin and CCP code has been updated to use this API. + +This fixes GitHub Issue #258 + +Signed-off-by: Eivind Naess +--- + pppd/Makefile.linux | 2 + + pppd/Makefile.sol2 | 2 +- + pppd/ccp.c | 15 +-- + pppd/chap_ms.c | 167 +---------------------- + pppd/chap_ms.h | 22 +--- + pppd/eap-tls.c | 21 +-- + pppd/eap-tls.h | 5 - + pppd/mppe.c | 248 +++++++++++++++++++++++++++++++++++ + pppd/mppe.h | 70 +++++++++- + pppd/plugins/radius/radius.c | 14 +- + pppd/plugins/winbind.c | 8 +- + 11 files changed, 348 insertions(+), 226 deletions(-) + create mode 100644 pppd/mppe.c + +diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux +index f92f7c0..852945e 100644 +--- a/pppd/Makefile.linux ++++ b/pppd/Makefile.linux +@@ -109,6 +109,8 @@ CFLAGS += -DMSLANMAN=1 + endif + ifdef MPPE + CFLAGS += -DMPPE=1 ++PPPDOBJS += mppe.o ++PPPDSRC += mppe.c + HEADERS += mppe.h + endif + endif +diff --git a/pppd/Makefile.sol2 b/pppd/Makefile.sol2 +index 809cb4b..3a8681c 100644 +--- a/pppd/Makefile.sol2 ++++ b/pppd/Makefile.sol2 +@@ -37,7 +37,7 @@ OBJS += ipv6cp.o eui64.o + + # Uncomment to enable MS-CHAP + CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H +-OBJS += chap_ms.o pppcrypt.o md4.o sha1.o ++OBJS += chap_ms.o pppcrypt.o md4.o sha1.o mppe.o + + # Uncomment to enable MPPE (in both CHAP and EAP-TLS) + CFLAGS += -DMPPE +diff --git a/pppd/ccp.c b/pppd/ccp.c +index 052c4c6..387b571 100644 +--- a/pppd/ccp.c ++++ b/pppd/ccp.c +@@ -38,10 +38,9 @@ + #include "ccp.h" + #include + +-#ifdef MPPE +-#include "chap_ms.h" /* mppe_xxxx_key, mppe_keys_set */ ++#include "chap_ms.h" ++#include "mppe.h" + #include "lcp.h" /* lcp_close(), lcp_fsm */ +-#endif + + + /* +@@ -574,7 +573,7 @@ ccp_resetci(fsm *f) + } + + /* A plugin (eg radius) may not have obtained key material. */ +- if (!mppe_keys_set) { ++ if (!mppe_keys_isset()) { + error("MPPE required, but keys are not available. " + "Possible plugin problem?"); + lcp_close(f->unit, "MPPE required but not available"); +@@ -705,7 +704,7 @@ static void + p[1] = opt_buf[1] = CILEN_MPPE; + MPPE_OPTS_TO_CI(go->mppe, &p[2]); + MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]); +- BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); ++ mppe_get_recv_key(&opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); + res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0); + if (res > 0) + p += CILEN_MPPE; +@@ -1156,8 +1155,7 @@ ccp_reqci(fsm *f, u_char *p, int *lenp, int dont_nak) + int mtu; + + BCOPY(p, opt_buf, CILEN_MPPE); +- BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], +- MPPE_MAX_KEY_LEN); ++ mppe_get_send_key(&opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); + if (ccp_test(f->unit, opt_buf, + CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) { + /* This shouldn't happen, we've already tested it! */ +@@ -1426,8 +1424,7 @@ ccp_up(fsm *f) + notice("%s transmit compression enabled", method_name(ho, NULL)); + #ifdef MPPE + if (go->mppe) { +- BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN); +- BZERO(mppe_send_key, MPPE_MAX_KEY_LEN); ++ mppe_clear_keys(); + continue_networks(f->unit); /* Bring up IP et al */ + } + #endif +diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c +index df2dadd..d315ab4 100644 +--- a/pppd/chap_ms.c ++++ b/pppd/chap_ms.c +@@ -93,8 +93,7 @@ + #include "sha1.h" + #include "pppcrypt.h" + #include "magic.h" +- +- ++#include "mppe.h" + + static void ascii2unicode (char[], int, u_char[]); + static void NTPasswordHash (u_char *, int, u_char[MD4_SIGNATURE_SIZE]); +@@ -109,21 +108,12 @@ static void GenerateAuthenticatorResponsePlain + static void ChapMS_LANMan (u_char *, char *, int, u_char *); + #endif + +-#ifdef MPPE +-static void Set_Start_Key (u_char *, char *, int); +-static void SetMasterKeys (char *, int, u_char[24], int); +-#endif +- + #ifdef MSLANMAN + bool ms_lanman = 0; /* Use LanMan password instead of NT */ + /* Has meaning only with MS-CHAP challenges */ + #endif + + #ifdef MPPE +-u_char mppe_send_key[MPPE_MAX_KEY_LEN]; +-u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +-int mppe_keys_set = 0; /* Have the MPPE keys been set? */ +- + #ifdef DEBUGMPPEKEY + /* For MPPE debug */ + /* Use "[]|}{?/><,`!2&&(" (sans quotes) for RFC 3079 MS-CHAPv2 test value */ +@@ -719,28 +709,6 @@ GenerateAuthenticatorResponsePlain + + + #ifdef MPPE +-/* +- * Set mppe_xxxx_key from the NTPasswordHashHash. +- * RFC 2548 (RADIUS support) requires us to export this function (ugh). +- */ +-void +-mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) +-{ +- SHA1_CTX sha1Context; +- u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ +- +- SHA1_Init(&sha1Context); +- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); +- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); +- SHA1_Update(&sha1Context, rchallenge, 8); +- SHA1_Final(Digest, &sha1Context); +- +- /* Same key in both directions. */ +- BCOPY(Digest, mppe_send_key, sizeof(mppe_send_key)); +- BCOPY(Digest, mppe_recv_key, sizeof(mppe_recv_key)); +- +- mppe_keys_set = 1; +-} + + /* + * Set mppe_xxxx_key from MS-CHAP credentials. (see RFC 3079) +@@ -757,104 +725,7 @@ Set_Start_Key(u_char *rchallenge, char *secret, int secret_len) + NTPasswordHash(unicodePassword, secret_len * 2, PasswordHash); + NTPasswordHash(PasswordHash, sizeof(PasswordHash), PasswordHashHash); + +- mppe_set_keys(rchallenge, PasswordHashHash); +-} +- +-/* +- * Set mppe_xxxx_key from MS-CHAPv2 credentials. (see RFC 3079) +- * +- * This helper function used in the Winbind module, which gets the +- * NTHashHash from the server. +- */ +-void +-mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], +- u_char NTResponse[24], int IsServer) +-{ +- SHA1_CTX sha1Context; +- u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ +- u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ +- +- u_char SHApad1[40] = +- { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; +- u_char SHApad2[40] = +- { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, +- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, +- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, +- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 }; +- +- /* "This is the MPPE Master Key" */ +- u_char Magic1[27] = +- { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, +- 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d, +- 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 }; +- /* "On the client side, this is the send key; " +- "on the server side, it is the receive key." */ +- u_char Magic2[84] = +- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, +- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, +- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, +- 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79, +- 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, +- 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65, +- 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, +- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, +- 0x6b, 0x65, 0x79, 0x2e }; +- /* "On the client side, this is the receive key; " +- "on the server side, it is the send key." */ +- u_char Magic3[84] = +- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, +- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, +- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, +- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, +- 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, +- 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, +- 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, +- 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, +- 0x6b, 0x65, 0x79, 0x2e }; +- u_char *s; +- +- SHA1_Init(&sha1Context); +- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); +- SHA1_Update(&sha1Context, NTResponse, 24); +- SHA1_Update(&sha1Context, Magic1, sizeof(Magic1)); +- SHA1_Final(MasterKey, &sha1Context); +- +- /* +- * generate send key +- */ +- if (IsServer) +- s = Magic3; +- else +- s = Magic2; +- SHA1_Init(&sha1Context); +- SHA1_Update(&sha1Context, MasterKey, 16); +- SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); +- SHA1_Update(&sha1Context, s, 84); +- SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); +- SHA1_Final(Digest, &sha1Context); +- +- BCOPY(Digest, mppe_send_key, sizeof(mppe_send_key)); +- +- /* +- * generate recv key +- */ +- if (IsServer) +- s = Magic2; +- else +- s = Magic3; +- SHA1_Init(&sha1Context); +- SHA1_Update(&sha1Context, MasterKey, 16); +- SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); +- SHA1_Update(&sha1Context, s, 84); +- SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); +- SHA1_Final(Digest, &sha1Context); +- +- BCOPY(Digest, mppe_recv_key, sizeof(mppe_recv_key)); +- +- mppe_keys_set = 1; ++ mppe_set_chapv1(rchallenge, PasswordHashHash); + } + + /* +@@ -870,7 +741,7 @@ SetMasterKeys(char *secret, int secret_len, u_char NTResponse[24], int IsServer) + ascii2unicode(secret, secret_len, unicodePassword); + NTPasswordHash(unicodePassword, secret_len * 2, PasswordHash); + NTPasswordHash(PasswordHash, sizeof(PasswordHash), PasswordHashHash); +- mppe_set_keys2(PasswordHashHash, NTResponse, IsServer); ++ mppe_set_chapv2(PasswordHashHash, NTResponse, IsServer); + } + + #endif /* MPPE */ +@@ -945,38 +816,6 @@ ChapMS2(u_char *rchallenge, u_char *PeerChallenge, + #endif + } + +-#ifdef MPPE +-/* +- * Set MPPE options from plugins. +- */ +-void +-set_mppe_enc_types(int policy, int types) +-{ +- /* Early exit for unknown policies. */ +- if (policy != MPPE_ENC_POL_ENC_ALLOWED && +- policy != MPPE_ENC_POL_ENC_REQUIRED) +- return; +- +- /* Don't modify MPPE if it's optional and wasn't already configured. */ +- if (policy == MPPE_ENC_POL_ENC_ALLOWED && !ccp_wantoptions[0].mppe) +- return; +- +- /* +- * Disable undesirable encryption types. Note that we don't ENABLE +- * any encryption types, to avoid overriding manual configuration. +- */ +- switch(types) { +- case MPPE_ENC_TYPES_RC4_40: +- ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ +- break; +- case MPPE_ENC_TYPES_RC4_128: +- ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ +- break; +- default: +- break; +- } +-} +-#endif /* MPPE */ + + static struct chap_digest_type chapms_digest = { + CHAP_MICROSOFT, /* code */ +diff --git a/pppd/chap_ms.h b/pppd/chap_ms.h +index 005eb63..4e6a621 100644 +--- a/pppd/chap_ms.h ++++ b/pppd/chap_ms.h +@@ -38,6 +38,7 @@ + #define MS_CHAP_RESPONSE_LEN 49 /* Response length for MS-CHAP */ + #define MS_CHAP2_RESPONSE_LEN 49 /* Response length for MS-CHAPv2 */ + #define MS_AUTH_RESPONSE_LENGTH 40 /* MS-CHAPv2 authenticator response, */ ++#define MS_AUTH_NTRESP_LEN 24 /* Length of NT-response field */ + /* as ASCII */ + + /* E=eeeeeeeeee error codes for MS-CHAP failure messages. */ +@@ -67,22 +68,6 @@ + #define MS_CHAP2_NTRESP_LEN 24 + #define MS_CHAP2_FLAGS 48 + +-#ifdef MPPE +-#include "mppe.h" /* MPPE_MAX_KEY_LEN */ +-extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; +-extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +-extern int mppe_keys_set; +- +-/* These values are the RADIUS attribute values--see RFC 2548. */ +-#define MPPE_ENC_POL_ENC_ALLOWED 1 +-#define MPPE_ENC_POL_ENC_REQUIRED 2 +-#define MPPE_ENC_TYPES_RC4_40 2 +-#define MPPE_ENC_TYPES_RC4_128 4 +- +-/* used by plugins (using above values) */ +-extern void set_mppe_enc_types(int, int); +-#endif +- + /* Are we the authenticator or authenticatee? For MS-CHAPv2 key derivation. */ + #define MS_CHAP2_AUTHENTICATEE 0 + #define MS_CHAP2_AUTHENTICATOR 1 +@@ -90,11 +75,6 @@ extern void set_mppe_enc_types(int, int); + void ChapMS (u_char *, char *, int, u_char *); + void ChapMS2 (u_char *, u_char *, char *, char *, int, + u_char *, u_char[MS_AUTH_RESPONSE_LENGTH+1], int); +-#ifdef MPPE +-void mppe_set_keys (u_char *, u_char[MD4_SIGNATURE_SIZE]); +-void mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], +- u_char NTResponse[24], int IsServer); +-#endif + + void ChallengeHash (u_char[16], u_char *, char *, u_char[8]); + +diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c +index 5c202c7..bfcf199 100644 +--- a/pppd/eap-tls.c ++++ b/pppd/eap-tls.c +@@ -48,6 +48,8 @@ + #include "eap-tls.h" + #include "fsm.h" + #include "lcp.h" ++#include "chap_ms.h" ++#include "mppe.h" + #include "pathnames.h" + + typedef struct pw_cb_data +@@ -74,10 +76,6 @@ int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); + X509 *get_X509_from_file(char *filename); + int ssl_cmp_certs(char *filename, X509 * a); + +-#ifdef MPPE +- +-#define EAPTLS_MPPE_KEY_LEN 32 +- + /* + * OpenSSL 1.1+ introduced a generic TLS_method() + * For older releases we substitute the appropriate method +@@ -119,6 +117,8 @@ static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) + + #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + ++#ifdef MPPE ++#define EAPTLS_MPPE_KEY_LEN 32 + + /* + * Generate keys according to RFC 2716 and add to reply +@@ -161,24 +161,17 @@ void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) + */ + if (client) + { +- p = out; +- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); +- p += EAPTLS_MPPE_KEY_LEN; +- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); ++ mppe_set_keys(out, out + EAPTLS_MPPE_KEY_LEN, EAPTLS_MPPE_KEY_LEN); + } + else + { +- p = out; +- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); +- p += EAPTLS_MPPE_KEY_LEN; +- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); ++ mppe_set_keys(out + EAPTLS_MPPE_KEY_LEN, out, EAPTLS_MPPE_KEY_LEN); + } +- +- mppe_keys_set = 1; + } + + #endif /* MPPE */ + ++ + void log_ssl_errors( void ) + { + unsigned long ssl_err = ERR_get_error(); +diff --git a/pppd/eap-tls.h b/pppd/eap-tls.h +index c74a831..b935ec5 100644 +--- a/pppd/eap-tls.h ++++ b/pppd/eap-tls.h +@@ -86,11 +86,6 @@ int get_eaptls_secret(int unit, char *client, char *server, + char *capath, char *pkfile, int am_server); + + #ifdef MPPE +-#include "mppe.h" /* MPPE_MAX_KEY_LEN */ +-extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; +-extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +-extern int mppe_keys_set; +- + void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); + #endif + +diff --git a/pppd/mppe.c b/pppd/mppe.c +new file mode 100644 +index 0000000..4f3d131 +--- /dev/null ++++ b/pppd/mppe.c +@@ -0,0 +1,248 @@ ++/* * mppe.c - MPPE key implementation ++ * ++ * Copyright (c) 2020 Eivind Naess. All rights reserved. ++ * Copyright (c) 2008 Paul Mackerras. All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in ++ * the documentation and/or other materials provided with the ++ * distribution. ++ * ++ * 3. The name(s) of the authors of this software must not be used to ++ * endorse or promote products derived from this software without ++ * prior written permission. ++ * ++ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO ++ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY ++ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY ++ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN ++ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING ++ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ * ++ */ ++ ++#include ++ ++#include "pppd.h" ++#include "fsm.h" ++#include "md4.h" ++#include "sha1.h" ++#include "ccp.h" ++#include "chap_ms.h" ++#include "mppe.h" ++ ++u_char mppe_send_key[MPPE_MAX_KEY_SIZE]; ++u_char mppe_recv_key[MPPE_MAX_KEY_SIZE]; ++int mppe_keys_set = 0; ++ ++void ++mppe_set_keys(u_char *send_key, u_char *recv_key, int keylen) ++{ ++ int length = keylen; ++ if (length > MPPE_MAX_KEY_SIZE) ++ length = MPPE_MAX_KEY_SIZE; ++ ++ if (send_key) { ++ BCOPY(send_key, mppe_send_key, length); ++ BZERO(send_key, keylen); ++ } ++ ++ if (recv_key) { ++ BCOPY(recv_key, mppe_recv_key, length); ++ BZERO(recv_key, keylen); ++ } ++ ++ mppe_keys_set = length; ++} ++ ++bool ++mppe_keys_isset() ++{ ++ return !!mppe_keys_set; ++} ++ ++int ++mppe_get_recv_key(u_char *recv_key, int length) ++{ ++ if (mppe_keys_isset()) { ++ if (length > mppe_keys_set) ++ length = mppe_keys_set; ++ BCOPY(mppe_recv_key, recv_key, length); ++ return length; ++ } ++ return 0; ++} ++ ++int ++mppe_get_send_key(u_char *send_key, int length) ++{ ++ if (mppe_keys_isset()) { ++ if (length > mppe_keys_set) ++ length = mppe_keys_set; ++ BCOPY(mppe_send_key, send_key, length); ++ return length; ++ } ++ return 0; ++} ++ ++void ++mppe_clear_keys(void) ++{ ++ mppe_keys_set = 0; ++ BZERO(mppe_send_key, sizeof(mppe_send_key)); ++ BZERO(mppe_recv_key, sizeof(mppe_recv_key)); ++} ++ ++/* ++ * Set mppe_xxxx_key from the NTPasswordHashHash. ++ * RFC 2548 (RADIUS support) requires us to export this function (ugh). ++ */ ++void ++mppe_set_chapv1(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) ++{ ++ SHA1_CTX sha1Context; ++ u_char Digest[SHA1_SIGNATURE_SIZE]; ++ ++ SHA1_Init(&sha1Context); ++ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); ++ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); ++ SHA1_Update(&sha1Context, rchallenge, 8); ++ SHA1_Final(Digest, &sha1Context); ++ ++ /* Same key in both directions. */ ++ mppe_set_keys(Digest, Digest, sizeof(Digest)); ++} ++ ++/* ++ * Set mppe_xxxx_key from MS-CHAPv2 credentials. (see RFC 3079) ++ * ++ * This helper function used in the Winbind module, which gets the ++ * NTHashHash from the server. ++ */ ++void ++mppe_set_chapv2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], ++ u_char NTResponse[MS_AUTH_NTRESP_LEN], int IsServer) ++{ ++ SHA1_CTX sha1Context; ++ u_char MasterKey[SHA1_SIGNATURE_SIZE]; ++ u_char SendKey[SHA1_SIGNATURE_SIZE]; ++ u_char RecvKey[SHA1_SIGNATURE_SIZE]; ++ ++ u_char SHApad1[40] = ++ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, ++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, ++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, ++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; ++ u_char SHApad2[40] = ++ { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, ++ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, ++ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, ++ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 }; ++ ++ /* "This is the MPPE Master Key" */ ++ u_char Magic1[27] = ++ { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, ++ 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d, ++ 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 }; ++ /* "On the client side, this is the send key; " ++ "on the server side, it is the receive key." */ ++ u_char Magic2[84] = ++ { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, ++ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, ++ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, ++ 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79, ++ 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, ++ 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65, ++ 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, ++ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, ++ 0x6b, 0x65, 0x79, 0x2e }; ++ /* "On the client side, this is the receive key; " ++ "on the server side, it is the send key." */ ++ u_char Magic3[84] = ++ { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, ++ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, ++ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, ++ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, ++ 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, ++ 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, ++ 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, ++ 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, ++ 0x6b, 0x65, 0x79, 0x2e }; ++ u_char *s; ++ ++ SHA1_Init(&sha1Context); ++ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); ++ SHA1_Update(&sha1Context, NTResponse, 24); ++ SHA1_Update(&sha1Context, Magic1, sizeof(Magic1)); ++ SHA1_Final(MasterKey, &sha1Context); ++ ++ /* ++ * generate send key ++ */ ++ if (IsServer) ++ s = Magic3; ++ else ++ s = Magic2; ++ SHA1_Init(&sha1Context); ++ SHA1_Update(&sha1Context, MasterKey, 16); ++ SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); ++ SHA1_Update(&sha1Context, s, 84); ++ SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); ++ SHA1_Final(SendKey, &sha1Context); ++ ++ /* ++ * generate recv key ++ */ ++ if (IsServer) ++ s = Magic2; ++ else ++ s = Magic3; ++ SHA1_Init(&sha1Context); ++ SHA1_Update(&sha1Context, MasterKey, 16); ++ SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); ++ SHA1_Update(&sha1Context, s, 84); ++ SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); ++ SHA1_Final(RecvKey, &sha1Context); ++ ++ mppe_set_keys(SendKey, RecvKey, SHA1_SIGNATURE_SIZE); ++} ++ ++/* ++ * Set MPPE options from plugins. ++ */ ++void ++mppe_set_enc_types(int policy, int types) ++{ ++ /* Early exit for unknown policies. */ ++ if (policy != MPPE_ENC_POL_ENC_ALLOWED && ++ policy != MPPE_ENC_POL_ENC_REQUIRED) ++ return; ++ ++ /* Don't modify MPPE if it's optional and wasn't already configured. */ ++ if (policy == MPPE_ENC_POL_ENC_ALLOWED && !ccp_wantoptions[0].mppe) ++ return; ++ ++ /* ++ * Disable undesirable encryption types. Note that we don't ENABLE ++ * any encryption types, to avoid overriding manual configuration. ++ */ ++ switch(types) { ++ case MPPE_ENC_TYPES_RC4_40: ++ ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ ++ break; ++ case MPPE_ENC_TYPES_RC4_128: ++ ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ ++ break; ++ default: ++ break; ++ } ++} ++ +diff --git a/pppd/mppe.h b/pppd/mppe.h +index 5eb3b37..98a89d3 100644 +--- a/pppd/mppe.h ++++ b/pppd/mppe.h +@@ -32,9 +32,12 @@ + * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ ++#ifndef __MPPE_H__ ++#define __MPPE_H__ + + #define MPPE_PAD 4 /* MPPE growth per frame */ +-#define MPPE_MAX_KEY_LEN 16 /* largest key length (128-bit) */ ++#define MPPE_MAX_KEY_SIZE 32 /* Largest key length */ ++#define MPPE_MAX_KEY_LEN 16 /* Largest key size accepted by the kernel */ + + /* option bits for ccp_options.mppe */ + #define MPPE_OPT_40 0x01 /* 40 bit */ +@@ -119,3 +122,68 @@ + if (ptr[3] & ~MPPE_ALL_BITS) \ + opts |= MPPE_OPT_UNKNOWN; \ + } while (/* CONSTCOND */ 0) ++ ++ ++#if MPPE ++ ++/* ++ * NOTE: ++ * Access to these variables directly is discuraged. Please ++ * change your code to use below accessor functions. ++ */ ++ ++/* The key material generated which is used for MPPE send key */ ++extern u_char mppe_send_key[MPPE_MAX_KEY_SIZE]; ++/* The key material generated which is used for MPPE recv key */ ++extern u_char mppe_recv_key[MPPE_MAX_KEY_SIZE]; ++/* Keys are set if value is non-zero */ ++extern int mppe_keys_set; ++ ++/* These values are the RADIUS attribute values--see RFC 2548. */ ++#define MPPE_ENC_POL_ENC_ALLOWED 1 ++#define MPPE_ENC_POL_ENC_REQUIRED 2 ++#define MPPE_ENC_TYPES_RC4_40 2 ++#define MPPE_ENC_TYPES_RC4_128 4 ++ ++/* used by plugins (using above values) */ ++void mppe_set_enc_types (int policy, int types); ++ ++/* ++ * Set the MPPE send and recv keys. NULL values for keys are ignored ++ * and input values are cleared to avoid leaving them on the stack ++ */ ++void mppe_set_keys(u_char *send_key, u_char *recv_key, int keylen); ++ ++/* ++ * Get the MPPE recv key ++ */ ++int mppe_get_recv_key(u_char *recv_key, int length); ++ ++/* ++ * Get the MPPE send key ++ */ ++int mppe_get_send_key(u_char *send_key, int length); ++ ++/* ++ * Clear the MPPE keys ++ */ ++void mppe_clear_keys(void); ++ ++/* ++ * Check if the MPPE keys are set ++ */ ++bool mppe_keys_isset(void); ++ ++/* ++ * Set mppe_xxxx_key from NT Password Hash Hash (MSCHAPv1), see RFC3079 ++ */ ++void mppe_set_chapv1(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]); ++ ++/* ++ * Set the mppe_xxxx_key from MS-CHAP-v2 credentials, see RFC3079 ++ */ ++void mppe_set_chapv2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], ++ u_char NTResponse[MS_AUTH_NTRESP_LEN], int IsServer); ++ ++#endif // #ifdef MPPE ++#endif // #ifdef __MPPE_H__ +diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c +index c579831..cf4c0f2 100644 +--- a/pppd/plugins/radius/radius.c ++++ b/pppd/plugins/radius/radius.c +@@ -31,6 +31,7 @@ static char const RCSID[] = + #ifdef CHAPMS + #include "chap_ms.h" + #ifdef MPPE ++#include "mppe.h" + #include "md5.h" + #endif + #endif +@@ -743,11 +744,12 @@ radius_setparams(VALUE_PAIR *vp, char *msg, REQUEST_INFO *req_info, + * Note that if the policy value was '0' we don't set the key! + */ + if (mppe_enc_policy && mppe_enc_keys) { +- mppe_keys_set = 1; + /* Set/modify allowed encryption types. */ + if (mppe_enc_types) +- set_mppe_enc_types(mppe_enc_policy, mppe_enc_types); ++ mppe_set_enc_types(mppe_enc_policy, mppe_enc_types); ++ return 0; + } ++ mppe_clear_keys(); + #endif + + return 0; +@@ -803,7 +805,7 @@ radius_setmppekeys(VALUE_PAIR *vp, REQUEST_INFO *req_info, + * the NAS (us) doesn't need; we only need the start key. So we have + * to generate the start key, sigh. NB: We do not support the LM-Key. + */ +- mppe_set_keys(challenge, &plain[8]); ++ mppe_set_chapv1(challenge, &plain[8]); + + return 0; + } +@@ -855,7 +857,7 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info) + for (i = 0; i < 16; i++) + plain[i] ^= buf[i]; + +- if (plain[0] != sizeof(mppe_send_key) /* 16 */) { ++ if (plain[0] != 16) { + error("RADIUS: Incorrect key length (%d) for MS-MPPE-%s-Key attribute", + (int) plain[0], type); + return -1; +@@ -869,9 +871,9 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info) + plain[16] ^= buf[0]; /* only need the first byte */ + + if (vp->attribute == PW_MS_MPPE_SEND_KEY) +- memcpy(mppe_send_key, plain + 1, 16); ++ mppe_set_keys(plain + 1, NULL, 16); + else +- memcpy(mppe_recv_key, plain + 1, 16); ++ mppe_set_keys(NULL, plain + 1, 16); + + return 0; + } +diff --git a/pppd/plugins/winbind.c b/pppd/plugins/winbind.c +index 0c395c3..67c72f6 100644 +--- a/pppd/plugins/winbind.c ++++ b/pppd/plugins/winbind.c +@@ -37,11 +37,9 @@ + #include "pppd.h" + #include "chap-new.h" + #include "chap_ms.h" +-#ifdef MPPE +-#include "md5.h" +-#endif + #include "fsm.h" + #include "ipcp.h" ++#include "mppe.h" + #include + #include + #include +@@ -583,7 +581,7 @@ winbind_chap_verify(char *user, char *ourname, int id, + nt_response, nt_response_size, + session_key, + &error_string) == AUTHENTICATED) { +- mppe_set_keys(challenge, session_key); ++ mppe_set_chapv1(challenge, session_key); + slprintf(message, message_space, "Access granted"); + return AUTHENTICATED; + +@@ -628,7 +626,7 @@ winbind_chap_verify(char *user, char *ourname, int id, + &response[MS_CHAP2_NTRESP], + &response[MS_CHAP2_PEER_CHALLENGE], + challenge, user, saresponse); +- mppe_set_keys2(session_key, &response[MS_CHAP2_NTRESP], ++ mppe_set_chapv2(session_key, &response[MS_CHAP2_NTRESP], + MS_CHAP2_AUTHENTICATOR); + if (response[MS_CHAP2_FLAGS]) { + slprintf(message, message_space, "S=%s", saresponse); +-- +2.34.1 + diff --git a/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch b/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch new file mode 100644 index 0000000..c8eb350 --- /dev/null +++ b/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch @@ -0,0 +1,37 @@ +From e609ed8bb62e4648568eaa49fbbc858dfda6d122 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Eivind=20N=C3=A6ss?= +Date: Sun, 14 Mar 2021 16:20:29 -0700 +Subject: [PATCH] pppd: Fix logical error in comparing valid encryption + policies (#262) + +RFC2548 describes the proper values of the MS-MPPE-Encryption-Policy attribute. +and it can only hold 2 values: 1 (encryption allowed) and 2 (encryption required). + +See + https://tools.ietf.org/html/rfc2548, section 2.4.4 + +The correct comparison should be made with an && and not a ||. + +This fixes github issue #218 + +Signed-off-by: Eivind Naess +--- + pppd/chap_ms.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c +index e6b84f2..df2dadd 100644 +--- a/pppd/chap_ms.c ++++ b/pppd/chap_ms.c +@@ -953,7 +953,7 @@ void + set_mppe_enc_types(int policy, int types) + { + /* Early exit for unknown policies. */ +- if (policy != MPPE_ENC_POL_ENC_ALLOWED || ++ if (policy != MPPE_ENC_POL_ENC_ALLOWED && + policy != MPPE_ENC_POL_ENC_REQUIRED) + return; + +-- +2.34.1 + diff --git a/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch b/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch new file mode 100644 index 0000000..2b6f53e --- /dev/null +++ b/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch @@ -0,0 +1,32 @@ +From d7e62a8499c4032d79e05afbd8fd3efd51c5b148 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Eivind=20N=C3=A6ss?= +Date: Thu, 3 Feb 2022 14:28:22 -0800 +Subject: [PATCH] pppd/eap: Fix bug causing incorrect response length (#334) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Need to update the esp->ea_client.ea_namelen variable. A plugin can override the +name of the user, and the variable is passed onto the eap_chap2_response generating +the wrong response length. + +Signed-off-by: Eivind Næss +--- + pppd/eap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/pppd/eap.c b/pppd/eap.c +index 54c3d42..6cb595f 100644 +--- a/pppd/eap.c ++++ b/pppd/eap.c +@@ -2182,6 +2182,7 @@ eap_request(eap_state *esp, u_char *inp, int id, int len) + eap_send_nak(esp, id, EAPT_SRP); + break; + } ++ esp->es_client.ea_namelen = strlen(esp->es_client.ea_name); + + /* Create the MSCHAPv2 response (and add to cache) */ + unsigned char response[MS_CHAP2_RESPONSE_LEN+1]; // VLEN + VALUE +-- +2.34.1 + diff --git a/ppp.spec b/ppp.spec index 2e9c6f3..f7b0ed2 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 6%{?dist} +Release: 7%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -37,6 +37,9 @@ Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch +Patch0027: ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch +Patch0028: ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch +Patch0029: ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch BuildRequires: make BuildRequires: gcc @@ -167,6 +170,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Tue Apr 05 2022 Marcin Zajaczkowski - 2.4.9-7 +- Backport patches from master for SSTP to connect using EAP-TLS to Azure VnetGWay and Windows RAS server + * Fri Jan 21 2022 Fedora Release Engineering - 2.4.9-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 6e51f2673a49fffea849ae68ca691d5dbfc4de2e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 31 May 2022 14:08:48 +0200 Subject: [PATCH 23/57] Added links to patches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ppp.spec b/ppp.spec index f7b0ed2..8c4cf05 100644 --- a/ppp.spec +++ b/ppp.spec @@ -37,8 +37,11 @@ Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch +# https://github.com/ppp-project/ppp/commit/d7e62a8499c4032d79e05afbd8fd3efd51c5b148 Patch0027: ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch +# https://github.com/ppp-project/ppp/commit/e609ed8bb62e4648568eaa49fbbc858dfda6d122 Patch0028: ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch +# https://github.com/ppp-project/ppp/pull/267/commits/6bfe06b9428a60eb637d5450d65dd3932fe5a83f Patch0029: ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch BuildRequires: make From 329b6bd0d1510b082a0ff625b7c20d7cb42956f4 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 22 Jul 2022 15:19:58 +0000 Subject: [PATCH 24/57] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 8c4cf05..56f54be 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 7%{?dist} +Release: 8%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -173,6 +173,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Fri Jul 22 2022 Fedora Release Engineering - 2.4.9-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Tue Apr 05 2022 Marcin Zajaczkowski - 2.4.9-7 - Backport patches from master for SSTP to connect using EAP-TLS to Azure VnetGWay and Windows RAS server From 9e045dfc2d20b6732de9e2f4b7b77555e5e8fc26 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 10:12:01 +0000 Subject: [PATCH 25/57] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 56f54be..de8598c 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 8%{?dist} +Release: 9%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -173,6 +173,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 2.4.9-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Fri Jul 22 2022 Fedora Release Engineering - 2.4.9-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 2b6b4da488a556efb62dd84beea5edd41b3254a9 Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Mon, 3 Apr 2023 12:13:44 +0200 Subject: [PATCH 26/57] Adding fmf plans and gating --- .fmf/version | 1 + ci.fmf | 1 + gating.yaml | 28 ++++++++++++++++++++++++++++ plans/public.fmf | 7 +++++++ plans/tier1-internal.fmf | 12 ++++++++++++ 5 files changed, 49 insertions(+) create mode 100644 .fmf/version create mode 100644 ci.fmf create mode 100644 gating.yaml create mode 100644 plans/public.fmf create mode 100644 plans/tier1-internal.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..285eb64 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,28 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_testing +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} + +#Rawhide +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} + +#gating rhel +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/public.functional} + diff --git a/plans/public.fmf b/plans/public.fmf new file mode 100644 index 0000000..78f4e0e --- /dev/null +++ b/plans/public.fmf @@ -0,0 +1,7 @@ +summary: Test plan with all Fedora tests +discover: + how: fmf + url: https://src.fedoraproject.org/tests/ppp.git +execute: + how: tmt + diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf new file mode 100644 index 0000000..7d2ee46 --- /dev/null +++ b/plans/tier1-internal.fmf @@ -0,0 +1,12 @@ +summary: CI plan, picks internal Tier1 tests, runs in beakerlib. +discover: + - name: rhel + how: fmf + filter: 'tier: 1' + url: git://pkgs.devel.redhat.com/tests/ppp +execute: + how: tmt +adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. From 5b232308197a976548b3f1202de89749f9b04a39 Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Mon, 3 Apr 2023 12:55:58 +0200 Subject: [PATCH 27/57] attempt to fix bad character --- plans/tier1-internal.fmf | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf index 7d2ee46..3447b11 100644 --- a/plans/tier1-internal.fmf +++ b/plans/tier1-internal.fmf @@ -1,12 +1,12 @@ summary: CI plan, picks internal Tier1 tests, runs in beakerlib. discover: - name: rhel - how: fmf - filter: 'tier: 1' - url: git://pkgs.devel.redhat.com/tests/ppp + how: fmf + filter: 'tier: 1' + url: git://pkgs.devel.redhat.com/tests/ppp execute: - how: tmt + how: tmt adjust: - enabled: false - when: distro == centos-stream, fedora - because: They don't have access to internal repos. + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. From 171029fcc85e2f10def95a2e8786040579dcdbfa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 17 Apr 2023 18:20:11 +0200 Subject: [PATCH 28/57] New version Resolves: rhbz#2184291 --- .gitignore | 6 +- 0004-doc-add-configuration-samples.patch | 341 ------- ...itps-use-change_resolv_conf-function.patch | 85 -- ...-t-put-connect-errors-log-to-etc-ppp.patch | 77 -- ...se-SOCK_CLOEXEC-when-creating-socket.patch | 149 --- ...pd-move-pppd-database-to-var-run-ppp.patch | 44 - ...ppoe-add-manpage-for-pppoe-discovery.patch | 115 --- 0018-scritps-fix-ip-up.local-sample.patch | 27 - ...l-rp-pppoe-plugin-files-with-standar.patch | 20 - ...l-pppoatm-plugin-files-with-standard.patch | 26 - ...pppd-binary-using-standard-perms-755.patch | 29 - ...-don-t-want-to-accidentally-leak-fds.patch | 143 --- ...hardcode-LIBDIR-but-set-it-according.patch | 99 -- ppp-2.4.9-config.patch | 21 - ppp-2.4.9-configure-cflags-allow-commas.patch | 17 - ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch | 241 ----- ...MPPE-keys-generated-through-an-API-2.patch | 898 ------------------ ...-error-in-comparing-valid-encryption.patch | 37 - ...-causing-incorrect-response-length-3.patch | 32 - ppp-2.5.0-use-change-resolv-function.patch | 51 + ppp.spec | 58 +- sources | 2 +- 22 files changed, 82 insertions(+), 2436 deletions(-) delete mode 100644 0004-doc-add-configuration-samples.patch delete mode 100644 0006-scritps-use-change_resolv_conf-function.patch delete mode 100644 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch delete mode 100644 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch delete mode 100644 0015-pppd-move-pppd-database-to-var-run-ppp.patch delete mode 100644 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch delete mode 100644 0018-scritps-fix-ip-up.local-sample.patch delete mode 100644 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch delete mode 100644 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch delete mode 100644 ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch delete mode 100644 ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch delete mode 100644 ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch delete mode 100644 ppp-2.4.9-config.patch delete mode 100644 ppp-2.4.9-configure-cflags-allow-commas.patch delete mode 100644 ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch delete mode 100644 ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch delete mode 100644 ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch delete mode 100644 ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch create mode 100644 ppp-2.5.0-use-change-resolv-function.patch diff --git a/.gitignore b/.gitignore index 3a9dd7f..4a4eaa3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,2 @@ -ppp-2.4.5.tar.gz -/ppp-2.4.6.tar.gz +/ppp-*.tar.gz /ppp-watch.tar.xz -/ppp-2.4.7.tar.gz -/ppp-2.4.8.tar.gz -/ppp-2.4.9.tar.gz diff --git a/0004-doc-add-configuration-samples.patch b/0004-doc-add-configuration-samples.patch deleted file mode 100644 index 0cea037..0000000 --- a/0004-doc-add-configuration-samples.patch +++ /dev/null @@ -1,341 +0,0 @@ -From d7faeb88f684c8b2ae193b2c5b5b358ac757fcfa Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 11:39:09 +0200 -Subject: [PATCH 04/27] doc: add configuration samples - ---- - sample/auth-down | 17 ++++++ - sample/auth-up | 17 ++++++ - sample/ip-down | 22 ++++++++ - sample/ip-up | 23 ++++++++ - sample/options | 153 +++++++++++++++++++++++++++++++++++++++++++++++++++ - sample/options.ttyXX | 14 +++++ - sample/pap-secrets | 28 ++++++++++ - 7 files changed, 274 insertions(+) - create mode 100644 sample/auth-down - create mode 100644 sample/auth-up - create mode 100644 sample/ip-down - create mode 100644 sample/ip-up - create mode 100644 sample/options - create mode 100644 sample/options.ttyXX - create mode 100644 sample/pap-secrets - -diff --git a/sample/auth-down b/sample/auth-down -new file mode 100644 -index 0000000..edde65d ---- /dev/null -+++ b/sample/auth-down -@@ -0,0 +1,17 @@ -+#!/bin/sh -+# -+# A program or script which is executed after the remote system -+# successfully authenticates itself. It is executed with the parameters -+# -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+echo auth-down `date +'%y/%m/%d %T'` $* >> /var/log/pppstats -+ -+# last line -diff --git a/sample/auth-up b/sample/auth-up -new file mode 100644 -index 0000000..54722a3 ---- /dev/null -+++ b/sample/auth-up -@@ -0,0 +1,17 @@ -+#!/bin/sh -+# -+# A program or script which is executed after the remote system -+# successfully authenticates itself. It is executed with the parameters -+# -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+echo auth-up `date +'%y/%m/%d %T'` $* >> /var/log/pppstats -+ -+# last line -diff --git a/sample/ip-down b/sample/ip-down -new file mode 100644 -index 0000000..b771fb6 ---- /dev/null -+++ b/sample/ip-down -@@ -0,0 +1,22 @@ -+#!/bin/sh -+# -+# This script is run by the pppd _after_ the link is brought down. -+# It should be used to delete routes, unset IP addresses etc. -+# -+# This script is called with the following arguments: -+# Arg Name Example -+# $1 Interface name ppp0 -+# $2 The tty ttyS1 -+# $3 The link speed 38400 -+# $4 Local IP number 12.34.56.78 -+# $5 Peer IP number 12.34.56.99 -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+# last line -diff --git a/sample/ip-up b/sample/ip-up -new file mode 100644 -index 0000000..7ce7c8d ---- /dev/null -+++ b/sample/ip-up -@@ -0,0 +1,23 @@ -+#!/bin/sh -+# -+# This script is run by the pppd after the link is established. -+# It should be used to add routes, set IP address, run the mailq -+# etc. -+# -+# This script is called with the following arguments: -+# Arg Name Example -+# $1 Interface name ppp0 -+# $2 The tty ttyS1 -+# $3 The link speed 38400 -+# $4 Local IP number 12.34.56.78 -+# $5 Peer IP number 12.34.56.99 -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+# last line -diff --git a/sample/options b/sample/options -new file mode 100644 -index 0000000..8d0a3f9 ---- /dev/null -+++ b/sample/options -@@ -0,0 +1,153 @@ -+# /etc/ppp/options -+ -+# The name of this server. Often, the FQDN is used here. -+#name -+ -+# Enforce the use of the hostname as the name of the local system for -+# authentication purposes (overrides the name option). -+usehostname -+ -+# If no local IP address is given, pppd will use the first IP address -+# that belongs to the local hostname. If "noipdefault" is given, this -+# is disabled and the peer will have to supply an IP address. -+noipdefault -+ -+# With this option, pppd will accept the peer's idea of our local IP -+# address, even if the local IP address was specified in an option. -+#ipcp-accept-local -+ -+# With this option, pppd will accept the peer's idea of its (remote) IP -+# address, even if the remote IP address was specified in an option. -+#ipcp-accept-remote -+ -+# Specify which DNS Servers the incoming Win95 or WinNT Connection should use -+# Two Servers can be remotely configured -+#ms-dns 192.168.1.1 -+#ms-dns 192.168.1.2 -+ -+# Specify which WINS Servers the incoming connection Win95 or WinNT should use -+#wins-addr 192.168.1.50 -+#wins-addr 192.168.1.51 -+ -+# enable this on a server that already has a permanent default route -+#nodefaultroute -+ -+# Run the executable or shell command specified after pppd has terminated -+# the link. This script could, for example, issue commands to the modem -+# to cause it to hang up if hardware modem control signals were not -+# available. -+# If mgetty is running, it will reset the modem anyway. So there is no need -+# to do it here. -+#disconnect "chat -- \d+++\d\c OK ath0 OK" -+ -+# Increase debugging level (same as -d). The debug output is written -+# to syslog LOG_LOCAL2. -+debug -+ -+# Enable debugging code in the kernel-level PPP driver. The argument n -+# is a number which is the sum of the following values: 1 to enable -+# general debug messages, 2 to request that the contents of received -+# packets be printed, and 4 to request that the contents of transmitted -+# packets be printed. -+#kdebug n -+ -+# Require the peer to authenticate itself before allowing network -+# packets to be sent or received. -+# Please do not disable this setting. It is expected to be standard in -+# future releases of pppd. Use the call option (see manpage) to disable -+# authentication for specific peers. -+#auth -+ -+# authentication can either be pap or chap. As most people only want to -+# use pap, you can also disable chap: -+#require-pap -+#refuse-chap -+ -+# Use hardware flow control (i.e. RTS/CTS) to control the flow of data -+# on the serial port. -+crtscts -+ -+# Specifies that pppd should use a UUCP-style lock on the serial device -+# to ensure exclusive access to the device. -+lock -+ -+# Use the modem control lines. -+modem -+ -+# async character map -- 32-bit hex; each bit is a character -+# that needs to be escaped for pppd to receive it. 0x00000001 -+# represents '\x01', and 0x80000000 represents '\x1f'. -+# To allow pppd to work over a rlogin/telnet connection, ou should escape -+# XON (^Q), XOFF (^S) and ^]: (The peer should use "escape ff".) -+#asyncmap 200a0000 -+asyncmap 0 -+ -+# Specifies that certain characters should be escaped on transmission -+# (regardless of whether the peer requests them to be escaped with its -+# async control character map). The characters to be escaped are -+# specified as a list of hex numbers separated by commas. Note that -+# almost any character can be specified for the escape option, unlike -+# the asyncmap option which only allows control characters to be -+# specified. The characters which may not be escaped are those with hex -+# values 0x20 - 0x3f or 0x5e. -+#escape 11,13,ff -+ -+# Set the MRU [Maximum Receive Unit] value to for negotiation. pppd -+# will ask the peer to send packets of no more than bytes. The -+# minimum MRU value is 128. The default MRU value is 1500. A value of -+# 296 is recommended for slow links (40 bytes for TCP/IP header + 256 -+# bytes of data). -+#mru 542 -+ -+# Set the MTU [Maximum Transmit Unit] value to . Unless the peer -+# requests a smaller value via MRU negotiation, pppd will request that -+# the kernel networking code send data packets of no more than n bytes -+# through the PPP network interface. -+#mtu -+ -+# Set the interface netmask to , a 32 bit netmask in "decimal dot" -+# notation (e.g. 255.255.255.0). -+#netmask 255.255.255.0 -+ -+# Don't fork to become a background process (otherwise pppd will do so -+# if a serial device is specified). -+nodetach -+ -+# Set the assumed name of the remote system for authentication purposes -+# to . -+#remotename -+ -+# Add an entry to this system's ARP [Address Resolution Protocol] -+# table with the IP address of the peer and the Ethernet address of this -+# system. {proxyarp,noproxyarp} -+proxyarp -+ -+# Use the system password database for authenticating the peer using -+# PAP. Note: mgetty already provides this option. If this is specified -+# then dialin from users using a script under Linux to fire up ppp wont work. -+#login -+ -+# If this option is given, pppd will send an LCP echo-request frame to -+# the peer every n seconds. Under Linux, the echo-request is sent when -+# no packets have been received from the peer for n seconds. Normally -+# the peer should respond to the echo-request by sending an echo-reply. -+# This option can be used with the lcp-echo-failure option to detect -+# that the peer is no longer connected. -+lcp-echo-interval 30 -+ -+# If this option is given, pppd will presume the peer to be dead if n -+# LCP echo-requests are sent without receiving a valid LCP echo-reply. -+# If this happens, pppd will terminate the connection. Use of this -+# option requires a non-zero value for the lcp-echo-interval parameter. -+# This option can be used to enable pppd to terminate after the physical -+# connection has been broken (e.g., the modem has hung up) in -+# situations where no hardware modem control lines are available. -+lcp-echo-failure 4 -+ -+# Specifies that pppd should disconnect if the link is idle for n seconds. -+idle 600 -+ -+# Disable the IPXCP and IPX protocols. -+noipx -+ -+# ------ -diff --git a/sample/options.ttyXX b/sample/options.ttyXX -new file mode 100644 -index 0000000..d4202f5 ---- /dev/null -+++ b/sample/options.ttyXX -@@ -0,0 +1,14 @@ -+# If you need to set up multiple serial lines then copy this file to -+# options. for each tty with a modem on it. -+# -+# The options.tty file will assign an IP address to each PPP connection -+# as it comes up. They must all be distinct! -+# -+# Example: -+# options.ttyS1 for com2 under DOS. -+# -+# Edit the following line so that the first IP address -+# mentioned is the ip address of the serial port while the second -+# is the IP address of your host -+# -+hostname-s1:hostname -diff --git a/sample/pap-secrets b/sample/pap-secrets -new file mode 100644 -index 0000000..098971b ---- /dev/null -+++ b/sample/pap-secrets -@@ -0,0 +1,28 @@ -+# Secrets for authentication using PAP -+# client server secret IP addresses -+ -+# OUTBOUND CONNECTIONS -+# Here you should add your userid password to connect to your providers via -+# pap. The * means that the password is to be used for ANY host you connect -+# to. Thus you do not have to worry about the foreign machine name. Just -+# replace password with your password. -+# If you have different providers with different passwords then you better -+# remove the following line. -+#hostname * password -+ -+# INBOUND CONNECTIONS -+#client hostname 192.168.1.1 -+ -+# If you add "auth login -chap +pap" to /etc/mgetty+sendfax/login.config, -+# all users in /etc/passwd can use their password for pap-authentication. -+# -+# Every regular user can use PPP and has to use passwords from /etc/passwd -+#* hostname "" -+# UserIDs that cannot use PPP at all. Check your /etc/passwd and add any -+# other accounts that should not be able to use pppd! Replace hostname -+# with your local hostname. -+#guest hostname "*" - -+#master hostname "*" - -+#root hostname "*" - -+#support hostname "*" - -+#stats hostname "*" - --- -1.8.3.1 - diff --git a/0006-scritps-use-change_resolv_conf-function.patch b/0006-scritps-use-change_resolv_conf-function.patch deleted file mode 100644 index cbf8713..0000000 --- a/0006-scritps-use-change_resolv_conf-function.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 01419dfb684d501b57f1c24dcfdbcf9da93ccca2 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 18:12:47 +0200 -Subject: [PATCH 06/27] scritps: use change_resolv_conf function - -Don't handle /etc/resolv.conf manually, but use a helper function from -initscripts. Also change path where we save DNS servers supplied by peer while -we are at it. - -Resolves: #132482 ---- - pppd/pppd.8 | 2 +- - scripts/ip-down.local.add | 9 +++++---- - scripts/ip-up.local.add | 17 ++++++++++------- - 3 files changed, 16 insertions(+), 12 deletions(-) - -diff --git a/pppd/pppd.8 b/pppd/pppd.8 -index e2768b1..2dd6e1a 100644 ---- a/pppd/pppd.8 -+++ b/pppd/pppd.8 -@@ -1099,7 +1099,7 @@ Ask the peer for up to 2 DNS server addresses. The addresses supplied - by the peer (if any) are passed to the /etc/ppp/ip\-up script in the - environment variables DNS1 and DNS2, and the environment variable - USEPEERDNS will be set to 1. In addition, pppd will create an --/etc/ppp/resolv.conf file containing one or two nameserver lines with -+/var/run/ppp/resolv.conf file containing one or two nameserver lines with - the address(es) supplied by the peer. - .TP - .B user \fIname -diff --git a/scripts/ip-down.local.add b/scripts/ip-down.local.add -index b93590e..163f71e 100644 ---- a/scripts/ip-down.local.add -+++ b/scripts/ip-down.local.add -@@ -9,12 +9,13 @@ - # - # Nick Walker (nickwalker@email.com) - # -+. /etc/sysconfig/network-scripts/network-functions - --if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then -- if [ -f /etc/ppp/resolv.prev ]; then -- cp -f /etc/ppp/resolv.prev /etc/resolv.conf -+if [ -n "$USEPEERDNS" -a -f /var/run/ppp/resolv.conf ]; then -+ if [ -f /var/run/ppp/resolv.prev ]; then -+ change_resolv_conf /var/run/ppp/resolv.prev - else -- rm -f /etc/resolv.conf -+ change_resolv_conf - fi - fi - -diff --git a/scripts/ip-up.local.add b/scripts/ip-up.local.add -index 8017209..26cf5f8 100644 ---- a/scripts/ip-up.local.add -+++ b/scripts/ip-up.local.add -@@ -9,16 +9,19 @@ - # - # Nick Walker (nickwalker@email.com) - # -+. /etc/sysconfig/network-scripts/network-functions - --if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then -- rm -f /etc/ppp/resolv.prev -+if [ -n "$USEPEERDNS" -a -f /var/run/ppp/resolv.conf ]; then -+ rm -f /var/run/ppp/resolv.prev - if [ -f /etc/resolv.conf ]; then -- cp /etc/resolv.conf /etc/ppp/resolv.prev -- grep domain /etc/ppp/resolv.prev > /etc/resolv.conf -- grep search /etc/ppp/resolv.prev >> /etc/resolv.conf -- cat /etc/ppp/resolv.conf >> /etc/resolv.conf -+ cp /etc/resolv.conf /var/run/ppp/resolv.prev -+ rscf=/var/run/ppp/resolv.new -+ grep domain /var/run/ppp/resolv.prev > $rscf -+ grep search /var/run/ppp/resolv.prev >> $rscf -+ change_resolv_conf $rscf -+ rm -f $rscf - else -- cp /etc/ppp/resolv.conf /etc -+ change_resolv_conf /var/run/ppp/resolv.conf - fi - fi - --- -1.8.3.1 - diff --git a/0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch b/0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch deleted file mode 100644 index 56ac388..0000000 --- a/0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch +++ /dev/null @@ -1,77 +0,0 @@ -From b4ef433be936c90e356da7a590b032cdee219a3f Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 19:06:05 +0200 -Subject: [PATCH 11/27] build-sys: don't put connect-errors log to /etc/ppp/ - -Resolves: #118837 ---- - chat/chat.8 | 2 +- - linux/Makefile.top | 8 +++++++- - pppd/pathnames.h | 4 ++-- - 3 files changed, 10 insertions(+), 4 deletions(-) - -diff --git a/chat/chat.8 b/chat/chat.8 -index 6d10836..78d6939 100644 ---- a/chat/chat.8 -+++ b/chat/chat.8 -@@ -200,7 +200,7 @@ The \fBSAY\fR directive allows the script to send strings to the user - at the terminal via standard error. If \fBchat\fR is being run by - pppd, and pppd is running as a daemon (detached from its controlling - terminal), standard error will normally be redirected to the file --/etc/ppp/connect\-errors. -+/var/log/ppp/connect\-errors. - .LP - \fBSAY\fR strings must be enclosed in single or double quotes. If - carriage return and line feed are needed in the string to be output, -diff --git a/linux/Makefile.top b/linux/Makefile.top -index f63d45e..f42efd5 100644 ---- a/linux/Makefile.top -+++ b/linux/Makefile.top -@@ -5,6 +5,8 @@ BINDIR = $(DESTDIR)/sbin - INCDIR = $(DESTDIR)/include - MANDIR = $(DESTDIR)/share/man - ETCDIR = $(INSTROOT)@SYSCONF@/ppp -+RUNDIR = $(DESTDIR)/var/run/ppp -+LOGDIR = $(DESTDIR)/var/log/ppp - - # uid 0 = root - INSTALL= install -@@ -16,7 +18,7 @@ all: - cd pppstats; $(MAKE) $(MFLAGS) all - cd pppdump; $(MAKE) $(MFLAGS) all - --install: $(BINDIR) $(MANDIR)/man8 install-progs install-devel -+install: $(BINDIR) $(RUNDIR) $(LOGDIR) $(MANDIR)/man8 install-progs install-devel - - install-progs: - cd chat; $(MAKE) $(MFLAGS) install -@@ -44,6 +46,10 @@ $(MANDIR)/man8: - $(INSTALL) -d -m 755 $@ - $(ETCDIR): - $(INSTALL) -d -m 755 $@ -+$(RUNDIR): -+ $(INSTALL) -d -m 755 $@ -+$(LOGDIR): -+ $(INSTALL) -d -m 755 $@ - - clean: - rm -f `find . -name '*.[oas]' -print` -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index a427cb8..bef3160 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -28,9 +28,9 @@ - #define _PATH_AUTHUP _ROOT_PATH "/etc/ppp/auth-up" - #define _PATH_AUTHDOWN _ROOT_PATH "/etc/ppp/auth-down" - #define _PATH_TTYOPT _ROOT_PATH "/etc/ppp/options." --#define _PATH_CONNERRS _ROOT_PATH "/etc/ppp/connect-errors" -+#define _PATH_CONNERRS _ROOT_PATH "/var/log/ppp/connect-errors" - #define _PATH_PEERFILES _ROOT_PATH "/etc/ppp/peers/" --#define _PATH_RESOLV _ROOT_PATH "/etc/ppp/resolv.conf" -+#define _PATH_RESOLV _ROOT_PATH "/var/run/ppp/resolv.conf" - - #define _PATH_USEROPT ".ppprc" - #define _PATH_PSEUDONYM ".ppp_pseudonym" --- -1.8.3.1 - diff --git a/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch deleted file mode 100644 index 1352370..0000000 --- a/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +++ /dev/null @@ -1,149 +0,0 @@ -diff --git a/pppd/plugins/pppoatm/pppoatm.c b/pppd/plugins/pppoatm/pppoatm.c -index d693350..c31bb34 100644 ---- a/pppd/plugins/pppoatm/pppoatm.c -+++ b/pppd/plugins/pppoatm/pppoatm.c -@@ -135,7 +135,7 @@ static int connect_pppoatm(void) - - if (!device_got_set) - no_device_given_pppoatm(); -- fd = socket(AF_ATMPVC, SOCK_DGRAM, 0); -+ fd = socket(AF_ATMPVC, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (fd < 0) - fatal("failed to create socket: %m"); - memset(&qos, 0, sizeof qos); -diff --git a/pppd/plugins/pppol2tp/openl2tp.c b/pppd/plugins/pppol2tp/openl2tp.c -index 9643b96..1099575 100644 ---- a/pppd/plugins/pppol2tp/openl2tp.c -+++ b/pppd/plugins/pppol2tp/openl2tp.c -@@ -83,7 +83,7 @@ static int openl2tp_client_create(void) - int result; - - if (openl2tp_fd < 0) { -- openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM, 0); -+ openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (openl2tp_fd < 0) { - error("openl2tp connection create: %m"); - return -ENOTCONN; -diff --git a/pppd/plugins/pppol2tp/pppol2tp.c b/pppd/plugins/pppol2tp/pppol2tp.c -index a7e3400..e64a778 100644 ---- a/pppd/plugins/pppol2tp/pppol2tp.c -+++ b/pppd/plugins/pppol2tp/pppol2tp.c -@@ -208,7 +208,7 @@ static void send_config_pppol2tp(int mtu, - struct ifreq ifr; - int fd; - -- fd = socket(AF_INET, SOCK_DGRAM, 0); -+ fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (fd >= 0) { - memset (&ifr, '\0', sizeof (ifr)); - strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -diff --git a/pppd/plugins/pppoe/if.c b/pppd/plugins/pppoe/if.c -index 91e9a57..72aba41 100644 ---- a/pppd/plugins/pppoe/if.c -+++ b/pppd/plugins/pppoe/if.c -@@ -116,7 +116,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - stype = SOCK_PACKET; - #endif - -- if ((fd = socket(domain, stype, htons(type))) < 0) { -+ if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { - /* Give a more helpful message for the common error case */ - if (errno == EPERM) { - fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/plugins/pppoe/plugin.c b/pppd/plugins/pppoe/plugin.c -index a8c2bb4..24bdf8f 100644 ---- a/pppd/plugins/pppoe/plugin.c -+++ b/pppd/plugins/pppoe/plugin.c -@@ -137,7 +137,7 @@ PPPOEConnectDevice(void) - /* server equipment). */ - /* Opening this socket just before waitForPADS in the discovery() */ - /* function would be more appropriate, but it would mess-up the code */ -- conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM, PX_PROTO_OE); -+ conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM | SOCK_CLOEXEC, PX_PROTO_OE); - if (conn->sessionSocket < 0) { - error("Failed to create PPPoE socket: %m"); - return -1; -@@ -148,7 +148,7 @@ PPPOEConnectDevice(void) - lcp_wantoptions[0].mru = conn->mru; - - /* Update maximum MRU */ -- s = socket(AF_INET, SOCK_DGRAM, 0); -+ s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (s < 0) { - error("Can't get MTU for %s: %m", conn->ifName); - goto errout; -@@ -320,7 +320,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) - } - - /* Open a socket */ -- if ((fd = socket(PF_PACKET, SOCK_RAW, 0)) < 0) { -+ if ((fd = socket(PF_PACKET, SOCK_RAW | SOCK_CLOEXEC, 0)) < 0) { - r = 0; - } - -diff --git a/pppd/plugins/pppoe/pppoe-discovery.c b/pppd/plugins/pppoe/pppoe-discovery.c -index 3d3bf4e..c0d927d 100644 ---- a/pppd/plugins/pppoe/pppoe-discovery.c -+++ b/pppd/plugins/pppoe/pppoe-discovery.c -@@ -121,7 +121,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - stype = SOCK_PACKET; - #endif - -- if ((fd = socket(domain, stype, htons(type))) < 0) { -+ if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { - /* Give a more helpful message for the common error case */ - if (errno == EPERM) { - fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 00a2cf5..0690019 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -308,12 +308,12 @@ static int modify_flags(int fd, int clear_bits, int set_bits) - void sys_init(void) - { - /* Get an internet socket for doing socket ioctls. */ -- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); -+ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock_fd < 0) - fatal("Couldn't create IP socket: %m(%d)", errno); - - #ifdef INET6 -- sock6_fd = socket(AF_INET6, SOCK_DGRAM, 0); -+ sock6_fd = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock6_fd < 0) - sock6_fd = -errno; /* save errno for later */ - #endif -@@ -1857,7 +1857,7 @@ get_if_hwaddr(u_char *addr, char *name) - struct ifreq ifreq; - int ret, sock_fd; - -- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); -+ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock_fd < 0) - return -1; - memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr)); -@@ -2067,7 +2067,7 @@ int ppp_available(void) - /* - * Open a socket for doing the ioctl operations. - */ -- s = socket(AF_INET, SOCK_DGRAM, 0); -+ s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (s < 0) - return 0; - -diff --git a/pppd/tty.c b/pppd/tty.c -index bc96695..8e76a5d 100644 ---- a/pppd/tty.c -+++ b/pppd/tty.c -@@ -896,7 +896,7 @@ open_socket(dest) - *sep = ':'; - - /* get a socket and connect it to the other end */ -- sock = socket(PF_INET, SOCK_STREAM, 0); -+ sock = socket(PF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0); - if (sock < 0) { - error("Can't create socket: %m"); - return -1; --- -1.8.3.1 - diff --git a/0015-pppd-move-pppd-database-to-var-run-ppp.patch b/0015-pppd-move-pppd-database-to-var-run-ppp.patch deleted file mode 100644 index 88b84d5..0000000 --- a/0015-pppd-move-pppd-database-to-var-run-ppp.patch +++ /dev/null @@ -1,44 +0,0 @@ -From f2c855462ff56be4121409c7e048cd2503fe0ccf Mon Sep 17 00:00:00 2001 -From: Jiri Skala -Date: Mon, 7 Apr 2014 14:26:20 +0200 -Subject: [PATCH 15/27] pppd: move pppd database to /var/run/ppp - -Resolves: #560014 ---- - pppd/pathnames.h | 11 ++++------- - 1 file changed, 4 insertions(+), 7 deletions(-) - -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index bef3160..24e010c 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -6,8 +6,9 @@ - - #ifdef HAVE_PATHS_H - #include -- -+#define _PPP_SUBDIR "ppp/" - #else /* HAVE_PATHS_H */ -+#define _PPP_SUBDIR - #ifndef _PATH_VARRUN - #define _PATH_VARRUN "/etc/ppp/" - #endif -@@ -46,13 +47,9 @@ - #endif /* IPX_CHANGE */ - - #ifdef __STDC__ --#define _PATH_PPPDB _ROOT_PATH _PATH_VARRUN "pppd2.tdb" -+#define _PATH_PPPDB _ROOT_PATH _PATH_VARRUN _PPP_SUBDIR "pppd2.tdb" - #else /* __STDC__ */ --#ifdef HAVE_PATHS_H --#define _PATH_PPPDB "/var/run/pppd2.tdb" --#else --#define _PATH_PPPDB "/etc/ppp/pppd2.tdb" --#endif -+#define _PATH_PPPDB _PATH_VARRUN _PPP_SUBDIR "pppd2.tdb" - #endif /* __STDC__ */ - - #ifdef PLUGIN --- -1.8.3.1 - diff --git a/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch b/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch deleted file mode 100644 index b7f7c91..0000000 --- a/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch +++ /dev/null @@ -1,115 +0,0 @@ -diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux -index 3cd9101..9918091 100644 ---- a/pppd/plugins/pppoe/Makefile.linux -+++ b/pppd/plugins/pppoe/Makefile.linux -@@ -16,6 +16,7 @@ - - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin -+MANDIR = $(DESTDIR)/share/man/man8 - LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(PPPDVERSION) - - PPPDVERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) -@@ -46,6 +47,7 @@ install: all - $(LN_S) pppoe.so $(LIBDIR)/rp-pppoe.so - $(INSTALL) -d -m 755 $(BINDIR) - $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) -+ $(INSTALL) -c -m 444 pppoe-discovery.8 $(MANDIR) - - clean: - rm -f *.o *.so pppoe-discovery -diff --git a/pppd/plugins/pppoe/pppoe-discovery.8 b/pppd/plugins/pppoe/pppoe-discovery.8 -new file mode 100644 -index 0000000..d0a93db ---- /dev/null -+++ b/pppd/plugins/pppoe/pppoe-discovery.8 -@@ -0,0 +1,86 @@ -+.\" pppoe-discovery.8 written by -+.\" Ben Hutchings , based on pppoe.8. -+.