plugin: Extend the plug-in v3 API to identify the SSL implementation used

PATCH Superseded David Sommerseth 2 participants 8 messages Jun 7, 2013 – Jul 3, 2013

lore

Share & tools

lore

David Sommerseth

author

2013-06-07 11:49 UTC #0 lore raw

PATCH 1/1 plugin: Extend the plug-in v3 API to identify the SSL implementation used

From: David Sommerseth <[email protected]...>

OpenVPN would segfault unexpectedly if it would be compiled against PolarSSL and the plug-in would expect OpenSSL, or vise-versa. This segfault would not appear before the plug-in would try to access functions which would be available if the plug-in and OpenVPN uses the same SSL implementation.

This patch adds a member to the plug-in initialisation function, which identifies the SSL implementation.

The log_v3 plug-in is updated accordingly + a simple fix to make it buildable again using the ./build script.

A minor documentation error in the openvpn-plugin.h was also corrected, where it mentioned OPENVPN_PLUGIN_VERSION instead of OPENVPN_PLUGINv3_STRUCTVER.

Signed-off-by David Sommerseth <[email protected]...>

---
 include/openvpn-plugin.h           |   24 +++++++++++++++++++++---
 sample/sample-plugins/log/build    |    2 +-
 sample/sample-plugins/log/log_v3.c |    5 +++++
 src/openvpn/plugin.c               |    3 ++-
 src/openvpn/ssl_backend.h          |    2 ++
 5 files changed, 31 insertions(+), 5 deletions(-)

include/openvpn-plugin.h +21 -3

index 0879f49..065b250 100644
@@ -201,10 +201,15 @@ struct openvpn_plugin_string_list
  *
  * Version   Comment
  *    1      Initial plugin v3 structures providing the same API as
- *           the v2 plugin interface + X509 certificate information.
+ *           the v2 plugin interface, X509 certificate information +
+ *           a logging API for plug-ins.
+ *
+ *    2      Added ssl_api member in struct openvpn_plugin_args_open_in
+ *           which identifies the SSL implementation OpenVPN is compiled
+ *           against.
  *
  */
-#define OPENVPN_PLUGINv3_STRUCTVER 1
+#define OPENVPN_PLUGINv3_STRUCTVER 2
 
 /**
  * Definitions needed for the plug-in callback functions.

@@ -260,6 +265,17 @@ struct openvpn_plugin_callbacks
 };
 
 /**
+ * Used by the openvpn_plugin_open_v3() function to indicate to the
+ * plug-in what kind of SSL implementation OpenVPN uses.  This is
+ * to avoid SEGV issues when OpenVPN is complied against PolarSSL
+ * and the plug-in against OpenSSL.
+ */
+typedef enum {
+  SSLAPI_OPENSSL,
+  SSLAPI_POLARSSL
+} ovpnSSLAPI;
+
+/**
  * Arguments used to transport variables to the plug-in.
  * The struct openvpn_plugin_args_open_in is only used
  * by the openvpn_plugin_open_v3() function.

@@ -283,6 +299,7 @@ struct openvpn_plugin_callbacks
 struct openvpn_plugin_args_open_in
 {
   const int type_mask;
+  const ovpnSSLAPI ssl_api;
   const char ** const argv;
   const char ** const envp;
   struct openvpn_plugin_callbacks *callbacks;

@@ -557,7 +574,8 @@ OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v2)
  * ARGUMENTS
  *
  * version : fixed value, defines the API version of the OpenVPN plug-in API.  The plug-in
- *	     should validate that this value is matching the OPENVPN_PLUGIN_VERSION value.
+ *	     should validate that this value is matching the OPENVPN_PLUGINv3_STRUCTVER
+ *	     value.
  *
  * arguments : Structure with all arguments available to the plug-in.
  *

sample/sample-plugins/log/build +1 -1

index bbb05f7..c07ec40 100755
@@ -6,7 +6,7 @@
 #
 
 # This directory is where we will look for openvpn-plugin.h
-CPPFLAGS="${CPPFLAGS:--I../../..}"
+CPPFLAGS="${CPPFLAGS:--I../../../include}"
 
