add option --management-query-proxy
PATCH 1/1 add option --management-query-proxy
Make openvpn query for proxy information through the management interface. This allows GUIs to provide (automatically detected) proxy information on a per connection basis.
This new option supersedes the undocumented --http-proxy-fallback option and puts the responsibilty for HTTP proxy fallback handling to the GUI caring for such.
Signed-off-by Heiko Hund <[email protected]...>
--- doc/management-notes.txt | 31 ++++++++ doc/openvpn.8 | 6 ++ src/openvpn/init.c | 185 +++++++++++++++++++++------------------------- src/openvpn/manage.c | 52 +++---------- src/openvpn/manage.h | 17 ++--- src/openvpn/options.c | 112 ++++------------------------ src/openvpn/options.h | 28 +------ src/openvpn/proxy.c | 15 ++++ src/openvpn/proxy.h | 3 + src/openvpn/syshead.h | 6 +- 10 files changed, 178 insertions(+), 277 deletions(-)
doc/management-notes.txt +31 -0
@@ -719,6 +719,37 @@ use this command: remote SKIP +COMMAND -- proxy (OpenVPN 2.3 or higher) +-------------------------------------------- + +Provide proxy server host/port and flags in response to a >PROXY +notification (client only). Requires that the --management-query-proxy +directive is used. + + proxy TYPE HOST PORT ["nct"] + +The "proxy" command must only be given in response to a >PROXY +notification. Use the "nct" flag if you only want to allow +non-cleartext auth with the proxy server. The following >PROXY +notification indicates that the client config file would ordinarily +connect to the first --remote configured, vpn.example.com using TCP: + + >PROXY:1,TCP,vpn.example.com + +Now, suppose we want to connect to the remote host using the proxy server +proxy.intranet port 8080 with secure authentication only, if required. +After receiving the above notification, use this command: + + proxy HTTP proxy.intranet 8080 nct + +You can also use the SOCKS keyword to pass a SOCKS server address, like: + + proxy SOCKS fe00::1 1080 + +To accept connecting to the host and port directly, use this command: + + proxy NONE + OUTPUT FORMAT -------------
doc/openvpn.8 +6 -0
@@ -2446,6 +2446,12 @@ for inputs which ordinarily would have been queried from the console. .\"********************************************************* .TP +.B \-\-management-query-proxy +Query management channel for proxy server information for a specific +.B \-\-remote +(client-only). +.\"********************************************************* +.TP .B \-\-management-query-remote Allow management interface to override .B \-\-remote
src/openvpn/init.c +85 -100
233 lines not on this page · raw message
src/openvpn/manage.c +10 -42
93 lines not on this page · raw message
src/openvpn/manage.h +8 -9
@@ -171,9 +171,7 @@ struct management_callbackconst unsigned long cid, struct buffer_list *pf_config); /* ownership transferred */#endif -#if HTTP_PROXY_FALLBACK -bool (*http_proxy_fallback_cmd) (void *arg,const char *server,const char *port,const char *flags); -#endif +bool (*proxy_cmd) (void *arg,const char **p);bool (*remote_cmd) (void *arg,const char **p); };
@@ -335,6 +333,7 @@ struct management *management_init (void);#endif #define MF_UP_DOWN (1<<10)#define MF_QUERY_REMOTE (1<<11) +#define MF_QUERY_PROXY (1<<12) bool management_open (struct management *man, const char *addr,
@@ -429,6 +428,12 @@ management_query_remote_enabled (const struct management *man)return BOOL_CAST (man->settings.flags &MF_QUERY_REMOTE ); } +static inline bool +management_query_proxy_enabled (const struct management *man) +{ +return BOOL_CAST (man->settings.flags &MF_QUERY_PROXY ); +} +#ifdef MANAGEMENT_PF static inline bool management_enable_pf (const struct management *man)
@@ -554,11 +559,5 @@ management_bytes_server (struct management *man,#endif /* MANAGEMENT_DEF_AUTH */ -#if HTTP_PROXY_FALLBACK - -void management_http_proxy_fallback_notify (struct management *man,const char *type,const char *remote_ip_hint); - -#endif /* HTTP_PROXY_FALLBACK */ -#endif #endif
src/openvpn/options.c +15 -97
180 lines not on this page · raw message
src/openvpn/options.h +2 -26
@@ -129,10 +129,7 @@ struct connection_entry#endif # define CE_DISABLED (1<<0) -#if HTTP_PROXY_FALLBACK -# define CE_HTTP_PROXY_FALLBACK (1<<1) -time_t ce_http_proxy_fallback_timestamp;/* time when fallback http_proxy_options was last updated */ -#endif +# define CE_MAN_QUERY_PROXY (1<<1)# define CE_MAN_QUERY_REMOTE_UNDEF 0# define CE_MAN_QUERY_REMOTE_QUERY 1# define CE_MAN_QUERY_REMOTE_ACCEPT 2
@@ -167,14 +164,6 @@ struct remote_liststruct remote_entry *array[CONNECTION_LIST_SIZE ]; }; -#if HTTP_PROXY_FALLBACK -struct hpo_store -{ -struct http_proxy_options hpo; -char server[80 ]; -}; -#endif -struct remote_host_store {# define RH_HOST_LEN 80
