Support PPPoE

Help (lots) from: julian, archie
Facilities from: ahebert@pubnix.net

22 files changed, 1087 insertions, 133 deletions

diff --git a/usr.sbin/ppp/Makefile b/usr.sbin/ppp/Makefile
index 0c565c5..e74ddc5 100644
--- a/usr.sbin/ppp/Makefile
+++ b/usr.sbin/ppp/Makefile
@@ -59,10 +59,18 @@ CFLAGS+=-DNOI4B
 SRCS+=	i4b.c
 .endif
 
+.if defined(NONETGRAPH)
+CFLAGS+=-DNONETGRAPH
+.else
+SRCS+=	ether.c
+LDADD+=	-lnetgraph
+DPADD+= ${LIBNETGRAPH}
+.endif
+
 .if defined(RELEASE_CRUNCH)
 # We must create these objects because crunchgen will link them,
 # and we don't want any unused symbols to spoil the final link.
-CFLAGS+=-DNONAT -DNORADIUS -DNOI4B
+CFLAGS+=-DNONAT -DNORADIUS -DNOI4B -DNONETGRAPH
 OBJS+=	nat_cmd.o chap_ms.o radius.o
 chap_ms.o nat_cmd.o radius.o:
 	>null_${.PREFIX}.c
diff --git a/usr.sbin/ppp/bundle.c b/usr.sbin/ppp/bundle.c
index 6131d70..7f47e05 100644
--- a/usr.sbin/ppp/bundle.c
+++ b/usr.sbin/ppp/bundle.c
@@ -89,10 +89,13 @@
 #include "ip.h"
 #include "iface.h"
 
-#define SCATTER_SEGMENTS 6	/* version, datalink, name, physical,
-                                   throughput, device */
-#define SOCKET_OVERHEAD	100	/* additional buffer space for large */
-                                /* {recv,send}msg() calls            */
+#define SCATTER_SEGMENTS 6      /* version, datalink, name, physical,
+                                   throughput, device                   */
+#define SOCKET_OVERHEAD	100     /* additional buffer space for large
+                                   {recv,send}msg() calls               */
+
+#define SEND_MAXFD 2		/* Max file descriptors passed through
+                                   the local domain socket              */
 
 static int bundle_RemainingIdleTime(struct bundle *);
 
@@ -1332,21 +1335,23 @@ bundle_GetLabel(struct bundle *bundle)
 void
 bundle_ReceiveDatalink(struct bundle *bundle, int s, struct sockaddr_un *sun)
 {
-  char cmsgbuf[sizeof(struct cmsghdr) + sizeof(int)];
-  struct cmsghdr *cmsg = (struct cmsghdr *)cmsgbuf;
+  char cmsgbuf[(sizeof(struct cmsghdr) + sizeof(int)) * SEND_MAXFD];
+  struct cmsghdr *cmsg;
   struct msghdr msg;
   struct iovec iov[SCATTER_SEGMENTS];
   struct datalink *dl;
-  int niov, link_fd, expect, f;
+  int niov, expect, f, fd[SEND_MAXFD], nfd, onfd;
   pid_t pid;
 
   log_Printf(LogPHASE, "Receiving datalink\n");
 
   /* Create our scatter/gather array */
   niov = 1;
+
   iov[0].iov_len = strlen(Version) + 1;
   iov[0].iov_base = (char *)malloc(iov[0].iov_len);
-  if (datalink2iov(NULL, iov, &niov, sizeof iov / sizeof *iov, 0) == -1) {
+  if (datalink2iov(NULL, iov, &niov, sizeof iov / sizeof *iov,
+                   NULL, NULL, 0) == -1) {
     close(s);
     return;
   }
@@ -1358,9 +1363,12 @@ bundle_ReceiveDatalink(struct bundle *bundle, int s, struct sockaddr_un *sun)
     expect += iov[f].iov_len;
 
   /* Set up our message */
-  cmsg->cmsg_len = sizeof cmsgbuf;
-  cmsg->cmsg_level = SOL_SOCKET;
-  cmsg->cmsg_type = 0;
+  for (f = 0; f < SEND_MAXFD; f++) {
+    cmsg = (struct cmsghdr *)(cmsgbuf + f * sizeof(struct cmsghdr));
+    cmsg->cmsg_len = sizeof *cmsg + sizeof(int);
+    cmsg->cmsg_level = SOL_SOCKET;
+    cmsg->cmsg_type = 0;
+  }
 
   memset(&msg, '\0', sizeof msg);
   msg.msg_name = (caddr_t)sun;
@@ -1387,35 +1395,63 @@ bundle_ReceiveDatalink(struct bundle *bundle, int s, struct sockaddr_un *sun)
   write(s, "!", 1);	/* ACK */
   close(s);
 
-  if (cmsg->cmsg_type != SCM_RIGHTS) {
-    log_Printf(LogERROR, "Recvmsg: no descriptor received !\n");
+  for (nfd = 0; nfd < SEND_MAXFD; nfd++) {
+    cmsg = (struct cmsghdr *)(cmsgbuf + nfd * sizeof(struct cmsghdr));
+    if (cmsg->cmsg_len == sizeof *cmsg + sizeof(int) &&
+        cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS)
+      fd[nfd] = *(int *)CMSG_DATA(cmsg);
+    else
+      break;
+  }
+
+  if (nfd == 0) {
+    log_Printf(LogERROR, "Recvmsg: no descriptors received !\n");
     while (niov--)
       free(iov[niov].iov_base);
     return;
   }
 
-  /* We've successfully received an open file descriptor through our socket */
+  /*
+   * We've successfully received one or more open file descriptors
+   * through our socket
+   */
   log_Printf(LogDEBUG, "Receiving device descriptor\n");
-  link_fd = *(int *)CMSG_DATA(cmsg);
+
+  nfd--;	/* Don't include p->fd */
 
   if (strncmp(Version, iov[0].iov_base, iov[0].iov_len)) {
     log_Printf(LogWARN, "Cannot receive datalink, incorrect version"
                " (\"%.*s\", not \"%s\")\n", (int)iov[0].iov_len,
                (char *)iov[0].iov_base, Version);
-    close(link_fd);
+    while (nfd)
+      close(fd[nfd--]);
+    close(fd[0]);
     while (niov--)
       free(iov[niov].iov_base);
     return;
   }
 
   niov = 1;
-  dl = iov2datalink(bundle, iov, &niov, sizeof iov / sizeof *iov, link_fd);
+  onfd = nfd;
+  dl = iov2datalink(bundle, iov, &niov, sizeof iov / sizeof *iov, fd[0],
+                    fd + 1, &nfd);
   if (dl) {
-    bundle_DatalinkLinkin(bundle, dl);
-    datalink_AuthOk(dl);
-    bundle_CalculateBandwidth(dl->bundle);
-  } else
-    close(link_fd);
+    if (nfd) {
+      log_Printf(LogERROR, "bundle_ReceiveDatalink: Failed to handle %d "
+                 "auxiliary file descriptors\n", nfd);
+      datalink_Destroy(dl);
+      while (nfd--)
+        close(fd[onfd--]);
+    } else {
+      bundle_DatalinkLinkin(bundle, dl);
+      datalink_AuthOk(dl);
+      bundle_CalculateBandwidth(dl->bundle);
+    }
+  } else {
+    while (nfd--)
+      close(fd[onfd--]);
+    close(fd[0]);
+  }
 
   free(iov[0].iov_base);
 }
@@ -1423,11 +1459,11 @@ bundle_ReceiveDatalink(struct bundle *bundle, int s, struct sockaddr_un *sun)
 void
 bundle_SendDatalink(struct datalink *dl, int s, struct sockaddr_un *sun)
 {
-  char cmsgbuf[sizeof(struct cmsghdr) + sizeof(int)], ack;
-  struct cmsghdr *cmsg = (struct cmsghdr *)cmsgbuf;
+  char cmsgbuf[(sizeof(struct cmsghdr) + sizeof(int)) * SEND_MAXFD], ack;
+  struct cmsghdr *cmsg;
   struct msghdr msg;
   struct iovec iov[SCATTER_SEGMENTS];
-  int niov, link_fd, f, expect, newsid;
+  int niov, f, expect, newsid, fd[SEND_MAXFD], nfd;
   pid_t newpid;
 
   log_Printf(LogPHASE, "Transmitting datalink %s\n", dl->name);
@@ -1439,11 +1475,15 @@ bundle_SendDatalink(struct datalink *dl, int s, struct sockaddr_un *sun)
   iov[0].iov_len = strlen(Version) + 1;
   iov[0].iov_base = strdup(Version);
   niov = 1;
+  nfd = 0;
 
   read(s, &newpid, sizeof newpid);
-  link_fd = datalink2iov(dl, iov, &niov, sizeof iov / sizeof *iov, newpid);
+  fd[0] = datalink2iov(dl, iov, &niov, sizeof iov / sizeof *iov,
+                          fd + 1, &nfd, newpid);
+
+  if (fd[0] != -1) {
+    nfd++;	/* Include fd[0] */
 
-  if (link_fd != -1) {
     memset(&msg, '\0', sizeof msg);
 
     msg.msg_name = (caddr_t)sun;
@@ -1451,17 +1491,22 @@ bundle_SendDatalink(struct datalink *dl, int s, struct sockaddr_un *sun)
     msg.msg_iov = iov;
     msg.msg_iovlen = niov;
 
-    cmsg->cmsg_len = sizeof cmsgbuf;
-    cmsg->cmsg_level = SOL_SOCKET;
-    cmsg->cmsg_type = SCM_RIGHTS;
-    *(int *)CMSG_DATA(cmsg) = link_fd;
+    for (f = 0; f < nfd; f++) {
+      cmsg = (struct cmsghdr *)(cmsgbuf + f * sizeof(struct cmsghdr));
+      cmsg->cmsg_len = sizeof *cmsg + sizeof(int);
+      cmsg->cmsg_level = SOL_SOCKET;
+      cmsg->cmsg_type = SCM_RIGHTS;
+      *(int *)CMSG_DATA(cmsg) = fd[f];
+    }
+
     msg.msg_control = cmsgbuf;
-    msg.msg_controllen = sizeof cmsgbuf;
+    msg.msg_controllen = (sizeof *cmsg + sizeof(int)) * nfd;
 
     for (f = expect = 0; f < niov; f++)
       expect += iov[f].iov_len;
 
-    log_Printf(LogDEBUG, "Sending %d bytes in scatter/gather array\n", expect);
+    log_Printf(LogDEBUG, "Sending %d descriptor%s and %d bytes in scatter"
+               "/gather array\n", nfd, nfd == 1 ? "" : "s", expect);
 
     f = expect + SOCKET_OVERHEAD;
     setsockopt(s, SOL_SOCKET, SO_SNDBUF, &f, sizeof f);
@@ -1471,8 +1516,9 @@ bundle_SendDatalink(struct datalink *dl, int s, struct sockaddr_un *sun)
     read(s, &ack, 1);
 
     newsid = Enabled(dl->bundle, OPT_KEEPSESSION) ||
-             tcgetpgrp(link_fd) == getpgrp();
-    close(link_fd);
+             tcgetpgrp(fd[0]) == getpgrp();
+    while (nfd)
+      close(fd[--nfd]);
     if (newsid)
       bundle_setsid(dl->bundle, 1);
   }
diff --git a/usr.sbin/ppp/command.c b/usr.sbin/ppp/command.c
index 3c0bc51..b742a75 100644
--- a/usr.sbin/ppp/command.c
+++ b/usr.sbin/ppp/command.c
@@ -145,7 +145,7 @@
 #define NEG_SHORTSEQ	52
 #define NEG_VJCOMP	53
 
-const char Version[] = "2.23";
+const char Version[] = "2.24";
 
 static int ShowCommand(struct cmdargs const *);
 static int TerminalCommand(struct cmdargs const *);
diff --git a/usr.sbin/ppp/datalink.c b/usr.sbin/ppp/datalink.c
index 4313fd5..40f22f1 100644
--- a/usr.sbin/ppp/datalink.c
+++ b/usr.sbin/ppp/datalink.c
@@ -1245,7 +1245,7 @@ datalink_NewState(struct datalink *dl, int state)
 
 struct datalink *
 iov2datalink(struct bundle *bundle, struct iovec *iov, int *niov, int maxiov,
-             int fd)
+             int fd, int *auxfd, int *nauxfd)
 {
   struct datalink *dl, *cdl;
   struct fsm_retry copy;
@@ -1306,7 +1306,7 @@ iov2datalink(struct bundle *bundle, struct iovec *iov, int *niov, int maxiov,
   dl->fsmp.LayerFinish = datalink_LayerFinish;
   dl->fsmp.object = dl;
 
-  dl->physical = iov2physical(dl, iov, niov, maxiov, fd);
+  dl->physical = iov2physical(dl, iov, niov, maxiov, fd, auxfd, nauxfd);
 
   if (!dl->physical) {
     free(dl->name);
@@ -1335,7 +1335,7 @@ iov2datalink(struct bundle *bundle, struct iovec *iov, int *niov, int maxiov,
 
 int
 datalink2iov(struct datalink *dl, struct iovec *iov, int *niov, int maxiov,
-             pid_t newpid)
+             int *auxfd, int *nauxfd, pid_t newpid)
 {
   /* If `dl' is NULL, we're allocating before a Fromiov() */
   int link_fd;
@@ -1363,7 +1363,8 @@ datalink2iov(struct datalink *dl, struct iovec *iov, int *niov, int maxiov,
     dl ? realloc(dl->name, DATALINK_MAXNAME) : malloc(DATALINK_MAXNAME);
   iov[(*niov)++].iov_len = DATALINK_MAXNAME;
 
-  link_fd = physical2iov(dl ? dl->physical : NULL, iov, niov, maxiov, newpid);
+  link_fd = physical2iov(dl ? dl->physical : NULL, iov, niov, maxiov, auxfd,
+                         nauxfd, newpid);
 
   if (link_fd == -1 && dl) {
     free(dl->name);
diff --git a/usr.sbin/ppp/datalink.h b/usr.sbin/ppp/datalink.h
index 8101849..9931795 100644
--- a/usr.sbin/ppp/datalink.h
+++ b/usr.sbin/ppp/datalink.h
@@ -128,8 +128,9 @@ struct datalink {
 extern struct datalink *datalink_Create(const char *name, struct bundle *, int);
 extern struct datalink *datalink_Clone(struct datalink *, const char *);
 extern struct datalink *iov2datalink(struct bundle *, struct iovec *, int *,
-                                     int, int);
-extern int datalink2iov(struct datalink *, struct iovec *, int *, int, pid_t);
+                                     int, int, int *, int *);
+extern int datalink2iov(struct datalink *, struct iovec *, int *, int, int *,
+                        int *, pid_t);
 extern struct datalink *datalink_Destroy(struct datalink *);
 extern void datalink_GotAuthname(struct datalink *, const char *);
 extern void datalink_Up(struct datalink *, int, int);
diff --git a/usr.sbin/ppp/ether.c b/usr.sbin/ppp/ether.c
new file mode 100644
index 0000000..a876f16
--- /dev/null
+++ b/usr.sbin/ppp/ether.c
@@ -0,0 +1,712 @@
+/*-
+ * Copyright (c) 1999 Brian Somers <brian@Awfulhak.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <netgraph.h>
+#include <net/ethernet.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netgraph/ng_ether.h>
+#include <netgraph/ng_message.h>
+#include <netgraph/ng_pppoe.h>
+#include <netgraph/ng_socket.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sysexits.h>
+#include <sys/fcntl.h>
+#if defined(__FreeBSD__) && !defined(NOKLDLOAD)
+#include <sys/linker.h>
+#endif
+#include <sys/uio.h>
+#include <termios.h>
+#ifndef NONBLOCK_FIXED
+#include <sys/time.h>
+#endif
+#include <unistd.h>
+
+#include "layer.h"
+#include "defs.h"
+#include "mbuf.h"
+#include "log.h"
+#include "timer.h"
+#include "lqr.h"
+#include "hdlc.h"
+#include "throughput.h"
+#include "fsm.h"
+#include "lcp.h"
+#include "ccp.h"
+#include "link.h"
+#include "async.h"
+#include "descriptor.h"
+#include "physical.h"
+#include "main.h"
+#include "mp.h"
+#include "chat.h"
+#include "auth.h"
+#include "chap.h"
+#include "cbcp.h"
+#include "datalink.h"
+#include "slcompress.h"
+#include "iplist.h"
+#include "ipcp.h"
+#include "filter.h"
+#ifndef NORADIUS
+#include "radius.h"
+#endif
+#include "bundle.h"
+#include "id.h"
+#include "ether.h"
+
+
+#define PPPOE_NODE_TYPE_LEN (sizeof NG_PPPOE_NODE_TYPE - 1) /* "PPPoE" */
+
+struct etherdevice {
+  struct device dev;			/* What struct physical knows about */
+  int cs;				/* Control socket */
+  int connected;			/* Are we connected yet ? */
+  int timeout;				/* Seconds attempting to connect */
+  char hook[sizeof TUN_NAME + 11];	/* Our socket node hook */
+};
+
+#define device2ether(d) \
+  ((d)->type == ETHER_DEVICE ? (struct etherdevice *)d : NULL)
+
+int
+ether_DeviceSize(void)
+{
+  return sizeof(struct etherdevice);
+}
+
+static ssize_t
+ether_Write(struct physical *p, const void *v, size_t n)
+{
+  struct etherdevice *dev = device2ether(p->handler);
+
+  return NgSendData(p->fd, dev->hook, v, n) == -1 ? -1 : n;
+}
+
+static ssize_t
+ether_Read(struct physical *p, void *v, size_t n)
+{
+  char hook[sizeof TUN_NAME + 11];
+
+  return NgRecvData(p->fd, v, n, hook);
+}
+
+static int
+ether_RemoveFromSet(struct physical *p, fd_set *r, fd_set *w, fd_set *e)
+{
+  struct etherdevice *dev = device2ether(p->handler);
+  int result;
+
+  if (r && dev->cs >= 0 && FD_ISSET(dev->cs, r)) {
+    FD_CLR(dev->cs, r);
+    log_Printf(LogTIMER, "%s: fdunset(ctrl) %d\n", p->link.name, dev->cs);
+    result = 1;
+  } else
+    result = 0;
+
+  /* Careful... physical_RemoveFromSet() called us ! */
+
+  p->handler->removefromset = NULL;
+  result += physical_RemoveFromSet(p, r, w, e);
+  p->handler->removefromset = ether_RemoveFromSet;
+
+  return result;
+}
+
+static void
+ether_Free(struct physical *p)
+{
+  struct etherdevice *dev = device2ether(p->handler);
+
+  physical_SetDescriptor(p);
+  if (dev->cs != -1)
+    close(dev->cs);
+  free(dev);
+}
+
+static const char *
+ether_OpenInfo(struct physical *p)
+{
+  struct etherdevice *dev = device2ether(p->handler);
+
+  switch (dev->connected) {
+    case CARRIER_PENDING:
+      return "negotiating";
+    case CARRIER_OK:
+      return "established";
+  }
+
+  return "disconnected";
+}
+
+static void
+ether_device2iov(struct device *d, struct iovec *iov, int *niov,
+                 int maxiov, int *auxfd, int *nauxfd, pid_t newpid)
+{
+  struct etherdevice *dev = device2ether(d);
+  int sz = physical_MaxDeviceSize();
+
+  iov[*niov].iov_base = realloc(d, sz);
+  if (iov[*niov].iov_base == NULL) {
+    log_Printf(LogALERT, "Failed to allocate memory: %d\n", sz);
+    AbortProgram(EX_OSERR);
+  }
+  iov[*niov].iov_len = sz;
+  (*niov)++;
+
+  if (dev->cs >= 0) {
+    *auxfd = dev->cs;
+    (*nauxfd)++;
+  }
+}
+
+static void
+ether_MessageIn(struct etherdevice *dev)
+{
+  char msgbuf[sizeof(struct ng_mesg) + sizeof(struct ngpppoe_sts)];
+  struct ng_mesg *rep = (struct ng_mesg *)msgbuf;
+  struct ngpppoe_sts *sts = (struct ngpppoe_sts *)(msgbuf + sizeof *rep);
+  char unknown[14];
+  const char *msg;
+#ifndef NONBLOCK_FIXED
+  struct timeval t;
+  fd_set r;
+#endif
+
+  if (dev->cs < 0)
+    return;
+
+#ifndef NONBLOCK_FIXED
+  FD_ZERO(&r);
+  FD_SET(dev->cs, &r);
+  t.tv_sec = t.tv_usec = 0;
+  if (select(dev->cs + 1, &r, NULL, NULL, &t) <= 0)
+    return;
+#endif
+
+  if (NgRecvMsg(dev->cs, rep, sizeof msgbuf, NULL) < 0)
+    return;
+
+  if (rep->header.version != NG_VERSION) {
+    log_Printf(LogWARN, "%ld: Unexpected netgraph version, expected %ld\n",
+               (long)rep->header.version, (long)NG_VERSION);
+    return;
+  }
+
+  if (rep->header.typecookie != NGM_PPPOE_COOKIE) {
+    log_Printf(LogWARN, "%ld: Unexpected netgraph cookie, expected %ld\n",
+               (long)rep->header.typecookie, (long)NGM_PPPOE_COOKIE);
+    return;
+  }
+
+  switch (rep->header.cmd) {
+    case NGM_PPPOE_SET_FLAG:	msg = "SET_FLAG";	break;
+    case NGM_PPPOE_CONNECT:	msg = "CONNECT";	break;
+    case NGM_PPPOE_LISTEN:	msg = "LISTEN";		break;
+    case NGM_PPPOE_OFFER:	msg = "OFFER";		break;
+    case NGM_PPPOE_SUCCESS:	msg = "SUCCESS";	break;
+    case NGM_PPPOE_FAIL:	msg = "FAIL";		break;
+    case NGM_PPPOE_CLOSE:	msg = "CLOSE";		break;
+    case NGM_PPPOE_GET_STATUS:	msg = "GET_STATUS";	break;
+    default:
+      snprintf(unknown, sizeof unknown, "<%d>", (int)rep->header.cmd);
+      msg = unknown;
+      break;
+  }
+
+  log_Printf(LogPHASE, "Received NGM_PPPOE_%s (hook \"%s\")\n", msg, sts->hook);
+
+  switch (rep->header.cmd) {
+    case NGM_PPPOE_SUCCESS:
+      dev->connected = CARRIER_OK;
+      break;
+    case NGM_PPPOE_FAIL:
+    case NGM_PPPOE_CLOSE:
+      dev->connected = CARRIER_LOST;
+      break;
+  }
+}
+
+static int
+ether_AwaitCarrier(struct physical *p)
+{
+  struct etherdevice *dev = device2ether(p->handler);
+
+  if (!dev->timeout--)
+    dev->connected = CARRIER_LOST;
+  else if (dev->connected == CARRIER_PENDING)
+    ether_MessageIn(dev);
+
+  return dev->connected;
+}
+
+static const struct device baseetherdevice = {
+  ETHER_DEVICE,
+  "ether",
+  ether_AwaitCarrier,
+  ether_RemoveFromSet,
+  NULL,
+  NULL,
+  NULL,
+  NULL,
+  ether_Free,
+  ether_Read,
+  ether_Write,
+  ether_device2iov,
+  NULL,
+  ether_OpenInfo
+};
+
+struct device *
+ether_iov2device(int type, struct physical *p, struct iovec *iov, int *niov,
+                 int maxiov, int *auxfd, int *nauxfd)
+{
+  if (type == ETHER_DEVICE) {
+    struct etherdevice *dev = (struct etherdevice *)iov[(*niov)++].iov_base;
+
+    dev = realloc(dev, sizeof *dev);	/* Reduce to the correct size */
+    if (dev == NULL) {
+      log_Printf(LogALERT, "Failed to allocate memory: %d\n",
+                 (int)(sizeof *dev));
+      AbortProgram(EX_OSERR);
+    }
+
+    if (*nauxfd) {
+      dev->cs = *auxfd;
+      (*nauxfd)--;
+    } else
+      dev->cs = -1;
+
+    /* Refresh function pointers etc */
+    memcpy(&dev->dev, &baseetherdevice, sizeof dev->dev);
+
+    physical_SetupStack(p, dev->dev.name, PHYSICAL_FORCE_SYNCNOACF);
+    return &dev->dev;
+  }
+
+  return NULL;
+}
+
+static int
+ether_UpdateSet(struct descriptor *d, fd_set *r, fd_set *w, fd_set *e, int *n)
+{
+  struct physical *p = descriptor2physical(d);
+  struct etherdevice *dev = device2ether(p->handler);
+  int result;
+
+  if (r && dev->cs >= 0) {
+    FD_SET(dev->cs, r);
+    log_Printf(LogTIMER, "%s(ctrl): fdset(r) %d\n", p->link.name, dev->cs);
+    result = 1;
+  } else
+    result = 0;
+
+  result += physical_doUpdateSet(d, r, w, e, n, 0);
+
+  return result;
+}
+
+static int
+ether_IsSet(struct descriptor *d, const fd_set *fdset)
+{
+  struct physical *p = descriptor2physical(d);
+  struct etherdevice *dev = device2ether(p->handler);
+  int result;
+
+  result = dev->cs >= 0 && FD_ISSET(dev->cs, fdset);
+  result += physical_IsSet(d, fdset);
+
+  return result;
+}
+
+static void
+ether_DescriptorRead(struct descriptor *d, struct bundle *bundle,
+                     const fd_set *fdset)
+{
+  struct physical *p = descriptor2physical(d);
+  struct etherdevice *dev = device2ether(p->handler);
+
+  if (dev->cs >= 0 && FD_ISSET(dev->cs, fdset)) {
+    ether_MessageIn(dev);
+    if (dev->connected == CARRIER_LOST) {
+      log_Printf(LogPHASE, "%s: Device disconnected\n", p->link.name);
+      datalink_Down(p->dl, CLOSE_NORMAL);
+      return;
+    }
+  }
+
+  if (physical_IsSet(d, fdset))
+    physical_DescriptorRead(d, bundle, fdset);
+}
+
+static struct device *
+ether_Abandon(struct etherdevice *dev, struct physical *p)
+{
+  /* Abandon our node construction */
+  close(dev->cs);
+  close(p->fd);
+  p->fd = -2;	/* Nobody else need try.. */
+  free(dev);
+
+  return NULL;
+}
+
+struct device *
+ether_Create(struct physical *p)
+{
+  u_char rbuf[2048];
+  struct etherdevice *dev;
+  struct ng_mesg *resp;
+  const struct hooklist *hlist;
+  const struct nodeinfo *ninfo;
+  int f;
+
+  dev = NULL;
+  if (p->fd < 0 && !strncasecmp(p->name.full, NG_PPPOE_NODE_TYPE,
+                                PPPOE_NODE_TYPE_LEN) &&
+      p->name.full[PPPOE_NODE_TYPE_LEN] == ':') {
+    const struct linkinfo *nlink;
+    struct ngpppoe_init_data *data;
+    struct ngm_mkpeer mkp;
+    struct ngm_connect ngc;
+    const char *iface, *provider;
+    char *path, etherid[12];
+    int ifacelen, providerlen, oldflag;
+    char connectpath[sizeof dev->hook + 2];	/* .:<hook> */
+
+#ifdef KLDSYM_LOOKUP
+    /* First make sure we've got the right code loaded */
+    char basesym[] = "ng_make_node", socksym[] = "ngdomain";
+    struct kld_sym_lookup baselookup = { sizeof baselookup, basesym, 0, 0 };
+    struct kld_sym_lookup socklookup = { sizeof socklookup, socksym, 0, 0 };
+#endif
+
+    p->fd--;				/* We own the device - change fd */
+
+#ifdef KLDSYM_LOOKUP
