From 223def554ba81d642e3d337caf6ad6592360c77c Mon Sep 17 00:00:00 2001
From: Dan Kruchinin <kruchinin@altell.ru>
Date: Mon, 4 Oct 2010 17:12:35 +0400
Subject: [PATCH] Added to git repository all files from pppd_ldap-0.12

---
 INSTALL              |  49 ++++
 Makefile             |  48 ++++
 RADIUS-LDAPv3.schema | 564 ++++++++++++++++++++++++++++++++++++++++
 README               | 114 +++++++++
 TODO                 |  13 +
 main.c               | 596 +++++++++++++++++++++++++++++++++++++++++++
 main.h               |  67 +++++
 ppp_list.c           |  60 +++++
 ppp_utmp.h           |  39 +++
 radius.ldif          |  11 +
 utmplib.c            | 161 ++++++++++++
 11 files changed, 1722 insertions(+)
 create mode 100644 INSTALL
 create mode 100644 Makefile
 create mode 100644 RADIUS-LDAPv3.schema
 create mode 100644 README
 create mode 100644 TODO
 create mode 100644 main.c
 create mode 100644 main.h
 create mode 100644 ppp_list.c
 create mode 100644 ppp_utmp.h
 create mode 100644 radius.ldif
 create mode 100644 utmplib.c

diff --git a/INSTALL b/INSTALL
new file mode 100644
index 0000000..e88283f
--- /dev/null
+++ b/INSTALL
@@ -0,0 +1,49 @@
+ This docs can be outdated. For the latest versions please refere to project page:
+ http://sourceforge.net/projects/pppd-ldap
+
+ The plugin has an idea of direct LDAP access instead of making RADIUS servers and so on. At the same time plugin uses RADIUS-LDAPv3 schema to store attributes and it's values. Seems being suitable for small providers and corporate network access services.
+
+ There is a great difference between corporate needs and ISP needs. One of them and the main goal of ISP is a necessity of accounting (ISP's always count what they are paid for). In corporate networks accounting is used rarely (except when organization is an ISP for their employees). The main goal of the corporate needs when deploying new services (such as remote access for home-working employees, affiliates, clients and so on) is to REDUCE overhead in managing additional accounts in separate databases/files, etc. LDAP server and pppd_ldap plugin helps keeping everything at the right and the same place. If you are an ISP who needs accounting - USE radius! I want to predict appearance of the questions kind of "Why do we need pppd_ldap if I can use RADIUS?". If you can - use it. pppd_ldap plugin was written to be usefull in corporate environment and it's needs in mind.
+
+ Installation process is very simple. You'll need OpenLDAP 2.x development library and pppd >= 2.4.2. Plugin was tested only on Linux i386 machine and is not guaranteed to work on any other platforms. We need some work towards this direction. I am sure it can work fine on Sparc/Solaris but there are no any suitable testing environment in the woods. You can get the latest pppd(8) version from ftp://ftp.samba.org/pub/ppp/. Version higher or equal to 2.4.2 is important because necessary plugin "hooks" performed starting from this version. Anyway I've some thoughts about < 2.4.2 porting. It is still in wide use.
+
+ Compile and install pppd as usual. After that copy tarball to pppd/plugins and extract archive:
+
+ $ tar -zxvf pppd_ldap.tgz
+
+ After that:
+
+ $ cd pppd_ldap
+ $ make
+
+ pppd(8) usually stores it's plugins in /lib/ppp/<VERSION> directory. To get your pppd version run "pppd --version".
+
+ $ cp pppd_ldap.so /usr/lib/ppp/{YOUR_PPPD_VERSION}
+
+ To compile in debugging messages uncomment "DEBUG=y" line in Makefile.
+
+ To enable SSL/TLS code uncomment "TLS=y" line in Makefile.
+
+ You'll need to add RADIUS-LDAPv3.schema to your slapd.conf file. After that create test PPP acount. Please refere to radius.ldif file and don't forget to set user's password with ldappasswd(1) tool (or any other suitable). After that you can run pppd(8) with options. Please note, that plugin options become available only after "plugin pppd_ldap.so".
+
+ Sample "server-side" command line:
+
+ $ pppd /dev/ttyS1 115200 192.168.0.1: auth -chap +pap plugin pppd_ldap.so \
+   ldaphost helen.nordcomp.ru userbasedn ou=People,dc=nordcomp,dc=ru ldapdn\
+   cn=pppd,ou=Daemon,dc=nordcomp,dc=ru ldappw testing123 ldaptimeout 25
+
+ You can use traditional /etc/ppp/options file. Don't forget to set "plugin pppd_ldap.so" option BEFORE plugin's specific options!!!
+
+ TROUBLESHOOTING
+
+ Use debugging options! :))
+
+ BUGS
+
+ Submit to http://unix.nordcomp.ru/forum.html or mail to me <sitkarew@nordcomp.ru>
+
+ GREETINGS:
+
+ http://unix.nordcomp.ru
+ http://www.xoky.net
+
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..c603e25
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,48 @@
+# Makefile for PPPD_LDAP plugin
+#
+
+# Uncomment this line to get more debug messages
+#DEBUG=y
+# Uncomment this line to enable SSL/TLS 
+TLS=y
+#
+
+#
+PLUGIN=pppd_ldap.so
+TOOLS=ppp_list
+DESTINATION=/usr/lib/ppp/
+CC=gcc
+LD=ld
+CFLAGS=-I../.. -I../../../include -O2
+#CFLAGS=-O2
+LDFLAGS=-lldap -lc
+#
+
+ifdef DEBUG
+CFLAGS += -DDEBUG=1
+endif
+ifdef TLS
+CFLAGS += -DOPT_WITH_TLS=1
+endif
+
+all : $(PLUGIN) $(TOOLS)
+
+ppp_list: utmplib.o
+	$(CC) $(CFLAGS) ppp_list.c -o ppp_list utmplib.o $(LDFLAGS)
+
+pppd_ldap.so: main.o utmplib.o
+
+	$(LD) -shared -o pppd_ldap.so utmplib.o main.o $(LDFLAGS)
+
+main.o: main.c
+
+	$(CC) $(CFLAGS) -c -o main.o main.c
+
+utmplib.o: utmplib.c
+
+	$(CC) $(CFLAGS) -c -o utmplib.o utmplib.c
+
+clean :
+
+	rm $(PLUGIN) $(TOOLS) *.o *.so *~
+
diff --git a/RADIUS-LDAPv3.schema b/RADIUS-LDAPv3.schema
new file mode 100644
index 0000000..cee7502
--- /dev/null
+++ b/RADIUS-LDAPv3.schema
@@ -0,0 +1,564 @@
+# This is a LDAPv3 schema for RADIUS attributes.
