user/ppp: new package

32 files changed, 6517 insertions, 0 deletions

diff --git a/user/ppp/02_all_make-vars.patch b/user/ppp/02_all_make-vars.patch
new file mode 100644
index 000000000..7937d666e
--- /dev/null
+++ b/user/ppp/02_all_make-vars.patch
@@ -0,0 +1,185 @@
+--- ppp-2.4.5/chat/Makefile.linux
++++ ppp-2.4.5/chat/Makefile.linux
+@@ -10,7 +10,6 @@
+ CDEF4=	-DFNDELAY=O_NDELAY		# Old name value
+ CDEFS=	$(CDEF1) $(CDEF2) $(CDEF3) $(CDEF4)
+ 
+-COPTS=	-O2 -g -pipe
+ CFLAGS=	$(COPTS) $(CDEFS)
+ 
+ INSTALL= install
+@@ -18,7 +17,7 @@
+ all:	chat
+ 
+ chat:	chat.o
+-	$(CC) -o chat chat.o
++	$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
+ 
+ chat.o:	chat.c
+ 	$(CC) -c $(CFLAGS) -o chat.o chat.c
+--- ppp-2.4.5/pppd/Makefile.linux
++++ ppp-2.4.5/pppd/Makefile.linux
+@@ -32,7 +32,7 @@
+ 
+ # CC = gcc
+ #
+-COPTS = -O2 -pipe -Wall -g
++COPTS+= -Wall
+ LIBS =
+ 
+ # Uncomment the next 2 lines to include support for Microsoft's
+--- ppp-2.4.5/pppd/plugins/Makefile.linux
++++ ppp-2.4.5/pppd/plugins/Makefile.linux
+@@ -1,7 +1,11 @@
+ #CC	= gcc
+-COPTS	= -O2 -g
+ CFLAGS	= $(COPTS) -I.. -I../../include -fPIC
+-LDFLAGS	= -shared
++LDFLAGS_PROG := $(LDFLAGS)
++export LDFLAGS LDFLAGS_PROG
++LDFLAGS	+= -shared
++# need the following option, otherwise linking plugins might fail with undef errors (Gentoo bug 210837)
++LDFLAGS += -Wl,--allow-shlib-undefined
++LIBS = 
+ INSTALL	= install
+ 
+ DESTDIR = $(INSTROOT)@DESTDIR@
+@@ -23,7 +27,7 @@
+ 	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done
+ 
+ %.so: %.c
+-	$(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^
++	$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS)
+ 
+ VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../patchlevel.h)
+ 
+--- ppp-2.4.5/pppd/plugins/pppoatm/Makefile.linux
++++ ppp-2.4.5/pppd/plugins/pppoatm/Makefile.linux
+@@ -1,7 +1,5 @@
+ #CC	= gcc
+-COPTS	= -O2 -g
+ CFLAGS	= $(COPTS) -I../.. -I../../../include -fPIC
+-LDFLAGS	= -shared
+ INSTALL	= install
+ 
+ #***********************************************************************
+@@ -33,7 +31,7 @@
+ all: $(PLUGIN)
+ 
+ $(PLUGIN): $(PLUGIN_OBJS)
+-	$(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS)
++	$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS)
+ 
+ install: all
+ 	$(INSTALL) -d -m 755 $(LIBDIR)
+--- ppp-2.4.5/pppd/plugins/pppol2tp/Makefile.linux
++++ ppp-2.4.5/pppd/plugins/pppol2tp/Makefile.linux
+@@ -1,7 +1,5 @@
+ #CC	= gcc
+-COPTS	= -O2 -g
+ CFLAGS	= $(COPTS) -I. -I../.. -I../../../include -fPIC
+-LDFLAGS	= -shared
+ INSTALL	= install
+ 
+ #***********************************************************************
+@@ -16,7 +14,7 @@
+ all: $(PLUGINS)
+ 
+ %.so: %.o
+-	$(CC) $(CFLAGS) -o $@ -shared $^ $(LIBS)
++	$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^ $(LIBS)
+ 
+ install: all
+ 	$(INSTALL) -d -m 755 $(LIBDIR)
+--- ppp-2.4.5/pppd/plugins/radius/Makefile.linux
++++ ppp-2.4.5/pppd/plugins/radius/Makefile.linux
+@@ -12,7 +12,7 @@
+ INSTALL	= install
+ 
+ PLUGIN=radius.so radattr.so radrealms.so
+-CFLAGS=-I. -I../.. -I../../../include -O2 -fPIC -DRC_LOG_FACILITY=LOG_DAEMON
++CFLAGS=$(COPTS) -I. -I../.. -I../../../include -fPIC -DRC_LOG_FACILITY=LOG_DAEMON
+ 
+ # Uncomment the next line to include support for Microsoft's
+ # MS-CHAP authentication protocol.
+@@ -43,13 +43,13 @@
+ 	$(INSTALL) -c -m 444 pppd-radattr.8 $(MANDIR)
+ 
+ radius.so: radius.o libradiusclient.a
+-	$(CC) -o radius.so -shared radius.o libradiusclient.a
++	$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
+ 
+ radattr.so: radattr.o
+-	$(CC) -o radattr.so -shared radattr.o
++	$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
+ 
+ radrealms.so: radrealms.o
+-	$(CC) -o radrealms.so -shared radrealms.o
++	$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
+ 
+ CLIENTOBJS = avpair.o buildreq.o config.o dict.o ip_util.o \
+ 	clientid.o sendserver.o lock.o util.o md5.o
+--- ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux
++++ ppp-2.4.5/pppd/plugins/rp-pppoe/Makefile.linux
+@@ -25,12 +25,11 @@
+ # Version is set ONLY IN THE MAKEFILE!  Don't delete this!
+ RP_VERSION=3.8p
+ 
+-COPTS=-O2 -g
+ CFLAGS=$(COPTS) -I../../../include '-DRP_VERSION="$(RP_VERSION)"'
+ all: rp-pppoe.so pppoe-discovery
+ 
+ pppoe-discovery: pppoe-discovery.o debug.o
+-	$(CC) -o pppoe-discovery pppoe-discovery.o debug.o
++	$(CC) $(LDFLAGS_PROG) $(CFLAGS) -o pppoe-discovery pppoe-discovery.o debug.o
+ 
+ pppoe-discovery.o: pppoe-discovery.c
+ 	$(CC) $(CFLAGS) -c -o pppoe-discovery.o pppoe-discovery.c
+@@ -39,7 +38,7 @@
+ 	$(CC) $(CFLAGS) -c -o debug.o debug.c
+ 
+ rp-pppoe.so: plugin.o discovery.o if.o common.o
+-	$(CC) -o rp-pppoe.so -shared plugin.o discovery.o if.o common.o
++	$(CC) $(LDFLAGS) $(CFLAGS) -o rp-pppoe.so plugin.o discovery.o if.o common.o
+ 
+ install: all
+ 	$(INSTALL) -d -m 755 $(LIBDIR)
+--- ppp-2.4.5/pppdump/Makefile.linux
++++ ppp-2.4.5/pppdump/Makefile.linux
+@@ -2,7 +2,7 @@
+ BINDIR = $(DESTDIR)/sbin
+ MANDIR = $(DESTDIR)/share/man/man8
+ 
+-CFLAGS= -O -I../include/net
++CFLAGS=$(COPTS) -I../include/net
+ OBJS = pppdump.o bsd-comp.o deflate.o zlib.o
+ 
+ INSTALL= install
+@@ -10,7 +10,7 @@
+ all:	pppdump
+ 
+ pppdump: $(OBJS)
+-	$(CC) -o pppdump $(OBJS)
++	$(CC) $(LDFLAGS) -o pppdump $(OBJS)
+ 
+ clean:
+ 	rm -f pppdump $(OBJS) *~
+--- ppp-2.4.5/pppstats/Makefile.linux
++++ ppp-2.4.5/pppstats/Makefile.linux
+@@ -10,7 +10,6 @@
+ PPPSTATOBJS = pppstats.o
+ 
+ #CC = gcc
+-COPTS = -O
+ COMPILE_FLAGS = -I../include
+ LIBS =
+ 
+@@ -26,7 +25,7 @@
+ 	$(INSTALL) -c -m 444 pppstats.8 $(MANDIR)
+ 
+ pppstats: $(PPPSTATSRCS)
+-	$(CC) $(CFLAGS) -o pppstats pppstats.c $(LIBS)
++	$(CC) $(CFLAGS) $(LDFLAGS) -o pppstats pppstats.c $(LIBS)
+ 
+ clean:
+ 	rm -f pppstats *~ #* core
diff --git a/user/ppp/03_all_use_internal_logwtmp.patch b/user/ppp/03_all_use_internal_logwtmp.patch
new file mode 100644
index 000000000..d9ecddf25
--- /dev/null
+++ b/user/ppp/03_all_use_internal_logwtmp.patch
@@ -0,0 +1,22 @@
+Use internal implementation of logwtmp function to prevent
+utilities from sys-apps/coreutils to not detect authorized users
+
+Patch by: Sergey Popov <pinkbyte@gentoo.org>
+
+--- a/pppd/sys-linux.c
++++ b/pppd/sys-linux.c
+@@ -2196,7 +2197,6 @@
+     return ok;
+ }
+ 
+-#ifndef HAVE_LOGWTMP
+ /********************************************************************
+  *
+  * Update the wtmp file with the appropriate user name and tty device.
+@@ -2270,7 +2270,7 @@
+     }
+ #endif
+ }
+-#endif /* HAVE_LOGWTMP */
++
+
diff --git a/user/ppp/04_all_mpls.patch b/user/ppp/04_all_mpls.patch
new file mode 100644
index 000000000..54b79f7bd
--- /dev/null
+++ b/user/ppp/04_all_mpls.patch
@@ -0,0 +1,427 @@
+--- ppp-2.4.5/pppd/main.c
++++ ppp-2.4.5/pppd/main.c
+@@ -96,6 +96,9 @@
+ #include "fsm.h"
+ #include "lcp.h"
+ #include "ipcp.h"
++
++#include "mplscp.h"
++
+ #ifdef INET6
+ #include "ipv6cp.h"
+ #endif
+@@ -283,6 +286,7 @@
+     &cbcp_protent,
+ #endif
+     &ipcp_protent,
++    &mplscp_protent,
+ #ifdef INET6
+     &ipv6cp_protent,
+ #endif
+--- ppp-2.4.5/pppd/Makefile.linux
++++ ppp-2.4.5/pppd/Makefile.linux
+@@ -13,16 +13,16 @@
+ 
+ PPPDSRCS = main.c magic.c fsm.c lcp.c ipcp.c upap.c chap-new.c md5.c ccp.c \
+ 	   ecp.c ipxcp.c auth.c options.c sys-linux.c md4.c chap_ms.c \
+-	   demand.c utils.c tty.c eap.c chap-md5.c session.c
++	   demand.c utils.c tty.c eap.c chap-md5.c session.c mplscp.c
+ 
+ HEADERS = ccp.h session.h chap-new.h ecp.h fsm.h ipcp.h \
+ 	ipxcp.h lcp.h magic.h md5.h patchlevel.h pathnames.h pppd.h \
+-	upap.h eap.h
++	upap.h eap.h mplscp.h
+ 
+ MANPAGES = pppd.8
+ PPPDOBJS = main.o magic.o fsm.o lcp.o ipcp.o upap.o chap-new.o md5.o ccp.o \
+ 	   ecp.o auth.o options.o demand.o utils.o sys-linux.o ipxcp.o tty.o \
+-	   eap.o chap-md5.o session.o
++	   eap.o chap-md5.o session.o mplscp.o
+ 
+ #
+ # include dependencies if present
+--- ppp-2.4.5/pppd/mplscp.c
++++ ppp-2.4.5/pppd/mplscp.c
+@@ -0,0 +1,371 @@
++
++/* MPLSCP - Serge.Krier@advalvas.be (C) 2001 */
++
++#include <stdio.h>
++#include <string.h>
++#include <netdb.h>
++#include <sys/param.h>
++#include <sys/types.h>
++#include <sys/socket.h>
++#include <netinet/in.h>
++#include <arpa/inet.h>
++
++#include "pppd.h"
++#include "fsm.h"
++#include "mplscp.h"
++
++
++/* local vars */
++/* static int mplscp_is_up; */                  /* have called np_up() */
++
++/*
++ * Callbacks for fsm code.  (CI = Configuration Information)
++ */
++static void mplscp_resetci __P((fsm *));	/* Reset our CI */
++static int  mplscp_cilen __P((fsm *));	        /* Return length of our CI */
++static void mplscp_addci __P((fsm *, u_char *, int *)); /* Add our CI */
++static int  mplscp_ackci __P((fsm *, u_char *, int));	/* Peer ack'd our CI */
++static int  mplscp_nakci __P((fsm *, u_char *, int));	/* Peer nak'd our CI */
++static int  mplscp_rejci __P((fsm *, u_char *, int));	/* Peer rej'd our CI */
++static int  mplscp_reqci __P((fsm *, u_char *, int *, int)); /* Rcv CI */
++static void mplscp_up __P((fsm *));		/* We're UP */
++static void mplscp_down __P((fsm *));		/* We're DOWN */
++static void mplscp_finished __P((fsm *));	/* Don't need lower layer */
++
++fsm mplscp_fsm[NUM_PPP];		/* MPLSCP fsm structure */
++
++static fsm_callbacks mplscp_callbacks = { /* MPLSCP callback routines */
++  mplscp_resetci,		/* Reset our Configuration Information */
++  mplscp_cilen,			/* Length of our Configuration Information */
++  mplscp_addci,			/* Add our Configuration Information */
++  mplscp_ackci,			/* ACK our Configuration Information */
++  mplscp_nakci,			/* NAK our Configuration Information */
++  mplscp_rejci,			/* Reject our Configuration Information */
++  mplscp_reqci,			/* Request peer's Configuration Information */
++  mplscp_up,			/* Called when fsm reaches OPENED state */
++  mplscp_down,			/* Called when fsm leaves OPENED state */
++  NULL,			        /* Called when we want the lower layer up */
++  mplscp_finished,		/* Called when we want the lower layer down */
++  NULL,			        /* Called when Protocol-Reject received */
++  NULL,			        /* Retransmission is necessary */
++  NULL,			        /* Called to handle protocol-specific codes */
++  "MPLSCP"			/* String name of protocol */
++};
++
++static option_t mplscp_option_list[] = {
++    { "mpls", o_bool, &mplscp_protent.enabled_flag,
++      "Enable MPLSCP (and MPLS)", 1 },
++    { NULL } };
++
++/*
++ * Protocol entry points from main code.
++ */
++
++static void mplscp_init __P((int));
++static void mplscp_open __P((int));
++static void mplscp_close __P((int, char *));
++static void mplscp_lowerup __P((int));
++static void mplscp_lowerdown __P((int));
++static void mplscp_input __P((int, u_char *, int));
++static void mplscp_protrej __P((int));
++static int  mplscp_printpkt __P((u_char *, int,
++				 void (*) __P((void *, char *, ...)), void *));
++
++struct protent mplscp_protent = {
++    PPP_MPLSCP,
++    mplscp_init,
++    mplscp_input,
++    mplscp_protrej,
++    mplscp_lowerup,
++    mplscp_lowerdown,
++    mplscp_open,
++    mplscp_close,
++    mplscp_printpkt,
++    NULL,
++    0,                            /* MPLS not enabled by default */
++    "MPLSCP",
++    "MPLS",
++    mplscp_option_list,
++    NULL,
++    NULL,
++    NULL
++};
++
++/*
++ * mplscp_init - Initialize MPLSCP.
++ */
++static void
++mplscp_init(int unit) {
++
++  fsm *f = &mplscp_fsm[unit];
++  
++  f->unit = unit;
++  f->protocol = PPP_MPLSCP;
++  f->callbacks = &mplscp_callbacks;  
++  fsm_init(&mplscp_fsm[unit]); 
++  
++}
++
++/*
++ * mplscp_open - MPLSCP is allowed to come up.
++ */
++static void
++mplscp_open(int unit) {
++  
++  fsm_open(&mplscp_fsm[unit]);
++
++}
++
++/*
++ * mplscp_close - Take MPLSCP down.
++ */
++static void
++mplscp_close(int unit, char *reason) {
++
++  fsm_close(&mplscp_fsm[unit], reason);
++
++}
++
++/*
++ * mplscp_lowerup - The lower layer is up.
++ */
++static void
++mplscp_lowerup(int unit) {
++
++  fsm_lowerup(&mplscp_fsm[unit]);
++}
++
++/*
++ * mplscp_lowerdown - The lower layer is down.
++ */
++static void
++mplscp_lowerdown(int unit) {
++  
++  fsm_lowerdown(&mplscp_fsm[unit]);
++}
++
++/*
++ * mplscp_input - Input MPLSCP packet.
++ */
++static void
++mplscp_input(int unit, u_char *p, int len) {
++
++  fsm_input(&mplscp_fsm[unit], p, len);
++}
++
++/*
++ * mplscp_protrej - A Protocol-Reject was received for MPLSCP.
++ * Pretend the lower layer went down, so we shut up.
++ */
++static void
++mplscp_protrej(int unit) {
++
++    fsm_lowerdown(&mplscp_fsm[unit]);
++}
++
++/*
++ * mplscp_resetci - Reset our CI.
++ * Called by fsm_sconfreq, Send Configure Request.
++ */
++static void
++mplscp_resetci(fsm *f) {
++
++  return;
++}
++
++/*
++ * mplscp_cilen - Return length of our CI.
++ * Called by fsm_sconfreq, Send Configure Request.
++ */
++static int
++mplscp_cilen(fsm *f) {
++
++  return 0;
++}
++
++/*
++ * mplscp_addci - Add our desired CIs to a packet.
++ * Called by fsm_sconfreq, Send Configure Request.
++ */
++static void
++mplscp_addci(fsm *f, u_char *ucp, int *lenp) {
++
++}
++
++/*
++ * ipcp_ackci - Ack our CIs.
++ * Called by fsm_rconfack, Receive Configure ACK.
++ *
++ * Returns:
++ *	0 - Ack was bad.
++ *	1 - Ack was good.
++ */
++static int
++mplscp_ackci(fsm *f, u_char *p, int  len) {
++  
++  return 1;
++
++}
++
++/*
++ * mplscp_nakci - Peer has sent a NAK for some of our CIs.
++ * This should not modify any state if the Nak is bad
++ * or if MPLSCP is in the OPENED state.
++ * Calback from fsm_rconfnakrej - Receive Configure-Nak or Configure-Reject.
++ *
++ * Returns:
++ *	0 - Nak was bad.
++ *	1 - Nak was good.
++ */
++static int
++mplscp_nakci(fsm *f, u_char *p, int len) {
++
++  return 1;
++}
++
++/*
++ * MPLSVP_rejci - Reject some of our CIs.
++ * Callback from fsm_rconfnakrej.
++ */
++static int
++mplscp_rejci(fsm *f, u_char *p, int len) {
++
++  return 1;
++
++}
++
++/*
++ * mplscp_reqci - Check the peer's requested CIs and send appropriate response.
++ * Callback from fsm_rconfreq, Receive Configure Request
++ *
++ * Returns: CONFACK, CONFNAK or CONFREJ and input packet modified
++ * appropriately.  If reject_if_disagree is non-zero, doesn't return
++ * CONFNAK; returns CONFREJ if it can't return CONFACK.
++ */
++static int
++mplscp_reqci(fsm *f, u_char *inp, int *len, int reject_if_disagree) {
++  
++  
++  int rc = CONFACK;		/* Final packet return code */
++   
++  PUTCHAR(CONFACK,inp);
++
++  return rc;
++
++}
++
++static void
++mplscp_up(fsm *f) {
++
++  sifnpmode(f->unit, PPP_MPLS_UC, NPMODE_PASS);
++  /*  sifnpmode(f->unit, PPP_MPLS_MC, NPMODE_PASS);*/
++  
++  np_up(f->unit, PPP_MPLS_UC);
++  /*  np_up(f->unit, PPP_MPLS_MC);*/
++  /*  ipcp_is_up = 1;*/
++
++  
++#if 1
++  printf("MPLSCP is OPENED\n");
++#endif
++
++}
++
++static void
++mplscp_down(fsm *f) {
++  
++  sifnpmode(f->unit, PPP_MPLS_UC, NPMODE_DROP);
++  /*  sifnpmode(f->unit, PPP_MPLS_MC, NPMODE_DROP);*/
++
++  sifdown(f->unit); 
++  
++#if 1
++  printf("MPLSCP is CLOSED\n");
++#endif
++  
++
++}
++
++static void 
++mplscp_finished(fsm *f) {
++  
++  np_finished(f->unit, PPP_MPLS_UC);
++  /*  np_finished(f->unit, PPP_MPLS_MC);*/
++
++}
++
++/*
++ * mpls_printpkt - print the contents of an MPLSCP packet.
++ */
++static char *mplscp_codenames[] = {
++    "ConfReq", "ConfAck", "ConfNak", "ConfRej",
++    "TermReq", "TermAck", "CodeRej"
++};
++
++static int
++mplscp_printpkt(u_char *p, int plen, 
++		void (*printer) __P((void *, char *, ...)),
++		void *arg) {
++ 
++    int code, id, len, olen;
++    u_char *pstart, *optend;
++
++    if (plen < HEADERLEN)
++	return 0;
++    pstart = p;
++    GETCHAR(code, p);
++    GETCHAR(id, p);
++    GETSHORT(len, p);
++    if (len < HEADERLEN || len > plen)
++	return 0;
++
++    if (code >= 1 && code <= sizeof(mplscp_codenames) / sizeof(char *))
++	printer(arg, " %s", mplscp_codenames[code-1]);
++    else
++	printer(arg, " code=0x%x", code);
++    printer(arg, " id=0x%x", id);
++    len -= HEADERLEN;
++    switch (code) {
++    case CONFREQ:
++    case CONFACK:
++    case CONFNAK:
++    case CONFREJ:
++	/* print option list */
++	while (len >= 2) {
++	    GETCHAR(code, p);
++	    GETCHAR(olen, p);
++	    p -= 2;
++	    if (olen < 2 || olen > len) {
++		break;
++	    }
++	    printer(arg, " <");
++	    len -= olen;
++	    optend = p + olen;
++	    while (p < optend) {
++		GETCHAR(code, p);
++		printer(arg, " %.2x", code);
++	    }
++	    printer(arg, ">");
++	}
++	break;
++
++    case TERMACK:
++    case TERMREQ:
++	if (len > 0 && *p >= ' ' && *p < 0x7f) {
++	    printer(arg, " ");
++	    print_string((char *)p, len, printer, arg);
++	    p += len;
++	    len = 0;
++	}
++	break;
++    }
++
++    /* print the rest of the bytes in the packet */
++    for (; len > 0; --len) {
++	GETCHAR(code, p);
++	printer(arg, " %.2x", code);
++    }
++
++    return p - pstart;
++
++}
+--- ppp-2.4.5/pppd/mplscp.h
++++ ppp-2.4.5/pppd/mplscp.h
+@@ -0,0 +1,8 @@
++
++/* MPLSCP - Serge.Krier@advalvas.be (C) 2001 */
++
++#define PPP_MPLSCP  0x8281
++#define PPP_MPLS_UC 0x0281
++#define PPP_MPLS_MC 0x0283
++
++extern struct protent mplscp_protent;
diff --git a/user/ppp/06_all_killaddr-smarter.patch b/user/ppp/06_all_killaddr-smarter.patch
new file mode 100644
index 000000000..d86534843
--- /dev/null
+++ b/user/ppp/06_all_killaddr-smarter.patch
@@ -0,0 +1,131 @@
+--- ppp-2.4.5/pppd/options.c
++++ ppp-2.4.5/pppd/options.c
+@@ -100,6 +100,9 @@
+ char	user[MAXNAMELEN];	/* Username for PAP */
+ char	passwd[MAXSECRETLEN];	/* Password for PAP */
+ bool	persist = 0;		/* Reopen link after it goes down */
++bool	killoldaddr = 0;		/* If our IP is reassigned on
++				    reconnect, kill active TCP
++				     connections using the old IP. */
+ char	our_name[MAXNAMELEN];	/* Our name for authentication purposes */
+ bool	demand = 0;		/* do dial-on-demand */
+ char	*ipparam = NULL;	/* Extra parameter for ip up/down scripts */
+@@ -231,6 +234,11 @@
+     { "demand", o_bool, &demand,
+       "Dial on demand", OPT_INITONLY | 1, &persist },
+ 
++    { "killoldaddr", o_bool, &killoldaddr,
++      "Kill connections from an old source address", 1},
++    { "nokilloldaddr", o_bool,&killoldaddr,
++      "Don't kill connections from an old source address" },
++
+     { "--version", o_special_noarg, (void *)showversion,
+       "Show version number" },
+     { "--help", o_special_noarg, (void *)showhelp,
+--- ppp-2.4.5/pppd/pppd.h
++++ ppp-2.4.5/pppd/pppd.h
+@@ -298,6 +298,9 @@
+ extern char	remote_name[MAXNAMELEN]; /* Peer's name for authentication */
+ extern bool	explicit_remote;/* remote_name specified with remotename opt */
+ extern bool	demand;		/* Do dial-on-demand */
++extern bool	killoldaddr;	/* If our IP is reassigned on
++				    reconnect, kill active TCP
++				     connections using the old IP. */
+ extern char	*ipparam;	/* Extra parameter for ip up/down scripts */
+ extern bool	cryptpap;	/* Others' PAP passwords are encrypted */
+ extern int	idle_time_limit;/* Shut down link if idle for this long */
+--- ppp-2.4.5/pppd/sys-linux.c
++++ ppp-2.4.5/pppd/sys-linux.c
+@@ -165,6 +165,10 @@
+ 
+ #endif /* INET6 */
+ 
++#ifndef SIOCKILLADDR
++#define SIOCKILLADDR	0x8939
++#endif
++
+ /* We can get an EIO error on an ioctl if the modem has hung up */
+ #define ok_error(num) ((num)==EIO)
+ 
+@@ -209,6 +213,7 @@
+ static u_int32_t proxy_arp_addr;	/* Addr for proxy arp entry added */
+ static char proxy_arp_dev[16];		/* Device for proxy arp entry */
+ static u_int32_t our_old_addr;		/* for detecting address changes */
++static u_int32_t our_current_addr;
+ static int	dynaddr_set;		/* 1 if ip_dynaddr set */
+ static int	looped;			/* 1 if using loop */
+ static int	link_mtu;		/* mtu for the link (not bundle) */
+@@ -537,6 +542,27 @@
+     return -1;
+ }
+ 
++static void do_killaddr(u_int32_t oldaddr)
++{
++    struct ifreq   ifr; 
++
++    memset(&ifr,0,sizeof ifr);
++
++    SET_SA_FAMILY (ifr.ifr_addr,    AF_INET); 
++    SET_SA_FAMILY (ifr.ifr_dstaddr, AF_INET); 
++    SET_SA_FAMILY (ifr.ifr_netmask, AF_INET); 
++    
++    SIN_ADDR(ifr.ifr_addr) = oldaddr;
++
++    strlcpy(ifr.ifr_name, ifname, sizeof (ifr.ifr_name));
++    
++    if(ioctl(sock_fd,SIOCKILLADDR,&ifr) < 0) {
++      if (!ok_error (errno))
++	error("ioctl(SIOCKILLADDR): %m(%d)", errno);
++      return;
++    }
++}
++
+ /********************************************************************
+  *
+  * tty_disestablish_ppp - Restore the serial port to normal operation.
+@@ -2385,21 +2411,29 @@
+ 	}
+     }
+ 
+-    /* set ip_dynaddr in demand mode if address changes */
+-    if (demand && tune_kernel && !dynaddr_set
+-	&& our_old_addr && our_old_addr != our_adr) {
++    if(persist && our_old_addr && our_old_addr != our_adr) {
++
++      if(killoldaddr)
++	do_killaddr(our_old_addr);
++
++	
++      /* set ip_dynaddr in persist mode if address changes */
++      if (tune_kernel && !dynaddr_set) {
+ 	/* set ip_dynaddr if possible */
+ 	char *path;
+ 	int fd;
+ 
+ 	path = path_to_procfs("/sys/net/ipv4/ip_dynaddr");
+ 	if (path != 0 && (fd = open(path, O_WRONLY)) >= 0) {
+-	    if (write(fd, "1", 1) != 1)
+-		error("Couldn't enable dynamic IP addressing: %m");
+-	    close(fd);
++	  if (write(fd, "1", 1) != 1)
++	    error("Couldn't enable dynamic IP addressing: %m");
++	  close(fd);
+ 	}
+ 	dynaddr_set = 1;	/* only 1 attempt */
++      }
+     }
++
++    our_current_addr = our_adr;
+     our_old_addr = 0;
+ 
+     return 1;
+@@ -2455,7 +2489,8 @@
+     }
+ 
+     our_old_addr = our_adr;
+-
++    our_current_addr = 0;
++    
+     return 1;
+ }
+ 
diff --git a/user/ppp/08_all_wait-children.patch b/user/ppp/08_all_wait-children.patch
new file mode 100644
index 000000000..708cf04d6
--- /dev/null
+++ b/user/ppp/08_all_wait-children.patch
@@ -0,0 +1,76 @@
+--- ppp-2.4.5/pppd/main.c
++++ ppp-2.4.5/pppd/main.c
+@@ -249,6 +249,7 @@
+ static void forget_child __P((int pid, int status));
+ static int reap_kids __P((void));
+ static void childwait_end __P((void *));
++static void wait_children __P((void));
+ 
+ #ifdef USE_TDB
+ static void update_db_entry __P((void));
+@@ -580,25 +581,11 @@
+ 	    if (!persist)
+ 		break;
+ 	}
++	
++	wait_children();
+     }
+ 
+-    /* Wait for scripts to finish */
+-    reap_kids();
+-    if (n_children > 0) {
+-	if (child_wait > 0)
+-	    TIMEOUT(childwait_end, NULL, child_wait);
+-	if (debug) {
+-	    struct subprocess *chp;
+-	    dbglog("Waiting for %d child processes...", n_children);
+-	    for (chp = children; chp != NULL; chp = chp->next)
+-		dbglog("  script %s, pid %d", chp->prog, chp->pid);
+-	}
+-	while (n_children > 0 && !childwait_done) {
+-	    handle_events();
+-	    if (kill_link && !childwait_done)
+-		childwait_end(NULL);
+-	}
+-    }
++    wait_children();
+ 
+     die(status);
+     return 0;
+@@ -1794,6 +1781,36 @@
+ }
+ 
+ /*
++ * wait_children - wait for scripts to finish.
++ * if child_wait is 0, wait indefinitely.
++ * else, kill'em all at the end of timeout
++ */
++static void
++wait_children()
++{
++    /* Wait for scripts to finish */
++    reap_kids();
++    if (n_children > 0) {
++	childwait_done = 0;
++	if (child_wait > 0)
++	    TIMEOUT(childwait_end, NULL, child_wait);
++	if (debug) {
++	    struct subprocess *chp;
++	    dbglog("Waiting for %d child processes...", n_children);
++	    for (chp = children; chp != NULL; chp = chp->next)
++		dbglog("  script %s, pid %d", chp->prog, chp->pid);
++	}
++	while (n_children > 0 && !childwait_done) {
++	    handle_events();
++	    if (asked_to_quit && !childwait_done)
++		childwait_end(NULL);
++	}
++	if (child_wait > 0)
++	    UNTIMEOUT(childwait_end, NULL);
++    }
++}
++
++/*
+  * childwait_end - we got fed up waiting for the child processes to
+  * exit, send them all a SIGTERM.
+  */
diff --git a/user/ppp/10_all_defaultgateway.patch b/user/ppp/10_all_defaultgateway.patch
new file mode 100644
index 000000000..1b7ae6396
--- /dev/null
+++ b/user/ppp/10_all_defaultgateway.patch
@@ -0,0 +1,90 @@
+This patch reverses revision 1.114 of the pppd/sys-linux.c file.
+The default gateway is needed by the openswan's %defaultroute.
