From patchwork Sun Mar 13 08:31:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Sommerseth X-Patchwork-Id: 2333 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director15.mail.ord1d.rsapps.net ([172.31.255.6]) by backend41.mail.ord1d.rsapps.net with LMTP id qG2wDEFHLmLkDwAAqwncew (envelope-from ) for ; Sun, 13 Mar 2022 15:34:25 -0400 Received: from proxy8.mail.iad3b.rsapps.net ([172.31.255.6]) by director15.mail.ord1d.rsapps.net with LMTP id SC+ZEkFHLmITYQAAIcMcQg (envelope-from ) for ; Sun, 13 Mar 2022 15:34:25 -0400 Received: from smtp25.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy8.mail.iad3b.rsapps.net with LMTPS id YBWdC0FHLmLRFQAAoCsc3g (envelope-from ) for ; Sun, 13 Mar 2022 15:34:25 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp25.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dkim=fail (signature verification failed) header.d=sf.lists.topphemmelig.net; dmarc=fail (p=none; dis=none) header.from=sf.lists.topphemmelig.net X-Suspicious-Flag: YES X-Classification-ID: 9668e17a-a304-11ec-be4f-52540030a522-1-1 Received: from [216.105.38.7] ([216.105.38.7:38906] helo=lists.sourceforge.net) by smtp25.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id BA/E1-17465-0474E226; Sun, 13 Mar 2022 15:34:24 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1nTTxx-000361-6W; Sun, 13 Mar 2022 19:33:20 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nTTxu-00035u-Me for openvpn-devel@lists.sourceforge.net; Sun, 13 Mar 2022 19:33:17 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=CNr5z0I4wrBbNL4EAk3leg8GTP8DLoXhHJdrsvdr5+0=; b=ZpSrHQE+cvkpInhe69dzVpo4mU gPUdlPKeSd2GDeVMpAT44HIQV05uJvjQ3eLqInzHJD0CX2HjYUm95tFGvZ3BooUTiUTjzFng2qUIA tocr4jwPe3TcdXzBTK2/6kEc3Z8cXUdlYcRPJAI7RWVP63d6xhqHPDbwvJ50qpO7HIls=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=CNr5z0I4wrBbNL4EAk3leg8GTP8DLoXhHJdrsvdr5+0=; b=bAxGjT9Q6RWWZfXzBxEgaLS/BH XJJWKmILttEZcBznVt5+Ta1je0k4KytrpPKhO/wsYw+r/eeoMWoFYkY08XHhVwA4YBkuc/ZNsCuFe Zs7+al2ZieQZ4TDwIupETCFM4R/JLvSE7uhwKqMPzTrNgCTkQg2QiB7Q4nCD/SiMw/xQ=; Received: from mx1.basenordic.cloud ([217.170.196.134]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1nTTxr-00EZMU-FC for openvpn-devel@lists.sourceforge.net; Sun, 13 Mar 2022 19:33:17 +0000 Received: from localhost (unknown [127.0.0.1]) by mx1.basenordic.cloud (Postfix) with ESMTP id D39D7E716 for ; Sun, 13 Mar 2022 19:33:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sf.lists.topphemmelig.net; s=inouz9eefah2too5; t=1647199983; bh=CNr5z0I4wrBbNL4EAk3leg8GTP8DLoXhHJdrsvdr5+0=; h=From:To:Subject:Date:In-Reply-To:References:From; b=oxFloW0K/QC/ZdC6ErKYmctO1pzas50p8zgeQJTVNuxg0Du/ONyPlmAp/v4HpIuKg yTgLULqzaJa1WRQr84Ivzz6xEgnEvv5JN34NXSe3x2vPGjt/Ri/zZ18Z/11lcfS4Un z9RQaS4WLLaA8mjteLaJQ8lNNdjbH33MyemjJ7ban5NVt1T1EKTbMu/WyXPXyAButF YvsLWqOWRnAj/jKvKl+jOmgo83Lgl1y8GYRR7Fl77Oi717YhomKu4pzqwy3Um8AUtG LklBqs377c/rjX2Rw0s41AP3ZwtuXDW73QnitJgFBxoEwtAbunxtS0Zn1TFqGEUwXp 9qhVCiSM0ABdQ== Received: from mx1.basenordic.cloud ([127.0.0.1]) by localhost (mx1.basenordic.cloud [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ZMbqaT37JgP for ; Sun, 13 Mar 2022 20:33:02 +0100 (CET) Received: from xplorer.net (xplorer.sommerseth.xyz [10.35.7.11]) by mx1.basenordic.cloud (Postfix) with ESMTP id 5D25DE713 for ; Sun, 13 Mar 2022 20:33:02 +0100 (CET) From: David Sommerseth To: openvpn-devel@lists.sourceforge.net Date: Sun, 13 Mar 2022 20:31:52 +0100 Message-Id: <20220313193154.9350-2-openvpn@sf.lists.topphemmelig.net> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20220313193154.9350-1-openvpn@sf.lists.topphemmelig.net> References: <20220313193154.9350-1-openvpn@sf.lists.topphemmelig.net> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: David Sommerseth This plugin allows setting username/passwords as well as configure deferred authentication behaviour as part of the runtime initialization. With this plug-in it is easier to test various scenarios where multiple authentication plug-ins are active on the server side. Content analysis details: (-2.4 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [217.170.196.134 listed in list.dnswl.org] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1nTTxr-00EZMU-FC Subject: [Openvpn-devel] [PATCH v4 1/3] sample-plugin: New plugin for testing multiple auth plugins X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: David Sommerseth This plugin allows setting username/passwords as well as configure deferred authentication behaviour as part of the runtime initialization. With this plug-in it is easier to test various scenarios where multiple authentication plug-ins are active on the server side. A test documentation was also added to describe various test cases and the expected results. Signed-off-by: David Sommerseth Acked-by: Antonio Quartulli --- v2 - Flipped NULL==var to var==NULL --- doc/tests/authentication-plugins.md | 153 +++++++++ sample/sample-plugins/Makefile.plugins | 1 + sample/sample-plugins/defer/multi-auth.c | 413 +++++++++++++++++++++++ 3 files changed, 567 insertions(+) create mode 100644 doc/tests/authentication-plugins.md create mode 100644 sample/sample-plugins/defer/multi-auth.c diff --git a/doc/tests/authentication-plugins.md b/doc/tests/authentication-plugins.md new file mode 100644 index 00000000..1f5fb851 --- /dev/null +++ b/doc/tests/authentication-plugins.md @@ -0,0 +1,153 @@ +# TESTING OF MULTIPLE AUTHENTICATION PLUG-INS + + +OpenVPN 2.x can support loading and authenticating users through multiple +plug-ins at the same time. But it can only support a single plug-in doing +deferred authentication. However, a plug-in supporting deferred +authentication may be accompanied by other authentication plug-ins **not** +doing deferred