Capture all the required worker process state in a protobuf and
pass to worker via env. Snapshot all config files to ensure ocserv-sm
and ocserv-worker remain in sync. Split ocserv-worker functionality
into it's own executable with minimal dependencies.
Resolves: #285
Signed-off-by: Alan Jowett alanjo@microsoft.com
This addresses issues with anyconnect clients which send back the descriptive labels.
Resolves#267
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Linux kernel commit 955ec4c ("net/ipv6: Do not allow route add with a
device that is down") rejects attempts to install an IPv6 route on an
interface that is not yet up. This commit is first included in kernel
4.16.
The current code in os_set_ipv6_addr brings up the interface only
after attempting to install the IPv6 route. On kernel 4.16 or later,
this fails with the error "Error setting route to remote IPv6: Network
is down".
Fix by switching the order of code blocks to bring the interface up
before attempting to configure the route.
Resolves: #301
Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>
This adds a fedora CI run to with filtered calls failing
with a signal in order to detect missing syscalls from our filters.
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
When new calls are introduced in the kernel a libc may
chose to move to them. Having our filter return ENOSYS
will signal libc to fallback to the previous call which
exists in the filter.
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
On systems that are running low on memory, the ocserv worker processes
should be killed before the ocserv-main or ocserv-sm process.
To achieve this, we set /proc/self/oom_score_adj to 1000
Resolves: #283
Signed-off-by: Alan TG Jowett <alan.jowett@microsoft.com>
This makes the CSTP connection more interactive for clients that
cannot run over UDP.
See openconnect#122 for discussion.
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
In openconnect client the BYE packet indicates an explicit
user disconnect by sending 0x0b as payload. In anyconnect clients it
may indicate an intention to reconnect (e.g., because network was changed).
We introduce a check for 0x0b to identify the user disconnect and
add debugging output for other disconnect reasons.
Relates: #281
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
This fixes the ban entries listing from printing all the items in
the database, to all the items that are actually banned from
connecting.
Resolves: #272
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
That prevents clients that send an all-zero DTLS client hello from being
able to establish a connection.
That also introduces the OCSERV_ALLOW_BROKEN_CLIENTS environment variable
which when set to 1 it allows broken clients to connect. This is used
mainly to allow test cases to pass to existing vulnerable systems in our
CI.
Resolves: #277
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
