Add a warning if --client-config-dir related config file cannot be opened
RFC PATCH 1/1 Add a warning if --client-config-dir related config file cannot be opened
From: David Sommerseth <[email protected]...>
This will cause a warning in the log file if --client-config-dir is configured but OpenVPN could not find or open the config file for the connecting client.
OpenVPN will also look for a file named 'DEFAULT' if a file named as the client's TLS Common Name cannot be found. To hide this warning above, create an empty 'DEFAULT' file inside the
--client-config-dir.
---
This patch is a result after some discssion on the #openvpn-devel IRC channel, where it seems many users do not realise the config files inside the --client-config-dir is not processed, due to wrong path, filename or lacking file access.
Currently it is not easy to provide a better warning message which gives a more fine grained reason why it fails. But I consider this still a better approach than the current one, which just silently fails.
src/openvpn/multi.c | 5 +++++ 1 file changed, 5 insertions(+)
src/openvpn/multi.c +5 -0
@@ -1659,6 +1659,11 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi &option_types_found, mi->context.c2.es); } +else + { +msg (M_WARN ,"[CCD] Failed to import client config for '%s'" , +tls_common_name (mi->context.c2.tls_multi, false)); + } } }
Signature · 1 line
1.7.10.2
Hi,
Quoted 10 lines · David Sommerseth
From: David Sommerseth <[email protected]...>
This will cause a warning in the log file if --client-config-dir is configured but OpenVPN could not find or open the config file for the connecting client.
OpenVPN will also look for a file named 'DEFAULT' if a file named as the client's TLS Common Name cannot be found. To hide this warning above, create an empty 'DEFAULT' file inside the
--client-config-dir.
I'm not sure I'm happy with that...
src/openvpn/multi.c multi_connection_established (struct multi_context *m, struct multi_instance *mi · line 1666
Quoted 5 lines
src/openvpn/multi.c +5
-0+else + { +msg (M_WARN ,"[CCD] Failed to import client config for '%s'" , +tls_common_name (mi->context.c2.tls_multi, false)); + }
I find the actual message confusing - what does "fail to *import*" mean?
Naive interpretation is "the file could be found, but there's something broken with it, like 'syntax errors' or such, but we won't tell you!".
So the message should be more along the lines of:
msg (M_WARN, "[CCD] client config file for '%s' not found (or unreadable), and no DEFAULT file either",
(while it would be even more nice to show *why* it fails, I can see that this is a bit tricky to get done without quite some extra code to remember test results, etc.)
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...Hi David
Quoted 3 lines · On Tuesday 14 August 2012 11:57:29 David Sommerseth wrote:
This will cause a warning in the log file if --client-config-dir is configured but OpenVPN could not find or open the config file for the connecting client.
There should only be a warning message if --ccd-exclusive is active. Otherwise mixed setups, where some users have a CCD entry and others use just the basic settings, will end up with a overly polluted log file. Adding a DEFAULT file somehow defeats the purpose of CCDs.
However, with --ccd-exclusive there already is a error message, generated in ssl_verify.c: "TLS Auth Error: --client-config-dir authentication failed for common name '%s' file='%s'".
Regards
Heiko
Signature · 2 lines
Heiko Hund | Sr. Software Engineer | Tel +49-721-25516-237 | Fax -200 SOPHOS NSG | Amalienbadstr. 41 Bau 52 | 76227 Karlsruhe | Germany