\" Licenced under the GPL version 2 or later. -+.TH PPPOE-DISCOVERY 8 -+.SH NAME -+pppoe\-discovery \- perform PPPoE discovery -+.SH SYNOPSIS -+.B pppoe\-discovery -+[ -+.I options -+] -+.br -+.BR pppoe\-discovery " { " \-V " | " \-h " }" -+.SH DESCRIPTION -+.LP -+\fBpppoe\-discovery\fR performs the same discovery process as -+\fBpppoe\fR, but does not initiate a session. -+It sends a PADI packet and then prints the names of access -+concentrators in each PADO packet it receives. -+.SH OPTIONS -+.TP -+.BI \-I " interface" -+.RS -+The \fB\-I\fR option specifies the Ethernet interface to use. -+Under Linux, it is typically eth0 or eth1. -+The interface should be \(lqup\(rq before you start -+\fBpppoe\-discovery\fR, but should \fInot\fR be configured to have an -+IP address. -+The default interface is eth0. -+.RE -+.TP -+.BI \-D " file_name" -+.RS -+The \fB\-D\fR option causes every packet to be dumped to the specified -+\fIfile_name\fR. -+This is intended for debugging only. -+.RE -+.TP -+.B \-U -+.RS -+Causes \fBpppoe\-discovery\fR to use the Host-Uniq tag in its discovery -+packets. -+This lets you run multiple instances of \fBpppoe\-discovery\fR and/or -+\fBpppoe\fR without having their discovery packets interfere with one -+another. -+You must supply this option to \fIall\fR instances that you intend to -+run simultaneously. -+.RE -+.TP -+.BI \-S " service_name" -+.RS -+Specifies the desired service name. -+\fBpppoe\-discovery\fR will only accept access concentrators which can -+provide the specified service. -+In most cases, you should \fInot\fR specify this option. -+Use it only if you know that there are multiple access concentrators -+or know that you need a specific service name. -+.RE -+.TP -+.BI \-C " ac_name" -+.RS -+Specifies the desired access concentrator name. -+\fBpppoe\-discovery\fR will only accept the specified access -+concentrator. -+In most cases, you should \fInot\fR specify this option. -+Use it only if you know that there are multiple access concentrators. -+If both the \fB\-S\fR and \fB\-C\fR options are specified, they must -+\fIboth\fR match. -+.RE -+.TP -+.B \-A -+.RS -+This option is accepted for compatibility with \fBpppoe\fR, but has no -+effect. -+.RE -+.TP -+.BR \-V " | " \-h -+.RS -+Either of these options causes \fBpppoe\-discovery\fR to print its -+version number and usage information, then exit. -+.RE -+.SH AUTHORS -+\fBpppoe\-discovery\fR was written by Marco d'Itri , -+based on \fBpppoe\fR by David F. Skoll . -+.SH SEE ALSO -+pppoe(8), pppoe-sniff(8) --- -1.8.3.1 - diff --git a/0018-scritps-fix-ip-up.local-sample.patch b/0018-scritps-fix-ip-up.local-sample.patch deleted file mode 100644 index c36e0b8..0000000 --- a/0018-scritps-fix-ip-up.local-sample.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 40960f91cdd06da387616ec838ae2599e7f01cee Mon Sep 17 00:00:00 2001 -From: Jiri Skala -Date: Mon, 7 Apr 2014 15:24:01 +0200 -Subject: [PATCH 18/27] scritps: fix ip-up.local sample - -Resolves: #613717 ---- - scripts/ip-up.local.add | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/scripts/ip-up.local.add b/scripts/ip-up.local.add -index 26cf5f8..282337c 100644 ---- a/scripts/ip-up.local.add -+++ b/scripts/ip-up.local.add -@@ -18,6 +18,9 @@ if [ -n "$USEPEERDNS" -a -f /var/run/ppp/resolv.conf ]; then - rscf=/var/run/ppp/resolv.new - grep domain /var/run/ppp/resolv.prev > $rscf - grep search /var/run/ppp/resolv.prev >> $rscf -+ if [ -f /var/run/ppp/resolv.conf ]; then -+ cat /var/run/ppp/resolv.conf >> $rscf -+ fi - change_resolv_conf $rscf - rm -f $rscf - else --- -1.8.3.1 - diff --git a/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch b/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch deleted file mode 100644 index 23b1f93..0000000 --- a/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux -index 2df887b..6cb8397 100644 ---- a/pppd/plugins/pppoe/Makefile.linux -+++ b/pppd/plugins/pppoe/Makefile.linux -@@ -43,12 +43,12 @@ pppoe.so: plugin.o discovery.o if.o common.o - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -c -m 4550 pppoe.so $(LIBDIR) -+ $(INSTALL) -c -m 755 pppoe.so $(LIBDIR) - # Symlink for backward compatibility - $(LN_S) pppoe.so $(LIBDIR)/rp-pppoe.so - $(INSTALL) -d -m 755 $(BINDIR) -- $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) -- $(INSTALL) -c -m 444 pppoe-discovery.8 $(MANDIR) -+ $(INSTALL) -c -m 755 pppoe-discovery $(BINDIR) -+ $(INSTALL) -c -m 644 pppoe-discovery.8 $(MANDIR) - - clean: - rm -f *.o *.so pppoe-discovery diff --git a/0024-build-sys-install-pppoatm-plugin-files-with-standard.patch b/0024-build-sys-install-pppoatm-plugin-files-with-standard.patch deleted file mode 100644 index 9982d92..0000000 --- a/0024-build-sys-install-pppoatm-plugin-files-with-standard.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 0fdb22ef3d3cc3b297372451d60bd6c61d047d27 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Thu, 10 Apr 2014 10:08:41 +0200 -Subject: [PATCH 24/27] build-sys: install pppoatm plugin files with standard - perms - ---- - pppd/plugins/pppoatm/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 769794b..4c5826f 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -37,7 +37,7 @@ $(PLUGIN): $(PLUGIN_OBJS) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -c -m 4550 $(PLUGIN) $(LIBDIR) -+ $(INSTALL) -c -m 755 $(PLUGIN) $(LIBDIR) - - clean: - rm -f *.o *.so --- -1.8.3.1 - diff --git a/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch b/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch deleted file mode 100644 index bedb902..0000000 --- a/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch +++ /dev/null @@ -1,29 +0,0 @@ -From ab8b06cdc1075abc67f77e7c3bb684e20071d614 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Thu, 10 Apr 2014 10:09:41 +0200 -Subject: [PATCH 25/27] pppd: install pppd binary using standard perms (755) - ---- - pppd/Makefile.linux | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 0e8107f..534ccc2 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -223,10 +223,10 @@ all: $(TARGETS) - install: pppd - mkdir -p $(BINDIR) $(MANDIR) - $(EXTRAINSTALL) -- $(INSTALL) -c -m 555 pppd $(BINDIR)/pppd -+ $(INSTALL) -c -m 755 pppd $(BINDIR)/pppd - if chgrp pppusers $(BINDIR)/pppd 2>/dev/null; then \ - chmod o-rx,u+s $(BINDIR)/pppd; fi -- $(INSTALL) -c -m 444 pppd.8 $(MANDIR) -+ $(INSTALL) -c -m 644 pppd.8 $(MANDIR) - - pppd: $(PPPDOBJS) - $(CC) $(CFLAGS) $(LDFLAGS) $(LDFLAGS_PLUGIN) -o pppd $(PPPDOBJS) $(LIBS) --- -1.8.3.1 - diff --git a/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch b/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch deleted file mode 100644 index 1b4a9cd..0000000 --- a/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch +++ /dev/null @@ -1,143 +0,0 @@ -From 82cd789df0f022eb6f3d28646e7a61d1d0715805 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 12:23:36 +0200 -Subject: [PATCH 12/27] pppd: we don't want to accidentally leak fds - ---- - pppd/auth.c | 20 ++++++++++---------- - pppd/options.c | 2 +- - pppd/sys-linux.c | 4 ++-- - 3 files changed, 13 insertions(+), 13 deletions(-) - -diff --git a/pppd/auth.c b/pppd/auth.c -index 4271af6..9e957fa 100644 ---- a/pppd/auth.c -+++ b/pppd/auth.c -@@ -428,7 +428,7 @@ setupapfile(argv) - free(fname); - return 0; - } -- ufile = fopen(fname, "r"); -+ ufile = fopen(fname, "re"); - if (seteuid(euid) == -1) - fatal("unable to regain privileges: %m"); - if (ufile == NULL) { -@@ -1413,7 +1413,7 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg) - filename = _PATH_UPAPFILE; - addrs = opts = NULL; - ret = UPAP_AUTHNAK; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) { - error("Can't open PAP password file %s: %m", filename); - -@@ -1512,7 +1512,7 @@ null_login(unit) - if (ret <= 0) { - filename = _PATH_UPAPFILE; - addrs = NULL; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - check_access(f, filename); -@@ -1559,7 +1559,7 @@ get_pap_passwd(passwd) - } - - filename = _PATH_UPAPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - check_access(f, filename); -@@ -1597,7 +1597,7 @@ have_pap_secret(lacks_ipp) - } - - filename = _PATH_UPAPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - -@@ -1642,7 +1642,7 @@ have_chap_secret(client, server, need_ip, lacks_ipp) - } - - filename = _PATH_CHAPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - -@@ -1684,7 +1684,7 @@ have_srp_secret(client, server, need_ip, lacks_ipp) - struct wordlist *addrs; - - filename = _PATH_SRPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - -@@ -1740,7 +1740,7 @@ get_secret(unit, client, server, secret, secret_len, am_server) - addrs = NULL; - secbuf[0] = 0; - -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) { - error("Can't open chap secret file %s: %m", filename); - return 0; -@@ -1797,7 +1797,7 @@ get_srp_secret(unit, client, server, secret, am_server) - filename = _PATH_SRPFILE; - addrs = NULL; - -- fp = fopen(filename, "r"); -+ fp = fopen(filename, "re"); - if (fp == NULL) { - error("Can't open srp secret file %s: %m", filename); - return 0; -@@ -2203,7 +2203,7 @@ scan_authfile(f, client, server, secret, addrs, opts, filename, flags) - */ - if (word[0] == '@' && word[1] == '/') { - strlcpy(atfile, word+1, sizeof(atfile)); -- if ((sf = fopen(atfile, "r")) == NULL) { -+ if ((sf = fopen(atfile, "re")) == NULL) { - warn("can't open indirect secret file %s", atfile); - continue; - } -diff --git a/pppd/options.c b/pppd/options.c -index 45fa742..1d754ae 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -427,7 +427,7 @@ options_from_file(filename, must_exist, check_prot, priv) - option_error("unable to drop privileges to open %s: %m", filename); - return 0; - } -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - err = errno; - if (check_prot && seteuid(euid) == -1) - fatal("unable to regain privileges"); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 72a7727..8a12fa0 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -1412,7 +1412,7 @@ static char *path_to_procfs(const char *tail) - /* Default the mount location of /proc */ - strlcpy (proc_path, "/proc", sizeof(proc_path)); - proc_path_len = 5; -- fp = fopen(MOUNTED, "r"); -+ fp = fopen(MOUNTED, "re"); - if (fp != NULL) { - while ((mntent = getmntent(fp)) != NULL) { - if (strcmp(mntent->mnt_type, MNTTYPE_IGNORE) == 0) -@@ -1472,7 +1472,7 @@ static int open_route_table (void) - close_route_table(); - - path = path_to_procfs("/net/route"); -- route_fd = fopen (path, "r"); -+ route_fd = fopen (path, "re"); - if (route_fd == NULL) { - error("can't open routing table %s: %m", path); - return 0; --- -1.8.3.1 - diff --git a/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch deleted file mode 100644 index c2c8cce..0000000 --- a/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ /dev/null @@ -1,99 +0,0 @@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 6a4b897..8f29c1f 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -12,6 +12,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 - INCDIR = $(DESTDIR)/include -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null) - - TARGETS = pppd - -@@ -93,7 +94,7 @@ INCLUDE_DIRS= -I../include - - COMPILE_FLAGS= -DHAVE_PATHS_H -DIPX_CHANGE -DHAVE_MMAP -pipe - --CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS) '-DDESTDIR="@DESTDIR@"' -+CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS) '-DDESTDIR="@DESTDIR@"' -DLIBDIR=\""$(LIBDIR)"\" - - ifdef CHAPMS - CFLAGS += -DCHAPMS=1 -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index 524d608..c7eadbb 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -62,7 +62,7 @@ - - #ifdef PLUGIN - #ifdef __STDC__ --#define _PATH_PLUGIN DESTDIR "/lib/pppd/" VERSION -+#define _PATH_PLUGIN LIBDIR "/pppd/" VERSION - #else /* __STDC__ */ - #define _PATH_PLUGIN "/usr/lib/pppd" - #endif /* __STDC__ */ -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index 6403e3d..f42d18c 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -5,7 +5,7 @@ COPTS=@CFLAGS@ - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS_SHARED = -shared -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index d3a8086..c2aff0c 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -4,7 +4,7 @@ CC=$(CROSS_COMPILE)@CC@ - COPTS=@CFLAGS@ - - DESTDIR = $(INSTROOT)@DESTDIR@ --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux -index c415ce3..d3b7392 100644 ---- a/pppd/plugins/pppoe/Makefile.linux -+++ b/pppd/plugins/pppoe/Makefile.linux -@@ -18,7 +18,7 @@ COPTS=@CFLAGS@ - - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin --LIBDIR = $(DESTDIR)/lib/pppd/$(PPPDVERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(PPPDVERSION) - - PPPDVERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index 1aa1c0b..e4442f9 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -4,7 +4,7 @@ CC=$(CROSS_COMPILE)@CC@ - COPTS=@CFLAGS@ - - DESTDIR = $(INSTROOT)/@DESTDIR@ --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 489aef2..d2ef044 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -9,7 +9,7 @@ COPTS=@CFLAGS@ - - DESTDIR = $(INSTROOT)@DESTDIR@ - MANDIR = $(DESTDIR)/share/man/man8 --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - diff --git a/ppp-2.4.9-config.patch b/ppp-2.4.9-config.patch deleted file mode 100644 index fc7c781..0000000 --- a/ppp-2.4.9-config.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index e77373e..07df6a7 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -68,14 +68,14 @@ USE_TDB=y - #SYSTEMD=y - - HAS_SHADOW=y --#USE_PAM=y -+USE_PAM=y - HAVE_INET6=y - - # Enable plugins - PLUGIN=y - - # Enable Microsoft proprietary Callback Control Protocol --#CBCP=y -+CBCP=y - - # Enable EAP SRP-SHA1 authentication (requires libsrp) - #USE_SRP=y diff --git a/ppp-2.4.9-configure-cflags-allow-commas.patch b/ppp-2.4.9-configure-cflags-allow-commas.patch deleted file mode 100644 index 5a4ef98..0000000 --- a/ppp-2.4.9-configure-cflags-allow-commas.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff --git a/configure b/configure -index f977663..c7031c2 100755 ---- a/configure -+++ b/configure -@@ -121,9 +121,9 @@ mkmkf() { - rm -f $2 - if [ -f $1 ]; then - echo " $2 <= $1" -- sed -e "s,@DESTDIR@,$DESTDIR,g" -e "s,@SYSCONF@,$SYSCONF,g" \ -- -e "s,@CROSS_COMPILE@,$CROSS_COMPILE,g" -e "s,@CC@,$CC,g" \ -- -e "s,@CFLAGS@,$CFLAGS,g" $1 >$2 -+ sed -e "s|@DESTDIR@|$DESTDIR|g" -e "s|@SYSCONF@|$SYSCONF|g" \ -+ -e "s|@CROSS_COMPILE@|$CROSS_COMPILE|g" -e "s|@CC@|$CC|g" \ -+ -e "s|@CFLAGS@|$CFLAGS|g" $1 >$2 - fi - } - diff --git a/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch b/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch deleted file mode 100644 index 84a3bdb..0000000 --- a/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch +++ /dev/null @@ -1,241 +0,0 @@ -From 302c1b736cb656c7885a0cba270fd953a672d8a8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 13:56:34 +0200 -Subject: [PATCH 13/27] everywhere: O_CLOEXEC harder - ---- - pppd/eap.c | 2 +- - pppd/main.c | 4 ++-- - pppd/options.c | 4 ++-- - pppd/sys-linux.c | 22 +++++++++++----------- - pppd/tdb.c | 4 ++-- - pppd/tty.c | 4 ++-- - pppd/utils.c | 6 +++--- - 7 files changed, 23 insertions(+), 23 deletions(-) - -diff --git a/pppd/eap.c b/pppd/eap.c -index 6ea6c1f..faced53 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -1226,7 +1226,7 @@ mode_t modebits; - - if ((path = name_of_pn_file()) == NULL) - return (-1); -- fd = open(path, modebits, S_IRUSR | S_IWUSR); -+ fd = open(path, modebits, S_IRUSR | S_IWUSR | O_CLOEXEC); - err = errno; - free(path); - errno = err; -diff --git a/pppd/main.c b/pppd/main.c -index 6d50d1b..4880377 100644 ---- a/pppd/main.c -+++ b/pppd/main.c -@@ -420,7 +420,7 @@ main(argc, argv) - die(0); - - /* Make sure fds 0, 1, 2 are open to somewhere. */ -- fd_devnull = open(_PATH_DEVNULL, O_RDWR); -+ fd_devnull = open(_PATH_DEVNULL, O_RDWR | O_CLOEXEC); - if (fd_devnull < 0) - fatal("Couldn't open %s: %m", _PATH_DEVNULL); - while (fd_devnull <= 2) { -@@ -1679,7 +1679,7 @@ device_script(program, in, out, dont_wait) - if (log_to_fd >= 0) - errfd = log_to_fd; - else -- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0644); -+ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0644); - - ++conn_running; - pid = safe_fork(in, out, errfd); -diff --git a/pppd/options.c b/pppd/options.c -index 1d754ae..8e62635 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -1544,9 +1544,9 @@ setlogfile(argv) - option_error("unable to drop permissions to open %s: %m", *argv); - return 0; - } -- fd = open(*argv, O_WRONLY | O_APPEND | O_CREAT | O_EXCL, 0644); -+ fd = open(*argv, O_WRONLY | O_APPEND | O_CREAT | O_EXCL | O_CLOEXEC, 0644); - if (fd < 0 && errno == EEXIST) -- fd = open(*argv, O_WRONLY | O_APPEND); -+ fd = open(*argv, O_WRONLY | O_APPEND | O_CLOEXEC); - err = errno; - if (!privileged_option && seteuid(euid) == -1) - fatal("unable to regain privileges: %m"); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 8a12fa0..00a2cf5 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -459,7 +459,7 @@ int generic_establish_ppp (int fd) - goto err; - } - dbglog("using channel %d", chindex); -- fd = open("/dev/ppp", O_RDWR); -+ fd = open("/dev/ppp", O_RDWR | O_CLOEXEC); - if (fd < 0) { - error("Couldn't reopen /dev/ppp: %m"); - goto err; -@@ -619,7 +619,7 @@ static int make_ppp_unit() - dbglog("in make_ppp_unit, already had /dev/ppp open?"); - close(ppp_dev_fd); - } -- ppp_dev_fd = open("/dev/ppp", O_RDWR); -+ ppp_dev_fd = open("/dev/ppp", O_RDWR | O_CLOEXEC); - if (ppp_dev_fd < 0) - fatal("Couldn't open /dev/ppp: %m"); - flags = fcntl(ppp_dev_fd, F_GETFL); -@@ -693,7 +693,7 @@ int bundle_attach(int ifnum) - if (!new_style_driver) - return -1; - -- master_fd = open("/dev/ppp", O_RDWR); -+ master_fd = open("/dev/ppp", O_RDWR | O_CLOEXEC); - if (master_fd < 0) - fatal("Couldn't open /dev/ppp: %m"); - if (ioctl(master_fd, PPPIOCATTACH, &ifnum) < 0) { -@@ -1715,7 +1715,7 @@ int sifproxyarp (int unit, u_int32_t his_adr) - if (tune_kernel) { - forw_path = path_to_procfs("/sys/net/ipv4/ip_forward"); - if (forw_path != 0) { -- int fd = open(forw_path, O_WRONLY); -+ int fd = open(forw_path, O_WRONLY | O_CLOEXEC); - if (fd >= 0) { - if (write(fd, "1", 1) != 1) - error("Couldn't enable IP forwarding: %m"); -@@ -2030,7 +2030,7 @@ int ppp_available(void) - sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch); - kernel_version = KVERSION(osmaj, osmin, ospatch); - -- fd = open("/dev/ppp", O_RDWR); -+ fd = open("/dev/ppp", O_RDWR | O_CLOEXEC); - if (fd >= 0) { - new_style_driver = 1; - -@@ -2208,7 +2208,7 @@ void logwtmp (const char *line, const char *name, const char *host) - #if __GLIBC__ >= 2 - updwtmp(_PATH_WTMP, &ut); - #else -- wtmp = open(_PATH_WTMP, O_APPEND|O_WRONLY); -+ wtmp = open(_PATH_WTMP, O_APPEND|O_WRONLY|O_CLOEXEC); - if (wtmp >= 0) { - flock(wtmp, LOCK_EX); - -@@ -2394,7 +2394,7 @@ int sifaddr (int unit, u_int32_t our_adr, u_int32_t his_adr, - int fd; - - path = path_to_procfs("/sys/net/ipv4/ip_dynaddr"); -- if (path != 0 && (fd = open(path, O_WRONLY)) >= 0) { -+ if (path != 0 && (fd = open(path, O_WRONLY | O_CLOEXEC)) >= 0) { - if (write(fd, "1", 1) != 1) - error("Couldn't enable dynamic IP addressing: %m"); - close(fd); -@@ -2570,7 +2570,7 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) - /* - * Try the unix98 way first. - */ -- mfd = open("/dev/ptmx", O_RDWR); -+ mfd = open("/dev/ptmx", O_RDWR | O_CLOEXEC); - if (mfd >= 0) { - int ptn; - if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) { -@@ -2581,7 +2581,7 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) - if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0) - warn("Couldn't unlock pty slave %s: %m", pty_name); - #endif -- if ((sfd = open(pty_name, O_RDWR | O_NOCTTY)) < 0) -+ if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) - { - warn("Couldn't open pty slave %s: %m", pty_name); - close(mfd); -@@ -2592,10 +2592,10 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) - for (i = 0; i < 64; ++i) { - slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", - 'p' + i / 16, i % 16); -- mfd = open(pty_name, O_RDWR, 0); -+ mfd = open(pty_name, O_RDWR | O_CLOEXEC, 0); - if (mfd >= 0) { - pty_name[5] = 't'; -- sfd = open(pty_name, O_RDWR | O_NOCTTY, 0); -+ sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC, 0); - if (sfd >= 0) { - fchown(sfd, uid, -1); - fchmod(sfd, S_IRUSR | S_IWUSR); -diff --git a/pppd/tdb.c b/pppd/tdb.c -index bdc5828..c7ab71c 100644 ---- a/pppd/tdb.c -+++ b/pppd/tdb.c -@@ -1724,7 +1724,7 @@ TDB_CONTEXT *tdb_open_ex(const char *name, int hash_size, int tdb_flags, - goto internal; - } - -- if ((tdb->fd = open(name, open_flags, mode)) == -1) { -+ if ((tdb->fd = open(name, open_flags | O_CLOEXEC, mode)) == -1) { - TDB_LOG((tdb, 5, "tdb_open_ex: could not open file %s: %s\n", - name, strerror(errno))); - goto fail; /* errno set by open(2) */ -@@ -1967,7 +1967,7 @@ int tdb_reopen(TDB_CONTEXT *tdb) - } - if (close(tdb->fd) != 0) - TDB_LOG((tdb, 0, "tdb_reopen: WARNING closing tdb->fd failed!\n")); -- tdb->fd = open(tdb->name, tdb->open_flags & ~(O_CREAT|O_TRUNC), 0); -+ tdb->fd = open(tdb->name, (tdb->open_flags & ~(O_CREAT|O_TRUNC)) | O_CLOEXEC, 0); - if (tdb->fd == -1) { - TDB_LOG((tdb, 0, "tdb_reopen: open failed (%s)\n", strerror(errno))); - goto fail; -diff --git a/pppd/tty.c b/pppd/tty.c -index d571b11..bc96695 100644 ---- a/pppd/tty.c -+++ b/pppd/tty.c -@@ -569,7 +569,7 @@ int connect_tty() - status = EXIT_OPEN_FAILED; - goto errret; - } -- real_ttyfd = open(devnam, O_NONBLOCK | O_RDWR, 0); -+ real_ttyfd = open(devnam, O_NONBLOCK | O_RDWR | O_CLOEXEC, 0); - err = errno; - if (prio < OPRIO_ROOT && seteuid(0) == -1) - fatal("Unable to regain privileges"); -@@ -723,7 +723,7 @@ int connect_tty() - if (connector == NULL && modem && devnam[0] != 0) { - int i; - for (;;) { -- if ((i = open(devnam, O_RDWR)) >= 0) -+ if ((i = open(devnam, O_RDWR | O_CLOEXEC)) >= 0) - break; - if (errno != EINTR) { - error("Failed to reopen %s: %m", devnam); -diff --git a/pppd/utils.c b/pppd/utils.c -index 29bf970..6051b9a 100644 ---- a/pppd/utils.c -+++ b/pppd/utils.c -@@ -918,14 +918,14 @@ lock(dev) - slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", LOCK_DIR, dev); - #endif - -- while ((fd = open(lock_file, O_EXCL | O_CREAT | O_RDWR, 0644)) < 0) { -+ while ((fd = open(lock_file, O_EXCL | O_CREAT | O_RDWR | O_CLOEXEC, 0644)) < 0) { - if (errno != EEXIST) { - error("Can't create lock file %s: %m", lock_file); - break; - } - - /* Read the lock file to find out who has the device locked. */ -- fd = open(lock_file, O_RDONLY, 0); -+ fd = open(lock_file, O_RDONLY | O_CLOEXEC, 0); - if (fd < 0) { - if (errno == ENOENT) /* This is just a timing problem. */ - continue; -@@ -1004,7 +1004,7 @@ relock(pid) - - if (lock_file[0] == 0) - return -1; -- fd = open(lock_file, O_WRONLY, 0); -+ fd = open(lock_file, O_WRONLY | O_CLOEXEC, 0); - if (fd < 0) { - error("Couldn't reopen lock file %s: %m", lock_file); - lock_file[0] = 0; --- -1.8.3.1 - diff --git a/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch b/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch deleted file mode 100644 index fb0bcc1..0000000 --- a/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch +++ /dev/null @@ -1,898 +0,0 @@ -From d706c95906d996534f13632a747af5dc617f306e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Eivind=20N=C3=A6ss?