 CC="${CC:-gcc}"
 CFLAGS="${CFLAGS:--O2 -Wall -g}"

sample/sample-plugins/log/log_v3.c +5 -0

index 742c756..4d3af91 100644
@@ -85,6 +85,11 @@ openvpn_plugin_open_v3 (const int v3structver,
     return OPENVPN_PLUGIN_FUNC_ERROR;
   }
 
+  if( args->ssl_api != SSLAPI_OPENSSL ) {
+    printf("This plug-in can only be used against OpenVPN with OpenSSL\n");
+    return OPENVPN_PLUGIN_FUNC_ERROR;
+  }
+
   /*  Which callbacks to intercept.  */
   ret->type_mask =
     OPENVPN_PLUGIN_MASK (OPENVPN_PLUGIN_UP) |

src/openvpn/plugin.c +2 -1

index c96c121..55680d1 100644
@@ -40,8 +40,8 @@
 #include "error.h"
 #include "misc.h"
 #include "plugin.h"
+#include "ssl_backend.h"
 #include "win32.h"
-
 #include "memdbg.h"
 
 #define PLUGIN_SYMBOL_REQUIRED (1<<0)

@@ -372,6 +372,7 @@ plugin_open_item (struct plugin *p,
        */
       if (p->open3) {
         struct openvpn_plugin_args_open_in args = { p->plugin_type_mask,
+                                                    SSLAPI,
                                                     (const char ** const) o->argv,
                                                     (const char ** const) envp,
                                                     &callbacks };

src/openvpn/ssl_backend.h +2 -0

index f61580c..5aba117 100644
@@ -36,10 +36,12 @@
 #ifdef ENABLE_CRYPTO_OPENSSL
 #include "ssl_openssl.h"
 #include "ssl_verify_openssl.h"
+#define SSLAPI SSLAPI_OPENSSL
 #endif
 #ifdef ENABLE_CRYPTO_POLARSSL
 #include "ssl_polarssl.h"
 #include "ssl_verify_polarssl.h"
+#define SSLAPI SSLAPI_POLARSSL
 #endif

Signature · 1 line

1.7.10.2

David Sommerseth

author

2013-06-12 10:18 UTC #1 lore raw

PATCH v2 1/1 plugin: Extend the plug-in v3 API to identify the SSL implementation used

From: David Sommerseth <[email protected]...>

OpenVPN would segfault unexpectedly if it would be compiled against PolarSSL and the plug-in would expect OpenSSL, or vice-versa. This segfault would not appear before the plug-in would try to access functions which would be available if the plug-in and OpenVPN uses the same SSL implementation.

This patch adds a member to the plug-in initialisation function, which identifies the SSL implementation.

The log_v3 plug-in is updated accordingly + a simple fix to make it buildable again using the ./build script.

A minor documentation error in the openvpn-plugin.h was also corrected, where it mentioned OPENVPN_PLUGIN_VERSION instead of OPENVPN_PLUGINv3_STRUCTVER.

v2 - add const ovpnSSLAPI ssl_api at the end of
struct openvpn_plugin_args_open_in and not in the "middle"

Signed-off-by David Sommerseth <[email protected]...>

---
 include/openvpn-plugin.h           |   24 +++++++++++++++++++++---
 sample/sample-plugins/log/build    |    2 +-
 sample/sample-plugins/log/log_v3.c |    5 +++++
 src/openvpn/plugin.c               |    3 ++-
 src/openvpn/ssl_backend.h          |    2 ++
 5 files changed, 31 insertions(+), 5 deletions(-)

include/openvpn-plugin.h +21 -3

index 0879f49..36e3240 100644
@@ -201,10 +201,15 @@ struct openvpn_plugin_string_list
  *
  * Version   Comment
  *    1      Initial plugin v3 structures providing the same API as
- *           the v2 plugin interface + X509 certificate information.
+ *           the v2 plugin interface, X509 certificate information +
+ *           a logging API for plug-ins.
+ *
+ *    2      Added ssl_api member in struct openvpn_plugin_args_open_in
+ *           which identifies the SSL implementation OpenVPN is compiled
+ *           against.
  *
  */
-#define OPENVPN_PLUGINv3_STRUCTVER 1
+#define OPENVPN_PLUGINv3_STRUCTVER 2
 
 /**
  * Definitions needed for the plug-in callback functions.

@@ -260,6 +265,17 @@ struct openvpn_plugin_callbacks
 };
 
 /**
+ * Used by the openvpn_plugin_open_v3() function to indicate to the
+ * plug-in what kind of SSL implementation OpenVPN uses.  This is
+ * to avoid SEGV issues when OpenVPN is complied against PolarSSL
+ * and the plug-in against OpenSSL.
+ */
+typedef enum {
+  SSLAPI_OPENSSL,
+  SSLAPI_POLARSSL
+} ovpnSSLAPI;
+
+/**
  * Arguments used to transport variables to the plug-in.
  * The struct openvpn_plugin_args_open_in is only used
  * by the openvpn_plugin_open_v3() function.

@@ -286,6 +302,7 @@ struct openvpn_plugin_args_open_in
   const char ** const argv;
   const char ** const envp;
   struct openvpn_plugin_callbacks *callbacks;
+  const ovpnSSLAPI ssl_api;
 };

@@ -557,7 +574,8 @@ OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v2)
  * ARGUMENTS
  *
  * version : fixed value, defines the API version of the OpenVPN plug-in API.  The plug-in
- *	     should validate that this value is matching the OPENVPN_PLUGIN_VERSION value.
+ *	     should validate that this value is matching the OPENVPN_PLUGINv3_STRUCTVER
+ *	     value.
  *
  * arguments : Structure with all arguments available to the plug-in.
  *

sample/sample-plugins/log/build +1 -1

index bbb05f7..c07ec40 100755
@@ -6,7 +6,7 @@
 #
 
 # This directory is where we will look for openvpn-plugin.h
-CPPFLAGS="${CPPFLAGS:--I../../..}"
+CPPFLAGS="${CPPFLAGS:--I../../../include}"
 
 CC="${CC:-gcc}"
 CFLAGS="${CFLAGS:--O2 -Wall -g}"

sample/sample-plugins/log/log_v3.c +5 -0

index 742c756..4d3af91 100644
@@ -85,6 +85,11 @@ openvpn_plugin_open_v3 (const int v3structver,
     return OPENVPN_PLUGIN_FUNC_ERROR;
   }
 
+  if( args->ssl_api != SSLAPI_OPENSSL ) {
+    printf("This plug-in can only be used against OpenVPN with OpenSSL\n");
+    return OPENVPN_PLUGIN_FUNC_ERROR;
+  }
+
   /*  Which callbacks to intercept.  */
   ret->type_mask =
     OPENVPN_PLUGIN_MASK (OPENVPN_PLUGIN_UP) |

src/openvpn/plugin.c +2 -1

index c96c121..55680d1 100644
@@ -40,8 +40,8 @@
 #include "error.h"
 #include "misc.h"
 #include "plugin.h"
+#include "ssl_backend.h"
 #include "win32.h"
-
 #include "memdbg.h"
 
 #define PLUGIN_SYMBOL_REQUIRED (1<<0)

@@ -372,6 +372,7 @@ plugin_open_item (struct plugin *p,
        */
       if (p->open3) {
         struct openvpn_plugin_args_open_in args = { p->plugin_type_mask,
+                                                    SSLAPI,
                                                     (const char ** const) o->argv,
                                                     (const char ** const) envp,
                                                     &callbacks };

src/openvpn/ssl_backend.h +2 -0

index 72235ae..413e4d4 100644
@@ -36,10 +36,12 @@
 #ifdef ENABLE_CRYPTO_OPENSSL
 #include "ssl_openssl.h"
 #include "ssl_verify_openssl.h"
+#define SSLAPI SSLAPI_OPENSSL
 #endif
 #ifdef ENABLE_CRYPTO_POLARSSL
 #include "ssl_polarssl.h"
 #include "ssl_verify_polarssl.h"
+#define SSLAPI SSLAPI_POLARSSL
 #endif
 
