Re-read auth-user-pass file on (re)connect if required

Fixes trac #225 ('--auth-user-pass FILE' and '--auth-nocache' problem).

This patch is based on the changes suggested by ye_olde_iron in the trac
ticket.  Also added a note to the manpage to inform people to use
absolute paths when combining --auth-user-pass file and --auth-nocache.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1432386145-15045-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9717
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit ac1cb5bfbb9e09e79fd737bc57999d968d77c5ad)

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index f9e7a0b1a36f547a92e676293b28db9f9d23f0ae..56e7e80bc249d509f1793c327ac0b8ba4726f672 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -4753,6 +4753,9 @@ when OpenVPN needs a username/password, it will prompt for input
 from stdin, which may be multiple times during the duration of an
 OpenVPN session.
 
+When using \-\-auth\-nocache in combination with a user/password file
+and \-\-chroot or \-\-daemon, make sure to use an absolute path.
+
 This directive does not affect the
 .B \-\-http\-proxy
 username/password.  It is always cached.

diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index ce0a865032d02baea1d987cdc7c7ef8fe4a27fa1..1bddd187fff5adecd3e2e80a4a929798ff0738a3 100644 (file)
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -2276,6 +2276,7 @@ do_init_crypto_tls (struct context *c, const unsigned int flags)
   to.tmp_dir = options->tmp_dir;
   if (options->ccd_exclusive)
     to.client_config_dir_exclusive = options->client_config_dir;
+  to.auth_user_pass_file = options->auth_user_pass_file;
 #endif
 
 #ifdef ENABLE_X509_TRACK

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 423aedb038fc0705175098b18969185ea4d7e45b..a17c7382d778a14c6b439b0f4e3fd16dcfa0a293 100644 (file)
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1905,9 +1905,9 @@ key_method_2_write (struct buffer *buf, struct tls_session *session)
   if (auth_user_pass_enabled)
     {
 #ifdef ENABLE_CLIENT_CR
-      auth_user_pass_setup (NULL, session->opt->sci);
+      auth_user_pass_setup (session->opt->auth_user_pass_file, session->opt->sci);
 #else
-      auth_user_pass_setup (NULL, NULL);
+      auth_user_pass_setup (session->opt->auth_user_pass_file, NULL);
 #endif
       if (!write_string (buf, auth_user_pass.username, -1))
        goto error;

diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index eb09983c3841e89158f97948fa53bb9e6ec590cf..449172d27c230cd75405dd4b7ed2800ad1cf2716 100644 (file)
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -277,6 +277,7 @@ struct tls_options
   const char *auth_user_pass_verify_script;
   bool auth_user_pass_verify_script_via_file;
   const char *tmp_dir;
+  const char *auth_user_pass_file;
 
   /* use the client-config-dir as a positive authenticator */
   const char *client_config_dir_exclusive;