ocserv

GitLab/ocserv

Fork 0

mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-10-07 23:02:05 +08:00

Commit Graph

Select branches

Hide Pull Requests

coverity

feature_PAM_Framed-IP-Address

master

ocserv_0_10_x

ocserv_0_11_x

ocserv_0_2_x

ocserv_0_3_x

ocserv_0_8_x

ocserv_0_9_x

set-dependency-scanning-config-1

set-sast-config-1

tmp-INTEGER_OVERFLOW

tmp-abnormal-exit-fix

tmp-cgroups-v2

tmp-crypt

tmp-disable-tests

tmp-fix-249

tmp-fix-744

tmp-fix-745

tmp-fix-pam-guard-check

tmp-fix-tls13

tmp-freebsd

tmp-hardening

tmp-icmp-ping

tmp-improve-ip-net-allocation

tmp-include2

tmp-ip_route_sanity_check

tmp-meson

tmp-ocpasswd

tmp-remove-auto-generated

tmp-requirements-first

tmp-simplify-radius

tmp-test-581

tmp-test-simplification

tmp-triage-policies-update

tmp-typedef-struct

tmp-user-scripts

0.12.6

1.0.0

1.0.1

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.4.0

1.4.1

1.4.2

1.5.0

ocserv_0_0_1

ocserv_0_0_2

ocserv_0_10_0

ocserv_0_10_1

ocserv_0_10_10

ocserv_0_10_11

ocserv_0_10_12

ocserv_0_10_2

ocserv_0_10_3

ocserv_0_10_4

ocserv_0_10_5

ocserv_0_10_6

ocserv_0_10_7

ocserv_0_10_8

ocserv_0_10_9

ocserv_0_11_0

ocserv_0_11_1

ocserv_0_11_10

ocserv_0_11_11

ocserv_0_11_12

ocserv_0_11_2

ocserv_0_11_3

ocserv_0_11_4

ocserv_0_11_5

ocserv_0_11_6

ocserv_0_11_7

ocserv_0_11_8

ocserv_0_11_9

ocserv_0_12_0

ocserv_0_12_1

ocserv_0_12_2

ocserv_0_12_3

ocserv_0_12_4

ocserv_0_12_5

ocserv_0_12_6

ocserv_0_1_0

ocserv_0_1_1

ocserv_0_1_2

ocserv_0_1_3

ocserv_0_1_4

ocserv_0_1_5

ocserv_0_1_6

ocserv_0_1_7

ocserv_0_2_0

ocserv_0_2_1

ocserv_0_2_2

ocserv_0_2_3

ocserv_0_2_4

ocserv_0_3_0

ocserv_0_3_1

ocserv_0_3_2

ocserv_0_3_3

ocserv_0_3_4

ocserv_0_3_5

ocserv_0_3_6

ocserv_0_8_0

ocserv_0_8_1

ocserv_0_8_2

ocserv_0_8_3

ocserv_0_8_4

ocserv_0_8_5

ocserv_0_8_5_1

ocserv_0_8_6

ocserv_0_8_7

ocserv_0_8_8

ocserv_0_8_9

ocserv_0_9_0

ocserv_0_9_0_1

ocserv_0_9_1

ocserv_0_9_2

b6501f6661 Merge branch 'tmp-lease' into 'master' master Nikos Mavrogiannopoulos 2026-10-01 18:02:06 +00:00
67ae4d3ace tests: add test-ipv6-p2p for the server-side IPv6 address Nikos Mavrogiannopoulos 2026-09-27 06:39:35 +02:00
3206e11665 Use network address as IPv6 lease start Dimitri PapadopoulosandNikos Mavrogiannopoulos 2026-05-09 13:43:24 +02:00
7fc0fb77c0 requirements: the server-side IPv6 tunnel address is the network address Nikos Mavrogiannopoulos 2026-09-27 06:39:35 +02:00
51a2d887ae tests: fix the command variable names documented in ns.sh Dimitri PapadopoulosandNikos Mavrogiannopoulos 2026-05-09 13:43:24 +02:00
0d3b4e82ed tests: keep the vpnc-script default route file per test run tmp-improve-ip-net-allocation Nikos Mavrogiannopoulos 2026-09-29 21:28:47 +02:00
8cb3c26dfb tests: detect network collisions from the routing table instead of ping Nikos Mavrogiannopoulos 2026-09-29 18:51:54 +02:00
d284915a77 tests: make test-iroute actually check the applied iroute Nikos Mavrogiannopoulos 2026-09-27 19:04:47 +02:00
2d240e02d3 tests: use generated networks and lint hard-coded addresses Nikos Mavrogiannopoulos 2026-09-27 19:04:47 +02:00
1e06cd36e0 tests: radius: use ping instead of iperf3 for the traffic step Nikos Mavrogiannopoulos 2026-09-27 19:04:47 +02:00
7554fe920d tests: require generated VPN networks and make random-net.sh easy to use Nikos Mavrogiannopoulos 2026-09-27 11:13:49 +02:00
979a1d5d99 Merge branch 'tmp-lease-ipv4' into 'master' Nikos Mavrogiannopoulos 2026-09-27 05:02:33 +00:00
e6a8b6df07 ip-lease: factor the /31 netmask check into is_ipv4_p2p_mask() Nikos Mavrogiannopoulos 2026-09-27 00:03:22 +02:00
c588aa23f4 tests: add requirements and test for IPv4 /31 point-to-point leases Nikos Mavrogiannopoulos 2026-09-26 23:55:39 +02:00
cdaf2e2904 Special case for IPv4 point-to-point /31 networks Dimitri PapadopoulosandNikos Mavrogiannopoulos 2026-05-09 14:08:37 +02:00
b04e591b4c requirements: fix REQ-CONFIG-INIT-003 error-path citation; add NEWS entry Nikos Mavrogiannopoulos 2026-09-26 23:26:33 +02:00
ad9d727ceb config: do not silently truncate long [vhost:NAME] names Katie HandNikos Mavrogiannopoulos 2026-09-06 15:47:28 +00:00
d651c68eff Erase the PAM password buffer after each conversation round and scrub both fixed credential buffers before releasing the PAM handle. Alex ProtskoandNikos Mavrogiannopoulos 2026-09-26 22:55:17 +02:00
6f58414656 radius: standardize on radcli library tmp-simplify-radius Nikos Mavrogiannopoulos 2026-09-20 12:05:37 +02:00
73e5c15470 agents: updated promptkit protocols and requirements Nikos Mavrogiannopoulos 2026-09-20 14:27:15 +02:00
f16daa89ef ocserv-core-dev: improved review protocol Nikos Mavrogiannopoulos 2026-09-20 13:27:05 +02:00
15bda6856d requirements: document the existing testing requirement Nikos Mavrogiannopoulos 2026-09-19 19:50:21 +02:00
9e1e983437 requirements: prevent fragile tests from being created or merged Nikos Mavrogiannopoulos 2026-09-19 19:34:22 +02:00
d87625ecb6 doc update Nikos Mavrogiannopoulos 2026-09-19 06:47:50 +02:00
df2302859f REQ-GEN-STYLE-003: removed Nikos Mavrogiannopoulos 2026-09-19 06:45:11 +02:00
4a3ef2bf5d Merge branch 'mr589-graceful-shutdown' into 'master' Nikos Mavrogiannopoulos 2026-09-19 04:42:41 +00:00
b34ce2c7e7 sec-mod: send accounting stop on server shutdown Alex Protsko 2026-09-18 20:14:03 +03:00
f433b0e8fb ocserv.8: include sample.config again tmp-user-scripts Nikos Mavrogiannopoulos 2026-09-13 21:49:29 +02:00
46cd42a465 sample.config: documented no ordering guarantee of scripts Nikos Mavrogiannopoulos 2026-09-13 21:42:40 +02:00
4577a2a6ba README.md: explicitly call out ipcalc Nikos Mavrogiannopoulos 2026-09-13 18:43:37 +02:00
0f72ed3f21 meson: added option to disable the building of tests tmp-disable-tests Nikos Mavrogiannopoulos 2026-09-13 17:51:31 +02:00
1355717a7d requirements: updated requirement for modifying vendored code Nikos Mavrogiannopoulos 2026-09-02 19:28:27 +02:00
96a4baf9f9 certificate validation: do not use LOG_ERR when logging a missing optional certificate tmp-fix-744 Nikos Mavrogiannopoulos 2026-08-13 21:47:51 +02:00
143abadd27 tests: aligned the PAM launcher variants to use the simpler approach tmp-test-simplification Nikos Mavrogiannopoulos 2026-08-14 07:27:57 +02:00
cf598075de tests: simplified by reducing unnecessary launch functions Nikos Mavrogiannopoulos 2026-08-14 07:20:46 +02:00
77a3208f99 Fixed regression with CISCO Anyconnect clients and TLS 1.3 tmp-fix-745 Nikos Mavrogiannopoulos 2026-08-05 09:03:22 +02:00
9ed4342153 sec-mod: prevent malicious clients from piling up client_entry_st per pid tmp-fix-249 Nikos Mavrogiannopoulos 2026-08-02 22:27:04 +02:00
be6b5deea0 proc_to_zombie: removed dead definition Nikos Mavrogiannopoulos 2026-08-02 17:26:34 +02:00
2315b91894 ocserv.8.md: corrected SYNOPSIS Nikos Mavrogiannopoulos 2026-07-29 10:42:35 +02:00
1002c6fce7 README.md: document that this is only about Intune VPN Nikos Mavrogiannopoulos 2026-07-29 08:24:15 +02:00
77e06aec8a sec-mod, worker: harden TLS resumption cache against empty session data tmp-fix-tls13 Nikos Mavrogiannopoulos 2026-07-28 07:47:41 +02:00
9e71c1b8b6 worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions Nikos Mavrogiannopoulos 2026-07-19 21:53:44 +02:00
76987ccb82 tlslib, worker: remove dead code orphaned by the listen-clear-file removal tmp-hardening Nikos Mavrogiannopoulos 2026-07-16 11:19:07 +02:00
879f723953 tlslib: harden recv_remaining() against truncated CSTP reads Nikos Mavrogiannopoulos 2026-07-16 08:56:38 +02:00
d79eda6013 ip-util: reject routes with characters outside address/prefix syntax Nikos Mavrogiannopoulos 2026-07-12 19:40:46 +02:00
5a9cddf606 main: validate AUTH_COOKIE_REQ cookie length before use Nikos Mavrogiannopoulos 2026-07-12 19:40:34 +02:00
cdc9a5b5f4 Merge branch 'mr588-worker-seccomp-musl' into 'master' Nikos Mavrogiannopoulos 2026-07-28 05:52:58 +00:00
b931112cb2 worker-privs: allow munmap/mremap/madvise for isolated workers Alex Protsko 2026-07-09 11:19:24 +03:00
dde0a16df2 Merge branch 'tmp-coverity' into 'master' Nikos Mavrogiannopoulos 2026-07-16 06:38:24 +00:00
df086188d7 radius: send the session ID as Acct-Session-Id in the Access-Request DmitriiandNikos Mavrogiannopoulos 2026-07-14 19:28:01 +03:00
5d79d98c37 Apply patch provided by maitainer tmp-icmp-ping Dimitri Papadopoulos 2026-07-12 21:33:46 +02:00
e41d351d02 Align ping implementation with current BusyBox sources Dimitri Papadopoulos 2026-06-25 17:14:22 +02:00
20ee8183a3 Fix Coverity Scan defect Dimitri Papadopoulos 2026-07-12 20:47:44 +02:00
9172e33f46 Functions return ssize_t Dimitri Papadopoulos 2026-07-12 20:26:00 +02:00
6d4f96aa72 doc update Nikos Mavrogiannopoulos 2026-07-12 18:10:23 +02:00
dbcbb1deb7 Add a local version of crypt_gensalt() tmp-crypt Dimitri Papadopoulos 2026-06-14 17:39:41 +02:00
8c49bf9df3 Hash passwords using the system default algorithm Dimitri Papadopoulos 2026-05-03 16:32:01 +02:00
26e76f9618 doc/requirements: align REQ-IPC-032 and REQ-AUTH-ACCT-002, add REQ-AUTH-ACCT-007 tmp-test-581 Nikos Mavrogiannopoulos 2026-07-12 10:45:06 +02:00
5a50aecedc Fix inflated RADIUS Acct-Session-Time across reconnects Alex ProtskoandNikos Mavrogiannopoulos 2026-07-12 10:43:38 +02:00
96aa1f5ae7 tests: add reproducer for inflated RADIUS Acct-Session-Time across reconnects Nikos Mavrogiannopoulos 2026-07-12 10:41:17 +02:00
0f7abd33ca auto-select group when a certificate provides enough information Nikos Mavrogiannopoulos 2026-06-14 17:30:56 +02:00
7e8ce7078f Merge branch 'tmp-wget' into 'master' Dimitri Papadopoulos Orfanos 2026-07-09 10:16:51 +03:00
2f943ea324 Validation of IPv4 and IPv6 addresses tmp-ip_route_sanity_check Dimitri Papadopoulos 2026-06-26 13:52:39 +02:00
efc9ac508d Suppress Coverity Scan false positive tmp-INTEGER_OVERFLOW Dimitri Papadopoulos 2026-06-24 11:00:26 +02:00
915f819009 ci: wget → curl Dimitri Papadopoulos 2026-06-25 13:15:06 +02:00
c7702799a1 Address Coverity Scan defect Dimitri Papadopoulos 2026-06-24 09:26:15 +02:00
5953319ef4 Suppress Coverity Scan false positives Dimitri Papadopoulos 2026-06-23 14:43:09 +02:00
f3f74de305 tests: do not store environment information Nikos Mavrogiannopoulos 2026-06-17 06:17:03 +02:00
a53e6d4e25 .gitlab-ci.yml: do not store .tmp files as artifacts Nikos Mavrogiannopoulos 2026-06-17 06:16:37 +02:00
bfe0d9ffd0 requirements: add REQ-CONFIG-SEC-002 for sup-config path-traversal hardening Nikos Mavrogiannopoulos 2026-06-14 22:10:27 +02:00
5c57855e5c sup-config/file: reject path-traversal in username/groupname Nikos Mavrogiannopoulos 2026-06-14 22:10:36 +02:00
5c0d4237f1 config: warn about select-group entries that exceed MAX_GROUPNAME_SIZE Nikos Mavrogiannopoulos 2026-06-14 18:17:46 +02:00
7fe325de46 ocserv-core-dev agent: validate requirements explicitly Nikos Mavrogiannopoulos 2026-06-17 06:02:56 +02:00
bda207237a requirements: enhanced with general implementation requirements Nikos Mavrogiannopoulos 2026-06-17 05:34:56 +02:00
aa7cf56150 Consistently typedef ..._st structures tmp-typedef-struct Nikos MavrogiannopoulosandDimitri Papadopoulos 2026-06-06 12:16:11 +02:00
32713999ed radius_vhost_ctx → radius_vhost_ctx_st Dimitri Papadopoulos 2026-06-06 15:08:13 +02:00
cfb0e0a2b2 main: improved reporting of errors by main Nikos Mavrogiannopoulos 2026-06-15 21:36:53 +02:00
47a1cd595c main: improved reporting of errors by main tmp-abnormal-exit-fix Nikos Mavrogiannopoulos 2026-06-15 21:36:53 +02:00
a3ac48c2d4 Move to a requirements-first approach Nikos Mavrogiannopoulos 2026-06-13 08:28:47 +02:00
8e8efd33a6 ai: added security-auditor persona Nikos Mavrogiannopoulos 2026-06-13 12:59:23 +02:00
4f187578c3 .gitignore/doc: removed legacy files Nikos Mavrogiannopoulos 2026-06-12 19:02:04 +02:00
ea253803e7 Merge branch 'tmp-make' into 'master' Nikos Mavrogiannopoulos 2026-06-14 13:26:20 +00:00
196350abc1 CONTRIBUTING.md: do not reference make Dimitri Papadopoulos 2026-06-14 13:59:06 +02:00
b91735f49f Reorder and reduce #include directives tmp-include2 Dimitri Papadopoulos 2026-06-06 12:56:34 +02:00
6a9b34d3c8 Move to a requirements-first approach [ci skip] tmp-requirements-first Nikos Mavrogiannopoulos 2026-06-13 08:28:47 +02:00
fa0a7db1cd Merge branch 'tmp-include' into 'master' Dimitri Papadopoulos Orfanos 2026-06-14 09:35:13 +03:00
ec6c42ea1e ai: added security-auditor persona Nikos Mavrogiannopoulos 2026-06-13 12:59:23 +02:00
80ce55ae8f Merge branch 'tmp-CID-646042' into 'master' Nikos Mavrogiannopoulos 2026-06-13 05:45:25 +00:00
3fbeca3aec .gitignore/doc: removed legacy files Nikos Mavrogiannopoulos 2026-06-12 19:02:04 +02:00
29dd18ddc5 tests: add SIGKILL fallback in cleanup_client_server Nikos Mavrogiannopoulos 2026-06-06 15:30:47 +02:00
eeef24e520 tests: do not skip if /usr/sbin/ip is missing Nikos Mavrogiannopoulos 2026-06-06 15:20:44 +02:00
826fe0ff30 tests: attempt to fix disconnect-user race that caused 300 s timeouts Nikos Mavrogiannopoulos 2026-06-06 13:01:19 +02:00
3f4a1f0e68 tests: reduce parallelization in asan Nikos Mavrogiannopoulos 2026-06-06 12:22:48 +02:00
6d778ebadb tests: pam-stack-guard: guard against tail optimizations of gcc Nikos Mavrogiannopoulos 2026-06-10 20:08:44 +02:00
423eab1b84 tests: pam-stack-guard: guard against tail optimizations of gcc tmp-fix-pam-guard-check Nikos Mavrogiannopoulos 2026-06-10 20:08:44 +02:00
c4fdd29a45 Suppress Coverity Scan false positive Dimitri Papadopoulos 2026-05-12 13:21:06 +02:00
49f9956eee release.sh: do not reference make 1.5.0 Nikos Mavrogiannopoulos 2026-06-07 08:34:22 +02:00
a4a8126c7b doc update Nikos Mavrogiannopoulos 2026-06-07 08:30:26 +02:00
b7a73b968d parse_data(): ensure sanity checks for safety Nikos Mavrogiannopoulos 2026-05-19 22:01:24 +02:00
9866624118 tun_write(): check input value for sanity Nikos Mavrogiannopoulos 2026-05-19 22:00:57 +02:00

1 2 3 4 5 ...