* Client IPs are essential for abuse handling
* NOTICE instead of INFO means they will be logged by default
Signed-off-by: Stefan Bühler <source@stbuehler.de>
This makes oc_syslog respect the configured log-level. This also introduces
a clear separation of the logging function between the two processes.
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Separated the logging logically from any remaining debugging
features. Introduced command line option for logging to stderr
only (for systemd and containers). The default log level is set
to (2) info.
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
ocserv has sent IPv6 DNS/routes to AnyConnect clients since
e9b79254e7, but this comment was inadvertently
retained.
Signed-off-by: Daniel Lenski <dlenski@gmail.com>
We are now planning to change the default HTTP user-agent string in
the OpenConnect client. In order to improve compatibility with Cisco
servers, it needs to start with `AnyConnect`; likely, the complete
prefix will be `AnyConnect-compatible OpenConnect VPN Agent`. (Details
in https://gitlab.com/openconnect/openconnect/-/merge_requests/497)
ocserv treats clients differently depending on their user-agent
strings:
1. ocserv makes simplifications/accommodations in its authentication
flow to accommodate old versions of OpenConnect
(`AGENT_OPENCONNECTV3`).
https://gitlab.com/openconnect/ocserv/-/blob/master/src/worker-auth.c
2. `ocserv` entirely disables IPv6 for old versions of OpenConnect
(`AGENT_OPENCONNECTV3`) *and* for unknown client software
(`AGENT_UNKNOWN`).
https://gitlab.com/openconnect/ocserv/-/blob/master/src/worker-vpn.c#L2123-2136
At this point, ocserv seems to be aware of a reasonably-complete list
of compatible client software: AnyConnect, OpenConnect, Clavister
OneConnect, AnyLink, and Cisco SVC IPPhone.
Among these, *only* old OpenConnect clients are known to require special
handling to unconditionally disable IPv6.
This patch modifies ocserv so that the IPv6 is disabled *only* for old
OpenConnect clients, and not for unknown clients. This should make the
transition to OpenConnect's modified UA string go more smoothly.
This should also improve "future-proofness" generally. Accommodations
for buggy clients should specifically list the affected clients,
rather than include unknown clients, since unknown clients are most
likely to be newer clients, in which bugs and incompatibilities may
have been fixed.
Signed-off-by: Daniel Lenski <dlenski@gmail.com>
Wait for all processes to terminate within 5 seconds, and
report the number of processes that did not terminate.
Resolves: #563
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
From i386/Debian CI jobs:
warning: format '%ld' expects argument of type 'long int', but argument 4 has type 'uint64_t' {aka 'long long unsigned int'} [-Wformat=]
snprintf(output, output_size, "%ldms", microseconds / 1000);
~~^ ~~~~~~~~~~~~~~~~~~~
%lld
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
Add support for LoongArch:
* Legacy syscalls 'fstat' and 'newfstatat' are not available
on new Linux architectures such as LoongArch.
This commit will fix related build-time errors.
* They have been superseded by syscall 'statx', which should
probably be enabled to avoid runtime errors.
Runtime errors can be fixed in a different merge request.
See merge request openconnect/ocserv!380
Once a client has progressed through the initial
auth checks (and successfully passed the initial
camouflage check), it's safe to skip further camouflage
checks. This allows the Cisco Secure client continue
successfully through HTTP requests for /profiles//etc/ocserv/profile.xml
and /1/VPNManifest.xml.
Resolves: #544
Signed-off-by: Rob van Oostenrijk <robvanoostenrijk@users.noreply.github.com>
* this test allows to validate the occtl output (JSON format) returns
expected fields
* we only test 2 fields for now (ID and raw_connected_at), but could
be expanded easily
Signed-off-by: Florian Domain <f.domain@criteo.com>
* useful for machines reading JSON to get directly the unix timestamp of
the users connection start time
Signed-off-by: Florian Domain <f.domain@criteo.com>
