GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-14 02:22:03 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,815 Commits 38 Branches 91 Tags
d4a26b9fbe3cafa7848c06bf74b4978a33726f41
Commit Graph
176 Commits
Author SHA1 Message Date
Nikos Mavrogiannopoulos 120e49b26b only enable session control when a username/password authentication is used 2014-10-11 08:28:04 +02:00
Nikos Mavrogiannopoulos 3a455f4178 listen-file -> listen-clear-file 2014-09-28 09:06:14 +02:00
Nikos Mavrogiannopoulos e2585b2f26 unix-conn-file -> listen-file 2014-09-26 08:54:41 +02:00
Nikos Mavrogiannopoulos bdcd27d13e optional-certificate was renamed to certificate[optional] 2014-09-25 10:36:46 +02:00
Nikos Mavrogiannopoulos 365ca267d4 added new authentication mode optional-certificate 
That mode allows having only specific group of users that are required
to present a certificate.
 2014-09-24 12:41:31 +02:00
Nikos Mavrogiannopoulos 30bcf35576 Revert "license upgraded to GPLv3" 
This reverts commit 213f9a63ee.

Conflicts:
	configure.ac
 2014-09-24 11:34:15 +02:00
Nikos Mavrogiannopoulos b479659836 do not allow the combination of AUTH_TYPE_CERTIFICATE and unix-conn-file 2014-09-23 22:33:37 +02:00
Nikos Mavrogiannopoulos 4ea5a56ace Allow the CSTP layer to operate without TLS 
That also introduces a unix domain socket under which connections to the
server can occur.
 2014-09-23 16:08:29 +02:00
Nikos Mavrogiannopoulos 6de26b9408 made macro usage safer 
That solves an issue where the pid_file would be overwritten on
a configuration file reload.
 2014-07-26 10:59:26 +02:00
Nikos Mavrogiannopoulos 4117bf2661 Use a more terse, but with more dynamic information version string. 2014-06-23 21:09:43 +02:00
Nikos Mavrogiannopoulos 70623591d5 Seccomp is now compiled in by default, and can be enabled at run-time. 2014-06-12 15:35:45 +02:00
Nikos Mavrogiannopoulos 28dca2aa0c Added support for session control (relevant for PAM for now) 
That in effect will utilize the pam_open_session() and pam_close_session().
It is disabled by default as it requires more resources from the security module.
 2014-06-10 15:16:40 +02:00
Nikos Mavrogiannopoulos 25fbdfbf70 Keep track of cookies internally. 
That allows to restrict the cookie validity time to the absolutely minimum
required to establish and reconnect a recently disconnected session.
That deprecates the cookie-validity option and introduces the cookie-timeout
option.
 2014-05-27 16:00:57 +02:00
Nikos Mavrogiannopoulos b5d5e3cb36 do not deny roaming by default 2014-05-26 13:04:16 +02:00
Nikos Mavrogiannopoulos 7ba0fffb07 Added the configuration option deny-roaming. 
That required moving the read of the group configuration during the
cookie authentication phase.
 2014-05-25 10:17:28 +02:00
Nikos Mavrogiannopoulos 78132e2a6d Added auto group listing on PAM authentication as well. 
In addition a configuration option to print group IDs over a
certain number was added.
 2014-05-23 16:36:48 +02:00
Nikos Mavrogiannopoulos 213f9a63ee license upgraded to GPLv3 2014-05-23 11:50:56 +02:00
Nikos Mavrogiannopoulos 28943341db Added the proxy-url option to allow sending a proxy URL. 
This corresponds to the X-CSTP-MSIE-Proxy-Pac-URL CSTP header.
 2014-05-23 11:04:30 +02:00
Nikos Mavrogiannopoulos fbdcaa82ca Make pid-file an array to avoid issues with memory allocation. 2014-05-21 14:16:00 +02:00
Nikos Mavrogiannopoulos 177c1c95bd Allow aliases to group names. 2014-05-21 12:25:26 +02:00
Nikos Mavrogiannopoulos 2668fe63b4 Added the default-select-group directive. 2014-05-19 20:00:35 +02:00
Nikos MavrogiannopoulosandNikos Mavrogiannopoulos 4755ee48c5 Added the select-group and auto-select-group config options. 
These options allow to prompt the user for a group prior to login.
That in addition enhances the password file format and multiple groups
can be specified on a comma separated list, as:
user:group1,group2,group3:$5$encodedpassword
 2014-05-19 18:25:25 +02:00
Nikos Mavrogiannopoulos 6bc625df81 The route configuration directive accepts the keyword 'default' 
In that case it will return a default route irrespective of any other
route directives. That allows overriding existing routes with a default
route for specific users and groups.
 2014-05-19 09:58:37 +02:00
Nikos Mavrogiannopoulos 739a2126d0 Clean-up all memory on deinitialization of sec-mod and worker. 
That will allow to easier spot any unintentional memory leaks.
 2014-05-15 15:36:03 +02:00
Nikos Mavrogiannopoulos 788560b9ce Added default-user-config and default-group-config configuration options. 
These allow setting a configuration file that will be loaded if a
user-specific or group-specific configuration file isn't found.
 2014-05-14 13:27:51 +02:00
Nikos Mavrogiannopoulos 3f9a215f53 Allow for random and for predictable IP assignment. 2014-05-14 13:00:11 +02:00
Nikos Mavrogiannopoulos 522a9c35a4 Allow modifying the default occtl socket file. 2014-05-11 14:16:38 +02:00
Nikos Mavrogiannopoulos fe150f8ab3 better interplay between use-dbus and use-occtl. 2014-05-09 16:38:28 +02:00
Nikos Mavrogiannopoulos 969e684960 Use talloc() for all allocations to reduce the possibility of memory leaks. 2014-05-09 16:13:11 +02:00
Nikos Mavrogiannopoulos b0e10065a0 Support for the unix socket is now configurable. 2014-05-09 16:12:37 +02:00
Nikos Mavrogiannopoulos 71104b36a3 Added support for unix sockets for the occtl communication. 
D-BUS support is left, but is not enabled by default.
 2014-05-07 13:54:58 +02:00
Nikos Mavrogiannopoulos 20cc945383 Warn when setting a default route the wrong way. 2014-03-01 14:23:22 +01:00
Nikos Mavrogiannopoulos 95a0b6abc3 Added the rekey-method config option. 2014-02-22 12:51:34 +01:00
Nikos Mavrogiannopoulos 7b73aee479 when mobile-dpd and mobile-idle-timeout are not set, they get values from their non-mobile counterpart. 2014-02-18 19:39:37 +01:00
Nikos Mavrogiannopoulos 6ee0899e22 Added the mobile-idle-timeout config option. 2014-02-18 18:54:50 +01:00
Nikos Mavrogiannopoulos 367976ca34 Implemented Idle timeout. 
When set, a client that does not have any non-control traffic
for that period is getting disconnected.
 2014-02-18 18:09:23 +01:00
Nikos Mavrogiannopoulos c5c38e92bd Do not allow DPD to be disabled. 
Doing so would prevent the server from dropping inactive
connections. If the dpd values are not configured, set some
reasonable defaults.
 2014-02-17 22:40:32 +01:00
Nikos Mavrogiannopoulos 2bd6f5a6a1 Added the mobile-dpd configuration option. 
This option allows setting a different DPD value for
mobile clients to allow them going to sleep for longer time.
 2014-02-17 22:17:09 +01:00
Nikos Mavrogiannopoulos be332174f8 Simplified debugging by allowing multiple levels. 
'ocserv -d' now accepts a numeric option from 0 (no debugging) to 9
(maximum verbosity).
 2014-02-17 20:19:39 +01:00
Nikos Mavrogiannopoulos 0faee9fbbf print errors when an invalid IPv6 prefix is found. 2014-02-15 15:16:19 +01:00
Nikos Mavrogiannopoulos 3b9971b7e8 Added support for the "new" type of IP6 support in AnyConnect. 
If the client sends "X-CSTP-Full-IPv6-Capability: true", then we
use the headers:
     X-CSTP-Address-IP6: 2001:db8:1000:1000::1/64
     X-CSTP-Split-Include-IP6: 2001:db8:1000:1001::/64
     X-CSTP-Split-Include-IP6: 2001:db8:1000:1002::/64

(see corresponding openconnect change)
 2014-02-15 13:51:03 +01:00
Nikos Mavrogiannopoulos f8f30bffa4 set a reasonable default rekey time 2014-02-12 11:07:14 +01:00
Nikos Mavrogiannopoulos c92925e727 Rekey time is now configurable and can be disabled. 2014-02-11 15:47:20 +01:00
Nikos Mavrogiannopoulos 638228e284 Use brackets in DEL macro 2014-02-05 09:56:06 +01:00
Nikos Mavrogiannopoulos 91ceefb1f3 Added the split-dns config option. 2014-02-01 18:59:50 +01:00
Nikos Mavrogiannopoulos 311d5ddd20 Added configuration option to send custom headers to client. 2014-02-01 18:55:27 +01:00
Nikos Mavrogiannopoulos 0ec67882c0 Added support for multiple DNS and NBNS servers. 
This patch also combines ipv4-dns and ipv6-dns options
that are now handled as aliases to dns.

A side-effect of this patch is that the local keyword is no
longer supported.
 2014-02-01 14:50:52 +01:00
Nikos Mavrogiannopoulos ea02f38a04 if the loading of default config in the new location fails, try the old default file. 2014-02-01 09:24:52 +01:00
Nikos Mavrogiannopoulos 28e5d62f3f The worker process receives the client's IPs from the main process. 
That eliminates the need to read the IP address from the tun device
(which can be quite tricky to implement in a clean portable way).
 2014-01-31 20:53:45 +01:00
Nikos Mavrogiannopoulos 2254ba554b Set a default password file if one is not specified in ocpasswd. 2014-01-30 19:12:02 +01:00