From patchwork Thu Nov 12 17:04:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10741 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jQRbJ4z6Fz3wwt for ; Thu, 12 Nov 2026 17:05:16 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jQRbG2tB1z882 for ; Thu, 12 Nov 2026 17:05:14 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jQRbF2h51z32Yw for ; Thu, 12 Nov 2026 17:05:13 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jQRbB1dZ2z32Mx for ; Thu, 12 Nov 2026 17:05:10 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jQRb86hz2z46V; Thu, 12 Nov 2026 17:05:08 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1794503109; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=p/9kgWUmK2s8+XDReftNGh6oRqM6++hen2//i1Z3tQk=; b=jaiAFJ99wJEgN4OtubwOHZuP8/g8d+hD2KgFOOS/4lgOVM6K6RtUskUdMRlmbcqT0LGPiB ZAzZKb1KnVBoMjCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1794503109; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=p/9kgWUmK2s8+XDReftNGh6oRqM6++hen2//i1Z3tQk=; b=UO6Ef4IQtpVPDAEfG9x9gkvuMHPUQkHA/8CyCsFRQI8u371lJEIEZ74lIB/a0nZD/n176A Vtx7CPM8wsuP8aF5us+txHcrZ+yx7aGVWFghLEBHOJEbuzHfkXbTPfyiufbuEDwR1RuHiN dXV2toZlcEQWk6098Ao1n/cvkCjmZbQKPy80DRDgRqn0+wU+0Fg88MgTflK5E86MxbWvMN cSvOdpZqXawsa4Ra5+PAhMZNbQowEG2a5T1Tl1QM7MiKxPmipCYqp40IOTD+RGYMt/dpnw 7/83RgcRLrMVBsdVfb7VH0Ttrt6sPobqH4OBkwTxf+U13OzD1l/koB8aZPpCEw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] ppp: Update to version 2.5.5 Date: Thu, 12 Nov 2026 18:04:58 +0100 Message-ID: <20261112170458.2062476-6-adolf.belka@ipfire.org> In-Reply-To: <20261112170458.2062476-1-adolf.belka@ipfire.org> References: <20261112170458.2062476-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.5.2 to 2.5.5 - Update of rootfile - Update of patches as some of the files changed enough to no longer have the old able to successfully apply. - Changelog 2.5.5 This is a bug-fix and security release, with no new features. Changes include: Fix bugs where hook scripts such as /etc/ppp/ip-up were not being run. Fix bugs causing PPP_SCRIPT_INSTANCE to be set incorrectly for some scripts. Fix validation of received frames in the RADIUS plugin, along with some further hardening against incorrect received frames. Fix generation of MPPE keys when EAP-TLS is being used with TLS 1.3. This makes it work with Windows clients, but breaks compatibility with earlier versions of pppd (but only in the case where EAP-TLS and MPPE and the 'max-tls-version 1.3' option are all being used). Various cases existed in the MPPE code where the link could come up without MPPE encryption despite it being requested via one or more of the 'require-mppe', 'require-mppe-40' or 'require-mppe-128' options. This is now fixed. Also, pppd will now accept an MPPE CCP configuration option requesting no encryption from the peer if MPPE is not required (rather than rejecting it). Fix a bug where the password from a file specified with the '+ua' option was not being used. 2.5.4 This is primarily a security release, fixing several vulnerabilities including CVE-2026-75883 and CVE-2026-85495. For more details on this and other vulnerabilities fixed, see the github advisories at https://github.com/ppp-project/ppp/security/advisories?state=published These range in severity up to 6.8 (moderate). Many of the vulnerabilities are actually only of concern if pppd is installed setuid-root, which some distros still do, though 'make install' in this project does not install pppd setuid-root. Other changes include: A new environment variable is defined for scripts, called PPP_SCRIPT_INSTANCE, which contains the original name of the script (e.g., ip-up). This can be useful when the name in argv[0] gets lost because the script is executed by an interpreter. New options 'strict-script-checks', 'nostrict-script-checks', 'strict-secrets-files' and 'nostrict-secrets-files' have been added. The strict versions are the default, and the nostrict versions are privileged. 'strict-script-checks' enables checks on script files that are run as root (e.g., /etc/ppp/ip-up) to ensure that they are owned by root and not writable by group or other. 'strict-secrets-checks' enables checks on secrets files (such as /etc/ppp/chap-secrets) to ensure that they are not readable by group or other. Previously (and now with nostrict-secrets-checks) the check was done but only produced a warning; now by default pppd will refuse to use the file. For EAP-TLS and PEAP, the verification of the 'common name' in TLS certificates no longer stops the comparison at an embedded NUL character. The pppd man page now notes that the default verification mode is 'none' and that the 'suffix' verification mode doesn't check for a '.' in the common name before the matched suffix (this was the behaviour previously but the man page was incorrect). Many more options are now privileged, in particular all of the RADIUS plugin options, and almost all the options relating to EAP-TLS and PEAP. OpenSSL engine support in EAP-TLS is disabled by default, since engine support in OpenSSL 3 is deprecated. If you need it, use the --enable-openssl-engine flag to configure. Pppd can now run as non-root as long as it has the CAP_NET_ADMIN capability. In that case, scripts are run as the invoking user, the user can use privileged options (provided the pppd binary was not marked as setuid or with additional capabilities), and the ownership checks use the user's effective UID rather than 0. Various pppd options that take an integer argument now enforce sensible limits on the value. This aids in avoiding edge cases where vulnerabilities may lurk. EAP-SRP support has been removed. Previously it was disabled by default. Extra length checks have been added to ensure that the pppd code doesn't access outside the bounds of received packets, even when such accesses were harmless (i.e. within the bounds of the array that the received packet was stored in, and not affecting any result). Various other minor bug fixes and improvements, including man page updates. 2.5.3 Several security improvements: Some options are now privileged: 'set', 'unset', 'defaultroute', and 'defaultroute6'. If a non-root user running a setuid-root pppd needs to use these options, the system administrator will have to make a 'call' file in /etc/ppp/peers containing the required option(s) for the user's use. Scripts, privileged options files and secrets files now are subject to a path check, which checks that the file and each directory in the real path to the file are owned by root and not writable by non-root. If pppd is installed setuid-root and run by a non-root user, the peer will be required to authenticate itself; previously this requirement only applied if the system had a default IPv4 route. Default route handling has changed; pppd no longer checks for an existing default route before adding its default route. The defaultroute and defaultroute6 options are now privileged, and if used, the default route will always be added. The metric of the default route can be controlled with new defaultroute-metric and defaultroute6-metric options, which are privileged. The replacedefaultroute and noreplacedefaultroute options are no longer functional, and just cause an error message to be printed. There is now a dhcpv6relay plugin, which can be used to provide IPv6 RAs to the remote side and relay the subsequent incoming DHCPv6 requests to a DHCPv6 server. Note: This is to delegate IPv6 to the remote side, not to configure IPv6 locally; in other words, this is generally only useful for service providers. For configuring IPv6 at an endpoint, projects like dhcpcd and/or radvd may be useful. VRF (Virtual Routing and Forwarding) support has been added to pppd on Linux. There is now a 'vrf' option which tells pppd to bind the PPP interface to a specific VRF, so that routes are installed in the VRF's routing table rather than the main routing table. The pppoe (PPP over ethernet) plugin now supports maximum packet sizes greater than 1492 bytes if