/* eurephia.c  --  Main functions for the eurephia authentication module
 *
 *  GPLv2 only - Copyright (C) 2008, 2009
 *               David Sommerseth <dazo@users.sourceforge.net>
 *
 *  This program is free software; you can redistribute it and/or
 *  modify it under the terms of the GNU General Public License
 *  as published by the Free Software Foundation; version 2
 *  of the License.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 *
 */

/**
 * @file   eurephia.c
 * @author David Sommerseth <dazo@users.sourceforge.net>
 * @date   2008-08-06
 *
 * @brief  The core eurephia functions which is called from OpenVPN.
 *
 */


#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <getopt.h>
#include <assert.h>

#define EUREPHIA_FWINTF         /**< Include the proper eurephiaFWINTF declaration in eurephiaCTX */
#include <eurephiafw_struct.h>
#include <eurephia_nullsafe.h>
#include <eurephia_context.h>
#include <eurephiadb.h>
#include <eurephiadb_driver.h>
#include <eurephiafw.h>
#include <eurephia_nullsafe.h>
#include <eurephia_values.h>
#include <eurephiadb_session_common.h>
#include <eurephiadb_session.h>
#include <certinfo.h>
#include <randstr.h>
#include <passwd.h>

#define MAX_ARGUMENTS 64        /**<  Maximum arguments we will parse from the openvpn plug-in configuration */


/**
 * get_env() retrieve values from the openvpn environment table
 *
 * @param ctx        eurephiaCTX context
 * @param logmasking If 1, the value will be masked in the log files (eg. to hide password)
 * @param envp       the environment table
 * @param fmt        The key to look for (stdarg)
 *
 * @return Returns a const char * with the value, or NULL if not found
 */
const char *get_env(eurephiaCTX *ctx, int logmasking, const char *envp[], const char *fmt, ... )
{
        if (envp) {
                va_list ap;
                char key[384];
                int keylen = 0;
                int i;

                // Build up the key we are looking for
                memset(&key, 0, 384);
                va_start(ap, fmt);
                vsnprintf(key, 382, fmt, ap);

                // Find the key
                keylen = strlen (key);
                for (i = 0; envp[i]; ++i) {
                        if (!strncmp (envp[i], key, keylen)) {
                                const char *cp = envp[i] + keylen;
                                if (*cp == '=') {
#ifdef ENABLE_DEBUG
                                        int do_mask = 0;
#ifndef SHOW_SECRETS
                                        do_mask = logmasking;
#endif
                                        if( ctx != NULL ) {
                                                DEBUG(ctx, 30, "Function call: get_env(envp, '%s') == '%s'",
                                                      key, (do_mask == 0 ? cp + 1 : "xxxxxxxxxxxxxx"));
                                        }
#endif

                                        return cp + 1;
                                }
                        }
                }
                if( ctx != NULL ) {
                        DEBUG(ctx, 15, "Function call: get_env(envp, '%s') -- environment variable not found",
                              key);
                }
                va_end(ap);
        }
        return NULL;
}


/**
 * Initialises the eurephia OpenVPN plug-in and prepares a eurephiaCTX (context)
 *
 * @param argv  Arguments from the openvpn configuration file.  The format is:
 *              logfile loglevel eDB_driver [eurephiaDB arguments]
 *                 1       2        3          4.....
 *
 * @return returns a pointer to a eurephiaCTX context.  On failure NULL is returned.
 */
eurephiaCTX *eurephiaInit(const char **argv)
{
        static struct option eurephia_opts[] = {
                {"log-destination", required_argument, 0, 'l'},
                {"log-level", required_argument, 0, 'L'},
                {"database-interface", required_argument, 0, 'i'},
                {0, 0, 0 ,0}
        };
        int argc = 0, error = 0, loglvl = 0, dbargc = 0;
        const char *dbargv[MAX_ARGUMENTS];
        const char *fwintf = NULL, *logfile = NULL, *dbi = NULL;
        eurephiaCTX *ctx = NULL;

        //
        // Parse input arguments
        //

        // Count arguments
        for( argc = 0; argv[argc] != NULL; argc++ ) {}

        while(1) {
                int opt_idx = 0;
                int c = 0;

                c = getopt_long(argc, (char **)argv, "l:L:i:", eurephia_opts, &opt_idx);
                if( c == -1 ) {
                        break;
                }

                switch( c ) {
                case 'l':
                        logfile = optarg;
                        break;

                case 'L':
                        loglvl = atoi_nullsafe(optarg);
                        break;

                case 'i':
                        dbi = optarg;
                        break;

                default:
                        fprintf(stderr, "Error parsing eurephia-auth arguments.\n");
                        return NULL;
                        break;
                }
        }

        // Put the rest of the arguments into an own array which will be the db module arguments
        if( optind < argc ) {
                // copy arguments, but make sure we do not exceed our limit
                while( (optind < argc) && (dbargc < MAX_ARGUMENTS) ) {
                        dbargv[dbargc] = argv[optind++];
                        dbargc++;
                        dbargv[dbargc] = NULL;
                }
        }
        // End of argument parsing

        // Prepare a context area for eurephia-auth
        ctx = (eurephiaCTX *) malloc_nullsafe(NULL, sizeof(eurephiaCTX)+2);
        assert( ctx != NULL );
        ctx->context_type = ECTX_PLUGIN_AUTH;

        // Open a log file
        if( logfile != NULL ) {
                if( strcmp(logfile, "openvpn:") == 0 ) {     // Let openvpn do the logging
                        ctx->log = stderr;
                } else if( strcmp(logfile, "none:") == 0 ) { // Do not perform any logging
                        ctx->log = NULL;
                } else {                                     // if no hit on these ones,open a file with given name
                        ctx->log = fopen(logfile, "aw");
                        if( ctx->log == NULL ) {
                                fprintf(stderr, "Could not open eurephia log file: %s\n", argv[1]);
                                return NULL;
                        }
                }
        } else {
                // If no logging is given ... log to openvpn:
                ctx->log = stderr;
        }

        // Set log verbosity
        ctx->loglevel = loglvl;

        // Load the database driver
        if( (error == 0) && eDBlink_init(ctx, dbi, 1) ) {
                // Connect to the database
                if( !eDBconnect(ctx, dbargc, dbargv) ) {
                        eurephia_log(ctx, LOG_PANIC, 0, "Could not connect to the database");
                        error = 1;
                        eDBlink_close(ctx);
                }
        } else {
                eurephia_log(ctx, LOG_PANIC, 0, "Could not load the database driver");
                error = 1;
        }

        if( error > 0 ) {
                if( ctx->log != NULL ) {
                        eurephia_log(ctx, LOG_PANIC, 0, "eurephia-auth is not available");
                        fclose(ctx->log);
                }
                free_nullsafe(ctx, ctx);
                return NULL;
        }

        // Get data for server_salt - which will be used for the password cache
        ctx->server_salt = (char *) malloc_nullsafe(ctx, SIZE_PWDCACHE_SALT+2);
        assert( ctx->server_salt != NULL );

        if( !eurephia_randstring(ctx, ctx->server_salt, SIZE_PWDCACHE_SALT) ) {
                eurephia_log(ctx, LOG_PANIC, 0 , "Could not get enough random data for password cache.");

                free_nullsafe(ctx, ctx->server_salt);
                eDBdisconnect(ctx);
                fclose(ctx->log);
                free_nullsafe(ctx, ctx);
                return NULL;
        }

        // Check if firewall functionality is enabled, load module if given
        fwintf = eGet_value(ctx->dbc->config, "firewall_interface");
        if( fwintf != NULL ) {
                if( eFW_load(ctx, fwintf) ) {
                        eurephia_log(ctx, LOG_INFO, 0, "Loaded firewall interface: %s", fwintf);
                        eFW_StartFirewall(ctx);
                } else {
                        eurephia_log(ctx, LOG_FATAL, 0, "Loading of firewall interface failed (%s)", fwintf);
                        ctx->eurephia_fw_intf = NULL;
                }
        } else {
                ctx->eurephia_fw_intf = NULL;
        }

        eurephia_log(ctx, LOG_INFO, 1, "eurephia-auth is initialised");
        return ctx;
}


/**
 * Shutdowns the eurephia plug-in properly, disconnecting from database, unloading drivers,
 * closing log files and cleaning up the memory used.
 *
 * @param ctx  The eurephiaCTX used by openvpn.
 *
 * @return Returns 1 on success, otherwise 0.
 */
int eurephiaShutdown(eurephiaCTX *ctx)
{
        if( ctx == NULL ) {
                return 0;
        }

        if( ctx->eurephia_fw_intf != NULL ) {
                if( ctx->fwcfg != NULL ) {
                        eFW_StopFirewall(ctx);
                }
                eFW_unload(ctx);
        }

        if( (ctx->dbc != NULL) && (ctx->dbc->dbhandle != NULL) ) {
                eDBdisconnect(ctx);
        }

        if( ctx->eurephia_driver != NULL ) {
                eDBlink_close(ctx);
        }

        if( ctx->log != NULL ) {
                fflush(ctx->log);

                // Do not close log file if we're on stdout or stderr
                if( (ctx->log != stderr) && (ctx->log != stdout) ) {
                        eurephia_log(ctx, LOG_INFO, 2, "Closing log file");
                        fclose(ctx->log);
                }

                ctx->log = NULL;
                ctx->loglevel = 0;
        }

        memset(ctx->server_salt, 0xff, SIZE_PWDCACHE_SALT+2);
        free_nullsafe(ctx, ctx->server_salt);
        free_nullsafe(ctx, ctx);
        return 1;
}


/**
 * Verifies the certificate digest (SHA1 fingerprint) against the database.
 *
 * @param ctx    eurephiaCTX
 * @param env    openvpn environment table containing all the information we need
 * @param depth  If depth is 0, it's a client certificate, or else it's a CA certificate
 *
 * @return Returns 0 on failure and 1 on success.
 */
int eurephia_tlsverify(eurephiaCTX *ctx, const char **env, const char *depth)
{
        int result = 0;
        char *ipaddr;
        char *tls_digest, *tls_id;
        certinfo *ci = NULL;

        DEBUG(ctx, 10, "** Function call: eurephia_tlsverify(...)");

        // Check if IP address is blacklisted
        ipaddr = (char *) get_env(ctx, 0, env, "untrusted_ip");
        if( eDBblacklist_check(ctx, attempt_IPADDR, ipaddr) == 1 ) {
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr);

                // If fw blacklisting is configured, also blacklist there too
                if( (ctx->fwcfg != NULL) && (ctx->fwcfg->fwblacklist != NULL ) ) {
                        eFW_UpdateFirewall(ctx, FWRULE_BLACKLIST, ipaddr, ctx->fwcfg->fwblacklist, NULL);
                }
                return 0;
        }

        // Check if certificate digest is blacklisted
        tls_digest = (char *) get_env(ctx, 0, env, "tls_digest_%s", depth);
        if( eDBblacklist_check(ctx, attempt_CERTIFICATE, tls_digest) == 1 ) {
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr);
                eDBregister_attempt(ctx, attempt_CERTIFICATE, ATTEMPT_REGISTER, tls_digest);
                return 0;
        }

        // Check if certificate is registered and allowed
        tls_id = (char *) get_env(ctx, 0, env, "tls_id_%s", depth);
        ci = parse_tlsid(tls_id);
        result = eDBauth_TLS(ctx, ci->org, ci->common_name, ci->email, tls_digest, depth);
        if( result < 1 ) {
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr);
                eDBregister_attempt(ctx, attempt_CERTIFICATE, ATTEMPT_REGISTER, tls_digest);
        }

        if( result > 0 ) {
                // Certificate is okay, result contains the certificate ID
                eurephia_log(ctx, LOG_INFO, (depth == 0 ? 0 : 1),
                             "Found certid %i for user: %s/%s/%s",
                             result, ci->org, ci->common_name, ci->email);
        } else {
                eurephia_log(ctx, LOG_WARNING, 0,
                             "Unknown certificate for: %s/%s/%s (depth %s, digest: %s)",
                             ci->org, ci->common_name, ci->email, depth, tls_digest);
        }
        free_certinfo(ci);
        DEBUG(ctx, 10, "** Function result: eurephia_tlsverify(...) == %i", result > 0);

        return (result > 0);
}


/**
 * Authenticates the given user name, password and client certificate against the database.
 *
 * @param ctx  eurephiaCTX
 * @param env  openvpn environment table
 *
 * @return Returns 0 on failure and 1 on success.
 */
int eurephia_userauth(eurephiaCTX *ctx, const char **env)
{
        eurephiaSESSION *authsess = NULL;
        int result = 0, certid = 0;
        const char *cname, *remport, *ipaddr = NULL;
        const char *tls_digest = NULL, *tls_id = NULL, *username = NULL;
        char *passwd = NULL, *pwdcache = NULL, *chkpwd = NULL;
        certinfo *ci = NULL;

        DEBUG(ctx, 10, "** Function call: eurephia_userauth(...)");


        // Check if IP address is blacklisted
        ipaddr = (char *) get_env(ctx, 0, env, "untrusted_ip");
        if( eDBblacklist_check(ctx, attempt_IPADDR, ipaddr) == 1 ) {
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr);

                // If fw blacklisting is configured, also blacklist there too
                if( (ctx->fwcfg != NULL) && (ctx->fwcfg->fwblacklist != NULL ) ) {
                        eFW_UpdateFirewall(ctx, FWRULE_BLACKLIST, ipaddr, ctx->fwcfg->fwblacklist, NULL);
                }
                return 0;
        }

        // Check if certificate digest is blacklisted
        tls_digest = (char *) get_env(ctx, 0, env, "tls_digest_0");
        if( eDBblacklist_check(ctx, attempt_CERTIFICATE, tls_digest) == 1 ) {
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr);
                eDBregister_attempt(ctx, attempt_CERTIFICATE, ATTEMPT_REGISTER, tls_digest);
                return 0;
        }

        // Check if username is blacklisted
        username = (char *) get_env(ctx, 0, env, "username");
        if( eDBblacklist_check(ctx, attempt_USERNAME, username) == 1 ) {
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr);
                eDBregister_attempt(ctx, attempt_CERTIFICATE, ATTEMPT_REGISTER, tls_digest);
                eDBregister_attempt(ctx, attempt_USERNAME, ATTEMPT_REGISTER, username);
                return 0;
        }

        // Get certificate ID
        tls_id = (char *) get_env(ctx, 0, env, "tls_id_0");
        ci = parse_tlsid(tls_id);
        certid = eDBauth_TLS(ctx, ci->org, ci->common_name, ci->email, tls_digest, "0");
        if( certid < 1 ) {
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr);
                eDBregister_attempt(ctx, attempt_CERTIFICATE, ATTEMPT_REGISTER, tls_digest);
                eDBregister_attempt(ctx, attempt_USERNAME, ATTEMPT_REGISTER, username);
                free_certinfo(ci);
                return 0;
        }
        free_certinfo(ci);

        // Do username/password/certificate authentication
        passwd = (char *)get_env(ctx, 1, env, "password");
        if( (passwd == NULL) || (strlen_nullsafe(passwd) == 0) ) {
                eurephia_log(ctx, LOG_WARNING, 0, "eurephia-auth: No password received.  Action aborted");
                free_certinfo(ci);
                return 0;
        }

        // Check if we have a valid password cached
        chkpwd = eurephia_quick_hash(ctx->server_salt, passwd);

        // Get an authentication session, which is not a real session ticket
        // but it uses almost the same system
        cname     = get_env(ctx, 0, env, "common_name");
        remport   = get_env(ctx, 0, env, "untrusted_port");

        // an authentication session do not use assigned VPN address
        authsess = eDBopen_session_seed(ctx, tls_digest, cname, username, NULL, NULL, ipaddr, remport);
        if( authsess == NULL ) {
                // No session found
                goto chk_pwd;
        }
        // Get cached password from password cache
        pwdcache = eGet_value(authsess->sessvals, "pwdcache");

        if( (pwdcache != NULL) && (chkpwd != NULL) && (strcmp(pwdcache, chkpwd) == 0) ) {
                // if cached password matches users password, we're done
                eurephia_log(ctx, LOG_INFO, 3, "Authenticated user '%s' against password cache", username);
                result = 1;
                goto exit;
        }

        // If we do not have a valid password cached, check against the user database
 chk_pwd:
        result = eDBauth_user(ctx, certid, username, passwd);
        if( result < 1 ) {
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_REGISTER, ipaddr);
                eDBregister_attempt(ctx, attempt_CERTIFICATE, ATTEMPT_REGISTER, tls_digest);
                eDBregister_attempt(ctx, attempt_USERNAME, ATTEMPT_REGISTER, username);
        }

        if( result > 0 ) {
                // If we have a valid result, reset all attempt counters.
                eDBregister_attempt(ctx, attempt_IPADDR, ATTEMPT_RESET, ipaddr);
                eDBregister_attempt(ctx, attempt_CERTIFICATE, ATTEMPT_RESET, tls_digest);
                eDBregister_attempt(ctx, attempt_USERNAME, ATTEMPT_RESET, username);

                if( !eDBset_session_value(ctx, authsess, "pwdcache", chkpwd) ) {
                        eurephia_log(ctx, LOG_WARNING, 0, "Failed to cache password for user '%s'", username);
                }
                eurephia_log(ctx, LOG_INFO, 0, "User '%s' authenticated", username);
        }

 exit:
        free_nullsafe(ctx, chkpwd);
        eDBfree_session(ctx, authsess);
        DEBUG(ctx, 10, "** Function result: eurephia_userauth(...) = %i", (result>0));
        return (result > 0);
}


/**
 * Called when openvpn has authenticated the user and granted it access.  This function
 * will log information about the client
 *
 * @param ctx eurephiaCTX
 * @param env  openvpn environment table
 *
 * @return Returns 0 on failure and 1 on success.
 */
int eurephia_connect(eurephiaCTX *ctx, const char **env) {
        eurephiaSESSION *session = NULL;
        const char *digest, *cname, *uname, *vpnipaddr, *vpnipmask, *remipaddr, *remport, *proto, *tlsid;
        int certid = 0, uid = 0, ret = 0;
        certinfo *ci = NULL;

        DEBUG(ctx, 10, "** Function call: eurephia_connect(...)");

        // Fetch needed info
        digest    = get_env(ctx, 0, env, "tls_digest_0");
        tlsid     = get_env(ctx, 0, env, "tls_id_0");
        cname     = get_env(ctx, 0, env, "common_name");
        uname     = get_env(ctx, 0, env, "username");
        vpnipaddr = get_env(ctx, 0, env, "ifconfig_pool_remote_ip");
        vpnipmask = get_env(ctx, 0, env, "ifconfig_pool_netmask");
        remipaddr = get_env(ctx, 0, env, "trusted_ip");
        remport   = get_env(ctx, 0, env, "trusted_port");
        proto     = get_env(ctx, 0, env, "proto_1");

        // Get a session ticket
        session = eDBopen_session_seed(ctx, digest, cname, uname, vpnipaddr, vpnipmask, remipaddr, remport);
        if( session == NULL ) {
                return 0;
        }

        // Get certificate info
        ci = parse_tlsid(tlsid);
        if( ci == NULL ) {
                eurephia_log(ctx, LOG_FATAL, 1, "Could not parse the TLS ID string");
                eDBfree_session(ctx, session);
                return 0;
        }
        certid = eDBauth_TLS(ctx, ci->org, ci->common_name, ci->email, digest, "0");
        uid = eDBget_uid(ctx, certid, uname);
        free_certinfo(ci);

        // Register the session login
        ret = eDBregister_login(ctx, session, certid, uid, proto, remipaddr, remport, vpnipaddr, vpnipmask);
        eDBfree_session(ctx, session);
        eurephia_log(ctx, LOG_INFO, 1, "User '%s' logged in", uname);

        DEBUG(ctx, 10, "** Function result: eurephia_connect(...) = %i", ret);
        return ret;
}

/**
 * Called when the client disconnects.  This function logs some statistics about the session
 *
 * @param ctx  eurephiaCTX
 * @param env  openvpn environment table
 *
 * @return Returns 0 on failure and 1 on success.
 */
int eurephia_disconnect(eurephiaCTX *ctx, const char **env) {
        eurephiaSESSION *session = NULL;
        const char *digest, *cname, *uname, *vpnipaddr, *vpnipmask, *remipaddr, *remport;
        const char *bytes_sent, *bytes_rec, *duration;
        int ret = 0;

        DEBUG(ctx, 10, "** Function call: eurephia_disconnect(...)");

        // Fetch needed info
        digest    = get_env(ctx, 0, env, "tls_digest_0");
        cname     = get_env(ctx, 0, env, "common_name");
        uname     = get_env(ctx, 0, env, "username");
        vpnipaddr = get_env(ctx, 0, env, "ifconfig_pool_remote_ip");
        vpnipmask = get_env(ctx, 0, env, "ifconfig_pool_netmask");
        remipaddr = get_env(ctx, 0, env, "trusted_ip");
        remport   = get_env(ctx, 0, env, "trusted_port");
        bytes_sent= get_env(ctx, 0, env, "bytes_sent");
        bytes_rec = get_env(ctx, 0, env, "bytes_received");
        duration  = get_env(ctx, 0, env, "time_duration");

        // Get a session ticket
        session = eDBopen_session_seed(ctx, digest, cname, uname, vpnipaddr, vpnipmask, remipaddr, remport);
        if( session == NULL ) {
                return 0;
        }

        ret = eDBregister_logout(ctx, session, bytes_sent, bytes_rec, duration);
        eDBfree_session(ctx, session);
        eurephia_log(ctx, LOG_INFO, 1, "User '%s' logged out", uname);

        // Get the authentication session and destroy it
        session = eDBopen_session_seed(ctx, digest, cname, uname, NULL, NULL, remipaddr, remport);
        if( !eDBdestroy_session(ctx, session) ) {
                eurephia_log(ctx, LOG_WARNING, 0, "Could not destroy authentication session (%s/%s/%s)",
                             uname, cname, digest);
        }
        eDBfree_session(ctx, session);

        DEBUG(ctx, 10, "** Function result: eurephia_disconnect(...) = %i", ret);
        return ret;
}

/**
 * Called whenever openvpn assigns or changes IP addresses of the client.  The function logs
 * this information to keep track of which user was assigned which IP address and which MAC address
 * the user had during the connection as well.  If the firewall interface is enabled, it will also
 * request an update via the firewall driver.
 *
 * @param ctx     eurephiaCTX
 * @param mode    strings which can be "add", "delete".  In some cases also "update".
 * @param macaddr string containing the MAC address of the client, if received from openvpn
 * @param env     openvpn environment table
 *
 * @return Returns 0 on failure and 1 on success.
 */
int eurephia_learn_address(eurephiaCTX *ctx, const char *mode, const char *macaddr, const char **env) {
        eurephiaSESSION *session = NULL;
        const char *digest, *cname, *uname, *vpnipaddr, *vpnipmask, *remipaddr, *remport;
        char *fwprofile = NULL, *fwdest = NULL;
        int ret = 0, fw_enabled = 0;

        DEBUG(ctx, 10, "** Function call: eurephia_learn_address(ctx, '%s', '%s', ...)",
              mode, macaddr);

        // Get firewall information
        fw_enabled = (eGet_value(ctx->dbc->config, "firewall_interface") != NULL);
        fwdest = eGet_value(ctx->dbc->config, "firewall_destination");
        if( fw_enabled && (fwdest == NULL) ) {
                eurephia_log(ctx, LOG_CRITICAL, 0, "No firewall destination defined in the config.");
        }

        if( strncmp(mode, "add", 3) == 0 ) {
                // Fetch needed info
                digest    = get_env(ctx, 0, env, "tls_digest_0");
                cname     = get_env(ctx, 0, env, "common_name");
                uname     = get_env(ctx, 0, env, "username");
                vpnipaddr = get_env(ctx, 0, env, "ifconfig_pool_remote_ip");
                vpnipmask = get_env(ctx, 0, env, "ifconfig_pool_netmask");
                remipaddr = get_env(ctx, 0, env, "trusted_ip");
                remport   = get_env(ctx, 0, env, "trusted_port");

                // Get a session ticket
                session = eDBopen_session_seed(ctx, digest, cname, uname, vpnipaddr, vpnipmask,
                                               remipaddr, remport);
                if( session == NULL ) {
                        ret = 0;
                        goto exit;
                }

                // Update openvpn_lastlog with the active MAC address, and save it as a session variable
                ret = eDBregister_vpnmacaddr(ctx, session, macaddr);

                if( (fw_enabled) && (fwdest != NULL) ) {
                        fwprofile = eDBget_firewall_profile(ctx, session);
                        if( fwprofile != NULL ) {
                                eFW_UpdateFirewall(ctx, FWRULE_ADD, macaddr, fwdest, fwprofile);
                                free_nullsafe(ctx, fwprofile);
                        }
                }
                eDBfree_session(ctx, session);

        } else if( strncmp(mode, "delete", 6) == 0 ) {

                // Load the session, based on MAC address
                session = eDBopen_session_macaddr(ctx, macaddr);
                if( session == NULL ) {
                        eurephia_log(ctx, LOG_WARNING, 0,
                                     "Could not find any session connected to this MAC address: %s",
                                     macaddr);
                        ret = 0;
                        goto exit;
                }

                if( (fw_enabled) && (fwdest != NULL) ) {
                        fwprofile = eDBget_firewall_profile(ctx, session);
                        if( fwprofile != NULL ) {
                                eFW_UpdateFirewall(ctx, FWRULE_DELETE, macaddr, fwdest, fwprofile);
                                free_nullsafe(ctx, fwprofile);
                        }
                }
                ret = eDBdestroy_session(ctx, session);
                eDBfree_session(ctx, session);
        }

 exit:
        DEBUG(ctx, 10, "** Function result: eurephia_learn_address(ctx, '%s', '%s', ...) = %i",
                     mode, macaddr, ret);

        return ret;
}