[Openvpn-devel,v4] Implement deferred auth for scripts

Message ID 20210304114052.8577-1-arne@rfc2549.org
State Changes Requested
Delegated to: Gert Doering
Headers show
Series [Openvpn-devel,v4] Implement deferred auth for scripts | expand

Commit Message

Arne Schwabe March 4, 2021, 12:40 a.m. UTC
This patch also refactors the if condition that checks the result of
the authentication since that has become quite unreadable. It renames
s1/s2 and extracts some parts of the condition into individual variables
to make the condition better understandle

Patch v2: add refactoring of the if condition
Patch v4: fix documentation not mentioning method as 2nd line

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
---
 Changes.rst                         | 12 +++++
 doc/man-sections/script-options.rst | 14 ++++-
 src/openvpn/ssl.c                   |  2 -
 src/openvpn/ssl_verify.c            | 84 +++++++++++++++++++++--------
 4 files changed, 87 insertions(+), 25 deletions(-)

Comments

David Sommerseth March 4, 2021, 3:56 a.m. UTC | #1
On 04/03/2021 12:40, Arne Schwabe wrote:
> This patch also refactors the if condition that checks the result of
> the authentication since that has become quite unreadable. It renames
> s1/s2 and extracts some parts of the condition into individual variables
> to make the condition better understandle
> 
> Patch v2: add refactoring of the if condition
> Patch v4: fix documentation not mentioning method as 2nd line
> 
> Signed-off-by: Arne Schwabe <arne@rfc2549.org>
> ---
>   Changes.rst                         | 12 +++++
>   doc/man-sections/script-options.rst | 14 ++++-
>   src/openvpn/ssl.c                   |  2 -
>   src/openvpn/ssl_verify.c            | 84 +++++++++++++++++++++--------
>   4 files changed, 87 insertions(+), 25 deletions(-)
> 
> diff --git a/Changes.rst b/Changes.rst
> index 62008e8d..74728d2a 100644

Acked-By: David Sommerseth <davids@openvpn.net>
Gert Doering March 10, 2021, 4:47 a.m. UTC | #2
Hi,

On Thu, Mar 04, 2021 at 12:40:52PM +0100, Arne Schwabe wrote:
> This patch also refactors the if condition that checks the result of
> the authentication since that has become quite unreadable. It renames
> s1/s2 and extracts some parts of the condition into individual variables
> to make the condition better understandle
> 
> Patch v2: add refactoring of the if condition
> Patch v4: fix documentation not mentioning method as 2nd line

Not sure yet what is happening, but this breaks deferred auth in plugins
- as in "they always succeed".

I have some test cases using plugin-auth-pam which delays for about 15
seconds (querying a nonexisting radius server) and then checks a local
auth+password file.  One of the cases should succeed "but be delayed",
one of the cases must fail "but delayed fail", because I send a username
that does not exists.

With this patch applied, authentication *succeeds* very fast in both
cases, even with wrong password.

The log file with this patch has:

