GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-02-10 16:57:00 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,428 Commits 19 Branches 88 Tags
a1d67c48ba3235e25ae80c134bd443af92177bed
Commit Graph

2428 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Nikos Mavrogiannopoulos
a1d67c48ba main: ensure we call ev_child_stop() on child cleanup handlers 2016-01-27 10:54:00 +01:00
Kevin Cernekee
8c2d6adde1 Return HTML error message on 404 
Currently ocserv's 404 errors show up as a blank page in most web
browsers.  Add a simple HTML error page.
 2016-01-27 10:00:06 +01:00
Kevin Cernekee
8bf668c0f7 Use helper functions to send common HTTP headers/responses 
Factor out duplicated code in the AnyConnect compatibility handlers.
 2016-01-27 09:58:47 +01:00
Nikos Mavrogiannopoulos
b3c9da4ce1 doc update 2016-01-26 12:51:33 +01:00
Nikos Mavrogiannopoulos
ed2edd65c5 tests: added check for certificate update on reload 2016-01-26 12:51:05 +01:00
Nikos Mavrogiannopoulos
b6df22c8c3 Reload the certificates and private keys on SIGHUP 
Until now this part of the configuration was static, but
there is the need to reload certificates and keys, e.g., on
renewal.
 2016-01-26 12:51:05 +01:00
Nikos Mavrogiannopoulos
0681aa1e3c main.h: corrected typo in comment 2016-01-25 11:23:16 +01:00
Nikos Mavrogiannopoulos
c61e5eb47b doc: document that ocserv-fw requiring options are available in Linux systems only 2016-01-25 11:16:06 +01:00
Kevin Cernekee
05960f1751 Add default case for 'restrict-user-to-ports' switch 
This fixes a compiler warning:

      CC       main-user.o
    main-user.c: In function ‘call_script’:
    main-user.c:215:7: warning: ‘ret’ may be used uninitialized in this function [-Wmaybe-uninitialized]
        if (ret < 0) {
           ^
    main-user.c:66:6: note: ‘ret’ was declared here
      int ret;
          ^

