GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-14 02:22:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,815 Commits 38 Branches 91 Tags
d4a26b9fbe3cafa7848c06bf74b4978a33726f41
Commit Graph
176 Commits
Author SHA1 Message Date
Nikos Mavrogiannopoulos d4a26b9fbe clear_cfg_file() -> clear_cfg() 2015-03-02 13:18:58 +01:00
Nikos Mavrogiannopoulos cc16a65819 separated permanent configuration options from the reloaded ones 2015-03-02 13:18:52 +01:00
Nikos Mavrogiannopoulos 17dbc5a29f config: print the primary authentication method only once 2015-02-27 13:52:18 +01:00
Nikos Mavrogiannopoulos 15f0733f7d PAM accounting is only included when PAM is enabled 2015-02-26 20:40:29 +01:00
Nikos Mavrogiannopoulos 445ea63783 made the ban points configurable 2015-02-26 11:23:06 +01:00
Nikos Mavrogiannopoulos 7619895a25 removed server-name config option 2015-02-26 11:00:07 +01:00
Nikos Mavrogiannopoulos a617485232 enforce of IP banning was moved to main 2015-02-25 13:16:56 +01:00
Nikos Mavrogiannopoulos 43f3807e3b prevent accounting methods from switching on reload 2015-02-25 09:31:17 +01:00
Nikos Mavrogiannopoulos 29e834da4d plain authentication uses the new parsing method 2015-02-24 13:53:37 +01:00
Nikos Mavrogiannopoulos c5bba80854 pam uses the new sub-config format 2015-02-24 13:39:46 +01:00
Nikos Mavrogiannopoulos 43caa1be14 radius will use the new sub-config format 2015-02-24 13:04:28 +01:00
Nikos Mavrogiannopoulos e16ae6614c Added more advanced suboption parser 
That adds the ability to parse options in the form:
auth = "gssapi[option1=value1,option2=value2,...]
It also introduces the keytab, and require-local-user-map
suboptions for gssapi.
 2015-02-24 11:50:55 +01:00
Nikos Mavrogiannopoulos 40e96aae45 Separated accounting from authentication. 2015-02-23 15:19:44 +01:00
Nikos Mavrogiannopoulos 9682a0f635 when combining multiple auth methods as primary, combine the name as well 2015-02-22 10:31:55 +01:00
Nikos Mavrogiannopoulos c1a6f4730b Added the configure option server-name 
If set it will be used to set the NAS_IDENTIFIER in radius.
 2015-02-21 08:20:16 +01:00
Nikos Mavrogiannopoulos d7b4a28325 radius: fixed config string parsing 2015-02-19 17:38:19 +01:00
Nikos Mavrogiannopoulos 9a3be087b4 kkdcp: allow the handling of multiple realms per URL 2015-02-19 15:27:55 +01:00
Nikos Mavrogiannopoulos f591cb0181 sanitized strcmp check 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 773d277802 kkdcp: perform the proper encoding and decoding on exchanged data 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 6334bada15 renamed urlfw to kkdcp 2015-02-19 11:47:20 +01:00
Nikos MavrogiannopoulosandNikos Mavrogiannopoulos b300177eb7 Added max-password-retries config option 
That makes the number of retries prior to banning the IP
configurable.
 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos c0ceeba0f8 Fail if authentication modules are changed on reload 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 01ec22db27 Allow setting content-type urlfw, and allow tcp 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 494738dd55 Added url-fw config option 
That allows to specify a class of URLs where, if a client
POSTS to it, the data will be forwarded to the configured server,
and the client will receive its reply.
 2015-02-19 11:47:20 +01:00
Nikos MavrogiannopoulosandNikos Mavrogiannopoulos afef74fa23 removed the certificate[optional] auth type 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 8bb0af61bc Added GSSAPI as an additional password auth mechanism 
That also adds the ability to support an OR composition of multiple
authentication methods. That is using the 'enable-auth' config option.
 2015-02-19 11:47:20 +01:00
Nikos Mavrogiannopoulos 23586bdb9c no longer document the auth option certificate[optional] 2015-02-12 21:08:41 +01:00
Kevin CernekeeandNikos Mavrogiannopoulos 25cfd3b1db config: Use talloc_free() to free "route" strings 
Adding redundant routes triggers a glibc assertion on startup.  The offending
config file contained:

    route = 192.168.1.0/255.255.255.0
    route = default

The assertion:

    # ./src/ocserv -c ocserv.conf -f
    *** Error in `./src/ocserv': munmap_chunk(): invalid pointer: 0x0000000001703470 ***
    Aborted (core dumped)

Fix this by calling the correct free() function.
 2015-02-09 15:06:57 +01:00
Nikos Mavrogiannopoulos bcea928abe Added support for no-routes (X-Split-Exclude) 2015-02-06 14:05:10 +01:00
Nikos Mavrogiannopoulos 2a25795170 corrected isolate-workers typo 2015-01-20 10:40:09 +01:00
Nikos Mavrogiannopoulos 04a9381068 Compression is disabled by default 2015-01-16 10:45:53 +01:00
Nikos Mavrogiannopoulos 048b25ba45 Made the no-compress-limit configurable 2015-01-15 18:31:33 +01:00
Nikos Mavrogiannopoulos 27168673f0 added option to disable compression 2015-01-15 16:42:29 +01:00
Nikos Mavrogiannopoulos 831abcb76d corrected typo 2015-01-15 16:34:58 +01:00
Nikos Mavrogiannopoulos fe848ad153 replaced use-seccomp by isolate-workers 
That, if enabled, includes the Linux namespaces restrictions into workers.
 2015-01-15 10:25:23 +01:00
Nikos Mavrogiannopoulos 7a51462abd reorganized to avoid compiler warnings 2015-01-15 09:59:38 +01:00
Nikos Mavrogiannopoulos 4dee583e29 In linux run the server in it's own container with separate IPC and PID namespace 2015-01-14 17:08:01 +01:00
Nikos Mavrogiannopoulos a1abcdbeae Allow prefixes in specifying the IPv4 network 2014-12-30 17:22:02 +02:00
Nikos Mavrogiannopoulos 50f2fb88f6 simplify the input of IPv6 networks 
The prefix is specified as part of the network.
 2014-12-29 20:15:36 +02:00
Nikos Mavrogiannopoulos 27b9e91eb8 bail out if use-seccomp is set to true but there is no seccomp capability 2014-12-29 14:22:45 +02:00
Nikos Mavrogiannopoulos 07e01d06b5 use strlcpy() instead of snprintf() where it make sense 
That should reduce wasted cycles.
 2014-12-14 19:24:14 +01:00
Nikos Mavrogiannopoulos b18eeb7d74 first set amod and then use it 
That fixes a crash with PAM module on startup.
Reported by Ismail Donmez.
 2014-12-11 11:58:23 +01:00
Nikos Mavrogiannopoulos 065753bd57 undid ed5b177691 
It is not currently possible to reload only a part of the
configuration. If the back-end module changes, the server will
bail out instead.
 2014-12-10 15:28:14 +01:00
Nikos Mavrogiannopoulos 35e93c6341 added option to send statistics periodically to sec-mod 2014-12-10 11:18:23 +01:00
Nikos Mavrogiannopoulos ed5b177691 authentication information is only read on load 2014-12-10 08:56:23 +01:00
Nikos Mavrogiannopoulos 766afb591a Added support for reading user configuration from radius. 2014-12-09 15:38:27 +01:00
Nikos Mavrogiannopoulos 2194e11b39 Added support for radius authentication 2014-12-09 10:59:18 +01:00
Nikos Mavrogiannopoulos baa3e4701e Supplementary configuration is now read by the security module. 
That allows sec-mod to handle both authentication and accounting.
That deprecates the session-control configuration option.
 2014-12-08 13:52:28 +01:00
Nikos Mavrogiannopoulos 8365449e9b deprecated ipv6_netmask 2014-12-08 10:48:25 +01:00
Nikos Mavrogiannopoulos cb9dcde387 Notify the client that the server may have a dynamic DNS address 
That is send "X-CSTP-DynDNS: true", in CSTP headers if the
server is configured as having a dynamic DNS address.
 2014-11-30 11:30:08 +01:00