GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-09 09:51:49 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,264 Commits 33 Branches 91 Tags
tmp-icmp-ping
Commit Graph
4264 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Nikos Mavrogiannopoulos 3db9ecd259 tests: fixed flaky condition in disconnect-user 
Ensure the client is killed eventually to prevent an openconnect
re-connect to keep the test up.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 21:13:28 +02:00
Nikos Mavrogiannopoulos fd3235784f tests: gssapi tests were moved to a specific testsuite 
They are skipped in Ubuntu 22.04.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 17:32:23 +02:00
Nikos Mavrogiannopoulos 233aa02236 tests: do not run the firewall tests in i386/Debian 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 17:32:23 +02:00
Nikos Mavrogiannopoulos 3026f46d1b cipher-tests: skip if legacy DTLS is disabled 
This is to enable running the test suite under Ubuntu 24.04.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 17:32:23 +02:00
Nikos Mavrogiannopoulos 0ba0c091af tests: initialize worker_st using = {0} 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 17:32:16 +02:00
Nikos Mavrogiannopoulos 979ccc711d .gitlab-ci.yml: updated to Ubuntu 24.04 and Fedora 43 
This deprecates Ubuntu 20.04 builds and Fedora 42 builds
and tests the latest version.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 17:00:33 +02:00
Nikos Mavrogiannopoulos 271b8b9303 tests: added tests for ocserv setting fw rules 
This validates that restrict-user-to-ports and
restrict-user-to-routes are enforced by the fw script.

The test verifies three cases after connecting with a config that
allows only TCP 80 and advertises a single route:
 - allowed port + advertised route: connection succeeds
 - denied port + advertised route: rejected at port level
 - allowed port + non-advertised route: rejected at route level

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 16:55:12 +02:00
Nikos Mavrogiannopoulos bb4e91c58a ocserv-fw: allow override using environment var 
This enables testing of the script.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 16:55:12 +02:00
Nikos Mavrogiannopoulos 598bcf405e Added ocserv-fw for nftables 
This also introduces a basic functional test for ocserv-fw.

Resolves: #397

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 16:55:12 +02:00
Nikos Mavrogiannopoulos e21359716b test-script-multi-user: simplified 
This enables the script to terminate quickly under meson.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-22 22:54:48 +01:00
Nikos Mavrogiannopoulos e5eb5d6de7 .lcovrc: exclude from coverage bundled 3rd party projects and tests 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-22 21:17:18 +01:00
Nikos Mavrogiannopoulos 0a2dc40251 occtl: fix trailing comma in JSON array for show sessions valid/all 
The has_more flag passed to print_end_block() used the raw array index,
producing a trailing comma when the last entry in args->cookies[] was
filtered out (e.g. a PS_AUTH_FAILED session lingering until cookie-timeout).

Fix by adding a pre-pass that collects the indices of entries that will
actually be printed into a C99 variable array vis[].

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
 2026-03-22 21:17:02 +01:00
Nikos Mavrogiannopoulos efa28e1492 worker: flush coverage data on exit 
Add a worker_exit() wrapper that calls __gcov_exit() before _exit()
when built with coverage instrumentation (-Db_coverage=true -> WITH_COVERAGE).
As atexit() handlers from libgcov are not triggered by SIGTERM, it caused
caused all worker-side coverage data to be silently lost.

umask(022) is set before __gcov_exit() so the .gcda files
are written with 0644 permissions and are readable by lcov.

This restores coverage for code paths that run exclusively in the
worker, such as lzs_compress(), lz4_compress().

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-22 21:16:57 +01:00
Nikos Mavrogiannopoulos 790f97d1cb tests: enable parallelization 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-22 21:16:53 +01:00
Nikos Mavrogiannopoulos c223f51c91 occtl.8.md: document available commands 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-22 12:30:04 +01:00
Nikos Mavrogiannopoulos 1b8f7f8ede tests: introduced helper to have uniform termination of client and server 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-22 12:29:59 +01:00
Nikos Mavrogiannopoulos 13a8007280 occtl: test commands 
This tests: show status, reload, show iroutes, disconnect id,
show sessions, show ip ban points.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-22 08:38:02 +01:00
Nikos Mavrogiannopoulos b76aa3b506 tests: run the compression tests also with data that are compressible 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-21 17:06:29 +01:00
Nikos Mavrogiannopoulos e05fc9852b tests: added test for PAM accounting 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-21 17:06:29 +01:00
Nikos Mavrogiannopoulos a33370ad93 tests: introduced test to check the bandwidth restrictions 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-21 17:06:26 +01:00
Nikos Mavrogiannopoulos 41b9016db1 meson: autogenerate AUTHORS 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-21 07:35:48 +01:00
Nikos Mavrogiannopoulos b5e631f6f4 .gitlab-ci.yml: added distcheck job 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos bdf4df9756 test-camouflage: improve termination of client connection 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos 763f98a93e dist-script: generate kkdcp_asn1_tab.c and fail if necessary files missing 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos a7df5240f1 http-heads: generate as C file to avoid issue with coverage 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos 97ad7e479a tests: explicitly specify the path (srcdir vs builddir) of config files 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos f98bf6afcb test-oidc: generate data 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos 7c740caf63 test-namespace-listen: only run when namespaces are enabled 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos df6cfdd64e tests: radius: auto-generate the freeradius config directory 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos 7e00f4247a test-script-multi-user: Fix timeout: move sleep 600 inside connect branch 
The sleep-connect-script blocked on both connect and disconnect invocations.
When the server shuts down, two disconnect scripts race past the test -f
check simultaneously and both sleep 600s, exceeding the test timeout.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos 18401eb298 Replaced autoconf with meson build files 
Resolves: #699

