Re: [Openvpn-devel] OpenVPN Client 2FA problem with Backslash

2022-03-10 Thread Selva Nair
Hi, On Thu, Mar 10, 2022 at 4:23 PM Gert Doering wrote: > Hi, > > On Thu, Mar 10, 2022 at 12:51:51PM -0500, Selva Nair wrote: > > I missed this follow up on the devel list. Please see my reply to > > openvpn-users. If @ doesnt work there is no easy fix short of patching > the > > GUI. > > We're

Re: [Openvpn-devel] OpenVPN Client 2FA problem with Backslash

2022-03-10 Thread Gert Doering
Hi, On Thu, Mar 10, 2022 at 12:51:51PM -0500, Selva Nair wrote: > I missed this follow up on the devel list. Please see my reply to > openvpn-users. If @ doesnt work there is no easy fix short of patching the > GUI. We're planning a 2.5.x release "some time next week" (partly prompted due to the

Re: [Openvpn-devel] [PATCH] Enable deferred auth for multiple plugins (RFC).

2022-03-10 Thread Pete Nelson
Hi Gert. On Thu, Mar 10, 2022 at 3:13 PM Gert Doering wrote: > Yes, your report triggered this work. I think I misunderstood the > original scenario (I thought it involved two plugins both going > "deferred"), but this patch introduces a "short circuit" approach > to plugin authentication

Re: [Openvpn-devel] OpenVPN Client 2FA problem with Backslash

2022-03-10 Thread Selva Nair
Hi, On Thu, Mar 10, 2022 at 9:15 AM Jakob Curdes wrote: > Hello all, > > I think I have found a bug in the OpenVPN Windows client , can you help me > to determine if this is true and how to proceed? > > We are trying to implement 2FA for several existing Firebox SSL VPNs > (which essentially

Re: [Openvpn-devel] OpenVPN Client 2FA problem with Backslash

2022-03-10 Thread Jakob Curdes
Hello list, hello Arne, Am 10.03.2022 um 16:32 schrieb Arne Schwabe: Am 10.03.22 um 15:14 schrieb Jakob Curdes: Thu Mar 10 10:35:32 2022 AUTH: Received control message: AUTH_FAILED,CRV1:R,E:1796:Yoirtuqeprtiqrew4==:*Type "p" to receive a push notification or type your one-time password*

Re: [Openvpn-devel] OpenVPN Client 2FA problem with Backslash

2022-03-10 Thread Arne Schwabe
Am 10.03.22 um 15:14 schrieb Jakob Curdes: Hello all, I think I have found a bug in the OpenVPN Windows client , can you help me to determine if this is true and how to proceed? We are trying to implement 2FA for several existing Firebox SSL VPNs (which essentially uses OpenVPN on server

Re: [Openvpn-devel] [PATCH] Enable deferred auth for multiple plugins (RFC).

2022-03-10 Thread Gert Doering
Hi, On Thu, Mar 10, 2022 at 01:57:01PM +, Pete Nelson wrote: > One of the behaviors that brought this to light was a user who had an LDAP > (non-deferred) plugin followed by a Duo MFA (deferred) plugin. He noted > that, even if the LDAP call returned failure, the Duo plugin was still >

[Openvpn-devel] OpenVPN Client 2FA problem with Backslash

2022-03-10 Thread Jakob Curdes
Hello all, I think I have found a bug in the OpenVPN Windows client , can you help me to determine if this is true and how to proceed? We are trying to implement 2FA for several existing Firebox SSL VPNs (which essentially uses OpenVPN on server and client side). The remote users all use

Re: [Openvpn-devel] [PATCH] Enable deferred auth for multiple plugins (RFC).

2022-03-10 Thread Pete Nelson
One of the behaviors that brought this to light was a user who had an LDAP (non-deferred) plugin followed by a Duo MFA (deferred) plugin. He noted that, even if the LDAP call returned failure, the Duo plugin was still called. That would generate a push notification to his phone even though the

[Openvpn-devel] [PATCH DCO]: FreeBSD DCO support

2022-03-10 Thread Kristof Provost via Openvpn-devel
Hi, Here's an updated version of the FreeBSD DCO patch. It addresses a few code style issues, moves the if_ovpn.h header into the tree and is rebased on top of the latest DCO branch version. Best regards, Kristof ___ Openvpn-devel mailing list

[Openvpn-devel] [PATCH] ovpn-dco: introduce FreeBSD data-channel offload support

2022-03-10 Thread Kristof Provost via Openvpn-devel
From: Kristof Provost Implement data-channel offload for FreeBSD. The implementation and flow is very similar to that of the Linux DCO support. Signed-off-by: Kristof Provost --- configure.ac | 6 +- src/openvpn/Makefile.am| 1 + src/openvpn/dco_freebsd.c |

[Openvpn-devel] [PATCH] Enable deferred auth for multiple plugins (RFC).

2022-03-10 Thread Gert Doering
Without this patch, OpenVPN behaviour if more than one plugin wants to do deferred user/password authentication not well-defined, as there is just one set of auth control files and a single plugin state. This patch changes "key state -> plugin_auth" from a single struct to an array of MAX_PLUGINS