@@ -130,7 +130,8 @@ extern "C" {

 #define OPENVPN_PLUGIN_ENABLE_PF                11

 #define OPENVPN_PLUGIN_ROUTE_PREDOWN            12

 #define OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER     13

-#define OPENVPN_PLUGIN_N                        14

+#define OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2  14

+#define OPENVPN_PLUGIN_N                        15

 /*

  * Build a mask out of a set of plug-in types.

@@ -2111,36 +2111,48 @@ multi_client_connect_call_plugin_v2(struct multi_context *m,

                                     bool deferred,

                                     unsigned int *option_types_found)

 {

-    if (deferred)

-    {

-        return CC_RET_FAILED;

-    }

     enum client_connect_return ret = CC_RET_SKIPPED;

 #ifdef ENABLE_PLUGIN

     ASSERT(m);

     ASSERT(mi);

     ASSERT(option_types_found);

+    int call = deferred ? OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 :

+               OPENVPN_PLUGIN_CLIENT_CONNECT_V2;

     /* V2 callback, use a plugin_return struct for passing back return info */

-    if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2))

+    if (plugin_defined(mi->context.plugins, call))

     {

         struct plugin_return pr;

         plugin_return_init(&pr);

-        if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2,

-                        NULL, &pr, mi->context.c2.es)

-            != OPENVPN_PLUGIN_FUNC_SUCCESS)

+        int plug_ret = plugin_call(mi->context.plugins, call,

+                                   NULL, &pr, mi->context.c2.es);

+        if (plug_ret == OPENVPN_PLUGIN_FUNC_SUCCESS)

         {

-            msg(M_WARN, "WARNING: client-connect-v2 plugin call failed");

-            ret = CC_RET_FAILED;

+            multi_client_connect_post_plugin(m, mi, &pr, option_types_found);

+            ret = CC_RET_SUCCEEDED;

+        }

+        else if (plug_ret == OPENVPN_PLUGIN_FUNC_DEFERRED)

+        {

+            ret = CC_RET_DEFERRED;

+            if (!(plugin_defined(mi->context.plugins,

+                                 OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2)))

+            {

+                msg(M_WARN, "A plugin that defers from the "

+                    "OPENVPN_PLUGIN_CLIENT_CONNECT_V2 call must also "

+                    "declare support for "

+                    "OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2");

+                ret = CC_RET_FAILED;

+            }

         }

         else

         {

-            multi_client_connect_post_plugin(m, mi, &pr, option_types_found);

-            ret = CC_RET_SUCCEEDED;

+            msg(M_WARN, "WARNING: client-connect-v2 plugin call failed");

+            ret = CC_RET_FAILED;

         }

+

         plugin_return_free(&pr);

     }

 #endif /* ifdef ENABLE_PLUGIN */

@@ -107,6 +107,9 @@ plugin_type_name(const int type)

         case OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER:

             return "PLUGIN_CLIENT_CONNECT_DEFER";

+        case OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2:

+            return "PLUGIN_CLIENT_CONNECT_DEFER_V2";

+

         case OPENVPN_PLUGIN_CLIENT_DISCONNECT:

             return "PLUGIN_CLIENT_DISCONNECT";