From patchwork Tue Nov 20 23:10:07 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 612 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director8.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id QHZROUtQ9VtONAAAIUCqbw for ; Wed, 21 Nov 2018 07:32:11 -0500 Received: from proxy10.mail.ord1d.rsapps.net ([172.30.191.6]) by director8.mail.ord1d.rsapps.net with LMTP id WAMlOUtQ9VteFwAAfY0hYg ; Wed, 21 Nov 2018 07:32:11 -0500 Received: from smtp29.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy10.mail.ord1d.rsapps.net with LMTP id 2CbrOEtQ9VveCQAAfSg8FQ ; Wed, 21 Nov 2018 07:32:11 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp29.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 77c3df56-ed89-11e8-ae55-525400f257a9-1-1 Received: from [216.105.38.7] ([216.105.38.7:44132] helo=lists.sourceforge.net) by smtp29.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 40/7B-12260-B4055FB5; Wed, 21 Nov 2018 07:32:11 -0500 Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRf6-0004PM-I0; Wed, 21 Nov 2018 12:31:20 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRf5-0004PF-2o for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:19 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=JoFTeqJjXgKXL87Smgh+eQxo7wqWisGZOTmgt962dnY=; b=MGLWns7dM3UqQvg/HNQt8P5K3f 1PKoh3sAvLco0TziJd/GV0WeNHoUiVADbPU7PehXzYIT9MpyQ90K3OAVJaFWsTdBzOwDcqNGeCr76 34k4IXCo0I+8XM9CQG5LZ0Wl81liMSRvKFTIpyXhDHNkaQY8s/OD2icj0Z1DjnyiRhXQ=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=JoFTeqJjXgKXL87Smgh+eQxo7wqWisGZOTmgt962dnY=; b=OdSoGtFxyAt+0wJZs+CTtfbjdB hzPK7VDFUMEGwj5vwn2F0tqHlRIuDRikUIzuxh8adfy6GC+WwL7EQuHrqmIFgobLin+n8JenuQRjr h/ZYaMll0Hes7BicLb77IMdSU5A6CNaqqKuXT0XxosQKPYj1bFk1IKo7USBeFuzwmLiw=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRew-008sMu-86 for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:18 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWC-4m; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1849 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:07 +0100 Message-Id: <20181121101019.1801-2-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPRew-008sMu-86 Subject: [Openvpn-devel] [PATCH v4 01/13] client-connect: Split multi_connection_established into separate functions X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Fabian Knittel This patch splits up the multi_connection_established() function. Each new helper function does a specific job. Functions that do a similar job receive a similar calling interface. The patch tries not to reindent code, so that the real changes are as clearly visible as possible. (A follow-up patch will only do indentation changes.) Signed-off-by: Fabian Knittel PATCH v3: Since the code has changed enough from the time the original patch to the current master, the splitting has been redone from the current code. Also some style and minor code changes have been added doing this patch. This elimininates and the big reformatting done before eliminates the follow up patch with indentation changes. The original patch already replaces some instances of option_permission_mask with CLIENT_CONNECT_OPT_MASK. The V3 version does this more consequently. Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 597 +++++++++++++++++++++++++------------------- src/openvpn/multi.h | 4 +- 2 files changed, 346 insertions(+), 255 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 8440f311..a4b62151 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -1638,7 +1638,6 @@ static void multi_client_connect_post(struct multi_context *m, struct multi_instance *mi, const char *dc_file, - unsigned int option_permissions_mask, unsigned int *option_types_found) { /* Did script generate a dynamic config file? */ @@ -1647,7 +1646,7 @@ multi_client_connect_post(struct multi_context *m, options_server_import(&mi->context.options, dc_file, D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, + CLIENT_CONNECT_OPT_MASK, option_types_found, mi->context.c2.es); @@ -1671,7 +1670,6 @@ static void multi_client_connect_post_plugin(struct multi_context *m, struct multi_instance *mi, const struct plugin_return *pr, - unsigned int option_permissions_mask, unsigned int *option_types_found) { struct plugin_return config; @@ -1689,7 +1687,7 @@ multi_client_connect_post_plugin(struct multi_context *m, options_string_import(&mi->context.options, config.list[i]->value, D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, + CLIENT_CONNECT_OPT_MASK, option_types_found, mi->context.c2.es); } @@ -1716,21 +1714,19 @@ multi_client_connect_post_plugin(struct multi_context *m, static void multi_client_connect_mda(struct multi_context *m, struct multi_instance *mi, - const struct buffer_list *config, - unsigned int option_permissions_mask, unsigned int *option_types_found) { - if (config) + if (mi->cc_config) { struct buffer_entry *be; - for (be = config->head; be != NULL; be = be->next) + for (be = mi->cc_config->head; be != NULL; be = be->next) { const char *opt = BSTR(&be->buf); options_string_import(&mi->context.options, opt, D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, + CLIENT_CONNECT_OPT_MASK, option_types_found, mi->context.c2.es); } @@ -1773,215 +1769,386 @@ multi_client_connect_setenv(struct multi_context *m, gc_free(&gc); } -/* - * Called as soon as the SSL/TLS connection authenticates. - * - * Instance-specific directives to be processed: - * - * iroute start-ip end-ip - * ifconfig-push local remote-netmask - * push - */ static void -multi_connection_established(struct multi_context *m, struct multi_instance *mi) +multi_client_connect_call_plugin_v1(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found, + int *cc_succeeded, + int *cc_succeeded_count) { - if (tls_authentication_status(mi->context.c2.tls_multi, 0) == TLS_AUTHENTICATION_SUCCEEDED) +#ifdef ENABLE_PLUGIN + ASSERT(m); + ASSERT(mi); + ASSERT(option_types_found); + ASSERT(cc_succeeded); + ASSERT(cc_succeeded_count); + + /* deprecated callback, use a file for passing back return info */ + if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT)) { + struct argv argv = argv_new(); struct gc_arena gc = gc_new(); - unsigned int option_types_found = 0; + const char *dc_file = + platform_create_temp_file(mi->context.options.tmp_dir, "cc", &gc); - const unsigned int option_permissions_mask = - OPT_P_INSTANCE - | OPT_P_INHERIT - | OPT_P_PUSH - | OPT_P_TIMER - | OPT_P_CONFIG - | OPT_P_ECHO - | OPT_P_COMP - | OPT_P_SOCKFLAGS; + if (!dc_file) + { + cc_succeeded = false; + goto cleanup; + } - int cc_succeeded = true; /* client connect script status */ - int cc_succeeded_count = 0; + argv_printf(&argv, "%s", dc_file); + if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT, + &argv, NULL, mi->context.c2.es) + != OPENVPN_PLUGIN_FUNC_SUCCESS) + { + msg(M_WARN, "WARNING: client-connect plugin call failed"); + *cc_succeeded = false; + } + else + { + multi_client_connect_post(m, mi, dc_file, option_types_found); + (*cc_succeeded_count)++; + } + + { + msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", + dc_file); + } + +cleanup: + argv_reset(&argv); + gc_free(&gc); + } +#endif /* ifdef ENABLE_PLUGIN */ +} - ASSERT(mi->context.c1.tuntap); +static void +multi_client_connect_call_plugin_v2(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found, + int *cc_succeeded, + int *cc_succeeded_count) +{ +#ifdef ENABLE_PLUGIN + ASSERT(m); + ASSERT(mi); + ASSERT(option_types_found); + ASSERT(cc_succeeded); + ASSERT(cc_succeeded_count); - /* lock down the common name and cert hashes so they can't change during future TLS renegotiations */ - tls_lock_common_name(mi->context.c2.tls_multi); - tls_lock_cert_hash_set(mi->context.c2.tls_multi); + /* V2 callback, use a plugin_return struct for passing back return info */ + if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2)) + { + struct plugin_return pr; - /* generate a msg() prefix for this client instance */ - generate_prefix(mi); + plugin_return_init(&pr); - /* delete instances of previous clients with same common-name */ - if (!mi->context.options.duplicate_cn) + if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2, + NULL, &pr, mi->context.c2.es) + != OPENVPN_PLUGIN_FUNC_SUCCESS) { - multi_delete_dup(m, mi); + msg(M_WARN, "WARNING: client-connect-v2 plugin call failed"); + *cc_succeeded = false; + } + else + { + multi_client_connect_post_plugin(m, mi, &pr, option_types_found); + (*cc_succeeded_count)++; } - /* reset pool handle to null */ - mi->vaddr_handle = -1; + plugin_return_free(&pr); + } +#endif /* ifdef ENABLE_PLUGIN */ +} - /* - * Try to source a dynamic config file from the - * --client-config-dir directory. - */ - if (mi->context.options.client_config_dir) + + +/** + * Runs the --client-connect script if one is defined. + */ +static void +multi_client_connect_call_script(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found, + int *cc_succeeded, + int *cc_succeeded_count) +{ + if (mi->context.options.client_connect_script) + { + struct argv argv = argv_new(); + struct gc_arena gc = gc_new(); + const char *dc_file = NULL; + + setenv_str(mi->context.c2.es, "script_type", "client-connect"); + + dc_file = platform_create_temp_file(mi->context.options.tmp_dir, + "cc", &gc); + if (!dc_file) { - const char *ccd_file; + *cc_succeeded = false; + goto cleanup; + } - ccd_file = platform_gen_path(mi->context.options.client_config_dir, - tls_common_name(mi->context.c2.tls_multi, - false), - &gc); + argv_parse_cmd(&argv, mi->context.options.client_connect_script); + argv_printf_cat(&argv, "%s", dc_file); - /* try common-name file */ - if (platform_test_file(ccd_file)) - { - options_server_import(&mi->context.options, - ccd_file, - D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, - &option_types_found, - mi->context.c2.es); - } - else /* try default file */ - { - ccd_file = platform_gen_path(mi->context.options.client_config_dir, - CCD_DEFAULT, - &gc); + if (openvpn_run_script(&argv, mi->context.c2.es, 0, "--client-connect")) + { + multi_client_connect_post(m, mi, dc_file, option_types_found); + (*cc_succeeded_count)++; + } + else + { + *cc_succeeded = false; + } - if (platform_test_file(ccd_file)) - { - options_server_import(&mi->context.options, - ccd_file, - D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, - &option_types_found, - mi->context.c2.es); - } - } + if (!platform_unlink(dc_file)) + { + msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", + dc_file); } +cleanup: + argv_reset(&argv); + gc_free(&gc); + } +} - /* - * Select a virtual address from either --ifconfig-push in --client-config-dir file - * or --ifconfig-pool. - */ - multi_select_virtual_addr(m, mi); +static void +multi_client_connect_late_setup(struct multi_context *m, + struct multi_instance *mi, + const unsigned int option_types_found) +{ + struct gc_arena gc = gc_new(); + /* + * Process sourced options. + */ + do_deferred_options(&mi->context, option_types_found); - /* do --client-connect setenvs */ - multi_client_connect_setenv(m, mi); + /* + * make sure we got ifconfig settings from somewhere + */ + if (!mi->context.c2.push_ifconfig_defined) + { + msg(D_MULTI_ERRORS, "MULTI: no dynamic or static remote" + "--ifconfig address is available for %s", + multi_instance_string(mi, false, &gc)); + } + + /* + * make sure that ifconfig settings comply with constraints + */ + if (!ifconfig_push_constraint_satisfied(&mi->context)) + { + const char *ifconfig_constraint_network = + print_in_addr_t(mi->context.options.push_ifconfig_constraint_network, 0, &gc); + const char *ifconfig_constraint_netmask = + print_in_addr_t(mi->context.options.push_ifconfig_constraint_netmask, 0, &gc); + + /* JYFIXME -- this should cause the connection to fail */ + msg(D_MULTI_ERRORS, "MULTI ERROR: primary virtual IP for %s (%s)" + "violates tunnel network/netmask constraint (%s/%s)", + multi_instance_string(mi, false, &gc), + print_in_addr_t(mi->context.c2.push_ifconfig_local, 0, &gc), + ifconfig_constraint_network, ifconfig_constraint_netmask); + } + + /* + * For routed tunnels, set up internal route to endpoint + * plus add all iroute routes. + */ + if (TUNNEL_TYPE(mi->context.c1.tuntap) == DEV_TYPE_TUN) + { + if (mi->context.c2.push_ifconfig_defined) + { + multi_learn_in_addr_t(m, mi, + mi->context.c2.push_ifconfig_local, + -1, true); + msg(D_MULTI_LOW, "MULTI: primary virtual IP for %s: %s", + multi_instance_string(mi, false, &gc), + print_in_addr_t(mi->context.c2.push_ifconfig_local, 0, &gc)); + } + + if (mi->context.c2.push_ifconfig_ipv6_defined) + { + multi_learn_in6_addr(m, mi, + mi->context.c2.push_ifconfig_ipv6_local, + -1, true); + /* TODO: find out where addresses are "unlearned"!! */ + const char *ifconfig_local_ipv6 = + print_in6_addr(mi->context.c2.push_ifconfig_ipv6_local, 0, &gc); + msg(D_MULTI_LOW, "MULTI: primary virtual IPv6 for %s: %s", + multi_instance_string(mi, false, &gc), + ifconfig_local_ipv6); + } + + /* add routes locally, pointing to new client, if + * --iroute options have been specified */ + multi_add_iroutes(m, mi); -#ifdef ENABLE_PLUGIN /* - * Call client-connect plug-in. + * iroutes represent subnets which are "owned" by a particular + * client. Therefore, do not actually push a route to a client + * if it matches one of the client's iroutes. */ + remove_iroutes_from_push_route_list(&mi->context.options); + } + else if (mi->context.options.iroutes) + { + msg(D_MULTI_ERRORS, "MULTI: --iroute options rejected for %s -- iroute" + "only works with tun-style tunnels", + multi_instance_string(mi, false, &gc)); + } - /* deprecated callback, use a file for passing back return info */ - if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT)) - { - struct argv argv = argv_new(); - const char *dc_file = platform_create_temp_file(mi->context.options.tmp_dir, - "cc", &gc); + /* set our client's VPN endpoint for status reporting purposes */ + mi->reporting_addr = mi->context.c2.push_ifconfig_local; + mi->reporting_addr_ipv6 = mi->context.c2.push_ifconfig_ipv6_local; - if (!dc_file) - { - cc_succeeded = false; - goto script_depr_failed; - } + /* set context-level authentication flag */ + mi->context.c2.context_auth = CAS_SUCCEEDED; - argv_printf(&argv, "%s", dc_file); - if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT, &argv, NULL, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS) - { - msg(M_WARN, "WARNING: client-connect plugin call failed"); - cc_succeeded = false; - } - else - { - multi_client_connect_post(m, mi, dc_file, option_permissions_mask, &option_types_found); - ++cc_succeeded_count; - } +#ifdef ENABLE_ASYNC_PUSH + /* authentication complete, send push reply */ + if (mi->context.c2.push_request_received) + { + process_incoming_push_request(&mi->context); + } +#endif + gc_free(&gc); +} - if (!platform_unlink(dc_file)) - { - msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", - dc_file); - } -script_depr_failed: - argv_reset(&argv); - } +static void +multi_client_connect_early_setup(struct multi_context *m, + struct multi_instance *mi) +{ + ASSERT(mi->context.c1.tuntap); + /* + * lock down the common name and cert hashes so they can't change + * during future TLS renegotiations + */ + tls_lock_common_name(mi->context.c2.tls_multi); + tls_lock_cert_hash_set(mi->context.c2.tls_multi); - /* V2 callback, use a plugin_return struct for passing back return info */ - if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2)) - { - struct plugin_return pr; + /* generate a msg() prefix for this client instance */ + generate_prefix(mi); - plugin_return_init(&pr); + /* delete instances of previous clients with same common-name */ + if (!mi->context.options.duplicate_cn) + { + multi_delete_dup(m, mi); + } - if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2, NULL, &pr, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS) - { - msg(M_WARN, "WARNING: client-connect-v2 plugin call failed"); - cc_succeeded = false; - } - else - { - multi_client_connect_post_plugin(m, mi, &pr, option_permissions_mask, &option_types_found); - ++cc_succeeded_count; - } + /* reset pool handle to null */ + mi->vaddr_handle = -1; +} - plugin_return_free(&pr); - } -#endif /* ifdef ENABLE_PLUGIN */ +/** + * Try to source a dynamic config file from the + * --client-config-dir directory. + */ +static void +multi_client_connect_source_ccd(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found) +{ + if (mi->context.options.client_config_dir) + { + struct gc_arena gc = gc_new(); + const char *ccd_file; - /* - * Run --client-connect script. - */ - if (mi->context.options.client_connect_script && cc_succeeded) - { - struct argv argv = argv_new(); - const char *dc_file = NULL; + ccd_file = platform_gen_path(mi->context.options.client_config_dir, + tls_common_name(mi->context.c2.tls_multi, + false), + &gc); - setenv_str(mi->context.c2.es, "script_type", "client-connect"); + /* try common-name file */ + if (platform_test_file(ccd_file)) + { + options_server_import(&mi->context.options, + ccd_file, + D_IMPORT_ERRORS|M_OPTERR, + CLIENT_CONNECT_OPT_MASK, + option_types_found, + mi->context.c2.es); + } + else /* try default file */ + { + ccd_file = platform_gen_path(mi->context.options.client_config_dir, + CCD_DEFAULT, + &gc); - dc_file = platform_create_temp_file(mi->context.options.tmp_dir, - "cc", &gc); - if (!dc_file) + if (platform_test_file(ccd_file)) { - cc_succeeded = false; - goto script_failed; + options_server_import(&mi->context.options, + ccd_file, + D_IMPORT_ERRORS|M_OPTERR, + CLIENT_CONNECT_OPT_MASK, + option_types_found, + mi->context.c2.es); } + } + gc_free(&gc); + } +} + +/* + * Called as soon as the SSL/TLS connection authenticates. + * + * Instance-specific directives to be processed: + * + * iroute start-ip end-ip + * ifconfig-push local remote-netmask + * push + */ +static void +multi_connection_established(struct multi_context *m, struct multi_instance *mi) +{ + if (tls_authentication_status(mi->context.c2.tls_multi, 0) + == TLS_AUTHENTICATION_SUCCEEDED) + { + unsigned int option_types_found = 0; - argv_parse_cmd(&argv, mi->context.options.client_connect_script); - argv_printf_cat(&argv, "%s", dc_file); + int cc_succeeded = true; /* client connect script status */ + int cc_succeeded_count = 0; - if (openvpn_run_script(&argv, mi->context.c2.es, 0, "--client-connect")) - { - multi_client_connect_post(m, mi, dc_file, option_permissions_mask, &option_types_found); - ++cc_succeeded_count; - } - else - { - cc_succeeded = false; - } + multi_client_connect_early_setup(m, mi); - if (!platform_unlink(dc_file)) - { - msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", - dc_file); - } + multi_client_connect_source_ccd(m, mi, &option_types_found); -script_failed: - argv_reset(&argv); - } + /* + * Select a virtual address from either --ifconfig-push in + * --client-config-dir file or --ifconfig-pool. + */ + multi_select_virtual_addr(m, mi); + + /* do --client-connect setenvs */ + multi_client_connect_setenv(m, mi); + + multi_client_connect_call_plugin_v1(m, mi, &option_types_found, + &cc_succeeded, + &cc_succeeded_count); + + multi_client_connect_call_plugin_v2(m, mi, &option_types_found, + &cc_succeeded, + &cc_succeeded_count); /* * Check for client-connect script left by management interface client */ + + if (cc_succeeded) + { + multi_client_connect_call_script(m, mi, &option_types_found, + &cc_succeeded, + &cc_succeeded_count); + + } #ifdef MANAGEMENT_DEF_AUTH if (cc_succeeded && mi->cc_config) { - multi_client_connect_mda(m, mi, mi->cc_config, option_permissions_mask, &option_types_found); - ++cc_succeeded_count; + multi_client_connect_mda(m, mi, &option_types_found); + cc_succeeded_count++; } #endif @@ -1991,99 +2158,21 @@ script_failed: */ if (mi->context.options.disable) { - msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to 'disable' directive"); + msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to" + "'disable' directive"); cc_succeeded = false; cc_succeeded_count = 0; } if (cc_succeeded) { - /* - * Process sourced options. - */ - do_deferred_options(&mi->context, option_types_found); - - /* - * make sure we got ifconfig settings from somewhere - */ - if (!mi->context.c2.push_ifconfig_defined) - { - msg(D_MULTI_ERRORS, "MULTI: no dynamic or static remote --ifconfig address is available for %s", - multi_instance_string(mi, false, &gc)); - } - - /* - * make sure that ifconfig settings comply with constraints - */ - if (!ifconfig_push_constraint_satisfied(&mi->context)) - { - /* JYFIXME -- this should cause the connection to fail */ - msg(D_MULTI_ERRORS, "MULTI ERROR: primary virtual IP for %s (%s) violates tunnel network/netmask constraint (%s/%s)", - multi_instance_string(mi, false, &gc), - print_in_addr_t(mi->context.c2.push_ifconfig_local, 0, &gc), - print_in_addr_t(mi->context.options.push_ifconfig_constraint_network, 0, &gc), - print_in_addr_t(mi->context.options.push_ifconfig_constraint_netmask, 0, &gc)); - } - - /* - * For routed tunnels, set up internal route to endpoint - * plus add all iroute routes. - */ - if (TUNNEL_TYPE(mi->context.c1.tuntap) == DEV_TYPE_TUN) - { - if (mi->context.c2.push_ifconfig_defined) - { - multi_learn_in_addr_t(m, mi, mi->context.c2.push_ifconfig_local, -1, true); - msg(D_MULTI_LOW, "MULTI: primary virtual IP for %s: %s", - multi_instance_string(mi, false, &gc), - print_in_addr_t(mi->context.c2.push_ifconfig_local, 0, &gc)); - } - - if (mi->context.c2.push_ifconfig_ipv6_defined) - { - multi_learn_in6_addr(m, mi, mi->context.c2.push_ifconfig_ipv6_local, -1, true); - /* TODO: find out where addresses are "unlearned"!! */ - msg(D_MULTI_LOW, "MULTI: primary virtual IPv6 for %s: %s", - multi_instance_string(mi, false, &gc), - print_in6_addr(mi->context.c2.push_ifconfig_ipv6_local, 0, &gc)); - } - - /* add routes locally, pointing to new client, if - * --iroute options have been specified */ - multi_add_iroutes(m, mi); - - /* - * iroutes represent subnets which are "owned" by a particular - * client. Therefore, do not actually push a route to a client - * if it matches one of the client's iroutes. - */ - remove_iroutes_from_push_route_list(&mi->context.options); - } - else if (mi->context.options.iroutes) - { - msg(D_MULTI_ERRORS, "MULTI: --iroute options rejected for %s -- iroute only works with tun-style tunnels", - multi_instance_string(mi, false, &gc)); - } - - /* set our client's VPN endpoint for status reporting purposes */ - mi->reporting_addr = mi->context.c2.push_ifconfig_local; - mi->reporting_addr_ipv6 = mi->context.c2.push_ifconfig_ipv6_local; - - /* set context-level authentication flag */ - mi->context.c2.context_auth = CAS_SUCCEEDED; - -#ifdef ENABLE_ASYNC_PUSH - /* authentication complete, send push reply */ - if (mi->context.c2.push_request_received) - { - process_incoming_push_request(&mi->context); - } -#endif + multi_client_connect_late_setup(m, mi, option_types_found); } else { /* set context-level authentication flag */ - mi->context.c2.context_auth = cc_succeeded_count ? CAS_PARTIAL : CAS_FAILED; + mi->context.c2.context_auth = + cc_succeeded_count ? CAS_PARTIAL : CAS_FAILED; } /* set flag so we don't get called again */ @@ -2097,11 +2186,11 @@ script_failed: #ifdef MANAGEMENT_DEF_AUTH if (management) { - management_connection_established(management, &mi->context.c2.mda_context, mi->context.c2.es); + management_connection_established + (management, &mi->context.c2.mda_context, mi->context.c2.es); } #endif - gc_free(&gc); } /* diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h index 3d3d6875..489c073a 100644 --- a/src/openvpn/multi.h +++ b/src/openvpn/multi.h @@ -628,7 +628,9 @@ multi_process_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags return ret; } - +#define CLIENT_CONNECT_OPT_MASK (OPT_P_INSTANCE | OPT_P_INHERIT \ + |OPT_P_PUSH | OPT_P_TIMER | OPT_P_CONFIG \ + |OPT_P_ECHO | OPT_P_COMP | OPT_P_SOCKFLAGS) static inline bool multi_process_outgoing_link_dowork(struct multi_context *m, struct multi_instance *mi, const unsigned int mpp_flags) From patchwork Tue Nov 20 23:10:08 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 616 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director7.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id wPSmMHFQ9VsKSAAAIUCqbw for ; Wed, 21 Nov 2018 07:32:49 -0500 Received: from proxy10.mail.ord1d.rsapps.net ([172.30.191.6]) by director7.mail.ord1d.rsapps.net with LMTP id YKugMHFQ9VtTIwAAovjBpQ ; Wed, 21 Nov 2018 07:32:49 -0500 Received: from smtp31.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy10.mail.ord1d.rsapps.net with LMTP id 2OhUMHFQ9VshCgAAfSg8FQ ; Wed, 21 Nov 2018 07:32:49 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp31.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 8e6dd4a0-ed89-11e8-9c65-525400b3ac8c-1-1 Received: from [216.105.38.7] ([216.105.38.7:51338] helo=lists.sourceforge.net) by smtp31.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 83/02-23392-17055FB5; Wed, 21 Nov 2018 07:32:49 -0500 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRfn-0006uc-EH; Wed, 21 Nov 2018 12:32:03 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRfl-0006uP-Fp for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:32:01 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=kPlfCCHm8Ih34jFDJdYOZq+pg+dY32Eo1lBbdDWNiJw=; b=iyhPbZSmPdOI90Q0titTsC7mHe rfxqhkXYIS0p6zcBxTUbw//jW/emEwTwedAHfGPa5OIhT8nXtbNey7CusWAL/HaAS5K4i2HQjOKFb fKu9HZbxSXimqifIKkGf7/uSD8oGtdwqBncIYHKrshVwgWQEb6+jj4MivKWyiZ50bmpw=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=kPlfCCHm8Ih34jFDJdYOZq+pg+dY32Eo1lBbdDWNiJw=; b=DoRmRO2/1q/wwkZLLsMM52E9KN LPURk71NaZJcUI7P8aBpmbY2HrGCFOamgPYFYUUREs3llOntP9GY1BpSGpE5XabEFtpsJb8WPtWdl 3Tf+JXjLh7dM4E1QoP49CUegteromM2uHs9eF1/Hr4k5iy2FmzUi0WyEgJQOmBvNpRZM=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRfi-008sMu-6B for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:32:01 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWG-7i; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1852 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:08 +0100 Message-Id: <20181121101019.1801-3-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPRfi-008sMu-6B Subject: [Openvpn-devel] [PATCH v4 02/13] client-connect: Refactor multi_client_connect_source_ccd X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Fabian Knittel Refactor multi_client_connect_source_ccd(), so that options_server_import() (or the success path in general) is only entered in one place within the function. Signed-off-by: Fabian Knittel Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index a4b62151..8fc69a07 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -2063,31 +2063,30 @@ multi_client_connect_source_ccd(struct multi_context *m, &gc); /* try common-name file */ - if (platform_test_file(ccd_file)) + if (!platform_test_file(ccd_file)) { - options_server_import(&mi->context.options, - ccd_file, - D_IMPORT_ERRORS|M_OPTERR, - CLIENT_CONNECT_OPT_MASK, - option_types_found, - mi->context.c2.es); + ccd_file = NULL; } - else /* try default file */ + /* try default file */ { ccd_file = platform_gen_path(mi->context.options.client_config_dir, CCD_DEFAULT, &gc); - - if (platform_test_file(ccd_file)) + if (!platform_test_file(ccd_file)) { - options_server_import(&mi->context.options, - ccd_file, - D_IMPORT_ERRORS|M_OPTERR, - CLIENT_CONNECT_OPT_MASK, - option_types_found, - mi->context.c2.es); + ccd_file = NULL; } } + + if (ccd_file) + { + options_server_import(&mi->context.options, + ccd_file, + D_IMPORT_ERRORS|M_OPTERR, + CLIENT_CONNECT_OPT_MASK, + option_types_found, + mi->context.c2.es); + } gc_free(&gc); } } From patchwork Tue Nov 20 23:10:09 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 619 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director9.