Add option --push-suppress-ipv6 to stop sending IPv6 info to clients.

PATCH In review Gert Doering 4 participants 13 messages Oct 19, 2015 – May 16, 2016 1 message not in the archive

Share & tools

Gert Doering

author

2015-10-19 18:06 UTC #0 lore raw

PATCH 1/1 Add option --push-suppress-ipv6 to stop sending IPv6 info to clients.

Workaround option for servers that have IPv6 working just fine, but need to turn it off for individual clients - in that case, set this option in the --client-config-dir file for a particular user, or via --client-connect script/plugin hook for a particular platform (like IOS 9.0.2)

Trac #614

Signed-off-by Gert Doering <[email protected]...>

---
 doc/openvpn.8         |  8 ++++++++
 src/openvpn/options.c |  6 ++++++
 src/openvpn/options.h |  1 +
 src/openvpn/push.c    | 33 +++++++++++++++++++++++++--------
 4 files changed, 40 insertions(+), 8 deletions(-)

doc/openvpn.8 +8 -0

index 3a86409..4cfc796 100644
@@ -5704,6 +5704,14 @@ for more details how to setup and use this, and how
 and
 .B \-\-route
 interact.
+.TP
+.B \-\-push\-suppress\-ipv6
+remove all IPv6 related options from the list of options that the
+server will send to a client.  Only needed if the server has IPv6 in
+general, but one particular client (or client OS) is known to have 
+problems with IPv6 - so this can be sent from a \-\-client\-config\-dir
+file (for a particular user), or a \-\-client\-connect script (evaluating
+peer-info variables, like IV_PLAT=)
 
 .\"*********************************************************
 .SH SCRIPTING AND ENVIRONMENTAL VARIABLES

src/openvpn/options.c +6 -0

index 5654830..ee2615a 100644
@@ -409,6 +409,7 @@ static const char usage_message[] =
   "                  execution.  Peer must specify --pull in its config file.\n"
   "--push-reset    : Don't inherit global push list for specific\n"
   "                  client instance.\n"
+  "--push-suppress-ipv6 : do not send IPv6 config to client instance.\n"
   "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
   "                  to be dynamically allocated to connecting clients.\n"
   "--ifconfig-pool-linear : Use individual addresses rather than /30 subnets\n"

@@ -5881,6 +5882,11 @@ add_option (struct options *options,
       options->push_ifconfig_ipv6_netbits = netbits;
       options->push_ifconfig_ipv6_remote = remote;
     }
+  else if (streq (p[0], "push-suppress-ipv6") && !p[1])
+    {
+      VERIFY_PERMISSION (OPT_P_INSTANCE);
+      options->push_suppress_ipv6 = true;
+    }
   else if (streq (p[0], "disable") && !p[1])
     {
       VERIFY_PERMISSION (OPT_P_INSTANCE);

src/openvpn/options.h +1 -0

index c642aa0..dee5994 100644
@@ -434,6 +434,7 @@ struct options
   struct in6_addr push_ifconfig_ipv6_local;		/* IPv6 */
   int 		  push_ifconfig_ipv6_netbits;		/* IPv6 */
   struct in6_addr push_ifconfig_ipv6_remote;		/* IPv6 */
+  bool push_suppress_ipv6;				/* no-IPv6 */
   bool enable_c2c;
   bool duplicate_cn;
   int cf_max;

src/openvpn/push.c +25 -8

index a4cb726..cdfafe4 100644
@@ -251,15 +251,22 @@ send_push_reply (struct context *c)
 