configured to do so, a larger size is agreed upon during the PPPoE negotiation, and the peer agrees. CBCP (Callback control protocol) support can still be selected at configuration time, but now a warning message will be printed, warning that CBCP support will be removed in a future version. If you use CBCP in pppd, let the maintainer know, for example by adding to issue #530. Various other bug fixes and minor enhancements. Signed-off-by: Adolf Belka --- config/rootfiles/common/ppp | 44 +++++----- lfs/ppp | 16 ++-- ...don-t-want-to-accidentally-leak-fds.patch} | 81 +++++++------------ ...2.5.5-2-everywhere-O_CLOEXEC-harder.patch} | 68 +++++++--------- ...e-SOCK_CLOEXEC-when-creating-socket.patch} | 54 ++++++------- ...-2.5.5-4-increase-max-padi-attempts.patch} | 6 +- ...rs_4.9.patch => ppp-2.5.5-5-headers.patch} | 6 +- 7 files changed, 119 insertions(+), 156 deletions(-) rename src/patches/ppp/{ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch => ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch} (65%) rename src/patches/ppp/{ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch => ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch} (79%) rename src/patches/ppp/{ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch => ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch} (76%) rename src/patches/ppp/{ppp-2.5.1-4-increase-max-padi-attempts.patch => ppp-2.5.5-4-increase-max-padi-attempts.patch} (64%) rename src/patches/ppp/{ppp-2.5.1-5-headers_4.9.patch => ppp-2.5.5-5-headers.patch} (60%) diff --git a/config/rootfiles/common/ppp b/config/rootfiles/common/ppp index fe2d0d244..0a8170179 100644 --- a/config/rootfiles/common/ppp +++ b/config/rootfiles/common/ppp @@ -38,27 +38,29 @@ etc/ppp/standardloginscript #usr/include/pppd/upap.h #usr/lib/pkgconfig/pppd.pc usr/lib/pppd -usr/lib/pppd/2.5.2 -#usr/lib/pppd/2.5.2/minconn.la -usr/lib/pppd/2.5.2/minconn.so -#usr/lib/pppd/2.5.2/openl2tp.la -usr/lib/pppd/2.5.2/openl2tp.so -#usr/lib/pppd/2.5.2/passwordfd.la -usr/lib/pppd/2.5.2/passwordfd.so -#usr/lib/pppd/2.5.2/pppoatm.la -usr/lib/pppd/2.5.2/pppoatm.so -#usr/lib/pppd/2.5.2/pppoe.la -usr/lib/pppd/2.5.2/pppoe.so -#usr/lib/pppd/2.5.2/pppol2tp.la -usr/lib/pppd/2.5.2/pppol2tp.so -#usr/lib/pppd/2.5.2/radattr.la -usr/lib/pppd/2.5.2/radattr.so -#usr/lib/pppd/2.5.2/radius.la -usr/lib/pppd/2.5.2/radius.so -#usr/lib/pppd/2.5.2/radrealms.la -usr/lib/pppd/2.5.2/radrealms.so -#usr/lib/pppd/2.5.2/winbind.la -usr/lib/pppd/2.5.2/winbind.so +usr/lib/pppd/2.5.5 +#usr/lib/pppd/2.5.5/dhcpv6relay.la +usr/lib/pppd/2.5.5/dhcpv6relay.so +#usr/lib/pppd/2.5.5/minconn.la +usr/lib/pppd/2.5.5/minconn.so +#usr/lib/pppd/2.5.5/openl2tp.la +usr/lib/pppd/2.5.5/openl2tp.so +#usr/lib/pppd/2.5.5/passwordfd.la +usr/lib/pppd/2.5.5/passwordfd.so +#usr/lib/pppd/2.5.5/pppoatm.la +usr/lib/pppd/2.5.5/pppoatm.so +#usr/lib/pppd/2.5.5/pppoe.la +usr/lib/pppd/2.5.5/pppoe.so +#usr/lib/pppd/2.5.5/pppol2tp.la +usr/lib/pppd/2.5.5/pppol2tp.so +#usr/lib/pppd/2.5.5/radattr.la +usr/lib/pppd/2.5.5/radattr.so +#usr/lib/pppd/2.5.5/radius.la +usr/lib/pppd/2.5.5/radius.so +#usr/lib/pppd/2.5.5/radrealms.la +usr/lib/pppd/2.5.5/radrealms.so +#usr/lib/pppd/2.5.5/winbind.la +usr/lib/pppd/2.5.5/winbind.so usr/sbin/chat usr/sbin/pppd usr/sbin/pppdump diff --git a/lfs/ppp b/lfs/ppp index b0f7c66b2..eedfa3fbf 100644 --- a/lfs/ppp +++ b/lfs/ppp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.5.2 +VER = 2.5.5 # Download source file from https://download.samba.org/pub/ppp/ @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5a79bfaf23c2f1cba7b2c4e8f27e6033aa7ee6e119b4d96dfd2870f91524052fe9ed16149e5f76cf93370159f491af828b4103eb04bd4f5dbbecca4a08af9d0d +$(DL_FILE)_BLAKE2 = 2983bf73c0ac65599f4b21e802d1f7be68a004d60008f470a1f5acef3b5fdd3be8bacffb28eb75c9399695f9657398c2d8366acc20f9d5c9b7566f97b6f2ee64 install : $(TARGET) @@ -76,11 +76,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && autoreconf -vfi - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-4-increase-max-padi-attempts.patch - cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-5-headers_4.9.