[Openvpn-devel,v4,3/3] plugins: Remove defer/simple.c sample plugin

Message ID 20220313193154.9350-4-openvpn@sf.lists.topphemmelig.net
State Accepted
Headers show
Series
  • Disable multiple deferred authentication
Related show

Commit Message

David Sommerseth March 13, 2022, 7:31 p.m.
From: David Sommerseth <davids@openvpn.net>

The use case for this plug-in is dubious now with the new multi-auth.c
plugin available.  This new plugin is based on simple.c, but allows
far more flexibility for testing.

Signed-off-by: David Sommerseth <davids@openvpn.net>
---
 include/openvpn-plugin.h.in            |   4 +-
 sample/sample-plugins/Makefile.plugins |   1 -
 sample/sample-plugins/README           |   6 +-
 sample/sample-plugins/defer/simple.c   | 393 -------------------------
 sample/sample-plugins/defer/simple.def |   6 -
 5 files changed, 6 insertions(+), 404 deletions(-)
 delete mode 100644 sample/sample-plugins/defer/simple.c
 delete mode 100755 sample/sample-plugins/defer/simple.def

Comments

Antonio Quartulli March 15, 2022, 3:11 p.m. | #1
Hi,

On 13/03/2022 20:31, David Sommerseth wrote:
> From: David Sommerseth <davids@openvpn.net>
> 
> The use case for this plug-in is dubious now with the new multi-auth.c
> plugin available.  This new plugin is based on simple.c, but allows
> far more flexibility for testing.
> 
> Signed-off-by: David Sommerseth <davids@openvpn.net>

Same as the patch for master.

Acked-by: Antonio Quartulli <a@unstable.cc>
Gert Doering March 15, 2022, 3:48 p.m. | #2
This one does not need much brains to review - "does it apply" and
"does it break 'make distcheck'" (yes, and no).

The reason why this plugin is deleted is because the new multi-auth
plugin does mostly the same thing, "but more" - and it's 90% the same
code, so not much to be learned from the older one anymore.

For 2.5 and 2.4 branches, after some discussion on IRC, it makes sense
to leave defer/simple alone - it still has "PF" support, which 
defer/auth-multi does not have (and does not need).  So, unlike 
master, there is something to be learned from having both plugins,
and someone might even make use of the "simple" feature set...

Your patch has been applied to the master branch.

commit d816207bc2fe1ee5a04c394b215d50123cb25aad (master)
Author: David Sommerseth
Date:   Sun Mar 13 20:31:54 2022 +0100

     plugins: Remove defer/simple.c sample plugin

     Signed-off-by: David Sommerseth <davids@openvpn.net>
     Acked-by: Antonio Quartulli <antonio@openvpn.net>
     Message-Id: <20220313193154.9350-4-openvpn@sf.lists.topphemmelig.net>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23933.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering

Patch

diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in
index 087010a4..dc7c5306 100644
--- a/include/openvpn-plugin.h.in
+++ b/include/openvpn-plugin.h.in
@@ -584,8 +584,8 @@  OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t OPENVPN_PLUGIN_FUNC(openvpn_plugin_op
  *
  * OpenVPN will delete the auth_control_file after it goes out of scope.
  *
- * See plugin/defer/simple.c for an example on using asynchronous
- * authentication.
+ * See sample/sample-plugins/defer/multi-auth.c for an example on using
+ * asynchronous authentication.
  */
 OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v2)
     (openvpn_plugin_handle_t handle,
diff --git a/sample/sample-plugins/Makefile.plugins b/sample/sample-plugins/Makefile.plugins
index 8bfbad09..917b02b6 100644
--- a/sample/sample-plugins/Makefile.plugins
+++ b/sample/sample-plugins/Makefile.plugins
@@ -7,7 +7,6 @@ 
 # Plug-ins to build - listed entries should not carry any extensions
 #
 PLUGINS = \
-	defer/simple \
 	defer/multi-auth \
 	keying-material-exporter-demo/keyingmaterialexporter \
 	log/log log/log_v3 \
diff --git a/sample/sample-plugins/README b/sample/sample-plugins/README
index cf1b355e..356f603d 100644
--- a/sample/sample-plugins/README
+++ b/sample/sample-plugins/README
@@ -5,8 +5,10 @@  Examples provided:
 * authentication and logging
 simple/simple.c -- using the --auth-user-pass-verify callback, verify
                    that the username/password is "foo"/"bar".
-defer/simple.c  -- using the --auth-user-pass-verify callback,
-                   test deferred authentication.
+defer/multi-auth.c
+                -- using the --auth-user-pass-verify callback,
+                   test deferred authentication. Can be used to test multiple
+                   authentication plugins in the same server config.
 log/log.c       -- Extended variant of simple/simple.c which adds more
                    logging of what is happening inside the plug-in
 log/log_v3.c    -- A variant of log/log.c, which makes use of the
diff --git a/sample/sample-plugins/defer/simple.c b/sample/sample-plugins/defer/simple.c
deleted file mode 100644
index d2f614a5..00000000
--- a/sample/sample-plugins/defer/simple.c
+++ /dev/null
@@ -1,393 +0,0 @@ 
-/*
- *  OpenVPN -- An application to securely tunnel IP networks
- *             over a single TCP/UDP port, with support for SSL/TLS-based
- *             session authentication and key exchange,
- *             packet encryption, packet authentication, and
- *             packet compression.
- *
- *  Copyright (C) 2002-2022 OpenVPN Inc <sales@openvpn.net>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2
- *  as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-/*
- * This file implements a simple OpenVPN plugin module which
- * will test deferred authentication and packet filtering.
- *
- * Will run on Windows or *nix.
- *
- * Sample usage:
- *
- * setenv test_deferred_auth 20
- * setenv test_packet_filter 10
- * plugin plugin/defer/simple.so
- *
- * This will enable deferred authentication to occur 20
- * seconds after the normal TLS authentication process,
- * and will cause a packet filter file to be generated 10
- * seconds after the initial TLS negotiation, using
- * {common-name}.pf as the source.
- *
- * Sample packet filter configuration:
- *
- * [CLIENTS DROP]
- * +otherclient
- * [SUBNETS DROP]
- * +10.0.0.0/8
- * -10.10.0.8
- * [END]
- *
- * See the README file for build instructions.
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdbool.h>
-#include <fcntl.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#include "openvpn-plugin.h"
-
-/* Pointers to functions exported from openvpn */
-static plugin_log_t plugin_log = NULL;
-
-/*
- * Constants indicating minimum API and struct versions by the functions
- * in this plugin.  Consult openvpn-plugin.h, look for:
- * OPENVPN_PLUGIN_VERSION and OPENVPN_PLUGINv3_STRUCTVER
- *
- * Strictly speaking, this sample code only requires plugin_log, a feature
- * of structver version 1.  However, '1' lines up with ancient versions
- * of openvpn that are past end-of-support.  As such, we are requiring
- * structver '5' here to indicate a desire for modern openvpn, rather
- * than a need for any particular feature found in structver beyond '1'.
- */
-#define OPENVPN_PLUGIN_VERSION_MIN 3
-#define OPENVPN_PLUGIN_STRUCTVER_MIN 5
-
-/*
- * Our context, where we keep our state.
- */
-
-struct plugin_context {
-    int test_deferred_auth;
-    int test_packet_filter;
-};
-
-struct plugin_per_client_context {
-    int n_calls;
-    bool generated_pf_file;
-};
-
-/* module name for plugin_log() */
-static char *MODULE = "defer/simple";
-
-/*
- * Given an environmental variable name, search
- * the envp array for its value, returning it
- * if found or NULL otherwise.
- */
-static const char *
-get_env(const char *name, const char *envp[])
-{
-    if (envp)
-    {
-        int i;
-        const int namelen = strlen(name);
-        for (i = 0; envp[i]; ++i)
-        {
-            if (!strncmp(envp[i], name, namelen))
-            {
-                const char *cp = envp[i] + namelen;
-                if (*cp == '=')
-                {
-                    return cp + 1;
-                }
-            }
-        }
-    }
-    return NULL;
-}
-
-/* used for safe printf of possible NULL strings */
-static const char *
-np(const char *str)
-{
-    if (str)
-    {
-        return str;
-    }
-    else
-    {
-        return "[NULL]";
-    }
-}
-
-static int
-atoi_null0(const char *str)
-{
-    if (str)
-    {
-        return atoi(str);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-/* Require a minimum OpenVPN Plugin API */
-OPENVPN_EXPORT int
-openvpn_plugin_min_version_required_v1()
-{
-    return OPENVPN_PLUGIN_VERSION_MIN;
-}
-
-/* use v3 functions so we can use openvpn's logging and base64 etc. */
-OPENVPN_EXPORT int
-openvpn_plugin_open_v3(const int v3structver,
-                       struct openvpn_plugin_args_open_in const *args,
-                       struct openvpn_plugin_args_open_return *ret)
-{
-    const char **envp = args->envp;       /* environment variables */
-    struct plugin_context *context;
-
-    if (v3structver < OPENVPN_PLUGIN_STRUCTVER_MIN)
-    {
-        fprintf(stderr, "%s: this plugin is incompatible with the running version of OpenVPN\n", MODULE);
-        return OPENVPN_PLUGIN_FUNC_ERROR;
-    }
-
-    /* Save global pointers to functions exported from openvpn */
-    plugin_log = args->callbacks->plugin_log;
-
-    plugin_log(PLOG_NOTE, MODULE, "FUNC: openvpn_plugin_open_v3");
-
-    /*
-     * Allocate our context
-     */
-    context = (struct plugin_context *) calloc(1, sizeof(struct plugin_context));
-    if (!context)
-    {
-        goto error;
-    }
-
-    context->test_deferred_auth = atoi_null0(get_env("test_deferred_auth", envp));
-    plugin_log(PLOG_NOTE, MODULE, "TEST_DEFERRED_AUTH %d", context->test_deferred_auth);
-
-    context->test_packet_filter = atoi_null0(get_env("test_packet_filter", envp));
-    plugin_log(PLOG_NOTE, MODULE, "TEST_PACKET_FILTER %d", context->test_packet_filter);
-
-    /*
-     * Which callbacks to intercept.
-     */
-    ret->type_mask =
-        OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_UP)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_DOWN)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_ROUTE_UP)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_IPCHANGE)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_TLS_VERIFY)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_CLIENT_CONNECT_V2)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_CLIENT_DISCONNECT)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_LEARN_ADDRESS)
-        |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_TLS_FINAL);
-
-    ret->handle = (openvpn_plugin_handle_t *) context;
-    plugin_log(PLOG_NOTE, MODULE, "initialization succeeded");
-    return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-error:
-    if (context)
-    {
-        free(context);
-    }
-    plugin_log(PLOG_NOTE, MODULE, "initialization failed");
-    return OPENVPN_PLUGIN_FUNC_ERROR;
-}
-
-static int
-auth_user_pass_verify(struct plugin_context *context,
-                      struct plugin_per_client_context *pcc,
-                      const char *argv[], const char *envp[])
-{
-    if (!context->test_deferred_auth)
-    {
-        return OPENVPN_PLUGIN_FUNC_SUCCESS;
-    }
-
-    /* get username/password from envp string array */
-    const char *username = get_env("username", envp);
-    const char *password = get_env("password", envp);
-
-    /* get auth_control_file filename from envp string array*/
-    const char *auth_control_file = get_env("auth_control_file", envp);
-
-    plugin_log(PLOG_NOTE, MODULE, "DEFER u='%s' p='%s' acf='%s'",
-               np(username),
-               np(password),
-               np(auth_control_file));
-
-    /* Authenticate asynchronously in n seconds */
-    if (!auth_control_file)
-    {
-        return OPENVPN_PLUGIN_FUNC_ERROR;
-    }
-
-    /* we do not want to complicate our lives with having to wait()
-     * for child processes (so they are not zombiefied) *and* we MUST NOT
-     * fiddle with signal handlers (= shared with openvpn main), so
-     * we use double-fork() trick.
-     */
-
-    /* fork, sleep, succeed (no "real" auth done = always succeed) */
-    pid_t p1 = fork();
-    if (p1 < 0)                 /* Fork failed */
-    {
-        return OPENVPN_PLUGIN_FUNC_ERROR;
-    }
-    if (p1 > 0)                 /* parent process */
-    {
-        waitpid(p1, NULL, 0);
