diff --git a/desktop/toolkit/newt/actions.py b/desktop/toolkit/newt/actions.py new file mode 100644 index 0000000000..9d379e5e61 --- /dev/null +++ b/desktop/toolkit/newt/actions.py @@ -0,0 +1,33 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +def setup(): + # use python2.x + pisitools.dosed("configure", "(\/usr\/include\/)python\*", r"\1python2*") + # fix unused direct dependency + pisitools.dosed("Makefile.in", "(PLFLAGS=)`\$\$pyconfig --libs`", r"\1'-lpython2.7'") + pisitools.dosed("Makefile.in", "(PLDFLAGS=)`\$\$pyconfig --ldflags`", r"\1'-lpython2.7 -Xlinker -export-dynamic'") + + shelltools.echo("config.h.in", "#define USE_INTERP_RESULT 1") + shelltools.export("PYTHON", "/usr/bin/python2.7") + autotools.configure("\ + --with-gpm-support \ + ") + +def build(): + autotools.make() + +def install(): + autotools.install() + + # remove static lib + pisitools.remove("/usr/lib/libnewt.a") + + pisitools.dodoc("CHANGES", "COPYING") diff --git a/desktop/toolkit/newt/pspec.xml b/desktop/toolkit/newt/pspec.xml new file mode 100644 index 0000000000..927aa1b1e8 --- /dev/null +++ b/desktop/toolkit/newt/pspec.xml @@ -0,0 +1,85 @@ + + + + + newt + https://fedorahosted.org/newt/ + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + library + app:console + A windowing toolkit for text mode + newt is a windowing toolkit for text mode, which provides many widgets and stackable windows. + https://fedorahosted.org/releases/n/e/newt/newt-0.52.17.tar.gz + + tcl-devel + + + + + newt + + tcl + + + /usr/bin + /usr/lib + /usr/share/locale + /usr/share/doc + /usr/share/man + + + + + newt-devel + Development files for newt + + newt + + + /usr/include + /usr/lib/pkgconfig + + + + + + 2014-07-05 + 0.52.17 + Version bump. + Serdar Soytetir + kaptan@pisilinux.org + + + 2013-11-05 + 0.52.16 + Version bump. + Serdar Soytetir + kaptan@pisilinux.org + + + 2013-08-26 + 0.52.14 + Release bump. + Serdar Soytetir + kaptan@pisilinux.org + + + 2013-01-30 + 0.52.14 + Build with new relaese Tcl + Erdinç Gültekin + admins@pisilinux.org + + + 2012-09-17 + 0.52.14 + First release + Serdar Soytetir + kaptan@pisilinux.org + + + \ No newline at end of file diff --git a/desktop/toolkit/newt/translations.xml b/desktop/toolkit/newt/translations.xml new file mode 100644 index 0000000000..5274ec3a68 --- /dev/null +++ b/desktop/toolkit/newt/translations.xml @@ -0,0 +1,13 @@ + + + + newt + Metin tabanlı bir pencere araç seti. + Newt, metin tabanlı bir pencere araç setidir. Pek çok alet ve istiflenebilir pencere sağlar. + + + + newt-devel + newt için geliştirme dosyaları + + diff --git a/hardware/bluetooth/bluez/actions.py b/hardware/bluetooth/bluez/actions.py new file mode 100644 index 0000000000..9526d3a88c --- /dev/null +++ b/hardware/bluetooth/bluez/actions.py @@ -0,0 +1,83 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import get + +def setup(): + + #shelltools.system("sed -i -e '/SystemdService/d' obexd/src/org.bluez.obex.service.in") + pisitools.dosed("obexd/src/org.bluez.obex.service.in", "SystemdService", deleteLine=True) + autotools.autoreconf("-fi") + autotools.configure("--prefix=/usr \ + --sysconfdir=/etc \ + --localstatedir=/var \ + --libexecdir=/usr/libexec/ \ + --enable-sixaxis \ + --enable-experimental \ + --disable-android \ + --enable-datafiles \ + --enable-optimization \ + --enable-pie \ + --enable-threads \ + --enable-library \ + --enable-tools \ + --enable-manpages \ + --enable-monitor \ + --enable-udev \ + --enable-test \ + --disable-systemd") + + + pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ") + +def build(): + autotools.make() + +def install(): + autotools.rawInstall("DESTDIR=%s install-libexecPROGRAMS install-dbussessionbusDATA install-dbussystembusDATA install-dbusDATA install-man8" % get.installDIR()) + + + # Install conf files + for i in ["profiles/input", "profiles/network" ,"src"]: + pisitools.insinto("/etc/bluetooth", "%s/*.conf" % (i)) + + + # Simple test tools + for i in ["bluezutils.py", + "dbusdef.py", + "ftp-client", + "list-devices", + "map-client", + "monitor-bluetooth", + "opp-client", + "pbap-client", + "sap_client.py", + "simple-agent", + "simple-endpoint", + "simple-player", + "test-adapter", + "test-alert", + "test-cyclingspeed", + "test-device", + "test-discovery", + "test-health", + "test-health-sink", + "test-heartrate", + "test-hfp", + "test-manager", + "test-nap", + "test-network", + "test-profile", + "test-proximity", + "test-sap-server", + "test-thermometer"]: + pisitools.dobin("test/%s" % i) + # for i in + # pisitools.dodoc("doc/%s" % i) + # Install documents + pisitools.dodoc("AUTHORS", "ChangeLog", "README") diff --git a/hardware/bluetooth/bluez/comar/service.py b/hardware/bluetooth/bluez/comar/service.py new file mode 100644 index 0000000000..d64306d997 --- /dev/null +++ b/hardware/bluetooth/bluez/comar/service.py @@ -0,0 +1,33 @@ +from comar.service import * +import os + +serviceType = "local" +serviceDesc = _({"en": "Bluetooth Service", + "tr": "Bluetooth Hizmeti"}) +serviceDefault = "on" + +PIDFILE="/run/bluez.pid" +DAEMON ="/usr/libexec/bluetooth/bluetoothd" + +@synchronized +def start(): + + startService(command=DAEMON, + pidfile=PIDFILE, + detach=True, + donotify=True) + + os.system("pidof bluez + /usr/libexec/bluetooth/bluetoothd > /run/bluez.pid") + +@synchronized +def stop(): + stopService(pidfile=PIDFILE, + donotify=True) + + try: + os.unlink(PIDFILE) + except: + pass + +def status(): + return isServiceRunning(pidfile=PIDFILE) diff --git a/hardware/bluetooth/bluez/files/bluez-5.18-obexd_without_systemd-1.patch b/hardware/bluetooth/bluez/files/bluez-5.18-obexd_without_systemd-1.patch new file mode 100644 index 0000000000..749787c5b3 --- /dev/null +++ b/hardware/bluetooth/bluez/files/bluez-5.18-obexd_without_systemd-1.patch @@ -0,0 +1,61 @@ +Submitted By: Armin K. +Date: 2013-04-29 +Initial Package Version: 5.17 +Upstream Status: unknown +Origin: Arch Linux (Giovanni Campagna) +Description: Allow using obexd without systemd in the user session + +Not all sessions run systemd --user (actually, the majority +doesn't), so the dbus daemon must be able to spawn obexd +directly, and to do so it needs the full path of the daemon. +--- + Makefile.obexd | 4 ++-- + obexd/src/org.bluez.obex.service | 4 ---- + obexd/src/org.bluez.obex.service.in | 4 ++++ + 3 files changed, 6 insertions(+), 6 deletions(-) + delete mode 100644 obexd/src/org.bluez.obex.service + create mode 100644 obexd/src/org.bluez.obex.service.in + +diff --git a/Makefile.obexd b/Makefile.obexd +index 3760867..142e7c3 100644 +--- a/Makefile.obexd ++++ b/Makefile.obexd +@@ -2,12 +2,12 @@ + if SYSTEMD + systemduserunitdir = @SYSTEMD_USERUNITDIR@ + systemduserunit_DATA = obexd/src/obex.service ++endif + + dbussessionbusdir = @DBUS_SESSIONBUSDIR@ + dbussessionbus_DATA = obexd/src/org.bluez.obex.service +-endif + +-EXTRA_DIST += obexd/src/obex.service.in obexd/src/org.bluez.obex.service ++EXTRA_DIST += obexd/src/obex.service.in obexd/src/org.bluez.obex.service.in + + obex_plugindir = $(libdir)/obex/plugins + +diff --git a/obexd/src/org.bluez.obex.service b/obexd/src/org.bluez.obex.service +deleted file mode 100644 +index a538088..0000000 +--- a/obexd/src/org.bluez.obex.service ++++ /dev/null +@@ -1,4 +0,0 @@ +-[D-BUS Service] +-Name=org.bluez.obex +-Exec=/bin/false +-SystemdService=dbus-org.bluez.obex.service +diff --git a/obexd/src/org.bluez.obex.service.in b/obexd/src/org.bluez.obex.service.in +new file mode 100644 +index 0000000..9c815f2 +--- /dev/null ++++ b/obexd/src/org.bluez.obex.service.in +@@ -0,0 +1,4 @@ ++[D-BUS Service] ++Name=org.bluez.obex ++Exec=@libexecdir@/obexd ++SystemdService=dbus-org.bluez.obex.service +-- +1.8.3.1 + + diff --git a/hardware/bluetooth/bluez/files/bluez-5.20-obexd_without_systemd-1.patch b/hardware/bluetooth/bluez/files/bluez-5.20-obexd_without_systemd-1.patch new file mode 100644 index 0000000000..252e48234a --- /dev/null +++ b/hardware/bluetooth/bluez/files/bluez-5.20-obexd_without_systemd-1.patch @@ -0,0 +1,61 @@ +Submitted By: Armin K. +Date: 2013-04-29 +Initial Package Version: 5.17 +Upstream Status: unknown +Origin: Arch Linux (Giovanni Campagna) +Description: Allow using obexd without systemd in the user session + +Not all sessions run systemd --user (actually, the majority +doesn't), so the dbus daemon must be able to spawn obexd +directly, and to do so it needs the full path of the daemon. +--- + Makefile.obexd | 4 ++-- + obexd/src/org.bluez.obex.service | 4 ---- + obexd/src/org.bluez.obex.service.in | 4 ++++ + 3 files changed, 6 insertions(+), 6 deletions(-) + delete mode 100644 obexd/src/org.bluez.obex.service + create mode 100644 obexd/src/org.bluez.obex.service.in + +diff --git a/Makefile.obexd b/Makefile.obexd +index 3760867..142e7c3 100644 +--- a/Makefile.obexd ++++ b/Makefile.obexd +@@ -2,12 +2,12 @@ + if SYSTEMD + systemduserunitdir = @SYSTEMD_USERUNITDIR@ + systemduserunit_DATA = obexd/src/obex.service ++endif + + dbussessionbusdir = @DBUS_SESSIONBUSDIR@ + dbussessionbus_DATA = obexd/src/org.bluez.obex.service +-endif + +-EXTRA_DIST += obexd/src/obex.service.in obexd/src/org.bluez.obex.service ++EXTRA_DIST += obexd/src/obex.service.in obexd/src/org.bluez.obex.service.in + + obex_plugindir = $(libdir)/obex/plugins + +diff --git a/obexd/src/org.bluez.obex.service b/obexd/src/org.bluez.obex.service +deleted file mode 100644 +index a538088..0000000 +--- a/obexd/src/org.bluez.obex.service ++++ /dev/null +@@ -1,4 +0,0 @@ +-[D-BUS Service] +-Name=org.bluez.obex +-Exec=/bin/false +-SystemdService=dbus-org.bluez.obex.service +diff --git a/obexd/src/org.bluez.obex.service.in b/obexd/src/org.bluez.obex.service.in +new file mode 100644 +index 0000000..9c815f2 +--- /dev/null ++++ b/obexd/src/org.bluez.obex.service.in +@@ -0,0 +1,4 @@ ++[D-BUS Service] ++Name=org.bluez.obex ++Exec=@libexecdir@/obexd ++SystemdService=dbus-org.bluez.obex.service +-- +1.8.3.1 + + diff --git a/hardware/bluetooth/bluez/files/bluez-5.27-obexd_without_systemd-1.patch b/hardware/bluetooth/bluez/files/bluez-5.27-obexd_without_systemd-1.patch new file mode 100644 index 0000000000..749787c5b3 --- /dev/null +++ b/hardware/bluetooth/bluez/files/bluez-5.27-obexd_without_systemd-1.patch @@ -0,0 +1,61 @@ +Submitted By: Armin K. +Date: 2013-04-29 +Initial Package Version: 5.17 +Upstream Status: unknown +Origin: Arch Linux (Giovanni Campagna) +Description: Allow using obexd without systemd in the user session + +Not all sessions run systemd --user (actually, the majority +doesn't), so the dbus daemon must be able to spawn obexd +directly, and to do so it needs the full path of the daemon. +--- + Makefile.obexd | 4 ++-- + obexd/src/org.bluez.obex.service | 4 ---- + obexd/src/org.bluez.obex.service.in | 4 ++++ + 3 files changed, 6 insertions(+), 6 deletions(-) + delete mode 100644 obexd/src/org.bluez.obex.service + create mode 100644 obexd/src/org.bluez.obex.service.in + +diff --git a/Makefile.obexd b/Makefile.obexd +index 3760867..142e7c3 100644 +--- a/Makefile.obexd ++++ b/Makefile.obexd +@@ -2,12 +2,12 @@ + if SYSTEMD + systemduserunitdir = @SYSTEMD_USERUNITDIR@ + systemduserunit_DATA = obexd/src/obex.service ++endif + + dbussessionbusdir = @DBUS_SESSIONBUSDIR@ + dbussessionbus_DATA = obexd/src/org.bluez.obex.service +-endif + +-EXTRA_DIST += obexd/src/obex.service.in obexd/src/org.bluez.obex.service ++EXTRA_DIST += obexd/src/obex.service.in obexd/src/org.bluez.obex.service.in + + obex_plugindir = $(libdir)/obex/plugins + +diff --git a/obexd/src/org.bluez.obex.service b/obexd/src/org.bluez.obex.service +deleted file mode 100644 +index a538088..0000000 +--- a/obexd/src/org.bluez.obex.service ++++ /dev/null +@@ -1,4 +0,0 @@ +-[D-BUS Service] +-Name=org.bluez.obex +-Exec=/bin/false +-SystemdService=dbus-org.bluez.obex.service +diff --git a/obexd/src/org.bluez.obex.service.in b/obexd/src/org.bluez.obex.service.in +new file mode 100644 +index 0000000..9c815f2 +--- /dev/null ++++ b/obexd/src/org.bluez.obex.service.in +@@ -0,0 +1,4 @@ ++[D-BUS Service] ++Name=org.bluez.obex ++Exec=@libexecdir@/obexd ++SystemdService=dbus-org.bluez.obex.service +-- +1.8.3.1 + + diff --git a/hardware/bluetooth/bluez/pspec.xml b/hardware/bluetooth/bluez/pspec.xml new file mode 100644 index 0000000000..df7725cdce --- /dev/null +++ b/hardware/bluetooth/bluez/pspec.xml @@ -0,0 +1,156 @@ + + + + + bluez + http://bluez.sourceforge.net + + PisiLinux Community + admins@pisilinux.org + + GPLv2+ + service + library + app:console + Official Linux Bluetooth protocol stack + bluez contains the tools and libraries that provides support for the core Bluetooth layers and protocols. + https://www.kernel.org/pub/linux/bluetooth/bluez-5.27.tar.xz + + cups-devel + dbus-devel + libnl-devel + alsa-lib-devel + gstreamer-devel + libsndfile-devel + gst-plugins-base-devel + libical-devel + glib2-devel + libical-devel + + + bluez-5.27-obexd_without_systemd-1.patch + + + + + bluez + + cups + libnl + libusb + libical + alsa-lib + alsa-lib + setserial + gstreamer + libsndfile + gst-plugins-base + bluez-libs + + + /lib/udev/rules.d + /lib/systemd/system + /usr/share/misc + /usr/bin + /usr/sbin + /lib/udev + /lib/bluetooth/obexd + /lib/bluetooth/bluetoothd + /usr/lib + /usr/libexec + /usr/share/man + /var/lib/bluetooth + /usr/share/alsa/bluetooth.conf + /usr/share/dbus-1 + /etc + + + System.Service + + + + + bluez-libs + Libraries for use in Bluetooth applications + + libical + + + /usr/lib/libbluetooth.so* + /usr/share/doc + + + + + bluez-libs-devel + Development files for bluez-libs + + bluez-libs + + + /usr/include/bluetooth + /usr/lib/pkgconfig + + + + + + + + 2015-01-29 + 5.27 + rebuild. + Vedat Demir + vedat@pisilinux.org + + + 2015-01-25 + 5.27 + Version bump. + Stefan Gronewold(groni) + groni@pisilinux.org + + + 2014-07-05 + 5.21 + Version bump and bugs fix. + Vedat Demir + vedat@pisilinux.org + + + 2014-05-23 + 5.18 + Version bump + Burak Fazıl Ertürk + burakerturk@pisilinux.org + + + 2014-01-28 + 4.101 + Rebuild Unused + Varol Maksutoğlu + waroi@pisilinux.org + + + 2013-08-27 + 4.101 + R.Bump + PisiLinux Community + admins@pisilinux.org + + + 2013-06-28 + 4.101 + Add patches, --enable-hid2hci --enable-wiimote + Marcin Bojara + marcin@pisilinux.org + + + 2013-01-09 + 4.101 + First release + Erdinç Gültekin + admins@pisilinux.org + + + diff --git a/hardware/bluetooth/bluez/translations.xml b/hardware/bluetooth/bluez/translations.xml new file mode 100644 index 0000000000..d6dcaf969f --- /dev/null +++ b/hardware/bluetooth/bluez/translations.xml @@ -0,0 +1,18 @@ + + + + bluez + Linux resmi Bluetooth protokol yığını + Bu projenin genel amacı Linux'ta Bluetooth kablosuz standartların ayrıntılarını yerine getirmektir. + + + + bluez-libs + Uygulamalar için bluetooth erişim kitaplığı + + + + bluez-libs-devel + bluez-libs için geliştirme dosyaları + + diff --git a/network/connection/ModemManager/actions.py b/network/connection/ModemManager/actions.py new file mode 100644 index 0000000000..9fd3f51af4 --- /dev/null +++ b/network/connection/ModemManager/actions.py @@ -0,0 +1,29 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import shelltools +from pisi.actionsapi import pisitools +from pisi.actionsapi import autotools +from pisi.actionsapi import get + +def setup(): + #shelltools.system("./autogen.sh") + autotools.configure("--disable-static \ + --enable-more-warnings=yes \ + --with-udev-base-dir=/lib/udev \ + --with-tests=yes \ + --with-polkit=no") + +def build(): + autotools.make() + +def check(): + autotools.make("check") + +def install(): + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + + pisitools.dodoc("README", "COPYING") diff --git a/network/connection/ModemManager/pspec.xml b/network/connection/ModemManager/pspec.xml new file mode 100644 index 0000000000..ac51366c1f --- /dev/null +++ b/network/connection/ModemManager/pspec.xml @@ -0,0 +1,107 @@ + + + + + ModemManager + http://projects.gnome.org/NetworkManager + + PisiLinux Community + admins@pisilinux.org + + LGPLv2.1 + app:console + service + A manager framework for mobile broadband modems + ModemManager provides a unified high level API for communicating with mobile broadband modems. + http://www.freedesktop.org/software/ModemManager/ModemManager-1.2.0.tar.xz + + ppp-devel + libqmi-devel + libmbim-devel + + + + + ModemManager + + ppp + libqmi + libmbim + libmm-glib + + + /usr/share/doc + /usr/sbin + /usr/share/icons + /usr/share/locale + /usr/share/dbus-1 + /usr/share/gir-1.0/ModemManager-1.0.gir + /lib/udev/rules.d/ + /etc/dbus-1/system.d/ + /usr/lib/ModemManager + /usr/lib/girepository-1.0/ModemManager-1.0.typelib + /usr/share/man/man8/ModemManager.8 + + + + + ModemManager-devel + Development files for ModemManager + + ModemManager + + + /usr/include/ModemManager/ + /usr/lib/pkgconfig/ModemManager.pc + + + + + libmm-glib + D-Bus service for managing modems - shared libraries + + /usr/bin + /usr/share/vala/vapi/libmm-glib.vapi + /usr/share/vala/vapi/libmm-glib.deps + /usr/lib/libmm-glib.so* + /usr/share/man/man8/mmcli.8 + + + + + libmm-glib-devel + Development files for libmm-glib + + ModemManager-devel + libmm-glib + + + /usr/include/libmm-glib/ + /usr/lib/pkgconfig/mm-glib.pc + + + + + + 2014-02-17 + 1.2.0 + Version bump. + Yusuf Aydemir + yusuf.aydemir@pisilinux.org + + + 2014-01-20 + 1.0.0 + Version Bump + PisiLinux Community + admins@pisilinux.org + + + 2012-08-28 + 5.3.96 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/network/connection/ModemManager/translations.xml b/network/connection/ModemManager/translations.xml new file mode 100644 index 0000000000..1ab9c10893 --- /dev/null +++ b/network/connection/ModemManager/translations.xml @@ -0,0 +1,24 @@ + + + + ModemManager + Mobil modemler için yönetim katmanı + ModemManager, 3G ve GSM gibi mobil genişbant modemlerle D-Bus üzerinden iletişimi sağlayan bir sistem hizmetidir. + + + + ModemManager-devel + ModemManager için geliştirme dosyaları + + + + libmm-glib + D-Bus service for managing modems - shared libraries + + + + libmm-glib-devel + Development files for libmm-glib + libmm-glib için geliştirme dosyaları + + \ No newline at end of file diff --git a/network/connection/linux-atm/actions.py b/network/connection/linux-atm/actions.py new file mode 100644 index 0000000000..ceb82be774 --- /dev/null +++ b/network/connection/linux-atm/actions.py @@ -0,0 +1,21 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import get + +def setup(): + autotools.configure("--disable-static") + +def build(): + autotools.make("-j1") + +def install(): + autotools.rawInstall("DESTDIR=%s man_prefix=/usr/share/man" % get.installDIR()) + pisitools.insinto("/etc", "src/config/hosts.atm") + + pisitools.dodoc("AUTHORS", "THANKS", "ChangeLog", "BUGS", "NEWS", "README") diff --git a/network/connection/linux-atm/files/gcc43.patch b/network/connection/linux-atm/files/gcc43.patch new file mode 100644 index 0000000000..51b10a7328 --- /dev/null +++ b/network/connection/linux-atm/files/gcc43.patch @@ -0,0 +1,11 @@ +diff -Nur linux-atm-2.5.0-old/src/led/main.c linux-atm-2.5.0/src/led/main.c +--- linux-atm-2.5.0-old/src/led/main.c 2008-04-25 03:39:28.000000000 +0300 ++++ linux-atm-2.5.0/src/led/main.c 2008-04-25 03:39:43.000000000 +0300 +@@ -46,6 +46,7 @@ + #include + + #include ++#include + + /* Local incs */ + #include "join.h" diff --git a/network/connection/linux-atm/files/linux-atm-2.5.0-disable-ilmidiag.patch b/network/connection/linux-atm/files/linux-atm-2.5.0-disable-ilmidiag.patch new file mode 100644 index 0000000000..c420be9c58 --- /dev/null +++ b/network/connection/linux-atm/files/linux-atm-2.5.0-disable-ilmidiag.patch @@ -0,0 +1,11 @@ +--- linux-atm/src/ilmid/Makefile.am~ 2007-07-11 17:07:57.000000000 +0100 ++++ linux-atm/src/ilmid/Makefile.am 2007-08-23 09:22:45.000000000 +0100 +@@ -2,7 +2,7 @@ SUBDIRS = asn1 + + INCLUDES = -I$(srcdir)/../ilmid/asn1 + +-sbin_PROGRAMS = ilmid ilmidiag ++sbin_PROGRAMS = ilmid + + ilmid_SOURCES = rfc1157_snmp.c rfc1157_snmp.h rfc1155_smi.c rfc1155_smi.h \ + util.c util.h io.c io.h message.c message.h \ diff --git a/network/connection/linux-atm/files/linux-atm-2.5.0-open-macro.patch b/network/connection/linux-atm/files/linux-atm-2.5.0-open-macro.patch new file mode 100644 index 0000000000..928222fa28 --- /dev/null +++ b/network/connection/linux-atm/files/linux-atm-2.5.0-open-macro.patch @@ -0,0 +1,11 @@ +--- linux-atm/src/maint/atmtcp.c~ 2007-08-22 14:59:21.000000000 +0100 ++++ linux-atm/src/maint/atmtcp.c 2007-08-22 18:27:24.000000000 +0100 +@@ -109,7 +109,7 @@ static void control(int in_link,struct a + switch (msg->type) { + case ATMTCP_CTRL_OPEN: + if (out->ops->open) +- changed += out->ops->open(out,in_link,msg); ++ changed += (out->ops->open)(out,in_link,msg); + break; + case ATMTCP_CTRL_CLOSE: + if (out->ops->close) diff --git a/network/connection/linux-atm/files/man-pages.patch b/network/connection/linux-atm/files/man-pages.patch new file mode 100644 index 0000000000..c504cfe87d --- /dev/null +++ b/network/connection/linux-atm/files/man-pages.patch @@ -0,0 +1,45 @@ +diff -up linux-atm-2.5.1/src/led/zeppelin.8.fixman linux-atm-2.5.1/src/led/zeppelin.8 +--- linux-atm-2.5.1/src/led/zeppelin.8.fixman 2003-05-02 19:35:04.000000000 +0200 ++++ linux-atm-2.5.1/src/led/zeppelin.8 2010-10-13 12:58:18.000000000 +0200 +@@ -99,7 +99,7 @@ Ring and ATM parts of the ELAN, so using + recommended. Token Ring support has received less testing than its + Ethernet counterpart. + .SH FILES +-.IP \fI/var/run/lec[interface number].pid\fP ++\fI/var/run/lec[interface number].pid\fP + The file containing the process id of zeppelin. + .SH BUGS + John Bonham died 1980 and Led Zeppelin broke. +diff -up linux-atm-2.5.1/src/mpoad/mpcd.8.fixman linux-atm-2.5.1/src/mpoad/mpcd.8 +--- linux-atm-2.5.1/src/mpoad/mpcd.8.fixman 2001-10-10 00:33:07.000000000 +0200 ++++ linux-atm-2.5.1/src/mpoad/mpcd.8 2010-10-13 12:59:14.000000000 +0200 +@@ -28,7 +28,7 @@ mpcd \- ATM MPOA (Multi\-Protocol Over A + .B ]] + .SH DESCRIPTION + MPOA client +-.SM(MPC) is responsible for creating and receiving ++.SM (MPC) is responsible for creating and receiving + internetwork layer shortcuts. Using these shortcuts MPCs forward + unicast internetwork layer packets effectively over ATM without need + for routing protocols. +@@ -43,7 +43,7 @@ accepts shortcuts and packets arriving o + shortcuts is done with the help of + .SM MPOA + server +-.SM(MPS). ++.SM (MPS). + .PP + Just as the Linux + .SM LAN +diff -up linux-atm-2.5.1/src/sigd/atmsigd.conf.4.fixman linux-atm-2.5.1/src/sigd/atmsigd.conf.4 +--- linux-atm-2.5.1/src/sigd/atmsigd.conf.4.fixman 2001-10-10 00:33:07.000000000 +0200 ++++ linux-atm-2.5.1/src/sigd/atmsigd.conf.4 2010-10-13 12:58:49.000000000 +0200 +@@ -125,7 +125,7 @@ a comment. The `#' character cannot be e + .P + If an option is specified in \fBatmsigd.conf\fP and on the command + line, the command line has priority. +-.COMPATIBILITY ++.SH COMPATIBILITY + Certain options used by past versions of \fBatmsigd\fP but no longer documented + on the man page are still recognized and supported, but they also yield a + warning message. Future versions of \fBatmsigd\fP will not recognize those diff --git a/network/connection/linux-atm/files/netdevice.patch b/network/connection/linux-atm/files/netdevice.patch new file mode 100644 index 0000000000..22af6ef27f --- /dev/null +++ b/network/connection/linux-atm/files/netdevice.patch @@ -0,0 +1,33 @@ +diff -Nur linux-atm-2.5.0-old/src/arpd/arp.c linux-atm-2.5.0/src/arpd/arp.c +--- linux-atm-2.5.0-old/src/arpd/arp.c 2008-04-25 03:34:35.000000000 +0300 ++++ linux-atm-2.5.0/src/arpd/arp.c 2008-04-25 03:34:51.000000000 +0300 +@@ -15,7 +15,6 @@ + #include + #include /* for linux/if_arp.h */ + #include /* for ntohs, etc. */ +-#define _LINUX_NETDEVICE_H /* very crude hack for glibc2 */ + #include + #include + #include +diff -Nur linux-atm-2.5.0-old/src/arpd/io.c linux-atm-2.5.0/src/arpd/io.c +--- linux-atm-2.5.0-old/src/arpd/io.c 2008-04-25 03:34:35.000000000 +0300 ++++ linux-atm-2.5.0/src/arpd/io.c 2008-04-25 03:34:51.000000000 +0300 +@@ -21,7 +21,6 @@ + #include + #include /* for CLIP_DEFAULT_IDLETIMER */ + #include +-#define _LINUX_NETDEVICE_H /* glibc2 */ + #include + #include + +diff -Nur linux-atm-2.5.0-old/src/arpd/itf.c linux-atm-2.5.0/src/arpd/itf.c +--- linux-atm-2.5.0-old/src/arpd/itf.c 2008-04-25 03:34:35.000000000 +0300 ++++ linux-atm-2.5.0/src/arpd/itf.c 2008-04-25 03:34:51.000000000 +0300 +@@ -12,7 +12,6 @@ + #include + #include + #include +-#define _LINUX_NETDEVICE_H /* glibc2 */ + #include + #include + diff --git a/network/connection/linux-atm/files/sandbox.patch b/network/connection/linux-atm/files/sandbox.patch new file mode 100644 index 0000000000..69939638fa --- /dev/null +++ b/network/connection/linux-atm/files/sandbox.patch @@ -0,0 +1,17 @@ +Index: linux-atm-2.5.1/src/config/Makefile.in +=================================================================== +--- linux-atm-2.5.1.orig/src/config/Makefile.in ++++ linux-atm-2.5.1/src/config/Makefile.in +@@ -413,10 +413,10 @@ uninstall-am: uninstall-local uninstall- + + + install-exec-local: +- -cp hosts.atm /etc ++ -cp hosts.atm $(DESTDIR)$(sysconfdir) + + uninstall-local: +- -rm /etc/hosts.atm ++ -rm $(DESTDIR)$(sysconfdir)/hosts.atm + + # Tell versions [3.59,3.63) of GNU make to not export all variables. + # Otherwise a system limit (for SysV at least) may be exceeded. diff --git a/network/connection/linux-atm/pspec.xml b/network/connection/linux-atm/pspec.xml new file mode 100644 index 0000000000..8b5e594b4e --- /dev/null +++ b/network/connection/linux-atm/pspec.xml @@ -0,0 +1,72 @@ + + + + + linux-atm + http://linux-atm.sourceforge.net/ + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + app:console + library + Tools to support ATM networking under Liunx + linux-atm contains tools for Asynchronous Transfer Mode. Supports raw ATM connections (PVCs and SVCs), IP over ATM, LAN emulation, MPOA, Arequipa, and some others. + mirrors://sourceforge/project/linux-atm/linux-atm/2.5.2/linux-atm-2.5.2.tar.gz + + flex + + + man-pages.patch + + + + + + linux-atm + + flex + + + /lib/firmware + /usr/sbin + /usr/bin + /etc + /usr/lib + /usr/share/man + /usr/share/doc + + + + + linux-atm-devel + Development files for linux-atm + + linux-atm + + + /usr/include + + + + + + 2015-04-13 + 2.5.2 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2010-10-13 + 2.5.1 + First release + Gökcen Eraslan + admins@pisilinux.org + + + diff --git a/network/connection/linux-atm/translations.xml b/network/connection/linux-atm/translations.xml new file mode 100644 index 0000000000..57d274cb46 --- /dev/null +++ b/network/connection/linux-atm/translations.xml @@ -0,0 +1,13 @@ + + + + linux-atm + ATM ağ bağlantısı desteği için araçlar + linux-atm ATM (Asynchronous Transfer Mode) bağlantısı için gerekli çeşitli araçlar ve kitaplıklarını içerir. + + + + linux-atm-devel + linux-atm için geliştirme dosyaları + + diff --git a/network/connection/mobile-broadband-provider-info/actions.py b/network/connection/mobile-broadband-provider-info/actions.py new file mode 100644 index 0000000000..5a90665eaf --- /dev/null +++ b/network/connection/mobile-broadband-provider-info/actions.py @@ -0,0 +1,20 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt. + +from pisi.actionsapi import pisitools +from pisi.actionsapi import autotools +from pisi.actionsapi import get + +def setup(): + autotools.configure() + +def build(): + autotools.make() + +def install(): + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + + pisitools.dodoc("ChangeLog", "COPYING", "README*") diff --git a/network/connection/mobile-broadband-provider-info/pspec.xml b/network/connection/mobile-broadband-provider-info/pspec.xml new file mode 100644 index 0000000000..23ae65e547 --- /dev/null +++ b/network/connection/mobile-broadband-provider-info/pspec.xml @@ -0,0 +1,34 @@ + + + + + mobile-broadband-provider-info + http://live.gnome.org/NetworkManager/MobileBroadband/ServiceProviders + + PisiLinux Community + admins@pisilinux.org + + public-domain + data + Service provider specific settings of mobile broadband providers in different countries + The mobile-broadband-provider-info package contains listings of mobile broadband (3G) providers and associated network and plan information. + ftp://ftp.gnome.org/pub/gnome/sources/mobile-broadband-provider-info/20120614/mobile-broadband-provider-info-20120614.tar.xz + + + + mobile-broadband-provider-info + + /usr/share + + + + + + 2012-08-28 + 20120614 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/network/connection/mobile-broadband-provider-info/translations.xml b/network/connection/mobile-broadband-provider-info/translations.xml new file mode 100644 index 0000000000..2d8e6b2f8e --- /dev/null +++ b/network/connection/mobile-broadband-provider-info/translations.xml @@ -0,0 +1,8 @@ + + + + mobile-broadband-provider-info + Çeşitli ülkelerdeki mobil genişbant servis sağlayıcıları hakkında bilgileri içeren ayar veritabanı + mobile-broadband-provider-info paketi, dünya üzerindeki mobil genişbant sağlayıcılarının ve ilgili tarifelerinin listesini tutan bir veritabanıdır. + + diff --git a/network/connection/ppp/actions.py b/network/connection/ppp/actions.py new file mode 100644 index 0000000000..fc5fe5bed2 --- /dev/null +++ b/network/connection/ppp/actions.py @@ -0,0 +1,47 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +def setup(): + pisitools.cflags.add("-fPIC", "-D_GNU_SOURCE") + shelltools.copytree("%s/dhcp" % get.workDIR(), "pppd/plugins") + pisitools.dosed("pppd/plugins/dhcp/Makefile.linux", "^(CFLAGS=.+)\s-O2", "\\1 %s" % get.CFLAGS()) + + # Enable atm + pisitools.dosed("pppd/Makefile.linux", "^#(HAVE_LIBATM=yes)", "\\1") + # Enable pam + pisitools.dosed("pppd/Makefile.linux", "^#(USE_PAM=y)", "\\1") + # Enable CBCP + pisitools.dosed("pppd/Makefile.linux", "^#(CBCP=y)", "\\1") + # Enable IPv6 + pisitools.dosed("pppd/Makefile.linux", "^#(HAVE_INET6)", "\\1") + # Enable dhcp + pisitools.dosed("pppd/plugins/Makefile.linux", "^(SUBDIRS\s:=.+)", "\\1 dhcp") + + autotools.configure() + +def build(): + autotools.make() + +def install(): + # The build mechanism is crap. Don't remove \/usr from DESTDIR or else the paths will fail + autotools.rawInstall("DESTDIR=%s/usr INSTROOT=%s install-etcppp" % ((get.installDIR(),)*2)) + + # No suid libraries + shelltools.chmod("%s/usr/lib/pppd/%s/*.so" % (get.installDIR(),get.srcVERSION()), 0755) + + # Install Radius config files + pisitools.insinto("/etc/radiusclient", "pppd/plugins/radius/etc/*") + + # Create peers directory + pisitools.dodir("/run/ppp") + pisitools.dodir("/etc/ppp/peers") + + pisitools.dodoc("Changes*", "README*", "FAQ") diff --git a/network/connection/ppp/files/chat-default b/network/connection/ppp/files/chat-default new file mode 100644 index 0000000000..72435c136a --- /dev/null +++ b/network/connection/ppp/files/chat-default @@ -0,0 +1,14 @@ +# /etc/ppp/chat-default: + +'ABORT' 'BUSY' +'ABORT' 'ERROR' +'ABORT' 'NO ANSWER' +'ABORT' 'NO CARRIER' +'ABORT' 'NO DIALTONE' +'ABORT' 'Invalid Login' +'ABORT' 'Login incorrect' +'' 'ATZ' +'OK' 'ATDT$NUMBER' +'CONNECT' '' +'TIMEOUT' '5' +'~--' '' diff --git a/network/connection/ppp/files/confd.ppp0 b/network/connection/ppp/files/confd.ppp0 new file mode 100644 index 0000000000..f54ef449b1 --- /dev/null +++ b/network/connection/ppp/files/confd.ppp0 @@ -0,0 +1,48 @@ +# /etc/conf.d/net.ppp0: + +# Config file for /etc/init.d/net.ppp0 + +PEER="MyPeer" # Define peer (aka ISP) +DEBUG="no" # Turn on debugging +PERSIST="no" # Redial after being dropped +ONDEMAND="no" # Only bring the interface up on demand? +MODEMPORT="/dev/ttyS1" # TTY device modem is connected to +LINESPEED="115200" # Speed pppd should try to connect at +INITSTRING="" # Extra init string for the modem +DEFROUTE="yes" # Must pppd set the default route? +HARDFLOWCTL="yes" # Use hardware flow control? +ESCAPECHARS="yes" # Use escape caracters ? +PPPOPTIONS="" # Extra options for pppd +USERNAME="user" # The PAP/CHAP username +PASSWORD="passwd" # Your password/secret. Ugly I know, but i + # will work on something more secure later + # on. 700 permission on /etc/init.d/net.ppp0 + # should be enouth for now. +NUMBER="9180000" # The telephone number of your ISP + # leave blank for leased-line operation. +REMIP="" # The ip of the remote box if it should be set +NETMASK="" # Netmask +IPADDR="" # Our IP if we have a static one +MRU="768" # Sets the MRU +MTU="768" # Sets the MTU +RETRYTIMEOUT="60" # Retry timeout for when ONDEMAND="yes" or + # PERSIST="yes" +IDLETIMEOUT="600" # Idle timeout for when ONDEMAND="yes" +PEERDNS="no" # Should pppd set the peer dns? + +AUTOCFGFILES="yes" # By default this scripts will generate + # /etc/ppp/chat-isp, /etc/ppp/chap-secrets, + # /etc/ppp/pap-secrets and /etc/ppp/peers/isp + # automatically. Set to "no" if you experience + # problems, or need specialized scripts. You + # will have to create these files by hand then. + +AUTOCHATSCRIPT="yes" # By default this script iwll generate + # /etc/ppp/chat-${PEER} automatically. Set to "no" + # if you experience problems, or need specialized + # scripts. You will have to create these files by + # hand then. + + +# Directory where the templates is stored +TEMPLATEDIR=/etc/ppp diff --git a/network/connection/ppp/files/gentoo/02_all_make-vars.patch b/network/connection/ppp/files/gentoo/02_all_make-vars.patch new file mode 100644 index 0000000000..e6898b2b0d --- /dev/null +++ b/network/connection/ppp/files/gentoo/02_all_make-vars.patch @@ -0,0 +1,194 @@ +diff -ur ppp-2.4.5.orig/chat/Makefile.linux ppp-2.4.5/chat/Makefile.linux +--- ppp-2.4.5.orig/chat/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/chat/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 +@@ -10,7 +10,6 @@ + CDEF4= -DFNDELAY=O_NDELAY # Old name value + CDEFS= $(CDEF1) $(CDEF2) $(CDEF3) $(CDEF4) + +-COPTS= -O2 -g -pipe + CFLAGS= $(COPTS) $(CDEFS) + + INSTALL= install +@@ -18,7 +17,7 @@ + all: chat + + chat: chat.o +- $(CC) -o chat chat.o ++ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ + + chat.o: chat.c + $(CC) -c $(CFLAGS) -o chat.o chat.c +diff -ur ppp-2.4.5.orig/pppd/Makefile.linux ppp-2.4.5/pppd/Makefile.linux +--- ppp-2.4.5.orig/pppd/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 +@@ -32,7 +32,7 @@ + + # CC = gcc + # +-COPTS = -O2 -pipe -Wall -g ++COPTS+= -Wall + LIBS = + + # Uncomment the next 2 lines to include support for Microsoft's +diff -ur ppp-2.4.5.orig/pppd/plugins/Makefile.linux ppp-2.4.5/pppd/plugins/Makefile.linux +--- ppp-2.4.5.orig/pppd/plugins/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/plugins/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 +@@ -1,7 +1,11 @@ + #CC = gcc +-COPTS = -O2 -g + CFLAGS = $(COPTS) -I.. -I../../include -fPIC +-LDFLAGS = -shared ++LDFLAGS_PROG := $(LDFLAGS) ++export LDFLAGS LDFLAGS_PROG ++LDFLAGS += -shared ++# need the following option, otherwise linking plugins might fail with undef errors (Gentoo bug 210837) ++LDFLAGS += -Wl,--allow-shlib-undefined ++LIBS = + INSTALL = install + + DESTDIR = $(INSTROOT)@DESTDIR@ +@@ -23,7 +27,7 @@ + for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done + + %.so: %.c +- $(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^ ++ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS) + + VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../patchlevel.h) + +diff -ur ppp-2.4.5.orig/pppd/plugins/pppoatm/Makefile.linux ppp-2.4.5/pppd/plugins/pppoatm/Makefile.linux +--- ppp-2.4.5.orig/pppd/plugins/pppoatm/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/plugins/pppoatm/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 +@@ -1,7 +1,5 @@ + #CC = gcc +-COPTS = -O2 -g + CFLAGS = $(COPTS) -I../.. -I../../../include -fPIC +-LDFLAGS = -shared + INSTALL = install + + #*********************************************************************** +@@ -33,7 +31,7 @@ + all: $(PLUGIN) + + $(PLUGIN): $(PLUGIN_OBJS) +- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) ++ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS) + + install: all + $(INSTALL) -d -m 755 $(LIBDIR) +diff -ur ppp-2.4.5.orig/pppd/plugins/pppol2tp/Makefile.linux ppp-2.4.5/pppd/plugins/pppol2tp/Makefile.linux +--- ppp-2.4.5.orig/pppd/plugins/pppol2tp/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/plugins/pppol2tp/Makefile.linux 2010-08-08 09:20:02.000000000 +0200 +@@ -1,7 +1,5 @@ + #CC = gcc +-COPTS = -O2 -g + CFLAGS = $(COPTS) -I. -I../.. -I../../../include -fPIC +-LDFLAGS = -shared + INSTALL = install + + #*********************************************************************** +@@ -16,7 +14,7 @@ + all: $(PLUGINS) + + %.so: %.o +- $(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS) ++ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS) + + install: all + $(INSTALL) -d -m 755 $(LIBDIR) +diff -ur ppp-2.4.5.orig/pppd/plugins/radius/Makefile.linux ppp-2.4.5/pppd/plugins/radius/Makefile.linux +--- ppp-2.4.5.orig/pppd/plugins/radius/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/plugins/radius/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 +@@ -12,7 +12,7 @@ + INSTALL = install + + PLUGIN=radius.so radattr.so radrealms.so +-CFLAGS=-I. -I../.. -I../../../include -O2 -fPIC -DRC_LOG_FACILITY=LOG_DAEMON ++CFLAGS=$(COPTS) -I. -I../.. -I../../../include -fPIC -DRC_LOG_FACILITY=LOG_DAEMON + + # Uncomment the next line to include support for Microsoft's + # MS-CHAP authentication protocol. +@@ -43,13 +43,13 @@ + $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) + + radius.so: radius.o libradiusclient.a +- $(CC) -o radius.so -shared radius.o libradiusclient.a ++ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ + + radattr.so: radattr.o +- $(CC) -o radattr.so -shared radattr.o ++ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ + + radrealms.so: radrealms.o +- $(CC) -o radrealms.so -shared radrealms.o ++ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ + + CLIENTOBJS = avpair.o buildreq.o config.o dict.o ip_util.o \ + clientid.o sendserver.o lock.o util.o md5.o +diff -ur ppp-2.4.5.orig/pppd/plugins/rp-pppoe/Makefile.linux ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux +--- ppp-2.4.5.orig/pppd/plugins/rp-pppoe/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 +@@ -25,12 +25,11 @@ + # Version is set ONLY IN THE MAKEFILE! Don't delete this! + RP_VERSION=3.8p + +-COPTS=-O2 -g + CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"' + all: rp-pppoe.so pppoe-discovery + + pppoe-discovery: pppoe-discovery.o debug.o +- $(CC) -o pppoe-discovery pppoe-discovery.o debug.o ++ $(CC) $(LDFLAGS_PROG) $(CFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o + + pppoe-discovery.o: pppoe-discovery.c + $(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c +@@ -39,7 +38,7 @@ + $(CC) $(CFLAGS) -c -o debug.o debug.c + + rp-pppoe.so: plugin.o discovery.o if.o common.o +- $(CC) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o ++ $(CC) $(LDFLAGS) $(CFLAGS) -o rp-pppoe.so plugin.o discovery.o if.o common.o + + install: all + $(INSTALL) -d -m 755 $(LIBDIR) +diff -ur ppp-2.4.5.orig/pppdump/Makefile.linux ppp-2.4.5/pppdump/Makefile.linux +--- ppp-2.4.5.orig/pppdump/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppdump/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 +@@ -2,7 +2,7 @@ + BINDIR = $(DESTDIR)/sbin + MANDIR = $(DESTDIR)/share/man/man8 + +-CFLAGS= -O -I../include/net ++CFLAGS=$(COPTS) -I../include/net + OBJS = pppdump.o bsd-comp.o deflate.o zlib.o + + INSTALL= install +@@ -10,7 +10,7 @@ + all: pppdump + + pppdump: $(OBJS) +- $(CC) -o pppdump $(OBJS) ++ $(CC) $(LDFLAGS) -o pppdump $(OBJS) + + clean: + rm -f pppdump $(OBJS) *~ +diff -ur ppp-2.4.5.orig/pppstats/Makefile.linux ppp-2.4.5/pppstats/Makefile.linux +--- ppp-2.4.5.orig/pppstats/Makefile.linux 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppstats/Makefile.linux 2010-08-08 09:19:38.000000000 +0200 +@@ -10,7 +10,6 @@ + PPPSTATOBJS = pppstats.o + + #CC = gcc +-COPTS = -O + COMPILE_FLAGS = -I../include + LIBS = + +@@ -26,7 +25,7 @@ + $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) + + pppstats: $(PPPSTATSRCS) +- $(CC) $(CFLAGS) -o pppstats pppstats.c $(LIBS) ++ $(CC) $(CFLAGS) $(LDFLAGS) -o pppstats pppstats.c $(LIBS) + + clean: + rm -f pppstats *~ #* core diff --git a/network/connection/ppp/files/gentoo/04_all_mpls.patch b/network/connection/ppp/files/gentoo/04_all_mpls.patch new file mode 100644 index 0000000000..86d79ef557 --- /dev/null +++ b/network/connection/ppp/files/gentoo/04_all_mpls.patch @@ -0,0 +1,431 @@ +diff -Nur ppp-2.4.5.orig/pppd/main.c ppp-2.4.5/pppd/main.c +--- ppp-2.4.5.orig/pppd/main.c 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/main.c 2010-08-08 09:30:23.000000000 +0200 +@@ -96,6 +96,9 @@ + #include "fsm.h" + #include "lcp.h" + #include "ipcp.h" ++ ++#include "mplscp.h" ++ + #ifdef INET6 + #include "ipv6cp.h" + #endif +@@ -283,6 +286,7 @@ + &cbcp_protent, + #endif + &ipcp_protent, ++ &mplscp_protent, + #ifdef INET6 + &ipv6cp_protent, + #endif +diff -Nur ppp-2.4.5.orig/pppd/Makefile.linux ppp-2.4.5/pppd/Makefile.linux +--- ppp-2.4.5.orig/pppd/Makefile.linux 2010-08-08 09:22:22.000000000 +0200 ++++ ppp-2.4.5/pppd/Makefile.linux 2010-08-08 09:31:43.000000000 +0200 +@@ -13,16 +13,16 @@ + + PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c md5.c ccp.c \ + ecp.c ipxcp.c auth.c options.c sys-linux.c md4.c chap_ms.c \ +- demand.c utils.c tty.c eap.c chap-md5.c session.c ++ demand.c utils.c tty.c eap.c chap-md5.c session.c mplscp.c + + HEADERS = ccp.h session.h chap-new.h ecp.h fsm.h ipcp.h \ + ipxcp.h lcp.h magic.h md5.h patchlevel.h pathnames.h pppd.h \ +- upap.h eap.h ++ upap.h eap.h mplscp.h + + MANPAGES = pppd.8 + PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o md5.o ccp.o \ + ecp.o auth.o options.o demand.o utils.o sys-linux.o ipxcp.o tty.o \ +- eap.o chap-md5.o session.o ++ eap.o chap-md5.o session.o mplscp.o + + # + # include dependencies if present +diff -Nur ppp-2.4.5.orig/pppd/mplscp.c ppp-2.4.5/pppd/mplscp.c +--- ppp-2.4.5.orig/pppd/mplscp.c 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.5/pppd/mplscp.c 2010-08-08 09:30:23.000000000 +0200 +@@ -0,0 +1,371 @@ ++ ++/* MPLSCP - Serge.Krier@advalvas.be (C) 2001 */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include "pppd.h" ++#include "fsm.h" ++#include "mplscp.h" ++ ++ ++/* local vars */ ++/* static int mplscp_is_up; */ /* have called np_up() */ ++ ++/* ++ * Callbacks for fsm code. (CI = Configuration Information) ++ */ ++static void mplscp_resetci __P((fsm *)); /* Reset our CI */ ++static int mplscp_cilen __P((fsm *)); /* Return length of our CI */ ++static void mplscp_addci __P((fsm *, u_char *, int *)); /* Add our CI */ ++static int mplscp_ackci __P((fsm *, u_char *, int)); /* Peer ack'd our CI */ ++static int mplscp_nakci __P((fsm *, u_char *, int)); /* Peer nak'd our CI */ ++static int mplscp_rejci __P((fsm *, u_char *, int)); /* Peer rej'd our CI */ ++static int mplscp_reqci __P((fsm *, u_char *, int *, int)); /* Rcv CI */ ++static void mplscp_up __P((fsm *)); /* We're UP */ ++static void mplscp_down __P((fsm *)); /* We're DOWN */ ++static void mplscp_finished __P((fsm *)); /* Don't need lower layer */ ++ ++fsm mplscp_fsm[NUM_PPP]; /* MPLSCP fsm structure */ ++ ++static fsm_callbacks mplscp_callbacks = { /* MPLSCP callback routines */ ++ mplscp_resetci, /* Reset our Configuration Information */ ++ mplscp_cilen, /* Length of our Configuration Information */ ++ mplscp_addci, /* Add our Configuration Information */ ++ mplscp_ackci, /* ACK our Configuration Information */ ++ mplscp_nakci, /* NAK our Configuration Information */ ++ mplscp_rejci, /* Reject our Configuration Information */ ++ mplscp_reqci, /* Request peer's Configuration Information */ ++ mplscp_up, /* Called when fsm reaches OPENED state */ ++ mplscp_down, /* Called when fsm leaves OPENED state */ ++ NULL, /* Called when we want the lower layer up */ ++ mplscp_finished, /* Called when we want the lower layer down */ ++ NULL, /* Called when Protocol-Reject received */ ++ NULL, /* Retransmission is necessary */ ++ NULL, /* Called to handle protocol-specific codes */ ++ "MPLSCP" /* String name of protocol */ ++}; ++ ++static option_t mplscp_option_list[] = { ++ { "mpls", o_bool, &mplscp_protent.enabled_flag, ++ "Enable MPLSCP (and MPLS)", 1 }, ++ { NULL } }; ++ ++/* ++ * Protocol entry points from main code. ++ */ ++ ++static void mplscp_init __P((int)); ++static void mplscp_open __P((int)); ++static void mplscp_close __P((int, char *)); ++static void mplscp_lowerup __P((int)); ++static void mplscp_lowerdown __P((int)); ++static void mplscp_input __P((int, u_char *, int)); ++static void mplscp_protrej __P((int)); ++static int mplscp_printpkt __P((u_char *, int, ++ void (*) __P((void *, char *, ...)), void *)); ++ ++struct protent mplscp_protent = { ++ PPP_MPLSCP, ++ mplscp_init, ++ mplscp_input, ++ mplscp_protrej, ++ mplscp_lowerup, ++ mplscp_lowerdown, ++ mplscp_open, ++ mplscp_close, ++ mplscp_printpkt, ++ NULL, ++ 0, /* MPLS not enabled by default */ ++ "MPLSCP", ++ "MPLS", ++ mplscp_option_list, ++ NULL, ++ NULL, ++ NULL ++}; ++ ++/* ++ * mplscp_init - Initialize MPLSCP. ++ */ ++static void ++mplscp_init(int unit) { ++ ++ fsm *f = &mplscp_fsm[unit]; ++ ++ f->unit = unit; ++ f->protocol = PPP_MPLSCP; ++ f->callbacks = &mplscp_callbacks; ++ fsm_init(&mplscp_fsm[unit]); ++ ++} ++ ++/* ++ * mplscp_open - MPLSCP is allowed to come up. ++ */ ++static void ++mplscp_open(int unit) { ++ ++ fsm_open(&mplscp_fsm[unit]); ++ ++} ++ ++/* ++ * mplscp_close - Take MPLSCP down. ++ */ ++static void ++mplscp_close(int unit, char *reason) { ++ ++ fsm_close(&mplscp_fsm[unit], reason); ++ ++} ++ ++/* ++ * mplscp_lowerup - The lower layer is up. ++ */ ++static void ++mplscp_lowerup(int unit) { ++ ++ fsm_lowerup(&mplscp_fsm[unit]); ++} ++ ++/* ++ * mplscp_lowerdown - The lower layer is down. ++ */ ++static void ++mplscp_lowerdown(int unit) { ++ ++ fsm_lowerdown(&mplscp_fsm[unit]); ++} ++ ++/* ++ * mplscp_input - Input MPLSCP packet. ++ */ ++static void ++mplscp_input(int unit, u_char *p, int len) { ++ ++ fsm_input(&mplscp_fsm[unit], p, len); ++} ++ ++/* ++ * mplscp_protrej - A Protocol-Reject was received for MPLSCP. ++ * Pretend the lower layer went down, so we shut up. ++ */ ++static void ++mplscp_protrej(int unit) { ++ ++ fsm_lowerdown(&mplscp_fsm[unit]); ++} ++ ++/* ++ * mplscp_resetci - Reset our CI. ++ * Called by fsm_sconfreq, Send Configure Request. ++ */ ++static void ++mplscp_resetci(fsm *f) { ++ ++ return; ++} ++ ++/* ++ * mplscp_cilen - Return length of our CI. ++ * Called by fsm_sconfreq, Send Configure Request. ++ */ ++static int ++mplscp_cilen(fsm *f) { ++ ++ return 0; ++} ++ ++/* ++ * mplscp_addci - Add our desired CIs to a packet. ++ * Called by fsm_sconfreq, Send Configure Request. ++ */ ++static void ++mplscp_addci(fsm *f, u_char *ucp, int *lenp) { ++ ++} ++ ++/* ++ * ipcp_ackci - Ack our CIs. ++ * Called by fsm_rconfack, Receive Configure ACK. ++ * ++ * Returns: ++ * 0 - Ack was bad. ++ * 1 - Ack was good. ++ */ ++static int ++mplscp_ackci(fsm *f, u_char *p, int len) { ++ ++ return 1; ++ ++} ++ ++/* ++ * mplscp_nakci - Peer has sent a NAK for some of our CIs. ++ * This should not modify any state if the Nak is bad ++ * or if MPLSCP is in the OPENED state. ++ * Calback from fsm_rconfnakrej - Receive Configure-Nak or Configure-Reject. ++ * ++ * Returns: ++ * 0 - Nak was bad. ++ * 1 - Nak was good. ++ */ ++static int ++mplscp_nakci(fsm *f, u_char *p, int len) { ++ ++ return 1; ++} ++ ++/* ++ * MPLSVP_rejci - Reject some of our CIs. ++ * Callback from fsm_rconfnakrej. ++ */ ++static int ++mplscp_rejci(fsm *f, u_char *p, int len) { ++ ++ return 1; ++ ++} ++ ++/* ++ * mplscp_reqci - Check the peer's requested CIs and send appropriate response. ++ * Callback from fsm_rconfreq, Receive Configure Request ++ * ++ * Returns: CONFACK, CONFNAK or CONFREJ and input packet modified ++ * appropriately. If reject_if_disagree is non-zero, doesn't return ++ * CONFNAK; returns CONFREJ if it can't return CONFACK. ++ */ ++static int ++mplscp_reqci(fsm *f, u_char *inp, int *len, int reject_if_disagree) { ++ ++ ++ int rc = CONFACK; /* Final packet return code */ ++ ++ PUTCHAR(CONFACK,inp); ++ ++ return rc; ++ ++} ++ ++static void ++mplscp_up(fsm *f) { ++ ++ sifnpmode(f->unit, PPP_MPLS_UC, NPMODE_PASS); ++ /* sifnpmode(f->unit, PPP_MPLS_MC, NPMODE_PASS);*/ ++ ++ np_up(f->unit, PPP_MPLS_UC); ++ /* np_up(f->unit, PPP_MPLS_MC);*/ ++ /* ipcp_is_up = 1;*/ ++ ++ ++#if 1 ++ printf("MPLSCP is OPENED\n"); ++#endif ++ ++} ++ ++static void ++mplscp_down(fsm *f) { ++ ++ sifnpmode(f->unit, PPP_MPLS_UC, NPMODE_DROP); ++ /* sifnpmode(f->unit, PPP_MPLS_MC, NPMODE_DROP);*/ ++ ++ sifdown(f->unit); ++ ++#if 1 ++ printf("MPLSCP is CLOSED\n"); ++#endif ++ ++ ++} ++ ++static void ++mplscp_finished(fsm *f) { ++ ++ np_finished(f->unit, PPP_MPLS_UC); ++ /* np_finished(f->unit, PPP_MPLS_MC);*/ ++ ++} ++ ++/* ++ * mpls_printpkt - print the contents of an MPLSCP packet. ++ */ ++static char *mplscp_codenames[] = { ++ "ConfReq", "ConfAck", "ConfNak", "ConfRej", ++ "TermReq", "TermAck", "CodeRej" ++}; ++ ++static int ++mplscp_printpkt(u_char *p, int plen, ++ void (*printer) __P((void *, char *, ...)), ++ void *arg) { ++ ++ int code, id, len, olen; ++ u_char *pstart, *optend; ++ ++ if (plen < HEADERLEN) ++ return 0; ++ pstart = p; ++ GETCHAR(code, p); ++ GETCHAR(id, p); ++ GETSHORT(len, p); ++ if (len < HEADERLEN || len > plen) ++ return 0; ++ ++ if (code >= 1 && code <= sizeof(mplscp_codenames) / sizeof(char *)) ++ printer(arg, " %s", mplscp_codenames[code-1]); ++ else ++ printer(arg, " code=0x%x", code); ++ printer(arg, " id=0x%x", id); ++ len -= HEADERLEN; ++ switch (code) { ++ case CONFREQ: ++ case CONFACK: ++ case CONFNAK: ++ case CONFREJ: ++ /* print option list */ ++ while (len >= 2) { ++ GETCHAR(code, p); ++ GETCHAR(olen, p); ++ p -= 2; ++ if (olen < 2 || olen > len) { ++ break; ++ } ++ printer(arg, " <"); ++ len -= olen; ++ optend = p + olen; ++ while (p < optend) { ++ GETCHAR(code, p); ++ printer(arg, " %.2x", code); ++ } ++ printer(arg, ">"); ++ } ++ break; ++ ++ case TERMACK: ++ case TERMREQ: ++ if (len > 0 && *p >= ' ' && *p < 0x7f) { ++ printer(arg, " "); ++ print_string((char *)p, len, printer, arg); ++ p += len; ++ len = 0; ++ } ++ break; ++ } ++ ++ /* print the rest of the bytes in the packet */ ++ for (; len > 0; --len) { ++ GETCHAR(code, p); ++ printer(arg, " %.2x", code); ++ } ++ ++ return p - pstart; ++ ++} +diff -Nur ppp-2.4.5.orig/pppd/mplscp.h ppp-2.4.5/pppd/mplscp.h +--- ppp-2.4.5.orig/pppd/mplscp.h 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.5/pppd/mplscp.h 2010-08-08 09:30:23.000000000 +0200 +@@ -0,0 +1,8 @@ ++ ++/* MPLSCP - Serge.Krier@advalvas.be (C) 2001 */ ++ ++#define PPP_MPLSCP 0x8281 ++#define PPP_MPLS_UC 0x0281 ++#define PPP_MPLS_MC 0x0283 ++ ++extern struct protent mplscp_protent; diff --git a/network/connection/ppp/files/gentoo/06_all_killaddr-smarter.patch b/network/connection/ppp/files/gentoo/06_all_killaddr-smarter.patch new file mode 100644 index 0000000000..6d12dd9edf --- /dev/null +++ b/network/connection/ppp/files/gentoo/06_all_killaddr-smarter.patch @@ -0,0 +1,134 @@ +diff -Nur ppp-2.4.5.orig/pppd/options.c ppp-2.4.5/pppd/options.c +--- ppp-2.4.5.orig/pppd/options.c 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/options.c 2010-08-08 09:43:47.000000000 +0200 +@@ -100,6 +100,9 @@ + char user[MAXNAMELEN]; /* Username for PAP */ + char passwd[MAXSECRETLEN]; /* Password for PAP */ + bool persist = 0; /* Reopen link after it goes down */ ++bool killoldaddr = 0; /* If our IP is reassigned on ++ reconnect, kill active TCP ++ connections using the old IP. */ + char our_name[MAXNAMELEN]; /* Our name for authentication purposes */ + bool demand = 0; /* do dial-on-demand */ + char *ipparam = NULL; /* Extra parameter for ip up/down scripts */ +@@ -231,6 +234,11 @@ + { "demand", o_bool, &demand, + "Dial on demand", OPT_INITONLY | 1, &persist }, + ++ { "killoldaddr", o_bool, &killoldaddr, ++ "Kill connections from an old source address", 1}, ++ { "nokilloldaddr", o_bool,&killoldaddr, ++ "Don't kill connections from an old source address" }, ++ + { "--version", o_special_noarg, (void *)showversion, + "Show version number" }, + { "--help", o_special_noarg, (void *)showhelp, +diff -Nur ppp-2.4.5.orig/pppd/pppd.h ppp-2.4.5/pppd/pppd.h +--- ppp-2.4.5.orig/pppd/pppd.h 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/pppd.h 2010-08-08 09:43:47.000000000 +0200 +@@ -298,6 +298,9 @@ + extern char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ + extern bool explicit_remote;/* remote_name specified with remotename opt */ + extern bool demand; /* Do dial-on-demand */ ++extern bool killoldaddr; /* If our IP is reassigned on ++ reconnect, kill active TCP ++ connections using the old IP. */ + extern char *ipparam; /* Extra parameter for ip up/down scripts */ + extern bool cryptpap; /* Others' PAP passwords are encrypted */ + extern int idle_time_limit;/* Shut down link if idle for this long */ +diff -Nur ppp-2.4.5.orig/pppd/sys-linux.c ppp-2.4.5/pppd/sys-linux.c +--- ppp-2.4.5.orig/pppd/sys-linux.c 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/sys-linux.c 2010-08-08 09:43:47.000000000 +0200 +@@ -165,6 +165,10 @@ + + #endif /* INET6 */ + ++#ifndef SIOCKILLADDR ++#define SIOCKILLADDR 0x8939 ++#endif ++ + /* We can get an EIO error on an ioctl if the modem has hung up */ + #define ok_error(num) ((num)==EIO) + +@@ -209,6 +213,7 @@ + static u_int32_t proxy_arp_addr; /* Addr for proxy arp entry added */ + static char proxy_arp_dev[16]; /* Device for proxy arp entry */ + static u_int32_t our_old_addr; /* for detecting address changes */ ++static u_int32_t our_current_addr; + static int dynaddr_set; /* 1 if ip_dynaddr set */ + static int looped; /* 1 if using loop */ + static int link_mtu; /* mtu for the link (not bundle) */ +@@ -537,6 +542,27 @@ + return -1; + } + ++static void do_killaddr(u_int32_t oldaddr) ++{ ++ struct ifreq ifr; ++ ++ memset(&ifr,0,sizeof ifr); ++ ++ SET_SA_FAMILY (ifr.ifr_addr, AF_INET); ++ SET_SA_FAMILY (ifr.ifr_dstaddr, AF_INET); ++ SET_SA_FAMILY (ifr.ifr_netmask, AF_INET); ++ ++ SIN_ADDR(ifr.ifr_addr) = oldaddr; ++ ++ strlcpy(ifr.ifr_name, ifname, sizeof (ifr.ifr_name)); ++ ++ if(ioctl(sock_fd,SIOCKILLADDR,&ifr) < 0) { ++ if (!ok_error (errno)) ++ error("ioctl(SIOCKILLADDR): %m(%d)", errno); ++ return; ++ } ++} ++ + /******************************************************************** + * + * tty_disestablish_ppp - Restore the serial port to normal operation. +@@ -2385,21 +2411,29 @@ + } + } + +- /* set ip_dynaddr in demand mode if address changes */ +- if (demand && tune_kernel && !dynaddr_set +- && our_old_addr && our_old_addr != our_adr) { ++ if(persist && our_old_addr && our_old_addr != our_adr) { ++ ++ if(killoldaddr) ++ do_killaddr(our_old_addr); ++ ++ ++ /* set ip_dynaddr in persist mode if address changes */ ++ if (tune_kernel && !dynaddr_set) { + /* set ip_dynaddr if possible */ + char *path; + int fd; + + path = path_to_procfs("/sys/net/ipv4/ip_dynaddr"); + if (path != 0 && (fd = open(path, O_WRONLY)) >= 0) { +- if (write(fd, "1", 1) != 1) +- error("Couldn't enable dynamic IP addressing: %m"); +- close(fd); ++ if (write(fd, "1", 1) != 1) ++ error("Couldn't enable dynamic IP addressing: %m"); ++ close(fd); + } + dynaddr_set = 1; /* only 1 attempt */ ++ } + } ++ ++ our_current_addr = our_adr; + our_old_addr = 0; + + return 1; +@@ -2455,7 +2489,8 @@ + } + + our_old_addr = our_adr; +- ++ our_current_addr = 0; ++ + return 1; + } + diff --git a/network/connection/ppp/files/gentoo/08_all_wait-children.patch b/network/connection/ppp/files/gentoo/08_all_wait-children.patch new file mode 100644 index 0000000000..3a204ea4ed --- /dev/null +++ b/network/connection/ppp/files/gentoo/08_all_wait-children.patch @@ -0,0 +1,77 @@ +diff -Nur ppp-2.4.5.orig/pppd/main.c ppp-2.4.5/pppd/main.c +--- ppp-2.4.5.orig/pppd/main.c 2010-08-08 09:34:32.000000000 +0200 ++++ ppp-2.4.5/pppd/main.c 2010-08-08 09:46:00.000000000 +0200 +@@ -249,6 +249,7 @@ + static void forget_child __P((int pid, int status)); + static int reap_kids __P((void)); + static void childwait_end __P((void *)); ++static void wait_children __P((void)); + + #ifdef USE_TDB + static void update_db_entry __P((void)); +@@ -580,25 +581,11 @@ + if (!persist) + break; + } ++ ++ wait_children(); + } + +- /* Wait for scripts to finish */ +- reap_kids(); +- if (n_children > 0) { +- if (child_wait > 0) +- TIMEOUT(childwait_end, NULL, child_wait); +- if (debug) { +- struct subprocess *chp; +- dbglog("Waiting for %d child processes...", n_children); +- for (chp = children; chp != NULL; chp = chp->next) +- dbglog(" script %s, pid %d", chp->prog, chp->pid); +- } +- while (n_children > 0 && !childwait_done) { +- handle_events(); +- if (kill_link && !childwait_done) +- childwait_end(NULL); +- } +- } ++ wait_children(); + + die(status); + return 0; +@@ -1794,6 +1781,36 @@ + } + + /* ++ * wait_children - wait for scripts to finish. ++ * if child_wait is 0, wait indefinitely. ++ * else, kill'em all at the end of timeout ++ */ ++static void ++wait_children() ++{ ++ /* Wait for scripts to finish */ ++ reap_kids(); ++ if (n_children > 0) { ++ childwait_done = 0; ++ if (child_wait > 0) ++ TIMEOUT(childwait_end, NULL, child_wait); ++ if (debug) { ++ struct subprocess *chp; ++ dbglog("Waiting for %d child processes...", n_children); ++ for (chp = children; chp != NULL; chp = chp->next) ++ dbglog(" script %s, pid %d", chp->prog, chp->pid); ++ } ++ while (n_children > 0 && !childwait_done) { ++ handle_events(); ++ if (asked_to_quit && !childwait_done) ++ childwait_end(NULL); ++ } ++ if (child_wait > 0) ++ UNTIMEOUT(childwait_end, NULL); ++ } ++} ++ ++/* + * childwait_end - we got fed up waiting for the child processes to + * exit, send them all a SIGTERM. + */ diff --git a/network/connection/ppp/files/gentoo/10_all_defaultgateway.patch b/network/connection/ppp/files/gentoo/10_all_defaultgateway.patch new file mode 100644 index 0000000000..799e852c66 --- /dev/null +++ b/network/connection/ppp/files/gentoo/10_all_defaultgateway.patch @@ -0,0 +1,90 @@ +This patch reverses revision 1.114 of the pppd/sys-linux.c file. +The default gateway is needed by the openswan's %defaultroute. +diff -Nur ppp-2.4.5.orig/pppd/sys-linux.c ppp-2.4.5/pppd/sys-linux.c +--- ppp-2.4.5.orig/pppd/sys-linux.c 2010-08-08 09:44:29.000000000 +0200 ++++ ppp-2.4.5/pppd/sys-linux.c 2010-08-08 09:53:02.000000000 +0200 +@@ -209,7 +209,7 @@ + static unsigned char inbuf[512]; /* buffer for chars read from loopback */ + + static int if_is_up; /* Interface has been marked up */ +-static int have_default_route; /* Gateway for default route added */ ++static u_int32_t default_route_gateway; /* Gateway for default route added */ + static u_int32_t proxy_arp_addr; /* Addr for proxy arp entry added */ + static char proxy_arp_dev[16]; /* Device for proxy arp entry */ + static u_int32_t our_old_addr; /* for detecting address changes */ +@@ -346,8 +346,8 @@ + /* + * Delete any routes through the device. + */ +- if (have_default_route) +- cifdefaultroute(0, 0, 0); ++ if (default_route_gateway != 0) ++ cifdefaultroute(0, 0, default_route_gateway); + + if (has_proxy_arp) + cifproxyarp(0, proxy_arp_addr); +@@ -1639,17 +1639,17 @@ + struct rtentry rt; + + if (defaultroute_exists(&rt) && strcmp(rt.rt_dev, ifname) != 0) { +- if (rt.rt_flags & RTF_GATEWAY) +- error("not replacing existing default route via %I", +- SIN_ADDR(rt.rt_gateway)); +- else +- error("not replacing existing default route through %s", +- rt.rt_dev); ++ u_int32_t old_gateway = SIN_ADDR(rt.rt_gateway); ++ ++ if (old_gateway != gateway) ++ error("not replacing existing default route to %s [%I]", ++ rt.rt_dev, old_gateway); + return 0; + } + +- memset (&rt, 0, sizeof (rt)); +- SET_SA_FAMILY (rt.rt_dst, AF_INET); ++ memset (&rt, '\0', sizeof (rt)); ++ SET_SA_FAMILY (rt.rt_dst, AF_INET); ++ SET_SA_FAMILY (rt.rt_gateway, AF_INET); + + rt.rt_dev = ifname; + +@@ -1658,14 +1658,16 @@ + SIN_ADDR(rt.rt_genmask) = 0L; + } + +- rt.rt_flags = RTF_UP; ++ SIN_ADDR(rt.rt_gateway) = gateway; ++ ++ rt.rt_flags = RTF_UP | RTF_GATEWAY; + if (ioctl(sock_fd, SIOCADDRT, &rt) < 0) { + if ( ! ok_error ( errno )) + error("default route ioctl(SIOCADDRT): %m"); + return 0; + } + +- have_default_route = 1; ++ default_route_gateway = gateway; + return 1; + } + +@@ -1678,7 +1680,7 @@ + { + struct rtentry rt; + +- have_default_route = 0; ++ default_route_gateway = 0; + + memset (&rt, '\0', sizeof (rt)); + SET_SA_FAMILY (rt.rt_dst, AF_INET); +@@ -1691,7 +1693,9 @@ + SIN_ADDR(rt.rt_genmask) = 0L; + } + +- rt.rt_flags = RTF_UP; ++ SIN_ADDR(rt.rt_gateway) = gateway; ++ ++ rt.rt_flags = RTF_UP | RTF_GATEWAY; + if (ioctl(sock_fd, SIOCDELRT, &rt) < 0 && errno != ESRCH) { + if (still_ppp()) { + if ( ! ok_error ( errno )) diff --git a/network/connection/ppp/files/gentoo/12_all_linkpidfile.patch b/network/connection/ppp/files/gentoo/12_all_linkpidfile.patch new file mode 100644 index 0000000000..887597aeef --- /dev/null +++ b/network/connection/ppp/files/gentoo/12_all_linkpidfile.patch @@ -0,0 +1,97 @@ +diff -Nru ppp-2.4.5.orig/pppd/auth.c ppp-2.4.5/pppd/auth.c +--- ppp-2.4.5.orig/pppd/auth.c 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/auth.c 2010-08-08 09:57:01.000000000 +0200 +@@ -637,7 +637,7 @@ + * we delete its pid file. + */ + if (!doing_multilink && !demand) +- remove_pidfiles(); ++ remove_pidfile(pidfilename); + + /* + * If we may want to bring the link up again, transfer +diff -Nru ppp-2.4.5.orig/pppd/main.c ppp-2.4.5/pppd/main.c +--- ppp-2.4.5.orig/pppd/main.c 2010-08-08 09:46:42.000000000 +0200 ++++ ppp-2.4.5/pppd/main.c 2010-08-08 09:57:01.000000000 +0200 +@@ -134,7 +134,7 @@ + + char *progname; /* Name of this program */ + char hostname[MAXNAMELEN]; /* Our hostname */ +-static char pidfilename[MAXPATHLEN]; /* name of pid file */ ++char pidfilename[MAXPATHLEN]; /* name of pid file */ + static char linkpidfile[MAXPATHLEN]; /* name of linkname pid file */ + char ppp_devnam[MAXPATHLEN]; /* name of PPP tty (maybe ttypx) */ + uid_t uid; /* Our real user-id */ +@@ -245,6 +245,7 @@ + static void toggle_debug __P((int)); + static void open_ccp __P((int)); + static void bad_signal __P((int)); ++static void remove_pidfilenames __P((void)); + static void holdoff_end __P((void *)); + static void forget_child __P((int pid, int status)); + static int reap_kids __P((void)); +@@ -835,16 +836,24 @@ + } + + /* +- * remove_pidfile - remove our pid files ++ * remove_pidfile - remove one of the 2 pidfiles (pidfilename or linkpidfile) + */ +-void remove_pidfiles() ++void ++remove_pidfile(filename) ++ char* filename; + { +- if (pidfilename[0] != 0 && unlink(pidfilename) < 0 && errno != ENOENT) +- warn("unable to delete pid file %s: %m", pidfilename); +- pidfilename[0] = 0; +- if (linkpidfile[0] != 0 && unlink(linkpidfile) < 0 && errno != ENOENT) +- warn("unable to delete pid file %s: %m", linkpidfile); +- linkpidfile[0] = 0; ++ if (filename[0] != 0 && unlink(filename) < 0 && errno != ENOENT) ++ warn("unable to delete pid file %s: %m", filename); ++ filename[0] = 0; ++} ++ ++/* ++ * remove_pidfiles - remove our pid files ++ */ ++static void remove_pidfiles() ++{ ++ remove_pidfile(pidfilename); ++ remove_pidfile(linkpidfile); + } + + /* +diff -Nru ppp-2.4.5.orig/pppd/multilink.c ppp-2.4.5/pppd/multilink.c +--- ppp-2.4.5.orig/pppd/multilink.c 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/multilink.c 2010-08-08 09:57:01.000000000 +0200 +@@ -267,7 +267,7 @@ + notice("Connection terminated."); + print_link_stats(); + if (!demand) { +- remove_pidfiles(); ++ remove_pidfile(pidfilename); + script_unsetenv("IFNAME"); + } + +diff -Nru ppp-2.4.5.orig/pppd/pppd.h ppp-2.4.5/pppd/pppd.h +--- ppp-2.4.5.orig/pppd/pppd.h 2010-08-08 09:44:29.000000000 +0200 ++++ ppp-2.4.5/pppd/pppd.h 2010-08-08 09:57:01.000000000 +0200 +@@ -214,6 +214,7 @@ + extern int ifunit; /* Interface unit number */ + extern char ifname[]; /* Interface name */ + extern char hostname[]; /* Our hostname */ ++extern char pidfilename[]; /* name of pid file */ + extern u_char outpacket_buf[]; /* Buffer for outgoing packets */ + extern int devfd; /* fd of underlying device */ + extern int fd_ppp; /* fd for talking PPP */ +@@ -497,7 +498,7 @@ + int ppp_send_config __P((int, int, u_int32_t, int, int)); + int ppp_recv_config __P((int, int, u_int32_t, int, int)); + const char *protocol_name __P((int)); +-void remove_pidfiles __P((void)); ++void remove_pidfile __P((char *)); + void lock_db __P((void)); + void unlock_db __P((void)); + diff --git a/network/connection/ppp/files/gentoo/16_all_auth-fail.patch b/network/connection/ppp/files/gentoo/16_all_auth-fail.patch new file mode 100644 index 0000000000..92487d17e7 --- /dev/null +++ b/network/connection/ppp/files/gentoo/16_all_auth-fail.patch @@ -0,0 +1,141 @@ +diff -Nru ppp-2.4.5.orig/pppd/auth.c ppp-2.4.5/pppd/auth.c +--- ppp-2.4.5.orig/pppd/auth.c 2010-08-08 09:58:19.000000000 +0200 ++++ ppp-2.4.5/pppd/auth.c 2010-08-08 10:06:06.000000000 +0200 +@@ -259,7 +259,7 @@ + struct wordlist **, struct wordlist **, + char *, int)); + static void free_wordlist __P((struct wordlist *)); +-static void auth_script __P((char *)); ++static void auth_script __P((char *, int)); + static void auth_script_done __P((void *)); + static void set_allowed_addrs __P((int, struct wordlist *, struct wordlist *)); + static int some_ip_ok __P((struct wordlist *)); +@@ -690,7 +690,7 @@ + if (auth_script_state == s_up && auth_script_pid == 0) { + update_link_stats(unit); + auth_script_state = s_down; +- auth_script(_PATH_AUTHDOWN); ++ auth_script(_PATH_AUTHDOWN, 0); + } + } + if (!doing_multilink) { +@@ -822,7 +822,7 @@ + auth_state = s_up; + if (auth_script_state == s_down && auth_script_pid == 0) { + auth_script_state = s_up; +- auth_script(_PATH_AUTHUP); ++ auth_script(_PATH_AUTHUP, 0); + } + } + +@@ -923,6 +923,7 @@ + * Authentication failure: take the link down + */ + status = EXIT_PEER_AUTH_FAILED; ++ auth_script(_PATH_AUTHFAIL, 1); + lcp_close(unit, "Authentication failed"); + } + +@@ -1001,6 +1002,7 @@ + * authentication secrets. + */ + status = EXIT_AUTH_TOPEER_FAILED; ++ auth_script(_PATH_AUTHFAIL, 1); + lcp_close(unit, "Failed to authenticate ourselves to peer"); + } + +@@ -1233,6 +1235,8 @@ + if (user[0] == 0 && !explicit_user) + strlcpy(user, our_name, sizeof(user)); + ++ script_setenv("LOCALNAME", user, 0); ++ + /* + * If we have a default route, require the peer to authenticate + * unless the noauth option was given or the real user is root. +@@ -2314,13 +2318,13 @@ + case s_up: + if (auth_state == s_down) { + auth_script_state = s_down; +- auth_script(_PATH_AUTHDOWN); ++ auth_script(_PATH_AUTHDOWN, 0); + } + break; + case s_down: + if (auth_state == s_up) { + auth_script_state = s_up; +- auth_script(_PATH_AUTHUP); ++ auth_script(_PATH_AUTHUP, 0); + } + break; + } +@@ -2331,8 +2335,9 @@ + * interface-name peer-name real-user tty speed + */ + static void +-auth_script(script) ++auth_script(script, wait) + char *script; ++ int wait; + { + char strspeed[32]; + struct passwd *pw; +@@ -2356,5 +2361,8 @@ + argv[5] = strspeed; + argv[6] = NULL; + +- auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); ++ if (wait) ++ run_program(script, argv, 0, NULL, NULL, 1); ++ else ++ auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); + } +diff -Nru ppp-2.4.5.orig/pppd/pathnames.h ppp-2.4.5/pppd/pathnames.h +--- ppp-2.4.5.orig/pppd/pathnames.h 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/pathnames.h 2010-08-08 10:06:06.000000000 +0200 +@@ -27,6 +27,7 @@ + #define _PATH_IPPREUP _ROOT_PATH "/etc/ppp/ip-pre-up" + #define _PATH_AUTHUP _ROOT_PATH "/etc/ppp/auth-up" + #define _PATH_AUTHDOWN _ROOT_PATH "/etc/ppp/auth-down" ++#define _PATH_AUTHFAIL _ROOT_PATH "/etc/ppp/auth-fail" + #define _PATH_TTYOPT _ROOT_PATH "/etc/ppp/options." + #define _PATH_CONNERRS _ROOT_PATH "/etc/ppp/connect-errors" + #define _PATH_PEERFILES _ROOT_PATH "/etc/ppp/peers/" +diff -Nru ppp-2.4.5.orig/pppd/pppd.8 ppp-2.4.5/pppd/pppd.8 +--- ppp-2.4.5.orig/pppd/pppd.8 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/pppd.8 2010-08-08 10:06:06.000000000 +0200 +@@ -1553,8 +1553,8 @@ + Pppd invokes scripts at various stages in its processing which can be + used to perform site-specific ancillary processing. These scripts are + usually shell scripts, but could be executable code files instead. +-Pppd does not wait for the scripts to finish (except for the ip-pre-up +-script). The scripts are ++Pppd does not wait for the scripts to finish (except for the ip-pre-up, ++and auth-fail scripts). The scripts are + executed as root (with the real and effective user-id set to 0), so + that they can do things such as update routing tables or run + privileged daemons. Be careful that the contents of these scripts do +@@ -1582,6 +1582,11 @@ + The authenticated name of the peer. This is only set if the peer + authenticates itself. + .TP ++.B LOCALNAME ++The username passed to the user option of the pppd daemon. This is ++handy to identify which account was used for authentication purposes ++when multiple accounts are available. ++.TP + .B SPEED + The baud rate of the tty device. + .TP +@@ -1634,6 +1639,11 @@ + /etc/ppp/auth\-up was previously executed. It is executed in the same + manner with the same parameters as /etc/ppp/auth\-up. + .TP ++.B /etc/ppp/auth\-fail ++A program or script which is executed should authentication fail. pppd ++waits for this script to finish. It is executed in the same manner, with ++the same parameters as /etc/ppp/auth\-up. ++.TP + .B /etc/ppp/ip\-pre\-up + A program or script which is executed just before the ppp network + interface is brought up. It is executed with the same parameters as diff --git a/network/connection/ppp/files/gentoo/18_all_defaultmetric.patch b/network/connection/ppp/files/gentoo/18_all_defaultmetric.patch new file mode 100644 index 0000000000..c71bf324ba --- /dev/null +++ b/network/connection/ppp/files/gentoo/18_all_defaultmetric.patch @@ -0,0 +1,108 @@ +diff -Nru ppp-2.4.5.orig/pppd/options.c ppp-2.4.5/pppd/options.c +--- ppp-2.4.5.orig/pppd/options.c 2010-08-08 09:44:29.000000000 +0200 ++++ ppp-2.4.5/pppd/options.c 2010-08-08 10:07:50.000000000 +0200 +@@ -94,6 +94,7 @@ + int kdebugflag = 0; /* Tell kernel to print debug messages */ + int default_device = 1; /* Using /dev/tty or equivalent */ + char devnam[MAXPATHLEN]; /* Device name */ ++int defaultmetric = 0; /* Metric of the default route */ + bool nodetach = 0; /* Don't detach from controlling tty */ + bool updetach = 0; /* Detach once link is up */ + int maxconnect = 0; /* Maximum connect time */ +@@ -289,6 +290,10 @@ + "Number of seconds to wait for child processes at exit", + OPT_PRIO }, + ++ { "defaultmetric", o_int, &defaultmetric, ++ "The metric of the default route", ++ OPT_LIMITS, 0, 32766 }, ++ + #ifdef HAVE_MULTILINK + { "multilink", o_bool, &multilink, + "Enable multilink operation", OPT_PRIO | 1 }, +diff -Nru ppp-2.4.5.orig/pppd/pppd.8 ppp-2.4.5/pppd/pppd.8 +--- ppp-2.4.5.orig/pppd/pppd.8 2010-08-08 10:06:57.000000000 +0200 ++++ ppp-2.4.5/pppd/pppd.8 2010-08-08 10:07:50.000000000 +0200 +@@ -121,6 +121,9 @@ + This entry is removed when the PPP connection is broken. This option + is privileged if the \fInodefaultroute\fR option has been specified. + .TP ++.B defaultmetric \fIn ++The metric of the default route configured by pppd; default is 0. ++.TP + .B disconnect \fIscript + Execute the command specified by \fIscript\fR, by passing it to a + shell, after +diff -Nru ppp-2.4.5.orig/pppd/pppd.h ppp-2.4.5/pppd/pppd.h +--- ppp-2.4.5.orig/pppd/pppd.h 2010-08-08 09:58:19.000000000 +0200 ++++ ppp-2.4.5/pppd/pppd.h 2010-08-08 10:07:50.000000000 +0200 +@@ -276,6 +276,7 @@ + extern int kdebugflag; /* Tell kernel to print debug messages */ + extern int default_device; /* Using /dev/tty or equivalent */ + extern char devnam[MAXPATHLEN]; /* Device name */ ++extern int defaultmetric; /* Metric of the default route */ + extern int crtscts; /* Use hardware flow control */ + extern bool modem; /* Use modem control lines */ + extern int inspeed; /* Input/Output speed requested */ +diff -Nru ppp-2.4.5.orig/pppd/sys-linux.c ppp-2.4.5/pppd/sys-linux.c +--- ppp-2.4.5.orig/pppd/sys-linux.c 2010-08-08 09:53:56.000000000 +0200 ++++ ppp-2.4.5/pppd/sys-linux.c 2010-08-08 10:07:50.000000000 +0200 +@@ -1465,7 +1465,7 @@ + FILE *route_fd = (FILE *) 0; + static char route_buffer[512]; + static int route_dev_col, route_dest_col, route_gw_col; +-static int route_flags_col, route_mask_col; ++static int route_flags_col, route_mask_col, route_metric_col; + static int route_num_cols; + + static int open_route_table (void); +@@ -1508,6 +1508,7 @@ + route_dest_col = 1; + route_gw_col = 2; + route_flags_col = 3; ++ route_metric_col = 6; + route_mask_col = 7; + route_num_cols = 8; + +@@ -1527,6 +1528,8 @@ + route_gw_col = col; + else if (strcasecmp(q, "flags") == 0) + route_flags_col = col; ++ else if (strcasecmp(q, "metric") == 0) ++ route_metric_col = col; + else if (strcasecmp(q, "mask") == 0) + route_mask_col = col; + else +@@ -1569,6 +1572,7 @@ + + rt->rt_flags = (short) strtoul(cols[route_flags_col], NULL, 16); + rt->rt_dev = cols[route_dev_col]; ++ rt->rt_metric = (short) strtoul(cols[route_metric_col], NULL, 16); + + return 1; + } +@@ -1591,6 +1595,8 @@ + + if (kernel_version > KVERSION(2,1,0) && SIN_ADDR(rt->rt_genmask) != 0) + continue; ++ if (rt->rt_metric != defaultmetric) /* consider only routes with the same metric */ ++ continue; + if (SIN_ADDR(rt->rt_dst) == 0L) { + result = 1; + break; +@@ -1661,6 +1667,7 @@ + SIN_ADDR(rt.rt_gateway) = gateway; + + rt.rt_flags = RTF_UP | RTF_GATEWAY; ++ rt.rt_metric = defaultmetric + 1; /* +1 for binary compatibility */ + if (ioctl(sock_fd, SIOCADDRT, &rt) < 0) { + if ( ! ok_error ( errno )) + error("default route ioctl(SIOCADDRT): %m"); +@@ -1696,6 +1703,7 @@ + SIN_ADDR(rt.rt_gateway) = gateway; + + rt.rt_flags = RTF_UP | RTF_GATEWAY; ++ rt.rt_metric = defaultmetric + 1; /* +1 for binary compatibility */ + if (ioctl(sock_fd, SIOCDELRT, &rt) < 0 && errno != ESRCH) { + if (still_ppp()) { + if ( ! ok_error ( errno )) diff --git a/network/connection/ppp/files/gentoo/20_all_dev-ppp.patch b/network/connection/ppp/files/gentoo/20_all_dev-ppp.patch new file mode 100644 index 0000000000..eff3e37f08 --- /dev/null +++ b/network/connection/ppp/files/gentoo/20_all_dev-ppp.patch @@ -0,0 +1,20 @@ +--- ppp-2.4.6/pppd/sys-linux.c ++++ ppp-2.4.6/pppd/sys-linux.c +@@ -2031,6 +2031,17 @@ + kernel_version = KVERSION(osmaj, osmin, ospatch); + + fd = open("/dev/ppp", O_RDWR); ++ if (fd < 0) { ++ /* try making it and see if that helps. */ ++ if (errno == ENOENT && mknod("/dev/ppp", S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP, ++ makedev(108, 0)) >= 0) { ++ fd = open("/dev/ppp", O_RDWR); ++ if (fd >= 0) ++ info("Created /dev/ppp device node"); ++ else ++ unlink("/dev/ppp"); /* didn't work, undo the mknod */ ++ } ++ } + if (fd >= 0) { + new_style_driver = 1; + diff --git a/network/connection/ppp/files/gentoo/24_all_passwordfd-read-early.patch b/network/connection/ppp/files/gentoo/24_all_passwordfd-read-early.patch new file mode 100644 index 0000000000..f64f09366f --- /dev/null +++ b/network/connection/ppp/files/gentoo/24_all_passwordfd-read-early.patch @@ -0,0 +1,85 @@ +diff -Nru ppp-2.4.5.orig/pppd/plugins/passwordfd.c ppp-2.4.5/pppd/plugins/passwordfd.c +--- ppp-2.4.5.orig/pppd/plugins/passwordfd.c 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/plugins/passwordfd.c 2010-08-08 10:41:39.000000000 +0200 +@@ -16,11 +16,11 @@ + + char pppd_version[] = VERSION; + +-static int passwdfd = -1; + static char save_passwd[MAXSECRETLEN]; + ++static int readpassword __P((char **)); + static option_t options[] = { +- { "passwordfd", o_int, &passwdfd, ++ { "passwordfd", o_special, (void *)readpassword, + "Receive password on this file descriptor" }, + { NULL } + }; +@@ -30,43 +30,39 @@ + return 1; + } + +-static int pwfd_passwd (char *user, char *passwd) ++static int readpassword(char **argv) + { +- int readgood, red; +- +- if (passwdfd == -1) +- return -1; +- +- if (passwd == NULL) +- return 1; +- +- if (passwdfd == -2) { +- strcpy (passwd, save_passwd); +- return 1; ++ char *arg = *argv; ++ int passwdfd = -1; ++ int chunk, len; ++ ++ if (sscanf(arg, "%d", &passwdfd) != 1 || passwdfd < 0) ++ { ++ error ("\"%s\" is not a valid file descriptor number", arg); ++ return 0; + } + +- readgood = 0; ++ len = 0; + do { +- red = read (passwdfd, passwd + readgood, MAXSECRETLEN - 1 - readgood); +- if (red == 0) +- break; +- if (red < 0) { +- error ("Can't read secret from fd\n"); +- readgood = -1; ++ chunk = read (passwdfd, save_passwd + len, MAXSECRETLEN - 1 - len); ++ if (chunk == 0) + break; ++ if (chunk < 0) { ++ error ("Can't read secret from fd %d", passwdfd); ++ return 0; + } +- readgood += red; +- } while (readgood < MAXSECRETLEN - 1); +- ++ len += chunk; ++ } while (len < MAXSECRETLEN - 1); ++ save_passwd[len] = 0; + close (passwdfd); + +- if (readgood < 0) +- return 0; +- +- passwd[readgood] = 0; +- strcpy (save_passwd, passwd); +- passwdfd = -2; ++ return 1; ++} + ++static int pwfd_passwd (char *user, char *passwd) ++{ ++ if (passwd != NULL) ++ strcpy (passwd, save_passwd); + return 1; + } + diff --git a/network/connection/ppp/files/gentoo/26_all_pppd-usepeerwins.patch b/network/connection/ppp/files/gentoo/26_all_pppd-usepeerwins.patch new file mode 100644 index 0000000000..d66fbe0b1c --- /dev/null +++ b/network/connection/ppp/files/gentoo/26_all_pppd-usepeerwins.patch @@ -0,0 +1,256 @@ +--- ppp-2.4.6/pppd/ipcp.c ++++ ppp-2.4.6/pppd/ipcp.c +@@ -91,6 +91,7 @@ + static int default_route_set[NUM_PPP]; /* Have set up a default route */ + static int proxy_arp_set[NUM_PPP]; /* Have created proxy arp entry */ + static bool usepeerdns; /* Ask peer for DNS addrs */ ++static bool usepeerwins; /* Ask peer for WINS addrs */ + static int ipcp_is_up; /* have called np_up() */ + static int ipcp_is_open; /* haven't called np_finished() */ + static bool ask_for_local; /* request our address from peer */ +@@ -210,6 +211,9 @@ + { "usepeerdns", o_bool, &usepeerdns, + "Ask peer for DNS address(es)", 1 }, + ++ { "usepeerwins", o_bool, &usepeerwins, ++ "Ask peer for WINS address(es)", 1 }, ++ + { "netmask", o_special, (void *)setnetmask, + "set netmask", OPT_PRIO | OPT_A2STRVAL | OPT_STATIC, netmask_str }, + +@@ -703,6 +707,8 @@ + wo->accept_remote = 1; + wo->req_dns1 = usepeerdns; /* Request DNS addresses from the peer */ + wo->req_dns2 = usepeerdns; ++ wo->req_wins1 = usepeerwins; /* Request WINS addresses from the peer */ ++ wo->req_wins2 = usepeerwins; + *go = *wo; + if (!ask_for_local) + go->ouraddr = 0; +@@ -755,8 +761,8 @@ + LENCIADDR(go->neg_addr) + + LENCIDNS(go->req_dns1) + + LENCIDNS(go->req_dns2) + +- LENCIWINS(go->winsaddr[0]) + +- LENCIWINS(go->winsaddr[1])) ; ++ LENCIWINS(go->req_wins1) + ++ LENCIWINS(go->req_wins2)) ; + } + + +@@ -830,8 +836,8 @@ + neg = 0; \ + } + +-#define ADDCIWINS(opt, addr) \ +- if (addr) { \ ++#define ADDCIWINS(opt, neg, addr) \ ++ if (neg) { \ + if (len >= CILEN_ADDR) { \ + u_int32_t l; \ + PUTCHAR(opt, ucp); \ +@@ -840,7 +846,7 @@ + PUTLONG(l, ucp); \ + len -= CILEN_ADDR; \ + } else \ +- addr = 0; \ ++ neg = 0; \ + } + + ADDCIADDRS(CI_ADDRS, !go->neg_addr && go->old_addrs, go->ouraddr, +@@ -855,9 +861,9 @@ + + ADDCIDNS(CI_MS_DNS2, go->req_dns2, go->dnsaddr[1]); + +- ADDCIWINS(CI_MS_WINS1, go->winsaddr[0]); ++ ADDCIWINS(CI_MS_WINS1, go->req_wins1, go->winsaddr[0]); + +- ADDCIWINS(CI_MS_WINS2, go->winsaddr[1]); ++ ADDCIWINS(CI_MS_WINS2, go->req_wins2, go->winsaddr[1]); + + *lenp -= len; + } +@@ -962,8 +968,8 @@ + goto bad; \ + } + +-#define ACKCIWINS(opt, addr) \ +- if (addr) { \ ++#define ACKCIWINS(opt, neg, addr) \ ++ if (neg) { \ + u_int32_t l; \ + if ((len -= CILEN_ADDR) < 0) \ + goto bad; \ +@@ -989,9 +995,9 @@ + + ACKCIDNS(CI_MS_DNS2, go->req_dns2, go->dnsaddr[1]); + +- ACKCIWINS(CI_MS_WINS1, go->winsaddr[0]); ++ ACKCIWINS(CI_MS_WINS1, go->req_wins1, go->winsaddr[0]); + +- ACKCIWINS(CI_MS_WINS2, go->winsaddr[1]); ++ ACKCIWINS(CI_MS_WINS2, go->req_wins2, go->winsaddr[1]); + + /* + * If there are any remaining CIs, then this packet is bad. +@@ -1026,7 +1032,7 @@ + u_char cimaxslotindex, cicflag; + u_char citype, cilen, *next; + u_short cishort; +- u_int32_t ciaddr1, ciaddr2, l, cidnsaddr; ++ u_int32_t ciaddr1, ciaddr2, l, cidnsaddr, ciwinsaddr; + ipcp_options no; /* options we've seen Naks for */ + ipcp_options try; /* options to request next time */ + +@@ -1091,6 +1097,19 @@ + code \ + } + ++#define NAKCIWINS(opt, neg, code) \ ++ if (go->neg && \ ++ ((cilen = p[1]) == CILEN_ADDR) && \ ++ len >= cilen && \ ++ p[0] == opt) { \ ++ len -= cilen; \ ++ INCPTR(2, p); \ ++ GETLONG(l, p); \ ++ ciwinsaddr = htonl(l); \ ++ no.neg = 1; \ ++ code \ ++ } ++ + /* + * Accept the peer's idea of {our,his} address, if different + * from our idea, only if the accept_{local,remote} flag is set. +@@ -1167,6 +1186,22 @@ + } + ); + ++ NAKCIWINS(CI_MS_WINS1, req_wins1, ++ if (treat_as_reject) { ++ try.req_wins1 = 0; ++ } else { ++ try.winsaddr[0] = ciwinsaddr; ++ } ++ ); ++ ++ NAKCIWINS(CI_MS_WINS2, req_wins2, ++ if (treat_as_reject) { ++ try.req_wins2 = 0; ++ } else { ++ try.winsaddr[1] = ciwinsaddr; ++ } ++ ); ++ + /* + * There may be remaining CIs, if the peer is requesting negotiation + * on an option that we didn't include in our request packet. +@@ -1259,7 +1294,6 @@ + return 0; + } + +- + /* + * ipcp_rejci - Reject some of our CIs. + * Callback from fsm_rconfnakrej. +@@ -1357,8 +1391,8 @@ + try.neg = 0; \ + } + +-#define REJCIWINS(opt, addr) \ +- if (addr && \ ++#define REJCIWINS(opt, neg, addr) \ ++ if (go->neg && \ + ((cilen = p[1]) == CILEN_ADDR) && \ + len >= cilen && \ + p[0] == opt) { \ +@@ -1370,7 +1404,7 @@ + /* Check rejected value. */ \ + if (cilong != addr) \ + goto bad; \ +- try.winsaddr[opt == CI_MS_WINS2] = 0; \ ++ try.neg = 0; \ + } + + REJCIADDRS(CI_ADDRS, !go->neg_addr && go->old_addrs, +@@ -1385,9 +1419,9 @@ + + REJCIDNS(CI_MS_DNS2, req_dns2, go->dnsaddr[1]); + +- REJCIWINS(CI_MS_WINS1, go->winsaddr[0]); ++ REJCIWINS(CI_MS_WINS1, req_wins1, go->winsaddr[0]); + +- REJCIWINS(CI_MS_WINS2, go->winsaddr[1]); ++ REJCIWINS(CI_MS_WINS2, req_wins2, go->winsaddr[1]); + + /* + * If there are any remaining CIs, then this packet is bad. +@@ -1581,7 +1615,7 @@ + /* Microsoft primary or secondary WINS request */ + d = citype == CI_MS_WINS2; + +- /* If we do not have a DNS address then we cannot send it */ ++ /* If we do not have a WINS address then we cannot send it */ + if (ao->winsaddr[d] == 0 || + cilen != CILEN_ADDR) { /* Check CI length */ + orc = CONFREJ; /* Reject CI */ +@@ -1830,6 +1864,13 @@ + create_resolv(go->dnsaddr[0], go->dnsaddr[1]); + } + ++ if (go->winsaddr[0]) ++ script_setenv("WINS1", ip_ntoa(go->winsaddr[0]), 0); ++ if (go->winsaddr[1]) ++ script_setenv("WINS2", ip_ntoa(go->winsaddr[1]), 0); ++ if (usepeerwins && (go->winsaddr[0] || go->winsaddr[1])) ++ script_setenv("USEPEERWINS", "1", 0); ++ + /* + * Check that the peer is allowed to use the IP address it wants. + */ +--- ppp-2.4.6/pppd/ipcp.h ++++ ppp-2.4.6/pppd/ipcp.h +@@ -77,6 +77,8 @@ + bool accept_remote; /* accept peer's value for hisaddr */ + bool req_dns1; /* Ask peer to send primary DNS address? */ + bool req_dns2; /* Ask peer to send secondary DNS address? */ ++ bool req_wins1; /* Ask peer to send primary WINS address? */ ++ bool req_wins2; /* Ask peer to send secondary WINS address? */ + int vj_protocol; /* protocol value to use in VJ option */ + int maxslotindex; /* values for RFC1332 VJ compression neg. */ + bool cflag; +--- ppp-2.4.6/pppd/pppd.8 ++++ ppp-2.4.6/pppd/pppd.8 +@@ -1102,6 +1102,16 @@ + /etc/ppp/resolv.conf file containing one or two nameserver lines with + the address(es) supplied by the peer. + .TP ++.B usepeerwins ++Ask the peer for up to 2 WINS server addresses. The addresses supplied ++by the peer (if any) are passed to the /etc/ppp/ip\-up script in the ++environment variables WINS1 and WINS2, and the environment variable ++USEPEERWINS will be set to 1. ++.LP ++Please note that some modems (like the Huawei E220) requires this option in ++order to avoid a race condition that results in the incorrect DNS servers ++being assigned. ++.TP + .B user \fIname + Sets the name used for authenticating the local system to the peer to + \fIname\fR. +@@ -1650,6 +1660,15 @@ + If the peer supplies DNS server addresses, this variable is set to the + second DNS server address supplied (whether or not the usepeerdns + option was given). ++.TP ++.B WINS1 ++If the peer supplies WINS server addresses, this variable is set to the ++first WINS server address supplied. ++.TP ++.B WINS2 ++If the peer supplies WINS server addresses, this variable is set to the ++second WINS server address supplied. ++.P + .P + Pppd invokes the following scripts, if they exist. It is not an error + if they don't exist. diff --git a/network/connection/ppp/files/gentoo/28_all_connect-errors.patch b/network/connection/ppp/files/gentoo/28_all_connect-errors.patch new file mode 100644 index 0000000000..f3b7b18cb6 --- /dev/null +++ b/network/connection/ppp/files/gentoo/28_all_connect-errors.patch @@ -0,0 +1,12 @@ +diff -Nru ppp-2.4.5.orig/pppd/pathnames.h ppp-2.4.5/pppd/pathnames.h +--- ppp-2.4.5.orig/pppd/pathnames.h 2010-08-08 10:06:57.000000000 +0200 ++++ ppp-2.4.5/pppd/pathnames.h 2010-08-08 10:53:51.000000000 +0200 +@@ -29,7 +29,7 @@ + #define _PATH_AUTHDOWN _ROOT_PATH "/etc/ppp/auth-down" + #define _PATH_AUTHFAIL _ROOT_PATH "/etc/ppp/auth-fail" + #define _PATH_TTYOPT _ROOT_PATH "/etc/ppp/options." +-#define _PATH_CONNERRS _ROOT_PATH "/etc/ppp/connect-errors" ++#define _PATH_CONNERRS _ROOT_PATH "/var/log/ppp-connect-errors" + #define _PATH_PEERFILES _ROOT_PATH "/etc/ppp/peers/" + #define _PATH_RESOLV _ROOT_PATH "/etc/ppp/resolv.conf" + diff --git a/network/connection/ppp/files/gentoo/30_all_Makefile.patch b/network/connection/ppp/files/gentoo/30_all_Makefile.patch new file mode 100644 index 0000000000..e3a406240e --- /dev/null +++ b/network/connection/ppp/files/gentoo/30_all_Makefile.patch @@ -0,0 +1,37 @@ +Ensure that the build process aborts if there is an error in one of +the plugin subdirectories. + +2010-09-01 Martin von Gagern + +References: +http://bugs.gentoo.org/334727 + +Index: ppp-2.4.5/pppd/plugins/Makefile.linux +=================================================================== +--- ppp-2.4.5.orig/pppd/plugins/Makefile.linux ++++ ppp-2.4.5/pppd/plugins/Makefile.linux +@@ -20,7 +20,7 @@ include .depend + endif + + all: $(PLUGINS) +- for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done ++ for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all || exit $?; done + + %.so: %.c + $(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^ +@@ -30,12 +30,12 @@ VERSION = $(shell awk -F '"' '/VERSION/ + install: $(PLUGINS) + $(INSTALL) -d $(LIBDIR) + $(INSTALL) $? $(LIBDIR) +- for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d install; done ++ for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d install || exit $?; done + + clean: + rm -f *.o *.so *.a +- for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d clean; done ++ for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d clean || exit $?; done + + depend: + $(CPP) -M $(CFLAGS) *.c >.depend +- for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d depend; done ++ for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d depend || exit $?; done diff --git a/network/connection/ppp/files/gentoo/32_all_pado-timeout.patch b/network/connection/ppp/files/gentoo/32_all_pado-timeout.patch new file mode 100644 index 0000000000..72f1adbb1e --- /dev/null +++ b/network/connection/ppp/files/gentoo/32_all_pado-timeout.patch @@ -0,0 +1,254 @@ +--- ppp-2.4.6/pppd/plugins/rp-pppoe/discovery.c ++++ ppp-2.4.6/pppd/plugins/rp-pppoe/discovery.c +@@ -39,6 +39,7 @@ + #endif + + #include ++#include + + /* Calculate time remaining until *exp, return 0 if now >= *exp */ + static int time_left(struct timeval *diff, struct timeval *exp) +@@ -251,6 +252,80 @@ + } + + /*********************************************************************** ++*%FUNCTION: recvPacketForMe ++*%ARGUMENTS: ++* packet -- output parameter ++* len -- output parameter length ++* conn -- connection ++* start -- operation startup timestamp ++* timeout -- how long to wait (in seconds) ++*%RETURNS: ++* -1: error ++* 0: timed out ++* 1: packet received ++*%DESCRIPTION: ++* receive and filter junk packets ++***********************************************************************/ ++ ++static int ++recvPacketForMe(PPPoEPacket *packet, int *len, PPPoEConnection *conn, time_t start, int timeout) ++{ ++ fd_set readable; ++ int r; ++ struct timeval tv; ++ time_t now; ++ int time_remain; ++ ++ do { ++ time(&now); ++ time_remain = timeout - (int)difftime(now, start); ++ if (time_remain <= 0) return 0; /* Timed out */ ++ ++ if (BPF_BUFFER_IS_EMPTY) { ++ tv.tv_sec = time_remain; ++ tv.tv_usec = 0; ++ ++ FD_ZERO(&readable); ++ FD_SET(conn->discoverySocket, &readable); ++ ++ r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv); ++ if (r < 0) ++ { ++ if (errno == EINTR) ++ { ++ continue; /* interrupted, so retry */ ++ }else ++ { ++ error("pppoe: recvPacketForMe: select: %m"); ++ return -1; ++ } ++ } ++ ++ if (r == 0) return 0; /* Timed out */ ++ } ++ ++ /* Get the packet */ ++ receivePacket(conn->discoverySocket, packet, len); ++ ++ /* Check length */ ++ if (ntohs(packet->length) + HDR_SIZE > *len) { ++ error("Bogus PPPoE length field (%u)", ++ (unsigned int) ntohs(packet->length)); ++ continue; ++ } ++ ++#ifdef USE_BPF ++ /* If it's not a Discovery packet, loop again */ ++ if (etherType(&packet) != Eth_PPPOE_Discovery) continue; ++#endif ++ /* If it's not for us, loop again */ ++ }while ( ! packetIsForMe(conn, packet)); ++ ++ return 1; ++} ++ ++ ++/*********************************************************************** + *%FUNCTION: sendPADI + *%ARGUMENTS: + * conn -- PPPoEConnection structure +@@ -344,13 +419,12 @@ + void + waitForPADO(PPPoEConnection *conn, int timeout) + { +- fd_set readable; + int r; +- struct timeval tv; + struct timeval expire_at; + + PPPoEPacket packet; + int len; ++ time_t start; + + struct PacketCriteria pc; + pc.conn = conn; +@@ -367,43 +441,10 @@ + } + expire_at.tv_sec += timeout; + ++ time(&start); + do { +- if (BPF_BUFFER_IS_EMPTY) { +- if (!time_left(&tv, &expire_at)) +- return; /* Timed out */ +- +- FD_ZERO(&readable); +- FD_SET(conn->discoverySocket, &readable); +- +- while(1) { +- r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv); +- if (r >= 0 || errno != EINTR) break; +- } +- if (r < 0) { +- error("select (waitForPADO): %m"); +- return; +- } +- if (r == 0) +- return; /* Timed out */ +- } +- +- /* Get the packet */ +- receivePacket(conn->discoverySocket, &packet, &len); +- +- /* Check length */ +- if (ntohs(packet.length) + HDR_SIZE > len) { +- error("Bogus PPPoE length field (%u)", +- (unsigned int) ntohs(packet.length)); +- continue; +- } +- +-#ifdef USE_BPF +- /* If it's not a Discovery packet, loop again */ +- if (etherType(&packet) != Eth_PPPOE_Discovery) continue; +-#endif +- +- /* If it's not for us, loop again */ +- if (!packetIsForMe(conn, &packet)) continue; ++ r = recvPacketForMe(&packet, &len, conn, start, timeout); ++ if (r<=0) return; /* Timed out or error */ + + if (packet.code == CODE_PADO) { + if (NOT_UNICAST(packet.ethHdr.h_source)) { +@@ -537,13 +578,12 @@ + static void + waitForPADS(PPPoEConnection *conn, int timeout) + { +- fd_set readable; + int r; +- struct timeval tv; + struct timeval expire_at; + + PPPoEPacket packet; + int len; ++ time_t start; + + if (gettimeofday(&expire_at, NULL) < 0) { + error("gettimeofday (waitForPADS): %m"); +@@ -551,48 +591,15 @@ + } + expire_at.tv_sec += timeout; + ++ time(&start); + conn->error = 0; + do { +- if (BPF_BUFFER_IS_EMPTY) { +- if (!time_left(&tv, &expire_at)) +- return; /* Timed out */ +- +- FD_ZERO(&readable); +- FD_SET(conn->discoverySocket, &readable); +- +- while(1) { +- r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv); +- if (r >= 0 || errno != EINTR) break; +- } +- if (r < 0) { +- error("select (waitForPADS): %m"); +- return; +- } +- if (r == 0) +- return; /* Timed out */ +- } +- +- /* Get the packet */ +- receivePacket(conn->discoverySocket, &packet, &len); +- +- /* Check length */ +- if (ntohs(packet.length) + HDR_SIZE > len) { +- error("Bogus PPPoE length field (%u)", +- (unsigned int) ntohs(packet.length)); +- continue; +- } +- +-#ifdef USE_BPF +- /* If it's not a Discovery packet, loop again */ +- if (etherType(&packet) != Eth_PPPOE_Discovery) continue; +-#endif ++ r = recvPacketForMe(&packet, &len, conn, start, timeout); ++ if (r<=0) return; /* Timed out or error */ + + /* If it's not from the AC, it's not for me */ + if (memcmp(packet.ethHdr.h_source, conn->peerEth, ETH_ALEN)) continue; + +- /* If it's not for us, loop again */ +- if (!packetIsForMe(conn, &packet)) continue; +- + /* Is it PADS? */ + if (packet.code == CODE_PADS) { + /* Parse for goodies */ +--- ppp-2.4.6/pppd/plugins/rp-pppoe/pppoe-discovery.c ++++ ppp-2.4.6/pppd/plugins/rp-pppoe/pppoe-discovery.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include "pppoe.h" + +@@ -513,6 +514,8 @@ + struct timeval tv; + PPPoEPacket packet; + int len; ++ time_t start, now; ++ int time_remain; + + struct PacketCriteria pc; + pc.conn = conn; +@@ -522,9 +525,13 @@ + pc.seenServiceName = 0; + conn->error = 0; + ++ time(&start); + do { ++ time(&now); ++ time_remain = timeout - (int)difftime(now, start); ++ if (time_remain <= 0) return; /* Timed out */ + if (BPF_BUFFER_IS_EMPTY) { +- tv.tv_sec = timeout; ++ tv.tv_sec = time_remain; + tv.tv_usec = 0; + + FD_ZERO(&readable); diff --git a/network/connection/ppp/files/gentoo/34_all_lcp-echo-adaptive.patch b/network/connection/ppp/files/gentoo/34_all_lcp-echo-adaptive.patch new file mode 100644 index 0000000000..b1549deb38 --- /dev/null +++ b/network/connection/ppp/files/gentoo/34_all_lcp-echo-adaptive.patch @@ -0,0 +1,58 @@ +diff -Nru ppp-2.4.5.orig/pppd/lcp.c ppp-2.4.5/pppd/lcp.c +--- ppp-2.4.5.orig/pppd/lcp.c 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/lcp.c 2010-11-27 10:46:26.000000000 +0100 +@@ -73,6 +73,7 @@ + */ + int lcp_echo_interval = 0; /* Interval between LCP echo-requests */ + int lcp_echo_fails = 0; /* Tolerance to unanswered echo-requests */ ++bool lcp_echo_adaptive = 0; /* request echo only if the link was idle */ + bool lax_recv = 0; /* accept control chars in asyncmap */ + bool noendpoint = 0; /* don't send/accept endpoint discriminator */ + +@@ -151,6 +152,8 @@ + OPT_PRIO }, + { "lcp-echo-interval", o_int, &lcp_echo_interval, + "Set time in seconds between LCP echo requests", OPT_PRIO }, ++ { "lcp-echo-adaptive", o_bool, &lcp_echo_adaptive, ++ "Suppress LCP echo requests if traffic was received", 1 }, + { "lcp-restart", o_int, &lcp_fsm[0].timeouttime, + "Set time in seconds between LCP retransmissions", OPT_PRIO }, + { "lcp-max-terminate", o_int, &lcp_fsm[0].maxtermtransmits, +@@ -2322,6 +2325,22 @@ + } + + /* ++ * If adaptive echos have been enabled, only send the echo request if ++ * no traffic was received since the last one. ++ */ ++ if (lcp_echo_adaptive) { ++ static unsigned int last_pkts_in = 0; ++ ++ update_link_stats(f->unit); ++ link_stats_valid = 0; ++ ++ if (link_stats.pkts_in != last_pkts_in) { ++ last_pkts_in = link_stats.pkts_in; ++ return; ++ } ++ } ++ ++ /* + * Make and send the echo request frame. + */ + if (f->state == OPENED) { +diff -Nru ppp-2.4.5.orig/pppd/pppd.8 ppp-2.4.5/pppd/pppd.8 +--- ppp-2.4.5.orig/pppd/pppd.8 2009-11-16 23:26:07.000000000 +0100 ++++ ppp-2.4.5/pppd/pppd.8 2010-11-27 10:44:58.000000000 +0100 +@@ -549,6 +549,11 @@ + dynamic IP address option (i.e. set /proc/sys/net/ipv4/ip_dynaddr to + 1) in demand mode if the local address changes. + .TP ++.B lcp\-echo\-adaptive ++If this option is used with the \fIlcp\-echo\-failure\fR option then ++pppd will send LCP echo\-request frames only if no traffic was received ++from the peer since the last echo\-request was sent. ++.TP + .B lcp\-echo\-failure \fIn + If this option is given, pppd will presume the peer to be dead + if \fIn\fR LCP echo\-requests are sent without receiving a valid LCP diff --git a/network/connection/ppp/files/gentoo/80_all_eaptls-mppe-0.994-gentoo.patch b/network/connection/ppp/files/gentoo/80_all_eaptls-mppe-0.994-gentoo.patch new file mode 100644 index 0000000000..3735e0c264 --- /dev/null +++ b/network/connection/ppp/files/gentoo/80_all_eaptls-mppe-0.994-gentoo.patch @@ -0,0 +1,2898 @@ +Taken from http://www.nikhef.nl/~janjust/ppp/ and modified to fit for +ppp-2.4.6 + +--- ppp-2.4.6/etc.ppp/eaptls-client ++++ ppp-2.4.6/etc.ppp/eaptls-client +@@ -0,0 +1,10 @@ ++# Parameters for authentication using EAP-TLS (client) ++ ++# client name (can be *) ++# server name (can be *) ++# client certificate file (required) ++# server certificate file (optional, if unused put '-') ++# CA certificate file (required) ++# client private key file (required) ++ ++#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key +--- ppp-2.4.6/etc.ppp/eaptls-server ++++ ppp-2.4.6/etc.ppp/eaptls-server +@@ -0,0 +1,11 @@ ++# Parameters for authentication using EAP-TLS (server) ++ ++# client name (can be *) ++# server name (can be *) ++# client certificate file (optional, if unused put '-') ++# server certificate file (required) ++# CA certificate file (required) ++# server private key file (required) ++# allowed addresses (required, can be *) ++ ++#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 +--- ppp-2.4.6/etc.ppp/openssl.cnf ++++ ppp-2.4.6/etc.ppp/openssl.cnf +@@ -0,0 +1,14 @@ ++openssl_conf = openssl_def ++ ++[ openssl_def ] ++engines = engine_section ++ ++[ engine_section ] ++pkcs11 = pkcs11_section ++ ++[ pkcs11_section ] ++engine_id = pkcs11 ++dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so ++MODULE_PATH = /usr/lib64/libeTPkcs11.so ++init = 0 ++ +--- ppp-2.4.6/linux/Makefile.top ++++ ppp-2.4.6/linux/Makefile.top +@@ -26,7 +26,7 @@ + cd pppdump; $(MAKE) $(MFLAGS) install + + install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ +- $(ETCDIR)/chap-secrets ++ $(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client + + install-devel: + cd pppd; $(MAKE) $(MFLAGS) install-devel +@@ -37,6 +37,10 @@ + $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ + $(ETCDIR)/chap-secrets: + $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ ++$(ETCDIR)/eaptls-server: ++ $(INSTALL) -c -m 600 etc.ppp/eaptls-server $@ ++$(ETCDIR)/eaptls-client: ++ $(INSTALL) -c -m 600 etc.ppp/eaptls-client $@ + + $(BINDIR): + $(INSTALL) -d -m 755 $@ +--- ppp-2.4.6/pppd/auth.c ++++ ppp-2.4.6/pppd/auth.c +@@ -109,6 +109,9 @@ + #include "upap.h" + #include "chap-new.h" + #include "eap.h" ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#endif + #ifdef CBCP_SUPPORT + #include "cbcp.h" + #endif +@@ -183,6 +186,11 @@ + /* Hook for a plugin to get the CHAP password for authenticating us */ + int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; + ++#ifdef USE_EAPTLS ++/* Hook for a plugin to get the EAP-TLS password for authenticating us */ ++int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL; ++#endif ++ + /* Hook for a plugin to say whether it is OK if the peer + refuses to authenticate. */ + int (*null_auth_hook) __P((struct wordlist **paddrs, +@@ -238,6 +246,13 @@ + bool explicit_user = 0; /* Set if "user" option supplied */ + bool explicit_passwd = 0; /* Set if "password" option supplied */ + char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ ++#ifdef USE_EAPTLS ++char *cacert_file = NULL; /* CA certificate file (pem format) */ ++char *cert_file = NULL; /* client certificate file (pem format) */ ++char *privkey_file = NULL; /* client private key file (pem format) */ ++char *crl_dir = NULL; /* directory containing CRL files */ ++bool need_peer_eap = 0; /* Require peer to authenticate us */ ++#endif + + static char *uafname; /* name of most recent +ua file */ + +@@ -254,6 +269,19 @@ + static int have_chap_secret __P((char *, char *, int, int *)); + static int have_srp_secret __P((char *client, char *server, int need_ip, + int *lacks_ipp)); ++ ++#ifdef USE_EAPTLS ++static int have_eaptls_secret_server ++__P((char *client, char *server, int need_ip, int *lacks_ipp)); ++static int have_eaptls_secret_client __P((char *client, char *server)); ++static int scan_authfile_eaptls __P((FILE * f, char *client, char *server, ++ char *cli_cert, char *serv_cert, ++ char *ca_cert, char *pk, ++ struct wordlist ** addrs, ++ struct wordlist ** opts, ++ char *filename, int flags)); ++#endif ++ + static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); + static int scan_authfile __P((FILE *, char *, char *, char *, + struct wordlist **, struct wordlist **, +@@ -401,6 +429,14 @@ + "Set telephone number(s) which are allowed to connect", + OPT_PRIV | OPT_A2LIST }, + ++#ifdef USE_EAPTLS ++ { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, ++ { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, ++ { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, ++ { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, ++ { "need-peer-eap", o_bool, &need_peer_eap, ++ "Require the peer to authenticate us", 1 }, ++#endif /* USE_EAPTLS */ + { NULL } + }; + +@@ -730,6 +766,9 @@ + lcp_options *wo = &lcp_wantoptions[unit]; + lcp_options *go = &lcp_gotoptions[unit]; + lcp_options *ho = &lcp_hisoptions[unit]; ++#ifdef USE_EAPTLS ++ lcp_options *ao = &lcp_allowoptions[unit]; ++#endif + int i; + struct protent *protp; + +@@ -764,6 +803,22 @@ + } + } + ++#ifdef USE_EAPTLS ++ if (need_peer_eap && !ao->neg_eap) { ++ warn("eap required to authenticate us but no suitable secrets"); ++ lcp_close(unit, "couldn't negotiate eap"); ++ status = EXIT_AUTH_TOPEER_FAILED; ++ return; ++ } ++ ++ if (need_peer_eap && !ho->neg_eap) { ++ warn("peer doesn't want to authenticate us with eap"); ++ lcp_close(unit, "couldn't negotiate eap"); ++ status = EXIT_PEER_AUTH_FAILED; ++ return; ++ } ++#endif ++ + new_phase(PHASE_AUTHENTICATE); + auth = 0; + if (go->neg_eap) { +@@ -1277,6 +1332,15 @@ + our_name, 1, &lacks_ip); + } + ++#ifdef USE_EAPTLS ++ if (!can_auth && wo->neg_eap) { ++ can_auth = ++ have_eaptls_secret_server((explicit_remote ? remote_name : ++ NULL), our_name, 1, &lacks_ip); ++ ++ } ++#endif ++ + if (auth_required && !can_auth && noauth_addrs == NULL) { + if (default_auth) { + option_error( +@@ -1331,7 +1395,11 @@ + passwd[0] != 0 || + (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, + (explicit_remote? remote_name: NULL), 0, NULL))) || +- have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)); ++ have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL) ++#ifdef USE_EAPTLS ++ || have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL)) ++#endif ++ ); + + hadchap = -1; + if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) +@@ -1346,8 +1414,14 @@ + !have_chap_secret((explicit_remote? remote_name: NULL), our_name, + 1, NULL))) && + !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, +- NULL)) ++ NULL) ++#ifdef USE_EAPTLS ++ && !have_eaptls_secret_server((explicit_remote? remote_name: NULL), ++ our_name, 1, NULL) ++#endif ++ ) + go->neg_eap = 0; ++ + } + + +@@ -1707,6 +1781,7 @@ + } + + ++ + /* + * get_secret - open the CHAP secret file and return the secret + * for authenticating the given client on the given server. +@@ -2359,3 +2434,335 @@ + + auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); + } ++ ++ ++#ifdef USE_EAPTLS ++static int ++have_eaptls_secret_server(client, server, need_ip, lacks_ipp) ++ char *client; ++ char *server; ++ int need_ip; ++ int *lacks_ipp; ++{ ++ FILE *f; ++ int ret; ++ char *filename; ++ struct wordlist *addrs; ++ char servcertfile[MAXWORDLEN]; ++ char clicertfile[MAXWORDLEN]; ++ char cacertfile[MAXWORDLEN]; ++ char pkfile[MAXWORDLEN]; ++ ++ filename = _PATH_EAPTLSSERVFILE; ++ f = fopen(filename, "r"); ++ if (f == NULL) ++ return 0; ++ ++ if (client != NULL && client[0] == 0) ++ client = NULL; ++ else if (server != NULL && server[0] == 0) ++ server = NULL; ++ ++ ret = ++ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, ++ cacertfile, pkfile, &addrs, NULL, filename, ++ 0); ++ ++ fclose(f); ++ ++/* ++ if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile, ++ clicertfile, pkfile)) ++ ret = -1; ++*/ ++ ++ if (ret >= 0 && need_ip && !some_ip_ok(addrs)) { ++ if (lacks_ipp != 0) ++ *lacks_ipp = 1; ++ ret = -1; ++ } ++ if (addrs != 0) ++ free_wordlist(addrs); ++ ++ return ret >= 0; ++} ++ ++ ++static int ++have_eaptls_secret_client(client, server) ++ char *client; ++ char *server; ++{ ++ FILE *f; ++ int ret; ++ char *filename; ++ struct wordlist *addrs = NULL; ++ char servcertfile[MAXWORDLEN]; ++ char clicertfile[MAXWORDLEN]; ++ char cacertfile[MAXWORDLEN]; ++ char pkfile[MAXWORDLEN]; ++ ++ if (client != NULL && client[0] == 0) ++ client = NULL; ++ else if (server != NULL && server[0] == 0) ++ server = NULL; ++ ++ if (cacert_file && cert_file && privkey_file) ++ return 1; ++ ++ filename = _PATH_EAPTLSCLIFILE; ++ f = fopen(filename, "r"); ++ if (f == NULL) ++ return 0; ++ ++ ret = ++ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, ++ cacertfile, pkfile, &addrs, NULL, filename, ++ 0); ++ fclose(f); ++ ++/* ++ if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile, ++ servcertfile, pkfile)) ++ ret = -1; ++*/ ++ ++ if (addrs != 0) ++ free_wordlist(addrs); ++ ++ return ret >= 0; ++} ++ ++ ++static int ++scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk, ++ addrs, opts, filename, flags) ++ FILE *f; ++ char *client; ++ char *server; ++ char *cli_cert; ++ char *serv_cert; ++ char *ca_cert; ++ char *pk; ++ struct wordlist **addrs; ++ struct wordlist **opts; ++ char *filename; ++ int flags; ++{ ++ int newline; ++ int got_flag, best_flag; ++ struct wordlist *ap, *addr_list, *alist, **app; ++ char word[MAXWORDLEN]; ++ ++ if (addrs != NULL) ++ *addrs = NULL; ++ if (opts != NULL) ++ *opts = NULL; ++ addr_list = NULL; ++ if (!getword(f, word, &newline, filename)) ++ return -1; /* file is empty??? */ ++ newline = 1; ++ best_flag = -1; ++ for (;;) { ++ /* ++ * Skip until we find a word at the start of a line. ++ */ ++ while (!newline && getword(f, word, &newline, filename)); ++ if (!newline) ++ break; /* got to end of file */ ++ ++ /* ++ * Got a client - check if it's a match or a wildcard. ++ */ ++ got_flag = 0; ++ if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) { ++ newline = 0; ++ continue; ++ } ++ if (!ISWILD(word)) ++ got_flag = NONWILD_CLIENT; ++ ++ /* ++ * Now get a server and check if it matches. ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ if (!ISWILD(word)) { ++ if (server != NULL && strcmp(word, server) != 0) ++ continue; ++ got_flag |= NONWILD_SERVER; ++ } ++ ++ /* ++ * Got some sort of a match - see if it's better than what ++ * we have already. ++ */ ++ if (got_flag <= best_flag) ++ continue; ++ ++ /* ++ * Get the cli_cert ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ if (strcmp(word, "-") != 0) { ++ strlcpy(cli_cert, word, MAXWORDLEN); ++ } else ++ cli_cert[0] = 0; ++ ++ /* ++ * Get serv_cert ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ if (strcmp(word, "-") != 0) { ++ strlcpy(serv_cert, word, MAXWORDLEN); ++ } else ++ serv_cert[0] = 0; ++ ++ /* ++ * Get ca_cert ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ strlcpy(ca_cert, word, MAXWORDLEN); ++ ++ /* ++ * Get pk ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ strlcpy(pk, word, MAXWORDLEN); ++ ++ ++ /* ++ * Now read address authorization info and make a wordlist. ++ */ ++ app = &alist; ++ for (;;) { ++ if (!getword(f, word, &newline, filename) || newline) ++ break; ++ ap = (struct wordlist *) ++ malloc(sizeof(struct wordlist) + strlen(word) + 1); ++ if (ap == NULL) ++ novm("authorized addresses"); ++ ap->word = (char *) (ap + 1); ++ strcpy(ap->word, word); ++ *app = ap; ++ app = &ap->next; ++ } ++ *app = NULL; ++ /* ++ * This is the best so far; remember it. ++ */ ++ best_flag = got_flag; ++ if (addr_list) ++ free_wordlist(addr_list); ++ addr_list = alist; ++ ++ if (!newline) ++ break; ++ } ++ ++ /* scan for a -- word indicating the start of options */ ++ for (app = &addr_list; (ap = *app) != NULL; app = &ap->next) ++ if (strcmp(ap->word, "--") == 0) ++ break; ++ /* ap = start of options */ ++ if (ap != NULL) { ++ ap = ap->next; /* first option */ ++ free(*app); /* free the "--" word */ ++ *app = NULL; /* terminate addr list */ ++ } ++ if (opts != NULL) ++ *opts = ap; ++ else if (ap != NULL) ++ free_wordlist(ap); ++ if (addrs != NULL) ++ *addrs = addr_list; ++ else if (addr_list != NULL) ++ free_wordlist(addr_list); ++ ++ return best_flag; ++} ++ ++ ++int ++get_eaptls_secret(unit, client, server, clicertfile, servcertfile, ++ cacertfile, pkfile, am_server) ++ int unit; ++ char *client; ++ char *server; ++ char *clicertfile; ++ char *servcertfile; ++ char *cacertfile; ++ char *pkfile; ++ int am_server; ++{ ++ FILE *fp; ++ int ret; ++ char *filename = NULL; ++ struct wordlist *addrs = NULL; ++ struct wordlist *opts = NULL; ++ ++ /* in client mode the ca+cert+privkey can also be specified as options */ ++ if (!am_server && cacert_file && cert_file && privkey_file ) ++ { ++ strlcpy( clicertfile, cert_file, MAXWORDLEN ); ++ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); ++ strlcpy( pkfile, privkey_file, MAXWORDLEN ); ++ servcertfile[0] = '\0'; ++ } ++ else ++ { ++ filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE); ++ addrs = NULL; ++ ++ fp = fopen(filename, "r"); ++ if (fp == NULL) ++ { ++ error("Can't open eap-tls secret file %s: %m", filename); ++ return 0; ++ } ++ ++ check_access(fp, filename); ++ ++ ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile, ++ cacertfile, pkfile, &addrs, &opts, filename, 0); ++ ++ fclose(fp); ++ ++ if (ret < 0) return 0; ++ } ++ ++ if (eaptls_passwd_hook) ++ { ++ dbglog( "Calling eaptls password hook" ); ++ if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0) ++ { ++ error("Unable to obtain EAP-TLS password for %s (%s) from plugin", ++ client, pkfile); ++ return 0; ++ } ++ } ++ if (am_server) ++ set_allowed_addrs(unit, addrs, opts); ++ else if (opts != NULL) ++ free_wordlist(opts); ++ if (addrs != NULL) ++ free_wordlist(addrs); ++ ++ return 1; ++} ++#endif ++ +--- ppp-2.4.6/pppd/ccp.c ++++ ppp-2.4.6/pppd/ccp.c +@@ -540,6 +540,9 @@ + if (go->mppe) { + ccp_options *ao = &ccp_allowoptions[f->unit]; + int auth_mschap_bits = auth_done[f->unit]; ++#ifdef USE_EAPTLS ++ int auth_eap_bits = auth_done[f->unit]; ++#endif + int numbits; + + /* +@@ -567,8 +570,23 @@ + lcp_close(f->unit, "MPPE required but not available"); + return; + } ++ ++#ifdef USE_EAPTLS ++ /* ++ * MPPE is also possible in combination with EAP-TLS. ++ * It is not possible to detect if we're doing EAP or EAP-TLS ++ * at this stage, hence we accept all forms of EAP. If TLS is ++ * not used then the MPPE keys will not be derived anyway. ++ */ ++ /* Leave only the eap auth bits set */ ++ auth_eap_bits &= (EAP_WITHPEER | EAP_PEER ); ++ ++ if ((numbits == 0) && (auth_eap_bits == 0)) { ++ error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed."); ++#else + if (!numbits) { +- error("MPPE required, but MS-CHAP[v2] auth not performed."); ++ error("MPPE required, but MS-CHAP[v2] auth not performed."); ++#endif + lcp_close(f->unit, "MPPE required but not available"); + return; + } +--- ppp-2.4.6/pppd/chap-md5.c ++++ ppp-2.4.6/pppd/chap-md5.c +@@ -36,7 +36,11 @@ + #include "chap-new.h" + #include "chap-md5.h" + #include "magic.h" ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#else + #include "md5.h" ++#endif /* USE_EAPTLS */ + + #define MD5_HASH_SIZE 16 + #define MD5_MIN_CHALLENGE 16 +--- ppp-2.4.6/pppd/eap.c ++++ ppp-2.4.6/pppd/eap.c +@@ -43,6 +43,11 @@ + * Based on draft-ietf-pppext-eap-srp-03.txt. + */ + ++/* ++ * Modification by Beniamino Galvani, Mar 2005 ++ * Implemented EAP-TLS authentication ++ */ ++ + #define RCSID "$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $" + + /* +@@ -62,8 +67,12 @@ + + #include "pppd.h" + #include "pathnames.h" +-#include "md5.h" + #include "eap.h" ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#else ++#include "md5.h" ++#endif /* USE_EAPTLS */ + + #ifdef USE_SRP + #include +@@ -209,6 +218,9 @@ + esp->es_server.ea_id = (u_char)(drand48() * 0x100); + esp->es_client.ea_timeout = EAP_DEFREQTIME; + esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; ++#ifdef USE_EAPTLS ++ esp->es_client.ea_using_eaptls = 0; ++#endif /* USE_EAPTLS */ + } + + /* +@@ -436,8 +448,16 @@ + u_char vals[2]; + struct b64state bs; + #endif /* USE_SRP */ ++#ifdef USE_EAPTLS ++ struct eaptls_session *ets; ++ int secret_len; ++ char secret[MAXWORDLEN]; ++#endif /* USE_EAPTLS */ + + esp->es_server.ea_timeout = esp->es_savedtime; ++#ifdef USE_EAPTLS ++ esp->es_server.ea_prev_state = esp->es_server.ea_state; ++#endif /* USE_EAPTLS */ + switch (esp->es_server.ea_state) { + case eapBadAuth: + return; +@@ -562,9 +582,81 @@ + break; + } + #endif /* USE_SRP */ ++#ifdef USE_EAPTLS ++ if (!get_secret(esp->es_unit, esp->es_server.ea_peer, ++ esp->es_server.ea_name, secret, &secret_len, 1)) { ++ ++ esp->es_server.ea_state = eapTlsStart; ++ break; ++ } ++#endif /* USE_EAPTLS */ ++ + esp->es_server.ea_state = eapMD5Chall; + break; + ++#ifdef USE_EAPTLS ++ case eapTlsStart: ++ /* Initialize ssl session */ ++ if(!eaptls_init_ssl_server(esp)) { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } ++ ++ esp->es_server.ea_state = eapTlsRecv; ++ break; ++ ++ case eapTlsRecv: ++ ets = (struct eaptls_session *) esp->es_server.ea_session; ++ ++ if(ets->alert_sent) { ++ esp->es_server.ea_state = eapTlsSendAlert; ++ break; ++ } ++ ++ if (status) { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } ++ ets = (struct eaptls_session *) esp->es_server.ea_session; ++ ++ if(ets->frag) ++ esp->es_server.ea_state = eapTlsSendAck; ++ else ++ esp->es_server.ea_state = eapTlsSend; ++ break; ++ ++ case eapTlsSend: ++ ets = (struct eaptls_session *) esp->es_server.ea_session; ++ ++ if(SSL_is_init_finished(ets->ssl)) { ++ esp->es_server.ea_state = eapTlsRecvClient; ++ break; ++ } ++ ++ if(ets->frag) ++ esp->es_server.ea_state = eapTlsRecvAck; ++ else ++ esp->es_server.ea_state = eapTlsRecv; ++ break; ++ ++ case eapTlsSendAck: ++ esp->es_server.ea_state = eapTlsRecv; ++ break; ++ ++ case eapTlsRecvAck: ++ if (status) { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } ++ ++ esp->es_server.ea_state = eapTlsSend; ++ break; ++ ++ case eapTlsSendAlert: ++ esp->es_server.ea_state = eapTlsRecvAlertAck; ++ break; ++#endif /* USE_EAPTLS */ ++ + case eapSRP1: + #ifdef USE_SRP + ts = (struct t_server *)esp->es_server.ea_session; +@@ -718,6 +810,30 @@ + INCPTR(esp->es_server.ea_namelen, outp); + break; + ++#ifdef USE_EAPTLS ++ case eapTlsStart: ++ PUTCHAR(EAPT_TLS, outp); ++ PUTCHAR(EAP_TLS_FLAGS_START, outp); ++ eap_figure_next_state(esp, 0); ++ break; ++ ++ case eapTlsSend: ++ eaptls_send(esp->es_server.ea_session, &outp); ++ eap_figure_next_state(esp, 0); ++ break; ++ ++ case eapTlsSendAck: ++ PUTCHAR(EAPT_TLS, outp); ++ PUTCHAR(0, outp); ++ eap_figure_next_state(esp, 0); ++ break; ++ ++ case eapTlsSendAlert: ++ eaptls_send(esp->es_server.ea_session, &outp); ++ eap_figure_next_state(esp, 0); ++ break; ++#endif /* USE_EAPTLS */ ++ + #ifdef USE_SRP + case eapSRP1: + PUTCHAR(EAPT_SRP, outp); +@@ -904,11 +1020,57 @@ + eap_server_timeout(arg) + void *arg; + { ++#ifdef USE_EAPTLS ++ u_char *outp; ++ u_char *lenloc; ++ int outlen; ++#endif /* USE_EAPTLS */ ++ + eap_state *esp = (eap_state *) arg; + + if (!eap_server_active(esp)) + return; + ++#ifdef USE_EAPTLS ++ switch(esp->es_server.ea_prev_state) { ++ ++ /* ++ * In eap-tls the state changes after a request, so we return to ++ * previous state ... ++ */ ++ case(eapTlsStart): ++ case(eapTlsSendAck): ++ esp->es_server.ea_state = esp->es_server.ea_prev_state; ++ break; ++ ++ /* ++ * ... or resend the stored data ++ */ ++ case(eapTlsSend): ++ case(eapTlsSendAlert): ++ outp = outpacket_buf; ++ MAKEHEADER(outp, PPP_EAP); ++ PUTCHAR(EAP_REQUEST, outp); ++ PUTCHAR(esp->es_server.ea_id, outp); ++ lenloc = outp; ++ INCPTR(2, outp); ++ ++ eaptls_retransmit(esp->es_server.ea_session, &outp); ++ ++ outlen = (outp - outpacket_buf) - PPP_HDRLEN; ++ PUTSHORT(outlen, lenloc); ++ output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN); ++ esp->es_server.ea_requests++; ++ ++ if (esp->es_server.ea_timeout > 0) ++ TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout); ++ ++ return; ++ default: ++ break; ++ } ++#endif /* USE_EAPTLS */ ++ + /* EAP ID number must not change on timeout. */ + eap_send_request(esp); + } +@@ -1166,6 +1328,81 @@ + } + #endif /* USE_SRP */ + ++#ifdef USE_EAPTLS ++/* ++ * Send an EAP-TLS response message with tls data ++ */ ++static void ++eap_tls_response(esp, id) ++eap_state *esp; ++u_char id; ++{ ++ u_char *outp; ++ int outlen; ++ u_char *lenloc; ++ ++ outp = outpacket_buf; ++ ++ MAKEHEADER(outp, PPP_EAP); ++ ++ PUTCHAR(EAP_RESPONSE, outp); ++ PUTCHAR(id, outp); ++ ++ lenloc = outp; ++ INCPTR(2, outp); ++ ++ /* ++ If the id in the request is unchanged, we must retransmit ++ the old data ++ */ ++ if(id == esp->es_client.ea_id) ++ eaptls_retransmit(esp->es_client.ea_session, &outp); ++ else ++ eaptls_send(esp->es_client.ea_session, &outp); ++ ++ outlen = (outp - outpacket_buf) - PPP_HDRLEN; ++ PUTSHORT(outlen, lenloc); ++ ++ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); ++ ++ esp->es_client.ea_id = id; ++ ++} ++ ++/* ++ * Send an EAP-TLS ack ++ */ ++static void ++eap_tls_sendack(esp, id) ++eap_state *esp; ++u_char id; ++{ ++ u_char *outp; ++ int outlen; ++ u_char *lenloc; ++ ++ outp = outpacket_buf; ++ ++ MAKEHEADER(outp, PPP_EAP); ++ ++ PUTCHAR(EAP_RESPONSE, outp); ++ PUTCHAR(id, outp); ++ esp->es_client.ea_id = id; ++ ++ lenloc = outp; ++ INCPTR(2, outp); ++ ++ PUTCHAR(EAPT_TLS, outp); ++ PUTCHAR(0, outp); ++ ++ outlen = (outp - outpacket_buf) - PPP_HDRLEN; ++ PUTSHORT(outlen, lenloc); ++ ++ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); ++ ++} ++#endif /* USE_EAPTLS */ ++ + static void + eap_send_nak(esp, id, type) + eap_state *esp; +@@ -1320,6 +1557,11 @@ + char rhostname[256]; + MD5_CTX mdContext; + u_char hash[MD5_SIGNATURE_SIZE]; ++#ifdef USE_EAPTLS ++ u_char flags; ++ struct eaptls_session *ets = esp->es_client.ea_session; ++#endif /* USE_EAPTLS */ ++ + #ifdef USE_SRP + struct t_client *tc; + struct t_num sval, gval, Nval, *Ap, Bval; +@@ -1456,6 +1698,90 @@ + esp->es_client.ea_namelen); + break; + ++#ifdef USE_EAPTLS ++ case EAPT_TLS: ++ ++ switch(esp->es_client.ea_state) { ++ ++ case eapListen: ++ ++ GETCHAR(flags, inp); ++ if(flags & EAP_TLS_FLAGS_START){ ++ ++ esp->es_client.ea_using_eaptls = 1; ++ ++ if (explicit_remote){ ++ esp->es_client.ea_peer = strdup(remote_name); ++ esp->es_client.ea_peerlen = strlen(remote_name); ++ } else ++ esp->es_client.ea_peer = NULL; ++ ++ /* Init ssl session */ ++ if(!eaptls_init_ssl_client(esp)) { ++ dbglog("cannot init ssl"); ++ eap_send_nak(esp, id, EAPT_TLS); ++ esp->es_client.ea_using_eaptls = 0; ++ break; ++ } ++ ++ ets = esp->es_client.ea_session; ++ eap_tls_response(esp, id); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : ++ eapTlsRecv); ++ break; ++ } ++ ++ /* The server has sent a bad start packet. */ ++ eap_send_nak(esp, id, EAPT_TLS); ++ break; ++ ++ case eapTlsRecvAck: ++ eap_tls_response(esp, id); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : ++ eapTlsRecv); ++ break; ++ ++ case eapTlsRecv: ++ eaptls_receive(ets, inp, len); ++ ++ if(ets->frag) { ++ eap_tls_sendack(esp, id); ++ esp->es_client.ea_state = eapTlsRecv; ++ break; ++ } ++ ++ if(ets->alert_recv) { ++ eap_tls_sendack(esp, id); ++ esp->es_client.ea_state = eapTlsRecvFailure; ++ break; ++ } ++ ++ /* Check if TLS handshake is finished */ ++ if(SSL_is_init_finished(ets->ssl)){ ++#ifdef MPPE ++ eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); ++#endif ++ eaptls_free_session(ets); ++ eap_tls_sendack(esp, id); ++ esp->es_client.ea_state = eapTlsRecvSuccess; ++ break; ++ } ++ ++ eap_tls_response(esp,id); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : ++ eapTlsRecv); ++ ++ break; ++ ++ default: ++ eap_send_nak(esp, id, EAPT_TLS); ++ esp->es_client.ea_using_eaptls = 0; ++ break; ++ } ++ ++ break; ++#endif /* USE_EAPTLS */ ++ + #ifdef USE_SRP + case EAPT_SRP: + if (len < 1) { +@@ -1737,6 +2063,11 @@ + u_char dig[SHA_DIGESTSIZE]; + #endif /* USE_SRP */ + ++#ifdef USE_EAPTLS ++ struct eaptls_session *ets; ++ u_char flags; ++#endif /* USE_EAPTLS */ ++ + if (esp->es_server.ea_id != id) { + dbglog("EAP: discarding Response %d; expected ID %d", id, + esp->es_server.ea_id); +@@ -1776,6 +2107,60 @@ + eap_figure_next_state(esp, 0); + break; + ++#ifdef USE_EAPTLS ++ case EAPT_TLS: ++ switch(esp->es_server.ea_state) { ++ ++ case eapTlsRecv: ++ ets = (struct eaptls_session *) esp->es_server.ea_session; ++ eap_figure_next_state(esp, ++ eaptls_receive(esp->es_server.ea_session, inp, len)); ++ ++ if(ets->alert_recv) { ++ eap_send_failure(esp); ++ break; ++ } ++ break; ++ ++ case eapTlsRecvAck: ++ if(len > 1) { ++ dbglog("EAP-TLS ACK with extra data"); ++ } ++ eap_figure_next_state(esp, 0); ++ break; ++ ++ case eapTlsRecvClient: ++ /* Receive authentication response from client */ ++ ++ GETCHAR(flags, inp); ++ ++ if(len == 1 && !flags) { /* Ack = ok */ ++#ifdef MPPE ++ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); ++#endif ++ eap_send_success(esp); ++ } ++ else { /* failure */ ++ eaptls_receive(esp->es_server.ea_session, inp, len); ++ warn("Server authentication failed"); ++ eap_send_failure(esp); ++ } ++ ++ eaptls_free_session(esp->es_server.ea_session); ++ ++ break; ++ ++ case eapTlsRecvAlertAck: ++ eap_send_failure(esp); ++ break; ++ ++ default: ++ eap_figure_next_state(esp, 1); ++ break; ++ } ++ break; ++#endif /* USE_EAPTLS */ ++ + case EAPT_NOTIFICATION: + dbglog("EAP unexpected Notification; response discarded"); + break; +@@ -1807,6 +2192,13 @@ + esp->es_server.ea_state = eapMD5Chall; + break; + ++#ifdef USE_EAPTLS ++ /* Send EAP-TLS start packet */ ++ case EAPT_TLS: ++ esp->es_server.ea_state = eapTlsStart; ++ break; ++#endif /* USE_EAPTLS */ ++ + default: + dbglog("EAP: peer requesting unknown Type %d", vallen); + switch (esp->es_server.ea_state) { +@@ -2018,13 +2410,27 @@ + int id; + int len; + { +- if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) { ++ if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp) ++#ifdef USE_EAPTLS ++ && esp->es_client.ea_state != eapTlsRecvSuccess ++#endif /* USE_EAPTLS */ ++ ) { + dbglog("EAP unexpected success message in state %s (%d)", + eap_state_name(esp->es_client.ea_state), + esp->es_client.ea_state); + return; + } + ++#ifdef USE_EAPTLS ++ if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != ++ eapTlsRecvSuccess) { ++ dbglog("EAP-TLS unexpected success message in state %s (%d)", ++ eap_state_name(esp->es_client.ea_state), ++ esp->es_client.ea_state); ++ return; ++ } ++#endif /* USE_EAPTLS */ ++ + if (esp->es_client.ea_timeout > 0) { + UNTIMEOUT(eap_client_timeout, (void *)esp); + } +@@ -2150,6 +2556,9 @@ + int code, id, len, rtype, vallen; + u_char *pstart; + u_int32_t uval; ++#ifdef USE_EAPTLS ++ u_char flags; ++#endif /* USE_EAPTLS */ + + if (inlen < EAP_HEADERLEN) + return (0); +@@ -2214,6 +2623,24 @@ + } + break; + ++#ifdef USE_EAPTLS ++ case EAPT_TLS: ++ if (len < 1) ++ break; ++ GETCHAR(flags, inp); ++ len--; ++ ++ if(flags == 0 && len == 0){ ++ printer(arg, " Ack"); ++ break; ++ } ++ ++ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); ++ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); ++ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); ++ break; ++#endif /* USE_EAPTLS */ ++ + case EAPT_SRP: + if (len < 3) + goto truncated; +@@ -2325,6 +2752,25 @@ + } + break; + ++#ifdef USE_EAPTLS ++ case EAPT_TLS: ++ if (len < 1) ++ break; ++ GETCHAR(flags, inp); ++ len--; ++ ++ if(flags == 0 && len == 0){ ++ printer(arg, " Ack"); ++ break; ++ } ++ ++ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); ++ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); ++ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); ++ ++ break; ++#endif /* USE_EAPTLS */ ++ + case EAPT_NAK: + if (len <= 0) { + printer(arg, " "); +@@ -2426,3 +2872,4 @@ + + return (inp - pstart); + } ++ +--- ppp-2.4.6/pppd/eap.h ++++ ppp-2.4.6/pppd/eap.h +@@ -84,6 +84,16 @@ + eapClosed, /* Authentication not in use */ + eapListen, /* Client ready (and timer running) */ + eapIdentify, /* EAP Identify sent */ ++ eapTlsStart, /* Send EAP-TLS start packet */ ++ eapTlsRecv, /* Receive EAP-TLS tls data */ ++ eapTlsSendAck, /* Send EAP-TLS ack */ ++ eapTlsSend, /* Send EAP-TLS tls data */ ++ eapTlsRecvAck, /* Receive EAP-TLS ack */ ++ eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ ++ eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ ++ eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ ++ eapTlsRecvSuccess, /* Receive EAP success */ ++ eapTlsRecvFailure, /* Receive EAP failure */ + eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ + eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ + eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ +@@ -95,9 +105,18 @@ + + #define EAP_STATES \ + "Initial", "Pending", "Closed", "Listen", "Identify", \ ++ "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ ++ "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ + "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" + +-#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) ++#ifdef USE_EAPTLS ++#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial ||\ ++ (esp)->es_client.ea_state != eapPending ||\ ++ (esp)->es_client.ea_state != eapClosed) ++#else ++#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) ++#endif /* USE_EAPTLS */ ++ + #define eap_server_active(esp) \ + ((esp)->es_server.ea_state >= eapIdentify && \ + (esp)->es_server.ea_state <= eapMD5Chall) +@@ -112,11 +131,17 @@ + u_short ea_namelen; /* Length of our name */ + u_short ea_peerlen; /* Length of peer's name */ + enum eap_state_code ea_state; ++#ifdef USE_EAPTLS ++ enum eap_state_code ea_prev_state; ++#endif + u_char ea_id; /* Current id */ + u_char ea_requests; /* Number of Requests sent/received */ + u_char ea_responses; /* Number of Responses */ + u_char ea_type; /* One of EAPT_* */ + u_int32_t ea_keyflags; /* SRP shared key usage flags */ ++#ifdef USE_EAPTLS ++ bool ea_using_eaptls; ++#endif + }; + + /* +@@ -139,7 +164,12 @@ + * Timeouts. + */ + #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ ++#ifdef USE_EAPTLS ++#define EAP_DEFTRANSMITS 30 /* max # times to transmit */ ++ /* certificates can be long ... */ ++#else + #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ ++#endif /* USE_EAPTLS */ + #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ + #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ + +--- ppp-2.4.6/pppd/eap-tls.c ++++ ppp-2.4.6/pppd/eap-tls.c +@@ -0,0 +1,1174 @@ ++/* ++ * eap-tls.c - EAP-TLS implementation for PPP ++ * ++ * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in ++ * the documentation and/or other materials provided with the ++ * distribution. ++ * ++ * 3. The name(s) of the authors of this software must not be used to ++ * endorse or promote products derived from this software without ++ * prior written permission. ++ * ++ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO ++ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY ++ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY ++ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN ++ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING ++ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ * ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include "pppd.h" ++#include "eap.h" ++#include "eap-tls.h" ++#include "fsm.h" ++#include "lcp.h" ++#include "pathnames.h" ++ ++/* The openssl configuration file and engines can be loaded only once */ ++static CONF *ssl_config = NULL; ++static ENGINE *cert_engine = NULL; ++static ENGINE *pkey_engine = NULL; ++ ++#ifdef MPPE ++ ++/* ++ * TLS PRF from RFC 2246 ++ */ ++static void P_hash(const EVP_MD *evp_md, ++ const unsigned char *secret, unsigned int secret_len, ++ const unsigned char *seed, unsigned int seed_len, ++ unsigned char *out, unsigned int out_len) ++{ ++ HMAC_CTX ctx_a, ctx_out; ++ unsigned char a[HMAC_MAX_MD_CBLOCK]; ++ unsigned int size; ++ ++ HMAC_CTX_init(&ctx_a); ++ HMAC_CTX_init(&ctx_out); ++ HMAC_Init_ex(&ctx_a, secret, secret_len, evp_md, NULL); ++ HMAC_Init_ex(&ctx_out, secret, secret_len, evp_md, NULL); ++ ++ size = HMAC_size(&ctx_out); ++ ++ /* Calculate A(1) */ ++ HMAC_Update(&ctx_a, seed, seed_len); ++ HMAC_Final(&ctx_a, a, NULL); ++ ++ while (1) { ++ /* Calculate next part of output */ ++ HMAC_Update(&ctx_out, a, size); ++ HMAC_Update(&ctx_out, seed, seed_len); ++ ++ /* Check if last part */ ++ if (out_len < size) { ++ HMAC_Final(&ctx_out, a, NULL); ++ memcpy(out, a, out_len); ++ break; ++ } ++ ++ /* Place digest in output buffer */ ++ HMAC_Final(&ctx_out, out, NULL); ++ HMAC_Init_ex(&ctx_out, NULL, 0, NULL, NULL); ++ out += size; ++ out_len -= size; ++ ++ /* Calculate next A(i) */ ++ HMAC_Init_ex(&ctx_a, NULL, 0, NULL, NULL); ++ HMAC_Update(&ctx_a, a, size); ++ HMAC_Final(&ctx_a, a, NULL); ++ } ++ ++ HMAC_CTX_cleanup(&ctx_a); ++ HMAC_CTX_cleanup(&ctx_out); ++ memset(a, 0, sizeof(a)); ++} ++ ++static void PRF(const unsigned char *secret, unsigned int secret_len, ++ const unsigned char *seed, unsigned int seed_len, ++ unsigned char *out, unsigned char *buf, unsigned int out_len) ++{ ++ unsigned int i; ++ unsigned int len = (secret_len + 1) / 2; ++ const unsigned char *s1 = secret; ++ const unsigned char *s2 = secret + (secret_len - len); ++ ++ P_hash(EVP_md5(), s1, len, seed, seed_len, out, out_len); ++ P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len); ++ ++ for (i=0; i < out_len; i++) { ++ out[i] ^= buf[i]; ++ } ++} ++ ++#define EAPTLS_MPPE_KEY_LEN 32 ++ ++/* ++ * Generate keys according to RFC 2716 and add to reply ++ */ ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, ++ int client) ++{ ++ unsigned char out[4*EAPTLS_MPPE_KEY_LEN], buf[4*EAPTLS_MPPE_KEY_LEN]; ++ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; ++ unsigned char *p = seed; ++ SSL *s = ets->ssl; ++ size_t prf_size; ++ ++ prf_size = strlen(prf_label); ++ ++ memcpy(p, prf_label, prf_size); ++ p += prf_size; ++ ++ memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); ++ p += SSL3_RANDOM_SIZE; ++ prf_size += SSL3_RANDOM_SIZE; ++ ++ memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE); ++ prf_size += SSL3_RANDOM_SIZE; ++ ++ PRF(s->session->master_key, s->session->master_key_length, ++ seed, prf_size, out, buf, sizeof(out)); ++ ++ /* ++ * We now have the master send and receive keys. ++ * From these, generate the session send and receive keys. ++ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) ++ */ ++ if (client) ++ { ++ p = out; ++ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); ++ p += EAPTLS_MPPE_KEY_LEN; ++ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); ++ } ++ else ++ { ++ p = out; ++ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); ++ p += EAPTLS_MPPE_KEY_LEN; ++ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); ++ } ++ ++ mppe_keys_set = 1; ++} ++ ++#endif ++ ++void log_ssl_errors( void ) ++{ ++ unsigned long ssl_err = ERR_get_error(); ++ ++ if (ssl_err != 0) ++ dbglog("EAP-TLS SSL error stack:"); ++ while (ssl_err != 0) { ++ dbglog( ERR_error_string( ssl_err, NULL ) ); ++ ssl_err = ERR_get_error(); ++ } ++} ++ ++ ++int password_callback (char *buf, int size, int rwflag, void *u) ++{ ++ if (buf) ++ { ++ strncpy (buf, passwd, size); ++ return strlen (buf); ++ } ++ return 0; ++} ++ ++ ++CONF *eaptls_ssl_load_config( void ) ++{ ++ CONF *config; ++ int ret_code; ++ long error_line = 33; ++ ++ config = NCONF_new( NULL ); ++ dbglog( "Loading OpenSSL config file" ); ++ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); ++ if (ret_code == 0) ++ { ++ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); ++ NCONF_free( config ); ++ config = NULL; ++ ERR_clear_error(); ++ } ++ ++ dbglog( "Loading OpenSSL built-ins" ); ++ ENGINE_load_builtin_engines(); ++ OPENSSL_load_builtin_modules(); ++ ++ dbglog( "Loading OpenSSL configured modules" ); ++ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) ++ { ++ warn( "EAP-TLS: Error loading OpenSSL modules" ); ++ log_ssl_errors(); ++ config = NULL; ++ } ++ ++ return config; ++} ++ ++ENGINE *eaptls_ssl_load_engine( char *engine_name ) ++{ ++ ENGINE *e = NULL; ++ ++ dbglog( "Enabling OpenSSL auto engines" ); ++ ENGINE_register_all_complete(); ++ ++ dbglog( "Loading OpenSSL '%s' engine support", engine_name ); ++ e = ENGINE_by_id( engine_name ); ++ if (!e) ++ { ++ dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); ++ e = ENGINE_by_id( "dynamic" ); ++ if (e) ++ { ++ if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0) ++ || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) ++ { ++ warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name ); ++ log_ssl_errors(); ++ ENGINE_free(e); ++ e = NULL; ++ } ++ } ++ else ++ { ++ warn( "EAP-TLS: Cannot load dynamic engine support" ); ++ } ++ } ++ ++ if (e) ++ { ++ dbglog( "Initialising engine" ); ++ if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) ++ { ++ warn( "EAP-TLS: Cannot use that engine" ); ++ log_ssl_errors(); ++ ENGINE_free(e); ++ e = NULL; ++ } ++ } ++ ++ return e; ++} ++ ++/* ++ * Initialize the SSL stacks and tests if certificates, key and crl ++ * for client or server use can be loaded. ++ */ ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++ char *certfile, char *peer_certfile, char *privkeyfile) ++{ ++ char *cert_engine_name = NULL; ++ char *cert_identifier = NULL; ++ char *pkey_engine_name = NULL; ++ char *pkey_identifier = NULL; ++ SSL_CTX *ctx; ++ X509_STORE *certstore; ++ X509_LOOKUP *lookup; ++ X509 *tmp; ++ ++ /* ++ * Without these can't continue ++ */ ++ if (!cacertfile[0]) ++ { ++ error("EAP-TLS: CA certificate missing"); ++ return NULL; ++ } ++ ++ if (!certfile[0]) ++ { ++ error("EAP-TLS: User certificate missing"); ++ return NULL; ++ } ++ ++ if (!privkeyfile[0]) ++ { ++ error("EAP-TLS: User private key missing"); ++ return NULL; ++ } ++ ++ SSL_library_init(); ++ SSL_load_error_strings(); ++ ++ ctx = SSL_CTX_new(TLSv1_method()); ++ ++ if (!ctx) { ++ error("EAP-TLS: Cannot initialize SSL CTX context"); ++ goto fail; ++ } ++ ++ /* if the certificate filename is of the form engine:id. e.g. ++ pkcs11:12345 ++ then we try to load and use this engine. ++ If the certificate filename starts with a / or . then we ++ ALWAYS assume it is a file and not an engine/pkcs11 identifier ++ */ ++ if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL ) ++ { ++ cert_identifier = index( certfile, ':' ); ++ ++ if (cert_identifier) ++ { ++ cert_engine_name = certfile; ++ *cert_identifier = '\0'; ++ cert_identifier++; ++ ++ dbglog( "Found certificate engine '%s'", cert_engine_name ); ++ dbglog( "Found certificate identifier '%s'", cert_identifier ); ++ } ++ } ++ ++ /* if the privatekey filename is of the form engine:id. e.g. ++ pkcs11:12345 ++ then we try to load and use this engine. ++ If the privatekey filename starts with a / or . then we ++ ALWAYS assume it is a file and not an engine/pkcs11 identifier ++ */ ++ if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL ) ++ { ++ pkey_identifier = index( privkeyfile, ':' ); ++ ++ if (pkey_identifier) ++ { ++ pkey_engine_name = privkeyfile; ++ *pkey_identifier = '\0'; ++ pkey_identifier++; ++ ++ dbglog( "Found privatekey engine '%s'", pkey_engine_name ); ++ dbglog( "Found privatekey identifier '%s'", pkey_identifier ); ++ } ++ } ++ ++ if (cert_identifier && pkey_identifier) ++ { ++ if (strlen( cert_identifier ) == 0) ++ { ++ if (strlen( pkey_identifier ) == 0) ++ error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" ); ++ else ++ { ++ dbglog( "Substituting privatekey identifier for certificate identifier" ); ++ cert_identifier = pkey_identifier; ++ } ++ } ++ else ++ { ++ if (strlen( pkey_identifier ) == 0) ++ { ++ dbglog( "Substituting certificate identifier for privatekey identifier" ); ++ pkey_identifier = cert_identifier; ++ } ++ } ++ ++ } ++ ++ /* load the openssl config file only once */ ++ if (!ssl_config) ++ { ++ if (cert_engine_name || pkey_engine_name) ++ ssl_config = eaptls_ssl_load_config(); ++ ++ if (ssl_config && cert_engine_name) ++ cert_engine = eaptls_ssl_load_engine( cert_engine_name ); ++ ++ if (ssl_config && pkey_engine_name) ++ { ++ /* don't load the same engine twice */ ++ if ( strcmp( cert_engine_name, pkey_engine_name) == 0 ) ++ pkey_engine = cert_engine; ++ else ++ pkey_engine = eaptls_ssl_load_engine( pkey_engine_name ); ++ } ++ } ++ ++ SSL_CTX_set_default_passwd_cb (ctx, password_callback); ++ ++ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) ++ { ++ error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); ++ goto fail; ++ } ++ ++ if (init_server) ++ SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); ++ ++ if (cert_engine) ++ { ++ struct ++ { ++ const char *s_slot_cert_id; ++ X509 *cert; ++ } cert_info; ++ ++ cert_info.s_slot_cert_id = cert_identifier; ++ cert_info.cert = NULL; ++ ++ if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) ) ++ { ++ error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier ); ++ goto fail; ++ } ++ ++ if (cert_info.cert) ++ { ++ dbglog( "Got the certificate, adding it to SSL context" ); ++ dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) ); ++ if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0) ++ { ++ error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier); ++ goto fail; ++ } ++ } ++ else ++ { ++ warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier); ++ log_ssl_errors(); ++ } ++ } ++ else ++ { ++ if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM)) ++ { ++ error( "EAP-TLS: Cannot use public certificate %s", certfile ); ++ goto fail; ++ } ++ } ++ ++ if (pkey_engine) ++ { ++ EVP_PKEY *pkey = NULL; ++ PW_CB_DATA cb_data; ++ ++ cb_data.password = passwd; ++ cb_data.prompt_info = pkey_identifier; ++ ++ dbglog( "Loading private key '%s' from engine", pkey_identifier ); ++ pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data); ++ if (pkey) ++ { ++ dbglog( "Got the private key, adding it to SSL context" ); ++ if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) ++ { ++ error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier); ++ goto fail; ++ } ++ } ++ else ++ { ++ warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier); ++ log_ssl_errors(); ++ } ++ } ++ else ++ { ++ if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM)) ++ { ++ error("EAP-TLS: Cannot use private key %s", privkeyfile); ++ goto fail; ++ } ++ } ++ ++ if (SSL_CTX_check_private_key(ctx) != 1) { ++ error("EAP-TLS: Private key %s fails security check", privkeyfile); ++ goto fail; ++ } ++ ++ SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); ++ SSL_CTX_set_verify_depth(ctx, 5); ++ SSL_CTX_set_verify(ctx, ++ SSL_VERIFY_PEER | ++ SSL_VERIFY_FAIL_IF_NO_PEER_CERT, ++ &ssl_verify_callback); ++ ++ if (crl_dir) { ++ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { ++ error("EAP-TLS: Failed to get certificate store"); ++ goto fail; ++ } ++ ++ if (!(lookup = ++ X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) { ++ error("EAP-TLS: Store lookup for CRL failed"); ++ ++ goto fail; ++ } ++ ++ X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM); ++ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); ++ } ++ ++ /* ++ * If a peer certificate file was specified, it must be valid, else fail ++ */ ++ if (peer_certfile[0]) { ++ if (!(tmp = get_X509_from_file(peer_certfile))) { ++ error("EAP-TLS: Error loading client certificate from file %s", ++ peer_certfile); ++ goto fail; ++ } ++ X509_free(tmp); ++ } ++ ++ return ctx; ++ ++fail: ++ log_ssl_errors(); ++ SSL_CTX_free(ctx); ++ return NULL; ++} ++ ++/* ++ * Determine the maximum packet size by looking at the LCP handshake ++ */ ++ ++int eaptls_get_mtu(int unit) ++{ ++ int mtu, mru; ++ ++ lcp_options *wo = &lcp_wantoptions[unit]; ++ lcp_options *go = &lcp_gotoptions[unit]; ++ lcp_options *ho = &lcp_hisoptions[unit]; ++ lcp_options *ao = &lcp_allowoptions[unit]; ++ ++ mtu = ho->neg_mru? ho->mru: PPP_MRU; ++ mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; ++ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; ++ ++ dbglog("MTU = %d", mtu); ++ return mtu; ++} ++ ++ ++/* ++ * Init the ssl handshake (server mode) ++ */ ++int eaptls_init_ssl_server(eap_state * esp) ++{ ++ struct eaptls_session *ets; ++ char servcertfile[MAXWORDLEN]; ++ char clicertfile[MAXWORDLEN]; ++ char cacertfile[MAXWORDLEN]; ++ char pkfile[MAXWORDLEN]; ++ /* ++ * Allocate new eaptls session ++ */ ++ esp->es_server.ea_session = malloc(sizeof(struct eaptls_session)); ++ if (!esp->es_server.ea_session) ++ fatal("Allocation error"); ++ ets = esp->es_server.ea_session; ++ ++ if (!esp->es_server.ea_peer) { ++ error("EAP-TLS: Error: client name not set (BUG)"); ++ return 0; ++ } ++ ++ strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); ++ ++ dbglog( "getting eaptls secret" ); ++ if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, ++ esp->es_server.ea_name, clicertfile, ++ servcertfile, cacertfile, pkfile, 1)) { ++ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", ++ esp->es_server.ea_peer, esp->es_server.ea_name ); ++ return 0; ++ } ++ ++ ets->mtu = eaptls_get_mtu(esp->es_unit); ++ ++ ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); ++ if (!ets->ctx) ++ goto fail; ++ ++ if (!(ets->ssl = SSL_new(ets->ctx))) ++ goto fail; ++ ++ /* ++ * Set auto-retry to avoid timeouts on BIO_read ++ */ ++ SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY); ++ ++ /* ++ * Initialize the BIOs we use to read/write to ssl engine ++ */ ++ ets->into_ssl = BIO_new(BIO_s_mem()); ++ ets->from_ssl = BIO_new(BIO_s_mem()); ++ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); ++ ++ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); ++ SSL_set_msg_callback_arg(ets->ssl, ets); ++ ++ /* ++ * Attach the session struct to the connection, so we can later ++ * retrieve it when doing certificate verification ++ */ ++ SSL_set_ex_data(ets->ssl, 0, ets); ++ ++ SSL_set_accept_state(ets->ssl); ++ ++ ets->data = NULL; ++ ets->datalen = 0; ++ ets->alert_sent = 0; ++ ets->alert_recv = 0; ++ ++ /* ++ * If we specified the client certificate file, store it in ets->peercertfile, ++ * so we can check it later in ssl_verify_callback() ++ */ ++ if (clicertfile[0]) ++ strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN); ++ else ++ ets->peercertfile[0] = 0; ++ ++ return 1; ++ ++fail: ++ SSL_CTX_free(ets->ctx); ++ return 0; ++} ++ ++/* ++ * Init the ssl handshake (client mode) ++ */ ++int eaptls_init_ssl_client(eap_state * esp) ++{ ++ struct eaptls_session *ets; ++ char servcertfile[MAXWORDLEN]; ++ char clicertfile[MAXWORDLEN]; ++ char cacertfile[MAXWORDLEN]; ++ char pkfile[MAXWORDLEN]; ++ ++ /* ++ * Allocate new eaptls session ++ */ ++ esp->es_client.ea_session = malloc(sizeof(struct eaptls_session)); ++ if (!esp->es_client.ea_session) ++ fatal("Allocation error"); ++ ets = esp->es_client.ea_session; ++ ++ /* ++ * If available, copy server name in ets; it will be used in cert ++ * verify ++ */ ++ if (esp->es_client.ea_peer) ++ strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); ++ else ++ ets->peer[0] = 0; ++ ++ ets->mtu = eaptls_get_mtu(esp->es_unit); ++ ++ dbglog( "calling get_eaptls_secret" ); ++ if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, ++ esp->es_client.ea_peer, clicertfile, ++ servcertfile, cacertfile, pkfile, 0)) { ++ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", ++ esp->es_client.ea_name, esp->es_client.ea_peer ); ++ return 0; ++ } ++ ++ dbglog( "calling eaptls_init_ssl" ); ++ ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); ++ if (!ets->ctx) ++ goto fail; ++ ++ ets->ssl = SSL_new(ets->ctx); ++ ++ if (!ets->ssl) ++ goto fail; ++ ++ /* ++ * Initialize the BIOs we use to read/write to ssl engine ++ */ ++ dbglog( "Initializing SSL BIOs" ); ++ ets->into_ssl = BIO_new(BIO_s_mem()); ++ ets->from_ssl = BIO_new(BIO_s_mem()); ++ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); ++ ++ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); ++ SSL_set_msg_callback_arg(ets->ssl, ets); ++ ++ /* ++ * Attach the session struct to the connection, so we can later ++ * retrieve it when doing certificate verification ++ */ ++ SSL_set_ex_data(ets->ssl, 0, ets); ++ ++ SSL_set_connect_state(ets->ssl); ++ ++ ets->data = NULL; ++ ets->datalen = 0; ++ ets->alert_sent = 0; ++ ets->alert_recv = 0; ++ ++ /* ++ * If we specified the server certificate file, store it in ++ * ets->peercertfile, so we can check it later in ++ * ssl_verify_callback() ++ */ ++ if (servcertfile[0]) ++ strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); ++ else ++ ets->peercertfile[0] = 0; ++ ++ return 1; ++ ++fail: ++ dbglog( "eaptls_init_ssl_client: fail" ); ++ SSL_CTX_free(ets->ctx); ++ return 0; ++ ++} ++ ++void eaptls_free_session(struct eaptls_session *ets) ++{ ++ if (ets->ssl) ++ SSL_free(ets->ssl); ++ ++ if (ets->ctx) ++ SSL_CTX_free(ets->ctx); ++ ++ free(ets); ++} ++ ++/* ++ * Handle a received packet, reassembling fragmented messages and ++ * passing them to the ssl engine ++ */ ++int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) ++{ ++ u_char flags; ++ u_int tlslen; ++ u_char dummy[65536]; ++ ++ GETCHAR(flags, inp); ++ len--; ++ ++ if (flags & EAP_TLS_FLAGS_LI && !ets->data) { ++ ++ /* ++ * This is the first packet of a message ++ */ ++ ++ GETLONG(tlslen, inp); ++ len -= 4; ++ ++ if (tlslen > EAP_TLS_MAX_LEN) { ++ error("Error: tls message length > %d, truncated", ++ EAP_TLS_MAX_LEN); ++ tlslen = EAP_TLS_MAX_LEN; ++ } ++ ++ /* ++ * Allocate memory for the whole message ++ */ ++ ets->data = malloc(tlslen); ++ if (!ets->data) ++ fatal("EAP TLS: allocation error\n"); ++ ++ ets->datalen = 0; ++ ets->tlslen = tlslen; ++ ++ } ++ else if (flags & EAP_TLS_FLAGS_LI && ets->data) { ++ /* ++ * Non first with LI (strange...) ++ */ ++ ++ GETLONG(tlslen, inp); ++ len -= 4; ++ ++ } ++ else if (!ets->data) { ++ /* ++ * A non fragmented message without LI flag ++ */ ++ ++ ets->data = malloc(len); ++ if (!ets->data) ++ fatal("EAP TLS: allocation error\n"); ++ ++ ets->datalen = 0; ++ ets->tlslen = len; ++ } ++ ++ if (flags & EAP_TLS_FLAGS_MF) ++ ets->frag = 1; ++ else ++ ets->frag = 0; ++ ++ if (len + ets->datalen > ets->tlslen) { ++ warn("EAP TLS: received data > TLS message length"); ++ return 1; ++ } ++ ++ BCOPY(inp, ets->data + ets->datalen, len); ++ ets->datalen += len; ++ ++ if (!ets->frag) { ++ ++ /* ++ * If we have the whole message, pass it to ssl ++ */ ++ ++ if (ets->datalen != ets->tlslen) { ++ warn("EAP TLS: received data != TLS message length"); ++ return 1; ++ } ++ ++ if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1) ++ log_ssl_errors(); ++ ++ SSL_read(ets->ssl, dummy, 65536); ++ ++ free(ets->data); ++ ets->data = NULL; ++ ets->datalen = 0; ++ } ++ ++ return 0; ++} ++ ++/* ++ * Return an eap-tls packet in outp. ++ * A TLS message read from the ssl engine is buffered in ets->data. ++ * At each call we control if there is buffered data and send a ++ * packet of mtu bytes. ++ */ ++int eaptls_send(struct eaptls_session *ets, u_char ** outp) ++{ ++ bool first = 0; ++ int size; ++ u_char fromtls[65536]; ++ int res; ++ u_char *start; ++ ++ start = *outp; ++ ++ if (!ets->data) { ++ ++ if(!ets->alert_sent) ++ SSL_read(ets->ssl, fromtls, 65536); ++ ++ /* ++ * Read from ssl ++ */ ++ if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) ++ fatal("No data from BIO_read"); ++ ++ ets->datalen = res; ++ ++ ets->data = malloc(ets->datalen); ++ BCOPY(fromtls, ets->data, ets->datalen); ++ ++ ets->offset = 0; ++ first = 1; ++ ++ } ++ ++ size = ets->datalen - ets->offset; ++ ++ if (size > ets->mtu) { ++ size = ets->mtu; ++ ets->frag = 1; ++ } else ++ ets->frag = 0; ++ ++ PUTCHAR(EAPT_TLS, *outp); ++ ++ /* ++ * Set right flags and length if necessary ++ */ ++ if (ets->frag && first) { ++ PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp); ++ PUTLONG(ets->datalen, *outp); ++ } else if (ets->frag) { ++ PUTCHAR(EAP_TLS_FLAGS_MF, *outp); ++ } else ++ PUTCHAR(0, *outp); ++ ++ /* ++ * Copy the data in outp ++ */ ++ BCOPY(ets->data + ets->offset, *outp, size); ++ INCPTR(size, *outp); ++ ++ /* ++ * Copy the packet in retransmission buffer ++ */ ++ BCOPY(start, &ets->rtx[0], *outp - start); ++ ets->rtx_len = *outp - start; ++ ++ ets->offset += size; ++ ++ if (ets->offset >= ets->datalen) { ++ ++ /* ++ * The whole message has been sent ++ */ ++ ++ free(ets->data); ++ ets->data = NULL; ++ ets->datalen = 0; ++ ets->offset = 0; ++ } ++ ++ return 0; ++} ++ ++/* ++ * Get the sent packet from the retransmission buffer ++ */ ++void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp) ++{ ++ BCOPY(ets->rtx, *outp, ets->rtx_len); ++ INCPTR(ets->rtx_len, *outp); ++} ++ ++/* ++ * Verify a certificate. ++ * Most of the work (signatures and issuer attributes checking) ++ * is done by ssl; we check the CN in the peer certificate ++ * against the peer name. ++ */ ++int ssl_verify_callback(int preverify_ok, X509_STORE_CTX * ctx) ++{ ++ char subject[256]; ++ char cn_str[256]; ++ X509 *peer_cert; ++ int err, depth; ++ int ok = preverify_ok; ++ SSL *ssl; ++ struct eaptls_session *ets; ++ ++ peer_cert = X509_STORE_CTX_get_current_cert(ctx); ++ err = X509_STORE_CTX_get_error(ctx); ++ depth = X509_STORE_CTX_get_error_depth(ctx); ++ ++ dbglog("certificate verify depth: %d", depth); ++ ++ if (auth_required && !ok) { ++ X509_NAME_oneline(X509_get_subject_name(peer_cert), ++ subject, 256); ++ ++ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), ++ NID_commonName, cn_str, 256); ++ ++ dbglog("Certificate verification error:\n depth: %d CN: %s" ++ "\n err: %d (%s)\n", depth, cn_str, err, ++ X509_verify_cert_error_string(err)); ++ ++ return 0; ++ } ++ ++ ssl = X509_STORE_CTX_get_ex_data(ctx, ++ SSL_get_ex_data_X509_STORE_CTX_idx()); ++ ++ ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0); ++ ++ if (ets == NULL) { ++ error("Error: SSL_get_ex_data returned NULL"); ++ return 0; ++ } ++ ++ log_ssl_errors(); ++ ++ if (!depth) { /* This is the peer certificate */ ++ ++ X509_NAME_oneline(X509_get_subject_name(peer_cert), ++ subject, 256); ++ ++ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), ++ NID_commonName, cn_str, 256); ++ ++ /* ++ * If acting as client and the name of the server wasn't specified ++ * explicitely, we can't verify the server authenticity ++ */ ++ if (!ets->peer[0]) { ++ warn("Peer name not specified: no check"); ++ return 1; ++ } ++ ++ /* ++ * Check the CN ++ */ ++ if (strcmp(cn_str, ets->peer)) { ++ error ++ ("Certificate verification error: CN (%s) != peer_name (%s)", ++ cn_str, ets->peer); ++ return 0; ++ } ++ ++ warn("Certificate CN: %s , peer name %s", cn_str, ets->peer); ++ ++ /* ++ * If a peer certificate file was specified, here we check it ++ */ ++ if (ets->peercertfile[0]) { ++ if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert) ++ != 0) { ++ error ++ ("Peer certificate doesn't match stored certificate"); ++ return 0; ++ } ++ } ++ } ++ ++ return 1; ++} ++ ++/* ++ * Compare a certificate with the one stored in a file ++ */ ++int ssl_cmp_certs(char *filename, X509 * a) ++{ ++ X509 *b; ++ int ret; ++ ++ if (!(b = get_X509_from_file(filename))) ++ return 1; ++ ++ ret = X509_cmp(a, b); ++ X509_free(b); ++ ++ return ret; ++ ++} ++ ++X509 *get_X509_from_file(char *filename) ++{ ++ FILE *fp; ++ X509 *ret; ++ ++ if (!(fp = fopen(filename, "r"))) ++ return NULL; ++ ++ ret = PEM_read_X509(fp, NULL, NULL, NULL); ++ ++ fclose(fp); ++ ++ return ret; ++} ++ ++/* ++ * Every sent & received message this callback function is invoked, ++ * so we know when alert messages have arrived or are sent and ++ * we can print debug information about TLS handshake. ++ */ ++void ++ssl_msg_callback(int write_p, int version, int content_type, ++ const void *buf, size_t len, SSL * ssl, void *arg) ++{ ++ char string[256]; ++ struct eaptls_session *ets = (struct eaptls_session *)arg; ++ unsigned char code; ++ ++ if(write_p) ++ strcpy(string, " -> "); ++ else ++ strcpy(string, " <- "); ++ ++ ++ switch(content_type) { ++ ++ case SSL3_RT_ALERT: ++ strcat(string, "Alert: "); ++ code = ((const unsigned char *)buf)[1]; ++ ++ if (write_p) { ++ ets->alert_sent = 1; ++ ets->alert_sent_desc = code; ++ } else { ++ ets->alert_recv = 1; ++ ets->alert_recv_desc = code; ++ } ++ ++ strcat(string, SSL_alert_desc_string_long(code)); ++ break; ++ ++ case SSL3_RT_CHANGE_CIPHER_SPEC: ++ strcat(string, "ChangeCipherSpec"); ++ break; ++ ++ case SSL3_RT_HANDSHAKE: ++ ++ strcat(string, "Handshake: "); ++ code = ((const unsigned char *)buf)[0]; ++ ++ switch(code) { ++ case SSL3_MT_HELLO_REQUEST: ++ strcat(string,"Hello Request"); ++ break; ++ case SSL3_MT_CLIENT_HELLO: ++ strcat(string,"Client Hello"); ++ break; ++ case SSL3_MT_SERVER_HELLO: ++ strcat(string,"Server Hello"); ++ break; ++ case SSL3_MT_CERTIFICATE: ++ strcat(string,"Certificate"); ++ break; ++ case SSL3_MT_SERVER_KEY_EXCHANGE: ++ strcat(string,"Server Key Exchange"); ++ break; ++ case SSL3_MT_CERTIFICATE_REQUEST: ++ strcat(string,"Certificate Request"); ++ break; ++ case SSL3_MT_SERVER_DONE: ++ strcat(string,"Server Hello Done"); ++ break; ++ case SSL3_MT_CERTIFICATE_VERIFY: ++ strcat(string,"Certificate Verify"); ++ break; ++ case SSL3_MT_CLIENT_KEY_EXCHANGE: ++ strcat(string,"Client Key Exchange"); ++ break; ++ case SSL3_MT_FINISHED: ++ strcat(string,"Finished"); ++ break; ++ ++ default: ++ sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); ++ } ++ break; ++ ++ default: ++ sprintf( string, "SSL message contains unknown content type: %d", content_type ); ++ ++ } ++ ++ /* Alert messages must always be displayed */ ++ if(content_type == SSL3_RT_ALERT) ++ error("%s", string); ++ else ++ dbglog("%s", string); ++} ++ +--- ppp-2.4.6/pppd/eap-tls.h ++++ ppp-2.4.6/pppd/eap-tls.h +@@ -0,0 +1,107 @@ ++/* ++ * eap-tls.h ++ * ++ * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in ++ * the documentation and/or other materials provided with the ++ * distribution. ++ * ++ * 3. The name(s) of the authors of this software must not be used to ++ * endorse or promote products derived from this software without ++ * prior written permission. ++ * ++ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO ++ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY ++ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY ++ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN ++ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING ++ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ * ++ */ ++ ++#ifndef __EAP_TLS_H__ ++#define __EAP_TLS_H__ ++ ++#include "eap.h" ++ ++#include ++#include ++#include ++ ++#define EAP_TLS_FLAGS_LI 128 /* length included flag */ ++#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ ++#define EAP_TLS_FLAGS_START 32 /* start flag */ ++ ++#define EAP_TLS_MAX_LEN 65536 /* max eap tls packet size */ ++ ++struct eaptls_session ++{ ++ u_char *data; /* buffered data */ ++ int datalen; /* buffered data len */ ++ int offset; /* from where to send */ ++ int tlslen; /* total length of tls data */ ++ bool frag; /* packet is fragmented */ ++ SSL_CTX *ctx; ++ SSL *ssl; /* ssl connection */ ++ BIO *from_ssl; ++ BIO *into_ssl; ++ char peer[MAXWORDLEN]; /* peer name */ ++ char peercertfile[MAXWORDLEN]; ++ bool alert_sent; ++ u_char alert_sent_desc; ++ bool alert_recv; ++ u_char alert_recv_desc; ++ char rtx[65536]; /* retransmission buffer */ ++ int rtx_len; ++ int mtu; /* unit mtu */ ++}; ++ ++typedef struct pw_cb_data ++{ ++ const void *password; ++ const char *prompt_info; ++} PW_CB_DATA; ++ ++ ++int ssl_verify_callback(int, X509_STORE_CTX *); ++void ssl_msg_callback(int write_p, int version, int ct, const void *buf, ++ size_t len, SSL * ssl, void *arg); ++ ++X509 *get_X509_from_file(char *filename); ++int ssl_cmp_certs(char *filename, X509 * a); ++ ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++ char *certfile, char *peer_certfile, char *privkeyfile); ++int eaptls_init_ssl_server(eap_state * esp); ++int eaptls_init_ssl_client(eap_state * esp); ++void eaptls_free_session(struct eaptls_session *ets); ++ ++int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); ++int eaptls_send(struct eaptls_session *ets, u_char ** outp); ++void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); ++ ++int get_eaptls_secret(int unit, char *client, char *server, ++ char *clicertfile, char *servcertfile, char *cacertfile, ++ char *pkfile, int am_server); ++ ++#ifdef MPPE ++#include "mppe.h" /* MPPE_MAX_KEY_LEN */ ++extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; ++extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; ++extern int mppe_keys_set; ++ ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); ++ ++#endif ++ ++#endif +--- ppp-2.4.6/pppd/Makefile.linux ++++ ppp-2.4.6/pppd/Makefile.linux +@@ -76,6 +76,9 @@ + # Use libutil + USE_LIBUTIL=y + ++# Enable EAP-TLS authentication (requires libssl and libcrypto) ++USE_EAPTLS=y ++ + MAXOCTETS=y + + INCLUDE_DIRS= -I../include +@@ -115,6 +118,15 @@ + PPPDOBJS += sha1.o + endif + ++# EAP-TLS ++ifdef USE_EAPTLS ++CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include ++LIBS += -lssl -lcrypto ++PPPDSRC += eap-tls.c ++HEADERS += eap-tls.h ++PPPDOBJS += eap-tls.o ++endif ++ + ifdef HAS_SHADOW + CFLAGS += -DHAS_SHADOW + #LIBS += -lshadow $(LIBS) +--- ppp-2.4.6/pppd/md5.c ++++ ppp-2.4.6/pppd/md5.c +@@ -33,6 +33,8 @@ + *********************************************************************** + */ + ++#ifndef USE_EAPTLS ++ + #include + #include "md5.h" + +@@ -305,3 +307,5 @@ + ** End of md5.c ** + ******************************** (cut) ******************************** + */ ++#endif /* USE_EAPTLS */ ++ +--- ppp-2.4.6/pppd/md5.h ++++ ppp-2.4.6/pppd/md5.h +@@ -36,6 +36,7 @@ + ** documentation and/or software. ** + *********************************************************************** + */ ++#ifndef USE_EAPTLS + + #ifndef __MD5_INCLUDE__ + +@@ -63,3 +64,5 @@ + + #define __MD5_INCLUDE__ + #endif /* __MD5_INCLUDE__ */ ++ ++#endif /* USE_EAPTLS */ +--- ppp-2.4.6/pppd/options.c ++++ ppp-2.4.6/pppd/options.c +@@ -122,6 +122,11 @@ + int child_wait = 5; /* # seconds to wait for children at exit */ + struct userenv *userenv_list; /* user environment variables */ + ++#ifdef USE_EAPTLS ++bool only_update_crl_server = 0; /* update server crl and exit */ ++bool only_update_crl_client = 0; /* update client crl and exit */ ++#endif /* USE_EAPTLS */ ++ + #ifdef MAXOCTETS + unsigned int maxoctets = 0; /* default - no limit */ + int maxoctets_dir = 0; /* default - sum of traffic */ +@@ -338,6 +343,12 @@ + { "mo-timeout", o_int, &maxoctets_timeout, + "Check for traffic limit every N seconds", OPT_PRIO | OPT_LLIMIT | 1 }, + #endif ++#ifdef USE_EAPTLS ++ { "only-update-crl-server", o_bool, &only_update_crl_server, ++ "Update server CA CRLs and exit", 1 }, ++ { "only-update-crl-client", o_bool, &only_update_crl_client, ++ "Update client CA CRLs and exit", 1 }, ++#endif /* USE_EAPTLS */ + + { NULL } + }; +--- ppp-2.4.6/pppd/pathnames.h ++++ ppp-2.4.6/pppd/pathnames.h +@@ -21,6 +21,13 @@ + #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" + #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" + #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" ++ ++#ifdef USE_EAPTLS ++#define _PATH_EAPTLSCLIFILE _ROOT_PATH "/etc/ppp/eaptls-client" ++#define _PATH_EAPTLSSERVFILE _ROOT_PATH "/etc/ppp/eaptls-server" ++#define _PATH_OPENSSLCONFFILE _ROOT_PATH "/etc/ppp/openssl.cnf" ++#endif /* USE_EAPTLS */ ++ + #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" + #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" + #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" +--- ppp-2.4.6/pppd/plugins/Makefile.linux ++++ ppp-2.4.6/pppd/plugins/Makefile.linux +@@ -4,6 +4,9 @@ + LDFLAGS = -shared + INSTALL = install + ++# EAP-TLS ++CFLAGS += -DUSE_EAPTLS=1 ++ + DESTDIR = $(INSTROOT)@DESTDIR@ + BINDIR = $(DESTDIR)/sbin + MANDIR = $(DESTDIR)/share/man/man8 +--- ppp-2.4.6/pppd/plugins/passprompt.c ++++ ppp-2.4.6/pppd/plugins/passprompt.c +@@ -107,4 +107,7 @@ + { + add_options(options); + pap_passwd_hook = promptpass; ++#ifdef USE_EAPTLS ++ eaptls_passwd_hook = promptpass; ++#endif + } +--- ppp-2.4.6/pppd/plugins/passwordfd.c ++++ ppp-2.4.6/pppd/plugins/passwordfd.c +@@ -79,4 +79,8 @@ + + chap_check_hook = pwfd_check; + chap_passwd_hook = pwfd_passwd; ++ ++#ifdef USE_EAPTLS ++ eaptls_passwd_hook = pwfd_passwd; ++#endif + } +--- ppp-2.4.6/pppd/pppd.h ++++ ppp-2.4.6/pppd/pppd.h +@@ -324,6 +324,10 @@ + extern bool dryrun; /* check everything, print options, exit */ + extern int child_wait; /* # seconds to wait for children at end */ + ++#ifdef USE_EAPTLS ++extern char *crl_dir; ++#endif /* USE_EAPTLS */ ++ + #ifdef MAXOCTETS + extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ + extern int maxoctets_dir; /* Direction : +@@ -738,6 +742,10 @@ + extern int (*chap_passwd_hook) __P((char *user, char *passwd)); + extern void (*multilink_join_hook) __P((void)); + ++#ifdef USE_EAPTLS ++extern int (*eaptls_passwd_hook) __P((char *user, char *passwd)); ++#endif ++ + /* Let a plugin snoop sent and received packets. Useful for L2TP */ + extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); + extern void (*snoop_send_hook) __P((unsigned char *p, int len)); +--- ppp-2.4.6/README.eap-tls ++++ ppp-2.4.6/README.eap-tls +@@ -0,0 +1,169 @@ ++EAP-TLS authentication support for PPP ++====================================== ++ ++1. Intro ++ ++ The Extensible Authentication Protocol (EAP; RFC 3748) is a ++ security protocol that can be used with PPP. It provides a means ++ to plug in multiple optional authentication methods. ++ ++ Transport Level Security (TLS; RFC 2246) provides for mutual ++ authentication, integrity-protected ciphersuite negotiation and ++ key exchange between two endpoints. It also provides for optional ++ MPPE encryption. ++ ++ EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets, ++ allowing TLS mutual authentication to be used as a generic EAP ++ mechanism. It also provides optional encryption using the MPPE ++ protocol. ++ ++ This patch provide EAP-TLS support to pppd. ++ This authentication method can be used in both client or server ++ mode. ++ ++2. Building ++ ++ To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org) ++ is required. Any version from 0.9.7 should work. ++ ++ Configure, compile, and install as usual. ++ ++3. Configuration ++ ++ On the client side there are two ways to configure EAP-TLS: ++ ++ 1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters ++ ++ 2. edit the /etc/ppp/eaptls-client file. ++ Insert a line for each system with which you use EAP-TLS. ++ The line is composed of this fields separated by tab: ++ ++ - Client name ++ The name used by the client for authentication, can be * ++ - Server name ++ The name of the server, can be * ++ - Client certificate file ++ The file containing the certificate chain for the ++ client in PEM format ++ - Server certificate file ++ If you want to specify the certificate that the ++ server is allowed to use, put the certificate file name. ++ Else put a dash '-'. ++ - CA certificate file ++ The file containing the trusted CA certificates in PEM ++ format. ++ - Client private key file ++ The file containing the client private key in PEM format. ++ ++ ++ On the server side edit the /etc/ppp/eaptls-server file. ++ Insert a line for each system with which you use EAP-TLS. ++ The line is composed of this fields separated by tab: ++ ++ - Client name ++ The name used by the client for authentication, can be * ++ - Server name ++ The name of the server, can be * ++ - Client certificate file ++ If you want to specify the certificate that the ++ client is allowed to use, put the certificate file name. ++ Else put a dash '-'. ++ - Server certificate file ++ The file containing the certificate chain for the ++ server in PEM format ++ - CA certificate file ++ The file containing the trusted CA certificates in PEM ++ format. ++ - Client private key file ++ The file containing the server private key in PEM format. ++ - addresses ++ A list of IP addresses the client is allowed to use. ++ ++ ++ OpenSSL engine support is included starting with v0.95 of this patch. ++ Currently the only engine tested is the 'pkcs11' engine (hardware token ++ support). To use the 'pksc11' engine: ++ - Use a special private key fileiname in the /etc/ppp/eaptls-client file: ++ : ++ e.g. ++ pkcs11:123456 ++ ++ - The certificate can also be loaded from the 'pkcs11' engine using ++ a special client certificate filename in the /etc/ppp/eaptls-client file: ++ : ++ e.g. ++ pkcs11:123456 ++ ++ - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior ++ to starting 'pppd'. A sample openssl.cnf file is ++ ++ openssl_conf = openssl_def ++ ++ [ openssl_def ] ++ engines = engine_section ++ ++ [ engine_section ] ++ pkcs11 = pkcs11_section ++ ++ [ pkcs11_section ] ++ engine_id = pkcs11 ++ dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so ++ MODULE_PATH = /usr/lib64/libeTPkcs11.so ++ init = 0 ++ ++ - There are two ways to specify a password/PIN for the PKCS11 engine: ++ - inside the openssl.cnf file using ++ PIN = your-secret-pin ++ Note The keyword 'PIN' is case sensitive! ++ - Using the 'password' in the ppp options file. ++ From v0.97 of the eap-tls patch the password can also be supplied ++ using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c ++ for an example). ++ ++ ++4. Options ++ ++ These pppd options are available: ++ ++ ca ++ Use the CA public certificate found in in PEM format ++ cert ++ Use the client public certificate found in in PEM format ++ or in engine:engine_id format ++ key ++ Use the client private key found in in PEM format ++ or in engine:engine_id format ++ crl-dir ++ Use CRL files from dir. It contains CRL files in PEM ++ format and each file contains a CRL. The files are looked up ++ by the issuer name hash value. Use the c_rehash utility ++ to create necessary links. ++ need-peer-eap ++ If the peer doesn't ask us to authenticate or doesn't use eap ++ to authenticate us, disconnect. ++ ++ Note: ++ password-encrypted certificates can be used as of v0.94 of this ++ patch. The password for the eap-tls.key file is specified using ++ the regular ++ password .... ++ statement in the ppp options file, or by using the appropriate ++ plugin which supplies a 'eaptls_passwd_hook' routine. ++ ++5. Connecting ++ ++ If you're setting up a pppd server, edit the EAP-TLS configuration file ++ as written above and then run pppd with the 'auth' option to authenticate ++ the client. The EAP-TLS method will be used if the other eap methods can't ++ be used (no secrets). ++ ++ If you're setting up a client, edit the configuration file and then run ++ pppd with 'remotename' option to specify the server name. Add the ++ 'need-peer-eap' option if you want to be sure the peer ask you to ++ authenticate (and to use eap) and to disconnect if it doesn't. ++ ++6. Notes ++ ++ This is experimental code. ++ Send suggestions and comments to Jan Just Keijser ++ diff --git a/network/connection/ppp/files/gentoo/85_all_dhcp-make-vars.patch b/network/connection/ppp/files/gentoo/85_all_dhcp-make-vars.patch new file mode 100644 index 0000000000..68af3aaf30 --- /dev/null +++ b/network/connection/ppp/files/gentoo/85_all_dhcp-make-vars.patch @@ -0,0 +1,19 @@ +--- ppp-2.4.3/pppd/plugins/dhcp/Makefile.linux ++++ ppp-2.4.3/pppd/plugins/dhcp/Makefile.linux +@@ -1,6 +1,6 @@ + + PLUGIN=dhcpc.so +-CFLAGS=-I../.. -I../../../include -O2 ++CFLAGS=$(COPTS) -I../.. -I../../../include -fPIC + + all: $(PLUGIN) + +@@ -9,7 +9,7 @@ + $(INSTALL) -s -c -m 755 dhcpc.so $(LIBDIR) + + dhcpc.so: dhcpc.o clientpacket.o packet.o socket.o options.o +- gcc -o dhcpc.so -shared dhcpc.o clientpacket.o packet.o socket.o options.o ++ $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ + + + clean: diff --git a/network/connection/ppp/files/gentoo/86_all_dhcp-sys_error_to_strerror.patch b/network/connection/ppp/files/gentoo/86_all_dhcp-sys_error_to_strerror.patch new file mode 100644 index 0000000000..e0d0937b2f --- /dev/null +++ b/network/connection/ppp/files/gentoo/86_all_dhcp-sys_error_to_strerror.patch @@ -0,0 +1,128 @@ +--- ppp-2.4.2/pppd/plugins/dhcp/dhcpc.c ++++ ppp-2.4.2/pppd/plugins/dhcp/dhcpc.c +@@ -144,7 +144,7 @@ + fd = raw_socket(client_config.ifindex); + + if (listen_mode != LISTEN_NONE && fd < 0) { +- fatal("DHCPC: couldn't listen on socket, %s", sys_errlist[errno]); ++ fatal("DHCPC: couldn't listen on socket, %s", strerror(errno)); + } + + } +@@ -208,7 +208,7 @@ + len = get_packet(&packet, fd); + + if (len == -1 && errno != EINTR) { +- dbglog("DHCPC: error on read, %s, reopening socket", sys_errlist[errno]); ++ dbglog("DHCPC: error on read, %s, reopening socket", strerror(errno)); + change_mode(LISTEN_KERNEL); + } + if (len < 0) continue; +@@ -380,7 +380,7 @@ + else len = get_raw_packet(&packet, fd); + + if (len == -1 && errno != EINTR) { +- dbglog("DHCPC: error on read, %s, reopening socket", sys_errlist[errno]); ++ dbglog("DHCPC: error on read, %s, reopening socket", strerror(errno)); + change_mode(listen_mode); /* just close and reopen */ + } + if (len < 0) continue; +@@ -445,7 +445,7 @@ + + } else { + /* An error occured */ +- dbglog("DHCPC: error on select, %s, reopening socket", sys_errlist[errno]); ++ dbglog("DHCPC: error on select, %s, reopening socket", strerror(errno)); + change_mode(listen_mode); /* just close and reopen */ + } + +--- ppp-2.4.2/pppd/plugins/dhcp/packet.c ++++ ppp-2.4.2/pppd/plugins/dhcp/packet.c +@@ -125,7 +125,7 @@ + return kernel_packet(payload,payload->giaddr,CLIENT_PORT,dest_ip,dest_port); + + if ((fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))) < 0) { +- DEBUG(LOG_ERR, "socket call failed: %s", sys_errlist[errno]); ++ DEBUG(LOG_ERR, "socket call failed: %s", strerror(errno)); + return -1; + } + +@@ -138,7 +138,7 @@ + dest.sll_halen = 6; + memcpy(dest.sll_addr, dest_arp, 6); + if (bind(fd, (struct sockaddr *)&dest, sizeof(struct sockaddr_ll)) < 0) { +- DEBUG(LOG_ERR, "bind call failed: %s", sys_errlist[errno]); ++ DEBUG(LOG_ERR, "bind call failed: %s", strerror(errno)); + close(fd); + return -1; + } +@@ -161,7 +161,7 @@ + + result = sendto(fd, &packet, sizeof(struct udp_dhcp_packet), 0, (struct sockaddr *) &dest, sizeof(dest)); + if (result <= 0) { +- DEBUG(LOG_ERR, "write on socket failed: %s", sys_errlist[errno]); ++ DEBUG(LOG_ERR, "write on socket failed: %s", strerror(errno)); + } + close(fd); + return result; +--- ppp-2.4.2/pppd/plugins/dhcp/socket.c ++++ ppp-2.4.2/pppd/plugins/dhcp/socket.c +@@ -60,7 +60,7 @@ + *addr = sin->sin_addr.s_addr; + DEBUG(LOG_INFO, "%s (our ip) = %s", ifr.ifr_name, inet_ntoa(sin->sin_addr)); + } else { +- LOG(LOG_ERR, "SIOCGIFADDR failed!: %s", sys_errlist[errno]); ++ LOG(LOG_ERR, "SIOCGIFADDR failed!: %s", strerror(errno)); + return -1; + } + } +@@ -69,7 +69,7 @@ + DEBUG(LOG_INFO, "adapter index %d", ifr.ifr_ifindex); + *ifindex = ifr.ifr_ifindex; + } else { +- LOG(LOG_ERR, "SIOCGIFINDEX failed!: %s", sys_errlist[errno]); ++ LOG(LOG_ERR, "SIOCGIFINDEX failed!: %s", strerror(errno)); + return -1; + } + if (ioctl(fd, SIOCGIFHWADDR, &ifr) == 0) { +@@ -77,11 +77,11 @@ + DEBUG(LOG_INFO, "adapter hardware address %02x:%02x:%02x:%02x:%02x:%02x", + arp[0], arp[1], arp[2], arp[3], arp[4], arp[5]); + } else { +- LOG(LOG_ERR, "SIOCGIFHWADDR failed!: %s", sys_errlist[errno]); ++ LOG(LOG_ERR, "SIOCGIFHWADDR failed!: %s", strerror(errno)); + return -1; + } + } else { +- LOG(LOG_ERR, "socket failed!: %s", sys_errlist[errno]); ++ LOG(LOG_ERR, "socket failed!: %s", strerror(errno)); + return -1; + } + close(fd); +@@ -98,7 +98,7 @@ + + DEBUG(LOG_INFO, "Opening listen socket on 0x%08x:%d %s\n", ip, port, inf ? inf : "*"); + if ((fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) { +- DEBUG(LOG_ERR, "socket call failed: %s", sys_errlist[errno]); ++ DEBUG(LOG_ERR, "socket call failed: %s", strerror(errno)); + return -1; + } + +@@ -144,7 +144,7 @@ + + DEBUG(LOG_INFO, "Opening raw socket on ifindex %d\n", ifindex); + if ((fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))) < 0) { +- DEBUG(LOG_ERR, "socket call failed: %s", sys_errlist[errno]); ++ DEBUG(LOG_ERR, "socket call failed: %s", strerror(errno)); + return -1; + } + +@@ -152,7 +152,7 @@ + sock.sll_protocol = htons(ETH_P_IP); + sock.sll_ifindex = ifindex; + if (bind(fd, (struct sockaddr *) &sock, sizeof(sock)) < 0) { +- DEBUG(LOG_ERR, "bind call failed: %s", sys_errlist[errno]); ++ DEBUG(LOG_ERR, "bind call failed: %s", strerror(errno)); + close(fd); + return -1; + } diff --git a/network/connection/ppp/files/ip-down b/network/connection/ppp/files/ip-down new file mode 100644 index 0000000000..77e05655a5 --- /dev/null +++ b/network/connection/ppp/files/ip-down @@ -0,0 +1,37 @@ +#!/bin/sh + +# this is a script which is executed after disconnecting the ppp interface. +# look at man pppd for details + +# the followings parameters are available: +# $1 = interface-name +# $2 = tty-device +# $3 = speed +# $4 = local-IP-address +# $5 = remote-IP-address +# $6 = ipparam + +if [ "$USEPEERDNS" ]; then + + # taken from debian's 0000usepeerdns + # follow any symlink to find the real file + REALRESOLVCONF=$(readlink --canonicalize /etc/resolv.conf) + + if [ "$REALRESOLVCONF" != "/etc/ppp/resolv.conf" ]; then + + # if an old resolv.conf file exists, restore it + if [ -e $REALRESOLVCONF.pppd-backup ]; then + mv $REALRESOLVCONF.pppd-backup $REALRESOLVCONF + fi + + fi + +fi + +# Recreate the default route so autodial works +[ -s /etc/conf.d/net ] && . /etc/conf.d/net +if [ -n "${gateway}" ] && [ "${gateway%/*}" = "$1" ]; then + /sbin/route add default dev ${gateway%/*} +fi + +[ -f /etc/ppp/ip-down.local ] && . /etc/ppp/ip-down.local "$@" diff --git a/network/connection/ppp/files/ip-up b/network/connection/ppp/files/ip-up new file mode 100644 index 0000000000..81fee89ec6 --- /dev/null +++ b/network/connection/ppp/files/ip-up @@ -0,0 +1,42 @@ +#!/bin/sh + +# this is a script which is executed after connecting the ppp interface. +# look at man pppd for details + +# the followings parameters are available: +# $1 = interface-name +# $2 = tty-device +# $3 = speed +# $4 = local-IP-address +# $5 = remote-IP-address +# $6 = ipparam + +if [ "$USEPEERDNS" ]; then + + # add the server supplied DNS entries to /etc/resolv.conf + # (taken from debian's 0000usepeerdns) + + # follow any symlink to find the real file + REALRESOLVCONF=$(readlink --canonicalize /etc/resolv.conf) + + if [ "$REALRESOLVCONF" != "/etc/ppp/resolv.conf" ]; then + + # merge the new nameservers with the other options from the old configuration + { + grep '^nameserver[[:space:]]' $REALRESOLVCONF + cat /etc/ppp/resolv.conf + } > $REALRESOLVCONF.tmp + + # backup the old configuration and install the new one + cp -a $REALRESOLVCONF $REALRESOLVCONF.pppd-backup + mv $REALRESOLVCONF.tmp $REALRESOLVCONF + + # correct permissions + chmod 0644 /etc/resolv.conf + chown root:root /etc/resolv.conf + + fi + +fi + +[ -f /etc/ppp/ip-up.local ] && . /etc/ppp/ip-up.local "$@" diff --git a/network/connection/ppp/files/nostrip.patch b/network/connection/ppp/files/nostrip.patch new file mode 100644 index 0000000000..342eb04f72 --- /dev/null +++ b/network/connection/ppp/files/nostrip.patch @@ -0,0 +1,92 @@ +Index: ppp-2.4.5/chat/Makefile.linux +=================================================================== +--- ppp-2.4.5.orig/chat/Makefile.linux ++++ ppp-2.4.5/chat/Makefile.linux +@@ -25,7 +25,7 @@ chat.o: chat.c + + install: chat + mkdir -p $(BINDIR) $(MANDIR) +- $(INSTALL) -s -c chat $(BINDIR) ++ $(INSTALL) -c chat $(BINDIR) + $(INSTALL) -c -m 644 chat.8 $(MANDIR) + + clean: +Index: ppp-2.4.5/pppd/Makefile.linux +=================================================================== +--- ppp-2.4.5.orig/pppd/Makefile.linux ++++ ppp-2.4.5/pppd/Makefile.linux +@@ -100,7 +100,7 @@ ifdef USE_SRP + CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include + LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto + TARGETS += srp-entry +-EXTRAINSTALL = $(INSTALL) -s -c -m 555 srp-entry $(BINDIR)/srp-entry ++EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry + MANPAGES += srp-entry.8 + EXTRACLEAN += srp-entry.o + NEEDDES=y +@@ -201,7 +201,7 @@ all: $(TARGETS) + install: pppd + mkdir -p $(BINDIR) $(MANDIR) + $(EXTRAINSTALL) +- $(INSTALL) -s -c -m 555 pppd $(BINDIR)/pppd ++ $(INSTALL) -c -m 555 pppd $(BINDIR)/pppd + if chgrp pppusers $(BINDIR)/pppd 2>/dev/null; then \ + chmod o-rx,u+s $(BINDIR)/pppd; fi + $(INSTALL) -c -m 444 pppd.8 $(MANDIR) +Index: ppp-2.4.5/pppd/plugins/radius/Makefile.linux +=================================================================== +--- ppp-2.4.5.orig/pppd/plugins/radius/Makefile.linux ++++ ppp-2.4.5/pppd/plugins/radius/Makefile.linux +@@ -36,9 +36,9 @@ all: $(PLUGIN) + + install: all + $(INSTALL) -d -m 755 $(LIBDIR) +- $(INSTALL) -s -c -m 755 radius.so $(LIBDIR) +- $(INSTALL) -s -c -m 755 radattr.so $(LIBDIR) +- $(INSTALL) -s -c -m 755 radrealms.so $(LIBDIR) ++ $(INSTALL) -c -m 755 radius.so $(LIBDIR) ++ $(INSTALL) -c -m 755 radattr.so $(LIBDIR) ++ $(INSTALL) -c -m 755 radrealms.so $(LIBDIR) + $(INSTALL) -c -m 444 pppd-radius.8 $(MANDIR) + $(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR) + +Index: ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux +=================================================================== +--- ppp-2.4.5.orig/pppd/plugins/rp-pppoe/Makefile.linux ++++ ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux +@@ -43,9 +43,9 @@ rp-pppoe.so: plugin.o discovery.o if.o c + + install: all + $(INSTALL) -d -m 755 $(LIBDIR) +- $(INSTALL) -s -c -m 4550 rp-pppoe.so $(LIBDIR) ++ $(INSTALL) -c -m 4550 rp-pppoe.so $(LIBDIR) + $(INSTALL) -d -m 755 $(BINDIR) +- $(INSTALL) -s -c -m 555 pppoe-discovery $(BINDIR) ++ $(INSTALL) -c -m 555 pppoe-discovery $(BINDIR) + + clean: + rm -f *.o *.so pppoe-discovery +Index: ppp-2.4.5/pppdump/Makefile.linux +=================================================================== +--- ppp-2.4.5.orig/pppdump/Makefile.linux ++++ ppp-2.4.5/pppdump/Makefile.linux +@@ -17,5 +17,5 @@ clean: + + install: + mkdir -p $(BINDIR) $(MANDIR) +- $(INSTALL) -s -c pppdump $(BINDIR) ++ $(INSTALL) -c pppdump $(BINDIR) + $(INSTALL) -c -m 444 pppdump.8 $(MANDIR) +Index: ppp-2.4.5/pppstats/Makefile.linux +=================================================================== +--- ppp-2.4.5.orig/pppstats/Makefile.linux ++++ ppp-2.4.5/pppstats/Makefile.linux +@@ -22,7 +22,7 @@ all: pppstats + + install: pppstats + -mkdir -p $(MANDIR) +- $(INSTALL) -s -c pppstats $(BINDIR) ++ $(INSTALL) -c pppstats $(BINDIR) + $(INSTALL) -c -m 444 pppstats.8 $(MANDIR) + + pppstats: $(PPPSTATSRCS) diff --git a/network/connection/ppp/files/options-pppoe b/network/connection/ppp/files/options-pppoe new file mode 100644 index 0000000000..5988ee2d66 --- /dev/null +++ b/network/connection/ppp/files/options-pppoe @@ -0,0 +1,6 @@ +noipdefault +hide-password +defaultroute +persist +lock + diff --git a/network/connection/ppp/files/options-pptp b/network/connection/ppp/files/options-pptp new file mode 100644 index 0000000000..af5749aac3 --- /dev/null +++ b/network/connection/ppp/files/options-pptp @@ -0,0 +1,18 @@ +#192.168.1.0: +netmask 255.255.255.0 +#debug +#kdebug 1 +lock +mtu 1490 +mru 1490 +proxyarp +auth +require-chap +passive +ipcp-accept-local +ipcp-accept-remote +lcp-echo-failure 3 +lcp-echo-interval 5 +deflate 0 +#ms-dns 192.168.1.1 +#ms-wins 192.168.1.1 diff --git a/network/connection/ppp/files/ppp-2.3.6-sample.patch b/network/connection/ppp/files/ppp-2.3.6-sample.patch new file mode 100644 index 0000000000..92eee6c0e3 --- /dev/null +++ b/network/connection/ppp/files/ppp-2.3.6-sample.patch @@ -0,0 +1,295 @@ +--- ppp-2.3.3/sample/auth-down.sample Tue Jan 6 17:53:27 1998 ++++ ppp-2.3.3/sample/auth-down Tue Jan 6 17:53:27 1998 +@@ -0,0 +1,17 @@ ++#!/bin/sh ++# ++# A program or script which is executed after the remote system ++# successfully authenticates itself. It is executed with the parameters ++# ++# ++ ++# ++# The environment is cleared before executing this script ++# so the path must be reset ++# ++PATH=/usr/sbin:/sbin:/usr/bin:/bin ++export PATH ++ ++echo auth-down `date +'%y/%m/%d %T'` $* >> /var/log/pppstats ++ ++# last line +--- ppp-2.3.3/sample/auth-up.sample Tue Jan 6 17:53:27 1998 ++++ ppp-2.3.3/sample/auth-up Tue Jan 6 17:53:27 1998 +@@ -0,0 +1,17 @@ ++#!/bin/sh ++# ++# A program or script which is executed after the remote system ++# successfully authenticates itself. It is executed with the parameters ++# ++# ++ ++# ++# The environment is cleared before executing this script ++# so the path must be reset ++# ++PATH=/usr/sbin:/sbin:/usr/bin:/bin ++export PATH ++ ++echo auth-up `date +'%y/%m/%d %T'` $* >> /var/log/pppstats ++ ++# last line +--- ppp-2.3.3/sample/ip-down.sample Tue Jan 6 17:53:27 1998 ++++ ppp-2.3.3/sample/ip-down Tue Jan 6 17:53:27 1998 +@@ -0,0 +1,22 @@ ++#!/bin/sh ++# ++# This script is run by the pppd _after_ the link is brought down. ++# It should be used to delete routes, unset IP addresses etc. ++# ++# This script is called with the following arguments: ++# Arg Name Example ++# $1 Interface name ppp0 ++# $2 The tty ttyS1 ++# $3 The link speed 38400 ++# $4 Local IP number 12.34.56.78 ++# $5 Peer IP number 12.34.56.99 ++# ++ ++# ++# The environment is cleared before executing this script ++# so the path must be reset ++# ++PATH=/usr/sbin:/sbin:/usr/bin:/bin ++export PATH ++ ++# last line +--- ppp-2.3.3/sample/ip-up.sample Tue Jan 6 17:53:27 1998 ++++ ppp-2.3.3/sample/ip-up Tue Jan 6 17:53:27 1998 +@@ -0,0 +1,23 @@ ++#!