summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * sqlite: Fixed a few odditiesDavid Sommerseth2013-03-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | memset() and free_nullsafe() was performed on a NULL pointer before it would be used. Also make uicid be 0 on generic database issues, not triggering a logging of a log-in attempt. A database error is hardly a user problem, and logging the log-in attempt may even fail as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth plug-in: Improved documentation for auth plug-insDavid Sommerseth2013-03-041-9/+32
| | | | | | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth plug-in: Made the PluginInfo() function more informativeDavid Sommerseth2013-03-043-20/+44
| | | | | | | | | | | | | | This new PluginInfo() will return a struct instead, containing all the needed plug-in info. It also replaces the APIversion() function completely. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * New feature: Added config option auth_disable_internalDavid Sommerseth2013-03-033-8/+31
| | | | | | | | | | | | | | | | | | | | | | | | By setting this config option in the eurephia database, eurephia will expect all user account/certificate links to be set up with an external plug-in for username/password authentications. Further, it is now ensured that system configuration issues or general failures not related to the user authentication itself, is not counted as a login attempt. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * sqlite: Honour the auth plug-in enable flag (plgenabled)David Sommerseth2013-03-031-10/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the configured authentication plug-in was disabled, edb-sqlite would still insist on using the plug-in as authentication method. This patch changes the behaviour to use the internal eurephia database for authentication if the authentication plug-in is disabled. The code also was modified slighly so that the internal eurephia database will be the fallback method if any other checks are skipped. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * sqlite: Implemented needed functions to enable authentication plug-insDavid Sommerseth2013-03-034-6/+178
| | | | | | | | | | | | | | | | | | | | | | | | This adds the needed functions the eurephia framework requires to retrieve a list of all configured plug-ins - eDBget_plugins(). And it includes eDBauth_GetAuthMethod() which is used to lookup what kind of authentication method a specific user account/certificate combination should use. If the authentication backend requires a different username for this, that can also be configured in this user account/certification setup. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * auth plug-in: Implemented the authentication plug-in into the core eurephia ↵David Sommerseth2013-03-034-7/+188
| | | | | | | | | | | | | | | | | | | | | | | | framework This enables using an external authentication plug-in if a user account/certification link is configured to make user of it. This change ensures that all configured authentiaction plug-ins are loaded and is available when eurephia is initialised. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * Added the first stab of an authentication plug-in frameworkDavid Sommerseth2013-03-0310-8/+520
| | | | | | | | | | | | | | | | | | This enables a run-time loadable support for other authentication modules. This can be used to make eurephia authenticate user's passwords against other sources than the local eurephia database itself. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
| * common: Added possibility to do dlsym() lookups as optional via ↵David Sommerseth2013-03-032-5/+22
| | | | | | | | | | | | | | | | eGetSym_optional() Will be used by the authentication plug-in framework. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Update eurephiadm to extract VPN MAC and IP address info from the new placesDavid Sommerseth2012-12-263-13/+16
| | | | | | | | | | | | | | As the lastlog table doesn't contain MAC or IP addresses of the VPN client any more, make the lastlog extraction gather the data from the vpnaddr_history table instead. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Make use of the new eDBregister_login2() call in the eurephia-auth plug-inDavid Sommerseth2012-12-261-4/+5
| | | | | | | | | | | | | | This will now log VPN client addresses only in the vpnaddr_history table, and lastlog will log the firewall profile the session used. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added eDBget_accessprofile() functionDavid Sommerseth2012-12-263-0/+44
| | | | | | | | | | | | | | | | This retrieves the accessprofile ID field from the database for a given uid/certid combination. This is useful when logging which firewall profile was used for a certain session. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | Added a new eDBregister_login2() to replace eDBregister_login() database ↵David Sommerseth2012-12-265-22/+115
| | | | | | | | | | | | | | | | | | | | | | | | | | | | function This will save the access profile in the lastlog table. However, it will not save the VPN IP address and netmask any more. This should be saved in the vpnaddr_history table, using the eDBregister_vpnclientaddr() function. eDBregister_login() is now just a wrapper around the eDBregister_login2(), ignoring the access profile id and VPN addresses. This exists purely as a compatibility layer if the updated driver is used against an older eurephia-auth.so plug-in. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* | FreeBSD compile fixesDavid Sommerseth2012-11-063-0/+8
|/ | | | | | | | - Only Linux have MADV_DONTFORK, so make it Linux specific - Added a few missing include files which Linux included through their include chains Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm/usercerts: Added support for username instead of uid on ↵David Sommerseth2012-11-021-20/+67
| | | | | | | | | | add/delete operations Instead of having to look up the UID manually when adding a user-cert link, it is now possible to user --username | -u instead of --uid | -i and provide a username directly. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Extended eDBget_uid() to also to UID lookup when certid is not availableDavid Sommerseth2012-11-022-7/+16
| | | | | | | By passing '0' as certid, the lookup will only be done against the user table. Any other values will consider the user-certification links as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Added error checking before calling eDBget_uid()David Sommerseth2012-11-021-0/+6
| | | | | | | This is to prepare for eDBget_uid() to also do lookups when certid is not set. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* sqlite3: Improve error handling if memory alloc fails for SQL query stringDavid Sommerseth2012-10-191-2/+8
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephia-auth: Fixed a double-free situation with dev-type is not obviousDavid Sommerseth2012-10-111-3/+2
| | | | | | | | | | | | | If OpenVPN is configured with a unkown --dev name and --dev-type is used, eurephia would in some specific situations double-free a memory region keeping the dev-type information. GETENV_*() functions returns a pointer to a buffer which is supposed to be free'd, but pointers returned by eGet_value() should not be free'd. And in the error situation if dev-type is not forced or detected, the memory allocated by GETENV_DEVNAME() was not properly free'd. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* SQLite: Move default installation path from /etc/openvpn to /var/lib/eurephiaDavid Sommerseth2012-10-092-2/+2
| | | | | | | Using /var/lib is more appropriate for the kind of database file eurephia uses and will also avoid other security restrictions on hardened installations as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm/users: Display remote IP address when displaying the lastlog on a ↵David Sommerseth2012-10-081-5/+31
| | | | | | | | | | | | | user In commit 35b61c51435d9f9095ced8949c045d50ac3c7018 the lastlog layout was changed. However, when displaying the lastlog for a particular user (eurephiadm users -s -l) the first column which was set to be username was empty. This patch will put the users remote IP address in the first column instead, while preserving the 'eurephiadm lastlog' layout. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Updated copyright datesDavid Sommerseth2012-10-08111-113/+113
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm: Removed several memleaks in error situations or when --help was usedDavid Sommerseth2012-10-087-25/+62
| | | | | | | Most of the eurephiadm commands leaked some memory if an error occured or the --help screen was requested. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm: Fixed some memory cleanup with libxml2 and libxsltDavid Sommerseth2012-10-082-1/+5
| | | | | | | | Valgrind complained about reachable buffers within the libxml2 and libxslt functions. Found some init and cleanup functions which needed to be called to solve this. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* sqlite/admin: Report all timestamp fields with localtime instead of UTC/GMTDavid Sommerseth2012-10-087-12/+15
| | | | | | | | Made all SELECT queries which is used for reports to use the new 'locdt' SQL function on timestamp fields. This converts the UTC/GMT timestamps stored in the database to the correct timezone of the running admin client. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* sqlite: Added SQL function to convert datetime timestamps from UTC/GMT to ↵David Sommerseth2012-10-083-5/+85
| | | | | | | | | | | | | | localtime All CURRENT_TIMESTAMP calls are returned in UTC/GMT, and this value is stored in the database. When using eurephiadm to look at these datetime fields the UTC/GMT value is used, and needs to be taken in consideration when looking at the reports. This patch is the first step to handle the local time zone better. This patch also fixes the 'debug' program in sqlite.c, making use of the eurephia_log_init() and eurephia_log_close() calls for log preparations. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fix bug with TUN mode disconnects being logged wrongly.David Sommerseth2012-09-131-8/+0
| | | | | | | | | | This fixes a bug which appeared with newer OpenVPN versions, where the OPENVPN_PLUGIN_LEARN_ADDRESS would be called in the end - also in tun mode. And with the clean-up in session seed, in regards to the netmask not being part of the session seed, this little code made things worse. So lets get rid of it! Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* sqlite3: Implement eDBregister_vpnclientaddr()David Sommerseth2012-09-133-10/+119
| | | | | | | | | | | | | This commit implements the eDBregister_vpnclientaddr() needed by the newer eurephia-auth plug-in. This is needed to improve the tun support in eurephia. In addition, this also updates the SQL schema to include IPv4 and in the future IPv6 addresses in the lastlog and VPN address history (openvpn_vpnaddr_history). The old openvpn_macaddr_history table is deprecated. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Only lookup function symbols for the administration API if the context is ↵David Sommerseth2012-09-131-11/+14
| | | | | | | | | correct This skips looking up all the eDBadmin*() functions if the context is unprivileged or the database interface is initialised by the OpenVPN plug-in Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Added a new database driver function: eDBregister_vpnclientaddr()David Sommerseth2012-09-133-13/+44
| | | | | | | | | | | | This function replaces eDBregister_vpnmacaddr(). This new function will in addition to the MAC address (if OpenVPN is running in TAP mode) also register the client's IPv4 VPN address. It's also prepared for logging the client's IPv6 VPN address. This function supports both TUN and TAP mode, while the old function only handled TAP mode. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Remove VPN IP netmask from session seedDavid Sommerseth2012-09-131-4/+4