= -Date: Sat, 24 Apr 2021 03:00:34 -0700 -Subject: [PATCH] pppd: Expose the MPPE keys generated through an API (#267) - -The lengthy part of this fix is to refactor the handling of MPPE keys -by moving it into mppe.c and thus reducing the clutter in chap_ms.c. -It does so by renaming the mppe_set_keys/2 to the corresponding -mppe_set_chapv1/mppe_set_chapv2 versions and updates callers of these -functions. - -Having done so, it conveniently allows the name "mppe_set_keys" to be -re-used for this new purpose which will copy the key material up to -its size and then clear the input parameters (avoids leaving the MPPE -keys on the stack). - -Additional functiions added to the MPPE code allow plugins et al. to -access the MPPE keys, clear the keys, and check if they are set. All -plugin and CCP code has been updated to use this API. - -This fixes GitHub Issue #258 - -Signed-off-by: Eivind Naess ---- - pppd/Makefile.linux | 2 + - pppd/Makefile.sol2 | 2 +- - pppd/ccp.c | 15 +-- - pppd/chap_ms.c | 167 +---------------------- - pppd/chap_ms.h | 22 +--- - pppd/eap-tls.c | 21 +-- - pppd/eap-tls.h | 5 - - pppd/mppe.c | 248 +++++++++++++++++++++++++++++++++++ - pppd/mppe.h | 70 +++++++++- - pppd/plugins/radius/radius.c | 14 +- - pppd/plugins/winbind.c | 8 +- - 11 files changed, 348 insertions(+), 226 deletions(-) - create mode 100644 pppd/mppe.c - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index f92f7c0..852945e 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -109,6 +109,8 @@ CFLAGS += -DMSLANMAN=1 - endif - ifdef MPPE - CFLAGS += -DMPPE=1 -+PPPDOBJS += mppe.o -+PPPDSRC += mppe.c - HEADERS += mppe.h - endif - endif -diff --git a/pppd/Makefile.sol2 b/pppd/Makefile.sol2 -index 809cb4b..3a8681c 100644 ---- a/pppd/Makefile.sol2 -+++ b/pppd/Makefile.sol2 -@@ -37,7 +37,7 @@ OBJS += ipv6cp.o eui64.o - - # Uncomment to enable MS-CHAP - CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H --OBJS += chap_ms.o pppcrypt.o md4.o sha1.o -+OBJS += chap_ms.o pppcrypt.o md4.o sha1.o mppe.o - - # Uncomment to enable MPPE (in both CHAP and EAP-TLS) - CFLAGS += -DMPPE -diff --git a/pppd/ccp.c b/pppd/ccp.c -index 052c4c6..387b571 100644 ---- a/pppd/ccp.c -+++ b/pppd/ccp.c -@@ -38,10 +38,9 @@ - #include "ccp.h" - #include - --#ifdef MPPE --#include "chap_ms.h" /* mppe_xxxx_key, mppe_keys_set */ -+#include "chap_ms.h" -+#include "mppe.h" - #include "lcp.h" /* lcp_close(), lcp_fsm */ --#endif - - - /* -@@ -574,7 +573,7 @@ ccp_resetci(fsm *f) - } - - /* A plugin (eg radius) may not have obtained key material. */ -- if (!mppe_keys_set) { -+ if (!mppe_keys_isset()) { - error("MPPE required, but keys are not available. " - "Possible plugin problem?"); - lcp_close(f->unit, "MPPE required but not available"); -@@ -705,7 +704,7 @@ static void - p[1] = opt_buf[1] = CILEN_MPPE; - MPPE_OPTS_TO_CI(go->mppe, &p[2]); - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]); -- BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); -+ mppe_get_recv_key(&opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); - res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0); - if (res > 0) - p += CILEN_MPPE; -@@ -1156,8 +1155,7 @@ ccp_reqci(fsm *f, u_char *p, int *lenp, int dont_nak) - int mtu; - - BCOPY(p, opt_buf, CILEN_MPPE); -- BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], -- MPPE_MAX_KEY_LEN); -+ mppe_get_send_key(&opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); - if (ccp_test(f->unit, opt_buf, - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) { - /* This shouldn't happen, we've already tested it! */ -@@ -1426,8 +1424,7 @@ ccp_up(fsm *f) - notice("%s transmit compression enabled", method_name(ho, NULL)); - #ifdef MPPE - if (go->mppe) { -- BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN); -- BZERO(mppe_send_key, MPPE_MAX_KEY_LEN); -+ mppe_clear_keys(); - continue_networks(f->unit); /* Bring up IP et al */ - } - #endif -diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c -index df2dadd..d315ab4 100644 ---- a/pppd/chap_ms.c -+++ b/pppd/chap_ms.c -@@ -93,8 +93,7 @@ - #include "sha1.h" - #include "pppcrypt.h" - #include "magic.h" -- -- -+#include "mppe.h" - - static void ascii2unicode (char[], int, u_char[]); - static void NTPasswordHash (u_char *, int, u_char[MD4_SIGNATURE_SIZE]); -@@ -109,21 +108,12 @@ static void GenerateAuthenticatorResponsePlain - static void ChapMS_LANMan (u_char *, char *, int, u_char *); - #endif - --#ifdef MPPE --static void Set_Start_Key (u_char *, char *, int); --static void SetMasterKeys (char *, int, u_char[24], int); --#endif -- - #ifdef MSLANMAN - bool ms_lanman = 0; /* Use LanMan password instead of NT */ - /* Has meaning only with MS-CHAP challenges */ - #endif - - #ifdef MPPE --u_char mppe_send_key[MPPE_MAX_KEY_LEN]; --u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; --int mppe_keys_set = 0; /* Have the MPPE keys been set? */ -- - #ifdef DEBUGMPPEKEY - /* For MPPE debug */ - /* Use "[]|}{?/><,`!2&&(" (sans quotes) for RFC 3079 MS-CHAPv2 test value */ -@@ -719,28 +709,6 @@ GenerateAuthenticatorResponsePlain - - - #ifdef MPPE --/* -- * Set mppe_xxxx_key from the NTPasswordHashHash. -- * RFC 2548 (RADIUS support) requires us to export this function (ugh). -- */ --void --mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) --{ -- SHA1_CTX sha1Context; -- u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ -- -- SHA1_Init(&sha1Context); -- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -- SHA1_Update(&sha1Context, rchallenge, 8); -- SHA1_Final(Digest, &sha1Context); -- -- /* Same key in both directions. */ -- BCOPY(Digest, mppe_send_key, sizeof(mppe_send_key)); -- BCOPY(Digest, mppe_recv_key, sizeof(mppe_recv_key)); -- -- mppe_keys_set = 1; --} - - /* - * Set mppe_xxxx_key from MS-CHAP credentials. (see RFC 3079) -@@ -757,104 +725,7 @@ Set_Start_Key(u_char *rchallenge, char *secret, int secret_len) - NTPasswordHash(unicodePassword, secret_len * 2, PasswordHash); - NTPasswordHash(PasswordHash, sizeof(PasswordHash), PasswordHashHash); - -- mppe_set_keys(rchallenge, PasswordHashHash); --} -- --/* -- * Set mppe_xxxx_key from MS-CHAPv2 credentials. (see RFC 3079) -- * -- * This helper function used in the Winbind module, which gets the -- * NTHashHash from the server. -- */ --void --mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], -- u_char NTResponse[24], int IsServer) --{ -- SHA1_CTX sha1Context; -- u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ -- u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ -- -- u_char SHApad1[40] = -- { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; -- u_char SHApad2[40] = -- { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 }; -- -- /* "This is the MPPE Master Key" */ -- u_char Magic1[27] = -- { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, -- 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d, -- 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 }; -- /* "On the client side, this is the send key; " -- "on the server side, it is the receive key." */ -- u_char Magic2[84] = -- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, -- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, -- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -- 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79, -- 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, -- 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65, -- 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, -- 0x6b, 0x65, 0x79, 0x2e }; -- /* "On the client side, this is the receive key; " -- "on the server side, it is the send key." */ -- u_char Magic3[84] = -- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, -- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, -- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, -- 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, -- 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, -- 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, -- 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, -- 0x6b, 0x65, 0x79, 0x2e }; -- u_char *s; -- -- SHA1_Init(&sha1Context); -- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -- SHA1_Update(&sha1Context, NTResponse, 24); -- SHA1_Update(&sha1Context, Magic1, sizeof(Magic1)); -- SHA1_Final(MasterKey, &sha1Context); -- -- /* -- * generate send key -- */ -- if (IsServer) -- s = Magic3; -- else -- s = Magic2; -- SHA1_Init(&sha1Context); -- SHA1_Update(&sha1Context, MasterKey, 16); -- SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); -- SHA1_Update(&sha1Context, s, 84); -- SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); -- SHA1_Final(Digest, &sha1Context); -- -- BCOPY(Digest, mppe_send_key, sizeof(mppe_send_key)); -- -- /* -- * generate recv key -- */ -- if (IsServer) -- s = Magic2; -- else -- s = Magic3; -- SHA1_Init(&sha1Context); -- SHA1_Update(&sha1Context, MasterKey, 16); -- SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); -- SHA1_Update(&sha1Context, s, 84); -- SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); -- SHA1_Final(Digest, &sha1Context); -- -- BCOPY(Digest, mppe_recv_key, sizeof(mppe_recv_key)); -- -- mppe_keys_set = 1; -+ mppe_set_chapv1(rchallenge, PasswordHashHash); - } - - /* -@@ -870,7 +741,7 @@ SetMasterKeys(char *secret, int secret_len, u_char NTResponse[24], int IsServer) - ascii2unicode(secret, secret_len, unicodePassword); - NTPasswordHash(unicodePassword, secret_len * 2, PasswordHash); - NTPasswordHash(PasswordHash, sizeof(PasswordHash), PasswordHashHash); -- mppe_set_keys2(PasswordHashHash, NTResponse, IsServer); -+ mppe_set_chapv2(PasswordHashHash, NTResponse, IsServer); - } - - #endif /* MPPE */ -@@ -945,38 +816,6 @@ ChapMS2(u_char *rchallenge, u_char *PeerChallenge, - #endif - } - --#ifdef MPPE --/* -- * Set MPPE options from plugins. -- */ --void --set_mppe_enc_types(int policy, int types) --{ -- /* Early exit for unknown policies. */ -- if (policy != MPPE_ENC_POL_ENC_ALLOWED && -- policy != MPPE_ENC_POL_ENC_REQUIRED) -- return; -- -- /* Don't modify MPPE if it's optional and wasn't already configured. */ -- if (policy == MPPE_ENC_POL_ENC_ALLOWED && !ccp_wantoptions[0].mppe) -- return; -- -- /* -- * Disable undesirable encryption types. Note that we don't ENABLE -- * any encryption types, to avoid overriding manual configuration. -- */ -- switch(types) { -- case MPPE_ENC_TYPES_RC4_40: -- ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ -- break; -- case MPPE_ENC_TYPES_RC4_128: -- ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ -- break; -- default: -- break; -- } --} --#endif /* MPPE */ - - static struct chap_digest_type chapms_digest = { - CHAP_MICROSOFT, /* code */ -diff --git a/pppd/chap_ms.h b/pppd/chap_ms.h -index 005eb63..4e6a621 100644 ---- a/pppd/chap_ms.h -+++ b/pppd/chap_ms.h -@@ -38,6 +38,7 @@ - #define MS_CHAP_RESPONSE_LEN 49 /* Response length for MS-CHAP */ - #define MS_CHAP2_RESPONSE_LEN 49 /* Response length for MS-CHAPv2 */ - #define MS_AUTH_RESPONSE_LENGTH 40 /* MS-CHAPv2 authenticator response, */ -+#define MS_AUTH_NTRESP_LEN 24 /* Length of NT-response field */ - /* as ASCII */ - - /* E=eeeeeeeeee error codes for MS-CHAP failure messages. */ -@@ -67,22 +68,6 @@ - #define MS_CHAP2_NTRESP_LEN 24 - #define MS_CHAP2_FLAGS 48 - --#ifdef MPPE --#include "mppe.h" /* MPPE_MAX_KEY_LEN */ --extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; --extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; --extern int mppe_keys_set; -- --/* These values are the RADIUS attribute values--see RFC 2548. */ --#define MPPE_ENC_POL_ENC_ALLOWED 1 --#define MPPE_ENC_POL_ENC_REQUIRED 2 --#define MPPE_ENC_TYPES_RC4_40 2 --#define MPPE_ENC_TYPES_RC4_128 4 -- --/* used by plugins (using above values) */ --extern void set_mppe_enc_types(int, int); --#endif -- - /* Are we the authenticator or authenticatee? For MS-CHAPv2 key derivation. */ - #define MS_CHAP2_AUTHENTICATEE 0 - #define MS_CHAP2_AUTHENTICATOR 1 -@@ -90,11 +75,6 @@ extern void set_mppe_enc_types(int, int); - void ChapMS (u_char *, char *, int, u_char *); - void ChapMS2 (u_char *, u_char *, char *, char *, int, - u_char *, u_char[MS_AUTH_RESPONSE_LENGTH+1], int); --#ifdef MPPE --void mppe_set_keys (u_char *, u_char[MD4_SIGNATURE_SIZE]); --void mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], -- u_char NTResponse[24], int IsServer); --#endif - - void ChallengeHash (u_char[16], u_char *, char *, u_char[8]); - -diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c -index 5c202c7..bfcf199 100644 ---- a/pppd/eap-tls.c -+++ b/pppd/eap-tls.c -@@ -48,6 +48,8 @@ - #include "eap-tls.h" - #include "fsm.h" - #include "lcp.h" -+#include "chap_ms.h" -+#include "mppe.h" - #include "pathnames.h" - - typedef struct pw_cb_data -@@ -74,10 +76,6 @@ int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); - X509 *get_X509_from_file(char *filename); - int ssl_cmp_certs(char *filename, X509 * a); - --#ifdef MPPE -- --#define EAPTLS_MPPE_KEY_LEN 32 -- - /* - * OpenSSL 1.1+ introduced a generic TLS_method() - * For older releases we substitute the appropriate method -@@ -119,6 +117,8 @@ static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) - - #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ - -+#ifdef MPPE -+#define EAPTLS_MPPE_KEY_LEN 32 - - /* - * Generate keys according to RFC 2716 and add to reply -@@ -161,24 +161,17 @@ void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) - */ - if (client) - { -- p = out; -- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -- p += EAPTLS_MPPE_KEY_LEN; -- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ mppe_set_keys(out, out + EAPTLS_MPPE_KEY_LEN, EAPTLS_MPPE_KEY_LEN); - } - else - { -- p = out; -- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -- p += EAPTLS_MPPE_KEY_LEN; -- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ mppe_set_keys(out + EAPTLS_MPPE_KEY_LEN, out, EAPTLS_MPPE_KEY_LEN); - } -- -- mppe_keys_set = 1; - } - - #endif /* MPPE */ - -+ - void log_ssl_errors( void ) - { - unsigned long ssl_err = ERR_get_error(); -diff --git a/pppd/eap-tls.h b/pppd/eap-tls.h -index c74a831..b935ec5 100644 ---- a/pppd/eap-tls.h -+++ b/pppd/eap-tls.h -@@ -86,11 +86,6 @@ int get_eaptls_secret(int unit, char *client, char *server, - char *capath, char *pkfile, int am_server); - - #ifdef MPPE --#include "mppe.h" /* MPPE_MAX_KEY_LEN */ --extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; --extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; --extern int mppe_keys_set; -- - void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); - #endif - -diff --git a/pppd/mppe.c b/pppd/mppe.c -new file mode 100644 -index 0000000..4f3d131 ---- /dev/null -+++ b/pppd/mppe.c -@@ -0,0 +1,248 @@ -+/* * mppe.c - MPPE key implementation -+ * -+ * Copyright (c) 2020 Eivind Naess. All rights reserved. -+ * Copyright (c) 2008 Paul Mackerras. All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#include -+ -+#include "pppd.h" -+#include "fsm.h" -+#include "md4.h" -+#include "sha1.h" -+#include "ccp.h" -+#include "chap_ms.h" -+#include "mppe.h" -+ -+u_char mppe_send_key[MPPE_MAX_KEY_SIZE]; -+u_char mppe_recv_key[MPPE_MAX_KEY_SIZE]; -+int mppe_keys_set = 0; -+ -+void -+mppe_set_keys(u_char *send_key, u_char *recv_key, int keylen) -+{ -+ int length = keylen; -+ if (length > MPPE_MAX_KEY_SIZE) -+ length = MPPE_MAX_KEY_SIZE; -+ -+ if (send_key) { -+ BCOPY(send_key, mppe_send_key, length); -+ BZERO(send_key, keylen); -+ } -+ -+ if (recv_key) { -+ BCOPY(recv_key, mppe_recv_key, length); -+ BZERO(recv_key, keylen); -+ } -+ -+ mppe_keys_set = length; -+} -+ -+bool -+mppe_keys_isset() -+{ -+ return !!mppe_keys_set; -+} -+ -+int -+mppe_get_recv_key(u_char *recv_key, int length) -+{ -+ if (mppe_keys_isset()) { -+ if (length > mppe_keys_set) -+ length = mppe_keys_set; -+ BCOPY(mppe_recv_key, recv_key, length); -+ return length; -+ } -+ return 0; -+} -+ -+int -+mppe_get_send_key(u_char *send_key, int length) -+{ -+ if (mppe_keys_isset()) { -+ if (length > mppe_keys_set) -+ length = mppe_keys_set; -+ BCOPY(mppe_send_key, send_key, length); -+ return length; -+ } -+ return 0; -+} -+ -+void -+mppe_clear_keys(void) -+{ -+ mppe_keys_set = 0; -+ BZERO(mppe_send_key, sizeof(mppe_send_key)); -+ BZERO(mppe_recv_key, sizeof(mppe_recv_key)); -+} -+ -+/* -+ * Set mppe_xxxx_key from the NTPasswordHashHash. -+ * RFC 2548 (RADIUS support) requires us to export this function (ugh). -+ */ -+void -+mppe_set_chapv1(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) -+{ -+ SHA1_CTX sha1Context; -+ u_char Digest[SHA1_SIGNATURE_SIZE]; -+ -+ SHA1_Init(&sha1Context); -+ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -+ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -+ SHA1_Update(&sha1Context, rchallenge, 8); -+ SHA1_Final(Digest, &sha1Context); -+ -+ /* Same key in both directions. */ -+ mppe_set_keys(Digest, Digest, sizeof(Digest)); -+} -+ -+/* -+ * Set mppe_xxxx_key from MS-CHAPv2 credentials. (see RFC 3079) -+ * -+ * This helper function used in the Winbind module, which gets the -+ * NTHashHash from the server. -+ */ -+void -+mppe_set_chapv2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], -+ u_char NTResponse[MS_AUTH_NTRESP_LEN], int IsServer) -+{ -+ SHA1_CTX sha1Context; -+ u_char MasterKey[SHA1_SIGNATURE_SIZE]; -+ u_char SendKey[SHA1_SIGNATURE_SIZE]; -+ u_char RecvKey[SHA1_SIGNATURE_SIZE]; -+ -+ u_char SHApad1[40] = -+ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; -+ u_char SHApad2[40] = -+ { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 }; -+ -+ /* "This is the MPPE Master Key" */ -+ u_char Magic1[27] = -+ { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, -+ 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d, -+ 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 }; -+ /* "On the client side, this is the send key; " -+ "on the server side, it is the receive key." */ -+ u_char Magic2[84] = -+ { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, -+ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, -+ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -+ 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79, -+ 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, -+ 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65, -+ 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -+ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, -+ 0x6b, 0x65, 0x79, 0x2e }; -+ /* "On the client side, this is the receive key; " -+ "on the server side, it is the send key." */ -+ u_char Magic3[84] = -+ { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, -+ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, -+ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -+ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, -+ 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, -+ 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, -+ 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, -+ 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, -+ 0x6b, 0x65, 0x79, 0x2e }; -+ u_char *s; -+ -+ SHA1_Init(&sha1Context); -+ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -+ SHA1_Update(&sha1Context, NTResponse, 24); -+ SHA1_Update(&sha1Context, Magic1, sizeof(Magic1)); -+ SHA1_Final(MasterKey, &sha1Context); -+ -+ /* -+ * generate send key -+ */ -+ if (IsServer) -+ s = Magic3; -+ else -+ s = Magic2; -+ SHA1_Init(&sha1Context); -+ SHA1_Update(&sha1Context, MasterKey, 16); -+ SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); -+ SHA1_Update(&sha1Context, s, 84); -+ SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); -+ SHA1_Final(SendKey, &sha1Context); -+ -+ /* -+ * generate recv key -+ */ -+ if (IsServer) -+ s = Magic2; -+ else -+ s = Magic3; -+ SHA1_Init(&sha1Context); -+ SHA1_Update(&sha1Context, MasterKey, 16); -+ SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); -+ SHA1_Update(&sha1Context, s, 84); -+ SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); -+ SHA1_Final(RecvKey, &sha1Context); -+ -+ mppe_set_keys(SendKey, RecvKey, SHA1_SIGNATURE_SIZE); -+} -+ -+/* -+ * Set MPPE options from plugins. -+ */ -+void -+mppe_set_enc_types(int policy, int types) -+{ -+ /* Early exit for unknown policies. */ -+ if (policy != MPPE_ENC_POL_ENC_ALLOWED && -+ policy != MPPE_ENC_POL_ENC_REQUIRED) -+ return; -+ -+ /* Don't modify MPPE if it's optional