Insecure method used

.gitignore

@@ -7,6 +7,7 @@
 .*.swp
 *~
 openvpn-ldap-search
+openvpn-ldap-auth-test
 m4
 depcomp
 install-sh
@@ -26,4 +27,6 @@ aclocal.m4
 Makefile
 configure
 config.h
+config.h.in
 testplugin
+tools/

Changelog

@@ -1,3 +1,10 @@
+version 1.0.0 undef
+  * Features:
+	  + handle TLS_REQCERT to some extend
+		+ Use LDAP backend to keep user settings
+	* Improvements:
+	  + Fallback to default config filename
+
 version 0.0.6 2010-08-03
 	* Handle *version* argument correctly
 

README

@@ -39,6 +39,7 @@ binddn=cn=admin,dc=example,dc=com
 bindpw=secret
 version=3
 #ssl=start_tls
+#tls_reqcert=never
 ssl=off
 groupdn=ou=roles,dc=example,dc=com
 group_search_filter=|(cn=vpn)(cn=sysadmins)

TODO

@@ -5,3 +5,9 @@ TLS:
 
 Handle the different TLS_REQCERT parameters ( never, allow, demand, try )
 
+User auth:
+----------
+handle default_pf_rules and default_profiledn when not pf_rules/profiledn are found
+default_profiledn: if user does not have a ovpnprofile dn, use this one as default
+default_pf_rules: if not pf_rules are found for user, use this one instead of default to accept all
+

UPGRADE-from-0.0.X.txt

@@ -0,0 +1,144 @@
+Important notes:
+
+= User config stored in LDAP
+Users configuration can now be stored in LDAP.
+the feature is enable by default but can be disabled by running:
+
+./configure --disable-ldapuserconfig
+
+If you use this feature, you ldap server must include ovpn.schema:
+in slapd.conf add:
+include         /etc/ldap/schema/ovpn.schema
+
+The schema can be found in tests/ovpn.schema.
+
+An OpenVPNAccount can have any attributes from
+OpenVPNProfile plus:
+OvpnProfile: the DN of a profile where to get default settings
+OvpnCCDIfconfigPush: to define a static IP for this user
+
+This allows to provide the same settings for many user belonging
+to the same group.
+
+An example LDAP ldif would look like:
+dn: uid=user1,ou=thirdparty,dc=example,dc=com
+objectClass: inetOrgPerson
+objectClass: OpenVPNAccount
+uid: user1
+cn: user1
+userPassword:: dXNlcjE=
+sn: user1sn
+OvpnProfile: cn=default,ou=profiles,ou=openvpn,dc=example,dc=com
+OvpnCCDPushOption: route 192.168.32.0 255.255.255.0
+OvpnPFRulesClientDefaultAccept: true
+OvpnPFRulesSubnetDefaultAccept: true
+OvpnPFRulesSubnet:: KzE5Mi4xNjguMzMuMTkKLTE5Mi4xNjguMzMuMC8yNAorMTkyLjE2OC4zMi
+ 4wLzI4Ci0xOTIuMTY4LjMyLjAvMjQ=
+OvpnEndDate: 20100810100000Z
+
+dn: cn=default,ou=profiles,ou=openvpn,dc=example,dc=com
+objectClass: OpenVPNProfile
+objectClass: person
+cn: default
+sn: dummy
+OvpnCCDPushReset: TRUE
+OvpnCCDPushOption: route 192.168.33.0 255.255.255.0
+OvpnCCDPushOption: route 192.168.34.0 255.255.255.0
+OvpnStartDate: 20100728000000Z
+OvpnEndDate: 20100802100000Z
+OvpnPFRulesSubnet:: KzE5Mi4xNjguMzIuMC8yNAotMTkyLjE2OC4zMy4wLzI4CisxOTIuMTY4Lj
+ MzLjAvMjQK
+OvpnPFRulesSubnetDefaultAccept: true
+OvpnPFRulesClientDefaultAccept: false
+
+
+default profile allow users to connect from:
+28/07/2010 00:00:00 GMT until 02/08/2010 00:00:00 GMT
+global push info will be reset
+default packet filter rules to clients will drop packets, while it will accept to subnets
+The rules for subnets are base64 encoded and is equivalent to:
++192.168.32.0/24
+-192.168.33.0/28
++192.168.33.0/24
+Also, the routes 192.168.33.0/24 and 192.168.34.0/24 will be pushed.
+
+user1 inherits those settings but override some of them:
+It wont be able to connect after 10/08/2010 10:00:00 GTM instead of 02/08/2010 00:00:00 GMT
+It will also get 192.168.32.0/24 route pushed to it
+Default PF rules are overriden and are instead changed to accept packets to clients
+Its PF subnets rules are 
++192.168.33.19
+-192.168.33.0/24
++192.168.32.0/28
+-192.168.32.0/24
+
+= Multiple profiles
+
+Since 0.0.X, the config syntax has changed a little.
+Most importantly, release greater than 0.0.X support multiple profiles
+which allow defining different type of openvpn group.
+
+From now on, all information which is not related to LDAP connection details
+must be enclosed within 
+<profile>
+</profile>
+tags.
+
+== LDAP server connection details parameters
+uri=ldap://192.168.9.135
+binddn=cn=admin,dc=example,dc=com
+bindpw=secret
+version=3
+#ssl=start_tls
+#tls_reqcert=never
+ssl=off
+timeout
+
+tls_reqcert can take the following values (default to never): never|try|allow|hard|demand
+
+Some more parameters exist which are ignore at the moment and might be subject
+to change, so it is not recommended you use them:
+tls_cacertfile
+tls_cacertdir
+tls_certfile
+tls_certkey
+tls_ciphersuite
+
+== Profile parameters
+Profiles allow to define how to find users. Each profile can have different rules
+applied to it.
+
+The following parameters can be defined whithin <profile></profile> tag.
+As many profile as you like can be defined.
+The first one that can match a user will be used.
+
+Here are the parameters you can use:
+basedn
+search_filter
+search_scope
+groupdn
+group_search_filter
+member_attribute
+redirect_gateway_prefix
+redirect_gateway_flags
+enable_pf
+default_pf_rules
+
+If the plugin was compiled with ldapuserconfig support, you can also use:
+default_profiledn
+
+An example config file can be found in tests/config.conf
+
+
+= group_search_filter syntax change
+
+In 0.0.X releases, group_search_filter syntax was not needing parentheses
+and was looking like:
+group_search_filter=|(cn=vpn)(cn=sysadmins)
+
+Since 0.1.X the syntax has changed to be consistant with search_filter and
+MUST now be within parentheses.
+As such, the previous filter need to be changed to:
+group_search_filter=(|(cn=vpn)(cn=sysadmins))
+
+

