* [PATCH] core207: Ship libssh
@ 2026-11-12 17:04 Adolf Belka
2026-11-12 17:04 ` [PATCH] core207: Ship lz4 Adolf Belka
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Adolf Belka @ 2026-11-12 17:04 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/core/207/filelists/libssh | 1 +
1 file changed, 1 insertion(+)
create mode 120000 config/rootfiles/core/207/filelists/libssh
diff --git a/config/rootfiles/core/207/filelists/libssh b/config/rootfiles/core/207/filelists/libssh
new file mode 120000
index 000000000..ecbb67053
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/libssh
@@ -0,0 +1 @@
+../../../common/libssh
\ No newline at end of file
--
2.56.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] core207: Ship lz4
2026-11-12 17:04 [PATCH] core207: Ship libssh Adolf Belka
@ 2026-11-12 17:04 ` Adolf Belka
2026-11-12 17:04 ` [PATCH] core207: Ship ppp Adolf Belka
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Adolf Belka @ 2026-11-12 17:04 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/core/207/filelists/lz4 | 1 +
1 file changed, 1 insertion(+)
create mode 120000 config/rootfiles/core/207/filelists/lz4
diff --git a/config/rootfiles/core/207/filelists/lz4 b/config/rootfiles/core/207/filelists/lz4
new file mode 120000
index 000000000..65c31802e
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/lz4
@@ -0,0 +1 @@
+../../../common/lz4
\ No newline at end of file
--
2.56.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] core207: Ship ppp
2026-11-12 17:04 [PATCH] core207: Ship libssh Adolf Belka
2026-11-12 17:04 ` [PATCH] core207: Ship lz4 Adolf Belka
@ 2026-11-12 17:04 ` Adolf Belka
2026-11-12 17:04 ` [PATCH] libssh: Update to version 0.12.2 Adolf Belka
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Adolf Belka @ 2026-11-12 17:04 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/core/207/filelists/ppp | 1 +
1 file changed, 1 insertion(+)
create mode 120000 config/rootfiles/core/207/filelists/ppp
diff --git a/config/rootfiles/core/207/filelists/ppp b/config/rootfiles/core/207/filelists/ppp
new file mode 120000
index 000000000..4844a9b58
--- /dev/null
+++ b/config/rootfiles/core/207/filelists/ppp
@@ -0,0 +1 @@
+../../../common/ppp
\ No newline at end of file
--
2.56.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] libssh: Update to version 0.12.2
2026-11-12 17:04 [PATCH] core207: Ship libssh Adolf Belka
2026-11-12 17:04 ` [PATCH] core207: Ship lz4 Adolf Belka
2026-11-12 17:04 ` [PATCH] core207: Ship ppp Adolf Belka
@ 2026-11-12 17:04 ` Adolf Belka
2026-11-12 17:04 ` [PATCH] lz4: Update to version 1.11.1 Adolf Belka
2026-11-12 17:04 ` [PATCH] ppp: Update to version 2.5.5 Adolf Belka
4 siblings, 0 replies; 6+ messages in thread
From: Adolf Belka @ 2026-11-12 17:04 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 0.11.3 to 0.12.2
- Update of rootfile
- 17 CVE fixes in total -1 in 0.12.2, 10 in 0.12.1 and 6 in 0.11.4
- Changelog
0.12.2
* Security:
* CVE-2026-59843: Denial of service via zero advertised channel packet size
(accidentally missed from previous release backports)
* Bugfixes:
* Fix fallback to default provider if FIPS provider does not have ML-KEM
implementation
* Do not override explicitly set options through a configuration file to
match OpenSSH behavior.
* Return SSH_KNOWN_HOSTS_UNKNOWN when GSSAPI key exchange is used without any
hostkey
* New API:
* API to check the GSSAPI key exchange was used for hostkey handling
* API to initiate GSSAPI keyex authentication (missing from last release)
0.12.1
* Security:
* CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
* CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
* CVE-2026-59844: Denial of service via oversized SFTP read length
* CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
* CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
* CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
* CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
* CVE-2026-59849: Denial of service via automatic certificate authentication loop
* CVE-2026-59850: Use-after-free via data callbacks on closed channels
* CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
* Zero-initialize every ssh_string
* Compatibility:
* Fix compatibility with C23 / gcc16
* Allow hybrid ML-KEM key exchange in FIPS mode
* Bugfixes:
* Fix multiple memory leaks, null checks, and error checks
* Fix parameter size mismatch in mlkem768x25519-sha256
* Fix client SFTP messages being ignored if sent at high rate
* Validate peer public key in DH key exchange
* Fix ambiguous error reporting of sftp_init
* Fix hidden integer underflow in socket packet callback
* Avoid remote window overflow
* Fix socket data callback return value on rekey failure
* Avoid off-by-one overflow during kbdint authentication
* Avoid logging uninitialized sequence numbers
* Avoid double conversion of SFTP version number
* Send correct SFTP server version number
* Avoid handling repeated SFTP INIT messages
* Harmonize return values from SFTP server callbacks
0.12.0
* Deprecations and removals:
* Bumped minimal RSA key size to 1024 bits
* New functionality:
* Add support for hybrid key exchange mechanisms using Quantum Resistant
cryptography for all backends. These are now preferred:
* sntrup761x25519-sha512, sntrup761x25519-sha512@openssh.com
* mlkem768nistp256-sha256
* mlkem768x25519-sha256
* mlkem1024nistp384-sha384 (only OpenSSL 3.5+ and libgcrypt)
* New cmake option WITH_HERMETIC_USR
* Added support for Ed25519 keys through PKCS#11
* Support for host-bound public key authentication
(publickey-hostbound-v00@openssh.com)
* Use curve25519 implementation from mbedTLS and libgcrypt
* New functions for signing arbitrary data (commits) with SSH keys
* sshsig_sign()
* sshsig_verify()
* Support for FIDO/U2F keys (internal implementation using libfido2)
* Compatible with OpenSSH: should work out of the box
* Extensible with callbacks
* Add support for GSSAPI Key Exchange (RFC 4462, RFC 8732)
* Add support for new configuration options (client and server):
* RequiredRsaSize
* AddressFamily (client)
* GSSAPIKeyExchange
* GSSAPIKexAlgorithms
* New option to get list of configured identities (SSH_OPTIONS_NEXT_IDENTITY)
* More OpenSSH compatible percent expansion characters
* Add new server auth_kbdint_function() callback
* New PKI Context structure for key operations
* Stability and compatibility improvements of ProxyJump
* SFTP
* Prevent failures when SFTP status message does not contain error message
* Fix possible timeouts while waiting for SFTP messages
* Support for users-groups-by-id@openssh.com extension in client
* Support for SSH_FXF_TRUNC in server
0.11.4
* Security:
* CVE-2025-14821: libssh loads configuration files from the C:\etc directory
on Windows
* CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
* CVE-2026-0965: Possible Denial of Service when parsing unexpected
configuration files
* CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
* CVE-2026-0967: Specially crafted patterns could cause DoS
* CVE-2026-0968: OOB Read in sftp_parse_longname()
* libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP
extensions
* Stability and compatibility improvements of ProxyJump
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/libssh | 2 +-
lfs/libssh | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/config/rootfiles/common/libssh b/config/rootfiles/common/libssh
index d0b55519f..f1c62b25a 100644
--- a/config/rootfiles/common/libssh
+++ b/config/rootfiles/common/libssh
@@ -14,5 +14,5 @@
#usr/lib/cmake/libssh/libssh-config.cmake
#usr/lib/libssh.so
usr/lib/libssh.so.4
-usr/lib/libssh.so.4.10.3
+usr/lib/libssh.so.4.12.0
#usr/lib/pkgconfig/libssh.pc
diff --git a/lfs/libssh b/lfs/libssh
index 26d41dd38..90e0618c6 100644
--- a/lfs/libssh
+++ b/lfs/libssh
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 0.11.3
+VER = 0.12.2
THISAPP = libssh-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 859e4af9bf6305e54175e456d153a85e678a6fc49ac184dbe09d94ab01dde42f0321f5a2ac35cf4ca9df188daab6c4bf3171dcd8a3776419a3a1a20474ccf89a
+$(DL_FILE)_BLAKE2 = 1cb3b2b05e399181dd215502bb1802fb8d428249f809ba166a90903f67825dac1d4639d57177b3f820529759f61a58e58a51d3502e24ef68c86e4804f4c8b738
install : $(TARGET)
--
2.56.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] lz4: Update to version 1.11.1
2026-11-12 17:04 [PATCH] core207: Ship libssh Adolf Belka
` (2 preceding siblings ...)
