ppp.git
4 weeks agopppd: Fix SIGSEGV in EAP-TLS code when TLS verify method is not specified master
Eivind Næss [Sun, 11 Apr 2021 23:31:02 +0000 (16:31 -0700)]
pppd: Fix SIGSEGV in EAP-TLS code when TLS verify method is not specified

Make sure the tls_verify_method variable has a default value. Also, fix up the
README.eap-tls documentation for the new options.

Fixes github issue #268.

Signed-off-by: Eivind Naess <eivnaes@yahoo.com>
2 months agopppd: Fix logical error in comparing valid encryption policies (#262)
Eivind Næss [Sun, 14 Mar 2021 23:20:29 +0000 (16:20 -0700)]
pppd: Fix logical error in comparing valid encryption policies (#262)

RFC2548 describes the proper values of the MS-MPPE-Encryption-Policy attribute.
and it can only hold 2 values: 1 (encryption allowed) and 2 (encryption required).

See
   https://tools.ietf.org/html/rfc2548, section 2.4.4

The correct comparison should be made with an && and not a ||.

This fixes github issue #218

Signed-off-by: Eivind Naess <eivnaes@yahoo.com>
2 months agopppd: EAP-TLS: Verify Subject or CommonName by suffix (#261)
Eivind Næss [Sun, 14 Mar 2021 23:17:41 +0000 (16:17 -0700)]
pppd: EAP-TLS: Verify Subject or CommonName by suffix (#261)

This feature matches closely what OpenVPN and the network-manager-openvpn plugin do for
certificate verification. It allows the end user to configure the certificate to be matched by
its common name (entire string), its subject name, or the suffix of a subject name.
The latter is especially useful if you are trying to match against a random server in a RADIUS
pool. Lastly, it also allows you to turn off the certificate matching altogether.

tls-verify-method can have the following parameter values:
- none
- subject   - The entire subject, e.g. /CN=some.server.org
- name      - The entire common name, e.g. some.server.org
- suffix    - The latter part of a name, e.g. servers.org

Secondly, it also introduces a new parameter 'tls-verify-key-usage' which permits checking
of the 'server' or 'client' side attributes of nsCertType and X509 extended key attributes.
For example, in client mode, it will verify that received certificate has the 'server' side
attributes enabled.

Signed-off-by: Eivind Naess <eivnaes@yahoo.com>
2 months agopppd: Fix cross-compilation using Clang (#253)
10ne1 [Sun, 14 Mar 2021 23:11:35 +0000 (01:11 +0200)]
pppd: Fix cross-compilation using Clang (#253)

Clang does not have the --print-sysroot option so the shell
snippet silently fails leading to "-I/usr/include/openssl".
Thankfully systems like Gentoo/portage or Yocto/bitbake enable
sysroot poisoning precisely to catch these kinds of bugs.

There is only one user of this non-standard CFLAG include in
pppcrypt.h, so make it consistent with the rest of the sources
(eg. see eap-tls.[h|c] openssl/* includes) and drop the fragile
sysroot hackery.

Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com>
2 months agoMerge pull request #254 from pali/ipv6-rtnetlink
Paul Mackerras [Fri, 26 Feb 2021 04:58:01 +0000 (15:58 +1100)]
Merge pull request #254 from pali/ipv6-rtnetlink

pppd: Fix and clean up code for setting Linux IPv6 addresses

2 months agopppd: defaultroute6 is not frequent option and should not be used (#257)
pali [Fri, 26 Feb 2021 04:44:19 +0000 (05:44 +0100)]
pppd: defaultroute6 is not frequent option and should not be used (#257)

In pppd.8 manpage, move defaultroute6 option from FREQUENTLY USED OPTIONS
into OPTIONS, and add a warning that this option should not be needed or
used on IPv6 networks. Option defaultroute6 is needed only for broken IPv6
networks. Also add nodefaultroute6 into sample options file.

Signed-off-by: Pali Rohár <pali@kernel.org>
2 months agopppd: Define request and response rtnetlink IPv6 structures
Pali Rohár [Sat, 16 Jan 2021 21:50:27 +0000 (22:50 +0100)]
pppd: Define request and response rtnetlink IPv6 structures

This simplify understanding of rtnetlink IPv6 API. Also it simplify
code for filling rtnetlink IPv6 address request message and reading
rtnetlink response message as it avoids usage of pointer arithmetic.

Signed-off-by: Pali Rohár <pali@kernel.org>
2 months agopppd: Set local and remote IPv6 addresses by one call
Pali Rohár [Sun, 10 Jan 2021 18:46:07 +0000 (19:46 +0100)]
pppd: Set local and remote IPv6 addresses by one call

Currently local IPv6 address is set by SIOCSIFADDR ioctl and remote peer
address is appended by rtnetlink RTM_NEWADDR/NLM_F_REPLACE call. For
RTM_NEWADDR/NLM_F_REPLACE call it is needed to specify both local + remote
addresses as local address is used for matching to which address needs to
be remote peer address appended. When issuing this call kernel first
removes currently configured local address and then inserts a new pair of
local + remote addresses.

Simplify whole setup by just one rtnetlink RTM_NEWADDR/NLM_F_CREATE call by
inserting pair of local + remote addresses atomically. Therefore calling
SIOCSIFADDR ioctl for local IPv6 address is not used or needed anymore.

Signed-off-by: Pali Rohár <pali@kernel.org>
2 months agopppd: Disable Duplicate Address Detection for IPv6 peer address
Pali Rohár [Sun, 10 Jan 2021 18:09:25 +0000 (19:09 +0100)]
pppd: Disable Duplicate Address Detection for IPv6 peer address

IPv6 link-local addresses are negotiated via IPV6CP and therefore are
unique and not duplicate. Doing additional Duplicate Address Detection
is redundant and not needed, so disable it.

Signed-off-by: Pali Rohár <pali@kernel.org>
2 months agopppd: Fix setting flags of IPv6 peer address
Pali Rohár [Sun, 10 Jan 2021 17:51:23 +0000 (18:51 +0100)]
pppd: Fix setting flags of IPv6 peer address

Address is link-local (not globaly routable) and is permanent (not dynamic
from stateless address configuration).

Signed-off-by: Pali Rohár <pali@kernel.org>
2 months agopppd: Fix compilation with older glibc or kernel headers (#248)
pali [Mon, 15 Feb 2021 06:54:01 +0000 (07:54 +0100)]
pppd: Fix compilation with older glibc or kernel headers (#248)

glibc versions prior to 2.24 do not define SOL_NETLINK and linux kernel
versions prior to 4.3 do not define NETLINK_CAP_ACK. So add fallback
definitions for these macros into pppd/sys-linux.c file.

Also extend description why we call SOL_NETLINK/NETLINK_CAP_ACK option.

Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agoMerge pull request #230 from tisj/eap-mschapv2-refactor
Paul Mackerras [Tue, 26 Jan 2021 03:14:42 +0000 (14:14 +1100)]
Merge pull request #230 from tisj/eap-mschapv2-refactor

EAP mschapv2 refactoring

3 months agoipv6cp: Fix ipv6cp-use-persistent option when remote address is specified (#246)
pali [Tue, 26 Jan 2021 02:58:45 +0000 (03:58 +0100)]
ipv6cp: Fix ipv6cp-use-persistent option when remote address is specified (#246)

Option ipv6cp-use-persistent affects only local interface identifier (local
link-local address). It does not affects remote peer interface identifier
(and remote link-local address) therefore ipv6cp-use-persistent option
should not depend on remote address.

Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agopppd: Document LLLOCAL and LLREMOTE environment variables (#240)
pali [Tue, 26 Jan 2021 02:58:07 +0000 (03:58 +0100)]
pppd: Document LLLOCAL and LLREMOTE environment variables (#240)

Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agoipv6cp: Fix ipv6cp-use-persistent option (#239)
pali [Tue, 26 Jan 2021 02:57:38 +0000 (03:57 +0100)]
ipv6cp: Fix ipv6cp-use-persistent option (#239)

There is incorrect logic in ether_to_eui64() function. Persistent id cannot
be found when both sources of persistent id fails, not just one.

This fixes ipv6cp-use-persistent option for non-ethernet PPP connections.

Fixes: 952cfa5acc41ad4ceee160420a188a388bb340cf
Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agoMerge pull request #238 from pali/ipv6cp-demand
Paul Mackerras [Tue, 26 Jan 2021 02:57:00 +0000 (13:57 +1100)]
Merge pull request #238 from pali/ipv6cp-demand

ipv6cp: Fix demand mode for IPv6

3 months agopppd: Negotiate IP address when only peer addresses are provided (#236)
pali [Tue, 26 Jan 2021 02:55:25 +0000 (03:55 +0100)]
pppd: Negotiate IP address when only peer addresses are provided (#236)

This fixes special case when both ppp ends are configured to send only IP
address of other side and do not send its own IP address. Such setup is
correct because both ends can exchange its IP addresses and therefore they
have full information, they known both local and remote address.

This issue can be triggered by calling pppd with arguments:

    ./pppd debug local noauth nolock nodetach asyncmap 0 default-asyncmap novj noaccomp nopcomp nodeflate nobsdcomp nomagic noipv6 noipdefault nosendip :10.0.0.1 pty "./pppd debug local noauth nolock nodetach asyncmap 0 default-asyncmap novj noaccomp nopcomp nodeflate nobsdcomp nomagic noipv6 nosendip nodefaultroute :10.0.0.2 notty"

Without this patch IP addresses are not exchanges at all and pppd fails:

    rcvd [LCP ConfReq id=0x1]
    sent [LCP ConfReq id=0x1]
    sent [LCP ConfAck id=0x1]
    rcvd [LCP ConfAck id=0x1]
    sent [LCP EchoReq id=0x0 magic=0x0]
    sent [IPCP ConfReq id=0x1]
    rcvd [LCP EchoReq id=0x0 magic=0x0]
    sent [LCP EchoRep id=0x0 magic=0x0]
    rcvd [IPCP ConfReq id=0x1]
    sent [IPCP ConfAck id=0x1]
    rcvd [LCP EchoRep id=0x0 magic=0x0]
    rcvd [IPCP ConfAck id=0x1]
    Could not determine local IP address

After applying this patch exchanging of IP addresses is working fine:

    rcvd [LCP ConfReq id=0x1]
    sent [LCP ConfReq id=0x1]
    sent [LCP ConfAck id=0x1]
    rcvd [LCP ConfAck id=0x1]
    sent [LCP EchoReq id=0x0 magic=0x0]
    sent [IPCP ConfReq id=0x1]
    rcvd [LCP EchoReq id=0x0 magic=0x0]
    sent [LCP EchoRep id=0x0 magic=0x0]
    rcvd [IPCP ConfReq id=0x1]
    sent [IPCP ConfNak id=0x1 <addr 10.0.0.1>]
    rcvd [LCP EchoRep id=0x0 magic=0x0]
    rcvd [IPCP ConfNak id=0x1 <addr 10.0.0.2>]
    sent [IPCP ConfReq id=0x2 <addr 10.0.0.2>]
    rcvd [IPCP ConfReq id=0x2 <addr 10.0.0.1>]
    sent [IPCP ConfAck id=0x2 <addr 10.0.0.1>]
    rcvd [IPCP ConfAck id=0x2 <addr 10.0.0.2>]
    local  IP address 10.0.0.2
    remote IP address 10.0.0.1

Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agopppd: Fix enforcing peer IP address (#235)
pali [Tue, 26 Jan 2021 02:53:59 +0000 (03:53 +0100)]
pppd: Fix enforcing peer IP address (#235)

If peer address is specified and ipcp-accept-remote is not set then peer
address is enforced.

But there is bug in pppd which allows peer to not use supplied address when
it reply with empty IPCP ConfReq. In this case pppd thinks that peer
accepted its idea of remote/peer address even it is not truth.

This issue can be reproduced by running pppd with arguments:

    ./pppd debug local noauth nolock nodetach asyncmap 0 default-asyncmap novj noaccomp nopcomp nodeflate nobsdcomp nomagic noipv6 noipdefault :10.1.0.1 pty "./pppd debug local noauth nolock nodetach asyncmap 0 default-asyncmap novj noaccomp nopcomp nodeflate nobsdcomp nomagic noipv6 nosendip nodefaultroute 10.0.0.1:10.0.0.2 notty"

Which means that first pppd force usage of address 10.1.0.1 for peer and
second pppd (peer) wants to use only address 10.0.0.1 for itself.

First pppd see this communication

    rcvd [IPCP ConfReq id=0x64 <addr 10.0.0.1>]
    sent [IPCP ConfNak id=0x64 <addr 10.1.0.1>]
    rcvd [IPCP ConfReq id=0x65]
    sent [IPCP ConfAck id=0x65]
    local  IP address 10.0.0.2
    remote IP address 10.1.0.1

and thinks that peer (second pppd) accepted its idea of remote/peer
address.

