Send push reply right after async auth complete

PATCH Superseded Lev Stipakov 2 participants 6 messages Oct 7, 2015 – Oct 11, 2015

Share & tools

Lev Stipakov

author

2015-10-07 13:32 UTC #0 lore raw

PATCH v2 1/1 Send push reply right after async auth complete

v2:
More careful inotify_watchers handling
* Ensure that same multi_instance is added only once
* Ensure that multi_instance is always removed

v1:
This feature speeds up connection establishment in cases when async authentication result is not ready when first push request arrives. At the moment server sends push reply only when it receives next push request, which comes 5 seconds later.

Implementation overview.

Add new configure option ENABLE_ASYNC_PUSH, which can be enabled if system supports inotify.

Add inotify descriptor to an event loop. Add inotify watch for a authentication control file. Store mapping between watch descriptor and multi_instance in a dictionary. When file is closed, inotify fires an event and we continue with connection establishment - call client- connect etc and send push reply.

Inotify watch descriptor got automatically deleted after file is closed or when file is removed. We catch that event and remove it from the dictionary.

Feature is easily tested with sample "defer" plugin and following settings:

auth-user-pass-optional
setenv test_deferred_auth 3
plugin simple.so

Signed-off-by Lev Stipakov <[email protected]...>

---
 configure.ac          |  15 +++++
 src/openvpn/forward.c |   8 +++
 src/openvpn/mtcp.c    |  28 ++++++++++
 src/openvpn/mudp.c    |  27 +++++++++
 src/openvpn/multi.c   | 152 +++++++++++++++++++++++++++++++++++++++++++++++++-
 src/openvpn/multi.h   |  14 +++++
 src/openvpn/openvpn.h |  11 ++++
 src/openvpn/push.c    |  69 +++++++++++++----------
 src/openvpn/push.h    |   2 +
 9 files changed, 295 insertions(+), 31 deletions(-)

configure.ac +15 -0

index 2e651d8..32620c6 100644
@@ -277,6 +277,13 @@ AC_ARG_ENABLE(
 	[enable_systemd="no"]
 )
 
+AC_ARG_ENABLE(
+	[async-push],
+	[AS_HELP_STRING([--enable-async-push], [enable async-push support @<:@default=no@:>@])],
+	[enable_async_push="yes"],
+	[enable_async_push="no"]
+)
+
 AC_ARG_WITH(
 	[special-build],
 	[AS_HELP_STRING([--with-special-build=STRING], [specify special build string])],

@@ -1201,6 +1208,14 @@ if test "${enable_plugin_auth_pam}" = "yes"; then
 	fi
 fi
 
+if test "${enable_async_push}" = "yes"; then
+	AC_CHECK_HEADERS(
+		[sys/inotify.h],
+		AC_DEFINE([ENABLE_ASYNC_PUSH], [1], [Enable async push]),
+		AC_MSG_ERROR([inotify.h not found.])
+	)
+fi
+
 CONFIGURE_DEFINES="`set | grep '^enable_.*=' ; set | grep '^with_.*='`"
 AC_DEFINE_UNQUOTED([CONFIGURE_DEFINES], ["`echo ${CONFIGURE_DEFINES}`"], [Configuration settings])

src/openvpn/forward.c +8 -0

index 7a5d383..134905c 100644
@@ -1371,6 +1371,9 @@ io_wait_dowork (struct context *c, const unsigned int flags)
 #ifdef ENABLE_MANAGEMENT
   static int management_shift = 6; /* depends on MANAGEMENT_READ and MANAGEMENT_WRITE */
 #endif
+#ifdef ENABLE_ASYNC_PUSH
+  static int file_shift = 8;
+#endif
 
   /*
    * Decide what kind of events we want to wait for.

@@ -1465,6 +1468,11 @@ io_wait_dowork (struct context *c, const unsigned int flags)
     management_socket_set (management, c->c2.event_set, (void*)&management_shift, NULL);
 #endif
 
+#ifdef ENABLE_ASYNC_PUSH
+  /* arm inotify watcher */
+  event_ctl (c->c2.event_set, c->c2.inotify_fd, EVENT_READ, (void*)&file_shift);
+#endif
+
   /*
    * Possible scenarios:
    *  (1) tcp/udp port has data available to read

src/openvpn/mtcp.c +28 -0

index dc15f09..b27c5eb 100644
@@ -62,6 +62,10 @@
 # define MTCP_MANAGEMENT ((void*)4)
 #endif
 