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-4-increase-max-padi-attempts.patch + cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-5-headers.patch cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/etc \ diff --git a/src/patches/ppp/ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch b/src/patches/ppp/ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch similarity index 65% rename from src/patches/ppp/ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch rename to src/patches/ppp/ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch index d755b89c3..cdbf9943e 100644 --- a/src/patches/ppp/ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch +++ b/src/patches/ppp/ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch @@ -1,16 +1,16 @@ diff -Naur pppd.orig/auth.c pppd/auth.c ---- pppd.orig/auth.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/auth.c 2024-10-07 16:12:09.202924555 +0200 +--- pppd.orig/auth.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/auth.c 2026-11-12 11:09:41.239609356 +0100 @@ -529,7 +529,7 @@ free(fname); return 0; } - ufile = fopen(fname, "r"); + ufile = fopen(fname, "re"); + check_res = ufile && ppp_check_access(fileno(ufile), fname, PPP_FT_SECRET); if (seteuid(euid) == -1) fatal("unable to regain privileges: %m"); - if (ufile == NULL) { -@@ -1552,7 +1552,7 @@ +@@ -1549,7 +1549,7 @@ filename = path_upapfile; addrs = opts = NULL; ret = UPAP_AUTHNAK; @@ -19,16 +19,16 @@ diff -Naur pppd.orig/auth.c pppd/auth.c if (f == NULL) { error("Can't open PAP password file %s: %m", filename); -@@ -1652,7 +1652,7 @@ - if (ret <= 0) { +@@ -1657,7 +1657,7 @@ + filename = path_upapfile; addrs = NULL; - f = fopen(filename, "r"); + f = fopen(filename, "re"); if (f == NULL) return 0; - check_access(f, filename); -@@ -1698,7 +1698,7 @@ + fd = fileno(f); +@@ -1707,7 +1707,7 @@ } filename = path_upapfile; @@ -36,8 +36,8 @@ diff -Naur pppd.orig/auth.c pppd/auth.c + f = fopen(filename, "re"); if (f == NULL) return 0; - check_access(f, filename); -@@ -1735,7 +1735,7 @@ + if (!ppp_check_access(fileno(f), filename, PPP_FT_SECRET)) { +@@ -1747,7 +1747,7 @@ } filename = path_upapfile; @@ -46,7 +46,7 @@ diff -Naur pppd.orig/auth.c pppd/auth.c if (f == NULL) return 0; -@@ -1777,7 +1777,7 @@ +@@ -1793,7 +1793,7 @@ } filename = path_chapfile; @@ -55,16 +55,7 @@ diff -Naur pppd.orig/auth.c pppd/auth.c if (f == NULL) return 0; -@@ -1815,7 +1815,7 @@ - struct wordlist *addrs; - - filename = PPP_PATH_SRPFILE; -- f = fopen(filename, "r"); -+ f = fopen(filename, "re"); - if (f == NULL) - return 0; - -@@ -1866,7 +1866,7 @@ +@@ -1852,7 +1852,7 @@ addrs = NULL; secbuf[0] = 0; @@ -73,34 +64,25 @@ diff -Naur pppd.orig/auth.c pppd/auth.c if (f == NULL) { error("Can't open chap secret file %s: %m", filename); return 0; -@@ -1919,7 +1919,7 @@ - filename = PPP_PATH_SRPFILE; - addrs = NULL; +@@ -2229,7 +2229,7 @@ + int fd; -- fp = fopen(filename, "r"); -+ fp = fopen(filename, "re"); - if (fp == NULL) { - error("Can't open srp secret file %s: %m", filename); - return 0; -@@ -2309,7 +2309,7 @@ - */ - if (word[0] == '@' && word[1] == '/') { strlcpy(atfile, word+1, sizeof(atfile)); - if ((sf = fopen(atfile, "r")) == NULL) { + if ((sf = fopen(atfile, "re")) == NULL) { warn("can't open indirect secret file %s", atfile); continue; } -@@ -2479,7 +2479,7 @@ +@@ -2406,7 +2406,7 @@ char pkfile[MAXWORDLEN]; filename = PPP_PATH_EAPTLSSERVFILE; - f = fopen(filename, "r"); + f = fopen(filename, "re"); if (f == NULL) - return 0; + return 0; -@@ -2536,7 +2536,7 @@ +@@ -2466,7 +2466,7 @@ return 1; filename = PPP_PATH_EAPTLSCLIFILE; @@ -109,19 +91,19 @@ diff -Naur pppd.orig/auth.c pppd/auth.c if (f == NULL) return 0; -@@ -2756,7 +2756,7 @@ +@@ -2692,7 +2692,7 @@ filename = (am_server ? PPP_PATH_EAPTLSSERVFILE : PPP_PATH_EAPTLSCLIFILE); addrs = NULL; - fp = fopen(filename, "r"); + fp = fopen(filename, "re"); - if (fp == NULL) - { + if (fp == NULL) { error("Can't open eap-tls secret file %s: %m", filename); + return 0; diff -Naur pppd.orig/options.c pppd/options.c ---- pppd.orig/options.