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:27 +01:00
Nikos Mavrogiannopoulos e0aebc0a3c terminate-commands: kill stray processes and reset routes 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-15 21:05:36 +01:00
Nikos Mavrogiannopoulos a6ec9e93df Merge branch 'feature/terminate-session-commands' into 'master' 
Add terminate commands for session cookie invalidation

Closes #689

See merge request openconnect/ocserv!503
 2026-03-15 17:13:53 +00:00
Ivan Verbin a8730a6997 occtl: add terminate commands for session cookie invalidation 
Add 'terminate user', 'terminate id' and 'terminate session' commands
to occtl that disconnect users and invalidate their session cookies,
preventing reconnection with cached credentials.

Short session IDs are resolved to full safe_id by fetching the cookie
list from sec-mod via CTL_CMD_LIST_COOKIES with prefix matching and
ambiguity detection. Active sessions trigger a warning before
invalidation.

Add integration tests for all three terminate commands.

Signed-off-by: Ivan Verbin <verbinivan@gmail.com>
 2026-03-15 17:05:29 +03:00
Dimitri Papadopoulos Orfanos d632aaf046 Merge branch 'fix/ns_name_collision' into 'master' 
tests: Fix intermittent namespace conflicts in CI

See merge request openconnect/ocserv!508
 2026-03-12 15:36:13 +02:00
Grigory Trenin cab071aa78 tests: Fix intermittent namespace conflicts in CI 
Fix PID-based namespace name collisions by:
- Extracting last 9 digits of PID (instead of first 4)
- Shortening interface names to fit 15-character IFNAMSIZ limit

Signed-off-by: Grigory Trenin <grigory.trenin@gmail.com>
 2026-03-11 18:58:24 -04:00
Dimitri PapadopoulosandNikos Mavrogiannopoulos a309ecead0 llhttp: updated to latest version 9.3.1 
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
 2026-03-02 08:19:50 +01:00
Nikos Mavrogiannopoulos 1cb1e5706f NEWS: clarified fix on authentication bypass 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-02 08:13:54 +01:00
Nikos Mavrogiannopoulos 071f1e18ee design.md: moved all diagrams to mermaid 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-01 20:11:07 +01:00
Nikos Mavrogiannopoulos 4ba99fc18b VPN overview: expanded diagram 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-01 20:11:04 +01:00
Nikos Mavrogiannopoulos 87cd179117 Removed design.dia in favor of design.md 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-01 20:10:59 +01:00
Nikos Mavrogiannopoulos 38458a8305 prepare for 1.4.2 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-01 19:19:06 +01:00
Nikos Mavrogiannopoulos 7477c32ba5 NEWS: updated 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
1.4.1 		2026-02-28 11:47:15 +01:00
Nikos Mavrogiannopoulos 789252b3f0 check_cert_user_group_status: added defense in depth check 
Suggested by Maksim Anufriev.

Relates: #694

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-02-28 11:47:00 +01:00
Nikos Mavrogiannopoulos c354de22f8 get_cert-names: simplified username extraction 
Relates: #964

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-02-28 11:47:00 +01:00
Nikos Mavrogiannopoulos 82e9467faa tests: added test-pass-cert-rfc822name 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-02-28 11:46:56 +01:00
Nikos Mavrogiannopoulos 7f6f671702 tests: enhanced test-pass-cert with various other certificate types 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-02-28 11:39:55 +01:00
Dimitri Papadopoulos Orfanos 834d2fa0e8 Merge branch 'tmp-README-oidc.md' into 'master' 
Small doc improvements

See merge request openconnect/ocserv!502
 2026-02-04 00:07:29 +02:00
Nikos Mavrogiannopoulos 210b3338da Merge branch 'tmp-protobuf-c' into 'master' 
updated to protobuf 1.5.2

See merge request openconnect/ocserv!475
 2026-02-03 17:32:58 +00:00
Nikos Mavrogiannopoulos 1e08ef47e0 Merge branch 'compression-tests' into 'master' 
Fix race condition in traffic tests

See merge request openconnect/ocserv!499
 2026-02-03 17:31:57 +00:00