Repository: jkroepke/openvpn-auth-oauth2
Pull request #43 (2023-10-05 13:46:48)

CI: test release in CI
Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Particularly user-facing changes**:

**PR Readiness Checklist**:

Complete these before marking the PR as `ready to review`:

- [ ] The PR title has a summary of the changes
- [ ] The PR body has a summary to reflect any significant (and particularly user-facing) changes introduced by this PR


codecov[bot]: ## [Codecov](https://app.codecov.io/gh/jkroepke/openvpn-auth-oauth2/pull/43?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Jan-Otto+Kr%C3%B6pke) Report
All modified lines are covered by tests :white_check_mark:
> Comparison is base [(`0de5b10`)](https://app.codecov.io/gh/jkroepke/openvpn-auth-oauth2/commit/0de5b1076deab747f843e750231a9e703cbfbd78?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Jan-Otto+Kr%C3%B6pke) 72.32% compared to head [(`9d1d8fe`)](https://app.codecov.io/gh/jkroepke/openvpn-auth-oauth2/pull/43?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Jan-Otto+Kr%C3%B6pke) 71.77%.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main      #43      +/-   ##
==========================================
- Coverage   72.32%   71.77%   -0.56%     
==========================================
  Files          19       19              
  Lines        1254     1254              
==========================================
- Hits          907      900       -7     
- Misses        304      309       +5     
- Partials       43       45       +2     
```


[see 3 files with indirect coverage changes](https://app.codecov.io/gh/jkroepke/openvpn-auth-oauth2/pull/43/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Jan-Otto+Kr%C3%B6pke)


</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/jkroepke/openvpn-auth-oauth2/pull/43?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Jan-Otto+Kr%C3%B6pke).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Jan-Otto+Kr%C3%B6pke).


Patch:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9446021..4c830a3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -39,16 +39,20 @@ jobs:
 
           sudo apt-get update -q
           sudo apt-get install --no-install-recommends -qy $PACKAGES
+
       - name: go build (with goreleaser)
         uses: goreleaser/goreleaser-action@v5
         with:
           version: latest
-          args: build --snapshot
+          args: release --snapshot
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: codecov/codecov-action@v3
-
+      - uses: actions/upload-artifact@v3
+        with:
+          name: dists
+          path: dist/
   lint:
     name: lint
     runs-on: ubuntu-latest
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 00a8f00..041c0e3 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -38,8 +38,6 @@ nfpms:
     description: |
       openvpn-auth-oauth2 is a management client for OpenVPN that handles the authentication of connecting users against OIDC providers like Azure AD or Keycloak.
     license: MIT License
-    builds:
-      - openvpn-auth-oauth2
     formats:
       - deb
       - rpm
@@ -49,6 +47,8 @@ nfpms:
       - src: packaging/openvpn-auth-oauth2.sysconfig
         dst: /etc/sysconfig/openvpn-auth-oauth2
         type: "config|noreplace"
+      - src: packaging/config.yaml
+        dst: /usr/share/doc/openvpn-auth-oauth2/examples/auth-oauth2.yaml
 
 report_sizes: true
 
diff --git a/internal/openvpn/client.go b/internal/openvpn/client.go
index 455c7f2..b954c48 100644
--- a/internal/openvpn/client.go
+++ b/internal/openvpn/client.go
@@ -41,26 +41,7 @@ func (c *Client) clientConnect(client connection.Client) error {
 
 	logger.Info("new client connection")
 
-	if slices.Contains(c.conf.OpenVpn.Bypass.CommonNames, client.CommonName) {
-		logger.Info("client bypass authentication")
-
-		var err error
-
-		if c.conf.OpenVpn.AuthTokenUser {
-			tokenUsername := base64.StdEncoding.EncodeToString([]byte(client.CommonName))
