GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 08:46:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

sec-mod: do not export expired entries to cookies list op

Browse Source 
Also combined macro to determine expired entries.
This commit is contained in:
Nikos Mavrogiannopoulos
2016-03-07 13:35:45 +01:00
parent e4dbeb6bd3
commit c213a8b8fc
4 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/sec-mod-auth.c
View File

@@ -384,7 +384,7 @@ int handle_secm_session_open_cmd(sec_mod_st *sec, int fd, const SecmSessionOpenM
return send_failed_session_open_reply(sec, fd);
}
if (e->time != -1 && time(0) > e->time + sec->config->cookie_timeout) {
if IS_CLIENT_ENTRY_EXPIRED(sec, e, time(0)) {
seclog(sec, LOG_ERR, "session expired; denied session for user '%s' "SESSION_STR, e->acct_info.username, e->acct_info.psid);
e->status = PS_AUTH_FAILED;
return send_failed_session_open_reply(sec, fd);

4
src/sec-mod-cookies.c
View File

@@ -48,6 +48,7 @@ void handle_secm_list_cookies_reply(void *pool, int fd, sec_mod_st *sec)
struct htable_iter iter;
CookieIntMsg *cookies;
int ret;
time_t now = time(0);
if (db == NULL) {
send_empty_reply(pool, fd, sec);
@@ -70,6 +71,9 @@ void handle_secm_list_cookies_reply(void *pool, int fd, sec_mod_st *sec)
t = htable_first(db, &iter);
while (t != NULL) {
if IS_CLIENT_ENTRY_EXPIRED(sec, t, now)
continue;
if (msg.n_cookies >= db->elems)
break;

3
src/sec-mod-db.c
View File

@@ -168,8 +168,7 @@ void cleanup_client_entries(sec_mod_st *sec)
t = htable_first(db, &iter);
while (t != NULL) {
if (t->time != -1 && (now - t->time) > (sec->config->cookie_timeout + AUTH_SLACK_TIME) &&
t->in_use == 0) {
if IS_CLIENT_ENTRY_EXPIRED_FULL(sec, t, now, 1) {
htable_delval(db, &iter);
clean_entry(sec, t);
}

3
src/sec-mod.h
View File

@@ -68,6 +68,9 @@ typedef struct common_acct_info_st {
unsigned id;
} common_acct_info_st;
#define IS_CLIENT_ENTRY_EXPIRED_FULL(sec, e, now, clean) (e->time != -1 && (now - e->time) > (sec->config->cookie_timeout + (clean?AUTH_SLACK_TIME:0)) && e->in_use == 0)
#define IS_CLIENT_ENTRY_EXPIRED(sec, e, now) IS_CLIENT_ENTRY_EXPIRED_FULL(sec, e, now, 0)
typedef struct client_entry_st {
/* A unique session identifier used to distinguish sessions
* prior to authentication. It is sent as cookie to the client