Avoid partial authentication state when using --disabled in CCD configs

From: David Sommerseth <[email protected]...>

If an openvpn server is configured with --client-config-dir and a client configuration file contains 'disabled', it is supposed to tell the client it is not authorized to use the service.

This patch will ensure that the internal state in this scenario is a complete CAS_FAILED state, and not CAS_PARTIAL if other authorization steps passed.

Trac: #521

---
 src/openvpn/multi.c | 1 +
 1 file changed, 1 insertion(+)

index 7c3aaac..e999450 100644
@@ -1858,6 +1858,7 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi
 	{
 	  msg (D_MULTI_ERRORS, "MULTI: client has been rejected due to 'disable' directive");
 	  cc_succeeded = false;
+	  cc_succeeded_count = 0;
 	}
 
       if (cc_succeeded)

1.8.3.1

ACK, thanks. As discussed in #521 and #180, I'm thinking more along the lines of a more radical approach to this (removing CAS_PARTIAL, or at least make it do the right thing - call plugin destructors, and send AUTH_FAILED). But for the time being this one fixes nicely and cleanly the issue at hand, with no possibly intended consequences.

Your patch has been applied to the master and release/2.3 branch.

commit 6c2d790ad8f10029e95aecb0d39377ef06ea8b2a (master) commit 4b0a6f808e20f1d6d6a0b60391f053bc8ab94772 (release/2.3)

Author: David Sommerseth
Date:   Wed Nov 11 14:01:39 2015 +0100

     Avoid partial authentication state when using --disabled in CCD configs

     Signed-off-by: David Sommerseth <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10486
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering