[PATCH 0/9] L2TP and PPTP fixes: credentials, new options, better l2tp.secret support

Jussi Laakkonen <[email protected]> Mon, 26 Jan 2026 15:43:39 +0200
Newsgroups dev.linux.lists.connman
Message-ID <[email protected]>
This patchset improves the credential handling on both L2TP and PPTP VPN
plugins with connection errors. On PPTP the auth and connection error counts
are used to detect when connection error happens to not to clear credentials.
On L2TP use the VPN agent error for the callback as it is previously parsed.

Add NoBuffer and Sync options for PPTP. Make the logging to be a bit less
verbosive, it seems that a log level 0 is needed for the plugin to function.

Add better shared secret support for L2TP by allowing the user to specify a
custom location for the l2tp.secrets file with existing L2TP.AuthFile option.
When L2TP.Challenge is set the plugin either uses the system file when AuthFile
is omitted, or the user specified AuthFile or the l2tp.secrets file details are
requested from the user via VPN agent. In case of VPN agent all information is
requested once, including the shared secret, local and remote hostnames.

Address potential TOCTOU cases in L2TP file handling. The files saved in
VPN_STATEDIR could overwrite content of a symlinked contend unless the
O_NOFOLLOW is used when open()ing the file.

Documented new L2TP and PPTP options, and added the two missing PPTP options
there as well.

Jussi Laakkonen (9):
  vpn-provider: Change vpn_provider_password_cb_t to use int error
  pptp: Add Sync and Nobuffer as new PPTP only bool options
  pptp: Fix clearing of credentials and use error int in callback
  pptp: Drop loglevel to 0 to reduce logging
  pptp: Do not clear credentials on connection error
  l2tp: Fix clearing of credentials and use error int in callback
  l2tp: Implement shared secret support using file or VPN agent
  l2tp: Fix potential TOCTOU cases with the created/removed files
  doc: Update VPN config options for L2TP and PPTP

 doc/vpn-config-format.txt |  12 +
 vpn/plugins/l2tp.c        | 461 +++++++++++++++++++++++++++++++++-----
 vpn/plugins/pptp.c        | 100 ++++++---
 vpn/vpn-provider.h        |   2 +-
 4 files changed, 485 insertions(+), 90 deletions(-)

-- 
2.47.3