@@ -220,10 +209,8 @@ struct optionsstruct remote_list *remote_list;bool force_connection_list; -#if HTTP_PROXY_FALLBACK -bool http_proxy_fallback; +#if HTTP_PROXY_OVERRIDE struct http_proxy_options *http_proxy_override; -struct hpo_store *hpo_store;/* used to store dynamic proxy info given by management interface */ #endif struct remote_host_store *rh_store;
@@ -798,15 +785,4 @@ connection_list_set_no_advance (struct options *o) o->connection_list->no_advance = true; } -#if HTTP_PROXY_FALLBACK - -struct http_proxy_options * -parse_http_proxy_fallback (struct context *c, -const char *server, -const char *port, -const char *flags, -const int msglevel); - -#endif /* HTTP_PROXY_FALLBACK */ -#endif
src/openvpn/proxy.c +15 -0
@@ -46,6 +46,21 @@#define UP_TYPE_PROXY "HTTP Proxy" +struct http_proxy_options * +init_http_proxy_options_once (struct http_proxy_options *hpo, +struct gc_arena *gc) +{ +if (!hpo) + { + ALLOC_OBJ_CLEAR_GC (hpo, struct http_proxy_options, gc); +/* http proxy defaults */ + hpo->timeout =5 ; + hpo->http_version ="1.0" ; + } +return hpo; +} + +/* cached proxy username/password */ static struct user_pass static_proxy_user_pass;
src/openvpn/proxy.h +3 -0
@@ -70,6 +70,9 @@ struct http_proxy_info {bool queried_creds; }; +struct http_proxy_options *init_http_proxy_options_once (struct http_proxy_options *hpo, +struct gc_arena *gc); +struct http_proxy_info *http_proxy_new (const struct http_proxy_options *o);void http_proxy_close (struct http_proxy_info *hp);
src/openvpn/syshead.h +3 -3
@@ -650,12 +650,12 @@ socket_defined (const socket_descriptor_t sd)#endif /* -* Should we include http proxy fallback functionality +* Should we include http proxy override functionality */ #if defined(ENABLE_MANAGEMENT ) && defined(ENABLE_HTTP_PROXY ) -#define HTTP_PROXY_FALLBACK 1 +#define HTTP_PROXY_OVERRIDE 1#else -#define HTTP_PROXY_FALLBACK 0 +#define HTTP_PROXY_OVERRIDE 0#endif /*
Signature · 1 line
1.7.9.5
Quoted 9 lines · Heiko Hund
Make openvpn query for proxy information through the management interface. This allows GUIs to provide (automatically detected) proxy information on a per connection basis.
This new option supersedes the undocumented --http-proxy-fallback option and puts the responsibilty for HTTP proxy fallback handling to the GUI caring for such.
Signed-off-by Heiko Hund <[email protected]...>
Quoted 13 lines
--- doc/management-notes.txt | 31 ++++++++ doc/openvpn.8 | 6 ++ src/openvpn/init.c | 185 +++++++++++++++++++++------------------------- src/openvpn/manage.c | 52 +++---------- src/openvpn/manage.h | 17 ++--- src/openvpn/options.c | 112 ++++------------------------ src/openvpn/options.h | 28 +------ src/openvpn/proxy.c | 15 ++++ src/openvpn/proxy.h | 3 + src/openvpn/syshead.h | 6 +- 10 files changed, 178 insertions(+), 277 deletions(-)
This patch got reviewed by James Yonan, but he never responded publicly to this list. But it's applied to the master branch, as James said this made sense if it makes writing the GUI easier.
commit af1bf85aee836f2b729c38990028c035b6c69152
Author: Heiko Hund <[email protected]...> Date: Wed Jul 11 14:16:50 2012 +0200
add option --management-query-proxy
Signed-off-by: Heiko Hund <[email protected]...>
Reviewed-by: James Yonan <[email protected]...>
Message-Id: [email protected]...
URL: http://article.gmane.org/gmane.network.openvpn.devel/6841
Signed-off-by: David Sommerseth <[email protected]...>kind regards,
David Sommerseth
Am 19.07.12 21:57, schrieb David Sommerseth:
Quoted 23 lines · Heiko Hund
Quoted 9 lines
Make openvpn query for proxy information through the management interface. This allows GUIs to provide (automatically detected) proxy information on a per connection basis.
This new option supersedes the undocumented --http-proxy-fallback option and puts the responsibilty for HTTP proxy fallback handling to the GUI caring for such.
Signed-off-by Heiko Hund <[email protected]...>Quoted 13 lines
--- doc/management-notes.txt | 31 ++++++++ doc/openvpn.8 | 6 ++ src/openvpn/init.c | 185 +++++++++++++++++++++------------------------- src/openvpn/manage.c | 52 +++---------- src/openvpn/manage.h | 17 ++--- src/openvpn/options.c | 112 ++++------------------------ src/openvpn/options.h | 28 +------ src/openvpn/proxy.c | 15 ++++ src/openvpn/proxy.h | 3 + src/openvpn/syshead.h | 6 +- 10 files changed, 178 insertions(+), 277 deletions(-)
Quoted 4 lines
This patch got reviewed by James Yonan, but he never responded publicly to this list. But it's applied to the master branch, as James said this made sense if it makes writing the GUI easier.
This patch somehow proxy connecting with a simple http-proxy xx yy option. Openvpn just ignores the proxy and connects directly. On a quick glance I could not determine what went wrong.
Arne