This helps circumvent the 253 characters limit of RADIUS string values.
We distinguish between value strings that start with "OU=" and the rest:
* Value strings that start with "OU=" define multiple groups in a single
AVP. Here, we update the previous logic by taking into account all the
AVPs. We emit a warning when discarding subsequent AVPs, but also when
discarding groups within the current AVP because we have reached the
maximum number of groups.
* Other value strings define a single group. Here, we change the
previous logic. We append to the list of groups instead of silently
discarding subsequent value strings.
We emit a warning when discarding AVPs because we have reached the
maximum number of groups.
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
We have added open() unconditionally, to be able to open system priority
and FIPS complicance configuration files from workers.
We had already added openat() unconditionally.
Therefore there is no need to re-add them to read XML config files.
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
Required on some version of Suse with GnuTLS 3.7.3, reportedly to open
system priority and FIPS compliance configuration files:
/etc/crypto-policies/back-ends/gnutls.config
/proc/sys/crypto/fips_enabled
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
Supporting gnulib brought a whole class of problems due to its complexity.
Removing its support eliminates this class of problems and simplifies the
code significantly.
This sets the locale explicitly on server startup to eliminate the
need for custom string comparison functions.
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This adds a "camouflage" functionality (looking and acting like an ordinary web server),
to prevent OCserv installations from being automatically scanned or blocked with active probing techniques.
Signed-off-by: Kirill Ovchinnikov <kirill.ovchinn@gmail.com>
Make clear hex.c and hex.h are vendored files from CCAN:
https://github.com/rustyrussell/ccan
At the same time, update to commit ba79e21 committed on 9 January 2023,
for consistency with the rest of CCAN vendored files.
Additionally, by including <ccan/str/hex/hex.h> instead of "hex.h",
this fixes my Ubuntu 22.04 build, where including "hex.h" would include
the system Kerberos file /usr/include/heimdal/hex.h instead of
our local CCAN file hex.h.
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
This option was almost impossible to use in general and worked with
very few clients only (not including openconnect). That also meant that
it could not be tested. Removed to reduce maintenance to parameters
that are used in practice.
Resolves: #376
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This also removes the stop on first error directive
which was set but not used for very long time.
Resolves: #364
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This ignores any items following the first group class attribute.
Resolves: #332
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Previously when we were disconnecting a user there were few seconds
after which the cookie was still valid, so a reconnect would succeed
by the same user. This change ensures that a disconnected (via occtl)
user cannot re-use the same cookie to connect. That enables a safe
user removal from the authentication database, and from run-time.
Resolves: #59
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
