[Openvpn-devel,v7,1/6] client-connect: Add CC_RET_DEFERRED and cope with deferred client-connect

Message ID 20200716134315.17742-1-arne@rfc2549.org
State Accepted
Headers show
Series
  • [Openvpn-devel,v7,1/6] client-connect: Add CC_RET_DEFERRED and cope with deferred client-connect
Related show

Commit Message

Arne Schwabe July 16, 2020, 1:43 p.m.
This patch moves the state, that was previously tracked within the
multi_connection_established() function, into struct client_connect_state.  The
multi_connection_established() function can now be exited and re-entered as
many times as necessary - without losing the client-connect handling state.

The patch also adds the new return value CC_RET_DEFERRED which indicates that
the handler couldn't complete immediately, and needs to be called later.  At
that point multi_connection_established() will exit without indicating
completion.

Each client-connect handler now has an (optional) additional call-back:  The
call-back for handling the deferred case.  If the main call-back returns
CC_RET_DEFERRED, the next call to the handler will be through the deferred
call-back.

Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>

Patch V3: Use a static struct in multi_instance instead of using
          malloc/free and use two states (deffered with and without
          result) instead of one to eliminate the counter that was
          only tested for > 0.

Patch V5: Use new states in context_auth instead of the extra state
          that the patch series previously used.

Patch V6: Restructure code to make it a bit more readable, rebase on
          master.

Patch V7: move defferred bool into client connect handler calls, switch
          to switch case

Signed-off-by: Arne Schwabe <arne@rfc2549.org>
---
 src/openvpn/multi.c   | 157 +++++++++++++++++++++++++++++-------------
 src/openvpn/multi.h   |  15 +++-
 src/openvpn/openvpn.h |   9 +++
 3 files changed, 132 insertions(+), 49 deletions(-)

Comments

Gert Doering July 16, 2020, 3:03 p.m. | #1
Hi,

On Thu, Jul 16, 2020 at 03:43:10PM +0200, Arne Schwabe wrote:
> This patch moves the state, that was previously tracked within the
> multi_connection_established() function, into struct client_connect_state.  The
> multi_connection_established() function can now be exited and re-entered as
> many times as necessary - without losing the client-connect handling state.

This looks much nicer now :-) - I haven't done a full review yet, but
I fed it to the test machine, and it seem to have liked it.  Including
"2.2 client" and "2.3 --enable-small client" now... *brag*

22...
Test sets succeeded: 1 2 3 4 6 8.
Test sets failed: none.
23.small...
Test sets succeeded: 1 2 3 4.
Test sets failed: none.
23...
Test sets succeeded: 1 1a 1b 1d 2 2a 2b 2c 2d 3 4 5 6 8 8a 9.
Test sets failed: none.
24...
Test sets succeeded: 1 1a 1b 1c 1d 1e 2 2a 2b 2c 2d 2e 3 4 4a 5 6 8 8a 9.
Test sets failed: none.
master...
Test sets succeeded: 1 1a 1b 1c 1d 1e 2 2a 2b 2c 2d 2e 3 4 5 5x 6 7 7x 8 8a 9 2f 4b.
Test sets failed: none.


The test setup is using --client-connect and CCD/ files, but no CC plugin
yet (nor management console).  So it's not excercising all these code 
parts very well.

gert
Antonio Quartulli July 16, 2020, 3:13 p.m. | #2
Hi,

On 16/07/2020 15:43, Arne Schwabe wrote:
> This patch moves the state, that was previously tracked within the
> multi_connection_established() function, into struct client_connect_state.  The
> multi_connection_established() function can now be exited and re-entered as
> many times as necessary - without losing the client-connect handling state.
> 
> The patch also adds the new return value CC_RET_DEFERRED which indicates that
> the handler couldn't complete immediately, and needs to be called later.  At
> that point multi_connection_established() will exit without indicating
> completion.
> 
> Each client-connect handler now has an (optional) additional call-back:  The
> call-back for handling the deferred case.  If the main call-back returns
> CC_RET_DEFERRED, the next call to the handler will be through the deferred
> call-back.
> 
> Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>
> 
> Patch V3: Use a static struct in multi_instance instead of using
>           malloc/free and use two states (deffered with and without
>           result) instead of one to eliminate the counter that was
>           only tested for > 0.
> 
> Patch V5: Use new states in context_auth instead of the extra state
>           that the patch series previously used.
> 
> Patch V6: Restructure code to make it a bit more readable, rebase on
>           master.
> 
> Patch V7: move defferred bool into client connect handler calls, switch
>           to switch case
> 
> Signed-off-by: Arne Schwabe <arne@rfc2549.org>


Haven't done a full test, this is why we have "Gert and his rig"[tm],
but the code looks good and I can't spot anything that may trigger my
personal alarm.

This version is much cleaner that what it looked like before. Thanks
Arne for reworking the patch once again.

Acked-by: Antonio Quartulli <antonio@openvpn.net>
Gert Doering July 17, 2020, 12:21 p.m. | #3
Your patch has been applied to the master branch.

Tested on the test rig, stared-at-code by antonio, and commit-message-adjusted
by me :-) (a few "defferred" and integrating the new call convention)

commit dfb40edc4acae5f17b0062ecb13ad1fa760ed529
Author: Arne Schwabe
Date:   Thu Jul 16 15:43:10 2020 +0200

     client-connect: Add CC_RET_DEFERRED and cope with deferred client-connect

     Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>
     Signed-off-by: Arne Schwabe <arne@rfc2549.org>
     Acked-by: Antonio Quartulli <antonio@openvpn.net>
     Message-Id: <20200716134315.17742-1-arne@rfc2549.org>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20395.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
Gert Doering July 17, 2020, 4:49 p.m. | #4
Your patch has been applied to the master branch.

Tested on the test rig, stared-at-code by antonio, and commit-message-adjusted
by me :-) (a few "defferred" and integrating the new call convention).

Pushed, then went out to write a plugin to excercise this a bit more... and
lo and behold, breakage!

If I run a server that has *both* a plugin with the connect handler configured 
(which succeeds) and a client-connect script (which fails), it will sort of "stare 
into nothingness".

With only the client-connect script configured, I get:

2020-07-17 18:35:10 us=536817 ... WARNING: Failed running command (--client-connect): external program exited with error status: 10
2020-07-17 18:35:11 us=751714 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:35:11 us=751860 ... SENT CONTROL [cron2-freebsd-tc-amd64]: 'AUTH_FAILED' (status=1)

"all good"

with both configured, I get:

2020-07-17 18:32:34 us=478215 PLUGIN_CALL: POST /root/t_server/tun-udp-p2mp-112-mask/sample-client-connect.so/PLUGIN_CLIENT_CONNECT status=0
2020-07-17 18:32:34 us=478331 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_36b55f67d059a540483662f8e736189.tmp
2020-07-17 18:32:34 us=478562 PLUGIN sample-cc: OPENVPN_PLUGIN_CLIENT_CONNECT_V2
2020-07-17 18:32:34 us=478670 PLUGIN_CALL: POST /root/t_server/tun-udp-p2mp-112-mask/sample-client-connect.so/PLUGIN_CLIENT_CONNECT status=0
2020-07-17 18:32:34 us=490057 WARNING: Failed running command (--client-connect): external program exited with error status: 10
2020-07-17 18:32:35 us=618131 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:32:40 us=801869 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:32:45 us=948480 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:32:50 us=990555 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:32:56 us=51592 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:33:01 us=311645 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:33:06 us=612242 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:33:11 us=811682 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:33:17 us=11695 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:33:22 us=151679 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:33:27 us=311636 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:33:32 us=351693 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:33:47 us=513879 MULTI: multi_create_instance called
2020-07-17 18:33:47 us=514020 194.97.140.21:51169 Re-using SSL/TLS context

(client retrying after timeout)


Now, if I make the *plugin* fail, it works as requested...

2020-07-17 18:47:21 us=372780 PLUGIN sample-cc: env has UV_WANT_CC_FAIL=10 -> fail
2020-07-17 18:47:21 us=372800 PLUGIN_CALL: POST /root/t_server/tun-udp-p2mp-112-mask/sample-client-connect.so/PLUGIN_CLIENT_CONNECT status=1
2020-07-17 18:47:21 us=372812 PLUGIN_CALL: plugin function PLUGIN_CLIENT_CONNECT failed with status 1: /root/t_server/tun-udp-p2mp-112-mask/sample-client-connect.so
2020-07-17 18:47:21 us=372824 WARNING: client-connect plugin call failed
2020-07-17 18:47:22 us=479574 ... PUSH: Received control message: 'PUSH_REQUEST'
2020-07-17 18:47:22 us=479634 ... Delayed exit in 5 seconds
2020-07-17 18:47:22 us=479661 ... SENT CONTROL [cron2-freebsd-tc-amd64]: 'AUTH_FAILED' (status=1)

- so it seems something in the chain of things is not good if "more than one" 
is there.


commit dfb40edc4acae5f17b0062ecb13ad1fa760ed529
Author: Arne Schwabe
Date:   Thu Jul 16 15:43:10 2020 +0200

     client-connect: Add CC_RET_DEFERRED and cope with deferred client-connect

     Signed-off-by: Fabian Knittel <fabian.knittel@lettink.de>
     Signed-off-by: Arne Schwabe <arne@rfc2549.org>
     Acked-by: Antonio Quartulli <antonio@openvpn.net>
     Message-Id: <20200716134315.17742-1-arne@rfc2549.org>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20395.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering

Patch

diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 97b7df16..9128798d 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -1713,8 +1713,11 @@  multi_client_connect_post_plugin(struct multi_context *m,
 enum client_connect_return
 multi_client_connect_mda(struct multi_context *m,
                          struct multi_instance *mi,
+                         bool deferred,
                          unsigned int *option_types_found)
 {
+    /* We never return CC_RET_DEFERRED */
+    ASSERT(!deferred);
     enum client_connect_return ret = CC_RET_SKIPPED;
 #ifdef MANAGEMENT_DEF_AUTH
     if (mi->cc_config)
@@ -1854,8 +1857,13 @@  multi_client_set_protocol_options(struct context *c)
 static enum client_connect_return
 multi_client_connect_call_plugin_v1(struct multi_context *m,
                                     struct multi_instance *mi,
+                                    bool deferred,
                                     unsigned int *option_types_found)
 {
+    if (deferred)
+    {
+        return CC_RET_FAILED;
+    }
     enum client_connect_return ret = CC_RET_SKIPPED;
 #ifdef ENABLE_PLUGIN
     ASSERT(m);
@@ -1907,8 +1915,13 @@  cleanup:
 static enum client_connect_return
 multi_client_connect_call_plugin_v2(struct multi_context *m,
                                     struct multi_instance *mi,
+                                    bool deferred,
                                     unsigned int *option_types_found)
 {
+    if (deferred)
+    {
+        return CC_RET_FAILED;
+    }
     enum client_connect_return ret = CC_RET_SKIPPED;
 #ifdef ENABLE_PLUGIN
     ASSERT(m);
@@ -1949,8 +1962,13 @@  multi_client_connect_call_plugin_v2(struct multi_context *m,
 static enum client_connect_return
 multi_client_connect_call_script(struct multi_context *m,
                                  struct multi_instance *mi,
+                                 bool deferred,
                                  unsigned int *option_types_found)
 {
+    if (deferred)
+    {
+        return CC_RET_FAILED;
+    }
     ASSERT(m);
     ASSERT(mi);
 
@@ -2173,8 +2191,12 @@  multi_client_connect_early_setup(struct multi_context *m,
 static enum client_connect_return
 multi_client_connect_source_ccd(struct multi_context *m,
                                 struct multi_instance *mi,
+                                bool deferred,
                                 unsigned int *option_types_found)
 {
+    /* Since we never return a CC_RET_DEFERRED, this indicates a serious
+     * problem */
+    ASSERT(!deferred);
     enum client_connect_return ret = CC_RET_SKIPPED;
     if (mi->context.options.client_config_dir)
     {
@@ -2225,32 +2247,18 @@  multi_client_connect_source_ccd(struct multi_context *m,
     return ret;
 }
 
