GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-14 02:22:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,670 Commits 38 Branches 91 Tags
6334bada15107406dfd4c2cd8f60774c4307dae6
Commit Graph
157 Commits
Author SHA1 Message Date
Nikos Mavrogiannopoulos 6334bada15 renamed urlfw to kkdcp 2015-02-19 11:47:20 +01:00
Nikos MavrogiannopoulosandNikos Mavrogiannopoulos b300177eb7 Added max-password-retries config option 
That makes the number of retries prior to banning the IP
configurable.
 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos c0ceeba0f8 Fail if authentication modules are changed on reload 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 01ec22db27 Allow setting content-type urlfw, and allow tcp 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 494738dd55 Added url-fw config option 
That allows to specify a class of URLs where, if a client
POSTS to it, the data will be forwarded to the configured server,
and the client will receive its reply.
 2015-02-19 11:47:20 +01:00
Nikos MavrogiannopoulosandNikos Mavrogiannopoulos afef74fa23 removed the certificate[optional] auth type 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 8bb0af61bc Added GSSAPI as an additional password auth mechanism 
That also adds the ability to support an OR composition of multiple
authentication methods. That is using the 'enable-auth' config option.
 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 23586bdb9c no longer document the auth option certificate[optional] 2015-02-12 21:08:41 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos 25cfd3b1db config: Use talloc_free() to free "route" strings 
Adding redundant routes triggers a glibc assertion on startup.  The offending
config file contained:

    route = 192.168.1.0/255.255.255.0
    route = default

The assertion:

    # ./src/ocserv -c ocserv.conf -f
    *** Error in `./src/ocserv': munmap_chunk(): invalid pointer: 0x0000000001703470 ***
    Aborted (core dumped)

Fix this by calling the correct free() function.
 2015-02-09 15:06:57 +01:00
Nikos Mavrogiannopoulos bcea928abe Added support for no-routes (X-Split-Exclude) 2015-02-06 14:05:10 +01:00
Nikos Mavrogiannopoulos 2a25795170 corrected isolate-workers typo 2015-01-20 10:40:09 +01:00
Nikos Mavrogiannopoulos 04a9381068 Compression is disabled by default 2015-01-16 10:45:53 +01:00
Nikos Mavrogiannopoulos 048b25ba45 Made the no-compress-limit configurable 2015-01-15 18:31:33 +01:00
Nikos Mavrogiannopoulos 27168673f0 added option to disable compression 2015-01-15 16:42:29 +01:00
Nikos Mavrogiannopoulos 831abcb76d corrected typo 2015-01-15 16:34:58 +01:00
Nikos Mavrogiannopoulos fe848ad153 replaced use-seccomp by isolate-workers 
That, if enabled, includes the Linux namespaces restrictions into workers.
 2015-01-15 10:25:23 +01:00
Nikos Mavrogiannopoulos 7a51462abd reorganized to avoid compiler warnings 2015-01-15 09:59:38 +01:00
Nikos Mavrogiannopoulos 4dee583e29 In linux run the server in it's own container with separate IPC and PID namespace 2015-01-14 17:08:01 +01:00
Nikos Mavrogiannopoulos a1abcdbeae Allow prefixes in specifying the IPv4 network 2014-12-30 17:22:02 +02:00
Nikos Mavrogiannopoulos 50f2fb88f6 simplify the input of IPv6 networks 
The prefix is specified as part of the network.
 2014-12-29 20:15:36 +02:00
Nikos Mavrogiannopoulos 27b9e91eb8 bail out if use-seccomp is set to true but there is no seccomp capability 2014-12-29 14:22:45 +02:00
Nikos Mavrogiannopoulos 07e01d06b5 use strlcpy() instead of snprintf() where it make sense 
That should reduce wasted cycles.
 2014-12-14 19:24:14 +01:00
Nikos Mavrogiannopoulos b18eeb7d74 first set amod and then use it 
That fixes a crash with PAM module on startup.
Reported by Ismail Donmez.
 2014-12-11 11:58:23 +01:00
Nikos Mavrogiannopoulos 065753bd57 undid ed5b177691 
It is not currently possible to reload only a part of the
configuration. If the back-end module changes, the server will
bail out instead.
 2014-12-10 15:28:14 +01:00
Nikos Mavrogiannopoulos 35e93c6341 added option to send statistics periodically to sec-mod 2014-12-10 11:18:23 +01:00
Nikos Mavrogiannopoulos ed5b177691 authentication information is only read on load 2014-12-10 08:56:23 +01:00
Nikos Mavrogiannopoulos 766afb591a Added support for reading user configuration from radius. 2014-12-09 15:38:27 +01:00
Nikos Mavrogiannopoulos 2194e11b39 Added support for radius authentication 2014-12-09 10:59:18 +01:00
Nikos Mavrogiannopoulos baa3e4701e Supplementary configuration is now read by the security module. 
That allows sec-mod to handle both authentication and accounting.
That deprecates the session-control configuration option.
 2014-12-08 13:52:28 +01:00
Nikos Mavrogiannopoulos 8365449e9b deprecated ipv6_netmask 2014-12-08 10:48:25 +01:00
Nikos Mavrogiannopoulos cb9dcde387 Notify the client that the server may have a dynamic DNS address 
That is send "X-CSTP-DynDNS: true", in CSTP headers if the
server is configured as having a dynamic DNS address.
 2014-11-30 11:30:08 +01:00
Nikos Mavrogiannopoulos 120e49b26b only enable session control when a username/password authentication is used 2014-10-11 08:28:04 +02:00
Nikos Mavrogiannopoulos 3a455f4178 listen-file -> listen-clear-file 2014-09-28 09:06:14 +02:00
Nikos Mavrogiannopoulos e2585b2f26 unix-conn-file -> listen-file 2014-09-26 08:54:41 +02:00
Nikos Mavrogiannopoulos bdcd27d13e optional-certificate was renamed to certificate[optional] 2014-09-25 10:36:46 +02:00
Nikos Mavrogiannopoulos 365ca267d4 added new authentication mode optional-certificate 
That mode allows having only specific group of users that are required
to present a certificate.
 2014-09-24 12:41:31 +02:00
Nikos Mavrogiannopoulos 30bcf35576 Revert "license upgraded to GPLv3" 
This reverts commit 213f9a63ee.

