OpenVPN / OpenVPN/openvpn

override-username not applied to consecutively called plugins

Open
#770 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Hi,

Probably not exactly a bug, but at least for me undesired behavior: I was playing with the soon-to-be-introduced --override-username option, setting it from within a plugin using a temporary client_config_file at the OPENVPN_PLUGIN_CLIENT_CONNECT step.

What I noticed is that consecutively called plugins are not called with the updated username, but still get the "original" username, even when registered for the OPENVPN_PLUGIN_CLIENT_CONNECT_V2 step and being registered after the username-overriding plugin.

In the context of the plugin, which implements external webauth via OIDC, the original username is basically an empty string and thereby not helpful for that "other" plugin that just records (dis-)connection events.

To Reproduce
Register two plugins and have the first pass the override-username option using a client_config_file. The second plugin will receive the original username in its envp-array

Expected behavior
The second plugin receives the updated username on its OPENVPN_PLUGIN_CLIENT_CONNECT_V2 call.

Version information

  • OS: Ubuntu 24.04
  • OpenVPN version: v2.7_alpha2/master

Additional Context
I managed get the desired behavior by having openvpn call the override_locked_username function earlier, within multi_client_connect_post:

diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index a760e071..1cda7188 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -1679,6 +1679,10 @@ multi_client_connect_post(struct multi_context *m,
          */
         multi_select_virtual_addr(m, mi);
         multi_set_virtual_addr_env(mi);
+        if (mi->context.options.override_username)
+        {
+            override_locked_username(mi);
+        }
     }
 }

It does work for my scenario, however, I'm not quite sure if I'm missing some important problem with that approach and would be happy about input in that regard.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/openvpn/multi.c at multi_client_connect_post and trace where override_locked_username and OPENVPN_PLUGIN_CLIENT_CONNECT_V2 are handled. Reproduce the two-plugin setup described in the issue, then verify that the second plugin receives the updated username in its envp-array after the first applies client_config_file. No specific test file is mentioned.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.