+
+--- ppp-2.4.7/pppd/sys-linux.c
++++ ppp-2.4.7/pppd/sys-linux.c
+@@ -206,7 +206,7 @@
+ 
+ static int	if_is_up;	/* Interface has been marked up */
+ static int	if6_is_up;	/* Interface has been marked up for IPv6, to help differentiate */
+-static int	have_default_route;	/* Gateway for default route added */
++static u_int32_t default_route_gateway;	/* Gateway for default route added */
+ static u_int32_t proxy_arp_addr;	/* Addr for proxy arp entry added */
+ static char proxy_arp_dev[16];		/* Device for proxy arp entry */
+ static u_int32_t our_old_addr;		/* for detecting address changes */
+@@ -346,8 +346,8 @@
+ /*
+  * Delete any routes through the device.
+  */
+-    if (have_default_route)
+-	cifdefaultroute(0, 0, 0);
++    if (default_route_gateway != 0)
++	cifdefaultroute(0, 0, default_route_gateway);
+ 
+     if (has_proxy_arp)
+ 	cifproxyarp(0, proxy_arp_addr);
+@@ -1621,17 +1621,17 @@
+     struct rtentry rt;
+ 
+     if (defaultroute_exists(&rt) && strcmp(rt.rt_dev, ifname) != 0) {
+-	if (rt.rt_flags & RTF_GATEWAY)
+-	    error("not replacing existing default route via %I",
+-		  SIN_ADDR(rt.rt_gateway));
+-	else
+-	    error("not replacing existing default route through %s",
+-		  rt.rt_dev);
++	u_int32_t old_gateway = SIN_ADDR(rt.rt_gateway);
++
++	if (old_gateway != gateway)
++	    error("not replacing existing default route to %s [%I]",
++		  rt.rt_dev, old_gateway);
+ 	return 0;
+     }
+ 
+-    memset (&rt, 0, sizeof (rt));
+-    SET_SA_FAMILY (rt.rt_dst, AF_INET);
++    memset (&rt, '\0', sizeof (rt));
++    SET_SA_FAMILY (rt.rt_dst,     AF_INET);
++    SET_SA_FAMILY (rt.rt_gateway, AF_INET);
+ 
+     rt.rt_dev = ifname;
+ 
+@@ -1640,14 +1640,16 @@
+ 	SIN_ADDR(rt.rt_genmask) = 0L;
+     }
+ 
+-    rt.rt_flags = RTF_UP;
++    SIN_ADDR(rt.rt_gateway) = gateway;
++
++    rt.rt_flags = RTF_UP | RTF_GATEWAY;
+     if (ioctl(sock_fd, SIOCADDRT, &rt) < 0) {
+ 	if ( ! ok_error ( errno ))
+ 	    error("default route ioctl(SIOCADDRT): %m");
+ 	return 0;
+     }
+ 
+-    have_default_route = 1;
++    default_route_gateway = gateway;
+     return 1;
+ }
+ 
+@@ -1660,7 +1662,7 @@
+ {
+     struct rtentry rt;
+ 
+-    have_default_route = 0;
++    default_route_gateway = 0;
+ 
+     memset (&rt, '\0', sizeof (rt));
+     SET_SA_FAMILY (rt.rt_dst,     AF_INET);
+@@ -1673,7 +1675,9 @@
+ 	SIN_ADDR(rt.rt_genmask) = 0L;
+     }
+ 
+-    rt.rt_flags = RTF_UP;
++    SIN_ADDR(rt.rt_gateway) = gateway;
++
++    rt.rt_flags = RTF_UP | RTF_GATEWAY;
+     if (ioctl(sock_fd, SIOCDELRT, &rt) < 0 && errno != ESRCH) {
+ 	if (still_ppp()) {
+ 	    if ( ! ok_error ( errno ))
diff --git a/user/ppp/12_all_linkpidfile.patch b/user/ppp/12_all_linkpidfile.patch
new file mode 100644
index 000000000..9c5769c8f
--- /dev/null
+++ b/user/ppp/12_all_linkpidfile.patch
@@ -0,0 +1,93 @@
+--- ppp-2.4.5/pppd/auth.c
++++ ppp-2.4.5/pppd/auth.c
+@@ -637,7 +637,7 @@
+      * we delete its pid file.
+      */
+     if (!doing_multilink && !demand)
+-	remove_pidfiles();
++	remove_pidfile(pidfilename);
+ 
+     /*
+      * If we may want to bring the link up again, transfer
+--- ppp-2.4.5/pppd/main.c
++++ ppp-2.4.5/pppd/main.c
+@@ -134,7 +134,7 @@
+ 
+ char *progname;			/* Name of this program */
+ char hostname[MAXNAMELEN];	/* Our hostname */
+-static char pidfilename[MAXPATHLEN];	/* name of pid file */
++char pidfilename[MAXPATHLEN];	/* name of pid file */
+ static char linkpidfile[MAXPATHLEN];	/* name of linkname pid file */
+ char ppp_devnam[MAXPATHLEN];	/* name of PPP tty (maybe ttypx) */
+ uid_t uid;			/* Our real user-id */
+@@ -245,6 +245,7 @@
+ static void toggle_debug __P((int));
+ static void open_ccp __P((int));
+ static void bad_signal __P((int));
++static void remove_pidfilenames __P((void));
+ static void holdoff_end __P((void *));
+ static void forget_child __P((int pid, int status));
+ static int reap_kids __P((void));
+@@ -835,16 +836,24 @@
+ }
+ 
+ /*
+- * remove_pidfile - remove our pid files
++ * remove_pidfile - remove one of the 2 pidfiles (pidfilename or linkpidfile)
+  */
+-void remove_pidfiles()
++void 
++remove_pidfile(filename)
++    char* filename;
+ {
+-    if (pidfilename[0] != 0 && unlink(pidfilename) < 0 && errno != ENOENT)
+-	warn("unable to delete pid file %s: %m", pidfilename);
+-    pidfilename[0] = 0;
+-    if (linkpidfile[0] != 0 && unlink(linkpidfile) < 0 && errno != ENOENT)
+-	warn("unable to delete pid file %s: %m", linkpidfile);
+-    linkpidfile[0] = 0;
++    if (filename[0] != 0 && unlink(filename) < 0 && errno != ENOENT)
++	warn("unable to delete pid file %s: %m", filename);
++    filename[0] = 0;
++}
++
++/*
++ * remove_pidfiles - remove our pid files
++ */
++static void remove_pidfiles()
++{
++    remove_pidfile(pidfilename);
++    remove_pidfile(linkpidfile);
+ }
+ 
+ /*
+--- ppp-2.4.5/pppd/multilink.c
++++ ppp-2.4.5/pppd/multilink.c
+@@ -267,7 +267,7 @@
+ 	notice("Connection terminated.");
+ 	print_link_stats();
+ 	if (!demand) {
+-		remove_pidfiles();
++		remove_pidfile(pidfilename);
+ 		script_unsetenv("IFNAME");
+ 	}
+ 
+--- ppp-2.4.5/pppd/pppd.h
++++ ppp-2.4.5/pppd/pppd.h
+@@ -214,6 +214,7 @@
+ extern int	ifunit;		/* Interface unit number */
+ extern char	ifname[];	/* Interface name */
+ extern char	hostname[];	/* Our hostname */
++extern char pidfilename[];	/* name of pid file */
+ extern u_char	outpacket_buf[]; /* Buffer for outgoing packets */
+ extern int	devfd;		/* fd of underlying device */
+ extern int	fd_ppp;		/* fd for talking PPP */
+@@ -497,7 +498,7 @@
+ int  ppp_send_config __P((int, int, u_int32_t, int, int));
+ int  ppp_recv_config __P((int, int, u_int32_t, int, int));
+ const char *protocol_name __P((int));
+-void remove_pidfiles __P((void));
++void remove_pidfile __P((char *));
+ void lock_db __P((void));
+ void unlock_db __P((void));
+ 
diff --git a/user/ppp/16_all_auth-fail.patch b/user/ppp/16_all_auth-fail.patch
new file mode 100644
index 000000000..8ae238035
--- /dev/null
+++ b/user/ppp/16_all_auth-fail.patch
@@ -0,0 +1,138 @@
+--- ppp-2.4.5/pppd/auth.c
++++ ppp-2.4.5/pppd/auth.c
+@@ -259,7 +259,7 @@
+ 			       struct wordlist **, struct wordlist **,
+ 			       char *, int));
+ static void free_wordlist __P((struct wordlist *));
+-static void auth_script __P((char *));
++static void auth_script __P((char *, int));
+ static void auth_script_done __P((void *));
+ static void set_allowed_addrs __P((int, struct wordlist *, struct wordlist *));
+ static int  some_ip_ok __P((struct wordlist *));
+@@ -690,7 +690,7 @@
+ 	if (auth_script_state == s_up && auth_script_pid == 0) {
+ 	    update_link_stats(unit);
+ 	    auth_script_state = s_down;
+-	    auth_script(_PATH_AUTHDOWN);
++	    auth_script(_PATH_AUTHDOWN, 0);
+ 	}
+     }
+     if (!doing_multilink) {
+@@ -822,7 +822,7 @@
+ 	auth_state = s_up;
+ 	if (auth_script_state == s_down && auth_script_pid == 0) {
+ 	    auth_script_state = s_up;
+-	    auth_script(_PATH_AUTHUP);
++	    auth_script(_PATH_AUTHUP, 0);
+ 	}
+     }
+ 
+@@ -923,6 +923,7 @@
+      * Authentication failure: take the link down
+      */
+     status = EXIT_PEER_AUTH_FAILED;
++    auth_script(_PATH_AUTHFAIL, 1);
+     lcp_close(unit, "Authentication failed");
+ }
+ 
+@@ -1001,6 +1002,7 @@
+      * authentication secrets.
+      */
+     status = EXIT_AUTH_TOPEER_FAILED;
++    auth_script(_PATH_AUTHFAIL, 1);
+     lcp_close(unit, "Failed to authenticate ourselves to peer");
+ }
+ 
+@@ -1233,6 +1235,8 @@
+     if (user[0] == 0 && !explicit_user)
+ 	strlcpy(user, our_name, sizeof(user));
+ 
++    script_setenv("LOCALNAME", user, 0);
++
+     /*
+      * If we have a default route, require the peer to authenticate
+      * unless the noauth option was given or the real user is root.
+@@ -2314,13 +2318,13 @@
+     case s_up:
+ 	if (auth_state == s_down) {
+ 	    auth_script_state = s_down;
+-	    auth_script(_PATH_AUTHDOWN);
++	    auth_script(_PATH_AUTHDOWN, 0);
+ 	}
+ 	break;
+     case s_down:
+ 	if (auth_state == s_up) {
+ 	    auth_script_state = s_up;
+-	    auth_script(_PATH_AUTHUP);
++	    auth_script(_PATH_AUTHUP, 0);
+ 	}
+ 	break;
+     }
+@@ -2331,8 +2335,9 @@
+  * interface-name peer-name real-user tty speed
+  */
+ static void
+-auth_script(script)
++auth_script(script, wait)
+     char *script;
++    int wait;
+ {
+     char strspeed[32];
+     struct passwd *pw;
+@@ -2356,5 +2361,8 @@
+     argv[5] = strspeed;
+     argv[6] = NULL;
+ 
+-    auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0);
++    if (wait)
++	run_program(script, argv, 0, NULL, NULL, 1);
++    else
++	auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0);
+ }
+--- ppp-2.4.5/pppd/pathnames.h
++++ ppp-2.4.5/pppd/pathnames.h
+@@ -27,6 +27,7 @@
+ #define _PATH_IPPREUP	 _ROOT_PATH "/etc/ppp/ip-pre-up"
+ #define _PATH_AUTHUP	 _ROOT_PATH "/etc/ppp/auth-up"
+ #define _PATH_AUTHDOWN	 _ROOT_PATH "/etc/ppp/auth-down"
++#define _PATH_AUTHFAIL	 _ROOT_PATH "/etc/ppp/auth-fail"
+ #define _PATH_TTYOPT	 _ROOT_PATH "/etc/ppp/options."
+ #define _PATH_CONNERRS	 _ROOT_PATH "/etc/ppp/connect-errors"
+ #define _PATH_PEERFILES	 _ROOT_PATH "/etc/ppp/peers/"
+--- ppp-2.4.5/pppd/pppd.8
++++ ppp-2.4.5/pppd/pppd.8
+@@ -1553,8 +1553,8 @@
+ Pppd invokes scripts at various stages in its processing which can be
+ used to perform site-specific ancillary processing.  These scripts are
+ usually shell scripts, but could be executable code files instead.
+-Pppd does not wait for the scripts to finish (except for the ip-pre-up
+-script).  The scripts are
++Pppd does not wait for the scripts to finish (except for the ip-pre-up,
++and auth-fail scripts).  The scripts are
+ executed as root (with the real and effective user-id set to 0), so
+ that they can do things such as update routing tables or run
+ privileged daemons.  Be careful that the contents of these scripts do
+@@ -1582,6 +1582,11 @@
+ The authenticated name of the peer.  This is only set if the peer
+ authenticates itself.
+ .TP
++.B LOCALNAME
++The username passed to the user option of the pppd daemon.  This is
++handy to identify which account was used for authentication purposes
++when multiple accounts are available.
++.TP
+ .B SPEED
+ The baud rate of the tty device.
+ .TP
+@@ -1634,6 +1639,11 @@
+ /etc/ppp/auth\-up was previously executed.  It is executed in the same
+ manner with the same parameters as /etc/ppp/auth\-up.
+ .TP
++.B /etc/ppp/auth\-fail
++A program or script which is executed should authentication fail.  pppd
++waits for this script to finish.  It is executed in the same manner, with
++the same parameters as /etc/ppp/auth\-up.
++.TP
+ .B /etc/ppp/ip\-pre\-up
+ A program or script which is executed just before the ppp network
+ interface is brought up.  It is executed with the same parameters as
diff --git a/user/ppp/18_all_defaultmetric.patch b/user/ppp/18_all_defaultmetric.patch
new file mode 100644
index 000000000..fba787005
--- /dev/null
+++ b/user/ppp/18_all_defaultmetric.patch
@@ -0,0 +1,104 @@
+--- ppp-2.4.5/pppd/options.c
++++ ppp-2.4.5/pppd/options.c
+@@ -94,6 +94,7 @@
+ int	kdebugflag = 0;		/* Tell kernel to print debug messages */
+ int	default_device = 1;	/* Using /dev/tty or equivalent */
+ char	devnam[MAXPATHLEN];	/* Device name */
++int defaultmetric = 0;		/* Metric of the default route */
+ bool	nodetach = 0;		/* Don't detach from controlling tty */
+ bool	updetach = 0;		/* Detach once link is up */
+ int	maxconnect = 0;		/* Maximum connect time */
+@@ -289,6 +290,10 @@
+       "Number of seconds to wait for child processes at exit",
+       OPT_PRIO },
+ 
++    { "defaultmetric", o_int, &defaultmetric,
++      "The metric of the default route",
++      OPT_LIMITS, 0, 32766 },
++
+ #ifdef HAVE_MULTILINK
+     { "multilink", o_bool, &multilink,
+       "Enable multilink operation", OPT_PRIO | 1 },
+--- ppp-2.4.5/pppd/pppd.8
++++ ppp-2.4.5/pppd/pppd.8
+@@ -121,6 +121,9 @@
+ This entry is removed when the PPP connection is broken.  This option
+ is privileged if the \fInodefaultroute\fR option has been specified.
+ .TP
++.B defaultmetric \fIn
++The metric of the default route configured by pppd; default is 0.
++.TP
+ .B disconnect \fIscript
+ Execute the command specified by \fIscript\fR, by passing it to a
+ shell, after
+--- ppp-2.4.5/pppd/pppd.h
++++ ppp-2.4.5/pppd/pppd.h
+@@ -276,6 +276,7 @@
+ extern int	kdebugflag;	/* Tell kernel to print debug messages */
+ extern int	default_device;	/* Using /dev/tty or equivalent */
+ extern char	devnam[MAXPATHLEN];	/* Device name */
++extern int defaultmetric;		/* Metric of the default route */
+ extern int	crtscts;	/* Use hardware flow control */
+ extern bool	modem;		/* Use modem control lines */
+ extern int	inspeed;	/* Input/Output speed requested */
+--- ppp-2.4.5/pppd/sys-linux.c
++++ ppp-2.4.5/pppd/sys-linux.c
+@@ -1465,7 +1465,7 @@
+ FILE *route_fd = (FILE *) 0;
+ static char route_buffer[512];
+ static int route_dev_col, route_dest_col, route_gw_col;
+-static int route_flags_col, route_mask_col;
++static int route_flags_col, route_mask_col, route_metric_col;
+ static int route_num_cols;
+ 
+ static int open_route_table (void);
+@@ -1508,6 +1508,7 @@
+     route_dest_col = 1;
+     route_gw_col = 2;
+     route_flags_col = 3;
++    route_metric_col = 6;
+     route_mask_col = 7;
+     route_num_cols = 8;
+ 
+@@ -1527,6 +1528,8 @@
+ 		route_gw_col = col;
+ 	    else if (strcasecmp(q, "flags") == 0)
+ 		route_flags_col = col;
++	    else if (strcasecmp(q, "metric") == 0)
++		route_metric_col = col;
+ 	    else if (strcasecmp(q, "mask") == 0)
+ 		route_mask_col = col;
+ 	    else
+@@ -1569,6 +1572,7 @@
+ 
+     rt->rt_flags = (short) strtoul(cols[route_flags_col], NULL, 16);
+     rt->rt_dev   = cols[route_dev_col];
++    rt->rt_metric = (short) strtoul(cols[route_metric_col], NULL, 16);
+ 
+     return 1;
+ }
+@@ -1591,6 +1595,8 @@
+ 
+ 	if (kernel_version > KVERSION(2,1,0) && SIN_ADDR(rt->rt_genmask) != 0)
+ 	    continue;
++	if (rt->rt_metric != defaultmetric) /* consider only routes with the same metric */
++	    continue;
+ 	if (SIN_ADDR(rt->rt_dst) == 0L) {
+ 	    result = 1;
+ 	    break;
+@@ -1661,6 +1667,7 @@
+     SIN_ADDR(rt.rt_gateway) = gateway;
+ 
+     rt.rt_flags = RTF_UP | RTF_GATEWAY;
++    rt.rt_metric = defaultmetric + 1; /* +1 for binary compatibility */
+     if (ioctl(sock_fd, SIOCADDRT, &rt) < 0) {
+ 	if ( ! ok_error ( errno ))
+ 	    error("default route ioctl(SIOCADDRT): %m");
+@@ -1696,6 +1703,7 @@
+     SIN_ADDR(rt.rt_gateway) = gateway;
+ 
+     rt.rt_flags = RTF_UP | RTF_GATEWAY;
++    rt.rt_metric = defaultmetric + 1; /* +1 for binary compatibility */
+     if (ioctl(sock_fd, SIOCDELRT, &rt) < 0 && errno != ESRCH) {
+ 	if (still_ppp()) {
+ 	    if ( ! ok_error ( errno ))
diff --git a/user/ppp/19_all_radius_pid_overflow.patch b/user/ppp/19_all_radius_pid_overflow.patch
new file mode 100644
index 000000000..b5078bdb9
--- /dev/null
+++ b/user/ppp/19_all_radius_pid_overflow.patch
@@ -0,0 +1,14 @@
+https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782450
+https://bugs.gentoo.org/546554
+
+--- ppp-2.4.7/pppd/plugins/radius/util.c
++++ ppp-2.4.7/pppd/plugins/radius/util.c
+@@ -77,7 +77,7 @@
+   static unsigned short int cnt = 0;
+   sprintf (buf, "%08lX%04X%02hX",
+ 	   (unsigned long int) time (NULL),
+-	   (unsigned int) getpid (),
++	   (unsigned int) getpid () % 65535,
+ 	   cnt & 0xFF);
+   cnt++;
+   return buf;
diff --git a/user/ppp/20_all_dev-ppp.patch b/user/ppp/20_all_dev-ppp.patch
new file mode 100644
index 000000000..eff3e37f0
--- /dev/null
+++ b/user/ppp/20_all_dev-ppp.patch
@@ -0,0 +1,20 @@
+--- ppp-2.4.6/pppd/sys-linux.c
++++ ppp-2.4.6/pppd/sys-linux.c
+@@ -2031,6 +2031,17 @@
+     kernel_version = KVERSION(osmaj, osmin, ospatch);
+ 
+     fd = open("/dev/ppp", O_RDWR);
++    if (fd < 0) {
++	/* try making it and see if that helps. */
++	if (errno == ENOENT && mknod("/dev/ppp", S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP,
++		  makedev(108, 0)) >= 0) {
++	    fd = open("/dev/ppp", O_RDWR);
++	    if (fd >= 0)
++		info("Created /dev/ppp device node");
++	    else
++		unlink("/dev/ppp");     /* didn't work, undo the mknod */
++	}
++    }
+     if (fd >= 0) {
+ 	new_style_driver = 1;
+ 
diff --git a/user/ppp/21_all_custom_iface_names.patch b/user/ppp/21_all_custom_iface_names.patch
new file mode 100644
index 000000000..5d3f7b94b
--- /dev/null
+++ b/user/ppp/21_all_custom_iface_names.patch
@@ -0,0 +1,144 @@
+pppd: Support arbitrary interface names
+
+This patch implements a new string option "ifname" which allows to specify
+fully custom PPP interface names on Linux. It does so by renaming the
+allocated pppX device immediately after it has been created to the requested
+interface name.
+
+Originally written by Suse. Used by openwrt, debian, ubuntu.
+
+Reference:
+
+https://dev.openwrt.org/browser/trunk/package/network/services/ppp/patches/320-custom_iface_names.patch
+
+diff -purN ppp-2.4.7.orig/pppd/main.c ppp-2.4.7/pppd/main.c
+--- ppp-2.4.7.orig/pppd/main.c	2016-08-25 15:52:52.032202044 +0200
++++ ppp-2.4.7/pppd/main.c	2016-08-25 16:22:25.740299940 +0200
+@@ -729,8 +729,11 @@ void
+ set_ifunit(iskey)
+     int iskey;
+ {
+-    info("Using interface %s%d", PPP_DRV_NAME, ifunit);
+-    slprintf(ifname, sizeof(ifname), "%s%d", PPP_DRV_NAME, ifunit);
++    if (use_ifname[0] == 0)
++	slprintf(ifname, sizeof(ifname), "%s%d", PPP_DRV_NAME, ifunit);
++    else
++	slprintf(ifname, sizeof(ifname), "%s", use_ifname);
++    info("Using interface %s", ifname);
+     script_setenv("IFNAME", ifname, iskey);
+     if (iskey) {
+ 	create_pidfile(getpid());	/* write pid to file */
+diff -purN ppp-2.4.7.orig/pppd/options.c ppp-2.4.7/pppd/options.c
+--- ppp-2.4.7.orig/pppd/options.c	2016-08-25 15:52:52.191194523 +0200
++++ ppp-2.4.7/pppd/options.c	2016-08-25 16:04:23.335501924 +0200
+@@ -115,6 +115,7 @@ int	log_to_fd = 1;		/* send log messages
+ bool	log_default = 1;	/* log_to_fd is default (stdout) */
+ int	maxfail = 10;		/* max # of unsuccessful connection attempts */
+ char	linkname[MAXPATHLEN];	/* logical name for link */
++char	use_ifname[IFNAMSIZ];	/* physical name for PPP link */
+ bool	tune_kernel;		/* may alter kernel settings */
+ int	connect_delay = 1000;	/* wait this many ms after connect script */
+ int	req_unit = -1;		/* requested interface unit */
+@@ -274,6 +275,9 @@ option_t general_options[] = {
+     { "linkname", o_string, linkname,
+       "Set logical name for link",
+       OPT_PRIO | OPT_PRIV | OPT_STATIC, NULL, MAXPATHLEN },
++    { "ifname", o_string, use_ifname,
++      "Set physical name for PPP interface",
++      OPT_PRIO | OPT_PRIV | OPT_STATIC, NULL, IFNAMSIZ },
+ 
+     { "maxfail", o_int, &maxfail,
+       "Maximum number of unsuccessful connection attempts to allow",
+diff -purN ppp-2.4.7.orig/pppd/pppd.h ppp-2.4.7/pppd/pppd.h
+--- ppp-2.4.7.orig/pppd/pppd.h	2016-08-25 15:52:52.829164346 +0200
++++ ppp-2.4.7/pppd/pppd.h	2016-08-25 16:07:12.024522417 +0200
+@@ -71,6 +71,10 @@
+ #include "eui64.h"
+ #endif
+ 
++#ifndef IFNAMSIZ
++#define IFNAMSIZ	16
++#endif
++
+ /*
+  * Limits.
+  */
+@@ -319,6 +323,7 @@ extern char	*record_file;	/* File to rec
+ extern bool	sync_serial;	/* Device is synchronous serial device */
+ extern int	maxfail;	/* Max # of unsuccessful connection attempts */
+ extern char	linkname[MAXPATHLEN]; /* logical name for link */
++extern char	use_ifname[IFNAMSIZ]; /* physical name for PPP interface */
+ extern bool	tune_kernel;	/* May alter kernel settings as necessary */
+ extern int	connect_delay;	/* Time to delay after connect script */
+ extern int	max_data_rate;	/* max bytes/sec through charshunt */
+diff -purN ppp-2.4.7.orig/pppd/sys-linux.c ppp-2.4.7/pppd/sys-linux.c
+--- ppp-2.4.7.orig/pppd/sys-linux.c	2016-08-25 15:52:52.268190881 +0200
++++ ppp-2.4.7/pppd/sys-linux.c	2016-08-25 16:12:13.905242396 +0200
+@@ -172,6 +172,10 @@ struct in6_ifreq {
+ /* We can get an EIO error on an ioctl if the modem has hung up */
+ #define ok_error(num) ((num)==EIO)
+ 
++#if !defined(PPP_DRV_NAME)
++#define PPP_DRV_NAME	"ppp"
++#endif /* !defined(PPP_DRV_NAME) */
++
+ static int tty_disc = N_TTY;	/* The TTY discipline */
+ static int ppp_disc = N_PPP;	/* The PPP discpline */
+ static int initfdflags = -1;	/* Initial file descriptor flags for fd */
+@@ -644,7 +648,8 @@ void generic_disestablish_ppp(int dev_fd
+  */
+ static int make_ppp_unit()
+ {
+-	int x, flags;
++	struct ifreq ifr;
++	int x, flags, s;
+ 
+ 	if (ppp_dev_fd >= 0) {
+ 		dbglog("in make_ppp_unit, already had /dev/ppp open?");
+@@ -667,6 +672,30 @@ static int make_ppp_unit()
+ 	}
+ 	if (x < 0)
+ 		error("Couldn't create new ppp unit: %m");
++
++	if (use_ifname[0] != 0) {
++		s = socket(PF_INET, SOCK_DGRAM, 0);
++		if (s < 0)
++			s = socket(PF_PACKET, SOCK_DGRAM, 0);
++		if (s < 0)
++			s = socket(PF_INET6, SOCK_DGRAM, 0);
++		if (s < 0)
++			s = socket(PF_UNIX, SOCK_DGRAM, 0);
++		if (s >= 0) {
++			slprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s%d", PPP_DRV_NAME, ifunit);
++			slprintf(ifr.ifr_newname, sizeof(ifr.ifr_newname), "%s", use_ifname);
++			x = ioctl(s, SIOCSIFNAME, &ifr);
++			close(s);
++		} else {
++			x = s;
++		}
++		if (x < 0) {
++			error("Couldn't rename %s to %s", ifr.ifr_name, ifr.ifr_newname);
++			close(ppp_dev_fd);
++			ppp_dev_fd = -1;
++		}
++	}
++
+ 	return x;
+ }
+ 
+diff -purN ppp-2.4.7.orig/pppstats/pppstats.c ppp-2.4.7/pppstats/pppstats.c
+--- ppp-2.4.7.orig/pppstats/pppstats.c	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7/pppstats/pppstats.c	2016-08-25 16:13:52.623572634 +0200
+@@ -506,10 +506,12 @@ main(argc, argv)
+     if (argc > 0)
+ 	interface = argv[0];
+ 
++#if 0
+     if (sscanf(interface, PPP_DRV_NAME "%d", &unit) != 1) {
+ 	fprintf(stderr, "%s: invalid interface '%s' specified\n",
+ 		progname, interface);
+     }
++#endif
+ 
+ #ifndef STREAMS
+     {
diff --git a/user/ppp/24_all_passwordfd-read-early.patch b/user/ppp/24_all_passwordfd-read-early.patch
new file mode 100644
index 000000000..f549540dc
--- /dev/null
+++ b/user/ppp/24_all_passwordfd-read-early.patch
@@ -0,0 +1,84 @@
+--- ppp-2.4.5/pppd/plugins/passwordfd.c
++++ ppp-2.4.5/pppd/plugins/passwordfd.c
+@@ -16,11 +16,11 @@
+ 
+ char pppd_version[] = VERSION;
+ 
+-static int passwdfd = -1;
+ static char save_passwd[MAXSECRETLEN];
+ 
++static int readpassword __P((char **));
+ static option_t options[] = {
+-    { "passwordfd", o_int, &passwdfd,
++    { "passwordfd", o_special, (void *)readpassword,
+       "Receive password on this file descriptor" },
+     { NULL }
+ };
+@@ -30,43 +30,39 @@
+     return 1;
+ }
+ 
+-static int pwfd_passwd (char *user, char *passwd)
++static int readpassword(char **argv)
+ {
+-    int readgood, red;
+-
+-    if (passwdfd == -1)
+-	return -1;
+-
+-    if (passwd == NULL)
+-	return 1;
+-
+-    if (passwdfd == -2) {
+-	strcpy (passwd, save_passwd);
+-	return 1;
++    char *arg = *argv;
++    int passwdfd = -1;
++    int chunk, len;
++
++    if (sscanf(arg, "%d", &passwdfd) != 1 || passwdfd < 0)
++    {
++	error ("\"%s\" is not a valid file descriptor number", arg);
++	return 0;
+     }
+ 
+-    readgood = 0;
++    len = 0;
+     do {
+-	red = read (passwdfd, passwd + readgood, MAXSECRETLEN - 1 - readgood);
+-	if (red == 0)
+-	    break;
+-	if (red < 0) {
+-	    error ("Can't read secret from fd\n");
+-	    readgood = -1;
++	chunk = read (passwdfd, save_passwd + len, MAXSECRETLEN - 1 - len);
++	if (chunk == 0)
+ 	    break;
++	if (chunk < 0) {
++	    error ("Can't read secret from fd %d", passwdfd);
++	    return 0;
+ 	}
+-	readgood += red;
+-    } while (readgood < MAXSECRETLEN - 1);
+-
++	len += chunk;
++    } while (len < MAXSECRETLEN - 1);
++    save_passwd[len] = 0;
+     close (passwdfd);
+ 
+-    if (readgood < 0)
+-	return 0;
+-
+-    passwd[readgood] = 0;
+-    strcpy (save_passwd, passwd);
+-    passwdfd = -2;
++    return 1;
++}
+ 
++static int pwfd_passwd (char *user, char *passwd)
++{
++    if (passwd != NULL)
++	strcpy (passwd, save_passwd);
+     return 1;
+ }
+ 
diff --git a/user/ppp/26_all_pppd-usepeerwins.patch b/user/ppp/26_all_pppd-usepeerwins.patch
new file mode 100644
index 000000000..d66fbe0b1
--- /dev/null
+++ b/user/ppp/26_all_pppd-usepeerwins.patch
@@ -0,0 +1,256 @@
+--- ppp-2.4.6/pppd/ipcp.c
++++ ppp-2.4.6/pppd/ipcp.c
+@@ -91,6 +91,7 @@
+ static int default_route_set[NUM_PPP];	/* Have set up a default route */
+ static int proxy_arp_set[NUM_PPP];	/* Have created proxy arp entry */
+ static bool usepeerdns;			/* Ask peer for DNS addrs */
++static bool usepeerwins;		/* Ask peer for WINS addrs */
+ static int ipcp_is_up;			/* have called np_up() */
+ static int ipcp_is_open;		/* haven't called np_finished() */
+ static bool ask_for_local;		/* request our address from peer */
+@@ -210,6 +211,9 @@
+     { "usepeerdns", o_bool, &usepeerdns,
+       "Ask peer for DNS address(es)", 1 },
+ 
++    { "usepeerwins", o_bool, &usepeerwins,
++      "Ask peer for WINS address(es)", 1 },
++
+     { "netmask", o_special, (void *)setnetmask,
+       "set netmask", OPT_PRIO | OPT_A2STRVAL | OPT_STATIC, netmask_str },
+ 
+@@ -703,6 +707,8 @@
+ 	wo->accept_remote = 1;
+     wo->req_dns1 = usepeerdns;	/* Request DNS addresses from the peer */
+     wo->req_dns2 = usepeerdns;
++    wo->req_wins1 = usepeerwins; /* Request WINS addresses from the peer */
++    wo->req_wins2 = usepeerwins;
+     *go = *wo;
+     if (!ask_for_local)
+ 	go->ouraddr = 0;
+@@ -755,8 +761,8 @@
+ 	    LENCIADDR(go->neg_addr) +
+ 	    LENCIDNS(go->req_dns1) +
+ 	    LENCIDNS(go->req_dns2) +
+-	    LENCIWINS(go->winsaddr[0]) +
+-	    LENCIWINS(go->winsaddr[1])) ;
++	    LENCIWINS(go->req_wins1) +
++	    LENCIWINS(go->req_wins2)) ;
+ }
+ 
+ 
+@@ -830,8 +836,8 @@
+ 	    neg = 0; \
+     }
+ 
+-#define ADDCIWINS(opt, addr) \
+-    if (addr) { \
++#define ADDCIWINS(opt, neg, addr) \
++    if (neg) { \
+ 	if (len >= CILEN_ADDR) { \
+ 	    u_int32_t l; \
+ 	    PUTCHAR(opt, ucp); \
+@@ -840,7 +846,7 @@
+ 	    PUTLONG(l, ucp); \
+ 	    len -= CILEN_ADDR; \
+ 	} else \
+-	    addr = 0; \
++	    neg = 0; \
+     }
+ 
+     ADDCIADDRS(CI_ADDRS, !go->neg_addr && go->old_addrs, go->ouraddr,
+@@ -855,9 +861,9 @@
+ 
+     ADDCIDNS(CI_MS_DNS2, go->req_dns2, go->dnsaddr[1]);
+ 
+-    ADDCIWINS(CI_MS_WINS1, go->winsaddr[0]);
++    ADDCIWINS(CI_MS_WINS1, go->req_wins1, go->winsaddr[0]);
+ 
+-    ADDCIWINS(CI_MS_WINS2, go->winsaddr[1]);
++    ADDCIWINS(CI_MS_WINS2, go->req_wins2, go->winsaddr[1]);
+     
+     *lenp -= len;
+ }
+@@ -962,8 +968,8 @@
+ 	    goto bad; \
+     }
+ 
+-#define ACKCIWINS(opt, addr) \
+-    if (addr) { \
++#define ACKCIWINS(opt, neg, addr) \
++    if (neg) { \
+ 	u_int32_t l; \
+ 	if ((len -= CILEN_ADDR) < 0) \
+ 	    goto bad; \
+@@ -989,9 +995,9 @@
+ 
+     ACKCIDNS(CI_MS_DNS2, go->req_dns2, go->dnsaddr[1]);
+ 
+-    ACKCIWINS(CI_MS_WINS1, go->winsaddr[0]);
++    ACKCIWINS(CI_MS_WINS1, go->req_wins1, go->winsaddr[0]);
+ 
+-    ACKCIWINS(CI_MS_WINS2, go->winsaddr[1]);
++    ACKCIWINS(CI_MS_WINS2, go->req_wins2, go->winsaddr[1]);
+ 
+     /*
+      * If there are any remaining CIs, then this packet is bad.
+@@ -1026,7 +1032,7 @@
+     u_char cimaxslotindex, cicflag;
+     u_char citype, cilen, *next;
+     u_short cishort;
+-    u_int32_t ciaddr1, ciaddr2, l, cidnsaddr;
++    u_int32_t ciaddr1, ciaddr2, l, cidnsaddr, ciwinsaddr;
+     ipcp_options no;		/* options we've seen Naks for */
+     ipcp_options try;		/* options to request next time */
+ 
+@@ -1091,6 +1097,19 @@
+ 	code \
+     }
+ 
++#define NAKCIWINS(opt, neg, code) \
++    if (go->neg && \
++	((cilen = p[1]) == CILEN_ADDR) && \
++	len >= cilen && \
++	p[0] == opt) { \
++	len -= cilen; \
++	INCPTR(2, p); \
++	GETLONG(l, p); \
++	ciwinsaddr = htonl(l); \
++	no.neg = 1; \
++	code \
++    }
++
+     /*
+      * Accept the peer's idea of {our,his} address, if different
+      * from our idea, only if the accept_{local,remote} flag is set.
+@@ -1167,6 +1186,22 @@
+ 	     }
+ 	     );
+ 
++    NAKCIWINS(CI_MS_WINS1, req_wins1,
++	     if (treat_as_reject) {
++		 try.req_wins1 = 0;
++	     } else {
++		 try.winsaddr[0] = ciwinsaddr;
++	     }
++	     );
++
++    NAKCIWINS(CI_MS_WINS2, req_wins2,
++	     if (treat_as_reject) {
++		 try.req_wins2 = 0;
++	     } else {
++		 try.winsaddr[1] = ciwinsaddr;
++	     }
++	     );
++
+     /*
+      * There may be remaining CIs, if the peer is requesting negotiation
+      * on an option that we didn't include in our request packet.
+@@ -1259,7 +1294,6 @@
+     return 0;
+ }
+ 
+-
+ /*
+  * ipcp_rejci - Reject some of our CIs.
+  * Callback from fsm_rconfnakrej.
+@@ -1357,8 +1391,8 @@
+ 	try.neg = 0; \
+     }
+ 
+-#define REJCIWINS(opt, addr) \
+-    if (addr && \
++#define REJCIWINS(opt, neg, addr) \
++    if (go->neg && \
+ 	((cilen = p[1]) == CILEN_ADDR) && \
+ 	len >= cilen && \
+ 	p[0] == opt) { \
+@@ -1370,7 +1404,7 @@
+ 	/* Check rejected value. */ \
+ 	if (cilong != addr) \
+ 	    goto bad; \
+-	try.winsaddr[opt == CI_MS_WINS2] = 0; \
++	try.neg = 0; \
+     }
+ 
+     REJCIADDRS(CI_ADDRS, !go->neg_addr && go->old_addrs,
+@@ -1385,9 +1419,9 @@
+ 
+     REJCIDNS(CI_MS_DNS2, req_dns2, go->dnsaddr[1]);
+ 
+-    REJCIWINS(CI_MS_WINS1, go->winsaddr[0]);
++    REJCIWINS(CI_MS_WINS1, req_wins1, go->winsaddr[0]);
+ 
+-    REJCIWINS(CI_MS_WINS2, go->winsaddr[1]);
++    REJCIWINS(CI_MS_WINS2, req_wins2, go->winsaddr[1]);
+ 
+     /*
+      * If there are any remaining CIs, then this packet is bad.
+@@ -1581,7 +1615,7 @@
+ 	    /* Microsoft primary or secondary WINS request */
+ 	    d = citype == CI_MS_WINS2;
+ 
+-	    /* If we do not have a DNS address then we cannot send it */
++	    /* If we do not have a WINS address then we cannot send it */
+ 	    if (ao->winsaddr[d] == 0 ||
+ 		cilen != CILEN_ADDR) {	/* Check CI length */
+ 		orc = CONFREJ;		/* Reject CI */
+@@ -1830,6 +1864,13 @@
+ 	create_resolv(go->dnsaddr[0], go->dnsaddr[1]);
+     }
+ 
++    if (go->winsaddr[0])
++        script_setenv("WINS1", ip_ntoa(go->winsaddr[0]), 0);
++    if (go->winsaddr[1])
++        script_setenv("WINS2", ip_ntoa(go->winsaddr[1]), 0);
++    if (usepeerwins && (go->winsaddr[0] || go->winsaddr[1]))
++        script_setenv("USEPEERWINS", "1", 0);
++
+     /*
+      * Check that the peer is allowed to use the IP address it wants.
+      */
+--- ppp-2.4.6/pppd/ipcp.h
++++ ppp-2.4.6/pppd/ipcp.h
+@@ -77,6 +77,8 @@
+     bool accept_remote;		/* accept peer's value for hisaddr */
+     bool req_dns1;		/* Ask peer to send primary DNS address? */
+     bool req_dns2;		/* Ask peer to send secondary DNS address? */
++    bool req_wins1;		/* Ask peer to send primary WINS address? */
++    bool req_wins2;		/* Ask peer to send secondary WINS address? */
+     int  vj_protocol;		/* protocol value to use in VJ option */
+     int  maxslotindex;		/* values for RFC1332 VJ compression neg. */
+     bool cflag;
+--- ppp-2.4.6/pppd/pppd.8
++++ ppp-2.4.6/pppd/pppd.8
+@@ -1102,6 +1102,16 @@
+ /etc/ppp/resolv.conf file containing one or two nameserver lines with
+ the address(es) supplied by the peer.
+ .TP
++.B usepeerwins
++Ask the peer for up to 2 WINS server addresses.  The addresses supplied
++by the peer (if any) are passed to the /etc/ppp/ip\-up script in the
++environment variables WINS1 and WINS2, and the environment variable
++USEPEERWINS will be set to 1.
++.LP
++Please note that some modems (like the Huawei E220) requires this option in
++order to avoid a race condition that results in the incorrect DNS servers
++being assigned.
++.TP
+ .B user \fIname
+ Sets the name used for authenticating the local system to the peer to
+ \fIname\fR.
+@@ -1650,6 +1660,15 @@
+ If the peer supplies DNS server addresses, this variable is set to the
+ second DNS server address supplied (whether or not the usepeerdns
+ option was given).
++.TP
++.B WINS1
++If the peer supplies WINS server addresses, this variable is set to the
++first WINS server address supplied.
++.TP
++.B WINS2
++If the peer supplies WINS server addresses, this variable is set to the
++second WINS server address supplied.
++.P
+ .P
+ Pppd invokes the following scripts, if they exist.  It is not an error
+ if they don't exist.
diff --git a/user/ppp/28_all_connect-errors.patch b/user/ppp/28_all_connect-errors.patch
new file mode 100644
index 000000000..b87acef5d
--- /dev/null
+++ b/user/ppp/28_all_connect-errors.patch
@@ -0,0 +1,11 @@
+--- ppp-2.4.5/pppd/pathnames.h
++++ ppp-2.4.5/pppd/pathnames.h
+@@ -29,7 +29,7 @@
+ #define _PATH_AUTHDOWN	 _ROOT_PATH "/etc/ppp/auth-down"
+ #define _PATH_AUTHFAIL	 _ROOT_PATH "/etc/ppp/auth-fail"
+ #define _PATH_TTYOPT	 _ROOT_PATH "/etc/ppp/options."
+-#define _PATH_CONNERRS	 _ROOT_PATH "/etc/ppp/connect-errors"
++#define _PATH_CONNERRS	 _ROOT_PATH "/var/log/ppp-connect-errors"
+ #define _PATH_PEERFILES	 _ROOT_PATH "/etc/ppp/peers/"
+ #define _PATH_RESOLV	 _ROOT_PATH "/etc/ppp/resolv.conf"
+ 
diff --git a/user/ppp/30_all_Makefile.patch b/user/ppp/30_all_Makefile.patch
new file mode 100644
index 000000000..165fc7b22
--- /dev/null
+++ b/user/ppp/30_all_Makefile.patch
@@ -0,0 +1,37 @@
+Ensure that the build process aborts if there is an error in one of
+the plugin subdirectories.
+
+2010-09-01 Martin von Gagern
+
+References:
+http://bugs.gentoo.org/334727
+
+Index: ppp-2.4.5/pppd/plugins/Makefile.linux
+===================================================================
+--- ppp-2.4.5/pppd/plugins/Makefile.linux
++++ ppp-2.4.5/pppd/plugins/Makefile.linux
+@@ -20,7 +20,7 @@ include .depend
+ endif
+ 
+ all:	$(PLUGINS)
+-	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all; done
++	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d all || exit $?; done
+ 
+ %.so: %.c
+ 	$(CC) -o $@ $(LDFLAGS) $(CFLAGS) $^
+@@ -30,12 +30,12 @@ VERSION = $(shell awk -F '"' '/VERSION/
+ install: $(PLUGINS)
+ 	$(INSTALL) -d $(LIBDIR)
+ 	$(INSTALL) $? $(LIBDIR)
+-	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d install; done
++	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d install || exit $?; done
+ 
+ clean:
+ 	rm -f *.o *.so *.a
+-	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d clean; done
++	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d clean || exit $?; done
+ 
+ depend:
+ 	$(CPP) -M $(CFLAGS) *.c >.depend
+-	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d depend; done
++	for d in $(SUBDIRS); do $(MAKE) $(MFLAGS) -C $$d depend || exit $?; done
diff --git a/user/ppp/32_all_pado-timeout.patch b/user/ppp/32_all_pado-timeout.patch
new file mode 100644
index 000000000..72f1adbb1
--- /dev/null
+++ b/user/ppp/32_all_pado-timeout.patch
@@ -0,0 +1,254 @@
+--- ppp-2.4.6/pppd/plugins/rp-pppoe/discovery.c
++++ ppp-2.4.6/pppd/plugins/rp-pppoe/discovery.c
+@@ -39,6 +39,7 @@
+ #endif
+ 
+ #include <signal.h>
++#include <time.h>
+ 
+ /* Calculate time remaining until *exp, return 0 if now >= *exp */
+ static int time_left(struct timeval *diff, struct timeval *exp)
+@@ -251,6 +252,80 @@
+ }
+ 
+ /***********************************************************************
++*%FUNCTION: recvPacketForMe
++*%ARGUMENTS:
++* packet -- output parameter
++* len -- output parameter length
++* conn -- connection
++* start -- operation startup timestamp
++* timeout -- how long to wait (in seconds)
++*%RETURNS:
++* -1:  error
++*  0:  timed out
++*  1:  packet received
++*%DESCRIPTION:
++* receive and filter junk packets
++***********************************************************************/
++
++static int
++recvPacketForMe(PPPoEPacket *packet, int *len, PPPoEConnection *conn, time_t start, int timeout)
++{
++    fd_set readable;
++    int r;
++    struct timeval tv;
++    time_t now;
++    int time_remain;
++
++    do {
++	time(&now);
++	time_remain = timeout - (int)difftime(now, start);
++	if (time_remain <= 0) return 0;  /* Timed out */
++
++	if (BPF_BUFFER_IS_EMPTY) {
++	    tv.tv_sec = time_remain;
++	    tv.tv_usec = 0;
++
++	    FD_ZERO(&readable);
++	    FD_SET(conn->discoverySocket, &readable);
++
++	    r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
++	    if (r < 0)
++	    {
++		if (errno == EINTR)
++		{
++		    continue;   /* interrupted, so retry */
++		}else
++		{
++		    error("pppoe: recvPacketForMe: select: %m");
++		    return -1;
++		}
++	    }
++
++	    if (r == 0) return 0;	/* Timed out */
++	}
++
++	/* Get the packet */
++	receivePacket(conn->discoverySocket, packet, len);
++
++	/* Check length */
++	if (ntohs(packet->length) + HDR_SIZE > *len) {
++	    error("Bogus PPPoE length field (%u)",
++		   (unsigned int) ntohs(packet->length));
++	    continue;
++	}
++
++#ifdef USE_BPF
++	/* If it's not a Discovery packet, loop again */
++	if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
++#endif
++	/* If it's not for us, loop again */
++	}while ( ! packetIsForMe(conn, packet));
++
++	return 1;
++}
++
++
++/***********************************************************************
+ *%FUNCTION: sendPADI
+ *%ARGUMENTS:
+ * conn -- PPPoEConnection structure
+@@ -344,13 +419,12 @@
+ void
+ waitForPADO(PPPoEConnection *conn, int timeout)
+ {
+-    fd_set readable;
+     int r;
+-    struct timeval tv;
+     struct timeval expire_at;
+ 
+     PPPoEPacket packet;
+     int len;
++    time_t start;
+ 
+     struct PacketCriteria pc;
+     pc.conn          = conn;
+@@ -367,43 +441,10 @@
+     }
+     expire_at.tv_sec += timeout;
+ 
++    time(&start);
+     do {
+-	if (BPF_BUFFER_IS_EMPTY) {
+-	    if (!time_left(&tv, &expire_at))
+-		return;		/* Timed out */
+-
+-	    FD_ZERO(&readable);
+-	    FD_SET(conn->discoverySocket, &readable);
+-
+-	    while(1) {
+-		r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
+-		if (r >= 0 || errno != EINTR) break;
+-	    }
+-	    if (r < 0) {
+-		error("select (waitForPADO): %m");
+-		return;
+-	    }
+-	    if (r == 0)
+-		return;		/* Timed out */
+-	}
+-
+-	/* Get the packet */
+-	receivePacket(conn->discoverySocket, &packet, &len);
+-
+-	/* Check length */
+-	if (ntohs(packet.length) + HDR_SIZE > len) {
+-	    error("Bogus PPPoE length field (%u)",
+-		   (unsigned int) ntohs(packet.length));
+-	    continue;
+-	}
+-
+-#ifdef USE_BPF
+-	/* If it's not a Discovery packet, loop again */
+-	if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
+-#endif
+-
+-	/* If it's not for us, loop again */
+-	if (!packetIsForMe(conn, &packet)) continue;
++	r = recvPacketForMe(&packet, &len, conn, start, timeout);
++	if (r<=0) return;  /* Timed out or error */
+ 
+ 	if (packet.code == CODE_PADO) {
+ 	    if (NOT_UNICAST(packet.ethHdr.h_source)) {
+@@ -537,13 +578,12 @@
+ static void
+ waitForPADS(PPPoEConnection *conn, int timeout)
+ {
+-    fd_set readable;
+     int r;
+-    struct timeval tv;
+     struct timeval expire_at;
+ 
+     PPPoEPacket packet;
+     int len;
++    time_t start;
+ 
+     if (gettimeofday(&expire_at, NULL) < 0) {
+ 	error("gettimeofday (waitForPADS): %m");
+@@ -551,48 +591,15 @@
+     }
+     expire_at.tv_sec += timeout;
+ 
++    time(&start);
+     conn->error = 0;
+     do {
+-	if (BPF_BUFFER_IS_EMPTY) {
+-	    if (!time_left(&tv, &expire_at))
+-		return;		/* Timed out */
+-
+-	    FD_ZERO(&readable);
+-	    FD_SET(conn->discoverySocket, &readable);
+-
+-	    while(1) {
+-		r = select(conn->discoverySocket+1, &readable, NULL, NULL, &tv);
+-		if (r >= 0 || errno != EINTR) break;
+-	    }
+-	    if (r < 0) {
+-		error("select (waitForPADS): %m");
+-		return;
+-	    }
+-	    if (r == 0)
+-		return;		/* Timed out */
+-	}
+-
+-	/* Get the packet */
+-	receivePacket(conn->discoverySocket, &packet, &len);
+-
+-	/* Check length */
+-	if (ntohs(packet.length) + HDR_SIZE > len) {
+-	    error("Bogus PPPoE length field (%u)",
+-		   (unsigned int) ntohs(packet.length));
+-	    continue;
+-	}
+-
+-#ifdef USE_BPF
+-	/* If it's not a Discovery packet, loop again */
+-	if (etherType(&packet) != Eth_PPPOE_Discovery) continue;
+-#endif
++	r = recvPacketForMe(&packet, &len, conn, start, timeout);
++	if (r<=0) return;  /* Timed out or error */
+ 
+ 	/* If it's not from the AC, it's not for me */
+ 	if (memcmp(packet.ethHdr.h_source, conn->peerEth, ETH_ALEN)) continue;
+ 
+-	/* If it's not for us, loop again */
+-	if (!packetIsForMe(conn, &packet)) continue;
+-
+ 	/* Is it PADS?  */
+ 	if (packet.code == CODE_PADS) {
+ 	    /* Parse for goodies */
+--- ppp-2.4.6/pppd/plugins/rp-pppoe/pppoe-discovery.c
++++ ppp-2.4.6/pppd/plugins/rp-pppoe/pppoe-discovery.c
+@@ -14,6 +14,7 @@
+ #include <unistd.h>
+ #include <errno.h>
+ #include <string.h>
++#include <time.h>
+ 
+ #include "pppoe.h"
+ 
+@@ -513,6 +514,8 @@
+     struct timeval tv;
+     PPPoEPacket packet;
+     int len;
++    time_t start, now;
++    int time_remain;
+ 
+     struct PacketCriteria pc;
+     pc.conn          = conn;
+@@ -522,9 +525,13 @@
+     pc.seenServiceName = 0;
+     conn->error = 0;
+ 	
++    time(&start);
+     do {
++	time(&now);
++	time_remain = timeout - (int)difftime(now, start);
++	if (time_remain <= 0) return;	/* Timed out */
+ 	if (BPF_BUFFER_IS_EMPTY) {
+-	    tv.tv_sec = timeout;
++	    tv.tv_sec = time_remain;
+ 	    tv.tv_usec = 0;
+ 	
+ 	    FD_ZERO(&readable);
diff --git a/user/ppp/34_all_lcp-echo-adaptive.patch b/user/ppp/34_all_lcp-echo-adaptive.patch
new file mode 100644
index 000000000..6faf19a27
--- /dev/null
+++ b/user/ppp/34_all_lcp-echo-adaptive.patch
@@ -0,0 +1,56 @@
+--- ppp-2.4.5/pppd/lcp.c
++++ ppp-2.4.5/pppd/lcp.c
+@@ -73,6 +73,7 @@
+  */
+ int	lcp_echo_interval = 0; 	/* Interval between LCP echo-requests */
+ int	lcp_echo_fails = 0;	/* Tolerance to unanswered echo-requests */
++bool	lcp_echo_adaptive = 0;	/* request echo only if the link was idle */
+ bool	lax_recv = 0;		/* accept control chars in asyncmap */
+ bool	noendpoint = 0;		/* don't send/accept endpoint discriminator */
+ 
+@@ -151,6 +152,8 @@
+       OPT_PRIO },
+     { "lcp-echo-interval", o_int, &lcp_echo_interval,
+       "Set time in seconds between LCP echo requests", OPT_PRIO },
++    { "lcp-echo-adaptive", o_bool, &lcp_echo_adaptive,
++      "Suppress LCP echo requests if traffic was received", 1 },
+     { "lcp-restart", o_int, &lcp_fsm[0].timeouttime,
+       "Set time in seconds between LCP retransmissions", OPT_PRIO },
+     { "lcp-max-terminate", o_int, &lcp_fsm[0].maxtermtransmits,
+@@ -2322,6 +2325,22 @@
+     }
+ 
+     /*
++     * If adaptive echos have been enabled, only send the echo request if
++     * no traffic was received since the last one.
++     */
++    if (lcp_echo_adaptive) {
++       static unsigned int last_pkts_in = 0;
++
++       update_link_stats(f->unit);
++       link_stats_valid = 0;
++
++       if (link_stats.pkts_in != last_pkts_in) {
++           last_pkts_in = link_stats.pkts_in;
++           return;
++       }
++    }
++
++    /*
+      * Make and send the echo request frame.
+      */
+     if (f->state == OPENED) {
+--- ppp-2.4.5/pppd/pppd.8
++++ ppp-2.4.5/pppd/pppd.8
+@@ -549,6 +549,11 @@
+ dynamic IP address option (i.e. set /proc/sys/net/ipv4/ip_dynaddr to
+ 1) in demand mode if the local address changes.
+ .TP
++.B lcp\-echo\-adaptive
++If this option is used with the \fIlcp\-echo\-failure\fR option then
++pppd will send LCP echo\-request frames only if no traffic was received
++from the peer since the last echo\-request was sent.
++.TP
+ .B lcp\-echo\-failure \fIn
+ If this option is given, pppd will presume the peer to be dead
+ if \fIn\fR LCP echo\-requests are sent without receiving a valid LCP
diff --git a/user/ppp/50_all_linux-headers.patch b/user/ppp/50_all_linux-headers.patch
new file mode 100644
index 000000000..cd2adbead
--- /dev/null
+++ b/user/ppp/50_all_linux-headers.patch
@@ -0,0 +1,28 @@
+the linux headers have started adding shims to not define types or structs
+when C lib headers are active, but in order to work, the C lib headers have
+to be included before the linux headers.
+
+move the netinet/in.h include up above the linux/ includes.
+
+Mike Frysinger <vapier@gentoo.org>
+
+--- a/pppd/plugins/rp-pppoe/pppoe.h
++++ b/pppd/plugins/rp-pppoe/pppoe.h
+@@ -47,6 +47,8 @@
+ #include <sys/socket.h>
+ #endif
+ 
++#include <netinet/in.h>
++
+ /* Ugly header files on some Linux boxes... */
+ #if defined(HAVE_LINUX_IF_H)
+ #include <linux/if.h>
+@@ -84,8 +86,6 @@ typedef unsigned long UINT32_t;
+ #include <linux/if_ether.h>
+ #endif
+ 
+-#include <netinet/in.h>
+-
+ #ifdef HAVE_NETINET_IF_ETHER_H
+ #include <sys/types.h>
+ 
diff --git a/user/ppp/51_all_glibc-2.28.patch b/user/ppp/51_all_glibc-2.28.patch
new file mode 100644
index 000000000..cbb5857a7
--- /dev/null
+++ b/user/ppp/51_all_glibc-2.28.patch
@@ -0,0 +1,110 @@
+From 3c7b86229f7bd2600d74db14b1fe5b3896be3875 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jaroslav=20=C5=A0karvada?= <jskarvad@redhat.com>
+Date: Fri, 6 Apr 2018 14:27:18 +0200
+Subject: [PATCH] pppd: Use openssl for the DES instead of the libcrypt / glibc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It seems the latest glibc (in Fedora glibc-2.27.9000-12.fc29) dropped
+libcrypt.  The libxcrypt standalone package can be used instead, but
+it dropped the old setkey/encrypt API which ppp uses for DES.  There
+is support for using openssl in pppcrypt.c, but it contains typos
+preventing it from compiling and seems to be written for an ancient
+openssl version.
+
+This updates the code to use current openssl.
+
+[paulus@ozlabs.org - wrote the commit description, fixed comment in
+ Makefile.linux.]
+
+Signed-off-by: Jaroslav Škarvada <jskarvad@redhat.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/Makefile.linux |  7 ++++---
+ pppd/pppcrypt.c     | 18 +++++++++---------
+ 2 files changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux
+index 36d2b036..8d5ce99d 100644
+--- a/pppd/Makefile.linux
++++ b/pppd/Makefile.linux
+@@ -35,10 +35,10 @@ endif
+ COPTS = -O2 -pipe -Wall -g
+ LIBS =
+ 
+-# Uncomment the next 2 lines to include support for Microsoft's
++# Uncomment the next line to include support for Microsoft's
+ # MS-CHAP authentication protocol.  Also, edit plugins/radius/Makefile.linux.
+ CHAPMS=y
+-USE_CRYPT=y
++#USE_CRYPT=y
+ # Don't use MSLANMAN unless you really know what you're doing.
+ #MSLANMAN=y
+ # Uncomment the next line to include support for MPPE.  CHAPMS (above) must
+@@ -137,7 +137,8 @@ endif
+ 
+ ifdef NEEDDES
+ ifndef USE_CRYPT
+-LIBS     += -ldes $(LIBS)
++CFLAGS   += -I/usr/include/openssl
++LIBS     += -lcrypto
+ else
+ CFLAGS   += -DUSE_CRYPT=1
+ endif
+diff --git a/pppd/pppcrypt.c b/pppd/pppcrypt.c
+index 8b85b132..6b35375e 100644
+--- a/pppd/pppcrypt.c
++++ b/pppd/pppcrypt.c
+@@ -64,7 +64,7 @@ u_char *des_key;	/* OUT 64 bit DES key with parity bits added */
+ 	des_key[7] = Get7Bits(key, 49);
+ 
+ #ifndef USE_CRYPT
+-	des_set_odd_parity((des_cblock *)des_key);
++	DES_set_odd_parity((DES_cblock *)des_key);
+ #endif
+ }
+ 
+@@ -158,25 +158,25 @@ u_char *clear;	/* OUT 8 octets */
+ }
+ 
+ #else /* USE_CRYPT */
+-static des_key_schedule	key_schedule;
++static DES_key_schedule	key_schedule;
+ 
+ bool
+ DesSetkey(key)
+ u_char *key;
+ {
+-	des_cblock des_key;
++	DES_cblock des_key;
+ 	MakeKey(key, des_key);
+-	des_set_key(&des_key, key_schedule);
++	DES_set_key(&des_key, &key_schedule);
+ 	return (1);
+ }
+ 
+ bool
+-DesEncrypt(clear, key, cipher)
++DesEncrypt(clear, cipher)
+ u_char *clear;	/* IN  8 octets */
+ u_char *cipher;	/* OUT 8 octets */
+ {
+-	des_ecb_encrypt((des_cblock *)clear, (des_cblock *)cipher,
+-	    key_schedule, 1);
++	DES_ecb_encrypt((DES_cblock *)clear, (DES_cblock *)cipher,
++	    &key_schedule, 1);
+ 	return (1);
+ }
+ 
+@@ -185,8 +185,8 @@ DesDecrypt(cipher, clear)
+ u_char *cipher;	/* IN  8 octets */
+ u_char *clear;	/* OUT 8 octets */
+ {
+-	des_ecb_encrypt((des_cblock *)cipher, (des_cblock *)clear,
+-	    key_schedule, 0);
++	DES_ecb_encrypt((DES_cblock *)cipher, (DES_cblock *)clear,
++	    &key_schedule, 0);
+ 	return (1);
+ }
+ 
diff --git a/user/ppp/80_all_eaptls-mppe-1.101a.patch b/user/ppp/80_all_eaptls-mppe-1.101a.patch
new file mode 100644
index 000000000..f22b63a86
--- /dev/null
+++ b/user/ppp/80_all_eaptls-mppe-1.101a.patch
@@ -0,0 +1,3233 @@
+diff -Naur ppp-2.4.7/README.eap-tls ppp-2.4.7-eaptls-mppe-1.101b/README.eap-tls
+--- ppp-2.4.7/README.eap-tls	1970-01-01 01:00:00.000000000 +0100
++++ ppp-2.4.7-eaptls-mppe-1.101b/README.eap-tls	2018-06-02 01:42:04.021165440 +0200
+@@ -0,0 +1,286 @@
++EAP-TLS authentication support for PPP
++======================================
++
++1. Intro
++
++    The Extensible Authentication Protocol (EAP; RFC 3748) is a
++    security protocol that can be used with PPP.  It provides a means
++    to plug in multiple optional authentication methods.
++
++    Transport Level Security (TLS; RFC 2246) provides for mutual 
++    authentication, integrity-protected ciphersuite negotiation and 
++    key exchange between two endpoints.  It also provides for optional
++    MPPE encryption.
++
++    EAP-TLS (RFC 2716) incapsulates the TLS messages in EAP packets,
++    allowing TLS mutual authentication to be used as a generic EAP
++    mechanism. It also provides optional encryption using the MPPE
++    protocol.
++
++    This patch provide EAP-TLS support to pppd.
++    This authentication method can be used in both client or server
++    mode.
++
++2. Building
++
++    To build pppd with EAP-TLS support, OpenSSL (http://www.openssl.org)
++    is required. Any version from 0.9.7 should work.
++    
++    Configure, compile, and install as usual. 
++
++3. Configuration
++
++    On the client side there are two ways to configure EAP-TLS:
++
++    1. supply the appropriate 'ca', 'cert' and 'key' command-line parameters
++
++    2. edit the /etc/ppp/eaptls-client file.
++    Insert a line for each system with which you use EAP-TLS.
++    The line is composed of this fields separated by tab:
++
++      - Client name 
++        The name used by the client for authentication, can be *
++      - Server name
++        The name of the server, can be *
++      - Client certificate file 
++        The file containing the certificate chain for the 
++        client in PEM format
++      - Server certificate file
++        If you want to specify the certificate that the 
++        server is allowed to use, put the certificate file name.