configure.in

@@ -18,18 +18,45 @@ dnl LT_INIT
 AC_CONFIG_MACRO_DIR([m4])
 AC_PROG_CC
 
-CFLAGS="${CFLAGS} -g -Wall -Werror -D_FILE_OFFSET_BITS=64"
-
+CFLAGS="${CFLAGS} -g -Wall -Werror"
 AC_SUBST(CFLAGS)
 
+AC_ARG_ENABLE(ldapuserconfig,
+   [  --disable-ldapuserconfig, Disable user ldap settings],
+   [LDAP_USER_CONF="$enableval"],
+   [LDAP_USER_CONF="yes"]
+)
+
+dnl enable ldapuserconfig
+if test "$LDAP_USER_CONF" = "yes"; then
+  AC_DEFINE(ENABLE_LDAPUSERCONF, 1, [Enable user ldap settings])
+fi
+
 AC_CHECK_HEADER([ldap.h],
         [AC_CHECK_LIB(ldap, [ldap_initialize])],
         [AC_MSG_ERROR("ldap headers not found")])
 
+AC_CHECK_HEADER([lber.h],
+        [AC_CHECK_LIB(lber, [ber_free])],
+        [AC_MSG_ERROR("lber headers not found")])
+
 AC_CHECK_HEADER([pthread.h],
       [AC_CHECK_LIB(pthread, [pthread_create])],
       [AC_MSG_ERROR("pthread headers not found")])
 
+AC_CHECK_HEADERS([syslog.h sys/resource.h ])
+AC_CHECK_FUNCS([getrlimit])
+
+
 AC_PROG_INSTALL
 AC_OUTPUT( Makefile src/Makefile tests/Makefile )
 
+echo "
+Configuration:
+
+   Source code location:                              ${srcdir}
+   Lib install dir:                                   ${prefix}/lib
+   Compiler:                                          ${CXX}
+
+   LDAP user conf:                                    ${LDAP_USER_CONF}
+"

src/Makefile.am

@@ -8,6 +8,8 @@ auth_ldap_SOURCES = utils.h utils.c \
 							list.h list.c \
 							action.h action.c \
 							la_ldap.h la_ldap.c \
+							ldap_profile.h ldap_profile.c \
+							client_context.h client_context.c \
 							debug.h debug.c
 
 #openvpn_ldap_rules_SOURCES = openvpn-ldap-rules.c \

src/action.c

@@ -28,7 +28,7 @@ action_new( )
   action_t *a = NULL;
   a = la_malloc( sizeof( action_t ) );
   if( a ){
-    la_memset( a, 0, sizeof( action_t ) ); 
+    la_memset( a, 0, sizeof( action_t ) );
   }
   return a;
 }

src/action.h

@@ -30,8 +30,9 @@ enum ldap_auth_action {
 
 typedef struct action{
   enum ldap_auth_action type;
-  void *context; 
-  void (*context_free_func)( void *data ); 
+  void *context;
+  void *client_context; /*this should not be freed, openvpn plugin call will take care of it */
+  void (*context_free_func)( void *data );
 } action_t;
 
 extern action_t *action_new( void );

src/client_context.c

@@ -0,0 +1,56 @@
+/**
+ * vim: tabstop=2:shiftwidth=2:softtabstop=2:expandtab
+ * client_context.c
+ *
+ * Copyright (C) 2010 Emmanuel Bretelle <chantra@debuntu.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ *
+ */
+
+#include "client_context.h"
+#include "utils.h"
+
+#ifdef ENABLE_LDAPUSERCONF
+#include "ldap_profile.h"
+#endif
+
+
+struct client_context *
+client_context_new (void) {
+	struct client_context *cc;
+	cc = la_malloc (sizeof (struct client_context));
+	if (cc)
+		la_memset (cc, 0, sizeof (struct client_context));
+#ifdef ENABLE_LDAPUSERCONF
+  if( ( cc->ldap_account = ldap_account_new( ) ) == NULL ){
+    client_context_free( cc );
+    cc = NULL;
+  }
+#endif
+	return cc;
+}
+void
+client_context_free (struct client_context *cc) {
+	if (cc == NULL)
+		return;
+	FREE_IF_NOT_NULL (cc->user_id);
+	FREE_IF_NOT_NULL (cc->user_dn);
+#ifdef ENABLE_LDAPUSERCONF
+  if( cc->ldap_account != NULL ) ldap_account_free( cc->ldap_account );
+#endif
+	FREE_IF_NOT_NULL (cc);
+}
+