forked from pool/openvpn
aa86a6a685
- update to 2.4.10: - OpenVPN client will now announce the acceptable ciphers to the server (IV_CIPHER=...), so NCP cipher negotiation works better - Parse static challenge response in auth-pam plugin - Accept empty password and/or response in auth-pam plugin - Log serial number of revoked certificate - Fix tls_ctx_client/server_new leaving error on OpenSSL error stack - Fix auth-token not being updated if auth-nocache is set (this should fix all remaining client-side bugs for the combination "auth-nocache in client-config" + "auth-token in use on the server") - Fix stack overflow in OpenSolaris and *BSD NEXTADDR() - Fix error detection / abort in --inetd corner case (#350) - Fix TUNSETGROUP compatibility with very old Linux systems (#1152) - Fix handling of 'route remote_host' for IPv6 transport case (#1247 and #1332) - Fix --show-gateway for IPv6 on NetBSD/i386 (#734) - A number of documentation improvements / clarification fixes. - Fix line number reporting on config file errors after <inline> segments - Fix fatal error at switching remotes (#629) - socks.c: fix alen for DOMAIN type addresses, bump up buffer sizes (#848) - Switch "ks->authenticated" assertion failure to returning false (#1270) - refresh 0001-preform-deferred-authentication-in-the-background.patch openvpn-2.3.x-fixed-multiple-low-severity-issues.patch against 2.4.10 OBS-URL: https://build.opensuse.org/request/show/860796 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openvpn?expand=0&rev=156
161 lines
4.7 KiB
Diff
161 lines
4.7 KiB
Diff
Index: openvpn-2.4.10/src/plugins/auth-pam/auth-pam.c
|
|
===================================================================
|
|
--- openvpn-2.4.10.orig/src/plugins/auth-pam/auth-pam.c
|
|
+++ openvpn-2.4.10/src/plugins/auth-pam/auth-pam.c
|
|
@@ -43,6 +43,7 @@
|
|
#include <stdlib.h>
|
|
#include <sys/types.h>
|
|
#include <sys/socket.h>
|
|
+#include <linux/limits.h>
|
|
#include <sys/wait.h>
|
|
#include <fcntl.h>
|
|
#include <signal.h>
|
|
@@ -56,6 +57,7 @@
|
|
/* Command codes for foreground -> background communication */
|
|
#define COMMAND_VERIFY 0
|
|
#define COMMAND_EXIT 1
|
|
+#define COMMAND_VERIFY_V2 2
|
|
|
|
/* Response codes for background -> foreground communication */
|
|
#define RESPONSE_INIT_SUCCEEDED 10
|
|
@@ -115,6 +117,7 @@ struct user_pass {
|
|
char password[128];
|
|
char common_name[128];
|
|
char response[128];
|
|
+ char auth_control_file[PATH_MAX];
|
|
|
|
const struct name_value_list *name_value_list;
|
|
};
|
|
@@ -776,6 +779,21 @@ pam_auth(const char *service, const stru
|
|
return ret;
|
|
}
|
|
|
|
+static int handle_auth_control_file(char *auth_control_file, int status)
|
|
+{
|
|
+ FILE *fp = fopen(auth_control_file, "w");
|
|
+
|
|
+ if (fp) {
|
|
+ if (fprintf (fp, "%d\n", status) < 0) {
|
|
+ fclose(fp);
|
|
+ return -1;
|
|
+ }
|
|
+ fclose(fp);
|
|
+ return 0;
|
|
+ }
|
|
+ return -1;
|
|
+}
|
|
+
|
|
/*
|
|
* Background process -- runs with privilege.
|
|
*/
|
|
@@ -878,6 +896,42 @@ pam_server(int fd, const char *service,
|
|
plugin_secure_memzero(up.password, sizeof(up.password));
|
|
break;
|
|
|
|
+ case COMMAND_VERIFY_V2:
|
|
+ if (recv_string (fd, up.username, sizeof (up.username)) == -1
|
|
+ || recv_string (fd, up.password, sizeof (up.password)) == -1
|
|
+ || recv_string (fd, up.common_name, sizeof (up.common_name)) == -1
|
|
+ || recv_string (fd, up.auth_control_file, sizeof (up.auth_control_file)) == -1)
|
|
+ {
|
|
+ fprintf (stderr, "AUTH-PAM: BACKGROUND: read error on command channel: code=%d, exiting\n",
|
|
+ command);
|
|
+ goto done;
|
|
+ }
|
|
+
|
|
+ if (DEBUG (verb))
|
|
+ {
|
|
+#if 0
|
|
+ fprintf (stderr, "AUTH-PAM: BACKGROUND: USER/PASS: %s/%s\n",
|
|
+ up.username, up.password);
|
|
+#else
|
|
+ fprintf (stderr, "AUTH-PAM: BACKGROUND: USER: %s\n", up.username);
|
|
+#endif
|
|
+ }
|
|
+
|
|
+ if (pam_auth (service, &up)) /* Succeeded */
|
|
+ {
|
|
+ if (handle_auth_control_file(up.auth_control_file, 1) == -1) {
|
|
+ fprintf (stderr, "AUTH-PAM: BACKGROUND: write error on control file\n");
|
|
+ }
|
|
+ }
|
|
+ else /* Failed */
|
|
+ {
|
|
+ if (handle_auth_control_file(up.auth_control_file, 0) == -1) {
|
|
+ fprintf (stderr, "AUTH-PAM: BACKGROUND: write error on control file\n");
|
|
+ }
|
|
+ }
|
|
+ break;
|
|
+
|
|
+
|
|
case COMMAND_EXIT:
|
|
goto done;
|
|
|
|
@@ -905,3 +959,56 @@ done:
|
|
|
|
return;
|
|
}
|
|
+
|
|
+int
|
|
+handle_auth_pass_verify_v2(struct auth_pam_context *context, const char *argv[], const char *envp[])
|
|
+{
|
|
+
|
|
+ /* get username/password from envp string array */
|
|
+ const char *username = get_env ("username", envp);
|
|
+ const char *password = get_env ("password", envp);
|
|
+ const char *common_name = get_env ("common_name", envp) ? get_env ("common_name", envp) : "";
|
|
+ const char *auth_control_file = get_env ("auth_control_file", envp);
|
|
+
|
|
+ if (!username || !*username || !password)
|
|
+ return OPENVPN_PLUGIN_FUNC_ERROR;
|
|
+
|
|
+ if (!auth_control_file || !*auth_control_file || access( auth_control_file, F_OK ) == -1)
|
|
+ return OPENVPN_PLUGIN_FUNC_ERROR;
|
|
+
|
|
+ if (send_control (context->foreground_fd, COMMAND_VERIFY_V2) == -1
|
|
+ || send_string (context->foreground_fd, username) == -1
|
|
+ || send_string (context->foreground_fd, password) == -1
|
|
+ || send_string (context->foreground_fd, common_name) == -1
|
|
+ || send_string (context->foreground_fd, auth_control_file) == -1)
|
|
+ {
|
|
+ fprintf (stderr, "AUTH-PAM: Error sending auth info to background process\n");
|
|
+ }
|
|
+ else
|
|
+ {
|
|
+ return OPENVPN_PLUGIN_FUNC_DEFERRED;
|
|
+ }
|
|
+
|
|
+ return OPENVPN_PLUGIN_FUNC_ERROR;
|
|
+}
|
|
+
|
|
+OPENVPN_EXPORT int
|
|
+openvpn_plugin_func_v2 (openvpn_plugin_handle_t handle,
|
|
+ const int type,
|
|
+ const char *argv[],
|
|
+ const char *envp[],
|
|
+ void *per_client_context,
|
|
+ struct openvpn_plugin_string_list **return_list)
|
|
+{
|
|
+ struct auth_pam_context *context = (struct auth_pam_context *) handle;
|
|
+
|
|
+ switch (type)
|
|
+ {
|
|
+ case OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY:
|
|
+ printf ("OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY\n");
|
|
+ return handle_auth_pass_verify_v2 (context, argv, envp);
|
|
+ default:
|
|
+ printf ("OPENVPN_PLUGIN_?\n");
|
|
+ return OPENVPN_PLUGIN_FUNC_ERROR;
|
|
+ }
|
|
+}
|
|
Index: openvpn-2.4.10/src/plugins/auth-pam/auth-pam.exports
|
|
===================================================================
|
|
--- openvpn-2.4.10.orig/src/plugins/auth-pam/auth-pam.exports
|
|
+++ openvpn-2.4.10/src/plugins/auth-pam/auth-pam.exports
|
|
@@ -1,4 +1,5 @@
|
|
openvpn_plugin_open_v3
|
|
openvpn_plugin_func_v1
|
|
+openvpn_plugin_func_v2
|
|
openvpn_plugin_close_v1
|
|
openvpn_plugin_abort_v1
|