Allow inlining of --auth-user-pass

Hi Davide,
nice idea. But I think I found two small bugs:
First, it won't compile in a config w/o ENABLE_CLIENT_CR defined (there is no "sc_info").
Second, if I'm not mistaken, name and password are not copied correctly:
If # of charachters is (pos - prev), the last charakter is at [pos - prev -1] and to terminate the string you should set [pos - prev] to '\0'. My suggestion (not sure, if the first one works with management enabled, only tested w/o).
Fix in src/openvpn/misc.c (add #ifdef):
[...]
+
+ if ( ( !streq(options->auth_user_pass_file, "stdin") || options->auth_user_pass_file_inline) && options->auth_nocache)
+ msg (M_USAGE, "Cannot use --auth-nocache with credentials from file");

(quoted diff) +3 -0

+
+#ifdef ENABLE_CLIENT_CR
+ if ( ( !streq(options->auth_user_pass_file, "stdin") ||

options->auth_user_pass_file_inline) && options->sc_info.challenge_text)
+ msg (M_USAGE, "Credentials cannot be in a file if using --static-challenge");

(quoted diff) +5 -0

+#endif
+
+ if (options->auth_user_pass_file_inline)
+ {
+ int n_inlined = 0;
[...]

in src/openvpn/ssl.c yo should use [pos - prev] instead of [pos - prev +1] [...]
+ {
+ strncpy(inlined_username, prev, pos - prev);
+ inlined_username[pos - prev] = '\0';
+ msg (M_INFO, "Using inlined username: %s (POS=%d PREV=%d)", inlined_username, pos, prev);
+ }
+ else
+ {
+ strncpy(inlined_password, prev, pos - prev);
+ inlined_password[pos - prev] = '\0';
+ msg (M_INFO, "Using inlined password:
...**%s**",inlined_password);
+ }
[...]

I hope it's o.k. just to give the idea but not post full patches again.

Regards
Joerg
*Gesendet:* Donnerstag, 03. Oktober 2013 um 10:30 Uhr
*Von:* "Davide Brini" <[email protected]...>
*An:* [email protected]
*Betreff:* Re: [Openvpn-devel] [PATCH] Allow inlining of --auth-user-pass (previous version contained a leftover debug line left by mistake, sorry)

This patch allows inlining of the --auth-user-pass directive, so it is now possible to do

<auth-user-pass>
myusername
mypassword
</auth-user-pass>

or supply just the username, eg

<auth-user-pass>
myusername
</auth-user-pass>

(in this case the user is prompted for the password only).
The most changed files are options.c (sanity check of inlined credentials) and ssl.c (actual parsing of the inlined credentials).

Udates to the documentation will be provided in a separate patch if and when the present patch is accepted.

As discussed on IRC, for the time being the non-inlined syntax

auth-user-pass [up]

is still supported and [up] is expected to contain username and password on two lines.

Signed-off-by Davide Brini <[email protected]...>

---
src/openvpn/init.c | 6 +--
src/openvpn/misc.c | 2 +-
src/openvpn/options.c | 56 ++++++++++++++++++++++++---- src/openvpn/options.h | 2 +
src/openvpn/ssl.c | 98 +++++++++++++++++++++++++++++++++++++------------ src/openvpn/ssl.h | 2 +-

6 files changed, 131 insertions(+), 35 deletions(-)

src/openvpn/init.c +3 -3

index 031fb20..b11ae8a 100644
@@ -400,12 +400,12 @@ init_query_passwords (struct context *c)
 
 #if P2MP
 /* Auth user/pass input */
- if (c->options.auth_user_pass_file)
+ if (c->options.auth_user_pass_file || c->options.auth_user_pass_file_inline)
 {
 #ifdef ENABLE_CLIENT_CR
- auth_user_pass_setup (c->options.auth_user_pass_file, &c->options.sc_info);
+ auth_user_pass_setup (c->options.auth_user_pass_file,
 c->options.auth_user_pass_file_inline, &c->options.sc_info);
 #else
- auth_user_pass_setup (c->options.auth_user_pass_file, NULL);
+ auth_user_pass_setup (c->options.auth_user_pass_file,
 c->options.auth_user_pass_file_inline, NULL);
 #endif