++        Else put a dash '-'.
++      - CA certificate file
++        The file containing the trusted CA certificates in PEM
++        format.
++      - Client private key file
++        The file containing the client private key in PEM format.
++
++
++    On the server side edit the /etc/ppp/eaptls-server file.
++    Insert a line for each system with which you use EAP-TLS.
++    The line is composed of this fields separated by tab:
++
++      - Client name
++        The name used by the client for authentication, can be *
++      - Server name
++        The name of the server, can be *
++      - Client certificate file
++        If you want to specify the certificate that the
++        client is allowed to use, put the certificate file name.
++        Else put a dash '-'.
++      - Server certificate file
++        The file containing the certificate chain for the
++        server in PEM format
++      - CA certificate file
++        The file containing the trusted CA certificates in PEM format.
++      - Client private key file
++        The file containing the server private key in PEM format.
++      - addresses
++        A list of IP addresses the client is allowed to use.
++
++
++    OpenSSL engine support is included starting with v0.95 of this patch. 
++    Currently the only engine tested is the 'pkcs11' engine (hardware token
++    support). To use the 'pksc11' engine:
++      - Use a special private key fileiname in the /etc/ppp/eaptls-client file:
++          <engine>:<identifier>
++        e.g.
++          pkcs11:123456
++
++      - The certificate can also be loaded from the 'pkcs11' engine using
++        a special client certificate filename in the /etc/ppp/eaptls-client file:
++          <engine>:<identifier>
++        e.g.
++          pkcs11:123456
++
++      - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior
++        to starting 'pppd'. A sample openssl.cnf file is
++
++        openssl_conf = openssl_def
++
++        [ openssl_def ]
++        engines = engine_section
++
++        [ engine_section ]
++        pkcs11 = pkcs11_section
++
++        [ pkcs11_section ]
++        engine_id = pkcs11
++        dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so
++        MODULE_PATH = /usr/lib64/libeTPkcs11.so
++        init = 0
++
++      - There are two ways to specify a password/PIN for the PKCS11 engine:
++          - inside the openssl.cnf file using
++              PIN = your-secret-pin
++            Note The keyword 'PIN' is case sensitive!
++          - Using the 'password' in the ppp options file.
++        From v0.97 of the eap-tls patch the password can also be supplied
++        using the appropriate 'eaptls_passwd_hook' (see plugins/passprompt.c
++        for an example).
++
++
++4. Options
++
++    These pppd options are available:
++
++      ca <ca-file>
++        Use the CA public certificate found in <ca-file> in PEM format
++      cert <cert-file>
++        Use the client public certificate found in <cert-file> in PEM format
++        or in engine:engine_id format
++      key <key-file>
++        Use the client private key found in <key-file> in PEM format
++        or in engine:engine_id format
++      crl <crl-file>
++        Use the Certificate Revocation List (CRL) file <crl-file> in PEM format.
++      crl-dir <dir>
++        Use CRL files from directory <dir>. It contains CRL files in PEM
++        format and each file contains a CRL. The files are looked up 
++        by the issuer name hash value. Use the c_rehash utility 
++        to create necessary links.
++      need-peer-eap
++        If the peer doesn't ask us to authenticate or doesn't use eap
++        to authenticate us, disconnect.
++
++    Note: 
++      password-encrypted certificates can be used as of v0.94 of this 
++      patch. The password for the eap-tls.key file is specified using 
++      the regular
++          password ....
++      statement in the ppp options file, or by using the appropriate
++      plugin which supplies a 'eaptls_passwd_hook' routine.
++
++5. Connecting
++
++    If you're setting up a pppd server, edit the EAP-TLS configuration file 
++    as written above and then run pppd with the 'auth' option to authenticate
++    the client. The EAP-TLS method will be used if the other eap methods can't
++    be used (no secrets).
++
++    If you're setting up a client, edit the configuration file and then run
++    pppd with 'remotename' option to specify the server name. Add the 
++    'need-peer-eap' option if you want to be sure the peer ask you to
++    authenticate (and to use eap) and to disconnect if it doesn't.
++
++6. Example
++
++    The following example can be used to connect a Linux client with the 'pptp'
++    package to a Linux server running the 'pptpd' (PoPToP) package. The server
++    was configured with a certificate with name (CN) 'pptp-server', the client
++    was configured with a certificate with name (CN) 'pptp-client', both 
++    signed by the same Certificate Authority (CA).
++
++    Server side:
++      - /etc/pptpd.conf file:
++          option /etc/ppp/options-pptpd-eaptls
++          localip 172.16.1.1
++          remoteip 172.16.1.10-20 
++      - /etc/ppp/options-pptpd-eaptls file:
++          name pptp-server
++          lock 
++          mtu 1500 
++          mru 1450
++          auth 
++          lcp-echo-failure 3 
++          lcp-echo-interval 5 
++          nodeflate 
++          nobsdcomp
++          nopredictor1
++          nopcomp
++          noaccomp
++          
++          require-eap
++          require-mppe-128
++          
++          crl /home/janjust/ppp/keys/crl.pem
++          
++          debug
++          logfile /tmp/pppd.log
++
++      - /etc/ppp/eaptls-server file:
++           * pptp-server - /etc/ppp/pptp-server.crt /etc/ppp/ca.crt /etc/ppp/pptp-server.key *
++
++      - On the server, run 
++          pptdp --conf /etc/pptpd.conf
++       
++    Client side:
++      - Run
++          pppd noauth require-eap require-mppe-128 \
++            ipcp-accept-local ipcp-accept-remote noipdefault \
++            cert  /etc/ppp/keys/pptp-client.crt \
++            key   /etc/ppp/keys/pptp-client.key \
++            ca    /etc/ppp/keys/ca.crt \
++            name pptp-client remotename pptp-server \
++            debug logfile /tmp/pppd.log
++            pty "pptp pptp-server.example.com --nolaunchpppd"
++
++    Check /var/log/messages and the files /tmp/pppd.log on both sides for debugging info.
++
++7. Notes
++
++    This is experimental code.
++    Send suggestions and comments to Jan Just Keijser <janjust@nikhef.nl>
++
++8. Changelog of ppp-<>-eaptls-mppe-* patches
++
++v0.7     (22-Nov-2005)
++ - First version of the patch to include MPPE support
++ - ppp-2.4.3 only
++v0.9     (25-Jul-2006)
++ - Bug fixes
++ - First version for ppp-2.4.4
++v0.91    (03-Sep-2006)
++ - Added missing #include for md5.h
++ - Last version for ppp-2.4.3
++v0.92    (22-Apr-2008)
++ - Fix for openssl 0.9.8 issue with md5 function overload.
++v0.93    (14-Aug-2008)
++ - Make sure 'noauth' option can be used to bypass server certificate verification.
++v0.94    (15-Oct-2008)
++ - Added support for password-protected private keys by (ab)using the 'password' field. 
++v0.95    (23-Dec-2009)
++ - First version with OpenSSL engine support.
++v0.96    (27-Jan-2010)
++ - Added fully functional support for OpenSSL engines (PKCS#11)
++ - First version for ppp-2.4.5
++v0.97    (20-Apr-2010)
++ - Some bug fixes for v0.96
++ - Added support for entering the password via a plugin. The sample plugin 
++     .../pppd/plugins/passprompt.c has been extended with EAP-TLS support.
++   The "old" methods using the password option or the /etc/ppp/openssl.cnf file still work.
++ - Added support for specifying the client CA, certificate and private key on the command-line
++   or via the ppp config file.
++v0.98    (20-Apr-2010)
++ - Fix initialisation bug when using ca/cert/key command-line options.
++ - Last version for ppp-2.4.4
++v0.99    (05-Oct-2010)
++ - Fix coredump when using multilink option.
++v0.991   (08-Aug-2011)
++ - Fix compilation issue with openssl 1.0.
++v0.992   (01-Dec-2011)
++ - Fix compilation issue with eaptls_check_hook and passwordfd plugin.
++v0.993   (24-Apr-2012)
++ - Fix compilation issue when EAP_TLS=n in pppd/Makefile.
++v0.994   (11-Jun-2012)
++ - Fix compilation issue on Ubuntu 11.10.
++v0.995   (27-May-2014)
++ - Add support for a CRL file using the command-line option 'crl' 
++   (prior only 'crl-dir' was supported).
++ - Fix segfault when pkcs11 enginename was not specified correctly.
++ - Fix segfault when client was misconfigured.
++ - Disable SSL Session Ticket support as Windows 8 does not support this.
++v0.996   (28-May-2014)
++ - Fix minor bug where SessionTicket message was printed as 'Unknown SSL3 code 4'
++ - Add EAP-TLS-specific options to pppd.8 manual page.
++ - Updated README.eap-tls file with new options and provide an example.
++v0.997   (19-Jun-2014)
++ - Change SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET
++ - Fix bug in initialisation code with fragmented packets.
++v0.998   (13-Mar-2015)
++ - Added fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620
++v0.999   (11-May-2017)
++ - Added support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x.
++v1.101 (1-Jun-2018)
++ - Fix vulnerabilities CVE-2018-11574.
++
+diff -Naur ppp-2.4.7/etc.ppp/eaptls-client ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-client
+--- ppp-2.4.7/etc.ppp/eaptls-client	1970-01-01 01:00:00.000000000 +0100
++++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-client	2018-06-02 01:42:04.021165440 +0200
+@@ -0,0 +1,10 @@
++# Parameters for authentication using EAP-TLS (client)
++
++# client name (can be *)
++# server name (can be *)
++# client certificate file (required)
++# server certificate file (optional, if unused put '-')
++# CA certificate file (required)
++# client private key file (required)
++
++#client	server	/root/cert/client.crt	-	/root/cert/ca.crt	/root/cert/client.key
+diff -Naur ppp-2.4.7/etc.ppp/eaptls-server ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-server
+--- ppp-2.4.7/etc.ppp/eaptls-server	1970-01-01 01:00:00.000000000 +0100
++++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/eaptls-server	2018-06-02 01:42:04.021165440 +0200
+@@ -0,0 +1,11 @@
++# Parameters for authentication using EAP-TLS (server)
++
++# client name (can be *)
++# server name (can be *)
++# client certificate file (optional, if unused put '-')
++# server certificate file (required)
++# CA certificate file (required)
++# server private key file (required)
++# allowed addresses (required, can be *)
++
++#client	server	-	/root/cert/server.crt	/root/cert/ca.crt	/root/cert/server.key	192.168.1.0/24
+diff -Naur ppp-2.4.7/etc.ppp/openssl.cnf ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/openssl.cnf
+--- ppp-2.4.7/etc.ppp/openssl.cnf	1970-01-01 01:00:00.000000000 +0100
++++ ppp-2.4.7-eaptls-mppe-1.101b/etc.ppp/openssl.cnf	2018-06-02 01:42:04.021165440 +0200
+@@ -0,0 +1,14 @@
++openssl_conf = openssl_def
++
++[ openssl_def ]
++engines = engine_section
++
++[ engine_section ]
++pkcs11 = pkcs11_section
++
++[ pkcs11_section ]
++engine_id = pkcs11
++dynamic_path = /usr/lib64/openssl/engines/engine_pkcs11.so
++MODULE_PATH = /usr/lib64/libeTPkcs11.so
++init = 0
++
+diff -Naur ppp-2.4.7/linux/Makefile.top ppp-2.4.7-eaptls-mppe-1.101b/linux/Makefile.top
+--- ppp-2.4.7/linux/Makefile.top	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/linux/Makefile.top	2018-06-02 01:42:04.021165440 +0200
+@@ -26,7 +26,7 @@
+ 	cd pppdump; $(MAKE) $(MFLAGS) install
+ 
+ install-etcppp: $(ETCDIR) $(ETCDIR)/options $(ETCDIR)/pap-secrets \
+-	$(ETCDIR)/chap-secrets
++	$(ETCDIR)/chap-secrets $(ETCDIR)/eaptls-server $(ETCDIR)/eaptls-client
+ 
+ install-devel:
+ 	cd pppd; $(MAKE) $(MFLAGS) install-devel
+@@ -37,6 +37,10 @@
+ 	$(INSTALL) -c -m 600 etc.ppp/pap-secrets $@
+ $(ETCDIR)/chap-secrets:
+ 	$(INSTALL) -c -m 600 etc.ppp/chap-secrets $@
++$(ETCDIR)/eaptls-server:
++	$(INSTALL) -c -m 600 etc.ppp/eaptls-server $@
++$(ETCDIR)/eaptls-client:
++	$(INSTALL) -c -m 600 etc.ppp/eaptls-client $@
+ 
+ $(BINDIR):
+ 	$(INSTALL) -d -m 755 $@
+diff -Naur ppp-2.4.7/pppd/Makefile.linux ppp-2.4.7-eaptls-mppe-1.101b/pppd/Makefile.linux
+--- ppp-2.4.7/pppd/Makefile.linux	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/Makefile.linux	2018-06-02 01:42:04.021165440 +0200
+@@ -76,6 +76,9 @@
+ # Use libutil
+ USE_LIBUTIL=y
+ 
++# Enable EAP-TLS authentication (requires libssl and libcrypto)
++USE_EAPTLS=y
++
+ MAXOCTETS=y
+ 
+ INCLUDE_DIRS= -I../include
+@@ -115,6 +118,15 @@
+ PPPDOBJS += sha1.o
+ endif
+ 
++# EAP-TLS
++ifdef USE_EAPTLS
++CFLAGS += -DUSE_EAPTLS=1 -I/usr/kerberos/include
++LIBS += -lssl -lcrypto
++PPPDSRC += eap-tls.c
++HEADERS += eap-tls.h
++PPPDOBJS += eap-tls.o
++endif
++
+ ifdef HAS_SHADOW
+ CFLAGS   += -DHAS_SHADOW
+ #LIBS     += -lshadow $(LIBS)
+diff -Naur ppp-2.4.7/pppd/auth.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/auth.c
+--- ppp-2.4.7/pppd/auth.c	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/auth.c	2018-06-02 01:42:04.022165436 +0200
+@@ -109,6 +109,9 @@
+ #include "upap.h"
+ #include "chap-new.h"
+ #include "eap.h"
++#ifdef USE_EAPTLS
++#include "eap-tls.h"
++#endif
+ #ifdef CBCP_SUPPORT
+ #include "cbcp.h"
+ #endif
+@@ -183,6 +186,11 @@
+ /* Hook for a plugin to get the CHAP password for authenticating us */
+ int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL;
+ 
++#ifdef USE_EAPTLS
++/* Hook for a plugin to get the EAP-TLS password for authenticating us */
++int (*eaptls_passwd_hook) __P((char *user, char *passwd)) = NULL;
++#endif
++
+ /* Hook for a plugin to say whether it is OK if the peer
+    refuses to authenticate. */
+ int (*null_auth_hook) __P((struct wordlist **paddrs,
+@@ -238,6 +246,14 @@
+ bool explicit_user = 0;		/* Set if "user" option supplied */
+ bool explicit_passwd = 0;	/* Set if "password" option supplied */
+ char remote_name[MAXNAMELEN];	/* Peer's name for authentication */
++#ifdef USE_EAPTLS
++char *cacert_file  = NULL;	/* CA certificate file (pem format) */
++char *cert_file    = NULL;	/* client certificate file (pem format) */
++char *privkey_file = NULL;	/* client private key file (pem format) */
++char *crl_dir      = NULL;	/* directory containing CRL files */
++char *crl_file     = NULL;	/* Certificate Revocation List (CRL) file (pem format) */
++bool need_peer_eap = 0;			/* Require peer to authenticate us */
++#endif
+ 
+ static char *uafname;		/* name of most recent +ua file */
+ 
+@@ -254,6 +270,19 @@
+ static int  have_chap_secret __P((char *, char *, int, int *));
+ static int  have_srp_secret __P((char *client, char *server, int need_ip,
+     int *lacks_ipp));
++
++#ifdef USE_EAPTLS
++static int  have_eaptls_secret_server
++__P((char *client, char *server, int need_ip, int *lacks_ipp));
++static int  have_eaptls_secret_client __P((char *client, char *server));
++static int  scan_authfile_eaptls __P((FILE * f, char *client, char *server,
++			       char *cli_cert, char *serv_cert,
++			       char *ca_cert, char *pk,
++			       struct wordlist ** addrs,
++			       struct wordlist ** opts,
++			       char *filename, int flags));
++#endif
++
+ static int  ip_addr_check __P((u_int32_t, struct permitted_ip *));
+ static int  scan_authfile __P((FILE *, char *, char *, char *,
+ 			       struct wordlist **, struct wordlist **,
+@@ -401,6 +430,15 @@
+       "Set telephone number(s) which are allowed to connect",
+       OPT_PRIV | OPT_A2LIST },
+ 
++#ifdef USE_EAPTLS
++    { "ca", o_string, &cacert_file,   "EAP-TLS CA certificate in PEM format" },
++    { "cert", o_string, &cert_file,   "EAP-TLS client certificate in PEM format" },
++    { "key", o_string, &privkey_file, "EAP-TLS client private key in PEM format" },
++    { "crl-dir", o_string, &crl_dir,  "Use CRLs in directory" },
++    { "crl", o_string, &crl_file,     "Use specific CRL file" },
++    { "need-peer-eap", o_bool, &need_peer_eap,
++      "Require the peer to authenticate us", 1 },
++#endif /* USE_EAPTLS */
+     { NULL }
+ };
+ 
+@@ -730,6 +768,9 @@
+     lcp_options *wo = &lcp_wantoptions[unit];
+     lcp_options *go = &lcp_gotoptions[unit];
+     lcp_options *ho = &lcp_hisoptions[unit];
++#ifdef USE_EAPTLS
++    lcp_options *ao = &lcp_allowoptions[unit];
++#endif
+     int i;
+     struct protent *protp;
+ 
+@@ -764,6 +805,22 @@
+ 	}
+     }
+ 
++#ifdef USE_EAPTLS
++    if (need_peer_eap && !ao->neg_eap) {
++	warn("eap required to authenticate us but no suitable secrets");
++	lcp_close(unit, "couldn't negotiate eap");
++	status = EXIT_AUTH_TOPEER_FAILED;
++	return;
++    }
++
++    if (need_peer_eap && !ho->neg_eap) {
++	warn("peer doesn't want to authenticate us with eap");
++	lcp_close(unit, "couldn't negotiate eap");
++	status = EXIT_PEER_AUTH_FAILED;
++	return;
++    }
++#endif
++
+     new_phase(PHASE_AUTHENTICATE);
+     auth = 0;
+     if (go->neg_eap) {
+@@ -1277,6 +1334,15 @@
+ 				    our_name, 1, &lacks_ip);
+     }
+ 
++#ifdef USE_EAPTLS
++    if (!can_auth && wo->neg_eap) {
++	can_auth =
++	    have_eaptls_secret_server((explicit_remote ? remote_name :
++				       NULL), our_name, 1, &lacks_ip);
++
++    }
++#endif
++
+     if (auth_required && !can_auth && noauth_addrs == NULL) {
+ 	if (default_auth) {
+ 	    option_error(
+@@ -1331,7 +1397,11 @@
+ 	passwd[0] != 0 ||
+ 	(hadchap == 1 || (hadchap == -1 && have_chap_secret(user,
+ 	    (explicit_remote? remote_name: NULL), 0, NULL))) ||
+-	have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL));
++	have_srp_secret(user, (explicit_remote? remote_name: NULL), 0, NULL)
++#ifdef USE_EAPTLS
++		|| have_eaptls_secret_client(user, (explicit_remote? remote_name: NULL))
++#endif
++	);
+ 
+     hadchap = -1;
+     if (go->neg_upap && !uselogin && !have_pap_secret(NULL))
+@@ -1346,8 +1416,14 @@
+ 	    !have_chap_secret((explicit_remote? remote_name: NULL), our_name,
+ 		1, NULL))) &&
+ 	!have_srp_secret((explicit_remote? remote_name: NULL), our_name, 1,
+-	    NULL))
++	    NULL)
++#ifdef USE_EAPTLS
++	 && !have_eaptls_secret_server((explicit_remote? remote_name: NULL),
++				   our_name, 1, NULL)
++#endif
++		)
+ 	go->neg_eap = 0;
++
+ }
+ 
+ 
+@@ -1707,6 +1783,7 @@
+ }
+ 
+ 
++
+ /*
+  * get_secret - open the CHAP secret file and return the secret
+  * for authenticating the given client on the given server.
+@@ -2359,3 +2436,335 @@
+ 
+     auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL, 0);
+ }
++
++
++#ifdef USE_EAPTLS
++static int
++have_eaptls_secret_server(client, server, need_ip, lacks_ipp)
++    char *client;
++    char *server;
++    int need_ip;
++    int *lacks_ipp;
++{
++    FILE *f;
++    int ret;
++    char *filename;
++    struct wordlist *addrs;
++    char servcertfile[MAXWORDLEN];
++    char clicertfile[MAXWORDLEN];
++    char cacertfile[MAXWORDLEN];
++    char pkfile[MAXWORDLEN];
++
++    filename = _PATH_EAPTLSSERVFILE;
++    f = fopen(filename, "r");
++    if (f == NULL)
++		return 0;
++
++    if (client != NULL && client[0] == 0)
++		client = NULL;
++    else if (server != NULL && server[0] == 0)
++		server = NULL;
++
++    ret =
++	scan_authfile_eaptls(f, client, server, clicertfile, servcertfile,
++			     cacertfile, pkfile, &addrs, NULL, filename,
++			     0);
++
++    fclose(f);
++
++/*
++    if (ret >= 0 && !eaptls_init_ssl(1, cacertfile, servcertfile,
++				clicertfile, pkfile))
++		ret = -1;
++*/
++
++	if (ret >= 0 && need_ip && !some_ip_ok(addrs)) {
++		if (lacks_ipp != 0)
++			*lacks_ipp = 1;
++		ret = -1;
++    }
++    if (addrs != 0)
++		free_wordlist(addrs);
++
++    return ret >= 0;
++}
++
++
++static int
++have_eaptls_secret_client(client, server)
++    char *client;
++    char *server;
++{
++    FILE *f;
++    int ret;
++    char *filename;
++    struct wordlist *addrs = NULL;
++    char servcertfile[MAXWORDLEN];
++    char clicertfile[MAXWORDLEN];
++    char cacertfile[MAXWORDLEN];
++    char pkfile[MAXWORDLEN];
++
++    if (client != NULL && client[0] == 0)
++		client = NULL;
++    else if (server != NULL && server[0] == 0)
++		server = NULL;
++
++	if (cacert_file && cert_file && privkey_file)
++		return 1;
++
++    filename = _PATH_EAPTLSCLIFILE;
++    f = fopen(filename, "r");
++    if (f == NULL)
++		return 0;
++
++    ret =
++	scan_authfile_eaptls(f, client, server, clicertfile, servcertfile,
++			     cacertfile, pkfile, &addrs, NULL, filename,
++			     0);
++    fclose(f);
++
++/*
++    if (ret >= 0 && !eaptls_init_ssl(0, cacertfile, clicertfile,
++				servcertfile, pkfile))
++		ret = -1;
++*/
++
++    if (addrs != 0)
++		free_wordlist(addrs);
++
++    return ret >= 0;
++}
++
++
++static int
++scan_authfile_eaptls(f, client, server, cli_cert, serv_cert, ca_cert, pk,
++		     addrs, opts, filename, flags)
++    FILE *f;
++    char *client;
++    char *server;
++    char *cli_cert;
++    char *serv_cert;
++    char *ca_cert;
++    char *pk;
++    struct wordlist **addrs;
++    struct wordlist **opts;
++    char *filename;
++    int flags;
++{
++    int newline;
++    int got_flag, best_flag;
++    struct wordlist *ap, *addr_list, *alist, **app;
++    char word[MAXWORDLEN];
++
++    if (addrs != NULL)
++	*addrs = NULL;
++    if (opts != NULL)
++	*opts = NULL;
++    addr_list = NULL;
++    if (!getword(f, word, &newline, filename))
++	return -1;		/* file is empty??? */
++    newline = 1;
++    best_flag = -1;
++    for (;;) {
++	/*
++	 * Skip until we find a word at the start of a line.
++	 */
++	while (!newline && getword(f, word, &newline, filename));
++	if (!newline)
++	    break;		/* got to end of file */
++
++	/*
++	 * Got a client - check if it's a match or a wildcard.
++	 */
++	got_flag = 0;
++	if (client != NULL && strcmp(word, client) != 0 && !ISWILD(word)) {
++	    newline = 0;
++	    continue;
++	}
++	if (!ISWILD(word))
++	    got_flag = NONWILD_CLIENT;
++
++	/*
++	 * Now get a server and check if it matches.
++	 */
++	if (!getword(f, word, &newline, filename))
++	    break;
++	if (newline)
++	    continue;
++	if (!ISWILD(word)) {
++	    if (server != NULL && strcmp(word, server) != 0)
++		continue;
++	    got_flag |= NONWILD_SERVER;
++	}
++
++	/*
++	 * Got some sort of a match - see if it's better than what
++	 * we have already.
++	 */
++	if (got_flag <= best_flag)
++	    continue;
++
++	/*
++	 * Get the cli_cert
++	 */
++	if (!getword(f, word, &newline, filename))
++	    break;
++	if (newline)
++	    continue;
++	if (strcmp(word, "-") != 0) {
++	    strlcpy(cli_cert, word, MAXWORDLEN);
++	} else
++	    cli_cert[0] = 0;
++
++	/*
++	 * Get serv_cert
++	 */
++	if (!getword(f, word, &newline, filename))
++	    break;
++	if (newline)
++	    continue;
++	if (strcmp(word, "-") != 0) {
++	    strlcpy(serv_cert, word, MAXWORDLEN);
++	} else
++	    serv_cert[0] = 0;
++
++	/*
++	 * Get ca_cert
++	 */
++	if (!getword(f, word, &newline, filename))
++	    break;
++	if (newline)
++	    continue;
++	strlcpy(ca_cert, word, MAXWORDLEN);
++
++	/*
++	 * Get pk
++	 */
++	if (!getword(f, word, &newline, filename))
++	    break;
++	if (newline)
++	    continue;
++	strlcpy(pk, word, MAXWORDLEN);
++
++
++	/*
++	 * Now read address authorization info and make a wordlist.
++	 */
++	app = &alist;
++	for (;;) {
++	    if (!getword(f, word, &newline, filename) || newline)
++		break;
++	    ap = (struct wordlist *)
++		malloc(sizeof(struct wordlist) + strlen(word) + 1);
++	    if (ap == NULL)
++		novm("authorized addresses");
++	    ap->word = (char *) (ap + 1);
++	    strcpy(ap->word, word);
++	    *app = ap;
++	    app = &ap->next;
++	}
++	*app = NULL;
++	/*
++	 * This is the best so far; remember it.
++	 */
++	best_flag = got_flag;
++	if (addr_list)
++	    free_wordlist(addr_list);
++	addr_list = alist;
++
++	if (!newline)
++	    break;
++    }
++
++    /* scan for a -- word indicating the start of options */
++    for (app = &addr_list; (ap = *app) != NULL; app = &ap->next)
++	if (strcmp(ap->word, "--") == 0)
++	    break;
++    /* ap = start of options */
++    if (ap != NULL) {
++	ap = ap->next;		/* first option */
++	free(*app);		/* free the "--" word */
++	*app = NULL;		/* terminate addr list */
++    }
++    if (opts != NULL)
++	*opts = ap;
++    else if (ap != NULL)
++	free_wordlist(ap);
++    if (addrs != NULL)
++	*addrs = addr_list;
++    else if (addr_list != NULL)
++	free_wordlist(addr_list);
++
++    return best_flag;
++}
++
++
++int
++get_eaptls_secret(unit, client, server, clicertfile, servcertfile,
++		  cacertfile, pkfile, am_server)
++    int unit;
++    char *client;
++    char *server;
++    char *clicertfile;
++    char *servcertfile;
++    char *cacertfile;
++    char *pkfile;
++    int am_server;
++{
++    FILE *fp;
++    int ret;
++    char *filename         = NULL;
++    struct wordlist *addrs = NULL;
++    struct wordlist *opts  = NULL;
++
++	/* in client mode the ca+cert+privkey can also be specified as options */
++	if (!am_server && cacert_file && cert_file && privkey_file )
++	{
++		strlcpy( clicertfile, cert_file, MAXWORDLEN );
++		strlcpy( cacertfile, cacert_file, MAXWORDLEN );
++		strlcpy( pkfile, privkey_file, MAXWORDLEN );
++		servcertfile[0] = '\0';
++	}
++	else
++	{
++		filename = (am_server ? _PATH_EAPTLSSERVFILE : _PATH_EAPTLSCLIFILE);
++		addrs = NULL;
++
++		fp = fopen(filename, "r");
++		if (fp == NULL)
++		{
++			error("Can't open eap-tls secret file %s: %m", filename);
++			return 0;
++   	 	}
++
++		check_access(fp, filename);
++
++		ret = scan_authfile_eaptls(fp, client, server, clicertfile, servcertfile,
++				cacertfile, pkfile, &addrs, &opts, filename, 0);
++
++		fclose(fp);
++
++		if (ret < 0) return 0;
++	}
++
++    if (eaptls_passwd_hook)
++    {
++		dbglog( "Calling eaptls password hook" );
++		if ( (*eaptls_passwd_hook)(pkfile, passwd) < 0)
++		{
++	   		 error("Unable to obtain EAP-TLS password for %s (%s) from plugin", 
++				client, pkfile);
++		    return 0;
++		}
++	}
++    if (am_server)
++		set_allowed_addrs(unit, addrs, opts);
++    else if (opts != NULL)
++		free_wordlist(opts);
++    if (addrs != NULL)
++		free_wordlist(addrs);
++
++    return 1;
++}
++#endif
++
+diff -Naur ppp-2.4.7/pppd/ccp.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/ccp.c
+--- ppp-2.4.7/pppd/ccp.c	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/ccp.c	2018-06-02 01:42:04.022165436 +0200
+@@ -540,6 +540,9 @@
+     if (go->mppe) {
+ 	ccp_options *ao = &ccp_allowoptions[f->unit];
+ 	int auth_mschap_bits = auth_done[f->unit];
++#ifdef USE_EAPTLS
++	int auth_eap_bits = auth_done[f->unit];
++#endif
+ 	int numbits;
+ 
+ 	/*
+@@ -567,8 +570,23 @@
+ 	    lcp_close(f->unit, "MPPE required but not available");
+ 	    return;
+ 	}
++
++#ifdef USE_EAPTLS
++    /*
++     * MPPE is also possible in combination with EAP-TLS.
++     * It is not possible to detect if we're doing EAP or EAP-TLS
++     * at this stage, hence we accept all forms of EAP. If TLS is
++     * not used then the MPPE keys will not be derived anyway.
++     */
++	/* Leave only the eap auth bits set */
++	auth_eap_bits &= (EAP_WITHPEER | EAP_PEER );
++
++	if ((numbits == 0) && (auth_eap_bits == 0)) {
++	    error("MPPE required, but MS-CHAP[v2] nor EAP-TLS auth are performed.");
++#else
+ 	if (!numbits) {
+-	    error("MPPE required, but MS-CHAP[v2] auth not performed.");
++		error("MPPE required, but MS-CHAP[v2] auth not performed.");
++#endif
+ 	    lcp_close(f->unit, "MPPE required but not available");
+ 	    return;
+ 	}
+diff -Naur ppp-2.4.7/pppd/chap-md5.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/chap-md5.c
+--- ppp-2.4.7/pppd/chap-md5.c	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/chap-md5.c	2018-06-02 01:42:04.022165436 +0200
+@@ -36,7 +36,11 @@
+ #include "chap-new.h"
+ #include "chap-md5.h"
+ #include "magic.h"
++#ifdef USE_EAPTLS
++#include "eap-tls.h"
++#else
+ #include "md5.h"
++#endif /* USE_EAPTLS */
+ 
+ #define MD5_HASH_SIZE		16
+ #define MD5_MIN_CHALLENGE	16
+diff -Naur ppp-2.4.7/pppd/eap-tls.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c
+--- ppp-2.4.7/pppd/eap-tls.c	1970-01-01 01:00:00.000000000 +0100
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.c	2018-06-02 01:42:16.790124406 +0200
+@@ -0,0 +1,1313 @@
++/*
++ * eap-tls.c - EAP-TLS implementation for PPP
++ *
++ * Copyright (c) Beniamino Galvani 2005 All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. The name(s) of the authors of this software must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission.
