X-Git-Url: http://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=pppd%2Fauth.c;h=ec137109141fa6428eed257862326aaf6048afff;hp=7457eda227bf19c2d09b79dd4e0b031da6bc1bf9;hb=HEAD;hpb=d34159f417620eb7c481bf53f29fe04c86ccd223

diff --git a/pppd/auth.c b/pppd/auth.c
index 7457eda..ecd30ba 100644
--- a/pppd/auth.c
+++ b/pppd/auth.c
@@ -17,7 +17,7 @@
  * 3. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by Paul Mackerras
- *     <paulus@samba.org>".
+ *     <paulus@ozlabs.org>".
  *
  * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
  * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
@@ -70,6 +70,10 @@
 
 #define RCSID	"$Id: auth.c,v 1.117 2008/07/01 12:27:56 paulus Exp $"
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include <stdio.h>
 #include <stddef.h>
 #include <stdlib.h>
@@ -78,6 +82,7 @@
 #include <pwd.h>
 #include <grp.h>
 #include <string.h>
+#include <strings.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
@@ -92,7 +97,7 @@
 #include <arpa/inet.h>
 
 
-#ifdef HAS_SHADOW
+#ifdef HAVE_SHADOW_H
 #include <shadow.h>
 #ifndef PW_PPP
 #define PW_PPP PW_LOGIN
@@ -100,26 +105,34 @@
 #endif
 #include <time.h>
 
+#ifdef HAVE_CRYPT_H
+#include <crypt.h>
+#endif
+
 #ifdef SYSTEMD
 #include <systemd/sd-daemon.h>
 #endif
 
-#include "pppd.h"
+#include "pppd-private.h"
+#include "options.h"
 #include "fsm.h"
 #include "lcp.h"
 #include "ccp.h"
 #include "ecp.h"
 #include "ipcp.h"
 #include "upap.h"
-#include "chap-new.h"
+#include "chap.h"
 #include "eap.h"
-#ifdef CBCP_SUPPORT
+#ifdef PPP_WITH_EAPTLS
+#include "eap-tls.h"
+#endif
+#ifdef PPP_WITH_CBCP
 #include "cbcp.h"
 #endif
+#include "multilink.h"
 #include "pathnames.h"
 #include "session.h"
 
-static const char rcsid[] = RCSID;
 
 /* Bits in scan_authfile return value */
 #define NONWILD_SERVER	1
@@ -165,39 +178,37 @@ static int passwd_from_file;
 static bool default_auth;
 
 /* Hook to enable a plugin to control the idle time limit */
-int (*idle_time_hook) __P((struct ppp_idle *)) = NULL;
+int (*idle_time_hook)(struct ppp_idle *) = NULL;
 
 /* Hook for a plugin to say whether we can possibly authenticate any peer */
-int (*pap_check_hook) __P((void)) = NULL;
+pap_check_hook_fn *pap_check_hook = NULL;
 
 /* Hook for a plugin to check the PAP user and password */
-int (*pap_auth_hook) __P((char *user, char *passwd, char **msgp,
-			  struct wordlist **paddrs,
-			  struct wordlist **popts)) = NULL;
+pap_auth_hook_fn *pap_auth_hook = NULL;
 
 /* Hook for a plugin to know about the PAP user logout */
-void (*pap_logout_hook) __P((void)) = NULL;
+pap_logout_hook_fn *pap_logout_hook = NULL;
 
 /* Hook for a plugin to get the PAP password for authenticating us */
-int (*pap_passwd_hook) __P((char *user, char *passwd)) = NULL;
+pap_passwd_hook_fn *pap_passwd_hook = NULL;
 
 /* Hook for a plugin to say if we can possibly authenticate a peer using CHAP */
-int (*chap_check_hook) __P((void)) = NULL;
+chap_check_hook_fn *chap_check_hook = NULL;
 
 /* Hook for a plugin to get the CHAP password for authenticating us */
-int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL;
+chap_passwd_hook_fn *chap_passwd_hook = NULL;
+
+#ifdef PPP_WITH_EAPTLS
+/* Hook for a plugin to get the EAP-TLS password for authenticating us */
+eaptls_passwd_hook_fn *eaptls_passwd_hook = NULL;
+#endif
 
 /* Hook for a plugin to say whether it is OK if the peer
    refuses to authenticate. */
-int (*null_auth_hook) __P((struct wordlist **paddrs,
-			   struct wordlist **popts)) = NULL;
+int (*null_auth_hook)(struct wordlist **paddrs,
+		      struct wordlist **popts) = NULL;
 
-int (*allowed_address_hook) __P((u_int32_t addr)) = NULL;
-
-#ifdef HAVE_MULTILINK
-/* Hook for plugin to hear when an interface joins a multilink bundle */
-void (*multilink_join_hook) __P((void)) = NULL;
-#endif
+int (*allowed_address_hook)(u_int32_t addr) = NULL;
 
 /* A notifier for when the peer has authenticated itself,
    and we are proceeding to the network phase. */
@@ -228,7 +239,7 @@ bool cryptpap = 0;		/* Passwords in pap-secrets are encrypted */
 bool refuse_pap = 0;		/* Don't wanna auth. ourselves with PAP */
 bool refuse_chap = 0;		/* Don't wanna auth. ourselves with CHAP */
 bool refuse_eap = 0;		/* Don't wanna auth. ourselves with EAP */
-#ifdef CHAPMS
+#ifdef PPP_WITH_CHAPMS
 bool refuse_mschap = 0;		/* Don't wanna auth. ourselves with MS-CHAP */
 bool refuse_mschap_v2 = 0;	/* Don't wanna auth. ourselves with MS-CHAPv2 */
 #else
@@ -243,45 +254,70 @@ bool explicit_user = 0;		/* Set if "user" option supplied */
 bool explicit_passwd = 0;	/* Set if "password" option supplied */
 char remote_name[MAXNAMELEN];	/* Peer's name for authentication */
 
-static char *uafname;		/* name of most recent +ua file */
+#if defined(PPP_WITH_EAPTLS) || defined(PPP_WITH_PEAP)
+char *cacert_file  = NULL;  /* CA certificate file (pem format) */
+char *ca_path      = NULL;  /* Directory with CA certificates */
+char *crl_dir      = NULL;  /* Directory containing CRL files */
+char *crl_file     = NULL;  /* Certificate Revocation List (CRL) file (pem format) */
+char *max_tls_version = NULL;   /* Maximum TLS protocol version (default=1.2) */
+char *tls_verify_method = NULL; /* Verify certificate method */
+bool  tls_verify_key_usage = 0; /* Verify peer certificate key usage */
+#endif
 
-extern char *crypt __P((const char *, const char *));
+#if defined(PPP_WITH_EAPTLS)
+char *cert_file    = NULL;  /* Client certificate file (pem format) */
+char *privkey_file = NULL;  /* Client private key file (pem format) */
+char *pkcs12_file  = NULL;  /* Client private key envelope file (pkcs12 format) */
+bool need_peer_eap = 0;	    /* Require peer to authenticate us */
+#endif
+
+static char *uafname;		/* name of most recent +ua file */
 