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id oI5jJ49Q9VuJCwAAIUCqbw for ; Wed, 21 Nov 2018 07:33:19 -0500 Received: from proxy5.mail.ord1d.rsapps.net ([172.30.191.6]) by director9.mail.ord1d.rsapps.net with LMTP id 0LFHJ49Q9VuESgAAalYnBA ; Wed, 21 Nov 2018 07:33:19 -0500 Received: from smtp23.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy5.mail.ord1d.rsapps.net with LMTP id yBUAJ49Q9VssAwAA8Zzt7w ; Wed, 21 Nov 2018 07:33:19 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp23.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: a0247e60-ed89-11e8-80c4-525400bfb165-1-1 Received: from [216.105.38.7] ([216.105.38.7:8193] helo=lists.sourceforge.net) by smtp23.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id DE/28-21557-F8055FB5; Wed, 21 Nov 2018 07:33:19 -0500 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRgH-0006xU-IP; Wed, 21 Nov 2018 12:32:33 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRgG-0006xK-Iy for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:32:32 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=q53VJ4eZ9Y6AQQUi9qrO1t4RlfZlyyc1QCksvD0oZ0Q=; b=YtiSARCm4CFzR/W1EFxh4/E7Lu uMgW6/nt1dKr3f14W6Mc9otFCgh5RhUBvpfr26y1Ihovz5ExLpq7/opt6SP2smUCjmZs06xgyHb0p 1BsbpMqiW1Kawio3f5ypGMPAa09dTxr93MDL9EjAHvQ/WKLbSzysAUGcWyw30u+lcE0A=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=q53VJ4eZ9Y6AQQUi9qrO1t4RlfZlyyc1QCksvD0oZ0Q=; b=GQORPcTvDfRw4G+3xEpQjWvV6V NWQd6qWNOkGgr9HYFKTI0OzoCIpeWViASVpsm+gCfEhZxUXfCKHxU+hK8ZEM1IkfGWAAF4KH2STyZ 1WZtrfZhKljnPd3tE95gGh2+9soOmprqFmKzznTrYccDVfRvATOib9DhPPF1P8bor7ig=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRg1-008sMu-9F for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:32:32 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWJ-A2; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1855 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:09 +0100 Message-Id: <20181121101019.1801-4-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 TIME_LIMIT_EXCEEDED Exceeded time limit / deadline X-Headers-End: 1gPRg1-008sMu-9F Subject: [Openvpn-devel] [PATCH v4 03/13] client-connect: Move multi_client_connect_setenv into early_setup X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Fabian Knittel This patch moves multi_client_connect_setenv into multi_client_connect_early_setup and makes sure that every client-connect handling function updates the virtual address selection. Background: This unifies how the client-connect handling functions work. Signed-off-by: Fabian Knittel Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 8fc69a07..bc9fddce 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -2041,6 +2041,12 @@ multi_client_connect_early_setup(struct multi_context *m, /* reset pool handle to null */ mi->vaddr_handle = -1; + + /* do --client-connect setenvs */ + multi_select_virtual_addr(m, mi); + + multi_client_connect_setenv(m, mi); + } /** @@ -2086,6 +2092,13 @@ multi_client_connect_source_ccd(struct multi_context *m, CLIENT_CONNECT_OPT_MASK, option_types_found, mi->context.c2.es); + /* + * Select a virtual address from either --ifconfig-push in + * --client-config-dir file or --ifconfig-pool. + */ + multi_select_virtual_addr(m, mi); + + multi_client_connect_setenv(m, mi); } gc_free(&gc); } @@ -2115,19 +2128,11 @@ multi_connection_established(struct multi_context *m, struct multi_instance *mi) multi_client_connect_source_ccd(m, mi, &option_types_found); - /* - * Select a virtual address from either --ifconfig-push in - * --client-config-dir file or --ifconfig-pool. - */ - multi_select_virtual_addr(m, mi); - - /* do --client-connect setenvs */ - multi_client_connect_setenv(m, mi); - multi_client_connect_call_plugin_v1(m, mi, &option_types_found, &cc_succeeded, &cc_succeeded_count); + multi_client_connect_call_plugin_v2(m, mi, &option_types_found, &cc_succeeded, &cc_succeeded_count); From patchwork Tue Nov 20 23:10:10 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 613 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director7.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id sJ6xLFxQ9VtONAAAIUCqbw for ; Wed, 21 Nov 2018 07:32:28 -0500 Received: from proxy9.mail.ord1d.rsapps.net ([172.30.191.6]) by director7.mail.ord1d.rsapps.net with LMTP id qIKoLFxQ9Vt7HQAAovjBpQ ; Wed, 21 Nov 2018 07:32:28 -0500 Received: from smtp26.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy9.mail.ord1d.rsapps.net with LMTP id uJ6VLFxQ9Vu7SgAA7h+8OQ ; Wed, 21 Nov 2018 07:32:28 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp26.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 81c84762-ed89-11e8-a54c-525400c5b129-1-1 Received: from [216.105.38.7] ([216.105.38.7:15750] helo=lists.sourceforge.net) by smtp26.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 25/7C-18831-C5055FB5; Wed, 21 Nov 2018 07:32:28 -0500 Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRfO-0004Qv-P1; Wed, 21 Nov 2018 12:31:38 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRfN-0004Qm-Fk for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:37 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=ukJZra/4VPizMEJPaMQ1+4TAe9WsXNZUJZxzuIvf8Iw=; b=dgcyZzVDowrryQSsO9u04yjjJv tnzQH4nmmVYxxqUJRazk+q+pkIR5Prx4ueHpjYukGOUubAKCWndsXiIoCZ11QYiAtcOpuY/yUwEBB XQO8wGJLm9xqnMv2Fp4oNmcV8a72BwPuopd/JvurKUhrJmn5nlN1mdSFwteA3ogot92k=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=ukJZra/4VPizMEJPaMQ1+4TAe9WsXNZUJZxzuIvf8Iw=; b=ZvEnmcuMSrtEpGZKxF0vC4IOLE fGVxRVzAdFAVJQJhMBrQfutpwuRFiax+EyhplC7rXAmSaDkBBi4uSlHS/8sToBc4jVm9TrKiMh/fz ojbyF03UYFcXRVwUhBjbOeRHx8UoDgmQyG4UZRff04XNFIxN0+zB5mzUHYYdhJhaKvDc=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRf7-008sMu-Va for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:37 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWM-Cz; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1858 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:10 +0100 Message-Id: <20181121101019.1801-5-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 TIME_LIMIT_EXCEEDED Exceeded time limit / deadline X-Headers-End: 1gPRf7-008sMu-Va Subject: [Openvpn-devel] [PATCH v4 04/13] client-connect: Refactor to use return values instead of modifying a passed-in flag X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Fabian Knittel This patch changes the way the client-connect helper functions communicate with the main function. Instead of updating cc_succeeded and cc_succeeded_count, they now return either CC_RET_SUCCEEDED, CC_RET_FAILED or CC_RET_SKIPPED. In addition, the client-connect helpers are now called in completely identical ways. This is in preparation of handling the helpers as simple call-backs. Signed-off-by: Fabian Knittel Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 126 +++++++++++++++++++++++++++----------------- src/openvpn/multi.h | 10 ++++ 2 files changed, 87 insertions(+), 49 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index bc9fddce..4182b553 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -1706,20 +1706,21 @@ multi_client_connect_post_plugin(struct multi_context *m, #endif /* ifdef ENABLE_PLUGIN */ -#ifdef MANAGEMENT_DEF_AUTH + /* * Called to load management-derived client-connect config */ -static void +enum client_connect_return multi_client_connect_mda(struct multi_context *m, struct multi_instance *mi, unsigned int *option_types_found) { + enum client_connect_return ret = CC_RET_SKIPPED; +#ifdef MANAGEMENT_DEF_AUTH if (mi->cc_config) { struct buffer_entry *be; - for (be = mi->cc_config->head; be != NULL; be = be->next) { const char *opt = BSTR(&be->buf); @@ -1739,10 +1740,12 @@ multi_client_connect_mda(struct multi_context *m, */ multi_select_virtual_addr(m, mi); multi_set_virtual_addr_env(m, mi); - } -} + ret = CC_RET_SUCCEEDED; + } #endif /* ifdef MANAGEMENT_DEF_AUTH */ + return ret; +} static void multi_client_connect_setenv(struct multi_context *m, @@ -1769,19 +1772,16 @@ multi_client_connect_setenv(struct multi_context *m, gc_free(&gc); } -static void +static enum client_connect_return multi_client_connect_call_plugin_v1(struct multi_context *m, struct multi_instance *mi, - unsigned int *option_types_found, - int *cc_succeeded, - int *cc_succeeded_count) + unsigned int *option_types_found) { + enum client_connect_return ret = CC_RET_SKIPPED; #ifdef ENABLE_PLUGIN ASSERT(m); ASSERT(mi); ASSERT(option_types_found); - ASSERT(cc_succeeded); - ASSERT(cc_succeeded_count); /* deprecated callback, use a file for passing back return info */ if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT)) @@ -1793,7 +1793,7 @@ multi_client_connect_call_plugin_v1(struct multi_context *m, if (!dc_file) { - cc_succeeded = false; + ret = CC_RET_FAILED; goto cleanup; } @@ -1803,12 +1803,12 @@ multi_client_connect_call_plugin_v1(struct multi_context *m, != OPENVPN_PLUGIN_FUNC_SUCCESS) { msg(M_WARN, "WARNING: client-connect plugin call failed"); - *cc_succeeded = false; + ret = CC_RET_FAILED; } else { multi_client_connect_post(m, mi, dc_file, option_types_found); - (*cc_succeeded_count)++; + ret = CC_RET_SUCCEEDED; } { @@ -1821,21 +1821,19 @@ cleanup: gc_free(&gc); } #endif /* ifdef ENABLE_PLUGIN */ + return ret; } -static void +static enum client_connect_return multi_client_connect_call_plugin_v2(struct multi_context *m, struct multi_instance *mi, - unsigned int *option_types_found, - int *cc_succeeded, - int *cc_succeeded_count) + unsigned int *option_types_found) { + enum client_connect_return ret = CC_RET_SKIPPED; #ifdef ENABLE_PLUGIN ASSERT(m); ASSERT(mi); ASSERT(option_types_found); - ASSERT(cc_succeeded); - ASSERT(cc_succeeded_count); /* V2 callback, use a plugin_return struct for passing back return info */ if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2)) @@ -1849,17 +1847,18 @@ multi_client_connect_call_plugin_v2(struct multi_context *m, != OPENVPN_PLUGIN_FUNC_SUCCESS) { msg(M_WARN, "WARNING: client-connect-v2 plugin call failed"); - *cc_succeeded = false; + ret = CC_RET_FAILED; } else { multi_client_connect_post_plugin(m, mi, &pr, option_types_found); - (*cc_succeeded_count)++; + ret = CC_RET_SUCCEEDED; } plugin_return_free(&pr); } #endif /* ifdef ENABLE_PLUGIN */ + return ret; } @@ -1867,13 +1866,12 @@ multi_client_connect_call_plugin_v2(struct multi_context *m, /** * Runs the --client-connect script if one is defined. */ -static void +static enum client_connect_return multi_client_connect_call_script(struct multi_context *m, struct multi_instance *mi, - unsigned int *option_types_found, - int *cc_succeeded, - int *cc_succeeded_count) + unsigned int *option_types_found) { + enum client_connect_return ret = CC_RET_SKIPPED; if (mi->context.options.client_connect_script) { struct argv argv = argv_new(); @@ -1886,7 +1884,7 @@ multi_client_connect_call_script(struct multi_context *m, "cc", &gc); if (!dc_file) { - *cc_succeeded = false; + ret = CC_RET_FAILED; goto cleanup; } @@ -1896,11 +1894,11 @@ multi_client_connect_call_script(struct multi_context *m, if (openvpn_run_script(&argv, mi->context.c2.es, 0, "--client-connect")) { multi_client_connect_post(m, mi, dc_file, option_types_found); - (*cc_succeeded_count)++; + ret = CC_RET_SUCCEEDED; } else { - *cc_succeeded = false; + ret = CC_RET_FAILED; } if (!platform_unlink(dc_file)) @@ -1912,6 +1910,7 @@ cleanup: argv_reset(&argv); gc_free(&gc); } + return ret; } static void @@ -2046,18 +2045,18 @@ multi_client_connect_early_setup(struct multi_context *m, multi_select_virtual_addr(m, mi); multi_client_connect_setenv(m, mi); - } /** * Try to source a dynamic config file from the * --client-config-dir directory. */ -static void +enum client_connect_return multi_client_connect_source_ccd(struct multi_context *m, struct multi_instance *mi, unsigned int *option_types_found) { + enum