diff options
Diffstat (limited to '')
| -rw-r--r-- | plugin.c | 33 | ||||
| -rw-r--r-- | plugin/defer/README | 16 | ||||
| -rwxr-xr-x | plugin/defer/build | 14 | ||||
| -rw-r--r-- | plugin/defer/simple.c | 138 | ||||
| -rwxr-xr-x | plugin/defer/simple.def | 6 | ||||
| -rwxr-xr-x | plugin/defer/winbuild | 18 |
6 files changed, 211 insertions, 14 deletions
@@ -347,7 +347,7 @@ plugin_call_item (const struct plugin *p, plugin_type_name (type), status); - if (status != OPENVPN_PLUGIN_FUNC_SUCCESS) + if (status == OPENVPN_PLUGIN_FUNC_ERROR) msg (M_WARN, "PLUGIN_CALL: plugin function %s failed with status %d: %s", plugin_type_name (type), status, @@ -541,7 +541,8 @@ plugin_call (const struct plugin_list *pl, int i; const char **envp; const int n = plugin_n (pl); - int count = 0; + bool error = false; + bool deferred = false; mutex_lock_static (L_PLUGIN); @@ -550,13 +551,16 @@ plugin_call (const struct plugin_list *pl, for (i = 0; i < n; ++i) { - if (!plugin_call_item (&pl->common->plugins[i], - pl->per_client.per_client_context[i], - type, - args, - pr ? &pr->list[i] : NULL, - envp)) - ++count; + const int status = plugin_call_item (&pl->common->plugins[i], + pl->per_client.per_client_context[i], + type, + args, + pr ? &pr->list[i] : NULL, + envp); + if (status == OPENVPN_PLUGIN_FUNC_ERROR) + error = true; + else if (status == OPENVPN_PLUGIN_FUNC_DEFERRED) + deferred = true; } if (pr) @@ -566,12 +570,13 @@ plugin_call (const struct plugin_list *pl, gc_free (&gc); - return count == n ? 0 : 1; /* if any one plugin in the chain failed, return failure (1) */ - } - else - { - return 0; + if (error) + return OPENVPN_PLUGIN_FUNC_ERROR; + else if (deferred) + return OPENVPN_PLUGIN_FUNC_DEFERRED; } + + return OPENVPN_PLUGIN_FUNC_SUCCESS; } void diff --git a/plugin/defer/README b/plugin/defer/README new file mode 100644 index 0000000..d8990f8 --- /dev/null +++ b/plugin/defer/README @@ -0,0 +1,16 @@ +OpenVPN plugin examples. + +Examples provided: + +simple.c -- using the --auth-user-pass-verify callback, + test deferred authentication. + +To build: + + ./build simple (Linux/BSD/etc.) + ./winbuild simple (MinGW on Windows) + +To use in OpenVPN, add to config file: + + plugin simple.so (Linux/BSD/etc.) + plugin simple.dll (MinGW on Windows) diff --git a/plugin/defer/build b/plugin/defer/build new file mode 100755 index 0000000..8b628a2 --- /dev/null +++ b/plugin/defer/build @@ -0,0 +1,14 @@ +#!/bin/sh + +# +# Build an OpenVPN plugin module on *nix. The argument should +# be the base name of the C source file (without the .c). +# + +# This directory is where we will look for openvpn-plugin.h +INCLUDE="-I../.." + +CC_FLAGS="-O2 -Wall" + +gcc $CC_FLAGS -fPIC -c $INCLUDE $1.c && \ +gcc -fPIC -shared -Wl,-soname,$1.so -o $1.so $1.o -lc diff --git a/plugin/defer/simple.c b/plugin/defer/simple.c new file mode 100644 index 0000000..7311a3f --- /dev/null +++ b/plugin/defer/simple.c @@ -0,0 +1,138 @@ +/* + * OpenVPN -- An application to securely tunnel IP networks + * over a single TCP/UDP port, with support for SSL/TLS-based + * session authentication and key exchange, + * packet encryption, packet authentication, and + * packet compression. + * + * Copyright (C) 2002-2005 OpenVPN Solutions LLC <info@openvpn.net> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program (see the file COPYING included with this + * distribution); if not, write to the Free Software Foundation, Inc., + * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * This file implements a simple OpenVPN plugin module which + * will test deferred authentication. Will run on Windows or *nix. + * + * See the README file for build instructions. + */ + +#include <stdio.h> +#include <string.h> +#include <stdlib.h> + +#include "openvpn-plugin.h" + +/* + * Our context, where we keep our state. + */ +struct plugin_context { + int dummy; +}; + +/* + * Given an environmental variable name, search + * the envp array for its value, returning it + * if found or NULL otherwise. + */ +static const char * +get_env (const char *name, const char *envp[]) +{ + if (envp) + { + int i; + const int namelen = strlen (name); + for (i = 0; envp[i]; ++i) + { + if (!strncmp (envp[i], name, namelen)) + { + const char *cp = envp[i] + namelen; + if (*cp == '=') + return cp + 1; + } + } + } + return NULL; +} + +/* used for safe printf of possible NULL strings */ +static const char * +np (const char *str) +{ + if (str) + return str; + else + return "[NULL]"; +} + +OPENVPN_EXPORT openvpn_plugin_handle_t +openvpn_plugin_open_v1 (unsigned int *type_mask, const char *argv[], const char *envp[]) +{ + struct plugin_context *context; + + /* + * Allocate our context + */ + context = (struct plugin_context *) calloc (1, sizeof (struct plugin_context)); + + /* + * We are only interested in intercepting the + * --auth-user-pass-verify callback. + */ + *type_mask = OPENVPN_PLUGIN_MASK (OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY); + + return (openvpn_plugin_handle_t) context; +} + +OPENVPN_EXPORT int +openvpn_plugin_func_v1 (openvpn_plugin_handle_t handle, const int type, const char *argv[], const char *envp[]) +{ + /* struct plugin_context *context = (struct plugin_context *) handle; */ + + /* get username/password from envp string array */ + const char *username = get_env ("username", envp); + const char *password = get_env ("password", envp); + + /* get auth_control_file filename from envp string array*/ + const char *auth_control_file = get_env ("auth_control_file", envp); + + printf ("DEFER u='%s' p='%s' acf='%s'\n", + np(username), + np(password), + np(auth_control_file)); + + /* Authenticate asynchronously in 10 seconds */ + if (auth_control_file) + { + char buf[256]; + snprintf (buf, sizeof(buf), "( sleep 10 ; echo AUTH %s ; echo 1 >%s ) &", + auth_control_file, + auth_control_file); + printf ("%s\n", buf); + system (buf); + return OPENVPN_PLUGIN_FUNC_DEFERRED; + } + else + { + return OPENVPN_PLUGIN_FUNC_ERROR; + } +} + +OPENVPN_EXPORT void +openvpn_plugin_close_v1 (openvpn_plugin_handle_t handle) +{ + struct plugin_context *context = (struct plugin_context *) handle; + free (context); +} diff --git a/plugin/defer/simple.def b/plugin/defer/simple.def new file mode 100755 index 0000000..a87507d --- /dev/null +++ b/plugin/defer/simple.def @@ -0,0 +1,6 @@ +LIBRARY OpenVPN_PLUGIN_SAMPLE +DESCRIPTION "Sample OpenVPN plug-in module." +EXPORTS + openvpn_plugin_open_v1 @1 + openvpn_plugin_func_v1 @2 + openvpn_plugin_close_v1 @3 diff --git a/plugin/defer/winbuild b/plugin/defer/winbuild new file mode 100755 index 0000000..97e724a --- /dev/null +++ b/plugin/defer/winbuild @@ -0,0 +1,18 @@ +# +# Build an OpenVPN plugin module on Windows/MinGW. +# The argument should be the base name of the C source file +# (without the .c). +# + +# This directory is where we will look for openvpn-plugin.h +INCLUDE="-I.." + +CC_FLAGS="-O2 -Wall" + +gcc -DBUILD_DLL $CC_FLAGS $INCLUDE -c $1.c +gcc --disable-stdcall-fixup -mdll -DBUILD_DLL -o junk.tmp -Wl,--base-file,base.tmp $1.o +rm junk.tmp +dlltool --dllname $1.dll --base-file base.tmp --output-exp temp.exp --input-def $1.def +rm base.tmp +gcc --enable-stdcall-fixup -mdll -DBUILD_DLL -o $1.dll $1.o -Wl,temp.exp +rm temp.exp |