diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 577a4ef8..052b0db7 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -255,6 +255,25 @@ Fedora: untracked: true when: always +Fedora-noprocfs: + stage: testing + image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD + script: + - chmod -R o-w tests/data/raddb + - git submodule update --init + - autoreconf -fvi + - ac_cv_file_FILE__proc_self_exe=no ./configure --disable-maintainer-mode --without-docker-tests + - make -j$JOBS + tags: + - shared + - linux + except: + - tags + artifacts: + expire_in: 1 day + untracked: true + when: on_failure + # Tests seccomp filters by asking seccomp to fail with a trap seccomp/Fedora: stage: testing diff --git a/README.md b/README.md index 647be4cd..ae7f95cb 100644 --- a/README.md +++ b/README.md @@ -15,8 +15,13 @@ The program consists of: # Supported platforms The OpenConnect VPN server is designed and tested to work, with both IPv6 -and IPv4, on Linux systems. It is, however, known to work on FreeBSD, other -BSD derived systems. +and IPv4, on Linux systems. It is, however, known to work on FreeBSD, +OpenBSD and other BSD derived systems. + +Known limitation is that on platforms, which do not support procfs(5), +changes to the configuration must only be made while ocserv(8) is stopped. +Not doing so will cause new worker processes picking up the new +configuration while ocserv-main will use the previous configuration. # Build dependencies diff --git a/configure.ac b/configure.ac index 0ee424fb..70757320 100644 --- a/configure.ac +++ b/configure.ac @@ -642,6 +642,8 @@ fi AM_CONDITIONAL(ENABLE_OIDC_AUTH, test "x$enable_oidc_auth" = xyes) AM_CONDITIONAL(ENABLE_OIDC_AUTH_TESTS, test "x$enable_oidc_auth" = xyes) +AC_CHECK_FILE(/proc/self/exe, AC_DEFINE([PROC_FS_SUPPORTED],[1], [procfs supported]), []) + uid=$(id -u) gid=$(id -g) AC_SUBST([ROOTUID], [$uid]) diff --git a/src/config.c b/src/config.c index f24a15b4..dbcecfb1 100644 --- a/src/config.c +++ b/src/config.c @@ -1130,6 +1130,7 @@ static void parse_cfg_file(void *pool, const char *file, struct list_head *head, ctx.reload = (flags&CFG_FLAG_RELOAD)?1:0; ctx.head = head; +#if defined(PROC_FS_SUPPORTED) // Worker always reads from snapshot if ((flags & CFG_FLAG_WORKER) == CFG_FLAG_WORKER) { char * snapshot_file = NULL; @@ -1192,6 +1193,27 @@ static void parse_cfg_file(void *pool, const char *file, struct list_head *head, } } +#else + const char * cfg_file = file; + + if (cfg_file == NULL) { + fprintf(stderr, ERRSTR"no config file!\n"); + exit(1); + } + + /* parse configuration + */ + ret = ini_parse(cfg_file, cfg_ini_handler, &ctx); + if (ret < 0 && file != NULL && strcmp(file, DEFAULT_CFG_FILE) == 0) { + cfg_file = OLD_DEFAULT_CFG_FILE; + ret = ini_parse(cfg_file, cfg_ini_handler, &ctx); + } + + if (ret < 0) { + fprintf(stderr, ERRSTR"cannot load config file %s\n", cfg_file); + exit(1); + } +#endif /* apply configuration not yet applied. * We start from the last, which is the default server (firstly diff --git a/src/main.c b/src/main.c index efc983dc..31b2f9cf 100644 --- a/src/main.c +++ b/src/main.c @@ -1015,9 +1015,7 @@ static void listen_watcher_cb (EV_P_ ev_io *w, int revents) int cmd_fd[2]; pid_t pid; hmac_component_st hmac_components[3]; - char path[_POSIX_PATH_MAX]; char worker_path[_POSIX_PATH_MAX]; - size_t path_length; if (ltmp->sock_type == SOCK_TYPE_TCP || ltmp->sock_type == SOCK_TYPE_UNIX) { /* connection on TCP port */ @@ -1117,16 +1115,27 @@ static void listen_watcher_cb (EV_P_ ev_io *w, int revents) safe_memset((uint8_t*)s->hmac_key, 0, sizeof(s->hmac_key)); set_env_from_ws(s); - path_length = readlink("/proc/self/exe", path, sizeof(path)-1); - if (path_length == -1) { - mslog(s, NULL, LOG_ERR, "readlink failed %s", strerror(ret)); - exit(1); - } - path[path_length] = '\0'; - if (snprintf(worker_path, sizeof(worker_path), "%s-worker", path) >= sizeof(worker_path)) { - mslog(s, NULL, LOG_ERR, "snprint of path %s and ocserv-worker failed", path); +#if defined(PROC_FS_SUPPORTED) + { + char path[_POSIX_PATH_MAX]; + size_t path_length; + path_length = readlink("/proc/self/exe", path, sizeof(path)-1); + if (path_length == -1) { + mslog(s, NULL, LOG_ERR, "readlink failed %s", strerror(ret)); + exit(1); + } + path[path_length] = '\0'; + if (snprintf(worker_path, sizeof(worker_path), "%s-worker", path) >= sizeof(worker_path)) { + mslog(s, NULL, LOG_ERR, "snprint of path %s and ocserv-worker failed", path); + exit(1); + } + } +#else + if (snprintf(worker_path, sizeof(worker_path), "%s-worker", worker_argv[0]) >= sizeof(worker_path)) { + mslog(s, NULL, LOG_ERR, "snprint of path %s and ocserv-worker failed", worker_argv[0]); exit(1); } +#endif worker_argv[0] = worker_path; execv(worker_path, worker_argv);