After applying this patch first pppd correctly detects that peer refused
its proposed peer address and therefore close connection.

    rcvd [IPCP ConfReq id=0x64 <addr 10.0.0.1>]
    sent [IPCP ConfNak id=0x64 <addr 10.1.0.1>]
    rcvd [IPCP ConfReq id=0x65]
    sent [IPCP ConfAck id=0x65]
    Peer refused to agree to his IP address
    Connect time 0.0 minutes.
    Sent 1024 bytes, received 1018 bytes.
    sent [IPCP TermReq id=0x3 "Refused his IP address"]

Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agopppd: Fix demand mode with noremoteip option (#232)
pali [Tue, 26 Jan 2021 02:52:22 +0000 (03:52 +0100)]
pppd: Fix demand mode with noremoteip option (#232)

When noremoteip is set then initial hisaddr (peer address) is zero. So to
handle setting correct peer address after establishing connection it is
needed to change logic around 'wo->hisaddr != 0' condition. wo->hisaddr
needs to be updated from initial zero address to correct peer address.

Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agopppd: Document ipcp-no-address, ipcp-no-addresses and nosendip options (#231)
pali [Tue, 26 Jan 2021 02:49:57 +0000 (03:49 +0100)]
pppd: Document ipcp-no-address, ipcp-no-addresses and nosendip options (#231)

Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agopppd: Fix nosendip option (#229)
pali [Tue, 26 Jan 2021 02:49:09 +0000 (03:49 +0100)]
pppd: Fix nosendip option (#229)

Respect nosendip option and do not send our IP address to peer even when
peer send to us IPCP ConfNak packet with address 0.0.0.0.

Without this patch pppd sends own local IP address to remote peer and it
can be reproduced with following command:

    $ ./pppd/pppd debug local noauth nolock nodetach asyncmap 0 default-asyncmap novj noaccomp nopcomp nodeflate nobsdcomp noipv6 nodefaultroute noipdefault pty "./pppd/pppd debug local noauth nolock nodetach asyncmap 0 default-asyncmap novj noaccomp nopcomp nodeflate nobsdcomp noipv6 nodefaultroute nosendip 10.0.0.1:10.0.0.2 notty"

Without this patch first pppd receives 10.0.0.1 address from second pppd
even second pppd is configured to not send its IP address.

    rcvd [LCP ConfReq id=0x1 <magic 0x7cf29fab>]
    sent [LCP ConfReq id=0x1 <magic 0x4550b00c>]
    sent [LCP ConfAck id=0x1 <magic 0x7cf29fab>]
    rcvd [LCP ConfAck id=0x1 <magic 0x4550b00c>]
    sent [LCP EchoReq id=0x0 magic=0x4550b00c]
    sent [IPCP ConfReq id=0x1 <addr 0.0.0.0>]
    rcvd [LCP EchoReq id=0x0 magic=0x7cf29fab]
    sent [LCP EchoRep id=0x0 magic=0x4550b00c]
    rcvd [IPCP ConfReq id=0x1]
    sent [IPCP ConfNak id=0x1 <addr 0.0.0.0>]
    rcvd [LCP EchoRep id=0x0 magic=0x7cf29fab]
    rcvd [IPCP ConfNak id=0x1 <addr 10.0.0.2>]
    sent [IPCP ConfReq id=0x2 <addr 10.0.0.2>]
    rcvd [IPCP ConfReq id=0x2 <addr 10.0.0.1>]
    sent [IPCP ConfAck id=0x2 <addr 10.0.0.1>]
    rcvd [IPCP ConfAck id=0x2 <addr 10.0.0.2>]
    local  IP address 10.0.0.2
    remote IP address 10.0.0.1

After applying this patch first pppd does not receive remote 10.0.0.1
address anymore which can be seen by the fact that first pppd cannot
determinate remote IP address and defaulting to 10.64.64.64.

    rcvd [LCP ConfReq id=0x1 <magic 0x1da305a6>]
    sent [LCP ConfReq id=0x1 <magic 0x2d76359>]
    sent [LCP ConfAck id=0x1 <magic 0x1da305a6>]
    rcvd [LCP ConfAck id=0x1 <magic 0x2d76359>]
    sent [LCP EchoReq id=0x0 magic=0x2d76359]
    sent [IPCP ConfReq id=0x1 <addr 0.0.0.0>]
    rcvd [LCP EchoReq id=0x0 magic=0x1da305a6]
    sent [LCP EchoRep id=0x0 magic=0x2d76359]
    rcvd [IPCP ConfReq id=0x1]
    sent [IPCP ConfNak id=0x1 <addr 0.0.0.0>]
    rcvd [LCP EchoRep id=0x0 magic=0x1da305a6]
    rcvd [IPCP ConfNak id=0x1 <addr 10.0.0.2>]
    sent [IPCP ConfReq id=0x2 <addr 10.0.0.2>]
    rcvd [IPCP ConfReq id=0x2]
    sent [IPCP ConfAck id=0x2]
    rcvd [IPCP ConfAck id=0x2 <addr 10.0.0.2>]
    Could not determine remote IP address: defaulting to 10.64.64.64
    local  IP address 10.0.0.2
    remote IP address 10.64.64.64

Signed-off-by: Pali Rohár <pali@kernel.org>
3 months agopppd/Makefile.linux: Fix copy/paste typo (#237)
Richard Purdie [Fri, 22 Jan 2021 05:02:58 +0000 (05:02 +0000)]
pppd/Makefile.linux: Fix copy/paste typo (#237)

A previous commit to fix a make issue had a copy/paste error, fix it
to refer to the correct header.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
4 months agoipv6cp: Remove demand debug notice
Pali Rohár [Sat, 9 Jan 2021 13:41:00 +0000 (14:41 +0100)]
ipv6cp: Remove demand debug notice

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoipv6cp: Fix clearing previous IPv6 LL address in demand mode
Pali Rohár [Sat, 9 Jan 2021 13:40:12 +0000 (14:40 +0100)]
ipv6cp: Fix clearing previous IPv6 LL address in demand mode

Previous old IPv6 LL address is stored in the 'wo' structure. In 'go'/'ho'
is stored new address which needs to be assigned on interface.

Without this patch pppd in demand IPv6 mode always let previous IPv6 LL
address on interface and failed on error:

cif6addr: ioctl(SIOCDIFADDR): No such address

Because it tried to remove new address from interface which obviously was
not set.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoipv6cp: Allow to use demand mode without specifying IPv6 address/identifier
Pali Rohár [Sat, 9 Jan 2021 13:37:00 +0000 (14:37 +0100)]
ipv6cp: Allow to use demand mode without specifying IPv6 address/identifier

Support is similar as in IPv4, pppd generates random temporary identifier
for LL address and after connection is established then LL address is
changed to the real one.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoplugins/pppoe: Add manual page for pppoe-discovery
Jaroslav Škarvada [Tue, 5 Jan 2021 23:03:38 +0000 (00:03 +0100)]
plugins/pppoe: Add manual page for pppoe-discovery

Signed-off-by: Jaroslav Škarvada <jskarvad@redhat.com>
4 months agoAdd some configuration samples (#225)
Jaroslav Škarvada [Fri, 8 Jan 2021 02:52:41 +0000 (03:52 +0100)]
Add some configuration samples (#225)

Signed-off-by: Jaroslav Škarvada <jskarvad@redhat.com>
4 months agoInstall with standard permissions (#221)
Jaroslav Škarvada [Fri, 8 Jan 2021 01:45:24 +0000 (02:45 +0100)]
Install with standard permissions (#221)

In Fedora it's installed with standard permissions for years.

Signed-off-by: Jaroslav Škarvada <jskarvad@redhat.com>
4 months agoconfigure: Allow commas in the CFLAGS (#220)
Jaroslav Škarvada [Fri, 8 Jan 2021 01:43:46 +0000 (02:43 +0100)]
configure: Allow commas in the CFLAGS (#220)

It allows e.g. the following:
./configure --cflags='-Wp,-D_FORTIFY_SOURCE=2'

Signed-off-by: Jaroslav Škarvada <jskarvad@redhat.com>
4 months agopppd/Makefile.linux: Fix reproducibility issue with differing make versions (#234)
Richard Purdie [Fri, 8 Jan 2021 01:41:42 +0000 (01:41 +0000)]
pppd/Makefile.linux: Fix reproducibility issue with differing make versions (#234)

We were seeing reproducibility issues where one host would use the internal
logwtmp wrapper, another would use the one in libutil. The issue was that in
some cases the "\#include" was making it to CC, in others, "#include". The
issue seems to be related to shell escaping.

The root cause looks to be:
http://git.savannah.gnu.org/cgit/make.git/commit/?id=c6966b323811c37acedff05b576b907b06aea5f4

Instead of relying on shell quoting, use make to indirect the variable
and avoid the problem.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
4 months agopppd: Support strip MS domain name for EAP MSCHAPv2
Tijs Van Buggenhout [Wed, 6 Jan 2021 13:59:04 +0000 (14:59 +0100)]
pppd: Support strip MS domain name for EAP MSCHAPv2

Missing feature in preparation for validating the MSCHAPv2 response, as
it was introduced in [1] later on.

1. https://github.com/paulusmack/ppp/commit/7f7ea8967e3b02234811a4b9bb893fc21544319c

Signed-off-by: Tijs Van Buggenhout <tvbuggen@gmail.com>
4 months agopppd: Refactor eap MSCHAPv2 using chap_find_digest
Tijs Van Buggenhout [Mon, 4 Jan 2021 22:59:57 +0000 (23:59 +0100)]
pppd: Refactor eap MSCHAPv2 using chap_find_digest

Remove code duplication from eap.c related to eap MSCHAPv2 (server)
implementation.

The chap_find_digest function - introduced in [1] - exposes the
registered CHAP digests type definitions, providing functions to
generate a challenge and verify a response, among others.

1. https://github.com/paulusmack/ppp/commit/14c1a77816e837852138e87a4adccfd66030b2c3

Signed-off-by: Tijs Van Buggenhout <tvbuggen@gmail.com>
4 months agopppd: (Re)use chap_find_digest in chap_auth_peer
Tijs Van Buggenhout [Mon, 4 Jan 2021 22:57:13 +0000 (23:57 +0100)]
pppd: (Re)use chap_find_digest in chap_auth_peer

Code duplication.

Signed-off-by: Tijs Van Buggenhout <tvbuggen@gmail.com>
4 months agopppd: Fix indentation/whitespace in chap_find_digest
Tijs Van Buggenhout [Mon, 4 Jan 2021 22:54:40 +0000 (23:54 +0100)]
pppd: Fix indentation/whitespace in chap_find_digest

Signed-off-by: Tijs Van Buggenhout <tvbuggen@gmail.com>
4 months agoUpdate README and patchlevel.h for 2.4.9 release 2.4.9 ppp-2.4.9
Paul Mackerras [Mon, 4 Jan 2021 03:20:47 +0000 (14:20 +1100)]
Update README and patchlevel.h for 2.4.9 release

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agopppd: Send nak suggesting eap-mschapv2 when using eap-tls (#217)
Eivind Næss [Mon, 4 Jan 2021 22:41:11 +0000 (14:41 -0800)]
pppd: Send nak suggesting eap-mschapv2 when using eap-tls (#217)

Signed-off-by: Eivind Naess <eivnaes@yahoo.com>
4 months agopppd: Call auth-up-notifier even if 'noauth' is specified (#216)
Eivind Næss [Mon, 4 Jan 2021 06:53:40 +0000 (22:53 -0800)]
pppd: Call auth-up-notifier even if 'noauth' is specified (#216)

This will allow client side plug-ins like for SSTP to use the auth-up-notifier hook to
process the authentication complete step.

Signed-off-by: Eivind Naess <eivnaes@yahoo.com>
4 months agoplugins/radius: Eliminate some potential buffer overruns
Paul Mackerras [Mon, 4 Jan 2021 03:20:10 +0000 (14:20 +1100)]
plugins/radius: Eliminate some potential buffer overruns

Increase AUTH_STRING_LEN and add extra checks in rc_avpair_gen()
to make sure that we can not overflow pair->strvalue.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agopppd: Add support for EAP-MSCHAPv2 (client side) (#211)
Eivind Næss [Mon, 4 Jan 2021 01:34:34 +0000 (17:34 -0800)]
pppd: Add support for EAP-MSCHAPv2 (client side) (#211)

* Adding EAP-MSCHAPv2 support #175

Implementation based on the RFC: draft-kamath-pppext-eap-mschapv2-02.
Adding support for MSCHAPv2 inside extensible authentication protocol (EAP).

Signed-off-by: Thomas Omerzu <thomas@omerzu.de>
* Removing empty "TODO" in comment section

Signed-off-by: Eivind Naess <eivnaes@yahoo.com>
* Add support for EAP-MSCHAPv2 #138

Rewrote the original patch to use the chap-new.c API for caching request/responses. Also incorporate feedback from @paulusmack for input validation and function signatures.

Signed-off-by: Eivind Naess <eivnaes@yahoo.com>
* Adding length checks per Paul's request

Signed-off-by: Eivind Naess, eivnaes@yahoo.com
Co-authored-by: Thomas Omerzu <thomas@omerzu.de>
4 months agopppd: Fix setting IPv6 peer address (#212)
pali [Sun, 3 Jan 2021 23:01:44 +0000 (00:01 +0100)]
pppd: Fix setting IPv6 peer address (#212)

On Linux IPv6 peer address cannot be set via SIOCSIFDSTADDR ioctl like it
is for IPv4 peer address. Linux kernel does not support SIOCSIFDSTADDR for
AF_INET6 PPP interfaces.

The only way how to set IPv6 peer address on Linux is via kernel netlink
interface which is just a little bit complicated compared to one ioctl
call.

Linux kernel for a long time automatically adds IPv6 peer address from
interface into route table so it is not needed to explicitly set routing
for remote peer address. pppd already does not do it for kernel versions
newer than 2.1.16. So the same check is used also for IPv6 peer route
address.

Prior this patch ppp interface was configured as:

    $ ip -6 address show dev ppp0
    2: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 state UNKNOWN qlen 3
        inet6 fe80::2/128 scope link
           valid_lft forever preferred_lft forever

    $ ip -6 route show dev ppp0
    fe80::1 metric 1 pref medium
    fe80::2 proto kernel metric 256 pref medium

And after applying this patch as:

    $ ip -6 address show dev ppp0
    2: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 state UNKNOWN qlen 3
        inet6 fe80::2 peer fe80::1/128 scope link
           valid_lft forever preferred_lft forever

    $ ip -6 route show dev ppp0
    fe80::1 proto kernel metric 256 pref medium
    fe80::2 proto kernel metric 256 pref medium

As can be seen IPv6 peer address is now correctly set on the interface and
also kernel correctly fill route table for IPv6 peer address.

Please note that old ifconfig utility cannot show nor change IPv6 peer
address. Peer address is supported only for IPv4 addresses as opposite of
the local addresses where both IPv4 and IPv6 are supported. It is because
old ifconfig utility is also using ioctl interface which cannot handle it.
Therefore for any testing it is really required ip utility or other utility
with netlink interface (and not ioctl interface).

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agopppoe: Check if PPPoE discovery socket was created
Pali Rohár [Fri, 1 Jan 2021 15:23:26 +0000 (16:23 +0100)]
pppoe: Check if PPPoE discovery socket was created

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoEnabled Buildroot CI test builds on pull request. (#214)
Adrien RICCIARDI [Sun, 3 Jan 2021 22:58:30 +0000 (23:58 +0100)]
Enabled Buildroot CI test builds on pull request. (#214)

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
4 months agoSolaris automated CI build. (#215)
Adrien RICCIARDI [Sun, 3 Jan 2021 22:57:37 +0000 (23:57 +0100)]
Solaris automated CI build. (#215)

* Started Solaris CI test. Retrieved PPP source code and started a Solaris virtual machine.

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
* Added PPP build step to Solaris CI.

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
4 months agoRepair compilation issues on Solaris
James Carlson [Wed, 30 Dec 2020 14:55:12 +0000 (09:55 -0500)]
Repair compilation issues on Solaris

There's no "ifr_mtu" on the legacy BSD interface; it's "ifr_metric"
and old K&R style implied 'int' can't be used with modern function
declarations.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agopppd: Combine get_first_ethernet() and get_if_hwaddr() into one function (#207)
pali [Sat, 2 Jan 2021 03:27:13 +0000 (04:27 +0100)]
pppd: Combine get_first_ethernet() and get_if_hwaddr() into one function (#207)

On all places is just needed hardware address for the first ethernet-style
interface. So provide it by new get_first_ether_hwaddr() function.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agopppd: Document chapms-strip-domain option in pppd(8) (#203)
Samuel Thibault [Sat, 2 Jan 2021 03:26:43 +0000 (04:26 +0100)]
pppd: Document chapms-strip-domain option in pppd(8) (#203)

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
4 months agopppd: Add replacedefaultroute option (#200)
Samuel Thibault [Sat, 2 Jan 2021 03:25:48 +0000 (04:25 +0100)]
pppd: Add replacedefaultroute option (#200)

Adds an option to pppd to control whether to replace existing default routes
when using the 'defaultroute' option.

If defaultroute and replacedefaultroute are both set, pppd replaces an existing
default route with the new default route. The old default route is restored when
the connection is taken down.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Chris Boot <bootc@debian.org>
4 months agoMerge pull request #208 from RICCIARDI-Adrien/automated_build
Paul Mackerras [Sat, 2 Jan 2021 03:13:06 +0000 (14:13 +1100)]
Merge pull request #208 from RICCIARDI-Adrien/automated_build

Automated build (multiple architectures and C libraries using Buildroot).

4 months agoAdded ARM, PPC and MIPS targets to Buildroot CI tests.
RICCIARDI-Adrien [Fri, 1 Jan 2021 14:17:51 +0000 (15:17 +0100)]
Added ARM, PPC and MIPS targets to Buildroot CI tests.

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
4 months agoAdded Buildroot C library selection.
RICCIARDI-Adrien [Thu, 31 Dec 2020 22:06:27 +0000 (23:06 +0100)]
Added Buildroot C library selection.

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
4 months agoAdded Buildroot configuration and build steps.
RICCIARDI-Adrien [Thu, 31 Dec 2020 15:21:04 +0000 (16:21 +0100)]
Added Buildroot configuration and build steps.

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
4 months agoEnabled PPPD package in Buildroot defconfig.
RICCIARDI-Adrien [Thu, 31 Dec 2020 13:08:10 +0000 (14:08 +0100)]
Enabled PPPD package in Buildroot defconfig.

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
4 months agoModified Buildroot PPPD package to use GitHub master branch.
RICCIARDI-Adrien [Thu, 31 Dec 2020 12:56:57 +0000 (13:56 +0100)]
Modified Buildroot PPPD package to use GitHub master branch.

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
4 months agoStarted Buildroot GitHub action. It can currently only retrieve latest stable Buildro...
RICCIARDI-Adrien [Thu, 31 Dec 2020 11:18:43 +0000 (12:18 +0100)]
Started Buildroot GitHub action. It can currently only retrieve latest stable Buildroot sources.

Signed-off-by: RICCIARDI-Adrien <adrien.ricciardi@hotmail.fr>
4 months agopppd: Fix ether_to_eui64() to prefer devnam ether interface (#206)
pali [Fri, 1 Jan 2021 08:58:02 +0000 (09:58 +0100)]
pppd: Fix ether_to_eui64() to prefer devnam ether interface (#206)

In case of PPPoE connection, devnam is ethernet interface. So in this case
calculate EUI-64 IPV6CP identifier from the PPPoE ethernet interface
instead from the first ethernet interface in the system.

This would ensure that each PPPoE connection would have unique IPv6 link
local address calculated from the interface MAC address on which is PPPoE
going to be established.

