Nikos Mavrogiannopoulos
177c1c95bd
Allow aliases to group names.
2014-05-21 12:25:26 +02:00
Nikos Mavrogiannopoulos
2668fe63b4
Added the default-select-group directive.
2014-05-19 20:00:35 +02:00
Nikos Mavrogiannopoulos and Nikos Mavrogiannopoulos
4755ee48c5
Added the select-group and auto-select-group config options.
...
These options allow to prompt the user for a group prior to login.
That in addition enhances the password file format and multiple groups
can be specified on a comma separated list, as:
user:group1,group2,group3:$5$encodedpassword
2014-05-19 18:25:25 +02:00
Nikos Mavrogiannopoulos
6bc625df81
The route configuration directive accepts the keyword 'default'
...
In that case it will return a default route irrespective of any other
route directives. That allows overriding existing routes with a default
route for specific users and groups.
2014-05-19 09:58:37 +02:00
Nikos Mavrogiannopoulos
739a2126d0
Clean-up all memory on deinitialization of sec-mod and worker.
...
That will allow to easier spot any unintentional memory leaks.
2014-05-15 15:36:03 +02:00
Nikos Mavrogiannopoulos
788560b9ce
Added default-user-config and default-group-config configuration options.
...
These allow setting a configuration file that will be loaded if a
user-specific or group-specific configuration file isn't found.
2014-05-14 13:27:51 +02:00
Nikos Mavrogiannopoulos
3f9a215f53
Allow for random and for predictable IP assignment.
2014-05-14 13:00:11 +02:00
Nikos Mavrogiannopoulos
522a9c35a4
Allow modifying the default occtl socket file.
2014-05-11 14:16:38 +02:00
Nikos Mavrogiannopoulos
fe150f8ab3
better interplay between use-dbus and use-occtl.
2014-05-09 16:38:28 +02:00
Nikos Mavrogiannopoulos
969e684960
Use talloc() for all allocations to reduce the possibility of memory leaks.
2014-05-09 16:13:11 +02:00
Nikos Mavrogiannopoulos
b0e10065a0
Support for the unix socket is now configurable.
2014-05-09 16:12:37 +02:00
Nikos Mavrogiannopoulos
71104b36a3
Added support for unix sockets for the occtl communication.
...
D-BUS support is left, but is not enabled by default.
2014-05-07 13:54:58 +02:00
Nikos Mavrogiannopoulos
20cc945383
Warn when setting a default route the wrong way.
2014-03-01 14:23:22 +01:00
Nikos Mavrogiannopoulos
95a0b6abc3
Added the rekey-method config option.
2014-02-22 12:51:34 +01:00
Nikos Mavrogiannopoulos
7b73aee479
when mobile-dpd and mobile-idle-timeout are not set, they get values from their non-mobile counterpart.
2014-02-18 19:39:37 +01:00
Nikos Mavrogiannopoulos
6ee0899e22
Added the mobile-idle-timeout config option.
2014-02-18 18:54:50 +01:00
Nikos Mavrogiannopoulos
367976ca34
Implemented Idle timeout.
...
When set, a client that does not have any non-control traffic
for that period is getting disconnected.
2014-02-18 18:09:23 +01:00
Nikos Mavrogiannopoulos
c5c38e92bd
Do not allow DPD to be disabled.
...
Doing so would prevent the server from dropping inactive
connections. If the dpd values are not configured, set some
reasonable defaults.
2014-02-17 22:40:32 +01:00
Nikos Mavrogiannopoulos
2bd6f5a6a1
Added the mobile-dpd configuration option.
...
This option allows setting a different DPD value for
mobile clients to allow them going to sleep for longer time.
2014-02-17 22:17:09 +01:00
Nikos Mavrogiannopoulos
be332174f8
Simplified debugging by allowing multiple levels.
...
'ocserv -d' now accepts a numeric option from 0 (no debugging) to 9
(maximum verbosity).
2014-02-17 20:19:39 +01:00
Nikos Mavrogiannopoulos
0faee9fbbf
print errors when an invalid IPv6 prefix is found.
2014-02-15 15:16:19 +01:00
Nikos Mavrogiannopoulos
3b9971b7e8
Added support for the "new" type of IP6 support in AnyConnect.
...
If the client sends "X-CSTP-Full-IPv6-Capability: true", then we
use the headers:
X-CSTP-Address-IP6: 2001:db8:1000:1000::1/64
X-CSTP-Split-Include-IP6: 2001:db8:1000:1001::/64
X-CSTP-Split-Include-IP6: 2001:db8:1000:1002::/64
(see corresponding openconnect change)
2014-02-15 13:51:03 +01:00
Nikos Mavrogiannopoulos
f8f30bffa4
set a reasonable default rekey time
2014-02-12 11:07:14 +01:00
Nikos Mavrogiannopoulos
c92925e727
Rekey time is now configurable and can be disabled.
2014-02-11 15:47:20 +01:00
Nikos Mavrogiannopoulos
638228e284
Use brackets in DEL macro
2014-02-05 09:56:06 +01:00
Nikos Mavrogiannopoulos
91ceefb1f3
Added the split-dns config option.
2014-02-01 18:59:50 +01:00
Nikos Mavrogiannopoulos
311d5ddd20
Added configuration option to send custom headers to client.
2014-02-01 18:55:27 +01:00
Nikos Mavrogiannopoulos
0ec67882c0
Added support for multiple DNS and NBNS servers.
...
This patch also combines ipv4-dns and ipv6-dns options
that are now handled as aliases to dns.
A side-effect of this patch is that the local keyword is no
longer supported.
2014-02-01 14:50:52 +01:00
Nikos Mavrogiannopoulos
ea02f38a04
if the loading of default config in the new location fails, try the old default file.
2014-02-01 09:24:52 +01:00
Nikos Mavrogiannopoulos
28e5d62f3f
The worker process receives the client's IPs from the main process.
...
That eliminates the need to read the IP address from the tun device
(which can be quite tricky to implement in a clean portable way).
2014-01-31 20:53:45 +01:00
Nikos Mavrogiannopoulos
2254ba554b
Set a default password file if one is not specified in ocpasswd.
2014-01-30 19:12:02 +01:00
Nikos Mavrogiannopoulos
d454557649
replace always-require-cert with cisco-client-compat.
2014-01-18 11:19:19 +01:00
Nikos Mavrogiannopoulos
9079e2b67a
Added configuration option use-dbus to allow disabling D-BUS usage.
2014-01-09 21:32:24 +01:00
Nikos Mavrogiannopoulos
cdba1ae374
Try to release as much memory as possible to be able to detect real memory leaks.
2014-01-09 17:27:49 +01:00
Nikos Mavrogiannopoulos
49b4eaa7dd
eliminated memory leaks
2014-01-09 16:56:01 +01:00
Nikos Mavrogiannopoulos
fdaeb60846
when using systemd socket activation the tcp-port option is optional.
...
Moreover the UDP and TCP ports are "discovered" from the provided file
descriptors.
2014-01-06 13:10:04 +01:00
Nikos Mavrogiannopoulos
c6a08db6db
Added support for cgroups
2013-12-10 11:07:08 +01:00
Nikos Mavrogiannopoulos
fd25969aca
simplified reading the net-priority option
2013-12-10 10:05:36 +01:00
Nikos Mavrogiannopoulos
b21f05df06
Allow setting directly the IP_TOS from net-priority.
2013-12-09 22:59:44 +01:00
Nikos Mavrogiannopoulos
6cb553e9a8
Added the net-priority configuration option.
...
That option allows setting the protocol-defined priority (via SO_PRIORITY)
for the UDP and TCP sockets, per user/group or globally.
2013-12-09 14:40:55 +01:00
Nikos Mavrogiannopoulos
8a919d236f
udp-port can now be unset, and that will disable listening to UDP.
2013-12-07 17:44:31 +01:00
Nikos Mavrogiannopoulos
e08f70987a
Added the --http-debug option to ocserv to avoid printing full HTTP messages to normal debug mode.
2013-11-16 17:33:50 +01:00
Nikos Mavrogiannopoulos
615e16cc41
count bandwidth in kb/sec to avoid overflows on high bandwidth.
2013-11-05 20:32:23 +01:00
Nikos Mavrogiannopoulos
3dc2637c6f
Added pid-file command line option, that overrides the configured pid-file.
2013-11-05 20:03:23 +01:00
Nikos Mavrogiannopoulos
85f4db201c
updated license information and authors
2013-11-05 19:38:30 +01:00
Nikos Mavrogiannopoulos
2f5141b00f
Added directives to allow bandwidth limitation.
2013-11-03 17:06:02 +01:00
Nikos Mavrogiannopoulos
e4d2e5803d
Added commands to add and remove a route.
2013-10-29 11:07:03 +01:00
Nikos Mavrogiannopoulos
30f0e93e70
Added the ipv6-prefix configuration option
2013-10-29 10:01:53 +01:00
Nikos Mavrogiannopoulos
00554b2f28
Allow loading additional configuration files per user or per group.
...
The directives currently allowed are: ipv4/6_dns and route.
2013-10-28 11:43:05 +01:00
Nikos Mavrogiannopoulos
87684c1c0d
Configuration file parsing was modified to allow detecting mispellings of directives and unknown options.
2013-10-21 10:29:44 +02:00
