openvpn-openssl: Compile management interface by default #21546
Conversation
resolves openwrt#21534 Signed-off-by: KoS <kosli@users.noreply.github.com>
|
FYI, the problem with the openvpn-wolfssl compile error with the management interface is mentioned in #18587 |
The problem still exists in my pull request #21547 . I think i have to extend the wolfssl patch like it is done in #21322 . |
|
I have added 2 further wolfSSL patches to #21547 . I only did compile tests, no runtime tests with wolfSSL. |
|
|
In my opinion this is not the good idea due to two aspects: size and security |
|
Thanks @AuthorReflex Despite the above points, without the managment interface being compiled in, the authentication of OpenVPN users via a script does not work as expected. Or what about having a openvpn-openssl-full package (like dnsmasq-full) so that the user has the choice? |
|
@kosli |
|
@AuthorReflex |
|
@AuthorReflex |
Thanks. Can you in additional provide client config? You can remove certs from archive, I will use my own |
as written, the client config is the .ovpn file included in the archive, or have I missed to add it? (writing from mobile phone right now) |
|
@AuthorReflex Have you been able to test it with the client.ovpn or do you need help with the client configuration? The client configuration is straightforward: besides the CA, cert & key you need to use the same DH key as on the server side. |
In a quick test, I couldn't get the results I wanted. I will continue testing this week |
|
So I ran some tests. There are a few inaccuracies in your configuration to note.
Under these conditions, the return code of the auth.sh script is processed correctly regardless of the MANAGEMENT_INTERFACE option enabled For tests, I use Xiaomi mi-mini router. My config files listed below openvpn-server.conf (generated from /etc/config/openvpn)openvpn-client.conf(generated from /etc/config/openvpn)log outputIf there are errors in the configuration (for example, the login-password for the auth-user-pass parameter is not set), then the behavior you described (the client does not receive a response from the server) is also observed if MANAGEMENT_INTERFACE is enabled during compilation These tests made on openvpn-2.6.5, maybe in this version issue is already fixed |
|
Thanks @AuthorReflex (the two points mentioned are not relevant for the tests) |
Openvpn 2.6.5 has been included into master branch, you can build for your existing architecture yourself (I don't use x86-64)
and this error do not translating to client also if MANAGEMENT_INTERFACE is enabled |
|
@AuthorReflex I was busy and have picked up the testing now again after testing some of my devices with the 23.05.0 release. |
What do you mean by "without sending userpass data"? The use case is not about not sending any userpass data (e.g. not having the option enabled in the client), but a user entering wrong username/password and the client not receiving the auth failed from the server and waiting for a timeout, instead of immediately asking again about the username/password. |
|
@AuthorReflex I have tried it with your sample, but it looks like the auth.sh never gets executed and the server always returns auth failed straight away. E.g. adding a "logger test" into the auth.sh doesn't show up in the log files, but executing the file manually does. Have you been able to create a successful connection with your sample? "The script should examine the username and password, returning a success exit code (0) if the client's authentication request is to be accepted, or a failure code (1) to reject the client." |
resolves #21534
Compile tested: OpenWRT 22.03.5, OpenVPN 2.5.7, x86_64 openvpn-openssl & openvpn-mbedtls. Whereas opevpn-wolfssl failed.
Run tested: OpenWRT 22.03.5, OpenVPN 2.5.7, x86_64 all my existing OpenVPN server and client connections worked fine, especially the auth-user-pass-verify featured finally worked as expected. I have tested only the openvpn-openssl package.
This patch is only for enabling it on the openvpn-openssl package.