++ *
++ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
++ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
++ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
++ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
++ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
++ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ *
++ */
++
++#include <string.h>
++#include <unistd.h>
++#include <sys/types.h>
++#include <sys/stat.h>
++#include <fcntl.h>
++
++#include <openssl/conf.h>
++#include <openssl/engine.h>
++#include <openssl/hmac.h>
++#include <openssl/err.h>
++#include <openssl/x509v3.h>
++
++#include "pppd.h"
++#include "eap.h"
++#include "eap-tls.h"
++#include "fsm.h"
++#include "lcp.h"
++#include "pathnames.h"
++
++/* The openssl configuration file and engines can be loaded only once */
++static CONF   *ssl_config  = NULL;
++static ENGINE *cert_engine = NULL;
++static ENGINE *pkey_engine = NULL;
++
++#ifdef MPPE
++
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++
++/*
++ * https://wiki.openssl.org/index.php/1.1_API_Changes
++ * tries to provide some guidance but ultimately falls short.
++ */
++
++
++static void HMAC_CTX_free(HMAC_CTX *ctx)
++{
++	if (ctx != NULL) {
++		HMAC_CTX_cleanup(ctx);
++		OPENSSL_free(ctx);
++	}
++}
++
++static HMAC_CTX *HMAC_CTX_new(void)
++{
++	HMAC_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
++	if (ctx != NULL)
++		HMAC_CTX_init(ctx);
++	return ctx;
++}
++
++/*
++ * These were basically jacked directly from the OpenSSL tree
++ * without adjustments.
++ */
++
++static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out,
++				    size_t outlen)
++{
++	if (outlen == 0)
++		return sizeof(ssl->s3->client_random);
++	if (outlen > sizeof(ssl->s3->client_random))
++		outlen = sizeof(ssl->s3->client_random);
++	memcpy(out, ssl->s3->client_random, outlen);
++	return outlen;
++}
++
++static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out,
++				    size_t outlen)
++{
++	if (outlen == 0)
++		return sizeof(ssl->s3->server_random);
++	if (outlen > sizeof(ssl->s3->server_random))
++		outlen = sizeof(ssl->s3->server_random);
++	memcpy(out, ssl->s3->server_random, outlen);
++	return outlen;
++}
++
++static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
++				         unsigned char *out, size_t outlen)
++{
++	if (outlen == 0)
++		return session->master_key_length;
++	if (outlen > session->master_key_length)
++		outlen = session->master_key_length;
++	memcpy(out, session->master_key, outlen);
++	return outlen;
++}
++
++/* Avoid a deprecated warning in OpenSSL 1.1 whilst still allowing to build against 1.0.x */
++#define TLS_method           TLSv1_method
++
++#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
++
++/*
++ * TLS PRF from RFC 2246
++ */
++static void P_hash(const EVP_MD *evp_md,
++		   const unsigned char *secret, unsigned int secret_len,
++		   const unsigned char *seed,   unsigned int seed_len,
++		   unsigned char *out, unsigned int out_len)
++{
++	HMAC_CTX *ctx_a, *ctx_out;
++	unsigned char a[HMAC_MAX_MD_CBLOCK];
++	unsigned int size;
++
++	ctx_a = HMAC_CTX_new();
++	ctx_out = HMAC_CTX_new();
++	HMAC_Init_ex(ctx_a, secret, secret_len, evp_md, NULL);
++	HMAC_Init_ex(ctx_out, secret, secret_len, evp_md, NULL);
++
++	size = HMAC_size(ctx_out);
++
++	/* Calculate A(1) */
++	HMAC_Update(ctx_a, seed, seed_len);
++	HMAC_Final(ctx_a, a, NULL);
++
++	while (1) {
++		/* Calculate next part of output */
++		HMAC_Update(ctx_out, a, size);
++		HMAC_Update(ctx_out, seed, seed_len);
++
++		/* Check if last part */
++		if (out_len < size) {
++			HMAC_Final(ctx_out, a, NULL);
++			memcpy(out, a, out_len);
++			break;
++		}
++
++		/* Place digest in output buffer */
++		HMAC_Final(ctx_out, out, NULL);
++		HMAC_Init_ex(ctx_out, NULL, 0, NULL, NULL);
++		out += size;
++		out_len -= size;
++
++		/* Calculate next A(i) */
++		HMAC_Init_ex(ctx_a, NULL, 0, NULL, NULL);
++		HMAC_Update(ctx_a, a, size);
++		HMAC_Final(ctx_a, a, NULL);
++	}
++
++	HMAC_CTX_free(ctx_a);
++	HMAC_CTX_free(ctx_out);
++	memset(a, 0, sizeof(a));
++}
++
++static void PRF(const unsigned char *secret, unsigned int secret_len,
++		const unsigned char *seed,   unsigned int seed_len,
++		unsigned char *out, unsigned char *buf, unsigned int out_len)
++{
++        unsigned int i;
++        unsigned int len = (secret_len + 1) / 2;
++	const unsigned char *s1 = secret;
++	const unsigned char *s2 = secret + (secret_len - len);
++
++	P_hash(EVP_md5(),  s1, len, seed, seed_len, out, out_len);
++	P_hash(EVP_sha1(), s2, len, seed, seed_len, buf, out_len);
++
++	for (i=0; i < out_len; i++) {
++	        out[i] ^= buf[i];
++	}
++}
++
++#define EAPTLS_MPPE_KEY_LEN     32
++
++/*
++ *  Generate keys according to RFC 2716 and add to reply
++ */
++void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label,
++                          int client)
++{
++    unsigned char out[4*EAPTLS_MPPE_KEY_LEN], buf[4*EAPTLS_MPPE_KEY_LEN];
++    unsigned char seed[64 + 2*SSL3_RANDOM_SIZE];
++    unsigned char *p = seed;
++	SSL			  *s = ets->ssl;
++    size_t prf_size;
++    unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];
++    size_t master_key_length;
++
++    prf_size = strlen(prf_label);
++
++    memcpy(p, prf_label, prf_size);
++    p += prf_size;
++
++    prf_size += SSL_get_client_random(s, p, SSL3_RANDOM_SIZE);
++    p += SSL3_RANDOM_SIZE;
++
++    prf_size += SSL_get_server_random(s, p, SSL3_RANDOM_SIZE);
++
++    master_key_length = SSL_SESSION_get_master_key(SSL_get_session(s), master_key,
++						   sizeof(master_key));
++    PRF(master_key, master_key_length, seed, prf_size, out, buf, sizeof(out));
++
++    /* 
++     * We now have the master send and receive keys.
++     * From these, generate the session send and receive keys.
++     * (see RFC3079 / draft-ietf-pppext-mppe-keys-03.txt for details)
++     */
++    if (client)
++    {
++	    p = out;
++		BCOPY( p, mppe_send_key, sizeof(mppe_send_key) );
++		p += EAPTLS_MPPE_KEY_LEN;
++    	BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) );
++    }
++    else
++    {
++	    p = out;
++    	BCOPY( p, mppe_recv_key, sizeof(mppe_recv_key) );
++		p += EAPTLS_MPPE_KEY_LEN;
++		BCOPY( p, mppe_send_key, sizeof(mppe_send_key) );
++    }
++
++    mppe_keys_set = 1;
++}
++
++#endif
++
++void log_ssl_errors( void )
++{
++	unsigned long ssl_err = ERR_get_error();
++
++    if (ssl_err != 0)
++		dbglog("EAP-TLS SSL error stack:");
++	while (ssl_err != 0) {
++		dbglog( ERR_error_string( ssl_err, NULL ) );
++		ssl_err = ERR_get_error();
++	}
++}
++
++
++int password_callback (char *buf, int size, int rwflag, void *u)
++{
++	if (buf)
++	{
++		strncpy (buf, passwd, size);
++		return strlen (buf);
++	}
++	return 0;
++}
++
++
++CONF *eaptls_ssl_load_config( void )
++{
++    CONF        *config;
++    int          ret_code;
++    long         error_line = 33;
++
++    config = NCONF_new( NULL );
++	dbglog( "Loading OpenSSL config file" );
++    ret_code = NCONF_load( config, _PATH_OPENSSLCONFFILE, &error_line );
++    if (ret_code == 0)
++    {
++        warn( "EAP-TLS: Error in OpenSSL config file %s at line %d", _PATH_OPENSSLCONFFILE, error_line );
++        NCONF_free( config );
++        config = NULL;
++        ERR_clear_error();
++    }
++
++	dbglog( "Loading OpenSSL built-ins" );
++    ENGINE_load_builtin_engines();
++    OPENSSL_load_builtin_modules();
++   
++	dbglog( "Loading OpenSSL configured modules" );
++    if (CONF_modules_load( config, NULL, 0 ) <= 0 )
++    {
++        warn( "EAP-TLS: Error loading OpenSSL modules" );
++	    log_ssl_errors();
++        config = NULL;
++    }
++
++    return config;
++}
++
++ENGINE *eaptls_ssl_load_engine( char *engine_name )
++{
++	ENGINE      *e = NULL;
++
++	dbglog( "Enabling OpenSSL auto engines" );
++	ENGINE_register_all_complete();
++
++	dbglog( "Loading OpenSSL '%s' engine support", engine_name );
++	e = ENGINE_by_id( engine_name );
++    if (!e) 
++	{
++		dbglog( "EAP-TLS: Cannot load '%s' engine support, trying 'dynamic'", engine_name );
++		e = ENGINE_by_id( "dynamic" );
++		if (e)
++		{
++			if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine_name, 0)
++   	         || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0))
++			{
++				warn( "EAP-TLS: Error loading dynamic engine '%s'", engine_name );
++		        log_ssl_errors();
++				ENGINE_free(e);
++				e = NULL;
++			}
++		}
++		else
++		{
++			warn( "EAP-TLS: Cannot load dynamic engine support" );
++		}
++	}
++
++    if (e)
++	{
++		dbglog( "Initialising engine" );
++		if(!ENGINE_set_default(e, ENGINE_METHOD_ALL))
++		{
++			warn( "EAP-TLS: Cannot use that engine" );
++			log_ssl_errors();
++			ENGINE_free(e);
++			e = NULL;
++		}
++	}
++
++    return e;
++}
++
++/*
++ * Initialize the SSL stacks and tests if certificates, key and crl
++ * for client or server use can be loaded.
++ */
++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile,
++			char *certfile, char *peer_certfile, char *privkeyfile)
++{
++	char		*cert_engine_name = NULL;
++	char		*cert_identifier = NULL;
++	char		*pkey_engine_name = NULL;
++	char		*pkey_identifier = NULL;
++	SSL_CTX		*ctx;
++	X509_STORE	*certstore;
++	X509_LOOKUP	*lookup;
++	X509		*tmp;
++
++	/*
++	 * Without these can't continue 
++	 */
++	if (!cacertfile[0])
++    {
++		error("EAP-TLS: CA certificate missing");
++		return NULL;
++    }
++
++	if (!certfile[0])
++    {
++		error("EAP-TLS: User certificate missing");
++		return NULL;
++    }
++
++	if (!privkeyfile[0])
++    {
++		error("EAP-TLS: User private key missing");
++		return NULL;
++    }
++
++	SSL_library_init();
++	SSL_load_error_strings();
++
++	ctx = SSL_CTX_new(TLS_method());
++
++	if (!ctx) {
++		error("EAP-TLS: Cannot initialize SSL CTX context");
++		goto fail;
++	}
++
++	/* if the certificate filename is of the form engine:id. e.g.
++		pkcs11:12345
++	   then we try to load and use this engine.
++	   If the certificate filename starts with a / or . then we
++	   ALWAYS assume it is a file and not an engine/pkcs11 identifier
++	 */
++	if ( index( certfile, '/' ) == NULL && index( certfile, '.') == NULL )
++	{
++		cert_identifier = index( certfile, ':' );
++
++		if (cert_identifier)
++		{
++			cert_engine_name = certfile;
++			*cert_identifier = '\0';
++			cert_identifier++;
++
++			dbglog( "Found certificate engine '%s'", cert_engine_name );
++			dbglog( "Found certificate identifier '%s'", cert_identifier );
++		}
++	}
++
++	/* if the privatekey filename is of the form engine:id. e.g.
++		pkcs11:12345
++	   then we try to load and use this engine.
++	   If the privatekey filename starts with a / or . then we
++	   ALWAYS assume it is a file and not an engine/pkcs11 identifier
++	 */
++	if ( index( privkeyfile, '/' ) == NULL && index( privkeyfile, '.') == NULL )
++	{
++		pkey_identifier = index( privkeyfile, ':' );
++
++		if (pkey_identifier)
++		{
++			pkey_engine_name = privkeyfile;
++			*pkey_identifier = '\0';
++			pkey_identifier++;
++
++			dbglog( "Found privatekey engine '%s'", pkey_engine_name );
++			dbglog( "Found privatekey identifier '%s'", pkey_identifier );
++		}
++	}
++
++	if (cert_identifier && pkey_identifier)
++	{
++		if (strlen( cert_identifier ) == 0)
++		{
++			if (strlen( pkey_identifier ) == 0)
++				error( "EAP-TLS: both the certificate and privatekey identifiers are missing!" );
++			else
++			{
++				dbglog( "Substituting privatekey identifier for certificate identifier" );
++				cert_identifier = pkey_identifier;
++			}
++		}
++		else
++		{
++			if (strlen( pkey_identifier ) == 0)
++			{
++				dbglog( "Substituting certificate identifier for privatekey identifier" );
++				pkey_identifier = cert_identifier;
++			}
++		}
++
++	}
++
++	/* load the openssl config file only once */
++	if (!ssl_config)
++	{
++		if (cert_engine_name || pkey_engine_name)
++			ssl_config = eaptls_ssl_load_config();
++
++		if (ssl_config && cert_engine_name)
++			cert_engine = eaptls_ssl_load_engine( cert_engine_name );
++
++		if (ssl_config && pkey_engine_name)
++		{
++			/* don't load the same engine twice */
++			if ( cert_engine && strcmp( cert_engine_name, pkey_engine_name) == 0 )
++				pkey_engine = cert_engine;
++			else
++				pkey_engine = eaptls_ssl_load_engine( pkey_engine_name );
++		}
++	}
++
++    SSL_CTX_set_default_passwd_cb (ctx, password_callback);
++
++	if (!SSL_CTX_load_verify_locations(ctx, cacertfile, NULL))
++	{
++		error("EAP-TLS: Cannot load or verify CA file %s", cacertfile);
++		goto fail;
++	}
++
++    if (init_server)
++		SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(cacertfile));
++
++	if (cert_engine)
++	{
++		struct
++		{
++			const char *s_slot_cert_id;
++			X509 *cert;
++		} cert_info;
++
++		cert_info.s_slot_cert_id = cert_identifier;
++		cert_info.cert = NULL;
++		
++		if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) )
++		{
++			error( "EAP-TLS: Error loading certificate with id '%s' from engine", cert_identifier );
++			goto fail;
++		}
++
++		if (cert_info.cert)
++		{
++		    dbglog( "Got the certificate, adding it to SSL context" );
++			dbglog( "subject = %s", X509_NAME_oneline( X509_get_subject_name( cert_info.cert ), NULL, 0 ) );
++			if (SSL_CTX_use_certificate(ctx, cert_info.cert) <= 0)
++			{
++				error("EAP-TLS: Cannot use PKCS11 certificate %s", cert_identifier);
++				goto fail;
++			}
++		}
++		else
++		{
++			warn("EAP-TLS: Cannot load PKCS11 key %s", cert_identifier);
++			log_ssl_errors();
++		}
++	}
++	else
++	{
++		if (!SSL_CTX_use_certificate_file(ctx, certfile, SSL_FILETYPE_PEM))
++		{
++			error( "EAP-TLS: Cannot use public certificate %s", certfile );
++			goto fail;
++		}
++	}
++
++	if (pkey_engine)
++	{
++		EVP_PKEY   *pkey = NULL;
++		PW_CB_DATA  cb_data;
++
++		cb_data.password = passwd;
++		cb_data.prompt_info = pkey_identifier;
++
++		dbglog( "Loading private key '%s' from engine", pkey_identifier );
++		pkey = ENGINE_load_private_key(pkey_engine, pkey_identifier, NULL, &cb_data);
++		if (pkey)
++		{
++		    dbglog( "Got the private key, adding it to SSL context" );
++			if (SSL_CTX_use_PrivateKey(ctx, pkey) <= 0)
++			{
++				error("EAP-TLS: Cannot use PKCS11 key %s", pkey_identifier);
++				goto fail;
++			}
++		}
++		else
++		{
++			warn("EAP-TLS: Cannot load PKCS11 key %s", pkey_identifier);
++			log_ssl_errors();
++		}
++	}
++	else
++	{
++		if (!SSL_CTX_use_PrivateKey_file(ctx, privkeyfile, SSL_FILETYPE_PEM))
++		{ 
++			error("EAP-TLS: Cannot use private key %s", privkeyfile);
++			goto fail;
++		}
++	}
++
++	if (SSL_CTX_check_private_key(ctx) != 1) {
++		error("EAP-TLS: Private key %s fails security check", privkeyfile);
++		goto fail;
++	}
++
++    /* Explicitly set the NO_TICKETS flag to support Win7/Win8 clients */
++	SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3
++#ifdef SSL_OP_NO_TICKET
++    | SSL_OP_NO_TICKET
++#endif
++);
++	SSL_CTX_set_verify_depth(ctx, 5);
++	SSL_CTX_set_verify(ctx,
++			   SSL_VERIFY_PEER |
++			   SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
++			   &ssl_verify_callback);
++
++	if (crl_dir) {
++		if (!(certstore = SSL_CTX_get_cert_store(ctx))) {
++			error("EAP-TLS: Failed to get certificate store");
++			goto fail;
++		}
++
++		if (!(lookup =
++		     X509_STORE_add_lookup(certstore, X509_LOOKUP_hash_dir()))) {
++			error("EAP-TLS: Store lookup for CRL failed");
++
++			goto fail;
++		}
++
++		X509_LOOKUP_add_dir(lookup, crl_dir, X509_FILETYPE_PEM);
++		X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK);
++	}
++
++    if (crl_file) {
++        FILE     *fp  = NULL;
++        X509_CRL *crl = NULL;
++
++        fp = fopen(crl_file, "r");
++        if (!fp) {
++            error("EAP-TLS: Cannot open CRL file '%s'", crl_file);
++            goto fail;
++        }
++
++        crl = PEM_read_X509_CRL(fp, NULL, NULL, NULL);
++        if (!crl) {
++            error("EAP-TLS: Cannot read CRL file '%s'", crl_file);
++            goto fail;
++        }
++
++		if (!(certstore = SSL_CTX_get_cert_store(ctx))) {
++			error("EAP-TLS: Failed to get certificate store");
++			goto fail;
++		}
++        if (!X509_STORE_add_crl(certstore, crl)) {
++            error("EAP-TLS: Cannot add CRL to certificate store");
++            goto fail;
++        }
++		X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK);
++
++    }
++
++	/*
++	 * If a peer certificate file was specified, it must be valid, else fail 
++	 */
++	if (peer_certfile[0]) {
++		if (!(tmp = get_X509_from_file(peer_certfile))) {
++			error("EAP-TLS: Error loading client certificate from file %s",
++			     peer_certfile);
++			goto fail;
++		}
++		X509_free(tmp);
++	}
++
++	return ctx;
++
++fail:
++	log_ssl_errors();
++	SSL_CTX_free(ctx);
++	return NULL;
++}
++
++/*
++ * Determine the maximum packet size by looking at the LCP handshake
++ */
++
++int eaptls_get_mtu(int unit)
++{
++	int mtu, mru;
++
++	lcp_options *wo = &lcp_wantoptions[unit];
++	lcp_options *go = &lcp_gotoptions[unit];
++	lcp_options *ho = &lcp_hisoptions[unit];
++	lcp_options *ao = &lcp_allowoptions[unit];
++
++	mtu = ho->neg_mru? ho->mru: PPP_MRU;
++	mru = go->neg_mru? MAX(wo->mru, go->mru): PPP_MRU;
++    mtu = MIN(MIN(mtu, mru), ao->mru)- PPP_HDRLEN - 10;
++
++	dbglog("MTU = %d", mtu);
++ 	return mtu;
++}
++
++
++/*
++ * Init the ssl handshake (server mode)
++ */
++int eaptls_init_ssl_server(eap_state * esp)
++{
++	struct eaptls_session *ets;
++	char servcertfile[MAXWORDLEN];
++	char clicertfile[MAXWORDLEN];
++	char cacertfile[MAXWORDLEN];
++	char pkfile[MAXWORDLEN];
++	/*
++	 * Allocate new eaptls session 
++	 */
++	esp->es_server.ea_session = malloc(sizeof(struct eaptls_session));
++	if (!esp->es_server.ea_session)
++		fatal("Allocation error");
++	ets = esp->es_server.ea_session;
++
++	if (!esp->es_server.ea_peer) {
++		error("EAP-TLS: Error: client name not set (BUG)");
++		return 0;
++	}
++
++	strncpy(ets->peer, esp->es_server.ea_peer, MAXWORDLEN);
++
++	dbglog( "getting eaptls secret" );
++	if (!get_eaptls_secret(esp->es_unit, esp->es_server.ea_peer,
++			       esp->es_server.ea_name, clicertfile,
++			       servcertfile, cacertfile, pkfile, 1)) {
++		error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"",
++				esp->es_server.ea_peer, esp->es_server.ea_name );
++		return 0;
++	}
++
++	ets->mtu = eaptls_get_mtu(esp->es_unit);
++
++	ets->ctx = eaptls_init_ssl(1, cacertfile, servcertfile, clicertfile, pkfile);
++	if (!ets->ctx)
++		goto fail;
++
++	if (!(ets->ssl = SSL_new(ets->ctx)))
++		goto fail;
++
++	/*
++	 * Set auto-retry to avoid timeouts on BIO_read
++	 */
++	SSL_set_mode(ets->ssl, SSL_MODE_AUTO_RETRY);
++
++	/*
++	 * Initialize the BIOs we use to read/write to ssl engine 
++	 */
++	ets->into_ssl = BIO_new(BIO_s_mem());
++	ets->from_ssl = BIO_new(BIO_s_mem());
++	SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl);
++
++	SSL_set_msg_callback(ets->ssl, ssl_msg_callback);
++	SSL_set_msg_callback_arg(ets->ssl, ets);
++
++	/*
++	 * Attach the session struct to the connection, so we can later
++	 * retrieve it when doing certificate verification
++	 */
++	SSL_set_ex_data(ets->ssl, 0, ets);
++
++	SSL_set_accept_state(ets->ssl);
++
++	ets->data = NULL;
++	ets->datalen = 0;
++	ets->alert_sent = 0;
++	ets->alert_recv = 0;
++
++	/*
++	 * If we specified the client certificate file, store it in ets->peercertfile,
++	 * so we can check it later in ssl_verify_callback()
++	 */
++	if (clicertfile[0])
++		strncpy(&ets->peercertfile[0], clicertfile, MAXWORDLEN);
++	else
++		ets->peercertfile[0] = 0;
++
++	return 1;
++
++fail:
++	SSL_CTX_free(ets->ctx);
++	return 0;
++}
++
++/*
++ * Init the ssl handshake (client mode)
++ */
++int eaptls_init_ssl_client(eap_state * esp)
++{
++	struct eaptls_session *ets;
++	char servcertfile[MAXWORDLEN];
++	char clicertfile[MAXWORDLEN];
++	char cacertfile[MAXWORDLEN];
++	char pkfile[MAXWORDLEN];
++
++	/*
++	 * Allocate new eaptls session 
++	 */
++	esp->es_client.ea_session = malloc(sizeof(struct eaptls_session));
++	if (!esp->es_client.ea_session)
++		fatal("Allocation error");
++	ets = esp->es_client.ea_session;
++
++	/*
++	 * If available, copy server name in ets; it will be used in cert
++	 * verify 
++	 */
++	if (esp->es_client.ea_peer)
++		strncpy(ets->peer, esp->es_client.ea_peer, MAXWORDLEN);
++	else
++		ets->peer[0] = 0;
++	
++	ets->mtu = eaptls_get_mtu(esp->es_unit);
++
++	dbglog( "calling get_eaptls_secret" );
++	if (!get_eaptls_secret(esp->es_unit, esp->es_client.ea_name,
++			       ets->peer, clicertfile,
++			       servcertfile, cacertfile, pkfile, 0)) {
++		error( "EAP-TLS: Cannot get secret/password for client \"%s\", server \"%s\"",
++				esp->es_client.ea_name, ets->peer );
++		return 0;
++	}
++
++	dbglog( "calling eaptls_init_ssl" );
++	ets->ctx = eaptls_init_ssl(0, cacertfile, clicertfile, servcertfile, pkfile);
++	if (!ets->ctx)
++		goto fail;
++
++	ets->ssl = SSL_new(ets->ctx);
++
++	if (!ets->ssl)
++		goto fail;
++
++	/*
++	 * Initialize the BIOs we use to read/write to ssl engine 
++	 */
++	dbglog( "Initializing SSL BIOs" );
++	ets->into_ssl = BIO_new(BIO_s_mem());
++	ets->from_ssl = BIO_new(BIO_s_mem());
++	SSL_set_bio(ets->ssl, ets->into_ssl, ets->from_ssl);
++
++	SSL_set_msg_callback(ets->ssl, ssl_msg_callback);
++	SSL_set_msg_callback_arg(ets->ssl, ets);
++
++	/*
++	 * Attach the session struct to the connection, so we can later
++	 * retrieve it when doing certificate verification
++	 */
++	SSL_set_ex_data(ets->ssl, 0, ets);
++
++	SSL_set_connect_state(ets->ssl);
++
++	ets->data = NULL;
++	ets->datalen = 0;
++	ets->alert_sent = 0;
++	ets->alert_recv = 0;
++
++	/*
++	 * If we specified the server certificate file, store it in
++	 * ets->peercertfile, so we can check it later in
++	 * ssl_verify_callback() 
++	 */
++	if (servcertfile[0])
++		strncpy(ets->peercertfile, servcertfile, MAXWORDLEN);
++	else
++		ets->peercertfile[0] = 0;
++
++	return 1;
++
++fail:
++	dbglog( "eaptls_init_ssl_client: fail" );
++	SSL_CTX_free(ets->ctx);
++	return 0;
++
++}
++
++void eaptls_free_session(struct eaptls_session *ets)
++{
++	if (ets->ssl)
++		SSL_free(ets->ssl);
++
++	if (ets->ctx)
++		SSL_CTX_free(ets->ctx);
++
++	free(ets);
++}
++
++/*
++ * Handle a received packet, reassembling fragmented messages and
++ * passing them to the ssl engine
++ */
++int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len)
++{
++	u_char flags;
++	u_int tlslen = 0;
++	u_char dummy[65536];
++
++	if (len < 1) {
++		warn("EAP-TLS: received no or invalid data");
++		return 1;
++	}
++		
++	GETCHAR(flags, inp);
++	len--;
++
++    if (flags & EAP_TLS_FLAGS_LI && len >= 4) {
++		/*
++		 * LenghtIncluded flag set -> this is the first packet of a message
++		*/
++
++		/*
++		 * the first 4 octets are the length of the EAP-TLS message
++		 */
++		GETLONG(tlslen, inp);
++		len -= 4;
++
++		if (!ets->data) {
++
++			if (tlslen > EAP_TLS_MAX_LEN) {
++				error("EAP-TLS: TLS message length > %d, truncated", EAP_TLS_MAX_LEN);
++				tlslen = EAP_TLS_MAX_LEN;
++			}
++
++			/*
++			 * Allocate memory for the whole message
++			*/
++			ets->data = malloc(tlslen);
++			if (!ets->data)
++				fatal("EAP-TLS: allocation error\n");
++
++			ets->datalen = 0;
++			ets->tlslen = tlslen;
++		}
++		else
++			warn("EAP-TLS: non-first LI packet? that's odd...");
++	}
++	else if (!ets->data) {
++		/*
++		 * A non fragmented message without LI flag
++		*/
++ 
++		ets->data = malloc(len);
++		if (!ets->data)
++			fatal("EAP-TLS: allocation error\n");
++ 
++		ets->datalen = 0;
++		ets->tlslen = len;
++	}
++
++	if (flags & EAP_TLS_FLAGS_MF)
++		ets->frag = 1;
++	else
++		ets->frag = 0;
++
++	if (len < 0) {
++		warn("EAP-TLS: received malformed data");
++		return 1;
++	}
++
++	if (len + ets->datalen > ets->tlslen) {
++		warn("EAP-TLS: received data > TLS message length");
++		return 1;
++	}
++
++	BCOPY(inp, ets->data + ets->datalen, len);
++	ets->datalen += len;
++
++	if (!ets->frag) {
++
++		/*
++		 * If we have the whole message, pass it to ssl 
++		 */
++
++		if (ets->datalen != ets->tlslen) {
++			warn("EAP-TLS: received data != TLS message length");
++			return 1;
++		}
++
++		if (BIO_write(ets->into_ssl, ets->data, ets->datalen) == -1)
++			log_ssl_errors();
++
++		SSL_read(ets->ssl, dummy, 65536);
++
++		free(ets->data);
++		ets->data = NULL;
++		ets->datalen = 0;
++	}
++
++	return 0;
++}
++
++/*
++ * Return an eap-tls packet in outp.
++ * A TLS message read from the ssl engine is buffered in ets->data.
++ * At each call we control if there is buffered data and send a 
++ * packet of mtu bytes.
++ */
++int eaptls_send(struct eaptls_session *ets, u_char ** outp)
++{
++	bool first = 0;
++	int size;
++	u_char fromtls[65536];
++	int res;
++	u_char *start;
++
++	start = *outp;
++
++	if (!ets->data) {
++
++		if(!ets->alert_sent)
++			SSL_read(ets->ssl, fromtls, 65536);
++
++		/*
++		 * Read from ssl 
++		 */
++		if ((res = BIO_read(ets->from_ssl, fromtls, 65536)) == -1)
++			fatal("No data from BIO_read");
++
++		ets->datalen = res;
++
++		ets->data = malloc(ets->datalen);
++		BCOPY(fromtls, ets->data, ets->datalen);
++
++		ets->offset = 0;
++		first = 1;
++
++	}
++
++	size = ets->datalen - ets->offset;
++    
++	if (size > ets->mtu) {
++		size = ets->mtu;
++		ets->frag = 1;
++	} else
++		ets->frag = 0;
++
++	PUTCHAR(EAPT_TLS, *outp);
++
++	/*
++	 * Set right flags and length if necessary 
++	 */
++	if (ets->frag && first) {
++		PUTCHAR(EAP_TLS_FLAGS_LI | EAP_TLS_FLAGS_MF, *outp);
++		PUTLONG(ets->datalen, *outp);
++	} else if (ets->frag) {
++		PUTCHAR(EAP_TLS_FLAGS_MF, *outp);
++	} else
++		PUTCHAR(0, *outp);
++
++	/*
++	 * Copy the data in outp 
++	 */
++	BCOPY(ets->data + ets->offset, *outp, size);
++	INCPTR(size, *outp);
++
++	/*
++	 * Copy the packet in retransmission buffer 
++	 */
++	BCOPY(start, &ets->rtx[0], *outp - start);
++	ets->rtx_len = *outp - start;
++
++	ets->offset += size;
++
++	if (ets->offset >= ets->datalen) {
++
++		/*
++		 * The whole message has been sent 
++		 */
++
++		free(ets->data);
++		ets->data = NULL;
++		ets->datalen = 0;
++		ets->offset = 0;
++	}
++
++	return 0;
++}
++
++/*
++ * Get the sent packet from the retransmission buffer
++ */
++void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp)
++{
++	BCOPY(ets->rtx, *outp, ets->rtx_len);
++	INCPTR(ets->rtx_len, *outp);
++}
++
++/*
++ * Verify a certificate.
++ * Most of the work (signatures and issuer attributes checking)
++ * is done by ssl; we check the CN in the peer certificate 
++ * against the peer name.