 /* Prototypes for procedures local to this file. */
 
-static void network_phase __P((int));
-static void check_idle __P((void *));
-static void connect_time_expired __P((void *));
-static int  null_login __P((int));
-static int  get_pap_passwd __P((char *));
-static int  have_pap_secret __P((int *));
-static int  have_chap_secret __P((char *, char *, int, int *));
-static int  have_srp_secret __P((char *client, char *server, int need_ip,
-    int *lacks_ipp));
-static int  ip_addr_check __P((u_int32_t, struct permitted_ip *));
-static int  scan_authfile __P((FILE *, char *, char *, char *,
-			       struct wordlist **, struct wordlist **,
-			       char *, int));
-static void free_wordlist __P((struct wordlist *));
-static void auth_script __P((char *));
-static void auth_script_done __P((void *));
-static void set_allowed_addrs __P((int, struct wordlist *, struct wordlist *));
-static int  some_ip_ok __P((struct wordlist *));
-static int  setupapfile __P((char **));
-static int  privgroup __P((char **));
-static int  set_noauth_addr __P((char **));
-static int  set_permitted_number __P((char **));
-static void check_access __P((FILE *, char *));
-static int  wordlist_count __P((struct wordlist *));
-
-#ifdef MAXOCTETS
-static void check_maxoctets __P((void *));
+static void network_phase (int);
+static void check_idle (void *);
+static void connect_time_expired (void *);
+static int  null_login (int);
+static int  get_pap_passwd (char *);
+static int  have_pap_secret (int *);
+static int  have_chap_secret (char *, char *, int, int *);
+static int  have_srp_secret(char *client, char *server, int need_ip,
+    int *lacks_ipp);
+
+#ifdef PPP_WITH_EAPTLS
+static int  have_eaptls_secret_server
+(char *client, char *server, int need_ip, int *lacks_ipp);
+static int  have_eaptls_secret_client (char *client, char *server);
+static int  scan_authfile_eaptls(FILE * f, char *client, char *server,
+			       char *cli_cert, char *serv_cert,
+			       char *ca_cert, char *pk,
+			       struct wordlist ** addrs,
+			       struct wordlist ** opts,
+			       char *filename, int flags);
 #endif
 
+static int  ip_addr_check (u_int32_t, struct permitted_ip *);
+static int  scan_authfile(FILE *, char *, char *, char *,
+			  struct wordlist **, struct wordlist **,
+			  char *, int);
+static void free_wordlist (struct wordlist *);
+static void auth_script (char *);
+static void auth_script_done (void *);
+static void set_allowed_addrs (int, struct wordlist *, struct wordlist *);
+static int  some_ip_ok (struct wordlist *);
+static int  setupapfile (char **);
+static int  privgroup (char **);
+static int  set_noauth_addr (char **);
+static int  set_permitted_number (char **);
+static void check_access (FILE *, char *);
+static int  wordlist_count (struct wordlist *);
+static void check_maxoctets (void *);
+
 /*
  * Authentication-related options.
  */
-option_t auth_options[] = {
+struct option auth_options[] = {
     { "auth", o_bool, &auth_required,
       "Require authentication from peer", OPT_PRIO | 1 },
     { "noauth", o_bool, &auth_required,
@@ -301,7 +337,7 @@ option_t auth_options[] = {
       "Require CHAP authentication from peer",
       OPT_ALIAS | OPT_PRIOSUB | OPT_A2OR | MDTYPE_MD5,
       &lcp_wantoptions[0].chap_mdtype },
-#ifdef CHAPMS
+#ifdef PPP_WITH_CHAPMS
     { "require-mschap", o_bool, &auth_required,
       "Require MS-CHAP authentication from peer",
       OPT_PRIOSUB | OPT_A2OR | MDTYPE_MICROSOFT,
@@ -332,7 +368,7 @@ option_t auth_options[] = {
       "Don't allow CHAP authentication with peer",
       OPT_ALIAS | OPT_A2CLRB | MDTYPE_MD5,
       &lcp_allowoptions[0].chap_mdtype },
-#ifdef CHAPMS
+#ifdef PPP_WITH_CHAPMS
     { "refuse-mschap", o_bool, &refuse_mschap,
       "Don't agree to auth to peer with MS-CHAP",
       OPT_A2CLRB | MDTYPE_MICROSOFT,
@@ -405,15 +441,64 @@ option_t auth_options[] = {
       "Set telephone number(s) which are allowed to connect",
       OPT_PRIV | OPT_A2LIST },
 
+#if defined(PPP_WITH_EAPTLS) || defined(PPP_WITH_PEAP)
+    { "ca", o_string, &cacert_file,     "CA certificate in PEM format" },
+    { "capath", o_string, &ca_path,     "TLS CA certificate directory" },
+    { "crl-dir", o_string, &crl_dir,    "Use CRLs in directory" },
+    { "crl", o_string, &crl_file,       "Use specific CRL file" },
+    { "max-tls-version", o_string, &max_tls_version,
+      "Maximum TLS version (1.0/1.1/1.2 (default)/1.3)" },
+    { "tls-verify-key-usage", o_bool, &tls_verify_key_usage,
+      "Verify certificate type and extended key usage" },
+    { "tls-verify-method", o_string, &tls_verify_method,
+      "Verify peer by method (none|subject|name|suffix)" },
+#endif
+
+#if defined(PPP_WITH_EAPTLS)
+    { "cert", o_string, &cert_file,     "client certificate in PEM format" },
+    { "key", o_string, &privkey_file,   "client private key in PEM format" },
+    { "pkcs12", o_string, &pkcs12_file, "EAP-TLS client credentials in PKCS12 format" },
+    { "need-peer-eap", o_bool, &need_peer_eap,
+      "Require the peer to authenticate us", 1 },
+#endif /* PPP_WITH_EAPTLS */
     { NULL }
 };
 
+const char *
+ppp_remote_name()
+{
+    return remote_name;
+}
+
+const char *
+ppp_get_remote_number(void)
+{
+    return remote_number;
+}
+
+void
+ppp_set_remote_number(const char *buf)
+{
+    if (buf) {
+        strlcpy(remote_number, buf, sizeof(remote_number));
+    }
+}
+
+const char *
+ppp_peer_authname(char *buf, size_t bufsz)
+{
+    if (buf && bufsz > 0) {
+        strlcpy(buf, peer_authname, bufsz);
+        return buf;
+    }
+    return peer_authname;
+}
+
 /*
  * setupapfile - specifies UPAP info for authenticating with peer.
  */
 static int
-setupapfile(argv)
-    char **argv;
+setupapfile(char **argv)
 {
     FILE *ufile;
     int l;
@@ -429,14 +514,16 @@ setupapfile(argv)
 	novm("+ua file name");
     euid = geteuid();
     if (seteuid(getuid()) == -1) {
-	option_error("unable to reset uid before opening %s: %m", fname);
+	ppp_option_error("unable to reset uid before opening %s: %m", fname);
+        free(fname);
 	return 0;
     }
     ufile = fopen(fname, "r");
     if (seteuid(euid) == -1)
 	fatal("unable to regain privileges: %m");
     if (ufile == NULL) {
-	option_error("unable to open user login data file %s", fname);
+	ppp_option_error("unable to open user login data file %s", fname);
+        free(fname);
 	return 0;
     }
     check_access(ufile, fname);
@@ -446,7 +533,8 @@ setupapfile(argv)
     if (fgets(u, MAXNAMELEN - 1, ufile) == NULL
 	|| fgets(p, MAXSECRETLEN - 1, ufile) == NULL) {
 	fclose(ufile);
-	option_error("unable to read user login data file %s", fname);
+	ppp_option_error("unable to read user login data file %s", fname);
+        free(fname);
 	return 0;
     }
     fclose(ufile);
@@ -468,6 +556,7 @@ setupapfile(argv)
 	explicit_passwd = 1;
     }
 
+    free(fname);
     return (1);
 }
 
@@ -476,15 +565,14 @@ setupapfile(argv)
  * privgroup - allow members of the group to have privileged access.
  */
 static int
-privgroup(argv)
-    char **argv;
+privgroup(char **argv)
 {
     struct group *g;
     int i;
 
     g = getgrnam(*argv);
     if (g == 0) {
-	option_error("group %s is unknown", *argv);
+	ppp_option_error("group %s is unknown", *argv);
 	return 0;
     }
     for (i = 0; i < ngroups; ++i) {
@@ -502,8 +590,7 @@ privgroup(argv)
  * Equivalent to specifying an entry like `"" * "" addr' in pap-secrets.
  */
 static int
-set_noauth_addr(argv)
-    char **argv;
+set_noauth_addr(char **argv)
 {
     char *addr = *argv;
     int l = strlen(addr) + 1;
@@ -524,8 +611,7 @@ set_noauth_addr(argv)
  * set_permitted_number - set remote telephone number(s) that may connect.
  */
 static int
-set_permitted_number(argv)
-    char **argv;
+set_permitted_number(char **argv)
 {
     char *number = *argv;
     int l = strlen(number) + 1;
@@ -546,18 +632,16 @@ set_permitted_number(argv)
  * An Open on LCP has requested a change from Dead to Establish phase.
  */
 void
-link_required(unit)
-    int unit;
+link_required(int unit)
 {
 }
 
 /*
  * Bring the link up to the point of being able to do ppp.
  */
-void start_link(unit)
-    int unit;
+void start_link(int unit)
 {
-    status = EXIT_CONNECT_FAILED;
+    ppp_set_status(EXIT_CONNECT_FAILED);
     new_phase(PHASE_SERIALCONN);
 
     hungup = 0;
@@ -575,7 +659,7 @@ void start_link(unit)
      */
     fd_ppp = the_channel->establish_ppp(devfd);
     if (fd_ppp < 0) {
-	status = EXIT_FATAL_ERROR;
+	ppp_set_status(EXIT_FATAL_ERROR);
 	goto disconnect;
     }
 
@@ -587,12 +671,12 @@ void start_link(unit)
      * incoming events (reply, timeout, etc.).
      */
     if (ifunit >= 0)
-	notice("Connect: %s <--> %s", ifname, ppp_devnam);
+	notice("Connect: %s <--> %s", ifname, ppp_devname);
     else
-	notice("Starting negotiation on %s", ppp_devnam);
+	notice("Starting negotiation on %s", ppp_devname);
     add_fd(fd_ppp);
 
-    status = EXIT_NEGOTIATION_FAILED;
+    ppp_set_status(EXIT_NEGOTIATION_FAILED);
     new_phase(PHASE_ESTABLISH);
 
     lcp_lowerup(0);
@@ -614,10 +698,9 @@ void start_link(unit)
  * physical layer down.
  */
 void
-link_terminated(unit)
-    int unit;
+link_terminated(int unit)
 {
-    if (phase == PHASE_DEAD || phase == PHASE_MASTER)
+    if (in_phase(PHASE_DEAD) || in_phase(PHASE_MASTER))
 	return;
     new_phase(PHASE_DISCONNECT);
 
@@ -626,7 +709,7 @@ link_terminated(unit)
     }
     session_end(devnam);
 
-    if (!doing_multilink) {
+    if (!mp_on()) {
 	notice("Connection terminated.");
 	print_link_stats();
     } else
@@ -637,9 +720,8 @@ link_terminated(unit)
      * can happen that another pppd gets the same unit and then
      * we delete its pid file.
      */
-    if (!doing_multilink && !demand)
+    if (!demand && !mp_on())
 	remove_pidfiles();
-
     /*
      * If we may want to bring the link up again, transfer
      * the ppp unit back to the loopback.  Set the
@@ -649,14 +731,14 @@ link_terminated(unit)
 	remove_fd(fd_ppp);
 	clean_check();
 	the_channel->disestablish_ppp(devfd);
-	if (doing_multilink)
+	if (mp_on())
 	    mp_exit_bundle();
 	fd_ppp = -1;
     }
     if (!hungup)
 	lcp_lowerdown(0);
-    if (!doing_multilink && !demand)
-	script_unsetenv("IFNAME");
+    if (!mp_on() && !demand)
+	ppp_script_unsetenv("IFNAME");
 
     /*
      * Run disconnector script, if requested.
@@ -669,7 +751,7 @@ link_terminated(unit)
     if (the_channel->cleanup)
 	(*the_channel->cleanup)();
 
-    if (doing_multilink && multilink_master) {
+    if (mp_on() && mp_master()) {
 	if (!bundle_terminating) {
 	    new_phase(PHASE_MASTER);
 	    if (master_detach && !detached)
@@ -684,21 +766,21 @@ link_terminated(unit)
  * LCP has gone down; it will either die or try to re-establish.
  */
 void
-link_down(unit)
-    int unit;
+link_down(int unit)
 {
     if (auth_state != s_down) {
 	notify(link_down_notifier, 0);
 	auth_state = s_down;
 	if (auth_script_state == s_up && auth_script_pid == 0) {
-	    update_link_stats(unit);
+	    ppp_get_link_stats(NULL);
 	    auth_script_state = s_down;
-	    auth_script(_PATH_AUTHDOWN);
+	    auth_script(PPP_PATH_AUTHDOWN);
 	}
     }
-    if (!doing_multilink) {
+    if (!mp_on())
+    {
 	upper_layers_down(unit);
-	if (phase != PHASE_DEAD && phase != PHASE_MASTER)
+	if (!in_phase(PHASE_DEAD) && !in_phase(PHASE_MASTER))
 	    new_phase(PHASE_ESTABLISH);
     }
     /* XXX if doing_multilink, should do something to stop
@@ -727,26 +809,26 @@ void upper_layers_down(int unit)
  * Proceed to the Dead, Authenticate or Network phase as appropriate.
  */
 void
-link_established(unit)
-    int unit;
+link_established(int unit)
 {
     int auth;
     lcp_options *wo = &lcp_wantoptions[unit];
     lcp_options *go = &lcp_gotoptions[unit];
     lcp_options *ho = &lcp_hisoptions[unit];
+#ifdef PPP_WITH_EAPTLS
+    lcp_options *ao = &lcp_allowoptions[unit];
+#endif
     int i;
     struct protent *protp;
 
     /*
      * Tell higher-level protocols that LCP is up.
      */
-    if (!doing_multilink) {
+    if (!mp_on())
 	for (i = 0; (protp = protocols[i]) != NULL; ++i)
 	    if (protp->protocol != PPP_LCP && protp->enabled_flag
 		&& protp->lowerup != NULL)
 		(*protp->lowerup)(unit);
-    }
-
     if (!auth_required && noauth_addrs != NULL)
 	set_allowed_addrs(unit, NULL, NULL);
 
@@ -762,12 +844,28 @@ link_established(unit)
 	    set_allowed_addrs(unit, NULL, NULL);
 	} else if (!wo->neg_upap || uselogin || !null_login(unit)) {
 	    warn("peer refused to authenticate: terminating link");
-	    status = EXIT_PEER_AUTH_FAILED;
+	    ppp_set_status(EXIT_PEER_AUTH_FAILED);
 	    lcp_close(unit, "peer refused to authenticate");
 	    return;
 	}
     }
 
+#ifdef PPP_WITH_EAPTLS
+    if (need_peer_eap && !ao->neg_eap) {
+	warn("eap required to authenticate us but no suitable secrets");
+	lcp_close(unit, "couldn't negotiate eap");
+	ppp_set_status(EXIT_AUTH_TOPEER_FAILED);
+	return;
+    }
+
+    if (need_peer_eap && !ho->neg_eap) {
+	warn("peer doesn't want to authenticate us with eap");
+	lcp_close(unit, "couldn't negotiate eap");
+	ppp_set_status(EXIT_PEER_AUTH_FAILED);
+	return;
+    }
+#endif
+
     new_phase(PHASE_AUTHENTICATE);
     auth = 0;
     if (go->neg_eap) {
@@ -808,8 +906,7 @@ link_established(unit)
  * Proceed to the network phase.
  */
 static void
-network_phase(unit)
-    int unit;
+network_phase(int unit)
 {
     lcp_options *go = &lcp_gotoptions[unit];
 
@@ -820,16 +917,16 @@ network_phase(unit)
     /*
      * If the peer had to authenticate, run the auth-up script now.
      */
+    notify(auth_up_notifier, 0);
     if (go->neg_chap || go->neg_upap || go->neg_eap) {
-	notify(auth_up_notifier, 0);
 	auth_state = s_up;
 	if (auth_script_state == s_down && auth_script_pid == 0) {
 	    auth_script_state = s_up;
-	    auth_script(_PATH_AUTHUP);
+	    auth_script(PPP_PATH_AUTHUP);
 	}
     }
 
-#ifdef CBCP_SUPPORT
+#ifdef PPP_WITH_CBCP
     /*
      * If we negotiated callback, do it now.
      */
@@ -852,8 +949,7 @@ network_phase(unit)
 }
 
 void
-start_networks(unit)
-    int unit;
+start_networks(int unit)
 {
     int i;
     struct protent *protp;
@@ -861,7 +957,7 @@ start_networks(unit)
 
     new_phase(PHASE_NETWORK);
 
-#ifdef HAVE_MULTILINK
+#ifdef PPP_WITH_MULTILINK
     if (multilink) {
 	if (mp_join_bundle()) {
 	    if (multilink_join_hook)
@@ -871,9 +967,9 @@ start_networks(unit)
 	    return;
 	}
     }
-#endif /* HAVE_MULTILINK */
+#endif /* PPP_WITH_MULTILINK */
 
-#ifdef PPP_FILTER
+#ifdef PPP_WITH_FILTER
     if (!demand)
 	set_filters(&pass_filter, &active_filter);
 #endif
@@ -893,8 +989,7 @@ start_networks(unit)
 }
 
 void
-continue_networks(unit)
-    int unit;
+continue_networks(int unit)
 {
     int i;
     struct protent *protp;
@@ -919,13 +1014,12 @@ continue_networks(unit)
  * The peer has failed to authenticate himself using `protocol'.
  */
 void
-auth_peer_fail(unit, protocol)
-    int unit, protocol;
+auth_peer_fail(int unit, int protocol)
 {
     /*
      * Authentication failure: take the link down
      */
-    status = EXIT_PEER_AUTH_FAILED;
+    ppp_set_status(EXIT_PEER_AUTH_FAILED);
     lcp_close(unit, "Authentication failed");
 }
 
@@ -933,10 +1027,8 @@ auth_peer_fail(unit, protocol)
  * The peer has been successfully authenticated using `protocol'.
  */
 void
-auth_peer_success(unit, protocol, prot_flavor, name, namelen)
-    int unit, protocol, prot_flavor;
-    char *name;
-    int namelen;
+auth_peer_success(int unit, int protocol, int prot_flavor,
+		  char *name, int namelen)
 {
     int bit;
 
@@ -947,7 +1039,7 @@ auth_peer_success(unit, protocol, prot_flavor, name, namelen)
 	case CHAP_MD5:
 	    bit |= CHAP_MD5_PEER;
 	    break;
-#ifdef CHAPMS
+#ifdef PPP_WITH_CHAPMS
 	case CHAP_MICROSOFT:
 	    bit |= CHAP_MS_PEER;
 	    break;
@@ -975,7 +1067,7 @@ auth_peer_success(unit, protocol, prot_flavor, name, namelen)
 	namelen = sizeof(peer_authname) - 1;
     BCOPY(name, peer_authname, namelen);
     peer_authname[namelen] = 0;
-    script_setenv("PEERNAME", peer_authname, 0);
+    ppp_script_setenv("PEERNAME", peer_authname, 0);
 
     /* Save the authentication method for later. */
     auth_done[unit] |= bit;
@@ -992,8 +1084,7 @@ auth_peer_success(unit, protocol, prot_flavor, name, namelen)
  * We have failed to authenticate ourselves to the peer using `protocol'.
  */
 void
-auth_withpeer_fail(unit, protocol)
-    int unit, protocol;
+auth_withpeer_fail(int unit, int protocol)
 {
     if (passwd_from_file)
 	BZERO(passwd, MAXSECRETLEN);
@@ -1003,7 +1094,7 @@ auth_withpeer_fail(unit, protocol)
      * is no point in persisting without any way to get updated
      * authentication secrets.
      */
-    status = EXIT_AUTH_TOPEER_FAILED;
+    ppp_set_status(EXIT_AUTH_TOPEER_FAILED);
     lcp_close(unit, "Failed to authenticate ourselves to peer");
 }
 
@@ -1011,8 +1102,7 @@ auth_withpeer_fail(unit, protocol)
  * We have successfully authenticated ourselves with the peer using `protocol'.
  */
 void
-auth_withpeer_success(unit, protocol, prot_flavor)
-    int unit, protocol, prot_flavor;
+auth_withpeer_success(int unit, int protocol, int prot_flavor)
 {
     int bit;
     const char *prot = "";
@@ -1025,7 +1115,7 @@ auth_withpeer_success(unit, protocol, prot_flavor)
 	case CHAP_MD5:
 	    bit |= CHAP_MD5_WITHPEER;
 	    break;
-#ifdef CHAPMS
+#ifdef PPP_WITH_CHAPMS
 	case CHAP_MICROSOFT:
 	    bit |= CHAP_MS_WITHPEER;
 	    break;
@@ -1068,8 +1158,7 @@ auth_withpeer_success(unit, protocol, prot_flavor)
  * np_up - a network protocol has come up.
  */
 void
-np_up(unit, proto)
-    int unit, proto;
+np_up(int unit, int proto)
 {
     int tlim;
 
@@ -1077,14 +1166,14 @@ np_up(unit, proto)
 	/*
 	 * At this point we consider that the link has come up successfully.
 	 */
-	status = EXIT_OK;
+	ppp_set_status(EXIT_OK);
 	unsuccess = 0;
 	new_phase(PHASE_RUNNING);
 
 	if (idle_time_hook != 0)
 	    tlim = (*idle_time_hook)(NULL);
 	else
-	    tlim = idle_time_limit;
+	    tlim = ppp_get_max_idle_time();
 	if (tlim > 0)
 	    TIMEOUT(check_idle, NULL, tlim);
 
@@ -1092,13 +1181,15 @@ np_up(unit, proto)
 	 * Set a timeout to close the connection once the maximum
 	 * connect time has expired.
 	 */
-	if (maxconnect > 0)
-	    TIMEOUT(connect_time_expired, 0, maxconnect);
+	if (ppp_get_max_connect_time() > 0)
+	    TIMEOUT(connect_time_expired, 0, ppp_get_max_connect_time());
 
-#ifdef MAXOCTETS
+	/*
+	 * Configure a check to see if session has outlived it's limit
+	 *   in terms of octets
+	 */
 	if (maxoctets > 0)
 	    TIMEOUT(check_maxoctets, NULL, maxoctets_timeout);
-#endif
 
 	/*
 	 * Detach now, if the updetach option was given.
@@ -1120,15 +1211,12 @@ np_up(unit, proto)
  * np_down - a network protocol has gone down.
  */
 void
-np_down(unit, proto)
-    int unit, proto;
+np_down(int unit, int proto)
 {
     if (--num_np_up == 0) {
 	UNTIMEOUT(check_idle, NULL);
 	UNTIMEOUT(connect_time_expired, NULL);
-#ifdef MAXOCTETS
 	UNTIMEOUT(check_maxoctets, NULL);
-#endif	
 	new_phase(PHASE_NETWORK);
     }
 }
@@ -1137,8 +1225,7 @@ np_down(unit, proto)
  * np_finished - a network protocol has finished using the link.
  */
 void
-np_finished(unit, proto)
-    int unit, proto;
+np_finished(int unit, int proto)
 {
     if (--num_np_open <= 0) {
 	/* no further use for the link: shut up shop. */
@@ -1146,49 +1233,53 @@ np_finished(unit, proto)
     }
 }
 
-#ifdef MAXOCTETS
+/*
+ * Periodic callback to check if session has reached its limit. The period defaults
+ * to 1 second and is configurable by setting "mo-timeout" in configuration
+ */
 static void
-check_maxoctets(arg)
-    void *arg;
+check_maxoctets(void *arg)
 {
-    unsigned int used;
-
-    update_link_stats(ifunit);
-    link_stats_valid=0;
-    
-    switch(maxoctets_dir) {
-	case PPP_OCTETS_DIRECTION_IN:
-	    used = link_stats.bytes_in;
-	    break;
-	case PPP_OCTETS_DIRECTION_OUT:
-	    used = link_stats.bytes_out;
-	    break;
-	case PPP_OCTETS_DIRECTION_MAXOVERAL:
-	case PPP_OCTETS_DIRECTION_MAXSESSION:
-	    used = (link_stats.bytes_in > link_stats.bytes_out) ? link_stats.bytes_in : link_stats.bytes_out;
-	    break;
-	default:
-	    used = link_stats.bytes_in+link_stats.bytes_out;
-	    break;
+    unsigned int used = 0;
+    ppp_link_stats_st stats;
+
+    if (ppp_get_link_stats(&stats)) {
+        switch(maxoctets_dir) {
+            case PPP_OCTETS_DIRECTION_IN:
+                used = stats.bytes_in;
+                break;
+            case PPP_OCTETS_DIRECTION_OUT:
+                used = stats.bytes_out;
+                break;
+            case PPP_OCTETS_DIRECTION_MAXOVERAL:
+            case PPP_OCTETS_DIRECTION_MAXSESSION:
+                used = (stats.bytes_in > stats.bytes_out)
+                                ? stats.bytes_in
+                                : stats.bytes_out;
+                break;
+            default:
+                used = stats.bytes_in+stats.bytes_out;
+                break;
+        }
     }
+
     if (used > maxoctets) {
 	notice("Traffic limit reached. Limit: %u Used: %u", maxoctets, used);
-	status = EXIT_TRAFFIC_LIMIT;
+	ppp_set_status(EXIT_TRAFFIC_LIMIT);
 	lcp_close(0, "Traffic limit");
+	link_stats_print = 0;
 	need_holdoff = 0;
     } else {
         TIMEOUT(check_maxoctets, NULL, maxoctets_timeout);
     }
 }
-#endif
 
 /*
  * check_idle - check whether the link has been idle for long
  * enough that we can shut it down.
  */
 static void
-check_idle(arg)
-    void *arg;
+check_idle(void *arg)
 {
     struct ppp_idle idle;
     time_t itime;
@@ -1200,12 +1291,12 @@ check_idle(arg)
 	tlim = idle_time_hook(&idle);
     } else {
 	itime = MIN(idle.xmit_idle, idle.recv_idle);
-	tlim = idle_time_limit - itime;
+	tlim = ppp_get_max_idle_time() - itime;
     }
     if (tlim <= 0) {
 	/* link is idle: shut it down. */
 	notice("Terminating connection due to lack of activity.");
-	status = EXIT_IDLE_TIMEOUT;
+	ppp_set_status(EXIT_IDLE_TIMEOUT);
 	lcp_close(0, "Link inactive");
 	need_holdoff = 0;
     } else {
@@ -1217,11 +1308,10 @@ check_idle(arg)
  * connect_time_expired - log a message and close the connection.
  */
 static void
-connect_time_expired(arg)
-    void *arg;
+connect_time_expired(void *arg)
 {
     info("Connect time expired");
-    status = EXIT_CONNECT_TIME;
+    ppp_set_status(EXIT_CONNECT_TIME);
     lcp_close(0, "Connect time expired");	/* Close connection */
 }
 
@@ -1229,7 +1319,7 @@ connect_time_expired(arg)
  * auth_check_options - called to check authentication options.
  */
 void
-auth_check_options()
+auth_check_options(void)
 {
     lcp_options *wo = &lcp_wantoptions[0];
     int can_auth;
@@ -1237,12 +1327,20 @@ auth_check_options()
 
     /* Default our_name to hostname, and user to our_name */
     if (our_name[0] == 0 || usehostname)
-	strlcpy(our_name, hostname, sizeof(our_name));
+        strlcpy(our_name, hostname, sizeof(our_name));
+
     /* If a blank username was explicitly given as an option, trust
        the user and don't use our_name */
     if (user[0] == 0 && !explicit_user)
 	strlcpy(user, our_name, sizeof(user));
 
+#if defined(SYSTEM_CA_PATH) && (defined(PPP_WITH_EAPTLS) || defined(PPP_WITH_PEAP))
+    /* Use system default for CA Path if not specified */
+    if (!ca_path) {
+        ca_path = SYSTEM_CA_PATH;
+    }
+#endif
+
     /*
      * If we have a default route, require the peer to authenticate
      * unless the noauth option was given or the real user is root.
@@ -1288,23 +1386,32 @@ auth_check_options()
 				    our_name, 1, &lacks_ip);
     }
 
+#ifdef PPP_WITH_EAPTLS
+    if (!can_auth && wo->neg_eap) {
+	can_auth =
+	    have_eaptls_secret_server((explicit_remote ? remote_name :
+				       NULL), our_name, 1, &lacks_ip);
+
+    }
+#endif
+
     if (auth_required && !can_auth && noauth_addrs == NULL) {
 	if (default_auth) {
-	    option_error(
+	    ppp_option_error(
 "By default the remote system is required to authenticate itself");
-	    option_error(
+	    ppp_option_error(
 "(because this system has a default route to the internet)");
 	} else if (explicit_remote)
-	    option_error(
+	    ppp_option_error(
 "The remote system (%s) is required to authenticate itself",
 			 remote_name);
 	else
-	    option_error(
+	    ppp_option_error(
 "The remote system is required to authenticate itself");
-	option_error(
+	ppp_option_error(
 "but I couldn't find any suitable secret (password) for it to use to do so.");
 	if (lacks_ip)
-	    option_error(
+	    ppp_option_error(
 "(None of the available passwords would let it use an IP address.)");
 
 	exit(1);
@@ -1325,8 +1432,7 @@ auth_check_options()
  * to use for authenticating ourselves and/or the peer.
  */
 void
-auth_reset(unit)
-    int unit;
+auth_reset(int unit)
 {
     lcp_options *go = &lcp_gotoptions[unit];
     lcp_options *ao = &lcp_allowoptions[unit];
@@ -1335,14 +1441,18 @@ auth_reset(unit)
     hadchap = -1;
     ao->neg_upap = !refuse_pap && (passwd[0] != 0 || get_pap_passwd(NULL));
     ao->neg_chap = (!refuse_chap || !refuse_mschap || !refuse_mschap_v2)
-	&& (passwd[0] != 0 ||
+	&& ((passwd[0] != 0 || explicit_passwd) ||
 	    (hadchap = have_chap_secret(user, (explicit_remote? remote_name:
 					       NULL), 0, NULL)));
     ao->neg_eap = !refuse_eap && (
 	passwd[0] != 0 ||
 	(hadchap == 1 || (hadchap == -1 && have_chap_secret(user,
 	    (explicit_remote? remote_name: NULL), 0, NULL))) ||
-	have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL));
+	have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)
+#ifdef PPP_WITH_EAPTLS
+		|| have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL))
+#endif
+	);
 
     hadchap = -1;
     if (go->neg_upap && !uselogin && !have_pap_secret(NULL))
@@ -1357,7 +1467,12 @@ auth_reset(unit)
 	    !have_chap_secret((explicit_remote? remote_name: NULL), our_name,
 		1, NULL))) &&
 	!have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1,
-	    NULL))
+	    NULL)
+#ifdef PPP_WITH_EAPTLS
+	 && !have_eaptls_secret_server((explicit_remote? remote_name: NULL),
+				   our_name, 1, NULL)
+#endif
+		)
 	go->neg_eap = 0;
 }
 
@@ -1373,13 +1488,9 @@ auth_reset(unit)
  * In either case, msg points to an appropriate message.
  */
 int
-check_passwd(unit, auser, userlen, apasswd, passwdlen, msg)
-    int unit;
-    char *auser;
-    int userlen;
-    char *apasswd;
-    int passwdlen;
-    char **msg;
+check_passwd(int unit,
+	     char *auser, int userlen,
+	     char *apasswd, int passwdlen, char **msg)
 {
     int ret;
     char *filename;
@@ -1421,7 +1532,7 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg)
      * Open the file of pap secrets and scan for a suitable secret
      * for authenticating this user.
      */
-    filename = _PATH_UPAPFILE;
+    filename = PPP_PATH_UPAPFILE;
     addrs = opts = NULL;
     ret = UPAP_AUTHNAK;
     f = fopen(filename, "r");
@@ -1453,8 +1564,10 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg)
 	    if (secret[0] != 0 && !login_secret) {
 		/* password given in pap-secrets - must match */
 		if (cryptpap || strcmp(passwd, secret) != 0) {
+#ifdef HAVE_CRYPT_H
 		    char *cbuf = crypt(passwd, secret);
 		    if (!cbuf || strcmp(cbuf, secret) != 0)
+#endif
 			ret = UPAP_AUTHNAK;
 		}
 	    }
@@ -1501,8 +1614,7 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg)
  * and return 1.
  */
 static int
-null_login(unit)
-    int unit;
+null_login(int unit)
 {
     char *filename;
     FILE *f;
@@ -1521,7 +1633,7 @@ null_login(unit)
      * Open the file of pap secrets and scan for a suitable secret.
      */
     if (ret <= 0) {
-	filename = _PATH_UPAPFILE;
+	filename = PPP_PATH_UPAPFILE;
 	addrs = NULL;
 	f = fopen(filename, "r");
 	if (f == NULL)
@@ -1552,8 +1664,7 @@ null_login(unit)
  * Assumes passwd points to MAXSECRETLEN bytes of space (if non-null).
  */
 static int
-get_pap_passwd(passwd)
-    char *passwd;
+get_pap_passwd(char *passwd)
 {
     char *filename;
     FILE *f;
@@ -1569,7 +1680,7 @@ get_pap_passwd(passwd)
 	    return ret;
     }
 
-    filename = _PATH_UPAPFILE;
+    filename = PPP_PATH_UPAPFILE;
     f = fopen(filename, "r");
     if (f == NULL)
 	return 0;
@@ -1592,8 +1703,7 @@ get_pap_passwd(passwd)
  * secrets that we could possibly use for authenticating the peer.
  */
 static int
-have_pap_secret(lacks_ipp)
-    int *lacks_ipp;
+have_pap_secret(int *lacks_ipp)
 {
     FILE *f;
     int ret;
@@ -1607,7 +1717,7 @@ have_pap_secret(lacks_ipp)
 	    return ret;
     }
 
-    filename = _PATH_UPAPFILE;
+    filename = PPP_PATH_UPAPFILE;
     f = fopen(filename, "r");
     if (f == NULL)
 	return 0;
@@ -1634,11 +1744,8 @@ have_pap_secret(lacks_ipp)
  * know the identity yet.
  */
 static int
-have_chap_secret(client, server, need_ip, lacks_ipp)
-    char *client;
-    char *server;
-    int need_ip;
-    int *lacks_ipp;
+have_chap_secret(char *client, char *server,
+		 int need_ip, int *lacks_ipp)
 {
     FILE *f;
     int ret;
@@ -1652,7 +1759,7 @@ have_chap_secret(client, server, need_ip, lacks_ipp)
 	}
     }
 
-    filename = _PATH_CHAPFILE;
+    filename = PPP_PATH_CHAPFILE;
     f = fopen(filename, "r");
     if (f == NULL)
 	return 0;
@@ -1683,18 +1790,14 @@ have_chap_secret(client, server, need_ip, lacks_ipp)
  * know the identity yet.
  */
 static int
-have_srp_secret(client, server, need_ip, lacks_ipp)
-    char *client;
-    char *server;
-    int need_ip;
-    int *lacks_ipp;
+have_srp_secret(char *client, char *server, int need_ip, int *lacks_ipp)
 {
     FILE *f;
     int ret;
     char *filename;
     struct wordlist *addrs;
 
-    filename = _PATH_SRPFILE;
+    filename = PPP_PATH_SRPFILE;
     f = fopen(filename, "r");
     if (f == NULL)
 	return 0;
@@ -1724,13 +1827,8 @@ have_srp_secret(client, server, need_ip, lacks_ipp)
  * (We could be either client or server).
  */
 int
-get_secret(unit, client, server, secret, secret_len, am_server)
-    int unit;
-    char *client;
-    char *server;
-    char *secret;
-    int *secret_len;
-    int am_server;
+get_secret(int unit, char *client, char *server,
+	   char *secret, int *secret_len, int am_server)
 {
     FILE *f;
     int ret, len;
@@ -1747,7 +1845,7 @@ get_secret(unit, client, server, secret, secret_len, am_server)
 	    return 0;
 	}
     } else {
-	filename = _PATH_CHAPFILE;
+	filename = PPP_PATH_CHAPFILE;
 	addrs = NULL;
 	secbuf[0] = 0;
 
@@ -1790,12 +1888,8 @@ get_secret(unit, client, server, secret, secret_len, am_server)
  * (We could be either client or server).
  */
 int
-get_srp_secret(unit, client, server, secret, am_server)
-    int unit;
-    char *client;
-    char *server;
-    char *secret;
-    int am_server;
+get_srp_secret(int unit, char *client, char *server,
+	       char *secret, int am_server)
 {
     FILE *fp;
     int ret;
@@ -1805,7 +1899,7 @@ get_srp_secret(unit, client, server, secret, am_server)
     if (!am_server && passwd[0] != '\0') {
 	strlcpy(secret, passwd, MAXWORDLEN);
     } else {
-	filename = _PATH_SRPFILE;
+	filename = PPP_PATH_SRPFILE;
 	addrs = NULL;
 
 	fp = fopen(filename, "r");
@@ -1839,10 +1933,8 @@ get_srp_secret(unit, client, server, secret, am_server)
  * and leaves the following words in extra_options.
  */
 static void
-set_allowed_addrs(unit, addrs, opts)
-    int unit;
-    struct wordlist *addrs;
-    struct wordlist *opts;
+set_allowed_addrs(int unit, struct wordlist *addrs,
+		  struct wordlist *opts)
 {
     int n;
     struct wordlist *ap, **plink;
@@ -1995,14 +2087,12 @@ set_allowed_addrs(unit, addrs, opts)
  * a given IP address.  Returns 1 if authorized, 0 otherwise.
  */
 int
-auth_ip_addr(unit, addr)
-    int unit;
-    u_int32_t addr;
+auth_ip_addr(int unit, u_int32_t addr)
 {
     int ok;
 