+# Tested on OpenLDAP 2.0.7
+# Posted by Javier Fernandez-Sanguino Pena <jfernandez@sgi.es>
+# LDAP v3 version by Jochen Friedrich <jochen@scram.de>
+# Updates by Adrian Pavlykevych <pam@polynet.lviv.ua>
+##############
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.1
+      NAME 'radiusArapFeatures'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.2
+      NAME 'radiusArapSecurity'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.3
+      NAME 'radiusArapZoneAccess'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.44
+     NAME 'radiusAuthType'
+     DESC ''
+     EQUALITY caseIgnoreIA5Match
+     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+     SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.4
+      NAME 'radiusCallbackId'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.5
+      NAME 'radiusCallbackNumber'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.6
+      NAME 'radiusCalledStationId'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.7
+      NAME 'radiusCallingStationId'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.8
+      NAME 'radiusClass'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.45
+     NAME 'radiusClientIPAddress'
+     DESC ''
+     EQUALITY caseIgnoreIA5Match
+     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+     SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.9
+      NAME 'radiusFilterId'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.10
+      NAME 'radiusFramedAppleTalkLink'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.11
+      NAME 'radiusFramedAppleTalkNetwork'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.12
+      NAME 'radiusFramedAppleTalkZone'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.13
+      NAME 'radiusFramedCompression'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.14
+      NAME 'radiusFramedIPAddress'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.15
+      NAME 'radiusFramedIPNetmask'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.16
+      NAME 'radiusFramedIPXNetwork'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.17
+      NAME 'radiusFramedMTU'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.18
+      NAME 'radiusFramedProtocol'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.19
+      NAME 'radiusFramedRoute'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.20
+      NAME 'radiusFramedRouting'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.46
+      NAME 'radiusGroupName'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.47
+      NAME 'radiusHint'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.48
+      NAME 'radiusHuntgroupName'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.21
+      NAME 'radiusIdleTimeout'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.22
+      NAME 'radiusLoginIPHost'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.23
+      NAME 'radiusLoginLATGroup'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.24
+      NAME 'radiusLoginLATNode'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.25
+      NAME 'radiusLoginLATPort'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.26
+      NAME 'radiusLoginLATService'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.27
+      NAME 'radiusLoginService'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.28
+      NAME 'radiusLoginTCPPort'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.29
+      NAME 'radiusPasswordRetry'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.30
+      NAME 'radiusPortLimit'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.49
+      NAME 'radiusProfileDn'
+      DESC ''
+      EQUALITY distinguishedNameMatch
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.31
+      NAME 'radiusPrompt'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.50
+      NAME 'radiusProxyToRealm'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.51
+      NAME 'radiusReplicateToRealm'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.52
+      NAME 'radiusRealm'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.32
+      NAME 'radiusServiceType'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.33
+      NAME 'radiusSessionTimeout'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.34
+      NAME 'radiusTerminationAction'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.35
+      NAME 'radiusTunnelAssignmentId'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.36
+      NAME 'radiusTunnelMediumType'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.37
+      NAME 'radiusTunnelPassword'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.38
+      NAME 'radiusTunnelPreference'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.39
+      NAME 'radiusTunnelPrivateGroupId'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.40
+      NAME 'radiusTunnelServerEndpoint'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.41
+      NAME 'radiusTunnelType'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.42
+      NAME 'radiusVSA'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.43
+      NAME 'radiusTunnelClientEndpoint'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+
+#need to change asn1.id
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.53
+      NAME 'radiusSimultaneousUse'
+      DESC ''
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.54
+      NAME 'radiusLoginTime'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.55
+      NAME 'radiusUserCategory'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.56
+      NAME 'radiusStripUserName'
+      DESC ''
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.57
+      NAME 'dialupAccess'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.58
+      NAME 'radiusExpiration'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+      SINGLE-VALUE 
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.59
+      NAME 'radiusCheckItem'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+attributetype
+   ( 1.3.6.1.4.1.3317.4.3.1.60
+      NAME 'radiusReplyItem'
+      DESC ''
+      EQUALITY caseIgnoreIA5Match
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+   )
+
+
+objectclass
+   ( 1.3.6.1.4.1.3317.4.3.2.1
+      NAME 'radiusprofile'
+      SUP top AUXILIARY
+      DESC ''
+      MUST cn
+      MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $
+            radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $
+            radiusCalledStationId $ radiusCallingStationId $ radiusClass $
+            radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $
+            radiusFramedAppleTalkNetwork $ radiusFramedAppleTalkZone $
+            radiusFramedCompression $ radiusFramedIPAddress $
+            radiusFramedIPNetmask $ radiusFramedIPXNetwork $
+            radiusFramedMTU $ radiusFramedProtocol $
+	    radiusCheckItem $ radiusReplyItem $
+            radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $
+            radiusGroupName $ radiusHint $ radiusHuntgroupName $ 
+            radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $
+            radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $
+            radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $
+            radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $
+            radiusRealm $ radiusReplicateToRealm $ radiusServiceType $
+            radiusSessionTimeout $ radiusStripUserName $
+            radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusProfileDn $
+            radiusSimultaneousUse $ radiusTunnelAssignmentId $
+            radiusTunnelMediumType $ radiusTunnelPassword $ radiusTunnelPreference $
+            radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $
+            radiusTunnelType $ radiusUserCategory $ radiusVSA $
+            radiusExpiration $ dialupAccess )
+   )
diff --git a/README b/README
new file mode 100644
index 0000000..9c0592c
--- /dev/null
+++ b/README
@@ -0,0 +1,114 @@
+This docs can be outdated. For the latest versions please refere to project page:
+http://sourceforge.net/projects/pppd-ldap
+
+	--- LDAP-enabled pppd(8) ---
+
+	NAME
+
+	pppd_ldap.so - LDAP authentication and information retrieval plugin for
+	pppd(8)
+
+	SYNOPSIS
+
+	pppd <option> plugin pppd_ldap.so
+
+	DESCRIPTION
+
+ LDAP plugin pppd_ldap.so permits pppd to perform PAP (in future CHAP will be
+ added) authentication against LDAP server instead of the usual
+ /etc/ppp/pap-secrets and other files.  LDAP plugin is linked with OpenLDAP
+ -lldap library. You'll need to have development part of OpenLDAP library to
+ build plugin successfuly. After successfull reception of peer's credentials,
+ pppd_ldap rebinds with supplied username and password. If operation succeeds,
+ pppd_ldap sets different pppd(8) options according to user information ret-
+ rieved from LDAP directory. If operation fails, pppd(8) performs it's
+ ordinary operations.
+
+ Search operation constructs search filter using peer name attaching "uid="
+ prefix. Thus, uid attribute is used as a login name. After completing search
+ operation, pppd_ldap rebinds with the entry's DN. For example if user logs in
+ using login name "tofik" and the entry looks like
+
+ dn: cn=Anton A. Postnikov,ou=People,dc=nordcomp,dc=ru
+ objectClass: radiusProfile
+ objectClass: inetOrgPerson
+ ....
+ uid: tofik
+
+ plugin searches for the entry using (uid=tofik) and then rebinds with DN
+ cn=Anton A. Postnikov,ou=People,dc=nordcomp,dc=ru. This behavior allows to
+ establish user's DN in different styles.
+
+ Plugin uses RADIUS-LDAPv3.schema provided with FreeRadius tarballs. Currently
+ plugin can use the following attributes and set appropriate values;
+
+	Mandatory attributes
+
+ 	dialupAccess - this attribute should be set to YES if we allow PPP connec-
+	tion or empty. If this attribute's value is set to FALSE, login is disabl-
+	ed.
+
+	radiusAuthType - SHOULD be set to LDAP.
+
+	Additional attributes
+
+ 	radiusFramedIPAddress - this attribute determines IP address of the
+	authenticating peer. If attribute is not set, normal actions are performed.
+	If peer's addres is set by runtime pppd(8) options, it is used if
+	LDAP user record has no radiusFramedIPAddress attribute.
+
+	radiusSessionTimeout - this attribute defines session timeout in seconds.
+	Connection will be destroyed by pppd(8) after session timeout.
+
+	radiusIdleTimeout - this attribute defines idle timeout in seconds.
+
+	OPTIONS
+
+  LDAP plugin introduces some additional options:
+
+  ldaphost <hostname>
+  	Sets LDAP server host name. By default "localhost" is assumed.
+
+  example: ldaphost helga.komitex.ru
+
+  ldapport <number>
+
+ Sets LDAP sever port number. By default LDAP_PORT (389) is used. pppd_ldap
+ now supports TLS/SSL. If your LDAP server talks only LDAPS, then set
+ ldapport to 636.
+
+  example: ldapport 555
+
+  ldapdn <DN>
+
+ Set to DN to bind with LDAP server, who has enough rights to read necessary
+ attributes in LDAP Directory.
+
+  example: ldapdn "cn=pppd,ou=Daemon,dc=nordcomp,dc=ru"
+
+  ldappw <password>
+
+ Set to ldapdn password. Seems not very good... I'll change this behavior
+ someday.
+
+  userbasedn <basedn>
+
+ Set to the base DN where to perform search for user accounts in LDAP directory.
+
+  example: "ou=Users,dc=nordcomp,dc=ru"
+
+  ldaptimeout <number>
+
+ ldap search timeout (in sec). 15 seconds assumed by default. set to any
+ suitable value.
+  example: ldaptimeout 25
+
+  ldapnettimeout <number>
+
+ Sets network operation timeout in seconds. Defaults to 10 seconds.
+
+  ldapusetls
+
+ Enables TLS/SSL connection with LDAP server. Make sure you have specified
+ correct ldaphost! If ldaphost name doesn't match server's certificate canonical
+ name, connection terminates immediately.
diff --git a/TODO b/TODO
new file mode 100644
index 0000000..117f9a2
--- /dev/null
+++ b/TODO
@@ -0,0 +1,13 @@
+TODO list for pppd(8) LDAP plugin
+
+ Handle radiusSimultaneousUse attribute i.e. limit number of simultaneous logins with the same user name. Functionality similar with utmp is already implemented. Enhance tools to handle logins database.
+
+ Implement CHAP and M$CHAP/M$CHAPv2 authentication. If LDAP server holds user's password (NT or LANManager) hashes (sambaPassword, etc) use it to perform response computation. Else use {cleartext} password.
+
+ Login date and time periods permissions management. Get information from LDAP server and compute session time limit to kick-off user.
+
+ Set MS DNS and WINS IP addresses if they are present in LDAP response.
+
+ Add proxyarp entry if LDAP response contains radiusProxyArp = YES (TRUE,1).
+
+ Handle realms. If user name contains "@" perform search with ou=$realm,$basedn. Add additional option "ldapdefuserdn" which sets default baseDN to perform search.
diff --git a/main.c b/main.c
new file mode 100644
index 0000000..4c353b2
--- /dev/null
+++ b/main.c
@@ -0,0 +1,596 @@
+/*******************************************************************
+* main.c
+*
+* LDAP plugin for pppd. Performs PAP authentication and sets
+* pppd parameters using LDAP as a backend.
+*
+* Copyright (c) Nordcomp LTD, Syktyvkar, Russian Federation
+* Initial version written by Grigoriy Sitkarev <sitkarew@nordcomp.ru>
+*
+* This plugin may be distributed according to the terms of the GNU
+* General Public License, version 2 or any later version.
+*
+********************************************************************/
+/*
+* 2004/05/17: first release!!! :) v 0.10
+*
+* 2004/05/19: Small bugfix. If peer's address was specified by pppd options
+* at startup use it if can't get if from LDAP. Usefull feature for those
+* who needn't have per-user fixed IP for one part and define fixed IP for
+* another through LDAP.
+*
+* 2004/05/20: Cleanups. IP address handling improved.
+*
+* 2004/05/21: Plugin can talk TLS/SSL now. Added a hack to run with servers
+* which can use only LDAPS. Code seems beeing more clean. Created TODO file.
+* v 0.11 --> v 0.11b
+*
+* 2004/05/30: Plugin can log ppp session data (login, line, IP, time etc) to
+* ppp_utmp file. A simple tool "ppp_list" can list active entries. New option
+* "lutmp" introduced. This functionality NEEDS COMPEHENSIVE TESTING.
+* v 0.11b --> v 0.12
+*
+*/
+
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <sys/fcntl.h>
+
+#include <netinet/in.h>
+#include <ldap.h>
+
+#include "pppd.h"
+#include "fsm.h"
+#include "ipcp.h"
+#include "lcp.h"
+#include "main.h"
+
+#include "ppp_utmp.h"
+
+char pppd_version[] = VERSION;
+static char rcsid[] = "$Id: main.c, v 0.12 2004/05/30 22:34:45 sitkarev Exp$";
+
+static char ldap_host[MAX_BUF] = "localhost";
+static char ldap_dn[MAX_BUF];
+static char ldap_pw[MAX_BUF];
+static char userbasedn[MAX_BUF];
+static int	ldap_port = LDAP_PORT;
+static int	ldap_timeout = 15;
+static int	ldap_nettimeout = 10;
+static bool	ldap_usetls = 0;
+static bool	lutmp = 0;
+
+static struct ldap_data ldap_data;
+
+static option_t ldap_options[] = {
+
+	{ "ldaphost", o_string, ldap_host,
+	  "LDAP server host name",
+	  OPT_PRIV | OPT_STATIC, NULL, (MAX_BUF - 1)},
+
+	{ "ldapdn", o_string, ldap_dn,
+	  "DN to bind with to LDAP server",
+	  OPT_PRIV | OPT_STATIC, NULL, (MAX_BUF - 1)},
+
+	{ "ldappw", o_string, ldap_pw,
+	  "DN password",
+	  OPT_PRIV | OPT_STATIC, NULL, (MAX_BUF - 1)},
+
+	{ "ldapport", o_int, &ldap_port,
+	  "LDAP server port",
+	  OPT_PRIV | OPT_STATIC},
+
+	{ "userbasedn", o_string, userbasedn,
+	  "LDAP user base DN",
+	  OPT_PRIV | OPT_STATIC, NULL, (MAX_BUF - 1)},
+
+	{ "ldaptimeout", o_int, &ldap_timeout,
+	  "LDAP search timeout",
+	  OPT_PRIV | OPT_STATIC},
+
+	{ "ldapnettimeout", o_int, &ldap_nettimeout,
+	  "LDAP network activity timeout",
+	  OPT_PRIV | OPT_STATIC },
+#ifdef OPT_WITH_TLS
+	{ "ldapusetls", o_bool, &ldap_usetls,
+	  "Connect to LDAP server using TLS", 1},
+#endif
+
+	{ "lutmp", o_bool, &lutmp,
+	  "Write session data to ppp_utmp", 1},
+
+	{ NULL }
+};
+
+int plugin_init()
+{
+	add_options(ldap_options);
+	pap_check_hook = ldap_pap_check;
+	pap_auth_hook =	ldap_pap_auth;
+	ip_choose_hook = ldap_ip_choose;
+	allowed_address_hook = ldap_address_allowed;
+
+	add_notifier(&ip_down_notifier, ldap_ip_down, NULL);
+	add_notifier(&ip_up_notifier, ldap_ip_up, NULL);
+
+	info("LDAP: plugin initialized.");
+}
+
+/*
+*	FUNCTION: ldap_pap_auth()
+*	PURPOSE: Authenticates PAP user against LDAP server.
+*
+*	ARGUMENTS:
+*	user - user name
+*	password - user password
+*	msgp - PAP message to send
+*
+*	RETURN:  0 - Supplied username/password values incorrect
+*			 1 - Success
+*			-1 - Error, proceed to normal pap-options file
+*/
+
+static int ldap_pap_auth(char *user, char *password, char **msgp,
+	struct wordlist **paddrs, struct wordlist **popts)
+{
+	int rc,ldap_errno;
+	int version = LDAP_VERSION3;
+	char filter[LDAP_FILT_MAXSIZ];
+	char userdn[MAX_BUF];
+	char **ldap_values;
+	LDAP *ldap;
+	LDAPMessage *ldap_mesg;
+	LDAPMessage	*ldap_entry;
+
+	/* Initiate session and bind to LDAP server */
+
+
+	if ((ldap = ldap_init(ldap_host, ldap_port)) == NULL) {
+		error("LDAP: failed to initialize session\n");
+		return -1;
+	}
+
+	/* Set LDAP specific options such as timeout, version and tls */
+
+	if ((rc = ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION,
+		&version) != LDAP_OPT_SUCCESS)) {
+		error("LDAP: failed to set protocol version\n");
+		return -1;
+	}
+
+	if ((rc = ldap_set_option(ldap, LDAP_OPT_NETWORK_TIMEOUT,
+		&ldap_nettimeout) != LDAP_OPT_SUCCESS)) {
+		error("LDAP: failed to set network timeout version\n");
+		return -1;
+	}
+
+	if ((rc = ldap_set_option(ldap, LDAP_OPT_TIMELIMIT,
+		&ldap_timeout) != LDAP_OPT_SUCCESS)) {
+		error("LDAP: failed to set timeout option\n");
+		return -1;
+	}
+
+#ifdef OPT_WITH_TLS
+
+	/* Some servers support only LDAPS but not TLS */
+	if ((ldap_port == LDAPS_PORT) && ldap_usetls) {
+		int tls_opt = LDAP_OPT_X_TLS_HARD;
+		if ((rc = ldap_set_option(ldap, LDAP_OPT_X_TLS,
+			(void *)&tls_opt)) != LDAP_SUCCESS) {
+		ldap_get_option(ldap, LDAP_OPT_ERROR_NUMBER, &ldap_errno);
+		error("LDAP: failed to set TLS option: %s\n", ldap_err2string(rc));
+		return -1;
+		}
+	}
+
+	if (ldap_usetls) {
+	#ifdef DEBUG
+		info("LDAP: Setting TLS option -> ON\n");
+	#endif
+		if((rc = ldap_start_tls_s(ldap, NULL, NULL) != LDAP_SUCCESS)) {
+		ldap_get_option(ldap, LDAP_OPT_ERROR_NUMBER, &ldap_errno);
+		error("LDAP: failed to initiate TLS: %s\n", ldap_err2string(ldap_errno));
+		return -1;
+		}
+	};
+
+#endif
+
+	/* Perform binding at last */
+
+	if ((rc = ldap_bind_s(ldap, ldap_dn, ldap_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) {
+		ldap_get_option(ldap, LDAP_OPT_ERROR_NUMBER, &ldap_errno);
+		error("LDAP: failed to bind: %s\n",ldap_err2string(rc));
+		ldap_unbind(ldap);
+		return -1;
+	}
+
+	/* Form a search filter from supplied peer's credentials */
+
+	if ((rc = snprintf(filter, LDAP_FILT_MAXSIZ,"(&(uid=%s)(objectClass=%s))",
+		 user, RADIUS_OBJECTCLASS)) == -1) {
+		error("LDAP: LDAP filter too big\n");
+		ldap_unbind(ldap);
+		return -1;
+	};
+
+#ifdef DEBUG
+		info("LDAP: search filter: %s\n",filter);
+#endif
+
+	/* Perform search*/
+
+	if ((rc = ldap_search_s(ldap, userbasedn, LDAP_SCOPE_SUBTREE, filter,
+		NULL, 0, &ldap_mesg)) != LDAP_SUCCESS) {
+		ldap_get_option(ldap, LDAP_OPT_ERROR_NUMBER, &ldap_errno);
+		error("LDAP: Can't perform search: %s\n",
+			ldap_err2string(rc));
+		ldap_unbind(ldap);
+		return -1;
+	};
+
+	/* If search returned more than 2 results or 0 - something is wrong! */
+
+	if ( ldap_mesg == NULL ){
+		info("LDAP: No such user \"%s\"\n",user);
+		ldap_unbind(ldap);
+		return -1;
+	}
+
+	if ((ldap_count_entries(ldap, ldap_mesg)) > 1){
+		warn("LDAP: more than one user \"%s\" exists!\n",user);
+		ldap_unbind(ldap);
+		return -1;
+	}
+
+	/* Check existance of dialupAccess attribute and it's value */
+#ifdef DEBUG
+	info("LDAP: found %u entries\n",ldap_count_entries(ldap, ldap_mesg));
+#endif
+
+	/* radiusAuthType = LDAP ->  check it! */
+
+	ldap_entry = ldap_first_entry(ldap, ldap_mesg);
+
+		ldap_values = ldap_get_values(ldap, ldap_entry, RADIUS_AUTHTYPE);
+
+		if (ldap_count_values(ldap_values) != 0) {
+
+			if ((strncasecmp(ldap_values[0],"LDAP",4) != 0)) {
+#ifdef DEBUG
+			info("LDAP: Sorry, only authtype=LDAP is supported\n");
+#endif
+			ldap_unbind(ldap);
+			ldap_msgfree(ldap_mesg);
+			return -1;
+			}
+		} else {
+#ifdef DEBUG
+					info("LDAP: Can not get authentication type\n");
+#endif
+					ldap_unbind(ldap);
+					ldap_msgfree(ldap_mesg);
+					return -1;
+		}
+
+		ldap_values = ldap_get_values(ldap, ldap_entry, RADIUS_DIALUPACCESS);
+		if (((strncasecmp(ldap_values[0],"YES",3) == 0)) ||
+			((strncasecmp(ldap_values[0],"FALSE",5)) != 0)) {
+
+		/* Rebind with peers supplied credentials */
+
+		if ((rc = snprintf(userdn,MAX_BUF,"%s",ldap_get_dn(ldap,ldap_entry))) == -1)
+		warn("LDAP: user DN stripped\n");
+
+#ifdef DEBUG
+	info("LDAP: rebind DN: %s\n",userdn);
+#endif
+
+		if ((rc = ldap_simple_bind_s(ldap,userdn,password)) != LDAP_SUCCESS) {
+			error("LDAP: username or password incorrect\n");
+			*msgp = "Username or password incorrect!";
+			ldap_unbind(ldap);
+			ldap_msgfree(ldap_mesg);
+			return 0;
+			}
+		} else {
+
+			error("LDAP: dialup access disabled for user %s\n",user);
+			*msgp = "Dial-in access not allowed!";
+			ldap_unbind(ldap);
+			ldap_msgfree(ldap_mesg);
+			return 0;
+		}
+
+		/* Set pppd options */
+
+		ldap_setoptions(ldap, ldap_mesg, &ldap_data);
+
+#ifdef DEBUG
+		info("LDAP: Auth success\n");
+#endif
+		*msgp = "Access OK!";
+		ldap_data.access_ok = 1;
+
+		/* Write ppp_utmp data in place */
+
+		return 1;
+}
+
+static void ldap_ip_choose(u_int32_t *addrp)
+{
+	if (ldap_data.address_set)
+		*addrp = ldap_data.addr;
+}
+
+static void ldap_ip_down(void *opaque, int arg)
+{
+	if(lutmp)
+	ldap_deactivate_utmp(devnam);
+}
+
+static void ldap_ip_up(void *opaque, int arg)
+{
+	if(lutmp)
+	ldap_activate_utmp(&ldap_data, devnam, ifname, peer_authname);
+}
+
+static int ldap_address_allowed(u_int32_t addr)
+{
+	/* if (ldap_data.address_set) return 1;*/
+	if (ntohl(addr) == ldap_data.addr) return 1;
+
+	/* if peer's address was specified in options
+	   allow it */
+	if ((ipcp_wantoptions[0].hisaddr != 0) &&
+	     (ipcp_wantoptions[0].hisaddr == addr)) return 1;
+
+	return 0;
+}
+
+static int ldap_pap_check(void)
+{
+	return 1;
+}
+
+
+/*
+*	FUNCTION: ldap_activate_utmp(struct ldap_data *ldap_data,
+				char *devnam, char *ppp_devname, char *user);
+*	PURPOSE: Writes ppp session data to ppp_utmp file
+*	ARGUMENTS:
+*	ldap_data - pointer to ldap_data structure
+*	devnam - 	tty device name ("/dev/" will be stripped)
+*	ppp_devname - interface name (ppp1, ppp0, etc) associated with
+*				ppp session
+*	user -		user login name
+*
+*	RETURNS: -1 in case of error
+			  1 if success
+*/
+
+static int ldap_activate_utmp(struct ldap_data *ldap_data,
+		char *devnam, char *ppp_devname, char* user)
+{
+	int rc;
+	int fd;
+	off_t offset;
+	struct ppp_utmp entry;
+
+	memset(&entry, 0, sizeof(struct ppp_utmp));
+
+	if ((fd = open(UTMP , O_RDWR | O_CREAT, 0644)) == -1)
+	{
+		error("LDAP: can't open utmp file\n");
+		return -1;
+	}
+
+	if(strncmp(devnam,"/dev/",5) == 0)
+	(char*)devnam += 5;
+
+	if ((rc = lockf(fd, F_LOCK, 0)) == -1)
+	{
+		error("LDAP: can't lock utmp file: %s\n",
+		strerror(errno));
+		return -1;
+	}
+
+	switch ((offset = utmp_seek(fd, devnam))) {
+
+	case -1:
+
+		strncpy(entry.line, devnam, strlen(devnam));
+		strncpy(entry.login, user, strlen(user));
+		strncpy(entry.ifname, ppp_devname, strlen(ppp_devname));
+
+		if (!ldap_data->address_set)
+		entry.ip_address = ipcp_wantoptions[0].hisaddr;
+		else entry.ip_address = ldap_data->addr;
+
+		entry.time = time(NULL);
+		entry.state = ACTIVE;
+
+		lseek(fd, 0, SEEK_END);
+		if ((write_n(fd, &entry, sizeof(struct ppp_utmp))) == -1){
+			error("LDAP: failed to write utmp entry\n");
+			return -1;
+		}
+
+		break;
+
+	default:
+
+		lseek(fd, offset, SEEK_SET);
+		read_n(fd,&entry,sizeof(struct ppp_utmp));
+
+		strncpy(entry.line, devnam, strlen(devnam));
+		strncpy(entry.login, user, strlen(user));
+		strncpy(entry.ifname, ppp_devname, strlen(ppp_devname));
+
+		if (!ldap_data->address_set)
+		entry.ip_address = ipcp_wantoptions[0].hisaddr;
+		else entry.ip_address = ldap_data->addr;
+
+		entry.time = time(NULL);
+		entry.state = ACTIVE;
+
+		lseek(fd, offset, SEEK_SET);
+		if ((write_n(fd, &entry, sizeof(struct ppp_utmp))) == -1){
+			error("LDAP: failed to write utmp entry\n");
+			return -1;
+		}
+
+		break;
+	}
+
+	lseek(fd, 0, SEEK_SET);
+	if ((rc = lockf(fd, F_ULOCK, 0)) == -1)
+	{
+		error("LDAP: can't unlock utmp file: %s\n",
+		strerror(errno));
+		return -1;
+	}
+
+	if ((rc = close(fd)) == -1)
+	{
+		error("LDAP: can't close utmp file: %s\n",
+		strerror(errno));
+		return -1;
+	}
+
+return 1;
+
+}
+
+/*
+*	FUNCTION: ldap_deactivate_utmp(char *devnam);
+*	PURPOSE: sets ppp session data to IDLE in ppp_utmp associated with tty
+*	ARGUMENTS:
+*	devnam - 	tty device name ("/dev/" will be stripped)
+*
+*	RETURNS: -1 in case of error
+			  1 if success
+*/
+
+
+static int ldap_deactivate_utmp(char *devnam)
+{
+
+	int rc;
+	int fd;
+	off_t offset;
+	struct ppp_utmp entry;
+
+	memset(&entry, 0, sizeof(struct ppp_utmp));
+	if(strncmp(devnam,"/dev/",5) == 0)
+	(char*)devnam += 5;
+
+#ifdef DEBUG
+	error("LDAP: deactivating %s\n",devnam);
+#endif
+
+	if ((fd = open(UTMP, O_RDWR, 0600)) == -1){
+		error("LDAP: can't open utmp file: %s\n",
+		strerror(errno));
+		return -1;
+	}
+
+	if ((rc = lockf(fd, F_LOCK, 0)) == -1){
+		error("LDAP: can't lock utmp file: %s\n",
+		strerror(errno));
+		return -1;
+	}
+
+	while(read_n(fd, &entry, sizeof(struct ppp_utmp))) {
+		if (strncmp(entry.line, devnam, strlen(entry.line)) == 0) {
+			entry.state = IDLE;
+			lseek(fd, -sizeof(struct ppp_utmp), SEEK_CUR);
+			if ((rc = write_n(fd, &entry, sizeof(struct ppp_utmp))) == -1) {
+				error("LDAP: can't change utmp record status: %s\n",
+						strerror(errno));
+				return -1;
+			}
+		}
+	}
+
+	lseek(fd, 0, SEEK_SET);
+	if ((rc = lockf(fd, F_ULOCK, 0)) == -1){
+		error("LDAP: can't unlock utmp file: %s\n",
+		strerror(errno));
+		return -1;
+	}
+
+	close(fd);
+	return 1;
+}
+
+/*
+*	FUNCTION: ldapset_options()
+*	PURPOSE: sets different pppd options retrieved from user's LDAP entry
+*	Currently ldap_set_options() processes radiusFramedIPAddress, radiusSessionTimeout,
+*	radiusIdleTimeout. Additional options should be easy.
