GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-14 02:22:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

undid ed5b177691

Browse Source 
It is not currently possible to reload only a part of the
configuration. If the back-end module changes, the server will
bail out instead.
This commit is contained in:
Nikos Mavrogiannopoulos
2014-12-10 15:28:14 +01:00
parent c15a7befbb
commit 065753bd57
4 changed files with 80 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/config.c
+65 -68
View File
@@ -407,79 +407,75 @@ unsigned force_cert_auth;
prev = val; prev = val;
} while((val = optionNextValue(pov, prev)) != NULL); } while((val = optionNextValue(pov, prev)) != NULL);
/* authentication information is only read on first load, as config->sup_config_type = SUP_CONFIG_FILE;
* it cannot be safely switched */
if (reload == 0) {
config->sup_config_type = SUP_CONFIG_FILE;
READ_MULTI_LINE("auth", auth, auth_size); READ_MULTI_LINE("auth", auth, auth_size);
for (j=0;j<auth_size;j++) { for (j=0;j<auth_size;j++) {
if (c_strncasecmp(auth[j], "pam", 3) == 0) { if (c_strncasecmp(auth[j], "pam", 3) == 0) {
config->auth_additional = get_brackets_string(config, auth[j]+3); config->auth_additional = get_brackets_string(config, auth[j]+3);
if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) { if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
fprintf(stderr, "You cannot mix multiple username/password authentication methods\n"); fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
exit(1);
}
#ifdef HAVE_PAM
config->auth_types |= amod->type;
amod = &pam_auth_funcs;
#else
fprintf(stderr, "PAM support is disabled\n");
exit(1);
#endif
} else if (strncasecmp(auth[j], "plain", 5) == 0) {
if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
exit(1);
}
config->auth_additional = get_brackets_string(config, auth[j]+5);
if (config->auth_additional == NULL) {
fprintf(stderr, "Format error in %s\n", auth[j]);
exit(1);
}
amod = &plain_auth_funcs;
config->auth_types |= amod->type;
} else if (strncasecmp(auth[j], "radius", 6) == 0) {
const char *p;
if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
exit(1);
}
#ifdef HAVE_RADIUS
config->auth_additional = get_brackets_string1(config, auth[j]+6);
if (config->auth_additional == NULL) {
fprintf(stderr, "No configuration specified; error in %s\n", auth[j]);
exit(1);
}
p = get_brackets_string2(config, auth[j]+6);
if (p != NULL) {
if (strcasecmp(p, "groupconfig") != 0) {
fprintf(stderr, "No known configuration option: %s\n", p);
exit(1);
}
config->sup_config_type = SUP_CONFIG_RADIUS;
}
amod = &radius_auth_funcs;
config->auth_types |= amod->type;
#else
fprintf(stderr, "Radius support is disabled\n");
exit(1);
#endif
} else if (c_strcasecmp(auth[j], "certificate") == 0) {
config->auth_types |= AUTH_TYPE_CERTIFICATE;
} else if (c_strcasecmp(auth[j], "certificate[optional]") == 0) {
config->auth_types |= AUTH_TYPE_CERTIFICATE_OPT;
} else {
fprintf(stderr, "Unknown auth method: %s\n", auth[j]);
exit(1); exit(1);
} }
talloc_free(auth[j]); #ifdef HAVE_PAM
config->auth_types |= amod->type;
amod = &pam_auth_funcs;
#else
fprintf(stderr, "PAM support is disabled\n");
exit(1);
#endif
} else if (strncasecmp(auth[j], "plain", 5) == 0) {
if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
exit(1);
}
config->auth_additional = get_brackets_string(config, auth[j]+5);
if (config->auth_additional == NULL) {
fprintf(stderr, "Format error in %s\n", auth[j]);
exit(1);
}
amod = &plain_auth_funcs;
config->auth_types |= amod->type;
} else if (strncasecmp(auth[j], "radius", 6) == 0) {
const char *p;
if ((config->auth_types & AUTH_TYPE_USERNAME_PASS) != 0) {
fprintf(stderr, "You cannot mix multiple username/password authentication methods\n");
exit(1);
}
#ifdef HAVE_RADIUS
config->auth_additional = get_brackets_string1(config, auth[j]+6);
if (config->auth_additional == NULL) {
fprintf(stderr, "No configuration specified; error in %s\n", auth[j]);
exit(1);
}
p = get_brackets_string2(config, auth[j]+6);
if (p != NULL) {
if (strcasecmp(p, "groupconfig") != 0) {
fprintf(stderr, "No known configuration option: %s\n", p);
exit(1);
}
config->sup_config_type = SUP_CONFIG_RADIUS;
}
amod = &radius_auth_funcs;
config->auth_types |= amod->type;
#else
fprintf(stderr, "Radius support is disabled\n");
exit(1);
#endif
} else if (c_strcasecmp(auth[j], "certificate") == 0) {
config->auth_types |= AUTH_TYPE_CERTIFICATE;
} else if (c_strcasecmp(auth[j], "certificate[optional]") == 0) {
config->auth_types |= AUTH_TYPE_CERTIFICATE_OPT;
} else {
fprintf(stderr, "Unknown auth method: %s\n", auth[j]);
exit(1);
} }
talloc_free(auth); talloc_free(auth[j]);
} }
talloc_free(auth);
/* When adding allocated data, remember to modify /* When adding allocated data, remember to modify
* reload_cfg_file(); * reload_cfg_file();
@@ -931,6 +927,7 @@ void print_version(tOptions *opts, tOptDesc *desc)
void reload_cfg_file(void *pool, struct cfg_st* config) void reload_cfg_file(void *pool, struct cfg_st* config)
{ {
clear_cfg_file(config); clear_cfg_file(config);
memset(config, 0, sizeof(*config)); memset(config, 0, sizeof(*config));
parse_cfg_file(cfg_file, config, 1); parse_cfg_file(cfg_file, config, 1);
src/sec-mod-auth.c
+12 -2
View File
@@ -53,12 +53,22 @@
static const struct auth_mod_st *module = NULL; static const struct auth_mod_st *module = NULL;
void sec_auth_init(void *pool, struct cfg_st *config) void sec_auth_init(sec_mod_st * sec, struct cfg_st *config)
{ {
module = get_auth_mod(); module = get_auth_mod();
if (module && module->global_init) { if (module && module->global_init) {
module->global_init(pool, config->auth_additional); module->global_init(sec, config->auth_additional);
}
}
void sec_auth_reinit(sec_mod_st * sec, struct cfg_st *config)
{
if (module) {
if (module != get_auth_mod()) {
seclog(sec, LOG_ERR, "Cannot change authentication method on reload");
exit(1);
}
} }
} }
src/sec-mod.c
+1
View File
@@ -358,6 +358,7 @@ static void check_other_work(sec_mod_st *sec)
if (need_reload) { if (need_reload) {
seclog(sec, LOG_DEBUG, "reloading configuration"); seclog(sec, LOG_DEBUG, "reloading configuration");
reload_cfg_file(sec, sec->config); reload_cfg_file(sec, sec->config);
sec_auth_reinit(sec, sec->config);
need_reload = 0; need_reload = 0;
} }
src/sec-mod.h
+2 -1
View File
@@ -89,7 +89,8 @@ void cleanup_client_entries(sec_mod_st *sec);
} }
#endif #endif
void sec_auth_init(void *pool, struct cfg_st *config); void sec_auth_init(sec_mod_st *sec, struct cfg_st *config);
void sec_auth_reinit(sec_mod_st *sec, struct cfg_st *config);
int handle_sec_auth_init(int cfd, sec_mod_st *sec, const SecAuthInitMsg * req); int handle_sec_auth_init(int cfd, sec_mod_st *sec, const SecAuthInitMsg * req);
int handle_sec_auth_cont(int cfd, sec_mod_st *sec, const SecAuthContMsg * req); int handle_sec_auth_cont(int cfd, sec_mod_st *sec, const SecAuthContMsg * req);