   if ( c->c2.push_ifconfig_ipv6_defined )
     {
-      /* IPv6 is put into buffer first, could be lengthy */
-      buf_printf( &buf, ",ifconfig-ipv6 %s/%d %s",
-		    print_in6_addr( c->c2.push_ifconfig_ipv6_local, 0, &gc),
-		    c->c2.push_ifconfig_ipv6_netbits,
-		    print_in6_addr( c->c2.push_ifconfig_ipv6_remote, 0, &gc) );
-      if (BLEN (&buf) >= safe_cap)
+      if ( c->options.push_suppress_ipv6 )
 	{
-	  msg (M_WARN, "--push ifconfig-ipv6 option is too long");
-	  goto fail;
+	  msg( M_INFO, "send_push_reply(): suppress sending ifconfig-ipv6" );
+	}
+      else
+	{
+	  /* IPv6 is put into buffer first, could be lengthy */
+	  buf_printf( &buf, ",ifconfig-ipv6 %s/%d %s",
+			print_in6_addr( c->c2.push_ifconfig_ipv6_local, 0, &gc),
+			c->c2.push_ifconfig_ipv6_netbits,
+			print_in6_addr( c->c2.push_ifconfig_ipv6_remote, 0, &gc) );
+	  if (BLEN (&buf) >= safe_cap)
+	    {
+	      msg (M_WARN, "--push ifconfig-ipv6 option is too long");
+	      goto fail;
+	    }
 	}
     }

@@ -268,6 +275,15 @@ send_push_reply (struct context *c)
       if (e->enable)
 	{
 	  const int l = strlen (e->option);
+
+	  if ( c->options.push_suppress_ipv6 &&
+		( strncmp( e->option, "tun-ipv6", 8 ) == 0 ||
+		  strncmp( e->option, "route-ipv6", 10 ) == 0 ) )
+	    {
+	      msg( M_INFO, "send_push_reply(): suppress sending '%s'", e->option );
+	      goto next;
+	    }
+
 	  if (BLEN (&buf) + l >= safe_cap)
 	    {
 	      buf_printf (&buf, ",push-continuation 2");

@@ -288,6 +304,7 @@ send_push_reply (struct context *c)
 	    }
 	  buf_printf (&buf, ",%s", e->option);
 	}
+next:
       e = e->next;
     }

Signature · 1 line

2.4.6

Arne Schwabe

2015-10-20 08:47 UTC #1 lore raw

Am 19.10.15 um 20:06 schrieb Gert Doering:

Quoted 6 lines

Workaround option for servers that have IPv6 working just fine, but need to turn it off for individual clients - in that case, set this option in the --client-config-dir file for a particular user, or via --client-connect script/plugin hook for a particular platform (like IOS 9.0.2)

ACK from me. Patch looks good and is small enough not to cause headaches. Ideally, this would be solved on the client (not accepting these variables). The client still complain about other options like redirect-gateway ipv6 but since this is a workaround anyway, it should be fine.

Arne

A message that is not in the archive (sent off-list or not yet received): [email protected]...

Gert Doering

author

2015-10-20 21:28 UTC #3 lore raw

Hi,

Quoted 8 lines · Arne Schwabe

Am 19.10.15 um 20:06 schrieb Gert Doering:
Quoted 6 lines
Workaround option for servers that have IPv6 working just fine, but need to turn it off for individual clients - in that case, set this option in the --client-config-dir file for a particular user, or via --client-connect script/plugin hook for a particular platform (like IOS 9.0.2)
ACK from me.

Heh :-) - this was more thought of an "here, what do you think?" patch (plus "fix valdikss' headache in #614 quickly"), and I didn't expect an ACK so quickly...

... and then a discussion on IRC later.

But Arne actually had a very good idea which I'm going to implement and send "soon":

--push-filter <keyword list>

like,

--push-filter ifconfig-ipv6 tun-ipv6 route-ipv6

which would do exactly what the current patch did, but is much more flexible depending on what exactly needs to be worked around with *this* client...