2026-11-12 17:04 ` [PATCH] libssh: Update to version 0.12.2 Adolf Belka
@ 2026-11-12 17:04 ` Adolf Belka
2026-11-12 17:04 ` [PATCH] ppp: Update to version 2.5.5 Adolf Belka
4 siblings, 0 replies; 6+ messages in thread
From: Adolf Belka @ 2026-11-12 17:04 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 1.10.0 to 1.11.1
- Update of rootfile
- Although there are no CVE's some of the bug fixes look like security related issues.
- Changelog
1.11.1
fix : `LZ4_resetStreamHC()` could write out of bounds at levels >= 10, on a
state containing garbage (since v1.11.0)
perf : faster decompression on ppc64 (+12% to +24% on silesia),
`LZ4_FAST_DEC_LOOP` enabled, by @runlevel5
perf : `lz4 -l` compresses small files up to 10x faster : no more threads
than blocks
api : restored the unprefixed lz4frame enums and types
(`LZ4F_ENABLE_OBSOLETE_ENUMS`), employed by zstd, now deprecated (compilation
warning), reported by @diizzyy
cli : help (`-h`, `-H`, `--help`) outputs to stdout, requested by @tansy
cli : `--list` reads standard input again (since v1.10.0)
cli : various fixes (`--list`, `--stdout`, `--force`, multiple inputs,
Windows pipes, modification time, output creation), by @lee3Q, @immanuwell
and @rudycelekli
build: `lz4file.h` usable from cmake (since v1.10.0) and meson installations,
reported by @rudycelekli
build: MinGW builds with clang and lld (since v1.11.0), reported by @tansy
build: `make` with `BUILD_STATIC=no` or `BUILD_SHARED=no` (since v1.11.0),
by @xry111
1.11.0
fix : data corruption in valid usage : ring buffer decoding
(`LZ4_decoderRingBufferSize()`, since v1.9.0), rare cases of streaming or
`destSize` compression, one reported by @freedom-winds
fix : single-thread `lz4` could truncate the decoding of concatenated frames
with block checksums
fix : multithreaded decompression could write out of bounds after 2^31
frames (since v1.10.0), by @arshsmith1
fix : `LZ4F_compressBegin_usingDict()` ignored the dictionary with
independent blocks
fix : some periodic data compressed up to 30x worse at fast levels, and very
slowly at level 12, reported by @martinus
fix : invalid arguments (negative sizes, `NULL`, invalid `blockSizeID`,
extreme levels) no longer crash nor overflow, by @arthuz-th,
@jaypatrickhoward, @louislafosse, @akashdeshmukh-git, @rinsuki
fix : lz4file reports truncated files and write failures, and accepts
files < 19 bytes, by @axiqia
perf : faster decompression on aarch64 and x86-64 (up to +19%, +4% on
silesia.tar), `LZ4_FAST_DEC_LOOP` on aarch64 with clang and on riscv64, by
@Nicoshev and @arpadpanyik-arm
perf : faster compression of small blocks at fast levels, with reused states
(up to +80%) or dictionaries (up to +35%), partly proposed by @BiplabRaut
perf : faster levels 11 and 12 (+8% to +27%), level 2 compresses ~0.8% better
perf : x86 builds avoid the JCC erratum : up to +12% compression and +31%
decompression on Intel Skylake-family cpus
api : multithreaded lz4frame compression (experimental
`LZ4F_preferences_t.nbWorkers`) : output independent of the nb of workers
and of the context's history
api : random access within frames and lz4 files : `LZ4F_resumeFrame()`,
`LZ4F_seek()`, `LZ4F_tell()` (static)
api : `LZ4_decompress_safe()` returns distinct error codes : `-1` malformed
input, `-2` `dstCapacity` too small, `-3` missing dictionary
api : lz4frame compression accepts any `dstCapacity`, and only fails if the
output doesn't fit
api : removed from headers : functions deprecated since v1.7.x / v1.8.0
(still exported by liblz4), unprefixed lz4frame enums ; `LZ4_resetStream()`
and `LZ4_resetStreamHC()` are deprecated
api : `LZ4F_compressOptions_t` must be zero-initialized ; reserved fields
are scalars (flatten positional initializers) ; `LZ4F_uncompressedUpdate()`
deprecated (use `.uncompressed`)
api : custom allocators for lz4file (`_advanced()` functions),
`LZ4_USER_MEMORY_FUNCTIONS` also for lz4frame and lz4file ;
`LZ4F_cctx_size()` and `LZ4F_dctx_size()` by @felixhandte
api : HC states include the buffer of levels 10+ (+64 KB per state) : no
allocation during compression
cli : multithreaded compression relies on liblz4 : same output with any nb
of threads and without multithreading support ; `-T#` within a memory budget
(`--memory=#`) ; new `--single-thread`
cli : decodes Firefox's mozlz4 files, proposed by @UnitedMarsupials, and
legacy frames with the Linux kernel end marker, requested by @benjarobin
(frame format documentation by @Artoria2e5)
cli : safer file handling : an output identical to the input is refused, a
source modified during compression is detected, `--rm` keeps the source
after failures, by @Furan666, @Nexory and @immanuwell
cli : benchmark (`-b`) measures frames, compressed as `lz4` does with the
same options
cli : various fixes (`--list`, legacy format, benchmark, `-t -m`, numeric
arguments), by @tansy, @jmestwa-coder, @akashdeshmukh-git, @arshsmith1,
@jlee303 and @Nexory
build: dynamic library multithreaded by default, static library
single-threaded ; cmake `lz4` multithreaded
build: cmake : exported `lz4::lz4` target by @dg0yt, CMake 4 support by
@GeorgH93, `CMAKE_POSITION_INDEPENDENT_CODE` by @ds-sloth
build: cmake : as a subproject, the `lz4` program is no longer built by
default (`-DLZ4_BUILD_CLI=ON` restores it), by @crueter
build: reproducible static library by @rpurdie, AIX support by @shubhamhii,
meson fixes by @grobian, @bgilbert and @eli-schwartz, other fixes by
@hotschmoe, @iwamatsu, @doraorak, @JCash and @brainy
port : RISC-V with `Zicclsm` uses unaligned memory accesses, by @Polaris-911