+*
+*	ARGUMENTS:
+*	ld - pointer to current LDAP structure
+*	ldap_entry - points to current LDAP entry we want to process
+*	ldap_data - points to ldap_data structure which holds necessary values
+*
+*	RETURNS: Nothing
+*
+*/
+
+static int ldap_setoptions(LDAP *ld, LDAPMessage *ldap_entry, struct ldap_data *ldap_data)
+{
+	int rc;
+	char **ldap_values;
+
+	if (((ldap_values = ldap_get_values(ld, ldap_entry,
+		 RADIUS_FRAMEDIPADDRESS)) != NULL) &&
+		  ((ldap_count_values(ldap_values)) != 0)) {
+		  if ((rc = inet_pton(AF_INET, ldap_values[0],&ldap_data->addr)) > 0){
+		 	ldap_data->address_set = 1;
+#ifdef DEBUG
+		 	info("LDAP: peer address is %p\n",ldap_data->addr);
+#endif
+		  } else
+		  {
+			switch(rc) {
+				case 0:
+				error("LDAP: LDAP server supplied incorrect IP address\n");
+				break;
+
+				default:
+				error("LDAP: Can not convert supplied IP address: %s\n",
+					  strerror(rc));
+				break;
+		  }
+	   }
+	}
+
+	if (((ldap_values = ldap_get_values(ld, ldap_entry,
+		 RADIUS_IDLETIMEOUT)) != NULL ) &&
+		  ((ldap_count_values(ldap_values)) != 0)) {
+		 ldap_data->idle_time_limit = atoi(ldap_values[0]);
+#ifdef DEBUG
+		info("LDAP: peer idle timeout is %u seconds\n",
+				ldap_data->idle_time_limit);
+#endif
+		 idle_time_limit = ldap_data->idle_time_limit;
+	}
+
+	if (((ldap_values = ldap_get_values(ld, ldap_entry,
+		 RADIUS_SESSIONTIMEOUT)) != NULL ) &&
+		 ((ldap_count_values(ldap_values)) != 0)) {
+		 ldap_data->maxconnect = atoi(ldap_values[0]);
+#ifdef DEBUG
+		info("LDAP: peer session timeout is %u seconds\n",
+				ldap_data->maxconnect);
+#endif
+		maxconnect = ldap_data->maxconnect;
+	}
+
+}
diff --git a/main.h b/main.h
new file mode 100644
index 0000000..9a32803
--- /dev/null
+++ b/main.h
@@ -0,0 +1,67 @@
+/* main.h
+*
+*  LDAP plugin for pppd
+*
+*/
+
+#define MAX_BUF	1024
+#define SEARCH_TIMEOUT 20
+/* main.h - contains defenitions for pppd_ldap plugin */
+
+/* Radius-LDAPv3 schema definitions */
+
+#define RADIUS_OBJECTCLASS		"radiusProfile"
+#define RADIUS_DIALUPACCESS 	"dialupAccess"
+#define RADIUS_FRAMEDIPADDRESS	"radiusFramedIPAddress"
+#define RADIUS_FRAMEDMRU		"radiusFramedMTU"
+#define RADIUS_IDLETIMEOUT		"radiusIdleTimeout"
+#define RADIUS_SESSIONTIMEOUT 	"radiusSessionTimeout"
+#define RADIUS_AUTHTYPE			"radiusAuthType"
+
+
+/* Keeps interpreted data recieved from LDAP */
+
+struct ldap_data {
+	int			maxconnect; /* maximum connect time in sec */
+	int			maxoctets; /* maximum number of octets, reserved */
+	int			maxoctets_dir; /* limit direction, reserved */
+	int			idle_time_limit; /* connection idle timeout in sec */
+	int			mru; /* Maximum recieve unit, reserved  */
+	u_int32_t	addr; /* peer's IP address in network format */
+	bool		access_ok; /* 1 if username/password pair correct */
+	bool		address_set; /* 1 if addr contains value */
+	bool		rebind; /* set to 1, reserved */
+};
+
+/* plugin main functions */
+
+static int
+ldap_pap_auth(char *user, char *password, char **msgp,
+	struct wordlist **paddrs, struct wordlist **popts);
+
+static void
+ldap_ip_choose(u_int32_t *addrp);
+
+static int
+ldap_address_allowed(u_int32_t addr);
+
+static int
+ldap_pap_check(void);
+
+static int
+ldap_setoptions(LDAP *ld, LDAPMessage *mesg,
+	struct ldap_data *ldap_data);
+
+static void
+ldap_ip_down(void *opaque, int arg);
+
+static void
+ldap_ip_up(void *opaque, int arg);
+
+static int
+ldap_activate_utmp(struct ldap_data *ldap_data,
+	char *devnam, char *ppp_devname, char *user);
+
+static int
+ldap_deactivate_utmp(char *devnam);
+
diff --git a/ppp_list.c b/ppp_list.c
new file mode 100644
index 0000000..d1b976d
--- /dev/null
+++ b/ppp_list.c
@@ -0,0 +1,60 @@
+/* ppp_list.c
+*
+*  Lists records and it's values from UTMP
+*
+*
+* TODO: Lot's of things... Sorting, displaying, etc.
+*
+*/
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <time.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#define BUF		256
+
+#include "ppp_utmp.h"
+
+int main(argc,argv)
+int argc; char *argv[];
+{
+
+	int rc; /* return values */
+	int fd; /* UTMP file descriptor */
+	struct ppp_utmp entry;
+	char addr[BUF];
+	char time[BUF];
+
+	if ((fd = open(UTMP,O_RDONLY,0600)) == -1)
+	{
+		fprintf(stderr,"%s: %s\n",argv[0], strerror(errno));
+		return -1;
+	}
+
+	fprintf(stdout,"%-8s %-20s %-8s %-15s %10s\n",
+			"LINE","LOGIN","IFACE","ADDRESS","TIME");
+
+	while(read_n(fd, &entry, sizeof(struct ppp_utmp)) &&
+		  entry.state == ACTIVE)
+	{
+		strftime(time,BUF,"%b %d %T",localtime(&entry.time));
+		fprintf(stdout,"%-8s \%-20s %-8s %-15s %-10s\n",
+			entry.line,
+			entry.login,
+			entry.ifname,
+			inet_ntop(AF_INET, &entry.ip_address, addr, BUF),
+			time
+		);
+
+	}
+
+return 1;
+}
+
+
diff --git a/ppp_utmp.h b/ppp_utmp.h
new file mode 100644
index 0000000..d2490a9
--- /dev/null
+++ b/ppp_utmp.h
@@ -0,0 +1,39 @@
+/* ppp_utmp.h
+*
+* Data definitions
+*
+*/
+
+#include <pppd.h>
+
+/* line state integers */
+
+#define	IDLE		0
+#define	ACTIVE		1
+#define UTMP		"/var/run/pppd_utmp"
+
+struct ppp_utmp {
+
+ char		login[MAXNAMELEN]; /* login name */
+ char		line[32];	/* terminal line name */
+ char		ifname[8];	/* ppp interface name */
+ char		cpn[24];	/* A-side number */
+ u_int32_t	ip_address; /* peer's IP address */
+ time_t		time;		/* last changed */
+ int		state;		/* line state */
+
+};
+
+/* Function definitions */
+
+int
+write_n(int fd, void *buf, size_t size);
+
+int
+read_n(int fd, void *buf, size_t size);
+
+off_t
+utmp_seek(int fd, char *line);
+
+int
+utmp_count(int fd, char *login);
diff --git a/radius.ldif b/radius.ldif
new file mode 100644
index 0000000..cef85a2
--- /dev/null
+++ b/radius.ldif
@@ -0,0 +1,11 @@
+dn: cn=Kiska,ou=People,dc=nordcomp,dc=ru
+objectClass: inetOrgPerson
+objectClass: radiusProfile
+cn: Kiska
+uid: Kiska
+sn: Kiska
+radiusAuthType: LDAP
+radiusFramedIPAddress: 192.168.0.105
+radiusSessionTimeout: 16000
+radiusIdleTimeout: 600
+dialupAccess: YES
diff --git a/utmplib.c b/utmplib.c
new file mode 100644
index 0000000..e1a0060
--- /dev/null
+++ b/utmplib.c
@@ -0,0 +1,161 @@
+/*******************************************************************
+* utmplib.c
+*
+* LDAP plugin for pppd. Performs PAP authentication and sets
+* pppd parameters using LDAP as a backend.
+*
+* Copyright (c) Nordcomp LTD, Syktyvkar, Russian Federation
+* Initial version written by Grigoriy Sitkarev <sitkarew@nordcomp.ru>
+*
+* This plugin may be distributed according to the terms of the GNU
+* General Public License, version 2 or any later version.
+*
+********************************************************************/
+/*
+* 2004/05/30: initial version of utmplib procedures
+*
+*/
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <time.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#define MAX_BUF	1024
+
+#include "ppp_utmp.h"
+
+
+/*
+* FUNCTION: off_t utmp_seek(int fd, char *line)
+* PURPOSE:	searches file associated with fd until line
+*			line entry is no found or returns error
+* ARGUMENTS: fd		- data file descriptor
+			 line	- name of the terminal line (without "/dev/")
+*
+* RETURNS:	-1 	in case of error
+*			 off_t record offset position in case of success
+*/
+
+off_t
+utmp_seek(int fd, char *line) {
+
+	struct ppp_utmp utmp;
+
+	if (lseek(fd, SEEK_SET, 0) != -1){
+		while (read_n(fd, &utmp, sizeof(struct ppp_utmp))) {
+			if (strncmp(utmp.line, line, strlen(utmp.line)) == 0)
+			return ((lseek(fd, 0, SEEK_CUR)) - sizeof(struct ppp_utmp));
+		}
+	}
+	return -1;
+}
+
+/*
+* FUNCTION: int utmp_count(int fd, char *login)
+* PURPOSE:	counts ACTIVE entries for login name "login"
+* ARGUMENTS: fd		- data file descriptor
+*			 login	- login name to count entries
+*
+*/
+
+int
+utmp_count(int fd, char *login) {
+
+	int count = 0;
+	struct ppp_utmp utmp;
+
+	if (lseek(fd, SEEK_SET, 0) != -1){
+		while (read_n(fd, &utmp, sizeof(struct ppp_utmp))) {
+			if(strncasecmp(utmp.login, login,
+			strlen(utmp.login)) == 0 &&	(utmp.state == ACTIVE))
+			++count;
+		}
+		return count;
+	}
+	return -1;
+}
+
+
+
+/*
+* FUNCTION: write_n(int, void *, size_t)
+* PURPOSE: Writes exactly size_t bytes or returns error
+* ARGUMENTS: standard write() arguments
+*
+* RETURNS:	-1 in case of error
+*			 1 in case of success
+*/
+
+int write_n(int fd, void *buf, size_t size) {
+
+	int rc; /* keeps results */
+
+	while (1) {
+		rc = write(fd, buf, size);
+		if (rc == -1) {
+			switch (errno) {
+				case EINTR:
+						continue;
+				case EIO:
+						fprintf(stderr,"Hardware failure: %s\n",strerror(errno));
+						return -1;
+				case ENOSPC:
+						fprintf(stderr,"Device if full: %s\n",strerror(errno));
+						return -1;
+				default:
+						fprintf(stderr,"Write failed: %s\n",strerror(errno));
+						return -1;
+			}
+		}
+
+		if (rc < size) continue;
+		break;
+	}
+
+	return 1;
+}
+
+/*
+* FUNCTION: read_n(int, void *, size_t)
+* PURPOSE: reads exactly size_t bytes or returns error
+* ARGUMENTS: standard write() arguments
+*
+* RETURNS:	-1 in case of error
+*			 1 in case of success
+*			 0 in case of EOF (end of file)
+*/
+
+int read_n(int fd, void *buf, size_t size) {
+
+	int rc; /* keeps results */
+
+	while(1) {
+		rc = read(fd, buf, size);
+		if (rc == -1) {
+			switch (rc) {
+			case EINTR:
+					continue;
+			case EIO:
+					fprintf(stderr,"Hardware failure: %s\n",strerror(errno));
+					return -1;
+			default:
+					fprintf(stderr,"Read failed: %s\n",strerror(errno));
+					return -1;
+			}
+		}
+
+		if (rc == 0) return 0;
+		if (rc < size) continue;
+		break;
+	}
+
+	return 1;
+}
+