client_connect_return ret = CC_RET_SKIPPED; if (mi->context.options.client_config_dir) { struct gc_arena gc = gc_new(); @@ -2099,9 +2098,35 @@ multi_client_connect_source_ccd(struct multi_context *m, multi_select_virtual_addr(m, mi); multi_client_connect_setenv(m, mi); + + ret = CC_RET_SUCCEEDED; } gc_free(&gc); } + return ret; +} + +static inline bool +cc_check_return(int *cc_succeeded_count, + enum client_connect_return ret) +{ + if (ret == CC_RET_SUCCEEDED) + { + (*cc_succeeded_count)++; + return true; + } + else if (ret == CC_RET_FAILED) + { + return false; + } + else if (ret == CC_RET_SKIPPED) + { + return true; + } + else + { + ASSERT(0); + } } /* @@ -2123,38 +2148,41 @@ multi_connection_established(struct multi_context *m, struct multi_instance *mi) int cc_succeeded = true; /* client connect script status */ int cc_succeeded_count = 0; + enum client_connect_return ret; multi_client_connect_early_setup(m, mi); - multi_client_connect_source_ccd(m, mi, &option_types_found); - - multi_client_connect_call_plugin_v1(m, mi, &option_types_found, - &cc_succeeded, - &cc_succeeded_count); + ret = multi_client_connect_source_ccd(m, mi, &option_types_found); + cc_succeeded = cc_check_return(&cc_succeeded_count, ret); + if (cc_succeeded) + { + ret = multi_client_connect_call_plugin_v1(m, mi, + &option_types_found); + cc_succeeded = cc_check_return(&cc_succeeded_count, ret); + } - multi_client_connect_call_plugin_v2(m, mi, &option_types_found, - &cc_succeeded, - &cc_succeeded_count); + if (cc_succeeded) + { + ret = multi_client_connect_call_plugin_v2(m, mi, + &option_types_found); + cc_succeeded = cc_check_return(&cc_succeeded_count, ret); + } /* * Check for client-connect script left by management interface client */ - if (cc_succeeded) { - multi_client_connect_call_script(m, mi, &option_types_found, - &cc_succeeded, - &cc_succeeded_count); - + ret = multi_client_connect_call_script(m, mi, &option_types_found); + cc_succeeded = cc_check_return(&cc_succeeded_count, ret); } -#ifdef MANAGEMENT_DEF_AUTH - if (cc_succeeded && mi->cc_config) + + if (cc_succeeded) { - multi_client_connect_mda(m, mi, &option_types_found); - cc_succeeded_count++; + ret = multi_client_connect_mda(m, mi, &option_types_found); + cc_succeeded = cc_check_return(&cc_succeeded_count, ret); } -#endif /* * Check for "disable" directive in client-config-dir file diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h index 489c073a..0a1ab2c3 100644 --- a/src/openvpn/multi.h +++ b/src/openvpn/multi.h @@ -191,6 +191,16 @@ struct multi_context { struct deferred_signal_schedule_entry deferred_shutdown_signal; }; +/** + * Return values used by the client connect call-back functions. + */ +enum client_connect_return +{ + CC_RET_FAILED, + CC_RET_SUCCEEDED, + CC_RET_SKIPPED +}; + /* * Host route */ From patchwork Tue Nov 20 23:10:11 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 611 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director7.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id +KsFBj5Q9VtNYQAAIUCqbw for ; Wed, 21 Nov 2018 07:31:58 -0500 Received: from proxy13.mail.ord1d.rsapps.net ([172.30.191.6]) by director7.mail.ord1d.rsapps.net with LMTP id MJ3/BT5Q9Vu4JAAAovjBpQ ; Wed, 21 Nov 2018 07:31:58 -0500 Received: from smtp37.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy13.mail.ord1d.rsapps.net with LMTP id KNe+BT5Q9VtcNgAAgjf6aA ; Wed, 21 Nov 2018 07:31:58 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp37.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 6ea462ec-ed89-11e8-bd54-525400a11cf3-1-1 Received: from [216.105.38.7] ([216.105.38.7:60970] helo=lists.sourceforge.net) by smtp37.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 48/F9-18017-C3055FB5; Wed, 21 Nov 2018 07:31:56 -0500 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPReu-0003WS-Vv; Wed, 21 Nov 2018 12:31:08 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRet-0003WA-9G for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:07 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=tIpCUeRA/OgER3lEHeiYP6t7WAIYh+VD9tjSPAOlzoU=; b=RAr7g9wtWTCtsblTYOP7VYYPb5 ThgzjwSodHWoFu7gs66Bh+JTXeGkGAn7xgpPe6+b8ZEAjCdPCuYMn3AAkB5Q3s2p8gPct7zMPSgfV IOGfHH+k3VMC5VaPmiu4gA1vksKQ/H1ferSh3XZdTBTO7YHB9wZg5Yv45Z9gSwR8+dc4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=tIpCUeRA/OgER3lEHeiYP6t7WAIYh+VD9tjSPAOlzoU=; b=kdWICKUc91plXTF/NHlECTGv5G oZAD72Jx7nGbRYlkqK4RE51DP3hVXs22oIHUAB9L6HQUy8s0utOn8FBhcFMPTsGM29woAV4bdqoba AHpP54g6hld8lRVt5Rf7HgYPsX8gOHEBwxDdP8ZdSnwTxxK57e+noCCxemZJ5w4osrVs=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRel-008sMu-Im for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:07 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWP-F5; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1861 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:11 +0100 Message-Id: <20181121101019.1801-6-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPRel-008sMu-Im Subject: [Openvpn-devel] [PATCH v4 05/13] client-connect: Refactor client-connect handling to calling a bunch of hooks in a loop X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Fabian Knittel This patch changes the calling of the client-connect functions into an array of hooks and a block of code that calls them in a loop. Signed-off-by: Fabian Knittel Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 44 ++++++++++++++++---------------------------- 1 file changed, 16 insertions(+), 28 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 4182b553..18a1313e 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -2144,6 +2144,20 @@ multi_connection_established(struct multi_context *m, struct multi_instance *mi) if (tls_authentication_status(mi->context.c2.tls_multi, 0) == TLS_AUTHENTICATION_SUCCEEDED) { + typedef enum client_connect_return + (*multi_client_connect_handler) + (struct multi_context *m, struct multi_instance *mi, + unsigned int *option_types_found); + + multi_client_connect_handler handlers[] = { + multi_client_connect_source_ccd, + multi_client_connect_call_plugin_v1, + multi_client_connect_call_plugin_v2, + multi_client_connect_call_script, + multi_client_connect_mda, + NULL + }; + unsigned int option_types_found = 0; int cc_succeeded = true; /* client connect script status */ @@ -2152,35 +2166,9 @@ multi_connection_established(struct multi_context *m, struct multi_instance *mi) multi_client_connect_early_setup(m, mi); - ret = multi_client_connect_source_ccd(m, mi, &option_types_found); - cc_succeeded = cc_check_return(&cc_succeeded_count, ret); - - if (cc_succeeded) - { - ret = multi_client_connect_call_plugin_v1(m, mi, - &option_types_found); - cc_succeeded = cc_check_return(&cc_succeeded_count, ret); - } - - if (cc_succeeded) - { - ret = multi_client_connect_call_plugin_v2(m, mi, - &option_types_found); - cc_succeeded = cc_check_return(&cc_succeeded_count, ret); - } - - /* - * Check for client-connect script left by management interface client - */ - if (cc_succeeded) - { - ret = multi_client_connect_call_script(m, mi, &option_types_found); - cc_succeeded = cc_check_return(&cc_succeeded_count, ret); - } - - if (cc_succeeded) + for (int i = 0; cc_succeeded && handlers[i]; i++) { - ret = multi_client_connect_mda(m, mi, &option_types_found); + ret = handlers[i](m, mi, &option_types_found); cc_succeeded = cc_check_return(&cc_succeeded_count, ret); } From patchwork Tue Nov 20 23:10:12 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 618 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director11.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id YFI8Fn1Q9VuJCwAAIUCqbw for ; Wed, 21 Nov 2018 07:33:01 -0500 Received: from proxy1.mail.ord1d.rsapps.net ([172.30.191.6]) by director11.mail.ord1d.rsapps.net with LMTP id UNv1FX1Q9VtGMQAAvGGmqA ; Wed, 21 Nov 2018 07:33:01 -0500 Received: from smtp2.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy1.mail.ord1d.rsapps.net with LMTP id qIK1FX1Q9VtHRQAAasrz9Q ; Wed, 21 Nov 2018 07:33:01 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp2.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 9505f702-ed89-11e8-a269-5254004a0287-1-1 Received: from [216.105.38.7] ([216.105.38.7:55155] helo=lists.sourceforge.net) by smtp2.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id D0/56-06426-C7055FB5; Wed, 21 Nov 2018 07:33:00 -0500 Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRfz-0004Wm-5x; Wed, 21 Nov 2018 12:32:15 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRfy-0004Wa-8k for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:32:14 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=2Aw8tW3Nd86R5FSH0uRrQXy3F1Xe1sK12+2mIJogAOg=; b=OlIrNOPRUQCm9ONBYyOuX2iPFi 1Qi8jnBBd7OskT7LVRymK4Y7IFpT7EPIku7e9M0GpNugpDnZNtg1hc2R3ESCQQcTWF25u4C+wBxBI 9yZ0aB3thTYEXHfXMPNKCJYmHv5ZtHuOPDZczlI1X5zNzbwG7wtnAm0nnAjG0yVOfzX4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=2Aw8tW3Nd86R5FSH0uRrQXy3F1Xe1sK12+2mIJogAOg=; b=XjbGjFBWf7BloouYRqs1Qco61M gGmhMzDLAKq6mJIKUYsYLfzxq6R0C4Ymn9ZtP36236818+9y/dKdVGsA8ATVHMkubM7zZVA3fbvBV mmlfbFhMzHMWfRWMGdgEoY37dL+1ySZyDGdfvNl1wn8UJc2HG5vHsoVAgDibGysHKrzQ=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRfw-008sMu-NY for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:32:14 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWS-Gw for openvpn-devel@lists.sourceforge.net; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1864 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:12 +0100 Message-Id: <20181121101019.1801-7-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPRfw-008sMu-NY Subject: [Openvpn-devel] [PATCH v4 06/13] client-connect: Change connection_established_flag from bool to enum X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox This prepares from the yes/no logic to a tristate logic with defered being the third state. This deviates from Fabian's original patch that that used a pointer being NULL or non NULL as implicit third state. Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 14 ++++++++------ src/openvpn/multi.h | 14 ++++++++++---- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 18a1313e..1093d8aa 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -574,7 +574,8 @@ static void multi_client_disconnect_script(struct multi_context *m, struct multi_instance *mi) { - if ((mi->context.c2.context_auth == CAS_SUCCEEDED && mi->connection_established_flag) + if ((mi->context.c2.context_auth == CAS_SUCCEEDED + && mi->client_connect_status == CC_STATUS_ESTABLISHED) || mi->context.c2.context_auth == CAS_PARTIAL) { multi_client_disconnect_setenv(m, mi); @@ -2051,7 +2052,7 @@ multi_client_connect_early_setup(struct multi_context *m, * Try to source a dynamic config file from the * --client-config-dir directory. */ -enum client_connect_return +static enum client_connect_return multi_client_connect_source_ccd(struct multi_context *m, struct multi_instance *mi, unsigned int *option_types_found) @@ -2196,7 +2197,7 @@ multi_connection_established(struct multi_context *m, struct multi_instance *mi) } /* set flag so we don't get called again */ - mi->connection_established_flag = true; + mi->client_connect_status = CC_STATUS_ESTABLISHED; /* increment number of current authenticated clients */ ++m->n_clients; @@ -2479,7 +2480,8 @@ multi_process_post(struct multi_context *m, struct multi_instance *mi, const uns { /* connection is "established" when SSL/TLS key negotiation succeeds * and (if specified) auth user/pass succeeds */ - if (!mi->connection_established_flag && CONNECTION_ESTABLISHED(&mi->context)) + if (mi->client_connect_status != CC_STATUS_ESTABLISHED + && CONNECTION_ESTABLISHED(&mi->context)) { multi_connection_established(m, mi); } @@ -3385,7 +3387,7 @@ management_client_auth(void *arg, { if (auth) { - if (!mi->connection_established_flag) + if (mi->client_connect_status == CC_STATUS_NOT_ESTABLISHED) { set_cc_config(mi, cc_config); cc_config_owned = false; @@ -3397,7 +3399,7 @@ management_client_auth(void *arg, { msg(D_MULTI_LOW, "MULTI: connection rejected: %s, CLI:%s", reason, np(client_reason)); } - if (mi->connection_established_flag) + if (mi->client_connect_status == CC_STATUS_ESTABLISHED) { send_auth_failed(&mi->context, client_reason); /* mid-session reauth failed */ multi_schedule_context_wakeup(m, mi); diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h index 0a1ab2c3..bd4882ea 100644 --- a/src/openvpn/multi.h +++ b/src/openvpn/multi.h @@ -63,6 +63,12 @@ struct deferred_signal_schedule_entry struct timeval wakeup; }; +enum client_connect_status +{ + CC_STATUS_NOT_ESTABLISHED, + CC_STATUS_ESTABLISHED +}; + /** * Server-mode state structure for one single VPN tunnel. * @@ -105,7 +111,7 @@ struct multi_instance { bool did_cid_hash; struct buffer_list *cc_config; #endif - bool connection_established_flag; + enum client_connect_status client_connect_status; bool did_iroutes; int n_clients_delta; /* added to multi_context.n_clients when instance is closed */ @@ -196,9 +202,9 @@ struct multi_context { */ enum client_connect_return { - CC_RET_FAILED, - CC_RET_SUCCEEDED, - CC_RET_SKIPPED + CC_RET_FAILED, + CC_RET_SUCCEEDED, + CC_RET_SKIPPED }; /* From patchwork Tue Nov 20 23:10:13 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 620 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director9.