Attention is currently required from: Arne Schwabe.
Hello Arne Schwabe,
I'd like you to do a code review.
Please visit
https://gerrit.openvpn.net/c/openvpn/+/2148?usp=email
to review the following change.
Change subject: Implement multiline responses for pkcs11-id commands
......................................................................
Implement multiline responses for pkcs11-id commands
Responses to the management interface commands pkcs11-id-[get|count] did
not follow the standard syntax, but instead looked like notifications.
Introduce a new management interface version to rewrite both commands to
conform to the common multiline + END syntax. At the same time it is now
possible to query all PKCS#11 ids using "all" or a range from "start" to
"end" - 1. Failures to retrieve an id will return a partial response
terminated by an "ERROR" message including the erroneous index.
The response format was changed to comma separated (index,id,cert_blob)
which is easier to parse.
Change-Id: I09e55085cde6dbc0040e111a42128527d59832b8
Signed-off-by: Marvin Wunderlich <[email protected]>
---
M doc/management-notes.txt
M src/openvpn/manage.c
M src/openvpn/manage.h
3 files changed, 167 insertions(+), 30 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/48/2148/1
diff --git a/doc/management-notes.txt b/doc/management-notes.txt
index 6c798c0..299cd29 100644
--- a/doc/management-notes.txt
+++ b/doc/management-notes.txt
@@ -619,21 +619,89 @@
Retrieve available number of certificates.
-Example:
+Example for client version < 7:
pkcs11-id-count
>PKCS11ID-COUNT:5
+Example for client version >= 7:
+
+ pkcs11-id-count
+ 5
+ END
+
COMMAND -- pkcs11-id-get (OpenVPN 2.1 or higher)
-------------------------------------------------
+ pkcs11-id-get <index>
+
Retrieve certificate by index, the ID string should be provided
as PKCS#11 identity, the blob is a base 64 encoded certificate.
-Example:
+Example for client version < 7:
pkcs11-id-get 1
- PKCS11ID-ENTRY:'1', ID:'<snip>', BLOB:'<snip>'
+ >PKCS11ID-ENTRY:'1', ID:'<snip>', BLOB:'<snip>'
+
+For client versions >= 7 it is also possible to retrieve multiple
+PKCS#11 identities from index <start> to <end>-1. Alternatively
+<start> = "all" retrieves all PKCS#11 identities. A comma separated
+list including index, PKCS#11 id and the base 64 encoded certificate
+will be returned. If any id retrieval results in a failure, the returned
+list will be partial and terminated by "ERROR: .." instead of "END".
+The "ERROR" message will include the index of failure.
+
+ pkcs11-id-get <index>
+ pkcs11-id-get <start> <end>
+ pkcs11-id-get all
+
+Example 1:
+
+ Management interface client sends:
+
+ pkcs11-id-get 1
+
+ OpenVPN daemon responds with:
+
+ 1,<id>,<blob>
+ END
+
+Example 2:
+
+ Management interface client sends:
+
+ pkcs11-id-get 1 3
+
+ OpenVPN daemon responds with:
+
+ 1,<id_a>,<blob_a>
+ 2,<id_b>,<blob_b>
+ END
+
+Example 3:
+
+ Management interface client sends:
+
+ pkcs11-id-get all
+
+ OpenVPN daemon with 3 PKCS#11 identities responds with:
+
+ 0,<id_a>,<blob_a>
+ 1,<id_b>,<blob_b>
+ 2,<id_c>,<blob_c>
+ END
+
+Example 4:
+
+ Management interface client sends:
+
+ pkcs11-id-get all
+
+ OpenVPN daemon with 3 PKCS#11 identities fails to retrieve index 1
+
+ 0,<id_a>,<blob_a>
+ ERROR: Failed to load PKCS#11 id at index: 1
+
COMMAND -- client-auth (OpenVPN 2.1 or higher)
-----------------------------------------------
diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index 58f63e6..f33e881 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -74,6 +74,7 @@
MCV_USERNAME_ONLY = 4,
MCV_MULTILINE_PASSWORD = 5,
MCV_PREFERRED_USERNAME = 6,
+ MCV_MULTILINE_PKCS11_RESPONSE = 7,
};
struct management *management; /* GLOBAL */
@@ -120,7 +121,8 @@
msg(M_CLIENT, "pid : Show process ID of the current
OpenVPN process.");
#ifdef ENABLE_PKCS11
msg(M_CLIENT, "pkcs11-id-count : Get number of available PKCS#11
identities.");
- msg(M_CLIENT, "pkcs11-id-get index : Get PKCS#11 identity at index.");
+ msg(M_CLIENT, "pkcs11-id-get i|all [j] : Get PKCS#11 identity at index =
i.");
+ msg(M_CLIENT, " For version >= 7 also i to j-1 or
all.");
#endif
msg(M_CLIENT, "client-auth CID KID : Authenticate client-id/key-id
CID/KID (MULTILINE)");
msg(M_CLIENT, "client-auth-nt CID KID : Authenticate client-id/key-id
CID/KID");
@@ -889,31 +891,104 @@
man_command_unsupported("cr-repsonse");
}
}
+
+static unsigned int
+parse_range_start(const char *p1)
+{
+ if (streq(p1, "all"))
+ {
+ return 0;
+ }
+ return (unsigned int)atoi(p1);
+}
+
+static unsigned int
+parse_range_end(const char *p1, const char *p2, unsigned int max)
+{
+ unsigned int from = (unsigned int)atoi(p1);
+ unsigned int to = p2 ? (unsigned int)atoi(p2) : from + 1;
+
+ if (streq(p1, "all"))
+ {
+ to = max;
+ }
+
+ return min_uint(to, max);
+}
+
#ifdef ENABLE_PKCS11
static void
man_pkcs11_id_count(const struct management *man)
{
- msg(M_CLIENT, ">PKCS11ID-COUNT:%d", pkcs11_management_id_count());
-}
-
-static void
-man_pkcs11_id_get(struct management *man, const int index)
-{
- char *id = NULL;
- char *base64 = NULL;
-
- if (pkcs11_management_id_get(index, &id, &base64))
+ if (man->connection.client_version >= MCV_MULTILINE_PKCS11_RESPONSE)
{
- msg(M_CLIENT, ">PKCS11ID-ENTRY:'%d', ID:'%s', BLOB:'%s'", index, id,
base64);
+ msg(M_CLIENT, "%d", pkcs11_management_id_count());
+ msg(M_CLIENT, "END");
}
else
{
- msg(M_CLIENT, ">PKCS11ID-ENTRY:'%d'", index);
+ msg(M_CLIENT, ">PKCS11ID-COUNT:%d", pkcs11_management_id_count());
+ }
+}
+
+static void
+man_pkcs11_id_get(struct management *man, const char *p1, const char *p2)
+{
+ ASSERT(p1);
+
+ if ((streq(p1, "all") || p2 != NULL) && man->connection.client_version <
MCV_MULTILINE_PKCS11_RESPONSE)
+ {
+ msg(M_CLIENT, "ERROR: Listing multiple ids is only supported for
version >= %d", MCV_MULTILINE_PKCS11_RESPONSE);
+ return;
}
- free(id);
- free(base64);
+ if (man->connection.client_version >= MCV_MULTILINE_PKCS11_RESPONSE)
+ {
+ unsigned int from = parse_range_start(p1);
+ unsigned int to = parse_range_end(p1, p2,
pkcs11_management_id_count());
+
+ bool error = false;
+ for (unsigned int i = from; i < to && !error; i++)
+ {
+ char *id = NULL;
+ char *base64 = NULL;
+
+ if (pkcs11_management_id_get(i, &id, &base64))
+ {
+ msg(M_CLIENT, "%u,%s,%s", i, id, base64);
+ }
+ else
+ {
+ error = true;
+ msg(M_CLIENT, "ERROR: Failed to load PKCS#11 id at index: %u",
i);
+ }
+ free(id);
+ free(base64);
+ }
+ if (!error)
+ {
+ msg(M_CLIENT, "END");
+ }
+ }
+ else
+ {
+ int index = atoi(p1);
+
+ char *id = NULL;
+ char *base64 = NULL;
+
+ if (pkcs11_management_id_get(index, &id, &base64))
+ {
+ msg(M_CLIENT, ">PKCS11ID-ENTRY:'%d', ID:'%s', BLOB:'%s'", index,
id, base64);
+ }
+ else
+ {
+ msg(M_CLIENT, ">PKCS11ID-ENTRY:'%d'", index);
+ }
+ free(id);
+ free(base64);
+ }
}
#endif /* ifdef ENABLE_PKCS11 */
@@ -942,16 +1017,10 @@
{
unsigned int count =
(*man->persist.callback.remote_entry_count)(man->persist.callback.arg);
- unsigned int from = (unsigned int)atoi(p1);
- unsigned int to = p2 ? (unsigned int)atoi(p2) : from + 1;
+ unsigned int from = parse_range_start(p1);
+ unsigned int to = parse_range_end(p1, p2, count);
- if (!strcmp(p1, "all"))
- {
- from = 0;
- to = count;
- }
-
- for (unsigned int i = from; i < min_uint(to, count); i++)
+ for (unsigned int i = from; i < to; i++)
{
char *remote = NULL;
bool res =
@@ -1838,9 +1907,9 @@
}
else if (streq(p[0], "pkcs11-id-get"))
{
- if (man_need(p, 1, 0))
+ if (man_need(p, 1, MN_AT_LEAST))
{
- man_pkcs11_id_get(man, atoi(p[1]));
+ man_pkcs11_id_get(man, p[1], p[2]);
}
}
#endif
diff --git a/src/openvpn/manage.h b/src/openvpn/manage.h
index 82c0caa..1d2aff1 100644
--- a/src/openvpn/manage.h
+++ b/src/openvpn/manage.h
@@ -50,7 +50,7 @@
#include "socket_util.h"
#include "mroute.h"
-#define MANAGEMENT_VERSION 6
+#define MANAGEMENT_VERSION 7
#define MANAGEMENT_N_PASSWORD_RETRIES 3
#define MANAGEMENT_LOG_HISTORY_INITIAL_SIZE 100
#define MANAGEMENT_ECHO_BUFFER_SIZE 100
--
To view, visit https://gerrit.openvpn.net/c/openvpn/+/2148?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I09e55085cde6dbc0040e111a42128527d59832b8
Gerrit-Change-Number: 2148
Gerrit-PatchSet: 1
Gerrit-Owner: Name of user not set #1000067
Gerrit-Reviewer: Arne Schwabe <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: Arne Schwabe <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
