Allow ncp-disable and ncp-ciphers to be specified in ccd files
PATCH 1/1 Allow ncp-disable and ncp-ciphers to be specified in ccd files
This allows the ncp-disable and ncp-ciphers options to be used in 'client config dir' files, to disable or change the negotiable crypto parameter settings for specific clients.
--- src/openvpn/options.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
src/openvpn/options.c +2 -2
@@ -6666,12 +6666,12 @@ add_option (struct options *options, }else if (streq (p[0 ],"ncp-ciphers" ) && p[1 ] && !p[2 ]) { -VERIFY_PERMISSION (OPT_P_GENERAL ); +VERIFY_PERMISSION (OPT_P_GENERAL |OPT_P_INSTANCE ); options->ncp_ciphers = p[1 ]; }else if (streq (p[0 ],"ncp-disable" ) && !p[1 ]) { -VERIFY_PERMISSION (OPT_P_GENERAL ); +VERIFY_PERMISSION (OPT_P_GENERAL |OPT_P_INSTANCE ); options->ncp_enabled = false; }else if (streq (p[0 ],"prng" ) && p[1 ] && !p[3 ])
Signature · 1 line
2.7.4
Your patch has been applied to the master branch.
commit 834f602fd069118b5d00a9042c9fdb20930257eb
Author: Steffan Karger Date: Mon Jul 25 20:52:46 2016 +0200
Allow ncp-disable and ncp-ciphers to be specified in ccd files
Signed-off-by: Steffan Karger <[email protected]...>
Acked-by: Gert Doering <[email protected]...>
Message-Id: <[email protected]...>
URL: http://article.gmane.org/gmane.network.openvpn.devel/12096
Signed-off-by: Gert Doering <[email protected]...>--
kind regards,
Gert Doering
Hi,
Quoted 10 lines · Gert Doering
Your patch has been applied to the master branch.
commit
834f602fd069118b5d00a9042c9fdb20930257ebAuthor: Steffan Karger Date: Mon Jul 25 20:52:46 2016 +0200Allow ncp-disable and ncp-ciphers to be specified in ccd files Signed-off-by: Steffan Karger <[email protected]...> Acked-by: Gert Doering <[email protected]...>
... this, obviously, means there should have been an "ACK!" in the mail :-)
So, yes, ACK!
gert
Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]...
fax: +49-89-35655025 [email protected]...ACK from me, but just to nitpick:
we now have an option 'disable-occ' and an option 'ncp-disable' - wouldn't it make more sense to make it "disable-ncp" as well?
JJK
Quoted 28 lines · Steffan Karger
This allows the ncp-disable and ncp-ciphers options to be used in 'client config dir' files, to disable or change the negotiable crypto parameter settings for specific clients.
Signed-off-by Steffan Karger <[email protected]...>--- src/openvpn/options.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)src/openvpn/options.c +2
-2@@ -6666,12 +6666,12 @@ add_option (struct options *options, }else if (streq (p[0 ],"ncp-ciphers" ) && p[1 ] && !p[2 ]) { -VERIFY_PERMISSION (OPT_P_GENERAL ); +VERIFY_PERMISSION (OPT_P_GENERAL |OPT_P_INSTANCE ); options->ncp_ciphers = p[1 ]; }else if (streq (p[0 ],"ncp-disable" ) && !p[1 ]) { -VERIFY_PERMISSION (OPT_P_GENERAL ); +VERIFY_PERMISSION (OPT_P_GENERAL |OPT_P_INSTANCE ); options->ncp_enabled = false; }else if (streq (p[0 ],"prng" ) && p[1 ] && !p[3 ])
Hi JJK,
Quoted 4 lines · Jan Just Keijser
ACK from me, but just to nitpick:
we now have an option 'disable-occ' and an option 'ncp-disable' - wouldn't it make more sense to make it "disable-ncp" as well?
Yes, I considered this, but I like --ncp-disable more because:
* it has some symmetry with --ncp-ciphers
* I like the 'hierarchical' --<group>-<property>, like we have now for
e.g. the --tls-* options
But, if the community likes --disable-ncp better, I'm happy to comply.
-Steffan
Hi,
Quoted 18 lines · Steffan Karger
This allows the ncp-disable and ncp-ciphers options to be used in 'client config dir' files, to disable or change the negotiable crypto parameter settings for specific clients.
Signed-off-by Steffan Karger <[email protected]...>--- src/openvpn/options.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)src/openvpn/options.c +0
-1@@ -6666,12 +6666,12 @@ add_option (struct options *options, }else if (streq (p[0 ],"ncp-ciphers" ) && p[1 ] && !p[2 ]) { -VERIFY_PERMISSION (OPT_P_GENERAL );
src/openvpn/options.c add_option (struct options *options, · line 6677
Quoted 10 lines
src/openvpn/options.c +2
-1+VERIFY_PERMISSION (OPT_P_GENERAL |OPT_P_INSTANCE ); options->ncp_ciphers = p[1 ]; }else if (streq (p[0 ],"ncp-disable" ) && !p[1 ]) { -VERIFY_PERMISSION (OPT_P_GENERAL ); +VERIFY_PERMISSION (OPT_P_GENERAL |OPT_P_INSTANCE ); options->ncp_enabled = false; }else if (streq (p[0 ],"prng" ) && p[1 ] && !p[3 ])
another remark: making this option CCD-file specific a good idea, but how you do ensure that the server only applies it to this particular client? o->ncp_enabled seems a global at first glance. Consider this scenario:
1) client A connects , for which we want to disable NCP; hence a client-connect script or CCD file with 'ncp-disable' in it;
2) client B connects, no CCD file, it's running v2.4+, so we want NCP.
How does the server handle this? Or did I miss the "per-client options" struct?
JJK
Quoted 10 lines · Jan Just Keijser
another remark: making this option CCD-file specific a good idea, but how you do ensure that the server only applies it to this particular client?
o->ncp_enabledseems a global at first glance. Consider this scenario:1) client A connects , for which we want to disable NCP; hence a client-connect script or CCD file with 'ncp-disable' in it;
2) client B connects, no CCD file, it's running v2.4+, so we want NCP.How does the server handle this? Or did I miss the "per-client options" struct?
You've just answered your own question ;)
The ccd file parsing operates on mi->context.options, which is a connection-specific options struct (mi = 'multi instance'). See multi_connection_established().
-Steffan