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/options.c 2024-10-07 16:12:40.217129032 +0200 -@@ -572,7 +572,7 @@ +--- pppd.orig/options.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/options.c 2026-11-12 11:10:25.907467723 +0100 +@@ -607,7 +607,7 @@ ppp_option_error("unable to drop privileges to open %s: %m", filename); return 0; } @@ -131,9 +113,9 @@ diff -Naur pppd.orig/options.c pppd/options.c if (check_prot && seteuid(euid) == -1) fatal("unable to regain privileges"); diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c ---- pppd.orig/sys-linux.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/sys-linux.c 2024-10-07 16:13:35.002001250 +0200 -@@ -1970,7 +1970,7 @@ +--- pppd.orig/sys-linux.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/sys-linux.c 2026-11-12 11:11:38.918864877 +0100 +@@ -2070,7 +2070,7 @@ /* Default the mount location of /proc */ strlcpy (proc_path, "/proc", sizeof(proc_path)); proc_path_len = 5; @@ -142,7 +124,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fp != NULL) { while ((mntent = getmntent(fp)) != NULL) { if (strcmp(mntent->mnt_type, MNTTYPE_IGNORE) == 0) -@@ -2030,7 +2030,7 @@ +@@ -2130,7 +2130,7 @@ close_route_table(); path = path_to_procfs("/net/route"); @@ -151,12 +133,3 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (route_fd == NULL) { error("can't open routing table %s: %m", path); return 0; -@@ -2330,7 +2330,7 @@ - close_route_table(); - - path = path_to_procfs("/net/ipv6_route"); -- route_fd = fopen (path, "r"); -+ route_fd = fopen (path, "re"); - if (route_fd == NULL) { - error("can't open routing table %s: %m", path); - return 0; diff --git a/src/patches/ppp/ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch b/src/patches/ppp/ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch similarity index 79% rename from src/patches/ppp/ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch rename to src/patches/ppp/ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch index 72102b74d..dde1ccddd 100644 --- a/src/patches/ppp/ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch +++ b/src/patches/ppp/ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch @@ -1,19 +1,7 @@ -diff -Naur pppd.orig/eap.c pppd/eap.c ---- pppd.orig/eap.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/eap.c 2024-10-07 16:18:53.077603533 +0200 -@@ -1542,7 +1542,7 @@ - - if ((path = name_of_pn_file()) == NULL) - return (-1); -- fd = open(path, modebits, S_IRUSR | S_IWUSR); -+ fd = open(path, modebits, S_IRUSR | S_IWUSR | O_CLOEXEC); - err = errno; - free(path); - errno = err; diff -Naur pppd.orig/main.c pppd/main.c ---- pppd.orig/main.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/main.c 2024-10-07 16:19:34.702106298 +0200 -@@ -491,7 +491,7 @@ +--- pppd.orig/main.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/main.c 2026-11-12 11:19:25.172479688 +0100 +@@ -495,7 +495,7 @@ die(0); /* Make sure fds 0, 1, 2 are open to somewhere. */ @@ -23,9 +11,9 @@ diff -Naur pppd.orig/main.c pppd/main.c fatal("Couldn't open %s: %m", PPP_DEVNULL); while (fd_devnull <= 2) { diff -Naur pppd.orig/options.c pppd/options.c ---- pppd.orig/options.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/options.c 2024-10-07 16:21:04.207954343 +0200 -@@ -1736,9 +1736,9 @@ +--- pppd.orig/options.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/options.c 2026-11-12 11:20:37.072336180 +0100 +@@ -1803,9 +1803,9 @@ ppp_option_error("unable to drop permissions to open %s: %m", *argv); return 0; } @@ -38,9 +26,9 @@ diff -Naur pppd.orig/options.c pppd/options.c if (!privileged_option && seteuid(euid) == -1) fatal("unable to regain privileges: %m"); diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c ---- pppd.orig/sys-linux.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/sys-linux.c 2024-10-07 16:27:42.282472415 +0200 -@@ -656,7 +656,7 @@ +--- pppd.orig/sys-linux.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/sys-linux.c 2026-11-12 11:25:40.913760089 +0100 +@@ -647,7 +647,7 @@ goto err; } dbglog("using channel %d", chindex); @@ -49,7 +37,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd < 0) { error("Couldn't reopen /dev/ppp: %m"); goto err; -@@ -894,7 +894,7 @@ +@@ -974,7 +974,7 @@ dbglog("in make_ppp_unit, already had /dev/ppp open?"); close(ppp_dev_fd); } @@ -58,7 +46,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (ppp_dev_fd < 0) fatal("Couldn't open /dev/ppp: %m"); flags = fcntl(ppp_dev_fd, F_GETFL); -@@ -1015,7 +1015,7 @@ +@@ -1145,7 +1145,7 @@ if (!new_style_driver) return -1; @@ -67,7 +55,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (master_fd < 0) fatal("Couldn't open /dev/ppp: %m"); if (ioctl(master_fd, PPPIOCATTACH, &ifnum) < 0) { -@@ -2541,7 +2541,7 @@ +@@ -2529,7 +2529,7 @@ if (tune_kernel) { forw_path = path_to_procfs("/sys/net/ipv4/ip_forward"); if (forw_path != 0) { @@ -76,7 +64,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd >= 0) { if (write(fd, "1", 1) != 1) error("Couldn't enable IP forwarding: %m"); -@@ -2886,7 +2886,7 @@ +@@ -2905,7 +2905,7 @@ sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch); kernel_version = KVERSION(osmaj, osmin, ospatch); @@ -85,7 +73,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (fd >= 0) { new_style_driver = 1; -@@ -3064,7 +3064,7 @@ +@@ -3083,7 +3083,7 @@ #if __GLIBC__ >= 2 updwtmp(_PATH_WTMP, &ut); #else @@ -94,7 +82,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (wtmp >= 0) { flock(wtmp, LOCK_EX); -@@ -3288,7 +3288,7 @@ +@@ -3307,7 +3307,7 @@ int fd; path = path_to_procfs("/sys/net/ipv4/ip_dynaddr"); @@ -103,7 +91,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (write(fd, "1", 1) != 1) error("Couldn't enable dynamic IP addressing: %m"); close(fd); -@@ -3542,7 +3542,7 @@ +@@ -3561,7 +3561,7 @@ /* * Try the unix98 way first. */ @@ -112,7 +100,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (mfd >= 0) { int ptn; if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) { -@@ -3553,7 +3553,8 @@ +@@ -3572,7 +3572,8 @@ if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0) warn("Couldn't unlock pty slave %s: %m", pty_name); #endif @@ -122,7 +110,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c { warn("Couldn't open pty slave %s: %m", pty_name); close(mfd); -@@ -3567,10 +3568,10 @@ +@@ -3586,10 +3587,10 @@ for (i = 0; i < 64; ++i) { slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", 'p' + i / 16, i % 16); @@ -136,8 +124,8 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c ret = fchown(sfd, uid, -1); if (ret != 0) { diff -Naur pppd.orig/tdb.c pppd/tdb.c ---- pppd.orig/tdb.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/tdb.c 2024-10-07 16:30:04.033122023 +0200 +--- pppd.orig/tdb.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/tdb.c 2026-11-12 11:26:23.065046016 +0100 @@ -1276,7 +1276,7 @@ } @@ -148,9 +136,9 @@ diff -Naur pppd.orig/tdb.c pppd/tdb.c mkdir_recursive(PPP_PATH_VARRUN) == 0) goto again; diff -Naur pppd.orig/tty.c pppd/tty.c ---- pppd.orig/tty.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/tty.c 2024-10-07 16:31:11.161674911 +0200 -@@ -621,7 +621,7 @@ +--- pppd.orig/tty.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/tty.c 2026-11-12 11:27:38.333269267 +0100 +@@ -617,7 +617,7 @@ ppp_set_status(EXIT_OPEN_FAILED); goto errret; } @@ -159,7 +147,7 @@ diff -Naur pppd.orig/tty.c pppd/tty.c err = errno; if (prio < OPRIO_ROOT && seteuid(0) == -1) fatal("Unable to regain privileges"); -@@ -775,7 +775,7 @@ +@@ -771,7 +771,7 @@ if (connector == NULL && modem && devnam[0] != 0) { int i; for (;;) { @@ -169,9 +157,9 @@ diff -Naur pppd.orig/tty.c pppd/tty.c if (errno != EINTR) { error("Failed to reopen %s: %m", devnam); diff -Naur pppd.orig/utils.c pppd/utils.c ---- pppd.orig/utils.c 2024-09-18 06:30:31.000000000 +0200 -+++ pppd/utils.c 2024-10-07 16:32:37.780775463 +0200 -@@ -926,14 +926,14 @@ +--- pppd.orig/utils.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/utils.c 2026-11-12 11:28:57.716524818 +0100 +@@ -1034,14 +1034,14 @@ slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", PPP_PATH_LOCKDIR, dev); #endif @@ -188,7 +176,7 @@ diff -Naur pppd.orig/utils.c pppd/utils.c if (fd < 0) { if (errno == ENOENT) /* This is just a timing problem. */ continue; -@@ -1016,7 +1016,7 @@ +@@ -1124,7 +1124,7 @@ if (lock_file[0] == 0) return -1; diff --git a/src/patches/ppp/ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/src/patches/ppp/ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch similarity index 76% rename from src/patches/ppp/ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch rename to src/patches/ppp/ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch index cfd72e468..d8d82c14e 100644 --- a/src/patches/ppp/ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch +++ b/src/patches/ppp/ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch @@ -1,6 +1,6 @@ diff -Naur pppd.orig/plugins/pppoatm/pppoatm.c pppd/plugins/pppoatm/pppoatm.c ---- pppd.orig/plugins/pppoatm/pppoatm.c 2023-03-25 05:38:30.000000000 +0100 -+++ pppd/plugins/pppoatm/pppoatm.c 2023-06-30 13:21:33.397378347 +0200 +--- pppd.orig/plugins/pppoatm/pppoatm.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/plugins/pppoatm/pppoatm.c 2026-11-12 12:29:52.914103725 +0100 @@ -146,7 +146,7 @@ if (!device_got_set) @@ -11,11 +11,11 @@ diff -Naur pppd.orig/plugins/pppoatm/pppoatm.c pppd/plugins/pppoatm/pppoatm.c fatal("failed to create socket: %m"); memset(&qos, 0, sizeof qos); diff -Naur pppd.orig/plugins/pppoe/if.c pppd/plugins/pppoe/if.c ---- pppd.orig/plugins/pppoe/if.c 2022-12-30 02:12:39.000000000 +0100 -+++ pppd/plugins/pppoe/if.c 2023-06-30 13:24:11.372183452 +0200 -@@ -116,7 +116,7 @@ - stype = SOCK_PACKET; - #endif +--- pppd.orig/plugins/pppoe/if.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/plugins/pppoe/if.c 2026-11-12 12:30:40.688340967 +0100 +@@ -121,7 +121,7 @@ + return -1; + } - if ((fd = socket(domain, stype, htons(type))) < 0) { + if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) { @@ -23,9 +23,9 @@ diff -Naur pppd.orig/plugins/pppoe/if.c pppd/plugins/pppoe/if.c if (errno == EPERM) { fatal("Cannot create raw socket -- pppoe must be run as root."); diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c ---- pppd.orig/plugins/pppoe/plugin.c 2023-03-25 05:38:30.000000000 +0100 -+++ pppd/plugins/pppoe/plugin.c 2023-06-30 13:25:58.798782323 +0200 -@@ -155,7 +155,7 @@ +--- pppd.orig/plugins/pppoe/plugin.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/plugins/pppoe/plugin.c 2026-11-12 12:32:19.848885925 +0100 +@@ -150,7 +150,7 @@ /* server equipment). */ /* Opening this socket just before waitForPADS in the discovery() */ /* function would be more appropriate, but it would mess-up the code */ @@ -34,7 +34,7 @@ diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c if (conn->sessionSocket < 0) { error("Failed to create PPPoE socket: %m"); return -1; -@@ -166,7 +166,7 @@ +@@ -161,7 +161,7 @@ lcp_wantoptions[0].mru = conn->mru = conn->storedmru; /* Update maximum MRU */ @@ -43,7 +43,7 @@ diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c if (s < 0) { error("Can't get MTU for %s: %m", conn->ifName); goto errout; -@@ -364,7 +364,7 @@ +@@ -366,7 +366,7 @@ } /* Open a socket */ @@ -53,9 +53,9 @@ diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c } diff -Naur pppd.orig/plugins/pppol2tp/openl2tp.c pppd/plugins/pppol2tp/openl2tp.c ---- pppd.orig/plugins/pppol2tp/openl2tp.c 2023-03-10 02:50:41.000000000 +0100 -+++ pppd/plugins/pppol2tp/openl2tp.c 2023-06-30 13:22:30.055768865 +0200 -@@ -93,7 +93,7 @@ +--- pppd.orig/plugins/pppol2tp/openl2tp.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/plugins/pppol2tp/openl2tp.c 2026-11-12 12:32:57.130835623 +0100 +@@ -92,7 +92,7 @@ int result; if (openl2tp_fd < 0) { @@ -65,9 +65,9 @@ diff -Naur pppd.orig/plugins/pppol2tp/openl2tp.c pppd/plugins/pppol2tp/openl2tp. error("openl2tp connection create: %m"); return -ENOTCONN; diff -Naur pppd.orig/plugins/pppol2tp/pppol2tp.c pppd/plugins/pppol2tp/pppol2tp.c ---- pppd.orig/plugins/pppol2tp/pppol2tp.c 2022-12-30 02:12:39.000000000 +0100 -+++ pppd/plugins/pppol2tp/pppol2tp.c 2023-06-30 13:23:13.493756755 +0200 -@@ -220,7 +220,7 @@ +--- pppd.orig/plugins/pppol2tp/pppol2tp.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/plugins/pppol2tp/pppol2tp.c 2026-11-12 12:33:36.408832408 +0100 +@@ -221,7 +221,7 @@ struct ifreq ifr; int fd; @@ -77,9 +77,9 @@ diff -Naur pppd.orig/plugins/pppol2tp/pppol2tp.c pppd/plugins/pppol2tp/pppol2tp. memset (&ifr, '\0', sizeof (ifr)); ppp_get_ifname(ifr.ifr_name, sizeof(ifr.ifr_name)); diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c ---- pppd.orig/sys-linux.c 2023-06-30 13:11:25.715511251 +0200 -+++ pppd/sys-linux.c 2023-06-30 13:32:50.021272249 +0200 -@@ -499,12 +499,12 @@ +--- pppd.orig/sys-linux.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/sys-linux.c 2026-11-12 12:36:15.477835260 +0100 +@@ -483,12 +483,12 @@ void sys_init(void) { /* Get an internet socket for doing socket ioctls. */ @@ -94,7 +94,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (sock6_fd < 0) sock6_fd = -errno; /* save errno for later */ #endif -@@ -2675,7 +2675,7 @@ +@@ -2671,7 +2671,7 @@ struct ifreq ifreq; int ret, sock_fd; @@ -103,7 +103,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (sock_fd < 0) return -1; memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr)); -@@ -2698,7 +2698,7 @@ +@@ -2694,7 +2694,7 @@ struct ifreq ifreq; int ret, sock_fd; @@ -112,7 +112,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c if (sock_fd < 0) return -1; -@@ -2915,7 +2915,7 @@ +@@ -2942,7 +2942,7 @@ /* * Open a socket for doing the ioctl operations. */ @@ -122,9 +122,9 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c return 0; diff -Naur pppd.orig/tty.c pppd/tty.c ---- pppd.orig/tty.c 2023-06-30 13:14:06.450418113 +0200 -+++ pppd/tty.c 2023-06-30 13:33:31.285858278 +0200 -@@ -942,7 +942,7 @@ +--- pppd.orig/tty.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/tty.c 2026-11-12 12:36:47.785642537 +0100 +@@ -938,7 +938,7 @@ *sep = ':'; /* get a socket and connect it to the other end */ diff --git a/src/patches/ppp/ppp-2.5.1-4-increase-max-padi-attempts.patch b/src/patches/ppp/ppp-2.5.5-4-increase-max-padi-attempts.patch similarity index 64% rename from src/patches/ppp/ppp-2.5.1-4-increase-max-padi-attempts.patch rename to src/patches/ppp/ppp-2.5.5-4-increase-max-padi-attempts.patch index 002b6066d..9c7013214 100644 --- a/src/patches/ppp/ppp-2.5.1-4-increase-max-padi-attempts.patch +++ b/src/patches/ppp/ppp-2.5.5-4-increase-max-padi-attempts.patch @@ -1,7 +1,7 @@ diff -Naur pppd.orig/plugins/pppoe/pppoe.h pppd/plugins/pppoe/pppoe.h ---- pppd.orig/plugins/pppoe/pppoe.h 2022-12-30 02:12:39.000000000 +0100 -+++ pppd/plugins/pppoe/pppoe.h 2023-06-30 13:37:07.189078090 +0200 -@@ -143,7 +143,7 @@ +--- pppd.orig/plugins/pppoe/pppoe.h 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/plugins/pppoe/pppoe.h 2026-11-12 12:39:37.389855386 +0100 +@@ -141,7 +141,7 @@ #define STATE_TERMINATED 4 /* How many PADI/PADS attempts? */ diff --git a/src/patches/ppp/ppp-2.5.1-5-headers_4.9.patch b/src/patches/ppp/ppp-2.5.5-5-headers.patch similarity index 60% rename from src/patches/ppp/ppp-2.5.1-5-headers_4.9.patch rename to src/patches/ppp/ppp-2.5.5-5-headers.patch index dc6c22852..ebc978133 100644 --- a/src/patches/ppp/ppp-2.5.1-5-headers_4.9.patch +++ b/src/patches/ppp/ppp-2.5.5-5-headers.patch @@ -1,7 +1,7 @@ diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c ---- pppd.orig/plugins/pppoe/plugin.c 2023-06-30 13:25:58.798782323 +0200 -+++ pppd/plugins/pppoe/plugin.c 2023-06-30 13:50:23.150026201 +0200 -@@ -46,6 +46,8 @@ +--- pppd.orig/plugins/pppoe/plugin.c 2026-10-31 00:02:07.000000000 +0100 ++++ pppd/plugins/pppoe/plugin.c 2026-11-12 12:42:29.523097123 +0100 +@@ -43,6 +43,8 @@ #include #include #include