From bfdac88f6ddaf4bf3204cc6f3591c4488fe958c2 Mon Sep 17 00:00:00 2001 From: Zhiqiang Wang Date: Thu, 25 Jul 2013 12:11:24 -0400 Subject: [PATCH] add openvpn username/password auth --- release/src/router/Makefile | 5 +- release/src/router/httpd/tomato.c | 6 ++ .../src/router/openvpn_plugin_auth_nvram/Makefile | 35 ++++++++ .../openvpn_plugin_auth_nvram.c | 99 ++++++++++++++++++++++ release/src/router/rc/vpn.c | 15 ++++ release/src/router/www/about.asp | 2 + release/src/router/www/vpn-server.asp | 89 ++++++++++++++++++- 7 files changed, 249 insertions(+), 2 deletions(-) create mode 100644 release/src/router/openvpn_plugin_auth_nvram/Makefile create mode 100644 release/src/router/openvpn_plugin_auth_nvram/openvpn_plugin_auth_nvram.c diff --git a/release/src/router/Makefile b/release/src/router/Makefile index bc192288c6..cb36dd296c 100644 --- a/release/src/router/Makefile +++ b/release/src/router/Makefile @@ -167,6 +167,7 @@ obj-$(TCONFIG_ZEBRA) += zebra # obj-$(TCONFIG_IPP2P) += ipp2p obj-$(TCONFIG_LZO) += lzo obj-$(TCONFIG_OPENVPN) += openvpn +obj-$(TCONFIG_OPENVPN) += openvpn_plugin_auth_nvram obj-$(TCONFIG_EMF) += emf obj-$(TCONFIG_EMF) += igs @@ -1606,7 +1607,7 @@ openvpn/.conf: openssl lzo CPPFLAGS="-I$(TOP)/lzo/include -I$(TOP)/openssl/include" \ $(CONFIGURE) --prefix= \ --with-crypto-library=openssl \ - --disable-debug --disable-plugins --enable-management --enable-small \ + --disable-debug --disable-plugin-auth-pam --disable-plugin-down-root --with-plugindir=/lib --enable-management --enable-small \ --disable-selinux --disable-socks --enable-password-save \ OPENSSL_SSL_CFLAGS="-I$(TOP)/openssl/include" \ OPENSSL_SSL_LIBS="-L$(TOP)/openssl -lssl" \ @@ -1625,6 +1626,8 @@ openvpn-install: openvpn $(STRIP) -s $(INSTALLDIR)/openvpn/usr/sbin/openvpn chmod 0500 $(INSTALLDIR)/openvpn/usr/sbin/openvpn +openvpn_plugin_auth_nvram:nvram + #shibby libcurl/stamp-h1: zlib openssl cd libcurl && CC=$(CC) STRIP='mipsel-uclibc-strip' \ diff --git a/release/src/router/httpd/tomato.c b/release/src/router/httpd/tomato.c index 923957f67b..c2886de430 100644 --- a/release/src/router/httpd/tomato.c +++ b/release/src/router/httpd/tomato.c @@ -1320,6 +1320,9 @@ static const nvset_t nvset_list[] = { { "vpn_server1_ccd_val", V_NONE }, { "vpn_server1_pdns", V_01 }, { "vpn_server1_rgw", V_01 }, + { "vpn_server1_userpass", V_01 }, + { "vpn_server1_nocert", V_01 }, + { "vpn_server1_users_val",V_NONE }, { "vpn_server1_custom", V_NONE }, { "vpn_server1_static", V_NONE }, { "vpn_server1_ca", V_NONE }, @@ -1346,6 +1349,9 @@ static const nvset_t nvset_list[] = { { "vpn_server2_plan", V_01 }, { "vpn_server2_pdns", V_01 }, { "vpn_server2_rgw", V_01 }, + { "vpn_server2_userpass", V_01 }, + { "vpn_server2_nocert", V_01 }, + { "vpn_server2_users_val",V_NONE }, { "vpn_server2_custom", V_NONE }, { "vpn_server2_ccd", V_01 }, { "vpn_server2_c2c", V_01 }, diff --git a/release/src/router/openvpn_plugin_auth_nvram/Makefile b/release/src/router/openvpn_plugin_auth_nvram/Makefile new file mode 100644 index 0000000000..a3fb5b7617 --- /dev/null +++ b/release/src/router/openvpn_plugin_auth_nvram/Makefile @@ -0,0 +1,35 @@ +include ../common.mak + +CFLAGS = -Os -Wall $(EXTRACFLAGS) +CFLAGS += -I$(SRCBASE)/include -I$(TOP)/openvpn/include +LDFLAGS = -L$(TOP)/nvram -lnvram +OBJS = openvpn_plugin_auth_nvram.o + +all: openvpn_plugin_auth_nvram.so + +openvpn_plugin_auth_nvram.so: $(OBJS) + @echo " [] CC -o $@" + @$(CC) -shared $(LDFLAGS) -o $@ $(OBJS) $(LDFLAGS) + + $(SIZECHECK) + $(CPTMP) + +install: all + install -D openvpn_plugin_auth_nvram.so $(INSTALLDIR)/lib/openvpn_plugin_auth_nvram.so + $(STRIP) $(INSTALLDIR)/lib/openvpn_plugin_auth_nvram.so + chmod 0500 $(INSTALLDIR)/lib/openvpn_plugin_auth_nvram.so + +clean: + rm -f openvpn_plugin_auth_nvram.so .*.depend *.o + +%.o: %.c .%.depend + @echo " [ntpc] CC $@" + @$(CC) $(CFLAGS) -c $< + +.depend: $(OBJS:%.o=%.c) + @$(CC) $(CFLAGS) -M $^ > .depend + +.%.depend: %.c + @$(CC) $(CFLAGS) -M $< > $@ + +-include $(OBJS:%.o=.