Re: [Openvpn-devel] [PATCH] Insert client connection data into PAM environment

2019-10-01 Thread Selva Nair
Hi, On Tue, Oct 1, 2019 at 1:02 PM Antonio Quartulli wrote: > Hi Paolo, > > On 01/10/2019 14:06, Paolo Cerrito wrote: > > From: paolo > > On June 27th another patch with the same subject was sent by you to this > mailing list. Is this new patch any different? > > If so, it should bear a "v2" in

Re: [Openvpn-devel] [PATCH] Insert client connection data into PAM environment

2019-10-01 Thread Selva Nair
Hi, Its useful to set PAM_RHOSTS which will allow use of pam_access for access control etc. So feature ACK. I would like to see a more precise commit message header like: "Insert remote IP address into PAM environment" On Tue, Oct 1, 2019 at 8:25 AM Paolo Cerrito wrote: > From: paolo > > ---

Re: [Openvpn-devel] [PATCH] Insert client connection data into PAM environment

2019-10-01 Thread Antonio Quartulli
Hi Paolo, On 01/10/2019 14:06, Paolo Cerrito wrote: > From: paolo On June 27th another patch with the same subject was sent by you to this mailing list. Is this new patch any different? If so, it should bear a "v2" in the subject and the differences should be explicitly mentioned to ease the re

[Openvpn-devel] [PATCH] Insert client connection data into PAM environment

2019-10-01 Thread Paolo Cerrito
From: paolo --- src/plugins/auth-pam/auth-pam.c | 19 --- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/src/plugins/auth-pam/auth-pam.c b/src/plugins/auth-pam/auth-pam.c index 88b53204..9d8dfb95 100644 --- a/src/plugins/auth-pam/auth-pam.c +++ b/src/plugins/auth-

Re: [Openvpn-devel] [PATCH applied] Re: Implement a permanent session id in auth-token

2019-10-01 Thread David Sommerseth
On 01/10/2019 12:54, Gert Doering wrote: > > Not exactly sure why we need a workaround for an OpenVPN3 bug in 2.5, > though... when 2.5 comes close to release, there should no longer be > any buggy OpenVPN3 client around that mishandles username sending? > So maybe we want to take that part *ou

Re: [Openvpn-devel] [PATCH applied] Re: Sent indication that a session is expired to clients

2019-10-01 Thread David Sommerseth
On 01/10/2019 13:11, Gert Doering wrote: > > The patch itself looks like a very nice approach to the problem with > "how can we communicate authentication fail reasons to the client?" issue > that had a few (fairly intrusiv) patch sets flying around... someone > needs to go through the open patch

[Openvpn-devel] [PATCH applied] Re: Implement unit tests for auth-gen-token

2019-10-01 Thread Gert Doering
Your patch has been applied to the master branch. Did client side tests, see the unit tests pass on linux and freebsd... .. [ RUN ] auth_token_test_timeout [ OK ] auth_token_test_timeout [==] 8 test(s) run. [ PASSED ] 8 test(s). PASS: auth_token_testdriver The "Fox Crypto B.

[Openvpn-devel] [PATCH applied] Re: Improve the comments related to auth-token-hmac patches

2019-10-01 Thread Gert Doering
Acked-by: Gert Doering Not sure if it really enables anyone outside ovpn tech to understand the comment about OVPN3 any better, but at least the first hunk is easy to verify & correct :-) Your patch has been applied to the master branch. commit 48a4c81b91bb5978cf21213fe5a85b80962025ee Author: D

[Openvpn-devel] [PATCH applied] Re: auth-token: Fix compiler complaints with --disable-management

2019-10-01 Thread Gert Doering
Acked-by: Gert Doering Not tested, but looks reasonable. Your patch has been applied to the master branch. commit f706d00f7f0cbcf26d2f8e58a684889cf3b9cf7d Author: David Sommerseth Date: Sat Sep 28 00:45:35 2019 +0200 auth-token: Fix compiler complaints with --disable-management Si

[Openvpn-devel] [PATCH applied] Re: auth-token: Fix building with --disable-server

2019-10-01 Thread Gert Doering
Acked-by: Gert Doering "Does what it says on the lid" :-) Your patch has been applied to the master branch. commit c20434a8c718ed577b62d96200a6c30472edadd6 Author: David Sommerseth Date: Sat Sep 28 00:45:34 2019 +0200 auth-token: Fix building with --disable-server Signed-off-by: D

[Openvpn-devel] [PATCH applied] Re: Sent indication that a session is expired to clients

2019-10-01 Thread Gert Doering
Your patch has been applied to the master branch. This breaks --disable-server (again), but since David sent a patch to remedy this, I'm merging it nonetheless. I'll merge David's patch right away and push both together to avoid needless buildbot fails. The patch itself looks like a very nice ap

[Openvpn-devel] [PATCH applied] Re: Implement a permanent session id in auth-token

2019-10-01 Thread Gert Doering
Your patch has been applied to the master branch. Again, lightly tested with client side test runs. There is a typo in the man page change: -.B \-\-auth\-gen\-token [lifetime] +.B \-\-auth\-gen\-token [lifetime] [auth] this flag is called "external-auth" (the *text* correctly says so, and optio

[Openvpn-devel] [PATCH applied] Re: Rewrite auth-token-gen to be based on HMAC based tokens

2019-10-01 Thread Gert Doering
Your patch has been applied to the master branch. I have lightly tested client-side builds and t_client runs (and I'm aware that half our buildbot cloud is down, but I do not expect any system- dependent breakages - compiler flags, possibly, but nothing like "on OpenBSD, will not work"). There's