From: Selva Nair Date: Tue, 7 Sep 2021 22:36:14 +0000 (-0400) Subject: Allow skipping multple remotes via management interface X-Git-Tag: v2.6_rc1~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=42bfb5b03031de7b46a82bdec4f03dbaa1fc6ecb;p=thirdparty%2Fopenvpn.git Allow skipping multple remotes via management interface The mamangement command "remote SKIP" is extended with an optional parameter 'count' > 0. If count is greater than number of connection entries (len), count % len is used. On going past the index of the last connection entry, counting is restarted from the first connection entry. Without this, use of management-query-remote from a UI is virtually impractical except when there are only a handful of remote entries. Skipping the entries one by one takes a long time when there are many entries to be skipped (~ 1 second per entry). Use of "remote MOD" is not an option as change of protocol is not supported. Management clients can determine the availability of this feature by checking that the management interface version is > 3. Older versions will ignore the count parameter and behave identically to using count = 1. Signed-off-by: Selva Nair Acked-by: Arne Schwabe Message-Id: <20210907223614.8574-1-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22817.html Signed-off-by: Gert Doering (cherry picked from commit ec5ffe35a394c44b1ea25b7c10dab7da7d792ef2) --- diff --git a/doc/management-notes.txt b/doc/management-notes.txt index 60d46d64d..6daa811af 100644 --- a/doc/management-notes.txt +++ b/doc/management-notes.txt @@ -877,6 +877,13 @@ use this command: remote SKIP +Starting OpenVPN version 2.6 (management version > 3), skip +multiple remotes using: + + remote SKIP n + +where n > 0 is the number of remotes to skip. + COMMAND -- proxy (OpenVPN 2.3 or higher) -------------------------------------------- diff --git a/src/openvpn/init.c b/src/openvpn/init.c index f63422ffc..2e95256cd 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -389,6 +389,7 @@ management_callback_remote_cmd(void *arg, const char **p) { flags = CE_MAN_QUERY_REMOTE_SKIP; ret = true; + c->options.ce_advance_count = (p[2]) ? atoi(p[2]) : 1; } else if (!strcmp(p[1], "MOD") && p[2] && p[3]) { @@ -563,18 +564,28 @@ next_connection_entry(struct context *c) c->c1.link_socket_addr.remote_list; } + int advance_count = 1; + + /* If previous connection entry was skipped by management client + * with a count to advance by, apply it. + */ + if (c->options.ce_advance_count > 0) + { + advance_count = c->options.ce_advance_count; + } + /* * Increase the number of connection attempts * If this is connect-retry-max * size(l) * OpenVPN will quit */ - c->options.unsuccessful_attempts++; + c->options.unsuccessful_attempts += advance_count; + l->current += advance_count; - if (++l->current >= l->len) + if (l->current >= l->len) { - - l->current = 0; + l->current %= l->len; if (++n_cycles >= 2) { msg(M_FATAL, "No usable connection profiles are present"); @@ -583,6 +594,7 @@ next_connection_entry(struct context *c) } } + c->options.ce_advance_count = 1; ce = l->array[l->current]; if (ce->flags & CE_DISABLED) diff --git a/src/openvpn/options.h b/src/openvpn/options.h index 04cc2e5c1..fec1eace5 100644 --- a/src/openvpn/options.h +++ b/src/openvpn/options.h @@ -285,6 +285,8 @@ struct options bool advance_next_remote; /* Counts the number of unsuccessful connection attempts */ unsigned int unsuccessful_attempts; + /* count of connection entries to advance by when no_advance is not set */ + int ce_advance_count; /* the server can suggest a backoff time to the client, it * will still be capped by the max timeout between connections * (300s by default) */