and wasn't already configured. */ -+ if (policy == MPPE_ENC_POL_ENC_ALLOWED && !ccp_wantoptions[0].mppe) -+ return; -+ -+ /* -+ * Disable undesirable encryption types. Note that we don't ENABLE -+ * any encryption types, to avoid overriding manual configuration. -+ */ -+ switch(types) { -+ case MPPE_ENC_TYPES_RC4_40: -+ ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ -+ break; -+ case MPPE_ENC_TYPES_RC4_128: -+ ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ -+ break; -+ default: -+ break; -+ } -+} -+ -diff --git a/pppd/mppe.h b/pppd/mppe.h -index 5eb3b37..98a89d3 100644 ---- a/pppd/mppe.h -+++ b/pppd/mppe.h -@@ -32,9 +32,12 @@ - * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING - * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - */ -+#ifndef __MPPE_H__ -+#define __MPPE_H__ - - #define MPPE_PAD 4 /* MPPE growth per frame */ --#define MPPE_MAX_KEY_LEN 16 /* largest key length (128-bit) */ -+#define MPPE_MAX_KEY_SIZE 32 /* Largest key length */ -+#define MPPE_MAX_KEY_LEN 16 /* Largest key size accepted by the kernel */ - - /* option bits for ccp_options.mppe */ - #define MPPE_OPT_40 0x01 /* 40 bit */ -@@ -119,3 +122,68 @@ - if (ptr[3] & ~MPPE_ALL_BITS) \ - opts |= MPPE_OPT_UNKNOWN; \ - } while (/* CONSTCOND */ 0) -+ -+ -+#if MPPE -+ -+/* -+ * NOTE: -+ * Access to these variables directly is discuraged. Please -+ * change your code to use below accessor functions. -+ */ -+ -+/* The key material generated which is used for MPPE send key */ -+extern u_char mppe_send_key[MPPE_MAX_KEY_SIZE]; -+/* The key material generated which is used for MPPE recv key */ -+extern u_char mppe_recv_key[MPPE_MAX_KEY_SIZE]; -+/* Keys are set if value is non-zero */ -+extern int mppe_keys_set; -+ -+/* These values are the RADIUS attribute values--see RFC 2548. */ -+#define MPPE_ENC_POL_ENC_ALLOWED 1 -+#define MPPE_ENC_POL_ENC_REQUIRED 2 -+#define MPPE_ENC_TYPES_RC4_40 2 -+#define MPPE_ENC_TYPES_RC4_128 4 -+ -+/* used by plugins (using above values) */ -+void mppe_set_enc_types (int policy, int types); -+ -+/* -+ * Set the MPPE send and recv keys. NULL values for keys are ignored -+ * and input values are cleared to avoid leaving them on the stack -+ */ -+void mppe_set_keys(u_char *send_key, u_char *recv_key, int keylen); -+ -+/* -+ * Get the MPPE recv key -+ */ -+int mppe_get_recv_key(u_char *recv_key, int length); -+ -+/* -+ * Get the MPPE send key -+ */ -+int mppe_get_send_key(u_char *send_key, int length); -+ -+/* -+ * Clear the MPPE keys -+ */ -+void mppe_clear_keys(void); -+ -+/* -+ * Check if the MPPE keys are set -+ */ -+bool mppe_keys_isset(void); -+ -+/* -+ * Set mppe_xxxx_key from NT Password Hash Hash (MSCHAPv1), see RFC3079 -+ */ -+void mppe_set_chapv1(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]); -+ -+/* -+ * Set the mppe_xxxx_key from MS-CHAP-v2 credentials, see RFC3079 -+ */ -+void mppe_set_chapv2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], -+ u_char NTResponse[MS_AUTH_NTRESP_LEN], int IsServer); -+ -+#endif // #ifdef MPPE -+#endif // #ifdef __MPPE_H__ -diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c -index c579831..cf4c0f2 100644 ---- a/pppd/plugins/radius/radius.c -+++ b/pppd/plugins/radius/radius.c -@@ -31,6 +31,7 @@ static char const RCSID[] = - #ifdef CHAPMS - #include "chap_ms.h" - #ifdef MPPE -+#include "mppe.h" - #include "md5.h" - #endif - #endif -@@ -743,11 +744,12 @@ radius_setparams(VALUE_PAIR *vp, char *msg, REQUEST_INFO *req_info, - * Note that if the policy value was '0' we don't set the key! - */ - if (mppe_enc_policy && mppe_enc_keys) { -- mppe_keys_set = 1; - /* Set/modify allowed encryption types. */ - if (mppe_enc_types) -- set_mppe_enc_types(mppe_enc_policy, mppe_enc_types); -+ mppe_set_enc_types(mppe_enc_policy, mppe_enc_types); -+ return 0; - } -+ mppe_clear_keys(); - #endif - - return 0; -@@ -803,7 +805,7 @@ radius_setmppekeys(VALUE_PAIR *vp, REQUEST_INFO *req_info, - * the NAS (us) doesn't need; we only need the start key. So we have - * to generate the start key, sigh. NB: We do not support the LM-Key. - */ -- mppe_set_keys(challenge, &plain[8]); -+ mppe_set_chapv1(challenge, &plain[8]); - - return 0; - } -@@ -855,7 +857,7 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info) - for (i = 0; i < 16; i++) - plain[i] ^= buf[i]; - -- if (plain[0] != sizeof(mppe_send_key) /* 16 */) { -+ if (plain[0] != 16) { - error("RADIUS: Incorrect key length (%d) for MS-MPPE-%s-Key attribute", - (int) plain[0], type); - return -1; -@@ -869,9 +871,9 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info) - plain[16] ^= buf[0]; /* only need the first byte */ - - if (vp->attribute == PW_MS_MPPE_SEND_KEY) -- memcpy(mppe_send_key, plain + 1, 16); -+ mppe_set_keys(plain + 1, NULL, 16); - else -- memcpy(mppe_recv_key, plain + 1, 16); -+ mppe_set_keys(NULL, plain + 1, 16); - - return 0; - } -diff --git a/pppd/plugins/winbind.c b/pppd/plugins/winbind.c -index 0c395c3..67c72f6 100644 ---- a/pppd/plugins/winbind.c -+++ b/pppd/plugins/winbind.c -@@ -37,11 +37,9 @@ - #include "pppd.h" - #include "chap-new.h" - #include "chap_ms.h" --#ifdef MPPE --#include "md5.h" --#endif - #include "fsm.h" - #include "ipcp.h" -+#include "mppe.h" - #include - #include - #include -@@ -583,7 +581,7 @@ winbind_chap_verify(char *user, char *ourname, int id, - nt_response, nt_response_size, - session_key, - &error_string) == AUTHENTICATED) { -- mppe_set_keys(challenge, session_key); -+ mppe_set_chapv1(challenge, session_key); - slprintf(message, message_space, "Access granted"); - return AUTHENTICATED; - -@@ -628,7 +626,7 @@ winbind_chap_verify(char *user, char *ourname, int id, - &response[MS_CHAP2_NTRESP], - &response[MS_CHAP2_PEER_CHALLENGE], - challenge, user, saresponse); -- mppe_set_keys2(session_key, &response[MS_CHAP2_NTRESP], -+ mppe_set_chapv2(session_key, &response[MS_CHAP2_NTRESP], - MS_CHAP2_AUTHENTICATOR); - if (response[MS_CHAP2_FLAGS]) { - slprintf(message, message_space, "S=%s", saresponse); --- -2.34.1 - diff --git a/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch b/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch deleted file mode 100644 index c8eb350..0000000 --- a/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch +++ /dev/null @@ -1,37 +0,0 @@ -From e609ed8bb62e4648568eaa49fbbc858dfda6d122 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Eivind=20N=C3=A6ss?= -Date: Sun, 14 Mar 2021 16:20:29 -0700 -Subject: [PATCH] pppd: Fix logical error in comparing valid encryption - policies (#262) - -RFC2548 describes the proper values of the MS-MPPE-Encryption-Policy attribute. -and it can only hold 2 values: 1 (encryption allowed) and 2 (encryption required). - -See - https://tools.ietf.org/html/rfc2548, section 2.4.4 - -The correct comparison should be made with an && and not a ||. - -This fixes github issue #218 - -Signed-off-by: Eivind Naess ---- - pppd/chap_ms.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c -index e6b84f2..df2dadd 100644 ---- a/pppd/chap_ms.c -+++ b/pppd/chap_ms.c -@@ -953,7 +953,7 @@ void - set_mppe_enc_types(int policy, int types) - { - /* Early exit for unknown policies. */ -- if (policy != MPPE_ENC_POL_ENC_ALLOWED || -+ if (policy != MPPE_ENC_POL_ENC_ALLOWED && - policy != MPPE_ENC_POL_ENC_REQUIRED) - return; - --- -2.34.1 - diff --git a/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch b/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch deleted file mode 100644 index 2b6f53e..0000000 --- a/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch +++ /dev/null @@ -1,32 +0,0 @@ -From d7e62a8499c4032d79e05afbd8fd3efd51c5b148 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Eivind=20N=C3=A6ss?= -Date: Thu, 3 Feb 2022 14:28:22 -0800 -Subject: [PATCH] pppd/eap: Fix bug causing incorrect response length (#334) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Need to update the esp->ea_client.ea_namelen variable. A plugin can override the -name of the user, and the variable is passed onto the eap_chap2_response generating -the wrong response length. - -Signed-off-by: Eivind Næss ---- - pppd/eap.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/pppd/eap.c b/pppd/eap.c -index 54c3d42..6cb595f 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -2182,6 +2182,7 @@ eap_request(eap_state *esp, u_char *inp, int id, int len) - eap_send_nak(esp, id, EAPT_SRP); - break; - } -+ esp->es_client.ea_namelen = strlen(esp->es_client.ea_name); - - /* Create the MSCHAPv2 response (and add to cache) */ - unsigned char response[MS_CHAP2_RESPONSE_LEN+1]; // VLEN + VALUE --- -2.34.1 - diff --git a/ppp-2.5.0-use-change-resolv-function.patch b/ppp-2.5.0-use-change-resolv-function.patch new file mode 100644 index 0000000..30a07fe --- /dev/null +++ b/ppp-2.5.0-use-change-resolv-function.patch @@ -0,0 +1,51 @@ +diff --git a/scripts/ip-down.local.add b/scripts/ip-down.local.add +index b93590e..8889cb6 100644 +--- a/scripts/ip-down.local.add ++++ b/scripts/ip-down.local.add +@@ -9,12 +9,13 @@ + # + # Nick Walker (nickwalker@email.com) + # ++. /etc/sysconfig/network-scripts/network-functions + + if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then + if [ -f /etc/ppp/resolv.prev ]; then +- cp -f /etc/ppp/resolv.prev /etc/resolv.conf ++ change_resolv_conf /etc/ppp/resolv.prev + else +- rm -f /etc/resolv.conf ++ change_resolv_conf + fi + fi + +diff --git a/scripts/ip-up.local.add b/scripts/ip-up.local.add +index 8017209..5ced496 100644 +--- a/scripts/ip-up.local.add ++++ b/scripts/ip-up.local.add +@@ -9,16 +9,22 @@ + # + # Nick Walker (nickwalker@email.com) + # ++. /etc/sysconfig/network-scripts/network-functions + + if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then + rm -f /etc/ppp/resolv.prev + if [ -f /etc/resolv.conf ]; then + cp /etc/resolv.conf /etc/ppp/resolv.prev +- grep domain /etc/ppp/resolv.prev > /etc/resolv.conf +- grep search /etc/ppp/resolv.prev >> /etc/resolv.conf +- cat /etc/ppp/resolv.conf >> /etc/resolv.conf ++ rscf=/etc/ppp/resolv.new ++ grep domain /etc/ppp/resolv.prev > $rscf ++ grep search /etc/ppp/resolv.prev >> $rscf ++ if [ -f /etc/ppp/resolv.conf ]; then ++ cat /etc/ppp/resolv.conf >> $rscf ++ fi ++ change_resolv_conf $rscf ++ rm -f $rscf + else +- cp /etc/ppp/resolv.conf /etc ++ change_resolv_conf /etc/ppp/resolv.conf + fi + fi + diff --git a/ppp.spec b/ppp.spec index de8598c..a9d6d51 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ppp -Version: 2.4.9 -Release: 9%{?dist} +Version: 2.5.0 +Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -22,34 +22,25 @@ Source11: ifdown-ppp Source12: ppp-watch.tar.xz # Fedora-specific -Patch0002: ppp-2.4.9-config.patch -Patch0004: 0004-doc-add-configuration-samples.patch -Patch0005: ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch -Patch0006: 0006-scritps-use-change_resolv_conf-function.patch -Patch0011: 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch -Patch0012: ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch -Patch0013: ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch -Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch -Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch -Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch -Patch0018: 0018-scritps-fix-ip-up.local-sample.patch -Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch -Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch -Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch -# https://github.com/ppp-project/ppp/commit/d7e62a8499c4032d79e05afbd8fd3efd51c5b148 -Patch0027: ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch -# https://github.com/ppp-project/ppp/commit/e609ed8bb62e4648568eaa49fbbc858dfda6d122 -Patch0028: ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch -# https://github.com/ppp-project/ppp/pull/267/commits/6bfe06b9428a60eb637d5450d65dd3932fe5a83f -Patch0029: ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch +Patch0: ppp-2.5.0-use-change-resolv-function.patch +BuildRequires: libtool +BuildRequires: autoconf +BuildRequires: automake BuildRequires: make BuildRequires: gcc -BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel +BuildRequires: pam-devel +BuildRequires: libpcap-devel +BuildRequires: systemd +BuildRequires: systemd-devel +BuildRequires: glib2-devel BuildRequires: openssl-devel +BuildRequires: linux-atm-libs-devel -Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd +Requires: glibc >= 2.0.6 +Requires: /etc/pam.d/system-auth +Requires: libpcap >= 14:0.8.3-6 +Requires: systemd Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd @@ -72,6 +63,7 @@ service. %package devel Summary: Headers for ppp plugin development Requires: %{name}%{?_isa} = %{version}-%{release} +Requires: pkgconf-pkg-config %description devel This package contains the header files for building plugins for ppp. @@ -82,12 +74,14 @@ This package contains the header files for building plugins for ppp. tar -xJf %{SOURCE12} %build -%configure --cflags="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" -%{make_build} LDFLAGS="%{?build_ldflags} -pie" -%{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" +autoreconf -fi +export CFLAGS="%{build_cflags} -fno-strict-aliasing" +%configure --enable-systemd --enable-cbcp --with-pam +%make_build +%make_build -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" %install -make INSTROOT=%{buildroot} install install-etcppp +%make_install find scripts -type f | xargs chmod a-x make ROOT=%{buildroot} -C ppp-watch install @@ -143,6 +137,7 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_sysconfdir}/ppp/ip-down.ipv6to4 %{_sysconfdir}/ppp/ipv6-up %{_sysconfdir}/ppp/ipv6-down +%{_sysconfdir}/ppp/openssl.cnf %{_mandir}/man8/chat.8* %{_mandir}/man8/pppd.8* %{_mandir}/man8/pppdump.8* @@ -171,8 +166,13 @@ mkdir -p %{buildroot}%{_rundir}/ppp %files devel %{_includedir}/pppd %doc PLUGINS +%{_libdir}/pkgconfig/pppd.pc %changelog +* Thu Apr 13 2023 Jaroslav Škarvada - 2.5.0-1 +- New version + Resolves: rhbz#2184291 + * Fri Jan 20 2023 Fedora Release Engineering - 2.4.9-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index db4f244..010a7fe 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ +SHA512 (ppp-2.5.0.tar.gz) = cf62410a952053f9aa71c5179453831152e958fcad9e77df2ddac864e39aa71af0b746e54b91e8fa3ad6295d6d2b1bb736e36dc05521b495f573468679133324 SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a -SHA512 (ppp-2.4.9.tar.gz) = c309f8f69f534c05547cd2f66dade0e0f198ea4c2928a7e899e660280786b3e965437a67b8c5bb81c59d0fa1818b4eb7b701d2dce015a420d380422d2bca4e1a From c9eaeba92be28024abdba9cfb2c5f3173bcc41c7 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Tue, 18 Apr 2023 14:39:21 -0700 Subject: [PATCH 29/57] Add comment to rebuild NetworkManager when bumping version --- ppp.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ppp.spec b/ppp.spec index a9d6d51..9e2118f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,6 +1,9 @@ %global _hardened_build 1 Name: ppp +# When bumping the ppp version, please be sure to rebuild +# NetworkManager against the new version - NetworkManager-ppp has a +# dep that is tied to the ppp version and generated at build time Version: 2.5.0 Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon From a5e362e976cd9461efc26d9f1b17b8f2ed2b56d6 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Wed, 19 Apr 2023 01:06:49 -0700 Subject: [PATCH 30/57] Update version bump comment --- ppp.spec | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/ppp.spec b/ppp.spec index 9e2118f..2963f36 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,9 +1,22 @@ %global _hardened_build 1 Name: ppp -# When bumping the ppp version, please be sure to rebuild -# NetworkManager against the new version - NetworkManager-ppp has a -# dep that is tied to the ppp version and generated at build time +# Please be careful when bumping the ppp version. Several packages +# have version-tied dependencies on it, including NetworkManager-ppp +# (from NetworkManager) and NetworkManager-pptp , which are core +# packages. They may need code changes to build against new ppp +# versions. Please only bump ppp on a side tag and ensure it also +# contains rebuilds of at least those two packages before merging. +# Several other less important packages are also tied to the ppp +# version, as of 2023-04-19 the list is: +# NetworkManager-fortisslvpn +# NetworkManager-l2tp +# NetworkManager-ppp +# NetworkManager-pptp +# NetworkManager-sstp +# sstp-client +# These all need to be patched (if necessary) and rebuilt for new +# versions of ppp. Version: 2.5.0 Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon From f8b675a1a6518d892b0cf46a45bd967743ce8e3e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 06:11:55 +0000 Subject: [PATCH 31/57] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 2963f36..615882c 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -185,6 +185,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 2.5.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Thu Apr 13 2023 Jaroslav Škarvada - 2.5.0-1 - New version Resolves: rhbz#2184291 From 0104c74bb68e007d4084aea8a2ec39d5c2f88ab4 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 24 Jul 2023 22:58:25 -0400 Subject: [PATCH 32/57] Use bundled ATM in RHEL builds If a system libatm is not found, the bundled version will be used as in previous versions. The bundled version was imported from 2.4.1 (based on date) but have not changed since. This avoids the need to support the entire linux-atm package in RHEL just for the pppoatm plugin. --- ppp.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 615882c..b2d6d21 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -51,7 +51,11 @@ BuildRequires: systemd BuildRequires: systemd-devel BuildRequires: glib2-devel BuildRequires: openssl-devel +%if %{defined rhel} +Provides: bundled(linux-atm) = 2.4.1 +%else BuildRequires: linux-atm-libs-devel +%endif Requires: glibc >= 2.0.6 Requires: /etc/pam.d/system-auth @@ -185,6 +189,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Tue Jul 25 2023 Yaakov Selkowitz - 2.5.0-3 +- Use bundled ATM in RHEL builds + * Fri Jul 21 2023 Fedora Release Engineering - 2.5.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 3e399582f0c3d72734e14b93870524c0e35d7d35 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 22:16:49 +0000 Subject: [PATCH 33/57] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index b2d6d21..cc14a39 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -189,6 +189,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 2.5.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Tue Jul 25 2023 Yaakov Selkowitz - 2.5.0-3 - Use bundled ATM in RHEL builds From 609188a4a4546d9663ef7e49ed823a1cd0c01bf6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 24 Jan 2024 16:31:03 +0100 Subject: [PATCH 34/57] Converted license to SPDX --- ppp.spec | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/ppp.spec b/ppp.spec index cc14a39..62ef388 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,9 +18,17 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: The Point-to-Point Protocol daemon -License: BSD and LGPLv2+ and GPLv2+ and Public Domain +# Add licenses: +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/441 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/442 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/443 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/444 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/445 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/446 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/447 +License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later URL: http://www.samba.org/ppp Source0: https://github.com/paulusmack/ppp/archive/ppp-%{version}.tar.gz @@ -189,6 +197,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Wed Jan 24 2024 Jaroslav Škarvada - 2.5.0-5 +- Converted license to SPDX + * Sun Jan 21 2024 Fedora Release Engineering - 2.5.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 93a27465a6939919e74245d56af6fd9083044bf6 Mon Sep 17 00:00:00 2001 From: Yanko Kaneti Date: Thu, 1 Feb 2024 15:02:25 +0200 Subject: [PATCH 35/57] Adapt ipv6-{up,down} to initscripts-less world Phase out use of initscripts for ipv6 if not installed --- ipv6-down | 58 +------------------------ ipv6-down.initscripts | 56 ++++++++++++++++++++++++ ipv6-up | 99 +------------------------------------------ ipv6-up.initscripts | 99 +++++++++++++++++++++++++++++++++++++++++++ ppp.spec | 6 +++ 5 files changed, 163 insertions(+), 155 deletions(-) create mode 100644 ipv6-down.initscripts create mode 100644 ipv6-up.initscripts diff --git a/ipv6-down b/ipv6-down index b290585..36e0c5f 100644 --- a/ipv6-down +++ b/ipv6-down @@ -6,65 +6,9 @@ # # This file should not be modified -- make local changes to # /etc/ppp/ipv6-down.local instead -# -# -# Taken from: -# (P) & (C) 2001-2006 by Peter Bieringer -# -# You will find more information on the initscripts-ipv6 homepage at -# http://www.deepspace6.net/projects/initscripts-ipv6.html -# -# RHL integration assistance by Pekka Savola -# -# Calling parameters: -# $1: interface name -# $6: logical interface name (set by pppd option ipparam) -# -# Version 2006-08-02 -# -# Uses following information from /etc/sysconfig/network-scripts/ifcfg-$1: -# IPV6INIT=yes|no: controls IPv6 configuration for this interface -# - -PATH=/sbin:/usr/sbin:/bin:/usr/bin -export PATH - -LOGDEVICE=$6 -REALDEVICE=$1 - -[ -f /etc/sysconfig/network ] || exit 0 -. /etc/sysconfig/network - -cd /etc/sysconfig/network-scripts -. ./network-functions - -CONFIG=$LOGDEVICE -[ -f "$CONFIG" ] || CONFIG=ifcfg-$CONFIG -source_config - -[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] || exit 1 -. /etc/sysconfig/network-scripts/network-functions-ipv6 +[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] && /etc/ppp/ipv6-down.initscripts "$@" [ -x /etc/ppp/ipv6-down.local ] && /etc/ppp/ipv6-down.local "$@" - -if [ "$IPV6_CONTROL_RADVD" = "yes" ]; then - # Control running radvd - ipv6_trigger_radvd down "$IPV6_RADVD_TRIGGER_ACTION" $IPV6_RADVD_PIDFILE -fi - -# IPv6 test, no module loaded, exit if system is not IPv6-ready -ipv6_test testonly || exit 0 - -# Test device status -ipv6_test_device_status $REALDEVICE -if [ $? != 0 -a $? != 11 ]; then - # device doesn't exist or other problem occurs - exit 1 -fi - -# Delete all current configured IPv6 addresses on this interface -ipv6_cleanup_device $REALDEVICE - exit 0 diff --git a/ipv6-down.initscripts b/ipv6-down.initscripts new file mode 100644 index 0000000..c8f228f --- /dev/null +++ b/ipv6-down.initscripts @@ -0,0 +1,56 @@ +#!/bin/sh +# +# +# Taken from: +# (P) & (C) 2001-2006 by Peter Bieringer +# +# You will find more information on the initscripts-ipv6 homepage at +# http://www.deepspace6.net/projects/initscripts-ipv6.html +# +# RHL integration assistance by Pekka Savola +# +# Calling parameters: +# $1: interface name +# $6: logical interface name (set by pppd option ipparam) +# +# Version 2006-08-02 +# +# Uses following information from /etc/sysconfig/network-scripts/ifcfg-$1: +# IPV6INIT=yes|no: controls IPv6 configuration for this interface +# +PATH=/sbin:/usr/sbin:/bin:/usr/bin +export PATH + +LOGDEVICE=$6 +REALDEVICE=$1 + +[ -f /etc/sysconfig/network ] || exit 0 +. /etc/sysconfig/network + +cd /etc/sysconfig/network-scripts +. ./network-functions + +CONFIG=$LOGDEVICE +[ -f "$CONFIG" ] || CONFIG=ifcfg-$CONFIG +source_config + +[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] || exit 1 +. /etc/sysconfig/network-scripts/network-functions-ipv6 + +if [ "$IPV6_CONTROL_RADVD" = "yes" ]; then + # Control running radvd + ipv6_trigger_radvd down "$IPV6_RADVD_TRIGGER_ACTION" $IPV6_RADVD_PIDFILE +fi + +# IPv6 test, no module loaded, exit if system is not IPv6-ready +ipv6_test testonly || exit 0 + +# Test device status +ipv6_test_device_status $REALDEVICE +if [ $? != 0 -a $? != 11 ]; then + # device doesn't exist or other problem occurs + exit 1 +fi + +# Delete all current configured IPv6 addresses on this interface +ipv6_cleanup_device $REALDEVICE diff --git a/ipv6-up b/ipv6-up index 059afec..623631a 100644 --- a/ipv6-up +++ b/ipv6-up @@ -7,105 +7,8 @@ # This file should not be modified -- make local changes to # /etc/ppp/ipv6-up.local instead # -# Taken from: -# (P) & (C) 2001-2006 by Peter Bieringer -# -# You will find more information on the initscripts-ipv6 homepage at -# http://www.deepspace6.net/projects/initscripts-ipv6.html -# -# RHL integration assistance by Pekka Savola -# -# Calling parameters: -# $1: interface name -# $6: logical interface name (set by pppd option ipparam) -# -# -# Version: 2006-08-02 -# -# Uses following information from "/etc/sysconfig/network": -# IPV6_DEFAULTDEV=: controls default route (optional) -# -# Uses following information from "/etc/sysconfig/network-scripts/ifcfg-$1": -# IPV6INIT=yes|no: controls IPv6 configuration for this interface -# IPV6ADDR=[/]: specify primary static IPv6 address -# IPV6ADDR_SECONDARIES="[/] ..." (optional) -# IPV6_MTU=: controls IPv6 MTU for this link (optional) -# - -PATH=/sbin:/usr/sbin:/bin:/usr/bin -export PATH - -LOGDEVICE=$6 -REALDEVICE=$1 - -[ -f /etc/sysconfig/network ] || exit 0 -. /etc/sysconfig/network - -cd /etc/sysconfig/network-scripts -. ./network-functions -. ./network-functions-ipv6 - -CONFIG=$LOGDEVICE -[ -f "$CONFIG" ] || CONFIG=ifcfg-$CONFIG -source_config - -# Test whether IPv6 configuration is disabled for this interface -[[ "$IPV6INIT" = [nN0]* ]] && exit 0 - -[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] || exit 1 -. /etc/sysconfig/network-scripts/network-functions-ipv6 - -# IPv6 test, module loaded, exit if system is not IPv6-ready -ipv6_test || exit 1 - -# Test device status -ipv6_test_device_status $REALDEVICE -if [ $? != 0 -a $? != 11 ]; then - # device doesn't exist or other problem occurs - exit 1 -fi - -# Setup IPv6 address on specified interface -if [ -n "$IPV6ADDR" ]; then - ipv6_add_addr_on_device $REALDEVICE $IPV6ADDR || exit 1 -fi - -# Set IPv6 MTU, if given -if [ -n "$IPV6_MTU" ]; then - ipv6_set_mtu $REALDEVICE $IPV6_MTU -fi - -# Setup additional IPv6 addresses from list, if given -if [ -n "$IPV6ADDR_SECONDARIES" ]; then - for ipv6addr in $IPV6ADDR_SECONDARIES; do - ipv6_add_addr_on_device $REALDEVICE $ipv6addr - done -fi - -# Setup default IPv6 route through device -if [ "$IPV6_DEFAULTDEV" = "$LOGDEVICE" ]; then - ipv6_set_default_route "" "$REALDEVICE" "$REALDEVICE" -fi - -# Setup additional static IPv6 routes on specified interface, if given -if [ -f /etc/sysconfig/static-routes-ipv6 ]; then - LC_ALL=C grep -w "^$LOGDEVICE" /etc/sysconfig/static-routes-ipv6 | while read device args; do - ipv6_add_route $args $REALDEVICE - done -fi - -# Setup additional static IPv6 routes (newer config style) -if [ -f "/etc/sysconfig/network-scripts/route6-$DEVICE" ]; then - sed -ne 's/#.*//' -e '/[^[:space:]]/p' "/etc/sysconfig/network-scripts/route6-$DEVICE" | while read line; do - /sbin/ip -6 route add $line - done -fi - -if [ "$IPV6_CONTROL_RADVD" = "yes" ]; then - # Control running radvd - ipv6_trigger_radvd up "$IPV6_RADVD_TRIGGER_ACTION" $IPV6_RADVD_PIDFILE -fi +[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] && /etc/ppp/ipv6-up.initscripts "$@" [ -x /etc/ppp/ipv6-up.local ] && /etc/ppp/ipv6-up.local "$@" diff --git a/ipv6-up.initscripts b/ipv6-up.initscripts new file mode 100644 index 0000000..98d6d63 --- /dev/null +++ b/ipv6-up.initscripts @@ -0,0 +1,99 @@ +#!/bin/sh +# Taken from: +# (P) & (C) 2001-2006 by Peter Bieringer +# +# You will find more information on the initscripts-ipv6 homepage at +# http://www.deepspace6.net/projects/initscripts-ipv6.html +# +# RHL integration assistance by Pekka Savola +# +# Calling parameters: +# $1: interface name +# $6: logical interface name (set by pppd option ipparam) +# +# +# Version: 2006-08-02 +# +# Uses following information from "/etc/sysconfig/network": +# IPV6_DEFAULTDEV=: controls default route (optional) +# +# Uses following information from "/etc/sysconfig/network-scripts/ifcfg-$1": +# IPV6INIT=yes|no: controls IPv6 configuration for this interface +# IPV6ADDR=[/]: specify primary static IPv6 address +# IPV6ADDR_SECONDARIES="[/] ..." (optional) +# IPV6_MTU=: controls IPv6 MTU for this link (optional) +# + +PATH=/sbin:/usr/sbin:/bin:/usr/bin +export PATH + +LOGDEVICE=$6 +REALDEVICE=$1 + +[ -f /etc/sysconfig/network ] || exit 0 +. /etc/sysconfig/network + +cd /etc/sysconfig/network-scripts +. ./network-functions +. ./network-functions-ipv6 + +CONFIG=$LOGDEVICE +[ -f "$CONFIG" ] || CONFIG=ifcfg-$CONFIG +source_config + +# Test whether IPv6 configuration is disabled for this interface +[[ "$IPV6INIT" = [nN0]* ]] && exit 0 + +[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] || exit 1 +. /etc/sysconfig/network-scripts/network-functions-ipv6 + +# IPv6 test, module loaded, exit if system is not IPv6-ready +ipv6_test || exit 1 + +# Test device status +ipv6_test_device_status $REALDEVICE +if [ $? != 0 -a $? != 11 ]; then + # device doesn't exist or other problem occurs + exit 1 +fi + +# Setup IPv6 address on specified interface +if [ -n "$IPV6ADDR" ]; then + ipv6_add_addr_on_device $REALDEVICE $IPV6ADDR || exit 1 +fi + +# Set IPv6 MTU, if given +if [ -n "$IPV6_MTU" ]; then + ipv6_set_mtu $REALDEVICE $IPV6_MTU +fi + +# Setup additional IPv6 addresses from list, if given +if [ -n "$IPV6ADDR_SECONDARIES" ]; then + for ipv6addr in $IPV6ADDR_SECONDARIES; do + ipv6_add_addr_on_device $REALDEVICE $ipv6addr + done +fi + +# Setup default IPv6 route through device +if [ "$IPV6_DEFAULTDEV" = "$LOGDEVICE" ]; then + ipv6_set_default_route "" "$REALDEVICE" "$REALDEVICE" +fi + +# Setup additional static IPv6 routes on specified interface, if given +if [ -f /etc/sysconfig/static-routes-ipv6 ]; then + LC_ALL=C grep -w "^$LOGDEVICE" /etc/sysconfig/static-routes-ipv6 | while read device args; do + ipv6_add_route $args $REALDEVICE + done +fi + +# Setup additional static IPv6 routes (newer config style) +if [ -f "/etc/sysconfig/network-scripts/route6-$DEVICE" ]; then + sed -ne 's/#.*//' -e '/[^[:space:]]/p' "/etc/sysconfig/network-scripts/route6-$DEVICE" | while read line; do + /sbin/ip -6 route add $line + done +fi + +if [ "$IPV6_CONTROL_RADVD" = "yes" ]; then + # Control running radvd + ipv6_trigger_radvd up "$IPV6_RADVD_TRIGGER_ACTION" $IPV6_RADVD_PIDFILE +fi diff --git a/ppp.spec b/ppp.spec index 62ef388..38a8cad 100644 --- a/ppp.spec +++ b/ppp.spec @@ -44,6 +44,8 @@ Source9: ipv6-up Source10: ifup-ppp Source11: ifdown-ppp Source12: ppp-watch.tar.xz +Source13: ipv6-up.initscripts +Source14: ipv6-down.initscripts # Fedora-specific Patch0: ppp-2.5.0-use-change-resolv-function.patch @@ -136,6 +138,8 @@ install -p %{SOURCE6} %{buildroot}%{_sysconfdir}/ppp/ip-up install -p %{SOURCE7} %{buildroot}%{_sysconfdir}/ppp/ip-up.ipv6to4 install -p %{SOURCE8} %{buildroot}%{_sysconfdir}/ppp/ipv6-down install -p %{SOURCE9} %{buildroot}%{_sysconfdir}/ppp/ipv6-up +install -p %{SOURCE13} %{buildroot}%{_sysconfdir}/ppp/ipv6-down.initscripts +install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts install -d %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ install -p %{SOURCE10} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp @@ -164,7 +168,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_sysconfdir}/ppp/ip-up.ipv6to4 %{_sysconfdir}/ppp/ip-down.ipv6to4 %{_sysconfdir}/ppp/ipv6-up +%{_sysconfdir}/ppp/ipv6-up.initscripts %{_sysconfdir}/ppp/ipv6-down +%{_sysconfdir}/ppp/ipv6-down.initscripts %{_sysconfdir}/ppp/openssl.cnf %{_mandir}/man8/chat.8* %{_mandir}/man8/pppd.8* From 0f6bdc6ffe49833580f2c43ba308d11cf2d4db9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 14 Feb 2024 18:03:17 +0100 Subject: [PATCH 36/57] Dropped network scripts Resolves: rhbz#2262981 --- ifdown-ppp | 51 ----------------- ifup-ppp | 157 ----------------------------------------------------- ppp.spec | 25 ++------- 3 files changed, 5 insertions(+), 228 deletions(-) delete mode 100755 ifdown-ppp delete mode 100755 ifup-ppp diff --git a/ifdown-ppp b/ifdown-ppp deleted file mode 100755 index fca6463..0000000 --- a/ifdown-ppp +++ /dev/null @@ -1,51 +0,0 @@ -#! /bin/bash - -cd /etc/sysconfig/network-scripts -. ./network-functions - -CONFIG=$1 -source_config - -if [ "$TYPE" = "xDSL" ] && [ -x /usr/sbin/adsl-stop ] ; then - adsl-stop /etc/sysconfig/network-scripts/$CONFIG - exit $? -fi - -CONFIG=${CONFIG##ifcfg-} - -if [ "${DEMAND}" = "yes" ] && [ -f /var/run/ppp-${CONFIG}.pid ] ; then - PID=$(head -1 /var/run/ppp-${CONFIG}.pid) - kill -TERM ${PID} - sleep 2 - [ ! -d /proc/${PID} ] && exit 0 - sleep 5 - [ ! -d /proc/${PID} ] && exit 0 - kill -TERM ${PID} - [ ! -d /proc/${PID} ] && exit 0 - exit 1 -fi - -file=/var/run/pppwatch-${DEVICE}.pid - -if [ ! -f $file ]; then - # ppp isn't running, or we didn't start it - exit 0 -fi - -PID=$(cat $file) -[ -n "${PID}" ] || exit 1 - -kill -TERM ${PID} > /dev/null 2>&1 -[ ! -d /proc/${PID} ] && exit 0 -sleep 2 -[ ! -d /proc/${PID} ] && exit 0 -sleep 5 -[ ! -d /proc/${PID} ] && exit 0 -sleep 10 -[ ! -d /proc/${PID} ] && exit 0 - -# killing ppp-watch twice in a row causes it to send a SIGKILL to pppd pgrp -kill -TERM ${PID} > /dev/null 2>&1 -[ ! -d /proc/${PID} ] && exit 0 - -exit 1 diff --git a/ifup-ppp b/ifup-ppp deleted file mode 100755 index fb30639..0000000 --- a/ifup-ppp +++ /dev/null @@ -1,157 +0,0 @@ -#! /bin/bash - -. /etc/init.d/functions - -cd /etc/sysconfig/network-scripts -. ./network-functions - -# ifup-post for PPP is handled through /etc/ppp/ip-up -if [ "${1}" = daemon ] ; then - # we've been called from ppp-watch, so don't invoke it for persistence - shift -else - # just in case a full path to the configuration file is passed in - CONFIG=${1##*/} # CONFIG=$(basename $1) - [ -f "${CONFIG}" ] || CONFIG=ifcfg-${1} - source_config - # don't start ppp-watch by xDSL - if [ "${DEMAND}" != yes -a "$TYPE" != "xDSL" ] ; then - # let ppp-watch do the right thing - exec /sbin/ppp-watch "${CONFIG##ifcfg-}" "$2" - fi -fi - -CONFIG=$1 -[ -f "${CONFIG}" ] || CONFIG=ifcfg-${1} -source_config - -if [ -z "${DISCONNECTTIMEOUT}" ]; then - DISCONNECTTIMEOUT=2 -fi - -if [ -z "${RETRYTIMEOUT}" ]; then - RETRYTIMEOUT=30 -fi - -if [ -z "${IDLETIMEOUT}" ]; then - IDLETIMEOUT=600 -fi - -if [ "${2}" = "boot" -a "${ONBOOT}" = "no" ]; then - exit -fi - -[ -x /usr/sbin/pppd ] || { - echo $"pppd does not exist or is not executable" - echo $"ifup-ppp for ${DEVICE} exiting" - /usr/bin/logger -p daemon.info -t ifup-ppp \ - $"pppd does not exist or is not executable for ${DEVICE}" - exit 1 -} - -# check that xDSL connection -if [ "$TYPE" = "xDSL" ] ; then - if [ -x /usr/sbin/adsl-start ] ; then - adsl-start /etc/sysconfig/network-scripts/$CONFIG - exit $? - else - /usr/bin/logger -p daemon.info -t ifup-ppp \ - $"adsl-start does not exist or is not executable for ${DEVICE}" - exit 1 - fi -fi - -PEERCONF=/etc/ppp/peers/${DEVNAME} - -if [ "${DEBUG}" = "yes" ]; then - CHATDBG="-v" -fi - -if [ ! -f ${PEERCONF} ]; then - if [ -z "${WVDIALSECT}" ] ; then - CHATSCRIPT=/etc/sysconfig/network-scripts/chat-${DEVNAME} - [ -f ${CHATSCRIPT} ] || { - echo $"/etc/sysconfig/network-scripts/chat-${DEVNAME} does not exist" - echo $"ifup-ppp for ${DEVNAME} exiting" - /usr/bin/logger -p daemon.info -t ifup-ppp \ - $"/etc/sysconfig/network-scripts/chat-${DEVNAME} does not exist for ${DEVICE}" - exit 1 - } - fi - /usr/bin/logger -s -p daemon.notice -t ifup-ppp \ - $"Setting up a new ${PEERCONF} config file" - if [ -f /etc/ppp/peers/${DEVICE} ]; then - cp -f /etc/ppp/peers/${DEVICE} ${PEERCONF} - else - touch ${PEERCONF} - fi - if [ "${WVDIALSECT}" ]; then - echo "connect \"/usr/bin/wvdial --remotename ${DEVNAME} --chat '${WVDIALSECT}'\"" >> ${PEERCONF} - else - echo "connect \"/usr/sbin/chat ${CHATDBG} -f ${CHATSCRIPT}\"" >> ${PEERCONF} - fi -fi - -opts="lock" -if [ "${HARDFLOWCTL}" != no ] ; then - opts="$opts modem crtscts" -fi -if [ "${ESCAPECHARS}" != yes ] ; then - opts="$opts asyncmap 00000000" -fi -if [ "${DEFROUTE}" != no ] ; then - # pppd will no longer delete an existing default route - # so we have to help it out a little here. - DEFRT=$(ip route list match 0.0.0.0/0) - [ -n "${DEFRT}" ] && echo "$DEFRT" > /etc/default-routes - echo "$DEFRT" | while read spec; do - ip route del $spec; - done - opts="$opts defaultroute" -fi -if [ "${PEERDNS}" != no ] ; then - cp -f /etc/resolv.conf /etc/resolv.conf.save - opts="$opts usepeerdns" -fi -if [ -n "${MRU}" ] ; then - opts="$opts mru ${MRU}" -fi -if [ -n "${MTU}" ] ; then - opts="$opts mtu ${MTU}" -fi -if [ -n "${IPADDR}${REMIP}" ] ; then - # if either IP address is set, the following will work. - opts="$opts ${IPADDR}:${REMIP}" -fi -if [ -n "${PAPNAME}" ] ; then - opts="$opts user ${PAPNAME} remotename ${DEVNAME}" -fi -if [ "${DEBUG}" = yes ] ; then - opts="$opts debug" -fi - -if [ ${DEMAND} = yes ] ; then - opts="$opts demand ktune idle ${IDLETIMEOUT} holdoff ${RETRYTIMEOUT}" - exec= -else - opts="$opts nodetach" - exec=exec -fi - -/usr/bin/logger -p daemon.info -t ifup-ppp \ - $"pppd started for ${DEVNAME} on ${MODEMPORT} at ${LINESPEED}" - -$exec pppd $opts ${MODEMPORT} ${LINESPEED} \ - ipparam ${DEVNAME} linkname ${DEVNAME} call ${DEVNAME}\ - noauth \ - ${PPPOPTIONS} || exit - -if [ "${DEMAND}" = "yes" ] ; then - # pppd is a tad slow to write the pid-file. - sleep 2 - if [ -f /var/run/ppp-${DEVNAME}.pid ] ; then - REALDEVICE=$(tail -1 /var/run/ppp-${DEVNAME}.pid) - /etc/sysconfig/network-scripts/ifup-routes ${REALDEVICE} ${DEVNAME} - fi -fi - diff --git a/ppp.spec b/ppp.spec index 38a8cad..a8dbf03 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: The Point-to-Point Protocol daemon # Add licenses: # https://gitlab.com/fedora/legal/fedora-license-data/-/issues/441 @@ -41,8 +41,6 @@ Source6: ip-up Source7: ip-up.ipv6to4 Source8: ipv6-down Source9: ipv6-up -Source10: ifup-ppp -Source11: ifdown-ppp Source12: ppp-watch.tar.xz Source13: ipv6-up.initscripts Source14: ipv6-down.initscripts @@ -81,15 +79,6 @@ transmitting datagrams over serial point-to-point links. PPP is usually used to dial in to an ISP (Internet Service Provider) or other organization over a modem and phone line. -%package -n network-scripts-%{name} -Summary: PPP legacy network service support -Requires: network-scripts -Supplements: (%{name} and network-scripts) - -%description -n network-scripts-%{name} -This provides the ifup and ifdown scripts for use with the legacy network -service. - %package devel Summary: Headers for ppp plugin development Requires: %{name}%{?_isa} = %{version}-%{release} @@ -141,10 +130,6 @@ install -p %{SOURCE9} %{buildroot}%{_sysconfdir}/ppp/ipv6-up install -p %{SOURCE13} %{buildroot}%{_sysconfdir}/ppp/ipv6-down.initscripts install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts -install -d %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ -install -p %{SOURCE10} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp -install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdown-ppp - # ghosts mkdir -p %{buildroot}%{_rundir}/ppp @@ -193,16 +178,16 @@ mkdir -p %{buildroot}%{_rundir}/ppp %config(noreplace) %{_sysconfdir}/logrotate.d/ppp %{_tmpfilesdir}/ppp.conf -%files -n network-scripts-%{name} -%{_sysconfdir}/sysconfig/network-scripts/ifdown-ppp -%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp - %files devel %{_includedir}/pppd %doc PLUGINS %{_libdir}/pkgconfig/pppd.pc %changelog +* Tue Feb 13 2024 Jaroslav Škarvada - 2.5.0-6 +- Dropped network scripts + Resolves: rhbz#2262981 + * Wed Jan 24 2024 Jaroslav Škarvada - 2.5.0-5 - Converted license to SPDX From d6144dfaf9061ff160d88310c81bbc51c6be7401 Mon Sep 17 00:00:00 2001 From: Kalev Lember Date: Wed, 21 Feb 2024 11:52:37 +0100 Subject: [PATCH 37/57] Obsolete dropped network-scripts-ppp subpackage --- ppp.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index a8dbf03..97e7889 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: The Point-to-Point Protocol daemon # Add licenses: # https://gitlab.com/fedora/legal/fedora-license-data/-/issues/441 @@ -72,6 +72,9 @@ Requires: systemd Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd +# Subpackage removed and obsoleted in F40 +Obsoletes: network-scripts-ppp < %{version}-%{release} + %description The ppp package contains the PPP (Point-to-Point Protocol) daemon and documentation for PPP support. The PPP protocol provides a method for @@ -184,6 +187,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Wed Feb 21 2024 Kalev Lember - 2.5.0-7 +- Obsolete dropped network-scripts-ppp subpackage + * Tue Feb 13 2024 Jaroslav Škarvada - 2.5.0-6 - Dropped network scripts Resolves: rhbz#2262981 From 443df8f965e04c4bf52eaa21280cdbd08d58ffe0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 9 Apr 2024 16:02:23 +0200 Subject: [PATCH 38/57] Added some missing SPDX licenses MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp.spec | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/ppp.spec b/ppp.spec index 97e7889..b42b2d2 100644 --- a/ppp.spec +++ b/ppp.spec @@ -21,14 +21,8 @@ Version: 2.5.0 Release: 7%{?dist} Summary: The Point-to-Point Protocol daemon # Add licenses: -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/441 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/442 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/443 # https://gitlab.com/fedora/legal/fedora-license-data/-/issues/444 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/445 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/446 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/447 -License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later +License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag URL: http://www.samba.org/ppp Source0: https://github.com/paulusmack/ppp/archive/ppp-%{version}.tar.gz From 80279e6e879c7c06ac43a8be6409c78a6c42381e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sun, 14 Apr 2024 21:57:15 +0200 Subject: [PATCH 39/57] Added missing and recently approved SPDX licenses --- ppp.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ppp.spec b/ppp.spec index b42b2d2..a87b136 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,11 +18,9 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: The Point-to-Point Protocol daemon -# Add licenses: -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/444 -License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag +License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp Source0: https://github.com/paulusmack/ppp/archive/ppp-%{version}.tar.gz @@ -181,6 +179,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Sun Apr 14 2024 Jaroslav Škarvada - 2.5.0-8 +- Added missing and recently approved SPDX licenses + * Wed Feb 21 2024 Kalev Lember - 2.5.0-7 - Obsolete dropped network-scripts-ppp subpackage From e8892074678e5386d7046d604387a6894168e6e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 11 Apr 2024 20:12:15 +0200 Subject: [PATCH 40/57] Fix installation when %_sbindir==%_bindir --- ppp.