Bump version of openvpn plugin argument structs to 5

From: Selva Nair <[email protected]...>

This was missed in commit 6690769f78bbfb889fef2a54088d979896c87d51 that exported base64_encode and base64_decode() functions.

Also check the version is >= 5 in auth-pam plugin to ensure that the base64_decode function pointer can be referenced.

---
 include/openvpn-plugin.h.in     | 5 +++--
 src/plugins/auth-pam/auth-pam.c | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

index 5b64cbb..103844f 100644
@@ -219,10 +219,11 @@ struct openvpn_plugin_string_list
  *           OpenVPN to plug-ins.
  *
  *    4      Exported secure_memzero() as plugin_secure_memzero()
- *           Exported openvpn_base64_encode() as plugin_base64_encode()
+ *
+ *    5      Exported openvpn_base64_encode() as plugin_base64_encode()
  *           Exported openvpn_base64_decode() as plugin_base64_decode()
  */
-#define OPENVPN_PLUGINv3_STRUCTVER 4
+#define OPENVPN_PLUGINv3_STRUCTVER 5
 
 /**
  * Definitions needed for the plug-in callback functions.

index 3d564a9..1324307 100644
@@ -356,8 +356,8 @@ openvpn_plugin_open_v3(const int v3structver,
     const char **argv = args->argv;
     const char **envp = args->envp;
 
-    /* Check API compatibility -- struct version 4 or higher needed */
-    if (v3structver < 4)
+    /* Check API compatibility -- struct version 5 or higher needed */
+    if (v3structver < 5)
     {
         fprintf(stderr, "AUTH-PAM: This plugin is incompatible with the running version of OpenVPN\n");
         return OPENVPN_PLUGIN_FUNC_ERROR;

2.6.2

From: Selva Nair <[email protected]...>

In the auth-pam plugin correctly parse the static challenge string even when password or challenge response is empty.

Whether an empty user input is an error is determined by the PAM conversation function depending on whether the PAM module queries for it or not.

---
 src/plugins/auth-pam/auth-pam.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 1324307..88b5320 100644
@@ -310,11 +310,11 @@ split_scrv1_password(struct user_pass *up)
     *resp++ = '\0';
 
     int n = plugin_base64_decode(pass, up->password, sizeof(up->password)-1);
-    if (n > 0)
+    if (n >= 0)
     {
         up->password[n] = '\0';
         n = plugin_base64_decode(resp, up->response, sizeof(up->response)-1);
-        if (n > 0)
+        if (n >= 0)
         {
             up->response[n] = '\0';
             if (DEBUG(up->verb))

2.6.2

Looks good and passes my use case ("PIN set, OTP empty"). So it was not a bug in the openvpn client at all, I just misread the logs.

Since I join PIN+OTP into one string passed to PAM anyway, I also tested "PIN empty, OTP set" and that works just as well. Thanks.

Your patch has been applied to the master branch.

commit 7a8109023f4c345fe12f23421c5fa7e88e1ea85b

Author: Selva Nair
Date:   Tue Aug 7 22:44:31 2018 -0400

     Accept empty password and/or response in auth-pam plugin

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg17382.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

"Because it makes sense" :-) - and of course I've tested that it works - built a new plugin, ran with the previously-used openvpn binary, and it nicely fails

AUTH-PAM: This plugin is incompatible with the running version of OpenVPN
Wed Aug 8 09:25:43 2018 us=345993 PLUGIN_INIT: plugin initialization function failed: /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so Wed Aug 8 09:25:43 2018 us=346142 Exiting due to fatal error

Your patch has been applied to the master and release/2.4 branch (the plugin in 2.4 could do with v3structver = 4, but if we ever backport the challenge patch it will bite us, so just declare "we want 5!" here).

commit da0a42ca98623487726162b8710690cd3d003a63 (master) commit d8496285948b814d78ee4be6ded08ce02046f8ee (release/2.4)

Author: Selva Nair
Date:   Tue Aug 7 22:44:30 2018 -0400

     Bump version of openvpn plugin argument structs to 5

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/search?l=mid&[email protected]...
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering