Currently the code sets the local interface IP to the same value as the
P-t-P IP:
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.63.1 P-t-P:192.168.63.1 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1341 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
This doesn't seem to get things routed correctly. e.g. pinging 192.168.63.1
from the ocserv gateway just loops traffic back to the local machine instead
of pinging the client.
So instead we'll set LIP = RIP + 1. This isn't terribly intuitive (an
administrator might try to number consecutive users 192.168.1.1, 192.168.1.2,
192.168.1.3, ...) but it's better than the current situation. Maybe at some
point, fixed IPs should also make use of the hash table.
This fixes:
main.c: In function ‘main’:
main.c:1025:8: warning: ignoring return value of ‘chdir’, declared with attribute warn_unused_result [-Wunused-result]
chdir(s->config->chroot_dir);
^
sec-mod.h now uses gnutls_privkey_t, so include <gnutls/abstract.h> to
fix this error:
CC main-misc.o
In file included from main-misc.c:43:0:
./sec-mod.h:31:2: error: unknown type name ‘gnutls_privkey_t’
gnutls_privkey_t *key;
^
Populate the 0-byte /1/Darwin_i386 file to prevent the following error:
The AnyConnect package on the secure gateway could not be located.
You may be experiencing network connectivity issues. Please try
connecting again.
Tested with AnyConnect 3.1.03103.
If /1/<OS> exists for every valid OS, then the client will never even try
to request /2/binaries/update.txt. Instead, it will request
/1/binaries/update.txt, and then get very confused when the response
looks like an XML document instead of a version string.
max-same-clients is used to limit the number of outstanding sessions
(cookies). If set to 0, it means an unlimited number of active cookies
can be owned by each user. But it doesn't mean that the same cookie
can be reused for multiple CSTP connections with different IPs, as
the protocol does not normally work this way.