/bin/sh ++# ++# This script is run by the pppd after the link is established. ++# It should be used to add routes, set IP address, run the mailq ++# etc. ++# ++# This script is called with the following arguments: ++# Arg Name Example ++# $1 Interface name ppp0 ++# $2 The tty ttyS1 ++# $3 The link speed 38400 ++# $4 Local IP number 12.34.56.78 ++# $5 Peer IP number 12.34.56.99 ++# ++ ++# ++# The environment is cleared before executing this script ++# so the path must be reset ++# ++PATH=/usr/sbin:/sbin:/usr/bin:/bin ++export PATH ++ ++# last line +--- ppp-2.3.3/sample/options.sample Tue Jan 6 17:53:27 1998 ++++ ppp-2.3.3/sample/options Tue Jan 6 17:53:27 1998 +@@ -0,0 +1,153 @@ ++# /etc/ppp/options ++ ++# The name of this server. Often, the FQDN is used here. ++#name ++ ++# Enforce the use of the hostname as the name of the local system for ++# authentication purposes (overrides the name option). ++usehostname ++ ++# If no local IP address is given, pppd will use the first IP address ++# that belongs to the local hostname. If "noipdefault" is given, this ++# is disabled and the peer will have to supply an IP address. ++noipdefault ++ ++# With this option, pppd will accept the peer's idea of our local IP ++# address, even if the local IP address was specified in an option. ++#ipcp-accept-local ++ ++# With this option, pppd will accept the peer's idea of its (remote) IP ++# address, even if the remote IP address was specified in an option. ++#ipcp-accept-remote ++ ++# Specify which DNS Servers the incoming Win95 or WinNT Connection should use ++# Two Servers can be remotely configured ++#ms-dns 192.168.1.1 ++#ms-dns 192.168.1.2 ++ ++# Specify which WINS Servers the incoming connection Win95 or WinNT should use ++#wins-addr 192.168.1.50 ++#wins-addr 192.168.1.51 ++ ++# enable this on a server that already has a permanent default route ++#nodefaultroute ++ ++# Run the executable or shell command specified after pppd has terminated ++# the link. This script could, for example, issue commands to the modem ++# to cause it to hang up if hardware modem control signals were not ++# available. ++# If mgetty is running, it will reset the modem anyway. So there is no need ++# to do it here. ++#disconnect "chat -- \d+++\d\c OK ath0 OK" ++ ++# Increase debugging level (same as -d). The debug output is written ++# to syslog LOG_LOCAL2. ++debug ++ ++# Enable debugging code in the kernel-level PPP driver. The argument n ++# is a number which is the sum of the following values: 1 to enable ++# general debug messages, 2 to request that the contents of received ++# packets be printed, and 4 to request that the contents of transmitted ++# packets be printed. ++#kdebug n ++ ++# Require the peer to authenticate itself before allowing network ++# packets to be sent or received. ++# Please do not disable this setting. It is expected to be standard in ++# future releases of pppd. Use the call option (see manpage) to disable ++# authentication for specific peers. ++#auth ++ ++# authentication can either be pap or chap. As most people only want to ++# use pap, you can also disable chap: ++#require-pap ++#refuse-chap ++ ++# Use hardware flow control (i.e. RTS/CTS) to control the flow of data ++# on the serial port. ++crtscts ++ ++# Specifies that pppd should use a UUCP-style lock on the serial device ++# to ensure exclusive access to the device. ++lock ++ ++# Use the modem control lines. ++modem ++ ++# async character map -- 32-bit hex; each bit is a character ++# that needs to be escaped for pppd to receive it. 0x00000001 ++# represents '\x01', and 0x80000000 represents '\x1f'. ++# To allow pppd to work over a rlogin/telnet connection, ou should escape ++# XON (^Q), XOFF (^S) and ^]: (The peer should use "escape ff".) ++#asyncmap 200a0000 ++asyncmap 0 ++ ++# Specifies that certain characters should be escaped on transmission ++# (regardless of whether the peer requests them to be escaped with its ++# async control character map). The characters to be escaped are ++# specified as a list of hex numbers separated by commas. Note that ++# almost any character can be specified for the escape option, unlike ++# the asyncmap option which only allows control characters to be ++# specified. The characters which may not be escaped are those with hex ++# values 0x20 - 0x3f or 0x5e. ++#escape 11,13,ff ++ ++# Set the MRU [Maximum Receive Unit] value to for negotiation. pppd ++# will ask the peer to send packets of no more than bytes. The ++# minimum MRU value is 128. The default MRU value is 1500. A value of ++# 296 is recommended for slow links (40 bytes for TCP/IP header + 256 ++# bytes of data). ++#mru 542 ++ ++# Set the MTU [Maximum Transmit Unit] value to . Unless the peer ++# requests a smaller value via MRU negotiation, pppd will request that ++# the kernel networking code send data packets of no more than n bytes ++# through the PPP network interface. ++#mtu ++ ++# Set the interface netmask to , a 32 bit netmask in "decimal dot" ++# notation (e.g. 255.255.255.0). ++#netmask 255.255.255.0 ++ ++# Don't fork to become a background process (otherwise pppd will do so ++# if a serial device is specified). ++nodetach ++ ++# Set the assumed name of the remote system for authentication purposes ++# to . ++#remotename ++ ++# Add an entry to this system's ARP [Address Resolution Protocol] ++# table with the IP address of the peer and the Ethernet address of this ++# system. {proxyarp,noproxyarp} ++proxyarp ++ ++# Use the system password database for authenticating the peer using ++# PAP. Note: mgetty already provides this option. If this is specified ++# then dialin from users using a script under Linux to fire up ppp wont work. ++#login ++ ++# If this option is given, pppd will send an LCP echo-request frame to ++# the peer every n seconds. Under Linux, the echo-request is sent when ++# no packets have been received from the peer for n seconds. Normally ++# the peer should respond to the echo-request by sending an echo-reply. ++# This option can be used with the lcp-echo-failure option to detect ++# that the peer is no longer connected. ++lcp-echo-interval 30 ++ ++# If this option is given, pppd will presume the peer to be dead if n ++# LCP echo-requests are sent without receiving a valid LCP echo-reply. ++# If this happens, pppd will terminate the connection. Use of this ++# option requires a non-zero value for the lcp-echo-interval parameter. ++# This option can be used to enable pppd to terminate after the physical ++# connection has been broken (e.g., the modem has hung up) in ++# situations where no hardware modem control lines are available. ++lcp-echo-failure 4 ++ ++# Specifies that pppd should disconnect if the link is idle for n seconds. ++idle 600 ++ ++# Disable the IPXCP and IPX protocols. ++noipx ++ ++# ------ +--- ppp-2.3.3/sample/options.ttyXX.sample Tue Jan 6 17:53:27 1998 ++++ ppp-2.3.3/sample/options.ttyXX Tue Jan 6 17:53:27 1998 +@@ -0,0 +1,14 @@ ++# If you need to set up multiple serial lines then copy this file to ++# options. for each tty with a modem on it. ++# ++# The options.tty file will assign an IP address to each PPP connection ++# as it comes up. They must all be distinct! ++# ++# Example: ++# options.ttyS1 for com2 under DOS. ++# ++# Edit the following line so that the first IP address ++# mentioned is the ip address of the serial port while the second ++# is the IP address of your host ++# ++hostname-s1:hostname +--- ppp-2.3.3/sample/pap-secrets.sample Tue Jan 6 17:53:27 1998 ++++ ppp-2.3.3/sample/pap-secrets Tue Jan 6 17:53:27 1998 +@@ -0,0 +1,28 @@ ++# Secrets for authentication using PAP ++# client server secret IP addresses ++ ++# OUTBOUND CONNECTIONS ++# Here you should add your userid password to connect to your providers via ++# pap. The * means that the password is to be used for ANY host you connect ++# to. Thus you do not have to worry about the foreign machine name. Just ++# replace password with your password. ++# If you have different providers with different passwords then you better ++# remove the following line. ++#hostname * password ++ ++# INBOUND CONNECTIONS ++#client hostname 192.168.1.1 ++ ++# If you add "auth login -chap +pap" to /etc/mgetty+sendfax/login.config, ++# all users in /etc/passwd can use their password for pap-authentication. ++# ++# Every regular user can use PPP and has to use passwords from /etc/passwd ++#* hostname "" ++# UserIDs that cannot use PPP at all. Check your /etc/passwd and add any ++# other accounts that should not be able to use pppd! Replace hostname ++# with your local hostname. ++#guest hostname "*" - ++#master hostname "*" - ++#root hostname "*" - ++#support hostname "*" - ++#stats hostname "*" - diff --git a/network/connection/ppp/files/ppp-2.4.2-change_resolv_conf.patch b/network/connection/ppp/files/ppp-2.4.2-change_resolv_conf.patch new file mode 100644 index 0000000000..9674f1af74 --- /dev/null +++ b/network/connection/ppp/files/ppp-2.4.2-change_resolv_conf.patch @@ -0,0 +1,61 @@ +diff -urNp --exclude-from=/mdomsch2/excludes --minimal ppp-2.4.3.orig/pppd/pppd.8 ppp-2.4.3/pppd/pppd.8 +--- ppp-2.4.3.orig/pppd/pppd.8 2004-11-13 06:22:49.000000000 -0600 ++++ ppp-2.4.3/pppd/pppd.8 2005-08-03 22:10:34.000000000 -0500 +@@ -1035,7 +1035,7 @@ Ask the peer for up to 2 DNS server addr + by the peer (if any) are passed to the /etc/ppp/ip\-up script in the + environment variables DNS1 and DNS2, and the environment variable + USEPEERDNS will be set to 1. In addition, pppd will create an +-/etc/ppp/resolv.conf file containing one or two nameserver lines with ++/run/ppp/resolv.conf file containing one or two nameserver lines with + the address(es) supplied by the peer. + .TP + .B user \fIname +--- ppp-2.4.2/scripts/ip-down.local.add.change_resolv_conf 1999-02-27 05:32:42.000000000 +0100 ++++ ppp-2.4.2/scripts/ip-down.local.add 2004-09-14 14:36:20.058008752 +0200 +@@ -9,12 +9,13 @@ + # + # Nick Walker (nickwalker@email.com) + # ++. /etc/sysconfig/network-scripts/network-functions + +-if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then +- if [ -f /etc/ppp/resolv.prev ]; then +- cp -f /etc/ppp/resolv.prev /etc/resolv.conf ++if [ -n "$USEPEERDNS" -a -f /run/ppp/resolv.conf ]; then ++ if [ -f /run/ppp/resolv.prev ]; then ++ change_resolv_conf /run/ppp/resolv.prev + else +- rm -f /etc/resolv.conf ++ change_resolv_conf + fi + fi + +--- ppp-2.4.2/scripts/ip-up.local.add.change_resolv_conf 1999-11-15 04:28:10.000000000 +0100 ++++ ppp-2.4.2/scripts/ip-up.local.add 2004-09-14 14:37:39.129061828 +0200 +@@ -9,16 +9,19 @@ + # + # Nick Walker (nickwalker@email.com) + # ++. /etc/sysconfig/network-scripts/network-functions + +-if [ -n "$USEPEERDNS" -a -f /etc/ppp/resolv.conf ]; then +- rm -f /etc/ppp/resolv.prev ++if [ -n "$USEPEERDNS" -a -f /run/ppp/resolv.conf ]; then ++ rm -f /run/ppp/resolv.prev + if [ -f /etc/resolv.conf ]; then +- cp /etc/resolv.conf /etc/ppp/resolv.prev +- grep domain /etc/ppp/resolv.prev > /etc/resolv.conf +- grep search /etc/ppp/resolv.prev >> /etc/resolv.conf +- cat /etc/ppp/resolv.conf >> /etc/resolv.conf ++ cp /etc/resolv.conf /run/ppp/resolv.prev ++ rscf=/run/ppp/resolv.new ++ grep domain /run/ppp/resolv.prev > $rscf ++ grep search /run/ppp/resolv.prev >> $rscf ++ change_resolv_conf $rscf ++ rm -f $rscf + else +- cp /etc/ppp/resolv.conf /etc ++ change_resolv_conf /run/ppp/resolv.conf + fi + fi + diff --git a/network/connection/ppp/files/ppp-2.4.3-fix64.patch b/network/connection/ppp/files/ppp-2.4.3-fix64.patch new file mode 100644 index 0000000000..8a2c794d14 --- /dev/null +++ b/network/connection/ppp/files/ppp-2.4.3-fix64.patch @@ -0,0 +1,10 @@ +--- ppp-2.4.3/pppd/sha1.c.fix64 2004-10-25 01:28:02.000000000 +0200 ++++ ppp-2.4.3/pppd/sha1.c 2004-11-22 16:44:16.850768926 +0100 +@@ -18,6 +18,7 @@ + + #include + #include /* htonl() */ ++#include /* u_int32_t */ + #include + #include "sha1.h" + diff --git a/network/connection/ppp/files/ppp-2.4.3-ipv6-accept-remote.patch b/network/connection/ppp/files/ppp-2.4.3-ipv6-accept-remote.patch new file mode 100644 index 0000000000..2bc82338cd --- /dev/null +++ b/network/connection/ppp/files/ppp-2.4.3-ipv6-accept-remote.patch @@ -0,0 +1,40 @@ +--- ppp-2.4.3/pppd/ipv6cp.c~ 2005-11-04 09:40:10.000000000 +0000 ++++ ppp-2.4.3/pppd/ipv6cp.c 2005-11-04 10:20:14.000000000 +0000 +@@ -235,6 +235,8 @@ static option_t ipv6cp_option_list[] = { + + { "ipv6cp-accept-local", o_bool, &ipv6cp_allowoptions[0].accept_local, + "Accept peer's interface identifier for us", 1 }, ++ { "ipv6cp-accept-remote", o_bool, &ipv6cp_allowoptions[0].accept_remote, ++ "Accept peer's interface identifier for itself", 1 }, + + { "ipv6cp-use-ipaddr", o_bool, &ipv6cp_allowoptions[0].use_ip, + "Use (default) IPv4 address as interface identifier", 1 }, +@@ -427,6 +429,7 @@ ipv6cp_init(unit) + memset(ao, 0, sizeof(*ao)); + + wo->accept_local = 1; ++ wo->accept_remote = 1; + wo->neg_ifaceid = 1; + ao->neg_ifaceid = 1; + +@@ -952,7 +955,7 @@ ipv6cp_reqci(f, inp, len, reject_if_disa + orc = CONFREJ; /* Reject CI */ + break; + } +- if (!eui64_iszero(wo->hisid) && ++ if (!eui64_iszero(wo->hisid) && !wo->accept_remote && + !eui64_equals(ifaceid, wo->hisid) && + eui64_iszero(go->hisid)) { + +--- ppp-2.4.3/pppd/ipv6cp.h~ 2002-12-04 23:03:32.000000000 +0000 ++++ ppp-2.4.3/pppd/ipv6cp.h 2005-11-04 10:20:55.000000000 +0000 +@@ -150,7 +150,8 @@ + typedef struct ipv6cp_options { + int neg_ifaceid; /* Negotiate interface identifier? */ + int req_ifaceid; /* Ask peer to send interface identifier? */ +- int accept_local; /* accept peer's value for iface id? */ ++ int accept_local; /* accept peer's value for our iface id? */ ++ int accept_remote; /* accept peer's value for his iface id? */ + int opt_local; /* ourtoken set by option */ + int opt_remote; /* histoken set by option */ + int use_ip; /* use IP as interface identifier */ diff --git a/network/connection/ppp/files/ppp-2.4.3-local.patch b/network/connection/ppp/files/ppp-2.4.3-local.patch new file mode 100644 index 0000000000..3288cba223 --- /dev/null +++ b/network/connection/ppp/files/ppp-2.4.3-local.patch @@ -0,0 +1,68 @@ +diff -up ppp-2.4.4/configure.local ppp-2.4.4/configure +--- ppp-2.4.4/configure.local 2005-07-08 20:23:05.000000000 -0400 ++++ ppp-2.4.4/configure 2008-08-28 17:38:04.000000000 -0400 +@@ -2,7 +2,7 @@ + # $Id: configure,v 1.38 2008/06/15 07:08:49 paulus Exp $ + + # Where to install stuff by default +-DESTDIR=/usr/local ++DESTDIR=/usr + SYSCONF=/etc + + # if [ -d /NextApps ]; then +diff -up ppp-2.4.4/pppd/Makefile.linux.local ppp-2.4.4/pppd/Makefile.linux +--- ppp-2.4.4/pppd/Makefile.linux.local 2008-08-28 17:37:33.000000000 -0400 ++++ ppp-2.4.4/pppd/Makefile.linux 2008-08-28 17:37:33.000000000 -0400 +@@ -97,8 +97,8 @@ endif + + # EAP SRP-SHA1 + ifdef USE_SRP +-CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include +-LIBS += -lsrp -L/usr/local/ssl/lib -lcrypto ++CFLAGS += -DUSE_SRP -DOPENSSL -I/usr/include/openssl ++LIBS += -lsrp -L/usr/lib -lcrypto + TARGETS += srp-entry + EXTRAINSTALL = $(INSTALL) -c -m 555 srp-entry $(BINDIR)/srp-entry + MANPAGES += srp-entry.8 +diff -up ppp-2.4.4/scripts/ppp-on-rsh.local ppp-2.4.4/scripts/ppp-on-rsh +--- ppp-2.4.4/scripts/ppp-on-rsh.local 2000-04-15 05:49:28.000000000 -0400 ++++ ppp-2.4.4/scripts/ppp-on-rsh 2008-08-28 17:37:33.000000000 -0400 +@@ -26,7 +26,7 @@ PPPD_RHOST=myremotehost + # For this example, we assume that pppd on both local and remote + # machines reside in the same place, /usr/local/bin/pppd + # +-PPPD_LOC=/usr/local/bin/pppd ++PPPD_LOC=/usr/sbin/pppd + + # + # The location of local options file (where rsh client is running). +diff -up ppp-2.4.4/scripts/ppp-on-ssh.local ppp-2.4.4/scripts/ppp-on-ssh +--- ppp-2.4.4/scripts/ppp-on-ssh.local 2000-04-15 05:49:42.000000000 -0400 ++++ ppp-2.4.4/scripts/ppp-on-ssh 2008-08-28 17:37:33.000000000 -0400 +@@ -26,7 +26,7 @@ PPPD_RHOST=myremotehost + # For this example, we assume that pppd on both local and remote + # machines reside in the same place, /usr/local/bin/pppd + # +-PPPD_LOC=/usr/local/bin/pppd ++PPPD_LOC=/usr/sbin/pppd + + # + # The location of local options file (where ssh client is running). +@@ -52,7 +52,7 @@ PPPD_REM_OPT=/etc/ppp/options-ssh-rem + # + # The location of ssh client on the local machine + # +-SSH_LOC=/usr/local/bin/ssh ++SSH_LOC=/usr/bin/ssh + + export PPPD_LOC PPPD_LOC_OPT PPPD_REM_OPT PPPD_RHOST SSH_LOC + +diff -up ppp-2.4.4/scripts/secure-card.local ppp-2.4.4/scripts/secure-card +--- ppp-2.4.4/scripts/secure-card.local 2004-02-01 22:36:46.000000000 -0500 ++++ ppp-2.4.4/scripts/secure-card 2008-08-28 17:37:33.000000000 -0400 +@@ -1,4 +1,4 @@ +-#!/usr/local/bin/expect -f ++#!/usr/bin/expect -f + # + # This script was written by Jim Isaacson . It is + # designed to work as a script to use the SecureCARD(tm) device. This diff --git a/network/connection/ppp/files/ppp-2.4.5-ppp_resolv.patch b/network/connection/ppp/files/ppp-2.4.5-ppp_resolv.patch new file mode 100644 index 0000000000..f0cc7c63a3 --- /dev/null +++ b/network/connection/ppp/files/ppp-2.4.5-ppp_resolv.patch @@ -0,0 +1,13 @@ +diff -up ppp-2.4.5/scripts/ip-up.local.add.ppp_resolv ppp-2.4.5/scripts/ip-up.local.add +--- ppp-2.4.5/scripts/ip-up.local.add.ppp_resolv 2010-07-13 10:29:23.227943994 +0200 ++++ ppp-2.4.5/scripts/ip-up.local.add 2010-07-13 10:32:27.729695487 +0200 +@@ -18,6 +18,9 @@ if [ -n "$USEPEERDNS" -a -f /run/ppp + rscf=/run/ppp/resolv.new + grep domain /run/ppp/resolv.prev > $rscf + grep search /run/ppp/resolv.prev >> $rscf ++ if [ -f /run/ppp/resolv.conf ]; then ++ cat /run/ppp/resolv.conf >> $rscf ++ fi + change_resolv_conf $rscf + rm -f $rscf + else diff --git a/network/connection/ppp/files/ppp-2.4.5-var_run_ppp.patch b/network/connection/ppp/files/ppp-2.4.5-var_run_ppp.patch new file mode 100644 index 0000000000..5caca49615 --- /dev/null +++ b/network/connection/ppp/files/ppp-2.4.5-var_run_ppp.patch @@ -0,0 +1,30 @@ +diff -up ppp-2.4.5/pppd/pathnames.h.var_run_ppp ppp-2.4.5/pppd/pathnames.h +--- ppp-2.4.5/pppd/pathnames.h.var_run_ppp 2010-02-12 16:36:14.479362718 +0100 ++++ ppp-2.4.5/pppd/pathnames.h 2010-02-12 16:38:24.995330994 +0100 +@@ -7,9 +7,13 @@ + #ifdef HAVE_PATHS_H + #include + ++#define _SUBPATH_PPP "ppp/" + #else /* HAVE_PATHS_H */ + #ifndef _PATH_VARRUN + #define _PATH_VARRUN "/etc/ppp/" ++#define _SUBPATH_PPP ++#else ++#define _SUBPATH_PPP "ppp/" + #endif + #define _PATH_DEVNULL "/dev/null" + #endif /* HAVE_PATHS_H */ +@@ -46,10 +50,10 @@ + #endif /* IPX_CHANGE */ + + #ifdef __STDC__ +-#define _PATH_PPPDB _ROOT_PATH _PATH_VARRUN "pppd2.tdb" ++#define _PATH_PPPDB _ROOT_PATH _PATH_VARRUN _SUBPATH_PPP "pppd2.tdb" + #else /* __STDC__ */ + #ifdef HAVE_PATHS_H +-#define _PATH_PPPDB "/var/run/pppd2.tdb" ++#define _PATH_PPPDB "/run/ppp/pppd2.tdb" + #else + #define _PATH_PPPDB "/etc/ppp/pppd2.tdb" + #endif diff --git a/network/connection/ppp/files/ppp-2.4.6-eaptls-mppe-0.99.patch b/network/connection/ppp/files/ppp-2.4.6-eaptls-mppe-0.99.patch new file mode 100644 index 0000000000..2fb48bd572 --- /dev/null +++ b/network/connection/ppp/files/ppp-2.4.6-eaptls-mppe-0.99.patch @@ -0,0 +1,2919 @@ +diff -Naur ppp-2.4.5/etc.ppp/eaptls-client ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/eaptls-client +--- ppp-2.4.5/etc.ppp/eaptls-client 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/eaptls-client 2010-10-01 15:17:54.205272328 +0200 +@@ -0,0 +1,10 @@ ++# Parameters for authentication using EAP-TLS (client) ++ ++# client name (can be *) ++# server name (can be *) ++# client certificate file (required) ++# server certificate file (optional, if unused put '-') ++# CA certificate file (required) ++# client private key file (required) ++ ++#client server /root/cert/client.crt - /root/cert/ca.crt /root/cert/client.key +diff -Naur ppp-2.4.5/etc.ppp/eaptls-server ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/eaptls-server +--- ppp-2.4.5/etc.ppp/eaptls-server 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/eaptls-server 2010-10-01 15:17:54.205272328 +0200 +@@ -0,0 +1,11 @@ ++# Parameters for authentication using EAP-TLS (server) ++ ++# client name (can be *) ++# server name (can be *) ++# client certificate file (optional, if unused put '-') ++# server certificate file (required) ++# CA certificate file (required) ++# server private key file (required) ++# allowed addresses (required, can be *) ++ ++#client server - /root/cert/server.crt /root/cert/ca.crt /root/cert/server.key 192.168.1.0/24 +diff -Naur ppp-2.4.5/etc.ppp/openssl.cnf ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/openssl.cnf +--- ppp-2.4.5/etc.ppp/openssl.cnf 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.5-eaptls-mppe-0.99/etc.ppp/openssl.cnf 2010-10-01 15:17:54.206272162 +0200 +@@ -0,0 +1,14 @@ ++openssl_conf = openssl_def ++ ++[ openssl_def ] ++engines = engine_section ++ ++[ engine_section ] ++pkcs11 = pkcs11_section ++ ++[ pkcs11_section ] ++engine_id = pkcs11 ++dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so ++MODULE_PATH = /usr/lib64/libeTPkcs11.so ++init = 0 ++ +diff -aur ppp-2.4.6.orig/linux/Makefile.top ppp-2.4.6/linux/Makefile.top +--- ppp-2.4.6.orig/linux/Makefile.top 2014-01-02 05:42:08.000000000 +0100 ++++ ppp-2.4.6/linux/Makefile.top 2014-04-03 21:32:29.076627151 +0200 +@@ -26,7 +26,7 @@ + cd pppdump; $(MAKE) $(MFLAGS) install + + install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \ +- $(ETCDIR)/chap-secrets ++ $(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client + + install-devel: + cd pppd; $(MAKE) $(MFLAGS) install-devel +@@ -37,6 +37,10 @@ + $(INSTALL) -c -m 600 etc.ppp/pap-secrets $@ + $(ETCDIR)/chap-secrets: + $(INSTALL) -c -m 600 etc.ppp/chap-secrets $@ ++$(ETCDIR)/eaptls-server: ++ $(INSTALL) -c -m 600 etc.ppp/eaptls-server $@ ++$(ETCDIR)/eaptls-client: ++ $(INSTALL) -c -m 600 etc.ppp/eaptls-client $@ + + $(BINDIR): + $(INSTALL) -d -m 755 $@ +diff -aur ppp-2.4.6.orig/pppd/auth.c ppp-2.4.6/pppd/auth.c +--- ppp-2.4.6.orig/pppd/auth.c 2014-04-03 21:31:37.000000000 +0200 ++++ ppp-2.4.6/pppd/auth.c 2014-04-03 21:32:29.076627151 +0200 +@@ -109,6 +109,9 @@ + #include "upap.h" + #include "chap-new.h" + #include "eap.h" ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#endif + #ifdef CBCP_SUPPORT + #include "cbcp.h" + #endif +@@ -183,6 +186,12 @@ + /* Hook for a plugin to get the CHAP password for authenticating us */ + int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL; + ++#ifdef USE_EAPTLS ++/* Hook for a plugin to get the EAP-TLS password for authenticating us */ ++int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL; ++int (*eaptls_check_hook) __P((void)) = NULL; ++#endif ++ + /* Hook for a plugin to say whether it is OK if the peer + refuses to authenticate. */ + int (*null_auth_hook) __P((struct wordlist **paddrs, +@@ -238,6 +247,13 @@ + bool explicit_user = 0; /* Set if "user" option supplied */ + bool explicit_passwd = 0; /* Set if "password" option supplied */ + char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ ++#ifdef USE_EAPTLS ++char *cacert_file = NULL; /* CA certificate file (pem format) */ ++char *cert_file = NULL; /* client certificate file (pem format) */ ++char *privkey_file = NULL; /* client private key file (pem format) */ ++char *crl_dir = NULL; /* directory containing CRL files */ ++bool need_peer_eap = 0; /* Require peer to authenticate us */ ++#endif + + static char *uafname; /* name of most recent +ua file */ + +@@ -254,6 +270,19 @@ + static int have_chap_secret __P((char *, char *, int, int *)); + static int have_srp_secret __P((char *client, char *server, int need_ip, + int *lacks_ipp)); ++ ++#ifdef USE_EAPTLS ++static int have_eaptls_secret_server ++__P((char *client, char *server, int need_ip, int *lacks_ipp)); ++static int have_eaptls_secret_client __P((char *client, char *server)); ++static int scan_authfile_eaptls __P((FILE * f, char *client, char *server, ++ char *cli_cert, char *serv_cert, ++ char *ca_cert, char *pk, ++ struct wordlist ** addrs, ++ struct wordlist ** opts, ++ char *filename, int flags)); ++#endif ++ + static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); + static int scan_authfile __P((FILE *, char *, char *, char *, + struct wordlist **, struct wordlist **, +@@ -401,6 +430,14 @@ + "Set telephone number(s) which are allowed to connect", + OPT_PRIV | OPT_A2LIST }, + ++#ifdef USE_EAPTLS ++ { "ca", o_string, &cacert_file, "EAP-TLS CA certificate in PEM format" }, ++ { "cert", o_string, &cert_file, "EAP-TLS client certificate in PEM format" }, ++ { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" }, ++ { "crl-dir", o_string, &crl_dir, "Use CRLs in directory" }, ++ { "need-peer-eap", o_bool, &need_peer_eap, ++ "Require the peer to authenticate us", 1 }, ++#endif /* USE_EAPTLS */ + { NULL } + }; + +@@ -730,6 +767,9 @@ + lcp_options *wo = &lcp_wantoptions[unit]; + lcp_options *go = &lcp_gotoptions[unit]; + lcp_options *ho = &lcp_hisoptions[unit]; ++#ifdef USE_EAPTLS ++ lcp_options *ao = &lcp_allowoptions[unit]; ++#endif + int i; + struct protent *protp; + +@@ -764,6 +804,22 @@ + } + } + ++#ifdef USE_EAPTLS ++ if (need_peer_eap && !ao->neg_eap) { ++ warn("eap required to authenticate us but no suitable secrets"); ++ lcp_close(unit, "couldn't negotiate eap"); ++ status = EXIT_AUTH_TOPEER_FAILED; ++ return; ++ } ++ ++ if (need_peer_eap && !ho->neg_eap) { ++ warn("peer doesn't want to authenticate us with eap"); ++ lcp_close(unit, "couldn't negotiate eap"); ++ status = EXIT_PEER_AUTH_FAILED; ++ return; ++ } ++#endif ++ + new_phase(PHASE_AUTHENTICATE); + auth = 0; + if (go->neg_eap) { +@@ -1281,6 +1337,15 @@ + our_name, 1, &lacks_ip); + } + ++#ifdef USE_EAPTLS ++ if (!can_auth && wo->neg_eap) { ++ can_auth = ++ have_eaptls_secret_server((explicit_remote ? remote_name : ++ NULL), our_name, 1, &lacks_ip); ++ ++ } ++#endif ++ + if (auth_required && !can_auth && noauth_addrs == NULL) { + if (default_auth) { + option_error( +@@ -1335,7 +1400,11 @@ + passwd[0] != 0 || + (hadchap == 1 || (hadchap == -1 && have_chap_secret(user, + (explicit_remote? remote_name: NULL), 0, NULL))) || +- have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)); ++ have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL) ++#ifdef USE_EAPTLS ++ || have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL)) ++#endif ++ ); + + hadchap = -1; + if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) +@@ -1350,8 +1419,14 @@ + !have_chap_secret((explicit_remote? remote_name: NULL), our_name, + 1, NULL))) && + !have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1, +- NULL)) ++ NULL) ++#ifdef USE_EAPTLS ++ && !have_eaptls_secret_server((explicit_remote? remote_name: NULL), ++ our_name, 1, NULL) ++#endif ++ ) + go->neg_eap = 0; ++ + } + + +@@ -1711,6 +1786,7 @@ + } + + ++ + /* + * get_secret - open the CHAP secret file and return the secret + * for authenticating the given client on the given server. +@@ -2367,3 +2443,335 @@ + else + auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0); + } ++ ++ ++#ifdef USE_EAPTLS ++static int ++have_eaptls_secret_server(client, server, need_ip, lacks_ipp) ++ char *client; ++ char *server; ++ int need_ip; ++ int *lacks_ipp; ++{ ++ FILE *f; ++ int ret; ++ char *filename; ++ struct wordlist *addrs; ++ char servcertfile[MAXWORDLEN]; ++ char clicertfile[MAXWORDLEN]; ++ char cacertfile[MAXWORDLEN]; ++ char pkfile[MAXWORDLEN]; ++ ++ filename = _PATH_EAPTLSSERVFILE; ++ f = fopen(filename, "r"); ++ if (f == NULL) ++ return 0; ++ ++ if (client != NULL && client[0] == 0) ++ client = NULL; ++ else if (server != NULL && server[0] == 0) ++ server = NULL; ++ ++ ret = ++ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, ++ cacertfile, pkfile, &addrs, NULL, filename, ++ 0); ++ ++ fclose(f); ++ ++/* ++ if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile, ++ clicertfile, pkfile)) ++ ret = -1; ++*/ ++ ++ if (ret >= 0 && need_ip && !some_ip_ok(addrs)) { ++ if (lacks_ipp != 0) ++ *lacks_ipp = 1; ++ ret = -1; ++ } ++ if (addrs != 0) ++ free_wordlist(addrs); ++ ++ return ret >= 0; ++} ++ ++ ++static int ++have_eaptls_secret_client(client, server) ++ char *client; ++ char *server; ++{ ++ FILE *f; ++ int ret; ++ char *filename; ++ struct wordlist *addrs = NULL; ++ char servcertfile[MAXWORDLEN]; ++ char clicertfile[MAXWORDLEN]; ++ char cacertfile[MAXWORDLEN]; ++ char pkfile[MAXWORDLEN]; ++ ++ if (client != NULL && client[0] == 0) ++ client = NULL; ++ else if (server != NULL && server[0] == 0) ++ server = NULL; ++ ++ if (cacert_file && cert_file && privkey_file) ++ return 1; ++ ++ filename = _PATH_EAPTLSCLIFILE; ++ f = fopen(filename, "r"); ++ if (f == NULL) ++ return 0; ++ ++ ret = ++ scan_authfile_eaptls(f, client, server, clicertfile, servcertfile, ++ cacertfile, pkfile, &addrs, NULL, filename, ++ 0); ++ fclose(f); ++ ++/* ++ if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile, ++ servcertfile, pkfile)) ++ ret = -1; ++*/ ++ ++ if (addrs != 0) ++ free_wordlist(addrs); ++ ++ return ret >= 0; ++} ++ ++ ++static int ++scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk, ++ addrs, opts, filename, flags) ++ FILE *f; ++ char *client; ++ char *server; ++ char *cli_cert; ++ char *serv_cert; ++ char *ca_cert; ++ char *pk; ++ struct wordlist **addrs; ++ struct wordlist **opts; ++ char *filename; ++ int flags; ++{ ++ int newline; ++ int got_flag, best_flag; ++ struct wordlist *ap, *addr_list, *alist, **app; ++ char word[MAXWORDLEN]; ++ ++ if (addrs != NULL) ++ *addrs = NULL; ++ if (opts != NULL) ++ *opts = NULL; ++ addr_list = NULL; ++ if (!getword(f, word, &newline, filename)) ++ return -1; /* file is empty??? */ ++ newline = 1; ++ best_flag = -1; ++ for (;;) { ++ /* ++ * Skip until we find a word at the start of a line. ++ */ ++ while (!newline && getword(f, word, &newline, filename)); ++ if (!newline) ++ break; /* got to end of file */ ++ ++ /* ++ * Got a client - check if it's a match or a wildcard. ++ */ ++ got_flag = 0; ++ if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) { ++ newline = 0; ++ continue; ++ } ++ if (!ISWILD(word)) ++ got_flag = NONWILD_CLIENT; ++ ++ /* ++ * Now get a server and check if it matches. ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ if (!ISWILD(word)) { ++ if (server != NULL && strcmp(word, server) != 0) ++ continue; ++ got_flag |= NONWILD_SERVER; ++ } ++ ++ /* ++ * Got some sort of a match - see if it's better than what ++ * we have already. ++ */ ++ if (got_flag <= best_flag) ++ continue; ++ ++ /* ++ * Get the cli_cert ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ if (strcmp(word, "-") != 0) { ++ strlcpy(cli_cert, word, MAXWORDLEN); ++ } else ++ cli_cert[0] = 0; ++ ++ /* ++ * Get serv_cert ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ if (strcmp(word, "-") != 0) { ++ strlcpy(serv_cert, word, MAXWORDLEN); ++ } else ++ serv_cert[0] = 0; ++ ++ /* ++ * Get ca_cert ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ strlcpy(ca_cert, word, MAXWORDLEN); ++ ++ /* ++ * Get pk ++ */ ++ if (!getword(f, word, &newline, filename)) ++ break; ++ if (newline) ++ continue; ++ strlcpy(pk, word, MAXWORDLEN); ++ ++ ++ /* ++ * Now read address authorization info and make a wordlist. ++ */ ++ app = &alist; ++ for (;;) { ++ if (!getword(f, word, &newline, filename) || newline) ++ break; ++ ap = (struct wordlist *) ++ malloc(sizeof(struct wordlist) + strlen(word) + 1); ++ if (ap == NULL) ++ novm("authorized addresses"); ++ ap->word = (char *) (ap + 1); ++ strcpy(ap->word, word); ++ *app = ap; ++ app = &ap->next; ++ } ++ *app = NULL; ++ /* ++ * This is the best so far; remember it. ++ */ ++ best_flag = got_flag; ++ if (addr_list) ++ free_wordlist(addr_list); ++ addr_list = alist; ++ ++ if (!newline) ++ break; ++ } ++ ++ /* scan for a -- word indicating the start of options */ ++ for (app = &addr_list; (ap = *app) != NULL; app = &ap->next) ++ if (strcmp(ap->word, "--") == 0) ++ break; ++ /* ap = start of options */ ++ if (ap != NULL) { ++ ap = ap->next; /* first option */ ++ free(*app); /* free the "--" word */ ++ *app = NULL; /* terminate addr list */ ++ } ++ if (opts != NULL) ++ *opts = ap; ++ else if (ap != NULL) ++ free_wordlist(ap); ++ if (addrs != NULL) ++ *addrs = addr_list; ++ else if (addr_list != NULL) ++ free_wordlist(addr_list); ++ ++ return best_flag; ++} ++ ++ ++int ++get_eaptls_secret(unit, client, server, clicertfile, servcertfile, ++ cacertfile, pkfile, am_server) ++ int unit; ++ char *client; ++ char *server; ++ char *clicertfile; ++ char *servcertfile; ++ char *cacertfile; ++ char *pkfile; ++ int am_server; ++{ ++ FILE *fp; ++ int ret; ++ char *filename = NULL; ++ struct wordlist *addrs = NULL; ++ struct wordlist *opts = NULL; ++ ++ /* in client mode the ca+cert+privkey can also be specified as options */ ++ if (!am_server && cacert_file && cert_file && privkey_file ) ++ { ++ strlcpy( clicertfile, cert_file, MAXWORDLEN ); ++ strlcpy( cacertfile, cacert_file, MAXWORDLEN ); ++ strlcpy( pkfile, privkey_file, MAXWORDLEN ); ++ servcertfile[0] = '\0'; ++ } ++ else ++ { ++ filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE); ++ addrs = NULL; ++ ++ fp = fopen(filename, "r"); ++ if (fp == NULL) ++ { ++ error("Can't open eap-tls secret file %s: %m", filename); ++ return 0; ++ } ++ ++ check_access(fp, filename); ++ ++ ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile, ++ cacertfile, pkfile, &addrs, &opts, filename, 0); ++ ++ fclose(fp); ++ ++ if (ret < 0) return 0; ++ } ++ ++ if (eaptls_passwd_hook) ++ { ++ dbglog( "Calling eaptls password hook" ); ++ if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0) ++ { ++ error("Unable to obtain EAP-TLS password for %s (%s) from plugin", ++ client, pkfile); ++ return 0; ++ } ++ } ++ if (am_server) ++ set_allowed_addrs(unit, addrs, opts); ++ else if (opts != NULL) ++ free_wordlist(opts); ++ if (addrs != NULL) ++ free_wordlist(addrs); ++ ++ return 1; ++} ++#endif ++ +diff -aur ppp-2.4.6.orig/pppd/ccp.c ppp-2.4.6/pppd/ccp.c +--- ppp-2.4.6.orig/pppd/ccp.c 2014-01-02 05:42:08.000000000 +0100 ++++ ppp-2.4.6/pppd/ccp.c 2014-04-03 21:32:29.076627151 +0200 +@@ -540,6 +540,9 @@ + if (go->mppe) { + ccp_options *ao = &ccp_allowoptions[f->unit]; + int auth_mschap_bits = auth_done[f->unit]; ++#ifdef USE_EAPTLS ++ int auth_eap_bits = auth_done[f->unit]; ++#endif + int numbits; + + /* +@@ -567,8 +570,23 @@ + lcp_close(f->unit, "MPPE required but not available"); + return; + } ++ ++#ifdef USE_EAPTLS ++ /* ++ * MPPE is also possible in combination with EAP-TLS. ++ * It is not possible to detect if we're doing EAP or EAP-TLS ++ * at this stage, hence we accept all forms of EAP. If TLS is ++ * not used then the MPPE keys will not be derived anyway. ++ */ ++ /* Leave only the eap auth bits set */ ++ auth_eap_bits &= (EAP_WITHPEER | EAP_PEER ); ++ ++ if ((numbits == 0) && (auth_eap_bits == 0)) { ++ error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed."); ++#else + if (!numbits) { +- error("MPPE required, but MS-CHAP[v2] auth not performed."); ++ error("MPPE required, but MS-CHAP[v2] auth not performed."); ++#endif + lcp_close(f->unit, "MPPE required but not available"); + return; + } +diff -aur ppp-2.4.6.orig/pppd/chap-md5.c ppp-2.4.6/pppd/chap-md5.c +--- ppp-2.4.6.orig/pppd/chap-md5.c 2014-01-02 05:42:08.000000000 +0100 ++++ ppp-2.4.6/pppd/chap-md5.c 2014-04-03 21:32:29.079960484 +0200 +@@ -36,7 +36,11 @@ + #include "chap-new.h" + #include "chap-md5.h" + #include "magic.h" ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#else + #include "md5.h" ++#endif /* USE_EAPTLS */ + + #define MD5_HASH_SIZE 16 + #define MD5_MIN_CHALLENGE 16 +diff -aur ppp-2.4.6.orig/pppd/eap.c ppp-2.4.6/pppd/eap.c +--- ppp-2.4.6.orig/pppd/eap.c 2014-01-02 05:42:08.000000000 +0100 ++++ ppp-2.4.6/pppd/eap.c 2014-04-03 21:32:29.079960484 +0200 +@@ -43,6 +43,11 @@ + * Based on draft-ietf-pppext-eap-srp-03.txt. + */ + ++/* ++ * Modification by Beniamino Galvani, Mar 2005 ++ * Implemented EAP-TLS authentication ++ */ ++ + #define RCSID "$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $" + + /* +@@ -62,8 +67,12 @@ + + #include "pppd.h" + #include "pathnames.h" +-#include "md5.h" + #include "eap.h" ++#ifdef USE_EAPTLS ++#include "eap-tls.h" ++#else ++#include "md5.h" ++#endif /* USE_EAPTLS */ + + #ifdef USE_SRP + #include +@@ -209,6 +218,9 @@ + esp->es_server.ea_id = (u_char)(drand48() * 0x100); + esp->es_client.ea_timeout = EAP_DEFREQTIME; + esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ; ++#ifdef USE_EAPTLS ++ esp->es_client.ea_using_eaptls = 0; ++#endif /* USE_EAPTLS */ + } + + /* +@@ -436,8 +448,16 @@ + u_char vals[2]; + struct b64state bs; + #endif /* USE_SRP */ ++#ifdef USE_EAPTLS ++ struct eaptls_session *ets; ++ int secret_len; ++ char secret[MAXWORDLEN]; ++#endif /* USE_EAPTLS */ + + esp->es_server.ea_timeout = esp->es_savedtime; ++#ifdef USE_EAPTLS ++ esp->es_server.ea_prev_state = esp->es_server.ea_state; ++#endif /* USE_EAPTLS */ + switch (esp->es_server.ea_state) { + case eapBadAuth: + return; +@@ -562,9 +582,81 @@ + break; + } + #endif /* USE_SRP */ ++#ifdef USE_EAPTLS ++ if (!get_secret(esp->es_unit, esp->es_server.ea_peer, ++ esp->es_server.ea_name, secret, &secret_len, 1)) { ++ ++ esp->es_server.ea_state = eapTlsStart; ++ break; ++ } ++#endif /* USE_EAPTLS */ ++ + esp->es_server.ea_state = eapMD5Chall; + break; + ++#ifdef USE_EAPTLS ++ case eapTlsStart: ++ /* Initialize ssl session */ ++ if(!eaptls_init_ssl_server(esp)) { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } ++ ++ esp->es_server.ea_state = eapTlsRecv; ++ break; ++ ++ case eapTlsRecv: ++ ets = (struct eaptls_session *) esp->es_server.ea_session; ++ ++ if(ets->alert_sent) { ++ esp->es_server.ea_state = eapTlsSendAlert; ++ break; ++ } ++ ++ if (status) { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } ++ ets = (struct eaptls_session *) esp->es_server.ea_session; ++ ++ if(ets->frag) ++ esp->es_server.ea_state = eapTlsSendAck; ++ else ++ esp->es_server.ea_state = eapTlsSend; ++ break; ++ ++ case eapTlsSend: ++ ets = (struct eaptls_session *) esp->es_server.ea_session; ++ ++ if(SSL_is_init_finished(ets->ssl)) { ++ esp->es_server.ea_state = eapTlsRecvClient; ++ break; ++ } ++ ++ if(ets->frag) ++ esp->es_server.ea_state = eapTlsRecvAck; ++ else ++ esp->es_server.ea_state = eapTlsRecv; ++ break; ++ ++ case eapTlsSendAck: ++ esp->es_server.ea_state = eapTlsRecv; ++ break; ++ ++ case eapTlsRecvAck: ++ if (status) { ++ esp->es_server.ea_state = eapBadAuth; ++ break; ++ } ++ ++ esp->es_server.ea_state = eapTlsSend; ++ break; ++ ++ case eapTlsSendAlert: ++ esp->es_server.ea_state = eapTlsRecvAlertAck; ++ break; ++#endif /* USE_EAPTLS */ ++ + case eapSRP1: + #ifdef USE_SRP + ts = (struct t_server *)esp->es_server.ea_session; +@@ -718,6 +810,30 @@ + INCPTR(esp->es_server.ea_namelen, outp); + break; + ++#ifdef USE_EAPTLS ++ case eapTlsStart: ++ PUTCHAR(EAPT_TLS, outp); ++ PUTCHAR(EAP_TLS_FLAGS_START, outp); ++ eap_figure_next_state(esp, 0); ++ break; ++ ++ case eapTlsSend: ++ eaptls_send(esp->es_server.ea_session, &outp); ++ eap_figure_next_state(esp, 0); ++ break; ++ ++ case eapTlsSendAck: ++ PUTCHAR(EAPT_TLS, outp); ++ PUTCHAR(0, outp); ++ eap_figure_next_state(esp, 0); ++ break; ++ ++ case eapTlsSendAlert: ++ eaptls_send(esp->es_server.ea_session, &outp); ++ eap_figure_next_state(esp, 0); ++ break; ++#endif /* USE_EAPTLS */ ++ + #ifdef USE_SRP + case eapSRP1: + PUTCHAR(EAPT_SRP, outp); +@@ -904,11 +1020,57 @@ + eap_server_timeout(arg) + void *arg; + { ++#ifdef USE_EAPTLS ++ u_char *outp; ++ u_char *lenloc; ++ int outlen; ++#endif /* USE_EAPTLS */ ++ + eap_state *esp = (eap_state *) arg; + + if (!eap_server_active(esp)) + return; + ++#ifdef USE_EAPTLS ++ switch(esp->es_server.ea_prev_state) { ++ ++ /* ++ * In eap-tls the state changes after a request, so we return to ++ * previous state ... ++ */ ++ case(eapTlsStart): ++ case(eapTlsSendAck): ++ esp->es_server.ea_state = esp->es_server.ea_prev_state; ++ break; ++ ++ /* ++ * ... or resend the stored data ++ */ ++ case(eapTlsSend): ++ case(eapTlsSendAlert): ++ outp = outpacket_buf; ++ MAKEHEADER(outp, PPP_EAP); ++ PUTCHAR(EAP_REQUEST, outp); ++ PUTCHAR(esp->es_server.ea_id, outp); ++ lenloc = outp; ++ INCPTR(2, outp); ++ ++ eaptls_retransmit(esp->es_server.ea_session, &outp); ++ ++ outlen = (outp - outpacket_buf) - PPP_HDRLEN; ++ PUTSHORT(outlen, lenloc); ++ output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN); ++ esp->es_server.ea_requests++; ++ ++ if (esp->es_server.ea_timeout > 0) ++ TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout); ++ ++ return; ++ default: ++ break; ++ } ++#endif /* USE_EAPTLS */ ++ + /* EAP ID number must not change on timeout. */ + eap_send_request(esp); + } +@@ -1166,6 +1328,81 @@ + } + #endif /* USE_SRP */ + ++#ifdef USE_EAPTLS ++/* ++ * Send an EAP-TLS response message with tls data ++ */ ++static void ++eap_tls_response(esp, id) ++eap_state *esp; ++u_char id; ++{ ++ u_char *outp; ++ int outlen; ++ u_char *lenloc; ++ ++ outp = outpacket_buf; ++ ++ MAKEHEADER(outp, PPP_EAP); ++ ++ PUTCHAR(EAP_RESPONSE, outp); ++ PUTCHAR(id, outp); ++ ++ lenloc = outp; ++ INCPTR(2, outp); ++ ++ /* ++ If the id in the request is unchanged, we must retransmit ++ the old data ++ */ ++ if(id == esp->es_client.ea_id) ++ eaptls_retransmit(esp->es_client.ea_session, &outp); ++ else ++ eaptls_send(esp->es_client.ea_session, &outp); ++ ++ outlen = (outp - outpacket_buf) - PPP_HDRLEN; ++ PUTSHORT(outlen, lenloc); ++ ++ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); ++ ++ esp->es_client.ea_id = id; ++ ++} ++ ++/* ++ * Send an EAP-TLS ack ++ */ ++static void ++eap_tls_sendack(esp, id) ++eap_state *esp; ++u_char id; ++{ ++ u_char *outp; ++ int outlen; ++ u_char *lenloc; ++ ++ outp = outpacket_buf; ++ ++ MAKEHEADER(outp, PPP_EAP); ++ ++ PUTCHAR(EAP_RESPONSE, outp); ++ PUTCHAR(id, outp); ++ esp->es_client.ea_id = id; ++ ++ lenloc = outp; ++ INCPTR(2, outp); ++ ++ PUTCHAR(EAPT_TLS, outp); ++ PUTCHAR(0, outp); ++ ++ outlen = (outp - outpacket_buf) - PPP_HDRLEN; ++ PUTSHORT(outlen, lenloc); ++ ++ output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen); ++ ++} ++#endif /* USE_EAPTLS */ ++ + static void + eap_send_nak(esp, id, type) + eap_state *esp; +@@ -1320,6 +1557,11 @@ + char rhostname[256]; + MD5_CTX mdContext; + u_char hash[MD5_SIGNATURE_SIZE]; ++#ifdef USE_EAPTLS ++ u_char flags; ++ struct eaptls_session *ets = esp->es_client.ea_session; ++#endif /* USE_EAPTLS */ ++ + #ifdef USE_SRP + struct t_client *tc; + struct t_num sval, gval, Nval, *Ap, Bval; +@@ -1456,6 +1698,90 @@ + esp->es_client.ea_namelen); + break; + ++#ifdef USE_EAPTLS ++ case EAPT_TLS: ++ ++ switch(esp->es_client.ea_state) { ++ ++ case eapListen: ++ ++ GETCHAR(flags, inp); ++ if(flags & EAP_TLS_FLAGS_START){ ++ ++ esp->es_client.ea_using_eaptls = 1; ++ ++ if (explicit_remote){ ++ esp->es_client.ea_peer = strdup(remote_name); ++ esp->es_client.ea_peerlen = strlen(remote_name); ++ } else ++ esp->es_client.ea_peer = NULL; ++ ++ /* Init ssl session */ ++ if(!eaptls_init_ssl_client(esp)) { ++ dbglog("cannot init ssl"); ++ eap_send_nak(esp, id, EAPT_TLS); ++ esp->es_client.ea_using_eaptls = 0; ++ break; ++ } ++ ++ ets = esp->es_client.ea_session; ++ eap_tls_response(esp, id); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : ++ eapTlsRecv); ++ break; ++ } ++ ++ /* The server has sent a bad start packet. */ ++ eap_send_nak(esp, id, EAPT_TLS); ++ break; ++ ++ case eapTlsRecvAck: ++ eap_tls_response(esp, id); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : ++ eapTlsRecv); ++ break; ++ ++ case eapTlsRecv: ++ eaptls_receive(ets, inp, len); ++ ++ if(ets->frag) { ++ eap_tls_sendack(esp, id); ++ esp->es_client.ea_state = eapTlsRecv; ++ break; ++ } ++ ++ if(ets->alert_recv) { ++ eap_tls_sendack(esp, id); ++ esp->es_client.ea_state = eapTlsRecvFailure; ++ break; ++ } ++ ++ /* Check if TLS handshake is finished */ ++ if(SSL_is_init_finished(ets->ssl)){ ++#ifdef MPPE ++ eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 ); ++#endif ++ eaptls_free_session(ets); ++ eap_tls_sendack(esp, id); ++ esp->es_client.ea_state = eapTlsRecvSuccess; ++ break; ++ } ++ ++ eap_tls_response(esp,id); ++ esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : ++ eapTlsRecv); ++ ++ break; ++ ++ default: ++ eap_send_nak(esp, id, EAPT_TLS); ++ esp->es_client.ea_using_eaptls = 0; ++ break; ++ } ++ ++ break; ++#endif /* USE_EAPTLS */ ++ + #ifdef USE_SRP + case EAPT_SRP: + if (len < 1) { +@@ -1737,6 +2063,11 @@ + u_char dig[SHA_DIGESTSIZE]; + #endif /* USE_SRP */ + ++#ifdef USE_EAPTLS ++ struct eaptls_session *ets; ++ u_char flags; ++#endif /* USE_EAPTLS */ ++ + if (esp->es_server.ea_id != id) { + dbglog("EAP: discarding Response %d; expected ID %d", id, + esp->es_server.ea_id); +@@ -1776,6 +2107,60 @@ + eap_figure_next_state(esp, 0); + break; + ++#ifdef USE_EAPTLS ++ case EAPT_TLS: ++ switch(esp->es_server.ea_state) { ++ ++ case eapTlsRecv: ++ ets = (struct eaptls_session *) esp->es_server.ea_session; ++ eap_figure_next_state(esp, ++ eaptls_receive(esp->es_server.ea_session, inp, len)); ++ ++ if(ets->alert_recv) { ++ eap_send_failure(esp); ++ break; ++ } ++ break; ++ ++ case eapTlsRecvAck: ++ if(len > 1) { ++ dbglog("EAP-TLS ACK with extra data"); ++ } ++ eap_figure_next_state(esp, 0); ++ break; ++ ++ case eapTlsRecvClient: ++ /* Receive authentication response from client */ ++ ++ GETCHAR(flags, inp); ++ ++ if(len == 1 && !flags) { /* Ack = ok */ ++#ifdef MPPE ++ eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 ); ++#endif ++ eap_send_success(esp); ++ } ++ else { /* failure */ ++ eaptls_receive(esp->es_server.ea_session, inp, len); ++ warn("Server authentication failed"); ++ eap_send_failure(esp); ++ } ++ ++ eaptls_free_session(esp->es_server.ea_session); ++ ++ break; ++ ++ case eapTlsRecvAlertAck: ++ eap_send_failure(esp); ++ break; ++ ++ default: ++ eap_figure_next_state(esp, 1); ++ break; ++ } ++ break; ++#endif /* USE_EAPTLS */ ++ + case EAPT_NOTIFICATION: + dbglog("EAP unexpected Notification; response discarded"); + break; +@@ -1807,6 +2192,13 @@ + esp->es_server.ea_state = eapMD5Chall; + break; + ++#ifdef USE_EAPTLS ++ /* Send EAP-TLS start packet */ ++ case EAPT_TLS: ++ esp->es_server.ea_state = eapTlsStart; ++ break; ++#endif /* USE_EAPTLS */ ++ + default: + dbglog("EAP: peer requesting unknown Type %d", vallen); + switch (esp->es_server.ea_state) { +@@ -2018,13 +2410,27 @@ + int id; + int len; + { +- if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) { ++ if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp) ++#ifdef USE_EAPTLS ++ && esp->es_client.ea_state != eapTlsRecvSuccess ++#endif /* USE_EAPTLS */ ++ ) { + dbglog("EAP unexpected success message in state %s (%d)", + eap_state_name(esp->es_client.ea_state), + esp->es_client.ea_state); + return; + } + ++#ifdef USE_EAPTLS ++ if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != ++ eapTlsRecvSuccess) { ++ dbglog("EAP-TLS unexpected success message in state %s (%d)", ++ eap_state_name(esp->es_client.ea_state), ++ esp->es_client.ea_state); ++ return; ++ } ++#endif /* USE_EAPTLS */ ++ + if (esp->es_client.ea_timeout > 0) { + UNTIMEOUT(eap_client_timeout, (void *)esp); + } +@@ -2150,6 +2556,9 @@ + int code, id, len, rtype, vallen; + u_char *pstart; + u_int32_t uval; ++#ifdef USE_EAPTLS ++ u_char flags; ++#endif /* USE_EAPTLS */ + + if (inlen < EAP_HEADERLEN) + return (0); +@@ -2214,6 +2623,24 @@ + } + break; + ++#ifdef USE_EAPTLS ++ case EAPT_TLS: ++ if (len < 1) ++ break; ++ GETCHAR(flags, inp); ++ len--; ++ ++ if(flags == 0 && len == 0){ ++ printer(arg, " Ack"); ++ break; ++ } ++ ++ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); ++ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); ++ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); ++ break; ++#endif /* USE_EAPTLS */ ++ + case EAPT_SRP: + if (len < 3) + goto truncated; +@@ -2325,6 +2752,25 @@ + } + break; + ++#ifdef USE_EAPTLS ++ case EAPT_TLS: ++ if (len < 1) ++ break; ++ GETCHAR(flags, inp); ++ len--; ++ ++ if(flags == 0 && len == 0){ ++ printer(arg, " Ack"); ++ break; ++ } ++ ++ printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -"); ++ printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-"); ++ printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- "); ++ ++ break; ++#endif /* USE_EAPTLS */ ++ + case EAPT_NAK: + if (len <= 0) { + printer(arg, " "); +@@ -2426,3 +2872,4 @@ + + return (inp - pstart); + } ++ +diff -aur ppp-2.4.6.orig/pppd/eap.h ppp-2.4.6/pppd/eap.h +--- ppp-2.4.6.orig/pppd/eap.h 2014-01-02 05:42:08.000000000 +0100 ++++ ppp-2.4.6/pppd/eap.h 2014-04-03 21:32:29.079960484 +0200 +@@ -84,6 +84,16 @@ + eapClosed, /* Authentication not in use */ + eapListen, /* Client ready (and timer running) */ + eapIdentify, /* EAP Identify sent */ ++ eapTlsStart, /* Send EAP-TLS start packet */ ++ eapTlsRecv, /* Receive EAP-TLS tls data */ ++ eapTlsSendAck, /* Send EAP-TLS ack */ ++ eapTlsSend, /* Send EAP-TLS tls data */ ++ eapTlsRecvAck, /* Receive EAP-TLS ack */ ++ eapTlsRecvClient, /* Receive EAP-TLS auth response from client*/ ++ eapTlsSendAlert, /* Send EAP-TLS tls alert (server)*/ ++ eapTlsRecvAlertAck, /* Receive EAP-TLS ack after sending alert */ ++ eapTlsRecvSuccess, /* Receive EAP success */ ++ eapTlsRecvFailure, /* Receive EAP failure */ + eapSRP1, /* Sent EAP SRP-SHA1 Subtype 1 */ + eapSRP2, /* Sent EAP SRP-SHA1 Subtype 2 */ + eapSRP3, /* Sent EAP SRP-SHA1 Subtype 3 */ +@@ -95,9 +105,18 @@ + + #define EAP_STATES \ + "Initial", "Pending", "Closed", "Listen", "Identify", \ ++ "TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\ ++ "TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \ + "SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth" + +-#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) ++#ifdef USE_EAPTLS ++#define eap_client_active(esp) ((esp)->es_client.ea_state != eapInitial ||\ ++ (esp)->es_client.ea_state != eapPending ||\ ++ (esp)->es_client.ea_state != eapClosed) ++#else ++#define eap_client_active(esp) ((esp)->es_client.ea_state == eapListen) ++#endif /* USE_EAPTLS */ ++ + #define eap_server_active(esp) \ + ((esp)->es_server.ea_state >= eapIdentify && \ + (esp)->es_server.ea_state <= eapMD5Chall) +@@ -112,11 +131,17 @@ + u_short ea_namelen; /* Length of our name */ + u_short ea_peerlen; /* Length of peer's name */ + enum eap_state_code ea_state; ++#ifdef USE_EAPTLS ++ enum eap_state_code ea_prev_state; ++#endif + u_char ea_id; /* Current id */ + u_char ea_requests; /* Number of Requests sent/received */ + u_char ea_responses; /* Number of Responses */ + u_char ea_type; /* One of EAPT_* */ + u_int32_t ea_keyflags; /* SRP shared key usage flags */ ++#ifdef USE_EAPTLS ++ bool ea_using_eaptls; ++#endif + }; + + /* +@@ -139,7 +164,12 @@ + * Timeouts. + */ + #define EAP_DEFTIMEOUT 3 /* Timeout (seconds) for rexmit */ ++#ifdef USE_EAPTLS ++#define EAP_DEFTRANSMITS 30 /* max # times to transmit */ ++ /* certificates can be long ... */ ++#else + #define EAP_DEFTRANSMITS 10 /* max # times to transmit */ ++#endif /* USE_EAPTLS */ + #define EAP_DEFREQTIME 20 /* Time to wait for peer request */ + #define EAP_DEFALLOWREQ 20 /* max # times to accept requests */ + +diff -Naur ppp-2.4.5/pppd/eap-tls.c ppp-2.4.5-eaptls-mppe-0.99/pppd/eap-tls.c +--- ppp-2.4.5/pppd/eap-tls.c 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.5-eaptls-mppe-0.99/pppd/eap-tls.c 2010-10-05 15:12:45.881615580 +0200 +@@ -0,0 +1,1174 @@ ++/* ++ * eap-tls.c - EAP-TLS implementation for PPP ++ * ++ * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in ++ * the documentation and/or other materials provided with the ++ * distribution. ++ * ++ * 3. The name(s) of the authors of this software must not be used to ++ * endorse or promote products derived from this software without ++ * prior written permission. ++ * ++ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO ++ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY ++ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY ++ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN ++ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING ++ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ * ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include "pppd.h" ++#include "eap.h" ++#include "eap-tls.h" ++#include "fsm.h" ++#include "lcp.h" ++#include "pathnames.h" ++ ++/* The openssl configuration file and engines can be loaded only once */ ++static CONF *ssl_config = NULL; ++static ENGINE *cert_engine = NULL; ++static ENGINE *pkey_engine = NULL; ++ ++#ifdef MPPE ++ ++/* ++ * TLS PRF from RFC 2246 ++ */ ++static void P_hash(const EVP_MD *evp_md, ++ const unsigned char *secret, unsigned int secret_len, ++ const unsigned char *seed, unsigned int seed_len, ++ unsigned char *out, unsigned int out_len) ++{ ++ HMAC_CTX ctx_a, ctx_out; ++ unsigned char a[HMAC_MAX_MD_CBLOCK]; ++ unsigned int size; ++ ++ HMAC_CTX_init(&ctx_a); ++ HMAC_CTX_init(&ctx_out); ++ HMAC_Init_ex(&ctx_a, secret, secret_len, evp_md, NULL); ++ HMAC_Init_ex(&ctx_out, secret, secret_len, evp_md, NULL); ++ ++ size = HMAC_size(&ctx_out); ++ ++ /* Calculate A(1) */ ++ HMAC_Update(&ctx_a, seed, seed_len); ++ HMAC_Final(&ctx_a, a, NULL); ++ ++ while (1) { ++ /* Calculate next part of output */ ++ HMAC_Update(&ctx_out, a, size); ++ HMAC_Update(&ctx_out, seed, seed_len); ++ ++ /* Check if last part */ ++ if (out_len < size) { ++ HMAC_Final(&ctx_out, a, NULL); ++ memcpy(out, a, out_len); ++ break; ++ } ++ ++ /* Place digest in output buffer */ ++ HMAC_Final(&ctx_out, out, NULL); ++ HMAC_Init_ex(&ctx_out, NULL, 0, NULL, NULL); ++ out += size; ++ out_len -= size; ++ ++ /* Calculate next A(i) */ ++ HMAC_Init_ex(&ctx_a, NULL, 0, NULL, NULL); ++ HMAC_Update(&ctx_a, a, size); ++ HMAC_Final(&ctx_a, a, NULL); ++ } ++ ++ HMAC_CTX_cleanup(&ctx_a); ++ HMAC_CTX_cleanup(&ctx_out); ++ memset(a, 0, sizeof(a)); ++} ++ ++static void PRF(const unsigned char *secret, unsigned int secret_len, ++ const unsigned char *seed, unsigned int seed_len, ++ unsigned char *out, unsigned char *buf, unsigned int out_len) ++{ ++ unsigned int i; ++ unsigned int len = (secret_len + 1) / 2; ++ const unsigned char *s1 = secret; ++ const unsigned char *s2 = secret + (secret_len - len); ++ ++ P_hash(EVP_md5(), s1, len, seed, seed_len, out, out_len); ++ P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len); ++ ++ for (i=0; i < out_len; i++) { ++ out[i] ^= buf[i]; ++ } ++} ++ ++#define EAPTLS_MPPE_KEY_LEN 32 ++ ++/* ++ * Generate keys according to RFC 2716 and add to reply ++ */ ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, ++ int client) ++{ ++ unsigned char out[4*EAPTLS_MPPE_KEY_LEN], buf[4*EAPTLS_MPPE_KEY_LEN]; ++ unsigned char seed[64 + 2*SSL3_RANDOM_SIZE]; ++ unsigned char *p = seed; ++ SSL *s = ets->ssl; ++ size_t prf_size; ++ ++ prf_size = strlen(prf_label); ++ ++ memcpy(p, prf_label, prf_size); ++ p += prf_size; ++ ++ memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE); ++ p += SSL3_RANDOM_SIZE; ++ prf_size += SSL3_RANDOM_SIZE; ++ ++ memcpy(p, s->s3->server_random, SSL3_RANDOM_SIZE); ++ prf_size += SSL3_RANDOM_SIZE; ++ ++ PRF(s->session->master_key, s->session->master_key_length, ++ seed, prf_size, out, buf, sizeof(out)); ++ ++ /* ++ * We now have the master send and receive keys. ++ * From these, generate the session send and receive keys. ++ * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details) ++ */ ++ if (client) ++ { ++ p = out; ++ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); ++ p += EAPTLS_MPPE_KEY_LEN; ++ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); ++ } ++ else ++ { ++ p = out; ++ BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) ); ++ p += EAPTLS_MPPE_KEY_LEN; ++ BCOPY( p, mppe_send_key, sizeof(mppe_send_key) ); ++ } ++ ++ mppe_keys_set = 1; ++} ++ ++#endif ++ ++void log_ssl_errors( void ) ++{ ++ unsigned long ssl_err = ERR_get_error(); ++ ++ if (ssl_err != 0) ++ dbglog("EAP-TLS SSL error stack:"); ++ while (ssl_err != 0) { ++ dbglog( ERR_error_string( ssl_err, NULL ) ); ++ ssl_err = ERR_get_error(); ++ } ++} ++ ++ ++int password_callback (char *buf, int size, int rwflag, void *u) ++{ ++ if (buf) ++ { ++ strncpy (buf, passwd, size); ++ return strlen (buf); ++ } ++ return 0; ++} ++ ++ ++CONF *eaptls_ssl_load_config( void ) ++{ ++ CONF *config; ++ int ret_code; ++ long error_line = 33; ++ ++ config = NCONF_new( NULL ); ++ dbglog( "Loading OpenSSL config file" ); ++ ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line ); ++ if (ret_code == 0) ++ { ++ warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line ); ++ NCONF_free( config ); ++ config = NULL; ++ ERR_clear_error(); ++ } ++ ++ dbglog( "Loading OpenSSL built-ins" ); ++ ENGINE_load_builtin_engines(); ++ OPENSSL_load_builtin_modules(); ++ ++ dbglog( "Loading OpenSSL configured modules" ); ++ if (CONF_modules_load( config, NULL, 0 ) <= 0 ) ++ { ++ warn( "EAP-TLS: Error loading OpenSSL modules" ); ++ log_ssl_errors(); ++ config = NULL; ++ } ++ ++ return config; ++} ++ ++ENGINE *eaptls_ssl_load_engine( char *engine_name ) ++{ ++ ENGINE *e = NULL; ++ ++ dbglog( "Enabling OpenSSL auto engines" ); ++ ENGINE_register_all_complete(); ++ ++ dbglog( "Loading OpenSSL '%s' engine support", engine_name ); ++ e = ENGINE_by_id( engine_name ); ++ if (!e) ++ { ++ dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name ); ++ e = ENGINE_by_id( "dynamic" ); ++ if (e) ++ { ++ if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0) ++ || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) ++ { ++ warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name ); ++ log_ssl_errors(); ++ ENGINE_free(e); ++ e = NULL; ++ } ++ } ++ else ++ { ++ warn( "EAP-TLS: Cannot load dynamic engine support" ); ++ } ++ } ++ ++ if (e) ++ { ++ dbglog( "Initialising engine" ); ++ if(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) ++ { ++ warn( "EAP-TLS: Cannot use that engine" ); ++ log_ssl_errors(); ++ ENGINE_free(e); ++ e = NULL; ++ } ++ } ++ ++ return e; ++} ++ ++/* ++ * Initialize the SSL stacks and tests if certificates, key and crl ++ * for client or server use can be loaded. ++ */ ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++ char *certfile, char *peer_certfile, char *privkeyfile) ++{ ++ char *cert_engine_name = NULL; ++ char *cert_identifier = NULL; ++ char *pkey_engine_name = NULL; ++ char *pkey_identifier = NULL; ++ SSL_CTX *ctx; ++ X509_STORE *certstore; ++ X509_LOOKUP *lookup; ++ X509 *tmp; ++ ++ /* ++ * Without these can't continue ++ */ ++ if (!cacertfile[0]) ++ { ++ error("EAP-TLS: CA certificate missing"); ++ return NULL; ++ } ++ ++ if (!certfile[0]) ++ { ++ error("EAP-TLS: User certificate missing"); ++ return NULL; ++ } ++ ++ if (!privkeyfile[0]) ++ { ++ error("EAP-TLS: User private key missing"); ++ return NULL; ++ } ++ ++ SSL_library_init(); ++ SSL_load_error_strings(); ++ ++ ctx = SSL_CTX_new(TLSv1_method()); ++ ++ if (!ctx) { ++ error("EAP-TLS: Cannot initialize SSL CTX context"); ++ goto fail; ++ } ++ ++ /* if the certificate filename is of the form engine:id. e.g. ++ pkcs11:12345 ++ then we try to load and use this engine. ++ If the certificate filename starts with a / or . then we ++ ALWAYS assume it is a file and not an engine/pkcs11 identifier ++ */ ++ if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL ) ++ { ++ cert_identifier = index( certfile, ':' ); ++ ++ if (cert_identifier) ++ { ++ cert_engine_name = certfile; ++ *cert_identifier = '\0'; ++ cert_identifier++; ++ ++ dbglog( "Found certificate engine '%s'", cert_engine_name ); ++ dbglog( "Found certificate identifier '%s'", cert_identifier ); ++ } ++ } ++ ++ /* if the privatekey filename is of the form engine:id. e.g. ++ pkcs11:12345 ++ then we try to load and use this engine. ++ If the privatekey filename starts with a / or . then we ++ ALWAYS assume it is a file and not an engine/pkcs11 identifier ++ */ ++ if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL ) ++ { ++ pkey_identifier = index( privkeyfile, ':' ); ++ ++ if (pkey_identifier) ++ { ++ pkey_engine_name = privkeyfile; ++ *pkey_identifier = '\0'; ++ pkey_identifier++; ++ ++ dbglog( "Found privatekey engine '%s'", pkey_engine_name ); ++ dbglog( "Found privatekey identifier '%s'", pkey_identifier ); ++ } ++ } ++ ++ if (cert_identifier && pkey_identifier) ++ { ++ if (strlen( cert_identifier ) == 0) ++ { ++ if (strlen( pkey_identifier ) == 0) ++ error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" ); ++ else ++ { ++ dbglog( "Substituting privatekey identifier for certificate identifier" ); ++ cert_identifier = pkey_identifier; ++ } ++ } ++ else ++ { ++ if (strlen( pkey_identifier ) == 0) ++ { ++ dbglog( "Substituting certificate identifier for privatekey identifier" ); ++ pkey_identifier = cert_identifier; ++ } ++ } ++ ++ } ++ ++ /* load the openssl config file only once */ ++ if (!ssl_config) ++ { ++ if (cert_engine_name || pkey_engine_name) ++ ssl_config = eaptls_ssl_load_config(); ++ ++ if (ssl_config && cert_engine_name) ++ cert_engine = eaptls_ssl_load_engine( cert_engine_name ); ++ ++ if (ssl_config && pkey_engine_name) ++ { ++ /* don't load the same engine twice */ ++ if ( strcmp( cert_engine_name, pkey_engine_name) == 0 ) ++ pkey_engine = cert_engine; ++ else ++ pkey_engine = eaptls_ssl_load_engine( pkey_engine_name ); ++ } ++ } ++ ++ SSL_CTX_set_default_passwd_cb (ctx, password_callback); ++ ++ if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL)) ++ { ++ error("EAP-TLS: Cannot load or verify CA file %s", cacertfile); ++ goto fail; ++ } ++ ++ if (init_server) ++ SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile)); ++ ++ if (cert_engine) ++ { ++ struct ++ { ++ const char *s_slot_cert_id; ++ X509 *cert; ++ } cert_info; ++ ++ cert_info.s_slot_cert_id = cert_identifier; ++ cert_info.cert = NULL; ++ ++ if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) ) ++ { ++ error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier ); ++ goto fail; ++ } ++ ++ if (cert_info.cert) ++ { ++ dbglog( "Got the certificate, adding it to SSL context" ); ++ dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) ); ++ if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0) ++ { ++ error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier); ++ goto fail; ++ } ++ } ++ else ++ { ++ warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier); ++ log_ssl_errors(); ++ } ++ } ++ else ++ { ++ if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM)) ++ { ++ error( "EAP-TLS: Cannot use public certificate %s", certfile ); ++ goto fail; ++ } ++ } ++ ++ if (pkey_engine) ++ { ++ EVP_PKEY *pkey = NULL; ++ PW_CB_DATA cb_data; ++ ++ cb_data.password = passwd; ++ cb_data.prompt_info = pkey_identifier; ++ ++ dbglog( "Loading private key '%s' from engine", pkey_identifier ); ++ pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data); ++ if (pkey) ++ { ++ dbglog( "Got the private key, adding it to SSL context" ); ++ if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0) ++ { ++ error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier); ++ goto fail; ++ } ++ } ++ else ++ { ++ warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier); ++ log_ssl_errors(); ++ } ++ } ++ else ++ { ++ if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM)) ++ { ++ error("EAP-TLS: Cannot use private key %s", privkeyfile); ++ goto fail; ++ } ++ } ++ ++ if (SSL_CTX_check_private_key(ctx) != 1) { ++ error("EAP-TLS: Private key %s fails security check", privkeyfile); ++ goto fail; ++ } ++ ++ SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); ++ SSL_CTX_set_verify_depth(ctx, 5); ++ SSL_CTX_set_verify(ctx, ++ SSL_VERIFY_PEER | ++ SSL_VERIFY_FAIL_IF_NO_PEER_CERT, ++ &ssl_verify_callback); ++ ++ if (crl_dir) { ++ if (!(certstore = SSL_CTX_get_cert_store(ctx))) { ++ error("EAP-TLS: Failed to get certificate store"); ++ goto fail; ++ } ++ ++ if (!(lookup = ++ X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) { ++ error("EAP-TLS: Store lookup for CRL failed"); ++ ++ goto fail; ++ } ++ ++ X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM); ++ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); ++ } ++ ++ /* ++ * If a peer certificate file was specified, it must be valid, else fail ++ */ ++ if (peer_certfile[0]) { ++ if (!(tmp = get_X509_from_file(peer_certfile))) { ++ error("EAP-TLS: Error loading client certificate from file %s", ++ peer_certfile); ++ goto fail; ++ } ++ X509_free(tmp); ++ } ++ ++ return ctx; ++ ++fail: ++ log_ssl_errors(); ++ SSL_CTX_free(ctx); ++ return NULL; ++} ++ ++/* ++ * Determine the maximum packet size by looking at the LCP handshake ++ */ ++ ++int eaptls_get_mtu(int unit) ++{ ++ int mtu, mru; ++ ++ lcp_options *wo = &lcp_wantoptions[unit]; ++ lcp_options *go = &lcp_gotoptions[unit]; ++ lcp_options *ho = &lcp_hisoptions[unit]; ++ lcp_options *ao = &lcp_allowoptions[unit]; ++ ++ mtu = ho->neg_mru? ho->mru: PPP_MRU; ++ mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU; ++ mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10; ++ ++ dbglog("MTU = %d", mtu); ++ return mtu; ++} ++ ++ ++/* ++ * Init the ssl handshake (server mode) ++ */ ++int eaptls_init_ssl_server(eap_state * esp) ++{ ++ struct eaptls_session *ets; ++ char servcertfile[MAXWORDLEN]; ++ char clicertfile[MAXWORDLEN]; ++ char cacertfile[MAXWORDLEN]; ++ char pkfile[MAXWORDLEN]; ++ /* ++ * Allocate new eaptls session ++ */ ++ esp->es_server.ea_session = malloc(sizeof(struct eaptls_session)); ++ if (!esp->es_server.ea_session) ++ fatal("Allocation error"); ++ ets = esp->es_server.ea_session; ++ ++ if (!esp->es_server.ea_peer) { ++ error("EAP-TLS: Error: client name not set (BUG)"); ++ return 0; ++ } ++ ++ strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN); ++ ++ dbglog( "getting eaptls secret" ); ++ if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer, ++ esp->es_server.ea_name, clicertfile, ++ servcertfile, cacertfile, pkfile, 1)) { ++ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", ++ esp->es_server.ea_peer, esp->es_server.ea_name ); ++ return 0; ++ } ++ ++ ets->mtu = eaptls_get_mtu(esp->es_unit); ++ ++ ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile); ++ if (!ets->ctx) ++ goto fail; ++ ++ if (!(ets->ssl = SSL_new(ets->ctx))) ++ goto fail; ++ ++ /* ++ * Set auto-retry to avoid timeouts on BIO_read ++ */ ++ SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY); ++ ++ /* ++ * Initialize the BIOs we use to read/write to ssl engine ++ */ ++ ets->into_ssl = BIO_new(BIO_s_mem()); ++ ets->from_ssl = BIO_new(BIO_s_mem()); ++ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); ++ ++ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); ++ SSL_set_msg_callback_arg(ets->ssl, ets); ++ ++ /* ++ * Attach the session struct to the connection, so we can later ++ * retrieve it when doing certificate verification ++ */ ++ SSL_set_ex_data(ets->ssl, 0, ets); ++ ++ SSL_set_accept_state(ets->ssl); ++ ++ ets->data = NULL; ++ ets->datalen = 0; ++ ets->alert_sent = 0; ++ ets->alert_recv = 0; ++ ++ /* ++ * If we specified the client certificate file, store it in ets->peercertfile, ++ * so we can check it later in ssl_verify_callback() ++ */ ++ if (clicertfile[0]) ++ strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN); ++ else ++ ets->peercertfile[0] = 0; ++ ++ return 1; ++ ++fail: ++ SSL_CTX_free(ets->ctx); ++ return 0; ++} ++ ++/* ++ * Init the ssl handshake (client mode) ++ */ ++int eaptls_init_ssl_client(eap_state * esp) ++{ ++ struct eaptls_session *ets; ++ char servcertfile[MAXWORDLEN]; ++ char clicertfile[MAXWORDLEN]; ++ char cacertfile[MAXWORDLEN]; ++ char pkfile[MAXWORDLEN]; ++ ++ /* ++ * Allocate new eaptls session ++ */ ++ esp->es_client.ea_session = malloc(sizeof(struct eaptls_session)); ++ if (!esp->es_client.ea_session) ++ fatal("Allocation error"); ++ ets = esp->es_client.ea_session; ++ ++ /* ++ * If available, copy server name in ets; it will be used in cert ++ * verify ++ */ ++ if (esp->es_client.ea_peer) ++ strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN); ++ else ++ ets->peer[0] = 0; ++ ++ ets->mtu = eaptls_get_mtu(esp->es_unit); ++ ++ dbglog( "calling get_eaptls_secret" ); ++ if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name, ++ esp->es_client.ea_peer, clicertfile, ++ servcertfile, cacertfile, pkfile, 0)) { ++ error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"", ++ esp->es_client.ea_name, esp->es_client.ea_peer ); ++ return 0; ++ } ++ ++ dbglog( "calling eaptls_init_ssl" ); ++ ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile); ++ if (!ets->ctx) ++ goto fail; ++ ++ ets->ssl = SSL_new(ets->ctx); ++ ++ if (!ets->ssl) ++ goto fail; ++ ++ /* ++ * Initialize the BIOs we use to read/write to ssl engine ++ */ ++ dbglog( "Initializing SSL BIOs" ); ++ ets->into_ssl = BIO_new(BIO_s_mem()); ++ ets->from_ssl = BIO_new(BIO_s_mem()); ++ SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl); ++ ++ SSL_set_msg_callback(ets->ssl, ssl_msg_callback); ++ SSL_set_msg_callback_arg(ets->ssl, ets); ++ ++ /* ++ * Attach the session struct to the connection, so we can later ++ * retrieve it when doing certificate verification ++ */ ++ SSL_set_ex_data(ets->ssl, 0, ets); ++ ++ SSL_set_connect_state(ets->ssl); ++ ++ ets->data = NULL; ++ ets->datalen = 0; ++ ets->alert_sent = 0; ++ ets->alert_recv = 0; ++ ++ /* ++ * If we specified the server certificate file, store it in ++ * ets->peercertfile, so we can check it later in ++ * ssl_verify_callback() ++ */ ++ if (servcertfile[0]) ++ strncpy(ets->peercertfile, servcertfile, MAXWORDLEN); ++ else ++ ets->peercertfile[0] = 0; ++ ++ return 1; ++ ++fail: ++ dbglog( "eaptls_init_ssl_client: fail" ); ++ SSL_CTX_free(ets->ctx); ++ return 0; ++ ++} ++ ++void eaptls_free_session(struct eaptls_session *ets) ++{ ++ if (ets->ssl) ++ SSL_free(ets->ssl); ++ ++ if (ets->ctx) ++ SSL_CTX_free(ets->ctx); ++ ++ free(ets); ++} ++ ++/* ++ * Handle a received packet, reassembling fragmented messages and ++ * passing them to the ssl engine ++ */ ++int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len) ++{ ++ u_char flags; ++ u_int tlslen; ++ u_char dummy[65536]; ++ ++ GETCHAR(flags, inp); ++ len--; ++ ++ if (flags & EAP_TLS_FLAGS_LI && !ets->data) { ++ ++ /* ++ * This is the first packet of a message ++ */ ++ ++ GETLONG(tlslen, inp); ++ len -= 4; ++ ++ if (tlslen > EAP_TLS_MAX_LEN) { ++ error("Error: tls message length > %d, truncated", ++ EAP_TLS_MAX_LEN); ++ tlslen = EAP_TLS_MAX_LEN; ++ } ++ ++ /* ++ * Allocate memory for the whole message ++ */ ++ ets->data = malloc(tlslen); ++ if (!ets->data) ++ fatal("EAP TLS: allocation error\n"); ++ ++ ets->datalen = 0; ++ ets->tlslen = tlslen; ++ ++ } ++ else if (flags & EAP_TLS_FLAGS_LI && ets->data) { ++ /* ++ * Non first with LI (strange...) ++ */ ++ ++ GETLONG(tlslen, inp); ++ len -= 4; ++ ++ } ++ else if (!ets->data) { ++ /* ++ * A non fragmented message without LI flag ++ */ ++ ++ ets->data = malloc(len); ++ if (!ets->data) ++ fatal("EAP TLS: allocation error\n"); ++ ++ ets->datalen = 0; ++ ets->tlslen = len; ++ } ++ ++ if (flags & EAP_TLS_FLAGS_MF) ++ ets->frag = 1; ++ else ++ ets->frag = 0; ++ ++ if (len + ets->datalen > ets->tlslen) { ++ warn("EAP TLS: received data > TLS message length"); ++ return 1; ++ } ++ ++ BCOPY(inp, ets->data + ets->datalen, len); ++ ets->datalen += len; ++ ++ if (!ets->frag) { ++ ++ /* ++ * If we have the whole message, pass it to ssl ++ */ ++ ++ if (ets->datalen != ets->tlslen) { ++ warn("EAP TLS: received data != TLS message length"); ++ return 1; ++ } ++ ++ if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1) ++ log_ssl_errors(); ++ ++ SSL_read(ets->ssl, dummy, 65536); ++ ++ free(ets->data); ++ ets->data = NULL; ++ ets->datalen = 0; ++ } ++ ++ return 0; ++} ++ ++/* ++ * Return an eap-tls packet in outp. ++ * A TLS message read from the ssl engine is buffered in ets->data. ++ * At each call we control if there is buffered data and send a ++ * packet of mtu bytes. ++ */ ++int eaptls_send(struct eaptls_session *ets, u_char ** outp) ++{ ++ bool first = 0; ++ int size; ++ u_char fromtls[65536]; ++ int res; ++ u_char *start; ++ ++ start = *outp; ++ ++ if (!ets->data) { ++ ++ if(!ets->alert_sent) ++ SSL_read(ets->ssl, fromtls, 65536); ++ ++ /* ++ * Read from ssl ++ */ ++ if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1) ++ fatal("No data from BIO_read"); ++ ++ ets->datalen = res; ++ ++ ets->data = malloc(ets->datalen); ++ BCOPY(fromtls, ets->data, ets->datalen); ++ ++ ets->offset = 0; ++ first = 1; ++ ++ } ++ ++ size = ets->datalen - ets->offset; ++ ++ if (size > ets->mtu) { ++ size = ets->mtu; ++ ets->frag = 1; ++ } else ++ ets->frag = 0; ++ ++ PUTCHAR(EAPT_TLS, *outp); ++ ++ /* ++ * Set right flags and length if necessary ++ */ ++ if (ets->frag && first) { ++ PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp); ++ PUTLONG(ets->datalen, *outp); ++ } else if (ets->frag) { ++ PUTCHAR(EAP_TLS_FLAGS_MF, *outp); ++ } else ++ PUTCHAR(0, *outp); ++ ++ /* ++ * Copy the data in outp ++ */ ++ BCOPY(ets->data + ets->offset, *outp, size); ++ INCPTR(size, *outp); ++ ++ /* ++ * Copy the packet in retransmission buffer ++ */ ++ BCOPY(start, &ets->rtx[0], *outp - start); ++ ets->rtx_len = *outp - start; ++ ++ ets->offset += size; ++ ++ if (ets->offset >= ets->datalen) { ++ ++ /* ++ * The whole message has been sent ++ */ ++ ++ free(ets->data); ++ ets->data = NULL; ++ ets->datalen = 0; ++ ets->offset = 0; ++ } ++ ++ return 0; ++} ++ ++/* ++ * Get the sent packet from the retransmission buffer ++ */ ++void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp) ++{ ++ BCOPY(ets->rtx, *outp, ets->rtx_len); ++ INCPTR(ets->rtx_len, *outp); ++} ++ ++/* ++ * Verify a certificate. ++ * Most of the work (signatures and issuer attributes checking) ++ * is done by ssl; we check the CN in the peer certificate ++ * against the peer name. ++ */ ++int ssl_verify_callback(int preverify_ok, X509_STORE_CTX * ctx) ++{ ++ char subject[256]; ++ char cn_str[256]; ++ X509 *peer_cert; ++ int err, depth; ++ int ok = preverify_ok; ++ SSL *ssl; ++ struct eaptls_session *ets; ++ ++ peer_cert = X509_STORE_CTX_get_current_cert(ctx); ++ err = X509_STORE_CTX_get_error(ctx); ++ depth = X509_STORE_CTX_get_error_depth(ctx); ++ ++ dbglog("certificate verify depth: %d", depth); ++ ++ if (auth_required && !ok) { ++ X509_NAME_oneline(X509_get_subject_name(peer_cert), ++ subject, 256); ++ ++ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), ++ NID_commonName, cn_str, 256); ++ ++ dbglog("Certificate verification error:\n depth: %d CN: %s" ++ "\n err: %d (%s)\n", depth, cn_str, err, ++ X509_verify_cert_error_string(err)); ++ ++ return 0; ++ } ++ ++ ssl = X509_STORE_CTX_get_ex_data(ctx, ++ SSL_get_ex_data_X509_STORE_CTX_idx()); ++ ++ ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0); ++ ++ if (ets == NULL) { ++ error("Error: SSL_get_ex_data returned NULL"); ++ return 0; ++ } ++ ++ log_ssl_errors(); ++ ++ if (!depth) { /* This is the peer certificate */ ++ ++ X509_NAME_oneline(X509_get_subject_name(peer_cert), ++ subject, 256); ++ ++ X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert), ++ NID_commonName, cn_str, 256); ++ ++ /* ++ * If acting as client and the name of the server wasn't specified ++ * explicitely, we can't verify the server authenticity ++ */ ++ if (!ets->peer[0]) { ++ warn("Peer name not specified: no check"); ++ return 1; ++ } ++ ++ /* ++ * Check the CN ++ */ ++ if (strcmp(cn_str, ets->peer)) { ++ error ++ ("Certificate verification error: CN (%s) != peer_name (%s)", ++ cn_str, ets->peer); ++ return 0; ++ } ++ ++ warn("Certificate CN: %s , peer name %s", cn_str, ets->peer); ++ ++ /* ++ * If a peer certificate file was specified, here we check it ++ */ ++ if (ets->peercertfile[0]) { ++ if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert) ++ != 0) { ++ error ++ ("Peer certificate doesn't match stored certificate"); ++ return 0; ++ } ++ } ++ } ++ ++ return 1; ++} ++ ++/* ++ * Compare a certificate with the one stored in a file ++ */ ++int ssl_cmp_certs(char *filename, X509 * a) ++{ ++ X509 *b; ++ int ret; ++ ++ if (!(b = get_X509_from_file(filename))) ++ return 1; ++ ++ ret = X509_cmp(a, b); ++ X509_free(b); ++ ++ return ret; ++ ++} ++ ++X509 *get_X509_from_file(char *filename) ++{ ++ FILE *fp; ++ X509 *ret; ++ ++ if (!(fp = fopen(filename, "r"))) ++ return NULL; ++ ++ ret = PEM_read_X509(fp, NULL, NULL, NULL); ++ ++ fclose(fp); ++ ++ return ret; ++} ++ ++/* ++ * Every sent & received message this callback function is invoked, ++ * so we know when alert messages have arrived or are sent and ++ * we can print debug information about TLS handshake. ++ */ ++void ++ssl_msg_callback(int write_p, int version, int content_type, ++ const void *buf, size_t len, SSL * ssl, void *arg) ++{ ++ char string[256]; ++ struct eaptls_session *ets = (struct eaptls_session *)arg; ++ unsigned char code; ++ ++ if(write_p) ++ strcpy(string, " -> "); ++ else ++ strcpy(string, " <- "); ++ ++ ++ switch(content_type) { ++ ++ case SSL3_RT_ALERT: ++ strcat(string, "Alert: "); ++ code = ((const unsigned char *)buf)[1]; ++ ++ if (write_p) { ++ ets->alert_sent = 1; ++ ets->alert_sent_desc = code; ++ } else { ++ ets->alert_recv = 1; ++ ets->alert_recv_desc = code; ++ } ++ ++ strcat(string, SSL_alert_desc_string_long(code)); ++ break; ++ ++ case SSL3_RT_CHANGE_CIPHER_SPEC: ++ strcat(string, "ChangeCipherSpec"); ++ break; ++ ++ case SSL3_RT_HANDSHAKE: ++ ++ strcat(string, "Handshake: "); ++ code = ((const unsigned char *)buf)[0]; ++ ++ switch(code) { ++ case SSL3_MT_HELLO_REQUEST: ++ strcat(string,"Hello Request"); ++ break; ++ case SSL3_MT_CLIENT_HELLO: ++ strcat(string,"Client Hello"); ++ break; ++ case SSL3_MT_SERVER_HELLO: ++ strcat(string,"Server Hello"); ++ break; ++ case SSL3_MT_CERTIFICATE: ++ strcat(string,"Certificate"); ++ break; ++ case SSL3_MT_SERVER_KEY_EXCHANGE: ++ strcat(string,"Server Key Exchange"); ++ break; ++ case SSL3_MT_CERTIFICATE_REQUEST: ++ strcat(string,"Certificate Request"); ++ break; ++ case SSL3_MT_SERVER_DONE: ++ strcat(string,"Server Hello Done"); ++ break; ++ case SSL3_MT_CERTIFICATE_VERIFY: ++ strcat(string,"Certificate Verify"); ++ break; ++ case SSL3_MT_CLIENT_KEY_EXCHANGE: ++ strcat(string,"Client Key Exchange"); ++ break; ++ case SSL3_MT_FINISHED: ++ strcat(string,"Finished"); ++ break; ++ ++ default: ++ sprintf( string, "Handshake: Unknown SSL3 code received: %d", code ); ++ } ++ break; ++ ++ default: ++ sprintf( string, "SSL message contains unknown content type: %d", content_type ); ++ ++ } ++ ++ /* Alert messages must always be displayed */ ++ if(content_type == SSL3_RT_ALERT) ++ error("%s", string); ++ else ++ dbglog("%s", string); ++} ++ +diff -Naur ppp-2.4.5/pppd/eap-tls.h ppp-2.4.5-eaptls-mppe-0.99/pppd/eap-tls.h +--- ppp-2.4.5/pppd/eap-tls.h 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.5-eaptls-mppe-0.99/pppd/eap-tls.h 2010-10-01 15:17:54.213271816 +0200 +@@ -0,0 +1,107 @@ ++/* ++ * eap-tls.h ++ * ++ * Copyright (c) Beniamino Galvani 2005 All rights reserved. ++ * ++ * Redistribution and use in source and binary forms, with or without ++ * modification, are permitted provided that the following conditions ++ * are met: ++ * ++ * 1. Redistributions of source code must retain the above copyright ++ * notice, this list of conditions and the following disclaimer. ++ * ++ * 2. Redistributions in binary form must reproduce the above copyright ++ * notice, this list of conditions and the following disclaimer in ++ * the documentation and/or other materials provided with the ++ * distribution. ++ * ++ * 3. The name(s) of the authors of this software must not be used to ++ * endorse or promote products derived from this software without ++ * prior written permission. ++ * ++ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO ++ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY ++ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY ++ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES ++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN ++ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING ++ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ++ * ++ */ ++ ++#ifndef __EAP_TLS_H__ ++#define __EAP_TLS_H__ ++ ++#include "eap.h" ++ ++#include ++#include ++#include ++ ++#define EAP_TLS_FLAGS_LI 128 /* length included flag */ ++#define EAP_TLS_FLAGS_MF 64 /* more fragments flag */ ++#define EAP_TLS_FLAGS_START 32 /* start flag */ ++ ++#define EAP_TLS_MAX_LEN 65536 /* max eap tls packet size */ ++ ++struct eaptls_session ++{ ++ u_char *data; /* buffered data */ ++ int datalen; /* buffered data len */ ++ int offset; /* from where to send */ ++ int tlslen; /* total length of tls data */ ++ bool frag; /* packet is fragmented */ ++ SSL_CTX *ctx; ++ SSL *ssl; /* ssl connection */ ++ BIO *from_ssl; ++ BIO *into_ssl; ++ char peer[MAXWORDLEN]; /* peer name */ ++ char peercertfile[MAXWORDLEN]; ++ bool alert_sent; ++ u_char alert_sent_desc; ++ bool alert_recv; ++ u_char alert_recv_desc; ++ char rtx[65536]; /* retransmission buffer */ ++ int rtx_len; ++ int mtu; /* unit mtu */ ++}; ++ ++typedef struct pw_cb_data ++{ ++ const void *password; ++ const char *prompt_info; ++} PW_CB_DATA; ++ ++ ++int ssl_verify_callback(int, X509_STORE_CTX *); ++void ssl_msg_callback(int write_p, int version, int ct, const void *buf, ++ size_t len, SSL * ssl, void *arg); ++ ++X509 *get_X509_from_file(char *filename); ++int ssl_cmp_certs(char *filename, X509 * a); ++ ++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile, ++ char *certfile, char *peer_certfile, char *privkeyfile); ++int eaptls_init_ssl_server(eap_state * esp); ++int eaptls_init_ssl_client(eap_state * esp); ++void eaptls_free_session(struct eaptls_session *ets); ++ ++int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len); ++int eaptls_send(struct eaptls_session *ets, u_char ** outp); ++void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp); ++ ++int get_eaptls_secret(int unit, char *client, char *server, ++ char *clicertfile, char *servcertfile, char *cacertfile, ++ char *pkfile, int am_server); ++ ++#ifdef MPPE ++#include "mppe.h" /* MPPE_MAX_KEY_LEN */ ++extern u_char mppe_send_key[MPPE_MAX_KEY_LEN]; ++extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN]; ++extern int mppe_keys_set; ++ ++void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client); ++ ++#endif ++ ++#endif +diff -aur ppp-2.4.6.orig/pppd/Makefile.linux ppp-2.4.6/pppd/Makefile.linux +--- ppp-2.4.6.orig/pppd/Makefile.linux 2014-04-03 21:31:37.000000000 +0200 ++++ ppp-2.4.6/pppd/Makefile.linux 2014-04-03 21:32:29.076627151 +0200 +@@ -76,6 +76,9 @@ + # Use libutil + USE_LIBUTIL=y + ++# Enable EAP-TLS authentication (requires libssl and libcurl) ++USE_EAPTLS=y ++ + MAXOCTETS=y + + INCLUDE_DIRS= -I../include +@@ -115,6 +118,15 @@ + PPPDOBJS += sha1.o + endif + ++# EAP-TLS ++ifdef USE_EAPTLS ++CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include ++LIBS += -lssl -lcrypto ++PPPDSRC += eap-tls.c ++HEADERS += eap-tls.h ++PPPDOBJS += eap-tls.o ++endif ++ + ifdef HAS_SHADOW + CFLAGS += -DHAS_SHADOW + #LIBS += -lshadow $(LIBS) +diff -aur ppp-2.4.6.orig/pppd/md5.c ppp-2.4.6/pppd/md5.c +--- ppp-2.4.6.orig/pppd/md5.c 2014-01-02 05:42:08.000000000 +0100 ++++ ppp-2.4.6/pppd/md5.c 2014-04-03 21:32:29.079960484 +0200 +@@ -33,6 +33,8 @@ + *********************************************************************** + */ + ++#ifndef USE_EAPTLS ++ + #include + #include "md5.h" + +@@ -305,3 +307,5 @@ + ** End of md5.c ** + ******************************** (cut) ******************************** + */ ++#endif /* USE_EAPTLS */ ++ +diff -aur ppp-2.4.6.orig/pppd/md5.h ppp-2.4.6/pppd/md5.h +--- ppp-2.4.6.orig/pppd/md5.h 2014-01-02 05:42:08.000000000 +0100 ++++ ppp-2.4.6/pppd/md5.h 2014-04-03 21:32:29.079960484 +0200 +@@ -36,6 +36,7 @@ + ** documentation and/or software. ** + *********************************************************************** + */ ++#ifndef USE_EAPTLS + + #ifndef __MD5_INCLUDE__ + +@@ -63,3 +64,5 @@ + + #define __MD5_INCLUDE__ + #endif /* __MD5_INCLUDE__ */ ++ ++#endif /* USE_EAPTLS */ +diff -aur ppp-2.4.6.orig/pppd/options.c ppp-2.4.6/pppd/options.c +--- ppp-2.4.6.orig/pppd/options.c 2014-04-03 21:31:37.000000000 +0200 ++++ ppp-2.4.6/pppd/options.c 2014-04-03 21:33:58.363293525 +0200 +@@ -126,6 +126,11 @@ + int child_wait = 5; /* # seconds to wait for children at exit */ + struct userenv *userenv_list; /* user environment variables */ + ++#ifdef USE_EAPTLS ++bool only_update_crl_server = 0; /* update server crl and exit */ ++bool only_update_crl_client = 0; /* update client crl and exit */ ++#endif /* USE_EAPTLS */ ++ + #ifdef MAXOCTETS + unsigned int maxoctets = 0; /* default - no limit */ + int maxoctets_dir = 0; /* default - sum of traffic */ +@@ -351,6 +356,12 @@ + { "mo-timeout", o_int, &maxoctets_timeout, + "Check for traffic limit every N seconds", OPT_PRIO | OPT_LLIMIT | 1 }, + #endif ++#ifdef USE_EAPTLS ++ { "only-update-crl-server", o_bool, &only_update_crl_server, ++ "Update server CA CRLs and exit", 1 }, ++ { "only-update-crl-client", o_bool, &only_update_crl_client, ++ "Update client CA CRLs and exit", 1 }, ++#endif /* USE_EAPTLS */ + + { NULL } + }; +diff -aur ppp-2.4.6.orig/pppd/pathnames.h ppp-2.4.6/pppd/pathnames.h +--- ppp-2.4.6.orig/pppd/pathnames.h 2014-04-03 21:31:37.000000000 +0200 ++++ ppp-2.4.6/pppd/pathnames.h 2014-04-03 21:32:29.083293817 +0200 +@@ -25,6 +25,13 @@ + #define _PATH_UPAPFILE _ROOT_PATH "/etc/ppp/pap-secrets" + #define _PATH_CHAPFILE _ROOT_PATH "/etc/ppp/chap-secrets" + #define _PATH_SRPFILE _ROOT_PATH "/etc/ppp/srp-secrets" ++ ++#ifdef USE_EAPTLS ++#define _PATH_EAPTLSCLIFILE _ROOT_PATH "/etc/ppp/eaptls-client" ++#define _PATH_EAPTLSSERVFILE _ROOT_PATH "/etc/ppp/eaptls-server" ++#define _PATH_OPENSSLCONFFILE _ROOT_PATH "/etc/ppp/openssl.cnf" ++#endif /* USE_EAPTLS */ ++ + #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options" + #define _PATH_IPUP _ROOT_PATH "/etc/ppp/ip-up" + #define _PATH_IPDOWN _ROOT_PATH "/etc/ppp/ip-down" +diff -aur ppp-2.4.6.orig/pppd/plugins/Makefile.linux ppp-2.4.6/pppd/plugins/Makefile.linux +--- ppp-2.4.6.orig/pppd/plugins/Makefile.linux 2014-04-03 21:31:37.000000000 +0200 ++++ ppp-2.4.6/pppd/plugins/Makefile.linux 2014-04-03 21:32:29.083293817 +0200 +@@ -8,6 +8,9 @@ + LIBS = + INSTALL = install + ++# EAP-TLS ++CFLAGS += -DUSE_EAPTLS=1 ++ + DESTDIR = $(INSTROOT)@DESTDIR@ + BINDIR = $(DESTDIR)/sbin + MANDIR = $(DESTDIR)/share/man/man8 +diff -aur ppp-2.4.6.orig/pppd/plugins/passprompt.c ppp-2.4.6/pppd/plugins/passprompt.c +--- ppp-2.4.6.orig/pppd/plugins/passprompt.c 2014-01-02 05:42:08.000000000 +0100 ++++ ppp-2.4.6/pppd/plugins/passprompt.c 2014-04-03 21:32:29.083293817 +0200 +@@ -107,4 +107,7 @@ + { + add_options(options); + pap_passwd_hook = promptpass; ++#ifdef USE_EAPTLS ++ eaptls_passwd_hook = promptpass; ++#endif + } +diff -aur ppp-2.4.6.orig/pppd/plugins/passwordfd.c ppp-2.4.6/pppd/plugins/passwordfd.c +--- ppp-2.4.6.orig/pppd/plugins/passwordfd.c 2014-04-03 21:31:37.000000000 +0200 ++++ ppp-2.4.6/pppd/plugins/passwordfd.c 2014-04-03 21:32:29.083293817 +0200 +@@ -75,4 +75,9 @@ + + chap_check_hook = pwfd_check; + chap_passwd_hook = pwfd_passwd; ++ ++#ifdef USE_EAPTLS ++ eaptls_check_hook = pwfd_check; ++ eaptls_passwd_hook = pwfd_passwd; ++#endif + } +diff -aur ppp-2.4.6.orig/pppd/pppd.h ppp-2.4.6/pppd/pppd.h +--- ppp-2.4.6.orig/pppd/pppd.h 2014-04-03 21:31:37.000000000 +0200 ++++ ppp-2.4.6/pppd/pppd.h 2014-04-03 21:32:29.083293817 +0200 +@@ -329,6 +329,10 @@ + extern bool dryrun; /* check everything, print options, exit */ + extern int child_wait; /* # seconds to wait for children at end */ + ++#ifdef USE_EAPTLS ++extern char *crl_dir; ++#endif /* USE_EAPTLS */ ++ + #ifdef MAXOCTETS + extern unsigned int maxoctets; /* Maximum octetes per session (in bytes) */ + extern int maxoctets_dir; /* Direction : +@@ -743,6 +747,11 @@ + extern int (*chap_passwd_hook) __P((char *user, char *passwd)); + extern void (*multilink_join_hook) __P((void)); + ++#ifdef USE_EAPTLS ++extern int (*eaptls_check_hook) __P((void)); ++extern int (*eaptls_passwd_hook) __P((char *user, char *passwd)); ++#endif ++ + /* Let a plugin snoop sent and received packets. Useful for L2TP */ + extern void (*snoop_recv_hook) __P((unsigned char *p, int len)); + extern void (*snoop_send_hook) __P((unsigned char *p, int len)); +diff -Naur ppp-2.4.5/README.eap-tls ppp-2.4.5-eaptls-mppe-0.99/README.eap-tls +--- ppp-2.4.5/README.eap-tls 1970-01-01 01:00:00.000000000 +0100 ++++ ppp-2.4.5-eaptls-mppe-0.99/README.eap-tls 2010-10-01 15:17:54.205272328 +0200 +@@ -0,0 +1,169 @@ ++EAP-TLS authentication support for PPP ++====================================== ++ ++1. Intro ++ ++ The Extensible Authentication Protocol (EAP; RFC 3748) is a ++ security protocol that can be used with PPP. It provides a means ++ to plug in multiple optional authentication methods. ++ ++ Transport Level Security (TLS; RFC 2246) provides for mutual ++ authentication, integrity-protected ciphersuite negotiation and ++ key exchange between two endpoints. It also provides for optional ++ MPPE encryption. ++ ++ EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets, ++ allowing TLS mutual authentication to be used as a generic EAP ++ mechanism. It also provides optional encryption using the MPPE ++ protocol. ++ ++ This patch provide EAP-TLS support to pppd. ++ This authentication method can be used in both client or server ++ mode. ++ ++2. Building ++ ++ To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org) ++ is required. Any version from 0.9.7 should work. ++ ++ Configure, compile, and install as usual. ++ ++3. Configuration ++ ++ On the client side there are two ways to configure EAP-TLS: ++ ++ 1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters ++ ++ 2. edit the /etc/ppp/eaptls-client file. ++ Insert a line for each system with which you use EAP-TLS. ++ The line is composed of this fields separated by tab: ++ ++ - Client name ++ The name used by the client for authentication, can be * ++ - Server name ++ The name of the server, can be * ++ - Client certificate file ++ The file containing the certificate chain for the ++ client in PEM format ++ - Server certificate file ++ If you want to specify the certificate that the ++ server is allowed to use, put the certificate file name. ++ Else put a dash '-'. ++ - CA certificate file ++ The file containing the trusted CA certificates in PEM ++ format. ++ - Client private key file ++ The file containing the client private key in PEM format. ++ ++ ++ On the server side edit the /etc/ppp/eaptls-server file. ++ Insert a line for each system with which you use EAP-TLS. ++ The line is composed of this fields separated by tab: ++ ++ - Client name ++ The name used by the client for authentication, can be * ++ - Server name ++ The name of the server, can be * ++ - Client certificate file ++ If you want to specify the certificate that the ++ client is allowed to use, put the certificate file name. ++ Else put a dash '-'. ++ - Server certificate file ++ The file containing the certificate chain for the ++ server in PEM format ++ - CA certificate file ++ The file containing the trusted CA certificates in PEM ++ format. ++ - Client private key file ++ The file containing the server private key in PEM format. ++ - addresses ++ A list of IP addresses the client is allowed to use. ++ ++ ++ OpenSSL engine support is included starting with v0.95 of this patch. ++ Currently the only engine tested is the 'pkcs11' engine (hardware token ++ support). To use the 'pksc11' engine: ++ - Use a special private key fileiname in the /etc/ppp/eaptls-client file: ++ : ++ e.g. ++ pkcs11:123456 ++ ++ - The certificate can also be loaded from the 'pkcs11' engine using ++ a special client certificate filename in the /etc/ppp/eaptls-client file: ++ : ++ e.g. ++ pkcs11:123456 ++ ++ - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior ++ to starting 'pppd'. A sample openssl.cnf file is ++ ++ openssl_conf = openssl_def ++ ++ [ openssl_def ] ++ engines = engine_section ++ ++ [ engine_section ] ++ pkcs11 = pkcs11_section ++ ++ [ pkcs11_section ] ++ engine_id = pkcs11 ++ dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so ++ MODULE_PATH = /usr/lib64/libeTPkcs11.so ++ init = 0 ++ ++ - There are two ways to specify a password/PIN for the PKCS11 engine: ++ - inside the openssl.cnf file using ++ PIN = your-secret-pin ++ Note The keyword 'PIN' is case sensitive! ++ - Using the 'password' in the ppp options file. ++ From v0.97 of the eap-tls patch the password can also be supplied ++ using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c ++ for an example). ++ ++ ++4. Options ++ ++ These pppd options are available: ++ ++ ca ++ Use the CA public certificate found in in PEM format ++ cert ++ Use the client public certificate found in in PEM format ++ or in engine:engine_id format ++ key ++ Use the client private key found in in PEM format ++ or in engine:engine_id format ++ crl-dir ++ Use CRL files from dir. It contains CRL files in PEM ++ format and each file contains a CRL. The files are looked up ++ by the issuer name hash value. Use the c_rehash utility ++ to create necessary links. ++ need-peer-eap ++ If the peer doesn't ask us to authenticate or doesn't use eap ++ to authenticate us, disconnect. ++ ++ Note: ++ password-encrypted certificates can be used as of v0.94 of this ++ patch. The password for the eap-tls.key file is specified using ++ the regular ++ password .... ++ statement in the ppp options file, or by using the appropriate ++ plugin which supplies a 'eaptls_passwd_hook' routine. ++ ++5. Connecting ++ ++ If you're setting up a pppd server, edit the EAP-TLS configuration file ++ as written above and then run pppd with the 'auth' option to authenticate ++ the client. The EAP-TLS method will be used if the other eap methods can't ++ be used (no secrets). ++ ++ If you're setting up a client, edit the configuration file and then run ++ pppd with 'remotename' option to specify the server name. Add the ++ 'need-peer-eap' option if you want to be sure the peer ask you to ++ authenticate (and to use eap) and to disconnect if it doesn't. ++ ++6. Notes ++ ++ This is experimental code. ++ Send suggestions and comments to Jan Just Keijser ++ diff --git a/network/connection/ppp/files/ppp.logrotate b/network/connection/ppp/files/ppp.logrotate new file mode 100644 index 0000000000..7a72979ca9 --- /dev/null +++ b/network/connection/ppp/files/ppp.logrotate @@ -0,0 +1,10 @@ +# Logrotate file for ppp RPM + +/var/log/ppp/connect-errors { + missingok + compress + notifempty + daily + rotate 5 + create 0600 root root +} diff --git a/network/connection/ppp/files/ppp.pamd b/network/connection/ppp/files/ppp.pamd new file mode 100644 index 0000000000..280a77a2a6 --- /dev/null +++ b/network/connection/ppp/files/ppp.pamd @@ -0,0 +1,5 @@ +#%PAM-1.0 +auth include system-auth +account required pam_nologin.so +account include system-auth +session include system-auth diff --git a/network/connection/ppp/files/tmpfiles.conf b/network/connection/ppp/files/tmpfiles.conf new file mode 100644 index 0000000000..5ecd2ee8ce --- /dev/null +++ b/network/connection/ppp/files/tmpfiles.conf @@ -0,0 +1 @@ +d /run/ppp 0755 root root diff --git a/network/connection/ppp/pspec.xml b/network/connection/ppp/pspec.xml new file mode 100644 index 0000000000..52c0e7b3ab --- /dev/null +++ b/network/connection/ppp/pspec.xml @@ -0,0 +1,124 @@ + + + + + ppp + http://samba.org/ppp + + PisiLinux Community + admins@pisilinux.org + + BSD + GPLv2 + service + Point-to-point protocol - patched for PPPOE + The Point-to-Point Protocol (PPP) provides a standard way to transmit datagrams over a serial link. + http://samba.org/ftp/ppp/ppp-2.4.6.tar.gz + http://www.netservers.net.uk/gpl/ppp-dhcpc.tgz + + libpcap-devel + + + gentoo/02_all_make-vars.patch + gentoo/04_all_mpls.patch + gentoo/06_all_killaddr-smarter.patch + gentoo/08_all_wait-children.patch + gentoo/10_all_defaultgateway.patch + gentoo/12_all_linkpidfile.patch + gentoo/16_all_auth-fail.patch + gentoo/18_all_defaultmetric.patch + gentoo/20_all_dev-ppp.patch + gentoo/24_all_passwordfd-read-early.patch + gentoo/26_all_pppd-usepeerwins.patch + gentoo/28_all_connect-errors.patch + gentoo/30_all_Makefile.patch + gentoo/32_all_pado-timeout.patch + gentoo/34_all_lcp-echo-adaptive.patch + ppp-2.3.6-sample.patch + ppp-2.4.3-fix64.patch + ppp-2.4.2-change_resolv_conf.patch + nostrip.patch + ppp-2.4.3-local.patch + ppp-2.4.3-ipv6-accept-remote.patch + ppp-2.4.5-ppp_resolv.patch + ppp-2.4.5-var_run_ppp.patch + ppp-2.4.6-eaptls-mppe-0.99.patch + + + + + ppp + + libpcap + + + /etc + /usr/lib/tmpfiles.d/ppp.conf + /usr/lib + /usr/sbin + /usr/share/doc + /usr/share/man + /run/ppp + + + tmpfiles.conf + options-pptp + options-pppoe + chat-default + ip-up + ip-down + confd.ppp0 + ppp.pamd + ppp.logrotate + + + + + ppp-devel + Development files for ppp + + ppp + + + /usr/include + + + + + + 2014-04-03 + 2.4.6 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-01-10 + 2.4.5 + Add tmpfiles.conf + Marcin Bojara + marcin@pisilinux.org + + + 2013-09-12 + 2.4.5 + service.py no longer needed. + Marcin Bojara + marcin@pisilinux.org + + + 2013-05-23 + 2.4.5 + Add service.py + Marcin Bojara + marcin@pisilinux.org + + + 2010-10-13 + 2.4.5 + First release + Gökcen Eraslan + admins@pisilinux.org + + + diff --git a/network/connection/ppp/translations.xml b/network/connection/ppp/translations.xml new file mode 100644 index 0000000000..3790632cfc --- /dev/null +++ b/network/connection/ppp/translations.xml @@ -0,0 +1,13 @@ + + + + ppp + Modem ile internet erişimi için PPP (point to point protocol) noktadan noktaya erişim protokolü + PPP protokolü veriyi seri bir bağlantı üzerinden transfer etmek için standart bir yol sağlar. + + + + ppp-devel + ppp için geliştirme dosyaları + + diff --git a/network/connection/wpa_supplicant/actions.py b/network/connection/wpa_supplicant/actions.py new file mode 100644 index 0000000000..405c8c3936 --- /dev/null +++ b/network/connection/wpa_supplicant/actions.py @@ -0,0 +1,36 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools +from pisi.actionsapi import get + +def build(): + shelltools.cd("wpa_supplicant") + + #Enable syslog output + cflags = get.CFLAGS() + " -DCONFIG_DEBUG_SYSLOG" + shelltools.export("CFLAGS", cflags) + + autotools.make("V=1") + autotools.make("eapol_test") + +def install(): + shelltools.cd("wpa_supplicant") + + for bin in ["wpa_supplicant", "wpa_cli", "wpa_passphrase", "eapol_test"]: + pisitools.dosbin(bin) + + # Install dbus files + pisitools.insinto("/usr/share/dbus-1/system-services", "dbus/*.service") + pisitools.insinto("/etc/dbus-1/system.d", "dbus/dbus-wpa_supplicant.conf", "wpa_supplicant.conf") + + pisitools.doman("doc/docbook/*.5") + pisitools.doman("doc/docbook/*.8") + pisitools.newdoc("wpa_supplicant.conf", "wpa_supplicant.conf.example") + + pisitools.dodoc("ChangeLog", "../COPYING", "eap_testing.txt", "../README", "todo.txt") \ No newline at end of file diff --git a/network/connection/wpa_supplicant/comar/service.py b/network/connection/wpa_supplicant/comar/service.py new file mode 100644 index 0000000000..6b5016e823 --- /dev/null +++ b/network/connection/wpa_supplicant/comar/service.py @@ -0,0 +1,24 @@ +# -*- coding: utf-8 -*- +from comar.service import * + +serviceType = "local" +serviceDefault = "off" #NM starts wpa_supp automatically. Use at your own risk if you start manually +serviceDesc = _({"en": "WPA Daemon", + "tr": "WPA Hizmeti"}) + +PIDFILE = "/run/wpa_supplicant.pid" + +@synchronized +def start(): + startService(command="/usr/sbin/wpa_supplicant", + args="-WuB -P%s %s" % (PIDFILE, config.get("OPTS", "")), + pidfile=PIDFILE, + donotify=True) + +@synchronized +def stop(): + stopService(pidfile=PIDFILE, + donotify=True) + +def status(): + return isServiceRunning(PIDFILE) diff --git a/network/connection/wpa_supplicant/files/0001-AP-Verify-that-HT40-secondary-channel-is-supported.patch b/network/connection/wpa_supplicant/files/0001-AP-Verify-that-HT40-secondary-channel-is-supported.patch new file mode 100644 index 0000000000..b2fef12c1a --- /dev/null +++ b/network/connection/wpa_supplicant/files/0001-AP-Verify-that-HT40-secondary-channel-is-supported.patch @@ -0,0 +1,52 @@ +From dea50507861b79f522c70500fe978072f143af8f Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Fri, 12 Nov 2010 18:31:56 +0200 +Subject: [PATCH 1/3] AP: Verify that HT40 secondary channel is supported + +Refuse to enable HT40 mode AP unless both the primary and secondary +channels are enabled for AP use. +(cherry picked from commit 8ea3dd21d2e8b760612af0c7b6a3bb5b89ba7304) +--- + src/ap/hw_features.c | 26 ++++++++++++++++++++++++++ + 1 files changed, 26 insertions(+), 0 deletions(-) + +diff --git a/src/ap/hw_features.c b/src/ap/hw_features.c +index 0159c72..7fc5b83 100644 +--- a/src/ap/hw_features.c ++++ b/src/ap/hw_features.c +@@ -642,6 +642,32 @@ int hostapd_select_hw_mode(struct hostapd_iface *iface) + break; + } + } ++ if (ok && iface->conf->secondary_channel) { ++ int sec_ok = 0; ++ int sec_chan = iface->conf->channel + ++ iface->conf->secondary_channel * 4; ++ for (j = 0; j < iface->current_mode->num_channels; j++) { ++ struct hostapd_channel_data *chan = ++ &iface->current_mode->channels[j]; ++ if (!(chan->flag & HOSTAPD_CHAN_DISABLED) && ++ (chan->chan == sec_chan)) { ++ sec_ok = 1; ++ break; ++ } ++ } ++ if (!sec_ok) { ++ hostapd_logger(iface->bss[0], NULL, ++ HOSTAPD_MODULE_IEEE80211, ++ HOSTAPD_LEVEL_WARNING, ++ "Configured HT40 secondary channel " ++ "(%d) not found from the channel list " ++ "of current mode (%d) %s", ++ sec_chan, iface->current_mode->mode, ++ hostapd_hw_mode_txt( ++ iface->current_mode->mode)); ++ ok = 0; ++ } ++ } + if (iface->conf->channel == 0) { + /* TODO: could request a scan of neighboring BSSes and select + * the channel automatically */ +-- +1.7.3.4 + diff --git a/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-assoc-timeout.patch b/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-assoc-timeout.patch new file mode 100644 index 0000000000..c3b3568c6b --- /dev/null +++ b/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-assoc-timeout.patch @@ -0,0 +1,16 @@ +diff -up wpa_supplicant-0.7.3/wpa_supplicant/wpa_supplicant.c.assoc-timeout wpa_supplicant-0.7.3/wpa_supplicant/wpa_supplicant.c +--- wpa_supplicant-0.7.3/wpa_supplicant/wpa_supplicant.c.assoc-timeout 2010-09-07 10:43:39.000000000 -0500 ++++ wpa_supplicant-0.7.3/wpa_supplicant/wpa_supplicant.c 2010-12-07 18:57:45.163457000 -0600 +@@ -1262,10 +1262,10 @@ void wpa_supplicant_associate(struct wpa + + if (assoc_failed) { + /* give IBSS a bit more time */ +- timeout = ssid->mode == WPAS_MODE_IBSS ? 10 : 5; ++ timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10; + } else if (wpa_s->conf->ap_scan == 1) { + /* give IBSS a bit more time */ +- timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 10; ++ timeout = ssid->mode == WPAS_MODE_IBSS ? 20 : 20; + } + wpa_supplicant_req_auth_timeout(wpa_s, timeout, 0); + } diff --git a/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-flush-debug-output.patch b/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-flush-debug-output.patch new file mode 100644 index 0000000000..a686851867 --- /dev/null +++ b/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-flush-debug-output.patch @@ -0,0 +1,49 @@ +--- wpa_supplicant-0.6.3/src/utils/wpa_debug.c.flush-debug 2007-07-30 23:15:34.000000000 -0400 ++++ wpa_supplicant-0.6.3/src/utils/wpa_debug.c 2007-07-30 23:17:06.000000000 -0400 +@@ -157,6 +157,7 @@ void wpa_debug_print_timestamp(void) + if (out_file) { + fprintf(out_file, "%ld.%06u: ", (long) tv.sec, + (unsigned int) tv.usec); ++ fflush(out_file); + } else + #endif /* CONFIG_DEBUG_FILE */ + printf("%ld.%06u: ", (long) tv.sec, (unsigned int) tv.usec); +@@ -185,6 +186,7 @@ void wpa_printf(int level, char *fmt, .. + if (out_file) { + vfprintf(out_file, fmt, ap); + fprintf(out_file, "\n"); ++ fflush(out_file); + } else { + #endif /* CONFIG_DEBUG_FILE */ + vprintf(fmt, ap); +@@ -217,6 +219,7 @@ static void _wpa_hexdump(int level, cons + fprintf(out_file, " [REMOVED]"); + } + fprintf(out_file, "\n"); ++ fflush(out_file); + } else { + #endif /* CONFIG_DEBUG_FILE */ + printf("%s - hexdump(len=%lu):", title, (unsigned long) len); +@@ -262,12 +265,14 @@ static void _wpa_hexdump_ascii(int level + fprintf(out_file, + "%s - hexdump_ascii(len=%lu): [REMOVED]\n", + title, (unsigned long) len); ++ fflush(out_file); + return; + } + if (buf == NULL) { + fprintf(out_file, + "%s - hexdump_ascii(len=%lu): [NULL]\n", + title, (unsigned long) len); ++ fflush(out_file); + return; + } + fprintf(out_file, "%s - hexdump_ascii(len=%lu):\n", +@@ -292,6 +297,7 @@ static void _wpa_hexdump_ascii(int level + pos += llen; + len -= llen; + } ++ fflush(out_file); + } else { + #endif /* CONFIG_DEBUG_FILE */ + if (!show) { diff --git a/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-openssl-more-algs.patch b/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-openssl-more-algs.patch new file mode 100644 index 0000000000..cd058837c0 --- /dev/null +++ b/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-openssl-more-algs.patch @@ -0,0 +1,15 @@ +diff -up wpa_supplicant-0.7.3/src/crypto/tls_openssl.c.more-openssl-algs wpa_supplicant-0.7.3/src/crypto/tls_openssl.c +--- wpa_supplicant-0.7.3/src/crypto/tls_openssl.c.more-openssl-algs 2010-09-07 10:43:39.000000000 -0500 ++++ wpa_supplicant-0.7.3/src/crypto/tls_openssl.c 2010-12-08 10:01:02.967664004 -0600 +@@ -710,6 +710,11 @@ void * tls_init(const struct tls_config + #endif /* OPENSSL_FIPS */ + #endif /* CONFIG_FIPS */ + SSL_load_error_strings(); ++ /* Only add potentially weak hashes and encryption algorithms ++ * when FIPS mode is not enabled. ++ */ ++ if (!conf || !conf->fips_mode) ++ OpenSSL_add_all_algorithms(); + SSL_library_init(); + #ifndef OPENSSL_NO_SHA256 + EVP_add_digest(EVP_sha256()); diff --git a/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-quiet-scan-results-message.patch b/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-quiet-scan-results-message.patch new file mode 100644 index 0000000000..afabdf6ec8 --- /dev/null +++ b/network/connection/wpa_supplicant/files/fedora/wpa_supplicant-quiet-scan-results-message.patch @@ -0,0 +1,12 @@ +diff -up wpa_supplicant-0.6.7/wpa_supplicant/events.c.scan-results-msg wpa_supplicant-0.6.7/wpa_supplicant/events.c +--- wpa_supplicant-0.6.7/wpa_supplicant/events.c.scan-results-msg 2009-01-30 12:08:34.000000000 -0500 ++++ wpa_supplicant-0.6.7/wpa_supplicant/events.c 2009-01-30 12:08:37.000000000 -0500 +@@ -911,7 +911,7 @@ static void wpa_supplicant_event_scan_re + } + + wpa_dbg(wpa_s, MSG_DEBUG, "New scan results available"); +- wpa_msg_ctrl(wpa_s, MSG_INFO, WPA_EVENT_SCAN_RESULTS); ++ wpa_msg_ctrl(wpa_s, MSG_DEBUG, WPA_EVENT_SCAN_RESULTS); + wpas_notify_scan_results(wpa_s); + + wpas_notify_scan_done(wpa_s, 1); \ No newline at end of file diff --git a/network/connection/wpa_supplicant/files/mandriva/wpa_supplicant-0.6.3-WEP232.patch b/network/connection/wpa_supplicant/files/mandriva/wpa_supplicant-0.6.3-WEP232.patch new file mode 100644 index 0000000000..bbb5b8f4f6 --- /dev/null +++ b/network/connection/wpa_supplicant/files/mandriva/wpa_supplicant-0.6.3-WEP232.patch @@ -0,0 +1,12 @@ +diff -p -up wpa_supplicant-0.6.3/wpa_supplicant/config_ssid.h.WEP232 wpa_supplicant-0.6.3/wpa_supplicant/config_ssid.h +--- wpa_supplicant-0.6.3/wpa_supplicant/config_ssid.h.WEP232 2008-02-23 03:45:24.000000000 +0100 ++++ wpa_supplicant-0.6.3/wpa_supplicant/config_ssid.h 2008-03-31 22:28:29.000000000 +0200 +@@ -189,7 +189,7 @@ struct wpa_ssid { + #endif /* IEEE8021X_EAPOL */ + + #define NUM_WEP_KEYS 4 +-#define MAX_WEP_KEY_LEN 16 ++#define MAX_WEP_KEY_LEN 32 + /** + * wep_key - WEP keys + */ diff --git a/network/connection/wpa_supplicant/files/suse/wpa_supplicant-driver-wext-debug.patch b/network/connection/wpa_supplicant/files/suse/wpa_supplicant-driver-wext-debug.patch new file mode 100644 index 0000000000..343c8168ff --- /dev/null +++ b/network/connection/wpa_supplicant/files/suse/wpa_supplicant-driver-wext-debug.patch @@ -0,0 +1,143 @@ +Index: src/drivers/driver_wext.c +=================================================================== +--- src/drivers/driver_wext.c.orig ++++ src/drivers/driver_wext.c +@@ -1901,19 +1901,26 @@ int wpa_driver_wext_associate(void *priv + * SIOCSIWENCODE here. + */ + if (drv->auth_alg_fallback && +- wpa_driver_wext_auth_alg_fallback(drv, params) < 0) ++ wpa_driver_wext_auth_alg_fallback(drv, params) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because auth_alg_fallback failed", __FUNCTION__); + ret = -1; ++ } + + if (!params->bssid && +- wpa_driver_wext_set_bssid(drv, NULL) < 0) ++ wpa_driver_wext_set_bssid(drv, NULL) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_bssid failed", __FUNCTION__); + ret = -1; ++ } + + /* TODO: should consider getting wpa version and cipher/key_mgmt suites + * from configuration, not from here, where only the selected suite is + * available */ + if (wpa_driver_wext_set_gen_ie(drv, params->wpa_ie, params->wpa_ie_len) +- < 0) ++ < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_gen_ie failed", __FUNCTION__); + ret = -1; ++ } ++ + if (params->wpa_ie == NULL || params->wpa_ie_len == 0) + value = IW_AUTH_WPA_VERSION_DISABLED; + else if (params->wpa_ie[0] == WLAN_EID_RSN) +@@ -1921,27 +1928,41 @@ int wpa_driver_wext_associate(void *priv + else + value = IW_AUTH_WPA_VERSION_WPA; + if (wpa_driver_wext_set_auth_param(drv, +- IW_AUTH_WPA_VERSION, value) < 0) ++ IW_AUTH_WPA_VERSION, value) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_auth_param(WPA_VERSION) failed", __FUNCTION__); + ret = -1; ++ } ++ + value = wpa_driver_wext_cipher2wext(params->pairwise_suite); + if (wpa_driver_wext_set_auth_param(drv, +- IW_AUTH_CIPHER_PAIRWISE, value) < 0) ++ IW_AUTH_CIPHER_PAIRWISE, value) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_auth_param(CIPHER_PAIRWISE) failed", __FUNCTION__); + ret = -1; ++ } ++ + value = wpa_driver_wext_cipher2wext(params->group_suite); + if (wpa_driver_wext_set_auth_param(drv, +- IW_AUTH_CIPHER_GROUP, value) < 0) ++ IW_AUTH_CIPHER_GROUP, value) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_auth_param(CIPHER_GROUP) failed", __FUNCTION__); + ret = -1; ++ } ++ + value = wpa_driver_wext_keymgmt2wext(params->key_mgmt_suite); + if (wpa_driver_wext_set_auth_param(drv, +- IW_AUTH_KEY_MGMT, value) < 0) ++ IW_AUTH_KEY_MGMT, value) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_auth_param(KEY_MGMT) failed", __FUNCTION__); + ret = -1; ++ } ++ + value = params->key_mgmt_suite != KEY_MGMT_NONE || + params->pairwise_suite != CIPHER_NONE || + params->group_suite != CIPHER_NONE || + params->wpa_ie_len; + if (wpa_driver_wext_set_auth_param(drv, +- IW_AUTH_PRIVACY_INVOKED, value) < 0) ++ IW_AUTH_PRIVACY_INVOKED, value) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_auth_param(PRIVACY_INVOKED) failed", __FUNCTION__); + ret = -1; ++ } + + /* Allow unencrypted EAPOL messages even if pairwise keys are set when + * not using WPA. IEEE 802.1X specifies that these frames are not +@@ -1952,12 +1973,18 @@ int wpa_driver_wext_associate(void *priv + else + allow_unencrypted_eapol = 1; + +- if (wpa_driver_wext_set_psk(drv, params->psk) < 0) ++ if (wpa_driver_wext_set_psk(drv, params->psk) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_psk failed", __FUNCTION__); + ret = -1; ++ } ++ + if (wpa_driver_wext_set_auth_param(drv, + IW_AUTH_RX_UNENCRYPTED_EAPOL, +- allow_unencrypted_eapol) < 0) ++ allow_unencrypted_eapol) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_auth_param(RX_UNENCRYPTED_EAPOL) failed", __FUNCTION__); + ret = -1; ++ } ++ + #ifdef CONFIG_IEEE80211W + switch (params->mgmt_frame_protection) { + case NO_MGMT_FRAME_PROTECTION: +@@ -1970,17 +1997,25 @@ int wpa_driver_wext_associate(void *priv + value = IW_AUTH_MFP_REQUIRED; + break; + }; +- if (wpa_driver_wext_set_auth_param(drv, IW_AUTH_MFP, value) < 0) ++ if (wpa_driver_wext_set_auth_param(drv, IW_AUTH_MFP, value) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_auth_param(IW_AUTH_MFP) failed", __FUNCTION__); + ret = -1; ++ } + #endif /* CONFIG_IEEE80211W */ +- if (params->freq && wpa_driver_wext_set_freq(drv, params->freq) < 0) ++ if (params->freq && wpa_driver_wext_set_freq(drv, params->freq) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_freq failed", __FUNCTION__); + ret = -1; ++ } + if (!drv->cfg80211 && +- wpa_driver_wext_set_ssid(drv, params->ssid, params->ssid_len) < 0) ++ wpa_driver_wext_set_ssid(drv, params->ssid, params->ssid_len) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_ssid failed", __FUNCTION__); + ret = -1; ++ } + if (params->bssid && +- wpa_driver_wext_set_bssid(drv, params->bssid) < 0) ++ wpa_driver_wext_set_bssid(drv, params->bssid) < 0) { ++ wpa_printf(MSG_DEBUG, "%s: assoc failed because set_bssid failed", __FUNCTION__); + ret = -1; ++ } + if (drv->cfg80211 && + wpa_driver_wext_set_ssid(drv, params->ssid, params->ssid_len) < 0) + ret = -1; +@@ -2008,6 +2043,10 @@ static int wpa_driver_wext_set_auth_alg( + res = wpa_driver_wext_set_auth_param(drv, IW_AUTH_80211_AUTH_ALG, + algs); + drv->auth_alg_fallback = res == -2; ++ ++ if (res == -2) ++ wpa_printf(MSG_DEBUG, "%s: falling back to ENCODE for AUTH", __FUNCTION__); ++ + return res; + } + diff --git a/network/connection/wpa_supplicant/files/suse/wpa_supplicant-errormsg.patch b/network/connection/wpa_supplicant/files/suse/wpa_supplicant-errormsg.patch new file mode 100644 index 0000000000..f2ac0cb707 --- /dev/null +++ b/network/connection/wpa_supplicant/files/suse/wpa_supplicant-errormsg.patch @@ -0,0 +1,19 @@ +Index: src/drivers/driver_wext.c +=================================================================== +--- src/drivers/driver_wext.c.orig ++++ src/drivers/driver_wext.c +@@ -54,12 +54,13 @@ int wpa_driver_wext_set_auth_param(struc + iwr.u.param.value = value; + + if (ioctl(drv->ioctl_sock, SIOCSIWAUTH, &iwr) < 0) { ++ int saved_errno = errno; + if (errno != EOPNOTSUPP) { + wpa_printf(MSG_DEBUG, "WEXT: SIOCSIWAUTH(param %d " + "value 0x%x) failed: %s)", + idx, value, strerror(errno)); + } +- ret = errno == EOPNOTSUPP ? -2 : -1; ++ ret = saved_errno == EOPNOTSUPP ? -2 : -1; + } + + return ret; diff --git a/network/connection/wpa_supplicant/files/ubuntu/01_use_pkg-config_for_pcsc-lite_module.patch b/network/connection/wpa_supplicant/files/ubuntu/01_use_pkg-config_for_pcsc-lite_module.patch new file mode 100644 index 0000000000..d41a507a1e --- /dev/null +++ b/network/connection/wpa_supplicant/files/ubuntu/01_use_pkg-config_for_pcsc-lite_module.patch @@ -0,0 +1,17 @@ +From: Reinhard Tartler +References: none +Description: Use pkg-config for libpcsclite linkage flags + At least in debian, we can rely on pkg-config being available and + returning more accurate ldflags. + +--- a/wpa_supplicant/Makefile ++++ b/wpa_supplicant/Makefile +@@ -691,7 +691,7 @@ ifdef CONFIG_NATIVE_WINDOWS + #dynamic symbol loading that is now used in pcsc_funcs.c + #LIBS += -lwinscard + else +-LIBS += -lpcsclite -lpthread ++LIBS += $(shell pkg-config --libs libpcsclite) + endif + endif + diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-dbus-path-fix.patch b/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-dbus-path-fix.patch new file mode 100644 index 0000000000..976d71b0ec --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-dbus-path-fix.patch @@ -0,0 +1,20 @@ +diff -aurp a/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in b/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in +--- a/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in 2012-05-15 09:00:03.048545044 +0000 ++++ b/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in 2012-05-15 09:01:19.759550509 +0000 +@@ -1,5 +1,5 @@ + [D-BUS Service] + Name=fi.epitest.hostap.WPASupplicant +-Exec=@BINDIR@/wpa_supplicant -u ++Exec=/usr/sbin/wpa_supplicant -u + User=root + SystemdService=wpa_supplicant.service +diff -aurp a/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in b/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in +--- a/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in 2012-05-15 09:00:03.048545044 +0000 ++++ b/wpa_supplicant/dbus/fi.w1.wpa_supplicant1.service.in 2012-05-15 09:01:28.727551913 +0000 +@@ -1,5 +1,5 @@ + [D-BUS Service] + Name=fi.w1.wpa_supplicant1 +-Exec=@BINDIR@/wpa_supplicant -u ++Exec=/usr/sbin/wpa_supplicant -u + User=root + SystemdService=wpa_supplicant.service diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-do-not-call-dbus-functions-with-NULL-path.patch b/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-do-not-call-dbus-functions-with-NULL-path.patch new file mode 100644 index 0000000000..bbff73e13d --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-do-not-call-dbus-functions-with-NULL-path.patch @@ -0,0 +1,60 @@ +diff -aurp a/wpa_supplicant/dbus/dbus_new_helpers.c b/wpa_supplicant/dbus/dbus_new_helpers.c +--- a/wpa_supplicant/dbus/dbus_new_helpers.c 2012-05-15 07:28:37.616150164 +0000 ++++ b/wpa_supplicant/dbus/dbus_new_helpers.c 2012-05-15 07:30:21.904157611 +0000 +@@ -882,7 +882,7 @@ void wpa_dbus_mark_property_changed(stru + const struct wpa_dbus_property_desc *dsc; + int i = 0; + +- if (iface == NULL) ++ if (iface == NULL || path == NULL) + return; + + dbus_connection_get_object_path_data(iface->con, path, +diff -aurp a/wpa_supplicant/dbus/dbus_old.c b/wpa_supplicant/dbus/dbus_old.c +--- a/wpa_supplicant/dbus/dbus_old.c 2012-05-15 07:28:29.502149373 +0000 ++++ b/wpa_supplicant/dbus/dbus_old.c 2012-05-15 07:30:48.859162441 +0000 +@@ -379,7 +379,7 @@ void wpa_supplicant_dbus_notify_scan_res + DBusMessage *_signal; + + /* Do nothing if the control interface is not turned on */ +- if (iface == NULL) ++ if (iface == NULL || wpa_s->dbus_path == NULL) + return; + + _signal = dbus_message_new_signal(wpa_s->dbus_path, +@@ -419,7 +419,7 @@ void wpa_supplicant_dbus_notify_state_ch + if (wpa_s->global == NULL) + return; + iface = wpa_s->global->dbus; +- if (iface == NULL) ++ if (iface == NULL || wpa_s->dbus_path == NULL) + return; + + /* Only send signal if state really changed */ +@@ -478,7 +478,7 @@ void wpa_supplicant_dbus_notify_scanning + dbus_bool_t scanning = wpa_s->scanning ? TRUE : FALSE; + + /* Do nothing if the control interface is not turned on */ +- if (iface == NULL) ++ if (iface == NULL || wpa_s->dbus_path == NULL) + return; + + _signal = dbus_message_new_signal(wpa_s->dbus_path, +@@ -513,7 +513,7 @@ void wpa_supplicant_dbus_notify_wps_cred + if (wpa_s->global == NULL) + return; + iface = wpa_s->global->dbus; +- if (iface == NULL) ++ if (iface == NULL || wpa_s->dbus_path == NULL) + return; + + _signal = dbus_message_new_signal(wpa_s->dbus_path, +@@ -564,7 +564,7 @@ void wpa_supplicant_dbus_notify_certific + if (wpa_s->global == NULL) + return; + iface = wpa_s->global->dbus; +- if (iface == NULL) ++ if (iface == NULL || wpa_s->dbus_path == NULL) + return; + + _signal = dbus_message_new_signal(wpa_s->dbus_path, diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-generate-libeap-peer.patch b/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-generate-libeap-peer.patch new file mode 100644 index 0000000000..c84e51dfde --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant-1.0-generate-libeap-peer.patch @@ -0,0 +1,347 @@ +diff -Naurp a/src/eap_peer/eap_methods.c b/src/eap_peer/eap_methods.c +--- a/src/eap_peer/eap_methods.c 2012-05-15 08:23:17.151386999 +0000 ++++ b/src/eap_peer/eap_methods.c 2012-05-15 08:23:57.403389760 +0000 +@@ -342,6 +342,120 @@ int eap_peer_method_register(struct eap_ + + + /** ++ * eap_peer_register_methods - Register all known EAP peer methods ++ * ++ * This function is called at program start to register all compiled ++ * in EAP peer methods. ++ */ ++int eap_peer_register_methods(void) ++{ ++ int ret = 0; ++ ++#ifdef EAP_MD5 ++ if (ret == 0) ++ ret = eap_peer_md5_register(); ++#endif /* EAP_MD5 */ ++ ++#ifdef EAP_TLS ++ if (ret == 0) ++ ret = eap_peer_tls_register(); ++#endif /* EAP_TLS */ ++ ++#ifdef EAP_MSCHAPv2 ++ if (ret == 0) ++ ret = eap_peer_mschapv2_register(); ++#endif /* EAP_MSCHAPv2 */ ++ ++#ifdef EAP_PEAP ++ if (ret == 0) ++ ret = eap_peer_peap_register(); ++#endif /* EAP_PEAP */ ++ ++#ifdef EAP_TTLS ++ if (ret == 0) ++ ret = eap_peer_ttls_register(); ++#endif /* EAP_TTLS */ ++ ++#ifdef EAP_GTC ++ if (ret == 0) ++ ret = eap_peer_gtc_register(); ++#endif /* EAP_GTC */ ++ ++#ifdef EAP_OTP ++ if (ret == 0) ++ ret = eap_peer_otp_register(); ++#endif /* EAP_OTP */ ++ ++#ifdef EAP_SIM ++ if (ret == 0) ++ ret = eap_peer_sim_register(); ++#endif /* EAP_SIM */ ++ ++#ifdef EAP_LEAP ++ if (ret == 0) ++ ret = eap_peer_leap_register(); ++#endif /* EAP_LEAP */ ++ ++#ifdef EAP_PSK ++ if (ret == 0) ++ ret = eap_peer_psk_register(); ++#endif /* EAP_PSK */ ++ ++#ifdef EAP_AKA ++ if (ret == 0) ++ ret = eap_peer_aka_register(); ++#endif /* EAP_AKA */ ++ ++#ifdef EAP_AKA_PRIME ++ if (ret == 0) ++ ret = eap_peer_aka_prime_register(); ++#endif /* EAP_AKA_PRIME */ ++ ++#ifdef EAP_FAST ++ if (ret == 0) ++ ret = eap_peer_fast_register(); ++#endif /* EAP_FAST */ ++ ++#ifdef EAP_PAX ++ if (ret == 0) ++ ret = eap_peer_pax_register(); ++#endif /* EAP_PAX */ ++ ++#ifdef EAP_SAKE ++ if (ret == 0) ++ ret = eap_peer_sake_register(); ++#endif /* EAP_SAKE */ ++ ++#ifdef EAP_GPSK ++ if (ret == 0) ++ ret = eap_peer_gpsk_register(); ++#endif /* EAP_GPSK */ ++ ++#ifdef EAP_WSC ++ if (ret == 0) ++ ret = eap_peer_wsc_register(); ++#endif /* EAP_WSC */ ++ ++#ifdef EAP_IKEV2 ++ if (ret == 0) ++ ret = eap_peer_ikev2_register(); ++#endif /* EAP_IKEV2 */ ++ ++#ifdef EAP_VENDOR_TEST ++ if (ret == 0) ++ ret = eap_peer_vendor_test_register(); ++#endif /* EAP_VENDOR_TEST */ ++ ++#ifdef EAP_TNC ++ if (ret == 0) ++ ret = eap_peer_tnc_register(); ++#endif /* EAP_TNC */ ++ ++ return ret; ++} ++ ++ ++/** + * eap_peer_unregister_methods - Unregister EAP peer methods + * + * This function is called at program termination to unregister all EAP peer +diff -Naurp a/src/eap_peer/eap_methods.h b/src/eap_peer/eap_methods.h +--- a/src/eap_peer/eap_methods.h 2012-05-15 08:23:17.151386999 +0000 ++++ b/src/eap_peer/eap_methods.h 2012-05-15 08:23:57.404389735 +0000 +@@ -32,6 +32,7 @@ EapType eap_peer_get_type(const char *na + const char * eap_get_name(int vendor, EapType type); + size_t eap_get_names(char *buf, size_t buflen); + char ** eap_get_names_as_string_array(size_t *num); ++int eap_peer_register_methods(void); + void eap_peer_unregister_methods(void); + + #else /* IEEE8021X_EAPOL */ +diff -Naurp a/src/eap_peer/libeap0.pc b/src/eap_peer/libeap0.pc +--- a/src/eap_peer/libeap0.pc 1970-01-01 00:00:00.000000000 +0000 ++++ b/src/eap_peer/libeap0.pc 2012-05-15 08:23:57.404389735 +0000 +@@ -0,0 +1,10 @@ ++prefix=/usr ++exec_prefix=/usr ++libdir=${exec_prefix}/lib ++includedir=${prefix}/include/eap_peer ++ ++Name: libeap0 ++Description: EAP Peer Library API ++Version: 0.7.2 ++Libs: -L${libdir} -leap ++Cflags: -I${includedir} +diff -Naurp a/src/eap_peer/Makefile b/src/eap_peer/Makefile +--- a/src/eap_peer/Makefile 2012-05-15 08:23:17.152386964 +0000 ++++ b/src/eap_peer/Makefile 2012-05-15 08:23:57.403389760 +0000 +@@ -1,11 +1,186 @@ +-all: +- @echo Nothing to be made. ++LIBEAP_NAME = libeap ++LIBEAP_CURRENT = 0 ++LIBEAP_REVISION = 0 ++LIBEAP_AGE = 0 ++ ++LIBEAP = $(LIBEAP_NAME).so.$(LIBEAP_CURRENT).$(LIBEAP_REVISION).$(LIBEAP_AGE) ++LIBEAP_SO = $(LIBEAP_NAME).so.$(LIBEAP_CURRENT) ++ ++.PHONY: all clean install uninstall ++ ++all: $(LIBEAP) ++ ++ifndef CC ++CC=gcc ++endif ++ ++ifndef CFLAGS ++CFLAGS = -MMD -O0 -Wall -g ++endif ++ ++CONFIG_TLS=openssl ++ ++INCLUDE_INSTALL_DIR=/usr/include/eap_peer ++ ++# Got to use override all across the board, otherwise a 'make ++# CFLAGS=XX' will kill us because the command line's CFLAGS will ++# overwrite Make's and we'll loose all the infrastructure it sets. ++override CFLAGS += -I. -I.. -I../crypto -I../utils -I../common ++ ++# at least for now, need to include config_ssid.h and config_blob.h from ++# wpa_supplicant directory ++override CFLAGS += -I ../../wpa_supplicant ++ ++OBJS_both += ../utils/common.o ++OBJS_both += ../utils/os_unix.o ++OBJS_both += ../utils/wpa_debug.o ++OBJS_both += ../utils/base64.o ++OBJS_both += ../utils/wpabuf.o ++OBJS_both += ../crypto/md5.o ++OBJS_both += ../crypto/sha1.o ++OBJS_both += ../crypto/sha1-tlsprf.o ++OBJS_both += ../crypto/aes-encblock.o ++OBJS_both += ../crypto/aes-wrap.o ++OBJS_both += ../crypto/aes-ctr.o ++OBJS_both += ../crypto/aes-eax.o ++OBJS_both += ../crypto/aes-omac1.o ++OBJS_both += ../crypto/ms_funcs.o ++OBJS_both += ../crypto/sha256.o ++ ++ ++OBJS_both += ../eap_common/eap_peap_common.o ++OBJS_both += ../eap_common/eap_psk_common.o ++OBJS_both += ../eap_common/eap_pax_common.o ++OBJS_both += ../eap_common/eap_sake_common.o ++OBJS_both += ../eap_common/eap_gpsk_common.o ++OBJS_both += ../eap_common/chap.o ++ ++OBJS_peer += ../eap_peer/eap_tls.o ++OBJS_peer += ../eap_peer/eap_peap.o ++OBJS_peer += ../eap_peer/eap_ttls.o ++OBJS_peer += ../eap_peer/eap_md5.o ++OBJS_peer += ../eap_peer/eap_mschapv2.o ++OBJS_peer += ../eap_peer/mschapv2.o ++OBJS_peer += ../eap_peer/eap_otp.o ++OBJS_peer += ../eap_peer/eap_gtc.o ++OBJS_peer += ../eap_peer/eap_leap.o ++OBJS_peer += ../eap_peer/eap_psk.o ++OBJS_peer += ../eap_peer/eap_pax.o ++OBJS_peer += ../eap_peer/eap_sake.o ++OBJS_peer += ../eap_peer/eap_gpsk.o ++OBJS_peer += ../eap_peer/eap.o ++OBJS_peer += ../eap_common/eap_common.o ++OBJS_peer += ../eap_peer/eap_methods.o ++OBJS_peer += ../eap_peer/eap_tls_common.o ++ ++override CFLAGS += -DEAP_TLS ++override CFLAGS += -DEAP_PEAP ++override CFLAGS += -DEAP_TTLS ++override CFLAGS += -DEAP_MD5 ++override CFLAGS += -DEAP_MSCHAPv2 ++override CFLAGS += -DEAP_GTC ++override CFLAGS += -DEAP_OTP ++override CFLAGS += -DEAP_LEAP ++override CFLAGS += -DEAP_PSK ++override CFLAGS += -DEAP_PAX ++override CFLAGS += -DEAP_SAKE ++override CFLAGS += -DEAP_GPSK -DEAP_GPSK_SHA256 ++override CFLAGS += -DEAP_TLS_FUNCS ++ ++override CFLAGS += -DIEEE8021X_EAPOL ++ ++ifeq ($(CONFIG_TLS), openssl) ++override CFLAGS += -DEAP_TLS_OPENSSL ++OBJS_both += ../crypto/tls_openssl.o ++OBJS_both += ../crypto/crypto_openssl.o ++LIBS += -lssl -lcrypto ++override CFLAGS += -DINTERNAL_SHA256 ++endif ++ ++ifeq ($(CONFIG_TLS), internal) ++OBJS_both += ../crypto/tls_internal.o ++OBJS_both += ../tls/tlsv1_common.o ../../tls/tlsv1_record.o ++OBJS_both += ../tls/tlsv1_cred.o ++OBJS_both += ../tls/asn1.o ../../tls/x509v3.o ++OBJS_both += ../crypto/crypto_internal.o ../../tls/rsa.o ../../tls/bignum.o ++ ++OBJS_peer += ../tls/tlsv1_client.o ++OBJS_peer += ../tls/tlsv1_client_write.o ../../tls/tlsv1_client_read.o ++override CFLAGS += -DCONFIG_TLS_INTERNAL_CLIENT ++ ++OBJS_server += ../tls/tlsv1_server.o ++OBJS_server += ../tls/tlsv1_server_write.o ../../tls/tlsv1_server_read.o ++override CFLAGS += -DCONFIG_TLS_INTERNAL_SERVER ++ ++override CFLAGS += -DCONFIG_TLS_INTERNAL ++override CFLAGS += -DCONFIG_CRYPTO_INTERNAL ++override CFLAGS += -DCONFIG_INTERNAL_X509 ++override CFLAGS += -DINTERNAL_AES ++override CFLAGS += -DINTERNAL_SHA1 ++override CFLAGS += -DINTERNAL_SHA256 ++override CFLAGS += -DINTERNAL_MD5 ++override CFLAGS += -DINTERNAL_MD4 ++override CFLAGS += -DINTERNAL_DES ++ifdef CONFIG_INTERNAL_LIBTOMMATH ++override CFLAGS += -DCONFIG_INTERNAL_LIBTOMMATH ++else ++LIBS += -ltommath ++endif ++endif ++ ++ifndef LDO ++LDO=$(CC) ++endif ++ ++ ++OBJS_lib=$(OBJS_both) $(OBJS_peer) ++ ++ #$(OBJS_server) ++ ++override CFLAGS += -fPIC -DPIC ++LDFLAGS += -shared ++ ++$(LIBEAP): $(OBJS_lib) ++ $(LDO) $(LDFLAGS) $(OBJS_lib) -Wl,-soname -Wl,$(LIBEAP_SO) -o $(LIBEAP) $(LIBS) ++ ++ ++UTIL_HEADERS = ../utils/includes.h ../utils/common.h \ ++ ../utils/wpabuf.h ../utils/build_config.h \ ++ ../utils/os.h ../utils/wpa_debug.h ++COMMON_HEADERS = ../common/defs.h ++EAP_COMMON_HEADERS = ../eap_common/eap_defs.h ++MAIN_HEADERS = eap.h eap_methods.h eap_config.h ++CRYPTO_HEADERS = ../crypto/tls.h ++ ++install: ++ ++ mkdir -p $(DESTDIR)/usr/lib ++# copy the lib file to std lib location ++ cp $(LIBEAP) $(DESTDIR)/usr/lib ++ ln -fs $(LIBEAP_SO) $(DESTDIR)/usr/lib/$(LIBEAP_NAME).so ++ ln -fs $(LIBEAP_NAME).so.0.0.0 $(DESTDIR)/usr/lib/$(LIBEAP_NAME).so.0 ++ ++# copy the headers reqd by apps using eap peer library in its own subfolder under /usr/include ++ mkdir -p \ ++ $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/eap_common \ ++ $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/common \ ++ $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/util \ ++ $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/crypto ++ install -m 0644 $(EAP_COMMON_HEADERS) $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/eap_common ++ install -m 0644 $(COMMON_HEADERS) $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/common ++ install -m 0644 $(CRYPTO_HEADERS) $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/crypto ++ install -m 0644 $(UTIL_HEADERS) $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/util ++ install -m 0644 $(MAIN_HEADERS) $(DESTDIR)/$(INCLUDE_INSTALL_DIR)/ ++ ++ mkdir -p $(DESTDIR)/usr/lib/pkgconfig ++ cp libeap0.pc $(DESTDIR)/usr/lib/pkgconfig ++ ++uninstall: ++ ++ rm $(DESTDIR)/usr/lib/$(LIBEAP) ++ rm -fr $(DESTDIR)/$(INCLUDE_INSTALL_DIR) ++ rm -f $(DESTDIR)/usr/lib/pkgconfig/libeap0.pc + + clean: +- rm -f *~ *.o *.so *.d ++ rm -f *~ *.o *.so *.d libeap.a $(LIBEAP) $(OBJS_lib) + +-install: +- if ls *.so >/dev/null 2>&1; then \ +- install -d $(DESTDIR)$(LIBDIR)/wpa_supplicant && \ +- cp *.so $(DESTDIR)$(LIBDIR)/wpa_supplicant \ +- ; fi diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant.conf b/network/connection/wpa_supplicant/files/wpa_supplicant.conf new file mode 100644 index 0000000000..97f44c1632 --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant.conf @@ -0,0 +1,35 @@ +# wpa_supplicant.conf +# WPA-PSK ile kimlikleme yapılmasını zorunlu kılan kablosuz erişim noktaları ile +# Microsoft IAS Radius sunucu kimliklemesinin wpa_supplicant ile nasıl yapılacağını +# örnekleyen ayar dosyası. İlgili yerleri doldurmanız gerekir. +# +# wpa_supplicant'ın desteklediği diğer ayar işlemleri için: +# /usr/share/doc/wpasupplicant/wpa_supplicant.conf.example dosyasına bakınız. + +# Root'un wpa_cli ile bağlantıyı izlemesi için +ctrl_interface=/run/wpa_supplicant + +eapol_version=1 +ap_scan=1 +fast_reauth=1 + +# WPA-PSK kimlikleme gerektiren kablosuz erişim noktaları için ayarlar +network={ +# Erişim noktasının SSID'si + ssid="SSID" +# Erişim cihazının WPA parolası + psk="Parola1234" +# Bu bağlantının önceliğinin 1. sırada olduğu belirtiliyor + priority=1 +} + +# MS IAS Radius sunucusunda kimlikleme için gereken ayarlar +network={ + ssid="SSID" + key_mgmt=WPA-EAP + eap=PEAP + identity="ALAN_ADI\KULLANICI" + password="Parola1234" + phase1="auth=MSCHAPV2" + priority=2 +} diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant.conf.fedora b/network/connection/wpa_supplicant/files/wpa_supplicant.conf.fedora new file mode 100644 index 0000000000..e3d3cac784 --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant.conf.fedora @@ -0,0 +1,3 @@ +ctrl_interface=/run/wpa_supplicant +ctrl_interface_group=wheel + diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant.confd b/network/connection/wpa_supplicant/files/wpa_supplicant.confd new file mode 100644 index 0000000000..3333e8a2d8 --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant.confd @@ -0,0 +1,16 @@ +# Use the flag "-i" before each of your interfaces, like so: +# INTERFACES="-ieth1 -iwlan0" +INTERFACES="" + +# Use the flag "-D" before each driver, like so: +# DRIVERS="-Dwext" +DRIVERS="" + +# Other arguments +# -u Enable the D-Bus interface (required for use with NetworkManager) +# -f Log to /var/log/wpa_supplicant.log +# -P Write pid file to /run/wpa_supplicant.pid +# required to return proper codes by init scripts (e.g. double "start" action) +# -B to daemonize that has to be used together with -P is already in wpa_supplicant.init.d +OTHER_ARGS="-u -f /var/log/wpa_supplicant.log -P /run/wpa_supplicant.pid" + diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant.config b/network/connection/wpa_supplicant/files/wpa_supplicant.config new file mode 100644 index 0000000000..e95469fe2b --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant.config @@ -0,0 +1,47 @@ + CONFIG_CTRL_IFACE=y + CONFIG_CTRL_IFACE_DBUS=y + CONFIG_CTRL_IFACE_DBUS_NEW=y + CONFIG_CTRL_IFACE_DBUS_INTRO=y + #CONFIG_DRIVER_HOSTAP=y + #CONFIG_DRIVER_HERMES=y + #CONFIG_DRIVER_MADWIFI=y + CONFIG_DRIVER_ATMEL=y + CONFIG_DRIVER_WEXT=y + CONFIG_DRIVER_NL80211=y + CONFIG_DRIVER_NDISWRAPPER=y + #CONFIG_DRIVER_PRISM54=y + CONFIG_DRIVER_WIRED=y + #CONFIG_DRIVER_BROADCOM=y + #CONFIG_DRIVER_IPW=y + #CONFIG_DRIVER_BSD=y + #CONFIG_DRIVER_NDIS=y + CONFIG_WIRELESS_EXTENSION=y + CONFIG_IEEE8021X_EAPOL=y + CONFIG_EAP_MD5=y + CONFIG_EAP_MSCHAPV2=y + CONFIG_EAP_TLS=y + CONFIG_EAP_PEAP=y + CONFIG_EAP_TTLS=y + CONFIG_EAP_FAST=y + CONFIG_EAP_GTC=y + CONFIG_EAP_OTP=y + CONFIG_EAP_SIM=y + CONFIG_EAP_AKA=y + CONFIG_EAP_PSK=y + CONFIG_EAP_PAX=y + CONFIG_EAP_LEAP=y + #CONFIG_PCSC=y + CONFIG_EAP_SAKE=y + CONFIG_EAP_GPSK=y + CONFIG_EAP_GPSK_SHA256=y + CONFIG_EAP_TNC=y + CONFIG_WPS=y + CONFIG_EAP_IKEV2=y + CONFIG_PKCS12=y + CONFIG_SMARTCARD=y + CONFIG_DEBUG_FILE=y + CFLAGS += -I/usr/include/libnl3 + CONFIG_IPV6=y + CONFIG_LIBNL32=y + CONFIG_PEERKEY=y + CONFIG_READLINE=y \ No newline at end of file diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant.logrotate b/network/connection/wpa_supplicant/files/wpa_supplicant.logrotate new file mode 100644 index 0000000000..bd7ef91cc3 --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant.logrotate @@ -0,0 +1,6 @@ +/var/log/wpa_supplicant.log { + missingok + notifempty + size 30k + create 0600 root root +} diff --git a/network/connection/wpa_supplicant/files/wpa_supplicant.py b/network/connection/wpa_supplicant/files/wpa_supplicant.py new file mode 100644 index 0000000000..d079729b43 --- /dev/null +++ b/network/connection/wpa_supplicant/files/wpa_supplicant.py @@ -0,0 +1,250 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +import dbus + +WPAS_DBUS_OPATH = "/fi/epitest/hostap/WPASupplicant" +WPAS_DBUS_INTERFACES_OPATH = "/fi/epitest/hostap/WPASupplicant/Interfaces" + +WPAS_DBUS_SERVICE = "fi.epitest.hostap.WPASupplicant" +WPAS_DBUS_INTERFACE = "fi.epitest.hostap.WPASupplicant" +WPAS_DBUS_INTERFACES_INTERFACE = "fi.epitest.hostap.WPASupplicant.Interface" +WPAS_DBUS_NETWORK_INTERFACE = "fi.epitest.hostap.WPASupplicant.Network" +WPAS_DBUS_BSSID_INTERFACE = "fi.epitest.hostap.WPASupplicant.BSSID" + +TIMEOUT = 60 + +class PasswordLengthError(Exception): + pass + +class WPA_Supplicant_Network: + def __init__(self, bus, path): + self.bus = bus + self.path = path + self.net_obj = self.bus.get_object(WPAS_DBUS_SERVICE, path) + self.net = dbus.Interface(self.net_obj, WPAS_DBUS_NETWORK_INTERFACE) + + # dict keys: ssid, bssid, key_mgmt, psk, scan_ssid, pairwise, group, eap, identity, + # anonymous_identity, ca_cert, ca_cert2, client_cert, client_cert2, private_key, private_key2, + # private_key_passwd, private_key2_passwd, phase1, phase2, eapol_flags + # + # Example: setNetwork({"ssid":dbus.String("MySSID", variant_level=1)), + # "psk":dbus.String("MyPassword", variant_level=1))}) + def setNetwork(self, options): + self.net.set(options) + + def enableNetwork(self): + self.net.enable() + + def disableNetwork(self): + self.net.disable() + +class WPA_Supplicant_Interface: + def __init__(self, bus, ifname, path): + self.bus = bus + self.ifname = ifname + self.path = path + self.if_obj = self.bus.get_object(WPAS_DBUS_SERVICE, path) + self.iface = dbus.Interface(self. if_obj, WPAS_DBUS_INTERFACES_INTERFACE) + + def scan(self): + self.iface.scan() + + def scanResults(self): + return self.iface.scanResults() + + def addNetwork(self): + path = self.iface.addNetwork() + return self.getNetwork(path) + + def removeNetwork(self, network): + self.iface.removeNetwork(network) + + def selectNetwork(self, network): + self.iface.selectNetwork(network) + + def getNetworkPath(self, network_id): + return "%s/Networks/%d" % (self.path, network_id) + + def getNetworkById(self, network_id): + return WPA_Supplicant_Network(self.bus, self.getNetworkPath(network_id)) + + def getNetwork(self, network): + return WPA_Supplicant_Network(self.bus, network) + + # mode should be between 0 and 2 + def setAPScan(self, mode): + self.iface.setAPScan(dbus.UInt32(mode)) + + def disconnect(self): + self.iface.disconnect() + + def getState(self): + return self.iface.state() + + def getCapabilities(self): + return self.iface.capabilities() + +class WPA_Supplicant: + def __init__(self): + self.bus = dbus.SystemBus() + self.wpas_obj = self.bus.get_object(WPAS_DBUS_SERVICE, WPAS_DBUS_OPATH) + self.wpas = dbus.Interface(self.wpas_obj, WPAS_DBUS_INTERFACE) + + def getInterface(self, ifname): + path = self.wpas.getInterface(ifname) + return WPA_Supplicant_Interface(self.bus, ifname, path) + + # driver=wext, hostap, prism54, madwifi, atmel, ndiswrapper, ipw, wired + def addInterface(self, ifname, driver): + self.wpas.addInterface(ifname, {'driver': dbus.String(driver, variant_level=1)}) + return self.getInterface(ifname) + + def removeInterface(self, ifname): + try: + iface_path = self.wpas.getInterface(ifname) + except dbus.DBusException: + iface_path = None + if iface_path: + self.wpas.removeInterface(dbus.ObjectPath(iface_path)) + +def detectWpaDriver(ifname): + import os + import sys + import pardus.netutils + # if device is an ethernet device, driver is "wired" + device = pardus.netutils.IF(ifname) + if (device.isEthernet()) and (not device.isWireless()): + return "wired" + path = os.path.join("/sys/class/net/", ifname, "device/driver/module") + modname = None + if os.path.exists(path): + modname = os.readlink(path).split("/")[-1] + if "hostap" in modname: + return "hostap" + if "prism54" in modname: + return "prism54" + if "atmel" in modname: + return "atmel" + # we fallback to wext + # wext is the generic driver for ipw2100, ipw2200, ndiswrapper > 1.12, madwifi etc... + return "wext" + +def getWpaInterface(ifname): + wpa = WPA_Supplicant() + try: + iface = wpa.getInterface(ifname) + except dbus.DBusException: + driver = detectWpaDriver(ifname) + iface = wpa.addInterface(ifname, driver) + return iface + +def waitForAuthenticationComplete(iface, timeout, wait = 0.1): + import time + while timeout > 0: + if iface.getState() == "COMPLETED": + return True + else: + timeout -= wait + time.sleep(wait) + return False + +def checkServiceState(serviceName): + bus = dbus.SystemBus() + obj = bus.get_object("tr.org.pardus.comar", "/package/%s" % serviceName) + state = obj.info(dbus_interface="tr.org.pardus.comar.System.Service")[2] + return state in ("on", "started") + +def isDBusServiceActive(): + return True + +def isWpaServiceActive(): + return checkServiceState("wpa_supplicant") + +def isWpaServiceUsable(): + return isDBusServiceActive() and isWpaServiceActive() + +def startWpaService(): + if not isWpaServiceActive(): + bus = dbus.SystemBus() + obj = bus.get_object("tr.org.pardus.comar", "/package/wpa_supplicant") + obj.start(dbus_interface="tr.org.pardus.comar.System.Service") + import time + timeout = 10 + while timeout > 0: + try: + bus = dbus.SystemBus() + net_obj = bus.get_object(WPAS_DBUS_SERVICE, WPAS_DBUS_OPATH) + net = dbus.Interface(net_obj, WPAS_DBUS_NETWORK_INTERFACE) + except dbus.DBusException: + time.sleep(0.1) + timeout -= 0.2 + continue + return True + return False + +def setWpaAuthentication(ifname, ssid, password, timeout = TIMEOUT): + password_length = len(password) + if (password_length < 8) or (password_length > 63): + raise PasswordLengthError("Password length should be between 8 and 63") + iface = getWpaInterface(ifname) + network = iface.addNetwork() + network.setNetwork({"ssid": dbus.String(ssid, variant_level=1), "psk": dbus.String(password, variant_level=1)}) + iface.selectNetwork(network.path) + authentication = waitForAuthenticationComplete(iface, timeout) + if not authentication: + disableAuthentication(ifname) + return authentication + +def disableAuthentication(ifname): + wpa = WPA_Supplicant() + wpa.removeInterface(ifname) + bus = dbus.SystemBus() + obj = bus.get_object("tr.org.pardus.comar", "/package/wpa_supplicant") + obj.stop(dbus_interface="tr.org.pardus.comar.System.Service") + +class Wpa_EAP: + ssid = "" + phase1 = "" + phase2 = "" + key_mgmt = "IEEE8021X" + eap = "PEAP" + anonymous_identity = "" + ca_cert = "" + client_cert = "" + private_key = "" + private_key_passwd = "" + + def __init__(self, ifname): + self.ifname = ifname + self.iface = getWpaInterface(ifname) + self.network = self.iface.addNetwork() + + def authenticate(self, username, password, timeout = TIMEOUT): + basic = {"ssid": dbus.String(self.ssid, variant_level=1), + "key_mgmt": dbus.String(self.key_mgmt, variant_level=1), + "eap": dbus.String(self.eap, variant_level=1), + "identity": dbus.String(username, variant_level=1)} + + if self.client_cert: + basic["client_cert"] = dbus.String(self.client_cert, variant_level=1) + if self.ca_cert: + basic["ca_cert"] = dbus.String(self.ca_cert, variant_level=1) + if self.private_key: + basic["private_key"] = dbus.String(self.private_key, variant_level=1) + if self.private_key_passwd: + basic["private_key_passwd"] = dbus.String(self.private_key_passwd, variant_level=1) + if self.phase2: + basic["phase2"] = dbus.String("auth=%s"%self.phase2, variant_level=1) + if password: + basic["password"] = dbus.String(password, variant_level=1) + if self.anonymous_identity: + basic["anonymous_identity"] = dbus.String(self.anonymous_identity, variant_level=1) + + self.network.setNetwork(basic) + + self.iface.selectNetwork(self.network.path) + authentication = waitForAuthenticationComplete(self.iface, timeout) + if not authentication: + disableAuthentication(self.ifname) + return authentication diff --git a/network/connection/wpa_supplicant/pspec.xml b/network/connection/wpa_supplicant/pspec.xml new file mode 100644 index 0000000000..f2e9f7ff8d --- /dev/null +++ b/network/connection/wpa_supplicant/pspec.xml @@ -0,0 +1,100 @@ + + + + + wpa_supplicant + http://hostap.epitest.fi/wpa_supplicant/ + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + BSD + service + IEEE 802.1X/WPA supplicant for secure wireless transfers + wpa_supplicant is a WPA supplicant with support for WPA and WPA2. + http://hostap.epitest.fi/releases/wpa_supplicant-2.1.tar.gz + + wpa_supplicant.config + + + libnl-devel + + + ubuntu/01_use_pkg-config_for_pcsc-lite_module.patch + + wpa_supplicant-1.0-dbus-path-fix.patch + wpa_supplicant-1.0-do-not-call-dbus-functions-with-NULL-path.patch + mandriva/wpa_supplicant-0.6.3-WEP232.patch + fedora/wpa_supplicant-openssl-more-algs.patch + fedora/wpa_supplicant-flush-debug-output.patch + + + fedora/wpa_supplicant-assoc-timeout.patch + + + + suse/wpa_supplicant-errormsg.patch + + + + + + + + + + wpa_supplicant + + libnl + + + /etc + /etc/dbus-1 + /usr/sbin + /usr/bin + /usr/lib + /usr/share/doc + /usr/share/man + /usr/share/dbus-1/system-services + /run + + + wpa_supplicant.conf + + wpa_supplicant.confd + wpa_supplicant.logrotate + wpa_supplicant.py + + + + System.Service + + + + + + 2014-06-02 + 2.1 + Version Bump. + Aydın Demirel + aydin.demirel@pisilinux.org + + + 2013-03-02 + 2.0 + V.Bump + PisiLinux Community + admins@pisilinux.org + + + 2012-10-14 + 1.0 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/network/connection/wpa_supplicant/translations.xml b/network/connection/wpa_supplicant/translations.xml new file mode 100644 index 0000000000..23e5f8b874 --- /dev/null +++ b/network/connection/wpa_supplicant/translations.xml @@ -0,0 +1,8 @@ + + + + wpa_supplicant + Güvenli kablosuz erişim için IEEE 802.1X/WPA sağlayıcı + WPA ve WPA2 desteği olan ve Linux, BSD ve Windows ortamları için bir WPA istemcisidir. + + diff --git a/network/filter/component.xml b/network/filter/component.xml new file mode 100644 index 0000000000..898a0b6bd9 --- /dev/null +++ b/network/filter/component.xml @@ -0,0 +1,3 @@ + + network.filter + diff --git a/network/filter/iproute2/actions.py b/network/filter/iproute2/actions.py new file mode 100644 index 0000000000..e12f5fe31b --- /dev/null +++ b/network/filter/iproute2/actions.py @@ -0,0 +1,25 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import get + +def setup(): + autotools.configure() + +def build(): + autotools.make('CC="%s" RPM_OPT_FLAGS="%s"' % (get.CC(), get.CFLAGS())) + +def install(): + autotools.rawInstall("DESTDIR=\"%s\" \ + SBINDIR=/sbin \ + DOCDIR=/%s/%s \ + MANDIR=/usr/share/man \ + " % (get.installDIR(), get.docDIR(), get.srcNAME())) + + pisitools.dodir("/usr/sbin") + pisitools.dodir("/var/lib/arpd") diff --git a/network/filter/iproute2/files/iproute2-2.6.29-IPPROTO_IP_for_SA.patch b/network/filter/iproute2/files/iproute2-2.6.29-IPPROTO_IP_for_SA.patch new file mode 100644 index 0000000000..48ffcb4274 --- /dev/null +++ b/network/filter/iproute2/files/iproute2-2.6.29-IPPROTO_IP_for_SA.patch @@ -0,0 +1,11 @@ +diff -up iproute2-2.6.29/ip/ipxfrm.c.old iproute2-2.6.29/ip/ipxfrm.c +--- iproute2-2.6.29/ip/ipxfrm.c.old 2009-03-24 23:15:14.000000000 +0100 ++++ iproute2-2.6.29/ip/ipxfrm.c 2009-04-24 09:35:58.203735119 +0200 +@@ -1156,6 +1156,7 @@ static int xfrm_selector_upspec_parse(st + case IPPROTO_UDP: + case IPPROTO_SCTP: + case IPPROTO_DCCP: ++ case IPPROTO_IP: /* to allow shared SA for different protocols */ + break; + default: + fprintf(stderr, "\"sport\" and \"dport\" are invalid with proto=%s\n", strxf_proto(sel->proto)); diff --git a/network/filter/iproute2/files/iproute2-2.6.29-kernel.patch b/network/filter/iproute2/files/iproute2-2.6.29-kernel.patch new file mode 100644 index 0000000000..df9125ac0c --- /dev/null +++ b/network/filter/iproute2/files/iproute2-2.6.29-kernel.patch @@ -0,0 +1,11 @@ +diff -up iproute2-20091009/Makefile.kernel iproute2-20091009/Makefile +--- iproute2-20091009/Makefile.kernel 2009-09-21 10:26:11.000000000 +0200 ++++ iproute2-20091009/Makefile 2009-10-09 12:27:03.687382422 +0200 +@@ -6,6 +6,7 @@ CONFDIR=/etc/iproute2 + DOCDIR=/share/doc/iproute2 + MANDIR=/share/man + ARPDDIR=/var/lib/arpd ++KERNEL_INCLUDE=/usr/include + + # Path to db_185.h include + DBM_INCLUDE:=$(ROOTDIR)/usr/include diff --git a/network/filter/iproute2/files/iproute2-2.6.31-tc_modules.patch b/network/filter/iproute2/files/iproute2-2.6.31-tc_modules.patch new file mode 100644 index 0000000000..0daa17bf8e --- /dev/null +++ b/network/filter/iproute2/files/iproute2-2.6.31-tc_modules.patch @@ -0,0 +1,12 @@ +diff -up iproute2-2.6.31/Makefile.old iproute2-2.6.31/Makefile +--- iproute2-2.6.31/Makefile.old 2010-01-04 12:46:47.000000000 +0100 ++++ iproute2-2.6.31/Makefile 2010-01-04 12:50:17.396384644 +0100 +@@ -13,7 +13,7 @@ DBM_INCLUDE:=$(ROOTDIR)/usr/include + + SHARED_LIBS = y + +-DEFINES= -DRESOLVE_HOSTNAMES -DLIBDIR=\"$(LIBDIR)\" ++DEFINES= -DRESOLVE_HOSTNAMES -DLIBDIR=\"$(LIBDIR)\" -DIPT_LIB_DIR=\"$(IPT_LIB_DIR)\" + ifneq ($(SHARED_LIBS),y) + DEFINES+= -DNO_SHARED_LIBS + endif diff --git a/network/filter/iproute2/files/iproute2-example-cbq-service.patch b/network/filter/iproute2/files/iproute2-example-cbq-service.patch new file mode 100644 index 0000000000..f8b4978161 --- /dev/null +++ b/network/filter/iproute2/files/iproute2-example-cbq-service.patch @@ -0,0 +1,22 @@ +diff -up iproute2-20091106/examples/cbq.init-v0.7.3.fix iproute2-20091106/examples/cbq.init-v0.7.3 +--- iproute2-20091106/examples/cbq.init-v0.7.3.fix 2009-11-10 19:41:44.000000000 +0100 ++++ iproute2-20091106/examples/cbq.init-v0.7.3 2009-11-27 13:36:07.957310549 +0100 +@@ -579,14 +579,14 @@ cbq_show () { + ### Check configuration and load DEVICES, DEVFIELDS and CLASSLIST from $1 + cbq_init () { + ### Get a list of configured classes +- CLASSLIST=`find $1 \( -type f -or -type l \) -name 'cbq-*' \ +- -not -name '*~' -maxdepth 1 -printf "%f\n"| sort` ++ CLASSLIST=`find $1 -maxdepth 1 \( -type f -or -type l \) -name 'cbq-*' \ ++ -not -name '*~' -printf "%f\n"| sort` + [ -z "$CLASSLIST" ] && + cbq_failure "no configuration files found in $1!" + + ### Gather all DEVICE fields from $1/cbq-* +- DEVFIELDS=`find $1 \( -type f -or -type l \) -name 'cbq-*' \ +- -not -name '*~' -maxdepth 1| xargs sed -n 's/#.*//; \ ++ DEVFIELDS=`find $1 -maxdepth 1 \( -type f -or -type l \) -name 'cbq-*' \ ++ -not -name '*~' | xargs sed -n 's/#.*//; \ + s/[[:space:]]//g; /^DEVICE=[^,]*,[^,]*\(,[^,]*\)\?/ \ + { s/.*=//; p; }'| sort -u` + [ -z "$DEVFIELDS" ] && diff --git a/network/filter/iproute2/files/iproute2-libxtables6.diff b/network/filter/iproute2/files/iproute2-libxtables6.diff new file mode 100644 index 0000000000..ed2e16a397 --- /dev/null +++ b/network/filter/iproute2/files/iproute2-libxtables6.diff @@ -0,0 +1,31 @@ +From: Jan Engelhardt +Date: 2011-06-01 00:52:29+0200 + +--- + tc/m_xt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +Index: iproute2-2.6.38/tc/m_xt.c +=================================================================== +--- iproute2-2.6.38.orig/tc/m_xt.c ++++ iproute2-2.6.38/tc/m_xt.c +@@ -162,7 +162,8 @@ static int parse_ipt(struct action_util + return -1; + } + tcipt_globals.opts = +- xtables_merge_options(tcipt_globals.opts, ++ xtables_merge_options(tcipt_globals.orig_opts, ++ tcipt_globals.opts, + m->extra_opts, + &m->option_offset); + } else { +@@ -307,7 +308,8 @@ print_ipt(struct action_util *au,FILE * + } + + tcipt_globals.opts = +- xtables_merge_options(tcipt_globals.opts, ++ xtables_merge_options(tcipt_globals.orig_opts, ++ tcipt_globals.opts, + m->extra_opts, + &m->option_offset); + } else { diff --git a/network/filter/iproute2/files/iproute2-xt.diff b/network/filter/iproute2/files/iproute2-xt.diff new file mode 100644 index 0000000000..181d44050e --- /dev/null +++ b/network/filter/iproute2/files/iproute2-xt.diff @@ -0,0 +1,22 @@ +From: Jan Engelhardt +Date: 2011-06-01 00:52:07+0200 + +--- + tc/m_xt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +Index: iproute2-2.6.37/tc/m_xt.c +=================================================================== +--- iproute2-2.6.37.orig/tc/m_xt.c ++++ iproute2-2.6.37/tc/m_xt.c +@@ -343,8 +343,8 @@ print_ipt(struct action_util *au,FILE * + return 0; + } + +-struct action_util ipt_action_util = { +- .id = "ipt", ++struct action_util xt_action_util = { ++ .id = "xt", + .parse_aopt = parse_ipt, + .print_aopt = print_ipt, + }; diff --git a/network/filter/iproute2/pspec.xml b/network/filter/iproute2/pspec.xml new file mode 100644 index 0000000000..9a22b3e6d8 --- /dev/null +++ b/network/filter/iproute2/pspec.xml @@ -0,0 +1,65 @@ + + + + + iproute2 + http://linux-net.osdl.org/index.php/Iproute2 + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + app:console + Kernel routing and traffic control utilities + Iproute2 is a collection of utilites for controlling TCP/IP networking and traffic control in Linux. + https://www.kernel.org/pub/linux/utils/net/iproute2/iproute2-4.0.0.tar.xz + + iptables-devel + linux-atm-devel + db-devel + + + + + iproute2 + + linux-atm + iptables + db + + + /etc + /sbin + /usr/sbin + /lib + /usr/lib + /usr/share/man + /usr/share/doc + /var/lib + + + + + + 2015-04-13 + 4.0.0 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2013-11-23 + 3.12.0 + Version bump + Richard de Bruin + richdb@pisilinux.org + + + 2012-09-01 + 3.5.1 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/network/filter/iproute2/translations.xml b/network/filter/iproute2/translations.xml new file mode 100644 index 0000000000..3281e88d0b --- /dev/null +++ b/network/filter/iproute2/translations.xml @@ -0,0 +1,8 @@ + + + + iproute2 + Çekirdek içinde yer alan ağ trafiği yönlendirme ve trafik kontrol araçları. + Iproute2 TCP/IP ağları ve trafik kontrolü için araçlar içeren bir koolleksiyondur. + + diff --git a/network/filter/iptables/actions.py b/network/filter/iptables/actions.py new file mode 100644 index 0000000000..be96668983 --- /dev/null +++ b/network/filter/iptables/actions.py @@ -0,0 +1,32 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools +from pisi.actionsapi import get + +def setup(): + autotools.configure("--sbindir=/sbin \ + --libexecdir=/usr/lib \ + --without-kernel \ + --enable-devel \ + --enable-libipq \ + --enable-shared \ + --enable-static") + +def build(): + autotools.make("V=1") + +def install(): + autotools.rawInstall('DESTDIR="%s"' % get.installDIR()) + + pisitools.insinto("/usr/include", "include/iptables.h") + pisitools.insinto("/usr/include", "include/ip6tables.h") + pisitools.insinto("/usr/include/libiptc", "include/libiptc/*.h") + + pisitools.dodir("/var/lib/iptables") + pisitools.dodir("/etc/iptables") diff --git a/network/filter/iptables/comar/firewall.py b/network/filter/iptables/comar/firewall.py new file mode 100644 index 0000000000..7939b7a53b --- /dev/null +++ b/network/filter/iptables/comar/firewall.py @@ -0,0 +1,528 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# i18n + +MSG_CONNECTION_NAME = { + "en": "Internet Sharing", + "tr": "Internet Paylaşımı", + "sv": "Internetdelning", + "fr": "Partage de connexion Internet", + "es": "Compartir Internet", + "de": "Internet Freigabe", + "nl": "Internetverbinding delen", +} + +MSG_ALLOWED_PORTS = { + "en": "Allowed Port Numbers", + "tr": "İzin Verilen Port Numaraları", + "sv": "Tillåtna portar", + "fr": "Numéros de port autorisés", + "es": "Números de puertos permitidos", + "de": "Erlaubte Ports", + "nl": "Toegestane poortnummers", +} + +MSG_FORBIDDEN_PORTS = { + "en": "Forbidden Port Numbers", + "tr": "İzin Verilmeyen Port Numaraları", + "sv": "Otillåtna portar", + "nl": "Verboden poortnummers", +} + +MSG_GATEWAY_HOME = { + "en": "Gate to Home Network", + "tr": "Ev Ağına Çıkış", + "sv": "Länk till lokalt nätverk", + "fr": "Passerelle vers le réseau local", + "es": "Enlace a la red doméstica", + "de": "Gateway zum Haus-Netzwerk", + "nl": "Gateway naar thuisnetwerk", +} + +MSG_GATEWAY_INTERNET = { + "en": "Gate to Internet", + "tr": "Internet'e Çıkış", + "sv": "Länk till internet", + "fr": "Passerelle vers Internet", + "es": "Enlace a Internet", + "de": "Gateway zum Internet", + "nl": "Gateway naar Internet", +} + +TITLE_BLOCK_INCOMING = { + "en": "Block Incoming Connections", + "tr": "Gelen Bağlantıları Engelle", + "sv": "Blockera inkommande anslutningar", + "fr": "Bloquer les connexions entrantes", + "es": "Bloquear conexiones entrantes", + "de": "Eingehende Verbindungen blockieren", + "nl": "Inkomende verbindingen blokkeren", +} +DESCRIPTION_BLOCK_INCOMING = { + "en": "Blocks all incoming connections to the computer. Exceptions can be set from configuration dialog.", + "tr": "Bilgisayara gelen tüm bağlantıları engeller. İstisnalar ayarlar penceresinden belirlenebilir.", + "sv": "Blockerar alla inkommande anslutningar till datorn. Undantag kan läggas till under inställningar.", + "fr": "Bloque toute les connexions entrantes dans l'ordinateur. Des exceptions peuvent être définies dans la fenêtre de configuration.", + "es": "Bloquea todas las conexiones entrantes a la computadora. Se puede especificar excepciones desde el dialogo de configuración.", + "de": "Blockiert alle eingehenden Verbindungen. Im Konfigurations-Dialog können Ausnahmen angegeben werden.", + "nl": "Alle inkomende verbindingen naar deze computer blokkeren. Uitzonderingen kunnen in een configuratiedialoog ingesteld worden.", +} + +TITLE_BLOCK_OUTGOING = { + "en": "Block Outgoing Connections", + "tr": "Giden Bağlantıları Engelle", + "sv": "Blockera utgående anslutningar", + "fr": "Bloquer les connexions sortantes", + "es": "Bloquear conexiones salientes", + "de": "Ausgehende Verbindungen blockieren", + "nl": "Uitgaande verbindingen blokkeren", +} +DESCRIPTION_BLOCK_OUTGOING = { + "en": "Blocks outgoing connections. Forbidden ports can be set from configuration dialog.", + "tr": "Dışarı yapılan bağlantıları engeller. Yasaklı port numaraları ayarlar penceresinden belirlenebilir.", + "sv": "Blockerar alla utgående anslutningar till datorn. Undantag kan läggas till under inställningar.", + "nl": "Uitgaande verbindingen blokkeren. Verboden poorten kunnen in een configuratiedialoog ingesteld worden.", +} + +TITLE_INTERNET_SHARING = { + "en": "Internet Sharing", + "tr": "Internet Paylaşımı", + "sv": "Internetdelning", + "fr": "Partage de connexion Internet", + "es": "Compartir Internet", + "de": "Internet Freigabe", + "nl": "Internetverbinding delen", +} +DESCRIPTION_INTERNET_SHARING = { + "en": "Allows computers in your local network to connect Internet through this computer.", + "tr": "Yerel ağınızdaki bilgisayarların, bu bilgisayarı kullanarak Internet'e bağlanmalarını sağlar.", + "sv": "Låter datorer i det lokala nätverket ansluta till internet via den här datorn.", + "fr": "Permet aux ordinateurs de votre réseau domestique de se connecter à Internet via cet ordinateur.", + "es": "Permitir a otros computadoras en su red local acceder a la Internet, a través de ésta computadora", + "de": "Gibt anderen Computern aus dem lokalen Netzwer die Mäglichkeit, Internet durch diesen Computer hier zu benutzen.", + "nl": "Geeft andere computers in het lokale netwerk via deze computer toegang tot het internet.", +} + + +# Don't touch below, if you don't know what you're doing. + +# Module configuration settings and templates + +FIREWALL_CONF = "/etc/firewall.conf" + +IPTABLES_RULES = { + 'filter': [ + '-P INPUT DROP', # Default policies + '-P FORWARD DROP', + '-P OUTPUT ACCEPT', + '-N PARDUS-IN', # Module container table for INPUT + '-N PARDUS-IN-MOD-BLOCK', # Table for BlockIncoming rules + '-N PARDUS-FW', # Module container table for FORWARD + '-N PARDUS-FW-MOD-SHARING', # Table for InternetSharingModule rules + '-N PARDUS-FW-MOD-BLOCK', # Table for BlockOutgoing rules + '-N PARDUS-OUT', # Module container table for OUTPUT + '-N PARDUS-OUT-MOD-BLOCK', # Table for BlockOutgoing rules + '-A INPUT -i lo -j ACCEPT', # Accept local + '-A FORWARD -o lo -j ACCEPT', + '-A INPUT -m state --state INVALID -j DROP', + '-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT', + '-A INPUT -j PARDUS-IN', # Jump into container tables + '-A FORWARD -j PARDUS-FW', + '-A OUTPUT -j PARDUS-OUT', + '-A PARDUS-IN -j PARDUS-IN-MOD-BLOCK' , # Jump into module tables + '-A PARDUS-FW -j PARDUS-FW-MOD-BLOCK', + '-A PARDUS-FW -j PARDUS-FW-MOD-SHARING', + '-A PARDUS-OUT -j PARDUS-OUT-MOD-BLOCK', + '-A INPUT -m state --state NEW -j ACCEPT', + ], + 'nat': [ + '-P PREROUTING ACCEPT', + '-P POSTROUTING ACCEPT', + '-P OUTPUT ACCEPT', + '-N PARDUS-POST', + '-N PARDUS-POST-MOD-SHARING', + '-A POSTROUTING -j PARDUS-POST', + '-A PARDUS-POST -j PARDUS-POST-MOD-SHARING', + ], +} + +DHCPD_CONF = """ +ddns-update-style interim; +ignore client-updates; +max-lease-time 500; +default-lease-time 500; +option domain-name-servers 193.140.100.220; +option routers 172.16.0.1; +option subnet-mask 255.255.255.0; +subnet 172.16.0.0 netmask 255.255.255.0 { + range 172.16.0.2 172.16.0.254; +} +""" + +# Utils + +import os +import subprocess + +from pardus import iniutils +from pardus import netutils +from pardus import netfilterutils + +INI = iniutils.iniParser(FIREWALL_CONF) + +def listModuleConfigs(): + """ + Returns a list of modules that are configured. + """ + try: + modules = INI.listSections() + except iniutils.iniParserError: + return + if "general" in modules: + modules.remove("general") + return modules + +class ModuleConfig: + """ + Module configuration parser. + """ + def __init__(self, name): + self.name = name + try: + self.info = INI.getSection(name) + except iniutils.iniParserError: + self.info = {} + + def delete(self): + INI.removeSection(self.name) + + def save(self): + is_new = self.name not in listModuleConfigs() + INI.setSection(self.name, self.info) + +def getServiceState(package): + """ + Returns state of a service. + """ + return call(package, "System.Service", "info")[2] in ["on", "started"] + +def stopService(package, permanent=False): + """ + Stops a service. + """ + call(package, "System.Service", "stop") + if permanent: + call(package, "System.Service", "setState", ("off")) + +def startService(package, restart=False, auto_start=False): + """ + Starts a service. + """ + if restart: + stopService(package) + if not getServiceState(package): + call(package, "System.Service", "start") + if auto_start: + call(package, "System.Service", "setState", ("on")) + +def initializeIPTables(): + """ + Initializes IPTables. + """ + # Active rules + rules_active = netfilterutils.parseConf(netfilterutils.getRules()) + + # Compare rules + for chain, rules in IPTABLES_RULES.iteritems(): + if chain not in rules_active or len(set(rules) - set(rules_active[chain])): + # At least one different rule, need re-initialization + netfilterutils.clear() + conf = netfilterutils.makeConf(IPTABLES_RULES) + netfilterutils.restoreRules(conf) + break + +def execRule(rule): + """ + Executes IPTables rule + """ + rule = rule.split() + rule.insert(0, "/sbin/iptables") + subprocess.call(rule) + +def createConnection(package, device): + import comar + link = comar.Link() + connection = _(MSG_CONNECTION_NAME) + link.Network.Link[package].setDevice(connection, device) + link.Network.Link[package].setAddress(connection, "manual", "172.16.0.1", "255.255.255.0", "") + return connection + +def findOrCreateConnection(link, device): + o_package, o_connecion = None, None + for package in link.Network.Link: + if device in link.Network.Link[package].deviceList(): + for connection in link.Network.Link[package].connections(): + info = link.Network.Link[package].connectionInfo(connection) + if info.get("net_address", "") == "172.16.0.1": + return package, connection + return package, createConnection(package, device) + +def makeDHCPConf(interface): + file("/etc/dhcp/dhcpd.conf", "w").write(DHCPD_CONF) + file("/etc/conf.d/dhcpd", "w").write("DHCPD_IFACE=%s" % interface) + +# Modules + +class BlockIncoming: + def __init__(self): + self.parametersLast = {} + + def getInfo(self): + title = _(TITLE_BLOCK_INCOMING) + description = _(DESCRIPTION_BLOCK_INCOMING) + icon = "network-server" + return (title, description, icon) + + def getParameters(self): + parameters = [ + ("port_exceptions", _(MSG_ALLOWED_PORTS), "editlist", {"format": "[0-9\-]+"}), + ] + return parameters + + def checkModule(self, parameters={}, quiet=False): + pass + + def loadModule(self, parameters={}): + # Initialize IPTables + initializeIPTables() + # Flush rules + self.unloadModule() + # Load rules + for port in parameters.get("port_exceptions", "").split(): + if "-" in port: + port = port.replace("-", ":") + execRule("-A PARDUS-IN-MOD-BLOCK -p tcp -m multiport --dports %s -j ACCEPT" % port) + execRule("-A PARDUS-IN-MOD-BLOCK -p udp -m multiport --dports %s -j ACCEPT" % port) + # Block else... + execRule("-A PARDUS-IN-MOD-BLOCK -p tcp -m multiport --dports 0:1024 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable") + execRule("-A PARDUS-IN-MOD-BLOCK -p udp -m multiport --dports 0:1024 -j REJECT --reject-with icmp-port-unreachable") + execRule("-A PARDUS-IN-MOD-BLOCK -j REJECT --reject-with icmp-host-prohibited") + + def unloadModule(self, shutdown=False): + if not shutdown: + # Unload rules + execRule("-F PARDUS-IN-MOD-BLOCK") + + +class BlockOutgoing: + def __init__(self): + self.parametersLast = {} + + def getInfo(self): + title = _(TITLE_BLOCK_OUTGOING) + description = _(DESCRIPTION_BLOCK_OUTGOING) + icon = "security-medium" + return (title, description, icon) + + def getParameters(self): + parameters = [ + ("port_exceptions", _(MSG_FORBIDDEN_PORTS), "editlist", {"format": "[0-9\-]+"}), + ] + return parameters + + def checkModule(self, parameters={}, quiet=False): + pass + + def loadModule(self, parameters={}): + # Initialize IPTables + initializeIPTables() + # Flush rules + self.unloadModule() + # Load rules + for port in parameters.get("port_exceptions", "").split(): + if "-" in port: + port = port.replace("-", ":") + execRule("-A PARDUS-OUT-MOD-BLOCK -p tcp -m multiport --dports %s -j DROP" % port) + execRule("-A PARDUS-OUT-MOD-BLOCK -p udp -m multiport --dports %s -j DROP" % port) + execRule("-A PARDUS-FW-MOD-BLOCK -p tcp -m multiport --dports %s -j DROP" % port) + execRule("-A PARDUS-FW-MOD-BLOCK -p udp -m multiport --dports %s -j DROP" % port) + + def unloadModule(self, shutdown=False): + if not shutdown: + # Unload rules + execRule("-F PARDUS-OUT-MOD-BLOCK") + execRule("-F PARDUS-FW-MOD-BLOCK") + + +class InternetSharingModule: + def __init__(self): + self.parametersLast = {} + + def getInfo(self): + title = _(TITLE_INTERNET_SHARING) + description = _(DESCRIPTION_INTERNET_SHARING) + icon = "network-workgroup" + return (title, description, icon) + + def getParameters(self): + def findInterfaces(wireless=True): + ifaces = [] + for iface in netutils.interfaces(): + if iface.name.startswith("lo") or iface.name.startswith("pan"): + continue + if not wireless and iface.isWireless(): + continue + if iface.isEthernet(): + dev_id = iface.deviceUID() + dev_name = netutils.deviceName(iface.deviceUID()) + if " - " in dev_name: + dev_name = dev_name.split(" - ")[1] + ifaces.append("%s\t%s" % (dev_id, dev_name)) + return ifaces + options_in = { + "choose": "\n".join(findInterfaces()) + } + options_out = { + "choose": "\n".join(findInterfaces(wireless=False)) + } + parameters = [ + ("device-input", _(MSG_GATEWAY_INTERNET), "combo", options_in), + ("device-output", _(MSG_GATEWAY_HOME), "combo", options_out), + ] + return parameters + + def checkModule(self, parameters={}, quiet=False): + pass + + def loadModule(self, parameters={}): + # Initialize IPTables + initializeIPTables() + # Flush rules + self.unloadModule() + # Enable forwarding + os.system("echo 1 > /proc/sys/net/ipv4/ip_forward") + os.system("echo 1 > /proc/sys/net/ipv4/ip_dynaddr") + # Load rules + input = parameters.get("device-input", "") + output = parameters.get("device-output", "") + if input and output and input != output: + in_name = input.split("_")[-1] + out_name = output.split("_")[-1] + execRule("-A PARDUS-FW-MOD-SHARING -i %s -o %s -m state --state ESTABLISHED,RELATED -j ACCEPT" % (in_name, out_name)) + execRule("-A PARDUS-FW-MOD-SHARING -i %s -o %s -j ACCEPT" % (out_name, in_name)) + execRule("-t nat -A PARDUS-POST-MOD-SHARING -o %s -j MASQUERADE" % in_name) + # Create local NAT profile + import comar + link = comar.Link() + package, connection = findOrCreateConnection(link, output) + link.Network.Link[package].setState(connection, "up") + # Configure DHCP + makeDHCPConf(out_name) + # Start DHCP + startService("dhcpd", restart=True) + + def unloadModule(self, shutdown=False): + # Stop DHCP + stopService("dhcpd") + if not shutdown: + # Unload rules + execRule("-F PARDUS-FW-MOD-SHARING") + execRule("-P PARDUS-FW-MOD-SHARING ACCEPT") + execRule("-t nat -F PARDUS-POST-MOD-SHARING") + + +# Usable modules +MODULES = { + "internet_sharing": InternetSharingModule, + "block_incoming": BlockIncoming, + "block_outgoing": BlockOutgoing, +} + +# Network.Firewall model + +def listModules(): + return MODULES.keys() + +def moduleInfo(module): + inst = MODULES[module]() + return inst.getInfo() + +def moduleParameters(module): + inst = MODULES[module]() + return inst.getParameters() + +def getModuleState(module): + info = ModuleConfig(module).info + return info.get("state", "off") + +def setModuleState(name, state): + if state in ["on", "off"]: + # Save state + module = ModuleConfig(name) + module.info["state"] = state + module.save() + # Execute module if firewall is active + if getState() == "on": + inst = MODULES[name]() + if state == "on": + inst.loadModule(getModuleParameters(name)) + else: + inst.unloadModule() + # Notify clients + notify("Network.Firewall", "moduleStateChanged", (name, state)) + +def getModuleParameters(module): + info = ModuleConfig(module).info + return info + +def setModuleParameters(name, parameters): + # Save module parameters + module = ModuleConfig(name) + for key, value in parameters.iteritems(): + module.info[key] = value + module.save() + # Execute module if it's active + if getState() == "on" and getModuleState(name) == "on": + inst = MODULES[name]() + inst.checkModule(parameters) + inst.loadModule(parameters) + # Notify clients + notify("Network.Firewall", "moduleSettingsChanged", (name)) + +def getState(): + state = ModuleConfig("general").info.get("state", "off") + if state not in ["on", "off"] or not getServiceState(script()): + return "off" + return state + +def setState(state): + if state in ["on", "off"]: + # Save state + general = ModuleConfig("general") + general.info["state"] = state + general.save() + if state == "on": + # Start IPTables + startService(script(), auto_start=True) + # Execute active modules + for module in listModuleConfigs(): + if module not in MODULES: + continue + info = ModuleConfig(module).info + if info.get("state", "off") == "on": + inst = MODULES[module]() + inst.loadModule(getModuleParameters(module)) + else: + # Flush IPTables since every module depends on it + netfilterutils.clear() + # Stop IPTables + stopService(script(), permanent=True) + # Unload modules + for module in listModuleConfigs(): + if module not in MODULES: + continue + inst = MODULES[module]() + inst.unloadModule(shutdown=True) + # Notify clients + notify("Network.Firewall", "stateChanged", (state)) diff --git a/network/filter/iptables/comar/service.py b/network/filter/iptables/comar/service.py new file mode 100644 index 0000000000..103f24dffb --- /dev/null +++ b/network/filter/iptables/comar/service.py @@ -0,0 +1,69 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +from comar.service import * + +serviceType = "local" +serviceDesc = _({"en": "Firewall", + "tr": "Güvenlik Duvarı"}) + +LOCK_FILE = "/var/lock/subsys/iptables" +FIREWALL_PATH = "/etc/firewall.conf" + +import os +import pardus.netfilterutils as iptables +from pardus import iniutils + +def writeFile(filename, content="", mode=0600): + '''Writes content to filename and sets file mode.''' + file(filename, "w").write(content) + os.chmod(filename, mode) + +def readFile(filename): + """Return content of a file""" + return file(filename, "r").read() + +def startNetworkFirewall(): + INI = iniutils.iniParser(FIREWALL_PATH) + try: + info = INI.getSection("general") + except iniutils.iniParserError: + return + if info.get("state", "off") == "on": + call(script(), "Network.Firewall", "setState", ("on")) + +def stop(): + # Save rules + writeFile("/var/lib/iptables/rules", iptables.getRules()) + + # Clear chains & rules + iptables.clear() + + # Remove lock file + if os.access(LOCK_FILE, os.F_OK): + os.unlink(LOCK_FILE) + + # Notify clients + notify("System.Service", "Changed", (script(), "stopped")) + +def start(): + # Clear chains & rules + iptables.clear() + + # Load rules + profile_file = "/var/lib/iptables/rules" + if os.path.exists(profile_file): + rules = readFile(profile_file) + iptables.restoreRules(rules) + + # Create lock file + writeFile(LOCK_FILE, "") + + # Initialize Network.Firewall, if necessary + startNetworkFirewall() + + # Notify clients + notify("System.Service", "Changed", (script(), "started")) + +def status(): + return os.access(LOCK_FILE, os.F_OK) diff --git a/network/filter/iptables/pspec.xml b/network/filter/iptables/pspec.xml new file mode 100644 index 0000000000..0c035659e5 --- /dev/null +++ b/network/filter/iptables/pspec.xml @@ -0,0 +1,89 @@ + + + + + iptables + http://www.iptables.org/ + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + app:console + Firewall, NAT and packet mangling tools + Contains iptables firewall, NAT and packet mangling tools. + ftp://ftp.netfilter.org/pub/iptables/iptables-1.4.21.tar.bz2 + + libnfnetlink-devel + + + + + + + + + iptables + + libnfnetlink + + + /usr/bin + /sbin + /lib + /usr/lib + /usr/share/man + /etc + /var + /usr/share/xtables + + + System.Service + Network.Firewall + + + + + iptables-devel + Development files for iptables + + iptables + + + /usr/include + /usr/lib/*.a + /usr/lib/pkgconfig + /usr/share/man/man3 + + + + + + 2013-11-23 + 1.4.21 + Version bump + Richard de Bruin + richdb@pisilinux.org + + + 2013-03-04 + 1.4.17 + Version bump + Yusuf Aydemir + yusuf.aydemir@pisilinux.org + + + 2012-10-21 + 1.4.16.3 + First release + + reverseDependencyUpdate + + PisiLinux Community + admins@pisilinux.org + + + diff --git a/network/filter/iptables/translations.xml b/network/filter/iptables/translations.xml new file mode 100644 index 0000000000..c56f16daf1 --- /dev/null +++ b/network/filter/iptables/translations.xml @@ -0,0 +1,13 @@ + + + + iptables + Güvenlik duvarı, ağ adres çevrimi ve paket çevrimi aracı + Iptables kural tabanlı gelişmiş güvenlik duvarı uygulamasıdır. + + + + iptables-devel + iptables için geliştirme dosyaları + + diff --git a/network/misc/libndp/actions.py b/network/misc/libndp/actions.py new file mode 100644 index 0000000000..aed4e19ed5 --- /dev/null +++ b/network/misc/libndp/actions.py @@ -0,0 +1,28 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 2. +# See the file http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + + +def setup(): + autotools.configure("--prefix=/usr \ + --sysconfdir=/etc \ + --localstatedir=/var \ + --disable-static \ + --libexecdir=/usr/lib") + +def build(): + autotools.make() + +#def check(): +# autotools.make("check") + +def install(): + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + pisitools.dodoc("COPYING", "README") diff --git a/network/misc/libndp/pspec.xml b/network/misc/libndp/pspec.xml new file mode 100644 index 0000000000..14d00d7fbc --- /dev/null +++ b/network/misc/libndp/pspec.xml @@ -0,0 +1,55 @@ + + + + + libndp + http://libndp.org/ + + Ayhan Yalçınsoy + ayhanyalcinsoy@pisilinux.org + + GPLv2+ + library + Library for Neighbor Discovery Protocol + Library for Neighbor Discovery Protocol + http://libndp.org/files/libndp-1.4.tar.gz + + glibc-devel + + + + + libndp + + /etc + /usr/share + /etc/dbus-1 + /usr/lib + /usr/share/man + /usr/share/doc + /usr/bin + + + + + libndp-devel + Development files for NetworkManager + + libndp + + + /usr/include + /usr/lib/pkgconfig/ + + + + + + 2015-01-07 + 1.4 + First release + Ayhan Yalçınsoy + ayhanyalcinsoy@pisilinux.org + + + \ No newline at end of file diff --git a/network/misc/libndp/translations.xml b/network/misc/libndp/translations.xml new file mode 100644 index 0000000000..390bb5d79a --- /dev/null +++ b/network/misc/libndp/translations.xml @@ -0,0 +1,13 @@ + + + + libndp + Ağ tarama protokolü için kitaplık + Ağ tarama protokolü için kitaplık + + + + libndp + libndp için geliştirme dosyaları + + diff --git a/network/misc/libnl/actions.py b/network/misc/libnl/actions.py new file mode 100644 index 0000000000..c56f300979 --- /dev/null +++ b/network/misc/libnl/actions.py @@ -0,0 +1,20 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools + +def setup(): + autotools.configure() + +def build(): + autotools.make() + +def install(): + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + + pisitools.dodoc("COPYING", "ChangeLog") \ No newline at end of file diff --git a/network/misc/libnl/pspec.xml b/network/misc/libnl/pspec.xml new file mode 100644 index 0000000000..beddc165b2 --- /dev/null +++ b/network/misc/libnl/pspec.xml @@ -0,0 +1,71 @@ + + + + + libnl + http://people.suug.ch/~tgr/libnl + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + library + A library for applications dealing with netlink sockets + libnl is a convenience library to simplify the usage of the Linux kernel's netlink sockets interface for network manipulation. + http://www.infradead.org/~tgr/libnl/files/libnl-3.2.24.tar.gz + + + + libnl + + /usr/lib + /usr/share/doc + /usr/share/man + /etc/libnl + /usr/sbin + + + + + libnl-devel + Development files for libnl + + libnl + + + /usr/include + /usr/lib/pkgconfig + + + + + + 2014-04-03 + 3.2.24 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-03-13 + 3.2.23 + Rebuild. + Serdar Soytetir + kaptan@pisilinux.org + + + 2013-11-19 + 3.2.23 + Version bump + Richard de Bruin + richdb@pisilinux.org + + + 2012-10-14 + 3.2.13 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/network/misc/libnl/translations.xml b/network/misc/libnl/translations.xml new file mode 100644 index 0000000000..68c4e95a31 --- /dev/null +++ b/network/misc/libnl/translations.xml @@ -0,0 +1,13 @@ + + + + libnl + Netlink soketleri erişimi için bir kitaplığı + libnl Linux çekirdeğinin netlink soket arayüzünü ağ ile ilgili çeşitli işlemleri kolaylaştırmak için kullanan bir kitaplığıdır. + + + + libnl-devel + libnl için geliştirme dosyaları + + \ No newline at end of file diff --git a/programming/misc/libsoup/actions.py b/programming/misc/libsoup/actions.py new file mode 100644 index 0000000000..a0f37d9448 --- /dev/null +++ b/programming/misc/libsoup/actions.py @@ -0,0 +1,41 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 2 +# See the file http://www.gnu.org/copyleft/gpl.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +def setup(): + options = "\ + --disable-static \ + --without-apache-httpd \ + --without-apache-module-dir \ + " + if get.buildTYPE() == "_emul32": + options += " --libdir=/usr/lib32 \ + --bindir=/_emul32/bin \ + --sbindir=/_emul32/sbin \ + --disable-tls-check" + + shelltools.export("CC", "%s -m32" % get.CC()) + shelltools.export("CXX", "%s -m32" % get.CXX()) + shelltools.export("PKG_CONFIG_PATH", "/usr/lib32/pkgconfig") + + autotools.configure(options) + + pisitools.dosed("libtool", " -shared ", " -Wl,-O1,--as-needed -shared ") + +def build(): + autotools.make() + +def install(): + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + + #if get.buildTYPE() == "_emul32": + #pisitools.removeDir("/_emul32") + + pisitools.dodoc("README", "NEWS", "AUTHORS") \ No newline at end of file diff --git a/programming/misc/libsoup/pspec.xml b/programming/misc/libsoup/pspec.xml new file mode 100644 index 0000000000..5b571fcf38 --- /dev/null +++ b/programming/misc/libsoup/pspec.xml @@ -0,0 +1,182 @@ + + + + + libsoup + http://live.gnome.org/LibSoup + + PisiLinux Community + admins@pisilinux.org + + LGPLv2 + library + An HTTP library implementation in C + libsoup is an HTTP client/server library for GNOME. + mirrors://gnome/libsoup/2.50/libsoup-2.50.0.tar.xz + + gtk-doc + tls-devel + gconf-devel + gnutls-devel + glib-networking + libgcrypt-devel + libgnome-keyring-devel + glib2-devel + libxml2-devel + sqlite-devel + + + + + + + libsoup + + glib2 + libxml2 + sqlite + + + /usr/lib + /usr/share/doc + /usr/share/locale/ + /usr/lib/girepository-1.0/Soup-2.4.typelib + + + + + libsoup-gnome + + libsoup + + + /usr/lib/lib*gnome* + /usr/lib/girepository-1.0/SoupGNOME-2.4.typelib + + + + + + libsoup-docs + data:doc + libsoup reference documents + + libsoup + + + /usr/share/gtk-doc + + + + + libsoup-devel + Development files for libsoup + + glib2-devel + libxml2-devel + libsoup + + + /usr/include + /usr/share/gir-1.0 + /usr/lib/pkgconfig + /usr/lib32/pkgconfig + + + + + libsoup-32bit + emul32 + 32-bit shared libraries for libsoup + _emul32 + + glib2-32bit + sqlite-32bit + libxml2-32bit + glibc-32bit + + + glib2-32bit + sqlite-32bit + libxml2-32bit + glibc-32bit + libsoup + + + /usr/lib32 + + + + + + 2015-06-14 + 2.50.0 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2015-02-20 + 2.49.1 + Version bump. + Stefan Gronewold(groni) + groni@pisilinux.org + + + 2014-05-25 + 2.46.0 + Rebuil. + Alihan Öztürk + alihan@pisilinux.org + + + 2014-03-30 + 2.46.0 + 32bit split packages. + PisiLinux Community + admins@pisilinux.org + + + 2014-03-30 + 2.46.0 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-02.20 + 2.44.0 + Rebuild Unused + Varol Maksutoğlu + waroi@pisilinux.org + + + 2013-10.10 + 2.44.0 + Version Bump. + PisiLinux Community + admins@pisilinux.org + + + 2013-03-08 + 2.41.91 + bump + Erdinç Gültekin + erdincgultekin@gmail + + + 2013-01-29 + 2.40.3 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2012-10-14 + 2.40.0 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/programming/misc/libsoup/translations.xml b/programming/misc/libsoup/translations.xml new file mode 100644 index 0000000000..0222ae910e --- /dev/null +++ b/programming/misc/libsoup/translations.xml @@ -0,0 +1,23 @@ + + + + libsoup + C için HTTP kitaplık gerçekleyicisi + libsoup, GNOME için HTTP istemci / sunucu kitaplığıdır. + + + + libsoup-docs + libsoup başvuru belgeleri + + + + libsoup-devel + libsoup için geliştirme dosyaları + + + + libsoup-32bit + libsoup için 32-bit paylaşımlı kitaplıklar + + \ No newline at end of file diff --git a/server/dhcp/actions.py b/server/dhcp/actions.py new file mode 100644 index 0000000000..9ef28f7b1a --- /dev/null +++ b/server/dhcp/actions.py @@ -0,0 +1,70 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools +from pisi.actionsapi import get + +def setup(): + shelltools.export("CFLAGS", "%s -D_GNU_SOURCE -fPIC" % get.CFLAGS()) +#in some troff man pages + #for i in ["dhclient.conf.5", "dhclient.leases.5", "dhclient-script.8", "dhclient.8"]: + # pisitools.dosed("client/%s" % i, "CLIENTBINDIR", "/sbin") + # pisitools.dosed("client/%s" % i, "RUNDIR", "/run") + # pisitools.dosed("client/%s" % i, "DBDIR", "/var/lib/dhcpd") + # pisitools.dosed("client/%s" % i, "ETCDIR", "/etc/dhcp") + + #for i in ["dhcpd.conf.5", "dhcpd.leases.5", "dhcpd.8"]: + # pisitools.dosed("server/%s" % i, "CLIENTBINDIR", "/sbin") + # pisitools.dosed("server/%s" % i, "RUNDIR", "/run") + # pisitools.dosed("server/%s" % i, "DBDIR", "/var/lib/dhcpd") + # pisitools.dosed("server/%s" % i, "ETCDIR", "/etc/dhcp") + + pisitools.dosed("client/scripts/linux", "/etc/dhclient-exit-hooks", "/etc/dhcp/dhclient-exit-hooks") + pisitools.dosed("client/scripts/linux", "/etc/dhclient-enter-hooks", "/etc/dhcp/dhclient-enter-hooks") + + autotools.autoreconf("-vfi") + autotools.configure("--with-srv-lease-file=/var/lib/dhcpd/dhcpd.leases \ + --with-srv6-lease-file=/var/lib/dhcpd/dhcpd6.leases \ + --with-cli-lease-file=/var/lib/dhclient/dhclient.leases \ + --with-cli6-lease-file=/var/lib/dhclient/dhclient6.leases \ + --with-srv-pid-file=/run/dhcpd.pid \ + --with-srv6-pid-file=/run/dhcpd6.pid \ + --with-cli-pid-file=/run/dhclient.pid \ + --with-cli6-pid-file=/run/dhclient6.pid \ + --with-relay-pid-file=/run/dhcrelay.pid \ + --with-ldap \ + --with-ldapcrypto") + +def build(): + autotools.make() + +def install(): + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + + # Remove files we don't want + pisitools.remove("/etc/dhcpd.conf.example") + pisitools.remove("/etc/dhclient.conf.example") + + # Install dhcp.schema for LDAP configuration + pisitools.insinto("/etc/openldap/schema", "contrib/ldap/dhcp.schema") + + # dhclient configuration per service support is not ready yet, no need to create this directory for now + # Install empty directory for dhclient.d scripts + #pisitools.dodir("/etc/dhcp/dhclient.d") + + # Create directory hierarchy in /var + pisitools.dodir("/var/lib/dhcpd") + pisitools.dodir("/var/lib/dhclient") + + # Sample configuration files + pisitools.insinto("/usr/share/doc/dhcp", "client/dhclient.conf.5", "dhclient.conf.exsample") + pisitools.insinto("/usr/share/doc/dhcp", "server/dhcpd.conf.5", "dhcpd.conf.example") + pisitools.insinto("/usr/share/doc/dhcp", "doc/examples/dhclient-dhcpv6.conf") + pisitools.insinto("/usr/share/doc/dhcp", "doc/examples/dhcpd-dhcpv6.conf") + + pisitools.dodoc("LICENSE", "README", "RELNOTES") diff --git a/server/dhcp/comar/dhcpd.py b/server/dhcp/comar/dhcpd.py new file mode 100644 index 0000000000..d1d7b9e59e --- /dev/null +++ b/server/dhcp/comar/dhcpd.py @@ -0,0 +1,39 @@ +# -*- coding: utf-8 -*- +from comar.service import * + +serviceType = "server" +serviceDesc = _({"en": "DHCP Daemon", + "tr": "DHCP Servisi"}) + +serviceConf = "dhcpd" + +MSG_NM_NOT_RUNNING = _({"en": "NetworkManager service is not running", + "tr": "NetworkManager hizmeti çalışmıyor", + }) + +PIDFILE = "/run/dhcpd.pid" +TIMEOUT = config.get("TIMEOUT", 10) + +@synchronized +def start(): + try: + startDependencies("NetworkManager") + # Prevent race condition between NM and dhcpd + if run("/usr/bin/nm-online -q -t %s" % TIMEOUT) != 0: + # NM is not running + fail(MSG_NM_NOT_RUNNING) + except: + pass + + startService(command="/usr/sbin/dhcpd", + args="-cf %s %s %s" % (config.get("DHCPD_CONF", "/etc/dhcp/dhcpd.conf"), config.get("DHCPD_ARGS", ""), config.get("INTERFACES", "")), + pidfile=PIDFILE, + donotify=True) + +@synchronized +def stop(): + stopService(pidfile=PIDFILE, + donotify=True) + +def status(): + return isServiceRunning(PIDFILE) diff --git a/server/dhcp/comar/dhcpd6.py b/server/dhcp/comar/dhcpd6.py new file mode 100644 index 0000000000..9dee3b6cf3 --- /dev/null +++ b/server/dhcp/comar/dhcpd6.py @@ -0,0 +1,39 @@ +# -*- coding: utf-8 -*- +from comar.service import * + +serviceType = "server" +serviceDesc = _({"en": "DHCPv6 Daemon", + "tr": "DHCPv6 Servisi"}) + +serviceConf = "dhcpd6" + +MSG_NM_NOT_RUNNING = _({"en": "NetworkManager service is not running", + "tr": "NetworkManager hizmeti çalışmıyor", + }) + +PIDFILE = "/run/dhcpd6.pid" +TIMEOUT = config.get("TIMEOUT", 10) + +@synchronized +def start(): + try: + startDependencies("NetworkManager") + # Prevent race condition between NM and dhcpd + if run("/usr/bin/nm-online -q -t %s" % TIMEOUT) != 0: + # NM is not running + fail(MSG_NM_NOT_RUNNING) + except: + pass + + startService(command="/usr/sbin/dhcpd", + args="-6 -cf %s %s %s" % (config.get("DHCPD_CONF", "/etc/dhcp/dhcpd.conf"), config.get("DHCPD_ARGS", ""), config.get("INTERFACES", "")), + pidfile=PIDFILE, + donotify=True) + +@synchronized +def stop(): + stopService(pidfile=PIDFILE, + donotify=True) + +def status(): + return isServiceRunning(PIDFILE) diff --git a/server/dhcp/comar/dhcrelay.py b/server/dhcp/comar/dhcrelay.py new file mode 100644 index 0000000000..2c7a246b3c --- /dev/null +++ b/server/dhcp/comar/dhcrelay.py @@ -0,0 +1,24 @@ +# -*- coding: utf-8 -*- +from comar.service import * + +serviceType = "server" +serviceDesc = _({"en": "DHCP Relay Server", + "tr": "DHCP Relay Servisi"}) +serviceConf = "dhcrelay" + +pidfile = "/run/dhcrelay.pid" + +@synchronized +def start(): + startService(command="/usr/sbin/dhcrelay", + args="%s %s" % (config.get("DHCPD_ARGS", ""), config.get("INTERFACES", "")), + donotify=True) + +@synchronized +def stop(): + stopService(command="/usr/sbin/dhcpd", + pidfile=pidfile, + donotify=True) + +def status(): + return isServiceRunning(pidfile) diff --git a/server/dhcp/comar/package.py b/server/dhcp/comar/package.py new file mode 100644 index 0000000000..d7ab76d36c --- /dev/null +++ b/server/dhcp/comar/package.py @@ -0,0 +1,11 @@ +#!/usr/bin/python + +import os + +def postInstall(fromVersion, fromRelease, toVersion, toRelease): + if not os.path.exists("/var/lib/dhcpd/dhcpd.leases"): + os.system("/bin/touch /var/lib/dhcpd/dhcpd.leases") + + if not os.path.exists("/var/lib/dhcpd/dhcpd6.leases"): + os.system("/bin/touch /var/lib/dhcpd/dhcpd6.leases") + diff --git a/server/dhcp/files/11-dhclient b/server/dhcp/files/11-dhclient new file mode 100644 index 0000000000..5842f8287c --- /dev/null +++ b/server/dhcp/files/11-dhclient @@ -0,0 +1,37 @@ +#!/bin/bash +# run dhclient.d scripts in an emulated environment + +PATH=/bin:/usr/bin:/sbin +SAVEDIR=/var/lib/dhclient +ETCDIR=/etc/dhcp +interface=$1 + +eval "$( +declare | LC_ALL=C grep '^DHCP4_[A-Z_]*=' | while read opt; do + optname=${opt%%=*} + optname=${optname,,} + optname=new_${optname#dhcp4_} + optvalue=${opt#*=} + echo "$optname=$optvalue" +done +)" + +[ -f /etc/sysconfig/network ] && . /etc/sysconfig/network + +[ -f /etc/sysconfig/network-scripts/ifcfg-$interface ] && \ + . /etc/sysconfig/network-scripts/ifcfg-$interface + +if [ -d $ETCDIR/dhclient.d ]; then + for f in $ETCDIR/dhclient.d/*.sh; do + if [ -x $f ]; then + subsystem="${f%.sh}" + subsystem="${subsystem##*/}" + . ${f} + if [ "$2" = "up" ]; then + "${subsystem}_config" + elif [ "$2" = "down" ]; then + "${subsystem}_restore" + fi + fi + done +fi diff --git a/server/dhcp/files/12-dhcpd b/server/dhcp/files/12-dhcpd new file mode 100644 index 0000000000..a48da320da --- /dev/null +++ b/server/dhcp/files/12-dhcpd @@ -0,0 +1,21 @@ +#!/bin/bash +export LC_ALL=C + +[ -f /etc/sysconfig/dhcpd ] && . /etc/sysconfig/dhcpd + +# restart dhcpd whenever $1 interface is brought up by NM (rhbz #565921) +if [ "$2" = "up" ]; then + # exit if the service is not configured to be started in the current runlevel + /sbin/chkconfig dhcpd || exit 0 + + # exit if dhcpd is not defined to listen on $1 + # i.e. if there are interfaces defined in DHCPDARGS and $1 is not among them + if [ -n "${DHCPDARGS}" ] && + [[ "${DHCPDARGS}" == *eth* ]] && + [[ "${DHCPDARGS}" != *$1* ]]; then + exit 0 + fi + + # restart service + /sbin/service dhcpd restart || : +fi diff --git a/server/dhcp/files/56dhclient b/server/dhcp/files/56dhclient new file mode 100644 index 0000000000..25d14db205 --- /dev/null +++ b/server/dhcp/files/56dhclient @@ -0,0 +1,61 @@ +#!/bin/sh +# If we are running dhclient, shutdown running instances cleanly and +# bring them back up on resume. + +. "${PM_FUNCTIONS}" + +PM_DHCLIENT_RUNDIR="${PM_UTILS_RUNDIR}/network" +PM_DHCLIENT_SUSPEND="${PM_DHCLIENT_RUNDIR}/dhclient.suspend" + +suspend_dhclient() { + [ ! -d /etc/sysconfig/network-scripts ] && return + [ ! -x /sbin/ifdown ] && return + + [ ! -d ${PM_DHCLIENT_RUNDIR} ] && /bin/mkdir -p ${PM_DHCLIENT_RUNDIR} + [ -f ${PM_DHCLIENT_SUSPEND} ] && /bin/rm -f ${PM_DHCLIENT_SUSPEND} + + cd /etc/sysconfig/network-scripts + for ifcfg in ifcfg-* ; do + # Clear relevant parameters set by previous interface + # (lo doesn't set them) + NM_CONTROLLED= + BOOTPROTO= + + . ./${ifcfg} + + if [ "${NM_CONTROLLED}" = "no" ] || [ "${NM_CONTROLLED}" = "n" ] || [ "${NM_CONTROLLED}" = "false" ]; then + if [ "${BOOTPROTO}" = "bootp" ] || [ "${BOOTPROTO}" = "dhcp" ] || [ -z "${BOOTPROTO}" ]; then + # device is not NetworkManager controlled and uses dhcp, + # now see if it's actually up at the moment + /sbin/ip link show ${DEVICE} | /bin/grep -qE "state (UP|UNKNOWN)" >/dev/null 2>&1 + if [ $? -eq 0 ]; then + echo "${DEVICE}" >> ${PM_DHCLIENT_SUSPEND} + /sbin/ifdown ${DEVICE} + fi + fi + fi + done +} + +resume_dhclient() { + [ ! -f ${PM_DHCLIENT_SUSPEND} ] && return + [ ! -x /sbin/ifup ] && return + + cd /etc/sysconfig/network-scripts + while read device ; do + /sbin/ifup ${device} + done < ${PM_DHCLIENT_SUSPEND} + + /bin/rm -f ${PM_DHCLIENT_SUSPEND} +} + +case "$1" in + hibernate|suspend) + suspend_dhclient + ;; + thaw|resume) + resume_dhclient + ;; + *) exit $NA + ;; +esac diff --git a/server/dhcp/files/dhclient-script b/server/dhcp/files/dhclient-script new file mode 100644 index 0000000000..9290d91a9a --- /dev/null +++ b/server/dhcp/files/dhclient-script @@ -0,0 +1,754 @@ +#!/bin/bash +# +# dhclient-script: Network interface configuration script run by +# dhclient based on DHCP client communication +# +# Copyright (C) 2008, 2009, 2010 Red Hat, Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# Author(s): David Cantrell +# +# ---------- +# This script is a rewrite/reworking on dhclient-script originally +# included as part of dhcp-970306: +# dhclient-script for Linux. Dan Halbert, March, 1997. +# Updated for Linux 2.[12] by Brian J. Murrell, January 1999. +# Modified by David Cantrell for Fedora and RHEL +# ---------- +# + +PATH=/bin:/usr/bin:/sbin +SAVEDIR=/var/lib/dhclient + +LOGFACILITY="local7" +LOGLEVEL="notice" + +ETCDIR="/etc/dhcp" + +logmessage() { + msg="${1}" + logger -p ${LOGFACILITY}.${LOGLEVEL} -t "NET" "dhclient: ${msg}" +} + +fix_context() { + if [ -x /sbin/restorecon ]; then + /sbin/restorecon ${1} >/dev/null 2>&1 + fi +} + +save_previous() { + origfile="${1}" + savefile="${SAVEDIR}/${origfile##*/}.predhclient.${interface}" + + if [ ! -d ${SAVEDIR} ]; then + mkdir -p ${SAVEDIR} + fi + + if [ -e ${origfile} ]; then + contents="$(< ${origfile})" + echo "${contents}" > ${savefile} + rm -f ${origfile} + else + echo > ${savefile} + fi + + fix_context ${savefile} +} + +make_resolv_conf() { + [ "${PEERDNS}" = "no" ] && return + + if [ "${reason}" = "RENEW" ] && + [ "${new_domain_name}" = "${old_domain_name}" ] && + [ "${new_domain_name_servers}" = "${old_domain_name_servers}" ]; then + return + fi + + if [ -n "${new_domain_name}" ] || + [ -n "${new_domain_name_servers}" ] || + [ -n "${new_domain_search}" ]; then + save_previous /etc/resolv.conf + rscf="$(mktemp /tmp/XXXXXX)" + echo "; generated by /sbin/dhclient-script" > ${rscf} + + if [ -n "${SEARCH}" ]; then + echo "search ${SEARCH}" >> $rscf + else + if [ -n "${new_domain_search}" ]; then + echo "search ${new_domain_search//\\032/ }" >> ${rscf} + elif [ -n "${new_domain_name}" ]; then + # Note that the DHCP 'Domain Name Option' is really just a domain + # name, and that this practice of using the domain name option as + # a search path is both nonstandard and deprecated. + echo "search ${new_domain_name//\\032/ }" >> ${rscf} + fi + fi + + if [ -n "${RES_OPTIONS}" ]; then + echo "options ${RES_OPTIONS}" >> ${rscf} + fi + + for nameserver in ${new_domain_name_servers} ; do + echo "nameserver ${nameserver}" >> ${rscf} + done + + change_resolv_conf ${rscf} + rm -f ${rscf} + + fix_context /etc/resolv.conf + elif [ -n "${new_dhcp6_name_servers}" ] || + [ -n "${new_dhcp6_domain_search}" ]; then + save_previous /etc/resolv.conf + rscf="$(mktemp /tmp/XXXXXX)" + echo "; generated by /sbin/dhclient-script" > ${rscf} + + if [ -n "${SEARCH}" ]; then + echo "search ${SEARCH}" >> $rscf + else + if [ -n "${new_dhcp6_domain_search}" ]; then + echo "search ${new_dhcp6_domain_search//\\032/ }" >> ${rscf} + fi + fi + + if [ -n "${RES_OPTIONS}" ]; then + echo "options ${RES_OPTIONS}" >> ${rscf} + fi + + for nameserver in ${new_dhcp6_name_servers} ; do + echo "nameserver ${nameserver}" >> ${rscf} + done + + change_resolv_conf ${rscf} + rm -f ${rscf} + + fix_context /etc/resolv.conf + fi +} + +exit_with_hooks() { + exit_status="${1}" + + if [ -x ${ETCDIR}/dhclient-exit-hooks ]; then + . ${ETCDIR}/dhclient-exit-hooks + fi + + exit ${exit_status} +} + +quad2num() { + if [ $# -eq 4 ]; then + let n="${1} << 24 | ${2} << 16 | ${3} << 8 | ${4}" + echo "${n}" + return 0 + else + echo "0" + return 1 + fi +} + +ip2num() { + IFS="." quad2num ${1} +} + +num2ip() { + let n="${1}" + let o1="(n >> 24) & 0xff" + let o2="(n >> 16) & 0xff" + let o3="(n >> 8) & 0xff" + let o4="n & 0xff" + echo "${o1}.${o2}.${o3}.${o4}" +} + +get_network_address() { +# get network address for the given IP address and (netmask or prefix) + ip="${1}" + nm="${2}" + + if [ -n "${ip}" -a -n "${nm}" ]; then + if [[ "${nm}" = *.* ]]; then + ipcalc -s -n ${ip} ${nm} | cut -d '=' -f 2 + else + ipcalc -s -n ${ip}/${nm} | cut -d '=' -f 2 + fi + fi +} + +get_prefix() { +# get prefix for the given IP address and mask + ip="${1}" + nm="${2}" + + if [ -n "${ip}" -a -n "${nm}" ]; then + ipcalc -s -p ${ip} ${nm} | cut -d '=' -f 2 + fi +} + +class_bits() { + let ip=$(IFS='.' ip2num $1) + let bits=32 + let mask='255' + for ((i=0; i <= 3; i++, 'mask<<=8')); do + let v='ip&mask' + if [ "$v" -eq 0 ] ; then + let bits-=8 + else + break + fi + done + echo $bits +} + +is_router_reachable() { + # handle DHCP servers that give us a router not on our subnet + router="${1}" + routersubnet="$(get_network_address ${router} ${new_subnet_mask})" + mysubnet="$(get_network_address ${new_ip_address} ${new_subnet_mask})" + unreachable=0 + + if [ ! "${routersubnet}" = "${mysubnet}" ]; then + unreachable=1 + if arping -f -q -I ${interface} -w2 ${router}; then + ip -4 route add ${router}/32 dev ${interface} + if [ $? -eq 0 ]; then + unreachable=0 + else + logmessage "failed to create host router for unreachable router ${router} not on subnet ${mysubnet}" + fi + else + unreachable=1 + logmessage "DHCP router ${router} is unreachable on DHCP subnet ${mysubnet} router subnet ${routersubnet}" + fi + fi + + return ${unreachable} +} + +add_default_gateway() { + router="${1}" + metric="" + + if [ $# -gt 1 ] && [ ${2} -gt 0 ]; then + metric="metric ${2}" + fi + + if is_router_reachable ${router} ; then + ip -4 route replace default via ${router} dev ${interface} ${metric} + if [ $? -ne 0 ]; then + logmessage "failed to create default route: ${router} dev ${interface} ${metric}" + return 1 + else + return 0 + fi + fi + + return 1 +} + +dhconfig() { + if [ -n "${old_ip_address}" ] && [ -n "${alias_ip_address}" ] && + [ ! "${alias_ip_address}" = "${old_ip_address}" ]; then + # possible new alias, remove old alias first + ip -4 addr del ${old_ip_address} dev ${interface}:0 + fi + + if [ -n "${old_ip_address}" ] && + [ ! "${old_ip_address}" = "${new_ip_address}" ]; then + # IP address changed. Bringing down the interface will delete all + # routes, and clear the ARP cache. + ip -4 addr flush dev ${interface} >/dev/null 2>&1 + fi + + if [ "${reason}" = "BOUND" ] || [ "${reason}" = "REBOOT" ] || + [ ! "${old_ip_address}" = "${new_ip_address}" ] || + [ ! "${old_subnet_mask}" = "${new_subnet_mask}" ] || + [ ! "${old_network_number}" = "${new_network_number}" ] || + [ ! "${old_broadcast_address}" = "${new_broadcast_address}" ] || + [ ! "${old_routers}" = "${new_routers}" ] || + [ ! "${old_interface_mtu}" = "${new_interface_mtu}" ]; then + ip -4 addr add ${new_ip_address}/${new_prefix} broadcast ${new_broadcast_address} dev ${interface} + ip link set dev ${interface} up + + # The 576 MTU is only used for X.25 and dialup connections + # where the admin wants low latency. Such a low MTU can cause + # problems with UDP traffic, among other things. As such, + # disallow MTUs from 576 and below by default, so that broken + # MTUs are ignored, but higher stuff is allowed (1492, 1500, etc). + if [ -n "${new_interface_mtu}" ] && [ ${new_interface_mtu} -gt 576 ]; then + ip link set ${interface} mtu ${new_interface_mtu} + fi + + if [ -x ${ETCDIR}/dhclient-${interface}-up-hooks ]; then + . ${ETCDIR}/dhclient-${interface}-up-hooks + elif [ -x ${ETCDIR}/dhclient-up-hooks ]; then + . ${ETCDIR}/dhclient-up-hooks + fi + + # static routes + if [ -n "${new_classless_static_routes}" ] || + [ -n "${new_static_routes}" ]; then + if [ -n "${new_classless_static_routes}" ]; then + IFS=', |' static_routes=(${new_classless_static_routes}) + + # If the DHCP server returns both a Classless Static Routes option and + # a Router option, the DHCP client MUST ignore the Router option. (RFC3442) + new_routers="" + else + IFS=', |' static_routes=(${new_static_routes}) + fi + route_targets=() + + for((i=0; i<${#static_routes[@]}; i+=2)); do + target=${static_routes[$i]} + if [ -n "${new_classless_static_routes}" ]; then + prefix=$(echo ${target} | cut -d "." -f 1) + target=$(echo ${target} | cut -d "." -f 2-) + IFS="." target_arr=(${target}) + unset IFS + ((pads=4-${#target_arr[@]})) + for j in $(seq $pads); do + target=${target}".0" + done + + # Client MUST zero any bits in the subnet number where the corresponding bit in the mask is zero. + # In other words, the subnet number installed in the routing table is the logical AND of + # the subnet number and subnet mask given in the Classless Static Routes option. (RFC3442) + target="$(get_network_address ${target} ${prefix})" + else + prefix=$(class_bits ${target}) + fi + gateway=${static_routes[$i+1]} + + metric='' + for t in ${route_targets[@]}; do + if [ ${t} = ${target} ]; then + if [ -z "${metric}" ]; then + metric=1 + else + ((metric=metric+1)) + fi + fi + done + + if [ -n "${metric}" ]; then + metric="metric ${metric}" + fi + + if is_router_reachable ${gateway}; then + ip -4 route replace ${target}/${prefix} via ${gateway} dev ${interface} ${metric} + + if [ $? -ne 0 ]; then + logmessage "failed to create static route: ${target}/${prefix} via ${gateway} dev ${interface} ${metric}" + else + route_targets=(${route_targets[@]} ${target}) + fi + fi + done + fi + + # gateways + if [[ ( "${DEFROUTE}" != "no") && + (( -z "${GATEWAYDEV}" ) || + ( "${GATEWAYDEV}" = "${interface}" )) ]]; then + if [[ ( -z "$GATEWAY" ) || + (( -n "$DHCLIENT_IGNORE_GATEWAY" ) && + ( "$DHCLIENT_IGNORE_GATEWAY" = [Yy]* )) ]]; then + metric="${METRIC:-}" + let i="${METRIC:-0}" + default_routers=() + + for router in ${new_routers} ; do + added_router=- + + for r in ${default_routers[@]} ; do + if [ "${r}" = "${router}" ]; then + added_router=1 + fi + done + + if [ -z "${router}" ] || + [ "${added_router}" = "1" ] || + [ $(IFS=. ip2num ${router}) -le 0 ] || + [[ ( "${router}" = "${new_broadcast_address}" ) && + ( "${new_subnet_mask}" != "255.255.255.255" ) ]]; then + continue + fi + + default_routers=(${default_routers[@]} ${router}) + add_default_gateway ${router} ${metric} + let i=i+1 + metric=${i} + done + elif [ -n "${GATEWAY}" ]; then + routersubnet=$(get_network_address ${GATEWAY} ${new_subnet_mask}) + mysubnet=$(get_network_address ${new_ip_address} ${new_subnet_mask}) + + if [ "${routersubnet}" = "${mysubnet}" ]; then + ip -4 route replace default via ${GATEWAY} dev ${interface} + fi + fi + fi + + fi + + if [ ! "${new_ip_address}" = "${alias_ip_address}" ] && + [ -n "${alias_ip_address}" ]; then + ip -4 addr flush dev ${interface}:0 >/dev/null 2>&1 + ip -4 addr add ${alias_ip_address}/${alias_prefix} dev ${interface}:0 + ip -4 route replace ${alias_ip_address}/32 dev ${interface}:0 + fi + + make_resolv_conf + + if [ -n "${new_host_name}" ] && need_hostname; then + hostname ${new_host_name} || echo "See -nc option in dhclient(8) man page." + fi + + if [ -n "${DHCP_TIME_OFFSET_SETS_TIMEZONE}" ] && + [[ "${DHCP_TIME_OFFSET_SETS_TIMEZONE}" = [yY1]* ]]; then + if [ -n "${new_time_offset}" ]; then + # DHCP option "time-offset" is requested by default and should be + # handled. The geographical zone abbreviation cannot be determined + # from the GMT offset, but the $ZONEINFO/Etc/GMT$offset file can be + # used - note: this disables DST. + ((z=new_time_offset/3600)) + ((hoursWest=$(printf '%+d' $z))) + + if (( $hoursWest < 0 )); then + # tzdata treats negative 'hours west' as positive 'gmtoff'! + ((hoursWest*=-1)) + fi + + tzfile=/usr/share/zoneinfo/Etc/GMT$(printf '%+d' ${hoursWest}) + if [ -e ${tzfile} ]; then + save_previous /etc/localtime + cp -fp ${tzfile} /etc/localtime + touch /etc/localtime + fix_context /etc/localtime + fi + fi + fi + + # execute any additional client side configuration scripts we have + if [ -d ${ETCDIR}/dhclient.d ]; then + for f in ${ETCDIR}/dhclient.d/*.sh ; do + if [ -x ${f} ]; then + subsystem="${f%.sh}" + subsystem="${subsystem##*/}" + . ${f} + "${subsystem}_config" + fi + done + fi +} + +# Section 18.1.8. (Receipt of Reply Messages) of RFC 3315 says: +# The client SHOULD perform duplicate address detection on each of +# the addresses in any IAs it receives in the Reply message before +# using that address for traffic. +add_ipv6_addr_with_DAD() { + ip -6 addr add ${new_ip6_address}/${new_ip6_prefixlen} \ + dev ${interface} scope global + + # repeatedly test whether newly added address passed + # duplicate address detection (DAD) + for i in $(seq 5); do + sleep 1 # give the DAD some time + + # tentative flag = DAD is still not complete or failed + duplicate=$(ip -6 addr show dev ${interface} tentative \ + | grep ${new_ip6_address}/${new_ip6_prefixlen}) + + # if there's no tentative flag, address passed DAD + if [ -z "${duplicate}" ]; then + break + fi + done + + # if there's still tentative flag = address didn't pass DAD = + # = it's duplicate = remove it + if [ -n "${duplicate}" ]; then + ip -6 addr del ${new_ip6_address}/${new_ip6_prefixlen} dev ${interface} + exit_with_hooks 3 + fi +} + +dh6config() { + case "${reason}" in + BOUND6) + if [ -z "${new_ip6_address}" ] && + [ -z "${new_ip6_prefixlen}" ]; then + exit_with_hooks 2 + fi + + add_ipv6_addr_with_DAD + + make_resolv_conf + ;; + + RENEW6|REBIND6) + if [ -n "${new_ip6_prefixlen}" ] && + [ -n "${new_ip6_address}" ] && + [ ! "${new_ip6_address}" = "${old_ip6_address}" ]; then + add_ipv6_addr_with_DAD + fi + + if [ ! "${new_dhcp6_name_servers}" = "${old_dhcp6_name_servers}" ] || + [ ! "${new_dhcp6_domain_search}" = "${old_dhcp6_domain_search}" ]; then + make_resolv_conf + fi + ;; + + DEPREF6) + if [ -z "${new_ip6_prefixlen}" ]; then + exit_with_hooks 2 + fi + + ip -6 addr change ${new_ip6_address}/${new_ip6_prefixlen} \ + dev ${interface} scope global preferred_lft 0 + ;; + esac + + # execute any additional client side configuration scripts we have + if [ -d ${ETCDIR}/dhclient.d ]; then + for f in ${ETCDIR}/dhclient.d/*.sh ; do + if [ -x ${f} ]; then + subsystem="${f%.sh}" + subsystem="${subsystem##*/}" + . ${f} + "${subsystem}_config" + fi + done + fi +} + + +# +# ### MAIN +# + +if [ -x ${ETCDIR}/dhclient-enter-hooks ]; then + exit_status=0 + + # dhclient-enter-hooks can abort dhclient-script by setting + # the exit_status variable to a non-zero value + . ${ETCDIR}/dhclient-enter-hooks + if [ ${exit_status} -ne 0 ]; then + exit ${exit_status} + fi +fi + +if [ ! -r /etc/sysconfig/network-scripts/network-functions ]; then + echo "Missing /etc/sysconfig/network-scripts/network-functions, exiting." >&2 + exit 1 +fi + +if [ ! -r /etc/rc.d/init.d/functions ]; then + echo "Missing /etc/rc.d/init.d/functions, exiting." >&2 + exit 1 +fi + +. /etc/sysconfig/network-scripts/network-functions +. /etc/rc.d/init.d/functions + +if [ -f /etc/sysconfig/network ]; then + . /etc/sysconfig/network +fi + +if [ -f /etc/sysconfig/networking/network ]; then + . /etc/sysconfig/networking/network +fi + +cd /etc/sysconfig/network-scripts +CONFIG="ifcfg-${interface}" +need_config ${CONFIG} +source_config >/dev/null 2>&1 + +new_prefix="$(get_prefix ${new_ip_address} ${new_subnet_mask})" +old_prefix="$(get_prefix ${old_ip_address} ${old_subnet_mask})" +alias_prefix="$(get_prefix ${alias_ip_address} ${alias_subnet_mask})" + +case "${reason}" in + MEDIUM) + # Linux doesn't handle mediums (media) + exit_with_hooks 0 + ;; + + PREINIT) + if [ -n "${alias_ip_address}" ]; then + # Bring down alias interface, its routes will disappear too. + ip link set ${interface}:0 down + fi + + if [ "${keep_old_ip}" = "yes" ]; then + ip link set ${interface} up + else + ip -4 addr flush dev ${interface} >/dev/null 2>&1 + ip link set ${interface} up + fi + + if [ -n "${DHCLIENT_DELAY}" ] && [ ${DHCLIENT_DELAY} -gt 0 ]; then + sleep ${DHCLIENT_DELAY} + fi + + exit_with_hooks 0 + ;; + + PREINIT6) + # ensure interface is up + ip link set ${interface} up + + # remove any stale addresses from aborted clients + ip -6 addr flush dev ${interface} scope global permanent + + exit_with_hooks 0 + ;; + + ARPCHECK|ARPSEND) + if [ -z "${new_ip_address}" ] || [ -z "${interface}" ] || + arping -q -f -c 2 -w 3 -D -I ${interface} ${new_ip_address}; then + exit_with_hooks 0 + else + exit_with_hooks 1 + fi + ;; + + BOUND|RENEW|REBIND|REBOOT) + dhconfig + exit_with_hooks 0 + ;; + + BOUND6|RENEW6|REBIND6|DEPREF6) + dh6config + exit_with_hooks 0 + ;; + + EXPIRE6|RELEASE6|STOP6) + if [ -z "${old_ip6_address}" ] || [ -z "${old_ip6_prefixlen}" ]; then + exit_with_hooks 2 + fi + + ip -6 addr del ${old_ip6_address}/${old_ip6_prefixlen} \ + dev ${interface} + + # execute any additional client side configuration scripts we have + if [ -d ${ETCDIR}/dhclient.d ]; then + for f in ${ETCDIR}/dhclient.d/*.sh ; do + if [ -x ${f} ]; then + subsystem="${f%.sh}" + subsystem="${subsystem##*/}" + . ${f} + "${subsystem}_restore" + fi + done + fi + + if [ -x ${ETCDIR}/dhclient-${interface}-down-hooks ]; then + . ${ETCDIR}/dhclient-${interface}-down-hooks + elif [ -x ${ETCDIR}/dhclient-down-hooks ]; then + . ${ETCDIR}/dhclient-down-hooks + fi + + exit_with_hooks 0 + ;; + + EXPIRE|FAIL|RELEASE|STOP) + # only restore config files if there are no other dhclient processes + # running (#306381) + any_other_clients="$(ps -eo pid,ppid,comm | grep dhclient | grep -v ${PPID})" + if [ -n "${any_other_clients}" ]; then + if [ -f ${SAVEDIR}/resolv.conf.predhclient.${interface} ]; then + change_resolv_conf ${SAVEDIR}/resolv.conf.predhclient.${interface} + rm -f ${SAVEDIR}/resolv.conf.predhclient.${interface} + fi + + if [ -n "${DHCP_TIME_OFFSET_SETS_TIMEZONE}" ] && + [[ "${DHCP_TIME_OFFSET_SETS_TIMEZONE}" = [yY1]* ]]; then + if [ -e ${SAVEDIR}/localtime.predhclient.${interface} ]; then + rm -f /etc/localtime + contents="$(< ${SAVEDIR}/localtime.predhclient.${interface})" + echo "${contents}" > /etc/localtime + rm -f ${SAVEDIR}/localtime.predhclient.${interface} + touch /etc/localtime + fix_context /etc/localtime + fi + fi + fi + + # execute any additional client side configuration scripts we have + if [ -d ${ETCDIR}/dhclient.d ]; then + for f in ${ETCDIR}/dhclient.d/*.sh ; do + if [ -x ${f} ]; then + subsystem="${f%.sh}" + subsystem="${subsystem##*/}" + . ${f} + "${subsystem}_restore" + fi + done + fi + + if [ -x ${ETCDIR}/dhclient-${interface}-down-hooks ]; then + . ${ETCDIR}/dhclient-${interface}-down-hooks + elif [ -x ${ETCDIR}/dhclient-down-hooks ]; then + . ${ETCDIR}/dhclient-down-hooks + fi + + if [ -n "${alias_ip_address}" ]; then + # Turn off alias interface + ip link set ${interface}:0 down + fi + + if [ -n "${old_ip_address}" ]; then + # Shut down interface, which will delete routes and clear arp cache. + ip -4 addr flush dev ${interface} >/dev/null 2>&1 + ip link set ${interface} down + fi + + if [ -n "${alias_ip_address}" ]; then + ip -4 addr add ${alias_ip_address}/${alias_prefix} dev ${interface}:0 + ip -4 route replace ${alias_ip_address}/32 ${interface}:0 + fi + + exit_with_hooks 0 + ;; + + TIMEOUT) + if [ -n "${new_routers}" ]; then + if [ -n "${alias_ip_address}" ]; then + ip -4 addr flush dev ${interface}:0 >/dev/null 2>&1 + fi + + ip -4 addr add ${new_ip_address}/${new_prefix} broadcast ${new_broadcast_address} dev ${interface} + set ${new_routers} + + if ping -q -c 1 -w 10 -I ${interface} ${1}; then + dhconfig + exit_with_hooks 0 + fi + + ip -4 addr flush dev ${interface} >/dev/null 2>&1 + ip link set ${interface} down + exit_with_hooks 1 + else + exit_with_hooks 1 + fi + ;; + + *) + logmessage "unhandled state: ${reason}" + exit_with_hooks 1 + ;; +esac + +exit_with_hooks 0 diff --git a/server/dhcp/files/dhclient.conf b/server/dhcp/files/dhclient.conf new file mode 100644 index 0000000000..c5837d7479 --- /dev/null +++ b/server/dhcp/files/dhclient.conf @@ -0,0 +1,40 @@ +#Please refer to dhclient.conf(5) man page + +#send host-name "pisilinux"; +#send dhcp-client-identifier 1:0:a0:24:ab:fb:9c; +#send dhcp-lease-time 3600; +#supersede domain-name "fugue.com home.vix.com"; +#prepend domain-name-servers 127.0.0.1; + +#request subnet-mask, broadcast-address, time-offset, routers, +# domain-name, domain-name-servers, host-name; + +#require subnet-mask, domain-name-servers; +#timeout 60; +#retry 60; +#reboot 10; +#select-timeout 5; +#initial-interval 2; +#script "/etc/dhcp/dhclient-script"; +#media "-link0 -link1 -link2", "link0 link1"; +#reject 192.33.137.209; + +#alias { +# interface "ep0"; +# fixed-address 192.5.5.213; +# option subnet-mask 255.255.255.255; +#} + +#lease { +# interface "ep0"; +# fixed-address 192.33.137.200; +# medium "link0 link1"; +# option host-name "andare.swiftmedia.com"; +# option subnet-mask 255.255.255.0; +# option broadcast-address 192.33.137.255; +# option routers 192.33.137.250; +# option domain-name-servers 127.0.0.1; +# renew 2 2000/1/12 00:00:01; +# rebind 2 2000/1/12 00:00:01; +# expire 2 2000/1/12 00:00:01; +#} diff --git a/server/dhcp/files/dhcp-4.2.0-IFNAMSIZ.patch b/server/dhcp/files/dhcp-4.2.0-IFNAMSIZ.patch new file mode 100644 index 0000000000..b8437daaac --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-IFNAMSIZ.patch @@ -0,0 +1,12 @@ +diff -up dhcp-4.2.0/server/dhcpd.c.ifnamsiz dhcp-4.2.0/server/dhcpd.c +--- dhcp-4.2.0/server/dhcpd.c.ifnamsiz 2010-07-21 14:31:39.000000000 +0200 ++++ dhcp-4.2.0/server/dhcpd.c 2010-07-21 16:05:49.000000000 +0200 +@@ -409,7 +409,7 @@ main(int argc, char **argv) { + log_fatal ("Insufficient memory to %s %s: %s", + "record interface", argv [i], + isc_result_totext (result)); +- strcpy (tmp -> name, argv [i]); ++ strncpy (tmp -> name, argv [i], sizeof (tmp -> name)); + if (interfaces) { + interface_reference (&tmp -> next, + interfaces, MDL); diff --git a/server/dhcp/files/dhcp-4.2.0-P2-omapi.patch b/server/dhcp/files/dhcp-4.2.0-P2-omapi.patch new file mode 100644 index 0000000000..0222090eda --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-P2-omapi.patch @@ -0,0 +1,12 @@ +diff -up dhcp-4.2.0-P2/omapip/protocol.c.omapi dhcp-4.2.0-P2/omapip/protocol.c +--- dhcp-4.2.0-P2/omapip/protocol.c.omapi 2009-11-20 02:49:02.000000000 +0100 ++++ dhcp-4.2.0-P2/omapip/protocol.c 2011-01-03 16:30:25.000000000 +0100 +@@ -386,7 +386,7 @@ isc_result_t omapi_protocol_signal_handl + /* Should only receive these when opening the initial authenticator. */ + if (!strcmp (name, "status")) { + status = va_arg (ap, isc_result_t); +- if (status != ISC_R_SUCCESS) { ++ if ((status != ISC_R_SUCCESS) && (status >= ISC_RESULTCLASS_DHCP)) { + omapi_signal_in (h -> inner, "status", status, + (omapi_object_t *)0); + omapi_disconnect (p -> outer, 1); diff --git a/server/dhcp/files/dhcp-4.2.0-PPP.patch b/server/dhcp/files/dhcp-4.2.0-PPP.patch new file mode 100644 index 0000000000..bef2be7f08 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-PPP.patch @@ -0,0 +1,150 @@ +diff -up dhcp-4.2.0-P1/client/dhc6.c.PPP dhcp-4.2.0-P1/client/dhc6.c +--- dhcp-4.2.0-P1/client/dhc6.c.PPP 2010-11-05 10:47:37.000000000 +0100 ++++ dhcp-4.2.0-P1/client/dhc6.c 2010-11-09 15:54:12.000000000 +0100 +@@ -129,7 +129,7 @@ extern int stateless; + * is not how it is intended. Upcoming rearchitecting the client should + * address this "one daemon model." + */ +-void ++isc_result_t + form_duid(struct data_string *duid, const char *file, int line) + { + struct interface_info *ip; +@@ -141,6 +141,15 @@ form_duid(struct data_string *duid, cons + if (ip == NULL) + log_fatal("Impossible condition at %s:%d.", MDL); + ++ while (ip && ip->hw_address.hbuf[0] == HTYPE_RESERVED) { ++ /* Try the other interfaces */ ++ log_debug("Cannot form default DUID from interface %s.", ip->name); ++ ip = ip->next; ++ } ++ if (ip == NULL) { ++ return ISC_R_UNEXPECTED; ++ } ++ + if ((ip->hw_address.hlen == 0) || + (ip->hw_address.hlen > sizeof(ip->hw_address.hbuf))) + log_fatal("Impossible hardware address length at %s:%d.", MDL); +@@ -176,6 +185,8 @@ form_duid(struct data_string *duid, cons + memcpy(duid->buffer->data + 4, ip->hw_address.hbuf + 1, + ip->hw_address.hlen - 1); + } ++ ++ return ISC_R_SUCCESS; + } + + /* +@@ -5289,7 +5300,8 @@ make_client6_options(struct client_state + */ + if ((oc = lookup_option(&dhcpv6_universe, *op, + D6O_CLIENTID)) == NULL) { +- if (!option_cache(&oc, &default_duid, NULL, clientid_option, ++ if (default_duid.len == 0 || ++ !option_cache(&oc, &default_duid, NULL, clientid_option, + MDL)) + log_fatal("Failure assembling a DUID."); + +diff -up dhcp-4.2.0-P1/client/dhclient.c.PPP dhcp-4.2.0-P1/client/dhclient.c +--- dhcp-4.2.0-P1/client/dhclient.c.PPP 2010-11-05 10:47:37.000000000 +0100 ++++ dhcp-4.2.0-P1/client/dhclient.c 2010-11-09 15:37:26.000000000 +0100 +@@ -911,8 +911,8 @@ main(int argc, char **argv) { + if (default_duid.buffer != NULL) + data_string_forget(&default_duid, MDL); + +- form_duid(&default_duid, MDL); +- write_duid(&default_duid); ++ if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS) ++ write_duid(&default_duid); + } + + for (ip = interfaces ; ip != NULL ; ip = ip->next) { +diff -up dhcp-4.2.0-P1/common/bpf.c.PPP dhcp-4.2.0-P1/common/bpf.c +--- dhcp-4.2.0-P1/common/bpf.c.PPP 2010-11-05 10:47:37.000000000 +0100 ++++ dhcp-4.2.0-P1/common/bpf.c 2010-11-09 15:42:42.000000000 +0100 +@@ -599,6 +599,22 @@ get_hw_addr(const char *name, struct har + memcpy(&hw->hbuf[1], LLADDR(sa), sa->sdl_alen); + break; + #endif /* IFT_FDDI */ ++#if defined(IFT_PPP) ++ case IFT_PPP: ++ if (local_family != AF_INET6) ++ log_fatal("Unsupported device type %d for \"%s\"", ++ sa->sdl_type, name); ++ hw->hlen = 0; ++ hw->hbuf[0] = HTYPE_RESERVED; ++ /* 0xdeadbeef should never occur on the wire, ++ * and is a signature that something went wrong. ++ */ ++ hw->hbuf[1] = 0xde; ++ hw->hbuf[2] = 0xad; ++ hw->hbuf[3] = 0xbe; ++ hw->hbuf[4] = 0xef; ++ break; ++#endif + default: + log_fatal("Unsupported device type %d for \"%s\"", + sa->sdl_type, name); +diff -up dhcp-4.2.0-P1/common/lpf.c.PPP dhcp-4.2.0-P1/common/lpf.c +--- dhcp-4.2.0-P1/common/lpf.c.PPP 2010-11-05 10:47:37.000000000 +0100 ++++ dhcp-4.2.0-P1/common/lpf.c 2010-11-09 15:45:40.000000000 +0100 +@@ -502,6 +502,22 @@ get_hw_addr(const char *name, struct har + hw->hbuf[0] = HTYPE_FDDI; + memcpy(&hw->hbuf[1], sa->sa_data, 16); + break; ++#if defined(ARPHRD_PPP) ++ case ARPHRD_PPP: ++ if (local_family != AF_INET6) ++ log_fatal("Unsupported device type %d for \"%s\"", ++ sa->sa_family, name); ++ hw->hlen = 0; ++ hw->hbuf[0] = HTYPE_RESERVED; ++ /* 0xdeadbeef should never occur on the wire, ++ * and is a signature that something went wrong. ++ */ ++ hw->hbuf[1] = 0xde; ++ hw->hbuf[2] = 0xad; ++ hw->hbuf[3] = 0xbe; ++ hw->hbuf[4] = 0xef; ++ break; ++#endif + default: + log_fatal("Unsupported device type %ld for \"%s\"", + (long int)sa->sa_family, name); +diff -up dhcp-4.2.0-P1/includes/dhcpd.h.PPP dhcp-4.2.0-P1/includes/dhcpd.h +--- dhcp-4.2.0-P1/includes/dhcpd.h.PPP 2010-11-05 10:47:37.000000000 +0100 ++++ dhcp-4.2.0-P1/includes/dhcpd.h 2010-11-09 15:46:58.000000000 +0100 +@@ -2733,7 +2733,7 @@ void dhcpv4_client_assignments(void); + void dhcpv6_client_assignments(void); + + /* dhc6.c */ +-void form_duid(struct data_string *duid, const char *file, int line); ++isc_result_t form_duid(struct data_string *duid, const char *file, int line); + void dhc6_lease_destroy(struct dhc6_lease **src, const char *file, int line); + void start_init6(struct client_state *client); + void start_info_request6(struct client_state *client); +diff -up dhcp-4.2.0-P1/includes/dhcp.h.PPP dhcp-4.2.0-P1/includes/dhcp.h +--- dhcp-4.2.0-P1/includes/dhcp.h.PPP 2010-11-05 10:47:37.000000000 +0100 ++++ dhcp-4.2.0-P1/includes/dhcp.h 2010-11-09 15:48:53.000000000 +0100 +@@ -80,6 +80,8 @@ struct dhcp_packet { + #define HTYPE_IEEE802 6 /* IEEE 802.2 Token Ring... */ + #define HTYPE_FDDI 8 /* FDDI... */ + ++#define HTYPE_RESERVED 0 /* RFC 5494 */ ++ + /* Magic cookie validating dhcp options field (and bootp vendor + extensions field). */ + #define DHCP_OPTIONS_COOKIE "\143\202\123\143" +diff -up dhcp-4.2.0-P1/server/dhcpv6.c.PPP dhcp-4.2.0-P1/server/dhcpv6.c +--- dhcp-4.2.0-P1/server/dhcpv6.c.PPP 2010-11-05 10:47:37.000000000 +0100 ++++ dhcp-4.2.0-P1/server/dhcpv6.c 2010-11-09 15:50:17.000000000 +0100 +@@ -300,6 +300,9 @@ generate_new_server_duid(void) { + if (p->hw_address.hlen > 0) { + break; + } ++ if (p->next == NULL && p->hw_address.hbuf[0] == HTYPE_RESERVED) { ++ log_error("Can not generate DUID from interfaces which do not have hardware addresses, please configure server-duid!"); ++ } + } + if (p == NULL) { + return ISC_R_UNEXPECTED; diff --git a/server/dhcp/files/dhcp-4.2.0-add_timeout_when_NULL.patch b/server/dhcp/files/dhcp-4.2.0-add_timeout_when_NULL.patch new file mode 100644 index 0000000000..4784d5a684 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-add_timeout_when_NULL.patch @@ -0,0 +1,14 @@ +diff -up dhcp-4.2.0/common/dispatch.c.dracut dhcp-4.2.0/common/dispatch.c +--- dhcp-4.2.0/common/dispatch.c.dracut 2010-06-01 19:29:59.000000000 +0200 ++++ dhcp-4.2.0/common/dispatch.c 2010-07-21 16:10:09.000000000 +0200 +@@ -189,6 +189,10 @@ void add_timeout (when, where, what, ref + isc_interval_t interval; + isc_time_t expires; + ++ if (when == NULL) { ++ return; ++ } ++ + /* See if this timeout supersedes an existing timeout. */ + t = (struct timeout *)0; + for (q = timeouts; q; q = q->next) { diff --git a/server/dhcp/files/dhcp-4.2.0-default-requested-options.patch b/server/dhcp/files/dhcp-4.2.0-default-requested-options.patch new file mode 100644 index 0000000000..fea8a4b99c --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-default-requested-options.patch @@ -0,0 +1,44 @@ +diff -up dhcp-4.2.0/client/clparse.c.requested dhcp-4.2.0/client/clparse.c +--- dhcp-4.2.0/client/clparse.c.requested 2010-07-21 13:29:05.000000000 +0200 ++++ dhcp-4.2.0/client/clparse.c 2010-07-21 13:50:29.000000000 +0200 +@@ -37,7 +37,7 @@ + + struct client_config top_level_config; + +-#define NUM_DEFAULT_REQUESTED_OPTS 9 ++#define NUM_DEFAULT_REQUESTED_OPTS 14 + struct option *default_requested_options[NUM_DEFAULT_REQUESTED_OPTS + 1]; + + static void parse_client_default_duid(struct parse *cfile); +@@ -111,6 +111,31 @@ isc_result_t read_client_conf () + option_code_hash_lookup(&default_requested_options[8], + dhcpv6_universe.code_hash, &code, 0, MDL); + ++ /* 10 */ ++ code = DHO_NIS_DOMAIN; ++ option_code_hash_lookup(&default_requested_options[9], ++ dhcp_universe.code_hash, &code, 0, MDL); ++ ++ /* 11 */ ++ code = DHO_NIS_SERVERS; ++ option_code_hash_lookup(&default_requested_options[10], ++ dhcp_universe.code_hash, &code, 0, MDL); ++ ++ /* 12 */ ++ code = DHO_NTP_SERVERS; ++ option_code_hash_lookup(&default_requested_options[11], ++ dhcp_universe.code_hash, &code, 0, MDL); ++ ++ /* 13 */ ++ code = DHO_INTERFACE_MTU; ++ option_code_hash_lookup(&default_requested_options[12], ++ dhcp_universe.code_hash, &code, 0, MDL); ++ ++ /* 14 */ ++ code = DHO_DOMAIN_SEARCH; ++ option_code_hash_lookup(&default_requested_options[13], ++ dhcp_universe.code_hash, &code, 0, MDL); ++ + for (code = 0 ; code < NUM_DEFAULT_REQUESTED_OPTS ; code++) { + if (default_requested_options[code] == NULL) + log_fatal("Unable to find option definition for " diff --git a/server/dhcp/files/dhcp-4.2.0-dhclient-decline-backoff.patch b/server/dhcp/files/dhcp-4.2.0-dhclient-decline-backoff.patch new file mode 100644 index 0000000000..81bec7bd47 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-dhclient-decline-backoff.patch @@ -0,0 +1,63 @@ +diff -up dhcp-4.2.0/client/dhclient.c.backoff dhcp-4.2.0/client/dhclient.c +--- dhcp-4.2.0/client/dhclient.c.backoff 2010-07-21 13:37:03.000000000 +0200 ++++ dhcp-4.2.0/client/dhclient.c 2010-07-21 13:38:31.000000000 +0200 +@@ -1208,6 +1208,8 @@ void state_init (cpp) + void *cpp; + { + struct client_state *client = cpp; ++ enum dhcp_state init_state = client->state; ++ struct timeval tv; + + ASSERT_STATE(state, S_INIT); + +@@ -1220,9 +1222,18 @@ void state_init (cpp) + client -> first_sending = cur_time; + client -> interval = client -> config -> initial_interval; + +- /* Add an immediate timeout to cause the first DHCPDISCOVER packet +- to go out. */ +- send_discover (client); ++ if (init_state != S_DECLINED) { ++ /* Add an immediate timeout to cause the first DHCPDISCOVER packet ++ to go out. */ ++ send_discover(client); ++ } else { ++ /* We've received an OFFER and it has been DECLINEd by dhclient-script. ++ * wait for a random time between 1 and backoff_cutoff seconds before ++ * trying again. */ ++ tv . tv_sec = cur_time + ((1 + (random() >> 2)) % client->config->backoff_cutoff); ++ tv . tv_usec = 0; ++ add_timeout(&tv, send_discover, client, 0, 0); ++ } + } + + /* +@@ -1501,6 +1512,7 @@ void bind_lease (client) + send_decline (client); + destroy_client_lease (client -> new); + client -> new = (struct client_lease *)0; ++ client -> state = S_DECLINED; + state_init (client); + return; + } +@@ -3711,6 +3723,7 @@ void client_location_changed () + case S_INIT: + case S_REBINDING: + case S_STOPPED: ++ case S_DECLINED: + break; + } + client -> state = S_INIT; +diff -up dhcp-4.2.0/includes/dhcpd.h.backoff dhcp-4.2.0/includes/dhcpd.h +--- dhcp-4.2.0/includes/dhcpd.h.backoff 2010-07-21 13:29:05.000000000 +0200 ++++ dhcp-4.2.0/includes/dhcpd.h 2010-07-21 13:38:31.000000000 +0200 +@@ -1056,7 +1056,8 @@ enum dhcp_state { + S_BOUND = 5, + S_RENEWING = 6, + S_REBINDING = 7, +- S_STOPPED = 8 ++ S_STOPPED = 8, ++ S_DECLINED = 9 + }; + + /* Authentication and BOOTP policy possibilities (not all values work diff --git a/server/dhcp/files/dhcp-4.2.0-errwarn-message.patch b/server/dhcp/files/dhcp-4.2.0-errwarn-message.patch new file mode 100644 index 0000000000..a0f70cd042 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-errwarn-message.patch @@ -0,0 +1,30 @@ +diff -up dhcp-4.2.0/omapip/errwarn.c.errwarn dhcp-4.2.0/omapip/errwarn.c +--- dhcp-4.2.0/omapip/errwarn.c.errwarn 2009-07-23 20:52:21.000000000 +0200 ++++ dhcp-4.2.0/omapip/errwarn.c 2010-07-21 13:23:47.000000000 +0200 +@@ -76,20 +76,13 @@ void log_fatal (const char * fmt, ... ) + + #if !defined (NOMINUM) + log_error ("%s", ""); +- log_error ("If you did not get this software from ftp.isc.org, please"); +- log_error ("get the latest from ftp.isc.org and install that before"); +- log_error ("requesting help."); ++ log_error ("This version of ISC DHCP is based on the release available"); ++ log_error ("on ftp.isc.org. Features have been added and other changes"); ++ log_error ("have been made to the base software release in order to make"); ++ log_error ("it work better with this distribution."); + log_error ("%s", ""); +- log_error ("If you did get this software from ftp.isc.org and have not"); +- log_error ("yet read the README, please read it before requesting help."); +- log_error ("If you intend to request help from the dhcp-server@isc.org"); +- log_error ("mailing list, please read the section on the README about"); +- log_error ("submitting bug reports and requests for help."); +- log_error ("%s", ""); +- log_error ("Please do not under any circumstances send requests for"); +- log_error ("help directly to the authors of this software - please"); +- log_error ("send them to the appropriate mailing list as described in"); +- log_error ("the README file."); ++ log_error ("Please report for this software via the Red Hat Bugzilla site:"); ++ log_error (" http://bugzilla.redhat.com"); + log_error ("%s", ""); + log_error ("exiting."); + #endif diff --git a/server/dhcp/files/dhcp-4.2.0-garbage-chars.patch b/server/dhcp/files/dhcp-4.2.0-garbage-chars.patch new file mode 100644 index 0000000000..118ff3fc1a --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-garbage-chars.patch @@ -0,0 +1,12 @@ +diff -up dhcp-4.2.0/common/tables.c.garbage dhcp-4.2.0/common/tables.c +--- dhcp-4.2.0/common/tables.c.garbage 2009-11-20 02:49:01.000000000 +0100 ++++ dhcp-4.2.0/common/tables.c 2010-07-21 14:40:56.000000000 +0200 +@@ -207,7 +207,7 @@ static struct option dhcp_options[] = { + { "netinfo-server-tag", "t", &dhcp_universe, 113, 1 }, + { "default-url", "t", &dhcp_universe, 114, 1 }, + { "subnet-selection", "I", &dhcp_universe, 118, 1 }, +- { "domain-search", "Dc", &dhcp_universe, 119, 1 }, ++ { "domain-search", "D", &dhcp_universe, 119, 1 }, + { "vivco", "Evendor-class.", &dhcp_universe, 124, 1 }, + { "vivso", "Evendor.", &dhcp_universe, 125, 1 }, + #if 0 diff --git a/server/dhcp/files/dhcp-4.2.0-honor-expired.patch b/server/dhcp/files/dhcp-4.2.0-honor-expired.patch new file mode 100644 index 0000000000..45eadfad80 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-honor-expired.patch @@ -0,0 +1,52 @@ +diff -up dhcp-4.2.0/client/dhc6.c.honor-expired dhcp-4.2.0/client/dhc6.c +--- dhcp-4.2.0/client/dhc6.c.honor-expired 2010-10-07 12:55:37.000000000 +0200 ++++ dhcp-4.2.0/client/dhc6.c 2010-10-07 12:56:43.000000000 +0200 +@@ -1405,6 +1405,35 @@ start_info_request6(struct client_state + go_daemon(); + } + ++/* Run through the addresses in lease and return true if there's any unexpired. ++ * Return false otherwise. ++ */ ++isc_boolean_t ++unexpired_address_in_lease(struct dhc6_lease *lease) ++{ ++ struct dhc6_ia *ia; ++ struct dhc6_addr *addr; ++ ++ if (lease == NULL) ++ return; ++ ++ for (ia = lease->bindings ; ia != NULL ; ia = ia->next) { ++ for (addr = ia->addrs ; addr != NULL ; addr = addr->next) { ++ if (addr->flags & DHC6_ADDR_EXPIRED) ++ continue; ++ ++ if (addr->starts + addr->max_life > cur_time) { ++ return ISC_TRUE; ++ } ++ } ++ } ++ ++ log_info("PRC: Previous lease is devoid of active addresses." ++ " Re-initializing."); ++ ++ return ISC_FALSE; ++} ++ + /* + * start_confirm6() kicks off an "init-reboot" version of the process, at + * startup to find out if old bindings are 'fair' and at runtime whenever +@@ -1417,8 +1446,10 @@ start_confirm6(struct client_state *clie + + /* If there is no active lease, there is nothing to check. */ + if ((client->active_lease == NULL) || +- !active_prefix(client) || +- client->active_lease->released) { ++ !active_prefix(client) || ++ client->active_lease->released || ++ !unexpired_address_in_lease(client->active_lease)) { ++ dhc6_lease_destroy(&client->active_lease, MDL); + start_init6(client); + return; + } diff --git a/server/dhcp/files/dhcp-4.2.0-inherit-leases.patch b/server/dhcp/files/dhcp-4.2.0-inherit-leases.patch new file mode 100644 index 0000000000..052f642594 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-inherit-leases.patch @@ -0,0 +1,34 @@ +diff -up dhcp-4.2.0/client/dhclient.c.inherit dhcp-4.2.0/client/dhclient.c +--- dhcp-4.2.0/client/dhclient.c.inherit 2010-07-21 14:33:44.000000000 +0200 ++++ dhcp-4.2.0/client/dhclient.c 2010-07-21 14:40:05.000000000 +0200 +@@ -2322,6 +2322,7 @@ void send_request (cpp) + { + struct client_state *client = cpp; + ++ int i; + int result; + int interval; + struct sockaddr_in destination; +@@ -2381,6 +2382,22 @@ void send_request (cpp) + /* Now do a preinit on the interface so that we can + discover a new address. */ + script_init (client, "PREINIT", (struct string_list *)0); ++ ++ /* Has an active lease */ ++ if (client -> interface -> addresses != NULL) { ++ for (i = 0; i < client -> interface -> address_count; i++) { ++ if (client -> active && ++ client -> active -> is_bootp && ++ client -> active -> expiry > cur_time && ++ client -> interface -> addresses[i].s_addr != 0 && ++ client -> active -> address.len == 4 && ++ memcpy (client -> active -> address.iabuf, &(client -> interface -> addresses[i]), 4) == 0) { ++ client_envadd (client, "", "keep_old_ip", "%s", "yes"); ++ break; ++ } ++ } ++ } ++ + if (client -> alias) + script_write_params (client, "alias_", + client -> alias); diff --git a/server/dhcp/files/dhcp-4.2.0-logpid.patch b/server/dhcp/files/dhcp-4.2.0-logpid.patch new file mode 100644 index 0000000000..c24adb14a9 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-logpid.patch @@ -0,0 +1,12 @@ +diff -up dhcp-4.2.0/client/dhclient.c.logpid dhcp-4.2.0/client/dhclient.c +--- dhcp-4.2.0/client/dhclient.c.logpid 2010-07-21 16:13:52.000000000 +0200 ++++ dhcp-4.2.0/client/dhclient.c 2010-07-21 16:16:51.000000000 +0200 +@@ -154,7 +154,7 @@ main(int argc, char **argv) { + else if (fd != -1) + close(fd); + +- openlog("dhclient", LOG_NDELAY, LOG_DAEMON); ++ openlog("dhclient", LOG_NDELAY | LOG_PID, LOG_DAEMON); + + #if !(defined(DEBUG) || defined(__CYGWIN32__)) + setlogmask(LOG_UPTO(LOG_INFO)); diff --git a/server/dhcp/files/dhcp-4.2.0-paths.patch b/server/dhcp/files/dhcp-4.2.0-paths.patch new file mode 100644 index 0000000000..54c7aba8e6 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-paths.patch @@ -0,0 +1,45 @@ +diff -up dhcp-4.2.0/includes/dhcpd.h.paths dhcp-4.2.0/includes/dhcpd.h +--- dhcp-4.2.0/includes/dhcpd.h.paths 2010-07-21 13:55:42.000000000 +0200 ++++ dhcp-4.2.0/includes/dhcpd.h 2010-07-21 14:29:57.000000000 +0200 +@@ -1390,15 +1390,15 @@ typedef unsigned char option_mask [16]; + #else /* !DEBUG */ + + #ifndef _PATH_DHCPD_CONF +-#define _PATH_DHCPD_CONF "/etc/dhcpd.conf" ++#define _PATH_DHCPD_CONF "/etc/dhcp/dhcpd.conf" + #endif /* DEBUG */ + + #ifndef _PATH_DHCPD_DB +-#define _PATH_DHCPD_DB LOCALSTATEDIR"/db/dhcpd.leases" ++#define _PATH_DHCPD_DB LOCALSTATEDIR"/dhcpd/dhcpd.leases" + #endif + + #ifndef _PATH_DHCPD6_DB +-#define _PATH_DHCPD6_DB LOCALSTATEDIR"/db/dhcpd6.leases" ++#define _PATH_DHCPD6_DB LOCALSTATEDIR"/dhcpd/dhcpd6.leases" + #endif + + #ifndef _PATH_DHCPD_PID +@@ -1412,7 +1412,7 @@ typedef unsigned char option_mask [16]; + #endif /* DEBUG */ + + #ifndef _PATH_DHCLIENT_CONF +-#define _PATH_DHCLIENT_CONF "/etc/dhclient.conf" ++#define _PATH_DHCLIENT_CONF "/etc/dhcp/dhclient.conf" + #endif + + #ifndef _PATH_DHCLIENT_SCRIPT +@@ -1428,11 +1428,11 @@ typedef unsigned char option_mask [16]; + #endif + + #ifndef _PATH_DHCLIENT_DB +-#define _PATH_DHCLIENT_DB LOCALSTATEDIR"/db/dhclient.leases" ++#define _PATH_DHCLIENT_DB LOCALSTATEDIR"/dhclient/dhclient.leases" + #endif + + #ifndef _PATH_DHCLIENT6_DB +-#define _PATH_DHCLIENT6_DB LOCALSTATEDIR"/db/dhclient6.leases" ++#define _PATH_DHCLIENT6_DB LOCALSTATEDIR"/dhclient/dhclient6.leases" + #endif + + #ifndef _PATH_RESOLV_CONF diff --git a/server/dhcp/files/dhcp-4.2.0-release-by-ifup.patch b/server/dhcp/files/dhcp-4.2.0-release-by-ifup.patch new file mode 100644 index 0000000000..1ad8213fb6 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-release-by-ifup.patch @@ -0,0 +1,85 @@ +diff -up dhcp-4.2.0/client/dhclient.c.ifup dhcp-4.2.0/client/dhclient.c +--- dhcp-4.2.0/client/dhclient.c.ifup 2010-07-21 13:30:10.000000000 +0200 ++++ dhcp-4.2.0/client/dhclient.c 2010-07-21 13:37:03.000000000 +0200 +@@ -497,9 +497,81 @@ main(int argc, char **argv) { + kill(oldpid, SIGTERM); + } + fclose(pidfd); ++ } else { ++ /* handle release for interfaces requested with Red Hat ++ * /sbin/ifup - pidfile will be /var/run/dhclient-$interface.pid ++ */ ++ ++ if ((path_dhclient_pid == NULL) || (*path_dhclient_pid == '\0')) ++ path_dhclient_pid = "/var/run/dhclient.pid"; ++ ++ char *new_path_dhclient_pid; ++ struct interface_info *ip; ++ int pdp_len = strlen(path_dhclient_pid), pfx, dpfx; ++ ++ /* find append point: beginning of any trailing '.pid' ++ * or '-$IF.pid' */ ++ for (pfx=pdp_len; (pfx >= 0) && (path_dhclient_pid[pfx] != '.') && (path_dhclient_pid[pfx] != '/'); pfx--); ++ if (pfx == -1) ++ pfx = pdp_len; ++ ++ if (path_dhclient_pid[pfx] == '/') ++ pfx += 1; ++ ++ for (dpfx=pfx; (dpfx >= 0) && (path_dhclient_pid[dpfx] != '-') && (path_dhclient_pid[dpfx] != '/'); dpfx--); ++ if ((dpfx > -1) && (path_dhclient_pid[dpfx] != '/')) ++ pfx = dpfx; ++ ++ for (ip = interfaces; ip; ip = ip->next) { ++ if (interfaces_requested && (ip->flags & (INTERFACE_REQUESTED)) && (ip->name != NULL)) { ++ int n_len = strlen(ip->name); ++ ++ new_path_dhclient_pid = (char*) malloc(pfx + n_len + 6); ++ strncpy(new_path_dhclient_pid, path_dhclient_pid, pfx); ++ sprintf(new_path_dhclient_pid + pfx, "-%s.pid", ip->name); ++ ++ if ((pidfd = fopen(new_path_dhclient_pid, "r")) != NULL) { ++ e = fscanf(pidfd, "%ld\n", &temp); ++ oldpid = (pid_t)temp; ++ ++ if (e != 0 && e != EOF) { ++ if (oldpid) { ++ if (kill(oldpid, SIGTERM) == 0) ++ unlink(path_dhclient_pid); ++ } ++ } ++ ++ fclose(pidfd); ++ } ++ ++ free(new_path_dhclient_pid); ++ } ++ } ++ } ++ } else { ++ FILE *pidfp = NULL; ++ long temp = 0; ++ pid_t dhcpid = 0; ++ int dhc_running = 0; ++ char procfn[256] = ""; ++ ++ if ((pidfp = fopen(path_dhclient_pid, "r")) != NULL) { ++ if ((fscanf(pidfp, "%ld", &temp)==1) && ((dhcpid=(pid_t)temp) > 0)) { ++ snprintf(procfn,256,"/proc/%u",dhcpid); ++ dhc_running = (access(procfn, F_OK) == 0); ++ } ++ ++ fclose(pidfp); ++ } ++ ++ if (dhc_running) { ++ log_fatal("dhclient(%u) is already running - exiting. ", dhcpid); ++ return(1); + } + } + ++ write_client_pid_file(); ++ + if (!quiet) { + log_info("%s %s", message, PACKAGE_VERSION); + log_info(copyright); diff --git a/server/dhcp/files/dhcp-4.2.0-sendDecline.patch b/server/dhcp/files/dhcp-4.2.0-sendDecline.patch new file mode 100644 index 0000000000..5f04b6b8aa --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-sendDecline.patch @@ -0,0 +1,233 @@ +diff -up dhcp-4.2.0/client/dhc6.c.sendDecline dhcp-4.2.0/client/dhc6.c +--- dhcp-4.2.0/client/dhc6.c.sendDecline 2009-11-20 02:48:58.000000000 +0100 ++++ dhcp-4.2.0/client/dhc6.c 2010-07-21 16:18:51.000000000 +0200 +@@ -95,6 +95,8 @@ void do_select6(void *input); + void do_refresh6(void *input); + static void do_release6(void *input); + static void start_bound(struct client_state *client); ++static void start_decline6(struct client_state *client); ++static void do_decline6(void *input); + static void start_informed(struct client_state *client); + void informed_handler(struct packet *packet, struct client_state *client); + void bound_handler(struct packet *packet, struct client_state *client); +@@ -2140,6 +2142,7 @@ start_release6(struct client_state *clie + cancel_timeout(do_select6, client); + cancel_timeout(do_refresh6, client); + cancel_timeout(do_release6, client); ++ cancel_timeout(do_decline6, client); + client->state = S_STOPPED; + + /* +@@ -2790,6 +2793,7 @@ dhc6_check_reply(struct client_state *cl + break; + + case S_STOPPED: ++ case S_DECLINED: + action = dhc6_stop_action; + break; + +@@ -2891,6 +2895,7 @@ dhc6_check_reply(struct client_state *cl + break; + + case S_STOPPED: ++ case S_DECLINED: + /* Nothing critical to do at this stage. */ + break; + +@@ -3933,17 +3938,23 @@ reply_handler(struct packet *packet, str + cancel_timeout(do_select6, client); + cancel_timeout(do_refresh6, client); + cancel_timeout(do_release6, client); ++ cancel_timeout(do_decline6, client); + + /* If this is in response to a Release/Decline, clean up and return. */ +- if (client->state == S_STOPPED) { +- if (client->active_lease == NULL) +- return; ++ if ((client->state == S_STOPPED) || ++ (client->state == S_DECLINED)) { ++ ++ if (client->active_lease != NULL) { ++ dhc6_lease_destroy(&client->active_lease, MDL); ++ client->active_lease = NULL; ++ /* We should never wait for nothing!? */ ++ if (stopping_finished()) ++ exit(0); ++ } ++ ++ if (client->state == S_DECLINED) ++ start_init6(client); + +- dhc6_lease_destroy(&client->active_lease, MDL); +- client->active_lease = NULL; +- /* We should never wait for nothing!? */ +- if (stopping_finished()) +- exit(0); + return; + } + +@@ -4470,7 +4481,11 @@ start_bound(struct client_state *client) + oldia, oldaddr); + dhc6_marshall_values("new_", client, lease, ia, addr); + +- script_go(client); ++ // when script returns 3, DAD failed ++ if (script_go(client) == 3) { ++ start_decline6(client); ++ return; ++ } + } + + /* XXX: maybe we should loop on the old values instead? */ +@@ -4516,6 +4531,151 @@ start_bound(struct client_state *client) + dhc6_check_times(client); + } + ++/* ++ * Decline addresses. ++ */ ++void ++start_decline6(struct client_state *client) ++{ ++ /* Cancel any pending transmissions */ ++ cancel_timeout(do_confirm6, client); ++ cancel_timeout(do_select6, client); ++ cancel_timeout(do_refresh6, client); ++ cancel_timeout(do_release6, client); ++ cancel_timeout(do_decline6, client); ++ client->state = S_DECLINED; ++ ++ if (client->active_lease == NULL) ++ return; ++ ++ /* Set timers per RFC3315 section 18.1.7. */ ++ client->IRT = DEC_TIMEOUT * 100; ++ client->MRT = 0; ++ client->MRC = DEC_MAX_RC; ++ client->MRD = 0; ++ ++ dhc6_retrans_init(client); ++ client->v6_handler = reply_handler; ++ ++ client->refresh_type = DHCPV6_DECLINE; ++ do_decline6(client); ++} ++ ++/* ++ * do_decline6() creates a Decline packet and transmits it. ++ */ ++static void ++do_decline6(void *input) ++{ ++ struct client_state *client; ++ struct data_string ds; ++ int send_ret; ++ struct timeval elapsed, tv; ++ ++ client = input; ++ ++ if ((client->active_lease == NULL) || !active_prefix(client)) ++ return; ++ ++ if ((client->MRC != 0) && (client->txcount > client->MRC)) { ++ log_info("Max retransmission count exceeded."); ++ goto decline_done; ++ } ++ ++ /* ++ * Start_time starts at the first transmission. ++ */ ++ if (client->txcount == 0) { ++ client->start_time.tv_sec = cur_tv.tv_sec; ++ client->start_time.tv_usec = cur_tv.tv_usec; ++ } ++ ++ /* elapsed = cur - start */ ++ elapsed.tv_sec = cur_tv.tv_sec - client->start_time.tv_sec; ++ elapsed.tv_usec = cur_tv.tv_usec - client->start_time.tv_usec; ++ if (elapsed.tv_usec < 0) { ++ elapsed.tv_sec -= 1; ++ elapsed.tv_usec += 1000000; ++ } ++ ++ memset(&ds, 0, sizeof(ds)); ++ if (!buffer_allocate(&ds.buffer, 4, MDL)) { ++ log_error("Unable to allocate memory for Decline."); ++ goto decline_done; ++ } ++ ++ ds.data = ds.buffer->data; ++ ds.len = 4; ++ ds.buffer->data[0] = DHCPV6_DECLINE; ++ memcpy(ds.buffer->data + 1, client->dhcpv6_transaction_id, 3); ++ ++ /* Form an elapsed option. */ ++ /* Maximum value is 65535 1/100s coded as 0xffff. */ ++ if ((elapsed.tv_sec < 0) || (elapsed.tv_sec > 655) || ++ ((elapsed.tv_sec == 655) && (elapsed.tv_usec > 350000))) { ++ client->elapsed = 0xffff; ++ } else { ++ client->elapsed = elapsed.tv_sec * 100; ++ client->elapsed += elapsed.tv_usec / 10000; ++ } ++ ++ client->elapsed = htons(client->elapsed); ++ ++ log_debug("XMT: Forming Decline."); ++ make_client6_options(client, &client->sent_options, ++ client->active_lease, DHCPV6_DECLINE); ++ dhcpv6_universe.encapsulate(&ds, NULL, NULL, client, NULL, ++ client->sent_options, &global_scope, ++ &dhcpv6_universe); ++ ++ /* Append IA's (but don't release temporary addresses). */ ++ if (wanted_ia_na && ++ dhc6_add_ia_na(client, &ds, client->active_lease, ++ DHCPV6_DECLINE) != ISC_R_SUCCESS) { ++ data_string_forget(&ds, MDL); ++ goto decline_done; ++ } ++ if (wanted_ia_pd && ++ dhc6_add_ia_pd(client, &ds, client->active_lease, ++ DHCPV6_DECLINE) != ISC_R_SUCCESS) { ++ data_string_forget(&ds, MDL); ++ goto decline_done; ++ } ++ ++ /* Transmit and wait. */ ++ log_info("XMT: Decline on %s, interval %ld0ms.", ++ client->name ? client->name : client->interface->name, ++ (long int)client->RT); ++ ++ send_ret = send_packet6(client->interface, ds.data, ds.len, ++ &DHCPv6DestAddr); ++ if (send_ret != ds.len) { ++ log_error("dhc6: sendpacket6() sent %d of %d bytes", ++ send_ret, ds.len); ++ } ++ ++ data_string_forget(&ds, MDL); ++ ++ /* Wait RT */ ++ tv.tv_sec = cur_tv.tv_sec + client->RT / 100; ++ tv.tv_usec = cur_tv.tv_usec + (client->RT % 100) * 10000; ++ if (tv.tv_usec >= 1000000) { ++ tv.tv_sec += 1; ++ tv.tv_usec -= 1000000; ++ } ++ add_timeout(&tv, do_decline6, client, NULL, NULL); ++ dhc6_retrans_advance(client); ++ return; ++ ++decline_done: ++ if (client->active_lease != NULL) { ++ dhc6_lease_destroy(&client->active_lease, MDL); ++ client->active_lease = NULL; ++ } ++ start_init6(client); ++ return; ++} ++ + /* While bound, ignore packets. In the future we'll want to answer + * Reconfigure-Request messages and the like. + */ diff --git a/server/dhcp/files/dhcp-4.2.0-unicast-bootp.patch b/server/dhcp/files/dhcp-4.2.0-unicast-bootp.patch new file mode 100644 index 0000000000..78bc078dcf --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.0-unicast-bootp.patch @@ -0,0 +1,99 @@ +diff -up dhcp-4.2.0/server/bootp.c.unicast dhcp-4.2.0/server/bootp.c +--- dhcp-4.2.0/server/bootp.c.unicast 2009-11-20 02:49:03.000000000 +0100 ++++ dhcp-4.2.0/server/bootp.c 2010-07-21 13:40:25.000000000 +0200 +@@ -58,6 +58,7 @@ void bootp (packet) + char msgbuf [1024]; + int ignorep; + int peer_has_leases = 0; ++ int norelay = 0; + + if (packet -> raw -> op != BOOTREQUEST) + return; +@@ -73,7 +74,7 @@ void bootp (packet) + ? inet_ntoa (packet -> raw -> giaddr) + : packet -> interface -> name); + +- if (!locate_network (packet)) { ++ if ((norelay = locate_network (packet)) == 0) { + log_info ("%s: network unknown", msgbuf); + return; + } +@@ -390,6 +391,13 @@ void bootp (packet) + from, &to, &hto); + goto out; + } ++ } else if (norelay == 2) { ++ to.sin_addr = raw.ciaddr; ++ to.sin_port = remote_port; ++ if (fallback_interface) { ++ result = send_packet (fallback_interface, (struct packet *)0, &raw, outgoing.packet_length, from, &to, &hto); ++ goto out; ++ } + + /* If it comes from a client that already knows its address + and is not requesting a broadcast response, and we can +diff -up dhcp-4.2.0/server/dhcp.c.unicast dhcp-4.2.0/server/dhcp.c +--- dhcp-4.2.0/server/dhcp.c.unicast 2010-06-01 19:29:59.000000000 +0200 ++++ dhcp-4.2.0/server/dhcp.c 2010-07-21 13:40:25.000000000 +0200 +@@ -4185,6 +4185,7 @@ int locate_network (packet) + struct data_string data; + struct subnet *subnet = (struct subnet *)0; + struct option_cache *oc; ++ int norelay = 0; + + /* See if there's a Relay Agent Link Selection Option, or a + * Subnet Selection Option. The Link-Select and Subnet-Select +@@ -4200,12 +4201,24 @@ int locate_network (packet) + from the interface, if there is one. If not, fail. */ + if (!oc && !packet -> raw -> giaddr.s_addr) { + if (packet -> interface -> shared_network) { +- shared_network_reference +- (&packet -> shared_network, +- packet -> interface -> shared_network, MDL); +- return 1; ++ struct in_addr any_addr; ++ any_addr.s_addr = INADDR_ANY; ++ ++ if (!packet -> packet_type && memcmp(&packet -> raw -> ciaddr, &any_addr, 4)) { ++ struct iaddr cip; ++ memcpy(cip.iabuf, &packet -> raw -> ciaddr, 4); ++ cip.len = 4; ++ if (!find_grouped_subnet(&subnet, packet->interface->shared_network, cip, MDL)) ++ norelay = 2; ++ } ++ ++ if (!norelay) { ++ shared_network_reference(&packet -> shared_network, packet -> interface -> shared_network, MDL); ++ return 1; ++ } ++ } else { ++ return 0; + } +- return 0; + } + + /* If there's an option indicating link connection, and it's valid, +@@ -4228,7 +4241,10 @@ int locate_network (packet) + data_string_forget (&data, MDL); + } else { + ia.len = 4; +- memcpy (ia.iabuf, &packet -> raw -> giaddr, 4); ++ if (norelay) ++ memcpy (ia.iabuf, &packet->raw->ciaddr, 4); ++ else ++ memcpy (ia.iabuf, &packet->raw->giaddr, 4); + } + + /* If we know the subnet on which the IP address lives, use it. */ +@@ -4236,7 +4252,10 @@ int locate_network (packet) + shared_network_reference (&packet -> shared_network, + subnet -> shared_network, MDL); + subnet_dereference (&subnet, MDL); +- return 1; ++ if (norelay) ++ return norelay; ++ else ++ return 1; + } + + /* Otherwise, fail. */ diff --git a/server/dhcp/files/dhcp-4.2.1-retransmission.patch b/server/dhcp/files/dhcp-4.2.1-retransmission.patch new file mode 100644 index 0000000000..18e447f6a3 --- /dev/null +++ b/server/dhcp/files/dhcp-4.2.1-retransmission.patch @@ -0,0 +1,48 @@ +diff -up dhcp-4.2.1b1/client/dhc6.c.retransmission dhcp-4.2.1b1/client/dhc6.c +--- dhcp-4.2.1b1/client/dhc6.c.retransmission 2011-01-28 08:40:56.000000000 +0100 ++++ dhcp-4.2.1b1/client/dhc6.c 2011-01-28 08:39:22.000000000 +0100 +@@ -361,7 +361,7 @@ dhc6_retrans_init(struct client_state *c + static void + dhc6_retrans_advance(struct client_state *client) + { +- struct timeval elapsed; ++ struct timeval elapsed, elapsed_after_RT; + + /* elapsed = cur - start */ + elapsed.tv_sec = cur_tv.tv_sec - client->start_time.tv_sec; +@@ -378,6 +378,8 @@ dhc6_retrans_advance(struct client_state + elapsed.tv_sec += 1; + elapsed.tv_usec -= 1000000; + } ++ elapsed_after_RT.tv_sec = elapsed.tv_sec; ++ elapsed_after_RT.tv_usec = elapsed.tv_usec; + + /* + * RT for each subsequent message transmission is based on the previous +@@ -415,13 +417,10 @@ dhc6_retrans_advance(struct client_state + elapsed.tv_usec -= 1000000; + } + if (elapsed.tv_sec >= client->MRD) { +- /* +- * wake at RT + cur = start + MRD +- */ +- client->RT = client->MRD + +- (client->start_time.tv_sec - cur_tv.tv_sec); +- client->RT = client->RT * 100 + +- (client->start_time.tv_usec - cur_tv.tv_usec) / 10000; ++ client->RT = client->MRD - elapsed_after_RT.tv_sec; ++ client->RT = client->RT * 100 - elapsed_after_RT.tv_usec / 10000; ++ if (client->RT < 0) ++ client->RT = 0; + } + client->txcount++; + } +@@ -1497,7 +1496,7 @@ check_timing6 (struct client_state *clie + } + + /* Check if finished (-1 argument). */ +- if ((client->MRD != 0) && (elapsed.tv_sec > client->MRD)) { ++ if ((client->MRD != 0) && (elapsed.tv_sec >= client->MRD)) { + log_info("Max retransmission duration exceeded."); + return(CHK_TIM_MRD_EXCEEDED); + } diff --git a/server/dhcp/files/dhcp-4.3.0a1-PPP.patch b/server/dhcp/files/dhcp-4.3.0a1-PPP.patch new file mode 100644 index 0000000000..7c349fa9b8 --- /dev/null +++ b/server/dhcp/files/dhcp-4.3.0a1-PPP.patch @@ -0,0 +1,150 @@ +diff -up dhcp-4.3.0a1/client/dhc6.c.PPP dhcp-4.3.0a1/client/dhc6.c +--- dhcp-4.3.0a1/client/dhc6.c.PPP 2013-12-19 16:16:45.925550229 +0100 ++++ dhcp-4.3.0a1/client/dhc6.c 2013-12-19 16:16:45.930550159 +0100 +@@ -5080,7 +5080,8 @@ make_client6_options(struct client_state + */ + if ((oc = lookup_option(&dhcpv6_universe, *op, + D6O_CLIENTID)) == NULL) { +- if (!option_cache(&oc, &default_duid, NULL, clientid_option, ++ if (default_duid.len == 0 || ++ !option_cache(&oc, &default_duid, NULL, clientid_option, + MDL)) + log_fatal("Failure assembling a DUID."); + +diff -up dhcp-4.3.0a1/client/dhclient.c.PPP dhcp-4.3.0a1/client/dhclient.c +--- dhcp-4.3.0a1/client/dhclient.c.PPP 2013-12-19 16:16:45.932550131 +0100 ++++ dhcp-4.3.0a1/client/dhclient.c 2013-12-19 16:27:38.334473958 +0100 +@@ -926,8 +926,8 @@ main(int argc, char **argv) { + if (default_duid.buffer != NULL) + data_string_forget(&default_duid, MDL); + +- form_duid(&default_duid, MDL); +- write_duid(&default_duid); ++ if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS) ++ write_duid(&default_duid); + } + } + +@@ -3225,7 +3225,7 @@ write_options(struct client_state *clien + * is not how it is intended. Upcoming rearchitecting the client should + * address this "one daemon model." + */ +-void ++isc_result_t + form_duid(struct data_string *duid, const char *file, int line) + { + struct interface_info *ip; +@@ -3237,6 +3237,15 @@ form_duid(struct data_string *duid, cons + if (ip == NULL) + log_fatal("Impossible condition at %s:%d.", MDL); + ++ while (ip && ip->hw_address.hbuf[0] == HTYPE_RESERVED) { ++ /* Try the other interfaces */ ++ log_debug("Cannot form default DUID from interface %s.", ip->name); ++ ip = ip->next; ++ } ++ if (ip == NULL) { ++ return ISC_R_UNEXPECTED; ++ } ++ + if ((ip->hw_address.hlen == 0) || + (ip->hw_address.hlen > sizeof(ip->hw_address.hbuf))) + log_fatal("Impossible hardware address length at %s:%d.", MDL); +@@ -3272,6 +3281,8 @@ form_duid(struct data_string *duid, cons + memcpy(duid->buffer->data + 4, ip->hw_address.hbuf + 1, + ip->hw_address.hlen - 1); + } ++ ++ return ISC_R_SUCCESS; + } + + /* Write the default DUID to the lease store. */ +diff -up dhcp-4.3.0a1/common/bpf.c.PPP dhcp-4.3.0a1/common/bpf.c +--- dhcp-4.3.0a1/common/bpf.c.PPP 2013-12-19 16:16:45.868551024 +0100 ++++ dhcp-4.3.0a1/common/bpf.c 2013-12-19 16:16:45.934550103 +0100 +@@ -602,6 +602,22 @@ get_hw_addr(const char *name, struct har + memcpy(&hw->hbuf[1], LLADDR(sa), sa->sdl_alen); + break; + #endif /* IFT_FDDI */ ++#if defined(IFT_PPP) ++ case IFT_PPP: ++ if (local_family != AF_INET6) ++ log_fatal("Unsupported device type %d for \"%s\"", ++ sa->sdl_type, name); ++ hw->hlen = 0; ++ hw->hbuf[0] = HTYPE_RESERVED; ++ /* 0xdeadbeef should never occur on the wire, ++ * and is a signature that something went wrong. ++ */ ++ hw->hbuf[1] = 0xde; ++ hw->hbuf[2] = 0xad; ++ hw->hbuf[3] = 0xbe; ++ hw->hbuf[4] = 0xef; ++ break; ++#endif + default: + log_fatal("Unsupported device type %d for \"%s\"", + sa->sdl_type, name); +diff -up dhcp-4.3.0a1/common/lpf.c.PPP dhcp-4.3.0a1/common/lpf.c +--- dhcp-4.3.0a1/common/lpf.c.PPP 2013-12-19 16:16:45.848551303 +0100 ++++ dhcp-4.3.0a1/common/lpf.c 2013-12-19 16:16:45.934550103 +0100 +@@ -511,6 +511,22 @@ get_hw_addr(const char *name, struct har + hw->hbuf[0] = HTYPE_FDDI; + memcpy(&hw->hbuf[1], sa->sa_data, 6); + break; ++#if defined(ARPHRD_PPP) ++ case ARPHRD_PPP: ++ if (local_family != AF_INET6) ++ log_fatal("Unsupported device type %d for \"%s\"", ++ sa->sa_family, name); ++ hw->hlen = 0; ++ hw->hbuf[0] = HTYPE_RESERVED; ++ /* 0xdeadbeef should never occur on the wire, ++ * and is a signature that something went wrong. ++ */ ++ hw->hbuf[1] = 0xde; ++ hw->hbuf[2] = 0xad; ++ hw->hbuf[3] = 0xbe; ++ hw->hbuf[4] = 0xef; ++ break; ++#endif + default: + log_fatal("Unsupported device type %ld for \"%s\"", + (long int)sa->sa_family, name); +diff -up dhcp-4.3.0a1/includes/dhcp.h.PPP dhcp-4.3.0a1/includes/dhcp.h +--- dhcp-4.3.0a1/includes/dhcp.h.PPP 2013-12-19 16:16:45.919550313 +0100 ++++ dhcp-4.3.0a1/includes/dhcp.h 2013-12-19 16:16:45.936550076 +0100 +@@ -85,6 +85,8 @@ struct dhcp_packet { + * is no standard for this so we + * just steal a type */ + ++#define HTYPE_RESERVED 0 /* RFC 5494 */ ++ + /* Magic cookie validating dhcp options field (and bootp vendor + extensions field). */ + #define DHCP_OPTIONS_COOKIE "\143\202\123\143" +diff -up dhcp-4.3.0a1/includes/dhcpd.h.PPP dhcp-4.3.0a1/includes/dhcpd.h +--- dhcp-4.3.0a1/includes/dhcpd.h.PPP 2013-12-19 16:16:45.935550090 +0100 ++++ dhcp-4.3.0a1/includes/dhcpd.h 2013-12-19 16:28:33.468709007 +0100 +@@ -2824,7 +2824,7 @@ void client_dns_remove(struct client_sta + + void dhcpv4_client_assignments(void); + void dhcpv6_client_assignments(void); +-void form_duid(struct data_string *duid, const char *file, int line); ++isc_result_t form_duid(struct data_string *duid, const char *file, int line); + + /* dhc6.c */ + void dhc6_lease_destroy(struct dhc6_lease **src, const char *file, int line); +diff -up dhcp-4.3.0a1/server/dhcpv6.c.PPP dhcp-4.3.0a1/server/dhcpv6.c +--- dhcp-4.3.0a1/server/dhcpv6.c.PPP 2013-12-19 16:16:45.901550564 +0100 ++++ dhcp-4.3.0a1/server/dhcpv6.c 2013-12-19 16:16:45.937550062 +0100 +@@ -307,6 +307,9 @@ generate_new_server_duid(void) { + if (p->hw_address.hlen > 0) { + break; + } ++ if (p->next == NULL && p->hw_address.hbuf[0] == HTYPE_RESERVED) { ++ log_error("Can not generate DUID from interfaces which do not have hardware addresses, please configure server-duid!"); ++ } + } + if (p == NULL) { + return ISC_R_UNEXPECTED; \ No newline at end of file diff --git a/server/dhcp/files/dhcp-4.3.0a1-errwarn-message.patch b/server/dhcp/files/dhcp-4.3.0a1-errwarn-message.patch new file mode 100644 index 0000000000..223f1a9bc8 --- /dev/null +++ b/server/dhcp/files/dhcp-4.3.0a1-errwarn-message.patch @@ -0,0 +1,30 @@ +diff -up dhcp-4.3.0a1/omapip/errwarn.c.errwarn dhcp-4.3.0a1/omapip/errwarn.c +--- dhcp-4.3.0a1/omapip/errwarn.c.errwarn 2012-07-11 22:46:29.000000000 +0200 ++++ dhcp-4.3.0a1/omapip/errwarn.c 2013-12-19 15:09:17.857125042 +0100 +@@ -76,20 +76,13 @@ void log_fatal (const char * fmt, ... ) + + #if !defined (NOMINUM) + log_error ("%s", ""); +- log_error ("If you did not get this software from ftp.isc.org, please"); +- log_error ("get the latest from ftp.isc.org and install that before"); +- log_error ("requesting help."); ++ log_error ("This version of ISC DHCP is based on the release available"); ++ log_error ("on ftp.isc.org. Features have been added and other changes"); ++ log_error ("have been made to the base software release in order to make"); ++ log_error ("it work better with this distribution."); + log_error ("%s", ""); +- log_error ("If you did get this software from ftp.isc.org and have not"); +- log_error ("yet read the README, please read it before requesting help."); +- log_error ("If you intend to request help from the dhcp-server@isc.org"); +- log_error ("mailing list, please read the section on the README about"); +- log_error ("submitting bug reports and requests for help."); +- log_error ("%s", ""); +- log_error ("Please do not under any circumstances send requests for"); +- log_error ("help directly to the authors of this software - please"); +- log_error ("send them to the appropriate mailing list as described in"); +- log_error ("the README file."); ++ log_error ("Please report for this software via the Red Hat Bugzilla site:"); ++ log_error (" http://bugzilla.redhat.com"); + log_error ("%s", ""); + log_error ("exiting."); + #endif \ No newline at end of file diff --git a/server/dhcp/files/dhcpd b/server/dhcp/files/dhcpd new file mode 100644 index 0000000000..2af815e3e3 --- /dev/null +++ b/server/dhcp/files/dhcpd @@ -0,0 +1,15 @@ +# DHCP Server Configuration file for Pisi Linux + +# Specify a configuration file - the default is /etc/dhcp/dhcpd.conf +DHCPD_CONF="/etc/dhcp/dhcpd.conf" + +# Configure which interface or interfaces to for dhcpd to listen on. +# List all interfaces space separated. If this is not specified then +# we listen on all interfaces. +INTERFACES="" + +# Insert any other dhcpd options - see the man page for a full list. +DHCPD_ARGS="" + +# Wait for interfaces being up (in seconds.) +TIMEOUT=10 diff --git a/server/dhcp/files/dhcpd.conf b/server/dhcp/files/dhcpd.conf new file mode 100644 index 0000000000..d1449ba360 --- /dev/null +++ b/server/dhcp/files/dhcpd.conf @@ -0,0 +1,31 @@ +# DHCP Server Configuration file. +# see /usr/share/doc/dhcp/dhcpd.conf.sample +# see 'man 5 dhcpd.conf' +# +############################################# +# ddns-update-style none; +# +# default-lease-time 21600; +# max-lease-time 21600; +# +# option subnet-mask 255.255.255.0; +# option broadcast-address 10.0.0.255; +# option routers 10.0.0.1; +# option domain-name-servers 10.0.0.1; +# option domain-name "pisilinux"; +# +# next-server 10.0.0.1; +# get-lease-hostnames on; +# +# option root-path "10.0.0.1:/opt/ptsp"; +# +# subnet 10.0.0.0 netmask 255.255.255.0 { +# range 10.0.0.1 10.0.0.99; + + #Send this file for pxe file requests + #filename "/pts/latest-ptsp/pxelinux.0"; +# } +# host AccessPoint { +# hardware ethernet XX:XX:XX:XX:XX:XX; +# fixed-address 10.0.0.120; +#} diff --git a/server/dhcp/files/dhcpd6 b/server/dhcp/files/dhcpd6 new file mode 100644 index 0000000000..b769b9d3a6 --- /dev/null +++ b/server/dhcp/files/dhcpd6 @@ -0,0 +1,15 @@ +# DHCPv6 Server Configuration file for Pisi Linux + +# Specify a configuration file - the default is /etc/dhcp/dhcpd.conf +DHCPD_CONF="/etc/dhcp/dhcpd.conf" + +# Configure which interface or interfaces to for dhcpd to listen on. +# List all interfaces space separated. If this is not specified then +# we listen on all interfaces. +INTERFACES="" + +# Insert any other dhcpd options - see the man page for a full list. +DHCPD_ARGS="" + +# Wait for interfaces being up (in seconds.) +TIMEOUT=10 diff --git a/server/dhcp/files/dhcpd6.conf b/server/dhcp/files/dhcpd6.conf new file mode 100644 index 0000000000..6bfb59fbef --- /dev/null +++ b/server/dhcp/files/dhcpd6.conf @@ -0,0 +1,32 @@ +# DHCP for IPv6 Server Configuration file. +# see /usr/share/doc/dhcp/dhcpd6.conf.sample +# see 'man 5 dhcpd.conf' +# run 'service dhcpd6 start' or 'dhcpd -6 -cf /etc/dhcp/dhcpd6.conf' +# +############################################# +# ddns-update-style none; +# +# default-lease-time 21600; +# max-lease-time 21600; +# +# option subnet-mask 255.255.255.0; +# option broadcast-address 10.0.0.255; +# option routers 10.0.0.1; +# option domain-name-servers 10.0.0.1; +# option domain-name "pisilinux"; +# +# next-server 10.0.0.1; +# get-lease-hostnames on; +# +# option root-path "10.0.0.1:/opt/ptsp"; +# +# subnet 10.0.0.0 netmask 255.255.255.0 { +# range 10.0.0.1 10.0.0.99; + + #Send this file for pxe file requests + #filename "/pts/latest-ptsp/pxelinux.0"; +# } +# host AccessPoint { +# hardware ethernet XX:XX:XX:XX:XX:XX; +# fixed-address 10.0.0.120; +#} diff --git a/server/dhcp/files/dhcrelay b/server/dhcp/files/dhcrelay new file mode 100644 index 0000000000..19d6b75087 --- /dev/null +++ b/server/dhcp/files/dhcrelay @@ -0,0 +1,14 @@ +# DHCP Relay Server Configuration file for Pisi Linux + +# Configure which interface or interfaces to for dhcpd to listen on. +# List all interfaces space separated. If this is not specified then +# we listen on all interfaces. +# +# DHCPv4 only +INTERFACES="" + +#DHCPv4 only +DHCP_SERVERS="" + +# Insert any other dhcpd options - see the man page for a full list. +DHCRELAY_ARGS="" diff --git a/server/dhcp/pspec.xml b/server/dhcp/pspec.xml new file mode 100644 index 0000000000..f423e13bf6 --- /dev/null +++ b/server/dhcp/pspec.xml @@ -0,0 +1,151 @@ + + + + + dhcp + http://www.isc.org/products/DHCP + + PisiLinux Community + admins@pisilinux.org + + isc-dhcp + app:console + library + service + Dynamic host configuration protocol software + DHCP (Dynamic Host Configuration Protocol) is a protocol which allows individual devices on an IP network to get their own network configuration information (IP address, subnetmask, broadcast address, etc.) from a DHCP server. + http://ftp.isc.org/isc/dhcp/4.3.0/dhcp-4.3.0.tar.gz + + groff + openldap-client + bind-devel + + + + + + dhcp-4.2.0-release-by-ifup.patch + dhcp-4.2.0-dhclient-decline-backoff.patch + dhcp-4.2.0-unicast-bootp.patch + + dhcp-4.2.0-default-requested-options.patch + + dhcp-4.2.0-paths.patch + + dhcp-4.2.0-inherit-leases.patch + dhcp-4.2.0-garbage-chars.patch + + dhcp-4.2.0-IFNAMSIZ.patch + dhcp-4.2.0-add_timeout_when_NULL.patch + + dhcp-4.2.0-logpid.patch + dhcp-4.2.0-sendDecline.patch + dhcp-4.2.1-retransmission.patch + + dhcp-4.2.0-honor-expired.patch + + + dhcp-4.3.0a1-PPP.patch + dhcp-4.2.0-P2-omapi.patch + + + + + + dhcp + + openldap-client + bind-libs + + + /etc + /usr/bin + /usr/sbin + /usr/lib + /var/lib + /run + /usr/share/man + /usr/share/doc + + + dhcpd + dhcpd6 + dhcrelay + dhcpd.conf + + + + System.Service + System.Service + System.Service + System.Package + + + + + dhclient + app:console + Provides the dhclient ISC DHCP client daemon + + dhcp + bind-libs + + + + /etc/dhcp/dhclient.conf + /usr/sbin/dhclient + + /var/lib/dhclient + /usr/share/man/man5/dhclient* + /usr/share/man/man8/dhclient* + /usr/share/man/man5/dhcp-options* + /usr/share/man/man5/dhcp-eval* + /usr/share/doc/dhcp/dhclient* + + + dhclient.conf + + + + + + + dhcp-devel + Development files for dhcp + + dhcp + + + /usr/include + /usr/share/man/man3 + + + + + + 2014-05-19 + 4.3.0 + Version Bump + Vedat Demir + vedat@pisilinux.org + + + 2014-01-22 + 4.2.5 + Version Bump + Stefan Gronewold(groni) + groni@pisilinux.org + + + 2012-10-14 + 4.2.3 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/server/dhcp/translations.xml b/server/dhcp/translations.xml new file mode 100644 index 0000000000..281f1fff7d --- /dev/null +++ b/server/dhcp/translations.xml @@ -0,0 +1,19 @@ + + + + dhcp + DHCP Sunucusu + IP adresi atanmasını ve TCP/IP bilgilerinin yapılandırılmasını sağlayan DHCP Sunucusu + DHCP-Server + + + + dhclient + DHCP İstemcisi + + + + dhcp-devel + dhcp için geliştirme dosyaları + + diff --git a/system/base/ConsoleKit/actions.py b/system/base/ConsoleKit/actions.py new file mode 100644 index 0000000000..4f5729a93b --- /dev/null +++ b/system/base/ConsoleKit/actions.py @@ -0,0 +1,47 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +def setup(): + # /var/run => /run + #pisitools.dosed("configure.ac", "^(\s+CONSOLE_KIT_PID_FILE=)\$\{localstatedir\}(\/run\/ConsoleKit\/pid)", r"\1\2") + #pisitools.dosed("src/Makefile.am", "\$\(localstatedir\)(\/run\/ConsoleKit)", r"\1") + #shelltools.system("sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in") + + #autotools.autoreconf("-fi") + + autotools.configure("--prefix=/usr \ + --sysconfdir=/etc \ + --sbindir=/usr/sbin \ + --with-rundir=/run \ + --libexecdir=/usr/libexec/ConsoleKit \ + --localstatedir=/var \ + --enable-polkit \ + --enable-pam-module \ + --enable-udev-acl \ + --enable-docbook-docs \ + --disable-static \ + --with-dbus-services=/usr/share/dbus-1/services \ + --with-logrotate-dir=/etc/logrotate.d \ + --with-xinitrc-dir=/etc/X11/xinit/xinitrc.d \ + --with-pam-module-dir=/lib/security \ + --with-systemdsystemunitdir=no \ + XMLTO_FLAGS='--skip-validation' \ + ") + +def build(): + autotools.make() + +def install(): + autotools.rawInstall("DESTDIR=%s/" % get.installDIR()) + + pisitools.removeDir("/run") + + pisitools.dodoc("AUTHORS", "README", "COPYING", "HACKING", "NEWS", "TODO") diff --git a/system/base/ConsoleKit/files/25-consolekit.rules b/system/base/ConsoleKit/files/25-consolekit.rules new file mode 100644 index 0000000000..adddfb1bd7 --- /dev/null +++ b/system/base/ConsoleKit/files/25-consolekit.rules @@ -0,0 +1,8 @@ +polkit.addRule(function(action, subject) { + if (action.id == "org.freedesktop.consolekit.system.stop" || + action.id == "org.freedesktop.consolekit.system.restart" || + action.id == "org.freedesktop.consolekit.system.hibernate" || + action.id == "org.freedesktop.consolekit.system.suspend") { + return polkit.Result.YES; + } +}); diff --git a/system/base/ConsoleKit/files/ConsoleKit.conf b/system/base/ConsoleKit/files/ConsoleKit.conf new file mode 100644 index 0000000000..4ec125110a --- /dev/null +++ b/system/base/ConsoleKit/files/ConsoleKit.conf @@ -0,0 +1 @@ +d /run/ConsoleKit 0755 - - - diff --git a/system/base/ConsoleKit/files/consolekit.pamd b/system/base/ConsoleKit/files/consolekit.pamd new file mode 100644 index 0000000000..8ac033c74b --- /dev/null +++ b/system/base/ConsoleKit/files/consolekit.pamd @@ -0,0 +1,7 @@ +#%PAM-1.0 + +auth include system-login +account include system-login +session include system-login +password include system-login +session optional pam_ck_connector.so diff --git a/system/base/ConsoleKit/files/pam-foreground-compat.ck b/system/base/ConsoleKit/files/pam-foreground-compat.ck new file mode 100644 index 0000000000..3c1d0744d0 --- /dev/null +++ b/system/base/ConsoleKit/files/pam-foreground-compat.ck @@ -0,0 +1,17 @@ +#!/bin/sh +TAGDIR=/run/console + +[ -n "$CK_SESSION_USER_UID" ] || exit 1 +[ "$CK_SESSION_IS_LOCAL" = "true" ] || exit 0 + +TAGFILE="$TAGDIR/`getent passwd $CK_SESSION_USER_UID | cut -f 1 -d:`" + +if [ "$1" = "session_added" ]; then + mkdir -p "$TAGDIR" + echo "$CK_SESSION_ID" >> "$TAGFILE" +fi + +if [ "$1" = "session_removed" ] && [ -e "$TAGFILE" ]; then + sed -i "\%^$CK_SESSION_ID\$%d" "$TAGFILE" + [ -s "$TAGFILE" ] || rm -f "$TAGFILE" +fi diff --git a/system/base/ConsoleKit/files/upstream_fix_issue_26.patch b/system/base/ConsoleKit/files/upstream_fix_issue_26.patch new file mode 100644 index 0000000000..a6009d302c --- /dev/null +++ b/system/base/ConsoleKit/files/upstream_fix_issue_26.patch @@ -0,0 +1,776 @@ +diff -Nuar ConsoleKit2-0.9.3.orig/src/ck-manager.c ConsoleKit2-0.9.3/src/ck-manager.c +--- ConsoleKit2-0.9.3.orig/src/ck-manager.c 2015-06-09 19:04:19.000000000 +0300 ++++ ConsoleKit2-0.9.3/src/ck-manager.c 2015-06-14 21:30:51.943744599 +0300 +@@ -2851,6 +2851,11 @@ + pid_t calling_pid = 0; + char *cookie; + ++ if (pid <= 1) { ++ throw_error (context, CK_MANAGER_ERROR_INVALID_INPUT, _("pid must be > 1")); ++ return TRUE; ++ } ++ + manager = CK_MANAGER (ckmanager); + + sender = g_dbus_method_invocation_get_sender (context); +diff -Nuar ConsoleKit2-0.9.3.orig/src/ck-session.c ConsoleKit2-0.9.3/src/ck-session.c +--- ConsoleKit2-0.9.3.orig/src/ck-session.c 2015-05-18 06:43:04.000000000 +0300 ++++ ConsoleKit2-0.9.3/src/ck-session.c 2015-06-14 21:30:55.946744527 +0300 +@@ -55,7 +55,6 @@ + char *seat_id; + + char *login_session_id; +- guint uid; + + GTimeVal creation_time; + +@@ -331,6 +330,11 @@ + + g_return_val_if_fail (CK_IS_SESSION (cksession), FALSE); + ++ if (console_kit_session_get_idle_hint (cksession) == FALSE) { ++ throw_error (context, CK_SESSION_ERROR_GENERAL, "idle since hint not set"); ++ return TRUE; ++ } ++ + date_str = g_time_val_to_iso8601 (&session->priv->idle_since_hint); + + console_kit_session_complete_get_idle_since_hint (cksession, context, date_str); +@@ -386,7 +390,7 @@ + } + + /* only restrict this by UID for now */ +- if (session->priv->uid != calling_uid) { ++ if (console_kit_session_get_unix_user (cksession) != calling_uid) { + throw_error (context, CK_SESSION_ERROR_INSUFFICIENT_PERMISSION, _("Only session owner may set idle hint state")); + return TRUE; + } +@@ -836,7 +840,11 @@ + + g_return_val_if_fail (CK_IS_SESSION (cksession), FALSE); + +- console_kit_session_complete_get_login_session_id (cksession, context, session->priv->login_session_id); ++ if (session->priv->login_session_id == NULL) { ++ throw_error (context, CK_SESSION_ERROR_FAILED, "no login session id"); ++ } else { ++ console_kit_session_complete_get_login_session_id (cksession, context, session->priv->login_session_id); ++ } + return TRUE; + } + +@@ -1240,7 +1248,7 @@ + extra_env[n++] = g_strdup_printf ("CK_SESSION_TYPE=%s", console_kit_session_get_session_type (cksession)); + } + extra_env[n++] = g_strdup_printf ("CK_SESSION_SEAT_ID=%s", session->priv->seat_id); +- extra_env[n++] = g_strdup_printf ("CK_SESSION_USER_UID=%d", session->priv->uid); ++ extra_env[n++] = g_strdup_printf ("CK_SESSION_USER_UID=%d", console_kit_session_get_unix_user (cksession)); + if (console_kit_session_get_display_device (cksession) != NULL && strlen (console_kit_session_get_display_device (cksession)) > 0) { + extra_env[n++] = g_strdup_printf ("CK_SESSION_DISPLAY_DEVICE=%s", console_kit_session_get_display_device (cksession)); + } +@@ -1279,7 +1287,7 @@ + cksession = CONSOLE_KIT_SESSION (session); + + group_name = g_strdup_printf ("Session %s", session->priv->id); +- g_key_file_set_integer (key_file, group_name, "uid", session->priv->uid); ++ g_key_file_set_integer (key_file, group_name, "uid", console_kit_session_get_unix_user (cksession)); + g_key_file_set_string (key_file, + group_name, + "seat", +diff -Nuar ConsoleKit2-0.9.3.orig/src/test-fus ConsoleKit2-0.9.3/src/test-fus +--- ConsoleKit2-0.9.3.orig/src/test-fus 1970-01-01 02:00:00.000000000 +0200 ++++ ConsoleKit2-0.9.3/src/test-fus 2015-06-14 21:31:08.768744297 +0300 +@@ -0,0 +1,69 @@ ++#!/usr/bin/env python ++# ++# Test fast-user-switch functionality ++# ++ ++import os ++import sys ++import gobject ++import dbus ++import dbus.glib ++ ++def activate_reply (res): ++ print "session activated" ++ ++def activate_error (e): ++ print str (e) ++ ++def session_added_cb (ssid): ++ print "Session added: %s" % ssid ++ ++def session_removed_cb (ssid): ++ print "Session removed: %s" % ssid ++ ++def active_session_changed_cb (ssid): ++ print "Active session changed: %s" % ssid ++ ++bus = dbus.SystemBus () ++ ++manager_obj = bus.get_object ('org.freedesktop.ConsoleKit', '/org/freedesktop/ConsoleKit/Manager') ++ ++manager = dbus.Interface (manager_obj, 'org.freedesktop.ConsoleKit.Manager') ++ ++current_ssid = manager.GetCurrentSession () ++current_session_obj = bus.get_object ('org.freedesktop.ConsoleKit', current_ssid) ++current_session = dbus.Interface (current_session_obj, 'org.freedesktop.ConsoleKit.Session') ++ ++sid = current_session.GetSeatId () ++if not sid: ++ print "Current session is not attached to a seat, no switching possible" ++ sys.exit () ++ ++seat_obj = bus.get_object ('org.freedesktop.ConsoleKit', sid) ++seat = dbus.Interface (seat_obj, 'org.freedesktop.ConsoleKit.Seat') ++seat.connect_to_signal ('SessionAdded', session_added_cb) ++seat.connect_to_signal ('SessionRemoved', session_removed_cb) ++seat.connect_to_signal ('ActiveSessionChanged', active_session_changed_cb) ++ ++can_fus = seat.CanActivateSessions() ++if can_fus: ++ print "The current seat supports session switching" ++else: ++ print "The current seat does not support session switching" ++ ++# Show a list of sessions on the current seat ++sessions = seat.GetSessions () ++for ssid in sessions: ++ session_obj = bus.get_object ('org.freedesktop.ConsoleKit', ssid) ++ session = dbus.Interface (session_obj, 'org.freedesktop.ConsoleKit.Session') ++ uid = session.GetUser () ++ print "Session %s user=%u" % (ssid, uid) ++ ++# then pretend a session-ID is selected: ++ssid = current_ssid ++session_obj = bus.get_object ('org.freedesktop.ConsoleKit', ssid) ++session = dbus.Interface (session_obj, 'org.freedesktop.ConsoleKit.Session') ++session.Activate (reply_handler = activate_reply, error_handler = activate_error) ++ ++mainloop = gobject.MainLoop () ++mainloop.run() +diff -Nuar ConsoleKit2-0.9.3.orig/src/test-manager.c ConsoleKit2-0.9.3/src/test-manager.c +--- ConsoleKit2-0.9.3.orig/src/test-manager.c 2015-06-08 10:14:14.000000000 +0300 ++++ ConsoleKit2-0.9.3/src/test-manager.c 2015-06-14 21:31:10.021744275 +0300 +@@ -277,7 +277,10 @@ + static gboolean + validate_stuff () + { +- gint fd; ++ gint fd; ++ GVariant *session_var = NULL, *close_var = NULL; ++ gboolean is_session_closed; ++ GError *error = NULL; + + print_reply (manager, "CanRestart"); + +@@ -295,7 +298,7 @@ + + fd = print_inhibit_reply (manager, "Inhibit"); + +- print_reply (manager, "OpenSession"); ++ session_var = print_method (manager, "OpenSession", g_variant_new ("()")); + + print_reply (manager, "GetSeats"); + +@@ -317,8 +320,29 @@ + g_close (fd, NULL); + } + ++ /* test closing our session */ ++ if (session_var != NULL) { ++ g_print ("calling CloseSession\t"); ++ close_var = g_dbus_proxy_call_sync (manager, "CloseSession", ++ session_var, ++ G_DBUS_CALL_FLAGS_NONE, 3000, NULL, &error); ++ if (close_var == NULL) { ++ g_print ("returned NULL\t"); ++ if (error) ++ g_print ("error %s", error->message); ++ } ++ } ++ ++ g_variant_get (close_var, "(b)", &is_session_closed); ++ g_print ("session closed? %s", is_session_closed ? "Closed" : "Not Closed"); ++ + g_print ("done printing stuff\n\n"); + ++ if (session_var) ++ g_variant_unref (session_var); ++ if (close_var) ++ g_variant_unref (close_var); ++ + return TRUE; + } + +diff -Nuar ConsoleKit2-0.9.3.orig/src/test-method-access-policy ConsoleKit2-0.9.3/src/test-method-access-policy +--- ConsoleKit2-0.9.3.orig/src/test-method-access-policy 1970-01-01 02:00:00.000000000 +0200 ++++ ConsoleKit2-0.9.3/src/test-method-access-policy 2015-06-14 21:31:10.021744275 +0300 +@@ -0,0 +1,534 @@ ++#!/usr/bin/env python ++# ++# Test access to methods ++# ++ ++import os ++import sys ++import gobject ++import dbus ++import dbus.glib ++ ++bus = dbus.SystemBus () ++ ++privileged = (os.geteuid () == 0) ++if privileged: ++ print "Running privileged as uid=%d pid=%d" % (os.geteuid (), os.getpid ()) ++else: ++ print "Running unprivileged as uid=%d pid=%d" % (os.geteuid (), os.getpid ()) ++ ++print "Testing all public methods to check D-Bus policy" ++ ++manager_obj = bus.get_object ('org.freedesktop.ConsoleKit', '/org/freedesktop/ConsoleKit/Manager') ++manager = dbus.Interface (manager_obj, 'org.freedesktop.ConsoleKit.Manager') ++ ++print "Testing Manager" ++ ++print "Testing Manager.OpenSession:", ++res = "PASS" ++try: ++ cookie = manager.OpenSession () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Manager.CloseSession:", ++res = "PASS" ++try: ++ manager.CloseSession (cookie) ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Manager.OpenSessionWithParameters:", ++res = "PASS" ++try: ++ cookie = manager.OpenSessionWithParameters (dbus.Array([], signature = "sv")) ++ if not privileged: ++ res = "FAIL" ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ if privileged: ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t%s" % res ++ ++print "Testing Manager.GetSeats:", ++res = "PASS" ++try: ++ manager.GetSeats () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Manager.GetSessionForCookie:", ++res = "PASS" ++try: ++ manager.GetSessionForCookie (os.environ['XDG_SESSION_COOKIE']) ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Manager.GetSessionForUnixProcess:", ++res = "PASS" ++try: ++ manager.GetSessionForUnixProcess (os.getpid ()) ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t%s" % res ++ ++print "Testing Manager.GetCurrentSession:", ++res = "PASS" ++try: ++ manager.GetCurrentSession () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Manager.GetSessionsForUnixUser:", ++res = "PASS" ++try: ++ manager.GetSessionsForUnixUser (os.geteuid ()) ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t%s" % res ++ ++print "Testing Manager.GetSessionsForUser:", ++res = "PASS" ++try: ++ manager.GetSessionsForUser (os.geteuid ()) ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Manager.GetSystemIdleHint:", ++res = "PASS" ++try: ++ manager.GetSystemIdleHint () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Manager.GetSystemIdleSinceHint:", ++res = "PASS" ++try: ++ manager.GetSystemIdleSinceHint () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t%s" % res ++ ++# Test Seat Interface ++print "Testing Seat" ++ ++seat_obj = bus.get_object ('org.freedesktop.ConsoleKit', '/org/freedesktop/ConsoleKit/Seat1') ++seat = dbus.Interface (seat_obj, 'org.freedesktop.ConsoleKit.Seat') ++ ++print "Testing Seat.GetId:", ++res = "PASS" ++try: ++ seat.GetId () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t\t%s" % res ++ ++print "Testing Seat.GetSessions:", ++res = "PASS" ++try: ++ seat.GetSessions () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Seat.GetDevices:", ++res = "PASS" ++try: ++ seat.GetDevices () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Seat.GetActiveSession:", ++res = "PASS" ++try: ++ seat.GetActiveSession () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Seat.CanActivateSessions:", ++res = "PASS" ++try: ++ seat.CanActivateSessions () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Seat.ActivateSession:", ++res = "PASS" ++try: ++ seat.ActivateSession ('/org/freedesktop/ConsoleKit/SessionN') ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++# Test Session Interface ++print "Testing Session" ++ ++# create a new session so we can set props ++cookie = manager.OpenSession () ++ssid = manager.GetSessionForCookie (cookie) ++if not ssid: ++ print "Could not create a session to test" ++ sys.exit () ++ ++session_obj = bus.get_object ('org.freedesktop.ConsoleKit', ssid) ++session = dbus.Interface (session_obj, 'org.freedesktop.ConsoleKit.Session') ++ ++print "Testing Session.GetId:", ++res = "PASS" ++try: ++ session.GetId () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t\t%s" % res ++ ++print "Testing Session.GetSeatId:", ++res = "PASS" ++try: ++ session.GetSeatId () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Session.GetLoginSessionId:", ++res = "PASS" ++try: ++ session.GetLoginSessionId () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Session.GetSessionType:", ++res = "PASS" ++try: ++ session.GetSessionType () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Session.GetUser:", ++res = "PASS" ++try: ++ session.GetUser () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Session.GetUnixUser:", ++res = "PASS" ++try: ++ session.GetUnixUser () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Session.GetX11Display:", ++res = "PASS" ++try: ++ session.GetX11Display () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Session.GetX11DisplayDevice:", ++res = "PASS" ++try: ++ session.GetX11DisplayDevice () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Session.GetDisplayDevice:", ++res = "PASS" ++try: ++ session.GetDisplayDevice () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Session.GetRemoteHostName:", ++res = "PASS" ++try: ++ session.GetRemoteHostName () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Session.IsActive:", ++res = "PASS" ++try: ++ session.IsActive () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Session.IsLocal:", ++res = "PASS" ++try: ++ session.IsLocal () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Session.GetCreationTime:", ++res = "PASS" ++try: ++ session.GetCreationTime () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Session.Activate:", ++res = "PASS" ++try: ++ session.Activate () ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++print "Testing Session.Lock:", ++res = "PASS" ++try: ++ session.Lock () ++ if not privileged: ++ res = "FAIL" ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ if privileged: ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t\t%s" % res ++ ++print "Testing Session.Unlock:", ++res = "PASS" ++try: ++ session.Unlock () ++ if not privileged: ++ res = "FAIL" ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ if privileged: ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res ++ ++# Test session properties ++ ++session_props = dbus.Interface (session_obj, 'org.freedesktop.DBus.Properties') ++ ++print "Testing Properties.Get 'unix-user':", ++res = "PASS" ++try: ++ session_props.Get ('org.freedesktop.ConsoleKit.Session', "unix-user") ++ if not privileged: ++ res = "FAIL" ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ if privileged: ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Properties.Get 'cookie':", ++res = "PASS" ++try: ++ session_props.Get ('org.freedesktop.ConsoleKit.Session', "cookie") ++ if not privileged: ++ res = "FAIL" ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ if privileged: ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t%s" % res ++ ++print "Testing Properties.Set:", ++res = "PASS" ++try: ++ session_props.Set ('org.freedesktop.ConsoleKit.Session', "unix-user", 0) ++ if not privileged: ++ res = "FAIL" ++except dbus.exceptions.DBusException, e: ++ if e.get_dbus_name () == "org.freedesktop.DBus.Error.AccessDenied": ++ if privileged: ++ res = "FAIL" ++ elif e.get_dbus_name () == "org.freedesktop.DBus.Error.UnknownMethod": ++ res = "UKNOWN METHOD" ++except: ++ pass ++print "\t\t\t%s" % res +diff -Nuar ConsoleKit2-0.9.3.orig/src/test-session.c ConsoleKit2-0.9.3/src/test-session.c +--- ConsoleKit2-0.9.3.orig/src/test-session.c 2015-05-18 06:43:04.000000000 +0300 ++++ ConsoleKit2-0.9.3/src/test-session.c 2015-06-14 21:31:12.560744229 +0300 +@@ -176,7 +176,7 @@ + open_session (void) + { + GDBusProxy *session; +- GVariant *cookie_var, *session_var, *activate_var; ++ GVariant *cookie_var, *session_var, *activate_var, *close_var; + GError *error = NULL; + const gchar *path = NULL, *cookie = NULL; + +@@ -272,6 +272,20 @@ + } + if (activate_var) + g_variant_unref (activate_var); ++ ++ close_var = g_dbus_proxy_call_sync (manager, "CloseSession", g_variant_new ("(s)", cookie), G_DBUS_CALL_FLAGS_NONE, 3000, NULL, &error); ++ if (session_var == NULL) { ++ g_print ("returned NULL, is the daemon running?\t"); ++ ++ if (error) ++ g_print ("error %s", error->message); ++ ++ g_print ("\n"); ++ g_clear_error (&error); ++ return; ++ } ++ if (close_var) ++ g_variant_unref (close_var); + } + + int diff --git a/system/base/ConsoleKit/pspec.xml b/system/base/ConsoleKit/pspec.xml new file mode 100644 index 0000000000..86cfe98319 --- /dev/null +++ b/system/base/ConsoleKit/pspec.xml @@ -0,0 +1,154 @@ + + + + + ConsoleKit2 + http://freedesktop.org/Software/Hal + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + library + A framework for defining and tracking users, login sessions, and seats + ConsoleKit is a system daemon for tracking what users are logged into the system and how they interact with the computer (e.g. which keyboard and mouse they use). + https://github.com/ConsoleKit2/ConsoleKit2/releases/download/0.9.4/ConsoleKit2-0.9.4.tar.bz2 + + acl-devel + pam-devel + dbus-devel + udev-devel + zlib-devel + glib2-devel + libX11-devel + polkit-devel + dbus-glib-devel + + + + + + ConsoleKit + + acl + pam + dbus + zlib + glib2 + libX11 + polkit + libudev + dbus-glib + + + /etc + /usr/lib/tmpfiles.d/ConsoleKit.conf + /usr/bin + /usr/sbin + /usr/libexec + /lib + /usr/lib + /usr/share/dbus-1 + /usr/share/polkit-1/actions + /usr/share/polkit-1/rules.d + /usr/share/man + /usr/share/locale + /usr/share/doc + /var + + + ConsoleKit.conf + 25-consolekit.rules + consolekit.pamd + + + + + ConsoleKit-devel + system.devel + Development files for ConsoleKit + + ConsoleKit + dbus-devel + + + /usr/include + /usr/lib/pkgconfig + + + + + + 2015-06-16 + 0.9.4 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2015-06-15 + 0.9.3 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2015-02-05 + 0.9.2 + Version bump. + Vedat Demir + vedat@pisilinux.org + + + 2014-08-01 + 0.4.6 + Rebuild. + Marcin Bojara + marcin@pisilinux.org + + + 2014-05-11 + 0.4.6 + Release bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-03-06 + 0.4.6 + Dep Fix + Varol Maksutoğlu + waroi@pisilinux.org + + + 2014-01-09 + 0.4.6 + Add gentoo patches and ConsoleKit.conf + Marcin Bojara + marcin@pisilinux.org + + + 2013-09-08 + 0.4.6 + /var/run => /run + Marcin Bojara + marcin@pisilinux.org + + + 2013-03-04 + 0.4.6 + Version bump + Yusuf Aydemir + yusuf.aydemir@pisilinux.org + + + 2012-08-23 + 0.4.5 + First release + PisiLinux Community + admins@pisilinux.org + + + diff --git a/system/base/ConsoleKit/translations.xml b/system/base/ConsoleKit/translations.xml new file mode 100644 index 0000000000..836acdaca0 --- /dev/null +++ b/system/base/ConsoleKit/translations.xml @@ -0,0 +1,13 @@ + + + + ConsoleKit + Kullanıcıları, giriş oturumlarını ve koltukları takip etmek ve tanımlamak için bir altyapı + ConsoleKit, sisteme giriş yapmış kullanıcıları ve bu kullanıcıların bilgisayar ile nasıl etkileştiğini izleyen bir sistem hizmetidir. + + + + ConsoleKit-devel + ConsoleKit için geliştirme dosyaları + + diff --git a/system/base/nspr/actions.py b/system/base/nspr/actions.py new file mode 100644 index 0000000000..e5d6dc7d35 --- /dev/null +++ b/system/base/nspr/actions.py @@ -0,0 +1,37 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import autotools +from pisi.actionsapi import get +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +def setup(): + # -fno-strict-aliasing workarounds some aliasing violations, see: https://bugzilla.redhat.com/show_bug.cgi?id=487844 --> + shelltools.system('nspr/configure \ + --prefix=/usr \ + --disable-debug \ + %s \ + --enable-optimize="%s -fno-strict-aliasing"' % ("--enable-64bit" if get.ARCH() == "x86_64" else "", get.CFLAGS())) + +def build(): + autotools.make() + +def install(): + # Create nss.pc and nss-config dynamically + shelltools.system("./generate-pc-config.sh") + + pisitools.insinto("/usr/lib","dist/lib/*.so",sym=False) + pisitools.insinto("/usr/include/nspr","dist/include/nspr/*.h",sym=False) + pisitools.insinto("/usr/include/nspr/obsolete","dist/include/nspr/obsolete/*.h",sym=False) + pisitools.insinto("/usr/include/nspr/private","dist/include/nspr/private/*.h",sym=False) + + # Fix permissions of headers, they're 0640 by default + shelltools.chmod("%s/usr/include/nspr/*.h" % get.installDIR(), 0644) + shelltools.chmod("%s/usr/include/nspr/*/*.h" % get.installDIR(), 0644) + + pisitools.insinto("/usr/bin","config/nspr-config",sym=False) + pisitools.insinto("/usr/lib/pkgconfig","config/nspr.pc",sym=False) diff --git a/system/base/nspr/files/generate-pc-config.sh b/system/base/nspr/files/generate-pc-config.sh new file mode 100644 index 0000000000..fb41397d05 --- /dev/null +++ b/system/base/nspr/files/generate-pc-config.sh @@ -0,0 +1,36 @@ +#!/bin/bash + +# Generate nss.pc from nss.pc.in +# Ozan Caglayan, 2010 +# +# Generate nspr.pc from nspr.pc.in +# Metin Akdere, 2012 + +LIBDIR="/usr/lib/nspr" +PREFIX="/usr" +EXEC_PREFIX="/usr" +INCLUDEDIR="/usr/include/nspr" + +PKGCONFIG="nspr/config/nspr.pc.in" + +NSPR_VERSION=`./config/nspr-config --version` +NSPR_LIBS=`./config/nspr-config --libs` +NSPR_CFLAGS=`./config/nspr-config --cflags` + +echo "NSPR_VERSION: $NSPR_VERSION" +echo "NSPR_LIBS: $NSPR_LIBS" +echo "NSPR_CFLAGS: $NSPR_CFLAGS" + +# Setup pkgconfig file +cat $PKGCONFIG | sed -e "s,%libdir%,$LIBDIR,g" \ + -e "s,%prefix%,$PREFIX,g" \ + -e "s,%exec_prefix%,$EXEC_PREFIX,g" \ + -e "s,%includedir%,$INCLUDEDIR,g" \ + -e "s,%NSPR_VERSION%,$NSPR_VERSION,g" \ + -e "s,%FULL_NSPR_LIBS%,$NSPR_LIBS,g" \ + -e "s,%FULL_NSPR_CFLAGS%,$NSPR_CFLAGS,g" \ + > config/nspr.pc + + +# Clear .in files +rm -rf $PKGCONFIG diff --git a/system/base/nspr/files/nspr.pc.in b/system/base/nspr/files/nspr.pc.in new file mode 100644 index 0000000000..1d8f4a0cad --- /dev/null +++ b/system/base/nspr/files/nspr.pc.in @@ -0,0 +1,10 @@ +prefix=%prefix% +exec_prefix=%exec_prefix% +libdir=%libdir% +includedir=%includedir% + +Name: NSPR +Description: The Netscape Portable Runtime +Version: %NSPR_VERSION% +Libs: %FULL_NSPR_LIBS% +Cflags: %FULL_NSPR_CFLAGS% diff --git a/system/base/nspr/pspec.xml b/system/base/nspr/pspec.xml new file mode 100644 index 0000000000..6c577d5a4a --- /dev/null +++ b/system/base/nspr/pspec.xml @@ -0,0 +1,122 @@ + + + + + nspr + http://www.mozilla.org/projects/nspr/ + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + library + Netscape Portable Runtime + Netscape Portable Runtime (NSPR) provides a platform-neutral API for system level and libc like functions. The API is used in the Mozilla client, many of Netscape/AOL/iPlanet's and other software offerings. + ftp://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.10.8/src/nspr-4.10.8.tar.gz + + nspr.pc.in + generate-pc-config.sh + + + + + nspr + + /usr/lib + + + + + nspr-devel + system.devel + Development files for nspr + + nspr + + + /usr/include + /usr/lib/pkgconfig + /usr/bin + + + + + + 2015-04-02 + 4.10.8 + Version bump. + Hakan Yıldız + hknyldz93@gmail.com + + + 2014-12-06 + 4.10.7 + Version bump. + Yusuf Aydemir + yusuf.aydemir@pisilinux.org + + + 2014-07-05 + 4.10.6 + Release bump. + PisiLinux Community + admins@pisilinux.org + + + 2014-05-11 + 4.10.4 + Release bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-03-29 + 4.10.4 + Version bump. + PisiLinux Community + admins@pisilinux.org + + + 2013-11-18 + 4.10.2 + Version bump. + PisiLinux Community + admins@pisilinux.org + + + 2013-10-23 + 4.10.1 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2013-07-18 + 4.10 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2013-05-17 + 4.9.6 + v.bump + Erdinç Gültekin + erdincgultekin@pisilinux.org + + + 2013-01-14 + 4.9.5 + New release + PisiLinux Community + admins@pisilinux.org + + + 2012-11-25 + 4.9.4 + First release + Erdinç Gültekin + admins@pisilinux.org + + + diff --git a/system/base/nspr/translations.xml b/system/base/nspr/translations.xml new file mode 100644 index 0000000000..1f0c162da6 --- /dev/null +++ b/system/base/nspr/translations.xml @@ -0,0 +1,15 @@ + + + + nspr + Netscape Taşınabilir Çalışma Zamanı + Netscape Taşınabilir çalışma Zamanı (NSPR) sistem seviyesindeki libc ve benzeri fonksiyonlar için platform bağımsız bir programlama arayüzü sunar. Bu arayüz, Mozilla istemcilerinde, Netscape/AOL/iPlanet'in diğer yazılımlarında kullanılmaktadır. + Netscape Portable Runtime (NSPR -- Exécutable Portable Netscape) fourni une API neutre au sens de la plate-forme pour les fonctions de niveau système ou de type libc. Cette API est utilisée au sein du client Mozilla ainsi que de nombreuses solutions logicielles de Netscape/AOL/iPlanet. + Netscape Portable Runtime (NSPR) provee un API independiente de la plataforma a nivel de sistema y funciones como libc. El API está usado en el cliente Mozilla, y muchos otros software de Netscape/AOL/iPlanet. + + + + nspr-devel + nspr için geliştirme dosyaları + + diff --git a/system/base/util-linux/actions.py b/system/base/util-linux/actions.py new file mode 100644 index 0000000000..a5384b21e0 --- /dev/null +++ b/system/base/util-linux/actions.py @@ -0,0 +1,91 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +pisitools.cflags.add("-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64") +pisitools.cflags.sub("-O[\d]", "-Os") + +def setup(): + shelltools.export("SUID_CFLAGS", "-fpie") + shelltools.export("SUID_LDFLAGS", "-pie -Wl,-z,relro -Wl,-z,now") + shelltools.export("AUTOPOINT", "/bin/true") + + options = "\ + --disable-rpath \ + --disable-silent-rules \ + --disable-use-tty-group \ + --disable-su \ + --disable-last \ + --disable-mesg \ + --disable-vipw \ + --disable-wall \ + --disable-login \ + --disable-newgrp \ + --disable-nologin \ + --disable-runuser \ + --disable-sulogin \ + --disable-utmpdump \ + --disable-chfn-chsh \ + --disable-mountpoint \ + --disable-makeinstall-chown \ + --disable-socket-activation \ + " + + if get.buildTYPE() == "emul32": + options += "\ + --prefix=/emul32 \ + --bindir=/emul32/bin \ + --sbindir=/emul32/sbin \ + --libdir=/usr/lib32 \ + --without-ncurses \ + --disable-static \ + --disable-partx \ + --disable-raw \ + --disable-write \ + --disable-mount \ + --disable-fsck \ + --disable-libmount \ + --with-audit=no \ + " + else: + options += "\ + --bindir=/bin \ + --sbindir=/sbin \ + --enable-static \ + --enable-partx \ + --enable-raw \ + --enable-write \ + --enable-tunelp \ + --without-audit \ + --with-udev \ + --without-utempter \ + " + + autotools.autoreconf("-fi") + autotools.configure(options) + pisitools.dosed("libtool", "( -shared )", r" -Wl,--as-needed\1") + + # Extra fedora switches: + # --enable-login-utils will enable some utilities we ship in shadow + # --enable-kill will enable the kill utility we ship in coreutils + +def build(): + autotools.make() + +def install(): + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + + #pisitools.doman("sys-utils/klogconsole.man") + pisitools.remove("/usr/share/man/man1/kill.1") + + if get.buildTYPE() == "emul32": return + + pisitools.dodoc("ABOUT-NLS", "AUTHORS", "ChangeLog", "COPYING", "README*") + pisitools.insinto("/%s/%s" % (get.docDIR(), get.srcNAME()), "Documentation") diff --git a/system/base/util-linux/files/0001-libmount-FS-id-and-parent-ID-could-be-zero.patch b/system/base/util-linux/files/0001-libmount-FS-id-and-parent-ID-could-be-zero.patch new file mode 100644 index 0000000000..01a8d441bb --- /dev/null +++ b/system/base/util-linux/files/0001-libmount-FS-id-and-parent-ID-could-be-zero.patch @@ -0,0 +1,98 @@ +From 6c373810f5b1d32824371e9dff6ee5a006388f98 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 20 Feb 2014 16:59:11 +0100 +Subject: [PATCH] libmount: FS id and parent ID could be zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +It seems that linux 3.14 is able to produce things like: + + 19 0 8:3 / / rw,relatime - ext4 /dev/sda3 rw,data=ordered + ^ + +Reported-by: Mantas Mikulėnas +Signed-off-by: Karel Zak +--- + libmount/src/tab.c | 12 ++++-------- + misc-utils/findmnt.c | 5 +++-- + 2 files changed, 7 insertions(+), 10 deletions(-) + +diff --git a/libmount/src/tab.c b/libmount/src/tab.c +index 4c2f8a4..332312b 100644 +--- a/libmount/src/tab.c ++++ b/libmount/src/tab.c +@@ -505,7 +505,7 @@ int mnt_table_get_root_fs(struct libmnt_table *tb, struct libmnt_fs **root) + assert(tb); + assert(root); + +- if (!tb || !root) ++ if (!tb || !root || !is_mountinfo(tb)) + return -EINVAL; + + DBG(TAB, mnt_debug_h(tb, "lookup root fs")); +@@ -515,8 +515,6 @@ int mnt_table_get_root_fs(struct libmnt_table *tb, struct libmnt_fs **root) + mnt_reset_iter(&itr, MNT_ITER_FORWARD); + while(mnt_table_next_fs(tb, &itr, &fs) == 0) { + int id = mnt_fs_get_parent_id(fs); +- if (!id) +- break; /* @tab is not a mountinfo file? */ + + if (!*root || id < root_id) { + *root = fs; +@@ -524,7 +522,7 @@ int mnt_table_get_root_fs(struct libmnt_table *tb, struct libmnt_fs **root) + } + } + +- return root_id ? 0 : -EINVAL; ++ return *root ? 0 : -EINVAL; + } + + /** +@@ -545,15 +543,13 @@ int mnt_table_next_child_fs(struct libmnt_table *tb, struct libmnt_iter *itr, + struct libmnt_fs *fs; + int parent_id, lastchld_id = 0, chld_id = 0; + +- if (!tb || !itr || !parent) ++ if (!tb || !itr || !parent || !is_mountinfo(tb)) + return -EINVAL; + + DBG(TAB, mnt_debug_h(tb, "lookup next child of '%s'", + mnt_fs_get_target(parent))); + + parent_id = mnt_fs_get_id(parent); +- if (!parent_id) +- return -EINVAL; + + /* get ID of the previously returned child */ + if (itr->head && itr->p != itr->head) { +@@ -584,7 +580,7 @@ int mnt_table_next_child_fs(struct libmnt_table *tb, struct libmnt_iter *itr, + } + } + +- if (!chld_id) ++ if (!*chld) + return 1; /* end of iterator */ + + /* set the iterator to the @chld for the next call */ +diff --git a/misc-utils/findmnt.c b/misc-utils/findmnt.c +index fb21174..988cd73 100644 +--- a/misc-utils/findmnt.c ++++ b/misc-utils/findmnt.c +@@ -822,8 +822,9 @@ static int tab_is_tree(struct libmnt_table *tb) + if (!itr) + return 0; + +- if (mnt_table_next_fs(tb, itr, &fs) == 0) +- rc = mnt_fs_get_id(fs) > 0 && mnt_fs_get_parent_id(fs) > 0; ++ rc = (mnt_table_next_fs(tb, itr, &fs) == 0 && ++ mnt_fs_is_kernel(fs) && ++ mnt_fs_get_root(fs)); + + mnt_free_iter(itr); + return rc; +-- +1.9.1 + diff --git a/system/base/util-linux/files/0001-switch_root-verify-initramfs-by-f_type-not-devno.patch b/system/base/util-linux/files/0001-switch_root-verify-initramfs-by-f_type-not-devno.patch new file mode 100644 index 0000000000..56191a30e7 --- /dev/null +++ b/system/base/util-linux/files/0001-switch_root-verify-initramfs-by-f_type-not-devno.patch @@ -0,0 +1,59 @@ +From 751c39383adaf5ff5a860516238d524b0e20f835 Mon Sep 17 00:00:00 2001 +From: Dave Reisner +Date: Wed, 2 Apr 2014 10:41:30 -0400 +Subject: [PATCH] switch_root: verify initramfs by f_type, not devno + +As of linux 3.14, the initramfs device will have both major and +minor 0, causing our paranoia check to fail. Make this version agnostic +by checking the filesystem type, rather than a device number. + +[adopted from master for backport into 2.24.x branch] + +Signed-off-by: Dave Reisner +--- + sys-utils/switch_root.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/sys-utils/switch_root.c b/sys-utils/switch_root.c +index f26f7da..40e222d 100644 +--- a/sys-utils/switch_root.c ++++ b/sys-utils/switch_root.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -33,6 +34,8 @@ + #include + #include + ++#include ++ + #include "c.h" + #include "nls.h" + #include "closestream.h" +@@ -174,12 +177,12 @@ static int switchroot(const char *newroot) + if (cfd >= 0) { + pid = fork(); + if (pid <= 0) { +- if (fstat(cfd, &sb) == 0) { +- if (sb.st_dev == makedev(0, 1)) +- recursiveRemove(cfd); +- else +- warn(_("old root filesystem is not an initramfs")); +- } ++ struct statfs stfs; ++ if (fstatfs(cfd, &stfs) == 0 && ++ (stfs.f_type == RAMFS_MAGIC || stfs.f_type == TMPFS_MAGIC)) ++ recursiveRemove(cfd); ++ else ++ warn(_("old root filesystem is not an initramfs")); + + if (pid == 0) + exit(EXIT_SUCCESS); +-- +1.9.1 + diff --git a/system/base/util-linux/files/move_is_mountinfo.patch b/system/base/util-linux/files/move_is_mountinfo.patch new file mode 100644 index 0000000000..ad9387efc3 --- /dev/null +++ b/system/base/util-linux/files/move_is_mountinfo.patch @@ -0,0 +1,46 @@ +diff --git a/libmount/src/tab.c b/libmount/src/tab.c +index 3633b6a..8ae49c8 100644 +--- a/libmount/src/tab.c ++++ b/libmount/src/tab.c +@@ -47,6 +47,20 @@ + #include "strutils.h" + #include "loopdev.h" + ++static int is_mountinfo(struct libmnt_table *tb) ++{ ++ struct libmnt_fs *fs; ++ ++ if (!tb) ++ return 0; ++ ++ fs = list_first_entry(&tb->ents, struct libmnt_fs, ents); ++ if (fs && mnt_fs_is_kernel(fs) && mnt_fs_get_root(fs)) ++ return 1; ++ ++ return 0; ++} ++ + /** + * mnt_new_table: + * +@@ -1229,20 +1335,6 @@ err: + return NULL; + } + +-static int is_mountinfo(struct libmnt_table *tb) +-{ +- struct libmnt_fs *fs; +- +- if (!tb) +- return 0; +- +- fs = list_first_entry(&tb->ents, struct libmnt_fs, ents); +- if (fs && mnt_fs_is_kernel(fs) && mnt_fs_get_root(fs)) +- return 1; +- +- return 0; +-} +- + /** + * mnt_table_is_fs__mounted: + * @tb: /proc/self/mountinfo file diff --git a/system/base/util-linux/files/ntfs-3g.patch b/system/base/util-linux/files/ntfs-3g.patch new file mode 100644 index 0000000000..818f0cbe09 --- /dev/null +++ b/system/base/util-linux/files/ntfs-3g.patch @@ -0,0 +1,12 @@ +diff -Nuar util-linux-2.21.2.orig/libblkid/src/superblocks/ntfs.c util-linux-2.21.2/libblkid/src/superblocks/ntfs.c +--- util-linux-2.21.2.orig/libblkid/src/superblocks/ntfs.c 2012-05-24 13:22:56.000000000 +0300 ++++ util-linux-2.21.2/libblkid/src/superblocks/ntfs.c 2012-06-05 14:21:57.967967774 +0300 +@@ -160,7 +160,7 @@ + + const struct blkid_idinfo ntfs_idinfo = + { +- .name = "ntfs", ++ .name = "ntfs-3g", + .usage = BLKID_USAGE_FILESYSTEM, + .probefunc = probe_ntfs, + .magics = diff --git a/system/base/util-linux/files/upstream/util-linux-ng-2.21-login-lastlog.patch b/system/base/util-linux/files/upstream/util-linux-ng-2.21-login-lastlog.patch new file mode 100644 index 0000000000..947a0e55c2 --- /dev/null +++ b/system/base/util-linux/files/upstream/util-linux-ng-2.21-login-lastlog.patch @@ -0,0 +1,11 @@ +diff -up util-linux-2.21-rc1/login-utils/login.c.kzak util-linux-2.21-rc1/login-utils/login.c +--- util-linux-2.21-rc1/login-utils/login.c.kzak 2012-01-19 13:19:54.886299587 +0100 ++++ util-linux-2.21-rc1/login-utils/login.c 2012-01-19 13:20:40.853451212 +0100 +@@ -499,7 +499,7 @@ static void log_lastlog(struct login_con + if (!cxt->pwd) + return; + +- fd = open(_PATH_LASTLOG, O_RDWR, 0); ++ fd = open(_PATH_LASTLOG, O_RDWR | O_CREAT, 0); + if (fd < 0) + return; diff --git a/system/base/util-linux/pspec.xml b/system/base/util-linux/pspec.xml new file mode 100644 index 0000000000..66f0b8a225 --- /dev/null +++ b/system/base/util-linux/pspec.xml @@ -0,0 +1,226 @@ + + + + + util-linux + http://userweb.kernel.org/~kzak/util-linux-ng/ + + PisiLinux Community + admins@pisilinux.org + + GPLv2 + app:console + library + Various useful Linux utilities + The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. + https://www.kernel.org/pub/linux/utils/util-linux/v2.26/util-linux-2.26.1.tar.xz + + zlib-devel + shadow + ncurses-devel + libcap-ng-devel + + + + + + upstream/util-linux-ng-2.21-login-lastlog.patch + + + + + util-linux + + libuuid + libblkid + zlib + perl + ncurses + libudev + + libcap-ng + + + /etc + /bin + /sbin + /usr/bin + /usr/sbin + /usr/share/doc + /usr/share/man + /usr/share/info + /usr/share/misc + /usr/share/getopt + /usr/share/bash-completion/completions + /usr/share/locale + /usr/include + /usr/lib + /lib + + + + + uuidd + service + app:console + util.misc + Helper daemon to guarantee uniqueness of time-based UUIDs + + libuuid + + + + /usr/bin/uuidgen + /usr/sbin/uuidd + /usr/share/man/man1/uuidgen.1 + /usr/share/man/man8/uuidd.8 + + + + + libuuid + library + A library for UUID processing + + /usr/share/man/man3/uuid* + /lib/libuuid.* + /usr/lib/libuuid.so + + + + + libuuid-devel + header + system.devel + libuuid header files + + libuuid + + + /usr/include/uuid/* + /usr/lib/pkgconfig/ + /usr/lib32/pkgconfig/uuid.pc + + + + + libblkid + library + A library for block device identifying + + libuuid + + + /usr/share/man/man3/libblkid* + /usr/share/man/man8/blkid* + /lib/libblkid.* + /usr/lib/libblkid.so + + + + + libblkid-devel + header + system.devel + libblkid header files + + libblkid + + + /usr/include/blkid/* + /usr/lib/pkgconfig/blkid.pc + /usr/lib32/pkgconfig/blkid.pc + + + + + libuuid-32bit + emul32 + 32-bit shared libraries for libuuid + emul32 + + glibc-32bit + + + /usr/lib32/libuuid.* + + + + + libblkid-32bit + emul32 + 32-bit shared libraries for libblkid + emul32 + + libblkid + libuuid-32bit + libuuid + glibc-32bit + + + /usr/lib32/libblkid.* + + + + + + 2015-04-01 + 2.26.1 + Version bump. + Ertuğrul Erata + ertugrulerata@gmail.com + + + 2014-05-11 + 2.24.1 + Release bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-04-08 + 2.24.1 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2014-01-20 + 2.24 + Version bump. + Marcin Bojara + marcin@pisilinux.org + + + 2013-07-27 + 2.22.2 + Move pc files to devel pack, rebuild + PisiLinux Community + admins@pisilinux.org + + + 2013-07-26 + 2.22.2 + Release bump for rebuild. + PisiLinux Community + admins@pisilinux.org + + + 2013-01-14 + 2.22.2 + New release + PisiLinux Community + admins@pisilinux.org + + + 2012-11-17 + 2.22.1 + First release + Marcin Bojara + marcin@pisilinux.org + + + diff --git a/system/base/util-linux/translations.xml b/system/base/util-linux/translations.xml new file mode 100644 index 0000000000..5f4eb08dc4 --- /dev/null +++ b/system/base/util-linux/translations.xml @@ -0,0 +1,29 @@ + + + + util-linux + Çeşitli kullanışlı Linux araçları + Divers utilitaires Linux utiles. + util-linux paketi, bir Linux sisteminin işlevsel olması için gerekli olan birçok düşük seviye sistem uygulamasını içerir. + + + + libuuid + UUID üretimi için bir kitaplık + + + + libblkid + Disk tanımlama için bir kitaplık + + + + uuidd + Zaman tabanlı UUID'lerin benzersizliğini garantileyen sistem hizmeti + + + + libuuid-32bit + libuuid için 32-bit paylaşımlı kitaplıklar + +