GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-08 01:11:49 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
ocserv/tests
T
History
Nikos Mavrogiannopoulos 9e71c1b8b6 worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions 
TLS 1.3 has no renegotiation and provides transparent rekeys but this
was not used by the server. Instead rekey-method=ssl was silently
downgraded to new-tunnel, causing a full tunnel/TUN-device rebuild (and
a brief data-path interruption) on every rekey whenever a client
negotiated TLS 1.3.

This commit simplifies that handling by taking advantage of TLS 1.3's own
rekey mechanism instead: the server now performs the "ssl" rekey on
TLS 1.3 sessions via the standard TLS 1.3 KeyUpdate message.

TLS <= 1.2 rekey behavior (client-driven rehandshake, gated on RFC
5746 safe renegotiation) is unchanged.

Resolves: #745

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-07-28 08:07:07 +02:00
..
certs
auto-select group when a certificate provides enough information
2026-07-12 10:15:11 +02:00
data
worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions
2026-07-28 08:07:07 +02:00
scripts
tests: which → command -v
2026-05-31 14:17:33 +02:00
user-config
Respect tunnel-all-dns in per-user/group config
2026-04-26 21:05:06 -04:00
user-config-explicit
test-explicit-ip: corrected the illegal IP address
2021-10-31 22:26:25 +01:00
user-config-opt
Remove spaces
2022-11-28 11:22:33 +01:00
ac-aes128-gcm-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
ac-aes256-gcm-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
aes128-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
aes256-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
apple-ios
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
asan.supp
tests: skip leaks in occtl
2021-11-01 10:23:01 +01:00
ban-ips.c
Fix new Coverity Scan defect
2026-05-01 19:26:45 +00:00
bandwidth
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
banner
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
check-config-scope.py
tests: add regression test for pam_auth_deinit coroutine safety
2026-06-06 08:12:13 +02:00
cipher-common.sh
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
common.sh
tests: add SIGKILL fallback in cleanup_client_server
2026-06-11 15:40:37 +02:00
config-auth.xml
Remove spaces
2022-11-28 11:22:33 +01:00
config-inherit.c
config: extend vhost_inherit_static_config to cover vhost-scoped fields
2026-04-23 10:51:26 +02:00
connect-ios-script
tests: do not store environment information
2026-06-17 06:17:05 +02:00
connect-script
tests: do not store environment information
2026-06-17 06:17:05 +02:00
defvhost-traffic
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
disconnect-user
tests: attempt to fix disconnect-user race that caused 300 s timeouts
2026-06-11 15:40:37 +02:00
disconnect-user2
tests: attempt to fix disconnect-user race that caused 300 s timeouts
2026-06-11 15:40:37 +02:00
drain-server
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
drain-server-fail
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
flowcontrol
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
fw-ocserv
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
fw-ocserv-ports-routes
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
generate_oidc_test_data.c
Main() signature compliant with C standard
2024-12-06 12:08:52 +01:00
haproxy-auth
tests: which → command -v
2026-05-31 14:17:33 +02:00
haproxy-connect
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
haproxy-proxyproto
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
haproxy-proxyproto-v1
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
html-escape.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
human_addr.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
idle-timeout
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
idle-timeout-icmpv6
worker: fix ICMPv6 misclassification as data traffic affecting idle-timeout
2026-05-19 20:14:21 +02:00
invalid-configs
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
ipv4-prefix.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
ipv6-iface
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
ipv6-prefix.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
ipv6-small-net
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
json
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
json-escape.c
Updated code to follow with kernel coding style
2024-12-01 17:01:05 +01:00
kerberos
tests: which → command -v
2026-05-31 14:17:33 +02:00
kkdcp-parsing.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
lz4-compression
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
lzs-compression
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
meson.build
worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions
2026-07-28 08:07:07 +02:00
multiple-routes
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
no-dtls-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
no-ipv6-ocv3
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
no-route-default
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
no-route-group
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
ns.sh
tests: which → command -v
2026-05-31 14:17:33 +02:00
oc-aes128-gcm-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
oc-aes256-gcm-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
ocpasswd-test
tests: added tests for multiple ocpasswd options
2026-04-13 22:43:52 +02:00
pam-abort-mod.c
tests: add regression test for pam_auth_deinit coroutine safety
2026-06-06 08:12:13 +02:00
pam-guard-page.c
tests: pam-stack-guard: guard against tail optimizations of gcc
2026-06-10 20:52:56 +02:00
ping-leases
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
port-parsing.c
config: restructure per-vhost configuration for clarity and maintainability
2026-04-22 20:29:15 +02:00
proxyproto-v1.c
tests: initialize worker_st using = {0}
2026-03-29 17:32:16 +02:00
proxyproto-v2.c
tlslib, worker: remove dead code orphaned by the listen-clear-file removal
2026-07-28 08:00:06 +02:00
psk-negotiate
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
psk-negotiate-match
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
radius
radius: send the session ID as Acct-Session-Id in the Access-Request
2026-07-14 21:40:23 +02:00
radius-config
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
radius-group
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
radius-ipv6-prefix
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
radius-multi-group
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
radius-multi-group-comma
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
radius-otp
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
radius-reconnect-acct
tests: add reproducer for inflated RADIUS Acct-Session-Time across reconnects
2026-07-12 13:55:55 +02:00
random-net2.sh
tests: auto-generate random addresses instead of hard-coding them
2023-12-29 21:18:28 +01:00
random-net.sh
tests: which → command -v
2026-05-31 14:17:33 +02:00
resumption
tests: resumption: enhanced and avoid the use of gnutls-cli insecure option
2026-01-11 09:04:18 +01:00
route-sanity-check.c
ip-util: reject routes with characters outside address/prefix syntax
2026-07-28 08:00:06 +02:00
server-cert-ed25519
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
server-cert-rsa-pss
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
session-timeout
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
sleep-connect-script
test-script-multi-user: Fix timeout: move sleep 600 inside connect branch
2026-03-20 20:47:35 +01:00
str-test2.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
str-test.c
Updated code to follow with kernel coding style
2024-12-01 17:01:05 +01:00
syslog-shim.c
config: add syslog-facility option to allow routing logs independently
2026-06-03 19:52:36 +02:00
terminate-commands
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-append-routes
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-ban
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-ban-local
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-camouflage
Removed unnecessary CA and certificate handlers
2026-05-19 20:11:33 +02:00
test-camouflage-norealm
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-cert
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-cert-opt-pass
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-cert-svc
Add support for Cisco IP-Phone Enterprise firmware VPN client.
2023-07-11 22:48:22 +12:00
test-client-bypass-protocol
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-config-per-group
sup-config/file: reject path-traversal in username/groupname
2026-06-17 06:04:49 +02:00
test-config-per-group-url-cert
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
test-config-per-group-url-pass
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
test-cookie-invalidation
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-cookie-sid-overflow
tests: add reproducer for oversized webvpncontext=/webvpn= cookie overflow
2026-06-07 08:29:52 +02:00
test-cookie-timeout
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-cookie-timeout-2
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-cstp-send-hang
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
test-enc-key
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-explicit-ip
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-fork
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-fw-normalize-route
ocserv-fw-nftables: replace ipcalc with pure-shell mask_to_prefix
2026-05-02 17:21:38 +02:00
test-fw-script
tests: added tests for ocserv setting fw rules
2026-03-29 16:55:12 +02:00
test-group-cert
tests: removed legacy tests and added missing ones
2023-06-22 12:29:02 +02:00
test-group-cert-autoselect
auto-select group when a certificate provides enough information
2026-07-12 10:15:11 +02:00
test-group-name
Fix cached group-select handling
2026-06-06 23:41:11 +02:00
test-group-pass
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-gssapi
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
test-gssapi-opt-cert
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-gssapi-opt-pass
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-http-limits
worker: harden HTTP request header size limits
2026-05-06 13:54:21 +02:00
test-http-smuggling
worker: reject HTTP pipelining to prevent request confusion
2026-05-15 06:42:24 +02:00
test-ignore-querystring-of-post
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-iroute
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-maintenance
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-max-same-1
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-mtu-connect
worker: reject client MTU below MIN_MTU to prevent unsigned underflow
2026-06-07 08:29:52 +02:00
test-multi-cookie
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-multiple-client-ip
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
test-namespace-listen
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-no-udp
Allow using no-udp option in vhosts
2026-04-14 13:26:32 -04:00
test-occtl
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-occtl-commands
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-oidc
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-otp
tests: check that empty password with correct OTP fails when password is set
2026-04-03 13:58:18 +02:00
test-otp-cert
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-owasp-headers
/svc handler: add the owasp headers for consistency
2026-05-19 20:11:33 +02:00
test-pam
pam: add 'service' sub-option to auth directive
2026-05-08 21:00:07 -04:00
test-pam-abort
tests: add regression test for pam_auth_deinit coroutine safety
2026-06-06 08:12:13 +02:00
test-pam-noauth
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-pass
tests: check for the case where a password is incorrectly entered
2026-04-03 12:29:01 +02:00
test-pass-cert
tests: check for the case where a password is incorrectly entered
2026-04-03 12:29:01 +02:00
test-pass-cert-rfc822name
tests: added test-pass-cert-rfc822name
2026-02-28 11:46:56 +01:00
test-pass-group-cert
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-pass-group-cert-no-pass
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-pass-opt-cert
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-pass-pam-acct
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
test-pass-script
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-pass-svc
Add support for Cisco IP-Phone Enterprise firmware VPN client.
2023-07-11 22:48:22 +12:00
test-rekey-tls12
worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions
2026-07-28 08:07:07 +02:00
test-rekey-tls13
worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions
2026-07-28 08:07:07 +02:00
test-replay
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-san-cert
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-script-multi-user
test-script-multi-user: simplified
2026-03-22 22:54:48 +01:00
test-secmod-kill
ocserv: exit with error code on error
2026-05-31 22:32:20 +02:00
test-select-group-length-warning
config: warn about select-group entries that exceed MAX_GROUPNAME_SIZE
2026-06-17 06:04:49 +02:00
test-sighup
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-sighup-key-change
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
test-stress
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-syslog-facility
config: add syslog-facility option to allow routing logs independently
2026-06-03 19:52:36 +02:00
test-udp-listen-host
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
test-user-config
Respect tunnel-all-dns in per-user/group config
2026-04-26 21:05:06 -04:00
test-vhost
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-vhost-udp-port-inheritance
Fix global option inheritance for virtual hosts
2026-04-09 20:20:45 -04:00
test-year-2038
tests: which → command -v
2026-05-31 14:17:33 +02:00
traffic
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00
url-escape.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
valid-hostname.c
valid_hostname: enhance to cover RFC 1123 requirements
2026-04-18 15:51:20 +02:00
vhost-traffic
tests: do not skip if /usr/sbin/ip is missing
2026-06-11 15:40:37 +02:00