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/lz4 | 2 +-
lfs/lz4 | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/config/rootfiles/common/lz4 b/config/rootfiles/common/lz4
index 795207c1a..d73e5663c 100644
--- a/config/rootfiles/common/lz4
+++ b/config/rootfiles/common/lz4
@@ -10,7 +10,7 @@ usr/bin/lz4
#usr/lib/liblz4.a
#usr/lib/liblz4.so
usr/lib/liblz4.so.1
-usr/lib/liblz4.so.1.10.0
+usr/lib/liblz4.so.1.11.1
#usr/lib/pkgconfig/liblz4.pc
#usr/share/man/man1/lz4.1
#usr/share/man/man1/lz4c.1
diff --git a/lfs/lz4 b/lfs/lz4
index cd7488778..1cb4fb1fd 100644
--- a/lfs/lz4
+++ b/lfs/lz4
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2024 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 1.10.0
+VER = 1.11.1
THISAPP = lz4-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = c87a939b748b0449e4f1869579ebc109704aa89e8699b6029217f6786c351d1b0329580dd3a955fe509efb113f29aecbafc83084d65d153f5d43610f4840a819
+$(DL_FILE)_BLAKE2 = ff75a065c2e088cdef33608342ac31b892f8b3397a8474f5970c38b1b95035136ba7f4cea2b757cc04a737e6292ada2a36aeb69cd43da67af7d45443dfe0a5ae
install : $(TARGET)
--
2.56.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] ppp: Update to version 2.5.5
2026-11-12 17:04 [PATCH] core207: Ship libssh Adolf Belka
` (3 preceding siblings ...)
2026-11-12 17:04 ` [PATCH] lz4: Update to version 1.11.1 Adolf Belka
@ 2026-11-12 17:04 ` Adolf Belka
4 siblings, 0 replies; 6+ messages in thread
From: Adolf Belka @ 2026-11-12 17:04 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 2.5.2 to 2.5.5
- Update of rootfile
- Update of patches as some of the files changed enough to no longer have the old
able to successfully apply.
- Changelog
2.5.5
This is a bug-fix and security release, with no new features. Changes include:
Fix bugs where hook scripts such as /etc/ppp/ip-up were not being run.
Fix bugs causing PPP_SCRIPT_INSTANCE to be set incorrectly for some scripts.
Fix validation of received frames in the RADIUS plugin, along with some further
hardening against incorrect received frames.
Fix generation of MPPE keys when EAP-TLS is being used with TLS 1.3. This makes
it work with Windows clients, but breaks compatibility with earlier versions
of pppd (but only in the case where EAP-TLS and MPPE and the
'max-tls-version 1.3' option are all being used).
Various cases existed in the MPPE code where the link could come up without MPPE
encryption despite it being requested via one or more of the 'require-mppe',
'require-mppe-40' or 'require-mppe-128' options. This is now fixed. Also,
pppd will now accept an MPPE CCP configuration option requesting no
encryption from the peer if MPPE is not required (rather than rejecting it).
Fix a bug where the password from a file specified with the '+ua' option was not
being used.
2.5.4
This is primarily a security release, fixing several vulnerabilities including
CVE-2026-75883 and CVE-2026-85495. For more details on this and other
vulnerabilities fixed, see the github advisories at
https://github.com/ppp-project/ppp/security/advisories?state=published
These range in severity up to 6.8 (moderate). Many of the vulnerabilities are
actually only of concern if pppd is installed setuid-root, which some
distros still do, though 'make install' in this project does not install
pppd setuid-root.
Other changes include:
A new environment variable is defined for scripts, called PPP_SCRIPT_INSTANCE,
which contains the original name of the script (e.g., ip-up). This can be
useful when the name in argv[0] gets lost because the script is executed by
an interpreter.
New options 'strict-script-checks', 'nostrict-script-checks',
'strict-secrets-files' and 'nostrict-secrets-files' have been added. The
strict versions are the default, and the nostrict versions are privileged.
'strict-script-checks' enables checks on script files that are run as root
(e.g., /etc/ppp/ip-up) to ensure that they are owned by root and not
writable by group or other. 'strict-secrets-checks' enables checks on
secrets files (such as /etc/ppp/chap-secrets) to ensure that they are not
readable by group or other. Previously (and now with nostrict-secrets-checks)
the check was done but only produced a warning; now by default pppd will
refuse to use the file.
For EAP-TLS and PEAP, the verification of the 'common name' in TLS certificates
no longer stops the comparison at an embedded NUL character. The pppd man
page now notes that the default verification mode is 'none' and that the
'suffix' verification mode doesn't check for a '.' in the common name before
the matched suffix (this was the behaviour previously but the man page was
incorrect).
Many more options are now privileged, in particular all of the RADIUS plugin
options, and almost all the options relating to EAP-TLS and PEAP.
OpenSSL engine support in EAP-TLS is disabled by default, since engine support
in OpenSSL 3 is deprecated. If you need it, use the --enable-openssl-engine
flag to configure.
Pppd can now run as non-root as long as it has the CAP_NET_ADMIN capability. In
that case, scripts are run as the invoking user, the user can use privileged
options (provided the pppd binary was not marked as setuid or with
additional capabilities), and the ownership checks use the user's effective
UID rather than 0.
Various pppd options that take an integer argument now enforce sensible limits on
the value. This aids in avoiding edge cases where vulnerabilities may lurk.
EAP-SRP support has been removed. Previously it was disabled by default.
