Nikos Mavrogiannopoulos 832d78401e sec-mod: prevent malicious clients from piling up client_entry_st per pid ...

Malicious clients cannot send CMD_SEC_AUTH_INIT arbitrarily: a worker's
pid has one client_entry_st attached to it. A repeated SEC_AUTH_INIT
is accepted (replacing the previous entry) only when the prior
attempt already ended in PS_AUTH_FAILED, matching the legitimate
case for it (GSSAPI/certificate falling back to the next auth method).

Any other repeat - while a previous attempt on that pid is still mid-flight
or already completed - is refused.

Resolves: #249

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

2026-08-03 09:21:33 +02:00

..

certs

auto-select group when a certificate provides enough information

2026-07-12 10:15:11 +02:00

data

worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions

2026-07-28 08:07:07 +02:00

scripts

tests: which → command -v

2026-05-31 14:17:33 +02:00

user-config

Respect tunnel-all-dns in per-user/group config

2026-04-26 21:05:06 -04:00

user-config-explicit

test-explicit-ip: corrected the illegal IP address

2021-10-31 22:26:25 +01:00

user-config-opt

Remove spaces

2022-11-28 11:22:33 +01:00

ac-aes128-gcm-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

ac-aes256-gcm-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

aes128-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

aes256-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

apple-ios

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

asan.supp

tests: skip leaks in occtl

2021-11-01 10:23:01 +01:00

ban-ips.c

Fix new Coverity Scan defect

2026-05-01 19:26:45 +00:00

bandwidth

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

banner

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

check-config-scope.py

tests: add regression test for pam_auth_deinit coroutine safety

2026-06-06 08:12:13 +02:00

cipher-common.sh

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

common.sh

tests: add SIGKILL fallback in cleanup_client_server

2026-06-11 15:40:37 +02:00

config-auth.xml

Remove spaces

2022-11-28 11:22:33 +01:00

config-inherit.c

config: extend vhost_inherit_static_config to cover vhost-scoped fields

2026-04-23 10:51:26 +02:00

connect-ios-script

tests: do not store environment information

2026-06-17 06:17:05 +02:00

connect-script

tests: do not store environment information

2026-06-17 06:17:05 +02:00

defvhost-traffic

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

disconnect-user

tests: attempt to fix disconnect-user race that caused 300 s timeouts

2026-06-11 15:40:37 +02:00

disconnect-user2

tests: attempt to fix disconnect-user race that caused 300 s timeouts

2026-06-11 15:40:37 +02:00

drain-server

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

drain-server-fail

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

flowcontrol

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

fw-ocserv

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

fw-ocserv-ports-routes

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

generate_oidc_test_data.c

Main() signature compliant with C standard

2024-12-06 12:08:52 +01:00

haproxy-auth

tests: which → command -v

2026-05-31 14:17:33 +02:00

haproxy-connect

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

haproxy-proxyproto

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

haproxy-proxyproto-v1

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

html-escape.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

human_addr.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

idle-timeout

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

idle-timeout-icmpv6

worker: fix ICMPv6 misclassification as data traffic affecting idle-timeout

2026-05-19 20:14:21 +02:00

invalid-configs

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

ipv4-prefix.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

ipv6-iface

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

ipv6-prefix.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

ipv6-small-net

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

json

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

json-escape.c

Updated code to follow with kernel coding style

2024-12-01 17:01:05 +01:00

kerberos

tests: which → command -v

2026-05-31 14:17:33 +02:00

kkdcp-parsing.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

lz4-compression

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

lzs-compression

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

meson.build

worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions

2026-07-28 08:07:07 +02:00

multiple-routes

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

no-dtls-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

no-ipv6-ocv3

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

no-route-default

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

no-route-group

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

ns.sh

tests: which → command -v

2026-05-31 14:17:33 +02:00

oc-aes128-gcm-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

oc-aes256-gcm-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

ocpasswd-test

tests: added tests for multiple ocpasswd options

2026-04-13 22:43:52 +02:00

pam-abort-mod.c

tests: add regression test for pam_auth_deinit coroutine safety

2026-06-06 08:12:13 +02:00

pam-guard-page.c

tests: pam-stack-guard: guard against tail optimizations of gcc

2026-06-10 20:52:56 +02:00

ping-leases

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

port-parsing.c

config: restructure per-vhost configuration for clarity and maintainability

2026-04-22 20:29:15 +02:00

proxyproto-v1.c

tests: initialize worker_st using = {0}

2026-03-29 17:32:16 +02:00

proxyproto-v2.c

tlslib, worker: remove dead code orphaned by the listen-clear-file removal

2026-07-28 08:00:06 +02:00

psk-negotiate

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

psk-negotiate-match

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

radius

radius: send the session ID as Acct-Session-Id in the Access-Request

2026-07-14 21:40:23 +02:00

radius-config

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

radius-group

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

radius-ipv6-prefix

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

radius-multi-group

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

radius-multi-group-comma

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

radius-otp

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

radius-reconnect-acct

tests: add reproducer for inflated RADIUS Acct-Session-Time across reconnects

2026-07-12 13:55:55 +02:00

random-net2.sh

tests: auto-generate random addresses instead of hard-coding them

2023-12-29 21:18:28 +01:00

random-net.sh

tests: which → command -v

2026-05-31 14:17:33 +02:00

resumption

tests: resumption: enhanced and avoid the use of gnutls-cli insecure option

2026-01-11 09:04:18 +01:00

route-sanity-check.c

ip-util: reject routes with characters outside address/prefix syntax

2026-07-28 08:00:06 +02:00

server-cert-ed25519

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

server-cert-rsa-pss

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

session-timeout

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

sleep-connect-script

test-script-multi-user: Fix timeout: move sleep 600 inside connect branch

2026-03-20 20:47:35 +01:00

str-test2.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

str-test.c

Updated code to follow with kernel coding style

2024-12-01 17:01:05 +01:00

syslog-shim.c

config: add syslog-facility option to allow routing logs independently

2026-06-03 19:52:36 +02:00

terminate-commands

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-append-routes

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-ban

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-ban-local

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-camouflage

Removed unnecessary CA and certificate handlers

2026-05-19 20:11:33 +02:00

test-camouflage-norealm

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-cert

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-cert-opt-pass

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-cert-svc

Add support for Cisco IP-Phone Enterprise firmware VPN client.

2023-07-11 22:48:22 +12:00

test-client-bypass-protocol

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-config-per-group

sup-config/file: reject path-traversal in username/groupname

2026-06-17 06:04:49 +02:00

test-config-per-group-url-cert

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

test-config-per-group-url-pass

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

test-cookie-invalidation

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-cookie-sid-overflow

tests: add reproducer for oversized webvpncontext=/webvpn= cookie overflow

2026-06-07 08:29:52 +02:00

test-cookie-timeout

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-cookie-timeout-2

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-cstp-send-hang

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

test-enc-key

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-explicit-ip

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-fork

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-fw-normalize-route

ocserv-fw-nftables: replace ipcalc with pure-shell mask_to_prefix

2026-05-02 17:21:38 +02:00

test-fw-script

tests: added tests for ocserv setting fw rules

2026-03-29 16:55:12 +02:00

test-group-cert

tests: removed legacy tests and added missing ones

2023-06-22 12:29:02 +02:00

test-group-cert-autoselect

auto-select group when a certificate provides enough information

2026-07-12 10:15:11 +02:00

test-group-name

Fix cached group-select handling

2026-06-06 23:41:11 +02:00

test-group-pass

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-gssapi

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

test-gssapi-opt-cert

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-gssapi-opt-pass

sec-mod: prevent malicious clients from piling up client_entry_st per pid

2026-08-03 09:21:33 +02:00

test-http-limits

worker: harden HTTP request header size limits

2026-05-06 13:54:21 +02:00

test-http-smuggling

worker: reject HTTP pipelining to prevent request confusion

2026-05-15 06:42:24 +02:00

test-ignore-querystring-of-post

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-iroute

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-maintenance

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-max-same-1

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-mtu-connect

worker: reject client MTU below MIN_MTU to prevent unsigned underflow

2026-06-07 08:29:52 +02:00

test-multi-cookie

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-multiple-client-ip

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

test-namespace-listen

tests: which → command -v

2026-05-31 14:17:33 +02:00

test-no-udp

Allow using no-udp option in vhosts

2026-04-14 13:26:32 -04:00

test-occtl

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-occtl-commands

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-oidc

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-otp

tests: check that empty password with correct OTP fails when password is set

2026-04-03 13:58:18 +02:00

test-otp-cert

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-owasp-headers

/svc handler: add the owasp headers for consistency

2026-05-19 20:11:33 +02:00

test-pam

pam: add 'service' sub-option to auth directive

2026-05-08 21:00:07 -04:00

test-pam-abort

tests: add regression test for pam_auth_deinit coroutine safety

2026-06-06 08:12:13 +02:00

test-pam-noauth

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pass

tests: check for the case where a password is incorrectly entered

2026-04-03 12:29:01 +02:00

test-pass-cert

tests: check for the case where a password is incorrectly entered

2026-04-03 12:29:01 +02:00

test-pass-cert-rfc822name

tests: added test-pass-cert-rfc822name

2026-02-28 11:46:56 +01:00

test-pass-group-cert

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pass-group-cert-no-pass

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pass-opt-cert

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-pass-pam-acct

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

test-pass-script

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pass-svc

Add support for Cisco IP-Phone Enterprise firmware VPN client.

2023-07-11 22:48:22 +12:00

test-rekey-tls12

worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions

2026-07-28 08:07:07 +02:00

test-rekey-tls13

worker: use TLS 1.3 transparent rekey on TLS 1.3 CSTP sessions

2026-07-28 08:07:07 +02:00

test-replay

tests: which → command -v

2026-05-31 14:17:33 +02:00

test-san-cert

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-script-multi-user

test-script-multi-user: simplified

2026-03-22 22:54:48 +01:00

test-secmod-kill

ocserv: exit with error code on error

2026-05-31 22:32:20 +02:00

test-select-group-length-warning

config: warn about select-group entries that exceed MAX_GROUPNAME_SIZE

2026-06-17 06:04:49 +02:00

test-sighup

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-sighup-key-change

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

test-stress

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-syslog-facility

config: add syslog-facility option to allow routing logs independently

2026-06-03 19:52:36 +02:00

test-udp-listen-host

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

test-user-config

Respect tunnel-all-dns in per-user/group config

2026-04-26 21:05:06 -04:00

test-vhost

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-vhost-udp-port-inheritance

Fix global option inheritance for virtual hosts

2026-04-09 20:20:45 -04:00

test-year-2038

tests: which → command -v

2026-05-31 14:17:33 +02:00

traffic

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00

url-escape.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

valid-hostname.c

valid_hostname: enhance to cover RFC 1123 requirements

2026-04-18 15:51:20 +02:00

vhost-traffic

tests: do not skip if /usr/sbin/ip is missing

2026-06-11 15:40:37 +02:00