Add support to ignore specific options.

PATCH Superseded Arne Schwabe 2 participants 6 messages Jun 21, 2013 – Aug 16, 2013

Share & tools

Arne Schwabe

author

2013-06-21 12:43 UTC #0 lore raw

PATCH 1/1 Add support to ignore specific options.

---
 doc/openvpn.8         |   24 ++++++++++++++++++++-
 src/openvpn/options.c |   56 +++++++++++++++++++++++++++++++++++++++++++++++--
 src/openvpn/options.h |    2 ++
 3 files changed, 79 insertions(+), 3 deletions(-)

doc/openvpn.8 +23 -1

index 949577b..d384252 100644
@@ -1888,9 +1888,31 @@ in future OpenVPN versions.
 
 This option should be used with caution, as there are good security
 reasons for having OpenVPN fail if it detects problems in a
-config file.  Having said that, there are valid reasons for wanting
+config file. Having said that, there are valid reasons for wanting
 new software features to gracefully degrade when encountered by
 older software versions.
+
+See also 
+.B \-\-ignore-unknown-option
+.\"*********************************************************
+.TP
+.B \-\-ignore-unknown-option opt1 opt2 opt3 ... optN
+When one of options 
+.B opt1 ... optN
+is encountered in the configuration file the configuration 
+file parsing does not fail if this OpenVPN version does not 
+support the option. Multiple 
+.B \-\-ignore-unknown-option
+options can be given to support a larger number of options to ignore. 
+
+This option should be used with caution, as there are good security
+reasons for having OpenVPN fail if it detects problems in a
+config file. Having said that, there are valid reasons for wanting
+new software features to gracefully degrade when encountered by
+older software versions.
+
+.B \-\-ignore-unknown-option
+is available since OpenVPN 2.3.3.
 .\"*********************************************************
 .TP
 .B \-\-setenv-safe name value

src/openvpn/options.c +54 -2

76 lines not on this page · raw message

src/openvpn/options.h +2 -0

index 6a132a6..8e0e367 100644
@@ -186,6 +186,8 @@ struct options
 
   /* enable forward compatibility for post-2.1 features */
   bool forward_compatible;
+  /* list of options that should be ignored even if unkown */
+  const char **  ignore_unknown_option;
 
   /* persist parms */
   bool persist_config;

Signature · 1 line

1.7.9.5

Gert Doering

2013-07-11 18:24 UTC #1 lore raw

Hi,

Quoted 2 lines · Arne Schwabe

+.B \-\-ignore-unknown-option opt1 opt2 opt3 ... optN +When one of options

Feature-ACK, but the code confuses me a bit...

src/openvpn/options.c add_option (struct options *options, · line 4422

Quoted 13 lines

src/openvpn/options.c +13 -0

+  else if (streq (p[0], "ignore-unknown-option") && p[1]) 
+    {
+      int i;
+      int j;
+      int numignored=0;
+      const char **ignore;
+
+      VERIFY_PERMISSION (OPT_P_GENERAL);
+      /* Find out how many options to be ignored */
+      for (i=1;p[i];i++)
+        numignored++;
+
+      numignored=i;

This... (I think the "numignored=i" bit should just go - while it does not harm, it doesn't help, and confuses people :-))

src/openvpn/options.c add_option (struct options *options, · line 6940

Quoted 4 lines

src/openvpn/options.c +4 -0

+        {
+          const char* opt = options->ignore_unknown_option[i];
+
+          if (streq(p[0], opt))

... and I'm not *so* happy about that either - if you only need "opt" once, why add an extra variable for that? Code is technically OK, though.

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

Arne Schwabe

author

2013-08-16 08:11 UTC #2 lore raw

PATCH v2 1/2 Add support to ignore specific options.

