From ebcb6e8d2dfdb1400782bb3d61165a9d433f941d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 21 Aug 2017 22:00:47 +0200 Subject: [PATCH 01/76] EAP-TLS patch updated to version 0.999 Switched to openssl-1.1 --- ...ch => 0027-pppd-EAP-TLS-patch-v0.999.patch | 450 ++++++++++-------- ...xpression-in-eap_client_active-macro.patch | 27 -- ...clude-netinet-in.h-before-linux-in.h.patch | 0 ppp.spec | 13 +- 4 files changed, 248 insertions(+), 242 deletions(-) rename 0027-pppd-EAP-TLS-patch-v0.997.patch => 0027-pppd-EAP-TLS-patch-v0.999.patch (89%) delete mode 100644 0028-Fix-logical-expression-in-eap_client_active-macro.patch rename 0029-pppoe-include-netinet-in.h-before-linux-in.h.patch => 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch (100%) diff --git a/0027-pppd-EAP-TLS-patch-v0.997.patch b/0027-pppd-EAP-TLS-patch-v0.999.patch similarity index 89% rename from 0027-pppd-EAP-TLS-patch-v0.997.patch rename to 0027-pppd-EAP-TLS-patch-v0.999.patch index 79ef893..2f71a8e 100644 --- a/0027-pppd-EAP-TLS-patch-v0.997.patch +++ b/0027-pppd-EAP-TLS-patch-v0.999.patch @@ -1,44 +1,6 @@ -From 7887b3d84468e1ebfbe5adc373f0816eda2b995a Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 20 Jun 2014 10:31:43 +0200 -Subject: [PATCH 27/27] pppd: EAP-TLS patch v0.997 - -See: http://www.nikhef.nl/~janjust/ppp/download.html ---- - README.eap-tls | 280 ++++++++++ - etc.ppp/eaptls-client | 10 + - etc.ppp/eaptls-server | 11 + - etc.ppp/openssl.cnf | 14 + - linux/Makefile.top | 6 +- - pppd/Makefile.linux | 12 + - pppd/auth.c | 413 ++++++++++++++- - pppd/ccp.c | 20 +- - pppd/chap-md5.c | 4 + - pppd/eap-tls.c | 1212 +++++++++++++++++++++++++++++++++++++++++++ - pppd/eap-tls.h | 107 ++++ - pppd/eap.c | 449 +++++++++++++++- - pppd/eap.h | 32 +- - pppd/md5.c | 4 + - pppd/md5.h | 3 + - pppd/pathnames.h | 7 + - pppd/plugins/Makefile.linux | 3 + - pppd/plugins/passprompt.c | 3 + - pppd/plugins/passwordfd.c | 4 + - pppd/pppd.8 | 33 ++ - pppd/pppd.h | 9 + - 21 files changed, 2629 insertions(+), 7 deletions(-) - create mode 100644 README.eap-tls - create mode 100644 etc.ppp/eaptls-client - create mode 100644 etc.ppp/eaptls-server - create mode 100644 etc.ppp/openssl.cnf - create mode 100644 pppd/eap-tls.c - create mode 100644 pppd/eap-tls.h - -diff --git a/README.eap-tls b/README.eap-tls -new file mode 100644 -index 0000000..037be0a ---- /dev/null -+++ b/README.eap-tls +diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-0.999/README.eap-tls +--- ppp-2.4.7/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.7-eaptls-mppe-0.999/README.eap-tls 2017-05-09 14:38:55.129084488 +0200 @@ -0,0 +1,280 @@ +EAP-TLS authentication support for PPP +====================================== @@ -320,11 +282,9 @@ index 0000000..037be0a + - change SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET + - fix bug in initialisation code with fragmented packets. + -diff --git a/etc.ppp/eaptls-client b/etc.ppp/eaptls-client -new file mode 100644 -index 0000000..7782f0e ---- /dev/null -+++ b/etc.ppp/eaptls-client +diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/eaptls-client +--- ppp-2.4.7/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/eaptls-client 2017-05-09 14:38:55.129084488 +0200 @@ -0,0 +1,10 @@ +# Parameters for authentication using EAP-TLS (client) + @@ -336,11 +296,9 @@ index 0000000..7782f0e +# client private key file (required) + +#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff --git a/etc.ppp/eaptls-server b/etc.ppp/eaptls-server -new file mode 100644 -index 0000000..fa53cbd ---- /dev/null -+++ b/etc.ppp/eaptls-server +diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/eaptls-server +--- ppp-2.4.7/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/eaptls-server 2017-05-09 14:38:55.137084099 +0200 @@ -0,0 +1,11 @@ +# Parameters for authentication using EAP-TLS (server) + @@ -353,11 +311,9 @@ index 0000000..fa53cbd +# allowed addresses (required, can be *) + +#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff --git a/etc.ppp/openssl.cnf b/etc.ppp/openssl.cnf -new file mode 100644 -index 0000000..dd32f30 ---- /dev/null -+++ b/etc.ppp/openssl.cnf +diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/openssl.cnf +--- ppp-2.4.7/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/openssl.cnf 2017-05-09 14:38:55.137084099 +0200 @@ -0,0 +1,14 @@ +openssl_conf = openssl_def + @@ -373,11 +329,10 @@ index 0000000..dd32f30 +MODULE_PATH = /usr/lib64/libeTPkcs11.so +init = 0 + -diff --git a/linux/Makefile.top b/linux/Makefile.top -index f42efd5..9a8945a 100644 ---- a/linux/Makefile.top -+++ b/linux/Makefile.top -@@ -28,7 +28,7 @@ install-progs: +diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-0.999/linux/Makefile.top +--- ppp-2.4.7/linux/Makefile.top 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/linux/Makefile.top 2017-05-09 14:38:55.138084052 +0200 +@@ -26,7 +26,7 @@ cd pppdump; $(MAKE) $(MFLAGS) install install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ @@ -386,7 +341,7 @@ index f42efd5..9a8945a 100644 install-devel: cd pppd; $(MAKE) $(MFLAGS) install-devel -@@ -39,6 +39,10 @@ $(ETCDIR)/pap-secrets: +@@ -37,6 +37,10 @@ $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ $(ETCDIR)/chap-secrets: $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ @@ -397,11 +352,10 @@ index f42efd5..9a8945a 100644 $(BINDIR): $(INSTALL) -d -m 755 $@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 943cf83..534ccc2 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -79,6 +79,9 @@ CBCP=y +diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-0.999/pppd/Makefile.linux +--- ppp-2.4.7/pppd/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/Makefile.linux 2017-05-09 14:38:55.138084052 +0200 +@@ -76,6 +76,9 @@ # Use libutil USE_LIBUTIL=y @@ -411,7 +365,7 @@ index 943cf83..534ccc2 100644 MAXOCTETS=y INCLUDE_DIRS= -I../include -@@ -118,6 +121,15 @@ HEADERS += sha1.h +@@ -115,6 +118,15 @@ PPPDOBJS += sha1.o endif @@ -427,10 +381,9 @@ index 943cf83..534ccc2 100644 ifdef HAS_SHADOW CFLAGS += -DHAS_SHADOW #LIBS += -lshadow $(LIBS) -diff --git a/pppd/auth.c b/pppd/auth.c -index 9e957fa..656ffe9 100644 ---- a/pppd/auth.c -+++ b/pppd/auth.c +diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-0.999/pppd/auth.c +--- ppp-2.4.7/pppd/auth.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/auth.c 2017-05-09 14:38:55.139084004 +0200 @@ -109,6 +109,9 @@ #include "upap.h" #include "chap-new.h" @@ -441,7 +394,7 @@ index 9e957fa..656ffe9 100644 #ifdef CBCP_SUPPORT #include "cbcp.h" #endif -@@ -183,6 +186,11 @@ int (*chap_check_hook) __P((void)) = NULL; +@@ -183,6 +186,11 @@ /* Hook for a plugin to get the CHAP password for authenticating us */ int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; @@ -453,7 +406,7 @@ index 9e957fa..656ffe9 100644 /* Hook for a plugin to say whether it is OK if the peer refuses to authenticate. */ int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -238,6 +246,14 @@ bool explicit_remote = 0; /* User specified explicit remote name */ +@@ -238,6 +246,14 @@ bool explicit_user = 0; /* Set if "user" option supplied */ bool explicit_passwd = 0; /* Set if "password" option supplied */ char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ @@ -468,7 +421,7 @@ index 9e957fa..656ffe9 100644 static char *uafname; /* name of most recent +ua file */ -@@ -254,6 +270,19 @@ static int have_pap_secret __P((int *)); +@@ -254,6 +270,19 @@ static int have_chap_secret __P((char *, char *, int, int *)); static int have_srp_secret __P((char *client, char *server, int need_ip, int *lacks_ipp)); @@ -488,7 +441,7 @@ index 9e957fa..656ffe9 100644 static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); static int scan_authfile __P((FILE *, char *, char *, char *, struct wordlist **, struct wordlist **, -@@ -401,6 +430,15 @@ option_t auth_options[] = { +@@ -401,6 +430,15 @@ "Set telephone number(s) which are allowed to connect", OPT_PRIV | OPT_A2LIST }, @@ -504,7 +457,7 @@ index 9e957fa..656ffe9 100644 { NULL } }; -@@ -730,6 +768,9 @@ link_established(unit) +@@ -730,6 +768,9 @@ lcp_options *wo = &lcp_wantoptions[unit]; lcp_options *go = &lcp_gotoptions[unit]; lcp_options *ho = &lcp_hisoptions[unit]; @@ -514,7 +467,7 @@ index 9e957fa..656ffe9 100644 int i; struct protent *protp; -@@ -764,6 +805,22 @@ link_established(unit) +@@ -764,6 +805,22 @@ } } @@ -537,7 +490,7 @@ index 9e957fa..656ffe9 100644 new_phase(PHASE_AUTHENTICATE); auth = 0; if (go->neg_eap) { -@@ -1277,6 +1334,15 @@ auth_check_options() +@@ -1277,6 +1334,15 @@ our_name, 1, &lacks_ip); } @@ -553,7 +506,7 @@ index 9e957fa..656ffe9 100644 if (auth_required && !can_auth && noauth_addrs == NULL) { if (default_auth) { option_error( -@@ -1331,7 +1397,11 @@ auth_reset(unit) +@@ -1331,7 +1397,11 @@ passwd[0] != 0 || (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, (explicit_remote? remote_name: NULL), 0, NULL))) || @@ -566,7 +519,7 @@ index 9e957fa..656ffe9 100644 hadchap = -1; if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1346,8 +1416,14 @@ auth_reset(unit) +@@ -1346,8 +1416,14 @@ !have_chap_secret((explicit_remote? remote_name: NULL), our_name, 1, NULL))) && !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, @@ -582,7 +535,7 @@ index 9e957fa..656ffe9 100644 } -@@ -1707,6 +1783,7 @@ have_srp_secret(client, server, need_ip, lacks_ipp) +@@ -1707,6 +1783,7 @@ } @@ -590,7 +543,7 @@ index 9e957fa..656ffe9 100644 /* * get_secret - open the CHAP secret file and return the secret * for authenticating the given client on the given server. -@@ -2359,3 +2436,335 @@ auth_script(script) +@@ -2359,3 +2436,335 @@ auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); } @@ -926,11 +879,10 @@ index 9e957fa..656ffe9 100644 +} +#endif + -diff --git a/pppd/ccp.c b/pppd/ccp.c -index 5814f35..7dead23 100644 ---- a/pppd/ccp.c -+++ b/pppd/ccp.c -@@ -540,6 +540,9 @@ ccp_resetci(f) +diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-0.999/pppd/ccp.c +--- ppp-2.4.7/pppd/ccp.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/ccp.c 2017-05-09 14:38:55.148083482 +0200 +@@ -540,6 +540,9 @@ if (go->mppe) { ccp_options *ao = &ccp_allowoptions[f->unit]; int auth_mschap_bits = auth_done[f->unit]; @@ -940,7 +892,7 @@ index 5814f35..7dead23 100644 int numbits; /* -@@ -567,8 +570,23 @@ ccp_resetci(f) +@@ -567,8 +570,23 @@ lcp_close(f->unit, "MPPE required but not available"); return; } @@ -965,10 +917,9 @@ index 5814f35..7dead23 100644 lcp_close(f->unit, "MPPE required but not available"); return; } -diff --git a/pppd/chap-md5.c b/pppd/chap-md5.c -index 77dd4ec..269b52c 100644 ---- a/pppd/chap-md5.c -+++ b/pppd/chap-md5.c +diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-0.999/pppd/chap-md5.c +--- ppp-2.4.7/pppd/chap-md5.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/chap-md5.c 2017-05-09 14:38:55.148083482 +0200 @@ -36,7 +36,11 @@ #include "chap-new.h" #include "chap-md5.h" @@ -981,12 +932,10 @@ index 77dd4ec..269b52c 100644 #define MD5_HASH_SIZE 16 #define MD5_MIN_CHALLENGE 16 -diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c -new file mode 100644 -index 0000000..edcb0cb ---- /dev/null -+++ b/pppd/eap-tls.c -@@ -0,0 +1,1212 @@ +diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c +--- ppp-2.4.7/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c 2017-05-11 10:43:00.345739124 +0200 +@@ -0,0 +1,1308 @@ +/* + * eap-tls.c - EAP-TLS implementation for PPP + * @@ -1044,6 +993,72 @@ index 0000000..edcb0cb + +#ifdef MPPE + ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++ ++/* ++ * https://wiki.openssl.org/index.php/1.1_API_Changes ++ * tries to provide some guidance but ultimately falls short. ++ */ ++ ++static void HMAC_CTX_free(HMAC_CTX *ctx) ++{ ++ if (ctx != NULL) { ++ HMAC_CTX_cleanup(ctx); ++ OPENSSL_free(ctx); ++ } ++} ++ ++static HMAC_CTX *HMAC_CTX_new(void) ++{ ++ HMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx)); ++ if (ctx != NULL) ++ HMAC_CTX_init(ctx); ++ return ctx; ++} ++ ++/* ++ * These were basically jacked directly from the OpenSSL tree ++ * without adjustments. ++ */ ++ ++static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, ++ size_t outlen) ++{ ++ if (outlen == 0) ++ return sizeof(ssl->s3->client_random); ++ if (outlen > sizeof(ssl->s3->client_random)) ++ outlen = sizeof(ssl->s3->client_random); ++ memcpy(out, ssl->s3->client_random, outlen); ++ return outlen; ++} ++ ++static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, ++ size_t outlen) ++{ ++ if (outlen == 0) ++ return sizeof(ssl->s3->server_random); ++ if (outlen > sizeof(ssl->s3->server_random)) ++ outlen = sizeof(ssl->s3->server_random); ++ memcpy(out, ssl->s3->server_random, outlen); ++ return outlen; ++} ++ ++static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, ++ unsigned char *out, size_t outlen) ++{ ++ if (outlen == 0) ++ return session->master_key_length; ++ if (outlen > session->master_key_length) ++ outlen = session->master_key_length; ++ memcpy(out, session->master_key, outlen); ++ return outlen; ++} ++ ++/* Avoid a deprecated warning in OpenSSL 1.1 whilst still allowing to build against 1.0.x */ ++#define TLS_method TLSv1_method ++ ++#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ ++ +/* + * TLS PRF from RFC 2246 + */ @@ -1052,47 +1067,47 @@ index 0000000..edcb0cb + const unsigned char *seed, unsigned int seed_len, + unsigned char *out, unsigned int out_len) +{ -+ HMAC_CTX ctx_a, ctx_out; ++ HMAC_CTX *ctx_a, *ctx_out; + unsigned char a[HMAC_MAX_MD_CBLOCK]; + unsigned int size; + -+ HMAC_CTX_init(&ctx_a); -+ HMAC_CTX_init(&ctx_out); -+ HMAC_Init_ex(&ctx_a, secret, secret_len, evp_md, NULL); -+ HMAC_Init_ex(&ctx_out, secret, secret_len, evp_md, NULL); ++ ctx_a = HMAC_CTX_new(); ++ ctx_out = HMAC_CTX_new(); ++ HMAC_Init_ex(ctx_a, secret, secret_len, evp_md, NULL); ++ HMAC_Init_ex(ctx_out, secret, secret_len, evp_md, NULL); + -+ size = HMAC_size(&ctx_out); ++ size = HMAC_size(ctx_out); + + /* Calculate A(1) */ -+ HMAC_Update(&ctx_a, seed, seed_len); -+ HMAC_Final(&ctx_a, a, NULL); ++ HMAC_Update(ctx_a, seed, seed_len); ++ HMAC_Final(ctx_a, a, NULL); + + while (1) { + /* Calculate next part of output */ -+ HMAC_Update(&ctx_out, a, size); -+ HMAC_Update(&ctx_out, seed, seed_len); ++ HMAC_Update(ctx_out, a, size); ++ HMAC_Update(ctx_out, seed, seed_len); + + /* Check if last part */ + if (out_len < size) { -+ HMAC_Final(&ctx_out, a, NULL); ++ HMAC_Final(ctx_out, a, NULL); + memcpy(out, a, out_len); + break; + } + + /* Place digest in output buffer */ -+ HMAC_Final(&ctx_out, out, NULL); -+ HMAC_Init_ex(&ctx_out, NULL, 0, NULL, NULL); ++ HMAC_Final(ctx_out, out, NULL); ++ HMAC_Init_ex(ctx_out, NULL, 0, NULL, NULL); + out += size; + out_len -= size; + + /* Calculate next A(i) */ -+ HMAC_Init_ex(&ctx_a, NULL, 0, NULL, NULL); -+ HMAC_Update(&ctx_a, a, size); -+ HMAC_Final(&ctx_a, a, NULL); ++ HMAC_Init_ex(ctx_a, NULL, 0, NULL, NULL); ++ HMAC_Update(ctx_a, a, size); ++ HMAC_Final(ctx_a, a, NULL); + } + -+ HMAC_CTX_cleanup(&ctx_a); -+ HMAC_CTX_cleanup(&ctx_out); ++ HMAC_CTX_free(ctx_a); ++ HMAC_CTX_free(ctx_out); + memset(a, 0, sizeof(a)); +} + @@ -1126,21 +1141,22 @@ index 0000000..edcb0cb + unsigned char *p = seed; + SSL *s = ets->ssl; + size_t prf_size; ++ unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH]; ++ size_t master_key_length; + + prf_size = strlen(prf_label); + + memcpy(p, prf_label, prf_size); + p += prf_size; + -+ memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); ++ prf_size += SSL_get_client_random(s, p, SSL3_RANDOM_SIZE); + p += SSL3_RANDOM_SIZE; -+ prf_size += SSL3_RANDOM_SIZE; + -+ memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE); -+ prf_size += SSL3_RANDOM_SIZE; ++ prf_size += SSL_get_server_random(s, p, SSL3_RANDOM_SIZE); + -+ PRF(s->session->master_key, s->session->master_key_length, -+ seed, prf_size, out, buf, sizeof(out)); ++ master_key_length = SSL_SESSION_get_master_key(SSL_get_session(s), master_key, ++ sizeof(master_key)); ++ PRF(master_key, master_key_length, seed, prf_size, out, buf, sizeof(out)); + + /* + * We now have the master send and receive keys. @@ -1308,7 +1324,7 @@ index 0000000..edcb0cb + SSL_library_init(); + SSL_load_error_strings(); + -+ ctx = SSL_CTX_new(TLSv1_method()); ++ ctx = SSL_CTX_new(TLS_method()); + + if (!ctx) { + error("EAP-TLS: Cannot initialize SSL CTX context"); @@ -2112,18 +2128,47 @@ index 0000000..edcb0cb + char string[256]; + struct eaptls_session *ets = (struct eaptls_session *)arg; + unsigned char code; ++ const unsigned char*msg = buf; ++ int hvers = msg[1] << 8 | msg[2]; + + if(write_p) + strcpy(string, " -> "); + else + strcpy(string, " <- "); + -+ + switch(content_type) { + ++#if OPENSSL_VERSION_NUMBER >= 0x10100000L ++ case SSL3_RT_HEADER: ++ strcat(string, "SSL/TLS Header: "); ++ switch(hvers) { ++ case SSL3_VERSION: ++ strcat(string, "SSL 3.0"); ++ break; ++ case TLS1_VERSION: ++ strcat(string, "TLS 1.0"); ++ break; ++ case TLS1_1_VERSION: ++ strcat(string, "TLS 1.1"); ++ break; ++ case TLS1_2_VERSION: ++ strcat(string, "TLS 1.2"); ++ break; ++ case DTLS1_VERSION: ++ strcat(string, "DTLS 1.0"); ++ break; ++ case DTLS1_2_VERSION: ++ strcat(string, "DTLS 1.2"); ++ break; ++ default: ++ strcat(string, "Unknown version"); ++ } ++ break; ++#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */ ++ + case SSL3_RT_ALERT: + strcat(string, "Alert: "); -+ code = ((const unsigned char *)buf)[1]; ++ code = msg[1]; + + if (write_p) { + ets->alert_sent = 1; @@ -2143,7 +2188,7 @@ index 0000000..edcb0cb + case SSL3_RT_HANDSHAKE: + + strcat(string, "Handshake: "); -+ code = ((const unsigned char *)buf)[0]; ++ code = msg[0]; + + switch(code) { + case SSL3_MT_HELLO_REQUEST: @@ -2199,11 +2244,9 @@ index 0000000..edcb0cb + dbglog("%s", string); +} + -diff --git a/pppd/eap-tls.h b/pppd/eap-tls.h -new file mode 100644 -index 0000000..2d45a0b ---- /dev/null -+++ b/pppd/eap-tls.h +diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.h +--- ppp-2.4.7/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.h 2017-05-09 14:38:55.150083347 +0200 @@ -0,0 +1,107 @@ +/* + * eap-tls.h @@ -2312,10 +2355,9 @@ index 0000000..2d45a0b +#endif + +#endif -diff --git a/pppd/eap.c b/pppd/eap.c -index faced53..bfbce95 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c +diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c +--- ppp-2.4.7/pppd/eap.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c 2017-05-09 14:38:55.151083274 +0200 @@ -43,6 +43,11 @@ * Based on draft-ietf-pppext-eap-srp-03.txt. */ @@ -2342,7 +2384,7 @@ index faced53..bfbce95 100644 #ifdef USE_SRP #include -@@ -209,6 +218,9 @@ int unit; +@@ -209,6 +218,9 @@ esp->es_server.ea_id = (u_char)(drand48() * 0x100); esp->es_client.ea_timeout = EAP_DEFREQTIME; esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; @@ -2352,7 +2394,7 @@ index faced53..bfbce95 100644 } /* -@@ -436,8 +448,16 @@ int status; +@@ -436,8 +448,16 @@ u_char vals[2]; struct b64state bs; #endif /* USE_SRP */ @@ -2369,7 +2411,7 @@ index faced53..bfbce95 100644 switch (esp->es_server.ea_state) { case eapBadAuth: return; -@@ -562,9 +582,79 @@ int status; +@@ -562,9 +582,79 @@ break; } #endif /* USE_SRP */ @@ -2449,7 +2491,7 @@ index faced53..bfbce95 100644 case eapSRP1: #ifdef USE_SRP ts = (struct t_server *)esp->es_server.ea_session; -@@ -718,6 +808,30 @@ eap_state *esp; +@@ -718,6 +808,30 @@ INCPTR(esp->es_server.ea_namelen, outp); break; @@ -2480,7 +2522,7 @@ index faced53..bfbce95 100644 #ifdef USE_SRP case eapSRP1: PUTCHAR(EAPT_SRP, outp); -@@ -904,11 +1018,57 @@ static void +@@ -904,11 +1018,57 @@ eap_server_timeout(arg) void *arg; { @@ -2538,7 +2580,7 @@ index faced53..bfbce95 100644 /* EAP ID number must not change on timeout. */ eap_send_request(esp); } -@@ -1166,6 +1326,81 @@ u_char *str; +@@ -1166,6 +1326,81 @@ } #endif /* USE_SRP */ @@ -2620,7 +2662,7 @@ index faced53..bfbce95 100644 static void eap_send_nak(esp, id, type) eap_state *esp; -@@ -1320,6 +1555,11 @@ int len; +@@ -1320,6 +1555,11 @@ char rhostname[256]; MD5_CTX mdContext; u_char hash[MD5_SIGNATURE_SIZE]; @@ -2632,7 +2674,7 @@ index faced53..bfbce95 100644 #ifdef USE_SRP struct t_client *tc; struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1456,6 +1696,90 @@ int len; +@@ -1456,6 +1696,90 @@ esp->es_client.ea_namelen); break; @@ -2723,7 +2765,7 @@ index faced53..bfbce95 100644 #ifdef USE_SRP case EAPT_SRP: if (len < 1) { -@@ -1737,6 +2061,11 @@ int len; +@@ -1737,6 +2061,11 @@ u_char dig[SHA_DIGESTSIZE]; #endif /* USE_SRP */ @@ -2735,7 +2777,7 @@ index faced53..bfbce95 100644 if (esp->es_server.ea_id != id) { dbglog("EAP: discarding Response %d; expected ID %d", id, esp->es_server.ea_id); -@@ -1776,6 +2105,60 @@ int len; +@@ -1776,6 +2105,60 @@ eap_figure_next_state(esp, 0); break; @@ -2796,7 +2838,7 @@ index faced53..bfbce95 100644 case EAPT_NOTIFICATION: dbglog("EAP unexpected Notification; response discarded"); break; -@@ -1807,6 +2190,13 @@ int len; +@@ -1807,6 +2190,13 @@ esp->es_server.ea_state = eapMD5Chall; break; @@ -2810,7 +2852,7 @@ index faced53..bfbce95 100644 default: dbglog("EAP: peer requesting unknown Type %d", vallen); switch (esp->es_server.ea_state) { -@@ -2018,13 +2408,27 @@ u_char *inp; +@@ -2018,13 +2408,27 @@ int id; int len; { @@ -2839,7 +2881,7 @@ index faced53..bfbce95 100644 if (esp->es_client.ea_timeout > 0) { UNTIMEOUT(eap_client_timeout, (void *)esp); } -@@ -2150,6 +2554,9 @@ void *arg; +@@ -2150,6 +2554,9 @@ int code, id, len, rtype, vallen; u_char *pstart; u_int32_t uval; @@ -2849,7 +2891,7 @@ index faced53..bfbce95 100644 if (inlen < EAP_HEADERLEN) return (0); -@@ -2214,6 +2621,24 @@ void *arg; +@@ -2214,6 +2621,24 @@ } break; @@ -2874,7 +2916,7 @@ index faced53..bfbce95 100644 case EAPT_SRP: if (len < 3) goto truncated; -@@ -2325,6 +2750,25 @@ void *arg; +@@ -2325,6 +2750,25 @@ } break; @@ -2900,16 +2942,15 @@ index faced53..bfbce95 100644 case EAPT_NAK: if (len <= 0) { printer(arg, " "); -@@ -2426,3 +2870,4 @@ void *arg; +@@ -2426,3 +2870,4 @@ return (inp - pstart); } + -diff --git a/pppd/eap.h b/pppd/eap.h -index 199d184..3fa5391 100644 ---- a/pppd/eap.h -+++ b/pppd/eap.h -@@ -84,6 +84,16 @@ enum eap_state_code { +diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.h +--- ppp-2.4.7/pppd/eap.h 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.h 2017-05-09 14:38:55.152083200 +0200 +@@ -84,6 +84,16 @@ eapClosed, /* Authentication not in use */ eapListen, /* Client ready (and timer running) */ eapIdentify, /* EAP Identify sent */ @@ -2926,7 +2967,7 @@ index 199d184..3fa5391 100644 eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ -@@ -95,9 +105,18 @@ enum eap_state_code { +@@ -95,9 +105,18 @@ #define EAP_STATES \ "Initial", "Pending", "Closed", "Listen", "Identify", \ @@ -2936,8 +2977,8 @@ index 199d184..3fa5391 100644 -#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) +#ifdef USE_EAPTLS -+#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial ||\ -+ (esp)->es_client.ea_state != eapPending ||\ ++#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial &&\ ++ (esp)->es_client.ea_state != eapPending &&\ + (esp)->es_client.ea_state != eapClosed) +#else +#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) @@ -2946,7 +2987,7 @@ index 199d184..3fa5391 100644 #define eap_server_active(esp) \ ((esp)->es_server.ea_state >= eapIdentify && \ (esp)->es_server.ea_state <= eapMD5Chall) -@@ -112,11 +131,17 @@ struct eap_auth { +@@ -112,11 +131,17 @@ u_short ea_namelen; /* Length of our name */ u_short ea_peerlen; /* Length of peer's name */ enum eap_state_code ea_state; @@ -2964,7 +3005,7 @@ index 199d184..3fa5391 100644 }; /* -@@ -139,7 +164,12 @@ typedef struct eap_state { +@@ -139,7 +164,12 @@ * Timeouts. */ #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ @@ -2977,10 +3018,9 @@ index 199d184..3fa5391 100644 #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ -diff --git a/pppd/md5.c b/pppd/md5.c -index f1291ce..6f8f720 100644 ---- a/pppd/md5.c -+++ b/pppd/md5.c +diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.c +--- ppp-2.4.7/pppd/md5.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.c 2017-05-09 14:38:55.152083200 +0200 @@ -33,6 +33,8 @@ *********************************************************************** */ @@ -2990,16 +3030,15 @@ index f1291ce..6f8f720 100644 #include #include "md5.h" -@@ -305,3 +307,5 @@ UINT4 *in; +@@ -305,3 +307,5 @@ ** End of md5.c ** ******************************** (cut) ******************************** */ +#endif /* USE_EAPTLS */ + -diff --git a/pppd/md5.h b/pppd/md5.h -index 71e8b00..14d7121 100644 ---- a/pppd/md5.h -+++ b/pppd/md5.h +diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.h +--- ppp-2.4.7/pppd/md5.h 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.h 2017-05-09 14:38:55.152083200 +0200 @@ -36,6 +36,7 @@ ** documentation and/or software. ** *********************************************************************** @@ -3008,17 +3047,16 @@ index 71e8b00..14d7121 100644 #ifndef __MD5_INCLUDE__ -@@ -63,3 +64,5 @@ void MD5_Final (unsigned char hash[], MD5_CTX *mdContext); +@@ -63,3 +64,5 @@ #define __MD5_INCLUDE__ #endif /* __MD5_INCLUDE__ */ + +#endif /* USE_EAPTLS */ -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index 24e010c..6275df6 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -22,6 +22,13 @@ +diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-0.999/pppd/pathnames.h +--- ppp-2.4.7/pppd/pathnames.h 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/pathnames.h 2017-05-09 14:38:55.153083126 +0200 +@@ -21,6 +21,13 @@ #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" @@ -3032,11 +3070,10 @@ index 24e010c..6275df6 100644 #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index b474a19..760cad4 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -4,6 +4,9 @@ CFLAGS = $(COPTS) -I.. -I../../include -fPIC +diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/Makefile.linux +--- ppp-2.4.7/pppd/plugins/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/Makefile.linux 2017-05-09 14:38:55.153083126 +0200 +@@ -4,6 +4,9 @@ LDFLAGS = -shared INSTALL = install @@ -3046,11 +3083,10 @@ index b474a19..760cad4 100644 DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -diff --git a/pppd/plugins/passprompt.c b/pppd/plugins/passprompt.c -index babb6dc..6ba73ca 100644 ---- a/pppd/plugins/passprompt.c -+++ b/pppd/plugins/passprompt.c -@@ -107,4 +107,7 @@ void plugin_init(void) +diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/passprompt.c +--- ppp-2.4.7/pppd/plugins/passprompt.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/passprompt.c 2017-05-09 14:38:55.153083126 +0200 +@@ -107,4 +107,7 @@ { add_options(options); pap_passwd_hook = promptpass; @@ -3058,11 +3094,10 @@ index babb6dc..6ba73ca 100644 + eaptls_passwd_hook = promptpass; +#endif } -diff --git a/pppd/plugins/passwordfd.c b/pppd/plugins/passwordfd.c -index d718f3b..c3f9793 100644 ---- a/pppd/plugins/passwordfd.c -+++ b/pppd/plugins/passwordfd.c -@@ -79,4 +79,8 @@ void plugin_init (void) +diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/passwordfd.c +--- ppp-2.4.7/pppd/plugins/passwordfd.c 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/passwordfd.c 2017-05-09 14:38:55.154083052 +0200 +@@ -79,4 +79,8 @@ chap_check_hook = pwfd_check; chap_passwd_hook = pwfd_passwd; @@ -3071,11 +3106,10 @@ index d718f3b..c3f9793 100644 + eaptls_passwd_hook = pwfd_passwd; +#endif } -diff --git a/pppd/pppd.8 b/pppd/pppd.8 -index 2dd6e1a..75dd6f3 100644 ---- a/pppd/pppd.8 -+++ b/pppd/pppd.8 -@@ -248,6 +248,12 @@ Alternatively, a value of 0 for \fInr\fR or \fInt\fR disables +diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.8 +--- ppp-2.4.7/pppd/pppd.8 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.8 2017-05-09 14:38:55.155082978 +0200 +@@ -248,6 +248,12 @@ compression in the corresponding direction. Use \fInobsdcomp\fR or \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. .TP @@ -3088,7 +3122,7 @@ index 2dd6e1a..75dd6f3 100644 .B cdtrcts Use a non-standard hardware flow control (i.e. DTR/CTS) to control the flow of data on the serial port. If neither the \fIcrtscts\fR, -@@ -259,6 +265,12 @@ RTS output. Such serial ports use this mode to implement true +@@ -259,6 +265,12 @@ bi-directional flow control. The sacrifice is that this flow control mode does not permit using DTR as a modem control line. .TP @@ -3101,7 +3135,7 @@ index 2dd6e1a..75dd6f3 100644 .B chap\-interval \fIn If this option is given, pppd will rechallenge the peer every \fIn\fR seconds. -@@ -287,6 +299,18 @@ negotiation by sending its first LCP packet. The default value is +@@ -287,6 +299,18 @@ 1000 (1 second). This wait period only applies if the \fBconnect\fR or \fBpty\fR option is used. .TP @@ -3120,7 +3154,7 @@ index 2dd6e1a..75dd6f3 100644 .B debug Enables connection debugging facilities. If this option is given, pppd will log the contents of all -@@ -551,6 +575,12 @@ transmitted packets be printed. On most systems, messages printed by +@@ -551,6 +575,12 @@ the kernel are logged by syslog(1) to a file as directed in the /etc/syslog.conf configuration file. .TP @@ -3133,7 +3167,7 @@ index 2dd6e1a..75dd6f3 100644 .B ktune Enables pppd to alter kernel settings as appropriate. Under Linux, pppd will enable IP forwarding (i.e. set /proc/sys/net/ipv4/ip_forward -@@ -709,6 +739,9 @@ name to \fIname\fR.) +@@ -709,6 +739,9 @@ Disable Address/Control compression in both directions (send and receive). .TP @@ -3143,11 +3177,10 @@ index 2dd6e1a..75dd6f3 100644 .B noauth Do not require the peer to authenticate itself. This option is privileged. -diff --git a/pppd/pppd.h b/pppd/pppd.h -index 5f72f72..523f226 100644 ---- a/pppd/pppd.h -+++ b/pppd/pppd.h -@@ -324,6 +324,11 @@ extern bool dump_options; /* print out option values */ +diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.h +--- ppp-2.4.7/pppd/pppd.h 2014-08-09 14:31:39.000000000 +0200 ++++ ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.h 2017-05-09 14:38:55.156082905 +0200 +@@ -325,6 +325,11 @@ extern bool dryrun; /* check everything, print options, exit */ extern int child_wait; /* # seconds to wait for children at end */ @@ -3159,7 +3192,7 @@ index 5f72f72..523f226 100644 #ifdef MAXOCTETS extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ extern int maxoctets_dir; /* Direction : -@@ -738,6 +743,10 @@ extern int (*chap_check_hook) __P((void)); +@@ -741,6 +746,10 @@ extern int (*chap_passwd_hook) __P((char *user, char *passwd)); extern void (*multilink_join_hook) __P((void)); @@ -3170,6 +3203,3 @@ index 5f72f72..523f226 100644 /* Let a plugin snoop sent and received packets. Useful for L2TP */ extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); extern void (*snoop_send_hook) __P((unsigned char *p, int len)); --- -1.8.3.1 - diff --git a/0028-Fix-logical-expression-in-eap_client_active-macro.patch b/0028-Fix-logical-expression-in-eap_client_active-macro.patch deleted file mode 100644 index fe99133..0000000 --- a/0028-Fix-logical-expression-in-eap_client_active-macro.patch +++ /dev/null @@ -1,27 +0,0 @@ -From fcb95abad72ac043f2e5f5ddcffc42b0783a3c2d Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Wed, 10 Dec 2014 12:21:31 +0100 -Subject: [PATCH] Fix logical expression in eap_client_active macro - ---- - pppd/eap.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/eap.h b/pppd/eap.h -index 3fa5391..087baad 100644 ---- a/pppd/eap.h -+++ b/pppd/eap.h -@@ -110,8 +110,8 @@ enum eap_state_code { - "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" - - #ifdef USE_EAPTLS --#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial ||\ -- (esp)->es_client.ea_state != eapPending ||\ -+#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial &&\ -+ (esp)->es_client.ea_state != eapPending &&\ - (esp)->es_client.ea_state != eapClosed) - #else - #define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) --- -1.8.3.1 - diff --git a/0029-pppoe-include-netinet-in.h-before-linux-in.h.patch b/0028-pppoe-include-netinet-in.h-before-linux-in.h.patch similarity index 100% rename from 0029-pppoe-include-netinet-in.h-before-linux-in.h.patch rename to 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch diff --git a/ppp.spec b/ppp.spec index 1d8e135..e0ad6da 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 13%{?dist} +Release: 14%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -48,12 +48,11 @@ Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: 0025-pppd-install-pppd-binary-using-standard-perms-755.patch Patch0026: 0026-Revert-pppd-rebase-EAP-TLS-patch-v0.994.patch -Patch0027: 0027-pppd-EAP-TLS-patch-v0.997.patch -Patch0028: 0028-Fix-logical-expression-in-eap_client_active-macro.patch -Patch0029: 0029-pppoe-include-netinet-in.h-before-linux-in.h.patch +Patch0027: 0027-pppd-EAP-TLS-patch-v0.999.patch +Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel -BuildRequires: pkgconfig(openssl) < 1.1 +BuildRequires: openssl-devel Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd, initscripts >= 9.54 Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd @@ -170,6 +169,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Mon Aug 21 2017 Jaroslav Škarvada - 2.4.7-14 +- EAP-TLS patch updated to version 0.999 +- Switched to openssl-1.1 + * Thu Aug 03 2017 Fedora Release Engineering - 2.4.7-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild From ed2a4706b16352a920cc6205f8212bad751d69f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 20 Jan 2018 23:07:37 +0100 Subject: [PATCH 02/76] Rebuilt for switch to libxcrypt --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index e0ad6da..089fbe7 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 14%{?dist} +Release: 15%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -169,6 +169,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Sat Jan 20 2018 Björn Esser - 2.4.7-15 +- Rebuilt for switch to libxcrypt + * Mon Aug 21 2017 Jaroslav Škarvada - 2.4.7-14 - EAP-TLS patch updated to version 0.999 - Switched to openssl-1.1 From b2dc3349ef2c7377fe6fc67ea76e0e9fd9a197b3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 9 Feb 2018 05:42:31 +0000 Subject: [PATCH 03/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 089fbe7..e087171 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 15%{?dist} +Release: 16%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -169,6 +169,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Feb 09 2018 Fedora Release Engineering - 2.4.7-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Sat Jan 20 2018 Björn Esser - 2.4.7-15 - Rebuilt for switch to libxcrypt From 93aa42b0f683f470cf3cc5680d3adf53244bbec3 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Fri, 9 Feb 2018 09:05:33 +0100 Subject: [PATCH 04/76] Escape macros in %changelog Reference: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/Y2ZUKK2B7T2IKXPMODNF6HB2O5T5TS6H/ Signed-off-by: Igor Gnatenko --- ppp.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/ppp.spec b/ppp.spec index e087171..1d16daf 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 16%{?dist} +Release: 17%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -169,6 +169,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Feb 09 2018 Igor Gnatenko - 2.4.7-17 +- Escape macros in %%changelog + * Fri Feb 09 2018 Fedora Release Engineering - 2.4.7-16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild @@ -237,7 +240,7 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo - fix post installation scriptlet * Fri Jul 12 2013 Michal Sekletar - 2.4.5-32 -- don't ship /var/lock/ppp in rpm payload and create it in %post instead +- don't ship /var/lock/ppp in rpm payload and create it in %%post instead - fix installation of tmpfiles.d configuration - enable hardened build - fix bogus dates in changelog @@ -546,7 +549,7 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo - automatic rebuild * Mon Jun 5 2000 Nalin Dahyabhai -- move man pages to %{_mandir} +- move man pages to %%{_mandir} * Thu Jun 1 2000 Nalin Dahyabhai - change perms using defattr From 5a9cdf3bbf85f677f0cf02efa2d2f4981215f324 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 27 Mar 2018 17:02:14 +0200 Subject: [PATCH 05/76] Used openssl for the DES instead of the libcrypt / glibc Resolves: rhbz#1556132 --- ppp-2.4.7-DES-openssl.patch | 79 +++++++++++++++++++++++++++++++++++++ ppp.spec | 9 ++++- 2 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.7-DES-openssl.patch diff --git a/ppp-2.4.7-DES-openssl.patch b/ppp-2.4.7-DES-openssl.patch new file mode 100644 index 0000000..ad3b268 --- /dev/null +++ b/ppp-2.4.7-DES-openssl.patch @@ -0,0 +1,79 @@ +diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux +index 534ccc2..cf11b74 100644 +--- a/pppd/Makefile.linux ++++ b/pppd/Makefile.linux +@@ -41,7 +41,7 @@ COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" + # Uncomment the next 2 lines to include support for Microsoft's + # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. + CHAPMS=y +-USE_CRYPT=y ++#USE_CRYPT=y + # Don't use MSLANMAN unless you really know what you're doing. + #MSLANMAN=y + # Uncomment the next line to include support for MPPE. CHAPMS (above) must +@@ -147,7 +147,8 @@ endif + + ifdef NEEDDES + ifndef USE_CRYPT +-LIBS += -ldes $(LIBS) ++CFLAGS += -I/usr/include/openssl ++LIBS += -lcrypto + else + CFLAGS += -DUSE_CRYPT=1 + endif +diff --git a/pppd/pppcrypt.c b/pppd/pppcrypt.c +index 8b85b13..6b35375 100644 +--- a/pppd/pppcrypt.c ++++ b/pppd/pppcrypt.c +@@ -64,7 +64,7 @@ u_char *des_key; /* OUT 64 bit DES key with parity bits added */ + des_key[7] = Get7Bits(key, 49); + + #ifndef USE_CRYPT +- des_set_odd_parity((des_cblock *)des_key); ++ DES_set_odd_parity((DES_cblock *)des_key); + #endif + } + +@@ -158,25 +158,25 @@ u_char *clear; /* OUT 8 octets */ + } + + #else /* USE_CRYPT */ +-static des_key_schedule key_schedule; ++static DES_key_schedule key_schedule; + + bool + DesSetkey(key) + u_char *key; + { +- des_cblock des_key; ++ DES_cblock des_key; + MakeKey(key, des_key); +- des_set_key(&des_key, key_schedule); ++ DES_set_key(&des_key, &key_schedule); + return (1); + } + + bool +-DesEncrypt(clear, key, cipher) ++DesEncrypt(clear, cipher) + u_char *clear; /* IN 8 octets */ + u_char *cipher; /* OUT 8 octets */ + { +- des_ecb_encrypt((des_cblock *)clear, (des_cblock *)cipher, +- key_schedule, 1); ++ DES_ecb_encrypt((DES_cblock *)clear, (DES_cblock *)cipher, ++ &key_schedule, 1); + return (1); + } + +@@ -185,8 +185,8 @@ DesDecrypt(cipher, clear) + u_char *cipher; /* IN 8 octets */ + u_char *clear; /* OUT 8 octets */ + { +- des_ecb_encrypt((des_cblock *)cipher, (des_cblock *)clear, +- key_schedule, 0); ++ DES_ecb_encrypt((DES_cblock *)cipher, (DES_cblock *)clear, ++ &key_schedule, 0); + return (1); + } + diff --git a/ppp.spec b/ppp.spec index 1d16daf..fba6300 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 17%{?dist} +Release: 18%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -51,6 +51,9 @@ Patch0026: 0026-Revert-pppd-rebase-EAP-TLS-patch-v0.994.patch Patch0027: 0027-pppd-EAP-TLS-patch-v0.999.patch Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch +# rhbz#1556132 +Patch0029: ppp-2.4.7-DES-openssl.patch + BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel BuildRequires: openssl-devel Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd, initscripts >= 9.54 @@ -169,6 +172,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Tue Mar 27 2018 Jaroslav Škarvada - 2.4.7-18 +- Used openssl for the DES instead of the libcrypt / glibc + Resolves: rhbz#1556132 + * Fri Feb 09 2018 Igor Gnatenko - 2.4.7-17 - Escape macros in %%changelog From 5da2a6a5b0bcfa8e65759f28246cbdd3ffea28aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 4 Apr 2018 11:33:41 +0200 Subject: [PATCH 06/76] Build with distro's LDFLAGS Resolves: rhbz#1563157 --- ppp-2.4.7-honor-ldflags.patch | 118 ++++++++++++++++++++++++++++++++++ ppp.spec | 13 +++- 2 files changed, 128 insertions(+), 3 deletions(-) create mode 100644 ppp-2.4.7-honor-ldflags.patch diff --git a/ppp-2.4.7-honor-ldflags.patch b/ppp-2.4.7-honor-ldflags.patch new file mode 100644 index 0000000..39339bb --- /dev/null +++ b/ppp-2.4.7-honor-ldflags.patch @@ -0,0 +1,118 @@ +diff --git a/chat/Makefile.linux b/chat/Makefile.linux +index 2445637..83114f1 100644 +--- a/chat/Makefile.linux ++++ b/chat/Makefile.linux +@@ -18,7 +18,7 @@ INSTALL= install + all: chat + + chat: chat.o +- $(CC) -o chat chat.o ++ $(CC) $(LDFLAGS) -o chat chat.o + + chat.o: chat.c + $(CC) -c $(CFLAGS) -o chat.o chat.c +diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux +index 303833a..04fe876 100644 +--- a/pppd/plugins/Makefile.linux ++++ b/pppd/plugins/Makefile.linux +@@ -1,7 +1,7 @@ + #CC = gcc + COPTS = $(RPM_OPT_FLAGS) + CFLAGS = $(COPTS) -I.. -I../../include -fPIC +-LDFLAGS = -shared ++LDFLAGS_SHARED = -shared + INSTALL = install + + # EAP-TLS +@@ -33,7 +33,7 @@ all: $(PLUGINS) + for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done + + %.so: %.c +- $(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^ ++ $(CC) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED) $(CFLAGS) $^ + + VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../patchlevel.h) + +diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux +index 4c5826f..1961e0e 100644 +--- a/pppd/plugins/pppoatm/Makefile.linux ++++ b/pppd/plugins/pppoatm/Makefile.linux +@@ -1,7 +1,7 @@ + #CC = gcc + COPTS = $(RPM_OPT_FLAGS) + CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC +-LDFLAGS = -shared ++LDFLAGS_SHARED = -shared + INSTALL = install + + #*********************************************************************** +@@ -33,7 +33,7 @@ endif + all: $(PLUGIN) + + $(PLUGIN): $(PLUGIN_OBJS) +- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) ++ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(LDFLAGS_SHARED) $^ $(LIBS) + + install: all + $(INSTALL) -d -m 755 $(LIBDIR) +diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux +index 9cb316d..7b23b25 100644 +--- a/pppd/plugins/pppol2tp/Makefile.linux ++++ b/pppd/plugins/pppol2tp/Makefile.linux +@@ -1,7 +1,7 @@ + #CC = gcc + COPTS = $(RPM_OPT_FLAGS) -DHAVE_MULTILINK + CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC +-LDFLAGS = -shared ++LDFLAGS_SHARED = -shared + INSTALL = install + + #*********************************************************************** +@@ -16,7 +16,7 @@ PLUGINS := pppol2tp.so openl2tp.so + all: $(PLUGINS) + + %.so: %.o +- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) ++ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(LDFLAGS_SHARED) $^ $(LIBS) + + install: all + $(INSTALL) -d -m 755 $(LIBDIR) +diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux +index fa49efb..d735c51 100644 +--- a/pppd/plugins/rp-pppoe/Makefile.linux ++++ b/pppd/plugins/rp-pppoe/Makefile.linux +@@ -31,7 +31,7 @@ CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' + all: rp-pppoe.so pppoe-discovery + + pppoe-discovery: pppoe-discovery.o debug.o common.o +- $(CC) -o pppoe-discovery pppoe-discovery.o debug.o -ludev ++ $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev + + pppoe-discovery.o: pppoe-discovery.c + $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c +diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux +index 95c6805..33e5107 100644 +--- a/pppdump/Makefile.linux ++++ b/pppdump/Makefile.linux +@@ -10,7 +10,7 @@ INSTALL= install + all: pppdump + + pppdump: $(OBJS) +- $(CC) -o pppdump $(OBJS) ++ $(CC) $(LDFLAGS) -o pppdump $(OBJS) + + clean: + rm -f pppdump $(OBJS) *~ +diff --git a/pppstats/Makefile.linux b/pppstats/Makefile.linux +index c5ba3b1..eeccf83 100644 +--- a/pppstats/Makefile.linux ++++ b/pppstats/Makefile.linux +@@ -26,7 +26,7 @@ install: pppstats + $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) + + pppstats: $(PPPSTATSRCS) +- $(CC) $(CFLAGS) -o pppstats pppstats.c $(LIBS) ++ $(CC) $(CFLAGS) $(LDFLAGS) -o pppstats pppstats.c $(LIBS) + + clean: + rm -f pppstats *~ #* core diff --git a/ppp.spec b/ppp.spec index fba6300..902c996 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 18%{?dist} +Release: 19%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -53,6 +53,8 @@ Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch # rhbz#1556132 Patch0029: ppp-2.4.7-DES-openssl.patch +# https://github.com/paulusmack/ppp/pull/95 +Patch0030: ppp-2.4.7-honor-ldflags.patch BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel BuildRequires: openssl-devel @@ -83,9 +85,10 @@ tar -xJf %{SOURCE12} %build export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" +export RPM_LD_FLAGS="$LDFLAGS" %configure -make %{?_smp_mflags} -make -C ppp-watch %{?_smp_mflags} +make %{?_smp_mflags} LDFLAGS="%{?build_ldflags}" +make -C ppp-watch %{?_smp_mflags} LDFLAGS="%{?build_ldflags}" %install make INSTROOT=%{buildroot} install install-etcppp @@ -172,6 +175,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Wed Apr 4 2018 Jaroslav Škarvada - 2.4.7-19 +- Build with distro's LDFLAGS + Resolves: rhbz#1563157 + * Tue Mar 27 2018 Jaroslav Škarvada - 2.4.7-18 - Used openssl for the DES instead of the libcrypt / glibc Resolves: rhbz#1556132 From cf1e6c7c6b0dd5bd88423af3424d6c9a8578c8cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Fri, 6 Apr 2018 14:09:44 +0200 Subject: [PATCH 07/76] Also build all DSOs with distro's LDFLAGS Related: rhbz#1563157 --- ppp-2.4.7-honor-ldflags.patch | 32 +++++++++++++++++++++++++++++++- ppp.spec | 6 +++++- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/ppp-2.4.7-honor-ldflags.patch b/ppp-2.4.7-honor-ldflags.patch index 39339bb..4cc6d1a 100644 --- a/ppp-2.4.7-honor-ldflags.patch +++ b/ppp-2.4.7-honor-ldflags.patch @@ -77,8 +77,29 @@ index 9cb316d..7b23b25 100644 install: all $(INSTALL) -d -m 755 $(LIBDIR) +diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux +index 707326b..2150332 100644 +--- a/pppd/plugins/radius/Makefile.linux ++++ b/pppd/plugins/radius/Makefile.linux +@@ -43,13 +43,13 @@ install: all + $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) + + radius.so: radius.o libradiusclient.a +- $(CC) -o radius.so -shared radius.o libradiusclient.a ++ $(CC) $(LDFLAGS) -o radius.so -shared radius.o libradiusclient.a + + radattr.so: radattr.o +- $(CC) -o radattr.so -shared radattr.o ++ $(CC) $(LDFLAGS) -o radattr.so -shared radattr.o + + radrealms.so: radrealms.o +- $(CC) -o radrealms.so -shared radrealms.o ++ $(CC) $(LDFLAGS) -o radrealms.so -shared radrealms.o + + CLIENTOBJS = avpair.o buildreq.o config.o dict.o ip_util.o \ + clientid.o sendserver.o lock.o util.o md5.o diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index fa49efb..d735c51 100644 +index fa49efb..5e06b52 100644 --- a/pppd/plugins/rp-pppoe/Makefile.linux +++ b/pppd/plugins/rp-pppoe/Makefile.linux @@ -31,7 +31,7 @@ CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' @@ -90,6 +111,15 @@ index fa49efb..d735c51 100644 pppoe-discovery.o: pppoe-discovery.c $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c +@@ -40,7 +40,7 @@ debug.o: debug.c + $(CC) $(CFLAGS) -c -o debug.o debug.c + + rp-pppoe.so: plugin.o discovery.o if.o common.o +- $(CC) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o ++ $(CC) $(LDFLAGS) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o + + install: all + $(INSTALL) -d -m 755 $(LIBDIR) diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux index 95c6805..33e5107 100644 --- a/pppdump/Makefile.linux diff --git a/ppp.spec b/ppp.spec index 902c996..5b81018 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 19%{?dist} +Release: 20%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -175,6 +175,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Apr 6 2018 Jaroslav Škarvada - 2.4.7-20 +- Also build all DSOs with distro's LDFLAGS + Related: rhbz#1563157 + * Wed Apr 4 2018 Jaroslav Škarvada - 2.4.7-19 - Build with distro's LDFLAGS Resolves: rhbz#1563157 From 8870b357cab427e9187751849971a6462157f680 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 9 Apr 2018 14:49:53 +0200 Subject: [PATCH 08/76] Link with -E not to break plugins Resolves: rhbz#1564459 --- ppp-2.4.7-honor-ldflags.patch | 22 ++++++++++++++++++++++ ppp.spec | 6 +++++- 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/ppp-2.4.7-honor-ldflags.patch b/ppp-2.4.7-honor-ldflags.patch index 4cc6d1a..2c3e20d 100644 --- a/ppp-2.4.7-honor-ldflags.patch +++ b/ppp-2.4.7-honor-ldflags.patch @@ -11,6 +11,28 @@ index 2445637..83114f1 100644 chat.o: chat.c $(CC) -c $(CFLAGS) -o chat.o chat.c +diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux +index cf11b74..089f164 100644 +--- a/pppd/Makefile.linux ++++ b/pppd/Makefile.linux +@@ -188,7 +188,7 @@ endif + + ifdef PLUGIN + CFLAGS += -DPLUGIN +-LDFLAGS += -Wl,-E ++LDFLAGS_PLUGIN += -Wl,-E + LIBS += -ldl + endif + +@@ -230,7 +230,7 @@ install: pppd + $(INSTALL) -c -m 644 pppd.8 $(MANDIR) + + pppd: $(PPPDOBJS) +- $(CC) $(CFLAGS) $(LDFLAGS) -o pppd $(PPPDOBJS) $(LIBS) ++ $(CC) $(CFLAGS) $(LDFLAGS) $(LDFLAGS_PLUGIN) -o pppd $(PPPDOBJS) $(LIBS) + + srp-entry: srp-entry.c + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ srp-entry.c $(LIBS) diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux index 303833a..04fe876 100644 --- a/pppd/plugins/Makefile.linux diff --git a/ppp.spec b/ppp.spec index 5b81018..12d2add 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 20%{?dist} +Release: 21%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -175,6 +175,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Mon Apr 9 2018 Jaroslav Škarvada - 2.4.7-21 +- Link with -E not to break plugins + Resolves: rhbz#1564459 + * Fri Apr 6 2018 Jaroslav Škarvada - 2.4.7-20 - Also build all DSOs with distro's LDFLAGS Related: rhbz#1563157 From ad8f16ddb21258ec6aea87698cccb494898a9e62 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 11 Jun 2018 23:59:15 +0200 Subject: [PATCH 09/76] Updated EAP-TLS patch to v1.101 Resolves: CVE-2018-11574 --- 0017-pppd-rebase-EAP-TLS-patch-v0.994.patch | 3045 ---------------- ...ert-pppd-rebase-EAP-TLS-patch-v0.994.patch | 3046 ----------------- ...patch => ppp-2.4.7-eaptls-mppe-1.101.patch | 223 +- ppp.spec | 10 +- 4 files changed, 130 insertions(+), 6194 deletions(-) delete mode 100644 0017-pppd-rebase-EAP-TLS-patch-v0.994.patch delete mode 100644 0026-Revert-pppd-rebase-EAP-TLS-patch-v0.994.patch rename 0027-pppd-EAP-TLS-patch-v0.999.patch => ppp-2.4.7-eaptls-mppe-1.101.patch (93%) diff --git a/0017-pppd-rebase-EAP-TLS-patch-v0.994.patch b/0017-pppd-rebase-EAP-TLS-patch-v0.994.patch deleted file mode 100644 index 991355d..0000000 --- a/0017-pppd-rebase-EAP-TLS-patch-v0.994.patch +++ /dev/null @@ -1,3045 +0,0 @@ -From 044a5b1e5d878c519143b71a44b3d5b0ca91de3b Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 14:56:56 +0200 -Subject: [PATCH 17/27] pppd: rebase EAP-TLS patch v0.994 - ---- - README.eap-tls | 169 +++++++ - etc.ppp/eaptls-client | 10 + - etc.ppp/eaptls-server | 11 + - etc.ppp/openssl.cnf | 14 + - linux/Makefile.top | 6 +- - pppd/Makefile.linux | 12 + - pppd/auth.c | 414 ++++++++++++++- - pppd/ccp.c | 20 +- - pppd/chap-md5.c | 4 + - pppd/eap-tls.c | 1174 +++++++++++++++++++++++++++++++++++++++++++ - pppd/eap-tls.h | 107 ++++ - pppd/eap.c | 462 ++++++++++++++++- - pppd/eap.h | 32 +- - pppd/md5.c | 3 + - pppd/md5.h | 3 + - pppd/options.c | 10 + - pppd/pathnames.h | 7 + - pppd/plugins/Makefile.linux | 3 + - pppd/plugins/passprompt.c | 3 + - pppd/plugins/passwordfd.c | 4 + - pppd/pppd.h | 8 + - 21 files changed, 2461 insertions(+), 15 deletions(-) - create mode 100644 README.eap-tls - create mode 100644 etc.ppp/eaptls-client - create mode 100644 etc.ppp/eaptls-server - create mode 100644 etc.ppp/openssl.cnf - create mode 100644 pppd/eap-tls.c - create mode 100644 pppd/eap-tls.h - -diff --git a/README.eap-tls b/README.eap-tls -new file mode 100644 -index 0000000..0a4fee9 ---- /dev/null -+++ b/README.eap-tls -@@ -0,0 +1,169 @@ -+EAP-TLS authentication support for PPP -+====================================== -+ -+1. Intro -+ -+ The Extensible Authentication Protocol (EAP; RFC 3748) is a -+ security protocol that can be used with PPP. It provides a means -+ to plug in multiple optional authentication methods. -+ -+ Transport Level Security (TLS; RFC 2246) provides for mutual -+ authentication, integrity-protected ciphersuite negotiation and -+ key exchange between two endpoints. It also provides for optional -+ MPPE encryption. -+ -+ EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets, -+ allowing TLS mutual authentication to be used as a generic EAP -+ mechanism. It also provides optional encryption using the MPPE -+ protocol. -+ -+ This patch provide EAP-TLS support to pppd. -+ This authentication method can be used in both client or server -+ mode. -+ -+2. Building -+ -+ To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org) -+ is required. Any version from 0.9.7 should work. -+ -+ Configure, compile, and install as usual. -+ -+3. Configuration -+ -+ On the client side there are two ways to configure EAP-TLS: -+ -+ 1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters -+ -+ 2. edit the /etc/ppp/eaptls-client file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ The file containing the certificate chain for the -+ client in PEM format -+ - Server certificate file -+ If you want to specify the certificate that the -+ server is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM -+ format. -+ - Client private key file -+ The file containing the client private key in PEM format. -+ -+ -+ On the server side edit the /etc/ppp/eaptls-server file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ If you want to specify the certificate that the -+ client is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - Server certificate file -+ The file containing the certificate chain for the -+ server in PEM format -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM -+ format. -+ - Client private key file -+ The file containing the server private key in PEM format. -+ - addresses -+ A list of IP addresses the client is allowed to use. -+ -+ -+ OpenSSL engine support is included starting with v0.95 of this patch. -+ Currently the only engine tested is the 'pkcs11' engine (hardware token -+ support). To use the 'pksc11' engine: -+ - Use a special private key fileiname in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - The certificate can also be loaded from the 'pkcs11' engine using -+ a special client certificate filename in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior -+ to starting 'pppd'. A sample openssl.cnf file is -+ -+ openssl_conf = openssl_def -+ -+ [ openssl_def ] -+ engines = engine_section -+ -+ [ engine_section ] -+ pkcs11 = pkcs11_section -+ -+ [ pkcs11_section ] -+ engine_id = pkcs11 -+ dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+ MODULE_PATH = /usr/lib64/libeTPkcs11.so -+ init = 0 -+ -+ - There are two ways to specify a password/PIN for the PKCS11 engine: -+ - inside the openssl.cnf file using -+ PIN = your-secret-pin -+ Note The keyword 'PIN' is case sensitive! -+ - Using the 'password' in the ppp options file. -+ From v0.97 of the eap-tls patch the password can also be supplied -+ using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c -+ for an example). -+ -+ -+4. Options -+ -+ These pppd options are available: -+ -+ ca -+ Use the CA public certificate found in in PEM format -+ cert -+ Use the client public certificate found in in PEM format -+ or in engine:engine_id format -+ key -+ Use the client private key found in in PEM format -+ or in engine:engine_id format -+ crl-dir -+ Use CRL files from dir. It contains CRL files in PEM -+ format and each file contains a CRL. The files are looked up -+ by the issuer name hash value. Use the c_rehash utility -+ to create necessary links. -+ need-peer-eap -+ If the peer doesn't ask us to authenticate or doesn't use eap -+ to authenticate us, disconnect. -+ -+ Note: -+ password-encrypted certificates can be used as of v0.94 of this -+ patch. The password for the eap-tls.key file is specified using -+ the regular -+ password .... -+ statement in the ppp options file, or by using the appropriate -+ plugin which supplies a 'eaptls_passwd_hook' routine. -+ -+5. Connecting -+ -+ If you're setting up a pppd server, edit the EAP-TLS configuration file -+ as written above and then run pppd with the 'auth' option to authenticate -+ the client. The EAP-TLS method will be used if the other eap methods can't -+ be used (no secrets). -+ -+ If you're setting up a client, edit the configuration file and then run -+ pppd with 'remotename' option to specify the server name. Add the -+ 'need-peer-eap' option if you want to be sure the peer ask you to -+ authenticate (and to use eap) and to disconnect if it doesn't. -+ -+6. Notes -+ -+ This is experimental code. -+ Send suggestions and comments to Jan Just Keijser -+ -diff --git a/etc.ppp/eaptls-client b/etc.ppp/eaptls-client -new file mode 100644 -index 0000000..7782f0e ---- /dev/null -+++ b/etc.ppp/eaptls-client -@@ -0,0 +1,10 @@ -+# Parameters for authentication using EAP-TLS (client) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (required) -+# server certificate file (optional, if unused put '-') -+# CA certificate file (required) -+# client private key file (required) -+ -+#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff --git a/etc.ppp/eaptls-server b/etc.ppp/eaptls-server -new file mode 100644 -index 0000000..fa53cbd ---- /dev/null -+++ b/etc.ppp/eaptls-server -@@ -0,0 +1,11 @@ -+# Parameters for authentication using EAP-TLS (server) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (optional, if unused put '-') -+# server certificate file (required) -+# CA certificate file (required) -+# server private key file (required) -+# allowed addresses (required, can be *) -+ -+#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff --git a/etc.ppp/openssl.cnf b/etc.ppp/openssl.cnf -new file mode 100644 -index 0000000..dd32f30 ---- /dev/null -+++ b/etc.ppp/openssl.cnf -@@ -0,0 +1,14 @@ -+openssl_conf = openssl_def -+ -+[ openssl_def ] -+engines = engine_section -+ -+[ engine_section ] -+pkcs11 = pkcs11_section -+ -+[ pkcs11_section ] -+engine_id = pkcs11 -+dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+MODULE_PATH = /usr/lib64/libeTPkcs11.so -+init = 0 -+ -diff --git a/linux/Makefile.top b/linux/Makefile.top -index f42efd5..9a8945a 100644 ---- a/linux/Makefile.top -+++ b/linux/Makefile.top -@@ -28,7 +28,7 @@ install-progs: - cd pppdump; $(MAKE) $(MFLAGS) install - - install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ -- $(ETCDIR)/chap-secrets -+ $(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client - - install-devel: - cd pppd; $(MAKE) $(MFLAGS) install-devel -@@ -39,6 +39,10 @@ $(ETCDIR)/pap-secrets: - $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ - $(ETCDIR)/chap-secrets: - $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ -+$(ETCDIR)/eaptls-server: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-server $@ -+$(ETCDIR)/eaptls-client: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-client $@ - - $(BINDIR): - $(INSTALL) -d -m 755 $@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 65700fa..53df4d2 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -76,6 +76,9 @@ CBCP=y - # Use libutil - USE_LIBUTIL=y - -+# Enable EAP-TLS authentication (requires libssl and libcrypto) -+USE_EAPTLS=y -+ - MAXOCTETS=y - - INCLUDE_DIRS= -I../include -@@ -115,6 +118,15 @@ HEADERS += sha1.h - PPPDOBJS += sha1.o - endif - -+# EAP-TLS -+ifdef USE_EAPTLS -+CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include -+LIBS += -lssl -lcrypto -+PPPDSRC += eap-tls.c -+HEADERS += eap-tls.h -+PPPDOBJS += eap-tls.o -+endif -+ - ifdef HAS_SHADOW - CFLAGS += -DHAS_SHADOW - #LIBS += -lshadow $(LIBS) -diff --git a/pppd/auth.c b/pppd/auth.c -index 9e957fa..88cbdb6 100644 ---- a/pppd/auth.c -+++ b/pppd/auth.c -@@ -109,6 +109,9 @@ - #include "upap.h" - #include "chap-new.h" - #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#endif - #ifdef CBCP_SUPPORT - #include "cbcp.h" - #endif -@@ -183,6 +186,11 @@ int (*chap_check_hook) __P((void)) = NULL; - /* Hook for a plugin to get the CHAP password for authenticating us */ - int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; - -+#ifdef USE_EAPTLS -+/* Hook for a plugin to get the EAP-TLS password for authenticating us */ -+int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL; -+#endif -+ - /* Hook for a plugin to say whether it is OK if the peer - refuses to authenticate. */ - int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -238,6 +246,13 @@ bool explicit_remote = 0; /* User specified explicit remote name */ - bool explicit_user = 0; /* Set if "user" option supplied */ - bool explicit_passwd = 0; /* Set if "password" option supplied */ - char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ -+#ifdef USE_EAPTLS -+char *cacert_file = NULL; /* CA certificate file (pem format) */ -+char *cert_file = NULL; /* client certificate file (pem format) */ -+char *privkey_file = NULL; /* client private key file (pem format) */ -+char *crl_dir = NULL; /* directory containing CRL files */ -+bool need_peer_eap = 0; /* Require peer to authenticate us */ -+#endif - - static char *uafname; /* name of most recent +ua file */ - -@@ -254,6 +269,19 @@ static int have_pap_secret __P((int *)); - static int have_chap_secret __P((char *, char *, int, int *)); - static int have_srp_secret __P((char *client, char *server, int need_ip, - int *lacks_ipp)); -+ -+#ifdef USE_EAPTLS -+static int have_eaptls_secret_server -+__P((char *client, char *server, int need_ip, int *lacks_ipp)); -+static int have_eaptls_secret_client __P((char *client, char *server)); -+static int scan_authfile_eaptls __P((FILE * f, char *client, char *server, -+ char *cli_cert, char *serv_cert, -+ char *ca_cert, char *pk, -+ struct wordlist ** addrs, -+ struct wordlist ** opts, -+ char *filename, int flags)); -+#endif -+ - static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); - static int scan_authfile __P((FILE *, char *, char *, char *, - struct wordlist **, struct wordlist **, -@@ -401,6 +429,14 @@ option_t auth_options[] = { - "Set telephone number(s) which are allowed to connect", - OPT_PRIV | OPT_A2LIST }, - -+#ifdef USE_EAPTLS -+ { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, -+ { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, -+ { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, -+ { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, -+ { "need-peer-eap", o_bool, &need_peer_eap, -+ "Require the peer to authenticate us", 1 }, -+#endif /* USE_EAPTLS */ - { NULL } - }; - -@@ -730,6 +766,9 @@ link_established(unit) - lcp_options *wo = &lcp_wantoptions[unit]; - lcp_options *go = &lcp_gotoptions[unit]; - lcp_options *ho = &lcp_hisoptions[unit]; -+#ifdef USE_EAPTLS -+ lcp_options *ao = &lcp_allowoptions[unit]; -+#endif - int i; - struct protent *protp; - -@@ -764,6 +803,22 @@ link_established(unit) - } - } - -+#ifdef USE_EAPTLS -+ if (need_peer_eap && !ao->neg_eap) { -+ warn("eap required to authenticate us but no suitable secrets"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_AUTH_TOPEER_FAILED; -+ return; -+ } -+ -+ if (need_peer_eap && !ho->neg_eap) { -+ warn("peer doesn't want to authenticate us with eap"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_PEER_AUTH_FAILED; -+ return; -+ } -+#endif -+ - new_phase(PHASE_AUTHENTICATE); - auth = 0; - if (go->neg_eap) { -@@ -1117,7 +1172,7 @@ np_down(unit, proto) - UNTIMEOUT(connect_time_expired, NULL); - #ifdef MAXOCTETS - UNTIMEOUT(check_maxoctets, NULL); --#endif -+#endif - new_phase(PHASE_NETWORK); - } - } -@@ -1144,7 +1199,7 @@ check_maxoctets(arg) - - update_link_stats(ifunit); - link_stats_valid=0; -- -+ - switch(maxoctets_dir) { - case PPP_OCTETS_DIRECTION_IN: - used = link_stats.bytes_in; -@@ -1277,6 +1332,15 @@ auth_check_options() - our_name, 1, &lacks_ip); - } - -+#ifdef USE_EAPTLS -+ if (!can_auth && wo->neg_eap) { -+ can_auth = -+ have_eaptls_secret_server((explicit_remote ? remote_name : -+ NULL), our_name, 1, &lacks_ip); -+ -+ } -+#endif -+ - if (auth_required && !can_auth && noauth_addrs == NULL) { - if (default_auth) { - option_error( -@@ -1331,7 +1395,11 @@ auth_reset(unit) - passwd[0] != 0 || - (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, - (explicit_remote? remote_name: NULL), 0, NULL))) || -- have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)); -+ have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL) -+#ifdef USE_EAPTLS -+ || have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL)) -+#endif -+ ); - - hadchap = -1; - if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1346,8 +1414,14 @@ auth_reset(unit) - !have_chap_secret((explicit_remote? remote_name: NULL), our_name, - 1, NULL))) && - !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, -- NULL)) -+ NULL) -+#ifdef USE_EAPTLS -+ && !have_eaptls_secret_server((explicit_remote? remote_name: NULL), -+ our_name, 1, NULL) -+#endif -+ ) - go->neg_eap = 0; -+ - } - - -@@ -1707,6 +1781,7 @@ have_srp_secret(client, server, need_ip, lacks_ipp) - } - - -+ - /* - * get_secret - open the CHAP secret file and return the secret - * for authenticating the given client on the given server. -@@ -2359,3 +2434,334 @@ auth_script(script) - - auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); - } -+ -+ -+#ifdef USE_EAPTLS -+static int -+have_eaptls_secret_server(client, server, need_ip, lacks_ipp) -+ char *client; -+ char *server; -+ int need_ip; -+ int *lacks_ipp; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ filename = _PATH_EAPTLSSERVFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile, -+ clicertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (ret >= 0 && need_ip && !some_ip_ok(addrs)) { -+ if (lacks_ipp != 0) -+ *lacks_ipp = 1; -+ ret = -1; -+ } -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+have_eaptls_secret_client(client, server) -+ char *client; -+ char *server; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs = NULL; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ if (cacert_file && cert_file && privkey_file) -+ return 1; -+ -+ filename = _PATH_EAPTLSCLIFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile, -+ servcertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk, -+ addrs, opts, filename, flags) -+ FILE *f; -+ char *client; -+ char *server; -+ char *cli_cert; -+ char *serv_cert; -+ char *ca_cert; -+ char *pk; -+ struct wordlist **addrs; -+ struct wordlist **opts; -+ char *filename; -+ int flags; -+{ -+ int newline; -+ int got_flag, best_flag; -+ struct wordlist *ap, *addr_list, *alist, **app; -+ char word[MAXWORDLEN]; -+ -+ if (addrs != NULL) -+ *addrs = NULL; -+ if (opts != NULL) -+ *opts = NULL; -+ addr_list = NULL; -+ if (!getword(f, word, &newline, filename)) -+ return -1; /* file is empty??? */ -+ newline = 1; -+ best_flag = -1; -+ for (;;) { -+ /* -+ * Skip until we find a word at the start of a line. -+ */ -+ while (!newline && getword(f, word, &newline, filename)); -+ if (!newline) -+ break; /* got to end of file */ -+ -+ /* -+ * Got a client - check if it's a match or a wildcard. -+ */ -+ got_flag = 0; -+ if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) { -+ newline = 0; -+ continue; -+ } -+ if (!ISWILD(word)) -+ got_flag = NONWILD_CLIENT; -+ -+ /* -+ * Now get a server and check if it matches. -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (!ISWILD(word)) { -+ if (server != NULL && strcmp(word, server) != 0) -+ continue; -+ got_flag |= NONWILD_SERVER; -+ } -+ -+ /* -+ * Got some sort of a match - see if it's better than what -+ * we have already. -+ */ -+ if (got_flag <= best_flag) -+ continue; -+ -+ /* -+ * Get the cli_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(cli_cert, word, MAXWORDLEN); -+ } else -+ cli_cert[0] = 0; -+ -+ /* -+ * Get serv_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(serv_cert, word, MAXWORDLEN); -+ } else -+ serv_cert[0] = 0; -+ -+ /* -+ * Get ca_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(ca_cert, word, MAXWORDLEN); -+ -+ /* -+ * Get pk -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(pk, word, MAXWORDLEN); -+ -+ -+ /* -+ * Now read address authorization info and make a wordlist. -+ */ -+ app = &alist; -+ for (;;) { -+ if (!getword(f, word, &newline, filename) || newline) -+ break; -+ ap = (struct wordlist *) -+ malloc(sizeof(struct wordlist) + strlen(word) + 1); -+ if (ap == NULL) -+ novm("authorized addresses"); -+ ap->word = (char *) (ap + 1); -+ strcpy(ap->word, word); -+ *app = ap; -+ app = &ap->next; -+ } -+ *app = NULL; -+ /* -+ * This is the best so far; remember it. -+ */ -+ best_flag = got_flag; -+ if (addr_list) -+ free_wordlist(addr_list); -+ addr_list = alist; -+ -+ if (!newline) -+ break; -+ } -+ -+ /* scan for a -- word indicating the start of options */ -+ for (app = &addr_list; (ap = *app) != NULL; app = &ap->next) -+ if (strcmp(ap->word, "--") == 0) -+ break; -+ /* ap = start of options */ -+ if (ap != NULL) { -+ ap = ap->next; /* first option */ -+ free(*app); /* free the "--" word */ -+ *app = NULL; /* terminate addr list */ -+ } -+ if (opts != NULL) -+ *opts = ap; -+ else if (ap != NULL) -+ free_wordlist(ap); -+ if (addrs != NULL) -+ *addrs = addr_list; -+ else if (addr_list != NULL) -+ free_wordlist(addr_list); -+ -+ return best_flag; -+} -+ -+ -+int -+get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, am_server) -+ int unit; -+ char *client; -+ char *server; -+ char *clicertfile; -+ char *servcertfile; -+ char *cacertfile; -+ char *pkfile; -+ int am_server; -+{ -+ FILE *fp; -+ int ret; -+ char *filename = NULL; -+ struct wordlist *addrs = NULL; -+ struct wordlist *opts = NULL; -+ -+ /* in client mode the ca+cert+privkey can also be specified as options */ -+ if (!am_server && cacert_file && cert_file && privkey_file ) -+ { -+ strlcpy( clicertfile, cert_file, MAXWORDLEN ); -+ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); -+ strlcpy( pkfile, privkey_file, MAXWORDLEN ); -+ servcertfile[0] = '\0'; -+ } -+ else -+ { -+ filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE); -+ addrs = NULL; -+ -+ fp = fopen(filename, "r"); -+ if (fp == NULL) -+ { -+ error("Can't open eap-tls secret file %s: %m", filename); -+ return 0; -+ } -+ -+ check_access(fp, filename); -+ -+ ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, &opts, filename, 0); -+ -+ fclose(fp); -+ -+ if (ret < 0) return 0; -+ } -+ -+ if (eaptls_passwd_hook) -+ { -+ dbglog( "Calling eaptls password hook" ); -+ if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0) -+ { -+ error("Unable to obtain EAP-TLS password for %s (%s) from plugin", -+ client, pkfile); -+ return 0; -+ } -+ } -+ if (am_server) -+ set_allowed_addrs(unit, addrs, opts); -+ else if (opts != NULL) -+ free_wordlist(opts); -+ if (addrs != NULL) -+ free_wordlist(addrs); -+ -+ return 1; -+} -+#endif -diff --git a/pppd/ccp.c b/pppd/ccp.c -index 5814f35..7dead23 100644 ---- a/pppd/ccp.c -+++ b/pppd/ccp.c -@@ -540,6 +540,9 @@ ccp_resetci(f) - if (go->mppe) { - ccp_options *ao = &ccp_allowoptions[f->unit]; - int auth_mschap_bits = auth_done[f->unit]; -+#ifdef USE_EAPTLS -+ int auth_eap_bits = auth_done[f->unit]; -+#endif - int numbits; - - /* -@@ -567,8 +570,23 @@ ccp_resetci(f) - lcp_close(f->unit, "MPPE required but not available"); - return; - } -+ -+#ifdef USE_EAPTLS -+ /* -+ * MPPE is also possible in combination with EAP-TLS. -+ * It is not possible to detect if we're doing EAP or EAP-TLS -+ * at this stage, hence we accept all forms of EAP. If TLS is -+ * not used then the MPPE keys will not be derived anyway. -+ */ -+ /* Leave only the eap auth bits set */ -+ auth_eap_bits &= (EAP_WITHPEER | EAP_PEER ); -+ -+ if ((numbits == 0) && (auth_eap_bits == 0)) { -+ error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed."); -+#else - if (!numbits) { -- error("MPPE required, but MS-CHAP[v2] auth not performed."); -+ error("MPPE required, but MS-CHAP[v2] auth not performed."); -+#endif - lcp_close(f->unit, "MPPE required but not available"); - return; - } -diff --git a/pppd/chap-md5.c b/pppd/chap-md5.c -index 77dd4ec..269b52c 100644 ---- a/pppd/chap-md5.c -+++ b/pppd/chap-md5.c -@@ -36,7 +36,11 @@ - #include "chap-new.h" - #include "chap-md5.h" - #include "magic.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#else - #include "md5.h" -+#endif /* USE_EAPTLS */ - - #define MD5_HASH_SIZE 16 - #define MD5_MIN_CHALLENGE 16 -diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c -new file mode 100644 -index 0000000..a3aea5a ---- /dev/null -+++ b/pppd/eap-tls.c -@@ -0,0 +1,1174 @@ -+/* -+ * eap-tls.c - EAP-TLS implementation for PPP -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "pppd.h" -+#include "eap.h" -+#include "eap-tls.h" -+#include "fsm.h" -+#include "lcp.h" -+#include "pathnames.h" -+ -+/* The openssl configuration file and engines can be loaded only once */ -+static CONF *ssl_config = NULL; -+static ENGINE *cert_engine = NULL; -+static ENGINE *pkey_engine = NULL; -+ -+#ifdef MPPE -+ -+/* -+ * TLS PRF from RFC 2246 -+ */ -+static void P_hash(const EVP_MD *evp_md, -+ const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned int out_len) -+{ -+ HMAC_CTX ctx_a, ctx_out; -+ unsigned char a[HMAC_MAX_MD_CBLOCK]; -+ unsigned int size; -+ -+ HMAC_CTX_init(&ctx_a); -+ HMAC_CTX_init(&ctx_out); -+ HMAC_Init_ex(&ctx_a, secret, secret_len, evp_md, NULL); -+ HMAC_Init_ex(&ctx_out, secret, secret_len, evp_md, NULL); -+ -+ size = HMAC_size(&ctx_out); -+ -+ /* Calculate A(1) */ -+ HMAC_Update(&ctx_a, seed, seed_len); -+ HMAC_Final(&ctx_a, a, NULL); -+ -+ while (1) { -+ /* Calculate next part of output */ -+ HMAC_Update(&ctx_out, a, size); -+ HMAC_Update(&ctx_out, seed, seed_len); -+ -+ /* Check if last part */ -+ if (out_len < size) { -+ HMAC_Final(&ctx_out, a, NULL); -+ memcpy(out, a, out_len); -+ break; -+ } -+ -+ /* Place digest in output buffer */ -+ HMAC_Final(&ctx_out, out, NULL); -+ HMAC_Init_ex(&ctx_out, NULL, 0, NULL, NULL); -+ out += size; -+ out_len -= size; -+ -+ /* Calculate next A(i) */ -+ HMAC_Init_ex(&ctx_a, NULL, 0, NULL, NULL); -+ HMAC_Update(&ctx_a, a, size); -+ HMAC_Final(&ctx_a, a, NULL); -+ } -+ -+ HMAC_CTX_cleanup(&ctx_a); -+ HMAC_CTX_cleanup(&ctx_out); -+ memset(a, 0, sizeof(a)); -+} -+ -+static void PRF(const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned char *buf, unsigned int out_len) -+{ -+ unsigned int i; -+ unsigned int len = (secret_len + 1) / 2; -+ const unsigned char *s1 = secret; -+ const unsigned char *s2 = secret + (secret_len - len); -+ -+ P_hash(EVP_md5(), s1, len, seed, seed_len, out, out_len); -+ P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len); -+ -+ for (i=0; i < out_len; i++) { -+ out[i] ^= buf[i]; -+ } -+} -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ -+/* -+ * Generate keys according to RFC 2716 and add to reply -+ */ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, -+ int client) -+{ -+ unsigned char out[4*EAPTLS_MPPE_KEY_LEN], buf[4*EAPTLS_MPPE_KEY_LEN]; -+ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; -+ unsigned char *p = seed; -+ SSL *s = ets->ssl; -+ size_t prf_size; -+ -+ prf_size = strlen(prf_label); -+ -+ memcpy(p, prf_label, prf_size); -+ p += prf_size; -+ -+ memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); -+ p += SSL3_RANDOM_SIZE; -+ prf_size += SSL3_RANDOM_SIZE; -+ -+ memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE); -+ prf_size += SSL3_RANDOM_SIZE; -+ -+ PRF(s->session->master_key, s->session->master_key_length, -+ seed, prf_size, out, buf, sizeof(out)); -+ -+ /* -+ * We now have the master send and receive keys. -+ * From these, generate the session send and receive keys. -+ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) -+ */ -+ if (client) -+ { -+ p = out; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ } -+ else -+ { -+ p = out; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ } -+ -+ mppe_keys_set = 1; -+} -+ -+#endif -+ -+void log_ssl_errors( void ) -+{ -+ unsigned long ssl_err = ERR_get_error(); -+ -+ if (ssl_err != 0) -+ dbglog("EAP-TLS SSL error stack:"); -+ while (ssl_err != 0) { -+ dbglog( ERR_error_string( ssl_err, NULL ) ); -+ ssl_err = ERR_get_error(); -+ } -+} -+ -+ -+int password_callback (char *buf, int size, int rwflag, void *u) -+{ -+ if (buf) -+ { -+ strncpy (buf, passwd, size); -+ return strlen (buf); -+ } -+ return 0; -+} -+ -+ -+CONF *eaptls_ssl_load_config( void ) -+{ -+ CONF *config; -+ int ret_code; -+ long error_line = 33; -+ -+ config = NCONF_new( NULL ); -+ dbglog( "Loading OpenSSL config file" ); -+ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); -+ if (ret_code == 0) -+ { -+ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); -+ NCONF_free( config ); -+ config = NULL; -+ ERR_clear_error(); -+ } -+ -+ dbglog( "Loading OpenSSL built-ins" ); -+ ENGINE_load_builtin_engines(); -+ OPENSSL_load_builtin_modules(); -+ -+ dbglog( "Loading OpenSSL configured modules" ); -+ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) -+ { -+ warn( "EAP-TLS: Error loading OpenSSL modules" ); -+ log_ssl_errors(); -+ config = NULL; -+ } -+ -+ return config; -+} -+ -+ENGINE *eaptls_ssl_load_engine( char *engine_name ) -+{ -+ ENGINE *e = NULL; -+ -+ dbglog( "Enabling OpenSSL auto engines" ); -+ ENGINE_register_all_complete(); -+ -+ dbglog( "Loading OpenSSL '%s' engine support", engine_name ); -+ e = ENGINE_by_id( engine_name ); -+ if (!e) -+ { -+ dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); -+ e = ENGINE_by_id( "dynamic" ); -+ if (e) -+ { -+ if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0) -+ || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) -+ { -+ warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ else -+ { -+ warn( "EAP-TLS: Cannot load dynamic engine support" ); -+ } -+ } -+ -+ if (e) -+ { -+ dbglog( "Initialising engine" ); -+ if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) -+ { -+ warn( "EAP-TLS: Cannot use that engine" ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ -+ return e; -+} -+ -+/* -+ * Initialize the SSL stacks and tests if certificates, key and crl -+ * for client or server use can be loaded. -+ */ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, -+ char *certfile, char *peer_certfile, char *privkeyfile) -+{ -+ char *cert_engine_name = NULL; -+ char *cert_identifier = NULL; -+ char *pkey_engine_name = NULL; -+ char *pkey_identifier = NULL; -+ SSL_CTX *ctx; -+ X509_STORE *certstore; -+ X509_LOOKUP *lookup; -+ X509 *tmp; -+ -+ /* -+ * Without these can't continue -+ */ -+ if (!cacertfile[0]) -+ { -+ error("EAP-TLS: CA certificate missing"); -+ return NULL; -+ } -+ -+ if (!certfile[0]) -+ { -+ error("EAP-TLS: User certificate missing"); -+ return NULL; -+ } -+ -+ if (!privkeyfile[0]) -+ { -+ error("EAP-TLS: User private key missing"); -+ return NULL; -+ } -+ -+ SSL_library_init(); -+ SSL_load_error_strings(); -+ -+ ctx = SSL_CTX_new(TLSv1_method()); -+ -+ if (!ctx) { -+ error("EAP-TLS: Cannot initialize SSL CTX context"); -+ goto fail; -+ } -+ -+ /* if the certificate filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the certificate filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL ) -+ { -+ cert_identifier = index( certfile, ':' ); -+ -+ if (cert_identifier) -+ { -+ cert_engine_name = certfile; -+ *cert_identifier = '\0'; -+ cert_identifier++; -+ -+ dbglog( "Found certificate engine '%s'", cert_engine_name ); -+ dbglog( "Found certificate identifier '%s'", cert_identifier ); -+ } -+ } -+ -+ /* if the privatekey filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the privatekey filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL ) -+ { -+ pkey_identifier = index( privkeyfile, ':' ); -+ -+ if (pkey_identifier) -+ { -+ pkey_engine_name = privkeyfile; -+ *pkey_identifier = '\0'; -+ pkey_identifier++; -+ -+ dbglog( "Found privatekey engine '%s'", pkey_engine_name ); -+ dbglog( "Found privatekey identifier '%s'", pkey_identifier ); -+ } -+ } -+ -+ if (cert_identifier && pkey_identifier) -+ { -+ if (strlen( cert_identifier ) == 0) -+ { -+ if (strlen( pkey_identifier ) == 0) -+ error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" ); -+ else -+ { -+ dbglog( "Substituting privatekey identifier for certificate identifier" ); -+ cert_identifier = pkey_identifier; -+ } -+ } -+ else -+ { -+ if (strlen( pkey_identifier ) == 0) -+ { -+ dbglog( "Substituting certificate identifier for privatekey identifier" ); -+ pkey_identifier = cert_identifier; -+ } -+ } -+ -+ } -+ -+ /* load the openssl config file only once */ -+ if (!ssl_config) -+ { -+ if (cert_engine_name || pkey_engine_name) -+ ssl_config = eaptls_ssl_load_config(); -+ -+ if (ssl_config && cert_engine_name) -+ cert_engine = eaptls_ssl_load_engine( cert_engine_name ); -+ -+ if (ssl_config && pkey_engine_name) -+ { -+ /* don't load the same engine twice */ -+ if ( strcmp( cert_engine_name, pkey_engine_name) == 0 ) -+ pkey_engine = cert_engine; -+ else -+ pkey_engine = eaptls_ssl_load_engine( pkey_engine_name ); -+ } -+ } -+ -+ SSL_CTX_set_default_passwd_cb (ctx, password_callback); -+ -+ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) -+ { -+ error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); -+ goto fail; -+ } -+ -+ if (init_server) -+ SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); -+ -+ if (cert_engine) -+ { -+ struct -+ { -+ const char *s_slot_cert_id; -+ X509 *cert; -+ } cert_info; -+ -+ cert_info.s_slot_cert_id = cert_identifier; -+ cert_info.cert = NULL; -+ -+ if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) ) -+ { -+ error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier ); -+ goto fail; -+ } -+ -+ if (cert_info.cert) -+ { -+ dbglog( "Got the certificate, adding it to SSL context" ); -+ dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) ); -+ if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM)) -+ { -+ error( "EAP-TLS: Cannot use public certificate %s", certfile ); -+ goto fail; -+ } -+ } -+ -+ if (pkey_engine) -+ { -+ EVP_PKEY *pkey = NULL; -+ PW_CB_DATA cb_data; -+ -+ cb_data.password = passwd; -+ cb_data.prompt_info = pkey_identifier; -+ -+ dbglog( "Loading private key '%s' from engine", pkey_identifier ); -+ pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data); -+ if (pkey) -+ { -+ dbglog( "Got the private key, adding it to SSL context" ); -+ if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM)) -+ { -+ error("EAP-TLS: Cannot use private key %s", privkeyfile); -+ goto fail; -+ } -+ } -+ -+ if (SSL_CTX_check_private_key(ctx) != 1) { -+ error("EAP-TLS: Private key %s fails security check", privkeyfile); -+ goto fail; -+ } -+ -+ SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); -+ SSL_CTX_set_verify_depth(ctx, 5); -+ SSL_CTX_set_verify(ctx, -+ SSL_VERIFY_PEER | -+ SSL_VERIFY_FAIL_IF_NO_PEER_CERT, -+ &ssl_verify_callback); -+ -+ if (crl_dir) { -+ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { -+ error("EAP-TLS: Failed to get certificate store"); -+ goto fail; -+ } -+ -+ if (!(lookup = -+ X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) { -+ error("EAP-TLS: Store lookup for CRL failed"); -+ -+ goto fail; -+ } -+ -+ X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM); -+ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); -+ } -+ -+ /* -+ * If a peer certificate file was specified, it must be valid, else fail -+ */ -+ if (peer_certfile[0]) { -+ if (!(tmp = get_X509_from_file(peer_certfile))) { -+ error("EAP-TLS: Error loading client certificate from file %s", -+ peer_certfile); -+ goto fail; -+ } -+ X509_free(tmp); -+ } -+ -+ return ctx; -+ -+fail: -+ log_ssl_errors(); -+ SSL_CTX_free(ctx); -+ return NULL; -+} -+ -+/* -+ * Determine the maximum packet size by looking at the LCP handshake -+ */ -+ -+int eaptls_get_mtu(int unit) -+{ -+ int mtu, mru; -+ -+ lcp_options *wo = &lcp_wantoptions[unit]; -+ lcp_options *go = &lcp_gotoptions[unit]; -+ lcp_options *ho = &lcp_hisoptions[unit]; -+ lcp_options *ao = &lcp_allowoptions[unit]; -+ -+ mtu = ho->neg_mru? ho->mru: PPP_MRU; -+ mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; -+ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; -+ -+ dbglog("MTU = %d", mtu); -+ return mtu; -+} -+ -+ -+/* -+ * Init the ssl handshake (server mode) -+ */ -+int eaptls_init_ssl_server(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_server.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_server.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_server.ea_session; -+ -+ if (!esp->es_server.ea_peer) { -+ error("EAP-TLS: Error: client name not set (BUG)"); -+ return 0; -+ } -+ -+ strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); -+ -+ dbglog( "getting eaptls secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, clicertfile, -+ servcertfile, cacertfile, pkfile, 1)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_server.ea_peer, esp->es_server.ea_name ); -+ return 0; -+ } -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ if (!(ets->ssl = SSL_new(ets->ctx))) -+ goto fail; -+ -+ /* -+ * Set auto-retry to avoid timeouts on BIO_read -+ */ -+ SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY); -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_accept_state(ets->ssl); -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the client certificate file, store it in ets->peercertfile, -+ * so we can check it later in ssl_verify_callback() -+ */ -+ if (clicertfile[0]) -+ strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ SSL_CTX_free(ets->ctx); -+ return 0; -+} -+ -+/* -+ * Init the ssl handshake (client mode) -+ */ -+int eaptls_init_ssl_client(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_client.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_client.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_client.ea_session; -+ -+ /* -+ * If available, copy server name in ets; it will be used in cert -+ * verify -+ */ -+ if (esp->es_client.ea_peer) -+ strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); -+ else -+ ets->peer[0] = 0; -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ dbglog( "calling get_eaptls_secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, -+ esp->es_client.ea_peer, clicertfile, -+ servcertfile, cacertfile, pkfile, 0)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_client.ea_name, esp->es_client.ea_peer ); -+ return 0; -+ } -+ -+ dbglog( "calling eaptls_init_ssl" ); -+ ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ ets->ssl = SSL_new(ets->ctx); -+ -+ if (!ets->ssl) -+ goto fail; -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ dbglog( "Initializing SSL BIOs" ); -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_connect_state(ets->ssl); -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the server certificate file, store it in -+ * ets->peercertfile, so we can check it later in -+ * ssl_verify_callback() -+ */ -+ if (servcertfile[0]) -+ strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ dbglog( "eaptls_init_ssl_client: fail" ); -+ SSL_CTX_free(ets->ctx); -+ return 0; -+ -+} -+ -+void eaptls_free_session(struct eaptls_session *ets) -+{ -+ if (ets->ssl) -+ SSL_free(ets->ssl); -+ -+ if (ets->ctx) -+ SSL_CTX_free(ets->ctx); -+ -+ free(ets); -+} -+ -+/* -+ * Handle a received packet, reassembling fragmented messages and -+ * passing them to the ssl engine -+ */ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) -+{ -+ u_char flags; -+ u_int tlslen; -+ u_char dummy[65536]; -+ -+ GETCHAR(flags, inp); -+ len--; -+ -+ if (flags & EAP_TLS_FLAGS_LI && !ets->data) { -+ -+ /* -+ * This is the first packet of a message -+ */ -+ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ -+ if (tlslen > EAP_TLS_MAX_LEN) { -+ error("Error: tls message length > %d, truncated", -+ EAP_TLS_MAX_LEN); -+ tlslen = EAP_TLS_MAX_LEN; -+ } -+ -+ /* -+ * Allocate memory for the whole message -+ */ -+ ets->data = malloc(tlslen); -+ if (!ets->data) -+ fatal("EAP TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = tlslen; -+ -+ } -+ else if (flags & EAP_TLS_FLAGS_LI && ets->data) { -+ /* -+ * Non first with LI (strange...) -+ */ -+ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ -+ } -+ else if (!ets->data) { -+ /* -+ * A non fragmented message without LI flag -+ */ -+ -+ ets->data = malloc(len); -+ if (!ets->data) -+ fatal("EAP TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = len; -+ } -+ -+ if (flags & EAP_TLS_FLAGS_MF) -+ ets->frag = 1; -+ else -+ ets->frag = 0; -+ -+ if (len + ets->datalen > ets->tlslen) { -+ warn("EAP TLS: received data > TLS message length"); -+ return 1; -+ } -+ -+ BCOPY(inp, ets->data + ets->datalen, len); -+ ets->datalen += len; -+ -+ if (!ets->frag) { -+ -+ /* -+ * If we have the whole message, pass it to ssl -+ */ -+ -+ if (ets->datalen != ets->tlslen) { -+ warn("EAP TLS: received data != TLS message length"); -+ return 1; -+ } -+ -+ if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1) -+ log_ssl_errors(); -+ -+ SSL_read(ets->ssl, dummy, 65536); -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Return an eap-tls packet in outp. -+ * A TLS message read from the ssl engine is buffered in ets->data. -+ * At each call we control if there is buffered data and send a -+ * packet of mtu bytes. -+ */ -+int eaptls_send(struct eaptls_session *ets, u_char ** outp) -+{ -+ bool first = 0; -+ int size; -+ u_char fromtls[65536]; -+ int res; -+ u_char *start; -+ -+ start = *outp; -+ -+ if (!ets->data) { -+ -+ if(!ets->alert_sent) -+ SSL_read(ets->ssl, fromtls, 65536); -+ -+ /* -+ * Read from ssl -+ */ -+ if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) -+ fatal("No data from BIO_read"); -+ -+ ets->datalen = res; -+ -+ ets->data = malloc(ets->datalen); -+ BCOPY(fromtls, ets->data, ets->datalen); -+ -+ ets->offset = 0; -+ first = 1; -+ -+ } -+ -+ size = ets->datalen - ets->offset; -+ -+ if (size > ets->mtu) { -+ size = ets->mtu; -+ ets->frag = 1; -+ } else -+ ets->frag = 0; -+ -+ PUTCHAR(EAPT_TLS, *outp); -+ -+ /* -+ * Set right flags and length if necessary -+ */ -+ if (ets->frag && first) { -+ PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp); -+ PUTLONG(ets->datalen, *outp); -+ } else if (ets->frag) { -+ PUTCHAR(EAP_TLS_FLAGS_MF, *outp); -+ } else -+ PUTCHAR(0, *outp); -+ -+ /* -+ * Copy the data in outp -+ */ -+ BCOPY(ets->data + ets->offset, *outp, size); -+ INCPTR(size, *outp); -+ -+ /* -+ * Copy the packet in retransmission buffer -+ */ -+ BCOPY(start, &ets->rtx[0], *outp - start); -+ ets->rtx_len = *outp - start; -+ -+ ets->offset += size; -+ -+ if (ets->offset >= ets->datalen) { -+ -+ /* -+ * The whole message has been sent -+ */ -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->offset = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Get the sent packet from the retransmission buffer -+ */ -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp) -+{ -+ BCOPY(ets->rtx, *outp, ets->rtx_len); -+ INCPTR(ets->rtx_len, *outp); -+} -+ -+/* -+ * Verify a certificate. -+ * Most of the work (signatures and issuer attributes checking) -+ * is done by ssl; we check the CN in the peer certificate -+ * against the peer name. -+ */ -+int ssl_verify_callback(int preverify_ok, X509_STORE_CTX * ctx) -+{ -+ char subject[256]; -+ char cn_str[256]; -+ X509 *peer_cert; -+ int err, depth; -+ int ok = preverify_ok; -+ SSL *ssl; -+ struct eaptls_session *ets; -+ -+ peer_cert = X509_STORE_CTX_get_current_cert(ctx); -+ err = X509_STORE_CTX_get_error(ctx); -+ depth = X509_STORE_CTX_get_error_depth(ctx); -+ -+ dbglog("certificate verify depth: %d", depth); -+ -+ if (auth_required && !ok) { -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ dbglog("Certificate verification error:\n depth: %d CN: %s" -+ "\n err: %d (%s)\n", depth, cn_str, err, -+ X509_verify_cert_error_string(err)); -+ -+ return 0; -+ } -+ -+ ssl = X509_STORE_CTX_get_ex_data(ctx, -+ SSL_get_ex_data_X509_STORE_CTX_idx()); -+ -+ ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0); -+ -+ if (ets == NULL) { -+ error("Error: SSL_get_ex_data returned NULL"); -+ return 0; -+ } -+ -+ log_ssl_errors(); -+ -+ if (!depth) { /* This is the peer certificate */ -+ -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ /* -+ * If acting as client and the name of the server wasn't specified -+ * explicitely, we can't verify the server authenticity -+ */ -+ if (!ets->peer[0]) { -+ warn("Peer name not specified: no check"); -+ return 1; -+ } -+ -+ /* -+ * Check the CN -+ */ -+ if (strcmp(cn_str, ets->peer)) { -+ error -+ ("Certificate verification error: CN (%s) != peer_name (%s)", -+ cn_str, ets->peer); -+ return 0; -+ } -+ -+ warn("Certificate CN: %s , peer name %s", cn_str, ets->peer); -+ -+ /* -+ * If a peer certificate file was specified, here we check it -+ */ -+ if (ets->peercertfile[0]) { -+ if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert) -+ != 0) { -+ error -+ ("Peer certificate doesn't match stored certificate"); -+ return 0; -+ } -+ } -+ } -+ -+ return 1; -+} -+ -+/* -+ * Compare a certificate with the one stored in a file -+ */ -+int ssl_cmp_certs(char *filename, X509 * a) -+{ -+ X509 *b; -+ int ret; -+ -+ if (!(b = get_X509_from_file(filename))) -+ return 1; -+ -+ ret = X509_cmp(a, b); -+ X509_free(b); -+ -+ return ret; -+ -+} -+ -+X509 *get_X509_from_file(char *filename) -+{ -+ FILE *fp; -+ X509 *ret; -+ -+ if (!(fp = fopen(filename, "r"))) -+ return NULL; -+ -+ ret = PEM_read_X509(fp, NULL, NULL, NULL); -+ -+ fclose(fp); -+ -+ return ret; -+} -+ -+/* -+ * Every sent & received message this callback function is invoked, -+ * so we know when alert messages have arrived or are sent and -+ * we can print debug information about TLS handshake. -+ */ -+void -+ssl_msg_callback(int write_p, int version, int content_type, -+ const void *buf, size_t len, SSL * ssl, void *arg) -+{ -+ char string[256]; -+ struct eaptls_session *ets = (struct eaptls_session *)arg; -+ unsigned char code; -+ -+ if(write_p) -+ strcpy(string, " -> "); -+ else -+ strcpy(string, " <- "); -+ -+ -+ switch(content_type) { -+ -+ case SSL3_RT_ALERT: -+ strcat(string, "Alert: "); -+ code = ((const unsigned char *)buf)[1]; -+ -+ if (write_p) { -+ ets->alert_sent = 1; -+ ets->alert_sent_desc = code; -+ } else { -+ ets->alert_recv = 1; -+ ets->alert_recv_desc = code; -+ } -+ -+ strcat(string, SSL_alert_desc_string_long(code)); -+ break; -+ -+ case SSL3_RT_CHANGE_CIPHER_SPEC: -+ strcat(string, "ChangeCipherSpec"); -+ break; -+ -+ case SSL3_RT_HANDSHAKE: -+ -+ strcat(string, "Handshake: "); -+ code = ((const unsigned char *)buf)[0]; -+ -+ switch(code) { -+ case SSL3_MT_HELLO_REQUEST: -+ strcat(string,"Hello Request"); -+ break; -+ case SSL3_MT_CLIENT_HELLO: -+ strcat(string,"Client Hello"); -+ break; -+ case SSL3_MT_SERVER_HELLO: -+ strcat(string,"Server Hello"); -+ break; -+ case SSL3_MT_CERTIFICATE: -+ strcat(string,"Certificate"); -+ break; -+ case SSL3_MT_SERVER_KEY_EXCHANGE: -+ strcat(string,"Server Key Exchange"); -+ break; -+ case SSL3_MT_CERTIFICATE_REQUEST: -+ strcat(string,"Certificate Request"); -+ break; -+ case SSL3_MT_SERVER_DONE: -+ strcat(string,"Server Hello Done"); -+ break; -+ case SSL3_MT_CERTIFICATE_VERIFY: -+ strcat(string,"Certificate Verify"); -+ break; -+ case SSL3_MT_CLIENT_KEY_EXCHANGE: -+ strcat(string,"Client Key Exchange"); -+ break; -+ case SSL3_MT_FINISHED: -+ strcat(string,"Finished"); -+ break; -+ -+ default: -+ sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); -+ } -+ break; -+ -+ default: -+ sprintf( string, "SSL message contains unknown content type: %d", content_type ); -+ -+ } -+ -+ /* Alert messages must always be displayed */ -+ if(content_type == SSL3_RT_ALERT) -+ error("%s", string); -+ else -+ dbglog("%s", string); -+} -+ -diff --git a/pppd/eap-tls.h b/pppd/eap-tls.h -new file mode 100644 -index 0000000..2d45a0b ---- /dev/null -+++ b/pppd/eap-tls.h -@@ -0,0 +1,107 @@ -+/* -+ * eap-tls.h -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#ifndef __EAP_TLS_H__ -+#define __EAP_TLS_H__ -+ -+#include "eap.h" -+ -+#include -+#include -+#include -+ -+#define EAP_TLS_FLAGS_LI 128 /* length included flag */ -+#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ -+#define EAP_TLS_FLAGS_START 32 /* start flag */ -+ -+#define EAP_TLS_MAX_LEN 65536 /* max eap tls packet size */ -+ -+struct eaptls_session -+{ -+ u_char *data; /* buffered data */ -+ int datalen; /* buffered data len */ -+ int offset; /* from where to send */ -+ int tlslen; /* total length of tls data */ -+ bool frag; /* packet is fragmented */ -+ SSL_CTX *ctx; -+ SSL *ssl; /* ssl connection */ -+ BIO *from_ssl; -+ BIO *into_ssl; -+ char peer[MAXWORDLEN]; /* peer name */ -+ char peercertfile[MAXWORDLEN]; -+ bool alert_sent; -+ u_char alert_sent_desc; -+ bool alert_recv; -+ u_char alert_recv_desc; -+ char rtx[65536]; /* retransmission buffer */ -+ int rtx_len; -+ int mtu; /* unit mtu */ -+}; -+ -+typedef struct pw_cb_data -+{ -+ const void *password; -+ const char *prompt_info; -+} PW_CB_DATA; -+ -+ -+int ssl_verify_callback(int, X509_STORE_CTX *); -+void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -+ size_t len, SSL * ssl, void *arg); -+ -+X509 *get_X509_from_file(char *filename); -+int ssl_cmp_certs(char *filename, X509 * a); -+ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, -+ char *certfile, char *peer_certfile, char *privkeyfile); -+int eaptls_init_ssl_server(eap_state * esp); -+int eaptls_init_ssl_client(eap_state * esp); -+void eaptls_free_session(struct eaptls_session *ets); -+ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); -+int eaptls_send(struct eaptls_session *ets, u_char ** outp); -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); -+ -+int get_eaptls_secret(int unit, char *client, char *server, -+ char *clicertfile, char *servcertfile, char *cacertfile, -+ char *pkfile, int am_server); -+ -+#ifdef MPPE -+#include "mppe.h" /* MPPE_MAX_KEY_LEN */ -+extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; -+extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; -+extern int mppe_keys_set; -+ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); -+ -+#endif -+ -+#endif -diff --git a/pppd/eap.c b/pppd/eap.c -index faced53..e2270af 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -43,6 +43,11 @@ - * Based on draft-ietf-pppext-eap-srp-03.txt. - */ - -+/* -+ * Modification by Beniamino Galvani, Mar 2005 -+ * Implemented EAP-TLS authentication -+ */ -+ - #define RCSID "$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $" - - /* -@@ -62,8 +67,12 @@ - - #include "pppd.h" - #include "pathnames.h" --#include "md5.h" - #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#else -+#include "md5.h" -+#endif /* USE_EAPTLS */ - - #ifdef USE_SRP - #include -@@ -209,6 +218,9 @@ int unit; - esp->es_server.ea_id = (u_char)(drand48() * 0x100); - esp->es_client.ea_timeout = EAP_DEFREQTIME; - esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; -+#ifdef USE_EAPTLS -+ esp->es_client.ea_using_eaptls = 0; -+#endif /* USE_EAPTLS */ - } - - /* -@@ -268,7 +280,7 @@ eap_state *esp; - u_char *outp; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_FAILURE, outp); -@@ -293,7 +305,7 @@ eap_state *esp; - u_char *outp; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_SUCCESS, outp); -@@ -436,8 +448,16 @@ int status; - u_char vals[2]; - struct b64state bs; - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ int secret_len; -+ char secret[MAXWORDLEN]; -+#endif /* USE_EAPTLS */ - - esp->es_server.ea_timeout = esp->es_savedtime; -+#ifdef USE_EAPTLS -+ esp->es_server.ea_prev_state = esp->es_server.ea_state; -+#endif /* USE_EAPTLS */ - switch (esp->es_server.ea_state) { - case eapBadAuth: - return; -@@ -562,9 +582,81 @@ int status; - break; - } - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ if (!get_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, secret, &secret_len, 1)) { -+ -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ /* Initialize ssl session */ -+ if(!eaptls_init_ssl_server(esp)) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecv: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->alert_sent) { -+ esp->es_server.ea_state = eapTlsSendAlert; -+ break; -+ } -+ -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsSendAck; -+ else -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSend: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(SSL_is_init_finished(ets->ssl)) { -+ esp->es_server.ea_state = eapTlsRecvClient; -+ break; -+ } -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsRecvAck; -+ else -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsSendAck: -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecvAck: -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSendAlert: -+ esp->es_server.ea_state = eapTlsRecvAlertAck; -+ break; -+#endif /* USE_EAPTLS */ -+ - case eapSRP1: - #ifdef USE_SRP - ts = (struct t_server *)esp->es_server.ea_session; -@@ -681,7 +773,7 @@ eap_state *esp; - } - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_REQUEST, outp); -@@ -718,6 +810,30 @@ eap_state *esp; - INCPTR(esp->es_server.ea_namelen, outp); - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(EAP_TLS_FLAGS_START, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSend: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAck: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAlert: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case eapSRP1: - PUTCHAR(EAPT_SRP, outp); -@@ -904,11 +1020,57 @@ static void - eap_server_timeout(arg) - void *arg; - { -+#ifdef USE_EAPTLS -+ u_char *outp; -+ u_char *lenloc; -+ int outlen; -+#endif /* USE_EAPTLS */ -+ - eap_state *esp = (eap_state *) arg; - - if (!eap_server_active(esp)) - return; - -+#ifdef USE_EAPTLS -+ switch(esp->es_server.ea_prev_state) { -+ -+ /* -+ * In eap-tls the state changes after a request, so we return to -+ * previous state ... -+ */ -+ case(eapTlsStart): -+ case(eapTlsSendAck): -+ esp->es_server.ea_state = esp->es_server.ea_prev_state; -+ break; -+ -+ /* -+ * ... or resend the stored data -+ */ -+ case(eapTlsSend): -+ case(eapTlsSendAlert): -+ outp = outpacket_buf; -+ MAKEHEADER(outp, PPP_EAP); -+ PUTCHAR(EAP_REQUEST, outp); -+ PUTCHAR(esp->es_server.ea_id, outp); -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ eaptls_retransmit(esp->es_server.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN); -+ esp->es_server.ea_requests++; -+ -+ if (esp->es_server.ea_timeout > 0) -+ TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout); -+ -+ return; -+ default: -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - /* EAP ID number must not change on timeout. */ - eap_send_request(esp); - } -@@ -1081,7 +1243,7 @@ int namelen; - int msglen; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_RESPONSE, outp); -@@ -1117,7 +1279,7 @@ int lenstr; - int msglen; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_RESPONSE, outp); -@@ -1148,7 +1310,7 @@ u_char *str; - int msglen; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_RESPONSE, outp); -@@ -1166,6 +1328,81 @@ u_char *str; - } - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+/* -+ * Send an EAP-TLS response message with tls data -+ */ -+static void -+eap_tls_response(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ /* -+ If the id in the request is unchanged, we must retransmit -+ the old data -+ */ -+ if(id == esp->es_client.ea_id) -+ eaptls_retransmit(esp->es_client.ea_session, &outp); -+ else -+ eaptls_send(esp->es_client.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ -+ esp->es_client.ea_id = id; -+ -+} -+ -+/* -+ * Send an EAP-TLS ack -+ */ -+static void -+eap_tls_sendack(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ esp->es_client.ea_id = id; -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ -+} -+#endif /* USE_EAPTLS */ -+ - static void - eap_send_nak(esp, id, type) - eap_state *esp; -@@ -1320,6 +1557,11 @@ int len; - char rhostname[256]; - MD5_CTX mdContext; - u_char hash[MD5_SIGNATURE_SIZE]; -+#ifdef USE_EAPTLS -+ u_char flags; -+ struct eaptls_session *ets = esp->es_client.ea_session; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - struct t_client *tc; - struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1456,6 +1698,90 @@ int len; - esp->es_client.ea_namelen); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ -+ switch(esp->es_client.ea_state) { -+ -+ case eapListen: -+ -+ GETCHAR(flags, inp); -+ if(flags & EAP_TLS_FLAGS_START){ -+ -+ esp->es_client.ea_using_eaptls = 1; -+ -+ if (explicit_remote){ -+ esp->es_client.ea_peer = strdup(remote_name); -+ esp->es_client.ea_peerlen = strlen(remote_name); -+ } else -+ esp->es_client.ea_peer = NULL; -+ -+ /* Init ssl session */ -+ if(!eaptls_init_ssl_client(esp)) { -+ dbglog("cannot init ssl"); -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ ets = esp->es_client.ea_session; -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ break; -+ } -+ -+ /* The server has sent a bad start packet. */ -+ eap_send_nak(esp, id, EAPT_TLS); -+ break; -+ -+ case eapTlsRecvAck: -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ break; -+ -+ case eapTlsRecv: -+ eaptls_receive(ets, inp, len); -+ -+ if(ets->frag) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecv; -+ break; -+ } -+ -+ if(ets->alert_recv) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvFailure; -+ break; -+ } -+ -+ /* Check if TLS handshake is finished */ -+ if(SSL_is_init_finished(ets->ssl)){ -+#ifdef MPPE -+ eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); -+#endif -+ eaptls_free_session(ets); -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvSuccess; -+ break; -+ } -+ -+ eap_tls_response(esp,id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ -+ break; -+ -+ default: -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case EAPT_SRP: - if (len < 1) { -@@ -1737,6 +2063,11 @@ int len; - u_char dig[SHA_DIGESTSIZE]; - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ u_char flags; -+#endif /* USE_EAPTLS */ -+ - if (esp->es_server.ea_id != id) { - dbglog("EAP: discarding Response %d; expected ID %d", id, - esp->es_server.ea_id); -@@ -1776,6 +2107,60 @@ int len; - eap_figure_next_state(esp, 0); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ switch(esp->es_server.ea_state) { -+ -+ case eapTlsRecv: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ eap_figure_next_state(esp, -+ eaptls_receive(esp->es_server.ea_session, inp, len)); -+ -+ if(ets->alert_recv) { -+ eap_send_failure(esp); -+ break; -+ } -+ break; -+ -+ case eapTlsRecvAck: -+ if(len > 1) { -+ dbglog("EAP-TLS ACK with extra data"); -+ } -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsRecvClient: -+ /* Receive authentication response from client */ -+ -+ GETCHAR(flags, inp); -+ -+ if(len == 1 && !flags) { /* Ack = ok */ -+#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); -+#endif -+ eap_send_success(esp); -+ } -+ else { /* failure */ -+ eaptls_receive(esp->es_server.ea_session, inp, len); -+ warn("Server authentication failed"); -+ eap_send_failure(esp); -+ } -+ -+ eaptls_free_session(esp->es_server.ea_session); -+ -+ break; -+ -+ case eapTlsRecvAlertAck: -+ eap_send_failure(esp); -+ break; -+ -+ default: -+ eap_figure_next_state(esp, 1); -+ break; -+ } -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NOTIFICATION: - dbglog("EAP unexpected Notification; response discarded"); - break; -@@ -1807,6 +2192,13 @@ int len; - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ /* Send EAP-TLS start packet */ -+ case EAPT_TLS: -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+#endif /* USE_EAPTLS */ -+ - default: - dbglog("EAP: peer requesting unknown Type %d", vallen); - switch (esp->es_server.ea_state) { -@@ -2018,13 +2410,27 @@ u_char *inp; - int id; - int len; - { -- if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) { -+ if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp) -+#ifdef USE_EAPTLS -+ && esp->es_client.ea_state != eapTlsRecvSuccess -+#endif /* USE_EAPTLS */ -+ ) { - dbglog("EAP unexpected success message in state %s (%d)", - eap_state_name(esp->es_client.ea_state), - esp->es_client.ea_state); - return; - } - -+#ifdef USE_EAPTLS -+ if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != -+ eapTlsRecvSuccess) { -+ dbglog("EAP-TLS unexpected success message in state %s (%d)", -+ eap_state_name(esp->es_client.ea_state), -+ esp->es_client.ea_state); -+ return; -+ } -+#endif /* USE_EAPTLS */ -+ - if (esp->es_client.ea_timeout > 0) { - UNTIMEOUT(eap_client_timeout, (void *)esp); - } -@@ -2150,6 +2556,9 @@ void *arg; - int code, id, len, rtype, vallen; - u_char *pstart; - u_int32_t uval; -+#ifdef USE_EAPTLS -+ u_char flags; -+#endif /* USE_EAPTLS */ - - if (inlen < EAP_HEADERLEN) - return (0); -@@ -2214,6 +2623,24 @@ void *arg; - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_SRP: - if (len < 3) - goto truncated; -@@ -2325,6 +2752,25 @@ void *arg; - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NAK: - if (len <= 0) { - printer(arg, " "); -diff --git a/pppd/eap.h b/pppd/eap.h -index 199d184..3fa5391 100644 ---- a/pppd/eap.h -+++ b/pppd/eap.h -@@ -84,6 +84,16 @@ enum eap_state_code { - eapClosed, /* Authentication not in use */ - eapListen, /* Client ready (and timer running) */ - eapIdentify, /* EAP Identify sent */ -+ eapTlsStart, /* Send EAP-TLS start packet */ -+ eapTlsRecv, /* Receive EAP-TLS tls data */ -+ eapTlsSendAck, /* Send EAP-TLS ack */ -+ eapTlsSend, /* Send EAP-TLS tls data */ -+ eapTlsRecvAck, /* Receive EAP-TLS ack */ -+ eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ -+ eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ -+ eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ -+ eapTlsRecvSuccess, /* Receive EAP success */ -+ eapTlsRecvFailure, /* Receive EAP failure */ - eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ - eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ - eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ -@@ -95,9 +105,18 @@ enum eap_state_code { - - #define EAP_STATES \ - "Initial", "Pending", "Closed", "Listen", "Identify", \ -+ "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ -+ "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ - "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" - --#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#ifdef USE_EAPTLS -+#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial ||\ -+ (esp)->es_client.ea_state != eapPending ||\ -+ (esp)->es_client.ea_state != eapClosed) -+#else -+#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#endif /* USE_EAPTLS */ -+ - #define eap_server_active(esp) \ - ((esp)->es_server.ea_state >= eapIdentify && \ - (esp)->es_server.ea_state <= eapMD5Chall) -@@ -112,11 +131,17 @@ struct eap_auth { - u_short ea_namelen; /* Length of our name */ - u_short ea_peerlen; /* Length of peer's name */ - enum eap_state_code ea_state; -+#ifdef USE_EAPTLS -+ enum eap_state_code ea_prev_state; -+#endif - u_char ea_id; /* Current id */ - u_char ea_requests; /* Number of Requests sent/received */ - u_char ea_responses; /* Number of Responses */ - u_char ea_type; /* One of EAPT_* */ - u_int32_t ea_keyflags; /* SRP shared key usage flags */ -+#ifdef USE_EAPTLS -+ bool ea_using_eaptls; -+#endif - }; - - /* -@@ -139,7 +164,12 @@ typedef struct eap_state { - * Timeouts. - */ - #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ -+#ifdef USE_EAPTLS -+#define EAP_DEFTRANSMITS 30 /* max # times to transmit */ -+ /* certificates can be long ... */ -+#else - #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ -+#endif /* USE_EAPTLS */ - #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ - #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ - -diff --git a/pppd/md5.c b/pppd/md5.c -index f1291ce..2ee0c80 100644 ---- a/pppd/md5.c -+++ b/pppd/md5.c -@@ -33,6 +33,8 @@ - *********************************************************************** - */ - -+#ifndef USE_EAPTLS -+ - #include - #include "md5.h" - -@@ -305,3 +307,4 @@ UINT4 *in; - ** End of md5.c ** - ******************************** (cut) ******************************** - */ -+#endif /* USE_EAPTLS */ -diff --git a/pppd/md5.h b/pppd/md5.h -index 71e8b00..14d7121 100644 ---- a/pppd/md5.h -+++ b/pppd/md5.h -@@ -36,6 +36,7 @@ - ** documentation and/or software. ** - *********************************************************************** - */ -+#ifndef USE_EAPTLS - - #ifndef __MD5_INCLUDE__ - -@@ -63,3 +64,5 @@ void MD5_Final (unsigned char hash[], MD5_CTX *mdContext); - - #define __MD5_INCLUDE__ - #endif /* __MD5_INCLUDE__ */ -+ -+#endif /* USE_EAPTLS */ -diff --git a/pppd/options.c b/pppd/options.c -index 8e62635..6915b2d 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -120,6 +120,10 @@ bool dump_options; /* print out option values */ - bool dryrun; /* print out option values and exit */ - char *domain; /* domain name set by domain option */ - int child_wait = 5; /* # seconds to wait for children at exit */ -+#ifdef USE_EAPTLS -+bool only_update_crl_server = 0; /* update server crl and exit */ -+bool only_update_crl_client = 0; /* update client crl and exit */ -+#endif /* USE_EAPTLS */ - struct userenv *userenv_list; /* user environment variables */ - - #ifdef MAXOCTETS -@@ -338,6 +342,12 @@ option_t general_options[] = { - { "mo-timeout", o_int, &maxoctets_timeout, - "Check for traffic limit every N seconds", OPT_PRIO | OPT_LLIMIT | 1 }, - #endif -+#ifdef USE_EAPTLS -+ { "only-update-crl-server", o_bool, &only_update_crl_server, -+ "Update server CA CRLs and exit", 1 }, -+ { "only-update-crl-client", o_bool, &only_update_crl_client, -+ "Update client CA CRLs and exit", 1 }, -+#endif /* USE_EAPTLS */ - - { NULL } - }; -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index 24e010c..6275df6 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -22,6 +22,13 @@ - #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" - #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" - #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" -+ -+#ifdef USE_EAPTLS -+#define _PATH_EAPTLSCLIFILE _ROOT_PATH "/etc/ppp/eaptls-client" -+#define _PATH_EAPTLSSERVFILE _ROOT_PATH "/etc/ppp/eaptls-server" -+#define _PATH_OPENSSLCONFFILE _ROOT_PATH "/etc/ppp/openssl.cnf" -+#endif /* USE_EAPTLS */ -+ - #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" - #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" - #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index b474a19..760cad4 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -4,6 +4,9 @@ CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS = -shared - INSTALL = install - -+# EAP-TLS -+CFLAGS += -DUSE_EAPTLS=1 -+ - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 -diff --git a/pppd/plugins/passprompt.c b/pppd/plugins/passprompt.c -index babb6dc..6ba73ca 100644 ---- a/pppd/plugins/passprompt.c -+++ b/pppd/plugins/passprompt.c -@@ -107,4 +107,7 @@ void plugin_init(void) - { - add_options(options); - pap_passwd_hook = promptpass; -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = promptpass; -+#endif - } -diff --git a/pppd/plugins/passwordfd.c b/pppd/plugins/passwordfd.c -index d718f3b..c3f9793 100644 ---- a/pppd/plugins/passwordfd.c -+++ b/pppd/plugins/passwordfd.c -@@ -79,4 +79,8 @@ void plugin_init (void) - - chap_check_hook = pwfd_check; - chap_passwd_hook = pwfd_passwd; -+ -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = pwfd_passwd; -+#endif - } -diff --git a/pppd/pppd.h b/pppd/pppd.h -index 47e4d9a..de271c1 100644 ---- a/pppd/pppd.h -+++ b/pppd/pppd.h -@@ -324,6 +324,10 @@ extern bool dump_options; /* print out option values */ - extern bool dryrun; /* check everything, print options, exit */ - extern int child_wait; /* # seconds to wait for children at end */ - -+#ifdef USE_EAPTLS -+extern char *crl_dir; -+#endif /* USE_EAPTLS */ -+ - #ifdef MAXOCTETS - extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ - extern int maxoctets_dir; /* Direction : -@@ -738,6 +742,10 @@ extern int (*chap_check_hook) __P((void)); - extern int (*chap_passwd_hook) __P((char *user, char *passwd)); - extern void (*multilink_join_hook) __P((void)); - -+#ifdef USE_EAPTLS -+extern int (*eaptls_passwd_hook) __P((char *user, char *passwd)); -+#endif -+ - /* Let a plugin snoop sent and received packets. Useful for L2TP */ - extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); - extern void (*snoop_send_hook) __P((unsigned char *p, int len)); --- -1.8.3.1 - diff --git a/0026-Revert-pppd-rebase-EAP-TLS-patch-v0.994.patch b/0026-Revert-pppd-rebase-EAP-TLS-patch-v0.994.patch deleted file mode 100644 index 515a5f4..0000000 --- a/0026-Revert-pppd-rebase-EAP-TLS-patch-v0.994.patch +++ /dev/null @@ -1,3046 +0,0 @@ -From 1c5d747dac840a633aebd3eef882b11321993009 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 20 Jun 2014 10:26:32 +0200 -Subject: [PATCH 26/27] Revert "pppd: rebase EAP-TLS patch v0.994" - -This reverts commit 044a5b1e5d878c519143b71a44b3d5b0ca91de3b. ---- - README.eap-tls | 169 ------- - etc.ppp/eaptls-client | 10 - - etc.ppp/eaptls-server | 11 - - etc.ppp/openssl.cnf | 14 - - linux/Makefile.top | 6 +- - pppd/Makefile.linux | 12 - - pppd/auth.c | 414 +-------------- - pppd/ccp.c | 20 +- - pppd/chap-md5.c | 4 - - pppd/eap-tls.c | 1174 ------------------------------------------- - pppd/eap-tls.h | 107 ---- - pppd/eap.c | 462 +---------------- - pppd/eap.h | 32 +- - pppd/md5.c | 3 - - pppd/md5.h | 3 - - pppd/options.c | 10 - - pppd/pathnames.h | 7 - - pppd/plugins/Makefile.linux | 3 - - pppd/plugins/passprompt.c | 3 - - pppd/plugins/passwordfd.c | 4 - - pppd/pppd.h | 8 - - 21 files changed, 15 insertions(+), 2461 deletions(-) - delete mode 100644 README.eap-tls - delete mode 100644 etc.ppp/eaptls-client - delete mode 100644 etc.ppp/eaptls-server - delete mode 100644 etc.ppp/openssl.cnf - delete mode 100644 pppd/eap-tls.c - delete mode 100644 pppd/eap-tls.h - -diff --git a/README.eap-tls b/README.eap-tls -deleted file mode 100644 -index 0a4fee9..0000000 ---- a/README.eap-tls -+++ /dev/null -@@ -1,169 +0,0 @@ --EAP-TLS authentication support for PPP --====================================== -- --1. Intro -- -- The Extensible Authentication Protocol (EAP; RFC 3748) is a -- security protocol that can be used with PPP. It provides a means -- to plug in multiple optional authentication methods. -- -- Transport Level Security (TLS; RFC 2246) provides for mutual -- authentication, integrity-protected ciphersuite negotiation and -- key exchange between two endpoints. It also provides for optional -- MPPE encryption. -- -- EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets, -- allowing TLS mutual authentication to be used as a generic EAP -- mechanism. It also provides optional encryption using the MPPE -- protocol. -- -- This patch provide EAP-TLS support to pppd. -- This authentication method can be used in both client or server -- mode. -- --2. Building -- -- To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org) -- is required. Any version from 0.9.7 should work. -- -- Configure, compile, and install as usual. -- --3. Configuration -- -- On the client side there are two ways to configure EAP-TLS: -- -- 1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters -- -- 2. edit the /etc/ppp/eaptls-client file. -- Insert a line for each system with which you use EAP-TLS. -- The line is composed of this fields separated by tab: -- -- - Client name -- The name used by the client for authentication, can be * -- - Server name -- The name of the server, can be * -- - Client certificate file -- The file containing the certificate chain for the -- client in PEM format -- - Server certificate file -- If you want to specify the certificate that the -- server is allowed to use, put the certificate file name. -- Else put a dash '-'. -- - CA certificate file -- The file containing the trusted CA certificates in PEM -- format. -- - Client private key file -- The file containing the client private key in PEM format. -- -- -- On the server side edit the /etc/ppp/eaptls-server file. -- Insert a line for each system with which you use EAP-TLS. -- The line is composed of this fields separated by tab: -- -- - Client name -- The name used by the client for authentication, can be * -- - Server name -- The name of the server, can be * -- - Client certificate file -- If you want to specify the certificate that the -- client is allowed to use, put the certificate file name. -- Else put a dash '-'. -- - Server certificate file -- The file containing the certificate chain for the -- server in PEM format -- - CA certificate file -- The file containing the trusted CA certificates in PEM -- format. -- - Client private key file -- The file containing the server private key in PEM format. -- - addresses -- A list of IP addresses the client is allowed to use. -- -- -- OpenSSL engine support is included starting with v0.95 of this patch. -- Currently the only engine tested is the 'pkcs11' engine (hardware token -- support). To use the 'pksc11' engine: -- - Use a special private key fileiname in the /etc/ppp/eaptls-client file: -- : -- e.g. -- pkcs11:123456 -- -- - The certificate can also be loaded from the 'pkcs11' engine using -- a special client certificate filename in the /etc/ppp/eaptls-client file: -- : -- e.g. -- pkcs11:123456 -- -- - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior -- to starting 'pppd'. A sample openssl.cnf file is -- -- openssl_conf = openssl_def -- -- [ openssl_def ] -- engines = engine_section -- -- [ engine_section ] -- pkcs11 = pkcs11_section -- -- [ pkcs11_section ] -- engine_id = pkcs11 -- dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -- MODULE_PATH = /usr/lib64/libeTPkcs11.so -- init = 0 -- -- - There are two ways to specify a password/PIN for the PKCS11 engine: -- - inside the openssl.cnf file using -- PIN = your-secret-pin -- Note The keyword 'PIN' is case sensitive! -- - Using the 'password' in the ppp options file. -- From v0.97 of the eap-tls patch the password can also be supplied -- using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c -- for an example). -- -- --4. Options -- -- These pppd options are available: -- -- ca -- Use the CA public certificate found in in PEM format -- cert -- Use the client public certificate found in in PEM format -- or in engine:engine_id format -- key -- Use the client private key found in in PEM format -- or in engine:engine_id format -- crl-dir -- Use CRL files from dir. It contains CRL files in PEM -- format and each file contains a CRL. The files are looked up -- by the issuer name hash value. Use the c_rehash utility -- to create necessary links. -- need-peer-eap -- If the peer doesn't ask us to authenticate or doesn't use eap -- to authenticate us, disconnect. -- -- Note: -- password-encrypted certificates can be used as of v0.94 of this -- patch. The password for the eap-tls.key file is specified using -- the regular -- password .... -- statement in the ppp options file, or by using the appropriate -- plugin which supplies a 'eaptls_passwd_hook' routine. -- --5. Connecting -- -- If you're setting up a pppd server, edit the EAP-TLS configuration file -- as written above and then run pppd with the 'auth' option to authenticate -- the client. The EAP-TLS method will be used if the other eap methods can't -- be used (no secrets). -- -- If you're setting up a client, edit the configuration file and then run -- pppd with 'remotename' option to specify the server name. Add the -- 'need-peer-eap' option if you want to be sure the peer ask you to -- authenticate (and to use eap) and to disconnect if it doesn't. -- --6. Notes -- -- This is experimental code. -- Send suggestions and comments to Jan Just Keijser -- -diff --git a/etc.ppp/eaptls-client b/etc.ppp/eaptls-client -deleted file mode 100644 -index 7782f0e..0000000 ---- a/etc.ppp/eaptls-client -+++ /dev/null -@@ -1,10 +0,0 @@ --# Parameters for authentication using EAP-TLS (client) -- --# client name (can be *) --# server name (can be *) --# client certificate file (required) --# server certificate file (optional, if unused put '-') --# CA certificate file (required) --# client private key file (required) -- --#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff --git a/etc.ppp/eaptls-server b/etc.ppp/eaptls-server -deleted file mode 100644 -index fa53cbd..0000000 ---- a/etc.ppp/eaptls-server -+++ /dev/null -@@ -1,11 +0,0 @@ --# Parameters for authentication using EAP-TLS (server) -- --# client name (can be *) --# server name (can be *) --# client certificate file (optional, if unused put '-') --# server certificate file (required) --# CA certificate file (required) --# server private key file (required) --# allowed addresses (required, can be *) -- --#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff --git a/etc.ppp/openssl.cnf b/etc.ppp/openssl.cnf -deleted file mode 100644 -index dd32f30..0000000 ---- a/etc.ppp/openssl.cnf -+++ /dev/null -@@ -1,14 +0,0 @@ --openssl_conf = openssl_def -- --[ openssl_def ] --engines = engine_section -- --[ engine_section ] --pkcs11 = pkcs11_section -- --[ pkcs11_section ] --engine_id = pkcs11 --dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so --MODULE_PATH = /usr/lib64/libeTPkcs11.so --init = 0 -- -diff --git a/linux/Makefile.top b/linux/Makefile.top -index 9a8945a..f42efd5 100644 ---- a/linux/Makefile.top -+++ b/linux/Makefile.top -@@ -28,7 +28,7 @@ install-progs: - cd pppdump; $(MAKE) $(MFLAGS) install - - install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ -- $(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client -+ $(ETCDIR)/chap-secrets - - install-devel: - cd pppd; $(MAKE) $(MFLAGS) install-devel -@@ -39,10 +39,6 @@ $(ETCDIR)/pap-secrets: - $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ - $(ETCDIR)/chap-secrets: - $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ --$(ETCDIR)/eaptls-server: -- $(INSTALL) -c -m 600 etc.ppp/eaptls-server $@ --$(ETCDIR)/eaptls-client: -- $(INSTALL) -c -m 600 etc.ppp/eaptls-client $@ - - $(BINDIR): - $(INSTALL) -d -m 755 $@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 534ccc2..943cf83 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -79,9 +79,6 @@ CBCP=y - # Use libutil - USE_LIBUTIL=y - --# Enable EAP-TLS authentication (requires libssl and libcrypto) --USE_EAPTLS=y -- - MAXOCTETS=y - - INCLUDE_DIRS= -I../include -@@ -121,15 +118,6 @@ HEADERS += sha1.h - PPPDOBJS += sha1.o - endif - --# EAP-TLS --ifdef USE_EAPTLS --CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include --LIBS += -lssl -lcrypto --PPPDSRC += eap-tls.c --HEADERS += eap-tls.h --PPPDOBJS += eap-tls.o --endif -- - ifdef HAS_SHADOW - CFLAGS += -DHAS_SHADOW - #LIBS += -lshadow $(LIBS) -diff --git a/pppd/auth.c b/pppd/auth.c -index 88cbdb6..9e957fa 100644 ---- a/pppd/auth.c -+++ b/pppd/auth.c -@@ -109,9 +109,6 @@ - #include "upap.h" - #include "chap-new.h" - #include "eap.h" --#ifdef USE_EAPTLS --#include "eap-tls.h" --#endif - #ifdef CBCP_SUPPORT - #include "cbcp.h" - #endif -@@ -186,11 +183,6 @@ int (*chap_check_hook) __P((void)) = NULL; - /* Hook for a plugin to get the CHAP password for authenticating us */ - int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; - --#ifdef USE_EAPTLS --/* Hook for a plugin to get the EAP-TLS password for authenticating us */ --int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL; --#endif -- - /* Hook for a plugin to say whether it is OK if the peer - refuses to authenticate. */ - int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -246,13 +238,6 @@ bool explicit_remote = 0; /* User specified explicit remote name */ - bool explicit_user = 0; /* Set if "user" option supplied */ - bool explicit_passwd = 0; /* Set if "password" option supplied */ - char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ --#ifdef USE_EAPTLS --char *cacert_file = NULL; /* CA certificate file (pem format) */ --char *cert_file = NULL; /* client certificate file (pem format) */ --char *privkey_file = NULL; /* client private key file (pem format) */ --char *crl_dir = NULL; /* directory containing CRL files */ --bool need_peer_eap = 0; /* Require peer to authenticate us */ --#endif - - static char *uafname; /* name of most recent +ua file */ - -@@ -269,19 +254,6 @@ static int have_pap_secret __P((int *)); - static int have_chap_secret __P((char *, char *, int, int *)); - static int have_srp_secret __P((char *client, char *server, int need_ip, - int *lacks_ipp)); -- --#ifdef USE_EAPTLS --static int have_eaptls_secret_server --__P((char *client, char *server, int need_ip, int *lacks_ipp)); --static int have_eaptls_secret_client __P((char *client, char *server)); --static int scan_authfile_eaptls __P((FILE * f, char *client, char *server, -- char *cli_cert, char *serv_cert, -- char *ca_cert, char *pk, -- struct wordlist ** addrs, -- struct wordlist ** opts, -- char *filename, int flags)); --#endif -- - static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); - static int scan_authfile __P((FILE *, char *, char *, char *, - struct wordlist **, struct wordlist **, -@@ -429,14 +401,6 @@ option_t auth_options[] = { - "Set telephone number(s) which are allowed to connect", - OPT_PRIV | OPT_A2LIST }, - --#ifdef USE_EAPTLS -- { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, -- { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, -- { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, -- { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, -- { "need-peer-eap", o_bool, &need_peer_eap, -- "Require the peer to authenticate us", 1 }, --#endif /* USE_EAPTLS */ - { NULL } - }; - -@@ -766,9 +730,6 @@ link_established(unit) - lcp_options *wo = &lcp_wantoptions[unit]; - lcp_options *go = &lcp_gotoptions[unit]; - lcp_options *ho = &lcp_hisoptions[unit]; --#ifdef USE_EAPTLS -- lcp_options *ao = &lcp_allowoptions[unit]; --#endif - int i; - struct protent *protp; - -@@ -803,22 +764,6 @@ link_established(unit) - } - } - --#ifdef USE_EAPTLS -- if (need_peer_eap && !ao->neg_eap) { -- warn("eap required to authenticate us but no suitable secrets"); -- lcp_close(unit, "couldn't negotiate eap"); -- status = EXIT_AUTH_TOPEER_FAILED; -- return; -- } -- -- if (need_peer_eap && !ho->neg_eap) { -- warn("peer doesn't want to authenticate us with eap"); -- lcp_close(unit, "couldn't negotiate eap"); -- status = EXIT_PEER_AUTH_FAILED; -- return; -- } --#endif -- - new_phase(PHASE_AUTHENTICATE); - auth = 0; - if (go->neg_eap) { -@@ -1172,7 +1117,7 @@ np_down(unit, proto) - UNTIMEOUT(connect_time_expired, NULL); - #ifdef MAXOCTETS - UNTIMEOUT(check_maxoctets, NULL); --#endif -+#endif - new_phase(PHASE_NETWORK); - } - } -@@ -1199,7 +1144,7 @@ check_maxoctets(arg) - - update_link_stats(ifunit); - link_stats_valid=0; -- -+ - switch(maxoctets_dir) { - case PPP_OCTETS_DIRECTION_IN: - used = link_stats.bytes_in; -@@ -1332,15 +1277,6 @@ auth_check_options() - our_name, 1, &lacks_ip); - } - --#ifdef USE_EAPTLS -- if (!can_auth && wo->neg_eap) { -- can_auth = -- have_eaptls_secret_server((explicit_remote ? remote_name : -- NULL), our_name, 1, &lacks_ip); -- -- } --#endif -- - if (auth_required && !can_auth && noauth_addrs == NULL) { - if (default_auth) { - option_error( -@@ -1395,11 +1331,7 @@ auth_reset(unit) - passwd[0] != 0 || - (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, - (explicit_remote? remote_name: NULL), 0, NULL))) || -- have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL) --#ifdef USE_EAPTLS -- || have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL)) --#endif -- ); -+ have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)); - - hadchap = -1; - if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1414,14 +1346,8 @@ auth_reset(unit) - !have_chap_secret((explicit_remote? remote_name: NULL), our_name, - 1, NULL))) && - !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, -- NULL) --#ifdef USE_EAPTLS -- && !have_eaptls_secret_server((explicit_remote? remote_name: NULL), -- our_name, 1, NULL) --#endif -- ) -+ NULL)) - go->neg_eap = 0; -- - } - - -@@ -1781,7 +1707,6 @@ have_srp_secret(client, server, need_ip, lacks_ipp) - } - - -- - /* - * get_secret - open the CHAP secret file and return the secret - * for authenticating the given client on the given server. -@@ -2434,334 +2359,3 @@ auth_script(script) - - auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); - } -- -- --#ifdef USE_EAPTLS --static int --have_eaptls_secret_server(client, server, need_ip, lacks_ipp) -- char *client; -- char *server; -- int need_ip; -- int *lacks_ipp; --{ -- FILE *f; -- int ret; -- char *filename; -- struct wordlist *addrs; -- char servcertfile[MAXWORDLEN]; -- char clicertfile[MAXWORDLEN]; -- char cacertfile[MAXWORDLEN]; -- char pkfile[MAXWORDLEN]; -- -- filename = _PATH_EAPTLSSERVFILE; -- f = fopen(filename, "r"); -- if (f == NULL) -- return 0; -- -- if (client != NULL && client[0] == 0) -- client = NULL; -- else if (server != NULL && server[0] == 0) -- server = NULL; -- -- ret = -- scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -- cacertfile, pkfile, &addrs, NULL, filename, -- 0); -- -- fclose(f); -- --/* -- if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile, -- clicertfile, pkfile)) -- ret = -1; --*/ -- -- if (ret >= 0 && need_ip && !some_ip_ok(addrs)) { -- if (lacks_ipp != 0) -- *lacks_ipp = 1; -- ret = -1; -- } -- if (addrs != 0) -- free_wordlist(addrs); -- -- return ret >= 0; --} -- -- --static int --have_eaptls_secret_client(client, server) -- char *client; -- char *server; --{ -- FILE *f; -- int ret; -- char *filename; -- struct wordlist *addrs = NULL; -- char servcertfile[MAXWORDLEN]; -- char clicertfile[MAXWORDLEN]; -- char cacertfile[MAXWORDLEN]; -- char pkfile[MAXWORDLEN]; -- -- if (client != NULL && client[0] == 0) -- client = NULL; -- else if (server != NULL && server[0] == 0) -- server = NULL; -- -- if (cacert_file && cert_file && privkey_file) -- return 1; -- -- filename = _PATH_EAPTLSCLIFILE; -- f = fopen(filename, "r"); -- if (f == NULL) -- return 0; -- -- ret = -- scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -- cacertfile, pkfile, &addrs, NULL, filename, -- 0); -- fclose(f); -- --/* -- if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile, -- servcertfile, pkfile)) -- ret = -1; --*/ -- -- if (addrs != 0) -- free_wordlist(addrs); -- -- return ret >= 0; --} -- -- --static int --scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk, -- addrs, opts, filename, flags) -- FILE *f; -- char *client; -- char *server; -- char *cli_cert; -- char *serv_cert; -- char *ca_cert; -- char *pk; -- struct wordlist **addrs; -- struct wordlist **opts; -- char *filename; -- int flags; --{ -- int newline; -- int got_flag, best_flag; -- struct wordlist *ap, *addr_list, *alist, **app; -- char word[MAXWORDLEN]; -- -- if (addrs != NULL) -- *addrs = NULL; -- if (opts != NULL) -- *opts = NULL; -- addr_list = NULL; -- if (!getword(f, word, &newline, filename)) -- return -1; /* file is empty??? */ -- newline = 1; -- best_flag = -1; -- for (;;) { -- /* -- * Skip until we find a word at the start of a line. -- */ -- while (!newline && getword(f, word, &newline, filename)); -- if (!newline) -- break; /* got to end of file */ -- -- /* -- * Got a client - check if it's a match or a wildcard. -- */ -- got_flag = 0; -- if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) { -- newline = 0; -- continue; -- } -- if (!ISWILD(word)) -- got_flag = NONWILD_CLIENT; -- -- /* -- * Now get a server and check if it matches. -- */ -- if (!getword(f, word, &newline, filename)) -- break; -- if (newline) -- continue; -- if (!ISWILD(word)) { -- if (server != NULL && strcmp(word, server) != 0) -- continue; -- got_flag |= NONWILD_SERVER; -- } -- -- /* -- * Got some sort of a match - see if it's better than what -- * we have already. -- */ -- if (got_flag <= best_flag) -- continue; -- -- /* -- * Get the cli_cert -- */ -- if (!getword(f, word, &newline, filename)) -- break; -- if (newline) -- continue; -- if (strcmp(word, "-") != 0) { -- strlcpy(cli_cert, word, MAXWORDLEN); -- } else -- cli_cert[0] = 0; -- -- /* -- * Get serv_cert -- */ -- if (!getword(f, word, &newline, filename)) -- break; -- if (newline) -- continue; -- if (strcmp(word, "-") != 0) { -- strlcpy(serv_cert, word, MAXWORDLEN); -- } else -- serv_cert[0] = 0; -- -- /* -- * Get ca_cert -- */ -- if (!getword(f, word, &newline, filename)) -- break; -- if (newline) -- continue; -- strlcpy(ca_cert, word, MAXWORDLEN); -- -- /* -- * Get pk -- */ -- if (!getword(f, word, &newline, filename)) -- break; -- if (newline) -- continue; -- strlcpy(pk, word, MAXWORDLEN); -- -- -- /* -- * Now read address authorization info and make a wordlist. -- */ -- app = &alist; -- for (;;) { -- if (!getword(f, word, &newline, filename) || newline) -- break; -- ap = (struct wordlist *) -- malloc(sizeof(struct wordlist) + strlen(word) + 1); -- if (ap == NULL) -- novm("authorized addresses"); -- ap->word = (char *) (ap + 1); -- strcpy(ap->word, word); -- *app = ap; -- app = &ap->next; -- } -- *app = NULL; -- /* -- * This is the best so far; remember it. -- */ -- best_flag = got_flag; -- if (addr_list) -- free_wordlist(addr_list); -- addr_list = alist; -- -- if (!newline) -- break; -- } -- -- /* scan for a -- word indicating the start of options */ -- for (app = &addr_list; (ap = *app) != NULL; app = &ap->next) -- if (strcmp(ap->word, "--") == 0) -- break; -- /* ap = start of options */ -- if (ap != NULL) { -- ap = ap->next; /* first option */ -- free(*app); /* free the "--" word */ -- *app = NULL; /* terminate addr list */ -- } -- if (opts != NULL) -- *opts = ap; -- else if (ap != NULL) -- free_wordlist(ap); -- if (addrs != NULL) -- *addrs = addr_list; -- else if (addr_list != NULL) -- free_wordlist(addr_list); -- -- return best_flag; --} -- -- --int --get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -- cacertfile, pkfile, am_server) -- int unit; -- char *client; -- char *server; -- char *clicertfile; -- char *servcertfile; -- char *cacertfile; -- char *pkfile; -- int am_server; --{ -- FILE *fp; -- int ret; -- char *filename = NULL; -- struct wordlist *addrs = NULL; -- struct wordlist *opts = NULL; -- -- /* in client mode the ca+cert+privkey can also be specified as options */ -- if (!am_server && cacert_file && cert_file && privkey_file ) -- { -- strlcpy( clicertfile, cert_file, MAXWORDLEN ); -- strlcpy( cacertfile, cacert_file, MAXWORDLEN ); -- strlcpy( pkfile, privkey_file, MAXWORDLEN ); -- servcertfile[0] = '\0'; -- } -- else -- { -- filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE); -- addrs = NULL; -- -- fp = fopen(filename, "r"); -- if (fp == NULL) -- { -- error("Can't open eap-tls secret file %s: %m", filename); -- return 0; -- } -- -- check_access(fp, filename); -- -- ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile, -- cacertfile, pkfile, &addrs, &opts, filename, 0); -- -- fclose(fp); -- -- if (ret < 0) return 0; -- } -- -- if (eaptls_passwd_hook) -- { -- dbglog( "Calling eaptls password hook" ); -- if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0) -- { -- error("Unable to obtain EAP-TLS password for %s (%s) from plugin", -- client, pkfile); -- return 0; -- } -- } -- if (am_server) -- set_allowed_addrs(unit, addrs, opts); -- else if (opts != NULL) -- free_wordlist(opts); -- if (addrs != NULL) -- free_wordlist(addrs); -- -- return 1; --} --#endif -diff --git a/pppd/ccp.c b/pppd/ccp.c -index 7dead23..5814f35 100644 ---- a/pppd/ccp.c -+++ b/pppd/ccp.c -@@ -540,9 +540,6 @@ ccp_resetci(f) - if (go->mppe) { - ccp_options *ao = &ccp_allowoptions[f->unit]; - int auth_mschap_bits = auth_done[f->unit]; --#ifdef USE_EAPTLS -- int auth_eap_bits = auth_done[f->unit]; --#endif - int numbits; - - /* -@@ -570,23 +567,8 @@ ccp_resetci(f) - lcp_close(f->unit, "MPPE required but not available"); - return; - } -- --#ifdef USE_EAPTLS -- /* -- * MPPE is also possible in combination with EAP-TLS. -- * It is not possible to detect if we're doing EAP or EAP-TLS -- * at this stage, hence we accept all forms of EAP. If TLS is -- * not used then the MPPE keys will not be derived anyway. -- */ -- /* Leave only the eap auth bits set */ -- auth_eap_bits &= (EAP_WITHPEER | EAP_PEER ); -- -- if ((numbits == 0) && (auth_eap_bits == 0)) { -- error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed."); --#else - if (!numbits) { -- error("MPPE required, but MS-CHAP[v2] auth not performed."); --#endif -+ error("MPPE required, but MS-CHAP[v2] auth not performed."); - lcp_close(f->unit, "MPPE required but not available"); - return; - } -diff --git a/pppd/chap-md5.c b/pppd/chap-md5.c -index 269b52c..77dd4ec 100644 ---- a/pppd/chap-md5.c -+++ b/pppd/chap-md5.c -@@ -36,11 +36,7 @@ - #include "chap-new.h" - #include "chap-md5.h" - #include "magic.h" --#ifdef USE_EAPTLS --#include "eap-tls.h" --#else - #include "md5.h" --#endif /* USE_EAPTLS */ - - #define MD5_HASH_SIZE 16 - #define MD5_MIN_CHALLENGE 16 -diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c -deleted file mode 100644 -index a3aea5a..0000000 ---- a/pppd/eap-tls.c -+++ /dev/null -@@ -1,1174 +0,0 @@ --/* -- * eap-tls.c - EAP-TLS implementation for PPP -- * -- * Copyright (c) Beniamino Galvani 2005 All rights reserved. -- * -- * Redistribution and use in source and binary forms, with or without -- * modification, are permitted provided that the following conditions -- * are met: -- * -- * 1. Redistributions of source code must retain the above copyright -- * notice, this list of conditions and the following disclaimer. -- * -- * 2. Redistributions in binary form must reproduce the above copyright -- * notice, this list of conditions and the following disclaimer in -- * the documentation and/or other materials provided with the -- * distribution. -- * -- * 3. The name(s) of the authors of this software must not be used to -- * endorse or promote products derived from this software without -- * prior written permission. -- * -- * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -- * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -- * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -- * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -- * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -- * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -- * -- */ -- --#include --#include --#include --#include --#include -- --#include --#include --#include --#include --#include -- --#include "pppd.h" --#include "eap.h" --#include "eap-tls.h" --#include "fsm.h" --#include "lcp.h" --#include "pathnames.h" -- --/* The openssl configuration file and engines can be loaded only once */ --static CONF *ssl_config = NULL; --static ENGINE *cert_engine = NULL; --static ENGINE *pkey_engine = NULL; -- --#ifdef MPPE -- --/* -- * TLS PRF from RFC 2246 -- */ --static void P_hash(const EVP_MD *evp_md, -- const unsigned char *secret, unsigned int secret_len, -- const unsigned char *seed, unsigned int seed_len, -- unsigned char *out, unsigned int out_len) --{ -- HMAC_CTX ctx_a, ctx_out; -- unsigned char a[HMAC_MAX_MD_CBLOCK]; -- unsigned int size; -- -- HMAC_CTX_init(&ctx_a); -- HMAC_CTX_init(&ctx_out); -- HMAC_Init_ex(&ctx_a, secret, secret_len, evp_md, NULL); -- HMAC_Init_ex(&ctx_out, secret, secret_len, evp_md, NULL); -- -- size = HMAC_size(&ctx_out); -- -- /* Calculate A(1) */ -- HMAC_Update(&ctx_a, seed, seed_len); -- HMAC_Final(&ctx_a, a, NULL); -- -- while (1) { -- /* Calculate next part of output */ -- HMAC_Update(&ctx_out, a, size); -- HMAC_Update(&ctx_out, seed, seed_len); -- -- /* Check if last part */ -- if (out_len < size) { -- HMAC_Final(&ctx_out, a, NULL); -- memcpy(out, a, out_len); -- break; -- } -- -- /* Place digest in output buffer */ -- HMAC_Final(&ctx_out, out, NULL); -- HMAC_Init_ex(&ctx_out, NULL, 0, NULL, NULL); -- out += size; -- out_len -= size; -- -- /* Calculate next A(i) */ -- HMAC_Init_ex(&ctx_a, NULL, 0, NULL, NULL); -- HMAC_Update(&ctx_a, a, size); -- HMAC_Final(&ctx_a, a, NULL); -- } -- -- HMAC_CTX_cleanup(&ctx_a); -- HMAC_CTX_cleanup(&ctx_out); -- memset(a, 0, sizeof(a)); --} -- --static void PRF(const unsigned char *secret, unsigned int secret_len, -- const unsigned char *seed, unsigned int seed_len, -- unsigned char *out, unsigned char *buf, unsigned int out_len) --{ -- unsigned int i; -- unsigned int len = (secret_len + 1) / 2; -- const unsigned char *s1 = secret; -- const unsigned char *s2 = secret + (secret_len - len); -- -- P_hash(EVP_md5(), s1, len, seed, seed_len, out, out_len); -- P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len); -- -- for (i=0; i < out_len; i++) { -- out[i] ^= buf[i]; -- } --} -- --#define EAPTLS_MPPE_KEY_LEN 32 -- --/* -- * Generate keys according to RFC 2716 and add to reply -- */ --void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, -- int client) --{ -- unsigned char out[4*EAPTLS_MPPE_KEY_LEN], buf[4*EAPTLS_MPPE_KEY_LEN]; -- unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; -- unsigned char *p = seed; -- SSL *s = ets->ssl; -- size_t prf_size; -- -- prf_size = strlen(prf_label); -- -- memcpy(p, prf_label, prf_size); -- p += prf_size; -- -- memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); -- p += SSL3_RANDOM_SIZE; -- prf_size += SSL3_RANDOM_SIZE; -- -- memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE); -- prf_size += SSL3_RANDOM_SIZE; -- -- PRF(s->session->master_key, s->session->master_key_length, -- seed, prf_size, out, buf, sizeof(out)); -- -- /* -- * We now have the master send and receive keys. -- * From these, generate the session send and receive keys. -- * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) -- */ -- if (client) -- { -- p = out; -- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -- p += EAPTLS_MPPE_KEY_LEN; -- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -- } -- else -- { -- p = out; -- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -- p += EAPTLS_MPPE_KEY_LEN; -- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -- } -- -- mppe_keys_set = 1; --} -- --#endif -- --void log_ssl_errors( void ) --{ -- unsigned long ssl_err = ERR_get_error(); -- -- if (ssl_err != 0) -- dbglog("EAP-TLS SSL error stack:"); -- while (ssl_err != 0) { -- dbglog( ERR_error_string( ssl_err, NULL ) ); -- ssl_err = ERR_get_error(); -- } --} -- -- --int password_callback (char *buf, int size, int rwflag, void *u) --{ -- if (buf) -- { -- strncpy (buf, passwd, size); -- return strlen (buf); -- } -- return 0; --} -- -- --CONF *eaptls_ssl_load_config( void ) --{ -- CONF *config; -- int ret_code; -- long error_line = 33; -- -- config = NCONF_new( NULL ); -- dbglog( "Loading OpenSSL config file" ); -- ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); -- if (ret_code == 0) -- { -- warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); -- NCONF_free( config ); -- config = NULL; -- ERR_clear_error(); -- } -- -- dbglog( "Loading OpenSSL built-ins" ); -- ENGINE_load_builtin_engines(); -- OPENSSL_load_builtin_modules(); -- -- dbglog( "Loading OpenSSL configured modules" ); -- if (CONF_modules_load( config, NULL, 0 ) <= 0 ) -- { -- warn( "EAP-TLS: Error loading OpenSSL modules" ); -- log_ssl_errors(); -- config = NULL; -- } -- -- return config; --} -- --ENGINE *eaptls_ssl_load_engine( char *engine_name ) --{ -- ENGINE *e = NULL; -- -- dbglog( "Enabling OpenSSL auto engines" ); -- ENGINE_register_all_complete(); -- -- dbglog( "Loading OpenSSL '%s' engine support", engine_name ); -- e = ENGINE_by_id( engine_name ); -- if (!e) -- { -- dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); -- e = ENGINE_by_id( "dynamic" ); -- if (e) -- { -- if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0) -- || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) -- { -- warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name ); -- log_ssl_errors(); -- ENGINE_free(e); -- e = NULL; -- } -- } -- else -- { -- warn( "EAP-TLS: Cannot load dynamic engine support" ); -- } -- } -- -- if (e) -- { -- dbglog( "Initialising engine" ); -- if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) -- { -- warn( "EAP-TLS: Cannot use that engine" ); -- log_ssl_errors(); -- ENGINE_free(e); -- e = NULL; -- } -- } -- -- return e; --} -- --/* -- * Initialize the SSL stacks and tests if certificates, key and crl -- * for client or server use can be loaded. -- */ --SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, -- char *certfile, char *peer_certfile, char *privkeyfile) --{ -- char *cert_engine_name = NULL; -- char *cert_identifier = NULL; -- char *pkey_engine_name = NULL; -- char *pkey_identifier = NULL; -- SSL_CTX *ctx; -- X509_STORE *certstore; -- X509_LOOKUP *lookup; -- X509 *tmp; -- -- /* -- * Without these can't continue -- */ -- if (!cacertfile[0]) -- { -- error("EAP-TLS: CA certificate missing"); -- return NULL; -- } -- -- if (!certfile[0]) -- { -- error("EAP-TLS: User certificate missing"); -- return NULL; -- } -- -- if (!privkeyfile[0]) -- { -- error("EAP-TLS: User private key missing"); -- return NULL; -- } -- -- SSL_library_init(); -- SSL_load_error_strings(); -- -- ctx = SSL_CTX_new(TLSv1_method()); -- -- if (!ctx) { -- error("EAP-TLS: Cannot initialize SSL CTX context"); -- goto fail; -- } -- -- /* if the certificate filename is of the form engine:id. e.g. -- pkcs11:12345 -- then we try to load and use this engine. -- If the certificate filename starts with a / or . then we -- ALWAYS assume it is a file and not an engine/pkcs11 identifier -- */ -- if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL ) -- { -- cert_identifier = index( certfile, ':' ); -- -- if (cert_identifier) -- { -- cert_engine_name = certfile; -- *cert_identifier = '\0'; -- cert_identifier++; -- -- dbglog( "Found certificate engine '%s'", cert_engine_name ); -- dbglog( "Found certificate identifier '%s'", cert_identifier ); -- } -- } -- -- /* if the privatekey filename is of the form engine:id. e.g. -- pkcs11:12345 -- then we try to load and use this engine. -- If the privatekey filename starts with a / or . then we -- ALWAYS assume it is a file and not an engine/pkcs11 identifier -- */ -- if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL ) -- { -- pkey_identifier = index( privkeyfile, ':' ); -- -- if (pkey_identifier) -- { -- pkey_engine_name = privkeyfile; -- *pkey_identifier = '\0'; -- pkey_identifier++; -- -- dbglog( "Found privatekey engine '%s'", pkey_engine_name ); -- dbglog( "Found privatekey identifier '%s'", pkey_identifier ); -- } -- } -- -- if (cert_identifier && pkey_identifier) -- { -- if (strlen( cert_identifier ) == 0) -- { -- if (strlen( pkey_identifier ) == 0) -- error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" ); -- else -- { -- dbglog( "Substituting privatekey identifier for certificate identifier" ); -- cert_identifier = pkey_identifier; -- } -- } -- else -- { -- if (strlen( pkey_identifier ) == 0) -- { -- dbglog( "Substituting certificate identifier for privatekey identifier" ); -- pkey_identifier = cert_identifier; -- } -- } -- -- } -- -- /* load the openssl config file only once */ -- if (!ssl_config) -- { -- if (cert_engine_name || pkey_engine_name) -- ssl_config = eaptls_ssl_load_config(); -- -- if (ssl_config && cert_engine_name) -- cert_engine = eaptls_ssl_load_engine( cert_engine_name ); -- -- if (ssl_config && pkey_engine_name) -- { -- /* don't load the same engine twice */ -- if ( strcmp( cert_engine_name, pkey_engine_name) == 0 ) -- pkey_engine = cert_engine; -- else -- pkey_engine = eaptls_ssl_load_engine( pkey_engine_name ); -- } -- } -- -- SSL_CTX_set_default_passwd_cb (ctx, password_callback); -- -- if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) -- { -- error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); -- goto fail; -- } -- -- if (init_server) -- SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); -- -- if (cert_engine) -- { -- struct -- { -- const char *s_slot_cert_id; -- X509 *cert; -- } cert_info; -- -- cert_info.s_slot_cert_id = cert_identifier; -- cert_info.cert = NULL; -- -- if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) ) -- { -- error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier ); -- goto fail; -- } -- -- if (cert_info.cert) -- { -- dbglog( "Got the certificate, adding it to SSL context" ); -- dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) ); -- if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0) -- { -- error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier); -- goto fail; -- } -- } -- else -- { -- warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier); -- log_ssl_errors(); -- } -- } -- else -- { -- if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM)) -- { -- error( "EAP-TLS: Cannot use public certificate %s", certfile ); -- goto fail; -- } -- } -- -- if (pkey_engine) -- { -- EVP_PKEY *pkey = NULL; -- PW_CB_DATA cb_data; -- -- cb_data.password = passwd; -- cb_data.prompt_info = pkey_identifier; -- -- dbglog( "Loading private key '%s' from engine", pkey_identifier ); -- pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data); -- if (pkey) -- { -- dbglog( "Got the private key, adding it to SSL context" ); -- if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) -- { -- error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier); -- goto fail; -- } -- } -- else -- { -- warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier); -- log_ssl_errors(); -- } -- } -- else -- { -- if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM)) -- { -- error("EAP-TLS: Cannot use private key %s", privkeyfile); -- goto fail; -- } -- } -- -- if (SSL_CTX_check_private_key(ctx) != 1) { -- error("EAP-TLS: Private key %s fails security check", privkeyfile); -- goto fail; -- } -- -- SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); -- SSL_CTX_set_verify_depth(ctx, 5); -- SSL_CTX_set_verify(ctx, -- SSL_VERIFY_PEER | -- SSL_VERIFY_FAIL_IF_NO_PEER_CERT, -- &ssl_verify_callback); -- -- if (crl_dir) { -- if (!(certstore = SSL_CTX_get_cert_store(ctx))) { -- error("EAP-TLS: Failed to get certificate store"); -- goto fail; -- } -- -- if (!(lookup = -- X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) { -- error("EAP-TLS: Store lookup for CRL failed"); -- -- goto fail; -- } -- -- X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM); -- X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); -- } -- -- /* -- * If a peer certificate file was specified, it must be valid, else fail -- */ -- if (peer_certfile[0]) { -- if (!(tmp = get_X509_from_file(peer_certfile))) { -- error("EAP-TLS: Error loading client certificate from file %s", -- peer_certfile); -- goto fail; -- } -- X509_free(tmp); -- } -- -- return ctx; -- --fail: -- log_ssl_errors(); -- SSL_CTX_free(ctx); -- return NULL; --} -- --/* -- * Determine the maximum packet size by looking at the LCP handshake -- */ -- --int eaptls_get_mtu(int unit) --{ -- int mtu, mru; -- -- lcp_options *wo = &lcp_wantoptions[unit]; -- lcp_options *go = &lcp_gotoptions[unit]; -- lcp_options *ho = &lcp_hisoptions[unit]; -- lcp_options *ao = &lcp_allowoptions[unit]; -- -- mtu = ho->neg_mru? ho->mru: PPP_MRU; -- mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; -- mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; -- -- dbglog("MTU = %d", mtu); -- return mtu; --} -- -- --/* -- * Init the ssl handshake (server mode) -- */ --int eaptls_init_ssl_server(eap_state * esp) --{ -- struct eaptls_session *ets; -- char servcertfile[MAXWORDLEN]; -- char clicertfile[MAXWORDLEN]; -- char cacertfile[MAXWORDLEN]; -- char pkfile[MAXWORDLEN]; -- /* -- * Allocate new eaptls session -- */ -- esp->es_server.ea_session = malloc(sizeof(struct eaptls_session)); -- if (!esp->es_server.ea_session) -- fatal("Allocation error"); -- ets = esp->es_server.ea_session; -- -- if (!esp->es_server.ea_peer) { -- error("EAP-TLS: Error: client name not set (BUG)"); -- return 0; -- } -- -- strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); -- -- dbglog( "getting eaptls secret" ); -- if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, -- esp->es_server.ea_name, clicertfile, -- servcertfile, cacertfile, pkfile, 1)) { -- error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -- esp->es_server.ea_peer, esp->es_server.ea_name ); -- return 0; -- } -- -- ets->mtu = eaptls_get_mtu(esp->es_unit); -- -- ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); -- if (!ets->ctx) -- goto fail; -- -- if (!(ets->ssl = SSL_new(ets->ctx))) -- goto fail; -- -- /* -- * Set auto-retry to avoid timeouts on BIO_read -- */ -- SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY); -- -- /* -- * Initialize the BIOs we use to read/write to ssl engine -- */ -- ets->into_ssl = BIO_new(BIO_s_mem()); -- ets->from_ssl = BIO_new(BIO_s_mem()); -- SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -- -- SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -- SSL_set_msg_callback_arg(ets->ssl, ets); -- -- /* -- * Attach the session struct to the connection, so we can later -- * retrieve it when doing certificate verification -- */ -- SSL_set_ex_data(ets->ssl, 0, ets); -- -- SSL_set_accept_state(ets->ssl); -- -- ets->data = NULL; -- ets->datalen = 0; -- ets->alert_sent = 0; -- ets->alert_recv = 0; -- -- /* -- * If we specified the client certificate file, store it in ets->peercertfile, -- * so we can check it later in ssl_verify_callback() -- */ -- if (clicertfile[0]) -- strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN); -- else -- ets->peercertfile[0] = 0; -- -- return 1; -- --fail: -- SSL_CTX_free(ets->ctx); -- return 0; --} -- --/* -- * Init the ssl handshake (client mode) -- */ --int eaptls_init_ssl_client(eap_state * esp) --{ -- struct eaptls_session *ets; -- char servcertfile[MAXWORDLEN]; -- char clicertfile[MAXWORDLEN]; -- char cacertfile[MAXWORDLEN]; -- char pkfile[MAXWORDLEN]; -- -- /* -- * Allocate new eaptls session -- */ -- esp->es_client.ea_session = malloc(sizeof(struct eaptls_session)); -- if (!esp->es_client.ea_session) -- fatal("Allocation error"); -- ets = esp->es_client.ea_session; -- -- /* -- * If available, copy server name in ets; it will be used in cert -- * verify -- */ -- if (esp->es_client.ea_peer) -- strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); -- else -- ets->peer[0] = 0; -- -- ets->mtu = eaptls_get_mtu(esp->es_unit); -- -- dbglog( "calling get_eaptls_secret" ); -- if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, -- esp->es_client.ea_peer, clicertfile, -- servcertfile, cacertfile, pkfile, 0)) { -- error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -- esp->es_client.ea_name, esp->es_client.ea_peer ); -- return 0; -- } -- -- dbglog( "calling eaptls_init_ssl" ); -- ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); -- if (!ets->ctx) -- goto fail; -- -- ets->ssl = SSL_new(ets->ctx); -- -- if (!ets->ssl) -- goto fail; -- -- /* -- * Initialize the BIOs we use to read/write to ssl engine -- */ -- dbglog( "Initializing SSL BIOs" ); -- ets->into_ssl = BIO_new(BIO_s_mem()); -- ets->from_ssl = BIO_new(BIO_s_mem()); -- SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -- -- SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -- SSL_set_msg_callback_arg(ets->ssl, ets); -- -- /* -- * Attach the session struct to the connection, so we can later -- * retrieve it when doing certificate verification -- */ -- SSL_set_ex_data(ets->ssl, 0, ets); -- -- SSL_set_connect_state(ets->ssl); -- -- ets->data = NULL; -- ets->datalen = 0; -- ets->alert_sent = 0; -- ets->alert_recv = 0; -- -- /* -- * If we specified the server certificate file, store it in -- * ets->peercertfile, so we can check it later in -- * ssl_verify_callback() -- */ -- if (servcertfile[0]) -- strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); -- else -- ets->peercertfile[0] = 0; -- -- return 1; -- --fail: -- dbglog( "eaptls_init_ssl_client: fail" ); -- SSL_CTX_free(ets->ctx); -- return 0; -- --} -- --void eaptls_free_session(struct eaptls_session *ets) --{ -- if (ets->ssl) -- SSL_free(ets->ssl); -- -- if (ets->ctx) -- SSL_CTX_free(ets->ctx); -- -- free(ets); --} -- --/* -- * Handle a received packet, reassembling fragmented messages and -- * passing them to the ssl engine -- */ --int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) --{ -- u_char flags; -- u_int tlslen; -- u_char dummy[65536]; -- -- GETCHAR(flags, inp); -- len--; -- -- if (flags & EAP_TLS_FLAGS_LI && !ets->data) { -- -- /* -- * This is the first packet of a message -- */ -- -- GETLONG(tlslen, inp); -- len -= 4; -- -- if (tlslen > EAP_TLS_MAX_LEN) { -- error("Error: tls message length > %d, truncated", -- EAP_TLS_MAX_LEN); -- tlslen = EAP_TLS_MAX_LEN; -- } -- -- /* -- * Allocate memory for the whole message -- */ -- ets->data = malloc(tlslen); -- if (!ets->data) -- fatal("EAP TLS: allocation error\n"); -- -- ets->datalen = 0; -- ets->tlslen = tlslen; -- -- } -- else if (flags & EAP_TLS_FLAGS_LI && ets->data) { -- /* -- * Non first with LI (strange...) -- */ -- -- GETLONG(tlslen, inp); -- len -= 4; -- -- } -- else if (!ets->data) { -- /* -- * A non fragmented message without LI flag -- */ -- -- ets->data = malloc(len); -- if (!ets->data) -- fatal("EAP TLS: allocation error\n"); -- -- ets->datalen = 0; -- ets->tlslen = len; -- } -- -- if (flags & EAP_TLS_FLAGS_MF) -- ets->frag = 1; -- else -- ets->frag = 0; -- -- if (len + ets->datalen > ets->tlslen) { -- warn("EAP TLS: received data > TLS message length"); -- return 1; -- } -- -- BCOPY(inp, ets->data + ets->datalen, len); -- ets->datalen += len; -- -- if (!ets->frag) { -- -- /* -- * If we have the whole message, pass it to ssl -- */ -- -- if (ets->datalen != ets->tlslen) { -- warn("EAP TLS: received data != TLS message length"); -- return 1; -- } -- -- if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1) -- log_ssl_errors(); -- -- SSL_read(ets->ssl, dummy, 65536); -- -- free(ets->data); -- ets->data = NULL; -- ets->datalen = 0; -- } -- -- return 0; --} -- --/* -- * Return an eap-tls packet in outp. -- * A TLS message read from the ssl engine is buffered in ets->data. -- * At each call we control if there is buffered data and send a -- * packet of mtu bytes. -- */ --int eaptls_send(struct eaptls_session *ets, u_char ** outp) --{ -- bool first = 0; -- int size; -- u_char fromtls[65536]; -- int res; -- u_char *start; -- -- start = *outp; -- -- if (!ets->data) { -- -- if(!ets->alert_sent) -- SSL_read(ets->ssl, fromtls, 65536); -- -- /* -- * Read from ssl -- */ -- if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) -- fatal("No data from BIO_read"); -- -- ets->datalen = res; -- -- ets->data = malloc(ets->datalen); -- BCOPY(fromtls, ets->data, ets->datalen); -- -- ets->offset = 0; -- first = 1; -- -- } -- -- size = ets->datalen - ets->offset; -- -- if (size > ets->mtu) { -- size = ets->mtu; -- ets->frag = 1; -- } else -- ets->frag = 0; -- -- PUTCHAR(EAPT_TLS, *outp); -- -- /* -- * Set right flags and length if necessary -- */ -- if (ets->frag && first) { -- PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp); -- PUTLONG(ets->datalen, *outp); -- } else if (ets->frag) { -- PUTCHAR(EAP_TLS_FLAGS_MF, *outp); -- } else -- PUTCHAR(0, *outp); -- -- /* -- * Copy the data in outp -- */ -- BCOPY(ets->data + ets->offset, *outp, size); -- INCPTR(size, *outp); -- -- /* -- * Copy the packet in retransmission buffer -- */ -- BCOPY(start, &ets->rtx[0], *outp - start); -- ets->rtx_len = *outp - start; -- -- ets->offset += size; -- -- if (ets->offset >= ets->datalen) { -- -- /* -- * The whole message has been sent -- */ -- -- free(ets->data); -- ets->data = NULL; -- ets->datalen = 0; -- ets->offset = 0; -- } -- -- return 0; --} -- --/* -- * Get the sent packet from the retransmission buffer -- */ --void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp) --{ -- BCOPY(ets->rtx, *outp, ets->rtx_len); -- INCPTR(ets->rtx_len, *outp); --} -- --/* -- * Verify a certificate. -- * Most of the work (signatures and issuer attributes checking) -- * is done by ssl; we check the CN in the peer certificate -- * against the peer name. -- */ --int ssl_verify_callback(int preverify_ok, X509_STORE_CTX * ctx) --{ -- char subject[256]; -- char cn_str[256]; -- X509 *peer_cert; -- int err, depth; -- int ok = preverify_ok; -- SSL *ssl; -- struct eaptls_session *ets; -- -- peer_cert = X509_STORE_CTX_get_current_cert(ctx); -- err = X509_STORE_CTX_get_error(ctx); -- depth = X509_STORE_CTX_get_error_depth(ctx); -- -- dbglog("certificate verify depth: %d", depth); -- -- if (auth_required && !ok) { -- X509_NAME_oneline(X509_get_subject_name(peer_cert), -- subject, 256); -- -- X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -- NID_commonName, cn_str, 256); -- -- dbglog("Certificate verification error:\n depth: %d CN: %s" -- "\n err: %d (%s)\n", depth, cn_str, err, -- X509_verify_cert_error_string(err)); -- -- return 0; -- } -- -- ssl = X509_STORE_CTX_get_ex_data(ctx, -- SSL_get_ex_data_X509_STORE_CTX_idx()); -- -- ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0); -- -- if (ets == NULL) { -- error("Error: SSL_get_ex_data returned NULL"); -- return 0; -- } -- -- log_ssl_errors(); -- -- if (!depth) { /* This is the peer certificate */ -- -- X509_NAME_oneline(X509_get_subject_name(peer_cert), -- subject, 256); -- -- X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -- NID_commonName, cn_str, 256); -- -- /* -- * If acting as client and the name of the server wasn't specified -- * explicitely, we can't verify the server authenticity -- */ -- if (!ets->peer[0]) { -- warn("Peer name not specified: no check"); -- return 1; -- } -- -- /* -- * Check the CN -- */ -- if (strcmp(cn_str, ets->peer)) { -- error -- ("Certificate verification error: CN (%s) != peer_name (%s)", -- cn_str, ets->peer); -- return 0; -- } -- -- warn("Certificate CN: %s , peer name %s", cn_str, ets->peer); -- -- /* -- * If a peer certificate file was specified, here we check it -- */ -- if (ets->peercertfile[0]) { -- if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert) -- != 0) { -- error -- ("Peer certificate doesn't match stored certificate"); -- return 0; -- } -- } -- } -- -- return 1; --} -- --/* -- * Compare a certificate with the one stored in a file -- */ --int ssl_cmp_certs(char *filename, X509 * a) --{ -- X509 *b; -- int ret; -- -- if (!(b = get_X509_from_file(filename))) -- return 1; -- -- ret = X509_cmp(a, b); -- X509_free(b); -- -- return ret; -- --} -- --X509 *get_X509_from_file(char *filename) --{ -- FILE *fp; -- X509 *ret; -- -- if (!(fp = fopen(filename, "r"))) -- return NULL; -- -- ret = PEM_read_X509(fp, NULL, NULL, NULL); -- -- fclose(fp); -- -- return ret; --} -- --/* -- * Every sent & received message this callback function is invoked, -- * so we know when alert messages have arrived or are sent and -- * we can print debug information about TLS handshake. -- */ --void --ssl_msg_callback(int write_p, int version, int content_type, -- const void *buf, size_t len, SSL * ssl, void *arg) --{ -- char string[256]; -- struct eaptls_session *ets = (struct eaptls_session *)arg; -- unsigned char code; -- -- if(write_p) -- strcpy(string, " -> "); -- else -- strcpy(string, " <- "); -- -- -- switch(content_type) { -- -- case SSL3_RT_ALERT: -- strcat(string, "Alert: "); -- code = ((const unsigned char *)buf)[1]; -- -- if (write_p) { -- ets->alert_sent = 1; -- ets->alert_sent_desc = code; -- } else { -- ets->alert_recv = 1; -- ets->alert_recv_desc = code; -- } -- -- strcat(string, SSL_alert_desc_string_long(code)); -- break; -- -- case SSL3_RT_CHANGE_CIPHER_SPEC: -- strcat(string, "ChangeCipherSpec"); -- break; -- -- case SSL3_RT_HANDSHAKE: -- -- strcat(string, "Handshake: "); -- code = ((const unsigned char *)buf)[0]; -- -- switch(code) { -- case SSL3_MT_HELLO_REQUEST: -- strcat(string,"Hello Request"); -- break; -- case SSL3_MT_CLIENT_HELLO: -- strcat(string,"Client Hello"); -- break; -- case SSL3_MT_SERVER_HELLO: -- strcat(string,"Server Hello"); -- break; -- case SSL3_MT_CERTIFICATE: -- strcat(string,"Certificate"); -- break; -- case SSL3_MT_SERVER_KEY_EXCHANGE: -- strcat(string,"Server Key Exchange"); -- break; -- case SSL3_MT_CERTIFICATE_REQUEST: -- strcat(string,"Certificate Request"); -- break; -- case SSL3_MT_SERVER_DONE: -- strcat(string,"Server Hello Done"); -- break; -- case SSL3_MT_CERTIFICATE_VERIFY: -- strcat(string,"Certificate Verify"); -- break; -- case SSL3_MT_CLIENT_KEY_EXCHANGE: -- strcat(string,"Client Key Exchange"); -- break; -- case SSL3_MT_FINISHED: -- strcat(string,"Finished"); -- break; -- -- default: -- sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); -- } -- break; -- -- default: -- sprintf( string, "SSL message contains unknown content type: %d", content_type ); -- -- } -- -- /* Alert messages must always be displayed */ -- if(content_type == SSL3_RT_ALERT) -- error("%s", string); -- else -- dbglog("%s", string); --} -- -diff --git a/pppd/eap-tls.h b/pppd/eap-tls.h -deleted file mode 100644 -index 2d45a0b..0000000 ---- a/pppd/eap-tls.h -+++ /dev/null -@@ -1,107 +0,0 @@ --/* -- * eap-tls.h -- * -- * Copyright (c) Beniamino Galvani 2005 All rights reserved. -- * -- * Redistribution and use in source and binary forms, with or without -- * modification, are permitted provided that the following conditions -- * are met: -- * -- * 1. Redistributions of source code must retain the above copyright -- * notice, this list of conditions and the following disclaimer. -- * -- * 2. Redistributions in binary form must reproduce the above copyright -- * notice, this list of conditions and the following disclaimer in -- * the documentation and/or other materials provided with the -- * distribution. -- * -- * 3. The name(s) of the authors of this software must not be used to -- * endorse or promote products derived from this software without -- * prior written permission. -- * -- * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -- * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -- * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -- * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -- * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -- * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -- * -- */ -- --#ifndef __EAP_TLS_H__ --#define __EAP_TLS_H__ -- --#include "eap.h" -- --#include --#include --#include -- --#define EAP_TLS_FLAGS_LI 128 /* length included flag */ --#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ --#define EAP_TLS_FLAGS_START 32 /* start flag */ -- --#define EAP_TLS_MAX_LEN 65536 /* max eap tls packet size */ -- --struct eaptls_session --{ -- u_char *data; /* buffered data */ -- int datalen; /* buffered data len */ -- int offset; /* from where to send */ -- int tlslen; /* total length of tls data */ -- bool frag; /* packet is fragmented */ -- SSL_CTX *ctx; -- SSL *ssl; /* ssl connection */ -- BIO *from_ssl; -- BIO *into_ssl; -- char peer[MAXWORDLEN]; /* peer name */ -- char peercertfile[MAXWORDLEN]; -- bool alert_sent; -- u_char alert_sent_desc; -- bool alert_recv; -- u_char alert_recv_desc; -- char rtx[65536]; /* retransmission buffer */ -- int rtx_len; -- int mtu; /* unit mtu */ --}; -- --typedef struct pw_cb_data --{ -- const void *password; -- const char *prompt_info; --} PW_CB_DATA; -- -- --int ssl_verify_callback(int, X509_STORE_CTX *); --void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -- size_t len, SSL * ssl, void *arg); -- --X509 *get_X509_from_file(char *filename); --int ssl_cmp_certs(char *filename, X509 * a); -- --SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, -- char *certfile, char *peer_certfile, char *privkeyfile); --int eaptls_init_ssl_server(eap_state * esp); --int eaptls_init_ssl_client(eap_state * esp); --void eaptls_free_session(struct eaptls_session *ets); -- --int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); --int eaptls_send(struct eaptls_session *ets, u_char ** outp); --void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); -- --int get_eaptls_secret(int unit, char *client, char *server, -- char *clicertfile, char *servcertfile, char *cacertfile, -- char *pkfile, int am_server); -- --#ifdef MPPE --#include "mppe.h" /* MPPE_MAX_KEY_LEN */ --extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; --extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; --extern int mppe_keys_set; -- --void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); -- --#endif -- --#endif -diff --git a/pppd/eap.c b/pppd/eap.c -index e2270af..faced53 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -43,11 +43,6 @@ - * Based on draft-ietf-pppext-eap-srp-03.txt. - */ - --/* -- * Modification by Beniamino Galvani, Mar 2005 -- * Implemented EAP-TLS authentication -- */ -- - #define RCSID "$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $" - - /* -@@ -67,12 +62,8 @@ - - #include "pppd.h" - #include "pathnames.h" --#include "eap.h" --#ifdef USE_EAPTLS --#include "eap-tls.h" --#else - #include "md5.h" --#endif /* USE_EAPTLS */ -+#include "eap.h" - - #ifdef USE_SRP - #include -@@ -218,9 +209,6 @@ int unit; - esp->es_server.ea_id = (u_char)(drand48() * 0x100); - esp->es_client.ea_timeout = EAP_DEFREQTIME; - esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; --#ifdef USE_EAPTLS -- esp->es_client.ea_using_eaptls = 0; --#endif /* USE_EAPTLS */ - } - - /* -@@ -280,7 +268,7 @@ eap_state *esp; - u_char *outp; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_FAILURE, outp); -@@ -305,7 +293,7 @@ eap_state *esp; - u_char *outp; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_SUCCESS, outp); -@@ -448,16 +436,8 @@ int status; - u_char vals[2]; - struct b64state bs; - #endif /* USE_SRP */ --#ifdef USE_EAPTLS -- struct eaptls_session *ets; -- int secret_len; -- char secret[MAXWORDLEN]; --#endif /* USE_EAPTLS */ - - esp->es_server.ea_timeout = esp->es_savedtime; --#ifdef USE_EAPTLS -- esp->es_server.ea_prev_state = esp->es_server.ea_state; --#endif /* USE_EAPTLS */ - switch (esp->es_server.ea_state) { - case eapBadAuth: - return; -@@ -582,81 +562,9 @@ int status; - break; - } - #endif /* USE_SRP */ --#ifdef USE_EAPTLS -- if (!get_secret(esp->es_unit, esp->es_server.ea_peer, -- esp->es_server.ea_name, secret, &secret_len, 1)) { -- -- esp->es_server.ea_state = eapTlsStart; -- break; -- } --#endif /* USE_EAPTLS */ -- - esp->es_server.ea_state = eapMD5Chall; - break; - --#ifdef USE_EAPTLS -- case eapTlsStart: -- /* Initialize ssl session */ -- if(!eaptls_init_ssl_server(esp)) { -- esp->es_server.ea_state = eapBadAuth; -- break; -- } -- -- esp->es_server.ea_state = eapTlsRecv; -- break; -- -- case eapTlsRecv: -- ets = (struct eaptls_session *) esp->es_server.ea_session; -- -- if(ets->alert_sent) { -- esp->es_server.ea_state = eapTlsSendAlert; -- break; -- } -- -- if (status) { -- esp->es_server.ea_state = eapBadAuth; -- break; -- } -- ets = (struct eaptls_session *) esp->es_server.ea_session; -- -- if(ets->frag) -- esp->es_server.ea_state = eapTlsSendAck; -- else -- esp->es_server.ea_state = eapTlsSend; -- break; -- -- case eapTlsSend: -- ets = (struct eaptls_session *) esp->es_server.ea_session; -- -- if(SSL_is_init_finished(ets->ssl)) { -- esp->es_server.ea_state = eapTlsRecvClient; -- break; -- } -- -- if(ets->frag) -- esp->es_server.ea_state = eapTlsRecvAck; -- else -- esp->es_server.ea_state = eapTlsRecv; -- break; -- -- case eapTlsSendAck: -- esp->es_server.ea_state = eapTlsRecv; -- break; -- -- case eapTlsRecvAck: -- if (status) { -- esp->es_server.ea_state = eapBadAuth; -- break; -- } -- -- esp->es_server.ea_state = eapTlsSend; -- break; -- -- case eapTlsSendAlert: -- esp->es_server.ea_state = eapTlsRecvAlertAck; -- break; --#endif /* USE_EAPTLS */ -- - case eapSRP1: - #ifdef USE_SRP - ts = (struct t_server *)esp->es_server.ea_session; -@@ -773,7 +681,7 @@ eap_state *esp; - } - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_REQUEST, outp); -@@ -810,30 +718,6 @@ eap_state *esp; - INCPTR(esp->es_server.ea_namelen, outp); - break; - --#ifdef USE_EAPTLS -- case eapTlsStart: -- PUTCHAR(EAPT_TLS, outp); -- PUTCHAR(EAP_TLS_FLAGS_START, outp); -- eap_figure_next_state(esp, 0); -- break; -- -- case eapTlsSend: -- eaptls_send(esp->es_server.ea_session, &outp); -- eap_figure_next_state(esp, 0); -- break; -- -- case eapTlsSendAck: -- PUTCHAR(EAPT_TLS, outp); -- PUTCHAR(0, outp); -- eap_figure_next_state(esp, 0); -- break; -- -- case eapTlsSendAlert: -- eaptls_send(esp->es_server.ea_session, &outp); -- eap_figure_next_state(esp, 0); -- break; --#endif /* USE_EAPTLS */ -- - #ifdef USE_SRP - case eapSRP1: - PUTCHAR(EAPT_SRP, outp); -@@ -1020,57 +904,11 @@ static void - eap_server_timeout(arg) - void *arg; - { --#ifdef USE_EAPTLS -- u_char *outp; -- u_char *lenloc; -- int outlen; --#endif /* USE_EAPTLS */ -- - eap_state *esp = (eap_state *) arg; - - if (!eap_server_active(esp)) - return; - --#ifdef USE_EAPTLS -- switch(esp->es_server.ea_prev_state) { -- -- /* -- * In eap-tls the state changes after a request, so we return to -- * previous state ... -- */ -- case(eapTlsStart): -- case(eapTlsSendAck): -- esp->es_server.ea_state = esp->es_server.ea_prev_state; -- break; -- -- /* -- * ... or resend the stored data -- */ -- case(eapTlsSend): -- case(eapTlsSendAlert): -- outp = outpacket_buf; -- MAKEHEADER(outp, PPP_EAP); -- PUTCHAR(EAP_REQUEST, outp); -- PUTCHAR(esp->es_server.ea_id, outp); -- lenloc = outp; -- INCPTR(2, outp); -- -- eaptls_retransmit(esp->es_server.ea_session, &outp); -- -- outlen = (outp - outpacket_buf) - PPP_HDRLEN; -- PUTSHORT(outlen, lenloc); -- output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN); -- esp->es_server.ea_requests++; -- -- if (esp->es_server.ea_timeout > 0) -- TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout); -- -- return; -- default: -- break; -- } --#endif /* USE_EAPTLS */ -- - /* EAP ID number must not change on timeout. */ - eap_send_request(esp); - } -@@ -1243,7 +1081,7 @@ int namelen; - int msglen; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_RESPONSE, outp); -@@ -1279,7 +1117,7 @@ int lenstr; - int msglen; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_RESPONSE, outp); -@@ -1310,7 +1148,7 @@ u_char *str; - int msglen; - - outp = outpacket_buf; -- -+ - MAKEHEADER(outp, PPP_EAP); - - PUTCHAR(EAP_RESPONSE, outp); -@@ -1328,81 +1166,6 @@ u_char *str; - } - #endif /* USE_SRP */ - --#ifdef USE_EAPTLS --/* -- * Send an EAP-TLS response message with tls data -- */ --static void --eap_tls_response(esp, id) --eap_state *esp; --u_char id; --{ -- u_char *outp; -- int outlen; -- u_char *lenloc; -- -- outp = outpacket_buf; -- -- MAKEHEADER(outp, PPP_EAP); -- -- PUTCHAR(EAP_RESPONSE, outp); -- PUTCHAR(id, outp); -- -- lenloc = outp; -- INCPTR(2, outp); -- -- /* -- If the id in the request is unchanged, we must retransmit -- the old data -- */ -- if(id == esp->es_client.ea_id) -- eaptls_retransmit(esp->es_client.ea_session, &outp); -- else -- eaptls_send(esp->es_client.ea_session, &outp); -- -- outlen = (outp - outpacket_buf) - PPP_HDRLEN; -- PUTSHORT(outlen, lenloc); -- -- output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -- -- esp->es_client.ea_id = id; -- --} -- --/* -- * Send an EAP-TLS ack -- */ --static void --eap_tls_sendack(esp, id) --eap_state *esp; --u_char id; --{ -- u_char *outp; -- int outlen; -- u_char *lenloc; -- -- outp = outpacket_buf; -- -- MAKEHEADER(outp, PPP_EAP); -- -- PUTCHAR(EAP_RESPONSE, outp); -- PUTCHAR(id, outp); -- esp->es_client.ea_id = id; -- -- lenloc = outp; -- INCPTR(2, outp); -- -- PUTCHAR(EAPT_TLS, outp); -- PUTCHAR(0, outp); -- -- outlen = (outp - outpacket_buf) - PPP_HDRLEN; -- PUTSHORT(outlen, lenloc); -- -- output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -- --} --#endif /* USE_EAPTLS */ -- - static void - eap_send_nak(esp, id, type) - eap_state *esp; -@@ -1557,11 +1320,6 @@ int len; - char rhostname[256]; - MD5_CTX mdContext; - u_char hash[MD5_SIGNATURE_SIZE]; --#ifdef USE_EAPTLS -- u_char flags; -- struct eaptls_session *ets = esp->es_client.ea_session; --#endif /* USE_EAPTLS */ -- - #ifdef USE_SRP - struct t_client *tc; - struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1698,90 +1456,6 @@ int len; - esp->es_client.ea_namelen); - break; - --#ifdef USE_EAPTLS -- case EAPT_TLS: -- -- switch(esp->es_client.ea_state) { -- -- case eapListen: -- -- GETCHAR(flags, inp); -- if(flags & EAP_TLS_FLAGS_START){ -- -- esp->es_client.ea_using_eaptls = 1; -- -- if (explicit_remote){ -- esp->es_client.ea_peer = strdup(remote_name); -- esp->es_client.ea_peerlen = strlen(remote_name); -- } else -- esp->es_client.ea_peer = NULL; -- -- /* Init ssl session */ -- if(!eaptls_init_ssl_client(esp)) { -- dbglog("cannot init ssl"); -- eap_send_nak(esp, id, EAPT_TLS); -- esp->es_client.ea_using_eaptls = 0; -- break; -- } -- -- ets = esp->es_client.ea_session; -- eap_tls_response(esp, id); -- esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -- eapTlsRecv); -- break; -- } -- -- /* The server has sent a bad start packet. */ -- eap_send_nak(esp, id, EAPT_TLS); -- break; -- -- case eapTlsRecvAck: -- eap_tls_response(esp, id); -- esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -- eapTlsRecv); -- break; -- -- case eapTlsRecv: -- eaptls_receive(ets, inp, len); -- -- if(ets->frag) { -- eap_tls_sendack(esp, id); -- esp->es_client.ea_state = eapTlsRecv; -- break; -- } -- -- if(ets->alert_recv) { -- eap_tls_sendack(esp, id); -- esp->es_client.ea_state = eapTlsRecvFailure; -- break; -- } -- -- /* Check if TLS handshake is finished */ -- if(SSL_is_init_finished(ets->ssl)){ --#ifdef MPPE -- eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); --#endif -- eaptls_free_session(ets); -- eap_tls_sendack(esp, id); -- esp->es_client.ea_state = eapTlsRecvSuccess; -- break; -- } -- -- eap_tls_response(esp,id); -- esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -- eapTlsRecv); -- -- break; -- -- default: -- eap_send_nak(esp, id, EAPT_TLS); -- esp->es_client.ea_using_eaptls = 0; -- break; -- } -- -- break; --#endif /* USE_EAPTLS */ -- - #ifdef USE_SRP - case EAPT_SRP: - if (len < 1) { -@@ -2063,11 +1737,6 @@ int len; - u_char dig[SHA_DIGESTSIZE]; - #endif /* USE_SRP */ - --#ifdef USE_EAPTLS -- struct eaptls_session *ets; -- u_char flags; --#endif /* USE_EAPTLS */ -- - if (esp->es_server.ea_id != id) { - dbglog("EAP: discarding Response %d; expected ID %d", id, - esp->es_server.ea_id); -@@ -2107,60 +1776,6 @@ int len; - eap_figure_next_state(esp, 0); - break; - --#ifdef USE_EAPTLS -- case EAPT_TLS: -- switch(esp->es_server.ea_state) { -- -- case eapTlsRecv: -- ets = (struct eaptls_session *) esp->es_server.ea_session; -- eap_figure_next_state(esp, -- eaptls_receive(esp->es_server.ea_session, inp, len)); -- -- if(ets->alert_recv) { -- eap_send_failure(esp); -- break; -- } -- break; -- -- case eapTlsRecvAck: -- if(len > 1) { -- dbglog("EAP-TLS ACK with extra data"); -- } -- eap_figure_next_state(esp, 0); -- break; -- -- case eapTlsRecvClient: -- /* Receive authentication response from client */ -- -- GETCHAR(flags, inp); -- -- if(len == 1 && !flags) { /* Ack = ok */ --#ifdef MPPE -- eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); --#endif -- eap_send_success(esp); -- } -- else { /* failure */ -- eaptls_receive(esp->es_server.ea_session, inp, len); -- warn("Server authentication failed"); -- eap_send_failure(esp); -- } -- -- eaptls_free_session(esp->es_server.ea_session); -- -- break; -- -- case eapTlsRecvAlertAck: -- eap_send_failure(esp); -- break; -- -- default: -- eap_figure_next_state(esp, 1); -- break; -- } -- break; --#endif /* USE_EAPTLS */ -- - case EAPT_NOTIFICATION: - dbglog("EAP unexpected Notification; response discarded"); - break; -@@ -2192,13 +1807,6 @@ int len; - esp->es_server.ea_state = eapMD5Chall; - break; - --#ifdef USE_EAPTLS -- /* Send EAP-TLS start packet */ -- case EAPT_TLS: -- esp->es_server.ea_state = eapTlsStart; -- break; --#endif /* USE_EAPTLS */ -- - default: - dbglog("EAP: peer requesting unknown Type %d", vallen); - switch (esp->es_server.ea_state) { -@@ -2410,27 +2018,13 @@ u_char *inp; - int id; - int len; - { -- if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp) --#ifdef USE_EAPTLS -- && esp->es_client.ea_state != eapTlsRecvSuccess --#endif /* USE_EAPTLS */ -- ) { -+ if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) { - dbglog("EAP unexpected success message in state %s (%d)", - eap_state_name(esp->es_client.ea_state), - esp->es_client.ea_state); - return; - } - --#ifdef USE_EAPTLS -- if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != -- eapTlsRecvSuccess) { -- dbglog("EAP-TLS unexpected success message in state %s (%d)", -- eap_state_name(esp->es_client.ea_state), -- esp->es_client.ea_state); -- return; -- } --#endif /* USE_EAPTLS */ -- - if (esp->es_client.ea_timeout > 0) { - UNTIMEOUT(eap_client_timeout, (void *)esp); - } -@@ -2556,9 +2150,6 @@ void *arg; - int code, id, len, rtype, vallen; - u_char *pstart; - u_int32_t uval; --#ifdef USE_EAPTLS -- u_char flags; --#endif /* USE_EAPTLS */ - - if (inlen < EAP_HEADERLEN) - return (0); -@@ -2623,24 +2214,6 @@ void *arg; - } - break; - --#ifdef USE_EAPTLS -- case EAPT_TLS: -- if (len < 1) -- break; -- GETCHAR(flags, inp); -- len--; -- -- if(flags == 0 && len == 0){ -- printer(arg, " Ack"); -- break; -- } -- -- printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -- printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -- printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -- break; --#endif /* USE_EAPTLS */ -- - case EAPT_SRP: - if (len < 3) - goto truncated; -@@ -2752,25 +2325,6 @@ void *arg; - } - break; - --#ifdef USE_EAPTLS -- case EAPT_TLS: -- if (len < 1) -- break; -- GETCHAR(flags, inp); -- len--; -- -- if(flags == 0 && len == 0){ -- printer(arg, " Ack"); -- break; -- } -- -- printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -- printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -- printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -- -- break; --#endif /* USE_EAPTLS */ -- - case EAPT_NAK: - if (len <= 0) { - printer(arg, " "); -diff --git a/pppd/eap.h b/pppd/eap.h -index 3fa5391..199d184 100644 ---- a/pppd/eap.h -+++ b/pppd/eap.h -@@ -84,16 +84,6 @@ enum eap_state_code { - eapClosed, /* Authentication not in use */ - eapListen, /* Client ready (and timer running) */ - eapIdentify, /* EAP Identify sent */ -- eapTlsStart, /* Send EAP-TLS start packet */ -- eapTlsRecv, /* Receive EAP-TLS tls data */ -- eapTlsSendAck, /* Send EAP-TLS ack */ -- eapTlsSend, /* Send EAP-TLS tls data */ -- eapTlsRecvAck, /* Receive EAP-TLS ack */ -- eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ -- eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ -- eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ -- eapTlsRecvSuccess, /* Receive EAP success */ -- eapTlsRecvFailure, /* Receive EAP failure */ - eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ - eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ - eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ -@@ -105,18 +95,9 @@ enum eap_state_code { - - #define EAP_STATES \ - "Initial", "Pending", "Closed", "Listen", "Identify", \ -- "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ -- "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ - "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" - --#ifdef USE_EAPTLS --#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial ||\ -- (esp)->es_client.ea_state != eapPending ||\ -- (esp)->es_client.ea_state != eapClosed) --#else --#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) --#endif /* USE_EAPTLS */ -- -+#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) - #define eap_server_active(esp) \ - ((esp)->es_server.ea_state >= eapIdentify && \ - (esp)->es_server.ea_state <= eapMD5Chall) -@@ -131,17 +112,11 @@ struct eap_auth { - u_short ea_namelen; /* Length of our name */ - u_short ea_peerlen; /* Length of peer's name */ - enum eap_state_code ea_state; --#ifdef USE_EAPTLS -- enum eap_state_code ea_prev_state; --#endif - u_char ea_id; /* Current id */ - u_char ea_requests; /* Number of Requests sent/received */ - u_char ea_responses; /* Number of Responses */ - u_char ea_type; /* One of EAPT_* */ - u_int32_t ea_keyflags; /* SRP shared key usage flags */ --#ifdef USE_EAPTLS -- bool ea_using_eaptls; --#endif - }; - - /* -@@ -164,12 +139,7 @@ typedef struct eap_state { - * Timeouts. - */ - #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ --#ifdef USE_EAPTLS --#define EAP_DEFTRANSMITS 30 /* max # times to transmit */ -- /* certificates can be long ... */ --#else - #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ --#endif /* USE_EAPTLS */ - #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ - #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ - -diff --git a/pppd/md5.c b/pppd/md5.c -index 2ee0c80..f1291ce 100644 ---- a/pppd/md5.c -+++ b/pppd/md5.c -@@ -33,8 +33,6 @@ - *********************************************************************** - */ - --#ifndef USE_EAPTLS -- - #include - #include "md5.h" - -@@ -307,4 +305,3 @@ UINT4 *in; - ** End of md5.c ** - ******************************** (cut) ******************************** - */ --#endif /* USE_EAPTLS */ -diff --git a/pppd/md5.h b/pppd/md5.h -index 14d7121..71e8b00 100644 ---- a/pppd/md5.h -+++ b/pppd/md5.h -@@ -36,7 +36,6 @@ - ** documentation and/or software. ** - *********************************************************************** - */ --#ifndef USE_EAPTLS - - #ifndef __MD5_INCLUDE__ - -@@ -64,5 +63,3 @@ void MD5_Final (unsigned char hash[], MD5_CTX *mdContext); - - #define __MD5_INCLUDE__ - #endif /* __MD5_INCLUDE__ */ -- --#endif /* USE_EAPTLS */ -diff --git a/pppd/options.c b/pppd/options.c -index 6915b2d..8e62635 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -120,10 +120,6 @@ bool dump_options; /* print out option values */ - bool dryrun; /* print out option values and exit */ - char *domain; /* domain name set by domain option */ - int child_wait = 5; /* # seconds to wait for children at exit */ --#ifdef USE_EAPTLS --bool only_update_crl_server = 0; /* update server crl and exit */ --bool only_update_crl_client = 0; /* update client crl and exit */ --#endif /* USE_EAPTLS */ - struct userenv *userenv_list; /* user environment variables */ - - #ifdef MAXOCTETS -@@ -342,12 +338,6 @@ option_t general_options[] = { - { "mo-timeout", o_int, &maxoctets_timeout, - "Check for traffic limit every N seconds", OPT_PRIO | OPT_LLIMIT | 1 }, - #endif --#ifdef USE_EAPTLS -- { "only-update-crl-server", o_bool, &only_update_crl_server, -- "Update server CA CRLs and exit", 1 }, -- { "only-update-crl-client", o_bool, &only_update_crl_client, -- "Update client CA CRLs and exit", 1 }, --#endif /* USE_EAPTLS */ - - { NULL } - }; -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index 6275df6..24e010c 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -22,13 +22,6 @@ - #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" - #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" - #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" -- --#ifdef USE_EAPTLS --#define _PATH_EAPTLSCLIFILE _ROOT_PATH "/etc/ppp/eaptls-client" --#define _PATH_EAPTLSSERVFILE _ROOT_PATH "/etc/ppp/eaptls-server" --#define _PATH_OPENSSLCONFFILE _ROOT_PATH "/etc/ppp/openssl.cnf" --#endif /* USE_EAPTLS */ -- - #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" - #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" - #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index 760cad4..b474a19 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -4,9 +4,6 @@ CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS = -shared - INSTALL = install - --# EAP-TLS --CFLAGS += -DUSE_EAPTLS=1 -- - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 -diff --git a/pppd/plugins/passprompt.c b/pppd/plugins/passprompt.c -index 6ba73ca..babb6dc 100644 ---- a/pppd/plugins/passprompt.c -+++ b/pppd/plugins/passprompt.c -@@ -107,7 +107,4 @@ void plugin_init(void) - { - add_options(options); - pap_passwd_hook = promptpass; --#ifdef USE_EAPTLS -- eaptls_passwd_hook = promptpass; --#endif - } -diff --git a/pppd/plugins/passwordfd.c b/pppd/plugins/passwordfd.c -index c3f9793..d718f3b 100644 ---- a/pppd/plugins/passwordfd.c -+++ b/pppd/plugins/passwordfd.c -@@ -79,8 +79,4 @@ void plugin_init (void) - - chap_check_hook = pwfd_check; - chap_passwd_hook = pwfd_passwd; -- --#ifdef USE_EAPTLS -- eaptls_passwd_hook = pwfd_passwd; --#endif - } -diff --git a/pppd/pppd.h b/pppd/pppd.h -index aaddba1..5f72f72 100644 ---- a/pppd/pppd.h -+++ b/pppd/pppd.h -@@ -324,10 +324,6 @@ extern bool dump_options; /* print out option values */ - extern bool dryrun; /* check everything, print options, exit */ - extern int child_wait; /* # seconds to wait for children at end */ - --#ifdef USE_EAPTLS --extern char *crl_dir; --#endif /* USE_EAPTLS */ -- - #ifdef MAXOCTETS - extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ - extern int maxoctets_dir; /* Direction : -@@ -742,10 +738,6 @@ extern int (*chap_check_hook) __P((void)); - extern int (*chap_passwd_hook) __P((char *user, char *passwd)); - extern void (*multilink_join_hook) __P((void)); - --#ifdef USE_EAPTLS --extern int (*eaptls_passwd_hook) __P((char *user, char *passwd)); --#endif -- - /* Let a plugin snoop sent and received packets. Useful for L2TP */ - extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); - extern void (*snoop_send_hook) __P((unsigned char *p, int len)); --- -1.8.3.1 - diff --git a/0027-pppd-EAP-TLS-patch-v0.999.patch b/ppp-2.4.7-eaptls-mppe-1.101.patch similarity index 93% rename from 0027-pppd-EAP-TLS-patch-v0.999.patch rename to ppp-2.4.7-eaptls-mppe-1.101.patch index 2f71a8e..127fcf8 100644 --- a/0027-pppd-EAP-TLS-patch-v0.999.patch +++ b/ppp-2.4.7-eaptls-mppe-1.101.patch @@ -1,7 +1,7 @@ -diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-0.999/README.eap-tls +diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.101b/README.eap-tls --- ppp-2.4.7/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-0.999/README.eap-tls 2017-05-09 14:38:55.129084488 +0200 -@@ -0,0 +1,280 @@ ++++ ppp-2.4.7-eaptls-mppe-1.101b/README.eap-tls 2018-06-02 01:42:04.021165440 +0200 +@@ -0,0 +1,286 @@ +EAP-TLS authentication support for PPP +====================================== + @@ -277,14 +277,20 @@ diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-0.999/README.eap-tls +v0.996 (28-May-2014) + - Fix minor bug where SessionTicket message was printed as 'Unknown SSL3 code 4' + - Add EAP-TLS-specific options to pppd.8 manual page. -+ - Updated README.eap-tls file with new option and provide an example. ++ - Updated README.eap-tls file with new options and provide an example. +v0.997 (19-Jun-2014) -+ - change SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET -+ - fix bug in initialisation code with fragmented packets. ++ - Change SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET ++ - Fix bug in initialisation code with fragmented packets. ++v0.998 (13-Mar-2015) ++ - Added fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620 ++v0.999 (11-May-2017) ++ - Added support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x. ++v1.101 (1-Jun-2018) ++ - Fix vulnerabilities CVE-2018-11574. + -diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/eaptls-client +diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-client --- ppp-2.4.7/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/eaptls-client 2017-05-09 14:38:55.129084488 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-client 2018-06-02 01:42:04.021165440 +0200 @@ -0,0 +1,10 @@ +# Parameters for authentication using EAP-TLS (client) + @@ -296,9 +302,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/e +# client private key file (required) + +#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/eaptls-server +diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-server --- ppp-2.4.7/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/eaptls-server 2017-05-09 14:38:55.137084099 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-server 2018-06-02 01:42:04.021165440 +0200 @@ -0,0 +1,11 @@ +# Parameters for authentication using EAP-TLS (server) + @@ -311,9 +317,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/e +# allowed addresses (required, can be *) + +#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/openssl.cnf +diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/openssl.cnf --- ppp-2.4.7/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/openssl.cnf 2017-05-09 14:38:55.137084099 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/openssl.cnf 2018-06-02 01:42:04.021165440 +0200 @@ -0,0 +1,14 @@ +openssl_conf = openssl_def + @@ -329,9 +335,9 @@ diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-0.999/etc.ppp/ope +MODULE_PATH = /usr/lib64/libeTPkcs11.so +init = 0 + -diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-0.999/linux/Makefile.top +diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.101b/linux/Makefile.top --- ppp-2.4.7/linux/Makefile.top 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/linux/Makefile.top 2017-05-09 14:38:55.138084052 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/linux/Makefile.top 2018-06-02 01:42:04.021165440 +0200 @@ -26,7 +26,7 @@ cd pppdump; $(MAKE) $(MFLAGS) install @@ -352,9 +358,9 @@ diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-0.999/linux/Makefi $(BINDIR): $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-0.999/pppd/Makefile.linux +diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.101b/pppd/Makefile.linux --- ppp-2.4.7/pppd/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/Makefile.linux 2017-05-09 14:38:55.138084052 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/Makefile.linux 2018-06-02 01:42:04.021165440 +0200 @@ -76,6 +76,9 @@ # Use libutil USE_LIBUTIL=y @@ -381,9 +387,9 @@ diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-0.999/pppd/Makefi ifdef HAS_SHADOW CFLAGS += -DHAS_SHADOW #LIBS += -lshadow $(LIBS) -diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-0.999/pppd/auth.c +diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/auth.c --- ppp-2.4.7/pppd/auth.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/auth.c 2017-05-09 14:38:55.139084004 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/auth.c 2018-06-02 01:42:04.022165436 +0200 @@ -109,6 +109,9 @@ #include "upap.h" #include "chap-new.h" @@ -879,9 +885,9 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-0.999/pppd/auth.c +} +#endif + -diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-0.999/pppd/ccp.c +diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/ccp.c --- ppp-2.4.7/pppd/ccp.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/ccp.c 2017-05-09 14:38:55.148083482 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/ccp.c 2018-06-02 01:42:04.022165436 +0200 @@ -540,6 +540,9 @@ if (go->mppe) { ccp_options *ao = &ccp_allowoptions[f->unit]; @@ -917,9 +923,9 @@ diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-0.999/pppd/ccp.c lcp_close(f->unit, "MPPE required but not available"); return; } -diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-0.999/pppd/chap-md5.c +diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/chap-md5.c --- ppp-2.4.7/pppd/chap-md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/chap-md5.c 2017-05-09 14:38:55.148083482 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/chap-md5.c 2018-06-02 01:42:04.022165436 +0200 @@ -36,7 +36,11 @@ #include "chap-new.h" #include "chap-md5.h" @@ -932,10 +938,10 @@ diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-0.999/pppd/chap-md5.c #define MD5_HASH_SIZE 16 #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c +diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c --- ppp-2.4.7/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c 2017-05-11 10:43:00.345739124 +0200 -@@ -0,0 +1,1308 @@ ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c 2018-06-02 01:42:16.790124406 +0200 +@@ -0,0 +1,1313 @@ +/* + * eap-tls.c - EAP-TLS implementation for PPP + * @@ -1000,6 +1006,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c + * tries to provide some guidance but ultimately falls short. + */ + ++ +static void HMAC_CTX_free(HMAC_CTX *ctx) +{ + if (ctx != NULL) { @@ -1803,46 +1810,47 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c +int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) +{ + u_char flags; -+ u_int tlslen; ++ u_int tlslen = 0; + u_char dummy[65536]; + ++ if (len < 1) { ++ warn("EAP-TLS: received no or invalid data"); ++ return 1; ++ } ++ + GETCHAR(flags, inp); + len--; + -+ if (flags & EAP_TLS_FLAGS_LI && !ets->data) { -+ ++ if (flags & EAP_TLS_FLAGS_LI && len >= 4) { + /* -+ * This is the first packet of a message ++ * LenghtIncluded flag set -> this is the first packet of a message + */ -+ ++ ++ /* ++ * the first 4 octets are the length of the EAP-TLS message ++ */ + GETLONG(tlslen, inp); + len -= 4; + -+ if (tlslen > EAP_TLS_MAX_LEN) { -+ error("Error: tls message length > %d, truncated", -+ EAP_TLS_MAX_LEN); -+ tlslen = EAP_TLS_MAX_LEN; ++ if (!ets->data) { ++ ++ if (tlslen > EAP_TLS_MAX_LEN) { ++ error("EAP-TLS: TLS message length > %d, truncated", EAP_TLS_MAX_LEN); ++ tlslen = EAP_TLS_MAX_LEN; ++ } ++ ++ /* ++ * Allocate memory for the whole message ++ */ ++ ets->data = malloc(tlslen); ++ if (!ets->data) ++ fatal("EAP-TLS: allocation error\n"); ++ ++ ets->datalen = 0; ++ ets->tlslen = tlslen; + } -+ -+ /* -+ * Allocate memory for the whole message -+ */ -+ ets->data = malloc(tlslen); -+ if (!ets->data) -+ fatal("EAP TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = tlslen; -+ -+ } -+ else if (flags & EAP_TLS_FLAGS_LI && ets->data) { -+ /* -+ * Non first with LI (strange...) -+ */ -+ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ ++ else ++ warn("EAP-TLS: non-first LI packet? that's odd..."); + } + else if (!ets->data) { + /* @@ -1851,7 +1859,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c + + ets->data = malloc(len); + if (!ets->data) -+ fatal("EAP TLS: allocation error\n"); ++ fatal("EAP-TLS: allocation error\n"); + + ets->datalen = 0; + ets->tlslen = len; @@ -1862,8 +1870,13 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c + else + ets->frag = 0; + ++ if (len < 0) { ++ warn("EAP-TLS: received malformed data"); ++ return 1; ++ } ++ + if (len + ets->datalen > ets->tlslen) { -+ warn("EAP TLS: received data > TLS message length"); ++ warn("EAP-TLS: received data > TLS message length"); + return 1; + } + @@ -1877,7 +1890,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c + */ + + if (ets->datalen != ets->tlslen) { -+ warn("EAP TLS: received data != TLS message length"); ++ warn("EAP-TLS: received data != TLS message length"); + return 1; + } + @@ -2138,7 +2151,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c + + switch(content_type) { + -+#if OPENSSL_VERSION_NUMBER >= 0x10100000L + case SSL3_RT_HEADER: + strcat(string, "SSL/TLS Header: "); + switch(hvers) { @@ -2164,7 +2176,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c + strcat(string, "Unknown version"); + } + break; -+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */ + + case SSL3_RT_ALERT: + strcat(string, "Alert: "); @@ -2244,9 +2255,9 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.c + dbglog("%s", string); +} + -diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.h +diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.h --- ppp-2.4.7/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.h 2017-05-09 14:38:55.150083347 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.h 2018-06-02 01:42:04.023165433 +0200 @@ -0,0 +1,107 @@ +/* + * eap-tls.h @@ -2355,9 +2366,9 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-0.999/pppd/eap-tls.h +#endif + +#endif -diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c +diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.c --- ppp-2.4.7/pppd/eap.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c 2017-05-09 14:38:55.151083274 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.c 2018-06-02 01:42:04.023165433 +0200 @@ -43,6 +43,11 @@ * Based on draft-ietf-pppext-eap-srp-03.txt. */ @@ -2674,7 +2685,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c #ifdef USE_SRP struct t_client *tc; struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1456,6 +1696,90 @@ +@@ -1456,6 +1696,100 @@ esp->es_client.ea_namelen); break; @@ -2685,6 +2696,11 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c + + case eapListen: + ++ if (len < 1) { ++ error("EAP: received EAP-TLS Listen packet with no data"); ++ /* Bogus request; wait for something real. */ ++ return; ++ } + GETCHAR(flags, inp); + if(flags & EAP_TLS_FLAGS_START){ + @@ -2722,6 +2738,11 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c + break; + + case eapTlsRecv: ++ if (len < 1) { ++ error("EAP: discarding EAP-TLS Receive packet with no data"); ++ /* Bogus request; wait for something real. */ ++ return; ++ } + eaptls_receive(ets, inp, len); + + if(ets->frag) { @@ -2765,7 +2786,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c #ifdef USE_SRP case EAPT_SRP: if (len < 1) { -@@ -1737,6 +2061,11 @@ +@@ -1737,6 +2071,11 @@ u_char dig[SHA_DIGESTSIZE]; #endif /* USE_SRP */ @@ -2777,7 +2798,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c if (esp->es_server.ea_id != id) { dbglog("EAP: discarding Response %d; expected ID %d", id, esp->es_server.ea_id); -@@ -1776,6 +2105,60 @@ +@@ -1776,6 +2115,64 @@ eap_figure_next_state(esp, 0); break; @@ -2786,6 +2807,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c + switch(esp->es_server.ea_state) { + + case eapTlsRecv: ++ + ets = (struct eaptls_session *) esp->es_server.ea_session; + eap_figure_next_state(esp, + eaptls_receive(esp->es_server.ea_session, inp, len)); @@ -2806,19 +2828,22 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c + case eapTlsRecvClient: + /* Receive authentication response from client */ + -+ GETCHAR(flags, inp); ++ if (len > 0) { ++ GETCHAR(flags, inp); + -+ if(len == 1 && !flags) { /* Ack = ok */ ++ if(len == 1 && !flags) { /* Ack = ok */ +#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); ++ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); +#endif -+ eap_send_success(esp); -+ } -+ else { /* failure */ -+ eaptls_receive(esp->es_server.ea_session, inp, len); -+ warn("Server authentication failed"); -+ eap_send_failure(esp); ++ eap_send_success(esp); ++ } ++ else { /* failure */ ++ warn("Server authentication failed"); ++ eap_send_failure(esp); ++ } + } ++ else ++ warn("Bogus EAP-TLS packet received from client"); + + eaptls_free_session(esp->es_server.ea_session); + @@ -2838,7 +2863,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c case EAPT_NOTIFICATION: dbglog("EAP unexpected Notification; response discarded"); break; -@@ -1807,6 +2190,13 @@ +@@ -1807,6 +2204,13 @@ esp->es_server.ea_state = eapMD5Chall; break; @@ -2852,7 +2877,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c default: dbglog("EAP: peer requesting unknown Type %d", vallen); switch (esp->es_server.ea_state) { -@@ -2018,13 +2408,27 @@ +@@ -2018,13 +2422,27 @@ int id; int len; { @@ -2881,7 +2906,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c if (esp->es_client.ea_timeout > 0) { UNTIMEOUT(eap_client_timeout, (void *)esp); } -@@ -2150,6 +2554,9 @@ +@@ -2150,6 +2568,9 @@ int code, id, len, rtype, vallen; u_char *pstart; u_int32_t uval; @@ -2891,7 +2916,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c if (inlen < EAP_HEADERLEN) return (0); -@@ -2214,6 +2621,24 @@ +@@ -2214,6 +2635,24 @@ } break; @@ -2916,7 +2941,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c case EAPT_SRP: if (len < 3) goto truncated; -@@ -2325,6 +2750,25 @@ +@@ -2325,6 +2764,25 @@ } break; @@ -2942,14 +2967,14 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.c case EAPT_NAK: if (len <= 0) { printer(arg, " "); -@@ -2426,3 +2870,4 @@ +@@ -2426,3 +2884,4 @@ return (inp - pstart); } + -diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.h +diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.h --- ppp-2.4.7/pppd/eap.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.h 2017-05-09 14:38:55.152083200 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.h 2018-06-02 01:42:04.023165433 +0200 @@ -84,6 +84,16 @@ eapClosed, /* Authentication not in use */ eapListen, /* Client ready (and timer running) */ @@ -3018,9 +3043,9 @@ diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-0.999/pppd/eap.h #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ -diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.c +diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.c --- ppp-2.4.7/pppd/md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.c 2017-05-09 14:38:55.152083200 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.c 2018-06-02 01:42:04.023165433 +0200 @@ -33,6 +33,8 @@ *********************************************************************** */ @@ -3036,9 +3061,9 @@ diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.c */ +#endif /* USE_EAPTLS */ + -diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.h +diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.h --- ppp-2.4.7/pppd/md5.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.h 2017-05-09 14:38:55.152083200 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.h 2018-06-02 01:42:04.024165430 +0200 @@ -36,6 +36,7 @@ ** documentation and/or software. ** *********************************************************************** @@ -3053,9 +3078,9 @@ diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-0.999/pppd/md5.h #endif /* __MD5_INCLUDE__ */ + +#endif /* USE_EAPTLS */ -diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-0.999/pppd/pathnames.h +diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/pathnames.h --- ppp-2.4.7/pppd/pathnames.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/pathnames.h 2017-05-09 14:38:55.153083126 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pathnames.h 2018-06-02 01:42:04.024165430 +0200 @@ -21,6 +21,13 @@ #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" @@ -3070,9 +3095,9 @@ diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-0.999/pppd/pathnames #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/Makefile.linux +diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/Makefile.linux --- ppp-2.4.7/pppd/plugins/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/Makefile.linux 2017-05-09 14:38:55.153083126 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/Makefile.linux 2018-06-02 01:42:04.024165430 +0200 @@ -4,6 +4,9 @@ LDFLAGS = -shared INSTALL = install @@ -3083,9 +3108,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-0.999/ppp DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/passprompt.c +diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passprompt.c --- ppp-2.4.7/pppd/plugins/passprompt.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/passprompt.c 2017-05-09 14:38:55.153083126 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passprompt.c 2018-06-02 01:42:04.024165430 +0200 @@ -107,4 +107,7 @@ { add_options(options); @@ -3094,9 +3119,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-0.999/pppd/ + eaptls_passwd_hook = promptpass; +#endif } -diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/passwordfd.c +diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passwordfd.c --- ppp-2.4.7/pppd/plugins/passwordfd.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/plugins/passwordfd.c 2017-05-09 14:38:55.154083052 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passwordfd.c 2018-06-02 01:42:04.024165430 +0200 @@ -79,4 +79,8 @@ chap_check_hook = pwfd_check; @@ -3106,9 +3131,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-0.999/pppd/ + eaptls_passwd_hook = pwfd_passwd; +#endif } -diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.8 +diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.8 --- ppp-2.4.7/pppd/pppd.8 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.8 2017-05-09 14:38:55.155082978 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.8 2018-06-02 01:42:04.025165427 +0200 @@ -248,6 +248,12 @@ compression in the corresponding direction. Use \fInobsdcomp\fR or \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. @@ -3177,9 +3202,9 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.8 .B noauth Do not require the peer to authenticate itself. This option is privileged. -diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.h +diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.h --- ppp-2.4.7/pppd/pppd.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-0.999/pppd/pppd.h 2017-05-09 14:38:55.156082905 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.h 2018-06-02 01:42:04.025165427 +0200 @@ -325,6 +325,11 @@ extern bool dryrun; /* check everything, print options, exit */ extern int child_wait; /* # seconds to wait for children at end */ diff --git a/ppp.spec b/ppp.spec index 12d2add..c5b7aa6 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 21%{?dist} +Release: 22%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -38,7 +38,6 @@ Patch0013: 0013-everywhere-O_CLOEXEC-harder.patch Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch -Patch0017: 0017-pppd-rebase-EAP-TLS-patch-v0.994.patch Patch0018: 0018-scritps-fix-ip-up.local-sample.patch Patch0019: 0019-sys-linux-rework-get_first_ethernet.patch Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch @@ -47,8 +46,7 @@ Patch0022: 0022-build-sys-compile-pppol2tp-with-multilink-support.patch Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: 0025-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: 0026-Revert-pppd-rebase-EAP-TLS-patch-v0.994.patch -Patch0027: 0027-pppd-EAP-TLS-patch-v0.999.patch +Patch0026: ppp-2.4.7-eaptls-mppe-1.101.patch Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch # rhbz#1556132 @@ -175,6 +173,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Tue Jun 5 2018 Jaroslav Škarvada - 2.4.7-22 +- Updated EAP-TLS patch to v1.101 + Resolves: CVE-2018-11574 + * Mon Apr 9 2018 Jaroslav Škarvada - 2.4.7-21 - Link with -E not to break plugins Resolves: rhbz#1564459 From 1bd88cdb7f3f36ddde6b091158b1ab29294f877d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 20 Jun 2018 11:59:48 +0200 Subject: [PATCH 10/76] Replaced initscripts requirement by the network-scripts Resolves: rhbz#1592384 --- ppp.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ppp.spec b/ppp.spec index c5b7aa6..2a54894 100644 --- a/ppp.spec +++ b/ppp.spec @@ -3,7 +3,7 @@ Summary: The Point-to-Point Protocol daemon Name: ppp Version: 2.4.7 -Release: 22%{?dist} +Release: 23%{?dist} License: BSD and LGPLv2+ and GPLv2+ and Public Domain Group: System Environment/Daemons URL: http://www.samba.org/ppp @@ -56,7 +56,7 @@ Patch0030: ppp-2.4.7-honor-ldflags.patch BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel BuildRequires: openssl-devel -Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd, initscripts >= 9.54 +Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd, network-scripts Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd @@ -173,6 +173,10 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Wed Jun 20 2018 Jaroslav Škarvada - 2.4.7-23 +- Replaced initscripts requirement by the network-scripts + Resolves: rhbz#1592384 + * Tue Jun 5 2018 Jaroslav Škarvada - 2.4.7-22 - Updated EAP-TLS patch to v1.101 Resolves: CVE-2018-11574 From eaa5f714f4022be340cf3bb1e2aabda9fb575760 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 30 Jun 2018 11:23:26 +0100 Subject: [PATCH 11/76] Remove group/defattr, minor spec cleanups --- ppp.spec | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/ppp.spec b/ppp.spec index 2a54894..6c3c2d6 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,12 +1,12 @@ %global _hardened_build 1 -Summary: The Point-to-Point Protocol daemon -Name: ppp +Name: ppp Version: 2.4.7 -Release: 23%{?dist} +Release: 24%{?dist} +Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain -Group: System Environment/Daemons -URL: http://www.samba.org/ppp +URL: http://www.samba.org/ppp + Source0: ftp://ftp.samba.org/pub/ppp/ppp-%{version}.tar.gz Source1: ppp-pam.conf Source2: ppp-logrotate.conf @@ -56,6 +56,7 @@ Patch0030: ppp-2.4.7-honor-ldflags.patch BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel BuildRequires: openssl-devel + Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd, network-scripts Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd @@ -69,7 +70,6 @@ organization over a modem and phone line. %package devel Summary: Headers for ppp plugin development -Group: Development/Libraries Requires: %{name}%{?_isa} = %{version}-%{release} %description devel @@ -128,7 +128,7 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %tmpfiles_create ppp.conf %files -%defattr(-,root,root) +%doc FAQ README README.cbcp README.linux README.MPPE README.MSCHAP80 README.MSCHAP81 README.pwfd README.pppoe scripts sample README.eap-tls %{_sbindir}/chat %{_sbindir}/pppd %{_sbindir}/pppdump @@ -165,14 +165,15 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %config(noreplace) %{_sysconfdir}/pam.d/ppp %config(noreplace) %{_sysconfdir}/logrotate.d/ppp %{_tmpfilesdir}/ppp.conf -%doc FAQ README README.cbcp README.linux README.MPPE README.MSCHAP80 README.MSCHAP81 README.pwfd README.pppoe scripts sample README.eap-tls %files devel -%defattr(-,root,root) %{_includedir}/pppd %doc PLUGINS %changelog +* Sat Jun 30 2018 Peter Robinson 2.4.7-24 +- Remove group/defattr, minor spec cleanups + * Wed Jun 20 2018 Jaroslav Škarvada - 2.4.7-23 - Replaced initscripts requirement by the network-scripts Resolves: rhbz#1592384 From ad2ec1482b8244486e60740852628c88efe90064 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 13 Jul 2018 22:48:57 +0000 Subject: [PATCH 12/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 6c3c2d6..7a682ac 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 24%{?dist} +Release: 25%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -171,6 +171,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Jul 13 2018 Fedora Release Engineering - 2.4.7-25 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Sat Jun 30 2018 Peter Robinson 2.4.7-24 - Remove group/defattr, minor spec cleanups From 0e0bd8ac458fc702de3f0e2606a01643e9a11feb Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Tue, 17 Jul 2018 16:51:18 +0100 Subject: [PATCH 13/76] add gcc build dep --- ppp.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ppp.spec b/ppp.spec index 7a682ac..1904460 100644 --- a/ppp.spec +++ b/ppp.spec @@ -54,6 +54,7 @@ Patch0029: ppp-2.4.7-DES-openssl.patch # https://github.com/paulusmack/ppp/pull/95 Patch0030: ppp-2.4.7-honor-ldflags.patch +BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel BuildRequires: openssl-devel From bb9869600908ae815942efa1115cce1da4bcf10d Mon Sep 17 00:00:00 2001 From: Lubomir Rintel Date: Tue, 24 Jul 2018 15:19:26 +0200 Subject: [PATCH 14/76] Split out the network-scripts The network-scripts are now removed from the RHEL 8 base installation (and possibly Fedora too). Let's remove them, so that we don't drag in the legacy scripts when we don't need them (e.g. invoking through NetworkManager or pptp and the like). The boolean weak dependency is utilized to make life easier for those still relying on the legacy network service and to avoid breakage on upgrades. --- ppp.spec | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/ppp.spec b/ppp.spec index 1904460..a874d95 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 25%{?dist} +Release: 26%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -58,7 +58,7 @@ BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel BuildRequires: openssl-devel -Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd, network-scripts +Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd @@ -69,6 +69,15 @@ transmitting datagrams over serial point-to-point links. PPP is usually used to dial in to an ISP (Internet Service Provider) or other organization over a modem and phone line. +%package -n network-scripts-%{name} +Summary: PPP legacy network service support +Requires: network-scripts +Supplements: (%{name} and network-scripts) + +%description -n network-scripts-%{name} +This provides the ifup and ifdown scripts for use with the legacy network +service. + %package devel Summary: Headers for ppp plugin development Requires: %{name}%{?_isa} = %{version}-%{release} @@ -114,7 +123,7 @@ install -d %{buildroot}%{_sysconfdir}/ppp install -p %{SOURCE4} %{buildroot}%{_sysconfdir}/ppp/ip-down install -p %{SOURCE5} %{buildroot}%{_sysconfdir}/ppp/ip-down.ipv6to4 install -p %{SOURCE6} %{buildroot}%{_sysconfdir}/ppp/ip-up -install -p %{SOURCE7} %{buildroot}%{_sysconfdir}/ppp/ip-up.ipv6to4 +install -p %{SOURCE8} %{buildroot}%{_sysconfdir}/ppp/ip-up.ipv6to4 install -p %{SOURCE8} %{buildroot}%{_sysconfdir}/ppp/ipv6-down install -p %{SOURCE9} %{buildroot}%{_sysconfdir}/ppp/ipv6-up @@ -143,8 +152,6 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %{_sysconfdir}/ppp/ip-down.ipv6to4 %{_sysconfdir}/ppp/ipv6-up %{_sysconfdir}/ppp/ipv6-down -%{_sysconfdir}/sysconfig/network-scripts/ifdown-ppp -%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp %{_mandir}/man8/chat.8* %{_mandir}/man8/pppd.8* %{_mandir}/man8/pppdump.8* @@ -167,11 +174,18 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %config(noreplace) %{_sysconfdir}/logrotate.d/ppp %{_tmpfilesdir}/ppp.conf +%files -n network-scripts-%{name} +%{_sysconfdir}/sysconfig/network-scripts/ifdown-ppp +%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp + %files devel %{_includedir}/pppd %doc PLUGINS %changelog +* Tue Jul 24 2018 Lubomir Rintel - 2.4.7-26 +- Split out the network-scripts + * Fri Jul 13 2018 Fedora Release Engineering - 2.4.7-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From 735ece793dd79cbd37e2769804a135acaafd132c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 5 Nov 2018 16:51:12 +0100 Subject: [PATCH 15/76] Updated EAP-TLS patch to v1.102 --- ...patch => ppp-2.4.7-eaptls-mppe-1.102.patch | 419 +++++++++++------- ppp.spec | 7 +- 2 files changed, 252 insertions(+), 174 deletions(-) rename ppp-2.4.7-eaptls-mppe-1.101.patch => ppp-2.4.7-eaptls-mppe-1.102.patch (90%) diff --git a/ppp-2.4.7-eaptls-mppe-1.101.patch b/ppp-2.4.7-eaptls-mppe-1.102.patch similarity index 90% rename from ppp-2.4.7-eaptls-mppe-1.101.patch rename to ppp-2.4.7-eaptls-mppe-1.102.patch index 127fcf8..598d1da 100644 --- a/ppp-2.4.7-eaptls-mppe-1.101.patch +++ b/ppp-2.4.7-eaptls-mppe-1.102.patch @@ -1,7 +1,7 @@ -diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.101b/README.eap-tls +diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls --- ppp-2.4.7/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.101b/README.eap-tls 2018-06-02 01:42:04.021165440 +0200 -@@ -0,0 +1,286 @@ ++++ ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls 2018-11-02 17:14:08.101636586 +0100 +@@ -0,0 +1,291 @@ +EAP-TLS authentication support for PPP +====================================== + @@ -11,7 +11,7 @@ diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.101b/README.eap-tls + security protocol that can be used with PPP. It provides a means + to plug in multiple optional authentication methods. + -+ Transport Level Security (TLS; RFC 2246) provides for mutual ++ Transport Level Security (TLS; RFC 5216) provides for mutual + authentication, integrity-protected ciphersuite negotiation and + key exchange between two endpoints. It also provides for optional + MPPE encryption. @@ -282,15 +282,20 @@ diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.101b/README.eap-tls + - Change SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET + - Fix bug in initialisation code with fragmented packets. +v0.998 (13-Mar-2015) -+ - Added fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620 ++ - Add fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620 +v0.999 (11-May-2017) -+ - Added support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x. ++ - Add support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x. +v1.101 (1-Jun-2018) + - Fix vulnerabilities CVE-2018-11574. -+ -diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-client ++v1.102 (2-Nov-2018) ++ - Add TLS 1.2 support. Windows 7/8 will connect using TLS 1.0, Windows 10 clients using TLS 1.2. ++ This works both when compiling against OpenSSL 1.0.1+ and 1.1+. ++ - Print warning when certificate is either not yet valid or has expired. ++ - Perform better peer certificate checks. ++ - Allow certificate chain files to be used. +diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-client --- ppp-2.4.7/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-client 2018-06-02 01:42:04.021165440 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-client 2018-10-30 16:47:59.527263750 +0100 @@ -0,0 +1,10 @@ +# Parameters for authentication using EAP-TLS (client) + @@ -302,9 +307,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/ +# client private key file (required) + +#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-server +diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-server --- ppp-2.4.7/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-server 2018-06-02 01:42:04.021165440 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-server 2018-10-30 16:47:59.527263750 +0100 @@ -0,0 +1,11 @@ +# Parameters for authentication using EAP-TLS (server) + @@ -317,9 +322,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/ +# allowed addresses (required, can be *) + +#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/openssl.cnf +diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/openssl.cnf --- ppp-2.4.7/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/openssl.cnf 2018-06-02 01:42:04.021165440 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/openssl.cnf 2018-10-30 16:47:59.527263750 +0100 @@ -0,0 +1,14 @@ +openssl_conf = openssl_def + @@ -335,9 +340,9 @@ diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/op +MODULE_PATH = /usr/lib64/libeTPkcs11.so +init = 0 + -diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.101b/linux/Makefile.top +diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.102/linux/Makefile.top --- ppp-2.4.7/linux/Makefile.top 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/linux/Makefile.top 2018-06-02 01:42:04.021165440 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/linux/Makefile.top 2018-10-30 16:47:59.528263707 +0100 @@ -26,7 +26,7 @@ cd pppdump; $(MAKE) $(MFLAGS) install @@ -358,9 +363,9 @@ diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.101b/linux/Makef $(BINDIR): $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.101b/pppd/Makefile.linux +diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/pppd/Makefile.linux --- ppp-2.4.7/pppd/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/Makefile.linux 2018-06-02 01:42:04.021165440 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/Makefile.linux 2018-10-30 16:47:59.528263707 +0100 @@ -76,6 +76,9 @@ # Use libutil USE_LIBUTIL=y @@ -387,9 +392,9 @@ diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.101b/pppd/Makef ifdef HAS_SHADOW CFLAGS += -DHAS_SHADOW #LIBS += -lshadow $(LIBS) -diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/auth.c +diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c --- ppp-2.4.7/pppd/auth.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/auth.c 2018-06-02 01:42:04.022165436 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c 2018-10-30 16:47:59.530263608 +0100 @@ -109,6 +109,9 @@ #include "upap.h" #include "chap-new.h" @@ -885,9 +890,9 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/auth.c +} +#endif + -diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/ccp.c +diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c --- ppp-2.4.7/pppd/ccp.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/ccp.c 2018-06-02 01:42:04.022165436 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c 2018-10-30 16:47:59.531263554 +0100 @@ -540,6 +540,9 @@ if (go->mppe) { ccp_options *ao = &ccp_allowoptions[f->unit]; @@ -923,9 +928,9 @@ diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/ccp.c lcp_close(f->unit, "MPPE required but not available"); return; } -diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/chap-md5.c +diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.102/pppd/chap-md5.c --- ppp-2.4.7/pppd/chap-md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/chap-md5.c 2018-06-02 01:42:04.022165436 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/chap-md5.c 2018-10-30 16:47:59.532263499 +0100 @@ -36,7 +36,11 @@ #include "chap-new.h" #include "chap-md5.h" @@ -938,12 +943,11 @@ diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/chap-md5. #define MD5_HASH_SIZE 16 #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c +diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c --- ppp-2.4.7/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c 2018-06-02 01:42:16.790124406 +0200 -@@ -0,0 +1,1313 @@ -+/* -+ * eap-tls.c - EAP-TLS implementation for PPP ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c 2018-11-02 16:53:05.996742547 +0100 +@@ -0,0 +1,1383 @@ ++/* * eap-tls.c - EAP-TLS implementation for PPP + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. + * @@ -999,14 +1003,20 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + +#ifdef MPPE + -+#if OPENSSL_VERSION_NUMBER < 0x10100000L ++#define EAPTLS_MPPE_KEY_LEN 32 ++ ++/* ++ * The following stuff is only needed if SSL_export_keying_material() is not available ++ */ ++ ++#if OPENSSL_VERSION_NUMBER < 0x10001000L + +/* + * https://wiki.openssl.org/index.php/1.1_API_Changes + * tries to provide some guidance but ultimately falls short. ++ * + */ + -+ +static void HMAC_CTX_free(HMAC_CTX *ctx) +{ + if (ctx != NULL) { @@ -1023,11 +1033,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + return ctx; +} + -+/* -+ * These were basically jacked directly from the OpenSSL tree -+ * without adjustments. -+ */ -+ +static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, + size_t outlen) +{ @@ -1061,10 +1066,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + return outlen; +} + -+/* Avoid a deprecated warning in OpenSSL 1.1 whilst still allowing to build against 1.0.x */ -+#define TLS_method TLSv1_method -+ -+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + +/* + * TLS PRF from RFC 2246 @@ -1122,8 +1123,8 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + const unsigned char *seed, unsigned int seed_len, + unsigned char *out, unsigned char *buf, unsigned int out_len) +{ -+ unsigned int i; -+ unsigned int len = (secret_len + 1) / 2; ++ unsigned int i; ++ unsigned int len = (secret_len + 1) / 2; + const unsigned char *s1 = secret; + const unsigned char *s2 = secret + (secret_len - len); + @@ -1135,57 +1136,88 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + } +} + -+#define EAPTLS_MPPE_KEY_LEN 32 ++static int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, ++ const char *label, size_t llen, ++ const unsigned char *p, size_t plen, ++ int use_context) ++{ ++ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; ++ unsigned char buf[4*EAPTLS_MPPE_KEY_LEN]; ++ unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH]; ++ size_t master_key_length; ++ unsigned char *pp; ++ ++ pp = seed; ++ ++ memcpy(pp, label, llen); ++ pp += llen; ++ ++ llen += SSL_get_client_random(s, pp, SSL3_RANDOM_SIZE); ++ pp += SSL3_RANDOM_SIZE; ++ ++ llen += SSL_get_server_random(s, pp, SSL3_RANDOM_SIZE); ++ ++ master_key_length = SSL_SESSION_get_master_key(SSL_get_session(s), master_key, ++ sizeof(master_key)); ++ PRF(master_key, master_key_length, seed, llen, out, buf, olen); ++ ++ return 1; ++} ++ ++#endif /* OPENSSL_VERSION_NUMBER < 0x10001000L */ ++ ++ ++/* ++ * OpenSSL 1.1+ introduced a generic TLS_method() ++ * For older releases we substitute the appropriate method ++ */ ++ ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++ ++#define TLS_method SSLv23_method ++ ++#define SSL3_RT_HEADER 0x100 ++ ++#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ ++ + +/* + * Generate keys according to RFC 2716 and add to reply + */ +void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, -+ int client) ++ int client) +{ -+ unsigned char out[4*EAPTLS_MPPE_KEY_LEN], buf[4*EAPTLS_MPPE_KEY_LEN]; -+ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; -+ unsigned char *p = seed; -+ SSL *s = ets->ssl; -+ size_t prf_size; -+ unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH]; -+ size_t master_key_length; ++ unsigned char out[4*EAPTLS_MPPE_KEY_LEN]; ++ size_t prf_size = strlen(prf_label); ++ unsigned char *p; + -+ prf_size = strlen(prf_label); ++ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, NULL, 0, 0) != 1) ++ { ++ warn( "EAP-TLS: Failed generating keying material" ); ++ return; ++ } + -+ memcpy(p, prf_label, prf_size); -+ p += prf_size; -+ -+ prf_size += SSL_get_client_random(s, p, SSL3_RANDOM_SIZE); -+ p += SSL3_RANDOM_SIZE; -+ -+ prf_size += SSL_get_server_random(s, p, SSL3_RANDOM_SIZE); -+ -+ master_key_length = SSL_SESSION_get_master_key(SSL_get_session(s), master_key, -+ sizeof(master_key)); -+ PRF(master_key, master_key_length, seed, prf_size, out, buf, sizeof(out)); -+ -+ /* -+ * We now have the master send and receive keys. -+ * From these, generate the session send and receive keys. -+ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) -+ */ -+ if (client) -+ { ++ /* ++ * We now have the master send and receive keys. ++ * From these, generate the session send and receive keys. ++ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) ++ */ ++ if (client) ++ { + p = out; + BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); + p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ } -+ else -+ { -+ p = out; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); ++ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); ++ } ++ else ++ { ++ p = out; ++ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); + p += EAPTLS_MPPE_KEY_LEN; + BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ } ++ } + -+ mppe_keys_set = 1; ++ mppe_keys_set = 1; +} + +#endif @@ -1194,7 +1226,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c +{ + unsigned long ssl_err = ERR_get_error(); + -+ if (ssl_err != 0) ++ if (ssl_err != 0) + dbglog("EAP-TLS SSL error stack:"); + while (ssl_err != 0) { + dbglog( ERR_error_string( ssl_err, NULL ) ); @@ -1216,34 +1248,34 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + +CONF *eaptls_ssl_load_config( void ) +{ -+ CONF *config; -+ int ret_code; -+ long error_line = 33; ++ CONF *config; ++ int ret_code; ++ long error_line = 33; + -+ config = NCONF_new( NULL ); ++ config = NCONF_new( NULL ); + dbglog( "Loading OpenSSL config file" ); -+ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); -+ if (ret_code == 0) -+ { -+ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); -+ NCONF_free( config ); -+ config = NULL; -+ ERR_clear_error(); -+ } ++ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); ++ if (ret_code == 0) ++ { ++ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); ++ NCONF_free( config ); ++ config = NULL; ++ ERR_clear_error(); ++ } + + dbglog( "Loading OpenSSL built-ins" ); -+ ENGINE_load_builtin_engines(); -+ OPENSSL_load_builtin_modules(); ++ ENGINE_load_builtin_engines(); ++ OPENSSL_load_builtin_modules(); + + dbglog( "Loading OpenSSL configured modules" ); -+ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) -+ { -+ warn( "EAP-TLS: Error loading OpenSSL modules" ); ++ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) ++ { ++ warn( "EAP-TLS: Error loading OpenSSL modules" ); + log_ssl_errors(); -+ config = NULL; -+ } ++ config = NULL; ++ } + -+ return config; ++ return config; +} + +ENGINE *eaptls_ssl_load_engine( char *engine_name ) @@ -1255,7 +1287,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + + dbglog( "Loading OpenSSL '%s' engine support", engine_name ); + e = ENGINE_by_id( engine_name ); -+ if (!e) ++ if (!e) + { + dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); + e = ENGINE_by_id( "dynamic" ); @@ -1276,7 +1308,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + } + } + -+ if (e) ++ if (e) + { + dbglog( "Initialising engine" ); + if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) @@ -1288,7 +1320,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + } + } + -+ return e; ++ return e; +} + +/* @@ -1303,30 +1335,32 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + char *pkey_engine_name = NULL; + char *pkey_identifier = NULL; + SSL_CTX *ctx; ++ SSL *ssl; + X509_STORE *certstore; + X509_LOOKUP *lookup; + X509 *tmp; ++ int ret; + + /* + * Without these can't continue + */ + if (!cacertfile[0]) -+ { ++ { + error("EAP-TLS: CA certificate missing"); + return NULL; -+ } ++ } + + if (!certfile[0]) -+ { ++ { + error("EAP-TLS: User certificate missing"); + return NULL; -+ } ++ } + + if (!privkeyfile[0]) -+ { ++ { + error("EAP-TLS: User private key missing"); + return NULL; -+ } ++ } + + SSL_library_init(); + SSL_load_error_strings(); @@ -1422,7 +1456,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + } + } + -+ SSL_CTX_set_default_passwd_cb (ctx, password_callback); ++ SSL_CTX_set_default_passwd_cb (ctx, password_callback); + + if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) + { @@ -1430,7 +1464,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + goto fail; + } + -+ if (init_server) ++ if (init_server) + SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); + + if (cert_engine) @@ -1468,13 +1502,41 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + } + else + { -+ if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM)) ++ if (!SSL_CTX_use_certificate_chain_file(ctx, certfile)) + { + error( "EAP-TLS: Cannot use public certificate %s", certfile ); + goto fail; + } + } + ++ ++ /* ++ * Check the Before and After dates of the certificate ++ */ ++ ssl = SSL_new(ctx); ++ tmp = SSL_get_certificate(ssl); ++ ++ ret = X509_cmp_time(X509_get_notBefore(tmp), NULL); ++ if (ret == 0) ++ { ++ warn( "EAP-TLS: Failed to read certificate notBefore field."); ++ } ++ if (ret > 0) ++ { ++ warn( "EAP-TLS: Your certificate is not yet valid!"); ++ } ++ ++ ret = X509_cmp_time(X509_get_notAfter(tmp), NULL); ++ if (ret == 0) ++ { ++ warn( "EAP-TLS: Failed to read certificate notAfter field."); ++ } ++ if (ret < 0) ++ { ++ warn( "EAP-TLS: Your certificate has expired!"); ++ } ++ SSL_free(ssl); ++ + if (pkey_engine) + { + EVP_PKEY *pkey = NULL; @@ -1517,9 +1579,10 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + /* Explicitly set the NO_TICKETS flag to support Win7/Win8 clients */ + SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 +#ifdef SSL_OP_NO_TICKET -+ | SSL_OP_NO_TICKET ++ | SSL_OP_NO_TICKET +#endif -+); ++ ); ++ + SSL_CTX_set_verify_depth(ctx, 5); + SSL_CTX_set_verify(ctx, + SSL_VERIFY_PEER | @@ -1543,33 +1606,33 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); + } + -+ if (crl_file) { -+ FILE *fp = NULL; -+ X509_CRL *crl = NULL; ++ if (crl_file) { ++ FILE *fp = NULL; ++ X509_CRL *crl = NULL; + -+ fp = fopen(crl_file, "r"); -+ if (!fp) { -+ error("EAP-TLS: Cannot open CRL file '%s'", crl_file); -+ goto fail; -+ } ++ fp = fopen(crl_file, "r"); ++ if (!fp) { ++ error("EAP-TLS: Cannot open CRL file '%s'", crl_file); ++ goto fail; ++ } + -+ crl = PEM_read_X509_CRL(fp, NULL, NULL, NULL); -+ if (!crl) { -+ error("EAP-TLS: Cannot read CRL file '%s'", crl_file); -+ goto fail; -+ } ++ crl = PEM_read_X509_CRL(fp, NULL, NULL, NULL); ++ if (!crl) { ++ error("EAP-TLS: Cannot read CRL file '%s'", crl_file); ++ goto fail; ++ } + + if (!(certstore = SSL_CTX_get_cert_store(ctx))) { + error("EAP-TLS: Failed to get certificate store"); + goto fail; + } -+ if (!X509_STORE_add_crl(certstore, crl)) { -+ error("EAP-TLS: Cannot add CRL to certificate store"); -+ goto fail; -+ } ++ if (!X509_STORE_add_crl(certstore, crl)) { ++ error("EAP-TLS: Cannot add CRL to certificate store"); ++ goto fail; ++ } + X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); + -+ } ++ } + + /* + * If a peer certificate file was specified, it must be valid, else fail @@ -1606,10 +1669,10 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + + mtu = ho->neg_mru? ho->mru: PPP_MRU; + mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; -+ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; ++ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; + + dbglog("MTU = %d", mtu); -+ return mtu; ++ return mtu; +} + + @@ -1821,7 +1884,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + GETCHAR(flags, inp); + len--; + -+ if (flags & EAP_TLS_FLAGS_LI && len >= 4) { ++ if (flags & EAP_TLS_FLAGS_LI && len > 4) { + /* + * LenghtIncluded flag set -> this is the first packet of a message + */ @@ -1932,7 +1995,10 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + * Read from ssl + */ + if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) -+ fatal("No data from BIO_read"); ++ { ++ warn("EAP-TLS send: No data from BIO_read"); ++ return 1; ++ } + + ets->datalen = res; + @@ -1945,7 +2011,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + } + + size = ets->datalen - ets->offset; -+ ++ + if (size > ets->mtu) { + size = ets->mtu; + ets->frag = 1; @@ -2009,13 +2075,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + * is done by ssl; we check the CN in the peer certificate + * against the peer name. + */ -+int ssl_verify_callback(int preverify_ok, X509_STORE_CTX * ctx) ++int ssl_verify_callback(int ok, X509_STORE_CTX * ctx) +{ + char subject[256]; + char cn_str[256]; + X509 *peer_cert; + int err, depth; -+ int ok = preverify_ok; + SSL *ssl; + struct eaptls_session *ets; + @@ -2025,7 +2090,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + + dbglog("certificate verify depth: %d", depth); + -+ if (auth_required && !ok) { ++ if (auth_required && !ok) { + X509_NAME_oneline(X509_get_subject_name(peer_cert), + subject, 256); + @@ -2065,7 +2130,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + */ + if (!ets->peer[0]) { + warn("Peer name not specified: no check"); -+ return 1; ++ return ok; + } + + /* @@ -2093,7 +2158,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + } + } + -+ return 1; ++ return ok; +} + +/* @@ -2142,7 +2207,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + struct eaptls_session *ets = (struct eaptls_session *)arg; + unsigned char code; + const unsigned char*msg = buf; -+ int hvers = msg[1] << 8 | msg[2]; ++ int hvers = msg[1] << 8 | msg[2]; + + if(write_p) + strcpy(string, " -> "); @@ -2166,12 +2231,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + case TLS1_2_VERSION: + strcat(string, "TLS 1.2"); + break; -+ case DTLS1_VERSION: -+ strcat(string, "DTLS 1.0"); -+ break; -+ case DTLS1_2_VERSION: -+ strcat(string, "DTLS 1.2"); -+ break; + default: + strcat(string, "Unknown version"); + } @@ -2235,9 +2294,25 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + strcat(string,"Client Key Exchange"); + break; + case SSL3_MT_FINISHED: -+ strcat(string,"Finished"); ++ strcat(string,"Finished: "); ++ hvers = SSL_version(ssl); ++ switch(hvers) { ++ case SSL3_VERSION: ++ strcat(string, "SSL 3.0"); ++ break; ++ case TLS1_VERSION: ++ strcat(string, "TLS 1.0"); ++ break; ++ case TLS1_1_VERSION: ++ strcat(string, "TLS 1.1"); ++ break; ++ case TLS1_2_VERSION: ++ strcat(string, "TLS 1.2"); ++ break; ++ default: ++ strcat(string, "Unknown version"); ++ } + break; -+ + default: + sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); + } @@ -2255,9 +2330,9 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c + dbglog("%s", string); +} + -diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.h +diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h --- ppp-2.4.7/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.h 2018-06-02 01:42:04.023165433 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h 2018-10-30 16:47:59.534263383 +0100 @@ -0,0 +1,107 @@ +/* + * eap-tls.h @@ -2366,9 +2441,9 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.h +#endif + +#endif -diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.c +diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c --- ppp-2.4.7/pppd/eap.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.c 2018-06-02 01:42:04.023165433 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c 2018-10-30 16:47:59.537263209 +0100 @@ -43,6 +43,11 @@ * Based on draft-ietf-pppext-eap-srp-03.txt. */ @@ -2972,9 +3047,9 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.c return (inp - pstart); } + -diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.h +diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h --- ppp-2.4.7/pppd/eap.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.h 2018-06-02 01:42:04.023165433 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h 2018-10-30 16:47:59.537263209 +0100 @@ -84,6 +84,16 @@ eapClosed, /* Authentication not in use */ eapListen, /* Client ready (and timer running) */ @@ -3043,9 +3118,9 @@ diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.h #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ -diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.c +diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.c --- ppp-2.4.7/pppd/md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.c 2018-06-02 01:42:04.023165433 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.c 2018-10-30 16:47:59.538263156 +0100 @@ -33,6 +33,8 @@ *********************************************************************** */ @@ -3061,9 +3136,9 @@ diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.c */ +#endif /* USE_EAPTLS */ + -diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.h +diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.h --- ppp-2.4.7/pppd/md5.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.h 2018-06-02 01:42:04.024165430 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.h 2018-10-30 16:47:59.538263156 +0100 @@ -36,6 +36,7 @@ ** documentation and/or software. ** *********************************************************************** @@ -3078,9 +3153,9 @@ diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.h #endif /* __MD5_INCLUDE__ */ + +#endif /* USE_EAPTLS */ -diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/pathnames.h +diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames.h --- ppp-2.4.7/pppd/pathnames.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pathnames.h 2018-06-02 01:42:04.024165430 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames.h 2018-10-30 16:47:59.539263095 +0100 @@ -21,6 +21,13 @@ #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" @@ -3095,9 +3170,9 @@ diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/pathname #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/Makefile.linux +diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux --- ppp-2.4.7/pppd/plugins/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/Makefile.linux 2018-06-02 01:42:04.024165430 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux 2018-10-30 16:47:59.539263095 +0100 @@ -4,6 +4,9 @@ LDFLAGS = -shared INSTALL = install @@ -3108,9 +3183,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.101b/pp DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passprompt.c +diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passprompt.c --- ppp-2.4.7/pppd/plugins/passprompt.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passprompt.c 2018-06-02 01:42:04.024165430 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passprompt.c 2018-10-30 16:47:59.540263023 +0100 @@ -107,4 +107,7 @@ { add_options(options); @@ -3119,9 +3194,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.101b/pppd + eaptls_passwd_hook = promptpass; +#endif } -diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passwordfd.c +diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passwordfd.c --- ppp-2.4.7/pppd/plugins/passwordfd.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passwordfd.c 2018-06-02 01:42:04.024165430 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passwordfd.c 2018-10-30 16:47:59.540263023 +0100 @@ -79,4 +79,8 @@ chap_check_hook = pwfd_check; @@ -3131,9 +3206,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.101b/pppd + eaptls_passwd_hook = pwfd_passwd; +#endif } -diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.8 +diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 --- ppp-2.4.7/pppd/pppd.8 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.8 2018-06-02 01:42:04.025165427 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 2018-10-30 16:47:59.542262870 +0100 @@ -248,6 +248,12 @@ compression in the corresponding direction. Use \fInobsdcomp\fR or \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. @@ -3202,9 +3277,9 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.8 .B noauth Do not require the peer to authenticate itself. This option is privileged. -diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.h +diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h --- ppp-2.4.7/pppd/pppd.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.h 2018-06-02 01:42:04.025165427 +0200 ++++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h 2018-10-30 16:47:59.542262870 +0100 @@ -325,6 +325,11 @@ extern bool dryrun; /* check everything, print options, exit */ extern int child_wait; /* # seconds to wait for children at end */ diff --git a/ppp.spec b/ppp.spec index a874d95..86d326e 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 26%{?dist} +Release: 27%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -46,7 +46,7 @@ Patch0022: 0022-build-sys-compile-pppol2tp-with-multilink-support.patch Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: 0025-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: ppp-2.4.7-eaptls-mppe-1.101.patch +Patch0026: ppp-2.4.7-eaptls-mppe-1.102.patch Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch # rhbz#1556132 @@ -183,6 +183,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Mon Nov 5 2018 Jaroslav Škarvada - 2.4.7-27 +- Updated EAP-TLS patch to v1.102 + * Tue Jul 24 2018 Lubomir Rintel - 2.4.7-26 - Split out the network-scripts From 332d094cb419daff2a2d46ec06b02b08f96aa218 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 20 Nov 2018 21:07:53 +0100 Subject: [PATCH 16/76] Fixed network scripts related regression caused by release 26 --- ppp.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ppp.spec b/ppp.spec index 86d326e..2d2a229 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 27%{?dist} +Release: 28%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -123,7 +123,7 @@ install -d %{buildroot}%{_sysconfdir}/ppp install -p %{SOURCE4} %{buildroot}%{_sysconfdir}/ppp/ip-down install -p %{SOURCE5} %{buildroot}%{_sysconfdir}/ppp/ip-down.ipv6to4 install -p %{SOURCE6} %{buildroot}%{_sysconfdir}/ppp/ip-up -install -p %{SOURCE8} %{buildroot}%{_sysconfdir}/ppp/ip-up.ipv6to4 +install -p %{SOURCE7} %{buildroot}%{_sysconfdir}/ppp/ip-up.ipv6to4 install -p %{SOURCE8} %{buildroot}%{_sysconfdir}/ppp/ipv6-down install -p %{SOURCE9} %{buildroot}%{_sysconfdir}/ppp/ipv6-up @@ -183,6 +183,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Tue Nov 20 2018 Jaroslav Škarvada - 2.4.7-28 +- Fixed network scripts related regression caused by release 26 + * Mon Nov 5 2018 Jaroslav Škarvada - 2.4.7-27 - Updated EAP-TLS patch to v1.102 From 984c17894ad9ef26bd383e6d1025e559ebdfe142 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 3 Dec 2018 22:28:51 +0100 Subject: [PATCH 17/76] Fixed some issues found by coverity scan --- ppp-2.4.7-coverity-scan-fixes.patch | 453 ++++++++++++++++++++++++++++ ppp.spec | 6 +- 2 files changed, 458 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.7-coverity-scan-fixes.patch diff --git a/ppp-2.4.7-coverity-scan-fixes.patch b/ppp-2.4.7-coverity-scan-fixes.patch new file mode 100644 index 0000000..4f61a27 --- /dev/null +++ b/ppp-2.4.7-coverity-scan-fixes.patch @@ -0,0 +1,453 @@ +diff --git a/chat/chat.c b/chat/chat.c +index 710dba9..bf10733 100644 +--- a/chat/chat.c ++++ b/chat/chat.c +@@ -512,6 +512,7 @@ void msgf __V((const char *fmt, ...)) + syslog(LOG_INFO, "%s", line); + if (to_stderr) + fprintf(stderr, "%s\n", line); ++ va_end(args); + } + + /* +@@ -537,6 +538,7 @@ void fatal __V((int code, const char *fmt, ...)) + syslog(LOG_ERR, "%s", line); + if (to_stderr) + fprintf(stderr, "%s\n", line); ++ va_end(args); + terminate(code); + } + +diff --git a/pppd/auth.c b/pppd/auth.c +index 656ffe9..9a7e32d 100644 +--- a/pppd/auth.c ++++ b/pppd/auth.c +@@ -464,6 +464,7 @@ setupapfile(argv) + euid = geteuid(); + if (seteuid(getuid()) == -1) { + option_error("unable to reset uid before opening %s: %m", fname); ++ free(fname); + return 0; + } + ufile = fopen(fname, "re"); +@@ -471,6 +472,7 @@ setupapfile(argv) + fatal("unable to regain privileges: %m"); + if (ufile == NULL) { + option_error("unable to open user login data file %s", fname); ++ free(fname); + return 0; + } + check_access(ufile, fname); +@@ -481,6 +483,7 @@ setupapfile(argv) + || fgets(p, MAXSECRETLEN - 1, ufile) == NULL) { + fclose(ufile); + option_error("unable to read user login data file %s", fname); ++ free(fname); + return 0; + } + fclose(ufile); +@@ -502,6 +505,7 @@ setupapfile(argv) + explicit_passwd = 1; + } + ++ free(fname); + return (1); + } + +diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c +index 1b79abf..f7f42fd 100644 +--- a/pppd/eap-tls.c ++++ b/pppd/eap-tls.c +@@ -693,6 +693,7 @@ int eaptls_init_ssl_server(eap_state * esp) + } + + strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); ++ ets->peer[MAXWORDLEN - 1] = 0; + + dbglog( "getting eaptls secret" ); + if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, +@@ -780,7 +781,10 @@ int eaptls_init_ssl_client(eap_state * esp) + * verify + */ + if (esp->es_client.ea_peer) ++ { + strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); ++ ets->peer[MAXWORDLEN - 1] = 0; ++ } + else + ets->peer[0] = 0; + +@@ -835,7 +839,10 @@ int eaptls_init_ssl_client(eap_state * esp) + * ssl_verify_callback() + */ + if (servcertfile[0]) ++ { + strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); ++ ets->peercertfile[MAXWORDLEN - 1] = 0; ++ } + else + ets->peercertfile[0] = 0; + +diff --git a/pppd/multilink.c b/pppd/multilink.c +index 2f0ed50..67200ba 100644 +--- a/pppd/multilink.c ++++ b/pppd/multilink.c +@@ -445,9 +445,13 @@ get_default_epdisc(ep) + if (p != 0 && get_if_hwaddr(ep->value, p) >= 0) { + ep->class = EPD_MAC; + ep->length = 6; ++ free(p); + return 1; + } + ++ if (p) ++ free(p); ++ + /* see if our hostname corresponds to a reasonable IP address */ + hp = gethostbyname(hostname); + if (hp != NULL) { +diff --git a/pppd/options.c b/pppd/options.c +index 1cef314..bc264d6 100644 +--- a/pppd/options.c ++++ b/pppd/options.c +@@ -1735,7 +1735,7 @@ user_unsetenv(argv) + option_error("unexpected = in name: %s", arg); + return 0; + } +- if (arg == '\0') { ++ if (*arg == '\0') { + option_error("missing variable name for unset"); + return 0; + } +diff --git a/pppd/plugins/pppol2tp/openl2tp.c b/pppd/plugins/pppol2tp/openl2tp.c +index 1099575..7c4fe8b 100644 +--- a/pppd/plugins/pppol2tp/openl2tp.c ++++ b/pppd/plugins/pppol2tp/openl2tp.c +@@ -246,6 +246,9 @@ out: + (*old_pppol2tp_ip_updown_hook)(tunnel_id, session_id, up); + } + ++ if (user_name != NULL) ++ free(user_name); ++ + return; + } + +diff --git a/pppd/plugins/radius/avpair.c b/pppd/plugins/radius/avpair.c +index 716d23f..ec48eb8 100644 +--- a/pppd/plugins/radius/avpair.c ++++ b/pppd/plugins/radius/avpair.c +@@ -121,7 +121,8 @@ VALUE_PAIR *rc_avpair_new (int attrid, void *pval, int len, int vendorcode) + if ((vp = (VALUE_PAIR *) malloc (sizeof (VALUE_PAIR))) + != (VALUE_PAIR *) NULL) + { +- strncpy (vp->name, pda->name, sizeof (vp->name)); ++ strncpy (vp->name, pda->name, NAME_LENGTH); ++ vp->name[NAME_LENGTH] = 0; + vp->attribute = attrid; + vp->vendorcode = vendorcode; + vp->next = (VALUE_PAIR *) NULL; +diff --git a/pppd/plugins/radius/config.c b/pppd/plugins/radius/config.c +index a29e5e8..6e36d89 100644 +--- a/pppd/plugins/radius/config.c ++++ b/pppd/plugins/radius/config.c +@@ -153,6 +153,7 @@ static int set_option_auo(char *filename, int line, OPTION *option, char *p) + *iptr = AUTH_RADIUS_FST; + else { + error("%s: auth_order: unknown keyword: %s", filename, p); ++ free(iptr); + return (-1); + } + +@@ -165,6 +166,7 @@ static int set_option_auo(char *filename, int line, OPTION *option, char *p) + *iptr = (*iptr) | AUTH_RADIUS_SND; + else { + error("%s: auth_order: unknown or unexpected keyword: %s", filename, p); ++ free(iptr); + return (-1); + } + } +@@ -272,7 +274,7 @@ char *rc_conf_str(char *optname) + + if (option == NULL) + fatal("rc_conf_str: unkown config option requested: %s", optname); +- return (char *)option->val; ++ return (char *)option->val; + } + + int rc_conf_int(char *optname) +diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c +index 4ba5f52..6f2a0bd 100644 +--- a/pppd/plugins/radius/radius.c ++++ b/pppd/plugins/radius/radius.c +@@ -898,7 +898,8 @@ radius_acct_start(void) + + rstate.start_time = time(NULL); + +- strncpy(rstate.session_id, rc_mksid(), sizeof(rstate.session_id)); ++ strncpy(rstate.session_id, rc_mksid(), MAXSESSIONID); ++ rstate.session_id[MAXSESSIONID] = 0; + + rc_avpair_add(&send, PW_ACCT_SESSION_ID, + rstate.session_id, 0, VENDOR_NONE); +diff --git a/pppd/plugins/radius/radiusclient.h b/pppd/plugins/radius/radiusclient.h +index 51b959a..cff0c26 100644 +--- a/pppd/plugins/radius/radiusclient.h ++++ b/pppd/plugins/radius/radiusclient.h +@@ -440,6 +440,7 @@ UINT4 rc_get_ipaddr __P((char *)); + int rc_good_ipaddr __P((char *)); + const char *rc_ip_hostname __P((UINT4)); + UINT4 rc_own_ipaddress __P((void)); ++UINT4 rc_own_bind_ipaddress __P((void)); + + + /* sendserver.c */ +diff --git a/pppd/plugins/radius/radrealms.c b/pppd/plugins/radius/radrealms.c +index 7a30370..cd006fd 100644 +--- a/pppd/plugins/radius/radrealms.c ++++ b/pppd/plugins/radius/radrealms.c +@@ -68,10 +68,12 @@ lookup_realm(char const *user, + + if ((fd = fopen(radrealms_config, "r")) == NULL) { + option_error("cannot open %s", radrealms_config); ++ free(auths); ++ free(accts); + return; +- } ++ } + info("Reading %s", radrealms_config); +- ++ + while ((fgets(buffer, sizeof(buffer), fd) != NULL)) { + line++; + +@@ -87,6 +89,8 @@ lookup_realm(char const *user, + fclose(fd); + option_error("%s: invalid line %d: %s", radrealms_config, + line, buffer); ++ free(auths); ++ free(accts); + return; + } + info("Parsing '%s' entry:", p); +@@ -101,6 +105,8 @@ lookup_realm(char const *user, + fclose(fd); + option_error("%s: realm name missing on line %d: %s", + radrealms_config, line, buffer); ++ free(auths); ++ free(accts); + return; + } + +@@ -111,6 +117,8 @@ lookup_realm(char const *user, + fclose(fd); + option_error("%s: server address missing on line %d: %s", + radrealms_config, line, buffer); ++ free(auths); ++ free(accts); + return; + } + s->name[s->max] = strdup(p); +@@ -119,6 +127,8 @@ lookup_realm(char const *user, + fclose(fd); + option_error("%s: server port missing on line %d: %s", + radrealms_config, line, buffer); ++ free(auths); ++ free(accts); + return; + } + s->port[s->max] = atoi(p); +diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux +index 5e06b52..5f79284 100644 +--- a/pppd/plugins/rp-pppoe/Makefile.linux ++++ b/pppd/plugins/rp-pppoe/Makefile.linux +@@ -34,10 +34,10 @@ pppoe-discovery: pppoe-discovery.o debug.o common.o + $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev + + pppoe-discovery.o: pppoe-discovery.c +- $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c ++ $(CC) $(CFLAGS) -I../../.. -c -o pppoe-discovery.o pppoe-discovery.c + + debug.o: debug.c +- $(CC) $(CFLAGS) -c -o debug.o debug.c ++ $(CC) $(CFLAGS) -I../../.. -c -o debug.o debug.c + + rp-pppoe.so: plugin.o discovery.o if.o common.o + $(CC) $(LDFLAGS) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o +diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c +index 72aba41..50d5693 100644 +--- a/pppd/plugins/rp-pppoe/if.c ++++ b/pppd/plugins/rp-pppoe/if.c +@@ -133,7 +133,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) + + /* Fill in hardware address */ + if (hwaddr) { +- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); ++ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); ++ ifr.ifr_name[IFNAMSIZ - 1] = 0; + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + error("Can't get hardware address for %s: %m", ifname); + close(fd); +@@ -152,7 +153,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) + } + + /* Sanity check on MTU */ +- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); ++ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); ++ ifr.ifr_name[IFNAMSIZ - 1] = 0; + if (ioctl(fd, SIOCGIFMTU, &ifr) < 0) { + error("Can't get MTU for %s: %m", ifname); + } else if (ifr.ifr_mtu < ETH_DATA_LEN) { +@@ -166,7 +168,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) + sa.sll_family = AF_PACKET; + sa.sll_protocol = htons(type); + +- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); ++ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); ++ ifr.ifr_name[IFNAMSIZ - 1] = 0; + if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { + error("Could not get interface index for %s: %m", ifname); + close(fd); +diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c +index 24bdf8f..1856c6b 100644 +--- a/pppd/plugins/rp-pppoe/plugin.c ++++ b/pppd/plugins/rp-pppoe/plugin.c +@@ -153,7 +153,7 @@ PPPOEConnectDevice(void) + error("Can't get MTU for %s: %m", conn->ifName); + goto errout; + } +- strncpy(ifr.ifr_name, conn->ifName, sizeof(ifr.ifr_name)); ++ strlcpy(ifr.ifr_name, conn->ifName, sizeof(ifr.ifr_name)); + if (ioctl(s, SIOCGIFMTU, &ifr) < 0) { + error("Can't get MTU for %s: %m", conn->ifName); + close(s); +@@ -326,7 +326,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) + + /* Try getting interface index */ + if (r) { +- strncpy(ifr.ifr_name, cmd, sizeof(ifr.ifr_name)); ++ strlcpy(ifr.ifr_name, cmd, sizeof(ifr.ifr_name)); + if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { + r = 0; + } else { +@@ -345,7 +345,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) + /* Close socket */ + close(fd); + if (r && doit) { +- strncpy(devnam, cmd, sizeof(devnam)); ++ strlcpy(devnam, cmd, sizeof(devnam)); + if (the_channel != &pppoe_channel) { + + the_channel = &pppoe_channel; +diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c +index 2bd910f..502e17f 100644 +--- a/pppd/plugins/rp-pppoe/pppoe-discovery.c ++++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c +@@ -177,7 +177,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) + sa.sll_family = AF_PACKET; + sa.sll_protocol = htons(type); + +- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); ++ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); ++ ifr.ifr_name[IFNAMSIZ - 1] = 0; + if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { + fatalSys("ioctl(SIOCFIGINDEX): Could not get interface index"); + } +diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h +index f77f5b7..6118e27 100644 +--- a/pppd/plugins/rp-pppoe/pppoe.h ++++ b/pppd/plugins/rp-pppoe/pppoe.h +@@ -24,6 +24,8 @@ + #include /* For FILE */ + #include /* For pid_t */ + ++#include "pppd/pppd.h" /* For error */ ++ + /* How do we access raw Ethernet devices? */ + #undef USE_LINUX_PACKET + #undef USE_BPF +diff --git a/pppd/plugins/winbind.c b/pppd/plugins/winbind.c +index bb05acd..4638f46 100644 +--- a/pppd/plugins/winbind.c ++++ b/pppd/plugins/winbind.c +@@ -432,6 +432,7 @@ unsigned int run_ntlm_auth(const char *username, + + /* parent */ + if (close(child_out[0]) == -1) { ++ close(child_in[1]); + notice("error closing pipe?!? for child OUT[0]"); + return NOT_AUTHENTICATED; + } +diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c +index 9a1d8a6..ef92486 100644 +--- a/pppd/sys-linux.c ++++ b/pppd/sys-linux.c +@@ -2236,7 +2236,6 @@ int ppp_available(void) + } + } + +- close (s); + if (!ok) { + slprintf(route_buffer, sizeof(route_buffer), + "Sorry - PPP driver version %d.%d.%d is out of date\n", +@@ -2246,6 +2245,7 @@ int ppp_available(void) + } + } + } ++ close(s); + return ok; + } + +@@ -2722,7 +2722,10 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) + warn("Couldn't unlock pty slave %s: %m", pty_name); + #endif + if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) ++ { + warn("Couldn't open pty slave %s: %m", pty_name); ++ close(mfd); ++ } + } + } + #endif /* TIOCGPTN */ +@@ -3011,6 +3014,7 @@ ether_to_eui64(eui64_t *p_eui64) + if (get_first_ethernet(ð_dev) < 0) + { + warn("no ethernet device present on the host"); ++ close(skfd); + return 0; + } + +diff --git a/pppstats/pppstats.c b/pppstats/pppstats.c +index 6367988..4aaa319 100644 +--- a/pppstats/pppstats.c ++++ b/pppstats/pppstats.c +@@ -150,7 +150,8 @@ get_ppp_stats(curp) + #define ifr_name ifr__name + #endif + +- strncpy(req.ifr_name, interface, sizeof(req.ifr_name)); ++ strncpy(req.ifr_name, interface, IFNAMSIZ); ++ req.ifr_name[IFNAMSIZ - 1] = 0; + if (ioctl(s, SIOCGPPPSTATS, &req) < 0) { + fprintf(stderr, "%s: ", progname); + if (errno == ENOTTY) +@@ -176,7 +177,8 @@ get_ppp_cstats(csp) + #define ifr_name ifr__name + #endif + +- strncpy(creq.ifr_name, interface, sizeof(creq.ifr_name)); ++ strncpy(creq.ifr_name, interface, IFNAMSIZ); ++ creq.ifr_name[IFNAMSIZ - 1] = 0; + if (ioctl(s, SIOCGPPPCSTATS, &creq) < 0) { + fprintf(stderr, "%s: ", progname); + if (errno == ENOTTY) { +@@ -526,7 +528,8 @@ main(argc, argv) + #undef ifr_name + #define ifr_name ifr_ifrn.ifrn_name + #endif +- strncpy(ifr.ifr_name, interface, sizeof(ifr.ifr_name)); ++ strncpy(ifr.ifr_name, interface, IFNAMSIZ); ++ ifr.ifr_name[IFNAMSIZ - 1] = 0; + if (ioctl(s, SIOCGIFFLAGS, (caddr_t)&ifr) < 0) { + fprintf(stderr, "%s: nonexistent interface '%s' specified\n", + progname, interface); diff --git a/ppp.spec b/ppp.spec index 2d2a229..c07c3d4 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 28%{?dist} +Release: 29%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -53,6 +53,7 @@ Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch Patch0029: ppp-2.4.7-DES-openssl.patch # https://github.com/paulusmack/ppp/pull/95 Patch0030: ppp-2.4.7-honor-ldflags.patch +Patch0031: ppp-2.4.7-coverity-scan-fixes.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -183,6 +184,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Mon Dec 3 2018 Jaroslav Škarvada - 2.4.7-29 +- Fixed some issues found by coverity scan + * Tue Nov 20 2018 Jaroslav Škarvada - 2.4.7-28 - Fixed network scripts related regression caused by release 26 From 11e66112460f42b1ef35b62eefa9f3dd41c8d2eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Mon, 14 Jan 2019 19:13:28 +0100 Subject: [PATCH 18/76] Rebuilt for libcrypt.so.2 (#1666033) --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index c07c3d4..f867846 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 29%{?dist} +Release: 30%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -184,6 +184,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Mon Jan 14 2019 Björn Esser - 2.4.7-30 +- Rebuilt for libcrypt.so.2 (#1666033) + * Mon Dec 3 2018 Jaroslav Škarvada - 2.4.7-29 - Fixed some issues found by coverity scan From ce3286c404fb3ff385acafcdec7f76f4220114e0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 2 Feb 2019 04:45:00 +0000 Subject: [PATCH 19/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index f867846..30584a9 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 30%{?dist} +Release: 31%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -184,6 +184,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Sat Feb 02 2019 Fedora Release Engineering - 2.4.7-31 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Mon Jan 14 2019 Björn Esser - 2.4.7-30 - Rebuilt for libcrypt.so.2 (#1666033) From be5731e25674e562cabee70d2d9b52b0008173c9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jul 2019 11:14:45 +0000 Subject: [PATCH 20/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 30584a9..160e9c5 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 31%{?dist} +Release: 32%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -184,6 +184,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Jul 26 2019 Fedora Release Engineering - 2.4.7-32 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Sat Feb 02 2019 Fedora Release Engineering - 2.4.7-31 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 0237a3fb30d1f28f6a46f204b8a7c759a8abcf28 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 30 Jan 2020 09:40:43 +0000 Subject: [PATCH 21/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 160e9c5..97715b7 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.7 -Release: 32%{?dist} +Release: 33%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -184,6 +184,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Thu Jan 30 2020 Fedora Release Engineering - 2.4.7-33 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Fri Jul 26 2019 Fedora Release Engineering - 2.4.7-32 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 6d73752ab1b4d937ac787c8f1206f3a857d61faf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Fri, 21 Feb 2020 17:34:33 +0100 Subject: [PATCH 22/76] New version Changed sources to github Dropped 0028-pppoe-include-netinet-in.h-before-linux-in.h, ppp-2.4.7-DES-openssl, ppp-2.4.7-honor-ldflags, ppp-2.4.7-coverity-scan-fixes patches (all upstreamed) Fixed buffer overflow in the eap_request and eap_response functions Resolves: CVE-2020-8597 --- .gitignore | 1 + ...clude-netinet-in.h-before-linux-in.h.patch | 35 -- ppp-2.4.7-DES-openssl.patch | 79 --- ppp-2.4.7-coverity-scan-fixes.patch | 453 ------------------ ppp-2.4.7-honor-ldflags.patch | 170 ------- ppp-2.4.8-CVE-2020-8597.patch | 37 ++ ...e-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch | 2 +- ...pile-pppol2tp-with-multilink-support.patch | 2 +- ...hardcode-LIBDIR-but-set-it-according.patch | 2 +- ...p-2.4.8-build-sys-enable-PAM-support.patch | 2 +- ...e-compiler-flags-handed-to-us-by-rpm.patch | 6 +- ...patch => ppp-2.4.8-eaptls-mppe-1.102.patch | 2 +- ...pp-2.4.8-everywhere-O_CLOEXEC-harder.patch | 4 +- ...pppd-binary-using-standard-perms-755.patch | 2 +- ....8-pppd-introduce-ipv6-accept-remote.patch | 6 +- ...-don-t-want-to-accidentally-leak-fds.patch | 2 +- ...-sys-linux-rework-get_first_ethernet.patch | 8 +- ppp.spec | 46 +- sources | 4 +- 19 files changed, 84 insertions(+), 779 deletions(-) delete mode 100644 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch delete mode 100644 ppp-2.4.7-DES-openssl.patch delete mode 100644 ppp-2.4.7-coverity-scan-fixes.patch delete mode 100644 ppp-2.4.7-honor-ldflags.patch create mode 100644 ppp-2.4.8-CVE-2020-8597.patch rename 0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch => ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch (96%) rename 0022-build-sys-compile-pppol2tp-with-multilink-support.patch => ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch (96%) rename 0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch => ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch (98%) rename 0002-build-sys-enable-PAM-support.patch => ppp-2.4.8-build-sys-enable-PAM-support.patch (97%) rename 0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch => ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch (97%) rename ppp-2.4.7-eaptls-mppe-1.102.patch => ppp-2.4.8-eaptls-mppe-1.102.patch (99%) rename 0013-everywhere-O_CLOEXEC-harder.patch => ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch (99%) rename 0025-pppd-install-pppd-binary-using-standard-perms-755.patch => ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch (91%) rename 0009-pppd-introduce-ipv6-accept-remote.patch => ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch (89%) rename 0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch => ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch (98%) rename 0019-sys-linux-rework-get_first_ethernet.patch => ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch (97%) diff --git a/.gitignore b/.gitignore index aa03936..94b2a80 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ ppp-2.4.5.tar.gz /ppp-2.4.6.tar.gz /ppp-watch.tar.xz /ppp-2.4.7.tar.gz +/ppp-2.4.8.tar.gz diff --git a/0028-pppoe-include-netinet-in.h-before-linux-in.h.patch b/0028-pppoe-include-netinet-in.h-before-linux-in.h.patch deleted file mode 100644 index 9b0920d..0000000 --- a/0028-pppoe-include-netinet-in.h-before-linux-in.h.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 33797aa193a2751da26f9af120e39c110defe4d1 Mon Sep 17 00:00:00 2001 -From: Lubomir Rintel -Date: Sat, 10 Dec 2016 19:53:56 +0100 -Subject: [PATCH] pppoe: include netinet/in.h before linux/in.h - -To fix build breakage. ---- - pppd/plugins/rp-pppoe/pppoe.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h -index 9ab2eee..f77f5b7 100644 ---- a/pppd/plugins/rp-pppoe/pppoe.h -+++ b/pppd/plugins/rp-pppoe/pppoe.h -@@ -15,6 +15,8 @@ - - #include "config.h" - -+#include -+ - #if defined(HAVE_NETPACKET_PACKET_H) || defined(HAVE_LINUX_IF_PACKET_H) - #define _POSIX_SOURCE 1 /* For sigaction defines */ - #endif -@@ -84,8 +86,6 @@ typedef unsigned long UINT32_t; - #include - #endif - --#include -- - #ifdef HAVE_NETINET_IF_ETHER_H - #include - --- -2.9.3 - diff --git a/ppp-2.4.7-DES-openssl.patch b/ppp-2.4.7-DES-openssl.patch deleted file mode 100644 index ad3b268..0000000 --- a/ppp-2.4.7-DES-openssl.patch +++ /dev/null @@ -1,79 +0,0 @@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 534ccc2..cf11b74 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -41,7 +41,7 @@ COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" - # Uncomment the next 2 lines to include support for Microsoft's - # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. - CHAPMS=y --USE_CRYPT=y -+#USE_CRYPT=y - # Don't use MSLANMAN unless you really know what you're doing. - #MSLANMAN=y - # Uncomment the next line to include support for MPPE. CHAPMS (above) must -@@ -147,7 +147,8 @@ endif - - ifdef NEEDDES - ifndef USE_CRYPT --LIBS += -ldes $(LIBS) -+CFLAGS += -I/usr/include/openssl -+LIBS += -lcrypto - else - CFLAGS += -DUSE_CRYPT=1 - endif -diff --git a/pppd/pppcrypt.c b/pppd/pppcrypt.c -index 8b85b13..6b35375 100644 ---- a/pppd/pppcrypt.c -+++ b/pppd/pppcrypt.c -@@ -64,7 +64,7 @@ u_char *des_key; /* OUT 64 bit DES key with parity bits added */ - des_key[7] = Get7Bits(key, 49); - - #ifndef USE_CRYPT -- des_set_odd_parity((des_cblock *)des_key); -+ DES_set_odd_parity((DES_cblock *)des_key); - #endif - } - -@@ -158,25 +158,25 @@ u_char *clear; /* OUT 8 octets */ - } - - #else /* USE_CRYPT */ --static des_key_schedule key_schedule; -+static DES_key_schedule key_schedule; - - bool - DesSetkey(key) - u_char *key; - { -- des_cblock des_key; -+ DES_cblock des_key; - MakeKey(key, des_key); -- des_set_key(&des_key, key_schedule); -+ DES_set_key(&des_key, &key_schedule); - return (1); - } - - bool --DesEncrypt(clear, key, cipher) -+DesEncrypt(clear, cipher) - u_char *clear; /* IN 8 octets */ - u_char *cipher; /* OUT 8 octets */ - { -- des_ecb_encrypt((des_cblock *)clear, (des_cblock *)cipher, -- key_schedule, 1); -+ DES_ecb_encrypt((DES_cblock *)clear, (DES_cblock *)cipher, -+ &key_schedule, 1); - return (1); - } - -@@ -185,8 +185,8 @@ DesDecrypt(cipher, clear) - u_char *cipher; /* IN 8 octets */ - u_char *clear; /* OUT 8 octets */ - { -- des_ecb_encrypt((des_cblock *)cipher, (des_cblock *)clear, -- key_schedule, 0); -+ DES_ecb_encrypt((DES_cblock *)cipher, (DES_cblock *)clear, -+ &key_schedule, 0); - return (1); - } - diff --git a/ppp-2.4.7-coverity-scan-fixes.patch b/ppp-2.4.7-coverity-scan-fixes.patch deleted file mode 100644 index 4f61a27..0000000 --- a/ppp-2.4.7-coverity-scan-fixes.patch +++ /dev/null @@ -1,453 +0,0 @@ -diff --git a/chat/chat.c b/chat/chat.c -index 710dba9..bf10733 100644 ---- a/chat/chat.c -+++ b/chat/chat.c -@@ -512,6 +512,7 @@ void msgf __V((const char *fmt, ...)) - syslog(LOG_INFO, "%s", line); - if (to_stderr) - fprintf(stderr, "%s\n", line); -+ va_end(args); - } - - /* -@@ -537,6 +538,7 @@ void fatal __V((int code, const char *fmt, ...)) - syslog(LOG_ERR, "%s", line); - if (to_stderr) - fprintf(stderr, "%s\n", line); -+ va_end(args); - terminate(code); - } - -diff --git a/pppd/auth.c b/pppd/auth.c -index 656ffe9..9a7e32d 100644 ---- a/pppd/auth.c -+++ b/pppd/auth.c -@@ -464,6 +464,7 @@ setupapfile(argv) - euid = geteuid(); - if (seteuid(getuid()) == -1) { - option_error("unable to reset uid before opening %s: %m", fname); -+ free(fname); - return 0; - } - ufile = fopen(fname, "re"); -@@ -471,6 +472,7 @@ setupapfile(argv) - fatal("unable to regain privileges: %m"); - if (ufile == NULL) { - option_error("unable to open user login data file %s", fname); -+ free(fname); - return 0; - } - check_access(ufile, fname); -@@ -481,6 +483,7 @@ setupapfile(argv) - || fgets(p, MAXSECRETLEN - 1, ufile) == NULL) { - fclose(ufile); - option_error("unable to read user login data file %s", fname); -+ free(fname); - return 0; - } - fclose(ufile); -@@ -502,6 +505,7 @@ setupapfile(argv) - explicit_passwd = 1; - } - -+ free(fname); - return (1); - } - -diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c -index 1b79abf..f7f42fd 100644 ---- a/pppd/eap-tls.c -+++ b/pppd/eap-tls.c -@@ -693,6 +693,7 @@ int eaptls_init_ssl_server(eap_state * esp) - } - - strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); -+ ets->peer[MAXWORDLEN - 1] = 0; - - dbglog( "getting eaptls secret" ); - if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, -@@ -780,7 +781,10 @@ int eaptls_init_ssl_client(eap_state * esp) - * verify - */ - if (esp->es_client.ea_peer) -+ { - strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); -+ ets->peer[MAXWORDLEN - 1] = 0; -+ } - else - ets->peer[0] = 0; - -@@ -835,7 +839,10 @@ int eaptls_init_ssl_client(eap_state * esp) - * ssl_verify_callback() - */ - if (servcertfile[0]) -+ { - strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); -+ ets->peercertfile[MAXWORDLEN - 1] = 0; -+ } - else - ets->peercertfile[0] = 0; - -diff --git a/pppd/multilink.c b/pppd/multilink.c -index 2f0ed50..67200ba 100644 ---- a/pppd/multilink.c -+++ b/pppd/multilink.c -@@ -445,9 +445,13 @@ get_default_epdisc(ep) - if (p != 0 && get_if_hwaddr(ep->value, p) >= 0) { - ep->class = EPD_MAC; - ep->length = 6; -+ free(p); - return 1; - } - -+ if (p) -+ free(p); -+ - /* see if our hostname corresponds to a reasonable IP address */ - hp = gethostbyname(hostname); - if (hp != NULL) { -diff --git a/pppd/options.c b/pppd/options.c -index 1cef314..bc264d6 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -1735,7 +1735,7 @@ user_unsetenv(argv) - option_error("unexpected = in name: %s", arg); - return 0; - } -- if (arg == '\0') { -+ if (*arg == '\0') { - option_error("missing variable name for unset"); - return 0; - } -diff --git a/pppd/plugins/pppol2tp/openl2tp.c b/pppd/plugins/pppol2tp/openl2tp.c -index 1099575..7c4fe8b 100644 ---- a/pppd/plugins/pppol2tp/openl2tp.c -+++ b/pppd/plugins/pppol2tp/openl2tp.c -@@ -246,6 +246,9 @@ out: - (*old_pppol2tp_ip_updown_hook)(tunnel_id, session_id, up); - } - -+ if (user_name != NULL) -+ free(user_name); -+ - return; - } - -diff --git a/pppd/plugins/radius/avpair.c b/pppd/plugins/radius/avpair.c -index 716d23f..ec48eb8 100644 ---- a/pppd/plugins/radius/avpair.c -+++ b/pppd/plugins/radius/avpair.c -@@ -121,7 +121,8 @@ VALUE_PAIR *rc_avpair_new (int attrid, void *pval, int len, int vendorcode) - if ((vp = (VALUE_PAIR *) malloc (sizeof (VALUE_PAIR))) - != (VALUE_PAIR *) NULL) - { -- strncpy (vp->name, pda->name, sizeof (vp->name)); -+ strncpy (vp->name, pda->name, NAME_LENGTH); -+ vp->name[NAME_LENGTH] = 0; - vp->attribute = attrid; - vp->vendorcode = vendorcode; - vp->next = (VALUE_PAIR *) NULL; -diff --git a/pppd/plugins/radius/config.c b/pppd/plugins/radius/config.c -index a29e5e8..6e36d89 100644 ---- a/pppd/plugins/radius/config.c -+++ b/pppd/plugins/radius/config.c -@@ -153,6 +153,7 @@ static int set_option_auo(char *filename, int line, OPTION *option, char *p) - *iptr = AUTH_RADIUS_FST; - else { - error("%s: auth_order: unknown keyword: %s", filename, p); -+ free(iptr); - return (-1); - } - -@@ -165,6 +166,7 @@ static int set_option_auo(char *filename, int line, OPTION *option, char *p) - *iptr = (*iptr) | AUTH_RADIUS_SND; - else { - error("%s: auth_order: unknown or unexpected keyword: %s", filename, p); -+ free(iptr); - return (-1); - } - } -@@ -272,7 +274,7 @@ char *rc_conf_str(char *optname) - - if (option == NULL) - fatal("rc_conf_str: unkown config option requested: %s", optname); -- return (char *)option->val; -+ return (char *)option->val; - } - - int rc_conf_int(char *optname) -diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c -index 4ba5f52..6f2a0bd 100644 ---- a/pppd/plugins/radius/radius.c -+++ b/pppd/plugins/radius/radius.c -@@ -898,7 +898,8 @@ radius_acct_start(void) - - rstate.start_time = time(NULL); - -- strncpy(rstate.session_id, rc_mksid(), sizeof(rstate.session_id)); -+ strncpy(rstate.session_id, rc_mksid(), MAXSESSIONID); -+ rstate.session_id[MAXSESSIONID] = 0; - - rc_avpair_add(&send, PW_ACCT_SESSION_ID, - rstate.session_id, 0, VENDOR_NONE); -diff --git a/pppd/plugins/radius/radiusclient.h b/pppd/plugins/radius/radiusclient.h -index 51b959a..cff0c26 100644 ---- a/pppd/plugins/radius/radiusclient.h -+++ b/pppd/plugins/radius/radiusclient.h -@@ -440,6 +440,7 @@ UINT4 rc_get_ipaddr __P((char *)); - int rc_good_ipaddr __P((char *)); - const char *rc_ip_hostname __P((UINT4)); - UINT4 rc_own_ipaddress __P((void)); -+UINT4 rc_own_bind_ipaddress __P((void)); - - - /* sendserver.c */ -diff --git a/pppd/plugins/radius/radrealms.c b/pppd/plugins/radius/radrealms.c -index 7a30370..cd006fd 100644 ---- a/pppd/plugins/radius/radrealms.c -+++ b/pppd/plugins/radius/radrealms.c -@@ -68,10 +68,12 @@ lookup_realm(char const *user, - - if ((fd = fopen(radrealms_config, "r")) == NULL) { - option_error("cannot open %s", radrealms_config); -+ free(auths); -+ free(accts); - return; -- } -+ } - info("Reading %s", radrealms_config); -- -+ - while ((fgets(buffer, sizeof(buffer), fd) != NULL)) { - line++; - -@@ -87,6 +89,8 @@ lookup_realm(char const *user, - fclose(fd); - option_error("%s: invalid line %d: %s", radrealms_config, - line, buffer); -+ free(auths); -+ free(accts); - return; - } - info("Parsing '%s' entry:", p); -@@ -101,6 +105,8 @@ lookup_realm(char const *user, - fclose(fd); - option_error("%s: realm name missing on line %d: %s", - radrealms_config, line, buffer); -+ free(auths); -+ free(accts); - return; - } - -@@ -111,6 +117,8 @@ lookup_realm(char const *user, - fclose(fd); - option_error("%s: server address missing on line %d: %s", - radrealms_config, line, buffer); -+ free(auths); -+ free(accts); - return; - } - s->name[s->max] = strdup(p); -@@ -119,6 +127,8 @@ lookup_realm(char const *user, - fclose(fd); - option_error("%s: server port missing on line %d: %s", - radrealms_config, line, buffer); -+ free(auths); -+ free(accts); - return; - } - s->port[s->max] = atoi(p); -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 5e06b52..5f79284 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -34,10 +34,10 @@ pppoe-discovery: pppoe-discovery.o debug.o common.o - $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev - - pppoe-discovery.o: pppoe-discovery.c -- $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c -+ $(CC) $(CFLAGS) -I../../.. -c -o pppoe-discovery.o pppoe-discovery.c - - debug.o: debug.c -- $(CC) $(CFLAGS) -c -o debug.o debug.c -+ $(CC) $(CFLAGS) -I../../.. -c -o debug.o debug.c - - rp-pppoe.so: plugin.o discovery.o if.o common.o - $(CC) $(LDFLAGS) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o -diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c -index 72aba41..50d5693 100644 ---- a/pppd/plugins/rp-pppoe/if.c -+++ b/pppd/plugins/rp-pppoe/if.c -@@ -133,7 +133,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - - /* Fill in hardware address */ - if (hwaddr) { -- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { - error("Can't get hardware address for %s: %m", ifname); - close(fd); -@@ -152,7 +153,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - } - - /* Sanity check on MTU */ -- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(fd, SIOCGIFMTU, &ifr) < 0) { - error("Can't get MTU for %s: %m", ifname); - } else if (ifr.ifr_mtu < ETH_DATA_LEN) { -@@ -166,7 +168,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - sa.sll_family = AF_PACKET; - sa.sll_protocol = htons(type); - -- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { - error("Could not get interface index for %s: %m", ifname); - close(fd); -diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c -index 24bdf8f..1856c6b 100644 ---- a/pppd/plugins/rp-pppoe/plugin.c -+++ b/pppd/plugins/rp-pppoe/plugin.c -@@ -153,7 +153,7 @@ PPPOEConnectDevice(void) - error("Can't get MTU for %s: %m", conn->ifName); - goto errout; - } -- strncpy(ifr.ifr_name, conn->ifName, sizeof(ifr.ifr_name)); -+ strlcpy(ifr.ifr_name, conn->ifName, sizeof(ifr.ifr_name)); - if (ioctl(s, SIOCGIFMTU, &ifr) < 0) { - error("Can't get MTU for %s: %m", conn->ifName); - close(s); -@@ -326,7 +326,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) - - /* Try getting interface index */ - if (r) { -- strncpy(ifr.ifr_name, cmd, sizeof(ifr.ifr_name)); -+ strlcpy(ifr.ifr_name, cmd, sizeof(ifr.ifr_name)); - if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { - r = 0; - } else { -@@ -345,7 +345,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) - /* Close socket */ - close(fd); - if (r && doit) { -- strncpy(devnam, cmd, sizeof(devnam)); -+ strlcpy(devnam, cmd, sizeof(devnam)); - if (the_channel != &pppoe_channel) { - - the_channel = &pppoe_channel; -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c -index 2bd910f..502e17f 100644 ---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c -@@ -177,7 +177,8 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - sa.sll_family = AF_PACKET; - sa.sll_protocol = htons(type); - -- strncpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, ifname, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(fd, SIOCGIFINDEX, &ifr) < 0) { - fatalSys("ioctl(SIOCFIGINDEX): Could not get interface index"); - } -diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h -index f77f5b7..6118e27 100644 ---- a/pppd/plugins/rp-pppoe/pppoe.h -+++ b/pppd/plugins/rp-pppoe/pppoe.h -@@ -24,6 +24,8 @@ - #include /* For FILE */ - #include /* For pid_t */ - -+#include "pppd/pppd.h" /* For error */ -+ - /* How do we access raw Ethernet devices? */ - #undef USE_LINUX_PACKET - #undef USE_BPF -diff --git a/pppd/plugins/winbind.c b/pppd/plugins/winbind.c -index bb05acd..4638f46 100644 ---- a/pppd/plugins/winbind.c -+++ b/pppd/plugins/winbind.c -@@ -432,6 +432,7 @@ unsigned int run_ntlm_auth(const char *username, - - /* parent */ - if (close(child_out[0]) == -1) { -+ close(child_in[1]); - notice("error closing pipe?!? for child OUT[0]"); - return NOT_AUTHENTICATED; - } -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 9a1d8a6..ef92486 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -2236,7 +2236,6 @@ int ppp_available(void) - } - } - -- close (s); - if (!ok) { - slprintf(route_buffer, sizeof(route_buffer), - "Sorry - PPP driver version %d.%d.%d is out of date\n", -@@ -2246,6 +2245,7 @@ int ppp_available(void) - } - } - } -+ close(s); - return ok; - } - -@@ -2722,7 +2722,10 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) - warn("Couldn't unlock pty slave %s: %m", pty_name); - #endif - if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) -+ { - warn("Couldn't open pty slave %s: %m", pty_name); -+ close(mfd); -+ } - } - } - #endif /* TIOCGPTN */ -@@ -3011,6 +3014,7 @@ ether_to_eui64(eui64_t *p_eui64) - if (get_first_ethernet(ð_dev) < 0) - { - warn("no ethernet device present on the host"); -+ close(skfd); - return 0; - } - -diff --git a/pppstats/pppstats.c b/pppstats/pppstats.c -index 6367988..4aaa319 100644 ---- a/pppstats/pppstats.c -+++ b/pppstats/pppstats.c -@@ -150,7 +150,8 @@ get_ppp_stats(curp) - #define ifr_name ifr__name - #endif - -- strncpy(req.ifr_name, interface, sizeof(req.ifr_name)); -+ strncpy(req.ifr_name, interface, IFNAMSIZ); -+ req.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(s, SIOCGPPPSTATS, &req) < 0) { - fprintf(stderr, "%s: ", progname); - if (errno == ENOTTY) -@@ -176,7 +177,8 @@ get_ppp_cstats(csp) - #define ifr_name ifr__name - #endif - -- strncpy(creq.ifr_name, interface, sizeof(creq.ifr_name)); -+ strncpy(creq.ifr_name, interface, IFNAMSIZ); -+ creq.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(s, SIOCGPPPCSTATS, &creq) < 0) { - fprintf(stderr, "%s: ", progname); - if (errno == ENOTTY) { -@@ -526,7 +528,8 @@ main(argc, argv) - #undef ifr_name - #define ifr_name ifr_ifrn.ifrn_name - #endif -- strncpy(ifr.ifr_name, interface, sizeof(ifr.ifr_name)); -+ strncpy(ifr.ifr_name, interface, IFNAMSIZ); -+ ifr.ifr_name[IFNAMSIZ - 1] = 0; - if (ioctl(s, SIOCGIFFLAGS, (caddr_t)&ifr) < 0) { - fprintf(stderr, "%s: nonexistent interface '%s' specified\n", - progname, interface); diff --git a/ppp-2.4.7-honor-ldflags.patch b/ppp-2.4.7-honor-ldflags.patch deleted file mode 100644 index 2c3e20d..0000000 --- a/ppp-2.4.7-honor-ldflags.patch +++ /dev/null @@ -1,170 +0,0 @@ -diff --git a/chat/Makefile.linux b/chat/Makefile.linux -index 2445637..83114f1 100644 ---- a/chat/Makefile.linux -+++ b/chat/Makefile.linux -@@ -18,7 +18,7 @@ INSTALL= install - all: chat - - chat: chat.o -- $(CC) -o chat chat.o -+ $(CC) $(LDFLAGS) -o chat chat.o - - chat.o: chat.c - $(CC) -c $(CFLAGS) -o chat.o chat.c -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index cf11b74..089f164 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -188,7 +188,7 @@ endif - - ifdef PLUGIN - CFLAGS += -DPLUGIN --LDFLAGS += -Wl,-E -+LDFLAGS_PLUGIN += -Wl,-E - LIBS += -ldl - endif - -@@ -230,7 +230,7 @@ install: pppd - $(INSTALL) -c -m 644 pppd.8 $(MANDIR) - - pppd: $(PPPDOBJS) -- $(CC) $(CFLAGS) $(LDFLAGS) -o pppd $(PPPDOBJS) $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) $(LDFLAGS_PLUGIN) -o pppd $(PPPDOBJS) $(LIBS) - - srp-entry: srp-entry.c - $(CC) $(CFLAGS) $(LDFLAGS) -o $@ srp-entry.c $(LIBS) -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index 303833a..04fe876 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -1,7 +1,7 @@ - #CC = gcc - COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I.. -I../../include -fPIC --LDFLAGS = -shared -+LDFLAGS_SHARED = -shared - INSTALL = install - - # EAP-TLS -@@ -33,7 +33,7 @@ all: $(PLUGINS) - for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done - - %.so: %.c -- $(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^ -+ $(CC) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED) $(CFLAGS) $^ - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../patchlevel.h) - -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 4c5826f..1961e0e 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -1,7 +1,7 @@ - #CC = gcc - COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC --LDFLAGS = -shared -+LDFLAGS_SHARED = -shared - INSTALL = install - - #*********************************************************************** -@@ -33,7 +33,7 @@ endif - all: $(PLUGIN) - - $(PLUGIN): $(PLUGIN_OBJS) -- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(LDFLAGS_SHARED) $^ $(LIBS) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index 9cb316d..7b23b25 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -1,7 +1,7 @@ - #CC = gcc - COPTS = $(RPM_OPT_FLAGS) -DHAVE_MULTILINK - CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC --LDFLAGS = -shared -+LDFLAGS_SHARED = -shared - INSTALL = install - - #*********************************************************************** -@@ -16,7 +16,7 @@ PLUGINS := pppol2tp.so openl2tp.so - all: $(PLUGINS) - - %.so: %.o -- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(LDFLAGS_SHARED) $^ $(LIBS) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 707326b..2150332 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -43,13 +43,13 @@ install: all - $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) - - radius.so: radius.o libradiusclient.a -- $(CC) -o radius.so -shared radius.o libradiusclient.a -+ $(CC) $(LDFLAGS) -o radius.so -shared radius.o libradiusclient.a - - radattr.so: radattr.o -- $(CC) -o radattr.so -shared radattr.o -+ $(CC) $(LDFLAGS) -o radattr.so -shared radattr.o - - radrealms.so: radrealms.o -- $(CC) -o radrealms.so -shared radrealms.o -+ $(CC) $(LDFLAGS) -o radrealms.so -shared radrealms.o - - CLIENTOBJS = avpair.o buildreq.o config.o dict.o ip_util.o \ - clientid.o sendserver.o lock.o util.o md5.o -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index fa49efb..5e06b52 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -31,7 +31,7 @@ CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' - all: rp-pppoe.so pppoe-discovery - - pppoe-discovery: pppoe-discovery.o debug.o common.o -- $(CC) -o pppoe-discovery pppoe-discovery.o debug.o -ludev -+ $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev - - pppoe-discovery.o: pppoe-discovery.c - $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c -@@ -40,7 +40,7 @@ debug.o: debug.c - $(CC) $(CFLAGS) -c -o debug.o debug.c - - rp-pppoe.so: plugin.o discovery.o if.o common.o -- $(CC) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o -+ $(CC) $(LDFLAGS) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux -index 95c6805..33e5107 100644 ---- a/pppdump/Makefile.linux -+++ b/pppdump/Makefile.linux -@@ -10,7 +10,7 @@ INSTALL= install - all: pppdump - - pppdump: $(OBJS) -- $(CC) -o pppdump $(OBJS) -+ $(CC) $(LDFLAGS) -o pppdump $(OBJS) - - clean: - rm -f pppdump $(OBJS) *~ -diff --git a/pppstats/Makefile.linux b/pppstats/Makefile.linux -index c5ba3b1..eeccf83 100644 ---- a/pppstats/Makefile.linux -+++ b/pppstats/Makefile.linux -@@ -26,7 +26,7 @@ install: pppstats - $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) - - pppstats: $(PPPSTATSRCS) -- $(CC) $(CFLAGS) -o pppstats pppstats.c $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) -o pppstats pppstats.c $(LIBS) - - clean: - rm -f pppstats *~ #* core diff --git a/ppp-2.4.8-CVE-2020-8597.patch b/ppp-2.4.8-CVE-2020-8597.patch new file mode 100644 index 0000000..5d7c51b --- /dev/null +++ b/ppp-2.4.8-CVE-2020-8597.patch @@ -0,0 +1,37 @@ +From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Mon, 3 Feb 2020 15:53:28 +1100 +Subject: [PATCH] pppd: Fix bounds check in EAP code + +Given that we have just checked vallen < len, it can never be the case +that vallen >= len + sizeof(rhostname). This fixes the check so we +actually avoid overflowing the rhostname array. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Paul Mackerras +--- + pppd/eap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/pppd/eap.c b/pppd/eap.c +index 94407f56..1b93db01 100644 +--- a/pppd/eap.c ++++ b/pppd/eap.c +@@ -1420,7 +1420,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; +@@ -1846,7 +1846,7 @@ int len; + } + + /* Not so likely to happen. */ +- if (vallen >= len + sizeof (rhostname)) { ++ if (len - vallen >= sizeof (rhostname)) { + dbglog("EAP: trimming really long peer name down"); + BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); + rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch b/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch similarity index 96% rename from 0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch rename to ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch index 8340271..fd53ac7 100644 --- a/0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch +++ b/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch @@ -16,7 +16,7 @@ index 4339566..9a635b8 100644 -COPTS = -O2 -g +COPTS = $(RPM_OPT_FLAGS) CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install -- 1.8.3.1 diff --git a/0022-build-sys-compile-pppol2tp-with-multilink-support.patch b/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch similarity index 96% rename from 0022-build-sys-compile-pppol2tp-with-multilink-support.patch rename to ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch index 945933e..d801308 100644 --- a/0022-build-sys-compile-pppol2tp-with-multilink-support.patch +++ b/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch @@ -17,7 +17,7 @@ index 9a635b8..9cb316d 100644 -COPTS = $(RPM_OPT_FLAGS) +COPTS = $(RPM_OPT_FLAGS) -DHAVE_MULTILINK CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install -- 1.8.3.1 diff --git a/0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch similarity index 98% rename from 0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch rename to ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch index 48190ed..2d6bdd6 100644 --- a/0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch @@ -33,7 +33,7 @@ index 63872eb..8ed56c1 100644 -COPTS = -Wall $(RPM_OPT_FLAGS) +COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" - # Uncomment the next 2 lines to include support for Microsoft's + # Uncomment the next line to include support for Microsoft's # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. diff --git a/pppd/pathnames.h b/pppd/pathnames.h index a33f046..a427cb8 100644 diff --git a/0002-build-sys-enable-PAM-support.patch b/ppp-2.4.8-build-sys-enable-PAM-support.patch similarity index 97% rename from 0002-build-sys-enable-PAM-support.patch rename to ppp-2.4.8-build-sys-enable-PAM-support.patch index 2f1c53b..355410c 100644 --- a/0002-build-sys-enable-PAM-support.patch +++ b/ppp-2.4.8-build-sys-enable-PAM-support.patch @@ -12,7 +12,7 @@ index 1d9ea78..5a44d30 100644 --- a/pppd/Makefile.linux +++ b/pppd/Makefile.linux @@ -61,7 +61,7 @@ HAVE_MULTILINK=y - USE_TDB=y + #SYSTEMD=y HAS_SHADOW=y -#USE_PAM=y diff --git a/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch similarity index 97% rename from 0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch rename to ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch index 87da38b..dc0c5df 100644 --- a/0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +++ b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch @@ -40,7 +40,7 @@ index 5a44d30..63872eb 100644 -LIBS = +COPTS = -Wall $(RPM_OPT_FLAGS) - # Uncomment the next 2 lines to include support for Microsoft's + # Uncomment the next line to include support for Microsoft's # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux index 0a7ec7b..e09a369 100644 @@ -51,7 +51,7 @@ index 0a7ec7b..e09a369 100644 -COPTS = -O2 -g +COPTS = $(RPM_OPT_FLAGS) CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux index 20f62e6..5a81447 100644 @@ -62,7 +62,7 @@ index 20f62e6..5a81447 100644 -COPTS = -O2 -g +COPTS = $(RPM_OPT_FLAGS) CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux index 24ed3e5..45b3b8d 100644 diff --git a/ppp-2.4.7-eaptls-mppe-1.102.patch b/ppp-2.4.8-eaptls-mppe-1.102.patch similarity index 99% rename from ppp-2.4.7-eaptls-mppe-1.102.patch rename to ppp-2.4.8-eaptls-mppe-1.102.patch index 598d1da..c594eba 100644 --- a/ppp-2.4.7-eaptls-mppe-1.102.patch +++ b/ppp-2.4.8-eaptls-mppe-1.102.patch @@ -3174,7 +3174,7 @@ diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/ppp --- ppp-2.4.7/pppd/plugins/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 +++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux 2018-10-30 16:47:59.539263095 +0100 @@ -4,6 +4,9 @@ - LDFLAGS = -shared + LDFLAGS_SHARED = -shared INSTALL = install +# EAP-TLS diff --git a/0013-everywhere-O_CLOEXEC-harder.patch b/ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch similarity index 99% rename from 0013-everywhere-O_CLOEXEC-harder.patch rename to ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch index d720c36..87613af 100644 --- a/0013-everywhere-O_CLOEXEC-harder.patch +++ b/ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch @@ -146,9 +146,9 @@ index 8a12fa0..00a2cf5 100644 #endif - if ((sfd = open(pty_name, O_RDWR | O_NOCTTY)) < 0) + if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) + { warn("Couldn't open pty slave %s: %m", pty_name); - } - } + close(mfd); @@ -2592,10 +2592,10 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) for (i = 0; i < 64; ++i) { slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", diff --git a/0025-pppd-install-pppd-binary-using-standard-perms-755.patch b/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch similarity index 91% rename from 0025-pppd-install-pppd-binary-using-standard-perms-755.patch rename to ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch index 428d71a..bedb902 100644 --- a/0025-pppd-install-pppd-binary-using-standard-perms-755.patch +++ b/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch @@ -23,7 +23,7 @@ index 0e8107f..534ccc2 100644 + $(INSTALL) -c -m 644 pppd.8 $(MANDIR) pppd: $(PPPDOBJS) - $(CC) $(CFLAGS) $(LDFLAGS) -o pppd $(PPPDOBJS) $(LIBS) + $(CC) $(CFLAGS) $(LDFLAGS) $(LDFLAGS_PLUGIN) -o pppd $(PPPDOBJS) $(LIBS) -- 1.8.3.1 diff --git a/0009-pppd-introduce-ipv6-accept-remote.patch b/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch similarity index 89% rename from 0009-pppd-introduce-ipv6-accept-remote.patch rename to ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch index af0f015..eddef5b 100644 --- a/0009-pppd-introduce-ipv6-accept-remote.patch +++ b/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch @@ -19,8 +19,8 @@ index caa2b26..5a56c95 100644 + { "ipv6cp-accept-remote", o_bool, &ipv6cp_allowoptions[0].accept_remote, + "Accept peer's interface identifier for itself", 1 }, - { "ipv6cp-use-ipaddr", o_bool, &ipv6cp_allowoptions[0].use_ip, - "Use (default) IPv4 address as interface identifier", 1 }, + { "defaultroute6", o_bool, &ipv6cp_wantoptions[0].default_route, + "Add default IPv6 route", OPT_ENABLE|1, &ipv6cp_allowoptions[0].default_route }, @@ -437,6 +439,7 @@ ipv6cp_init(unit) memset(ao, 0, sizeof(*ao)); @@ -43,9 +43,9 @@ index cc4568d..8c7552e 100644 --- a/pppd/ipv6cp.h +++ b/pppd/ipv6cp.h @@ -150,7 +150,8 @@ - typedef struct ipv6cp_options { int neg_ifaceid; /* Negotiate interface identifier? */ int req_ifaceid; /* Ask peer to send interface identifier? */ + int default_route; /* Assign default route through interface? */ - int accept_local; /* accept peer's value for iface id? */ + int accept_local; /* accept peer's value for our iface id? */ + int accept_remote; /* accept peer's value for his iface id? */ diff --git a/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch b/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch similarity index 98% rename from 0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch rename to ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch index cf25dba..1b4a9cd 100644 --- a/0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch +++ b/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch @@ -14,7 +14,7 @@ index 4271af6..9e957fa 100644 --- a/pppd/auth.c +++ b/pppd/auth.c @@ -428,7 +428,7 @@ setupapfile(argv) - option_error("unable to reset uid before opening %s: %m", fname); + free(fname); return 0; } - ufile = fopen(fname, "r"); diff --git a/0019-sys-linux-rework-get_first_ethernet.patch b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch similarity index 97% rename from 0019-sys-linux-rework-get_first_ethernet.patch rename to ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch index 9a8c3dd..780e068 100644 --- a/0019-sys-linux-rework-get_first_ethernet.patch +++ b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch @@ -68,12 +68,12 @@ index 9918091..b949716 100644 all: rp-pppoe.so pppoe-discovery -pppoe-discovery: pppoe-discovery.o debug.o -- $(CC) -o pppoe-discovery pppoe-discovery.o debug.o +- $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o +pppoe-discovery: pppoe-discovery.o debug.o common.o -+ $(CC) -o pppoe-discovery pppoe-discovery.o debug.o -ludev ++ $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev pppoe-discovery.o: pppoe-discovery.c - $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c + $(CC) $(CFLAGS) -I../../.. -c -o pppoe-discovery.o pppoe-discovery.c diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c index c0d927d..2bd910f 100644 --- a/pppd/plugins/rp-pppoe/pppoe-discovery.c @@ -111,7 +111,7 @@ index c0d927d..2bd910f 100644 conn->discoverySocket = -1; conn->sessionSocket = -1; @@ -722,3 +734,104 @@ void usage(void) - fprintf(stderr, "Usage: pppoe-discovery [options]\n"); + " -h -- Print usage information.\n"); fprintf(stderr, "\nVersion " RP_VERSION "\n"); } + diff --git a/ppp.spec b/ppp.spec index 97715b7..23b6229 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,13 +1,13 @@ %global _hardened_build 1 Name: ppp -Version: 2.4.7 -Release: 33%{?dist} +Version: 2.4.8 +Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp -Source0: ftp://ftp.samba.org/pub/ppp/ppp-%{version}.tar.gz +Source0: https://github.com/paulusmack/ppp/archive/ppp-%{version}.tar.gz Source1: ppp-pam.conf Source2: ppp-logrotate.conf Source3: ppp-tmpfiles.conf @@ -23,37 +23,32 @@ Source12: ppp-watch.tar.xz # Fedora-specific Patch0001: 0001-build-sys-use-gcc-as-our-compiler-of-choice.patch -Patch0002: 0002-build-sys-enable-PAM-support.patch -Patch0003: 0003-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +Patch0002: ppp-2.4.8-build-sys-enable-PAM-support.patch +Patch0003: ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch Patch0004: 0004-doc-add-configuration-samples.patch -Patch0005: 0005-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +Patch0005: ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch Patch0006: 0006-scritps-use-change_resolv_conf-function.patch Patch0007: 0007-build-sys-don-t-strip-binaries-during-installation.patch Patch0008: 0008-build-sys-use-prefix-usr-instead-of-usr-local.patch -Patch0009: 0009-pppd-introduce-ipv6-accept-remote.patch +Patch0009: ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch Patch0010: 0010-build-sys-enable-CBCP.patch Patch0011: 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch -Patch0012: 0012-pppd-we-don-t-want-to-accidentally-leak-fds.patch -Patch0013: 0013-everywhere-O_CLOEXEC-harder.patch +Patch0012: ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch +Patch0013: ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch Patch0018: 0018-scritps-fix-ip-up.local-sample.patch -Patch0019: 0019-sys-linux-rework-get_first_ethernet.patch +Patch0019: ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch -Patch0021: 0021-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch -Patch0022: 0022-build-sys-compile-pppol2tp-with-multilink-support.patch +Patch0021: ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch +Patch0022: ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch -Patch0025: 0025-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: ppp-2.4.7-eaptls-mppe-1.102.patch -Patch0028: 0028-pppoe-include-netinet-in.h-before-linux-in.h.patch +Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch +Patch0026: ppp-2.4.8-eaptls-mppe-1.102.patch -# rhbz#1556132 -Patch0029: ppp-2.4.7-DES-openssl.patch -# https://github.com/paulusmack/ppp/pull/95 -Patch0030: ppp-2.4.7-honor-ldflags.patch -Patch0031: ppp-2.4.7-coverity-scan-fixes.patch +Patch0032: ppp-2.4.8-CVE-2020-8597.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -87,7 +82,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release} This package contains the header files for building plugins for ppp. %prep -%setup -q +%setup -qn %{name}-%{name}-%{version} %autopatch -p1 tar -xJf %{SOURCE12} @@ -184,6 +179,15 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Fri Feb 21 2020 Jaroslav Škarvada - 2.4.8-1 +- New version +- Changed sources to github +- Dropped 0028-pppoe-include-netinet-in.h-before-linux-in.h, + ppp-2.4.7-DES-openssl, ppp-2.4.7-honor-ldflags, + ppp-2.4.7-coverity-scan-fixes patches (all upstreamed) +- Fixed buffer overflow in the eap_request and eap_response functions + Resolves: CVE-2020-8597 + * Thu Jan 30 2020 Fedora Release Engineering - 2.4.7-33 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index 30dba5f..f30d28e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -78818f40e6d33a1d1de68a1551f6595a ppp-2.4.7.tar.gz -166cdfbce3391746fde60e86752c7bc7 ppp-watch.tar.xz +SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a +SHA512 (ppp-2.4.8.tar.gz) = a99b3b6c7bd80cd133bda4e29d33c793a76f3b67e1f8db774547e88932ce29564fad390a4f51d3fe30a75e006499b95000b042ae0f64cd360548426f8091a478 From 47c6e80e42ed7360d59ea3abed79a4c810214096 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 26 Feb 2020 11:26:32 +0100 Subject: [PATCH 23/76] Fixed ghost directories verification --- ppp.spec | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/ppp.spec b/ppp.spec index 23b6229..fda59c0 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -127,6 +127,10 @@ install -d %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ install -p %{SOURCE10} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdown-ppp +# ghosts +mkdir -p %{buildroot}%{_rundir}/ppp +mkdir -p %{buildroot}%{_rundir}/lock/ppp + %pre /usr/bin/getent group dip >/dev/null 2>&1 || /usr/sbin/groupadd -r -g 40 dip >/dev/null 2>&1 || : @@ -157,8 +161,8 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %{_mandir}/man8/pppoe-discovery.8* %{_mandir}/man8/ppp-watch.8* %{_libdir}/pppd -%ghost %dir /run/ppp -%ghost %dir /run/lock/ppp +%ghost %dir %{_rundir}/ppp +%ghost %dir %{_rundir}/lock/ppp %dir %{_sysconfdir}/logrotate.d %attr(700, root, root) %dir %{_localstatedir}/log/ppp %config(noreplace) %{_sysconfdir}/ppp/eaptls-client @@ -179,6 +183,9 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo %doc PLUGINS %changelog +* Wed Feb 26 2020 Jaroslav Škarvada - 2.4.8-2 +- Fixed ghost directories verification + * Fri Feb 21 2020 Jaroslav Škarvada - 2.4.8-1 - New version - Changed sources to github From a5cfee84bdf2a1178e66b08302f12623e0573103 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Fri, 28 Feb 2020 02:37:01 +0000 Subject: [PATCH 24/76] Use make_build macro https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make --- ppp.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/ppp.spec b/ppp.spec index fda59c0..9c8f483 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 2%{?dist} +Release: 3%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -91,8 +91,8 @@ tar -xJf %{SOURCE12} export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" export RPM_LD_FLAGS="$LDFLAGS" %configure -make %{?_smp_mflags} LDFLAGS="%{?build_ldflags}" -make -C ppp-watch %{?_smp_mflags} LDFLAGS="%{?build_ldflags}" +%{make_build} LDFLAGS="%{?build_ldflags}" +%{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags}" %install make INSTROOT=%{buildroot} install install-etcppp @@ -183,6 +183,10 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Fri Feb 28 2020 Tom Stellard - 2.4.8-3 +- Use make_build macro +- https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make + * Wed Feb 26 2020 Jaroslav Škarvada - 2.4.8-2 - Fixed ghost directories verification From ad5e2374ccee99e11b6c942e635d775615a5093e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 6 Apr 2020 18:33:17 +0200 Subject: [PATCH 25/76] Updated EAP-TLS patch to v1.201 --- ...patch => ppp-2.4.8-eaptls-mppe-1.201.patch | 863 ++++++++++++++---- ppp.spec | 8 +- 2 files changed, 697 insertions(+), 174 deletions(-) rename ppp-2.4.8-eaptls-mppe-1.102.patch => ppp-2.4.8-eaptls-mppe-1.201.patch (78%) diff --git a/ppp-2.4.8-eaptls-mppe-1.102.patch b/ppp-2.4.8-eaptls-mppe-1.201.patch similarity index 78% rename from ppp-2.4.8-eaptls-mppe-1.102.patch rename to ppp-2.4.8-eaptls-mppe-1.201.patch index c594eba..ca3e872 100644 --- a/ppp-2.4.8-eaptls-mppe-1.102.patch +++ b/ppp-2.4.8-eaptls-mppe-1.201.patch @@ -1,7 +1,7 @@ -diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls ---- ppp-2.4.7/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls 2018-11-02 17:14:08.101636586 +0100 -@@ -0,0 +1,291 @@ +diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls +--- ppp-2.4.8/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls 2020-04-03 14:02:19.334905035 +0200 +@@ -0,0 +1,301 @@ +EAP-TLS authentication support for PPP +====================================== + @@ -293,9 +293,19 @@ diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.102/README.eap-tls + - Print warning when certificate is either not yet valid or has expired. + - Perform better peer certificate checks. + - Allow certificate chain files to be used. -diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-client ---- ppp-2.4.7/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-client 2018-10-30 16:47:59.527263750 +0100 ++v1.200 (28-Feb-2020) ++ - First version of patch that was used to create a github PR against the main ppp code base. ++ - Add client-side 'capath' option to allow a directory with trusted CA certificates. ++ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or ++ use the ones supplied by OpenSSL. ++ - Code now also builds on Solaris (x86 tested) but has not been tested yet, as the Solaris ppp ++ kernel driver does not support MPPE. ++v1.201 (03-Apr-2020) ++ - Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that ++ you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation. +diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-client +--- ppp-2.4.8/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-client 2020-04-03 14:02:19.334905035 +0200 @@ -0,0 +1,10 @@ +# Parameters for authentication using EAP-TLS (client) + @@ -307,9 +317,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/e +# client private key file (required) + +#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-server ---- ppp-2.4.7/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/eaptls-server 2018-10-30 16:47:59.527263750 +0100 +diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-server +--- ppp-2.4.8/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-server 2020-04-03 14:02:19.334905035 +0200 @@ -0,0 +1,11 @@ +# Parameters for authentication using EAP-TLS (server) + @@ -322,9 +332,9 @@ diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/e +# allowed addresses (required, can be *) + +#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/openssl.cnf ---- ppp-2.4.7/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/openssl.cnf 2018-10-30 16:47:59.527263750 +0100 +diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/openssl.cnf +--- ppp-2.4.8/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/openssl.cnf 2020-04-03 14:02:19.334905035 +0200 @@ -0,0 +1,14 @@ +openssl_conf = openssl_def + @@ -340,9 +350,9 @@ diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.102/etc.ppp/ope +MODULE_PATH = /usr/lib64/libeTPkcs11.so +init = 0 + -diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.102/linux/Makefile.top ---- ppp-2.4.7/linux/Makefile.top 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/linux/Makefile.top 2018-10-30 16:47:59.528263707 +0100 +diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.201/linux/Makefile.top +--- ppp-2.4.8/linux/Makefile.top 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/linux/Makefile.top 2020-04-03 14:02:19.334905035 +0200 @@ -26,7 +26,7 @@ cd pppdump; $(MAKE) $(MFLAGS) install @@ -363,39 +373,134 @@ diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.102/linux/Makefi $(BINDIR): $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/pppd/Makefile.linux ---- ppp-2.4.7/pppd/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/Makefile.linux 2018-10-30 16:47:59.528263707 +0100 -@@ -76,6 +76,9 @@ +diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.linux +--- ppp-2.4.8/pppd/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.linux 2020-04-03 14:02:19.335905034 +0200 +@@ -11,16 +11,16 @@ + + TARGETS = pppd + +-PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c md5.c ccp.c \ +- ecp.c ipxcp.c auth.c options.c sys-linux.c md4.c chap_ms.c \ ++PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c ccp.c \ ++ ecp.c ipxcp.c auth.c options.c sys-linux.c chap_ms.c \ + demand.c utils.c tty.c eap.c chap-md5.c session.c + + HEADERS = ccp.h session.h chap-new.h ecp.h fsm.h ipcp.h \ +- ipxcp.h lcp.h magic.h md5.h patchlevel.h pathnames.h pppd.h \ ++ ipxcp.h lcp.h magic.h patchlevel.h pathnames.h pppd.h \ + upap.h eap.h + + MANPAGES = pppd.8 +-PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o md5.o ccp.o \ ++PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o ccp.o \ + ecp.o auth.o options.o demand.o utils.o sys-linux.o ipxcp.o tty.o \ + eap.o chap-md5.o session.o + +@@ -81,6 +81,13 @@ # Use libutil USE_LIBUTIL=y -+# Enable EAP-TLS authentication (requires libssl and libcrypto) ++# Enable EAP-TLS authentication (requires MPPE support, libssl and libcrypto) +USE_EAPTLS=y ++ ++# Either use the internal {md5,sha1} routines or use the openssl versions ++USE_OPENSSL_MD5=y ++USE_OPENSSL_SHA1=y + MAXOCTETS=y INCLUDE_DIRS= -I../include -@@ -115,6 +118,15 @@ - PPPDOBJS += sha1.o +@@ -92,8 +99,9 @@ + ifdef CHAPMS + CFLAGS += -DCHAPMS=1 + NEEDDES=y +-PPPDOBJS += md4.o chap_ms.o ++PPPDSRC += md4.c chap_ms.c + HEADERS += md4.h chap_ms.h ++PPPDOBJS += md4.o chap_ms.o + ifdef MSLANMAN + CFLAGS += -DMSLANMAN=1 endif - +@@ -111,11 +119,31 @@ + MANPAGES += srp-entry.8 + EXTRACLEAN += srp-entry.o + NEEDDES=y ++endif ++ +# EAP-TLS +ifdef USE_EAPTLS -+CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include ++CFLAGS += -DUSE_EAPTLS=1 +LIBS += -lssl -lcrypto +PPPDSRC += eap-tls.c +HEADERS += eap-tls.h +PPPDOBJS += eap-tls.o +endif + - ifdef HAS_SHADOW - CFLAGS += -DHAS_SHADOW - #LIBS += -lshadow $(LIBS) -diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c ---- ppp-2.4.7/pppd/auth.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c 2018-10-30 16:47:59.530263608 +0100 -@@ -109,6 +109,9 @@ ++ifdef USE_OPENSSL_MD5 ++CFLAGS += -DUSE_OPENSSL_MD5=1 ++LIBS += -lcrypto ++else ++PPPDSRC += md5.c ++HEADERS += md5.h ++PPPDOBJS += md5.o ++endif ++ ++ifdef USE_OPENSSL_SHA1 ++CFLAGS += -DUSE_OPENSSL_SHA1=1 ++LIBS += -lcrypto + else +-# OpenSSL has an integrated version of SHA-1, and its implementation +-# is incompatible with this local SHA-1 implementation. We must use +-# one or the other, not both. +-PPPDSRCS += sha1.c ++PPPDSRC += sha1.c + HEADERS += sha1.h + PPPDOBJS += sha1.o + endif +diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.sol2 +--- ppp-2.4.8/pppd/Makefile.sol2 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.sol2 2020-04-03 14:02:19.335905034 +0200 +@@ -5,10 +5,10 @@ + + include ../Makedefs.com + +-CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="@DESTDIR@"' ++CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="/usr/local"' + LIBS = -lsocket -lnsl + +-OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o md5.o \ ++OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o \ + tty.o ccp.o ecp.o auth.o options.o demand.o utils.o sys-solaris.o \ + chap-md5.o session.o + +@@ -37,7 +37,21 @@ + + # Uncomment to enable MS-CHAP + CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H +-OBJS += chap_ms.o pppcrypt.o md4.o sha1.o ++OBJS += chap_ms.o pppcrypt.o md4.o ++ ++# Uncomment to enable MPPE (in both CHAP and EAP-TLS) ++CFLAGS += -DMPPE ++ ++# Uncomment to use the OpenSSL {md5,sha1} routines ++#CFLAGS += -DUSE_OPENSSL_MD5 -DUSE_OPENSSL_SHA1 ++#LIBS += -lcrypto ++# else ++OBJS += md5.o sha1.o ++ ++# Uncomment to enable EAP-TLS ++CFLAGS += -DUSE_EAPTLS ++LIBS += -lcrypto -lssl ++OBJS += eap-tls.o + + # Uncomment for CBCP + #CFLAGS += -DCBCP_SUPPORT +diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c +--- ppp-2.4.8/pppd/auth.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c 2020-04-03 14:02:19.337905032 +0200 +@@ -113,6 +113,9 @@ #include "upap.h" #include "chap-new.h" #include "eap.h" @@ -405,7 +510,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c #ifdef CBCP_SUPPORT #include "cbcp.h" #endif -@@ -183,6 +186,11 @@ +@@ -186,6 +189,11 @@ /* Hook for a plugin to get the CHAP password for authenticating us */ int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; @@ -417,12 +522,13 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c /* Hook for a plugin to say whether it is OK if the peer refuses to authenticate. */ int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -238,6 +246,14 @@ +@@ -241,6 +249,15 @@ bool explicit_user = 0; /* Set if "user" option supplied */ bool explicit_passwd = 0; /* Set if "password" option supplied */ char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ +#ifdef USE_EAPTLS +char *cacert_file = NULL; /* CA certificate file (pem format) */ ++char *ca_path = NULL; /* directory with CA certificates */ +char *cert_file = NULL; /* client certificate file (pem format) */ +char *privkey_file = NULL; /* client private key file (pem format) */ +char *crl_dir = NULL; /* directory containing CRL files */ @@ -432,7 +538,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c static char *uafname; /* name of most recent +ua file */ -@@ -254,6 +270,19 @@ +@@ -257,6 +274,19 @@ static int have_chap_secret __P((char *, char *, int, int *)); static int have_srp_secret __P((char *client, char *server, int need_ip, int *lacks_ipp)); @@ -452,12 +558,13 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); static int scan_authfile __P((FILE *, char *, char *, char *, struct wordlist **, struct wordlist **, -@@ -401,6 +430,15 @@ +@@ -404,6 +434,16 @@ "Set telephone number(s) which are allowed to connect", OPT_PRIV | OPT_A2LIST }, +#ifdef USE_EAPTLS + { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, ++ { "capath", o_string, &ca_path, "EAP-TLS CA certificate directory" }, + { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, + { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, + { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, @@ -468,7 +575,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c { NULL } }; -@@ -730,6 +768,9 @@ +@@ -737,6 +777,9 @@ lcp_options *wo = &lcp_wantoptions[unit]; lcp_options *go = &lcp_gotoptions[unit]; lcp_options *ho = &lcp_hisoptions[unit]; @@ -478,7 +585,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c int i; struct protent *protp; -@@ -764,6 +805,22 @@ +@@ -771,6 +814,22 @@ } } @@ -501,7 +608,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c new_phase(PHASE_AUTHENTICATE); auth = 0; if (go->neg_eap) { -@@ -1277,6 +1334,15 @@ +@@ -1291,6 +1350,15 @@ our_name, 1, &lacks_ip); } @@ -517,7 +624,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c if (auth_required && !can_auth && noauth_addrs == NULL) { if (default_auth) { option_error( -@@ -1331,7 +1397,11 @@ +@@ -1345,7 +1413,11 @@ passwd[0] != 0 || (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, (explicit_remote? remote_name: NULL), 0, NULL))) || @@ -530,7 +637,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c hadchap = -1; if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1346,8 +1416,14 @@ +@@ -1360,8 +1432,14 @@ !have_chap_secret((explicit_remote? remote_name: NULL), our_name, 1, NULL))) && !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, @@ -546,7 +653,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c } -@@ -1707,6 +1783,7 @@ +@@ -1721,6 +1799,7 @@ } @@ -554,7 +661,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c /* * get_secret - open the CHAP secret file and return the secret * for authenticating the given client on the given server. -@@ -2359,3 +2436,335 @@ +@@ -2373,3 +2452,345 @@ auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); } @@ -631,7 +738,7 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + else if (server != NULL && server[0] == 0) + server = NULL; + -+ if (cacert_file && cert_file && privkey_file) ++ if ((cacert_file || ca_path) && cert_file && privkey_file) + return 1; + + filename = _PATH_EAPTLSCLIFILE; @@ -823,13 +930,14 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + +int +get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, am_server) ++ cacertfile, capath, pkfile, am_server) + int unit; + char *client; + char *server; + char *clicertfile; + char *servcertfile; + char *cacertfile; ++ char *capath; + char *pkfile; + int am_server; +{ @@ -839,13 +947,22 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c + struct wordlist *addrs = NULL; + struct wordlist *opts = NULL; + -+ /* in client mode the ca+cert+privkey can also be specified as options */ -+ if (!am_server && cacert_file && cert_file && privkey_file ) ++ /* maybe overkill, but it eases debugging */ ++ bzero(clicertfile, MAXWORDLEN); ++ bzero(servcertfile, MAXWORDLEN); ++ bzero(cacertfile, MAXWORDLEN); ++ bzero(capath, MAXWORDLEN); ++ bzero(pkfile, MAXWORDLEN); ++ ++ /* the ca+cert+privkey can also be specified as options */ ++ if (!am_server && (cacert_file || ca_path) && cert_file && privkey_file ) + { + strlcpy( clicertfile, cert_file, MAXWORDLEN ); -+ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); ++ if (cacert_file) ++ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); ++ if (ca_path) ++ strlcpy( capath, ca_path, MAXWORDLEN ); + strlcpy( pkfile, privkey_file, MAXWORDLEN ); -+ servcertfile[0] = '\0'; + } + else + { @@ -890,10 +1007,10 @@ diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.102/pppd/auth.c +} +#endif + -diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c ---- ppp-2.4.7/pppd/ccp.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c 2018-10-30 16:47:59.531263554 +0100 -@@ -540,6 +540,9 @@ +diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c +--- ppp-2.4.8/pppd/ccp.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c 2020-04-03 14:02:19.337905032 +0200 +@@ -539,6 +539,9 @@ if (go->mppe) { ccp_options *ao = &ccp_allowoptions[f->unit]; int auth_mschap_bits = auth_done[f->unit]; @@ -903,7 +1020,7 @@ diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c int numbits; /* -@@ -567,8 +570,23 @@ +@@ -566,8 +569,23 @@ lcp_close(f->unit, "MPPE required but not available"); return; } @@ -928,28 +1045,68 @@ diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ccp.c lcp_close(f->unit, "MPPE required but not available"); return; } -diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.102/pppd/chap-md5.c ---- ppp-2.4.7/pppd/chap-md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/chap-md5.c 2018-10-30 16:47:59.532263499 +0100 +diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c +--- ppp-2.4.8/pppd/chap-md5.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c 2020-04-03 14:02:19.337905032 +0200 @@ -36,7 +36,11 @@ #include "chap-new.h" #include "chap-md5.h" #include "magic.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" ++#ifdef USE_OPENSSL_MD5 ++#include "openssl/md5.h" +#else #include "md5.h" -+#endif /* USE_EAPTLS */ ++#endif /* USE_OPENSSL_MD5 */ #define MD5_HASH_SIZE 16 #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c ---- ppp-2.4.7/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c 2018-11-02 16:53:05.996742547 +0100 -@@ -0,0 +1,1383 @@ +diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c +--- ppp-2.4.8/pppd/chap_ms.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c 2020-04-03 14:02:19.338905030 +0200 +@@ -534,7 +534,7 @@ + char *username, u_char Challenge[8]) + + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char sha1Hash[SHA1_SIGNATURE_SIZE]; + char *user; + +@@ -670,7 +670,7 @@ + 0x6E }; + + int i; +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char Digest[SHA1_SIGNATURE_SIZE]; + u_char Challenge[8]; + +@@ -724,7 +724,7 @@ + void + mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + + SHA1_Init(&sha1Context); +@@ -768,7 +768,7 @@ + mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], + u_char NTResponse[24], int IsServer) + { +- SHA1_CTX sha1Context; ++ SHA_CTX sha1Context; + u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ + +diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +--- ppp-2.4.8/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c 2020-04-03 14:02:19.338905030 +0200 +@@ -0,0 +1,1442 @@ +/* * eap-tls.c - EAP-TLS implementation for PPP + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * Jan Just Keijser 2006-2019 All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions @@ -978,6 +1135,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + */ + +#include ++#include +#include +#include +#include @@ -1001,10 +1159,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c +static ENGINE *cert_engine = NULL; +static ENGINE *pkey_engine = NULL; + -+#ifdef MPPE -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ +/* + * The following stuff is only needed if SSL_export_keying_material() is not available + */ @@ -1178,9 +1332,41 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + +#define SSL3_RT_HEADER 0x100 + ++#ifndef SSL_CTX_set_max_proto_version ++/** Mimics SSL_CTX_set_max_proto_version for OpenSSL < 1.1 */ ++static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) ++{ ++ long sslopt = 0; ++ ++ if (tls_ver_max < TLS1_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1; ++ } ++#ifdef SSL_OP_NO_TLSv1_1 ++ if (tls_ver_max < TLS1_1_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1_1; ++ } ++#endif ++#ifdef SSL_OP_NO_TLSv1_2 ++ if (tls_ver_max < TLS1_2_VERSION) ++ { ++ sslopt |= SSL_OP_NO_TLSv1_2; ++ } ++#endif ++ SSL_CTX_set_options(ctx, sslopt); ++ ++ return 1; ++} ++#endif /* SSL_CTX_set_max_proto_version */ ++ +#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + + ++#ifdef MPPE ++ ++#define EAPTLS_MPPE_KEY_LEN 32 ++ +/* + * Generate keys according to RFC 2716 and add to reply + */ @@ -1220,7 +1406,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + mppe_keys_set = 1; +} + -+#endif ++#endif /* MPPE */ + +void log_ssl_errors( void ) +{ @@ -1327,7 +1513,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + * Initialize the SSL stacks and tests if certificates, key and crl + * for client or server use can be loaded. + */ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, + char *certfile, char *peer_certfile, char *privkeyfile) +{ + char *cert_engine_name = NULL; @@ -1340,25 +1526,32 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + X509_LOOKUP *lookup; + X509 *tmp; + int ret; ++#if defined(TLS1_2_VERSION) ++ long tls_version = TLS1_2_VERSION; ++#elif defined(TLS1_1_VERSION) ++ long tls_version = TLS1_1_VERSION; ++#else ++ long tls_version = TLS1_VERSION; ++#endif + + /* + * Without these can't continue + */ -+ if (!cacertfile[0]) ++ if (!(cacertfile[0] || capath[0])) + { -+ error("EAP-TLS: CA certificate missing"); ++ error("EAP-TLS: CA certificate file or path missing"); + return NULL; + } + + if (!certfile[0]) + { -+ error("EAP-TLS: User certificate missing"); ++ error("EAP-TLS: Certificate missing"); + return NULL; + } + + if (!privkeyfile[0]) + { -+ error("EAP-TLS: User private key missing"); ++ error("EAP-TLS: Private key missing"); + return NULL; + } + @@ -1458,9 +1651,14 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + SSL_CTX_set_default_passwd_cb (ctx, password_callback); + -+ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) ++ if (strlen(cacertfile) == 0) cacertfile = NULL; ++ if (strlen(capath) == 0) capath = NULL; ++ ++ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, capath)) + { -+ error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); ++ error("EAP-TLS: Cannot load verify locations"); ++ if (cacertfile) dbglog("CA certificate file = [%s]", cacertfile); ++ if (capath) dbglog("CA certificate path = [%s]", capath); + goto fail; + } + @@ -1583,6 +1781,9 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c +#endif + ); + ++ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); ++ SSL_CTX_set_max_proto_version(ctx, tls_version); ++ + SSL_CTX_set_verify_depth(ctx, 5); + SSL_CTX_set_verify(ctx, + SSL_VERIFY_PEER | @@ -1685,6 +1886,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + char servcertfile[MAXWORDLEN]; + char clicertfile[MAXWORDLEN]; + char cacertfile[MAXWORDLEN]; ++ char capath[MAXWORDLEN]; + char pkfile[MAXWORDLEN]; + /* + * Allocate new eaptls session @@ -1704,7 +1906,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog( "getting eaptls secret" ); + if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, + esp->es_server.ea_name, clicertfile, -+ servcertfile, cacertfile, pkfile, 1)) { ++ servcertfile, cacertfile, capath, pkfile, 1)) { + error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", + esp->es_server.ea_peer, esp->es_server.ea_name ); + return 0; @@ -1712,7 +1914,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + + ets->mtu = eaptls_get_mtu(esp->es_unit); + -+ ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); ++ ets->ctx = eaptls_init_ssl(1, cacertfile, capath, servcertfile, clicertfile, pkfile); + if (!ets->ctx) + goto fail; + @@ -1772,6 +1974,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + char servcertfile[MAXWORDLEN]; + char clicertfile[MAXWORDLEN]; + char cacertfile[MAXWORDLEN]; ++ char capath[MAXWORDLEN]; + char pkfile[MAXWORDLEN]; + + /* @@ -1796,14 +1999,14 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog( "calling get_eaptls_secret" ); + if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, + ets->peer, clicertfile, -+ servcertfile, cacertfile, pkfile, 0)) { ++ servcertfile, cacertfile, capath, pkfile, 0)) { + error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", + esp->es_client.ea_name, ets->peer ); + return 0; + } + + dbglog( "calling eaptls_init_ssl" ); -+ ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); ++ ets->ctx = eaptls_init_ssl(0, cacertfile, capath, clicertfile, servcertfile, pkfile); + if (!ets->ctx) + goto fail; + @@ -2255,6 +2458,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + strcat(string, "ChangeCipherSpec"); + break; + ++#ifdef SSL3_RT_INNER_CONTENT_TYPE ++ case SSL3_RT_INNER_CONTENT_TYPE: ++ strcat(string, "InnerContentType (TLS1.3)"); ++ break; ++#endif ++ + case SSL3_RT_HANDSHAKE: + + strcat(string, "Handshake: "); @@ -2309,6 +2518,12 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + case TLS1_2_VERSION: + strcat(string, "TLS 1.2"); + break; ++#ifdef TLS1_3_VERSION ++ case TLS1_3_VERSION: ++ strcat(string, "TLS 1.3 (not supported)"); ++ break; ++#endif ++ + default: + strcat(string, "Unknown version"); + } @@ -2330,14 +2545,15 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.c + dbglog("%s", string); +} + -diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h ---- ppp-2.4.7/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h 2018-10-30 16:47:59.534263383 +0100 +diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h +--- ppp-2.4.8/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h 2020-04-03 14:02:19.338905030 +0200 @@ -0,0 +1,107 @@ +/* + * eap-tls.h + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * Jan Just Keijser 2006-2019 All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions @@ -2372,7 +2588,6 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h + +#include +#include -+#include + +#define EAP_TLS_FLAGS_LI 128 /* length included flag */ +#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ @@ -2416,7 +2631,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h +X509 *get_X509_from_file(char *filename); +int ssl_cmp_certs(char *filename, X509 * a); + -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, + char *certfile, char *peer_certfile, char *privkeyfile); +int eaptls_init_ssl_server(eap_state * esp); +int eaptls_init_ssl_client(eap_state * esp); @@ -2428,7 +2643,7 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h + +int get_eaptls_secret(int unit, char *client, char *server, + char *clicertfile, char *servcertfile, char *cacertfile, -+ char *pkfile, int am_server); ++ char *capath, char *pkfile, int am_server); + +#ifdef MPPE +#include "mppe.h" /* MPPE_MAX_KEY_LEN */ @@ -2441,9 +2656,9 @@ diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap-tls.h +#endif + +#endif -diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c ---- ppp-2.4.7/pppd/eap.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c 2018-10-30 16:47:59.537263209 +0100 +diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c +--- ppp-2.4.8/pppd/eap.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c 2020-04-03 14:02:19.339905029 +0200 @@ -43,6 +43,11 @@ * Based on draft-ietf-pppext-eap-srp-03.txt. */ @@ -2462,15 +2677,30 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #include "pathnames.h" -#include "md5.h" #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" ++#ifdef USE_OPENSSL_MD5 ++#include "openssl/md5.h" +#else +#include "md5.h" -+#endif /* USE_EAPTLS */ ++#endif /* USE_OPENSSL_MD5 */ #ifdef USE_SRP #include -@@ -209,6 +218,9 @@ +@@ -72,8 +81,12 @@ + #include "pppcrypt.h" + #endif /* USE_SRP */ + +-#ifndef SHA_DIGESTSIZE +-#define SHA_DIGESTSIZE 20 ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#endif /* USE_EAPTLS */ ++ ++#ifndef SHA_DIGEST_LENGTH ++#define SHA_DIGEST_LENGTH 20 + #endif + + +@@ -208,6 +221,9 @@ esp->es_server.ea_id = (u_char)(drand48() * 0x100); esp->es_client.ea_timeout = EAP_DEFREQTIME; esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; @@ -2480,7 +2710,18 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c } /* -@@ -436,8 +448,16 @@ +@@ -316,8 +332,8 @@ + { + struct tm *tp; + char tbuf[9]; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + time_t reftime; + + if (pn_secret == NULL) +@@ -435,8 +451,16 @@ u_char vals[2]; struct b64state bs; #endif /* USE_SRP */ @@ -2497,7 +2738,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c switch (esp->es_server.ea_state) { case eapBadAuth: return; -@@ -562,9 +582,79 @@ +@@ -561,9 +585,79 @@ break; } #endif /* USE_SRP */ @@ -2577,7 +2818,20 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case eapSRP1: #ifdef USE_SRP ts = (struct t_server *)esp->es_server.ea_session; -@@ -718,6 +808,30 @@ +@@ -647,10 +741,10 @@ + char *str; + #ifdef USE_SRP + struct t_server *ts; +- u_char clear[8], cipher[8], dig[SHA_DIGESTSIZE], *optr, *cp; ++ u_char clear[8], cipher[8], dig[SHA_DIGEST_LENGTH], *optr, *cp; + int i, j; + struct b64state b64; +- SHA1_CTX ctxt; ++ SHA_CTX ctxt; + #endif /* USE_SRP */ + + /* Handle both initial auth and restart */ +@@ -717,6 +811,30 @@ INCPTR(esp->es_server.ea_namelen, outp); break; @@ -2608,7 +2862,48 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP case eapSRP1: PUTCHAR(EAPT_SRP, outp); -@@ -904,11 +1018,57 @@ +@@ -763,8 +881,8 @@ + PUTLONG(SRPVAL_EBIT, outp); + ts = (struct t_server *)esp->es_server.ea_session; + assert(ts != NULL); +- BCOPY(t_serverresponse(ts), outp, SHA_DIGESTSIZE); +- INCPTR(SHA_DIGESTSIZE, outp); ++ BCOPY(t_serverresponse(ts), outp, SHA_DIGEST_LENGTH); ++ INCPTR(SHA_DIGEST_LENGTH, outp); + + if (pncrypt_setkey(0)) { + /* Generate pseudonym */ +@@ -804,9 +922,9 @@ + /* Set length and pad out to next 20 octet boundary */ + i = outp - optr - 1; + *optr = i; +- i %= SHA_DIGESTSIZE; ++ i %= SHA_DIGEST_LENGTH; + if (i != 0) { +- while (i < SHA_DIGESTSIZE) { ++ while (i < SHA_DIGEST_LENGTH) { + *outp++ = drand48() * 0x100; + i++; + } +@@ -822,14 +940,14 @@ + while (optr < outp) { + SHA1Final(dig, &ctxt); + cp = dig; +- while (cp < dig + SHA_DIGESTSIZE) ++ while (cp < dig + SHA_DIGEST_LENGTH) + *optr++ ^= *cp++; + SHA1Init(&ctxt); + SHA1Update(&ctxt, &esp->es_server.ea_id, 1); + SHA1Update(&ctxt, esp->es_server.ea_skey, + SESSION_KEY_LEN); +- SHA1Update(&ctxt, optr - SHA_DIGESTSIZE, +- SHA_DIGESTSIZE); ++ SHA1Update(&ctxt, optr - SHA_DIGEST_LENGTH, ++ SHA_DIGEST_LENGTH); + } + } + break; +@@ -903,11 +1021,57 @@ eap_server_timeout(arg) void *arg; { @@ -2666,7 +2961,20 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c /* EAP ID number must not change on timeout. */ eap_send_request(esp); } -@@ -1166,6 +1326,81 @@ +@@ -1154,17 +1318,92 @@ + PUTCHAR(id, outp); + esp->es_client.ea_id = id; + msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) + +- SHA_DIGESTSIZE; ++ SHA_DIGEST_LENGTH; + PUTSHORT(msglen, outp); + PUTCHAR(EAPT_SRP, outp); + PUTCHAR(EAPSRP_CVALIDATOR, outp); + PUTLONG(flags, outp); +- BCOPY(str, outp, SHA_DIGESTSIZE); ++ BCOPY(str, outp, SHA_DIGEST_LENGTH); + + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen); } #endif /* USE_SRP */ @@ -2748,7 +3056,44 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c static void eap_send_nak(esp, id, type) eap_state *esp; -@@ -1320,6 +1555,11 @@ +@@ -1251,8 +1490,8 @@ + { + u_char val; + u_char *datp, *digp; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + int dsize, fd, olen = len; + + /* +@@ -1261,21 +1500,21 @@ + */ + val = id; + while (len > 0) { +- if ((dsize = len % SHA_DIGESTSIZE) == 0) +- dsize = SHA_DIGESTSIZE; ++ if ((dsize = len % SHA_DIGEST_LENGTH) == 0) ++ dsize = SHA_DIGEST_LENGTH; + len -= dsize; + datp = inp + len; + SHA1Init(&ctxt); + SHA1Update(&ctxt, &val, 1); + SHA1Update(&ctxt, esp->es_client.ea_skey, SESSION_KEY_LEN); + if (len > 0) { +- SHA1Update(&ctxt, datp, SHA_DIGESTSIZE); ++ SHA1Update(&ctxt, datp, SHA_DIGEST_LENGTH); + } else { + SHA1Update(&ctxt, esp->es_client.ea_name, + esp->es_client.ea_namelen); + } + SHA1Final(dig, &ctxt); +- for (digp = dig; digp < dig + SHA_DIGESTSIZE; digp++) ++ for (digp = dig; digp < dig + SHA_DIGEST_LENGTH; digp++) + *datp++ ^= *digp; + } + +@@ -1319,12 +1558,17 @@ char rhostname[256]; MD5_CTX mdContext; u_char hash[MD5_SIGNATURE_SIZE]; @@ -2760,7 +3105,15 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP struct t_client *tc; struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1456,6 +1696,100 @@ + u_char vals[2]; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ SHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; + int fd; + #endif /* USE_SRP */ + +@@ -1455,6 +1699,100 @@ esp->es_client.ea_namelen); break; @@ -2861,8 +3214,41 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c #ifdef USE_SRP case EAPT_SRP: if (len < 1) { -@@ -1737,6 +2071,11 @@ - u_char dig[SHA_DIGESTSIZE]; +@@ -1639,7 +1977,7 @@ + esp->es_client.ea_id, id); + } + } else { +- len -= sizeof (u_int32_t) + SHA_DIGESTSIZE; ++ len -= sizeof (u_int32_t) + SHA_DIGEST_LENGTH; + if (len < 0 || t_clientverify(tc, inp + + sizeof (u_int32_t)) != 0) { + error("EAP: SRP server verification " +@@ -1649,7 +1987,7 @@ + GETLONG(esp->es_client.ea_keyflags, inp); + /* Save pseudonym if user wants it. */ + if (len > 0 && esp->es_usepseudo) { +- INCPTR(SHA_DIGESTSIZE, inp); ++ INCPTR(SHA_DIGEST_LENGTH, inp); + write_pseudonym(esp, inp, len, id); + } + } +@@ -1676,7 +2014,7 @@ + esp->es_client.ea_namelen); + SHA1Final(dig, &ctxt); + eap_srp_response(esp, id, EAPSRP_LWRECHALLENGE, dig, +- SHA_DIGESTSIZE); ++ SHA_DIGEST_LENGTH); + break; + + default: +@@ -1732,10 +2070,15 @@ + #ifdef USE_SRP + struct t_server *ts; + struct t_num A; +- SHA1_CTX ctxt; +- u_char dig[SHA_DIGESTSIZE]; ++ eHA_CTX ctxt; ++ u_char dig[SHA_DIGEST_LENGTH]; #endif /* USE_SRP */ +#ifdef USE_EAPTLS @@ -2873,7 +3259,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (esp->es_server.ea_id != id) { dbglog("EAP: discarding Response %d; expected ID %d", id, esp->es_server.ea_id); -@@ -1776,6 +2115,64 @@ +@@ -1775,6 +2118,64 @@ eap_figure_next_state(esp, 0); break; @@ -2938,7 +3324,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_NOTIFICATION: dbglog("EAP unexpected Notification; response discarded"); break; -@@ -1807,6 +2204,13 @@ +@@ -1806,6 +2207,13 @@ esp->es_server.ea_state = eapMD5Chall; break; @@ -2952,7 +3338,37 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c default: dbglog("EAP: peer requesting unknown Type %d", vallen); switch (esp->es_server.ea_state) { -@@ -2018,13 +2422,27 @@ +@@ -1923,9 +2331,9 @@ + eap_figure_next_state(esp, 1); + break; + } +- if (len < sizeof (u_int32_t) + SHA_DIGESTSIZE) { ++ if (len < sizeof (u_int32_t) + SHA_DIGEST_LENGTH) { + error("EAP: M1 length %d < %d", len, +- sizeof (u_int32_t) + SHA_DIGESTSIZE); ++ sizeof (u_int32_t) + SHA_DIGEST_LENGTH); + eap_figure_next_state(esp, 1); + break; + } +@@ -1962,7 +2370,7 @@ + info("EAP: unexpected SRP Subtype 4 Response"); + return; + } +- if (len != SHA_DIGESTSIZE) { ++ if (len != SHA_DIGEST_LENGTH) { + error("EAP: bad Lightweight rechallenge " + "response"); + return; +@@ -1976,7 +2384,7 @@ + SHA1Update(&ctxt, esp->es_server.ea_peer, + esp->es_server.ea_peerlen); + SHA1Final(dig, &ctxt); +- if (BCMP(dig, inp, SHA_DIGESTSIZE) != 0) { ++ if (BCMP(dig, inp, SHA_DIGEST_LENGTH) != 0) { + error("EAP: failed Lightweight rechallenge"); + eap_send_failure(esp); + break; +@@ -2017,13 +2425,27 @@ int id; int len; { @@ -2981,7 +3397,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (esp->es_client.ea_timeout > 0) { UNTIMEOUT(eap_client_timeout, (void *)esp); } -@@ -2150,6 +2568,9 @@ +@@ -2149,6 +2571,9 @@ int code, id, len, rtype, vallen; u_char *pstart; u_int32_t uval; @@ -2991,7 +3407,7 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c if (inlen < EAP_HEADERLEN) return (0); -@@ -2214,6 +2635,24 @@ +@@ -2213,6 +2638,24 @@ } break; @@ -3016,7 +3432,21 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_SRP: if (len < 3) goto truncated; -@@ -2325,6 +2764,25 @@ +@@ -2280,10 +2723,10 @@ + if (uval != 0) { + printer(arg, " f<%X>", uval); + } +- if ((vallen = len) > SHA_DIGESTSIZE) +- vallen = SHA_DIGESTSIZE; ++ if ((vallen = len) > SHA_DIGEST_LENGTH) ++ vallen = SHA_DIGEST_LENGTH; + printer(arg, " ", len, inp, +- len < SHA_DIGESTSIZE ? "?" : ""); ++ len < SHA_DIGEST_LENGTH ? "?" : ""); + INCPTR(vallen, inp); + len -= vallen; + if (len > 0) { +@@ -2324,6 +2767,25 @@ } break; @@ -3042,14 +3472,36 @@ diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.c case EAPT_NAK: if (len <= 0) { printer(arg, " "); -@@ -2426,3 +2884,4 @@ +@@ -2387,7 +2849,7 @@ + printer(arg, " f<%X>", uval); + } + printer(arg, " ", len, inp, +- len == SHA_DIGESTSIZE ? "" : "?"); ++ len == SHA_DIGEST_LENGTH ? "" : "?"); + INCPTR(len, inp); + len = 0; + break; +@@ -2397,9 +2859,9 @@ + + case EAPSRP_LWRECHALLENGE: + printer(arg, " ", len, inp, +- len == SHA_DIGESTSIZE ? "" : "?"); +- if ((vallen = len) > SHA_DIGESTSIZE) +- vallen = SHA_DIGESTSIZE; ++ len == SHA_DIGEST_LENGTH ? "" : "?"); ++ if ((vallen = len) > SHA_DIGEST_LENGTH) ++ vallen = SHA_DIGEST_LENGTH; + INCPTR(vallen, inp); + len -= vallen; + break; +@@ -2425,3 +2887,4 @@ return (inp - pstart); } + -diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h ---- ppp-2.4.7/pppd/eap.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h 2018-10-30 16:47:59.537263209 +0100 +diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h +--- ppp-2.4.8/pppd/eap.h 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h 2020-04-03 14:02:19.340905028 +0200 @@ -84,6 +84,16 @@ eapClosed, /* Authentication not in use */ eapListen, /* Client ready (and timer running) */ @@ -3118,44 +3570,9 @@ diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.102/pppd/eap.h #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ -diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.c ---- ppp-2.4.7/pppd/md5.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.c 2018-10-30 16:47:59.538263156 +0100 -@@ -33,6 +33,8 @@ - *********************************************************************** - */ - -+#ifndef USE_EAPTLS -+ - #include - #include "md5.h" - -@@ -305,3 +307,5 @@ - ** End of md5.c ** - ******************************** (cut) ******************************** - */ -+#endif /* USE_EAPTLS */ -+ -diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.h ---- ppp-2.4.7/pppd/md5.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/md5.h 2018-10-30 16:47:59.538263156 +0100 -@@ -36,6 +36,7 @@ - ** documentation and/or software. ** - *********************************************************************** - */ -+#ifndef USE_EAPTLS - - #ifndef __MD5_INCLUDE__ - -@@ -63,3 +64,5 @@ - - #define __MD5_INCLUDE__ - #endif /* __MD5_INCLUDE__ */ -+ -+#endif /* USE_EAPTLS */ -diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames.h ---- ppp-2.4.7/pppd/pathnames.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames.h 2018-10-30 16:47:59.539263095 +0100 +diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames.h +--- ppp-2.4.8/pppd/pathnames.h 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames.h 2020-04-03 14:02:19.340905028 +0200 @@ -21,6 +21,13 @@ #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" @@ -3170,9 +3587,9 @@ diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pathnames #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux ---- ppp-2.4.7/pppd/plugins/Makefile.linux 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/Makefile.linux 2018-10-30 16:47:59.539263095 +0100 +diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/Makefile.linux +--- ppp-2.4.8/pppd/plugins/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/Makefile.linux 2020-04-03 14:02:19.340905028 +0200 @@ -4,6 +4,9 @@ LDFLAGS_SHARED = -shared INSTALL = install @@ -3183,9 +3600,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.102/ppp DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passprompt.c ---- ppp-2.4.7/pppd/plugins/passprompt.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passprompt.c 2018-10-30 16:47:59.540263023 +0100 +diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passprompt.c +--- ppp-2.4.8/pppd/plugins/passprompt.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passprompt.c 2020-04-03 14:02:19.340905028 +0200 @@ -107,4 +107,7 @@ { add_options(options); @@ -3194,9 +3611,9 @@ diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ + eaptls_passwd_hook = promptpass; +#endif } -diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passwordfd.c ---- ppp-2.4.7/pppd/plugins/passwordfd.c 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/plugins/passwordfd.c 2018-10-30 16:47:59.540263023 +0100 +diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passwordfd.c +--- ppp-2.4.8/pppd/plugins/passwordfd.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passwordfd.c 2020-04-03 14:02:19.340905028 +0200 @@ -79,4 +79,8 @@ chap_check_hook = pwfd_check; @@ -3206,10 +3623,21 @@ diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.102/pppd/ + eaptls_passwd_hook = pwfd_passwd; +#endif } -diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 ---- ppp-2.4.7/pppd/pppd.8 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 2018-10-30 16:47:59.542262870 +0100 -@@ -248,6 +248,12 @@ +diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c +--- ppp-2.4.8/pppd/pppcrypt.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c 2020-04-03 14:02:19.340905028 +0200 +@@ -31,6 +31,7 @@ + */ + + #include ++#include + #include "pppd.h" + #include "pppcrypt.h" + +diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 +--- ppp-2.4.8/pppd/pppd.8 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 2020-04-03 14:02:19.341905027 +0200 +@@ -260,6 +260,12 @@ compression in the corresponding direction. Use \fInobsdcomp\fR or \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. .TP @@ -3222,7 +3650,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B cdtrcts Use a non-standard hardware flow control (i.e. DTR/CTS) to control the flow of data on the serial port. If neither the \fIcrtscts\fR, -@@ -259,6 +265,12 @@ +@@ -271,6 +277,12 @@ bi-directional flow control. The sacrifice is that this flow control mode does not permit using DTR as a modem control line. .TP @@ -3235,7 +3663,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B chap\-interval \fIn If this option is given, pppd will rechallenge the peer every \fIn\fR seconds. -@@ -287,6 +299,18 @@ +@@ -299,6 +311,18 @@ 1000 (1 second). This wait period only applies if the \fBconnect\fR or \fBpty\fR option is used. .TP @@ -3254,7 +3682,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B debug Enables connection debugging facilities. If this option is given, pppd will log the contents of all -@@ -551,6 +575,12 @@ +@@ -563,6 +587,12 @@ the kernel are logged by syslog(1) to a file as directed in the /etc/syslog.conf configuration file. .TP @@ -3267,7 +3695,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B ktune Enables pppd to alter kernel settings as appropriate. Under Linux, pppd will enable IP forwarding (i.e. set /proc/sys/net/ipv4/ip_forward -@@ -709,6 +739,9 @@ +@@ -721,6 +751,9 @@ Disable Address/Control compression in both directions (send and receive). .TP @@ -3277,10 +3705,10 @@ diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.8 .B noauth Do not require the peer to authenticate itself. This option is privileged. -diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h ---- ppp-2.4.7/pppd/pppd.h 2014-08-09 14:31:39.000000000 +0200 -+++ ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h 2018-10-30 16:47:59.542262870 +0100 -@@ -325,6 +325,11 @@ +diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h +--- ppp-2.4.8/pppd/pppd.h 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h 2020-04-03 14:02:19.341905027 +0200 +@@ -341,6 +341,11 @@ extern bool dryrun; /* check everything, print options, exit */ extern int child_wait; /* # seconds to wait for children at end */ @@ -3292,7 +3720,7 @@ diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h #ifdef MAXOCTETS extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ extern int maxoctets_dir; /* Direction : -@@ -741,6 +746,10 @@ +@@ -763,6 +768,10 @@ extern int (*chap_passwd_hook) __P((char *user, char *passwd)); extern void (*multilink_join_hook) __P((void)); @@ -3303,3 +3731,94 @@ diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.102/pppd/pppd.h /* Let a plugin snoop sent and received packets. Useful for L2TP */ extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); extern void (*snoop_send_hook) __P((unsigned char *p, int len)); +diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c +--- ppp-2.4.8/pppd/sha1.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c 2020-04-03 14:02:19.341905027 +0200 +@@ -101,7 +101,7 @@ + /* SHA1Init - Initialize new context */ + + void +-SHA1_Init(SHA1_CTX *context) ++SHA1_Init(SHA_CTX *context) + { + /* SHA1 initialization constants */ + context->state[0] = 0x67452301; +@@ -116,7 +116,7 @@ + /* Run your data through this. */ + + void +-SHA1_Update(SHA1_CTX *context, const unsigned char *data, unsigned int len) ++SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len) + { + unsigned int i, j; + +@@ -140,7 +140,7 @@ + /* Add padding and return the message digest. */ + + void +-SHA1_Final(unsigned char digest[20], SHA1_CTX *context) ++SHA1_Final(unsigned char *digest, SHA_CTX *context) + { + u_int32_t i, j; + unsigned char finalcount[8]; +diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h +--- ppp-2.4.8/pppd/sha1.h 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h 2020-04-03 14:02:19.341905027 +0200 +@@ -1,11 +1,5 @@ + /* sha1.h */ + +-/* If OpenSSL is in use, then use that version of SHA-1 */ +-#ifdef OPENSSL +-#include +-#define __SHA1_INCLUDE_ +-#endif +- + #ifndef __SHA1_INCLUDE_ + + #ifndef SHA1_SIGNATURE_SIZE +@@ -20,11 +14,11 @@ + u_int32_t state[5]; + u_int32_t count[2]; + unsigned char buffer[64]; +-} SHA1_CTX; ++} SHA_CTX; + +-extern void SHA1_Init(SHA1_CTX *); +-extern void SHA1_Update(SHA1_CTX *, const unsigned char *, unsigned int); +-extern void SHA1_Final(unsigned char[SHA1_SIGNATURE_SIZE], SHA1_CTX *); ++extern void SHA1_Init(SHA_CTX *context); ++extern void SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len); ++extern void SHA1_Final(unsigned char *data, SHA_CTX *context); + + #define __SHA1_INCLUDE_ + #endif /* __SHA1_INCLUDE_ */ +diff -Naur ppp-2.4.8/pppd/sys-solaris.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sys-solaris.c +--- ppp-2.4.8/pppd/sys-solaris.c 2019-12-31 02:31:26.000000000 +0100 ++++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sys-solaris.c 2020-04-03 14:02:19.342905025 +0200 +@@ -1550,6 +1550,26 @@ + #endif /* defined(INET6) && defined(SOL2) */ + } + ++ ++ ++/* ++ * netif_get_mtu - get the MTU on the PPP network interface. ++ */ ++int ++netif_get_mtu(int unit) ++{ ++ struct ifreq ifr; ++ ++ memset (&ifr, '\0', sizeof (ifr)); ++ strlcpy(ifr.ifr_name, ifname, sizeof (ifr.ifr_name)); ++ ++ if (ioctl(ipfd, SIOCGIFMTU, (caddr_t) &ifr) < 0) { ++ error("ioctl(SIOCGIFMTU): %m (line %d)", __LINE__); ++ return 0; ++ } ++ return ifr.ifr_mtu; ++} ++ + /* + * tty_send_config - configure the transmit characteristics of + * the ppp interface. diff --git a/ppp.spec b/ppp.spec index 9c8f483..320796d 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 3%{?dist} +Release: 4%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -46,7 +46,8 @@ Patch0022: ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patc Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: ppp-2.4.8-eaptls-mppe-1.102.patch +# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.8-eaptls-mppe-1.201.patch +Patch0026: ppp-2.4.8-eaptls-mppe-1.201.patch Patch0032: ppp-2.4.8-CVE-2020-8597.patch @@ -183,6 +184,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Mon Apr 6 2020 Jaroslav Škarvada - 2.4.8-4 +- Updated EAP-TLS patch to v1.201 + * Fri Feb 28 2020 Tom Stellard - 2.4.8-3 - Use make_build macro - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make From e4e647d22e5a59110322c4112fce3eb4f07c8a14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 7 Apr 2020 10:23:05 +0200 Subject: [PATCH 26/76] Updated EAP-TLS patch to v1.300 --- ...patch => ppp-2.4.8-eaptls-mppe-1.300.patch | 432 +++++++++++------- ppp.spec | 9 +- 2 files changed, 284 insertions(+), 157 deletions(-) rename ppp-2.4.8-eaptls-mppe-1.201.patch => ppp-2.4.8-eaptls-mppe-1.300.patch (90%) diff --git a/ppp-2.4.8-eaptls-mppe-1.201.patch b/ppp-2.4.8-eaptls-mppe-1.300.patch similarity index 90% rename from ppp-2.4.8-eaptls-mppe-1.201.patch rename to ppp-2.4.8-eaptls-mppe-1.300.patch index ca3e872..65b1434 100644 --- a/ppp-2.4.8-eaptls-mppe-1.201.patch +++ b/ppp-2.4.8-eaptls-mppe-1.300.patch @@ -1,7 +1,7 @@ -diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls +diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.300/README.eap-tls --- ppp-2.4.8/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls 2020-04-03 14:02:19.334905035 +0200 -@@ -0,0 +1,301 @@ ++++ ppp-2.4.8-eaptls-mppe-1.300/README.eap-tls 2020-04-07 10:09:50.565118206 +0200 +@@ -0,0 +1,307 @@ +EAP-TLS authentication support for PPP +====================================== + @@ -296,16 +296,22 @@ diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.201/README.eap-tls +v1.200 (28-Feb-2020) + - First version of patch that was used to create a github PR against the main ppp code base. + - Add client-side 'capath' option to allow a directory with trusted CA certificates. -+ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or ++ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or + use the ones supplied by OpenSSL. + - Code now also builds on Solaris (x86 tested) but has not been tested yet, as the Solaris ppp + kernel driver does not support MPPE. +v1.201 (03-Apr-2020) + - Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that + you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation. -diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-client ++v1.300 (03-Apr-2020) ++ - Add (experimental) TLS 1.3 support. This is based on draft-ietf-emu-eap-tls13-05 (expired) and ++ requires OpenSSL 1.1.1+ to be effective. ++ - Add new option 'max-tls-version' to specify the highest version of the TLS protocol to use ++ (defaults to TLS1.2 for now - so to use TLS1.3 you need to explicitly add 'max-tls-version 1.3') ++ +diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-client --- ppp-2.4.8/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-client 2020-04-03 14:02:19.334905035 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-client 2020-04-07 10:09:50.566118204 +0200 @@ -0,0 +1,10 @@ +# Parameters for authentication using EAP-TLS (client) + @@ -317,9 +323,9 @@ diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/e +# client private key file (required) + +#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-server +diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-server --- ppp-2.4.8/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/eaptls-server 2020-04-03 14:02:19.334905035 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-server 2020-04-07 10:09:50.566118204 +0200 @@ -0,0 +1,11 @@ +# Parameters for authentication using EAP-TLS (server) + @@ -332,9 +338,9 @@ diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/e +# allowed addresses (required, can be *) + +#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/openssl.cnf +diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/openssl.cnf --- ppp-2.4.8/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/openssl.cnf 2020-04-03 14:02:19.334905035 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/openssl.cnf 2020-04-07 10:09:50.566118204 +0200 @@ -0,0 +1,14 @@ +openssl_conf = openssl_def + @@ -350,9 +356,9 @@ diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.201/etc.ppp/ope +MODULE_PATH = /usr/lib64/libeTPkcs11.so +init = 0 + -diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.201/linux/Makefile.top +diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.300/linux/Makefile.top --- ppp-2.4.8/linux/Makefile.top 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/linux/Makefile.top 2020-04-03 14:02:19.334905035 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/linux/Makefile.top 2020-04-07 10:09:50.566118204 +0200 @@ -26,7 +26,7 @@ cd pppdump; $(MAKE) $(MFLAGS) install @@ -373,9 +379,9 @@ diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.201/linux/Makefi $(BINDIR): $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.linux +diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.linux --- ppp-2.4.8/pppd/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.linux 2020-04-03 14:02:19.335905034 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.linux 2020-04-07 10:10:01.427104384 +0200 @@ -11,16 +11,16 @@ TARGETS = pppd @@ -458,9 +464,9 @@ diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefi HEADERS += sha1.h PPPDOBJS += sha1.o endif -diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.sol2 +diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.sol2 --- ppp-2.4.8/pppd/Makefile.sol2 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefile.sol2 2020-04-03 14:02:19.335905034 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.sol2 2020-04-07 10:09:50.566118204 +0200 @@ -5,10 +5,10 @@ include ../Makedefs.com @@ -497,9 +503,9 @@ diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.201/pppd/Makefil # Uncomment for CBCP #CFLAGS += -DCBCP_SUPPORT -diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c +diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.300/pppd/auth.c --- ppp-2.4.8/pppd/auth.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c 2020-04-03 14:02:19.337905032 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/auth.c 2020-04-07 10:09:50.567118203 +0200 @@ -113,6 +113,9 @@ #include "upap.h" #include "chap-new.h" @@ -522,7 +528,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c /* Hook for a plugin to say whether it is OK if the peer refuses to authenticate. */ int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -241,6 +249,15 @@ +@@ -241,6 +249,16 @@ bool explicit_user = 0; /* Set if "user" option supplied */ bool explicit_passwd = 0; /* Set if "password" option supplied */ char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ @@ -533,12 +539,13 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c +char *privkey_file = NULL; /* client private key file (pem format) */ +char *crl_dir = NULL; /* directory containing CRL files */ +char *crl_file = NULL; /* Certificate Revocation List (CRL) file (pem format) */ ++char *max_tls_version = NULL; /* Maximum TLS protocol version (default=1.2) */ +bool need_peer_eap = 0; /* Require peer to authenticate us */ +#endif static char *uafname; /* name of most recent +ua file */ -@@ -257,6 +274,19 @@ +@@ -257,6 +275,19 @@ static int have_chap_secret __P((char *, char *, int, int *)); static int have_srp_secret __P((char *client, char *server, int need_ip, int *lacks_ipp)); @@ -558,7 +565,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); static int scan_authfile __P((FILE *, char *, char *, char *, struct wordlist **, struct wordlist **, -@@ -404,6 +434,16 @@ +@@ -404,6 +435,18 @@ "Set telephone number(s) which are allowed to connect", OPT_PRIV | OPT_A2LIST }, @@ -569,13 +576,15 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c + { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, + { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, + { "crl", o_string, &crl_file, "Use specific CRL file" }, ++ { "max-tls-version", o_string, &max_tls_version, ++ "Maximum TLS version (1.0/1.1/1.2 (default)/1.3)" }, + { "need-peer-eap", o_bool, &need_peer_eap, + "Require the peer to authenticate us", 1 }, +#endif /* USE_EAPTLS */ { NULL } }; -@@ -737,6 +777,9 @@ +@@ -737,6 +780,9 @@ lcp_options *wo = &lcp_wantoptions[unit]; lcp_options *go = &lcp_gotoptions[unit]; lcp_options *ho = &lcp_hisoptions[unit]; @@ -585,7 +594,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c int i; struct protent *protp; -@@ -771,6 +814,22 @@ +@@ -771,6 +817,22 @@ } } @@ -608,7 +617,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c new_phase(PHASE_AUTHENTICATE); auth = 0; if (go->neg_eap) { -@@ -1291,6 +1350,15 @@ +@@ -1291,6 +1353,15 @@ our_name, 1, &lacks_ip); } @@ -624,7 +633,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c if (auth_required && !can_auth && noauth_addrs == NULL) { if (default_auth) { option_error( -@@ -1345,7 +1413,11 @@ +@@ -1345,7 +1416,11 @@ passwd[0] != 0 || (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, (explicit_remote? remote_name: NULL), 0, NULL))) || @@ -637,7 +646,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c hadchap = -1; if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1360,8 +1432,14 @@ +@@ -1360,8 +1435,14 @@ !have_chap_secret((explicit_remote? remote_name: NULL), our_name, 1, NULL))) && !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, @@ -653,7 +662,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c } -@@ -1721,6 +1799,7 @@ +@@ -1721,6 +1802,7 @@ } @@ -661,7 +670,7 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c /* * get_secret - open the CHAP secret file and return the secret * for authenticating the given client on the given server. -@@ -2373,3 +2452,345 @@ +@@ -2373,3 +2455,345 @@ auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); } @@ -1007,9 +1016,9 @@ diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.201/pppd/auth.c +} +#endif + -diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c +diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.300/pppd/ccp.c --- ppp-2.4.8/pppd/ccp.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c 2020-04-03 14:02:19.337905032 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/ccp.c 2020-04-07 10:09:50.567118203 +0200 @@ -539,6 +539,9 @@ if (go->mppe) { ccp_options *ao = &ccp_allowoptions[f->unit]; @@ -1045,9 +1054,9 @@ diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ccp.c lcp_close(f->unit, "MPPE required but not available"); return; } -diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c +diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.300/pppd/chap-md5.c --- ppp-2.4.8/pppd/chap-md5.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c 2020-04-03 14:02:19.337905032 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/chap-md5.c 2020-04-07 10:09:50.567118203 +0200 @@ -36,7 +36,11 @@ #include "chap-new.h" #include "chap-md5.h" @@ -1060,9 +1069,9 @@ diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap-md5.c #define MD5_HASH_SIZE 16 #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c +diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.300/pppd/chap_ms.c --- ppp-2.4.8/pppd/chap_ms.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c 2020-04-03 14:02:19.338905030 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/chap_ms.c 2020-04-07 10:09:50.567118203 +0200 @@ -534,7 +534,7 @@ char *username, u_char Challenge[8]) @@ -1099,10 +1108,10 @@ diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.201/pppd/chap_ms.c u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ -diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.c --- ppp-2.4.8/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c 2020-04-03 14:02:19.338905030 +0200 -@@ -0,0 +1,1442 @@ ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.c 2020-04-07 10:09:50.568118202 +0200 +@@ -0,0 +1,1560 @@ +/* * eap-tls.c - EAP-TLS implementation for PPP + * + * Copyright (c) Beniamino Galvani 2005 All rights reserved. @@ -1154,11 +1163,32 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +#include "lcp.h" +#include "pathnames.h" + ++typedef struct pw_cb_data ++{ ++ const void *password; ++ const char *prompt_info; ++} PW_CB_DATA; ++ +/* The openssl configuration file and engines can be loaded only once */ +static CONF *ssl_config = NULL; +static ENGINE *cert_engine = NULL; +static ENGINE *pkey_engine = NULL; + ++/* TLSv1.3 do we have a session ticket ? */ ++static int have_session_ticket = 0; ++ ++int ssl_verify_callback(int, X509_STORE_CTX *); ++void ssl_msg_callback(int write_p, int version, int ct, const void *buf, ++ size_t len, SSL * ssl, void *arg); ++int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); ++ ++X509 *get_X509_from_file(char *filename); ++int ssl_cmp_certs(char *filename, X509 * a); ++ ++#ifdef MPPE ++ ++#define EAPTLS_MPPE_KEY_LEN 32 ++ +/* + * The following stuff is only needed if SSL_export_keying_material() is not available + */ @@ -1363,21 +1393,35 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + + -+#ifdef MPPE -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ +/* + * Generate keys according to RFC 2716 and add to reply + */ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, -+ int client) ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) +{ + unsigned char out[4*EAPTLS_MPPE_KEY_LEN]; -+ size_t prf_size = strlen(prf_label); ++ const char *prf_label; ++ size_t prf_size; ++ unsigned char eap_tls13_context[] = { EAPT_TLS }; ++ unsigned char *context = NULL; ++ size_t context_len = 0; + unsigned char *p; + -+ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, NULL, 0, 0) != 1) ++ dbglog("EAP-TLS generating MPPE keys"); ++ if (ets->tls_v13) ++ { ++ prf_label = "EXPORTER_EAP_TLS_Key_Material"; ++ context = eap_tls13_context; ++ context_len = 1; ++ } ++ else ++ { ++ prf_label = "client EAP encryption"; ++ } ++ ++ dbglog("EAP-TLS PRF label = %s", prf_label); ++ prf_size = strlen(prf_label); ++ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, ++ context, context_len, 0) != 1) + { + warn( "EAP-TLS: Failed generating keying material" ); + return; @@ -1525,13 +1569,13 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + X509_STORE *certstore; + X509_LOOKUP *lookup; + X509 *tmp; -+ int ret; ++ int ret; +#if defined(TLS1_2_VERSION) -+ long tls_version = TLS1_2_VERSION; ++ long tls_version = TLS1_2_VERSION; +#elif defined(TLS1_1_VERSION) -+ long tls_version = TLS1_1_VERSION; ++ long tls_version = TLS1_1_VERSION; +#else -+ long tls_version = TLS1_VERSION; ++ long tls_version = TLS1_VERSION; +#endif + + /* @@ -1781,8 +1825,51 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c +#endif + ); + -+ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); -+ SSL_CTX_set_max_proto_version(ctx, tls_version); ++ /* OpenSSL 1.1.1+ does not include RC4 ciphers by default. ++ * This causes totally obsolete WinXP clients to fail. If you really ++ * need ppp+EAP-TLS+openssl 1.1.1+WinXP then enable RC4 cipers and ++ * make sure that you use an OpenSSL that supports them ++ ++ SSL_CTX_set_cipher_list(ctx, "RC4"); ++ */ ++ ++ ++ /* Set up a SSL Session cache with a callback. This is needed for TLSv1.3+. ++ * During the initial handshake the server signals to the client early on ++ * that the handshake is finished, even before the client has sent its ++ * credentials to the server. The actual connection (and moment that the ++ * client sends its credentials) only starts after the arrival of the first ++ * session ticket. The 'ssl_new_session_cb' catches this ticket. ++ */ ++ SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL_STORE); ++ SSL_CTX_sess_set_new_cb(ctx, ssl_new_session_cb); ++ ++ /* As EAP-TLS+TLSv1.3 is highly experimental we offer the user a chance to override */ ++ if (max_tls_version) ++ { ++ if (strncmp(max_tls_version, "1.0", 3) == 0) ++ tls_version = TLS1_VERSION; ++ else if (strncmp(max_tls_version, "1.1", 3) == 0) ++ tls_version = TLS1_1_VERSION; ++ else if (strncmp(max_tls_version, "1.2", 3) == 0) ++#ifdef TLS1_2_VERSION ++ tls_version = TLS1_2_VERSION; ++#else ++ { ++ warn("TLSv1.2 not available. Defaulting to TLSv1.1"); ++ tls_version = TLS_1_1_VERSION; ++ } ++#endif ++ else if (strncmp(max_tls_version, "1.3", 3) == 0) ++#ifdef TLS1_3_VERSION ++ tls_version = TLS1_3_VERSION; ++#else ++ warn("TLSv1.3 not available."); ++#endif ++ } ++ ++ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); ++ SSL_CTX_set_max_proto_version(ctx, tls_version); + + SSL_CTX_set_verify_depth(ctx, 5); + SSL_CTX_set_verify(ctx, @@ -1944,6 +2031,8 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + + SSL_set_accept_state(ets->ssl); + ++ ets->tls_v13 = 0; ++ + ets->data = NULL; + ets->datalen = 0; + ets->alert_sent = 0; @@ -2034,6 +2123,8 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + + SSL_set_connect_state(ets->ssl); + ++ ets->tls_v13 = 0; ++ + ets->data = NULL; + ets->datalen = 0; + ets->alert_sent = 0; @@ -2069,6 +2160,20 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + free(ets); +} + ++ ++int eaptls_is_init_finished(struct eaptls_session *ets) ++{ ++ if (ets->ssl && SSL_is_init_finished(ets->ssl)) ++ { ++ if (ets->tls_v13) ++ return have_session_ticket; ++ else ++ return 1; ++ } ++ ++ return 0; ++} ++ +/* + * Handle a received packet, reassembling fragmented messages and + * passing them to the ssl engine @@ -2189,10 +2294,12 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + + start = *outp; + -+ if (!ets->data) { -+ ++ if (!ets->data) ++ { + if(!ets->alert_sent) -+ SSL_read(ets->ssl, fromtls, 65536); ++ { ++ res = SSL_read(ets->ssl, fromtls, 65536); ++ } + + /* + * Read from ssl @@ -2435,7 +2542,7 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + strcat(string, "TLS 1.2"); + break; + default: -+ strcat(string, "Unknown version"); ++ sprintf(string, "SSL/TLS Header: Unknown version (%d)", hvers); + } + break; + @@ -2459,9 +2566,9 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + break; + +#ifdef SSL3_RT_INNER_CONTENT_TYPE -+ case SSL3_RT_INNER_CONTENT_TYPE: -+ strcat(string, "InnerContentType (TLS1.3)"); -+ break; ++ case SSL3_RT_INNER_CONTENT_TYPE: ++ strcat(string, "InnerContentType (TLS1.3)"); ++ break; +#endif + + case SSL3_RT_HANDSHAKE: @@ -2484,6 +2591,16 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + strcat(string,"New Session Ticket"); + break; +#endif ++#ifdef SSL3_MT_END_OF_EARLY_DATA ++ case SSL3_MT_END_OF_EARLY_DATA: ++ strcat(string,"End of Early Data"); ++ break; ++#endif ++#ifdef SSL3_MT_ENCRYPTED_EXTENSIONS ++ case SSL3_MT_ENCRYPTED_EXTENSIONS: ++ strcat(string,"Encryped Extensions"); ++ break; ++#endif + case SSL3_MT_CERTIFICATE: + strcat(string,"Certificate"); + break; @@ -2519,11 +2636,11 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + strcat(string, "TLS 1.2"); + break; +#ifdef TLS1_3_VERSION -+ case TLS1_3_VERSION: -+ strcat(string, "TLS 1.3 (not supported)"); -+ break; ++ case TLS1_3_VERSION: ++ strcat(string, "TLS 1.3 (experimental)"); ++ ets->tls_v13 = 1; ++ break; +#endif -+ + default: + strcat(string, "Unknown version"); + } @@ -2545,10 +2662,20 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.c + dbglog("%s", string); +} + -diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h ++int ++ssl_new_session_cb(SSL *s, SSL_SESSION *sess) ++{ ++ dbglog("EAP-TLS: Post-Handshake New Session Ticket arrived:"); ++ have_session_ticket = 1; ++ ++ /* always return success */ ++ return 1; ++} ++ +diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.h --- ppp-2.4.8/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h 2020-04-03 14:02:19.338905030 +0200 -@@ -0,0 +1,107 @@ ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.h 2020-04-07 10:09:50.568118202 +0200 +@@ -0,0 +1,96 @@ +/* + * eap-tls.h + * @@ -2599,11 +2726,12 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h +{ + u_char *data; /* buffered data */ + int datalen; /* buffered data len */ -+ int offset; /* from where to send */ -+ int tlslen; /* total length of tls data */ -+ bool frag; /* packet is fragmented */ ++ int offset; /* from where to send */ ++ int tlslen; /* total length of tls data */ ++ bool frag; /* packet is fragmented */ ++ bool tls_v13; /* whether we've negotiated TLSv1.3 */ + SSL_CTX *ctx; -+ SSL *ssl; /* ssl connection */ ++ SSL *ssl; /* ssl connection */ + BIO *from_ssl; + BIO *into_ssl; + char peer[MAXWORDLEN]; /* peer name */ @@ -2612,24 +2740,11 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h + u_char alert_sent_desc; + bool alert_recv; + u_char alert_recv_desc; -+ char rtx[65536]; /* retransmission buffer */ ++ char rtx[EAP_TLS_MAX_LEN]; /* retransmission buffer */ + int rtx_len; + int mtu; /* unit mtu */ +}; + -+typedef struct pw_cb_data -+{ -+ const void *password; -+ const char *prompt_info; -+} PW_CB_DATA; -+ -+ -+int ssl_verify_callback(int, X509_STORE_CTX *); -+void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -+ size_t len, SSL * ssl, void *arg); -+ -+X509 *get_X509_from_file(char *filename); -+int ssl_cmp_certs(char *filename, X509 * a); + +SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, + char *certfile, char *peer_certfile, char *privkeyfile); @@ -2637,6 +2752,8 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h +int eaptls_init_ssl_client(eap_state * esp); +void eaptls_free_session(struct eaptls_session *ets); + ++int eaptls_is_init_finished(struct eaptls_session *ets); ++ +int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); +int eaptls_send(struct eaptls_session *ets, u_char ** outp); +void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); @@ -2651,14 +2768,13 @@ diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap-tls.h +extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +extern int mppe_keys_set; + -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); -+ ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); +#endif + +#endif -diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c +diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.c --- ppp-2.4.8/pppd/eap.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c 2020-04-03 14:02:19.339905029 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.c 2020-04-07 10:09:50.569118201 +0200 @@ -43,6 +43,11 @@ * Based on draft-ietf-pppext-eap-srp-03.txt. */ @@ -2738,7 +2854,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c switch (esp->es_server.ea_state) { case eapBadAuth: return; -@@ -561,9 +585,79 @@ +@@ -561,9 +585,81 @@ break; } #endif /* USE_SRP */ @@ -2794,18 +2910,20 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + if(SSL_is_init_finished(ets->ssl)) + esp->es_server.ea_state = eapTlsRecvClient; + else -+ esp->es_server.ea_state = eapTlsRecv; ++ /* JJK Add "TLS empty record" message here ??? */ ++ esp->es_server.ea_state = eapTlsRecv; + break; + + case eapTlsSendAck: -+ esp->es_server.ea_state = eapTlsRecv; ++ esp->es_server.ea_state = eapTlsRecv; + break; + + case eapTlsRecvAck: -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } ++ if (status) ++ { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } + + esp->es_server.ea_state = eapTlsSend; + break; @@ -2818,7 +2936,18 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c case eapSRP1: #ifdef USE_SRP ts = (struct t_server *)esp->es_server.ea_session; -@@ -647,10 +741,10 @@ +@@ -629,6 +725,10 @@ + } + if (esp->es_server.ea_state == eapBadAuth) + eap_send_failure(esp); ++ ++#ifdef USE_EAPTLS ++ dbglog("EAP id=0x%2x '%s' -> '%s'", esp->es_server.ea_id, eap_state_name(esp->es_server.ea_prev_state), eap_state_name(esp->es_server.ea_state)); ++#endif /* USE_EAPTLS */ + } + + /* +@@ -647,10 +747,10 @@ char *str; #ifdef USE_SRP struct t_server *ts; @@ -2831,7 +2960,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c #endif /* USE_SRP */ /* Handle both initial auth and restart */ -@@ -717,6 +811,30 @@ +@@ -717,6 +817,30 @@ INCPTR(esp->es_server.ea_namelen, outp); break; @@ -2862,7 +2991,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c #ifdef USE_SRP case eapSRP1: PUTCHAR(EAPT_SRP, outp); -@@ -763,8 +881,8 @@ +@@ -763,8 +887,8 @@ PUTLONG(SRPVAL_EBIT, outp); ts = (struct t_server *)esp->es_server.ea_session; assert(ts != NULL); @@ -2873,7 +3002,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c if (pncrypt_setkey(0)) { /* Generate pseudonym */ -@@ -804,9 +922,9 @@ +@@ -804,9 +928,9 @@ /* Set length and pad out to next 20 octet boundary */ i = outp - optr - 1; *optr = i; @@ -2885,7 +3014,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c *outp++ = drand48() * 0x100; i++; } -@@ -822,14 +940,14 @@ +@@ -822,14 +946,14 @@ while (optr < outp) { SHA1Final(dig, &ctxt); cp = dig; @@ -2903,7 +3032,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c } } break; -@@ -903,11 +1021,57 @@ +@@ -903,11 +1027,57 @@ eap_server_timeout(arg) void *arg; { @@ -2961,7 +3090,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c /* EAP ID number must not change on timeout. */ eap_send_request(esp); } -@@ -1154,17 +1318,92 @@ +@@ -1154,17 +1324,90 @@ PUTCHAR(id, outp); esp->es_client.ea_id = id; msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) + @@ -2987,16 +3116,16 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c +eap_state *esp; +u_char id; +{ -+ u_char *outp; -+ int outlen; ++ u_char *outp; ++ int outlen; + u_char *lenloc; + -+ outp = outpacket_buf; ++ outp = outpacket_buf; + -+ MAKEHEADER(outp, PPP_EAP); ++ MAKEHEADER(outp, PPP_EAP); + -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); ++ PUTCHAR(EAP_RESPONSE, outp); ++ PUTCHAR(id, outp); + + lenloc = outp; + INCPTR(2, outp); @@ -3016,7 +3145,6 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); + + esp->es_client.ea_id = id; -+ +} + +/* @@ -3049,14 +3177,13 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + PUTSHORT(outlen, lenloc); + + output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ +} +#endif /* USE_EAPTLS */ + static void eap_send_nak(esp, id, type) eap_state *esp; -@@ -1251,8 +1490,8 @@ +@@ -1251,8 +1494,8 @@ { u_char val; u_char *datp, *digp; @@ -3067,7 +3194,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c int dsize, fd, olen = len; /* -@@ -1261,21 +1500,21 @@ +@@ -1261,21 +1504,21 @@ */ val = id; while (len > 0) { @@ -3093,7 +3220,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c *datp++ ^= *digp; } -@@ -1319,12 +1558,17 @@ +@@ -1319,12 +1562,17 @@ char rhostname[256]; MD5_CTX mdContext; u_char hash[MD5_SIGNATURE_SIZE]; @@ -3113,7 +3240,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c int fd; #endif /* USE_SRP */ -@@ -1455,6 +1699,100 @@ +@@ -1455,6 +1703,96 @@ esp->es_client.ea_namelen); break; @@ -3134,11 +3261,11 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + + esp->es_client.ea_using_eaptls = 1; + -+ if (explicit_remote){ -+ esp->es_client.ea_peer = strdup(remote_name); -+ esp->es_client.ea_peerlen = strlen(remote_name); -+ } else -+ esp->es_client.ea_peer = NULL; ++ if (explicit_remote){ ++ esp->es_client.ea_peer = strdup(remote_name); ++ esp->es_client.ea_peerlen = strlen(remote_name); ++ } else ++ esp->es_client.ea_peer = NULL; + + /* Init ssl session */ + if(!eaptls_init_ssl_client(esp)) { @@ -3150,8 +3277,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + + ets = esp->es_client.ea_session; + eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); + break; + } + @@ -3161,8 +3287,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + + case eapTlsRecvAck: + eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); + break; + + case eapTlsRecv: @@ -3186,9 +3311,9 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + } + + /* Check if TLS handshake is finished */ -+ if(SSL_is_init_finished(ets->ssl)){ ++ if(eaptls_is_init_finished(ets)) { +#ifdef MPPE -+ eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); ++ eaptls_gen_mppe_keys(ets, 1); +#endif + eaptls_free_session(ets); + eap_tls_sendack(esp, id); @@ -3197,10 +3322,8 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + } + + eap_tls_response(esp,id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ -+ break; ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); ++ break; + + default: + eap_send_nak(esp, id, EAPT_TLS); @@ -3270,6 +3393,7 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + case eapTlsRecv: + + ets = (struct eaptls_session *) esp->es_server.ea_session; ++ + eap_figure_next_state(esp, + eaptls_receive(esp->es_server.ea_session, inp, len)); + @@ -3288,13 +3412,12 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c + + case eapTlsRecvClient: + /* Receive authentication response from client */ -+ + if (len > 0) { + GETCHAR(flags, inp); + + if(len == 1 && !flags) { /* Ack = ok */ +#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); ++ eaptls_gen_mppe_keys( esp->es_server.ea_session, 0 ); +#endif + eap_send_success(esp); + } @@ -3499,9 +3622,9 @@ diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.c return (inp - pstart); } + -diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h +diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.h --- ppp-2.4.8/pppd/eap.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.h 2020-04-07 10:09:50.569118201 +0200 @@ -84,6 +84,16 @@ eapClosed, /* Authentication not in use */ eapListen, /* Client ready (and timer running) */ @@ -3570,9 +3693,9 @@ diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.201/pppd/eap.h #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ -diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames.h +diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.300/pppd/pathnames.h --- ppp-2.4.8/pppd/pathnames.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames.h 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pathnames.h 2020-04-07 10:09:50.569118201 +0200 @@ -21,6 +21,13 @@ #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" @@ -3587,9 +3710,9 @@ diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pathnames #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/Makefile.linux +diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/Makefile.linux --- ppp-2.4.8/pppd/plugins/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/Makefile.linux 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/Makefile.linux 2020-04-07 10:09:50.569118201 +0200 @@ -4,6 +4,9 @@ LDFLAGS_SHARED = -shared INSTALL = install @@ -3600,9 +3723,9 @@ diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.201/ppp DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passprompt.c +diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passprompt.c --- ppp-2.4.8/pppd/plugins/passprompt.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passprompt.c 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passprompt.c 2020-04-07 10:09:50.569118201 +0200 @@ -107,4 +107,7 @@ { add_options(options); @@ -3611,9 +3734,9 @@ diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ + eaptls_passwd_hook = promptpass; +#endif } -diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passwordfd.c +diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passwordfd.c --- ppp-2.4.8/pppd/plugins/passwordfd.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/plugins/passwordfd.c 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passwordfd.c 2020-04-07 10:09:50.569118201 +0200 @@ -79,4 +79,8 @@ chap_check_hook = pwfd_check; @@ -3623,9 +3746,9 @@ diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.201/pppd/ + eaptls_passwd_hook = pwfd_passwd; +#endif } -diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c +diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.300/pppd/pppcrypt.c --- ppp-2.4.8/pppd/pppcrypt.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c 2020-04-03 14:02:19.340905028 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppcrypt.c 2020-04-07 10:09:50.569118201 +0200 @@ -31,6 +31,7 @@ */ @@ -3634,9 +3757,9 @@ diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.201/pppd/pppcrypt.c #include "pppd.h" #include "pppcrypt.h" -diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 +diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.8 --- ppp-2.4.8/pppd/pppd.8 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 2020-04-03 14:02:19.341905027 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.8 2020-04-07 10:09:50.570118199 +0200 @@ -260,6 +260,12 @@ compression in the corresponding direction. Use \fInobsdcomp\fR or \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. @@ -3705,22 +3828,23 @@ diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.8 .B noauth Do not require the peer to authenticate itself. This option is privileged. -diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h +diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.h --- ppp-2.4.8/pppd/pppd.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h 2020-04-03 14:02:19.341905027 +0200 -@@ -341,6 +341,11 @@ ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.h 2020-04-07 10:09:50.570118199 +0200 +@@ -341,6 +341,12 @@ extern bool dryrun; /* check everything, print options, exit */ extern int child_wait; /* # seconds to wait for children at end */ +#ifdef USE_EAPTLS +extern char *crl_dir; +extern char *crl_file; ++extern char *max_tls_version; +#endif /* USE_EAPTLS */ + #ifdef MAXOCTETS extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ extern int maxoctets_dir; /* Direction : -@@ -763,6 +768,10 @@ +@@ -763,6 +769,10 @@ extern int (*chap_passwd_hook) __P((char *user, char *passwd)); extern void (*multilink_join_hook) __P((void)); @@ -3731,9 +3855,9 @@ diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.201/pppd/pppd.h /* Let a plugin snoop sent and received packets. Useful for L2TP */ extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); extern void (*snoop_send_hook) __P((unsigned char *p, int len)); -diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c +diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.c --- ppp-2.4.8/pppd/sha1.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c 2020-04-03 14:02:19.341905027 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.c 2020-04-07 10:09:50.570118199 +0200 @@ -101,7 +101,7 @@ /* SHA1Init - Initialize new context */ @@ -3761,9 +3885,9 @@ diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.c { u_int32_t i, j; unsigned char finalcount[8]; -diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h +diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.h --- ppp-2.4.8/pppd/sha1.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h 2020-04-03 14:02:19.341905027 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.h 2020-04-07 10:09:50.570118199 +0200 @@ -1,11 +1,5 @@ /* sha1.h */ @@ -3792,9 +3916,9 @@ diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.201/pppd/sha1.h #define __SHA1_INCLUDE_ #endif /* __SHA1_INCLUDE_ */ -diff -Naur ppp-2.4.8/pppd/sys-solaris.c ppp-2.4.8-eaptls-mppe-1.201/pppd/sys-solaris.c +diff -Naur ppp-2.4.8/pppd/sys-solaris.c ppp-2.4.8-eaptls-mppe-1.300/pppd/sys-solaris.c --- ppp-2.4.8/pppd/sys-solaris.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.201/pppd/sys-solaris.c 2020-04-03 14:02:19.342905025 +0200 ++++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sys-solaris.c 2020-04-07 10:09:50.571118198 +0200 @@ -1550,6 +1550,26 @@ #endif /* defined(INET6) && defined(SOL2) */ } diff --git a/ppp.spec b/ppp.spec index 320796d..42eb0e7 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 4%{?dist} +Release: 5%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -46,8 +46,8 @@ Patch0022: ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patc Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch -# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.8-eaptls-mppe-1.201.patch -Patch0026: ppp-2.4.8-eaptls-mppe-1.201.patch +# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.8-eaptls-mppe-1.300.patch +Patch0026: ppp-2.4.8-eaptls-mppe-1.300.patch Patch0032: ppp-2.4.8-CVE-2020-8597.patch @@ -184,6 +184,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Tue Apr 7 2020 Jaroslav Škarvada - 2.4.8-5 +- Updated EAP-TLS patch to v1.300 + * Mon Apr 6 2020 Jaroslav Škarvada - 2.4.8-4 - Updated EAP-TLS patch to v1.201 From 568dc9d422eb69cd289098028efe6a60b54a7540 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Thu, 21 May 2020 20:03:30 +0200 Subject: [PATCH 27/76] Added missing options to man pages --- ppp-2.4.8-man-fix.patch | 46 +++++++++++++++++++++++++++++++++++++++++ ppp.spec | 7 ++++++- 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.8-man-fix.patch diff --git a/ppp-2.4.8-man-fix.patch b/ppp-2.4.8-man-fix.patch new file mode 100644 index 0000000..4ecf1f5 --- /dev/null +++ b/ppp-2.4.8-man-fix.patch @@ -0,0 +1,46 @@ +diff --git a/pppdump/pppdump.8 b/pppdump/pppdump.8 +index 4072e68..1116b85 100644 +--- a/pppdump/pppdump.8 ++++ b/pppdump/pppdump.8 +@@ -13,6 +13,8 @@ pppdump \- convert PPP record file to readable format + ]] [ + .B \-r + ] [ ++.B \-a ++] [ + .B \-m \fImru + ] [ + .I file \fR... +@@ -54,6 +56,9 @@ Reverses the direction indicators, so that `sent' is printed for + bytes or packets received, and `rcvd' is printed for bytes or packets + sent. + .TP ++.B \-a ++Prints absolute times. ++.TP + .B \-m \fImru + Use \fImru\fR as the MRU (maximum receive unit) for both directions of + the link when checking for over-length PPP packets (with the \fB\-p\fR +diff --git a/pppstats/pppstats.8 b/pppstats/pppstats.8 +index 4ac101e..cabf4d7 100644 +--- a/pppstats/pppstats.8 ++++ b/pppstats/pppstats.8 +@@ -7,6 +7,8 @@ pppstats \- print PPP statistics + [ + .B \-a + ] [ ++.B \-d ++] [ + .B \-v + ] [ + .B \-r +@@ -41,6 +43,9 @@ reports show statistics for the time since the link was initiated. + Without this option, the second and subsequent reports show statistics + for the time since the last report. + .TP ++.B \-d ++Show data rate (kB/s) instead of bytes. ++.TP + .B \-c \fIcount + Repeat the display + .I count diff --git a/ppp.spec b/ppp.spec index 42eb0e7..51e577f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 5%{?dist} +Release: 6%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -50,6 +50,8 @@ Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patc Patch0026: ppp-2.4.8-eaptls-mppe-1.300.patch Patch0032: ppp-2.4.8-CVE-2020-8597.patch +# rhbz#1612918, https://github.com/paulusmack/ppp/pull/149 +Patch0033: ppp-2.4.8-man-fix.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -184,6 +186,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Thu May 21 2020 Jaroslav Škarvada - 2.4.8-6 +- Added missing options to man pages + * Tue Apr 7 2020 Jaroslav Škarvada - 2.4.8-5 - Updated EAP-TLS patch to v1.300 From 22365d4cf2dfb4afdb38ad3ae46b98bbf35adf3e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 22:56:17 +0000 Subject: [PATCH 28/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 51e577f..5c006f5 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 6%{?dist} +Release: 7%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -186,6 +186,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 2.4.8-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Thu May 21 2020 Jaroslav Škarvada - 2.4.8-6 - Added missing options to man pages From a9d0d03ee8d59233b76365dfb4cb0e345e8eaf70 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 10 Aug 2020 19:51:14 +0200 Subject: [PATCH 29/76] Added workaround for Windows Server 2019 Resolves: rhbz#1867047 --- ppp-2.4.8-ws-2019-workaround.patch | 27 +++++++++++++++++++++++++++ ppp.spec | 8 +++++++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.8-ws-2019-workaround.patch diff --git a/ppp-2.4.8-ws-2019-workaround.patch b/ppp-2.4.8-ws-2019-workaround.patch new file mode 100644 index 0000000..837a206 --- /dev/null +++ b/ppp-2.4.8-ws-2019-workaround.patch @@ -0,0 +1,27 @@ +From 3cd95baf3f1de1d5a9bc89be0f4c3215ceb5aefe Mon Sep 17 00:00:00 2001 +From: yannayl +Date: Sun, 12 Jul 2020 12:12:08 +0300 +Subject: [PATCH] Accept Malformed Windows Success Message + +Windows Server 2019 skip a space when sending a success message. +This commit accepts such a malformed message and continues normally. + +Signed-off-by: Yannay Linveh +Signed-off-by: yannayl +--- + pppd/chap_ms.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c +index 1de50428..ffb6bd13 100644 +--- a/pppd/chap_ms.c ++++ b/pppd/chap_ms.c +@@ -423,6 +423,8 @@ chapms2_check_success(int id, unsigned char *msg, int len) + len -= MS_AUTH_RESPONSE_LENGTH; + if ((len >= 3) && !strncmp((char *)msg, " M=", 3)) { + msg += 3; /* Eat the delimiter */ ++ } else if ((len >= 2) && !strncmp((char *)msg, "M=", 2)) { ++ msg += 2; /* Eat the delimiter */ + } else if (len) { + /* Packet has extra text which does not begin " M=" */ + error("MS-CHAPv2 Success packet is badly formed."); diff --git a/ppp.spec b/ppp.spec index 5c006f5..537625c 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.8 -Release: 7%{?dist} +Release: 8%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -52,6 +52,8 @@ Patch0026: ppp-2.4.8-eaptls-mppe-1.300.patch Patch0032: ppp-2.4.8-CVE-2020-8597.patch # rhbz#1612918, https://github.com/paulusmack/ppp/pull/149 Patch0033: ppp-2.4.8-man-fix.patch +# rhbz#1867047, https://github.com/paulusmack/ppp/commit/3cd95baf3f1de1d5a9bc89be0f4c3215ceb5aefe.patch +Patch0034: ppp-2.4.8-ws-2019-workaround.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -186,6 +188,10 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Mon Aug 10 2020 Jaroslav Škarvada - 2.4.8-8 +- Added workaround for Windows Server 2019 + Resolves: rhbz#1867047 + * Tue Jul 28 2020 Fedora Release Engineering - 2.4.8-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 4c460e431e75c97b753683c8d13f549d326b0c5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 10 Nov 2020 14:50:51 +0100 Subject: [PATCH 30/76] Remove patch setting CC to gcc This is automatically done these days, so no need for us to do it --- ...ys-use-gcc-as-our-compiler-of-choice.patch | 25 ------------------- ...hardcode-LIBDIR-but-set-it-according.patch | 2 +- ...e-compiler-flags-handed-to-us-by-rpm.patch | 2 +- ...-sys-linux-rework-get_first_ethernet.patch | 2 +- ppp.spec | 1 - 5 files changed, 3 insertions(+), 29 deletions(-) delete mode 100644 0001-build-sys-use-gcc-as-our-compiler-of-choice.patch diff --git a/0001-build-sys-use-gcc-as-our-compiler-of-choice.patch b/0001-build-sys-use-gcc-as-our-compiler-of-choice.patch deleted file mode 100644 index b8a76ca..0000000 --- a/0001-build-sys-use-gcc-as-our-compiler-of-choice.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 486e36d184cbaee7e34bb582ea6fdf3bfa9ca531 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 11:23:42 +0200 -Subject: [PATCH 01/27] build-sys: use gcc as our compiler of choice - ---- - pppd/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index a74c914..1d9ea78 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -30,7 +30,7 @@ ifeq (.depend,$(wildcard .depend)) - include .depend - endif - --# CC = gcc -+CC = gcc - # - COPTS = -O2 -pipe -Wall -g - LIBS = --- -1.8.3.1 - diff --git a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch index 2d6bdd6..8544d60 100644 --- a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch @@ -28,7 +28,7 @@ index 63872eb..8ed56c1 100644 @@ -32,7 +33,7 @@ endif - CC = gcc + # CC = gcc # -COPTS = -Wall $(RPM_OPT_FLAGS) +COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" diff --git a/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch index dc0c5df..d38b9d8 100644 --- a/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +++ b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch @@ -34,7 +34,7 @@ index 5a44d30..63872eb 100644 +++ b/pppd/Makefile.linux @@ -32,8 +32,7 @@ endif - CC = gcc + # CC = gcc # -COPTS = -O2 -pipe -Wall -g -LIBS = diff --git a/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch index 780e068..18bfecf 100644 --- a/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch +++ b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch @@ -33,7 +33,7 @@ index 53df4d2..0e8107f 100644 @@ -32,6 +32,9 @@ include .depend endif - CC = gcc + # CC = gcc + +LIBS = -ludev + diff --git a/ppp.spec b/ppp.spec index 537625c..3c75dec 100644 --- a/ppp.spec +++ b/ppp.spec @@ -22,7 +22,6 @@ Source11: ifdown-ppp Source12: ppp-watch.tar.xz # Fedora-specific -Patch0001: 0001-build-sys-use-gcc-as-our-compiler-of-choice.patch Patch0002: ppp-2.4.8-build-sys-enable-PAM-support.patch Patch0003: ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch Patch0004: 0004-doc-add-configuration-samples.patch From 02c8201efb6783c57e42e53d0361f40ccd5d3703 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 10 Nov 2020 14:57:56 +0100 Subject: [PATCH 31/76] Use gcc directly for -print-multi-os-directory The patch uses gcc directly everywhere else. --- ...8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch index 8544d60..016e310 100644 --- a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ b/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch @@ -57,7 +57,7 @@ index e09a369..b474a19 100644 BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell $(CC) -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) ++LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) SUBDIRS := rp-pppoe pppoatm pppol2tp # Uncomment the next line to include the radius authentication plugin From 61c3711488b5a982bc412a593d48697287c0ecf4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 10 Nov 2020 15:13:48 +0100 Subject: [PATCH 32/76] spec: Remove unused export RPM_LD_FLAGS is not used anywhere. --- ppp.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 3c75dec..cdc1456 100644 --- a/ppp.spec +++ b/ppp.spec @@ -93,7 +93,6 @@ tar -xJf %{SOURCE12} %build export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" -export RPM_LD_FLAGS="$LDFLAGS" %configure %{make_build} LDFLAGS="%{?build_ldflags}" %{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags}" From bf3c4131752b08d47ddd9c22bd21cc96a16ae770 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 10 Nov 2020 15:17:07 +0100 Subject: [PATCH 33/76] spec: Pass -pie via LDFLAGS Makes the clang build pass --- ppp.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ppp.spec b/ppp.spec index cdc1456..cb0a87a 100644 --- a/ppp.spec +++ b/ppp.spec @@ -94,8 +94,8 @@ tar -xJf %{SOURCE12} %build export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" %configure -%{make_build} LDFLAGS="%{?build_ldflags}" -%{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags}" +%{make_build} LDFLAGS="%{?build_ldflags} -pie" +%{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" %install make INSTROOT=%{buildroot} install install-etcppp From 23f594e00896a75b4cf3690aa4a32e0d11917cf7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 5 Jan 2021 22:35:54 +0100 Subject: [PATCH 34/76] New version Resolves: rhbz#1912617 --- .gitignore | 1 + ...t-strip-binaries-during-installation.patch | 111 - ...-use-prefix-usr-instead-of-usr-local.patch | 89 - 0010-build-sys-enable-CBCP.patch | 26 - ...se-SOCK_CLOEXEC-when-creating-socket.patch | 47 +- ...ppoe-add-manpage-for-pppoe-discovery.patch | 23 +- ...l-rp-pppoe-plugin-files-with-standar.patch | 30 +- ppp-2.4.8-CVE-2020-8597.patch | 37 - ...e-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch | 23 - ...pile-pppol2tp-with-multilink-support.patch | 24 - ppp-2.4.8-build-sys-enable-PAM-support.patch | 25 - ...e-compiler-flags-handed-to-us-by-rpm.patch | 121 - ppp-2.4.8-eaptls-mppe-1.300.patch | 3948 ----------------- ppp-2.4.8-man-fix.patch | 46 - ....8-pppd-introduce-ipv6-accept-remote.patch | 57 - ...-sys-linux-rework-get_first_ethernet.patch | 383 -- ppp-2.4.8-ws-2019-workaround.patch | 27 - ...hardcode-LIBDIR-but-set-it-according.patch | 119 +- ppp-2.4.9-config.patch | 21 + ppp-2.4.9-configure-cflags-allow-commas.patch | 17 + ...pp-2.4.9-everywhere-O_CLOEXEC-harder.patch | 4 +- ppp.spec | 58 +- sources | 2 +- 23 files changed, 140 insertions(+), 5099 deletions(-) delete mode 100644 0007-build-sys-don-t-strip-binaries-during-installation.patch delete mode 100644 0008-build-sys-use-prefix-usr-instead-of-usr-local.patch delete mode 100644 0010-build-sys-enable-CBCP.patch delete mode 100644 ppp-2.4.8-CVE-2020-8597.patch delete mode 100644 ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch delete mode 100644 ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch delete mode 100644 ppp-2.4.8-build-sys-enable-PAM-support.patch delete mode 100644 ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch delete mode 100644 ppp-2.4.8-eaptls-mppe-1.300.patch delete mode 100644 ppp-2.4.8-man-fix.patch delete mode 100644 ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch delete mode 100644 ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch delete mode 100644 ppp-2.4.8-ws-2019-workaround.patch rename ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch => ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch (58%) create mode 100644 ppp-2.4.9-config.patch create mode 100644 ppp-2.4.9-configure-cflags-allow-commas.patch rename ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch => ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch (99%) diff --git a/.gitignore b/.gitignore index 94b2a80..3a9dd7f 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ ppp-2.4.5.tar.gz /ppp-watch.tar.xz /ppp-2.4.7.tar.gz /ppp-2.4.8.tar.gz +/ppp-2.4.9.tar.gz diff --git a/0007-build-sys-don-t-strip-binaries-during-installation.patch b/0007-build-sys-don-t-strip-binaries-during-installation.patch deleted file mode 100644 index 9f542a6..0000000 --- a/0007-build-sys-don-t-strip-binaries-during-installation.patch +++ /dev/null @@ -1,111 +0,0 @@ -From b9fb631a493c5f1b490c8e9645eb6ebab4b25cc8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 18:37:00 +0200 -Subject: [PATCH 07/27] build-sys: don't strip binaries during installation - -We don't want that when building rpms. rpmbuild does final stripping of binaries -for us and generetes debuginfo rpm. ---- - chat/Makefile.linux | 2 +- - pppd/Makefile.linux | 4 ++-- - pppd/plugins/radius/Makefile.linux | 6 +++--- - pppd/plugins/rp-pppoe/Makefile.linux | 4 ++-- - pppdump/Makefile.linux | 2 +- - pppstats/Makefile.linux | 2 +- - 6 files changed, 10 insertions(+), 10 deletions(-) - -diff --git a/chat/Makefile.linux b/chat/Makefile.linux -index 848cd8d..2445637 100644 ---- a/chat/Makefile.linux -+++ b/chat/Makefile.linux -@@ -25,7 +25,7 @@ chat.o: chat.c - - install: chat - mkdir -p $(BINDIR) $(MANDIR) -- $(INSTALL) -s -c chat $(BINDIR) -+ $(INSTALL) -c chat $(BINDIR) - $(INSTALL) -c -m 644 chat.8 $(MANDIR) - - clean: -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 8ed56c1..4f27100 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -102,7 +102,7 @@ ifdef USE_SRP - CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include - LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto - TARGETS += srp-entry --EXTRAINSTALL = $(INSTALL) -s -c -m 555 srp-entry $(BINDIR)/srp-entry -+EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry - MANPAGES += srp-entry.8 - EXTRACLEAN += srp-entry.o - NEEDDES=y -@@ -208,7 +208,7 @@ all: $(TARGETS) - install: pppd - mkdir -p $(BINDIR) $(MANDIR) - $(EXTRAINSTALL) -- $(INSTALL) -s -c -m 555 pppd $(BINDIR)/pppd -+ $(INSTALL) -c -m 555 pppd $(BINDIR)/pppd - if chgrp pppusers $(BINDIR)/pppd 2>/dev/null; then \ - chmod o-rx,u+s $(BINDIR)/pppd; fi - $(INSTALL) -c -m 444 pppd.8 $(MANDIR) -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 179d0b7..707326b 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -36,9 +36,9 @@ all: $(PLUGIN) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -s -c -m 755 radius.so $(LIBDIR) -- $(INSTALL) -s -c -m 755 radattr.so $(LIBDIR) -- $(INSTALL) -s -c -m 755 radrealms.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radius.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radattr.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radrealms.so $(LIBDIR) - $(INSTALL) -c -m 444 pppd-radius.8 $(MANDIR) - $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) - -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 1305ed8..3cd9101 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -43,9 +43,9 @@ rp-pppoe.so: plugin.o discovery.o if.o common.o - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -s -c -m 4550 rp-pppoe.so $(LIBDIR) -+ $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR) - $(INSTALL) -d -m 755 $(BINDIR) -- $(INSTALL) -s -c -m 555 pppoe-discovery $(BINDIR) -+ $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) - - clean: - rm -f *.o *.so pppoe-discovery -diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux -index d0a5032..95c6805 100644 ---- a/pppdump/Makefile.linux -+++ b/pppdump/Makefile.linux -@@ -17,5 +17,5 @@ clean: - - install: - mkdir -p $(BINDIR) $(MANDIR) -- $(INSTALL) -s -c pppdump $(BINDIR) -+ $(INSTALL) -c pppdump $(BINDIR) - $(INSTALL) -c -m 444 pppdump.8 $(MANDIR) -diff --git a/pppstats/Makefile.linux b/pppstats/Makefile.linux -index 42aba73..c5ba3b1 100644 ---- a/pppstats/Makefile.linux -+++ b/pppstats/Makefile.linux -@@ -22,7 +22,7 @@ all: pppstats - - install: pppstats - -mkdir -p $(MANDIR) -- $(INSTALL) -s -c pppstats $(BINDIR) -+ $(INSTALL) -c pppstats $(BINDIR) - $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) - - pppstats: $(PPPSTATSRCS) --- -1.8.3.1 - diff --git a/0008-build-sys-use-prefix-usr-instead-of-usr-local.patch b/0008-build-sys-use-prefix-usr-instead-of-usr-local.patch deleted file mode 100644 index e82c957..0000000 --- a/0008-build-sys-use-prefix-usr-instead-of-usr-local.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 343728d5de6e44bd67923503e62eefaad50760a4 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 18:47:01 +0200 -Subject: [PATCH 08/27] build-sys: use prefix /usr instead of /usr/local - ---- - configure | 2 +- - pppd/Makefile.linux | 4 ++-- - scripts/ppp-on-rsh | 2 +- - scripts/ppp-on-ssh | 4 ++-- - scripts/secure-card | 2 +- - 5 files changed, 7 insertions(+), 7 deletions(-) - -diff --git a/configure b/configure -index 6a55e0f..db54d77 100755 ---- a/configure -+++ b/configure -@@ -2,7 +2,7 @@ - # $Id: configure,v 1.38 2008/06/15 07:08:49 paulus Exp $ - - # Where to install stuff by default --DESTDIR=/usr/local -+DESTDIR=/usr - SYSCONF=/etc - - # if [ -d /NextApps ]; then -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 4f27100..95c2598 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -99,8 +99,8 @@ endif - - # EAP SRP-SHA1 - ifdef USE_SRP --CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include --LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto -+CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/include/openssl -+LIBS += -lsrp -L/usr/lib -lcrypto - TARGETS += srp-entry - EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry - MANPAGES += srp-entry.8 -diff --git a/scripts/ppp-on-rsh b/scripts/ppp-on-rsh -index 30a50db..a80616a 100755 ---- a/scripts/ppp-on-rsh -+++ b/scripts/ppp-on-rsh -@@ -26,7 +26,7 @@ PPPD_RHOST=myremotehost - # For this example, we assume that pppd on both local and remote - # machines reside in the same place, /usr/local/bin/pppd - # --PPPD_LOC=/usr/local/bin/pppd -+PPPD_LOC=/usr/sbin/pppd - - # - # The location of local options file (where rsh client is running). -diff --git a/scripts/ppp-on-ssh b/scripts/ppp-on-ssh -index 0e41aca..c27e80a 100755 ---- a/scripts/ppp-on-ssh -+++ b/scripts/ppp-on-ssh -@@ -26,7 +26,7 @@ PPPD_RHOST=myremotehost - # For this example, we assume that pppd on both local and remote - # machines reside in the same place, /usr/local/bin/pppd - # --PPPD_LOC=/usr/local/bin/pppd -+PPPD_LOC=/usr/sbin/pppd - - # - # The location of local options file (where ssh client is running). -@@ -52,7 +52,7 @@ PPPD_REM_OPT=/etc/ppp/options-ssh-rem - # - # The location of ssh client on the local machine - # --SSH_LOC=/usr/local/bin/ssh -+SSH_LOC=/usr/bin/ssh - - export PPPD_LOC PPPD_LOC_OPT PPPD_REM_OPT PPPD_RHOST SSH_LOC - -diff --git a/scripts/secure-card b/scripts/secure-card -index 0002365..ae3ae50 100755 ---- a/scripts/secure-card -+++ b/scripts/secure-card -@@ -1,4 +1,4 @@ --#!/usr/local/bin/expect -f -+#!/usr/bin/expect -f - # - # This script was written by Jim Isaacson . It is - # designed to work as a script to use the SecureCARD(tm) device. This --- -1.8.3.1 - diff --git a/0010-build-sys-enable-CBCP.patch b/0010-build-sys-enable-CBCP.patch deleted file mode 100644 index 87c3b72..0000000 --- a/0010-build-sys-enable-CBCP.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 8015a0ef23a874f288d5e77ffafe1d7f4281725d Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 18:59:24 +0200 -Subject: [PATCH 10/27] build-sys: enable CBCP - -Resolves: #199278 ---- - pppd/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 95c2598..65700fa 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -68,7 +68,7 @@ HAVE_INET6=y - PLUGIN=y - - # Enable Microsoft proprietary Callback Control Protocol --#CBCP=y -+CBCP=y - - # Enable EAP SRP-SHA1 authentication (requires libsrp) - #USE_SRP=y --- -1.8.3.1 - diff --git a/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch index 08d67f7..1352370 100644 --- a/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +++ b/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch @@ -1,19 +1,3 @@ -From 2a97ab28ee00586e5f06b3ef3a0e43ea0c7c6499 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 14:21:41 +0200 -Subject: [PATCH 14/27] everywhere: use SOCK_CLOEXEC when creating socket - ---- - pppd/plugins/pppoatm/pppoatm.c | 2 +- - pppd/plugins/pppol2tp/openl2tp.c | 2 +- - pppd/plugins/pppol2tp/pppol2tp.c | 2 +- - pppd/plugins/rp-pppoe/if.c | 2 +- - pppd/plugins/rp-pppoe/plugin.c | 6 +++--- - pppd/plugins/rp-pppoe/pppoe-discovery.c | 2 +- - pppd/sys-linux.c | 10 +++++----- - pppd/tty.c | 2 +- - 8 files changed, 14 insertions(+), 14 deletions(-) - diff --git a/pppd/plugins/pppoatm/pppoatm.c b/pppd/plugins/pppoatm/pppoatm.c index d693350..c31bb34 100644 --- a/pppd/plugins/pppoatm/pppoatm.c @@ -53,10 +37,10 @@ index a7e3400..e64a778 100644 if (fd >= 0) { memset (&ifr, '\0', sizeof (ifr)); strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c +diff --git a/pppd/plugins/pppoe/if.c b/pppd/plugins/pppoe/if.c index 91e9a57..72aba41 100644 ---- a/pppd/plugins/rp-pppoe/if.c -+++ b/pppd/plugins/rp-pppoe/if.c +--- a/pppd/plugins/pppoe/if.c ++++ b/pppd/plugins/pppoe/if.c @@ -116,7 +116,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) stype = SOCK_PACKET; #endif @@ -66,10 +50,10 @@ index 91e9a57..72aba41 100644 /* Give a more helpful message for the common error case */ if (errno == EPERM) { fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c +diff --git a/pppd/plugins/pppoe/plugin.c b/pppd/plugins/pppoe/plugin.c index a8c2bb4..24bdf8f 100644 ---- a/pppd/plugins/rp-pppoe/plugin.c -+++ b/pppd/plugins/rp-pppoe/plugin.c +--- a/pppd/plugins/pppoe/plugin.c ++++ b/pppd/plugins/pppoe/plugin.c @@ -137,7 +137,7 @@ PPPOEConnectDevice(void) /* server equipment). */ /* Opening this socket just before waitForPADS in the discovery() */ @@ -97,10 +81,10 @@ index a8c2bb4..24bdf8f 100644 r = 0; } -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c +diff --git a/pppd/plugins/pppoe/pppoe-discovery.c b/pppd/plugins/pppoe/pppoe-discovery.c index 3d3bf4e..c0d927d 100644 ---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c +--- a/pppd/plugins/pppoe/pppoe-discovery.c ++++ b/pppd/plugins/pppoe/pppoe-discovery.c @@ -121,7 +121,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) stype = SOCK_PACKET; #endif @@ -109,7 +93,7 @@ index 3d3bf4e..c0d927d 100644 + if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { /* Give a more helpful message for the common error case */ if (errno == EPERM) { - rp_fatal("Cannot create raw socket -- pppoe must be run as root."); + fatal("Cannot create raw socket -- pppoe must be run as root."); diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c index 00a2cf5..0690019 100644 --- a/pppd/sys-linux.c @@ -136,7 +120,7 @@ index 00a2cf5..0690019 100644 - sock_fd = socket(AF_INET, SOCK_DGRAM, 0); + sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); if (sock_fd < 0) - return 0; + return -1; memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr)); @@ -2067,7 +2067,7 @@ int ppp_available(void) /* @@ -147,15 +131,6 @@ index 00a2cf5..0690019 100644 if (s < 0) return 0; -@@ -2860,7 +2860,7 @@ ether_to_eui64(eui64_t *p_eui64) - int skfd; - const unsigned char *ptr; - -- skfd = socket(PF_INET6, SOCK_DGRAM, 0); -+ skfd = socket(PF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if(skfd == -1) - { - warn("could not open IPv6 socket"); diff --git a/pppd/tty.c b/pppd/tty.c index bc96695..8e76a5d 100644 --- a/pppd/tty.c diff --git a/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch b/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch index a13fe79..b7f7c91 100644 --- a/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch +++ b/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch @@ -1,18 +1,7 @@ -From a30efa2cc99a5b6ab220de04cbcc7db38888a17a Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 14:29:45 +0200 -Subject: [PATCH 16/27] rp-pppoe: add manpage for pppoe-discovery - ---- - pppd/plugins/rp-pppoe/Makefile.linux | 2 + - pppd/plugins/rp-pppoe/pppoe-discovery.8 | 86 +++++++++++++++++++++++++++++++++ - 2 files changed, 88 insertions(+) - create mode 100644 pppd/plugins/rp-pppoe/pppoe-discovery.8 - -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux +diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux index 3cd9101..9918091 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux +--- a/pppd/plugins/pppoe/Makefile.linux ++++ b/pppd/plugins/pppoe/Makefile.linux @@ -16,6 +16,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ @@ -22,18 +11,18 @@ index 3cd9101..9918091 100644 PPPDVERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) @@ -46,6 +47,7 @@ install: all - $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR) + $(LN_S) pppoe.so $(LIBDIR)/rp-pppoe.so $(INSTALL) -d -m 755 $(BINDIR) $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) + $(INSTALL) -c -m 444 pppoe-discovery.8 $(MANDIR) clean: rm -f *.o *.so pppoe-discovery -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.8 b/pppd/plugins/rp-pppoe/pppoe-discovery.8 +diff --git a/pppd/plugins/pppoe/pppoe-discovery.8 b/pppd/plugins/pppoe/pppoe-discovery.8 new file mode 100644 index 0000000..d0a93db --- /dev/null -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.8 ++++ b/pppd/plugins/pppoe/pppoe-discovery.8 @@ -0,0 +1,86 @@ +.\" pppoe-discovery.8 written by +.\" Ben Hutchings , based on pppoe.8. diff --git a/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch b/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch index 7a18e07..23b1f93 100644 --- a/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch +++ b/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch @@ -1,24 +1,15 @@ -From 769521a3798fd554ddc7333cb1255cd1b40790e8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Thu, 10 Apr 2014 10:00:55 +0200 -Subject: [PATCH 23/27] build-sys: install rp-pppoe plugin files with standard - perms - -This is needed to properly generate debuginfo package. ---- - pppd/plugins/rp-pppoe/Makefile.linux | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index b949716..fa49efb 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -44,10 +44,10 @@ rp-pppoe.so: plugin.o discovery.o if.o common.o +diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux +index 2df887b..6cb8397 100644 +--- a/pppd/plugins/pppoe/Makefile.linux ++++ b/pppd/plugins/pppoe/Makefile.linux +@@ -43,12 +43,12 @@ pppoe.so: plugin.o discovery.o if.o common.o install: all $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR) -+ $(INSTALL) -c -m 755 rp-pppoe.so $(LIBDIR) +- $(INSTALL) -c -m 4550 pppoe.so $(LIBDIR) ++ $(INSTALL) -c -m 755 pppoe.so $(LIBDIR) + # Symlink for backward compatibility + $(LN_S) pppoe.so $(LIBDIR)/rp-pppoe.so $(INSTALL) -d -m 755 $(BINDIR) - $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) - $(INSTALL) -c -m 444 pppoe-discovery.8 $(MANDIR) @@ -27,6 +18,3 @@ index b949716..fa49efb 100644 clean: rm -f *.o *.so pppoe-discovery --- -1.8.3.1 - diff --git a/ppp-2.4.8-CVE-2020-8597.patch b/ppp-2.4.8-CVE-2020-8597.patch deleted file mode 100644 index 5d7c51b..0000000 --- a/ppp-2.4.8-CVE-2020-8597.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001 -From: Paul Mackerras -Date: Mon, 3 Feb 2020 15:53:28 +1100 -Subject: [PATCH] pppd: Fix bounds check in EAP code - -Given that we have just checked vallen < len, it can never be the case -that vallen >= len + sizeof(rhostname). This fixes the check so we -actually avoid overflowing the rhostname array. - -Reported-by: Ilja Van Sprundel -Signed-off-by: Paul Mackerras ---- - pppd/eap.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/eap.c b/pppd/eap.c -index 94407f56..1b93db01 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -1420,7 +1420,7 @@ int len; - } - - /* Not so likely to happen. */ -- if (vallen >= len + sizeof (rhostname)) { -+ if (len - vallen >= sizeof (rhostname)) { - dbglog("EAP: trimming really long peer name down"); - BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); - rhostname[sizeof (rhostname) - 1] = '\0'; -@@ -1846,7 +1846,7 @@ int len; - } - - /* Not so likely to happen. */ -- if (vallen >= len + sizeof (rhostname)) { -+ if (len - vallen >= sizeof (rhostname)) { - dbglog("EAP: trimming really long peer name down"); - BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); - rhostname[sizeof (rhostname) - 1] = '\0'; diff --git a/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch b/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch deleted file mode 100644 index fd53ac7..0000000 --- a/ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch +++ /dev/null @@ -1,23 +0,0 @@ -From d69eb9a8aa284014dd7dd282813989eda9d84d74 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Wed, 9 Apr 2014 09:56:09 +0200 -Subject: [PATCH 21/27] build-sys: compile pppol2tp plugin with RPM_OPT_FLAGS - ---- - pppd/plugins/pppol2tp/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index 4339566..9a635b8 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = -O2 -g -+COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC - LDFLAGS_SHARED = -shared - INSTALL = install --- -1.8.3.1 - diff --git a/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch b/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch deleted file mode 100644 index d801308..0000000 --- a/ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch +++ /dev/null @@ -1,24 +0,0 @@ -From a0060c5d48ef742bff4fe9ba9c276a5c21795ce8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Wed, 9 Apr 2014 09:58:38 +0200 -Subject: [PATCH 22/27] build-sys: compile pppol2tp with multilink support - -Resolves: #817013 ---- - pppd/plugins/pppol2tp/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index 9a635b8..9cb316d 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = $(RPM_OPT_FLAGS) -+COPTS = $(RPM_OPT_FLAGS) -DHAVE_MULTILINK - CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC - LDFLAGS_SHARED = -shared - INSTALL = install --- -1.8.3.1 - diff --git a/ppp-2.4.8-build-sys-enable-PAM-support.patch b/ppp-2.4.8-build-sys-enable-PAM-support.patch deleted file mode 100644 index 355410c..0000000 --- a/ppp-2.4.8-build-sys-enable-PAM-support.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 0d71a32b73b71c9793d0b304320858062faf00d1 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 11:25:43 +0200 -Subject: [PATCH 02/27] build-sys: enable PAM support - ---- - pppd/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 1d9ea78..5a44d30 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -61,7 +61,7 @@ HAVE_MULTILINK=y - #SYSTEMD=y - - HAS_SHADOW=y --#USE_PAM=y -+USE_PAM=y - HAVE_INET6=y - - # Enable plugins --- -1.8.3.1 - diff --git a/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch b/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch deleted file mode 100644 index d38b9d8..0000000 --- a/ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch +++ /dev/null @@ -1,121 +0,0 @@ -From d729b06f0ac7a5ebd3648ef60bef0499b59bf82d Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 11:29:39 +0200 -Subject: [PATCH 03/27] build-sys: utilize compiler flags handed to us by - rpmbuild - ---- - chat/Makefile.linux | 2 +- - pppd/Makefile.linux | 3 +-- - pppd/plugins/Makefile.linux | 2 +- - pppd/plugins/pppoatm/Makefile.linux | 2 +- - pppd/plugins/radius/Makefile.linux | 2 +- - pppd/plugins/rp-pppoe/Makefile.linux | 2 +- - pppdump/Makefile.linux | 2 +- - pppstats/Makefile.linux | 2 +- - 8 files changed, 8 insertions(+), 9 deletions(-) - -diff --git a/chat/Makefile.linux b/chat/Makefile.linux -index 1065ac5..848cd8d 100644 ---- a/chat/Makefile.linux -+++ b/chat/Makefile.linux -@@ -10,7 +10,7 @@ CDEF3= -UNO_SLEEP # Use the usleep function - CDEF4= -DFNDELAY=O_NDELAY # Old name value - CDEFS= $(CDEF1) $(CDEF2) $(CDEF3) $(CDEF4) - --COPTS= -O2 -g -pipe -+COPTS= $(RPM_OPT_FLAGS) - CFLAGS= $(COPTS) $(CDEFS) - - INSTALL= install -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 5a44d30..63872eb 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -32,8 +32,7 @@ endif - - # CC = gcc - # --COPTS = -O2 -pipe -Wall -g --LIBS = -+COPTS = -Wall $(RPM_OPT_FLAGS) - - # Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index 0a7ec7b..e09a369 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = -O2 -g -+COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS_SHARED = -shared - INSTALL = install -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 20f62e6..5a81447 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -1,5 +1,5 @@ - #CC = gcc --COPTS = -O2 -g -+COPTS = $(RPM_OPT_FLAGS) - CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC - LDFLAGS_SHARED = -shared - INSTALL = install -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 24ed3e5..45b3b8d 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -12,7 +12,7 @@ VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - INSTALL = install - - PLUGIN=radius.so radattr.so radrealms.so --CFLAGS=-I. -I../.. -I../../../include -O2 -fPIC -DRC_LOG_FACILITY=LOG_DAEMON -+CFLAGS=-I. -I../.. -I../../../include $(RPM_OPT_FLAGS) -DRC_LOG_FACILITY=LOG_DAEMON - - # Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 5d7a271..352991a 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -25,7 +25,7 @@ INSTALL = install - # Version is set ONLY IN THE MAKEFILE! Don't delete this! - RP_VERSION=3.8p - --COPTS=-O2 -g -+COPTS=$(RPM_OPT_FLAGS) - CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' - all: rp-pppoe.so pppoe-discovery - -diff --git a/pppdump/Makefile.linux b/pppdump/Makefile.linux -index ac028f6..d0a5032 100644 ---- a/pppdump/Makefile.linux -+++ b/pppdump/Makefile.linux -@@ -2,7 +2,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 - --CFLAGS= -O -I../include/net -+CFLAGS= $(RPM_OPT_FLAGS) -I../include/net - OBJS = pppdump.o bsd-comp.o deflate.o zlib.o - - INSTALL= install -diff --git a/pppstats/Makefile.linux b/pppstats/Makefile.linux -index cca6f0f..42aba73 100644 ---- a/pppstats/Makefile.linux -+++ b/pppstats/Makefile.linux -@@ -10,7 +10,7 @@ PPPSTATSRCS = pppstats.c - PPPSTATOBJS = pppstats.o - - #CC = gcc --COPTS = -O -+COPTS = $(RPM_OPT_FLAGS) - COMPILE_FLAGS = -I../include - LIBS = - --- -1.8.3.1 - diff --git a/ppp-2.4.8-eaptls-mppe-1.300.patch b/ppp-2.4.8-eaptls-mppe-1.300.patch deleted file mode 100644 index 65b1434..0000000 --- a/ppp-2.4.8-eaptls-mppe-1.300.patch +++ /dev/null @@ -1,3948 +0,0 @@ -diff -Naur ppp-2.4.8/README.eap-tls ppp-2.4.8-eaptls-mppe-1.300/README.eap-tls ---- ppp-2.4.8/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/README.eap-tls 2020-04-07 10:09:50.565118206 +0200 -@@ -0,0 +1,307 @@ -+EAP-TLS authentication support for PPP -+====================================== -+ -+1. Intro -+ -+ The Extensible Authentication Protocol (EAP; RFC 3748) is a -+ security protocol that can be used with PPP. It provides a means -+ to plug in multiple optional authentication methods. -+ -+ Transport Level Security (TLS; RFC 5216) provides for mutual -+ authentication, integrity-protected ciphersuite negotiation and -+ key exchange between two endpoints. It also provides for optional -+ MPPE encryption. -+ -+ EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets, -+ allowing TLS mutual authentication to be used as a generic EAP -+ mechanism. It also provides optional encryption using the MPPE -+ protocol. -+ -+ This patch provide EAP-TLS support to pppd. -+ This authentication method can be used in both client or server -+ mode. -+ -+2. Building -+ -+ To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org) -+ is required. Any version from 0.9.7 should work. -+ -+ Configure, compile, and install as usual. -+ -+3. Configuration -+ -+ On the client side there are two ways to configure EAP-TLS: -+ -+ 1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters -+ -+ 2. edit the /etc/ppp/eaptls-client file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ The file containing the certificate chain for the -+ client in PEM format -+ - Server certificate file -+ If you want to specify the certificate that the -+ server is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM -+ format. -+ - Client private key file -+ The file containing the client private key in PEM format. -+ -+ -+ On the server side edit the /etc/ppp/eaptls-server file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ If you want to specify the certificate that the -+ client is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - Server certificate file -+ The file containing the certificate chain for the -+ server in PEM format -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM format. -+ - Client private key file -+ The file containing the server private key in PEM format. -+ - addresses -+ A list of IP addresses the client is allowed to use. -+ -+ -+ OpenSSL engine support is included starting with v0.95 of this patch. -+ Currently the only engine tested is the 'pkcs11' engine (hardware token -+ support). To use the 'pksc11' engine: -+ - Use a special private key fileiname in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - The certificate can also be loaded from the 'pkcs11' engine using -+ a special client certificate filename in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior -+ to starting 'pppd'. A sample openssl.cnf file is -+ -+ openssl_conf = openssl_def -+ -+ [ openssl_def ] -+ engines = engine_section -+ -+ [ engine_section ] -+ pkcs11 = pkcs11_section -+ -+ [ pkcs11_section ] -+ engine_id = pkcs11 -+ dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+ MODULE_PATH = /usr/lib64/libeTPkcs11.so -+ init = 0 -+ -+ - There are two ways to specify a password/PIN for the PKCS11 engine: -+ - inside the openssl.cnf file using -+ PIN = your-secret-pin -+ Note The keyword 'PIN' is case sensitive! -+ - Using the 'password' in the ppp options file. -+ From v0.97 of the eap-tls patch the password can also be supplied -+ using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c -+ for an example). -+ -+ -+4. Options -+ -+ These pppd options are available: -+ -+ ca -+ Use the CA public certificate found in in PEM format -+ cert -+ Use the client public certificate found in in PEM format -+ or in engine:engine_id format -+ key -+ Use the client private key found in in PEM format -+ or in engine:engine_id format -+ crl -+ Use the Certificate Revocation List (CRL) file in PEM format. -+ crl-dir -+ Use CRL files from directory . It contains CRL files in PEM -+ format and each file contains a CRL. The files are looked up -+ by the issuer name hash value. Use the c_rehash utility -+ to create necessary links. -+ need-peer-eap -+ If the peer doesn't ask us to authenticate or doesn't use eap -+ to authenticate us, disconnect. -+ -+ Note: -+ password-encrypted certificates can be used as of v0.94 of this -+ patch. The password for the eap-tls.key file is specified using -+ the regular -+ password .... -+ statement in the ppp options file, or by using the appropriate -+ plugin which supplies a 'eaptls_passwd_hook' routine. -+ -+5. Connecting -+ -+ If you're setting up a pppd server, edit the EAP-TLS configuration file -+ as written above and then run pppd with the 'auth' option to authenticate -+ the client. The EAP-TLS method will be used if the other eap methods can't -+ be used (no secrets). -+ -+ If you're setting up a client, edit the configuration file and then run -+ pppd with 'remotename' option to specify the server name. Add the -+ 'need-peer-eap' option if you want to be sure the peer ask you to -+ authenticate (and to use eap) and to disconnect if it doesn't. -+ -+6. Example -+ -+ The following example can be used to connect a Linux client with the 'pptp' -+ package to a Linux server running the 'pptpd' (PoPToP) package. The server -+ was configured with a certificate with name (CN) 'pptp-server', the client -+ was configured with a certificate with name (CN) 'pptp-client', both -+ signed by the same Certificate Authority (CA). -+ -+ Server side: -+ - /etc/pptpd.conf file: -+ option /etc/ppp/options-pptpd-eaptls -+ localip 172.16.1.1 -+ remoteip 172.16.1.10-20 -+ - /etc/ppp/options-pptpd-eaptls file: -+ name pptp-server -+ lock -+ mtu 1500 -+ mru 1450 -+ auth -+ lcp-echo-failure 3 -+ lcp-echo-interval 5 -+ nodeflate -+ nobsdcomp -+ nopredictor1 -+ nopcomp -+ noaccomp -+ -+ require-eap -+ require-mppe-128 -+ -+ crl /home/janjust/ppp/keys/crl.pem -+ -+ debug -+ logfile /tmp/pppd.log -+ -+ - /etc/ppp/eaptls-server file: -+ * pptp-server - /etc/ppp/pptp-server.crt /etc/ppp/ca.crt /etc/ppp/pptp-server.key * -+ -+ - On the server, run -+ pptdp --conf /etc/pptpd.conf -+ -+ Client side: -+ - Run -+ pppd noauth require-eap require-mppe-128 \ -+ ipcp-accept-local ipcp-accept-remote noipdefault \ -+ cert /etc/ppp/keys/pptp-client.crt \ -+ key /etc/ppp/keys/pptp-client.key \ -+ ca /etc/ppp/keys/ca.crt \ -+ name pptp-client remotename pptp-server \ -+ debug logfile /tmp/pppd.log -+ pty "pptp pptp-server.example.com --nolaunchpppd" -+ -+ Check /var/log/messages and the files /tmp/pppd.log on both sides for debugging info. -+ -+7. Notes -+ -+ This is experimental code. -+ Send suggestions and comments to Jan Just Keijser -+ -+8. Changelog of ppp-<>-eaptls-mppe-* patches -+ -+v0.7 (22-Nov-2005) -+ - First version of the patch to include MPPE support -+ - ppp-2.4.3 only -+v0.9 (25-Jul-2006) -+ - Bug fixes -+ - First version for ppp-2.4.4 -+v0.91 (03-Sep-2006) -+ - Added missing #include for md5.h -+ - Last version for ppp-2.4.3 -+v0.92 (22-Apr-2008) -+ - Fix for openssl 0.9.8 issue with md5 function overload. -+v0.93 (14-Aug-2008) -+ - Make sure 'noauth' option can be used to bypass server certificate verification. -+v0.94 (15-Oct-2008) -+ - Added support for password-protected private keys by (ab)using the 'password' field. -+v0.95 (23-Dec-2009) -+ - First version with OpenSSL engine support. -+v0.96 (27-Jan-2010) -+ - Added fully functional support for OpenSSL engines (PKCS#11) -+ - First version for ppp-2.4.5 -+v0.97 (20-Apr-2010) -+ - Some bug fixes for v0.96 -+ - Added support for entering the password via a plugin. The sample plugin -+ .../pppd/plugins/passprompt.c has been extended with EAP-TLS support. -+ The "old" methods using the password option or the /etc/ppp/openssl.cnf file still work. -+ - Added support for specifying the client CA, certificate and private key on the command-line -+ or via the ppp config file. -+v0.98 (20-Apr-2010) -+ - Fix initialisation bug when using ca/cert/key command-line options. -+ - Last version for ppp-2.4.4 -+v0.99 (05-Oct-2010) -+ - Fix coredump when using multilink option. -+v0.991 (08-Aug-2011) -+ - Fix compilation issue with openssl 1.0. -+v0.992 (01-Dec-2011) -+ - Fix compilation issue with eaptls_check_hook and passwordfd plugin. -+v0.993 (24-Apr-2012) -+ - Fix compilation issue when EAP_TLS=n in pppd/Makefile. -+v0.994 (11-Jun-2012) -+ - Fix compilation issue on Ubuntu 11.10. -+v0.995 (27-May-2014) -+ - Add support for a CRL file using the command-line option 'crl' -+ (prior only 'crl-dir' was supported). -+ - Fix segfault when pkcs11 enginename was not specified correctly. -+ - Fix segfault when client was misconfigured. -+ - Disable SSL Session Ticket support as Windows 8 does not support this. -+v0.996 (28-May-2014) -+ - Fix minor bug where SessionTicket message was printed as 'Unknown SSL3 code 4' -+ - Add EAP-TLS-specific options to pppd.8 manual page. -+ - Updated README.eap-tls file with new options and provide an example. -+v0.997 (19-Jun-2014) -+ - Change SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET -+ - Fix bug in initialisation code with fragmented packets. -+v0.998 (13-Mar-2015) -+ - Add fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620 -+v0.999 (11-May-2017) -+ - Add support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x. -+v1.101 (1-Jun-2018) -+ - Fix vulnerabilities CVE-2018-11574. -+v1.102 (2-Nov-2018) -+ - Add TLS 1.2 support. Windows 7/8 will connect using TLS 1.0, Windows 10 clients using TLS 1.2. -+ This works both when compiling against OpenSSL 1.0.1+ and 1.1+. -+ - Print warning when certificate is either not yet valid or has expired. -+ - Perform better peer certificate checks. -+ - Allow certificate chain files to be used. -+v1.200 (28-Feb-2020) -+ - First version of patch that was used to create a github PR against the main ppp code base. -+ - Add client-side 'capath' option to allow a directory with trusted CA certificates. -+ - Add compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or -+ use the ones supplied by OpenSSL. -+ - Code now also builds on Solaris (x86 tested) but has not been tested yet, as the Solaris ppp -+ kernel driver does not support MPPE. -+v1.201 (03-Apr-2020) -+ - Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that -+ you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation. -+v1.300 (03-Apr-2020) -+ - Add (experimental) TLS 1.3 support. This is based on draft-ietf-emu-eap-tls13-05 (expired) and -+ requires OpenSSL 1.1.1+ to be effective. -+ - Add new option 'max-tls-version' to specify the highest version of the TLS protocol to use -+ (defaults to TLS1.2 for now - so to use TLS1.3 you need to explicitly add 'max-tls-version 1.3') -+ -diff -Naur ppp-2.4.8/etc.ppp/eaptls-client ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-client ---- ppp-2.4.8/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-client 2020-04-07 10:09:50.566118204 +0200 -@@ -0,0 +1,10 @@ -+# Parameters for authentication using EAP-TLS (client) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (required) -+# server certificate file (optional, if unused put '-') -+# CA certificate file (required) -+# client private key file (required) -+ -+#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.8/etc.ppp/eaptls-server ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-server ---- ppp-2.4.8/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/eaptls-server 2020-04-07 10:09:50.566118204 +0200 -@@ -0,0 +1,11 @@ -+# Parameters for authentication using EAP-TLS (server) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (optional, if unused put '-') -+# server certificate file (required) -+# CA certificate file (required) -+# server private key file (required) -+# allowed addresses (required, can be *) -+ -+#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.8/etc.ppp/openssl.cnf ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/openssl.cnf ---- ppp-2.4.8/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/etc.ppp/openssl.cnf 2020-04-07 10:09:50.566118204 +0200 -@@ -0,0 +1,14 @@ -+openssl_conf = openssl_def -+ -+[ openssl_def ] -+engines = engine_section -+ -+[ engine_section ] -+pkcs11 = pkcs11_section -+ -+[ pkcs11_section ] -+engine_id = pkcs11 -+dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+MODULE_PATH = /usr/lib64/libeTPkcs11.so -+init = 0 -+ -diff -Naur ppp-2.4.8/linux/Makefile.top ppp-2.4.8-eaptls-mppe-1.300/linux/Makefile.top ---- ppp-2.4.8/linux/Makefile.top 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/linux/Makefile.top 2020-04-07 10:09:50.566118204 +0200 -@@ -26,7 +26,7 @@ - cd pppdump; $(MAKE) $(MFLAGS) install - - install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ -- $(ETCDIR)/chap-secrets -+ $(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client - - install-devel: - cd pppd; $(MAKE) $(MFLAGS) install-devel -@@ -37,6 +37,10 @@ - $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ - $(ETCDIR)/chap-secrets: - $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ -+$(ETCDIR)/eaptls-server: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-server $@ -+$(ETCDIR)/eaptls-client: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-client $@ - - $(BINDIR): - $(INSTALL) -d -m 755 $@ -diff -Naur ppp-2.4.8/pppd/Makefile.linux ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.linux ---- ppp-2.4.8/pppd/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.linux 2020-04-07 10:10:01.427104384 +0200 -@@ -11,16 +11,16 @@ - - TARGETS = pppd - --PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c md5.c ccp.c \ -- ecp.c ipxcp.c auth.c options.c sys-linux.c md4.c chap_ms.c \ -+PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c ccp.c \ -+ ecp.c ipxcp.c auth.c options.c sys-linux.c chap_ms.c \ - demand.c utils.c tty.c eap.c chap-md5.c session.c - - HEADERS = ccp.h session.h chap-new.h ecp.h fsm.h ipcp.h \ -- ipxcp.h lcp.h magic.h md5.h patchlevel.h pathnames.h pppd.h \ -+ ipxcp.h lcp.h magic.h patchlevel.h pathnames.h pppd.h \ - upap.h eap.h - - MANPAGES = pppd.8 --PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o md5.o ccp.o \ -+PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o ccp.o \ - ecp.o auth.o options.o demand.o utils.o sys-linux.o ipxcp.o tty.o \ - eap.o chap-md5.o session.o - -@@ -81,6 +81,13 @@ - # Use libutil - USE_LIBUTIL=y - -+# Enable EAP-TLS authentication (requires MPPE support, libssl and libcrypto) -+USE_EAPTLS=y -+ -+# Either use the internal {md5,sha1} routines or use the openssl versions -+USE_OPENSSL_MD5=y -+USE_OPENSSL_SHA1=y -+ - MAXOCTETS=y - - INCLUDE_DIRS= -I../include -@@ -92,8 +99,9 @@ - ifdef CHAPMS - CFLAGS += -DCHAPMS=1 - NEEDDES=y --PPPDOBJS += md4.o chap_ms.o -+PPPDSRC += md4.c chap_ms.c - HEADERS += md4.h chap_ms.h -+PPPDOBJS += md4.o chap_ms.o - ifdef MSLANMAN - CFLAGS += -DMSLANMAN=1 - endif -@@ -111,11 +119,31 @@ - MANPAGES += srp-entry.8 - EXTRACLEAN += srp-entry.o - NEEDDES=y -+endif -+ -+# EAP-TLS -+ifdef USE_EAPTLS -+CFLAGS += -DUSE_EAPTLS=1 -+LIBS += -lssl -lcrypto -+PPPDSRC += eap-tls.c -+HEADERS += eap-tls.h -+PPPDOBJS += eap-tls.o -+endif -+ -+ifdef USE_OPENSSL_MD5 -+CFLAGS += -DUSE_OPENSSL_MD5=1 -+LIBS += -lcrypto -+else -+PPPDSRC += md5.c -+HEADERS += md5.h -+PPPDOBJS += md5.o -+endif -+ -+ifdef USE_OPENSSL_SHA1 -+CFLAGS += -DUSE_OPENSSL_SHA1=1 -+LIBS += -lcrypto - else --# OpenSSL has an integrated version of SHA-1, and its implementation --# is incompatible with this local SHA-1 implementation. We must use --# one or the other, not both. --PPPDSRCS += sha1.c -+PPPDSRC += sha1.c - HEADERS += sha1.h - PPPDOBJS += sha1.o - endif -diff -Naur ppp-2.4.8/pppd/Makefile.sol2 ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.sol2 ---- ppp-2.4.8/pppd/Makefile.sol2 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/Makefile.sol2 2020-04-07 10:09:50.566118204 +0200 -@@ -5,10 +5,10 @@ - - include ../Makedefs.com - --CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="@DESTDIR@"' -+CFLAGS = -I../include -DSVR4 -DSOL2 $(COPTS) '-DDESTDIR="/usr/local"' - LIBS = -lsocket -lnsl - --OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o md5.o \ -+OBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o eap.o \ - tty.o ccp.o ecp.o auth.o options.o demand.o utils.o sys-solaris.o \ - chap-md5.o session.o - -@@ -37,7 +37,21 @@ - - # Uncomment to enable MS-CHAP - CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H --OBJS += chap_ms.o pppcrypt.o md4.o sha1.o -+OBJS += chap_ms.o pppcrypt.o md4.o -+ -+# Uncomment to enable MPPE (in both CHAP and EAP-TLS) -+CFLAGS += -DMPPE -+ -+# Uncomment to use the OpenSSL {md5,sha1} routines -+#CFLAGS += -DUSE_OPENSSL_MD5 -DUSE_OPENSSL_SHA1 -+#LIBS += -lcrypto -+# else -+OBJS += md5.o sha1.o -+ -+# Uncomment to enable EAP-TLS -+CFLAGS += -DUSE_EAPTLS -+LIBS += -lcrypto -lssl -+OBJS += eap-tls.o - - # Uncomment for CBCP - #CFLAGS += -DCBCP_SUPPORT -diff -Naur ppp-2.4.8/pppd/auth.c ppp-2.4.8-eaptls-mppe-1.300/pppd/auth.c ---- ppp-2.4.8/pppd/auth.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/auth.c 2020-04-07 10:09:50.567118203 +0200 -@@ -113,6 +113,9 @@ - #include "upap.h" - #include "chap-new.h" - #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#endif - #ifdef CBCP_SUPPORT - #include "cbcp.h" - #endif -@@ -186,6 +189,11 @@ - /* Hook for a plugin to get the CHAP password for authenticating us */ - int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; - -+#ifdef USE_EAPTLS -+/* Hook for a plugin to get the EAP-TLS password for authenticating us */ -+int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL; -+#endif -+ - /* Hook for a plugin to say whether it is OK if the peer - refuses to authenticate. */ - int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -241,6 +249,16 @@ - bool explicit_user = 0; /* Set if "user" option supplied */ - bool explicit_passwd = 0; /* Set if "password" option supplied */ - char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ -+#ifdef USE_EAPTLS -+char *cacert_file = NULL; /* CA certificate file (pem format) */ -+char *ca_path = NULL; /* directory with CA certificates */ -+char *cert_file = NULL; /* client certificate file (pem format) */ -+char *privkey_file = NULL; /* client private key file (pem format) */ -+char *crl_dir = NULL; /* directory containing CRL files */ -+char *crl_file = NULL; /* Certificate Revocation List (CRL) file (pem format) */ -+char *max_tls_version = NULL; /* Maximum TLS protocol version (default=1.2) */ -+bool need_peer_eap = 0; /* Require peer to authenticate us */ -+#endif - - static char *uafname; /* name of most recent +ua file */ - -@@ -257,6 +275,19 @@ - static int have_chap_secret __P((char *, char *, int, int *)); - static int have_srp_secret __P((char *client, char *server, int need_ip, - int *lacks_ipp)); -+ -+#ifdef USE_EAPTLS -+static int have_eaptls_secret_server -+__P((char *client, char *server, int need_ip, int *lacks_ipp)); -+static int have_eaptls_secret_client __P((char *client, char *server)); -+static int scan_authfile_eaptls __P((FILE * f, char *client, char *server, -+ char *cli_cert, char *serv_cert, -+ char *ca_cert, char *pk, -+ struct wordlist ** addrs, -+ struct wordlist ** opts, -+ char *filename, int flags)); -+#endif -+ - static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); - static int scan_authfile __P((FILE *, char *, char *, char *, - struct wordlist **, struct wordlist **, -@@ -404,6 +435,18 @@ - "Set telephone number(s) which are allowed to connect", - OPT_PRIV | OPT_A2LIST }, - -+#ifdef USE_EAPTLS -+ { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, -+ { "capath", o_string, &ca_path, "EAP-TLS CA certificate directory" }, -+ { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, -+ { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, -+ { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, -+ { "crl", o_string, &crl_file, "Use specific CRL file" }, -+ { "max-tls-version", o_string, &max_tls_version, -+ "Maximum TLS version (1.0/1.1/1.2 (default)/1.3)" }, -+ { "need-peer-eap", o_bool, &need_peer_eap, -+ "Require the peer to authenticate us", 1 }, -+#endif /* USE_EAPTLS */ - { NULL } - }; - -@@ -737,6 +780,9 @@ - lcp_options *wo = &lcp_wantoptions[unit]; - lcp_options *go = &lcp_gotoptions[unit]; - lcp_options *ho = &lcp_hisoptions[unit]; -+#ifdef USE_EAPTLS -+ lcp_options *ao = &lcp_allowoptions[unit]; -+#endif - int i; - struct protent *protp; - -@@ -771,6 +817,22 @@ - } - } - -+#ifdef USE_EAPTLS -+ if (need_peer_eap && !ao->neg_eap) { -+ warn("eap required to authenticate us but no suitable secrets"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_AUTH_TOPEER_FAILED; -+ return; -+ } -+ -+ if (need_peer_eap && !ho->neg_eap) { -+ warn("peer doesn't want to authenticate us with eap"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_PEER_AUTH_FAILED; -+ return; -+ } -+#endif -+ - new_phase(PHASE_AUTHENTICATE); - auth = 0; - if (go->neg_eap) { -@@ -1291,6 +1353,15 @@ - our_name, 1, &lacks_ip); - } - -+#ifdef USE_EAPTLS -+ if (!can_auth && wo->neg_eap) { -+ can_auth = -+ have_eaptls_secret_server((explicit_remote ? remote_name : -+ NULL), our_name, 1, &lacks_ip); -+ -+ } -+#endif -+ - if (auth_required && !can_auth && noauth_addrs == NULL) { - if (default_auth) { - option_error( -@@ -1345,7 +1416,11 @@ - passwd[0] != 0 || - (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, - (explicit_remote? remote_name: NULL), 0, NULL))) || -- have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)); -+ have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL) -+#ifdef USE_EAPTLS -+ || have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL)) -+#endif -+ ); - - hadchap = -1; - if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1360,8 +1435,14 @@ - !have_chap_secret((explicit_remote? remote_name: NULL), our_name, - 1, NULL))) && - !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, -- NULL)) -+ NULL) -+#ifdef USE_EAPTLS -+ && !have_eaptls_secret_server((explicit_remote? remote_name: NULL), -+ our_name, 1, NULL) -+#endif -+ ) - go->neg_eap = 0; -+ - } - - -@@ -1721,6 +1802,7 @@ - } - - -+ - /* - * get_secret - open the CHAP secret file and return the secret - * for authenticating the given client on the given server. -@@ -2373,3 +2455,345 @@ - - auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); - } -+ -+ -+#ifdef USE_EAPTLS -+static int -+have_eaptls_secret_server(client, server, need_ip, lacks_ipp) -+ char *client; -+ char *server; -+ int need_ip; -+ int *lacks_ipp; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ filename = _PATH_EAPTLSSERVFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile, -+ clicertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (ret >= 0 && need_ip && !some_ip_ok(addrs)) { -+ if (lacks_ipp != 0) -+ *lacks_ipp = 1; -+ ret = -1; -+ } -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+have_eaptls_secret_client(client, server) -+ char *client; -+ char *server; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs = NULL; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ if ((cacert_file || ca_path) && cert_file && privkey_file) -+ return 1; -+ -+ filename = _PATH_EAPTLSCLIFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile, -+ servcertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk, -+ addrs, opts, filename, flags) -+ FILE *f; -+ char *client; -+ char *server; -+ char *cli_cert; -+ char *serv_cert; -+ char *ca_cert; -+ char *pk; -+ struct wordlist **addrs; -+ struct wordlist **opts; -+ char *filename; -+ int flags; -+{ -+ int newline; -+ int got_flag, best_flag; -+ struct wordlist *ap, *addr_list, *alist, **app; -+ char word[MAXWORDLEN]; -+ -+ if (addrs != NULL) -+ *addrs = NULL; -+ if (opts != NULL) -+ *opts = NULL; -+ addr_list = NULL; -+ if (!getword(f, word, &newline, filename)) -+ return -1; /* file is empty??? */ -+ newline = 1; -+ best_flag = -1; -+ for (;;) { -+ /* -+ * Skip until we find a word at the start of a line. -+ */ -+ while (!newline && getword(f, word, &newline, filename)); -+ if (!newline) -+ break; /* got to end of file */ -+ -+ /* -+ * Got a client - check if it's a match or a wildcard. -+ */ -+ got_flag = 0; -+ if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) { -+ newline = 0; -+ continue; -+ } -+ if (!ISWILD(word)) -+ got_flag = NONWILD_CLIENT; -+ -+ /* -+ * Now get a server and check if it matches. -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (!ISWILD(word)) { -+ if (server != NULL && strcmp(word, server) != 0) -+ continue; -+ got_flag |= NONWILD_SERVER; -+ } -+ -+ /* -+ * Got some sort of a match - see if it's better than what -+ * we have already. -+ */ -+ if (got_flag <= best_flag) -+ continue; -+ -+ /* -+ * Get the cli_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(cli_cert, word, MAXWORDLEN); -+ } else -+ cli_cert[0] = 0; -+ -+ /* -+ * Get serv_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(serv_cert, word, MAXWORDLEN); -+ } else -+ serv_cert[0] = 0; -+ -+ /* -+ * Get ca_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(ca_cert, word, MAXWORDLEN); -+ -+ /* -+ * Get pk -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(pk, word, MAXWORDLEN); -+ -+ -+ /* -+ * Now read address authorization info and make a wordlist. -+ */ -+ app = &alist; -+ for (;;) { -+ if (!getword(f, word, &newline, filename) || newline) -+ break; -+ ap = (struct wordlist *) -+ malloc(sizeof(struct wordlist) + strlen(word) + 1); -+ if (ap == NULL) -+ novm("authorized addresses"); -+ ap->word = (char *) (ap + 1); -+ strcpy(ap->word, word); -+ *app = ap; -+ app = &ap->next; -+ } -+ *app = NULL; -+ /* -+ * This is the best so far; remember it. -+ */ -+ best_flag = got_flag; -+ if (addr_list) -+ free_wordlist(addr_list); -+ addr_list = alist; -+ -+ if (!newline) -+ break; -+ } -+ -+ /* scan for a -- word indicating the start of options */ -+ for (app = &addr_list; (ap = *app) != NULL; app = &ap->next) -+ if (strcmp(ap->word, "--") == 0) -+ break; -+ /* ap = start of options */ -+ if (ap != NULL) { -+ ap = ap->next; /* first option */ -+ free(*app); /* free the "--" word */ -+ *app = NULL; /* terminate addr list */ -+ } -+ if (opts != NULL) -+ *opts = ap; -+ else if (ap != NULL) -+ free_wordlist(ap); -+ if (addrs != NULL) -+ *addrs = addr_list; -+ else if (addr_list != NULL) -+ free_wordlist(addr_list); -+ -+ return best_flag; -+} -+ -+ -+int -+get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -+ cacertfile, capath, pkfile, am_server) -+ int unit; -+ char *client; -+ char *server; -+ char *clicertfile; -+ char *servcertfile; -+ char *cacertfile; -+ char *capath; -+ char *pkfile; -+ int am_server; -+{ -+ FILE *fp; -+ int ret; -+ char *filename = NULL; -+ struct wordlist *addrs = NULL; -+ struct wordlist *opts = NULL; -+ -+ /* maybe overkill, but it eases debugging */ -+ bzero(clicertfile, MAXWORDLEN); -+ bzero(servcertfile, MAXWORDLEN); -+ bzero(cacertfile, MAXWORDLEN); -+ bzero(capath, MAXWORDLEN); -+ bzero(pkfile, MAXWORDLEN); -+ -+ /* the ca+cert+privkey can also be specified as options */ -+ if (!am_server && (cacert_file || ca_path) && cert_file && privkey_file ) -+ { -+ strlcpy( clicertfile, cert_file, MAXWORDLEN ); -+ if (cacert_file) -+ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); -+ if (ca_path) -+ strlcpy( capath, ca_path, MAXWORDLEN ); -+ strlcpy( pkfile, privkey_file, MAXWORDLEN ); -+ } -+ else -+ { -+ filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE); -+ addrs = NULL; -+ -+ fp = fopen(filename, "r"); -+ if (fp == NULL) -+ { -+ error("Can't open eap-tls secret file %s: %m", filename); -+ return 0; -+ } -+ -+ check_access(fp, filename); -+ -+ ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, &opts, filename, 0); -+ -+ fclose(fp); -+ -+ if (ret < 0) return 0; -+ } -+ -+ if (eaptls_passwd_hook) -+ { -+ dbglog( "Calling eaptls password hook" ); -+ if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0) -+ { -+ error("Unable to obtain EAP-TLS password for %s (%s) from plugin", -+ client, pkfile); -+ return 0; -+ } -+ } -+ if (am_server) -+ set_allowed_addrs(unit, addrs, opts); -+ else if (opts != NULL) -+ free_wordlist(opts); -+ if (addrs != NULL) -+ free_wordlist(addrs); -+ -+ return 1; -+} -+#endif -+ -diff -Naur ppp-2.4.8/pppd/ccp.c ppp-2.4.8-eaptls-mppe-1.300/pppd/ccp.c ---- ppp-2.4.8/pppd/ccp.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/ccp.c 2020-04-07 10:09:50.567118203 +0200 -@@ -539,6 +539,9 @@ - if (go->mppe) { - ccp_options *ao = &ccp_allowoptions[f->unit]; - int auth_mschap_bits = auth_done[f->unit]; -+#ifdef USE_EAPTLS -+ int auth_eap_bits = auth_done[f->unit]; -+#endif - int numbits; - - /* -@@ -566,8 +569,23 @@ - lcp_close(f->unit, "MPPE required but not available"); - return; - } -+ -+#ifdef USE_EAPTLS -+ /* -+ * MPPE is also possible in combination with EAP-TLS. -+ * It is not possible to detect if we're doing EAP or EAP-TLS -+ * at this stage, hence we accept all forms of EAP. If TLS is -+ * not used then the MPPE keys will not be derived anyway. -+ */ -+ /* Leave only the eap auth bits set */ -+ auth_eap_bits &= (EAP_WITHPEER | EAP_PEER ); -+ -+ if ((numbits == 0) && (auth_eap_bits == 0)) { -+ error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed."); -+#else - if (!numbits) { -- error("MPPE required, but MS-CHAP[v2] auth not performed."); -+ error("MPPE required, but MS-CHAP[v2] auth not performed."); -+#endif - lcp_close(f->unit, "MPPE required but not available"); - return; - } -diff -Naur ppp-2.4.8/pppd/chap-md5.c ppp-2.4.8-eaptls-mppe-1.300/pppd/chap-md5.c ---- ppp-2.4.8/pppd/chap-md5.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/chap-md5.c 2020-04-07 10:09:50.567118203 +0200 -@@ -36,7 +36,11 @@ - #include "chap-new.h" - #include "chap-md5.h" - #include "magic.h" -+#ifdef USE_OPENSSL_MD5 -+#include "openssl/md5.h" -+#else - #include "md5.h" -+#endif /* USE_OPENSSL_MD5 */ - - #define MD5_HASH_SIZE 16 - #define MD5_MIN_CHALLENGE 16 -diff -Naur ppp-2.4.8/pppd/chap_ms.c ppp-2.4.8-eaptls-mppe-1.300/pppd/chap_ms.c ---- ppp-2.4.8/pppd/chap_ms.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/chap_ms.c 2020-04-07 10:09:50.567118203 +0200 -@@ -534,7 +534,7 @@ - char *username, u_char Challenge[8]) - - { -- SHA1_CTX sha1Context; -+ SHA_CTX sha1Context; - u_char sha1Hash[SHA1_SIGNATURE_SIZE]; - char *user; - -@@ -670,7 +670,7 @@ - 0x6E }; - - int i; -- SHA1_CTX sha1Context; -+ SHA_CTX sha1Context; - u_char Digest[SHA1_SIGNATURE_SIZE]; - u_char Challenge[8]; - -@@ -724,7 +724,7 @@ - void - mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) - { -- SHA1_CTX sha1Context; -+ SHA_CTX sha1Context; - u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ - - SHA1_Init(&sha1Context); -@@ -768,7 +768,7 @@ - mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], - u_char NTResponse[24], int IsServer) - { -- SHA1_CTX sha1Context; -+ SHA_CTX sha1Context; - u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ - u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ - -diff -Naur ppp-2.4.8/pppd/eap-tls.c ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.c ---- ppp-2.4.8/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.c 2020-04-07 10:09:50.568118202 +0200 -@@ -0,0 +1,1560 @@ -+/* * eap-tls.c - EAP-TLS implementation for PPP -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * Jan Just Keijser 2006-2019 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "pppd.h" -+#include "eap.h" -+#include "eap-tls.h" -+#include "fsm.h" -+#include "lcp.h" -+#include "pathnames.h" -+ -+typedef struct pw_cb_data -+{ -+ const void *password; -+ const char *prompt_info; -+} PW_CB_DATA; -+ -+/* The openssl configuration file and engines can be loaded only once */ -+static CONF *ssl_config = NULL; -+static ENGINE *cert_engine = NULL; -+static ENGINE *pkey_engine = NULL; -+ -+/* TLSv1.3 do we have a session ticket ? */ -+static int have_session_ticket = 0; -+ -+int ssl_verify_callback(int, X509_STORE_CTX *); -+void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -+ size_t len, SSL * ssl, void *arg); -+int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); -+ -+X509 *get_X509_from_file(char *filename); -+int ssl_cmp_certs(char *filename, X509 * a); -+ -+#ifdef MPPE -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ -+/* -+ * The following stuff is only needed if SSL_export_keying_material() is not available -+ */ -+ -+#if OPENSSL_VERSION_NUMBER < 0x10001000L -+ -+/* -+ * https://wiki.openssl.org/index.php/1.1_API_Changes -+ * tries to provide some guidance but ultimately falls short. -+ * -+ */ -+ -+static void HMAC_CTX_free(HMAC_CTX *ctx) -+{ -+ if (ctx != NULL) { -+ HMAC_CTX_cleanup(ctx); -+ OPENSSL_free(ctx); -+ } -+} -+ -+static HMAC_CTX *HMAC_CTX_new(void) -+{ -+ HMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx)); -+ if (ctx != NULL) -+ HMAC_CTX_init(ctx); -+ return ctx; -+} -+ -+static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, -+ size_t outlen) -+{ -+ if (outlen == 0) -+ return sizeof(ssl->s3->client_random); -+ if (outlen > sizeof(ssl->s3->client_random)) -+ outlen = sizeof(ssl->s3->client_random); -+ memcpy(out, ssl->s3->client_random, outlen); -+ return outlen; -+} -+ -+static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, -+ size_t outlen) -+{ -+ if (outlen == 0) -+ return sizeof(ssl->s3->server_random); -+ if (outlen > sizeof(ssl->s3->server_random)) -+ outlen = sizeof(ssl->s3->server_random); -+ memcpy(out, ssl->s3->server_random, outlen); -+ return outlen; -+} -+ -+static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, -+ unsigned char *out, size_t outlen) -+{ -+ if (outlen == 0) -+ return session->master_key_length; -+ if (outlen > session->master_key_length) -+ outlen = session->master_key_length; -+ memcpy(out, session->master_key, outlen); -+ return outlen; -+} -+ -+ -+/* -+ * TLS PRF from RFC 2246 -+ */ -+static void P_hash(const EVP_MD *evp_md, -+ const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned int out_len) -+{ -+ HMAC_CTX *ctx_a, *ctx_out; -+ unsigned char a[HMAC_MAX_MD_CBLOCK]; -+ unsigned int size; -+ -+ ctx_a = HMAC_CTX_new(); -+ ctx_out = HMAC_CTX_new(); -+ HMAC_Init_ex(ctx_a, secret, secret_len, evp_md, NULL); -+ HMAC_Init_ex(ctx_out, secret, secret_len, evp_md, NULL); -+ -+ size = HMAC_size(ctx_out); -+ -+ /* Calculate A(1) */ -+ HMAC_Update(ctx_a, seed, seed_len); -+ HMAC_Final(ctx_a, a, NULL); -+ -+ while (1) { -+ /* Calculate next part of output */ -+ HMAC_Update(ctx_out, a, size); -+ HMAC_Update(ctx_out, seed, seed_len); -+ -+ /* Check if last part */ -+ if (out_len < size) { -+ HMAC_Final(ctx_out, a, NULL); -+ memcpy(out, a, out_len); -+ break; -+ } -+ -+ /* Place digest in output buffer */ -+ HMAC_Final(ctx_out, out, NULL); -+ HMAC_Init_ex(ctx_out, NULL, 0, NULL, NULL); -+ out += size; -+ out_len -= size; -+ -+ /* Calculate next A(i) */ -+ HMAC_Init_ex(ctx_a, NULL, 0, NULL, NULL); -+ HMAC_Update(ctx_a, a, size); -+ HMAC_Final(ctx_a, a, NULL); -+ } -+ -+ HMAC_CTX_free(ctx_a); -+ HMAC_CTX_free(ctx_out); -+ memset(a, 0, sizeof(a)); -+} -+ -+static void PRF(const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned char *buf, unsigned int out_len) -+{ -+ unsigned int i; -+ unsigned int len = (secret_len + 1) / 2; -+ const unsigned char *s1 = secret; -+ const unsigned char *s2 = secret + (secret_len - len); -+ -+ P_hash(EVP_md5(), s1, len, seed, seed_len, out, out_len); -+ P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len); -+ -+ for (i=0; i < out_len; i++) { -+ out[i] ^= buf[i]; -+ } -+} -+ -+static int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, -+ const char *label, size_t llen, -+ const unsigned char *p, size_t plen, -+ int use_context) -+{ -+ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; -+ unsigned char buf[4*EAPTLS_MPPE_KEY_LEN]; -+ unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH]; -+ size_t master_key_length; -+ unsigned char *pp; -+ -+ pp = seed; -+ -+ memcpy(pp, label, llen); -+ pp += llen; -+ -+ llen += SSL_get_client_random(s, pp, SSL3_RANDOM_SIZE); -+ pp += SSL3_RANDOM_SIZE; -+ -+ llen += SSL_get_server_random(s, pp, SSL3_RANDOM_SIZE); -+ -+ master_key_length = SSL_SESSION_get_master_key(SSL_get_session(s), master_key, -+ sizeof(master_key)); -+ PRF(master_key, master_key_length, seed, llen, out, buf, olen); -+ -+ return 1; -+} -+ -+#endif /* OPENSSL_VERSION_NUMBER < 0x10001000L */ -+ -+ -+/* -+ * OpenSSL 1.1+ introduced a generic TLS_method() -+ * For older releases we substitute the appropriate method -+ */ -+ -+#if OPENSSL_VERSION_NUMBER < 0x10100000L -+ -+#define TLS_method SSLv23_method -+ -+#define SSL3_RT_HEADER 0x100 -+ -+#ifndef SSL_CTX_set_max_proto_version -+/** Mimics SSL_CTX_set_max_proto_version for OpenSSL < 1.1 */ -+static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) -+{ -+ long sslopt = 0; -+ -+ if (tls_ver_max < TLS1_VERSION) -+ { -+ sslopt |= SSL_OP_NO_TLSv1; -+ } -+#ifdef SSL_OP_NO_TLSv1_1 -+ if (tls_ver_max < TLS1_1_VERSION) -+ { -+ sslopt |= SSL_OP_NO_TLSv1_1; -+ } -+#endif -+#ifdef SSL_OP_NO_TLSv1_2 -+ if (tls_ver_max < TLS1_2_VERSION) -+ { -+ sslopt |= SSL_OP_NO_TLSv1_2; -+ } -+#endif -+ SSL_CTX_set_options(ctx, sslopt); -+ -+ return 1; -+} -+#endif /* SSL_CTX_set_max_proto_version */ -+ -+#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ -+ -+ -+/* -+ * Generate keys according to RFC 2716 and add to reply -+ */ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) -+{ -+ unsigned char out[4*EAPTLS_MPPE_KEY_LEN]; -+ const char *prf_label; -+ size_t prf_size; -+ unsigned char eap_tls13_context[] = { EAPT_TLS }; -+ unsigned char *context = NULL; -+ size_t context_len = 0; -+ unsigned char *p; -+ -+ dbglog("EAP-TLS generating MPPE keys"); -+ if (ets->tls_v13) -+ { -+ prf_label = "EXPORTER_EAP_TLS_Key_Material"; -+ context = eap_tls13_context; -+ context_len = 1; -+ } -+ else -+ { -+ prf_label = "client EAP encryption"; -+ } -+ -+ dbglog("EAP-TLS PRF label = %s", prf_label); -+ prf_size = strlen(prf_label); -+ if (SSL_export_keying_material(ets->ssl, out, sizeof(out), prf_label, prf_size, -+ context, context_len, 0) != 1) -+ { -+ warn( "EAP-TLS: Failed generating keying material" ); -+ return; -+ } -+ -+ /* -+ * We now have the master send and receive keys. -+ * From these, generate the session send and receive keys. -+ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) -+ */ -+ if (client) -+ { -+ p = out; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ } -+ else -+ { -+ p = out; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ } -+ -+ mppe_keys_set = 1; -+} -+ -+#endif /* MPPE */ -+ -+void log_ssl_errors( void ) -+{ -+ unsigned long ssl_err = ERR_get_error(); -+ -+ if (ssl_err != 0) -+ dbglog("EAP-TLS SSL error stack:"); -+ while (ssl_err != 0) { -+ dbglog( ERR_error_string( ssl_err, NULL ) ); -+ ssl_err = ERR_get_error(); -+ } -+} -+ -+ -+int password_callback (char *buf, int size, int rwflag, void *u) -+{ -+ if (buf) -+ { -+ strncpy (buf, passwd, size); -+ return strlen (buf); -+ } -+ return 0; -+} -+ -+ -+CONF *eaptls_ssl_load_config( void ) -+{ -+ CONF *config; -+ int ret_code; -+ long error_line = 33; -+ -+ config = NCONF_new( NULL ); -+ dbglog( "Loading OpenSSL config file" ); -+ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); -+ if (ret_code == 0) -+ { -+ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); -+ NCONF_free( config ); -+ config = NULL; -+ ERR_clear_error(); -+ } -+ -+ dbglog( "Loading OpenSSL built-ins" ); -+ ENGINE_load_builtin_engines(); -+ OPENSSL_load_builtin_modules(); -+ -+ dbglog( "Loading OpenSSL configured modules" ); -+ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) -+ { -+ warn( "EAP-TLS: Error loading OpenSSL modules" ); -+ log_ssl_errors(); -+ config = NULL; -+ } -+ -+ return config; -+} -+ -+ENGINE *eaptls_ssl_load_engine( char *engine_name ) -+{ -+ ENGINE *e = NULL; -+ -+ dbglog( "Enabling OpenSSL auto engines" ); -+ ENGINE_register_all_complete(); -+ -+ dbglog( "Loading OpenSSL '%s' engine support", engine_name ); -+ e = ENGINE_by_id( engine_name ); -+ if (!e) -+ { -+ dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); -+ e = ENGINE_by_id( "dynamic" ); -+ if (e) -+ { -+ if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0) -+ || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) -+ { -+ warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ else -+ { -+ warn( "EAP-TLS: Cannot load dynamic engine support" ); -+ } -+ } -+ -+ if (e) -+ { -+ dbglog( "Initialising engine" ); -+ if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) -+ { -+ warn( "EAP-TLS: Cannot use that engine" ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ -+ return e; -+} -+ -+/* -+ * Initialize the SSL stacks and tests if certificates, key and crl -+ * for client or server use can be loaded. -+ */ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, -+ char *certfile, char *peer_certfile, char *privkeyfile) -+{ -+ char *cert_engine_name = NULL; -+ char *cert_identifier = NULL; -+ char *pkey_engine_name = NULL; -+ char *pkey_identifier = NULL; -+ SSL_CTX *ctx; -+ SSL *ssl; -+ X509_STORE *certstore; -+ X509_LOOKUP *lookup; -+ X509 *tmp; -+ int ret; -+#if defined(TLS1_2_VERSION) -+ long tls_version = TLS1_2_VERSION; -+#elif defined(TLS1_1_VERSION) -+ long tls_version = TLS1_1_VERSION; -+#else -+ long tls_version = TLS1_VERSION; -+#endif -+ -+ /* -+ * Without these can't continue -+ */ -+ if (!(cacertfile[0] || capath[0])) -+ { -+ error("EAP-TLS: CA certificate file or path missing"); -+ return NULL; -+ } -+ -+ if (!certfile[0]) -+ { -+ error("EAP-TLS: Certificate missing"); -+ return NULL; -+ } -+ -+ if (!privkeyfile[0]) -+ { -+ error("EAP-TLS: Private key missing"); -+ return NULL; -+ } -+ -+ SSL_library_init(); -+ SSL_load_error_strings(); -+ -+ ctx = SSL_CTX_new(TLS_method()); -+ -+ if (!ctx) { -+ error("EAP-TLS: Cannot initialize SSL CTX context"); -+ goto fail; -+ } -+ -+ /* if the certificate filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the certificate filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL ) -+ { -+ cert_identifier = index( certfile, ':' ); -+ -+ if (cert_identifier) -+ { -+ cert_engine_name = certfile; -+ *cert_identifier = '\0'; -+ cert_identifier++; -+ -+ dbglog( "Found certificate engine '%s'", cert_engine_name ); -+ dbglog( "Found certificate identifier '%s'", cert_identifier ); -+ } -+ } -+ -+ /* if the privatekey filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the privatekey filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL ) -+ { -+ pkey_identifier = index( privkeyfile, ':' ); -+ -+ if (pkey_identifier) -+ { -+ pkey_engine_name = privkeyfile; -+ *pkey_identifier = '\0'; -+ pkey_identifier++; -+ -+ dbglog( "Found privatekey engine '%s'", pkey_engine_name ); -+ dbglog( "Found privatekey identifier '%s'", pkey_identifier ); -+ } -+ } -+ -+ if (cert_identifier && pkey_identifier) -+ { -+ if (strlen( cert_identifier ) == 0) -+ { -+ if (strlen( pkey_identifier ) == 0) -+ error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" ); -+ else -+ { -+ dbglog( "Substituting privatekey identifier for certificate identifier" ); -+ cert_identifier = pkey_identifier; -+ } -+ } -+ else -+ { -+ if (strlen( pkey_identifier ) == 0) -+ { -+ dbglog( "Substituting certificate identifier for privatekey identifier" ); -+ pkey_identifier = cert_identifier; -+ } -+ } -+ -+ } -+ -+ /* load the openssl config file only once */ -+ if (!ssl_config) -+ { -+ if (cert_engine_name || pkey_engine_name) -+ ssl_config = eaptls_ssl_load_config(); -+ -+ if (ssl_config && cert_engine_name) -+ cert_engine = eaptls_ssl_load_engine( cert_engine_name ); -+ -+ if (ssl_config && pkey_engine_name) -+ { -+ /* don't load the same engine twice */ -+ if ( cert_engine && strcmp( cert_engine_name, pkey_engine_name) == 0 ) -+ pkey_engine = cert_engine; -+ else -+ pkey_engine = eaptls_ssl_load_engine( pkey_engine_name ); -+ } -+ } -+ -+ SSL_CTX_set_default_passwd_cb (ctx, password_callback); -+ -+ if (strlen(cacertfile) == 0) cacertfile = NULL; -+ if (strlen(capath) == 0) capath = NULL; -+ -+ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, capath)) -+ { -+ error("EAP-TLS: Cannot load verify locations"); -+ if (cacertfile) dbglog("CA certificate file = [%s]", cacertfile); -+ if (capath) dbglog("CA certificate path = [%s]", capath); -+ goto fail; -+ } -+ -+ if (init_server) -+ SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); -+ -+ if (cert_engine) -+ { -+ struct -+ { -+ const char *s_slot_cert_id; -+ X509 *cert; -+ } cert_info; -+ -+ cert_info.s_slot_cert_id = cert_identifier; -+ cert_info.cert = NULL; -+ -+ if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) ) -+ { -+ error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier ); -+ goto fail; -+ } -+ -+ if (cert_info.cert) -+ { -+ dbglog( "Got the certificate, adding it to SSL context" ); -+ dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) ); -+ if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_certificate_chain_file(ctx, certfile)) -+ { -+ error( "EAP-TLS: Cannot use public certificate %s", certfile ); -+ goto fail; -+ } -+ } -+ -+ -+ /* -+ * Check the Before and After dates of the certificate -+ */ -+ ssl = SSL_new(ctx); -+ tmp = SSL_get_certificate(ssl); -+ -+ ret = X509_cmp_time(X509_get_notBefore(tmp), NULL); -+ if (ret == 0) -+ { -+ warn( "EAP-TLS: Failed to read certificate notBefore field."); -+ } -+ if (ret > 0) -+ { -+ warn( "EAP-TLS: Your certificate is not yet valid!"); -+ } -+ -+ ret = X509_cmp_time(X509_get_notAfter(tmp), NULL); -+ if (ret == 0) -+ { -+ warn( "EAP-TLS: Failed to read certificate notAfter field."); -+ } -+ if (ret < 0) -+ { -+ warn( "EAP-TLS: Your certificate has expired!"); -+ } -+ SSL_free(ssl); -+ -+ if (pkey_engine) -+ { -+ EVP_PKEY *pkey = NULL; -+ PW_CB_DATA cb_data; -+ -+ cb_data.password = passwd; -+ cb_data.prompt_info = pkey_identifier; -+ -+ dbglog( "Loading private key '%s' from engine", pkey_identifier ); -+ pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data); -+ if (pkey) -+ { -+ dbglog( "Got the private key, adding it to SSL context" ); -+ if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM)) -+ { -+ error("EAP-TLS: Cannot use private key %s", privkeyfile); -+ goto fail; -+ } -+ } -+ -+ if (SSL_CTX_check_private_key(ctx) != 1) { -+ error("EAP-TLS: Private key %s fails security check", privkeyfile); -+ goto fail; -+ } -+ -+ /* Explicitly set the NO_TICKETS flag to support Win7/Win8 clients */ -+ SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 -+#ifdef SSL_OP_NO_TICKET -+ | SSL_OP_NO_TICKET -+#endif -+ ); -+ -+ /* OpenSSL 1.1.1+ does not include RC4 ciphers by default. -+ * This causes totally obsolete WinXP clients to fail. If you really -+ * need ppp+EAP-TLS+openssl 1.1.1+WinXP then enable RC4 cipers and -+ * make sure that you use an OpenSSL that supports them -+ -+ SSL_CTX_set_cipher_list(ctx, "RC4"); -+ */ -+ -+ -+ /* Set up a SSL Session cache with a callback. This is needed for TLSv1.3+. -+ * During the initial handshake the server signals to the client early on -+ * that the handshake is finished, even before the client has sent its -+ * credentials to the server. The actual connection (and moment that the -+ * client sends its credentials) only starts after the arrival of the first -+ * session ticket. The 'ssl_new_session_cb' catches this ticket. -+ */ -+ SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT | SSL_SESS_CACHE_NO_INTERNAL_STORE); -+ SSL_CTX_sess_set_new_cb(ctx, ssl_new_session_cb); -+ -+ /* As EAP-TLS+TLSv1.3 is highly experimental we offer the user a chance to override */ -+ if (max_tls_version) -+ { -+ if (strncmp(max_tls_version, "1.0", 3) == 0) -+ tls_version = TLS1_VERSION; -+ else if (strncmp(max_tls_version, "1.1", 3) == 0) -+ tls_version = TLS1_1_VERSION; -+ else if (strncmp(max_tls_version, "1.2", 3) == 0) -+#ifdef TLS1_2_VERSION -+ tls_version = TLS1_2_VERSION; -+#else -+ { -+ warn("TLSv1.2 not available. Defaulting to TLSv1.1"); -+ tls_version = TLS_1_1_VERSION; -+ } -+#endif -+ else if (strncmp(max_tls_version, "1.3", 3) == 0) -+#ifdef TLS1_3_VERSION -+ tls_version = TLS1_3_VERSION; -+#else -+ warn("TLSv1.3 not available."); -+#endif -+ } -+ -+ dbglog("EAP-TLS: Setting max protocol version to 0x%X", tls_version); -+ SSL_CTX_set_max_proto_version(ctx, tls_version); -+ -+ SSL_CTX_set_verify_depth(ctx, 5); -+ SSL_CTX_set_verify(ctx, -+ SSL_VERIFY_PEER | -+ SSL_VERIFY_FAIL_IF_NO_PEER_CERT, -+ &ssl_verify_callback); -+ -+ if (crl_dir) { -+ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { -+ error("EAP-TLS: Failed to get certificate store"); -+ goto fail; -+ } -+ -+ if (!(lookup = -+ X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) { -+ error("EAP-TLS: Store lookup for CRL failed"); -+ -+ goto fail; -+ } -+ -+ X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM); -+ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); -+ } -+ -+ if (crl_file) { -+ FILE *fp = NULL; -+ X509_CRL *crl = NULL; -+ -+ fp = fopen(crl_file, "r"); -+ if (!fp) { -+ error("EAP-TLS: Cannot open CRL file '%s'", crl_file); -+ goto fail; -+ } -+ -+ crl = PEM_read_X509_CRL(fp, NULL, NULL, NULL); -+ if (!crl) { -+ error("EAP-TLS: Cannot read CRL file '%s'", crl_file); -+ goto fail; -+ } -+ -+ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { -+ error("EAP-TLS: Failed to get certificate store"); -+ goto fail; -+ } -+ if (!X509_STORE_add_crl(certstore, crl)) { -+ error("EAP-TLS: Cannot add CRL to certificate store"); -+ goto fail; -+ } -+ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); -+ -+ } -+ -+ /* -+ * If a peer certificate file was specified, it must be valid, else fail -+ */ -+ if (peer_certfile[0]) { -+ if (!(tmp = get_X509_from_file(peer_certfile))) { -+ error("EAP-TLS: Error loading client certificate from file %s", -+ peer_certfile); -+ goto fail; -+ } -+ X509_free(tmp); -+ } -+ -+ return ctx; -+ -+fail: -+ log_ssl_errors(); -+ SSL_CTX_free(ctx); -+ return NULL; -+} -+ -+/* -+ * Determine the maximum packet size by looking at the LCP handshake -+ */ -+ -+int eaptls_get_mtu(int unit) -+{ -+ int mtu, mru; -+ -+ lcp_options *wo = &lcp_wantoptions[unit]; -+ lcp_options *go = &lcp_gotoptions[unit]; -+ lcp_options *ho = &lcp_hisoptions[unit]; -+ lcp_options *ao = &lcp_allowoptions[unit]; -+ -+ mtu = ho->neg_mru? ho->mru: PPP_MRU; -+ mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; -+ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; -+ -+ dbglog("MTU = %d", mtu); -+ return mtu; -+} -+ -+ -+/* -+ * Init the ssl handshake (server mode) -+ */ -+int eaptls_init_ssl_server(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char capath[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_server.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_server.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_server.ea_session; -+ -+ if (!esp->es_server.ea_peer) { -+ error("EAP-TLS: Error: client name not set (BUG)"); -+ return 0; -+ } -+ -+ strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); -+ -+ dbglog( "getting eaptls secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, clicertfile, -+ servcertfile, cacertfile, capath, pkfile, 1)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_server.ea_peer, esp->es_server.ea_name ); -+ return 0; -+ } -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ ets->ctx = eaptls_init_ssl(1, cacertfile, capath, servcertfile, clicertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ if (!(ets->ssl = SSL_new(ets->ctx))) -+ goto fail; -+ -+ /* -+ * Set auto-retry to avoid timeouts on BIO_read -+ */ -+ SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY); -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_accept_state(ets->ssl); -+ -+ ets->tls_v13 = 0; -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the client certificate file, store it in ets->peercertfile, -+ * so we can check it later in ssl_verify_callback() -+ */ -+ if (clicertfile[0]) -+ strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ SSL_CTX_free(ets->ctx); -+ return 0; -+} -+ -+/* -+ * Init the ssl handshake (client mode) -+ */ -+int eaptls_init_ssl_client(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char capath[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_client.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_client.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_client.ea_session; -+ -+ /* -+ * If available, copy server name in ets; it will be used in cert -+ * verify -+ */ -+ if (esp->es_client.ea_peer) -+ strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); -+ else -+ ets->peer[0] = 0; -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ dbglog( "calling get_eaptls_secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, -+ ets->peer, clicertfile, -+ servcertfile, cacertfile, capath, pkfile, 0)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_client.ea_name, ets->peer ); -+ return 0; -+ } -+ -+ dbglog( "calling eaptls_init_ssl" ); -+ ets->ctx = eaptls_init_ssl(0, cacertfile, capath, clicertfile, servcertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ ets->ssl = SSL_new(ets->ctx); -+ -+ if (!ets->ssl) -+ goto fail; -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ dbglog( "Initializing SSL BIOs" ); -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_connect_state(ets->ssl); -+ -+ ets->tls_v13 = 0; -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the server certificate file, store it in -+ * ets->peercertfile, so we can check it later in -+ * ssl_verify_callback() -+ */ -+ if (servcertfile[0]) -+ strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ dbglog( "eaptls_init_ssl_client: fail" ); -+ SSL_CTX_free(ets->ctx); -+ return 0; -+ -+} -+ -+void eaptls_free_session(struct eaptls_session *ets) -+{ -+ if (ets->ssl) -+ SSL_free(ets->ssl); -+ -+ if (ets->ctx) -+ SSL_CTX_free(ets->ctx); -+ -+ free(ets); -+} -+ -+ -+int eaptls_is_init_finished(struct eaptls_session *ets) -+{ -+ if (ets->ssl && SSL_is_init_finished(ets->ssl)) -+ { -+ if (ets->tls_v13) -+ return have_session_ticket; -+ else -+ return 1; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Handle a received packet, reassembling fragmented messages and -+ * passing them to the ssl engine -+ */ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) -+{ -+ u_char flags; -+ u_int tlslen = 0; -+ u_char dummy[65536]; -+ -+ if (len < 1) { -+ warn("EAP-TLS: received no or invalid data"); -+ return 1; -+ } -+ -+ GETCHAR(flags, inp); -+ len--; -+ -+ if (flags & EAP_TLS_FLAGS_LI && len > 4) { -+ /* -+ * LenghtIncluded flag set -> this is the first packet of a message -+ */ -+ -+ /* -+ * the first 4 octets are the length of the EAP-TLS message -+ */ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ -+ if (!ets->data) { -+ -+ if (tlslen > EAP_TLS_MAX_LEN) { -+ error("EAP-TLS: TLS message length > %d, truncated", EAP_TLS_MAX_LEN); -+ tlslen = EAP_TLS_MAX_LEN; -+ } -+ -+ /* -+ * Allocate memory for the whole message -+ */ -+ ets->data = malloc(tlslen); -+ if (!ets->data) -+ fatal("EAP-TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = tlslen; -+ } -+ else -+ warn("EAP-TLS: non-first LI packet? that's odd..."); -+ } -+ else if (!ets->data) { -+ /* -+ * A non fragmented message without LI flag -+ */ -+ -+ ets->data = malloc(len); -+ if (!ets->data) -+ fatal("EAP-TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = len; -+ } -+ -+ if (flags & EAP_TLS_FLAGS_MF) -+ ets->frag = 1; -+ else -+ ets->frag = 0; -+ -+ if (len < 0) { -+ warn("EAP-TLS: received malformed data"); -+ return 1; -+ } -+ -+ if (len + ets->datalen > ets->tlslen) { -+ warn("EAP-TLS: received data > TLS message length"); -+ return 1; -+ } -+ -+ BCOPY(inp, ets->data + ets->datalen, len); -+ ets->datalen += len; -+ -+ if (!ets->frag) { -+ -+ /* -+ * If we have the whole message, pass it to ssl -+ */ -+ -+ if (ets->datalen != ets->tlslen) { -+ warn("EAP-TLS: received data != TLS message length"); -+ return 1; -+ } -+ -+ if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1) -+ log_ssl_errors(); -+ -+ SSL_read(ets->ssl, dummy, 65536); -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Return an eap-tls packet in outp. -+ * A TLS message read from the ssl engine is buffered in ets->data. -+ * At each call we control if there is buffered data and send a -+ * packet of mtu bytes. -+ */ -+int eaptls_send(struct eaptls_session *ets, u_char ** outp) -+{ -+ bool first = 0; -+ int size; -+ u_char fromtls[65536]; -+ int res; -+ u_char *start; -+ -+ start = *outp; -+ -+ if (!ets->data) -+ { -+ if(!ets->alert_sent) -+ { -+ res = SSL_read(ets->ssl, fromtls, 65536); -+ } -+ -+ /* -+ * Read from ssl -+ */ -+ if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) -+ { -+ warn("EAP-TLS send: No data from BIO_read"); -+ return 1; -+ } -+ -+ ets->datalen = res; -+ -+ ets->data = malloc(ets->datalen); -+ BCOPY(fromtls, ets->data, ets->datalen); -+ -+ ets->offset = 0; -+ first = 1; -+ -+ } -+ -+ size = ets->datalen - ets->offset; -+ -+ if (size > ets->mtu) { -+ size = ets->mtu; -+ ets->frag = 1; -+ } else -+ ets->frag = 0; -+ -+ PUTCHAR(EAPT_TLS, *outp); -+ -+ /* -+ * Set right flags and length if necessary -+ */ -+ if (ets->frag && first) { -+ PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp); -+ PUTLONG(ets->datalen, *outp); -+ } else if (ets->frag) { -+ PUTCHAR(EAP_TLS_FLAGS_MF, *outp); -+ } else -+ PUTCHAR(0, *outp); -+ -+ /* -+ * Copy the data in outp -+ */ -+ BCOPY(ets->data + ets->offset, *outp, size); -+ INCPTR(size, *outp); -+ -+ /* -+ * Copy the packet in retransmission buffer -+ */ -+ BCOPY(start, &ets->rtx[0], *outp - start); -+ ets->rtx_len = *outp - start; -+ -+ ets->offset += size; -+ -+ if (ets->offset >= ets->datalen) { -+ -+ /* -+ * The whole message has been sent -+ */ -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->offset = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Get the sent packet from the retransmission buffer -+ */ -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp) -+{ -+ BCOPY(ets->rtx, *outp, ets->rtx_len); -+ INCPTR(ets->rtx_len, *outp); -+} -+ -+/* -+ * Verify a certificate. -+ * Most of the work (signatures and issuer attributes checking) -+ * is done by ssl; we check the CN in the peer certificate -+ * against the peer name. -+ */ -+int ssl_verify_callback(int ok, X509_STORE_CTX * ctx) -+{ -+ char subject[256]; -+ char cn_str[256]; -+ X509 *peer_cert; -+ int err, depth; -+ SSL *ssl; -+ struct eaptls_session *ets; -+ -+ peer_cert = X509_STORE_CTX_get_current_cert(ctx); -+ err = X509_STORE_CTX_get_error(ctx); -+ depth = X509_STORE_CTX_get_error_depth(ctx); -+ -+ dbglog("certificate verify depth: %d", depth); -+ -+ if (auth_required && !ok) { -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ dbglog("Certificate verification error:\n depth: %d CN: %s" -+ "\n err: %d (%s)\n", depth, cn_str, err, -+ X509_verify_cert_error_string(err)); -+ -+ return 0; -+ } -+ -+ ssl = X509_STORE_CTX_get_ex_data(ctx, -+ SSL_get_ex_data_X509_STORE_CTX_idx()); -+ -+ ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0); -+ -+ if (ets == NULL) { -+ error("Error: SSL_get_ex_data returned NULL"); -+ return 0; -+ } -+ -+ log_ssl_errors(); -+ -+ if (!depth) { /* This is the peer certificate */ -+ -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ /* -+ * If acting as client and the name of the server wasn't specified -+ * explicitely, we can't verify the server authenticity -+ */ -+ if (!ets->peer[0]) { -+ warn("Peer name not specified: no check"); -+ return ok; -+ } -+ -+ /* -+ * Check the CN -+ */ -+ if (strcmp(cn_str, ets->peer)) { -+ error -+ ("Certificate verification error: CN (%s) != peer_name (%s)", -+ cn_str, ets->peer); -+ return 0; -+ } -+ -+ warn("Certificate CN: %s , peer name %s", cn_str, ets->peer); -+ -+ /* -+ * If a peer certificate file was specified, here we check it -+ */ -+ if (ets->peercertfile[0]) { -+ if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert) -+ != 0) { -+ error -+ ("Peer certificate doesn't match stored certificate"); -+ return 0; -+ } -+ } -+ } -+ -+ return ok; -+} -+ -+/* -+ * Compare a certificate with the one stored in a file -+ */ -+int ssl_cmp_certs(char *filename, X509 * a) -+{ -+ X509 *b; -+ int ret; -+ -+ if (!(b = get_X509_from_file(filename))) -+ return 1; -+ -+ ret = X509_cmp(a, b); -+ X509_free(b); -+ -+ return ret; -+ -+} -+ -+X509 *get_X509_from_file(char *filename) -+{ -+ FILE *fp; -+ X509 *ret; -+ -+ if (!(fp = fopen(filename, "r"))) -+ return NULL; -+ -+ ret = PEM_read_X509(fp, NULL, NULL, NULL); -+ -+ fclose(fp); -+ -+ return ret; -+} -+ -+/* -+ * Every sent & received message this callback function is invoked, -+ * so we know when alert messages have arrived or are sent and -+ * we can print debug information about TLS handshake. -+ */ -+void -+ssl_msg_callback(int write_p, int version, int content_type, -+ const void *buf, size_t len, SSL * ssl, void *arg) -+{ -+ char string[256]; -+ struct eaptls_session *ets = (struct eaptls_session *)arg; -+ unsigned char code; -+ const unsigned char*msg = buf; -+ int hvers = msg[1] << 8 | msg[2]; -+ -+ if(write_p) -+ strcpy(string, " -> "); -+ else -+ strcpy(string, " <- "); -+ -+ switch(content_type) { -+ -+ case SSL3_RT_HEADER: -+ strcat(string, "SSL/TLS Header: "); -+ switch(hvers) { -+ case SSL3_VERSION: -+ strcat(string, "SSL 3.0"); -+ break; -+ case TLS1_VERSION: -+ strcat(string, "TLS 1.0"); -+ break; -+ case TLS1_1_VERSION: -+ strcat(string, "TLS 1.1"); -+ break; -+ case TLS1_2_VERSION: -+ strcat(string, "TLS 1.2"); -+ break; -+ default: -+ sprintf(string, "SSL/TLS Header: Unknown version (%d)", hvers); -+ } -+ break; -+ -+ case SSL3_RT_ALERT: -+ strcat(string, "Alert: "); -+ code = msg[1]; -+ -+ if (write_p) { -+ ets->alert_sent = 1; -+ ets->alert_sent_desc = code; -+ } else { -+ ets->alert_recv = 1; -+ ets->alert_recv_desc = code; -+ } -+ -+ strcat(string, SSL_alert_desc_string_long(code)); -+ break; -+ -+ case SSL3_RT_CHANGE_CIPHER_SPEC: -+ strcat(string, "ChangeCipherSpec"); -+ break; -+ -+#ifdef SSL3_RT_INNER_CONTENT_TYPE -+ case SSL3_RT_INNER_CONTENT_TYPE: -+ strcat(string, "InnerContentType (TLS1.3)"); -+ break; -+#endif -+ -+ case SSL3_RT_HANDSHAKE: -+ -+ strcat(string, "Handshake: "); -+ code = msg[0]; -+ -+ switch(code) { -+ case SSL3_MT_HELLO_REQUEST: -+ strcat(string,"Hello Request"); -+ break; -+ case SSL3_MT_CLIENT_HELLO: -+ strcat(string,"Client Hello"); -+ break; -+ case SSL3_MT_SERVER_HELLO: -+ strcat(string,"Server Hello"); -+ break; -+#ifdef SSL3_MT_NEWSESSION_TICKET -+ case SSL3_MT_NEWSESSION_TICKET: -+ strcat(string,"New Session Ticket"); -+ break; -+#endif -+#ifdef SSL3_MT_END_OF_EARLY_DATA -+ case SSL3_MT_END_OF_EARLY_DATA: -+ strcat(string,"End of Early Data"); -+ break; -+#endif -+#ifdef SSL3_MT_ENCRYPTED_EXTENSIONS -+ case SSL3_MT_ENCRYPTED_EXTENSIONS: -+ strcat(string,"Encryped Extensions"); -+ break; -+#endif -+ case SSL3_MT_CERTIFICATE: -+ strcat(string,"Certificate"); -+ break; -+ case SSL3_MT_SERVER_KEY_EXCHANGE: -+ strcat(string,"Server Key Exchange"); -+ break; -+ case SSL3_MT_CERTIFICATE_REQUEST: -+ strcat(string,"Certificate Request"); -+ break; -+ case SSL3_MT_SERVER_DONE: -+ strcat(string,"Server Hello Done"); -+ break; -+ case SSL3_MT_CERTIFICATE_VERIFY: -+ strcat(string,"Certificate Verify"); -+ break; -+ case SSL3_MT_CLIENT_KEY_EXCHANGE: -+ strcat(string,"Client Key Exchange"); -+ break; -+ case SSL3_MT_FINISHED: -+ strcat(string,"Finished: "); -+ hvers = SSL_version(ssl); -+ switch(hvers) { -+ case SSL3_VERSION: -+ strcat(string, "SSL 3.0"); -+ break; -+ case TLS1_VERSION: -+ strcat(string, "TLS 1.0"); -+ break; -+ case TLS1_1_VERSION: -+ strcat(string, "TLS 1.1"); -+ break; -+ case TLS1_2_VERSION: -+ strcat(string, "TLS 1.2"); -+ break; -+#ifdef TLS1_3_VERSION -+ case TLS1_3_VERSION: -+ strcat(string, "TLS 1.3 (experimental)"); -+ ets->tls_v13 = 1; -+ break; -+#endif -+ default: -+ strcat(string, "Unknown version"); -+ } -+ break; -+ default: -+ sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); -+ } -+ break; -+ -+ default: -+ sprintf( string, "SSL message contains unknown content type: %d", content_type ); -+ -+ } -+ -+ /* Alert messages must always be displayed */ -+ if(content_type == SSL3_RT_ALERT) -+ error("%s", string); -+ else -+ dbglog("%s", string); -+} -+ -+int -+ssl_new_session_cb(SSL *s, SSL_SESSION *sess) -+{ -+ dbglog("EAP-TLS: Post-Handshake New Session Ticket arrived:"); -+ have_session_ticket = 1; -+ -+ /* always return success */ -+ return 1; -+} -+ -diff -Naur ppp-2.4.8/pppd/eap-tls.h ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.h ---- ppp-2.4.8/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap-tls.h 2020-04-07 10:09:50.568118202 +0200 -@@ -0,0 +1,96 @@ -+/* -+ * eap-tls.h -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * Jan Just Keijser 2006-2019 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#ifndef __EAP_TLS_H__ -+#define __EAP_TLS_H__ -+ -+#include "eap.h" -+ -+#include -+#include -+ -+#define EAP_TLS_FLAGS_LI 128 /* length included flag */ -+#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ -+#define EAP_TLS_FLAGS_START 32 /* start flag */ -+ -+#define EAP_TLS_MAX_LEN 65536 /* max eap tls packet size */ -+ -+struct eaptls_session -+{ -+ u_char *data; /* buffered data */ -+ int datalen; /* buffered data len */ -+ int offset; /* from where to send */ -+ int tlslen; /* total length of tls data */ -+ bool frag; /* packet is fragmented */ -+ bool tls_v13; /* whether we've negotiated TLSv1.3 */ -+ SSL_CTX *ctx; -+ SSL *ssl; /* ssl connection */ -+ BIO *from_ssl; -+ BIO *into_ssl; -+ char peer[MAXWORDLEN]; /* peer name */ -+ char peercertfile[MAXWORDLEN]; -+ bool alert_sent; -+ u_char alert_sent_desc; -+ bool alert_recv; -+ u_char alert_recv_desc; -+ char rtx[EAP_TLS_MAX_LEN]; /* retransmission buffer */ -+ int rtx_len; -+ int mtu; /* unit mtu */ -+}; -+ -+ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, char *capath, -+ char *certfile, char *peer_certfile, char *privkeyfile); -+int eaptls_init_ssl_server(eap_state * esp); -+int eaptls_init_ssl_client(eap_state * esp); -+void eaptls_free_session(struct eaptls_session *ets); -+ -+int eaptls_is_init_finished(struct eaptls_session *ets); -+ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); -+int eaptls_send(struct eaptls_session *ets, u_char ** outp); -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); -+ -+int get_eaptls_secret(int unit, char *client, char *server, -+ char *clicertfile, char *servcertfile, char *cacertfile, -+ char *capath, char *pkfile, int am_server); -+ -+#ifdef MPPE -+#include "mppe.h" /* MPPE_MAX_KEY_LEN */ -+extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; -+extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; -+extern int mppe_keys_set; -+ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); -+#endif -+ -+#endif -diff -Naur ppp-2.4.8/pppd/eap.c ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.c ---- ppp-2.4.8/pppd/eap.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.c 2020-04-07 10:09:50.569118201 +0200 -@@ -43,6 +43,11 @@ - * Based on draft-ietf-pppext-eap-srp-03.txt. - */ - -+/* -+ * Modification by Beniamino Galvani, Mar 2005 -+ * Implemented EAP-TLS authentication -+ */ -+ - #define RCSID "$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $" - - /* -@@ -62,8 +67,12 @@ - - #include "pppd.h" - #include "pathnames.h" --#include "md5.h" - #include "eap.h" -+#ifdef USE_OPENSSL_MD5 -+#include "openssl/md5.h" -+#else -+#include "md5.h" -+#endif /* USE_OPENSSL_MD5 */ - - #ifdef USE_SRP - #include -@@ -72,8 +81,12 @@ - #include "pppcrypt.h" - #endif /* USE_SRP */ - --#ifndef SHA_DIGESTSIZE --#define SHA_DIGESTSIZE 20 -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#endif /* USE_EAPTLS */ -+ -+#ifndef SHA_DIGEST_LENGTH -+#define SHA_DIGEST_LENGTH 20 - #endif - - -@@ -208,6 +221,9 @@ - esp->es_server.ea_id = (u_char)(drand48() * 0x100); - esp->es_client.ea_timeout = EAP_DEFREQTIME; - esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; -+#ifdef USE_EAPTLS -+ esp->es_client.ea_using_eaptls = 0; -+#endif /* USE_EAPTLS */ - } - - /* -@@ -316,8 +332,8 @@ - { - struct tm *tp; - char tbuf[9]; -- SHA1_CTX ctxt; -- u_char dig[SHA_DIGESTSIZE]; -+ SHA_CTX ctxt; -+ u_char dig[SHA_DIGEST_LENGTH]; - time_t reftime; - - if (pn_secret == NULL) -@@ -435,8 +451,16 @@ - u_char vals[2]; - struct b64state bs; - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ int secret_len; -+ char secret[MAXWORDLEN]; -+#endif /* USE_EAPTLS */ - - esp->es_server.ea_timeout = esp->es_savedtime; -+#ifdef USE_EAPTLS -+ esp->es_server.ea_prev_state = esp->es_server.ea_state; -+#endif /* USE_EAPTLS */ - switch (esp->es_server.ea_state) { - case eapBadAuth: - return; -@@ -561,9 +585,81 @@ - break; - } - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ if (!get_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, secret, &secret_len, 1)) { -+ -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ /* Initialize ssl session */ -+ if(!eaptls_init_ssl_server(esp)) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecv: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->alert_sent) { -+ esp->es_server.ea_state = eapTlsSendAlert; -+ break; -+ } -+ -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsSendAck; -+ else -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSend: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsRecvAck; -+ else -+ if(SSL_is_init_finished(ets->ssl)) -+ esp->es_server.ea_state = eapTlsRecvClient; -+ else -+ /* JJK Add "TLS empty record" message here ??? */ -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsSendAck: -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecvAck: -+ if (status) -+ { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSendAlert: -+ esp->es_server.ea_state = eapTlsRecvAlertAck; -+ break; -+#endif /* USE_EAPTLS */ -+ - case eapSRP1: - #ifdef USE_SRP - ts = (struct t_server *)esp->es_server.ea_session; -@@ -629,6 +725,10 @@ - } - if (esp->es_server.ea_state == eapBadAuth) - eap_send_failure(esp); -+ -+#ifdef USE_EAPTLS -+ dbglog("EAP id=0x%2x '%s' -> '%s'", esp->es_server.ea_id, eap_state_name(esp->es_server.ea_prev_state), eap_state_name(esp->es_server.ea_state)); -+#endif /* USE_EAPTLS */ - } - - /* -@@ -647,10 +747,10 @@ - char *str; - #ifdef USE_SRP - struct t_server *ts; -- u_char clear[8], cipher[8], dig[SHA_DIGESTSIZE], *optr, *cp; -+ u_char clear[8], cipher[8], dig[SHA_DIGEST_LENGTH], *optr, *cp; - int i, j; - struct b64state b64; -- SHA1_CTX ctxt; -+ SHA_CTX ctxt; - #endif /* USE_SRP */ - - /* Handle both initial auth and restart */ -@@ -717,6 +817,30 @@ - INCPTR(esp->es_server.ea_namelen, outp); - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(EAP_TLS_FLAGS_START, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSend: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAck: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAlert: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case eapSRP1: - PUTCHAR(EAPT_SRP, outp); -@@ -763,8 +887,8 @@ - PUTLONG(SRPVAL_EBIT, outp); - ts = (struct t_server *)esp->es_server.ea_session; - assert(ts != NULL); -- BCOPY(t_serverresponse(ts), outp, SHA_DIGESTSIZE); -- INCPTR(SHA_DIGESTSIZE, outp); -+ BCOPY(t_serverresponse(ts), outp, SHA_DIGEST_LENGTH); -+ INCPTR(SHA_DIGEST_LENGTH, outp); - - if (pncrypt_setkey(0)) { - /* Generate pseudonym */ -@@ -804,9 +928,9 @@ - /* Set length and pad out to next 20 octet boundary */ - i = outp - optr - 1; - *optr = i; -- i %= SHA_DIGESTSIZE; -+ i %= SHA_DIGEST_LENGTH; - if (i != 0) { -- while (i < SHA_DIGESTSIZE) { -+ while (i < SHA_DIGEST_LENGTH) { - *outp++ = drand48() * 0x100; - i++; - } -@@ -822,14 +946,14 @@ - while (optr < outp) { - SHA1Final(dig, &ctxt); - cp = dig; -- while (cp < dig + SHA_DIGESTSIZE) -+ while (cp < dig + SHA_DIGEST_LENGTH) - *optr++ ^= *cp++; - SHA1Init(&ctxt); - SHA1Update(&ctxt, &esp->es_server.ea_id, 1); - SHA1Update(&ctxt, esp->es_server.ea_skey, - SESSION_KEY_LEN); -- SHA1Update(&ctxt, optr - SHA_DIGESTSIZE, -- SHA_DIGESTSIZE); -+ SHA1Update(&ctxt, optr - SHA_DIGEST_LENGTH, -+ SHA_DIGEST_LENGTH); - } - } - break; -@@ -903,11 +1027,57 @@ - eap_server_timeout(arg) - void *arg; - { -+#ifdef USE_EAPTLS -+ u_char *outp; -+ u_char *lenloc; -+ int outlen; -+#endif /* USE_EAPTLS */ -+ - eap_state *esp = (eap_state *) arg; - - if (!eap_server_active(esp)) - return; - -+#ifdef USE_EAPTLS -+ switch(esp->es_server.ea_prev_state) { -+ -+ /* -+ * In eap-tls the state changes after a request, so we return to -+ * previous state ... -+ */ -+ case(eapTlsStart): -+ case(eapTlsSendAck): -+ esp->es_server.ea_state = esp->es_server.ea_prev_state; -+ break; -+ -+ /* -+ * ... or resend the stored data -+ */ -+ case(eapTlsSend): -+ case(eapTlsSendAlert): -+ outp = outpacket_buf; -+ MAKEHEADER(outp, PPP_EAP); -+ PUTCHAR(EAP_REQUEST, outp); -+ PUTCHAR(esp->es_server.ea_id, outp); -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ eaptls_retransmit(esp->es_server.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN); -+ esp->es_server.ea_requests++; -+ -+ if (esp->es_server.ea_timeout > 0) -+ TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout); -+ -+ return; -+ default: -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - /* EAP ID number must not change on timeout. */ - eap_send_request(esp); - } -@@ -1154,17 +1324,90 @@ - PUTCHAR(id, outp); - esp->es_client.ea_id = id; - msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) + -- SHA_DIGESTSIZE; -+ SHA_DIGEST_LENGTH; - PUTSHORT(msglen, outp); - PUTCHAR(EAPT_SRP, outp); - PUTCHAR(EAPSRP_CVALIDATOR, outp); - PUTLONG(flags, outp); -- BCOPY(str, outp, SHA_DIGESTSIZE); -+ BCOPY(str, outp, SHA_DIGEST_LENGTH); - - output(esp->es_unit, outpacket_buf, PPP_HDRLEN + msglen); - } - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+/* -+ * Send an EAP-TLS response message with tls data -+ */ -+static void -+eap_tls_response(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ /* -+ If the id in the request is unchanged, we must retransmit -+ the old data -+ */ -+ if(id == esp->es_client.ea_id) -+ eaptls_retransmit(esp->es_client.ea_session, &outp); -+ else -+ eaptls_send(esp->es_client.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ -+ esp->es_client.ea_id = id; -+} -+ -+/* -+ * Send an EAP-TLS ack -+ */ -+static void -+eap_tls_sendack(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ esp->es_client.ea_id = id; -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+} -+#endif /* USE_EAPTLS */ -+ - static void - eap_send_nak(esp, id, type) - eap_state *esp; -@@ -1251,8 +1494,8 @@ - { - u_char val; - u_char *datp, *digp; -- SHA1_CTX ctxt; -- u_char dig[SHA_DIGESTSIZE]; -+ SHA_CTX ctxt; -+ u_char dig[SHA_DIGEST_LENGTH]; - int dsize, fd, olen = len; - - /* -@@ -1261,21 +1504,21 @@ - */ - val = id; - while (len > 0) { -- if ((dsize = len % SHA_DIGESTSIZE) == 0) -- dsize = SHA_DIGESTSIZE; -+ if ((dsize = len % SHA_DIGEST_LENGTH) == 0) -+ dsize = SHA_DIGEST_LENGTH; - len -= dsize; - datp = inp + len; - SHA1Init(&ctxt); - SHA1Update(&ctxt, &val, 1); - SHA1Update(&ctxt, esp->es_client.ea_skey, SESSION_KEY_LEN); - if (len > 0) { -- SHA1Update(&ctxt, datp, SHA_DIGESTSIZE); -+ SHA1Update(&ctxt, datp, SHA_DIGEST_LENGTH); - } else { - SHA1Update(&ctxt, esp->es_client.ea_name, - esp->es_client.ea_namelen); - } - SHA1Final(dig, &ctxt); -- for (digp = dig; digp < dig + SHA_DIGESTSIZE; digp++) -+ for (digp = dig; digp < dig + SHA_DIGEST_LENGTH; digp++) - *datp++ ^= *digp; - } - -@@ -1319,12 +1562,17 @@ - char rhostname[256]; - MD5_CTX mdContext; - u_char hash[MD5_SIGNATURE_SIZE]; -+#ifdef USE_EAPTLS -+ u_char flags; -+ struct eaptls_session *ets = esp->es_client.ea_session; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - struct t_client *tc; - struct t_num sval, gval, Nval, *Ap, Bval; - u_char vals[2]; -- SHA1_CTX ctxt; -- u_char dig[SHA_DIGESTSIZE]; -+ SHA_CTX ctxt; -+ u_char dig[SHA_DIGEST_LENGTH]; - int fd; - #endif /* USE_SRP */ - -@@ -1455,6 +1703,96 @@ - esp->es_client.ea_namelen); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ -+ switch(esp->es_client.ea_state) { -+ -+ case eapListen: -+ -+ if (len < 1) { -+ error("EAP: received EAP-TLS Listen packet with no data"); -+ /* Bogus request; wait for something real. */ -+ return; -+ } -+ GETCHAR(flags, inp); -+ if(flags & EAP_TLS_FLAGS_START){ -+ -+ esp->es_client.ea_using_eaptls = 1; -+ -+ if (explicit_remote){ -+ esp->es_client.ea_peer = strdup(remote_name); -+ esp->es_client.ea_peerlen = strlen(remote_name); -+ } else -+ esp->es_client.ea_peer = NULL; -+ -+ /* Init ssl session */ -+ if(!eaptls_init_ssl_client(esp)) { -+ dbglog("cannot init ssl"); -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ ets = esp->es_client.ea_session; -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); -+ break; -+ } -+ -+ /* The server has sent a bad start packet. */ -+ eap_send_nak(esp, id, EAPT_TLS); -+ break; -+ -+ case eapTlsRecvAck: -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); -+ break; -+ -+ case eapTlsRecv: -+ if (len < 1) { -+ error("EAP: discarding EAP-TLS Receive packet with no data"); -+ /* Bogus request; wait for something real. */ -+ return; -+ } -+ eaptls_receive(ets, inp, len); -+ -+ if(ets->frag) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecv; -+ break; -+ } -+ -+ if(ets->alert_recv) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvFailure; -+ break; -+ } -+ -+ /* Check if TLS handshake is finished */ -+ if(eaptls_is_init_finished(ets)) { -+#ifdef MPPE -+ eaptls_gen_mppe_keys(ets, 1); -+#endif -+ eaptls_free_session(ets); -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvSuccess; -+ break; -+ } -+ -+ eap_tls_response(esp,id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : eapTlsRecv); -+ break; -+ -+ default: -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case EAPT_SRP: - if (len < 1) { -@@ -1639,7 +1977,7 @@ - esp->es_client.ea_id, id); - } - } else { -- len -= sizeof (u_int32_t) + SHA_DIGESTSIZE; -+ len -= sizeof (u_int32_t) + SHA_DIGEST_LENGTH; - if (len < 0 || t_clientverify(tc, inp + - sizeof (u_int32_t)) != 0) { - error("EAP: SRP server verification " -@@ -1649,7 +1987,7 @@ - GETLONG(esp->es_client.ea_keyflags, inp); - /* Save pseudonym if user wants it. */ - if (len > 0 && esp->es_usepseudo) { -- INCPTR(SHA_DIGESTSIZE, inp); -+ INCPTR(SHA_DIGEST_LENGTH, inp); - write_pseudonym(esp, inp, len, id); - } - } -@@ -1676,7 +2014,7 @@ - esp->es_client.ea_namelen); - SHA1Final(dig, &ctxt); - eap_srp_response(esp, id, EAPSRP_LWRECHALLENGE, dig, -- SHA_DIGESTSIZE); -+ SHA_DIGEST_LENGTH); - break; - - default: -@@ -1732,10 +2070,15 @@ - #ifdef USE_SRP - struct t_server *ts; - struct t_num A; -- SHA1_CTX ctxt; -- u_char dig[SHA_DIGESTSIZE]; -+ eHA_CTX ctxt; -+ u_char dig[SHA_DIGEST_LENGTH]; - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ u_char flags; -+#endif /* USE_EAPTLS */ -+ - if (esp->es_server.ea_id != id) { - dbglog("EAP: discarding Response %d; expected ID %d", id, - esp->es_server.ea_id); -@@ -1775,6 +2118,64 @@ - eap_figure_next_state(esp, 0); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ switch(esp->es_server.ea_state) { -+ -+ case eapTlsRecv: -+ -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ eap_figure_next_state(esp, -+ eaptls_receive(esp->es_server.ea_session, inp, len)); -+ -+ if(ets->alert_recv) { -+ eap_send_failure(esp); -+ break; -+ } -+ break; -+ -+ case eapTlsRecvAck: -+ if(len > 1) { -+ dbglog("EAP-TLS ACK with extra data"); -+ } -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsRecvClient: -+ /* Receive authentication response from client */ -+ if (len > 0) { -+ GETCHAR(flags, inp); -+ -+ if(len == 1 && !flags) { /* Ack = ok */ -+#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, 0 ); -+#endif -+ eap_send_success(esp); -+ } -+ else { /* failure */ -+ warn("Server authentication failed"); -+ eap_send_failure(esp); -+ } -+ } -+ else -+ warn("Bogus EAP-TLS packet received from client"); -+ -+ eaptls_free_session(esp->es_server.ea_session); -+ -+ break; -+ -+ case eapTlsRecvAlertAck: -+ eap_send_failure(esp); -+ break; -+ -+ default: -+ eap_figure_next_state(esp, 1); -+ break; -+ } -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NOTIFICATION: - dbglog("EAP unexpected Notification; response discarded"); - break; -@@ -1806,6 +2207,13 @@ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ /* Send EAP-TLS start packet */ -+ case EAPT_TLS: -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+#endif /* USE_EAPTLS */ -+ - default: - dbglog("EAP: peer requesting unknown Type %d", vallen); - switch (esp->es_server.ea_state) { -@@ -1923,9 +2331,9 @@ - eap_figure_next_state(esp, 1); - break; - } -- if (len < sizeof (u_int32_t) + SHA_DIGESTSIZE) { -+ if (len < sizeof (u_int32_t) + SHA_DIGEST_LENGTH) { - error("EAP: M1 length %d < %d", len, -- sizeof (u_int32_t) + SHA_DIGESTSIZE); -+ sizeof (u_int32_t) + SHA_DIGEST_LENGTH); - eap_figure_next_state(esp, 1); - break; - } -@@ -1962,7 +2370,7 @@ - info("EAP: unexpected SRP Subtype 4 Response"); - return; - } -- if (len != SHA_DIGESTSIZE) { -+ if (len != SHA_DIGEST_LENGTH) { - error("EAP: bad Lightweight rechallenge " - "response"); - return; -@@ -1976,7 +2384,7 @@ - SHA1Update(&ctxt, esp->es_server.ea_peer, - esp->es_server.ea_peerlen); - SHA1Final(dig, &ctxt); -- if (BCMP(dig, inp, SHA_DIGESTSIZE) != 0) { -+ if (BCMP(dig, inp, SHA_DIGEST_LENGTH) != 0) { - error("EAP: failed Lightweight rechallenge"); - eap_send_failure(esp); - break; -@@ -2017,13 +2425,27 @@ - int id; - int len; - { -- if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) { -+ if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp) -+#ifdef USE_EAPTLS -+ && esp->es_client.ea_state != eapTlsRecvSuccess -+#endif /* USE_EAPTLS */ -+ ) { - dbglog("EAP unexpected success message in state %s (%d)", - eap_state_name(esp->es_client.ea_state), - esp->es_client.ea_state); - return; - } - -+#ifdef USE_EAPTLS -+ if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != -+ eapTlsRecvSuccess) { -+ dbglog("EAP-TLS unexpected success message in state %s (%d)", -+ eap_state_name(esp->es_client.ea_state), -+ esp->es_client.ea_state); -+ return; -+ } -+#endif /* USE_EAPTLS */ -+ - if (esp->es_client.ea_timeout > 0) { - UNTIMEOUT(eap_client_timeout, (void *)esp); - } -@@ -2149,6 +2571,9 @@ - int code, id, len, rtype, vallen; - u_char *pstart; - u_int32_t uval; -+#ifdef USE_EAPTLS -+ u_char flags; -+#endif /* USE_EAPTLS */ - - if (inlen < EAP_HEADERLEN) - return (0); -@@ -2213,6 +2638,24 @@ - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_SRP: - if (len < 3) - goto truncated; -@@ -2280,10 +2723,10 @@ - if (uval != 0) { - printer(arg, " f<%X>", uval); - } -- if ((vallen = len) > SHA_DIGESTSIZE) -- vallen = SHA_DIGESTSIZE; -+ if ((vallen = len) > SHA_DIGEST_LENGTH) -+ vallen = SHA_DIGEST_LENGTH; - printer(arg, " ", len, inp, -- len < SHA_DIGESTSIZE ? "?" : ""); -+ len < SHA_DIGEST_LENGTH ? "?" : ""); - INCPTR(vallen, inp); - len -= vallen; - if (len > 0) { -@@ -2324,6 +2767,25 @@ - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NAK: - if (len <= 0) { - printer(arg, " "); -@@ -2387,7 +2849,7 @@ - printer(arg, " f<%X>", uval); - } - printer(arg, " ", len, inp, -- len == SHA_DIGESTSIZE ? "" : "?"); -+ len == SHA_DIGEST_LENGTH ? "" : "?"); - INCPTR(len, inp); - len = 0; - break; -@@ -2397,9 +2859,9 @@ - - case EAPSRP_LWRECHALLENGE: - printer(arg, " ", len, inp, -- len == SHA_DIGESTSIZE ? "" : "?"); -- if ((vallen = len) > SHA_DIGESTSIZE) -- vallen = SHA_DIGESTSIZE; -+ len == SHA_DIGEST_LENGTH ? "" : "?"); -+ if ((vallen = len) > SHA_DIGEST_LENGTH) -+ vallen = SHA_DIGEST_LENGTH; - INCPTR(vallen, inp); - len -= vallen; - break; -@@ -2425,3 +2887,4 @@ - - return (inp - pstart); - } -+ -diff -Naur ppp-2.4.8/pppd/eap.h ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.h ---- ppp-2.4.8/pppd/eap.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/eap.h 2020-04-07 10:09:50.569118201 +0200 -@@ -84,6 +84,16 @@ - eapClosed, /* Authentication not in use */ - eapListen, /* Client ready (and timer running) */ - eapIdentify, /* EAP Identify sent */ -+ eapTlsStart, /* Send EAP-TLS start packet */ -+ eapTlsRecv, /* Receive EAP-TLS tls data */ -+ eapTlsSendAck, /* Send EAP-TLS ack */ -+ eapTlsSend, /* Send EAP-TLS tls data */ -+ eapTlsRecvAck, /* Receive EAP-TLS ack */ -+ eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ -+ eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ -+ eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ -+ eapTlsRecvSuccess, /* Receive EAP success */ -+ eapTlsRecvFailure, /* Receive EAP failure */ - eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ - eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ - eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ -@@ -95,9 +105,18 @@ - - #define EAP_STATES \ - "Initial", "Pending", "Closed", "Listen", "Identify", \ -+ "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ -+ "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ - "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" - --#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#ifdef USE_EAPTLS -+#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial &&\ -+ (esp)->es_client.ea_state != eapPending &&\ -+ (esp)->es_client.ea_state != eapClosed) -+#else -+#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#endif /* USE_EAPTLS */ -+ - #define eap_server_active(esp) \ - ((esp)->es_server.ea_state >= eapIdentify && \ - (esp)->es_server.ea_state <= eapMD5Chall) -@@ -112,11 +131,17 @@ - u_short ea_namelen; /* Length of our name */ - u_short ea_peerlen; /* Length of peer's name */ - enum eap_state_code ea_state; -+#ifdef USE_EAPTLS -+ enum eap_state_code ea_prev_state; -+#endif - u_char ea_id; /* Current id */ - u_char ea_requests; /* Number of Requests sent/received */ - u_char ea_responses; /* Number of Responses */ - u_char ea_type; /* One of EAPT_* */ - u_int32_t ea_keyflags; /* SRP shared key usage flags */ -+#ifdef USE_EAPTLS -+ bool ea_using_eaptls; -+#endif - }; - - /* -@@ -139,7 +164,12 @@ - * Timeouts. - */ - #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ -+#ifdef USE_EAPTLS -+#define EAP_DEFTRANSMITS 30 /* max # times to transmit */ -+ /* certificates can be long ... */ -+#else - #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ -+#endif /* USE_EAPTLS */ - #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ - #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ - -diff -Naur ppp-2.4.8/pppd/pathnames.h ppp-2.4.8-eaptls-mppe-1.300/pppd/pathnames.h ---- ppp-2.4.8/pppd/pathnames.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pathnames.h 2020-04-07 10:09:50.569118201 +0200 -@@ -21,6 +21,13 @@ - #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" - #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" - #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" -+ -+#ifdef USE_EAPTLS -+#define _PATH_EAPTLSCLIFILE _ROOT_PATH "/etc/ppp/eaptls-client" -+#define _PATH_EAPTLSSERVFILE _ROOT_PATH "/etc/ppp/eaptls-server" -+#define _PATH_OPENSSLCONFFILE _ROOT_PATH "/etc/ppp/openssl.cnf" -+#endif /* USE_EAPTLS */ -+ - #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" - #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" - #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -Naur ppp-2.4.8/pppd/plugins/Makefile.linux ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/Makefile.linux ---- ppp-2.4.8/pppd/plugins/Makefile.linux 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/Makefile.linux 2020-04-07 10:09:50.569118201 +0200 -@@ -4,6 +4,9 @@ - LDFLAGS_SHARED = -shared - INSTALL = install - -+# EAP-TLS -+CFLAGS += -DUSE_EAPTLS=1 -+ - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 -diff -Naur ppp-2.4.8/pppd/plugins/passprompt.c ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passprompt.c ---- ppp-2.4.8/pppd/plugins/passprompt.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passprompt.c 2020-04-07 10:09:50.569118201 +0200 -@@ -107,4 +107,7 @@ - { - add_options(options); - pap_passwd_hook = promptpass; -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = promptpass; -+#endif - } -diff -Naur ppp-2.4.8/pppd/plugins/passwordfd.c ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passwordfd.c ---- ppp-2.4.8/pppd/plugins/passwordfd.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/plugins/passwordfd.c 2020-04-07 10:09:50.569118201 +0200 -@@ -79,4 +79,8 @@ - - chap_check_hook = pwfd_check; - chap_passwd_hook = pwfd_passwd; -+ -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = pwfd_passwd; -+#endif - } -diff -Naur ppp-2.4.8/pppd/pppcrypt.c ppp-2.4.8-eaptls-mppe-1.300/pppd/pppcrypt.c ---- ppp-2.4.8/pppd/pppcrypt.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppcrypt.c 2020-04-07 10:09:50.569118201 +0200 -@@ -31,6 +31,7 @@ - */ - - #include -+#include - #include "pppd.h" - #include "pppcrypt.h" - -diff -Naur ppp-2.4.8/pppd/pppd.8 ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.8 ---- ppp-2.4.8/pppd/pppd.8 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.8 2020-04-07 10:09:50.570118199 +0200 -@@ -260,6 +260,12 @@ - compression in the corresponding direction. Use \fInobsdcomp\fR or - \fIbsdcomp 0\fR to disable BSD-Compress compression entirely. - .TP -+.B ca \fIca-file -+(EAP-TLS) Use the file \fIca-file\fR as the X.509 Certificate Authority -+(CA) file (in PEM format), needed for setting up an EAP-TLS connection. -+This option is used on the client-side in conjunction with the \fBcert\fR -+and \fBkey\fR options. -+.TP - .B cdtrcts - Use a non-standard hardware flow control (i.e. DTR/CTS) to control - the flow of data on the serial port. If neither the \fIcrtscts\fR, -@@ -271,6 +277,12 @@ - bi-directional flow control. The sacrifice is that this flow - control mode does not permit using DTR as a modem control line. - .TP -+.B cert \fIcertfile -+(EAP-TLS) Use the file \fIcertfile\fR as the X.509 certificate (in PEM -+format), needed for setting up an EAP-TLS connection. This option is -+used on the client-side in conjunction with the \fBca\fR and -+\fBkey\fR options. -+.TP - .B chap\-interval \fIn - If this option is given, pppd will rechallenge the peer every \fIn\fR - seconds. -@@ -299,6 +311,18 @@ - 1000 (1 second). This wait period only applies if the \fBconnect\fR - or \fBpty\fR option is used. - .TP -+.B crl \fIfilename -+(EAP-TLS) Use the file \fIfilename\fR as the Certificate Revocation List -+to check for the validity of the peer's certificate. This option is not -+mandatory for setting up an EAP-TLS connection. Also see the \fBcrl-dir\fR -+option. -+.TP -+.B crl-dir \fIdirectory -+(EAP-TLS) Use the directory \fIdirectory\fR to scan for CRL files in -+has format ($hash.r0) to check for the validity of the peer's certificate. -+This option is not mandatory for setting up an EAP-TLS connection. -+Also see the \fBcrl\fR option. -+.TP - .B debug - Enables connection debugging facilities. - If this option is given, pppd will log the contents of all -@@ -563,6 +587,12 @@ - the kernel are logged by syslog(1) to a file as directed in the - /etc/syslog.conf configuration file. - .TP -+.B key \fIkeyfile -+(EAP-TLS) Use the file \fIkeyfile\fR as the private key file (in PEM -+format), needed for setting up an EAP-TLS connection. This option is -+used on the client-side in conjunction with the \fBca\fR and -+\fBcert\fR options. -+.TP - .B ktune - Enables pppd to alter kernel settings as appropriate. Under Linux, - pppd will enable IP forwarding (i.e. set /proc/sys/net/ipv4/ip_forward -@@ -721,6 +751,9 @@ - Disable Address/Control compression in both directions (send and - receive). - .TP -+.B need-peer-eap -+(EAP-TLS) Require the peer to verify our authentication credentials. -+.TP - .B noauth - Do not require the peer to authenticate itself. This option is - privileged. -diff -Naur ppp-2.4.8/pppd/pppd.h ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.h ---- ppp-2.4.8/pppd/pppd.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/pppd.h 2020-04-07 10:09:50.570118199 +0200 -@@ -341,6 +341,12 @@ - extern bool dryrun; /* check everything, print options, exit */ - extern int child_wait; /* # seconds to wait for children at end */ - -+#ifdef USE_EAPTLS -+extern char *crl_dir; -+extern char *crl_file; -+extern char *max_tls_version; -+#endif /* USE_EAPTLS */ -+ - #ifdef MAXOCTETS - extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ - extern int maxoctets_dir; /* Direction : -@@ -763,6 +769,10 @@ - extern int (*chap_passwd_hook) __P((char *user, char *passwd)); - extern void (*multilink_join_hook) __P((void)); - -+#ifdef USE_EAPTLS -+extern int (*eaptls_passwd_hook) __P((char *user, char *passwd)); -+#endif -+ - /* Let a plugin snoop sent and received packets. Useful for L2TP */ - extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); - extern void (*snoop_send_hook) __P((unsigned char *p, int len)); -diff -Naur ppp-2.4.8/pppd/sha1.c ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.c ---- ppp-2.4.8/pppd/sha1.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.c 2020-04-07 10:09:50.570118199 +0200 -@@ -101,7 +101,7 @@ - /* SHA1Init - Initialize new context */ - - void --SHA1_Init(SHA1_CTX *context) -+SHA1_Init(SHA_CTX *context) - { - /* SHA1 initialization constants */ - context->state[0] = 0x67452301; -@@ -116,7 +116,7 @@ - /* Run your data through this. */ - - void --SHA1_Update(SHA1_CTX *context, const unsigned char *data, unsigned int len) -+SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len) - { - unsigned int i, j; - -@@ -140,7 +140,7 @@ - /* Add padding and return the message digest. */ - - void --SHA1_Final(unsigned char digest[20], SHA1_CTX *context) -+SHA1_Final(unsigned char *digest, SHA_CTX *context) - { - u_int32_t i, j; - unsigned char finalcount[8]; -diff -Naur ppp-2.4.8/pppd/sha1.h ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.h ---- ppp-2.4.8/pppd/sha1.h 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sha1.h 2020-04-07 10:09:50.570118199 +0200 -@@ -1,11 +1,5 @@ - /* sha1.h */ - --/* If OpenSSL is in use, then use that version of SHA-1 */ --#ifdef OPENSSL --#include --#define __SHA1_INCLUDE_ --#endif -- - #ifndef __SHA1_INCLUDE_ - - #ifndef SHA1_SIGNATURE_SIZE -@@ -20,11 +14,11 @@ - u_int32_t state[5]; - u_int32_t count[2]; - unsigned char buffer[64]; --} SHA1_CTX; -+} SHA_CTX; - --extern void SHA1_Init(SHA1_CTX *); --extern void SHA1_Update(SHA1_CTX *, const unsigned char *, unsigned int); --extern void SHA1_Final(unsigned char[SHA1_SIGNATURE_SIZE], SHA1_CTX *); -+extern void SHA1_Init(SHA_CTX *context); -+extern void SHA1_Update(SHA_CTX *context, const unsigned char *data, size_t len); -+extern void SHA1_Final(unsigned char *data, SHA_CTX *context); - - #define __SHA1_INCLUDE_ - #endif /* __SHA1_INCLUDE_ */ -diff -Naur ppp-2.4.8/pppd/sys-solaris.c ppp-2.4.8-eaptls-mppe-1.300/pppd/sys-solaris.c ---- ppp-2.4.8/pppd/sys-solaris.c 2019-12-31 02:31:26.000000000 +0100 -+++ ppp-2.4.8-eaptls-mppe-1.300/pppd/sys-solaris.c 2020-04-07 10:09:50.571118198 +0200 -@@ -1550,6 +1550,26 @@ - #endif /* defined(INET6) && defined(SOL2) */ - } - -+ -+ -+/* -+ * netif_get_mtu - get the MTU on the PPP network interface. -+ */ -+int -+netif_get_mtu(int unit) -+{ -+ struct ifreq ifr; -+ -+ memset (&ifr, '\0', sizeof (ifr)); -+ strlcpy(ifr.ifr_name, ifname, sizeof (ifr.ifr_name)); -+ -+ if (ioctl(ipfd, SIOCGIFMTU, (caddr_t) &ifr) < 0) { -+ error("ioctl(SIOCGIFMTU): %m (line %d)", __LINE__); -+ return 0; -+ } -+ return ifr.ifr_mtu; -+} -+ - /* - * tty_send_config - configure the transmit characteristics of - * the ppp interface. diff --git a/ppp-2.4.8-man-fix.patch b/ppp-2.4.8-man-fix.patch deleted file mode 100644 index 4ecf1f5..0000000 --- a/ppp-2.4.8-man-fix.patch +++ /dev/null @@ -1,46 +0,0 @@ -diff --git a/pppdump/pppdump.8 b/pppdump/pppdump.8 -index 4072e68..1116b85 100644 ---- a/pppdump/pppdump.8 -+++ b/pppdump/pppdump.8 -@@ -13,6 +13,8 @@ pppdump \- convert PPP record file to readable format - ]] [ - .B \-r - ] [ -+.B \-a -+] [ - .B \-m \fImru - ] [ - .I file \fR... -@@ -54,6 +56,9 @@ Reverses the direction indicators, so that `sent' is printed for - bytes or packets received, and `rcvd' is printed for bytes or packets - sent. - .TP -+.B \-a -+Prints absolute times. -+.TP - .B \-m \fImru - Use \fImru\fR as the MRU (maximum receive unit) for both directions of - the link when checking for over-length PPP packets (with the \fB\-p\fR -diff --git a/pppstats/pppstats.8 b/pppstats/pppstats.8 -index 4ac101e..cabf4d7 100644 ---- a/pppstats/pppstats.8 -+++ b/pppstats/pppstats.8 -@@ -7,6 +7,8 @@ pppstats \- print PPP statistics - [ - .B \-a - ] [ -+.B \-d -+] [ - .B \-v - ] [ - .B \-r -@@ -41,6 +43,9 @@ reports show statistics for the time since the link was initiated. - Without this option, the second and subsequent reports show statistics - for the time since the last report. - .TP -+.B \-d -+Show data rate (kB/s) instead of bytes. -+.TP - .B \-c \fIcount - Repeat the display - .I count diff --git a/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch b/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch deleted file mode 100644 index eddef5b..0000000 --- a/ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch +++ /dev/null @@ -1,57 +0,0 @@ -From abef895f9d144f05a83045136b77277352dc450f Mon Sep 17 00:00:00 2001 -From: David Woodhouse -Date: Fri, 4 Apr 2014 18:53:33 +0200 -Subject: [PATCH 09/27] pppd: introduce ipv6-accept-remote - ---- - pppd/ipv6cp.c | 5 ++++- - pppd/ipv6cp.h | 3 ++- - 2 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/pppd/ipv6cp.c b/pppd/ipv6cp.c -index caa2b26..5a56c95 100644 ---- a/pppd/ipv6cp.c -+++ b/pppd/ipv6cp.c -@@ -245,6 +245,8 @@ static option_t ipv6cp_option_list[] = { - - { "ipv6cp-accept-local", o_bool, &ipv6cp_allowoptions[0].accept_local, - "Accept peer's interface identifier for us", 1 }, -+ { "ipv6cp-accept-remote", o_bool, &ipv6cp_allowoptions[0].accept_remote, -+ "Accept peer's interface identifier for itself", 1 }, - - { "defaultroute6", o_bool, &ipv6cp_wantoptions[0].default_route, - "Add default IPv6 route", OPT_ENABLE|1, &ipv6cp_allowoptions[0].default_route }, -@@ -437,6 +439,7 @@ ipv6cp_init(unit) - memset(ao, 0, sizeof(*ao)); - - wo->accept_local = 1; -+ wo->accept_remote = 1; - wo->neg_ifaceid = 1; - ao->neg_ifaceid = 1; - -@@ -962,7 +965,7 @@ ipv6cp_reqci(f, inp, len, reject_if_disagree) - orc = CONFREJ; /* Reject CI */ - break; - } -- if (!eui64_iszero(wo->hisid) && -+ if (!eui64_iszero(wo->hisid) && !wo->accept_remote && - !eui64_equals(ifaceid, wo->hisid) && - eui64_iszero(go->hisid)) { - -diff --git a/pppd/ipv6cp.h b/pppd/ipv6cp.h -index cc4568d..8c7552e 100644 ---- a/pppd/ipv6cp.h -+++ b/pppd/ipv6cp.h -@@ -150,7 +150,8 @@ - int neg_ifaceid; /* Negotiate interface identifier? */ - int req_ifaceid; /* Ask peer to send interface identifier? */ - int default_route; /* Assign default route through interface? */ -- int accept_local; /* accept peer's value for iface id? */ -+ int accept_local; /* accept peer's value for our iface id? */ -+ int accept_remote; /* accept peer's value for his iface id? */ - int opt_local; /* ourtoken set by option */ - int opt_remote; /* histoken set by option */ - int use_ip; /* use IP as interface identifier */ --- -1.8.3.1 - diff --git a/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch b/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch deleted file mode 100644 index 18bfecf..0000000 --- a/ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch +++ /dev/null @@ -1,383 +0,0 @@ -From 6edc865bd02ab591b9121d4a5f6dc3cdbe5af809 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Wed, 9 Apr 2014 09:18:24 +0200 -Subject: [PATCH 19/27] sys-linux: rework get_first_ethernet() - -We can't assume that host has ethernet NIC named "eth0". Rather than guessing we -better ask udev. We iterate over symlinks symlinks in /sys/class/net and -for each device we determine if it is ethernet device and additionally we query -udev database for sub-type of the device. If we find PCI or USB device which has -ethernet datalink type and appropriate sub-type we return its name. If we don't -succeed in determining more information about device we will return "good -enough" device which in turn is first device with ethernet datalink type. - -Note that we now have two copies of get_first_ethernet() in the source code. This -is bad and should be fixed in the future. - -This commit replaces ppp-2.4.5-eth.patch. - -Resolves: #682381 ---- - pppd/Makefile.linux | 3 + - pppd/multilink.c | 4 +- - pppd/plugins/rp-pppoe/Makefile.linux | 4 +- - pppd/plugins/rp-pppoe/pppoe-discovery.c | 117 +++++++++++++++++++++++++++++++- - pppd/pppd.h | 2 +- - pppd/sys-linux.c | 115 +++++++++++++++++++++++++++++-- - 6 files changed, 232 insertions(+), 13 deletions(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 53df4d2..0e8107f 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -32,6 +32,9 @@ include .depend - endif - - # CC = gcc -+ -+LIBS = -ludev -+ - # - COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" - -diff --git a/pppd/multilink.c b/pppd/multilink.c -index 135cab0..2f0ed50 100644 ---- a/pppd/multilink.c -+++ b/pppd/multilink.c -@@ -436,12 +436,12 @@ static int - get_default_epdisc(ep) - struct epdisc *ep; - { -- char *p; -+ char *p = NULL; - struct hostent *hp; - u_int32_t addr; - - /* First try for an ethernet MAC address */ -- p = get_first_ethernet(); -+ get_first_ethernet(&p); - if (p != 0 && get_if_hwaddr(ep->value, p) >= 0) { - ep->class = EPD_MAC; - ep->length = 6; -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 9918091..b949716 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -30,8 +30,8 @@ COPTS=$(RPM_OPT_FLAGS) - CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' - all: rp-pppoe.so pppoe-discovery - --pppoe-discovery: pppoe-discovery.o debug.o -- $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -+pppoe-discovery: pppoe-discovery.o debug.o common.o -+ $(CC) $(LDFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o -ludev - - pppoe-discovery.o: pppoe-discovery.c - $(CC) $(CFLAGS) -I../../.. -c -o pppoe-discovery.o pppoe-discovery.c -diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c -index c0d927d..2bd910f 100644 ---- a/pppd/plugins/rp-pppoe/pppoe-discovery.c -+++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c -@@ -47,8 +47,13 @@ - #include - #endif - -+#include -+#include -+#include -+ - char *xstrdup(const char *s); - void usage(void); -+int get_first_ethernet(char **_r); - - void die(int status) - { -@@ -681,8 +686,15 @@ int main(int argc, char *argv[]) - } - - /* default interface name */ -- if (!conn->ifName) -- conn->ifName = strdup("eth0"); -+ if (!conn->ifName) { -+ char *eth_dev; -+ if (get_first_ethernet(ð_dev) < 0) { -+ fprintf(stderr, "No ethernet device on the host.\n"); -+ exit(1); -+ } -+ conn->ifName = eth_dev; -+ } -+ - - conn->discoverySocket = -1; - conn->sessionSocket = -1; -@@ -722,3 +734,104 @@ void usage(void) - " -h -- Print usage information.\n"); - fprintf(stderr, "\nVersion " RP_VERSION "\n"); - } -+ -+/* -+ * get_first_ethernet - return the name of the first ethernet-style -+ * interface on this system. -+ */ -+int -+get_first_ethernet(char **_r) -+{ -+ int r = 0; -+ DIR *d = NULL; -+ struct dirent *entry = NULL; -+ struct udev *udev = NULL; -+ struct udev_device *dev = NULL; -+ char *eth_dev = NULL; -+ -+ d = opendir("/sys/class/net"); -+ if (!d) { -+ fprintf(stderr, "Failed to open dir /sys/class/net : %m\n"); -+ r = -errno; -+ goto fail; -+ } -+ -+ udev = udev_new(); -+ if (!udev) { -+ fprintf(stderr, "Failed to talk to systemd-udevd\n"); -+ r = -EIO; -+ goto fail; -+ } -+ -+ while ((entry = readdir(d)) != NULL) { -+ char syspath[PATH_MAX] = {}; -+ const char *type = NULL; -+ -+ if ((strcmp(entry->d_name, ".") == 0) || (strcmp(entry->d_name, "..") == 0)) -+ continue; -+ -+ sprintf(syspath, "/sys/class/net/%s", entry->d_name); -+ -+ dev = udev_device_new_from_syspath(udev, syspath); -+ if (!dev) -+ continue; -+ -+ type = udev_device_get_sysattr_value(dev, "type"); -+ if (strcmp(type, "1") == 0) { -+ const char *pci_dev_subclass = NULL, *usb_dev_subclass = NULL; -+ -+ pci_dev_subclass = udev_device_get_property_value(dev, -+ "ID_PCI_SUBCLASS_FROM_DATABASE"); -+ usb_dev_subclass = udev_device_get_property_value(dev, -+ "ID_USB_SUBCLASS_FROM_DATABASE"); -+ -+ if ((pci_dev_subclass && strcmp(pci_dev_subclass, "Ethernet controller") == 0) || -+ (usb_dev_subclass && (strcmp(usb_dev_subclass, "Ethernet Networking") == 0 || -+ strcmp(usb_dev_subclass, "Ethernet Emulation") == 0))) { -+ char *d = NULL; -+ -+ d = strdup(entry->d_name); -+ if (!d) { -+ r = -ENOMEM; -+ goto fail; -+ } -+ -+ free(eth_dev); -+ eth_dev = d; -+ break; -+ } else if (!eth_dev) { -+ eth_dev = strdup(entry->d_name); -+ if (!eth_dev) { -+ r = -ENOMEM; -+ goto fail; -+ } -+ } -+ } -+ -+ udev_device_unref(dev); -+ dev = NULL; -+ } -+ -+ if (dev) -+ udev_device_unref(dev); -+ udev_unref(udev); -+ closedir(d); -+ -+ *_r = eth_dev; -+ -+ return 0; -+ -+fail: -+ if (dev) -+ udev_device_unref(dev); -+ -+ if (udev) -+ udev_unref(udev); -+ -+ if (d) -+ closedir(d); -+ -+ free(eth_dev); -+ -+ return r; -+} -diff --git a/pppd/pppd.h b/pppd/pppd.h -index de271c1..aaddba1 100644 ---- a/pppd/pppd.h -+++ b/pppd/pppd.h -@@ -691,7 +691,7 @@ int sipxfaddr __P((int, unsigned long, unsigned char *)); - int cipxfaddr __P((int)); - #endif - int get_if_hwaddr __P((u_char *addr, char *name)); --char *get_first_ethernet __P((void)); -+int get_first_ethernet __P((char **_r)); - - /* Procedures exported from options.c */ - int setipaddr __P((char *, char **, int)); /* Set local/remote ip addresses */ -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 0690019..ec09c50 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -92,6 +92,9 @@ - #include - #include - #include -+#include -+ -+#include - - /* This is in netdevice.h. However, this compile will fail miserably if - you attempt to include netdevice.h because it has so many references -@@ -1873,10 +1876,101 @@ get_if_hwaddr(u_char *addr, char *name) - * get_first_ethernet - return the name of the first ethernet-style - * interface on this system. - */ --char * --get_first_ethernet() --{ -- return "eth0"; -+int -+get_first_ethernet(char **_r) -+{ -+ int r = 0; -+ DIR *d = NULL; -+ struct dirent *entry = NULL; -+ struct udev *udev = NULL; -+ struct udev_device *dev = NULL; -+ char *eth_dev = NULL; -+ -+ d = opendir("/sys/class/net"); -+ if (!d) { -+ fprintf(stderr, "Failed to open dir /sys/class/net : %m\n"); -+ r = -errno; -+ goto fail; -+ } -+ -+ udev = udev_new(); -+ if (!udev) { -+ fprintf(stderr, "Failed to talk to systemd-udevd\n"); -+ r = -EIO; -+ goto fail; -+ } -+ -+ while ((entry = readdir(d)) != NULL) { -+ char syspath[PATH_MAX] = {}; -+ const char *type = NULL; -+ -+ if ((strcmp(entry->d_name, ".") == 0) || (strcmp(entry->d_name, "..") == 0)) -+ continue; -+ -+ sprintf(syspath, "/sys/class/net/%s", entry->d_name); -+ -+ dev = udev_device_new_from_syspath(udev, syspath); -+ if (!dev) -+ continue; -+ -+ type = udev_device_get_sysattr_value(dev, "type"); -+ if (strcmp(type, "1") == 0) { -+ const char *pci_dev_subclass = NULL, *usb_dev_subclass = NULL; -+ -+ pci_dev_subclass = udev_device_get_property_value(dev, -+ "ID_PCI_SUBCLASS_FROM_DATABASE"); -+ usb_dev_subclass = udev_device_get_property_value(dev, -+ "ID_USB_SUBCLASS_FROM_DATABASE"); -+ -+ if ((pci_dev_subclass && strcmp(pci_dev_subclass, "Ethernet controller") == 0) || -+ (usb_dev_subclass && (strcmp(usb_dev_subclass, "Ethernet Networking") == 0 || -+ strcmp(usb_dev_subclass, "Ethernet Emulation") == 0))) { -+ char *d = NULL; -+ -+ d = strdup(entry->d_name); -+ if (!d) { -+ r = -ENOMEM; -+ goto fail; -+ } -+ -+ free(eth_dev); -+ eth_dev = d; -+ break; -+ } else if (!eth_dev) { -+ eth_dev = strdup(entry->d_name); -+ if (!eth_dev) { -+ r = -ENOMEM; -+ goto fail; -+ } -+ } -+ } -+ -+ udev_device_unref(dev); -+ dev = NULL; -+ } -+ -+ if (dev) -+ udev_device_unref(dev); -+ udev_unref(udev); -+ closedir(d); -+ -+ *_r = eth_dev; -+ -+ return 0; -+ -+fail: -+ if (dev) -+ udev_device_unref(dev); -+ -+ if (udev) -+ udev_unref(udev); -+ -+ if (d) -+ closedir(d); -+ -+ free(eth_dev); -+ -+ return r; - } - - /******************************************************************** -@@ -2859,6 +2953,7 @@ ether_to_eui64(eui64_t *p_eui64) - struct ifreq ifr; - int skfd; - const unsigned char *ptr; -+ char *eth_dev = NULL; - - skfd = socket(PF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if(skfd == -1) -@@ -2867,11 +2962,19 @@ ether_to_eui64(eui64_t *p_eui64) - return 0; - } - -- strcpy(ifr.ifr_name, "eth0"); -+ if (get_first_ethernet(ð_dev) < 0) -+ { -+ warn("no ethernet device present on the host"); -+ return 0; -+ } -+ -+ strcpy(ifr.ifr_name, eth_dev); -+ free(eth_dev); -+ - if(ioctl(skfd, SIOCGIFHWADDR, &ifr) < 0) - { - close(skfd); -- warn("could not obtain hardware address for eth0"); -+ warn("could not obtain hardware address for %s", ifr.ifr_name); - return 0; - } - close(skfd); --- -1.8.3.1 - diff --git a/ppp-2.4.8-ws-2019-workaround.patch b/ppp-2.4.8-ws-2019-workaround.patch deleted file mode 100644 index 837a206..0000000 --- a/ppp-2.4.8-ws-2019-workaround.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 3cd95baf3f1de1d5a9bc89be0f4c3215ceb5aefe Mon Sep 17 00:00:00 2001 -From: yannayl -Date: Sun, 12 Jul 2020 12:12:08 +0300 -Subject: [PATCH] Accept Malformed Windows Success Message - -Windows Server 2019 skip a space when sending a success message. -This commit accepts such a malformed message and continues normally. - -Signed-off-by: Yannay Linveh -Signed-off-by: yannayl ---- - pppd/chap_ms.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c -index 1de50428..ffb6bd13 100644 ---- a/pppd/chap_ms.c -+++ b/pppd/chap_ms.c -@@ -423,6 +423,8 @@ chapms2_check_success(int id, unsigned char *msg, int len) - len -= MS_AUTH_RESPONSE_LENGTH; - if ((len >= 3) && !strncmp((char *)msg, " M=", 3)) { - msg += 3; /* Eat the delimiter */ -+ } else if ((len >= 2) && !strncmp((char *)msg, "M=", 2)) { -+ msg += 2; /* Eat the delimiter */ - } else if (len) { - /* Packet has extra text which does not begin " M=" */ - error("MS-CHAPv2 Success packet is badly formed."); diff --git a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch similarity index 58% rename from ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch rename to ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch index 016e310..c2c8cce 100644 --- a/ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ b/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch @@ -1,24 +1,8 @@ -From 69711944745af0078da77e108d30f89fd7e06108 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 12:01:33 +0200 -Subject: [PATCH 05/27] build-sys: don't hardcode LIBDIR, but set it according - to the target platform - ---- - pppd/Makefile.linux | 3 ++- - pppd/pathnames.h | 2 +- - pppd/plugins/Makefile.linux | 2 +- - pppd/plugins/pppoatm/Makefile.linux | 2 +- - pppd/plugins/pppol2tp/Makefile.linux | 4 ++-- - pppd/plugins/radius/Makefile.linux | 2 +- - pppd/plugins/rp-pppoe/Makefile.linux | 2 +- - 7 files changed, 9 insertions(+), 8 deletions(-) - diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 63872eb..8ed56c1 100644 +index 6a4b897..8f29c1f 100644 --- a/pppd/Makefile.linux +++ b/pppd/Makefile.linux -@@ -8,6 +8,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ +@@ -12,6 +12,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 INCDIR = $(DESTDIR)/include @@ -26,20 +10,20 @@ index 63872eb..8ed56c1 100644 TARGETS = pppd -@@ -32,7 +33,7 @@ endif +@@ -93,7 +94,7 @@ INCLUDE_DIRS= -I../include - # CC = gcc - # --COPTS = -Wall $(RPM_OPT_FLAGS) -+COPTS = -Wall $(RPM_OPT_FLAGS) -DLIBDIR=\""$(LIBDIR)"\" + COMPILE_FLAGS= -DHAVE_PATHS_H -DIPX_CHANGE -DHAVE_MMAP -pipe - # Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. +-CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS) '-DDESTDIR="@DESTDIR@"' ++CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS) '-DDESTDIR="@DESTDIR@"' -DLIBDIR=\""$(LIBDIR)"\" + + ifdef CHAPMS + CFLAGS += -DCHAPMS=1 diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index a33f046..a427cb8 100644 +index 524d608..c7eadbb 100644 --- a/pppd/pathnames.h +++ b/pppd/pathnames.h -@@ -57,7 +57,7 @@ +@@ -62,7 +62,7 @@ #ifdef PLUGIN #ifdef __STDC__ @@ -49,24 +33,24 @@ index a33f046..a427cb8 100644 #define _PATH_PLUGIN "/usr/lib/pppd" #endif /* __STDC__ */ diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index e09a369..b474a19 100644 +index 6403e3d..f42d18c 100644 --- a/pppd/plugins/Makefile.linux +++ b/pppd/plugins/Makefile.linux -@@ -7,7 +7,7 @@ INSTALL = install +@@ -5,7 +5,7 @@ COPTS=@CFLAGS@ DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin MANDIR = $(DESTDIR)/share/man/man8 -LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) +LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - SUBDIRS := rp-pppoe pppoatm pppol2tp - # Uncomment the next line to include the radius authentication plugin + CFLAGS = $(COPTS) -I.. -I../../include -fPIC + LDFLAGS_SHARED = -shared diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 5a81447..769794b 100644 +index d3a8086..c2aff0c 100644 --- a/pppd/plugins/pppoatm/Makefile.linux +++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -7,7 +7,7 @@ INSTALL = install - #*********************************************************************** +@@ -4,7 +4,7 @@ CC=$(CROSS_COMPILE)@CC@ + COPTS=@CFLAGS@ DESTDIR = $(INSTROOT)@DESTDIR@ -LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) @@ -74,39 +58,11 @@ index 5a81447..769794b 100644 VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index ea3538e..4339566 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -6,8 +6,8 @@ INSTALL = install - - #*********************************************************************** - --DESTDIR = @DESTDIR@ --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+DESTDIR = $(INSTROOT)@DESTDIR@ -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 45b3b8d..179d0b7 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -5,7 +5,7 @@ - - DESTDIR = $(INSTROOT)@DESTDIR@ - MANDIR = $(DESTDIR)/share/man/man8 --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/rp-pppoe/Makefile.linux b/pppd/plugins/rp-pppoe/Makefile.linux -index 352991a..1305ed8 100644 ---- a/pppd/plugins/rp-pppoe/Makefile.linux -+++ b/pppd/plugins/rp-pppoe/Makefile.linux -@@ -16,7 +16,7 @@ +diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux +index c415ce3..d3b7392 100644 +--- a/pppd/plugins/pppoe/Makefile.linux ++++ b/pppd/plugins/pppoe/Makefile.linux +@@ -18,7 +18,7 @@ COPTS=@CFLAGS@ DESTDIR = $(INSTROOT)@DESTDIR@ BINDIR = $(DESTDIR)/sbin @@ -115,6 +71,29 @@ index 352991a..1305ed8 100644 PPPDVERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) --- -1.8.3.1 - +diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux +index 1aa1c0b..e4442f9 100644 +--- a/pppd/plugins/pppol2tp/Makefile.linux ++++ b/pppd/plugins/pppol2tp/Makefile.linux +@@ -4,7 +4,7 @@ CC=$(CROSS_COMPILE)@CC@ + COPTS=@CFLAGS@ + + DESTDIR = $(INSTROOT)/@DESTDIR@ +-LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) ++LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) + + VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) + +diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux +index 489aef2..d2ef044 100644 +--- a/pppd/plugins/radius/Makefile.linux ++++ b/pppd/plugins/radius/Makefile.linux +@@ -9,7 +9,7 @@ COPTS=@CFLAGS@ + + DESTDIR = $(INSTROOT)@DESTDIR@ + MANDIR = $(DESTDIR)/share/man/man8 +-LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) ++LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) + + VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) + diff --git a/ppp-2.4.9-config.patch b/ppp-2.4.9-config.patch new file mode 100644 index 0000000..fc7c781 --- /dev/null +++ b/ppp-2.4.9-config.patch @@ -0,0 +1,21 @@ +diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux +index e77373e..07df6a7 100644 +--- a/pppd/Makefile.linux ++++ b/pppd/Makefile.linux +@@ -68,14 +68,14 @@ USE_TDB=y + #SYSTEMD=y + + HAS_SHADOW=y +-#USE_PAM=y ++USE_PAM=y + HAVE_INET6=y + + # Enable plugins + PLUGIN=y + + # Enable Microsoft proprietary Callback Control Protocol +-#CBCP=y ++CBCP=y + + # Enable EAP SRP-SHA1 authentication (requires libsrp) + #USE_SRP=y diff --git a/ppp-2.4.9-configure-cflags-allow-commas.patch b/ppp-2.4.9-configure-cflags-allow-commas.patch new file mode 100644 index 0000000..5a4ef98 --- /dev/null +++ b/ppp-2.4.9-configure-cflags-allow-commas.patch @@ -0,0 +1,17 @@ +diff --git a/configure b/configure +index f977663..c7031c2 100755 +--- a/configure ++++ b/configure +@@ -121,9 +121,9 @@ mkmkf() { + rm -f $2 + if [ -f $1 ]; then + echo " $2 <= $1" +- sed -e "s,@DESTDIR@,$DESTDIR,g" -e "s,@SYSCONF@,$SYSCONF,g" \ +- -e "s,@CROSS_COMPILE@,$CROSS_COMPILE,g" -e "s,@CC@,$CC,g" \ +- -e "s,@CFLAGS@,$CFLAGS,g" $1 >$2 ++ sed -e "s|@DESTDIR@|$DESTDIR|g" -e "s|@SYSCONF@|$SYSCONF|g" \ ++ -e "s|@CROSS_COMPILE@|$CROSS_COMPILE|g" -e "s|@CC@|$CC|g" \ ++ -e "s|@CFLAGS@|$CFLAGS|g" $1 >$2 + fi + } + diff --git a/ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch b/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch similarity index 99% rename from ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch rename to ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch index 87613af..84a3bdb 100644 --- a/ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch +++ b/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch @@ -43,8 +43,8 @@ index 6d50d1b..4880377 100644 if (log_to_fd >= 0) errfd = log_to_fd; else -- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0600); -+ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0600); +- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0644); ++ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0644); ++conn_running; pid = safe_fork(in, out, errfd); diff --git a/ppp.spec b/ppp.spec index cb0a87a..b2c7658 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ppp -Version: 2.4.8 -Release: 8%{?dist} +Version: 2.4.9 +Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -22,37 +22,22 @@ Source11: ifdown-ppp Source12: ppp-watch.tar.xz # Fedora-specific -Patch0002: ppp-2.4.8-build-sys-enable-PAM-support.patch -Patch0003: ppp-2.4.8-build-sys-utilize-compiler-flags-handed-to-us-by-rpm.patch -Patch0004: 0004-doc-add-configuration-samples.patch -Patch0005: ppp-2.4.8-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch -Patch0006: 0006-scritps-use-change_resolv_conf-function.patch -Patch0007: 0007-build-sys-don-t-strip-binaries-during-installation.patch -Patch0008: 0008-build-sys-use-prefix-usr-instead-of-usr-local.patch -Patch0009: ppp-2.4.8-pppd-introduce-ipv6-accept-remote.patch -Patch0010: 0010-build-sys-enable-CBCP.patch -Patch0011: 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch -Patch0012: ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch -Patch0013: ppp-2.4.8-everywhere-O_CLOEXEC-harder.patch -Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch -Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch -Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch -Patch0018: 0018-scritps-fix-ip-up.local-sample.patch -Patch0019: ppp-2.4.8-sys-linux-rework-get_first_ethernet.patch -Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch -Patch0021: ppp-2.4.8-build-sys-compile-pppol2tp-plugin-with-RPM_OPT_FLAGS.patch -Patch0022: ppp-2.4.8-build-sys-compile-pppol2tp-with-multilink-support.patch -Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch -Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch -Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch -# https://www.nikhef.nl/~janjust/ppp/ppp-2.4.8-eaptls-mppe-1.300.patch -Patch0026: ppp-2.4.8-eaptls-mppe-1.300.patch - -Patch0032: ppp-2.4.8-CVE-2020-8597.patch -# rhbz#1612918, https://github.com/paulusmack/ppp/pull/149 -Patch0033: ppp-2.4.8-man-fix.patch -# rhbz#1867047, https://github.com/paulusmack/ppp/commit/3cd95baf3f1de1d5a9bc89be0f4c3215ceb5aefe.patch -Patch0034: ppp-2.4.8-ws-2019-workaround.patch +Patch0002: ppp-2.4.9-config.patch +Patch0004: 0004-doc-add-configuration-samples.patch +Patch0005: ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +Patch0006: 0006-scritps-use-change_resolv_conf-function.patch +Patch0011: 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch +Patch0012: ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch +Patch0013: ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch +Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch +Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch +Patch0018: 0018-scritps-fix-ip-up.local-sample.patch +Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch +Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch +Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch +Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch +Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel @@ -92,8 +77,7 @@ This package contains the header files for building plugins for ppp. tar -xJf %{SOURCE12} %build -export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" -%configure +%configure --cflags="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" %{make_build} LDFLAGS="%{?build_ldflags} -pie" %{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" @@ -186,6 +170,10 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Tue Jan 5 2021 Jaroslav Škarvada - 2.4.9-1 +- New version + Resolves: rhbz#1912617 + * Mon Aug 10 2020 Jaroslav Škarvada - 2.4.8-8 - Added workaround for Windows Server 2019 Resolves: rhbz#1867047 diff --git a/sources b/sources index f30d28e..db4f244 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a -SHA512 (ppp-2.4.8.tar.gz) = a99b3b6c7bd80cd133bda4e29d33c793a76f3b67e1f8db774547e88932ce29564fad390a4f51d3fe30a75e006499b95000b042ae0f64cd360548426f8091a478 +SHA512 (ppp-2.4.9.tar.gz) = c309f8f69f534c05547cd2f66dade0e0f198ea4c2928a7e899e660280786b3e965437a67b8c5bb81c59d0fa1818b4eb7b701d2dce015a420d380422d2bca4e1a From f1667c8a0fd4e35830ef1f3835361a7520f4f618 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Fri, 8 Jan 2021 19:28:43 +0000 Subject: [PATCH 35/76] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- ppp.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ppp.spec b/ppp.spec index b2c7658..9dc28d7 100644 --- a/ppp.spec +++ b/ppp.spec @@ -39,6 +39,7 @@ Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch +BuildRequires: make BuildRequires: gcc BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel BuildRequires: openssl-devel From e8f51851e79460ecc0b303e5c4b367c3b148b4e9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 08:31:13 +0000 Subject: [PATCH 36/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 9dc28d7..c9ce30f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -171,6 +171,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 2.4.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Tue Jan 5 2021 Jaroslav Škarvada - 2.4.9-1 - New version Resolves: rhbz#1912617 From bfc43d320dcff8bfe352e38bf68b320143538c98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 8 Mar 2021 21:12:25 +0100 Subject: [PATCH 37/76] Keep lock files in /var/lock (https://github.com/ppp-project/ppp/pull/227) --- ...-pppd-put-lock-files-in-var-lock-ppp.patch | 26 ------------------- ppp-tmpfiles.conf | 1 - ppp.spec | 11 ++++---- 3 files changed, 5 insertions(+), 33 deletions(-) delete mode 100644 0020-pppd-put-lock-files-in-var-lock-ppp.patch diff --git a/0020-pppd-put-lock-files-in-var-lock-ppp.patch b/0020-pppd-put-lock-files-in-var-lock-ppp.patch deleted file mode 100644 index 93d26c5..0000000 --- a/0020-pppd-put-lock-files-in-var-lock-ppp.patch +++ /dev/null @@ -1,26 +0,0 @@ -From c5a5f795b1defcb6d168e79c4d1fc371dfc556ca Mon Sep 17 00:00:00 2001 -From: Jiri Skala -Date: Wed, 9 Apr 2014 09:29:50 +0200 -Subject: [PATCH 20/27] pppd: put lock files in /var/lock/ppp - -Resolves: #708260 ---- - pppd/utils.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/utils.c b/pppd/utils.c -index 6051b9a..8407492 100644 ---- a/pppd/utils.c -+++ b/pppd/utils.c -@@ -846,7 +846,7 @@ complete_read(int fd, void *buf, size_t count) - /* Procedures for locking the serial device using a lock file. */ - #ifndef LOCK_DIR - #ifdef __linux__ --#define LOCK_DIR "/var/lock" -+#define LOCK_DIR "/var/lock/ppp" - #else - #ifdef SVR4 - #define LOCK_DIR "/var/spool/locks" --- -1.8.3.1 - diff --git a/ppp-tmpfiles.conf b/ppp-tmpfiles.conf index a07719c..1097cbe 100644 --- a/ppp-tmpfiles.conf +++ b/ppp-tmpfiles.conf @@ -1,2 +1 @@ d /run/ppp 0755 root root -d /run/lock/ppp 0755 root root diff --git a/ppp.spec b/ppp.spec index c9ce30f..0db24f8 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 2%{?dist} +Release: 3%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -33,7 +33,6 @@ Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch Patch0018: 0018-scritps-fix-ip-up.local-sample.patch -Patch0020: 0020-pppd-put-lock-files-in-var-lock-ppp.patch Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch @@ -72,8 +71,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release} This package contains the header files for building plugins for ppp. %prep -%setup -qn %{name}-%{name}-%{version} -%autopatch -p1 +%autosetup -p1 -n %{name}-%{name}-%{version} tar -xJf %{SOURCE12} @@ -117,7 +115,6 @@ install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdo # ghosts mkdir -p %{buildroot}%{_rundir}/ppp -mkdir -p %{buildroot}%{_rundir}/lock/ppp %pre /usr/bin/getent group dip >/dev/null 2>&1 || /usr/sbin/groupadd -r -g 40 dip >/dev/null 2>&1 || : @@ -150,7 +147,6 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %{_mandir}/man8/ppp-watch.8* %{_libdir}/pppd %ghost %dir %{_rundir}/ppp -%ghost %dir %{_rundir}/lock/ppp %dir %{_sysconfdir}/logrotate.d %attr(700, root, root) %dir %{_localstatedir}/log/ppp %config(noreplace) %{_sysconfdir}/ppp/eaptls-client @@ -171,6 +167,9 @@ mkdir -p %{buildroot}%{_rundir}/lock/ppp %doc PLUGINS %changelog +* Mon Mar 8 2021 Jaroslav Škarvada - 2.4.9-3 +- Keep lock files in /var/lock (https://github.com/ppp-project/ppp/pull/227) + * Wed Jan 27 2021 Fedora Release Engineering - 2.4.9-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From ebfb905788add703e4213479328f9f3335a8ce0b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 03:59:18 +0000 Subject: [PATCH 38/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 0db24f8..05abb1a 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 3%{?dist} +Release: 4%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -167,6 +167,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 2.4.9-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Mon Mar 8 2021 Jaroslav Škarvada - 2.4.9-3 - Keep lock files in /var/lock (https://github.com/ppp-project/ppp/pull/227) From 0221a70cad5679021d228ac75d4893d66d2b813d Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:12:00 +0200 Subject: [PATCH 39/76] Rebuilt with OpenSSL 3.0.0 --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 05abb1a..f12567f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 4%{?dist} +Release: 5%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -167,6 +167,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Tue Sep 14 2021 Sahana Prasad - 2.4.9-5 +- Rebuilt with OpenSSL 3.0.0 + * Fri Jul 23 2021 Fedora Release Engineering - 2.4.9-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 879a84b9d88ea14d680dd3f7b0c9640ae4d4829c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jan 2022 09:22:37 +0000 Subject: [PATCH 40/76] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index f12567f..2e9c6f3 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 5%{?dist} +Release: 6%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -167,6 +167,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Fri Jan 21 2022 Fedora Release Engineering - 2.4.9-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Tue Sep 14 2021 Sahana Prasad - 2.4.9-5 - Rebuilt with OpenSSL 3.0.0 From 8c079e9264451529856e83f483c9c00e33e98149 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcin=20Zaj=C4=85czkowski?= <148013+szpak@users.noreply.github.com> Date: Tue, 5 Apr 2022 23:45:18 +0200 Subject: [PATCH 41/76] Backport patches from master for SSTP and EAP-TLS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With those changes will allow pppd to connect to an Azure VnetGWay using SSTP (or using EAP-TLS to a Windows RAS server). Backport to Fedora endorsed by Eivind Næss, their author and the author of sstp-client and network-manager-sstp. Links to git commits used to generate patches: https://github.com/ppp-project/ppp/commit/e609ed8bb62e4648568eaa49fbbc858dfda6d122 https://github.com/ppp-project/ppp/commit/d706c95906d996534f13632a747af5dc617f306e https://github.com/ppp-project/ppp/commit/d7e62a8499c4032d79e05afbd8fd3efd51c5b148 (the first one is only needed to make the second apply in the original form from Git - those changed lines are removed anyway) --- ...MPPE-keys-generated-through-an-API-2.patch | 898 ++++++++++++++++++ ...-error-in-comparing-valid-encryption.patch | 37 + ...-causing-incorrect-response-length-3.patch | 32 + ppp.spec | 8 +- 4 files changed, 974 insertions(+), 1 deletion(-) create mode 100644 ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch create mode 100644 ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch create mode 100644 ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch diff --git a/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch b/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch new file mode 100644 index 0000000..fb0bcc1 --- /dev/null +++ b/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch @@ -0,0 +1,898 @@ +From d706c95906d996534f13632a747af5dc617f306e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Eivind=20N=C3=A6ss?= +Date: Sat, 24 Apr 2021 03:00:34 -0700 +Subject: [PATCH] pppd: Expose the MPPE keys generated through an API (#267) + +The lengthy part of this fix is to refactor the handling of MPPE keys +by moving it into mppe.c and thus reducing the clutter in chap_ms.c. +It does so by renaming the mppe_set_keys/2 to the corresponding +mppe_set_chapv1/mppe_set_chapv2 versions and updates callers of these +functions. + +Having done so, it conveniently allows the name "mppe_set_keys" to be +re-used for this new purpose which will copy the key material up to +its size and then clear the input parameters (avoids leaving the MPPE +keys on the stack). + +Additional functiions added to the MPPE code allow plugins et al. to +access the MPPE keys, clear the keys, and check if they are set. All +plugin and CCP code has been updated to use this API. + +This fixes GitHub Issue #258 + +Signed-off-by: Eivind Naess +--- + pppd/Makefile.linux | 2 + + pppd/Makefile.sol2 | 2 +- + pppd/ccp.c | 15 +-- + pppd/chap_ms.c | 167 +---------------------- + pppd/chap_ms.h | 22 +--- + pppd/eap-tls.c | 21 +-- + pppd/eap-tls.h | 5 - + pppd/mppe.c | 248 +++++++++++++++++++++++++++++++++++ + pppd/mppe.h | 70 +++++++++- + pppd/plugins/radius/radius.c | 14 +- + pppd/plugins/winbind.c | 8 +- + 11 files changed, 348 insertions(+), 226 deletions(-) + create mode 100644 pppd/mppe.c + +diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux +index f92f7c0..852945e 100644 +--- a/pppd/Makefile.linux ++++ b/pppd/Makefile.linux +@@ -109,6 +109,8 @@ CFLAGS += -DMSLANMAN=1 + endif + ifdef MPPE + CFLAGS += -DMPPE=1 ++PPPDOBJS += mppe.o ++PPPDSRC += mppe.c + HEADERS += mppe.h + endif + endif +diff --git a/pppd/Makefile.sol2 b/pppd/Makefile.sol2 +index 809cb4b..3a8681c 100644 +--- a/pppd/Makefile.sol2 ++++ b/pppd/Makefile.sol2 +@@ -37,7 +37,7 @@ OBJS += ipv6cp.o eui64.o + + # Uncomment to enable MS-CHAP + CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H +-OBJS += chap_ms.o pppcrypt.o md4.o sha1.o ++OBJS += chap_ms.o pppcrypt.o md4.o sha1.o mppe.o + + # Uncomment to enable MPPE (in both CHAP and EAP-TLS) + CFLAGS += -DMPPE +diff --git a/pppd/ccp.c b/pppd/ccp.c +index 052c4c6..387b571 100644 +--- a/pppd/ccp.c ++++ b/pppd/ccp.c +@@ -38,10 +38,9 @@ + #include "ccp.h" + #include + +-#ifdef MPPE +-#include "chap_ms.h" /* mppe_xxxx_key, mppe_keys_set */ ++#include "chap_ms.h" ++#include "mppe.h" + #include "lcp.h" /* lcp_close(), lcp_fsm */ +-#endif + + + /* +@@ -574,7 +573,7 @@ ccp_resetci(fsm *f) + } + + /* A plugin (eg radius) may not have obtained key material. */ +- if (!mppe_keys_set) { ++ if (!mppe_keys_isset()) { + error("MPPE required, but keys are not available. " + "Possible plugin problem?"); + lcp_close(f->unit, "MPPE required but not available"); +@@ -705,7 +704,7 @@ static void + p[1] = opt_buf[1] = CILEN_MPPE; + MPPE_OPTS_TO_CI(go->mppe, &p[2]); + MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]); +- BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); ++ mppe_get_recv_key(&opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); + res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0); + if (res > 0) + p += CILEN_MPPE; +@@ -1156,8 +1155,7 @@ ccp_reqci(fsm *f, u_char *p, int *lenp, int dont_nak) + int mtu; + + BCOPY(p, opt_buf, CILEN_MPPE); +- BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], +- MPPE_MAX_KEY_LEN); ++ mppe_get_send_key(&opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); + if (ccp_test(f->unit, opt_buf, + CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) { + /* This shouldn't happen, we've already tested it! */ +@@ -1426,8 +1424,7 @@ ccp_up(fsm *f) + notice("%s transmit compression enabled", method_name(ho, NULL)); + #ifdef MPPE + if (go->mppe) { +- BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN); +- BZERO(mppe_send_key, MPPE_MAX_KEY_LEN); ++ mppe_clear_keys(); + continue_networks(f->unit); /* Bring up IP et al */ + } + #endif +diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c +index df2dadd..d315ab4 100644 +--- a/pppd/chap_ms.c ++++ b/pppd/chap_ms.c +@@ -93,8 +93,7 @@ + #include "sha1.h" + #include "pppcrypt.h" + #include "magic.h" +- +- ++#include "mppe.h" + + static void ascii2unicode (char[], int, u_char[]); + static void NTPasswordHash (u_char *, int, u_char[MD4_SIGNATURE_SIZE]); +@@ -109,21 +108,12 @@ static void GenerateAuthenticatorResponsePlain + static void ChapMS_LANMan (u_char *, char *, int, u_char *); + #endif + +-#ifdef MPPE +-static void Set_Start_Key (u_char *, char *, int); +-static void SetMasterKeys (char *, int, u_char[24], int); +-#endif +- + #ifdef MSLANMAN + bool ms_lanman = 0; /* Use LanMan password instead of NT */ + /* Has meaning only with MS-CHAP challenges */ + #endif + + #ifdef MPPE +-u_char mppe_send_key[MPPE_MAX_KEY_LEN]; +-u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +-int mppe_keys_set = 0; /* Have the MPPE keys been set? */ +- + #ifdef DEBUGMPPEKEY + /* For MPPE debug */ + /* Use "[]|}{?/><,`!2&&(" (sans quotes) for RFC 3079 MS-CHAPv2 test value */ +@@ -719,28 +709,6 @@ GenerateAuthenticatorResponsePlain + + + #ifdef MPPE +-/* +- * Set mppe_xxxx_key from the NTPasswordHashHash. +- * RFC 2548 (RADIUS support) requires us to export this function (ugh). +- */ +-void +-mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) +-{ +- SHA1_CTX sha1Context; +- u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ +- +- SHA1_Init(&sha1Context); +- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); +- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); +- SHA1_Update(&sha1Context, rchallenge, 8); +- SHA1_Final(Digest, &sha1Context); +- +- /* Same key in both directions. */ +- BCOPY(Digest, mppe_send_key, sizeof(mppe_send_key)); +- BCOPY(Digest, mppe_recv_key, sizeof(mppe_recv_key)); +- +- mppe_keys_set = 1; +-} + + /* + * Set mppe_xxxx_key from MS-CHAP credentials. (see RFC 3079) +@@ -757,104 +725,7 @@ Set_Start_Key(u_char *rchallenge, char *secret, int secret_len) + NTPasswordHash(unicodePassword, secret_len * 2, PasswordHash); + NTPasswordHash(PasswordHash, sizeof(PasswordHash), PasswordHashHash); + +- mppe_set_keys(rchallenge, PasswordHashHash); +-} +- +-/* +- * Set mppe_xxxx_key from MS-CHAPv2 credentials. (see RFC 3079) +- * +- * This helper function used in the Winbind module, which gets the +- * NTHashHash from the server. +- */ +-void +-mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], +- u_char NTResponse[24], int IsServer) +-{ +- SHA1_CTX sha1Context; +- u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ +- u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ +- +- u_char SHApad1[40] = +- { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; +- u_char SHApad2[40] = +- { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, +- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, +- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, +- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 }; +- +- /* "This is the MPPE Master Key" */ +- u_char Magic1[27] = +- { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, +- 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d, +- 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 }; +- /* "On the client side, this is the send key; " +- "on the server side, it is the receive key." */ +- u_char Magic2[84] = +- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, +- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, +- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, +- 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79, +- 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, +- 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65, +- 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, +- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, +- 0x6b, 0x65, 0x79, 0x2e }; +- /* "On the client side, this is the receive key; " +- "on the server side, it is the send key." */ +- u_char Magic3[84] = +- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, +- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, +- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, +- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, +- 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, +- 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, +- 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, +- 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, +- 0x6b, 0x65, 0x79, 0x2e }; +- u_char *s; +- +- SHA1_Init(&sha1Context); +- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); +- SHA1_Update(&sha1Context, NTResponse, 24); +- SHA1_Update(&sha1Context, Magic1, sizeof(Magic1)); +- SHA1_Final(MasterKey, &sha1Context); +- +- /* +- * generate send key +- */ +- if (IsServer) +- s = Magic3; +- else +- s = Magic2; +- SHA1_Init(&sha1Context); +- SHA1_Update(&sha1Context, MasterKey, 16); +- SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); +- SHA1_Update(&sha1Context, s, 84); +- SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); +- SHA1_Final(Digest, &sha1Context); +- +- BCOPY(Digest, mppe_send_key, sizeof(mppe_send_key)); +- +- /* +- * generate recv key +- */ +- if (IsServer) +- s = Magic2; +- else +- s = Magic3; +- SHA1_Init(&sha1Context); +- SHA1_Update(&sha1Context, MasterKey, 16); +- SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); +- SHA1_Update(&sha1Context, s, 84); +- SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); +- SHA1_Final(Digest, &sha1Context); +- +- BCOPY(Digest, mppe_recv_key, sizeof(mppe_recv_key)); +- +- mppe_keys_set = 1; ++ mppe_set_chapv1(rchallenge, PasswordHashHash); + } + + /* +@@ -870,7 +741,7 @@ SetMasterKeys(char *secret, int secret_len, u_char NTResponse[24], int IsServer) + ascii2unicode(secret, secret_len, unicodePassword); + NTPasswordHash(unicodePassword, secret_len * 2, PasswordHash); + NTPasswordHash(PasswordHash, sizeof(PasswordHash), PasswordHashHash); +- mppe_set_keys2(PasswordHashHash, NTResponse, IsServer); ++ mppe_set_chapv2(PasswordHashHash, NTResponse, IsServer); + } + + #endif /* MPPE */ +@@ -945,38 +816,6 @@ ChapMS2(u_char *rchallenge, u_char *PeerChallenge, + #endif + } + +-#ifdef MPPE +-/* +- * Set MPPE options from plugins. +- */ +-void +-set_mppe_enc_types(int policy, int types) +-{ +- /* Early exit for unknown policies. */ +- if (policy != MPPE_ENC_POL_ENC_ALLOWED && +- policy != MPPE_ENC_POL_ENC_REQUIRED) +- return; +- +- /* Don't modify MPPE if it's optional and wasn't already configured. */ +- if (policy == MPPE_ENC_POL_ENC_ALLOWED && !ccp_wantoptions[0].mppe) +- return; +- +- /* +- * Disable undesirable encryption types. Note that we don't ENABLE +- * any encryption types, to avoid overriding manual configuration. +- */ +- switch(types) { +- case MPPE_ENC_TYPES_RC4_40: +- ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ +- break; +- case MPPE_ENC_TYPES_RC4_128: +- ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ +- break; +- default: +- break; +- } +-} +-#endif /* MPPE */ + + static struct chap_digest_type chapms_digest = { + CHAP_MICROSOFT, /* code */ +diff --git a/pppd/chap_ms.h b/pppd/chap_ms.h +index 005eb63..4e6a621 100644 +--- a/pppd/chap_ms.h ++++ b/pppd/chap_ms.h +@@ -38,6 +38,7 @@ + #define MS_CHAP_RESPONSE_LEN 49 /* Response length for MS-CHAP */ + #define MS_CHAP2_RESPONSE_LEN 49 /* Response length for MS-CHAPv2 */ + #define MS_AUTH_RESPONSE_LENGTH 40 /* MS-CHAPv2 authenticator response, */ ++#define MS_AUTH_NTRESP_LEN 24 /* Length of NT-response field */ + /* as ASCII */ + + /* E=eeeeeeeeee error codes for MS-CHAP failure messages. */ +@@ -67,22 +68,6 @@ + #define MS_CHAP2_NTRESP_LEN 24 + #define MS_CHAP2_FLAGS 48 + +-#ifdef MPPE +-#include "mppe.h" /* MPPE_MAX_KEY_LEN */ +-extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; +-extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +-extern int mppe_keys_set; +- +-/* These values are the RADIUS attribute values--see RFC 2548. */ +-#define MPPE_ENC_POL_ENC_ALLOWED 1 +-#define MPPE_ENC_POL_ENC_REQUIRED 2 +-#define MPPE_ENC_TYPES_RC4_40 2 +-#define MPPE_ENC_TYPES_RC4_128 4 +- +-/* used by plugins (using above values) */ +-extern void set_mppe_enc_types(int, int); +-#endif +- + /* Are we the authenticator or authenticatee? For MS-CHAPv2 key derivation. */ + #define MS_CHAP2_AUTHENTICATEE 0 + #define MS_CHAP2_AUTHENTICATOR 1 +@@ -90,11 +75,6 @@ extern void set_mppe_enc_types(int, int); + void ChapMS (u_char *, char *, int, u_char *); + void ChapMS2 (u_char *, u_char *, char *, char *, int, + u_char *, u_char[MS_AUTH_RESPONSE_LENGTH+1], int); +-#ifdef MPPE +-void mppe_set_keys (u_char *, u_char[MD4_SIGNATURE_SIZE]); +-void mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], +- u_char NTResponse[24], int IsServer); +-#endif + + void ChallengeHash (u_char[16], u_char *, char *, u_char[8]); + +diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c +index 5c202c7..bfcf199 100644 +--- a/pppd/eap-tls.c ++++ b/pppd/eap-tls.c +@@ -48,6 +48,8 @@ + #include "eap-tls.h" + #include "fsm.h" + #include "lcp.h" ++#include "chap_ms.h" ++#include "mppe.h" + #include "pathnames.h" + + typedef struct pw_cb_data +@@ -74,10 +76,6 @@ int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); + X509 *get_X509_from_file(char *filename); + int ssl_cmp_certs(char *filename, X509 * a); + +-#ifdef MPPE +- +-#define EAPTLS_MPPE_KEY_LEN 32 +- + /* + * OpenSSL 1.1+ introduced a generic TLS_method() + * For older releases we substitute the appropriate method +@@ -119,6 +117,8 @@ static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) + + #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ + ++#ifdef MPPE ++#define EAPTLS_MPPE_KEY_LEN 32 + + /* + * Generate keys according to RFC 2716 and add to reply +@@ -161,24 +161,17 @@ void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) + */ + if (client) + { +- p = out; +- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); +- p += EAPTLS_MPPE_KEY_LEN; +- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); ++ mppe_set_keys(out, out + EAPTLS_MPPE_KEY_LEN, EAPTLS_MPPE_KEY_LEN); + } + else + { +- p = out; +- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); +- p += EAPTLS_MPPE_KEY_LEN; +- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); ++ mppe_set_keys(out + EAPTLS_MPPE_KEY_LEN, out, EAPTLS_MPPE_KEY_LEN); + } +- +- mppe_keys_set = 1; + } + + #endif /* MPPE */ + ++ + void log_ssl_errors( void ) + { + unsigned long ssl_err = ERR_get_error(); +diff --git a/pppd/eap-tls.h b/pppd/eap-tls.h +index c74a831..b935ec5 100644 +--- a/pppd/eap-tls.h ++++ b/pppd/eap-tls.h +@@ -86,11 +86,6 @@ int get_eaptls_secret(int unit, char *client, char *server, + char *capath, char *pkfile, int am_server); + + #ifdef MPPE +-#include "mppe.h" /* MPPE_MAX_KEY_LEN */ +-extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; +-extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; +-extern int mppe_keys_set; +- + void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); + #endif + +diff --git a/pppd/mppe.c b/pppd/mppe.c +new file mode 100644 +index 0000000..4f3d131 +--- /dev/null ++++ b/pppd/mppe.c +@@ -0,0 +1,248 @@ ++/* * mppe.c - MPPE key implementation ++ * ++ * Copyright (c) 2020 Eivind Naess. All rights reserved. ++ * Copyright (c) 2008 Paul Mackerras. All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in ++ * the documentation and/or other materials provided with the ++ * distribution. ++ * ++ * 3. The name(s) of the authors of this software must not be used to ++ * endorse or promote products derived from this software without ++ * prior written permission. ++ * ++ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO ++ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY ++ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY ++ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN ++ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING ++ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ * ++ */ ++ ++#include ++ ++#include "pppd.h" ++#include "fsm.h" ++#include "md4.h" ++#include "sha1.h" ++#include "ccp.h" ++#include "chap_ms.h" ++#include "mppe.h" ++ ++u_char mppe_send_key[MPPE_MAX_KEY_SIZE]; ++u_char mppe_recv_key[MPPE_MAX_KEY_SIZE]; ++int mppe_keys_set = 0; ++ ++void ++mppe_set_keys(u_char *send_key, u_char *recv_key, int keylen) ++{ ++ int length = keylen; ++ if (length > MPPE_MAX_KEY_SIZE) ++ length = MPPE_MAX_KEY_SIZE; ++ ++ if (send_key) { ++ BCOPY(send_key, mppe_send_key, length); ++ BZERO(send_key, keylen); ++ } ++ ++ if (recv_key) { ++ BCOPY(recv_key, mppe_recv_key, length); ++ BZERO(recv_key, keylen); ++ } ++ ++ mppe_keys_set = length; ++} ++ ++bool ++mppe_keys_isset() ++{ ++ return !!mppe_keys_set; ++} ++ ++int ++mppe_get_recv_key(u_char *recv_key, int length) ++{ ++ if (mppe_keys_isset()) { ++ if (length > mppe_keys_set) ++ length = mppe_keys_set; ++ BCOPY(mppe_recv_key, recv_key, length); ++ return length; ++ } ++ return 0; ++} ++ ++int ++mppe_get_send_key(u_char *send_key, int length) ++{ ++ if (mppe_keys_isset()) { ++ if (length > mppe_keys_set) ++ length = mppe_keys_set; ++ BCOPY(mppe_send_key, send_key, length); ++ return length; ++ } ++ return 0; ++} ++ ++void ++mppe_clear_keys(void) ++{ ++ mppe_keys_set = 0; ++ BZERO(mppe_send_key, sizeof(mppe_send_key)); ++ BZERO(mppe_recv_key, sizeof(mppe_recv_key)); ++} ++ ++/* ++ * Set mppe_xxxx_key from the NTPasswordHashHash. ++ * RFC 2548 (RADIUS support) requires us to export this function (ugh). ++ */ ++void ++mppe_set_chapv1(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) ++{ ++ SHA1_CTX sha1Context; ++ u_char Digest[SHA1_SIGNATURE_SIZE]; ++ ++ SHA1_Init(&sha1Context); ++ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); ++ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); ++ SHA1_Update(&sha1Context, rchallenge, 8); ++ SHA1_Final(Digest, &sha1Context); ++ ++ /* Same key in both directions. */ ++ mppe_set_keys(Digest, Digest, sizeof(Digest)); ++} ++ ++/* ++ * Set mppe_xxxx_key from MS-CHAPv2 credentials. (see RFC 3079) ++ * ++ * This helper function used in the Winbind module, which gets the ++ * NTHashHash from the server. ++ */ ++void ++mppe_set_chapv2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], ++ u_char NTResponse[MS_AUTH_NTRESP_LEN], int IsServer) ++{ ++ SHA1_CTX sha1Context; ++ u_char MasterKey[SHA1_SIGNATURE_SIZE]; ++ u_char SendKey[SHA1_SIGNATURE_SIZE]; ++ u_char RecvKey[SHA1_SIGNATURE_SIZE]; ++ ++ u_char SHApad1[40] = ++ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, ++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, ++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, ++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; ++ u_char SHApad2[40] = ++ { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, ++ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, ++ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, ++ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 }; ++ ++ /* "This is the MPPE Master Key" */ ++ u_char Magic1[27] = ++ { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, ++ 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d, ++ 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 }; ++ /* "On the client side, this is the send key; " ++ "on the server side, it is the receive key." */ ++ u_char Magic2[84] = ++ { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, ++ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, ++ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, ++ 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79, ++ 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, ++ 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65, ++ 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, ++ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, ++ 0x6b, 0x65, 0x79, 0x2e }; ++ /* "On the client side, this is the receive key; " ++ "on the server side, it is the send key." */ ++ u_char Magic3[84] = ++ { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, ++ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, ++ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, ++ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, ++ 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, ++ 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, ++ 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, ++ 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, ++ 0x6b, 0x65, 0x79, 0x2e }; ++ u_char *s; ++ ++ SHA1_Init(&sha1Context); ++ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); ++ SHA1_Update(&sha1Context, NTResponse, 24); ++ SHA1_Update(&sha1Context, Magic1, sizeof(Magic1)); ++ SHA1_Final(MasterKey, &sha1Context); ++ ++ /* ++ * generate send key ++ */ ++ if (IsServer) ++ s = Magic3; ++ else ++ s = Magic2; ++ SHA1_Init(&sha1Context); ++ SHA1_Update(&sha1Context, MasterKey, 16); ++ SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); ++ SHA1_Update(&sha1Context, s, 84); ++ SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); ++ SHA1_Final(SendKey, &sha1Context); ++ ++ /* ++ * generate recv key ++ */ ++ if (IsServer) ++ s = Magic2; ++ else ++ s = Magic3; ++ SHA1_Init(&sha1Context); ++ SHA1_Update(&sha1Context, MasterKey, 16); ++ SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); ++ SHA1_Update(&sha1Context, s, 84); ++ SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); ++ SHA1_Final(RecvKey, &sha1Context); ++ ++ mppe_set_keys(SendKey, RecvKey, SHA1_SIGNATURE_SIZE); ++} ++ ++/* ++ * Set MPPE options from plugins. ++ */ ++void ++mppe_set_enc_types(int policy, int types) ++{ ++ /* Early exit for unknown policies. */ ++ if (policy != MPPE_ENC_POL_ENC_ALLOWED && ++ policy != MPPE_ENC_POL_ENC_REQUIRED) ++ return; ++ ++ /* Don't modify MPPE if it's optional and wasn't already configured. */ ++ if (policy == MPPE_ENC_POL_ENC_ALLOWED && !ccp_wantoptions[0].mppe) ++ return; ++ ++ /* ++ * Disable undesirable encryption types. Note that we don't ENABLE ++ * any encryption types, to avoid overriding manual configuration. ++ */ ++ switch(types) { ++ case MPPE_ENC_TYPES_RC4_40: ++ ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ ++ break; ++ case MPPE_ENC_TYPES_RC4_128: ++ ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ ++ break; ++ default: ++ break; ++ } ++} ++ +diff --git a/pppd/mppe.h b/pppd/mppe.h +index 5eb3b37..98a89d3 100644 +--- a/pppd/mppe.h ++++ b/pppd/mppe.h +@@ -32,9 +32,12 @@ + * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ ++#ifndef __MPPE_H__ ++#define __MPPE_H__ + + #define MPPE_PAD 4 /* MPPE growth per frame */ +-#define MPPE_MAX_KEY_LEN 16 /* largest key length (128-bit) */ ++#define MPPE_MAX_KEY_SIZE 32 /* Largest key length */ ++#define MPPE_MAX_KEY_LEN 16 /* Largest key size accepted by the kernel */ + + /* option bits for ccp_options.mppe */ + #define MPPE_OPT_40 0x01 /* 40 bit */ +@@ -119,3 +122,68 @@ + if (ptr[3] & ~MPPE_ALL_BITS) \ + opts |= MPPE_OPT_UNKNOWN; \ + } while (/* CONSTCOND */ 0) ++ ++ ++#if MPPE ++ ++/* ++ * NOTE: ++ * Access to these variables directly is discuraged. Please ++ * change your code to use below accessor functions. ++ */ ++ ++/* The key material generated which is used for MPPE send key */ ++extern u_char mppe_send_key[MPPE_MAX_KEY_SIZE]; ++/* The key material generated which is used for MPPE recv key */ ++extern u_char mppe_recv_key[MPPE_MAX_KEY_SIZE]; ++/* Keys are set if value is non-zero */ ++extern int mppe_keys_set; ++ ++/* These values are the RADIUS attribute values--see RFC 2548. */ ++#define MPPE_ENC_POL_ENC_ALLOWED 1 ++#define MPPE_ENC_POL_ENC_REQUIRED 2 ++#define MPPE_ENC_TYPES_RC4_40 2 ++#define MPPE_ENC_TYPES_RC4_128 4 ++ ++/* used by plugins (using above values) */ ++void mppe_set_enc_types (int policy, int types); ++ ++/* ++ * Set the MPPE send and recv keys. NULL values for keys are ignored ++ * and input values are cleared to avoid leaving them on the stack ++ */ ++void mppe_set_keys(u_char *send_key, u_char *recv_key, int keylen); ++ ++/* ++ * Get the MPPE recv key ++ */ ++int mppe_get_recv_key(u_char *recv_key, int length); ++ ++/* ++ * Get the MPPE send key ++ */ ++int mppe_get_send_key(u_char *send_key, int length); ++ ++/* ++ * Clear the MPPE keys ++ */ ++void mppe_clear_keys(void); ++ ++/* ++ * Check if the MPPE keys are set ++ */ ++bool mppe_keys_isset(void); ++ ++/* ++ * Set mppe_xxxx_key from NT Password Hash Hash (MSCHAPv1), see RFC3079 ++ */ ++void mppe_set_chapv1(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]); ++ ++/* ++ * Set the mppe_xxxx_key from MS-CHAP-v2 credentials, see RFC3079 ++ */ ++void mppe_set_chapv2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], ++ u_char NTResponse[MS_AUTH_NTRESP_LEN], int IsServer); ++ ++#endif // #ifdef MPPE ++#endif // #ifdef __MPPE_H__ +diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c +index c579831..cf4c0f2 100644 +--- a/pppd/plugins/radius/radius.c ++++ b/pppd/plugins/radius/radius.c +@@ -31,6 +31,7 @@ static char const RCSID[] = + #ifdef CHAPMS + #include "chap_ms.h" + #ifdef MPPE ++#include "mppe.h" + #include "md5.h" + #endif + #endif +@@ -743,11 +744,12 @@ radius_setparams(VALUE_PAIR *vp, char *msg, REQUEST_INFO *req_info, + * Note that if the policy value was '0' we don't set the key! + */ + if (mppe_enc_policy && mppe_enc_keys) { +- mppe_keys_set = 1; + /* Set/modify allowed encryption types. */ + if (mppe_enc_types) +- set_mppe_enc_types(mppe_enc_policy, mppe_enc_types); ++ mppe_set_enc_types(mppe_enc_policy, mppe_enc_types); ++ return 0; + } ++ mppe_clear_keys(); + #endif + + return 0; +@@ -803,7 +805,7 @@ radius_setmppekeys(VALUE_PAIR *vp, REQUEST_INFO *req_info, + * the NAS (us) doesn't need; we only need the start key. So we have + * to generate the start key, sigh. NB: We do not support the LM-Key. + */ +- mppe_set_keys(challenge, &plain[8]); ++ mppe_set_chapv1(challenge, &plain[8]); + + return 0; + } +@@ -855,7 +857,7 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info) + for (i = 0; i < 16; i++) + plain[i] ^= buf[i]; + +- if (plain[0] != sizeof(mppe_send_key) /* 16 */) { ++ if (plain[0] != 16) { + error("RADIUS: Incorrect key length (%d) for MS-MPPE-%s-Key attribute", + (int) plain[0], type); + return -1; +@@ -869,9 +871,9 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info) + plain[16] ^= buf[0]; /* only need the first byte */ + + if (vp->attribute == PW_MS_MPPE_SEND_KEY) +- memcpy(mppe_send_key, plain + 1, 16); ++ mppe_set_keys(plain + 1, NULL, 16); + else +- memcpy(mppe_recv_key, plain + 1, 16); ++ mppe_set_keys(NULL, plain + 1, 16); + + return 0; + } +diff --git a/pppd/plugins/winbind.c b/pppd/plugins/winbind.c +index 0c395c3..67c72f6 100644 +--- a/pppd/plugins/winbind.c ++++ b/pppd/plugins/winbind.c +@@ -37,11 +37,9 @@ + #include "pppd.h" + #include "chap-new.h" + #include "chap_ms.h" +-#ifdef MPPE +-#include "md5.h" +-#endif + #include "fsm.h" + #include "ipcp.h" ++#include "mppe.h" + #include + #include + #include +@@ -583,7 +581,7 @@ winbind_chap_verify(char *user, char *ourname, int id, + nt_response, nt_response_size, + session_key, + &error_string) == AUTHENTICATED) { +- mppe_set_keys(challenge, session_key); ++ mppe_set_chapv1(challenge, session_key); + slprintf(message, message_space, "Access granted"); + return AUTHENTICATED; + +@@ -628,7 +626,7 @@ winbind_chap_verify(char *user, char *ourname, int id, + &response[MS_CHAP2_NTRESP], + &response[MS_CHAP2_PEER_CHALLENGE], + challenge, user, saresponse); +- mppe_set_keys2(session_key, &response[MS_CHAP2_NTRESP], ++ mppe_set_chapv2(session_key, &response[MS_CHAP2_NTRESP], + MS_CHAP2_AUTHENTICATOR); + if (response[MS_CHAP2_FLAGS]) { + slprintf(message, message_space, "S=%s", saresponse); +-- +2.34.1 + diff --git a/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch b/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch new file mode 100644 index 0000000..c8eb350 --- /dev/null +++ b/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch @@ -0,0 +1,37 @@ +From e609ed8bb62e4648568eaa49fbbc858dfda6d122 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Eivind=20N=C3=A6ss?= +Date: Sun, 14 Mar 2021 16:20:29 -0700 +Subject: [PATCH] pppd: Fix logical error in comparing valid encryption + policies (#262) + +RFC2548 describes the proper values of the MS-MPPE-Encryption-Policy attribute. +and it can only hold 2 values: 1 (encryption allowed) and 2 (encryption required). + +See + https://tools.ietf.org/html/rfc2548, section 2.4.4 + +The correct comparison should be made with an && and not a ||. + +This fixes github issue #218 + +Signed-off-by: Eivind Naess +--- + pppd/chap_ms.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c +index e6b84f2..df2dadd 100644 +--- a/pppd/chap_ms.c ++++ b/pppd/chap_ms.c +@@ -953,7 +953,7 @@ void + set_mppe_enc_types(int policy, int types) + { + /* Early exit for unknown policies. */ +- if (policy != MPPE_ENC_POL_ENC_ALLOWED || ++ if (policy != MPPE_ENC_POL_ENC_ALLOWED && + policy != MPPE_ENC_POL_ENC_REQUIRED) + return; + +-- +2.34.1 + diff --git a/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch b/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch new file mode 100644 index 0000000..2b6f53e --- /dev/null +++ b/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch @@ -0,0 +1,32 @@ +From d7e62a8499c4032d79e05afbd8fd3efd51c5b148 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Eivind=20N=C3=A6ss?= +Date: Thu, 3 Feb 2022 14:28:22 -0800 +Subject: [PATCH] pppd/eap: Fix bug causing incorrect response length (#334) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Need to update the esp->ea_client.ea_namelen variable. A plugin can override the +name of the user, and the variable is passed onto the eap_chap2_response generating +the wrong response length. + +Signed-off-by: Eivind Næss +--- + pppd/eap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/pppd/eap.c b/pppd/eap.c +index 54c3d42..6cb595f 100644 +--- a/pppd/eap.c ++++ b/pppd/eap.c +@@ -2182,6 +2182,7 @@ eap_request(eap_state *esp, u_char *inp, int id, int len) + eap_send_nak(esp, id, EAPT_SRP); + break; + } ++ esp->es_client.ea_namelen = strlen(esp->es_client.ea_name); + + /* Create the MSCHAPv2 response (and add to cache) */ + unsigned char response[MS_CHAP2_RESPONSE_LEN+1]; // VLEN + VALUE +-- +2.34.1 + diff --git a/ppp.spec b/ppp.spec index 2e9c6f3..f7b0ed2 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 6%{?dist} +Release: 7%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -37,6 +37,9 @@ Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch +Patch0027: ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch +Patch0028: ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch +Patch0029: ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch BuildRequires: make BuildRequires: gcc @@ -167,6 +170,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Tue Apr 05 2022 Marcin Zajaczkowski - 2.4.9-7 +- Backport patches from master for SSTP to connect using EAP-TLS to Azure VnetGWay and Windows RAS server + * Fri Jan 21 2022 Fedora Release Engineering - 2.4.9-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 6e51f2673a49fffea849ae68ca691d5dbfc4de2e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 31 May 2022 14:08:48 +0200 Subject: [PATCH 42/76] Added links to patches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ppp.spec b/ppp.spec index f7b0ed2..8c4cf05 100644 --- a/ppp.spec +++ b/ppp.spec @@ -37,8 +37,11 @@ Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch +# https://github.com/ppp-project/ppp/commit/d7e62a8499c4032d79e05afbd8fd3efd51c5b148 Patch0027: ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch +# https://github.com/ppp-project/ppp/commit/e609ed8bb62e4648568eaa49fbbc858dfda6d122 Patch0028: ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch +# https://github.com/ppp-project/ppp/pull/267/commits/6bfe06b9428a60eb637d5450d65dd3932fe5a83f Patch0029: ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch BuildRequires: make From 329b6bd0d1510b082a0ff625b7c20d7cb42956f4 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 22 Jul 2022 15:19:58 +0000 Subject: [PATCH 43/76] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 8c4cf05..56f54be 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 7%{?dist} +Release: 8%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -173,6 +173,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Fri Jul 22 2022 Fedora Release Engineering - 2.4.9-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Tue Apr 05 2022 Marcin Zajaczkowski - 2.4.9-7 - Backport patches from master for SSTP to connect using EAP-TLS to Azure VnetGWay and Windows RAS server From 9e045dfc2d20b6732de9e2f4b7b77555e5e8fc26 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 10:12:01 +0000 Subject: [PATCH 44/76] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 56f54be..de8598c 100644 --- a/ppp.spec +++ b/ppp.spec @@ -2,7 +2,7 @@ Name: ppp Version: 2.4.9 -Release: 8%{?dist} +Release: 9%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -173,6 +173,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %doc PLUGINS %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 2.4.9-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Fri Jul 22 2022 Fedora Release Engineering - 2.4.9-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 2b6b4da488a556efb62dd84beea5edd41b3254a9 Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Mon, 3 Apr 2023 12:13:44 +0200 Subject: [PATCH 45/76] Adding fmf plans and gating --- .fmf/version | 1 + ci.fmf | 1 + gating.yaml | 28 ++++++++++++++++++++++++++++ plans/public.fmf | 7 +++++++ plans/tier1-internal.fmf | 12 ++++++++++++ 5 files changed, 49 insertions(+) create mode 100644 .fmf/version create mode 100644 ci.fmf create mode 100644 gating.yaml create mode 100644 plans/public.fmf create mode 100644 plans/tier1-internal.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..285eb64 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,28 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_testing +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} + +#Rawhide +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} + +#gating rhel +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/public.functional} + diff --git a/plans/public.fmf b/plans/public.fmf new file mode 100644 index 0000000..78f4e0e --- /dev/null +++ b/plans/public.fmf @@ -0,0 +1,7 @@ +summary: Test plan with all Fedora tests +discover: + how: fmf + url: https://src.fedoraproject.org/tests/ppp.git +execute: + how: tmt + diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf new file mode 100644 index 0000000..7d2ee46 --- /dev/null +++ b/plans/tier1-internal.fmf @@ -0,0 +1,12 @@ +summary: CI plan, picks internal Tier1 tests, runs in beakerlib. +discover: + - name: rhel + how: fmf + filter: 'tier: 1' + url: git://pkgs.devel.redhat.com/tests/ppp +execute: + how: tmt +adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. From 5b232308197a976548b3f1202de89749f9b04a39 Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Mon, 3 Apr 2023 12:55:58 +0200 Subject: [PATCH 46/76] attempt to fix bad character --- plans/tier1-internal.fmf | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf index 7d2ee46..3447b11 100644 --- a/plans/tier1-internal.fmf +++ b/plans/tier1-internal.fmf @@ -1,12 +1,12 @@ summary: CI plan, picks internal Tier1 tests, runs in beakerlib. discover: - name: rhel - how: fmf - filter: 'tier: 1' - url: git://pkgs.devel.redhat.com/tests/ppp + how: fmf + filter: 'tier: 1' + url: git://pkgs.devel.redhat.com/tests/ppp execute: - how: tmt + how: tmt adjust: - enabled: false - when: distro == centos-stream, fedora - because: They don't have access to internal repos. + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. From 171029fcc85e2f10def95a2e8786040579dcdbfa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 17 Apr 2023 18:20:11 +0200 Subject: [PATCH 47/76] New version Resolves: rhbz#2184291 --- .gitignore | 6 +- 0004-doc-add-configuration-samples.patch | 341 ------- ...itps-use-change_resolv_conf-function.patch | 85 -- ...-t-put-connect-errors-log-to-etc-ppp.patch | 77 -- ...se-SOCK_CLOEXEC-when-creating-socket.patch | 149 --- ...pd-move-pppd-database-to-var-run-ppp.patch | 44 - ...ppoe-add-manpage-for-pppoe-discovery.patch | 115 --- 0018-scritps-fix-ip-up.local-sample.patch | 27 - ...l-rp-pppoe-plugin-files-with-standar.patch | 20 - ...l-pppoatm-plugin-files-with-standard.patch | 26 - ...pppd-binary-using-standard-perms-755.patch | 29 - ...-don-t-want-to-accidentally-leak-fds.patch | 143 --- ...hardcode-LIBDIR-but-set-it-according.patch | 99 -- ppp-2.4.9-config.patch | 21 - ppp-2.4.9-configure-cflags-allow-commas.patch | 17 - ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch | 241 ----- ...MPPE-keys-generated-through-an-API-2.patch | 898 ------------------ ...-error-in-comparing-valid-encryption.patch | 37 - ...-causing-incorrect-response-length-3.patch | 32 - ppp-2.5.0-use-change-resolv-function.patch | 51 + ppp.spec | 58 +- sources | 2 +- 22 files changed, 82 insertions(+), 2436 deletions(-) delete mode 100644 0004-doc-add-configuration-samples.patch delete mode 100644 0006-scritps-use-change_resolv_conf-function.patch delete mode 100644 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch delete mode 100644 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch delete mode 100644 0015-pppd-move-pppd-database-to-var-run-ppp.patch delete mode 100644 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch delete mode 100644 0018-scritps-fix-ip-up.local-sample.patch delete mode 100644 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch delete mode 100644 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch delete mode 100644 ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch delete mode 100644 ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch delete mode 100644 ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch delete mode 100644 ppp-2.4.9-config.patch delete mode 100644 ppp-2.4.9-configure-cflags-allow-commas.patch delete mode 100644 ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch delete mode 100644 ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch delete mode 100644 ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch delete mode 100644 ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch create mode 100644 ppp-2.5.0-use-change-resolv-function.patch diff --git a/.gitignore b/.gitignore index 3a9dd7f..4a4eaa3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,2 @@ -ppp-2.4.5.tar.gz -/ppp-2.4.6.tar.gz +/ppp-*.tar.gz /ppp-watch.tar.xz -/ppp-2.4.7.tar.gz -/ppp-2.4.8.tar.gz -/ppp-2.4.9.tar.gz diff --git a/0004-doc-add-configuration-samples.patch b/0004-doc-add-configuration-samples.patch deleted file mode 100644 index 0cea037..0000000 --- a/0004-doc-add-configuration-samples.patch +++ /dev/null @@ -1,341 +0,0 @@ -From d7faeb88f684c8b2ae193b2c5b5b358ac757fcfa Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 11:39:09 +0200 -Subject: [PATCH 04/27] doc: add configuration samples - ---- - sample/auth-down | 17 ++++++ - sample/auth-up | 17 ++++++ - sample/ip-down | 22 ++++++++ - sample/ip-up | 23 ++++++++ - sample/options | 153 +++++++++++++++++++++++++++++++++++++++++++++++++++ - sample/options.ttyXX | 14 +++++ - sample/pap-secrets | 28 ++++++++++ - 7 files changed, 274 insertions(+) - create mode 100644 sample/auth-down - create mode 100644 sample/auth-up - create mode 100644 sample/ip-down - create mode 100644 sample/ip-up - create mode 100644 sample/options - create mode 100644 sample/options.ttyXX - create mode 100644 sample/pap-secrets - -diff --git a/sample/auth-down b/sample/auth-down -new file mode 100644 -index 0000000..edde65d ---- /dev/null -+++ b/sample/auth-down -@@ -0,0 +1,17 @@ -+#!/bin/sh -+# -+# A program or script which is executed after the remote system -+# successfully authenticates itself. It is executed with the parameters -+# -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+echo auth-down `date +'%y/%m/%d %T'` $* >> /var/log/pppstats -+ -+# last line -diff --git a/sample/auth-up b/sample/auth-up -new file mode 100644 -index 0000000..54722a3 ---- /dev/null -+++ b/sample/auth-up -@@ -0,0 +1,17 @@ -+#!/bin/sh -+# -+# A program or script which is executed after the remote system -+# successfully authenticates itself. It is executed with the parameters -+# -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+echo auth-up `date +'%y/%m/%d %T'` $* >> /var/log/pppstats -+ -+# last line -diff --git a/sample/ip-down b/sample/ip-down -new file mode 100644 -index 0000000..b771fb6 ---- /dev/null -+++ b/sample/ip-down -@@ -0,0 +1,22 @@ -+#!/bin/sh -+# -+# This script is run by the pppd _after_ the link is brought down. -+# It should be used to delete routes, unset IP addresses etc. -+# -+# This script is called with the following arguments: -+# Arg Name Example -+# $1 Interface name ppp0 -+# $2 The tty ttyS1 -+# $3 The link speed 38400 -+# $4 Local IP number 12.34.56.78 -+# $5 Peer IP number 12.34.56.99 -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+# last line -diff --git a/sample/ip-up b/sample/ip-up -new file mode 100644 -index 0000000..7ce7c8d ---- /dev/null -+++ b/sample/ip-up -@@ -0,0 +1,23 @@ -+#!/bin/sh -+# -+# This script is run by the pppd after the link is established. -+# It should be used to add routes, set IP address, run the mailq -+# etc. -+# -+# This script is called with the following arguments: -+# Arg Name Example -+# $1 Interface name ppp0 -+# $2 The tty ttyS1 -+# $3 The link speed 38400 -+# $4 Local IP number 12.34.56.78 -+# $5 Peer IP number 12.34.56.99 -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+# last line -diff --git a/sample/options b/sample/options -new file mode 100644 -index 0000000..8d0a3f9 ---- /dev/null -+++ b/sample/options -@@ -0,0 +1,153 @@ -+# /etc/ppp/options -+ -+# The name of this server. Often, the FQDN is used here. -+#name -+ -+# Enforce the use of the hostname as the name of the local system for -+# authentication purposes (overrides the name option). -+usehostname -+ -+# If no local IP address is given, pppd will use the first IP address -+# that belongs to the local hostname. If "noipdefault" is given, this -+# is disabled and the peer will have to supply an IP address. -+noipdefault -+ -+# With this option, pppd will accept the peer's idea of our local IP -+# address, even if the local IP address was specified in an option. -+#ipcp-accept-local -+ -+# With this option, pppd will accept the peer's idea of its (remote) IP -+# address, even if the remote IP address was specified in an option. -+#ipcp-accept-remote -+ -+# Specify which DNS Servers the incoming Win95 or WinNT Connection should use -+# Two Servers can be remotely configured -+#ms-dns 192.168.1.1 -+#ms-dns 192.168.1.2 -+ -+# Specify which WINS Servers the incoming connection Win95 or WinNT should use -+#wins-addr 192.168.1.50 -+#wins-addr 192.168.1.51 -+ -+# enable this on a server that already has a permanent default route -+#nodefaultroute -+ -+# Run the executable or shell command specified after pppd has terminated -+# the link. This script could, for example, issue commands to the modem -+# to cause it to hang up if hardware modem control signals were not -+# available. -+# If mgetty is running, it will reset the modem anyway. So there is no need -+# to do it here. -+#disconnect "chat -- \d+++\d\c OK ath0 OK" -+ -+# Increase debugging level (same as -d). The debug output is written -+# to syslog LOG_LOCAL2. -+debug -+ -+# Enable debugging code in the kernel-level PPP driver. The argument n -+# is a number which is the sum of the following values: 1 to enable -+# general debug messages, 2 to request that the contents of received -+# packets be printed, and 4 to request that the contents of transmitted -+# packets be printed. -+#kdebug n -+ -+# Require the peer to authenticate itself before allowing network -+# packets to be sent or received. -+# Please do not disable this setting. It is expected to be standard in -+# future releases of pppd. Use the call option (see manpage) to disable -+# authentication for specific peers. -+#auth -+ -+# authentication can either be pap or chap. As most people only want to -+# use pap, you can also disable chap: -+#require-pap -+#refuse-chap -+ -+# Use hardware flow control (i.e. RTS/CTS) to control the flow of data -+# on the serial port. -+crtscts -+ -+# Specifies that pppd should use a UUCP-style lock on the serial device -+# to ensure exclusive access to the device. -+lock -+ -+# Use the modem control lines. -+modem -+ -+# async character map -- 32-bit hex; each bit is a character -+# that needs to be escaped for pppd to receive it. 0x00000001 -+# represents '\x01', and 0x80000000 represents '\x1f'. -+# To allow pppd to work over a rlogin/telnet connection, ou should escape -+# XON (^Q), XOFF (^S) and ^]: (The peer should use "escape ff".) -+#asyncmap 200a0000 -+asyncmap 0 -+ -+# Specifies that certain characters should be escaped on transmission -+# (regardless of whether the peer requests them to be escaped with its -+# async control character map). The characters to be escaped are -+# specified as a list of hex numbers separated by commas. Note that -+# almost any character can be specified for the escape option, unlike -+# the asyncmap option which only allows control characters to be -+# specified. The characters which may not be escaped are those with hex -+# values 0x20 - 0x3f or 0x5e. -+#escape 11,13,ff -+ -+# Set the MRU [Maximum Receive Unit] value to for negotiation. pppd -+# will ask the peer to send packets of no more than bytes. The -+# minimum MRU value is 128. The default MRU value is 1500. A value of -+# 296 is recommended for slow links (40 bytes for TCP/IP header + 256 -+# bytes of data). -+#mru 542 -+ -+# Set the MTU [Maximum Transmit Unit] value to . Unless the peer -+# requests a smaller value via MRU negotiation, pppd will request that -+# the kernel networking code send data packets of no more than n bytes -+# through the PPP network interface. -+#mtu -+ -+# Set the interface netmask to , a 32 bit netmask in "decimal dot" -+# notation (e.g. 255.255.255.0). -+#netmask 255.255.255.0 -+ -+# Don't fork to become a background process (otherwise pppd will do so -+# if a serial device is specified). -+nodetach -+ -+# Set the assumed name of the remote system for authentication purposes -+# to . -+#remotename -+ -+# Add an entry to this system's ARP [Address Resolution Protocol] -+# table with the IP address of the peer and the Ethernet address of this -+# system. {proxyarp,noproxyarp} -+proxyarp -+ -+# Use the system password database for authenticating the peer using -+# PAP. Note: mgetty already provides this option. If this is specified -+# then dialin from users using a script under Linux to fire up ppp wont work. -+#login -+ -+# If this option is given, pppd will send an LCP echo-request frame to -+# the peer every n seconds. Under Linux, the echo-request is sent when -+# no packets have been received from the peer for n seconds. Normally -+# the peer should respond to the echo-request by sending an echo-reply. -+# This option can be used with the lcp-echo-failure option to detect -+# that the peer is no longer connected. -+lcp-echo-interval 30 -+ -+# If this option is given, pppd will presume the peer to be dead if n -+# LCP echo-requests are sent without receiving a valid LCP echo-reply. -+# If this happens, pppd will terminate the connection. Use of this -+# option requires a non-zero value for the lcp-echo-interval parameter. -+# This option can be used to enable pppd to terminate after the physical -+# connection has been broken (e.g., the modem has hung up) in -+# situations where no hardware modem control lines are available. -+lcp-echo-failure 4 -+ -+# Specifies that pppd should disconnect if the link is idle for n seconds. -+idle 600 -+ -+# Disable the IPXCP and IPX protocols. -+noipx -+ -+# ------ -diff --git a/sample/options.ttyXX b/sample/options.ttyXX -new file mode 100644 -index 0000000..d4202f5 ---- /dev/null -+++ b/sample/options.ttyXX -@@ -0,0 +1,14 @@ -+# If you need to set up multiple serial lines then copy this file to -+# options. for each tty with a modem on it. -+# -+# The options.tty file will assign an IP address to each PPP connection -+# as it comes up. They must all be distinct! -+# -+# Example: -+# options.ttyS1 for com2 under DOS. -+# -+# Edit the following line so that the first IP address -+# mentioned is the ip address of the serial port while the second -+# is the IP address of your host -+# -+hostname-s1:hostname -diff --git a/sample/pap-secrets b/sample/pap-secrets -new file mode 100644 -index 0000000..098971b ---- /dev/null -+++ b/sample/pap-secrets -@@ -0,0 +1,28 @@ -+# Secrets for authentication using PAP -+# client server secret IP addresses -+ -+# OUTBOUND CONNECTIONS -+# Here you should add your userid password to connect to your providers via -+# pap. The * means that the password is to be used for ANY host you connect -+# to. Thus you do not have to worry about the foreign machine name. Just -+# replace password with your password. -+# If you have different providers with different passwords then you better -+# remove the following line. -+#hostname * password -+ -+# INBOUND CONNECTIONS -+#client hostname 192.168.1.1 -+ -+# If you add "auth login -chap +pap" to /etc/mgetty+sendfax/login.config, -+# all users in /etc/passwd can use their password for pap-authentication. -+# -+# Every regular user can use PPP and has to use passwords from /etc/passwd -+#* hostname "" -+# UserIDs that cannot use PPP at all. Check your /etc/passwd and add any -+# other accounts that should not be able to use pppd! Replace hostname -+# with your local hostname. -+#guest hostname "*" - -+#master hostname "*" - -+#root hostname "*" - -+#support hostname "*" - -+#stats hostname "*" - --- -1.8.3.1 - diff --git a/0006-scritps-use-change_resolv_conf-function.patch b/0006-scritps-use-change_resolv_conf-function.patch deleted file mode 100644 index cbf8713..0000000 --- a/0006-scritps-use-change_resolv_conf-function.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 01419dfb684d501b57f1c24dcfdbcf9da93ccca2 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 18:12:47 +0200 -Subject: [PATCH 06/27] scritps: use change_resolv_conf function - -Don't handle /etc/resolv.conf manually, but use a helper function from -initscripts. Also change path where we save DNS servers supplied by peer while -we are at it. - -Resolves: #132482 ---- - pppd/pppd.8 | 2 +- - scripts/ip-down.local.add | 9 +++++---- - scripts/ip-up.local.add | 17 ++++++++++------- - 3 files changed, 16 insertions(+), 12 deletions(-) - -diff --git a/pppd/pppd.8 b/pppd/pppd.8 -index e2768b1..2dd6e1a 100644 ---- a/pppd/pppd.8 -+++ b/pppd/pppd.8 -@@ -1099,7 +1099,7 @@ Ask the peer for up to 2 DNS server addresses. The addresses supplied - by the peer (if any) are passed to the /etc/ppp/ip\-up script in the - environment variables DNS1 and DNS2, and the environment variable - USEPEERDNS will be set to 1. In addition, pppd will create an --/etc/ppp/resolv.conf file containing one or two nameserver lines with -+/var/run/ppp/resolv.conf file containing one or two nameserver lines with - the address(es) supplied by the peer. - .TP - .B user \fIname -diff --git a/scripts/ip-down.local.add b/scripts/ip-down.local.add -index b93590e..163f71e 100644 ---- a/scripts/ip-down.local.add -+++ b/scripts/ip-down.local.add -@@ -9,12 +9,13 @@ - # - # Nick Walker (nickwalker@email.com) - # -+. /etc/sysconfig/network-scripts/network-functions - --if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then -- if [ -f /etc/ppp/resolv.prev ]; then -- cp -f /etc/ppp/resolv.prev /etc/resolv.conf -+if [ -n "$USEPEERDNS" -a -f /var/run/ppp/resolv.conf ]; then -+ if [ -f /var/run/ppp/resolv.prev ]; then -+ change_resolv_conf /var/run/ppp/resolv.prev - else -- rm -f /etc/resolv.conf -+ change_resolv_conf - fi - fi - -diff --git a/scripts/ip-up.local.add b/scripts/ip-up.local.add -index 8017209..26cf5f8 100644 ---- a/scripts/ip-up.local.add -+++ b/scripts/ip-up.local.add -@@ -9,16 +9,19 @@ - # - # Nick Walker (nickwalker@email.com) - # -+. /etc/sysconfig/network-scripts/network-functions - --if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then -- rm -f /etc/ppp/resolv.prev -+if [ -n "$USEPEERDNS" -a -f /var/run/ppp/resolv.conf ]; then -+ rm -f /var/run/ppp/resolv.prev - if [ -f /etc/resolv.conf ]; then -- cp /etc/resolv.conf /etc/ppp/resolv.prev -- grep domain /etc/ppp/resolv.prev > /etc/resolv.conf -- grep search /etc/ppp/resolv.prev >> /etc/resolv.conf -- cat /etc/ppp/resolv.conf >> /etc/resolv.conf -+ cp /etc/resolv.conf /var/run/ppp/resolv.prev -+ rscf=/var/run/ppp/resolv.new -+ grep domain /var/run/ppp/resolv.prev > $rscf -+ grep search /var/run/ppp/resolv.prev >> $rscf -+ change_resolv_conf $rscf -+ rm -f $rscf - else -- cp /etc/ppp/resolv.conf /etc -+ change_resolv_conf /var/run/ppp/resolv.conf - fi - fi - --- -1.8.3.1 - diff --git a/0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch b/0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch deleted file mode 100644 index 56ac388..0000000 --- a/0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch +++ /dev/null @@ -1,77 +0,0 @@ -From b4ef433be936c90e356da7a590b032cdee219a3f Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Fri, 4 Apr 2014 19:06:05 +0200 -Subject: [PATCH 11/27] build-sys: don't put connect-errors log to /etc/ppp/ - -Resolves: #118837 ---- - chat/chat.8 | 2 +- - linux/Makefile.top | 8 +++++++- - pppd/pathnames.h | 4 ++-- - 3 files changed, 10 insertions(+), 4 deletions(-) - -diff --git a/chat/chat.8 b/chat/chat.8 -index 6d10836..78d6939 100644 ---- a/chat/chat.8 -+++ b/chat/chat.8 -@@ -200,7 +200,7 @@ The \fBSAY\fR directive allows the script to send strings to the user - at the terminal via standard error. If \fBchat\fR is being run by - pppd, and pppd is running as a daemon (detached from its controlling - terminal), standard error will normally be redirected to the file --/etc/ppp/connect\-errors. -+/var/log/ppp/connect\-errors. - .LP - \fBSAY\fR strings must be enclosed in single or double quotes. If - carriage return and line feed are needed in the string to be output, -diff --git a/linux/Makefile.top b/linux/Makefile.top -index f63d45e..f42efd5 100644 ---- a/linux/Makefile.top -+++ b/linux/Makefile.top -@@ -5,6 +5,8 @@ BINDIR = $(DESTDIR)/sbin - INCDIR = $(DESTDIR)/include - MANDIR = $(DESTDIR)/share/man - ETCDIR = $(INSTROOT)@SYSCONF@/ppp -+RUNDIR = $(DESTDIR)/var/run/ppp -+LOGDIR = $(DESTDIR)/var/log/ppp - - # uid 0 = root - INSTALL= install -@@ -16,7 +18,7 @@ all: - cd pppstats; $(MAKE) $(MFLAGS) all - cd pppdump; $(MAKE) $(MFLAGS) all - --install: $(BINDIR) $(MANDIR)/man8 install-progs install-devel -+install: $(BINDIR) $(RUNDIR) $(LOGDIR) $(MANDIR)/man8 install-progs install-devel - - install-progs: - cd chat; $(MAKE) $(MFLAGS) install -@@ -44,6 +46,10 @@ $(MANDIR)/man8: - $(INSTALL) -d -m 755 $@ - $(ETCDIR): - $(INSTALL) -d -m 755 $@ -+$(RUNDIR): -+ $(INSTALL) -d -m 755 $@ -+$(LOGDIR): -+ $(INSTALL) -d -m 755 $@ - - clean: - rm -f `find . -name '*.[oas]' -print` -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index a427cb8..bef3160 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -28,9 +28,9 @@ - #define _PATH_AUTHUP _ROOT_PATH "/etc/ppp/auth-up" - #define _PATH_AUTHDOWN _ROOT_PATH "/etc/ppp/auth-down" - #define _PATH_TTYOPT _ROOT_PATH "/etc/ppp/options." --#define _PATH_CONNERRS _ROOT_PATH "/etc/ppp/connect-errors" -+#define _PATH_CONNERRS _ROOT_PATH "/var/log/ppp/connect-errors" - #define _PATH_PEERFILES _ROOT_PATH "/etc/ppp/peers/" --#define _PATH_RESOLV _ROOT_PATH "/etc/ppp/resolv.conf" -+#define _PATH_RESOLV _ROOT_PATH "/var/run/ppp/resolv.conf" - - #define _PATH_USEROPT ".ppprc" - #define _PATH_PSEUDONYM ".ppp_pseudonym" --- -1.8.3.1 - diff --git a/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch deleted file mode 100644 index 1352370..0000000 --- a/0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +++ /dev/null @@ -1,149 +0,0 @@ -diff --git a/pppd/plugins/pppoatm/pppoatm.c b/pppd/plugins/pppoatm/pppoatm.c -index d693350..c31bb34 100644 ---- a/pppd/plugins/pppoatm/pppoatm.c -+++ b/pppd/plugins/pppoatm/pppoatm.c -@@ -135,7 +135,7 @@ static int connect_pppoatm(void) - - if (!device_got_set) - no_device_given_pppoatm(); -- fd = socket(AF_ATMPVC, SOCK_DGRAM, 0); -+ fd = socket(AF_ATMPVC, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (fd < 0) - fatal("failed to create socket: %m"); - memset(&qos, 0, sizeof qos); -diff --git a/pppd/plugins/pppol2tp/openl2tp.c b/pppd/plugins/pppol2tp/openl2tp.c -index 9643b96..1099575 100644 ---- a/pppd/plugins/pppol2tp/openl2tp.c -+++ b/pppd/plugins/pppol2tp/openl2tp.c -@@ -83,7 +83,7 @@ static int openl2tp_client_create(void) - int result; - - if (openl2tp_fd < 0) { -- openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM, 0); -+ openl2tp_fd = socket(PF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (openl2tp_fd < 0) { - error("openl2tp connection create: %m"); - return -ENOTCONN; -diff --git a/pppd/plugins/pppol2tp/pppol2tp.c b/pppd/plugins/pppol2tp/pppol2tp.c -index a7e3400..e64a778 100644 ---- a/pppd/plugins/pppol2tp/pppol2tp.c -+++ b/pppd/plugins/pppol2tp/pppol2tp.c -@@ -208,7 +208,7 @@ static void send_config_pppol2tp(int mtu, - struct ifreq ifr; - int fd; - -- fd = socket(AF_INET, SOCK_DGRAM, 0); -+ fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (fd >= 0) { - memset (&ifr, '\0', sizeof (ifr)); - strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); -diff --git a/pppd/plugins/pppoe/if.c b/pppd/plugins/pppoe/if.c -index 91e9a57..72aba41 100644 ---- a/pppd/plugins/pppoe/if.c -+++ b/pppd/plugins/pppoe/if.c -@@ -116,7 +116,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - stype = SOCK_PACKET; - #endif - -- if ((fd = socket(domain, stype, htons(type))) < 0) { -+ if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { - /* Give a more helpful message for the common error case */ - if (errno == EPERM) { - fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/plugins/pppoe/plugin.c b/pppd/plugins/pppoe/plugin.c -index a8c2bb4..24bdf8f 100644 ---- a/pppd/plugins/pppoe/plugin.c -+++ b/pppd/plugins/pppoe/plugin.c -@@ -137,7 +137,7 @@ PPPOEConnectDevice(void) - /* server equipment). */ - /* Opening this socket just before waitForPADS in the discovery() */ - /* function would be more appropriate, but it would mess-up the code */ -- conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM, PX_PROTO_OE); -+ conn->sessionSocket = socket(AF_PPPOX, SOCK_STREAM | SOCK_CLOEXEC, PX_PROTO_OE); - if (conn->sessionSocket < 0) { - error("Failed to create PPPoE socket: %m"); - return -1; -@@ -148,7 +148,7 @@ PPPOEConnectDevice(void) - lcp_wantoptions[0].mru = conn->mru; - - /* Update maximum MRU */ -- s = socket(AF_INET, SOCK_DGRAM, 0); -+ s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (s < 0) { - error("Can't get MTU for %s: %m", conn->ifName); - goto errout; -@@ -320,7 +320,7 @@ PPPoEDevnameHook(char *cmd, char **argv, int doit) - } - - /* Open a socket */ -- if ((fd = socket(PF_PACKET, SOCK_RAW, 0)) < 0) { -+ if ((fd = socket(PF_PACKET, SOCK_RAW | SOCK_CLOEXEC, 0)) < 0) { - r = 0; - } - -diff --git a/pppd/plugins/pppoe/pppoe-discovery.c b/pppd/plugins/pppoe/pppoe-discovery.c -index 3d3bf4e..c0d927d 100644 ---- a/pppd/plugins/pppoe/pppoe-discovery.c -+++ b/pppd/plugins/pppoe/pppoe-discovery.c -@@ -121,7 +121,7 @@ openInterface(char const *ifname, UINT16_t type, unsigned char *hwaddr) - stype = SOCK_PACKET; - #endif - -- if ((fd = socket(domain, stype, htons(type))) < 0) { -+ if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { - /* Give a more helpful message for the common error case */ - if (errno == EPERM) { - fatal("Cannot create raw socket -- pppoe must be run as root."); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 00a2cf5..0690019 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -308,12 +308,12 @@ static int modify_flags(int fd, int clear_bits, int set_bits) - void sys_init(void) - { - /* Get an internet socket for doing socket ioctls. */ -- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); -+ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock_fd < 0) - fatal("Couldn't create IP socket: %m(%d)", errno); - - #ifdef INET6 -- sock6_fd = socket(AF_INET6, SOCK_DGRAM, 0); -+ sock6_fd = socket(AF_INET6, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock6_fd < 0) - sock6_fd = -errno; /* save errno for later */ - #endif -@@ -1857,7 +1857,7 @@ get_if_hwaddr(u_char *addr, char *name) - struct ifreq ifreq; - int ret, sock_fd; - -- sock_fd = socket(AF_INET, SOCK_DGRAM, 0); -+ sock_fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (sock_fd < 0) - return -1; - memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr)); -@@ -2067,7 +2067,7 @@ int ppp_available(void) - /* - * Open a socket for doing the ioctl operations. - */ -- s = socket(AF_INET, SOCK_DGRAM, 0); -+ s = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); - if (s < 0) - return 0; - -diff --git a/pppd/tty.c b/pppd/tty.c -index bc96695..8e76a5d 100644 ---- a/pppd/tty.c -+++ b/pppd/tty.c -@@ -896,7 +896,7 @@ open_socket(dest) - *sep = ':'; - - /* get a socket and connect it to the other end */ -- sock = socket(PF_INET, SOCK_STREAM, 0); -+ sock = socket(PF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0); - if (sock < 0) { - error("Can't create socket: %m"); - return -1; --- -1.8.3.1 - diff --git a/0015-pppd-move-pppd-database-to-var-run-ppp.patch b/0015-pppd-move-pppd-database-to-var-run-ppp.patch deleted file mode 100644 index 88b84d5..0000000 --- a/0015-pppd-move-pppd-database-to-var-run-ppp.patch +++ /dev/null @@ -1,44 +0,0 @@ -From f2c855462ff56be4121409c7e048cd2503fe0ccf Mon Sep 17 00:00:00 2001 -From: Jiri Skala -Date: Mon, 7 Apr 2014 14:26:20 +0200 -Subject: [PATCH 15/27] pppd: move pppd database to /var/run/ppp - -Resolves: #560014 ---- - pppd/pathnames.h | 11 ++++------- - 1 file changed, 4 insertions(+), 7 deletions(-) - -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index bef3160..24e010c 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -6,8 +6,9 @@ - - #ifdef HAVE_PATHS_H - #include -- -+#define _PPP_SUBDIR "ppp/" - #else /* HAVE_PATHS_H */ -+#define _PPP_SUBDIR - #ifndef _PATH_VARRUN - #define _PATH_VARRUN "/etc/ppp/" - #endif -@@ -46,13 +47,9 @@ - #endif /* IPX_CHANGE */ - - #ifdef __STDC__ --#define _PATH_PPPDB _ROOT_PATH _PATH_VARRUN "pppd2.tdb" -+#define _PATH_PPPDB _ROOT_PATH _PATH_VARRUN _PPP_SUBDIR "pppd2.tdb" - #else /* __STDC__ */ --#ifdef HAVE_PATHS_H --#define _PATH_PPPDB "/var/run/pppd2.tdb" --#else --#define _PATH_PPPDB "/etc/ppp/pppd2.tdb" --#endif -+#define _PATH_PPPDB _PATH_VARRUN _PPP_SUBDIR "pppd2.tdb" - #endif /* __STDC__ */ - - #ifdef PLUGIN --- -1.8.3.1 - diff --git a/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch b/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch deleted file mode 100644 index b7f7c91..0000000 --- a/0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch +++ /dev/null @@ -1,115 +0,0 @@ -diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux -index 3cd9101..9918091 100644 ---- a/pppd/plugins/pppoe/Makefile.linux -+++ b/pppd/plugins/pppoe/Makefile.linux -@@ -16,6 +16,7 @@ - - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin -+MANDIR = $(DESTDIR)/share/man/man8 - LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(PPPDVERSION) - - PPPDVERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) -@@ -46,6 +47,7 @@ install: all - $(LN_S) pppoe.so $(LIBDIR)/rp-pppoe.so - $(INSTALL) -d -m 755 $(BINDIR) - $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) -+ $(INSTALL) -c -m 444 pppoe-discovery.8 $(MANDIR) - - clean: - rm -f *.o *.so pppoe-discovery -diff --git a/pppd/plugins/pppoe/pppoe-discovery.8 b/pppd/plugins/pppoe/pppoe-discovery.8 -new file mode 100644 -index 0000000..d0a93db ---- /dev/null -+++ b/pppd/plugins/pppoe/pppoe-discovery.8 -@@ -0,0 +1,86 @@ -+.\" pppoe-discovery.8 written by -+.\" Ben Hutchings , based on pppoe.8. -+.\" Licenced under the GPL version 2 or later. -+.TH PPPOE-DISCOVERY 8 -+.SH NAME -+pppoe\-discovery \- perform PPPoE discovery -+.SH SYNOPSIS -+.B pppoe\-discovery -+[ -+.I options -+] -+.br -+.BR pppoe\-discovery " { " \-V " | " \-h " }" -+.SH DESCRIPTION -+.LP -+\fBpppoe\-discovery\fR performs the same discovery process as -+\fBpppoe\fR, but does not initiate a session. -+It sends a PADI packet and then prints the names of access -+concentrators in each PADO packet it receives. -+.SH OPTIONS -+.TP -+.BI \-I " interface" -+.RS -+The \fB\-I\fR option specifies the Ethernet interface to use. -+Under Linux, it is typically eth0 or eth1. -+The interface should be \(lqup\(rq before you start -+\fBpppoe\-discovery\fR, but should \fInot\fR be configured to have an -+IP address. -+The default interface is eth0. -+.RE -+.TP -+.BI \-D " file_name" -+.RS -+The \fB\-D\fR option causes every packet to be dumped to the specified -+\fIfile_name\fR. -+This is intended for debugging only. -+.RE -+.TP -+.B \-U -+.RS -+Causes \fBpppoe\-discovery\fR to use the Host-Uniq tag in its discovery -+packets. -+This lets you run multiple instances of \fBpppoe\-discovery\fR and/or -+\fBpppoe\fR without having their discovery packets interfere with one -+another. -+You must supply this option to \fIall\fR instances that you intend to -+run simultaneously. -+.RE -+.TP -+.BI \-S " service_name" -+.RS -+Specifies the desired service name. -+\fBpppoe\-discovery\fR will only accept access concentrators which can -+provide the specified service. -+In most cases, you should \fInot\fR specify this option. -+Use it only if you know that there are multiple access concentrators -+or know that you need a specific service name. -+.RE -+.TP -+.BI \-C " ac_name" -+.RS -+Specifies the desired access concentrator name. -+\fBpppoe\-discovery\fR will only accept the specified access -+concentrator. -+In most cases, you should \fInot\fR specify this option. -+Use it only if you know that there are multiple access concentrators. -+If both the \fB\-S\fR and \fB\-C\fR options are specified, they must -+\fIboth\fR match. -+.RE -+.TP -+.B \-A -+.RS -+This option is accepted for compatibility with \fBpppoe\fR, but has no -+effect. -+.RE -+.TP -+.BR \-V " | " \-h -+.RS -+Either of these options causes \fBpppoe\-discovery\fR to print its -+version number and usage information, then exit. -+.RE -+.SH AUTHORS -+\fBpppoe\-discovery\fR was written by Marco d'Itri , -+based on \fBpppoe\fR by David F. Skoll . -+.SH SEE ALSO -+pppoe(8), pppoe-sniff(8) --- -1.8.3.1 - diff --git a/0018-scritps-fix-ip-up.local-sample.patch b/0018-scritps-fix-ip-up.local-sample.patch deleted file mode 100644 index c36e0b8..0000000 --- a/0018-scritps-fix-ip-up.local-sample.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 40960f91cdd06da387616ec838ae2599e7f01cee Mon Sep 17 00:00:00 2001 -From: Jiri Skala -Date: Mon, 7 Apr 2014 15:24:01 +0200 -Subject: [PATCH 18/27] scritps: fix ip-up.local sample - -Resolves: #613717 ---- - scripts/ip-up.local.add | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/scripts/ip-up.local.add b/scripts/ip-up.local.add -index 26cf5f8..282337c 100644 ---- a/scripts/ip-up.local.add -+++ b/scripts/ip-up.local.add -@@ -18,6 +18,9 @@ if [ -n "$USEPEERDNS" -a -f /var/run/ppp/resolv.conf ]; then - rscf=/var/run/ppp/resolv.new - grep domain /var/run/ppp/resolv.prev > $rscf - grep search /var/run/ppp/resolv.prev >> $rscf -+ if [ -f /var/run/ppp/resolv.conf ]; then -+ cat /var/run/ppp/resolv.conf >> $rscf -+ fi - change_resolv_conf $rscf - rm -f $rscf - else --- -1.8.3.1 - diff --git a/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch b/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch deleted file mode 100644 index 23b1f93..0000000 --- a/0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux -index 2df887b..6cb8397 100644 ---- a/pppd/plugins/pppoe/Makefile.linux -+++ b/pppd/plugins/pppoe/Makefile.linux -@@ -43,12 +43,12 @@ pppoe.so: plugin.o discovery.o if.o common.o - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -c -m 4550 pppoe.so $(LIBDIR) -+ $(INSTALL) -c -m 755 pppoe.so $(LIBDIR) - # Symlink for backward compatibility - $(LN_S) pppoe.so $(LIBDIR)/rp-pppoe.so - $(INSTALL) -d -m 755 $(BINDIR) -- $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) -- $(INSTALL) -c -m 444 pppoe-discovery.8 $(MANDIR) -+ $(INSTALL) -c -m 755 pppoe-discovery $(BINDIR) -+ $(INSTALL) -c -m 644 pppoe-discovery.8 $(MANDIR) - - clean: - rm -f *.o *.so pppoe-discovery diff --git a/0024-build-sys-install-pppoatm-plugin-files-with-standard.patch b/0024-build-sys-install-pppoatm-plugin-files-with-standard.patch deleted file mode 100644 index 9982d92..0000000 --- a/0024-build-sys-install-pppoatm-plugin-files-with-standard.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 0fdb22ef3d3cc3b297372451d60bd6c61d047d27 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Thu, 10 Apr 2014 10:08:41 +0200 -Subject: [PATCH 24/27] build-sys: install pppoatm plugin files with standard - perms - ---- - pppd/plugins/pppoatm/Makefile.linux | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index 769794b..4c5826f 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -37,7 +37,7 @@ $(PLUGIN): $(PLUGIN_OBJS) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -c -m 4550 $(PLUGIN) $(LIBDIR) -+ $(INSTALL) -c -m 755 $(PLUGIN) $(LIBDIR) - - clean: - rm -f *.o *.so --- -1.8.3.1 - diff --git a/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch b/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch deleted file mode 100644 index bedb902..0000000 --- a/ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch +++ /dev/null @@ -1,29 +0,0 @@ -From ab8b06cdc1075abc67f77e7c3bb684e20071d614 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Thu, 10 Apr 2014 10:09:41 +0200 -Subject: [PATCH 25/27] pppd: install pppd binary using standard perms (755) - ---- - pppd/Makefile.linux | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 0e8107f..534ccc2 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -223,10 +223,10 @@ all: $(TARGETS) - install: pppd - mkdir -p $(BINDIR) $(MANDIR) - $(EXTRAINSTALL) -- $(INSTALL) -c -m 555 pppd $(BINDIR)/pppd -+ $(INSTALL) -c -m 755 pppd $(BINDIR)/pppd - if chgrp pppusers $(BINDIR)/pppd 2>/dev/null; then \ - chmod o-rx,u+s $(BINDIR)/pppd; fi -- $(INSTALL) -c -m 444 pppd.8 $(MANDIR) -+ $(INSTALL) -c -m 644 pppd.8 $(MANDIR) - - pppd: $(PPPDOBJS) - $(CC) $(CFLAGS) $(LDFLAGS) $(LDFLAGS_PLUGIN) -o pppd $(PPPDOBJS) $(LIBS) --- -1.8.3.1 - diff --git a/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch b/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch deleted file mode 100644 index 1b4a9cd..0000000 --- a/ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch +++ /dev/null @@ -1,143 +0,0 @@ -From 82cd789df0f022eb6f3d28646e7a61d1d0715805 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 12:23:36 +0200 -Subject: [PATCH 12/27] pppd: we don't want to accidentally leak fds - ---- - pppd/auth.c | 20 ++++++++++---------- - pppd/options.c | 2 +- - pppd/sys-linux.c | 4 ++-- - 3 files changed, 13 insertions(+), 13 deletions(-) - -diff --git a/pppd/auth.c b/pppd/auth.c -index 4271af6..9e957fa 100644 ---- a/pppd/auth.c -+++ b/pppd/auth.c -@@ -428,7 +428,7 @@ setupapfile(argv) - free(fname); - return 0; - } -- ufile = fopen(fname, "r"); -+ ufile = fopen(fname, "re"); - if (seteuid(euid) == -1) - fatal("unable to regain privileges: %m"); - if (ufile == NULL) { -@@ -1413,7 +1413,7 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg) - filename = _PATH_UPAPFILE; - addrs = opts = NULL; - ret = UPAP_AUTHNAK; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) { - error("Can't open PAP password file %s: %m", filename); - -@@ -1512,7 +1512,7 @@ null_login(unit) - if (ret <= 0) { - filename = _PATH_UPAPFILE; - addrs = NULL; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - check_access(f, filename); -@@ -1559,7 +1559,7 @@ get_pap_passwd(passwd) - } - - filename = _PATH_UPAPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - check_access(f, filename); -@@ -1597,7 +1597,7 @@ have_pap_secret(lacks_ipp) - } - - filename = _PATH_UPAPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - -@@ -1642,7 +1642,7 @@ have_chap_secret(client, server, need_ip, lacks_ipp) - } - - filename = _PATH_CHAPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - -@@ -1684,7 +1684,7 @@ have_srp_secret(client, server, need_ip, lacks_ipp) - struct wordlist *addrs; - - filename = _PATH_SRPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - -@@ -1740,7 +1740,7 @@ get_secret(unit, client, server, secret, secret_len, am_server) - addrs = NULL; - secbuf[0] = 0; - -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) { - error("Can't open chap secret file %s: %m", filename); - return 0; -@@ -1797,7 +1797,7 @@ get_srp_secret(unit, client, server, secret, am_server) - filename = _PATH_SRPFILE; - addrs = NULL; - -- fp = fopen(filename, "r"); -+ fp = fopen(filename, "re"); - if (fp == NULL) { - error("Can't open srp secret file %s: %m", filename); - return 0; -@@ -2203,7 +2203,7 @@ scan_authfile(f, client, server, secret, addrs, opts, filename, flags) - */ - if (word[0] == '@' && word[1] == '/') { - strlcpy(atfile, word+1, sizeof(atfile)); -- if ((sf = fopen(atfile, "r")) == NULL) { -+ if ((sf = fopen(atfile, "re")) == NULL) { - warn("can't open indirect secret file %s", atfile); - continue; - } -diff --git a/pppd/options.c b/pppd/options.c -index 45fa742..1d754ae 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -427,7 +427,7 @@ options_from_file(filename, must_exist, check_prot, priv) - option_error("unable to drop privileges to open %s: %m", filename); - return 0; - } -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - err = errno; - if (check_prot && seteuid(euid) == -1) - fatal("unable to regain privileges"); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 72a7727..8a12fa0 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -1412,7 +1412,7 @@ static char *path_to_procfs(const char *tail) - /* Default the mount location of /proc */ - strlcpy (proc_path, "/proc", sizeof(proc_path)); - proc_path_len = 5; -- fp = fopen(MOUNTED, "r"); -+ fp = fopen(MOUNTED, "re"); - if (fp != NULL) { - while ((mntent = getmntent(fp)) != NULL) { - if (strcmp(mntent->mnt_type, MNTTYPE_IGNORE) == 0) -@@ -1472,7 +1472,7 @@ static int open_route_table (void) - close_route_table(); - - path = path_to_procfs("/net/route"); -- route_fd = fopen (path, "r"); -+ route_fd = fopen (path, "re"); - if (route_fd == NULL) { - error("can't open routing table %s: %m", path); - return 0; --- -1.8.3.1 - diff --git a/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch b/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch deleted file mode 100644 index c2c8cce..0000000 --- a/ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch +++ /dev/null @@ -1,99 +0,0 @@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 6a4b897..8f29c1f 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -12,6 +12,7 @@ DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 - INCDIR = $(DESTDIR)/include -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null) - - TARGETS = pppd - -@@ -93,7 +94,7 @@ INCLUDE_DIRS= -I../include - - COMPILE_FLAGS= -DHAVE_PATHS_H -DIPX_CHANGE -DHAVE_MMAP -pipe - --CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS) '-DDESTDIR="@DESTDIR@"' -+CFLAGS= $(COPTS) $(COMPILE_FLAGS) $(INCLUDE_DIRS) '-DDESTDIR="@DESTDIR@"' -DLIBDIR=\""$(LIBDIR)"\" - - ifdef CHAPMS - CFLAGS += -DCHAPMS=1 -diff --git a/pppd/pathnames.h b/pppd/pathnames.h -index 524d608..c7eadbb 100644 ---- a/pppd/pathnames.h -+++ b/pppd/pathnames.h -@@ -62,7 +62,7 @@ - - #ifdef PLUGIN - #ifdef __STDC__ --#define _PATH_PLUGIN DESTDIR "/lib/pppd/" VERSION -+#define _PATH_PLUGIN LIBDIR "/pppd/" VERSION - #else /* __STDC__ */ - #define _PATH_PLUGIN "/usr/lib/pppd" - #endif /* __STDC__ */ -diff --git a/pppd/plugins/Makefile.linux b/pppd/plugins/Makefile.linux -index 6403e3d..f42d18c 100644 ---- a/pppd/plugins/Makefile.linux -+++ b/pppd/plugins/Makefile.linux -@@ -5,7 +5,7 @@ COPTS=@CFLAGS@ - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - CFLAGS = $(COPTS) -I.. -I../../include -fPIC - LDFLAGS_SHARED = -shared -diff --git a/pppd/plugins/pppoatm/Makefile.linux b/pppd/plugins/pppoatm/Makefile.linux -index d3a8086..c2aff0c 100644 ---- a/pppd/plugins/pppoatm/Makefile.linux -+++ b/pppd/plugins/pppoatm/Makefile.linux -@@ -4,7 +4,7 @@ CC=$(CROSS_COMPILE)@CC@ - COPTS=@CFLAGS@ - - DESTDIR = $(INSTROOT)@DESTDIR@ --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/pppoe/Makefile.linux b/pppd/plugins/pppoe/Makefile.linux -index c415ce3..d3b7392 100644 ---- a/pppd/plugins/pppoe/Makefile.linux -+++ b/pppd/plugins/pppoe/Makefile.linux -@@ -18,7 +18,7 @@ COPTS=@CFLAGS@ - - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin --LIBDIR = $(DESTDIR)/lib/pppd/$(PPPDVERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(PPPDVERSION) - - PPPDVERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/pppol2tp/Makefile.linux b/pppd/plugins/pppol2tp/Makefile.linux -index 1aa1c0b..e4442f9 100644 ---- a/pppd/plugins/pppol2tp/Makefile.linux -+++ b/pppd/plugins/pppol2tp/Makefile.linux -@@ -4,7 +4,7 @@ CC=$(CROSS_COMPILE)@CC@ - COPTS=@CFLAGS@ - - DESTDIR = $(INSTROOT)/@DESTDIR@ --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - -diff --git a/pppd/plugins/radius/Makefile.linux b/pppd/plugins/radius/Makefile.linux -index 489aef2..d2ef044 100644 ---- a/pppd/plugins/radius/Makefile.linux -+++ b/pppd/plugins/radius/Makefile.linux -@@ -9,7 +9,7 @@ COPTS=@CFLAGS@ - - DESTDIR = $(INSTROOT)@DESTDIR@ - MANDIR = $(DESTDIR)/share/man/man8 --LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION) -+LIBDIR = $(DESTDIR)/lib/$(shell gcc -print-multi-os-directory 2> /dev/null)/pppd/$(VERSION) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h) - diff --git a/ppp-2.4.9-config.patch b/ppp-2.4.9-config.patch deleted file mode 100644 index fc7c781..0000000 --- a/ppp-2.4.9-config.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index e77373e..07df6a7 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -68,14 +68,14 @@ USE_TDB=y - #SYSTEMD=y - - HAS_SHADOW=y --#USE_PAM=y -+USE_PAM=y - HAVE_INET6=y - - # Enable plugins - PLUGIN=y - - # Enable Microsoft proprietary Callback Control Protocol --#CBCP=y -+CBCP=y - - # Enable EAP SRP-SHA1 authentication (requires libsrp) - #USE_SRP=y diff --git a/ppp-2.4.9-configure-cflags-allow-commas.patch b/ppp-2.4.9-configure-cflags-allow-commas.patch deleted file mode 100644 index 5a4ef98..0000000 --- a/ppp-2.4.9-configure-cflags-allow-commas.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff --git a/configure b/configure -index f977663..c7031c2 100755 ---- a/configure -+++ b/configure -@@ -121,9 +121,9 @@ mkmkf() { - rm -f $2 - if [ -f $1 ]; then - echo " $2 <= $1" -- sed -e "s,@DESTDIR@,$DESTDIR,g" -e "s,@SYSCONF@,$SYSCONF,g" \ -- -e "s,@CROSS_COMPILE@,$CROSS_COMPILE,g" -e "s,@CC@,$CC,g" \ -- -e "s,@CFLAGS@,$CFLAGS,g" $1 >$2 -+ sed -e "s|@DESTDIR@|$DESTDIR|g" -e "s|@SYSCONF@|$SYSCONF|g" \ -+ -e "s|@CROSS_COMPILE@|$CROSS_COMPILE|g" -e "s|@CC@|$CC|g" \ -+ -e "s|@CFLAGS@|$CFLAGS|g" $1 >$2 - fi - } - diff --git a/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch b/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch deleted file mode 100644 index 84a3bdb..0000000 --- a/ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch +++ /dev/null @@ -1,241 +0,0 @@ -From 302c1b736cb656c7885a0cba270fd953a672d8a8 Mon Sep 17 00:00:00 2001 -From: Michal Sekletar -Date: Mon, 7 Apr 2014 13:56:34 +0200 -Subject: [PATCH 13/27] everywhere: O_CLOEXEC harder - ---- - pppd/eap.c | 2 +- - pppd/main.c | 4 ++-- - pppd/options.c | 4 ++-- - pppd/sys-linux.c | 22 +++++++++++----------- - pppd/tdb.c | 4 ++-- - pppd/tty.c | 4 ++-- - pppd/utils.c | 6 +++--- - 7 files changed, 23 insertions(+), 23 deletions(-) - -diff --git a/pppd/eap.c b/pppd/eap.c -index 6ea6c1f..faced53 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -1226,7 +1226,7 @@ mode_t modebits; - - if ((path = name_of_pn_file()) == NULL) - return (-1); -- fd = open(path, modebits, S_IRUSR | S_IWUSR); -+ fd = open(path, modebits, S_IRUSR | S_IWUSR | O_CLOEXEC); - err = errno; - free(path); - errno = err; -diff --git a/pppd/main.c b/pppd/main.c -index 6d50d1b..4880377 100644 ---- a/pppd/main.c -+++ b/pppd/main.c -@@ -420,7 +420,7 @@ main(argc, argv) - die(0); - - /* Make sure fds 0, 1, 2 are open to somewhere. */ -- fd_devnull = open(_PATH_DEVNULL, O_RDWR); -+ fd_devnull = open(_PATH_DEVNULL, O_RDWR | O_CLOEXEC); - if (fd_devnull < 0) - fatal("Couldn't open %s: %m", _PATH_DEVNULL); - while (fd_devnull <= 2) { -@@ -1679,7 +1679,7 @@ device_script(program, in, out, dont_wait) - if (log_to_fd >= 0) - errfd = log_to_fd; - else -- errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT, 0644); -+ errfd = open(_PATH_CONNERRS, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0644); - - ++conn_running; - pid = safe_fork(in, out, errfd); -diff --git a/pppd/options.c b/pppd/options.c -index 1d754ae..8e62635 100644 ---- a/pppd/options.c -+++ b/pppd/options.c -@@ -1544,9 +1544,9 @@ setlogfile(argv) - option_error("unable to drop permissions to open %s: %m", *argv); - return 0; - } -- fd = open(*argv, O_WRONLY | O_APPEND | O_CREAT | O_EXCL, 0644); -+ fd = open(*argv, O_WRONLY | O_APPEND | O_CREAT | O_EXCL | O_CLOEXEC, 0644); - if (fd < 0 && errno == EEXIST) -- fd = open(*argv, O_WRONLY | O_APPEND); -+ fd = open(*argv, O_WRONLY | O_APPEND | O_CLOEXEC); - err = errno; - if (!privileged_option && seteuid(euid) == -1) - fatal("unable to regain privileges: %m"); -diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c -index 8a12fa0..00a2cf5 100644 ---- a/pppd/sys-linux.c -+++ b/pppd/sys-linux.c -@@ -459,7 +459,7 @@ int generic_establish_ppp (int fd) - goto err; - } - dbglog("using channel %d", chindex); -- fd = open("/dev/ppp", O_RDWR); -+ fd = open("/dev/ppp", O_RDWR | O_CLOEXEC); - if (fd < 0) { - error("Couldn't reopen /dev/ppp: %m"); - goto err; -@@ -619,7 +619,7 @@ static int make_ppp_unit() - dbglog("in make_ppp_unit, already had /dev/ppp open?"); - close(ppp_dev_fd); - } -- ppp_dev_fd = open("/dev/ppp", O_RDWR); -+ ppp_dev_fd = open("/dev/ppp", O_RDWR | O_CLOEXEC); - if (ppp_dev_fd < 0) - fatal("Couldn't open /dev/ppp: %m"); - flags = fcntl(ppp_dev_fd, F_GETFL); -@@ -693,7 +693,7 @@ int bundle_attach(int ifnum) - if (!new_style_driver) - return -1; - -- master_fd = open("/dev/ppp", O_RDWR); -+ master_fd = open("/dev/ppp", O_RDWR | O_CLOEXEC); - if (master_fd < 0) - fatal("Couldn't open /dev/ppp: %m"); - if (ioctl(master_fd, PPPIOCATTACH, &ifnum) < 0) { -@@ -1715,7 +1715,7 @@ int sifproxyarp (int unit, u_int32_t his_adr) - if (tune_kernel) { - forw_path = path_to_procfs("/sys/net/ipv4/ip_forward"); - if (forw_path != 0) { -- int fd = open(forw_path, O_WRONLY); -+ int fd = open(forw_path, O_WRONLY | O_CLOEXEC); - if (fd >= 0) { - if (write(fd, "1", 1) != 1) - error("Couldn't enable IP forwarding: %m"); -@@ -2030,7 +2030,7 @@ int ppp_available(void) - sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch); - kernel_version = KVERSION(osmaj, osmin, ospatch); - -- fd = open("/dev/ppp", O_RDWR); -+ fd = open("/dev/ppp", O_RDWR | O_CLOEXEC); - if (fd >= 0) { - new_style_driver = 1; - -@@ -2208,7 +2208,7 @@ void logwtmp (const char *line, const char *name, const char *host) - #if __GLIBC__ >= 2 - updwtmp(_PATH_WTMP, &ut); - #else -- wtmp = open(_PATH_WTMP, O_APPEND|O_WRONLY); -+ wtmp = open(_PATH_WTMP, O_APPEND|O_WRONLY|O_CLOEXEC); - if (wtmp >= 0) { - flock(wtmp, LOCK_EX); - -@@ -2394,7 +2394,7 @@ int sifaddr (int unit, u_int32_t our_adr, u_int32_t his_adr, - int fd; - - path = path_to_procfs("/sys/net/ipv4/ip_dynaddr"); -- if (path != 0 && (fd = open(path, O_WRONLY)) >= 0) { -+ if (path != 0 && (fd = open(path, O_WRONLY | O_CLOEXEC)) >= 0) { - if (write(fd, "1", 1) != 1) - error("Couldn't enable dynamic IP addressing: %m"); - close(fd); -@@ -2570,7 +2570,7 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) - /* - * Try the unix98 way first. - */ -- mfd = open("/dev/ptmx", O_RDWR); -+ mfd = open("/dev/ptmx", O_RDWR | O_CLOEXEC); - if (mfd >= 0) { - int ptn; - if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) { -@@ -2581,7 +2581,7 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) - if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0) - warn("Couldn't unlock pty slave %s: %m", pty_name); - #endif -- if ((sfd = open(pty_name, O_RDWR | O_NOCTTY)) < 0) -+ if ((sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC)) < 0) - { - warn("Couldn't open pty slave %s: %m", pty_name); - close(mfd); -@@ -2592,10 +2592,10 @@ get_pty(master_fdp, slave_fdp, slave_name, uid) - for (i = 0; i < 64; ++i) { - slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", - 'p' + i / 16, i % 16); -- mfd = open(pty_name, O_RDWR, 0); -+ mfd = open(pty_name, O_RDWR | O_CLOEXEC, 0); - if (mfd >= 0) { - pty_name[5] = 't'; -- sfd = open(pty_name, O_RDWR | O_NOCTTY, 0); -+ sfd = open(pty_name, O_RDWR | O_NOCTTY | O_CLOEXEC, 0); - if (sfd >= 0) { - fchown(sfd, uid, -1); - fchmod(sfd, S_IRUSR | S_IWUSR); -diff --git a/pppd/tdb.c b/pppd/tdb.c -index bdc5828..c7ab71c 100644 ---- a/pppd/tdb.c -+++ b/pppd/tdb.c -@@ -1724,7 +1724,7 @@ TDB_CONTEXT *tdb_open_ex(const char *name, int hash_size, int tdb_flags, - goto internal; - } - -- if ((tdb->fd = open(name, open_flags, mode)) == -1) { -+ if ((tdb->fd = open(name, open_flags | O_CLOEXEC, mode)) == -1) { - TDB_LOG((tdb, 5, "tdb_open_ex: could not open file %s: %s\n", - name, strerror(errno))); - goto fail; /* errno set by open(2) */ -@@ -1967,7 +1967,7 @@ int tdb_reopen(TDB_CONTEXT *tdb) - } - if (close(tdb->fd) != 0) - TDB_LOG((tdb, 0, "tdb_reopen: WARNING closing tdb->fd failed!\n")); -- tdb->fd = open(tdb->name, tdb->open_flags & ~(O_CREAT|O_TRUNC), 0); -+ tdb->fd = open(tdb->name, (tdb->open_flags & ~(O_CREAT|O_TRUNC)) | O_CLOEXEC, 0); - if (tdb->fd == -1) { - TDB_LOG((tdb, 0, "tdb_reopen: open failed (%s)\n", strerror(errno))); - goto fail; -diff --git a/pppd/tty.c b/pppd/tty.c -index d571b11..bc96695 100644 ---- a/pppd/tty.c -+++ b/pppd/tty.c -@@ -569,7 +569,7 @@ int connect_tty() - status = EXIT_OPEN_FAILED; - goto errret; - } -- real_ttyfd = open(devnam, O_NONBLOCK | O_RDWR, 0); -+ real_ttyfd = open(devnam, O_NONBLOCK | O_RDWR | O_CLOEXEC, 0); - err = errno; - if (prio < OPRIO_ROOT && seteuid(0) == -1) - fatal("Unable to regain privileges"); -@@ -723,7 +723,7 @@ int connect_tty() - if (connector == NULL && modem && devnam[0] != 0) { - int i; - for (;;) { -- if ((i = open(devnam, O_RDWR)) >= 0) -+ if ((i = open(devnam, O_RDWR | O_CLOEXEC)) >= 0) - break; - if (errno != EINTR) { - error("Failed to reopen %s: %m", devnam); -diff --git a/pppd/utils.c b/pppd/utils.c -index 29bf970..6051b9a 100644 ---- a/pppd/utils.c -+++ b/pppd/utils.c -@@ -918,14 +918,14 @@ lock(dev) - slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", LOCK_DIR, dev); - #endif - -- while ((fd = open(lock_file, O_EXCL | O_CREAT | O_RDWR, 0644)) < 0) { -+ while ((fd = open(lock_file, O_EXCL | O_CREAT | O_RDWR | O_CLOEXEC, 0644)) < 0) { - if (errno != EEXIST) { - error("Can't create lock file %s: %m", lock_file); - break; - } - - /* Read the lock file to find out who has the device locked. */ -- fd = open(lock_file, O_RDONLY, 0); -+ fd = open(lock_file, O_RDONLY | O_CLOEXEC, 0); - if (fd < 0) { - if (errno == ENOENT) /* This is just a timing problem. */ - continue; -@@ -1004,7 +1004,7 @@ relock(pid) - - if (lock_file[0] == 0) - return -1; -- fd = open(lock_file, O_WRONLY, 0); -+ fd = open(lock_file, O_WRONLY | O_CLOEXEC, 0); - if (fd < 0) { - error("Couldn't reopen lock file %s: %m", lock_file); - lock_file[0] = 0; --- -1.8.3.1 - diff --git a/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch b/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch deleted file mode 100644 index fb0bcc1..0000000 --- a/ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch +++ /dev/null @@ -1,898 +0,0 @@ -From d706c95906d996534f13632a747af5dc617f306e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Eivind=20N=C3=A6ss?= -Date: Sat, 24 Apr 2021 03:00:34 -0700 -Subject: [PATCH] pppd: Expose the MPPE keys generated through an API (#267) - -The lengthy part of this fix is to refactor the handling of MPPE keys -by moving it into mppe.c and thus reducing the clutter in chap_ms.c. -It does so by renaming the mppe_set_keys/2 to the corresponding -mppe_set_chapv1/mppe_set_chapv2 versions and updates callers of these -functions. - -Having done so, it conveniently allows the name "mppe_set_keys" to be -re-used for this new purpose which will copy the key material up to -its size and then clear the input parameters (avoids leaving the MPPE -keys on the stack). - -Additional functiions added to the MPPE code allow plugins et al. to -access the MPPE keys, clear the keys, and check if they are set. All -plugin and CCP code has been updated to use this API. - -This fixes GitHub Issue #258 - -Signed-off-by: Eivind Naess ---- - pppd/Makefile.linux | 2 + - pppd/Makefile.sol2 | 2 +- - pppd/ccp.c | 15 +-- - pppd/chap_ms.c | 167 +---------------------- - pppd/chap_ms.h | 22 +--- - pppd/eap-tls.c | 21 +-- - pppd/eap-tls.h | 5 - - pppd/mppe.c | 248 +++++++++++++++++++++++++++++++++++ - pppd/mppe.h | 70 +++++++++- - pppd/plugins/radius/radius.c | 14 +- - pppd/plugins/winbind.c | 8 +- - 11 files changed, 348 insertions(+), 226 deletions(-) - create mode 100644 pppd/mppe.c - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index f92f7c0..852945e 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -109,6 +109,8 @@ CFLAGS += -DMSLANMAN=1 - endif - ifdef MPPE - CFLAGS += -DMPPE=1 -+PPPDOBJS += mppe.o -+PPPDSRC += mppe.c - HEADERS += mppe.h - endif - endif -diff --git a/pppd/Makefile.sol2 b/pppd/Makefile.sol2 -index 809cb4b..3a8681c 100644 ---- a/pppd/Makefile.sol2 -+++ b/pppd/Makefile.sol2 -@@ -37,7 +37,7 @@ OBJS += ipv6cp.o eui64.o - - # Uncomment to enable MS-CHAP - CFLAGS += -DUSE_CRYPT -DCHAPMS -DMSLANMAN -DHAVE_CRYPT_H --OBJS += chap_ms.o pppcrypt.o md4.o sha1.o -+OBJS += chap_ms.o pppcrypt.o md4.o sha1.o mppe.o - - # Uncomment to enable MPPE (in both CHAP and EAP-TLS) - CFLAGS += -DMPPE -diff --git a/pppd/ccp.c b/pppd/ccp.c -index 052c4c6..387b571 100644 ---- a/pppd/ccp.c -+++ b/pppd/ccp.c -@@ -38,10 +38,9 @@ - #include "ccp.h" - #include - --#ifdef MPPE --#include "chap_ms.h" /* mppe_xxxx_key, mppe_keys_set */ -+#include "chap_ms.h" -+#include "mppe.h" - #include "lcp.h" /* lcp_close(), lcp_fsm */ --#endif - - - /* -@@ -574,7 +573,7 @@ ccp_resetci(fsm *f) - } - - /* A plugin (eg radius) may not have obtained key material. */ -- if (!mppe_keys_set) { -+ if (!mppe_keys_isset()) { - error("MPPE required, but keys are not available. " - "Possible plugin problem?"); - lcp_close(f->unit, "MPPE required but not available"); -@@ -705,7 +704,7 @@ static void - p[1] = opt_buf[1] = CILEN_MPPE; - MPPE_OPTS_TO_CI(go->mppe, &p[2]); - MPPE_OPTS_TO_CI(go->mppe, &opt_buf[2]); -- BCOPY(mppe_recv_key, &opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); -+ mppe_get_recv_key(&opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); - res = ccp_test(f->unit, opt_buf, CILEN_MPPE + MPPE_MAX_KEY_LEN, 0); - if (res > 0) - p += CILEN_MPPE; -@@ -1156,8 +1155,7 @@ ccp_reqci(fsm *f, u_char *p, int *lenp, int dont_nak) - int mtu; - - BCOPY(p, opt_buf, CILEN_MPPE); -- BCOPY(mppe_send_key, &opt_buf[CILEN_MPPE], -- MPPE_MAX_KEY_LEN); -+ mppe_get_send_key(&opt_buf[CILEN_MPPE], MPPE_MAX_KEY_LEN); - if (ccp_test(f->unit, opt_buf, - CILEN_MPPE + MPPE_MAX_KEY_LEN, 1) <= 0) { - /* This shouldn't happen, we've already tested it! */ -@@ -1426,8 +1424,7 @@ ccp_up(fsm *f) - notice("%s transmit compression enabled", method_name(ho, NULL)); - #ifdef MPPE - if (go->mppe) { -- BZERO(mppe_recv_key, MPPE_MAX_KEY_LEN); -- BZERO(mppe_send_key, MPPE_MAX_KEY_LEN); -+ mppe_clear_keys(); - continue_networks(f->unit); /* Bring up IP et al */ - } - #endif -diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c -index df2dadd..d315ab4 100644 ---- a/pppd/chap_ms.c -+++ b/pppd/chap_ms.c -@@ -93,8 +93,7 @@ - #include "sha1.h" - #include "pppcrypt.h" - #include "magic.h" -- -- -+#include "mppe.h" - - static void ascii2unicode (char[], int, u_char[]); - static void NTPasswordHash (u_char *, int, u_char[MD4_SIGNATURE_SIZE]); -@@ -109,21 +108,12 @@ static void GenerateAuthenticatorResponsePlain - static void ChapMS_LANMan (u_char *, char *, int, u_char *); - #endif - --#ifdef MPPE --static void Set_Start_Key (u_char *, char *, int); --static void SetMasterKeys (char *, int, u_char[24], int); --#endif -- - #ifdef MSLANMAN - bool ms_lanman = 0; /* Use LanMan password instead of NT */ - /* Has meaning only with MS-CHAP challenges */ - #endif - - #ifdef MPPE --u_char mppe_send_key[MPPE_MAX_KEY_LEN]; --u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; --int mppe_keys_set = 0; /* Have the MPPE keys been set? */ -- - #ifdef DEBUGMPPEKEY - /* For MPPE debug */ - /* Use "[]|}{?/><,`!2&&(" (sans quotes) for RFC 3079 MS-CHAPv2 test value */ -@@ -719,28 +709,6 @@ GenerateAuthenticatorResponsePlain - - - #ifdef MPPE --/* -- * Set mppe_xxxx_key from the NTPasswordHashHash. -- * RFC 2548 (RADIUS support) requires us to export this function (ugh). -- */ --void --mppe_set_keys(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) --{ -- SHA1_CTX sha1Context; -- u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ -- -- SHA1_Init(&sha1Context); -- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -- SHA1_Update(&sha1Context, rchallenge, 8); -- SHA1_Final(Digest, &sha1Context); -- -- /* Same key in both directions. */ -- BCOPY(Digest, mppe_send_key, sizeof(mppe_send_key)); -- BCOPY(Digest, mppe_recv_key, sizeof(mppe_recv_key)); -- -- mppe_keys_set = 1; --} - - /* - * Set mppe_xxxx_key from MS-CHAP credentials. (see RFC 3079) -@@ -757,104 +725,7 @@ Set_Start_Key(u_char *rchallenge, char *secret, int secret_len) - NTPasswordHash(unicodePassword, secret_len * 2, PasswordHash); - NTPasswordHash(PasswordHash, sizeof(PasswordHash), PasswordHashHash); - -- mppe_set_keys(rchallenge, PasswordHashHash); --} -- --/* -- * Set mppe_xxxx_key from MS-CHAPv2 credentials. (see RFC 3079) -- * -- * This helper function used in the Winbind module, which gets the -- * NTHashHash from the server. -- */ --void --mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], -- u_char NTResponse[24], int IsServer) --{ -- SHA1_CTX sha1Context; -- u_char MasterKey[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ -- u_char Digest[SHA1_SIGNATURE_SIZE]; /* >= MPPE_MAX_KEY_LEN */ -- -- u_char SHApad1[40] = -- { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; -- u_char SHApad2[40] = -- { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -- 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 }; -- -- /* "This is the MPPE Master Key" */ -- u_char Magic1[27] = -- { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, -- 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d, -- 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 }; -- /* "On the client side, this is the send key; " -- "on the server side, it is the receive key." */ -- u_char Magic2[84] = -- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, -- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, -- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -- 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79, -- 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, -- 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65, -- 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, -- 0x6b, 0x65, 0x79, 0x2e }; -- /* "On the client side, this is the receive key; " -- "on the server side, it is the send key." */ -- u_char Magic3[84] = -- { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, -- 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, -- 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -- 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, -- 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, -- 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, -- 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, -- 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, -- 0x6b, 0x65, 0x79, 0x2e }; -- u_char *s; -- -- SHA1_Init(&sha1Context); -- SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -- SHA1_Update(&sha1Context, NTResponse, 24); -- SHA1_Update(&sha1Context, Magic1, sizeof(Magic1)); -- SHA1_Final(MasterKey, &sha1Context); -- -- /* -- * generate send key -- */ -- if (IsServer) -- s = Magic3; -- else -- s = Magic2; -- SHA1_Init(&sha1Context); -- SHA1_Update(&sha1Context, MasterKey, 16); -- SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); -- SHA1_Update(&sha1Context, s, 84); -- SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); -- SHA1_Final(Digest, &sha1Context); -- -- BCOPY(Digest, mppe_send_key, sizeof(mppe_send_key)); -- -- /* -- * generate recv key -- */ -- if (IsServer) -- s = Magic2; -- else -- s = Magic3; -- SHA1_Init(&sha1Context); -- SHA1_Update(&sha1Context, MasterKey, 16); -- SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); -- SHA1_Update(&sha1Context, s, 84); -- SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); -- SHA1_Final(Digest, &sha1Context); -- -- BCOPY(Digest, mppe_recv_key, sizeof(mppe_recv_key)); -- -- mppe_keys_set = 1; -+ mppe_set_chapv1(rchallenge, PasswordHashHash); - } - - /* -@@ -870,7 +741,7 @@ SetMasterKeys(char *secret, int secret_len, u_char NTResponse[24], int IsServer) - ascii2unicode(secret, secret_len, unicodePassword); - NTPasswordHash(unicodePassword, secret_len * 2, PasswordHash); - NTPasswordHash(PasswordHash, sizeof(PasswordHash), PasswordHashHash); -- mppe_set_keys2(PasswordHashHash, NTResponse, IsServer); -+ mppe_set_chapv2(PasswordHashHash, NTResponse, IsServer); - } - - #endif /* MPPE */ -@@ -945,38 +816,6 @@ ChapMS2(u_char *rchallenge, u_char *PeerChallenge, - #endif - } - --#ifdef MPPE --/* -- * Set MPPE options from plugins. -- */ --void --set_mppe_enc_types(int policy, int types) --{ -- /* Early exit for unknown policies. */ -- if (policy != MPPE_ENC_POL_ENC_ALLOWED && -- policy != MPPE_ENC_POL_ENC_REQUIRED) -- return; -- -- /* Don't modify MPPE if it's optional and wasn't already configured. */ -- if (policy == MPPE_ENC_POL_ENC_ALLOWED && !ccp_wantoptions[0].mppe) -- return; -- -- /* -- * Disable undesirable encryption types. Note that we don't ENABLE -- * any encryption types, to avoid overriding manual configuration. -- */ -- switch(types) { -- case MPPE_ENC_TYPES_RC4_40: -- ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ -- break; -- case MPPE_ENC_TYPES_RC4_128: -- ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ -- break; -- default: -- break; -- } --} --#endif /* MPPE */ - - static struct chap_digest_type chapms_digest = { - CHAP_MICROSOFT, /* code */ -diff --git a/pppd/chap_ms.h b/pppd/chap_ms.h -index 005eb63..4e6a621 100644 ---- a/pppd/chap_ms.h -+++ b/pppd/chap_ms.h -@@ -38,6 +38,7 @@ - #define MS_CHAP_RESPONSE_LEN 49 /* Response length for MS-CHAP */ - #define MS_CHAP2_RESPONSE_LEN 49 /* Response length for MS-CHAPv2 */ - #define MS_AUTH_RESPONSE_LENGTH 40 /* MS-CHAPv2 authenticator response, */ -+#define MS_AUTH_NTRESP_LEN 24 /* Length of NT-response field */ - /* as ASCII */ - - /* E=eeeeeeeeee error codes for MS-CHAP failure messages. */ -@@ -67,22 +68,6 @@ - #define MS_CHAP2_NTRESP_LEN 24 - #define MS_CHAP2_FLAGS 48 - --#ifdef MPPE --#include "mppe.h" /* MPPE_MAX_KEY_LEN */ --extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; --extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; --extern int mppe_keys_set; -- --/* These values are the RADIUS attribute values--see RFC 2548. */ --#define MPPE_ENC_POL_ENC_ALLOWED 1 --#define MPPE_ENC_POL_ENC_REQUIRED 2 --#define MPPE_ENC_TYPES_RC4_40 2 --#define MPPE_ENC_TYPES_RC4_128 4 -- --/* used by plugins (using above values) */ --extern void set_mppe_enc_types(int, int); --#endif -- - /* Are we the authenticator or authenticatee? For MS-CHAPv2 key derivation. */ - #define MS_CHAP2_AUTHENTICATEE 0 - #define MS_CHAP2_AUTHENTICATOR 1 -@@ -90,11 +75,6 @@ extern void set_mppe_enc_types(int, int); - void ChapMS (u_char *, char *, int, u_char *); - void ChapMS2 (u_char *, u_char *, char *, char *, int, - u_char *, u_char[MS_AUTH_RESPONSE_LENGTH+1], int); --#ifdef MPPE --void mppe_set_keys (u_char *, u_char[MD4_SIGNATURE_SIZE]); --void mppe_set_keys2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], -- u_char NTResponse[24], int IsServer); --#endif - - void ChallengeHash (u_char[16], u_char *, char *, u_char[8]); - -diff --git a/pppd/eap-tls.c b/pppd/eap-tls.c -index 5c202c7..bfcf199 100644 ---- a/pppd/eap-tls.c -+++ b/pppd/eap-tls.c -@@ -48,6 +48,8 @@ - #include "eap-tls.h" - #include "fsm.h" - #include "lcp.h" -+#include "chap_ms.h" -+#include "mppe.h" - #include "pathnames.h" - - typedef struct pw_cb_data -@@ -74,10 +76,6 @@ int ssl_new_session_cb(SSL *s, SSL_SESSION *sess); - X509 *get_X509_from_file(char *filename); - int ssl_cmp_certs(char *filename, X509 * a); - --#ifdef MPPE -- --#define EAPTLS_MPPE_KEY_LEN 32 -- - /* - * OpenSSL 1.1+ introduced a generic TLS_method() - * For older releases we substitute the appropriate method -@@ -119,6 +117,8 @@ static inline int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, long tls_ver_max) - - #endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */ - -+#ifdef MPPE -+#define EAPTLS_MPPE_KEY_LEN 32 - - /* - * Generate keys according to RFC 2716 and add to reply -@@ -161,24 +161,17 @@ void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client) - */ - if (client) - { -- p = out; -- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -- p += EAPTLS_MPPE_KEY_LEN; -- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ mppe_set_keys(out, out + EAPTLS_MPPE_KEY_LEN, EAPTLS_MPPE_KEY_LEN); - } - else - { -- p = out; -- BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -- p += EAPTLS_MPPE_KEY_LEN; -- BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ mppe_set_keys(out + EAPTLS_MPPE_KEY_LEN, out, EAPTLS_MPPE_KEY_LEN); - } -- -- mppe_keys_set = 1; - } - - #endif /* MPPE */ - -+ - void log_ssl_errors( void ) - { - unsigned long ssl_err = ERR_get_error(); -diff --git a/pppd/eap-tls.h b/pppd/eap-tls.h -index c74a831..b935ec5 100644 ---- a/pppd/eap-tls.h -+++ b/pppd/eap-tls.h -@@ -86,11 +86,6 @@ int get_eaptls_secret(int unit, char *client, char *server, - char *capath, char *pkfile, int am_server); - - #ifdef MPPE --#include "mppe.h" /* MPPE_MAX_KEY_LEN */ --extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; --extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; --extern int mppe_keys_set; -- - void eaptls_gen_mppe_keys(struct eaptls_session *ets, int client); - #endif - -diff --git a/pppd/mppe.c b/pppd/mppe.c -new file mode 100644 -index 0000000..4f3d131 ---- /dev/null -+++ b/pppd/mppe.c -@@ -0,0 +1,248 @@ -+/* * mppe.c - MPPE key implementation -+ * -+ * Copyright (c) 2020 Eivind Naess. All rights reserved. -+ * Copyright (c) 2008 Paul Mackerras. All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#include -+ -+#include "pppd.h" -+#include "fsm.h" -+#include "md4.h" -+#include "sha1.h" -+#include "ccp.h" -+#include "chap_ms.h" -+#include "mppe.h" -+ -+u_char mppe_send_key[MPPE_MAX_KEY_SIZE]; -+u_char mppe_recv_key[MPPE_MAX_KEY_SIZE]; -+int mppe_keys_set = 0; -+ -+void -+mppe_set_keys(u_char *send_key, u_char *recv_key, int keylen) -+{ -+ int length = keylen; -+ if (length > MPPE_MAX_KEY_SIZE) -+ length = MPPE_MAX_KEY_SIZE; -+ -+ if (send_key) { -+ BCOPY(send_key, mppe_send_key, length); -+ BZERO(send_key, keylen); -+ } -+ -+ if (recv_key) { -+ BCOPY(recv_key, mppe_recv_key, length); -+ BZERO(recv_key, keylen); -+ } -+ -+ mppe_keys_set = length; -+} -+ -+bool -+mppe_keys_isset() -+{ -+ return !!mppe_keys_set; -+} -+ -+int -+mppe_get_recv_key(u_char *recv_key, int length) -+{ -+ if (mppe_keys_isset()) { -+ if (length > mppe_keys_set) -+ length = mppe_keys_set; -+ BCOPY(mppe_recv_key, recv_key, length); -+ return length; -+ } -+ return 0; -+} -+ -+int -+mppe_get_send_key(u_char *send_key, int length) -+{ -+ if (mppe_keys_isset()) { -+ if (length > mppe_keys_set) -+ length = mppe_keys_set; -+ BCOPY(mppe_send_key, send_key, length); -+ return length; -+ } -+ return 0; -+} -+ -+void -+mppe_clear_keys(void) -+{ -+ mppe_keys_set = 0; -+ BZERO(mppe_send_key, sizeof(mppe_send_key)); -+ BZERO(mppe_recv_key, sizeof(mppe_recv_key)); -+} -+ -+/* -+ * Set mppe_xxxx_key from the NTPasswordHashHash. -+ * RFC 2548 (RADIUS support) requires us to export this function (ugh). -+ */ -+void -+mppe_set_chapv1(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]) -+{ -+ SHA1_CTX sha1Context; -+ u_char Digest[SHA1_SIGNATURE_SIZE]; -+ -+ SHA1_Init(&sha1Context); -+ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -+ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -+ SHA1_Update(&sha1Context, rchallenge, 8); -+ SHA1_Final(Digest, &sha1Context); -+ -+ /* Same key in both directions. */ -+ mppe_set_keys(Digest, Digest, sizeof(Digest)); -+} -+ -+/* -+ * Set mppe_xxxx_key from MS-CHAPv2 credentials. (see RFC 3079) -+ * -+ * This helper function used in the Winbind module, which gets the -+ * NTHashHash from the server. -+ */ -+void -+mppe_set_chapv2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], -+ u_char NTResponse[MS_AUTH_NTRESP_LEN], int IsServer) -+{ -+ SHA1_CTX sha1Context; -+ u_char MasterKey[SHA1_SIGNATURE_SIZE]; -+ u_char SendKey[SHA1_SIGNATURE_SIZE]; -+ u_char RecvKey[SHA1_SIGNATURE_SIZE]; -+ -+ u_char SHApad1[40] = -+ { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; -+ u_char SHApad2[40] = -+ { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, -+ 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 }; -+ -+ /* "This is the MPPE Master Key" */ -+ u_char Magic1[27] = -+ { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, -+ 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d, -+ 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 }; -+ /* "On the client side, this is the send key; " -+ "on the server side, it is the receive key." */ -+ u_char Magic2[84] = -+ { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, -+ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, -+ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -+ 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79, -+ 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, -+ 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65, -+ 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -+ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, -+ 0x6b, 0x65, 0x79, 0x2e }; -+ /* "On the client side, this is the receive key; " -+ "on the server side, it is the send key." */ -+ u_char Magic3[84] = -+ { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69, -+ 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20, -+ 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68, -+ 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20, -+ 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, -+ 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, -+ 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, -+ 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, -+ 0x6b, 0x65, 0x79, 0x2e }; -+ u_char *s; -+ -+ SHA1_Init(&sha1Context); -+ SHA1_Update(&sha1Context, PasswordHashHash, MD4_SIGNATURE_SIZE); -+ SHA1_Update(&sha1Context, NTResponse, 24); -+ SHA1_Update(&sha1Context, Magic1, sizeof(Magic1)); -+ SHA1_Final(MasterKey, &sha1Context); -+ -+ /* -+ * generate send key -+ */ -+ if (IsServer) -+ s = Magic3; -+ else -+ s = Magic2; -+ SHA1_Init(&sha1Context); -+ SHA1_Update(&sha1Context, MasterKey, 16); -+ SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); -+ SHA1_Update(&sha1Context, s, 84); -+ SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); -+ SHA1_Final(SendKey, &sha1Context); -+ -+ /* -+ * generate recv key -+ */ -+ if (IsServer) -+ s = Magic2; -+ else -+ s = Magic3; -+ SHA1_Init(&sha1Context); -+ SHA1_Update(&sha1Context, MasterKey, 16); -+ SHA1_Update(&sha1Context, SHApad1, sizeof(SHApad1)); -+ SHA1_Update(&sha1Context, s, 84); -+ SHA1_Update(&sha1Context, SHApad2, sizeof(SHApad2)); -+ SHA1_Final(RecvKey, &sha1Context); -+ -+ mppe_set_keys(SendKey, RecvKey, SHA1_SIGNATURE_SIZE); -+} -+ -+/* -+ * Set MPPE options from plugins. -+ */ -+void -+mppe_set_enc_types(int policy, int types) -+{ -+ /* Early exit for unknown policies. */ -+ if (policy != MPPE_ENC_POL_ENC_ALLOWED && -+ policy != MPPE_ENC_POL_ENC_REQUIRED) -+ return; -+ -+ /* Don't modify MPPE if it's optional and wasn't already configured. */ -+ if (policy == MPPE_ENC_POL_ENC_ALLOWED && !ccp_wantoptions[0].mppe) -+ return; -+ -+ /* -+ * Disable undesirable encryption types. Note that we don't ENABLE -+ * any encryption types, to avoid overriding manual configuration. -+ */ -+ switch(types) { -+ case MPPE_ENC_TYPES_RC4_40: -+ ccp_wantoptions[0].mppe &= ~MPPE_OPT_128; /* disable 128-bit */ -+ break; -+ case MPPE_ENC_TYPES_RC4_128: -+ ccp_wantoptions[0].mppe &= ~MPPE_OPT_40; /* disable 40-bit */ -+ break; -+ default: -+ break; -+ } -+} -+ -diff --git a/pppd/mppe.h b/pppd/mppe.h -index 5eb3b37..98a89d3 100644 ---- a/pppd/mppe.h -+++ b/pppd/mppe.h -@@ -32,9 +32,12 @@ - * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING - * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - */ -+#ifndef __MPPE_H__ -+#define __MPPE_H__ - - #define MPPE_PAD 4 /* MPPE growth per frame */ --#define MPPE_MAX_KEY_LEN 16 /* largest key length (128-bit) */ -+#define MPPE_MAX_KEY_SIZE 32 /* Largest key length */ -+#define MPPE_MAX_KEY_LEN 16 /* Largest key size accepted by the kernel */ - - /* option bits for ccp_options.mppe */ - #define MPPE_OPT_40 0x01 /* 40 bit */ -@@ -119,3 +122,68 @@ - if (ptr[3] & ~MPPE_ALL_BITS) \ - opts |= MPPE_OPT_UNKNOWN; \ - } while (/* CONSTCOND */ 0) -+ -+ -+#if MPPE -+ -+/* -+ * NOTE: -+ * Access to these variables directly is discuraged. Please -+ * change your code to use below accessor functions. -+ */ -+ -+/* The key material generated which is used for MPPE send key */ -+extern u_char mppe_send_key[MPPE_MAX_KEY_SIZE]; -+/* The key material generated which is used for MPPE recv key */ -+extern u_char mppe_recv_key[MPPE_MAX_KEY_SIZE]; -+/* Keys are set if value is non-zero */ -+extern int mppe_keys_set; -+ -+/* These values are the RADIUS attribute values--see RFC 2548. */ -+#define MPPE_ENC_POL_ENC_ALLOWED 1 -+#define MPPE_ENC_POL_ENC_REQUIRED 2 -+#define MPPE_ENC_TYPES_RC4_40 2 -+#define MPPE_ENC_TYPES_RC4_128 4 -+ -+/* used by plugins (using above values) */ -+void mppe_set_enc_types (int policy, int types); -+ -+/* -+ * Set the MPPE send and recv keys. NULL values for keys are ignored -+ * and input values are cleared to avoid leaving them on the stack -+ */ -+void mppe_set_keys(u_char *send_key, u_char *recv_key, int keylen); -+ -+/* -+ * Get the MPPE recv key -+ */ -+int mppe_get_recv_key(u_char *recv_key, int length); -+ -+/* -+ * Get the MPPE send key -+ */ -+int mppe_get_send_key(u_char *send_key, int length); -+ -+/* -+ * Clear the MPPE keys -+ */ -+void mppe_clear_keys(void); -+ -+/* -+ * Check if the MPPE keys are set -+ */ -+bool mppe_keys_isset(void); -+ -+/* -+ * Set mppe_xxxx_key from NT Password Hash Hash (MSCHAPv1), see RFC3079 -+ */ -+void mppe_set_chapv1(u_char *rchallenge, u_char PasswordHashHash[MD4_SIGNATURE_SIZE]); -+ -+/* -+ * Set the mppe_xxxx_key from MS-CHAP-v2 credentials, see RFC3079 -+ */ -+void mppe_set_chapv2(u_char PasswordHashHash[MD4_SIGNATURE_SIZE], -+ u_char NTResponse[MS_AUTH_NTRESP_LEN], int IsServer); -+ -+#endif // #ifdef MPPE -+#endif // #ifdef __MPPE_H__ -diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c -index c579831..cf4c0f2 100644 ---- a/pppd/plugins/radius/radius.c -+++ b/pppd/plugins/radius/radius.c -@@ -31,6 +31,7 @@ static char const RCSID[] = - #ifdef CHAPMS - #include "chap_ms.h" - #ifdef MPPE -+#include "mppe.h" - #include "md5.h" - #endif - #endif -@@ -743,11 +744,12 @@ radius_setparams(VALUE_PAIR *vp, char *msg, REQUEST_INFO *req_info, - * Note that if the policy value was '0' we don't set the key! - */ - if (mppe_enc_policy && mppe_enc_keys) { -- mppe_keys_set = 1; - /* Set/modify allowed encryption types. */ - if (mppe_enc_types) -- set_mppe_enc_types(mppe_enc_policy, mppe_enc_types); -+ mppe_set_enc_types(mppe_enc_policy, mppe_enc_types); -+ return 0; - } -+ mppe_clear_keys(); - #endif - - return 0; -@@ -803,7 +805,7 @@ radius_setmppekeys(VALUE_PAIR *vp, REQUEST_INFO *req_info, - * the NAS (us) doesn't need; we only need the start key. So we have - * to generate the start key, sigh. NB: We do not support the LM-Key. - */ -- mppe_set_keys(challenge, &plain[8]); -+ mppe_set_chapv1(challenge, &plain[8]); - - return 0; - } -@@ -855,7 +857,7 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info) - for (i = 0; i < 16; i++) - plain[i] ^= buf[i]; - -- if (plain[0] != sizeof(mppe_send_key) /* 16 */) { -+ if (plain[0] != 16) { - error("RADIUS: Incorrect key length (%d) for MS-MPPE-%s-Key attribute", - (int) plain[0], type); - return -1; -@@ -869,9 +871,9 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info) - plain[16] ^= buf[0]; /* only need the first byte */ - - if (vp->attribute == PW_MS_MPPE_SEND_KEY) -- memcpy(mppe_send_key, plain + 1, 16); -+ mppe_set_keys(plain + 1, NULL, 16); - else -- memcpy(mppe_recv_key, plain + 1, 16); -+ mppe_set_keys(NULL, plain + 1, 16); - - return 0; - } -diff --git a/pppd/plugins/winbind.c b/pppd/plugins/winbind.c -index 0c395c3..67c72f6 100644 ---- a/pppd/plugins/winbind.c -+++ b/pppd/plugins/winbind.c -@@ -37,11 +37,9 @@ - #include "pppd.h" - #include "chap-new.h" - #include "chap_ms.h" --#ifdef MPPE --#include "md5.h" --#endif - #include "fsm.h" - #include "ipcp.h" -+#include "mppe.h" - #include - #include - #include -@@ -583,7 +581,7 @@ winbind_chap_verify(char *user, char *ourname, int id, - nt_response, nt_response_size, - session_key, - &error_string) == AUTHENTICATED) { -- mppe_set_keys(challenge, session_key); -+ mppe_set_chapv1(challenge, session_key); - slprintf(message, message_space, "Access granted"); - return AUTHENTICATED; - -@@ -628,7 +626,7 @@ winbind_chap_verify(char *user, char *ourname, int id, - &response[MS_CHAP2_NTRESP], - &response[MS_CHAP2_PEER_CHALLENGE], - challenge, user, saresponse); -- mppe_set_keys2(session_key, &response[MS_CHAP2_NTRESP], -+ mppe_set_chapv2(session_key, &response[MS_CHAP2_NTRESP], - MS_CHAP2_AUTHENTICATOR); - if (response[MS_CHAP2_FLAGS]) { - slprintf(message, message_space, "S=%s", saresponse); --- -2.34.1 - diff --git a/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch b/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch deleted file mode 100644 index c8eb350..0000000 --- a/ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch +++ /dev/null @@ -1,37 +0,0 @@ -From e609ed8bb62e4648568eaa49fbbc858dfda6d122 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Eivind=20N=C3=A6ss?= -Date: Sun, 14 Mar 2021 16:20:29 -0700 -Subject: [PATCH] pppd: Fix logical error in comparing valid encryption - policies (#262) - -RFC2548 describes the proper values of the MS-MPPE-Encryption-Policy attribute. -and it can only hold 2 values: 1 (encryption allowed) and 2 (encryption required). - -See - https://tools.ietf.org/html/rfc2548, section 2.4.4 - -The correct comparison should be made with an && and not a ||. - -This fixes github issue #218 - -Signed-off-by: Eivind Naess ---- - pppd/chap_ms.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/pppd/chap_ms.c b/pppd/chap_ms.c -index e6b84f2..df2dadd 100644 ---- a/pppd/chap_ms.c -+++ b/pppd/chap_ms.c -@@ -953,7 +953,7 @@ void - set_mppe_enc_types(int policy, int types) - { - /* Early exit for unknown policies. */ -- if (policy != MPPE_ENC_POL_ENC_ALLOWED || -+ if (policy != MPPE_ENC_POL_ENC_ALLOWED && - policy != MPPE_ENC_POL_ENC_REQUIRED) - return; - --- -2.34.1 - diff --git a/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch b/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch deleted file mode 100644 index 2b6f53e..0000000 --- a/ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch +++ /dev/null @@ -1,32 +0,0 @@ -From d7e62a8499c4032d79e05afbd8fd3efd51c5b148 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Eivind=20N=C3=A6ss?= -Date: Thu, 3 Feb 2022 14:28:22 -0800 -Subject: [PATCH] pppd/eap: Fix bug causing incorrect response length (#334) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Need to update the esp->ea_client.ea_namelen variable. A plugin can override the -name of the user, and the variable is passed onto the eap_chap2_response generating -the wrong response length. - -Signed-off-by: Eivind Næss ---- - pppd/eap.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/pppd/eap.c b/pppd/eap.c -index 54c3d42..6cb595f 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -2182,6 +2182,7 @@ eap_request(eap_state *esp, u_char *inp, int id, int len) - eap_send_nak(esp, id, EAPT_SRP); - break; - } -+ esp->es_client.ea_namelen = strlen(esp->es_client.ea_name); - - /* Create the MSCHAPv2 response (and add to cache) */ - unsigned char response[MS_CHAP2_RESPONSE_LEN+1]; // VLEN + VALUE --- -2.34.1 - diff --git a/ppp-2.5.0-use-change-resolv-function.patch b/ppp-2.5.0-use-change-resolv-function.patch new file mode 100644 index 0000000..30a07fe --- /dev/null +++ b/ppp-2.5.0-use-change-resolv-function.patch @@ -0,0 +1,51 @@ +diff --git a/scripts/ip-down.local.add b/scripts/ip-down.local.add +index b93590e..8889cb6 100644 +--- a/scripts/ip-down.local.add ++++ b/scripts/ip-down.local.add +@@ -9,12 +9,13 @@ + # + # Nick Walker (nickwalker@email.com) + # ++. /etc/sysconfig/network-scripts/network-functions + + if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then + if [ -f /etc/ppp/resolv.prev ]; then +- cp -f /etc/ppp/resolv.prev /etc/resolv.conf ++ change_resolv_conf /etc/ppp/resolv.prev + else +- rm -f /etc/resolv.conf ++ change_resolv_conf + fi + fi + +diff --git a/scripts/ip-up.local.add b/scripts/ip-up.local.add +index 8017209..5ced496 100644 +--- a/scripts/ip-up.local.add ++++ b/scripts/ip-up.local.add +@@ -9,16 +9,22 @@ + # + # Nick Walker (nickwalker@email.com) + # ++. /etc/sysconfig/network-scripts/network-functions + + if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then + rm -f /etc/ppp/resolv.prev + if [ -f /etc/resolv.conf ]; then + cp /etc/resolv.conf /etc/ppp/resolv.prev +- grep domain /etc/ppp/resolv.prev > /etc/resolv.conf +- grep search /etc/ppp/resolv.prev >> /etc/resolv.conf +- cat /etc/ppp/resolv.conf >> /etc/resolv.conf ++ rscf=/etc/ppp/resolv.new ++ grep domain /etc/ppp/resolv.prev > $rscf ++ grep search /etc/ppp/resolv.prev >> $rscf ++ if [ -f /etc/ppp/resolv.conf ]; then ++ cat /etc/ppp/resolv.conf >> $rscf ++ fi ++ change_resolv_conf $rscf ++ rm -f $rscf + else +- cp /etc/ppp/resolv.conf /etc ++ change_resolv_conf /etc/ppp/resolv.conf + fi + fi + diff --git a/ppp.spec b/ppp.spec index de8598c..a9d6d51 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ppp -Version: 2.4.9 -Release: 9%{?dist} +Version: 2.5.0 +Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -22,34 +22,25 @@ Source11: ifdown-ppp Source12: ppp-watch.tar.xz # Fedora-specific -Patch0002: ppp-2.4.9-config.patch -Patch0004: 0004-doc-add-configuration-samples.patch -Patch0005: ppp-2.4.9-build-sys-don-t-hardcode-LIBDIR-but-set-it-according.patch -Patch0006: 0006-scritps-use-change_resolv_conf-function.patch -Patch0011: 0011-build-sys-don-t-put-connect-errors-log-to-etc-ppp.patch -Patch0012: ppp-2.4.8-pppd-we-don-t-want-to-accidentally-leak-fds.patch -Patch0013: ppp-2.4.9-everywhere-O_CLOEXEC-harder.patch -Patch0014: 0014-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch -Patch0015: 0015-pppd-move-pppd-database-to-var-run-ppp.patch -Patch0016: 0016-rp-pppoe-add-manpage-for-pppoe-discovery.patch -Patch0018: 0018-scritps-fix-ip-up.local-sample.patch -Patch0023: 0023-build-sys-install-rp-pppoe-plugin-files-with-standar.patch -Patch0024: 0024-build-sys-install-pppoatm-plugin-files-with-standard.patch -Patch0025: ppp-2.4.8-pppd-install-pppd-binary-using-standard-perms-755.patch -Patch0026: ppp-2.4.9-configure-cflags-allow-commas.patch -# https://github.com/ppp-project/ppp/commit/d7e62a8499c4032d79e05afbd8fd3efd51c5b148 -Patch0027: ppp-2.4.9-pppd-eap-Fix-bug-causing-incorrect-response-length-3.patch -# https://github.com/ppp-project/ppp/commit/e609ed8bb62e4648568eaa49fbbc858dfda6d122 -Patch0028: ppp-2.4.9-pppd-Fix-logical-error-in-comparing-valid-encryption.patch -# https://github.com/ppp-project/ppp/pull/267/commits/6bfe06b9428a60eb637d5450d65dd3932fe5a83f -Patch0029: ppp-2.4.9-pppd-Expose-the-MPPE-keys-generated-through-an-API-2.patch +Patch0: ppp-2.5.0-use-change-resolv-function.patch +BuildRequires: libtool +BuildRequires: autoconf +BuildRequires: automake BuildRequires: make BuildRequires: gcc -BuildRequires: pam-devel, libpcap-devel, systemd, systemd-devel, glib2-devel +BuildRequires: pam-devel +BuildRequires: libpcap-devel +BuildRequires: systemd +BuildRequires: systemd-devel +BuildRequires: glib2-devel BuildRequires: openssl-devel +BuildRequires: linux-atm-libs-devel -Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd +Requires: glibc >= 2.0.6 +Requires: /etc/pam.d/system-auth +Requires: libpcap >= 14:0.8.3-6 +Requires: systemd Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd @@ -72,6 +63,7 @@ service. %package devel Summary: Headers for ppp plugin development Requires: %{name}%{?_isa} = %{version}-%{release} +Requires: pkgconf-pkg-config %description devel This package contains the header files for building plugins for ppp. @@ -82,12 +74,14 @@ This package contains the header files for building plugins for ppp. tar -xJf %{SOURCE12} %build -%configure --cflags="$RPM_OPT_FLAGS -fPIC -Wall -fno-strict-aliasing" -%{make_build} LDFLAGS="%{?build_ldflags} -pie" -%{make_build} -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" +autoreconf -fi +export CFLAGS="%{build_cflags} -fno-strict-aliasing" +%configure --enable-systemd --enable-cbcp --with-pam +%make_build +%make_build -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" %install -make INSTROOT=%{buildroot} install install-etcppp +%make_install find scripts -type f | xargs chmod a-x make ROOT=%{buildroot} -C ppp-watch install @@ -143,6 +137,7 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_sysconfdir}/ppp/ip-down.ipv6to4 %{_sysconfdir}/ppp/ipv6-up %{_sysconfdir}/ppp/ipv6-down +%{_sysconfdir}/ppp/openssl.cnf %{_mandir}/man8/chat.8* %{_mandir}/man8/pppd.8* %{_mandir}/man8/pppdump.8* @@ -171,8 +166,13 @@ mkdir -p %{buildroot}%{_rundir}/ppp %files devel %{_includedir}/pppd %doc PLUGINS +%{_libdir}/pkgconfig/pppd.pc %changelog +* Thu Apr 13 2023 Jaroslav Škarvada - 2.5.0-1 +- New version + Resolves: rhbz#2184291 + * Fri Jan 20 2023 Fedora Release Engineering - 2.4.9-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index db4f244..010a7fe 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ +SHA512 (ppp-2.5.0.tar.gz) = cf62410a952053f9aa71c5179453831152e958fcad9e77df2ddac864e39aa71af0b746e54b91e8fa3ad6295d6d2b1bb736e36dc05521b495f573468679133324 SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a -SHA512 (ppp-2.4.9.tar.gz) = c309f8f69f534c05547cd2f66dade0e0f198ea4c2928a7e899e660280786b3e965437a67b8c5bb81c59d0fa1818b4eb7b701d2dce015a420d380422d2bca4e1a From c9eaeba92be28024abdba9cfb2c5f3173bcc41c7 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Tue, 18 Apr 2023 14:39:21 -0700 Subject: [PATCH 48/76] Add comment to rebuild NetworkManager when bumping version --- ppp.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ppp.spec b/ppp.spec index a9d6d51..9e2118f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,6 +1,9 @@ %global _hardened_build 1 Name: ppp +# When bumping the ppp version, please be sure to rebuild +# NetworkManager against the new version - NetworkManager-ppp has a +# dep that is tied to the ppp version and generated at build time Version: 2.5.0 Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon From a5e362e976cd9461efc26d9f1b17b8f2ed2b56d6 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Wed, 19 Apr 2023 01:06:49 -0700 Subject: [PATCH 49/76] Update version bump comment --- ppp.spec | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/ppp.spec b/ppp.spec index 9e2118f..2963f36 100644 --- a/ppp.spec +++ b/ppp.spec @@ -1,9 +1,22 @@ %global _hardened_build 1 Name: ppp -# When bumping the ppp version, please be sure to rebuild -# NetworkManager against the new version - NetworkManager-ppp has a -# dep that is tied to the ppp version and generated at build time +# Please be careful when bumping the ppp version. Several packages +# have version-tied dependencies on it, including NetworkManager-ppp +# (from NetworkManager) and NetworkManager-pptp , which are core +# packages. They may need code changes to build against new ppp +# versions. Please only bump ppp on a side tag and ensure it also +# contains rebuilds of at least those two packages before merging. +# Several other less important packages are also tied to the ppp +# version, as of 2023-04-19 the list is: +# NetworkManager-fortisslvpn +# NetworkManager-l2tp +# NetworkManager-ppp +# NetworkManager-pptp +# NetworkManager-sstp +# sstp-client +# These all need to be patched (if necessary) and rebuilt for new +# versions of ppp. Version: 2.5.0 Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon From f8b675a1a6518d892b0cf46a45bd967743ce8e3e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 06:11:55 +0000 Subject: [PATCH 50/76] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 2963f36..615882c 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -185,6 +185,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 2.5.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Thu Apr 13 2023 Jaroslav Škarvada - 2.5.0-1 - New version Resolves: rhbz#2184291 From 0104c74bb68e007d4084aea8a2ec39d5c2f88ab4 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 24 Jul 2023 22:58:25 -0400 Subject: [PATCH 51/76] Use bundled ATM in RHEL builds If a system libatm is not found, the bundled version will be used as in previous versions. The bundled version was imported from 2.4.1 (based on date) but have not changed since. This avoids the need to support the entire linux-atm package in RHEL just for the pppoatm plugin. --- ppp.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 615882c..b2d6d21 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -51,7 +51,11 @@ BuildRequires: systemd BuildRequires: systemd-devel BuildRequires: glib2-devel BuildRequires: openssl-devel +%if %{defined rhel} +Provides: bundled(linux-atm) = 2.4.1 +%else BuildRequires: linux-atm-libs-devel +%endif Requires: glibc >= 2.0.6 Requires: /etc/pam.d/system-auth @@ -185,6 +189,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Tue Jul 25 2023 Yaakov Selkowitz - 2.5.0-3 +- Use bundled ATM in RHEL builds + * Fri Jul 21 2023 Fedora Release Engineering - 2.5.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 3e399582f0c3d72734e14b93870524c0e35d7d35 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 22:16:49 +0000 Subject: [PATCH 52/76] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index b2d6d21..cc14a39 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: The Point-to-Point Protocol daemon License: BSD and LGPLv2+ and GPLv2+ and Public Domain URL: http://www.samba.org/ppp @@ -189,6 +189,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 2.5.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Tue Jul 25 2023 Yaakov Selkowitz - 2.5.0-3 - Use bundled ATM in RHEL builds From 609188a4a4546d9663ef7e49ed823a1cd0c01bf6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 24 Jan 2024 16:31:03 +0100 Subject: [PATCH 53/76] Converted license to SPDX --- ppp.spec | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/ppp.spec b/ppp.spec index cc14a39..62ef388 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,9 +18,17 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: The Point-to-Point Protocol daemon -License: BSD and LGPLv2+ and GPLv2+ and Public Domain +# Add licenses: +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/441 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/442 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/443 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/444 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/445 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/446 +# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/447 +License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later URL: http://www.samba.org/ppp Source0: https://github.com/paulusmack/ppp/archive/ppp-%{version}.tar.gz @@ -189,6 +197,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Wed Jan 24 2024 Jaroslav Škarvada - 2.5.0-5 +- Converted license to SPDX + * Sun Jan 21 2024 Fedora Release Engineering - 2.5.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 93a27465a6939919e74245d56af6fd9083044bf6 Mon Sep 17 00:00:00 2001 From: Yanko Kaneti Date: Thu, 1 Feb 2024 15:02:25 +0200 Subject: [PATCH 54/76] Adapt ipv6-{up,down} to initscripts-less world Phase out use of initscripts for ipv6 if not installed --- ipv6-down | 58 +------------------------ ipv6-down.initscripts | 56 ++++++++++++++++++++++++ ipv6-up | 99 +------------------------------------------ ipv6-up.initscripts | 99 +++++++++++++++++++++++++++++++++++++++++++ ppp.spec | 6 +++ 5 files changed, 163 insertions(+), 155 deletions(-) create mode 100644 ipv6-down.initscripts create mode 100644 ipv6-up.initscripts diff --git a/ipv6-down b/ipv6-down index b290585..36e0c5f 100644 --- a/ipv6-down +++ b/ipv6-down @@ -6,65 +6,9 @@ # # This file should not be modified -- make local changes to # /etc/ppp/ipv6-down.local instead -# -# -# Taken from: -# (P) & (C) 2001-2006 by Peter Bieringer -# -# You will find more information on the initscripts-ipv6 homepage at -# http://www.deepspace6.net/projects/initscripts-ipv6.html -# -# RHL integration assistance by Pekka Savola -# -# Calling parameters: -# $1: interface name -# $6: logical interface name (set by pppd option ipparam) -# -# Version 2006-08-02 -# -# Uses following information from /etc/sysconfig/network-scripts/ifcfg-$1: -# IPV6INIT=yes|no: controls IPv6 configuration for this interface -# - -PATH=/sbin:/usr/sbin:/bin:/usr/bin -export PATH - -LOGDEVICE=$6 -REALDEVICE=$1 - -[ -f /etc/sysconfig/network ] || exit 0 -. /etc/sysconfig/network - -cd /etc/sysconfig/network-scripts -. ./network-functions - -CONFIG=$LOGDEVICE -[ -f "$CONFIG" ] || CONFIG=ifcfg-$CONFIG -source_config - -[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] || exit 1 -. /etc/sysconfig/network-scripts/network-functions-ipv6 +[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] && /etc/ppp/ipv6-down.initscripts "$@" [ -x /etc/ppp/ipv6-down.local ] && /etc/ppp/ipv6-down.local "$@" - -if [ "$IPV6_CONTROL_RADVD" = "yes" ]; then - # Control running radvd - ipv6_trigger_radvd down "$IPV6_RADVD_TRIGGER_ACTION" $IPV6_RADVD_PIDFILE -fi - -# IPv6 test, no module loaded, exit if system is not IPv6-ready -ipv6_test testonly || exit 0 - -# Test device status -ipv6_test_device_status $REALDEVICE -if [ $? != 0 -a $? != 11 ]; then - # device doesn't exist or other problem occurs - exit 1 -fi - -# Delete all current configured IPv6 addresses on this interface -ipv6_cleanup_device $REALDEVICE - exit 0 diff --git a/ipv6-down.initscripts b/ipv6-down.initscripts new file mode 100644 index 0000000..c8f228f --- /dev/null +++ b/ipv6-down.initscripts @@ -0,0 +1,56 @@ +#!/bin/sh +# +# +# Taken from: +# (P) & (C) 2001-2006 by Peter Bieringer +# +# You will find more information on the initscripts-ipv6 homepage at +# http://www.deepspace6.net/projects/initscripts-ipv6.html +# +# RHL integration assistance by Pekka Savola +# +# Calling parameters: +# $1: interface name +# $6: logical interface name (set by pppd option ipparam) +# +# Version 2006-08-02 +# +# Uses following information from /etc/sysconfig/network-scripts/ifcfg-$1: +# IPV6INIT=yes|no: controls IPv6 configuration for this interface +# +PATH=/sbin:/usr/sbin:/bin:/usr/bin +export PATH + +LOGDEVICE=$6 +REALDEVICE=$1 + +[ -f /etc/sysconfig/network ] || exit 0 +. /etc/sysconfig/network + +cd /etc/sysconfig/network-scripts +. ./network-functions + +CONFIG=$LOGDEVICE +[ -f "$CONFIG" ] || CONFIG=ifcfg-$CONFIG +source_config + +[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] || exit 1 +. /etc/sysconfig/network-scripts/network-functions-ipv6 + +if [ "$IPV6_CONTROL_RADVD" = "yes" ]; then + # Control running radvd + ipv6_trigger_radvd down "$IPV6_RADVD_TRIGGER_ACTION" $IPV6_RADVD_PIDFILE +fi + +# IPv6 test, no module loaded, exit if system is not IPv6-ready +ipv6_test testonly || exit 0 + +# Test device status +ipv6_test_device_status $REALDEVICE +if [ $? != 0 -a $? != 11 ]; then + # device doesn't exist or other problem occurs + exit 1 +fi + +# Delete all current configured IPv6 addresses on this interface +ipv6_cleanup_device $REALDEVICE diff --git a/ipv6-up b/ipv6-up index 059afec..623631a 100644 --- a/ipv6-up +++ b/ipv6-up @@ -7,105 +7,8 @@ # This file should not be modified -- make local changes to # /etc/ppp/ipv6-up.local instead # -# Taken from: -# (P) & (C) 2001-2006 by Peter Bieringer -# -# You will find more information on the initscripts-ipv6 homepage at -# http://www.deepspace6.net/projects/initscripts-ipv6.html -# -# RHL integration assistance by Pekka Savola -# -# Calling parameters: -# $1: interface name -# $6: logical interface name (set by pppd option ipparam) -# -# -# Version: 2006-08-02 -# -# Uses following information from "/etc/sysconfig/network": -# IPV6_DEFAULTDEV=: controls default route (optional) -# -# Uses following information from "/etc/sysconfig/network-scripts/ifcfg-$1": -# IPV6INIT=yes|no: controls IPv6 configuration for this interface -# IPV6ADDR=[/]: specify primary static IPv6 address -# IPV6ADDR_SECONDARIES="[/] ..." (optional) -# IPV6_MTU=: controls IPv6 MTU for this link (optional) -# - -PATH=/sbin:/usr/sbin:/bin:/usr/bin -export PATH - -LOGDEVICE=$6 -REALDEVICE=$1 - -[ -f /etc/sysconfig/network ] || exit 0 -. /etc/sysconfig/network - -cd /etc/sysconfig/network-scripts -. ./network-functions -. ./network-functions-ipv6 - -CONFIG=$LOGDEVICE -[ -f "$CONFIG" ] || CONFIG=ifcfg-$CONFIG -source_config - -# Test whether IPv6 configuration is disabled for this interface -[[ "$IPV6INIT" = [nN0]* ]] && exit 0 - -[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] || exit 1 -. /etc/sysconfig/network-scripts/network-functions-ipv6 - -# IPv6 test, module loaded, exit if system is not IPv6-ready -ipv6_test || exit 1 - -# Test device status -ipv6_test_device_status $REALDEVICE -if [ $? != 0 -a $? != 11 ]; then - # device doesn't exist or other problem occurs - exit 1 -fi - -# Setup IPv6 address on specified interface -if [ -n "$IPV6ADDR" ]; then - ipv6_add_addr_on_device $REALDEVICE $IPV6ADDR || exit 1 -fi - -# Set IPv6 MTU, if given -if [ -n "$IPV6_MTU" ]; then - ipv6_set_mtu $REALDEVICE $IPV6_MTU -fi - -# Setup additional IPv6 addresses from list, if given -if [ -n "$IPV6ADDR_SECONDARIES" ]; then - for ipv6addr in $IPV6ADDR_SECONDARIES; do - ipv6_add_addr_on_device $REALDEVICE $ipv6addr - done -fi - -# Setup default IPv6 route through device -if [ "$IPV6_DEFAULTDEV" = "$LOGDEVICE" ]; then - ipv6_set_default_route "" "$REALDEVICE" "$REALDEVICE" -fi - -# Setup additional static IPv6 routes on specified interface, if given -if [ -f /etc/sysconfig/static-routes-ipv6 ]; then - LC_ALL=C grep -w "^$LOGDEVICE" /etc/sysconfig/static-routes-ipv6 | while read device args; do - ipv6_add_route $args $REALDEVICE - done -fi - -# Setup additional static IPv6 routes (newer config style) -if [ -f "/etc/sysconfig/network-scripts/route6-$DEVICE" ]; then - sed -ne 's/#.*//' -e '/[^[:space:]]/p' "/etc/sysconfig/network-scripts/route6-$DEVICE" | while read line; do - /sbin/ip -6 route add $line - done -fi - -if [ "$IPV6_CONTROL_RADVD" = "yes" ]; then - # Control running radvd - ipv6_trigger_radvd up "$IPV6_RADVD_TRIGGER_ACTION" $IPV6_RADVD_PIDFILE -fi +[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] && /etc/ppp/ipv6-up.initscripts "$@" [ -x /etc/ppp/ipv6-up.local ] && /etc/ppp/ipv6-up.local "$@" diff --git a/ipv6-up.initscripts b/ipv6-up.initscripts new file mode 100644 index 0000000..98d6d63 --- /dev/null +++ b/ipv6-up.initscripts @@ -0,0 +1,99 @@ +#!/bin/sh +# Taken from: +# (P) & (C) 2001-2006 by Peter Bieringer +# +# You will find more information on the initscripts-ipv6 homepage at +# http://www.deepspace6.net/projects/initscripts-ipv6.html +# +# RHL integration assistance by Pekka Savola +# +# Calling parameters: +# $1: interface name +# $6: logical interface name (set by pppd option ipparam) +# +# +# Version: 2006-08-02 +# +# Uses following information from "/etc/sysconfig/network": +# IPV6_DEFAULTDEV=: controls default route (optional) +# +# Uses following information from "/etc/sysconfig/network-scripts/ifcfg-$1": +# IPV6INIT=yes|no: controls IPv6 configuration for this interface +# IPV6ADDR=[/]: specify primary static IPv6 address +# IPV6ADDR_SECONDARIES="[/] ..." (optional) +# IPV6_MTU=: controls IPv6 MTU for this link (optional) +# + +PATH=/sbin:/usr/sbin:/bin:/usr/bin +export PATH + +LOGDEVICE=$6 +REALDEVICE=$1 + +[ -f /etc/sysconfig/network ] || exit 0 +. /etc/sysconfig/network + +cd /etc/sysconfig/network-scripts +. ./network-functions +. ./network-functions-ipv6 + +CONFIG=$LOGDEVICE +[ -f "$CONFIG" ] || CONFIG=ifcfg-$CONFIG +source_config + +# Test whether IPv6 configuration is disabled for this interface +[[ "$IPV6INIT" = [nN0]* ]] && exit 0 + +[ -f /etc/sysconfig/network-scripts/network-functions-ipv6 ] || exit 1 +. /etc/sysconfig/network-scripts/network-functions-ipv6 + +# IPv6 test, module loaded, exit if system is not IPv6-ready +ipv6_test || exit 1 + +# Test device status +ipv6_test_device_status $REALDEVICE +if [ $? != 0 -a $? != 11 ]; then + # device doesn't exist or other problem occurs + exit 1 +fi + +# Setup IPv6 address on specified interface +if [ -n "$IPV6ADDR" ]; then + ipv6_add_addr_on_device $REALDEVICE $IPV6ADDR || exit 1 +fi + +# Set IPv6 MTU, if given +if [ -n "$IPV6_MTU" ]; then + ipv6_set_mtu $REALDEVICE $IPV6_MTU +fi + +# Setup additional IPv6 addresses from list, if given +if [ -n "$IPV6ADDR_SECONDARIES" ]; then + for ipv6addr in $IPV6ADDR_SECONDARIES; do + ipv6_add_addr_on_device $REALDEVICE $ipv6addr + done +fi + +# Setup default IPv6 route through device +if [ "$IPV6_DEFAULTDEV" = "$LOGDEVICE" ]; then + ipv6_set_default_route "" "$REALDEVICE" "$REALDEVICE" +fi + +# Setup additional static IPv6 routes on specified interface, if given +if [ -f /etc/sysconfig/static-routes-ipv6 ]; then + LC_ALL=C grep -w "^$LOGDEVICE" /etc/sysconfig/static-routes-ipv6 | while read device args; do + ipv6_add_route $args $REALDEVICE + done +fi + +# Setup additional static IPv6 routes (newer config style) +if [ -f "/etc/sysconfig/network-scripts/route6-$DEVICE" ]; then + sed -ne 's/#.*//' -e '/[^[:space:]]/p' "/etc/sysconfig/network-scripts/route6-$DEVICE" | while read line; do + /sbin/ip -6 route add $line + done +fi + +if [ "$IPV6_CONTROL_RADVD" = "yes" ]; then + # Control running radvd + ipv6_trigger_radvd up "$IPV6_RADVD_TRIGGER_ACTION" $IPV6_RADVD_PIDFILE +fi diff --git a/ppp.spec b/ppp.spec index 62ef388..38a8cad 100644 --- a/ppp.spec +++ b/ppp.spec @@ -44,6 +44,8 @@ Source9: ipv6-up Source10: ifup-ppp Source11: ifdown-ppp Source12: ppp-watch.tar.xz +Source13: ipv6-up.initscripts +Source14: ipv6-down.initscripts # Fedora-specific Patch0: ppp-2.5.0-use-change-resolv-function.patch @@ -136,6 +138,8 @@ install -p %{SOURCE6} %{buildroot}%{_sysconfdir}/ppp/ip-up install -p %{SOURCE7} %{buildroot}%{_sysconfdir}/ppp/ip-up.ipv6to4 install -p %{SOURCE8} %{buildroot}%{_sysconfdir}/ppp/ipv6-down install -p %{SOURCE9} %{buildroot}%{_sysconfdir}/ppp/ipv6-up +install -p %{SOURCE13} %{buildroot}%{_sysconfdir}/ppp/ipv6-down.initscripts +install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts install -d %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ install -p %{SOURCE10} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp @@ -164,7 +168,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_sysconfdir}/ppp/ip-up.ipv6to4 %{_sysconfdir}/ppp/ip-down.ipv6to4 %{_sysconfdir}/ppp/ipv6-up +%{_sysconfdir}/ppp/ipv6-up.initscripts %{_sysconfdir}/ppp/ipv6-down +%{_sysconfdir}/ppp/ipv6-down.initscripts %{_sysconfdir}/ppp/openssl.cnf %{_mandir}/man8/chat.8* %{_mandir}/man8/pppd.8* From 0f6bdc6ffe49833580f2c43ba308d11cf2d4db9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 14 Feb 2024 18:03:17 +0100 Subject: [PATCH 55/76] Dropped network scripts Resolves: rhbz#2262981 --- ifdown-ppp | 51 ----------------- ifup-ppp | 157 ----------------------------------------------------- ppp.spec | 25 ++------- 3 files changed, 5 insertions(+), 228 deletions(-) delete mode 100755 ifdown-ppp delete mode 100755 ifup-ppp diff --git a/ifdown-ppp b/ifdown-ppp deleted file mode 100755 index fca6463..0000000 --- a/ifdown-ppp +++ /dev/null @@ -1,51 +0,0 @@ -#! /bin/bash - -cd /etc/sysconfig/network-scripts -. ./network-functions - -CONFIG=$1 -source_config - -if [ "$TYPE" = "xDSL" ] && [ -x /usr/sbin/adsl-stop ] ; then - adsl-stop /etc/sysconfig/network-scripts/$CONFIG - exit $? -fi - -CONFIG=${CONFIG##ifcfg-} - -if [ "${DEMAND}" = "yes" ] && [ -f /var/run/ppp-${CONFIG}.pid ] ; then - PID=$(head -1 /var/run/ppp-${CONFIG}.pid) - kill -TERM ${PID} - sleep 2 - [ ! -d /proc/${PID} ] && exit 0 - sleep 5 - [ ! -d /proc/${PID} ] && exit 0 - kill -TERM ${PID} - [ ! -d /proc/${PID} ] && exit 0 - exit 1 -fi - -file=/var/run/pppwatch-${DEVICE}.pid - -if [ ! -f $file ]; then - # ppp isn't running, or we didn't start it - exit 0 -fi - -PID=$(cat $file) -[ -n "${PID}" ] || exit 1 - -kill -TERM ${PID} > /dev/null 2>&1 -[ ! -d /proc/${PID} ] && exit 0 -sleep 2 -[ ! -d /proc/${PID} ] && exit 0 -sleep 5 -[ ! -d /proc/${PID} ] && exit 0 -sleep 10 -[ ! -d /proc/${PID} ] && exit 0 - -# killing ppp-watch twice in a row causes it to send a SIGKILL to pppd pgrp -kill -TERM ${PID} > /dev/null 2>&1 -[ ! -d /proc/${PID} ] && exit 0 - -exit 1 diff --git a/ifup-ppp b/ifup-ppp deleted file mode 100755 index fb30639..0000000 --- a/ifup-ppp +++ /dev/null @@ -1,157 +0,0 @@ -#! /bin/bash - -. /etc/init.d/functions - -cd /etc/sysconfig/network-scripts -. ./network-functions - -# ifup-post for PPP is handled through /etc/ppp/ip-up -if [ "${1}" = daemon ] ; then - # we've been called from ppp-watch, so don't invoke it for persistence - shift -else - # just in case a full path to the configuration file is passed in - CONFIG=${1##*/} # CONFIG=$(basename $1) - [ -f "${CONFIG}" ] || CONFIG=ifcfg-${1} - source_config - # don't start ppp-watch by xDSL - if [ "${DEMAND}" != yes -a "$TYPE" != "xDSL" ] ; then - # let ppp-watch do the right thing - exec /sbin/ppp-watch "${CONFIG##ifcfg-}" "$2" - fi -fi - -CONFIG=$1 -[ -f "${CONFIG}" ] || CONFIG=ifcfg-${1} -source_config - -if [ -z "${DISCONNECTTIMEOUT}" ]; then - DISCONNECTTIMEOUT=2 -fi - -if [ -z "${RETRYTIMEOUT}" ]; then - RETRYTIMEOUT=30 -fi - -if [ -z "${IDLETIMEOUT}" ]; then - IDLETIMEOUT=600 -fi - -if [ "${2}" = "boot" -a "${ONBOOT}" = "no" ]; then - exit -fi - -[ -x /usr/sbin/pppd ] || { - echo $"pppd does not exist or is not executable" - echo $"ifup-ppp for ${DEVICE} exiting" - /usr/bin/logger -p daemon.info -t ifup-ppp \ - $"pppd does not exist or is not executable for ${DEVICE}" - exit 1 -} - -# check that xDSL connection -if [ "$TYPE" = "xDSL" ] ; then - if [ -x /usr/sbin/adsl-start ] ; then - adsl-start /etc/sysconfig/network-scripts/$CONFIG - exit $? - else - /usr/bin/logger -p daemon.info -t ifup-ppp \ - $"adsl-start does not exist or is not executable for ${DEVICE}" - exit 1 - fi -fi - -PEERCONF=/etc/ppp/peers/${DEVNAME} - -if [ "${DEBUG}" = "yes" ]; then - CHATDBG="-v" -fi - -if [ ! -f ${PEERCONF} ]; then - if [ -z "${WVDIALSECT}" ] ; then - CHATSCRIPT=/etc/sysconfig/network-scripts/chat-${DEVNAME} - [ -f ${CHATSCRIPT} ] || { - echo $"/etc/sysconfig/network-scripts/chat-${DEVNAME} does not exist" - echo $"ifup-ppp for ${DEVNAME} exiting" - /usr/bin/logger -p daemon.info -t ifup-ppp \ - $"/etc/sysconfig/network-scripts/chat-${DEVNAME} does not exist for ${DEVICE}" - exit 1 - } - fi - /usr/bin/logger -s -p daemon.notice -t ifup-ppp \ - $"Setting up a new ${PEERCONF} config file" - if [ -f /etc/ppp/peers/${DEVICE} ]; then - cp -f /etc/ppp/peers/${DEVICE} ${PEERCONF} - else - touch ${PEERCONF} - fi - if [ "${WVDIALSECT}" ]; then - echo "connect \"/usr/bin/wvdial --remotename ${DEVNAME} --chat '${WVDIALSECT}'\"" >> ${PEERCONF} - else - echo "connect \"/usr/sbin/chat ${CHATDBG} -f ${CHATSCRIPT}\"" >> ${PEERCONF} - fi -fi - -opts="lock" -if [ "${HARDFLOWCTL}" != no ] ; then - opts="$opts modem crtscts" -fi -if [ "${ESCAPECHARS}" != yes ] ; then - opts="$opts asyncmap 00000000" -fi -if [ "${DEFROUTE}" != no ] ; then - # pppd will no longer delete an existing default route - # so we have to help it out a little here. - DEFRT=$(ip route list match 0.0.0.0/0) - [ -n "${DEFRT}" ] && echo "$DEFRT" > /etc/default-routes - echo "$DEFRT" | while read spec; do - ip route del $spec; - done - opts="$opts defaultroute" -fi -if [ "${PEERDNS}" != no ] ; then - cp -f /etc/resolv.conf /etc/resolv.conf.save - opts="$opts usepeerdns" -fi -if [ -n "${MRU}" ] ; then - opts="$opts mru ${MRU}" -fi -if [ -n "${MTU}" ] ; then - opts="$opts mtu ${MTU}" -fi -if [ -n "${IPADDR}${REMIP}" ] ; then - # if either IP address is set, the following will work. - opts="$opts ${IPADDR}:${REMIP}" -fi -if [ -n "${PAPNAME}" ] ; then - opts="$opts user ${PAPNAME} remotename ${DEVNAME}" -fi -if [ "${DEBUG}" = yes ] ; then - opts="$opts debug" -fi - -if [ ${DEMAND} = yes ] ; then - opts="$opts demand ktune idle ${IDLETIMEOUT} holdoff ${RETRYTIMEOUT}" - exec= -else - opts="$opts nodetach" - exec=exec -fi - -/usr/bin/logger -p daemon.info -t ifup-ppp \ - $"pppd started for ${DEVNAME} on ${MODEMPORT} at ${LINESPEED}" - -$exec pppd $opts ${MODEMPORT} ${LINESPEED} \ - ipparam ${DEVNAME} linkname ${DEVNAME} call ${DEVNAME}\ - noauth \ - ${PPPOPTIONS} || exit - -if [ "${DEMAND}" = "yes" ] ; then - # pppd is a tad slow to write the pid-file. - sleep 2 - if [ -f /var/run/ppp-${DEVNAME}.pid ] ; then - REALDEVICE=$(tail -1 /var/run/ppp-${DEVNAME}.pid) - /etc/sysconfig/network-scripts/ifup-routes ${REALDEVICE} ${DEVNAME} - fi -fi - diff --git a/ppp.spec b/ppp.spec index 38a8cad..a8dbf03 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: The Point-to-Point Protocol daemon # Add licenses: # https://gitlab.com/fedora/legal/fedora-license-data/-/issues/441 @@ -41,8 +41,6 @@ Source6: ip-up Source7: ip-up.ipv6to4 Source8: ipv6-down Source9: ipv6-up -Source10: ifup-ppp -Source11: ifdown-ppp Source12: ppp-watch.tar.xz Source13: ipv6-up.initscripts Source14: ipv6-down.initscripts @@ -81,15 +79,6 @@ transmitting datagrams over serial point-to-point links. PPP is usually used to dial in to an ISP (Internet Service Provider) or other organization over a modem and phone line. -%package -n network-scripts-%{name} -Summary: PPP legacy network service support -Requires: network-scripts -Supplements: (%{name} and network-scripts) - -%description -n network-scripts-%{name} -This provides the ifup and ifdown scripts for use with the legacy network -service. - %package devel Summary: Headers for ppp plugin development Requires: %{name}%{?_isa} = %{version}-%{release} @@ -141,10 +130,6 @@ install -p %{SOURCE9} %{buildroot}%{_sysconfdir}/ppp/ipv6-up install -p %{SOURCE13} %{buildroot}%{_sysconfdir}/ppp/ipv6-down.initscripts install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts -install -d %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ -install -p %{SOURCE10} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp -install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts/ifdown-ppp - # ghosts mkdir -p %{buildroot}%{_rundir}/ppp @@ -193,16 +178,16 @@ mkdir -p %{buildroot}%{_rundir}/ppp %config(noreplace) %{_sysconfdir}/logrotate.d/ppp %{_tmpfilesdir}/ppp.conf -%files -n network-scripts-%{name} -%{_sysconfdir}/sysconfig/network-scripts/ifdown-ppp -%{_sysconfdir}/sysconfig/network-scripts/ifup-ppp - %files devel %{_includedir}/pppd %doc PLUGINS %{_libdir}/pkgconfig/pppd.pc %changelog +* Tue Feb 13 2024 Jaroslav Škarvada - 2.5.0-6 +- Dropped network scripts + Resolves: rhbz#2262981 + * Wed Jan 24 2024 Jaroslav Škarvada - 2.5.0-5 - Converted license to SPDX From d6144dfaf9061ff160d88310c81bbc51c6be7401 Mon Sep 17 00:00:00 2001 From: Kalev Lember Date: Wed, 21 Feb 2024 11:52:37 +0100 Subject: [PATCH 56/76] Obsolete dropped network-scripts-ppp subpackage --- ppp.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index a8dbf03..97e7889 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: The Point-to-Point Protocol daemon # Add licenses: # https://gitlab.com/fedora/legal/fedora-license-data/-/issues/441 @@ -72,6 +72,9 @@ Requires: systemd Requires(pre): /usr/bin/getent Requires(pre): /usr/sbin/groupadd +# Subpackage removed and obsoleted in F40 +Obsoletes: network-scripts-ppp < %{version}-%{release} + %description The ppp package contains the PPP (Point-to-Point Protocol) daemon and documentation for PPP support. The PPP protocol provides a method for @@ -184,6 +187,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Wed Feb 21 2024 Kalev Lember - 2.5.0-7 +- Obsolete dropped network-scripts-ppp subpackage + * Tue Feb 13 2024 Jaroslav Škarvada - 2.5.0-6 - Dropped network scripts Resolves: rhbz#2262981 From 443df8f965e04c4bf52eaa21280cdbd08d58ffe0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Tue, 9 Apr 2024 16:02:23 +0200 Subject: [PATCH 57/76] Added some missing SPDX licenses MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp.spec | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/ppp.spec b/ppp.spec index 97e7889..b42b2d2 100644 --- a/ppp.spec +++ b/ppp.spec @@ -21,14 +21,8 @@ Version: 2.5.0 Release: 7%{?dist} Summary: The Point-to-Point Protocol daemon # Add licenses: -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/441 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/442 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/443 # https://gitlab.com/fedora/legal/fedora-license-data/-/issues/444 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/445 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/446 -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/447 -License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later +License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag URL: http://www.samba.org/ppp Source0: https://github.com/paulusmack/ppp/archive/ppp-%{version}.tar.gz From 80279e6e879c7c06ac43a8be6409c78a6c42381e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sun, 14 Apr 2024 21:57:15 +0200 Subject: [PATCH 58/76] Added missing and recently approved SPDX licenses --- ppp.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ppp.spec b/ppp.spec index b42b2d2..a87b136 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,11 +18,9 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: The Point-to-Point Protocol daemon -# Add licenses: -# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/444 -License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag +License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp Source0: https://github.com/paulusmack/ppp/archive/ppp-%{version}.tar.gz @@ -181,6 +179,9 @@ mkdir -p %{buildroot}%{_rundir}/ppp %{_libdir}/pkgconfig/pppd.pc %changelog +* Sun Apr 14 2024 Jaroslav Škarvada - 2.5.0-8 +- Added missing and recently approved SPDX licenses + * Wed Feb 21 2024 Kalev Lember - 2.5.0-7 - Obsolete dropped network-scripts-ppp subpackage From e8892074678e5386d7046d604387a6894168e6e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 11 Apr 2024 20:12:15 +0200 Subject: [PATCH 59/76] Fix installation when %_sbindir==%_bindir --- ppp.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ppp.spec b/ppp.spec index a87b136..40b46d6 100644 --- a/ppp.spec +++ b/ppp.spec @@ -128,6 +128,10 @@ install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts # ghosts mkdir -p %{buildroot}%{_rundir}/ppp +%if "%{_sbindir}" == "%{_bindir}" +mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ +%endif + %pre /usr/bin/getent group dip >/dev/null 2>&1 || /usr/sbin/groupadd -r -g 40 dip >/dev/null 2>&1 || : From eea1551e441d12519057055422f3020936220a75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Thu, 9 May 2024 18:09:49 +0200 Subject: [PATCH 60/76] Pre-created upstream default lock dir --- ppp-tmpfiles.conf | 2 +- ppp.spec | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/ppp-tmpfiles.conf b/ppp-tmpfiles.conf index 1097cbe..a48a271 100644 --- a/ppp-tmpfiles.conf +++ b/ppp-tmpfiles.conf @@ -1 +1 @@ -d /run/ppp 0755 root root +d /run/pppd/lock 0755 root root diff --git a/ppp.spec b/ppp.spec index 40b46d6..79874ba 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 8%{?dist} +Release: 9%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -126,7 +126,7 @@ install -p %{SOURCE13} %{buildroot}%{_sysconfdir}/ppp/ipv6-down.initscripts install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts # ghosts -mkdir -p %{buildroot}%{_rundir}/ppp +mkdir -p %{buildroot}%{_rundir}/pppd/lock %if "%{_sbindir}" == "%{_bindir}" mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ @@ -165,7 +165,8 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_mandir}/man8/pppoe-discovery.8* %{_mandir}/man8/ppp-watch.8* %{_libdir}/pppd -%ghost %dir %{_rundir}/ppp +%ghost %dir %{_rundir}/pppd +%ghost %dir %{_rundir}/pppd/lock %dir %{_sysconfdir}/logrotate.d %attr(700, root, root) %dir %{_localstatedir}/log/ppp %config(noreplace) %{_sysconfdir}/ppp/eaptls-client @@ -183,6 +184,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Thu May 9 2024 Jaroslav Škarvada - 2.5.0-9 +- Pre-created upstream default lock dir + * Sun Apr 14 2024 Jaroslav Škarvada - 2.5.0-8 - Added missing and recently approved SPDX licenses From a9c63b097bd6453a15691fd238eef2b8f7c1052a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Wed, 12 Jun 2024 15:31:39 +0200 Subject: [PATCH 61/76] Openssl engine API is deprecated for a while thus disable it --- ppp.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ppp.spec b/ppp.spec index 79874ba..c7e633a 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 9%{?dist} +Release: 10%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -90,7 +90,7 @@ tar -xJf %{SOURCE12} %build autoreconf -fi export CFLAGS="%{build_cflags} -fno-strict-aliasing" -%configure --enable-systemd --enable-cbcp --with-pam +%configure --enable-systemd --enable-cbcp --with-pam --disable-openssl-engine %make_build %make_build -C ppp-watch LDFLAGS="%{?build_ldflags} -pie" @@ -184,6 +184,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Wed Jun 12 2024 Jaroslav Škarvada - 2.5.0-10 +- Openssl engine API is deprecated for a while thus disable it + * Thu May 9 2024 Jaroslav Škarvada - 2.5.0-9 - Pre-created upstream default lock dir From 6707aaf9b1f6d789a79fd9e91200cfd80eb0c658 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Mon, 24 Jun 2024 13:53:33 +0200 Subject: [PATCH 62/76] Fixed radiusclient parser --- ppp-2.5.0-radiusclient-parser-fix.patch | 49 +++++++++++++++++++++++++ ppp.spec | 8 +++- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 ppp-2.5.0-radiusclient-parser-fix.patch diff --git a/ppp-2.5.0-radiusclient-parser-fix.patch b/ppp-2.5.0-radiusclient-parser-fix.patch new file mode 100644 index 0000000..a898e25 --- /dev/null +++ b/ppp-2.5.0-radiusclient-parser-fix.patch @@ -0,0 +1,49 @@ +From 7f89208b860ea0c41636410bfdb6a609b2772f47 Mon Sep 17 00:00:00 2001 +From: Eivind Naess +Date: Sun, 23 Apr 2023 11:37:01 -0700 +Subject: [PATCH] Closes #411, Fixing up parsing in radiusclient.conf + +Adding curly braces to fix the code. + +Signed-off-by: Eivind Naess +--- + pppd/plugins/radius/config.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/pppd/plugins/radius/config.c b/pppd/plugins/radius/config.c +index 39744fca1..e1a481487 100644 +--- a/pppd/plugins/radius/config.c ++++ b/pppd/plugins/radius/config.c +@@ -235,24 +235,28 @@ int rc_read_config(char *filename) + + switch (option->type) { + case OT_STR: +- if (set_option_str(filename, line, option, p) < 0) ++ if (set_option_str(filename, line, option, p) < 0) { + fclose(configfd); + return (-1); ++ } + break; + case OT_INT: +- if (set_option_int(filename, line, option, p) < 0) ++ if (set_option_int(filename, line, option, p) < 0) { + fclose(configfd); + return (-1); ++ } + break; + case OT_SRV: +- if (set_option_srv(filename, line, option, p) < 0) ++ if (set_option_srv(filename, line, option, p) < 0) { + fclose(configfd); + return (-1); ++ } + break; + case OT_AUO: +- if (set_option_auo(filename, line, option, p) < 0) ++ if (set_option_auo(filename, line, option, p) < 0) { + fclose(configfd); + return (-1); ++ } + break; + default: + fatal("rc_read_config: impossible case branch!"); diff --git a/ppp.spec b/ppp.spec index c7e633a..bc111db 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 10%{?dist} +Release: 11%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -40,6 +40,9 @@ Source14: ipv6-down.initscripts # Fedora-specific Patch0: ppp-2.5.0-use-change-resolv-function.patch +# https://github.com/ppp-project/ppp/commit/7f89208b860ea0c41636410bfdb6a609b2772f47 +Patch1: ppp-2.5.0-radiusclient-parser-fix.patch + BuildRequires: libtool BuildRequires: autoconf BuildRequires: automake @@ -184,6 +187,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Mon Jun 24 2024 Jaroslav Škarvada - 2.5.0-11 +- Fixed radiusclient parser + * Wed Jun 12 2024 Jaroslav Škarvada - 2.5.0-10 - Openssl engine API is deprecated for a while thus disable it From 6b4070612ff9c3456bcef69620a971f1a06a5622 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 9 Jul 2024 13:49:47 +0200 Subject: [PATCH 63/76] Rebuilt for the bin-sbin merge https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index bc111db..668f8d1 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 11%{?dist} +Release: 12%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -187,6 +187,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 2.5.0-12 +- Rebuilt for the bin-sbin merge + * Mon Jun 24 2024 Jaroslav Škarvada - 2.5.0-11 - Fixed radiusclient parser From 635ed2c4e49b0eb6d19a14f02902944455dc505c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 08:24:44 +0000 Subject: [PATCH 64/76] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 668f8d1..ed6553f 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.0 -Release: 12%{?dist} +Release: 13%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -187,6 +187,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 2.5.0-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 2.5.0-12 - Rebuilt for the bin-sbin merge From 8676c76d0b47be51e1094a9c3b0dbe7b255031f2 Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Mon, 14 Oct 2024 10:15:34 +0200 Subject: [PATCH 65/76] Update plans and gating --- gating.yaml | 12 +++++----- plans.fmf | 47 ++++++++++++++++++++++++++++++++++++++++ plans/public.fmf | 7 ------ plans/tier1-internal.fmf | 12 ---------- 4 files changed, 52 insertions(+), 26 deletions(-) create mode 100644 plans.fmf delete mode 100644 plans/public.fmf delete mode 100644 plans/tier1-internal.fmf diff --git a/gating.yaml b/gating.yaml index 285eb64..9b2646f 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,8 +4,8 @@ product_versions: decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} - + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + #Rawhide --- !Policy product_versions: @@ -13,16 +13,14 @@ product_versions: decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} - + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + #gating rhel --- !Policy product_versions: - rhel-* decision_context: osci_compose_gate rules: - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-public.functional} - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} - - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/public.functional} diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..1150d22 --- /dev/null +++ b/plans.fmf @@ -0,0 +1,47 @@ +/tier1-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/tier1/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/tier1-public: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/tier1/public + +/tier2-tier3-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/tier2-tier3/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/tier2-tier3-public: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/tier2-tier3/public + +/others-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/others/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/others-public: + plan: + import: + url: https://src.fedoraproject.org/tests/ppp.git + name: /plans/others/public diff --git a/plans/public.fmf b/plans/public.fmf deleted file mode 100644 index 78f4e0e..0000000 --- a/plans/public.fmf +++ /dev/null @@ -1,7 +0,0 @@ -summary: Test plan with all Fedora tests -discover: - how: fmf - url: https://src.fedoraproject.org/tests/ppp.git -execute: - how: tmt - diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf deleted file mode 100644 index 3447b11..0000000 --- a/plans/tier1-internal.fmf +++ /dev/null @@ -1,12 +0,0 @@ -summary: CI plan, picks internal Tier1 tests, runs in beakerlib. -discover: - - name: rhel - how: fmf - filter: 'tier: 1' - url: git://pkgs.devel.redhat.com/tests/ppp -execute: - how: tmt -adjust: - enabled: false - when: distro == centos-stream, fedora - because: They don't have access to internal repos. From 239faff36a81e2f9c125afaed45e70ba934f9d6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 09:39:34 +0100 Subject: [PATCH 66/76] New version Resolves: rhbz#2313209 New version Resolves: rhbz#2313209 --- ppp.spec | 8 ++++++-- sources | 3 +-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ppp.spec b/ppp.spec index ed6553f..dd0075d 100644 --- a/ppp.spec +++ b/ppp.spec @@ -17,8 +17,8 @@ Name: ppp # sstp-client # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. -Version: 2.5.0 -Release: 13%{?dist} +Version: 2.5.1 +Release: 1%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -187,6 +187,10 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Sat Nov 16 2024 Jaroslav Škarvada - 2.5.1-1 +- New version + Resolves: rhbz#2313209 + * Fri Jul 19 2024 Fedora Release Engineering - 2.5.0-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 010a7fe..b93ac97 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (ppp-2.5.0.tar.gz) = cf62410a952053f9aa71c5179453831152e958fcad9e77df2ddac864e39aa71af0b746e54b91e8fa3ad6295d6d2b1bb736e36dc05521b495f573468679133324 -SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a +SHA512 (ppp-2.5.1.tar.gz) = 2e2a113fbb9ea1395ddde8711696e741b5ae66f5d5dc3f7d26be10bc09c605d13a972f067b7b4335f32d1f6952f5af8d59dec0cc28fa21d84664b236f0761216 From e3c470201bc6cd9fd9664df47349fe2178bbca9b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 09:45:56 +0100 Subject: [PATCH 67/76] New version Resolves: rhbz#2313209 New version Resolves: rhbz#2313209 --- sources | 1 + 1 file changed, 1 insertion(+) diff --git a/sources b/sources index b93ac97..117d746 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (ppp-2.5.1.tar.gz) = 2e2a113fbb9ea1395ddde8711696e741b5ae66f5d5dc3f7d26be10bc09c605d13a972f067b7b4335f32d1f6952f5af8d59dec0cc28fa21d84664b236f0761216 +SHA512 (ppp-watch.tar.xz) = aee10735facf918b9a1e33408c9f19d8240c2cd265837da87ac9f58e097eece6bbe1abcaf426e2f10369d1368f6e9e68d2e07d005a19857f17d6318708ec438a From beb7e74ce7a786a9ff1811e30678b137af620d47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 09:58:25 +0100 Subject: [PATCH 68/76] Dropped radiusclient-parser-fix patch (upstreamed) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp-2.5.0-radiusclient-parser-fix.patch | 49 ------------------------- ppp.spec | 3 -- 2 files changed, 52 deletions(-) delete mode 100644 ppp-2.5.0-radiusclient-parser-fix.patch diff --git a/ppp-2.5.0-radiusclient-parser-fix.patch b/ppp-2.5.0-radiusclient-parser-fix.patch deleted file mode 100644 index a898e25..0000000 --- a/ppp-2.5.0-radiusclient-parser-fix.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 7f89208b860ea0c41636410bfdb6a609b2772f47 Mon Sep 17 00:00:00 2001 -From: Eivind Naess -Date: Sun, 23 Apr 2023 11:37:01 -0700 -Subject: [PATCH] Closes #411, Fixing up parsing in radiusclient.conf - -Adding curly braces to fix the code. - -Signed-off-by: Eivind Naess ---- - pppd/plugins/radius/config.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/pppd/plugins/radius/config.c b/pppd/plugins/radius/config.c -index 39744fca1..e1a481487 100644 ---- a/pppd/plugins/radius/config.c -+++ b/pppd/plugins/radius/config.c -@@ -235,24 +235,28 @@ int rc_read_config(char *filename) - - switch (option->type) { - case OT_STR: -- if (set_option_str(filename, line, option, p) < 0) -+ if (set_option_str(filename, line, option, p) < 0) { - fclose(configfd); - return (-1); -+ } - break; - case OT_INT: -- if (set_option_int(filename, line, option, p) < 0) -+ if (set_option_int(filename, line, option, p) < 0) { - fclose(configfd); - return (-1); -+ } - break; - case OT_SRV: -- if (set_option_srv(filename, line, option, p) < 0) -+ if (set_option_srv(filename, line, option, p) < 0) { - fclose(configfd); - return (-1); -+ } - break; - case OT_AUO: -- if (set_option_auo(filename, line, option, p) < 0) -+ if (set_option_auo(filename, line, option, p) < 0) { - fclose(configfd); - return (-1); -+ } - break; - default: - fatal("rc_read_config: impossible case branch!"); diff --git a/ppp.spec b/ppp.spec index dd0075d..e22658a 100644 --- a/ppp.spec +++ b/ppp.spec @@ -40,9 +40,6 @@ Source14: ipv6-down.initscripts # Fedora-specific Patch0: ppp-2.5.0-use-change-resolv-function.patch -# https://github.com/ppp-project/ppp/commit/7f89208b860ea0c41636410bfdb6a609b2772f47 -Patch1: ppp-2.5.0-radiusclient-parser-fix.patch - BuildRequires: libtool BuildRequires: autoconf BuildRequires: automake From 8219d5b47f05bea6034920397cf937b52f51891e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 10:22:50 +0100 Subject: [PATCH 69/76] Fixed installation of configuration files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp.spec | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ppp.spec b/ppp.spec index e22658a..3da4aaf 100644 --- a/ppp.spec +++ b/ppp.spec @@ -128,6 +128,14 @@ install -p %{SOURCE14} %{buildroot}%{_sysconfdir}/ppp/ipv6-up.initscripts # ghosts mkdir -p %{buildroot}%{_rundir}/pppd/lock +# fix configuration files suffix +pushd %{buildroot}%{_sysconfdir}/ppp +for f in `ls *.example` +do + mv "$f" "${f%%.example} +done +popd + %if "%{_sbindir}" == "%{_bindir}" mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %endif From bd1d1479325c6964592ecc29bf10dfdbef56474d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= Date: Sat, 16 Nov 2024 11:09:22 +0100 Subject: [PATCH 70/76] Fixed spec MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jaroslav Škarvada --- ppp.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 3da4aaf..9c371c4 100644 --- a/ppp.spec +++ b/ppp.spec @@ -132,7 +132,7 @@ mkdir -p %{buildroot}%{_rundir}/pppd/lock pushd %{buildroot}%{_sysconfdir}/ppp for f in `ls *.example` do - mv "$f" "${f%%.example} + mv "$f" "${f%%.example}" done popd From 19a05d6af61664c3c65ae66a557f33fe4dbb9e78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:39:58 +0100 Subject: [PATCH 71/76] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index 9c371c4..d431a0b 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -192,6 +192,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 2.5.1-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Sat Nov 16 2024 Jaroslav Škarvada - 2.5.1-1 - New version Resolves: rhbz#2313209 From b854e546bbaa42594ea206259fbf073292489959 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 10:44:02 +0000 Subject: [PATCH 72/76] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index d431a0b..cbd0167 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -192,6 +192,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 2.5.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 2.5.1-2 - Rebuilt for the bin-sbin merge (2nd attempt) From dadb2d4d98a578f393f91536c04cdf6c93a57224 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:56:45 +0100 Subject: [PATCH 73/76] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- ppp.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index cbd0167..6086f25 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -51,6 +51,7 @@ BuildRequires: systemd BuildRequires: systemd-devel BuildRequires: glib2-devel BuildRequires: openssl-devel +BuildRequires: libxcrypt-devel %if %{defined rhel} Provides: bundled(linux-atm) = 2.4.1 %else @@ -192,6 +193,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Sat Feb 01 2025 Björn Esser - 2.5.1-4 +- Add explicit BR: libxcrypt-devel + * Sat Jan 18 2025 Fedora Release Engineering - 2.5.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 2e02872e926609aa240359830bc9bfe7d7277aba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 16:44:31 +0100 Subject: [PATCH 74/76] Add sysusers.d config file to allow rpm to create users/groups automatically See https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers. --- ppp.spec | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/ppp.spec b/ppp.spec index 6086f25..1fa0bbc 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 4%{?dist} +Release: 5%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -62,8 +62,6 @@ Requires: glibc >= 2.0.6 Requires: /etc/pam.d/system-auth Requires: libpcap >= 14:0.8.3-6 Requires: systemd -Requires(pre): /usr/bin/getent -Requires(pre): /usr/sbin/groupadd # Subpackage removed and obsoleted in F40 Obsoletes: network-scripts-ppp < %{version}-%{release} @@ -88,6 +86,11 @@ This package contains the header files for building plugins for ppp. tar -xJf %{SOURCE12} +# Create a sysusers.d config file +cat >ppp.sysusers.conf </dev/null 2>&1 || /usr/sbin/groupadd -r -g 40 dip >/dev/null 2>&1 || : +install -m0644 -D ppp.sysusers.conf %{buildroot}%{_sysusersdir}/ppp.conf + %post %tmpfiles_create ppp.conf @@ -186,6 +189,7 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %config(noreplace) %{_sysconfdir}/pam.d/ppp %config(noreplace) %{_sysconfdir}/logrotate.d/ppp %{_tmpfilesdir}/ppp.conf +%{_sysusersdir}/ppp.conf %files devel %{_includedir}/pppd @@ -193,6 +197,9 @@ mv %{buildroot}/usr/sbin/ppp-watch %{buildroot}%{_bindir}/ %{_libdir}/pkgconfig/pppd.pc %changelog +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.5.1-5 +- Add sysusers.d config file to allow rpm to create users/groups automatically + * Sat Feb 01 2025 Björn Esser - 2.5.1-4 - Add explicit BR: libxcrypt-devel From 055f5683fd0028789391e47c1da866685b2189ee Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 25 Feb 2025 00:04:47 -0500 Subject: [PATCH 75/76] Fix build with GCC 15 --- ppp-2.5.1-gcc15.patch | 58 +++++++++++++++++++++++++++++++++++++++++++ ppp.spec | 2 ++ 2 files changed, 60 insertions(+) create mode 100644 ppp-2.5.1-gcc15.patch diff --git a/ppp-2.5.1-gcc15.patch b/ppp-2.5.1-gcc15.patch new file mode 100644 index 0000000..5f13bc9 --- /dev/null +++ b/ppp-2.5.1-gcc15.patch @@ -0,0 +1,58 @@ +Fix build with GCC 15 + +GCC 15 defaults to C23 which does not allow K&R declarations. + +diff --git a/pppdump/pppdump.c b/pppdump/pppdump.c +index 16a5ffb..5708177 100644 +--- a/pppdump/pppdump.c ++++ b/pppdump/pppdump.c +@@ -51,14 +51,12 @@ int tot_sent, tot_rcvd; + extern int optind; + extern char *optarg; + +-void dumplog(); +-void dumpppp(); +-void show_time(); ++void dumplog(FILE *); ++void dumpppp(FILE *); ++void show_time(FILE *, int); + + int +-main(ac, av) +- int ac; +- char **av; ++main(int ac, char **av) + { + int i; + char *p; +@@ -106,8 +104,7 @@ main(ac, av) + } + + void +-dumplog(f) +- FILE *f; ++dumplog(FILE *f) + { + int c, n, k, col; + int nb, c2; +@@ -250,8 +247,7 @@ struct pkt { + unsigned char dbuf[8192]; + + void +-dumpppp(f) +- FILE *f; ++dumpppp(FILE *f) + { + int c, n, k; + int nb, nl, dn, proto, rv; +@@ -384,9 +380,7 @@ dumpppp(f) + } + + void +-show_time(f, c) +- FILE *f; +- int c; ++show_time(FILE *f, int c) + { + time_t t; + int n; diff --git a/ppp.spec b/ppp.spec index 1fa0bbc..d157c43 100644 --- a/ppp.spec +++ b/ppp.spec @@ -39,6 +39,8 @@ Source14: ipv6-down.initscripts # Fedora-specific Patch0: ppp-2.5.0-use-change-resolv-function.patch +# Fix build with GCC 15 +Patch1: ppp-2.5.1-gcc15.patch BuildRequires: libtool BuildRequires: autoconf From baad7a85acc667d45e0ad2a5ab0981a34946a03d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 06:07:04 +0000 Subject: [PATCH 76/76] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- ppp.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ppp.spec b/ppp.spec index d157c43..cdceb10 100644 --- a/ppp.spec +++ b/ppp.spec @@ -18,7 +18,7 @@ Name: ppp # These all need to be patched (if necessary) and rebuilt for new # versions of ppp. Version: 2.5.1 -Release: 5%{?dist} +Release: 6%{?dist} Summary: The Point-to-Point Protocol daemon License: bsd-3-clause AND zlib AND licenseref-fedora-public-domain AND bsd-attribution-hpnd-disclaimer AND bsd-4.3tahoe AND bsd-4-clause-uc AND apache-2.0 AND lgpl-2.0-or-later AND (gpl-2.0-or-later OR bsd-2-clause OR bsd-3-clause OR bsd-4-clause) AND gpl-2.0-or-later AND xlock AND gpl-1.0-or-later AND mackerras-3-clause-acknowledgment AND mackerras-3-clause AND hpnd-fenneberg-Livingston AND sun-ppp AND hpnd-inria-imag AND sun-ppp-2000 URL: http://www.samba.org/ppp @@ -199,6 +199,9 @@ install -m0644 -D ppp.sysusers.conf %{buildroot}%{_sysusersdir}/ppp.conf %{_libdir}/pkgconfig/pppd.pc %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 2.5.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 2.5.1-5 - Add sysusers.d config file to allow rpm to create users/groups automatically