GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-14 02:22:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,671 Commits 38 Branches 91 Tags
773d277802a92cb4de2163de4d880d90e0c923c0
Commit Graph
215 Commits
Author SHA1 Message Date
Nikos Mavrogiannopoulos 773d277802 kkdcp: perform the proper encoding and decoding on exchanged data 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 137e584538 force relative names on the socket file to allow it being accessible from main and workers 2015-02-15 12:23:39 +01:00
Nikos Mavrogiannopoulos a07be822ac use IPV6_V6ONLY flag only when defined 2015-02-15 08:21:39 +01:00
Nikos Mavrogiannopoulos 1b9fe50628 Set blocking mode to fd returned by accept 
That addresses issues in OpenBSD where the fd is
set to non blocking when the accept's fd is non blocking.
 2015-02-14 11:49:26 +01:00
Nikos Mavrogiannopoulos 820de6a979 correctly renamed DTLS ID search functions 2015-02-10 18:14:34 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos 1545130237 main: Check chdir() return value 
This fixes:

    main.c: In function ‘main’:
    main.c:1025:8: warning: ignoring return value of ‘chdir’, declared with attribute warn_unused_result [-Wunused-result]
       chdir(s->config->chroot_dir);
            ^
 2015-02-09 11:31:52 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos fbe55c23ef main: Fix unused variable warning on !HAVE_LIBSYSTEMD builds 
This fixes:

      CC       main.o
    main.c: In function ‘listen_ports’:
    main.c:276:11: warning: unused variable ‘fds’ [-Wunused-variable]
      int ret, fds;
               ^
 2015-02-09 11:31:18 +01:00
Nikos Mavrogiannopoulos 38206d6e93 eliminate double books for session expiration 
Session expiration is now handled only by security
module. That simplifies the logic significantly.
 2015-02-09 11:25:48 +01:00
Aron XuandNikos Mavrogiannopoulos d4b6d97697 Replace LIBSYSTEMD_DAEMON with LIBSYSTEMD 
Signed-off-by: Aron Xu <aron@debian.org>
 2015-01-24 10:15:05 +01:00
Nikos Mavrogiannopoulos fe848ad153 replaced use-seccomp by isolate-workers 
That, if enabled, includes the Linux namespaces restrictions into workers.
 2015-01-15 10:25:23 +01:00
Nikos Mavrogiannopoulos 4dee583e29 In linux run the server in it's own container with separate IPC and PID namespace 2015-01-14 17:08:01 +01:00
Nikos Mavrogiannopoulos c3417f0830 simplified DTLS fd handling and dtls_pull() 2015-01-11 11:40:22 +01:00
Nikos Mavrogiannopoulos a04599afc8 always forward the first message when forwarding fd 2015-01-11 11:33:44 +01:00
Nikos Mavrogiannopoulos 41d61c4225 cleanups 2015-01-11 11:27:06 +01:00
Nikos Mavrogiannopoulos 286ea8ff7b only set IPV6_RECVPKTINFO on IPv6 sockets 2015-01-11 10:57:02 +01:00
Nikos Mavrogiannopoulos a4c2967e02 simplified forward_udp_to_owner() by introducing oc_recvfrom_at() 2015-01-11 10:53:29 +01:00
Nikos Mavrogiannopoulos 3d7ac2c98c bind to the address we received UDP on 
That in addition allocates a new UDP socket per client,
and forwards the initial client hello to the worker
process as auxillary data. That, eliminates the need to
re-open the main server's UDP socket per client connection.
 2015-01-11 00:46:34 +01:00
Nikos Mavrogiannopoulos 07e01d06b5 use strlcpy() instead of snprintf() where it make sense 
That should reduce wasted cycles.
 2014-12-14 19:24:14 +01:00
Nikos Mavrogiannopoulos baa3e4701e Supplementary configuration is now read by the security module. 
That allows sec-mod to handle both authentication and accounting.
That deprecates the session-control configuration option.
 2014-12-08 13:52:28 +01:00
Nikos Mavrogiannopoulos f1e71ec597 improved logged messages 2014-11-15 12:47:30 +01:00
Nikos Mavrogiannopoulos 57cbb43a3b advertise a new DTLS session only when it is one 2014-11-15 12:32:31 +01:00
Nikos Mavrogiannopoulos 79668eb5e5 partially reverted b924eba1ac 
The timeouts were reset to the original values.
 2014-11-15 10:21:26 +01:00
Nikos Mavrogiannopoulos a4ec19eb55 disable matching of IPs when the listen-clear-file option is set 2014-11-15 09:50:35 +01:00
Nikos Mavrogiannopoulos b924eba1ac reduced the severity of log messages when forwarding packets and reduced the timeouts 2014-11-10 16:05:02 +01:00
Nikos Mavrogiannopoulos 53005a2cfd use hash tables to locate proc entries 
That would avoid a walk on all connected clients, when a
new UDP session starts.
 2014-10-27 15:01:05 +01:00
Nikos Mavrogiannopoulos ccd07f96fc use non-blocking sockets in worker process 2014-10-05 22:13:08 +02:00
Nikos Mavrogiannopoulos db48e3db07 added set_non_block() 2014-10-05 22:00:53 +02:00
Nikos Mavrogiannopoulos ef7fb7d594 Revert "use force_close() on server to avoid descriptor leaks" 
This reverts commit f622f6696c.
 2014-10-02 09:36:22 +02:00
Nikos Mavrogiannopoulos accdb24050 allow positive values to waitpid 2014-09-25 10:26:50 +02:00
Nikos Mavrogiannopoulos f4de7e7757 increased the verbosity of shutdown messages 2014-09-25 10:04:00 +02:00
Nikos Mavrogiannopoulos 30bcf35576 Revert "license upgraded to GPLv3" 
This reverts commit 213f9a63ee.

Conflicts:
	configure.ac
 2014-09-24 11:34:15 +02:00
Nikos Mavrogiannopoulos de486dbdfe Allow disabling the TCP port completely 2014-09-23 22:47:36 +02:00
Nikos Mavrogiannopoulos 56bcfffed7 allow the group owner of the connection socket to access it 2014-09-23 16:42:30 +02:00
Nikos Mavrogiannopoulos 4ea5a56ace Allow the CSTP layer to operate without TLS 
That also introduces a unix domain socket under which connections to the
server can occur.
 2014-09-23 16:08:29 +02:00
Nikos Mavrogiannopoulos f622f6696c use force_close() on server to avoid descriptor leaks 2014-09-21 01:40:36 +02:00
Nikos Mavrogiannopoulos 0cd8002f0c when a UDP packet error occurs print the IP of the packet 2014-09-20 00:04:01 +02:00
Nikos Mavrogiannopoulos 817f757577 after fork restore the default signal mask 2014-08-22 15:23:16 +02:00
Nikos Mavrogiannopoulos cfa74a4e29 Reload the configuration of the security module as well, on main process reload. 2014-06-10 15:47:58 +02:00
Nikos Mavrogiannopoulos 28dca2aa0c Added support for session control (relevant for PAM for now) 
That in effect will utilize the pam_open_session() and pam_close_session().
It is disabled by default as it requires more resources from the security module.
 2014-06-10 15:16:40 +02:00
Nikos Mavrogiannopoulos 6f3c07ca2d SID is no longer being randomized in main. 
This was unecessary as it is now being set (and generated) by sec-mod.
 2014-06-02 09:28:36 +02:00
Nikos Mavrogiannopoulos 1e48d0d0de main: removed the inactive ban_list. 2014-05-29 00:20:13 +02:00
Nikos Mavrogiannopoulos ff4f895cb0 main: deactivate the cookie when releasing proc. 2014-05-29 00:19:24 +02:00
Nikos Mavrogiannopoulos d11d8ae47c increased the maintainance time to 15 mins 2014-05-28 10:56:03 +02:00
Nikos Mavrogiannopoulos 25fbdfbf70 Keep track of cookies internally. 
That allows to restrict the cookie validity time to the absolutely minimum
required to establish and reconnect a recently disconnected session.
That deprecates the cookie-validity option and introduces the cookie-timeout
option.
 2014-05-27 16:00:57 +02:00
Nikos Mavrogiannopoulos 0586e4c5fa Simplified the TLS hash table initialization. 2014-05-27 15:00:13 +02:00
Nikos Mavrogiannopoulos 213f9a63ee license upgraded to GPLv3 2014-05-23 11:50:56 +02:00
Nikos MavrogiannopoulosandNikos Mavrogiannopoulos 4755ee48c5 Added the select-group and auto-select-group config options. 
These options allow to prompt the user for a group prior to login.
That in addition enhances the password file format and multiple groups
can be specified on a comma separated list, as:
user:group1,group2,group3:$5$encodedpassword
 2014-05-19 18:25:25 +02:00
Nikos Mavrogiannopoulos d99c527758 memory reorganization in sec-mod. 
It no longer relies on main pool, it uses it's own pool.
In addition the DEBUG_LEAKS definition was added to allow debugging
leaks.
 2014-05-15 16:44:43 +02:00
Nikos Mavrogiannopoulos 739a2126d0 Clean-up all memory on deinitialization of sec-mod and worker. 
That will allow to easier spot any unintentional memory leaks.
 2014-05-15 15:36:03 +02:00
Nikos Mavrogiannopoulos 68c4b2371b Renamed main-auth.h. 2014-05-15 11:39:02 +02:00