GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 16:57:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Added the match-tls-and-dtls-ciphers config option

Browse Source 
That when enable, it will prevent any DTLS negotiation other than the
DTLS-PSK, and will ensure that the cipher/mac combination matches on
the TLS and DTLS connections. The cisco-client-compat config option
when disabled, it will disable the pre-draft-DTLS negotiation.
This commit is contained in:
Nikos Mavrogiannopoulos
2016-09-13 13:25:35 +02:00
parent 56e82a2f31
commit 555d2cb03e
6 changed files with 51 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/config.c
View File

@@ -185,6 +185,7 @@ static struct cfg_options available_options[] = {
{ .name = "config-per-group", .type = OPTION_STRING, .mandatory = 0 },
{ .name = "default-user-config", .type = OPTION_STRING, .mandatory = 0 },
{ .name = "default-group-config", .type = OPTION_STRING, .mandatory = 0 },
{ .name = "match-tls-and-dtls-ciphers", .type = OPTION_BOOLEAN, .mandatory = 0 },
};
static const tOptionValue* get_option(const char* name, unsigned * mand)
@@ -815,6 +816,7 @@ size_t urlfw_size = 0;
}
READ_STRING("banner", config->banner);
READ_TF("cisco-client-compat", config->cisco_client_compat, 0);
READ_TF("always-require-cert", force_cert_auth, 1);
if (force_cert_auth == 0) {
@@ -822,6 +824,14 @@ size_t urlfw_size = 0;
config->cisco_client_compat = 1;
}
READ_TF("match-tls-and-dtls-ciphers", config->match_dtls_and_tls, 0);
if (config->match_dtls_and_tls) {
if (config->cisco_client_compat) {
fprintf(stderr, "note that 'match-tls-and-dtls-ciphers' cannot be applied when 'cisco-client-compat' is on; disabling\n");
}
config->cisco_client_compat = 0;
}
READ_TF("compression", config->enable_compression, 0);
READ_NUMERIC("no-compress-limit", config->no_compress_limit);
if (config->no_compress_limit == 0)