Don't require DAF_INITIAL_AUTH to send ADDRESS/DISCONNECT messages
PATCH 1/1 Don't require DAF_INITIAL_AUTH to send ADDRESS/DISCONNECT messages
From: Adrien Bustany <[email protected]...>
As discussed in [1], here is a cleaned up version of my patch to fix the sending of CLIENT:ADDRESS/CLIENT:DISCONNECT message on the management interface when using password-less TLS certificate authentication. It seems that DAF_INITIAL_AUTH is now unused, should I send another patch that removes it altogether?
Adrien Bustany (1):
management: Don't require DAF_INITIAL_AUTH to send ADDRESS/DISCONNECT
messages
src/openvpn/manage.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
Signature · 1 line
1.7.8.1
PATCH 1/1 management: Don't require DAF_INITIAL_AUTH to send ADDRESS/DISCONNECT messages
From: Adrien Bustany <[email protected]...>
DAF_INITIAL_AUTH will only be set if a password was needed for client authentication. This means that for password-less certificate authentication, no DISCONNECT/ADDRESS messages would be sent.
--- src/openvpn/manage.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)
src/openvpn/manage.c +2 -2
@@ -2474,7 +2474,7 @@ management_notify_client_close (struct management *management, struct man_def_auth_context *mdac, const struct env_set *es) { -if ((mdac->flags &DAF_INITIAL_AUTH ) && !(mdac->flags &DAF_CONNECTION_CLOSED )) +if (!(mdac->flags &DAF_CONNECTION_CLOSED )) {msg (M_CLIENT ,">CLIENT:DISCONNECT,%lu" , mdac->cid);man_output_env (es, true, management->connection.env_filter_level,"CLIENT" );
@@ -2489,7 +2489,7 @@ management_learn_addr (struct management *management, const bool primary) {struct gc_arena gc =gc_new (); -if ((mdac->flags &DAF_INITIAL_AUTH ) && !(mdac->flags &DAF_CONNECTION_CLOSED )) +if (!(mdac->flags &DAF_CONNECTION_CLOSED )) { msg (M_CLIENT, ">CLIENT:ADDRESS,%lu,%s,%d", mdac->cid,
Signature · 1 line
1.7.8.1
Re: [Openvpn-devel] [PATCH] management: Don't require DAF_INITIAL_AUTH to send ADDRESS/DISCONNECT messages
Quoted 24 lines
From: Adrien Bustany <[email protected]...>
DAF_INITIAL_AUTHwill only be set if a password was needed for client authentication. This means that for password-less certificate authentication, no DISCONNECT/ADDRESS messages would be sent.--- src/openvpn/manage.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)src/openvpn/manage.c +1
-1@@ -2474,7 +2474,7 @@ management_notify_client_close (struct management *management, struct man_def_auth_context *mdac, const struct env_set *es) { -if ((mdac->flags &DAF_INITIAL_AUTH ) && !(mdac->flags &DAF_CONNECTION_CLOSED )) +if (!(mdac->flags &DAF_CONNECTION_CLOSED )) {msg (M_CLIENT ,">CLIENT:DISCONNECT,%lu" , mdac->cid);man_output_env (es, true, management->connection.env_filter_level,"CLIENT" );
src/openvpn/manage.c management_learn_addr (struct management *management, · line 2495
Quoted 8 lines
src/openvpn/manage.c +1
-1@@ -2489,7 +2489,7 @@ management_learn_addr (struct management *management, const bool primary) {struct gc_arena gc =gc_new (); -if ((mdac->flags &DAF_INITIAL_AUTH ) && !(mdac->flags &DAF_CONNECTION_CLOSED )) +if (!(mdac->flags &DAF_CONNECTION_CLOSED )) { msg (M_CLIENT, ">CLIENT:ADDRESS,%lu,%s,%d", mdac->cid,
Hi Adrien,
We discussed this patch in our IRC meeting yesterday, and couple of questions popped up... First, what is the benefit of this patch? Is it just to see if the clients connect even if they're not using password authentication? Second, what's the impact on existing management interface clients, i.e. can this patch break compatibility?
Best regards,
Signature · 5 lines
Samuli Seppänen Community Manager OpenVPN Technologies, Inc irc freenode net: mattock
Re: [Openvpn-devel] [PATCH] management: Don't require DAF_INITIAL_AUTH to send ADDRESS/DISCONNECT messages
Le 2012-06-22 13:23, Samuli Seppänen a écrit :
Quoted 38 lines
Quoted 35 lines
From: Adrien Bustany <[email protected]...>
DAF_INITIAL_AUTHwill only be set if a password was needed for client authentication. This means that for password-less certificate authentication, no DISCONNECT/ADDRESS messages would be sent.--- src/openvpn/manage.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)src/openvpn/manage.c +1
-1@@ -2474,7 +2474,7 @@ management_notify_client_close (structmanagement *management, struct man_def_auth_context *mdac, const struct env_set *es) { - if ((mdac->flags & DAF_INITIAL_AUTH) && !(mdac->flags & DAF_CONNECTION_CLOSED)) + if (!(mdac->flags & DAF_CONNECTION_CLOSED)) {msg (
M_CLIENT, ">CLIENT:DISCONNECT,%lu",mdac->cid);man_output_env(es, true,management->connection.env_filter_level, "CLIENT");src/openvpn/manage.c +1
-1@@ -2489,7 +2489,7 @@ management_learn_addr (struct management *management, const bool primary) {struct gc_arena gc =gc_new (); -if ((mdac->flags &DAF_INITIAL_AUTH ) && !(mdac->flags & DAF_CONNECTION_CLOSED)) +if (!(mdac->flags &DAF_CONNECTION_CLOSED )) {msg (M_CLIENT, ">CLIENT:ADDRESS,%lu,%s,%d",Quoted 1 line
mdac->cid,Hi Adrien,
Quoted 7 lines
We discussed this patch in our IRC meeting yesterday, and couple of questions popped up... First, what is the benefit of this patch? Is it just to see if the clients connect even if they're not using password authentication? Second, what's the impact on existing management interface clients, i.e. can this patch break compatibility?
Best regards,
Hi Samuli
thanks for reviewing the patch. What this patch does is as you said enable a program monitoring the management interface of an openvpn daemon to get connection events for clients authenticating with a password-less TLS certificate. We found it useful, since in our case that's what clients use and we still wanted to monitor who was connected and with what IP. I can't vouch at a 100% for backwards compatibility, mainly since I don't have a windows machine to test the existing management interface. Is there another way to test that? Any unit tests?
Cheers
Adrien