-			_, err = c.SendCommandf("client-auth %d %d\npush \"auth-token-user %s\"\nEND", client.Cid, client.Kid, tokenUsername)
-		} else {
-			_, err = c.SendCommandf("client-auth-nt %d %d", client.Cid, client.Kid)
-		}
-
-		if err != nil {
-			logger.Warn(err.Error())
-		}
-
-		return nil
-	}
-
-	if !c.checkClientSsoCapabilities(logger, client) {
+	if c.checkAuthBypass(logger, client) || !c.checkClientSsoCapabilities(logger, client) {
 		return nil
 	}
 
@@ -89,6 +70,23 @@ func (c *Client) clientConnect(client connection.Client) error {
 	return nil
 }
 
+func (c *Client) checkAuthBypass(logger *slog.Logger, client connection.Client) bool {
+	if !slices.Contains(c.conf.OpenVpn.Bypass.CommonNames, client.CommonName) {
+		return false
+	}
+
+	logger.Info("client bypass authentication")
+
+	if c.conf.OpenVpn.AuthTokenUser {
+		tokenUsername := base64.StdEncoding.EncodeToString([]byte(client.CommonName))
+		c.AcceptClientWithToken(logger, state.ClientIdentifier{Cid: client.Cid, Kid: client.Kid}, tokenUsername)
+	} else {
+		c.AcceptClient(logger, state.ClientIdentifier{Cid: client.Cid, Kid: client.Kid})
+	}
+
+	return true
+}
+
 func (c *Client) clientDisconnect(client connection.Client) {
 	c.logger.Info("client disconnected",
 		slog.Uint64("cid", client.Cid),
diff --git a/internal/openvpn/main.go b/internal/openvpn/main.go
index 0ef864f..2df2506 100644
--- a/internal/openvpn/main.go
+++ b/internal/openvpn/main.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/jkroepke/openvpn-auth-oauth2/internal/config"
 	"github.com/jkroepke/openvpn-auth-oauth2/internal/openvpn/connection"
+	"github.com/jkroepke/openvpn-auth-oauth2/internal/state"
 	"github.com/jkroepke/openvpn-auth-oauth2/internal/utils"
 )
 
@@ -154,12 +155,7 @@ func (c *Client) checkClientSsoCapabilities(logger *slog.Logger, client connecti
 
 	errorSsoNotSupported := "OpenVPN Client does not support SSO authentication via webauth"
 	logger.Warn(errorSsoNotSupported)
-
-	_, err := c.SendCommandf(`client-deny %d %d "%s" "%s"`,
-		client.Cid, client.Kid, errorSsoNotSupported, errorSsoNotSupported)
-	if err != nil {
-		c.logger.Warn(err.Error())
-	}
+	c.DenyClient(logger, state.ClientIdentifier{Cid: client.Cid, Kid: client.Kid}, errorSsoNotSupported)
 
 	return false
 }
diff --git a/packaging/config.yaml b/packaging/config.yaml
new file mode 100644
index 0000000..d1f93ec
--- /dev/null
+++ b/packaging/config.yaml
@@ -0,0 +1,10 @@
+# Example:
+# http:
+#   secret: ""
+#   baseurl: http://localhost:9000
+#
+# oauth2:
+#   client:
+#     id:
+#     secret:
+#   issuer:
diff --git a/packaging/preremove.sh b/packaging/preremove.sh
index cb98f2f..6f3933d 100644
--- a/packaging/preremove.sh
+++ b/packaging/preremove.sh
@@ -3,5 +3,5 @@
 set -e
 
 if command -v systemctl >/dev/null 2>&1; then
-    systemctl stop --now openvpn-auth-oauth2
+    systemctl disable -q --now openvpn-auth-oauth2 > /dev/null 2>&1 || true
 fi


Test patch:
diff --git a/internal/openvpn/main_test.go b/internal/openvpn/main_test.go
index b229536..2ca2af2 100644
--- a/internal/openvpn/main_test.go
+++ b/internal/openvpn/main_test.go
@@ -111,7 +111,7 @@ func TestClientFull(t *testing.T) {
 				},
 			},
 			">CLIENT:CONNECT,0,1\r\n>CLIENT:ENV,daemon=0\r\n>CLIENT:ENV,END\r\n",
-			"client-deny 0 1 \"OpenVPN Client does not support SSO authentication via webauth\" \"OpenVPN Client does not support SSO authentication via webauth",
+			"client-deny 0 1 \"OpenVPN Client does not support SSO authentication via webauth\"",
 			nil,
 		},
 		{
@@ -228,7 +228,13 @@ func TestClientFull(t *testing.T) {
 				}
 
 				auth := readLine(t, reader)
-				assert.Contains(t, auth, tt.expect)
+
+				if strings.Contains(tt.expect, "WEB_AUTH") {
+					assert.Contains(t, auth, tt.expect)
+				} else {
+					assert.Equal(t, tt.expect, auth)
+				}
+
 				sendLine(t, conn, "SUCCESS: %s command succeeded\r\n", strings.SplitN(auth, " ", 2)[0])
 
 				if strings.Contains(auth, "client-deny") {