Extra length checks have been added to ensure that the pppd code doesn't access
outside the bounds of received packets, even when such accesses were
harmless (i.e. within the bounds of the array that the received packet was
stored in, and not affecting any result).
Various other minor bug fixes and improvements, including man page updates.
2.5.3
Several security improvements:
Some options are now privileged: 'set', 'unset', 'defaultroute', and
'defaultroute6'. If a non-root user running a setuid-root pppd needs
to use these options, the system administrator will have to make a
'call' file in /etc/ppp/peers containing the required option(s) for
the user's use.
Scripts, privileged options files and secrets files now are subject to a
path check, which checks that the file and each directory in the real
path to the file are owned by root and not writable by non-root.
If pppd is installed setuid-root and run by a non-root user, the peer
will be required to authenticate itself; previously this requirement
only applied if the system had a default IPv4 route.
Default route handling has changed; pppd no longer checks for an existing
default route before adding its default route. The defaultroute and
defaultroute6 options are now privileged, and if used, the default route
will always be added. The metric of the default route can be controlled
with new defaultroute-metric and defaultroute6-metric options, which are
privileged. The replacedefaultroute and noreplacedefaultroute options are no
longer functional, and just cause an error message to be printed.
There is now a dhcpv6relay plugin, which can be used to provide IPv6 RAs to
the remote side and relay the subsequent incoming DHCPv6 requests to a
DHCPv6 server. Note: This is to delegate IPv6 to the remote side, not to
configure IPv6 locally; in other words, this is generally only useful for
service providers. For configuring IPv6 at an endpoint, projects like
dhcpcd and/or radvd may be useful.
VRF (Virtual Routing and Forwarding) support has been added to pppd on Linux.
There is now a 'vrf' option which tells pppd to bind the PPP interface to a
specific VRF, so that routes are installed in the VRF's routing table rather
than the main routing table.
The pppoe (PPP over ethernet) plugin now supports maximum packet sizes
greater than 1492 bytes if configured to do so, a larger size is agreed
upon during the PPPoE negotiation, and the peer agrees.
CBCP (Callback control protocol) support can still be selected at
configuration time, but now a warning message will be printed, warning that
CBCP support will be removed in a future version. If you use CBCP in pppd,
let the maintainer know, for example by adding to issue #530.
Various other bug fixes and minor enhancements.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/ppp | 44 +++++-----
lfs/ppp | 16 ++--
...don-t-want-to-accidentally-leak-fds.patch} | 81 +++++++------------
...2.5.5-2-everywhere-O_CLOEXEC-harder.patch} | 68 +++++++---------
...e-SOCK_CLOEXEC-when-creating-socket.patch} | 54 ++++++-------
...-2.5.5-4-increase-max-padi-attempts.patch} | 6 +-
| 6 +-
7 files changed, 119 insertions(+), 156 deletions(-)
rename src/patches/ppp/{ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch => ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch} (65%)
rename src/patches/ppp/{ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch => ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch} (79%)
rename src/patches/ppp/{ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch => ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch} (76%)
rename src/patches/ppp/{ppp-2.5.1-4-increase-max-padi-attempts.patch => ppp-2.5.5-4-increase-max-padi-attempts.patch} (64%)
rename src/patches/ppp/{ppp-2.5.1-5-headers_4.9.patch => ppp-2.5.5-5-headers.patch} (60%)
diff --git a/config/rootfiles/common/ppp b/config/rootfiles/common/ppp
index fe2d0d244..0a8170179 100644
--- a/config/rootfiles/common/ppp
+++ b/config/rootfiles/common/ppp
@@ -38,27 +38,29 @@ etc/ppp/standardloginscript
#usr/include/pppd/upap.h
#usr/lib/pkgconfig/pppd.pc
usr/lib/pppd
-usr/lib/pppd/2.5.2
-#usr/lib/pppd/2.5.2/minconn.la
-usr/lib/pppd/2.5.2/minconn.so
-#usr/lib/pppd/2.5.2/openl2tp.la
-usr/lib/pppd/2.5.2/openl2tp.so
-#usr/lib/pppd/2.5.2/passwordfd.la
-usr/lib/pppd/2.5.2/passwordfd.so
-#usr/lib/pppd/2.5.2/pppoatm.la
-usr/lib/pppd/2.5.2/pppoatm.so
-#usr/lib/pppd/2.5.2/pppoe.la
-usr/lib/pppd/2.5.2/pppoe.so
-#usr/lib/pppd/2.5.2/pppol2tp.la
-usr/lib/pppd/2.5.2/pppol2tp.so
-#usr/lib/pppd/2.5.2/radattr.la
-usr/lib/pppd/2.5.2/radattr.so
-#usr/lib/pppd/2.5.2/radius.la
-usr/lib/pppd/2.5.2/radius.so
-#usr/lib/pppd/2.5.2/radrealms.la
-usr/lib/pppd/2.5.2/radrealms.so
-#usr/lib/pppd/2.5.2/winbind.la
-usr/lib/pppd/2.5.2/winbind.so
+usr/lib/pppd/2.5.5
+#usr/lib/pppd/2.5.5/dhcpv6relay.la
+usr/lib/pppd/2.5.5/dhcpv6relay.so
+#usr/lib/pppd/2.5.5/minconn.la
+usr/lib/pppd/2.5.5/minconn.so
+#usr/lib/pppd/2.5.5/openl2tp.la
+usr/lib/pppd/2.5.5/openl2tp.so
+#usr/lib/pppd/2.5.5/passwordfd.la
+usr/lib/pppd/2.5.5/passwordfd.so
+#usr/lib/pppd/2.5.5/pppoatm.la
+usr/lib/pppd/2.5.5/pppoatm.so
+#usr/lib/pppd/2.5.5/pppoe.la
+usr/lib/pppd/2.5.5/pppoe.so
+#usr/lib/pppd/2.5.5/pppol2tp.la
+usr/lib/pppd/2.5.5/pppol2tp.so
+#usr/lib/pppd/2.5.5/radattr.la
+usr/lib/pppd/2.5.5/radattr.so
+#usr/lib/pppd/2.5.5/radius.la
+usr/lib/pppd/2.5.5/radius.so
+#usr/lib/pppd/2.5.5/radrealms.la
+usr/lib/pppd/2.5.5/radrealms.so
+#usr/lib/pppd/2.5.5/winbind.la
+usr/lib/pppd/2.5.5/winbind.so
usr/sbin/chat
usr/sbin/pppd
usr/sbin/pppdump