2021-03-10 16:40:43 us=610286 2001:608:0:814::f000:21 VERIFY OK: depth=0, C=DE, ST=Bavaria, L=Munich, O=OpenVPN community project, OU=Server Testing, CN=cron2-freebsd-tc-amd64, emailAddress=gert@greenie.net
2021-03-10 16:40:43 us=612104 PLUGIN AUTH-PAM: do deferred auth '/tmp/openvpn_acf_2f305c6e47c6552f3e29e210b1c0baf.tmp'
2021-03-10 16:40:43 us=612428 PLUGIN AUTH-PAM: deferred authentication
2021-03-10 16:40:43 us=612823 PLUGIN AUTH-PAM: BACKGROUND: deferred auth for 'fbsd-tc-masterFoo', pid=21053
2021-03-10 16:40:43 us=612951 PLUGIN AUTH-PAM: cannot open '/tmp/openvpn_acf_2f305c6e47c6552f3e29e210b1c0baf.tmp' for writing: No such file or directory (errno=2)
2021-03-10 16:40:43 us=617812 2001:608:0:814::f000:21 TLS: Username/Password authentication deferred for username 'fbsd-tc-masterFoo' 
2021-03-10 16:40:43 us=618636 2001:608:0:814::f000:21 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2021-03-10 16:40:43 us=618674 2001:608:0:814::f000:21 [cron2-freebsd-tc-amd64] Peer Connection Initiated with [AF_INET6]2001:608:0:814::f000:21:40868
2021-03-10 16:40:43 us=618705 cron2-freebsd-tc-amd64/2001:608:0:814::f000:21 MULTI_sva: pool returned IPv4=194.97.145.74, IPv6=2001:608:3:814::1000
2021-03-10 16:40:43 us=625942 cron2-freebsd-tc-amd64/2001:608:0:814::f000:21 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_1cdbffdecac750624e0d4deb89a7ad1d.tmp
...
2021-03-10 16:40:43 us=626454 cron2-freebsd-tc-amd64/2001:608:0:814::f000:21 SENT CONTROL [cron2-freebsd-tc-amd64]: 'PUSH_REPLY,route 10.204.0.0 255.255.0.0,route-ipv6 fd00:abcd:204::/48,tun-ipv6,route-gateway 194.97.145.73,topology subnet,ping 10,ping-restart 30,compress lz4,ifconfig-ipv6 2001:608:3:814::1000/64 2001:608:3:814::1,ifconfig 194.97.145.74 255.255.255.248,peer-id 0,auth-tokenSESS_ID,cipher AES-256-GCM,key-derivation tls-ekm' (status=1)


Actually, there is a script involved as well - the server config has

# ASYNC (20s delay ueber pam_radius)
setenv deferred_auth_pam 1
plugin /.../openvpn-plugin-auth-pam.so "openvpn-global Login: USERNAME Password: PASSWORD"

# nebenbei auch noch das shell-interface validieren
script-security 3
auth-user-pass-verify /.../auth-user-pass-verify.sh via-env


if I remove the call to "auth-user-pass-verify", the plugin failure is
correctly detected and signalled again.  It also waits proper 15 seconds
again...

2021-03-10 16:44:31 us=527310 PLUGIN AUTH-PAM: BACKGROUND: deferred auth for 'fbsd-tc-masterFoo', pid=21861
2021-03-10 16:44:46 us=546819 PLUGIN AUTH-PAM: BACKGROUND: user 'fbsd-tc-masterFoo' failed to authenticate: User not known to the underlying authentication module
2021-03-10 16:44:47 us=992782 2001:608:0:814::f000:21 SENT CONTROL [cron2-freebsd-tc-amd64]: 'AUTH_FAILED' (status=1)


... and no error messages about the auth_control_file missing.

So, it seems the cleanup of this nasty bit of logic has actually broken 
it :-( (or introduced new and interesting corner cases)


I'll see if I can find sufficient brains to dig into this and see what
is happening.

gert

Patch

diff --git a/Changes.rst b/Changes.rst
index 62008e8d..74728d2a 100644
--- a/Changes.rst
+++ b/Changes.rst
@@ -15,6 +15,17 @@  Compatibility with OpenSSL in FIPS mode
     requirements/recommendation of FIPS 140-2. This just allows OpenVPN
     to be run on a system that be configured OpenSSL in FIPS mode.
 
+Deferred auth support for scripts
+    The ``--auth-user-pass-verify`` script supports now deferred authentication.
+
+Pending auth support for plugins and scripts
+    Both auth plugin and script can now signal pending authentication to
+    the client when using deferred authentication. The new ``client-crresponse``
+    script option and ``OPENVPN_PLUGIN_CLIENT_CRRESPONSE`` plugin function can
+    be used to parse a client response to a ``CR_TEXT`` two factor challenge.
+
+    See ``sample/sample-scripts/totpauth.py`` for an example.
+
 Deprecated features
 -------------------
 ``inetd`` has been removed
@@ -22,6 +33,7 @@  Deprecated features
     and TAP mode only.
 
 
+
 Overview of changes in 2.5
 ==========================
 
diff --git a/doc/man-sections/script-options.rst b/doc/man-sections/script-options.rst
index 03b3dd77..22990f4f 100644
--- a/doc/man-sections/script-options.rst
+++ b/doc/man-sections/script-options.rst
@@ -90,7 +90,19 @@  SCRIPT HOOKS
 
   The script should examine the username and password, returning a success
   exit code (:code:`0`) if the client's authentication request is to be
-  accepted, or a failure code (:code:`1`) to reject the client.
+  accepted, a failure code (:code:`1`) to reject the client, or a that
+  the authentication is deferred (:code:`2`). If the authentication is
+  deferred, the script must fork/start a background or another non-blocking
+  operation to continue the authentication in the background. When finshing
+  the authentication, a :code:`1` or :code:`0` must be written to the
+  file specified by the :code:`auth_control_file`.
+
+  When deferred authentication is in use, the script can also request
+  pending authentication by writing to the file specified by the
+  :code:`auth_pending_file`. The first line must be the timeout in
+  seconds, the required method on the second line (e.g. crtext) and
+  third line must be the EXTRA as documented in the
+  ``client-pending-auth`` section of `doc/management.txt`.
 
   This directive is designed to enable a plugin-style interface for
   extending OpenVPN's authentication capabilities.
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index f958a605..51164a66 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -992,9 +992,7 @@  key_state_free(struct key_state *ks, bool clear)
 
     packet_id_free(&ks->crypto_options.packet_id);
 
-#ifdef PLUGIN_DEF_AUTH
     key_state_rm_auth_control_files(ks);
-#endif
 
     if (clear)
     {
diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c
index b9647c1a..b59a0230 100644
--- a/src/openvpn/ssl_verify.c
+++ b/src/openvpn/ssl_verify.c
@@ -1188,14 +1188,14 @@  tls_authenticate_key(struct tls_multi *multi, const unsigned int mda_key_id, con
 /*
  * Verify the user name and password using a script
  */
-static bool
+static int
 verify_user_pass_script(struct tls_session *session, struct tls_multi *multi,
                         const struct user_pass *up)
 {
     struct gc_arena gc = gc_new();
     struct argv argv = argv_new();
     const char *tmp_file = "";
-    bool ret = false;
+    int retval = OPENVPN_PLUGIN_FUNC_ERROR;
 
     /* Set environmental variables prior to calling script */
     setenv_str(session->opt->es, "script_type", "user-pass-verify");
@@ -1223,25 +1223,59 @@  verify_user_pass_script(struct tls_session *session, struct tls_multi *multi,
             /* pass temp file name to script */
             argv_printf_cat(&argv, "%s", tmp_file);
         }
-        else
-        {
-            msg(D_TLS_ERRORS, "TLS Auth Error: could not create write "
-                "username/password to temp file");
-        }
     }
     else
     {
+        setenv_str(session->opt->es, "username", up->username);
         setenv_str(session->opt->es, "password", up->password);
     }
 
+    /* generate filename for deferred auth control file */
+    if (!key_state_gen_auth_control_files(&session->key[KS_PRIMARY],
+                                         session->opt))
+    {
+        msg(D_TLS_ERRORS, "TLS Auth Error (%s): "
+                          "could not create deferred auth control file", __func__);
+        return OPENVPN_PLUGIN_FUNC_ERROR;
+    }
+
     /* call command */
-    ret = openvpn_run_script(&argv, session->opt->es, 0,
-                             "--auth-user-pass-verify");
+    int script_ret = openvpn_run_script(&argv, session->opt->es, S_EXITCODE,
+                                        "--auth-user-pass-verify");
+    switch (script_ret)
+    {
+       case 0:
+           retval = OPENVPN_PLUGIN_FUNC_SUCCESS;
+           break;
+       case 2:
+           retval = OPENVPN_PLUGIN_FUNC_DEFERRED;
+           break;
+       default:
+           retval = OPENVPN_PLUGIN_FUNC_ERROR;
+           break;
+    }
+    if (retval == OPENVPN_PLUGIN_FUNC_DEFERRED)
+    {
+        /* Check if we the plugin has written the pending auth control
+         * file and send the pending auth to the client */
+        if(!key_state_check_auth_pending_file(&session->key[KS_PRIMARY],
+                                              multi))
+        {
+            retval = OPENVPN_PLUGIN_FUNC_ERROR;
+            key_state_rm_auth_control_files(&session->key[KS_PRIMARY]);
+        }
 
+    }
+    else
+    {
+        /* purge auth control filename (and file itself) for non-deferred returns */
+        key_state_rm_auth_control_files(&session->key[KS_PRIMARY]);
+    }
     if (!session->opt->auth_user_pass_verify_script_via_file)
     {
         setenv_del(session->opt->es, "password");
     }
+
 done:
     if (tmp_file && strlen(tmp_file) > 0)
     {
@@ -1250,7 +1284,7 @@  done:
 
     argv_free(&argv);
     gc_free(&gc);
-    return ret;
+    return retval;
 }
 
 /*
@@ -1371,8 +1405,6 @@  void
 verify_user_pass(struct user_pass *up, struct tls_multi *multi,
                  struct tls_session *session)
 {
-    int s1 = OPENVPN_PLUGIN_FUNC_SUCCESS;
-    bool s2 = true;
     struct key_state *ks = &session->key[KS_PRIMARY];      /* primary key */
 
 #ifdef ENABLE_MANAGEMENT
@@ -1432,30 +1464,32 @@  verify_user_pass(struct user_pass *up, struct tls_multi *multi,
         }
     }
 
+    int plugin_status = OPENVPN_PLUGIN_FUNC_SUCCESS;
+    int script_status = OPENVPN_PLUGIN_FUNC_SUCCESS;
     /* Set the environment variables used by all auth variants */
     if (!set_verify_user_pass_env(up, multi, session))
     {
         skip_auth = true;
-        s1 = OPENVPN_PLUGIN_FUNC_ERROR;
+        plugin_status = OPENVPN_PLUGIN_FUNC_ERROR;
     }
 
     /* call plugin(s) and/or script */
     if (!skip_auth)
     {
 #ifdef ENABLE_MANAGEMENT
-        if (man_def_auth==KMDA_DEF)
+        if (man_def_auth == KMDA_DEF)
         {
             man_def_auth = verify_user_pass_management(session, multi, up);
         }
 #endif
         if (plugin_defined(session->opt->plugins, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY))
         {
-            s1 = verify_user_pass_plugin(session, multi, up);
+            plugin_status = verify_user_pass_plugin(session, multi, up);
         }
 
         if (session->opt->auth_user_pass_verify_script)
         {
-            s2 = verify_user_pass_script(session, multi, up);
+            script_status = verify_user_pass_script(session, multi, up);
         }
     }
 
@@ -1466,19 +1500,25 @@  verify_user_pass(struct user_pass *up, struct tls_multi *multi,
         msg(D_TLS_ERRORS,
             "TLS Auth Error: --username-as-common name specified and username is longer than the maximum permitted Common Name length of %d characters",
             TLS_USERNAME_LEN);
-        s1 = OPENVPN_PLUGIN_FUNC_ERROR;
+        plugin_status = OPENVPN_PLUGIN_FUNC_ERROR;
+        script_status = OPENVPN_PLUGIN_FUNC_ERROR;
     }
     /* auth succeeded? */
-    if ((s1 == OPENVPN_PLUGIN_FUNC_SUCCESS
-         || s1 == OPENVPN_PLUGIN_FUNC_DEFERRED
-         ) && s2
+    bool plugin_ok = plugin_status == OPENVPN_PLUGIN_FUNC_SUCCESS
+        || plugin_status == OPENVPN_PLUGIN_FUNC_DEFERRED;
+
+    bool script_ok =  script_status == OPENVPN_PLUGIN_FUNC_SUCCESS
+        || script_status ==  OPENVPN_PLUGIN_FUNC_DEFERRED;
+
+    if (script_ok && plugin_ok && tls_lock_username(multi, up->username)
 #ifdef ENABLE_MANAGEMENT
         && man_def_auth != KMDA_ERROR
 #endif
-        && tls_lock_username(multi, up->username))
+        )
     {
         ks->authenticated = KS_AUTH_TRUE;
-        if (s1 == OPENVPN_PLUGIN_FUNC_DEFERRED)
+        if (plugin_status == OPENVPN_PLUGIN_FUNC_DEFERRED
+            || script_status == OPENVPN_PLUGIN_FUNC_DEFERRED)
         {
             ks->authenticated = KS_AUTH_DEFERRED;
         }