Skip to content

Update README, add warning if CBCP is enabled, remove warnings #588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
paulusmack merged 3 commits into from
May 22, 2026
+59 −3
Merged

Update README, add warning if CBCP is enabled, remove warnings #588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
20dcd29
pppd/plugins: Add const qualifiers to eliminate warnings
paulusmack May 19, 2026
69d4a84
configure.ac: Print warning if CBCP is enabled
paulusmack May 19, 2026
65f19b5
README: Update for v2.5.3
paulusmack May 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 54 additions & 1 deletion README
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,9 +67,62 @@ use any IP address. (This only applies where the peer is
authenticating itself to you, of course.)


What's new in ppp-2.5.2
What's new in ppp-2.5.3
***********************

* Several security improvements:
- Some options are now privileged: 'set', 'unset',
'defaultroute', and 'defaultroute6'. If a non-root user
running a setuid-root pppd needs to use these options,
the system administrator will have to make a 'call' file
in /etc/ppp/peers containing the required option(s) for
the user's use.

- Scripts, privileged options files and secrets files now are
subject to a path check, which checks that the file and each
directory in the real path to the file are owned by root and
not writable by non-root.

- If pppd is installed setuid-root and run by a non-root user,
the peer will be required to authenticate itself; previously
this requirement only applied if the system had a default
IPv4 route.

* Default route handling has changed; pppd no longer checks for
an existing default route before adding its default route. The
defaultroute and defaultroute6 options are now privileged, and
if used, the default route will always be added. The metric of
the default route can be controlled with new defaultroute-metric
and defaultroute6-metric options, which are privileged.
The replacedefaultroute and noreplacedefaultroute options
are no longer functional, and just cause an error message to
be printed.

* There is now a dhcpv6relay plugin, which provides a DHCPv6
relay for the local system inside pppd.
Copy link
Copy Markdown
Contributor

@jkroonza jkroonza May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is for service provider side to generate RA's indicating managed mode and then to forward the incoming DHCPv6 client request to the real DHCPv6 server, as well as manage the routing around the relevant delegations that the DHCPv6 server then provides. Essentially it just appends a route for the delegations (whether it's IA_NA or IA_PD) to the local routing table and to again remove them upon expiry. This is probably too much detail for here.

For client side it's always been possible to use for example dhcpcd -6 on the ppp interface to obtain addressing information. Possibly in combination with something like radvd to forward advertise.

How about:

There is now a dhcpv6relay plugin, which can be used to provide IPv6 RAs to the remote side and relay the subsequent incoming DHCPv6 requests to a DHCPv6 server. Note: This is to delegate IPv6 to the remote side, not to configure IPv6 locally - for that you can look at projects like dhcpcd and/or radvd as needed.


* VRF (Virtual Routing and Forwarding) support has been added
to pppd on Linux. There is now a 'vrf' option which tells
pppd to bind the PPP interface to a specific VRF, so that
routes are installed in the VRF's routing table rather than
the main routing table.

* The pppoe (PPP over ethernet) plugin now supports maximum
packet sizes greater than 1492 bytes if configured to do so
and the server agrees.
Copy link
Copy Markdown
Contributor

@jkroonza jkroonza May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and the peer agrees.

Sorry, I primarily use pppd on the service provider side :).


* CBCP (Callback control protocol) support can still be selected
at configuration time, but now a warning message will be
printed, warning that CBCP support will be removed in a
future version. If you use CBCP in pppd, let the maintainer
know.

* Various other bug fixes and minor enhancements.


What was new in ppp-2.5.2
*************************

* Some old and probably unused code has been removed, notably the
pppgetpass program and the passprompt plugin, and some of the files
in the sample and scripts directories.
Expand Down
3 changes: 3 additions & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,3 +362,6 @@ Features enabled
EAP-TLS..............: ${enable_eaptls:-yes}
systemd notifications: ${enable_systemd:-no}
"

AM_COND_IF([PPP_WITH_CBCP],
AC_MSG_WARN([CBCP support is likely to be removed in future]))
Copy link
Copy Markdown
Contributor

@jkroonza jkroonza May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd make this more aggressive and point to the specific issue

[CPCP is going to be removed in version (one of) 2.5.X (or) 2.6.0 unless motivation to keep it is given to the issue at https://....]

2 changes: 1 addition & 1 deletion pppd/plugins/radius/radrealms.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ lookup_realm(char const *user,
SERVER **authserver,
SERVER **acctserver)
{
char *realm;
const char *realm;
FILE *fd;
SERVER *accts, *auths, *s;
char buffer[512], *p;
Expand Down
2 changes: 1 addition & 1 deletion pppd/plugins/winbind.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ size_t strhex_to_str(unsigned char *p, size_t len, const char *strhex)
size_t num_chars = 0;
unsigned char lonybble, hinybble;
const char *hexchars = "0123456789ABCDEF";
char *p1 = NULL, *p2 = NULL;
const char *p1 = NULL, *p2 = NULL;

for (i = 0; i < len && strhex[i] != 0; i++) {
if (strncmp(hexchars, "0x", 2) == 0) {
Expand Down
Loading