We were previously asking rc_aaa() to include NAS-Port pair to
the request which has undesirable results.
Resolves: #269
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
When IPv6 is requested by iphone we provide a special route that is
necessary by these clients to use IPv6.
Resolves: #254
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This fixes a regression which prevented DTLS-PSK (or PSK-NEGOTIATE)
from being negotiated.
Resolves: #262
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Export more information to the script, including client device platform,
type and user agent.
Resolves: #256
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
When a client re-uses a cookie and takes over a previous connection
previously the disconnect script of the old connection wouldn't receive
the IP information. Ensure that all information is provided to scripts
at this case.
Resolves: #231
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
When max-same-clients is set to 1 and a user re-using a cookie
connects, check_multiple_users() would prevent the user from
reconnecting. This corrects the issue by taking into account
only valid sessions that have not yet been disconnected.
Resolves: #223
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
This removes a trailing comma from the end of the listing, and
adds a missing one.
Resolves: #220
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
When a user explicitly disconnects after the session is open,
cleanup its entry immediatelly. That ensures that a radius
server will be notified sooner, while anyconnect clients which
disconnect early (before session is open), remain unaffected.
Resolves: #210
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
This ensures that libev will not be notified by already
terminated and handled scripts.
Resolves: #208
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
This ensures that the main process receives the TLS channel information
early and does not depend on DTLS channel establishment. Furthermore,
we refactor to make setup_dtls_psk_keys() fail early when no TLS channel
is available.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
This avoids a crash when no DTLS ciphersuite is selected and adds a
test case for negotiation without DTLS.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
This enables support for AES-256 for anyconnect clients which
do not support AES-GCM. Also prioritized the 256-bit ciphers
higher than the 128-bit ones.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
That addresses the issue of not being able to run under systemd,
or under non-forking mode. Added test case to detect proper
operation.
Resolves#154
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
In particular require gnutls 3.5.5 which fixes cleanups in
gnutls_certificate_set_key(), or a recent version of
the 3.3.x branch. When forced to use a broken version work-around
issues (at the cost of a memory leak).
Resolves#152
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
That adds a safety net in case there is a mismatch of IPs, to prevent
adding two entries in the hashtable for the same IP.
Resolves#146
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
