From 1465a5922cb754b0b65643d9cff9e8453734b4dc Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Mon, 12 May 2014 10:29:29 +0200
Subject: [PATCH] Added no-udp group configuration option.

That options allows disabling UDP for specific users or groups.
---
 src/group-config.c  | 15 +++++++++++++++
 src/ipc.proto       |  3 ++-
 src/main-auth.c     |  5 +++++
 src/ocserv-args.def |  6 ++++--
 src/vpn.h           |  1 +
 src/worker-auth.c   |  3 +++
 6 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/src/group-config.c b/src/group-config.c
index 5e7cd7f4..090d0bb8 100644
--- a/src/group-config.c
+++ b/src/group-config.c
@@ -40,6 +40,7 @@ struct cfg_options {
 };
 
 static struct cfg_options available_options[] = {
+	{ .name = "no-udp", .type = OPTION_BOOLEAN },
 	{ .name = "route", .type = OPTION_MULTI_LINE },
 	{ .name = "iroute", .type = OPTION_MULTI_LINE },
 	{ .name = "dns", .type = OPTION_MULTI_LINE },
@@ -107,6 +108,18 @@ static struct cfg_options available_options[] = {
 		} \
 	}
 
+#define READ_TF(name, s_name, def) \
+	{ char* tmp_tf = NULL; \
+		READ_RAW_STRING(name, tmp_tf); \
+		if (tmp_tf == NULL) s_name = def; \
+		else { \
+			if (c_strcasecmp(tmp_tf, "true") == 0 || c_strcasecmp(tmp_tf, "yes") == 0) \
+				s_name = 1; \
+			else \
+				s_name = 0; \
+		} \
+		talloc_free(tmp_tf); \
+	}
 
 static int handle_option(const tOptionValue* val)
 {
@@ -151,6 +164,8 @@ struct group_cfg_st *config = &proc->config;
 		prev = val;
 	} while((val = optionNextValue(pov, prev)) != NULL);
 
+	READ_TF("no-udp", config->no_udp, (s->config->udp_port!=0)?0:1);
+
 	READ_RAW_MULTI_LINE("route", config->routes, config->routes_size);
 	READ_RAW_MULTI_LINE("iroute", config->iroutes, config->iroutes_size);
 
diff --git a/src/ipc.proto b/src/ipc.proto
index c9f8dd65..005ecfe7 100644
--- a/src/ipc.proto
+++ b/src/ipc.proto
@@ -97,12 +97,13 @@ message auth_reply_msg
 	repeated string routes = 21;
 	repeated string dns = 22;
 	repeated string nbns = 23;
+	optional bool no_udp = 24 [default = false];
 
 	/* The sid is used when this message is a reply
 	 * to an AUTH_REINIT, to let the worker know of
 	 * any change in the sid.
 	 */
-	optional bytes sid = 24;
+	optional bytes sid = 25;
 }
 
 /* RESUME_FETCH_REQ + RESUME_DELETE_REQ */
diff --git a/src/main-auth.c b/src/main-auth.c
index db22443b..a524bb35 100644
--- a/src/main-auth.c
+++ b/src/main-auth.c
@@ -125,6 +125,11 @@ int send_auth_reply(main_server_st* s, struct proc_st* proc,
 			msg.net_priority = proc->config.net_priority;
 		}
 
+		if (proc->config.no_udp != 0) {
+			msg.has_no_udp = 1;
+			msg.no_udp = proc->config.no_udp;
+		}
+
 		msg.n_dns = proc->config.dns_size;
 		for (i=0;i<proc->config.dns_size;i++) {
 			mslog(s, proc, LOG_DEBUG, "sending dns '%s'", proc->config.dns[i]);
diff --git a/src/ocserv-args.def b/src/ocserv-args.def
index d757faa7..076fb6e6 100644
--- a/src/ocserv-args.def
+++ b/src/ocserv-args.def
@@ -344,11 +344,13 @@ route = 192.168.5.0/255.255.255.0
 # or the groupname.
 # The options allowed in the configuration files are dns, nbns,
 #  ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route,
-#  net-priority and cgroup.
+#  net-priority, no-udp and cgroup.
 #
 # Note that the 'iroute' option allows to add routes on the server
 # based on a user or group. The syntax depends on the input accepted
-# by the commands route-add-cmd and route-del-cmd (see below).
+# by the commands route-add-cmd and route-del-cmd (see below). The no-udp
+# is a boolean option (e.g., no-udp = true), and will prevent a UDP session
+# for that specific user or group.
 
 #config-per-user = /etc/ocserv/config-per-user/
 #config-per-group = /etc/ocserv/config-per-group/
diff --git a/src/vpn.h b/src/vpn.h
index 9cde0df4..6cd2f4d1 100644
--- a/src/vpn.h
+++ b/src/vpn.h
@@ -146,6 +146,7 @@ struct group_cfg_st {
 	size_t tx_per_sec;
 	
 	unsigned net_priority;
+	unsigned no_udp; /* whether to disable UDP for this user */
 };
 
 struct vpn_st {
diff --git a/src/worker-auth.c b/src/worker-auth.c
index becd8a21..12b1113b 100644
--- a/src/worker-auth.c
+++ b/src/worker-auth.c
@@ -331,6 +331,9 @@ static int recv_auth_reply(worker_st * ws, char *txt, size_t max_txt_size)
 			if (msg->has_net_priority)
 				ws->config->net_priority = msg->net_priority;
 
+			if (msg->has_no_udp && msg->no_udp != 0)
+				ws->config->udp_port = 0;
+
 			/* routes */
 			ws->routes_size = msg->n_routes;