aboutsummaryrefslogtreecommitdiff
path: root/src/plugins/auth-pam
AgeCommit message (Collapse)Author
2023-01-10Update copyright year to 2023Frank Lichtenheld
Manually excluded ovpn_dco_win.h because it is an imported file. ovpn_dco_linux.h is already excluded because it still says 2021. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20230110160531.81010-1-frank@lichtenheld.com> URL: https://patchwork.openvpn.net/project/openvpn2/patch/20230110160531.81010-1-frank@lichtenheld.com/ Signed-off-by: Gert Doering <gert@greenie.muc.de> (cherry picked from commit ccf9d57249acb9bc9a450aec3e613bda631415f5)
2022-10-10Insert client connection data into PAM environmentPaolo Cerrito
OpenVPN provides the IPv4/IPv6 address of incoming client connections to the plugin-api by means of two environment variables, $untrusted_ip and $untrusted_ip6. This patch adds support to plugin-auth-pam to pass this information to the PAM stack as pam_set_item(PAM_RHOST). v3: - styled code as openvpn - added check for remote, if NULL after all get_env, put to point to empy string Signed-off-by: Paolo Cerrito <wardragon78@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20221010122745.19809-1-wardragon78@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg25375.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-05-22Reformat for sp_after_comma=addFrank Lichtenheld
It is our usual style. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com> Acked-by: Antonio Quartulli <a@unstable.cc> Message-Id: <20220519085428.6783-2-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24399.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-04-22auth-pam.c: add missing include limits.hAntonio Quartulli
On most systems limits.h is pulled in by some other header and thus no error is ever triggered, but it's possible to find the right environment which lackis this and prevents compiling auth-pam.c (possibly when using LibreSSL). Include the header explicitly as it includes the definition of PATH_MAX. (note that this bug is fixed in Gentoo since 2020 by including a custom patch, but apparently the issue was never reported upstream) Reported-by: Michelangelo Scopelliti <kernelpanic@gmx.com> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220421131909.32053-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24136.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-04-21The Great Reformatting of 2022David Sommerseth
It was agreed it was time to do a full reformat fix-up of the whole source tree again. Over time (since late 2016) small changes has not adhered to our uncrustify defined coding style. This realigns to our current standards. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220420143050.52790-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg24123.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-02-26Ignore deprecation warning for daemon() on macOS (plugin/auth-pam)Saifur Rahman Mohsin
Follow up to a480eaa (does the same for auth-pam.c). Signed-off-by: Saifur Rahman Mohsin <mohsin92@me.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20220224172330.43451-1-mohsin92@me.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23890.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2022-01-26update copyright year to 2022Antonio Quartulli
Update performed by means of: dev-tools/update-copyright.sh Cc: David Sommerseth <davids@openvpn.net> Signed-off-by: Antonio Quartulli <a@unstable.cc> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <20220125142456.18176-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23650.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2021-06-15Update copyrightsDavid Sommerseth
- Update the update-copyright script to include more contributors as well as correcting a few typos - Correct a copyright address in the source code to now used address (dazo) - Update copyright year to 2021 Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net> URL: https://www.mail-archive.com/search?l=mid&q=20210609213231.22576-1-openvpn@sf.lists.topphemmelig.net URL: https://sourceforge.net/p/openvpn/mailman/message/37299719/ Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-10-24Remove NULL checks before calling freeArne Schwabe
We (and OpenSSL) already use calling free on null pointers in a number of places and also C99 standards says free(NULL) does nothing. The if (x) free(x) calls more often make code harder to read, instead of easier, remove these NULL checks in favour of directly calling free(x). The OpenSSL *_free methods are also safe to call with NULL and pkcs11h_certificate_freeCertificateIdList is also safe to be called with NULL. Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20201023113431.26691-5-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21216.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-07-21Remove --client-cert-not-requiredDavid Sommerseth
This removes support for the --client-cert-not-required option. To avoid starting a server with this option just ignored, which would make it impossible for existing clients to connect it will exit with instructions to replace this option with --verify-client-cert none. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20200720113010.10450-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20502.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-07-15Add deferred authentication support to plugin-auth-pamGert Doering
If OpenVPN signals deferred authentication support (by setting the internal environment variables "auth_control_file" and "deferred_auth_pam"), do not wait for PAM stack to finish. Instead, the privileged PAM process returns RESPONSE_DEFER via the control socket, which gets turned into OPENVPN_PLUGIN_FUNC_DEFERRED towards openvpn. The PAM process will then fork() and handle all the PAM auth in the new process, signalling success/failure back by means of the auth_control_file (forking twice, to simplify wait() handling). With the extra fork(), multiple deferred authentications can run at the same time - otherwise the first one would block the next auth call (because the child would not be ready again to read from the control socket). Lightly tested on Linux. Signed-off-by: Gert Doering <gert@greenie.muc.de> -- v2: - only do deferred auth if "deferred_auth_pam" is set (env) - put deferred auth logic into do_deferred_pam_auth() - line-wrap lines where needed - close "background end" of socketpair in deferred auth process - remove leftover /* plugin_log() */ lines from initial testing - tested over a few hundred "15s delayed" authentication cycles v3: - uncrustify new code - do not abort background process if do_deferred_pam_auth() fails (this can only happen if fork() fails, which is assumed to be temporary, or if something is wrong with the socketpair which we should notice on the next read()) --> change do_deferred_pam_auth() to "void" - add documentation to README.auth-pam and Changes.rst Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20200715090105.22296-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20361.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2020-06-22Convert plugin/auth-pam.c from stderr logging to plugin_log().Gert Doering
More recent OpenVPN APIs pass a function pointer for a logging function (plugin_log()) to plugins. Using this will make the plugin logs appear wherever openvpn logs to - file, syslog, stderr. This patch converts plugin/auth-pam.c "fairly mechanically" to use this new API. Real errors are logged with PLOG_ERR or PLOG_ERR|PLOG_ERRNO, while debug info is logged with PLOG_NOTE (subject to the already-existing debug level handling inside plugin/auth-pam, via "setenv verb <n>"). Signed-off-by: Gert Doering <gert@greenie.muc.de> Acked-by: Selva Nair <selva.nair@gmail.com> Message-Id: <20200620143940.11704-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20037.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2019-02-06Fix various spelling mistakesJonathan Tooker
New patch, omitted changes to copyrights/licenses & changelog. Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <20190123201717.15048-1-jonathan@reliablehosting.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18177.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-08-08Accept empty password and/or response in auth-pam pluginSelva Nair
In the auth-pam plugin correctly parse the static challenge string even when password or challenge response is empty. Whether an empty user input is an error is determined by the PAM conversation function depending on whether the PAM module queries for it or not. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1533696271-21799-2-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17382.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-08-08Bump version of openvpn plugin argument structs to 5Selva Nair
This was missed in commit 6690769f78bbfb889fef2a54088d979896c87d51 that exported base64_encode and base64_decode() functions. Also check the version is >= 5 in auth-pam plugin to ensure that the base64_decode function pointer can be referenced. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1533696271-21799-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/search?l=mid&q=1533696271-21799-1-git-send-email-selva.nair@gmail.com Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-08-07Parse static challenge response in auth-pam pluginSelva Nair
If static challenge is in use, the password passed to the plugin by openvpn is of the form "SCRV1:base64-pass:base64-response". Parse this string to separate it into password and response and use them to respond to queries in the pam conversation function. On the plugin parameters line the substitution keyword for the static challenge response is "OTP". For example, for pam config named "test" that prompts for "user", "password" and "pin", use plugin openvpn-auth-pam.so "test user USERNAME password PASSWORD pin OTP" Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1532486093-24793-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg17307.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2018-02-01Update copyright to include 2018 plus company name changeDavid Sommerseth
The autumn of 2017, OpenVPN Technologies, Inc changed name to just OpenVPN Inc. Otherwise, extend the copyright to cover 2018 as well. With the exception of the company name change, all changes have been performed by the dev-tools/update-copyright.sh script. Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20180131140314.11103-1-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16418.html Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-06-16copyright: Update GPLv2 license textsDavid Sommerseth
The COPYRIGHT.GPL file was slightly out-of-sync with the last GPLv2 license from Free Software Foundation, Inc. The changes are primarily a new address, which required touching almost all the project files. Except of that, it is just minor adjustments to formatting, removal of form-feed characters and referencing "GNU Lesser General Public License" instead of "GNU Library General Public License". Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20170329093648.10156-1-davids@openvpn.net> URL: https://www.mail-archive.com/search?l=mid&q=20170329093648.10156-1-davids@openvpn.net Signed-off-by: Gert Doering <gert@greenie.muc.de>
2017-05-09In auth-pam plugin clear the password after useSelva Nair
v2: Change the plugin open to use v3 API so that secure_memzero() exported from OpenVPN can be used. v3: Relaxe API compatibility check: struct version 4 or higher will have secure_memzero exported. Note: context is cast as (openvpn_plugin_handle_t *) for consistency with the current plugin header. If/when the header is fixed, change this cast as well. Signed-off-by: Selva Nair <selva.nair@gmail.com> Acked-by: David Sommerseth <davids@openvpn.net> Message-Id: <1494359069-13824-1-git-send-email-selva.nair@gmail.com> URL: http://www.mail-archive.com/search?l=mid&q=1494359069-13824-1-git-send-email-selva.nair@gmail.com Signed-off-by: David Sommerseth <davids@openvpn.net>
2017-01-18More broadly enforce Allman style and braces-around-conditionalsSteffan Karger
We want { and } aligned, which means also adding a newline between each for() and {, while() and {, etc. Also, we agreed to always use braces with conditionals. The previous uncrustify config added these for if()s, now also add these for while() and for(). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1484403020-6857-1-git-send-email-steffan@karger.me> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13875.html Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-12-21Update copyrightsDavid Sommerseth
Signed-off-by: David Sommerseth <davids@openvpn.net> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <1482350454-27280-2-git-send-email-davids@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13653.html
2016-12-14The Great Reformatting - first phaseDavid Sommerseth
This is the first commit of the big reformatting task. This is performed by running the ./dev-tools/reformat-all.sh script. This is based upon the v3 reformat-all.sh/uncrustify.conf version which is now applied to git master. Signed-off-by: David Sommerseth <davids@openvpn.net>
2016-05-30Add a test for auth-pam searchandreplaceJens Neuhalfen
No functional changes. Utility functions of auth-pam are split into a dedicated file. This allows the test programs to easily test these functions without adding dependencies. Add a minimal test for searchandreplace as a proof of concept. [ Modified during commit: Enhanced documentation of functions in utils.h to comply with doxygen standards ] Signed-off-by: Jens Neuhalfen <jens@neuhalfen.name> Acked-by: Steffan Karger <steffan@karger.me> Message-Id: <20160525175756.56186-3-openvpn-devel@neuhalfen.name> URL: http://article.gmane.org/gmane.network.openvpn.devel/11724 Signed-off-by: David Sommerseth <dazo@privateinternetaccess.com>
2016-04-21Fix buffer overflow by user supplied dataJens Neuhalfen
Passing very long usernames/passwords for pam authentication could possibly lead to a stack based buffer overrun in the auth-pam plugin. Adds a dependency to C99 (includes stdbool.h) Signed-off-by: Jens Neuhalfen <jens@neuhalfen.name> Acked-by: Steffan Karger <steffan.karger@fox-it.com> Message-Id: <A4F03DE4-3E70-4815-B4B4-CC185E35CF2C@neuhalfen.name> URL: http://article.gmane.org/gmane.network.openvpn.devel/11477 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2015-10-22Fix memory leak in auth-pam pluginSteffan Karger
As it says on the tin. aresp would not be free'd nor returned by my_conv() on errors. Note that we never reach this code if allocation of aresp failed. Found with the Clang static analyzer. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Lev Stipakov <lstipakov@gmail.com> Message-Id: <1445380706-20864-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/10338 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2014-04-27Fix build system to accept non-system crypto library locations for plugins.Steffan Karger
Flags like {OPEN,POLAR}SSL_CFLAGS were used by the core build, but not by the plugins. However, all plugins include openvpn-plugin.h, which need crypto/ssl headers. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1398080238-19662-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8576 Signed-off-by: Gert Doering <gert@greenie.muc.de>
2012-06-26build: integrate plugins build into core buildAlon Bar-Lev
As disucssed[1], keep plugins in repository. 1, Proper automake/libtool build. 2. Move example plugins to samples/sample-plugins. 3. Plugins are installed at LIBDIR/openvpn/plugins. [1] http://comments.gmane.org/gmane.network.openvpn.devel/6436 Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1337035323-27465-1-git-send-email-alon.barlev@gmail.com URL: http://article.gmane.org/gmane.network.openvpn.devel/6591 Signed-off-by: David Sommerseth <davids@redhat.com>
2012-03-22build: standard directory layoutAlon Bar-Lev
Suitable for mature project. root - administrative stuff doc - documents src - sources tests - tests distro - distro specific files sample - samples SIDE EFFECT: many changes to rpm spec. Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Signed-off-by: David Sommerseth <davids@redhat.com>
generated by cgit v1.1 at 2024-10-07 11:21:56 +0000