Conflicts:
	configure.ac
 2014-09-24 11:34:15 +02:00
Nikos Mavrogiannopoulos b479659836 do not allow the combination of AUTH_TYPE_CERTIFICATE and unix-conn-file 2014-09-23 22:33:37 +02:00
Nikos Mavrogiannopoulos 4ea5a56ace Allow the CSTP layer to operate without TLS 
That also introduces a unix domain socket under which connections to the
server can occur.
 2014-09-23 16:08:29 +02:00
Nikos Mavrogiannopoulos 6de26b9408 made macro usage safer 
That solves an issue where the pid_file would be overwritten on
a configuration file reload.
 2014-07-26 10:59:26 +02:00
Nikos Mavrogiannopoulos 4117bf2661 Use a more terse, but with more dynamic information version string. 2014-06-23 21:09:43 +02:00
Nikos Mavrogiannopoulos 70623591d5 Seccomp is now compiled in by default, and can be enabled at run-time. 2014-06-12 15:35:45 +02:00
Nikos Mavrogiannopoulos 28dca2aa0c Added support for session control (relevant for PAM for now) 
That in effect will utilize the pam_open_session() and pam_close_session().
It is disabled by default as it requires more resources from the security module.
 2014-06-10 15:16:40 +02:00
Nikos Mavrogiannopoulos 25fbdfbf70 Keep track of cookies internally. 
That allows to restrict the cookie validity time to the absolutely minimum
required to establish and reconnect a recently disconnected session.
That deprecates the cookie-validity option and introduces the cookie-timeout
option.
 2014-05-27 16:00:57 +02:00
Nikos Mavrogiannopoulos b5d5e3cb36 do not deny roaming by default 2014-05-26 13:04:16 +02:00
Nikos Mavrogiannopoulos 7ba0fffb07 Added the configuration option deny-roaming. 
That required moving the read of the group configuration during the
cookie authentication phase.
 2014-05-25 10:17:28 +02:00
Nikos Mavrogiannopoulos 78132e2a6d Added auto group listing on PAM authentication as well. 
In addition a configuration option to print group IDs over a
certain number was added.
 2014-05-23 16:36:48 +02:00
Nikos Mavrogiannopoulos 213f9a63ee license upgraded to GPLv3 2014-05-23 11:50:56 +02:00
Nikos Mavrogiannopoulos 28943341db Added the proxy-url option to allow sending a proxy URL. 
This corresponds to the X-CSTP-MSIE-Proxy-Pac-URL CSTP header.
 2014-05-23 11:04:30 +02:00
Nikos Mavrogiannopoulos fbdcaa82ca Make pid-file an array to avoid issues with memory allocation. 2014-05-21 14:16:00 +02:00