(There's a trac ticket about "--push-reset", which we might resolve with this as well :-) )

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

David Sommerseth

2015-10-20 22:50 UTC #4 lore raw

Quoted 25 lines · Gert Doering

Hi,
Quoted 8 lines · Arne Schwabe
Am 19.10.15 um 20:06 schrieb Gert Doering:
Quoted 6 lines
Workaround option for servers that have IPv6 working just fine, but need to turn it off for individual clients - in that case, set this option in the --client-config-dir file for a particular user, or via --client-connect script/plugin hook for a particular platform (like IOS 9.0.2)
ACK from me.
Heh :-) - this was more thought of an "here, what do you think?" patch (plus "fix valdikss' headache in #614 quickly"), and I didn't expect an ACK so quickly...
... and then a discussion on IRC later.
But Arne actually had a very good idea which I'm going to implement and send "soon":
--push-filter <keyword list>
like,

Quoted 7 lines

--push-filter ifconfig-ipv6 tun-ipv6 route-ipv6
which would do exactly what the current patch did, but is much more flexible depending on what exactly needs to be worked around with *this* client...
(There's a trac ticket about "--push-reset", which we might resolve with this as well :-) )

I agree with the intention. Just not sure 'filter' is a clever word. As it can be understood both as "remove these options" or "only include these options". Both interpretations are results of a filter.

Signature · 3 lines

kind regards,

David Sommerseth

Arne Schwabe

2015-10-21 08:06 UTC #5 lore raw

Am 21.10.15 um 00:50 schrieb David Sommerseth:

Quoted 10 lines

Quoted 7 lines
Quoted 7 lines
--push-filter ifconfig-ipv6 tun-ipv6 route-ipv6
which would do exactly what the current patch did, but is much more flexible depending on what exactly needs to be worked around with *this* client...
(There's a trac ticket about "--push-reset", which we might resolve with this as well :-) )
I agree with the intention. Just not sure 'filter' is a clever word. As it can be understood both as "remove these options" or "only include these options". Both interpretations are results of a filter.

push-suppress?

Arne

David Sommerseth

2015-10-23 08:12 UTC #6 lore raw

Quoted 8 lines · Arne Schwabe

Am 21.10.15 um 00:50 schrieb David Sommerseth:
Quoted 5 lines
Quoted 5 lines
Quoted 5 lines
--push-filter ifconfig-ipv6 tun-ipv6 route-ipv6
which would do exactly what the current patch did, but is much more flexible depending on what exactly needs to be worked around with *this* client...

Quoted 7 lines

Quoted 5 lines
Quoted 2 lines
Quoted 2 lines
(There's a trac ticket about "--push-reset", which we might resolve with this as well :-) )
I agree with the intention. Just not sure 'filter' is a clever word. As it can be understood both as "remove these options" or "only include these options". Both interpretations are results of a filter.
push-suppress?

That's better. Another suggestion could be --push-remove. But I have no strong opinion either way.

Signature · 3 lines

kind regards,

David Sommerseth

Gert Doering

author

2015-12-26 22:19 UTC #7 lore raw

Hi,

Quoted 5 lines · David Sommerseth

Quoted 5 lines
Am 21.10.15 um 00:50 schrieb David Sommerseth:
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
--push-filter ifconfig-ipv6 tun-ipv6 route-ipv6
which would do exactly what the current patch did, but is much more flexible depending on what exactly needs to be worked around with *this* client...

[..]

Quoted 2 lines

That's better. Another suggestion could be --push-remove. But I have no strong opinion either way.

So, you asked for it, you or Arne get to review this :-) - it's currently missing a man page entry, but the commit message explains how it works - just put

push-remove tun-ipv6
push-remove route-ipv6

into your ccd/ file, and all options strings starting with one of these strings are removed. Caveat: "push-remove route" will remove IPv4 and IPv6 routes, so to remove only IPv4 routes, use

push-remove 'route '

(our config parser is just magic :) )

Missing in this patch is "openvpn.8" and you can't remove "ifconfig-ipv6" (or "ifconfig", for that matter) from the push list as these are not normal options but special cased - but that is actually not very hard to add if you agree with the general direction.

gert

PS: merry christmas everyone :-)

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

From 06a634bb966c6adbc8f5bd66a0cf796e25727c6d Mon Sep 17 00:00:00 2001
From: Gert Doering <[email protected]...>
Date: Sat, 26 Dec 2015 23:08:14 +0100
Subject: [PATCH] Implement push-remove option to selectively remove pushed
options.

