Nikos Mavrogiannopoulos
e7171ac859
Supplementary group/user configuration is now modular.
...
That will ease the addition of other backends that can be used to
read the user/group configuration. The only backend supported now
is file.
2014-05-15 11:36:30 +02:00
Nikos Mavrogiannopoulos
53f3129da9
Authentication modules were moved to subdirectory auth/
2014-05-14 14:35:50 +02:00
Nikos Mavrogiannopoulos
09704b8819
Password authentication is now delegated to sec-mod.
...
That prevents any memory from the authentication modules to be leaked
to a worker process. As a result, the status zombie and dead no longer
exists.
2014-05-14 11:37:01 +02:00
Nikos Mavrogiannopoulos
07559df432
Corrected the removal of socket files in chrooted environment.
...
In addition remove the occtl_socket_file.
2014-05-12 11:14:53 +02:00
Nikos Mavrogiannopoulos
5e3afb92ad
eliminate the need for a worker_pool variable in main_server_st.
2014-05-12 10:51:18 +02:00
Nikos Mavrogiannopoulos
9f07c42b82
Allow the main process to connect to sec-module.
...
That allows gnutls' to verify the key validity during initialization.
2014-05-12 10:12:39 +02:00
Nikos Mavrogiannopoulos
41561567b5
status cmd will report the server uptime
2014-05-10 23:12:37 +02:00
Nikos Mavrogiannopoulos
d0729cf454
use safe_memset() where needed.
2014-05-10 13:48:00 +02:00
Nikos Mavrogiannopoulos
f21079b667
use malloc_trim() to return memory to OS after fork().
2014-05-09 20:42:04 +02:00
Nikos Mavrogiannopoulos
969e684960
Use talloc() for all allocations to reduce the possibility of memory leaks.
2014-05-09 16:13:11 +02:00
Nikos Mavrogiannopoulos
71104b36a3
Added support for unix sockets for the occtl communication.
...
D-BUS support is left, but is not enabled by default.
2014-05-07 13:54:58 +02:00
Nikos Mavrogiannopoulos
ca8ac737b7
initialize values to avoid compiler warnings.
2014-05-01 12:08:23 +02:00
Nikos Mavrogiannopoulos
489368c58e
When receiving unexpected UDP packets, check if they match a known IP and forward them.
...
This will not work for many clients that come from a single IP but will
work-around issues, when clients are behind a NAT that keeps their UDP port
state for shorter time than DPD.
2014-04-19 10:29:57 +02:00
Nikos Mavrogiannopoulos
bd7240e1d5
When a DTLS hello message is received, print the source address.
2014-04-18 20:37:27 +02:00
Nikos Mavrogiannopoulos
3f8661a98a
renamed function names for clarity.
2014-04-16 11:49:13 +02:00
Nikos Mavrogiannopoulos
f8fbb9bde3
Corrected several coverity uncovered bugs.
2014-04-15 10:08:42 +02:00
Nikos Mavrogiannopoulos
be3920a08c
Correctly close tun lease descriptors prior to running worker.
...
That is, properly initialize them to -1, to avoid deinitializing
an unrelated descriptor.
2014-04-13 14:04:55 +02:00
Nikos Mavrogiannopoulos
1c3ca402b3
Revert "close tun lease descriptors prior to running worker"
...
This reverts commit 9496819a33
2014-04-13 09:35:20 +02:00
Nikos Mavrogiannopoulos
9496819a33
close tun lease descriptors prior to running worker
2014-04-12 23:56:23 +02:00
Nikos Mavrogiannopoulos
d00319faf4
Updates in CRL handling.
...
Ensure reload on SIGHUP, and do print an appropriate error
when an empty CRL file is encountered.
2014-04-02 12:55:43 +02:00
Nikos Mavrogiannopoulos
214ae42cd3
The IP don't fragment bit is only set if try-mtu-discovery is true.
2014-03-24 13:22:22 +01:00
Nikos Mavrogiannopoulos
194462a600
use remove_proc() instead of user_disconnected() when killing children.
2014-02-23 11:50:01 +01:00
Nikos Mavrogiannopoulos
25afdb5949
use RND_RANDOM for the generation of SID
2014-02-22 10:00:32 +01:00
Nikos Mavrogiannopoulos
be332174f8
Simplified debugging by allowing multiple levels.
...
'ocserv -d' now accepts a numeric option from 0 (no debugging) to 9
(maximum verbosity).
2014-02-17 20:19:39 +01:00
Nikos Mavrogiannopoulos
991455065f
simplified handling of CISCO reconnecting clients.