authentication. + +This is a test script useful to test the various combinations and order of +plug-in execution. + +The configuration files are expected to be used from the root of the build +directory. + +To build the needed authentication plug-in, run: + + make -C sample/sample-plugins + + +## Test configs + +* Client config + + verb 4 + dev tun + client + remote x.x.x.x + ca sample/sample-keys/ca.crt + cert sample/sample-keys/client.crt + key sample/sample-keys/client.key + auth-user-pass + +* Base server config (`base-server.conf`) + + verb 4 + dev tun + server 10.8.0.0 255.255.255.0 + dh sample/sample-keys/dh2048.pem + ca sample/sample-keys/ca.crt + cert sample/sample-keys/server.crt + key sample/sample-keys/server.key + + +## Test cases + +### Test: *sanity-1* + +This tests the basic authentication with an instant answer. + + config base-server.conf + plugin multi-auth.so S1.1 0 foo bar + +#### Expected results + - Username/password `foo`/`bar`: **PASS** + - Anything else: **FAIL** + + +### Test: *sanity-2* + +This is similar to `sanity-1`, but does the authentication +through two plug-ins providing an instant reply. + + config base-server.conf + plugin multi-auth.so S2.1 0 foo bar + plugin multi-auth.so S2.2 0 foo bar + +#### Expected results + - Username/password `foo`/`bar`: **PASS** + - Anything else: **FAIL** + + +### Test: *sanity-3* + +This is also similar to `sanity-1`, but uses deferred authentication +with a 1 second delay on the response. + + plugin multi-auth.so S3.1 1000 foo bar + +#### Expected results + - Username/password `foo`/`bar`: **PASS** + - Anything else: **FAIL** + + +### Test: *case-a* + +Runs two authentications, the first one deferred by 1 second and the +second one providing an instant response. + + plugin multi-auth.so A.1 1000 foo bar + plugin multi-auth.so A.2 0 foo bar + +#### Expected results + - Username/password `foo`/`bar`: **PASS** + - Anything else: **FAIL** + + +### Test: *case-b* + +This is similar to `case-a`, but the instant authentication response +is provided first before the deferred authentication. + + plugin multi-auth.so B.1 0 foo bar + plugin multi-auth.so B.2 1000 test pass + +#### Expected results + - **Always FAIL** + - This test should never pass, as each plug-in expects different + usernames and passwords. + + +### Test: *case-c* + +This is similar to the two prior tests, but the authentication result +is returned instantly in both steps. + + plugin multi-auth.so C.1 0 foo bar + plugin multi-auth.so C.2 0 foo2 bar2 + +#### Expected results + - **Always FAIL** + - This test should never pass, as each plug-in expects different + usernames and passwords. + + +### Test: *case-d* + +This is similar to the `case-b` test, but the order of deferred +and instant response is reversed. + + plugin ./multi-auth.so D.1 2000 test pass + plugin ./multi-auth.so D.2 0 foo bar + +#### Expected results + - **Always FAIL** + - This test should never pass, as each plug-in expects different + usernames and passwords. + + +### Test: *case-e* + +This test case will run two deferred authentication plug-ins. This is +**not** supported by OpenVPN, and should therefore fail instantly. + + plugin ./multi-auth.so E1 1000 test1 pass1 + plugin ./multi-auth.so E2 2000 test2 pass2 + +#### Expected results + - The OpenVPN server process should stop running + - An error about multiple deferred plug-ins being configured + should be seen in the server log. + + diff --git a/sample/sample-plugins/Makefile.plugins b/sample/sample-plugins/Makefile.plugins index 73ce5916..8bfbad09 100644 --- a/sample/sample-plugins/Makefile.plugins +++ b/sample/sample-plugins/Makefile.plugins @@ -8,6 +8,7 @@ # PLUGINS = \ defer/simple \ + defer/multi-auth \ keying-material-exporter-demo/keyingmaterialexporter \ log/log log/log_v3 \ simple/base64 \ diff --git a/sample/sample-plugins/defer/multi-auth.c b/sample/sample-plugins/defer/multi-auth.c new file mode 100644 index 00000000..20c9dac5 --- /dev/null +++ b/sample/sample-plugins/defer/multi-auth.c @@ -0,0 +1,413 @@ +/* + * OpenVPN -- An application to securely tunnel IP networks + * over a single TCP/UDP port, with support for SSL/TLS-based + * session authentication and key exchange, + * packet encryption, packet authentication, and + * packet compression. + * + * Copyright (C) 2002-2021 OpenVPN Inc + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +/* + * This file implements a simple OpenVPN plugin module which + * can do either an instant authentication or a deferred auth. + * The purpose of this plug-in is to test multiple auth plugins + * in the same configuration file + * + * Plugin arguments: + * + * multi-auth.so LOG_ID DEFER_TIME USERNAME PASSWORD + * + * LOG_ID is just an ID string used to separate auth results in the log + * DEFER_TIME is the time to defer the auth. Set to 0 to return immediately + * USERNAME is the username for a valid authentication + * PASSWORD is the password for a valid authentication + * + * The DEFER_TIME time unit is in ms. + * + * Sample usage: + * + * plugin multi-auth.so MA_1 0 foo bar # Instant reply user:foo pass:bar + * plugin multi-auth.so MA_2 5000 fux bax # Defer 5 sec, user:fux pass: bax + * + */ +#include "config.h" +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "openvpn-plugin.h" + +static char *MODULE = "multi-auth"; + +/* + * Our context, where we keep our state. + */ + +struct plugin_context { + int test_deferred_auth; + char *authid; + char *test_valid_user; + char *test_valid_pass; +}; + +/* local wrapping of the log function, to add more details */ +static plugin_vlog_t _plugin_vlog_func = NULL; +static void plog(const struct plugin_context *ctx, int flags, char *fmt, ...) +{ + char logid[129]; + + if (ctx && ctx->authid) + { + snprintf(logid, 128, "%s[%s]", MODULE, ctx->authid); + } + else + { + snprintf(logid, 128, "%s", MODULE); + } + + va_list arglist; + va_start(arglist, fmt); + _plugin_vlog_func(flags, logid, fmt, arglist); + va_end(arglist); +} + + +/* + * Constants indicating minimum API and struct versions by the functions + * in this plugin. Consult openvpn-plugin.h, look for: + * OPENVPN_PLUGIN_VERSION and OPENVPN_PLUGINv3_STRUCTVER + * + * Strictly speaking, this sample code only requires plugin_log, a feature + * of structver version 1. However, '1' lines up with ancient versions + * of openvpn that are past end-of-support. As such, we are requiring + * structver '5' here to indicate a desire for modern openvpn, rather + * than a need for any particular feature found in structver beyond '1'. + */ +#define OPENVPN_PLUGIN_VERSION_MIN 3 +#define OPENVPN_PLUGIN_STRUCTVER_MIN 5 + + +struct plugin_per_client_context { + int n_calls; + bool generated_pf_file; +}; + + +/* + * Given an environmental variable name, search + * the envp array for its value, returning it + * if found or NULL otherwise. + */ +static const char * +get_env(const char *name, const char *envp[]) +{ + if (envp) + { + int i; + const int namelen = strlen(name); + for (i = 0; envp[i]; ++i) + { + if (!strncmp(envp[i], name, namelen)) + { + const char *cp = envp[i] + namelen; + if (*cp == '=') + { + return cp + 1; + } + } + } + } + return NULL; +} + +/* used for safe printf of possible NULL strings */ +static const char * +np(const char *str) +{ + if (str) + { + return str; + } + else + { + return "[NULL]"; + } +} + +static int +atoi_null0(const char *str) +{ + if (str) + { + return atoi(str); + } + else + { + return 0; + } +} + +/* Require a minimum OpenVPN Plugin API */ +OPENVPN_EXPORT int +openvpn_plugin_min_version_required_v1() +{ + return OPENVPN_PLUGIN_VERSION_MIN; +} + +/* use v3 functions so we can use openvpn's logging and base64 etc. */ +OPENVPN_EXPORT int +openvpn_plugin_open_v3(const int v3structver, + struct openvpn_plugin_args_open_in const *args, + struct openvpn_plugin_args_open_return *ret) +{ + if (v3structver < OPENVPN_PLUGIN_STRUCTVER_MIN) + { + fprintf(stderr, "%s: this plugin is incompatible with the running version of OpenVPN\n", MODULE); + return OPENVPN_PLUGIN_FUNC_ERROR; + } + + /* Save global pointers to functions exported from openvpn */ + _plugin_vlog_func = args->callbacks->plugin_vlog; + + plog(NULL, PLOG_NOTE, "FUNC: openvpn_plugin_open_v3"); + + /* + * Allocate our context + */ + struct plugin_context *context = NULL; + context = (struct plugin_context *) calloc(1, sizeof(struct plugin_context)); + if (!context) + { + goto error; + } + + /* simple module argument parsing */ + if ((args->argv[4]) && !args->argv[5]) + { + context->authid = strdup(args->argv[1]); + context->test_deferred_auth = atoi_null0(args->argv[2]); + context->test_valid_user = strdup(args->argv[3]); + context->test_valid_pass = strdup(args->argv[4]); + } + else + { + plog(context, PLOG_ERR, "Too many arguments provided"); + goto error; + } + + if (context->test_deferred_auth > 0) + { + plog(context, PLOG_NOTE, "TEST_DEFERRED_AUTH %d", context->test_deferred_auth); + } + + /* + * Which callbacks to intercept. + */ + ret->type_mask = OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY); + ret->handle = (openvpn_plugin_handle_t *) context; + + plog(context, PLOG_NOTE, "initialization succeeded"); + return OPENVPN_PLUGIN_FUNC_SUCCESS; + +error: + plog(context, PLOG_NOTE, "initialization failed"); + if (context) + { + free(context); + } + return OPENVPN_PLUGIN_FUNC_ERROR; +} + +static bool +do_auth_user_pass(struct plugin_context *context, + const char *username, const char *password) +{ + plog(context, PLOG_NOTE, + "expect_user=%s, received_user=%s, expect_passw=%s, received_passw=%s", + np(context->test_valid_user), + np(username), + np(context->test_valid_pass), + np(password)); + + if (context->test_valid_user && context->test_valid_pass) + { + if ((strcmp(context->test_valid_user, username) != 0) + || (strcmp(context->test_valid_pass, password) != 0)) + { + plog(context, PLOG_ERR, + "User/Password auth result: FAIL"); + return false; + } + else + { + plog(context, PLOG_NOTE, + "User/Password auth result: PASS"); + return true; + } + } + return false; +} + + +static int +auth_user_pass_verify(struct plugin_context *context, + struct plugin_per_client_context *pcc, + const char *argv[], const char *envp[]) +{ + /* get username/password from envp string array */ + const char *username = get_env("username", envp); + const char *password = get_env("password", envp); + + if (!context->test_deferred_auth) + { + plog(context, PLOG_NOTE, "Direct authentication"); + return do_auth_user_pass(context, username, password) ? + OPENVPN_PLUGIN_FUNC_SUCCESS : OPENVPN_PLUGIN_FUNC_ERROR; + } + + /* get auth_control_file filename from envp string array*/ + const char *auth_control_file = get_env("auth_control_file", envp); + plog(context, PLOG_NOTE, "auth_control_file=%s", auth_control_file); + + /* Authenticate asynchronously in n seconds */ + if (!auth_control_file) + { + return OPENVPN_PLUGIN_FUNC_ERROR; + } + + /* we do not want to complicate our lives with having to wait() + * for child processes (so they are not zombiefied) *and* we MUST NOT + * fiddle with signal handlers (= shared with openvpn main), so + * we use double-fork() trick. + */ + + /* fork, sleep, succeed (no "real" auth done = always succeed) */ + pid_t p1 = fork(); + if (p1 < 0) /* Fork failed */ + { + return OPENVPN_PLUGIN_FUNC_ERROR; + } + if (p1 > 0) /* parent process */ + { + waitpid(p1, NULL, 0); + return OPENVPN_PLUGIN_FUNC_DEFERRED; + } + + /* first gen child process, fork() again