+    if (kldsym(0, KLDSYM_LOOKUP, &baselookup) == -1) {
+      log_Printf(LogWARN, "Can't run without options NETGRAPH in the kernel\n");
+      return NULL;
+    }
+
+    if (kldsym(0, KLDSYM_LOOKUP, &socklookup) == -1 &&
+        ID0kldload("ng_socket") == -1) {
+      log_Printf(LogWARN, "kldload: ng_socket: %s\n", strerror(errno));
+      return NULL;
+    }
+#endif
+
+    if ((dev = malloc(sizeof *dev)) == NULL)
+      return NULL;
+
+    iface = p->name.full + PPPOE_NODE_TYPE_LEN + 1;
+
+    provider = strchr(iface, ':');
+    if (provider) {
+      ifacelen = provider - iface;
+      provider++;
+      providerlen = strlen(provider);
+    } else {
+      ifacelen = strlen(iface);
+      provider = "";
+      providerlen = 0;
+    }
+
+    /*
+     * We're going to do this (where tunN is our tunnel device):
+     *
+     * .---------.
+     * |  ether  |
+     * | <iface> |                         dev->cs
+     * `---------'                           |
+     *  (orphan)                     p->fd   |
+     *     |                           |     |
+     *     |                           |     |
+     * (ethernet)                      |     |
+     * .---------.                  .-----------.
+     * |  pppoe  |                  |  socket   |
+     * | <iface> |(tunN)<---->(tunN)| <unnamed> |
+     * `---------                   `-----------'
+     *   (tunX)
+     *     ^
+     *     |
+     *     `--->(tunX)
+     */
+
+    /* Create a socket node */
+    if (NgMkSockNode(NULL, &dev->cs, &p->fd) == -1) {
+      log_Printf(LogWARN, "Cannot create netgraph socket node: %s\n",
+                 strerror(errno));
+      free(dev);
+      return NULL;
+    }
+
+    /*
+     * Ask for a list of hooks attached to the "ether" node.  This node should
+     * magically exist as a way of hooking stuff onto an ethernet device
+     */
+    path = (char *)alloca(ifacelen + 2);
+    sprintf(path, "%.*s:", ifacelen, iface);
+    if (NgSendMsg(dev->cs, path, NGM_GENERIC_COOKIE, NGM_LISTHOOKS,
+                  NULL, 0) < 0) {
+      log_Printf(LogWARN, "%s Cannot send a netgraph message: %s\n",
+                 path, strerror(errno));
+      return ether_Abandon(dev, p);
+    }
+
+    /* Get our list back */
+    resp = (struct ng_mesg *)rbuf;
+    if (NgRecvMsg(dev->cs, resp, sizeof rbuf, NULL) < 0) {
+      log_Printf(LogWARN, "Cannot get netgraph response: %s\n",
+                 strerror(errno));
+      return ether_Abandon(dev, p);
+    }
+
+    hlist = (const struct hooklist *)resp->data;
+    ninfo = &hlist->nodeinfo;
+
+    /* Make sure we've got the right type of node */
+    if (strncmp(ninfo->type, NG_ETHER_NODE_TYPE,
+                sizeof NG_ETHER_NODE_TYPE - 1)) {
+      log_Printf(LogWARN, "%s Unexpected node type ``%s'' (wanted ``"
+                 NG_ETHER_NODE_TYPE "'')\n", path, ninfo->type);
+      return ether_Abandon(dev, p);
+    }
+
+    log_Printf(LogDEBUG, "List of netgraph node ``%s'' (id %08x) hooks:\n",
+               path, ninfo->id);
+
+    /* look for a hook already attached.  */
+    for (f = 0; f < ninfo->hooks; f++) {
+      nlink = &hlist->link[f];
+
+      log_Printf(LogDEBUG, "  Found %s -> %s\n", nlink->ourhook,
+                 nlink->peerhook);
+
+      if (!strcmp(nlink->ourhook, NG_ETHER_HOOK_ORPHAN) ||
+          !strcmp(nlink->ourhook, NG_ETHER_HOOK_DIVERT)) {
+        /*
+         * Something is using the data coming out of this ``ether'' node.
+         * If it's a PPPoE node, we use that node, otherwise we complain that
+         * someone else is using the node.
+         */
+        if (!strcmp(nlink->nodeinfo.type, NG_PPPOE_NODE_TYPE))
+          /* Use this PPPoE node ! */
+          snprintf(ngc.path, sizeof ngc.path, "[%08x]:", nlink->nodeinfo.id);
+        else {
+          log_Printf(LogWARN, "%s Node type ``%s'' is currently active\n",
+                     path, nlink->nodeinfo.type);
+          return ether_Abandon(dev, p);
+        }
+        break;
+      }
+    }
+
+    if (f == ninfo->hooks) {
+      /*
+       * Create a new ``PPPoE'' node connected to the ``ether'' node using
+       * the magic ``orphan'' and ``ethernet'' hooks
+       */
+      snprintf(mkp.type, sizeof mkp.type, "%s", NG_PPPOE_NODE_TYPE);
+      snprintf(mkp.ourhook, sizeof mkp.ourhook, "%s", NG_ETHER_HOOK_ORPHAN);
+      snprintf(mkp.peerhook, sizeof mkp.peerhook, "%s", NG_PPPOE_HOOK_ETHERNET);
+      snprintf(etherid, sizeof etherid, "[%08x]:", ninfo->id);
+
+      log_Printf(LogDEBUG, "Creating PPPoE netgraph node %s%s -> %s\n",
+                 etherid, mkp.ourhook, mkp.peerhook);
+
+      if (NgSendMsg(dev->cs, etherid, NGM_GENERIC_COOKIE,
+                    NGM_MKPEER, &mkp, sizeof mkp) < 0) {
+        log_Printf(LogWARN, "%s Cannot create PPPoE netgraph node: %s\n",
+                   etherid, strerror(errno));
+        return ether_Abandon(dev, p);
+      }
+
+      snprintf(ngc.path, sizeof ngc.path, "%s%s", path, NG_ETHER_HOOK_ORPHAN);
+    }
+
+    snprintf(dev->hook, sizeof dev->hook, "%s%d",
+             TUN_NAME, p->dl->bundle->unit);
+
+    /*
+     * Connect the PPPoE node to our socket node.
+     * ngc.path has already been set up
+     */
+    snprintf(ngc.ourhook, sizeof ngc.ourhook, "%s", dev->hook);
+    memcpy(ngc.peerhook, ngc.ourhook, sizeof ngc.peerhook);
+
+    log_Printf(LogDEBUG, "Connecting netgraph socket .:%s -> %s:%s\n",
+               ngc.ourhook, ngc.path, ngc.peerhook);
+    if (NgSendMsg(dev->cs, ".:", NGM_GENERIC_COOKIE,
+                  NGM_CONNECT, &ngc, sizeof ngc) < 0) {
+      log_Printf(LogWARN, "Cannot connect PPPoE and socket netgraph "
+                 "nodes: %s\n", strerror(errno));
+      return ether_Abandon(dev, p);
+    }
+
+    /* And finally, request a connection to the given provider */
+
+    data = (struct ngpppoe_init_data *)alloca(sizeof *data + providerlen + 1);
+
+    snprintf(data->hook, sizeof data->hook, "%s", dev->hook);
+    strcpy(data->data, provider);
+    data->data_len = providerlen;
+
+    snprintf(connectpath, sizeof connectpath, ".:%s", dev->hook);
+    log_Printf(LogDEBUG, "Sending PPPOE_CONNECT to %s\n", connectpath);
+    if (NgSendMsg(dev->cs, connectpath, NGM_PPPOE_COOKIE,
+                  NGM_PPPOE_CONNECT, data, sizeof *data + providerlen) == -1) {
+      log_Printf(LogWARN, "``%s'': Cannot start netgraph node: %s\n",
+                 connectpath, strerror(errno));
+      return ether_Abandon(dev, p);
+    }
+
+    /*
+     * Now make our control socket non-blocking so that we can read()
+     * without having to select()
+     *
+     * XXX: Does this work (#define NONBLOCK_FIXED) ?
+     */
+    oldflag = fcntl(dev->cs, F_GETFL, 0);
+    if (oldflag < 0) {
+      log_Printf(LogWARN, "%s: Open: Cannot get physical flags: %s\n",
+                 p->link.name, strerror(errno));
+      return ether_Abandon(dev, p);
+    } else
+      fcntl(dev->cs, F_SETFL, oldflag & ~O_NONBLOCK);
+
+    dev->timeout = p->cfg.cd.delay;
+    dev->connected = CARRIER_PENDING;
+  } else {
+    /* See if we're a netgraph socket */
+    struct sockaddr_ng ngsock;
+    struct sockaddr *sock = (struct sockaddr *)&ngsock;
+    int sz;
+
+    sz = sizeof ngsock;
+    if (getsockname(p->fd, sock, &sz) != -1 && sock->sa_family == AF_NETGRAPH) {
+      /*
+       * It's a netgraph node... determine the hook name and set things up
+       */
+
+      if (NgSendMsg(dev->cs, ".", NGM_GENERIC_COOKIE, NGM_LISTHOOKS,
+                    NULL, 0) < 0) {
+        log_Printf(LogWARN, "Cannot send a netgraph message to stdin: %s\n",
+                   strerror(errno));
+        close(p->fd);
+        p->fd = -1;
+        return NULL;
+      }
+
+      /* Get our list back */
+      resp = (struct ng_mesg *)rbuf;
+      if (NgRecvMsg(dev->cs, resp, sizeof rbuf, NULL) < 0) {
+        log_Printf(LogWARN, "Cannot get netgraph response: %s\n",
+                   strerror(errno));
+        close(p->fd);
+        p->fd = -1;
+        return NULL;
+      }
+
+      hlist = (const struct hooklist *)resp->data;
+      ninfo = &hlist->nodeinfo;
+
+      /*
+       * Make sure we've got the right type of node...
+       * Can it be anything else ?
+       */
+      if (strncmp(ninfo->type, NG_SOCKET_NODE_TYPE,
+                  sizeof NG_SOCKET_NODE_TYPE - 1)) {
+        log_Printf(LogWARN, "Unexpected netgraph node type ``%s'' (wanted ``"
+                   NG_SOCKET_NODE_TYPE "'')\n", ninfo->type);
+        close(p->fd);
+        p->fd = -1;
+        return NULL;
+      }
+
+      if (ninfo->hooks != 1) {
+        log_Printf(LogWARN, "Can't handle netgraph node with %d hooks\n",
+                   ninfo->hooks);
+        close(p->fd);
+        p->fd = -1;
+        return NULL;
+      }
+
+      /* Looks good.... lets allocate a device structure */
+      if ((dev = malloc(sizeof *dev)) == NULL) {
+        log_Printf(LogWARN, "%s: Cannot allocate an ether device: %s\n",
+                   p->link.name, strerror(errno));
+        return NULL;
+      }
+
+      dev->cs = -1;
+      dev->timeout = 0;
+      dev->connected = CARRIER_OK;
+      strncpy(dev->hook, hlist->link->ourhook, sizeof dev->hook - 1);
+      dev->hook[sizeof dev->hook - 1] = '\0';
+
+      log_Printf(LogDEBUG, "Using netgraph hook ``.:%s'' -> [%08x]:%s\n",
+                 dev->hook, hlist->link->nodeinfo.id, hlist->link->peerhook);
+    }
+  }
+
+  if (dev) {
+    memcpy(&dev->dev, &baseetherdevice, sizeof dev->dev);
+
+    /* Hook things up so that we monitor dev->cs */
+    p->desc.UpdateSet = ether_UpdateSet;
+    p->desc.IsSet = ether_IsSet;
+    p->desc.Read = ether_DescriptorRead;
+
+    physical_SetupStack(p, dev->dev.name, PHYSICAL_FORCE_SYNCNOACF);
+
+    /* Moan about (and fix) invalid LCP configurations */
+    if (p->link.lcp.cfg.mru > 1492) {
+      log_Printf(LogWARN, "%s: Reducing MRU to 1492\n", p->link.name);
+      p->link.lcp.cfg.mru = 1492;
+    }
+    if (p->dl->bundle->cfg.mtu > 1492) {
+      log_Printf(LogWARN, "%s: Reducing MTU to 1492\n", p->link.name);
+      p->dl->bundle->cfg.mtu = 1492;
+    }
+
+    return &dev->dev;
+  }
+
+  return NULL;
+}
diff --git a/usr.sbin/ppp/ether.h b/usr.sbin/ppp/ether.h
new file mode 100644
index 0000000..a2e96c7
--- /dev/null
+++ b/usr.sbin/ppp/ether.h
@@ -0,0 +1,35 @@
+/*-
+ * Copyright (c) 1999 Brian Somers <brian@Awfulhak.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+struct physical;
+struct device;
+
+extern struct device *ether_Create(struct physical *);
+extern struct device *ether_iov2device(int, struct physical *, struct iovec *,
+                                       int *, int, int *, int *);
+extern int ether_DeviceSize(void);
diff --git a/usr.sbin/ppp/exec.c b/usr.sbin/ppp/exec.c
index de9e632..80f8343 100644
--- a/usr.sbin/ppp/exec.c
+++ b/usr.sbin/ppp/exec.c
@@ -77,12 +77,13 @@ static struct device execdevice = {
   NULL,
   NULL,
   NULL,
+  NULL,
   NULL
 };
 
 struct device *
 exec_iov2device(int type, struct physical *p, struct iovec *iov,
-                int *niov, int maxiov)
+                int *niov, int maxiov, int *auxfd, int *nauxfd)
 {
   if (type == EXEC_DEVICE) {
     free(iov[(*niov)++].iov_base);
@@ -99,6 +100,8 @@ exec_Create(struct physical *p)
   if (p->fd < 0 && *p->name.full == '!') {
     int fids[2];
 
+    p->fd--;	/* We own the device but maybe can't use it - change fd */
+
     if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, fids) < 0)
       log_Printf(LogPHASE, "Unable to create pipe for line exec: %s\n",
 	         strerror(errno));
diff --git a/usr.sbin/ppp/exec.h b/usr.sbin/ppp/exec.h
index ef6237b..d4b3387 100644
--- a/usr.sbin/ppp/exec.h
+++ b/usr.sbin/ppp/exec.h
@@ -31,5 +31,5 @@ struct device;
 
 extern struct device *exec_Create(struct physical *);
 extern struct device *exec_iov2device(int, struct physical *,
-                                      struct iovec *, int *, int);
+                                      struct iovec *, int *, int, int *, int *);
 #define exec_DeviceSize physical_DeviceSize
diff --git a/usr.sbin/ppp/fsm.c b/usr.sbin/ppp/fsm.c
index 48c7b2e..2e2a2ea 100644
--- a/usr.sbin/ppp/fsm.c
+++ b/usr.sbin/ppp/fsm.c
@@ -893,8 +893,10 @@ FsmRecvEchoReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
   u_char *cp;
   u_int32_t magic;
 
+  bp = mbuf_Contiguous(bp);
   mbuf_SetType(bp, MB_ECHOIN);
-  if (lcp && mbuf_Length(bp) >= 4) {
+
+  if (lcp && ntohs(lhp->length) - sizeof *lhp >= 4) {
     cp = MBUF_CTOP(bp);
     ua_ntohl(cp, &magic);
     if (magic != lcp->his_magic) {
@@ -905,7 +907,8 @@ FsmRecvEchoReq(struct fsm *fp, struct fsmheader *lhp, struct mbuf *bp)
     }
     if (fp->state == ST_OPENED) {
       ua_htonl(&lcp->want_magic, cp);		/* local magic */
-      fsm_Output(fp, CODE_ECHOREP, lhp->id, cp, mbuf_Length(bp), MB_ECHOOUT);
+      fsm_Output(fp, CODE_ECHOREP, lhp->id, cp,
+                 ntohs(lhp->length) - sizeof *lhp, MB_ECHOOUT);
     }
   }
   mbuf_Free(bp);
@@ -972,6 +975,11 @@ fsm_Input(struct fsm *fp, struct mbuf *bp)
     return;
   }
   bp = mbuf_Read(bp, &lh, sizeof lh);
+
+  if (ntohs(lh.length) != len)
+    log_Printf(LogWARN, "%s: Oops: Got %d bytes but %d byte payload\n",
+               fp->link->name, len, (int)ntohs(lh.length));
+
   if (lh.code < fp->min_code || lh.code > fp->max_code ||
       lh.code > sizeof FsmCodes / sizeof *FsmCodes) {
     /*
diff --git a/usr.sbin/ppp/i4b.c b/usr.sbin/ppp/i4b.c
index 5e76c4f..ccaa76b 100644
--- a/usr.sbin/ppp/i4b.c
+++ b/usr.sbin/ppp/i4b.c
@@ -269,7 +269,7 @@ i4b_OpenInfo(struct physical *p)
 
 static void
 i4b_device2iov(struct device *d, struct iovec *iov, int *niov,
-               int maxiov, pid_t newpid)
+               int maxiov, int *auxfd, int *nauxfd, pid_t newpid)
 {
   struct i4bdevice *dev = device2i4b(d);
   int sz = physical_MaxDeviceSize();
@@ -292,6 +292,7 @@ static struct device basei4bdevice = {
   I4B_DEVICE,
   "i4b",
   i4b_AwaitCarrier,
+  NULL,
   i4b_Raw,
   i4b_Offline,
   i4b_Cooked,
@@ -306,7 +307,7 @@ static struct device basei4bdevice = {
 
 struct device *
 i4b_iov2device(int type, struct physical *p, struct iovec *iov, int *niov,
-               int maxiov)
+               int maxiov, int *auxfd, int *nauxfd)
 {
   if (type == I4B_DEVICE) {
     struct i4bdevice *dev = (struct i4bdevice *)iov[(*niov)++].iov_base;
diff --git a/usr.sbin/ppp/i4b.h b/usr.sbin/ppp/i4b.h
index 38763e7..4375ca33 100644
--- a/usr.sbin/ppp/i4b.h
+++ b/usr.sbin/ppp/i4b.h
@@ -31,5 +31,5 @@ struct device;
 
 extern struct device *i4b_Create(struct physical *);
 extern struct device *i4b_iov2device(int, struct physical *,
-                                     struct iovec *, int *, int);
+                                     struct iovec *, int *, int, int *, int *);
 extern int i4b_DeviceSize(void);
diff --git a/usr.sbin/ppp/physical.c b/usr.sbin/ppp/physical.c
index fee584a..97124e0 100644
--- a/usr.sbin/ppp/physical.c
+++ b/usr.sbin/ppp/physical.c
@@ -90,14 +90,15 @@
 #ifndef NOI4B
 #include "i4b.h"
 #endif
+#ifndef NONETGRAPH
+#include "ether.h"
+#endif
 
 
 #define PPPOTCPLINE "ppp"
 
 static int physical_DescriptorWrite(struct descriptor *, struct bundle *,
                                     const fd_set *);
-static void physical_DescriptorRead(struct descriptor *, struct bundle *,
-                                    const fd_set *);
 
 static int
 physical_DeviceSize(void)
@@ -107,14 +108,18 @@ physical_DeviceSize(void)
 
 struct {
   struct device *(*create)(struct physical *);
-  struct device *(*iov2device)(int, struct physical *, struct iovec *iov,
-                               int *niov, int maxiov);
+  struct device *(*iov2device)(int, struct physical *, struct iovec *,
+                               int *, int, int *, int *);
   int (*DeviceSize)(void);
 } devices[] = {
 #ifndef NOI4B
   { i4b_Create, i4b_iov2device, i4b_DeviceSize },
 #endif
   { tty_Create, tty_iov2device, tty_DeviceSize },
+#ifndef NONETGRAPH
+  /* This must come before ``udp'' & ``tcp'' */
+  { ether_Create, ether_iov2device, ether_DeviceSize },
+#endif
   { tcp_Create, tcp_iov2device, tcp_DeviceSize },
   { udp_Create, udp_iov2device, udp_DeviceSize },
   { exec_Create, exec_iov2device, exec_DeviceSize }
@@ -129,6 +134,16 @@ physical_UpdateSet(struct descriptor *d, fd_set *r, fd_set *w, fd_set *e,
   return physical_doUpdateSet(d, r, w, e, n, 0);
 }
 
+void
+physical_SetDescriptor(struct physical *p)
+{
+  p->desc.type = PHYSICAL_DESCRIPTOR;
+  p->desc.UpdateSet = physical_UpdateSet;
+  p->desc.IsSet = physical_IsSet;
+  p->desc.Read = physical_DescriptorRead;
+  p->desc.Write = physical_DescriptorWrite;
+}
+
 struct physical *
 physical_Create(struct datalink *dl, int type)
 {
@@ -151,11 +166,7 @@ physical_Create(struct datalink *dl, int type)
   link_EmptyStack(&p->link);
 
   p->handler = NULL;
-  p->desc.type = PHYSICAL_DESCRIPTOR;
-  p->desc.UpdateSet = physical_UpdateSet;
-  p->desc.IsSet = physical_IsSet;
-  p->desc.Read = physical_DescriptorRead;
-  p->desc.Write = physical_DescriptorWrite;
+  physical_SetDescriptor(p);
   p->type = type;
 
   hdlc_Init(&p->hdlc, &p->link.lcp);
@@ -480,7 +491,7 @@ physical_ShowStatus(struct cmdargs const *arg)
   return 0;
 }
 
-static void
+void
 physical_DescriptorRead(struct descriptor *d, struct bundle *bundle,
                      const fd_set *fdset)
 {
@@ -535,7 +546,7 @@ physical_DescriptorRead(struct descriptor *d, struct bundle *bundle,
 
 struct physical *
 iov2physical(struct datalink *dl, struct iovec *iov, int *niov, int maxiov,
-             int fd)
+             int fd, int *auxfd, int *nauxfd)
 {
   struct physical *p;
   int len, h, type;
@@ -585,11 +596,10 @@ iov2physical(struct datalink *dl, struct iovec *iov, int *niov, int maxiov,
   type = (long)p->handler;
   p->handler = NULL;
   for (h = 0; h < NDEVICES && p->handler == NULL; h++)
-    p->handler = (*devices[h].iov2device)(type, p, iov, niov, maxiov);
-
+    p->handler = (*devices[h].iov2device)(type, p, iov, niov, maxiov,
+                                          auxfd, nauxfd);
   if (p->handler == NULL) {
-    log_Printf(LogPHASE, "%s: Device %s, unknown link type\n",
-               p->link.name, p->name.full);
+    log_Printf(LogPHASE, "%s: Unknown link type\n", p->link.name);
     free(iov[(*niov)++].iov_base);
     physical_SetupStack(p, "unknown", PHYSICAL_NOFORCE);
   } else
@@ -624,7 +634,7 @@ physical_MaxDeviceSize()
 
 int
 physical2iov(struct physical *p, struct iovec *iov, int *niov, int maxiov,
-             pid_t newpid)
+             int *auxfd, int *nauxfd, pid_t newpid)
 {
   struct device *h;
   int sz;
@@ -674,7 +684,7 @@ physical2iov(struct physical *p, struct iovec *iov, int *niov, int maxiov,
   sz = physical_MaxDeviceSize();
   if (p) {
     if (h)
-      (*h->device2iov)(h, iov, niov, maxiov, newpid);
+      (*h->device2iov)(h, iov, niov, maxiov, auxfd, nauxfd, newpid);
     else {
       iov[*niov].iov_base = malloc(sz);
       if (p->handler)
@@ -801,28 +811,32 @@ physical_doUpdateSet(struct descriptor *d, fd_set *r, fd_set *w, fd_set *e,
 int
 physical_RemoveFromSet(struct physical *p, fd_set *r, fd_set *w, fd_set *e)
 {
-  int sets;
+  if (p->handler && p->handler->removefromset)
+    return (*p->handler->removefromset)(p, r, w, e);
+  else {
+    int sets;
 
-  sets = 0;
-  if (p->fd >= 0) {
-    if (r && FD_ISSET(p->fd, r)) {
-      FD_CLR(p->fd, r);
-      log_Printf(LogTIMER, "%s: fdunset(r) %d\n", p->link.name, p->fd);
-      sets++;
-    }
-    if (e && FD_ISSET(p->fd, e)) {
-      FD_CLR(p->fd, e);
-      log_Printf(LogTIMER, "%s: fdunset(e) %d\n", p->link.name, p->fd);
-      sets++;
-    }
-    if (w && FD_ISSET(p->fd, w)) {
-      FD_CLR(p->fd, w);
-      log_Printf(LogTIMER, "%s: fdunset(w) %d\n", p->link.name, p->fd);
-      sets++;
+    sets = 0;
+    if (p->fd >= 0) {
+      if (r && FD_ISSET(p->fd, r)) {
+        FD_CLR(p->fd, r);
+        log_Printf(LogTIMER, "%s: fdunset(r) %d\n", p->link.name, p->fd);
+        sets++;
+      }
+      if (e && FD_ISSET(p->fd, e)) {
+        FD_CLR(p->fd, e);
+        log_Printf(LogTIMER, "%s: fdunset(e) %d\n", p->link.name, p->fd);
+        sets++;
+      }
+      if (w && FD_ISSET(p->fd, w)) {
+        FD_CLR(p->fd, w);
+        log_Printf(LogTIMER, "%s: fdunset(w) %d\n", p->link.name, p->fd);
+        sets++;
+      }
     }
+
+    return sets;
   }
-  
-  return sets;
 }
 
 int
@@ -929,7 +943,7 @@ physical_Found(struct physical *p)
 int
 physical_Open(struct physical *p, struct bundle *bundle)
 {
-  int devno, h, wasopen, err;
+  int devno, h, wasfd, err;
   char *dev;
 
   if (p->fd >= 0)
@@ -939,7 +953,7 @@ physical_Open(struct physical *p, struct bundle *bundle)
     physical_SetDevice(p, "");
     p->fd = STDIN_FILENO;
     for (h = 0; h < NDEVICES && p->handler == NULL && p->fd >= 0; h++)
-        p->handler = (*devices[h].create)(p);
+      p->handler = (*devices[h].create)(p);
     if (p->fd >= 0) {
       if (p->handler == NULL) {
         physical_SetupStack(p, "unknown", PHYSICAL_NOFORCE);
@@ -961,10 +975,9 @@ physical_Open(struct physical *p, struct bundle *bundle)
             err = errno;
         }
 
-        wasopen = p->fd >= 0;
+        wasfd = p->fd;
         for (h = 0; h < NDEVICES && p->handler == NULL; h++)
-          if ((p->handler = (*devices[h].create)(p)) == NULL &&
-              wasopen && p->fd == -1)
+          if ((p->handler = (*devices[h].create)(p)) == NULL && wasfd != p->fd)
             break;
 
         if (p->fd < 0) {
@@ -974,7 +987,7 @@ physical_Open(struct physical *p, struct bundle *bundle)
                          strerror(errno));
             else
 	      log_Printf(LogWARN, "%s: Device (%s) must begin with a '/',"
-                         " a '!' or be a host:port pair\n", p->link.name,
+                         " a '!' or contain at least one ':'\n", p->link.name,
                          p->name.full);
           }
           physical_Unlock(p);
@@ -993,14 +1006,15 @@ void
 physical_SetupStack(struct physical *p, const char *who, int how)
 {
   link_EmptyStack(&p->link);
-  if (how == PHYSICAL_FORCE_SYNC ||
+  if (how == PHYSICAL_FORCE_SYNC || how == PHYSICAL_FORCE_SYNCNOACF ||
       (how == PHYSICAL_NOFORCE && physical_IsSync(p)))
     link_Stack(&p->link, &synclayer);
   else {
     link_Stack(&p->link, &asynclayer);
     link_Stack(&p->link, &hdlclayer);
   }
-  link_Stack(&p->link, &acflayer);
+  if (how != PHYSICAL_FORCE_SYNCNOACF)
+    link_Stack(&p->link, &acflayer);
   link_Stack(&p->link, &protolayer);
   link_Stack(&p->link, &lqrlayer);
   link_Stack(&p->link, &ccplayer);
diff --git a/usr.sbin/ppp/physical.h b/usr.sbin/ppp/physical.h
index 083ee91..0ff589a 100644
--- a/usr.sbin/ppp/physical.h
+++ b/usr.sbin/ppp/physical.h
@@ -33,7 +33,8 @@ struct cmdargs;
 #define TTY_DEVICE	2
 #define TCP_DEVICE	3
 #define UDP_DEVICE	4
-#define EXEC_DEVICE	5
+#define ETHER_DEVICE	5
+#define EXEC_DEVICE	6
 
 /* Returns from awaitcarrier() */
 #define CARRIER_PENDING	1
@@ -50,6 +51,7 @@ struct device {
   const char *name;
 
   int (*awaitcarrier)(struct physical *);
+  int (*removefromset)(struct physical *, fd_set *, fd_set *, fd_set *);
   int (*raw)(struct physical *);
   void (*offline)(struct physical *);
   void (*cooked)(struct physical *);
@@ -57,7 +59,8 @@ struct device {
   void (*destroy)(struct physical *);
   ssize_t (*read)(struct physical *, void *, size_t);
   ssize_t (*write)(struct physical *, const void *, size_t);
-  void (*device2iov)(struct device *, struct iovec *, int *, int, pid_t);
+  void (*device2iov)(struct device *, struct iovec *, int *, int, int *,
+                     int *, pid_t);
   int (*speed)(struct physical *);
   const char *(*openinfo)(struct physical *);
 };
@@ -111,9 +114,10 @@ struct physical {
 #define descriptor2physical(d) \
   ((d)->type == PHYSICAL_DESCRIPTOR ? field2phys(d, desc) : NULL)
 
-#define PHYSICAL_NOFORCE	1
-#define PHYSICAL_FORCE_ASYNC	2
-#define PHYSICAL_FORCE_SYNC	3
+#define PHYSICAL_NOFORCE		1
+#define PHYSICAL_FORCE_ASYNC		2
+#define PHYSICAL_FORCE_SYNC		3
+#define PHYSICAL_FORCE_SYNCNOACF	4
 
 extern struct physical *physical_Create(struct datalink *, int);
 extern int physical_Open(struct physical *, struct bundle *);
@@ -128,8 +132,9 @@ extern void physical_Offline(struct physical *);
 extern void physical_Close(struct physical *);
 extern void physical_Destroy(struct physical *);
 extern struct physical *iov2physical(struct datalink *, struct iovec *, int *,
-                                     int, int);
-extern int physical2iov(struct physical *, struct iovec *, int *, int, pid_t);
+                                     int, int, int *, int *);
+extern int physical2iov(struct physical *, struct iovec *, int *, int, int *,
+                        int *, pid_t);
 extern void physical_ChangedPid(struct physical *, pid_t);
 
 extern int physical_IsSync(struct physical *);
@@ -142,6 +147,8 @@ extern ssize_t physical_Write(struct physical *, const void *, size_t);
 extern int physical_doUpdateSet(struct descriptor *, fd_set *, fd_set *,
                                 fd_set *, int *, int);
 extern int physical_IsSet(struct descriptor *, const fd_set *);
+extern void physical_DescriptorRead(struct descriptor *, struct bundle *,
+                                    const fd_set *);
 extern void physical_Login(struct physical *, const char *);
 extern int physical_RemoveFromSet(struct physical *, fd_set *, fd_set *,
                                   fd_set *);
@@ -151,3 +158,4 @@ extern void physical_SetupStack(struct physical *, const char *, int);
 extern void physical_StopDeviceTimer(struct physical *);
 extern int physical_MaxDeviceSize(void);
 extern int physical_AwaitCarrier(struct physical *);
+extern void physical_SetDescriptor(struct physical *);
diff --git a/usr.sbin/ppp/ppp.8 b/usr.sbin/ppp/ppp.8
index 95d1949..115aace 100644
--- a/usr.sbin/ppp/ppp.8
+++ b/usr.sbin/ppp/ppp.8
@@ -206,7 +206,7 @@ will force it to exit.
 .Nm
 can use either the standard LCP callback protocol or the Microsoft
 CallBack Control Protocol (ftp://ftp.microsoft.com/developr/rfc/cbcp.txt).
-.It Supports packet aliasing.
+.It Supports NAT or packet aliasing.
 Packet aliasing (a.k.a. IP masquerading) allows computers on a
 private, unregistered network to access the Internet.  The
 .Em PPP
@@ -277,19 +277,39 @@ link.
 .It Supports PPP over TCP and PPP over UDP.
 If a device name is specified as
 .Em host Ns No : Ns Em port Ns
-.Op / Ns Em tcp Ns No | Ns Em udp ,
+.Xo
+.Op / Ns tcp|udp ,
+.Xc
 .Nm
 will open a TCP or UDP connection for transporting data rather than using a
 conventional serial device.  UDP connections force
 .Nm
 into synchronous mode.
-.It Supports PPP over ISDN
+.It Supports PPP over ISDN.
 If
 .Nm
 is given a raw B-channel i4b device to open as a link, it's able to talk
 to the
 .Xr isdnd 8
 daemon to establish an ISDN connection.
+.It Supports PPP over Ethernet (rfc 2516).
+If
+.Nm
+is given a device specification of the format
+.No PPPoE: Ns Ar iface Ns Xo
+.Op \&: Ns Ar provider Ns
+.Xc
+and if
+.Xr netgraph 4
+is available,
+.Nm
+will attempt talk
+.Em PPP
+over Ethernet to
+.Ar provider
+using the
+.Ar iface
+network interface.
 .It "Supports IETF draft Predictor-1 (rfc 1978) and DEFLATE (rfc 1979) compression."
 .Nm
 supports not only VJ-compression but also Predictor-1 and DEFLATE compression.
@@ -3712,9 +3732,15 @@ If
 does not begin with
 .Pa /dev/ ,
 it must either begin with an exclamation mark
-.Pq Dq \&!
+.Pq Dq \&! ,
+be of the format
+.No PPPoE: Ns Ar iface Ns Xo
+.Op \&: Ns Ar provider Ns
+.Xc
 or be of the format
-.Dq host:port Ns Op Ns /proto .
+.Ar host Ns No : Ns Ar port Ns Oo
+.No /tcp|udp
+.Oc .
 .Pp
 If it begins with an exclamation mark, the rest of the device name is
 treated as a program name, and that program is executed when the device
@@ -3723,15 +3749,42 @@ is opened.  Standard input, output and error are fed back to
 and are read and written as if they were a regular device.
 .Pp
 If a
-.Dq host:port Ns Op /tcp|/udp
+.No PPPoE: Ns Ar iface Ns Xo
+.Op \&: Ns Ar provider Ns
+.Xc
+specification is given,
+.Nm
+will attempt to create a
+.Em PPP
+over Ethernet connection using the given
+.Ar iface
+interface.  If a
+.Ar provider
+is given,
+.Nm
+will attempt to make a connection to that provider only.  Refer to
+.Xr netgraph 4
+and
+.Xr ng_pppoe 8
+for further details.
+.Pp
+If a
+.Ar host Ns No : Ns Ar port Ns Oo
+.No /tcp|udp
+.Oc
 specification is given,
 .Nm
 will attempt to connect to the given
-.Dq host
+.Ar host
 on the given
-.Dq port .
-If a tcp or udp specification is not given, the default is tcp.  Refer to
-the section on
+.Ar port .
+If a
+.Dq /tcp
+or
+.Dq /udp
+suffix is not provided, the default is
+.Dq /tcp .
+Refer to the section on
 .Em PPP OVER TCP and UDP
 above for further details.
 .Pp
@@ -4769,6 +4822,7 @@ This socket is used to pass links between different instances of
 .Xr libalias 3 ,
 .Xr syslog 3 ,
 .Xr uucplock 3 ,
+.Xr netgraph 4 ,
 .Xr crontab 5 ,
 .Xr group 5 ,
 .Xr passwd 5 ,
@@ -4782,6 +4836,7 @@ This socket is used to pass links between different instances of
 .Xr init 8 ,
 .Xr isdn 8 ,
 .Xr named 8 ,
+.Xr ng_pppoe 8 ,
 .Xr ping 8 ,
 .Xr pppctl 8 ,
 .Xr pppd 8 ,
diff --git a/usr.sbin/ppp/ppp.8.m4 b/usr.sbin/ppp/ppp.8.m4
index 95d1949..115aace 100644
--- a/usr.sbin/ppp/ppp.8.m4
+++ b/usr.sbin/ppp/ppp.8.m4
@@ -206,7 +206,7 @@ will force it to exit.
 .Nm
 can use either the standard LCP callback protocol or the Microsoft
 CallBack Control Protocol (ftp://ftp.microsoft.com/developr/rfc/cbcp.txt).
-.It Supports packet aliasing.
+.It Supports NAT or packet aliasing.
 Packet aliasing (a.k.a. IP masquerading) allows computers on a
 private, unregistered network to access the Internet.  The
 .Em PPP
@@ -277,19 +277,39 @@ link.
 .It Supports PPP over TCP and PPP over UDP.
 If a device name is specified as
 .Em host Ns No : Ns Em port Ns
-.Op / Ns Em tcp Ns No | Ns Em udp ,
+.Xo
+.Op / Ns tcp|udp ,
+.Xc
 .Nm
 will open a TCP or UDP connection for transporting data rather than using a
 conventional serial device.  UDP connections force
 .Nm
 into synchronous mode.
-.It Supports PPP over ISDN
+.It Supports PPP over ISDN.
 If
 .Nm
 is given a raw B-channel i4b device to open as a link, it's able to talk
 to the
 .Xr isdnd 8
 daemon to establish an ISDN connection.
+.It Supports PPP over Ethernet (rfc 2516).
+If
+.Nm
+is given a device specification of the format
+.No PPPoE: Ns Ar iface Ns Xo
+.Op \&: Ns Ar provider Ns
+.Xc
+and if
+.Xr netgraph 4
+is available,
+.Nm
+will attempt talk
+.Em PPP
+over Ethernet to
+.Ar provider
+using the
+.Ar iface
+network interface.
 .It "Supports IETF draft Predictor-1 (rfc 1978) and DEFLATE (rfc 1979) compression."
 .Nm
 supports not only VJ-compression but also Predictor-1 and DEFLATE compression.
@@ -3712,9 +3732,15 @@ If
 does not begin with
 .Pa /dev/ ,
 it must either begin with an exclamation mark
-.Pq Dq \&!
+.Pq Dq \&! ,
+be of the format
+.No PPPoE: Ns Ar iface Ns Xo
+.Op \&: Ns Ar provider Ns
+.Xc
 or be of the format
-.Dq host:port Ns Op Ns /proto .
+.Ar host Ns No : Ns Ar port Ns Oo
+.No /tcp|udp
+.Oc .
 .Pp
 If it begins with an exclamation mark, the rest of the device name is
 treated as a program name, and that program is executed when the device
@@ -3723,15 +3749,42 @@ is opened.  Standard input, output and error are fed back to
 and are read and written as if they were a regular device.
 .Pp
 If a
-.Dq host:port Ns Op /tcp|/udp
+.No PPPoE: Ns Ar iface Ns Xo
+.Op \&: Ns Ar provider Ns
+.Xc
+specification is given,
+.Nm
+will attempt to create a
+.Em PPP
+over Ethernet connection using the given
+.Ar iface
+interface.  If a
+.Ar provider
+is given,
+.Nm
+will attempt to make a connection to that provider only.  Refer to
+.Xr netgraph 4
+and
+.Xr ng_pppoe 8
+for further details.
+.Pp
+If a
+.Ar host Ns No : Ns Ar port Ns Oo
+.No /tcp|udp
+.Oc
 specification is given,
 .Nm
 will attempt to connect to the given
-.Dq host
+.Ar host
 on the given
-.Dq port .
-If a tcp or udp specification is not given, the default is tcp.  Refer to
-the section on
+.Ar port .
+If a
+.Dq /tcp
+or
+.Dq /udp
+suffix is not provided, the default is
+.Dq /tcp .
+Refer to the section on
 .Em PPP OVER TCP and UDP
 above for further details.
 .Pp
@@ -4769,6 +4822,7 @@ This socket is used to pass links between different instances of
 .Xr libalias 3 ,
 .Xr syslog 3 ,
 .Xr uucplock 3 ,
+.Xr netgraph 4 ,
 .Xr crontab 5 ,
 .Xr group 5 ,
 .Xr passwd 5 ,
@@ -4782,6 +4836,7 @@ This socket is used to pass links between different instances of
 .Xr init 8 ,
 .Xr isdn 8 ,
 .Xr named 8 ,
+.Xr ng_pppoe 8 ,
 .Xr ping 8 ,
 .Xr pppctl 8 ,
 .Xr pppd 8 ,
diff --git a/usr.sbin/ppp/tcp.c b/usr.sbin/ppp/tcp.c
index 7fd53a7..c6cb16d 100644
--- a/usr.sbin/ppp/tcp.c
+++ b/usr.sbin/ppp/tcp.c
@@ -109,12 +109,13 @@ static struct device tcpdevice = {
   NULL,
   NULL,
   NULL,
+  NULL,
   NULL
 };
 
 struct device *
 tcp_iov2device(int type, struct physical *p, struct iovec *iov,
-               int *niov, int maxiov)
+               int *niov, int maxiov, int *auxfd, int *nauxfd)
 {
   if (type == TCP_DEVICE) {
     free(iov[(*niov)++].iov_base);
@@ -131,7 +132,7 @@ tcp_Create(struct physical *p)
   char *cp, *host, *port, *svc;
 
   if (p->fd < 0) {
-    if ((cp = strchr(p->name.full, ':')) != NULL) {
+    if ((cp = strchr(p->name.full, ':')) != NULL && !strchr(cp + 1, ':')) {
       *cp = '\0';
       host = p->name.full;
       port = cp + 1;
@@ -140,8 +141,10 @@ tcp_Create(struct physical *p)
         *cp = ':';
         return 0;
       }
-      if (svc)
+      if (svc) {
+        p->fd--;     /* We own the device but maybe can't use it - change fd */
         *svc = '\0';
+      }
       if (*host && *port) {
         p->fd = tcp_OpenConnection(p->link.name, host, port);
         *cp = ':';
diff --git a/usr.sbin/ppp/tcp.h b/usr.sbin/ppp/tcp.h
index 798f19a..f6a8235 100644
--- a/usr.sbin/ppp/tcp.h
+++ b/usr.sbin/ppp/tcp.h
@@ -30,5 +30,5 @@ struct physical;
 
 extern struct device *tcp_Create(struct physical *);
 extern struct device *tcp_iov2device(int, struct physical *,
-                                     struct iovec *, int *, int);
+                                     struct iovec *, int *, int, int *, int *);
 #define tcp_DeviceSize physical_DeviceSize
diff --git a/usr.sbin/ppp/tty.c b/usr.sbin/ppp/tty.c
index eeae250..db9fddc 100644
--- a/usr.sbin/ppp/tty.c
+++ b/usr.sbin/ppp/tty.c
@@ -309,7 +309,7 @@ tty_OpenInfo(struct physical *p)
 
 static void
 tty_device2iov(struct device *d, struct iovec *iov, int *niov,
-               int maxiov, pid_t newpid)
+               int maxiov, int *auxfd, int *nauxfd, pid_t newpid)
 {
   struct ttydevice *dev = device2tty(d);
   int sz = physical_MaxDeviceSize();
@@ -332,6 +332,7 @@ static struct device basettydevice = {
   TTY_DEVICE,
   "tty",
   tty_AwaitCarrier,
+  NULL,
   tty_Raw,
   tty_Offline,
   tty_Cooked,
@@ -346,7 +347,7 @@ static struct device basettydevice = {
 
 struct device *
 tty_iov2device(int type, struct physical *p, struct iovec *iov, int *niov,
-               int maxiov)
+               int maxiov, int *auxfd, int *nauxfd)
 {
   if (type == TTY_DEVICE) {
     struct ttydevice *dev = (struct ttydevice *)iov[(*niov)++].iov_base;
diff --git a/usr.sbin/ppp/tty.h b/usr.sbin/ppp/tty.h
index 0985c77..9f37dd5 100644
--- a/usr.sbin/ppp/tty.h
+++ b/usr.sbin/ppp/tty.h
@@ -31,5 +31,5 @@ struct device;
 
 extern struct device *tty_Create(struct physical *);
 extern struct device *tty_iov2device(int, struct physical *,
-                                     struct iovec *, int *, int);
+                                     struct iovec *, int *, int, int *, int *);
 extern int tty_DeviceSize(void);
diff --git a/usr.sbin/ppp/udp.c b/usr.sbin/ppp/udp.c
index 2a84eb6..c3763dc 100644
--- a/usr.sbin/ppp/udp.c
+++ b/usr.sbin/ppp/udp.c
@@ -116,7 +116,7 @@ udp_Free(struct physical *p)
 
 static void
 udp_device2iov(struct device *d, struct iovec *iov, int *niov,
-               int maxiov, pid_t newpid)
+               int maxiov, int *auxfd, int *nauxfd, pid_t newpid)
 {
   int sz = physical_MaxDeviceSize();
 
@@ -137,6 +137,7 @@ static const struct device baseudpdevice = {
   NULL,
   NULL,
   NULL,
+  NULL,
   udp_Free,
   udp_Recvfrom,
   udp_Sendto,
@@ -147,7 +148,7 @@ static const struct device baseudpdevice = {
 
 struct device *
 udp_iov2device(int type, struct physical *p, struct iovec *iov, int *niov,
-               int maxiov)
+               int maxiov, int *auxfd, int *nauxfd)
 {
   if (type == UDP_DEVICE) {
     struct udpdevice *dev = (struct udpdevice *)iov[(*niov)++].iov_base;
@@ -231,7 +232,7 @@ udp_Create(struct physical *p)
 
   dev = NULL;
   if (p->fd < 0) {
-    if ((cp = strchr(p->name.full, ':')) != NULL) {
+    if ((cp = strchr(p->name.full, ':')) != NULL && !strchr(cp + 1, ':')) {
       *cp = '\0';
       host = p->name.full;
       port = cp + 1;
@@ -240,8 +241,10 @@ udp_Create(struct physical *p)
         *cp = ':';
         return NULL;
       }
-      if (svc)
+      if (svc) {
+        p->fd--;     /* We own the device but maybe can't use it - change fd */
         *svc = '\0';
+      }
 
       if (*host && *port)
         dev = udp_CreateDevice(p, host, port);
diff --git a/usr.sbin/ppp/udp.h b/usr.sbin/ppp/udp.h
index 5ef3983..46b8fe6 100644
--- a/usr.sbin/ppp/udp.h
+++ b/usr.sbin/ppp/udp.h
@@ -31,5 +31,5 @@ struct device;
 
 extern struct device *udp_Create(struct physical *);
 extern struct device *udp_iov2device(int, struct physical *,
-                                     struct iovec *, int *, int);
+                                     struct iovec *, int *, int, int *, int *);
 extern int udp_DeviceSize(void);