...
Instead of having a client use the initial SID over and over,
re-set the SID cookie, during authentication when needed. That
way we avoid having expensive checks to ensure uniqueness of SID.
2014-02-16 22:47:45 +01:00
Nikos Mavrogiannopoulos
4e8d7e7a58
corrected typo
2014-02-15 13:44:05 +01:00
Nikos Mavrogiannopoulos
8ffca1fcd9
eliminate small leak
2014-02-15 09:57:52 +01:00
Nikos Mavrogiannopoulos
798eb38eb0
remove socket and pid files prior to waiting for kill.
2014-01-31 13:28:11 +01:00
Nikos Mavrogiannopoulos
ed43472ac9
print info when a UDP connection is rejected due to time.
2014-01-28 08:35:18 +01:00
Nikos Mavrogiannopoulos
2b743f5898
increased minimum maintainance time, and decreased log level of maintainance message.
2014-01-19 09:34:27 +01:00
Nikos Mavrogiannopoulos
9d2b10de22
Use base64 to encode Cookies. That reduces the size of the cookie.
2014-01-19 09:14:11 +01:00
Nikos Mavrogiannopoulos
ef647c0190
reduce maintainance time to remove zombie processes sooner.
2014-01-19 03:43:30 +01:00
Nikos Mavrogiannopoulos
b9fe6b6263
instead of using the TLS session ID as session identifier prior to authentication use the webvpncontext cookie.
2014-01-19 02:59:04 +01:00
Nikos Mavrogiannopoulos
b1af6f2829
enabling cisco-client-compat allows 'stealing' of processes.
...
This change puts a proc_st that its client has terminated to a "zombie"
state. That state will allow a client that connects later using the
same TLS session ID to reclaim it. That way clients that try to authenticate
by sending their credentials in different sessions can still authenticate with
ocserv. That however puts more trust to worker processes (as the main
process has no way of telling whether a TLS session is certainly
resumed).
2014-01-18 15:06:10 +01:00
Nikos Mavrogiannopoulos
089e8a7c30
updated copyrights
2014-01-12 10:01:48 +01:00
Nikos Mavrogiannopoulos
6d3f5b791e
use pselect only when available.
2014-01-11 14:42:23 +01:00
Nikos Mavrogiannopoulos
9b4e98be71
unblock signals in children.
2014-01-09 21:21:27 +01:00
Nikos Mavrogiannopoulos
cdba1ae374
Try to release as much memory as possible to be able to detect real memory leaks.
2014-01-09 17:27:49 +01:00
Nikos Mavrogiannopoulos
df1b3ac223
block signals on the proper time.
2014-01-09 16:22:25 +01:00
Nikos Mavrogiannopoulos
bc08bcce9a
Added reload and 'stop now' D-BUS commands.
2014-01-09 11:24:30 +01:00
Nikos Mavrogiannopoulos
3e6be0f788
force kill if there are alive children after some time
2014-01-09 10:55:17 +01:00
Nikos Mavrogiannopoulos
99140996b7
force kill if not every process dies.
2014-01-09 10:30:18 +01:00
Nikos Mavrogiannopoulos
80e5d84c6d
remove_proc() calls remove_from_script_list().
...
This will prevent a race in the case where a proc is deleted (i.e.,
user is disconnected) but a running script terminates afterwards and
tries to reference the deleted proc.
2014-01-08 20:21:45 +01:00
Nikos Mavrogiannopoulos
7b4c98680e
set sockets to non-blocking outside the loop.
2014-01-08 20:13:38 +01:00
Nikos Mavrogiannopoulos
cf8cac0161
better names to lists
2014-01-08 20:07:41 +01:00
Nikos Mavrogiannopoulos
7c7b5bffbd
use pselect() instead of select()
2014-01-08 19:05:22 +01:00
Nikos Mavrogiannopoulos
0cf7529c72
Added support for control commands using D-BUS.
2014-01-08 11:15:06 +01:00
Nikos Mavrogiannopoulos
fdaeb60846
when using systemd socket activation the tcp-port option is optional.
...
Moreover the UDP and TCP ports are "discovered" from the provided file
descriptors.
2014-01-06 13:10:04 +01:00
Nikos Mavrogiannopoulos
0981efe74f
store the time a client connected.
2014-01-05 17:17:54 +01:00
Nikos Mavrogiannopoulos
f344ced1d0
set socket options in sockets received by systemd as well.
2013-12-30 22:58:34 +01:00