++ */
++int ssl_verify_callback(int preverify_ok, X509_STORE_CTX * ctx)
++{
++	char subject[256];
++	char cn_str[256];
++	X509 *peer_cert;
++	int err, depth;
++	int ok = preverify_ok;
++	SSL *ssl;
++	struct eaptls_session *ets;
++
++	peer_cert = X509_STORE_CTX_get_current_cert(ctx);
++	err = X509_STORE_CTX_get_error(ctx);
++	depth = X509_STORE_CTX_get_error_depth(ctx);
++
++	dbglog("certificate verify depth: %d", depth);
++
++    if (auth_required && !ok) {
++		X509_NAME_oneline(X509_get_subject_name(peer_cert),
++				  subject, 256);
++
++		X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert),
++					  NID_commonName, cn_str, 256);
++
++		dbglog("Certificate verification error:\n depth: %d CN: %s"
++		       "\n err: %d (%s)\n", depth, cn_str, err,
++		       X509_verify_cert_error_string(err));
++
++		return 0;
++	}
++
++	ssl = X509_STORE_CTX_get_ex_data(ctx,
++				       SSL_get_ex_data_X509_STORE_CTX_idx());
++
++	ets = (struct eaptls_session *)SSL_get_ex_data(ssl, 0);
++
++	if (ets == NULL) {
++		error("Error: SSL_get_ex_data returned NULL");
++		return 0;
++	}
++
++	log_ssl_errors();
++
++	if (!depth) {		/* This is the peer certificate */
++
++		X509_NAME_oneline(X509_get_subject_name(peer_cert),
++				  subject, 256);
++
++		X509_NAME_get_text_by_NID(X509_get_subject_name(peer_cert),
++					  NID_commonName, cn_str, 256);
++
++		/*
++		 * If acting as client and the name of the server wasn't specified
++		 * explicitely, we can't verify the server authenticity 
++		 */
++		if (!ets->peer[0]) {
++			warn("Peer name not specified: no check");
++			return 1;
++		}
++
++		/*
++		 * Check the CN 
++		 */
++		if (strcmp(cn_str, ets->peer)) {
++			error
++			    ("Certificate verification error: CN (%s) != peer_name (%s)",
++			     cn_str, ets->peer);
++			return 0;
++		}
++
++		warn("Certificate CN: %s , peer name %s", cn_str, ets->peer);
++
++		/*
++		 * If a peer certificate file was specified, here we check it 
++		 */
++		if (ets->peercertfile[0]) {
++			if (ssl_cmp_certs(&ets->peercertfile[0], peer_cert)
++			    != 0) {
++				error
++				    ("Peer certificate doesn't match stored certificate");
++				return 0;
++			}
++		}
++	}
++
++	return 1;
++}
++
++/*
++ * Compare a certificate with the one stored in a file
++ */
++int ssl_cmp_certs(char *filename, X509 * a)
++{
++	X509 *b;
++	int ret;
++
++	if (!(b = get_X509_from_file(filename)))
++		return 1;
++
++	ret = X509_cmp(a, b);
++	X509_free(b);
++
++	return ret;
++
++}
++
++X509 *get_X509_from_file(char *filename)
++{
++	FILE *fp;
++	X509 *ret;
++
++	if (!(fp = fopen(filename, "r")))
++		return NULL;
++
++	ret = PEM_read_X509(fp, NULL, NULL, NULL);
++
++	fclose(fp);
++
++	return ret;
++}
++
++/*
++ * Every sent & received message this callback function is invoked,
++ * so we know when alert messages have arrived or are sent and
++ * we can print debug information about TLS handshake.
++ */
++void
++ssl_msg_callback(int write_p, int version, int content_type,
++		 const void *buf, size_t len, SSL * ssl, void *arg)
++{
++	char string[256];
++	struct eaptls_session *ets = (struct eaptls_session *)arg;
++	unsigned char code;
++	const unsigned char*msg = buf;
++    int hvers = msg[1] << 8 | msg[2];
++
++	if(write_p)
++		strcpy(string, " -> ");
++	else
++		strcpy(string, " <- ");
++
++	switch(content_type) {
++
++	case SSL3_RT_HEADER:
++		strcat(string, "SSL/TLS Header: ");
++		switch(hvers) {
++		case SSL3_VERSION:
++				strcat(string, "SSL 3.0");
++				break;
++		case TLS1_VERSION:
++				strcat(string, "TLS 1.0");
++				break;
++		case TLS1_1_VERSION:
++				strcat(string, "TLS 1.1");
++				break;
++		case TLS1_2_VERSION:
++				strcat(string, "TLS 1.2");
++				break;
++		case DTLS1_VERSION:
++				strcat(string, "DTLS 1.0");
++				break;
++		case DTLS1_2_VERSION:
++				strcat(string, "DTLS 1.2");
++				break;
++		default:
++			strcat(string, "Unknown version");
++		}
++		break;
++
++	case SSL3_RT_ALERT:	
++		strcat(string, "Alert: ");	
++		code = msg[1];
++
++		if (write_p) {
++			ets->alert_sent = 1;
++			ets->alert_sent_desc = code;
++		} else {
++			ets->alert_recv = 1;
++			ets->alert_recv_desc = code;
++		}
++
++		strcat(string, SSL_alert_desc_string_long(code));
++		break;
++
++	case SSL3_RT_CHANGE_CIPHER_SPEC:
++		strcat(string, "ChangeCipherSpec");
++		break;
++
++	case SSL3_RT_HANDSHAKE:
++
++		strcat(string, "Handshake: ");
++		code = msg[0];
++
++		switch(code) {
++			case SSL3_MT_HELLO_REQUEST:
++				strcat(string,"Hello Request");
++				break;
++			case SSL3_MT_CLIENT_HELLO:
++				strcat(string,"Client Hello");
++				break;
++			case SSL3_MT_SERVER_HELLO:
++				strcat(string,"Server Hello");
++				break;
++#ifdef SSL3_MT_NEWSESSION_TICKET
++			case SSL3_MT_NEWSESSION_TICKET:
++				strcat(string,"New Session Ticket");
++				break;
++#endif
++			case SSL3_MT_CERTIFICATE:
++				strcat(string,"Certificate");
++				break;
++			case SSL3_MT_SERVER_KEY_EXCHANGE:
++				strcat(string,"Server Key Exchange");
++				break;
++			case SSL3_MT_CERTIFICATE_REQUEST:
++				strcat(string,"Certificate Request");
++				break;
++			case SSL3_MT_SERVER_DONE:
++				strcat(string,"Server Hello Done");
++								break;
++			case SSL3_MT_CERTIFICATE_VERIFY:
++				strcat(string,"Certificate Verify");
++				break;
++			case SSL3_MT_CLIENT_KEY_EXCHANGE:
++				strcat(string,"Client Key Exchange");
++				break;
++			case SSL3_MT_FINISHED:
++				strcat(string,"Finished");
++				break;
++
++			default:
++				sprintf( string, "Handshake: Unknown SSL3 code received: %d", code );
++		}
++		break;
++
++	default:
++		sprintf( string, "SSL message contains unknown content type: %d", content_type );
++		
++	}
++
++	/* Alert messages must always be displayed */
++	if(content_type == SSL3_RT_ALERT)
++		error("%s", string);
++	else
++		dbglog("%s", string);
++}
++
+diff -Naur ppp-2.4.7/pppd/eap-tls.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.h
+--- ppp-2.4.7/pppd/eap-tls.h	1970-01-01 01:00:00.000000000 +0100
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap-tls.h	2018-06-02 01:42:04.023165433 +0200
+@@ -0,0 +1,107 @@
++/*
++ * eap-tls.h
++ *
++ * Copyright (c) Beniamino Galvani 2005 All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. The name(s) of the authors of this software must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission.
++ *
++ * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
++ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
++ * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
++ * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
++ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
++ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ *
++ */
++
++#ifndef __EAP_TLS_H__
++#define __EAP_TLS_H__
++
++#include "eap.h"
++
++#include <openssl/ssl.h>
++#include <openssl/bio.h>
++#include <openssl/md5.h>
++
++#define EAP_TLS_FLAGS_LI        128	/* length included flag */
++#define EAP_TLS_FLAGS_MF        64	/* more fragments flag */
++#define EAP_TLS_FLAGS_START     32	/* start flag */
++
++#define EAP_TLS_MAX_LEN         65536	/* max eap tls packet size */
++
++struct eaptls_session
++{
++	u_char *data;		/* buffered data */
++	int datalen;		/* buffered data len */
++	int offset;		/* from where to send */
++	int tlslen;		/* total length of tls data */
++	bool frag;		/* packet is fragmented */
++	SSL_CTX *ctx;
++	SSL *ssl;		/* ssl connection */
++	BIO *from_ssl;
++	BIO *into_ssl;
++	char peer[MAXWORDLEN];	/* peer name */
++	char peercertfile[MAXWORDLEN];
++	bool alert_sent;
++	u_char alert_sent_desc;
++	bool alert_recv;
++	u_char alert_recv_desc;
++	char rtx[65536];	/* retransmission buffer */
++	int rtx_len;
++	int mtu;		/* unit mtu */
++};
++
++typedef struct pw_cb_data
++{
++	const void *password;
++	const char *prompt_info;
++} PW_CB_DATA;
++
++
++int ssl_verify_callback(int, X509_STORE_CTX *);
++void ssl_msg_callback(int write_p, int version, int ct, const void *buf,
++		      size_t len, SSL * ssl, void *arg);
++
++X509 *get_X509_from_file(char *filename);
++int ssl_cmp_certs(char *filename, X509 * a);
++
++SSL_CTX *eaptls_init_ssl(int init_server, char *cacertfile,
++            char *certfile, char *peer_certfile, char *privkeyfile);
++int eaptls_init_ssl_server(eap_state * esp);
++int eaptls_init_ssl_client(eap_state * esp);
++void eaptls_free_session(struct eaptls_session *ets);
++
++int eaptls_receive(struct eaptls_session *ets, u_char * inp, int len);
++int eaptls_send(struct eaptls_session *ets, u_char ** outp);
++void eaptls_retransmit(struct eaptls_session *ets, u_char ** outp);
++
++int get_eaptls_secret(int unit, char *client, char *server,
++		      char *clicertfile, char *servcertfile, char *cacertfile,
++		      char *pkfile, int am_server);
++
++#ifdef MPPE
++#include "mppe.h"   /* MPPE_MAX_KEY_LEN */
++extern u_char mppe_send_key[MPPE_MAX_KEY_LEN];
++extern u_char mppe_recv_key[MPPE_MAX_KEY_LEN];
++extern int mppe_keys_set;
++
++void eaptls_gen_mppe_keys(struct eaptls_session *ets, const char *prf_label, int client);
++
++#endif
++
++#endif
+diff -Naur ppp-2.4.7/pppd/eap.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.c
+--- ppp-2.4.7/pppd/eap.c	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.c	2018-06-02 01:42:04.023165433 +0200
+@@ -43,6 +43,11 @@
+  * Based on draft-ietf-pppext-eap-srp-03.txt.
+  */
+ 
++/*
++ * Modification by Beniamino Galvani, Mar 2005
++ * Implemented EAP-TLS authentication
++ */
++
+ #define RCSID	"$Id: eap.c,v 1.4 2004/11/09 22:39:25 paulus Exp $"
+ 
+ /*
+@@ -62,8 +67,12 @@
+ 
+ #include "pppd.h"
+ #include "pathnames.h"
+-#include "md5.h"
+ #include "eap.h"
++#ifdef USE_EAPTLS
++#include "eap-tls.h"
++#else
++#include "md5.h"
++#endif /* USE_EAPTLS */
+ 
+ #ifdef USE_SRP
+ #include <t_pwd.h>
+@@ -209,6 +218,9 @@
+ 	esp->es_server.ea_id = (u_char)(drand48() * 0x100);
+ 	esp->es_client.ea_timeout = EAP_DEFREQTIME;
+ 	esp->es_client.ea_maxrequests = EAP_DEFALLOWREQ;
++#ifdef USE_EAPTLS
++	esp->es_client.ea_using_eaptls = 0;
++#endif /* USE_EAPTLS */
+ }
+ 
+ /*
+@@ -436,8 +448,16 @@
+ 	u_char vals[2];
+ 	struct b64state bs;
+ #endif /* USE_SRP */
++#ifdef USE_EAPTLS
++	struct eaptls_session *ets;
++	int secret_len;
++	char secret[MAXWORDLEN];
++#endif /* USE_EAPTLS */
+ 
+ 	esp->es_server.ea_timeout = esp->es_savedtime;
++#ifdef USE_EAPTLS
++	esp->es_server.ea_prev_state = esp->es_server.ea_state;
++#endif /* USE_EAPTLS */
+ 	switch (esp->es_server.ea_state) {
+ 	case eapBadAuth:
+ 		return;
+@@ -562,9 +582,79 @@
+ 			break;
+ 		}
+ #endif /* USE_SRP */
++#ifdef USE_EAPTLS
++                if (!get_secret(esp->es_unit, esp->es_server.ea_peer,
++                    esp->es_server.ea_name, secret, &secret_len, 1)) {
++
++			esp->es_server.ea_state = eapTlsStart;
++			break;
++		}
++#endif /* USE_EAPTLS */
++
+ 		esp->es_server.ea_state = eapMD5Chall;
+ 		break;
+ 
++#ifdef USE_EAPTLS
++	case eapTlsStart:
++		/* Initialize ssl session */
++		if(!eaptls_init_ssl_server(esp)) {
++			esp->es_server.ea_state = eapBadAuth;
++			break;
++		}
++
++		esp->es_server.ea_state = eapTlsRecv;
++		break;
++
++	case eapTlsRecv:
++		ets = (struct eaptls_session *) esp->es_server.ea_session;
++
++		if(ets->alert_sent) {
++			esp->es_server.ea_state = eapTlsSendAlert;
++			break;
++		}
++
++		if (status) {
++			esp->es_server.ea_state = eapBadAuth;
++			break;
++		}
++		ets = (struct eaptls_session *) esp->es_server.ea_session;
++
++		if(ets->frag)
++			esp->es_server.ea_state = eapTlsSendAck;
++		else
++			esp->es_server.ea_state = eapTlsSend;
++		break;
++
++	case eapTlsSend:
++		ets = (struct eaptls_session *) esp->es_server.ea_session;
++
++		if(ets->frag)
++			esp->es_server.ea_state = eapTlsRecvAck;
++		else
++			if(SSL_is_init_finished(ets->ssl)) 
++				esp->es_server.ea_state = eapTlsRecvClient; 
++			else
++				esp->es_server.ea_state = eapTlsRecv;
++		break;
++
++	case eapTlsSendAck:
++			esp->es_server.ea_state = eapTlsRecv;
++		break;
++
++	case eapTlsRecvAck:
++                if (status) {
++                        esp->es_server.ea_state = eapBadAuth;
++                        break;
++                }
++
++		esp->es_server.ea_state = eapTlsSend;
++		break;
++
++	case eapTlsSendAlert:
++		esp->es_server.ea_state = eapTlsRecvAlertAck;
++		break;
++#endif /* USE_EAPTLS */
++
+ 	case eapSRP1:
+ #ifdef USE_SRP
+ 		ts = (struct t_server *)esp->es_server.ea_session;
+@@ -718,6 +808,30 @@
+ 		INCPTR(esp->es_server.ea_namelen, outp);
+ 		break;
+ 
++#ifdef USE_EAPTLS
++	case eapTlsStart:
++		PUTCHAR(EAPT_TLS, outp);
++		PUTCHAR(EAP_TLS_FLAGS_START, outp);
++		eap_figure_next_state(esp, 0);
++		break;
++
++	case eapTlsSend:
++		eaptls_send(esp->es_server.ea_session, &outp);
++		eap_figure_next_state(esp, 0);
++		break;
++
++	case eapTlsSendAck:
++		PUTCHAR(EAPT_TLS, outp);
++		PUTCHAR(0, outp);
++		eap_figure_next_state(esp, 0);
++		break;
++
++	case eapTlsSendAlert:
++		eaptls_send(esp->es_server.ea_session, &outp);
++		eap_figure_next_state(esp, 0);
++		break;
++#endif /* USE_EAPTLS */
++
+ #ifdef USE_SRP
+ 	case eapSRP1:
+ 		PUTCHAR(EAPT_SRP, outp);
+@@ -904,11 +1018,57 @@
+ eap_server_timeout(arg)
+ void *arg;
+ {
++#ifdef USE_EAPTLS
++	u_char *outp;
++	u_char *lenloc;
++	int outlen;
++#endif /* USE_EAPTLS */
++
+ 	eap_state *esp = (eap_state *) arg;
+ 
+ 	if (!eap_server_active(esp))
+ 		return;
+ 
++#ifdef USE_EAPTLS
++	switch(esp->es_server.ea_prev_state) {
++
++	/* 
++	 *  In eap-tls the state changes after a request, so we return to
++	 *  previous state ...
++	 */
++	case(eapTlsStart):
++	case(eapTlsSendAck):
++		esp->es_server.ea_state = esp->es_server.ea_prev_state;
++		break;
++
++	/*
++	 *  ... or resend the stored data
++	 */
++	case(eapTlsSend):
++	case(eapTlsSendAlert):
++		outp = outpacket_buf;
++		MAKEHEADER(outp, PPP_EAP);
++		PUTCHAR(EAP_REQUEST, outp);
++		PUTCHAR(esp->es_server.ea_id, outp);
++		lenloc = outp;
++		INCPTR(2, outp);
++
++		eaptls_retransmit(esp->es_server.ea_session, &outp);
++
++		outlen = (outp - outpacket_buf) - PPP_HDRLEN;
++		PUTSHORT(outlen, lenloc);
++		output(esp->es_unit, outpacket_buf, outlen + PPP_HDRLEN);
++		esp->es_server.ea_requests++;
++
++		if (esp->es_server.ea_timeout > 0)
++			TIMEOUT(eap_server_timeout, esp, esp->es_server.ea_timeout);
++
++		return;
++	default:
++		break;
++	}
++#endif /* USE_EAPTLS */
++
+ 	/* EAP ID number must not change on timeout. */
+ 	eap_send_request(esp);
+ }
+@@ -1166,6 +1326,81 @@
+ }
+ #endif /* USE_SRP */
+ 
++#ifdef USE_EAPTLS
++/*
++ * Send an EAP-TLS response message with tls data
++ */
++static void
++eap_tls_response(esp, id)
++eap_state *esp;
++u_char id;
++{
++        u_char *outp;
++        int outlen;
++	u_char *lenloc;
++
++        outp = outpacket_buf;
++
++        MAKEHEADER(outp, PPP_EAP);
++
++        PUTCHAR(EAP_RESPONSE, outp);
++        PUTCHAR(id, outp);
++
++	lenloc = outp;
++	INCPTR(2, outp);        
++
++	/*
++	   If the id in the request is unchanged, we must retransmit
++	   the old data
++	*/
++	if(id == esp->es_client.ea_id)
++		eaptls_retransmit(esp->es_client.ea_session, &outp);
++	else
++		eaptls_send(esp->es_client.ea_session, &outp);
++
++	outlen = (outp - outpacket_buf) - PPP_HDRLEN;
++	PUTSHORT(outlen, lenloc);
++
++	output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen);
++
++	esp->es_client.ea_id = id;
++
++}
++
++/*
++ * Send an EAP-TLS ack
++ */
++static void
++eap_tls_sendack(esp, id)
++eap_state *esp;
++u_char id;
++{
++	u_char *outp;
++	int outlen;
++	u_char *lenloc;
++
++	outp = outpacket_buf;
++
++	MAKEHEADER(outp, PPP_EAP);
++
++	PUTCHAR(EAP_RESPONSE, outp);
++	PUTCHAR(id, outp);
++	esp->es_client.ea_id = id;
++
++	lenloc = outp;
++	INCPTR(2, outp);
++
++	PUTCHAR(EAPT_TLS, outp);
++	PUTCHAR(0, outp);
++
++	outlen = (outp - outpacket_buf) - PPP_HDRLEN;
++	PUTSHORT(outlen, lenloc);
++
++	output(esp->es_unit, outpacket_buf, PPP_HDRLEN + outlen);
++
++}
++#endif /* USE_EAPTLS */
++
+ static void
+ eap_send_nak(esp, id, type)
+ eap_state *esp;
+@@ -1320,6 +1555,11 @@
+ 	char rhostname[256];
+ 	MD5_CTX mdContext;
+ 	u_char hash[MD5_SIGNATURE_SIZE];
++#ifdef USE_EAPTLS
++	u_char flags;
++	struct eaptls_session *ets = esp->es_client.ea_session;
++#endif /* USE_EAPTLS */
++
+ #ifdef USE_SRP
+ 	struct t_client *tc;
+ 	struct t_num sval, gval, Nval, *Ap, Bval;
+@@ -1456,6 +1696,100 @@
+ 		    esp->es_client.ea_namelen);
+ 		break;
+ 
++#ifdef USE_EAPTLS
++	case EAPT_TLS:
++
++		switch(esp->es_client.ea_state) {
++
++		case eapListen:
++
++			if (len < 1) {
++				error("EAP: received EAP-TLS Listen packet with no data");
++				/* Bogus request; wait for something real. */
++				return;
++			}
++			GETCHAR(flags, inp);
++			if(flags & EAP_TLS_FLAGS_START){
++
++				esp->es_client.ea_using_eaptls = 1;
++
++                                if (explicit_remote){
++                                        esp->es_client.ea_peer = strdup(remote_name);
++                                        esp->es_client.ea_peerlen = strlen(remote_name);
++                                } else
++                                        esp->es_client.ea_peer = NULL;
++
++				/* Init ssl session */
++				if(!eaptls_init_ssl_client(esp)) {
++					dbglog("cannot init ssl");
++					eap_send_nak(esp, id, EAPT_TLS);
++					esp->es_client.ea_using_eaptls = 0;
++					break;
++				}
++
++				ets = esp->es_client.ea_session;
++				eap_tls_response(esp, id);
++				esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck :
++								eapTlsRecv);
++				break;
++			}
++
++			/* The server has sent a bad start packet. */
++			eap_send_nak(esp, id, EAPT_TLS);
++			break;
++
++		case eapTlsRecvAck:
++			eap_tls_response(esp, id);
++			esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck : 
++							eapTlsRecv);
++			break;
++
++		case eapTlsRecv:
++			if (len < 1) {
++				error("EAP: discarding EAP-TLS Receive packet with no data");
++				/* Bogus request; wait for something real. */
++				return;
++			}
++			eaptls_receive(ets, inp, len);
++
++			if(ets->frag) {
++				eap_tls_sendack(esp, id);
++				esp->es_client.ea_state = eapTlsRecv;
++				break;
++			}
++
++			if(ets->alert_recv) {
++				eap_tls_sendack(esp, id);
++				esp->es_client.ea_state = eapTlsRecvFailure;
++				break;
++			}
++
++			/* Check if TLS handshake is finished */
++			if(SSL_is_init_finished(ets->ssl)){
++#ifdef MPPE
++ 				eaptls_gen_mppe_keys( ets, "client EAP encryption", 1 );
++#endif
++				eaptls_free_session(ets);
++				eap_tls_sendack(esp, id);
++				esp->es_client.ea_state = eapTlsRecvSuccess;
++				break;
++			}
++
++			eap_tls_response(esp,id);
++                        esp->es_client.ea_state = (ets->frag ? eapTlsRecvAck :
++                                                        eapTlsRecv);
++
++                        break;
++
++		default:
++			eap_send_nak(esp, id, EAPT_TLS);
++			esp->es_client.ea_using_eaptls = 0;
++			break;
++		}
++
++		break;
++#endif /* USE_EAPTLS */
++
+ #ifdef USE_SRP
+ 	case EAPT_SRP:
+ 		if (len < 1) {
+@@ -1737,6 +2071,11 @@
+ 	u_char dig[SHA_DIGESTSIZE];
+ #endif /* USE_SRP */
+ 
++#ifdef USE_EAPTLS
++	struct eaptls_session *ets;
++	u_char flags;
++#endif /* USE_EAPTLS */
++
+ 	if (esp->es_server.ea_id != id) {
+ 		dbglog("EAP: discarding Response %d; expected ID %d", id,
+ 		    esp->es_server.ea_id);
+@@ -1776,6 +2115,64 @@
+ 		eap_figure_next_state(esp, 0);
+ 		break;
+ 
++#ifdef USE_EAPTLS
++	case EAPT_TLS:
++		switch(esp->es_server.ea_state) {
++
++		case eapTlsRecv:
++	
++			ets = (struct eaptls_session *) esp->es_server.ea_session;
++			eap_figure_next_state(esp, 
++				eaptls_receive(esp->es_server.ea_session, inp, len));
++
++			if(ets->alert_recv) {
++				eap_send_failure(esp);
++				break;
++			}
++			break;
++
++		case eapTlsRecvAck:
++			if(len > 1) {
++				dbglog("EAP-TLS ACK with extra data");
++			}
++			eap_figure_next_state(esp, 0);
++			break;
++
++		case eapTlsRecvClient:
++			/* Receive authentication response from client */
++
++			if (len > 0) {
++				GETCHAR(flags, inp);
++
++				if(len == 1 && !flags) {	/* Ack = ok */
++#ifdef MPPE
++ 					eaptls_gen_mppe_keys( esp->es_server.ea_session, "client EAP encryption", 0 );
++#endif
++					eap_send_success(esp);
++				}
++				else {			/* failure */
++					warn("Server authentication failed");
++					eap_send_failure(esp);
++				}
++			}
++			else
++				warn("Bogus EAP-TLS packet received from client");
++
++			eaptls_free_session(esp->es_server.ea_session);
++
++			break;
++
++		case eapTlsRecvAlertAck:
++			eap_send_failure(esp);
++			break;
++
++		default:
++			eap_figure_next_state(esp, 1);
++			break;
++		}
++		break;
++#endif /* USE_EAPTLS */
++
+ 	case EAPT_NOTIFICATION:
+ 		dbglog("EAP unexpected Notification; response discarded");
+ 		break;
+@@ -1807,6 +2204,13 @@
+ 			esp->es_server.ea_state = eapMD5Chall;
+ 			break;
+ 
++#ifdef USE_EAPTLS
++			/* Send EAP-TLS start packet */
++		case EAPT_TLS:
++			esp->es_server.ea_state = eapTlsStart;
++			break;
++#endif /* USE_EAPTLS */
++
+ 		default:
+ 			dbglog("EAP: peer requesting unknown Type %d", vallen);
+ 			switch (esp->es_server.ea_state) {
+@@ -2018,13 +2422,27 @@
+ int id;
+ int len;
+ {
+-	if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)) {
++	if (esp->es_client.ea_state != eapOpen && !eap_client_active(esp)
++#ifdef USE_EAPTLS
++		&& esp->es_client.ea_state != eapTlsRecvSuccess
++#endif /* USE_EAPTLS */
++		) {
+ 		dbglog("EAP unexpected success message in state %s (%d)",
+ 		    eap_state_name(esp->es_client.ea_state),
+ 		    esp->es_client.ea_state);
+ 		return;
+ 	}
+ 
++#ifdef USE_EAPTLS
++	if(esp->es_client.ea_using_eaptls && esp->es_client.ea_state != 
++		eapTlsRecvSuccess) {
++		dbglog("EAP-TLS unexpected success message in state %s (%d)",
++                    eap_state_name(esp->es_client.ea_state),
++                    esp->es_client.ea_state);
++		return;
++	}
++#endif /* USE_EAPTLS */
++
+ 	if (esp->es_client.ea_timeout > 0) {
+ 		UNTIMEOUT(eap_client_timeout, (void *)esp);
+ 	}
+@@ -2150,6 +2568,9 @@
+ 	int code, id, len, rtype, vallen;
+ 	u_char *pstart;
+ 	u_int32_t uval;
++#ifdef USE_EAPTLS
++	u_char flags;
++#endif /* USE_EAPTLS */
+ 
+ 	if (inlen < EAP_HEADERLEN)
+ 		return (0);
+@@ -2214,6 +2635,24 @@
+ 			}
+ 			break;
+ 
++#ifdef USE_EAPTLS
++		case EAPT_TLS:
++			if (len < 1)
++				break;
++			GETCHAR(flags, inp);
++			len--;
++
++                        if(flags == 0 && len == 0){
++                                printer(arg, " Ack");
++                                break;
++                        }
++
++			printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -");
++			printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-");
++			printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- ");
++			break;
++#endif /* USE_EAPTLS */
++
+ 		case EAPT_SRP:
+ 			if (len < 3)
+ 				goto truncated;
+@@ -2325,6 +2764,25 @@
+ 			}
+ 			break;
+ 
++#ifdef USE_EAPTLS
++		case EAPT_TLS:
++			if (len < 1)
++				break;
++			GETCHAR(flags, inp);
++			len--;
++
++                        if(flags == 0 && len == 0){
++                                printer(arg, " Ack");
++                                break;
++                        }
++
++			printer(arg, flags & EAP_TLS_FLAGS_LI ? " L":" -");
++			printer(arg, flags & EAP_TLS_FLAGS_MF ? "M":"-");
++			printer(arg, flags & EAP_TLS_FLAGS_START ? "S":"- ");
++
++			break;
++#endif /* USE_EAPTLS */
++
+ 		case EAPT_NAK:
+ 			if (len <= 0) {
+ 				printer(arg, " <missing hint>");
+@@ -2426,3 +2884,4 @@
+ 
+ 	return (inp - pstart);
+ }
++
+diff -Naur ppp-2.4.7/pppd/eap.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.h
+--- ppp-2.4.7/pppd/eap.h	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/eap.h	2018-06-02 01:42:04.023165433 +0200
+@@ -84,6 +84,16 @@
+ 	eapClosed,	/* Authentication not in use */
+ 	eapListen,	/* Client ready (and timer running) */
+ 	eapIdentify,	/* EAP Identify sent */
++	eapTlsStart,	/* Send EAP-TLS start packet */
++	eapTlsRecv,	/* Receive EAP-TLS tls data */
++	eapTlsSendAck,	/* Send EAP-TLS ack */
++	eapTlsSend,	/* Send EAP-TLS tls data */
++	eapTlsRecvAck,	/* Receive EAP-TLS ack */
++	eapTlsRecvClient, 	/* Receive EAP-TLS auth response from client*/
++	eapTlsSendAlert,	/* Send EAP-TLS tls alert (server)*/
++	eapTlsRecvAlertAck,	/* Receive EAP-TLS ack after sending alert */
++	eapTlsRecvSuccess,	/* Receive EAP success */
++	eapTlsRecvFailure,	/* Receive EAP failure */
+ 	eapSRP1,	/* Sent EAP SRP-SHA1 Subtype 1 */
+ 	eapSRP2,	/* Sent EAP SRP-SHA1 Subtype 2 */
+ 	eapSRP3,	/* Sent EAP SRP-SHA1 Subtype 3 */
+@@ -95,9 +105,18 @@
+ 
+ #define	EAP_STATES	\
+ 	"Initial", "Pending", "Closed", "Listen", "Identify", \
++	"TlsStart", "TlsRecv", "TlsSendAck", "TlsSend", "TlsRecvAck", "TlsRecvClient",\
++	"TlsSendAlert", "TlsRecvAlertAck" , "TlsRecvSuccess", "TlsRecvFailure", \
+ 	"SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth"
+ 
+-#define	eap_client_active(esp)	((esp)->es_client.ea_state == eapListen)
++#ifdef USE_EAPTLS
++#define	eap_client_active(esp)	((esp)->es_client.ea_state != eapInitial &&\
++				 (esp)->es_client.ea_state != eapPending &&\
++				 (esp)->es_client.ea_state != eapClosed)
++#else
++#define eap_client_active(esp)	((esp)->es_client.ea_state == eapListen)
++#endif /* USE_EAPTLS */
++
+ #define	eap_server_active(esp)	\
+ 	((esp)->es_server.ea_state >= eapIdentify && \
+ 	 (esp)->es_server.ea_state <= eapMD5Chall)
+@@ -112,11 +131,17 @@
+ 	u_short ea_namelen;	/* Length of our name */
+ 	u_short ea_peerlen;	/* Length of peer's name */
+ 	enum eap_state_code ea_state;
++#ifdef USE_EAPTLS
++	enum eap_state_code ea_prev_state;
++#endif
+ 	u_char ea_id;		/* Current id */
+ 	u_char ea_requests;	/* Number of Requests sent/received */
+ 	u_char ea_responses;	/* Number of Responses */
+ 	u_char ea_type;		/* One of EAPT_* */
+ 	u_int32_t ea_keyflags;	/* SRP shared key usage flags */
++#ifdef USE_EAPTLS
++	bool ea_using_eaptls;
++#endif
+ };
+ 
+ /*
+@@ -139,7 +164,12 @@
+  * Timeouts.
+  */
+ #define	EAP_DEFTIMEOUT		3	/* Timeout (seconds) for rexmit */
++#ifdef USE_EAPTLS
++#define	EAP_DEFTRANSMITS	30	/* max # times to transmit */
++					/* certificates can be long ... */
++#else
+ #define	EAP_DEFTRANSMITS	10	/* max # times to transmit */
++#endif /* USE_EAPTLS */
+ #define	EAP_DEFREQTIME		20	/* Time to wait for peer request */
+ #define	EAP_DEFALLOWREQ		20	/* max # times to accept requests */
+ 
+diff -Naur ppp-2.4.7/pppd/md5.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.c
+--- ppp-2.4.7/pppd/md5.c	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.c	2018-06-02 01:42:04.023165433 +0200
+@@ -33,6 +33,8 @@
+  ***********************************************************************
+  */
+ 
++#ifndef USE_EAPTLS
++
+ #include <string.h>
+ #include "md5.h"
+ 
+@@ -305,3 +307,5 @@
+  ** End of md5.c                                                      **
+  ******************************** (cut) ********************************
+  */
++#endif /* USE_EAPTLS */
++
+diff -Naur ppp-2.4.7/pppd/md5.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.h
+--- ppp-2.4.7/pppd/md5.h	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/md5.h	2018-06-02 01:42:04.024165430 +0200
+@@ -36,6 +36,7 @@
+  ** documentation and/or software.                                    **
+  ***********************************************************************
+  */
++#ifndef USE_EAPTLS
+ 
+ #ifndef __MD5_INCLUDE__
+ 
+@@ -63,3 +64,5 @@
+ 
+ #define __MD5_INCLUDE__
+ #endif /* __MD5_INCLUDE__ */
++
++#endif /* USE_EAPTLS */
+diff -Naur ppp-2.4.7/pppd/pathnames.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/pathnames.h
+--- ppp-2.4.7/pppd/pathnames.h	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pathnames.h	2018-06-02 01:42:04.024165430 +0200
+@@ -21,6 +21,13 @@
+ #define _PATH_UPAPFILE 	 _ROOT_PATH "/etc/ppp/pap-secrets"
+ #define _PATH_CHAPFILE 	 _ROOT_PATH "/etc/ppp/chap-secrets"
+ #define _PATH_SRPFILE 	 _ROOT_PATH "/etc/ppp/srp-secrets"
++
++#ifdef USE_EAPTLS
++#define _PATH_EAPTLSCLIFILE	_ROOT_PATH "/etc/ppp/eaptls-client"
++#define _PATH_EAPTLSSERVFILE	_ROOT_PATH "/etc/ppp/eaptls-server"
++#define _PATH_OPENSSLCONFFILE	_ROOT_PATH "/etc/ppp/openssl.cnf"
++#endif /* USE_EAPTLS */
++
+ #define _PATH_SYSOPTIONS _ROOT_PATH "/etc/ppp/options"
+ #define _PATH_IPUP	 _ROOT_PATH "/etc/ppp/ip-up"
+ #define _PATH_IPDOWN	 _ROOT_PATH "/etc/ppp/ip-down"
+diff -Naur ppp-2.4.7/pppd/plugins/Makefile.linux ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/Makefile.linux
+--- ppp-2.4.7/pppd/plugins/Makefile.linux	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/Makefile.linux	2018-06-02 01:42:04.024165430 +0200
+@@ -4,6 +4,9 @@
+ LDFLAGS	= -shared
+ INSTALL	= install
+ 
++# EAP-TLS
++CFLAGS += -DUSE_EAPTLS=1
++
+ DESTDIR = $(INSTROOT)@DESTDIR@
+ BINDIR = $(DESTDIR)/sbin
+ MANDIR = $(DESTDIR)/share/man/man8
+diff -Naur ppp-2.4.7/pppd/plugins/passprompt.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passprompt.c
+--- ppp-2.4.7/pppd/plugins/passprompt.c	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passprompt.c	2018-06-02 01:42:04.024165430 +0200
+@@ -107,4 +107,7 @@
+ {
+     add_options(options);
+     pap_passwd_hook = promptpass;
++#ifdef USE_EAPTLS
++    eaptls_passwd_hook = promptpass;
++#endif
+ }
+diff -Naur ppp-2.4.7/pppd/plugins/passwordfd.c ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passwordfd.c
+--- ppp-2.4.7/pppd/plugins/passwordfd.c	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/plugins/passwordfd.c	2018-06-02 01:42:04.024165430 +0200
+@@ -79,4 +79,8 @@
+ 
+     chap_check_hook = pwfd_check;
+     chap_passwd_hook = pwfd_passwd;
++
++#ifdef USE_EAPTLS
++    eaptls_passwd_hook = pwfd_passwd;
++#endif
+ }
+diff -Naur ppp-2.4.7/pppd/pppd.8 ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.8
+--- ppp-2.4.7/pppd/pppd.8	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.8	2018-06-02 01:42:04.025165427 +0200
+@@ -248,6 +248,12 @@
+ compression in the corresponding direction.  Use \fInobsdcomp\fR or
+ \fIbsdcomp 0\fR to disable BSD-Compress compression entirely.
+ .TP
++.B ca \fIca-file
++(EAP-TLS) Use the file \fIca-file\fR as the X.509 Certificate Authority
++(CA) file (in PEM format), needed for setting up an EAP-TLS connection.
++This option is used on the client-side in conjunction with the \fBcert\fR
++and \fBkey\fR options.
++.TP
+ .B cdtrcts
+ Use a non-standard hardware flow control (i.e. DTR/CTS) to control
+ the flow of data on the serial port.  If neither the \fIcrtscts\fR,
+@@ -259,6 +265,12 @@
+ bi-directional flow control. The sacrifice is that this flow
+ control mode does not permit using DTR as a modem control line.
+ .TP
++.B cert \fIcertfile
++(EAP-TLS) Use the file \fIcertfile\fR as the X.509 certificate (in PEM
++format), needed for setting up an EAP-TLS connection. This option is
++used on the client-side in conjunction with the \fBca\fR and 
++\fBkey\fR options.
++.TP
+ .B chap\-interval \fIn
+ If this option is given, pppd will rechallenge the peer every \fIn\fR
+ seconds.
+@@ -287,6 +299,18 @@
+ 1000 (1 second).  This wait period only applies if the \fBconnect\fR
+ or \fBpty\fR option is used.
+ .TP
++.B crl \fIfilename
++(EAP-TLS) Use the file \fIfilename\fR as the Certificate Revocation List
++to check for the validity of the peer's certificate. This option is not
++mandatory for setting up an EAP-TLS connection. Also see the \fBcrl-dir\fR
++option.
++.TP
++.B crl-dir \fIdirectory
++(EAP-TLS) Use the directory \fIdirectory\fR to scan for CRL files in
++has format ($hash.r0) to check for the validity of the peer's certificate.
++This option is not mandatory for setting up an EAP-TLS connection.
++Also see the \fBcrl\fR option.
++.TP
+ .B debug
+ Enables connection debugging facilities.
+ If this option is given, pppd will log the contents of all
+@@ -551,6 +575,12 @@
+ the kernel are logged by syslog(1) to a file as directed in the
+ /etc/syslog.conf configuration file.
+ .TP
++.B key \fIkeyfile
++(EAP-TLS) Use the file \fIkeyfile\fR as the private key file (in PEM
++format), needed for setting up an EAP-TLS connection. This option is
++used on the client-side in conjunction with the \fBca\fR and 
++\fBcert\fR options.
++.TP
+ .B ktune
+ Enables pppd to alter kernel settings as appropriate.  Under Linux,
+ pppd will enable IP forwarding (i.e. set /proc/sys/net/ipv4/ip_forward
+@@ -709,6 +739,9 @@
+ Disable Address/Control compression in both directions (send and
+ receive).
+ .TP
++.B need-peer-eap
++(EAP-TLS) Require the peer to verify our authentication credentials.
++.TP
+ .B noauth
+ Do not require the peer to authenticate itself.  This option is
+ privileged.
+diff -Naur ppp-2.4.7/pppd/pppd.h ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.h
+--- ppp-2.4.7/pppd/pppd.h	2014-08-09 14:31:39.000000000 +0200
++++ ppp-2.4.7-eaptls-mppe-1.101b/pppd/pppd.h	2018-06-02 01:42:04.025165427 +0200
+@@ -325,6 +325,11 @@
+ extern bool	dryrun;		/* check everything, print options, exit */
+ extern int	child_wait;	/* # seconds to wait for children at end */
+ 
++#ifdef USE_EAPTLS
++extern char	*crl_dir;
++extern char	*crl_file;
++#endif /* USE_EAPTLS */
++
+ #ifdef MAXOCTETS
+ extern unsigned int maxoctets;	     /* Maximum octetes per session (in bytes) */
+ extern int       maxoctets_dir;      /* Direction :
+@@ -741,6 +746,10 @@
+ extern int (*chap_passwd_hook) __P((char *user, char *passwd));
+ extern void (*multilink_join_hook) __P((void));
+ 
++#ifdef USE_EAPTLS
++extern int (*eaptls_passwd_hook) __P((char *user, char *passwd));
++#endif
++
+ /* Let a plugin snoop sent and received packets.  Useful for L2TP */
+ extern void (*snoop_recv_hook) __P((unsigned char *p, int len));
+ extern void (*snoop_send_hook) __P((unsigned char *p, int len));
+
+
+
diff --git a/user/ppp/85_all_dhcp-make-vars.patch b/user/ppp/85_all_dhcp-make-vars.patch
new file mode 100644
index 000000000..68af3aaf3
--- /dev/null
+++ b/user/ppp/85_all_dhcp-make-vars.patch
@@ -0,0 +1,19 @@
+--- ppp-2.4.3/pppd/plugins/dhcp/Makefile.linux
++++ ppp-2.4.3/pppd/plugins/dhcp/Makefile.linux
+@@ -1,6 +1,6 @@
+ 
+ PLUGIN=dhcpc.so
+-CFLAGS=-I../.. -I../../../include -O2
++CFLAGS=$(COPTS) -I../.. -I../../../include -fPIC
+ 
+ all: $(PLUGIN)
+ 
+@@ -9,7 +9,7 @@
+ 	$(INSTALL) -s -c -m 755 dhcpc.so $(LIBDIR)
+ 
+ dhcpc.so: dhcpc.o clientpacket.o packet.o socket.o options.o 
+-	gcc -o dhcpc.so -shared dhcpc.o clientpacket.o packet.o socket.o options.o
++	$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
+ 
+ 
+ clean:
diff --git a/user/ppp/86_all_dhcp-sys_error_to_strerror.patch b/user/ppp/86_all_dhcp-sys_error_to_strerror.patch
new file mode 100644
index 000000000..e0d0937b2
--- /dev/null
+++ b/user/ppp/86_all_dhcp-sys_error_to_strerror.patch
@@ -0,0 +1,128 @@
+--- ppp-2.4.2/pppd/plugins/dhcp/dhcpc.c
++++ ppp-2.4.2/pppd/plugins/dhcp/dhcpc.c
+@@ -144,7 +144,7 @@
+     fd = raw_socket(client_config.ifindex);
+   
+   if (listen_mode != LISTEN_NONE && fd < 0) {
+-    fatal("DHCPC: couldn't listen on socket, %s", sys_errlist[errno]);
++    fatal("DHCPC: couldn't listen on socket, %s", strerror(errno));
+   }
+   
+ }
+@@ -208,7 +208,7 @@
+     len = get_packet(&packet, fd);
+     
+     if (len == -1 && errno != EINTR) {
+-      dbglog("DHCPC: error on read, %s, reopening socket", sys_errlist[errno]);
++      dbglog("DHCPC: error on read, %s, reopening socket", strerror(errno));
+       change_mode(LISTEN_KERNEL);
+     }
+     if (len < 0) continue;
+@@ -380,7 +380,7 @@
+       else len = get_raw_packet(&packet, fd);
+       
+       if (len == -1 && errno != EINTR) {
+-	dbglog("DHCPC: error on read, %s, reopening socket", sys_errlist[errno]);
++	dbglog("DHCPC: error on read, %s, reopening socket", strerror(errno));
+ 	change_mode(listen_mode); /* just close and reopen */
+       }
+       if (len < 0) continue;
+@@ -445,7 +445,7 @@
+       
+     } else {
+       /* An error occured */
+-        dbglog("DHCPC: error on select, %s, reopening socket", sys_errlist[errno]);
++        dbglog("DHCPC: error on select, %s, reopening socket", strerror(errno));
+         change_mode(listen_mode); /* just close and reopen */
+     }
+     
+--- ppp-2.4.2/pppd/plugins/dhcp/packet.c
++++ ppp-2.4.2/pppd/plugins/dhcp/packet.c
+@@ -125,7 +125,7 @@
+ 	    return kernel_packet(payload,payload->giaddr,CLIENT_PORT,dest_ip,dest_port);
+ 	
+ 	if ((fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))) < 0) {
+-		DEBUG(LOG_ERR, "socket call failed: %s", sys_errlist[errno]);
++		DEBUG(LOG_ERR, "socket call failed: %s", strerror(errno));
+ 		return -1;
+ 	}
+ 	
+@@ -138,7 +138,7 @@
+ 	dest.sll_halen = 6;
+ 	memcpy(dest.sll_addr, dest_arp, 6);
+ 	if (bind(fd, (struct sockaddr *)&dest, sizeof(struct sockaddr_ll)) < 0) {
+-		DEBUG(LOG_ERR, "bind call failed: %s", sys_errlist[errno]);
++		DEBUG(LOG_ERR, "bind call failed: %s", strerror(errno));
+ 		close(fd);
+ 		return -1;
+ 	}
+@@ -161,7 +161,7 @@
+ 
+ 	result = sendto(fd, &packet, sizeof(struct udp_dhcp_packet), 0, (struct sockaddr *) &dest, sizeof(dest));
+ 	if (result <= 0) {
+-		DEBUG(LOG_ERR, "write on socket failed: %s", sys_errlist[errno]);
++		DEBUG(LOG_ERR, "write on socket failed: %s", strerror(errno));
+ 	}
+ 	close(fd);
+ 	return result;
+--- ppp-2.4.2/pppd/plugins/dhcp/socket.c
++++ ppp-2.4.2/pppd/plugins/dhcp/socket.c
+@@ -60,7 +60,7 @@
+ 				*addr = sin->sin_addr.s_addr;
+ 				DEBUG(LOG_INFO, "%s (our ip) = %s", ifr.ifr_name, inet_ntoa(sin->sin_addr));
+ 			} else {
+-				LOG(LOG_ERR, "SIOCGIFADDR failed!: %s", sys_errlist[errno]);
++				LOG(LOG_ERR, "SIOCGIFADDR failed!: %s", strerror(errno));
+ 				return -1;
+ 			}
+ 		}
+@@ -69,7 +69,7 @@
+ 			DEBUG(LOG_INFO, "adapter index %d", ifr.ifr_ifindex);
+ 			*ifindex = ifr.ifr_ifindex;
+ 		} else {
+-			LOG(LOG_ERR, "SIOCGIFINDEX failed!: %s", sys_errlist[errno]);
++			LOG(LOG_ERR, "SIOCGIFINDEX failed!: %s", strerror(errno));
+ 			return -1;
+ 		}
+ 		if (ioctl(fd, SIOCGIFHWADDR, &ifr) == 0) {
+@@ -77,11 +77,11 @@
+ 			DEBUG(LOG_INFO, "adapter hardware address %02x:%02x:%02x:%02x:%02x:%02x",
+ 				arp[0], arp[1], arp[2], arp[3], arp[4], arp[5]);
+ 		} else {
+-			LOG(LOG_ERR, "SIOCGIFHWADDR failed!: %s", sys_errlist[errno]);
++			LOG(LOG_ERR, "SIOCGIFHWADDR failed!: %s", strerror(errno));
+ 			return -1;
+ 		}
+ 	} else {
+-		LOG(LOG_ERR, "socket failed!: %s", sys_errlist[errno]);
++		LOG(LOG_ERR, "socket failed!: %s", strerror(errno));
+ 		return -1;
+ 	}
+ 	close(fd);
+@@ -98,7 +98,7 @@
+ 
+ 	DEBUG(LOG_INFO, "Opening listen socket on 0x%08x:%d %s\n", ip, port, inf ? inf : "*");
+ 	if ((fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) {
+-		DEBUG(LOG_ERR, "socket call failed: %s", sys_errlist[errno]);
++		DEBUG(LOG_ERR, "socket call failed: %s", strerror(errno));
+ 		return -1;
+ 	}
+ 
+@@ -144,7 +144,7 @@
+ 
+ 	DEBUG(LOG_INFO, "Opening raw socket on ifindex %d\n", ifindex);
+ 	if ((fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))) < 0) {
+-		DEBUG(LOG_ERR, "socket call failed: %s", sys_errlist[errno]);
++		DEBUG(LOG_ERR, "socket call failed: %s", strerror(errno));
+ 		return -1;
+ 	}
+ 	
+@@ -152,7 +152,7 @@
+ 	sock.sll_protocol = htons(ETH_P_IP);
+ 	sock.sll_ifindex = ifindex;
+ 	if (bind(fd, (struct sockaddr *) &sock, sizeof(sock)) < 0) {
+-		DEBUG(LOG_ERR, "bind call failed: %s", sys_errlist[errno]);
++		DEBUG(LOG_ERR, "bind call failed: %s", strerror(errno));
+ 		close(fd);
+ 		return -1;
+ 	}
diff --git a/user/ppp/APKBUILD b/user/ppp/APKBUILD
new file mode 100644
index 000000000..bcd4c85cf
--- /dev/null
+++ b/user/ppp/APKBUILD
@@ -0,0 +1,125 @@
+# Contributor: A. Wilcox <awilfox@adelielinux.org>
+# Maintainer: A. Wilcox <awilfox@adelielinux.org>
+pkgname=ppp
+pkgver=2.4.7
+pkgrel=0
+pkgdesc="Point-to-Point Protocol (PPP) implementation for serial networking"
+url="https://ppp.samba.org/"
+arch="all"
+options="!check"  # No test suite.
+license="BSD-4-Clause AND GPL-2.0-only AND GPL-2.0+ AND zlib AND LGPL-2.0+"
+depends=""
+makedepends="bsd-compat-headers linux-pam-dev libpcap-dev openssl-dev utmps-dev"
+subpackages="$pkgname-dev $pkgname-doc $pkgname-openrc"
+source="https://download.samba.org/pub/ppp/ppp-$pkgver.tar.gz
+	http://distfiles.gentoo.org/distfiles/ppp-dhcpc.tgz
+	02_all_make-vars.patch
+	03_all_use_internal_logwtmp.patch
+	04_all_mpls.patch
+	06_all_killaddr-smarter.patch
+	08_all_wait-children.patch
+	10_all_defaultgateway.patch
+	12_all_linkpidfile.patch
+	16_all_auth-fail.patch
+	18_all_defaultmetric.patch
+	19_all_radius_pid_overflow.patch
+	20_all_dev-ppp.patch
+	21_all_custom_iface_names.patch
+	24_all_passwordfd-read-early.patch
+	26_all_pppd-usepeerwins.patch
+	28_all_connect-errors.patch
+	30_all_Makefile.patch
+	32_all_pado-timeout.patch
+	34_all_lcp-echo-adaptive.patch
+	50_all_linux-headers.patch
+	51_all_glibc-2.28.patch
+	80_all_eaptls-mppe-1.101a.patch
+	85_all_dhcp-make-vars.patch
+	86_all_dhcp-sys_error_to_strerror.patch
+	adelie.patch
+	dhcp.patch
+	install-path.patch
+	musl-fix-headers.patch
+	utmpx.patch
+
+	ppp.mod
+	ppp.pamd
+	pppd.initd
+	"
+
+prepare() {
+	mv "$srcdir"/dhcp "$builddir"/pppd/plugins
+	default_prepare
+}
+
+build() {
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var
+	make COPTS="$CFLAGS -D_GNU_SOURCE" \
+		LIBS="-lutmps -lskarnet -lcrypto -lssl -lpam -lpcap"
+	make -C contrib/pppgetpass pppgetpass.vt
+}
+
+package() {
+	make INSTROOT="$pkgdir" install
+
+	install -Dm 0644 -t "$pkgdir"/usr/include/net/ include/net/ppp_defs.h
+
+	install -d "$pkgdir"/etc/ppp/peers
+	install -m 0600 etc.ppp/pap-secrets \
+		"$pkgdir"/etc/ppp/pap-secrets.example
+	install -m 0600 etc.ppp/chap-secrets \
+		"$pkgdir"/etc/ppp/chap-secrets.example
+	install -m 0644 etc.ppp/options "$pkgdir"/etc/ppp/options
+
+	install -Dm 0644 "$srcdir"/ppp.pamd "$pkgdir"/etc/pam.d/ppp
+	install -Dm 0755 -t "$pkgdir"/usr/bin/ scripts/p{on,off,log}
+	install -Dm 0644 -t "$pkgdir"/usr/share/man/man1/ scripts/pon.1
+
+	install -Dm 0755 contrib/pppgetpass/pppgetpass.vt \
+		"$pkgdir"/usr/sbin/pppgetpass
+	install -Dm 0644 -t "$pkgdir"/usr/share/man/man8/ \
+		contrib/pppgetpass/pppgetpass.8
+
+	install -Dm 0644 "$srcdir"/ppp.mod "$pkgdir"/etc/modprobe.d/ppp.conf
+	install -Dm 0755 "$srcdir"/pppd.initd "$pkgdir"/etc/init.d/pppd
+}
+
+sha512sums="e34ce24020af6a73e7a26c83c4f73a9c83fa455b7b363794dba27bf01f70368be06bff779777843949bd77f4bc9385d6ad455ea48bf8fff4e0d73cc8fef16ae2  ppp-2.4.7.tar.gz
+aeaf791b14f5a09c0e2079072a157e65132cbff46e608bc0724e6a5827a01da934f5006e2774eb7105f83e607a52cb4987238f4385cf6f5cc86cbe305a556738  ppp-dhcpc.tgz
+8444d7edfe902a83f6cce96d29b9b7fb45ac68bdbe44494797d2a98470b80017489d36feb50cf945cbe72486bac69f45b23790e15cfbd33e07913a857ee80ab7  02_all_make-vars.patch
+4c4a5cc6fd8ce3203c41ff07fc0ce5f0468985c779fe05030898d36c404d2086ce7a49336ac58e6502fc2fd14c4de9006028fe19c500d2cac890a16a55c723e8  03_all_use_internal_logwtmp.patch
+1d63795949da00a19712aef39a54f338183b6917b246083e04a0b9ee43d346af5adeeb9357cb165587722790fa19b13375d55008646a4e9e2acdf8724bf3c7cc  04_all_mpls.patch
+b49086401c1b395ee6caba0418272b2d1b2ab9dcf6f1fc7e7f1280e94fcf17c8fdb884a19f4ef911bd7849a9cceb4cc07fc75438726340cd8c17265d4c2bd4d8  06_all_killaddr-smarter.patch
+807707ee9795ef4300b92bacdeba6b9e7332b6ce5a355de3ce77ddcc6dafce069f024131fd3ef282e38be3499e4230ad50fdda2b96e00891f5df1696234b775b  08_all_wait-children.patch
+c084237458ceb8704541f6e8424855788dbc2883559c4bf1ff35060e277c2b2ddfadcdb6dedc0bf42a5e83e98cfe7241fae8f6dc59d1ed963ed50356c9fd83ed  10_all_defaultgateway.patch
+122b9e3dbc3a9accacb31c653b3c0d368e8cdf3d954a6c93d04ac26ca8f3cb5bfcf8a01881d1cf08e855a1d2d0bd86e7fadba22bb5ada1a86f78e6b9820e6687  12_all_linkpidfile.patch
+3a23ef3619b2840eb3f1f7e14bd4765526b09acdfa8ab4d659ad8525a6f96d0cfb7c9fef042cde99ba1de8cf5caa74faa32e2a988453b4b17a70d5cc9a4bcf41  16_all_auth-fail.patch
+24b2cf579844bb9e1c0360227a5d35c3510471c0de6f16031d5e192d0ae7b1913aba93c2d99ea5fd3724deb6754f9831c1adb30671a31617268c77c65fc8beaf  18_all_defaultmetric.patch
+9fdb3346ef13b250f91f1af55c0efa0f836a60abe9e62fceed30df4e431a3bccdd33b083c2662c45e2091085438ba2221cdc4ae51fc1b05a666d77f74d461214  19_all_radius_pid_overflow.patch
+82c80701095a2d9707afbf5fc29bdf2fc3f92252b7de5de1d639f8607096a9d34ce90ffd0a2f770512b590a27dec56f2b03e5e9f4c9e56e1f362a2387d9fb568  20_all_dev-ppp.patch
+314e0939b546af5229db34888284a06e07d7b4c94190bf95d4382d3ff39935f18ecc6172f62309e4f63a00fdfceca73d908da8d82c95fd0b926b1832968ee3cc  21_all_custom_iface_names.patch
+2508cf1285a086c917ba5deffc96c1c29a511f1c1a0ef94c811b2bf139aed0218f34d7c1f1004890e105c47dffc5834a049dbe7686611d0fc8b8607ccdc86105  24_all_passwordfd-read-early.patch
+3eb55fb681e7fecf4e09b53683f509d2db3779599dd60fb89f88cd644c92d779f4720114546ba458262e8239581061e4a450143338c4725ada18b7ca314e12b0  26_all_pppd-usepeerwins.patch
+2e0bd81124bcd7c1234089f11e0b607b19047d279dc436ced3a4b8d793bcee4fcececd948b6a0755a02f68542c5c5e30b6f8541f90b998c09da8d50362827520  28_all_connect-errors.patch
+e495a489ee98258a3a4549127faca2c41feff27dff296065c2e41bfc696ced2ad1062ea0aa5bf3cc2425c85b4494ebbcbaaabacd8a3ea8ce8fab28acea028336  30_all_Makefile.patch
+77c0585b46f4fc090a67198d800d67dab2ce75eadcf2153c6e800e274b53ced6b512fd6eb4767c632f765bacd6c332f8d2a68233abb3781d6c62321d6bbb6052  32_all_pado-timeout.patch
+0bd928f45708f10835250fd6a6162f6e148dca172c810511c1f4b1fe56602c4869e7f622e95a3f4a41e5502ddefd0cf6054cd57211bc83426d5da5b5f10dac26  34_all_lcp-echo-adaptive.patch
+cda8e347eef7f26589cf1a12243f4d77de34d5736e3cb04fda9063adc0d931ef7ec7dbb2f142f1dfabc6d3ee04a252d2dd67d2c99ad9c01f2bd343bec88abe97  50_all_linux-headers.patch
+fc012971a062456fa4e253f5b4a5e2ce56ae1852293d0245ecfd165ba162fa76ec2c28e1035dd89de3e9d43941d528e2d95a40552eb8037a5ba084c1717c20d1  51_all_glibc-2.28.patch
+977b247e87557c4c57a871470c40670457e285ca59357dabab854ab16cc5578526ddf880410aa2efc7078e16d32d7afea4b69928af14ac4449523f6a591284f1  80_all_eaptls-mppe-1.101a.patch
+2d294bfe455648949cedb47a12a07913f0395aadbe2566c1e90d70fc37baa8635a667ab45195a697567f8d52de88771c499adffee82cde2e9e318ed858b6007b  85_all_dhcp-make-vars.patch
+44d5528c057d0abf2b45ba04943a52b6b94209434a06aa565f8a74acdd660efd86fe13280d540383168eaedad9f627673410bb8468860b64adb3145030e12889  86_all_dhcp-sys_error_to_strerror.patch
+2ba9ba8856e569c204a0e058a3e7a4a74f331118cb33bbca445a87b54bb0e4f0da2a968df5f394633911603359284831a80a4d9c793d795eef8477d00bab63f1  adelie.patch
+6d38f9779945bce2277f2d52d66dd79d2696f02c44186e1750d236f2d77d692746a8e8c164d925d5bb32dbfd02a723cabb59304f05954e0b5f7adada208ee220  dhcp.patch
+fb4ae2c2ba4ecdd1c85f6e5f730fd9659cf1fbc7a8a004b09042adafee7e4af6238df8deb3dbd3dc9c69407d9ebc4c82e1792a43b4aaf8ac18ebe18268b50597  install-path.patch
+2f071ea9db15e4abf1bed6cce8130dc81b710a31bfef5fa8f9370c353f845dbc47674b1551b8e040478e5156add6f98d480530206125e8bb308f0f4288d1eec6  musl-fix-headers.patch
+723ff3dd0aee13f9878559aa433b314af6043523a2bafd5957258809a645942f7d34b5bd659869a1528cf7b1a462ad7cc2dbf18e7986220f5f685f2c1ea1d36b  utmpx.patch
+58bf5d6d286a08bd6dd595b39ee425efedd5745dddf33a9c90505891546eb46f4cf1306d83911bef61bc4611816aa0f6aef5d3e0f14c2f4ddd0a588780570041  ppp.mod
+e30a397392d467ac3c78f6533f3adff5de7d38f0372d8d6f7b186db4ec69ddf12463d467d8a86eb5867effeb7dd6bd16942a98fb3a3ab59ff754a123e16d0938  ppp.pamd
+bd6f43588b037367ffdb57f5e331492dcaa5969003e219c2dc8b90e6be1aa407282ff6114b91d1379ebeff766983fa0622456520cc0ac592b4f0b1496acf21bf  pppd.initd"
diff --git a/user/ppp/adelie.patch b/user/ppp/adelie.patch
new file mode 100644
index 000000000..06bb6edf9
--- /dev/null
+++ b/user/ppp/adelie.patch
@@ -0,0 +1,88 @@
+--- ppp-2.4.7/pppd/Makefile.linux.old	2019-05-09 20:32:30.959257140 +0000
++++ ppp-2.4.7/pppd/Makefile.linux	2019-05-09 20:34:48.964184093 +0000
+@@ -32,7 +32,7 @@
+ 
+ # CC = gcc
+ #
+-COPTS+= -Wall
++COPTS+= -Wall -D_GNU_SOURCE
+ LIBS =
+ 
+ # Uncomment the next line to include support for Microsoft's
+@@ -61,14 +61,14 @@
+ USE_TDB=y
+ 
+ HAS_SHADOW=y
+-#USE_PAM=y
++USE_PAM=y
+ HAVE_INET6=y
+ 
+ # Enable plugins
+ PLUGIN=y
+ 
+ # Enable Microsoft proprietary Callback Control Protocol
+-#CBCP=y
++CBCP=y
+ 
+ # Enable EAP SRP-SHA1 authentication (requires libsrp)
+ #USE_SRP=y
+@@ -102,8 +102,8 @@
+ 
+ # EAP SRP-SHA1
+ ifdef USE_SRP
+-CFLAGS	+= -DUSE_SRP -DOPENSSL -I/usr/local/ssl/include
+-LIBS	+= -lsrp -L/usr/local/ssl/lib -lcrypto
++CFLAGS	+= -DUSE_SRP -DOPENSSL
++LIBS	+= -lsrp `$(PKG_CONFIG) --libs libcrypto`
+ TARGETS	+= srp-entry
+ EXTRAINSTALL = $(INSTALL) -s -c -m 555 srp-entry $(BINDIR)/srp-entry
+ MANPAGES += srp-entry.8
+--- ppp-2.4.7/pppd/plugins/radius/pathnames.h.old	2014-08-09 12:31:39.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/radius/pathnames.h	2019-05-09 20:35:39.258690873 +0000
+@@ -22,7 +22,7 @@
+ 
+ /* normally defined in the Makefile */
+ #ifndef _PATH_ETC_RADIUSCLIENT_CONF
+-#define _PATH_ETC_RADIUSCLIENT_CONF       "/etc/radiusclient.conf"
++#define _PATH_ETC_RADIUSCLIENT_CONF       "/etc/radiusclient/radiusclient.conf"
+ #endif
+ 
+ #endif /* PATHNAMES_H */
+--- ppp-2.4.7/pppd/plugins/radius/etc/radiusclient.conf.old	2014-08-09 12:31:39.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/radius/etc/radiusclient.conf	2019-05-09 20:37:29.676630906 +0000
+@@ -22,7 +22,7 @@
+ 
+ # name of the issue file. it's only display when no username is passed
+ # on the radlogin command line  (default /etc/radiusclient/issue)
+-issue	/usr/local/etc/radiusclient/issue
++issue	/etc/radiusclient/issue
+ 
+ # RADIUS settings
+ 
+@@ -43,22 +43,22 @@
+ 
+ # file holding shared secrets used for the communication
+ # between the RADIUS client and server
+-servers		/usr/local/etc/radiusclient/servers
++servers		/etc/radiusclient/servers
+ 
+ # dictionary of allowed attributes and values
+ # just like in the normal RADIUS distributions
+-dictionary 	/usr/local/etc/radiusclient/dictionary
++dictionary 	/etc/radiusclient/dictionary
+ 
+ # program to call for a RADIUS authenticated login 
+ # (default /usr/sbin/login.radius)
+-login_radius	/usr/local/sbin/login.radius
++login_radius	/usr/sbin/login.radius
+ 
+ # file which holds sequence number for communication with the
+ # RADIUS server
+ seqfile		/var/run/radius.seq
+ 
+ # file which specifies mapping between ttyname and NAS-Port attribute
+-mapfile		/usr/local/etc/radiusclient/port-id-map
++mapfile		/etc/radiusclient/port-id-map
+ 
+ # default authentication realm to append to all usernames if no
+ # realm was explicitly specified by the user
diff --git a/user/ppp/dhcp.patch b/user/ppp/dhcp.patch
new file mode 100644
index 000000000..611882326
--- /dev/null
+++ b/user/ppp/dhcp.patch
@@ -0,0 +1,324 @@
+--- ppp-2.4.7/pppd/plugins/Makefile.linux.old	2019-05-09 23:06:56.499058276 +0000
++++ ppp-2.4.7/pppd/plugins/Makefile.linux	2019-05-09 23:11:21.040252628 +0000
+@@ -16,7 +16,7 @@
+ MANDIR = $(DESTDIR)/share/man/man8
+ LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION)
+ 
+-SUBDIRS := rp-pppoe pppoatm pppol2tp
++SUBDIRS := dhcp rp-pppoe pppoatm pppol2tp
+ # Uncomment the next line to include the radius authentication plugin
+ SUBDIRS += radius
+ PLUGINS := minconn.so passprompt.so passwordfd.so winbind.so
+--- ppp-2.4.7/pppd/plugins/dhcp/README.old	2002-09-30 11:33:49.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/README	2019-05-09 23:11:37.408470308 +0000
+@@ -37,7 +37,7 @@
+ 
+         This option specified the local IP address of the system running
+         this proxy, as should be identified to the DHCP server in the
+-        'giaddr' field of DHCP requests.  Normal server behavor should
++        'giaddr' field of DHCP requests.  Normal server behaviour should
+         be to send DHCP responses to this address.  The default is the 
+         primary address bound to the dhcp interface.