Currently IPv6 link local address is always calculated from the MAC address
of the first ethernet interface and therefore all active PPPoE connections
have by default same (non unique) IPv6 link local address.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoAdd cross-compilation support on Linux
Paul Mackerras [Fri, 1 Jan 2021 08:44:07 +0000 (19:44 +1100)]
Add cross-compilation support on Linux

This adds three new command-line options to the configure script:

--cross_compile=<prefix> (default "")
--cc=<compiler>          (default cc)
--cflags=<compile flags> (default -g -O2 -pipe)

These get propagated to the Makefiles in the subdirectories.  The
cross-compile prefix is prepended to the CC value, so for example
if you do "./configure --cross_compile=powerpc64le-linux-" then
everything gets compiled and linked using powerpc64le-linux-cc.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agopppd: Use a run-time test to detect libutil availability on Linux
Paul Mackerras [Fri, 1 Jan 2021 00:26:48 +0000 (11:26 +1100)]
pppd: Use a run-time test to detect libutil availability on Linux

This tests whether logwtmp is declared in <utmp.h>, and if not we
assume we need to include our own logwtmp implementation.  We assume
that if logwtmp is provided by the system then we need -lutil to get
it (as is the case for glibc).

This fixes compilation with musl libc and other libcs that don't
provide logwtmp.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agoMerge pull request #205 from pali/pppoe-rename
Paul Mackerras [Fri, 1 Jan 2021 08:52:59 +0000 (19:52 +1100)]
Merge pull request #205 from pali/pppoe-rename

Rename rp-pppoe.so plugin to pppoe.so

4 months agoCleanup pppoe-discovery fatal functions
Pali Rohár [Thu, 31 Dec 2020 17:52:50 +0000 (18:52 +0100)]
Cleanup pppoe-discovery fatal functions

Implement fatal() function as defined in pppd/pppd.h and use it instead of
rp_fatal() and sysErr() functions.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoMake a consistency in pppoe options
Pali Rohár [Thu, 31 Dec 2020 17:49:27 +0000 (18:49 +0100)]
Make a consistency in pppoe options

Remove 'rp_' prefix from all pppoe options and ensure that pppoe options
have 'pppoe-' prefix. Also change underlines to dashes to be consistent
with other pppd options.

To not break a backward compatibility ensure that old option names still
work via (legacy) aliases.

Also document everything in pppd manual page.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoDeduplicate ether_to_eui64() implementation (#204)
pali [Thu, 31 Dec 2020 22:54:37 +0000 (23:54 +0100)]
Deduplicate ether_to_eui64() implementation (#204)

Now when get_first_ethernet() is implemented for both Linux and Solaris,
implementation of ether_to_eui64() function can use this function
get_first_ethernet() and therefore be system independent.

So change implementation of ether_to_eui64() to use get_first_ethernet()
function and move it from Linux and Solaris files to common ipv6cp.c file
where it is used.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agopppd/Makefile.linux: do not check for bpf header presence on the host (#201)
Alexander Kanavin [Thu, 31 Dec 2020 22:44:08 +0000 (23:44 +0100)]
pppd/Makefile.linux: do not check for bpf header presence on the host (#201)

This makes builds non-deterministic, and doesn't work
when building in sysroot environments (such as yocto).

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
4 months agoRename rp-pppoe.so plugin to pppoe.so
Pali Rohár [Thu, 31 Dec 2020 17:46:01 +0000 (18:46 +0100)]
Rename rp-pppoe.so plugin to pppoe.so

Original out-of-tree rp-pppoe plugin for pppd software is still available
at website https://dianne.skoll.ca/projects/rp-pppoe/ and receives new
releases. The last update is from the June 2020.

Currently it is ambiguous if user is using original out-of-tree rp-pppoe
plugin or in-tree pppd's rp-pppoe plugin. These two plugins are different,
come from different sources but share same name.

Some users want to use original rp-pppoe plugin and not pppd's in-tree
rp-pppoe plugin. Also some distribution want to package both plugins,
pppd's in-tree and original rp-pppoe.

So for this reason and also because all other PPP over <something> plugins
have just pppo prefix, rename in-tree rp-pppoe.so plugin to just pppoe.so.

This will allow to distinguish and make it clear what is the original
rp-pppoe plugin and what is pppd's in-tree pppoe plugin.

When installing pppd create a compatibility symlink from pppoe.so to
rp-pppoe.so so nothing would be broken. This compatibility symlink may be
removed by Linux distribution which do not want to have compatibility with
the old name as before and rather use rp-pppoe.so name for original
rp-pppoe software.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agopppd: Use a compile test to detect crypt.h (#198)
Samuel Thibault [Thu, 31 Dec 2020 05:35:24 +0000 (06:35 +0100)]
pppd: Use a compile test to detect crypt.h (#198)

ppp checks header for existence of crypt.h looking it up in /usr/include.
That's incompatible with non-glibcs or a glibc with multiarch headers
(https://bugs.debian.org/798955). This patch replaces the file existence
test with a compile test.

Reviewed-by: Chris Boot <bootc@debian.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Helmut Grohne <helmut@subdivi.de>
4 months agoAllow overriding the optimization level with CFLAGS (#197)
Samuel Thibault [Thu, 31 Dec 2020 05:34:09 +0000 (06:34 +0100)]
Allow overriding the optimization level with CFLAGS (#197)

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Marco d'Itri <md@linux.it>
4 months agoRevert "pppdump: support building with the system zlib (#189)"
Paul Mackerras [Thu, 31 Dec 2020 05:00:37 +0000 (16:00 +1100)]
Revert "pppdump: support building with the system zlib (#189)"

This reverts commit c98cc28f128dffc456488c74b600640057da6994
because of compile errors in pppdump:

cc  -o pppdump pppdump.o deflate.o bsd-comp.o  -lz
/usr/bin/ld: deflate.o: in function `z_incomp':
deflate.c:(.text+0x99): undefined reference to `inflateIncomp'
/usr/bin/ld: deflate.o: in function `z_decomp_alloc':
deflate.c:(.text+0x355): undefined reference to `inflateInit2'
collect2: error: ld returned 1 exit status
make[1]: *** [Makefile:38: pppdump] Error 1

The copy of zlib here is not the same as the standard upstream zlib;
this version has some extra functions added.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agopppd: Export $CALL_FILE to the link scripts (#196)
Samuel Thibault [Thu, 31 Dec 2020 04:50:46 +0000 (05:50 +0100)]
pppd: Export $CALL_FILE to the link scripts (#196)

From https://bugs.debian.org/51880


This would make it much easier for me, and cleaner too, to handle
multiple, mutually exclusive, dialout internet service providers.


Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Marco d'Itri <md@linux.it>
4 months agoChange path to expect in secure-card example script (#195)
Samuel Thibault [Thu, 31 Dec 2020 04:49:39 +0000 (05:49 +0100)]
Change path to expect in secure-card example script (#195)

People would usually just install expect from their distribution

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Chris Boot <bootc@debian.org>
4 months agopppd: Make _PATH_CONNERRS world readable (#194)
Samuel Thibault [Thu, 31 Dec 2020 04:49:09 +0000 (05:49 +0100)]
pppd: Make _PATH_CONNERRS world readable (#194)

From https://bugs.debian.org/341853

There is nothing security-sensitive there.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Marco d'Itri <md@linux.it>
4 months agoplugins/radius: Add support for the Framed-MTU Radius attribute (#192)
Samuel Thibault [Thu, 31 Dec 2020 04:47:56 +0000 (05:47 +0100)]
plugins/radius: Add support for the Framed-MTU Radius attribute (#192)

This allows radius plugin to deal with Framed-MTU Radius attribute and to
set MTU on interface.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Alexander Klepikov <klepikov_a@up.ua>
4 months agoMerge branch 'pppoatm_wildcard' of https://github.com/sthibaul/ppp
Paul Mackerras [Thu, 31 Dec 2020 04:42:15 +0000 (15:42 +1100)]
Merge branch 'pppoatm_wildcard' of https://github.com/sthibaul/ppp

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agoplugins/pppoatm: cosmetic cleanup (#190)
Samuel Thibault [Thu, 31 Dec 2020 04:38:40 +0000 (05:38 +0100)]
plugins/pppoatm: cosmetic cleanup (#190)

Removed some debugging messages and generally cleaned up the source.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Marco d'Itri <md@linux.it>
4 months agopppdump: support building with the system zlib (#189)
Samuel Thibault [Thu, 31 Dec 2020 04:37:38 +0000 (05:37 +0100)]
pppdump: support building with the system zlib (#189)

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Marco d'Itri <md@linux.it>
4 months agopppd: Add option to strip MS domain name (#188)
Samuel Thibault [Thu, 31 Dec 2020 04:33:45 +0000 (05:33 +0100)]
pppd: Add option to strip MS domain name (#188)

Some Windows 9x/ME clients might be erroneously transmitting the MS domain
along the login name. This allows to strip them on the server side.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Marco d'Itri <md@linux.it>
4 months agoDo not strip installed binaries (#186)
Samuel Thibault [Thu, 31 Dec 2020 04:31:43 +0000 (05:31 +0100)]
Do not strip installed binaries (#186)

This should be done by the packaging system, to be able to separate out
debugging symbols into separate packages.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
4 months agopppd: Make sure that the linkpidfile is always created (#185)
Samuel Thibault [Thu, 31 Dec 2020 04:30:58 +0000 (05:30 +0100)]
pppd: Make sure that the linkpidfile is always created (#185)

From https://bugs.debian.org/284382

When pppd detaches from the parent normally, that is, without nodetach
or updetach set, the linkpidfile is not created even when linkname is
set.

This is because the create_linkpidfile call in detach() is only made
if the linkpidfile is filled in.  However, linkpidfile is never filled
in until create_linkpidfile has been called.

IMHO the call should be made uncondtionally in detach() since
create_linkpidfile does its own check on linkname anyway.

Please note that the version of pppd in woody always wrote the
linkpidfile after detaching.  It did so in main() however.  That
call has now been removed which is why I'm seeing this problem.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Herbert Xu <herbert@gondor.apana.org.au>
4 months agopppd: Be sure to close /dev/ppp when reconnecting (#184)
Samuel Thibault [Thu, 31 Dec 2020 04:28:19 +0000 (05:28 +0100)]
pppd: Be sure to close /dev/ppp when reconnecting (#184)

From https://bugs.debian.org/306261

When using the kernel PPPoE driver, pppd never
closes /dev/ppp when the link has come down.

It opens superfluous fds to the device each time it re-opens the
connection, with the unclosed ones falsely reported always ready for
data by select().

This makes pppd eat up 100% CPU time after the first persist because of
the always instantly returning select() on the unclosed fds.

The problem also occurs with the upstream version, but does not occur
when a pty/tty device is used for the ppp connection.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Co-authored-by: Simon Peter <dn.tlp@gmx.net>
4 months agoMerge pull request #183 from sthibaul/path-ip-up-down
Paul Mackerras [Thu, 31 Dec 2020 04:27:11 +0000 (15:27 +1100)]
Merge pull request #183 from sthibaul/path-ip-up-down

Add option to specify ip-up script

4 months agoMerge pull request #182 from pali/get_if_hwaddr
Paul Mackerras [Thu, 31 Dec 2020 04:25:36 +0000 (15:25 +1100)]
Merge pull request #182 from pali/get_if_hwaddr

Fix indicating failure in Linux get_if_hwaddr() function

4 months agoMerge pull request #181 from pali/get_first_ethernet
Paul Mackerras [Thu, 31 Dec 2020 04:23:31 +0000 (15:23 +1100)]
Merge pull request #181 from pali/get_first_ethernet

Implement get_first_ethernet() for Linux systems properly

4 months agoMerge pull request #177 from tisj/eap-mschapv2-server
Paul Mackerras [Thu, 31 Dec 2020 04:19:22 +0000 (15:19 +1100)]
Merge pull request #177 from tisj/eap-mschapv2-server

pppd: Add support for EAP-MSCHAPv2 in server mode

4 months agoradius: Handle IPv6 RADIUS attributes (#176)
Alarig Le Lay [Thu, 31 Dec 2020 01:25:07 +0000 (02:25 +0100)]
radius: Handle IPv6 RADIUS attributes (#176)

Signed-off-by: Alarig Le Lay <alarig@swordarmor.fr>
4 months agoMerge pull request #103 from Low-power/solaris-mtu-fix
Paul Mackerras [Thu, 31 Dec 2020 01:17:27 +0000 (12:17 +1100)]
Merge pull request #103 from Low-power/solaris-mtu-fix

Fix netif_set_mtu for Solaris

4 months agopppd: Add support for EAP-MSCHAPv2 in server mode
Tijs Van Buggenhout [Tue, 24 Nov 2020 15:17:45 +0000 (16:17 +0100)]
pppd: Add support for EAP-MSCHAPv2 in server mode

This implements EAP-MSCHAPv2 as specified by
draft-kamath-pppext-eap-mschapv2-02 [1] in server mode (as the client
mode is already proposed by Thomas [2]).

