@@ -63,6 +63,9 @@

 #define RESPONSE_VERIFY_SUCCEEDED 12

 #define RESPONSE_VERIFY_FAILED    13

+/* Pointers to functions exported from openvpn */

+static plugin_secure_memzero_t plugin_secure_memzero = NULL;

+

 /*

  * Plugin state, used by foreground

  */

@@ -274,8 +277,10 @@ name_value_match(const char *query, const char *match)

     return strncasecmp(match, query, strlen(match)) == 0;

 }

-OPENVPN_EXPORT openvpn_plugin_handle_t

-openvpn_plugin_open_v1(unsigned int *type_mask, const char *argv[], const char *envp[])

+OPENVPN_EXPORT int

+openvpn_plugin_open_v3(const int v3structver,

+                       struct openvpn_plugin_args_open_in const *args,

+                       struct openvpn_plugin_args_open_return *ret)

 {

     pid_t pid;

     int fd[2];

@@ -285,6 +290,16 @@ openvpn_plugin_open_v1(unsigned int *type_mask, const char *argv[], const char *

     const int base_parms = 2;

+    const char **argv = args->argv;

+    const char **envp = args->envp;

+

+    /* Check API compatibility -- struct version 4 or higher needed */

+    if (v3structver < 4)

+    {

+        fprintf(stderr, "AUTH-PAM: This plugin is incompatible with the running version of OpenVPN\n");

+        return OPENVPN_PLUGIN_FUNC_ERROR;

+    }

+

     /*

      * Allocate our context

      */

@@ -298,7 +313,10 @@ openvpn_plugin_open_v1(unsigned int *type_mask, const char *argv[], const char *

     /*

      * Intercept the --auth-user-pass-verify callback.

      */

-    *type_mask = OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY);

+    ret->type_mask = OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY);

+

+    /* Save global pointers to functions exported from openvpn */

+    plugin_secure_memzero = args->callbacks->plugin_secure_memzero;

     /*

      * Make sure we have two string arguments: the first is the .so name,

@@ -386,7 +404,8 @@ openvpn_plugin_open_v1(unsigned int *type_mask, const char *argv[], const char *

         if (status == RESPONSE_INIT_SUCCEEDED)

         {

             context->foreground_fd = fd[0];

-            return (openvpn_plugin_handle_t) context;

+            ret->handle = (openvpn_plugin_handle_t *) context;

+            return OPENVPN_PLUGIN_FUNC_SUCCESS;

         }

     }

     else

@@ -420,7 +439,7 @@ error:

     {

         free(context);

     }

-    return NULL;

+    return OPENVPN_PLUGIN_FUNC_ERROR;

 }

 OPENVPN_EXPORT int

@@ -785,6 +804,7 @@ pam_server(int fd, const char *service, int verb, const struct name_value_list *

                         goto done;

                     }

                 }

+                plugin_secure_memzero(up.password, sizeof(up.password));

                 break;

             case COMMAND_EXIT:

@@ -802,6 +822,7 @@ pam_server(int fd, const char *service, int verb, const struct name_value_list *

     }

 done:

+    plugin_secure_memzero(up.password, sizeof(up.password));

 #ifdef USE_PAM_DLOPEN

     dlclose_pam();

 #endif

@@ -1,4 +1,4 @@

-openvpn_plugin_open_v1

+openvpn_plugin_open_v3

 openvpn_plugin_func_v1

 openvpn_plugin_close_v1

 openvpn_plugin_abort_v1