+ 
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/clientpacket.c ppp-2.4.7/pppd/plugins/dhcp/clientpacket.c
+--- ppp-2.4.7/pppd/plugins/dhcp.old/clientpacket.c	2002-08-31 12:19:20.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/clientpacket.c	2019-05-09 23:42:33.566347764 +0000
+@@ -179,8 +179,8 @@
+ {
+ 	int bytes;
+ 	struct udp_dhcp_packet packet;
+-	u_int32_t source, dest;
+-	u_int16_t check;
++	uint32_t source, dest;
++	uint16_t check;
+ 
+ 	memset(&packet, 0, sizeof(struct udp_dhcp_packet));
+ 	bytes = read(fd, &packet, sizeof(struct udp_dhcp_packet));
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/dhcpc.c ppp-2.4.7/pppd/plugins/dhcp/dhcpc.c
+--- ppp-2.4.7/pppd/plugins/dhcp.old/dhcpc.c	2019-05-09 23:41:38.732319544 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/dhcpc.c	2019-05-09 23:42:33.566347764 +0000
+@@ -56,11 +56,11 @@
+ #include "socket.h"
+ #include "debug.h"
+ 
+-static void (*dhcp_old_ip_choose_hook)(u_int32_t *addrp);
++static void (*dhcp_old_ip_choose_hook)(uint32_t *addrp);
+ 
+ static int dhcp_state;
+-static u_int32_t requested_ip; /* = 0 */
+-u_int32_t assigned_ip; /* value supplied to remote ppp */
++static uint32_t requested_ip; /* = 0 */
++uint32_t assigned_ip; /* value supplied to remote ppp */
+ static unsigned long server_addr;
+ unsigned long lease, renew_timeout;
+ unsigned long xid = 0;
+@@ -118,7 +118,7 @@
+ void dhcp_release(void *ptr, int arg);
+ void dhcp_renew(void *dummy);
+ void dhcp_request_new();
+-void dhcp_ip_choose(u_int32_t *addrp);
++void dhcp_ip_choose(uint32_t *addrp);
+ void dhcp_read_options(void);
+ 
+ 
+@@ -453,8 +453,8 @@
+   return;
+ }
+ 
+-void dhcp_ip_choose(u_int32_t *addrp) {
+-  u_int32_t entryvalue;
++void dhcp_ip_choose(uint32_t *addrp) {
++  uint32_t entryvalue;
+ 
+   dbglog("DHCPC: ip_choose_hook entered with peer name %s",peer_authname);
+ 
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/dhcpc.h ppp-2.4.7/pppd/plugins/dhcp/dhcpc.h
+--- ppp-2.4.7/pppd/plugins/dhcp.old/dhcpc.h	2002-08-31 11:54:23.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/dhcpc.h	2019-05-09 23:42:33.566347764 +0000
+@@ -24,9 +24,9 @@
+ 	unsigned char *hostname;	/* Optional hostname to use */
+ 	int ifindex;			/* Index number of the interface to use */
+ 	unsigned char arp[6];		/* Our arp address */
+-        u_int32_t giaddr;    /* Fill in this value on all packets we generate */
+-        u_int32_t siaddr;    /* If defined, only talk to this server (never broadcast) */
+-  u_int32_t subnet_selection; /* If non zero, send and require SS option */
++        uint32_t giaddr;    /* Fill in this value on all packets we generate */
++        uint32_t siaddr;    /* If defined, only talk to this server (never broadcast) */
++  uint32_t subnet_selection; /* If non zero, send and require SS option */
+ };
+ 
+ extern struct client_config_t client_config;
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/dhcpd.h ppp-2.4.7/pppd/plugins/dhcp/dhcpd.h
+--- ppp-2.4.7/pppd/plugins/dhcp.old/dhcpd.h	2002-08-31 11:52:31.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/dhcpd.h	2019-05-09 23:42:33.566347764 +0000
+@@ -101,9 +101,9 @@
+ };
+ 
+ struct server_config_t {
+-	u_int32_t server;		/* Our IP, in network order */
+-	u_int32_t start;		/* Start address of leases, network order */
+-	u_int32_t end;			/* End of leases, network order */
++	uint32_t server;		/* Our IP, in network order */
++	uint32_t start;		/* Start address of leases, network order */
++	uint32_t end;			/* End of leases, network order */
+ 	struct option_set *options;	/* List of DHCP options loaded from the config file */
+ 	char *interface;		/* The name of the interface to use */
+ 	int ifindex;			/* Index number of the interface to use */
+@@ -122,7 +122,7 @@
+ 	char *lease_file;
+ 	char *pidfile;
+ 	char *notify_file;		/* What to run whenever leases are written */
+-	u_int32_t siaddr;		/* next server bootp option */
++	uint32_t siaddr;		/* next server bootp option */
+ 	char *sname;			/* bootp server name */
+ 	char *boot_file;		/* bootp boot file option */
+ };	
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/leases.h ppp-2.4.7/pppd/plugins/dhcp/leases.h
+--- ppp-2.4.7/pppd/plugins/dhcp.old/leases.h	2002-08-23 13:17:14.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/leases.h	2019-05-09 23:42:33.566347764 +0000
+@@ -4,20 +4,20 @@
+ 
+ 
+ struct dhcpOfferedAddr {
+-	u_int8_t chaddr[16];
+-	u_int32_t yiaddr;	/* network order */
+-	u_int32_t expires;	/* host order */
++	uint8_t chaddr[16];
++	uint32_t yiaddr;	/* network order */
++	uint32_t expires;	/* host order */
+ };
+ 
+ 
+-void clear_lease(u_int8_t *chaddr, u_int32_t yiaddr);
+-struct dhcpOfferedAddr *add_lease(u_int8_t *chaddr, u_int32_t yiaddr, unsigned long lease);
++void clear_lease(uint8_t *chaddr, uint32_t yiaddr);
++struct dhcpOfferedAddr *add_lease(uint8_t *chaddr, uint32_t yiaddr, unsigned long lease);
+ int lease_expired(struct dhcpOfferedAddr *lease);
+ struct dhcpOfferedAddr *oldest_expired_lease(void);
+-struct dhcpOfferedAddr *find_lease_by_chaddr(u_int8_t *chaddr);
+-struct dhcpOfferedAddr *find_lease_by_yiaddr(u_int32_t yiaddr);
+-u_int32_t find_address(int check_expired);
+-int check_ip(u_int32_t addr);
++struct dhcpOfferedAddr *find_lease_by_chaddr(uint8_t *chaddr);
++struct dhcpOfferedAddr *find_lease_by_yiaddr(uint32_t yiaddr);
++uint32_t find_address(int check_expired);
++int check_ip(uint32_t addr);
+ 
+ 
+ #endif
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/options.c ppp-2.4.7/pppd/plugins/dhcp/options.c
+--- ppp-2.4.7/pppd/plugins/dhcp.old/options.c	2002-08-31 11:52:37.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/options.c	2019-05-09 23:42:33.566347764 +0000
+@@ -148,17 +148,17 @@
+ 
+ 
+ /* add a one to four byte option to a packet */
+-int add_simple_option(unsigned char *optionptr, unsigned char code, u_int32_t data)
++int add_simple_option(unsigned char *optionptr, unsigned char code, uint32_t data)
+ {
+ 	char length = 0;
+ 	int i;
+ 	unsigned char option[2 + 4];
+ 	unsigned char *u8;
+-	u_int16_t *u16;
+-	u_int32_t *u32;
+-	u_int32_t aligned;
++	uint16_t *u16;
++	uint32_t *u32;
++	uint32_t aligned;
+ 	u8 = (unsigned char *) &aligned;
+-	u16 = (u_int16_t *) &aligned;
++	u16 = (uint16_t *) &aligned;
+ 	u32 = &aligned;
+ 
+ 	for (i = 0; options[i].code; i++)
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/options.h ppp-2.4.7/pppd/plugins/dhcp/options.h
+--- ppp-2.4.7/pppd/plugins/dhcp.old/options.h	2002-08-23 13:06:28.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/options.h	2019-05-09 23:42:33.566347764 +0000
+@@ -33,7 +33,7 @@
+ unsigned char *get_option(struct dhcpMessage *packet, int code);
+ int end_option(unsigned char *optionptr);
+ int add_option_string(unsigned char *optionptr, unsigned char *string);
+-int add_simple_option(unsigned char *optionptr, unsigned char code, u_int32_t data);
++int add_simple_option(unsigned char *optionptr, unsigned char code, uint32_t data);
+ struct option_set *find_option(struct option_set *opt_list, char code);
+ void attach_option(struct option_set **opt_list, struct dhcp_option *option, char *buffer, int length);
+ 
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/packet.c ppp-2.4.7/pppd/plugins/dhcp/packet.c
+--- ppp-2.4.7/pppd/plugins/dhcp.old/packet.c	2019-05-09 23:41:38.732319544 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/packet.c	2019-05-09 23:42:33.566347764 +0000
+@@ -83,13 +83,13 @@
+ }
+ 
+ 
+-u_int16_t checksum(void *addr, int count)
++uint16_t checksum(void *addr, int count)
+ {
+ 	/* Compute Internet Checksum for "count" bytes
+ 	 *         beginning at location "addr".
+ 	 */
+ 	register int32_t sum = 0;
+-	u_int16_t *source = (u_int16_t *) addr;
++	uint16_t *source = (uint16_t *) addr;
+ 
+ 	while( count > 1 )  {
+ 		/*  This is the inner loop */
+@@ -110,8 +110,8 @@
+ 
+ 
+ /* Constuct a ip/udp header for a packet, and specify the source and dest hardware address */
+-int raw_packet(struct dhcpMessage *payload, u_int32_t source_ip, int source_port,
+-		   u_int32_t dest_ip, int dest_port, unsigned char *dest_arp, int ifindex)
++int raw_packet(struct dhcpMessage *payload, uint32_t source_ip, int source_port,
++		   uint32_t dest_ip, int dest_port, unsigned char *dest_arp, int ifindex)
+ {
+ 	int fd;
+ 	int result;
+@@ -169,8 +169,8 @@
+ 
+ 
+ /* Let the kernel do all the work for packet generation */
+-int kernel_packet(struct dhcpMessage *payload, u_int32_t source_ip, int source_port,
+-		   u_int32_t dest_ip, int dest_port)
++int kernel_packet(struct dhcpMessage *payload, uint32_t source_ip, int source_port,
++		   uint32_t dest_ip, int dest_port)
+ {
+ 	int n = 1;
+ 	int fd, result;
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/packet.h ppp-2.4.7/pppd/plugins/dhcp/packet.h
+--- ppp-2.4.7/pppd/plugins/dhcp.old/packet.h	2002-08-23 13:04:56.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/packet.h	2019-05-09 23:42:33.566347764 +0000
+@@ -5,22 +5,22 @@
+ #include <netinet/ip.h>
+ 
+ struct dhcpMessage {
+-	u_int8_t op;
+-	u_int8_t htype;
+-	u_int8_t hlen;
+-	u_int8_t hops;
+-	u_int32_t xid;
+-	u_int16_t secs;
+-	u_int16_t flags;
+-	u_int32_t ciaddr;
+-	u_int32_t yiaddr;
+-	u_int32_t siaddr;
+-	u_int32_t giaddr;
+-	u_int8_t chaddr[16];
+-	u_int8_t sname[64];
+-	u_int8_t file[128];
+-	u_int32_t cookie;
+-	u_int8_t options[308]; /* 312 - cookie */ 
++	uint8_t op;
++	uint8_t htype;
++	uint8_t hlen;
++	uint8_t hops;
++	uint32_t xid;
++	uint16_t secs;
++	uint16_t flags;
++	uint32_t ciaddr;
++	uint32_t yiaddr;
++	uint32_t siaddr;
++	uint32_t giaddr;
++	uint8_t chaddr[16];
++	uint8_t sname[64];
++	uint8_t file[128];
++	uint32_t cookie;
++	uint8_t options[308]; /* 312 - cookie */ 
+ };
+ 
+ struct udp_dhcp_packet {
+@@ -31,11 +31,11 @@
+ 
+ void init_header(struct dhcpMessage *packet, char type);
+ int get_packet(struct dhcpMessage *packet, int fd);
+-u_int16_t checksum(void *addr, int count);
+-int raw_packet(struct dhcpMessage *payload, u_int32_t source_ip, int source_port,
+-		   u_int32_t dest_ip, int dest_port, unsigned char *dest_arp, int ifindex);
+-int kernel_packet(struct dhcpMessage *payload, u_int32_t source_ip, int source_port,
+-		   u_int32_t dest_ip, int dest_port);
++uint16_t checksum(void *addr, int count);
++int raw_packet(struct dhcpMessage *payload, uint32_t source_ip, int source_port,
++		   uint32_t dest_ip, int dest_port, unsigned char *dest_arp, int ifindex);
++int kernel_packet(struct dhcpMessage *payload, uint32_t source_ip, int source_port,
++		   uint32_t dest_ip, int dest_port);
+ 
+ 
+ #endif
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/socket.c ppp-2.4.7/pppd/plugins/dhcp/socket.c
+--- ppp-2.4.7/pppd/plugins/dhcp.old/socket.c	2019-05-09 23:41:38.732319544 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/socket.c	2019-05-09 23:42:33.566347764 +0000
+@@ -43,7 +43,7 @@
+ 
+ #include "debug.h"
+ 
+-int read_interface(char *interface, int *ifindex, u_int32_t *addr, unsigned char *arp)
++int read_interface(char *interface, int *ifindex, uint32_t *addr, unsigned char *arp)
+ {
+ 	int fd;
+ 	struct ifreq ifr;
+diff -Naur ppp-2.4.7/pppd/plugins/dhcp.old/socket.h ppp-2.4.7/pppd/plugins/dhcp/socket.h
+--- ppp-2.4.7/pppd/plugins/dhcp.old/socket.h	2002-08-23 13:06:28.000000000 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/socket.h	2019-05-09 23:42:33.566347764 +0000
+@@ -2,7 +2,7 @@
+ #ifndef _SOCKET_H
+ #define _SOCKET_H
+ 
+-int read_interface(char *interface, int *ifindex, u_int32_t *addr, unsigned char *arp);
++int read_interface(char *interface, int *ifindex, uint32_t *addr, unsigned char *arp);
+ int listen_socket(unsigned int ip, int port, char *inf);
+ int raw_socket(int ifindex);
+ 
+--- ppp-2.4.7/pppd/plugins/dhcp/Makefile.linux.old	2019-05-09 23:54:56.595427092 +0000
++++ ppp-2.4.7/pppd/plugins/dhcp/Makefile.linux	2019-05-09 23:56:53.012746364 +0000
+@@ -1,6 +1,11 @@
+ 
+ PLUGIN=dhcpc.so
+ CFLAGS=$(COPTS) -I../.. -I../../../include -fPIC
++INSTALL = install
++DESTDIR = $(INSTROOT)/usr
++LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION)
++
++VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h)
+ 
+ all: $(PLUGIN)
+ 
diff --git a/user/ppp/install-path.patch b/user/ppp/install-path.patch
new file mode 100644
index 000000000..845729fd5
--- /dev/null
+++ b/user/ppp/install-path.patch
@@ -0,0 +1,11 @@
+--- ppp-2.4.7/pppd/plugins/pppol2tp/Makefile.linux.old	2019-05-09 22:28:24.640793389 +0000
++++ ppp-2.4.7/pppd/plugins/pppol2tp/Makefile.linux	2019-05-09 23:02:56.955142166 +0000
+@@ -4,7 +4,7 @@
+ 
+ #***********************************************************************
+ 
+-DESTDIR = @DESTDIR@
++DESTDIR = $(INSTROOT)@DESTDIR@
+ LIBDIR = $(DESTDIR)/lib/pppd/$(VERSION)
+ 
+ VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' ../../patchlevel.h)
diff --git a/user/ppp/musl-fix-headers.patch b/user/ppp/musl-fix-headers.patch
new file mode 100644
index 000000000..d24f62896
--- /dev/null
+++ b/user/ppp/musl-fix-headers.patch
@@ -0,0 +1,137 @@
+diff --git a/include/net/ppp_defs.h b/include/net/ppp_defs.h
+index b06eda5..dafa36c 100644
+--- a/include/net/ppp_defs.h
++++ b/include/net/ppp_defs.h
+@@ -38,6 +38,8 @@
+ #ifndef _PPP_DEFS_H_
+ #define _PPP_DEFS_H_
+ 
++#include <sys/time.h>
++
+ /*
+  * The basic PPP frame.
+  */
+diff --git a/pppd/Makefile.linux b/pppd/Makefile.linux
+index a74c914..7acd2cf 100644
+--- a/pppd/Makefile.linux
++++ b/pppd/Makefile.linux
+@@ -126,7 +126,7 @@ LIBS	+= -lcrypt
+ endif
+ 
+ ifdef USE_LIBUTIL
+-CFLAGS	+= -DHAVE_LOGWTMP=1
++#CFLAGS	+= -DHAVE_LOGWTMP=1
+ LIBS	+= -lutil
+ endif
+ 
+diff --git a/pppd/magic.h b/pppd/magic.h
+index c81213b..305aece 100644
+--- a/pppd/magic.h
++++ b/pppd/magic.h
+@@ -42,6 +42,8 @@
+  * $Id: magic.h,v 1.5 2003/06/11 23:56:26 paulus Exp $
+  */
+ 
++#include <sys/cdefs.h>
++
+ void magic_init __P((void));	/* Initialize the magic number generator */
+ u_int32_t magic __P((void));	/* Returns the next magic number */
+ 
+diff --git a/pppd/plugins/rp-pppoe/if.c b/pppd/plugins/rp-pppoe/if.c
+index 91e9a57..9c0fac3 100644
+--- a/pppd/plugins/rp-pppoe/if.c
++++ b/pppd/plugins/rp-pppoe/if.c
+@@ -30,10 +30,6 @@ static char const RCSID[] =
+ #include <linux/if_packet.h>
+ #endif
+ 
+-#ifdef HAVE_NET_ETHERNET_H
+-#include <net/ethernet.h>
+-#endif
+-
+ #ifdef HAVE_ASM_TYPES_H
+ #include <asm/types.h>
+ #endif
+diff --git a/pppd/plugins/rp-pppoe/plugin.c b/pppd/plugins/rp-pppoe/plugin.c
+index a8c2bb4..ca34d79 100644
+--- a/pppd/plugins/rp-pppoe/plugin.c
++++ b/pppd/plugins/rp-pppoe/plugin.c
+@@ -46,7 +46,6 @@ static char const RCSID[] =
+ #include <unistd.h>
+ #include <fcntl.h>
+ #include <signal.h>
+-#include <net/ethernet.h>
+ #include <net/if_arp.h>
+ #include <linux/ppp_defs.h>
+ #include <linux/if_pppox.h>
+diff --git a/pppd/plugins/rp-pppoe/pppoe-discovery.c b/pppd/plugins/rp-pppoe/pppoe-discovery.c
+index 3d3bf4e..b5f82d3 100644
+--- a/pppd/plugins/rp-pppoe/pppoe-discovery.c
++++ b/pppd/plugins/rp-pppoe/pppoe-discovery.c
+@@ -27,10 +27,6 @@
+ #include <linux/if_packet.h>
+ #endif
+ 
+-#ifdef HAVE_NET_ETHERNET_H
+-#include <net/ethernet.h>
+-#endif
+-
+ #ifdef HAVE_ASM_TYPES_H
+ #include <asm/types.h>
+ #endif
+@@ -55,6 +51,8 @@ void die(int status)
+ 	exit(status);
+ }
+ 
++#define error(x...) fprintf(stderr, x)
++
+ /* Initialize frame types to RFC 2516 values.  Some broken peers apparently
+    use different frame types... sigh... */
+ 
+diff --git a/pppd/plugins/rp-pppoe/pppoe.h b/pppd/plugins/rp-pppoe/pppoe.h
+index 9ab2eee..4d68147 100644
+--- a/pppd/plugins/rp-pppoe/pppoe.h
++++ b/pppd/plugins/rp-pppoe/pppoe.h
+@@ -86,18 +86,6 @@ typedef unsigned long UINT32_t;
+ 
+ #include <netinet/in.h>
+ 
+-#ifdef HAVE_NETINET_IF_ETHER_H
+-#include <sys/types.h>
+-
+-#ifdef HAVE_SYS_SOCKET_H
+-#include <sys/socket.h>
+-#endif
+-#ifndef HAVE_SYS_DLPI_H
+-#include <netinet/if_ether.h>
+-#endif
+-#endif
+-
+-
+ 
+ /* Ethernet frame types according to RFC 2516 */
+ #define ETH_PPPOE_DISCOVERY 0x8863
+diff --git a/pppd/sys-linux.c b/pppd/sys-linux.c
+index 6d71530..86d224e 100644
+--- a/pppd/sys-linux.c
++++ b/pppd/sys-linux.c
+@@ -102,19 +102,11 @@
+ #define MAX_ADDR_LEN 7
+ #endif
+ 
+-#if __GLIBC__ >= 2
+ #include <asm/types.h>		/* glibc 2 conflicts with linux/types.h */
+ #include <net/if.h>
+ #include <net/if_arp.h>
+ #include <net/route.h>
+ #include <netinet/if_ether.h>
+-#else
+-#include <linux/types.h>
+-#include <linux/if.h>
+-#include <linux/if_arp.h>
+-#include <linux/route.h>
+-#include <linux/if_ether.h>
+-#endif
+ #include <netinet/in.h>
+ #include <arpa/inet.h>
+ 
diff --git a/user/ppp/ppp.mod b/user/ppp/ppp.mod
new file mode 100644
index 000000000..e936041c6
--- /dev/null
+++ b/user/ppp/ppp.mod
@@ -0,0 +1,10 @@
+alias char-major-108	ppp_generic
+alias /dev/ppp		ppp_generic
+alias tty-ldisc-3	ppp_async
+alias tty-ldisc-13	n_hdlc
+alias tty-ldisc-14	ppp_synctty
+alias ppp-compress-18	ppp_mppe
+alias ppp-compress-21	bsd_comp
+alias ppp-compress-24	ppp_deflate
+alias ppp-compress-26	ppp_deflate
+alias net-pf-24		pppoe
diff --git a/user/ppp/ppp.pamd b/user/ppp/ppp.pamd
new file mode 100644
index 000000000..ac86d9512
--- /dev/null
+++ b/user/ppp/ppp.pamd
@@ -0,0 +1,7 @@
+# Welcome to Adélie Linux.
+
+# This file ensures PPP uses the system-wide PAM configuration.
+
+auth		include		base-auth
+account		include		base-account
+session		include		base-session-noninteractive
diff --git a/user/ppp/pppd.initd b/user/ppp/pppd.initd
new file mode 100644
index 000000000..30bd641da
--- /dev/null
+++ b/user/ppp/pppd.initd
@@ -0,0 +1,13 @@
+#!/sbin/openrc-run
+
+name="pppd"
+command="/usr/sbin/${SVCNAME}"
+command_args="nodetach ${PPPD_OPTS}"
+pidfile="/var/run/$SVCNAME.pid"
+command_background=true
+
+start_pre() {
+	checkpath --directory /var/run/ppp
+	modprobe pptp
+}
+
diff --git a/user/ppp/utmpx.patch b/user/ppp/utmpx.patch
new file mode 100644
index 000000000..2914bc4be
--- /dev/null
+++ b/user/ppp/utmpx.patch
@@ -0,0 +1,142 @@
+--- ppp-2.4.7/pppd/utils.c.old	2014-08-09 12:31:39.000000000 +0000
++++ ppp-2.4.7/pppd/utils.c	2019-05-09 22:13:47.546342436 +0000
+@@ -41,7 +41,7 @@
+ #include <syslog.h>
+ #include <netdb.h>
+ #include <time.h>
+-#include <utmp.h>
++#include <utmpx.h>
+ #include <pwd.h>
+ #include <sys/param.h>
+ #include <sys/types.h>
+--- ppp-2.4.7/pppd/auth.c.old	2019-05-09 22:07:26.737835517 +0000
++++ ppp-2.4.7/pppd/auth.c	2019-05-09 22:14:11.833696617 +0000
+@@ -81,7 +81,7 @@
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <sys/socket.h>
+-#include <utmp.h>
++#include <utmpx.h>
+ #include <fcntl.h>
+ #if defined(_PATH_LASTLOG) && defined(__linux__)
+ #include <lastlog.h>
+--- ppp-2.4.7/pppd/sys-linux.c.old	2019-05-09 22:07:26.747834427 +0000
++++ ppp-2.4.7/pppd/sys-linux.c	2019-05-09 22:15:20.616203578 +0000
+@@ -85,7 +85,7 @@
+ #include <string.h>
+ #include <time.h>
+ #include <memory.h>
+-#include <utmp.h>
++#include <utmpx.h>
+ #include <mntent.h>
+ #include <signal.h>
+ #include <fcntl.h>
+@@ -2230,75 +2230,6 @@
+  * Update the wtmp file with the appropriate user name and tty device.
+  */
+ 
+-void logwtmp (const char *line, const char *name, const char *host)
+-{
+-    struct utmp ut, *utp;
+-    pid_t  mypid = getpid();
+-#if __GLIBC__ < 2
+-    int    wtmp;
+-#endif
+-
+-/*
+- * Update the signon database for users.
+- * Christoph Lameter: Copied from poeigl-1.36 Jan 3, 1996
+- */
+-    utmpname(_PATH_UTMP);
+-    setutent();
+-    while ((utp = getutent()) && (utp->ut_pid != mypid))
+-	/* nothing */;
+-
+-    if (utp)
+-	memcpy(&ut, utp, sizeof(ut));
+-    else
+-	/* some gettys/telnetds don't initialize utmp... */
+-	memset(&ut, 0, sizeof(ut));
+-
+-    if (ut.ut_id[0] == 0)
+-	strncpy(ut.ut_id, line + 3, sizeof(ut.ut_id));
+-
+-    strncpy(ut.ut_user, name, sizeof(ut.ut_user));
+-    strncpy(ut.ut_line, line, sizeof(ut.ut_line));
+-
+-    time(&ut.ut_time);
+-
+-    ut.ut_type = USER_PROCESS;
+-    ut.ut_pid  = mypid;
+-
+-    /* Insert the host name if one is supplied */
+-    if (*host)
+-	strncpy (ut.ut_host, host, sizeof(ut.ut_host));
+-
+-    /* Insert the IP address of the remote system if IP is enabled */
+-    if (ipcp_protent.enabled_flag && ipcp_hisoptions[0].neg_addr)
+-	memcpy(&ut.ut_addr, (char *) &ipcp_hisoptions[0].hisaddr,
+-		 sizeof(ut.ut_addr));
+-
+-    /* CL: Makes sure that the logout works */
+-    if (*host == 0 && *name==0)
+-	ut.ut_host[0]=0;
+-
+-    pututline(&ut);
+-    endutent();
+-/*
+- * Update the wtmp file.
+- */
+-#if __GLIBC__ >= 2
+-    updwtmp(_PATH_WTMP, &ut);
+-#else
+-    wtmp = open(_PATH_WTMP, O_APPEND|O_WRONLY);
+-    if (wtmp >= 0) {
+-	flock(wtmp, LOCK_EX);
+-
+-	if (write (wtmp, (char *)&ut, sizeof(ut)) != sizeof(ut))
+-	    warn("error writing %s: %m", _PATH_WTMP);
+-
+-	flock(wtmp, LOCK_UN);
+-
+-	close (wtmp);
+-    }
+-#endif
+-}
+-
+ 
+ /********************************************************************
+  *
+--- ppp-2.4.7/pppd/tty.c.old	2014-08-09 12:31:39.000000000 +0000
++++ ppp-2.4.7/pppd/tty.c	2019-05-09 22:15:34.854652468 +0000
+@@ -81,7 +81,7 @@
+ #include <fcntl.h>
+ #include <syslog.h>
+ #include <netdb.h>
+-#include <utmp.h>
++#include <utmpx.h>
+ #include <pwd.h>
+ #include <setjmp.h>
+ #include <sys/param.h>
+--- ppp-2.4.7/pppd/session.c.old	2014-08-09 12:31:39.000000000 +0000
++++ ppp-2.4.7/pppd/session.c	2019-05-09 22:15:52.692709222 +0000
+@@ -77,7 +77,7 @@
+ #include <shadow.h>
+ #endif
+ #include <time.h>
+-#include <utmp.h>
++#include <utmpx.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+ #include "pppd.h"
+--- ppp-2.4.7/pppd/main.c.old	2019-05-09 22:07:26.717837696 +0000
++++ ppp-2.4.7/pppd/main.c	2019-05-09 22:16:06.881163559 +0000
+@@ -78,7 +78,7 @@
+ #include <fcntl.h>
+ #include <syslog.h>
+ #include <netdb.h>
+-#include <utmp.h>
++#include <utmpx.h>
+ #include <pwd.h>
+ #include <setjmp.h>
+ #include <sys/param.h>