diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 21a72e57..83b10d0d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -21,7 +21,7 @@ Debian: script: - chmod -R o-w tests/data/raddb - git submodule update --init && autoreconf -fvi && - ./configure --without-nuttcp-tests --without-docker-tests --enable-oidc-auth + ./configure --without-nuttcp-tests --enable-oidc-auth - make -j$JOBS - export OCSERV_ALLOW_BROKEN_CLIENTS=1 - make check -j$JOBS @@ -66,7 +66,7 @@ Ubuntu16.04: script: - git submodule update --init - autoreconf -fvi - - ./configure --without-nuttcp-tests --without-docker-tests + - ./configure --without-nuttcp-tests - make -j$JOBS # this version of openconnect doesn't work with IPv6 only - make check -j$JOBS XFAIL_TESTS=ipv6-iface @@ -89,7 +89,7 @@ Ubuntu20.04: script: - git submodule update --init - autoreconf -fvi - - ./configure --without-nuttcp-tests --without-docker-tests --enable-oidc-auth --enable-latency-stats + - ./configure --without-nuttcp-tests --enable-oidc-auth --enable-latency-stats - make -j$JOBS - make check -j$JOBS tags: @@ -136,7 +136,7 @@ Centos7: script: - git submodule update --init - autoreconf -fvi - - ./configure --without-docker-tests + - ./configure - make -j$JOBS - make check -j$JOBS tags: @@ -238,7 +238,7 @@ Coverity: - tar xfz /tmp/coverity_tool.tgz - git submodule update --init - autoreconf -fvi - - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --without-docker-tests --enable-latency-stats + - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --enable-latency-stats - cov-analysis-linux64-*/bin/cov-build --dir cov-int make -j$JOBS - tar cfz cov-int.tar.gz cov-int - curl https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME @@ -260,7 +260,7 @@ musl/Alpine: image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$ALPINE_BUILD script: - autoreconf -fvi - - ./configure --disable-maintainer-mode --without-docker-tests --with-werror + - ./configure --disable-maintainer-mode --with-werror - make -j$JOBS tags: - shared @@ -282,7 +282,7 @@ Fedora: - chmod -R o-w tests/data/raddb - git submodule update --init - autoreconf -fvi - - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --without-docker-tests --enable-code-coverage --with-kerberos-tests --enable-oidc-auth + - CFLAGS="-g -O0" ./configure --disable-maintainer-mode --enable-code-coverage --with-kerberos-tests --enable-oidc-auth - make -j$JOBS - make check -j$JOBS COVERAGE=1 - make files-update @@ -305,7 +305,7 @@ noprocfs/Fedora: - chmod -R o-w tests/data/raddb - git submodule update --init - autoreconf -fvi - - ac_cv_file_FILE__proc_self_exe=no ./configure --disable-maintainer-mode --without-docker-tests --disable-namespaces + - ac_cv_file_FILE__proc_self_exe=no ./configure --disable-maintainer-mode --disable-namespaces - make -j$JOBS tags: - shared @@ -325,7 +325,7 @@ clang/Fedora: - chmod -R o-w tests/data/raddb - git submodule update --init - autoreconf -fvi - - CC=clang ./configure --disable-maintainer-mode --without-docker-tests --with-werror + - CC=clang ./configure --disable-maintainer-mode --with-werror - make -j$JOBS - make check -j$JOBS tags: @@ -347,7 +347,7 @@ seccomp/Fedora: - chmod -R o-w tests/data/raddb - git submodule update --init - autoreconf -fvi - - ./configure --disable-maintainer-mode --without-docker-tests --with-kerberos-tests --enable-oidc-auth --with-seccomp-trap + - ./configure --disable-maintainer-mode --with-kerberos-tests --enable-oidc-auth --with-seccomp-trap - make -j$JOBS - make check -j$JOBS tags: @@ -367,7 +367,7 @@ minimal: script: - git submodule update --init - autoreconf -fvi - - ./configure --without-docker-tests --without-libnl --without-liboath --without-pam --without-radius --without-utmp --without-libwrap --without-http-parser --without-lz4 --without-gssapi --without-pcl-lib --without-protobuf + - ./configure --without-libnl --without-liboath --without-pam --without-radius --without-utmp --without-libwrap --without-http-parser --without-lz4 --without-gssapi --without-pcl-lib --without-protobuf - make -j$JOBS - make check -j$JOBS XFAIL_TESTS="lz4-compression" tags: @@ -390,7 +390,7 @@ minimal/Ubuntu20.04: script: - git submodule update --init - autoreconf -fvi - - ./configure --without-protobuf --without-root-tests --without-docker-tests --without-nuttcp-tests --without-libtalloc-prefix --without-libnl --without-maxmind --without-geoip --without-libreadline-prefix --without-liboath --without-libc-prefix --without-pam --without-radius --without-libcrypt-prefix --without-utmp --without-libutil-prefix --without-libwrap --without-libwrap-prefix --without-libseccomp-prefix --without-libsystemd-prefix --without-http-parser --without-lz4 --without-gssapi --without-pcl-lib --disable-rpath --disable-seccomp --disable-anyconnect-compat --disable-compression + - ./configure --without-protobuf --without-root-tests --without-nuttcp-tests --without-libtalloc-prefix --without-libnl --without-maxmind --without-geoip --without-libreadline-prefix --without-liboath --without-libc-prefix --without-pam --without-radius --without-libcrypt-prefix --without-utmp --without-libutil-prefix --without-libwrap --without-libwrap-prefix --without-libseccomp-prefix --without-libsystemd-prefix --without-http-parser --without-lz4 --without-gssapi --without-pcl-lib --disable-rpath --disable-seccomp --disable-anyconnect-compat --disable-compression - make -j$JOBS - make check -j$JOBS tags: @@ -415,7 +415,7 @@ asan/clang/Fedora: - chmod -R o-w tests/data/raddb - git submodule update --init - autoreconf -fvi - - CC=clang CFLAGS="-fsanitize=address -fno-optimize-sibling-calls -fno-omit-frame-pointer -g -O1" ./configure --without-pam --without-docker-tests --without-asan-broken-tests + - CC=clang CFLAGS="-fsanitize=address -fno-optimize-sibling-calls -fno-omit-frame-pointer -g -O1" ./configure --without-pam --without-asan-broken-tests - make -j$JOBS - make check -j$JOBS tags: @@ -439,7 +439,7 @@ ubsan/Fedora: - git submodule update --init - autoreconf -fvi - export UBCFLAGS="-Wall -Wextra -fsanitize=undefined -fsanitize=bool -fsanitize=alignment -fsanitize=null -fsanitize=bounds-strict -fsanitize=enum -fno-sanitize-recover -g -O2 -Werror" - - CFLAGS="$UBCFLAGS" ./configure --without-docker-tests + - CFLAGS="$UBCFLAGS" ./configure - make -j$JOBS - make check -j$JOBS CFLAGS="$UBCFLAGS -Wno-unused-function -Wno-unused-parameter" tags: diff --git a/configure.ac b/configure.ac index 635d6807..b3a85ca7 100644 --- a/configure.ac +++ b/configure.ac @@ -122,13 +122,6 @@ AC_ARG_WITH(root-tests, AM_CONDITIONAL(ENABLE_ROOT_TESTS, test "x$root_tests" = xyes) -AC_ARG_WITH(docker-tests, - AS_HELP_STRING([--without-docker-tests], [disable any tests requiring docker]), - docker_tests=$withval, - docker_tests=yes) - -AM_CONDITIONAL(ENABLE_DOCKER_TESTS, test "x$docker_tests" = xyes) - AC_ARG_WITH(asan-broken-tests, AS_HELP_STRING([--without-asan-broken-tests], [disable any tests that cannot be run under asan]), enable_asan_broken_tests=$withval, @@ -688,7 +681,6 @@ AC_CONFIG_FILES([ src/Makefile doc/Makefile gl/Makefile - tests/docker-ocserv/Makefile tests/data/pam/ocserv tests/data/pam/nss-passwd tests/data/pam/nss-group diff --git a/tests/Makefile.am b/tests/Makefile.am index 37122ecf..df1bd641 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -9,13 +9,13 @@ EXTRA_DIST = certs/ca-key.pem certs/ca.pem ns.sh common.sh certs/server-cert.pem data/test-stress.config certs/user-cert-wrong.pem connect-script data/test-group.passwd \ data/test-group-pass.config certs/user-group-cert.pem certs/user-group-key.pem \ data/test-user-group-cert.config data/pam/ocserv.in data/pam/passdb.templ data/pam-single/passdb.templ \ - data/test-user-group-cert-no-pass.config docker-common.sh data/test-cookie-timeout.config \ + data/test-user-group-cert-no-pass.config data/test-cookie-timeout.config \ data/test-cookie-timeout-2.config user-config-explicit/test data/test-explicit-ip.config \ test-explicit-ip user-config-explicit/test2 user-config-explicit/test3 \ user-config-explicit/test4 data/test-pass-opt-cert.config data/test-gssapi.config \ data/test-ban.config data/test-sighup.config data/test-gssapi-local-map.config \ data/test-cookie-invalidation.config data/test-enc-key2.config data/test-enc-key.config \ - certs/server-key-ossl.pem certs/server-key-p8.pem proxyproto-unix-test certs/user-cn.pem \ + certs/server-key-ossl.pem certs/server-key-p8.pem certs/user-cn.pem \ certs/user-cert-testuser.pem test-stress data/test-user-config.config user-config/testuser \ data/test-sighup-key-change.config data/test-sighup-key-change.config user-config/testipnet \ certs/user-cert-testipnet.pem certs/user-cert-invalid.pem certs/server-cert-ca.pem \ @@ -41,9 +41,9 @@ EXTRA_DIST = certs/ca-key.pem certs/ca.pem ns.sh common.sh certs/server-cert.pem data/kdc.conf data/krb5.conf data/k5.KERBEROS.TEST data/kadm5.acl \ data/ipv6-iface.config data/no-route-default.config data/no-route-group.config \ data/group-config/group1 data/test-namespace-listen.config data/disconnect-user.config \ - data/disconnect-user2.config data/ping-leases.config - -SUBDIRS = docker-ocserv + data/disconnect-user2.config data/ping-leases.config data/haproxy-proxyproto.config \ + data/haproxy-proxyproto.cfg scripts/proxy-connectscript data/haproxy-proxyproto-v1.config \ + data/haproxy-proxyproto-v1.cfg scripts/proxy-connectscript-v1 xfail_scripts = dist_check_SCRIPTS = ocpasswd-test @@ -54,13 +54,6 @@ endif if ENABLE_ROOT_TESTS -if ENABLE_DOCKER_TESTS -#docker tests -dist_check_SCRIPTS += unix-test \ - proxyproto-test proxyproto-v1-test proxyproto-unix-test \ - reload-info-test -endif - #other root requiring tests dist_check_SCRIPTS += haproxy-connect test-iroute test-multi-cookie test-pass-script \ test-cookie-timeout test-cookie-timeout-2 test-explicit-ip \ @@ -97,7 +90,8 @@ dist_check_SCRIPTS += test-pass test-pass-cert test-cert test-group-pass \ test-enc-key test-sighup-key-change test-get-cert test-san-cert \ test-gssapi test-pass-opt-cert test-cert-opt-pass test-gssapi-opt-pass \ test-gssapi-opt-cert haproxy-auth test-maintenance resumption \ - test-group-name flowcontrol banner invalid-configs + test-group-name flowcontrol banner invalid-configs haproxy-proxyproto \ + haproxy-proxyproto-v1 if HAVE_CWRAP_PAM dist_check_SCRIPTS += test-pam test-pam-noauth diff --git a/tests/data/haproxy-proxyproto-v1.cfg b/tests/data/haproxy-proxyproto-v1.cfg new file mode 100644 index 00000000..882ea61b --- /dev/null +++ b/tests/data/haproxy-proxyproto-v1.cfg @@ -0,0 +1,32 @@ +global + user haproxy + group haproxy + #daemon + + # Default SSL material locations + #ca-base /etc/ssl/certs + #crt-base /etc/ssl/private + + ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL + + +defaults + log global + mode http + option dontlognull + timeout connect 5000 + timeout client 50000 + timeout server 50000 + +frontend ssl + mode tcp + bind *:@HAPORT@ + tcp-request inspect-delay 5s + tcp-request content accept if { req.ssl_hello_type 1 } + +use_backend ocserv + +backend ocserv + mode tcp +# option ssl-hello-chk + server server-vpn @ADDRESS@:@PORT@ check send-proxy diff --git a/tests/data/haproxy-proxyproto-v1.config b/tests/data/haproxy-proxyproto-v1.config new file mode 100644 index 00000000..6c226953 --- /dev/null +++ b/tests/data/haproxy-proxyproto-v1.config @@ -0,0 +1,190 @@ +# User authentication method. Could be set multiple times and in that case +# all should succeed. +# Options: certificate, pam. +#auth = "certificate" +auth = "plain[@SRCDIR@/data/test1.passwd]" +#auth = "pam" + +isolate-workers = @ISOLATE_WORKERS@ + +max-ban-score = 0 + +# A banner to be displayed on clients +#banner = "Welcome" + +# Use listen-host to limit to specific IPs or to the IPs of a provided hostname. +#listen-host = [IP|HOSTNAME] + +use-dbus = no + +# Limit the number of clients. Unset or set to zero for unlimited. +#max-clients = 1024 +max-clients = 16 + +listen-proxy-proto = true + +# Limit the number of client connections to one every X milliseconds +# (X is the provided value). Set to zero for no limit. +#rate-limit-ms = 100 + +# Limit the number of identical clients (i.e., users connecting multiple times) +# Unset or set to zero for unlimited. +max-same-clients = 2 + +# TCP and UDP port number +tcp-port = @PORT@ +udp-port = @PORT@ + +# Keepalive in seconds +keepalive = 32400 + +# Dead peer detection in seconds +dpd = 240 + +# MTU discovery (DPD must be enabled) +try-mtu-discovery = false + +# The key and the certificates of the server +# The key may be a file, or any URL supported by GnuTLS (e.g., +# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user +# or pkcs11:object=my-vpn-key;object-type=private) +# +# There may be multiple certificate and key pairs and each key +# should correspond to the preceding certificate. +server-cert = @SRCDIR@/certs/server-cert.pem +server-key = @SRCDIR@/certs/server-key.pem + +# Diffie-Hellman parameters. Only needed if you require support +# for the DHE ciphersuites (by default this server supports ECDHE). +# Can be generated using: +# certtool --generate-dh-params --outfile /path/to/dh.pem +#dh-params = /path/to/dh.pem + +# If you have a certificate from a CA that provides an OCSP +# service you may provide a fresh OCSP status response within +# the TLS handshake. That will prevent the client from connecting +# independently on the OCSP server. +# You can update this response periodically using: +# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response +# Make sure that you replace the following file in an atomic way. +#ocsp-response = /path/to/ocsp.der + +# In case PKCS #11 or TPM keys are used the PINs should be available +# in files. The srk-pin-file is applicable to TPM keys only (It's the storage +# root key). +#pin-file = /path/to/pin.txt +#srk-pin-file = /path/to/srkpin.txt + +# The Certificate Authority that will be used +# to verify clients if certificate authentication +# is set. +#ca-cert = /path/to/ca.pem + +# The object identifier that will be used to read the user ID in the client certificate. +# The object identifier should be part of the certificate's DN +# Useful OIDs are: +# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 +#cert-user-oid = 0.9.2342.19200300.100.1.1 + +# The object identifier that will be used to read the user group in the client +# certificate. The object identifier should be part of the certificate's DN +# Useful OIDs are: +# OU (organizational unit) = 2.5.4.11 +#cert-group-oid = 2.5.4.11 + +# A revocation list of ca-cert is set +#crl = /path/to/crl.pem + +# GnuTLS priority string +tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT" + +# To enforce perfect forward secrecy (PFS) on the main channel. +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" + +# The time (in seconds) that a client is allowed to stay connected prior +# to authentication +auth-timeout = 40 + +# The time (in seconds) that a client is not allowed to reconnect after +# a failed authentication attempt. +#min-reauth-time = 2 + +# Cookie validity time (in seconds) +# Once a client is authenticated he's provided a cookie with +# which he can reconnect. This option sets the maximum lifetime +# of that cookie. +cookie-validity = 172800 + +# Script to call when a client connects and obtains an IP +# Parameters are passed on the environment. +# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), +# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP +# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON +# may be "connect" or "disconnect". +connect-script = ./scripts/proxy-connectscript-v1 +#disconnect-script = /usr/bin/myscript + +# UTMP +use-utmp = true + +# PID file +pid-file = ./ocserv.pid + +# The default server directory. Does not require any devices present. +#chroot-dir = /path/to/chroot + +# socket file used for IPC, will be appended with .PID +# It must be accessible within the chroot environment (if any) +socket-file = ./ocserv-socket + +# The user the worker processes will be run as. It should be +# unique (no other services run as this user). +run-as-user = @USERNAME@ +run-as-group = @GROUP@ + +# Network settings + +device = vpns + +# The default domain to be advertised +default-domain = example.com + +ipv4-network = 192.168.1.0 +ipv4-netmask = 255.255.255.0 +# Use the keywork local to advertize the local P-t-P address as DNS server +ipv4-dns = 192.168.1.1 + +# The NBNS server (if any) +#ipv4-nbns = 192.168.2.3 + +#ipv6-address = +#ipv6-mask = +#ipv6-dns = + +# Prior to leasing any IP from the pool ping it to verify that +# it is not in use by another (unrelated to this server) host. +ping-leases = false + +# Leave empty to assign the default MTU of the device +# mtu = + +route = 192.168.1.0/255.255.255.0 +#route = 192.168.5.0/255.255.255.0 + +# +# The following options are for (experimental) AnyConnect client +# compatibility. They are only available if the server is built +# with --enable-anyconnect +# + +# Client profile xml. A sample file exists in doc/profile.xml. +# This file must be accessible from inside the worker's chroot. +# The profile is ignored by the openconnect client. +#user-profile = profile.xml + +# Unless set to false it is required for clients to present their +# certificate even if they are authenticating via a previously granted +# cookie. Legacy CISCO clients do not do that, and thus this option +# should be set for them. +#always-require-cert = false + diff --git a/tests/data/haproxy-proxyproto.cfg b/tests/data/haproxy-proxyproto.cfg new file mode 100644 index 00000000..668bbe7d --- /dev/null +++ b/tests/data/haproxy-proxyproto.cfg @@ -0,0 +1,32 @@ +global + user haproxy + group haproxy + #daemon + + # Default SSL material locations + #ca-base /etc/ssl/certs + #crt-base /etc/ssl/private + + ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL + + +defaults + log global + mode http + option dontlognull + timeout connect 5000 + timeout client 50000 + timeout server 50000 + +frontend ssl + mode tcp + bind *:@HAPORT@ + tcp-request inspect-delay 5s + tcp-request content accept if { req.ssl_hello_type 1 } + +use_backend ocserv + +backend ocserv + mode tcp +# option ssl-hello-chk + server server-vpn @ADDRESS@:@PORT@ check send-proxy-v2 send-proxy-v2-ssl-cn diff --git a/tests/data/haproxy-proxyproto.config b/tests/data/haproxy-proxyproto.config new file mode 100644 index 00000000..d7495b27 --- /dev/null +++ b/tests/data/haproxy-proxyproto.config @@ -0,0 +1,190 @@ +# User authentication method. Could be set multiple times and in that case +# all should succeed. +# Options: certificate, pam. +#auth = "certificate" +auth = "plain[@SRCDIR@/data/test1.passwd]" +#auth = "pam" + +isolate-workers = @ISOLATE_WORKERS@ + +max-ban-score = 0 + +# A banner to be displayed on clients +#banner = "Welcome" + +# Use listen-host to limit to specific IPs or to the IPs of a provided hostname. +#listen-host = [IP|HOSTNAME] + +use-dbus = no + +# Limit the number of clients. Unset or set to zero for unlimited. +#max-clients = 1024 +max-clients = 16 + +listen-proxy-proto = true + +# Limit the number of client connections to one every X milliseconds +# (X is the provided value). Set to zero for no limit. +#rate-limit-ms = 100 + +# Limit the number of identical clients (i.e., users connecting multiple times) +# Unset or set to zero for unlimited. +max-same-clients = 2 + +# TCP and UDP port number +tcp-port = @PORT@ +udp-port = @PORT@ + +# Keepalive in seconds +keepalive = 32400 + +# Dead peer detection in seconds +dpd = 240 + +# MTU discovery (DPD must be enabled) +try-mtu-discovery = false + +# The key and the certificates of the server +# The key may be a file, or any URL supported by GnuTLS (e.g., +# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user +# or pkcs11:object=my-vpn-key;object-type=private) +# +# There may be multiple certificate and key pairs and each key +# should correspond to the preceding certificate. +server-cert = @SRCDIR@/certs/server-cert.pem +server-key = @SRCDIR@/certs/server-key.pem + +# Diffie-Hellman parameters. Only needed if you require support +# for the DHE ciphersuites (by default this server supports ECDHE). +# Can be generated using: +# certtool --generate-dh-params --outfile /path/to/dh.pem +#dh-params = /path/to/dh.pem + +# If you have a certificate from a CA that provides an OCSP +# service you may provide a fresh OCSP status response within +# the TLS handshake. That will prevent the client from connecting +# independently on the OCSP server. +# You can update this response periodically using: +# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response +# Make sure that you replace the following file in an atomic way. +#ocsp-response = /path/to/ocsp.der + +# In case PKCS #11 or TPM keys are used the PINs should be available +# in files. The srk-pin-file is applicable to TPM keys only (It's the storage +# root key). +#pin-file = /path/to/pin.txt +#srk-pin-file = /path/to/srkpin.txt + +# The Certificate Authority that will be used +# to verify clients if certificate authentication +# is set. +#ca-cert = /path/to/ca.pem + +# The object identifier that will be used to read the user ID in the client certificate. +# The object identifier should be part of the certificate's DN +# Useful OIDs are: +# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 +#cert-user-oid = 0.9.2342.19200300.100.1.1 + +# The object identifier that will be used to read the user group in the client +# certificate. The object identifier should be part of the certificate's DN +# Useful OIDs are: +# OU (organizational unit) = 2.5.4.11 +#cert-group-oid = 2.5.4.11 + +# A revocation list of ca-cert is set +#crl = /path/to/crl.pem + +# GnuTLS priority string +tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT" + +# To enforce perfect forward secrecy (PFS) on the main channel. +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" + +# The time (in seconds) that a client is allowed to stay connected prior +# to authentication +auth-timeout = 40 + +# The time (in seconds) that a client is not allowed to reconnect after +# a failed authentication attempt. +#min-reauth-time = 2 + +# Cookie validity time (in seconds) +# Once a client is authenticated he's provided a cookie with +# which he can reconnect. This option sets the maximum lifetime +# of that cookie. +cookie-validity = 172800 + +# Script to call when a client connects and obtains an IP +# Parameters are passed on the environment. +# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), +# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP +# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON +# may be "connect" or "disconnect". +connect-script = ./scripts/proxy-connectscript +#disconnect-script = /usr/bin/myscript + +# UTMP +use-utmp = true + +# PID file +pid-file = ./ocserv.pid + +# The default server directory. Does not require any devices present. +#chroot-dir = /path/to/chroot + +# socket file used for IPC, will be appended with .PID +# It must be accessible within the chroot environment (if any) +socket-file = ./ocserv-socket + +# The user the worker processes will be run as. It should be +# unique (no other services run as this user). +run-as-user = @USERNAME@ +run-as-group = @GROUP@ + +# Network settings + +device = vpns + +# The default domain to be advertised +default-domain = example.com + +ipv4-network = 192.168.1.0 +ipv4-netmask = 255.255.255.0 +# Use the keywork local to advertize the local P-t-P address as DNS server +ipv4-dns = 192.168.1.1 + +# The NBNS server (if any) +#ipv4-nbns = 192.168.2.3 + +#ipv6-address = +#ipv6-mask = +#ipv6-dns = + +# Prior to leasing any IP from the pool ping it to verify that +# it is not in use by another (unrelated to this server) host. +ping-leases = false + +# Leave empty to assign the default MTU of the device +# mtu = + +route = 192.168.1.0/255.255.255.0 +#route = 192.168.5.0/255.255.255.0 + +# +# The following options are for (experimental) AnyConnect client +# compatibility. They are only available if the server is built +# with --enable-anyconnect +# + +# Client profile xml. A sample file exists in doc/profile.xml. +# This file must be accessible from inside the worker's chroot. +# The profile is ignored by the openconnect client. +#user-profile = profile.xml + +# Unless set to false it is required for clients to present their +# certificate even if they are authenticating via a previously granted +# cookie. Legacy CISCO clients do not do that, and thus this option +# should be set for them. +#always-require-cert = false + diff --git a/tests/data/test-cookie-invalidation.config b/tests/data/test-cookie-invalidation.config index 18c730fc..098e9808 100644 --- a/tests/data/test-cookie-invalidation.config +++ b/tests/data/test-cookie-invalidation.config @@ -5,7 +5,7 @@ auth = "plain[./data/test1.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/data/test-cookie-timeout-2.config b/tests/data/test-cookie-timeout-2.config index f82e7a7e..fe216bf5 100644 --- a/tests/data/test-cookie-timeout-2.config +++ b/tests/data/test-cookie-timeout-2.config @@ -5,7 +5,7 @@ auth = "plain[./data/test1.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/data/test-cookie-timeout.config b/tests/data/test-cookie-timeout.config index f82e7a7e..fe216bf5 100644 --- a/tests/data/test-cookie-timeout.config +++ b/tests/data/test-cookie-timeout.config @@ -5,7 +5,7 @@ auth = "plain[./data/test1.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/data/test-explicit-ip.config b/tests/data/test-explicit-ip.config index e2fbcfac..cf362f59 100644 --- a/tests/data/test-explicit-ip.config +++ b/tests/data/test-explicit-ip.config @@ -5,7 +5,7 @@ auth = "plain[./data/test1.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/data/test-group-cert.config b/tests/data/test-group-cert.config index 6c6b624a..bc3d791b 100644 --- a/tests/data/test-group-cert.config +++ b/tests/data/test-group-cert.config @@ -5,7 +5,7 @@ auth = "certificate" #auth = "plain[./data/test-group.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ select-group = group1 select-group = group2 diff --git a/tests/data/test-iroute.config b/tests/data/test-iroute.config index 87908972..88c68ca4 100644 --- a/tests/data/test-iroute.config +++ b/tests/data/test-iroute.config @@ -5,7 +5,7 @@ auth = "certificate" #auth = "plain[./data/test1.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/data/test-oidc-auth.config b/tests/data/test-oidc-auth.config index a0137ce6..a0509021 100644 --- a/tests/data/test-oidc-auth.config +++ b/tests/data/test-oidc-auth.config @@ -3,7 +3,7 @@ # Options: certificate, pam. auth = "oidc[config=@SRCDIR@/data/oidc.json]" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/data/test-pass-script.config b/tests/data/test-pass-script.config index 351a5e6e..4afc5135 100644 --- a/tests/data/test-pass-script.config +++ b/tests/data/test-pass-script.config @@ -5,7 +5,7 @@ auth = "plain[./data/test1.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/data/test-stress.config b/tests/data/test-stress.config index 9f0fbd5b..e2c8b4ed 100644 --- a/tests/data/test-stress.config +++ b/tests/data/test-stress.config @@ -5,7 +5,7 @@ auth = "plain[./data/test1.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/data/test-user-config.config b/tests/data/test-user-config.config index 93232c12..91b53e96 100644 --- a/tests/data/test-user-config.config +++ b/tests/data/test-user-config.config @@ -5,7 +5,7 @@ auth = "certificate" #auth = "plain[./data/test1.passwd]" #auth = "pam" -isolate-workers = false +isolate-workers = @ISOLATE_WORKERS@ # A banner to be displayed on clients #banner = "Welcome" diff --git a/tests/docker-common.sh b/tests/docker-common.sh deleted file mode 100755 index 7c20b634..00000000 --- a/tests/docker-common.sh +++ /dev/null @@ -1,147 +0,0 @@ -if test -x /usr/bin/docker;then -DOCKER=/usr/bin/docker -else -DOCKER=/usr/bin/docker.io -fi - -. ./common.sh - -ECHO_E="/bin/echo -e" -if test -x /usr/bin/lockfile-create;then -LOCKFILE="lockfile-create docker" -UNLOCKFILE="lockfile-remove docker" -else -LOCKFILE="lockfile docker.lock" -UNLOCKFILE="rm -f docker.lock" -fi - -if test -z "$DOCKER_DIR";then - DOCKER_DIR=docker-ocserv -fi - -if ! test -x $DOCKER;then - echo "The docker program is needed to perform this test" - exit 77 -fi - -if test -f /etc/debian_version;then - DEBIAN=1 -fi - -if test -f /etc/fedora-release;then - FEDORA=1 -fi - -if test -z $FEDORA && test -z $DEBIAN;then - echo "******************************************************" - echo "This test requires compiling ocserv in a Debian or Fedora systems" - echo "******************************************************" - exit 77 -fi - -get_ip() { - IP=`$DOCKER inspect $IMAGE_NAME | grep \"IPAddress\" | cut -d '"' -f 4|head -n1` -} - -check_for_file() { - FILENAME=$1 - IMG=$2 - - if test -z "$IMG"; then - IMG=$IMAGE_NAME - fi - - rm -f out$TMP - $DOCKER exec $IMG ls $FILENAME >out$TMP - grep "$FILENAME" out$TMP|grep -v "cannot access" - if test $? != 0;then - echo "could not find $FILENAME" - return 1 - else - rm -f out$TMP - return 0 - fi -} - -retrieve_user_info() { - USERNAME=$1 - MATCH=$2 - counter=0 - ret=1 - - while [ $counter -lt 4 ] - do - $DOCKER exec $IMAGE_NAME occtl show user $USERNAME >out$TMP 2>&1 - if test -z "$MATCH";then - grep "Username" out$TMP - else - grep "$MATCH" out$TMP - fi - ret=$? - if test $ret = 0;then - break - fi - counter=`expr $counter + 1` - sleep 2 - done - if test $ret != 0;then - kill $PID - cat out$TMP - echo "could not find user information" - stop - else - rm -f out$TMP - fi -} - -retrieve_route_info() { - retrieve_user_info $1 $2 -} - -stop() { - $DOCKER stop $IMAGE_NAME - $DOCKER rm $IMAGE_NAME - exit 1 -} - -$LOCKFILE -$DOCKER stop $IMAGE_NAME >/dev/null 2>&1 -$DOCKER rm $IMAGE_NAME >/dev/null 2>&1 - -rm -f $DOCKER_DIR/Dockerfile -if test "$FEDORA" = 1;then - echo "Using the fedora image" - if test $? != 0;then - echo "Cannot pull docker image" - $UNLOCKFILE - exit 1 - fi - cp $DOCKER_DIR/Dockerfile-fedora-$CONFIG $DOCKER_DIR/Dockerfile -else #DEBIAN - echo "Using the Debian image" - if test $? != 0;then - echo "Cannot pull docker image" - $UNLOCKFILE - exit 1 - fi - cp $DOCKER_DIR/Dockerfile-debian-$CONFIG $DOCKER_DIR/Dockerfile -fi - -if test ! -f $DOCKER_DIR/Dockerfile;then - echo "Cannot test in this system" - $UNLOCKFILE - exit 77 -fi - -rm -f $DOCKER_DIR/ocserv $DOCKER_DIR/ocpasswd $DOCKER_DIR/occtl $DOCKER_DIR/ocserv-fw -cp ../src/ocserv ../src/ocserv-fw ../src/ocpasswd/ocpasswd ../src/occtl/occtl $DOCKER_DIR/ - -echo "Creating image $IMAGE" -$DOCKER build -t $IMAGE $DOCKER_DIR/ -if test $? != 0;then - echo "Cannot build docker image" - $UNLOCKFILE - exit 1 -fi - -$UNLOCKFILE diff --git a/tests/docker-ocserv/Dockerfile-debian-proxyproto b/tests/docker-ocserv/Dockerfile-debian-proxyproto deleted file mode 100644 index 8b364bb1..00000000 --- a/tests/docker-ocserv/Dockerfile-debian-proxyproto +++ /dev/null @@ -1,35 +0,0 @@ -FROM debian:stretch - -RUN apt-get update -y -RUN apt-get install -y libgnutls30 libprotobuf-c1 liboath0 libev4 -RUN apt-get install -y libwrap0 libpam0g libseccomp2 libdbus-1-3 libreadline5 libnl-route-3-200 -RUN apt-get install -y libhttp-parser2.1 libpcl1 libopts25 -RUN apt-get install -y libsystemd0 valgrind nuttcp openssh-server bash -RUN apt-get install -y libtalloc2 liblz4-1 libkrb5-3 less haproxy libradcli4 -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - - -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD combo.pem /etc/ocserv/ -ADD haproxy-proxyproto.cfg /etc/haproxy/haproxy.cfg -ADD ocserv-proxyproto.conf /etc/ocserv/ocserv.conf -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -ADD proxy-connectscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;/etc/init.d/ssh restart;mkdir -p /tmp/disconnect/;mkdir -p /tmp/connect;/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg;/usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Dockerfile-debian-tcp b/tests/docker-ocserv/Dockerfile-debian-tcp deleted file mode 100644 index fa8f1c6a..00000000 --- a/tests/docker-ocserv/Dockerfile-debian-tcp +++ /dev/null @@ -1,29 +0,0 @@ -FROM debian:stretch - -RUN apt-get update -RUN apt-get install -y libgnutls30 libprotobuf-c1 liboath0 libev4 -RUN apt-get install -y libwrap0 libpam0g libseccomp2 libdbus-1-3 libreadline5 libnl-route-3-200 -RUN apt-get install -y libhttp-parser2.1 libpcl1 libopts25 autogen -RUN apt-get install -y libsystemd0 valgrind nuttcp openssh-server bash -RUN apt-get install -y libtalloc2 libradcli4 libkrb5-3 less liblz4-1 -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD ocserv.conf /etc/ocserv/ -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;/etc/init.d/ssh restart;mkdir -p /tmp/disconnect/;usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Dockerfile-debian-unix b/tests/docker-ocserv/Dockerfile-debian-unix deleted file mode 100644 index 764826aa..00000000 --- a/tests/docker-ocserv/Dockerfile-debian-unix +++ /dev/null @@ -1,32 +0,0 @@ -FROM debian:stretch - -RUN apt-get update -y -RUN apt-get install -y haproxy libgnutls30 libprotobuf-c1 liboath0 libev4 -RUN apt-get install -y libwrap0 libpam0g libseccomp2 libdbus-1-3 libreadline5 libnl-route-3-200 -RUN apt-get install -y libhttp-parser2.1 libpcl1 libopts25 autogen -RUN apt-get install -y libsystemd0 valgrind nuttcp openssh-server bash -RUN apt-get install -y libtalloc2 libradcli4 libkrb5-3 less liblz4-1 -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - - -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD combo.pem /etc/ocserv/ -ADD haproxy.cfg /etc/haproxy/ -ADD ocserv-unix.conf /etc/ocserv/ocserv.conf -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;/etc/init.d/ssh restart;mkdir -p /tmp/disconnect/;/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg;/usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Dockerfile-fedora-proxyproto b/tests/docker-ocserv/Dockerfile-fedora-proxyproto deleted file mode 100644 index 19cf6f19..00000000 --- a/tests/docker-ocserv/Dockerfile-fedora-proxyproto +++ /dev/null @@ -1,34 +0,0 @@ -FROM fedora:25 - -RUN yum install -y gnutls gnutls-utils protobuf-c iproute pcllib http-parser tcp_wrappers pam systemd libseccomp -RUN yum install -y bash openssh-server nuttcp -RUN systemctl enable sshd -RUN yum install -y libnl3 libtalloc haproxy libev -RUN yum install -y freeradius-client -RUN yum install -y lz4 radcli liboauth oathtool procps-ng iputils -RUN yum install -y krb5-libs less -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - - -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD combo.pem /etc/ocserv/ -ADD haproxy-proxyproto.cfg /etc/haproxy/haproxy.cfg -ADD ocserv-proxyproto.conf /etc/ocserv/ocserv.conf -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -ADD proxy-connectscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;sshd-keygen;/usr/sbin/sshd;mkdir -p /tmp/disconnect/;/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg;/usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Dockerfile-fedora-proxyproto-unix b/tests/docker-ocserv/Dockerfile-fedora-proxyproto-unix deleted file mode 100644 index c190909b..00000000 --- a/tests/docker-ocserv/Dockerfile-fedora-proxyproto-unix +++ /dev/null @@ -1,34 +0,0 @@ -FROM fedora:25 - -RUN yum install -y gnutls gnutls-utils protobuf-c iproute pcllib http-parser tcp_wrappers pam systemd libseccomp -RUN yum install -y bash openssh-server nuttcp -RUN systemctl enable sshd -RUN yum install -y libnl3 libtalloc haproxy libev -RUN yum install -y freeradius-client -RUN yum install -y lz4 radcli liboauth oathtool procps-ng iputils -RUN yum install -y krb5-libs less -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - - -ADD ca.pem /etc/ocserv/ -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD combo.pem /etc/ocserv/ -ADD haproxy-proxyproto-unix.cfg /etc/haproxy/haproxy.cfg -ADD ocserv-proxyproto-unix.conf /etc/ocserv/ocserv.conf -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;sshd-keygen;/usr/sbin/sshd;mkdir -p /tmp/disconnect/;/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg;/usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Dockerfile-fedora-proxyproto-v1 b/tests/docker-ocserv/Dockerfile-fedora-proxyproto-v1 deleted file mode 100644 index ec7fa165..00000000 --- a/tests/docker-ocserv/Dockerfile-fedora-proxyproto-v1 +++ /dev/null @@ -1,34 +0,0 @@ -FROM fedora:25 - -RUN yum install -y gnutls gnutls-utils protobuf-c iproute pcllib http-parser tcp_wrappers pam systemd libseccomp -RUN yum install -y bash openssh-server nuttcp -RUN systemctl enable sshd -RUN yum install -y libnl3 libtalloc haproxy libev -RUN yum install -y freeradius-client -RUN yum install -y lz4 radcli liboauth oathtool procps-ng iputils -RUN yum install -y krb5-libs less -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - - -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD combo.pem /etc/ocserv/ -ADD haproxy-proxyproto-v1.cfg /etc/haproxy/haproxy.cfg -ADD ocserv-proxyproto-v1.conf /etc/ocserv/ocserv.conf -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -ADD proxy-connectscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;sshd-keygen;/usr/sbin/sshd;mkdir -p /tmp/disconnect/;/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg;/usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Dockerfile-fedora-reload b/tests/docker-ocserv/Dockerfile-fedora-reload deleted file mode 100644 index c577f419..00000000 --- a/tests/docker-ocserv/Dockerfile-fedora-reload +++ /dev/null @@ -1,31 +0,0 @@ -FROM fedora:25 - -RUN yum install -y gnutls gnutls-utils protobuf-c iproute pcllib http-parser tcp_wrappers pam systemd libseccomp -RUN yum install -y bash openssh-server nuttcp -RUN yum install -y libnl3 libtalloc libev -RUN yum install -y freeradius-client -RUN yum install -y lz4 radcli liboauth oathtool procps-ng iputils -RUN yum install -y krb5-libs less psmisc -RUN systemctl enable sshd -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - - -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD ocserv-reload.conf /etc/ocserv/ocserv.conf -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;sshd-keygen;/usr/sbin/sshd;mkdir -p /tmp/disconnect/;usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Dockerfile-fedora-tcp b/tests/docker-ocserv/Dockerfile-fedora-tcp deleted file mode 100644 index 5892543d..00000000 --- a/tests/docker-ocserv/Dockerfile-fedora-tcp +++ /dev/null @@ -1,31 +0,0 @@ -FROM fedora:25 - -RUN yum install -y gnutls gnutls-utils protobuf-c iproute pcllib http-parser tcp_wrappers pam systemd libseccomp -RUN yum install -y bash openssh-server nuttcp -RUN yum install -y libnl3 libtalloc libev -RUN yum install -y freeradius-client -RUN yum install -y lz4 radcli liboauth oathtool procps-ng iputils -RUN yum install -y krb5-libs less -RUN systemctl enable sshd -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - - -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD ocserv.conf /etc/ocserv/ -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;sshd-keygen;/usr/sbin/sshd;mkdir -p /tmp/disconnect/;usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Dockerfile-fedora-unix b/tests/docker-ocserv/Dockerfile-fedora-unix deleted file mode 100644 index 2324caee..00000000 --- a/tests/docker-ocserv/Dockerfile-fedora-unix +++ /dev/null @@ -1,33 +0,0 @@ -FROM fedora:25 - -RUN yum install -y gnutls gnutls-utils protobuf-c iproute pcllib http-parser tcp_wrappers pam systemd libseccomp -RUN yum install -y bash openssh-server nuttcp -RUN systemctl enable sshd -RUN yum install -y libnl3 libtalloc haproxy libev -RUN yum install -y freeradius-client -RUN yum install -y lz4 radcli liboauth oathtool procps-ng iputils -RUN yum install -y krb5-libs less -RUN sed 's/PermitRootLogin without-password/PermitRootLogin yes/g' -i /etc/ssh/sshd_config - -RUN echo 'root:root' |chpasswd -RUN useradd -m -d /home/admin -s /bin/bash admin -RUN echo 'admin:admin' |chpasswd - -RUN mkdir /etc/ocserv - - -ADD key.pem /etc/ocserv/ -ADD cert.pem /etc/ocserv/ -ADD combo.pem /etc/ocserv/ -ADD haproxy.cfg /etc/haproxy/ -ADD ocserv-unix.conf /etc/ocserv/ocserv.conf -ADD passwd /etc/ocserv/ -ADD ocserv /usr/sbin/ -ADD ocpasswd /usr/bin/ -ADD occtl /usr/bin/ -ADD myscript /usr/bin/ -# It's not possible to use mknod inside a container with the default LXC -# template, so we untar it from this archive. -ADD dev-tun.tgz /dev/ - -CMD nuttcp -S;sshd-keygen;/usr/sbin/sshd;mkdir -p /tmp/disconnect/;/usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg;/usr/sbin/ocserv -d 1 -f;sleep 3600 diff --git a/tests/docker-ocserv/Makefile.am b/tests/docker-ocserv/Makefile.am deleted file mode 100644 index 9fe119b4..00000000 --- a/tests/docker-ocserv/Makefile.am +++ /dev/null @@ -1,10 +0,0 @@ -EXTRA_DIST = passwd ocserv.conf Dockerfile-debian-tcp dev-tun.tgz myscript key.pem cert.pem \ - Dockerfile-debian-unix ocserv-unix.conf haproxy.cfg combo.pem Dockerfile-fedora-unix \ - Dockerfile-fedora-tcp ca.pem ocserv-proxyproto.conf Dockerfile-fedora-proxyproto haproxy-proxyproto.cfg \ - haproxy-proxyproto-unix.cfg Dockerfile-fedora-proxyproto-unix ocserv-proxyproto-unix.conf \ - proxy-connectscript \ - Dockerfile-fedora-reload \ - ocserv-reload.conf - -TESTS_ENVIRONMENT = srcdir="$(srcdir)" \ - top_builddir="$(top_builddir)" diff --git a/tests/docker-ocserv/ca.pem b/tests/docker-ocserv/ca.pem deleted file mode 100644 index c4058ee0..00000000 --- a/tests/docker-ocserv/ca.pem +++ /dev/null @@ -1,20 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD -EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw -fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ -l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW -DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh -zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt -c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b -7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep -n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA -MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC -ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT -z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP -g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX -ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk -x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH -yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg -fJbi9Ui2FmXEeKkX34f1ONNj9Q== ------END CERTIFICATE----- diff --git a/tests/docker-ocserv/cert.pem b/tests/docker-ocserv/cert.pem deleted file mode 100644 index 4acde02b..00000000 --- a/tests/docker-ocserv/cert.pem +++ /dev/null @@ -1,22 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD -Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs -PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 -u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd -YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ -IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 -KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 -7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU -yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL -gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg -ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 -UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s -9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 -GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C -zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ -eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF -FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j -LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM -zzJKdNg= ------END CERTIFICATE----- diff --git a/tests/docker-ocserv/combo.pem b/tests/docker-ocserv/combo.pem deleted file mode 100644 index 0dee3459..00000000 --- a/tests/docker-ocserv/combo.pem +++ /dev/null @@ -1,187 +0,0 @@ -Public Key Info: - Public Key Algorithm: RSA - Key Security Level: Normal (2432 bits) - -modulus: - 00:a7:3a:2b:ec:3f:14:b0:2c:19:f6:f1:6e:90:1d: - bf:8e:a9:f6:e9:70:84:09:87:f3:50:f3:5f:c3:94: - 50:fa:2c:64:d6:57:80:58:e1:96:fc:ee:d0:bd:04: - 15:7e:5f:7f:a5:33:f8:fc:bb:91:ef:37:79:c3:5a: - db:f8:19:ed:03:af:22:d6:e9:37:2c:e8:53:c2:b7: - 8b:2b:11:f0:a4:87:99:79:e0:ba:cc:99:66:e1:16: - 09:15:94:de:5f:4e:aa:18:d2:59:dd:60:9c:76:5f: - c5:96:95:d4:63:78:bf:bc:13:b9:c5:51:c1:52:b5: - 6a:e0:8b:d0:33:80:c1:6b:8e:c2:f8:a6:a9:7d:ed: - 80:19:45:77:0c:a1:05:d5:8d:b4:66:cd:52:d9:21: - 5b:a6:43:2e:dc:fa:d9:7b:12:ac:fc:97:1f:f1:4b: - fe:45:c7:db:48:46:e9:ea:35:2e:63:11:4b:3c:36: - 7e:44:e8:5b:eb:68:07:32:f9:e2:34:81:74:c6:93: - be:7d:28:d3:d8:8a:c4:aa:02:e1:40:9a:6b:7f:5c: - 34:d3:be:f3:a8:e9:da:40:b1:e5:ea:b5:1d:bf:2e: - 36:49:58:e9:57:76:26:7f:ca:31:e0:e7:e4:4a:43: - 97:6d:dd:d9:39:ee:50:08:58:44:7d:7a:02:0e:a3: - ff:86:02:4c:9e:93:46:49:e4:65:94:e9:5c:53:b0: - 57:08:97:aa:32:dd:2e:c4:b4:1d:0d:08:83:3b:86: - f8:72:df:64:2b:27:96:54:c8:d9:dc:4d:27:fa:a8: - c5:68:79:d8:1d: - -public exponent: - 01:00:01: - -private exponent: - 79:2b:86:6d:fd:5b:41:38:03:6c:52:8e:59:70:a4: - bf:7b:da:44:55:d9:e6:8a:12:bd:22:4b:ce:8c:66: - 8c:8f:a4:55:47:3b:e1:ab:3c:5b:73:b3:de:71:da: - 1d:22:97:7c:1e:07:99:21:54:61:f0:61:93:32:ff: - d6:6a:fa:b9:43:aa:cb:ec:5a:a5:78:86:50:bd:eb: - e2:3e:72:8e:d5:0e:59:28:84:52:02:09:70:a9:25: - d5:f4:73:98:bd:88:34:ca:1e:81:71:22:8e:07:61: - 45:76:b5:59:8a:41:eb:c6:a3:42:1d:b6:25:f6:fc: - 45:4e:29:83:58:15:4e:99:38:1f:31:ab:f8:6a:21: - fa:ad:c1:d0:6d:d0:ab:67:ad:43:1c:1d:9e:e5:33: - e2:68:f9:e2:fa:d8:9a:e7:36:e0:20:8c:25:4d:e9: - 17:95:4b:71:38:df:18:71:cd:e0:a0:7f:b2:58:fe: - 8b:c0:1c:d2:96:4a:17:14:bf:1c:3b:e8:b5:54:2b: - 8d:47:50:a7:77:56:61:a8:e3:79:dd:70:88:5f:89: - a1:f8:78:0d:47:ef:32:98:c1:47:88:d8:33:ed:95: - 10:90:7f:f1:57:cb:2b:18:c9:58:a1:de:ef:1c:70: - 5a:58:3c:86:3d:96:17:ad:9c:fd:0b:eb:d8:33:a4: - 5f:7f:db:97:c0:78:b4:94:56:56:0a:83:b3:d3:02: - c6:6f:08:dc:0d:22:8f:2a:4b:25:7a:34:97:8e:63: - 49:8a:39:d1:c1:1e:9b:93:41:c5:9c:b6:50:9e:ff: - 7a:37:e4:c1: - -prime1: - 00:cb:13:4a:a3:8f:ad:5c:63:89:30:f3:3b:eb:25: - 85:d9:6c:ad:6d:50:f8:03:00:d3:1e:e3:ae:ad:54: - 7a:9b:21:1a:72:18:a6:54:e4:32:58:8d:66:37:65: - 8c:f7:8f:37:65:ec:f8:ef:2e:a9:c1:78:bb:04:90: - aa:fe:0a:f2:7c:80:82:32:c7:db:ef:bc:10:c6:ff: - e0:d4:2e:b9:3a:0e:cc:29:28:81:b8:41:78:37:80: - 69:39:5e:97:44:36:d6:cd:39:af:14:c2:df:f3:67: - b7:d4:a7:49:da:f4:d3:ee:14:10:e4:5c:3f:4a:62: - 52:81:34:d0:8e:f3:7e:d4:42:0a:34:e2:f9:a7:bc: - 03:f9:c0:48:e8:9b:7f:da:08:ec:db:82:fd:a2:aa: - 0f:5d:71: - -prime2: - 00:d2:cf:2d:81:00:28:43:76:b3:76:10:3f:04:57: - 63:94:fa:bb:08:6a:a2:7d:99:4b:0f:ad:76:11:da: - 5c:2a:2b:33:0a:05:0d:f8:51:9a:4d:b3:40:4b:53: - 63:c8:c1:96:45:c7:42:35:cf:05:cf:8a:e2:aa:bd: - dc:96:c0:fd:c8:c4:dc:4c:0b:1f:43:74:04:cf:13: - f5:fa:ea:b6:0d:82:92:8c:03:bd:e9:7b:b1:f2:d0: - df:fd:c5:1b:6e:66:b7:ce:f6:12:65:34:c8:15:01: - da:36:5e:f9:d8:ad:37:86:52:2b:ea:9f:f5:75:6b: - 91:b3:01:6f:52:e9:e9:07:16:db:ba:65:e2:49:cc: - 4f:70:11:39:5c:fa:d2:da:d4:0c:24:17:c4:68:6f: - d4:7f:6d: - -coefficient: - 3b:96:f2:06:96:22:14:a2:fe:27:09:2f:43:b0:22: - a6:f4:ae:33:c2:f8:be:d5:03:96:7d:4a:d1:eb:7b: - 9d:51:bd:77:1d:3f:79:ef:62:1d:c3:e9:c2:9a:53: - df:ec:33:9b:32:36:f6:e7:40:e8:6c:1b:16:3d:4e: - 94:97:94:02:5d:cc:23:45:6b:53:8d:b8:7c:0e:24: - f9:5c:30:e4:e3:76:5b:f6:1f:74:3d:ca:e7:ef:a0: - 1e:d3:c8:a2:54:d2:db:06:4b:0d:b0:b9:64:ca:dd: - 68:44:51:d6:07:c5:ac:5b:e7:11:4b:76:b0:78:ba: - aa:b1:af:06:64:0d:27:1a:85:2d:a8:5a:c1:d7:c1: - 2e:f6:ef:fe:f6:0d:d6:f1:18:fc:0b:14:b1:d7:76: - 51:1b: - -exp1: - 76:ce:d4:8e:18:92:ee:48:75:8d:23:e0:dc:53:d9: - 99:38:d1:c5:f0:e7:08:aa:c4:d9:7f:8f:44:6c:f6: - 46:27:f9:d6:e2:c0:fd:4d:7c:7e:fe:4a:dd:02:16: - 95:07:3e:fb:ec:c6:3e:f8:e7:eb:fe:fc:3b:51:80: - 18:9c:c2:fd:40:19:ec:27:ad:6e:f6:72:42:5a:95: - 68:cd:e5:24:28:60:1d:7c:4b:58:47:45:54:03:56: - 8c:6f:e0:c3:d1:e9:9d:ab:af:d8:cf:a2:42:3f:5d: - f7:95:df:c9:b0:0f:05:6c:cb:ed:2e:63:00:db:c1: - 35:42:76:fa:0b:4f:1a:53:80:b1:2c:51:af:66:7a: - 54:f5:c0:32:06:37:a8:92:2c:30:c8:d4:27:04:a3: - 74:a1: - -exp2: - 18:07:41:5a:88:d8:0e:08:83:a0:1b:6d:f3:62:ba: - 99:0a:93:32:fc:64:95:08:5a:03:e9:73:a1:c9:4f: - e4:06:94:84:b9:da:c3:c9:19:5b:6d:e9:10:2c:eb: - 1c:c0:e4:0e:04:0e:49:ef:d4:eb:b9:1a:e8:f7:47: - 23:6f:cf:fd:88:62:cb:d0:20:ba:21:89:42:c9:35: - aa:6a:02:62:3b:d5:d4:5b:c0:d3:d2:23:90:57:ba: - 90:44:5d:42:12:37:35:41:db:0a:ea:1f:3c:35:bf: - d7:9e:af:bf:c0:ce:a9:62:c8:5a:af:ec:dc:7b:6c: - 5a:08:f9:d5:6b:90:02:1c:da:e2:be:26:32:df:34: - d6:c3:3f:d4:97:4a:5d:62:fa:17:4b:16:3a:09:35: - 21:69: - - -Public Key ID: A8:25:47:F6:8F:44:D6:35:1B:EF:6C:AC:D1:D7:B9:6E:84:F9:DF:A3 -Public key's random art: -+--[ RSA 2432]----+ -| + | -| . . = | -| o o . . . | -| o = = o| -| . + S . O.o| -| = . o * o.| -| . . . . o. | -| .+.| -| Eo.=| -+-----------------+ - ------BEGIN RSA PRIVATE KEY----- -MIIFegIBAAKCATEApzor7D8UsCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leA -WOGW/O7QvQQVfl9/pTP4/LuR7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6 -zJlm4RYJFZTeX06qGNJZ3WCcdl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kap -fe2AGUV3DKEF1Y20Zs1S2SFbpkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ -ROhb62gHMvniNIF0xpO+fSjT2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjp -V3Ymf8ox4OfkSkOXbd3ZOe5QCFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0u -xLQdDQiDO4b4ct9kKyeWVMjZ3E0n+qjFaHnYHQIDAQABAoIBMHkrhm39W0E4A2xS -jllwpL972kRV2eaKEr0iS86MZoyPpFVHO+GrPFtzs95x2h0il3weB5khVGHwYZMy -/9Zq+rlDqsvsWqV4hlC96+I+co7VDlkohFICCXCpJdX0c5i9iDTKHoFxIo4HYUV2 -tVmKQevGo0IdtiX2/EVOKYNYFU6ZOB8xq/hqIfqtwdBt0KtnrUMcHZ7lM+Jo+eL6 -2JrnNuAgjCVN6ReVS3E43xhxzeCgf7JY/ovAHNKWShcUvxw76LVUK41HUKd3VmGo -43ndcIhfiaH4eA1H7zKYwUeI2DPtlRCQf/FXyysYyVih3u8ccFpYPIY9lhetnP0L -69gzpF9/25fAeLSUVlYKg7PTAsZvCNwNIo8qSyV6NJeOY0mKOdHBHpuTQcWctlCe -/3o35MECgZkAyxNKo4+tXGOJMPM76yWF2WytbVD4AwDTHuOurVR6myEachimVOQy -WI1mN2WM9483Zez47y6pwXi7BJCq/gryfICCMsfb77wQxv/g1C65Og7MKSiBuEF4 -N4BpOV6XRDbWzTmvFMLf82e31KdJ2vTT7hQQ5Fw/SmJSgTTQjvN+1EIKNOL5p7wD -+cBI6Jt/2gjs24L9oqoPXXECgZkA0s8tgQAoQ3azdhA/BFdjlPq7CGqifZlLD612 -EdpcKiszCgUN+FGaTbNAS1NjyMGWRcdCNc8Fz4riqr3clsD9yMTcTAsfQ3QEzxP1 -+uq2DYKSjAO96Xux8tDf/cUbbma3zvYSZTTIFQHaNl752K03hlIr6p/1dWuRswFv -UunpBxbbumXiScxPcBE5XPrS2tQMJBfEaG/Uf20CgZh2ztSOGJLuSHWNI+DcU9mZ -ONHF8OcIqsTZf49EbPZGJ/nW4sD9TXx+/krdAhaVBz777MY++Ofr/vw7UYAYnML9 -QBnsJ61u9nJCWpVozeUkKGAdfEtYR0VUA1aMb+DD0emdq6/Yz6JCP133ld/JsA8F -bMvtLmMA28E1Qnb6C08aU4CxLFGvZnpU9cAyBjeokiwwyNQnBKN0oQKBmBgHQVqI -2A4Ig6AbbfNiupkKkzL8ZJUIWgPpc6HJT+QGlIS52sPJGVtt6RAs6xzA5A4EDknv -1Ou5Guj3RyNvz/2IYsvQILohiULJNapqAmI71dRbwNPSI5BXupBEXUISNzVB2wrq -Hzw1v9eer7/AzqliyFqv7Nx7bFoI+dVrkAIc2uK+JjLfNNbDP9SXSl1i+hdLFjoJ -NSFpAoGYO5byBpYiFKL+JwkvQ7AipvSuM8L4vtUDln1K0et7nVG9dx0/ee9iHcPp -wppT3+wzmzI29udA6GwbFj1OlJeUAl3MI0VrU424fA4k+Vww5ON2W/YfdD3K5++g -HtPIolTS2wZLDbC5ZMrdaERR1gfFrFvnEUt2sHi6qrGvBmQNJxqFLahawdfBLvbv -/vYN1vEY/AsUsdd2URs= ------END RSA PRIVATE KEY----- ------BEGIN CERTIFICATE----- -MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD -Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs -PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 -u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd -YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ -IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 -KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 -7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU -yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL -gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg -ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 -UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s -9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 -GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C -zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ -eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF -FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j -LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM -zzJKdNg= ------END CERTIFICATE----- diff --git a/tests/docker-ocserv/dev-tun.tgz b/tests/docker-ocserv/dev-tun.tgz deleted file mode 100644 index b89b9787..00000000 Binary files a/tests/docker-ocserv/dev-tun.tgz and /dev/null differ diff --git a/tests/docker-ocserv/haproxy-proxyproto-unix.cfg b/tests/docker-ocserv/haproxy-proxyproto-unix.cfg deleted file mode 100644 index bb554242..00000000 --- a/tests/docker-ocserv/haproxy-proxyproto-unix.cfg +++ /dev/null @@ -1,42 +0,0 @@ -global -# log /dev/log local0 -# log /dev/log local1 notice -# chroot /var/lib/haproxy - stats socket /var/run/admin.sock mode 660 level admin - stats timeout 30s - user haproxy - group haproxy - daemon - - # Default SSL material locations - ca-base /etc/ssl/certs - crt-base /etc/ssl/private - - # Default ciphers to use on SSL-enabled listening sockets. - # For more information, see ciphers(1SSL). - ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL - -defaults - log global - mode http - option httplog - option dontlognull - timeout connect 5000 - timeout client 50000 - timeout server 50000 -# errorfile 400 /etc/haproxy/errors/400.http -# errorfile 403 /etc/haproxy/errors/403.http -# errorfile 408 /etc/haproxy/errors/408.http -# errorfile 500 /etc/haproxy/errors/500.http -# errorfile 502 /etc/haproxy/errors/502.http -# errorfile 503 /etc/haproxy/errors/503.http -# errorfile 504 /etc/haproxy/errors/504.http - -frontend www-https - bind 0.0.0.0:443 ssl crt /etc/ocserv/combo.pem ca-file /etc/ocserv/ca.pem verify required - reqadd X-Forwarded-Proto:\ https - default_backend www-backend - -backend www-backend - server ocserv unix@/var/run/ocserv-conn.socket check send-proxy-v2 send-proxy-v2-ssl-cn send-proxy-v2-ssl - diff --git a/tests/docker-ocserv/haproxy-proxyproto-v1.cfg b/tests/docker-ocserv/haproxy-proxyproto-v1.cfg deleted file mode 100644 index 8633ebe4..00000000 --- a/tests/docker-ocserv/haproxy-proxyproto-v1.cfg +++ /dev/null @@ -1,36 +0,0 @@ -global -# log /dev/log local0 -# log /dev/log local1 notice -# chroot /var/lib/haproxy - stats socket /var/run/admin.sock mode 660 level admin - stats timeout 30s - user haproxy - group haproxy - daemon - - # Default SSL material locations - ca-base /etc/ssl/certs - crt-base /etc/ssl/private - - # Default ciphers to use on SSL-enabled listening sockets. - # For more information, see ciphers(1SSL). - ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL - -defaults - log global - mode tcp - option dontlognull - timeout connect 5000 - timeout client 50000 - timeout server 50000 -# errorfile 400 /etc/haproxy/errors/400.http -# errorfile 403 /etc/haproxy/errors/403.http -# errorfile 408 /etc/haproxy/errors/408.http -# errorfile 500 /etc/haproxy/errors/500.http -# errorfile 502 /etc/haproxy/errors/502.http -# errorfile 503 /etc/haproxy/errors/503.http -# errorfile 504 /etc/haproxy/errors/504.http - -listen ssl-relay - bind 0.0.0.0:443 - server ocserv ipv4@127.0.0.1:5555 check send-proxy diff --git a/tests/docker-ocserv/haproxy-proxyproto.cfg b/tests/docker-ocserv/haproxy-proxyproto.cfg deleted file mode 100644 index b7193bb9..00000000 --- a/tests/docker-ocserv/haproxy-proxyproto.cfg +++ /dev/null @@ -1,36 +0,0 @@ -global -# log /dev/log local0 -# log /dev/log local1 notice -# chroot /var/lib/haproxy - stats socket /var/run/admin.sock mode 660 level admin - stats timeout 30s - user haproxy - group haproxy - daemon - - # Default SSL material locations - ca-base /etc/ssl/certs - crt-base /etc/ssl/private - - # Default ciphers to use on SSL-enabled listening sockets. - # For more information, see ciphers(1SSL). - ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL - -defaults - log global - mode tcp - option dontlognull - timeout connect 5000 - timeout client 50000 - timeout server 50000 -# errorfile 400 /etc/haproxy/errors/400.http -# errorfile 403 /etc/haproxy/errors/403.http -# errorfile 408 /etc/haproxy/errors/408.http -# errorfile 500 /etc/haproxy/errors/500.http -# errorfile 502 /etc/haproxy/errors/502.http -# errorfile 503 /etc/haproxy/errors/503.http -# errorfile 504 /etc/haproxy/errors/504.http - -listen ssl-relay - bind 0.0.0.0:443 - server ocserv ipv4@127.0.0.1:5555 check send-proxy-v2 send-proxy-v2-ssl-cn diff --git a/tests/docker-ocserv/haproxy.cfg b/tests/docker-ocserv/haproxy.cfg deleted file mode 100644 index 26330f3b..00000000 --- a/tests/docker-ocserv/haproxy.cfg +++ /dev/null @@ -1,41 +0,0 @@ -global -# log /dev/log local0 -# log /dev/log local1 notice -# chroot /var/lib/haproxy - stats socket /var/run/admin.sock mode 660 level admin - stats timeout 30s - user haproxy - group haproxy - daemon - - # Default SSL material locations - ca-base /etc/ssl/certs - crt-base /etc/ssl/private - - # Default ciphers to use on SSL-enabled listening sockets. - # For more information, see ciphers(1SSL). - ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL - -defaults - log global - mode http - option httplog - option dontlognull - timeout connect 5000 - timeout client 50000 - timeout server 50000 -# errorfile 400 /etc/haproxy/errors/400.http -# errorfile 403 /etc/haproxy/errors/403.http -# errorfile 408 /etc/haproxy/errors/408.http -# errorfile 500 /etc/haproxy/errors/500.http -# errorfile 502 /etc/haproxy/errors/502.http -# errorfile 503 /etc/haproxy/errors/503.http -# errorfile 504 /etc/haproxy/errors/504.http - -frontend www-https - bind 0.0.0.0:6551 ssl crt /etc/ocserv/combo.pem - reqadd X-Forwarded-Proto:\ https - default_backend www-backend - -backend www-backend - server ocserv unix@/var/run/ocserv-conn.socket check diff --git a/tests/docker-ocserv/key.pem b/tests/docker-ocserv/key.pem deleted file mode 100644 index 0de36f5e..00000000 --- a/tests/docker-ocserv/key.pem +++ /dev/null @@ -1,165 +0,0 @@ -Public Key Info: - Public Key Algorithm: RSA - Key Security Level: Normal (2432 bits) - -modulus: - 00:a7:3a:2b:ec:3f:14:b0:2c:19:f6:f1:6e:90:1d: - bf:8e:a9:f6:e9:70:84:09:87:f3:50:f3:5f:c3:94: - 50:fa:2c:64:d6:57:80:58:e1:96:fc:ee:d0:bd:04: - 15:7e:5f:7f:a5:33:f8:fc:bb:91:ef:37:79:c3:5a: - db:f8:19:ed:03:af:22:d6:e9:37:2c:e8:53:c2:b7: - 8b:2b:11:f0:a4:87:99:79:e0:ba:cc:99:66:e1:16: - 09:15:94:de:5f:4e:aa:18:d2:59:dd:60:9c:76:5f: - c5:96:95:d4:63:78:bf:bc:13:b9:c5:51:c1:52:b5: - 6a:e0:8b:d0:33:80:c1:6b:8e:c2:f8:a6:a9:7d:ed: - 80:19:45:77:0c:a1:05:d5:8d:b4:66:cd:52:d9:21: - 5b:a6:43:2e:dc:fa:d9:7b:12:ac:fc:97:1f:f1:4b: - fe:45:c7:db:48:46:e9:ea:35:2e:63:11:4b:3c:36: - 7e:44:e8:5b:eb:68:07:32:f9:e2:34:81:74:c6:93: - be:7d:28:d3:d8:8a:c4:aa:02:e1:40:9a:6b:7f:5c: - 34:d3:be:f3:a8:e9:da:40:b1:e5:ea:b5:1d:bf:2e: - 36:49:58:e9:57:76:26:7f:ca:31:e0:e7:e4:4a:43: - 97:6d:dd:d9:39:ee:50:08:58:44:7d:7a:02:0e:a3: - ff:86:02:4c:9e:93:46:49:e4:65:94:e9:5c:53:b0: - 57:08:97:aa:32:dd:2e:c4:b4:1d:0d:08:83:3b:86: - f8:72:df:64:2b:27:96:54:c8:d9:dc:4d:27:fa:a8: - c5:68:79:d8:1d: - -public exponent: - 01:00:01: - -private exponent: - 79:2b:86:6d:fd:5b:41:38:03:6c:52:8e:59:70:a4: - bf:7b:da:44:55:d9:e6:8a:12:bd:22:4b:ce:8c:66: - 8c:8f:a4:55:47:3b:e1:ab:3c:5b:73:b3:de:71:da: - 1d:22:97:7c:1e:07:99:21:54:61:f0:61:93:32:ff: - d6:6a:fa:b9:43:aa:cb:ec:5a:a5:78:86:50:bd:eb: - e2:3e:72:8e:d5:0e:59:28:84:52:02:09:70:a9:25: - d5:f4:73:98:bd:88:34:ca:1e:81:71:22:8e:07:61: - 45:76:b5:59:8a:41:eb:c6:a3:42:1d:b6:25:f6:fc: - 45:4e:29:83:58:15:4e:99:38:1f:31:ab:f8:6a:21: - fa:ad:c1:d0:6d:d0:ab:67:ad:43:1c:1d:9e:e5:33: - e2:68:f9:e2:fa:d8:9a:e7:36:e0:20:8c:25:4d:e9: - 17:95:4b:71:38:df:18:71:cd:e0:a0:7f:b2:58:fe: - 8b:c0:1c:d2:96:4a:17:14:bf:1c:3b:e8:b5:54:2b: - 8d:47:50:a7:77:56:61:a8:e3:79:dd:70:88:5f:89: - a1:f8:78:0d:47:ef:32:98:c1:47:88:d8:33:ed:95: - 10:90:7f:f1:57:cb:2b:18:c9:58:a1:de:ef:1c:70: - 5a:58:3c:86:3d:96:17:ad:9c:fd:0b:eb:d8:33:a4: - 5f:7f:db:97:c0:78:b4:94:56:56:0a:83:b3:d3:02: - c6:6f:08:dc:0d:22:8f:2a:4b:25:7a:34:97:8e:63: - 49:8a:39:d1:c1:1e:9b:93:41:c5:9c:b6:50:9e:ff: - 7a:37:e4:c1: - -prime1: - 00:cb:13:4a:a3:8f:ad:5c:63:89:30:f3:3b:eb:25: - 85:d9:6c:ad:6d:50:f8:03:00:d3:1e:e3:ae:ad:54: - 7a:9b:21:1a:72:18:a6:54:e4:32:58:8d:66:37:65: - 8c:f7:8f:37:65:ec:f8:ef:2e:a9:c1:78:bb:04:90: - aa:fe:0a:f2:7c:80:82:32:c7:db:ef:bc:10:c6:ff: - e0:d4:2e:b9:3a:0e:cc:29:28:81:b8:41:78:37:80: - 69:39:5e:97:44:36:d6:cd:39:af:14:c2:df:f3:67: - b7:d4:a7:49:da:f4:d3:ee:14:10:e4:5c:3f:4a:62: - 52:81:34:d0:8e:f3:7e:d4:42:0a:34:e2:f9:a7:bc: - 03:f9:c0:48:e8:9b:7f:da:08:ec:db:82:fd:a2:aa: - 0f:5d:71: - -prime2: - 00:d2:cf:2d:81:00:28:43:76:b3:76:10:3f:04:57: - 63:94:fa:bb:08:6a:a2:7d:99:4b:0f:ad:76:11:da: - 5c:2a:2b:33:0a:05:0d:f8:51:9a:4d:b3:40:4b:53: - 63:c8:c1:96:45:c7:42:35:cf:05:cf:8a:e2:aa:bd: - dc:96:c0:fd:c8:c4:dc:4c:0b:1f:43:74:04:cf:13: - f5:fa:ea:b6:0d:82:92:8c:03:bd:e9:7b:b1:f2:d0: - df:fd:c5:1b:6e:66:b7:ce:f6:12:65:34:c8:15:01: - da:36:5e:f9:d8:ad:37:86:52:2b:ea:9f:f5:75:6b: - 91:b3:01:6f:52:e9:e9:07:16:db:ba:65:e2:49:cc: - 4f:70:11:39:5c:fa:d2:da:d4:0c:24:17:c4:68:6f: - d4:7f:6d: - -coefficient: - 3b:96:f2:06:96:22:14:a2:fe:27:09:2f:43:b0:22: - a6:f4:ae:33:c2:f8:be:d5:03:96:7d:4a:d1:eb:7b: - 9d:51:bd:77:1d:3f:79:ef:62:1d:c3:e9:c2:9a:53: - df:ec:33:9b:32:36:f6:e7:40:e8:6c:1b:16:3d:4e: - 94:97:94:02:5d:cc:23:45:6b:53:8d:b8:7c:0e:24: - f9:5c:30:e4:e3:76:5b:f6:1f:74:3d:ca:e7:ef:a0: - 1e:d3:c8:a2:54:d2:db:06:4b:0d:b0:b9:64:ca:dd: - 68:44:51:d6:07:c5:ac:5b:e7:11:4b:76:b0:78:ba: - aa:b1:af:06:64:0d:27:1a:85:2d:a8:5a:c1:d7:c1: - 2e:f6:ef:fe:f6:0d:d6:f1:18:fc:0b:14:b1:d7:76: - 51:1b: - -exp1: - 76:ce:d4:8e:18:92:ee:48:75:8d:23:e0:dc:53:d9: - 99:38:d1:c5:f0:e7:08:aa:c4:d9:7f:8f:44:6c:f6: - 46:27:f9:d6:e2:c0:fd:4d:7c:7e:fe:4a:dd:02:16: - 95:07:3e:fb:ec:c6:3e:f8:e7:eb:fe:fc:3b:51:80: - 18:9c:c2:fd:40:19:ec:27:ad:6e:f6:72:42:5a:95: - 68:cd:e5:24:28:60:1d:7c:4b:58:47:45:54:03:56: - 8c:6f:e0:c3:d1:e9:9d:ab:af:d8:cf:a2:42:3f:5d: - f7:95:df:c9:b0:0f:05:6c:cb:ed:2e:63:00:db:c1: - 35:42:76:fa:0b:4f:1a:53:80:b1:2c:51:af:66:7a: - 54:f5:c0:32:06:37:a8:92:2c:30:c8:d4:27:04:a3: - 74:a1: - -exp2: - 18:07:41:5a:88:d8:0e:08:83:a0:1b:6d:f3:62:ba: - 99:0a:93:32:fc:64:95:08:5a:03:e9:73:a1:c9:4f: - e4:06:94:84:b9:da:c3:c9:19:5b:6d:e9:10:2c:eb: - 1c:c0:e4:0e:04:0e:49:ef:d4:eb:b9:1a:e8:f7:47: - 23:6f:cf:fd:88:62:cb:d0:20:ba:21:89:42:c9:35: - aa:6a:02:62:3b:d5:d4:5b:c0:d3:d2:23:90:57:ba: - 90:44:5d:42:12:37:35:41:db:0a:ea:1f:3c:35:bf: - d7:9e:af:bf:c0:ce:a9:62:c8:5a:af:ec:dc:7b:6c: - 5a:08:f9:d5:6b:90:02:1c:da:e2:be:26:32:df:34: - d6:c3:3f:d4:97:4a:5d:62:fa:17:4b:16:3a:09:35: - 21:69: - - -Public Key ID: A8:25:47:F6:8F:44:D6:35:1B:EF:6C:AC:D1:D7:B9:6E:84:F9:DF:A3 -Public key's random art: -+--[ RSA 2432]----+ -| + | -| . . = | -| o o . . . | -| o = = o| -| . + S . O.o| -| = . o * o.| -| . . . . o. | -| .+.| -| Eo.=| -+-----------------+ - ------BEGIN RSA PRIVATE KEY----- -MIIFegIBAAKCATEApzor7D8UsCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leA -WOGW/O7QvQQVfl9/pTP4/LuR7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6 -zJlm4RYJFZTeX06qGNJZ3WCcdl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kap -fe2AGUV3DKEF1Y20Zs1S2SFbpkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ -ROhb62gHMvniNIF0xpO+fSjT2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjp -V3Ymf8ox4OfkSkOXbd3ZOe5QCFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0u -xLQdDQiDO4b4ct9kKyeWVMjZ3E0n+qjFaHnYHQIDAQABAoIBMHkrhm39W0E4A2xS -jllwpL972kRV2eaKEr0iS86MZoyPpFVHO+GrPFtzs95x2h0il3weB5khVGHwYZMy -/9Zq+rlDqsvsWqV4hlC96+I+co7VDlkohFICCXCpJdX0c5i9iDTKHoFxIo4HYUV2 -tVmKQevGo0IdtiX2/EVOKYNYFU6ZOB8xq/hqIfqtwdBt0KtnrUMcHZ7lM+Jo+eL6 -2JrnNuAgjCVN6ReVS3E43xhxzeCgf7JY/ovAHNKWShcUvxw76LVUK41HUKd3VmGo -43ndcIhfiaH4eA1H7zKYwUeI2DPtlRCQf/FXyysYyVih3u8ccFpYPIY9lhetnP0L -69gzpF9/25fAeLSUVlYKg7PTAsZvCNwNIo8qSyV6NJeOY0mKOdHBHpuTQcWctlCe -/3o35MECgZkAyxNKo4+tXGOJMPM76yWF2WytbVD4AwDTHuOurVR6myEachimVOQy -WI1mN2WM9483Zez47y6pwXi7BJCq/gryfICCMsfb77wQxv/g1C65Og7MKSiBuEF4 -N4BpOV6XRDbWzTmvFMLf82e31KdJ2vTT7hQQ5Fw/SmJSgTTQjvN+1EIKNOL5p7wD -+cBI6Jt/2gjs24L9oqoPXXECgZkA0s8tgQAoQ3azdhA/BFdjlPq7CGqifZlLD612 -EdpcKiszCgUN+FGaTbNAS1NjyMGWRcdCNc8Fz4riqr3clsD9yMTcTAsfQ3QEzxP1 -+uq2DYKSjAO96Xux8tDf/cUbbma3zvYSZTTIFQHaNl752K03hlIr6p/1dWuRswFv -UunpBxbbumXiScxPcBE5XPrS2tQMJBfEaG/Uf20CgZh2ztSOGJLuSHWNI+DcU9mZ -ONHF8OcIqsTZf49EbPZGJ/nW4sD9TXx+/krdAhaVBz777MY++Ofr/vw7UYAYnML9 -QBnsJ61u9nJCWpVozeUkKGAdfEtYR0VUA1aMb+DD0emdq6/Yz6JCP133ld/JsA8F -bMvtLmMA28E1Qnb6C08aU4CxLFGvZnpU9cAyBjeokiwwyNQnBKN0oQKBmBgHQVqI -2A4Ig6AbbfNiupkKkzL8ZJUIWgPpc6HJT+QGlIS52sPJGVtt6RAs6xzA5A4EDknv -1Ou5Guj3RyNvz/2IYsvQILohiULJNapqAmI71dRbwNPSI5BXupBEXUISNzVB2wrq -Hzw1v9eer7/AzqliyFqv7Nx7bFoI+dVrkAIc2uK+JjLfNNbDP9SXSl1i+hdLFjoJ -NSFpAoGYO5byBpYiFKL+JwkvQ7AipvSuM8L4vtUDln1K0et7nVG9dx0/ee9iHcPp -wppT3+wzmzI29udA6GwbFj1OlJeUAl3MI0VrU424fA4k+Vww5ON2W/YfdD3K5++g -HtPIolTS2wZLDbC5ZMrdaERR1gfFrFvnEUt2sHi6qrGvBmQNJxqFLahawdfBLvbv -/vYN1vEY/AsUsdd2URs= ------END RSA PRIVATE KEY----- diff --git a/tests/docker-ocserv/myscript b/tests/docker-ocserv/myscript deleted file mode 100755 index d71f406b..00000000 --- a/tests/docker-ocserv/myscript +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/sh - -if [ "$REASON" != "connect" ];then - if test "$STATS_BYTES_IN" != "0";then - echo $STATS_BYTES_IN >/tmp/disconnect/ok - else - echo $STATS_BYTES_IN >/tmp/disconnect/not-ok - fi -fi - -exit 0 diff --git a/tests/docker-ocserv/ocserv-proxyproto-unix.conf b/tests/docker-ocserv/ocserv-proxyproto-unix.conf deleted file mode 100644 index 5a33849b..00000000 --- a/tests/docker-ocserv/ocserv-proxyproto-unix.conf +++ /dev/null @@ -1,320 +0,0 @@ -# User authentication method. Could be set multiple times and in that case -# all should succeed. -# Options: certificate, pam. -auth = "certificate" -auth = "plain[/etc/ocserv/passwd]" -#auth = "pam" - -# Whether to enable support for the occtl tool (i.e., either through D-BUS, -# or via a unix socket). -use-occtl = true - -# socket file used for IPC with occtl. You only need to set that, -# if you use more than a single servers. -#occtl-socket-file = /var/run/occtl.socket - -# The plain option requires specifying a password file which contains -# entries of the following format. -# "username:groupname:encoded-password" -# One entry must be listed per line, and 'ocpasswd' can be used -# to generate password entries. -#auth = "plain[/etc/ocserv/ocpasswd]" - -# A banner to be displayed on clients -#banner = "Welcome" - -# When the server receives connections from a proxy like haproxy -# which supports the proxy protocol enable this to set the correct -# client addresses. The proxy protocol would then be expected in -# the TCP or UNIX socket (not the UDP one). -listen-proxy-proto = true - -# Use listen-host to limit to specific IPs or to the IPs of a provided -# hostname. -#listen-host = [IP|HOSTNAME] - -# Limit the number of clients. Unset or set to zero for unlimited. -#max-clients = 1024 -max-clients = 16 - -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 - -# Limit the number of identical clients (i.e., users connecting -# multiple times). Unset or set to zero for unlimited. -max-same-clients = 2 - -# TCP and UDP port number -#tcp-port = 5551 -udp-port = 443 - -# Accept connections using a socket file. The connections are -# forwarded without SSL/TLS. -listen-clear-file = /var/run/ocserv-conn.socket - -# Keepalive in seconds -keepalive = 32400 - -# Dead peer detection in seconds. -dpd = 240 - -# Dead peer detection for mobile clients. The needs to -# be much higher to prevent such clients being awaken too -# often by the DPD messages, and save battery. -# (clients that send the X-AnyConnect-Identifier-DeviceType) -mobile-dpd = 1800 - -# MTU discovery (DPD must be enabled) -try-mtu-discovery = false - -# The key and the certificates of the server -# The key may be a file, or any URL supported by GnuTLS (e.g., -# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user -# or pkcs11:object=my-vpn-key;object-type=private) -# -# There may be multiple certificate and key pairs and each key -# should correspond to the preceding certificate. -server-cert = /etc/ocserv/cert.pem -server-key = /etc/ocserv/key.pem - -# Diffie-Hellman parameters. Only needed if you require support -# for the DHE ciphersuites (by default this server supports ECDHE). -# Can be generated using: -# certtool --generate-dh-params --outfile /path/to/dh.pem -#dh-params = /path/to/dh.pem - -# If you have a certificate from a CA that provides an OCSP -# service you may provide a fresh OCSP status response within -# the TLS handshake. That will prevent the client from connecting -# independently on the OCSP server. -# You can update this response periodically using: -# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response -# Make sure that you replace the following file in an atomic way. -#ocsp-response = /path/to/ocsp.der - -# In case PKCS #11 or TPM keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only, and is the -# storage root key. -#pin-file = /path/to/pin.txt -#srk-pin-file = /path/to/srkpin.txt - -# The Certificate Authority that will be used to verify -# client certificates (public keys) if certificate authentication -# is set. -ca-cert = /etc/ocserv/ca.pem - -# The object identifier that will be used to read the user ID in the client -# certificate. The object identifier should be part of the certificate's DN -# Useful OIDs are: -# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 -cert-user-oid = 2.5.4.3 - -# The object identifier that will be used to read the user group in the -# client certificate. The object identifier should be part of the certificate's -# DN. Useful OIDs are: -# OU (organizational unit) = 2.5.4.11 -#cert-group-oid = 2.5.4.11 - -# Uncomment this to enable compression negotiation. -compression = true - -# Set the minimum size under which a packet will not be compressed. -# That is to allow low-latency for VoIP packets. The default size -# is 256 bytes. Modify it if the clients typically use compression -# as well of VoIP with codecs that exceed the default value. -#no-compress-limit = 256 - -# The revocation list of the certificates issued by the 'ca-cert' above. -#crl = /path/to/crl.pem - -# GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" - -# To enforce perfect forward secrecy (PFS) on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" - -# The time (in seconds) that a client is allowed to stay connected prior -# to authentication -auth-timeout = 40 - -# The time (in seconds) that a client is allowed to stay idle (no traffic) -# before being disconnected. Unset to disable. -#idle-timeout = 1200 - -# The time (in seconds) that a mobile client is allowed to stay idle (no -# traffic) before being disconnected. Unset to disable. -#mobile-idle-timeout = 2400 - -# The time (in seconds) that a client is not allowed to reconnect after -# a failed authentication attempt. -#min-reauth-time = 2 - -# Cookie validity time (in seconds) -# Once a client is authenticated he's provided a cookie with -# which he can reconnect. This option sets the maximum lifetime -# of that cookie. -cookie-validity = 86400 - -# ReKey time (in seconds) -# ocserv will ask the client to refresh keys periodically once -# this amount of seconds is elapsed. Set to zero to disable. -rekey-time = 172800 - -# ReKey method -# Valid options: ssl, new-tunnel -# ssl: Will perform an efficient rehandshake on the channel allowing -# a seamless connection during rekey. -# new-tunnel: Will instruct the client to discard and re-establish the channel. -# Use this option only if the connecting clients have issues with the ssl -# option. -rekey-method = ssl - -# Script to call when a client connects and obtains an IP -# Parameters are passed on the environment. -# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), -# ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /usr/bin/myscript -disconnect-script = /usr/bin/myscript - -# UTMP -use-utmp = true - -# D-BUS usage. If disabled occtl tool cannot be used. If enabled -# then ocserv must have access to register org.infradead.ocserv -# D-BUS service. See doc/dbus/org.infradead.ocserv.conf -use-dbus = false - -# PID file. It can be overridden in the command line. -pid-file = /var/run/ocserv.pid - -# The default server directory. Does not require any devices present. -#chroot-dir = /path/to/chroot - -# socket file used for IPC, will be appended with .PID -# It must be accessible within the chroot environment (if any) -socket-file = /var/run/ocserv-socket - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). -run-as-user = nobody -run-as-group = haproxy - -# Set the protocol-defined priority (SO_PRIORITY) for packets to -# be sent. That is a number from 0 to 6 with 0 being the lowest -# priority. Alternatively this can be used to set the IP Type- -# Of-Service, by setting it to a hexadecimal number (e.g., 0x20). -# This can be set per user/group or globally. -#net-priority = 3 - -# Set the VPN worker process into a specific cgroup. This is Linux -# specific and can be set per user/group or globally. -#cgroup = "cpuset,cpu:test" - -# -# Network settings -# - -# The name of the tun device -device = vpns - -# The default domain to be advertised -default-domain = example.com - -# The pool of addresses that leases will be given from. -ipv4-network = 192.168.196.0 -ipv4-netmask = 255.255.255.0 - -# The advertized DNS server. Use multiple lines for -# multiple servers. -# dns = fc00::4be0 -#dns = 192.168.1.2 - -# The NBNS server (if any) -#nbns = 192.168.1.3 - -# The IPv6 subnet that leases will be given from. -ipv6-network = fd60:d98f:7a84:dca6:: -ipv6-prefix = 64 - -# The domains over which the provided DNS should be used. Use -# multiple lines for multiple domains. -#split-dns = example.com - -# Prior to leasing any IP from the pool ping it to verify that -# it is not in use by another (unrelated to this server) host. -ping-leases = false - -# Unset to assign the default MTU of the device -# mtu = - -# Unset to enable bandwidth restrictions (in bytes/sec). The -# setting here is global, but can also be set per user or per group. -#rx-data-per-sec = 40000 -#tx-data-per-sec = 40000 - -# The number of packets (of MTU size) that are available in -# the output buffer. The default is low to improve latency. -# Setting it higher will improve throughput. -#output-buffer = 10 - -# Routes to be forwarded to the client. If you need the -# client to forward routes to the server, you may use the -# config-per-user/group or even connect and disconnect scripts. -# -# To set the server as the default gateway for the client just -# comment out all routes from the server. -route = 10.128.196.0/24 -#route = 192.168.5.0/255.255.255.0 -#route = fef4:db8:1000:1001::/64 - -# Configuration files that will be applied per user connection or -# per group. Each file name on these directories must match the username -# or the groupname. -# The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, -# net-priority and cgroup. -# -# Note that the 'iroute' option allows one to add routes on the server -# based on a user or group. The syntax depends on the input accepted -# by the commands route-add-cmd and route-del-cmd (see below). - -#config-per-user = /etc/ocserv/config-per-user/ -#config-per-group = /etc/ocserv/config-per-group/ - -# The system command to use to setup a route. %R will be replaced with the -# route/mask and %D with the (tun) device. -# -# The following example is from linux systems. %R should be something -# like 192.168.2.0/24 - -#route-add-cmd = "ip route add %R dev %D" -#route-del-cmd = "ip route delete %R dev %D" - -# -# The following options are for (experimental) AnyConnect client -# compatibility. - -# Client profile xml. A sample file exists in doc/profile.xml. -# This file must be accessible from inside the worker's chroot. -# It is not used by the openconnect client. -#user-profile = profile.xml - -# Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. -#binary-files = /path/to/binaries - -# Unless set to false it is required for clients to present their -# certificate even if they are authenticating via a previously granted -# cookie and complete their authentication in the same TCP connection. -# Legacy CISCO clients do not do that, and thus this option should be -# set for them. -#cisco-client-compat = false - -#Advanced options - -# Option to allow sending arbitrary custom headers to the client after -# authentication and prior to VPN tunnel establishment. -#custom-header = "X-My-Header: hi there" diff --git a/tests/docker-ocserv/ocserv-proxyproto-v1.conf b/tests/docker-ocserv/ocserv-proxyproto-v1.conf deleted file mode 100644 index 104a414b..00000000 --- a/tests/docker-ocserv/ocserv-proxyproto-v1.conf +++ /dev/null @@ -1,320 +0,0 @@ -# User authentication method. Could be set multiple times and in that case -# all should succeed. -# Options: certificate, pam. -#auth = "certificate" -auth = "plain[/etc/ocserv/passwd]" -#auth = "pam" - -# Whether to enable support for the occtl tool (i.e., either through D-BUS, -# or via a unix socket). -use-occtl = true - -# socket file used for IPC with occtl. You only need to set that, -# if you use more than a single servers. -#occtl-socket-file = /var/run/occtl.socket - -# The plain option requires specifying a password file which contains -# entries of the following format. -# "username:groupname:encoded-password" -# One entry must be listed per line, and 'ocpasswd' can be used -# to generate password entries. -#auth = "plain[/etc/ocserv/ocpasswd]" - -# A banner to be displayed on clients -#banner = "Welcome" - -# When the server receives connections from a proxy like haproxy -# which supports the proxy protocol enable this to set the correct -# client addresses. The proxy protocol would then be expected in -# the TCP or UNIX socket (not the UDP one). -listen-proxy-proto = true - -# Use listen-host to limit to specific IPs or to the IPs of a provided -# hostname. -#listen-host = [IP|HOSTNAME] - -# Limit the number of clients. Unset or set to zero for unlimited. -#max-clients = 1024 -max-clients = 16 - -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 - -# Limit the number of identical clients (i.e., users connecting -# multiple times). Unset or set to zero for unlimited. -max-same-clients = 2 - -# TCP and UDP port number -tcp-port = 5555 -udp-port = 443 - -# Accept connections using a socket file. The connections are -# forwarded without SSL/TLS. -#listen-clear-file = /var/run/ocserv-conn.socket - -# Keepalive in seconds -keepalive = 32400 - -# Dead peer detection in seconds. -dpd = 240 - -# Dead peer detection for mobile clients. The needs to -# be much higher to prevent such clients being awaken too -# often by the DPD messages, and save battery. -# (clients that send the X-AnyConnect-Identifier-DeviceType) -mobile-dpd = 1800 - -# MTU discovery (DPD must be enabled) -try-mtu-discovery = false - -# The key and the certificates of the server -# The key may be a file, or any URL supported by GnuTLS (e.g., -# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user -# or pkcs11:object=my-vpn-key;object-type=private) -# -# There may be multiple certificate and key pairs and each key -# should correspond to the preceding certificate. -server-cert = /etc/ocserv/cert.pem -server-key = /etc/ocserv/key.pem - -# Diffie-Hellman parameters. Only needed if you require support -# for the DHE ciphersuites (by default this server supports ECDHE). -# Can be generated using: -# certtool --generate-dh-params --outfile /path/to/dh.pem -#dh-params = /path/to/dh.pem - -# If you have a certificate from a CA that provides an OCSP -# service you may provide a fresh OCSP status response within -# the TLS handshake. That will prevent the client from connecting -# independently on the OCSP server. -# You can update this response periodically using: -# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response -# Make sure that you replace the following file in an atomic way. -#ocsp-response = /path/to/ocsp.der - -# In case PKCS #11 or TPM keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only, and is the -# storage root key. -#pin-file = /path/to/pin.txt -#srk-pin-file = /path/to/srkpin.txt - -# The Certificate Authority that will be used to verify -# client certificates (public keys) if certificate authentication -# is set. -#ca-cert = /path/to/ca.pem - -# The object identifier that will be used to read the user ID in the client -# certificate. The object identifier should be part of the certificate's DN -# Useful OIDs are: -# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 -#cert-user-oid = 0.9.2342.19200300.100.1.1 - -# The object identifier that will be used to read the user group in the -# client certificate. The object identifier should be part of the certificate's -# DN. Useful OIDs are: -# OU (organizational unit) = 2.5.4.11 -#cert-group-oid = 2.5.4.11 - -# Uncomment this to enable compression negotiation. -compression = true - -# Set the minimum size under which a packet will not be compressed. -# That is to allow low-latency for VoIP packets. The default size -# is 256 bytes. Modify it if the clients typically use compression -# as well of VoIP with codecs that exceed the default value. -#no-compress-limit = 256 - -# The revocation list of the certificates issued by the 'ca-cert' above. -#crl = /path/to/crl.pem - -# GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" - -# To enforce perfect forward secrecy (PFS) on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" - -# The time (in seconds) that a client is allowed to stay connected prior -# to authentication -auth-timeout = 40 - -# The time (in seconds) that a client is allowed to stay idle (no traffic) -# before being disconnected. Unset to disable. -#idle-timeout = 1200 - -# The time (in seconds) that a mobile client is allowed to stay idle (no -# traffic) before being disconnected. Unset to disable. -#mobile-idle-timeout = 2400 - -# The time (in seconds) that a client is not allowed to reconnect after -# a failed authentication attempt. -#min-reauth-time = 2 - -# Cookie validity time (in seconds) -# Once a client is authenticated he's provided a cookie with -# which he can reconnect. This option sets the maximum lifetime -# of that cookie. -cookie-validity = 86400 - -# ReKey time (in seconds) -# ocserv will ask the client to refresh keys periodically once -# this amount of seconds is elapsed. Set to zero to disable. -rekey-time = 172800 - -# ReKey method -# Valid options: ssl, new-tunnel -# ssl: Will perform an efficient rehandshake on the channel allowing -# a seamless connection during rekey. -# new-tunnel: Will instruct the client to discard and re-establish the channel. -# Use this option only if the connecting clients have issues with the ssl -# option. -rekey-method = ssl - -# Script to call when a client connects and obtains an IP -# Parameters are passed on the environment. -# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), -# ID (a unique numeric ID); REASON may be "connect" or "disconnect". -connect-script = /usr/bin/proxy-connectscript -disconnect-script = /usr/bin/myscript - -# UTMP -use-utmp = true - -# D-BUS usage. If disabled occtl tool cannot be used. If enabled -# then ocserv must have access to register org.infradead.ocserv -# D-BUS service. See doc/dbus/org.infradead.ocserv.conf -use-dbus = false - -# PID file. It can be overridden in the command line. -pid-file = /var/run/ocserv.pid - -# The default server directory. Does not require any devices present. -#chroot-dir = /path/to/chroot - -# socket file used for IPC, will be appended with .PID -# It must be accessible within the chroot environment (if any) -socket-file = /var/run/ocserv-socket - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). -run-as-user = nobody -run-as-group = haproxy - -# Set the protocol-defined priority (SO_PRIORITY) for packets to -# be sent. That is a number from 0 to 6 with 0 being the lowest -# priority. Alternatively this can be used to set the IP Type- -# Of-Service, by setting it to a hexadecimal number (e.g., 0x20). -# This can be set per user/group or globally. -#net-priority = 3 - -# Set the VPN worker process into a specific cgroup. This is Linux -# specific and can be set per user/group or globally. -#cgroup = "cpuset,cpu:test" - -# -# Network settings -# - -# The name of the tun device -device = vpns - -# The default domain to be advertised -default-domain = example.com - -# The pool of addresses that leases will be given from. -ipv4-network = 192.168.194.0 -ipv4-netmask = 255.255.255.0 - -# The advertized DNS server. Use multiple lines for -# multiple servers. -# dns = fc00::4be0 -#dns = 192.168.1.2 - -# The NBNS server (if any) -#nbns = 192.168.1.3 - -# The IPv6 subnet that leases will be given from. -ipv6-network = fd60:d98f:7b84:dca6:: -ipv6-prefix = 64 - -# The domains over which the provided DNS should be used. Use -# multiple lines for multiple domains. -#split-dns = example.com - -# Prior to leasing any IP from the pool ping it to verify that -# it is not in use by another (unrelated to this server) host. -ping-leases = false - -# Unset to assign the default MTU of the device -# mtu = - -# Unset to enable bandwidth restrictions (in bytes/sec). The -# setting here is global, but can also be set per user or per group. -#rx-data-per-sec = 40000 -#tx-data-per-sec = 40000 - -# The number of packets (of MTU size) that are available in -# the output buffer. The default is low to improve latency. -# Setting it higher will improve throughput. -#output-buffer = 10 - -# Routes to be forwarded to the client. If you need the -# client to forward routes to the server, you may use the -# config-per-user/group or even connect and disconnect scripts. -# -# To set the server as the default gateway for the client just -# comment out all routes from the server. -route = 10.128.222.0/24 -#route = 192.168.5.0/255.255.255.0 -#route = fef4:db8:1000:1001::/64 - -# Configuration files that will be applied per user connection or -# per group. Each file name on these directories must match the username -# or the groupname. -# The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, -# net-priority and cgroup. -# -# Note that the 'iroute' option allows one to add routes on the server -# based on a user or group. The syntax depends on the input accepted -# by the commands route-add-cmd and route-del-cmd (see below). - -#config-per-user = /etc/ocserv/config-per-user/ -#config-per-group = /etc/ocserv/config-per-group/ - -# The system command to use to setup a route. %R will be replaced with the -# route/mask and %D with the (tun) device. -# -# The following example is from linux systems. %R should be something -# like 192.168.2.0/24 - -#route-add-cmd = "ip route add %R dev %D" -#route-del-cmd = "ip route delete %R dev %D" - -# -# The following options are for (experimental) AnyConnect client -# compatibility. - -# Client profile xml. A sample file exists in doc/profile.xml. -# This file must be accessible from inside the worker's chroot. -# It is not used by the openconnect client. -#user-profile = profile.xml - -# Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. -#binary-files = /path/to/binaries - -# Unless set to false it is required for clients to present their -# certificate even if they are authenticating via a previously granted -# cookie and complete their authentication in the same TCP connection. -# Legacy CISCO clients do not do that, and thus this option should be -# set for them. -#cisco-client-compat = false - -#Advanced options - -# Option to allow sending arbitrary custom headers to the client after -# authentication and prior to VPN tunnel establishment. -#custom-header = "X-My-Header: hi there" diff --git a/tests/docker-ocserv/ocserv-proxyproto.conf b/tests/docker-ocserv/ocserv-proxyproto.conf deleted file mode 100644 index b579649a..00000000 --- a/tests/docker-ocserv/ocserv-proxyproto.conf +++ /dev/null @@ -1,320 +0,0 @@ -# User authentication method. Could be set multiple times and in that case -# all should succeed. -# Options: certificate, pam. -#auth = "certificate" -auth = "plain[/etc/ocserv/passwd]" -#auth = "pam" - -# Whether to enable support for the occtl tool (i.e., either through D-BUS, -# or via a unix socket). -use-occtl = true - -# socket file used for IPC with occtl. You only need to set that, -# if you use more than a single servers. -#occtl-socket-file = /var/run/occtl.socket - -# The plain option requires specifying a password file which contains -# entries of the following format. -# "username:groupname:encoded-password" -# One entry must be listed per line, and 'ocpasswd' can be used -# to generate password entries. -#auth = "plain[/etc/ocserv/ocpasswd]" - -# A banner to be displayed on clients -#banner = "Welcome" - -# When the server receives connections from a proxy like haproxy -# which supports the proxy protocol enable this to set the correct -# client addresses. The proxy protocol would then be expected in -# the TCP or UNIX socket (not the UDP one). -listen-proxy-proto = true - -# Use listen-host to limit to specific IPs or to the IPs of a provided -# hostname. -#listen-host = [IP|HOSTNAME] - -# Limit the number of clients. Unset or set to zero for unlimited. -#max-clients = 1024 -max-clients = 16 - -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 - -# Limit the number of identical clients (i.e., users connecting -# multiple times). Unset or set to zero for unlimited. -max-same-clients = 2 - -# TCP and UDP port number -tcp-port = 5555 -udp-port = 443 - -# Accept connections using a socket file. The connections are -# forwarded without SSL/TLS. -#listen-clear-file = /var/run/ocserv-conn.socket - -# Keepalive in seconds -keepalive = 32400 - -# Dead peer detection in seconds. -dpd = 240 - -# Dead peer detection for mobile clients. The needs to -# be much higher to prevent such clients being awaken too -# often by the DPD messages, and save battery. -# (clients that send the X-AnyConnect-Identifier-DeviceType) -mobile-dpd = 1800 - -# MTU discovery (DPD must be enabled) -try-mtu-discovery = false - -# The key and the certificates of the server -# The key may be a file, or any URL supported by GnuTLS (e.g., -# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user -# or pkcs11:object=my-vpn-key;object-type=private) -# -# There may be multiple certificate and key pairs and each key -# should correspond to the preceding certificate. -server-cert = /etc/ocserv/cert.pem -server-key = /etc/ocserv/key.pem - -# Diffie-Hellman parameters. Only needed if you require support -# for the DHE ciphersuites (by default this server supports ECDHE). -# Can be generated using: -# certtool --generate-dh-params --outfile /path/to/dh.pem -#dh-params = /path/to/dh.pem - -# If you have a certificate from a CA that provides an OCSP -# service you may provide a fresh OCSP status response within -# the TLS handshake. That will prevent the client from connecting -# independently on the OCSP server. -# You can update this response periodically using: -# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response -# Make sure that you replace the following file in an atomic way. -#ocsp-response = /path/to/ocsp.der - -# In case PKCS #11 or TPM keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only, and is the -# storage root key. -#pin-file = /path/to/pin.txt -#srk-pin-file = /path/to/srkpin.txt - -# The Certificate Authority that will be used to verify -# client certificates (public keys) if certificate authentication -# is set. -#ca-cert = /path/to/ca.pem - -# The object identifier that will be used to read the user ID in the client -# certificate. The object identifier should be part of the certificate's DN -# Useful OIDs are: -# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 -#cert-user-oid = 0.9.2342.19200300.100.1.1 - -# The object identifier that will be used to read the user group in the -# client certificate. The object identifier should be part of the certificate's -# DN. Useful OIDs are: -# OU (organizational unit) = 2.5.4.11 -#cert-group-oid = 2.5.4.11 - -# Uncomment this to enable compression negotiation. -compression = true - -# Set the minimum size under which a packet will not be compressed. -# That is to allow low-latency for VoIP packets. The default size -# is 256 bytes. Modify it if the clients typically use compression -# as well of VoIP with codecs that exceed the default value. -#no-compress-limit = 256 - -# The revocation list of the certificates issued by the 'ca-cert' above. -#crl = /path/to/crl.pem - -# GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" - -# To enforce perfect forward secrecy (PFS) on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" - -# The time (in seconds) that a client is allowed to stay connected prior -# to authentication -auth-timeout = 40 - -# The time (in seconds) that a client is allowed to stay idle (no traffic) -# before being disconnected. Unset to disable. -#idle-timeout = 1200 - -# The time (in seconds) that a mobile client is allowed to stay idle (no -# traffic) before being disconnected. Unset to disable. -#mobile-idle-timeout = 2400 - -# The time (in seconds) that a client is not allowed to reconnect after -# a failed authentication attempt. -#min-reauth-time = 2 - -# Cookie validity time (in seconds) -# Once a client is authenticated he's provided a cookie with -# which he can reconnect. This option sets the maximum lifetime -# of that cookie. -cookie-validity = 86400 - -# ReKey time (in seconds) -# ocserv will ask the client to refresh keys periodically once -# this amount of seconds is elapsed. Set to zero to disable. -rekey-time = 172800 - -# ReKey method -# Valid options: ssl, new-tunnel -# ssl: Will perform an efficient rehandshake on the channel allowing -# a seamless connection during rekey. -# new-tunnel: Will instruct the client to discard and re-establish the channel. -# Use this option only if the connecting clients have issues with the ssl -# option. -rekey-method = ssl - -# Script to call when a client connects and obtains an IP -# Parameters are passed on the environment. -# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), -# ID (a unique numeric ID); REASON may be "connect" or "disconnect". -connect-script = /usr/bin/proxy-connectscript -disconnect-script = /usr/bin/myscript - -# UTMP -use-utmp = true - -# D-BUS usage. If disabled occtl tool cannot be used. If enabled -# then ocserv must have access to register org.infradead.ocserv -# D-BUS service. See doc/dbus/org.infradead.ocserv.conf -use-dbus = false - -# PID file. It can be overridden in the command line. -pid-file = /var/run/ocserv.pid - -# The default server directory. Does not require any devices present. -#chroot-dir = /path/to/chroot - -# socket file used for IPC, will be appended with .PID -# It must be accessible within the chroot environment (if any) -socket-file = /var/run/ocserv-socket - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). -run-as-user = nobody -run-as-group = haproxy - -# Set the protocol-defined priority (SO_PRIORITY) for packets to -# be sent. That is a number from 0 to 6 with 0 being the lowest -# priority. Alternatively this can be used to set the IP Type- -# Of-Service, by setting it to a hexadecimal number (e.g., 0x20). -# This can be set per user/group or globally. -#net-priority = 3 - -# Set the VPN worker process into a specific cgroup. This is Linux -# specific and can be set per user/group or globally. -#cgroup = "cpuset,cpu:test" - -# -# Network settings -# - -# The name of the tun device -device = vpns - -# The default domain to be advertised -default-domain = example.com - -# The pool of addresses that leases will be given from. -ipv4-network = 192.168.195.0 -ipv4-netmask = 255.255.255.0 - -# The advertized DNS server. Use multiple lines for -# multiple servers. -# dns = fc00::4be0 -#dns = 192.168.1.2 - -# The NBNS server (if any) -#nbns = 192.168.1.3 - -# The IPv6 subnet that leases will be given from. -ipv6-network = fd60:d98f:7a84:dca6:: -ipv6-prefix = 64 - -# The domains over which the provided DNS should be used. Use -# multiple lines for multiple domains. -#split-dns = example.com - -# Prior to leasing any IP from the pool ping it to verify that -# it is not in use by another (unrelated to this server) host. -ping-leases = false - -# Unset to assign the default MTU of the device -# mtu = - -# Unset to enable bandwidth restrictions (in bytes/sec). The -# setting here is global, but can also be set per user or per group. -#rx-data-per-sec = 40000 -#tx-data-per-sec = 40000 - -# The number of packets (of MTU size) that are available in -# the output buffer. The default is low to improve latency. -# Setting it higher will improve throughput. -#output-buffer = 10 - -# Routes to be forwarded to the client. If you need the -# client to forward routes to the server, you may use the -# config-per-user/group or even connect and disconnect scripts. -# -# To set the server as the default gateway for the client just -# comment out all routes from the server. -route = 10.128.222.0/24 -#route = 192.168.5.0/255.255.255.0 -#route = fef4:db8:1000:1001::/64 - -# Configuration files that will be applied per user connection or -# per group. Each file name on these directories must match the username -# or the groupname. -# The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, -# net-priority and cgroup. -# -# Note that the 'iroute' option allows one to add routes on the server -# based on a user or group. The syntax depends on the input accepted -# by the commands route-add-cmd and route-del-cmd (see below). - -#config-per-user = /etc/ocserv/config-per-user/ -#config-per-group = /etc/ocserv/config-per-group/ - -# The system command to use to setup a route. %R will be replaced with the -# route/mask and %D with the (tun) device. -# -# The following example is from linux systems. %R should be something -# like 192.168.2.0/24 - -#route-add-cmd = "ip route add %R dev %D" -#route-del-cmd = "ip route delete %R dev %D" - -# -# The following options are for (experimental) AnyConnect client -# compatibility. - -# Client profile xml. A sample file exists in doc/profile.xml. -# This file must be accessible from inside the worker's chroot. -# It is not used by the openconnect client. -#user-profile = profile.xml - -# Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. -#binary-files = /path/to/binaries - -# Unless set to false it is required for clients to present their -# certificate even if they are authenticating via a previously granted -# cookie and complete their authentication in the same TCP connection. -# Legacy CISCO clients do not do that, and thus this option should be -# set for them. -#cisco-client-compat = false - -#Advanced options - -# Option to allow sending arbitrary custom headers to the client after -# authentication and prior to VPN tunnel establishment. -#custom-header = "X-My-Header: hi there" diff --git a/tests/docker-ocserv/ocserv-reload.conf b/tests/docker-ocserv/ocserv-reload.conf deleted file mode 100644 index 5665240f..00000000 --- a/tests/docker-ocserv/ocserv-reload.conf +++ /dev/null @@ -1,303 +0,0 @@ -# User authentication method. Could be set multiple times and in that case -# all should succeed. -# Options: certificate, pam. -#auth = "certificate" -auth = "plain[/etc/ocserv/passwd]" -#auth = "pam" - -# Whether to enable support for the occtl tool (i.e., either through D-BUS, -# or via a unix socket). -use-occtl = true - -# socket file used for IPC with occtl. You only need to set that, -# if you use more than a single servers. -#occtl-socket-file = /var/run/occtl.socket - -# The plain option requires specifying a password file which contains -# entries of the following format. -# "username:groupname:encoded-password" -# One entry must be listed per line, and 'ocpasswd' can be used -# to generate password entries. -#auth = "plain[/etc/ocserv/ocpasswd]" - -# A banner to be displayed on clients -#banner = "Welcome" - -# Use listen-host to limit to specific IPs or to the IPs of a provided -# hostname. -#listen-host = [IP|HOSTNAME] - -# Limit the number of clients. Unset or set to zero for unlimited. -#max-clients = 1024 -max-clients = 16 - -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 - -# Limit the number of identical clients (i.e., users connecting -# multiple times). Unset or set to zero for unlimited. -max-same-clients = 2 - -# TCP and UDP port number -tcp-port = 443 -udp-port = 443 - -# Keepalive in seconds -keepalive = 32400 - -# Dead peer detection in seconds. -dpd = 240 - -# Dead peer detection for mobile clients. The needs to -# be much higher to prevent such clients being awaken too -# often by the DPD messages, and save battery. -# (clients that send the X-AnyConnect-Identifier-DeviceType) -mobile-dpd = 1800 - -# MTU discovery (DPD must be enabled) -try-mtu-discovery = false - -# The key and the certificates of the server -# The key may be a file, or any URL supported by GnuTLS (e.g., -# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user -# or pkcs11:object=my-vpn-key;object-type=private) -# -# There may be multiple certificate and key pairs and each key -# should correspond to the preceding certificate. -server-cert = /etc/ocserv/cert.pem -server-key = /etc/ocserv/key.pem - -# Diffie-Hellman parameters. Only needed if you require support -# for the DHE ciphersuites (by default this server supports ECDHE). -# Can be generated using: -# certtool --generate-dh-params --outfile /path/to/dh.pem -#dh-params = /path/to/dh.pem - -# If you have a certificate from a CA that provides an OCSP -# service you may provide a fresh OCSP status response within -# the TLS handshake. That will prevent the client from connecting -# independently on the OCSP server. -# You can update this response periodically using: -# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response -# Make sure that you replace the following file in an atomic way. -#ocsp-response = /path/to/ocsp.der - -# In case PKCS #11 or TPM keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only, and is the -# storage root key. -#pin-file = /path/to/pin.txt -#srk-pin-file = /path/to/srkpin.txt - -# The Certificate Authority that will be used to verify -# client certificates (public keys) if certificate authentication -# is set. -#ca-cert = /path/to/ca.pem - -# The object identifier that will be used to read the user ID in the client -# certificate. The object identifier should be part of the certificate's DN -# Useful OIDs are: -# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 -#cert-user-oid = 0.9.2342.19200300.100.1.1 - -# The object identifier that will be used to read the user group in the -# client certificate. The object identifier should be part of the certificate's -# DN. Useful OIDs are: -# OU (organizational unit) = 2.5.4.11 -#cert-group-oid = 2.5.4.11 - -# The revocation list of the certificates issued by the 'ca-cert' above. -#crl = /path/to/crl.pem - -# GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" - -# To enforce perfect forward secrecy (PFS) on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" - -# The time (in seconds) that a client is allowed to stay connected prior -# to authentication -auth-timeout = 40 - -# The time (in seconds) that a client is allowed to stay idle (no traffic) -# before being disconnected. Unset to disable. -#idle-timeout = 1200 - -# The time (in seconds) that a mobile client is allowed to stay idle (no -# traffic) before being disconnected. Unset to disable. -#mobile-idle-timeout = 2400 - -# The time (in seconds) that a client is not allowed to reconnect after -# a failed authentication attempt. -#min-reauth-time = 2 - -#max-ban-score = 50 - -# Cookie validity time (in seconds) -# Once a client is authenticated he's provided a cookie with -# which he can reconnect. This option sets the maximum lifetime -# of that cookie. -cookie-validity = 86400 - -# ReKey time (in seconds) -# ocserv will ask the client to refresh keys periodically once -# this amount of seconds is elapsed. Set to zero to disable. -rekey-time = 172800 - -# ReKey method -# Valid options: ssl, new-tunnel -# ssl: Will perform an efficient rehandshake on the channel allowing -# a seamless connection during rekey. -# new-tunnel: Will instruct the client to discard and re-establish the channel. -# Use this option only if the connecting clients have issues with the ssl -# option. -rekey-method = ssl - -# Script to call when a client connects and obtains an IP -# Parameters are passed on the environment. -# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), -# ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /usr/bin/myscript -disconnect-script = /usr/bin/myscript - -# UTMP -use-utmp = true - -# D-BUS usage. If disabled occtl tool cannot be used. If enabled -# then ocserv must have access to register org.infradead.ocserv -# D-BUS service. See doc/dbus/org.infradead.ocserv.conf -use-dbus = false - -# PID file. It can be overridden in the command line. -pid-file = /var/run/ocserv.pid - -# The default server directory. Does not require any devices present. -#chroot-dir = /path/to/chroot - -# socket file used for IPC, will be appended with .PID -# It must be accessible within the chroot environment (if any) -socket-file = /var/run/ocserv-socket - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). -run-as-user = nobody -run-as-group = daemon - -# Set the protocol-defined priority (SO_PRIORITY) for packets to -# be sent. That is a number from 0 to 6 with 0 being the lowest -# priority. Alternatively this can be used to set the IP Type- -# Of-Service, by setting it to a hexadecimal number (e.g., 0x20). -# This can be set per user/group or globally. -#net-priority = 3 - -# Set the VPN worker process into a specific cgroup. This is Linux -# specific and can be set per user/group or globally. -#cgroup = "cpuset,cpu:test" - -# -# Network settings -# - -# The name of the tun device -device = vpns - -# The default domain to be advertised -default-domain = example.com - -# The pool of addresses that leases will be given from. -ipv4-network = 192.168.87.0 -ipv4-netmask = 255.255.255.0 - -# The advertized DNS server. Use multiple lines for -# multiple servers. -# dns = fc00::4be0 -#dns = 192.168.1.2 - -# The NBNS server (if any) -#nbns = 192.168.1.3 - -# The IPv6 subnet that leases will be given from. -#ipv6-network = fd91:6d87:7341:db6a:: -#ipv6-prefix = 64 - -# The domains over which the provided DNS should be used. Use -# multiple lines for multiple domains. -#split-dns = example.com - -# Prior to leasing any IP from the pool ping it to verify that -# it is not in use by another (unrelated to this server) host. -ping-leases = false - -# Unset to assign the default MTU of the device -# mtu = - -# Unset to enable bandwidth restrictions (in bytes/sec). The -# setting here is global, but can also be set per user or per group. -#rx-data-per-sec = 40000 -#tx-data-per-sec = 40000 - -# The number of packets (of MTU size) that are available in -# the output buffer. The default is low to improve latency. -# Setting it higher will improve throughput. -#output-buffer = 10 - -# Routes to be forwarded to the client. If you need the -# client to forward routes to the server, you may use the -# config-per-user/group or even connect and disconnect scripts. -# -# To set the server as the default gateway for the client just -# comment out all routes from the server. -route = 192.168.87.0/24 -#route = 192.168.5.0/255.255.255.0 -#route = fd91:6d87:7341:db6a::/64 - -# Configuration files that will be applied per user connection or -# per group. Each file name on these directories must match the username -# or the groupname. -# The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, -# net-priority and cgroup. -# -# Note that the 'iroute' option allows one to add routes on the server -# based on a user or group. The syntax depends on the input accepted -# by the commands route-add-cmd and route-del-cmd (see below). - -#config-per-user = /etc/ocserv/config-per-user/ -#config-per-group = /etc/ocserv/config-per-group/ - -# The system command to use to setup a route. %R will be replaced with the -# route/mask and %D with the (tun) device. -# -# The following example is from linux systems. %R should be something -# like 192.168.2.0/24 - -#route-add-cmd = "ip route add %R dev %D" -#route-del-cmd = "ip route delete %R dev %D" - -# -# The following options are for (experimental) AnyConnect client -# compatibility. - -# Client profile xml. A sample file exists in doc/profile.xml. -# This file must be accessible from inside the worker's chroot. -# It is not used by the openconnect client. -#user-profile = profile.xml - -# Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. -#binary-files = /path/to/binaries - -# Unless set to false it is required for clients to present their -# certificate even if they are authenticating via a previously granted -# cookie and complete their authentication in the same TCP connection. -# Legacy CISCO clients do not do that, and thus this option should be -# set for them. -#cisco-client-compat = false - -#Advanced options - -# Option to allow sending arbitrary custom headers to the client after -# authentication and prior to VPN tunnel establishment. -#custom-header = "X-My-Header: hi there" diff --git a/tests/docker-ocserv/ocserv-unix.conf b/tests/docker-ocserv/ocserv-unix.conf deleted file mode 100644 index 4b8a09ff..00000000 --- a/tests/docker-ocserv/ocserv-unix.conf +++ /dev/null @@ -1,314 +0,0 @@ -# User authentication method. Could be set multiple times and in that case -# all should succeed. -# Options: certificate, pam. -#auth = "certificate" -auth = "plain[/etc/ocserv/passwd]" -#auth = "pam" - -# Whether to enable support for the occtl tool (i.e., either through D-BUS, -# or via a unix socket). -use-occtl = true - -# socket file used for IPC with occtl. You only need to set that, -# if you use more than a single servers. -#occtl-socket-file = /var/run/occtl.socket - -# The plain option requires specifying a password file which contains -# entries of the following format. -# "username:groupname:encoded-password" -# One entry must be listed per line, and 'ocpasswd' can be used -# to generate password entries. -#auth = "plain[/etc/ocserv/ocpasswd]" - -# A banner to be displayed on clients -#banner = "Welcome" - -# Use listen-host to limit to specific IPs or to the IPs of a provided -# hostname. -#listen-host = [IP|HOSTNAME] - -# Limit the number of clients. Unset or set to zero for unlimited. -#max-clients = 1024 -max-clients = 16 - -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 - -# Limit the number of identical clients (i.e., users connecting -# multiple times). Unset or set to zero for unlimited. -max-same-clients = 2 - -# TCP and UDP port number -#tcp-port = 5551 -udp-port = 6551 - -# Accept connections using a socket file. The connections are -# forwarded without SSL/TLS. -listen-clear-file = /var/run/ocserv-conn.socket - -# Keepalive in seconds -keepalive = 32400 - -# Dead peer detection in seconds. -dpd = 240 - -# Dead peer detection for mobile clients. The needs to -# be much higher to prevent such clients being awaken too -# often by the DPD messages, and save battery. -# (clients that send the X-AnyConnect-Identifier-DeviceType) -mobile-dpd = 1800 - -# MTU discovery (DPD must be enabled) -try-mtu-discovery = false - -# The key and the certificates of the server -# The key may be a file, or any URL supported by GnuTLS (e.g., -# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user -# or pkcs11:object=my-vpn-key;object-type=private) -# -# There may be multiple certificate and key pairs and each key -# should correspond to the preceding certificate. -server-cert = /etc/ocserv/cert.pem -server-key = /etc/ocserv/key.pem - -# Diffie-Hellman parameters. Only needed if you require support -# for the DHE ciphersuites (by default this server supports ECDHE). -# Can be generated using: -# certtool --generate-dh-params --outfile /path/to/dh.pem -#dh-params = /path/to/dh.pem - -# If you have a certificate from a CA that provides an OCSP -# service you may provide a fresh OCSP status response within -# the TLS handshake. That will prevent the client from connecting -# independently on the OCSP server. -# You can update this response periodically using: -# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response -# Make sure that you replace the following file in an atomic way. -#ocsp-response = /path/to/ocsp.der - -# In case PKCS #11 or TPM keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only, and is the -# storage root key. -#pin-file = /path/to/pin.txt -#srk-pin-file = /path/to/srkpin.txt - -# The Certificate Authority that will be used to verify -# client certificates (public keys) if certificate authentication -# is set. -#ca-cert = /path/to/ca.pem - -# The object identifier that will be used to read the user ID in the client -# certificate. The object identifier should be part of the certificate's DN -# Useful OIDs are: -# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 -#cert-user-oid = 0.9.2342.19200300.100.1.1 - -# The object identifier that will be used to read the user group in the -# client certificate. The object identifier should be part of the certificate's -# DN. Useful OIDs are: -# OU (organizational unit) = 2.5.4.11 -#cert-group-oid = 2.5.4.11 - -# Uncomment this to enable compression negotiation. -compression = true - -# Set the minimum size under which a packet will not be compressed. -# That is to allow low-latency for VoIP packets. The default size -# is 256 bytes. Modify it if the clients typically use compression -# as well of VoIP with codecs that exceed the default value. -#no-compress-limit = 256 - -# The revocation list of the certificates issued by the 'ca-cert' above. -#crl = /path/to/crl.pem - -# GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" - -# To enforce perfect forward secrecy (PFS) on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" - -# The time (in seconds) that a client is allowed to stay connected prior -# to authentication -auth-timeout = 40 - -# The time (in seconds) that a client is allowed to stay idle (no traffic) -# before being disconnected. Unset to disable. -#idle-timeout = 1200 - -# The time (in seconds) that a mobile client is allowed to stay idle (no -# traffic) before being disconnected. Unset to disable. -#mobile-idle-timeout = 2400 - -# The time (in seconds) that a client is not allowed to reconnect after -# a failed authentication attempt. -#min-reauth-time = 2 - -# Cookie validity time (in seconds) -# Once a client is authenticated he's provided a cookie with -# which he can reconnect. This option sets the maximum lifetime -# of that cookie. -cookie-validity = 86400 - -# ReKey time (in seconds) -# ocserv will ask the client to refresh keys periodically once -# this amount of seconds is elapsed. Set to zero to disable. -rekey-time = 172800 - -# ReKey method -# Valid options: ssl, new-tunnel -# ssl: Will perform an efficient rehandshake on the channel allowing -# a seamless connection during rekey. -# new-tunnel: Will instruct the client to discard and re-establish the channel. -# Use this option only if the connecting clients have issues with the ssl -# option. -rekey-method = ssl - -# Script to call when a client connects and obtains an IP -# Parameters are passed on the environment. -# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), -# ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /usr/bin/myscript -disconnect-script = /usr/bin/myscript - -# UTMP -use-utmp = true - -# D-BUS usage. If disabled occtl tool cannot be used. If enabled -# then ocserv must have access to register org.infradead.ocserv -# D-BUS service. See doc/dbus/org.infradead.ocserv.conf -use-dbus = false - -# PID file. It can be overridden in the command line. -pid-file = /var/run/ocserv.pid - -# The default server directory. Does not require any devices present. -#chroot-dir = /path/to/chroot - -# socket file used for IPC, will be appended with .PID -# It must be accessible within the chroot environment (if any) -socket-file = /var/run/ocserv-socket - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). -run-as-user = nobody -run-as-group = haproxy - -# Set the protocol-defined priority (SO_PRIORITY) for packets to -# be sent. That is a number from 0 to 6 with 0 being the lowest -# priority. Alternatively this can be used to set the IP Type- -# Of-Service, by setting it to a hexadecimal number (e.g., 0x20). -# This can be set per user/group or globally. -#net-priority = 3 - -# Set the VPN worker process into a specific cgroup. This is Linux -# specific and can be set per user/group or globally. -#cgroup = "cpuset,cpu:test" - -# -# Network settings -# - -# The name of the tun device -device = vpns - -# The default domain to be advertised -default-domain = example.com - -# The pool of addresses that leases will be given from. -ipv4-network = 192.168.99.0 -ipv4-netmask = 255.255.255.0 - -# The advertized DNS server. Use multiple lines for -# multiple servers. -# dns = fc00::4be0 -#dns = 192.168.1.2 - -# The NBNS server (if any) -#nbns = 192.168.1.3 - -# The IPv6 subnet that leases will be given from. -ipv6-network = fd60:d98f:7a84:dca6:: -ipv6-prefix = 64 - -# The domains over which the provided DNS should be used. Use -# multiple lines for multiple domains. -#split-dns = example.com - -# Prior to leasing any IP from the pool ping it to verify that -# it is not in use by another (unrelated to this server) host. -ping-leases = false - -# Unset to assign the default MTU of the device -# mtu = - -# Unset to enable bandwidth restrictions (in bytes/sec). The -# setting here is global, but can also be set per user or per group. -#rx-data-per-sec = 40000 -#tx-data-per-sec = 40000 - -# The number of packets (of MTU size) that are available in -# the output buffer. The default is low to improve latency. -# Setting it higher will improve throughput. -#output-buffer = 10 - -# Routes to be forwarded to the client. If you need the -# client to forward routes to the server, you may use the -# config-per-user/group or even connect and disconnect scripts. -# -# To set the server as the default gateway for the client just -# comment out all routes from the server. -route = 10.128.222.0/24 -#route = 192.168.5.0/255.255.255.0 -#route = fef4:db8:1000:1001::/64 - -# Configuration files that will be applied per user connection or -# per group. Each file name on these directories must match the username -# or the groupname. -# The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, -# net-priority and cgroup. -# -# Note that the 'iroute' option allows one to add routes on the server -# based on a user or group. The syntax depends on the input accepted -# by the commands route-add-cmd and route-del-cmd (see below). - -#config-per-user = /etc/ocserv/config-per-user/ -#config-per-group = /etc/ocserv/config-per-group/ - -# The system command to use to setup a route. %R will be replaced with the -# route/mask and %D with the (tun) device. -# -# The following example is from linux systems. %R should be something -# like 192.168.2.0/24 - -#route-add-cmd = "ip route add %R dev %D" -#route-del-cmd = "ip route delete %R dev %D" - -# -# The following options are for (experimental) AnyConnect client -# compatibility. - -# Client profile xml. A sample file exists in doc/profile.xml. -# This file must be accessible from inside the worker's chroot. -# It is not used by the openconnect client. -#user-profile = profile.xml - -# Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. -#binary-files = /path/to/binaries - -# Unless set to false it is required for clients to present their -# certificate even if they are authenticating via a previously granted -# cookie and complete their authentication in the same TCP connection. -# Legacy CISCO clients do not do that, and thus this option should be -# set for them. -#cisco-client-compat = false - -#Advanced options - -# Option to allow sending arbitrary custom headers to the client after -# authentication and prior to VPN tunnel establishment. -#custom-header = "X-My-Header: hi there" diff --git a/tests/docker-ocserv/ocserv.conf b/tests/docker-ocserv/ocserv.conf deleted file mode 100644 index 665374c4..00000000 --- a/tests/docker-ocserv/ocserv.conf +++ /dev/null @@ -1,303 +0,0 @@ -# User authentication method. Could be set multiple times and in that case -# all should succeed. -# Options: certificate, pam. -#auth = "certificate" -auth = "plain[/etc/ocserv/passwd]" -#auth = "pam" - -# Whether to enable support for the occtl tool (i.e., either through D-BUS, -# or via a unix socket). -use-occtl = true - -# socket file used for IPC with occtl. You only need to set that, -# if you use more than a single servers. -#occtl-socket-file = /var/run/occtl.socket - -# The plain option requires specifying a password file which contains -# entries of the following format. -# "username:groupname:encoded-password" -# One entry must be listed per line, and 'ocpasswd' can be used -# to generate password entries. -#auth = "plain[/etc/ocserv/ocpasswd]" - -# A banner to be displayed on clients -#banner = "Welcome" - -# Use listen-host to limit to specific IPs or to the IPs of a provided -# hostname. -#listen-host = [IP|HOSTNAME] - -# Limit the number of clients. Unset or set to zero for unlimited. -#max-clients = 1024 -max-clients = 16 - -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 - -# Limit the number of identical clients (i.e., users connecting -# multiple times). Unset or set to zero for unlimited. -max-same-clients = 2 - -# TCP and UDP port number -tcp-port = 443 -udp-port = 443 - -# Keepalive in seconds -keepalive = 32400 - -# Dead peer detection in seconds. -dpd = 240 - -# Dead peer detection for mobile clients. The needs to -# be much higher to prevent such clients being awaken too -# often by the DPD messages, and save battery. -# (clients that send the X-AnyConnect-Identifier-DeviceType) -mobile-dpd = 1800 - -# MTU discovery (DPD must be enabled) -try-mtu-discovery = false - -# The key and the certificates of the server -# The key may be a file, or any URL supported by GnuTLS (e.g., -# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user -# or pkcs11:object=my-vpn-key;object-type=private) -# -# There may be multiple certificate and key pairs and each key -# should correspond to the preceding certificate. -server-cert = /etc/ocserv/cert.pem -server-key = /etc/ocserv/key.pem - -# Diffie-Hellman parameters. Only needed if you require support -# for the DHE ciphersuites (by default this server supports ECDHE). -# Can be generated using: -# certtool --generate-dh-params --outfile /path/to/dh.pem -#dh-params = /path/to/dh.pem - -# If you have a certificate from a CA that provides an OCSP -# service you may provide a fresh OCSP status response within -# the TLS handshake. That will prevent the client from connecting -# independently on the OCSP server. -# You can update this response periodically using: -# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response -# Make sure that you replace the following file in an atomic way. -#ocsp-response = /path/to/ocsp.der - -# In case PKCS #11 or TPM keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only, and is the -# storage root key. -#pin-file = /path/to/pin.txt -#srk-pin-file = /path/to/srkpin.txt - -# The Certificate Authority that will be used to verify -# client certificates (public keys) if certificate authentication -# is set. -#ca-cert = /path/to/ca.pem - -# The object identifier that will be used to read the user ID in the client -# certificate. The object identifier should be part of the certificate's DN -# Useful OIDs are: -# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 -#cert-user-oid = 0.9.2342.19200300.100.1.1 - -# The object identifier that will be used to read the user group in the -# client certificate. The object identifier should be part of the certificate's -# DN. Useful OIDs are: -# OU (organizational unit) = 2.5.4.11 -#cert-group-oid = 2.5.4.11 - -# The revocation list of the certificates issued by the 'ca-cert' above. -#crl = /path/to/crl.pem - -# GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" - -# To enforce perfect forward secrecy (PFS) on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" - -# The time (in seconds) that a client is allowed to stay connected prior -# to authentication -auth-timeout = 40 - -# The time (in seconds) that a client is allowed to stay idle (no traffic) -# before being disconnected. Unset to disable. -#idle-timeout = 1200 - -# The time (in seconds) that a mobile client is allowed to stay idle (no -# traffic) before being disconnected. Unset to disable. -#mobile-idle-timeout = 2400 - -# The time (in seconds) that a client is not allowed to reconnect after -# a failed authentication attempt. -#min-reauth-time = 2 - -#max-ban-score = 50 - -# Cookie validity time (in seconds) -# Once a client is authenticated he's provided a cookie with -# which he can reconnect. This option sets the maximum lifetime -# of that cookie. -cookie-validity = 86400 - -# ReKey time (in seconds) -# ocserv will ask the client to refresh keys periodically once -# this amount of seconds is elapsed. Set to zero to disable. -rekey-time = 172800 - -# ReKey method -# Valid options: ssl, new-tunnel -# ssl: Will perform an efficient rehandshake on the channel allowing -# a seamless connection during rekey. -# new-tunnel: Will instruct the client to discard and re-establish the channel. -# Use this option only if the connecting clients have issues with the ssl -# option. -rekey-method = ssl - -# Script to call when a client connects and obtains an IP -# Parameters are passed on the environment. -# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), -# ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /usr/bin/myscript -disconnect-script = /usr/bin/myscript - -# UTMP -use-utmp = true - -# D-BUS usage. If disabled occtl tool cannot be used. If enabled -# then ocserv must have access to register org.infradead.ocserv -# D-BUS service. See doc/dbus/org.infradead.ocserv.conf -use-dbus = false - -# PID file. It can be overridden in the command line. -pid-file = /var/run/ocserv.pid - -# The default server directory. Does not require any devices present. -#chroot-dir = /path/to/chroot - -# socket file used for IPC, will be appended with .PID -# It must be accessible within the chroot environment (if any) -socket-file = /var/run/ocserv-socket - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). -run-as-user = nobody -run-as-group = daemon - -# Set the protocol-defined priority (SO_PRIORITY) for packets to -# be sent. That is a number from 0 to 6 with 0 being the lowest -# priority. Alternatively this can be used to set the IP Type- -# Of-Service, by setting it to a hexadecimal number (e.g., 0x20). -# This can be set per user/group or globally. -#net-priority = 3 - -# Set the VPN worker process into a specific cgroup. This is Linux -# specific and can be set per user/group or globally. -#cgroup = "cpuset,cpu:test" - -# -# Network settings -# - -# The name of the tun device -device = vpns - -# The default domain to be advertised -default-domain = example.com - -# The pool of addresses that leases will be given from. -ipv4-network = 192.168.79.0 -ipv4-netmask = 255.255.255.0 - -# The advertized DNS server. Use multiple lines for -# multiple servers. -# dns = fc00::4be0 -#dns = 192.168.1.2 - -# The NBNS server (if any) -#nbns = 192.168.1.3 - -# The IPv6 subnet that leases will be given from. -ipv6-network = fd91:6d87:7341:db6a:: -ipv6-prefix = 64 - -# The domains over which the provided DNS should be used. Use -# multiple lines for multiple domains. -#split-dns = example.com - -# Prior to leasing any IP from the pool ping it to verify that -# it is not in use by another (unrelated to this server) host. -ping-leases = false - -# Unset to assign the default MTU of the device -# mtu = - -# Unset to enable bandwidth restrictions (in bytes/sec). The -# setting here is global, but can also be set per user or per group. -#rx-data-per-sec = 40000 -#tx-data-per-sec = 40000 - -# The number of packets (of MTU size) that are available in -# the output buffer. The default is low to improve latency. -# Setting it higher will improve throughput. -#output-buffer = 10 - -# Routes to be forwarded to the client. If you need the -# client to forward routes to the server, you may use the -# config-per-user/group or even connect and disconnect scripts. -# -# To set the server as the default gateway for the client just -# comment out all routes from the server. -route = 10.44.59.0/24 -#route = 192.168.5.0/255.255.255.0 -route = fd91:6d87:7341:db6a::/64 - -# Configuration files that will be applied per user connection or -# per group. Each file name on these directories must match the username -# or the groupname. -# The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, -# net-priority and cgroup. -# -# Note that the 'iroute' option allows one to add routes on the server -# based on a user or group. The syntax depends on the input accepted -# by the commands route-add-cmd and route-del-cmd (see below). - -#config-per-user = /etc/ocserv/config-per-user/ -#config-per-group = /etc/ocserv/config-per-group/ - -# The system command to use to setup a route. %R will be replaced with the -# route/mask and %D with the (tun) device. -# -# The following example is from linux systems. %R should be something -# like 192.168.2.0/24 - -#route-add-cmd = "ip route add %R dev %D" -#route-del-cmd = "ip route delete %R dev %D" - -# -# The following options are for (experimental) AnyConnect client -# compatibility. - -# Client profile xml. A sample file exists in doc/profile.xml. -# This file must be accessible from inside the worker's chroot. -# It is not used by the openconnect client. -#user-profile = profile.xml - -# Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. -#binary-files = /path/to/binaries - -# Unless set to false it is required for clients to present their -# certificate even if they are authenticating via a previously granted -# cookie and complete their authentication in the same TCP connection. -# Legacy CISCO clients do not do that, and thus this option should be -# set for them. -#cisco-client-compat = false - -#Advanced options - -# Option to allow sending arbitrary custom headers to the client after -# authentication and prior to VPN tunnel establishment. -#custom-header = "X-My-Header: hi there" diff --git a/tests/docker-ocserv/passwd b/tests/docker-ocserv/passwd deleted file mode 100644 index c2e10073..00000000 --- a/tests/docker-ocserv/passwd +++ /dev/null @@ -1,2 +0,0 @@ -test:tost:$5$i6SNmLDCgBNjyJ7q$SZ4bVJb7I/DLgXo3txHBVohRFBjOtdbxGQZp.DOnrA. -tost:*:$5$qc1CKWjcmlrFREe2$h9zQJcD3AeuQmwMncdIqqls47TDOUvu2r2nXQ7aDfcD diff --git a/tests/docker-ocserv/users.oath b/tests/docker-ocserv/users.oath deleted file mode 100644 index 14d93db4..00000000 --- a/tests/docker-ocserv/users.oath +++ /dev/null @@ -1 +0,0 @@ -HOTP testuser - 00 diff --git a/tests/haproxy-proxyproto b/tests/haproxy-proxyproto new file mode 100755 index 00000000..70c1390a --- /dev/null +++ b/tests/haproxy-proxyproto @@ -0,0 +1,128 @@ +#!/bin/bash +# +# Copyright (C) 2018 Nikos Mavrogiannopoulos +# +# This file is part of ocserv. +# +# ocserv is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at +# your option) any later version. +# +# ocserv is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +SERV="${SERV:-../src/ocserv}" +srcdir=${srcdir:-.} +PIDFILE=ocserv-pid.$$.tmp +CLIPID=oc-pid.$$.tmp +HACONFIG=haproxy.conf.$$.tmp +PATH=${PATH}:/usr/sbin +HAPROXY=$(which haproxy) +IP=$(which ip) + +. `dirname $0`/common.sh + +eval "${GETPORT}" +HAPORT=${PORT} + +eval "${GETPORT}" + +if test -z "${HAPROXY}";then + echo "no haproxy present" + exit 77 +fi + +if test -z "${IP}";then + echo "no IP tool is present" + exit 77 +fi + +if test "$(id -u)" != "0";then + echo "This test must be run as root" + exit 77 +fi + +echo "Testing ocserv connection via haproxy... " + +function finish { + set +e + echo " * Cleaning up..." + test -n "${HAPID}" && kill ${HAPID} >/dev/null 2>&1 + test -n "${PID}" && kill ${PID} >/dev/null 2>&1 + test -n "${PIDFILE}" && rm -f ${PIDFILE} >/dev/null 2>&1 + test -n "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1 + test -n "${CLIPID}" && rm -f ${CLIPID} >/dev/null 2>&1 + test -n "${HACONFIG}" && rm -f ${HACONFIG} >/dev/null 2>&1 + test -n "${CONFIG}" && rm -f ${CONFIG} >/dev/null 2>&1 + test -n "${NUTTCPPID}" && kill ${NUTTCPPID} >/dev/null 2>&1 + rm -f proxyproto-connect-ok +} +trap finish EXIT + +rm -f proxyproto-connect-ok + +# server address +ADDRESS=10.214.2.1 +CLI_ADDRESS=10.214.1.1 +VPNNET=192.168.1.0/24 +VPNADDR=192.168.1.1 + +. `dirname $0`/ns.sh + +# Run servers +update_config haproxy-proxyproto.config +if test "$VERBOSE" = 1;then +DEBUG="-d 3" +fi + +${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + +sleep 1 + +rm -f ${HACONFIG} +sed -e 's|@HAPORT@|'${HAPORT}'|g' -e 's|@PORT@|'${PORT}'|g' -e 's|@ADDRESS@|'${ADDRESS}'|g' ${srcdir}/data/haproxy-proxyproto.cfg >${HACONFIG} +${CMDNS2} ${HAPROXY} -f ${HACONFIG} -d & HAPID=$! + +sleep 3 + +# Run clients +echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." +( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) +if test $? != 0;then + echo "Could not get cookie from server" + exit 1 +fi + +echo " * Connecting to ${ADDRESS}:${HAPORT}..." +( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) +if test $? != 0;then + echo "Could not connect to server" + exit 1 +fi + +set -e +echo " * ping remote address" + +${CMDNS1} ping -c 3 ${VPNADDR} + +set +e + +echo " * checking for connect-ok" +if ! test -f proxyproto-connect-ok;then + echo "Could not find file written by script" + exit 1 +fi + +if ! test -f ${PIDFILE};then + echo "Could not find pid file ${PIDFILE}" + exit 1 +fi + +exit 0 diff --git a/tests/haproxy-proxyproto-v1 b/tests/haproxy-proxyproto-v1 new file mode 100755 index 00000000..d2745757 --- /dev/null +++ b/tests/haproxy-proxyproto-v1 @@ -0,0 +1,128 @@ +#!/bin/bash +# +# Copyright (C) 2018 Nikos Mavrogiannopoulos +# +# This file is part of ocserv. +# +# ocserv is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at +# your option) any later version. +# +# ocserv is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +SERV="${SERV:-../src/ocserv}" +srcdir=${srcdir:-.} +PIDFILE=ocserv-pid.$$.tmp +CLIPID=oc-pid.$$.tmp +HACONFIG=haproxy.conf.$$.tmp +PATH=${PATH}:/usr/sbin +HAPROXY=$(which haproxy) +IP=$(which ip) + +. `dirname $0`/common.sh + +eval "${GETPORT}" +HAPORT=${PORT} + +eval "${GETPORT}" + +if test -z "${HAPROXY}";then + echo "no haproxy present" + exit 77 +fi + +if test -z "${IP}";then + echo "no IP tool is present" + exit 77 +fi + +if test "$(id -u)" != "0";then + echo "This test must be run as root" + exit 77 +fi + +echo "Testing ocserv connection via haproxy... " + +function finish { + set +e + echo " * Cleaning up..." + test -n "${HAPID}" && kill ${HAPID} >/dev/null 2>&1 + test -n "${PID}" && kill ${PID} >/dev/null 2>&1 + test -n "${PIDFILE}" && rm -f ${PIDFILE} >/dev/null 2>&1 + test -n "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1 + test -n "${CLIPID}" && rm -f ${CLIPID} >/dev/null 2>&1 + test -n "${HACONFIG}" && rm -f ${HACONFIG} >/dev/null 2>&1 + test -n "${CONFIG}" && rm -f ${CONFIG} >/dev/null 2>&1 + test -n "${NUTTCPPID}" && kill ${NUTTCPPID} >/dev/null 2>&1 + rm -f proxyproto-v1-connect-ok +} +trap finish EXIT + +rm -f proxyproto-v1-connect-ok + +# server address +ADDRESS=10.214.2.1 +CLI_ADDRESS=10.214.1.1 +VPNNET=192.168.1.0/24 +VPNADDR=192.168.1.1 + +. `dirname $0`/ns.sh + +# Run servers +update_config haproxy-proxyproto-v1.config +if test "$VERBOSE" = 1;then +DEBUG="-d 3" +fi + +${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + +sleep 1 + +rm -f ${HACONFIG} +sed -e 's|@HAPORT@|'${HAPORT}'|g' -e 's|@PORT@|'${PORT}'|g' -e 's|@ADDRESS@|'${ADDRESS}'|g' ${srcdir}/data/haproxy-proxyproto-v1.cfg >${HACONFIG} +${CMDNS2} ${HAPROXY} -f ${HACONFIG} -d & HAPID=$! + +sleep 3 + +# Run clients +echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." +( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) +if test $? != 0;then + echo "Could not get cookie from server" + exit 1 +fi + +echo " * Connecting to ${ADDRESS}:${HAPORT}..." +( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) +if test $? != 0;then + echo "Could not connect to server" + exit 1 +fi + +set -e +echo " * ping remote address" + +${CMDNS1} ping -c 3 ${VPNADDR} + +set +e + +echo " * checking for connect-ok" +if ! test -f proxyproto-v1-connect-ok;then + echo "Could not find file written by script" + exit 1 +fi + +if ! test -f ${PIDFILE};then + echo "Could not find pid file ${PIDFILE}" + exit 1 +fi + +exit 0 diff --git a/tests/proxyproto-test b/tests/proxyproto-test deleted file mode 100755 index c35d87d8..00000000 --- a/tests/proxyproto-test +++ /dev/null @@ -1,147 +0,0 @@ -#!/bin/sh -# -# Copyright (C) 2014 Red Hat -# -# This file is part of ocserv. -# -# ocserv is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at -# your option) any later version. -# -# ocserv is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with ocserv; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -srcdir=${srcdir:-.} - -#this test can only be run as root -id|grep root >/dev/null 2>&1 -if [ $? != 0 ];then - exit 77 -fi - -PORT_OCSERV=443 -CONFIG="proxyproto" -IMAGE=proxyproto-test -IMAGE_NAME=test_proxyproto_ocserv -TMP=$IMAGE_NAME.tmp -PIDFILE="$IMAGE_NAME.$$.pid.tmp" -. ./docker-common.sh - -$DOCKER run -e OCCTL_PAGER=cat -P --privileged=true -p 22 --tty=false -d --name $IMAGE_NAME $IMAGE -if test $? != 0;then - echo "Cannot run docker image" - exit 1 -fi - -echo "ocserv image was run" -#wait for ocserv to server -sleep 5 - -get_ip -if test -z "$IP";then - echo "Detected IP is null!" - stop -fi -echo "Detected IP: $IP" - -if test ! -z "$QUIT_ON_INIT";then - exit 0 -fi - -echo "" -echo "Connecting with correct username" -$ECHO_E "test" >pass-full$TMP -$OPENCONNECT $IP:$PORT_OCSERV -b --pid-file $PIDFILE -u test --passwd-on-stdin -v --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 < pass-full$TMP -if test $? != 0;then - echo "Cannot connect to server" - stop -fi - -#wait for openconnect -sleep 5 - -rm -f pass-full$TMP -if [ ! -f $PIDFILE ];then - echo "It was not possible to establish session!" - stop -fi - -PID=`cat $PIDFILE` -rm -f $PIDFILE - -# The client IP depends on the username so it shouldn't change. -ping -w 5 192.168.195.1 -if test $? != 0;then - kill -INT $PID - echo "Cannot ping ocserv" - stop -fi - -ping -w 5 192.168.195.1 -s 1500 -if test $? != 0;then - kill -INT $PID - echo "Cannot ping ocserv" - stop -fi - -retrieve_user_info test - -# There is an issue in nuttcp that makes it crash under docker if -# /proc/sys/net/ipv4/tcp_adv_win_scale does not exist. -if test "$FEDORA" = 1;then -nuttcp -T 10 -t 192.168.195.1 -if test $? != 0;then - echo "Cannot send to ocserv" - kill -INT $PID - stop - exit 77 -fi - -nuttcp -T 10 -r 192.168.195.1 -if test $? != 0;then - echo "Cannot recv from ocserv" - kill -INT $PID - stop - exit 77 -fi -fi - -sleep 2 - -kill -INT $PID - -sleep 3 - -check_for_file /tmp/connect/ok -if test $? != 0;then - echo "There was an issue in connect script" - stop -fi -$DOCKER exec $IMAGE_NAME cat /tmp/connect/ok - -sleep 4 - -#check whether /tmp/disconnect/ok was created -check_for_file /tmp/disconnect/not-ok -if test $? = 0;then - echo "There was an issue" - stop -fi - -check_for_file /tmp/disconnect/ok -if test $? != 0;then - echo "There was an issue getting stats" - ret=77 -fi - -$DOCKER stop $IMAGE_NAME -$DOCKER rm $IMAGE_NAME - -exit $ret diff --git a/tests/proxyproto-unix-test b/tests/proxyproto-unix-test deleted file mode 100755 index 7e9795fe..00000000 --- a/tests/proxyproto-unix-test +++ /dev/null @@ -1,138 +0,0 @@ -#!/bin/sh -# -# Copyright (C) 2014 Red Hat -# -# This file is part of ocserv. -# -# ocserv is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at -# your option) any later version. -# -# ocserv is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with ocserv; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -srcdir=${srcdir:-.} - -#this test can only be run as root -id|grep root >/dev/null 2>&1 -if [ $? != 0 ];then - exit 77 -fi - -PORT_OCSERV=443 -CONFIG="proxyproto-unix" -IMAGE=proxyproto-unix-test -IMAGE_NAME=test_proxyproto_unix_ocserv -TMP=$IMAGE_NAME.tmp -PIDFILE="$IMAGE_NAME.$$.pid.tmp" -. ./docker-common.sh - -$DOCKER run -e OCCTL_PAGER=cat -P --privileged=true -p 22 --tty=false -d --name $IMAGE_NAME $IMAGE -if test $? != 0;then - echo "Cannot run docker image" - exit 1 -fi - -echo "ocserv image was run" -#wait for ocserv to server -sleep 5 - -get_ip -if test -z "$IP";then - echo "Detected IP is null!" - stop -fi -echo "Detected IP: $IP" - -if test ! -z "$QUIT_ON_INIT";then - exit 0 -fi - -echo "" -echo "Connecting with correct username" -$ECHO_E "test" >pass-full$TMP -$OPENCONNECT $IP:$PORT_OCSERV -b --sslkey ./certs/user-key.pem -c ./certs/user-cn.pem --pid-file $PIDFILE -u test --passwd-on-stdin -v --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 < pass-full$TMP -if test $? != 0;then - echo "Cannot connect to server" - stop -fi - -#wait for openconnect -sleep 5 - -rm -f pass-full$TMP -if [ ! -f $PIDFILE ];then - echo "It was not possible to establish session!" - stop -fi - -PID=`cat $PIDFILE` -rm -f $PIDFILE - -# The client IP depends on the username so it shouldn't change. -ping -w 5 192.168.196.1 -if test $? != 0;then - kill -INT $PID - echo "Cannot ping ocserv" - stop -fi - -ping -w 5 192.168.196.1 -s 1500 -if test $? != 0;then - kill -INT $PID - echo "Cannot ping ocserv" - stop -fi - -retrieve_user_info test - -# There is an issue in nuttcp that makes it crash under docker if -# /proc/sys/net/ipv4/tcp_adv_win_scale does not exist. -if test "$FEDORA" = 1;then -nuttcp -T 10 -t 192.168.196.1 -if test $? != 0;then - echo "Cannot send to ocserv" - kill -INT $PID - exit 77 - stop -fi - -nuttcp -T 10 -r 192.168.196.1 -if test $? != 0;then - echo "Cannot recv from ocserv" - kill -INT $PID - exit 77 - stop -fi -fi - -sleep 2 - -kill -INT $PID - -sleep 4 - -#check whether /tmp/disconnect/ok was created -check_for_file /tmp/disconnect/not-ok -if test $? = 0;then - echo "There was an issue" - stop -fi - -check_for_file /tmp/disconnect/ok -if test $? != 0;then - echo "There was an issue getting stats" - ret=77 -fi - -$DOCKER stop $IMAGE_NAME -$DOCKER rm $IMAGE_NAME - -exit $ret diff --git a/tests/proxyproto-v1-test b/tests/proxyproto-v1-test deleted file mode 100755 index 8c1d7618..00000000 --- a/tests/proxyproto-v1-test +++ /dev/null @@ -1,147 +0,0 @@ -#!/bin/sh -# -# Copyright (C) 2014 Red Hat -# -# This file is part of ocserv. -# -# ocserv is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at -# your option) any later version. -# -# ocserv is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with ocserv; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -srcdir=${srcdir:-.} - -#this test can only be run as root -id|grep root >/dev/null 2>&1 -if [ $? != 0 ];then - exit 77 -fi - -PORT_OCSERV=443 -CONFIG="proxyproto-v1" -IMAGE=proxyproto-v1-test -IMAGE_NAME=test_proxyproto_v1_ocserv -TMP=$IMAGE_NAME.tmp -PIDFILE="$IMAGE_NAME.$$.pid.tmp" -. ./docker-common.sh - -$DOCKER run -e OCCTL_PAGER=cat -P --privileged=true -p 22 --tty=false -d --name $IMAGE_NAME $IMAGE -if test $? != 0;then - echo "Cannot run docker image" - exit 1 -fi - -echo "ocserv image was run" -#wait for ocserv to server -sleep 5 - -get_ip -if test -z "$IP";then - echo "Detected IP is null!" - stop -fi -echo "Detected IP: $IP" - -if test ! -z "$QUIT_ON_INIT";then - exit 0 -fi - -echo "" -echo "Connecting with correct username" -$ECHO_E "test" >pass-full$TMP -$OPENCONNECT $IP:$PORT_OCSERV -b --pid-file $PIDFILE -u test --passwd-on-stdin -v --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 < pass-full$TMP -if test $? != 0;then - echo "Cannot connect to server" - stop -fi - -#wait for openconnect -sleep 5 - -rm -f pass-full$TMP -if [ ! -f $PIDFILE ];then - echo "It was not possible to establish session!" - stop -fi - -PID=`cat $PIDFILE` -rm -f $PIDFILE - -# The client IP depends on the username so it shouldn't change. -ping -w 5 192.168.194.1 -if test $? != 0;then - kill -INT $PID - echo "Cannot ping ocserv" - stop -fi - -ping -w 5 192.168.194.1 -s 1500 -if test $? != 0;then - kill -INT $PID - echo "Cannot ping ocserv" - stop -fi - -retrieve_user_info test - -# There is an issue in nuttcp that makes it crash under docker if -# /proc/sys/net/ipv4/tcp_adv_win_scale does not exist. -if test "$FEDORA" = 1;then -nuttcp -T 10 -t 192.168.194.1 -if test $? != 0;then - echo "Cannot send to ocserv" - kill -INT $PID - stop - exit 77 -fi - -nuttcp -T 10 -r 192.168.194.1 -if test $? != 0;then - echo "Cannot recv from ocserv" - kill -INT $PID - stop - exit 77 -fi -fi - -sleep 2 - -kill -INT $PID - -sleep 3 - -check_for_file /tmp/connect/ok -if test $? != 0;then - echo "There was an issue in connect script" - stop -fi -$DOCKER exec $IMAGE_NAME cat /tmp/connect/ok - -sleep 4 - -#check whether /tmp/disconnect/ok was created -check_for_file /tmp/disconnect/not-ok -if test $? = 0;then - echo "There was an issue" - stop -fi - -check_for_file /tmp/disconnect/ok -if test $? != 0;then - echo "There was an issue getting stats" - ret=77 -fi - -$DOCKER stop $IMAGE_NAME -$DOCKER rm $IMAGE_NAME - -exit $ret diff --git a/tests/reload-info-test b/tests/reload-info-test deleted file mode 100755 index bd2bae29..00000000 --- a/tests/reload-info-test +++ /dev/null @@ -1,124 +0,0 @@ -#!/bin/sh -# -# Copyright (C) 2015 Red Hat -# -# This file is part of ocserv. -# -# ocserv is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 2 of the License, or (at -# your option) any later version. -# -# ocserv is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with ocserv; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -srcdir=${srcdir:-.} - -#this test can only be run as root -id|grep root >/dev/null 2>&1 -if [ $? != 0 ];then - exit 77 -fi - -PORT_OCSERV=443 -CONFIG="reload" -IMAGE=ocserv-reload-info -IMAGE_NAME=test_reload_info -TMP=$IMAGE_NAME.tmp -PIDFILE="$IMAGE_NAME.$$.pid.tmp" -. ./docker-common.sh - -$DOCKER run -e OCCTL_PAGER=cat -P --privileged=true -p 22 --tty=false -d --name $IMAGE_NAME $IMAGE -if test $? != 0;then - echo "Cannot run docker image" - exit 1 -fi - -echo "ocserv image was run" -#wait for ocserv to server -sleep 5 - -get_ip -if test -z "$IP";then - echo "Detected IP is null!" - stop -fi -echo "Detected IP: $IP" - -if test ! -z "$QUIT_ON_INIT";then - exit 0 -fi - -echo "" -echo "Connecting with correct username" -$ECHO_E "test" >pass-full$TMP -$OPENCONNECT $IP:$PORT_OCSERV -b --pid-file $PIDFILE -u test --passwd-on-stdin -v --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 < pass-full$TMP -if test $? != 0;then - echo "Cannot connect to server" - stop -fi - -#wait for openconnect -sleep 5 - -rm -f pass-full$TMP -if [ ! -f $PIDFILE ];then - echo "It was not possible to establish session!" - stop -fi - -PID=`cat $PIDFILE` -rm -f $PIDFILE - -# The client IP depends on the username so it shouldn't change. -ping -w 5 192.168.87.1 -if test $? != 0;then - kill -INT $PID - echo "Cannot ping ocserv" - stop -fi - -retrieve_user_info test - -sleep 2 - -$DOCKER exec $IMAGE_NAME /bin/killall -HUP ocserv-main - -sleep 2 - -retrieve_user_info test - -ping -w 5 192.168.87.1 -if test $? != 0;then - kill -INT $PID - echo "Cannot ping ocserv after sighup" - stop -fi - -kill -INT $PID - -sleep 4 - -#check whether /tmp/disconnect/ok was created -check_for_file /tmp/disconnect/not-ok -if test $? = 0;then - echo "There was an issue" - stop -fi - -check_for_file /tmp/disconnect/ok -if test $? != 0;then - echo "There was an issue getting stats" - ret=77 -fi - -$DOCKER stop $IMAGE_NAME -$DOCKER rm $IMAGE_NAME - -exit $ret diff --git a/tests/docker-ocserv/proxy-connectscript b/tests/scripts/proxy-connectscript similarity index 68% rename from tests/docker-ocserv/proxy-connectscript rename to tests/scripts/proxy-connectscript index e58008f6..ba690b76 100755 --- a/tests/docker-ocserv/proxy-connectscript +++ b/tests/scripts/proxy-connectscript @@ -1,9 +1,8 @@ #!/bin/sh -mkdir -p /tmp/connect if [ "$REASON" = "connect" ];then if test "$IP_REAL" != "127.0.0.1" && test "$IP_REAL" != "::1" && test -n "$IP_REAL_LOCAL";then - echo "$IP_REAL:$IP_REAL_LOCAL" >/tmp/connect/ok + echo "$IP_REAL:$IP_REAL_LOCAL" >proxyproto-connect-ok fi fi diff --git a/tests/scripts/proxy-connectscript-v1 b/tests/scripts/proxy-connectscript-v1 new file mode 100755 index 00000000..c082d253 --- /dev/null +++ b/tests/scripts/proxy-connectscript-v1 @@ -0,0 +1,9 @@ +#!/bin/sh + +if [ "$REASON" = "connect" ];then + if test "$IP_REAL" != "127.0.0.1" && test "$IP_REAL" != "::1" && test -n "$IP_REAL_LOCAL";then + echo "$IP_REAL:$IP_REAL_LOCAL" >proxyproto-v1-connect-ok + fi +fi + +exit 0