%.depend) diff --git a/release/src/router/openvpn_plugin_auth_nvram/openvpn_plugin_auth_nvram.c b/release/src/router/openvpn_plugin_auth_nvram/openvpn_plugin_auth_nvram.c new file mode 100644 index 0000000000..360c80e870 --- /dev/null +++ b/release/src/router/openvpn_plugin_auth_nvram/openvpn_plugin_auth_nvram.c @@ -0,0 +1,99 @@ +#include +#include +#include +#include +#include +#define NVRAM_KEY_MAX_LEN 32 + +struct nvram_context { + char nvarm_key[NVRAM_KEY_MAX_LEN + 1]; +}; +static const char *get_env(const char *key, const char *env[]) { + int i; + + if (!env) + return (NULL); + + for (i = 0; env[i]; i++) { + int keylen = strlen(key); + + if (keylen > strlen(env[i])) + continue; + + if (!strncmp(key, env[i], keylen)) { + const char *p = env[i] + keylen; + if (*p == '=') + return (p + 1); + } + } + + return (NULL); +} +/** +find password ptr of username. +*/ +static int nv_verify_pass(const char *nv_key,const char *username,const char *password) { + int i; + if(!nv_key || !username || !password) + return 0; + const char *nv = nvram_safe_get(nv_key); + const char *start = nv; + int to_verify_len = strlen(username) + strlen(password) + 3; // 1'){ + if(to_verify_len == nv + i - start && !memcmp(to_verify,start,to_verify_len)){ + free(to_verify); + return 1; + } + start = nv + i + 1; + } + else if(nv[i] == 0){ + free(to_verify); + return 0; + } + } + free(to_verify); + return 0; +} +int string_array_len (const char *array[]) +{ + int i = 0; + if (array) + { + while (array[i]) + ++i; + } + return i; +} +OPENVPN_EXPORT openvpn_plugin_handle_t openvpn_plugin_open_v1 (unsigned int *type_mask, const char *argv[], const char *envp[]) { + struct nvram_context *context = calloc(1,sizeof(struct nvram_context)); + *type_mask = OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY); + if (string_array_len (argv) < 2) { + fprintf (stderr, "AUTH-NVRAM: need NVRAM KEY parameter\n"); + goto error; + } + else { + strncpy(context->nvarm_key,argv[1],NVRAM_KEY_MAX_LEN); + } + return (openvpn_plugin_handle_t) context; + error: + if(context) free(context); + return NULL; +} +OPENVPN_EXPORT void openvpn_plugin_close_v1(openvpn_plugin_handle_t handle) +{ + free (handle); +} +OPENVPN_EXPORT int openvpn_plugin_func_v1 (openvpn_plugin_handle_t handle, const int type, const char *argv[], const char *envp[]) { + struct nvram_context *context = (struct nvram_context *)handle; + if (type == OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY){ + const char *username = get_env ("username", envp); + const char *password = get_env ("password", envp); + if(username && password && nv_verify_pass(context->nvarm_key,username,password)){ + return OPENVPN_PLUGIN_FUNC_SUCCESS; + } + } + return OPENVPN_PLUGIN_FUNC_ERROR; +} diff --git a/release/src/router/rc/vpn.c b/release/src/router/rc/vpn.c index bd4104128e..dddfb5a4fe 100644 --- a/release/src/router/rc/vpn.c +++ b/release/src/router/rc/vpn.c @@ -520,6 +520,7 @@ void start_vpnserver(int serverNum) long int nvl; int pid; + int current_security_level = 1; sprintf(&buffer[0], "vpnserver%d", serverNum); if (getpid() != 1) { start_service(&buffer[0]); @@ -764,6 +765,20 @@ void start_vpnserver(int serverNum) vpnlog(VPN_LOG_EXTRA,"CCD processing complete"); } + sprintf(&buffer[0], "vpn_server%d_userpass", serverNum); + if ( nvram_get_int(&buffer[0]) ) + { + fprintf(fp, "plugin /lib/openvpn_plugin_auth_nvram.so vpn_server%d_users_val\n",serverNum); + if(current_security_level < 2){ + fprintf(fp, "script-security 2\n"); + current_security_level = 2; + } + fprintf(fp, "username-as-common-name\n"); + sprintf(&buffer[0], "vpn_server%d_nocert", serverNum); + if ( nvram_get_int(&buffer[0]) ) + fprintf(fp, "client-cert-not-required\n"); + } + sprintf(&buffer[0], "vpn_server%d_pdns", serverNum); if ( nvram_get_int(&buffer[0]) ) { diff --git a/release/src/router/www/about.asp b/release/src/router/www/about.asp index a6e560f4ea..b8fcc8f76a 100644 --- a/release/src/router/www/about.asp +++ b/release/src/router/www/about.asp @@ -111,6 +111,8 @@ Copyright (C) 2010 Keith Moyer,
tomatovpn@keithmoyer.com

+"TomatoEgg" Features:
+- Openvpn username/password verify feature and configure GUI.
"Shibby" features:
diff --git a/release/src/router/www/vpn-server.asp b/release/src/router/www/vpn-server.asp index 8c3e2ac398..4803a9bd27 100644 --- a/release/src/router/www/vpn-server.asp +++ b/release/src/router/www/vpn-server.asp @@ -20,18 +20,24 @@