OpenVPN / OpenVPN/openvpn

client doesn't sent auth-token if auth-user-pass is not defined

Open
#296 20 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.6k
Forks
3.4k
No merged PRs in 30d

Description

IMPORTANT NOTE
Bugs about OpenVPN Access Server, OpenVPN Connect or any other product by OpenVPN Inc. should be directly reported to OpenVPN Inc. at https://support.openvpn.net

Describe the bug
I have a OpenVPN server that uses client certificates and MFA through Web Browser.

Our policies allows to cache the MFA for 24h. If a OpenVPN client reconnects to the server with an valid auth-token, the MFA can skipped.

We are using deferred authentication in combination with OPENURL to ask for Username/Password. Thats why auth-user-pass-optional is configured and the client doesn't have a auth-user-pass directive.

Our POC, it works since #261 fine. But re-authentication happens each 120 seconds. If auth-user-pass is defined on client, the auth-token based re-authentication works fine.

To Reproduce

reneg-sec 120
script-security 3
# auth-user-pass-verify.sh is a script that initiate the deferred authentication method
auth-user-pass-verify "auth-user-pass-verify.sh" via-file
auth-user-pass-optional
auth-gen-token

Expected behavior
On TLS, the client should sent a auth-token and the server should bypass the auth through auth-user-pass-verify. (same behavior as auth-user-pass is defined on client)

Version information (please complete the following information):
Server

  • OS: Ubuntu 22.04
  • OpenVPN version: 2.6.1 [git:release/2.6/e950ca1b9fca58e9]
  • Repeat for peer if relevant

Client

  • OS: Windows 10
  • OpenVPN version: 2.6.1

Additional context

Server Logs

Details 
tests-openvpn-1  | 2023-03-23 20:47:34 Note: --cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
tests-openvpn-1  | 2023-03-23 20:47:34 Note: Kernel support for ovpn-dco missing, disabling data channel offload.
tests-openvpn-1  | 2023-03-23 20:47:34 OpenVPN 2.6.1 [git:release/2.6/e950ca1b9fca58e9] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO] built on Mar 23 2023
tests-openvpn-1  | 2023-03-23 20:47:34 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
tests-openvpn-1  | 2023-03-23 20:47:34 DCO version: N/A
tests-openvpn-1  | 2023-03-23 20:47:34 net_route_v4_best_gw query: dst 0.0.0.0
tests-openvpn-1  | 2023-03-23 20:47:34 net_route_v4_best_gw result: via 172.19.0.1 dev eth0
tests-openvpn-1  | 2023-03-23 20:47:34 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
tests-openvpn-1  | 2023-03-23 20:47:34 Using random OpenVPN auth-token server key.
tests-openvpn-1  | 2023-03-23 20:47:34 TUN/TAP device tun0 opened
tests-openvpn-1  | 2023-03-23 20:47:34 net_iface_mtu_set: mtu 1500 for tun0
tests-openvpn-1  | 2023-03-23 20:47:34 net_iface_up: set tun0 up
tests-openvpn-1  | 2023-03-23 20:47:34 net_addr_v4_add: 100.64.0.1/24 dev tun0
tests-openvpn-1  | 2023-03-23 20:47:34 Could not determine IPv4/IPv6 protocol. Using AF_INET
tests-openvpn-1  | 2023-03-23 20:47:34 Socket Buffers: R=[212992->212992] S=[212992->212992]
tests-openvpn-1  | 2023-03-23 20:47:34 UDPv4 link local (bound): [AF_INET][undef]:1194
tests-openvpn-1  | 2023-03-23 20:47:34 UDPv4 link remote: [AF_UNSPEC]
tests-openvpn-1  | 2023-03-23 20:47:34 UID set to nobody
tests-openvpn-1  | 2023-03-23 20:47:34 GID set to nogroup
tests-openvpn-1  | 2023-03-23 20:47:34 Capabilities retained: CAP_NET_ADMIN
tests-openvpn-1  | 2023-03-23 20:47:34 MULTI: multi_init called, r=256 v=256
tests-openvpn-1  | 2023-03-23 20:47:34 IFCONFIG POOL IPv4: base=100.64.0.2 size=253
tests-openvpn-1  | 2023-03-23 20:47:34 Initialization Sequence Completed
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 VERIFY OK: depth=1, CN=Easy-RSA CA
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 VERIFY OK: depth=0, CN=user@example.com
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_VER=2.6.1
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_PLAT=win
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_TCPNL=1
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_MTU=1600
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_NCP=2
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_PROTO=990
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_LZO_STUB=1
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_COMP_STUB=1
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_COMP_STUBv2=1
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_GUI_VER=OpenVPN_GUI_11
tests-openvpn-1  | 2023-03-23 20:47:35 172.19.0.1:33897 peer info: IV_SSO=openurl,webauth,crtext
tests-openvpn-1  | 2023-03-23 20:47:36 172.19.0.1:33897 SENT CONTROL [user@example.com]: 'AUTH_PENDING,timeout 60' (status=1)
tests-openvpn-1  | 2023-03-23 20:47:36 172.19.0.1:33897 SENT CONTROL [user@example.com]: 'INFO_PRE,OPEN_URL:https://jkroepke.github.io/openvpn-auth-azure-ad/?code=CUAJGVDXW' (status=1)
tests-openvpn-1  | 2023-03-23 20:47:36 172.19.0.1:33897 TLS: Username/Password authentication deferred for username '' 
tests-openvpn-1  | 2023-03-23 20:47:36 172.19.0.1:33897 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
tests-openvpn-1  | 2023-03-23 20:47:36 172.19.0.1:33897 TLS: tls_multi_process: initial untrusted session promoted to semi-trusted
tests-openvpn-1  | 2023-03-23 20:47:36 172.19.0.1:33897 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 256 bit ED25519, signature: ED25519
tests-openvpn-1  | 2023-03-23 20:47:36 172.19.0.1:33897 [user@example.com] Peer Connection Initiated with [AF_INET]172.19.0.1:33897
tests-openvpn-1  | 2023-03-23 20:47:37 172.19.0.1:33897 PUSH: Received control message: 'PUSH_REQUEST'
tests-openvpn-1  | 2023-03-23 20:47:42 172.19.0.1:33897 PUSH: Received control message: 'PUSH_REQUEST'
tests-openvpn-1  | 2023-03-23 20:47:47 172.19.0.1:33897 PUSH: Received control message: 'PUSH_REQUEST'
tests-openvpn-1  | 2023-03-23 20:47:53 172.19.0.1:33897 PUSH: Received control message: 'PUSH_REQUEST'
tests-openvpn-1  | 2023-03-23 20:47:53 user@example.com/172.19.0.1:33897 MULTI_sva: pool returned IPv4=100.64.0.2, IPv6=(Not enabled)
tests-openvpn-1  | 2023-03-23 20:47:53 user@example.com/172.19.0.1:33897 MULTI: Learn: 100.64.0.2 -> user@example.com/172.19.0.1:33897
tests-openvpn-1  | 2023-03-23 20:47:53 user@example.com/172.19.0.1:33897 MULTI: primary virtual IP for user@example.com/172.19.0.1:33897: 100.64.0.2
tests-openvpn-1  | 2023-03-23 20:47:53 user@example.com/172.19.0.1:33897 SENT CONTROL [user@example.com]: 'PUSH_REPLY,route-gateway 100.64.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 100.64.0.2 255.255.255.0,peer-id 0,auth-tokenSESS_ID,cipher AES-256-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt,tun-mtu 1500' (status=1)
tests-openvpn-1  | 2023-03-23 20:47:54 user@example.com/172.19.0.1:33897 Data Channel: cipher 'AES-256-GCM', peer-id: 0
tests-openvpn-1  | 2023-03-23 20:47:54 user@example.com/172.19.0.1:33897 Timers: ping 10, ping-restart 120
tests-openvpn-1  | 2023-03-23 20:47:54 user@example.com/172.19.0.1:33897 Protocol options: explicit-exit-notify 1, protocol-flags cc-exit tls-ekm dyn-tls-crypt
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 TLS: soft reset sec=113/113 bytes=41901/-1 pkts=311/0
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 VERIFY OK: depth=1, CN=Easy-RSA CA
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 VERIFY OK: depth=0, CN=user@example.com
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_VER=2.6.1
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_PLAT=win
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_TCPNL=1
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_MTU=1600
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_NCP=2
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_PROTO=990
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_LZO_STUB=1
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_COMP_STUB=1
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_COMP_STUBv2=1
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_GUI_VER=OpenVPN_GUI_11
tests-openvpn-1  | 2023-03-23 20:49:29 user@example.com/172.19.0.1:33897 peer info: IV_SSO=openurl,webauth,crtext
tests-openvpn-1  | 2023-03-23 20:49:30 user@example.com/172.19.0.1:33897 SENT CONTROL [user@example.com]: 'AUTH_PENDING,timeout 60' (status=1)
tests-openvpn-1  | 2023-03-23 20:49:30 user@example.com/172.19.0.1:33897 SENT CONTROL [user@example.com]: 'INFO_PRE,OPEN_URL:https://jkroepke.github.io/openvpn-auth-azure-ad/?code=CYP6RVF5E' (status=1)
tests-openvpn-1  | 2023-03-23 20:49:30 user@example.com/172.19.0.1:33897 TLS: Username/Password authentication deferred for username '' 
tests-openvpn-1  | 2023-03-23 20:49:30 user@example.com/172.19.0.1:33897 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 256 bit ED25519, signature: ED25519

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the supplied configuration with auth-user-pass-optional and auth-gen-token, then compare the TLS re-authentication path with a client that defines auth-user-pass. Done means the client sends the auth-token during renegotiation and the server bypasses deferred auth-user-pass-verify as described.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
authentication, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.