In reply to Arne Schwabe

---
 doc/openvpn.8         |   22 ++++++++++++++++++++
 src/openvpn/options.c |   55 +++++++++++++++++++++++++++++++++++++++++++++++--
 src/openvpn/options.h |    2 ++
 3 files changed, 77 insertions(+), 2 deletions(-)

doc/openvpn.8 +22 -0

index 741f554..1680ebc 100644
@@ -1896,6 +1896,9 @@ It is also possible to tag a single directive so as not to trigger
 a fatal error if the directive isn't recognized.  To do this,
 prepend the following before the directive:
 .B setenv opt
+
+See also 
+.B \-\-ignore-unknown-option
 .\"*********************************************************
 .TP
 .B \-\-setenv-safe name value

@@ -1909,6 +1912,25 @@ is a safety precaution to prevent a LD_PRELOAD style attack
 from a malicious or compromised server.
 .\"*********************************************************
 .TP
+.B \-\-ignore-unknown-option opt1 opt2 opt3 ... optN
+When one of options 
+.B opt1 ... optN
+is encountered in the configuration file the configuration 
+file parsing does not fail if this OpenVPN version does not 
+support the option. Multiple 
+.B \-\-ignore-unknown-option
+options can be given to support a larger number of options to ignore. 
+
+This option should be used with caution, as there are good security
+reasons for having OpenVPN fail if it detects problems in a
+config file. Having said that, there are valid reasons for wanting
+new software features to gracefully degrade when encountered by
+older software versions.
+
+.B \-\-ignore-unknown-option
+is available since OpenVPN 2.3.3.
+.\"*********************************************************
+.TP
 .B \-\-script-security level
 This directive offers policy-level control over OpenVPN's usage of external programs
 and scripts.  Lower

src/openvpn/options.c +53 -2

75 lines not on this page · raw message

src/openvpn/options.h +2 -0

index 6a132a6..8e0e367 100644
@@ -186,6 +186,8 @@ struct options
 
   /* enable forward compatibility for post-2.1 features */
   bool forward_compatible;
+  /* list of options that should be ignored even if unkown */
+  const char **  ignore_unknown_option;
 
   /* persist parms */
   bool persist_config;

Signature · 1 line

1.7.9.5

Gert Doering

2013-08-16 16:17 UTC #3 lore raw

ACK (v1 had a feature-ack already and this adds missing code bits)

Your patch has been applied to the master and release/2.3 branches (... with some trailing whitespace fixed).

commit b685a1e6b012682ce7d6fb31960273b8f5213714 (master) commit e56b52ff62856dc1deac8f3db03450d144a6e6bf (release/2.3)

Author: Arne Schwabe
Date:   Fri Aug 16 10:11:04 2013 +0200

     Add support to ignore specific options.

     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/7799
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

Arne Schwabe

author

2013-08-16 08:11 UTC #4 lore raw

PATCH v2 2/2 Add a note what setenv opt does for OpenVPN < 2.3.3

In reply to Arne Schwabe

---
 doc/openvpn.8 |    4 ++++
 1 file changed, 4 insertions(+)

doc/openvpn.8 +4 -0

index 1680ebc..9c3f400 100644
@@ -1897,6 +1897,10 @@ a fatal error if the directive isn't recognized.  To do this,
 prepend the following before the directive:
 .B setenv opt
 
+Versions prior to OpenVPN 2.3.3 will always ignore options set with the
+.B setenv opt
+directive.
+
 See also 
 .B \-\-ignore-unknown-option
 .\"*********************************************************

Signature · 1 line

1.7.9.5

Gert Doering

2013-08-16 16:17 UTC #5 lore raw

[Openvpn-devel] [PATCH applied] Re: Add a note what setenv opt does for OpenVPN < 2.3.3

ACK.

Your patch has been applied to the master and release/2.3 branches.

commit 39dad37d5b13c4dc0614ab7b19fdae88c23de0a2 (master) commit 5fbc2bf7ef9f0ffd4648f706e6053eeae9d3ced6 (release/2.3)

Author: Arne Schwabe
Date:   Fri Aug 16 10:11:20 2013 +0200

     Add a note what setenv opt does for OpenVPN < 2.3.3

     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/7798
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering