pfSense

Looks like it's a known issue with the nature of auth-user-pass-verify that OpenVPN does not plan to address: https://community.openvpn.net/openvpn/ticket/222

But there is a workaround:
http://engineering.freeagent.com/2017/05/22/external-authentication-scripts-in-openvpn-the-right-way/
https://github.com/fac/auth-script-openvpn

Looks like that would need to be converted into a FreeBSD port or added to the OpenVPN port and then the OpenVPN code and auth script would have to be adapted to use it instead, assuming it can do everything we need it to do.

Moving target to 2.4.2 as we need 2.4.1 sooner than anticipated.

I was finally able to confirm the problem, I'm looking at that auth_script plugin now, but it will require some significant changes to the auth script and it doesn't compile out of the box on FreeBSD. Probably going to need more time to analyze this than we have for 2.4.2 given the nature of how it operates and what is required, so bumping it forward for now.

Sorry to have to kick this to ++version but the work required cannot be squeezed into the 2.4.3 schedule

I'm really close to having this working on the 2.4.2-RELEASE code base, however, I'm running into an issue and I'm hoping someone a bit more familiar with the integration of pfsense & openvpn might be able to help.

1. Added a new asynrchonous script designed to be called via a OpenVPN plugin: https://github.com/pdemonaco/pfsense/blob/master/src/usr/local/sbin/ovpn_auth_verify_async
2. Updated the config file generation such that it used the plugin directive instead of auth-user-pass-verify: https://github.com/pdemonaco/pfsense/blob/master/src/etc/inc/openvpn.inc
3. Modified the auth-script plugin to allow arguments to be passed to the target script: https://github.com/pdemonaco/auth-script-openvpn/tree/pass-script-arguments

Note that I made the same changes to the 2.4.2-RELEASE version of the openvpn.inc file to actually execute my tests as it differs from the current master.

While the call to the authentication module occurs correctly and returns the proper result something goes wrong after the plugin notifies the core process of the result. The log excerpt below begins at the point where the authentication process completes with a successful auth.

Feb 23 21:11:28 d0-nfw2533 openvpn[29675]: event_wait : Interrupted system call (code=4)
Feb 23 21:11:29 d0-nfw2533 openvpn[29675]: <client-ip>:43518 UDPv4 READ [56] from [AF_INET]<client-ip>:43518: P_CONTROL_V1 kid=0 [ ] pid=5 DATA len=42
Feb 23 21:11:29 d0-nfw2533 openvpn[29675]: <client-ip>:43518 PUSH: Received control message: 'PUSH_REQUEST'
Feb 23 21:11:29 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 MULTI_sva: pool returned IPv4=172.29.128.2, IPv6=(Not enabled)
Feb 23 21:11:29 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 WARNING: Failed running command (--client-connect): external program fork failed
Feb 23 21:11:29 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 UDPv4 WRITE [22] to [AF_INET]<client-ip>:43518: P_ACK_V1 kid=0 [ 5 ]
Feb 23 21:11:35 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 UDPv4 READ [56] from [AF_INET]<client-ip>:43518: P_CONTROL_V1 kid=0 [ ] pid=6 DATA len=42
Feb 23 21:11:35 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 PUSH: Received control message: 'PUSH_REQUEST'
Feb 23 21:11:35 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 Delayed exit in 5 seconds
Feb 23 21:11:35 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 SENT CONTROL [<client-user>]: 'AUTH_FAILED' (status=1)
Feb 23 21:11:35 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 UDPv4 WRITE [22] to [AF_INET]<client-ip>:43518: P_ACK_V1 kid=0 [ 6 ]
Feb 23 21:11:35 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 UDPv4 WRITE [55] to [AF_INET]<client-ip>:43518: P_CONTROL_V1 kid=0 [ ] pid=7 DATA len=41
Feb 23 21:11:37 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 UDPv4 WRITE [55] to [AF_INET]<client-ip>:43518: P_CONTROL_V1 kid=0 [ ] pid=7 DATA len=41
Feb 23 21:11:40 d0-nfw2533 openvpn[29675]: <client-user>/<client-ip>:43518 SIGTERM[soft,delayed-exit] received, client-instance exiting

I believe the "event_wait" message may be the normal indication of the completion of the auth request as it is immediately followed by an attempt to allocate an IP to the client. The part which confuses me is the fork failure messageon the client connect command. From what I can tell the script referenced in the configuration file is not actually being called.

Any suggestions would be appreciated - thanks!

PR has been merged. Thanks!