summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* eurephia-auth: Fixed a few issues when using OpenVPN 2.2David Sommerseth2013-06-091-2/+6
| | | | | | | | | | | | | | | - SSLAPI_OPENSSL isn't available in this version. Print a warning during compile time that OpenVPN must be compiled against OpenSSL. If OpenVPN is not compiled against OpenSSL, it may most likely crash. OpenVPN 2.3.2 and below can be compiled against PolarSSL and does not contain the needed arguments->ssl_api variable to identify SSL implementation at runtime. - Bug: When moving the certificate information extraction to openvpn_plugin_func_v1(), the certificate level was not extracted correctly. It needs to be converted to an integer. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* auth: Added socket-auth moduleDavid Sommerseth2013-06-094-1/+482
| | | | | | | | | This can authenticate username/passwords via a file socket to an authentication service. A simple authentication service written in Python is added as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fixed a memory leak in detect_tunnel_type()David Sommerseth2013-06-071-0/+1
| | | | | | | If the tunnel type was detected and a understandable device name was found, the local devtype was not freed at all. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* plugin: Save the client certificate information in a OpenVPN per-client-contextDavid Sommerseth2013-06-071-17/+73
| | | | | | | | | | | As the X.509 certificate data isn't available when the certificate has been validated, save the parsed certificate information in the per-client-context OpenVPN provides in the v3 plug-in API. When the client disconnects, the certificate information and per-client-context buffer is released as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* plugin: Reworked the certinfo integration and use the X.509 certificate from ↵David Sommerseth2013-06-073-105/+103
| | | | | | | | | | OpenVPN The OpenVPN plug-in v3 API there is direct access to the X.509 certificate data. This patch starts the adoptation to make use of that, but also to preserve backwards compatibility. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* plugin: cleaned up some white space errors in environment.cDavid Sommerseth2013-06-071-2/+2
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm: Added needed include files to be buildableDavid Sommerseth2013-06-072-0/+2
| | | | | | | This is related to that certinfo has been extended and now need to pull in the openssl/x509.h to compile properly. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* common: Improved the certificate information extračtionDavid Sommerseth2013-06-072-2/+88
| | | | | | | | | Added a function to extract the needed information from an OpenSSL X509 object. Also extended parse_tlsid() to include a pointer to the certificate digest, to have a common behaviour between parse_tlsid() and parse_x509_cert(). Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm: Removed inclusion of certinfo.h where not neededDavid Sommerseth2013-06-073-3/+0
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* plugin: Start the implementation of OpenVPN 2.3's plug-in API v3David Sommerseth2013-06-051-4/+121
| | | | | | | These changes should provide both the v1 API and the new v3 API, depending on which OpenVPN is being used. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* common: Update callers of eurephia_log_init() to comply with the API changesDavid Sommerseth2013-06-054-12/+21
| | | | | | This is to enable an improved logging feature in OpenVPN v2.3 and newer. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* common: Prepare for OpenVPN 2.3's new logging feature in plug-in API v3David Sommerseth2013-06-053-7/+42
| | | | | | | In OpenVPN v2.3 there's a new plug-in API with a more integrated log features. This patch prepares the logging infrastructure for this API. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm/usercerts: Add support for setting up auth-pluginsDavid Sommerseth2013-05-295-36/+107
| | | | | | | This enables setting authentication plug-in and the alternative authentication username for user-certificate links. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* auth-plugin: Added a simple flat-file authentication exampleDavid Sommerseth2013-05-293-1/+264
| | | | | | | | This auth-plugin will authenticate users against a simple text file containing username and password hashes, separated by a '|' (pipe). Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm: Added missing install of the plugins.xsl fileDavid Sommerseth2013-05-291-0/+1
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm: Added missing XSLT file for the plug-ins commandDavid Sommerseth2013-05-281-0/+122
| | | | | | | This file should have been added to commit 2cb8244efca21c48db523df9a12a337d3679e26b but got forgotten. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Merge auth-plugin workDavid Sommerseth2013-05-2832-77/+2318
|\ | | | | | | | | | | | | | | | | | | | | This implements a authentication plug-in framework which can be used to do username/password authentication against another backend per user/certificate. Conflicts: database/eurephiadb.c Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * sqlite3: Rename the delta script to avoid merge issuesDavid Sommerseth2013-05-281-0/+0
| | | | | | | | | | | | Seems delta-2 was already "taken" in master. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * sqlite3: Enable support for managing plug-in modulesDavid Sommerseth2013-05-283-0/+357
| | | | | | | | | | | | | | This enables plug-in support management via the eDBadminPlugins() function, used by eurephiadm. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * eurephiadm: Add support for managing plug-insDavid Sommerseth2013-05-284-1/+471
| | | | | | | | | | | | | | This adds the 'plugins' command, which is used to register, remove or modify plug-in parameters. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Add the eDBadminPlugins() function in the database APIDavid Sommerseth2013-05-282-0/+31
| | | | | | | | | | | | | | This function will be used by the admin interface to configure eurephia plug-ins. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * database/field mapping: Introduce boolean field typeDavid Sommerseth2013-05-283-2/+26
| | | | | | | | | | | | | | This field type ensures boolean values will be predictable when working in the database driver layer. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Use proper return type in eDBmappingFieldsPresent()David Sommerseth2013-05-282-3/+3
| | | | | | | | | | | | | | | | The field mapping id changed to unsigned long long in commit 60800a7030c7aa3a9e1a1b6155abc4079a0e34f1. This function needs to support that as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Added fieldmapping to the new 'plugins' tableDavid Sommerseth2013-05-281-6/+6
| | | | | | | | | | | | | | This will enable the database plug-ins and eurephiadm to manipulate this table. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Added fieldmapping to the new 'plugins' tableDavid Sommerseth2013-04-122-0/+19
| | | | | | | | | | | | | | This will enable the database plug-ins and eurephiadm to manipulate this table. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Added new function to set the value in a eDBfieldMap structDavid Sommerseth2013-04-122-5/+39
| | | | | | | | | | | | | | This slightly changes the eDBmappingGetValue() function to reuse some of the same look-up logic for eDBmappingSetValue() Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Move the field mapping identifier from long int to long longDavid Sommerseth2013-04-121-38/+42
| | | | | | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Added function to inspect a plug-inDavid Sommerseth2013-04-123-0/+101
| | | | | | | | | | | | | | This will temporarily load a plug-in and extract information about it. The gathered information is returned in a struct on success. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth plugin: Added a possibility for auth plug-ins to close down properlyDavid Sommerseth2013-03-074-1/+24
| | | | | | | | | | | | | | This optional function may be declared in the auth-plugins and will be called via the eAuthPlugin_Close() function. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth-plugin: Added a silly and stupid authentication plug-inDavid Sommerseth2013-03-043-1/+151
| | | | | | | | | | | | | | | | This is a dummy plug-in, which should NEVER EVER be used in production. Its purpose is just to solely test the authentication plug-in API and to provide a demo implementation of the API. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * sqlite: Modified eDBget_plugins() to support the new interface for plug-in initDavid Sommerseth2013-03-043-1/+9
| | | | | | | | | | | | | | This is needed to provide config data to a configured plug-in when it is loaded and initialised. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth plug-in: Extended the API to have a PluginInit() functionDavid Sommerseth2013-03-043-1/+70
| | | | | | | | | | | | This can be used to pass a configuration to the authentication plug-in. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * sqlite: Fixed a few odditiesDavid Sommerseth2013-03-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | memset() and free_nullsafe() was performed on a NULL pointer before it would be used. Also make uicid be 0 on generic database issues, not triggering a logging of a log-in attempt. A database error is hardly a user problem, and logging the log-in attempt may even fail as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth plug-in: Improved documentation for auth plug-insDavid Sommerseth2013-03-041-9/+32
| | | | | | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth plug-in: Made the PluginInfo() function more informativeDavid Sommerseth2013-03-043-20/+44
| | | | | | | | | | | | | | This new PluginInfo() will return a struct instead, containing all the needed plug-in info. It also replaces the APIversion() function completely. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * New feature: Added config option auth_disable_internalDavid Sommerseth2013-03-033-8/+31
| | | | | | | | | | | | | | | | | | | | | | | | By setting this config option in the eurephia database, eurephia will expect all user account/certificate links to be set up with an external plug-in for username/password authentications. Further, it is now ensured that system configuration issues or general failures not related to the user authentication itself, is not counted as a login attempt. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * sqlite: Honour the auth plug-in enable flag (plgenabled)David Sommerseth2013-03-031-10/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the configured authentication plug-in was disabled, edb-sqlite would still insist on using the plug-in as authentication method. This patch changes the behaviour to use the internal eurephia database for authentication if the authentication plug-in is disabled. The code also was modified slighly so that the internal eurephia database will be the fallback method if any other checks are skipped. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * sqlite: Implemented needed functions to enable authentication plug-insDavid Sommerseth2013-03-034-6/+178
| | | | | | | | | | | | | | | | | | | | | | | | This adds the needed functions the eurephia framework requires to retrieve a list of all configured plug-ins - eDBget_plugins(). And it includes eDBauth_GetAuthMethod() which is used to lookup what kind of authentication method a specific user account/certificate combination should use. If the authentication backend requires a different username for this, that can also be configured in this user account/certification setup. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth plug-in: Implemented the authentication plug-in into the core eurephia ↵David Sommerseth2013-03-034-7/+188
| | | | | | | | | | | | | | | | | | | | | | | | framework This enables using an external authentication plug-in if a user account/certification link is configured to make user of it. This change ensures that all configured authentiaction plug-ins are loaded and is available when eurephia is initialised. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Added the first stab of an authentication plug-in frameworkDavid Sommerseth2013-03-0310-8/+520
| | | | | | | | | | | | | | | | | | This enables a run-time loadable support for other authentication modules. This can be used to make eurephia authenticate user's passwords against other sources than the local eurephia database itself. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * common: Added possibility to do dlsym() lookups as optional via ↵David Sommerseth2013-03-032-5/+22
| | | | | | | | | | | | | | | | eGetSym_optional() Will be used by the authentication plug-in framework. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Update eurephiadm to extract VPN MAC and IP address info from the new placesDavid Sommerseth2012-12-263-13/+16
| | | | | | | | | | | | | | As the lastlog table doesn't contain MAC or IP addresses of the VPN client any more, make the lastlog extraction gather the data from the vpnaddr_history table instead. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Make use of the new eDBregister_login2() call in the eurephia-auth plug-inDavid Sommerseth2012-12-261-4/+5
| | | | | | | | | | | | | | This will now log VPN client addresses only in the vpnaddr_history table, and lastlog will log the firewall profile the session used. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added eDBget_accessprofile() functionDavid Sommerseth2012-12-263-0/+44
| | | | | | | | | | | | | | | | This retrieves the accessprofile ID field from the database for a given uid/certid combination. This is useful when logging which firewall profile was used for a certain session. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added a new eDBregister_login2() to replace eDBregister_login() database ↵David Sommerseth2012-12-265-22/+115
| | | | | | | | | | | | | | | | | | | | | | | | | | | | function This will save the access profile in the lastlog table. However, it will not save the VPN IP address and netmask any more. This should be saved in the vpnaddr_history table, using the eDBregister_vpnclientaddr() function. eDBregister_login() is now just a wrapper around the eDBregister_login2(), ignoring the access profile id and VPN addresses. This exists purely as a compatibility layer if the updated driver is used against an older eurephia-auth.so plug-in. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | FreeBSD compile fixesDavid Sommerseth2012-11-063-0/+8
|/ | | | | | | | - Only Linux have MADV_DONTFORK, so make it Linux specific - Added a few missing include files which Linux included through their include chains Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm/usercerts: Added support for username instead of uid on ↵David Sommerseth2012-11-021-20/+67
| | | | | | | | | | add/delete operations Instead of having to look up the UID manually when adding a user-cert link, it is now possible to user --username | -u instead of --uid | -i and provide a username directly. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Extended eDBget_uid() to also to UID lookup when certid is not availableDavid Sommerseth2012-11-022-7/+16
| | | | | | | By passing '0' as certid, the lookup will only be done against the user table. Any other values will consider the user-certification links as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Added error checking before calling eDBget_uid()David Sommerseth2012-11-021-0/+6
| | | | | | | This is to prepare for eDBget_uid() to also do lookups when certid is not set. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* sqlite3: Improve error handling if memory alloc fails for SQL query stringDavid Sommerseth2012-10-191-2/+8
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
generated by cgit (git 2.34.1) at 2024-09-24 06:20:23 +0000