-static inline bool
-cc_check_return(int *cc_succeeded_count,
-                enum client_connect_return ret)
-{
-    if (ret == CC_RET_SUCCEEDED)
-    {
-        (*cc_succeeded_count)++;
-        return true;
-    }
-    else if (ret == CC_RET_FAILED)
-    {
-        return false;
-    }
-    else if (ret == CC_RET_SKIPPED)
-    {
-        return true;
-    }
-    else
-    {
-        ASSERT(0);
-    }
-}
-
 typedef enum client_connect_return (*multi_client_connect_handler)
     (struct multi_context *m, struct multi_instance *mi,
-     unsigned int *option_types_found);
+    bool from_deferred, unsigned int *option_types_found);
+
+static const multi_client_connect_handler client_connect_handlers[] = {
+    multi_client_connect_source_ccd,
+    multi_client_connect_call_plugin_v1,
+    multi_client_connect_call_plugin_v2,
+    multi_client_connect_call_script,
+    multi_client_connect_mda,
+    NULL,
+};
 
 /*
  * Called as soon as the SSL/TLS connection is authenticated.
@@ -2280,27 +2288,74 @@  multi_connection_established(struct multi_context *m, struct multi_instance *mi)
         return;
     }
 
-        multi_client_connect_handler handlers[] = {
-            multi_client_connect_source_ccd,
-            multi_client_connect_call_plugin_v1,
-            multi_client_connect_call_plugin_v2,
-            multi_client_connect_call_script,
-            multi_client_connect_mda,
-            NULL
-        };
+    /* We are only called for the CAS_PENDING_x states, so we
+     * can ignore other states here */
+    bool from_deferred = (mi->context.c2.context_auth != CAS_PENDING);
 
-        unsigned int option_types_found = 0;
+    int *cur_handler_index = &mi->client_connect_defer_state.cur_handler_index;
+    unsigned int *option_types_found =
+        &mi->client_connect_defer_state.option_types_found;
 
-    int cc_succeeded = true;     /* client connect script status */
-    int cc_succeeded_count = 0;
-    enum client_connect_return ret;
+    /* We are called for the first time */
+    if (!from_deferred)
+    {
+        *cur_handler_index = 0;
+        *option_types_found = 0;
+        /* Initially we have no handler that has returned a result */
+        mi->context.c2.context_auth = CAS_PENDING_DEFERRED;
 
-    multi_client_connect_early_setup(m, mi);
+        multi_client_connect_early_setup(m, mi);
+    }
 
-    for (int i = 0; cc_succeeded && handlers[i]; i++)
+    bool cc_succeeded = true;
+
+    while (cc_succeeded
+           && client_connect_handlers[*cur_handler_index] != NULL)
     {
-        ret = handlers[i](m, mi, &option_types_found);
-        cc_succeeded = cc_check_return(&cc_succeeded_count, ret);
+        enum client_connect_return ret;
+        ret = client_connect_handlers[*cur_handler_index](m, mi, from_deferred,
+                                                          option_types_found);
+
+        from_deferred = false;
+
+        switch (ret)
+        {
+            case CC_RET_SUCCEEDED:
+                /*
+                 * Remember that we already had at least one handler
+                 * returning a result should go to into deferred state
+                 */
+                mi->context.c2.context_auth = CAS_PENDING_DEFERRED_PARTIAL;
+                break;
+
+            case CC_RET_SKIPPED:
+                /*
+                 * Move on with the next handler without modifying any
+                 * other state
+                 */
+                break;
+
+            case CC_RET_DEFERRED:
+                /*
+                 * we already set client_connect_status to DEFERRED_RESULT or
+                 * DEFERRED_NO_RESULT. We just return
+                 * from the function as having client_connect_status
+                 */
+                return;
+
+            case CC_RET_FAILED:
+                /*
+                 * One handler failed. We abort the chain and set the final
+                 * result to failed
+                 */
+                cc_succeeded = false;
+                break;
+
+            default:
+                ASSERT(0);
+        }
+
+        (*cur_handler_index)++;
     }
 
     /*
@@ -2312,18 +2367,24 @@  multi_connection_established(struct multi_context *m, struct multi_instance *mi)
         msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to "
             "'disable' directive");
         cc_succeeded = false;
-        cc_succeeded_count = 0;
     }
 
     if (cc_succeeded)
     {
-        multi_client_connect_late_setup(m, mi, option_types_found);
+        multi_client_connect_late_setup(m, mi, *option_types_found);
     }
     else
     {
-        /* set context-level authentication flag */
-        mi->context.c2.context_auth =
-            cc_succeeded_count ? CAS_PARTIAL : CAS_FAILED;
+        /* set context-level authentication flag to failed but remember
+         * if had a handler succeed (for cleanup) */
+        if (mi->context.c2.context_auth == CAS_PENDING_DEFERRED_PARTIAL)
+        {
+            mi->context.c2.context_auth = CAS_PARTIAL;
+        }
+        else
+        {
+            mi->context.c2.context_auth = CAS_FAILED;
+        }
     }
 
