ICMPv6 was never excluded from idle-timeout accounting because is_data()
inspected data[9] for both IPv4 and IPv6. Offset 9 is the Protocol field
in the IPv4 fixed header (RFC 791), but the Next Header field in the IPv6
fixed header sits at offset 6 (RFC 8200 §3). As a result, the idle timer
was reset on every ICMPv6 packet, preventing the server from disconnecting
clients that were sending only control traffic.
Resolves: #724
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This removes certificate and CA handlers not used by the openconnect
client. This is a hardening measure to further reduce the attack surface
of the worker process.
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
In case of error in pam_start(3), the content of the `pam_handle_t **pamh`
handle is undefined:
Following a successful return (PAM_SUCCESS) the contents of
pamh is a handle that contains the PAM context for successive
calls to the PAM functions. In an error case is the content
of pamh undefined.
Although pam_sterror(3) does not use `pamh` in any way, pass plain
`NULL` instead of `pamh`.
Fixes#722.
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
When two HTTP requests arrived in the same TLS read buffer, a single
llhttp_execute() call would fire callbacks for both requests inline.
Because http_req_reset() is not called between them, ws->req ended up
reflecting the second request's URL and headers, silently discarding
the first. In the worst case, body bytes from the first request
accumulated alongside the second request's body.
Fix this by registering an on_message_begin callback that returns
HPE_PAUSED when an existing message is detected.
Resolves: #716
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This fixes a theoretical risk of overflow. I suspect it's not an issue in
practice, but it doesn't hurt to switch to talloc_array() to remove the
problem altogether. Also, `talloc_array()` macro returns the proper type.
From `talloc.h`:
/**
* talloc_array - allocate dynamic memory for an array of a given type
* @ctx: context to be parent of this allocation, or NULL.
* @type: the type to be allocated.
* @count: the number of elements to be allocated.
*
* The talloc_array() macro is a safe way of allocating an array. It is
* equivalent to:
*
* (type *)talloc_size(ctx, sizeof(type) * count);
*
* except that it provides integer overflow protection for the multiply,
* returning NULL if the multiply overflows.
/**
* talloc_size - allocate a particular size of memory
* @ctx: context to be parent of this allocation, or NULL.
* @size: the number of bytes to allocate
*
* The function talloc_size() should be used when you don't have a convenient
* type to pass to talloc(). Unlike talloc(), it is not type safe (as it
* returns a void *), so you are on your own for type checking.
*
* Best to use talloc() or talloc_array() instead.
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
Bound memory growth in the worker for unauthenticated connections by
enforcing HTTP headers limit in addition to HTTP body limit.
Resolves: #712
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
ipcalc was used only to convert dotted-decimal subnet masks to CIDR
prefix lengths (e.g. 255.255.0.0 -> 16), replaced with a POSIX shell
script.
Relates: #709
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This adds checks in memory allocation, to address the following issue reported by coverity:
** CID 645850: Null pointer dereferences (FORWARD_NULL) /tests/ban-ips.c: 84 in main()
Signed-off-by: default avatarDimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
When processing a RADIUS Access-Accept with Framed-IPv6-Prefix, the code
passed the wrong value for it. Corrected by passing the actual prefix.
Fixes: #710
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This fixes a -Wtype-limits warning encountered in builds without
PAM and RADIUS (e.g., OpenWRT). When the avail_acct_types array is
empty, ARRAY_SIZE evaluates to 0, making the unsigned comparison
always false.
Reported in #709.
Signed-off-by: Grigory Trenin <grigory.trenin@gmail.com>
Ensure that 'tunnel-all-dns' setting is honoured when overridden
in user or group-specific configuration files.
Resolves: #708
Signed-off-by: Grigory Trenin <grigory.trenin@gmail.com>
