From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4cX2by3Tknz32Vl for ; Wed, 24 Sep 2025 16:38:54 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R13" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4cX2by3C02z2xQd for ; Wed, 24 Sep 2025 16:38:54 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E8" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4cX2bx5WdYz241 for ; Wed, 24 Sep 2025 16:38:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1758731933; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=NVMVjN689y++6KgNQWgRho3YOHDNEaG7MGPdX5tcmvg=; b=CWTSqUjtS5U/5xsZ2ASi2uMpLXOiV22qDTdfVFe1wtDvL1yBNK/zlhxn1HB9uQOMRTWNoP KAi/fSdYbNVOLufoOoPmgYUPM8mT36zu8aiTswS+Y2Dnpo3Cnejbv+/OzDmi9NKOPfFo+S IW1qzHeSJfyUey59n5S1OW0msOFBjU3pFeCdvvCu2e+RE6fzjKmJJ0D19ERlSbipxiH9Fj hUTaQjR2gImBEduwhvJXz9ic1RYN2giCOBxb8MpfdD53HsAzQGiwmxWyg2wbRc2n6YloYI OyUiG8tlcS687VMipkJYCeJjGd1QUFzvMqo7z7BZ+cqQRq58mVF6tWK4mLLpYg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1758731933; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=NVMVjN689y++6KgNQWgRho3YOHDNEaG7MGPdX5tcmvg=; b=wewrp5fURO3mzGjb1dJzhVKGEU6SeLzFdB7bx+LjXN5zOjV1JaZEdlirCEELJhUChCl2Gp o5FEI77gtcJc+ODQ== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4cX2bw5zfWz2xNn; Wed, 24 Sep 2025 16:38:52 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 437e28f1268ba41bbbe6565cf5d097e8c640965d X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: af0a1f70aa0ed081b32c4f7589979a1cc19afb9a X-Git-Newrev: 437e28f1268ba41bbbe6565cf5d097e8c640965d Message-Id: <4cX2bw5zfWz2xNn@people01.haj.ipfire.org> Date: Wed, 24 Sep 2025 16:38:52 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 437e28f1268ba41bbbe6565cf5d097e8c640965d (commit) via e3e4d6fe8ab6b3e60157be3b2b08aa5fa2d05b67 (commit) via ab628fec98da87b210e14894343fda130099314d (commit) via 8018f729982f363bacbf53840ff0fd05e39938f8 (commit) from af0a1f70aa0ed081b32c4f7589979a1cc19afb9a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 437e28f1268ba41bbbe6565cf5d097e8c640965d Author: Michael Tremer Date: Wed Sep 24 18:37:59 2025 +0200 core199: Ship the OpenVPN Authenticator Signed-off-by: Michael Tremer commit e3e4d6fe8ab6b3e60157be3b2b08aa5fa2d05b67 Author: Michael Tremer Date: Wed Sep 24 18:36:12 2025 +0200 ovpnmain.cgi: Remove the auth-nocache directive from clients This seems to have some weird effects on Windows clients using OpenVPN 2.6.14 where username/password popup appears after one hour. Since we don't use any real username/password authentication, we will have to make sure that the client keeps using the fake data that we have added to the configuration. Signed-off-by: Michael Tremer commit ab628fec98da87b210e14894343fda130099314d Author: Michael Tremer Date: Wed Sep 24 18:34:46 2025 +0200 ovpnmain.cgi: Bring back auth-user-pass This seems to have been unintentionally removed during the latest OpenVPN changes. Signed-off-by: Michael Tremer commit 8018f729982f363bacbf53840ff0fd05e39938f8 Author: Michael Tremer Date: Wed Sep 24 18:30:59 2025 +0200 openvpn: Return something if the authentication is in an unknown state Sometimes, the clients seem to be sending a PUSH_REQUEST which is not receiving a reply from the server. That is because the authenticator might not respond at all on the socket. In that case, we should just aim to restart the authentication and hope that the client will come back with something that we expected. Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/ovpn/openvpn-authenticator | 6 +++--- config/rootfiles/core/199/filelists/files | 1 + html/cgi-bin/ovpnmain.cgi | 4 +--- 3 files changed, 5 insertions(+), 6 deletions(-) Difference in files: diff --git a/config/ovpn/openvpn-authenticator b/config/ovpn/openvpn-authenticator index 4341993e6d..d61c0f35ee 100644 --- a/config/ovpn/openvpn-authenticator +++ b/config/ovpn/openvpn-authenticator @@ -218,9 +218,9 @@ class OpenVPNAuthenticator(object): if self._check_totp_token(token, conn.get("totp_secret")): return self._client_auth_successful(cid, kid) - # Restart authentication - self._client_auth_challenge(cid, kid, - username=common_name, password="TOTP") + # Restart authentication + self._client_auth_challenge(cid, kid, + username=common_name, password="TOTP") def _client_disconnect(self, cid, environ={}): """ diff --git a/config/rootfiles/core/199/filelists/files b/config/rootfiles/core/199/filelists/files index 00198bcc3e..9c54b971bb 100644 --- a/config/rootfiles/core/199/filelists/files +++ b/config/rootfiles/core/199/filelists/files @@ -1 +1,2 @@ srv/web/ipfire/cgi-bin/vulnerabilities.cgi +usr/sbin/openvpn-authenticator diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index b63e5752cd..52261b8899 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2439,10 +2439,8 @@ END print "auth $vpnsettings{'DAUTH'}\n"; } - # Disable storing any credentials in memory - print "auth-nocache\n"; - # Set a fake user name for authentication + print "auth-user-pass\n"; print "auth-token-user USER\n"; print "auth-token TOTP\n"; hooks/post-receive -- IPFire 2.x development tree