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ppp.spec b/ppp.spec index a87b136..40b46d6 100644 --- a/ppp.spec +++ b/ppp.spec @@ -128,6 +128,10 @@ install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts # ghosts mkdir -p %{buildroot}%{_rundir}/ppp +%if "%{_sbindir}" == "%{_bindir}" +mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ +%endif + %pre /usr/bin/getent group dip >/dev/null 2>&1 || /usr/sbin/groupadd -r -g 40 dip >/dev/null 2>&1 || : From eea1551e441d12519057055422f3020936220a75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Thu, 9 May 2024 18:09:49 +0200 Subject: [PATCH 41/57] Pre-created upstream default lock dir --- ppp-tmpfiles.conf | 2 +- ppp.spec | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/ppp-tmpfiles.conf b/ppp-tmpfiles.conf index 1097cbe..a48a271 100644 --- a/ppp-tmpfiles.conf +++ b/ppp-tmpfiles.conf @@ -1 +1 @@ -d /run/ppp 0755 root root +d /run/pppd/lock 0755 root root diff --git a/ppp.spec b/ppp.spec index 40b46d6..79874ba 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 8%{?dist} +Release: 9%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -126,7 +126,7 @@ install -p %{SOURCE13} %{buildroot}%{_sysconfdir}/ppp/ipv6-down.initscripts install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts # ghosts -mkdir -p %{buildroot}%{_rundir}/ppp +mkdir -p %{buildroot}%{_rundir}/pppd/lock %if "%{_sbindir}" == "%{_bindir}" mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ @@ -165,7 +165,8 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_mandir}/man8/pppoe-discovery.8* %{_mandir}/man8/ppp-watch.8* %{_libdir}/pppd -%ghost %dir %{_rundir}/ppp +%ghost %dir %{_rundir}/pppd +%ghost %dir %{_rundir}/pppd/lock %dir %{_sysconfdir}/logrotate.d %attr(700, root, root) %dir %{_localstatedir}/log/ppp %config(noreplace) %{_sysconfdir}/ppp/eaptls-client @@ -183,6 +184,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Thu May 9 2024 Jaroslav Škarvada - 2.5.0-9 +- Pre-created upstream default lock dir + * Sun Apr 14 2024 Jaroslav Škarvada - 2.5.0-8 - Added missing and recently approved SPDX licenses From a9c63b097bd6453a15691fd238eef2b8f7c1052a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 12 Jun 2024 15:31:39 +0200 Subject: [PATCH 42/57] Openssl engine API is deprecated for a while thus disable it --- ppp.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ppp.spec b/ppp.spec index 79874ba..c7e633a 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 9%{?dist} +Release: 10%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -90,7 +90,7 @@ tar -xJf %{SOURCE12} %build autoreconf -fi export CFLAGS="%{build_cflags} -fno-strict-aliasing" -%configure --enable-systemd --enable-cbcp --with-pam +%configure --enable-systemd --enable-cbcp --with-pam --disable-openssl-engine %make_build %make_build -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" @@ -184,6 +184,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Wed Jun 12 2024 Jaroslav Škarvada - 2.5.0-10 +- Openssl engine API is deprecated for a while thus disable it + * Thu May 9 2024 Jaroslav Škarvada - 2.5.0-9 - Pre-created upstream default lock dir From 6707aaf9b1f6d789a79fd9e91200cfd80eb0c658 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 24 Jun 2024 13:53:33 +0200 Subject: [PATCH 43/57] Fixed radiusclient parser --- ppp-2.5.0-radiusclient-parser-fix.patch | 49 +++++++++++++++++++++++++ ppp.spec | 8 +++- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 ppp-2.5.0-radiusclient-parser-fix.patch diff --git a/ppp-2.5.0-radiusclient-parser-fix.patch b/ppp-2.5.0-radiusclient-parser-fix.patch new file mode 100644 index 0000000..a898e25 --- /dev/null +++ b/ppp-2.5.0-radiusclient-parser-fix.patch @@ -0,0 +1,49 @@ +From 7f89208b860ea0c41636410bfdb6a609b2772f47 Mon Sep 17 00:00:00 2001 +From: Eivind Naess +Date: Sun, 23 Apr 2023 11:37:01 -0700 +Subject: [PATCH] Closes #411, Fixing up parsing in radiusclient.conf + +Adding curly braces to fix the code. + +Signed-off-by: Eivind Naess +--- + pppd/plugins/radius/config.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/pppd/plugins/radius/config.c b/pppd/plugins/radius/config.c +index 39744fca1..e1a481487 100644 +--- a/pppd/plugins/radius/config.c ++++ b/pppd/plugins/radius/config.c +@@ -235,24 +235,28 @@ int rc_read_config(char *filename) + + switch (option->type) { + case OT_STR: +- if (set_option_str(filename, line, option, p) < 0) ++ if (set_option_str(filename, line, option, p) < 0) { + fclose(configfd); + return (-1); ++ } + break; + case OT_INT: +- if (set_option_int(filename, line, option, p) < 0) ++ if (set_option_int(filename, line, option, p) < 0) { + fclose(configfd); + return (-1); ++ } + break; + case OT_SRV: +- if (set_option_srv(filename, line, option, p) < 0) ++ if (set_option_srv(filename, line, option, p) < 0) { + fclose(configfd); + return (-1); ++ } + break; + case OT_AUO: +- if (set_option_auo(filename, line, option, p) < 0) ++ if (set_option_auo(filename, line, option, p) < 0) { + fclose(configfd); + return (-1); ++ } + break; + default: + fatal("rc_read_config: impossible case branch!"); diff --git a/ppp.spec b/ppp.spec index c7e633a..bc111db 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 10%{?dist} +Release: 11%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -40,6 +40,9 @@ Source14: ipv6-down.initscripts # Fedora-specific Patch0: ppp-2.5.0-use-change-resolv-function.patch +# https://github.com/ppp-project/ppp/commit/7f89208b860ea0c41636410bfdb6a609b2772f47 +Patch1: ppp-2.5.0-radiusclient-parser-fix.patch + BuildRequires: libtool BuildRequires: autoconf BuildRequires: automake @@ -184,6 +187,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Mon Jun 24 2024 Jaroslav Škarvada - 2.5.0-11 +- Fixed radiusclient parser + * Wed Jun 12 2024 Jaroslav Škarvada - 2.5.0-10 - Openssl engine API is deprecated for a while thus disable it From 6b4070612ff9c3456bcef69620a971f1a06a5622 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 9 Jul 2024 13:49:47 +0200 Subject: [PATCH 44/57] Rebuilt for the bin-sbin merge https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index bc111db..668f8d1 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 11%{?dist} +Release: 12%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -187,6 +187,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 2.5.0-12 +- Rebuilt for the bin-sbin merge + * Mon Jun 24 2024 Jaroslav Škarvada - 2.5.0-11 - Fixed radiusclient parser From 635ed2c4e49b0eb6d19a14f02902944455dc505c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 08:24:44 +0000 Subject: [PATCH 45/57] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 668f8d1..ed6553f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 12%{?dist} +Release: 13%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -187,6 +187,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 2.5.0-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 2.5.0-12 - Rebuilt for the bin-sbin merge From 8676c76d0b47be51e1094a9c3b0dbe7b255031f2 Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Mon, 14 Oct 2024 10:15:34 +0200 Subject: [PATCH 46/57] Update plans and gating --- gating.yaml | 12 +++++----- plans.fmf | 47 ++++++++++++++++++++++++++++++++++++++++ plans/public.fmf | 7 ------ plans/tier1-internal.fmf | 12 ---------- 4 files changed, 52 insertions(+), 26 deletions(-) create mode 100644 plans.fmf delete mode 100644 plans/public.fmf delete mode 100644 plans/tier1-internal.fmf diff --git a/gating.yaml b/gating.yaml index 285eb64..9b2646f 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,8 +4,8 @@ product_versions: decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} - + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + #Rawhide --- !Policy product_versions: @@ -13,16 +13,14 @@ product_versions: decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} - + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + #gating rhel --- !Policy product_versions: - rhel-* decision_context: osci_compose_gate rules: - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-public.functional} - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} - - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/public.functional} diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..1150d22 --- /dev/null +++ b/plans.fmf @@ -0,0 +1,47 @@ +/tier1-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/tier1/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/tier1-public: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/tier1/public + +/tier2-tier3-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/tier2-tier3/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/tier2-tier3-public: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/tier2-tier3/public + +/others-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/others/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/others-public: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/others/public diff --git a/plans/public.fmf b/plans/public.fmf deleted file mode 100644 index 78f4e0e..0000000 --- a/plans/public.fmf +++ /dev/null @@ -1,7 +0,0 @@ -summary: Test plan with all Fedora tests -discover: - how: fmf - url: https://src.fedoraproject.org/tests/ppp.git -execute: - how: tmt - diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf deleted file mode 100644 index 3447b11..0000000 --- a/plans/tier1-internal.fmf +++ /dev/null @@ -1,12 +0,0 @@ -summary: CI plan, picks internal Tier1 tests, runs in beakerlib. -discover: - - name: rhel - how: fmf - filter: 'tier: 1' - url: git://pkgs.devel.redhat.com/tests/ppp -execute: - how: tmt -adjust: - enabled: false - when: distro == centos-stream, fedora - because: They don't have access to internal repos. From 239faff36a81e2f9c125afaed45e70ba934f9d6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 09:39:34 +0100 Subject: [PATCH 47/57] New version Resolves: rhbz#2313209 New version Resolves: rhbz#2313209 --- ppp.spec | 8 ++++++-- sources | 3 +-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ppp.spec b/ppp.spec index ed6553f..dd0075d 100644 --- a/ppp.spec +++ b/ppp.spec @@ -17,8 +17,8 @@ Name: ppp # sstp-client # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. -Version: 2.5.0 -Release: 13%{?dist} +Version: 2.5.1 +Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -187,6 +187,10 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Sat Nov 16 2024 Jaroslav Škarvada - 2.5.1-1 +- New version + Resolves: rhbz#2313209 + * Fri Jul 19 2024 Fedora Release Engineering - 2.5.0-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 010a7fe..b93ac97 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (ppp-2.5.0.tar.gz) = cf62410a952053f9aa71c5179453831152e958fcad9e77df2ddac864e39aa71af0b746e54b91e8fa3ad6295d6d2b1bb736e36dc05521b495f573468679133324 -SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a +SHA512 (ppp-2.5.1.tar.gz) = 2e2a113fbb9ea1395ddde8711696e741b5ae66f5d5dc3f7d26be10bc09c605d13a972f067b7b4335f32d1f6952f5af8d59dec0cc28fa21d84664b236f0761216 From e3c470201bc6cd9fd9664df47349fe2178bbca9b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 09:45:56 +0100 Subject: [PATCH 48/57] New version Resolves: rhbz#2313209 New version Resolves: rhbz#2313209 --- sources | 1 + 1 file changed, 1 insertion(+) diff --git a/sources b/sources index b93ac97..117d746 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (ppp-2.5.1.tar.gz) = 2e2a113fbb9ea1395ddde8711696e741b5ae66f5d5dc3f7d26be10bc09c605d13a972f067b7b4335f32d1f6952f5af8d59dec0cc28fa21d84664b236f0761216 +SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a From beb7e74ce7a786a9ff1811e30678b137af620d47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 09:58:25 +0100 Subject: [PATCH 49/57] Dropped radiusclient-parser-fix patch (upstreamed) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp-2.5.0-radiusclient-parser-fix.patch | 49 ------------------------- ppp.spec | 3 -- 2 files changed, 52 deletions(-) delete mode 100644 ppp-2.5.0-radiusclient-parser-fix.patch diff --git a/ppp-2.5.0-radiusclient-parser-fix.patch b/ppp-2.5.0-radiusclient-parser-fix.patch deleted file mode 100644 index a898e25..0000000 --- a/ppp-2.5.0-radiusclient-parser-fix.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 7f89208b860ea0c41636410bfdb6a609b2772f47 Mon Sep 17 00:00:00 2001 -From: Eivind Naess -Date: Sun, 23 Apr 2023 11:37:01 -0700 -Subject: [PATCH] Closes #411, Fixing up parsing in radiusclient.conf - -Adding curly braces to fix the code. - -Signed-off-by: Eivind Naess ---- - pppd/plugins/radius/config.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/pppd/plugins/radius/config.c b/pppd/plugins/radius/config.c -index 39744fca1..e1a481487 100644 ---- a/pppd/plugins/radius/config.c -+++ b/pppd/plugins/radius/config.c -@@ -235,24 +235,28 @@ int rc_read_config(char *filename) - - switch (option->type) { - case OT_STR: -- if (set_option_str(filename, line, option, p) < 0) -+ if (set_option_str(filename, line, option, p) < 0) { - fclose(configfd); - return (-1); -+ } - break; - case OT_INT: -- if (set_option_int(filename, line, option, p) < 0) -+ if (set_option_int(filename, line, option, p) < 0) { - fclose(configfd); - return (-1); -+ } - break; - case OT_SRV: -- if (set_option_srv(filename, line, option, p) < 0) -+ if (set_option_srv(filename, line, option, p) < 0) { - fclose(configfd); - return (-1); -+ } - break; - case OT_AUO: -- if (set_option_auo(filename, line, option, p) < 0) -+ if (set_option_auo(filename, line, option, p) < 0) { - fclose(configfd); - return (-1); -+ } - break; - default: - fatal("rc_read_config: impossible case branch!"); diff --git a/ppp.spec b/ppp.spec index dd0075d..e22658a 100644 --- a/ppp.spec +++ b/ppp.spec @@ -40,9 +40,6 @@ Source14: ipv6-down.initscripts # Fedora-specific Patch0: ppp-2.5.0-use-change-resolv-function.patch -# https://github.com/ppp-project/ppp/commit/7f89208b860ea0c41636410bfdb6a609b2772f47 -Patch1: ppp-2.5.0-radiusclient-parser-fix.patch - BuildRequires: libtool BuildRequires: autoconf BuildRequires: automake From 8219d5b47f05bea6034920397cf937b52f51891e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 10:22:50 +0100 Subject: [PATCH 50/57] Fixed installation of configuration files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp.spec | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ppp.spec b/ppp.spec index e22658a..3da4aaf 100644 --- a/ppp.spec +++ b/ppp.spec @@ -128,6 +128,14 @@ install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts # ghosts mkdir -p %{buildroot}%{_rundir}/pppd/lock +# fix configuration files suffix +pushd %{buildroot}%{_sysconfdir}/ppp +for f in `ls *.example` +do + mv "$f" "${f%%.example} +done +popd + %if "%{_sbindir}" == "%{_bindir}" mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %endif From bd1d1479325c6964592ecc29bf10dfdbef56474d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 11:09:22 +0100 Subject: [PATCH 51/57] Fixed spec MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 3da4aaf..9c371c4 100644 --- a/ppp.spec +++ b/ppp.spec @@ -132,7 +132,7 @@ mkdir -p %{buildroot}%{_rundir}/pppd/lock pushd %{buildroot}%{_sysconfdir}/ppp for f in `ls *.example` do - mv "$f" "${f%%.example} + mv "$f" "${f%%.example}" done popd From 19a05d6af61664c3c65ae66a557f33fe4dbb9e78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:39:58 +0100 Subject: [PATCH 52/57] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 9c371c4..d431a0b 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -192,6 +192,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 2.5.1-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Sat Nov 16 2024 Jaroslav Škarvada - 2.5.1-1 - New version Resolves: rhbz#2313209 From b854e546bbaa42594ea206259fbf073292489959 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 10:44:02 +0000 Subject: [PATCH 53/57] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index d431a0b..cbd0167 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -192,6 +192,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 2.5.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 2.5.1-2 - Rebuilt for the bin-sbin merge (2nd attempt) From dadb2d4d98a578f393f91536c04cdf6c93a57224 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:56:45 +0100 Subject: [PATCH 54/57] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- ppp.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index cbd0167..6086f25 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -51,6 +51,7 @@ BuildRequires: systemd BuildRequires: systemd-devel BuildRequires: glib2-devel BuildRequires: openssl-devel +BuildRequires: libxcrypt-devel %if %{defined rhel} Provides: bundled(linux-atm) = 2.4.1 %else @@ -192,6 +193,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Sat Feb 01 2025 Björn Esser - 2.5.1-4 +- Add explicit BR: libxcrypt-devel + * Sat Jan 18 2025 Fedora Release Engineering - 2.5.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 2e02872e926609aa240359830bc9bfe7d7277aba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 16:44:31 +0100 Subject: [PATCH 55/57] Add sysusers.d config file to allow rpm to create users/groups automatically See https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers. --- ppp.spec | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/ppp.spec b/ppp.spec index 6086f25..1fa0bbc 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 4%{?dist} +Release: 5%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -62,8 +62,6 @@ Requires: glibc >= 2.0.6 Requires: /etc/pam.d/system-auth Requires: libpcap >= 14:0.8.3-6 Requires: systemd -Requires(pre): /usr/bin/getent -Requires(pre): /usr/sbin/groupadd # Subpackage removed and obsoleted in F40 Obsoletes: network-scripts-ppp < %{version}-%{release} @@ -88,6 +86,11 @@ This package contains the header files for building plugins for ppp. tar -xJf %{SOURCE12} +# Create a sysusers.d config file +cat >ppp.sysusers.conf </dev/null 2>&1 || /usr/sbin/groupadd -r -g 40 dip >/dev/null 2>&1 || : +install -m0644 -D ppp.sysusers.conf %{buildroot}%{_sysusersdir}/ppp.conf + %post %tmpfiles_create ppp.conf @@ -186,6 +189,7 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %config(noreplace) %{_sysconfdir}/pam.d/ppp %config(noreplace) %{_sysconfdir}/logrotate.d/ppp %{_tmpfilesdir}/ppp.conf +%{_sysusersdir}/ppp.conf %files devel %{_includedir}/pppd @@ -193,6 +197,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.5.1-5 +- Add sysusers.d config file to allow rpm to create users/groups automatically + * Sat Feb 01 2025 Björn Esser - 2.5.1-4 - Add explicit BR: libxcrypt-devel From 055f5683fd0028789391e47c1da866685b2189ee Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 25 Feb 2025 00:04:47 -0500 Subject: [PATCH 56/57] Fix build with GCC 15 --- ppp-2.5.1-gcc15.patch | 58 +++++++++++++++++++++++++++++++++++++++++++ ppp.spec | 2 ++ 2 files changed, 60 insertions(+) create mode 100644 ppp-2.5.1-gcc15.patch diff --git a/ppp-2.5.1-gcc15.patch b/ppp-2.5.1-gcc15.patch new file mode 100644 index 0000000..5f13bc9 --- /dev/null +++ b/ppp-2.5.1-gcc15.patch @@ -0,0 +1,58 @@ +Fix build with GCC 15 + +GCC 15 defaults to C23 which does not allow K&R declarations. + +diff --git a/pppdump/pppdump.c b/pppdump/pppdump.c +index 16a5ffb..5708177 100644 +--- a/pppdump/pppdump.c ++++ b/pppdump/pppdump.c +@@ -51,14 +51,12 @@ int tot_sent, tot_rcvd; + extern int optind; + extern char *optarg; + +-void dumplog(); +-void dumpppp(); +-void show_time(); ++void dumplog(FILE *); ++void dumpppp(FILE *); ++void show_time(FILE *, int); + + int +-main(ac, av) +- int ac; +- char **av; ++main(int ac, char **av) + { + int i; + char *p; +@@ -106,8 +104,7 @@ main(ac, av) + } + + void +-dumplog(f) +- FILE *f; ++dumplog(FILE *f) + { + int c, n, k, col; + int nb, c2; +@@ -250,8 +247,7 @@ struct pkt { + unsigned char dbuf[8192]; + + void +-dumpppp(f) +- FILE *f; ++dumpppp(FILE *f) + { + int c, n, k; + int nb, nl, dn, proto, rv; +@@ -384,9 +380,7 @@ dumpppp(f) + } + + void +-show_time(f, c) +- FILE *f; +- int c; ++show_time(FILE *f, int c) + { + time_t t; + int n; diff --git a/ppp.spec b/ppp.spec index 1fa0bbc..d157c43 100644 --- a/ppp.spec +++ b/ppp.spec @@ -39,6 +39,8 @@ Source14: ipv6-down.initscripts # Fedora-specific Patch0: ppp-2.5.0-use-change-resolv-function.patch +# Fix build with GCC 15 +Patch1: ppp-2.5.1-gcc15.patch BuildRequires: libtool BuildRequires: autoconf From baad7a85acc667d45e0ad2a5ab0981a34946a03d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 06:07:04 +0000 Subject: [PATCH 57/57] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index d157c43..cdceb10 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 5%{?dist} +Release: 6%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -199,6 +199,9 @@ install -m0644 -D ppp.sysusers.conf %{buildroot}%{_sysusersdir}/ppp.conf %{_libdir}/pkgconfig/pppd.pc %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 2.5.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.5.1-5 - Add sysusers.d config file to allow rpm to create users/groups automatically