Allow using no-udp option in vhosts

Signed-off-by: Grigory Trenin <grigory.trenin@gmail.com>

tests/test-no-udp

@@ -0,0 +1,125 @@
+#!/bin/bash
+#
+# Copyright (C) 2026 Grigory Trenin
+#
+# This file is part of ocserv.
+#
+# ocserv is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at
+# your option) any later version.
+#
+# ocserv is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# Test no-udp option
+
+OCCTL="${OCCTL:-../src/occtl/occtl}"
+OCCTL_SOCKET=./occtl-no-udp-$$.socket
+SERV="${SERV:-../src/ocserv}"
+srcdir=${srcdir:-.}
+PIDFILE=ocserv-pid.$$.tmp
+CLIPID=oc-pid.$$.tmp
+PATH=${PATH}:/usr/sbin
+OUTFILE=occtl-no-udp.$$.tmp
+
+echo "Testing no-udp option..."
+
+finish() {
+	set +e
+	echo " * Cleaning up..."
+	test -n "${PID}" && kill ${PID} >/dev/null 2>&1
+	test -n "${PIDFILE}" && rm -f ${PIDFILE} >/dev/null 2>&1
+	test -n "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1
+	test -n "${CLIPID}" && rm -f ${CLIPID} >/dev/null 2>&1
+	test -n "${CONFIG}" && rm -f ${CONFIG} >/dev/null 2>&1
+	rm -f ${OUTFILE}
+}
+
+connect_vhost() {
+	VHOST=$1
+	USERNAME=$2
+
+	echo " * Connecting to ${VHOST} at ${ADDRESS}:${PORT}..."
+	( echo ${USERNAME} | ${CMDNS1} ${OPENCONNECT} ${VHOST}:${PORT} --resolve ${VHOST}:${ADDRESS} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b )
+	if test $? != 0;then
+		fail $PID "Could not connect to server"
+	fi
+
+	${OCCTL} -s ${OCCTL_SOCKET} show user ${USERNAME} >${OUTFILE}
+	if test $? != 0;then
+		cat ${OUTFILE}
+		fail $PID "occtl show user ${USERNAME} failed!"
+	fi
+
+	grep -i "Username: ${USERNAME}" ${OUTFILE} >/dev/null
+	if test $? != 0;then
+		cat ${OUTFILE}
+		fail $PID "Username missing in occtl show user output"
+	fi
+
+	grep -i "vhost: ${VHOST}" ${OUTFILE} >/dev/null
+	if test $? != 0;then
+		cat ${OUTFILE}
+		fail $PID "Session associated with wrong vhost (expected: ${VHOST})"
+	fi
+
+	if grep -i "DTLS cipher:" ${OUTFILE} >/dev/null;then
+		HAVE_DTLS=1
+	else
+		HAVE_DTLS=0
+	fi
+}
+
+disconnect() {
+	kill "$(cat ${CLIPID})" 2>/dev/null || true
+	rm -f "${CLIPID}"
+	sleep 3
+	# Restore NS1 routing in case vpnc-script failed to run during server-initiated disconnect
+	reset_client_routes
+}
+
+. `dirname $0`/common.sh
+. `dirname $0`/random-net.sh
+. `dirname $0`/ns.sh
+
+eval "${GETPORT}"
+
+# Run server
+update_config test-no-udp.config
+if test "$VERBOSE" = 1;then
+	DEBUG="-d 3"
+fi
+
+${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$!
+
+sleep 4
+
+echo "*** Test 1 - UDP enabled"
+connect_vhost default noudp1
+if test "${HAVE_DTLS}" = 0;then
+	fail $PID "DTLS session was not established with default vhost"
+fi
+disconnect
+
+echo "*** Test 2 - UDP disabled per vhost"
+connect_vhost udp-restricted.example.com noudp2
+if test "${HAVE_DTLS}" = 1;then
+	fail $PID "DTLS session established despite being disabled for this vhost"
+fi
+disconnect
+
+echo "*** Test 3 - UDP disabled per vhost, but enabled per-user"
+connect_vhost udp-restricted.example.com noudp3
+if test "${HAVE_DTLS}" = 0;then
+	fail $PID "DTLS session failed to establish despite user-level override"
+fi
+disconnect
+
+exit 0