GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-13 18:12:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,604 Commits 38 Branches 91 Tags
75af003f128ef859c57f28e0febf35dd706e609c
Commit Graph
1112 Commits
Author SHA1 Message Date
Nikos Mavrogiannopoulos 75af003f12 check the explicit IP addresses for existence in our leases 2015-02-11 09:51:43 +01:00
Nikos Mavrogiannopoulos 57225a2c6a reserve the first address of the network to be set as the local part in our tun devices 
That is used only when explicit IP addresses are set. That way we
don't need to separate addresses into odd and even.
 2015-02-11 09:37:26 +01:00
Nikos Mavrogiannopoulos 0d999f5424 Added failure codes for proc_table_add() 2015-02-10 18:36:40 +01:00
Nikos Mavrogiannopoulos 85483e98e8 added hash table to search via 'real' SID 2015-02-10 18:33:02 +01:00
Nikos Mavrogiannopoulos 820de6a979 correctly renamed DTLS ID search functions 2015-02-10 18:14:34 +01:00
Nikos Mavrogiannopoulos 952d6adc9c Added implicit accounting when explicit addresses are specified 
Only odd IP addresses can now explicitly be set, so that the next
even address can be used as the local one.
 2015-02-10 11:07:58 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos 2e757cedb2 Use distinct remote and local IPs when explicit_ipv[46] is specified 
Currently the code sets the local interface IP to the same value as the
P-t-P IP:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:192.168.63.1  P-t-P:192.168.63.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1341  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

This doesn't seem to get things routed correctly.  e.g. pinging 192.168.63.1
from the ocserv gateway just loops traffic back to the local machine instead
of pinging the client.

So instead we'll set LIP = RIP + 1.  This isn't terribly intuitive (an
administrator might try to number consecutive users 192.168.1.1, 192.168.1.2,
192.168.1.3, ...) but it's better than the current situation.  Maybe at some
point, fixed IPs should also make use of the hash table.
 2015-02-10 10:43:49 +01:00
Nikos Mavrogiannopoulos 1e0af5c482 set cookie to expire when the last user disconnects 2015-02-10 09:10:00 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos 25cfd3b1db config: Use talloc_free() to free "route" strings 
Adding redundant routes triggers a glibc assertion on startup.  The offending
config file contained:

    route = 192.168.1.0/255.255.255.0
    route = default

The assertion:

    # ./src/ocserv -c ocserv.conf -f
    *** Error in `./src/ocserv': munmap_chunk(): invalid pointer: 0x0000000001703470 ***
    Aborted (core dumped)

Fix this by calling the correct free() function.
 2015-02-09 15:06:57 +01:00
Nikos Mavrogiannopoulos 35fae82538 document explicit-ipv? 2015-02-09 15:04:30 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos 71ff05cea7 Allow explicit-ipv4 / explicit-ipv6 addresses in per-user config files 
If a machine is running remotely accessible services, it can be helpful
to assign a fixed IP address upon connection.
 2015-02-09 11:32:24 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos 1545130237 main: Check chdir() return value 
This fixes:

    main.c: In function ‘main’:
    main.c:1025:8: warning: ignoring return value of ‘chdir’, declared with attribute warn_unused_result [-Wunused-result]
       chdir(s->config->chroot_dir);
            ^
 2015-02-09 11:31:52 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos fbe55c23ef main: Fix unused variable warning on !HAVE_LIBSYSTEMD builds 
This fixes:

      CC       main.o
    main.c: In function ‘listen_ports’:
    main.c:276:11: warning: unused variable ‘fds’ [-Wunused-variable]
      int ret, fds;
               ^
 2015-02-09 11:31:18 +01:00
Nikos Mavrogiannopoulos 38206d6e93 eliminate double books for session expiration 
Session expiration is now handled only by security
module. That simplifies the logic significantly.
 2015-02-09 11:25:48 +01:00
Nikos Mavrogiannopoulos e82e1b8d68 delete client entry after message is sent 2015-02-09 10:57:40 +01:00
Nikos Mavrogiannopoulos dcb7068c19 Before allowing the steal of leases, check that usernames match 2015-02-09 10:20:25 +01:00
Nikos Mavrogiannopoulos 905222fe6e corrected typo 2015-02-09 10:20:00 +01:00
Nikos Mavrogiannopoulos ee81ffa10d when we detect user disconnection, set the proper expiration time on their cookies 2015-02-09 10:07:46 +01:00
Nikos Mavrogiannopoulos 1ce578a525 doc update 2015-02-06 20:05:35 +01:00
Nikos Mavrogiannopoulos bcea928abe Added support for no-routes (X-Split-Exclude) 2015-02-06 14:05:10 +01:00
Nikos Mavrogiannopoulos 639514d1e1 seccomp: allow _newselect since it is called in x86 instead of select 2015-01-30 00:41:26 +01:00
Nikos Mavrogiannopoulos 654cf12ac4 sec-mod: use ctime() to print the ban list expiration time 2015-01-28 13:04:02 +01:00
Nikos Mavrogiannopoulos 5d3b2da2e1 sec-mod: pass all failures through handle_sec_auth_res() 
That will set the proper state to the user entry.
 2015-01-28 12:56:37 +01:00
Nikos Mavrogiannopoulos 0dc2e43335 worker: allow empty passwords 2015-01-28 11:52:38 +01:00
Nikos Mavrogiannopoulos 6c8174668d moved LOG_DEBUG messages to debug level 3 or higher 2015-01-28 11:48:58 +01:00
Nikos Mavrogiannopoulos b8bcf8b835 moved some debugging messages into http level 2015-01-28 11:41:15 +01:00
Nikos Mavrogiannopoulos 414c5d94da harmonize the time cookies are stored in security module and main server 2015-01-25 18:48:49 +01:00
Nikos Mavrogiannopoulos 99c9a8ef6a enable min-reauth-time in default configuration 2015-01-24 13:56:41 +01:00
Nikos Mavrogiannopoulos de846f9dd6 enforce the actual number of MAX_TRIES in authentication 2015-01-24 13:53:34 +01:00
Nikos Mavrogiannopoulos 313b456a54 occtl: corrected sending of dbus msgs 2015-01-24 10:18:41 +01:00
Aron XuandNikos Mavrogiannopoulos d4b6d97697 Replace LIBSYSTEMD_DAEMON with LIBSYSTEMD 
Signed-off-by: Aron Xu <aron@debian.org>
 2015-01-24 10:15:05 +01:00
Aron XuandNikos Mavrogiannopoulos aeb034222a Update call parameters of str_init() for --with-dbus 
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
 2015-01-24 08:50:50 +01:00
Nikos Mavrogiannopoulos cbcb9a6a7d doc update 2015-01-21 15:13:11 +01:00
Nikos Mavrogiannopoulos c907496136 worker: calculate MTU prior to sending IPv6 addresses 
That way we can disable IPv6 if the calculated MTU size is
less than the allowed by IPv6.
 2015-01-21 10:28:45 +01:00
Nikos Mavrogiannopoulos ac80bbdbf0 include http-heads.h into ocserv's sources 2015-01-21 07:51:03 +01:00
Nikos Mavrogiannopoulos bcef2eb16b doc update 2015-01-20 14:26:42 +01:00
Nikos Mavrogiannopoulos c0cd87b0e3 properly disable safe_fork 2015-01-20 10:40:16 +01:00
Nikos Mavrogiannopoulos 2a25795170 corrected isolate-workers typo 2015-01-20 10:40:09 +01:00
Nikos Mavrogiannopoulos ec1ee46250 ocpasswd: attempt to use sha2crypt only in glibc 
uclibc's crypt(3) is so dumb it will not error if
$5$ is specified as salt, but not supported.
 2015-01-19 14:46:37 +01:00
Nikos Mavrogiannopoulos 0ce83be801 ocpasswd: corrected fallback to MD5 crypt 2015-01-19 14:46:35 +01:00
Nikos Mavrogiannopoulos cb5499a6b7 only define safe_fork() in systems with linux namespaces 2015-01-19 10:49:01 +01:00
Nikos Mavrogiannopoulos c954e45e53 silence debugging messages from sec-mod when not in debug 2015-01-18 17:34:59 +01:00
Nikos Mavrogiannopoulos 5179a064ab doc update 2015-01-18 16:51:34 +01:00
Nikos Mavrogiannopoulos 310855cb7c move more http-related functions to worker-http 2015-01-16 11:55:17 +01:00
Nikos Mavrogiannopoulos 6d1f848e1d updated copyright information in LZS code 2015-01-16 11:17:52 +01:00
Nikos Mavrogiannopoulos 0638d85631 combined parsing of CSTP and DTLS encoding 2015-01-16 11:12:16 +01:00
Nikos Mavrogiannopoulos 4a372f4e05 Replace header_check() mess with a gperf table 2015-01-16 11:07:10 +01:00
Nikos Mavrogiannopoulos dcf47899e0 Moved HTTP parts of worker to worker-http.c 2015-01-16 10:56:35 +01:00
Nikos Mavrogiannopoulos 04a9381068 Compression is disabled by default 2015-01-16 10:45:53 +01:00
Nikos Mavrogiannopoulos d3159c6973 lzs.h: added license 2015-01-16 10:23:00 +01:00