GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-09 09:51:49 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
a4a8126c7bc8bc08bf0598cb853e5ae24b8d7768
ocserv/tests
T
History
Nikos Mavrogiannopoulos c5c921528d worker: reject client MTU below MIN_MTU to prevent unsigned underflow 
DATA_MTU(ws, mtu) performs unsigned subtraction.  A client advertising
X-CSTP-Base-MTU or X-CSTP-MTU smaller than the combined DTLS overhead
(IP + UDP + DTLS record + crypto) causes the result to wrap to ~UINT_MAX,
which then reaches memset(), tun_read(), and IPC calls.

Fix: enforce MIN_MTU(ws) (800 for IPv4, 1280 for IPv6) as the lower
bound when accepting client-supplied link_mtu and tunnel_mtu values.
Values below the floor are logged and ignored; the server's own MTU
is used instead.  Add a defense-in-depth lower-bound check in
link_mtu_set() and a runtime assert after calc_mtu_values() that fires
in CI if a future cipher or protocol change erodes the safety margin.

Resolves: #717

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-06-07 08:29:52 +02:00
..
certs
tests: added test-pass-cert-rfc822name
2026-02-28 11:46:56 +01:00
data
Merge branch 'fix-cached-group-select' into 'master'
2026-06-07 06:24:15 +00:00
scripts
tests: which → command -v
2026-05-31 14:17:33 +02:00
user-config
Respect tunnel-all-dns in per-user/group config
2026-04-26 21:05:06 -04:00
user-config-explicit
test-explicit-ip: corrected the illegal IP address
2021-10-31 22:26:25 +01:00
user-config-opt
Remove spaces
2022-11-28 11:22:33 +01:00
ac-aes128-gcm-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
ac-aes256-gcm-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
aes128-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
aes256-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
apple-ios
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
asan.supp
tests: skip leaks in occtl
2021-11-01 10:23:01 +01:00
ban-ips.c
Fix new Coverity Scan defect
2026-05-01 19:26:45 +00:00
bandwidth
tests: which → command -v
2026-05-31 14:17:33 +02:00
banner
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
check-config-scope.py
tests: add regression test for pam_auth_deinit coroutine safety
2026-06-06 08:12:13 +02:00
cipher-common.sh
tests: which → command -v
2026-05-31 14:17:33 +02:00
common.sh
tests: which → command -v
2026-05-31 14:17:33 +02:00
config-auth.xml
Remove spaces
2022-11-28 11:22:33 +01:00
config-inherit.c
config: extend vhost_inherit_static_config to cover vhost-scoped fields
2026-04-23 10:51:26 +02:00
connect-ios-script
Replaced autoconf with meson build files
2026-03-20 20:47:27 +01:00
connect-script
Replaced autoconf with meson build files
2026-03-20 20:47:27 +01:00
cstp-recv.c
tests: initialize worker_st using = {0}
2026-03-29 17:32:16 +02:00
defvhost-traffic
tests: which → command -v
2026-05-31 14:17:33 +02:00
disconnect-user
tests: fixed flaky condition in disconnect-user
2026-03-29 21:13:28 +02:00
disconnect-user2
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
drain-server
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
drain-server-fail
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
flowcontrol
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
fw-ocserv
tests: which → command -v
2026-05-31 14:17:33 +02:00
fw-ocserv-ports-routes
tests: which → command -v
2026-05-31 14:17:33 +02:00
generate_oidc_test_data.c
Main() signature compliant with C standard
2024-12-06 12:08:52 +01:00
haproxy-auth
tests: which → command -v
2026-05-31 14:17:33 +02:00
haproxy-connect
tests: which → command -v
2026-05-31 14:17:33 +02:00
haproxy-proxyproto
tests: which → command -v
2026-05-31 14:17:33 +02:00
haproxy-proxyproto-v1
tests: which → command -v
2026-05-31 14:17:33 +02:00
html-escape.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
human_addr.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
idle-timeout
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
idle-timeout-icmpv6
worker: fix ICMPv6 misclassification as data traffic affecting idle-timeout
2026-05-19 20:14:21 +02:00
invalid-configs
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
ipv4-prefix.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
ipv6-iface
tests: which → command -v
2026-05-31 14:17:33 +02:00
ipv6-prefix.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
ipv6-small-net
tests: which → command -v
2026-05-31 14:17:33 +02:00
json
tests: which → command -v
2026-05-31 14:17:33 +02:00
json-escape.c
Updated code to follow with kernel coding style
2024-12-01 17:01:05 +01:00
kerberos
tests: which → command -v
2026-05-31 14:17:33 +02:00
kkdcp-parsing.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
lz4-compression
tests: which → command -v
2026-05-31 14:17:33 +02:00
lzs-compression
tests: which → command -v
2026-05-31 14:17:33 +02:00
meson.build
worker: reject client MTU below MIN_MTU to prevent unsigned underflow
2026-06-07 08:29:52 +02:00
multiple-routes
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
no-dtls-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
no-ipv6-ocv3
tests: which → command -v
2026-05-31 14:17:33 +02:00
no-route-default
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
no-route-group
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
ns.sh
tests: which → command -v
2026-05-31 14:17:33 +02:00
oc-aes128-gcm-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
oc-aes256-gcm-cipher
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
ocpasswd-test
tests: added tests for multiple ocpasswd options
2026-04-13 22:43:52 +02:00
pam-abort-mod.c
tests: add regression test for pam_auth_deinit coroutine safety
2026-06-06 08:12:13 +02:00
pam-guard-page.c
pam: increase coroutine stack to 8 MB and add guard page
2026-06-06 08:12:13 +02:00
ping-leases
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
port-parsing.c
config: restructure per-vhost configuration for clarity and maintainability
2026-04-22 20:29:15 +02:00
proxyproto-v1.c
tests: initialize worker_st using = {0}
2026-03-29 17:32:16 +02:00
proxyproto-v2.c
Test proxy protocol parser with IPv6 packet
2026-05-23 14:52:01 +00:00
psk-negotiate
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
psk-negotiate-match
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
radius
tests: which → command -v
2026-05-31 14:17:33 +02:00
radius-config
tests: which → command -v
2026-05-31 14:17:33 +02:00
radius-group
tests: which → command -v
2026-05-31 14:17:33 +02:00
radius-ipv6-prefix
tests: which → command -v
2026-05-31 14:17:33 +02:00
radius-multi-group
tests: which → command -v
2026-05-31 14:17:33 +02:00
radius-multi-group-comma
tests: which → command -v
2026-05-31 14:17:33 +02:00
radius-otp
tests: which → command -v
2026-05-31 14:17:33 +02:00
random-net2.sh
tests: auto-generate random addresses instead of hard-coding them
2023-12-29 21:18:28 +01:00
random-net.sh
tests: which → command -v
2026-05-31 14:17:33 +02:00
resumption
tests: resumption: enhanced and avoid the use of gnutls-cli insecure option
2026-01-11 09:04:18 +01:00
server-cert-ed25519
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
server-cert-rsa-pss
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
session-timeout
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
sleep-connect-script
test-script-multi-user: Fix timeout: move sleep 600 inside connect branch
2026-03-20 20:47:35 +01:00
str-test2.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
str-test.c
Updated code to follow with kernel coding style
2024-12-01 17:01:05 +01:00
syslog-shim.c
config: add syslog-facility option to allow routing logs independently
2026-06-03 19:52:36 +02:00
terminate-commands
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-append-routes
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-ban
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-ban-local
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-camouflage
Removed unnecessary CA and certificate handlers
2026-05-19 20:11:33 +02:00
test-camouflage-norealm
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-cert
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-cert-opt-pass
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-cert-svc
Add support for Cisco IP-Phone Enterprise firmware VPN client.
2023-07-11 22:48:22 +12:00
test-client-bypass-protocol
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-config-per-group
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-config-per-group-url-cert
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-config-per-group-url-pass
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-cookie-invalidation
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-cookie-sid-overflow
tests: add reproducer for oversized webvpncontext=/webvpn= cookie overflow
2026-06-07 08:29:52 +02:00
test-cookie-timeout
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-cookie-timeout-2
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-cstp-send-hang
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-enc-key
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-explicit-ip
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-fork
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-fw-normalize-route
ocserv-fw-nftables: replace ipcalc with pure-shell mask_to_prefix
2026-05-02 17:21:38 +02:00
test-fw-script
tests: added tests for ocserv setting fw rules
2026-03-29 16:55:12 +02:00
test-group-cert
tests: removed legacy tests and added missing ones
2023-06-22 12:29:02 +02:00
test-group-name
Fix cached group-select handling
2026-06-06 23:41:11 +02:00
test-group-pass
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-gssapi
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
test-gssapi-opt-cert
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-gssapi-opt-pass
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-http-limits
worker: harden HTTP request header size limits
2026-05-06 13:54:21 +02:00
test-http-smuggling
worker: reject HTTP pipelining to prevent request confusion
2026-05-15 06:42:24 +02:00
test-ignore-querystring-of-post
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-iroute
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-maintenance
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-max-same-1
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-mtu-connect
worker: reject client MTU below MIN_MTU to prevent unsigned underflow
2026-06-07 08:29:52 +02:00
test-multi-cookie
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-multiple-client-ip
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-namespace-listen
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-no-udp
Allow using no-udp option in vhosts
2026-04-14 13:26:32 -04:00
test-occtl
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-occtl-commands
tests: introduced helper to have uniform termination of client and server
2026-03-22 12:29:59 +01:00
test-oidc
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-otp
tests: check that empty password with correct OTP fails when password is set
2026-04-03 13:58:18 +02:00
test-otp-cert
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-owasp-headers
/svc handler: add the owasp headers for consistency
2026-05-19 20:11:33 +02:00
test-pam
pam: add 'service' sub-option to auth directive
2026-05-08 21:00:07 -04:00
test-pam-abort
tests: add regression test for pam_auth_deinit coroutine safety
2026-06-06 08:12:13 +02:00
test-pam-noauth
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-pass
tests: check for the case where a password is incorrectly entered
2026-04-03 12:29:01 +02:00
test-pass-cert
tests: check for the case where a password is incorrectly entered
2026-04-03 12:29:01 +02:00
test-pass-cert-rfc822name
tests: added test-pass-cert-rfc822name
2026-02-28 11:46:56 +01:00
test-pass-group-cert
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-pass-group-cert-no-pass
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-pass-opt-cert
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-pass-pam-acct
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-pass-script
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-pass-svc
Add support for Cisco IP-Phone Enterprise firmware VPN client.
2023-07-11 22:48:22 +12:00
test-replay
tests: which → command -v
2026-05-31 14:17:33 +02:00
test-san-cert
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-script-multi-user
test-script-multi-user: simplified
2026-03-22 22:54:48 +01:00
test-secmod-kill
ocserv: exit with error code on error
2026-05-31 22:32:20 +02:00
test-sighup
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-sighup-key-change
tests: replaced explicit ports with random assignment
2020-08-09 13:14:22 +02:00
test-stress
ignore querystring while dispatching
2023-06-10 16:21:34 +08:00
test-syslog-facility
config: add syslog-facility option to allow routing logs independently
2026-06-03 19:52:36 +02:00
test-udp-listen-host
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-user-config
Respect tunnel-all-dns in per-user/group config
2026-04-26 21:05:06 -04:00
test-vhost
tests: explicitly specify the path (srcdir vs builddir) of config files
2026-03-20 20:47:35 +01:00
test-vhost-udp-port-inheritance
Fix global option inheritance for virtual hosts
2026-04-09 20:20:45 -04:00
test-year-2038
tests: which → command -v
2026-05-31 14:17:33 +02:00
traffic
tests: which → command -v
2026-05-31 14:17:33 +02:00
url-escape.c
tests: replace strcpy() with strlcpy()
2026-01-07 15:46:16 -05:00
valid-hostname.c
valid_hostname: enhance to cover RFC 1123 requirements
2026-04-18 15:51:20 +02:00
vhost-traffic
tests: which → command -v
2026-05-31 14:17:33 +02:00