head 1.1; branch 1.1.1; access; symbols ppp-2-5-5:1.1.1.2 perseant-exfatfs-base-20261102:1.1.1.1 netbsd-11-1-RELEASE:1.1.1.1 netbsd-10-2-RELEASE:1.1.1.1 netbsd-11-0-RELEASE:1.1.1.1 netbsd-11-0-RC7:1.1.1.1 netbsd-11-0-RC6:1.1.1.1 netbsd-11-0-RC5:1.1.1.1 netbsd-11-0-RC4:1.1.1.1 netbsd-11-0-RC3:1.1.1.1 netbsd-11-0-RC2:1.1.1.1 netbsd-11-0-RC1:1.1.1.1 perseant-exfatfs-base-20250801:1.1.1.1 netbsd-11:1.1.1.1.0.10 netbsd-11-base:1.1.1.1 ppp-2-5-2:1.1.1.1 netbsd-10-1-RELEASE:1.1.1.1 perseant-exfatfs-base-20240630:1.1.1.1 perseant-exfatfs:1.1.1.1.0.8 perseant-exfatfs-base:1.1.1.1 netbsd-10-0-RELEASE:1.1.1.1 netbsd-10-0-RC6:1.1.1.1 netbsd-10-0-RC5:1.1.1.1 netbsd-10-0-RC4:1.1.1.1 netbsd-10-0-RC3:1.1.1.1 netbsd-10-0-RC2:1.1.1.1 netbsd-10-0-RC1:1.1.1.1 netbsd-10:1.1.1.1.0.6 netbsd-10-base:1.1.1.1 cjep_sun2x-base1:1.1.1.1 cjep_sun2x:1.1.1.1.0.4 cjep_sun2x-base:1.1.1.1 cjep_staticlib_x-base1:1.1.1.1 cjep_staticlib_x:1.1.1.1.0.2 cjep_staticlib_x-base:1.1.1.1 ppp-2-4-9:1.1.1.1 MACKERRAS:1.1.1; locks; strict; comment @# @; 1.1 date 2021.01.09.16.37.36; author christos; state Exp; branches 1.1.1.1; next ; commitid E1YeMokojLpiu4DC; 1.1.1.1 date 2021.01.09.16.37.36; author christos; state Exp; branches; next 1.1.1.2; commitid E1YeMokojLpiu4DC; 1.1.1.2 date 2026.11.13.16.40.03; author christos; state Exp; branches; next ; commitid 04XDB2hgXdkqRj3H; desc @@ 1.1 log @Initial revision @ text @#!/bin/sh # # A program or script which is executed after the remote system # successfully authenticates itself. It is executed with the parameters # # # # The environment is cleared before executing this script # so the path must be reset # PATH=/usr/sbin:/sbin:/usr/bin:/bin export PATH echo auth-down `date +'%y/%m/%d %T'` $* >> /var/log/pppstats # last line @ 1.1.1.1 log @What's new in ppp-2.4.9. ************************ * Support for new EAP (Extensible Authentication Protocol) methods: - Support for EAP-TLS, from Jan Just Keijser and others - Support for EAP-MSCHAPv2, from Eivind Næss, Thomas Omerzu, Tijs Van Buggenhout and others * New pppd options: - chap-timeout - chapms-strip-domain - replacedefaultroute - noreplacedefaultroute - ipv6cp-accept-remote - lcp-echo-adaptive - ip-up-script - ip-down-script - ca - capath - cert - key - crl-dir - crl - max-tls-version - need-peer-eap * Fixes for CVE-2020-8597 and CVE-2015-3310. * libpcap is now required when compiling on Linux (previously, if libpcap was not present, pppd would be compiled without packet filtering support). * The rp-pppoe plugin has been renamed to pppoe, to distinguish it from the upstream rp-pppoe code. Its options have changed names, but the old names are kept as aliases. * The configure script now supports cross-compilation. * Many bug fixes and cleanups. What was new in ppp-2.4.8. ************************** * New pppd options have been added: - ifname, to set the name for the PPP interface device - defaultroute-metric, to set the metric for the default route - defaultroute6, to add an IPv6 default route (with nodefaultroute6 to prevent adding an IPv6 default route) - up_sdnotify, to have pppd notify systemd when the link is up. * The rp-pppoe plugin has new options: - host-uniq, to set the Host-Uniq value to send - pppoe-padi-timeout, to set the timeout for discovery packets - pppoe-padi-attempts, to set the number of discovery attempts. * Added the CLASS attribute in radius packets. * Sundry bug fixes. * Fixed warnings and issues found by static analysis. * Added Submitting-patches.md. What was new in ppp-2.4.7. ************************** * Fixed a potential security issue in parsing option files (CVE-2014-3158). * There is a new "stop-bits" option, which takes an argument of 1 or 2, indicating the number of stop bits to use for async serial ports. * Various bug fixes. What was new in ppp-2.4.6. ************************** * Man page updates. * Several bug fixes. * Options files can now set and unset environment variables for scripts. * The timeout for chat scripts can now be taken from an environment variable. * There is a new option, master_detach, which allows pppd to detach from the controlling terminal when it is the multilink bundle master but its own link has terminated, even if the nodetach option has been given. @ text @@ 1.1.1.2 log @Import pppd-2.5.5 (previous was 2.5.2) Release 2.5.5 ============= This is a bug-fix and security release, with no new features. Changes include: * Fix bugs where hook scripts such as /etc/ppp/ip-up were not being run. * Fix bugs causing PPP_SCRIPT_INSTANCE to be set incorrectly for some scripts. * Fix validation of received frames in the RADIUS plugin, along with some further hardening against incorrect received frames. * Fix generation of MPPE keys when EAP-TLS is being used with TLS 1.3. * This makes it work with Windows clients, but breaks compatibility with earlier versions of pppd (but only in the case where EAP-TLS and MPPE and the 'max-tls-version 1.3' option are all being used). * Various cases existed in the MPPE code where the link could come up without MPPE encryption despite it being requested via one or more of the 'require- mppe', 'require-mppe-40' or 'require-mppe-128' options. This is now fixed. Also, pppd will now accept an MPPE CCP configuration option requesting no encryption from the peer if MPPE is not required (rather than rejecting it). * Fix a bug where the password from a file specified with the '+ua' option was not being used. Release 2.5.4 ============= This is primarily a security release, fixing several vulnerabilities including CVE-2026-75883 and CVE-2026-85495. For more details on this and other vulnerabilities fixed, see the GitHub advisories at: https://github.com/ppp-project/ppp/security/advisories?state=published These range in severity up to 6.8 (moderate). Many of the vulnerabilities are actually only of concern if pppd is installed setuid-root, which some distros still do, though 'make install' in this project does not install pppd setuid-root. Other changes include: * A new environment variable is defined for scripts, called PPP_SCRIPT_INSTANCE, which contains the original name of the script (e.g., ip-up). This can be useful when the name in argv[0] gets lost because the script is executed by an interpreter. * New options 'strict-script-checks', 'nostrict-script-checks', 'strict-secrets-files', and 'nostrict-secrets-files' have been added. The strict versions are the default, and the nostrict versions are privileged. 'strict-script-checks' enables checks on script files that are run as root (e.g., /etc/ppp/ip-up) to ensure that they are owned by root and not writable by group or other. 'strict-secrets-checks' enables checks on secrets files (such as /etc/ppp/chap-secrets) to ensure that they are not readable by group or other. Previously (and now with nostrict-secrets-checks) the check was done but only produced a warning; now by default pppd will refuse to use thek file. * For EAP-TLS and PEAP, the verification of the 'common name' in TLS certificates no longer stops the comparison at an embedded NUL character. The pppd man page now notes that the default verification mode is 'none' and that the 'suffix' verification mode doesn't check for a '.' in the common name before the matched suffix (this was the behaviour previously but the man page was incorrect). * Many more options are now privileged, in particular all of the RADIUS plugin options, and almost all the options relating to EAP-TLS and PEAP. * OpenSSL engine support in EAP-TLS is disabled by default, since engine support in OpenSSL 3 is deprecated. If you need it, use the --enable-openssl-engine flag to configure. * Pppd can now run as non-root as long as it has the CAP_NET_ADMIN capability. In that case, scripts are run as the invoking user, the user can use privileged options (provided the pppd binary was not marked as setuid or with additional capabilities), and the ownership checks use the user's effective UID rather than 0. * Various pppd options that take an integer argument now enforce sensible limits on the value. This aids in avoiding edge cases where vulnerabilities may lurk. * EAP-SRP support has been removed. Previously it was disabled by default. * Extra length checks have been added to ensure that the pppd code doesn't access outside the bounds of received packets, even when such accesses were harmless (i.e. within the bounds of the array that the received packet was stored in, and not affecting any result). * Various other minor bug fixes and improvements, including man page updates. Release 2.5.3 ============= * Several security improvements: - Some options are now privileged: 'set', 'unset', 'defaultroute', and 'defaultroute6'. If a non-root user running a setuid-root pppd needs to use these options, the system administrator will have to make a 'call' file in /etc/ppp/peers containing the required option(s) for the user's use. - Scripts, privileged options files, and secrets files are now subject to a path check, which checks that the file and each directory in the real path to the file are owned by root and not writable by non-root. - If pppd is installed setuid-root and run by a non-root user, the peer will be required to authenticate itself; previously this requirement only applied if the system had a default IPv4 route. * Default route handling has changed; pppd no longer checks for an existing default route before adding its default route. The defaultroute and defaultroute6 options are now privileged, and if used, the default route will always be added. The metric of the default route can be controlled with new defaultroute-metric and defaultroute6-metric options, which are privileged. The replacedefaultroute and noreplacedefaultroute options are no longer functional, and just cause an error message to be printed. * There is now a dhcpv6relay plugin, which can be used to provide IPv6 RAs to the remote side and relay the subsequent incoming DHCPv6 requests to a DHCPv6 server. Note: This is to delegate IPv6 to the remote side, not to configure IPv6 locally; in other words, this is generally only useful for service providers. For configuring IPv6 at an endpoint, projects like dhcpcd and/or radvd may be useful. * VRF (Virtual Routing and Forwarding) support has been added to pppd on Linux. There is now a 'vrf' option which tells pppd to bind the PPP interface to a specific VRF, so that routes are installed in the VRF's routing table rather than the main routing table. * The pppoe (PPP over ethernet) plugin now supports maximum packet sizes greater than 1492 bytes if configured to do so, a larger size is agreed upon during the PPPoE negotiation, and the peer agrees. * CBCP (Callback control protocol) support can still be selected at configuration time, but now a warning message will be printed, warning that CBCP support will be removed in a future version. If you use CBCP in pppd, let the maintainer know, for example by adding to issue #530. * Various other bug fixes and minor enhancements. @ text @d3 3 a5 3 # A program or script which is executed when the link goes down, if the remote # system successfully authenticates itself. It is executed with the parameters # @