+#ifdef ENABLE_ASYNC_PUSH
+#define MTCP_FILE_CLOSE_WRITE ((void*)5)
+#endif
+
 #define MTCP_N           ((void*)16) /* upper bound on MTCP_x */
 
 struct ta_iow_flags

@@ -245,6 +249,12 @@ multi_tcp_wait (const struct context *c,
   if (management)
     management_socket_set (management, mtcp->es, MTCP_MANAGEMENT, &mtcp->management_persist_flags);
 #endif
+
+#ifdef ENABLE_ASYNC_PUSH
+  /* arm inotify watcher */
+  event_ctl (mtcp->es, c->c2.inotify_fd, EVENT_READ, MTCP_FILE_CLOSE_WRITE);
+#endif
+
   status = event_wait (mtcp->es, &c->c2.timeval, mtcp->esr, mtcp->maxevents);
   update_time ();
   mtcp->n_esr = 0;

@@ -636,6 +646,12 @@ multi_tcp_process_io (struct multi_context *m)
 	    {
 	      get_signal (&m->top.sig->signal_received);
 	    }
+#ifdef ENABLE_ASYNC_PUSH
+	  else if (e->arg == MTCP_FILE_CLOSE_WRITE)
+	    {
+	      multi_process_file_closed (m, MPP_PRE_SELECT | MPP_RECORD_TOUCH);
+	    }
+#endif
 	}
       if (IS_SIG (&m->top))
 	break;

@@ -684,6 +700,14 @@ tunnel_server_tcp (struct context *top)
   /* finished with initialization */
   initialization_sequence_completed (top, ISC_SERVER); /* --mode server --proto tcp-server */
 
+#ifdef ENABLE_ASYNC_PUSH
+  multi.top.c2.inotify_fd = inotify_init();
+  if (multi.top.c2.inotify_fd < 0)
+    {
+      msg (D_MULTI_ERRORS, "MULTI: inotify_init error: %s", strerror(errno));
+    }
+#endif
+
   /* per-packet event loop */
   while (true)
     {

@@ -712,6 +736,10 @@ tunnel_server_tcp (struct context *top)
       perf_pop ();
     }
 
+#ifdef ENABLE_ASYNC_PUSH
+  close(top->c2.inotify_fd);
+#endif
+
   /* shut down management interface */
   uninit_management_callback_multi (&multi);

src/openvpn/mudp.c +27 -0

index 57118f8..30ec345 100644
@@ -38,6 +38,10 @@
 
 #include "memdbg.h"
 
+#ifdef ENABLE_ASYNC_PUSH
+#include <sys/inotify.h>
+#endif
+
 /*
  * Get a client instance based on real address.  If
  * the instance doesn't exist, create it while

@@ -177,6 +181,10 @@ multi_process_io_udp (struct multi_context *m)
     strcat (buf, "TR/");
   else if (status & TUN_WRITE)
     strcat (buf, "TW/");
+#ifdef ENABLE_ASYNC_PUSH
+  else if (status & FILE_CLOSED)
+    strcat (buf, "FC/");
+#endif
   printf ("IO %s\n", buf);
 #endif

@@ -214,6 +222,13 @@ multi_process_io_udp (struct multi_context *m)
       if (!IS_SIG (&m->top))
 	multi_process_incoming_tun (m, mpp_flags);
     }
+#ifdef ENABLE_ASYNC_PUSH
+  /* INOTIFY callback */
+  else if (status & FILE_CLOSED)
+    {
+      multi_process_file_closed(m, mpp_flags);
+    }
+#endif
 }
 
 /*

@@ -276,6 +291,14 @@ tunnel_server_udp_single_threaded (struct context *top)
   /* finished with initialization */
   initialization_sequence_completed (top, ISC_SERVER); /* --mode server --proto udp */
 
+#ifdef ENABLE_ASYNC_PUSH
+  multi.top.c2.inotify_fd = inotify_init();
+  if (multi.top.c2.inotify_fd < 0)
+    {
+      msg (D_MULTI_ERRORS, "MULTI: inotify_init error: %s", strerror(errno));
+    }
+#endif
+
   /* per-packet event loop */
   while (true)
     {

@@ -304,6 +327,10 @@ tunnel_server_udp_single_threaded (struct context *top)
       perf_pop ();
     }
 
+#ifdef ENABLE_ASYNC_PUSH
+  close(top->c2.inotify_fd);
+#endif
+
   /* shut down management interface */
   uninit_management_callback_multi (&multi);

src/openvpn/multi.c +149 -3

222 lines not on this page · raw message

src/openvpn/multi.h +14 -0

index 32b89d2..2c3fc38 100644
@@ -105,6 +105,10 @@ struct multi_instance {
 
   struct context context;       /**< The context structure storing state
                                  *   for this VPN tunnel. */
+
+#ifdef ENABLE_ASYNC_PUSH
+  int inotify_watch; /* watch descriptor for acf */
+#endif
 };

@@ -172,6 +176,11 @@ struct multi_context {
    * Timer object for stale route check
    */
   struct event_timeout stale_routes_check_et;
+
+#ifdef ENABLE_ASYNC_PUSH
+  /* mapping between inotify watch descriptors and multi_instances */
+  struct hash *inotify_watchers;
+#endif
 };
 
 /*

@@ -327,6 +336,11 @@ void multi_close_instance_on_signal (struct multi_context *m, struct multi_insta
 void init_management_callback_multi (struct multi_context *m);
 void uninit_management_callback_multi (struct multi_context *m);
 
+
+#ifdef ENABLE_ASYNC_PUSH
+void multi_process_file_closed (struct multi_context *m, const unsigned int mpp_flags);
+#endif
+
 /*
  * Return true if our output queue is not full
  */

src/openvpn/openvpn.h +11 -0

index ef22269..da2a807 100644
@@ -241,6 +241,9 @@ struct context_2
 #  define MANAGEMENT_READ  (1<<6)
 #  define MANAGEMENT_WRITE (1<<7)
 # endif
+#ifdef ENABLE_ASYNC_PUSH
+# define FILE_CLOSED       (1<<8)
+#endif
 
   unsigned int event_set_status;

@@ -436,6 +439,9 @@ struct context_2
 #if P2MP_SERVER
   /* --ifconfig endpoints to be pushed to client */
   bool push_reply_deferred;
+#ifdef ENABLE_ASYNC_PUSH
+  bool push_request_received;
+#endif
   bool push_ifconfig_defined;
   time_t sent_push_reply_expiry;
   in_addr_t push_ifconfig_local;

@@ -479,6 +485,11 @@ struct context_2
 #ifdef MANAGEMENT_DEF_AUTH
   struct man_def_auth_context mda_context;
 #endif
+
+#ifdef ENABLE_ASYNC_PUSH
+  /* descriptor for monitoring file changes */
+  int inotify_fd;
+#endif
 };

src/openvpn/push.c +41 ~~-28~~

81 lines not on this page · raw message

src/openvpn/push.h +2 -0

index 8c3f157..5eca45f 100644
@@ -40,6 +40,8 @@
 void incoming_push_message (struct context *c,
 			    const struct buffer *buffer);
 
+int process_incoming_push_request (struct context *c);
+
 int process_incoming_push_msg (struct context *c,
 			       const struct buffer *buffer,
 			       bool honor_received_options,

Signature · 1 line

1.9.1

David Sommerseth

2015-10-10 13:21 UTC #1 lore raw

Quoted 45 lines · Lev Stipakov

v2:
More careful inotify_watchers handling
* Ensure that same multi_instance is added only once
* Ensure that multi_instance is always removed
v1:
This feature speeds up connection establishment in cases when async authentication result is not ready when first push request arrives. At the moment server sends push reply only when it receives next push request, which comes 5 seconds later.
Implementation overview.
Add new configure option ENABLE_ASYNC_PUSH, which can be enabled if system supports inotify.
Add inotify descriptor to an event loop. Add inotify watch for a authentication control file. Store mapping between watch descriptor and multi_instance in a dictionary. When file is closed, inotify fires an event and we continue with connection establishment - call client- connect etc and send push reply.
Inotify watch descriptor got automatically deleted after file is closed or when file is removed. We catch that event and remove it from the dictionary.
Feature is easily tested with sample "defer" plugin and following settings:
auth-user-pass-optional
setenv test_deferred_auth 3
plugin simple.so
Signed-off-by Lev Stipakov <[email protected]...>
---
 configure.ac          |  15 +++++
 src/openvpn/forward.c |   8 +++
 src/openvpn/mtcp.c    |  28 ++++++++++
 src/openvpn/mudp.c    |  27 +++++++++
 src/openvpn/multi.c   | 152 +++++++++++++++++++++++++++++++++++++++++++++++++-
 src/openvpn/multi.h   |  14 +++++
 src/openvpn/openvpn.h |  11 ++++
 src/openvpn/push.c    |  69 +++++++++++++----------
 src/openvpn/push.h    |   2 +
 9 files changed, 295 insertions(+), 31 deletions(-)

[...snip...]

src/openvpn/forward.c io_wait_dowork (struct context *c, const unsigned int flags) · line 1376

Quoted 11 lines

src/openvpn/forward.c +3 -0

index 7a5d383..134905c 100644
@@ -1371,6 +1371,9 @@ io_wait_dowork (struct context *c, const unsigned int flags)
 #ifdef ENABLE_MANAGEMENT
   static int management_shift = 6; /* depends on MANAGEMENT_READ and MANAGEMENT_WRITE */
 #endif
+#ifdef ENABLE_ASYNC_PUSH
+  static int file_shift = 8;
+#endif

Can we please have a comment on what this 'file_shift' value means? Just a single line comment. Perhaps 'file_change' would be a better name?

[...snip...]

src/openvpn/mudp.c line 44

Quoted 12 lines

src/openvpn/mudp.c +4 -0

index 57118f8..30ec345 100644
@@ -38,6 +38,10 @@
 
 #include "memdbg.h"
 
+#ifdef ENABLE_ASYNC_PUSH
+#include <sys/inotify.h>
+#endif
+

Maybe HAVE_SYS_INOTIFY_H is better?

[...snip...]

src/openvpn/multi.c line 35

Quoted 13 lines

src/openvpn/multi.c +5 -0

index 902c4dc..0da9ca7 100644
@@ -28,6 +28,11 @@
 #include "config-msvc.h"
 #endif
 
+#ifdef ENABLE_ASYNC_PUSH
+#include <sys/inotify.h>
+#define INOTIFY_EVENT_BUFFER_SIZE 16384
+#endif
+

Maybe HAVE_SYS_INOTIFY_H is better here too?

Quoted 4 lines

src/openvpn/multi.c +0 -0

 #include "syshead.h"
 
 #if P2MP_SERVER

src/openvpn/multi.c cid_compare_function (const void *key1, const void *key2) · line 257

Quoted 10 lines

src/openvpn/multi.c +6 -0

@@ -243,6 +248,20 @@ cid_compare_function (const void *key1, const void *key2)
 
 #endif
 
+#ifdef ENABLE_ASYNC_PUSH
+static uint32_t
+int_hash_function (const void *key, uint32_t iv)
+{
+  return (unsigned long)key;
+}

This looks very odd, but I understand it's required by hash_init(). Could you add a little remark about why this function looks so "useless"?

[...snip...]

Quoted 16 lines

src/openvpn/multi.c +8 -0

@@ -1877,6 +1932,14 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi
 
 	  /* set context-level authentication flag */
 	  mi->context.c2.context_auth = CAS_SUCCEEDED;
+
+#ifdef ENABLE_ASYNC_PUSH
+	  /* authentication complete, send push reply */
+	  if (mi->context.c2.push_request_received)
+	    {
+	      process_incoming_push_request(&mi->context);
+	    }
+#endif
 	}
       else
 	{

src/openvpn/multi.c multi_connection_established (struct multi_context *m, struct multi_instance *mi · line 1974

Quoted 6 lines

src/openvpn/multi.c +3 -0

@@ -1906,6 +1969,54 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi
   mi->context.c2.push_reply_deferred = false;
 }
 
+#ifdef ENABLE_ASYNC_PUSH
+void
+multi_process_file_closed (struct multi_context *m, const unsigned int mpp_flags)

It would be great to see a more verbose doxygen comment here, explaining what this function do, why and who calls it in which situations.

Quoted 49 lines

src/openvpn/multi.c +45 -0

+{
+  char buffer[INOTIFY_EVENT_BUFFER_SIZE];
+  size_t buffer_i = 0;
+  int r = read (m->top.c2.inotify_fd, buffer, INOTIFY_EVENT_BUFFER_SIZE);
+
+  while (buffer_i < r)
+    {
+      /* parse inotify events */
+      struct inotify_event *pevent = (struct inotify_event *) &buffer[buffer_i];
+      size_t event_size = sizeof (struct inotify_event) + pevent->len;
+      buffer_i += event_size;
+
+      msg(D_MULTI_DEBUG, "MULTI: modified fd %d, mask %d", pevent->wd, pevent->mask);
+
+      struct multi_instance* mi = hash_lookup(m->inotify_watchers, (void*) (unsigned long) pevent->wd);
+
+      if (pevent->mask & IN_CLOSE_WRITE)
+	{
+	  if (mi)
+	    {
+	      /* continue authentication and send push_reply */
+	      multi_process_post (m, mi, mpp_flags);
+	    }
+	  else
+	    {
+	      msg(D_MULTI_ERRORS, "MULTI: multi_instance not found!");
+	    }
+	}
+      else if (pevent->mask & IN_IGNORED)
+	{
+	  /* this event is _always_ fired when watch is removed or file is deleted */
+	  if (mi)
+	    {
+	      hash_remove(m->inotify_watchers, (void*) (unsigned long) pevent->wd);
+	      mi->inotify_watch = -1;
+	    }
+	}
+      else
+	{
+	  msg(D_MULTI_ERRORS, "MULTI: unknown mask %d", pevent->mask);
+	}
+    }
+}
+#endif
+
 /*
  * Add a mbuf buffer to a particular
  * instance.

src/openvpn/multi.c multi_process_post (struct multi_context *m, struct multi_instance *mi, const un · line 2181

Quoted 5 lines

src/openvpn/multi.c +2 -0

@@ -2066,19 +2177,54 @@ multi_process_post (struct multi_context *m, struct multi_instance *mi, const un
 
   if (!IS_SIG (&mi->context) && ((flags & MPP_PRE_SELECT) || ((flags & MPP_CONDITIONAL_PRE_SELECT) && !ANY_OUT (&mi->context))))
     {
+#ifdef ENABLE_ASYNC_PUSH
+#ifdef ENABLE_DEF_AUTH

Could we combine these #ifdefs instead of nesting them? Something like:

   #if defined(ENABLE_ASYNC_PUSH) && defined(ENABLE_DEF_AUTH)

Quoted 7 lines

src/openvpn/multi.c +7 -0

+      bool was_authenticated = false;
+      struct key_state *ks = NULL;
+      if (mi->context.c2.tls_multi)
+        {
+          ks = &mi->context.c2.tls_multi->session[TM_ACTIVE].key[KS_PRIMARY];
+          was_authenticated = ks->authenticated;
+        }

src/openvpn/multi.c multi_process_post (struct multi_context *m, struct multi_instance *mi, const un · line 2197

Quoted 10 lines

src/openvpn/multi.c +5 -1

+#endif
+#endif
+
       /* figure timeouts and fetch possible outgoing
 	 to_link packets (such as ping or TLS control) */
       pre_select (&mi->context);
 
-      if (!IS_SIG (&mi->context))
+#ifdef ENABLE_ASYNC_PUSH
+#ifdef ENABLE_DEF_AUTH

Same here ... combine these #ifdefs

src/openvpn/multi.c multi_process_post (struct multi_context *m, struct multi_instance *mi, const un · line 2201

Quoted 6 lines

src/openvpn/multi.c +3 -2

+      if (ks && ks->auth_control_file && ks->auth_deferred && !was_authenticated)
 	{
-	  /* tell scheduler to wake us up at some point in the future */
-	  multi_schedule_context_wakeup(m, mi);
+	  /* watch acf file */
+	  long wd = inotify_add_watch(m->top.c2.inotify_fd, ks->auth_control_file, IN_CLOSE_WRITE | IN_ONESHOT);

What does 'wd' mean in this context? Could the variable be slightly more descriptive.

[...snip...]

src/openvpn/openvpn.h struct context_2 · line 246

Quoted 11 lines

src/openvpn/openvpn.h +3 -0

index ef22269..da2a807 100644
@@ -241,6 +241,9 @@ struct context_2
 #  define MANAGEMENT_READ  (1<<6)
 #  define MANAGEMENT_WRITE (1<<7)
 # endif
+#ifdef ENABLE_ASYNC_PUSH
+# define FILE_CLOSED       (1<<8)
+#endif

I see that the management stuff is also #ifdef'ed here. But I'm not sure it's a clever idea to #ifdef bitmasks ... that can seed some fun debugging situations. On the otherhand, you can't use these macros if they're #ifdef'ed and you use them without of ENABLE_ASYNC_PUSH. I'm torn.

Quoted 13 lines

src/openvpn/openvpn.h +3 -0

   unsigned int event_set_status;

@@ -436,6 +439,9 @@ struct context_2
 #if P2MP_SERVER
   /* --ifconfig endpoints to be pushed to client */
   bool push_reply_deferred;
+#ifdef ENABLE_ASYNC_PUSH
+  bool push_request_received;
+#endif
   bool push_ifconfig_defined;
   time_t sent_push_reply_expiry;
   in_addr_t push_ifconfig_local;

src/openvpn/openvpn.h struct context_2 · line 491

Quoted 7 lines

src/openvpn/openvpn.h +4 -0

@@ -479,6 +485,11 @@ struct context_2
 #ifdef MANAGEMENT_DEF_AUTH
   struct man_def_auth_context mda_context;
 #endif
+
+#ifdef ENABLE_ASYNC_PUSH
+  /* descriptor for monitoring file changes */
+  int inotify_fd;

Just a nit pick, could we move the comment to the same line as the declaration?

[...snip...]

Otherwise, this looks reasonable and fine. Feature wise it is very useful. I've done some quick compile and sanity tests, as this has been used in production in your own environment for about a year or so. So most of the bugs have hopefully already been squashed.

Signature · 3 lines

kind regards,

David Sommerseth

Lev Stipakov

author

2015-10-10 16:04 UTC #2 lore raw

PATCH v3 1/1 Send push reply right after async auth complete

v3:
* better comments
* better variable naming
* include sys/inotify.h if HAVE_SYS_INOTIFY_H is defined

v2:
More careful inotify_watchers handling
* Ensure that same multi_instance is added only once
* Ensure that multi_instance is always removed

Implementation overview.