}
#endif

src/openvpn/misc.c +1 -1

index 4688444..05bc2f0 100644
@@ -1036,7 +1036,7 @@ get_user_pass_cr (struct user_pass *up,
 
 if (!up->defined)
 {
- const bool from_stdin = (!auth_file || !strcmp (auth_file, "stdin"));
+ const bool from_stdin = (!auth_file || streq (auth_file, "stdin"));
 
 if (flags & GET_USER_PASS_PREVIOUS_CREDS_FAILED)
 msg (M_WARN, "Note: previous '%s' credentials failed", prefix);

src/openvpn/options.c +2 -1

index 4d0271f..6f2ea66 100644
@@ -1233,6 +1233,7 @@ show_p2mp_parms (const struct options *o)
 SHOW_BOOL (client);
 SHOW_BOOL (pull);
 SHOW_STR (auth_user_pass_file);
+ SHOW_STR (auth_user_pass_file_inline);
 
 gc_free (&gc);
 }

@@ -2080,7 +2081,7 @@ options_postprocess_verify_ce (const struct options
 *options, const struct conne
 if (options->ifconfig_ipv6_local && !options->tun_ipv6 )
 msg (M_INFO, "Warning: --ifconfig-ipv6 without --tun-ipv6 will not do IPv6");
 
- if (options->auth_user_pass_file)
+ if ( options->auth_user_pass_file || options->auth_user_pass_file_inline )

msg (M_USAGE, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
if (options->ccd_exclusive && !options->client_config_dir)
msg (M_USAGE, "--ccd-exclusive must be used with --client-config-dir");

src/openvpn/options.c +1 -1

@@ -2274,7 +2275,7 @@ options_postprocess_verify_ce (const struct options
 *options, const struct conne
 if (sum == 0)
 {
 #if P2MP
- if (!options->auth_user_pass_file)
+ if (!options->auth_user_pass_file && !options->auth_user_pass_file_inline)
 #endif

msg (M_USAGE, "No client-side authentication method is specified. You must use either --cert/--key, --pkcs12, or --auth-user-pass");
}

src/openvpn/options.c +6 -1

@@ -2350,8 +2351,42 @@ options_postprocess_verify_ce (const struct options
 *options, const struct conne
 #endif /* ENABLE_SSL */
 
 #if P2MP
- if (options->auth_user_pass_file && !options->pull)
+ if ( ( options->auth_user_pass_file || options->auth_user_pass_file_inline) &&
 !options->pull)
 msg (M_USAGE, "--auth-user-pass requires --pull");
+
+ if ( ( !streq(options->auth_user_pass_file, "stdin") ||
 options->auth_user_pass_file_inline) && options->auth_nocache)
+ msg (M_USAGE, "Cannot use --auth-nocache with credentials from file");
+
+ if ( ( !streq(options->auth_user_pass_file, "stdin") ||

options->auth_user_pass_file_inline) && options->sc_info.challenge_text)
+ msg (M_USAGE, "Credentials cannot be in a file if using --static-challenge");

src/openvpn/options.c +28 -0

+
+ if (options->auth_user_pass_file_inline)
+ {
+ int n_inlined = 0;
+ const char *pos = options->auth_user_pass_file_inline;
+ const char *prev = pos;
+
+ if ( strlen(pos) == 0 )
+ msg (M_USAGE, "Invalid format for inlined --auth-user-pass");
+
+ while( (pos = strchr(pos, '\n')) != NULL )
+ {
+ n_inlined++;
+
+ if (n_inlined > 2)
+ msg (M_USAGE, "Too many lines in inlined --auth-user-pass");
+
+ if ( pos - prev > USER_PASS_LEN - 1 )
+ msg (M_USAGE, "Line too long in inlined --auth-user-pass");
+
+ pos++;
+ prev = pos;
+ }
+
+ if ( (n_inlined == 0) || (*prev != '\0') )
+ msg (M_USAGE, "Invalid format for inlined --auth-user-pass");
+
+ }

#endif

uninit_options (&defaults);

src/openvpn/options.c +10 -4

@@ -2719,9 +2754,10 @@ options_postprocess_filechecks (struct options *options)
 "--management user/password file");
 #endif /* ENABLE_MANAGEMENT */
 #if P2MP
- errs |= check_file_access (CHKACC_FILE|CHKACC_ACPTSTDIN,
- options->auth_user_pass_file, R_OK,
- "--auth-user-pass");
+ if (!streq(options->auth_user_pass_file, INLINE_FILE_TAG))
+ errs |= check_file_access (CHKACC_FILE|CHKACC_ACPTSTDIN,
+ options->auth_user_pass_file, R_OK,
+ "--auth-user-pass");
 #endif /* P2MP */
 
 /* ** System related ** */

@@ -5894,7 +5930,12 @@ add_option (struct options *options,
 VERIFY_PERMISSION (OPT_P_GENERAL);
 if (p[1])
 {
- options->auth_user_pass_file = p[1];
+ options->auth_user_pass_file = p[1];
+ if (streq (p[1], INLINE_FILE_TAG) && p[2])
+ {
+ options->auth_user_pass_file = "stdin";
+ options->auth_user_pass_file_inline = p[2];
+ }
 }

else
options->auth_user_pass_file = "stdin";

src/openvpn/options.c +1 -0

@@ -6591,6 +6632,7 @@ add_option (struct options *options,
 else if (streq (p[0], "auth-nocache"))
 {
 VERIFY_PERMISSION (OPT_P_GENERAL);
+ options->auth_nocache = true;
 ssl_set_auth_nocache ();
 }
 else if (streq (p[0], "auth-token") && p[1])

src/openvpn/options.h +1 -0

index 8e0e367..5ae733a 100644
@@ -292,6 +292,7 @@ struct options
 bool up_delay;
 bool up_restart;
 bool daemon;
+ bool auth_nocache;
 
 int remap_sigusr1;
 

@@ -460,6 +461,7 @@ struct options

bool pull; /* client pull of config options from server */ int push_continuation;
const char *auth_user_pass_file;
+ const char *auth_user_pass_file_inline;
struct options_pre_pull *pre_pull;

int server_poll_timeout;

src/openvpn/ssl.c +0 -0

index 69f77f3..aa249f1 100644
@@ -354,36 +354,88 @@ static char *auth_challenge; /* GLOBAL */
 #endif
 

void
-auth_user_pass_setup (const char *auth_file, const struct static_challenge_info *sci)
+auth_user_pass_setup (const char *auth_file, const char *auth_file_inline, const struct static_challenge_info *sci)
{

src/openvpn/ssl.c +6 -0

+
+ int extra_flags = 0;
+ int n_inlined = 0;
+ char inlined_username[USER_PASS_LEN];
+ char inlined_password[USER_PASS_LEN];
+

auth_user_pass_enabled = true;
+
if (!auth_user_pass.defined)
{
+ if (auth_file && streq (auth_file, "stdin") && auth_file_inline)
+ {
+ /* check how much is inlined. */
+ const char *pos = auth_file_inline;
+ const char *prev = pos;

src/openvpn/ssl.c +34 -0

+
+ while( (pos = strchr(pos, '\n')) != NULL)
+ {
+ n_inlined++;
+
+ if (n_inlined == 1)
+ {
+ strncpy(inlined_username, prev, pos - prev);
+ inlined_username[pos - prev + 1] = '\0';
+ msg (M_INFO, "Using inlined username: %s", inlined_username);
+ }
+ else
+ {
+ strncpy(inlined_password, prev, pos - prev);
+ inlined_password[pos - prev + 1] = '\0';
+ msg (M_INFO, "Using inlined password: ...");
+ }
+
+ pos++;
+ prev = pos;
+ }
+
+ if (n_inlined == 1)
+ extra_flags = GET_USER_PASS_PASSWORD_ONLY;
+ }
+
+ if (n_inlined == 2)
+ {
+ strcpy(auth_user_pass.username, inlined_username);
+ strcpy(auth_user_pass.password, inlined_password);
+ auth_user_pass.defined = true;
+ }
+ else
+ {

#if AUTO_USERID
- get_user_pass_auto_userid (&auth_user_pass, auth_file);
+ get_user_pass_auto_userid (&auth_user_pass, auth_file); #else

# ifdef ENABLE_CLIENT_CR
- if (auth_challenge) /* dynamic challenge/response */
- get_user_pass_cr (&auth_user_pass,
- auth_file,
- UP_TYPE_AUTH,
- GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_DYNAMIC_CHALLENGE,
- auth_challenge);
- else if (sci) /* static challenge response */
- {
- int flags =
GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_STATIC_CHALLENGE;
- if (sci->flags & SC_ECHO)
- flags |= GET_USER_PASS_STATIC_CHALLENGE_ECHO;
- get_user_pass_cr (&auth_user_pass,
- auth_file,
- UP_TYPE_AUTH,
- flags,
- sci->challenge_text);
- }
- else
+ if (auth_challenge) /* dynamic challenge/response */
+ get_user_pass_cr (&auth_user_pass,
+ auth_file,
+ UP_TYPE_AUTH,
+
GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_DYNAMIC_CHALLENGE|extra_flags,
+ auth_challenge);
+ else if (sci) /* static challenge response */
+ {
+ int flags =
GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_STATIC_CHALLENGE|extra_flags;
+ if (sci->flags & SC_ECHO)
+ flags |= GET_USER_PASS_STATIC_CHALLENGE_ECHO;
+
+ get_user_pass_cr (&auth_user_pass,
+ auth_file,
+ UP_TYPE_AUTH,
+ flags,
+ sci->challenge_text);
+ }
+ else
# endif
- get_user_pass (&auth_user_pass, auth_file, UP_TYPE_AUTH,
GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE);
+ get_user_pass (&auth_user_pass, auth_file, UP_TYPE_AUTH,
GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|extra_flags);
#endif
+ }

src/openvpn/ssl.c +4 -0

+
+ if (n_inlined == 1)
+ strcpy(auth_user_pass.username, inlined_username);
+

}
}

src/openvpn/ssl.c +2 -2

@@ -1892,9 +1944,9 @@ key_method_2_write (struct buffer *buf, struct tls_session
 *session)
 if (auth_user_pass_enabled)
 {
 #ifdef ENABLE_CLIENT_CR
- auth_user_pass_setup (NULL, session->opt->sci);
+ auth_user_pass_setup (NULL, NULL, session->opt->sci);
 #else
- auth_user_pass_setup (NULL, NULL);
+ auth_user_pass_setup (NULL, NULL, NULL);
 #endif
 if (!write_string (buf, auth_user_pass.username, -1))

goto error;

src/openvpn/ssl.h +1 -1

index cd7cae2..c7554aa 100644
@@ -388,7 +388,7 @@ void pem_password_setup (const char *auth_file);
 * Setup authentication username and password. If auth_file is given, use the
 * credentials stored in the file.
 */
-void auth_user_pass_setup (const char *auth_file, const struct
 static_challenge_info *sc_info);
+void auth_user_pass_setup (const char *auth_file, const char *auth_file_inline,
 const struct static_challenge_info *sc_info);
 

/*
* Ensure that no caching is performed on authentication information
-- 1.7.10.4------------------------------------------------------------------------------ October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel[https://lists.sourceforge.net/lists/listinfo/openvpn-devel]

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk[http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk]

_______________________________________________
Openvpn-devel mailing list
[email protected]...; https://lists.sourceforge.net/lists/listinfo/openvpn-devel[https://lists.sourceforge.net/lists/listinfo/openvpn-devel]

Thanks for reporting! I have poor connectivity and little time this week, but I will look at it when I have a chance.

Sent from mobile

[email protected]... wrote:

So here we go, your points are all valid. The patch you attached has a spurious line, or maybe it's just my client that doesn't show it correctly, I see

openvpn/options.c +6 -1

@@ -5835,7 +5872,12 @@
       VERIFY_PERMISSION (OPT_P_GENERAL);
       if (p[1])
 	{
-	  options->auth_user_pass_file = p[1];
+          options->auth_user_pass_file = p[1];
+          if (streq (p[1], INLINE_FILE_TAG) && p[2])
+            { msg (M_WARN, "options.c \n  !!!SETTING !!! \n_ +5930,12 @@ add_optio"); 
+              options->auth_user_pass_file = "stdin";
+              options->auth_user_pass_file_inline = p[2];
+            }
 	}
 

I don't think the !!!SETTING !!! line should be there, so I'm going to send a revised patch in a few minutes which essentially includes all your suggestions (and is against master, I'm not sure yours was against master). I'm also citing your contribution in the new text, which I think is deserved.

Thanks also for showing that there is at least another person besides me interested in this functionality!

