EditPageHistoryDiffInfoLikePages

Annotated edit history of pppd(8) version 2, including all changes. View license author blame.

Rev	Author	#	Line
1	perry	1	PPPD
		2	!!!PPPD
		3	NAME
		4	SYNOPSIS
		5	DESCRIPTION
		6	FREQUENTLY USED OPTIONS
		7	OPTIONS
		8	OPTIONS FILES
		9	SECURITY
		10	AUTHENTICATION
		11	ROUTING
		12	MULTILINK
		13	EXAMPLES
		14	DIAGNOSTICS
		15	EXIT STATUS
		16	SCRIPTS
		17	FILES
		18	SEE ALSO
		19	NOTES
		20	AUTHORS
		21	----
		22	!!NAME
		23
		24
		25	pppd - Point to Point Protocol daemon
		26	!!SYNOPSIS
		27
		28
		29	__pppd__ [[ ''tty_name'' ] [[ ''speed'' ] [[
		30	''options'' ]
		31	!!DESCRIPTION
		32
		33
		34	The Point-to-Point Protocol (PPP) provides a method for
		35	transmitting datagrams over serial point-to-point links. PPP
		36	is composed of three parts: a method for encapsulating
		37	datagrams over serial links, an extensible Link Control
		38	Protocol (LCP), and a family of Network Control Protocols
		39	(NCP) for establishing and configuring different
		40	network-layer protocols.
		41
		42
		43	The encapsulation scheme is provided by driver code in the
		44	kernel. Pppd provides the basic LCP, authentication support,
		45	and an NCP for establishing and configuring the Internet
		46	Protocol (IP) (called the IP Control Protocol,
		47	IPCP).
		48	!!FREQUENTLY USED OPTIONS
		49
		50
		51	''''
		52
		53
		54	Communicate over the named device. The string
		55
		56
		57	''''
		58
		59
		60	Set the baud rate to
		61
		62
		63	__asyncmap__ ''''
		64
		65
		66	Set the async character map to
		67	asyncmap'' options are given,
		68	the values are ORed together. If no ''asyncmap'' option
		69	is given, no async character map will be negotiated for the
		70	receive direction; the peer should then escape ''all''
		71	control characters. To escape transmitted characters, use
		72	the ''escape'' option.
		73
		74
		75	__auth__
		76
		77
		78	Require the peer to authenticate itself before allowing
		79	network packets to be sent or received. This option is the
		80	default if the system has a default route. If neither this
		81	option nor the ''noauth'' option is specified, pppd will
		82	only allow the peer to use IP addresses to which the system
		83	does not already have a route.
		84
		85
		86	__call__ ''name''
		87
		88
		89	Read options from the file /etc/ppp/peers/''name''. This
		90	file may contain privileged options, such as ''noauth'',
		91	even if pppd is not being run by root. The ''name''
		92	string may not begin with / or include .. as a pathname
		93	component. The format of the options file is described
		94	below.
		95
		96
		97	__connect__ ''script''
		98
		99
		100	Use the executable or shell command specified by
		101	''script'' to set up the serial line. This script would
		102	typically use the chat(8) program to dial the modem and
		103	start the remote ppp session. A value for this option from a
		104	privileged source cannot be overridden by a non-privileged
		105	user.
		106
		107
		108	__crtscts__
		109
		110
		111	Use hardware flow control (i.e. RTS/CTS) to control the flow
		112	of data on the serial port. If neither the ''crtscts'',
		113	the ''nocrtscts'', the ''cdtrcts'' nor the
		114	''nocdtrcts'' option is given, the hardware flow control
		115	setting for the serial port is left unchanged. Some serial
		116	ports (such as Macintosh serial ports) lack a true RTS
		117	output. Such serial ports use this mode to implement
		118	unidirectional flow control. The serial port will suspend
		119	transmission when requested by the modem (via CTS) but will
		120	be unable to request the modem stop sending to the computer.
		121	This mode retains the ability to use DTR as a modem control
		122	line.
		123
		124
		125	__defaultroute__
		126
		127
		128	Add a default route to the system routing tables, using the
		129	peer as the gateway, when IPCP negotiation is successfully
		130	completed. This entry is removed when the PPP connection is
		131	broken. This option is privileged if the
		132	''nodefaultroute'' option has been
		133	specified.
		134
		135
		136	__disconnect__ ''script''
		137
		138
		139	Run the executable or shell command specified by
		140	''script'' after pppd has terminated the link. This
		141	script could, for example, issue commands to the modem to
		142	cause it to hang up if hardware modem control signals were
		143	not available. The disconnect script is not run if the modem
		144	has already hung up. A value for this option from a
		145	privileged source cannot be overridden by a non-privileged
		146	user.
		147
		148
		149	__escape__ ''xx,yy,...''
		150
		151
		152	Specifies that certain characters should be escaped on
		153	transmission (regardless of whether the peer requests them
		154	to be escaped with its async control character map). The
		155	characters to be escaped are specified as a list of hex
		156	numbers separated by commas. Note that almost any character
		157	can be specified for the ''escape'' option, unlike the
		158	''asyncmap'' option which only allows control characters
		159	to be specified. The characters which may not be escaped are
		160	those with hex values 0x20 - 0x3f or 0x5e.
		161
		162
		163	__file__ ''name''
		164
		165
		166	Read options from file ''name'' (the format is described
		167	below). The file must be readable by the user who has
		168	invoked pppd.
		169
		170
		171	__init__ ''script''
		172
		173
		174	Run the executable or shell command specified by
		175	''script'' to initialize the serial line. This script
		176	would typically use the chat(8) program to configure the
		177	modem to enable auto answer. A value for this option from a
		178	privileged source cannot be overridden by a non-privileged
		179	user.
		180
		181
		182	__lock__
		183
		184
		185	Specifies that pppd should create a UUCP-style lock file for
		186	the serial device to ensure exclusive access to the
		187	device.
		188
		189
		190	__mru__ ''n''
		191
		192
		193	Set the MRU [[Maximum Receive Unit] value to ''n''. Pppd
		194	will ask the peer to send packets of no more than ''n''
		195	bytes. The minimum MRU value is 128. The default MRU value
		196	is 1500. A value of 296 is recommended for slow links (40
		197	bytes for TCP/IP header + 256 bytes of data). (Note that for
		198	IPv6 MRU must be at least 1280)
		199
		200
		201	__mtu__ ''n''
		202
		203
		204	Set the MTU [[Maximum Transmit Unit] value to ''n''.
		205	Unless the peer requests a smaller value via MRU
		206	negotiation, pppd will request that the kernel networking
		207	code send data packets of no more than ''n'' bytes
		208	through the PPP network interface. (Note that for IPv6 MTU
		209	must be at least 1280)
		210
		211
		212	__passive__
		213
		214
		215	Enables the
		216	!!OPTIONS
		217
		218
		219	''''__:__''''
		220
		221
		222	Set the local and/or remote interface IP addresses. Either
		223	one may be omitted. The IP addresses can be specified with a
		224	host name or in decimal dot notation (e.g. 150.234.56.78).
		225	The default local address is the (first) IP address of the
		226	system (unless the ''noipdefault'' option is given). The
		227	remote address will be obtained from the peer if not
		228	specified in any option. Thus, in simple cases, this option
		229	is not required. If a local and/or remote IP address is
		230	specified with this option, pppd will not accept a different
		231	value from the peer in the IPCP negotiation, unless the
		232	''ipcp-accept-local'' and/or ''ipcp-accept-remote''
		233	options are given, respectively.
		234
		235
		236	__ipv6__
		237	'''',''''
		238
		239
		240	Set the local and/or remote 64-bit interface identifier.
		241	Either one may be omitted. The identifier must be specified
		242	in standard ascii notation of IPv6 addresses (e.g.
		243	::dead:beef). If the ''ipv6cp-use-ipaddr'' option is
		244	given, the local identifier is the local IPv4 address (see
		245	above). On systems which supports a unique persistent id,
		246	such as EUI-48 derived from the Ethernet MAC address,
		247	''ipv6cp-use-persistent'' option can be used to replace
		248	the ''ipv6 '' option.
		249	Otherwise the identifier is randomized.
		250
		251
		252	__active-filter__ ''filter-expression''
		253
		254
		255	Specifies a packet filter to be applied to data packets to
		256	determine which packets are to be regarded as link activity,
		257	and therefore reset the idle timer, or cause the link to be
		258	brought up in demand-dialling mode. This option is useful in
		259	conjunction with the __idle__ option if there are packets
		260	being sent or received regularly over the link (for example,
		261	routing information packets) which would otherwise prevent
		262	the link from ever appearing to be idle. The
		263	''filter-expression'' syntax is as described for
		264	tcpdump(1), except that qualifiers which are inappropriate
		265	for a PPP link, such as __ether__ and __arp__, are not
		266	permitted. Generally the filter expression should be
		267	enclosed in single-quotes to prevent whitespace in the
		268	expression from being interpreted by the shell.
		269
		270
		271	__allow-ip__ ''address(es)''
		272
		273
		274	Allow peers to use the given IP address or subnet without
		275	authenticating themselves. The parameter is parsed as for
		276	each element of the list of allowed IP addresses in the
		277	secrets files (see the AUTHENTICATION section
		278	below).
		279
		280
		281	__bsdcomp__ ''nr,nt''
		282
		283
		284	Request that the peer compress packets that it sends, using
		285	the BSD-Compress scheme, with a maximum code size of
		286	''nr'' bits, and agree to compress packets sent to the
		287	peer with a maximum code size of ''nt'' bits. If
		288	''nt'' is not specified, it defaults to the value given
		289	for ''nr''. Values in the range 9 to 15 may be used for
		290	''nr'' and ''nt''; larger values give better
		291	compression but consume more kernel memory for compression
		292	dictionaries. Alternatively, a value of 0 for ''nr'' or
		293	''nt'' disables compression in the corresponding
		294	direction. Use ''nobsdcomp'' or ''bsdcomp 0'' to
		295	disable BSD-Compress compression entirely.
		296
		297
		298	__cdtrcts__
		299
		300
		301	Use a non-standard hardware flow control (i.e. DTR/CTS) to
		302	control the flow of data on the serial port. If neither the
		303	''crtscts'', the ''nocrtscts'', the ''cdtrcts'' nor
		304	the ''nocdtrcts'' option is given, the hardware flow
		305	control setting for the serial port is left unchanged. Some
		306	serial ports (such as Macintosh serial ports) lack a true
		307	RTS output. Such serial ports use this mode to implement
		308	true bi-directional flow control. The sacrifice is that this
		309	flow control mode does not permit using DTR as a modem
		310	control line.
		311
		312
		313	__chap-interval__ ''n''
		314
		315
		316	If this option is given, pppd will rechallenge the peer
		317	every ''n'' seconds.
		318
		319
		320	__chap-max-challenge__ ''n''
		321
		322
		323	Set the maximum number of CHAP challenge transmissions to
		324	''n'' (default 10).
		325
		326
		327	__chap-restart__ ''n''
		328
		329
		330	Set the CHAP restart interval (retransmission timeout for
		331	challenges) to ''n'' seconds (default 3).
		332
		333
		334	__connect-delay__ ''n''
		335
		336
		337	Wait for up ''n'' milliseconds after the connect script
		338	finishes for a valid PPP packet from the peer. At the end of
		339	this time, or when a valid PPP packet is received from the
		340	peer, pppd will commence negotiation by sending its first
		341	LCP packet. The default value is 1000 (1 second). This wait
		342	period only applies if the __connect__ or __pty__
		343	option is used.
		344
		345
		346	__debug__
		347
		348
		349	Enables connection debugging facilities. If this option is
		350	given, pppd will log the contents of all control packets
		351	sent or received in a readable form. The packets are logged
		352	through syslog with facility ''daemon'' and level
		353	''debug''. This information can be directed to a file by
		354	setting up /etc/syslog.conf appropriately (see
		355	syslog.conf(5)).
		356
		357
		358	__default-asyncmap__
		359
		360
		361	Disable asyncmap negotiation, forcing all control characters
		362	to be escaped for both the transmit and the receive
		363	direction.
		364
		365
		366	__default-mru__
		367
		368
		369	Disable MRU [[Maximum Receive Unit] negotiation. With this
		370	option, pppd will use the default MRU value of 1500 bytes
		371	for both the transmit and receive direction.
		372
		373
		374	__deflate__ ''nr,nt''
		375
		376
		377	Request that the peer compress packets that it sends, using
		378	the Deflate scheme, with a maximum window size of
		379	''2**nr'' bytes, and agree to compress packets sent to
		380	the peer with a maximum window size of ''2**nt'' bytes.
		381	If ''nt'' is not specified, it defaults to the value
		382	given for ''nr''. Values in the range 9 to 15 may be used
		383	for ''nr'' and ''nt''; larger values give better
		384	compression but consume more kernel memory for compression
		385	dictionaries. Alternatively, a value of 0 for ''nr'' or
		386	''nt'' disables compression in the corresponding
		387	direction. Use ''nodeflate'' or ''deflate 0'' to
		388	disable Deflate compression entirely. (Note: pppd requests
		389	Deflate compression in preference to BSD-Compress if the
		390	peer can do either.)
		391
		392
		393	__demand__
		394
		395
		396	Initiate the link only on demand, i.e. when data traffic is
		397	present. With this option, the remote IP address must be
		398	specified by the user on the command line or in an options
		399	file. Pppd will initially configure the interface and enable
		400	it for IP traffic without connecting to the peer. When
		401	traffic is available, pppd will connect to the peer and
		402	perform negotiation, authentication, etc. When this is
		403	completed, pppd will commence passing data packets (i.e., IP
		404	packets) across the link.
		405
		406
		407	The ''demand'' option implies the ''persist'' option.
		408	If this behaviour is not desired, use the ''nopersist''
		409	option after the ''demand'' option. The ''idle'' and
		410	''holdoff'' options are also useful in conjuction with
		411	the ''demand'' option.
		412
		413
		414	__domain__ ''d''
		415
		416
		417	Append the domain name ''d'' to the local host name for
		418	authentication purposes. For example, if gethostname()
		419	returns the name porsche, but the fully qualified domain
		420	name is porsche.Quotron.COM, you could specify ''domain
		421	Quotron.COM''. Pppd would then use the name
		422	''porsche.Quotron.COM'' for looking up secrets in the
		423	secrets file, and as the default name to send to the peer
		424	when authenticating itself to the peer. This option is
		425	privileged.
		426
		427
		428	__dryrun__
		429
		430
		431	With the __dryrun__ option, pppd will print out all the
		432	option values which have been set and then exit, after
		433	parsing the command line and options files and checking the
		434	option values, but before initiating the link. The option
		435	values are logged at level info, and also printed to
		436	standard output unless the device on standard output is the
		437	device that pppd would be using to communicate with the
		438	peer.
		439
		440
		441	__dump__
		442
		443
		444	With the __dump__ option, pppd will print out all the
		445	option values which have been set. This option is like the
		446	__dryrun__ option except that pppd proceeds as normal
		447	rather than exiting.
		448
		449
		450	__endpoint__ ''''
		451
		452
		453	Sets the endpoint discriminator sent by the local machine to
		454	the peer during multilink negotiation to
		455	''''. The default is to use the MAC address
		456	of the first ethernet interface on the system, if any,
		457	otherwise the IPv4 address corresponding to the hostname, if
		458	any, provided it is not in the multicast or locally-assigned
		459	IP address ranges, or the localhost address. The endpoint
		460	discriminator can be the string __null__ or of the form
		461	''type'':''value'', where type is a decimal number or
		462	one of the strings __local__, __IP__, __MAC__,
		463	__magic__, or __phone__. The value is an IP address in
		464	dotted-decimal notation for the __IP__ type, or a string
		465	of bytes in hexadecimal, separated by periods or colons for
		466	the other types. For the MAC type, the value may also be the
		467	name of an ethernet or similar network interface. This
		468	option is currently only available under Linux.
		469
		470
		471	__hide-password__
		472
		473
		474	When logging the contents of PAP packets, this option causes
		475	pppd to exclude the password string from the log. This is
		476	the default.
		477
		478
		479	__holdoff__ ''n''
		480
		481
		482	Specifies how many seconds to wait before re-initiating the
		483	link after it terminates. This option only has any effect if
		484	the ''persist'' or ''demand'' option is used. The
		485	holdoff period is not applied if the link was terminated
		486	because it was idle.
		487
		488
		489	__idle__ ''n''
		490
		491
		492	Specifies that pppd should disconnect if the link is idle
		493	for ''n'' seconds. The link is idle when no data packets
		494	(i.e. IP packets) are being sent or received. Note: it is
		495	not advisable to use this option with the ''persist''
		496	option without the ''demand'' option. If the
		497	__active-filter__ option is given, data packets which are
		498	rejected by the specified activity filter also count as the
		499	link being idle.
		500
		501
		502	__ipcp-accept-local__
		503
		504
		505	With this option, pppd will accept the peer's idea of our
		506	local IP address, even if the local IP address was specified
		507	in an option.
		508
		509
		510	__ipcp-accept-remote__
		511
		512
		513	With this option, pppd will accept the peer's idea of its
		514	(remote) IP address, even if the remote IP address was
		515	specified in an option.
		516
		517
		518	__ipcp-max-configure__ ''n''
		519
		520
		521	Set the maximum number of IPCP configure-request
		522	transmissions to ''n'' (default 10).
		523
		524
		525	__ipcp-max-failure__ ''n''
		526
		527
		528	Set the maximum number of IPCP configure-NAKs returned
		529	before starting to send configure-Rejects instead to
		530	''n'' (default 10).
		531
		532
		533	__ipcp-max-terminate__ ''n''
		534
		535
		536	Set the maximum number of IPCP terminate-request
		537	transmissions to ''n'' (default 3).
		538
		539
		540	__ipcp-restart__ ''n''
		541
		542
		543	Set the IPCP restart interval (retransmission timeout) to
		544	''n'' seconds (default 3).
		545
		546
		547	__ipparam__ ''string''
		548
		549
		550	Provides an extra parameter to the ip-up and ip-down
		551	scripts. If this option is given, the ''string'' supplied
		552	is given as the 6th parameter to those scripts.
		553
		554
		555	__ipv6cp-max-configure__ ''n''
		556
		557
		558	Set the maximum number of IPv6CP configure-request
		559	transmissions to ''n'' (default 10).
		560
		561
		562	__ipv6cp-max-failure__ ''n''
		563
		564
		565	Set the maximum number of IPv6CP configure-NAKs returned
		566	before starting to send configure-Rejects instead to
		567	''n'' (default 10).
		568
		569
		570	__ipv6cp-max-terminate__ ''n''
		571
		572
		573	Set the maximum number of IPv6CP terminate-request
		574	transmissions to ''n'' (default 3).
		575
		576
		577	__ipv6cp-restart__ ''n''
		578
		579
		580	Set the IPv6CP restart interval (retransmission timeout) to
		581	''n'' seconds (default 3).
		582
		583
		584	__ipx__
		585
		586
		587	Enable the IPXCP and IPX protocols. This option is presently
		588	only supported under Linux, and only if your kernel has been
		589	configured to include IPX support.
		590
		591
		592	__ipx-network__ ''n''
		593
		594
		595	Set the IPX network number in the IPXCP configure request
		596	frame to ''n'', a hexadecimal number (without a leading
		597	0x). There is no valid default. If this option is not
		598	specified, the network number is obtained from the peer. If
		599	the peer does not have the network number, the IPX protocol
		600	will not be started.
		601
		602
		603	__ipx-node__ ''n''__:__''m''
		604
		605
		606	Set the IPX node numbers. The two node numbers are separated
		607	from each other with a colon character. The first number
		608	''n'' is the local node number. The second number
		609	''m'' is the peer's node number. Each node number is a
		610	hexadecimal number, at most 10 digits long. The node numbers
		611	on the ipx-network must be unique. There is no valid
		612	default. If this option is not specified then the node
		613	numbers are obtained from the peer.
		614
		615
		616	__ipx-router-name__ ''''
		617
		618
		619	Set the name of the router. This is a string and is sent to
		620	the peer as information data.
		621
		622
		623	__ipx-routing__ ''n''
		624
		625
		626	Set the routing protocol to be received by this option. More
		627	than one instance of ''ipx-routing'' may be specified.
		628	The '''none''' option (0) may be specified as the only
		629	instance of ipx-routing. The values may be ''0'' for
		630	''NONE'', ''2'' for ''RIP/SAP'', and ''4'' for
		631	''NLSP''.
		632
		633
		634	__ipxcp-accept-local__
		635
		636
		637	Accept the peer's NAK for the node number specified in the
		638	ipx-node option. If a node number was specified, and
		639	non-zero, the default is to insist that the value be used.
		640	If you include this option then you will permit the peer to
		641	override the entry of the node number.
		642
		643
		644	__ipxcp-accept-network__
		645
		646
		647	Accept the peer's NAK for the network number specified in
		648	the ipx-network option. If a network number was specified,
		649	and non-zero, the default is to insist that the value be
		650	used. If you include this option then you will permit the
		651	peer to override the entry of the node number.
		652
		653
		654	__ipxcp-accept-remote__
		655
		656
		657	Use the peer's network number specified in the configure
		658	request frame. If a node number was specified for the peer
		659	and this option was not specified, the peer will be forced
		660	to use the value which you have specified.
		661
		662
		663	__ipxcp-max-configure__ ''n''
		664
		665
		666	Set the maximum number of IPXCP configure request frames
		667	which the system will send to ''n''. The default is
		668	10.
		669
		670
		671	__ipxcp-max-failure__ ''n''
		672
		673
		674	Set the maximum number of IPXCP NAK frames which the local
		675	system will send before it rejects the options. The default
		676	value is 3.
		677
		678
		679	__ipxcp-max-terminate__ ''n''
		680
		681
		682	Set the maximum nuber of IPXCP terminate request frames
		683	before the local system considers that the peer is not
		684	listening to them. The default value is 3.
		685
		686
		687	__kdebug__ ''n''
		688
		689
		690	Enable debugging code in the kernel-level PPP driver. The
		691	argument values depend on the specific kernel driver, but in
		692	general a value of 1 will enable general kernel debug
		693	messages. (Note that these messages are usually only useful
		694	for debugging the kernel driver itself.) For the Linux 2.2.x
		695	kernel driver, the value is a sum of bits: 1 to enable
		696	general debug messages, 2 to request that the contents of
		697	received packets be printed, and 4 to request that the
		698	contents of transmitted packets be printed. On most systems,
		699	messages printed by the kernel are logged by syslog(1) to a
		700	file as directed in the /etc/syslog.conf configuration
		701	file.
		702
		703
		704	__ktune__
		705
		706
		707	Enables pppd to alter kernel settings as appropriate. Under
		708	Linux, pppd will enable IP forwarding (i.e. set
		709	/proc/sys/net/ipv4/ip_forward to 1) if the ''proxyarp''
		710	option is used, and will enable the dynamic IP address
		711	option (i.e. set /proc/sys/net/ipv4/ip_dynaddr to 1) in
		712	demand mode if the local address changes.
		713
		714
		715	__lcp-echo-failure__ ''n''
		716
		717
		718	If this option is given, pppd will presume the peer to be
		719	dead if ''n'' LCP echo-requests are sent without
		720	receiving a valid LCP echo-reply. If this happens, pppd will
		721	terminate the connection. Use of this option requires a
		722	non-zero value for the ''lcp-echo-interval'' parameter.
		723	This option can be used to enable pppd to terminate after
		724	the physical connection has been broken (e.g., the modem has
		725	hung up) in situations where no hardware modem control lines
		726	are available.
		727
		728
		729	__lcp-echo-interval__ ''n''
		730
		731
		732	If this option is given, pppd will send an LCP echo-request
		733	frame to the peer every ''n'' seconds. Normally the peer
		734	should respond to the echo-request by sending an echo-reply.
		735	This option can be used with the ''lcp-echo-failure''
		736	option to detect that the peer is no longer
		737	connected.
		738
		739
		740	__lcp-max-configure__ ''n''
		741
		742
		743	Set the maximum number of LCP configure-request
		744	transmissions to ''n'' (default 10).
		745
		746
		747	__lcp-max-failure__ ''n''
		748
		749
		750	Set the maximum number of LCP configure-NAKs returned before
		751	starting to send configure-Rejects instead to ''n''
		752	(default 10).
		753
		754
		755	__lcp-max-terminate__ ''n''
		756
		757
		758	Set the maximum number of LCP terminate-request
		759	transmissions to ''n'' (default 3).
		760
		761
		762	__lcp-restart__ ''n''
		763
		764
		765	Set the LCP restart interval (retransmission timeout) to
		766	''n'' seconds (default 3).
		767
		768
		769	__linkname__ ''name''
		770
		771
		772	Sets the logical name of the link to ''name''. Pppd will
		773	create a file named __ppp-__''name''__.pid__ in
		774	/var/run (or /etc/ppp on some systems) containing its
		775	process ID. This can be useful in determining which instance
		776	of pppd is responsible for the link to a given peer system.
		777	This is a privileged option.
		778
		779
		780	__local__
		781
		782
		783	Don't use the modem control lines. With this option, pppd
		784	will ignore the state of the CD (Carrier Detect) signal from
		785	the modem and will not change the state of the DTR (Data
		786	Terminal Ready) signal.
		787
		788
		789	__logfd__ ''n''
		790
		791
		792	Send log messages to file descriptor ''n''. Pppd will
		793	send log messages to at most one file or file descriptor (as
		794	well as sending the log messages to syslog), so this option
		795	and the __logfile__ option are mutually exclusive. The
		796	default is for pppd to send log messages to stdout (file
		797	descriptor 1), unless the serial port is already open on
		798	stdout.
		799
		800
		801	__logfile__ ''filename''
		802
		803
		804	Append log messages to the file ''filename'' (as well as
		805	sending the log messages to syslog). The file is opened with
		806	the privileges of the user who invoked pppd, in append
		807	mode.
		808
		809
		810	__login__
		811
		812
		813	Use the system password database for authenticating the peer
		814	using PAP, and record the user in the system wtmp file. Note
		815	that the peer must have an entry in the /etc/ppp/pap-secrets
		816	file as well as the system password database to be allowed
		817	access.
		818
		819
		820	__maxconnect__ ''n''
		821
		822
		823	Terminate the connection when it has been available for
		824	network traffic for ''n'' seconds (i.e. ''n'' seconds
		825	after the first network control protocol comes
		826	up).
		827
		828
		829	__maxfail__ ''n''
		830
		831
		832	Terminate after ''n'' consecutive failed connection
		833	attempts. A value of 0 means no limit. The default value is
		834	10.
		835
		836
		837	__modem__
		838
		839
		840	Use the modem control lines. This option is the default.
		841	With this option, pppd will wait for the CD (Carrier Detect)
		842	signal from the modem to be asserted when opening the serial
		843	device (unless a connect script is specified), and it will
		844	drop the DTR (Data Terminal Ready) signal briefly when the
		845	connection is terminated and before executing the connect
		846	script. On Ultrix, this option implies hardware flow
		847	control, as for the ''crtscts'' option.
		848
		849
		850	__mp__
		851
		852
		853	Enables the use of PPP multilink; this is an alias for the
		854	`multilink' option. This option is currently only available
		855	under Linux.
		856
		857
		858	__mpshortseq__
		859
		860
		861	Enables the use of short (12-bit) sequence numbers in
		862	multilink headers, as opposed to 24-bit sequence numbers.
		863	This option is only available under Linux, and only has any
		864	effect if multilink is enabled (see the multilink
		865	option).
		866
		867
		868	__mrru__ ''n''
		869
		870
		871	Sets the Maximum Reconstructed Receive Unit to ''n''. The
		872	MRRU is the maximum size for a received packet on a
		873	multilink bundle, and is analogous to the MRU for the
		874	individual links. This option is currently only available
		875	under Linux, and only has any effect if multilink is enabled
		876	(see the multilink option).
		877
		878
		879	__ms-dns__ ''''
		880
		881
		882	If pppd is acting as a server for Microsoft Windows clients,
		883	this option allows pppd to supply one or two DNS (Domain
		884	Name Server) addresses to the clients. The first instance of
		885	this option specifies the primary DNS address; the second
		886	instance (if given) specifies the secondary DNS address.
		887	(This option was present in some older versions of pppd
		888	under the name __dns-addr__.)
		889
		890
		891	__ms-wins__ ''''
		892
		893
		894	If pppd is acting as a server for Microsoft Windows or
		895
		896
		897	__multilink__
		898
		899
		900	Enables the use of the PPP multilink protocol. If the peer
		901	also supports multilink, then this link can become part of a
		902	bundle between the local system and the peer. If there is an
		903	existing bundle to the peer, pppd will join this link to
		904	that bundle, otherwise pppd will create a new bundle. See
		905	the MULTILINK section below. This option is currently only
		906	available under Linux.
		907
		908
		909	__name__ ''name''
		910
		911
		912	Set the name of the local system for authentication purposes
		913	to ''name''. This is a privileged option. With this
		914	option, pppd will use lines in the secrets files which have
		915	''name'' as the second field when looking for a secret to
		916	use in authenticating the peer. In addition, unless
		917	overridden with the ''user'' option, ''name'' will be
		918	used as the name to send to the peer when authenticating the
		919	local system to the peer. (Note that pppd does not append
		920	the domain name to ''name''.)
		921
		922
		923	__netmask__ ''n''
		924
		925
		926	Set the interface netmask to ''n'', a 32 bit netmask in
		927	''
		928
		929
		930	__noaccomp__
		931
		932
		933	Disable Address/Control compression in both directions (send
		934	and receive).
		935
		936
		937	__noauth__
		938
		939
		940	Do not require the peer to authenticate itself. This option
		941	is privileged.
		942
		943
		944	__nobsdcomp__
		945
		946
		947	Disables BSD-Compress compression; __pppd__ will not
		948	request or agree to compress packets using the BSD-Compress
		949	scheme.
		950
		951
		952	__noccp__
		953
		954
		955	Disable CCP (Compression Control Protocol) negotiation. This
		956	option should only be required if the peer is buggy and gets
		957	confused by requests from pppd for CCP
		958	negotiation.
		959
		960
		961	__nocrtscts__
		962
		963
		964	Disable hardware flow control (i.e. RTS/CTS) on the serial
		965	port. If neither the ''crtscts'' nor the ''nocrtscts''
		966	nor the ''cdtrcts'' nor the ''nocdtrcts'' option is
		967	given, the hardware flow control setting for the serial port
		968	is left unchanged.
		969
		970
		971	__nocdtrcts__
		972
		973
		974	This option is a synonym for ''nocrtscts''. Either of
		975	these options will disable both forms of hardware flow
		976	control.
		977
		978
		979	__nodefaultroute__
		980
		981
		982	Disable the ''defaultroute'' option. The system
		983	administrator who wishes to prevent users from creating
		984	default routes with pppd can do so by placing this option in
		985	the /etc/ppp/options file.
		986
		987
		988	__nodeflate__
		989
		990
		991	Disables Deflate compression; pppd will not request or agree
		992	to compress packets using the Deflate scheme.
		993
		994
		995	__nodetach__
		996
		997
		998	Don't detach from the controlling terminal. Without this
		999	option, if a serial device other than the terminal on the
		1000	standard input is specified, pppd will fork to become a
		1001	background process.
		1002
		1003
		1004	__noendpoint__
		1005
		1006
		1007	Disables pppd from sending an endpoint discriminator to the
		1008	peer or accepting one from the peer (see the MULTILINK
		1009	section below). This option should only be required if the
		1010	peer is buggy.
		1011
		1012
		1013	__noip__
		1014
		1015
		1016	Disable IPCP negotiation and IP communication. This option
		1017	should only be required if the peer is buggy and gets
		1018	confused by requests from pppd for IPCP
		1019	negotiation.
		1020
		1021
		1022	__noipv6__
		1023
		1024
		1025	Disable IPv6CP negotiation and IPv6 communication. This
		1026	option should only be required if the peer is buggy and gets
		1027	confused by requests from pppd for IPv6CP
		1028	negotiation.
		1029
		1030
		1031	__noipdefault__
		1032
		1033
		1034	Disables the default behaviour when no local IP address is
		1035	specified, which is to determine (if possible) the local IP
		1036	address from the hostname. With this option, the peer will
		1037	have to supply the local IP address during IPCP negotiation
		1038	(unless it specified explicitly on the command line or in an
		1039	options file).
		1040
		1041
		1042	__noipx__
		1043
		1044
		1045	Disable the IPXCP and IPX protocols. This option should only
		1046	be required if the peer is buggy and gets confused by
		1047	requests from pppd for IPXCP negotiation.
		1048
		1049
		1050	__noktune__
		1051
		1052
		1053	Opposite of the ''ktune'' option; disables pppd from
		1054	changing system settings.
		1055
		1056
		1057	__nolog__
		1058
		1059
		1060	Do not send log messages to a file or file descriptor. This
		1061	option cancels the __logfd__ and __logfile__
		1062	options.
		1063
		1064
		1065	__nomagic__
		1066
		1067
		1068	Disable magic number negotiation. With this option, pppd
		1069	cannot detect a looped-back line. This option should only be
		1070	needed if the peer is buggy.
		1071
		1072
		1073	__nomp__
		1074
		1075
		1076	Disables the use of PPP multilink. This option is currently
		1077	only available under Linux.
		1078
		1079
		1080	__nompshortseq__
		1081
		1082
		1083	Disables the use of short (12-bit) sequence numbers in the
		1084	PPP multilink protocol, forcing the use of 24-bit sequence
		1085	numbers. This option is currently only available under
		1086	Linux, and only has any effect if multilink is
		1087	enabled.
		1088
		1089
		1090	__nomultilink__
		1091
		1092
		1093	Disables the use of PPP multilink. This option is currently
		1094	only available under Linux.
		1095
		1096
		1097	__nopcomp__
		1098
		1099
		1100	Disable protocol field compression negotiation in both the
		1101	receive and the transmit direction.
		1102
		1103
		1104	__nopersist__
		1105
		1106
		1107	Exit once a connection has been made and terminated. This is
		1108	the default unless the ''persist'' or ''demand''
		1109	option has been specified.
		1110
		1111
		1112	__nopredictor1__
		1113
		1114
		1115	Do not accept or agree to Predictor-1
		1116	compression.
		1117
		1118
		1119	__noproxyarp__
		1120
		1121
		1122	Disable the ''proxyarp'' option. The system administrator
		1123	who wishes to prevent users from creating proxy ARP entries
		1124	with pppd can do so by placing this option in the
		1125	/etc/ppp/options file.
		1126
		1127
		1128	__notty__
		1129
		1130
		1131	Normally, pppd requires a terminal device. With this option,
		1132	pppd will allocate itself a pseudo-tty master/slave pair and
		1133	use the slave as its terminal device. Pppd will create a
		1134	child process to act as a `character shunt' to transfer
		1135	characters between the pseudo-tty master and its standard
		1136	input and output. Thus pppd will transmit characters on its
		1137	standard output and receive characters on its standard input
		1138	even if they are not terminal devices. This option increases
		1139	the latency and CPU overhead of transferring data over the
		1140	ppp interface as all of the characters sent and received
		1141	must flow through the character shunt process. An explicit
		1142	device name may not be given if this option is
		1143	used.
		1144
		1145
		1146	__novj__
		1147
		1148
		1149	Disable Van Jacobson style TCP/IP header compression in both
		1150	the transmit and the receive direction.
		1151
		1152
		1153	__novjccomp__
		1154
		1155
		1156	Disable the connection-ID compression option in Van Jacobson
		1157	style TCP/IP header compression. With this option, pppd will
		1158	not omit the connection-ID byte from Van Jacobson compressed
		1159	TCP/IP headers, nor ask the peer to do so.
		1160
		1161
		1162	__papcrypt__
		1163
		1164
		1165	Indicates that all secrets in the /etc/ppp/pap-secrets file
		1166	which are used for checking the identity of the peer are
		1167	encrypted, and thus pppd should not accept a password which,
		1168	before encryption, is identical to the secret from the
		1169	/etc/ppp/pap-secrets file.
		1170
		1171
		1172	__pap-max-authreq__ ''n''
		1173
		1174
		1175	Set the maximum number of PAP authenticate-request
		1176	transmissions to ''n'' (default 10).
		1177
		1178
		1179	__pap-restart__ ''n''
		1180
		1181
		1182	Set the PAP restart interval (retransmission timeout) to
		1183	''n'' seconds (default 3).
		1184
		1185
		1186	__pap-timeout__ ''n''
		1187
		1188
		1189	Set the maximum time that pppd will wait for the peer to
		1190	authenticate itself with PAP to ''n'' seconds (0 means no
		1191	limit).
		1192
		1193
		1194	__pass-filter__ ''filter-expression''
		1195
		1196
		1197	Specifies a packet filter to applied to data packets being
		1198	sent or received to determine which packets should be
		1199	allowed to pass. Packets which are rejected by the filter
		1200	are silently discarded. This option can be used to prevent
		1201	specific network daemons (such as routed) using up link
		1202	bandwidth, or to provide a basic firewall capability. The
		1203	''filter-expression'' syntax is as described for
		1204	tcpdump(1), except that qualifiers which are inappropriate
		1205	for a PPP link, such as __ether__ and __arp__, are not
		1206	permitted. Generally the filter expression should be
		1207	enclosed in single-quotes to prevent whitespace in the
		1208	expression from being interpreted by the shell. Note that it
		1209	is possible to apply different constraints to incoming and
		1210	outgoing packets using the __inbound__ and
		1211	__outbound__ qualifiers. This option is currently only
		1212	available under NetBSD, and then only if both the kernel and
		1213	pppd were compiled with PPP_FILTER defined.
		1214
		1215
		1216	__persist__
		1217
		1218
		1219	Do not exit after a connection is terminated; instead try to
		1220	reopen the connection. The __maxfail__ option still has
		1221	an effect on persistent connections.
		1222
		1223
		1224	__plugin__ ''filename''
		1225
		1226
		1227	Load the shared library object file ''filename'' as a
		1228	plugin. This is a privileged option.
		1229
		1230
		1231	__predictor1__
		1232
		1233
		1234	Request that the peer compress frames that it sends using
		1235	Predictor-1 compression, and agree to compress transmitted
		1236	frames with Predictor-1 if requested. This option has no
		1237	effect unless the kernel driver supports Predictor-1
		1238	compression.
		1239
		1240
		1241	__privgroup__ ''group-name''
		1242
		1243
		1244	Allows members of group ''group-name'' to use privileged
		1245	options. This is a privileged option. Use of this option
		1246	requires care as there is no guarantee that members of
		1247	''group-name'' cannot use pppd to become root themselves.
		1248	Consider it equivalent to putting the members of
		1249	''group-name'' in the kmem or disk group.
		1250
		1251
		1252	__proxyarp__
		1253
		1254
		1255	Add an entry to this system's ARP [[Address Resolution
		1256	Protocol] table with the IP address of the peer and the
		1257	Ethernet address of this system. This will have the effect
		1258	of making the peer appear to other systems to be on the
		1259	local ethernet.
		1260
		1261
		1262	__pty__ ''script''
		1263
		1264
		1265	Specifies that the command ''script'' is to be used to
		1266	communicate rather than a specific terminal device. Pppd
		1267	will allocate itself a pseudo-tty master/slave pair and use
		1268	the slave as its terminal device. The ''script'' will be
		1269	run in a child process with the pseudo-tty master as its
		1270	standard input and output. An explicit device name may not
		1271	be given if this option is used. (Note: if the ''record''
		1272	option is used in conjuction with the ''pty'' option, the
		1273	child process will have pipes on its standard input and
		1274	output.)
		1275
		1276
		1277	__receive-all__
		1278
		1279
		1280	With this option, pppd will accept all control characters
		1281	from the peer, including those marked in the receive
		1282	asyncmap. Without this option, pppd will discard those
		1283	characters as specified in RFC1662. This option should only
		1284	be needed if the peer is buggy.
		1285
		1286
		1287	__record__ ''filename''
		1288
		1289
		1290	Specifies that pppd should record all characters sent and
		1291	received to a file named ''filename''. This file is
		1292	opened in append mode, using the user's user-ID and
		1293	permissions. This option is implemented using a pseudo-tty
		1294	and a process to transfer characters between the pseudo-tty
		1295	and the real serial device, so it will increase the latency
		1296	and CPU overhead of transferring data over the ppp
		1297	interface. The characters are stored in a tagged format with
		1298	timestamps, which can be displayed in readable form using
		1299	the pppdump(8) program.
		1300
		1301
		1302	__remotename__ ''name''
		1303
		1304
		1305	Set the assumed name of the remote system for authentication
		1306	purposes to ''name''.
		1307
		1308
		1309	__refuse-chap__
		1310
		1311
		1312	With this option, pppd will not agree to authenticate itself
		1313	to the peer using CHAP.
		1314
		1315
		1316	__refuse-pap__
		1317
		1318
		1319	With this option, pppd will not agree to authenticate itself
		1320	to the peer using PAP.
		1321
		1322
		1323	__require-chap__
		1324
		1325
		1326	Require the peer to authenticate itself using CHAP
		1327	[[Challenge Handshake Authentication Protocol]
		1328	authentication.
		1329
		1330
		1331	__require-pap__
		1332
		1333
		1334	Require the peer to authenticate itself using PAP [[Password
		1335	Authentication Protocol] authentication.
		1336
		1337
		1338	__show-password__
		1339
		1340
		1341	When logging the contents of PAP packets, this option causes
		1342	pppd to show the password string in the log
		1343	message.
		1344
		1345
		1346	__silent__
		1347
		1348
		1349	With this option, pppd will not transmit LCP packets to
		1350	initiate a connection until a valid LCP packet is received
		1351	from the peer (as for the `passive' option with ancient
		1352	versions of pppd).
		1353
		1354
		1355	__sync__
		1356
		1357
		1358	Use synchronous HDLC serial encoding instead of
		1359	asynchronous. The device used by pppd with this option must
2	perry	1360	have sync support. Currently supports Microgate !SyncLink
1	perry	1361	adapters under Linux and FreeBSD 2.2.8 and
		1362	later.
		1363
		1364
		1365	__updetach__
		1366
		1367
		1368	With this option, pppd will detach from its controlling
		1369	terminal once it has successfully established the ppp
		1370	connection (to the point where the first network control
		1371	protocol, usually the IP control protocol, has come
		1372	up).
		1373
		1374
		1375	__usehostname__
		1376
		1377
		1378	Enforce the use of the hostname (with domain name appended,
		1379	if given) as the name of the local system for authentication
		1380	purposes (overrides the ''name'' option). This option is
		1381	not normally needed since the ''name'' option is
		1382	privileged.
		1383
		1384
		1385	__usepeerdns__
		1386
		1387
		1388	Ask the peer for up to 2 DNS server addresses. The addresses
		1389	supplied by the peer (if any) are passed to the
		1390	/etc/ppp/ip-up script in the environment variables DNS1 and
		1391	DNS2. In addition, pppd will create an /etc/ppp/resolv.conf
		1392	file containing one or two nameserver lines with the
		1393	address(es) supplied by the peer.
		1394
		1395
		1396	__user__ ''name''
		1397
		1398
		1399	Sets the name used for authenticating the local system to
		1400	the peer to ''name''.
		1401
		1402
		1403	__vj-max-slots__ ''n''
		1404
		1405
		1406	Sets the number of connection slots to be used by the Van
		1407	Jacobson TCP/IP header compression and decompression code to
		1408	''n'', which must be between 2 and 16
		1409	(inclusive).
		1410
		1411
		1412	__welcome__ ''script''
		1413
		1414
		1415	Run the executable or shell command specified by
		1416	''script'' before initiating PPP negotiation, after the
		1417	connect script (if any) has completed. A value for this
		1418	option from a privileged source cannot be overridden by a
		1419	non-privileged user.
		1420
		1421
		1422	__xonxoff__
		1423
		1424
		1425	Use software flow control (i.e. XON/XOFF) to control the
		1426	flow of data on the serial port.
		1427	!!OPTIONS FILES
		1428
		1429
		1430	Options can be taken from files as well as the command line.
		1431	Pppd reads options from the files /etc/ppp/options, ~/.ppprc
		1432	and /etc/ppp/options.''ttyname'' (in that order) before
		1433	processing the options on the command line. (In fact, the
		1434	command-line options are scanned to find the terminal name
		1435	before the options.''ttyname'' file is read.) In forming
		1436	the name of the options.''ttyname'' file, the initial
		1437	/dev/ is removed from the terminal name, and any remaining /
		1438	characters are replaced with dots.
		1439
		1440
		1441	An options file is parsed into a series of words, delimited
		1442	by whitespace. Whitespace can be included in a word by
		1443	enclosing the word in double-quotes (
		1444	file'' or ''call'' options
		1445	within an options file.
		1446	!!SECURITY
		1447
		1448
		1449	''pppd'' provides system administrators with sufficient
		1450	access control that PPP access to a server machine can be
		1451	provided to legitimate users without fear of compromising
		1452	the security of the server or the network it's on. This
		1453	control is provided through restrictions on which IP
		1454	addresses the peer may use, based on its authenticated
		1455	identity (if any), and through restrictions on which options
		1456	a non-privileged user may use. Several of pppd's options are
		1457	privileged, in particular those which permit potentially
		1458	insecure configurations; these options are only accepted in
		1459	files which are under the control of the system
		1460	administrator, or if pppd is being run by root.
		1461
		1462
		1463	The default behaviour of pppd is to allow an unauthenticated
		1464	peer to use a given IP address only if the system does not
		1465	already have a route to that IP address. For example, a
		1466	system with a permanent connection to the wider internet
		1467	will normally have a default route, and thus all peers will
		1468	have to authenticate themselves in order to set up a
		1469	connection. On such a system, the ''auth'' option is the
		1470	default. On the other hand, a system where the PPP link is
		1471	the only connection to the internet will not normally have a
		1472	default route, so the peer will be able to use almost any IP
		1473	address without authenticating itself.
		1474
		1475
		1476	As indicated above, some security-sensitive options are
		1477	privileged, which means that they may not be used by an
		1478	ordinary non-privileged user running a setuid-root pppd,
		1479	either on the command line, in the user's ~/.ppprc file, or
		1480	in an options file read using the ''file'' option.
		1481	Privileged options may be used in /etc/ppp/options file or
		1482	in an options file read using the ''call'' option. If
		1483	pppd is being run by the root user, privileged options can
		1484	be used without restriction.
		1485
		1486
		1487	When opening the device, pppd uses either the invoking
		1488	user's user ID or the root UID (that is, 0), depending on
		1489	whether the device name was specified by the user or the
		1490	system administrator. If the device name comes from a
		1491	privileged source, that is, /etc/ppp/options or an options
		1492	file read using the ''call'' option, pppd uses full root
		1493	privileges when opening the device. Thus, by creating an
		1494	appropriate file under /etc/ppp/peers, the system
		1495	administrator can allow users to establish a ppp connection
		1496	via a device which they would not normally have permission
		1497	to access. Otherwise pppd uses the invoking user's real UID
		1498	when opening the device.
		1499	!!AUTHENTICATION
		1500
		1501
		1502	Authentication is the process whereby one peer convinces the
		1503	other of its identity. This involves the first peer sending
		1504	its name to the other, together with some kind of secret
		1505	information which could only come from the genuine
		1506	authorized user of that name. In such an exchange, we will
		1507	call the first peer the
		1508
		1509
		1510	At present, pppd supports two authentication protocols: the
		1511	Password Authentication Protocol (PAP) and the Challenge
		1512	Handshake Authentication Protocol (CHAP). PAP involves the
		1513	client sending its name and a cleartext password to the
		1514	server to authenticate itself. In contrast, the server
		1515	initiates the CHAP authentication exchange by sending a
		1516	challenge to the client (the challenge packet includes the
		1517	server's name). The client must respond with a response
		1518	which includes its name plus a hash value derived from the
		1519	shared secret and the challenge, in order to prove that it
		1520	knows the secret.
		1521
		1522
		1523	The PPP protocol, being symmetrical, allows both peers to
		1524	require the other to authenticate itself. In that case, two
		1525	separate and independent authentication exchanges will
		1526	occur. The two exchanges could use different authentication
		1527	protocols, and in principle, different names could be used
		1528	in the two exchanges.
		1529
		1530
		1531	The default behaviour of pppd is to agree to authenticate if
		1532	requested, and to not require authentication from the peer.
		1533	However, pppd will not agree to authenticate itself with a
		1534	particular protocol if it has no secrets which could be used
		1535	to do so.
		1536
		1537
		1538	Pppd stores secrets for use in authentication in secrets
		1539	files (/etc/ppp/pap-secrets for PAP, /etc/ppp/chap-secrets
		1540	for CHAP). Both secrets files have the same format. The
		1541	secrets files can contain secrets for pppd to use in
		1542	authenticating itself to other systems, as well as secrets
		1543	for pppd to use when authenticating other systems to
		1544	itself.
		1545
		1546
		1547	Each line in a secrets file contains one secret. A given
		1548	secret is specific to a particular combination of client and
		1549	server - it can only be used by that client to authenticate
		1550	itself to that server. Thus each line in a secrets file has
		1551	at least 3 fields: the name of the client, the name of the
		1552	server, and the secret. These fields may be followed by a
		1553	list of the IP addresses that the specified client may use
		1554	when connecting to the specified server.
		1555
		1556
		1557	A secrets file is parsed into words as for a options file,
		1558	so the client name, server name and secrets fields must each
		1559	be one word, with any embedded spaces or other special
		1560	characters quoted or escaped. Note that case is significant
		1561	in the client and server names and in the
		1562	secret.
		1563
		1564
		1565	If the secret starts with an `@', what follows is assumed to
		1566	be the name of a file from which to read the secret. A
		1567
		1568
		1569	Any following words on the same line are taken to be a list
		1570	of acceptable IP addresses for that client. If there are
		1571	only 3 words on the line, or if the first word is
		1572	not'' acceptable. An address may be followed by
		1573	''n'', to indicate a whole
		1574	subnet, i.e. all addresses which have the same value in the
		1575	most significant ''n'' bits. In this form, the address
		1576	may be followed by a plus sign (
		1577	''
		1578
		1579
		1580	Thus a secrets file contains both secrets for use in
		1581	authenticating other hosts, plus secrets which we use for
		1582	authenticating ourselves to others. When pppd is
		1583	authenticating the peer (checking the peer's identity), it
		1584	chooses a secret with the peer's name in the first field and
		1585	the name of the local system in the second field. The name
		1586	of the local system defaults to the hostname, with the
		1587	domain name appended if the ''domain'' option is used.
		1588	This default can be overridden with the ''name'' option,
		1589	except when the ''usehostname'' option is
		1590	used.
		1591
		1592
		1593	When pppd is choosing a secret to use in authenticating
		1594	itself to the peer, it first determines what name it is
		1595	going to use to identify itself to the peer. This name can
		1596	be specified by the user with the ''user'' option. If
		1597	this option is not used, the name defaults to the name of
		1598	the local system, determined as described in the previous
		1599	paragraph. Then pppd looks for a secret with this name in
		1600	the first field and the peer's name in the second field.
		1601	Pppd will know the name of the peer if CHAP authentication
		1602	is being used, because the peer will have sent it in the
		1603	challenge packet. However, if PAP is being used, pppd will
		1604	have to determine the peer's name from the options specified
		1605	by the user. The user can specify the peer's name directly
		1606	with the ''remotename'' option. Otherwise, if the remote
		1607	IP address was specified by a name (rather than in numeric
		1608	form), that name will be used as the peer's name. Failing
		1609	that, pppd will use the null string as the peer's
		1610	name.
		1611
		1612
		1613	When authenticating the peer with PAP, the supplied password
		1614	is first compared with the secret from the secrets file. If
		1615	the password doesn't match the secret, the password is
		1616	encrypted using crypt() and checked against the secret
		1617	again. Thus secrets for authenticating the peer can be
		1618	stored in encrypted form if desired. If the ''papcrypt''
		1619	option is given, the first (unencrypted) comparison is
		1620	omitted, for better security.
		1621
		1622
		1623	Furthermore, if the ''login'' option was specified, the
		1624	username and password are also checked against the system
		1625	password database. Thus, the system administrator can set up
		1626	the pap-secrets file to allow PPP access only to certain
		1627	users, and to restrict the set of IP addresses that each
		1628	user can use. Typically, when using the ''login'' option,
		1629	the secret in /etc/ppp/pap-secrets would be
		1630	''
		1631
		1632
		1633	Authentication must be satisfactorily completed before IPCP
		1634	(or any other Network Control Protocol) can be started. If
		1635	the peer is required to authenticate itself, and fails to do
		1636	so, pppd will terminated the link (by closing LCP). If IPCP
		1637	negotiates an unacceptable IP address for the remote host,
		1638	IPCP will be closed. IP packets can only be sent or received
		1639	when IPCP is open.
		1640
		1641
		1642	In some cases it is desirable to allow some hosts which
		1643	can't authenticate themselves to connect and use one of a
		1644	restricted set of IP addresses, even when the local host
		1645	generally requires authentication. If the peer refuses to
		1646	authenticate itself when requested, pppd takes that as
		1647	equivalent to authenticating with PAP using the empty string
		1648	for the username and password. Thus, by adding a line to the
		1649	pap-secrets file which specifies the empty string for the
		1650	client and password, it is possible to allow restricted
		1651	access to hosts which refuse to authenticate
		1652	themselves.
		1653	!!ROUTING
		1654
		1655
		1656	When IPCP negotiation is completed successfully, pppd will
		1657	inform the kernel of the local and remote IP addresses for
		1658	the ppp interface. This is sufficient to create a host route
		1659	to the remote end of the link, which will enable the peers
		1660	to exchange IP packets. Communication with other machines
		1661	generally requires further modification to routing tables
		1662	and/or ARP (Address Resolution Protocol) tables. In most
		1663	cases the ''defaultroute'' and/or ''proxyarp'' options
		1664	are sufficient for this, but in some cases further
		1665	intervention is required. The /etc/ppp/ip-up script can be
		1666	used for this.
		1667
		1668
		1669	Sometimes it is desirable to add a default route through the
		1670	remote host, as in the case of a machine whose only
		1671	connection to the Internet is through the ppp interface. The
		1672	''defaultroute'' option causes pppd to create such a
		1673	default route when IPCP comes up, and delete it when the
		1674	link is terminated.
		1675
		1676
		1677	In some cases it is desirable to use proxy ARP, for example
		1678	on a server machine connected to a LAN, in order to allow
		1679	other hosts to communicate with the remote host. The
		1680	''proxyarp'' option causes pppd to look for a network
		1681	interface on the same subnet as the remote host (an
		1682	interface supporting broadcast and ARP, which is up and not
		1683	a point-to-point or loopback interface). If found, pppd
		1684	creates a permanent, published ARP entry with the IP address
		1685	of the remote host and the hardware address of the network
		1686	interface found.
		1687
		1688
		1689	When the ''demand'' option is used, the interface IP
		1690	addresses have already been set at the point when IPCP comes
		1691	up. If pppd has not been able to negotiate the same
		1692	addresses that it used to configure the interface (for
		1693	example when the peer is an ISP that uses dynamic IP address
		1694	assignment), pppd has to change the interface IP addresses
		1695	to the negotiated addresses. This may disrupt existing
		1696	connections, and the use of demand dialling with peers that
		1697	do dynamic IP address assignment is not
		1698	recommended.
		1699	!!MULTILINK
		1700
		1701
		1702	Multilink PPP provides the capability to combine two or more
		1703	PPP links between a pair of machines into a single `bundle',
		1704	which appears as a single virtual PPP link which has the
		1705	combined bandwidth of the individual links. Currently,
		1706	multilink PPP is only supported under Linux.
		1707
		1708
		1709	Pppd detects that the link it is controlling is connected to
		1710	the same peer as another link using the peer's endpoint
		1711	discriminator and the authenticated identity of the peer (if
		1712	it authenticates itself). The endpoint discriminator is a
		1713	block of data which is hopefully unique for each peer.
		1714	Several types of data can be used, including
		1715	locally-assigned strings of bytes, IP addresses, MAC
		1716	addresses, randomly strings of bytes, or E-164 phone
		1717	numbers. The endpoint discriminator sent to the peer by pppd
		1718	can be set using the endpoint option.
		1719
		1720
		1721	In circumstances the peer may send no endpoint discriminator
		1722	or a non-unique value. The optional bundle option adds an
		1723	extra string which is added to the peer's endpoint
		1724	discriminator and authenticated identity when matching up
		1725	links to be joined together in a bundle. The bundle option
		1726	can also be used to allow the establishment of multiple
		1727	bundles between the local system and the peer. Pppd uses a
		1728	TDB database in /var/run/pppd.tdb to match up
		1729	links.
		1730
		1731
		1732	Assuming that multilink is enabled and the peer is willing
		1733	to negotiate multilink, then when pppd is invoked to bring
		1734	up the first link to the peer, it will detect that no other
		1735	link is connected to the peer and create a new bundle, that
		1736	is, another ppp network interface unit. When another pppd is
		1737	invoked to bring up another link to the peer, it will detect
		1738	the existing bundle and join its link to it. Currently, if
		1739	the first pppd terminates (for example, because of a hangup
		1740	or a received signal) the bundle is destroyed.
		1741	!!EXAMPLES
		1742
		1743
		1744	The following examples assume that the /etc/ppp/options file
		1745	contains the ''auth'' option (as in the default
		1746	/etc/ppp/options file in the ppp distribution).
		1747
		1748
		1749	Probably the most common use of pppd is to dial out to an
		1750	ISP. This can be done with a command such as
		1751
		1752
		1753	pppd call isp
		1754
		1755
		1756	where the /etc/ppp/peers/isp file is set up by the system
		1757	administrator to contain something like this:
		1758
		1759
		1760	ttyS0 19200 crtscts
		1761	connect '/usr/sbin/chat -v -f /etc/ppp/chat-isp'
		1762	noauth
		1763
		1764
		1765	In this example, we are using chat to dial the ISP's modem
		1766	and go through any logon sequence required. The
		1767	/etc/ppp/chat-isp file contains the script used by chat; it
		1768	could for example contain something like this:
		1769
		1770
		1771	ABORT
		1772	ABORT
		1773	ABORT
		1774	ABORT
		1775	ABORT
		1776	ABORT
		1777	OK
		1778	OK
		1779
		1780
		1781	See the chat(8) man page for details of chat
		1782	scripts.
		1783
		1784
		1785	Pppd can also be used to provide a dial-in ppp service for
		1786	users. If the users already have login accounts, the
		1787	simplest way to set up the ppp service is to let the users
		1788	log in to their accounts and run pppd (installed
		1789	setuid-root) with a command such as
		1790
		1791
		1792	pppd proxyarp
		1793
		1794
		1795	To allow a user to use the PPP facilities, you need to
		1796	allocate an IP address for that user's machine and create an
		1797	entry in /etc/ppp/pap-secrets or /etc/ppp/chap-secrets
		1798	(depending on which authentication method the PPP
		1799	implementation on the user's machine supports), so that the
		1800	user's machine can authenticate itself. For example, if Joe
		1801	has a machine called
		1802
		1803
		1804	joespc server
		1805
		1806
		1807	Alternatively, you can create a username called (for
		1808	example)
		1809
		1810
		1811	If your serial connection is any more complicated than a
		1812	piece of wire, you may need to arrange for some control
		1813	characters to be escaped. In particular, it is often useful
		1814	to escape XON (^Q) and XOFF (^S), using ''asyncmap
		1815	a0000''. If the path includes a telnet, you probably
		1816	should escape ^] as well (''asyncmap 200a0000''). If the
		1817	path includes an rlogin, you will need to use the ''escape
		1818	ff'' option on the end which is running the rlogin client,
		1819	since many rlogin implementations are not transparent; they
		1820	will remove the sequence [[0xff, 0xff, 0x73, 0x73, followed
		1821	by any 8 bytes] from the stream.
		1822	!!DIAGNOSTICS
		1823
		1824
		1825	Messages are sent to the syslog daemon using facility
		1826	LOG_DAEMON. (This can be overriden by recompiling pppd with
		1827	the macro LOG_PPP defined as the desired facility.) In order
		1828	to see the error and debug messages, you will need to edit
		1829	your /etc/syslog.conf file to direct the messages to the
		1830	desired output device or file.
		1831
		1832
		1833	The ''debug'' option causes the contents of all control
		1834	packets sent or received to be logged, that is, all LCP,
		1835	PAP, CHAP or IPCP packets. This can be useful if the PPP
		1836	negotiation does not succeed or if authentication fails. If
		1837	debugging is enabled at compile time, the ''debug''
		1838	option also causes other debugging messages to be
		1839	logged.
		1840
		1841
		1842	Debugging can also be enabled or disabled by sending a
		1843	SIGUSR1 signal to the pppd process. This signal acts as a
		1844	toggle.
		1845	!!EXIT STATUS
		1846
		1847
		1848	The exit status of pppd is set to indicate whether any error
		1849	was detected, or the reason for the link being terminated.
		1850	The values used are:
		1851
		1852
		1853	__0__
		1854
		1855
		1856	Pppd has detached, or otherwise the connection was
		1857	successfully established and terminated at the peer's
		1858	request.
		1859
		1860
		1861	__1__
		1862
		1863
		1864	An immediately fatal error of some kind occurred, such as an
		1865	essential system call failing, or running out of virtual
		1866	memory.
		1867
		1868
		1869	__2__
		1870
		1871
		1872	An error was detected in processing the options given, such
		1873	as two mutually exclusive options being used.
		1874
		1875
		1876	__3__
		1877
		1878
		1879	Pppd is not setuid-root and the invoking user is not
		1880	root.
		1881
		1882
		1883	__4__
		1884
		1885
		1886	The kernel does not support PPP, for example, the PPP kernel
		1887	driver is not included or cannot be loaded.
		1888
		1889
		1890	__5__
		1891
		1892
		1893	Pppd terminated because it was sent a SIGINT, SIGTERM or
		1894	SIGHUP signal.
		1895
		1896
		1897	__6__
		1898
		1899
		1900	The serial port could not be locked.
		1901
		1902
		1903	__7__
		1904
		1905
		1906	The serial port could not be opened.
		1907
		1908
		1909	__8__
		1910
		1911
		1912	The connect script failed (returned a non-zero exit
		1913	status).
		1914
		1915
		1916	__9__
		1917
		1918
		1919	The command specified as the argument to the ''pty''
		1920	option could not be run.
		1921
		1922
		1923	__10__
		1924
		1925
		1926	The PPP negotiation failed, that is, it didn't reach the
		1927	point where at least one network protocol (e.g. IP) was
		1928	running.
		1929
		1930
		1931	__11__
		1932
		1933
		1934	The peer system failed (or refused) to authenticate
		1935	itself.
		1936
		1937
		1938	__12__
		1939
		1940
		1941	The link was established successfully and terminated because
		1942	it was idle.
		1943
		1944
		1945	__13__
		1946
		1947
		1948	The link was established successfully and terminated because
		1949	the connect time limit was reached.
		1950
		1951
		1952	__14__
		1953
		1954
		1955	Callback was negotiated and an incoming call should arrive
		1956	shortly.
		1957
		1958
		1959	__15__
		1960
		1961
		1962	The link was terminated because the peer is not responding
		1963	to echo requests.
		1964
		1965
		1966	__16__
		1967
		1968
		1969	The link was terminated by the modem hanging
		1970	up.
		1971
		1972
		1973	__17__
		1974
		1975
		1976	The PPP negotiation failed because serial loopback was
		1977	detected.
		1978
		1979
		1980	__18__
		1981
		1982
		1983	The init script failed (returned a non-zero exit
		1984	status).
		1985
		1986
		1987	__19__
		1988
		1989
		1990	We failed to authenticate ourselves to the
		1991	peer.
		1992	!!SCRIPTS
		1993
		1994
		1995	Pppd invokes scripts at various stages in its processing
		1996	which can be used to perform site-specific ancillary
		1997	processing. These scripts are usually shell scripts, but
		1998	could be executable code files instead. Pppd does not wait
		1999	for the scripts to finish. The scripts are executed as root
		2000	(with the real and effective user-id set to 0), so that they
		2001	can do things such as update routing tables or run
		2002	privileged daemons. Be careful that the contents of these
		2003	scripts do not compromise your system's security. Pppd runs
		2004	the scripts with standard input, output and error redirected
		2005	to /dev/null, and with an environment that is empty except
		2006	for some environment variables that give information about
		2007	the link. The environment variables that pppd sets
		2008	are:
		2009
		2010
		2011	__DEVICE__
		2012
		2013
		2014	The name of the serial tty device being used.
		2015
		2016
		2017	__IFNAME__
		2018
		2019
		2020	The name of the network interface being used.
		2021
		2022
		2023	__IPLOCAL__
		2024
		2025
		2026	The IP address for the local end of the link. This is only
		2027	set when IPCP has come up.
		2028
		2029
		2030	__IPREMOTE__
		2031
		2032
		2033	The IP address for the remote end of the link. This is only
		2034	set when IPCP has come up.
		2035
		2036
		2037	__PEERNAME__
		2038
		2039
		2040	The authenticated name of the peer. This is only set if the
		2041	peer authenticates itself.
		2042
		2043
		2044	__SPEED__
		2045
		2046
		2047	The baud rate of the tty device.
		2048
		2049
		2050	__ORIG_UID__
		2051
		2052
		2053	The real user-id of the user who invoked pppd.
		2054
		2055
		2056	__PPPLOGNAME__
		2057
		2058
		2059	The username of the real user-id that invoked pppd. This is
		2060	always set.
		2061
		2062
		2063	For the ip-down and auth-down scripts, pppd also sets the
		2064	following variables giving statistics for the
		2065	connection:
		2066
		2067
		2068	__CONNECT_TIME__
		2069
		2070
		2071	The number of seconds from when the PPP negotiation started
		2072	until the connection was terminated.
		2073
		2074
		2075	__BYTES_SENT__
		2076
		2077
		2078	The number of bytes sent (at the level of the serial port)
		2079	during the connection.
		2080
		2081
		2082	__BYTES_RCVD__
		2083
		2084
		2085	The number of bytes received (at the level of the serial
		2086	port) during the connection.
		2087
		2088
		2089	__LINKNAME__
		2090
		2091
		2092	The logical name of the link, set with the ''linkname''
		2093	option.
		2094
		2095
		2096	Pppd invokes the following scripts, if they exist. It is not
		2097	an error if they don't exist.
		2098
		2099
		2100	__/etc/ppp/auth-up__
		2101
		2102
		2103	A program or script which is executed after the remote
		2104	system successfully authenticates itself. It is executed
		2105	with the parameters
		2106
		2107
		2108	''interface-name peer-name user-name tty-device
		2109	speed''
		2110
		2111
		2112	Note that this script is not executed if the peer doesn't
		2113	authenticate itself, for example when the ''noauth''
		2114	option is used.
		2115
		2116
		2117	__/etc/ppp/auth-down__
		2118
		2119
		2120	A program or script which is executed when the link goes
		2121	down, if /etc/ppp/auth-up was previously executed. It is
		2122	executed in the same manner with the same parameters as
		2123	/etc/ppp/auth-up.
		2124
		2125
		2126	__/etc/ppp/ip-up__
		2127
		2128
		2129	A program or script which is executed when the link is
		2130	available for sending and receiving IP packets (that is,
		2131	IPCP has come up). It is executed with the
		2132	parameters
		2133
		2134
		2135	''interface-name tty-device speed local-IP-address
		2136	remote-IP-address ipparam''
		2137
		2138
		2139	__/etc/ppp/ip-down__
		2140
		2141
		2142	A program or script which is executed when the link is no
		2143	longer available for sending and receiving IP packets. This
		2144	script can be used for undoing the effects of the
		2145	/etc/ppp/ip-up script. It is invoked in the same manner and
		2146	with the same parameters as the ip-up script.
		2147
		2148
		2149	__/etc/ppp/ipv6-up__
		2150
		2151
		2152	Like /etc/ppp/ip-up, except that it is executed when the
		2153	link is available for sending and receiving IPv6 packets. It
		2154	is executed with the parameters
		2155
		2156
		2157	''interface-name tty-device speed local-link-local-address
		2158	remote-link-local-address ipparam''
		2159
		2160
		2161	__/etc/ppp/ipv6-down__
		2162
		2163
		2164	Similar to /etc/ppp/ip-down, but it is executed when IPv6
		2165	packets can no longer be transmitted on the link. It is
		2166	executed with the same parameters as the ipv6-up
		2167	script.
		2168
		2169
		2170	__/etc/ppp/ipx-up__
		2171
		2172
		2173	A program or script which is executed when the link is
		2174	available for sending and receiving IPX packets (that is,
		2175	IPXCP has come up). It is executed with the
		2176	parameters
		2177
		2178
		2179	''interface-name tty-device speed network-number
		2180	local-IPX-node-address remote-IPX-node-address
		2181	local-IPX-routing-protocol remote-IPX-routing-protocol
		2182	local-IPX-router-name remote-IPX-router-name ipparam
		2183	pppd-pid''
		2184
		2185
		2186	The local-IPX-routing-protocol and
		2187	remote-IPX-routing-protocol field may be one of the
		2188	following:
		2189
		2190
		2191	NONE to indicate that there is no routing protocol
		2192	RIP to indicate that RIP/SAP should be used
		2193	NLSP to indicate that Novell NLSP should be used
		2194	RIP NLSP to indicate that both RIP/SAP and NLSP should be
		2195	used
		2196
		2197
		2198	__/etc/ppp/ipx-down__
		2199
		2200
		2201	A program or script which is executed when the link is no
		2202	longer available for sending and receiving IPX packets. This
		2203	script can be used for undoing the effects of the
		2204	/etc/ppp/ipx-up script. It is invoked in the same manner and
		2205	with the same parameters as the ipx-up script.
		2206	!!FILES
		2207
		2208
		2209	__/var/run/ppp__''n''__.pid__ (BSD or Linux),
		2210	__/etc/ppp/ppp__''n''__.pid__ (others)
		2211
		2212
		2213	Process-ID for pppd process on ppp interface unit
		2214	''n''.
		2215
		2216
		2217	__/var/run/ppp-__''name''__.pid__ (BSD or Linux),
		2218	__/etc/ppp/ppp-__''name''__.pid__
		2219	(others)
		2220
		2221
		2222	Process-ID for pppd process for logical link ''name''
		2223	(see the ''linkname'' option).
		2224
		2225
		2226	__/etc/ppp/pap-secrets__
		2227
		2228
		2229	Usernames, passwords and IP addresses for PAP
		2230	authentication. This file should be owned by root and not
		2231	readable or writable by any other user. Pppd will log a
		2232	warning if this is not the case.
		2233
		2234
		2235	__/etc/ppp/chap-secrets__
		2236
		2237
		2238	Names, secrets and IP addresses for CHAP authentication. As
		2239	for /etc/ppp/pap-secrets, this file should be owned by root
		2240	and not readable or writable by any other user. Pppd will
		2241	log a warning if this is not the case.
		2242
		2243
		2244	__/etc/ppp/options__
		2245
		2246
		2247	System default options for pppd, read before user default
		2248	options or command-line options.
		2249
		2250
		2251	__~/.ppprc__
		2252
		2253
		2254	User default options, read before
		2255	/etc/ppp/options.''ttyname''.
		2256
		2257
		2258	__/etc/ppp/options.__''ttyname''
		2259
		2260
		2261	System default options for the serial port being used, read
		2262	after ~/.ppprc. In forming the ''ttyname'' part of this
		2263	filename, an initial /dev/ is stripped from the port name
		2264	(if present), and any slashes in the remaining part are
		2265	converted to dots.
		2266
		2267
		2268	__/etc/ppp/peers__
		2269
		2270
		2271	A directory containing options files which may contain
		2272	privileged options, even if pppd was invoked by a user other
		2273	than root. The system administrator can create options files
		2274	in this directory to permit non-privileged users to dial out
		2275	without requiring the peer to authenticate, but only to
		2276	certain trusted peers.
		2277	!!SEE ALSO
		2278
		2279
		2280	__RFC1144__
		2281
		2282
		2283	Jacobson, V. ''Compressing TCP/IP headers for low-speed
		2284	serial links.'' February 1990.
		2285
		2286
		2287	__RFC1321__
		2288
		2289
		2290	Rivest, R. ''The MD5 Message-Digest Algorithm.'' April
		2291	1992.
		2292
		2293
		2294	__RFC1332__
		2295
		2296
2	perry	2297	!McGregor, G. ''PPP Internet Protocol Control Protocol
1	perry	2298	(IPCP).'' May 1992.
		2299
		2300
		2301	__RFC1334__
		2302
		2303
		2304	Lloyd, B.; Simpson, W.A. ''PPP authentication
		2305	protocols.'' October 1992.
		2306
		2307
		2308	__RFC1661__
		2309
		2310
		2311	Simpson, W.A. ''The Point-to-Point Protocol (PPP).'' July
		2312	1994.
		2313
		2314
		2315	__RFC1662__
		2316
		2317
		2318	Simpson, W.A. ''PPP in HDLC-like Framing.'' July
		2319	1994.
		2320
		2321
		2322	__RFC2472__
		2323
		2324
		2325	Haskin, D. ''IP Version 6 over PPP'' December
		2326	1998.
		2327	!!NOTES
		2328
		2329
		2330	The following signals have the specified effect when sent to
		2331	pppd.
		2332
		2333
		2334	__SIGINT, SIGTERM__
		2335
		2336
		2337	These signals cause pppd to terminate the link (by closing
		2338	LCP), restore the serial device settings, and
		2339	exit.
		2340
		2341
		2342	__SIGHUP__
		2343
		2344
		2345	This signal causes pppd to terminate the link, restore the
		2346	serial device settings, and close the serial device. If the
		2347	''persist'' or ''demand'' option has been specified,
		2348	pppd will try to reopen the serial device and start another
		2349	connection (after the holdoff period). Otherwise pppd will
		2350	exit. If this signal is received during the holdoff period,
		2351	it causes pppd to end the holdoff period
		2352	immediately.
		2353
		2354
		2355	__SIGUSR1__
		2356
		2357
		2358	This signal toggles the state of the ''debug''
		2359	option.
		2360
		2361
		2362	__SIGUSR2__
		2363
		2364
		2365	This signal causes pppd to renegotiate compression. This can
		2366	be useful to re-enable compression after it has been
		2367	disabled as a result of a fatal decompression error. (Fatal
		2368	decompression errors generally indicate a bug in one or
		2369	other implementation.)
		2370	!!AUTHORS
		2371
		2372
		2373	Paul Mackerras (Paul.Mackerras@cs.anu.edu.au), based on
		2374	earlier work by Drew Perkins, Brad Clements, Karl Fox, Greg
		2375	Christy, and Brad Parker.
		2376	----