diff --git a/lfs/ppp b/lfs/ppp
index b0f7c66b2..eedfa3fbf 100644
--- a/lfs/ppp
+++ b/lfs/ppp
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.5.2
+VER = 2.5.5
# Download source file from https://download.samba.org/pub/ppp/
@@ -45,7 +45,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 5a79bfaf23c2f1cba7b2c4e8f27e6033aa7ee6e119b4d96dfd2870f91524052fe9ed16149e5f76cf93370159f491af828b4103eb04bd4f5dbbecca4a08af9d0d
+$(DL_FILE)_BLAKE2 = 2983bf73c0ac65599f4b21e802d1f7be68a004d60008f470a1f5acef3b5fdd3be8bacffb28eb75c9399695f9657398c2d8366acc20f9d5c9b7566f97b6f2ee64
install : $(TARGET)
@@ -76,11 +76,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
cd $(DIR_APP) && autoreconf -vfi
- cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch
- cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch
- cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch
- cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-4-increase-max-padi-attempts.patch
- cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.1-5-headers_4.9.patch
+ cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch
+ cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch
+ cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch
+ cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-4-increase-max-padi-attempts.patch
+ cd $(DIR_APP) && patch -Np0 -i $(DIR_SRC)/src/patches/ppp/ppp-2.5.5-5-headers.patch
cd $(DIR_APP) && ./configure \
--prefix=/usr \
--sysconfdir=/etc \
diff --git a/src/patches/ppp/ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch b/src/patches/ppp/ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch
similarity index 65%
rename from src/patches/ppp/ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch
rename to src/patches/ppp/ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch
index d755b89c3..cdbf9943e 100644
--- a/src/patches/ppp/ppp-2.5.1-1-we-don-t-want-to-accidentally-leak-fds.patch
+++ b/src/patches/ppp/ppp-2.5.5-1-we-don-t-want-to-accidentally-leak-fds.patch
@@ -1,16 +1,16 @@
diff -Naur pppd.orig/auth.c pppd/auth.c
---- pppd.orig/auth.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/auth.c 2024-10-07 16:12:09.202924555 +0200
+--- pppd.orig/auth.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/auth.c 2026-11-12 11:09:41.239609356 +0100
@@ -529,7 +529,7 @@
free(fname);
return 0;
}
- ufile = fopen(fname, "r");
+ ufile = fopen(fname, "re");
+ check_res = ufile && ppp_check_access(fileno(ufile), fname, PPP_FT_SECRET);
if (seteuid(euid) == -1)
fatal("unable to regain privileges: %m");
- if (ufile == NULL) {
-@@ -1552,7 +1552,7 @@
+@@ -1549,7 +1549,7 @@
filename = path_upapfile;
addrs = opts = NULL;
ret = UPAP_AUTHNAK;
@@ -19,16 +19,16 @@ diff -Naur pppd.orig/auth.c pppd/auth.c
if (f == NULL) {
error("Can't open PAP password file %s: %m", filename);
-@@ -1652,7 +1652,7 @@
- if (ret <= 0) {
+@@ -1657,7 +1657,7 @@
+
filename = path_upapfile;
addrs = NULL;
- f = fopen(filename, "r");
+ f = fopen(filename, "re");
if (f == NULL)
return 0;
- check_access(f, filename);
-@@ -1698,7 +1698,7 @@
+ fd = fileno(f);
+@@ -1707,7 +1707,7 @@
}
filename = path_upapfile;
@@ -36,8 +36,8 @@ diff -Naur pppd.orig/auth.c pppd/auth.c
+ f = fopen(filename, "re");
if (f == NULL)
return 0;
- check_access(f, filename);
-@@ -1735,7 +1735,7 @@
+ if (!ppp_check_access(fileno(f), filename, PPP_FT_SECRET)) {
+@@ -1747,7 +1747,7 @@
}
filename = path_upapfile;
@@ -46,7 +46,7 @@ diff -Naur pppd.orig/auth.c pppd/auth.c
if (f == NULL)
return 0;
-@@ -1777,7 +1777,7 @@
+@@ -1793,7 +1793,7 @@
}
filename = path_chapfile;
@@ -55,16 +55,7 @@ diff -Naur pppd.orig/auth.c pppd/auth.c
if (f == NULL)
return 0;
-@@ -1815,7 +1815,7 @@
- struct wordlist *addrs;
-
- filename = PPP_PATH_SRPFILE;
-- f = fopen(filename, "r");
-+ f = fopen(filename, "re");
- if (f == NULL)
- return 0;
-
-@@ -1866,7 +1866,7 @@
+@@ -1852,7 +1852,7 @@
addrs = NULL;
secbuf[0] = 0;
@@ -73,34 +64,25 @@ diff -Naur pppd.orig/auth.c pppd/auth.c
if (f == NULL) {
error("Can't open chap secret file %s: %m", filename);
return 0;
-@@ -1919,7 +1919,7 @@
- filename = PPP_PATH_SRPFILE;
- addrs = NULL;
+@@ -2229,7 +2229,7 @@
+ int fd;
-- fp = fopen(filename, "r");
-+ fp = fopen(filename, "re");
- if (fp == NULL) {
- error("Can't open srp secret file %s: %m", filename);
- return 0;
-@@ -2309,7 +2309,7 @@
- */
- if (word[0] == '@' && word[1] == '/') {
strlcpy(atfile, word+1, sizeof(atfile));
- if ((sf = fopen(atfile, "r")) == NULL) {
+ if ((sf = fopen(atfile, "re")) == NULL) {
warn("can't open indirect secret file %s", atfile);
continue;
}
-@@ -2479,7 +2479,7 @@
+@@ -2406,7 +2406,7 @@
char pkfile[MAXWORDLEN];
filename = PPP_PATH_EAPTLSSERVFILE;
- f = fopen(filename, "r");
+ f = fopen(filename, "re");
if (f == NULL)
- return 0;
+ return 0;
-@@ -2536,7 +2536,7 @@
+@@ -2466,7 +2466,7 @@
return 1;
filename = PPP_PATH_EAPTLSCLIFILE;
@@ -109,19 +91,19 @@ diff -Naur pppd.orig/auth.c pppd/auth.c
if (f == NULL)
return 0;
-@@ -2756,7 +2756,7 @@
+@@ -2692,7 +2692,7 @@
filename = (am_server ? PPP_PATH_EAPTLSSERVFILE : PPP_PATH_EAPTLSCLIFILE);
addrs = NULL;
- fp = fopen(filename, "r");
+ fp = fopen(filename, "re");
- if (fp == NULL)
- {
+ if (fp == NULL) {
error("Can't open eap-tls secret file %s: %m", filename);
+ return 0;
diff -Naur pppd.orig/options.c pppd/options.c
---- pppd.orig/options.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/options.c 2024-10-07 16:12:40.217129032 +0200
-@@ -572,7 +572,7 @@
+--- pppd.orig/options.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/options.c 2026-11-12 11:10:25.907467723 +0100
+@@ -607,7 +607,7 @@
ppp_option_error("unable to drop privileges to open %s: %m", filename);
return 0;
}
@@ -131,9 +113,9 @@ diff -Naur pppd.orig/options.c pppd/options.c
if (check_prot && seteuid(euid) == -1)
fatal("unable to regain privileges");
diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
---- pppd.orig/sys-linux.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/sys-linux.c 2024-10-07 16:13:35.002001250 +0200
-@@ -1970,7 +1970,7 @@
+--- pppd.orig/sys-linux.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/sys-linux.c 2026-11-12 11:11:38.918864877 +0100
+@@ -2070,7 +2070,7 @@
/* Default the mount location of /proc */
strlcpy (proc_path, "/proc", sizeof(proc_path));
proc_path_len = 5;
@@ -142,7 +124,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (fp != NULL) {
while ((mntent = getmntent(fp)) != NULL) {
if (strcmp(mntent->mnt_type, MNTTYPE_IGNORE) == 0)
-@@ -2030,7 +2030,7 @@
+@@ -2130,7 +2130,7 @@
close_route_table();
path = path_to_procfs("/net/route");
@@ -151,12 +133,3 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (route_fd == NULL) {
error("can't open routing table %s: %m", path);
return 0;
-@@ -2330,7 +2330,7 @@
- close_route_table();
-
- path = path_to_procfs("/net/ipv6_route");
-- route_fd = fopen (path, "r");
-+ route_fd = fopen (path, "re");
- if (route_fd == NULL) {
- error("can't open routing table %s: %m", path);
- return 0;
diff --git a/src/patches/ppp/ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch b/src/patches/ppp/ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch
similarity index 79%
rename from src/patches/ppp/ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch
rename to src/patches/ppp/ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch
index 72102b74d..dde1ccddd 100644
--- a/src/patches/ppp/ppp-2.5.1-2-everywhere-O_CLOEXEC-harder.patch
+++ b/src/patches/ppp/ppp-2.5.5-2-everywhere-O_CLOEXEC-harder.patch
@@ -1,19 +1,7 @@
-diff -Naur pppd.orig/eap.c pppd/eap.c
---- pppd.orig/eap.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/eap.c 2024-10-07 16:18:53.077603533 +0200
-@@ -1542,7 +1542,7 @@
-
- if ((path = name_of_pn_file()) == NULL)
- return (-1);
-- fd = open(path, modebits, S_IRUSR | S_IWUSR);
-+ fd = open(path, modebits, S_IRUSR | S_IWUSR | O_CLOEXEC);
- err = errno;
- free(path);
- errno = err;
diff -Naur pppd.orig/main.c pppd/main.c
---- pppd.orig/main.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/main.c 2024-10-07 16:19:34.702106298 +0200
-@@ -491,7 +491,7 @@
+--- pppd.orig/main.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/main.c 2026-11-12 11:19:25.172479688 +0100
+@@ -495,7 +495,7 @@
die(0);
/* Make sure fds 0, 1, 2 are open to somewhere. */
@@ -23,9 +11,9 @@ diff -Naur pppd.orig/main.c pppd/main.c
fatal("Couldn't open %s: %m", PPP_DEVNULL);
while (fd_devnull <= 2) {
diff -Naur pppd.orig/options.c pppd/options.c
---- pppd.orig/options.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/options.c 2024-10-07 16:21:04.207954343 +0200
-@@ -1736,9 +1736,9 @@
+--- pppd.orig/options.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/options.c 2026-11-12 11:20:37.072336180 +0100
+@@ -1803,9 +1803,9 @@
ppp_option_error("unable to drop permissions to open %s: %m", *argv);
return 0;
}
@@ -38,9 +26,9 @@ diff -Naur pppd.orig/options.c pppd/options.c
if (!privileged_option && seteuid(euid) == -1)
fatal("unable to regain privileges: %m");
diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
---- pppd.orig/sys-linux.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/sys-linux.c 2024-10-07 16:27:42.282472415 +0200
-@@ -656,7 +656,7 @@
+--- pppd.orig/sys-linux.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/sys-linux.c 2026-11-12 11:25:40.913760089 +0100
+@@ -647,7 +647,7 @@
goto err;
}
dbglog("using channel %d", chindex);
@@ -49,7 +37,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (fd < 0) {
error("Couldn't reopen /dev/ppp: %m");
goto err;
-@@ -894,7 +894,7 @@
+@@ -974,7 +974,7 @@
dbglog("in make_ppp_unit, already had /dev/ppp open?");
close(ppp_dev_fd);
}
@@ -58,7 +46,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (ppp_dev_fd < 0)
fatal("Couldn't open /dev/ppp: %m");
flags = fcntl(ppp_dev_fd, F_GETFL);
-@@ -1015,7 +1015,7 @@
+@@ -1145,7 +1145,7 @@
if (!new_style_driver)
return -1;
@@ -67,7 +55,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (master_fd < 0)
fatal("Couldn't open /dev/ppp: %m");
if (ioctl(master_fd, PPPIOCATTACH, &ifnum) < 0) {
-@@ -2541,7 +2541,7 @@
+@@ -2529,7 +2529,7 @@
if (tune_kernel) {
forw_path = path_to_procfs("/sys/net/ipv4/ip_forward");
if (forw_path != 0) {
@@ -76,7 +64,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (fd >= 0) {
if (write(fd, "1", 1) != 1)
error("Couldn't enable IP forwarding: %m");
-@@ -2886,7 +2886,7 @@
+@@ -2905,7 +2905,7 @@
sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch);
kernel_version = KVERSION(osmaj, osmin, ospatch);
@@ -85,7 +73,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (fd >= 0) {
new_style_driver = 1;
-@@ -3064,7 +3064,7 @@
+@@ -3083,7 +3083,7 @@
#if __GLIBC__ >= 2
updwtmp(_PATH_WTMP, &ut);
#else
@@ -94,7 +82,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (wtmp >= 0) {
flock(wtmp, LOCK_EX);
-@@ -3288,7 +3288,7 @@
+@@ -3307,7 +3307,7 @@
int fd;
path = path_to_procfs("/sys/net/ipv4/ip_dynaddr");
@@ -103,7 +91,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (write(fd, "1", 1) != 1)
error("Couldn't enable dynamic IP addressing: %m");
close(fd);
-@@ -3542,7 +3542,7 @@
+@@ -3561,7 +3561,7 @@
/*
* Try the unix98 way first.
*/
@@ -112,7 +100,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (mfd >= 0) {
int ptn;
if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) {
-@@ -3553,7 +3553,8 @@
+@@ -3572,7 +3572,8 @@
if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0)
warn("Couldn't unlock pty slave %s: %m", pty_name);
#endif
@@ -122,7 +110,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
{
warn("Couldn't open pty slave %s: %m", pty_name);
close(mfd);
-@@ -3567,10 +3568,10 @@
+@@ -3586,10 +3587,10 @@
for (i = 0; i < 64; ++i) {
slprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x",
'p' + i / 16, i % 16);
@@ -136,8 +124,8 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
ret = fchown(sfd, uid, -1);
if (ret != 0) {
diff -Naur pppd.orig/tdb.c pppd/tdb.c
---- pppd.orig/tdb.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/tdb.c 2024-10-07 16:30:04.033122023 +0200
+--- pppd.orig/tdb.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/tdb.c 2026-11-12 11:26:23.065046016 +0100
@@ -1276,7 +1276,7 @@
}
@@ -148,9 +136,9 @@ diff -Naur pppd.orig/tdb.c pppd/tdb.c
mkdir_recursive(PPP_PATH_VARRUN) == 0)
goto again;
diff -Naur pppd.orig/tty.c pppd/tty.c
---- pppd.orig/tty.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/tty.c 2024-10-07 16:31:11.161674911 +0200
-@@ -621,7 +621,7 @@
+--- pppd.orig/tty.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/tty.c 2026-11-12 11:27:38.333269267 +0100
+@@ -617,7 +617,7 @@
ppp_set_status(EXIT_OPEN_FAILED);
goto errret;
}
@@ -159,7 +147,7 @@ diff -Naur pppd.orig/tty.c pppd/tty.c
err = errno;
if (prio < OPRIO_ROOT && seteuid(0) == -1)
fatal("Unable to regain privileges");
-@@ -775,7 +775,7 @@
+@@ -771,7 +771,7 @@
if (connector == NULL && modem && devnam[0] != 0) {
int i;
for (;;) {
@@ -169,9 +157,9 @@ diff -Naur pppd.orig/tty.c pppd/tty.c
if (errno != EINTR) {
error("Failed to reopen %s: %m", devnam);
diff -Naur pppd.orig/utils.c pppd/utils.c
---- pppd.orig/utils.c 2024-09-18 06:30:31.000000000 +0200
-+++ pppd/utils.c 2024-10-07 16:32:37.780775463 +0200
-@@ -926,14 +926,14 @@
+--- pppd.orig/utils.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/utils.c 2026-11-12 11:28:57.716524818 +0100
+@@ -1034,14 +1034,14 @@
slprintf(lock_file, sizeof(lock_file), "%s/LCK..%s", PPP_PATH_LOCKDIR, dev);
#endif
@@ -188,7 +176,7 @@ diff -Naur pppd.orig/utils.c pppd/utils.c
if (fd < 0) {
if (errno == ENOENT) /* This is just a timing problem. */
continue;
-@@ -1016,7 +1016,7 @@
+@@ -1124,7 +1124,7 @@
if (lock_file[0] == 0)
return -1;
diff --git a/src/patches/ppp/ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch b/src/patches/ppp/ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch
similarity index 76%
rename from src/patches/ppp/ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch
rename to src/patches/ppp/ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch
index cfd72e468..d8d82c14e 100644
--- a/src/patches/ppp/ppp-2.5.1-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch
+++ b/src/patches/ppp/ppp-2.5.5-3-everywhere-use-SOCK_CLOEXEC-when-creating-socket.patch
@@ -1,6 +1,6 @@
diff -Naur pppd.orig/plugins/pppoatm/pppoatm.c pppd/plugins/pppoatm/pppoatm.c
---- pppd.orig/plugins/pppoatm/pppoatm.c 2023-03-25 05:38:30.000000000 +0100
-+++ pppd/plugins/pppoatm/pppoatm.c 2023-06-30 13:21:33.397378347 +0200
+--- pppd.orig/plugins/pppoatm/pppoatm.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/plugins/pppoatm/pppoatm.c 2026-11-12 12:29:52.914103725 +0100
@@ -146,7 +146,7 @@
if (!device_got_set)
@@ -11,11 +11,11 @@ diff -Naur pppd.orig/plugins/pppoatm/pppoatm.c pppd/plugins/pppoatm/pppoatm.c
fatal("failed to create socket: %m");
memset(&qos, 0, sizeof qos);
diff -Naur pppd.orig/plugins/pppoe/if.c pppd/plugins/pppoe/if.c
---- pppd.orig/plugins/pppoe/if.c 2022-12-30 02:12:39.000000000 +0100
-+++ pppd/plugins/pppoe/if.c 2023-06-30 13:24:11.372183452 +0200
-@@ -116,7 +116,7 @@
- stype = SOCK_PACKET;
- #endif
+--- pppd.orig/plugins/pppoe/if.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/plugins/pppoe/if.c 2026-11-12 12:30:40.688340967 +0100
+@@ -121,7 +121,7 @@
+ return -1;
+ }
- if ((fd = socket(domain, stype, htons(type))) < 0) {
+ if ((fd = socket(domain, stype | SOCK_CLOEXEC, htons(type))) < 0) {
@@ -23,9 +23,9 @@ diff -Naur pppd.orig/plugins/pppoe/if.c pppd/plugins/pppoe/if.c
if (errno == EPERM) {
fatal("Cannot create raw socket -- pppoe must be run as root.");
diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c
---- pppd.orig/plugins/pppoe/plugin.c 2023-03-25 05:38:30.000000000 +0100
-+++ pppd/plugins/pppoe/plugin.c 2023-06-30 13:25:58.798782323 +0200
-@@ -155,7 +155,7 @@
+--- pppd.orig/plugins/pppoe/plugin.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/plugins/pppoe/plugin.c 2026-11-12 12:32:19.848885925 +0100
+@@ -150,7 +150,7 @@
/* server equipment). */
/* Opening this socket just before waitForPADS in the discovery() */
/* function would be more appropriate, but it would mess-up the code */
@@ -34,7 +34,7 @@ diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c
if (conn->sessionSocket < 0) {
error("Failed to create PPPoE socket: %m");
return -1;
-@@ -166,7 +166,7 @@
+@@ -161,7 +161,7 @@
lcp_wantoptions[0].mru = conn->mru = conn->storedmru;
/* Update maximum MRU */
@@ -43,7 +43,7 @@ diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c
if (s < 0) {
error("Can't get MTU for %s: %m", conn->ifName);
goto errout;
-@@ -364,7 +364,7 @@
+@@ -366,7 +366,7 @@
}
/* Open a socket */
@@ -53,9 +53,9 @@ diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c
}
diff -Naur pppd.orig/plugins/pppol2tp/openl2tp.c pppd/plugins/pppol2tp/openl2tp.c
---- pppd.orig/plugins/pppol2tp/openl2tp.c 2023-03-10 02:50:41.000000000 +0100
-+++ pppd/plugins/pppol2tp/openl2tp.c 2023-06-30 13:22:30.055768865 +0200
-@@ -93,7 +93,7 @@
+--- pppd.orig/plugins/pppol2tp/openl2tp.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/plugins/pppol2tp/openl2tp.c 2026-11-12 12:32:57.130835623 +0100
+@@ -92,7 +92,7 @@
int result;
if (openl2tp_fd < 0) {
@@ -65,9 +65,9 @@ diff -Naur pppd.orig/plugins/pppol2tp/openl2tp.c pppd/plugins/pppol2tp/openl2tp.
error("openl2tp connection create: %m");
return -ENOTCONN;
diff -Naur pppd.orig/plugins/pppol2tp/pppol2tp.c pppd/plugins/pppol2tp/pppol2tp.c
---- pppd.orig/plugins/pppol2tp/pppol2tp.c 2022-12-30 02:12:39.000000000 +0100
-+++ pppd/plugins/pppol2tp/pppol2tp.c 2023-06-30 13:23:13.493756755 +0200
-@@ -220,7 +220,7 @@
+--- pppd.orig/plugins/pppol2tp/pppol2tp.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/plugins/pppol2tp/pppol2tp.c 2026-11-12 12:33:36.408832408 +0100
+@@ -221,7 +221,7 @@
struct ifreq ifr;
int fd;
@@ -77,9 +77,9 @@ diff -Naur pppd.orig/plugins/pppol2tp/pppol2tp.c pppd/plugins/pppol2tp/pppol2tp.
memset (&ifr, '\0', sizeof (ifr));
ppp_get_ifname(ifr.ifr_name, sizeof(ifr.ifr_name));
diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
---- pppd.orig/sys-linux.c 2023-06-30 13:11:25.715511251 +0200
-+++ pppd/sys-linux.c 2023-06-30 13:32:50.021272249 +0200
-@@ -499,12 +499,12 @@
+--- pppd.orig/sys-linux.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/sys-linux.c 2026-11-12 12:36:15.477835260 +0100
+@@ -483,12 +483,12 @@
void sys_init(void)
{
/* Get an internet socket for doing socket ioctls. */
@@ -94,7 +94,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (sock6_fd < 0)
sock6_fd = -errno; /* save errno for later */
#endif
-@@ -2675,7 +2675,7 @@
+@@ -2671,7 +2671,7 @@
struct ifreq ifreq;
int ret, sock_fd;
@@ -103,7 +103,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (sock_fd < 0)
return -1;
memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr));
-@@ -2698,7 +2698,7 @@
+@@ -2694,7 +2694,7 @@
struct ifreq ifreq;
int ret, sock_fd;
@@ -112,7 +112,7 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
if (sock_fd < 0)
return -1;
-@@ -2915,7 +2915,7 @@
+@@ -2942,7 +2942,7 @@
/*
* Open a socket for doing the ioctl operations.
*/
@@ -122,9 +122,9 @@ diff -Naur pppd.orig/sys-linux.c pppd/sys-linux.c
return 0;
diff -Naur pppd.orig/tty.c pppd/tty.c
---- pppd.orig/tty.c 2023-06-30 13:14:06.450418113 +0200
-+++ pppd/tty.c 2023-06-30 13:33:31.285858278 +0200
-@@ -942,7 +942,7 @@
+--- pppd.orig/tty.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/tty.c 2026-11-12 12:36:47.785642537 +0100
+@@ -938,7 +938,7 @@
*sep = ':';
/* get a socket and connect it to the other end */
diff --git a/src/patches/ppp/ppp-2.5.1-4-increase-max-padi-attempts.patch b/src/patches/ppp/ppp-2.5.5-4-increase-max-padi-attempts.patch
similarity index 64%
rename from src/patches/ppp/ppp-2.5.1-4-increase-max-padi-attempts.patch
rename to src/patches/ppp/ppp-2.5.5-4-increase-max-padi-attempts.patch
index 002b6066d..9c7013214 100644
--- a/src/patches/ppp/ppp-2.5.1-4-increase-max-padi-attempts.patch
+++ b/src/patches/ppp/ppp-2.5.5-4-increase-max-padi-attempts.patch
@@ -1,7 +1,7 @@
diff -Naur pppd.orig/plugins/pppoe/pppoe.h pppd/plugins/pppoe/pppoe.h
---- pppd.orig/plugins/pppoe/pppoe.h 2022-12-30 02:12:39.000000000 +0100
-+++ pppd/plugins/pppoe/pppoe.h 2023-06-30 13:37:07.189078090 +0200
-@@ -143,7 +143,7 @@
+--- pppd.orig/plugins/pppoe/pppoe.h 2026-10-31 00:02:07.000000000 +0100
++++ pppd/plugins/pppoe/pppoe.h 2026-11-12 12:39:37.389855386 +0100
+@@ -141,7 +141,7 @@
#define STATE_TERMINATED 4
/* How many PADI/PADS attempts? */
diff --git a/src/patches/ppp/ppp-2.5.1-5-headers_4.9.patch b/src/patches/ppp/ppp-2.5.5-5-headers.patch
similarity index 60%
rename from src/patches/ppp/ppp-2.5.1-5-headers_4.9.patch
rename to src/patches/ppp/ppp-2.5.5-5-headers.patch
index dc6c22852..ebc978133 100644
--- a/src/patches/ppp/ppp-2.5.1-5-headers_4.9.patch
+++ b/src/patches/ppp/ppp-2.5.5-5-headers.patch
@@ -1,7 +1,7 @@
diff -Naur pppd.orig/plugins/pppoe/plugin.c pppd/plugins/pppoe/plugin.c
---- pppd.orig/plugins/pppoe/plugin.c 2023-06-30 13:25:58.798782323 +0200
-+++ pppd/plugins/pppoe/plugin.c 2023-06-30 13:50:23.150026201 +0200
-@@ -46,6 +46,8 @@
+--- pppd.orig/plugins/pppoe/plugin.c 2026-10-31 00:02:07.000000000 +0100
++++ pppd/plugins/pppoe/plugin.c 2026-11-12 12:42:29.523097123 +0100
+@@ -43,6 +43,8 @@
#include <signal.h>
#include <net/if_arp.h>
#include <linux/ppp_defs.h>
--
2.56.1
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-11-12 17:05 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-12 17:04 [PATCH] core207: Ship libssh Adolf Belka
2026-11-12 17:04 ` [PATCH] core207: Ship lz4 Adolf Belka
2026-11-12 17:04 ` [PATCH] core207: Ship ppp Adolf Belka
2026-11-12 17:04 ` [PATCH] libssh: Update to version 0.12.2 Adolf Belka
2026-11-12 17:04 ` [PATCH] lz4: Update to version 1.11.1 Adolf Belka
2026-11-12 17:04 ` [PATCH] ppp: Update to version 2.5.5 Adolf Belka
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox