GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 16:57:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Do not set X-CSTP-Lease-Duration header

Browse Source 
This header was added in dd34f85875.
The intention was to allow clients to accurately determine the remaining
lifetime of the authentication session by replicating the headers that Cisco
servers were observed to send. See https://gitlab.com/openconnect/openconnect/-/merge_requests/156
for the client-side implementation in OpenConnect.

However, two users of ocserv have now reported that the *presence* of this
header *breaks* compatibility with newer Cisco AnyConnect clients
(https://gitlab.com/openconnect/ocserv/-/issues/414#note_581221384,
https://gitlab.com/openconnect/ocserv/-/issues/232#note_477714207).

This patch removes the `X-CSTP-Lease-Duration` header, while leaving behind
the `X-CSTP-Session-Timeout` and `X-CSTP-Session-Timeout-Remaining` headers.
With

(a) Cisco AnyConnect clients are able to correct (tested at
    https://gitlab.com/openconnect/ocserv/-/issues/414#note_581563460)
(b) OpenConnect clients are still able to determine the authentication session
    lifetime (https://gitlab.com/openconnect/ocserv/-/issues/414#note_582314323)

Signed-off-by: Daniel Lenski <dlenski@gmail.com>
This commit is contained in:
Daniel Lenski
2021-05-22 10:29:53 -07:00
parent b37544b513
commit fac0244f3e
1 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/worker-vpn.c
View File

@@ -2226,16 +2226,13 @@ static int connect_handler(worker_st * ws)
}
if (!ws->user_config->has_session_timeout_secs) {
ret = cstp_puts(ws, "X-CSTP-Lease-Duration: none\r\n"
"X-CSTP-Session-Timeout: none\r\n");
ret = cstp_puts(ws, "X-CSTP-Session-Timeout: none\r\n");
SEND_ERR(ret);
} else {
time_t expiration = ws->session_start_time + ws->user_config->session_timeout_secs;
ret = cstp_printf(ws, "X-CSTP-Lease-Duration: %u\r\n"
"X-CSTP-Session-Timeout: %u\r\n"
ret = cstp_printf(ws, "X-CSTP-Session-Timeout: %u\r\n"
"X-CSTP-Session-Timeout-Remaining: %ld\r\n",
ws->user_config->session_timeout_secs,
ws->user_config->session_timeout_secs,
MAX(expiration - now, 0));
SEND_ERR(ret);
}