     /* don't allow loopback or multicast address */
-    if (bad_ip_adrs(addr))
+    if (ppp_bad_ip_addr(addr))
 	return 0;
 
     if (allowed_address_hook) {
@@ -2022,9 +2112,7 @@ auth_ip_addr(unit, addr)
 }
 
 static int
-ip_addr_check(addr, addrs)
-    u_int32_t addr;
-    struct permitted_ip *addrs;
+ip_addr_check(u_int32_t addr, struct permitted_ip *addrs)
 {
     for (; ; ++addrs)
 	if ((addr & addrs->mask) == addrs->base)
@@ -2032,13 +2120,10 @@ ip_addr_check(addr, addrs)
 }
 
 /*
- * bad_ip_adrs - return 1 if the IP address is one we don't want
- * to use, such as an address in the loopback net or a multicast address.
- * addr is in network byte order.
+ * Check if given addr in network byte order is in the looback network, or a multicast address.
  */
-int
-bad_ip_adrs(addr)
-    u_int32_t addr;
+bool
+ppp_bad_ip_addr(u_int32_t addr)
 {
     addr = ntohl(addr);
     return (addr >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET
@@ -2050,8 +2135,7 @@ bad_ip_adrs(addr)
  * IP address(es).
  */
 static int
-some_ip_ok(addrs)
-    struct wordlist *addrs;
+some_ip_ok(struct wordlist *addrs)
 {
     for (; addrs != 0; addrs = addrs->next) {
 	if (addrs->word[0] == '-')
@@ -2067,7 +2151,7 @@ some_ip_ok(addrs)
  * Returns 1 if authorized, 0 otherwise.
  */
 int
-auth_number()
+auth_number(void)
 {
     struct wordlist *wp = permitted_numbers;
     int l;
@@ -2094,9 +2178,7 @@ auth_number()
  * check_access - complain if a secret file has too-liberal permissions.
  */
 static void
-check_access(f, filename)
-    FILE *f;
-    char *filename;
+check_access(FILE *f, char *filename)
 {
     struct stat sbuf;
 
@@ -2124,15 +2206,10 @@ check_access(f, filename)
  * match.
  */
 static int
-scan_authfile(f, client, server, secret, addrs, opts, filename, flags)
-    FILE *f;
-    char *client;
-    char *server;
-    char *secret;
-    struct wordlist **addrs;
-    struct wordlist **opts;
-    char *filename;
-    int flags;
+scan_authfile(FILE *f, char *client, char *server,
+	      char *secret, struct wordlist **addrs,
+	      struct wordlist **opts, char *filename,
+	      int flags)
 {
     int newline, xxx;
     int got_flag, best_flag;
@@ -2287,8 +2364,7 @@ scan_authfile(f, client, server, secret, addrs, opts, filename, flags)
  * wordlist_count - return the number of items in a wordlist
  */
 static int
-wordlist_count(wp)
-    struct wordlist *wp;
+wordlist_count(struct wordlist *wp)
 {
     int n;
 
@@ -2301,8 +2377,7 @@ wordlist_count(wp)
  * free_wordlist - release memory allocated for a wordlist.
  */
 static void
-free_wordlist(wp)
-    struct wordlist *wp;
+free_wordlist(struct wordlist *wp)
 {
     struct wordlist *next;
 
@@ -2318,21 +2393,20 @@ free_wordlist(wp)
  * has finished.
  */
 static void
-auth_script_done(arg)
-    void *arg;
+auth_script_done(void *arg)
 {
     auth_script_pid = 0;
     switch (auth_script_state) {
     case s_up:
 	if (auth_state == s_down) {
 	    auth_script_state = s_down;
-	    auth_script(_PATH_AUTHDOWN);
+	    auth_script(PPP_PATH_AUTHDOWN);
 	}
 	break;
     case s_down:
 	if (auth_state == s_up) {
 	    auth_script_state = s_up;
-	    auth_script(_PATH_AUTHUP);
+	    auth_script(PPP_PATH_AUTHUP);
 	}
 	break;
     }
@@ -2343,8 +2417,7 @@ auth_script_done(arg)
  * interface-name peer-name real-user tty speed
  */
 static void
-auth_script(script)
-    char *script;
+auth_script(char *script)
 {
     char strspeed[32];
     struct passwd *pw;
@@ -2366,7 +2439,339 @@ auth_script(script)
     argv[3] = user_name;
     argv[4] = devnam;
     argv[5] = strspeed;
-    argv[6] = NULL;
+    argv[6] = ipparam;
+    argv[7] = NULL;
 
     auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0);
 }
+
+
+#ifdef PPP_WITH_EAPTLS
+static int
+have_eaptls_secret_server(char *client, char *server,
+			  int need_ip, int *lacks_ipp)
+{
+    FILE *f;
+    int ret;
+    char *filename;
+    struct wordlist *addrs;
+    char servcertfile[MAXWORDLEN];
+    char clicertfile[MAXWORDLEN];
+    char cacertfile[MAXWORDLEN];
+    char pkfile[MAXWORDLEN];
+
+    filename = PPP_PATH_EAPTLSSERVFILE;
+    f = fopen(filename, "r");
+    if (f == NULL)
+		return 0;
+
+    if (client != NULL && client[0] == 0)
+		client = NULL;
+    else if (server != NULL && server[0] == 0)
+		server = NULL;
+
+    ret =
+	scan_authfile_eaptls(f, client, server, clicertfile, servcertfile,
+			     cacertfile, pkfile, &addrs, NULL, filename,
+			     0);
+
+    fclose(f);
+
+/*
+    if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile,
+				clicertfile, pkfile))
+		ret = -1;
+*/
+
+	if (ret >= 0 && need_ip && !some_ip_ok(addrs)) {
+		if (lacks_ipp != 0)
+			*lacks_ipp = 1;
+		ret = -1;
+    }
+    if (addrs != 0)
+		free_wordlist(addrs);
+
+    return ret >= 0;
+}
+
+
+static int
+have_eaptls_secret_client(char *client, char *server)
+{
+    FILE *f;
+    int ret;
+    char *filename;
+    struct wordlist *addrs = NULL;
+    char servcertfile[MAXWORDLEN];
+    char clicertfile[MAXWORDLEN];
+    char cacertfile[MAXWORDLEN];
+    char pkfile[MAXWORDLEN];
+
+    if (client != NULL && client[0] == 0)
+		client = NULL;
+    else if (server != NULL && server[0] == 0)
+		server = NULL;
+
+	if ((cacert_file || ca_path) && cert_file && privkey_file)
+		return 1;
+	if (pkcs12_file)
+		return 1;
+
+    filename = PPP_PATH_EAPTLSCLIFILE;
+    f = fopen(filename, "r");
+    if (f == NULL)
+		return 0;
+
+    ret =
+	scan_authfile_eaptls(f, client, server, clicertfile, servcertfile,
+			     cacertfile, pkfile, &addrs, NULL, filename,
+			     0);
+    fclose(f);
+
+/*
+    if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile,
+				servcertfile, pkfile))
+		ret = -1;
+*/
+
+    if (addrs != 0)
+		free_wordlist(addrs);
+
+    return ret >= 0;
+}
+
+
+static int
+scan_authfile_eaptls(FILE *f, char *client, char *server,
+		     char *cli_cert, char *serv_cert, char *ca_cert,
+		     char *pk, struct wordlist **addrs,
+		     struct wordlist **opts,
+		     char *filename, int flags)
+{
+    int newline;
+    int got_flag, best_flag;
+    struct wordlist *ap, *addr_list, *alist, **app;
+    char word[MAXWORDLEN];
+
+    if (addrs != NULL)
+	*addrs = NULL;
+    if (opts != NULL)
+	*opts = NULL;
+    addr_list = NULL;
+    if (!getword(f, word, &newline, filename))
+	return -1;		/* file is empty??? */
+    newline = 1;
+    best_flag = -1;
+    for (;;) {
+	/*
+	 * Skip until we find a word at the start of a line.
+	 */
+	while (!newline && getword(f, word, &newline, filename));
+	if (!newline)
+	    break;		/* got to end of file */
+
+	/*
+	 * Got a client - check if it's a match or a wildcard.
+	 */
+	got_flag = 0;
+	if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) {
+	    newline = 0;
+	    continue;
+	}
+	if (!ISWILD(word))
+	    got_flag = NONWILD_CLIENT;
+
+	/*
+	 * Now get a server and check if it matches.
+	 */
+	if (!getword(f, word, &newline, filename))
+	    break;
+	if (newline)
+	    continue;
+	if (!ISWILD(word)) {
+	    if (server != NULL && strcmp(word, server) != 0)
+		continue;
+	    got_flag |= NONWILD_SERVER;
+	}
+
+	/*
+	 * Got some sort of a match - see if it's better than what
+	 * we have already.
+	 */
+	if (got_flag <= best_flag)
+	    continue;
+
+	/*
+	 * Get the cli_cert
+	 */
+	if (!getword(f, word, &newline, filename))
+	    break;
+	if (newline)
+	    continue;
+	if (strcmp(word, "-") != 0) {
+	    strlcpy(cli_cert, word, MAXWORDLEN);
+	} else
+	    cli_cert[0] = 0;
+
+	/*
+	 * Get serv_cert
+	 */
+	if (!getword(f, word, &newline, filename))
+	    break;
+	if (newline)
+	    continue;
+	if (strcmp(word, "-") != 0) {
+	    strlcpy(serv_cert, word, MAXWORDLEN);
+	} else
+	    serv_cert[0] = 0;
+
+	/*
+	 * Get ca_cert
+	 */
+	if (!getword(f, word, &newline, filename))
+	    break;
+	if (newline)
+	    continue;
+	strlcpy(ca_cert, word, MAXWORDLEN);
+
+	/*
+	 * Get pk
+	 */
+	if (!getword(f, word, &newline, filename))
+	    break;
+	if (newline)
+	    continue;
+	strlcpy(pk, word, MAXWORDLEN);
+
+
+	/*
+	 * Now read address authorization info and make a wordlist.
+	 */
+	app = &alist;
+	for (;;) {
+	    if (!getword(f, word, &newline, filename) || newline)
+		break;
+	    ap = (struct wordlist *)
+		malloc(sizeof(struct wordlist) + strlen(word) + 1);
+	    if (ap == NULL)
+		novm("authorized addresses");
+	    ap->word = (char *) (ap + 1);
+	    strcpy(ap->word, word);
+	    *app = ap;
+	    app = &ap->next;
+	}
+	*app = NULL;
+	/*
+	 * This is the best so far; remember it.
+	 */
+	best_flag = got_flag;
+	if (addr_list)
+	    free_wordlist(addr_list);
+	addr_list = alist;
+
+	if (!newline)
+	    break;
+    }
+
+    /* scan for a -- word indicating the start of options */
+    for (app = &addr_list; (ap = *app) != NULL; app = &ap->next)
+	if (strcmp(ap->word, "--") == 0)
+	    break;
+    /* ap = start of options */
+    if (ap != NULL) {
+	ap = ap->next;		/* first option */
+	free(*app);		/* free the "--" word */
+	*app = NULL;		/* terminate addr list */
+    }
+    if (opts != NULL)
+	*opts = ap;
+    else if (ap != NULL)
+	free_wordlist(ap);
+    if (addrs != NULL)
+	*addrs = addr_list;
+    else if (addr_list != NULL)
+	free_wordlist(addr_list);
+
+    return best_flag;
+}
+
+
+int
+get_eaptls_secret(int unit, char *client, char *server,
+		  char *clicertfile, char *servcertfile, char *cacertfile,
+		  char *capath, char *pkfile, char *pkcs12, int am_server)
+{
+    FILE *fp;
+    int ret;
+    char *filename         = NULL;
+    struct wordlist *addrs = NULL;
+    struct wordlist *opts  = NULL;
+
+	/* maybe overkill, but it eases debugging */
+	bzero(clicertfile, MAXWORDLEN);
+	bzero(servcertfile, MAXWORDLEN);
+	bzero(cacertfile, MAXWORDLEN);
+	bzero(capath, MAXWORDLEN);
+	bzero(pkfile, MAXWORDLEN);
+	bzero(pkcs12, MAXWORDLEN);
+
+	/* the ca+cert+privkey can also be specified as options */
+	if (!am_server && (cacert_file || ca_path) && cert_file && privkey_file )
+	{
+		strlcpy( clicertfile, cert_file, MAXWORDLEN );
+		if (cacert_file)
+			strlcpy( cacertfile, cacert_file, MAXWORDLEN );
+		if (ca_path)
+			strlcpy( capath, ca_path, MAXWORDLEN );
+		strlcpy( pkfile, privkey_file, MAXWORDLEN );
+	}
+    else if (!am_server && pkcs12_file)
+	{
+		strlcpy( pkcs12, pkcs12_file, MAXWORDLEN );
+		if (cacert_file)
+			strlcpy( cacertfile, cacert_file, MAXWORDLEN );
+		if (ca_path)
+			strlcpy( capath, ca_path, MAXWORDLEN );
+	}
+	else
+	{
+		filename = (am_server ? PPP_PATH_EAPTLSSERVFILE : PPP_PATH_EAPTLSCLIFILE);
+		addrs = NULL;
+
+		fp = fopen(filename, "r");
+		if (fp == NULL)
+		{
+			error("Can't open eap-tls secret file %s: %m", filename);
+			return 0;
+		}
+
+		check_access(fp, filename);
+
+		ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile,
+				cacertfile, pkfile, &addrs, &opts, filename, 0);
+
+		fclose(fp);
+
+		if (ret < 0) return 0;
+	}
+
+    if (eaptls_passwd_hook)
+    {
+		dbglog( "Calling eaptls password hook" );
+		if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0)
+		{
+			 error("Unable to obtain EAP-TLS password for %s (%s) from plugin",
+				client, pkfile);
+		    return 0;
+		}
+	}
+    if (am_server)
+		set_allowed_addrs(unit, addrs, opts);
+    else if (opts != NULL)
+		free_wordlist(opts);
+    if (addrs != NULL)
+		free_wordlist(addrs);
+
+    return 1;
+}
+#endif