Add new configure option ENABLE_ASYNC_PUSH, which can be enabled if system supports inotify.

Inotify watch descriptor got automatically deleted after file is closed or when file is removed. We catch that event and remove it from the dictionary.

Feature is easily tested with sample "defer" plugin and following settings:

auth-user-pass-optional
setenv test_deferred_auth 3
plugin simple.so

Signed-off-by Lev Stipakov <[email protected]...>

Add doxygen comment

---
 configure.ac          |  15 +++++
 src/openvpn/forward.c |   8 +++
 src/openvpn/mtcp.c    |  28 +++++++++
 src/openvpn/mudp.c    |  27 +++++++++
 src/openvpn/multi.c   | 155 +++++++++++++++++++++++++++++++++++++++++++++++++-
 src/openvpn/multi.h   |  21 +++++++
 src/openvpn/openvpn.h |  10 ++++
 src/openvpn/push.c    |  69 +++++++++++++---------
 src/openvpn/push.h    |   2 +
 9 files changed, 304 insertions(+), 31 deletions(-)

configure.ac +15 -0

index 2e651d8..32620c6 100644
@@ -277,6 +277,13 @@ AC_ARG_ENABLE(
 	[enable_systemd="no"]
 )
 
+AC_ARG_ENABLE(
+	[async-push],
+	[AS_HELP_STRING([--enable-async-push], [enable async-push support @<:@default=no@:>@])],
+	[enable_async_push="yes"],
+	[enable_async_push="no"]
+)
+
 AC_ARG_WITH(
 	[special-build],
 	[AS_HELP_STRING([--with-special-build=STRING], [specify special build string])],

@@ -1201,6 +1208,14 @@ if test "${enable_plugin_auth_pam}" = "yes"; then
 	fi
 fi
 
+if test "${enable_async_push}" = "yes"; then
+	AC_CHECK_HEADERS(
+		[sys/inotify.h],
+		AC_DEFINE([ENABLE_ASYNC_PUSH], [1], [Enable async push]),
+		AC_MSG_ERROR([inotify.h not found.])
+	)
+fi
+
 CONFIGURE_DEFINES="`set | grep '^enable_.*=' ; set | grep '^with_.*='`"
 AC_DEFINE_UNQUOTED([CONFIGURE_DEFINES], ["`echo ${CONFIGURE_DEFINES}`"], [Configuration settings])

src/openvpn/forward.c +8 -0

index 7a5d383..f89c5bc 100644
@@ -1371,6 +1371,9 @@ io_wait_dowork (struct context *c, const unsigned int flags)
 #ifdef ENABLE_MANAGEMENT
   static int management_shift = 6; /* depends on MANAGEMENT_READ and MANAGEMENT_WRITE */
 #endif
+#ifdef ENABLE_ASYNC_PUSH
+  static int file_shift = 8;       /* listening inotify events */
+#endif
 
   /*
    * Decide what kind of events we want to wait for.

@@ -1465,6 +1468,11 @@ io_wait_dowork (struct context *c, const unsigned int flags)
     management_socket_set (management, c->c2.event_set, (void*)&management_shift, NULL);
 #endif
 
+#ifdef ENABLE_ASYNC_PUSH
+  /* arm inotify watcher */
+  event_ctl (c->c2.event_set, c->c2.inotify_fd, EVENT_READ, (void*)&file_shift);
+#endif
+
   /*
    * Possible scenarios:
    *  (1) tcp/udp port has data available to read

src/openvpn/mtcp.c +28 -0

index dc15f09..b27c5eb 100644
@@ -62,6 +62,10 @@
 # define MTCP_MANAGEMENT ((void*)4)
 #endif
 
+#ifdef ENABLE_ASYNC_PUSH
+#define MTCP_FILE_CLOSE_WRITE ((void*)5)
+#endif
+
 #define MTCP_N           ((void*)16) /* upper bound on MTCP_x */
 
 struct ta_iow_flags

@@ -245,6 +249,12 @@ multi_tcp_wait (const struct context *c,
   if (management)
     management_socket_set (management, mtcp->es, MTCP_MANAGEMENT, &mtcp->management_persist_flags);
 #endif
+
+#ifdef ENABLE_ASYNC_PUSH
+  /* arm inotify watcher */
+  event_ctl (mtcp->es, c->c2.inotify_fd, EVENT_READ, MTCP_FILE_CLOSE_WRITE);
+#endif
+
   status = event_wait (mtcp->es, &c->c2.timeval, mtcp->esr, mtcp->maxevents);
   update_time ();
   mtcp->n_esr = 0;

@@ -636,6 +646,12 @@ multi_tcp_process_io (struct multi_context *m)
 	    {
 	      get_signal (&m->top.sig->signal_received);
 	    }
+#ifdef ENABLE_ASYNC_PUSH
+	  else if (e->arg == MTCP_FILE_CLOSE_WRITE)
+	    {
+	      multi_process_file_closed (m, MPP_PRE_SELECT | MPP_RECORD_TOUCH);
+	    }
+#endif
 	}
       if (IS_SIG (&m->top))
 	break;

@@ -684,6 +700,14 @@ tunnel_server_tcp (struct context *top)
   /* finished with initialization */
   initialization_sequence_completed (top, ISC_SERVER); /* --mode server --proto tcp-server */
 
+#ifdef ENABLE_ASYNC_PUSH
+  multi.top.c2.inotify_fd = inotify_init();
+  if (multi.top.c2.inotify_fd < 0)
+    {
+      msg (D_MULTI_ERRORS, "MULTI: inotify_init error: %s", strerror(errno));
+    }
+#endif
+
   /* per-packet event loop */
   while (true)
     {

@@ -712,6 +736,10 @@ tunnel_server_tcp (struct context *top)
       perf_pop ();
     }
 
+#ifdef ENABLE_ASYNC_PUSH
+  close(top->c2.inotify_fd);
+#endif
+
   /* shut down management interface */
   uninit_management_callback_multi (&multi);

src/openvpn/mudp.c +27 -0

index 57118f8..3aed3a0 100644
@@ -38,6 +38,10 @@
 
 #include "memdbg.h"
 
+#ifdef HAVE_SYS_INOTIFY_H
+#include <sys/inotify.h>
+#endif
+
 /*
  * Get a client instance based on real address.  If
  * the instance doesn't exist, create it while

@@ -177,6 +181,10 @@ multi_process_io_udp (struct multi_context *m)
     strcat (buf, "TR/");
   else if (status & TUN_WRITE)
     strcat (buf, "TW/");
+#ifdef ENABLE_ASYNC_PUSH
+  else if (status & FILE_CLOSED)
+    strcat (buf, "FC/");
+#endif
   printf ("IO %s\n", buf);
 #endif

@@ -214,6 +222,13 @@ multi_process_io_udp (struct multi_context *m)
       if (!IS_SIG (&m->top))
 	multi_process_incoming_tun (m, mpp_flags);
     }
+#ifdef ENABLE_ASYNC_PUSH
+  /* INOTIFY callback */
+  else if (status & FILE_CLOSED)
+    {
+      multi_process_file_closed(m, mpp_flags);
+    }
+#endif
 }
 
 /*

@@ -276,6 +291,14 @@ tunnel_server_udp_single_threaded (struct context *top)
   /* finished with initialization */
   initialization_sequence_completed (top, ISC_SERVER); /* --mode server --proto udp */
 
+#ifdef ENABLE_ASYNC_PUSH
+  multi.top.c2.inotify_fd = inotify_init();
+  if (multi.top.c2.inotify_fd < 0)
+    {
+      msg (D_MULTI_ERRORS, "MULTI: inotify_init error: %s", strerror(errno));
+    }
+#endif
+
   /* per-packet event loop */
   while (true)
     {

@@ -304,6 +327,10 @@ tunnel_server_udp_single_threaded (struct context *top)
       perf_pop ();
     }
 
+#ifdef ENABLE_ASYNC_PUSH
+  close(top->c2.inotify_fd);
+#endif
+
   /* shut down management interface */
   uninit_management_callback_multi (&multi);

src/openvpn/multi.c +152 -3

225 lines not on this page · raw message

src/openvpn/multi.h +21 -0

index 32b89d2..69ed85e 100644
@@ -105,6 +105,10 @@ struct multi_instance {
 
   struct context context;       /**< The context structure storing state
                                  *   for this VPN tunnel. */
+
+#ifdef ENABLE_ASYNC_PUSH
+  int inotify_watch; /* watch descriptor for acf */
+#endif
 };

@@ -172,6 +176,11 @@ struct multi_context {
    * Timer object for stale route check
    */
   struct event_timeout stale_routes_check_et;
+
+#ifdef ENABLE_ASYNC_PUSH
+  /* mapping between inotify watch descriptors and multi_instances */
+  struct hash *inotify_watchers;
+#endif
 };
 
 /*

@@ -327,6 +336,18 @@ void multi_close_instance_on_signal (struct multi_context *m, struct multi_insta
 void init_management_callback_multi (struct multi_context *m);
 void uninit_management_callback_multi (struct multi_context *m);
 
+
+#ifdef ENABLE_ASYNC_PUSH
+/**
+ * Called when inotify event is fired, which happens when acf file is closed or deleted.
+ * Continues authentication and sends push_repl
+ *
+ * @param m multi_context
+ * @param mpp_flags
+ */
+void multi_process_file_closed (struct multi_context *m, const unsigned int mpp_flags);
+#endif
+
 /*
  * Return true if our output queue is not full
  */

src/openvpn/openvpn.h +10 -0

index ef22269..4fab00b 100644
@@ -241,6 +241,9 @@ struct context_2
 #  define MANAGEMENT_READ  (1<<6)
 #  define MANAGEMENT_WRITE (1<<7)
 # endif
+#ifdef ENABLE_ASYNC_PUSH
+# define FILE_CLOSED       (1<<8)
+#endif
 
   unsigned int event_set_status;

@@ -436,6 +439,9 @@ struct context_2
 #if P2MP_SERVER
   /* --ifconfig endpoints to be pushed to client */
   bool push_reply_deferred;
+#ifdef ENABLE_ASYNC_PUSH
+  bool push_request_received;
+#endif
   bool push_ifconfig_defined;
   time_t sent_push_reply_expiry;
   in_addr_t push_ifconfig_local;

@@ -479,6 +485,10 @@ struct context_2
 #ifdef MANAGEMENT_DEF_AUTH
   struct man_def_auth_context mda_context;
 #endif
+
+#ifdef ENABLE_ASYNC_PUSH
+  int inotify_fd; /* descriptor for monitoring file changes */
+#endif
 };

src/openvpn/push.c +41 ~~-28~~

81 lines not on this page · raw message

src/openvpn/push.h +2 -0

index 8c3f157..5eca45f 100644
@@ -40,6 +40,8 @@
 void incoming_push_message (struct context *c,
 			    const struct buffer *buffer);
 
+int process_incoming_push_request (struct context *c);
+
 int process_incoming_push_msg (struct context *c,
 			       const struct buffer *buffer,
 			       bool honor_received_options,

Signature · 1 line

1.9.1

David Sommerseth

2015-10-11 09:07 UTC #3 lore raw

Your patch has been applied to the master branch.

commit 0d1a75bfe241466230c41a52c6013494135c5935

Author: Lev Stipakov
Date:   Sat Oct 10 19:04:25 2015 +0300

     Send push reply right after async auth complete

     Signed-off-by: Lev Stipakov <[email protected]...>
     Acked-by: David Sommerseth <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10248
     Signed-off-by: David Sommerseth <[email protected]...>

--
kind regards,

David Sommerseth

Lev Stipakov

author

2015-10-11 10:15 UTC #4 lore raw

PATCH 1/1 Fix compilation with --disable-server

Add missing #if P2MP_SERVER

---
 src/openvpn/push.c | 2 ++
 src/openvpn/push.h | 5 ++---
 2 files changed, 4 insertions(+), 3 deletions(-)

src/openvpn/push.c +2 -0

index 704818d..a4cb726 100644
@@ -410,6 +410,7 @@ push_reset (struct options *o)
 }
 #endif
 
+#if P2MP_SERVER
 int
 process_incoming_push_request (struct context *c)
 {

@@ -449,6 +450,7 @@ process_incoming_push_request (struct context *c)
 
   return ret;
 }
+#endif
 
 int
 process_incoming_push_msg (struct context *c,

src/openvpn/push.h +2 -3

index 5eca45f..fa06e08 100644
@@ -37,9 +37,6 @@
 #define PUSH_MSG_CONTINUATION     5
 #define PUSH_MSG_ALREADY_REPLIED  6
 
-void incoming_push_message (struct context *c,
-			    const struct buffer *buffer);
-
 int process_incoming_push_request (struct context *c);
 
 int process_incoming_push_msg (struct context *c,

@@ -56,6 +53,8 @@ void server_pushed_signal (struct context *c, const struct buffer *buffer, const
 
 #if P2MP_SERVER
 
+void incoming_push_message (struct context *c, const struct buffer *buffer);
+
 void clone_push_list (struct options *o);
 
 void push_option (struct options *o, const char *opt, int msglevel);

Signature · 1 line

1.9.1

David Sommerseth

2015-10-11 11:04 UTC #5 lore raw

[Openvpn-devel] [PATCH applied] Re: Fix compilation with --disable-server

ACK. Your patch has been applied to the master branch.

commit 958d08213625b02782a060ff70cc2639f23615e6

Author: Lev Stipakov
Date:   Sun Oct 11 13:15:31 2015 +0300

     Fix compilation with --disable-server

     Acked-by: David Sommerseth <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10259
     Signed-off-by: David Sommerseth <[email protected]...>

--
kind regards,

David Sommerseth