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id aOJ/F6lQ9VsKSAAAIUCqbw for ; Wed, 21 Nov 2018 07:33:45 -0500 Received: from proxy15.mail.ord1d.rsapps.net ([172.30.191.6]) by director9.mail.ord1d.rsapps.net with LMTP id kDBkF6lQ9Vt3TAAAalYnBA ; Wed, 21 Nov 2018 07:33:45 -0500 Received: from smtp3.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy15.mail.ord1d.rsapps.net with LMTP id KA41F6lQ9VthDQAAAY1PeQ ; Wed, 21 Nov 2018 07:33:45 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp3.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: af80cdfa-ed89-11e8-a0cf-5254006d4589-1-1 Received: from [216.105.38.7] ([216.105.38.7:28283] helo=lists.sourceforge.net) by smtp3.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id A9/34-05889-8A055FB5; Wed, 21 Nov 2018 07:33:45 -0500 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRgZ-0003gc-RB; Wed, 21 Nov 2018 12:32:51 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRgY-0003gO-Jv for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:32:50 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=gyfWjsg4o3F+qYLmtgEzfv9kGT2HnB9TnQ7CXvi0f3o=; b=EaIAynsTXl0nHkVU1CzUlIAFu/ 1U5K7Xw6swW0ulKLd8gX45rnHozq7clUOsi9sJJpdgicEa7Ex/EwAWPt5gVlJ+RBHvpKtYSvxakBq CKyYOQegvqfu49ANVFdlvL2w/ifV9XlgMke7MNAgjNYDlUFBSGa5wYgnzNwhiHgtq0Os=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=gyfWjsg4o3F+qYLmtgEzfv9kGT2HnB9TnQ7CXvi0f3o=; b=U49qcxK2i8oMxe3U3VK8DU589j TkUdvvPevJCANL21rSxzw1tEW4lDQTOAutCg0AcVgRSA2ti5G7XuiWUzvmVEFkJ0fb/k29JHroInA KVLo2uawLXi9JoWaXJsiJ5TQud3GvgXNfrs/WwWmD9oj25u9QhrDKnOZOusQuGQZHLcg=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRgJ-008sMu-Ca for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:32:50 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWg-Ig; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1867 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:13 +0100 Message-Id: <20181121101019.1801-8-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPRgJ-008sMu-Ca Subject: [Openvpn-devel] [PATCH v4 07/13] client-connect: Add CC_RET_DEFERRED and cope with deferred client-connect X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Fabian Knittel This patch moves the state, that was previously tracked within the multi_connection_established() function, into struct client_connect_state. The multi_connection_established() function can now be exited and re-entered as many times as necessary - without losing the client-connect handling state. The patch also adds the new return value CC_RET_DEFERRED which indicates that the handler couldn't complete immediately, and needs to be called later. At that point multi_connection_established() will exit without indicating completion. Each client-connect handler now has an (optional) additional call-back: The call-back for handling the deferred case. If the main call-back returns CC_RET_DEFERRED, the next call to the handler will be through the deferred call-back. Signed-off-by: Fabian Knittel Patch V3: Use a static struct in multi_instance instead of using malloc/free and use two states (deffered with and without result) instead of one to eliminate the counter that was only tested for > 0. Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 159 +++++++++++++++++++++++++++++++++----------- src/openvpn/multi.h | 18 ++++- 2 files changed, 137 insertions(+), 40 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 1093d8aa..e333476d 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -2107,28 +2107,51 @@ multi_client_connect_source_ccd(struct multi_context *m, return ret; } -static inline bool -cc_check_return(int *cc_succeeded_count, - enum client_connect_return ret) +typedef enum client_connect_return (*client_connect_handler) + (struct multi_context *m, struct multi_instance *mi, + unsigned int *option_types_found); + +struct client_connect_handlers +{ + client_connect_handler main; + client_connect_handler deferred; +}; + +static enum client_connect_return +multi_client_connect_fail(struct multi_context *m, struct multi_instance *mi, + unsigned int *option_types_found) { - if (ret == CC_RET_SUCCEEDED) + /* Called null call-back. This should never happen. */ + return CC_RET_FAILED; +} + +static const struct client_connect_handlers client_connect_handlers[] = { { - (*cc_succeeded_count)++; - return true; - } - else if (ret == CC_RET_FAILED) + .main = multi_client_connect_source_ccd, + .deferred = multi_client_connect_fail + }, { - return false; - } - else if (ret == CC_RET_SKIPPED) + .main = multi_client_connect_call_plugin_v1, + .deferred = multi_client_connect_fail + }, { - return true; - } - else + .main = multi_client_connect_call_plugin_v2, + .deferred = multi_client_connect_fail + }, { - ASSERT(0); + .main = multi_client_connect_call_script, + .deferred = multi_client_connect_fail + }, + { + .main = multi_client_connect_mda, + .deferred = multi_client_connect_fail + }, + { + .main = NULL, + .deferred = NULL + /* End of list sentinel. */ } -} +}; /* * Called as soon as the SSL/TLS connection authenticates. @@ -2145,32 +2168,86 @@ multi_connection_established(struct multi_context *m, struct multi_instance *mi) if (tls_authentication_status(mi->context.c2.tls_multi, 0) == TLS_AUTHENTICATION_SUCCEEDED) { - typedef enum client_connect_return - (*multi_client_connect_handler) - (struct multi_context *m, struct multi_instance *mi, - unsigned int *option_types_found); + bool from_deferred; - multi_client_connect_handler handlers[] = { - multi_client_connect_source_ccd, - multi_client_connect_call_plugin_v1, - multi_client_connect_call_plugin_v2, - multi_client_connect_call_script, - multi_client_connect_mda, - NULL - }; + enum client_connect_return ret; - unsigned int option_types_found = 0; + struct client_connect_defer_state *defer_state = + &(mi->client_connect_defer_state); - int cc_succeeded = true; /* client connect script status */ - int cc_succeeded_count = 0; - enum client_connect_return ret; + /* We are called for the first time */ + if (mi->client_connect_status == CC_STATUS_NOT_ESTABLISHED) + { + defer_state->cur_handler_index = 0; + defer_state->option_types_found = 0; + /* Initially we have no handler that has returned a result */ + mi->client_connect_status = CC_STATUS_DEFERRED_NO_RESULT; + from_deferred = false; + } + else + { + from_deferred = true; + } multi_client_connect_early_setup(m, mi); - for (int i = 0; cc_succeeded && handlers[i]; i++) + bool cc_succeeded = true; + + while (cc_succeeded + && client_connect_handlers[defer_state->cur_handler_index] + .main != NULL) { - ret = handlers[i](m, mi, &option_types_found); - cc_succeeded = cc_check_return(&cc_succeeded_count, ret); + client_connect_handler handler; + if (from_deferred) + { + handler = client_connect_handlers + [defer_state->cur_handler_index].deferred; + from_deferred = false; + } + else + { + handler = client_connect_handlers + [defer_state->cur_handler_index].main; + } + + ret = handler(m, mi, &(defer_state->option_types_found)); + if (ret == CC_RET_SUCCEEDED) + { + /* + * Remember that we already had at least one handler + * returning a result should go to into defered state + */ + mi->client_connect_status = CC_STATUS_DEFERRED_RESULT; + } + else if (ret == CC_RET_SKIPPED) + { + /* + * Move on with the next handler without modifying any + * other state + */ + } + else if (ret == CC_RET_DEFERRED) + { + /* + * we already set client_connect_status to DEFERRED_RESULT or + * DEFERRED_NO_RESULT and increased index. We just return + * from the function as having client_connect_status + */ + return; + } + else if (ret == CC_RET_FAILED) + { + /* + * One handler failed. We abort the chain and set the final + * result to failed + */ + cc_succeeded = false; + } + else + { + ASSERT(0); + } + (defer_state->cur_handler_index)++; } /* @@ -2182,21 +2259,25 @@ multi_connection_established(struct multi_context *m, struct multi_instance *mi) msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to" "'disable' directive"); cc_succeeded = false; - cc_succeeded_count = 0; } if (cc_succeeded) { - multi_client_connect_late_setup(m, mi, option_types_found); + multi_client_connect_late_setup(m, mi, + mi->client_connect_defer_state. + option_types_found); + } else { + bool at_least_one_cc_succeeded = + (mi->client_connect_status == CC_STATUS_DEFERRED_RESULT); /* set context-level authentication flag */ mi->context.c2.context_auth = - cc_succeeded_count ? CAS_PARTIAL : CAS_FAILED; + at_least_one_cc_succeeded ? CAS_PARTIAL : CAS_FAILED; } - /* set flag so we don't get called again */ + /* set flag so we do not get called again */ mi->client_connect_status = CC_STATUS_ESTABLISHED; /* increment number of current authenticated clients */ diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h index bd4882ea..252b1d3d 100644 --- a/src/openvpn/multi.h +++ b/src/openvpn/multi.h @@ -63,9 +63,24 @@ struct deferred_signal_schedule_entry struct timeval wakeup; }; +/** + * Detached client connection state. This is the state that is tracked while + * the client connect hooks are executed. + */ +struct client_connect_defer_state +{ + /* Index of currently executed handler. */ + int cur_handler_index; + /* Remember which option classes where processed for delayed option + * handling. */ + unsigned int option_types_found; +}; + enum client_connect_status { CC_STATUS_NOT_ESTABLISHED, + CC_STATUS_DEFERRED_NO_RESULT, + CC_STATUS_DEFERRED_RESULT, CC_STATUS_ESTABLISHED }; @@ -117,7 +132,7 @@ struct multi_instance { struct context context; /**< The context structure storing state * for this VPN tunnel. */ - + struct client_connect_defer_state client_connect_defer_state; #ifdef ENABLE_ASYNC_PUSH int inotify_watch; /* watch descriptor for acf */ #endif @@ -204,6 +219,7 @@ enum client_connect_return { CC_RET_FAILED, CC_RET_SUCCEEDED, + CC_RET_DEFERRED, CC_RET_SKIPPED }; From patchwork Tue Nov 20 23:10:14 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 614 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director9.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id SLMdI2hQ9VveGQAAIUCqbw for ; Wed, 21 Nov 2018 07:32:40 -0500 Received: from proxy18.mail.ord1d.rsapps.net ([172.30.191.6]) by director9.mail.ord1d.rsapps.net with LMTP id GCL4ImhQ9VsOVQAAalYnBA ; Wed, 21 Nov 2018 07:32:40 -0500 Received: from smtp12.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy18.mail.ord1d.rsapps.net with LMTP id 0ILVImhQ9Vv1LAAATCaURg ; Wed, 21 Nov 2018 07:32:40 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp12.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 88bd0c74-ed89-11e8-a7aa-52540070b731-1-1 Received: from [216.105.38.7] ([216.105.38.7:58206] helo=lists.sourceforge.net) by smtp12.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 8C/56-22334-76055FB5; Wed, 21 Nov 2018 07:32:40 -0500 Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRfZ-0004SX-S3; Wed, 21 Nov 2018 12:31:49 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRfY-0004SG-LA for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:48 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=XnE/lMI9wfWSI5nIBW6JaQ0z2BN4MKLIFOAdPe2cED8=; b=OSgtxM/zOWr/cQFgxcwRuDOvNL 992cmwnheoURMfUJV9gU2I9Sd4PFgcD982BIBq3kGlJHDrhgWl8IcZuJ3bbbb064KYqkP+CApnHZO AEuwRDHILVxh+lcz38aVRdKbrNJsoz0hCRwNf7Ko1ewXV6np87o3P45VN3yXKO6FwIkg=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=XnE/lMI9wfWSI5nIBW6JaQ0z2BN4MKLIFOAdPe2cED8=; b=DiKGfaPCUzbpi++pa/NCbOFJuE jsjhlV0AxWmYjAW1K3N+bgUA9vQEniMF540AHwgI+T+/HPAPRyCrCw2DABkl+UI2HrMlHalJf/isV UNwoy1+cSA7eVQpvzOHE8U9bv60tor3WM9r9DFjU6ueK+dEQ3MuCpZw4sH6h46/kq6AA=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRfQ-008sMu-FV for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:48 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWl-L5; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1870 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:14 +0100 Message-Id: <20181121101019.1801-9-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPRfQ-008sMu-FV Subject: [Openvpn-devel] [PATCH v4 08/13] client-connect: Add deferred support to the client-connect script handler X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Fabian Knittel This patch introduces the concept of a return value file for the client-connect handlers. (This is very similar to the auth value file used during deferred authentication.) The file name is stored in the client_connect_state struct. In addition, the patch also allows the storage of the client config file name in struct client_connect_state. Both changes are used by the client-connect script handler to support deferred client-connection handling. The deferred return value file (deferred_ret_file) is passed to the actual script via the environment. If the script succeeds and writes the value for deferral into the deferred_ret_file, the handler knows to indicate deferral. Later on, the deferred handler checks whether the value of the deferred_ret_file has been updated to success or failure. Signed-off-by: Fabian Knittel Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 232 +++++++++++++++++++++++++++++++++++++++++--- src/openvpn/multi.h | 12 +++ 2 files changed, 229 insertions(+), 15 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index e333476d..df6e4610 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -1773,6 +1773,168 @@ multi_client_connect_setenv(struct multi_context *m, gc_free(&gc); } +/** + * Delete the temporary file for the return value of client connect + * It also removes it from it from client_connect_defer_state and + * environment + */ +static void +ccs_delete_deferred_ret_file(struct multi_instance *mi) +{ + struct client_connect_defer_state *ccs = &(mi->client_connect_defer_state); + if (ccs->deferred_ret_file) + { + setenv_del(mi->context.c2.es, "client_connect_deferred_file"); + if (!platform_unlink(ccs->deferred_ret_file)) + { + msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", + ccs->deferred_ret_file); + } + free(ccs->deferred_ret_file); + ccs->deferred_ret_file = NULL; + } +} + +/** + * Create a temporary file for the return value of client connect + * and puts it into the client_connect_defer_state and environment + * as "client_connect_deferred_file" + * + * @return boolean value if creation was successfull + */ +static bool +ccs_gen_deferred_ret_file(struct multi_instance *mi) +{ + struct client_connect_defer_state *ccs = &(mi->client_connect_defer_state); + struct gc_arena gc = gc_new(); + const char *fn; + + if (ccs->deferred_ret_file) + { + ccs_delete_deferred_ret_file(mi); + } + + fn = platform_create_temp_file(mi->context.options.tmp_dir, "ccr", &gc); + if (!fn) + { + gc_free(&gc); + return false; + } + ccs->deferred_ret_file = string_alloc(fn, NULL); + + setenv_str(mi->context.c2.es, "client_connect_deferred_file", + ccs->deferred_ret_file); + + gc_free(&gc); + return true; +} + +/** + * Tests whether the deferred return value file exists and returns the + * contained return value. + * + * @return CC_RET_SKIPPED if the file does not exist or is empty. + * CC_RET_DEFERRED, CC_RET_SUCCEEDED or CC_RET_FAILED depending on + * the value stored in the file. + */ +static enum client_connect_return +ccs_test_deferred_ret_file(struct multi_instance *mi) +{ + struct client_connect_defer_state *ccs = &(mi->client_connect_defer_state); + enum client_connect_return ret = CC_RET_SKIPPED; + FILE *fp = fopen(ccs->deferred_ret_file, "r"); + if (fp) + { + const int c = fgetc(fp); + switch (c) + { + case '0': + ret = CC_RET_FAILED; + break; + + case '1': + ret = CC_RET_SUCCEEDED; + break; + + case '2': + ret = CC_RET_DEFERRED; + break; + + case EOF: + if (feof(fp)) + { + ret = CC_RET_SKIPPED; + break; + } + + /* Not EOF, but other error fall through to error state */ + default: + /* We received an unknown/unexpected value. Assume failure. */ + msg(M_WARN, "WARNING: Unknown/unexcepted value in deferred" + "client-connect resultfile"); + ret = CC_RET_FAILED; + } + fclose(fp); + } + return ret; +} + +/** + * Deletes the temporary file for the config directives of the client connect + * script and removes it into the client_connect_defer_state and environment + * + */ +static void +ccs_delete_config_file(struct multi_instance *mi) +{ + struct client_connect_defer_state *ccs = &(mi->client_connect_defer_state); + if (ccs->config_file) + { + setenv_del(mi->context.c2.es, "client_connect_config_file"); + if (!platform_unlink(ccs->config_file)) + { + msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", + ccs->config_file); + } + free(ccs->config_file); + ccs->config_file = NULL; + } +} + +/** + * Create a temporary file for the config directives of the client connect + * script and puts it into the client_connect_defer_state and environment + * as "client_connect_config_file" + * + * @return boolean value if creation was successfull + */ +static bool +ccs_gen_config_file(struct multi_instance *mi) +{ + struct client_connect_defer_state *ccs = &(mi->client_connect_defer_state); + struct gc_arena gc = gc_new(); + const char *fn; + + if (ccs->config_file) + { + ccs_delete_config_file(mi); + } + + fn = platform_create_temp_file(mi->context.options.tmp_dir, "cc", &gc); + if (!fn) + { + gc_free(&gc); + return false; + } + ccs->config_file = string_alloc(fn, NULL); + + setenv_str(mi->context.c2.es, "client_connect_config_file", + ccs->config_file); + + gc_free(&gc); + return true; +} + static enum client_connect_return multi_client_connect_call_plugin_v1(struct multi_context *m, struct multi_instance *mi, @@ -1862,8 +2024,6 @@ multi_client_connect_call_plugin_v2(struct multi_context *m, return ret; } - - /** * Runs the --client-connect script if one is defined. */ @@ -1873,47 +2033,89 @@ multi_client_connect_call_script(struct multi_context *m, unsigned int *option_types_found) { enum client_connect_return ret = CC_RET_SKIPPED; + struct client_connect_defer_state *ccs = &(mi->client_connect_defer_state); + if (mi->context.options.client_connect_script) { struct argv argv = argv_new(); struct gc_arena gc = gc_new(); - const char *dc_file = NULL; setenv_str(mi->context.c2.es, "script_type", "client-connect"); - dc_file = platform_create_temp_file(mi->context.options.tmp_dir, - "cc", &gc); - if (!dc_file) + if (!ccs_gen_config_file(mi) + || !ccs_gen_deferred_ret_file(mi)) { ret = CC_RET_FAILED; goto cleanup; } argv_parse_cmd(&argv, mi->context.options.client_connect_script); - argv_printf_cat(&argv, "%s", dc_file); + argv_printf_cat(&argv, "%s", ccs->config_file); if (openvpn_run_script(&argv, mi->context.c2.es, 0, "--client-connect")) { - multi_client_connect_post(m, mi, dc_file, option_types_found); - ret = CC_RET_SUCCEEDED; + if (ccs_test_deferred_ret_file(mi) == CC_RET_DEFERRED) + { + ret = CC_RET_DEFERRED; + } + else + { + multi_client_connect_post(m, mi, ccs->config_file, + option_types_found); + ret = CC_RET_SUCCEEDED; + } } else { ret = CC_RET_FAILED; } - - if (!platform_unlink(dc_file)) +cleanup: + if (ret != CC_RET_DEFERRED) { - msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", - dc_file); + ccs_delete_config_file(mi); + ccs_delete_deferred_ret_file(mi); } -cleanup: argv_reset(&argv); gc_free(&gc); } return ret; } +static enum client_connect_return +multi_client_handle_deferred(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found) +{ + ASSERT(mi); + ASSERT(option_types_found); + struct client_connect_defer_state *ccs = &(mi->client_connect_defer_state); + enum client_connect_return ret = CC_RET_SKIPPED; + + ret = ccs_test_deferred_ret_file(mi); + + if (ret == CC_RET_SKIPPED) + { + /* + * Skipped and deferred are equivalent in this context. + * skipped means that the called program has not yet + * written a return status implicitly needing more time + * while deferred is the explicit notifcation that it + * needs more time + */ + ret = CC_RET_DEFERRED; + } + + if (ret != CC_RET_DEFERRED) + { + ccs_delete_deferred_ret_file(mi); + multi_client_connect_post(m, mi, ccs->config_file, + option_types_found); + ccs_delete_config_file(mi); + } + return ret; +} + + static void multi_client_connect_late_setup(struct multi_context *m, struct multi_instance *mi, @@ -2140,7 +2342,7 @@ static const struct client_connect_handlers client_connect_handlers[] = { }, { .main = multi_client_connect_call_script, - .deferred = multi_client_connect_fail + .deferred = multi_client_handle_deferred }, { .main = multi_client_connect_mda, diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h index 252b1d3d..c83323ce 100644 --- a/src/openvpn/multi.h +++ b/src/openvpn/multi.h @@ -74,6 +74,18 @@ struct client_connect_defer_state /* Remember which option classes where processed for delayed option * handling. */ unsigned int option_types_found; + + /** + * The temporrary file name that contains the return status of the + * client-connect script if it exits with defer as status + */ + char *deferred_ret_file; + + /** + * The temporary file name that contains the config directives + * returned by the client-connect script + */ + char *config_file; }; enum client_connect_status From patchwork Tue Nov 20 23:10:15 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 610 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director10.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id sHQfBzRQ9VtONAAAIUCqbw for ; Wed, 21 Nov 2018 07:31:48 -0500 Received: from proxy6.mail.ord1d.rsapps.net ([172.30.191.6]) by director10.mail.ord1d.rsapps.net with LMTP id +FYiBzRQ9VsQMQAApN4f7A ; Wed, 21 Nov 2018 07:31:48 -0500 Received: from smtp31.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy6.mail.ord1d.rsapps.net with LMTP id +Em8BjRQ9Vu6WgAAQyIf0w ; Wed, 21 Nov 2018 07:31:48 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp31.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 68d4fa20-ed89-11e8-9c65-525400b3ac8c-1-1 Received: from [216.105.38.7] ([216.105.38.7:6373] helo=lists.sourceforge.net) by smtp31.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 0E/61-23392-23055FB5; Wed, 21 Nov 2018 07:31:46 -0500 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRek-0006o7-3q; Wed, 21 Nov 2018 12:30:58 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRei-0006nq-Jf for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:30:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=xbLrpffVs+7UgwFCyfxsreciec6rtbH0k2be/D4TTVU=; b=JEgHg/b2h5kQn8hSlqwrEfgrZD /HZjcPclWFCSm9yw0Kt4hYVkxUSr8CgDSCdeZpcHNXzavXZ5sFonf0qSGwDhoBeYg24GOKwIm7ByJ XO/7i/Rwten906NJYzADGlvmXKa8PBOL3YDBLSK+ibexazBs5Ebp662i6VxWBx6crmpU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=xbLrpffVs+7UgwFCyfxsreciec6rtbH0k2be/D4TTVU=; b=BGZ2C3YOcU8Ks1oJ1m10FnydL2 98309n+KQ6fgpfk+Fzbq2vfQg2zNGrmFOmNBKBIcr25FR/WfbTs3zmM3QovILPtPAw2WqqP7ptSld UjMSwR/wycj2K6utiivmccfJa+BnBh9+te6BQ1j+Mho3YD3BXr4FjkbTSPKU1QHU3rtY=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPReh-008sMu-6O for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:30:56 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWq-ND for openvpn-devel@lists.sourceforge.net; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1873 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:15 +0100 Message-Id: <20181121101019.1801-10-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPReh-008sMu-6O Subject: [Openvpn-devel] [PATCH v4 09/13] client-connect: Move adding inotify watch into its own function X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox This make the code a bit better readable and also prepares resuing the function for client-connect return files Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 46 +++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index df6e4610..63d9db05 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -2710,6 +2710,32 @@ multi_schedule_context_wakeup(struct multi_context *m, struct multi_instance *mi compute_wakeup_sigma(&mi->context.c2.timeval)); } +#if defined(ENABLE_ASYNC_PUSH) && defined(ENABLE_DEF_AUTH) +static void +add_inotify_file_watch(struct multi_context *m, struct multi_instance *mi, + int inotify_fd, const char *file) +{ + /* watch acf file */ + long watch_descriptor = inotify_add_watch(inotify_fd, file, + IN_CLOSE_WRITE | IN_ONESHOT); + if (watch_descriptor >= 0) + { + if (mi->inotify_watch != -1) + { + hash_remove(m->inotify_watchers, + (void *) (unsigned long)mi->inotify_watch); + } + hash_add(m->inotify_watchers, (const uintptr_t *)watch_descriptor, + mi, true); + mi->inotify_watch = watch_descriptor; + } + else + { + msg(M_NONFATAL | M_ERRNO, "MULTI: inotify_add_watch error"); + } +} +#endif /* if defined(ENABLE_ASYNC_PUSH) && defined(ENABLE_DEF_AUTH) */ + /* * Figure instance-specific timers, convert * earliest to absolute time in mi->wakeup, @@ -2739,23 +2765,11 @@ multi_process_post(struct multi_context *m, struct multi_instance *mi, const uns pre_select(&mi->context); #if defined(ENABLE_ASYNC_PUSH) && defined(ENABLE_DEF_AUTH) - if (ks && ks->auth_control_file && ks->auth_deferred && !was_authenticated) + if (ks && ks->auth_control_file + && ks->auth_deferred && !was_authenticated) { - /* watch acf file */ - long watch_descriptor = inotify_add_watch(m->top.c2.inotify_fd, ks->auth_control_file, IN_CLOSE_WRITE | IN_ONESHOT); - if (watch_descriptor >= 0) - { - if (mi->inotify_watch != -1) - { - hash_remove(m->inotify_watchers, (void *) (unsigned long)mi->inotify_watch); - } - hash_add(m->inotify_watchers, (const uintptr_t *)watch_descriptor, mi, true); - mi->inotify_watch = watch_descriptor; - } - else - { - msg(M_NONFATAL | M_ERRNO, "MULTI: inotify_add_watch error"); - } + add_inotify_file_watch(m, mi, m->top.c2.inotify_fd, + ks->auth_control_file); } #endif From patchwork Tue Nov 20 23:10:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 615 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director8.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id UIOAJGpQ9VsKSAAAIUCqbw for ; Wed, 21 Nov 2018 07:32:42 -0500 Received: from proxy19.mail.ord1d.rsapps.net ([172.30.191.6]) by director8.mail.ord1d.rsapps.net with LMTP id UK9PJGpQ9VukHgAAfY0hYg ; Wed, 21 Nov 2018 07:32:42 -0500 Received: from smtp23.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy19.mail.ord1d.rsapps.net with LMTP id WOYVJGpQ9VvsagAAyH2SIw ; Wed, 21 Nov 2018 07:32:42 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp23.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 8a2e1e0e-ed89-11e8-80c4-525400bfb165-1-1 Received: from [216.105.38.7] ([216.105.38.7:46799] helo=lists.sourceforge.net) by smtp23.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 9D/D7-21557-A6055FB5; Wed, 21 Nov 2018 07:32:42 -0500 Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRff-0004Ti-VG; Wed, 21 Nov 2018 12:31:55 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRff-0004TX-5W for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:55 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=4oZ27F8IyDrIws50xx6f0v67EQPdTHJT12auQdVIWXw=; b=Vd1M1efJrHwXmMVfXqL9/oZpXH bBBZNB2Pbe3CkHulshrDhNcRRuDoqe5m8hOZXv0POWuNThj9sdiyXeYju+45gs9zj5HwikK+4Ge/m nzzT4hXllKOWPSCGb5+TDpTL0uIyb0mjeWPosbXnPeDA47uMHAFCgwqJ/wXmojIt5WJA=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=4oZ27F8IyDrIws50xx6f0v67EQPdTHJT12auQdVIWXw=; b=fiteWLD1Chu25Vijdl/EEfxV+c /HGxuXS2rtzhzq6gz1mB3sBgFBpWEssHS1DOt9oq+HP93dQHK0jIpqPDf+PDwVXRT5hsD08O+5kIT EOowxl0g8sPnvjoCbdB8gxL7s7JTguTt/q1bCv+HhRjRGouNKY4yTjzgwQ2iuwUSE5IY=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRfb-008sMu-MQ for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:31:55 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWu-P8 for openvpn-devel@lists.sourceforge.net; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1876 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:16 +0100 Message-Id: <20181121101019.1801-11-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPRfb-008sMu-MQ Subject: [Openvpn-devel] [PATCH v4 10/13] client-connect: Also use inotify for the deferred client-connect status file X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox As we never do client-connect and authentication at the same time it is safe to reuse the existing fields for client-connect return status file Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 63d9db05..09974357 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -2505,8 +2505,10 @@ multi_connection_established(struct multi_context *m, struct multi_instance *mi) #ifdef ENABLE_ASYNC_PUSH /* - * Called when inotify event is fired, which happens when acf file is closed or deleted. - * Continues authentication and sends push_reply. + * Called when inotify event is fired, which happens when acf + * or connect-status file is closed or deleted. + * Continues authentication and sends push_reply + * (or be deferred again by client-connect) */ void multi_process_file_closed(struct multi_context *m, const unsigned int mpp_flags) @@ -2782,7 +2784,15 @@ multi_process_post(struct multi_context *m, struct multi_instance *mi, const uns { multi_connection_established(m, mi); } - +#if defined(ENABLE_ASYNC_PUSH) && defined(ENABLE_DEF_AUTH) + if (mi->client_connect_status != CC_STATUS_ESTABLISHED + && mi->client_connect_defer_state.deferred_ret_file) + { + add_inotify_file_watch(m, mi, m->top.c2.inotify_fd, + mi->client_connect_defer_state. + deferred_ret_file); + } +#endif /* tell scheduler to wake us up at some point in the future */ multi_schedule_context_wakeup(m, mi); } From patchwork Tue Nov 20 23:10:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 609 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director7.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id GNSwMC9Q9VveGQAAIUCqbw for ; Wed, 21 Nov 2018 07:31:43 -0500 Received: from proxy1.mail.ord1d.rsapps.net ([172.30.191.6]) by director7.mail.ord1d.rsapps.net with LMTP id eNysMC9Q9VvVIgAAovjBpQ ; Wed, 21 Nov 2018 07:31:43 -0500 Received: from smtp40.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy1.mail.ord1d.rsapps.net with LMTP id CJEOMC9Q9VtRRQAAasrz9Q ; Wed, 21 Nov 2018 07:31:43 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp40.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 6665cc56-ed89-11e8-bd12-525400f204c2-1-1 Received: from [216.105.38.7] ([216.105.38.7:42484] helo=lists.sourceforge.net) by smtp40.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id B2/8B-11659-E2055FB5; Wed, 21 Nov 2018 07:31:42 -0500 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPRef-0003UK-TE; Wed, 21 Nov 2018 12:30:53 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPRee-0003UC-5f for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:30:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=gFO7oYJJRDpS/H5O4+5hkUDoSuuDsPVutWOK3npslbM=; b=iAK2ehkkT7yZxL0mU7RPJNCqJE wt286sRqZnA99dVtUJ4zrseFeqrOrPfdrmBN3uKn9sq7vklE6OT/s+P0LMXCbZq7yb4+PqKNrN7XQ 7tPjmU3XnjtJKY/WBM98skK+f2etzkICtxu+HLoEv+9scrwcwwK6saMsV88b953DJTZs=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=gFO7oYJJRDpS/H5O4+5hkUDoSuuDsPVutWOK3npslbM=; b=d8XbhEH7remQQkF8990CxeAj9m aBY/NnR1zIpsAxG4Ap8D6fC3LmOrwJ0KkII+r3rCtrePVF5cyc/Q3EIdclceiSsljKMNPWc86ISoI Y4KltNgCxncN2Kc8xR7yJXAcLPnNqX83p5nuSQ8DxQciROSLyZT1Ah0pm6idPkKe8Ob0=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPReY-008sMu-Eq for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:30:52 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GWy-Rr; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1879 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:17 +0100 Message-Id: <20181121101019.1801-12-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPReY-008sMu-Eq Subject: [Openvpn-devel] [PATCH v4 11/13] client-connect: Add deferred support to the client-connect plugin v1 handler X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox From: Fabian Knittel Uses the infrastructure provided and used in the previous patch to provide deferral support to the v1 client-connect plugin handler as well. Signed-off-by: Fabian Knittel PATCH V3: Modify the API to also (optionally) call the plugin on a deferred call. This allows the plugin authors to be more flexible and make the V1 API more similar to the V2 API. Signed-off-by: Arne Schwabe --- include/openvpn-plugin.h.in | 30 ++++++------ src/openvpn/multi.c | 97 ++++++++++++++++++++++++++++--------- src/openvpn/plugin.c | 3 ++ 3 files changed, 94 insertions(+), 36 deletions(-) diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in index 103844f7..38fbe097 100644 --- a/include/openvpn-plugin.h.in +++ b/include/openvpn-plugin.h.in @@ -116,20 +116,22 @@ extern "C" { * FUNC: openvpn_plugin_client_destructor_v1 (top-level "generic" client) * FUNC: openvpn_plugin_close_v1 */ -#define OPENVPN_PLUGIN_UP 0 -#define OPENVPN_PLUGIN_DOWN 1 -#define OPENVPN_PLUGIN_ROUTE_UP 2 -#define OPENVPN_PLUGIN_IPCHANGE 3 -#define OPENVPN_PLUGIN_TLS_VERIFY 4 -#define OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY 5 -#define OPENVPN_PLUGIN_CLIENT_CONNECT 6 -#define OPENVPN_PLUGIN_CLIENT_DISCONNECT 7 -#define OPENVPN_PLUGIN_LEARN_ADDRESS 8 -#define OPENVPN_PLUGIN_CLIENT_CONNECT_V2 9 -#define OPENVPN_PLUGIN_TLS_FINAL 10 -#define OPENVPN_PLUGIN_ENABLE_PF 11 -#define OPENVPN_PLUGIN_ROUTE_PREDOWN 12 -#define OPENVPN_PLUGIN_N 13 +#define OPENVPN_PLUGIN_UP 0 +#define OPENVPN_PLUGIN_DOWN 1 +#define OPENVPN_PLUGIN_ROUTE_UP 2 +#define OPENVPN_PLUGIN_IPCHANGE 3 +#define OPENVPN_PLUGIN_TLS_VERIFY 4 +#define OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY 5 +#define OPENVPN_PLUGIN_CLIENT_CONNECT 6 +#define OPENVPN_PLUGIN_CLIENT_DISCONNECT 7 +#define OPENVPN_PLUGIN_LEARN_ADDRESS 8 +#define OPENVPN_PLUGIN_CLIENT_CONNECT_V2 9 +#define OPENVPN_PLUGIN_TLS_FINAL 10 +#define OPENVPN_PLUGIN_ENABLE_PF 11 +#define OPENVPN_PLUGIN_ROUTE_PREDOWN 12 +#define OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER 13 +#define OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 14 +#define OPENVPN_PLUGIN_N 15 /* * Build a mask out of a set of plug-in types. diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 09974357..c14a21e4 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -1938,55 +1938,108 @@ ccs_gen_config_file(struct multi_instance *mi) static enum client_connect_return multi_client_connect_call_plugin_v1(struct multi_context *m, struct multi_instance *mi, - unsigned int *option_types_found) + unsigned int *option_types_found, + bool deferred) { enum client_connect_return ret = CC_RET_SKIPPED; #ifdef ENABLE_PLUGIN ASSERT(m); ASSERT(mi); ASSERT(option_types_found); + struct client_connect_defer_state *ccs = &(mi->client_connect_defer_state); /* deprecated callback, use a file for passing back return info */ if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT)) { struct argv argv = argv_new(); - struct gc_arena gc = gc_new(); - const char *dc_file = - platform_create_temp_file(mi->context.options.tmp_dir, "cc", &gc); - - if (!dc_file) + int call; + if (!deferred) { - ret = CC_RET_FAILED; - goto cleanup; + call = OPENVPN_PLUGIN_CLIENT_CONNECT; + if (!ccs_gen_config_file(mi) + || !ccs_gen_deferred_ret_file(mi)) + { + ret = CC_RET_FAILED; + goto cleanup; + } + } + else + { + call = OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER; + /* the initial call should have create these files */ + ASSERT(ccs->config_file); + ASSERT(ccs->deferred_ret_file); } - argv_printf(&argv, "%s", dc_file); - if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT, - &argv, NULL, mi->context.c2.es) - != OPENVPN_PLUGIN_FUNC_SUCCESS) + argv_printf(&argv, "%s", ccs->config_file); + int plug_ret = plugin_call(mi->context.plugins, call, + &argv, NULL, mi->context.c2.es); + if (plug_ret == OPENVPN_PLUGIN_FUNC_SUCCESS) { - msg(M_WARN, "WARNING: client-connect plugin call failed"); - ret = CC_RET_FAILED; + multi_client_connect_post(m, mi, ccs->config_file, + option_types_found); + ret = CC_RET_SUCCEEDED; + } + else if (plug_ret == OPENVPN_PLUGIN_FUNC_DEFERRED) + { + ret = CC_RET_DEFERRED; + /** + * Contrary to the plugin v2 API, we do not dmeand a working + * deferred plugin as all return can be handled by the files + * and plugin_call return success if a plugin is not defined + */ } else { - multi_client_connect_post(m, mi, dc_file, option_types_found); - ret = CC_RET_SUCCEEDED; + msg(M_WARN, "WARNING: client-connect plugin call failed"); + ret = CC_RET_FAILED; } + + /** + * plugin api v1 client connect async feature has both plugin and + * file return status, so in case that the file has a code that + * demands override, we override our return code + */ + int file_ret = ccs_test_deferred_ret_file(mi); + + if (file_ret == CC_RET_FAILED) { - msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", - dc_file); + ret = CC_RET_FAILED; + } + else if (ret == CC_RET_SUCCEEDED && file_ret == CC_RET_DEFERRED) + { + ret = CC_RET_DEFERRED; } - cleanup: argv_reset(&argv); - gc_free(&gc); + + if (ret != CC_RET_DEFERRED) + { + ccs_delete_config_file(mi); + ccs_delete_deferred_ret_file(mi); + } } #endif /* ifdef ENABLE_PLUGIN */ return ret; } +static enum client_connect_return +multi_client_connect_call_plugin_v1_initial(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found) +{ + return multi_client_connect_call_plugin_v1(m,mi, option_types_found, false); +} + +static enum client_connect_return +multi_client_connect_call_plugin_v1_deferred(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found) +{ + return multi_client_connect_call_plugin_v1(m,mi, option_types_found, true); +} + static enum client_connect_return multi_client_connect_call_plugin_v2(struct multi_context *m, struct multi_instance *mi, @@ -2333,8 +2386,8 @@ static const struct client_connect_handlers client_connect_handlers[] = { .deferred = multi_client_connect_fail }, { - .main = multi_client_connect_call_plugin_v1, - .deferred = multi_client_connect_fail + .main = multi_client_connect_call_plugin_v1_initial, + .deferred = multi_client_connect_call_plugin_v1_deferred, }, { .main = multi_client_connect_call_plugin_v2, diff --git a/src/openvpn/plugin.c b/src/openvpn/plugin.c index 4d17c821..51c130c1 100644 --- a/src/openvpn/plugin.c +++ b/src/openvpn/plugin.c @@ -104,6 +104,9 @@ plugin_type_name(const int type) case OPENVPN_PLUGIN_CLIENT_CONNECT_V2: return "PLUGIN_CLIENT_CONNECT"; + case OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER: + return "PLUGIN_CLIENT_CONNECT"; + case OPENVPN_PLUGIN_CLIENT_DISCONNECT: return "PLUGIN_CLIENT_DISCONNECT"; From patchwork Tue Nov 20 23:10:18 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 608 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director10.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id 4MI4OClQ9VtNYQAAIUCqbw for ; Wed, 21 Nov 2018 07:31:37 -0500 Received: from proxy12.mail.ord1d.rsapps.net ([172.30.191.6]) by director10.mail.ord1d.rsapps.net with LMTP id yGczOClQ9VtxMgAApN4f7A ; Wed, 21 Nov 2018 07:31:37 -0500 Received: from smtp10.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy12.mail.ord1d.rsapps.net with LMTP id kHn6NylQ9VtoNAAA7PHxkg ; Wed, 21 Nov 2018 07:31:37 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp10.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 63626b4a-ed89-11e8-ae2c-52540013bccb-1-1 Received: from [216.105.38.7] ([216.105.38.7:16399] helo=lists.sourceforge.net) by smtp10.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 65/0B-26478-92055FB5; Wed, 21 Nov 2018 07:31:37 -0500 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPReW-0003Tg-Qq; Wed, 21 Nov 2018 12:30:44 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPReV-0003TY-Gt for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:30:43 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Yyq6dLaFkK3TLNISZPm35nYMjijJO9ET0P+WH3wm++U=; b=UjgxnFW4KasO4XyArwmeaqMQmM UqZi2zuSoxaf4Pk/IRtge+LbsgqXlAIY+/ZPeDJNWfx68IuDQzGkbzDCF1O7NtpkhC+h2vmqiPGpk KjR+UKWQDzLuIdI09a0m94AY/fAaKqPb85Judenu7Uy/poTtcm2e1sQjH6bSJE6fvNIU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Yyq6dLaFkK3TLNISZPm35nYMjijJO9ET0P+WH3wm++U=; b=R4ZSmuOlhpmKjkw7nRzwIkjf/M 614kk3m5hMGVjae8oioVV5C2+jH6b7FF6lo2zjqpgOmVlub1nJrQrnWHmhIe+57LlbGkH2V6lbsdF 7mHpyV6w9VRVRRgG9JZHgQlvFnZfKUQMsjSEyKpvI61eSSsSYpEBNnHKdjLlOVm36HfM=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPReK-008sMu-D7 for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:30:43 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSe-000GX3-U3 for openvpn-devel@lists.sourceforge.net; Wed, 21 Nov 2018 11:10:20 +0100 Received: (nullmailer pid 1882 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:18 +0100 Message-Id: <20181121101019.1801-13-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different X-Headers-End: 1gPReK-008sMu-D7 Subject: [Openvpn-devel] [PATCH v4 12/13] client-connect: Implement deferred connect support for plugin API v2 X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox The V2 API is simpler than the V1 API since there is no passing of data via files. This also means that with the current API the V2 API cannot support async notify via files. Adding a file just for async notify seems very hacky and when needed we should implement a better option when async is needed for the plugin V2 API Signed-off-by: Arne Schwabe --- src/openvpn/multi.c | 58 +++++++++++++++++++++++++++++++++++--------- src/openvpn/plugin.c | 3 +++ 2 files changed, 50 insertions(+), 11 deletions(-) diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index c14a21e4..c94716ae 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -2043,7 +2043,8 @@ multi_client_connect_call_plugin_v1_deferred(struct multi_context *m, static enum client_connect_return multi_client_connect_call_plugin_v2(struct multi_context *m, struct multi_instance *mi, - unsigned int *option_types_found) + unsigned int *option_types_found, + bool deferred) { enum client_connect_return ret = CC_RET_SKIPPED; #ifdef ENABLE_PLUGIN @@ -2051,32 +2052,67 @@ multi_client_connect_call_plugin_v2(struct multi_context *m, ASSERT(mi); ASSERT(option_types_found); + int call = deferred ? OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 : + OPENVPN_PLUGIN_CLIENT_CONNECT_V2; /* V2 callback, use a plugin_return struct for passing back return info */ - if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2)) + if (plugin_defined(mi->context.plugins, call)) { struct plugin_return pr; plugin_return_init(&pr); - if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2, - NULL, &pr, mi->context.c2.es) - != OPENVPN_PLUGIN_FUNC_SUCCESS) + int plug_ret = plugin_call(mi->context.plugins, call, + NULL, &pr, mi->context.c2.es); + if (plug_ret == OPENVPN_PLUGIN_FUNC_SUCCESS) { - msg(M_WARN, "WARNING: client-connect-v2 plugin call failed"); - ret = CC_RET_FAILED; + multi_client_connect_post_plugin(m, mi, &pr, option_types_found); + ret = CC_RET_SUCCEEDED; + } + else if (plug_ret == OPENVPN_PLUGIN_FUNC_DEFERRED) + { + ret = CC_RET_DEFERRED; + if (!(plugin_defined(mi->context.plugins, + OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2))) + { + msg(M_WARN, "A plugin that defers from the " + "OPENVPN_PLUGIN_CLIENT_CONNECT_V2 call must also " + "declare support for " + "OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2"); + ret = CC_RET_FAILED; + } } else { - multi_client_connect_post_plugin(m, mi, &pr, option_types_found); - ret = CC_RET_SUCCEEDED; + msg(M_WARN, "WARNING: client-connect-v2 plugin call failed"); + ret = CC_RET_FAILED; } + plugin_return_free(&pr); } #endif /* ifdef ENABLE_PLUGIN */ return ret; } + +static enum client_connect_return +multi_client_connect_call_plugin_v2_initial(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found) +{ + return multi_client_connect_call_plugin_v2(m, mi, option_types_found, + false); +} + +static enum client_connect_return +multi_client_connect_call_plugin_v2_deferred(struct multi_context *m, + struct multi_instance *mi, + unsigned int *option_types_found) +{ + return multi_client_connect_call_plugin_v2(m, mi, option_types_found, + true); +} + /** * Runs the --client-connect script if one is defined. */ @@ -2390,8 +2426,8 @@ static const struct client_connect_handlers client_connect_handlers[] = { .deferred = multi_client_connect_call_plugin_v1_deferred, }, { - .main = multi_client_connect_call_plugin_v2, - .deferred = multi_client_connect_fail + .main = multi_client_connect_call_plugin_v2_initial, + .deferred = multi_client_connect_call_plugin_v2_deferred, }, { .main = multi_client_connect_call_script, diff --git a/src/openvpn/plugin.c b/src/openvpn/plugin.c index 51c130c1..347acade 100644 --- a/src/openvpn/plugin.c +++ b/src/openvpn/plugin.c @@ -107,6 +107,9 @@ plugin_type_name(const int type) case OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER: return "PLUGIN_CLIENT_CONNECT"; + case OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2: + return "PLUGIN_CLIENT_CONNECT"; + case OPENVPN_PLUGIN_CLIENT_DISCONNECT: return "PLUGIN_CLIENT_DISCONNECT"; From patchwork Tue Nov 20 23:10:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 607 X-Patchwork-Delegate: a@unstable.cc Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director12.mail.ord1d.rsapps.net ([172.30.191.6]) by backend30.mail.ord1d.rsapps.net with LMTP id QBTbAilQ9VtONAAAIUCqbw for ; Wed, 21 Nov 2018 07:31:37 -0500 Received: from proxy19.mail.ord1d.rsapps.net ([172.30.191.6]) by director12.mail.ord1d.rsapps.net with LMTP id wC7hAilQ9VvoXgAAIasKDg ; Wed, 21 Nov 2018 07:31:37 -0500 Received: from smtp19.gate.ord1d ([172.30.191.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy19.mail.ord1d.rsapps.net with LMTP id EKpwAilQ9VvsagAAyH2SIw ; Wed, 21 Nov 2018 07:31:37 -0500 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp19.gate.ord1d.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 6268c158-ed89-11e8-a453-525400d67fa8-1-1 Received: from [216.105.38.7] ([216.105.38.7:19586] helo=lists.sourceforge.net) by smtp19.gate.ord1d.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id E1/7D-26108-72055FB5; Wed, 21 Nov 2018 07:31:35 -0500 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1gPReJ-0006mF-VG; Wed, 21 Nov 2018 12:30:31 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1gPReH-0006m3-BE for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:30:29 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=References:In-Reply-To:Message-Id:Date:Subject:To: From:Sender:Reply-To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=DbQK4MkcC9kEsTq1Sr91WLRf8a08gJpfttK5XDYTK0U=; b=gfeF/Latr5H4WSy+Q0rAMZWlWP sEKuGvoo8i6sr2O3R0eBZKYuLikqLAbexARApXKdKJ6WOchFCNa6E1Z6m1GfciILWyiupWQf/cU4I TdlF/9cSlD2HLy92HylzSojDNGSLbg32MqhjkHvDON+peu1uav+hYwNtX2meTMWS0mMg=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=References:In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc :MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=DbQK4MkcC9kEsTq1Sr91WLRf8a08gJpfttK5XDYTK0U=; b=RPYKyaoqFbVxfgiT22M73dVHPM 19/qDTLBW+JpvKzT2ScHdfMMfy6buy74tbaz95Dsfq7+6sbEW20l9T94O0hM7LD/bajahBcucYxHP UKmFV52RDKAUWoMPZSURJnRXUe2MQvGzRaPC2aSXlCkavzbmFs1sV6kaO3FlSyEwZIoY=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1gPRe1-008sMu-Vj for openvpn-devel@lists.sourceforge.NET; Wed, 21 Nov 2018 12:30:29 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.91 (FreeBSD)) (envelope-from ) id 1gPPSf-000GX7-0K for openvpn-devel@lists.sourceforge.net; Wed, 21 Nov 2018 11:10:21 +0100 Received: (nullmailer pid 1886 invoked by uid 10006); Wed, 21 Nov 2018 10:10:20 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Wed, 21 Nov 2018 11:10:19 +0100 Message-Id: <20181121101019.1801-14-arne@rfc2549.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181121101019.1801-1-arne@rfc2549.org> References: <20181121101019.1801-1-arne@rfc2549.org> X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 TIME_LIMIT_EXCEEDED Exceeded time limit / deadline X-Headers-End: 1gPRe1-008sMu-Vj Subject: [Openvpn-devel] [PATCH v4 13/13] client-connect: Add documentation for the deferred client connect feature X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox Signed-off-by: Arne Schwabe --- doc/openvpn.8 | 47 ++++++++++++++++++++++++++++++++++--- include/openvpn-plugin.h.in | 21 ++++++++++++----- 2 files changed, 59 insertions(+), 9 deletions(-) diff --git a/doc/openvpn.8 b/doc/openvpn.8 index 94b5cc4f..9377bbf5 100644 --- a/doc/openvpn.8 +++ b/doc/openvpn.8 @@ -3346,6 +3346,13 @@ is significant. If .B script returns a non\-zero error status, it will cause the client to be disconnected. + +If a +.B \-\-client\-connect cmd +wants to defer the generating the configuration the script should +use the client_connect_deferred_file and client_connect_config_file +environment variables and write status acorrdingly into these files +(See the environment section below for more details). .\"********************************************************* .TP .B \-\-client\-disconnect cmd @@ -3428,12 +3435,18 @@ This directory will be used by in the following cases: * .B \-\-client\-connect -scripts to dynamically generate client\-specific -configuration files. +scripts and +.B OPENVPN_PLUGIN_CLIENT_CONNECT +plugin hook +to dynamically generate client\-specific configuration files +and return success/failure via client_connect_deferred_file +when using deferred client connect method * .B OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY -plugin hook to return success/failure via auth_control_file +and + +plugin hook to return success/failure via auth_control_file/ when using deferred auth method * @@ -6431,6 +6444,34 @@ Set prior to execution of the script. .\"********************************************************* .TP +.B client_connect_config_file +The path to the configuration file that should be written by +the +.B \-\-client\-connect +The content of this enviroment variable is identical to the +file as a argument of the called +.B \-\-client\-connect +script. +.\"********************************************************* +.TP +.B client_connect_defferred_file +This file can be optionally written to communicate a status +code of the +.TP +.B \-\-client\-connect +script. If used for deferring, this file must be written +before the +.B \-\-client\-connect +script exits. The first character in the file is interpreted +and 1 is equal to normal script execution, 0 indicated and +error (in the same way that a non zero exit status does) and +2 indicates that the script deferred returning the config +file. When the script defers the executing it must first write 2 +during the execution of the script. A background process or similar +must then take of writing the client_connect_config_file and when +finished, write the a 1 to this file. +.\"********************************************************* +.TP .B common_name The X509 common name of an authenticated client. Set prior to execution of diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in index 38fbe097..fce59422 100644 --- a/include/openvpn-plugin.h.in +++ b/include/openvpn-plugin.h.in @@ -557,12 +557,21 @@ OPENVPN_PLUGIN_DEF openvpn_plugin_handle_t OPENVPN_PLUGIN_FUNC(openvpn_plugin_op * OPENVPN_PLUGIN_FUNC_SUCCESS on success, OPENVPN_PLUGIN_FUNC_ERROR on failure * * In addition, OPENVPN_PLUGIN_FUNC_DEFERRED may be returned by - * OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY. This enables asynchronous - * authentication where the plugin (or one of its agents) may indicate - * authentication success/failure some number of seconds after the return - * of the OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY handler by writing a single - * char to the file named by auth_control_file in the environmental variable - * list (envp). + * OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY, OPENVPN_PLUGIN_CLIENT_CONNECT and + * OPENVPN_PLUGIN_CLIENT_CONNECT_V2. This enables asynchronous + * authentication or client connect where the plugin (or one of its agents) + * may indicate authentication success/failure or client configuration some + * number of seconds after the return of the function handler. + * For OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY and OPENVPN_PLUGIN_CLIENT_CONNECT + * this done by writing a single char to the file named by + * auth_control_file/client_connect_deferred_file + * in the environmental variable list (envp). + * + * In Addition the OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER and + * OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 are called when OpenVPN tries to + * get the deferred result. For V2 call implementing this function is + * required as information is not passed by files. For the normal version + * the call is optional. * * first char of auth_control_file: * '0' -- indicates auth failure