[PATCH 16/20] ppp: upgrade 2.5.3 -> 2.5.4

[Richard Purdie <richard.purdie@linuxfoundation.org>]

This is primarily a security release, fixing several vulnerabilities including CVE-2026-75883 and
CVE-2026-85495. For more details on this and other vulnerabilities fixed, see the github advisories at

https://github.com/ppp-project/ppp/security/advisories?state=published

These range in severity up to 6.8 (moderate). Many of the vulnerabilities are actually only of
concern if pppd is installed setuid-root, which some distros still do, though 'make install'
in this project does not install pppd setuid-root.

Other changes include:

    A new environment variable is defined for scripts, called PPP_SCRIPT_INSTANCE, which contains
    the original name of the script (e.g., ip-up). This can be useful when the name in argv[0]
    gets lost because the script is executed by an interpreter.

    New options 'strict-script-checks', 'nostrict-script-checks', 'strict-secrets-files' and
    'nostrict-secrets-files' have been added. The strict versions are the default, and the
    nostrict versions are privileged. 'strict-script-checks' enables checks on script files
    that are run as root (e.g., /etc/ppp/ip-up) to ensure that they are owned by root and not
    writable by group or other. 'strict-secrets-checks' enables checks on secrets files (such
    as /etc/ppp/chap-secrets) to ensure that they are not readable by group or other. Previously
    (and now with nostrict-secrets-checks) the check was done but only produced a warning; now by
    default pppd will refuse to use the file.

    For EAP-TLS and PEAP, the verification of the 'common name' in TLS certificates no longer
    stops the comparison at an embedded NUL character. The pppd man page now notes that the
    default verification mode is 'none' and that the 'suffix' verification mode doesn't check
    for a '.' in the common name before the matched suffix (this was the behaviour previously
    but the man page was incorrect).

    Many more options are now privileged, in particular all of the RADIUS plugin options, and
    almost all the options relating to EAP-TLS and PEAP.

    OpenSSL engine support in EAP-TLS is disabled by default, since engine support in OpenSSL 3 is
    deprecated. If you need it, use the --enable-openssl-engine flag to configure.

    Pppd can now run as non-root as long as it has the CAP_NET_ADMIN capability. In that case,
    scripts are run as the invoking user, the user can use privileged options (provided the pppd
    binary was not marked as setuid or with additional capabilities), and the ownership checks
    use the user's effective UID rather than 0.

    Various pppd options that take an integer argument now enforce sensible limits on the value.
    This aids in avoiding edge cases where vulnerabilities may lurk.

    EAP-SRP support has been removed. Previously it was disabled by default.

    Extra length checks have been added to ensure that the pppd code doesn't access outside the
    bounds of received packets, even when such accesses were harmless (i.e. within the bounds
    of the array that the received packet was stored in, and not affecting any result).

    Various other minor bug fixes and improvements, including man page updates.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 meta/recipes-connectivity/ppp/{ppp_2.5.3.bb => ppp_2.5.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-connectivity/ppp/{ppp_2.5.3.bb => ppp_2.5.4.bb} (98%)

diff --git a/meta/recipes-connectivity/ppp/ppp_2.5.3.bb b/meta/recipes-connectivity/ppp/ppp_2.5.4.bb
similarity index 98%
rename from meta/recipes-connectivity/ppp/ppp_2.5.3.bb
rename to meta/recipes-connectivity/ppp/ppp_2.5.4.bb
index 18157821690..6f7977ece37 100644
--- a/meta/recipes-connectivity/ppp/ppp_2.5.3.bb
+++ b/meta/recipes-connectivity/ppp/ppp_2.5.4.bb
@@ -25,7 +25,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/${BP}.tar.gz \
            file://ppp@.service \
            "
 
-SRC_URI[sha256sum] = "ddda28dec8aca99a403ab6070d94ffd2b17d63e9a4c5509158e99e148f572d4f"
+SRC_URI[sha256sum] = "379a630a40d858a1347f6592d671791dde12101697a743ef9900012f3765be31"
 
 inherit autotools pkgconfig systemd