| | | | | | | | | | | This is sometimes NULL, which is noticed more often when OpenVPN is configured in tun mode. This makes it difficult to identify the proper session key, as the seed isn't consistent. It does not affect much in regarding to the seed itself, as the netmask is most likely going to be the same for all clients anyhow. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephia-auth: eurephiaInit() may not always return a contextDavid Sommerseth2012-01-051-1/+4
| | | | | | Check if we have a context available before setting ctx->tuntype. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm/lastlog: Replace session deleted timestamp with session statusDavid Sommerseth2012-01-021-13/+7
| | | | | | | It's more useful to see the session status in 'eurephiadm lastlog' than when the session was closed by eurephia in the non-verbose overview. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Modified the whole edb-sqlite driver to use a better error handlingDavid Sommerseth2011-12-1910-192/+397
| | | | | | | | | | | This will change the driver to use the new error routines made available in the SQLite3 framework. Some of the code is also restructured a little bit to simplify the code with these changes. The functionality should be the same as for, but better error messages are now sent back to the caller on the functions supporting XML. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Implemented better error handling in the SQLite3 frameworkDavid Sommerseth2011-12-192-18/+133
| | | | | | | | | | | | | | | | The core sqlite_query() function will now always return a pointer to a dbresult structure. This structure now contains a query status and the error message from the sqlite3 backend if something went wrong. This means that error checking from now on should use the sqlite_query_status() macro and not to check if sqlite_query() returns NULL. Another fundamental change is that sqlite_free_results() must always be called on the dbresult structure now, to free the memory used by either data from the query or the error message. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* common: Fixed an error in the veurephia_log() macroDavid Sommerseth2011-07-261-1/+1
| | | | | | | The argument list didn't match what the internal _veurephia_log_func() function expected. This error was introduced in commit ebf4e80250b525e17 Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Moved generic parts of the config file parser to the common libraryDavid Sommerseth2011-07-254-91/+197
| | | | | | | Modified the eurephiadm client_config section to make use of the common version as well. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* common: Rework eurephia_log() to include also veurephia_log()David Sommerseth2011-07-252-11/+53
| | | | | | | veurephia_log() is to eurephia_log() what vprintf() is to printf(), taking va_list and const char *fmt arguments directly. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* edb-sqlite: Fixed a typos and copyright noticesDavid Sommerseth2011-07-251-3/+4
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Fixed several memleaks in the eurephiadm related code pathsDavid Sommerseth2011-01-105-6/+17
| | | | Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Look for endian.h in include/sys as well.David Sommerseth2010-12-312-1/+15
| | | | | | On FreeBSD the endian.h file is located in sys/endian.h. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Only look for dlopen() and dlclose() in libdl on LinuxDavid Sommerseth2010-12-311-2/+9
| | | | | | | Other platforms, like FreeBDS, have these functions in the standard libc library. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Explicit set library path for libxml2 and libxslt librariesDavid Sommerseth2010-12-311-0/+2
| | | | | | | On some platforms, CMake did not give this needed information to the linker. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Make use of more cross-platform friendly libc functionsDavid Sommerseth2010-12-311-3/+5
| | | | | | | | The initial implementation of the SHA512 hashing functions was tightly connected to glibc. This patch changes those few functions which is glibc to more portable functions. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Add paths and libaries for SQLite3 which pkg-config returnsDavid Sommerseth2010-12-311-1/+3
| | | | | | | | If SQLite3 was not installed in system paths, it would not be possible to compile the edb-sqlite driver due to include and library paths not being set. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Do not link in libdl explicitlyDavid Sommerseth2010-12-313-3/+3
| | | | | | | | | The functions related to dynamic loading of shared objects are a part of the standard libc library on FreeBSD, while in Linux it is in libdl. However, the linker on Linux seems to add the libdl linking automatically when needed, so no need to explicitly link this library. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Call 'find' properly in ./configureDavid Sommerseth2010-12-311-6/+6
| | | | | | | Some platforms expects a path to be given, so adding a relative path to the 'find' expressions. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* efw-iptables: Use the iptables conntrack moduleMatthew Gyurgyik2010-12-242-4/+5
| | | | | | | Make use of the iptables conntrack module instead of the older state module for stateful firewalling. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* Added ./configure information to eurephiadm buildinfoDavid Sommerseth2010-12-212-1/+7
| | | | | | | This is to help debugging even further, to be able to reproduce as similar builds as possible. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
* eurephiadm users: Revoke all admin access privileges when deleting a user ↵David Sommerseth2010-12-143-7/+45
| | | | | | | | | | account Matthew Gyurgyik noticed that when deleting a user account, the users granted access levels was still present. This resulted in a rather odd looking list when showing granted access levels. Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
generated by cgit (git 2.34.1) at 2025-09-03 11:06:47 +0000