With this option, the server can remove individual options from the set pushed to a client (call from --client-config-dir file, or from --client-connect script or plugin). Options are removed at parse time, so it is possible to do stuff like:

push-remove route-ipv6
push "route-ipv6 fd00::/8"

to first remove all IPv6 route options set so far, then add something specific (what "push-reset" does to all the options).

Arguments to push-remove are strncmp()'ed to option string, so partial matches like

push-remove route-ipv6 2001:

are possible ("remove all IPv6 routes starting with 2001:").

Implementation of remove_iroutes_from_push_route_list() had to be changed slightly to stop it from re-enabling all disabled options again.

Signed-off-by Gert Doering <[email protected]...>

---
 src/openvpn/options.c |  9 +++++++++
 src/openvpn/push.c    | 38 ++++++++++++++++++++++++++++++++------
 src/openvpn/push.h    |  1 +
 3 files changed, 42 insertions(+), 6 deletions(-)

src/openvpn/options.c +9 -0

index 46aa824..952e171 100644
@@ -5578,6 +5578,15 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_INSTANCE);
       push_reset (options);
     }
+  else if (streq (p[0], "push-remove"))
+    {
+      int j;
+      VERIFY_PERMISSION (OPT_P_INSTANCE);
+      for (j = 1; j < MAX_PARMS && p[j]; ++j)
+        {
+	  push_remove_option (options,p[j]);
+	}
+    }
   else if (streq (p[0], "ifconfig-pool") && p[1] && p[2] && !p[4])
     {
       const int lev = M_WARN;

src/openvpn/push.c +32 -6

index d4f3cb6..59fb4cf 100644
@@ -414,6 +414,31 @@ push_reset (struct options *o)
 {
   CLEAR (o->push_list);
 }
+
+void
+push_remove_option (struct options *o, const char *p)
+{
+  msg( D_PUSH, "PUSH_REMOVE '%s'", p );
+
+  if (o && o->push_list.head )
+    {
+      struct gc_arena gc = gc_new ();
+      struct push_entry *e = o->push_list.head;
+
+      /* cycle through the push list */
+      while (e)
+	{
+	  if ( e->enable &&
+               strncmp( e->option, p, strlen(p) ) == 0 )
+	    {
+	      msg (D_PUSH, "PUSH_REMOVE removing: '%s'", e->option);
+	      e->enable = false;
+	    }
+
+	  e = e->next;
+	}
+    }
+}
 #endif
 
 #if P2MP_SERVER

@@ -543,7 +568,8 @@ remove_iroutes_from_push_route_list (struct options *o)
 
 	  /* parse the push item */
 	  CLEAR (p);
-	  if (parse_line (e->option, p, SIZE (p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc))
+	  if ( e->enable &&
+               parse_line (e->option, p, SIZE (p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc))
 	    {
 	      /* is the push item a route directive? */
 	      if (p[0] && !strcmp (p[0], "route") && !p[3])

@@ -569,12 +595,12 @@ remove_iroutes_from_push_route_list (struct options *o)
 			}
 		    }
 		}
-	    }
 
-	  /* should we copy the push item? */
-	  e->enable = enable;
-	  if (!enable)
-	    msg (D_PUSH, "REMOVE PUSH ROUTE: '%s'", e->option);
+	      /* should we copy the push item? */
+	      e->enable = enable;
+	      if (!enable)
+		msg (D_PUSH, "REMOVE PUSH ROUTE: '%s'", e->option);
+	    }
 
 	  e = e->next;
 	}

src/openvpn/push.h +1 -0

index fa06e08..e756582 100644
@@ -61,6 +61,7 @@ void push_option (struct options *o, const char *opt, int msglevel);
 void push_options (struct options *o, char **p, int msglevel, struct gc_arena *gc);
 
 void push_reset (struct options *o);
+void push_remove_option (struct options *o, const char *p);
 
 bool send_push_reply (struct context *c);

Signature · 1 line

2.4.10

Arne Schwabe

2015-12-26 22:27 UTC #8 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 4 lines

So, you asked for it, you or Arne get to review this :-) - it's currently missing a man page entry, but the commit message explains how it works - just put

and a changlog entry :)

Quoted 10 lines

push-remove tun-ipv6
push-remove route-ipv6
into your ccd/ file, and all options strings starting with one of these strings are removed. Caveat: "push-remove route" will remove IPv4 and IPv6 routes, so to remove only IPv4 routes, use
push-remove 'route '

A sounds like more of a hack that anything.

Quoted 6 lines

(our config parser is just magic :) )
Missing in this patch is "openvpn.8" and you can't remove "ifconfig-ipv6" (or "ifconfig", for that matter) from the push list as these are not

normal

Quoted 7 lines

options but special cased - but that is actually not very hard to add if you agree with the general direction.
gert
PS: merry christmas everyone :-)

+void
+push_remove_option (struct options *o, const char *p) +{
+ msg( D_PUSH, "PUSH_REMOVE '%s'", p );
+
+ if (o && o->push_list.head )
+ {
+ struct gc_arena gc = gc_new ();

That gc is never gc'ed and is alos not used :)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iEYEARECAAYFAlZ/FGgACgkQe8+cMNS4zRcOpgCfQdoyXJeE5w+aEfArX+3O002q pGUAniqnoMlwXqsQLbGcO1UWT/bESiY8
=8ulD
-----END PGP SIGNATURE-----

Gert Doering

author

2015-12-27 20:58 UTC #9 lore raw

Hi,

Quoted 4 lines · Arne Schwabe

Quoted 3 lines
So, you asked for it, you or Arne get to review this :-) - it's currently missing a man page entry, but the commit message explains how it works - just put
and a changlog entry :)

Done!

Quoted 10 lines

Quoted 8 lines
push-remove tun-ipv6
push-remove route-ipv6
into your ccd/ file, and all options strings starting with one of these strings are removed. Caveat: "push-remove route" will remove IPv4 and IPv6 routes, so to remove only IPv4 routes, use
push-remove 'route '
A sounds like more of a hack that anything.

A hack it is, but one that gives me the maximum flexibility with fairly little code. Being able to do

push-remove 'route-ipv6 2001:'

*and*

push-remove route

(and the latter only matching "push route" and not "push route-ipv6") is more complicated...

[..]

Quoted 10 lines

(quoted diff) +8 -0

+void
+push_remove_option (struct options *o, const char *p)
+{
+  msg( D_PUSH, "PUSH_REMOVE '%s'", p );
+
+  if (o && o->push_list.head )
+    {
+      struct gc_arena gc = gc_new ();

That gc is never gc'ed and is alos not used :)

Well spotted. That's what you get for starting with a copy of another function... :)

v2 attached.

Being able to remove "ifconfig-ipv6" from the to-be-pushed option list was much less fun (due to the way pool and "ifconfig-ipv6-push" interact)
- but it is one of the important parts here. Like, when we release a 2.3.9 version which blows up when using IPv6 on XP...

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

From 59d7df554aa120588bca4f89869c6cbcf42cb4f5 Mon Sep 17 00:00:00 2001
From: Gert Doering <[email protected]...>
Date: Sat, 26 Dec 2015 23:08:14 +0100
Subject: [PATCH v2] Implement push-remove option to selectively remove pushed
options.

push-remove route-ipv6
push "route-ipv6 fd00::/8"

to first remove all IPv6 route options set so far, then add something specific (what "push-reset" does to all the options).

Arguments to push-remove are strncmp()'ed to option string, so partial matches like

push-remove route-ipv6 2001:

are possible ("remove all IPv6 routes starting with 2001:").

Implementation of remove_iroutes_from_push_route_list() had to be changed slightly to stop it from re-enabling all disabled options again.

v2: documentation (Changes.rst, doc/openvpn.8)
remove surplus gc_arena
implement filtering of "ifconfig-ipv6"

Trac #29, #614

Signed-off-by Gert Doering <[email protected]...>

---
 Changes.rst           |  4 ++++
 doc/openvpn.8         | 35 ++++++++++++++++++++++++++++++++++-
 src/openvpn/options.c | 10 ++++++++++
 src/openvpn/options.h |  1 +
 src/openvpn/push.c    | 47 ++++++++++++++++++++++++++++++++++++++++-------
 src/openvpn/push.h    |  1 +
 6 files changed, 90 insertions(+), 8 deletions(-)

Changes.rst +4 -0

index c2142fa..b3acf71 100644
@@ -5,6 +5,10 @@ Version 2.4.0
 New features
 ------------
 
+push-remove
+    new option to remove options on a per-client basis from the "push" list
+    (more fine-grained than "push-reset")
+
 keying-material-exporter
     Keying Material Exporter [RFC-5705] allow additional keying material to be
     derived from existing TLS channel.

doc/openvpn.8 +34 -1

index 368bd4c..ed0a1a4 100644
@@ -2964,6 +2964,39 @@ as with a
 configuration file.  This option will ignore
 .B \-\-push
 options at the global config file level.
+.\"*********************************************************
+.TP
+.B \-\-push\-remove opt
+selectively remove all
+.B \-\-push
+options matching "opt" from the option list for a client.  "opt" is matched
+as a substring against the whole option string to-be-pushed to the client, so
+.B \-\-push\-remove route
+would remove all
+.B \-\-push route ...
+and
+.B \-\-push route-ipv6 ...
+statements, while
+.B \-\-push\-remove 'route-ipv6 2001:'
+would only remove IPv6 routes for 2001:... networks.
+
+.B \-\-push\-remove
+can only be used in a client-specific context, like in a
+.B \-\-client\-config\-dir
+file, or
+.B \-\-client\-connect
+script or plugin -- similar to
+.B \-\-push\-reset,
+just more selective.
+
+NOTE: to
+.I change
+an option,
+.B \-\-push\-remove
+can be used to first remove the old value, and then add a new
+.B \-\-push
+option with the new value.
+.\"*********************************************************
 .TP
 .B \-\-push\-peer\-info
 Push additional information about the client to server.  The additional information

@@ -3288,7 +3321,7 @@ without needing to restart the server.
 
 The following
 options are legal in a client-specific context:
-.B \-\-push, \-\-push\-reset, \-\-iroute, \-\-ifconfig\-push,
+.B \-\-push, \-\-push\-reset, \-\-push\-remove, \-\-iroute, \-\-ifconfig\-push,
 and
 .B \-\-config.
 .\"*********************************************************

src/openvpn/options.c +10 -0

index 46aa824..bf1d2d7 100644
@@ -5578,6 +5578,15 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_INSTANCE);
       push_reset (options);
     }
+  else if (streq (p[0], "push-remove"))
+    {
+      int j;
+      VERIFY_PERMISSION (OPT_P_INSTANCE);
+      for (j = 1; j < MAX_PARMS && p[j]; ++j)
+        {
+	  push_remove_option (options,p[j]);
+	}
+    }
   else if (streq (p[0], "ifconfig-pool") && p[1] && p[2] && !p[4])
     {
       const int lev = M_WARN;

@@ -5926,6 +5935,7 @@ add_option (struct options *options,
       options->push_ifconfig_ipv6_local = local;
       options->push_ifconfig_ipv6_netbits = netbits;
       options->push_ifconfig_ipv6_remote = remote;
+      options->push_ifconfig_ipv6_blocked = false;
     }
   else if (streq (p[0], "disable") && !p[1])
     {

src/openvpn/options.h +1 -0

index 2f6c8b4..7551f79 100644
@@ -432,6 +432,7 @@ struct options
   struct in6_addr push_ifconfig_ipv6_local;		/* IPv6 */
   int 		  push_ifconfig_ipv6_netbits;		/* IPv6 */
   struct in6_addr push_ifconfig_ipv6_remote;		/* IPv6 */
+  bool            push_ifconfig_ipv6_blocked;		/* IPv6 */
   bool enable_c2c;
   bool duplicate_cn;
   int cf_max;

src/openvpn/push.c +40 -7

72 lines not on this page · raw message

src/openvpn/push.h +1 -0

index fa06e08..e756582 100644
@@ -61,6 +61,7 @@ void push_option (struct options *o, const char *opt, int msglevel);
 void push_options (struct options *o, char **p, int msglevel, struct gc_arena *gc);
 
 void push_reset (struct options *o);
+void push_remove_option (struct options *o, const char *p);
 
 bool send_push_reply (struct context *c);

Signature · 1 line

2.4.10

Arne Schwabe

2016-02-10 14:12 UTC #10 lore raw

Am 27.12.15 um 21:58 schrieb Gert Doering:

Quoted 1 line

push-remove route-ipv6 2001:

I think this is missing " " in the commit message, it is okay later in the manpage

Quoted 1 line

+ else if (streq (p[0], "push-remove"))

I would add at least a && p[1] and possible a !p[2]

I think multiple push-remove are better than a single one taking multiple arguments.

Otherwise are you more likely to end up with push-remove a b instead of push-remove "a b"

Arne

Gert Doering

author

2016-05-16 10:13 UTC #11 lore raw

PATCH v3 1/1 Implement push-remove option to selectively remove pushed options.

push-remove route-ipv6
push "route-ipv6 fd00::/8"

to first remove all IPv6 route options set so far, then add something specific (what "push-reset" does to all the options).

Arguments to push-remove are strncmp()'ed to option string, so partial matches like

push-remove "route-ipv6 2001:"

are possible ("remove all IPv6 routes starting with 2001:").

Implementation of remove_iroutes_from_push_route_list() had to be changed slightly to stop it from re-enabling all disabled options again.

v2: documentation (Changes.rst, doc/openvpn.8)
remove surplus gc_arena
implement filtering of "ifconfig-ipv6"

v3: correct quoting in commit message
only handle a single argument per push-remove statement - if multiple options are to be removed, just use multiple push-remove statements

Trac #29, #614

Signed-off-by Gert Doering <[email protected]...>

---
 Changes.rst           |  4 ++++
 doc/openvpn.8         | 35 ++++++++++++++++++++++++++++++++++-
 src/openvpn/options.c |  6 ++++++
 src/openvpn/options.h |  1 +
 src/openvpn/push.c    | 47 ++++++++++++++++++++++++++++++++++++++++-------
 src/openvpn/push.h    |  1 +
 6 files changed, 86 insertions(+), 8 deletions(-)

Changes.rst +4 -0

index dc9131b..a6bb2a5 100644
@@ -5,6 +5,10 @@ Version 2.4.0
 New features
 ------------
 
+push-remove
+    new option to remove options on a per-client basis from the "push" list
+    (more fine-grained than "push-reset")
+
 keying-material-exporter
     Keying Material Exporter [RFC-5705] allow additional keying material to be
     derived from existing TLS channel.

doc/openvpn.8 +34 -1

index 7d5dc5b..8d1b062 100644
@@ -2965,6 +2965,39 @@ as with a
 configuration file.  This option will ignore
 .B \-\-push
 options at the global config file level.
+.\"*********************************************************
+.TP
+.B \-\-push\-remove opt
+selectively remove all
+.B \-\-push
+options matching "opt" from the option list for a client.  "opt" is matched
+as a substring against the whole option string to-be-pushed to the client, so
+.B \-\-push\-remove route
+would remove all
+.B \-\-push route ...
+and
+.B \-\-push route-ipv6 ...
+statements, while
+.B \-\-push\-remove 'route-ipv6 2001:'
+would only remove IPv6 routes for 2001:... networks.
+
+.B \-\-push\-remove
+can only be used in a client-specific context, like in a
+.B \-\-client\-config\-dir
+file, or
+.B \-\-client\-connect
+script or plugin -- similar to
+.B \-\-push\-reset,
+just more selective.
+
+NOTE: to
+.I change
+an option,
+.B \-\-push\-remove
+can be used to first remove the old value, and then add a new
+.B \-\-push
+option with the new value.
+.\"*********************************************************
 .TP
 .B \-\-push\-peer\-info
 Push additional information about the client to server.  The additional information

@@ -3289,7 +3322,7 @@ without needing to restart the server.
 
 The following
 options are legal in a client-specific context:
-.B \-\-push, \-\-push\-reset, \-\-iroute, \-\-ifconfig\-push,
+.B \-\-push, \-\-push\-reset, \-\-push\-remove, \-\-iroute, \-\-ifconfig\-push,
 and
 .B \-\-config.
 .\"*********************************************************

src/openvpn/options.c +6 -0

index 764ca74..55630c7 100644
@@ -5582,6 +5582,11 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_INSTANCE);
       push_reset (options);
     }
+  else if (streq (p[0], "push-remove") && p[1] && !p[2])
+    {
+      VERIFY_PERMISSION (OPT_P_INSTANCE);
+      push_remove_option (options,p[1]);
+    }
   else if (streq (p[0], "ifconfig-pool") && p[1] && p[2] && !p[4])
     {
       const int lev = M_WARN;

@@ -5930,6 +5935,7 @@ add_option (struct options *options,
       options->push_ifconfig_ipv6_local = local;
       options->push_ifconfig_ipv6_netbits = netbits;
       options->push_ifconfig_ipv6_remote = remote;
+      options->push_ifconfig_ipv6_blocked = false;
     }
   else if (streq (p[0], "disable") && !p[1])
     {

src/openvpn/options.h +1 -0

index 18d8376..2fa375f 100644
@@ -432,6 +432,7 @@ struct options
   struct in6_addr push_ifconfig_ipv6_local;		/* IPv6 */
   int 		  push_ifconfig_ipv6_netbits;		/* IPv6 */
   struct in6_addr push_ifconfig_ipv6_remote;		/* IPv6 */
+  bool            push_ifconfig_ipv6_blocked;		/* IPv6 */
   bool enable_c2c;
   bool duplicate_cn;
   int cf_max;

src/openvpn/push.c +40 -7

72 lines not on this page · raw message

src/openvpn/push.h +1 -0

index 19bbf5e..d6cb4b1 100644
@@ -61,6 +61,7 @@ void push_option (struct options *o, const char *opt, int msglevel);
 void push_options (struct options *o, char **p, int msglevel, struct gc_arena *gc);
 
 void push_reset (struct options *o);
+void push_remove_option (struct options *o, const char *p);
 
 void remove_iroutes_from_push_route_list (struct options *o);

Signature · 1 line

2.7.3

Arne Schwabe

2016-05-16 12:35 UTC #12 lore raw

Re: [Openvpn-devel] [PATCH v3] Implement push-remove option to selectively remove pushed options.

Am 16.05.16 um 12:13 schrieb Gert Doering:

Quoted 21 lines

With this option, the server can remove individual options from the set pushed to a client (call from --client-config-dir file, or from --client-connect script or plugin). Options are removed at parse time, so it is possible to do stuff like:
push-remove route-ipv6
push "route-ipv6 fd00::/8"
to first remove all IPv6 route options set so far, then add something specific (what "push-reset" does to all the options).
Arguments to push-remove are strncmp()'ed to option string, so partial matches like
push-remove "route-ipv6 2001:"
are possible ("remove all IPv6 routes starting with 2001:").
Implementation of remove_iroutes_from_push_route_list() had to be changed slightly to stop it from re-enabling all disabled options again.

Quoted 7 lines

v2: documentation (Changes.rst, doc/openvpn.8)
remove surplus gc_arena
implement filtering of "ifconfig-ipv6"
v3: correct quoting in commit message
only handle a single argument per push-remove statement - if multiple options are to be removed, just use multiple push-remove statements

Ack, thanks for v3.

Arne

Gert Doering

author

2016-05-16 18:33 UTC #13 lore raw

[Openvpn-devel] [PATCH applied] Re: Implement push-remove option to selectively remove pushed options.

In reply to Gert Doering

Patch has been applied to the master branch.

commit 970312f185012341cc5bcc9492ab3e1413c7b3c7 (master)

Author: Gert Doering
Date:   Mon May 16 12:13:04 2016 +0200

     Implement push-remove option to selectively remove pushed options.

     Signed-off-by: Gert Doering <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/11665
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering