GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 00:37:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Camouflage functionality

Browse Source 
This adds a "camouflage" functionality (looking and acting like an ordinary web server),
to prevent OCserv installations from being automatically scanned or blocked with active probing techniques.

Signed-off-by: Kirill Ovchinnikov <kirill.ovchinn@gmail.com>
This commit is contained in:
Kirill Ovchinnikov
2023-05-26 21:13:41 +02:00
committed by Nikos Mavrogiannopoulos
parent 1ecdf35494
commit 85fdf7d2e6
13 changed files with 608 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -1,5 +1,6 @@
* Version 1.1.8 (unreleased)
- Added "Camouflage" functionality that makes ocserv look
like a web server to unauthorized parties.
* Version 1.1.7 (released 2023-05-07)
- Emit a LOG_ERR error message with plain authentication fails

18
doc/sample.config
View File

@@ -704,6 +704,24 @@ dtls-legacy = true
# currently only understood by Anyconnect clients.
client-bypass-protocol = false
# The following options are related to server camouflage (hidden service)
# This option allows you to enable the camouflage feature of ocserv that makes it look
# like a web server to unauthorized parties.
# With "camouflage" enabled, connection to the VPN can be established only if the client provided a specific
# "secret string" in the connection URL, e.g. "https://example.com/?mysecretkey",
# otherwise the server will return HTTP error for all requests.
camouflage = false
# The URL prefix that should be set on the client (after '?' sign) to pass through the camouflage check,
# e.g. in case of 'mysecretkey', the server URL on the client should be like "https://example.com/?mysecretkey".
camouflage_secret = "mysecretkey"
# Defines the realm (browser prompt) for HTTP authentication.
# If no realm is set, the server will return 404 Not found error instead of 401 Unauthorized.
# Better change it from the default value to avoid fingerprinting.
camouflage_realm = "Restricted Content"
#Advanced options
# Option to allow sending arbitrary custom headers to the client after

6
src/config.c
View File

@@ -1129,6 +1129,12 @@ static int cfg_ini_handler(void *_ctx, const char *section, const char *name, co
READ_STRING(config->default_user_conf);
} else if (strcmp(name, "default-group-config") == 0) {
READ_STRING(config->default_group_conf);
} else if (strcmp(name, "camouflage") == 0) {
READ_TF(config->camouflage);
} else if (strcmp(name, "camouflage_secret") == 0) {
READ_STRING(config->camouflage_secret);
} else if (strcmp(name, "camouflage_realm") == 0) {
READ_STRING(config->camouflage_realm);
} else {
if (reload == 0)
fprintf(stderr, WARNSTR"skipping unknown option '%s'\n", name);

4
src/vpn.h
View File

@@ -358,6 +358,10 @@ struct cfg_st {
/* holds a usage count of holders of pointers in this struct */
int *usage_count;
bool camouflage;
char *camouflage_secret;
char *camouflage_realm;
};
struct perm_cfg_st {

6
src/worker-auth.c
View File

@@ -919,6 +919,12 @@ void cookie_authenticate_or_exit(worker_st *ws)
ret = auth_cookie(ws, ws->cookie, sizeof(ws->cookie));
if (ret < 0) {
oclog(ws, LOG_WARNING, "failed cookie authentication attempt");
if (WSCONFIG(ws)->camouflage && ws->camouflage_check_passed == 0)
{
cstp_puts(ws,
"HTTP/1.1 405 Method Not Allowed\r\n\r\n");
}
else
if (ret == ERR_AUTH_FAIL) {
cstp_puts(ws,
"HTTP/1.1 401 Cookie is not acceptable\r\n\r\n");

12
src/worker-http-handlers.c
View File

@@ -39,6 +39,7 @@
#include <tlslib.h>
#define HTML_404 "<html><body><h1>404 Not Found</h1></body></html>\r\n"
#define HTML_401 "<html><body><h1>401 Unauthorized</h1></body></html>\r\n"
int response_404(worker_st *ws, unsigned http_ver)
{
@@ -50,6 +51,17 @@ int response_404(worker_st *ws, unsigned http_ver)
return 0;
}
int response_401(worker_st *ws, unsigned http_ver, char* realm)
{
if (cstp_printf(ws, "HTTP/1.%u 401 Unauthorized\r\n", http_ver) < 0 ||
cstp_printf(ws, "WWW-Authenticate: Basic realm=\"%s\"\r\n", realm) < 0 ||
cstp_printf(ws, "Content-Length: %u\r\n", (unsigned)(sizeof(HTML_401) - 1)) < 0 ||
cstp_puts (ws, "Connection: close\r\n\r\n") < 0 ||
cstp_puts (ws, HTML_401) < 0)
return -1;
return 0;
}
static int send_headers(worker_st *ws, unsigned http_ver, const char *content_type,
unsigned content_length)
{

29
src/worker-vpn.c
View File

@@ -756,6 +756,20 @@ static void peek_client_hello(struct worker_st *ws, gnutls_session_t session, in
}
#endif
void check_camouflage_url(struct worker_st *ws)
{
if (WSCONFIG(ws)->camouflage_secret == NULL)
return;
char* url_camouflage_part = strchr(ws->req.url, '?');
if (url_camouflage_part
&& !strcmp(url_camouflage_part + 1, WSCONFIG(ws)->camouflage_secret))
{
*url_camouflage_part = '\0';
ws->camouflage_check_passed = 1;
}
}
/* vpn_server:
* @ws: an initialized worker structure
*
@@ -927,6 +941,21 @@ void vpn_server(struct worker_st *ws)
}
} while (ws->req.headers_complete == 0);
if ((parser.method == HTTP_GET || parser.method == HTTP_POST) &&
(WSCONFIG(ws)->camouflage && ws->camouflage_check_passed == 0))
{
check_camouflage_url(ws);
if (ws->camouflage_check_passed == 0)
{
oclog(ws, LOG_INFO, "Secret not found in URL, declining...");
if (WSCONFIG(ws)->camouflage_realm)
response_401(ws, parser.http_minor, WSCONFIG(ws)->camouflage_realm);
else
response_404(ws, parser.http_minor);
goto finish;
}
}
if (parser.method == HTTP_GET) {
oclog(ws, LOG_HTTP_DEBUG, "HTTP GET %s", ws->req.url);
fn = http_get_url_handler(ws->req.url);

2
src/worker.h
View File

@@ -325,6 +325,7 @@ typedef struct worker_st {
uint32_t samples[LATENCY_SAMPLE_SIZE];
} latency;
#endif
bool camouflage_check_passed;
} worker_st;
void vpn_server(struct worker_st* ws);
@@ -341,6 +342,7 @@ int get_ca_handler(worker_st * ws, unsigned http_ver);
int get_ca_der_handler(worker_st * ws, unsigned http_ver);
int response_404(worker_st *ws, unsigned http_ver);
int response_401(worker_st *ws, unsigned http_ver, char* realm);
int get_empty_handler(worker_st *server, unsigned http_ver);
#ifdef ANYCONNECT_CLIENT_COMPAT
int get_config_handler(worker_st *ws, unsigned http_ver);

5
tests/Makefile.am
View File

@@ -45,7 +45,7 @@ EXTRA_DIST = certs/ca-key.pem certs/ca.pem ns.sh common.sh certs/server-cert.pem
data/haproxy-proxyproto.cfg scripts/proxy-connectscript data/haproxy-proxyproto-v1.config \
data/haproxy-proxyproto-v1.cfg scripts/proxy-connectscript-v1 data/test-multiple-client-ip.config \
data/test-client-bypass-protocol.config asan.supp certs/ca.tmpl certs/server-cert.tmpl \
certs/user-cert.tmpl
certs/user-cert.tmpl data/test-camouflage.config data/test-camouflage-norealm.config
xfail_scripts =
dist_check_SCRIPTS = ocpasswd-test
@@ -62,7 +62,8 @@ dist_check_SCRIPTS += haproxy-connect test-iroute test-multi-cookie test-pass-sc
test-cookie-invalidation test-user-config test-append-routes test-ban \
multiple-routes json test-udp-listen-host test-max-same-1 test-script-multi-user \
apple-ios ipv6-iface test-namespace-listen disconnect-user disconnect-user2 \
ping-leases test-ban-local test-client-bypass-protocol ipv6-small-net
ping-leases test-ban-local test-client-bypass-protocol ipv6-small-net test-camouflage \
test-camouflage-norealm
if RADIUS_ENABLED
dist_check_SCRIPTS += radius-group radius-otp

191
tests/data/test-camouflage-norealm.config Normal file
View File

@@ -0,0 +1,191 @@
# User authentication method. Could be set multiple times and in that case
# all should succeed.
# Options: certificate, pam.
#auth = "certificate"
auth = "plain[./data/test1.passwd]"
#auth = "pam"
isolate-workers = @ISOLATE_WORKERS@
# A banner to be displayed on clients
#banner = "Welcome"
# Use listen-host to limit to specific IPs or to the IPs of a provided hostname.
#listen-host = [IP|HOSTNAME]
use-dbus = no
# Limit the number of clients. Unset or set to zero for unlimited.
#max-clients = 1024
max-clients = 16
# Limit the number of client connections to one every X milliseconds
# (X is the provided value). Set to zero for no limit.
#rate-limit-ms = 100
# Limit the number of identical clients (i.e., users connecting multiple times)
# Unset or set to zero for unlimited.
max-same-clients = 2
# TCP and UDP port number
tcp-port = @PORT@
udp-port = @PORT@
# Keepalive in seconds
keepalive = 32400
# Dead peer detection in seconds
dpd = 440
# MTU discovery (DPD must be enabled)
try-mtu-discovery = false
# The key and the certificates of the server
# The key may be a file, or any URL supported by GnuTLS (e.g.,
# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user
# or pkcs11:object=my-vpn-key;object-type=private)
#
# There may be multiple certificate and key pairs and each key
# should correspond to the preceding certificate.
server-cert = ./certs/server-cert.pem
server-key = ./certs/server-key.pem
# Diffie-Hellman parameters. Only needed if you require support
# for the DHE ciphersuites (by default this server supports ECDHE).
# Can be generated using:
# certtool --generate-dh-params --outfile /path/to/dh.pem
#dh-params = /path/to/dh.pem
# If you have a certificate from a CA that provides an OCSP
# service you may provide a fresh OCSP status response within
# the TLS handshake. That will prevent the client from connecting
# independently on the OCSP server.
# You can update this response periodically using:
# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response
# Make sure that you replace the following file in an atomic way.
#ocsp-response = /path/to/ocsp.der
# In case PKCS #11 or TPM keys are used the PINs should be available
# in files. The srk-pin-file is applicable to TPM keys only (It's the storage
# root key).
#pin-file = /path/to/pin.txt
#srk-pin-file = /path/to/srkpin.txt
# The Certificate Authority that will be used
# to verify clients if certificate authentication
# is set.
#ca-cert = /path/to/ca.pem
# The object identifier that will be used to read the user ID in the client certificate.
# The object identifier should be part of the certificate's DN
# Useful OIDs are:
# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1
#cert-user-oid = 0.9.2342.19200300.100.1.1
# The object identifier that will be used to read the user group in the client
# certificate. The object identifier should be part of the certificate's DN
# Useful OIDs are:
# OU (organizational unit) = 2.5.4.11
#cert-group-oid = 2.5.4.11
# A revocation list of ca-cert is set
#crl = /path/to/crl.pem
# GnuTLS priority string
tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
# To enforce perfect forward secrecy (PFS) on the main channel.
#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA"
# The time (in seconds) that a client is allowed to stay connected prior
# to authentication
auth-timeout = 40
# The time (in seconds) that a client is not allowed to reconnect after
# a failed authentication attempt.
#min-reauth-time = 2
# Cookie timeout (in seconds)
# Once a client is authenticated he's provided a cookie with
# which he can reconnect. That cookie will be invalided if not
# used within this timeout value. On a user disconnection, that
# cookie will also be active for this time amount prior to be
# invalid. That should allow a reasonable amount of time for roaming
# between different networks.
cookie-timeout = 30
# Script to call when a client connects and obtains an IP
# Parameters are passed on the environment.
# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client),
# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
# may be "connect" or "disconnect".
#connect-script = /usr/bin/myscript
#disconnect-script = /usr/bin/myscript
# UTMP
use-utmp = true
# PID file
pid-file = /var/run/ocserv.pid
# The default server directory. Does not require any devices present.
#chroot-dir = /path/to/chroot
# socket file used for IPC, will be appended with .PID
# It must be accessible within the chroot environment (if any)
socket-file = /var/run/ocserv-socket
# The user the worker processes will be run as. It should be
# unique (no other services run as this user).
run-as-user = nobody
run-as-group = daemon
# Network settings
device = vpns
# The default domain to be advertised
default-domain = example.com
ipv4-network = 192.168.1.0
ipv4-netmask = 255.255.255.0
# Use the keyword local to advertise the local P-t-P address as DNS server
dns = 192.168.1.1
# The NBNS server (if any)
#ipv4-nbns = 192.168.2.3
ipv6-network = fe80::
ipv6-prefix = 16
#ipv6-dns =
# Prior to leasing any IP from the pool ping it to verify that
# it is not in use by another (unrelated to this server) host.
ping-leases = false
# Leave empty to assign the default MTU of the device
# mtu =
route = 192.168.1.0/255.255.255.0
#route = 192.168.5.0/255.255.255.0
#
# The following options are for (experimental) AnyConnect client
# compatibility. They are only available if the server is built
# with --enable-anyconnect
#
# Client profile xml. A sample file exists in doc/profile.xml.
# This file must be accessible from inside the worker's chroot.
# The profile is ignored by the openconnect client.
#user-profile = profile.xml
# Unless set to false it is required for clients to present their
# certificate even if they are authenticating via a previously granted
# cookie. Legacy CISCO clients do not do that, and thus this option
# should be set for them.
#always-require-cert = false
camouflage = true
camouflage_secret = "mysecretkey"

192
tests/data/test-camouflage.config Normal file
View File

@@ -0,0 +1,192 @@
# User authentication method. Could be set multiple times and in that case
# all should succeed.
# Options: certificate, pam.
#auth = "certificate"
auth = "plain[./data/test1.passwd]"
#auth = "pam"
isolate-workers = @ISOLATE_WORKERS@
# A banner to be displayed on clients
#banner = "Welcome"
# Use listen-host to limit to specific IPs or to the IPs of a provided hostname.
#listen-host = [IP|HOSTNAME]
use-dbus = no
# Limit the number of clients. Unset or set to zero for unlimited.
#max-clients = 1024
max-clients = 16
# Limit the number of client connections to one every X milliseconds
# (X is the provided value). Set to zero for no limit.
#rate-limit-ms = 100
# Limit the number of identical clients (i.e., users connecting multiple times)
# Unset or set to zero for unlimited.
max-same-clients = 2
# TCP and UDP port number
tcp-port = @PORT@
udp-port = @PORT@
# Keepalive in seconds
keepalive = 32400
# Dead peer detection in seconds
dpd = 440
# MTU discovery (DPD must be enabled)
try-mtu-discovery = false
# The key and the certificates of the server
# The key may be a file, or any URL supported by GnuTLS (e.g.,
# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user
# or pkcs11:object=my-vpn-key;object-type=private)
#
# There may be multiple certificate and key pairs and each key
# should correspond to the preceding certificate.
server-cert = ./certs/server-cert.pem
server-key = ./certs/server-key.pem
# Diffie-Hellman parameters. Only needed if you require support
# for the DHE ciphersuites (by default this server supports ECDHE).
# Can be generated using:
# certtool --generate-dh-params --outfile /path/to/dh.pem
#dh-params = /path/to/dh.pem
# If you have a certificate from a CA that provides an OCSP
# service you may provide a fresh OCSP status response within
# the TLS handshake. That will prevent the client from connecting
# independently on the OCSP server.
# You can update this response periodically using:
# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response
# Make sure that you replace the following file in an atomic way.
#ocsp-response = /path/to/ocsp.der
# In case PKCS #11 or TPM keys are used the PINs should be available
# in files. The srk-pin-file is applicable to TPM keys only (It's the storage
# root key).
#pin-file = /path/to/pin.txt
#srk-pin-file = /path/to/srkpin.txt
# The Certificate Authority that will be used
# to verify clients if certificate authentication
# is set.
#ca-cert = /path/to/ca.pem
# The object identifier that will be used to read the user ID in the client certificate.
# The object identifier should be part of the certificate's DN
# Useful OIDs are:
# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1
#cert-user-oid = 0.9.2342.19200300.100.1.1
# The object identifier that will be used to read the user group in the client
# certificate. The object identifier should be part of the certificate's DN
# Useful OIDs are:
# OU (organizational unit) = 2.5.4.11
#cert-group-oid = 2.5.4.11