 /**

Signature · 1 line

1.7.10.2

Gert Doering

NAK

2013-06-20 18:02 UTC #2 lore raw

Hi,

Quoted 2 lines · David Sommerseth

v2 - add const ovpnSSLAPI ssl_api at the end of
struct openvpn_plugin_args_open_in and not in the "middle"

NAK, because:

src/openvpn/plugin.c plugin_open_item (struct plugin *p, · line 378

Quoted 8 lines

src/openvpn/plugin.c +1 -0

@@ -372,6 +372,7 @@ plugin_open_item (struct plugin *p,
        */
       if (p->open3) {
         struct openvpn_plugin_args_open_in args = { p->plugin_type_mask,
+                                                    SSLAPI,
                                                     (const char ** const) o->argv,
                                                     (const char ** const) envp,
                                                     &callbacks };

... it's still sitting in the middle in the init function...

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

David Sommerseth

author

2013-06-20 18:39 UTC #3 lore raw

PATCH v3 1/1 plugin: Extend the plug-in v3 API to identify the SSL implementation used

From: David Sommerseth <[email protected]...>

This patch adds a member to the plug-in initialisation function, which identifies the SSL implementation.

The log_v3 plug-in is updated accordingly + a simple fix to make it buildable again using the ./build script.

A minor documentation error in the openvpn-plugin.h was also corrected, where it mentioned OPENVPN_PLUGIN_VERSION instead of OPENVPN_PLUGINv3_STRUCTVER.

v2 - add const ovpnSSLAPI ssl_api at the end of
struct openvpn_plugin_args_open_in and not in the "middle"

v3 - fix bug in plug-in init, as the SSLAPI was located wrong in the
args struct sent to the openvpn_plugin_open_v3() function.

Signed-off-by David Sommerseth <[email protected]...>

---
 include/openvpn-plugin.h           |   24 +++++++++++++++++++++---
 sample/sample-plugins/log/build    |    2 +-
 sample/sample-plugins/log/log_v3.c |    5 +++++
 src/openvpn/plugin.c               |    5 +++--
 src/openvpn/ssl_backend.h          |    2 ++
 5 files changed, 32 insertions(+), 6 deletions(-)

include/openvpn-plugin.h +21 -3

index 0879f49..36e3240 100644
@@ -201,10 +201,15 @@ struct openvpn_plugin_string_list
  *
  * Version   Comment
  *    1      Initial plugin v3 structures providing the same API as
- *           the v2 plugin interface + X509 certificate information.
+ *           the v2 plugin interface, X509 certificate information +
+ *           a logging API for plug-ins.
+ *
+ *    2      Added ssl_api member in struct openvpn_plugin_args_open_in
+ *           which identifies the SSL implementation OpenVPN is compiled
+ *           against.
  *
  */
-#define OPENVPN_PLUGINv3_STRUCTVER 1
+#define OPENVPN_PLUGINv3_STRUCTVER 2
 
 /**
  * Definitions needed for the plug-in callback functions.

@@ -260,6 +265,17 @@ struct openvpn_plugin_callbacks
 };
 
 /**
+ * Used by the openvpn_plugin_open_v3() function to indicate to the
+ * plug-in what kind of SSL implementation OpenVPN uses.  This is
+ * to avoid SEGV issues when OpenVPN is complied against PolarSSL
+ * and the plug-in against OpenSSL.
+ */
+typedef enum {
+  SSLAPI_OPENSSL,
+  SSLAPI_POLARSSL
+} ovpnSSLAPI;
+
+/**
  * Arguments used to transport variables to the plug-in.
  * The struct openvpn_plugin_args_open_in is only used
  * by the openvpn_plugin_open_v3() function.

@@ -286,6 +302,7 @@ struct openvpn_plugin_args_open_in
   const char ** const argv;
   const char ** const envp;
   struct openvpn_plugin_callbacks *callbacks;
+  const ovpnSSLAPI ssl_api;
 };

@@ -557,7 +574,8 @@ OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v2)
  * ARGUMENTS
  *
  * version : fixed value, defines the API version of the OpenVPN plug-in API.  The plug-in
- *	     should validate that this value is matching the OPENVPN_PLUGIN_VERSION value.
+ *	     should validate that this value is matching the OPENVPN_PLUGINv3_STRUCTVER
+ *	     value.
  *
  * arguments : Structure with all arguments available to the plug-in.
  *

sample/sample-plugins/log/build +1 -1

index bbb05f7..c07ec40 100755
@@ -6,7 +6,7 @@
 #
 
 # This directory is where we will look for openvpn-plugin.h
-CPPFLAGS="${CPPFLAGS:--I../../..}"
+CPPFLAGS="${CPPFLAGS:--I../../../include}"
 
 CC="${CC:-gcc}"
 CFLAGS="${CFLAGS:--O2 -Wall -g}"

sample/sample-plugins/log/log_v3.c +5 -0

index 742c756..4d3af91 100644
@@ -85,6 +85,11 @@ openvpn_plugin_open_v3 (const int v3structver,
     return OPENVPN_PLUGIN_FUNC_ERROR;
   }
 
+  if( args->ssl_api != SSLAPI_OPENSSL ) {
+    printf("This plug-in can only be used against OpenVPN with OpenSSL\n");
+    return OPENVPN_PLUGIN_FUNC_ERROR;
+  }
+
   /*  Which callbacks to intercept.  */
   ret->type_mask =
     OPENVPN_PLUGIN_MASK (OPENVPN_PLUGIN_UP) |

src/openvpn/plugin.c +3 -2

index c96c121..0948f23 100644
@@ -40,8 +40,8 @@
 #include "error.h"
 #include "misc.h"
 #include "plugin.h"
+#include "ssl_backend.h"
 #include "win32.h"
-
 #include "memdbg.h"
 
 #define PLUGIN_SYMBOL_REQUIRED (1<<0)

@@ -374,7 +374,8 @@ plugin_open_item (struct plugin *p,
         struct openvpn_plugin_args_open_in args = { p->plugin_type_mask,
                                                     (const char ** const) o->argv,
                                                     (const char ** const) envp,
-                                                    &callbacks };
+                                                    &callbacks,
+                                                    SSLAPI };
         struct openvpn_plugin_args_open_return retargs;
 
         CLEAR(retargs);

src/openvpn/ssl_backend.h +2 -0

index 72235ae..413e4d4 100644
@@ -36,10 +36,12 @@
 #ifdef ENABLE_CRYPTO_OPENSSL
 #include "ssl_openssl.h"
 #include "ssl_verify_openssl.h"
+#define SSLAPI SSLAPI_OPENSSL
 #endif
 #ifdef ENABLE_CRYPTO_POLARSSL
 #include "ssl_polarssl.h"
 #include "ssl_verify_polarssl.h"
+#define SSLAPI SSLAPI_POLARSSL
 #endif
 
 /**

Signature · 1 line

1.7.10.2

Gert Doering

2013-06-20 19:44 UTC #4 lore raw

Hi,

Quoted 6 lines · David Sommerseth

From: David Sommerseth <[email protected]...>
OpenVPN would segfault unexpectedly if it would be compiled against PolarSSL and the plug-in would expect OpenSSL, or vice-versa. This segfault would not appear before the plug-in would try to access functions which would be available if the plug-in and OpenVPN uses the same SSL implementation.

[..]

Quoted 2 lines

v3 - fix bug in plug-in init, as the SSLAPI was located wrong in the
args struct sent to the openvpn_plugin_open_v3() function.

ACK.

As, I think, 2.3.x will be with us for quite a while, I'd consider this a bugfix to the new feature in 2.3.x (namely, polarSSL support) and would put it into master and 2.3

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

Gert Doering

2013-07-03 19:05 UTC #5 lore raw

In reply to David Sommerseth

Hi,

Quoted 9 lines · David Sommerseth

From: David Sommerseth <[email protected]...>
OpenVPN would segfault unexpectedly if it would be compiled against PolarSSL and the plug-in would expect OpenSSL, or vice-versa. This segfault would not appear before the plug-in would try to access functions which would be available if the plug-in and OpenVPN uses the same SSL implementation.
This patch adds a member to the plug-in initialisation function, which identifies the SSL implementation.

I already ACKed that, but merging & testing, I found that when you compile with --disable-ssl, the plugin functions would be passed "0" as SSLAPI, by pure coincidence (macro not being defined at all, which seems to be legal in a struct init and maps to 0).

So could you do a v4 that has SSLAPI_NONE in the ovpnSSLAPI and sets that if neither OpenSSL nor PolarSSL is active?

thanks :-)

gert

Signature · 4 lines

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

David Sommerseth

author

2013-07-03 19:17 UTC #6 lore raw

PATCH 1/1 plugin: Extend the plug-in v3 API to identify the SSL implementation used

From: David Sommerseth <[email protected]...>

This patch adds a member to the plug-in initialisation function, which identifies the SSL implementation.

The log_v3 plug-in is updated accordingly + a simple fix to make it buildable again using the ./build script.

A minor documentation error in the openvpn-plugin.h was also corrected, where it mentioned OPENVPN_PLUGIN_VERSION instead of OPENVPN_PLUGINv3_STRUCTVER.

v2 - add const ovpnSSLAPI ssl_api at the end of
struct openvpn_plugin_args_open_in and not in the "middle"

v3 - fix bug in plug-in init, as the SSLAPI was located wrong in the
args struct sent to the openvpn_plugin_open_v3() function.

v4 - Ensure SSLAPI got a sane/known value if SSL is disabled or unknown

Signed-off-by David Sommerseth <[email protected]...>

---
 include/openvpn-plugin.h           | 25 ++++++++++++++++++++++---
 sample/sample-plugins/log/build    |  2 +-
 sample/sample-plugins/log/log_v3.c |  5 +++++
 src/openvpn/plugin.c               |  5 +++--
 src/openvpn/ssl_backend.h          |  7 +++++++
 5 files changed, 38 insertions(+), 6 deletions(-)

include/openvpn-plugin.h +22 -3

index 0879f49..03da92a 100644
@@ -201,10 +201,15 @@ struct openvpn_plugin_string_list
  *
  * Version   Comment
  *    1      Initial plugin v3 structures providing the same API as
- *           the v2 plugin interface + X509 certificate information.
+ *           the v2 plugin interface, X509 certificate information +
+ *           a logging API for plug-ins.
+ *
+ *    2      Added ssl_api member in struct openvpn_plugin_args_open_in
+ *           which identifies the SSL implementation OpenVPN is compiled
+ *           against.
  *
  */
-#define OPENVPN_PLUGINv3_STRUCTVER 1
+#define OPENVPN_PLUGINv3_STRUCTVER 2
 
 /**
  * Definitions needed for the plug-in callback functions.

@@ -260,6 +265,18 @@ struct openvpn_plugin_callbacks
 };
 
 /**
+ * Used by the openvpn_plugin_open_v3() function to indicate to the
+ * plug-in what kind of SSL implementation OpenVPN uses.  This is
+ * to avoid SEGV issues when OpenVPN is complied against PolarSSL
+ * and the plug-in against OpenSSL.
+ */
+typedef enum {
+  SSLAPI_NONE,
+  SSLAPI_OPENSSL,
+  SSLAPI_POLARSSL
+} ovpnSSLAPI;
+
+/**
  * Arguments used to transport variables to the plug-in.
  * The struct openvpn_plugin_args_open_in is only used
  * by the openvpn_plugin_open_v3() function.

@@ -286,6 +303,7 @@ struct openvpn_plugin_args_open_in
   const char ** const argv;
   const char ** const envp;
   struct openvpn_plugin_callbacks *callbacks;
+  const ovpnSSLAPI ssl_api;
 };

@@ -557,7 +575,8 @@ OPENVPN_PLUGIN_DEF int OPENVPN_PLUGIN_FUNC(openvpn_plugin_func_v2)
  * ARGUMENTS
  *
  * version : fixed value, defines the API version of the OpenVPN plug-in API.  The plug-in
- *	     should validate that this value is matching the OPENVPN_PLUGIN_VERSION value.
+ *	     should validate that this value is matching the OPENVPN_PLUGINv3_STRUCTVER
+ *	     value.
  *
  * arguments : Structure with all arguments available to the plug-in.
  *

sample/sample-plugins/log/build +1 -1

index bbb05f7..c07ec40 100755
@@ -6,7 +6,7 @@
 #
 
 # This directory is where we will look for openvpn-plugin.h
-CPPFLAGS="${CPPFLAGS:--I../../..}"
+CPPFLAGS="${CPPFLAGS:--I../../../include}"
 
 CC="${CC:-gcc}"
 CFLAGS="${CFLAGS:--O2 -Wall -g}"

sample/sample-plugins/log/log_v3.c +5 -0

index 742c756..4d3af91 100644
@@ -85,6 +85,11 @@ openvpn_plugin_open_v3 (const int v3structver,
     return OPENVPN_PLUGIN_FUNC_ERROR;
   }
 
+  if( args->ssl_api != SSLAPI_OPENSSL ) {
+    printf("This plug-in can only be used against OpenVPN with OpenSSL\n");
+    return OPENVPN_PLUGIN_FUNC_ERROR;
+  }
+
   /*  Which callbacks to intercept.  */
   ret->type_mask =
     OPENVPN_PLUGIN_MASK (OPENVPN_PLUGIN_UP) |

src/openvpn/plugin.c +3 -2

index c96c121..0948f23 100644
@@ -40,8 +40,8 @@
 #include "error.h"
 #include "misc.h"
 #include "plugin.h"
+#include "ssl_backend.h"
 #include "win32.h"
-
 #include "memdbg.h"
 
 #define PLUGIN_SYMBOL_REQUIRED (1<<0)

@@ -374,7 +374,8 @@ plugin_open_item (struct plugin *p,
         struct openvpn_plugin_args_open_in args = { p->plugin_type_mask,
                                                     (const char ** const) o->argv,
                                                     (const char ** const) envp,
-                                                    &callbacks };
+                                                    &callbacks,
+                                                    SSLAPI };
         struct openvpn_plugin_args_open_return retargs;
 
         CLEAR(retargs);

src/openvpn/ssl_backend.h +7 -0

index 72235ae..b1dce22 100644
@@ -36,10 +36,17 @@
 #ifdef ENABLE_CRYPTO_OPENSSL
 #include "ssl_openssl.h"
 #include "ssl_verify_openssl.h"
+#define SSLAPI SSLAPI_OPENSSL
 #endif
 #ifdef ENABLE_CRYPTO_POLARSSL
 #include "ssl_polarssl.h"
 #include "ssl_verify_polarssl.h"
+#define SSLAPI SSLAPI_POLARSSL
+#endif
+
+/* Ensure that SSLAPI got a sane value if SSL is disabled or unknown */
+#ifndef SSLAPI
+#define SSLAPI SSLAPI_NONE
 #endif
 
 /**

Signature · 1 line

1.8.3.1

Gert Doering

2013-07-03 19:22 UTC #7 lore raw

ACK, as discussed on IRC in parallel.

Patch has been applied to the master and release/2.3 branches (as discussed in the context of earlier revisions - considered a bugfix for the new plugin v3 infrastructure introduced in 2.3.0, and bugfixes go into 2.3).

commit 587df08abda3c8f1f85ccdba4d8b82a736c11e2d (master) commit 570da542877a1f42ed6549a6ca3f54df9ec53c1f (release/2.3)

Author: David Sommerseth
Date:   Wed Jul 3 21:17:10 2013 +0200

     plugin: Extend the plug-in v3 API to identify the SSL implementation used

     Signed-off-by: David Sommerseth <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/7754
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering