mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-08-08 09:21:48 +08:00
Nikos Mavrogiannopoulos
0dafa7b005
Add test-pam-abort, which verifies that pam_auth_deinit() correctly resumes a suspended PAM coroutine before calling pam_end(). The test posts a username-only HTTP request to trigger SEC_AUTH_INIT, leaving the PAM coroutine suspended in PAM_S_WAIT_FOR_PASS while the worker exits without sending a password. The stale pre-auth entry is cleaned up by the sec-mod maintenance cycle (driven by the new sec-mod-db-cleanup-time config knob, set to 3 s in the test config). Bug detection is provided by pam_abort_test.so, a small PAM module that registers a pam_set_data() cleanup which calls abort() if pam_end() fires while conv->conv() has not yet returned. Without the fix, sec-mod would abort and the subsequent authentication check would fail. Relates: #741 Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
54 lines
1.2 KiB
Plaintext
54 lines
1.2 KiB
Plaintext
# Minimal ocserv config for test-pam-abort.
|
|
# Uses the ocserv-abort PAM service backed by pam_abort_test.so, which
|
|
# aborts the process if pam_end() is called while the conversation
|
|
# coroutine is still live (regression test for issue #657).
|
|
|
|
auth = "pam[service=ocserv-abort]"
|
|
|
|
isolate-workers = @ISOLATE_WORKERS@
|
|
|
|
use-dbus = no
|
|
|
|
max-clients = 16
|
|
max-same-clients = 2
|
|
|
|
tcp-port = @PORT@
|
|
udp-port = @PORT@
|
|
|
|
keepalive = 32400
|
|
dpd = 440
|
|
try-mtu-discovery = false
|
|
|
|
server-cert = @SRCDIR@/certs/server-cert.pem
|
|
server-key = @SRCDIR@/certs/server-key.pem
|
|
|
|
tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
|
|
|
|
auth-timeout = 5
|
|
|
|
# Short cookie-timeout so stale pre-auth entries expire quickly
|
|
# (exptime = cookie_timeout + AUTH_SLACK_TIME = 0 + 15 = 15 s).
|
|
cookie-timeout = 0
|
|
|
|
# Short maintenance interval so cleanup_client_entries() fires within
|
|
# seconds of entry expiry. Undocumented; 0 = use built-in default.
|
|
sec-mod-db-cleanup-time = 3
|
|
|
|
pid-file = ./ocserv.pid
|
|
socket-file = ./ocserv-socket
|
|
|
|
run-as-user = root
|
|
run-as-group = root
|
|
|
|
device = vpns
|
|
|
|
default-domain = example.com
|
|
|
|
ipv4-network = 192.168.1.0
|
|
ipv4-netmask = 255.255.255.0
|
|
ipv4-dns = 192.168.1.1
|
|
|
|
ping-leases = false
|
|
|
|
route = 192.168.1.0/255.255.255.0
|