# A revocation list of ca-cert is set
#crl = /path/to/crl.pem
# GnuTLS priority string
tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
# To enforce perfect forward secrecy (PFS) on the main channel.
#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA"
# The time (in seconds) that a client is allowed to stay connected prior
# to authentication
auth-timeout = 40
# The time (in seconds) that a client is not allowed to reconnect after
# a failed authentication attempt.
#min-reauth-time = 2
# Cookie timeout (in seconds)
# Once a client is authenticated he's provided a cookie with
# which he can reconnect. That cookie will be invalided if not
# used within this timeout value. On a user disconnection, that
# cookie will also be active for this time amount prior to be
# invalid. That should allow a reasonable amount of time for roaming
# between different networks.
cookie-timeout = 30
# Script to call when a client connects and obtains an IP
# Parameters are passed on the environment.
# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client),
# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
# may be "connect" or "disconnect".
#connect-script = /usr/bin/myscript
#disconnect-script = /usr/bin/myscript
# UTMP
use-utmp = true
# PID file
pid-file = /var/run/ocserv.pid
# The default server directory. Does not require any devices present.
#chroot-dir = /path/to/chroot
# socket file used for IPC, will be appended with .PID
# It must be accessible within the chroot environment (if any)
socket-file = /var/run/ocserv-socket
# The user the worker processes will be run as. It should be
# unique (no other services run as this user).
run-as-user = nobody
run-as-group = daemon
# Network settings
device = vpns
# The default domain to be advertised
default-domain = example.com
ipv4-network = 192.168.1.0
ipv4-netmask = 255.255.255.0
# Use the keyword local to advertise the local P-t-P address as DNS server
dns = 192.168.1.1
# The NBNS server (if any)
#ipv4-nbns = 192.168.2.3
ipv6-network = fe80::
ipv6-prefix = 16
#ipv6-dns =
# Prior to leasing any IP from the pool ping it to verify that
# it is not in use by another (unrelated to this server) host.
ping-leases = false
# Leave empty to assign the default MTU of the device
# mtu =
route = 192.168.1.0/255.255.255.0
#route = 192.168.5.0/255.255.255.0
#
# The following options are for (experimental) AnyConnect client
# compatibility. They are only available if the server is built
# with --enable-anyconnect
#
# Client profile xml. A sample file exists in doc/profile.xml.
# This file must be accessible from inside the worker's chroot.
# The profile is ignored by the openconnect client.
#user-profile = profile.xml
# Unless set to false it is required for clients to present their
# certificate even if they are authenticating via a previously granted
# cookie. Legacy CISCO clients do not do that, and thus this option
# should be set for them.
#always-require-cert = false
camouflage = true
camouflage_secret = "mysecretkey"
camouflage_realm = "Please enter password"

84
tests/test-camouflage Executable file
View File

@@ -0,0 +1,84 @@
#!/bin/sh
#
# Copyright (C) 2013 Nikos Mavrogiannopoulos
# Copyright (C) 2023 Kirill Ovchinnikov
#
# This file is part of ocserv.
#
# ocserv is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# ocserv is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GnuTLS; if not, write to the Free Software Foundation,
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
SERV="${SERV:-../src/ocserv}"
srcdir=${srcdir:-.}
CLIENTPIDFILE=openconnect-pid.$$.tmp
SECRETURL="/?mysecretkey"
SERVERCERT="pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8="
. `dirname $0`/common.sh
eval "${GETPORT}"
echo "Testing connection to the server with camouflage enabled"
update_config test-camouflage.config
launch_server -d 1 -f -c ${CONFIG} & PID=$!
wait_server ${PID}
echo "Checking with CURL that server returns us HTTP 401 for GET"
http_result=$(curl --insecure https://localhost:${PORT} --output /dev/null --silent --write-out "%{http_code}")
if [ "${http_result}" != "401" ]; then
fail ${PID} "Server returned ${http_result} instead of 401 for GET"
fi
echo "OK"
echo "Checking with CURL that server returns us HTTP 403 for POST"
http_result=$(curl -X POST -F 'test=test' --insecure https://localhost:${PORT} --output /dev/null --silent --write-out "%{http_code}")
if [ "${http_result}" != "401" ]; then
fail ${PID} "Server returned ${http_result} instead of 401 for POST"
fi
echo "OK"
echo "Connecting to obtain cookie without secret URL"
eval `echo "test" | ${OPENCONNECT} -q localhost:${PORT} -u test --servercert ${SERVERCERT} --authenticate`
if [ ! -z "${COOKIE}" ];then
fail ${PID} "Got a cookie, this shouldn't happen"
fi
echo "OK"
echo "Connecting to obtain cookie using secret URL.."
eval `echo "test" | ${OPENCONNECT} -q localhost:${PORT}${SECRETURL} -u test --servercert ${SERVERCERT} --authenticate`
if [ -z "${COOKIE}" ];then
fail ${PID} "Could not obtain cookie"
fi
echo "OK"
echo "Connecting with cookie..."
$OPENCONNECT -q localhost:${PORT} -u test -C "${COOKIE}" --servercert ${SERVERCERT} --script=/bin/true --verbose --pid-file "${CLIENTPIDFILE}" --background
sleep 4
if [ ! -f "${CLIENTPIDFILE}" ];then
fail ${PID} "Failed to establish the session"
fi
echo "Seems like the connection is established, stopping the client to finish the test...."
kill -USR1 `cat "${CLIENTPIDFILE}"`
if test $? != 0;then
fail ${PID} "Client process could not be killed"
fi
echo "OK"
cleanup
exit 0

59
tests/test-camouflage-norealm Executable file
View File

@@ -0,0 +1,59 @@
#!/bin/sh
#
# Copyright (C) 2013 Nikos Mavrogiannopoulos
# Copyright (C) 2023 Kirill Ovchinnikov
#
# This file is part of ocserv.
#
# ocserv is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# ocserv is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GnuTLS; if not, write to the Free Software Foundation,
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
SERV="${SERV:-../src/ocserv}"
srcdir=${srcdir:-.}
CLIENTPIDFILE=openconnect-pid.$$.tmp
SECRETURL="/?mysecretkey"
SERVERCERT="pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8="
. `dirname $0`/common.sh
eval "${GETPORT}"
echo "Testing connection to the server with camouflage enabled"
update_config test-camouflage-norealm.config
launch_server -d 1 -f -c ${CONFIG} & PID=$!
wait_server ${PID}
# Most of the logic is tested in 'test-camouflage' test,
# so here we will only pay attention to the no-realm-specifics
echo "Checking with CURL that server returns us HTTP 404 for request with no secret in URL"
http_result=$(curl --insecure https://localhost:${PORT} --output /dev/null --silent --write-out "%{http_code}")
if [ "${http_result}" != "404" ]; then
fail ${PID} "Server returned ${http_result} instead of 404 for GET"
fi
echo "OK"
echo "Checking with CURL that server returns us HTTP 200 when there's a secret in URL"
http_result=$(curl --insecure https://localhost:${PORT}${SECRETURL} --output /dev/null --silent --write-out "%{http_code}")
if [ "${http_result}" != "200" ]; then
fail ${PID} "Server returned ${http_result} instead of 200"
fi
echo "OK"
cleanup
exit 0