Ticket #29: 0001-Make-some-push-options-not-resetable-by-ccd-config.patch

helper.c

@@ -256 +256 @@
               o->ifconfig_pool_netmask = o->server_netmask;
                   
               push_option (o, print_opt_route_gateway (o->server_network + 1, &o->gc), M_USAGE);
+              o->push_list.tail->immutable = true;
             }
           else
             ASSERT (0);
 
           push_option (o, print_opt_topology (topology, &o->gc), M_USAGE);
+          o->push_list.tail->immutable = true;
         }
       else if (dev == DEV_TYPE_TAP)
         {
@@ -283 +285 @@
           o->ifconfig_pool_netmask = o->server_netmask;
 
           push_option (o, print_opt_route_gateway (o->server_network + 1, &o->gc), M_USAGE);
+          o->push_list.tail->immutable = true;
         }
       else
         {
@@ -355 +358 @@
           ifconfig_pool_verify_range (M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
           o->ifconfig_pool_netmask = o->server_bridge_netmask;
           push_option (o, print_opt_route_gateway (o->server_bridge_ip, &o->gc), M_USAGE);
+          o->push_list.tail->immutable = true;
         }
       else if (o->server_bridge_proxy_dhcp && !(o->server_flags & SF_NO_PUSH_ROUTE_GATEWAY))
         {
           push_option (o, print_opt_route_gateway_dhcp (&o->gc), M_USAGE);
+          o->push_list.tail->immutable = true;
         }
     }
   else

multi.c

@@ -1283 +1283 @@
 }
 
 /*
+ * Set list entry immutable flag to immutable
+ * until end of list
+ */
+static void
+multi_client_connect_post_set_immutable (struct push_entry *e,
+                           bool immutable)
+{
+        while( e ){
+                e->immutable = immutable;
+                e = e->next;
+        }
+}
+
+/*
  * Called after client-connect script is called
  */
 static void
@@ -1442 +1456 @@
     {
       struct gc_arena gc = gc_new ();
       unsigned int option_types_found = 0;
+      struct push_entry *immutable_from_option = NULL, *last_option = NULL;
+      bool push_reset = false;
 
       const unsigned int option_permissions_mask =
           OPT_P_INSTANCE
@@ -1487 +1503 @@
           /* try common-name file */
           if (test_file (ccd_file))
             {
+              last_option = mi->context.options.push_list.tail;
               options_server_import (&mi->context.options,
                                      ccd_file,
                                      D_IMPORT_ERRORS|M_OPTERR,
                                      option_permissions_mask,
                                      &option_types_found,
                                      mi->context.c2.es);
+              if (mi->context.options.push_reset){
+                                     immutable_from_option = last_option;
+                                     push_reset = true;
+                                     mi->context.options.push_reset = false;
+                                        }
             }
           else /* try default file */
             {
@@ -1502 +1524 @@
 
               if (test_file (ccd_file))
                 {
+                  last_option = mi->context.options.push_list.tail;
                   options_server_import (&mi->context.options,
                                          ccd_file,
                                          D_IMPORT_ERRORS|M_OPTERR,
                                          option_permissions_mask,
                                          &option_types_found,
                                          mi->context.c2.es);
+
+                   if (mi->context.options.push_reset){
+                                         immutable_from_option = last_option;
+                                         push_reset = true;
+                                         mi->context.options.push_reset = false;
+             }
                 }
             }
         }
@@ -1545 +1574 @@
             }
           else
             {
+              last_option = mi->context.options.push_list.tail;
               multi_client_connect_post (m, mi, dc_file, option_permissions_mask, &option_types_found);
+              if (mi->context.options.push_reset){
+                                                immutable_from_option = last_option;
+                                                push_reset = true;
+                                                mi->context.options.push_reset = false;
+              }
+
               ++cc_succeeded_count;
             }
         script_depr_failed:
@@ -1566 +1602 @@
             }
           else
             {
+              last_option = mi->context.options.push_list.tail;
               multi_client_connect_post_plugin (m, mi, &pr, option_permissions_mask, &option_types_found);
               ++cc_succeeded_count;
+              if (mi->context.options.push_reset){
+                                                immutable_from_option = last_option;
+                                                push_reset = true;
+                                                mi->context.options.push_reset = false;
+                                }
+
             }
 
           plugin_return_free (&pr);
@@ -1596 +1639 @@
 
           if (openvpn_execve_check (&argv, mi->context.c2.es, S_SCRIPT, "client-connect command failed"))
             {
+              last_option = mi->context.options.push_list.tail;
               multi_client_connect_post (m, mi, dc_file, option_permissions_mask, &option_types_found);
               ++cc_succeeded_count;
+              if (mi->context.options.push_reset){
+                                                immutable_from_option = last_option;
+                                                push_reset = true;
+                                                mi->context.options.push_reset = false;
+              }
             }
           else
             cc_succeeded = false;
@@ -1611 +1660 @@
 #ifdef MANAGEMENT_DEF_AUTH
       if (cc_succeeded && mi->cc_config)
         {
+          last_option = mi->context.options.push_list.tail;
           multi_client_connect_mda (m, mi, mi->cc_config, option_permissions_mask, &option_types_found);
           ++cc_succeeded_count;
+          if (mi->context.options.push_reset){
+                    immutable_from_option = last_option;
+                    push_reset = true;
+                    mi->context.options.push_reset = false;
+          }
         }
 #endif
 
@@ -1625 +1680 @@
           msg (D_MULTI_ERRORS, "MULTI: client has been rejected due to 'disable' directive");
           cc_succeeded = false;
         }
-
+  /*
+   * Set option push_reset to true if push-reset option
+   * was ever encountered, and set to immutable
+   * options added since last push-reset
+   */
+  mi->context.options.push_reset = push_reset;
+  if( push_reset ){
+                multi_client_connect_post_set_immutable(
+                        immutable_from_option ? immutable_from_option->next : mi->context.options.push_list.head, true);
+  }
       if (cc_succeeded)
         {
           /*

options.c

@@ -691 +691 @@
   o->route_delay_window = 30;
   o->max_routes = MAX_ROUTES_DEFAULT;
   o->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
+  o->push_reset = false;
 #ifdef ENABLE_OCC
   o->occ = true;
 #endif
@@ -4789 +4790 @@
   else if (streq (p[0], "push-reset"))
     {
       VERIFY_PERMISSION (OPT_P_INSTANCE);
-      push_reset (options);
+      options->push_reset = true;
     }
   else if (streq (p[0], "ifconfig-pool") && p[1] && p[2])
     {

options.h

@@ -378 +378 @@
   in_addr_t server_bridge_pool_end;
 
   struct push_list push_list;
+  bool push_reset;
   bool ifconfig_pool_defined;
   in_addr_t ifconfig_pool_start;
   in_addr_t ifconfig_pool_end;

push.c

@@ -183 +183 @@
 
   while (e)
     {
-      if (e->enable)
+      if (e->enable && (!c->options.push_reset || e->immutable))
         {
           const int l = strlen (e->option);
           if (BLEN (&buf) + l >= safe_cap)
@@ -290 +290 @@
       while (e)
         {
           push_option_ex (o, string_alloc (e->option, &o->gc), true, M_FATAL);
+          o->push_list.tail->immutable = e->immutable;
           e = e->next;
         }
     }

pushlist.h

@@ -30 +30 @@
 struct push_entry {
   struct push_entry *next;
   bool enable;
+  bool immutable;
   const char *option;
 };