-        return OPENVPN_PLUGIN_FUNC_DEFERRED;
-    }
-
-    /* first gen child process, fork() again and exit() right away */
-    pid_t p2 = fork();
-    if (p2 < 0)
-    {
-        plugin_log(PLOG_ERR|PLOG_ERRNO, MODULE, "BACKGROUND: fork(2) failed");
-        exit(1);
-    }
-
-    if (p2 != 0)                            /* new parent: exit right away */
-    {
-        exit(0);
-    }
-
-    /* (grand-)child process
-     *  - never call "return" now (would mess up openvpn)
-     *  - return status is communicated by file
-     *  - then exit()
-     */
-
-    /* do mighty complicated work that will really take time here... */
-    plugin_log(PLOG_NOTE, MODULE, "in async/deferred handler, sleep(%d)", context->test_deferred_auth);
-    sleep(context->test_deferred_auth);
-
-    /* now signal success state to openvpn */
-    int fd = open(auth_control_file, O_WRONLY);
-    if (fd < 0)
-    {
-        plugin_log(PLOG_ERR|PLOG_ERRNO, MODULE, "open('%s') failed", auth_control_file);
-        exit(1);
-    }
-
-    plugin_log(PLOG_NOTE, MODULE, "auth_user_pass_verify: done" );
-
-    if (write(fd, "1", 1) != 1)
-    {
-        plugin_log(PLOG_ERR|PLOG_ERRNO, MODULE, "write to '%s' failed", auth_control_file );
-    }
-    close(fd);
-
-    exit(0);
-}
-
-OPENVPN_EXPORT int
-openvpn_plugin_func_v3(const int v3structver,
-                       struct openvpn_plugin_args_func_in const *args,
-                       struct openvpn_plugin_args_func_return *ret)
-{
-    if (v3structver < OPENVPN_PLUGIN_STRUCTVER_MIN)
-    {
-        fprintf(stderr, "%s: this plugin is incompatible with the running version of OpenVPN\n", MODULE);
-        return OPENVPN_PLUGIN_FUNC_ERROR;
-    }
-    const char **argv = args->argv;
-    const char **envp = args->envp;
-    struct plugin_context *context = (struct plugin_context *) args->handle;
-    struct plugin_per_client_context *pcc = (struct plugin_per_client_context *) args->per_client_context;
-    switch (args->type)
-    {
-        case OPENVPN_PLUGIN_UP:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_UP");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        case OPENVPN_PLUGIN_DOWN:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_DOWN");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        case OPENVPN_PLUGIN_ROUTE_UP:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_ROUTE_UP");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        case OPENVPN_PLUGIN_IPCHANGE:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_IPCHANGE");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        case OPENVPN_PLUGIN_TLS_VERIFY:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_TLS_VERIFY");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        case OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY");
-            return auth_user_pass_verify(context, pcc, argv, envp);
-
-        case OPENVPN_PLUGIN_CLIENT_CONNECT_V2:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_CLIENT_CONNECT_V2");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        case OPENVPN_PLUGIN_CLIENT_DISCONNECT:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_CLIENT_DISCONNECT");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        case OPENVPN_PLUGIN_LEARN_ADDRESS:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_LEARN_ADDRESS");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        case OPENVPN_PLUGIN_TLS_FINAL:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_TLS_FINAL");
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
-
-        default:
-            plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_?");
-            return OPENVPN_PLUGIN_FUNC_ERROR;
-    }
-}
-
-OPENVPN_EXPORT void *
-openvpn_plugin_client_constructor_v1(openvpn_plugin_handle_t handle)
-{
-    plugin_log(PLOG_NOTE, MODULE, "FUNC: openvpn_plugin_client_constructor_v1");
-    return calloc(1, sizeof(struct plugin_per_client_context));
-}
-
-OPENVPN_EXPORT void
-openvpn_plugin_client_destructor_v1(openvpn_plugin_handle_t handle, void *per_client_context)
-{
-    plugin_log(PLOG_NOTE, MODULE, "FUNC: openvpn_plugin_client_destructor_v1");
-    free(per_client_context);
-}
-
-OPENVPN_EXPORT void
-openvpn_plugin_close_v1(openvpn_plugin_handle_t handle)
-{
-    struct plugin_context *context = (struct plugin_context *) handle;
-    plugin_log(PLOG_NOTE, MODULE, "FUNC: openvpn_plugin_close_v1");
-    free(context);
-}
diff --git a/sample/sample-plugins/defer/simple.def b/sample/sample-plugins/defer/simple.def
deleted file mode 100755
index a87507d1..00000000
--- a/sample/sample-plugins/defer/simple.def
+++ /dev/null
@@ -1,6 +0,0 @@ 
-LIBRARY   OpenVPN_PLUGIN_SAMPLE
-DESCRIPTION "Sample OpenVPN plug-in module."
-EXPORTS
-   openvpn_plugin_open_v1   @1
-   openvpn_plugin_func_v1   @2
-   openvpn_plugin_close_v1  @3