It's not really necessary because proto gets checked when the option is
parsed, but gcc doesn't know that.
 2016-01-25 11:13:27 +01:00
Nikos Mavrogiannopoulos
a55cf312ca README.md: moved radius to main dependencies 2016-01-21 22:25:44 +01:00
Nikos Mavrogiannopoulos
655df51655 occtl: updated copyright text 2016-01-21 11:18:58 +01:00
Nikos Mavrogiannopoulos
d0fc4ce92b doc: added more info on isolate-workers 2016-01-20 13:12:37 +01:00
Nikos Mavrogiannopoulos
7fcd989d6a TODO: removed already handled issue 2016-01-20 11:58:44 +01:00
Nikos Mavrogiannopoulos
f80f513e4a tlslib: abstracted the recv_packet functions 2016-01-19 14:33:03 +01:00
Nikos Mavrogiannopoulos
f5e5bde862 tls_recv -> cstp_recv 2016-01-19 14:02:21 +01:00
Nikos Mavrogiannopoulos
3e556f21df worker: use DEFAULT_SOCKET_TIMEOUT and remove SOCKET_TIMEO_SECS 2016-01-19 13:56:17 +01:00
Nikos Mavrogiannopoulos
96febbaf61 proxyproto: use force_read_timeout() to ensure reconstruction of packets 2016-01-19 13:55:56 +01:00
Nikos Mavrogiannopoulos
9b6c4f3a26 cleaned up the fatal error checking in TLS/DTLS sessions 2016-01-19 13:19:57 +01:00
Nikos Mavrogiannopoulos
507e725189 tests: fixed issues in radius-test-config 2016-01-19 11:59:37 +01:00
Nikos Mavrogiannopoulos
af95a67182 tests: enhanced the radius checks to test for Connect-Info presence 2016-01-19 11:37:05 +01:00
Nikos Mavrogiannopoulos
72a71d21d1 ocserv: added the --test-config command line option 
This allows to test a configuration file for being valid without
starting the server.
 2016-01-19 10:27:58 +01:00
Nikos Mavrogiannopoulos
9cd8562fd4 worker: handle EOF during HTTP header parsing 2016-01-19 01:03:40 +01:00
Nikos Mavrogiannopoulos
7725d53e8d tls_recv() will retry on EINTR 2016-01-19 00:51:10 +01:00
Nikos Mavrogiannopoulos
40185fe0c2 radius: send user agent information as Connect-Info on accounting start 
Relates #26
 2016-01-18 11:55:16 +01:00
Nikos Mavrogiannopoulos
271ce75574 doc update 2016-01-18 09:08:12 +01:00
Nikos Mavrogiannopoulos
17473a734c tests: updated radius tests for Debian 2016-01-18 00:01:14 +01:00
Nikos Mavrogiannopoulos
55b1cbec91 radius: more careful checks around the user_agent access 2016-01-17 23:18:24 +01:00
Nikos Mavrogiannopoulos
c662641768 README.radius: added Connect-Info attribute 2016-01-17 23:13:04 +01:00
Nikos Mavrogiannopoulos
dfc4124d7a NEWS: doc update [ci skip] 2016-01-16 23:48:37 +01:00
Nikos Mavrogiannopoulos
6c6481de40 radius: send user agent information as Connect-Info 
That allows the radius server to store information on particular
client. Resolves #26
 2016-01-16 23:01:10 +01:00
Nikos Mavrogiannopoulos
8aa55db239 send_stats_to_secmod() is called as soon as possible 
This allows us to send the client assigned IP to radius server
as soon as it is available, rather than waiting a full interim_update
cycle.
 2016-01-14 17:25:35 +01:00
Nikos Mavrogiannopoulos
1fc9e31f3e Updated support for chacha20-poly1305 
It was modified to support the PSK variant of the algorithm because
draft-ietf-tls-chacha20-poly1305-03 doesn't define an RSA variant. It
was tested to interoperate with openconnect/gnutls.
 2016-01-13 11:44:19 +01:00
Nikos Mavrogiannopoulos
3eb2b903ed worker: Prevent any frozen worker processes by killing them on inactivity 
That is, introduced an alarm() call at the worker periodic check, which will
only get triggered if a very long timeout has occurred without the loop being
completed.
 2016-01-11 13:55:12 +01:00
Nikos Mavrogiannopoulos
43d55261e6 main: introduced main-worker-cmd.c 2016-01-11 13:09:34 +01:00
Nikos Mavrogiannopoulos
e1dea8ae71 moved run_sec_mod() to main-sec-mod-cmd.c 2016-01-11 13:07:15 +01:00
Nikos Mavrogiannopoulos
3002645108 moved proc creation and deinitialization at main-proc.c 2016-01-11 13:05:55 +01:00
Nikos Mavrogiannopoulos
f2bd0a0ec7 released 0.11.0rc0 2016-01-08 13:39:16 +01:00
Nikos Mavrogiannopoulos
22a4ab8a9b worker: use the state buffer for HTTP requests 2016-01-07 13:24:15 +01:00
Nikos Mavrogiannopoulos
79cfacf0fe worker: enforce a default socket timeout for TCP and UDP sockets 
That is because, although we  use select() to see whether a call to
recv() would block, there are certain cases in Linux where recv() blocks
even though select() notified of available data. Reported by Yick Xie.
 2016-01-06 23:51:01 +01:00
Nikos Mavrogiannopoulos
5bb19cae39 don't attempt to open per_user_dir if it is NULL 
Nor attempt to close a NULL handle. This addresses a crash in certain libc's.
 2016-01-05 21:44:43 +01:00
Nikos Mavrogiannopoulos
1955394cfa When receiving from unix socket attempt to reconstruct the CSTP packets 
That is because it may happen that the sender sends a complete packet
into multiple chunks. Resolves #22
 2016-01-02 00:13:56 +02:00
Nikos Mavrogiannopoulos
bee0d57323 set_tun_mtu: print the mtu size on failed assignment 2016-01-01 23:35:25 +02:00
Nikos Mavrogiannopoulos
e4cedfb898 README-radius: added more text for Framed-Route format 2016-01-01 23:35:24 +02:00
Nikos Mavrogiannopoulos
0ad8a3a46a correctly print the IP of addresses added to ban list 2015-12-23 19:33:14 +02:00
Nikos Mavrogiannopoulos
34fa33ca15 README.md: added radcli dependency 2015-12-22 00:29:45 +02:00
Nikos Mavrogiannopoulos
ca5cae6f01 tests: use libradcli4 in debian builds 2015-12-22 00:27:30 +02:00
Nikos Mavrogiannopoulos
3e82a965a8 Prior to sending profile files, perform cookie authentication 
That allows to read the per-user config file, and prevent
a null pointer dereference. Reported by Yick Xie.
 2015-12-22 00:20:39 +02:00
Nikos Mavrogiannopoulos
97a49138e6 improved logged messages for certificate auth 2015-12-20 12:43:39 +02:00
Nikos Mavrogiannopoulos
7b086fb3f9 Don't print any cookie data unless debug level is set to be over 8 
That prevents adding into debugging logs sensitive data which can be used
to resume sessions.
 2015-12-18 11:22:49 +01:00
Nikos Mavrogiannopoulos
a52ffc4d06 When max-clients is set adjust the file descriptor limits accordingly 
This also increases the default number of descriptors to 4k.
 2015-12-08 16:31:30 +01:00