This patch allows inlining of the --auth-user-pass directive, so it is now possible to do

<auth-user-pass>
myusername
mypassword
</auth-user-pass>

or supply just the username, eg

<auth-user-pass>
myusername
</auth-user-pass>

(in this case the user is prompted for the password only).
The most changed files are options.c (sanity check of inlined credentials) and ssl.c (actual parsing of the inlined credentials).

Udates to the documentation will be provided in a separate patch if and when the present patch is accepted.

As discussed on IRC, for the time being the non-inlined syntax

auth-user-pass [up]

is still supported and [up] is expected to contain username and password on two lines.

Signed-off-by Davide Brini <[email protected]...>

Updated patch to current master, removed printing of the username/password.

Signed-off-by Adriaan de Jong <[email protected]...>

---
  doc/openvpn.8            |  3 +--
  src/openvpn/init.c       |  5 ++--
  src/openvpn/misc.c       |  2 +-
  src/openvpn/options.c    | 45 +++++++++++++++++++++++++++++++++--
  src/openvpn/options.h    |  2 ++
  src/openvpn/ssl.c        | 61 +++++++++++++++++++++++++++++++++++++++++++-----
  src/openvpn/ssl.h        |  2 +-
  src/openvpn/ssl_common.h |  1 +
  8 files changed, 107 insertions(+), 14 deletions(-)

doc/openvpn.8 +1 -2

index 829b09c..422b426 100644
@@ -6399,8 +6399,7 @@ X509_1_C=KG
  .SH INLINE FILE SUPPORT
  OpenVPN allows including files in the main configuration for the
  .B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret
-and
-.B \-\-tls\-auth
+.B \-\-tls\-auth and \-\-auth-user-pass
  options.
 
  Each inline file started by the line

src/openvpn/init.c +3 -2

index c32a809..ade8cae 100644
@@ -421,9 +421,9 @@ init_query_passwords (const struct context *c)
    if (c->options.auth_user_pass_file)
      {
  #ifdef ENABLE_CLIENT_CR
-      auth_user_pass_setup (c->options.auth_user_pass_file, &c->options.sc_info);
+      auth_user_pass_setup (c->options.auth_user_pass_file, c->options.auth_user_pass_file_inline, &c->options.sc_info);
  #else
-      auth_user_pass_setup (c->options.auth_user_pass_file, NULL);
+      auth_user_pass_setup (c->options.auth_user_pass_file, c->options.auth_user_pass_file_inline, NULL);
  #endif
      }
  #endif

@@ -2263,6 +2263,7 @@ do_init_crypto_tls (struct context *c, const unsigned int flags)
    if (options->ccd_exclusive)
      to.client_config_dir_exclusive = options->client_config_dir;
    to.auth_user_pass_file = options->auth_user_pass_file;
+  to.auth_user_pass_file_inline = options->auth_user_pass_file_inline;
  #endif
 
  #ifdef ENABLE_X509_TRACK

src/openvpn/misc.c +1 -1

index fd1930a..5158f66 100644
@@ -1003,7 +1003,7 @@ get_user_pass_cr (struct user_pass *up,
 
    if (!up->defined)
      {
-      const bool from_stdin = (!auth_file || !strcmp (auth_file, "stdin"));
+      const bool from_stdin = (!auth_file || streq (auth_file, "stdin"));
 
        if (flags & GET_USER_PASS_PREVIOUS_CREDS_FAILED)
  	msg (M_WARN, "Note: previous '%s' credentials failed", prefix);

src/openvpn/options.c +43 -2

index 7906f46..619a269 100644
@@ -2320,6 +2320,41 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
  #if P2MP
    if (options->auth_user_pass_file && !options->pull)
      msg (M_USAGE, "--auth-user-pass requires --pull");
+  if (options->auth_user_pass_file)
+    {
+      if ( (!streq(options->auth_user_pass_file, "stdin") || options->auth_user_pass_file_inline) && options->auth_nocache)
+        msg (M_USAGE, "Cannot use --auth-nocache with credentials from file");
+#ifdef ENABLE_CLIENT_CR
+      if ( (!streq(options->auth_user_pass_file, "stdin") || options->auth_user_pass_file_inline) && options->sc_info.challenge_text)
+        msg (M_USAGE, "Credentials cannot be in a file if using --static-challenge");
+#endif
+    }
+  if (options->auth_user_pass_file_inline)
+    {
+      int n_inlined = 0;
+      const char *pos = options->auth_user_pass_file_inline;
+      const char *prev = pos;
+
+      if ( strlen(pos) == 0 )
+        msg (M_USAGE, "Invalid format for inlined --auth-user-pass");
+
+      while( (pos = strchr(pos, '\n')) != NULL )
+        {
+          n_inlined++;
+
+          if (n_inlined > 2)
+            msg (M_USAGE, "Too many lines in inlined --auth-user-pass");
+
+          if ( pos - prev > USER_PASS_LEN - 1 )
+            msg (M_USAGE, "Line too long in inlined --auth-user-pass");
+
+          pos++;
+          prev = pos;
+        }
+
+      if ( (n_inlined == 0) || (*prev != '\0') )
+        msg (M_USAGE, "Invalid format for inlined --auth-user-pass");
+    }
  #endif
 
    uninit_options (&defaults);

@@ -2744,7 +2779,7 @@ options_postprocess_filechecks (struct options *options)
                               "--management user/password file");
  #endif /* ENABLE_MANAGEMENT */
  #if P2MP
-  errs |= check_file_access (CHKACC_FILE|CHKACC_ACPTSTDIN,
+  errs |= check_file_access (CHKACC_FILE|CHKACC_ACPTSTDIN|CHKACC_INLINE,
                               options->auth_user_pass_file, R_OK,
                               "--auth-user-pass");
  #endif /* P2MP */

@@ -5932,12 +5967,17 @@ add_option (struct options *options,
        VERIFY_PERMISSION (OPT_P_GENERAL);
        options->server_poll_timeout = positive_atoi(p[1]);
      }
-  else if (streq (p[0], "auth-user-pass") && !p[2])
+  else if (streq (p[0], "auth-user-pass") && p[1] && ((streq (p[1], INLINE_FILE_TAG) && p[2]) || !p[2]) && !p[3])
      {
        VERIFY_PERMISSION (OPT_P_GENERAL);
        if (p[1])
  	{
  	  options->auth_user_pass_file = p[1];
+          if (streq (p[1], INLINE_FILE_TAG) && p[2])
+            {
+              options->auth_user_pass_file = "stdin";
+              options->auth_user_pass_file_inline = p[2];
+            }
  	}
        else
  	options->auth_user_pass_file = "stdin";

@@ -6665,6 +6705,7 @@ add_option (struct options *options,
    else if (streq (p[0], "auth-nocache") && !p[1])
      {
        VERIFY_PERMISSION (OPT_P_GENERAL);
+      options->auth_nocache = true;
        ssl_set_auth_nocache ();
      }
    else if (streq (p[0], "auth-token") && p[1] && !p[2])

src/openvpn/options.h +2 -0

index c642aa0..903c663 100644
@@ -292,6 +292,7 @@ struct options
    bool up_delay;
    bool up_restart;
    bool daemon;
+  bool auth_nocache;
 
    int remap_sigusr1;
 

@@ -457,6 +458,7 @@ struct options
    int push_continuation;
    unsigned int push_option_types_found;
    const char *auth_user_pass_file;
+  const char *auth_user_pass_file_inline;
    struct options_pre_pull *pre_pull;
 
    int server_poll_timeout;

src/openvpn/ssl.c +55 -6

index 86eda77..7debaf8 100644
@@ -362,11 +362,57 @@ static char *auth_challenge; /* GLOBAL */
  #endif
 
  void
-auth_user_pass_setup (const char *auth_file, const struct static_challenge_info *sci)
+auth_user_pass_setup (const char *auth_file, const char *auth_file_inline, const struct static_challenge_info *sci)
  {
+  int extra_flags = 0;
+  int n_inlined = 0;
+  char inlined_username[USER_PASS_LEN];
+  char inlined_password[USER_PASS_LEN];
+
    auth_user_pass_enabled = true;
+
    if (!auth_user_pass.defined)
      {
+      if (auth_file && streq (auth_file, "stdin") && auth_file_inline)
+        {
+          /* check how much is inlined. */
+          const char *pos = auth_file_inline;
+          const char *prev = pos;
+
+          while( (pos = strchr(pos, '\n')) != NULL)
+            {
+              n_inlined++;
+
+              if (n_inlined == 1)
+                {
+                  strncpy(inlined_username, prev, pos - prev);
+                  inlined_username[pos - prev] = '\0';
+                  msg (M_INFO, "Using inlined username: %s", inlined_username);
+                }
+              else
+                {
+                  strncpy(inlined_password, prev, pos - prev);
+                  inlined_password[pos - prev] = '\0';
+                  msg (M_INFO, "Using inlined password: ... ");
+                }
+
+              pos++;
+              prev = pos;
+            }
+
+          if (n_inlined == 1)
+            extra_flags = GET_USER_PASS_PASSWORD_ONLY;
+        }
+
+      if (n_inlined == 2)
+        {
+          strcpy(auth_user_pass.username, inlined_username);
+          strcpy(auth_user_pass.password, inlined_password);
+          auth_user_pass.defined = true;
+        }
+      else
+        {
+
  #if AUTO_USERID
        get_user_pass_auto_userid (&auth_user_pass, auth_file);
  #else

@@ -375,11 +421,11 @@ auth_user_pass_setup (const char *auth_file, const struct static_challenge_info
         get_user_pass_cr (&auth_user_pass,
                           auth_file,
                           UP_TYPE_AUTH,
-                         GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_DYNAMIC_CHALLENGE,
+                         GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_DYNAMIC_CHALLENGE|extra_flags,
                           auth_challenge);
        else if (sci) /* static challenge response */
         {
-         int flags = GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_STATIC_CHALLENGE;
+         int flags = GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|GET_USER_PASS_STATIC_CHALLENGE|extra_flags;
           if (sci->flags & SC_ECHO)
             flags |= GET_USER_PASS_STATIC_CHALLENGE_ECHO;
           get_user_pass_cr (&auth_user_pass,

@@ -390,8 +436,11 @@ auth_user_pass_setup (const char *auth_file, const struct static_challenge_info
         }
        else
  # endif
-       get_user_pass (&auth_user_pass, auth_file, UP_TYPE_AUTH, GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE);
+       get_user_pass (&auth_user_pass, auth_file, UP_TYPE_AUTH, GET_USER_PASS_MANAGEMENT|GET_USER_PASS_SENSITIVE|extra_flags);
  #endif
+        }
+        if (n_inlined == 1)
+          strcpy(auth_user_pass.username, inlined_username);
      }
  }
 

@@ -1925,9 +1974,9 @@ key_method_2_write (struct buffer *buf, struct tls_session *session)
    if (auth_user_pass_enabled)
      {
  #ifdef ENABLE_CLIENT_CR
-      auth_user_pass_setup (session->opt->auth_user_pass_file, session->opt->sci);
+      auth_user_pass_setup (session->opt->auth_user_pass_file, session->opt->auth_user_pass_file_inline, session->opt->sci);
  #else
-      auth_user_pass_setup (session->opt->auth_user_pass_file, NULL);
+      auth_user_pass_setup (session->opt->auth_user_pass_file, session->opt->auth_user_pass_file_inline, NULL);
  #endif
        if (!write_string (buf, auth_user_pass.username, -1))
  	goto error;

src/openvpn/ssl.h +1 -1

index 797c3e5..9473c35 100644
@@ -389,7 +389,7 @@ void pem_password_setup (const char *auth_file);
   * Setup authentication username and password. If auth_file is given, use the
   * credentials stored in the file.
   */
-void auth_user_pass_setup (const char *auth_file, const struct static_challenge_info *sc_info);
+void auth_user_pass_setup (const char *auth_file, const char *auth_file_inline, const struct static_challenge_info *sc_info);
 
  /*
   * Ensure that no caching is performed on authentication information

src/openvpn/ssl_common.h +1 -0

index 86e4ac8..01f7a30 100644
@@ -278,6 +278,7 @@ struct tls_options
    bool auth_user_pass_verify_script_via_file;
    const char *tmp_dir;
    const char *auth_user_pass_file;
+  const char *auth_user_pass_file_inline;
 
    /* use the client-config-dir as a positive authenticator */
    const char *client_config_dir_exclusive;

This patch allows inlining of the --auth-user-pass directive, so it is now possible to do

This patch allows inlining of the --auth-user-pass directive, so it is now possible to do

<auth-user-pass>
myusername
mypassword
</auth-user-pass>

src/openvpn/options.c +5 -0

+  if (options->auth_user_pass_file_inline)
+    {
+      int n_inlined = 0;
+      const char *pos = options->auth_user_pass_file_inline;
+      const char *prev = pos;