GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-10 08:12:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,259 Commits 37 Branches 91 Tags
96aa1f5ae774dbeb041caa7233fdc3d767a8fa2f
Commit Graph
48 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Alan Jowett 25e899017a Merge branch 'cookie-httponly' into 'master' 
Added HttpOnly flag to cookie

See merge request openconnect/ocserv!258
 2021-02-22 16:25:42 +00:00
Alan Jowett c53cc97395 Close fd and stop ev_io on failed handshake. 
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2021-02-04 10:18:34 -07:00
Alan Jowett 84dd1ace60 Merge branch 'coverity_fix' into 'master' 
Fix coverity warning in forward_udp_to_owner

See merge request openconnect/ocserv!241
 2020-12-02 20:43:39 +00:00
Alan Jowett 50ab40782a Fix coverty warning in forward_udp_to_owner 
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
 2020-12-02 12:58:56 -07:00
Alan Jowett 5b9fc73fd9 Merge branch 'issue360' into 'master' 
Issue360 - Send disconnect reason with BanIP message

Closes #360

See merge request openconnect/ocserv!234
 2020-11-06 22:30:21 +00:00
Alan Jowett 01a9815bdf Set disconnect reason when updating ban-ip 
Resolves: #360

Signed-off-by: Alan Jowett alan.jowett@microsoft.com
 2020-11-06 13:16:32 -07:00
Alan Jowett 73ebc58265 Merge branch 'issue359' into 'master' 
Allow setup of new DTLS session while processing on old session

Closes #359

See merge request openconnect/ocserv!223
 2020-10-19 17:21:33 +00:00
Alan Jowett 3436705a9c Allow setup of new DTLS session while processing on old session 
Resolves: #359

Signed-off-by: Alan Jowett alan.jowett@microsoft.com
 2020-10-19 10:36:03 -06:00
Alan Jowett 117bad2e29 Merge branch 'issue362' into 'master' 
Log disconnects from TCP healt probe at debug level

See merge request openconnect/ocserv!229
 2020-10-16 15:56:53 +00:00
Alan Jowett 6fe6926cff Log disconnects from TCP healt probe at debug level 
Signed-off-by: Alan Jowett alan.jowett@microsoft.com
 2020-10-16 09:13:49 -06:00
Alan Jowett 1b938f8726 Merge branch 'user/alanjo/issue365' into 'master' 
Log fatal key retrieval errors at LOG_ERR

Closes #365

See merge request openconnect/ocserv!228
 2020-10-14 22:30:48 +00:00
Alan Jowett f116c134a4 Log fatal key retrieval errors at LOG_ERR 
Resolves #365

Signed-off-by: Alan Jowett alan.jowett@microsoft.com
 2020-10-14 15:47:48 -06:00
Alan Jowett 0d3d0dbd3d Merge branch 'malloc_enforce' into 'master' 
Raise warning level on malloc to catch double frees earlier.

See merge request openconnect/ocserv!227
 2020-10-09 16:23:15 +00:00
Alan Jowett afe437f8eb Raise warning level on malloc to catch double frees earlier. 
Signed-off-by: Alan Jowett alan.jowett@microsoft.com
 2020-10-09 09:39:35 -06:00
Alan Jowett c106bb86fc Merge branch 'issue363' into 'master' 
Latency stats should be at LOG_DEBUG not LOG_INFO level

Closes #363

See merge request openconnect/ocserv!225
 2020-10-07 19:52:35 +00:00
Alan Jowett f0f90ef4d7 Merge branch 'issue362' into 'master' 
TCP health probes shouldn't be logged at INFO level

Closes #362

See merge request openconnect/ocserv!224
 2020-10-07 19:39:40 +00:00
Alan Jowett cd0f382628 Latency stats should be at LOG_DEBUG not LOG_INFO level 
Resolves: #363

Signed-off-by: Alan Jowett alan.jowett@microsoft.com
 2020-10-07 13:09:05 -06:00
Alan Jowett 7ffb4d1ca2 TCP health probes shouldn't be logged at INFO level 
Resolves: #362

Signed-off-by: Alan Jowett alan.jowett@microsoft.com
 2020-10-07 12:56:24 -06:00
Alan Jowett f94b54341e Merge branch 'issue360' into 'master' 
Don't apply BanIP checks to clients on the same subnet.

Closes #360

See merge request openconnect/ocserv!222
 2020-10-01 21:22:45 +00:00
Alan Jowett 5b402014fd Don't apply BanIP checks to clients on the same subnet. 
Resolves #360

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
 2020-10-01 11:59:41 -06:00
Alan Jowett 8cc7fed172 Merge branch 'issue357-part1' into 'master' 
Don't attempt TLS if the client closes the connection with zero data sent.

Closes #357

See merge request openconnect/ocserv!221
 2020-09-30 22:46:37 +00:00
Alan Jowett 7a924b6d9c Don't attempt TLS if the client closes the connection with zero data sent. 
Resolves #357

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
 2020-09-30 16:03:38 -06:00
Alan JowettandNikos Mavrogiannopoulos 12c3d62276 Stop listening on ocserv-sm socket on error to prevent looping. 
Resolves #356

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
 2020-09-29 22:51:52 +02:00
Alan Jowett 5b3b8e8d33 Merge branch 'issue345' into 'master' 
Stop accepting new TCP connections when the server is at maximum active connection capacity & add support for gracefully stopping the server.

Closes #345

See merge request openconnect/ocserv!212
 2020-09-02 14:51:05 +00:00
Alan Jowett 77dfa36c71 Stop accepting new TCP connections when the server is at maximum active connection capacity. 
Add support for gracefully stopping the server.
Add primer on using ocserv with L3 load balancer.

Resolves: #345

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-08-28 16:01:35 -06:00
Alan Jowett e5191bf4f3 Merge branch 'issue341' into 'master' 
Modify ocserv-sm to permit it to scale up to the number of CPUs. This permits...

Closes #341

See merge request openconnect/ocserv!210
 2020-08-26 16:44:43 +00:00
Alan Jowett 945699097d Modify ocserv-sm to permit it to scale up to the number of CPUs. This permits a higher rate of client connections and prevents TLS signing from becoming a bottleneck for clients connecting. 
Resolves: #341

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-08-26 09:46:04 -06:00
Alan Jowett 34eab81339 Resolves: #326 
Pass the hostname to ocserv-main after receiving the connect request.

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-07-28 13:37:20 -06:00
Alan JowettandNikos Mavrogiannopoulos 6533299b78 Improve accept rate limitation and make it conditional on queue depth. 
Resolves: #310

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-07-11 12:51:29 +02:00
Alan Jowett 770c4202f5 Provide option to suppress tests that depend on /dev/net/tun 
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-07-08 14:31:35 -06:00
Alan JowettandBjörn Ketelaars be17dac16f OpenBSD lacks support for procfs 
Based on
https://gitlab.com/Alan_Jowett/ocserv/-/commit/60641282df1462dd94a12a9832200bb5e6849ec4.

Snapshot of config files are used to ensure that ocserv-sm and
ocserv-worker remain in sync. These snapshots are anonymous files that
are passed via a file descriptor. A worker creates a new file
description and file descriptor by using open(2) on /proc/self/fd.
Unfortunately OpenBSD lacks support for procfs.

Instead of using snapshot of config files let workers use the config
files.

While here add a note to README.md about this limitation, and add a CI
run (from @nmav).

Signed-off-by: Björn Ketelaars <bjorn.ketelaars@hydroxide.nl>
 2020-07-01 16:20:46 +02:00
Alan Jowett 4204d8a5c0 Resolves: #315 
Filter out sensitive headers when logging

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-06-30 08:57:44 -06:00
Alan JowettandAlan Jowett 722e030e58 Add reporting of RX latency 
Resolve: #258

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-05-26 18:14:36 -06:00
Alan JowettandNikos Mavrogiannopoulos ce66485ee6 Uses fork/exec to limit memory footprint of ocserv-worker processes 
Capture all the required worker process state in a protobuf and
pass to worker via env. Snapshot all config files to ensure ocserv-sm
and ocserv-worker remain in sync. Split ocserv-worker functionality
into it's own executable with minimal dependencies.

Resolves: #285

Signed-off-by: Alan Jowett alanjo@microsoft.com
 2020-05-25 08:33:16 +02:00
Alan JowettandNikos Mavrogiannopoulos 75470d99c3 When setting up the DTLS session, close the previous DTLS session if it exists. 
Resolves: #293

Signed-off-by: Alan Jowett alanjo@microsoft.com
 2020-04-29 13:39:28 +02:00
Alan Jowett 7e5052782e Remove unused code when --disable-compression is set. 
Resolves: #291

Singed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-04-27 09:18:09 -06:00
Alan Jowett 8cac05dac2 Remove unused code when --disable-anyconnect-compat is set. 
Resolves: #290

Signed-off-by: Alan Jowett alanjo@microsoft.com
 2020-04-26 13:10:10 -06:00
Alan JowettandNikos Mavrogiannopoulos b63ecb7717 Kill ocserv workers before ocserv-main or ocserv-secmod 
On systems that are running low on memory, the ocserv worker processes
should be killed before the ocserv-main or ocserv-sm process.

To achieve this, we set /proc/self/oom_score_adj to 1000

Resolves: #283

Signed-off-by: Alan TG Jowett <alan.jowett@microsoft.com>
 2020-04-22 12:59:07 +02:00
Alan Jowett 9d9907ef5e Attempt to download updated JWKs if the client presents an unknown key. 
Limit the download of keys to every 900s.

Resolves: #284
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-04-19 16:30:12 -06:00
Alan JowettandNikos Mavrogiannopoulos 780fbb89a0 Script needs access to additional client metadata. 
Export more information to the script, including client device platform,
type and user agent.

Resolves: #256

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-03-11 09:13:55 +01:00
Alan JowettandNikos Mavrogiannopoulos b43e782b12 Add support for RFC6750 bearer tokens to ocserv 
This permits the validation of OpenID Connect auth tokens OpenID
Connect is an OAuth 2.0 protocol used to identify a resource owner
(VPN client end-user) to a resource server (VPN server) intermediated
by an Authorization server.

Resolves: #240

Signed-off-by: Alan TG Jowett <alan.jowett@microsoft.com>
 2020-03-09 21:48:04 +01:00
Alan Jowett 6d3b295b12 Fix issues flag by Coverity: 
288530 Dereference after null check
288529 Array compared against 0

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-03-04 09:49:24 -07:00
Alan Jowett c9662282a1 Prevent tampering of our_ip, ip, session_start_time in SEC_AUTH_INIT from ocserv-worker to ocserv->sm and reject replay of auth_init_messages from old sessions. 
Resolves: #252

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-02-28 11:20:30 -07:00
Alan Jowett 6518965129 CMD_BAN_IP should not use the IP address provided by worker process as it is not verified. 
Resolves: #245

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-02-27 12:18:09 -07:00
Alan Jowett bfa442379d ocserv-worker that fails to complete it's authentication should be killed 
Resolves: #251

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-02-27 12:17:45 -07:00
Alan Jowett 87b1dc65ba Bound negotited MTU between RFC 791 defined minumum and configured maximum. 
Resolves: #247

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-02-19 15:26:55 -07:00
Alan Jowett f410a5c637 ocserv-main should limit the maximum message size a client can send 
Resolves: #244

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-02-19 15:11:03 -07:00
Alan JowettandNikos Mavrogiannopoulos 8d1aa343b4 Ban score should always increase. 
Resolves: #246

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
 2020-02-15 21:12:19 +01:00