diff mbox series

[Openvpn-devel,v4] Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts

Message ID 20261030213936.1001-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v4] Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts |

Commit Message

Gert Doering Oct. 30, 2026, 9:39 p.m. UTC 
  From: Selva Nair <selva.nair@gmail.com>

When username is included in the config file as inlined or
read from a file, indicate it as a preferred-username in
>PASSWORD Need '<UP_TYPE>' username/password prompts where
'<UP_TYPE>' could be 'Auth', 'HTTP Proxy' or 'SOCKS Proxy'.
The prompt is appended with "UN:<user64>" where <user64> is
the pre-defined username, base64 encoded.

This is treated as a hint, not an enforced value. The management
client still responds with both username and password obtained
from the user. Whether the management client allows the
user to input a different username is left to the client
implementation.

The documentation in management-notes is slightly edited to add
that 'Auth', 'HTTP Proxy', 'SOCKS Proxy' are possible types of
username/password prompts.

Only clients that announce version >=6 are prompted this way.

This helps to fix user reports on OpenVPN-GUI not respecting username
set in the config file.

Change-Id: Iac23d5141a8c29e239d0f2aeea497d3a002e609b
Signed-off-by: Selva Nair <selva.nair@gmail.com>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2069
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2069
This mail reflects revision 4 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/doc/management-notes.txt b/doc/management-notes.txt
index eac91a4..b9b367f 100644
--- a/doc/management-notes.txt
+++ b/doc/management-notes.txt
@@ -304,6 +304,9 @@ 
     username "Auth" foo
     password "Auth" bar
 
+  The same format is used for HTTP and SOCKS proxy username and password
+  with 'Auth' replaced by 'HTTP Proxy' and 'SOCKS Proxy' respectively.
+
   Example 3:
 
     >PASSWORD:Need 'Auth' username
@@ -394,6 +397,31 @@ 
   response along with the username and password formatted as described
   in the Challenge/Response Protocol section below
 
+  Example 10:
+
+    >PASSWORD:Need '<UP_TYPE>' username/password UN:<user-base64>
+    >PASSWORD:Need 'Auth' username/password UN:<user-base64> SC:1,Please enter token PIN
+
+  where <UP_TYPE> is any supported type that requires username and password.
+  (see Example 2).
+
+  These work exactly as Examples 2 and 8, respectively, with the following
+  difference. The prompt has an additional word "UN:<user-base64>" where
+  <user-base64> is the base64 encoded form of a pre-defined username. This
+  may be a username inlined in the config file or read from an external
+  user-pass file.
+
+  The management client is expected to show the base64 decoded value to
+  the user. Whether the user can change this username or not is left to
+  the client implementation.
+
+  The response from the management client should follow the same format
+  as in example 2 or example 8, as applicable.
+
+  This prompt is shown only if the management-client announces a
+  version >= 6. Older clients will see the prompt shown in Example 2
+  or 8.
+
 See the "Challenge/Response Protocol" section below for more details
 about examples 8 and 9, including how the management interface client
 should respond.
@@ -530,6 +558,7 @@ 
     >PK_SIGN:[base64],[alg]     -- version 3 or greater
     >PASSWORD:Need 'Auth' username -- version 4 or greater
     multiline password from client -- version 5 or greater
+    preferred username in >PASSWORD prompt -- version 6 or greater
 
 COMMAND -- auth-retry
 ---------------------
@@ -1454,6 +1483,12 @@ 
 used, the management interface will send:
 
   >PASSWORD:Need 'Auth' username/password SC:<flag>,<TEXT>
+  or
+  >PASSWORD:Need 'Auth' username/password UN:<user64> SC:<flag>,<TEXT>
+
+  The second form is used only if the client version is >=6, and a
+  preferred username is available. See also Example 10 in the section
+  titled "COMMAND -- password and username"
 
   flag: an integer whose least significant bit is the ECHO flag and
         the next significant bit is the FORMAT flag.
@@ -1463,6 +1498,7 @@ 
         as described below. Thus flag could take values 0, 1, 2, or 3.
   TEXT: challenge text that should be shown to the user to
       facilitate their response
+  user64: Preferred username, if available, base64 encoded.
 
 For example:
 
diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index 0fc9ee2..65e2881 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -71,6 +71,7 @@ 
     MCV_PKSIGN_ALG = 3,
     MCV_USERNAME_ONLY = 4,
     MCV_MULTILINE_PASSWORD = 5,
+    MCV_PREFERRED_USERNAME = 6,
 };
 
 struct management *management; /* GLOBAL */
@@ -3670,6 +3671,26 @@ 
             buf_printf(&alert_msg, " MSG:%s", up->username);
         }
 
+        if (up_query_mode == UP_QUERY_USER_PASS
+            && (man->connection.client_version >= MCV_PREFERRED_USERNAME)
+            && up->username[0])
+        {
+            /*
+             * The buffer up is prefilled with username from auth-file or inline.
+             * Indicate it in the prompt as base64 encoded.
+             */
+            char *user64 = NULL;
+            if (openvpn_base64_encode(up->username, (int)strlen(up->username), &user64) != -1)
+            {
+                buf_printf(&alert_msg, " UN:%s", user64);
+            }
+            else
+            {
+                msg(M_NONFATAL, "ERROR: could not base64-encode username");
+            }
+            free(user64);
+        }
+
         if (sc)
         {
             buf_printf(&alert_msg, " SC:%d,%s",