The flow is camparable to MD5-Challenge, with some additional steps for
confirmation:

* Client sends an EAP request
* Server answers with MD5-Challenge
* Client Naks and requests MSCHAPv2
* Server answers with MSCHAPv2-Challenge
* Client answers with MSCHAPv2-Response
* Server answers with MSCHAPv2-{Success/Failure}
* Client possibly confirms MSCHAPv2-{Success/Failure}

I reused as much as possible from pppd/chap-new.c and pppd/chap_ms.c,
but most of the implementation is protected by static functions.

Therefore eap_chapms2_verify_response is an exact copy of
chapms2_verify_response, likewise for eap_chap_verify which is an exact
copy of chap_verify_response. This is not optimal and subject for
improvement.

By using a chap_digest_type struct/object with validator
(verify_response), validation is compatible with other (external)
plugins that have a specific CHAP implementation exposed in the
chap_verify_hook (like radius, windbind, ...).

Changes in eap.h are identical to [2], except for the additional
eapMSCHAPv2Chall server state.

[1] https://tools.ietf.org/html/draft-kamath-pppext-eap-mschapv2-02
[2] https://github.com/enaess/ppp-mschap-v2.git

Signed-off-by: Tijs Van Buggenhout <tvbuggen@gmail.com>
4 months agoFix pppoatm plugin for pppd to accept a wildcard argument for an ATM device
Duncan Sands [Wed, 30 Dec 2020 11:22:50 +0000 (12:22 +0100)]
Fix pppoatm plugin for pppd to accept a wildcard argument for an ATM device

From https://bugs.debian.org/376990

This becomes an issue when using a USB ADSL modem (e.g. Alcatel Speedtouch)
and the USB host controller disconnects the modem, then later re-connects it
with a new USB address and consequently a new ATM device number.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
4 months agoAdd option to specify ip-up script
Russell Coker [Wed, 30 Dec 2020 10:37:44 +0000 (11:37 +0100)]
Add option to specify ip-up script

From https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=101587

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
4 months agoFix indicating failure in Linux get_if_hwaddr() function
Pali Rohár [Wed, 30 Dec 2020 10:04:36 +0000 (11:04 +0100)]
Fix indicating failure in Linux get_if_hwaddr() function

This function should return negative value on error.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoImplement get_first_ethernet() for Linux systems properly
Pali Rohár [Wed, 30 Dec 2020 10:00:11 +0000 (11:00 +0100)]
Implement get_first_ethernet() for Linux systems properly

Use if_nameindex() for enumerating network interfaces and choose the first
one with ARPHRD_ETHER ifr_hwaddr.sa_family.

Signed-off-by: Pali Rohár <pali@kernel.org>
4 months agoMerge pull request #54 from shankerwangmiao/master
Paul Mackerras [Wed, 30 Dec 2020 09:28:49 +0000 (20:28 +1100)]
Merge pull request #54 from shankerwangmiao/master

add $(INSTROOT) to $(DESTDIR)

4 months agoMerge pull request #101 from vyos/if-renaming-clean
Paul Mackerras [Wed, 30 Dec 2020 09:27:07 +0000 (20:27 +1100)]
Merge pull request #101 from vyos/if-renaming-clean

Support for interface renaming by pre-up scripts

4 months agorp-pppoe: Fix compilation with musl libc
Paul Mackerras [Wed, 30 Dec 2020 01:04:57 +0000 (12:04 +1100)]
rp-pppoe: Fix compilation with musl libc

Ensure that we don't include both <netinet/if_ether.h> and
<linux/if_ether.h>, and don't include <net/ethernet.h>.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agopppd: Fix compilation with uclibc
Paul Mackerras [Wed, 30 Dec 2020 01:04:11 +0000 (12:04 +1100)]
pppd: Fix compilation with uclibc

<stdarg.h> is needed in pppd.h to define va_list.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agoMerge pull request #153 from pali/master
Paul Mackerras [Tue, 29 Dec 2020 23:48:26 +0000 (10:48 +1100)]
Merge pull request #153 from pali/master

Document PPPoE options in pppd.8 manpage

4 months agoMerge branch 'chap-timeout' of https://github.com/nomis/ppp
Paul Mackerras [Tue, 29 Dec 2020 23:45:55 +0000 (10:45 +1100)]
Merge branch 'chap-timeout' of https://github.com/nomis/ppp

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agoConvert to ANSI C
Paul Mackerras [Tue, 29 Dec 2020 05:08:24 +0000 (16:08 +1100)]
Convert to ANSI C

This gets rid of the __P and __V macros that were used so that the
code was in theory compilable by a K&R C compiler, and converts the
function definitions to ANSI C style.  In fact there were already
quite a few function definitions in the ANSI C style, so it would not
have been compilable by a K&R C compiler in fact.

The Solaris and BSD kernel code modules have had __P removed but the
function definitions have not been converted.

There are some other minor changes here to remove warnings.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
4 months agoMerge pull request #165 from pali/lcp
Paul Mackerras [Tue, 29 Dec 2020 03:10:40 +0000 (14:10 +1100)]
Merge pull request #165 from pali/lcp

pppd: Do not call update_link_stats() for every LcpSendEchoRequest() call

4 months agoClose discovery socket after session completed
Xing Qingjie [Thu, 26 Nov 2020 11:09:38 +0000 (06:09 -0500)]
Close discovery socket after session completed

After the session is complete, the socket is left unmanaged. When the
interface receives PADIs from other device, the packets is putting
in the socket's Recv-Q, which eat system memory.

[root@test ~]# ss -f link
Netid  Recv-Q Send-Q    Local Address:Port    Peer Address:Port
p_raw  10269952 0          ppp_disc:eth1           *

Signed-off-by: Xing Qingjie <88930741@qq.com>
6 months agoadd $(INSTROOT) to $(DESTDIR)
Miao Wang [Thu, 28 Apr 2016 10:33:17 +0000 (18:33 +0800)]
add $(INSTROOT) to $(DESTDIR)

Signed-off-by: Miao Wang <shankerwangmiao@gmail.com>
6 months agoSupport renaming interfaces from a pre-up script.
Daniil Baturin [Sat, 20 Dec 2008 02:00:15 +0000 (18:00 -0800)]
Support renaming interfaces from a pre-up script.

This is useful for PPP server operators
who want control over the naming of client interfaces.

Originally implemented by Stephen Hemminger.

Signed-off-by: Daniil Baturin <daniil@baturin.org>
6 months agoFixed static analyzer warnings; removed superfluous file
Jan Just Keijser [Mon, 2 Nov 2020 09:07:12 +0000 (10:07 +0100)]
Fixed static analyzer warnings; removed superfluous file

Signed-off-by: Jan Just Keijser <jan.just.keijser@gmail.com>