GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-08 09:21:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'anyconnect-bye-packet' into 'master'

Browse Source 
Handle AnyConnect BYE packet with reconnect intention (0x91)

Closes #732

See merge request openconnect/ocserv!555
This commit is contained in:
Nikos Mavrogiannopoulos
2026-05-23 14:25:22 +00:00
parent e5894dba7d 2ff4154159
commit ae021ecf58
3 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+1
View File
@@ -7,6 +7,7 @@
configurable PAM service names, enabling per-vhost PAM stacks (#718) configurable PAM service names, enabling per-vhost PAM stacks (#718)
- ocserv-fw-nftables: dropped runtime dependency on ipcalc/ipcalc-ng (#709) - ocserv-fw-nftables: dropped runtime dependency on ipcalc/ipcalc-ng (#709)
- Fixed sudden disconnects after authentication for AnyConnect clients (#706) - Fixed sudden disconnects after authentication for AnyConnect clients (#706)
- Distinguish disconnect reasons in AnyConnect BYE packets (#732)
- Vhosts now inherit configuration options from the default vhost if - Vhosts now inherit configuration options from the default vhost if
they are not overridden (#705) they are not overridden (#705)
- `tunnel-all-dns` now works correctly when set in per-user/group config (#708) - `tunnel-all-dns` now works correctly when set in per-user/group config (#708)
src/vpn.h
+6
View File
@@ -119,6 +119,12 @@ inline static const char *proto_to_str(fw_proto_t proto)
#define AC_PKT_COMPRESSED 8 /* Compressed data */ #define AC_PKT_COMPRESSED 8 /* Compressed data */
#define AC_PKT_TERM_SERVER 9 /* Server kick */ #define AC_PKT_TERM_SERVER 9 /* Server kick */
/* Disconnect reason for AC_PKT_DISCONN */
#define AC_BYE_USER_DISCONNECT 0xb0 /* User requested to disconnect */
#define AC_BYE_LOCAL_ERROR 0x70 /* E.g., unable to modify routing table */
#define AC_BYE_VPN_RECONNECT 0x91 /* VPN tunnel is reconnecting */
#define AC_BYE_VPN_PAUSE 0xd1 /* VPN tunnel is paused */
#define REKEY_METHOD_SSL 1 #define REKEY_METHOD_SSL 1
#define REKEY_METHOD_NEW_TUNNEL 2 #define REKEY_METHOD_NEW_TUNNEL 2
src/worker-vpn.c
+15 -7
View File
@@ -2688,19 +2688,27 @@ static int parse_data(struct worker_st *ws, uint8_t *buf, size_t buf_size,
* an intention to reconnect (e.g., because network was * an intention to reconnect (e.g., because network was
* changed). We separate the error codes to ensure we do * changed). We separate the error codes to ensure we do
* not interpret the intention incorrectly (see #281). */ * not interpret the intention incorrectly (see #281). */
if (plain_size > 0 && plain[0] == 0xb0) { if (plain_size > 0) {
exit_worker_reason(ws, REASON_USER_DISCONNECT); const uint8_t bye_reason = plain[0];
} else {
if (plain_size > 0) { switch (bye_reason) {
case AC_BYE_USER_DISCONNECT:
oclog(ws, LOG_DEBUG,
"User requested to disconnect");
exit_worker_reason(ws, REASON_USER_DISCONNECT);
case AC_BYE_VPN_RECONNECT:
oclog(ws, LOG_DEBUG,
"VPN tunnel is reconnecting");
exit_worker_reason(ws, REASON_TEMP_DISCONNECT);
default:
oclog_hex(ws, LOG_DEBUG, oclog_hex(ws, LOG_DEBUG,
"bye packet with unknown payload", "bye packet with unknown payload",
plain, plain_size, 0); plain, plain_size, 0);
return -1; return -1;
} }
exit_worker_reason(ws, REASON_TEMP_DISCONNECT);
} }
break; exit_worker_reason(ws, REASON_TEMP_DISCONNECT);
case AC_PKT_COMPRESSED: case AC_PKT_COMPRESSED:
/* decompress */ /* decompress */
if (is_dtls == 0) { /* CSTP */ if (is_dtls == 0) { /* CSTP */