[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 437e28f1268ba41bbbe6565cf5d097e8c640965d

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 437e28f1268ba41bbbe6565cf5d097e8c640965d

[Michael Tremer]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  437e28f1268ba41bbbe6565cf5d097e8c640965d (commit)
       via  e3e4d6fe8ab6b3e60157be3b2b08aa5fa2d05b67 (commit)
       via  ab628fec98da87b210e14894343fda130099314d (commit)
       via  8018f729982f363bacbf53840ff0fd05e39938f8 (commit)
      from  af0a1f70aa0ed081b32c4f7589979a1cc19afb9a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 437e28f1268ba41bbbe6565cf5d097e8c640965d
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Wed Sep 24 18:37:59 2025 +0200

    core199: Ship the OpenVPN Authenticator
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit e3e4d6fe8ab6b3e60157be3b2b08aa5fa2d05b67
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Wed Sep 24 18:36:12 2025 +0200

    ovpnmain.cgi: Remove the auth-nocache directive from clients
    
    This seems to have some weird effects on Windows clients using OpenVPN
    2.6.14 where username/password popup appears after one hour. Since we
    don't use any real username/password authentication, we will have to
    make sure that the client keeps using the fake data that we have added
    to the configuration.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit ab628fec98da87b210e14894343fda130099314d
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Wed Sep 24 18:34:46 2025 +0200

    ovpnmain.cgi: Bring back auth-user-pass
    
    This seems to have been unintentionally removed during the latest
    OpenVPN changes.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 8018f729982f363bacbf53840ff0fd05e39938f8
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Wed Sep 24 18:30:59 2025 +0200

    openvpn: Return something if the authentication is in an unknown state
    
    Sometimes, the clients seem to be sending a PUSH_REQUEST which is not
    receiving a reply from the server. That is because the authenticator
    might not respond at all on the socket.
    
    In that case, we should just aim to restart the authentication and hope
    that the client will come back with something that we expected.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/ovpn/openvpn-authenticator         | 6 +++---
 config/rootfiles/core/199/filelists/files | 1 +
 html/cgi-bin/ovpnmain.cgi                 | 4 +---
 3 files changed, 5 insertions(+), 6 deletions(-)

Difference in files:
diff --git a/config/ovpn/openvpn-authenticator b/config/ovpn/openvpn-authenticator
index 4341993e6d..d61c0f35ee 100644
--- a/config/ovpn/openvpn-authenticator
+++ b/config/ovpn/openvpn-authenticator
@@ -218,9 +218,9 @@ class OpenVPNAuthenticator(object):
 				if self._check_totp_token(token, conn.get("totp_secret")):
 					return self._client_auth_successful(cid, kid)
 
-			# Restart authentication
-			self._client_auth_challenge(cid, kid,
-				username=common_name, password="TOTP")
+		# Restart authentication
+		self._client_auth_challenge(cid, kid,
+			username=common_name, password="TOTP")
 
 	def _client_disconnect(self, cid, environ={}):
 		"""
diff --git a/config/rootfiles/core/199/filelists/files b/config/rootfiles/core/199/filelists/files
index 00198bcc3e..9c54b971bb 100644
--- a/config/rootfiles/core/199/filelists/files
+++ b/config/rootfiles/core/199/filelists/files
@@ -1 +1,2 @@
 srv/web/ipfire/cgi-bin/vulnerabilities.cgi
+usr/sbin/openvpn-authenticator
diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index b63e5752cd..52261b8899 100644
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -2439,10 +2439,8 @@ END
 			print "auth $vpnsettings{'DAUTH'}\n";
 		}
 
-		# Disable storing any credentials in memory
-		print "auth-nocache\n";
-
 		# Set a fake user name for authentication
+		print "auth-user-pass\n";
 		print "auth-token-user USER\n";
 		print "auth-token TOTP\n";
 


hooks/post-receive
--
IPFire 2.x development tree