and exit() right away */ + pid_t p2 = fork(); + if (p2 < 0) + { + plog(context, PLOG_ERR|PLOG_ERRNO, "BACKGROUND: fork(2) failed"); + exit(1); + } + + if (p2 != 0) /* new parent: exit right away */ + { + exit(0); + } + + /* (grand-)child process + * - never call "return" now (would mess up openvpn) + * - return status is communicated by file + * - then exit() + */ + + /* do mighty complicated work that will really take time here... */ + plog(context, PLOG_NOTE, "in async/deferred handler, usleep(%d)", + context->test_deferred_auth*1000); + usleep(context->test_deferred_auth*1000); + + /* now signal success state to openvpn */ + int fd = open(auth_control_file, O_WRONLY); + if (fd < 0) + { + plog(context, PLOG_ERR|PLOG_ERRNO, + "open('%s') failed", auth_control_file); + exit(1); + } + + char result[2] = "0\0"; + if (do_auth_user_pass(context, username, password)) + { + result[0] = '1'; + } + + if (write(fd, result, 1) != 1) + { + plog(context, PLOG_ERR|PLOG_ERRNO, "write to '%s' failed", auth_control_file ); + } + close(fd); + + exit(0); +} + + +OPENVPN_EXPORT int +openvpn_plugin_func_v3(const int v3structver, + struct openvpn_plugin_args_func_in const *args, + struct openvpn_plugin_args_func_return *ret) +{ + if (v3structver < OPENVPN_PLUGIN_STRUCTVER_MIN) + { + fprintf(stderr, "%s: this plugin is incompatible with the running version of OpenVPN\n", MODULE); + return OPENVPN_PLUGIN_FUNC_ERROR; + } + const char **argv = args->argv; + const char **envp = args->envp; + struct plugin_context *context = (struct plugin_context *) args->handle; + struct plugin_per_client_context *pcc = (struct plugin_per_client_context *) args->per_client_context; + switch (args->type) + { + case OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY: + plog(context, PLOG_NOTE, "OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY"); + return auth_user_pass_verify(context, pcc, argv, envp); + + default: + plog(context, PLOG_NOTE, "OPENVPN_PLUGIN_?"); + return OPENVPN_PLUGIN_FUNC_ERROR; + } +} + +OPENVPN_EXPORT void * +openvpn_plugin_client_constructor_v1(openvpn_plugin_handle_t handle) +{ + struct plugin_context *context = (struct plugin_context *) handle; + plog(context, PLOG_NOTE, "FUNC: openvpn_plugin_client_constructor_v1"); + return calloc(1, sizeof(struct plugin_per_client_context)); +} + +OPENVPN_EXPORT void +openvpn_plugin_client_destructor_v1(openvpn_plugin_handle_t handle, void *per_client_context) +{ + struct plugin_context *context = (struct plugin_context *) handle; + plog(context, PLOG_NOTE, "FUNC: openvpn_plugin_client_destructor_v1"); + free(per_client_context); +} + +OPENVPN_EXPORT void +openvpn_plugin_close_v1(openvpn_plugin_handle_t handle) +{ + struct plugin_context *context = (struct plugin_context *) handle; + plog(context, PLOG_NOTE, "FUNC: openvpn_plugin_close_v1"); + free(context); +} From patchwork Sun Mar 13 08:31:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Sommerseth X-Patchwork-Id: 2330 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director15.mail.ord1d.rsapps.net ([172.27.255.7]) by backend41.mail.ord1d.rsapps.net with LMTP id WDrZFj1HLmK+DwAAqwncew (envelope-from ) for ; Sun, 13 Mar 2022 15:34:21 -0400 Received: from proxy7.mail.iad3a.rsapps.net ([172.27.255.7]) by director15.mail.ord1d.rsapps.net with LMTP id yOXGHD1HLmIMYAAAIcMcQg (envelope-from ) for ; Sun, 13 Mar 2022 15:34:21 -0400 Received: from smtp16.gate.iad3a ([172.27.255.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy7.mail.iad3a.rsapps.net with LMTPS id KKqYFz1HLmLKagAAnPvY+A (envelope-from ) for ; Sun, 13 Mar 2022 15:34:21 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp16.gate.iad3a.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dkim=fail (signature verification failed) header.d=sf.lists.topphemmelig.net; dmarc=fail (p=none; dis=none) header.from=sf.lists.topphemmelig.net X-Suspicious-Flag: YES X-Classification-ID: 944230fe-a304-11ec-8caa-5254004ee196-1-1 Received: from [216.105.38.7] ([216.105.38.7:55764] helo=lists.sourceforge.net) by smtp16.gate.iad3a.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id C6/D0-26865-C374E226; Sun, 13 Mar 2022 15:34:21 -0400 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1nTTpz-0008Tt-Ez; Sun, 13 Mar 2022 19:33:19 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nTTpy-0008Tn-IA for openvpn-devel@lists.sourceforge.net; Sun, 13 Mar 2022 19:33:18 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=f1Fbh8nAA2lZoVbmh/cZFVyiwXvzDNtY3P0kTejgTxk=; b=c0Y84Ue9EsjMvau8m8XEGIXMkR 5nq0AkZthOgqOnBOdBtCjgQFuttiBk4CqVuM1oJF4Gg8jkScBmSUtU2ZovLV1vgkHmeg2cNph497V 3XQ4nKRylp9nE5+HSpH2qFueLeV1samr4Qg1fnDvKbkOfnKvyY16QwyLExfn1pfeSkmI=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=f1Fbh8nAA2lZoVbmh/cZFVyiwXvzDNtY3P0kTejgTxk=; b=jM0iyK4X+1lLJ6CzKiAseU/gzT K2/vjwU8vtiA1zazx5gB9tKtiE7AMvMBBz/qacNR4LgoCSeiMidbqy4FQiybX5/VCTwb5R1n33gqP zlgNzYgXAb/cSZb+hC+xs4l/+jBsES0aJjKxvl8OzOf004udCV/HkaM4/yZqk/hkpVOc=; Received: from mx1.basenordic.cloud ([217.170.196.134]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1nTTxs-0002ub-DN for openvpn-devel@lists.sourceforge.net; Sun, 13 Mar 2022 19:33:17 +0000 Received: from localhost (unknown [127.0.0.1]) by mx1.basenordic.cloud (Postfix) with ESMTP id 01F24E717 for ; Sun, 13 Mar 2022 19:33:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sf.lists.topphemmelig.net; s=inouz9eefah2too5; t=1647199990; bh=f1Fbh8nAA2lZoVbmh/cZFVyiwXvzDNtY3P0kTejgTxk=; h=From:To:Subject:Date:In-Reply-To:References:From; b=uU+HXHfaVOuI2JCJJNmpoxxrNW60p3e21wXyghiVvQF8TKvBZ1iEjAGlsgUOCGXiI 6P1OD9tS6BwraUpHKp6enBr8aKBs7pHr+5bRYhcVyCxXHW1r72wWBjTPIus5s8VaxV 8Ylls0H9CxiO47zWu2vxaja4VESJhQ98LircOfrtIOLvDTIkGt0Fk4ZsaUtQIeqN2x t9L26uOjsHostILZVzO6BgL/FiY/MJnTaykvFeRCFCIpGNKCxjM50eWA2h1679RyR5 Ym4smHG02MqJ9A0JRsPdhkcUf0EW4YY7USZ1yNEafC+lIoWcRr3dFfpBAkRXHbbUp9 ggSK+ng/b32Dw== Received: from mx1.basenordic.cloud ([127.0.0.1]) by localhost (mx1.basenordic.cloud [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9_wQMsCDncpv for ; Sun, 13 Mar 2022 20:33:09 +0100 (CET) Received: from xplorer.net (xplorer.sommerseth.xyz [10.35.7.11]) by mx1.basenordic.cloud (Postfix) with ESMTP id 14207E713 for ; Sun, 13 Mar 2022 20:33:09 +0100 (CET) From: David Sommerseth To: openvpn-devel@lists.sourceforge.net Date: Sun, 13 Mar 2022 20:31:53 +0100 Message-Id: <20220313193154.9350-3-openvpn@sf.lists.topphemmelig.net> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20220313193154.9350-1-openvpn@sf.lists.topphemmelig.net> References: <20220313193154.9350-1-openvpn@sf.lists.topphemmelig.net> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: David Sommerseth The plug-in API in OpenVPN 2.x is not designed for running multiple deferred authentication processes in parallel. The authentication results of such configurations are not to be trusted. For now we b [...] Content analysis details: (-2.4 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [217.170.196.134 listed in list.dnswl.org] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1nTTxs-0002ub-DN Subject: [Openvpn-devel] [PATCH v4 2/3] plug-ins: Disallow multiple deferred authentication plug-ins X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: David Sommerseth The plug-in API in OpenVPN 2.x is not designed for running multiple deferred authentication processes in parallel. The authentication results of such configurations are not to be trusted. For now we bail out when this discovered with an error in the log. CVE: 2022-0547 Signed-off-by: David Sommerseth Acked-by: Antonio Quartulli --- v2 - flip CONSTANT==var to var==CONSTANT in if() clause v3 - Use M_FATAL instead of M_ERR --- doc/man-sections/plugin-options.rst | 9 ++++++++ src/openvpn/plugin.c | 33 ++++++++++++++++++++++++++--- 2 files changed, 39 insertions(+), 3 deletions(-) diff --git a/doc/man-sections/plugin-options.rst b/doc/man-sections/plugin-options.rst index 51c574fe..6cbbc2f3 100644 --- a/doc/man-sections/plugin-options.rst +++ b/doc/man-sections/plugin-options.rst @@ -55,3 +55,12 @@ plug-ins must be prebuilt and adhere to the OpenVPN Plug-In API. (such as tls-verify, auth-user-pass-verify, or client-connect), then every module and script must return success (:code:`0`) in order for the connection to be authenticated. + + **WARNING**: + Plug-ins may do deferred execution, meaning the plug-in will + return the control back to the main OpenVPN process and provide + the plug-in result later on via a different thread or process. + OpenVPN does **NOT** support multiple authentication plug-ins + **where more than one of them** do deferred authentication. + If this behaviour is detected, OpenVPN will shut down upon first + authentication. diff --git a/src/openvpn/plugin.c b/src/openvpn/plugin.c index e3a89293..8236e29e 100644 --- a/src/openvpn/plugin.c +++ b/src/openvpn/plugin.c @@ -802,7 +802,7 @@ plugin_call_ssl(const struct plugin_list *pl, const char **envp; const int n = plugin_n(pl); bool error = false; - bool deferred = false; + bool deferred_auth_done = false; setenv_del(es, "script_type"); envp = make_env_array(es, false, &gc); @@ -824,7 +824,34 @@ plugin_call_ssl(const struct plugin_list *pl, break; case OPENVPN_PLUGIN_FUNC_DEFERRED: - deferred = true; + if ((type == OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY) + && deferred_auth_done) + { + /* + * Do not allow deferred auth if a deferred auth has + * already been started. This should allow a single + * deferred auth call to happen, with one or more + * auth calls with an instant authentication result. + * + * The plug-in API is not designed for multiple + * deferred authentications to happen, as the + * auth_control_file file will be shared across all + * the plug-ins. + * + * Since this is considered a critical configuration + * error, we bail out and exit the OpenVPN process. + */ + error = true; + msg(M_FATAL, + "Exiting due to multiple authentication plug-ins " + "performing deferred authentication. Only one " + "authentication plug-in doing deferred auth is " + "allowed. Ignoring the result and stopping now, " + "the current authentication result is not to be " + "trusted."); + break; + } + deferred_auth_done = true; break; default: @@ -844,7 +871,7 @@ plugin_call_ssl(const struct plugin_list *pl, { return OPENVPN_PLUGIN_FUNC_ERROR; } - else if (deferred) + else if (deferred_auth_done) { return OPENVPN_PLUGIN_FUNC_DEFERRED; } From patchwork Sun Mar 13 08:31:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Sommerseth X-Patchwork-Id: 2332 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director9.mail.ord1d.rsapps.net ([172.27.255.52]) by backend41.mail.ord1d.rsapps.net with LMTP id qA81MUBHLmK+DwAAqwncew (envelope-from ) for ; Sun, 13 Mar 2022 15:34:24 -0400 Received: from proxy11.mail.iad3a.rsapps.net ([172.27.255.52]) by director9.mail.ord1d.rsapps.net with LMTP id oKQpN0BHLmJcZQAAalYnBA (envelope-from ) for ; Sun, 13 Mar 2022 15:34:24 -0400 Received: from smtp15.gate.iad3a ([172.27.255.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy11.mail.iad3a.rsapps.net with LMTPS id cB+pMEBHLmIlRAAAxCvdqw (envelope-from ) for ; Sun, 13 Mar 2022 15:34:24 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp15.gate.iad3a.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dkim=fail (signature verification failed) header.d=sf.lists.topphemmelig.net; dmarc=fail (p=none; dis=none) header.from=sf.lists.topphemmelig.net X-Suspicious-Flag: YES X-Classification-ID: 9649d7e4-a304-11ec-a6ed-525400f46865-1-1 Received: from [216.105.38.7] ([216.105.38.7:45426] helo=lists.sourceforge.net) by smtp15.gate.iad3a.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 32/12-16296-0474E226; Sun, 13 Mar 2022 15:34:24 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1nTTyC-00037D-U0; Sun, 13 Mar 2022 19:33:35 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nTTyB-00036r-4w for openvpn-devel@lists.sourceforge.net; Sun, 13 Mar 2022 19:33:33 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=DwDPqMqNqx8Rx9+LCESd6QvLM88nRteJ8SrNFc9hP/o=; b=jxpZesAw7B5OKCETpuhmeAQWr5 RDQbRMR4dCQ92xqzigKT3V+MWn+hWzVaWmXB+9zeLrfyf12UZtAffd+rjIfQ7VjBZFJHgsjQm8uIe mHcmXNi9bWbx7tHnbK4niSgE7DFamXfKL+dwg7mkkPWjrOL09PoOK8wMrUrxet1eMjz0=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=DwDPqMqNqx8Rx9+LCESd6QvLM88nRteJ8SrNFc9hP/o=; b=HeHfynsC1VmymdCctat8Wwhe0k hpiTk9YbJbrIA+ORmH28HIq2ezRsgHknpOlfondT9X4kbOjHgbIabNYeN08s7lcxqGkFYjmxmF0FS vmYu4dbCJCmeunbVJ15yVZfDYIpDuVZ3X9o2gMmZrTNa6+c4zwkMJ3xbsMTkuVEuqiO8=; Received: from mx1.basenordic.cloud ([217.170.196.134]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1nTTy8-00EZNV-26 for openvpn-devel@lists.sourceforge.net; Sun, 13 Mar 2022 19:33:33 +0000 Received: from localhost (unknown [127.0.0.1]) by mx1.basenordic.cloud (Postfix) with ESMTP id 03DC9E714 for ; Sun, 13 Mar 2022 19:33:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sf.lists.topphemmelig.net; s=inouz9eefah2too5; t=1647200005; bh=DwDPqMqNqx8Rx9+LCESd6QvLM88nRteJ8SrNFc9hP/o=; h=From:To:Subject:Date:In-Reply-To:References:From; b=Ag5cje9WZmcqGjoeJJgibhz2J5RQZiXaVPQm7zPUHbnKcQCygrQwy1JoUTCX5rNdf wifDN/gLoMzPkhr0j0gmP+hevKJTMmKZxKzRufjIecUUSLEmqZHmjwroecMDhSPIxL 5pwFJmjVC7CRjaS9T6HaqPS9Yg1xxsKocXShM15OjUfvb0B3/Pgxk2UaklwSG8oHkB OxHJ6dmEw9JxyupN+GGxQjIqjc7G2nU5Ph6AQ4eAcIDGH1q5fBZCt1V7BeTGTTjdQO BV1Z9YHIOE9chLpuWaK0JrsCvW4z6QkIMEzUcJmYH/uJmKkG4yKUKFS6gIzk7TTRgL D5f0sxenVCnzA== Received: from mx1.basenordic.cloud ([127.0.0.1]) by localhost (mx1.basenordic.cloud [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4nR79lTh94ac for ; Sun, 13 Mar 2022 20:33:23 +0100 (CET) Received: from xplorer.net (xplorer.sommerseth.xyz [10.35.7.11]) by mx1.basenordic.cloud (Postfix) with ESMTP id 9F6F6E713 for ; Sun, 13 Mar 2022 20:33:23 +0100 (CET) From: David Sommerseth To: openvpn-devel@lists.sourceforge.net Date: Sun, 13 Mar 2022 20:31:54 +0100 Message-Id: <20220313193154.9350-4-openvpn@sf.lists.topphemmelig.net> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20220313193154.9350-1-openvpn@sf.lists.topphemmelig.net> References: <20220313193154.9350-1-openvpn@sf.lists.topphemmelig.net> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: David Sommerseth The use case for this plug-in is dubious now with the new multi-auth.c plugin available. This new plugin is based on simple.c, but allows far more flexibility for testing. Content analysis details: (-2.4 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [217.170.196.134 listed in list.dnswl.org] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1nTTy8-00EZNV-26 Subject: [Openvpn-devel] [PATCH v4 3/3] plugins: Remove defer/simple.c sample plugin X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: David Sommerseth The use case for this plug-in is dubious now with the new multi-auth.c plugin available. This new plugin is based on simple.c, but allows far more flexibility for testing. Signed-off-by: David Sommerseth Acked-by: Antonio Quartulli --- include/openvpn-plugin.h.in | 4 +- sample/sample-plugins/Makefile.plugins | 1 - sample/sample-plugins/README | 6 +- sample/sample-plugins/defer/simple.c | 393 ------------------------- sample/sample-plugins/defer/simple.def | 6 - 5 files changed, 6 insertions(+), 404 deletions(-) delete mode 100644 sample/sample-plugins/defer/simple.c delete mode 100755 sample/sample-plugins/defer/simple.def diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in index 087010a4..dc7c5306 100644 --- a/include/openvpn-plugin.h.in +++ b/include/openvpn-plugin.h.in @@ -584,8 +584,8 @@ OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t OPENVPN_PLUGIN_FUNC(openvpn_plugin_op * * OpenVPN will delete the auth_control_file after it goes out of scope. * - * See plugin/defer/simple.c for an example on using asynchronous - * authentication. + * See sample/sample-plugins/defer/multi-auth.c for an example on using + * asynchronous authentication. */ OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v2) (openvpn_plugin_handle_t handle, diff --git a/sample/sample-plugins/Makefile.plugins b/sample/sample-plugins/Makefile.plugins index 8bfbad09..917b02b6 100644 --- a/sample/sample-plugins/Makefile.plugins +++ b/sample/sample-plugins/Makefile.plugins @@ -7,7 +7,6 @@ # Plug-ins to build - listed entries should not carry any extensions # PLUGINS = \ - defer/simple \ defer/multi-auth \ keying-material-exporter-demo/keyingmaterialexporter \ log/log log/log_v3 \ diff --git a/sample/sample-plugins/README b/sample/sample-plugins/README index cf1b355e..356f603d 100644 --- a/sample/sample-plugins/README +++ b/sample/sample-plugins/README @@ -5,8 +5,10 @@ Examples provided: * authentication and logging simple/simple.c -- using the --auth-user-pass-verify callback, verify that the username/password is "foo"/"bar". -defer/simple.c -- using the --auth-user-pass-verify callback, - test deferred authentication. +defer/multi-auth.c + -- using the --auth-user-pass-verify callback, + test deferred authentication. Can be used to test multiple + authentication plugins in the same server config. log/log.c -- Extended variant of simple/simple.c which adds more logging of what is happening inside the plug-in log/log_v3.c -- A variant of log/log.c, which makes use of the diff --git a/sample/sample-plugins/defer/simple.c b/sample/sample-plugins/defer/simple.c deleted file mode 100644 index d2f614a5..00000000 --- a/sample/sample-plugins/defer/simple.c +++ /dev/null @@ -1,393 +0,0 @@ -/* - * OpenVPN -- An application to securely tunnel IP networks - * over a single TCP/UDP port, with support for SSL/TLS-based - * session authentication and key exchange, - * packet encryption, packet authentication, and - * packet compression. - * - * Copyright (C) 2002-2022 OpenVPN Inc - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 - * as published by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License along - * with this program; if not, write to the Free Software Foundation, Inc., - * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - */ - -/* - * This file implements a simple OpenVPN plugin module which - * will test deferred authentication and packet filtering. - * - * Will run on Windows or *nix. - * - * Sample usage: - * - * setenv test_deferred_auth 20 - * setenv test_packet_filter 10 - * plugin plugin/defer/simple.so - * - * This will enable deferred authentication to occur 20 - * seconds after the normal TLS authentication process, - * and will cause a packet filter file to be generated 10 - * seconds after the initial TLS negotiation, using - * {common-name}.pf as the source. - * - * Sample packet filter configuration: - * - * [CLIENTS DROP] - * +otherclient - * [SUBNETS DROP] - * +10.0.0.0/8 - * -10.10.0.8 - * [END] - * - * See the README file for build instructions. - */ - -#include -#include -#include -#include -#include -#include -#include -#include - -#include "openvpn-plugin.h" - -/* Pointers to functions exported from openvpn */ -static plugin_log_t plugin_log = NULL; - -/* - * Constants indicating minimum API and struct versions by the functions - * in this plugin. Consult openvpn-plugin.h, look for: - * OPENVPN_PLUGIN_VERSION and OPENVPN_PLUGINv3_STRUCTVER - * - * Strictly speaking, this sample code only requires plugin_log, a feature - * of structver version 1. However, '1' lines up with ancient versions - * of openvpn that are past end-of-support. As such, we are requiring - * structver '5' here to indicate a desire for modern openvpn, rather - * than a need for any particular feature found in structver beyond '1'. - */ -#define OPENVPN_PLUGIN_VERSION_MIN 3 -#define OPENVPN_PLUGIN_STRUCTVER_MIN 5 - -/* - * Our context, where we keep our state. - */ - -struct plugin_context { - int test_deferred_auth; - int test_packet_filter; -}; - -struct plugin_per_client_context { - int n_calls; - bool generated_pf_file; -}; - -/* module name for plugin_log() */ -static char *MODULE = "defer/simple"; - -/* - * Given an environmental variable name, search - * the envp array for its value, returning it - * if found or NULL otherwise. - */ -static const char * -get_env(const char *name, const char *envp[]) -{ - if (envp) - { - int i; - const int namelen = strlen(name); - for (i = 0; envp[i]; ++i) - { - if (!strncmp(envp[i], name, namelen)) - { - const char *cp = envp[i] + namelen; - if (*cp == '=') - { - return cp + 1; - } - } - } - } - return NULL; -} - -/* used for safe printf of possible NULL strings */ -static const char * -np(const char *str) -{ - if (str) - { - return str; - } - else - { - return "[NULL]"; - } -} - -static int -atoi_null0(const char *str) -{ - if (str) - { - return atoi(str); - } - else - { - return 0; - } -} - -/* Require a minimum OpenVPN Plugin API */ -OPENVPN_EXPORT int -openvpn_plugin_min_version_required_v1() -{ - return OPENVPN_PLUGIN_VERSION_MIN; -} - -/* use v3 functions so we can use openvpn's logging and base64 etc. */ -OPENVPN_EXPORT int -openvpn_plugin_open_v3(const int v3structver, - struct openvpn_plugin_args_open_in const *args, - struct openvpn_plugin_args_open_return *ret) -{ - const char **envp = args->envp; /* environment variables */ - struct plugin_context *context; - - if (v3structver < OPENVPN_PLUGIN_STRUCTVER_MIN) - { - fprintf(stderr, "%s: this plugin is incompatible with the running version of OpenVPN\n", MODULE); - return OPENVPN_PLUGIN_FUNC_ERROR; - } - - /* Save global pointers to functions exported from openvpn */ - plugin_log = args->callbacks->plugin_log; - - plugin_log(PLOG_NOTE, MODULE, "FUNC: openvpn_plugin_open_v3"); - - /* - * Allocate our context - */ - context = (struct plugin_context *) calloc(1, sizeof(struct plugin_context)); - if (!context) - { - goto error; - } - - context->test_deferred_auth = atoi_null0(get_env("test_deferred_auth", envp)); - plugin_log(PLOG_NOTE, MODULE, "TEST_DEFERRED_AUTH %d", context->test_deferred_auth); - - context->test_packet_filter = atoi_null0(get_env("test_packet_filter", envp)); - plugin_log(PLOG_NOTE, MODULE, "TEST_PACKET_FILTER %d", context->test_packet_filter); - - /* - * Which callbacks to intercept. - */ - ret->type_mask = - OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_UP) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_DOWN) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_ROUTE_UP) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_IPCHANGE) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_TLS_VERIFY) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_CLIENT_CONNECT_V2) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_CLIENT_DISCONNECT) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_LEARN_ADDRESS) - |OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_TLS_FINAL); - - ret->handle = (openvpn_plugin_handle_t *) context; - plugin_log(PLOG_NOTE, MODULE, "initialization succeeded"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - -error: - if (context) - { - free(context); - } - plugin_log(PLOG_NOTE, MODULE, "initialization failed"); - return OPENVPN_PLUGIN_FUNC_ERROR; -} - -static int -auth_user_pass_verify(struct plugin_context *context, - struct plugin_per_client_context *pcc, - const char *argv[], const char *envp[]) -{ - if (!context->test_deferred_auth) - { - return OPENVPN_PLUGIN_FUNC_SUCCESS; - } - - /* get username/password from envp string array */ - const char *username = get_env("username", envp); - const char *password = get_env("password", envp); - - /* get auth_control_file filename from envp string array*/ - const char *auth_control_file = get_env("auth_control_file", envp); - - plugin_log(PLOG_NOTE, MODULE, "DEFER u='%s' p='%s' acf='%s'", - np(username), - np(password), - np(auth_control_file)); - - /* Authenticate asynchronously in n seconds */ - if (!auth_control_file) - { - return OPENVPN_PLUGIN_FUNC_ERROR; - } - - /* we do not want to complicate our lives with having to wait() - * for child processes (so they are not zombiefied) *and* we MUST NOT - * fiddle with signal handlers (= shared with openvpn main), so - * we use double-fork() trick. - */ - - /* fork, sleep, succeed (no "real" auth done = always succeed) */ - pid_t p1 = fork(); - if (p1 < 0) /* Fork failed */ - { - return OPENVPN_PLUGIN_FUNC_ERROR; - } - if (p1 > 0) /* parent process */ - { - waitpid(p1, NULL, 0); - return OPENVPN_PLUGIN_FUNC_DEFERRED; - } - - /* first gen child process, fork() again and exit() right away */ - pid_t p2 = fork(); - if (p2 < 0) - { - plugin_log(PLOG_ERR|PLOG_ERRNO, MODULE, "BACKGROUND: fork(2) failed"); - exit(1); - } - - if (p2 != 0) /* new parent: exit right away */ - { - exit(0); - } - - /* (grand-)child process - * - never call "return" now (would mess up openvpn) - * - return status is communicated by file - * - then exit() - */ - - /* do mighty complicated work that will really take time here... */ - plugin_log(PLOG_NOTE, MODULE, "in async/deferred handler, sleep(%d)", context->test_deferred_auth); - sleep(context->test_deferred_auth); - - /* now signal success state to openvpn */ - int fd = open(auth_control_file, O_WRONLY); - if (fd < 0) - { - plugin_log(PLOG_ERR|PLOG_ERRNO, MODULE, "open('%s') failed", auth_control_file); - exit(1); - } - - plugin_log(PLOG_NOTE, MODULE, "auth_user_pass_verify: done" ); - - if (write(fd, "1", 1) != 1) - { - plugin_log(PLOG_ERR|PLOG_ERRNO, MODULE, "write to '%s' failed", auth_control_file ); - } - close(fd); - - exit(0); -} - -OPENVPN_EXPORT int -openvpn_plugin_func_v3(const int v3structver, - struct openvpn_plugin_args_func_in const *args, - struct openvpn_plugin_args_func_return *ret) -{ - if (v3structver < OPENVPN_PLUGIN_STRUCTVER_MIN) - { - fprintf(stderr, "%s: this plugin is incompatible with the running version of OpenVPN\n", MODULE); - return OPENVPN_PLUGIN_FUNC_ERROR; - } - const char **argv = args->argv; - const char **envp = args->envp; - struct plugin_context *context = (struct plugin_context *) args->handle; - struct plugin_per_client_context *pcc = (struct plugin_per_client_context *) args->per_client_context; - switch (args->type) - { - case OPENVPN_PLUGIN_UP: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_UP"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - case OPENVPN_PLUGIN_DOWN: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_DOWN"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - case OPENVPN_PLUGIN_ROUTE_UP: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_ROUTE_UP"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - case OPENVPN_PLUGIN_IPCHANGE: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_IPCHANGE"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - case OPENVPN_PLUGIN_TLS_VERIFY: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_TLS_VERIFY"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - case OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY"); - return auth_user_pass_verify(context, pcc, argv, envp); - - case OPENVPN_PLUGIN_CLIENT_CONNECT_V2: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_CLIENT_CONNECT_V2"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - case OPENVPN_PLUGIN_CLIENT_DISCONNECT: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_CLIENT_DISCONNECT"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - case OPENVPN_PLUGIN_LEARN_ADDRESS: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_LEARN_ADDRESS"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - case OPENVPN_PLUGIN_TLS_FINAL: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_TLS_FINAL"); - return OPENVPN_PLUGIN_FUNC_SUCCESS; - - default: - plugin_log(PLOG_NOTE, MODULE, "OPENVPN_PLUGIN_?"); - return OPENVPN_PLUGIN_FUNC_ERROR; - } -} - -OPENVPN_EXPORT void * -openvpn_plugin_client_constructor_v1(openvpn_plugin_handle_t handle) -{ - plugin_log(PLOG_NOTE, MODULE, "FUNC: openvpn_plugin_client_constructor_v1"); - return calloc(1, sizeof(struct plugin_per_client_context)); -} - -OPENVPN_EXPORT void -openvpn_plugin_client_destructor_v1(openvpn_plugin_handle_t handle, void *per_client_context) -{ - plugin_log(PLOG_NOTE, MODULE, "FUNC: openvpn_plugin_client_destructor_v1"); - free(per_client_context); -} - -OPENVPN_EXPORT void -openvpn_plugin_close_v1(openvpn_plugin_handle_t handle) -{ - struct plugin_context *context = (struct plugin_context *) handle; - plugin_log(PLOG_NOTE, MODULE, "FUNC: openvpn_plugin_close_v1"); - free(context); -} diff --git a/sample/sample-plugins/defer/simple.def b/sample/sample-plugins/defer/simple.def deleted file mode 100755 index a87507d1..00000000 --- a/sample/sample-plugins/defer/simple.def +++ /dev/null @@ -1,6 +0,0 @@ -LIBRARY OpenVPN_PLUGIN_SAMPLE -DESCRIPTION "Sample OpenVPN plug-in module." -EXPORTS - openvpn_plugin_open_v1 @1 - openvpn_plugin_func_v1 @2 - openvpn_plugin_close_v1 @3