     /* increment number of current authenticated clients */
@@ -2624,7 +2685,7 @@  multi_process_post(struct multi_context *m, struct multi_instance *mi, const uns
         {
             /* connection is "established" when SSL/TLS key negotiation succeeds
              * and (if specified) auth user/pass succeeds */
-            if (mi->context.c2.context_auth == CAS_PENDING
+            if (is_cas_pending(mi->context.c2.context_auth)
                 && CONNECTION_ESTABLISHED(&mi->context))
             {
                 multi_connection_established(m, mi);
@@ -3579,7 +3640,7 @@  management_client_auth(void *arg,
         {
             if (auth)
             {
-                if (mi->context.c2.context_auth == CAS_PENDING)
+                if (is_cas_pending(mi->context.c2.context_auth))
                 {
                     set_cc_config(mi, cc_config);
                     cc_config_owned = false;
@@ -3591,7 +3652,7 @@  management_client_auth(void *arg,
                 {
                     msg(D_MULTI_LOW, "MULTI: connection rejected: %s, CLI:%s", reason, np(client_reason));
                 }
-                if (mi->context.c2.context_auth != CAS_PENDING)
+                if (!is_cas_pending(mi->context.c2.context_auth))
                 {
                     send_auth_failed(&mi->context, client_reason); /* mid-session reauth failed */
                     multi_schedule_context_wakeup(m, mi);
diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h
index 1d30dcc6..11da0209 100644
--- a/src/openvpn/multi.h
+++ b/src/openvpn/multi.h
@@ -62,6 +62,18 @@  struct deferred_signal_schedule_entry
     struct timeval wakeup;
 };
 
+/**
+ * Detached client connection state.  This is the state that is tracked while
+ * the client connect hooks are executed.
+ */
+struct client_connect_defer_state
+{
+    /* Index of currently executed handler.  */
+    int cur_handler_index;
+    /* Remember which option classes where processed for delayed option
+     * handling. */
+    unsigned int option_types_found;
+};
 
 /**
  * Server-mode state structure for one single VPN tunnel.
@@ -108,7 +120,7 @@  struct multi_instance {
 
     struct context context;     /**< The context structure storing state
                                  *   for this VPN tunnel. */
-
+    struct client_connect_defer_state client_connect_defer_state;
 #ifdef ENABLE_ASYNC_PUSH
     int inotify_watch; /* watch descriptor for acf */
 #endif
@@ -195,6 +207,7 @@  enum client_connect_return
 {
     CC_RET_FAILED,
     CC_RET_SUCCEEDED,
+    CC_RET_DEFERRED,
     CC_RET_SKIPPED
 };
 
diff --git a/src/openvpn/openvpn.h b/src/openvpn/openvpn.h
index 7c469b01..ccc7f118 100644
--- a/src/openvpn/openvpn.h
+++ b/src/openvpn/openvpn.h
@@ -217,6 +217,8 @@  struct context_1
 enum client_connect_status {
     CAS_SUCCEEDED=0,
     CAS_PENDING,
+    CAS_PENDING_DEFERRED,
+    CAS_PENDING_DEFERRED_PARTIAL,   /**< at least handler succeeded, no result yet*/
     CAS_FAILED,
     CAS_PARTIAL,        /**< Variant of CAS_FAILED: at least one
                          * client-connect script/plugin succeeded
@@ -225,6 +227,13 @@  enum client_connect_status {
                          */
 };
 
+static inline bool
+is_cas_pending(enum client_connect_status cas)
+{
+    return cas == CAS_PENDING || cas == CAS_PENDING_DEFERRED
+           || cas == CAS_PENDING_DEFERRED_PARTIAL;
+}
+
 /**
  * Level 2 %context containing state that is reset on both \c SIGHUP and
  * \c SIGUSR1 restarts.