GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-14 02:22:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,415 Commits 38 Branches 91 Tags
35e93c63417f75e5eab51cb20a325472ef392f99
Commit Graph
84 Commits
Author SHA1 Message Date
Nikos Mavrogiannopoulos 35e93c6341 added option to send statistics periodically to sec-mod 2014-12-10 11:18:23 +01:00
Nikos Mavrogiannopoulos bf2e8c8cd6 added oclog_hex() 2014-11-16 12:34:30 +01:00
Nikos Mavrogiannopoulos 79668eb5e5 partially reverted b924eba1ac 
The timeouts were reset to the original values.
 2014-11-15 10:21:26 +01:00
Nikos Mavrogiannopoulos b924eba1ac reduced the severity of log messages when forwarding packets and reduced the timeouts 2014-11-10 16:05:02 +01:00
Nikos Mavrogiannopoulos 365ca267d4 added new authentication mode optional-certificate 
That mode allows having only specific group of users that are required
to present a certificate.
 2014-09-24 12:41:31 +02:00
Nikos Mavrogiannopoulos 4ea5a56ace Allow the CSTP layer to operate without TLS 
That also introduces a unix domain socket under which connections to the
server can occur.
 2014-09-23 16:08:29 +02:00
Nikos Mavrogiannopoulos 4a0b16fb98 Forward the appropriate DNS and NBNS values when using a per-user/group config. 2014-06-25 10:02:16 +02:00
Nikos Mavrogiannopoulos 1d2f36f9bf When renegotiating, verify that any certificate received from the client contains the same username. 2014-06-13 15:08:40 +02:00
Nikos Mavrogiannopoulos 0a0b51ab37 Added work-around for openconnect v3.20 
That version of openconnect requires some strict format on the
XML messages. Thus we send it, what it expects.
 2014-06-10 10:08:46 +02:00
Nikos Mavrogiannopoulos 6ca3c4761c Cookies are packed using protocol buffers to reduce their size. 2014-05-21 16:11:05 +02:00
Nikos Mavrogiannopoulos 7153ea8ea7 more precise usage of MAX_*_SIZE definitions. 2014-05-21 06:21:34 +02:00
Nikos Mavrogiannopoulos aef5dc0633 Allow multiple groups to be present in a client certificate. 
In that case the user will be prompted to select a group.
 2014-05-20 15:36:40 +02:00
Nikos MavrogiannopoulosandNikos Mavrogiannopoulos 4755ee48c5 Added the select-group and auto-select-group config options. 
These options allow to prompt the user for a group prior to login.
That in addition enhances the password file format and multiple groups
can be specified on a comma separated list, as:
user:group1,group2,group3:$5$encodedpassword
 2014-05-19 18:25:25 +02:00
Nikos Mavrogiannopoulos 6bc625df81 The route configuration directive accepts the keyword 'default' 
In that case it will return a default route irrespective of any other
route directives. That allows overriding existing routes with a default
route for specific users and groups.
 2014-05-19 09:58:37 +02:00
Nikos Mavrogiannopoulos 739a2126d0 Clean-up all memory on deinitialization of sec-mod and worker. 
That will allow to easier spot any unintentional memory leaks.
 2014-05-15 15:36:03 +02:00
Nikos Mavrogiannopoulos 09704b8819 Password authentication is now delegated to sec-mod. 
That prevents any memory from the authentication modules to be leaked
to a worker process. As a result, the status zombie and dead no longer
exists.
 2014-05-14 11:37:01 +02:00
Nikos Mavrogiannopoulos 93db512921 do not separately allocate buffer, but place it instead into worker structure. 2014-05-10 13:26:22 +02:00
Nikos Mavrogiannopoulos 969e684960 Use talloc() for all allocations to reduce the possibility of memory leaks. 2014-05-09 16:13:11 +02:00
Nikos Mavrogiannopoulos 2a0cc77c2e Export TUN device statistics from the worker process. 
When a worker process terminates in authenticated state, then
export statistics from the tun device (currently bytes_in and
bytes_out). These statistics are sent to main process using an
informational message just prior to process exit. The statistics
are also exported to the disconnect script using the STATS_BYTES_IN
and STATS_BYTES_OUT environment variables.
 2014-04-28 17:32:51 +02:00
Nikos Mavrogiannopoulos 03f6e7cc16 Setup an alternative stack for signals on heap. 2014-04-19 12:03:40 +02:00
Nikos Mavrogiannopoulos 0d1eef4fa5 refactored worker main loop 2014-04-03 11:42:18 +02:00
Nikos Mavrogiannopoulos df6653229a more cleanups in MTU calculation 2014-03-30 17:10:30 +02:00
Nikos Mavrogiannopoulos 1b711a1f7c Use the Base-MTU for MTU calculations. 2014-03-27 14:04:58 +01:00
Nikos Mavrogiannopoulos 1879207f37 No longer send IPv6 information to CISCO clients that may not be able to handle it. 
Now IPv6 information is only forwarded if the client is openconnect, or if
the client is unknown and has advertised full IPv6 support.
 2014-03-20 22:51:30 +01:00
Nikos Mavrogiannopoulos 367976ca34 Implemented Idle timeout. 
When set, a client that does not have any non-control traffic
for that period is getting disconnected.
 2014-02-18 18:09:23 +01:00
Nikos Mavrogiannopoulos 2bd6f5a6a1 Added the mobile-dpd configuration option. 
This option allows setting a different DPD value for
mobile clients to allow them going to sleep for longer time.
 2014-02-17 22:17:09 +01:00
Nikos Mavrogiannopoulos 991455065f simplified handling of CISCO reconnecting clients. 
Instead of having a client use the initial SID over and over,
re-set the SID cookie, during authentication when needed. That
way we avoid having expensive checks to ensure uniqueness of SID.
 2014-02-16 22:47:45 +01:00
Nikos Mavrogiannopoulos 3b9971b7e8 Added support for the "new" type of IP6 support in AnyConnect. 
If the client sends "X-CSTP-Full-IPv6-Capability: true", then we
use the headers:
     X-CSTP-Address-IP6: 2001:db8:1000:1000::1/64
     X-CSTP-Split-Include-IP6: 2001:db8:1000:1001::/64
     X-CSTP-Split-Include-IP6: 2001:db8:1000:1002::/64

(see corresponding openconnect change)
 2014-02-15 13:51:03 +01:00
Nikos Mavrogiannopoulos 001fd57c71 Allow rehandshakes on the DTLS channel. 2014-02-11 16:18:08 +01:00
Nikos Mavrogiannopoulos 0ec67882c0 Added support for multiple DNS and NBNS servers. 
This patch also combines ipv4-dns and ipv6-dns options
that are now handled as aliases to dns.

A side-effect of this patch is that the local keyword is no
longer supported.
 2014-02-01 14:50:52 +01:00
Nikos Mavrogiannopoulos 28e5d62f3f The worker process receives the client's IPs from the main process. 
That eliminates the need to read the IP address from the tun device
(which can be quite tricky to implement in a clean portable way).
 2014-01-31 20:53:45 +01:00
Nikos Mavrogiannopoulos 524e90351f Take into account peer's MTU values after considering the overhead. 2014-01-30 10:36:01 +01:00
Nikos Mavrogiannopoulos f9a1dd94ae Do not rehandshake on the DTLS channel. 2014-01-21 18:00:21 +01:00
Nikos Mavrogiannopoulos 5f3a6279d9 protect the server from multiple rehandshakes. 2014-01-21 17:29:45 +01:00
Nikos Mavrogiannopoulos b500de2ec0 simplified ciphersuite selection method and select ciphers based on server's desire. 2014-01-19 11:52:07 +01:00
Nikos Mavrogiannopoulos 404d831c35 better definition names. 2014-01-19 09:49:46 +01:00
Nikos Mavrogiannopoulos 9d2b10de22 Use base64 to encode Cookies. That reduces the size of the cookie. 2014-01-19 09:14:11 +01:00
Nikos Mavrogiannopoulos b9fe6b6263 instead of using the TLS session ID as session identifier prior to authentication use the webvpncontext cookie. 2014-01-19 02:59:04 +01:00
Nikos Mavrogiannopoulos b1af6f2829 enabling cisco-client-compat allows 'stealing' of processes. 
This change puts a proc_st that its client has terminated to a "zombie"
state. That state will allow a client that connects later using the
same TLS session ID to reclaim it. That way clients that try to authenticate
by sending their credentials in different sessions can still authenticate with
ocserv. That however puts more trust to worker processes (as the main
process has no way of telling whether a TLS session is certainly
resumed).
 2014-01-18 15:06:10 +01:00
Nikos Mavrogiannopoulos 823190475b print textual name of messages exchanged. 2014-01-12 18:23:29 +01:00
Nikos Mavrogiannopoulos 39572b3d48 Store User-Agent information and send to occtl. 2014-01-12 14:35:58 +01:00
Nikos Mavrogiannopoulos 2e2310187d Replaced the username cookie with a compact auth option. 
That option performs authentication of username, password in
a single go for clients that request Connection: Close.
 2014-01-12 12:01:08 +01:00
Nikos Mavrogiannopoulos 3c82dc7787 report the file name plus line instead of function name. 2014-01-12 10:19:42 +01:00
Nikos Mavrogiannopoulos eba1c9255b Allow a client to reconnect and continue authentication. 
That allows clients like CISCO anyconnect to resume authentication
in a different session by keeping the username in a cookie. That
works only when a single password is used.
 2014-01-12 09:52:31 +01:00
Nikos MavrogiannopoulosandNikos Mavrogiannopoulos 058b986967 Converted IPC messaging to protocolbuffers-c 
That adds a dependency on protocolbuffers-c, but simplifies
the worker-main communication protocol handling.
 2013-12-21 12:38:01 +01:00
Nikos Mavrogiannopoulos c5e656a916 simplified setting of additional configuration in the worker process 2013-12-09 19:59:46 +01:00
Nikos Mavrogiannopoulos 6cb553e9a8 Added the net-priority configuration option. 
That option allows setting the protocol-defined priority (via SO_PRIORITY)
for the UDP and TCP sockets, per user/group or globally.
 2013-12-09 14:40:55 +01:00
Nikos Mavrogiannopoulos d3a6759bc7 more changes for the new ciphersuites 2013-11-15 09:51:24 +01:00
Nikos Mavrogiannopoulos 85f4db201c updated license information and authors 2013-11-05 19:38:30 +01:00
Nikos Mavrogiannopoulos 2f5141b00f Added directives to allow bandwidth limitation. 2013-11-03 17:06:02 +01:00