From a5d0519e95de6acb8660598489ea8913a7057eec Mon Sep 17 00:00:00 2001 From: Rmys Date: Wed, 19 Apr 2023 18:13:07 +0300 Subject: [PATCH] ppp-2.4.9 revert --- network/connection/ppp/actions.py | 14 +- ...clude-netinet-in.h-before-linux-in.h.patch | 35 - .../ppp/files/gentoo/02_all_make-vars.patch | 194 -- .../ppp/files/gentoo/04_all_mpls.patch | 431 --- .../gentoo/06_all_killaddr-smarter.patch | 134 - .../files/gentoo/08_all_wait-children.patch | 77 - .../files/gentoo/10_all_defaultgateway.patch | 90 - .../ppp/files/gentoo/12_all_linkpidfile.patch | 97 - .../ppp/files/gentoo/16_all_auth-fail.patch | 141 - .../files/gentoo/18_all_defaultmetric.patch | 108 - .../ppp/files/gentoo/20_all_dev-ppp.patch | 20 - .../gentoo/24_all_passwordfd-read-early.patch | 85 - .../gentoo/26_all_pppd-usepeerwins.patch | 256 -- .../files/gentoo/28_all_connect-errors.patch | 12 - .../ppp/files/gentoo/30_all_Makefile.patch | 37 - .../files/gentoo/32_all_pado-timeout.patch | 254 -- .../gentoo/34_all_lcp-echo-adaptive.patch | 58 - .../80_all_eaptls-mppe-0.994-gentoo.patch | 2898 ---------------- network/connection/ppp/files/nostrip.patch | 92 - .../ppp/files/ppp-2.3.6-sample.patch | 295 -- .../files/ppp-2.4.2-change_resolv_conf.patch | 61 - .../ppp/files/ppp-2.4.3-fix64.patch | 10 - .../files/ppp-2.4.3-ipv6-accept-remote.patch | 40 - .../ppp/files/ppp-2.4.3-local.patch | 68 - .../ppp/files/ppp-2.4.5-ppp_resolv.patch | 13 - .../ppp/files/ppp-2.4.5-var_run_ppp.patch | 30 - .../files/ppp-2.4.6-eaptls-mppe-0.99.patch | 2919 ----------------- .../connection/ppp/files/ppp-openssl.patch | 110 - network/connection/ppp/pspec.xml | 31 +- 29 files changed, 26 insertions(+), 8584 deletions(-) delete mode 100644 network/connection/ppp/files/0029-pppoe-include-netinet-in.h-before-linux-in.h.patch delete mode 100644 network/connection/ppp/files/gentoo/02_all_make-vars.patch delete mode 100644 network/connection/ppp/files/gentoo/04_all_mpls.patch delete mode 100644 network/connection/ppp/files/gentoo/06_all_killaddr-smarter.patch delete mode 100644 network/connection/ppp/files/gentoo/08_all_wait-children.patch delete mode 100644 network/connection/ppp/files/gentoo/10_all_defaultgateway.patch delete mode 100644 network/connection/ppp/files/gentoo/12_all_linkpidfile.patch delete mode 100644 network/connection/ppp/files/gentoo/16_all_auth-fail.patch delete mode 100644 network/connection/ppp/files/gentoo/18_all_defaultmetric.patch delete mode 100644 network/connection/ppp/files/gentoo/20_all_dev-ppp.patch delete mode 100644 network/connection/ppp/files/gentoo/24_all_passwordfd-read-early.patch delete mode 100644 network/connection/ppp/files/gentoo/26_all_pppd-usepeerwins.patch delete mode 100644 network/connection/ppp/files/gentoo/28_all_connect-errors.patch delete mode 100644 network/connection/ppp/files/gentoo/30_all_Makefile.patch delete mode 100644 network/connection/ppp/files/gentoo/32_all_pado-timeout.patch delete mode 100644 network/connection/ppp/files/gentoo/34_all_lcp-echo-adaptive.patch delete mode 100644 network/connection/ppp/files/gentoo/80_all_eaptls-mppe-0.994-gentoo.patch delete mode 100644 network/connection/ppp/files/nostrip.patch delete mode 100644 network/connection/ppp/files/ppp-2.3.6-sample.patch delete mode 100644 network/connection/ppp/files/ppp-2.4.2-change_resolv_conf.patch delete mode 100644 network/connection/ppp/files/ppp-2.4.3-fix64.patch delete mode 100644 network/connection/ppp/files/ppp-2.4.3-ipv6-accept-remote.patch delete mode 100644 network/connection/ppp/files/ppp-2.4.3-local.patch delete mode 100644 network/connection/ppp/files/ppp-2.4.5-ppp_resolv.patch delete mode 100644 network/connection/ppp/files/ppp-2.4.5-var_run_ppp.patch delete mode 100644 network/connection/ppp/files/ppp-2.4.6-eaptls-mppe-0.99.patch delete mode 100644 network/connection/ppp/files/ppp-openssl.patch diff --git a/network/connection/ppp/actions.py b/network/connection/ppp/actions.py index 6b13cd4611..fb442cc4f5 100644 --- a/network/connection/ppp/actions.py +++ b/network/connection/ppp/actions.py @@ -15,24 +15,24 @@ def setup(): pisitools.dosed("pppd/plugins/dhcp/Makefile.linux", "^(CFLAGS=.+)\s-O2", "\\1 %s" % get.CFLAGS()) # Enable atm - # pisitools.dosed("pppd/Makefile.linux", "^#(HAVE_LIBATM=yes)", "\\1") + pisitools.dosed("pppd/Makefile.linux", "^#(HAVE_LIBATM=yes)", "\\1") # Enable pam - # pisitools.dosed("pppd/Makefile.linux", "^#(USE_PAM=y)", "\\1") + pisitools.dosed("pppd/Makefile.linux", "^#(USE_PAM=y)", "\\1") # Enable CBCP - # pisitools.dosed("pppd/Makefile.linux", "^#(CBCP=y)", "\\1") + pisitools.dosed("pppd/Makefile.linux", "^#(CBCP=y)", "\\1") # Enable IPv6 - # pisitools.dosed("pppd/Makefile.linux", "^#(HAVE_INET6)", "\\1") + pisitools.dosed("pppd/Makefile.linux", "^#(HAVE_INET6)", "\\1") # Enable dhcp - # pisitools.dosed("pppd/plugins/Makefile.linux", "^(SUBDIRS\s:=.+)", "\\1 dhcp") + pisitools.dosed("pppd/plugins/Makefile.linux", "^(SUBDIRS\s:=.+)", "\\1 dhcp") - autotools.configure("--enable-cbcp --enable-ipv6cp=yes") + autotools.configure() def build(): autotools.make() def install(): # The build mechanism is crap. Don't remove \/usr from DESTDIR or else the paths will fail - autotools.rawInstall("DESTDIR=%s INSTROOT=%s" % ((get.installDIR(),)*2)) + autotools.rawInstall("DESTDIR=%s/usr INSTROOT=%s install-etcppp" % ((get.installDIR(),)*2)) # No suid libraries shelltools.chmod("%s/usr/lib/pppd/%s/*.so" % (get.installDIR(),get.srcVERSION()), 0755) diff --git a/network/connection/ppp/files/0029-pppoe-include-netinet-in.h-before-linux-in.h.patch b/network/connection/ppp/files/0029-pppoe-include-netinet-in.h-before-linux-in.h.patch deleted file mode 100644 index 9b0920d3bc..0000000000 --- a/network/connection/ppp/files/0029-pppoe-include-netinet-in.h-before-linux-in.h.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 33797aa193a2751da26f9af120e39c110defe4d1 Mon Sep 17 00:00:00 2001 -From: Lubomir Rintel -Date: Sat, 10 Dec 2016 19:53:56 +0100 -Subject: [PATCH] pppoe: include netinet/in.h before linux/in.h - -To fix build breakage. ---- - pppd/plugins/rp-pppoe/pppoe.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h -index 9ab2eee..f77f5b7 100644 ---- a/pppd/plugins/rp-pppoe/pppoe.h -+++ b/pppd/plugins/rp-pppoe/pppoe.h -@@ -15,6 +15,8 @@ - - #include "config.h" - -+#include -+ - #if defined(HAVE_NETPACKET_PACKET_H) || defined(HAVE_LINUX_IF_PACKET_H) - #define _POSIX_SOURCE 1 /* For sigaction defines */ - #endif -@@ -84,8 +86,6 @@ typedef unsigned long UINT32_t; - #include - #endif - --#include -- - #ifdef HAVE_NETINET_IF_ETHER_H - #include - --- -2.9.3 - diff --git a/network/connection/ppp/files/gentoo/02_all_make-vars.patch b/network/connection/ppp/files/gentoo/02_all_make-vars.patch deleted file mode 100644 index e6898b2b0d..0000000000 --- a/network/connection/ppp/files/gentoo/02_all_make-vars.patch +++ /dev/null @@ -1,194 +0,0 @@ -diff -ur ppp-2.4.5.orig/chat/Makefile.linux ppp-2.4.5/chat/Makefile.linux ---- ppp-2.4.5.orig/chat/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/chat/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 -@@ -10,7 +10,6 @@ - CDEF4= -DFNDELAY=O_NDELAY # Old name value - CDEFS= $(CDEF1) $(CDEF2) $(CDEF3) $(CDEF4) - --COPTS= -O2 -g -pipe - CFLAGS= $(COPTS) $(CDEFS) - - INSTALL= install -@@ -18,7 +17,7 @@ - all: chat - - chat: chat.o -- $(CC) -o chat chat.o -+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ - - chat.o: chat.c - $(CC) -c $(CFLAGS) -o chat.o chat.c -diff -ur ppp-2.4.5.orig/pppd/Makefile.linux ppp-2.4.5/pppd/Makefile.linux ---- ppp-2.4.5.orig/pppd/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 -@@ -32,7 +32,7 @@ - - # CC = gcc - # --COPTS = -O2 -pipe -Wall -g -+COPTS+= -Wall - LIBS = - - # Uncomment the next 2 lines to include support for Microsoft's -diff -ur ppp-2.4.5.orig/pppd/plugins/Makefile.linux ppp-2.4.5/pppd/plugins/Makefile.linux ---- ppp-2.4.5.orig/pppd/plugins/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/plugins/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 -@@ -1,7 +1,11 @@ - #CC = gcc --COPTS = -O2 -g - CFLAGS = $(COPTS) -I.. -I../../include -fPIC --LDFLAGS = -shared -+LDFLAGS_PROG := $(LDFLAGS) -+export LDFLAGS LDFLAGS_PROG -+LDFLAGS += -shared -+# need the following option, otherwise linking plugins might fail with undef errors (Gentoo bug 210837) -+LDFLAGS += -Wl,--allow-shlib-undefined -+LIBS = - INSTALL = install - - DESTDIR = $(INSTROOT)@DESTDIR@ -@@ -23,7 +27,7 @@ - for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done - - %.so: %.c -- $(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^ -+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS) - - VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../patchlevel.h) - -diff -ur ppp-2.4.5.orig/pppd/plugins/pppoatm/Makefile.linux ppp-2.4.5/pppd/plugins/pppoatm/Makefile.linux ---- ppp-2.4.5.orig/pppd/plugins/pppoatm/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/plugins/pppoatm/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 -@@ -1,7 +1,5 @@ - #CC = gcc --COPTS = -O2 -g - CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC --LDFLAGS = -shared - INSTALL = install - - #*********************************************************************** -@@ -33,7 +31,7 @@ - all: $(PLUGIN) - - $(PLUGIN): $(PLUGIN_OBJS) -- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) -+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff -ur ppp-2.4.5.orig/pppd/plugins/pppol2tp/Makefile.linux ppp-2.4.5/pppd/plugins/pppol2tp/Makefile.linux ---- ppp-2.4.5.orig/pppd/plugins/pppol2tp/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/plugins/pppol2tp/Makefile.linux 2010-08-08 09:20:02.000000000 +0200 -@@ -1,7 +1,5 @@ - #CC = gcc --COPTS = -O2 -g - CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC --LDFLAGS = -shared - INSTALL = install - - #*********************************************************************** -@@ -16,7 +14,7 @@ - all: $(PLUGINS) - - %.so: %.o -- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) -+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff -ur ppp-2.4.5.orig/pppd/plugins/radius/Makefile.linux ppp-2.4.5/pppd/plugins/radius/Makefile.linux ---- ppp-2.4.5.orig/pppd/plugins/radius/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/plugins/radius/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 -@@ -12,7 +12,7 @@ - INSTALL = install - - PLUGIN=radius.so radattr.so radrealms.so --CFLAGS=-I. -I../.. -I../../../include -O2 -fPIC -DRC_LOG_FACILITY=LOG_DAEMON -+CFLAGS=$(COPTS) -I. -I../.. -I../../../include -fPIC -DRC_LOG_FACILITY=LOG_DAEMON - - # Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. -@@ -43,13 +43,13 @@ - $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) - - radius.so: radius.o libradiusclient.a -- $(CC) -o radius.so -shared radius.o libradiusclient.a -+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ - - radattr.so: radattr.o -- $(CC) -o radattr.so -shared radattr.o -+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ - - radrealms.so: radrealms.o -- $(CC) -o radrealms.so -shared radrealms.o -+ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ - - CLIENTOBJS = avpair.o buildreq.o config.o dict.o ip_util.o \ - clientid.o sendserver.o lock.o util.o md5.o -diff -ur ppp-2.4.5.orig/pppd/plugins/rp-pppoe/Makefile.linux ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux ---- ppp-2.4.5.orig/pppd/plugins/rp-pppoe/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 -@@ -25,12 +25,11 @@ - # Version is set ONLY IN THE MAKEFILE! Don't delete this! - RP_VERSION=3.8p - --COPTS=-O2 -g - CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' - all: rp-pppoe.so pppoe-discovery - - pppoe-discovery: pppoe-discovery.o debug.o -- $(CC) -o pppoe-discovery pppoe-discovery.o debug.o -+ $(CC) $(LDFLAGS_PROG) $(CFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o - - pppoe-discovery.o: pppoe-discovery.c - $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c -@@ -39,7 +38,7 @@ - $(CC) $(CFLAGS) -c -o debug.o debug.c - - rp-pppoe.so: plugin.o discovery.o if.o common.o -- $(CC) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o -+ $(CC) $(LDFLAGS) $(CFLAGS) -o rp-pppoe.so plugin.o discovery.o if.o common.o - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -diff -ur ppp-2.4.5.orig/pppdump/Makefile.linux ppp-2.4.5/pppdump/Makefile.linux ---- ppp-2.4.5.orig/pppdump/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppdump/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 -@@ -2,7 +2,7 @@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 - --CFLAGS= -O -I../include/net -+CFLAGS=$(COPTS) -I../include/net - OBJS = pppdump.o bsd-comp.o deflate.o zlib.o - - INSTALL= install -@@ -10,7 +10,7 @@ - all: pppdump - - pppdump: $(OBJS) -- $(CC) -o pppdump $(OBJS) -+ $(CC) $(LDFLAGS) -o pppdump $(OBJS) - - clean: - rm -f pppdump $(OBJS) *~ -diff -ur ppp-2.4.5.orig/pppstats/Makefile.linux ppp-2.4.5/pppstats/Makefile.linux ---- ppp-2.4.5.orig/pppstats/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppstats/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 -@@ -10,7 +10,6 @@ - PPPSTATOBJS = pppstats.o - - #CC = gcc --COPTS = -O - COMPILE_FLAGS = -I../include - LIBS = - -@@ -26,7 +25,7 @@ - $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) - - pppstats: $(PPPSTATSRCS) -- $(CC) $(CFLAGS) -o pppstats pppstats.c $(LIBS) -+ $(CC) $(CFLAGS) $(LDFLAGS) -o pppstats pppstats.c $(LIBS) - - clean: - rm -f pppstats *~ #* core diff --git a/network/connection/ppp/files/gentoo/04_all_mpls.patch b/network/connection/ppp/files/gentoo/04_all_mpls.patch deleted file mode 100644 index 86d79ef557..0000000000 --- a/network/connection/ppp/files/gentoo/04_all_mpls.patch +++ /dev/null @@ -1,431 +0,0 @@ -diff -Nur ppp-2.4.5.orig/pppd/main.c ppp-2.4.5/pppd/main.c ---- ppp-2.4.5.orig/pppd/main.c 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/main.c 2010-08-08 09:30:23.000000000 +0200 -@@ -96,6 +96,9 @@ - #include "fsm.h" - #include "lcp.h" - #include "ipcp.h" -+ -+#include "mplscp.h" -+ - #ifdef INET6 - #include "ipv6cp.h" - #endif -@@ -283,6 +286,7 @@ - &cbcp_protent, - #endif - &ipcp_protent, -+ &mplscp_protent, - #ifdef INET6 - &ipv6cp_protent, - #endif -diff -Nur ppp-2.4.5.orig/pppd/Makefile.linux ppp-2.4.5/pppd/Makefile.linux ---- ppp-2.4.5.orig/pppd/Makefile.linux 2010-08-08 09:22:22.000000000 +0200 -+++ ppp-2.4.5/pppd/Makefile.linux 2010-08-08 09:31:43.000000000 +0200 -@@ -13,16 +13,16 @@ - - PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c md5.c ccp.c \ - ecp.c ipxcp.c auth.c options.c sys-linux.c md4.c chap_ms.c \ -- demand.c utils.c tty.c eap.c chap-md5.c session.c -+ demand.c utils.c tty.c eap.c chap-md5.c session.c mplscp.c - - HEADERS = ccp.h session.h chap-new.h ecp.h fsm.h ipcp.h \ - ipxcp.h lcp.h magic.h md5.h patchlevel.h pathnames.h pppd.h \ -- upap.h eap.h -+ upap.h eap.h mplscp.h - - MANPAGES = pppd.8 - PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o md5.o ccp.o \ - ecp.o auth.o options.o demand.o utils.o sys-linux.o ipxcp.o tty.o \ -- eap.o chap-md5.o session.o -+ eap.o chap-md5.o session.o mplscp.o - - # - # include dependencies if present -diff -Nur ppp-2.4.5.orig/pppd/mplscp.c ppp-2.4.5/pppd/mplscp.c ---- ppp-2.4.5.orig/pppd/mplscp.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.5/pppd/mplscp.c 2010-08-08 09:30:23.000000000 +0200 -@@ -0,0 +1,371 @@ -+ -+/* MPLSCP - Serge.Krier@advalvas.be (C) 2001 */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include "pppd.h" -+#include "fsm.h" -+#include "mplscp.h" -+ -+ -+/* local vars */ -+/* static int mplscp_is_up; */ /* have called np_up() */ -+ -+/* -+ * Callbacks for fsm code. (CI = Configuration Information) -+ */ -+static void mplscp_resetci __P((fsm *)); /* Reset our CI */ -+static int mplscp_cilen __P((fsm *)); /* Return length of our CI */ -+static void mplscp_addci __P((fsm *, u_char *, int *)); /* Add our CI */ -+static int mplscp_ackci __P((fsm *, u_char *, int)); /* Peer ack'd our CI */ -+static int mplscp_nakci __P((fsm *, u_char *, int)); /* Peer nak'd our CI */ -+static int mplscp_rejci __P((fsm *, u_char *, int)); /* Peer rej'd our CI */ -+static int mplscp_reqci __P((fsm *, u_char *, int *, int)); /* Rcv CI */ -+static void mplscp_up __P((fsm *)); /* We're UP */ -+static void mplscp_down __P((fsm *)); /* We're DOWN */ -+static void mplscp_finished __P((fsm *)); /* Don't need lower layer */ -+ -+fsm mplscp_fsm[NUM_PPP]; /* MPLSCP fsm structure */ -+ -+static fsm_callbacks mplscp_callbacks = { /* MPLSCP callback routines */ -+ mplscp_resetci, /* Reset our Configuration Information */ -+ mplscp_cilen, /* Length of our Configuration Information */ -+ mplscp_addci, /* Add our Configuration Information */ -+ mplscp_ackci, /* ACK our Configuration Information */ -+ mplscp_nakci, /* NAK our Configuration Information */ -+ mplscp_rejci, /* Reject our Configuration Information */ -+ mplscp_reqci, /* Request peer's Configuration Information */ -+ mplscp_up, /* Called when fsm reaches OPENED state */ -+ mplscp_down, /* Called when fsm leaves OPENED state */ -+ NULL, /* Called when we want the lower layer up */ -+ mplscp_finished, /* Called when we want the lower layer down */ -+ NULL, /* Called when Protocol-Reject received */ -+ NULL, /* Retransmission is necessary */ -+ NULL, /* Called to handle protocol-specific codes */ -+ "MPLSCP" /* String name of protocol */ -+}; -+ -+static option_t mplscp_option_list[] = { -+ { "mpls", o_bool, &mplscp_protent.enabled_flag, -+ "Enable MPLSCP (and MPLS)", 1 }, -+ { NULL } }; -+ -+/* -+ * Protocol entry points from main code. -+ */ -+ -+static void mplscp_init __P((int)); -+static void mplscp_open __P((int)); -+static void mplscp_close __P((int, char *)); -+static void mplscp_lowerup __P((int)); -+static void mplscp_lowerdown __P((int)); -+static void mplscp_input __P((int, u_char *, int)); -+static void mplscp_protrej __P((int)); -+static int mplscp_printpkt __P((u_char *, int, -+ void (*) __P((void *, char *, ...)), void *)); -+ -+struct protent mplscp_protent = { -+ PPP_MPLSCP, -+ mplscp_init, -+ mplscp_input, -+ mplscp_protrej, -+ mplscp_lowerup, -+ mplscp_lowerdown, -+ mplscp_open, -+ mplscp_close, -+ mplscp_printpkt, -+ NULL, -+ 0, /* MPLS not enabled by default */ -+ "MPLSCP", -+ "MPLS", -+ mplscp_option_list, -+ NULL, -+ NULL, -+ NULL -+}; -+ -+/* -+ * mplscp_init - Initialize MPLSCP. -+ */ -+static void -+mplscp_init(int unit) { -+ -+ fsm *f = &mplscp_fsm[unit]; -+ -+ f->unit = unit; -+ f->protocol = PPP_MPLSCP; -+ f->callbacks = &mplscp_callbacks; -+ fsm_init(&mplscp_fsm[unit]); -+ -+} -+ -+/* -+ * mplscp_open - MPLSCP is allowed to come up. -+ */ -+static void -+mplscp_open(int unit) { -+ -+ fsm_open(&mplscp_fsm[unit]); -+ -+} -+ -+/* -+ * mplscp_close - Take MPLSCP down. -+ */ -+static void -+mplscp_close(int unit, char *reason) { -+ -+ fsm_close(&mplscp_fsm[unit], reason); -+ -+} -+ -+/* -+ * mplscp_lowerup - The lower layer is up. -+ */ -+static void -+mplscp_lowerup(int unit) { -+ -+ fsm_lowerup(&mplscp_fsm[unit]); -+} -+ -+/* -+ * mplscp_lowerdown - The lower layer is down. -+ */ -+static void -+mplscp_lowerdown(int unit) { -+ -+ fsm_lowerdown(&mplscp_fsm[unit]); -+} -+ -+/* -+ * mplscp_input - Input MPLSCP packet. -+ */ -+static void -+mplscp_input(int unit, u_char *p, int len) { -+ -+ fsm_input(&mplscp_fsm[unit], p, len); -+} -+ -+/* -+ * mplscp_protrej - A Protocol-Reject was received for MPLSCP. -+ * Pretend the lower layer went down, so we shut up. -+ */ -+static void -+mplscp_protrej(int unit) { -+ -+ fsm_lowerdown(&mplscp_fsm[unit]); -+} -+ -+/* -+ * mplscp_resetci - Reset our CI. -+ * Called by fsm_sconfreq, Send Configure Request. -+ */ -+static void -+mplscp_resetci(fsm *f) { -+ -+ return; -+} -+ -+/* -+ * mplscp_cilen - Return length of our CI. -+ * Called by fsm_sconfreq, Send Configure Request. -+ */ -+static int -+mplscp_cilen(fsm *f) { -+ -+ return 0; -+} -+ -+/* -+ * mplscp_addci - Add our desired CIs to a packet. -+ * Called by fsm_sconfreq, Send Configure Request. -+ */ -+static void -+mplscp_addci(fsm *f, u_char *ucp, int *lenp) { -+ -+} -+ -+/* -+ * ipcp_ackci - Ack our CIs. -+ * Called by fsm_rconfack, Receive Configure ACK. -+ * -+ * Returns: -+ * 0 - Ack was bad. -+ * 1 - Ack was good. -+ */ -+static int -+mplscp_ackci(fsm *f, u_char *p, int len) { -+ -+ return 1; -+ -+} -+ -+/* -+ * mplscp_nakci - Peer has sent a NAK for some of our CIs. -+ * This should not modify any state if the Nak is bad -+ * or if MPLSCP is in the OPENED state. -+ * Calback from fsm_rconfnakrej - Receive Configure-Nak or Configure-Reject. -+ * -+ * Returns: -+ * 0 - Nak was bad. -+ * 1 - Nak was good. -+ */ -+static int -+mplscp_nakci(fsm *f, u_char *p, int len) { -+ -+ return 1; -+} -+ -+/* -+ * MPLSVP_rejci - Reject some of our CIs. -+ * Callback from fsm_rconfnakrej. -+ */ -+static int -+mplscp_rejci(fsm *f, u_char *p, int len) { -+ -+ return 1; -+ -+} -+ -+/* -+ * mplscp_reqci - Check the peer's requested CIs and send appropriate response. -+ * Callback from fsm_rconfreq, Receive Configure Request -+ * -+ * Returns: CONFACK, CONFNAK or CONFREJ and input packet modified -+ * appropriately. If reject_if_disagree is non-zero, doesn't return -+ * CONFNAK; returns CONFREJ if it can't return CONFACK. -+ */ -+static int -+mplscp_reqci(fsm *f, u_char *inp, int *len, int reject_if_disagree) { -+ -+ -+ int rc = CONFACK; /* Final packet return code */ -+ -+ PUTCHAR(CONFACK,inp); -+ -+ return rc; -+ -+} -+ -+static void -+mplscp_up(fsm *f) { -+ -+ sifnpmode(f->unit, PPP_MPLS_UC, NPMODE_PASS); -+ /* sifnpmode(f->unit, PPP_MPLS_MC, NPMODE_PASS);*/ -+ -+ np_up(f->unit, PPP_MPLS_UC); -+ /* np_up(f->unit, PPP_MPLS_MC);*/ -+ /* ipcp_is_up = 1;*/ -+ -+ -+#if 1 -+ printf("MPLSCP is OPENED\n"); -+#endif -+ -+} -+ -+static void -+mplscp_down(fsm *f) { -+ -+ sifnpmode(f->unit, PPP_MPLS_UC, NPMODE_DROP); -+ /* sifnpmode(f->unit, PPP_MPLS_MC, NPMODE_DROP);*/ -+ -+ sifdown(f->unit); -+ -+#if 1 -+ printf("MPLSCP is CLOSED\n"); -+#endif -+ -+ -+} -+ -+static void -+mplscp_finished(fsm *f) { -+ -+ np_finished(f->unit, PPP_MPLS_UC); -+ /* np_finished(f->unit, PPP_MPLS_MC);*/ -+ -+} -+ -+/* -+ * mpls_printpkt - print the contents of an MPLSCP packet. -+ */ -+static char *mplscp_codenames[] = { -+ "ConfReq", "ConfAck", "ConfNak", "ConfRej", -+ "TermReq", "TermAck", "CodeRej" -+}; -+ -+static int -+mplscp_printpkt(u_char *p, int plen, -+ void (*printer) __P((void *, char *, ...)), -+ void *arg) { -+ -+ int code, id, len, olen; -+ u_char *pstart, *optend; -+ -+ if (plen < HEADERLEN) -+ return 0; -+ pstart = p; -+ GETCHAR(code, p); -+ GETCHAR(id, p); -+ GETSHORT(len, p); -+ if (len < HEADERLEN || len > plen) -+ return 0; -+ -+ if (code >= 1 && code <= sizeof(mplscp_codenames) / sizeof(char *)) -+ printer(arg, " %s", mplscp_codenames[code-1]); -+ else -+ printer(arg, " code=0x%x", code); -+ printer(arg, " id=0x%x", id); -+ len -= HEADERLEN; -+ switch (code) { -+ case CONFREQ: -+ case CONFACK: -+ case CONFNAK: -+ case CONFREJ: -+ /* print option list */ -+ while (len >= 2) { -+ GETCHAR(code, p); -+ GETCHAR(olen, p); -+ p -= 2; -+ if (olen < 2 || olen > len) { -+ break; -+ } -+ printer(arg, " <"); -+ len -= olen; -+ optend = p + olen; -+ while (p < optend) { -+ GETCHAR(code, p); -+ printer(arg, " %.2x", code); -+ } -+ printer(arg, ">"); -+ } -+ break; -+ -+ case TERMACK: -+ case TERMREQ: -+ if (len > 0 && *p >= ' ' && *p < 0x7f) { -+ printer(arg, " "); -+ print_string((char *)p, len, printer, arg); -+ p += len; -+ len = 0; -+ } -+ break; -+ } -+ -+ /* print the rest of the bytes in the packet */ -+ for (; len > 0; --len) { -+ GETCHAR(code, p); -+ printer(arg, " %.2x", code); -+ } -+ -+ return p - pstart; -+ -+} -diff -Nur ppp-2.4.5.orig/pppd/mplscp.h ppp-2.4.5/pppd/mplscp.h ---- ppp-2.4.5.orig/pppd/mplscp.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.5/pppd/mplscp.h 2010-08-08 09:30:23.000000000 +0200 -@@ -0,0 +1,8 @@ -+ -+/* MPLSCP - Serge.Krier@advalvas.be (C) 2001 */ -+ -+#define PPP_MPLSCP 0x8281 -+#define PPP_MPLS_UC 0x0281 -+#define PPP_MPLS_MC 0x0283 -+ -+extern struct protent mplscp_protent; diff --git a/network/connection/ppp/files/gentoo/06_all_killaddr-smarter.patch b/network/connection/ppp/files/gentoo/06_all_killaddr-smarter.patch deleted file mode 100644 index 6d12dd9edf..0000000000 --- a/network/connection/ppp/files/gentoo/06_all_killaddr-smarter.patch +++ /dev/null @@ -1,134 +0,0 @@ -diff -Nur ppp-2.4.5.orig/pppd/options.c ppp-2.4.5/pppd/options.c ---- ppp-2.4.5.orig/pppd/options.c 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/options.c 2010-08-08 09:43:47.000000000 +0200 -@@ -100,6 +100,9 @@ - char user[MAXNAMELEN]; /* Username for PAP */ - char passwd[MAXSECRETLEN]; /* Password for PAP */ - bool persist = 0; /* Reopen link after it goes down */ -+bool killoldaddr = 0; /* If our IP is reassigned on -+ reconnect, kill active TCP -+ connections using the old IP. */ - char our_name[MAXNAMELEN]; /* Our name for authentication purposes */ - bool demand = 0; /* do dial-on-demand */ - char *ipparam = NULL; /* Extra parameter for ip up/down scripts */ -@@ -231,6 +234,11 @@ - { "demand", o_bool, &demand, - "Dial on demand", OPT_INITONLY | 1, &persist }, - -+ { "killoldaddr", o_bool, &killoldaddr, -+ "Kill connections from an old source address", 1}, -+ { "nokilloldaddr", o_bool,&killoldaddr, -+ "Don't kill connections from an old source address" }, -+ - { "--version", o_special_noarg, (void *)showversion, - "Show version number" }, - { "--help", o_special_noarg, (void *)showhelp, -diff -Nur ppp-2.4.5.orig/pppd/pppd.h ppp-2.4.5/pppd/pppd.h ---- ppp-2.4.5.orig/pppd/pppd.h 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/pppd.h 2010-08-08 09:43:47.000000000 +0200 -@@ -298,6 +298,9 @@ - extern char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ - extern bool explicit_remote;/* remote_name specified with remotename opt */ - extern bool demand; /* Do dial-on-demand */ -+extern bool killoldaddr; /* If our IP is reassigned on -+ reconnect, kill active TCP -+ connections using the old IP. */ - extern char *ipparam; /* Extra parameter for ip up/down scripts */ - extern bool cryptpap; /* Others' PAP passwords are encrypted */ - extern int idle_time_limit;/* Shut down link if idle for this long */ -diff -Nur ppp-2.4.5.orig/pppd/sys-linux.c ppp-2.4.5/pppd/sys-linux.c ---- ppp-2.4.5.orig/pppd/sys-linux.c 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/sys-linux.c 2010-08-08 09:43:47.000000000 +0200 -@@ -165,6 +165,10 @@ - - #endif /* INET6 */ - -+#ifndef SIOCKILLADDR -+#define SIOCKILLADDR 0x8939 -+#endif -+ - /* We can get an EIO error on an ioctl if the modem has hung up */ - #define ok_error(num) ((num)==EIO) - -@@ -209,6 +213,7 @@ - static u_int32_t proxy_arp_addr; /* Addr for proxy arp entry added */ - static char proxy_arp_dev[16]; /* Device for proxy arp entry */ - static u_int32_t our_old_addr; /* for detecting address changes */ -+static u_int32_t our_current_addr; - static int dynaddr_set; /* 1 if ip_dynaddr set */ - static int looped; /* 1 if using loop */ - static int link_mtu; /* mtu for the link (not bundle) */ -@@ -537,6 +542,27 @@ - return -1; - } - -+static void do_killaddr(u_int32_t oldaddr) -+{ -+ struct ifreq ifr; -+ -+ memset(&ifr,0,sizeof ifr); -+ -+ SET_SA_FAMILY (ifr.ifr_addr, AF_INET); -+ SET_SA_FAMILY (ifr.ifr_dstaddr, AF_INET); -+ SET_SA_FAMILY (ifr.ifr_netmask, AF_INET); -+ -+ SIN_ADDR(ifr.ifr_addr) = oldaddr; -+ -+ strlcpy(ifr.ifr_name, ifname, sizeof (ifr.ifr_name)); -+ -+ if(ioctl(sock_fd,SIOCKILLADDR,&ifr) < 0) { -+ if (!ok_error (errno)) -+ error("ioctl(SIOCKILLADDR): %m(%d)", errno); -+ return; -+ } -+} -+ - /******************************************************************** - * - * tty_disestablish_ppp - Restore the serial port to normal operation. -@@ -2385,21 +2411,29 @@ - } - } - -- /* set ip_dynaddr in demand mode if address changes */ -- if (demand && tune_kernel && !dynaddr_set -- && our_old_addr && our_old_addr != our_adr) { -+ if(persist && our_old_addr && our_old_addr != our_adr) { -+ -+ if(killoldaddr) -+ do_killaddr(our_old_addr); -+ -+ -+ /* set ip_dynaddr in persist mode if address changes */ -+ if (tune_kernel && !dynaddr_set) { - /* set ip_dynaddr if possible */ - char *path; - int fd; - - path = path_to_procfs("/sys/net/ipv4/ip_dynaddr"); - if (path != 0 && (fd = open(path, O_WRONLY)) >= 0) { -- if (write(fd, "1", 1) != 1) -- error("Couldn't enable dynamic IP addressing: %m"); -- close(fd); -+ if (write(fd, "1", 1) != 1) -+ error("Couldn't enable dynamic IP addressing: %m"); -+ close(fd); - } - dynaddr_set = 1; /* only 1 attempt */ -+ } - } -+ -+ our_current_addr = our_adr; - our_old_addr = 0; - - return 1; -@@ -2455,7 +2489,8 @@ - } - - our_old_addr = our_adr; -- -+ our_current_addr = 0; -+ - return 1; - } - diff --git a/network/connection/ppp/files/gentoo/08_all_wait-children.patch b/network/connection/ppp/files/gentoo/08_all_wait-children.patch deleted file mode 100644 index 3a204ea4ed..0000000000 --- a/network/connection/ppp/files/gentoo/08_all_wait-children.patch +++ /dev/null @@ -1,77 +0,0 @@ -diff -Nur ppp-2.4.5.orig/pppd/main.c ppp-2.4.5/pppd/main.c ---- ppp-2.4.5.orig/pppd/main.c 2010-08-08 09:34:32.000000000 +0200 -+++ ppp-2.4.5/pppd/main.c 2010-08-08 09:46:00.000000000 +0200 -@@ -249,6 +249,7 @@ - static void forget_child __P((int pid, int status)); - static int reap_kids __P((void)); - static void childwait_end __P((void *)); -+static void wait_children __P((void)); - - #ifdef USE_TDB - static void update_db_entry __P((void)); -@@ -580,25 +581,11 @@ - if (!persist) - break; - } -+ -+ wait_children(); - } - -- /* Wait for scripts to finish */ -- reap_kids(); -- if (n_children > 0) { -- if (child_wait > 0) -- TIMEOUT(childwait_end, NULL, child_wait); -- if (debug) { -- struct subprocess *chp; -- dbglog("Waiting for %d child processes...", n_children); -- for (chp = children; chp != NULL; chp = chp->next) -- dbglog(" script %s, pid %d", chp->prog, chp->pid); -- } -- while (n_children > 0 && !childwait_done) { -- handle_events(); -- if (kill_link && !childwait_done) -- childwait_end(NULL); -- } -- } -+ wait_children(); - - die(status); - return 0; -@@ -1794,6 +1781,36 @@ - } - - /* -+ * wait_children - wait for scripts to finish. -+ * if child_wait is 0, wait indefinitely. -+ * else, kill'em all at the end of timeout -+ */ -+static void -+wait_children() -+{ -+ /* Wait for scripts to finish */ -+ reap_kids(); -+ if (n_children > 0) { -+ childwait_done = 0; -+ if (child_wait > 0) -+ TIMEOUT(childwait_end, NULL, child_wait); -+ if (debug) { -+ struct subprocess *chp; -+ dbglog("Waiting for %d child processes...", n_children); -+ for (chp = children; chp != NULL; chp = chp->next) -+ dbglog(" script %s, pid %d", chp->prog, chp->pid); -+ } -+ while (n_children > 0 && !childwait_done) { -+ handle_events(); -+ if (asked_to_quit && !childwait_done) -+ childwait_end(NULL); -+ } -+ if (child_wait > 0) -+ UNTIMEOUT(childwait_end, NULL); -+ } -+} -+ -+/* - * childwait_end - we got fed up waiting for the child processes to - * exit, send them all a SIGTERM. - */ diff --git a/network/connection/ppp/files/gentoo/10_all_defaultgateway.patch b/network/connection/ppp/files/gentoo/10_all_defaultgateway.patch deleted file mode 100644 index 799e852c66..0000000000 --- a/network/connection/ppp/files/gentoo/10_all_defaultgateway.patch +++ /dev/null @@ -1,90 +0,0 @@ -This patch reverses revision 1.114 of the pppd/sys-linux.c file. -The default gateway is needed by the openswan's %defaultroute. -diff -Nur ppp-2.4.5.orig/pppd/sys-linux.c ppp-2.4.5/pppd/sys-linux.c ---- ppp-2.4.5.orig/pppd/sys-linux.c 2010-08-08 09:44:29.000000000 +0200 -+++ ppp-2.4.5/pppd/sys-linux.c 2010-08-08 09:53:02.000000000 +0200 -@@ -209,7 +209,7 @@ - static unsigned char inbuf[512]; /* buffer for chars read from loopback */ - - static int if_is_up; /* Interface has been marked up */ --static int have_default_route; /* Gateway for default route added */ -+static u_int32_t default_route_gateway; /* Gateway for default route added */ - static u_int32_t proxy_arp_addr; /* Addr for proxy arp entry added */ - static char proxy_arp_dev[16]; /* Device for proxy arp entry */ - static u_int32_t our_old_addr; /* for detecting address changes */ -@@ -346,8 +346,8 @@ - /* - * Delete any routes through the device. - */ -- if (have_default_route) -- cifdefaultroute(0, 0, 0); -+ if (default_route_gateway != 0) -+ cifdefaultroute(0, 0, default_route_gateway); - - if (has_proxy_arp) - cifproxyarp(0, proxy_arp_addr); -@@ -1639,17 +1639,17 @@ - struct rtentry rt; - - if (defaultroute_exists(&rt) && strcmp(rt.rt_dev, ifname) != 0) { -- if (rt.rt_flags & RTF_GATEWAY) -- error("not replacing existing default route via %I", -- SIN_ADDR(rt.rt_gateway)); -- else -- error("not replacing existing default route through %s", -- rt.rt_dev); -+ u_int32_t old_gateway = SIN_ADDR(rt.rt_gateway); -+ -+ if (old_gateway != gateway) -+ error("not replacing existing default route to %s [%I]", -+ rt.rt_dev, old_gateway); - return 0; - } - -- memset (&rt, 0, sizeof (rt)); -- SET_SA_FAMILY (rt.rt_dst, AF_INET); -+ memset (&rt, '\0', sizeof (rt)); -+ SET_SA_FAMILY (rt.rt_dst, AF_INET); -+ SET_SA_FAMILY (rt.rt_gateway, AF_INET); - - rt.rt_dev = ifname; - -@@ -1658,14 +1658,16 @@ - SIN_ADDR(rt.rt_genmask) = 0L; - } - -- rt.rt_flags = RTF_UP; -+ SIN_ADDR(rt.rt_gateway) = gateway; -+ -+ rt.rt_flags = RTF_UP | RTF_GATEWAY; - if (ioctl(sock_fd, SIOCADDRT, &rt) < 0) { - if ( ! ok_error ( errno )) - error("default route ioctl(SIOCADDRT): %m"); - return 0; - } - -- have_default_route = 1; -+ default_route_gateway = gateway; - return 1; - } - -@@ -1678,7 +1680,7 @@ - { - struct rtentry rt; - -- have_default_route = 0; -+ default_route_gateway = 0; - - memset (&rt, '\0', sizeof (rt)); - SET_SA_FAMILY (rt.rt_dst, AF_INET); -@@ -1691,7 +1693,9 @@ - SIN_ADDR(rt.rt_genmask) = 0L; - } - -- rt.rt_flags = RTF_UP; -+ SIN_ADDR(rt.rt_gateway) = gateway; -+ -+ rt.rt_flags = RTF_UP | RTF_GATEWAY; - if (ioctl(sock_fd, SIOCDELRT, &rt) < 0 && errno != ESRCH) { - if (still_ppp()) { - if ( ! ok_error ( errno )) diff --git a/network/connection/ppp/files/gentoo/12_all_linkpidfile.patch b/network/connection/ppp/files/gentoo/12_all_linkpidfile.patch deleted file mode 100644 index 887597aeef..0000000000 --- a/network/connection/ppp/files/gentoo/12_all_linkpidfile.patch +++ /dev/null @@ -1,97 +0,0 @@ -diff -Nru ppp-2.4.5.orig/pppd/auth.c ppp-2.4.5/pppd/auth.c ---- ppp-2.4.5.orig/pppd/auth.c 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/auth.c 2010-08-08 09:57:01.000000000 +0200 -@@ -637,7 +637,7 @@ - * we delete its pid file. - */ - if (!doing_multilink && !demand) -- remove_pidfiles(); -+ remove_pidfile(pidfilename); - - /* - * If we may want to bring the link up again, transfer -diff -Nru ppp-2.4.5.orig/pppd/main.c ppp-2.4.5/pppd/main.c ---- ppp-2.4.5.orig/pppd/main.c 2010-08-08 09:46:42.000000000 +0200 -+++ ppp-2.4.5/pppd/main.c 2010-08-08 09:57:01.000000000 +0200 -@@ -134,7 +134,7 @@ - - char *progname; /* Name of this program */ - char hostname[MAXNAMELEN]; /* Our hostname */ --static char pidfilename[MAXPATHLEN]; /* name of pid file */ -+char pidfilename[MAXPATHLEN]; /* name of pid file */ - static char linkpidfile[MAXPATHLEN]; /* name of linkname pid file */ - char ppp_devnam[MAXPATHLEN]; /* name of PPP tty (maybe ttypx) */ - uid_t uid; /* Our real user-id */ -@@ -245,6 +245,7 @@ - static void toggle_debug __P((int)); - static void open_ccp __P((int)); - static void bad_signal __P((int)); -+static void remove_pidfilenames __P((void)); - static void holdoff_end __P((void *)); - static void forget_child __P((int pid, int status)); - static int reap_kids __P((void)); -@@ -835,16 +836,24 @@ - } - - /* -- * remove_pidfile - remove our pid files -+ * remove_pidfile - remove one of the 2 pidfiles (pidfilename or linkpidfile) - */ --void remove_pidfiles() -+void -+remove_pidfile(filename) -+ char* filename; - { -- if (pidfilename[0] != 0 && unlink(pidfilename) < 0 && errno != ENOENT) -- warn("unable to delete pid file %s: %m", pidfilename); -- pidfilename[0] = 0; -- if (linkpidfile[0] != 0 && unlink(linkpidfile) < 0 && errno != ENOENT) -- warn("unable to delete pid file %s: %m", linkpidfile); -- linkpidfile[0] = 0; -+ if (filename[0] != 0 && unlink(filename) < 0 && errno != ENOENT) -+ warn("unable to delete pid file %s: %m", filename); -+ filename[0] = 0; -+} -+ -+/* -+ * remove_pidfiles - remove our pid files -+ */ -+static void remove_pidfiles() -+{ -+ remove_pidfile(pidfilename); -+ remove_pidfile(linkpidfile); - } - - /* -diff -Nru ppp-2.4.5.orig/pppd/multilink.c ppp-2.4.5/pppd/multilink.c ---- ppp-2.4.5.orig/pppd/multilink.c 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/multilink.c 2010-08-08 09:57:01.000000000 +0200 -@@ -267,7 +267,7 @@ - notice("Connection terminated."); - print_link_stats(); - if (!demand) { -- remove_pidfiles(); -+ remove_pidfile(pidfilename); - script_unsetenv("IFNAME"); - } - -diff -Nru ppp-2.4.5.orig/pppd/pppd.h ppp-2.4.5/pppd/pppd.h ---- ppp-2.4.5.orig/pppd/pppd.h 2010-08-08 09:44:29.000000000 +0200 -+++ ppp-2.4.5/pppd/pppd.h 2010-08-08 09:57:01.000000000 +0200 -@@ -214,6 +214,7 @@ - extern int ifunit; /* Interface unit number */ - extern char ifname[]; /* Interface name */ - extern char hostname[]; /* Our hostname */ -+extern char pidfilename[]; /* name of pid file */ - extern u_char outpacket_buf[]; /* Buffer for outgoing packets */ - extern int devfd; /* fd of underlying device */ - extern int fd_ppp; /* fd for talking PPP */ -@@ -497,7 +498,7 @@ - int ppp_send_config __P((int, int, u_int32_t, int, int)); - int ppp_recv_config __P((int, int, u_int32_t, int, int)); - const char *protocol_name __P((int)); --void remove_pidfiles __P((void)); -+void remove_pidfile __P((char *)); - void lock_db __P((void)); - void unlock_db __P((void)); - diff --git a/network/connection/ppp/files/gentoo/16_all_auth-fail.patch b/network/connection/ppp/files/gentoo/16_all_auth-fail.patch deleted file mode 100644 index 92487d17e7..0000000000 --- a/network/connection/ppp/files/gentoo/16_all_auth-fail.patch +++ /dev/null @@ -1,141 +0,0 @@ -diff -Nru ppp-2.4.5.orig/pppd/auth.c ppp-2.4.5/pppd/auth.c ---- ppp-2.4.5.orig/pppd/auth.c 2010-08-08 09:58:19.000000000 +0200 -+++ ppp-2.4.5/pppd/auth.c 2010-08-08 10:06:06.000000000 +0200 -@@ -259,7 +259,7 @@ - struct wordlist **, struct wordlist **, - char *, int)); - static void free_wordlist __P((struct wordlist *)); --static void auth_script __P((char *)); -+static void auth_script __P((char *, int)); - static void auth_script_done __P((void *)); - static void set_allowed_addrs __P((int, struct wordlist *, struct wordlist *)); - static int some_ip_ok __P((struct wordlist *)); -@@ -690,7 +690,7 @@ - if (auth_script_state == s_up && auth_script_pid == 0) { - update_link_stats(unit); - auth_script_state = s_down; -- auth_script(_PATH_AUTHDOWN); -+ auth_script(_PATH_AUTHDOWN, 0); - } - } - if (!doing_multilink) { -@@ -822,7 +822,7 @@ - auth_state = s_up; - if (auth_script_state == s_down && auth_script_pid == 0) { - auth_script_state = s_up; -- auth_script(_PATH_AUTHUP); -+ auth_script(_PATH_AUTHUP, 0); - } - } - -@@ -923,6 +923,7 @@ - * Authentication failure: take the link down - */ - status = EXIT_PEER_AUTH_FAILED; -+ auth_script(_PATH_AUTHFAIL, 1); - lcp_close(unit, "Authentication failed"); - } - -@@ -1001,6 +1002,7 @@ - * authentication secrets. - */ - status = EXIT_AUTH_TOPEER_FAILED; -+ auth_script(_PATH_AUTHFAIL, 1); - lcp_close(unit, "Failed to authenticate ourselves to peer"); - } - -@@ -1233,6 +1235,8 @@ - if (user[0] == 0 && !explicit_user) - strlcpy(user, our_name, sizeof(user)); - -+ script_setenv("LOCALNAME", user, 0); -+ - /* - * If we have a default route, require the peer to authenticate - * unless the noauth option was given or the real user is root. -@@ -2314,13 +2318,13 @@ - case s_up: - if (auth_state == s_down) { - auth_script_state = s_down; -- auth_script(_PATH_AUTHDOWN); -+ auth_script(_PATH_AUTHDOWN, 0); - } - break; - case s_down: - if (auth_state == s_up) { - auth_script_state = s_up; -- auth_script(_PATH_AUTHUP); -+ auth_script(_PATH_AUTHUP, 0); - } - break; - } -@@ -2331,8 +2335,9 @@ - * interface-name peer-name real-user tty speed - */ - static void --auth_script(script) -+auth_script(script, wait) - char *script; -+ int wait; - { - char strspeed[32]; - struct passwd *pw; -@@ -2356,5 +2361,8 @@ - argv[5] = strspeed; - argv[6] = NULL; - -- auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); -+ if (wait) -+ run_program(script, argv, 0, NULL, NULL, 1); -+ else -+ auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); - } -diff -Nru ppp-2.4.5.orig/pppd/pathnames.h ppp-2.4.5/pppd/pathnames.h ---- ppp-2.4.5.orig/pppd/pathnames.h 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/pathnames.h 2010-08-08 10:06:06.000000000 +0200 -@@ -27,6 +27,7 @@ - #define _PATH_IPPREUP _ROOT_PATH "/etc/ppp/ip-pre-up" - #define _PATH_AUTHUP _ROOT_PATH "/etc/ppp/auth-up" - #define _PATH_AUTHDOWN _ROOT_PATH "/etc/ppp/auth-down" -+#define _PATH_AUTHFAIL _ROOT_PATH "/etc/ppp/auth-fail" - #define _PATH_TTYOPT _ROOT_PATH "/etc/ppp/options." - #define _PATH_CONNERRS _ROOT_PATH "/etc/ppp/connect-errors" - #define _PATH_PEERFILES _ROOT_PATH "/etc/ppp/peers/" -diff -Nru ppp-2.4.5.orig/pppd/pppd.8 ppp-2.4.5/pppd/pppd.8 ---- ppp-2.4.5.orig/pppd/pppd.8 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/pppd.8 2010-08-08 10:06:06.000000000 +0200 -@@ -1553,8 +1553,8 @@ - Pppd invokes scripts at various stages in its processing which can be - used to perform site-specific ancillary processing. These scripts are - usually shell scripts, but could be executable code files instead. --Pppd does not wait for the scripts to finish (except for the ip-pre-up --script). The scripts are -+Pppd does not wait for the scripts to finish (except for the ip-pre-up, -+and auth-fail scripts). The scripts are - executed as root (with the real and effective user-id set to 0), so - that they can do things such as update routing tables or run - privileged daemons. Be careful that the contents of these scripts do -@@ -1582,6 +1582,11 @@ - The authenticated name of the peer. This is only set if the peer - authenticates itself. - .TP -+.B LOCALNAME -+The username passed to the user option of the pppd daemon. This is -+handy to identify which account was used for authentication purposes -+when multiple accounts are available. -+.TP - .B SPEED - The baud rate of the tty device. - .TP -@@ -1634,6 +1639,11 @@ - /etc/ppp/auth\-up was previously executed. It is executed in the same - manner with the same parameters as /etc/ppp/auth\-up. - .TP -+.B /etc/ppp/auth\-fail -+A program or script which is executed should authentication fail. pppd -+waits for this script to finish. It is executed in the same manner, with -+the same parameters as /etc/ppp/auth\-up. -+.TP - .B /etc/ppp/ip\-pre\-up - A program or script which is executed just before the ppp network - interface is brought up. It is executed with the same parameters as diff --git a/network/connection/ppp/files/gentoo/18_all_defaultmetric.patch b/network/connection/ppp/files/gentoo/18_all_defaultmetric.patch deleted file mode 100644 index c71bf324ba..0000000000 --- a/network/connection/ppp/files/gentoo/18_all_defaultmetric.patch +++ /dev/null @@ -1,108 +0,0 @@ -diff -Nru ppp-2.4.5.orig/pppd/options.c ppp-2.4.5/pppd/options.c ---- ppp-2.4.5.orig/pppd/options.c 2010-08-08 09:44:29.000000000 +0200 -+++ ppp-2.4.5/pppd/options.c 2010-08-08 10:07:50.000000000 +0200 -@@ -94,6 +94,7 @@ - int kdebugflag = 0; /* Tell kernel to print debug messages */ - int default_device = 1; /* Using /dev/tty or equivalent */ - char devnam[MAXPATHLEN]; /* Device name */ -+int defaultmetric = 0; /* Metric of the default route */ - bool nodetach = 0; /* Don't detach from controlling tty */ - bool updetach = 0; /* Detach once link is up */ - int maxconnect = 0; /* Maximum connect time */ -@@ -289,6 +290,10 @@ - "Number of seconds to wait for child processes at exit", - OPT_PRIO }, - -+ { "defaultmetric", o_int, &defaultmetric, -+ "The metric of the default route", -+ OPT_LIMITS, 0, 32766 }, -+ - #ifdef HAVE_MULTILINK - { "multilink", o_bool, &multilink, - "Enable multilink operation", OPT_PRIO | 1 }, -diff -Nru ppp-2.4.5.orig/pppd/pppd.8 ppp-2.4.5/pppd/pppd.8 ---- ppp-2.4.5.orig/pppd/pppd.8 2010-08-08 10:06:57.000000000 +0200 -+++ ppp-2.4.5/pppd/pppd.8 2010-08-08 10:07:50.000000000 +0200 -@@ -121,6 +121,9 @@ - This entry is removed when the PPP connection is broken. This option - is privileged if the \fInodefaultroute\fR option has been specified. - .TP -+.B defaultmetric \fIn -+The metric of the default route configured by pppd; default is 0. -+.TP - .B disconnect \fIscript - Execute the command specified by \fIscript\fR, by passing it to a - shell, after -diff -Nru ppp-2.4.5.orig/pppd/pppd.h ppp-2.4.5/pppd/pppd.h ---- ppp-2.4.5.orig/pppd/pppd.h 2010-08-08 09:58:19.000000000 +0200 -+++ ppp-2.4.5/pppd/pppd.h 2010-08-08 10:07:50.000000000 +0200 -@@ -276,6 +276,7 @@ - extern int kdebugflag; /* Tell kernel to print debug messages */ - extern int default_device; /* Using /dev/tty or equivalent */ - extern char devnam[MAXPATHLEN]; /* Device name */ -+extern int defaultmetric; /* Metric of the default route */ - extern int crtscts; /* Use hardware flow control */ - extern bool modem; /* Use modem control lines */ - extern int inspeed; /* Input/Output speed requested */ -diff -Nru ppp-2.4.5.orig/pppd/sys-linux.c ppp-2.4.5/pppd/sys-linux.c ---- ppp-2.4.5.orig/pppd/sys-linux.c 2010-08-08 09:53:56.000000000 +0200 -+++ ppp-2.4.5/pppd/sys-linux.c 2010-08-08 10:07:50.000000000 +0200 -@@ -1465,7 +1465,7 @@ - FILE *route_fd = (FILE *) 0; - static char route_buffer[512]; - static int route_dev_col, route_dest_col, route_gw_col; --static int route_flags_col, route_mask_col; -+static int route_flags_col, route_mask_col, route_metric_col; - static int route_num_cols; - - static int open_route_table (void); -@@ -1508,6 +1508,7 @@ - route_dest_col = 1; - route_gw_col = 2; - route_flags_col = 3; -+ route_metric_col = 6; - route_mask_col = 7; - route_num_cols = 8; - -@@ -1527,6 +1528,8 @@ - route_gw_col = col; - else if (strcasecmp(q, "flags") == 0) - route_flags_col = col; -+ else if (strcasecmp(q, "metric") == 0) -+ route_metric_col = col; - else if (strcasecmp(q, "mask") == 0) - route_mask_col = col; - else -@@ -1569,6 +1572,7 @@ - - rt->rt_flags = (short) strtoul(cols[route_flags_col], NULL, 16); - rt->rt_dev = cols[route_dev_col]; -+ rt->rt_metric = (short) strtoul(cols[route_metric_col], NULL, 16); - - return 1; - } -@@ -1591,6 +1595,8 @@ - - if (kernel_version > KVERSION(2,1,0) && SIN_ADDR(rt->rt_genmask) != 0) - continue; -+ if (rt->rt_metric != defaultmetric) /* consider only routes with the same metric */ -+ continue; - if (SIN_ADDR(rt->rt_dst) == 0L) { - result = 1; - break; -@@ -1661,6 +1667,7 @@ - SIN_ADDR(rt.rt_gateway) = gateway; - - rt.rt_flags = RTF_UP | RTF_GATEWAY; -+ rt.rt_metric = defaultmetric + 1; /* +1 for binary compatibility */ - if (ioctl(sock_fd, SIOCADDRT, &rt) < 0) { - if ( ! ok_error ( errno )) - error("default route ioctl(SIOCADDRT): %m"); -@@ -1696,6 +1703,7 @@ - SIN_ADDR(rt.rt_gateway) = gateway; - - rt.rt_flags = RTF_UP | RTF_GATEWAY; -+ rt.rt_metric = defaultmetric + 1; /* +1 for binary compatibility */ - if (ioctl(sock_fd, SIOCDELRT, &rt) < 0 && errno != ESRCH) { - if (still_ppp()) { - if ( ! ok_error ( errno )) diff --git a/network/connection/ppp/files/gentoo/20_all_dev-ppp.patch b/network/connection/ppp/files/gentoo/20_all_dev-ppp.patch deleted file mode 100644 index eff3e37f08..0000000000 --- a/network/connection/ppp/files/gentoo/20_all_dev-ppp.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- ppp-2.4.6/pppd/sys-linux.c -+++ ppp-2.4.6/pppd/sys-linux.c -@@ -2031,6 +2031,17 @@ - kernel_version = KVERSION(osmaj, osmin, ospatch); - - fd = open("/dev/ppp", O_RDWR); -+ if (fd < 0) { -+ /* try making it and see if that helps. */ -+ if (errno == ENOENT && mknod("/dev/ppp", S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP, -+ makedev(108, 0)) >= 0) { -+ fd = open("/dev/ppp", O_RDWR); -+ if (fd >= 0) -+ info("Created /dev/ppp device node"); -+ else -+ unlink("/dev/ppp"); /* didn't work, undo the mknod */ -+ } -+ } - if (fd >= 0) { - new_style_driver = 1; - diff --git a/network/connection/ppp/files/gentoo/24_all_passwordfd-read-early.patch b/network/connection/ppp/files/gentoo/24_all_passwordfd-read-early.patch deleted file mode 100644 index f64f09366f..0000000000 --- a/network/connection/ppp/files/gentoo/24_all_passwordfd-read-early.patch +++ /dev/null @@ -1,85 +0,0 @@ -diff -Nru ppp-2.4.5.orig/pppd/plugins/passwordfd.c ppp-2.4.5/pppd/plugins/passwordfd.c ---- ppp-2.4.5.orig/pppd/plugins/passwordfd.c 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/plugins/passwordfd.c 2010-08-08 10:41:39.000000000 +0200 -@@ -16,11 +16,11 @@ - - char pppd_version[] = VERSION; - --static int passwdfd = -1; - static char save_passwd[MAXSECRETLEN]; - -+static int readpassword __P((char **)); - static option_t options[] = { -- { "passwordfd", o_int, &passwdfd, -+ { "passwordfd", o_special, (void *)readpassword, - "Receive password on this file descriptor" }, - { NULL } - }; -@@ -30,43 +30,39 @@ - return 1; - } - --static int pwfd_passwd (char *user, char *passwd) -+static int readpassword(char **argv) - { -- int readgood, red; -- -- if (passwdfd == -1) -- return -1; -- -- if (passwd == NULL) -- return 1; -- -- if (passwdfd == -2) { -- strcpy (passwd, save_passwd); -- return 1; -+ char *arg = *argv; -+ int passwdfd = -1; -+ int chunk, len; -+ -+ if (sscanf(arg, "%d", &passwdfd) != 1 || passwdfd < 0) -+ { -+ error ("\"%s\" is not a valid file descriptor number", arg); -+ return 0; - } - -- readgood = 0; -+ len = 0; - do { -- red = read (passwdfd, passwd + readgood, MAXSECRETLEN - 1 - readgood); -- if (red == 0) -- break; -- if (red < 0) { -- error ("Can't read secret from fd\n"); -- readgood = -1; -+ chunk = read (passwdfd, save_passwd + len, MAXSECRETLEN - 1 - len); -+ if (chunk == 0) - break; -+ if (chunk < 0) { -+ error ("Can't read secret from fd %d", passwdfd); -+ return 0; - } -- readgood += red; -- } while (readgood < MAXSECRETLEN - 1); -- -+ len += chunk; -+ } while (len < MAXSECRETLEN - 1); -+ save_passwd[len] = 0; - close (passwdfd); - -- if (readgood < 0) -- return 0; -- -- passwd[readgood] = 0; -- strcpy (save_passwd, passwd); -- passwdfd = -2; -+ return 1; -+} - -+static int pwfd_passwd (char *user, char *passwd) -+{ -+ if (passwd != NULL) -+ strcpy (passwd, save_passwd); - return 1; - } - diff --git a/network/connection/ppp/files/gentoo/26_all_pppd-usepeerwins.patch b/network/connection/ppp/files/gentoo/26_all_pppd-usepeerwins.patch deleted file mode 100644 index d66fbe0b1c..0000000000 --- a/network/connection/ppp/files/gentoo/26_all_pppd-usepeerwins.patch +++ /dev/null @@ -1,256 +0,0 @@ ---- ppp-2.4.6/pppd/ipcp.c -+++ ppp-2.4.6/pppd/ipcp.c -@@ -91,6 +91,7 @@ - static int default_route_set[NUM_PPP]; /* Have set up a default route */ - static int proxy_arp_set[NUM_PPP]; /* Have created proxy arp entry */ - static bool usepeerdns; /* Ask peer for DNS addrs */ -+static bool usepeerwins; /* Ask peer for WINS addrs */ - static int ipcp_is_up; /* have called np_up() */ - static int ipcp_is_open; /* haven't called np_finished() */ - static bool ask_for_local; /* request our address from peer */ -@@ -210,6 +211,9 @@ - { "usepeerdns", o_bool, &usepeerdns, - "Ask peer for DNS address(es)", 1 }, - -+ { "usepeerwins", o_bool, &usepeerwins, -+ "Ask peer for WINS address(es)", 1 }, -+ - { "netmask", o_special, (void *)setnetmask, - "set netmask", OPT_PRIO | OPT_A2STRVAL | OPT_STATIC, netmask_str }, - -@@ -703,6 +707,8 @@ - wo->accept_remote = 1; - wo->req_dns1 = usepeerdns; /* Request DNS addresses from the peer */ - wo->req_dns2 = usepeerdns; -+ wo->req_wins1 = usepeerwins; /* Request WINS addresses from the peer */ -+ wo->req_wins2 = usepeerwins; - *go = *wo; - if (!ask_for_local) - go->ouraddr = 0; -@@ -755,8 +761,8 @@ - LENCIADDR(go->neg_addr) + - LENCIDNS(go->req_dns1) + - LENCIDNS(go->req_dns2) + -- LENCIWINS(go->winsaddr[0]) + -- LENCIWINS(go->winsaddr[1])) ; -+ LENCIWINS(go->req_wins1) + -+ LENCIWINS(go->req_wins2)) ; - } - - -@@ -830,8 +836,8 @@ - neg = 0; \ - } - --#define ADDCIWINS(opt, addr) \ -- if (addr) { \ -+#define ADDCIWINS(opt, neg, addr) \ -+ if (neg) { \ - if (len >= CILEN_ADDR) { \ - u_int32_t l; \ - PUTCHAR(opt, ucp); \ -@@ -840,7 +846,7 @@ - PUTLONG(l, ucp); \ - len -= CILEN_ADDR; \ - } else \ -- addr = 0; \ -+ neg = 0; \ - } - - ADDCIADDRS(CI_ADDRS, !go->neg_addr && go->old_addrs, go->ouraddr, -@@ -855,9 +861,9 @@ - - ADDCIDNS(CI_MS_DNS2, go->req_dns2, go->dnsaddr[1]); - -- ADDCIWINS(CI_MS_WINS1, go->winsaddr[0]); -+ ADDCIWINS(CI_MS_WINS1, go->req_wins1, go->winsaddr[0]); - -- ADDCIWINS(CI_MS_WINS2, go->winsaddr[1]); -+ ADDCIWINS(CI_MS_WINS2, go->req_wins2, go->winsaddr[1]); - - *lenp -= len; - } -@@ -962,8 +968,8 @@ - goto bad; \ - } - --#define ACKCIWINS(opt, addr) \ -- if (addr) { \ -+#define ACKCIWINS(opt, neg, addr) \ -+ if (neg) { \ - u_int32_t l; \ - if ((len -= CILEN_ADDR) < 0) \ - goto bad; \ -@@ -989,9 +995,9 @@ - - ACKCIDNS(CI_MS_DNS2, go->req_dns2, go->dnsaddr[1]); - -- ACKCIWINS(CI_MS_WINS1, go->winsaddr[0]); -+ ACKCIWINS(CI_MS_WINS1, go->req_wins1, go->winsaddr[0]); - -- ACKCIWINS(CI_MS_WINS2, go->winsaddr[1]); -+ ACKCIWINS(CI_MS_WINS2, go->req_wins2, go->winsaddr[1]); - - /* - * If there are any remaining CIs, then this packet is bad. -@@ -1026,7 +1032,7 @@ - u_char cimaxslotindex, cicflag; - u_char citype, cilen, *next; - u_short cishort; -- u_int32_t ciaddr1, ciaddr2, l, cidnsaddr; -+ u_int32_t ciaddr1, ciaddr2, l, cidnsaddr, ciwinsaddr; - ipcp_options no; /* options we've seen Naks for */ - ipcp_options try; /* options to request next time */ - -@@ -1091,6 +1097,19 @@ - code \ - } - -+#define NAKCIWINS(opt, neg, code) \ -+ if (go->neg && \ -+ ((cilen = p[1]) == CILEN_ADDR) && \ -+ len >= cilen && \ -+ p[0] == opt) { \ -+ len -= cilen; \ -+ INCPTR(2, p); \ -+ GETLONG(l, p); \ -+ ciwinsaddr = htonl(l); \ -+ no.neg = 1; \ -+ code \ -+ } -+ - /* - * Accept the peer's idea of {our,his} address, if different - * from our idea, only if the accept_{local,remote} flag is set. -@@ -1167,6 +1186,22 @@ - } - ); - -+ NAKCIWINS(CI_MS_WINS1, req_wins1, -+ if (treat_as_reject) { -+ try.req_wins1 = 0; -+ } else { -+ try.winsaddr[0] = ciwinsaddr; -+ } -+ ); -+ -+ NAKCIWINS(CI_MS_WINS2, req_wins2, -+ if (treat_as_reject) { -+ try.req_wins2 = 0; -+ } else { -+ try.winsaddr[1] = ciwinsaddr; -+ } -+ ); -+ - /* - * There may be remaining CIs, if the peer is requesting negotiation - * on an option that we didn't include in our request packet. -@@ -1259,7 +1294,6 @@ - return 0; - } - -- - /* - * ipcp_rejci - Reject some of our CIs. - * Callback from fsm_rconfnakrej. -@@ -1357,8 +1391,8 @@ - try.neg = 0; \ - } - --#define REJCIWINS(opt, addr) \ -- if (addr && \ -+#define REJCIWINS(opt, neg, addr) \ -+ if (go->neg && \ - ((cilen = p[1]) == CILEN_ADDR) && \ - len >= cilen && \ - p[0] == opt) { \ -@@ -1370,7 +1404,7 @@ - /* Check rejected value. */ \ - if (cilong != addr) \ - goto bad; \ -- try.winsaddr[opt == CI_MS_WINS2] = 0; \ -+ try.neg = 0; \ - } - - REJCIADDRS(CI_ADDRS, !go->neg_addr && go->old_addrs, -@@ -1385,9 +1419,9 @@ - - REJCIDNS(CI_MS_DNS2, req_dns2, go->dnsaddr[1]); - -- REJCIWINS(CI_MS_WINS1, go->winsaddr[0]); -+ REJCIWINS(CI_MS_WINS1, req_wins1, go->winsaddr[0]); - -- REJCIWINS(CI_MS_WINS2, go->winsaddr[1]); -+ REJCIWINS(CI_MS_WINS2, req_wins2, go->winsaddr[1]); - - /* - * If there are any remaining CIs, then this packet is bad. -@@ -1581,7 +1615,7 @@ - /* Microsoft primary or secondary WINS request */ - d = citype == CI_MS_WINS2; - -- /* If we do not have a DNS address then we cannot send it */ -+ /* If we do not have a WINS address then we cannot send it */ - if (ao->winsaddr[d] == 0 || - cilen != CILEN_ADDR) { /* Check CI length */ - orc = CONFREJ; /* Reject CI */ -@@ -1830,6 +1864,13 @@ - create_resolv(go->dnsaddr[0], go->dnsaddr[1]); - } - -+ if (go->winsaddr[0]) -+ script_setenv("WINS1", ip_ntoa(go->winsaddr[0]), 0); -+ if (go->winsaddr[1]) -+ script_setenv("WINS2", ip_ntoa(go->winsaddr[1]), 0); -+ if (usepeerwins && (go->winsaddr[0] || go->winsaddr[1])) -+ script_setenv("USEPEERWINS", "1", 0); -+ - /* - * Check that the peer is allowed to use the IP address it wants. - */ ---- ppp-2.4.6/pppd/ipcp.h -+++ ppp-2.4.6/pppd/ipcp.h -@@ -77,6 +77,8 @@ - bool accept_remote; /* accept peer's value for hisaddr */ - bool req_dns1; /* Ask peer to send primary DNS address? */ - bool req_dns2; /* Ask peer to send secondary DNS address? */ -+ bool req_wins1; /* Ask peer to send primary WINS address? */ -+ bool req_wins2; /* Ask peer to send secondary WINS address? */ - int vj_protocol; /* protocol value to use in VJ option */ - int maxslotindex; /* values for RFC1332 VJ compression neg. */ - bool cflag; ---- ppp-2.4.6/pppd/pppd.8 -+++ ppp-2.4.6/pppd/pppd.8 -@@ -1102,6 +1102,16 @@ - /etc/ppp/resolv.conf file containing one or two nameserver lines with - the address(es) supplied by the peer. - .TP -+.B usepeerwins -+Ask the peer for up to 2 WINS server addresses. The addresses supplied -+by the peer (if any) are passed to the /etc/ppp/ip\-up script in the -+environment variables WINS1 and WINS2, and the environment variable -+USEPEERWINS will be set to 1. -+.LP -+Please note that some modems (like the Huawei E220) requires this option in -+order to avoid a race condition that results in the incorrect DNS servers -+being assigned. -+.TP - .B user \fIname - Sets the name used for authenticating the local system to the peer to - \fIname\fR. -@@ -1650,6 +1660,15 @@ - If the peer supplies DNS server addresses, this variable is set to the - second DNS server address supplied (whether or not the usepeerdns - option was given). -+.TP -+.B WINS1 -+If the peer supplies WINS server addresses, this variable is set to the -+first WINS server address supplied. -+.TP -+.B WINS2 -+If the peer supplies WINS server addresses, this variable is set to the -+second WINS server address supplied. -+.P - .P - Pppd invokes the following scripts, if they exist. It is not an error - if they don't exist. diff --git a/network/connection/ppp/files/gentoo/28_all_connect-errors.patch b/network/connection/ppp/files/gentoo/28_all_connect-errors.patch deleted file mode 100644 index f3b7b18cb6..0000000000 --- a/network/connection/ppp/files/gentoo/28_all_connect-errors.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Nru ppp-2.4.5.orig/pppd/pathnames.h ppp-2.4.5/pppd/pathnames.h ---- ppp-2.4.5.orig/pppd/pathnames.h 2010-08-08 10:06:57.000000000 +0200 -+++ ppp-2.4.5/pppd/pathnames.h 2010-08-08 10:53:51.000000000 +0200 -@@ -29,7 +29,7 @@ - #define _PATH_AUTHDOWN _ROOT_PATH "/etc/ppp/auth-down" - #define _PATH_AUTHFAIL _ROOT_PATH "/etc/ppp/auth-fail" - #define _PATH_TTYOPT _ROOT_PATH "/etc/ppp/options." --#define _PATH_CONNERRS _ROOT_PATH "/etc/ppp/connect-errors" -+#define _PATH_CONNERRS _ROOT_PATH "/var/log/ppp-connect-errors" - #define _PATH_PEERFILES _ROOT_PATH "/etc/ppp/peers/" - #define _PATH_RESOLV _ROOT_PATH "/etc/ppp/resolv.conf" - diff --git a/network/connection/ppp/files/gentoo/30_all_Makefile.patch b/network/connection/ppp/files/gentoo/30_all_Makefile.patch deleted file mode 100644 index e3a406240e..0000000000 --- a/network/connection/ppp/files/gentoo/30_all_Makefile.patch +++ /dev/null @@ -1,37 +0,0 @@ -Ensure that the build process aborts if there is an error in one of -the plugin subdirectories. - -2010-09-01 Martin von Gagern - -References: -http://bugs.gentoo.org/334727 - -Index: ppp-2.4.5/pppd/plugins/Makefile.linux -=================================================================== ---- ppp-2.4.5.orig/pppd/plugins/Makefile.linux -+++ ppp-2.4.5/pppd/plugins/Makefile.linux -@@ -20,7 +20,7 @@ include .depend - endif - - all: $(PLUGINS) -- for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done -+ for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all || exit $?; done - - %.so: %.c - $(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^ -@@ -30,12 +30,12 @@ VERSION = $(shell awk -F '"' '/VERSION/ - install: $(PLUGINS) - $(INSTALL) -d $(LIBDIR) - $(INSTALL) $? $(LIBDIR) -- for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d install; done -+ for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d install || exit $?; done - - clean: - rm -f *.o *.so *.a -- for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d clean; done -+ for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d clean || exit $?; done - - depend: - $(CPP) -M $(CFLAGS) *.c >.depend -- for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d depend; done -+ for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d depend || exit $?; done diff --git a/network/connection/ppp/files/gentoo/32_all_pado-timeout.patch b/network/connection/ppp/files/gentoo/32_all_pado-timeout.patch deleted file mode 100644 index 72f1adbb1e..0000000000 --- a/network/connection/ppp/files/gentoo/32_all_pado-timeout.patch +++ /dev/null @@ -1,254 +0,0 @@ ---- ppp-2.4.6/pppd/plugins/rp-pppoe/discovery.c -+++ ppp-2.4.6/pppd/plugins/rp-pppoe/discovery.c -@@ -39,6 +39,7 @@ - #endif - - #include -+#include - - /* Calculate time remaining until *exp, return 0 if now >= *exp */ - static int time_left(struct timeval *diff, struct timeval *exp) -@@ -251,6 +252,80 @@ - } - - /*********************************************************************** -+*%FUNCTION: recvPacketForMe -+*%ARGUMENTS: -+* packet -- output parameter -+* len -- output parameter length -+* conn -- connection -+* start -- operation startup timestamp -+* timeout -- how long to wait (in seconds) -+*%RETURNS: -+* -1: error -+* 0: timed out -+* 1: packet received -+*%DESCRIPTION: -+* receive and filter junk packets -+***********************************************************************/ -+ -+static int -+recvPacketForMe(PPPoEPacket *packet, int *len, PPPoEConnection *conn, time_t start, int timeout) -+{ -+ fd_set readable; -+ int r; -+ struct timeval tv; -+ time_t now; -+ int time_remain; -+ -+ do { -+ time(&now); -+ time_remain = timeout - (int)difftime(now, start); -+ if (time_remain <= 0) return 0; /* Timed out */ -+ -+ if (BPF_BUFFER_IS_EMPTY) { -+ tv.tv_sec = time_remain; -+ tv.tv_usec = 0; -+ -+ FD_ZERO(&readable); -+ FD_SET(conn->discoverySocket, &readable); -+ -+ r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv); -+ if (r < 0) -+ { -+ if (errno == EINTR) -+ { -+ continue; /* interrupted, so retry */ -+ }else -+ { -+ error("pppoe: recvPacketForMe: select: %m"); -+ return -1; -+ } -+ } -+ -+ if (r == 0) return 0; /* Timed out */ -+ } -+ -+ /* Get the packet */ -+ receivePacket(conn->discoverySocket, packet, len); -+ -+ /* Check length */ -+ if (ntohs(packet->length) + HDR_SIZE > *len) { -+ error("Bogus PPPoE length field (%u)", -+ (unsigned int) ntohs(packet->length)); -+ continue; -+ } -+ -+#ifdef USE_BPF -+ /* If it's not a Discovery packet, loop again */ -+ if (etherType(&packet) != Eth_PPPOE_Discovery) continue; -+#endif -+ /* If it's not for us, loop again */ -+ }while ( ! packetIsForMe(conn, packet)); -+ -+ return 1; -+} -+ -+ -+/*********************************************************************** - *%FUNCTION: sendPADI - *%ARGUMENTS: - * conn -- PPPoEConnection structure -@@ -344,13 +419,12 @@ - void - waitForPADO(PPPoEConnection *conn, int timeout) - { -- fd_set readable; - int r; -- struct timeval tv; - struct timeval expire_at; - - PPPoEPacket packet; - int len; -+ time_t start; - - struct PacketCriteria pc; - pc.conn = conn; -@@ -367,43 +441,10 @@ - } - expire_at.tv_sec += timeout; - -+ time(&start); - do { -- if (BPF_BUFFER_IS_EMPTY) { -- if (!time_left(&tv, &expire_at)) -- return; /* Timed out */ -- -- FD_ZERO(&readable); -- FD_SET(conn->discoverySocket, &readable); -- -- while(1) { -- r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv); -- if (r >= 0 || errno != EINTR) break; -- } -- if (r < 0) { -- error("select (waitForPADO): %m"); -- return; -- } -- if (r == 0) -- return; /* Timed out */ -- } -- -- /* Get the packet */ -- receivePacket(conn->discoverySocket, &packet, &len); -- -- /* Check length */ -- if (ntohs(packet.length) + HDR_SIZE > len) { -- error("Bogus PPPoE length field (%u)", -- (unsigned int) ntohs(packet.length)); -- continue; -- } -- --#ifdef USE_BPF -- /* If it's not a Discovery packet, loop again */ -- if (etherType(&packet) != Eth_PPPOE_Discovery) continue; --#endif -- -- /* If it's not for us, loop again */ -- if (!packetIsForMe(conn, &packet)) continue; -+ r = recvPacketForMe(&packet, &len, conn, start, timeout); -+ if (r<=0) return; /* Timed out or error */ - - if (packet.code == CODE_PADO) { - if (NOT_UNICAST(packet.ethHdr.h_source)) { -@@ -537,13 +578,12 @@ - static void - waitForPADS(PPPoEConnection *conn, int timeout) - { -- fd_set readable; - int r; -- struct timeval tv; - struct timeval expire_at; - - PPPoEPacket packet; - int len; -+ time_t start; - - if (gettimeofday(&expire_at, NULL) < 0) { - error("gettimeofday (waitForPADS): %m"); -@@ -551,48 +591,15 @@ - } - expire_at.tv_sec += timeout; - -+ time(&start); - conn->error = 0; - do { -- if (BPF_BUFFER_IS_EMPTY) { -- if (!time_left(&tv, &expire_at)) -- return; /* Timed out */ -- -- FD_ZERO(&readable); -- FD_SET(conn->discoverySocket, &readable); -- -- while(1) { -- r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv); -- if (r >= 0 || errno != EINTR) break; -- } -- if (r < 0) { -- error("select (waitForPADS): %m"); -- return; -- } -- if (r == 0) -- return; /* Timed out */ -- } -- -- /* Get the packet */ -- receivePacket(conn->discoverySocket, &packet, &len); -- -- /* Check length */ -- if (ntohs(packet.length) + HDR_SIZE > len) { -- error("Bogus PPPoE length field (%u)", -- (unsigned int) ntohs(packet.length)); -- continue; -- } -- --#ifdef USE_BPF -- /* If it's not a Discovery packet, loop again */ -- if (etherType(&packet) != Eth_PPPOE_Discovery) continue; --#endif -+ r = recvPacketForMe(&packet, &len, conn, start, timeout); -+ if (r<=0) return; /* Timed out or error */ - - /* If it's not from the AC, it's not for me */ - if (memcmp(packet.ethHdr.h_source, conn->peerEth, ETH_ALEN)) continue; - -- /* If it's not for us, loop again */ -- if (!packetIsForMe(conn, &packet)) continue; -- - /* Is it PADS? */ - if (packet.code == CODE_PADS) { - /* Parse for goodies */ ---- ppp-2.4.6/pppd/plugins/rp-pppoe/pppoe-discovery.c -+++ ppp-2.4.6/pppd/plugins/rp-pppoe/pppoe-discovery.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - #include "pppoe.h" - -@@ -513,6 +514,8 @@ - struct timeval tv; - PPPoEPacket packet; - int len; -+ time_t start, now; -+ int time_remain; - - struct PacketCriteria pc; - pc.conn = conn; -@@ -522,9 +525,13 @@ - pc.seenServiceName = 0; - conn->error = 0; - -+ time(&start); - do { -+ time(&now); -+ time_remain = timeout - (int)difftime(now, start); -+ if (time_remain <= 0) return; /* Timed out */ - if (BPF_BUFFER_IS_EMPTY) { -- tv.tv_sec = timeout; -+ tv.tv_sec = time_remain; - tv.tv_usec = 0; - - FD_ZERO(&readable); diff --git a/network/connection/ppp/files/gentoo/34_all_lcp-echo-adaptive.patch b/network/connection/ppp/files/gentoo/34_all_lcp-echo-adaptive.patch deleted file mode 100644 index b1549deb38..0000000000 --- a/network/connection/ppp/files/gentoo/34_all_lcp-echo-adaptive.patch +++ /dev/null @@ -1,58 +0,0 @@ -diff -Nru ppp-2.4.5.orig/pppd/lcp.c ppp-2.4.5/pppd/lcp.c ---- ppp-2.4.5.orig/pppd/lcp.c 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/lcp.c 2010-11-27 10:46:26.000000000 +0100 -@@ -73,6 +73,7 @@ - */ - int lcp_echo_interval = 0; /* Interval between LCP echo-requests */ - int lcp_echo_fails = 0; /* Tolerance to unanswered echo-requests */ -+bool lcp_echo_adaptive = 0; /* request echo only if the link was idle */ - bool lax_recv = 0; /* accept control chars in asyncmap */ - bool noendpoint = 0; /* don't send/accept endpoint discriminator */ - -@@ -151,6 +152,8 @@ - OPT_PRIO }, - { "lcp-echo-interval", o_int, &lcp_echo_interval, - "Set time in seconds between LCP echo requests", OPT_PRIO }, -+ { "lcp-echo-adaptive", o_bool, &lcp_echo_adaptive, -+ "Suppress LCP echo requests if traffic was received", 1 }, - { "lcp-restart", o_int, &lcp_fsm[0].timeouttime, - "Set time in seconds between LCP retransmissions", OPT_PRIO }, - { "lcp-max-terminate", o_int, &lcp_fsm[0].maxtermtransmits, -@@ -2322,6 +2325,22 @@ - } - - /* -+ * If adaptive echos have been enabled, only send the echo request if -+ * no traffic was received since the last one. -+ */ -+ if (lcp_echo_adaptive) { -+ static unsigned int last_pkts_in = 0; -+ -+ update_link_stats(f->unit); -+ link_stats_valid = 0; -+ -+ if (link_stats.pkts_in != last_pkts_in) { -+ last_pkts_in = link_stats.pkts_in; -+ return; -+ } -+ } -+ -+ /* - * Make and send the echo request frame. - */ - if (f->state == OPENED) { -diff -Nru ppp-2.4.5.orig/pppd/pppd.8 ppp-2.4.5/pppd/pppd.8 ---- ppp-2.4.5.orig/pppd/pppd.8 2009-11-16 23:26:07.000000000 +0100 -+++ ppp-2.4.5/pppd/pppd.8 2010-11-27 10:44:58.000000000 +0100 -@@ -549,6 +549,11 @@ - dynamic IP address option (i.e. set /proc/sys/net/ipv4/ip_dynaddr to - 1) in demand mode if the local address changes. - .TP -+.B lcp\-echo\-adaptive -+If this option is used with the \fIlcp\-echo\-failure\fR option then -+pppd will send LCP echo\-request frames only if no traffic was received -+from the peer since the last echo\-request was sent. -+.TP - .B lcp\-echo\-failure \fIn - If this option is given, pppd will presume the peer to be dead - if \fIn\fR LCP echo\-requests are sent without receiving a valid LCP diff --git a/network/connection/ppp/files/gentoo/80_all_eaptls-mppe-0.994-gentoo.patch b/network/connection/ppp/files/gentoo/80_all_eaptls-mppe-0.994-gentoo.patch deleted file mode 100644 index 3735e0c264..0000000000 --- a/network/connection/ppp/files/gentoo/80_all_eaptls-mppe-0.994-gentoo.patch +++ /dev/null @@ -1,2898 +0,0 @@ -Taken from http://www.nikhef.nl/~janjust/ppp/ and modified to fit for -ppp-2.4.6 - ---- ppp-2.4.6/etc.ppp/eaptls-client -+++ ppp-2.4.6/etc.ppp/eaptls-client -@@ -0,0 +1,10 @@ -+# Parameters for authentication using EAP-TLS (client) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (required) -+# server certificate file (optional, if unused put '-') -+# CA certificate file (required) -+# client private key file (required) -+ -+#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key ---- ppp-2.4.6/etc.ppp/eaptls-server -+++ ppp-2.4.6/etc.ppp/eaptls-server -@@ -0,0 +1,11 @@ -+# Parameters for authentication using EAP-TLS (server) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (optional, if unused put '-') -+# server certificate file (required) -+# CA certificate file (required) -+# server private key file (required) -+# allowed addresses (required, can be *) -+ -+#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 ---- ppp-2.4.6/etc.ppp/openssl.cnf -+++ ppp-2.4.6/etc.ppp/openssl.cnf -@@ -0,0 +1,14 @@ -+openssl_conf = openssl_def -+ -+[ openssl_def ] -+engines = engine_section -+ -+[ engine_section ] -+pkcs11 = pkcs11_section -+ -+[ pkcs11_section ] -+engine_id = pkcs11 -+dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+MODULE_PATH = /usr/lib64/libeTPkcs11.so -+init = 0 -+ ---- ppp-2.4.6/linux/Makefile.top -+++ ppp-2.4.6/linux/Makefile.top -@@ -26,7 +26,7 @@ - cd pppdump; $(MAKE) $(MFLAGS) install - - install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ -- $(ETCDIR)/chap-secrets -+ $(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client - - install-devel: - cd pppd; $(MAKE) $(MFLAGS) install-devel -@@ -37,6 +37,10 @@ - $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ - $(ETCDIR)/chap-secrets: - $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ -+$(ETCDIR)/eaptls-server: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-server $@ -+$(ETCDIR)/eaptls-client: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-client $@ - - $(BINDIR): - $(INSTALL) -d -m 755 $@ ---- ppp-2.4.6/pppd/auth.c -+++ ppp-2.4.6/pppd/auth.c -@@ -109,6 +109,9 @@ - #include "upap.h" - #include "chap-new.h" - #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#endif - #ifdef CBCP_SUPPORT - #include "cbcp.h" - #endif -@@ -183,6 +186,11 @@ - /* Hook for a plugin to get the CHAP password for authenticating us */ - int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; - -+#ifdef USE_EAPTLS -+/* Hook for a plugin to get the EAP-TLS password for authenticating us */ -+int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL; -+#endif -+ - /* Hook for a plugin to say whether it is OK if the peer - refuses to authenticate. */ - int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -238,6 +246,13 @@ - bool explicit_user = 0; /* Set if "user" option supplied */ - bool explicit_passwd = 0; /* Set if "password" option supplied */ - char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ -+#ifdef USE_EAPTLS -+char *cacert_file = NULL; /* CA certificate file (pem format) */ -+char *cert_file = NULL; /* client certificate file (pem format) */ -+char *privkey_file = NULL; /* client private key file (pem format) */ -+char *crl_dir = NULL; /* directory containing CRL files */ -+bool need_peer_eap = 0; /* Require peer to authenticate us */ -+#endif - - static char *uafname; /* name of most recent +ua file */ - -@@ -254,6 +269,19 @@ - static int have_chap_secret __P((char *, char *, int, int *)); - static int have_srp_secret __P((char *client, char *server, int need_ip, - int *lacks_ipp)); -+ -+#ifdef USE_EAPTLS -+static int have_eaptls_secret_server -+__P((char *client, char *server, int need_ip, int *lacks_ipp)); -+static int have_eaptls_secret_client __P((char *client, char *server)); -+static int scan_authfile_eaptls __P((FILE * f, char *client, char *server, -+ char *cli_cert, char *serv_cert, -+ char *ca_cert, char *pk, -+ struct wordlist ** addrs, -+ struct wordlist ** opts, -+ char *filename, int flags)); -+#endif -+ - static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); - static int scan_authfile __P((FILE *, char *, char *, char *, - struct wordlist **, struct wordlist **, -@@ -401,6 +429,14 @@ - "Set telephone number(s) which are allowed to connect", - OPT_PRIV | OPT_A2LIST }, - -+#ifdef USE_EAPTLS -+ { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, -+ { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, -+ { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, -+ { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, -+ { "need-peer-eap", o_bool, &need_peer_eap, -+ "Require the peer to authenticate us", 1 }, -+#endif /* USE_EAPTLS */ - { NULL } - }; - -@@ -730,6 +766,9 @@ - lcp_options *wo = &lcp_wantoptions[unit]; - lcp_options *go = &lcp_gotoptions[unit]; - lcp_options *ho = &lcp_hisoptions[unit]; -+#ifdef USE_EAPTLS -+ lcp_options *ao = &lcp_allowoptions[unit]; -+#endif - int i; - struct protent *protp; - -@@ -764,6 +803,22 @@ - } - } - -+#ifdef USE_EAPTLS -+ if (need_peer_eap && !ao->neg_eap) { -+ warn("eap required to authenticate us but no suitable secrets"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_AUTH_TOPEER_FAILED; -+ return; -+ } -+ -+ if (need_peer_eap && !ho->neg_eap) { -+ warn("peer doesn't want to authenticate us with eap"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_PEER_AUTH_FAILED; -+ return; -+ } -+#endif -+ - new_phase(PHASE_AUTHENTICATE); - auth = 0; - if (go->neg_eap) { -@@ -1277,6 +1332,15 @@ - our_name, 1, &lacks_ip); - } - -+#ifdef USE_EAPTLS -+ if (!can_auth && wo->neg_eap) { -+ can_auth = -+ have_eaptls_secret_server((explicit_remote ? remote_name : -+ NULL), our_name, 1, &lacks_ip); -+ -+ } -+#endif -+ - if (auth_required && !can_auth && noauth_addrs == NULL) { - if (default_auth) { - option_error( -@@ -1331,7 +1395,11 @@ - passwd[0] != 0 || - (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, - (explicit_remote? remote_name: NULL), 0, NULL))) || -- have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)); -+ have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL) -+#ifdef USE_EAPTLS -+ || have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL)) -+#endif -+ ); - - hadchap = -1; - if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1346,8 +1414,14 @@ - !have_chap_secret((explicit_remote? remote_name: NULL), our_name, - 1, NULL))) && - !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, -- NULL)) -+ NULL) -+#ifdef USE_EAPTLS -+ && !have_eaptls_secret_server((explicit_remote? remote_name: NULL), -+ our_name, 1, NULL) -+#endif -+ ) - go->neg_eap = 0; -+ - } - - -@@ -1707,6 +1781,7 @@ - } - - -+ - /* - * get_secret - open the CHAP secret file and return the secret - * for authenticating the given client on the given server. -@@ -2359,3 +2434,335 @@ - - auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); - } -+ -+ -+#ifdef USE_EAPTLS -+static int -+have_eaptls_secret_server(client, server, need_ip, lacks_ipp) -+ char *client; -+ char *server; -+ int need_ip; -+ int *lacks_ipp; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ filename = _PATH_EAPTLSSERVFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile, -+ clicertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (ret >= 0 && need_ip && !some_ip_ok(addrs)) { -+ if (lacks_ipp != 0) -+ *lacks_ipp = 1; -+ ret = -1; -+ } -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+have_eaptls_secret_client(client, server) -+ char *client; -+ char *server; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs = NULL; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ if (cacert_file && cert_file && privkey_file) -+ return 1; -+ -+ filename = _PATH_EAPTLSCLIFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile, -+ servcertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk, -+ addrs, opts, filename, flags) -+ FILE *f; -+ char *client; -+ char *server; -+ char *cli_cert; -+ char *serv_cert; -+ char *ca_cert; -+ char *pk; -+ struct wordlist **addrs; -+ struct wordlist **opts; -+ char *filename; -+ int flags; -+{ -+ int newline; -+ int got_flag, best_flag; -+ struct wordlist *ap, *addr_list, *alist, **app; -+ char word[MAXWORDLEN]; -+ -+ if (addrs != NULL) -+ *addrs = NULL; -+ if (opts != NULL) -+ *opts = NULL; -+ addr_list = NULL; -+ if (!getword(f, word, &newline, filename)) -+ return -1; /* file is empty??? */ -+ newline = 1; -+ best_flag = -1; -+ for (;;) { -+ /* -+ * Skip until we find a word at the start of a line. -+ */ -+ while (!newline && getword(f, word, &newline, filename)); -+ if (!newline) -+ break; /* got to end of file */ -+ -+ /* -+ * Got a client - check if it's a match or a wildcard. -+ */ -+ got_flag = 0; -+ if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) { -+ newline = 0; -+ continue; -+ } -+ if (!ISWILD(word)) -+ got_flag = NONWILD_CLIENT; -+ -+ /* -+ * Now get a server and check if it matches. -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (!ISWILD(word)) { -+ if (server != NULL && strcmp(word, server) != 0) -+ continue; -+ got_flag |= NONWILD_SERVER; -+ } -+ -+ /* -+ * Got some sort of a match - see if it's better than what -+ * we have already. -+ */ -+ if (got_flag <= best_flag) -+ continue; -+ -+ /* -+ * Get the cli_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(cli_cert, word, MAXWORDLEN); -+ } else -+ cli_cert[0] = 0; -+ -+ /* -+ * Get serv_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(serv_cert, word, MAXWORDLEN); -+ } else -+ serv_cert[0] = 0; -+ -+ /* -+ * Get ca_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(ca_cert, word, MAXWORDLEN); -+ -+ /* -+ * Get pk -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(pk, word, MAXWORDLEN); -+ -+ -+ /* -+ * Now read address authorization info and make a wordlist. -+ */ -+ app = &alist; -+ for (;;) { -+ if (!getword(f, word, &newline, filename) || newline) -+ break; -+ ap = (struct wordlist *) -+ malloc(sizeof(struct wordlist) + strlen(word) + 1); -+ if (ap == NULL) -+ novm("authorized addresses"); -+ ap->word = (char *) (ap + 1); -+ strcpy(ap->word, word); -+ *app = ap; -+ app = &ap->next; -+ } -+ *app = NULL; -+ /* -+ * This is the best so far; remember it. -+ */ -+ best_flag = got_flag; -+ if (addr_list) -+ free_wordlist(addr_list); -+ addr_list = alist; -+ -+ if (!newline) -+ break; -+ } -+ -+ /* scan for a -- word indicating the start of options */ -+ for (app = &addr_list; (ap = *app) != NULL; app = &ap->next) -+ if (strcmp(ap->word, "--") == 0) -+ break; -+ /* ap = start of options */ -+ if (ap != NULL) { -+ ap = ap->next; /* first option */ -+ free(*app); /* free the "--" word */ -+ *app = NULL; /* terminate addr list */ -+ } -+ if (opts != NULL) -+ *opts = ap; -+ else if (ap != NULL) -+ free_wordlist(ap); -+ if (addrs != NULL) -+ *addrs = addr_list; -+ else if (addr_list != NULL) -+ free_wordlist(addr_list); -+ -+ return best_flag; -+} -+ -+ -+int -+get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, am_server) -+ int unit; -+ char *client; -+ char *server; -+ char *clicertfile; -+ char *servcertfile; -+ char *cacertfile; -+ char *pkfile; -+ int am_server; -+{ -+ FILE *fp; -+ int ret; -+ char *filename = NULL; -+ struct wordlist *addrs = NULL; -+ struct wordlist *opts = NULL; -+ -+ /* in client mode the ca+cert+privkey can also be specified as options */ -+ if (!am_server && cacert_file && cert_file && privkey_file ) -+ { -+ strlcpy( clicertfile, cert_file, MAXWORDLEN ); -+ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); -+ strlcpy( pkfile, privkey_file, MAXWORDLEN ); -+ servcertfile[0] = '\0'; -+ } -+ else -+ { -+ filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE); -+ addrs = NULL; -+ -+ fp = fopen(filename, "r"); -+ if (fp == NULL) -+ { -+ error("Can't open eap-tls secret file %s: %m", filename); -+ return 0; -+ } -+ -+ check_access(fp, filename); -+ -+ ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, &opts, filename, 0); -+ -+ fclose(fp); -+ -+ if (ret < 0) return 0; -+ } -+ -+ if (eaptls_passwd_hook) -+ { -+ dbglog( "Calling eaptls password hook" ); -+ if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0) -+ { -+ error("Unable to obtain EAP-TLS password for %s (%s) from plugin", -+ client, pkfile); -+ return 0; -+ } -+ } -+ if (am_server) -+ set_allowed_addrs(unit, addrs, opts); -+ else if (opts != NULL) -+ free_wordlist(opts); -+ if (addrs != NULL) -+ free_wordlist(addrs); -+ -+ return 1; -+} -+#endif -+ ---- ppp-2.4.6/pppd/ccp.c -+++ ppp-2.4.6/pppd/ccp.c -@@ -540,6 +540,9 @@ - if (go->mppe) { - ccp_options *ao = &ccp_allowoptions[f->unit]; - int auth_mschap_bits = auth_done[f->unit]; -+#ifdef USE_EAPTLS -+ int auth_eap_bits = auth_done[f->unit]; -+#endif - int numbits; - - /* -@@ -567,8 +570,23 @@ - lcp_close(f->unit, "MPPE required but not available"); - return; - } -+ -+#ifdef USE_EAPTLS -+ /* -+ * MPPE is also possible in combination with EAP-TLS. -+ * It is not possible to detect if we're doing EAP or EAP-TLS -+ * at this stage, hence we accept all forms of EAP. If TLS is -+ * not used then the MPPE keys will not be derived anyway. -+ */ -+ /* Leave only the eap auth bits set */ -+ auth_eap_bits &= (EAP_WITHPEER | EAP_PEER ); -+ -+ if ((numbits == 0) && (auth_eap_bits == 0)) { -+ error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed."); -+#else - if (!numbits) { -- error("MPPE required, but MS-CHAP[v2] auth not performed."); -+ error("MPPE required, but MS-CHAP[v2] auth not performed."); -+#endif - lcp_close(f->unit, "MPPE required but not available"); - return; - } ---- ppp-2.4.6/pppd/chap-md5.c -+++ ppp-2.4.6/pppd/chap-md5.c -@@ -36,7 +36,11 @@ - #include "chap-new.h" - #include "chap-md5.h" - #include "magic.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#else - #include "md5.h" -+#endif /* USE_EAPTLS */ - - #define MD5_HASH_SIZE 16 - #define MD5_MIN_CHALLENGE 16 ---- ppp-2.4.6/pppd/eap.c -+++ ppp-2.4.6/pppd/eap.c -@@ -43,6 +43,11 @@ - * Based on draft-ietf-pppext-eap-srp-03.txt. - */ - -+/* -+ * Modification by Beniamino Galvani, Mar 2005 -+ * Implemented EAP-TLS authentication -+ */ -+ - #define RCSID "$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $" - - /* -@@ -62,8 +67,12 @@ - - #include "pppd.h" - #include "pathnames.h" --#include "md5.h" - #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#else -+#include "md5.h" -+#endif /* USE_EAPTLS */ - - #ifdef USE_SRP - #include -@@ -209,6 +218,9 @@ - esp->es_server.ea_id = (u_char)(drand48() * 0x100); - esp->es_client.ea_timeout = EAP_DEFREQTIME; - esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; -+#ifdef USE_EAPTLS -+ esp->es_client.ea_using_eaptls = 0; -+#endif /* USE_EAPTLS */ - } - - /* -@@ -436,8 +448,16 @@ - u_char vals[2]; - struct b64state bs; - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ int secret_len; -+ char secret[MAXWORDLEN]; -+#endif /* USE_EAPTLS */ - - esp->es_server.ea_timeout = esp->es_savedtime; -+#ifdef USE_EAPTLS -+ esp->es_server.ea_prev_state = esp->es_server.ea_state; -+#endif /* USE_EAPTLS */ - switch (esp->es_server.ea_state) { - case eapBadAuth: - return; -@@ -562,9 +582,81 @@ - break; - } - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ if (!get_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, secret, &secret_len, 1)) { -+ -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ /* Initialize ssl session */ -+ if(!eaptls_init_ssl_server(esp)) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecv: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->alert_sent) { -+ esp->es_server.ea_state = eapTlsSendAlert; -+ break; -+ } -+ -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsSendAck; -+ else -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSend: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(SSL_is_init_finished(ets->ssl)) { -+ esp->es_server.ea_state = eapTlsRecvClient; -+ break; -+ } -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsRecvAck; -+ else -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsSendAck: -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecvAck: -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSendAlert: -+ esp->es_server.ea_state = eapTlsRecvAlertAck; -+ break; -+#endif /* USE_EAPTLS */ -+ - case eapSRP1: - #ifdef USE_SRP - ts = (struct t_server *)esp->es_server.ea_session; -@@ -718,6 +810,30 @@ - INCPTR(esp->es_server.ea_namelen, outp); - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(EAP_TLS_FLAGS_START, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSend: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAck: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAlert: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case eapSRP1: - PUTCHAR(EAPT_SRP, outp); -@@ -904,11 +1020,57 @@ - eap_server_timeout(arg) - void *arg; - { -+#ifdef USE_EAPTLS -+ u_char *outp; -+ u_char *lenloc; -+ int outlen; -+#endif /* USE_EAPTLS */ -+ - eap_state *esp = (eap_state *) arg; - - if (!eap_server_active(esp)) - return; - -+#ifdef USE_EAPTLS -+ switch(esp->es_server.ea_prev_state) { -+ -+ /* -+ * In eap-tls the state changes after a request, so we return to -+ * previous state ... -+ */ -+ case(eapTlsStart): -+ case(eapTlsSendAck): -+ esp->es_server.ea_state = esp->es_server.ea_prev_state; -+ break; -+ -+ /* -+ * ... or resend the stored data -+ */ -+ case(eapTlsSend): -+ case(eapTlsSendAlert): -+ outp = outpacket_buf; -+ MAKEHEADER(outp, PPP_EAP); -+ PUTCHAR(EAP_REQUEST, outp); -+ PUTCHAR(esp->es_server.ea_id, outp); -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ eaptls_retransmit(esp->es_server.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN); -+ esp->es_server.ea_requests++; -+ -+ if (esp->es_server.ea_timeout > 0) -+ TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout); -+ -+ return; -+ default: -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - /* EAP ID number must not change on timeout. */ - eap_send_request(esp); - } -@@ -1166,6 +1328,81 @@ - } - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+/* -+ * Send an EAP-TLS response message with tls data -+ */ -+static void -+eap_tls_response(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ /* -+ If the id in the request is unchanged, we must retransmit -+ the old data -+ */ -+ if(id == esp->es_client.ea_id) -+ eaptls_retransmit(esp->es_client.ea_session, &outp); -+ else -+ eaptls_send(esp->es_client.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ -+ esp->es_client.ea_id = id; -+ -+} -+ -+/* -+ * Send an EAP-TLS ack -+ */ -+static void -+eap_tls_sendack(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ esp->es_client.ea_id = id; -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ -+} -+#endif /* USE_EAPTLS */ -+ - static void - eap_send_nak(esp, id, type) - eap_state *esp; -@@ -1320,6 +1557,11 @@ - char rhostname[256]; - MD5_CTX mdContext; - u_char hash[MD5_SIGNATURE_SIZE]; -+#ifdef USE_EAPTLS -+ u_char flags; -+ struct eaptls_session *ets = esp->es_client.ea_session; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - struct t_client *tc; - struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1456,6 +1698,90 @@ - esp->es_client.ea_namelen); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ -+ switch(esp->es_client.ea_state) { -+ -+ case eapListen: -+ -+ GETCHAR(flags, inp); -+ if(flags & EAP_TLS_FLAGS_START){ -+ -+ esp->es_client.ea_using_eaptls = 1; -+ -+ if (explicit_remote){ -+ esp->es_client.ea_peer = strdup(remote_name); -+ esp->es_client.ea_peerlen = strlen(remote_name); -+ } else -+ esp->es_client.ea_peer = NULL; -+ -+ /* Init ssl session */ -+ if(!eaptls_init_ssl_client(esp)) { -+ dbglog("cannot init ssl"); -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ ets = esp->es_client.ea_session; -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ break; -+ } -+ -+ /* The server has sent a bad start packet. */ -+ eap_send_nak(esp, id, EAPT_TLS); -+ break; -+ -+ case eapTlsRecvAck: -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ break; -+ -+ case eapTlsRecv: -+ eaptls_receive(ets, inp, len); -+ -+ if(ets->frag) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecv; -+ break; -+ } -+ -+ if(ets->alert_recv) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvFailure; -+ break; -+ } -+ -+ /* Check if TLS handshake is finished */ -+ if(SSL_is_init_finished(ets->ssl)){ -+#ifdef MPPE -+ eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); -+#endif -+ eaptls_free_session(ets); -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvSuccess; -+ break; -+ } -+ -+ eap_tls_response(esp,id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ -+ break; -+ -+ default: -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case EAPT_SRP: - if (len < 1) { -@@ -1737,6 +2063,11 @@ - u_char dig[SHA_DIGESTSIZE]; - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ u_char flags; -+#endif /* USE_EAPTLS */ -+ - if (esp->es_server.ea_id != id) { - dbglog("EAP: discarding Response %d; expected ID %d", id, - esp->es_server.ea_id); -@@ -1776,6 +2107,60 @@ - eap_figure_next_state(esp, 0); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ switch(esp->es_server.ea_state) { -+ -+ case eapTlsRecv: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ eap_figure_next_state(esp, -+ eaptls_receive(esp->es_server.ea_session, inp, len)); -+ -+ if(ets->alert_recv) { -+ eap_send_failure(esp); -+ break; -+ } -+ break; -+ -+ case eapTlsRecvAck: -+ if(len > 1) { -+ dbglog("EAP-TLS ACK with extra data"); -+ } -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsRecvClient: -+ /* Receive authentication response from client */ -+ -+ GETCHAR(flags, inp); -+ -+ if(len == 1 && !flags) { /* Ack = ok */ -+#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); -+#endif -+ eap_send_success(esp); -+ } -+ else { /* failure */ -+ eaptls_receive(esp->es_server.ea_session, inp, len); -+ warn("Server authentication failed"); -+ eap_send_failure(esp); -+ } -+ -+ eaptls_free_session(esp->es_server.ea_session); -+ -+ break; -+ -+ case eapTlsRecvAlertAck: -+ eap_send_failure(esp); -+ break; -+ -+ default: -+ eap_figure_next_state(esp, 1); -+ break; -+ } -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NOTIFICATION: - dbglog("EAP unexpected Notification; response discarded"); - break; -@@ -1807,6 +2192,13 @@ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ /* Send EAP-TLS start packet */ -+ case EAPT_TLS: -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+#endif /* USE_EAPTLS */ -+ - default: - dbglog("EAP: peer requesting unknown Type %d", vallen); - switch (esp->es_server.ea_state) { -@@ -2018,13 +2410,27 @@ - int id; - int len; - { -- if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) { -+ if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp) -+#ifdef USE_EAPTLS -+ && esp->es_client.ea_state != eapTlsRecvSuccess -+#endif /* USE_EAPTLS */ -+ ) { - dbglog("EAP unexpected success message in state %s (%d)", - eap_state_name(esp->es_client.ea_state), - esp->es_client.ea_state); - return; - } - -+#ifdef USE_EAPTLS -+ if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != -+ eapTlsRecvSuccess) { -+ dbglog("EAP-TLS unexpected success message in state %s (%d)", -+ eap_state_name(esp->es_client.ea_state), -+ esp->es_client.ea_state); -+ return; -+ } -+#endif /* USE_EAPTLS */ -+ - if (esp->es_client.ea_timeout > 0) { - UNTIMEOUT(eap_client_timeout, (void *)esp); - } -@@ -2150,6 +2556,9 @@ - int code, id, len, rtype, vallen; - u_char *pstart; - u_int32_t uval; -+#ifdef USE_EAPTLS -+ u_char flags; -+#endif /* USE_EAPTLS */ - - if (inlen < EAP_HEADERLEN) - return (0); -@@ -2214,6 +2623,24 @@ - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_SRP: - if (len < 3) - goto truncated; -@@ -2325,6 +2752,25 @@ - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NAK: - if (len <= 0) { - printer(arg, " "); -@@ -2426,3 +2872,4 @@ - - return (inp - pstart); - } -+ ---- ppp-2.4.6/pppd/eap.h -+++ ppp-2.4.6/pppd/eap.h -@@ -84,6 +84,16 @@ - eapClosed, /* Authentication not in use */ - eapListen, /* Client ready (and timer running) */ - eapIdentify, /* EAP Identify sent */ -+ eapTlsStart, /* Send EAP-TLS start packet */ -+ eapTlsRecv, /* Receive EAP-TLS tls data */ -+ eapTlsSendAck, /* Send EAP-TLS ack */ -+ eapTlsSend, /* Send EAP-TLS tls data */ -+ eapTlsRecvAck, /* Receive EAP-TLS ack */ -+ eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ -+ eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ -+ eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ -+ eapTlsRecvSuccess, /* Receive EAP success */ -+ eapTlsRecvFailure, /* Receive EAP failure */ - eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ - eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ - eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ -@@ -95,9 +105,18 @@ - - #define EAP_STATES \ - "Initial", "Pending", "Closed", "Listen", "Identify", \ -+ "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ -+ "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ - "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" - --#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#ifdef USE_EAPTLS -+#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial ||\ -+ (esp)->es_client.ea_state != eapPending ||\ -+ (esp)->es_client.ea_state != eapClosed) -+#else -+#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#endif /* USE_EAPTLS */ -+ - #define eap_server_active(esp) \ - ((esp)->es_server.ea_state >= eapIdentify && \ - (esp)->es_server.ea_state <= eapMD5Chall) -@@ -112,11 +131,17 @@ - u_short ea_namelen; /* Length of our name */ - u_short ea_peerlen; /* Length of peer's name */ - enum eap_state_code ea_state; -+#ifdef USE_EAPTLS -+ enum eap_state_code ea_prev_state; -+#endif - u_char ea_id; /* Current id */ - u_char ea_requests; /* Number of Requests sent/received */ - u_char ea_responses; /* Number of Responses */ - u_char ea_type; /* One of EAPT_* */ - u_int32_t ea_keyflags; /* SRP shared key usage flags */ -+#ifdef USE_EAPTLS -+ bool ea_using_eaptls; -+#endif - }; - - /* -@@ -139,7 +164,12 @@ - * Timeouts. - */ - #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ -+#ifdef USE_EAPTLS -+#define EAP_DEFTRANSMITS 30 /* max # times to transmit */ -+ /* certificates can be long ... */ -+#else - #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ -+#endif /* USE_EAPTLS */ - #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ - #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ - ---- ppp-2.4.6/pppd/eap-tls.c -+++ ppp-2.4.6/pppd/eap-tls.c -@@ -0,0 +1,1174 @@ -+/* -+ * eap-tls.c - EAP-TLS implementation for PPP -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "pppd.h" -+#include "eap.h" -+#include "eap-tls.h" -+#include "fsm.h" -+#include "lcp.h" -+#include "pathnames.h" -+ -+/* The openssl configuration file and engines can be loaded only once */ -+static CONF *ssl_config = NULL; -+static ENGINE *cert_engine = NULL; -+static ENGINE *pkey_engine = NULL; -+ -+#ifdef MPPE -+ -+/* -+ * TLS PRF from RFC 2246 -+ */ -+static void P_hash(const EVP_MD *evp_md, -+ const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned int out_len) -+{ -+ HMAC_CTX ctx_a, ctx_out; -+ unsigned char a[HMAC_MAX_MD_CBLOCK]; -+ unsigned int size; -+ -+ HMAC_CTX_init(&ctx_a); -+ HMAC_CTX_init(&ctx_out); -+ HMAC_Init_ex(&ctx_a, secret, secret_len, evp_md, NULL); -+ HMAC_Init_ex(&ctx_out, secret, secret_len, evp_md, NULL); -+ -+ size = HMAC_size(&ctx_out); -+ -+ /* Calculate A(1) */ -+ HMAC_Update(&ctx_a, seed, seed_len); -+ HMAC_Final(&ctx_a, a, NULL); -+ -+ while (1) { -+ /* Calculate next part of output */ -+ HMAC_Update(&ctx_out, a, size); -+ HMAC_Update(&ctx_out, seed, seed_len); -+ -+ /* Check if last part */ -+ if (out_len < size) { -+ HMAC_Final(&ctx_out, a, NULL); -+ memcpy(out, a, out_len); -+ break; -+ } -+ -+ /* Place digest in output buffer */ -+ HMAC_Final(&ctx_out, out, NULL); -+ HMAC_Init_ex(&ctx_out, NULL, 0, NULL, NULL); -+ out += size; -+ out_len -= size; -+ -+ /* Calculate next A(i) */ -+ HMAC_Init_ex(&ctx_a, NULL, 0, NULL, NULL); -+ HMAC_Update(&ctx_a, a, size); -+ HMAC_Final(&ctx_a, a, NULL); -+ } -+ -+ HMAC_CTX_cleanup(&ctx_a); -+ HMAC_CTX_cleanup(&ctx_out); -+ memset(a, 0, sizeof(a)); -+} -+ -+static void PRF(const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned char *buf, unsigned int out_len) -+{ -+ unsigned int i; -+ unsigned int len = (secret_len + 1) / 2; -+ const unsigned char *s1 = secret; -+ const unsigned char *s2 = secret + (secret_len - len); -+ -+ P_hash(EVP_md5(), s1, len, seed, seed_len, out, out_len); -+ P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len); -+ -+ for (i=0; i < out_len; i++) { -+ out[i] ^= buf[i]; -+ } -+} -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ -+/* -+ * Generate keys according to RFC 2716 and add to reply -+ */ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, -+ int client) -+{ -+ unsigned char out[4*EAPTLS_MPPE_KEY_LEN], buf[4*EAPTLS_MPPE_KEY_LEN]; -+ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; -+ unsigned char *p = seed; -+ SSL *s = ets->ssl; -+ size_t prf_size; -+ -+ prf_size = strlen(prf_label); -+ -+ memcpy(p, prf_label, prf_size); -+ p += prf_size; -+ -+ memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); -+ p += SSL3_RANDOM_SIZE; -+ prf_size += SSL3_RANDOM_SIZE; -+ -+ memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE); -+ prf_size += SSL3_RANDOM_SIZE; -+ -+ PRF(s->session->master_key, s->session->master_key_length, -+ seed, prf_size, out, buf, sizeof(out)); -+ -+ /* -+ * We now have the master send and receive keys. -+ * From these, generate the session send and receive keys. -+ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) -+ */ -+ if (client) -+ { -+ p = out; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ } -+ else -+ { -+ p = out; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ } -+ -+ mppe_keys_set = 1; -+} -+ -+#endif -+ -+void log_ssl_errors( void ) -+{ -+ unsigned long ssl_err = ERR_get_error(); -+ -+ if (ssl_err != 0) -+ dbglog("EAP-TLS SSL error stack:"); -+ while (ssl_err != 0) { -+ dbglog( ERR_error_string( ssl_err, NULL ) ); -+ ssl_err = ERR_get_error(); -+ } -+} -+ -+ -+int password_callback (char *buf, int size, int rwflag, void *u) -+{ -+ if (buf) -+ { -+ strncpy (buf, passwd, size); -+ return strlen (buf); -+ } -+ return 0; -+} -+ -+ -+CONF *eaptls_ssl_load_config( void ) -+{ -+ CONF *config; -+ int ret_code; -+ long error_line = 33; -+ -+ config = NCONF_new( NULL ); -+ dbglog( "Loading OpenSSL config file" ); -+ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); -+ if (ret_code == 0) -+ { -+ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); -+ NCONF_free( config ); -+ config = NULL; -+ ERR_clear_error(); -+ } -+ -+ dbglog( "Loading OpenSSL built-ins" ); -+ ENGINE_load_builtin_engines(); -+ OPENSSL_load_builtin_modules(); -+ -+ dbglog( "Loading OpenSSL configured modules" ); -+ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) -+ { -+ warn( "EAP-TLS: Error loading OpenSSL modules" ); -+ log_ssl_errors(); -+ config = NULL; -+ } -+ -+ return config; -+} -+ -+ENGINE *eaptls_ssl_load_engine( char *engine_name ) -+{ -+ ENGINE *e = NULL; -+ -+ dbglog( "Enabling OpenSSL auto engines" ); -+ ENGINE_register_all_complete(); -+ -+ dbglog( "Loading OpenSSL '%s' engine support", engine_name ); -+ e = ENGINE_by_id( engine_name ); -+ if (!e) -+ { -+ dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); -+ e = ENGINE_by_id( "dynamic" ); -+ if (e) -+ { -+ if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0) -+ || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) -+ { -+ warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ else -+ { -+ warn( "EAP-TLS: Cannot load dynamic engine support" ); -+ } -+ } -+ -+ if (e) -+ { -+ dbglog( "Initialising engine" ); -+ if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) -+ { -+ warn( "EAP-TLS: Cannot use that engine" ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ -+ return e; -+} -+ -+/* -+ * Initialize the SSL stacks and tests if certificates, key and crl -+ * for client or server use can be loaded. -+ */ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, -+ char *certfile, char *peer_certfile, char *privkeyfile) -+{ -+ char *cert_engine_name = NULL; -+ char *cert_identifier = NULL; -+ char *pkey_engine_name = NULL; -+ char *pkey_identifier = NULL; -+ SSL_CTX *ctx; -+ X509_STORE *certstore; -+ X509_LOOKUP *lookup; -+ X509 *tmp; -+ -+ /* -+ * Without these can't continue -+ */ -+ if (!cacertfile[0]) -+ { -+ error("EAP-TLS: CA certificate missing"); -+ return NULL; -+ } -+ -+ if (!certfile[0]) -+ { -+ error("EAP-TLS: User certificate missing"); -+ return NULL; -+ } -+ -+ if (!privkeyfile[0]) -+ { -+ error("EAP-TLS: User private key missing"); -+ return NULL; -+ } -+ -+ SSL_library_init(); -+ SSL_load_error_strings(); -+ -+ ctx = SSL_CTX_new(TLSv1_method()); -+ -+ if (!ctx) { -+ error("EAP-TLS: Cannot initialize SSL CTX context"); -+ goto fail; -+ } -+ -+ /* if the certificate filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the certificate filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL ) -+ { -+ cert_identifier = index( certfile, ':' ); -+ -+ if (cert_identifier) -+ { -+ cert_engine_name = certfile; -+ *cert_identifier = '\0'; -+ cert_identifier++; -+ -+ dbglog( "Found certificate engine '%s'", cert_engine_name ); -+ dbglog( "Found certificate identifier '%s'", cert_identifier ); -+ } -+ } -+ -+ /* if the privatekey filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the privatekey filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL ) -+ { -+ pkey_identifier = index( privkeyfile, ':' ); -+ -+ if (pkey_identifier) -+ { -+ pkey_engine_name = privkeyfile; -+ *pkey_identifier = '\0'; -+ pkey_identifier++; -+ -+ dbglog( "Found privatekey engine '%s'", pkey_engine_name ); -+ dbglog( "Found privatekey identifier '%s'", pkey_identifier ); -+ } -+ } -+ -+ if (cert_identifier && pkey_identifier) -+ { -+ if (strlen( cert_identifier ) == 0) -+ { -+ if (strlen( pkey_identifier ) == 0) -+ error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" ); -+ else -+ { -+ dbglog( "Substituting privatekey identifier for certificate identifier" ); -+ cert_identifier = pkey_identifier; -+ } -+ } -+ else -+ { -+ if (strlen( pkey_identifier ) == 0) -+ { -+ dbglog( "Substituting certificate identifier for privatekey identifier" ); -+ pkey_identifier = cert_identifier; -+ } -+ } -+ -+ } -+ -+ /* load the openssl config file only once */ -+ if (!ssl_config) -+ { -+ if (cert_engine_name || pkey_engine_name) -+ ssl_config = eaptls_ssl_load_config(); -+ -+ if (ssl_config && cert_engine_name) -+ cert_engine = eaptls_ssl_load_engine( cert_engine_name ); -+ -+ if (ssl_config && pkey_engine_name) -+ { -+ /* don't load the same engine twice */ -+ if ( strcmp( cert_engine_name, pkey_engine_name) == 0 ) -+ pkey_engine = cert_engine; -+ else -+ pkey_engine = eaptls_ssl_load_engine( pkey_engine_name ); -+ } -+ } -+ -+ SSL_CTX_set_default_passwd_cb (ctx, password_callback); -+ -+ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) -+ { -+ error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); -+ goto fail; -+ } -+ -+ if (init_server) -+ SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); -+ -+ if (cert_engine) -+ { -+ struct -+ { -+ const char *s_slot_cert_id; -+ X509 *cert; -+ } cert_info; -+ -+ cert_info.s_slot_cert_id = cert_identifier; -+ cert_info.cert = NULL; -+ -+ if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) ) -+ { -+ error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier ); -+ goto fail; -+ } -+ -+ if (cert_info.cert) -+ { -+ dbglog( "Got the certificate, adding it to SSL context" ); -+ dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) ); -+ if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM)) -+ { -+ error( "EAP-TLS: Cannot use public certificate %s", certfile ); -+ goto fail; -+ } -+ } -+ -+ if (pkey_engine) -+ { -+ EVP_PKEY *pkey = NULL; -+ PW_CB_DATA cb_data; -+ -+ cb_data.password = passwd; -+ cb_data.prompt_info = pkey_identifier; -+ -+ dbglog( "Loading private key '%s' from engine", pkey_identifier ); -+ pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data); -+ if (pkey) -+ { -+ dbglog( "Got the private key, adding it to SSL context" ); -+ if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM)) -+ { -+ error("EAP-TLS: Cannot use private key %s", privkeyfile); -+ goto fail; -+ } -+ } -+ -+ if (SSL_CTX_check_private_key(ctx) != 1) { -+ error("EAP-TLS: Private key %s fails security check", privkeyfile); -+ goto fail; -+ } -+ -+ SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); -+ SSL_CTX_set_verify_depth(ctx, 5); -+ SSL_CTX_set_verify(ctx, -+ SSL_VERIFY_PEER | -+ SSL_VERIFY_FAIL_IF_NO_PEER_CERT, -+ &ssl_verify_callback); -+ -+ if (crl_dir) { -+ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { -+ error("EAP-TLS: Failed to get certificate store"); -+ goto fail; -+ } -+ -+ if (!(lookup = -+ X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) { -+ error("EAP-TLS: Store lookup for CRL failed"); -+ -+ goto fail; -+ } -+ -+ X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM); -+ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); -+ } -+ -+ /* -+ * If a peer certificate file was specified, it must be valid, else fail -+ */ -+ if (peer_certfile[0]) { -+ if (!(tmp = get_X509_from_file(peer_certfile))) { -+ error("EAP-TLS: Error loading client certificate from file %s", -+ peer_certfile); -+ goto fail; -+ } -+ X509_free(tmp); -+ } -+ -+ return ctx; -+ -+fail: -+ log_ssl_errors(); -+ SSL_CTX_free(ctx); -+ return NULL; -+} -+ -+/* -+ * Determine the maximum packet size by looking at the LCP handshake -+ */ -+ -+int eaptls_get_mtu(int unit) -+{ -+ int mtu, mru; -+ -+ lcp_options *wo = &lcp_wantoptions[unit]; -+ lcp_options *go = &lcp_gotoptions[unit]; -+ lcp_options *ho = &lcp_hisoptions[unit]; -+ lcp_options *ao = &lcp_allowoptions[unit]; -+ -+ mtu = ho->neg_mru? ho->mru: PPP_MRU; -+ mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; -+ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; -+ -+ dbglog("MTU = %d", mtu); -+ return mtu; -+} -+ -+ -+/* -+ * Init the ssl handshake (server mode) -+ */ -+int eaptls_init_ssl_server(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_server.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_server.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_server.ea_session; -+ -+ if (!esp->es_server.ea_peer) { -+ error("EAP-TLS: Error: client name not set (BUG)"); -+ return 0; -+ } -+ -+ strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); -+ -+ dbglog( "getting eaptls secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, clicertfile, -+ servcertfile, cacertfile, pkfile, 1)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_server.ea_peer, esp->es_server.ea_name ); -+ return 0; -+ } -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ if (!(ets->ssl = SSL_new(ets->ctx))) -+ goto fail; -+ -+ /* -+ * Set auto-retry to avoid timeouts on BIO_read -+ */ -+ SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY); -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_accept_state(ets->ssl); -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the client certificate file, store it in ets->peercertfile, -+ * so we can check it later in ssl_verify_callback() -+ */ -+ if (clicertfile[0]) -+ strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ SSL_CTX_free(ets->ctx); -+ return 0; -+} -+ -+/* -+ * Init the ssl handshake (client mode) -+ */ -+int eaptls_init_ssl_client(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_client.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_client.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_client.ea_session; -+ -+ /* -+ * If available, copy server name in ets; it will be used in cert -+ * verify -+ */ -+ if (esp->es_client.ea_peer) -+ strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); -+ else -+ ets->peer[0] = 0; -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ dbglog( "calling get_eaptls_secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, -+ esp->es_client.ea_peer, clicertfile, -+ servcertfile, cacertfile, pkfile, 0)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_client.ea_name, esp->es_client.ea_peer ); -+ return 0; -+ } -+ -+ dbglog( "calling eaptls_init_ssl" ); -+ ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ ets->ssl = SSL_new(ets->ctx); -+ -+ if (!ets->ssl) -+ goto fail; -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ dbglog( "Initializing SSL BIOs" ); -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_connect_state(ets->ssl); -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the server certificate file, store it in -+ * ets->peercertfile, so we can check it later in -+ * ssl_verify_callback() -+ */ -+ if (servcertfile[0]) -+ strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ dbglog( "eaptls_init_ssl_client: fail" ); -+ SSL_CTX_free(ets->ctx); -+ return 0; -+ -+} -+ -+void eaptls_free_session(struct eaptls_session *ets) -+{ -+ if (ets->ssl) -+ SSL_free(ets->ssl); -+ -+ if (ets->ctx) -+ SSL_CTX_free(ets->ctx); -+ -+ free(ets); -+} -+ -+/* -+ * Handle a received packet, reassembling fragmented messages and -+ * passing them to the ssl engine -+ */ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) -+{ -+ u_char flags; -+ u_int tlslen; -+ u_char dummy[65536]; -+ -+ GETCHAR(flags, inp); -+ len--; -+ -+ if (flags & EAP_TLS_FLAGS_LI && !ets->data) { -+ -+ /* -+ * This is the first packet of a message -+ */ -+ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ -+ if (tlslen > EAP_TLS_MAX_LEN) { -+ error("Error: tls message length > %d, truncated", -+ EAP_TLS_MAX_LEN); -+ tlslen = EAP_TLS_MAX_LEN; -+ } -+ -+ /* -+ * Allocate memory for the whole message -+ */ -+ ets->data = malloc(tlslen); -+ if (!ets->data) -+ fatal("EAP TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = tlslen; -+ -+ } -+ else if (flags & EAP_TLS_FLAGS_LI && ets->data) { -+ /* -+ * Non first with LI (strange...) -+ */ -+ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ -+ } -+ else if (!ets->data) { -+ /* -+ * A non fragmented message without LI flag -+ */ -+ -+ ets->data = malloc(len); -+ if (!ets->data) -+ fatal("EAP TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = len; -+ } -+ -+ if (flags & EAP_TLS_FLAGS_MF) -+ ets->frag = 1; -+ else -+ ets->frag = 0; -+ -+ if (len + ets->datalen > ets->tlslen) { -+ warn("EAP TLS: received data > TLS message length"); -+ return 1; -+ } -+ -+ BCOPY(inp, ets->data + ets->datalen, len); -+ ets->datalen += len; -+ -+ if (!ets->frag) { -+ -+ /* -+ * If we have the whole message, pass it to ssl -+ */ -+ -+ if (ets->datalen != ets->tlslen) { -+ warn("EAP TLS: received data != TLS message length"); -+ return 1; -+ } -+ -+ if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1) -+ log_ssl_errors(); -+ -+ SSL_read(ets->ssl, dummy, 65536); -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Return an eap-tls packet in outp. -+ * A TLS message read from the ssl engine is buffered in ets->data. -+ * At each call we control if there is buffered data and send a -+ * packet of mtu bytes. -+ */ -+int eaptls_send(struct eaptls_session *ets, u_char ** outp) -+{ -+ bool first = 0; -+ int size; -+ u_char fromtls[65536]; -+ int res; -+ u_char *start; -+ -+ start = *outp; -+ -+ if (!ets->data) { -+ -+ if(!ets->alert_sent) -+ SSL_read(ets->ssl, fromtls, 65536); -+ -+ /* -+ * Read from ssl -+ */ -+ if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) -+ fatal("No data from BIO_read"); -+ -+ ets->datalen = res; -+ -+ ets->data = malloc(ets->datalen); -+ BCOPY(fromtls, ets->data, ets->datalen); -+ -+ ets->offset = 0; -+ first = 1; -+ -+ } -+ -+ size = ets->datalen - ets->offset; -+ -+ if (size > ets->mtu) { -+ size = ets->mtu; -+ ets->frag = 1; -+ } else -+ ets->frag = 0; -+ -+ PUTCHAR(EAPT_TLS, *outp); -+ -+ /* -+ * Set right flags and length if necessary -+ */ -+ if (ets->frag && first) { -+ PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp); -+ PUTLONG(ets->datalen, *outp); -+ } else if (ets->frag) { -+ PUTCHAR(EAP_TLS_FLAGS_MF, *outp); -+ } else -+ PUTCHAR(0, *outp); -+ -+ /* -+ * Copy the data in outp -+ */ -+ BCOPY(ets->data + ets->offset, *outp, size); -+ INCPTR(size, *outp); -+ -+ /* -+ * Copy the packet in retransmission buffer -+ */ -+ BCOPY(start, &ets->rtx[0], *outp - start); -+ ets->rtx_len = *outp - start; -+ -+ ets->offset += size; -+ -+ if (ets->offset >= ets->datalen) { -+ -+ /* -+ * The whole message has been sent -+ */ -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->offset = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Get the sent packet from the retransmission buffer -+ */ -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp) -+{ -+ BCOPY(ets->rtx, *outp, ets->rtx_len); -+ INCPTR(ets->rtx_len, *outp); -+} -+ -+/* -+ * Verify a certificate. -+ * Most of the work (signatures and issuer attributes checking) -+ * is done by ssl; we check the CN in the peer certificate -+ * against the peer name. -+ */ -+int ssl_verify_callback(int preverify_ok, X509_STORE_CTX * ctx) -+{ -+ char subject[256]; -+ char cn_str[256]; -+ X509 *peer_cert; -+ int err, depth; -+ int ok = preverify_ok; -+ SSL *ssl; -+ struct eaptls_session *ets; -+ -+ peer_cert = X509_STORE_CTX_get_current_cert(ctx); -+ err = X509_STORE_CTX_get_error(ctx); -+ depth = X509_STORE_CTX_get_error_depth(ctx); -+ -+ dbglog("certificate verify depth: %d", depth); -+ -+ if (auth_required && !ok) { -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ dbglog("Certificate verification error:\n depth: %d CN: %s" -+ "\n err: %d (%s)\n", depth, cn_str, err, -+ X509_verify_cert_error_string(err)); -+ -+ return 0; -+ } -+ -+ ssl = X509_STORE_CTX_get_ex_data(ctx, -+ SSL_get_ex_data_X509_STORE_CTX_idx()); -+ -+ ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0); -+ -+ if (ets == NULL) { -+ error("Error: SSL_get_ex_data returned NULL"); -+ return 0; -+ } -+ -+ log_ssl_errors(); -+ -+ if (!depth) { /* This is the peer certificate */ -+ -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ /* -+ * If acting as client and the name of the server wasn't specified -+ * explicitely, we can't verify the server authenticity -+ */ -+ if (!ets->peer[0]) { -+ warn("Peer name not specified: no check"); -+ return 1; -+ } -+ -+ /* -+ * Check the CN -+ */ -+ if (strcmp(cn_str, ets->peer)) { -+ error -+ ("Certificate verification error: CN (%s) != peer_name (%s)", -+ cn_str, ets->peer); -+ return 0; -+ } -+ -+ warn("Certificate CN: %s , peer name %s", cn_str, ets->peer); -+ -+ /* -+ * If a peer certificate file was specified, here we check it -+ */ -+ if (ets->peercertfile[0]) { -+ if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert) -+ != 0) { -+ error -+ ("Peer certificate doesn't match stored certificate"); -+ return 0; -+ } -+ } -+ } -+ -+ return 1; -+} -+ -+/* -+ * Compare a certificate with the one stored in a file -+ */ -+int ssl_cmp_certs(char *filename, X509 * a) -+{ -+ X509 *b; -+ int ret; -+ -+ if (!(b = get_X509_from_file(filename))) -+ return 1; -+ -+ ret = X509_cmp(a, b); -+ X509_free(b); -+ -+ return ret; -+ -+} -+ -+X509 *get_X509_from_file(char *filename) -+{ -+ FILE *fp; -+ X509 *ret; -+ -+ if (!(fp = fopen(filename, "r"))) -+ return NULL; -+ -+ ret = PEM_read_X509(fp, NULL, NULL, NULL); -+ -+ fclose(fp); -+ -+ return ret; -+} -+ -+/* -+ * Every sent & received message this callback function is invoked, -+ * so we know when alert messages have arrived or are sent and -+ * we can print debug information about TLS handshake. -+ */ -+void -+ssl_msg_callback(int write_p, int version, int content_type, -+ const void *buf, size_t len, SSL * ssl, void *arg) -+{ -+ char string[256]; -+ struct eaptls_session *ets = (struct eaptls_session *)arg; -+ unsigned char code; -+ -+ if(write_p) -+ strcpy(string, " -> "); -+ else -+ strcpy(string, " <- "); -+ -+ -+ switch(content_type) { -+ -+ case SSL3_RT_ALERT: -+ strcat(string, "Alert: "); -+ code = ((const unsigned char *)buf)[1]; -+ -+ if (write_p) { -+ ets->alert_sent = 1; -+ ets->alert_sent_desc = code; -+ } else { -+ ets->alert_recv = 1; -+ ets->alert_recv_desc = code; -+ } -+ -+ strcat(string, SSL_alert_desc_string_long(code)); -+ break; -+ -+ case SSL3_RT_CHANGE_CIPHER_SPEC: -+ strcat(string, "ChangeCipherSpec"); -+ break; -+ -+ case SSL3_RT_HANDSHAKE: -+ -+ strcat(string, "Handshake: "); -+ code = ((const unsigned char *)buf)[0]; -+ -+ switch(code) { -+ case SSL3_MT_HELLO_REQUEST: -+ strcat(string,"Hello Request"); -+ break; -+ case SSL3_MT_CLIENT_HELLO: -+ strcat(string,"Client Hello"); -+ break; -+ case SSL3_MT_SERVER_HELLO: -+ strcat(string,"Server Hello"); -+ break; -+ case SSL3_MT_CERTIFICATE: -+ strcat(string,"Certificate"); -+ break; -+ case SSL3_MT_SERVER_KEY_EXCHANGE: -+ strcat(string,"Server Key Exchange"); -+ break; -+ case SSL3_MT_CERTIFICATE_REQUEST: -+ strcat(string,"Certificate Request"); -+ break; -+ case SSL3_MT_SERVER_DONE: -+ strcat(string,"Server Hello Done"); -+ break; -+ case SSL3_MT_CERTIFICATE_VERIFY: -+ strcat(string,"Certificate Verify"); -+ break; -+ case SSL3_MT_CLIENT_KEY_EXCHANGE: -+ strcat(string,"Client Key Exchange"); -+ break; -+ case SSL3_MT_FINISHED: -+ strcat(string,"Finished"); -+ break; -+ -+ default: -+ sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); -+ } -+ break; -+ -+ default: -+ sprintf( string, "SSL message contains unknown content type: %d", content_type ); -+ -+ } -+ -+ /* Alert messages must always be displayed */ -+ if(content_type == SSL3_RT_ALERT) -+ error("%s", string); -+ else -+ dbglog("%s", string); -+} -+ ---- ppp-2.4.6/pppd/eap-tls.h -+++ ppp-2.4.6/pppd/eap-tls.h -@@ -0,0 +1,107 @@ -+/* -+ * eap-tls.h -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#ifndef __EAP_TLS_H__ -+#define __EAP_TLS_H__ -+ -+#include "eap.h" -+ -+#include -+#include -+#include -+ -+#define EAP_TLS_FLAGS_LI 128 /* length included flag */ -+#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ -+#define EAP_TLS_FLAGS_START 32 /* start flag */ -+ -+#define EAP_TLS_MAX_LEN 65536 /* max eap tls packet size */ -+ -+struct eaptls_session -+{ -+ u_char *data; /* buffered data */ -+ int datalen; /* buffered data len */ -+ int offset; /* from where to send */ -+ int tlslen; /* total length of tls data */ -+ bool frag; /* packet is fragmented */ -+ SSL_CTX *ctx; -+ SSL *ssl; /* ssl connection */ -+ BIO *from_ssl; -+ BIO *into_ssl; -+ char peer[MAXWORDLEN]; /* peer name */ -+ char peercertfile[MAXWORDLEN]; -+ bool alert_sent; -+ u_char alert_sent_desc; -+ bool alert_recv; -+ u_char alert_recv_desc; -+ char rtx[65536]; /* retransmission buffer */ -+ int rtx_len; -+ int mtu; /* unit mtu */ -+}; -+ -+typedef struct pw_cb_data -+{ -+ const void *password; -+ const char *prompt_info; -+} PW_CB_DATA; -+ -+ -+int ssl_verify_callback(int, X509_STORE_CTX *); -+void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -+ size_t len, SSL * ssl, void *arg); -+ -+X509 *get_X509_from_file(char *filename); -+int ssl_cmp_certs(char *filename, X509 * a); -+ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, -+ char *certfile, char *peer_certfile, char *privkeyfile); -+int eaptls_init_ssl_server(eap_state * esp); -+int eaptls_init_ssl_client(eap_state * esp); -+void eaptls_free_session(struct eaptls_session *ets); -+ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); -+int eaptls_send(struct eaptls_session *ets, u_char ** outp); -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); -+ -+int get_eaptls_secret(int unit, char *client, char *server, -+ char *clicertfile, char *servcertfile, char *cacertfile, -+ char *pkfile, int am_server); -+ -+#ifdef MPPE -+#include "mppe.h" /* MPPE_MAX_KEY_LEN */ -+extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; -+extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; -+extern int mppe_keys_set; -+ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); -+ -+#endif -+ -+#endif ---- ppp-2.4.6/pppd/Makefile.linux -+++ ppp-2.4.6/pppd/Makefile.linux -@@ -76,6 +76,9 @@ - # Use libutil - USE_LIBUTIL=y - -+# Enable EAP-TLS authentication (requires libssl and libcrypto) -+USE_EAPTLS=y -+ - MAXOCTETS=y - - INCLUDE_DIRS= -I../include -@@ -115,6 +118,15 @@ - PPPDOBJS += sha1.o - endif - -+# EAP-TLS -+ifdef USE_EAPTLS -+CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include -+LIBS += -lssl -lcrypto -+PPPDSRC += eap-tls.c -+HEADERS += eap-tls.h -+PPPDOBJS += eap-tls.o -+endif -+ - ifdef HAS_SHADOW - CFLAGS += -DHAS_SHADOW - #LIBS += -lshadow $(LIBS) ---- ppp-2.4.6/pppd/md5.c -+++ ppp-2.4.6/pppd/md5.c -@@ -33,6 +33,8 @@ - *********************************************************************** - */ - -+#ifndef USE_EAPTLS -+ - #include - #include "md5.h" - -@@ -305,3 +307,5 @@ - ** End of md5.c ** - ******************************** (cut) ******************************** - */ -+#endif /* USE_EAPTLS */ -+ ---- ppp-2.4.6/pppd/md5.h -+++ ppp-2.4.6/pppd/md5.h -@@ -36,6 +36,7 @@ - ** documentation and/or software. ** - *********************************************************************** - */ -+#ifndef USE_EAPTLS - - #ifndef __MD5_INCLUDE__ - -@@ -63,3 +64,5 @@ - - #define __MD5_INCLUDE__ - #endif /* __MD5_INCLUDE__ */ -+ -+#endif /* USE_EAPTLS */ ---- ppp-2.4.6/pppd/options.c -+++ ppp-2.4.6/pppd/options.c -@@ -122,6 +122,11 @@ - int child_wait = 5; /* # seconds to wait for children at exit */ - struct userenv *userenv_list; /* user environment variables */ - -+#ifdef USE_EAPTLS -+bool only_update_crl_server = 0; /* update server crl and exit */ -+bool only_update_crl_client = 0; /* update client crl and exit */ -+#endif /* USE_EAPTLS */ -+ - #ifdef MAXOCTETS - unsigned int maxoctets = 0; /* default - no limit */ - int maxoctets_dir = 0; /* default - sum of traffic */ -@@ -338,6 +343,12 @@ - { "mo-timeout", o_int, &maxoctets_timeout, - "Check for traffic limit every N seconds", OPT_PRIO | OPT_LLIMIT | 1 }, - #endif -+#ifdef USE_EAPTLS -+ { "only-update-crl-server", o_bool, &only_update_crl_server, -+ "Update server CA CRLs and exit", 1 }, -+ { "only-update-crl-client", o_bool, &only_update_crl_client, -+ "Update client CA CRLs and exit", 1 }, -+#endif /* USE_EAPTLS */ - - { NULL } - }; ---- ppp-2.4.6/pppd/pathnames.h -+++ ppp-2.4.6/pppd/pathnames.h -@@ -21,6 +21,13 @@ - #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" - #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" - #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" -+ -+#ifdef USE_EAPTLS -+#define _PATH_EAPTLSCLIFILE _ROOT_PATH "/etc/ppp/eaptls-client" -+#define _PATH_EAPTLSSERVFILE _ROOT_PATH "/etc/ppp/eaptls-server" -+#define _PATH_OPENSSLCONFFILE _ROOT_PATH "/etc/ppp/openssl.cnf" -+#endif /* USE_EAPTLS */ -+ - #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" - #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" - #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" ---- ppp-2.4.6/pppd/plugins/Makefile.linux -+++ ppp-2.4.6/pppd/plugins/Makefile.linux -@@ -4,6 +4,9 @@ - LDFLAGS = -shared - INSTALL = install - -+# EAP-TLS -+CFLAGS += -DUSE_EAPTLS=1 -+ - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 ---- ppp-2.4.6/pppd/plugins/passprompt.c -+++ ppp-2.4.6/pppd/plugins/passprompt.c -@@ -107,4 +107,7 @@ - { - add_options(options); - pap_passwd_hook = promptpass; -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = promptpass; -+#endif - } ---- ppp-2.4.6/pppd/plugins/passwordfd.c -+++ ppp-2.4.6/pppd/plugins/passwordfd.c -@@ -79,4 +79,8 @@ - - chap_check_hook = pwfd_check; - chap_passwd_hook = pwfd_passwd; -+ -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = pwfd_passwd; -+#endif - } ---- ppp-2.4.6/pppd/pppd.h -+++ ppp-2.4.6/pppd/pppd.h -@@ -324,6 +324,10 @@ - extern bool dryrun; /* check everything, print options, exit */ - extern int child_wait; /* # seconds to wait for children at end */ - -+#ifdef USE_EAPTLS -+extern char *crl_dir; -+#endif /* USE_EAPTLS */ -+ - #ifdef MAXOCTETS - extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ - extern int maxoctets_dir; /* Direction : -@@ -738,6 +742,10 @@ - extern int (*chap_passwd_hook) __P((char *user, char *passwd)); - extern void (*multilink_join_hook) __P((void)); - -+#ifdef USE_EAPTLS -+extern int (*eaptls_passwd_hook) __P((char *user, char *passwd)); -+#endif -+ - /* Let a plugin snoop sent and received packets. Useful for L2TP */ - extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); - extern void (*snoop_send_hook) __P((unsigned char *p, int len)); ---- ppp-2.4.6/README.eap-tls -+++ ppp-2.4.6/README.eap-tls -@@ -0,0 +1,169 @@ -+EAP-TLS authentication support for PPP -+====================================== -+ -+1. Intro -+ -+ The Extensible Authentication Protocol (EAP; RFC 3748) is a -+ security protocol that can be used with PPP. It provides a means -+ to plug in multiple optional authentication methods. -+ -+ Transport Level Security (TLS; RFC 2246) provides for mutual -+ authentication, integrity-protected ciphersuite negotiation and -+ key exchange between two endpoints. It also provides for optional -+ MPPE encryption. -+ -+ EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets, -+ allowing TLS mutual authentication to be used as a generic EAP -+ mechanism. It also provides optional encryption using the MPPE -+ protocol. -+ -+ This patch provide EAP-TLS support to pppd. -+ This authentication method can be used in both client or server -+ mode. -+ -+2. Building -+ -+ To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org) -+ is required. Any version from 0.9.7 should work. -+ -+ Configure, compile, and install as usual. -+ -+3. Configuration -+ -+ On the client side there are two ways to configure EAP-TLS: -+ -+ 1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters -+ -+ 2. edit the /etc/ppp/eaptls-client file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ The file containing the certificate chain for the -+ client in PEM format -+ - Server certificate file -+ If you want to specify the certificate that the -+ server is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM -+ format. -+ - Client private key file -+ The file containing the client private key in PEM format. -+ -+ -+ On the server side edit the /etc/ppp/eaptls-server file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ If you want to specify the certificate that the -+ client is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - Server certificate file -+ The file containing the certificate chain for the -+ server in PEM format -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM -+ format. -+ - Client private key file -+ The file containing the server private key in PEM format. -+ - addresses -+ A list of IP addresses the client is allowed to use. -+ -+ -+ OpenSSL engine support is included starting with v0.95 of this patch. -+ Currently the only engine tested is the 'pkcs11' engine (hardware token -+ support). To use the 'pksc11' engine: -+ - Use a special private key fileiname in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - The certificate can also be loaded from the 'pkcs11' engine using -+ a special client certificate filename in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior -+ to starting 'pppd'. A sample openssl.cnf file is -+ -+ openssl_conf = openssl_def -+ -+ [ openssl_def ] -+ engines = engine_section -+ -+ [ engine_section ] -+ pkcs11 = pkcs11_section -+ -+ [ pkcs11_section ] -+ engine_id = pkcs11 -+ dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+ MODULE_PATH = /usr/lib64/libeTPkcs11.so -+ init = 0 -+ -+ - There are two ways to specify a password/PIN for the PKCS11 engine: -+ - inside the openssl.cnf file using -+ PIN = your-secret-pin -+ Note The keyword 'PIN' is case sensitive! -+ - Using the 'password' in the ppp options file. -+ From v0.97 of the eap-tls patch the password can also be supplied -+ using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c -+ for an example). -+ -+ -+4. Options -+ -+ These pppd options are available: -+ -+ ca -+ Use the CA public certificate found in in PEM format -+ cert -+ Use the client public certificate found in in PEM format -+ or in engine:engine_id format -+ key -+ Use the client private key found in in PEM format -+ or in engine:engine_id format -+ crl-dir -+ Use CRL files from dir. It contains CRL files in PEM -+ format and each file contains a CRL. The files are looked up -+ by the issuer name hash value. Use the c_rehash utility -+ to create necessary links. -+ need-peer-eap -+ If the peer doesn't ask us to authenticate or doesn't use eap -+ to authenticate us, disconnect. -+ -+ Note: -+ password-encrypted certificates can be used as of v0.94 of this -+ patch. The password for the eap-tls.key file is specified using -+ the regular -+ password .... -+ statement in the ppp options file, or by using the appropriate -+ plugin which supplies a 'eaptls_passwd_hook' routine. -+ -+5. Connecting -+ -+ If you're setting up a pppd server, edit the EAP-TLS configuration file -+ as written above and then run pppd with the 'auth' option to authenticate -+ the client. The EAP-TLS method will be used if the other eap methods can't -+ be used (no secrets). -+ -+ If you're setting up a client, edit the configuration file and then run -+ pppd with 'remotename' option to specify the server name. Add the -+ 'need-peer-eap' option if you want to be sure the peer ask you to -+ authenticate (and to use eap) and to disconnect if it doesn't. -+ -+6. Notes -+ -+ This is experimental code. -+ Send suggestions and comments to Jan Just Keijser -+ diff --git a/network/connection/ppp/files/nostrip.patch b/network/connection/ppp/files/nostrip.patch deleted file mode 100644 index 342eb04f72..0000000000 --- a/network/connection/ppp/files/nostrip.patch +++ /dev/null @@ -1,92 +0,0 @@ -Index: ppp-2.4.5/chat/Makefile.linux -=================================================================== ---- ppp-2.4.5.orig/chat/Makefile.linux -+++ ppp-2.4.5/chat/Makefile.linux -@@ -25,7 +25,7 @@ chat.o: chat.c - - install: chat - mkdir -p $(BINDIR) $(MANDIR) -- $(INSTALL) -s -c chat $(BINDIR) -+ $(INSTALL) -c chat $(BINDIR) - $(INSTALL) -c -m 644 chat.8 $(MANDIR) - - clean: -Index: ppp-2.4.5/pppd/Makefile.linux -=================================================================== ---- ppp-2.4.5.orig/pppd/Makefile.linux -+++ ppp-2.4.5/pppd/Makefile.linux -@@ -100,7 +100,7 @@ ifdef USE_SRP - CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include - LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto - TARGETS += srp-entry --EXTRAINSTALL = $(INSTALL) -s -c -m 555 srp-entry $(BINDIR)/srp-entry -+EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry - MANPAGES += srp-entry.8 - EXTRACLEAN += srp-entry.o - NEEDDES=y -@@ -201,7 +201,7 @@ all: $(TARGETS) - install: pppd - mkdir -p $(BINDIR) $(MANDIR) - $(EXTRAINSTALL) -- $(INSTALL) -s -c -m 555 pppd $(BINDIR)/pppd -+ $(INSTALL) -c -m 555 pppd $(BINDIR)/pppd - if chgrp pppusers $(BINDIR)/pppd 2>/dev/null; then \ - chmod o-rx,u+s $(BINDIR)/pppd; fi - $(INSTALL) -c -m 444 pppd.8 $(MANDIR) -Index: ppp-2.4.5/pppd/plugins/radius/Makefile.linux -=================================================================== ---- ppp-2.4.5.orig/pppd/plugins/radius/Makefile.linux -+++ ppp-2.4.5/pppd/plugins/radius/Makefile.linux -@@ -36,9 +36,9 @@ all: $(PLUGIN) - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -s -c -m 755 radius.so $(LIBDIR) -- $(INSTALL) -s -c -m 755 radattr.so $(LIBDIR) -- $(INSTALL) -s -c -m 755 radrealms.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radius.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radattr.so $(LIBDIR) -+ $(INSTALL) -c -m 755 radrealms.so $(LIBDIR) - $(INSTALL) -c -m 444 pppd-radius.8 $(MANDIR) - $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) - -Index: ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux -=================================================================== ---- ppp-2.4.5.orig/pppd/plugins/rp-pppoe/Makefile.linux -+++ ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux -@@ -43,9 +43,9 @@ rp-pppoe.so: plugin.o discovery.o if.o c - - install: all - $(INSTALL) -d -m 755 $(LIBDIR) -- $(INSTALL) -s -c -m 4550 rp-pppoe.so $(LIBDIR) -+ $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR) - $(INSTALL) -d -m 755 $(BINDIR) -- $(INSTALL) -s -c -m 555 pppoe-discovery $(BINDIR) -+ $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) - - clean: - rm -f *.o *.so pppoe-discovery -Index: ppp-2.4.5/pppdump/Makefile.linux -=================================================================== ---- ppp-2.4.5.orig/pppdump/Makefile.linux -+++ ppp-2.4.5/pppdump/Makefile.linux -@@ -17,5 +17,5 @@ clean: - - install: - mkdir -p $(BINDIR) $(MANDIR) -- $(INSTALL) -s -c pppdump $(BINDIR) -+ $(INSTALL) -c pppdump $(BINDIR) - $(INSTALL) -c -m 444 pppdump.8 $(MANDIR) -Index: ppp-2.4.5/pppstats/Makefile.linux -=================================================================== ---- ppp-2.4.5.orig/pppstats/Makefile.linux -+++ ppp-2.4.5/pppstats/Makefile.linux -@@ -22,7 +22,7 @@ all: pppstats - - install: pppstats - -mkdir -p $(MANDIR) -- $(INSTALL) -s -c pppstats $(BINDIR) -+ $(INSTALL) -c pppstats $(BINDIR) - $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) - - pppstats: $(PPPSTATSRCS) diff --git a/network/connection/ppp/files/ppp-2.3.6-sample.patch b/network/connection/ppp/files/ppp-2.3.6-sample.patch deleted file mode 100644 index 92eee6c0e3..0000000000 --- a/network/connection/ppp/files/ppp-2.3.6-sample.patch +++ /dev/null @@ -1,295 +0,0 @@ ---- ppp-2.3.3/sample/auth-down.sample Tue Jan 6 17:53:27 1998 -+++ ppp-2.3.3/sample/auth-down Tue Jan 6 17:53:27 1998 -@@ -0,0 +1,17 @@ -+#!/bin/sh -+# -+# A program or script which is executed after the remote system -+# successfully authenticates itself. It is executed with the parameters -+# -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+echo auth-down `date +'%y/%m/%d %T'` $* >> /var/log/pppstats -+ -+# last line ---- ppp-2.3.3/sample/auth-up.sample Tue Jan 6 17:53:27 1998 -+++ ppp-2.3.3/sample/auth-up Tue Jan 6 17:53:27 1998 -@@ -0,0 +1,17 @@ -+#!/bin/sh -+# -+# A program or script which is executed after the remote system -+# successfully authenticates itself. It is executed with the parameters -+# -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+echo auth-up `date +'%y/%m/%d %T'` $* >> /var/log/pppstats -+ -+# last line ---- ppp-2.3.3/sample/ip-down.sample Tue Jan 6 17:53:27 1998 -+++ ppp-2.3.3/sample/ip-down Tue Jan 6 17:53:27 1998 -@@ -0,0 +1,22 @@ -+#!/bin/sh -+# -+# This script is run by the pppd _after_ the link is brought down. -+# It should be used to delete routes, unset IP addresses etc. -+# -+# This script is called with the following arguments: -+# Arg Name Example -+# $1 Interface name ppp0 -+# $2 The tty ttyS1 -+# $3 The link speed 38400 -+# $4 Local IP number 12.34.56.78 -+# $5 Peer IP number 12.34.56.99 -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+# last line ---- ppp-2.3.3/sample/ip-up.sample Tue Jan 6 17:53:27 1998 -+++ ppp-2.3.3/sample/ip-up Tue Jan 6 17:53:27 1998 -@@ -0,0 +1,23 @@ -+#!/bin/sh -+# -+# This script is run by the pppd after the link is established. -+# It should be used to add routes, set IP address, run the mailq -+# etc. -+# -+# This script is called with the following arguments: -+# Arg Name Example -+# $1 Interface name ppp0 -+# $2 The tty ttyS1 -+# $3 The link speed 38400 -+# $4 Local IP number 12.34.56.78 -+# $5 Peer IP number 12.34.56.99 -+# -+ -+# -+# The environment is cleared before executing this script -+# so the path must be reset -+# -+PATH=/usr/sbin:/sbin:/usr/bin:/bin -+export PATH -+ -+# last line ---- ppp-2.3.3/sample/options.sample Tue Jan 6 17:53:27 1998 -+++ ppp-2.3.3/sample/options Tue Jan 6 17:53:27 1998 -@@ -0,0 +1,153 @@ -+# /etc/ppp/options -+ -+# The name of this server. Often, the FQDN is used here. -+#name -+ -+# Enforce the use of the hostname as the name of the local system for -+# authentication purposes (overrides the name option). -+usehostname -+ -+# If no local IP address is given, pppd will use the first IP address -+# that belongs to the local hostname. If "noipdefault" is given, this -+# is disabled and the peer will have to supply an IP address. -+noipdefault -+ -+# With this option, pppd will accept the peer's idea of our local IP -+# address, even if the local IP address was specified in an option. -+#ipcp-accept-local -+ -+# With this option, pppd will accept the peer's idea of its (remote) IP -+# address, even if the remote IP address was specified in an option. -+#ipcp-accept-remote -+ -+# Specify which DNS Servers the incoming Win95 or WinNT Connection should use -+# Two Servers can be remotely configured -+#ms-dns 192.168.1.1 -+#ms-dns 192.168.1.2 -+ -+# Specify which WINS Servers the incoming connection Win95 or WinNT should use -+#wins-addr 192.168.1.50 -+#wins-addr 192.168.1.51 -+ -+# enable this on a server that already has a permanent default route -+#nodefaultroute -+ -+# Run the executable or shell command specified after pppd has terminated -+# the link. This script could, for example, issue commands to the modem -+# to cause it to hang up if hardware modem control signals were not -+# available. -+# If mgetty is running, it will reset the modem anyway. So there is no need -+# to do it here. -+#disconnect "chat -- \d+++\d\c OK ath0 OK" -+ -+# Increase debugging level (same as -d). The debug output is written -+# to syslog LOG_LOCAL2. -+debug -+ -+# Enable debugging code in the kernel-level PPP driver. The argument n -+# is a number which is the sum of the following values: 1 to enable -+# general debug messages, 2 to request that the contents of received -+# packets be printed, and 4 to request that the contents of transmitted -+# packets be printed. -+#kdebug n -+ -+# Require the peer to authenticate itself before allowing network -+# packets to be sent or received. -+# Please do not disable this setting. It is expected to be standard in -+# future releases of pppd. Use the call option (see manpage) to disable -+# authentication for specific peers. -+#auth -+ -+# authentication can either be pap or chap. As most people only want to -+# use pap, you can also disable chap: -+#require-pap -+#refuse-chap -+ -+# Use hardware flow control (i.e. RTS/CTS) to control the flow of data -+# on the serial port. -+crtscts -+ -+# Specifies that pppd should use a UUCP-style lock on the serial device -+# to ensure exclusive access to the device. -+lock -+ -+# Use the modem control lines. -+modem -+ -+# async character map -- 32-bit hex; each bit is a character -+# that needs to be escaped for pppd to receive it. 0x00000001 -+# represents '\x01', and 0x80000000 represents '\x1f'. -+# To allow pppd to work over a rlogin/telnet connection, ou should escape -+# XON (^Q), XOFF (^S) and ^]: (The peer should use "escape ff".) -+#asyncmap 200a0000 -+asyncmap 0 -+ -+# Specifies that certain characters should be escaped on transmission -+# (regardless of whether the peer requests them to be escaped with its -+# async control character map). The characters to be escaped are -+# specified as a list of hex numbers separated by commas. Note that -+# almost any character can be specified for the escape option, unlike -+# the asyncmap option which only allows control characters to be -+# specified. The characters which may not be escaped are those with hex -+# values 0x20 - 0x3f or 0x5e. -+#escape 11,13,ff -+ -+# Set the MRU [Maximum Receive Unit] value to for negotiation. pppd -+# will ask the peer to send packets of no more than bytes. The -+# minimum MRU value is 128. The default MRU value is 1500. A value of -+# 296 is recommended for slow links (40 bytes for TCP/IP header + 256 -+# bytes of data). -+#mru 542 -+ -+# Set the MTU [Maximum Transmit Unit] value to . Unless the peer -+# requests a smaller value via MRU negotiation, pppd will request that -+# the kernel networking code send data packets of no more than n bytes -+# through the PPP network interface. -+#mtu -+ -+# Set the interface netmask to , a 32 bit netmask in "decimal dot" -+# notation (e.g. 255.255.255.0). -+#netmask 255.255.255.0 -+ -+# Don't fork to become a background process (otherwise pppd will do so -+# if a serial device is specified). -+nodetach -+ -+# Set the assumed name of the remote system for authentication purposes -+# to . -+#remotename -+ -+# Add an entry to this system's ARP [Address Resolution Protocol] -+# table with the IP address of the peer and the Ethernet address of this -+# system. {proxyarp,noproxyarp} -+proxyarp -+ -+# Use the system password database for authenticating the peer using -+# PAP. Note: mgetty already provides this option. If this is specified -+# then dialin from users using a script under Linux to fire up ppp wont work. -+#login -+ -+# If this option is given, pppd will send an LCP echo-request frame to -+# the peer every n seconds. Under Linux, the echo-request is sent when -+# no packets have been received from the peer for n seconds. Normally -+# the peer should respond to the echo-request by sending an echo-reply. -+# This option can be used with the lcp-echo-failure option to detect -+# that the peer is no longer connected. -+lcp-echo-interval 30 -+ -+# If this option is given, pppd will presume the peer to be dead if n -+# LCP echo-requests are sent without receiving a valid LCP echo-reply. -+# If this happens, pppd will terminate the connection. Use of this -+# option requires a non-zero value for the lcp-echo-interval parameter. -+# This option can be used to enable pppd to terminate after the physical -+# connection has been broken (e.g., the modem has hung up) in -+# situations where no hardware modem control lines are available. -+lcp-echo-failure 4 -+ -+# Specifies that pppd should disconnect if the link is idle for n seconds. -+idle 600 -+ -+# Disable the IPXCP and IPX protocols. -+noipx -+ -+# ------ ---- ppp-2.3.3/sample/options.ttyXX.sample Tue Jan 6 17:53:27 1998 -+++ ppp-2.3.3/sample/options.ttyXX Tue Jan 6 17:53:27 1998 -@@ -0,0 +1,14 @@ -+# If you need to set up multiple serial lines then copy this file to -+# options. for each tty with a modem on it. -+# -+# The options.tty file will assign an IP address to each PPP connection -+# as it comes up. They must all be distinct! -+# -+# Example: -+# options.ttyS1 for com2 under DOS. -+# -+# Edit the following line so that the first IP address -+# mentioned is the ip address of the serial port while the second -+# is the IP address of your host -+# -+hostname-s1:hostname ---- ppp-2.3.3/sample/pap-secrets.sample Tue Jan 6 17:53:27 1998 -+++ ppp-2.3.3/sample/pap-secrets Tue Jan 6 17:53:27 1998 -@@ -0,0 +1,28 @@ -+# Secrets for authentication using PAP -+# client server secret IP addresses -+ -+# OUTBOUND CONNECTIONS -+# Here you should add your userid password to connect to your providers via -+# pap. The * means that the password is to be used for ANY host you connect -+# to. Thus you do not have to worry about the foreign machine name. Just -+# replace password with your password. -+# If you have different providers with different passwords then you better -+# remove the following line. -+#hostname * password -+ -+# INBOUND CONNECTIONS -+#client hostname 192.168.1.1 -+ -+# If you add "auth login -chap +pap" to /etc/mgetty+sendfax/login.config, -+# all users in /etc/passwd can use their password for pap-authentication. -+# -+# Every regular user can use PPP and has to use passwords from /etc/passwd -+#* hostname "" -+# UserIDs that cannot use PPP at all. Check your /etc/passwd and add any -+# other accounts that should not be able to use pppd! Replace hostname -+# with your local hostname. -+#guest hostname "*" - -+#master hostname "*" - -+#root hostname "*" - -+#support hostname "*" - -+#stats hostname "*" - diff --git a/network/connection/ppp/files/ppp-2.4.2-change_resolv_conf.patch b/network/connection/ppp/files/ppp-2.4.2-change_resolv_conf.patch deleted file mode 100644 index 9674f1af74..0000000000 --- a/network/connection/ppp/files/ppp-2.4.2-change_resolv_conf.patch +++ /dev/null @@ -1,61 +0,0 @@ -diff -urNp --exclude-from=/mdomsch2/excludes --minimal ppp-2.4.3.orig/pppd/pppd.8 ppp-2.4.3/pppd/pppd.8 ---- ppp-2.4.3.orig/pppd/pppd.8 2004-11-13 06:22:49.000000000 -0600 -+++ ppp-2.4.3/pppd/pppd.8 2005-08-03 22:10:34.000000000 -0500 -@@ -1035,7 +1035,7 @@ Ask the peer for up to 2 DNS server addr - by the peer (if any) are passed to the /etc/ppp/ip\-up script in the - environment variables DNS1 and DNS2, and the environment variable - USEPEERDNS will be set to 1. In addition, pppd will create an --/etc/ppp/resolv.conf file containing one or two nameserver lines with -+/run/ppp/resolv.conf file containing one or two nameserver lines with - the address(es) supplied by the peer. - .TP - .B user \fIname ---- ppp-2.4.2/scripts/ip-down.local.add.change_resolv_conf 1999-02-27 05:32:42.000000000 +0100 -+++ ppp-2.4.2/scripts/ip-down.local.add 2004-09-14 14:36:20.058008752 +0200 -@@ -9,12 +9,13 @@ - # - # Nick Walker (nickwalker@email.com) - # -+. /etc/sysconfig/network-scripts/network-functions - --if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then -- if [ -f /etc/ppp/resolv.prev ]; then -- cp -f /etc/ppp/resolv.prev /etc/resolv.conf -+if [ -n "$USEPEERDNS" -a -f /run/ppp/resolv.conf ]; then -+ if [ -f /run/ppp/resolv.prev ]; then -+ change_resolv_conf /run/ppp/resolv.prev - else -- rm -f /etc/resolv.conf -+ change_resolv_conf - fi - fi - ---- ppp-2.4.2/scripts/ip-up.local.add.change_resolv_conf 1999-11-15 04:28:10.000000000 +0100 -+++ ppp-2.4.2/scripts/ip-up.local.add 2004-09-14 14:37:39.129061828 +0200 -@@ -9,16 +9,19 @@ - # - # Nick Walker (nickwalker@email.com) - # -+. /etc/sysconfig/network-scripts/network-functions - --if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then -- rm -f /etc/ppp/resolv.prev -+if [ -n "$USEPEERDNS" -a -f /run/ppp/resolv.conf ]; then -+ rm -f /run/ppp/resolv.prev - if [ -f /etc/resolv.conf ]; then -- cp /etc/resolv.conf /etc/ppp/resolv.prev -- grep domain /etc/ppp/resolv.prev > /etc/resolv.conf -- grep search /etc/ppp/resolv.prev >> /etc/resolv.conf -- cat /etc/ppp/resolv.conf >> /etc/resolv.conf -+ cp /etc/resolv.conf /run/ppp/resolv.prev -+ rscf=/run/ppp/resolv.new -+ grep domain /run/ppp/resolv.prev > $rscf -+ grep search /run/ppp/resolv.prev >> $rscf -+ change_resolv_conf $rscf -+ rm -f $rscf - else -- cp /etc/ppp/resolv.conf /etc -+ change_resolv_conf /run/ppp/resolv.conf - fi - fi - diff --git a/network/connection/ppp/files/ppp-2.4.3-fix64.patch b/network/connection/ppp/files/ppp-2.4.3-fix64.patch deleted file mode 100644 index 8a2c794d14..0000000000 --- a/network/connection/ppp/files/ppp-2.4.3-fix64.patch +++ /dev/null @@ -1,10 +0,0 @@ ---- ppp-2.4.3/pppd/sha1.c.fix64 2004-10-25 01:28:02.000000000 +0200 -+++ ppp-2.4.3/pppd/sha1.c 2004-11-22 16:44:16.850768926 +0100 -@@ -18,6 +18,7 @@ - - #include - #include /* htonl() */ -+#include /* u_int32_t */ - #include - #include "sha1.h" - diff --git a/network/connection/ppp/files/ppp-2.4.3-ipv6-accept-remote.patch b/network/connection/ppp/files/ppp-2.4.3-ipv6-accept-remote.patch deleted file mode 100644 index 2bc82338cd..0000000000 --- a/network/connection/ppp/files/ppp-2.4.3-ipv6-accept-remote.patch +++ /dev/null @@ -1,40 +0,0 @@ ---- ppp-2.4.3/pppd/ipv6cp.c~ 2005-11-04 09:40:10.000000000 +0000 -+++ ppp-2.4.3/pppd/ipv6cp.c 2005-11-04 10:20:14.000000000 +0000 -@@ -235,6 +235,8 @@ static option_t ipv6cp_option_list[] = { - - { "ipv6cp-accept-local", o_bool, &ipv6cp_allowoptions[0].accept_local, - "Accept peer's interface identifier for us", 1 }, -+ { "ipv6cp-accept-remote", o_bool, &ipv6cp_allowoptions[0].accept_remote, -+ "Accept peer's interface identifier for itself", 1 }, - - { "ipv6cp-use-ipaddr", o_bool, &ipv6cp_allowoptions[0].use_ip, - "Use (default) IPv4 address as interface identifier", 1 }, -@@ -427,6 +429,7 @@ ipv6cp_init(unit) - memset(ao, 0, sizeof(*ao)); - - wo->accept_local = 1; -+ wo->accept_remote = 1; - wo->neg_ifaceid = 1; - ao->neg_ifaceid = 1; - -@@ -952,7 +955,7 @@ ipv6cp_reqci(f, inp, len, reject_if_disa - orc = CONFREJ; /* Reject CI */ - break; - } -- if (!eui64_iszero(wo->hisid) && -+ if (!eui64_iszero(wo->hisid) && !wo->accept_remote && - !eui64_equals(ifaceid, wo->hisid) && - eui64_iszero(go->hisid)) { - ---- ppp-2.4.3/pppd/ipv6cp.h~ 2002-12-04 23:03:32.000000000 +0000 -+++ ppp-2.4.3/pppd/ipv6cp.h 2005-11-04 10:20:55.000000000 +0000 -@@ -150,7 +150,8 @@ - typedef struct ipv6cp_options { - int neg_ifaceid; /* Negotiate interface identifier? */ - int req_ifaceid; /* Ask peer to send interface identifier? */ -- int accept_local; /* accept peer's value for iface id? */ -+ int accept_local; /* accept peer's value for our iface id? */ -+ int accept_remote; /* accept peer's value for his iface id? */ - int opt_local; /* ourtoken set by option */ - int opt_remote; /* histoken set by option */ - int use_ip; /* use IP as interface identifier */ diff --git a/network/connection/ppp/files/ppp-2.4.3-local.patch b/network/connection/ppp/files/ppp-2.4.3-local.patch deleted file mode 100644 index 3288cba223..0000000000 --- a/network/connection/ppp/files/ppp-2.4.3-local.patch +++ /dev/null @@ -1,68 +0,0 @@ -diff -up ppp-2.4.4/configure.local ppp-2.4.4/configure ---- ppp-2.4.4/configure.local 2005-07-08 20:23:05.000000000 -0400 -+++ ppp-2.4.4/configure 2008-08-28 17:38:04.000000000 -0400 -@@ -2,7 +2,7 @@ - # $Id: configure,v 1.38 2008/06/15 07:08:49 paulus Exp $ - - # Where to install stuff by default --DESTDIR=/usr/local -+DESTDIR=/usr - SYSCONF=/etc - - # if [ -d /NextApps ]; then -diff -up ppp-2.4.4/pppd/Makefile.linux.local ppp-2.4.4/pppd/Makefile.linux ---- ppp-2.4.4/pppd/Makefile.linux.local 2008-08-28 17:37:33.000000000 -0400 -+++ ppp-2.4.4/pppd/Makefile.linux 2008-08-28 17:37:33.000000000 -0400 -@@ -97,8 +97,8 @@ endif - - # EAP SRP-SHA1 - ifdef USE_SRP --CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include --LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto -+CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/include/openssl -+LIBS += -lsrp -L/usr/lib -lcrypto - TARGETS += srp-entry - EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry - MANPAGES += srp-entry.8 -diff -up ppp-2.4.4/scripts/ppp-on-rsh.local ppp-2.4.4/scripts/ppp-on-rsh ---- ppp-2.4.4/scripts/ppp-on-rsh.local 2000-04-15 05:49:28.000000000 -0400 -+++ ppp-2.4.4/scripts/ppp-on-rsh 2008-08-28 17:37:33.000000000 -0400 -@@ -26,7 +26,7 @@ PPPD_RHOST=myremotehost - # For this example, we assume that pppd on both local and remote - # machines reside in the same place, /usr/local/bin/pppd - # --PPPD_LOC=/usr/local/bin/pppd -+PPPD_LOC=/usr/sbin/pppd - - # - # The location of local options file (where rsh client is running). -diff -up ppp-2.4.4/scripts/ppp-on-ssh.local ppp-2.4.4/scripts/ppp-on-ssh ---- ppp-2.4.4/scripts/ppp-on-ssh.local 2000-04-15 05:49:42.000000000 -0400 -+++ ppp-2.4.4/scripts/ppp-on-ssh 2008-08-28 17:37:33.000000000 -0400 -@@ -26,7 +26,7 @@ PPPD_RHOST=myremotehost - # For this example, we assume that pppd on both local and remote - # machines reside in the same place, /usr/local/bin/pppd - # --PPPD_LOC=/usr/local/bin/pppd -+PPPD_LOC=/usr/sbin/pppd - - # - # The location of local options file (where ssh client is running). -@@ -52,7 +52,7 @@ PPPD_REM_OPT=/etc/ppp/options-ssh-rem - # - # The location of ssh client on the local machine - # --SSH_LOC=/usr/local/bin/ssh -+SSH_LOC=/usr/bin/ssh - - export PPPD_LOC PPPD_LOC_OPT PPPD_REM_OPT PPPD_RHOST SSH_LOC - -diff -up ppp-2.4.4/scripts/secure-card.local ppp-2.4.4/scripts/secure-card ---- ppp-2.4.4/scripts/secure-card.local 2004-02-01 22:36:46.000000000 -0500 -+++ ppp-2.4.4/scripts/secure-card 2008-08-28 17:37:33.000000000 -0400 -@@ -1,4 +1,4 @@ --#!/usr/local/bin/expect -f -+#!/usr/bin/expect -f - # - # This script was written by Jim Isaacson . It is - # designed to work as a script to use the SecureCARD(tm) device. This diff --git a/network/connection/ppp/files/ppp-2.4.5-ppp_resolv.patch b/network/connection/ppp/files/ppp-2.4.5-ppp_resolv.patch deleted file mode 100644 index f0cc7c63a3..0000000000 --- a/network/connection/ppp/files/ppp-2.4.5-ppp_resolv.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -up ppp-2.4.5/scripts/ip-up.local.add.ppp_resolv ppp-2.4.5/scripts/ip-up.local.add ---- ppp-2.4.5/scripts/ip-up.local.add.ppp_resolv 2010-07-13 10:29:23.227943994 +0200 -+++ ppp-2.4.5/scripts/ip-up.local.add 2010-07-13 10:32:27.729695487 +0200 -@@ -18,6 +18,9 @@ if [ -n "$USEPEERDNS" -a -f /run/ppp - rscf=/run/ppp/resolv.new - grep domain /run/ppp/resolv.prev > $rscf - grep search /run/ppp/resolv.prev >> $rscf -+ if [ -f /run/ppp/resolv.conf ]; then -+ cat /run/ppp/resolv.conf >> $rscf -+ fi - change_resolv_conf $rscf - rm -f $rscf - else diff --git a/network/connection/ppp/files/ppp-2.4.5-var_run_ppp.patch b/network/connection/ppp/files/ppp-2.4.5-var_run_ppp.patch deleted file mode 100644 index 5caca49615..0000000000 --- a/network/connection/ppp/files/ppp-2.4.5-var_run_ppp.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff -up ppp-2.4.5/pppd/pathnames.h.var_run_ppp ppp-2.4.5/pppd/pathnames.h ---- ppp-2.4.5/pppd/pathnames.h.var_run_ppp 2010-02-12 16:36:14.479362718 +0100 -+++ ppp-2.4.5/pppd/pathnames.h 2010-02-12 16:38:24.995330994 +0100 -@@ -7,9 +7,13 @@ - #ifdef HAVE_PATHS_H - #include - -+#define _SUBPATH_PPP "ppp/" - #else /* HAVE_PATHS_H */ - #ifndef _PATH_VARRUN - #define _PATH_VARRUN "/etc/ppp/" -+#define _SUBPATH_PPP -+#else -+#define _SUBPATH_PPP "ppp/" - #endif - #define _PATH_DEVNULL "/dev/null" - #endif /* HAVE_PATHS_H */ -@@ -46,10 +50,10 @@ - #endif /* IPX_CHANGE */ - - #ifdef __STDC__ --#define _PATH_PPPDB _ROOT_PATH _PATH_VARRUN "pppd2.tdb" -+#define _PATH_PPPDB _ROOT_PATH _PATH_VARRUN _SUBPATH_PPP "pppd2.tdb" - #else /* __STDC__ */ - #ifdef HAVE_PATHS_H --#define _PATH_PPPDB "/var/run/pppd2.tdb" -+#define _PATH_PPPDB "/run/ppp/pppd2.tdb" - #else - #define _PATH_PPPDB "/etc/ppp/pppd2.tdb" - #endif diff --git a/network/connection/ppp/files/ppp-2.4.6-eaptls-mppe-0.99.patch b/network/connection/ppp/files/ppp-2.4.6-eaptls-mppe-0.99.patch deleted file mode 100644 index 2fb48bd572..0000000000 --- a/network/connection/ppp/files/ppp-2.4.6-eaptls-mppe-0.99.patch +++ /dev/null @@ -1,2919 +0,0 @@ -diff -Naur ppp-2.4.5/etc.ppp/eaptls-client ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/eaptls-client ---- ppp-2.4.5/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/eaptls-client 2010-10-01 15:17:54.205272328 +0200 -@@ -0,0 +1,10 @@ -+# Parameters for authentication using EAP-TLS (client) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (required) -+# server certificate file (optional, if unused put '-') -+# CA certificate file (required) -+# client private key file (required) -+ -+#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key -diff -Naur ppp-2.4.5/etc.ppp/eaptls-server ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/eaptls-server ---- ppp-2.4.5/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/eaptls-server 2010-10-01 15:17:54.205272328 +0200 -@@ -0,0 +1,11 @@ -+# Parameters for authentication using EAP-TLS (server) -+ -+# client name (can be *) -+# server name (can be *) -+# client certificate file (optional, if unused put '-') -+# server certificate file (required) -+# CA certificate file (required) -+# server private key file (required) -+# allowed addresses (required, can be *) -+ -+#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 -diff -Naur ppp-2.4.5/etc.ppp/openssl.cnf ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/openssl.cnf ---- ppp-2.4.5/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/openssl.cnf 2010-10-01 15:17:54.206272162 +0200 -@@ -0,0 +1,14 @@ -+openssl_conf = openssl_def -+ -+[ openssl_def ] -+engines = engine_section -+ -+[ engine_section ] -+pkcs11 = pkcs11_section -+ -+[ pkcs11_section ] -+engine_id = pkcs11 -+dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+MODULE_PATH = /usr/lib64/libeTPkcs11.so -+init = 0 -+ -diff -aur ppp-2.4.6.orig/linux/Makefile.top ppp-2.4.6/linux/Makefile.top ---- ppp-2.4.6.orig/linux/Makefile.top 2014-01-02 05:42:08.000000000 +0100 -+++ ppp-2.4.6/linux/Makefile.top 2014-04-03 21:32:29.076627151 +0200 -@@ -26,7 +26,7 @@ - cd pppdump; $(MAKE) $(MFLAGS) install - - install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ -- $(ETCDIR)/chap-secrets -+ $(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client - - install-devel: - cd pppd; $(MAKE) $(MFLAGS) install-devel -@@ -37,6 +37,10 @@ - $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ - $(ETCDIR)/chap-secrets: - $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ -+$(ETCDIR)/eaptls-server: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-server $@ -+$(ETCDIR)/eaptls-client: -+ $(INSTALL) -c -m 600 etc.ppp/eaptls-client $@ - - $(BINDIR): - $(INSTALL) -d -m 755 $@ -diff -aur ppp-2.4.6.orig/pppd/auth.c ppp-2.4.6/pppd/auth.c ---- ppp-2.4.6.orig/pppd/auth.c 2014-04-03 21:31:37.000000000 +0200 -+++ ppp-2.4.6/pppd/auth.c 2014-04-03 21:32:29.076627151 +0200 -@@ -109,6 +109,9 @@ - #include "upap.h" - #include "chap-new.h" - #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#endif - #ifdef CBCP_SUPPORT - #include "cbcp.h" - #endif -@@ -183,6 +186,12 @@ - /* Hook for a plugin to get the CHAP password for authenticating us */ - int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; - -+#ifdef USE_EAPTLS -+/* Hook for a plugin to get the EAP-TLS password for authenticating us */ -+int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL; -+int (*eaptls_check_hook) __P((void)) = NULL; -+#endif -+ - /* Hook for a plugin to say whether it is OK if the peer - refuses to authenticate. */ - int (*null_auth_hook) __P((struct wordlist **paddrs, -@@ -238,6 +247,13 @@ - bool explicit_user = 0; /* Set if "user" option supplied */ - bool explicit_passwd = 0; /* Set if "password" option supplied */ - char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ -+#ifdef USE_EAPTLS -+char *cacert_file = NULL; /* CA certificate file (pem format) */ -+char *cert_file = NULL; /* client certificate file (pem format) */ -+char *privkey_file = NULL; /* client private key file (pem format) */ -+char *crl_dir = NULL; /* directory containing CRL files */ -+bool need_peer_eap = 0; /* Require peer to authenticate us */ -+#endif - - static char *uafname; /* name of most recent +ua file */ - -@@ -254,6 +270,19 @@ - static int have_chap_secret __P((char *, char *, int, int *)); - static int have_srp_secret __P((char *client, char *server, int need_ip, - int *lacks_ipp)); -+ -+#ifdef USE_EAPTLS -+static int have_eaptls_secret_server -+__P((char *client, char *server, int need_ip, int *lacks_ipp)); -+static int have_eaptls_secret_client __P((char *client, char *server)); -+static int scan_authfile_eaptls __P((FILE * f, char *client, char *server, -+ char *cli_cert, char *serv_cert, -+ char *ca_cert, char *pk, -+ struct wordlist ** addrs, -+ struct wordlist ** opts, -+ char *filename, int flags)); -+#endif -+ - static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); - static int scan_authfile __P((FILE *, char *, char *, char *, - struct wordlist **, struct wordlist **, -@@ -401,6 +430,14 @@ - "Set telephone number(s) which are allowed to connect", - OPT_PRIV | OPT_A2LIST }, - -+#ifdef USE_EAPTLS -+ { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, -+ { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, -+ { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, -+ { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, -+ { "need-peer-eap", o_bool, &need_peer_eap, -+ "Require the peer to authenticate us", 1 }, -+#endif /* USE_EAPTLS */ - { NULL } - }; - -@@ -730,6 +767,9 @@ - lcp_options *wo = &lcp_wantoptions[unit]; - lcp_options *go = &lcp_gotoptions[unit]; - lcp_options *ho = &lcp_hisoptions[unit]; -+#ifdef USE_EAPTLS -+ lcp_options *ao = &lcp_allowoptions[unit]; -+#endif - int i; - struct protent *protp; - -@@ -764,6 +804,22 @@ - } - } - -+#ifdef USE_EAPTLS -+ if (need_peer_eap && !ao->neg_eap) { -+ warn("eap required to authenticate us but no suitable secrets"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_AUTH_TOPEER_FAILED; -+ return; -+ } -+ -+ if (need_peer_eap && !ho->neg_eap) { -+ warn("peer doesn't want to authenticate us with eap"); -+ lcp_close(unit, "couldn't negotiate eap"); -+ status = EXIT_PEER_AUTH_FAILED; -+ return; -+ } -+#endif -+ - new_phase(PHASE_AUTHENTICATE); - auth = 0; - if (go->neg_eap) { -@@ -1281,6 +1337,15 @@ - our_name, 1, &lacks_ip); - } - -+#ifdef USE_EAPTLS -+ if (!can_auth && wo->neg_eap) { -+ can_auth = -+ have_eaptls_secret_server((explicit_remote ? remote_name : -+ NULL), our_name, 1, &lacks_ip); -+ -+ } -+#endif -+ - if (auth_required && !can_auth && noauth_addrs == NULL) { - if (default_auth) { - option_error( -@@ -1335,7 +1400,11 @@ - passwd[0] != 0 || - (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, - (explicit_remote? remote_name: NULL), 0, NULL))) || -- have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)); -+ have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL) -+#ifdef USE_EAPTLS -+ || have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL)) -+#endif -+ ); - - hadchap = -1; - if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) -@@ -1350,8 +1419,14 @@ - !have_chap_secret((explicit_remote? remote_name: NULL), our_name, - 1, NULL))) && - !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, -- NULL)) -+ NULL) -+#ifdef USE_EAPTLS -+ && !have_eaptls_secret_server((explicit_remote? remote_name: NULL), -+ our_name, 1, NULL) -+#endif -+ ) - go->neg_eap = 0; -+ - } - - -@@ -1711,6 +1786,7 @@ - } - - -+ - /* - * get_secret - open the CHAP secret file and return the secret - * for authenticating the given client on the given server. -@@ -2367,3 +2443,335 @@ - else - auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); - } -+ -+ -+#ifdef USE_EAPTLS -+static int -+have_eaptls_secret_server(client, server, need_ip, lacks_ipp) -+ char *client; -+ char *server; -+ int need_ip; -+ int *lacks_ipp; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ filename = _PATH_EAPTLSSERVFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile, -+ clicertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (ret >= 0 && need_ip && !some_ip_ok(addrs)) { -+ if (lacks_ipp != 0) -+ *lacks_ipp = 1; -+ ret = -1; -+ } -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+have_eaptls_secret_client(client, server) -+ char *client; -+ char *server; -+{ -+ FILE *f; -+ int ret; -+ char *filename; -+ struct wordlist *addrs = NULL; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ if (client != NULL && client[0] == 0) -+ client = NULL; -+ else if (server != NULL && server[0] == 0) -+ server = NULL; -+ -+ if (cacert_file && cert_file && privkey_file) -+ return 1; -+ -+ filename = _PATH_EAPTLSCLIFILE; -+ f = fopen(filename, "r"); -+ if (f == NULL) -+ return 0; -+ -+ ret = -+ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, NULL, filename, -+ 0); -+ fclose(f); -+ -+/* -+ if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile, -+ servcertfile, pkfile)) -+ ret = -1; -+*/ -+ -+ if (addrs != 0) -+ free_wordlist(addrs); -+ -+ return ret >= 0; -+} -+ -+ -+static int -+scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk, -+ addrs, opts, filename, flags) -+ FILE *f; -+ char *client; -+ char *server; -+ char *cli_cert; -+ char *serv_cert; -+ char *ca_cert; -+ char *pk; -+ struct wordlist **addrs; -+ struct wordlist **opts; -+ char *filename; -+ int flags; -+{ -+ int newline; -+ int got_flag, best_flag; -+ struct wordlist *ap, *addr_list, *alist, **app; -+ char word[MAXWORDLEN]; -+ -+ if (addrs != NULL) -+ *addrs = NULL; -+ if (opts != NULL) -+ *opts = NULL; -+ addr_list = NULL; -+ if (!getword(f, word, &newline, filename)) -+ return -1; /* file is empty??? */ -+ newline = 1; -+ best_flag = -1; -+ for (;;) { -+ /* -+ * Skip until we find a word at the start of a line. -+ */ -+ while (!newline && getword(f, word, &newline, filename)); -+ if (!newline) -+ break; /* got to end of file */ -+ -+ /* -+ * Got a client - check if it's a match or a wildcard. -+ */ -+ got_flag = 0; -+ if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) { -+ newline = 0; -+ continue; -+ } -+ if (!ISWILD(word)) -+ got_flag = NONWILD_CLIENT; -+ -+ /* -+ * Now get a server and check if it matches. -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (!ISWILD(word)) { -+ if (server != NULL && strcmp(word, server) != 0) -+ continue; -+ got_flag |= NONWILD_SERVER; -+ } -+ -+ /* -+ * Got some sort of a match - see if it's better than what -+ * we have already. -+ */ -+ if (got_flag <= best_flag) -+ continue; -+ -+ /* -+ * Get the cli_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(cli_cert, word, MAXWORDLEN); -+ } else -+ cli_cert[0] = 0; -+ -+ /* -+ * Get serv_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ if (strcmp(word, "-") != 0) { -+ strlcpy(serv_cert, word, MAXWORDLEN); -+ } else -+ serv_cert[0] = 0; -+ -+ /* -+ * Get ca_cert -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(ca_cert, word, MAXWORDLEN); -+ -+ /* -+ * Get pk -+ */ -+ if (!getword(f, word, &newline, filename)) -+ break; -+ if (newline) -+ continue; -+ strlcpy(pk, word, MAXWORDLEN); -+ -+ -+ /* -+ * Now read address authorization info and make a wordlist. -+ */ -+ app = &alist; -+ for (;;) { -+ if (!getword(f, word, &newline, filename) || newline) -+ break; -+ ap = (struct wordlist *) -+ malloc(sizeof(struct wordlist) + strlen(word) + 1); -+ if (ap == NULL) -+ novm("authorized addresses"); -+ ap->word = (char *) (ap + 1); -+ strcpy(ap->word, word); -+ *app = ap; -+ app = &ap->next; -+ } -+ *app = NULL; -+ /* -+ * This is the best so far; remember it. -+ */ -+ best_flag = got_flag; -+ if (addr_list) -+ free_wordlist(addr_list); -+ addr_list = alist; -+ -+ if (!newline) -+ break; -+ } -+ -+ /* scan for a -- word indicating the start of options */ -+ for (app = &addr_list; (ap = *app) != NULL; app = &ap->next) -+ if (strcmp(ap->word, "--") == 0) -+ break; -+ /* ap = start of options */ -+ if (ap != NULL) { -+ ap = ap->next; /* first option */ -+ free(*app); /* free the "--" word */ -+ *app = NULL; /* terminate addr list */ -+ } -+ if (opts != NULL) -+ *opts = ap; -+ else if (ap != NULL) -+ free_wordlist(ap); -+ if (addrs != NULL) -+ *addrs = addr_list; -+ else if (addr_list != NULL) -+ free_wordlist(addr_list); -+ -+ return best_flag; -+} -+ -+ -+int -+get_eaptls_secret(unit, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, am_server) -+ int unit; -+ char *client; -+ char *server; -+ char *clicertfile; -+ char *servcertfile; -+ char *cacertfile; -+ char *pkfile; -+ int am_server; -+{ -+ FILE *fp; -+ int ret; -+ char *filename = NULL; -+ struct wordlist *addrs = NULL; -+ struct wordlist *opts = NULL; -+ -+ /* in client mode the ca+cert+privkey can also be specified as options */ -+ if (!am_server && cacert_file && cert_file && privkey_file ) -+ { -+ strlcpy( clicertfile, cert_file, MAXWORDLEN ); -+ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); -+ strlcpy( pkfile, privkey_file, MAXWORDLEN ); -+ servcertfile[0] = '\0'; -+ } -+ else -+ { -+ filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE); -+ addrs = NULL; -+ -+ fp = fopen(filename, "r"); -+ if (fp == NULL) -+ { -+ error("Can't open eap-tls secret file %s: %m", filename); -+ return 0; -+ } -+ -+ check_access(fp, filename); -+ -+ ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile, -+ cacertfile, pkfile, &addrs, &opts, filename, 0); -+ -+ fclose(fp); -+ -+ if (ret < 0) return 0; -+ } -+ -+ if (eaptls_passwd_hook) -+ { -+ dbglog( "Calling eaptls password hook" ); -+ if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0) -+ { -+ error("Unable to obtain EAP-TLS password for %s (%s) from plugin", -+ client, pkfile); -+ return 0; -+ } -+ } -+ if (am_server) -+ set_allowed_addrs(unit, addrs, opts); -+ else if (opts != NULL) -+ free_wordlist(opts); -+ if (addrs != NULL) -+ free_wordlist(addrs); -+ -+ return 1; -+} -+#endif -+ -diff -aur ppp-2.4.6.orig/pppd/ccp.c ppp-2.4.6/pppd/ccp.c ---- ppp-2.4.6.orig/pppd/ccp.c 2014-01-02 05:42:08.000000000 +0100 -+++ ppp-2.4.6/pppd/ccp.c 2014-04-03 21:32:29.076627151 +0200 -@@ -540,6 +540,9 @@ - if (go->mppe) { - ccp_options *ao = &ccp_allowoptions[f->unit]; - int auth_mschap_bits = auth_done[f->unit]; -+#ifdef USE_EAPTLS -+ int auth_eap_bits = auth_done[f->unit]; -+#endif - int numbits; - - /* -@@ -567,8 +570,23 @@ - lcp_close(f->unit, "MPPE required but not available"); - return; - } -+ -+#ifdef USE_EAPTLS -+ /* -+ * MPPE is also possible in combination with EAP-TLS. -+ * It is not possible to detect if we're doing EAP or EAP-TLS -+ * at this stage, hence we accept all forms of EAP. If TLS is -+ * not used then the MPPE keys will not be derived anyway. -+ */ -+ /* Leave only the eap auth bits set */ -+ auth_eap_bits &= (EAP_WITHPEER | EAP_PEER ); -+ -+ if ((numbits == 0) && (auth_eap_bits == 0)) { -+ error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed."); -+#else - if (!numbits) { -- error("MPPE required, but MS-CHAP[v2] auth not performed."); -+ error("MPPE required, but MS-CHAP[v2] auth not performed."); -+#endif - lcp_close(f->unit, "MPPE required but not available"); - return; - } -diff -aur ppp-2.4.6.orig/pppd/chap-md5.c ppp-2.4.6/pppd/chap-md5.c ---- ppp-2.4.6.orig/pppd/chap-md5.c 2014-01-02 05:42:08.000000000 +0100 -+++ ppp-2.4.6/pppd/chap-md5.c 2014-04-03 21:32:29.079960484 +0200 -@@ -36,7 +36,11 @@ - #include "chap-new.h" - #include "chap-md5.h" - #include "magic.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#else - #include "md5.h" -+#endif /* USE_EAPTLS */ - - #define MD5_HASH_SIZE 16 - #define MD5_MIN_CHALLENGE 16 -diff -aur ppp-2.4.6.orig/pppd/eap.c ppp-2.4.6/pppd/eap.c ---- ppp-2.4.6.orig/pppd/eap.c 2014-01-02 05:42:08.000000000 +0100 -+++ ppp-2.4.6/pppd/eap.c 2014-04-03 21:32:29.079960484 +0200 -@@ -43,6 +43,11 @@ - * Based on draft-ietf-pppext-eap-srp-03.txt. - */ - -+/* -+ * Modification by Beniamino Galvani, Mar 2005 -+ * Implemented EAP-TLS authentication -+ */ -+ - #define RCSID "$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $" - - /* -@@ -62,8 +67,12 @@ - - #include "pppd.h" - #include "pathnames.h" --#include "md5.h" - #include "eap.h" -+#ifdef USE_EAPTLS -+#include "eap-tls.h" -+#else -+#include "md5.h" -+#endif /* USE_EAPTLS */ - - #ifdef USE_SRP - #include -@@ -209,6 +218,9 @@ - esp->es_server.ea_id = (u_char)(drand48() * 0x100); - esp->es_client.ea_timeout = EAP_DEFREQTIME; - esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; -+#ifdef USE_EAPTLS -+ esp->es_client.ea_using_eaptls = 0; -+#endif /* USE_EAPTLS */ - } - - /* -@@ -436,8 +448,16 @@ - u_char vals[2]; - struct b64state bs; - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ int secret_len; -+ char secret[MAXWORDLEN]; -+#endif /* USE_EAPTLS */ - - esp->es_server.ea_timeout = esp->es_savedtime; -+#ifdef USE_EAPTLS -+ esp->es_server.ea_prev_state = esp->es_server.ea_state; -+#endif /* USE_EAPTLS */ - switch (esp->es_server.ea_state) { - case eapBadAuth: - return; -@@ -562,9 +582,81 @@ - break; - } - #endif /* USE_SRP */ -+#ifdef USE_EAPTLS -+ if (!get_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, secret, &secret_len, 1)) { -+ -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ /* Initialize ssl session */ -+ if(!eaptls_init_ssl_server(esp)) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecv: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->alert_sent) { -+ esp->es_server.ea_state = eapTlsSendAlert; -+ break; -+ } -+ -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsSendAck; -+ else -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSend: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ -+ if(SSL_is_init_finished(ets->ssl)) { -+ esp->es_server.ea_state = eapTlsRecvClient; -+ break; -+ } -+ -+ if(ets->frag) -+ esp->es_server.ea_state = eapTlsRecvAck; -+ else -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsSendAck: -+ esp->es_server.ea_state = eapTlsRecv; -+ break; -+ -+ case eapTlsRecvAck: -+ if (status) { -+ esp->es_server.ea_state = eapBadAuth; -+ break; -+ } -+ -+ esp->es_server.ea_state = eapTlsSend; -+ break; -+ -+ case eapTlsSendAlert: -+ esp->es_server.ea_state = eapTlsRecvAlertAck; -+ break; -+#endif /* USE_EAPTLS */ -+ - case eapSRP1: - #ifdef USE_SRP - ts = (struct t_server *)esp->es_server.ea_session; -@@ -718,6 +810,30 @@ - INCPTR(esp->es_server.ea_namelen, outp); - break; - -+#ifdef USE_EAPTLS -+ case eapTlsStart: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(EAP_TLS_FLAGS_START, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSend: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAck: -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsSendAlert: -+ eaptls_send(esp->es_server.ea_session, &outp); -+ eap_figure_next_state(esp, 0); -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case eapSRP1: - PUTCHAR(EAPT_SRP, outp); -@@ -904,11 +1020,57 @@ - eap_server_timeout(arg) - void *arg; - { -+#ifdef USE_EAPTLS -+ u_char *outp; -+ u_char *lenloc; -+ int outlen; -+#endif /* USE_EAPTLS */ -+ - eap_state *esp = (eap_state *) arg; - - if (!eap_server_active(esp)) - return; - -+#ifdef USE_EAPTLS -+ switch(esp->es_server.ea_prev_state) { -+ -+ /* -+ * In eap-tls the state changes after a request, so we return to -+ * previous state ... -+ */ -+ case(eapTlsStart): -+ case(eapTlsSendAck): -+ esp->es_server.ea_state = esp->es_server.ea_prev_state; -+ break; -+ -+ /* -+ * ... or resend the stored data -+ */ -+ case(eapTlsSend): -+ case(eapTlsSendAlert): -+ outp = outpacket_buf; -+ MAKEHEADER(outp, PPP_EAP); -+ PUTCHAR(EAP_REQUEST, outp); -+ PUTCHAR(esp->es_server.ea_id, outp); -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ eaptls_retransmit(esp->es_server.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN); -+ esp->es_server.ea_requests++; -+ -+ if (esp->es_server.ea_timeout > 0) -+ TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout); -+ -+ return; -+ default: -+ break; -+ } -+#endif /* USE_EAPTLS */ -+ - /* EAP ID number must not change on timeout. */ - eap_send_request(esp); - } -@@ -1166,6 +1328,81 @@ - } - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+/* -+ * Send an EAP-TLS response message with tls data -+ */ -+static void -+eap_tls_response(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ /* -+ If the id in the request is unchanged, we must retransmit -+ the old data -+ */ -+ if(id == esp->es_client.ea_id) -+ eaptls_retransmit(esp->es_client.ea_session, &outp); -+ else -+ eaptls_send(esp->es_client.ea_session, &outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ -+ esp->es_client.ea_id = id; -+ -+} -+ -+/* -+ * Send an EAP-TLS ack -+ */ -+static void -+eap_tls_sendack(esp, id) -+eap_state *esp; -+u_char id; -+{ -+ u_char *outp; -+ int outlen; -+ u_char *lenloc; -+ -+ outp = outpacket_buf; -+ -+ MAKEHEADER(outp, PPP_EAP); -+ -+ PUTCHAR(EAP_RESPONSE, outp); -+ PUTCHAR(id, outp); -+ esp->es_client.ea_id = id; -+ -+ lenloc = outp; -+ INCPTR(2, outp); -+ -+ PUTCHAR(EAPT_TLS, outp); -+ PUTCHAR(0, outp); -+ -+ outlen = (outp - outpacket_buf) - PPP_HDRLEN; -+ PUTSHORT(outlen, lenloc); -+ -+ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); -+ -+} -+#endif /* USE_EAPTLS */ -+ - static void - eap_send_nak(esp, id, type) - eap_state *esp; -@@ -1320,6 +1557,11 @@ - char rhostname[256]; - MD5_CTX mdContext; - u_char hash[MD5_SIGNATURE_SIZE]; -+#ifdef USE_EAPTLS -+ u_char flags; -+ struct eaptls_session *ets = esp->es_client.ea_session; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - struct t_client *tc; - struct t_num sval, gval, Nval, *Ap, Bval; -@@ -1456,6 +1698,90 @@ - esp->es_client.ea_namelen); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ -+ switch(esp->es_client.ea_state) { -+ -+ case eapListen: -+ -+ GETCHAR(flags, inp); -+ if(flags & EAP_TLS_FLAGS_START){ -+ -+ esp->es_client.ea_using_eaptls = 1; -+ -+ if (explicit_remote){ -+ esp->es_client.ea_peer = strdup(remote_name); -+ esp->es_client.ea_peerlen = strlen(remote_name); -+ } else -+ esp->es_client.ea_peer = NULL; -+ -+ /* Init ssl session */ -+ if(!eaptls_init_ssl_client(esp)) { -+ dbglog("cannot init ssl"); -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ ets = esp->es_client.ea_session; -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ break; -+ } -+ -+ /* The server has sent a bad start packet. */ -+ eap_send_nak(esp, id, EAPT_TLS); -+ break; -+ -+ case eapTlsRecvAck: -+ eap_tls_response(esp, id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ break; -+ -+ case eapTlsRecv: -+ eaptls_receive(ets, inp, len); -+ -+ if(ets->frag) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecv; -+ break; -+ } -+ -+ if(ets->alert_recv) { -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvFailure; -+ break; -+ } -+ -+ /* Check if TLS handshake is finished */ -+ if(SSL_is_init_finished(ets->ssl)){ -+#ifdef MPPE -+ eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); -+#endif -+ eaptls_free_session(ets); -+ eap_tls_sendack(esp, id); -+ esp->es_client.ea_state = eapTlsRecvSuccess; -+ break; -+ } -+ -+ eap_tls_response(esp,id); -+ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : -+ eapTlsRecv); -+ -+ break; -+ -+ default: -+ eap_send_nak(esp, id, EAPT_TLS); -+ esp->es_client.ea_using_eaptls = 0; -+ break; -+ } -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - #ifdef USE_SRP - case EAPT_SRP: - if (len < 1) { -@@ -1737,6 +2063,11 @@ - u_char dig[SHA_DIGESTSIZE]; - #endif /* USE_SRP */ - -+#ifdef USE_EAPTLS -+ struct eaptls_session *ets; -+ u_char flags; -+#endif /* USE_EAPTLS */ -+ - if (esp->es_server.ea_id != id) { - dbglog("EAP: discarding Response %d; expected ID %d", id, - esp->es_server.ea_id); -@@ -1776,6 +2107,60 @@ - eap_figure_next_state(esp, 0); - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ switch(esp->es_server.ea_state) { -+ -+ case eapTlsRecv: -+ ets = (struct eaptls_session *) esp->es_server.ea_session; -+ eap_figure_next_state(esp, -+ eaptls_receive(esp->es_server.ea_session, inp, len)); -+ -+ if(ets->alert_recv) { -+ eap_send_failure(esp); -+ break; -+ } -+ break; -+ -+ case eapTlsRecvAck: -+ if(len > 1) { -+ dbglog("EAP-TLS ACK with extra data"); -+ } -+ eap_figure_next_state(esp, 0); -+ break; -+ -+ case eapTlsRecvClient: -+ /* Receive authentication response from client */ -+ -+ GETCHAR(flags, inp); -+ -+ if(len == 1 && !flags) { /* Ack = ok */ -+#ifdef MPPE -+ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); -+#endif -+ eap_send_success(esp); -+ } -+ else { /* failure */ -+ eaptls_receive(esp->es_server.ea_session, inp, len); -+ warn("Server authentication failed"); -+ eap_send_failure(esp); -+ } -+ -+ eaptls_free_session(esp->es_server.ea_session); -+ -+ break; -+ -+ case eapTlsRecvAlertAck: -+ eap_send_failure(esp); -+ break; -+ -+ default: -+ eap_figure_next_state(esp, 1); -+ break; -+ } -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NOTIFICATION: - dbglog("EAP unexpected Notification; response discarded"); - break; -@@ -1807,6 +2192,13 @@ - esp->es_server.ea_state = eapMD5Chall; - break; - -+#ifdef USE_EAPTLS -+ /* Send EAP-TLS start packet */ -+ case EAPT_TLS: -+ esp->es_server.ea_state = eapTlsStart; -+ break; -+#endif /* USE_EAPTLS */ -+ - default: - dbglog("EAP: peer requesting unknown Type %d", vallen); - switch (esp->es_server.ea_state) { -@@ -2018,13 +2410,27 @@ - int id; - int len; - { -- if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) { -+ if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp) -+#ifdef USE_EAPTLS -+ && esp->es_client.ea_state != eapTlsRecvSuccess -+#endif /* USE_EAPTLS */ -+ ) { - dbglog("EAP unexpected success message in state %s (%d)", - eap_state_name(esp->es_client.ea_state), - esp->es_client.ea_state); - return; - } - -+#ifdef USE_EAPTLS -+ if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != -+ eapTlsRecvSuccess) { -+ dbglog("EAP-TLS unexpected success message in state %s (%d)", -+ eap_state_name(esp->es_client.ea_state), -+ esp->es_client.ea_state); -+ return; -+ } -+#endif /* USE_EAPTLS */ -+ - if (esp->es_client.ea_timeout > 0) { - UNTIMEOUT(eap_client_timeout, (void *)esp); - } -@@ -2150,6 +2556,9 @@ - int code, id, len, rtype, vallen; - u_char *pstart; - u_int32_t uval; -+#ifdef USE_EAPTLS -+ u_char flags; -+#endif /* USE_EAPTLS */ - - if (inlen < EAP_HEADERLEN) - return (0); -@@ -2214,6 +2623,24 @@ - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_SRP: - if (len < 3) - goto truncated; -@@ -2325,6 +2752,25 @@ - } - break; - -+#ifdef USE_EAPTLS -+ case EAPT_TLS: -+ if (len < 1) -+ break; -+ GETCHAR(flags, inp); -+ len--; -+ -+ if(flags == 0 && len == 0){ -+ printer(arg, " Ack"); -+ break; -+ } -+ -+ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); -+ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); -+ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); -+ -+ break; -+#endif /* USE_EAPTLS */ -+ - case EAPT_NAK: - if (len <= 0) { - printer(arg, " "); -@@ -2426,3 +2872,4 @@ - - return (inp - pstart); - } -+ -diff -aur ppp-2.4.6.orig/pppd/eap.h ppp-2.4.6/pppd/eap.h ---- ppp-2.4.6.orig/pppd/eap.h 2014-01-02 05:42:08.000000000 +0100 -+++ ppp-2.4.6/pppd/eap.h 2014-04-03 21:32:29.079960484 +0200 -@@ -84,6 +84,16 @@ - eapClosed, /* Authentication not in use */ - eapListen, /* Client ready (and timer running) */ - eapIdentify, /* EAP Identify sent */ -+ eapTlsStart, /* Send EAP-TLS start packet */ -+ eapTlsRecv, /* Receive EAP-TLS tls data */ -+ eapTlsSendAck, /* Send EAP-TLS ack */ -+ eapTlsSend, /* Send EAP-TLS tls data */ -+ eapTlsRecvAck, /* Receive EAP-TLS ack */ -+ eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ -+ eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ -+ eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ -+ eapTlsRecvSuccess, /* Receive EAP success */ -+ eapTlsRecvFailure, /* Receive EAP failure */ - eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ - eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ - eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ -@@ -95,9 +105,18 @@ - - #define EAP_STATES \ - "Initial", "Pending", "Closed", "Listen", "Identify", \ -+ "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ -+ "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ - "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" - --#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#ifdef USE_EAPTLS -+#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial ||\ -+ (esp)->es_client.ea_state != eapPending ||\ -+ (esp)->es_client.ea_state != eapClosed) -+#else -+#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) -+#endif /* USE_EAPTLS */ -+ - #define eap_server_active(esp) \ - ((esp)->es_server.ea_state >= eapIdentify && \ - (esp)->es_server.ea_state <= eapMD5Chall) -@@ -112,11 +131,17 @@ - u_short ea_namelen; /* Length of our name */ - u_short ea_peerlen; /* Length of peer's name */ - enum eap_state_code ea_state; -+#ifdef USE_EAPTLS -+ enum eap_state_code ea_prev_state; -+#endif - u_char ea_id; /* Current id */ - u_char ea_requests; /* Number of Requests sent/received */ - u_char ea_responses; /* Number of Responses */ - u_char ea_type; /* One of EAPT_* */ - u_int32_t ea_keyflags; /* SRP shared key usage flags */ -+#ifdef USE_EAPTLS -+ bool ea_using_eaptls; -+#endif - }; - - /* -@@ -139,7 +164,12 @@ - * Timeouts. - */ - #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ -+#ifdef USE_EAPTLS -+#define EAP_DEFTRANSMITS 30 /* max # times to transmit */ -+ /* certificates can be long ... */ -+#else - #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ -+#endif /* USE_EAPTLS */ - #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ - #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ - -diff -Naur ppp-2.4.5/pppd/eap-tls.c ppp-2.4.5-eaptls-mppe-0.99/pppd/eap-tls.c ---- ppp-2.4.5/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.5-eaptls-mppe-0.99/pppd/eap-tls.c 2010-10-05 15:12:45.881615580 +0200 -@@ -0,0 +1,1174 @@ -+/* -+ * eap-tls.c - EAP-TLS implementation for PPP -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "pppd.h" -+#include "eap.h" -+#include "eap-tls.h" -+#include "fsm.h" -+#include "lcp.h" -+#include "pathnames.h" -+ -+/* The openssl configuration file and engines can be loaded only once */ -+static CONF *ssl_config = NULL; -+static ENGINE *cert_engine = NULL; -+static ENGINE *pkey_engine = NULL; -+ -+#ifdef MPPE -+ -+/* -+ * TLS PRF from RFC 2246 -+ */ -+static void P_hash(const EVP_MD *evp_md, -+ const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned int out_len) -+{ -+ HMAC_CTX ctx_a, ctx_out; -+ unsigned char a[HMAC_MAX_MD_CBLOCK]; -+ unsigned int size; -+ -+ HMAC_CTX_init(&ctx_a); -+ HMAC_CTX_init(&ctx_out); -+ HMAC_Init_ex(&ctx_a, secret, secret_len, evp_md, NULL); -+ HMAC_Init_ex(&ctx_out, secret, secret_len, evp_md, NULL); -+ -+ size = HMAC_size(&ctx_out); -+ -+ /* Calculate A(1) */ -+ HMAC_Update(&ctx_a, seed, seed_len); -+ HMAC_Final(&ctx_a, a, NULL); -+ -+ while (1) { -+ /* Calculate next part of output */ -+ HMAC_Update(&ctx_out, a, size); -+ HMAC_Update(&ctx_out, seed, seed_len); -+ -+ /* Check if last part */ -+ if (out_len < size) { -+ HMAC_Final(&ctx_out, a, NULL); -+ memcpy(out, a, out_len); -+ break; -+ } -+ -+ /* Place digest in output buffer */ -+ HMAC_Final(&ctx_out, out, NULL); -+ HMAC_Init_ex(&ctx_out, NULL, 0, NULL, NULL); -+ out += size; -+ out_len -= size; -+ -+ /* Calculate next A(i) */ -+ HMAC_Init_ex(&ctx_a, NULL, 0, NULL, NULL); -+ HMAC_Update(&ctx_a, a, size); -+ HMAC_Final(&ctx_a, a, NULL); -+ } -+ -+ HMAC_CTX_cleanup(&ctx_a); -+ HMAC_CTX_cleanup(&ctx_out); -+ memset(a, 0, sizeof(a)); -+} -+ -+static void PRF(const unsigned char *secret, unsigned int secret_len, -+ const unsigned char *seed, unsigned int seed_len, -+ unsigned char *out, unsigned char *buf, unsigned int out_len) -+{ -+ unsigned int i; -+ unsigned int len = (secret_len + 1) / 2; -+ const unsigned char *s1 = secret; -+ const unsigned char *s2 = secret + (secret_len - len); -+ -+ P_hash(EVP_md5(), s1, len, seed, seed_len, out, out_len); -+ P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len); -+ -+ for (i=0; i < out_len; i++) { -+ out[i] ^= buf[i]; -+ } -+} -+ -+#define EAPTLS_MPPE_KEY_LEN 32 -+ -+/* -+ * Generate keys according to RFC 2716 and add to reply -+ */ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, -+ int client) -+{ -+ unsigned char out[4*EAPTLS_MPPE_KEY_LEN], buf[4*EAPTLS_MPPE_KEY_LEN]; -+ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; -+ unsigned char *p = seed; -+ SSL *s = ets->ssl; -+ size_t prf_size; -+ -+ prf_size = strlen(prf_label); -+ -+ memcpy(p, prf_label, prf_size); -+ p += prf_size; -+ -+ memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); -+ p += SSL3_RANDOM_SIZE; -+ prf_size += SSL3_RANDOM_SIZE; -+ -+ memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE); -+ prf_size += SSL3_RANDOM_SIZE; -+ -+ PRF(s->session->master_key, s->session->master_key_length, -+ seed, prf_size, out, buf, sizeof(out)); -+ -+ /* -+ * We now have the master send and receive keys. -+ * From these, generate the session send and receive keys. -+ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) -+ */ -+ if (client) -+ { -+ p = out; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ } -+ else -+ { -+ p = out; -+ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); -+ p += EAPTLS_MPPE_KEY_LEN; -+ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); -+ } -+ -+ mppe_keys_set = 1; -+} -+ -+#endif -+ -+void log_ssl_errors( void ) -+{ -+ unsigned long ssl_err = ERR_get_error(); -+ -+ if (ssl_err != 0) -+ dbglog("EAP-TLS SSL error stack:"); -+ while (ssl_err != 0) { -+ dbglog( ERR_error_string( ssl_err, NULL ) ); -+ ssl_err = ERR_get_error(); -+ } -+} -+ -+ -+int password_callback (char *buf, int size, int rwflag, void *u) -+{ -+ if (buf) -+ { -+ strncpy (buf, passwd, size); -+ return strlen (buf); -+ } -+ return 0; -+} -+ -+ -+CONF *eaptls_ssl_load_config( void ) -+{ -+ CONF *config; -+ int ret_code; -+ long error_line = 33; -+ -+ config = NCONF_new( NULL ); -+ dbglog( "Loading OpenSSL config file" ); -+ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); -+ if (ret_code == 0) -+ { -+ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); -+ NCONF_free( config ); -+ config = NULL; -+ ERR_clear_error(); -+ } -+ -+ dbglog( "Loading OpenSSL built-ins" ); -+ ENGINE_load_builtin_engines(); -+ OPENSSL_load_builtin_modules(); -+ -+ dbglog( "Loading OpenSSL configured modules" ); -+ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) -+ { -+ warn( "EAP-TLS: Error loading OpenSSL modules" ); -+ log_ssl_errors(); -+ config = NULL; -+ } -+ -+ return config; -+} -+ -+ENGINE *eaptls_ssl_load_engine( char *engine_name ) -+{ -+ ENGINE *e = NULL; -+ -+ dbglog( "Enabling OpenSSL auto engines" ); -+ ENGINE_register_all_complete(); -+ -+ dbglog( "Loading OpenSSL '%s' engine support", engine_name ); -+ e = ENGINE_by_id( engine_name ); -+ if (!e) -+ { -+ dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); -+ e = ENGINE_by_id( "dynamic" ); -+ if (e) -+ { -+ if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0) -+ || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) -+ { -+ warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ else -+ { -+ warn( "EAP-TLS: Cannot load dynamic engine support" ); -+ } -+ } -+ -+ if (e) -+ { -+ dbglog( "Initialising engine" ); -+ if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) -+ { -+ warn( "EAP-TLS: Cannot use that engine" ); -+ log_ssl_errors(); -+ ENGINE_free(e); -+ e = NULL; -+ } -+ } -+ -+ return e; -+} -+ -+/* -+ * Initialize the SSL stacks and tests if certificates, key and crl -+ * for client or server use can be loaded. -+ */ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, -+ char *certfile, char *peer_certfile, char *privkeyfile) -+{ -+ char *cert_engine_name = NULL; -+ char *cert_identifier = NULL; -+ char *pkey_engine_name = NULL; -+ char *pkey_identifier = NULL; -+ SSL_CTX *ctx; -+ X509_STORE *certstore; -+ X509_LOOKUP *lookup; -+ X509 *tmp; -+ -+ /* -+ * Without these can't continue -+ */ -+ if (!cacertfile[0]) -+ { -+ error("EAP-TLS: CA certificate missing"); -+ return NULL; -+ } -+ -+ if (!certfile[0]) -+ { -+ error("EAP-TLS: User certificate missing"); -+ return NULL; -+ } -+ -+ if (!privkeyfile[0]) -+ { -+ error("EAP-TLS: User private key missing"); -+ return NULL; -+ } -+ -+ SSL_library_init(); -+ SSL_load_error_strings(); -+ -+ ctx = SSL_CTX_new(TLSv1_method()); -+ -+ if (!ctx) { -+ error("EAP-TLS: Cannot initialize SSL CTX context"); -+ goto fail; -+ } -+ -+ /* if the certificate filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the certificate filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL ) -+ { -+ cert_identifier = index( certfile, ':' ); -+ -+ if (cert_identifier) -+ { -+ cert_engine_name = certfile; -+ *cert_identifier = '\0'; -+ cert_identifier++; -+ -+ dbglog( "Found certificate engine '%s'", cert_engine_name ); -+ dbglog( "Found certificate identifier '%s'", cert_identifier ); -+ } -+ } -+ -+ /* if the privatekey filename is of the form engine:id. e.g. -+ pkcs11:12345 -+ then we try to load and use this engine. -+ If the privatekey filename starts with a / or . then we -+ ALWAYS assume it is a file and not an engine/pkcs11 identifier -+ */ -+ if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL ) -+ { -+ pkey_identifier = index( privkeyfile, ':' ); -+ -+ if (pkey_identifier) -+ { -+ pkey_engine_name = privkeyfile; -+ *pkey_identifier = '\0'; -+ pkey_identifier++; -+ -+ dbglog( "Found privatekey engine '%s'", pkey_engine_name ); -+ dbglog( "Found privatekey identifier '%s'", pkey_identifier ); -+ } -+ } -+ -+ if (cert_identifier && pkey_identifier) -+ { -+ if (strlen( cert_identifier ) == 0) -+ { -+ if (strlen( pkey_identifier ) == 0) -+ error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" ); -+ else -+ { -+ dbglog( "Substituting privatekey identifier for certificate identifier" ); -+ cert_identifier = pkey_identifier; -+ } -+ } -+ else -+ { -+ if (strlen( pkey_identifier ) == 0) -+ { -+ dbglog( "Substituting certificate identifier for privatekey identifier" ); -+ pkey_identifier = cert_identifier; -+ } -+ } -+ -+ } -+ -+ /* load the openssl config file only once */ -+ if (!ssl_config) -+ { -+ if (cert_engine_name || pkey_engine_name) -+ ssl_config = eaptls_ssl_load_config(); -+ -+ if (ssl_config && cert_engine_name) -+ cert_engine = eaptls_ssl_load_engine( cert_engine_name ); -+ -+ if (ssl_config && pkey_engine_name) -+ { -+ /* don't load the same engine twice */ -+ if ( strcmp( cert_engine_name, pkey_engine_name) == 0 ) -+ pkey_engine = cert_engine; -+ else -+ pkey_engine = eaptls_ssl_load_engine( pkey_engine_name ); -+ } -+ } -+ -+ SSL_CTX_set_default_passwd_cb (ctx, password_callback); -+ -+ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) -+ { -+ error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); -+ goto fail; -+ } -+ -+ if (init_server) -+ SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); -+ -+ if (cert_engine) -+ { -+ struct -+ { -+ const char *s_slot_cert_id; -+ X509 *cert; -+ } cert_info; -+ -+ cert_info.s_slot_cert_id = cert_identifier; -+ cert_info.cert = NULL; -+ -+ if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) ) -+ { -+ error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier ); -+ goto fail; -+ } -+ -+ if (cert_info.cert) -+ { -+ dbglog( "Got the certificate, adding it to SSL context" ); -+ dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) ); -+ if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM)) -+ { -+ error( "EAP-TLS: Cannot use public certificate %s", certfile ); -+ goto fail; -+ } -+ } -+ -+ if (pkey_engine) -+ { -+ EVP_PKEY *pkey = NULL; -+ PW_CB_DATA cb_data; -+ -+ cb_data.password = passwd; -+ cb_data.prompt_info = pkey_identifier; -+ -+ dbglog( "Loading private key '%s' from engine", pkey_identifier ); -+ pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data); -+ if (pkey) -+ { -+ dbglog( "Got the private key, adding it to SSL context" ); -+ if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) -+ { -+ error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier); -+ goto fail; -+ } -+ } -+ else -+ { -+ warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier); -+ log_ssl_errors(); -+ } -+ } -+ else -+ { -+ if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM)) -+ { -+ error("EAP-TLS: Cannot use private key %s", privkeyfile); -+ goto fail; -+ } -+ } -+ -+ if (SSL_CTX_check_private_key(ctx) != 1) { -+ error("EAP-TLS: Private key %s fails security check", privkeyfile); -+ goto fail; -+ } -+ -+ SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); -+ SSL_CTX_set_verify_depth(ctx, 5); -+ SSL_CTX_set_verify(ctx, -+ SSL_VERIFY_PEER | -+ SSL_VERIFY_FAIL_IF_NO_PEER_CERT, -+ &ssl_verify_callback); -+ -+ if (crl_dir) { -+ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { -+ error("EAP-TLS: Failed to get certificate store"); -+ goto fail; -+ } -+ -+ if (!(lookup = -+ X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) { -+ error("EAP-TLS: Store lookup for CRL failed"); -+ -+ goto fail; -+ } -+ -+ X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM); -+ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); -+ } -+ -+ /* -+ * If a peer certificate file was specified, it must be valid, else fail -+ */ -+ if (peer_certfile[0]) { -+ if (!(tmp = get_X509_from_file(peer_certfile))) { -+ error("EAP-TLS: Error loading client certificate from file %s", -+ peer_certfile); -+ goto fail; -+ } -+ X509_free(tmp); -+ } -+ -+ return ctx; -+ -+fail: -+ log_ssl_errors(); -+ SSL_CTX_free(ctx); -+ return NULL; -+} -+ -+/* -+ * Determine the maximum packet size by looking at the LCP handshake -+ */ -+ -+int eaptls_get_mtu(int unit) -+{ -+ int mtu, mru; -+ -+ lcp_options *wo = &lcp_wantoptions[unit]; -+ lcp_options *go = &lcp_gotoptions[unit]; -+ lcp_options *ho = &lcp_hisoptions[unit]; -+ lcp_options *ao = &lcp_allowoptions[unit]; -+ -+ mtu = ho->neg_mru? ho->mru: PPP_MRU; -+ mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; -+ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; -+ -+ dbglog("MTU = %d", mtu); -+ return mtu; -+} -+ -+ -+/* -+ * Init the ssl handshake (server mode) -+ */ -+int eaptls_init_ssl_server(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_server.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_server.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_server.ea_session; -+ -+ if (!esp->es_server.ea_peer) { -+ error("EAP-TLS: Error: client name not set (BUG)"); -+ return 0; -+ } -+ -+ strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); -+ -+ dbglog( "getting eaptls secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, -+ esp->es_server.ea_name, clicertfile, -+ servcertfile, cacertfile, pkfile, 1)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_server.ea_peer, esp->es_server.ea_name ); -+ return 0; -+ } -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ if (!(ets->ssl = SSL_new(ets->ctx))) -+ goto fail; -+ -+ /* -+ * Set auto-retry to avoid timeouts on BIO_read -+ */ -+ SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY); -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_accept_state(ets->ssl); -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the client certificate file, store it in ets->peercertfile, -+ * so we can check it later in ssl_verify_callback() -+ */ -+ if (clicertfile[0]) -+ strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ SSL_CTX_free(ets->ctx); -+ return 0; -+} -+ -+/* -+ * Init the ssl handshake (client mode) -+ */ -+int eaptls_init_ssl_client(eap_state * esp) -+{ -+ struct eaptls_session *ets; -+ char servcertfile[MAXWORDLEN]; -+ char clicertfile[MAXWORDLEN]; -+ char cacertfile[MAXWORDLEN]; -+ char pkfile[MAXWORDLEN]; -+ -+ /* -+ * Allocate new eaptls session -+ */ -+ esp->es_client.ea_session = malloc(sizeof(struct eaptls_session)); -+ if (!esp->es_client.ea_session) -+ fatal("Allocation error"); -+ ets = esp->es_client.ea_session; -+ -+ /* -+ * If available, copy server name in ets; it will be used in cert -+ * verify -+ */ -+ if (esp->es_client.ea_peer) -+ strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); -+ else -+ ets->peer[0] = 0; -+ -+ ets->mtu = eaptls_get_mtu(esp->es_unit); -+ -+ dbglog( "calling get_eaptls_secret" ); -+ if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, -+ esp->es_client.ea_peer, clicertfile, -+ servcertfile, cacertfile, pkfile, 0)) { -+ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", -+ esp->es_client.ea_name, esp->es_client.ea_peer ); -+ return 0; -+ } -+ -+ dbglog( "calling eaptls_init_ssl" ); -+ ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); -+ if (!ets->ctx) -+ goto fail; -+ -+ ets->ssl = SSL_new(ets->ctx); -+ -+ if (!ets->ssl) -+ goto fail; -+ -+ /* -+ * Initialize the BIOs we use to read/write to ssl engine -+ */ -+ dbglog( "Initializing SSL BIOs" ); -+ ets->into_ssl = BIO_new(BIO_s_mem()); -+ ets->from_ssl = BIO_new(BIO_s_mem()); -+ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); -+ -+ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); -+ SSL_set_msg_callback_arg(ets->ssl, ets); -+ -+ /* -+ * Attach the session struct to the connection, so we can later -+ * retrieve it when doing certificate verification -+ */ -+ SSL_set_ex_data(ets->ssl, 0, ets); -+ -+ SSL_set_connect_state(ets->ssl); -+ -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->alert_sent = 0; -+ ets->alert_recv = 0; -+ -+ /* -+ * If we specified the server certificate file, store it in -+ * ets->peercertfile, so we can check it later in -+ * ssl_verify_callback() -+ */ -+ if (servcertfile[0]) -+ strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); -+ else -+ ets->peercertfile[0] = 0; -+ -+ return 1; -+ -+fail: -+ dbglog( "eaptls_init_ssl_client: fail" ); -+ SSL_CTX_free(ets->ctx); -+ return 0; -+ -+} -+ -+void eaptls_free_session(struct eaptls_session *ets) -+{ -+ if (ets->ssl) -+ SSL_free(ets->ssl); -+ -+ if (ets->ctx) -+ SSL_CTX_free(ets->ctx); -+ -+ free(ets); -+} -+ -+/* -+ * Handle a received packet, reassembling fragmented messages and -+ * passing them to the ssl engine -+ */ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) -+{ -+ u_char flags; -+ u_int tlslen; -+ u_char dummy[65536]; -+ -+ GETCHAR(flags, inp); -+ len--; -+ -+ if (flags & EAP_TLS_FLAGS_LI && !ets->data) { -+ -+ /* -+ * This is the first packet of a message -+ */ -+ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ -+ if (tlslen > EAP_TLS_MAX_LEN) { -+ error("Error: tls message length > %d, truncated", -+ EAP_TLS_MAX_LEN); -+ tlslen = EAP_TLS_MAX_LEN; -+ } -+ -+ /* -+ * Allocate memory for the whole message -+ */ -+ ets->data = malloc(tlslen); -+ if (!ets->data) -+ fatal("EAP TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = tlslen; -+ -+ } -+ else if (flags & EAP_TLS_FLAGS_LI && ets->data) { -+ /* -+ * Non first with LI (strange...) -+ */ -+ -+ GETLONG(tlslen, inp); -+ len -= 4; -+ -+ } -+ else if (!ets->data) { -+ /* -+ * A non fragmented message without LI flag -+ */ -+ -+ ets->data = malloc(len); -+ if (!ets->data) -+ fatal("EAP TLS: allocation error\n"); -+ -+ ets->datalen = 0; -+ ets->tlslen = len; -+ } -+ -+ if (flags & EAP_TLS_FLAGS_MF) -+ ets->frag = 1; -+ else -+ ets->frag = 0; -+ -+ if (len + ets->datalen > ets->tlslen) { -+ warn("EAP TLS: received data > TLS message length"); -+ return 1; -+ } -+ -+ BCOPY(inp, ets->data + ets->datalen, len); -+ ets->datalen += len; -+ -+ if (!ets->frag) { -+ -+ /* -+ * If we have the whole message, pass it to ssl -+ */ -+ -+ if (ets->datalen != ets->tlslen) { -+ warn("EAP TLS: received data != TLS message length"); -+ return 1; -+ } -+ -+ if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1) -+ log_ssl_errors(); -+ -+ SSL_read(ets->ssl, dummy, 65536); -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Return an eap-tls packet in outp. -+ * A TLS message read from the ssl engine is buffered in ets->data. -+ * At each call we control if there is buffered data and send a -+ * packet of mtu bytes. -+ */ -+int eaptls_send(struct eaptls_session *ets, u_char ** outp) -+{ -+ bool first = 0; -+ int size; -+ u_char fromtls[65536]; -+ int res; -+ u_char *start; -+ -+ start = *outp; -+ -+ if (!ets->data) { -+ -+ if(!ets->alert_sent) -+ SSL_read(ets->ssl, fromtls, 65536); -+ -+ /* -+ * Read from ssl -+ */ -+ if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) -+ fatal("No data from BIO_read"); -+ -+ ets->datalen = res; -+ -+ ets->data = malloc(ets->datalen); -+ BCOPY(fromtls, ets->data, ets->datalen); -+ -+ ets->offset = 0; -+ first = 1; -+ -+ } -+ -+ size = ets->datalen - ets->offset; -+ -+ if (size > ets->mtu) { -+ size = ets->mtu; -+ ets->frag = 1; -+ } else -+ ets->frag = 0; -+ -+ PUTCHAR(EAPT_TLS, *outp); -+ -+ /* -+ * Set right flags and length if necessary -+ */ -+ if (ets->frag && first) { -+ PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp); -+ PUTLONG(ets->datalen, *outp); -+ } else if (ets->frag) { -+ PUTCHAR(EAP_TLS_FLAGS_MF, *outp); -+ } else -+ PUTCHAR(0, *outp); -+ -+ /* -+ * Copy the data in outp -+ */ -+ BCOPY(ets->data + ets->offset, *outp, size); -+ INCPTR(size, *outp); -+ -+ /* -+ * Copy the packet in retransmission buffer -+ */ -+ BCOPY(start, &ets->rtx[0], *outp - start); -+ ets->rtx_len = *outp - start; -+ -+ ets->offset += size; -+ -+ if (ets->offset >= ets->datalen) { -+ -+ /* -+ * The whole message has been sent -+ */ -+ -+ free(ets->data); -+ ets->data = NULL; -+ ets->datalen = 0; -+ ets->offset = 0; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Get the sent packet from the retransmission buffer -+ */ -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp) -+{ -+ BCOPY(ets->rtx, *outp, ets->rtx_len); -+ INCPTR(ets->rtx_len, *outp); -+} -+ -+/* -+ * Verify a certificate. -+ * Most of the work (signatures and issuer attributes checking) -+ * is done by ssl; we check the CN in the peer certificate -+ * against the peer name. -+ */ -+int ssl_verify_callback(int preverify_ok, X509_STORE_CTX * ctx) -+{ -+ char subject[256]; -+ char cn_str[256]; -+ X509 *peer_cert; -+ int err, depth; -+ int ok = preverify_ok; -+ SSL *ssl; -+ struct eaptls_session *ets; -+ -+ peer_cert = X509_STORE_CTX_get_current_cert(ctx); -+ err = X509_STORE_CTX_get_error(ctx); -+ depth = X509_STORE_CTX_get_error_depth(ctx); -+ -+ dbglog("certificate verify depth: %d", depth); -+ -+ if (auth_required && !ok) { -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ dbglog("Certificate verification error:\n depth: %d CN: %s" -+ "\n err: %d (%s)\n", depth, cn_str, err, -+ X509_verify_cert_error_string(err)); -+ -+ return 0; -+ } -+ -+ ssl = X509_STORE_CTX_get_ex_data(ctx, -+ SSL_get_ex_data_X509_STORE_CTX_idx()); -+ -+ ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0); -+ -+ if (ets == NULL) { -+ error("Error: SSL_get_ex_data returned NULL"); -+ return 0; -+ } -+ -+ log_ssl_errors(); -+ -+ if (!depth) { /* This is the peer certificate */ -+ -+ X509_NAME_oneline(X509_get_subject_name(peer_cert), -+ subject, 256); -+ -+ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), -+ NID_commonName, cn_str, 256); -+ -+ /* -+ * If acting as client and the name of the server wasn't specified -+ * explicitely, we can't verify the server authenticity -+ */ -+ if (!ets->peer[0]) { -+ warn("Peer name not specified: no check"); -+ return 1; -+ } -+ -+ /* -+ * Check the CN -+ */ -+ if (strcmp(cn_str, ets->peer)) { -+ error -+ ("Certificate verification error: CN (%s) != peer_name (%s)", -+ cn_str, ets->peer); -+ return 0; -+ } -+ -+ warn("Certificate CN: %s , peer name %s", cn_str, ets->peer); -+ -+ /* -+ * If a peer certificate file was specified, here we check it -+ */ -+ if (ets->peercertfile[0]) { -+ if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert) -+ != 0) { -+ error -+ ("Peer certificate doesn't match stored certificate"); -+ return 0; -+ } -+ } -+ } -+ -+ return 1; -+} -+ -+/* -+ * Compare a certificate with the one stored in a file -+ */ -+int ssl_cmp_certs(char *filename, X509 * a) -+{ -+ X509 *b; -+ int ret; -+ -+ if (!(b = get_X509_from_file(filename))) -+ return 1; -+ -+ ret = X509_cmp(a, b); -+ X509_free(b); -+ -+ return ret; -+ -+} -+ -+X509 *get_X509_from_file(char *filename) -+{ -+ FILE *fp; -+ X509 *ret; -+ -+ if (!(fp = fopen(filename, "r"))) -+ return NULL; -+ -+ ret = PEM_read_X509(fp, NULL, NULL, NULL); -+ -+ fclose(fp); -+ -+ return ret; -+} -+ -+/* -+ * Every sent & received message this callback function is invoked, -+ * so we know when alert messages have arrived or are sent and -+ * we can print debug information about TLS handshake. -+ */ -+void -+ssl_msg_callback(int write_p, int version, int content_type, -+ const void *buf, size_t len, SSL * ssl, void *arg) -+{ -+ char string[256]; -+ struct eaptls_session *ets = (struct eaptls_session *)arg; -+ unsigned char code; -+ -+ if(write_p) -+ strcpy(string, " -> "); -+ else -+ strcpy(string, " <- "); -+ -+ -+ switch(content_type) { -+ -+ case SSL3_RT_ALERT: -+ strcat(string, "Alert: "); -+ code = ((const unsigned char *)buf)[1]; -+ -+ if (write_p) { -+ ets->alert_sent = 1; -+ ets->alert_sent_desc = code; -+ } else { -+ ets->alert_recv = 1; -+ ets->alert_recv_desc = code; -+ } -+ -+ strcat(string, SSL_alert_desc_string_long(code)); -+ break; -+ -+ case SSL3_RT_CHANGE_CIPHER_SPEC: -+ strcat(string, "ChangeCipherSpec"); -+ break; -+ -+ case SSL3_RT_HANDSHAKE: -+ -+ strcat(string, "Handshake: "); -+ code = ((const unsigned char *)buf)[0]; -+ -+ switch(code) { -+ case SSL3_MT_HELLO_REQUEST: -+ strcat(string,"Hello Request"); -+ break; -+ case SSL3_MT_CLIENT_HELLO: -+ strcat(string,"Client Hello"); -+ break; -+ case SSL3_MT_SERVER_HELLO: -+ strcat(string,"Server Hello"); -+ break; -+ case SSL3_MT_CERTIFICATE: -+ strcat(string,"Certificate"); -+ break; -+ case SSL3_MT_SERVER_KEY_EXCHANGE: -+ strcat(string,"Server Key Exchange"); -+ break; -+ case SSL3_MT_CERTIFICATE_REQUEST: -+ strcat(string,"Certificate Request"); -+ break; -+ case SSL3_MT_SERVER_DONE: -+ strcat(string,"Server Hello Done"); -+ break; -+ case SSL3_MT_CERTIFICATE_VERIFY: -+ strcat(string,"Certificate Verify"); -+ break; -+ case SSL3_MT_CLIENT_KEY_EXCHANGE: -+ strcat(string,"Client Key Exchange"); -+ break; -+ case SSL3_MT_FINISHED: -+ strcat(string,"Finished"); -+ break; -+ -+ default: -+ sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); -+ } -+ break; -+ -+ default: -+ sprintf( string, "SSL message contains unknown content type: %d", content_type ); -+ -+ } -+ -+ /* Alert messages must always be displayed */ -+ if(content_type == SSL3_RT_ALERT) -+ error("%s", string); -+ else -+ dbglog("%s", string); -+} -+ -diff -Naur ppp-2.4.5/pppd/eap-tls.h ppp-2.4.5-eaptls-mppe-0.99/pppd/eap-tls.h ---- ppp-2.4.5/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.5-eaptls-mppe-0.99/pppd/eap-tls.h 2010-10-01 15:17:54.213271816 +0200 -@@ -0,0 +1,107 @@ -+/* -+ * eap-tls.h -+ * -+ * Copyright (c) Beniamino Galvani 2005 All rights reserved. -+ * -+ * Redistribution and use in source and binary forms, with or without -+ * modification, are permitted provided that the following conditions -+ * are met: -+ * -+ * 1. Redistributions of source code must retain the above copyright -+ * notice, this list of conditions and the following disclaimer. -+ * -+ * 2. Redistributions in binary form must reproduce the above copyright -+ * notice, this list of conditions and the following disclaimer in -+ * the documentation and/or other materials provided with the -+ * distribution. -+ * -+ * 3. The name(s) of the authors of this software must not be used to -+ * endorse or promote products derived from this software without -+ * prior written permission. -+ * -+ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO -+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY -+ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY -+ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN -+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING -+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -+ * -+ */ -+ -+#ifndef __EAP_TLS_H__ -+#define __EAP_TLS_H__ -+ -+#include "eap.h" -+ -+#include -+#include -+#include -+ -+#define EAP_TLS_FLAGS_LI 128 /* length included flag */ -+#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ -+#define EAP_TLS_FLAGS_START 32 /* start flag */ -+ -+#define EAP_TLS_MAX_LEN 65536 /* max eap tls packet size */ -+ -+struct eaptls_session -+{ -+ u_char *data; /* buffered data */ -+ int datalen; /* buffered data len */ -+ int offset; /* from where to send */ -+ int tlslen; /* total length of tls data */ -+ bool frag; /* packet is fragmented */ -+ SSL_CTX *ctx; -+ SSL *ssl; /* ssl connection */ -+ BIO *from_ssl; -+ BIO *into_ssl; -+ char peer[MAXWORDLEN]; /* peer name */ -+ char peercertfile[MAXWORDLEN]; -+ bool alert_sent; -+ u_char alert_sent_desc; -+ bool alert_recv; -+ u_char alert_recv_desc; -+ char rtx[65536]; /* retransmission buffer */ -+ int rtx_len; -+ int mtu; /* unit mtu */ -+}; -+ -+typedef struct pw_cb_data -+{ -+ const void *password; -+ const char *prompt_info; -+} PW_CB_DATA; -+ -+ -+int ssl_verify_callback(int, X509_STORE_CTX *); -+void ssl_msg_callback(int write_p, int version, int ct, const void *buf, -+ size_t len, SSL * ssl, void *arg); -+ -+X509 *get_X509_from_file(char *filename); -+int ssl_cmp_certs(char *filename, X509 * a); -+ -+SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, -+ char *certfile, char *peer_certfile, char *privkeyfile); -+int eaptls_init_ssl_server(eap_state * esp); -+int eaptls_init_ssl_client(eap_state * esp); -+void eaptls_free_session(struct eaptls_session *ets); -+ -+int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); -+int eaptls_send(struct eaptls_session *ets, u_char ** outp); -+void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); -+ -+int get_eaptls_secret(int unit, char *client, char *server, -+ char *clicertfile, char *servcertfile, char *cacertfile, -+ char *pkfile, int am_server); -+ -+#ifdef MPPE -+#include "mppe.h" /* MPPE_MAX_KEY_LEN */ -+extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; -+extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; -+extern int mppe_keys_set; -+ -+void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); -+ -+#endif -+ -+#endif -diff -aur ppp-2.4.6.orig/pppd/Makefile.linux ppp-2.4.6/pppd/Makefile.linux ---- ppp-2.4.6.orig/pppd/Makefile.linux 2014-04-03 21:31:37.000000000 +0200 -+++ ppp-2.4.6/pppd/Makefile.linux 2014-04-03 21:32:29.076627151 +0200 -@@ -76,6 +76,9 @@ - # Use libutil - USE_LIBUTIL=y - -+# Enable EAP-TLS authentication (requires libssl and libcurl) -+USE_EAPTLS=y -+ - MAXOCTETS=y - - INCLUDE_DIRS= -I../include -@@ -115,6 +118,15 @@ - PPPDOBJS += sha1.o - endif - -+# EAP-TLS -+ifdef USE_EAPTLS -+CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include -+LIBS += -lssl -lcrypto -+PPPDSRC += eap-tls.c -+HEADERS += eap-tls.h -+PPPDOBJS += eap-tls.o -+endif -+ - ifdef HAS_SHADOW - CFLAGS += -DHAS_SHADOW - #LIBS += -lshadow $(LIBS) -diff -aur ppp-2.4.6.orig/pppd/md5.c ppp-2.4.6/pppd/md5.c ---- ppp-2.4.6.orig/pppd/md5.c 2014-01-02 05:42:08.000000000 +0100 -+++ ppp-2.4.6/pppd/md5.c 2014-04-03 21:32:29.079960484 +0200 -@@ -33,6 +33,8 @@ - *********************************************************************** - */ - -+#ifndef USE_EAPTLS -+ - #include - #include "md5.h" - -@@ -305,3 +307,5 @@ - ** End of md5.c ** - ******************************** (cut) ******************************** - */ -+#endif /* USE_EAPTLS */ -+ -diff -aur ppp-2.4.6.orig/pppd/md5.h ppp-2.4.6/pppd/md5.h ---- ppp-2.4.6.orig/pppd/md5.h 2014-01-02 05:42:08.000000000 +0100 -+++ ppp-2.4.6/pppd/md5.h 2014-04-03 21:32:29.079960484 +0200 -@@ -36,6 +36,7 @@ - ** documentation and/or software. ** - *********************************************************************** - */ -+#ifndef USE_EAPTLS - - #ifndef __MD5_INCLUDE__ - -@@ -63,3 +64,5 @@ - - #define __MD5_INCLUDE__ - #endif /* __MD5_INCLUDE__ */ -+ -+#endif /* USE_EAPTLS */ -diff -aur ppp-2.4.6.orig/pppd/options.c ppp-2.4.6/pppd/options.c ---- ppp-2.4.6.orig/pppd/options.c 2014-04-03 21:31:37.000000000 +0200 -+++ ppp-2.4.6/pppd/options.c 2014-04-03 21:33:58.363293525 +0200 -@@ -126,6 +126,11 @@ - int child_wait = 5; /* # seconds to wait for children at exit */ - struct userenv *userenv_list; /* user environment variables */ - -+#ifdef USE_EAPTLS -+bool only_update_crl_server = 0; /* update server crl and exit */ -+bool only_update_crl_client = 0; /* update client crl and exit */ -+#endif /* USE_EAPTLS */ -+ - #ifdef MAXOCTETS - unsigned int maxoctets = 0; /* default - no limit */ - int maxoctets_dir = 0; /* default - sum of traffic */ -@@ -351,6 +356,12 @@ - { "mo-timeout", o_int, &maxoctets_timeout, - "Check for traffic limit every N seconds", OPT_PRIO | OPT_LLIMIT | 1 }, - #endif -+#ifdef USE_EAPTLS -+ { "only-update-crl-server", o_bool, &only_update_crl_server, -+ "Update server CA CRLs and exit", 1 }, -+ { "only-update-crl-client", o_bool, &only_update_crl_client, -+ "Update client CA CRLs and exit", 1 }, -+#endif /* USE_EAPTLS */ - - { NULL } - }; -diff -aur ppp-2.4.6.orig/pppd/pathnames.h ppp-2.4.6/pppd/pathnames.h ---- ppp-2.4.6.orig/pppd/pathnames.h 2014-04-03 21:31:37.000000000 +0200 -+++ ppp-2.4.6/pppd/pathnames.h 2014-04-03 21:32:29.083293817 +0200 -@@ -25,6 +25,13 @@ - #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" - #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" - #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" -+ -+#ifdef USE_EAPTLS -+#define _PATH_EAPTLSCLIFILE _ROOT_PATH "/etc/ppp/eaptls-client" -+#define _PATH_EAPTLSSERVFILE _ROOT_PATH "/etc/ppp/eaptls-server" -+#define _PATH_OPENSSLCONFFILE _ROOT_PATH "/etc/ppp/openssl.cnf" -+#endif /* USE_EAPTLS */ -+ - #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" - #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" - #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" -diff -aur ppp-2.4.6.orig/pppd/plugins/Makefile.linux ppp-2.4.6/pppd/plugins/Makefile.linux ---- ppp-2.4.6.orig/pppd/plugins/Makefile.linux 2014-04-03 21:31:37.000000000 +0200 -+++ ppp-2.4.6/pppd/plugins/Makefile.linux 2014-04-03 21:32:29.083293817 +0200 -@@ -8,6 +8,9 @@ - LIBS = - INSTALL = install - -+# EAP-TLS -+CFLAGS += -DUSE_EAPTLS=1 -+ - DESTDIR = $(INSTROOT)@DESTDIR@ - BINDIR = $(DESTDIR)/sbin - MANDIR = $(DESTDIR)/share/man/man8 -diff -aur ppp-2.4.6.orig/pppd/plugins/passprompt.c ppp-2.4.6/pppd/plugins/passprompt.c ---- ppp-2.4.6.orig/pppd/plugins/passprompt.c 2014-01-02 05:42:08.000000000 +0100 -+++ ppp-2.4.6/pppd/plugins/passprompt.c 2014-04-03 21:32:29.083293817 +0200 -@@ -107,4 +107,7 @@ - { - add_options(options); - pap_passwd_hook = promptpass; -+#ifdef USE_EAPTLS -+ eaptls_passwd_hook = promptpass; -+#endif - } -diff -aur ppp-2.4.6.orig/pppd/plugins/passwordfd.c ppp-2.4.6/pppd/plugins/passwordfd.c ---- ppp-2.4.6.orig/pppd/plugins/passwordfd.c 2014-04-03 21:31:37.000000000 +0200 -+++ ppp-2.4.6/pppd/plugins/passwordfd.c 2014-04-03 21:32:29.083293817 +0200 -@@ -75,4 +75,9 @@ - - chap_check_hook = pwfd_check; - chap_passwd_hook = pwfd_passwd; -+ -+#ifdef USE_EAPTLS -+ eaptls_check_hook = pwfd_check; -+ eaptls_passwd_hook = pwfd_passwd; -+#endif - } -diff -aur ppp-2.4.6.orig/pppd/pppd.h ppp-2.4.6/pppd/pppd.h ---- ppp-2.4.6.orig/pppd/pppd.h 2014-04-03 21:31:37.000000000 +0200 -+++ ppp-2.4.6/pppd/pppd.h 2014-04-03 21:32:29.083293817 +0200 -@@ -329,6 +329,10 @@ - extern bool dryrun; /* check everything, print options, exit */ - extern int child_wait; /* # seconds to wait for children at end */ - -+#ifdef USE_EAPTLS -+extern char *crl_dir; -+#endif /* USE_EAPTLS */ -+ - #ifdef MAXOCTETS - extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ - extern int maxoctets_dir; /* Direction : -@@ -743,6 +747,11 @@ - extern int (*chap_passwd_hook) __P((char *user, char *passwd)); - extern void (*multilink_join_hook) __P((void)); - -+#ifdef USE_EAPTLS -+extern int (*eaptls_check_hook) __P((void)); -+extern int (*eaptls_passwd_hook) __P((char *user, char *passwd)); -+#endif -+ - /* Let a plugin snoop sent and received packets. Useful for L2TP */ - extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); - extern void (*snoop_send_hook) __P((unsigned char *p, int len)); -diff -Naur ppp-2.4.5/README.eap-tls ppp-2.4.5-eaptls-mppe-0.99/README.eap-tls ---- ppp-2.4.5/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 -+++ ppp-2.4.5-eaptls-mppe-0.99/README.eap-tls 2010-10-01 15:17:54.205272328 +0200 -@@ -0,0 +1,169 @@ -+EAP-TLS authentication support for PPP -+====================================== -+ -+1. Intro -+ -+ The Extensible Authentication Protocol (EAP; RFC 3748) is a -+ security protocol that can be used with PPP. It provides a means -+ to plug in multiple optional authentication methods. -+ -+ Transport Level Security (TLS; RFC 2246) provides for mutual -+ authentication, integrity-protected ciphersuite negotiation and -+ key exchange between two endpoints. It also provides for optional -+ MPPE encryption. -+ -+ EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets, -+ allowing TLS mutual authentication to be used as a generic EAP -+ mechanism. It also provides optional encryption using the MPPE -+ protocol. -+ -+ This patch provide EAP-TLS support to pppd. -+ This authentication method can be used in both client or server -+ mode. -+ -+2. Building -+ -+ To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org) -+ is required. Any version from 0.9.7 should work. -+ -+ Configure, compile, and install as usual. -+ -+3. Configuration -+ -+ On the client side there are two ways to configure EAP-TLS: -+ -+ 1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters -+ -+ 2. edit the /etc/ppp/eaptls-client file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ The file containing the certificate chain for the -+ client in PEM format -+ - Server certificate file -+ If you want to specify the certificate that the -+ server is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM -+ format. -+ - Client private key file -+ The file containing the client private key in PEM format. -+ -+ -+ On the server side edit the /etc/ppp/eaptls-server file. -+ Insert a line for each system with which you use EAP-TLS. -+ The line is composed of this fields separated by tab: -+ -+ - Client name -+ The name used by the client for authentication, can be * -+ - Server name -+ The name of the server, can be * -+ - Client certificate file -+ If you want to specify the certificate that the -+ client is allowed to use, put the certificate file name. -+ Else put a dash '-'. -+ - Server certificate file -+ The file containing the certificate chain for the -+ server in PEM format -+ - CA certificate file -+ The file containing the trusted CA certificates in PEM -+ format. -+ - Client private key file -+ The file containing the server private key in PEM format. -+ - addresses -+ A list of IP addresses the client is allowed to use. -+ -+ -+ OpenSSL engine support is included starting with v0.95 of this patch. -+ Currently the only engine tested is the 'pkcs11' engine (hardware token -+ support). To use the 'pksc11' engine: -+ - Use a special private key fileiname in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - The certificate can also be loaded from the 'pkcs11' engine using -+ a special client certificate filename in the /etc/ppp/eaptls-client file: -+ : -+ e.g. -+ pkcs11:123456 -+ -+ - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior -+ to starting 'pppd'. A sample openssl.cnf file is -+ -+ openssl_conf = openssl_def -+ -+ [ openssl_def ] -+ engines = engine_section -+ -+ [ engine_section ] -+ pkcs11 = pkcs11_section -+ -+ [ pkcs11_section ] -+ engine_id = pkcs11 -+ dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so -+ MODULE_PATH = /usr/lib64/libeTPkcs11.so -+ init = 0 -+ -+ - There are two ways to specify a password/PIN for the PKCS11 engine: -+ - inside the openssl.cnf file using -+ PIN = your-secret-pin -+ Note The keyword 'PIN' is case sensitive! -+ - Using the 'password' in the ppp options file. -+ From v0.97 of the eap-tls patch the password can also be supplied -+ using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c -+ for an example). -+ -+ -+4. Options -+ -+ These pppd options are available: -+ -+ ca -+ Use the CA public certificate found in in PEM format -+ cert -+ Use the client public certificate found in in PEM format -+ or in engine:engine_id format -+ key -+ Use the client private key found in in PEM format -+ or in engine:engine_id format -+ crl-dir -+ Use CRL files from dir. It contains CRL files in PEM -+ format and each file contains a CRL. The files are looked up -+ by the issuer name hash value. Use the c_rehash utility -+ to create necessary links. -+ need-peer-eap -+ If the peer doesn't ask us to authenticate or doesn't use eap -+ to authenticate us, disconnect. -+ -+ Note: -+ password-encrypted certificates can be used as of v0.94 of this -+ patch. The password for the eap-tls.key file is specified using -+ the regular -+ password .... -+ statement in the ppp options file, or by using the appropriate -+ plugin which supplies a 'eaptls_passwd_hook' routine. -+ -+5. Connecting -+ -+ If you're setting up a pppd server, edit the EAP-TLS configuration file -+ as written above and then run pppd with the 'auth' option to authenticate -+ the client. The EAP-TLS method will be used if the other eap methods can't -+ be used (no secrets). -+ -+ If you're setting up a client, edit the configuration file and then run -+ pppd with 'remotename' option to specify the server name. Add the -+ 'need-peer-eap' option if you want to be sure the peer ask you to -+ authenticate (and to use eap) and to disconnect if it doesn't. -+ -+6. Notes -+ -+ This is experimental code. -+ Send suggestions and comments to Jan Just Keijser -+ diff --git a/network/connection/ppp/files/ppp-openssl.patch b/network/connection/ppp/files/ppp-openssl.patch deleted file mode 100644 index cbb5857a7c..0000000000 --- a/network/connection/ppp/files/ppp-openssl.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 3c7b86229f7bd2600d74db14b1fe5b3896be3875 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= -Date: Fri, 6 Apr 2018 14:27:18 +0200 -Subject: [PATCH] pppd: Use openssl for the DES instead of the libcrypt / glibc -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -It seems the latest glibc (in Fedora glibc-2.27.9000-12.fc29) dropped -libcrypt. The libxcrypt standalone package can be used instead, but -it dropped the old setkey/encrypt API which ppp uses for DES. There -is support for using openssl in pppcrypt.c, but it contains typos -preventing it from compiling and seems to be written for an ancient -openssl version. - -This updates the code to use current openssl. - -[paulus@ozlabs.org - wrote the commit description, fixed comment in - Makefile.linux.] - -Signed-off-by: Jaroslav Škarvada -Signed-off-by: Paul Mackerras ---- - pppd/Makefile.linux | 7 ++++--- - pppd/pppcrypt.c | 18 +++++++++--------- - 2 files changed, 13 insertions(+), 12 deletions(-) - -diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux -index 36d2b036..8d5ce99d 100644 ---- a/pppd/Makefile.linux -+++ b/pppd/Makefile.linux -@@ -35,10 +35,10 @@ endif - COPTS = -O2 -pipe -Wall -g - LIBS = - --# Uncomment the next 2 lines to include support for Microsoft's -+# Uncomment the next line to include support for Microsoft's - # MS-CHAP authentication protocol. Also, edit plugins/radius/Makefile.linux. - CHAPMS=y --USE_CRYPT=y -+#USE_CRYPT=y - # Don't use MSLANMAN unless you really know what you're doing. - #MSLANMAN=y - # Uncomment the next line to include support for MPPE. CHAPMS (above) must -@@ -137,7 +137,8 @@ endif - - ifdef NEEDDES - ifndef USE_CRYPT --LIBS += -ldes $(LIBS) -+CFLAGS += -I/usr/include/openssl -+LIBS += -lcrypto - else - CFLAGS += -DUSE_CRYPT=1 - endif -diff --git a/pppd/pppcrypt.c b/pppd/pppcrypt.c -index 8b85b132..6b35375e 100644 ---- a/pppd/pppcrypt.c -+++ b/pppd/pppcrypt.c -@@ -64,7 +64,7 @@ u_char *des_key; /* OUT 64 bit DES key with parity bits added */ - des_key[7] = Get7Bits(key, 49); - - #ifndef USE_CRYPT -- des_set_odd_parity((des_cblock *)des_key); -+ DES_set_odd_parity((DES_cblock *)des_key); - #endif - } - -@@ -158,25 +158,25 @@ u_char *clear; /* OUT 8 octets */ - } - - #else /* USE_CRYPT */ --static des_key_schedule key_schedule; -+static DES_key_schedule key_schedule; - - bool - DesSetkey(key) - u_char *key; - { -- des_cblock des_key; -+ DES_cblock des_key; - MakeKey(key, des_key); -- des_set_key(&des_key, key_schedule); -+ DES_set_key(&des_key, &key_schedule); - return (1); - } - - bool --DesEncrypt(clear, key, cipher) -+DesEncrypt(clear, cipher) - u_char *clear; /* IN 8 octets */ - u_char *cipher; /* OUT 8 octets */ - { -- des_ecb_encrypt((des_cblock *)clear, (des_cblock *)cipher, -- key_schedule, 1); -+ DES_ecb_encrypt((DES_cblock *)clear, (DES_cblock *)cipher, -+ &key_schedule, 1); - return (1); - } - -@@ -185,8 +185,8 @@ DesDecrypt(cipher, clear) - u_char *cipher; /* IN 8 octets */ - u_char *clear; /* OUT 8 octets */ - { -- des_ecb_encrypt((des_cblock *)cipher, (des_cblock *)clear, -- key_schedule, 0); -+ DES_ecb_encrypt((DES_cblock *)cipher, (DES_cblock *)clear, -+ &key_schedule, 0); - return (1); - } - diff --git a/network/connection/ppp/pspec.xml b/network/connection/ppp/pspec.xml index c4976b3b7b..d8e519ef04 100644 --- a/network/connection/ppp/pspec.xml +++ b/network/connection/ppp/pspec.xml @@ -13,26 +13,26 @@ service Point-to-point protocol - patched for PPPOE The Point-to-Point Protocol (PPP) provides a standard way to transmit datagrams over a serial link. - https://www.samba.org/ftp/ppp/ppp-2.5.0.tar.gz - http://distfiles.gentoo.org/distfiles/ppp-dhcpc.tgz + https://www.samba.org/ftp/ppp/ppp-2.4.9.tar.gz + http://distfiles.gentoo.org/distfiles/ppp-dhcpc.tgz libpcap-devel openssl-devel pam-devel - + gentoo/0001-Change-Make-vars-to-work-in-Gentoo-builds.patch gentoo/0002-Use-internal-implementation-of-logwtmp-function.patch - - - - - + gentoo/0003-Add-MPLSCP-support.patch + gentoo/0004-smarter-killaddr.patch + gentoo/0005-Improve-waiting-for-children-on-exit.patch + gentoo/0006-Remove-one-of-the-2-pidfiles-pidfilename-or-linkpidf.patch + gentoo/0007-Run-etc-ppp-auth-fail-script-if-exists-and-authentic.patch gentoo/0008-Try-to-create-dev-ppp-if-not-available.patch - - - - + gentoo/0009-passwordfd-read-early.patch + gentoo/0010-Add-option-to-ask-peer-for-WINS-address.patch + gentoo/0011-Log-connect-errors-to-var-log-ppp-connect-errors.patch + gentoo/0012-Don-t-hang-when-starting-pppoe-connection-without-se.patch gentoo/0013-Add-defaultmetric-as-compatibility-option-name.patch gentoo/0014-Warn-user-of-deprecated-option-defaultmetric.patch gentoo/85_all_dhcp-make-vars.patch @@ -81,6 +81,13 @@ + + 2023-04-19 + 2.4.9 + revert + Mustafa Cinasal + muscnsl@gmail.com + 2023-04-04 2.5.0