From ef8e174232e5773492eb672047d4faaa7cf18ae2 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Dec 2013 14:35:59 +0100 Subject: [PATCH 01/87] compile with any version of libopts --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 1368da1..7f35e14 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -23,7 +23,7 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute BuildRequires: systemd -BuildRequires: autogen-libopts-devel >= 5.18 +BuildRequires: autogen-libopts-devel BuildRequires: autogen BuildRequires: pcllib-devel, http-parser-devel, tcp_wrappers-devel BuildRequires: automake, autoconf From 817148ef4f0613f19e06a1ac72c075d7fd18c4c3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Jan 2014 11:44:23 +0100 Subject: [PATCH 02/87] changes to compile on el7 --- ocserv.spec | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index c0c3ea8..174868b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -23,12 +23,13 @@ BuildRequires: pam-devel BuildRequires: iproute BuildRequires: systemd BuildRequires: autogen-libopts-devel -BuildRequires: protobuf-c-devel +#BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: dbus-devel BuildRequires: autogen -BuildRequires: pcllib-devel, http-parser-devel, tcp_wrappers-devel +#BuildRequires: pcllib-devel, http-parser-devel +BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf Requires: gnutls-utils @@ -55,10 +56,10 @@ to provide the secure VPN service. %prep %setup -q -rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h -rm -rf src/protobuf/ +#rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h +#rm -rf src/protobuf/ rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h -rm -f src/pcl/*.c src/pcl/*.h +#rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # GPLv3 in headers is a gnulib bug: From 311406cfc4e711c4492054a63c6cd86abf5ae249 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 29 Jan 2014 09:53:30 +0100 Subject: [PATCH 03/87] depend on pcllib-devel --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 6629c6f..2a296b8 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -28,7 +28,7 @@ BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: dbus-devel BuildRequires: autogen -#BuildRequires: pcllib-devel +BuildRequires: pcllib-devel #BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf From 58b3228aefcecc8a56e0fbdc01552bdc175fdc8f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 17 Mar 2014 10:34:27 +0100 Subject: [PATCH 04/87] http-parser-devel is now available on epel7 --- ocserv.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 5aed7e6..2491a03 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -29,7 +29,7 @@ BuildRequires: readline-devel BuildRequires: dbus-devel BuildRequires: autogen BuildRequires: pcllib-devel -#BuildRequires: http-parser-devel +BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf @@ -57,10 +57,10 @@ to provide the secure VPN service. %prep %setup -q -#rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h +rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h #rm -rf src/protobuf/ rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h -#rm -f src/pcl/*.c src/pcl/*.h +rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # GPLv3 in headers is a gnulib bug: From 989e8c6a96ad68a572c9120d37ea72f3ef7c644a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 27 May 2014 10:11:47 +0200 Subject: [PATCH 05/87] updated license information --- ocserv.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 98e0f64..4f8d2c0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -4,8 +4,8 @@ Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING -# To simplify licenses LGPLv2+ files have been promoted to GPLv2+. -License: GPLv2+ and BSD and MIT and CC0 +# To simplify licenses LGPLv2+ files have been promoted to GPLv3+. +License: GPLv3+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz Source1: ocserv.conf From 8dd8c434a9fc8edb00e2d59d3ac7297ded1ab014 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 30 Jun 2014 10:29:57 +0200 Subject: [PATCH 06/87] Updated to 0.8.1 --- .gitignore | 2 + ocserv-0.8.0-cmp.patch | 13 ------- ocserv-0.8.0-endianness.patch | 70 ----------------------------------- ocserv.spec | 12 +++--- sources | 4 +- 5 files changed, 9 insertions(+), 92 deletions(-) delete mode 100644 ocserv-0.8.0-cmp.patch delete mode 100644 ocserv-0.8.0-endianness.patch diff --git a/.gitignore b/.gitignore index 11ec67a..fe72e6d 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,5 @@ /ocserv-0.8.0pre0.tar.xz.sig /ocserv-0.8.0.tar.xz /ocserv-0.8.0.tar.xz.sig +/ocserv-0.8.1.tar.xz +/ocserv-0.8.1.tar.xz.sig diff --git a/ocserv-0.8.0-cmp.patch b/ocserv-0.8.0-cmp.patch deleted file mode 100644 index 1a00580..0000000 --- a/ocserv-0.8.0-cmp.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/auth/plain.c b/src/auth/plain.c -index 1b66683..c8ed5bf 100644 ---- a/src/auth/plain.c -+++ b/src/auth/plain.c -@@ -266,7 +266,7 @@ static size_t rehash(const void *_e, void *unused) - - static bool str_cmp(const void* _c1, void* _c2) - { -- const char *c1 = _c1, *c2 = c2; -+ const char *c1 = _c1, *c2 = _c2; - - if (strcmp(c1, c2) == 0) - return 1; diff --git a/ocserv-0.8.0-endianness.patch b/ocserv-0.8.0-endianness.patch deleted file mode 100644 index 0afd8a3..0000000 --- a/ocserv-0.8.0-endianness.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff --git a/src/main-ctl-unix.c b/src/main-ctl-unix.c -index b4da5eb..90d604f 100644 ---- a/src/main-ctl-unix.c -+++ b/src/main-ctl-unix.c -@@ -629,7 +629,7 @@ static void ctl_handle_commands(main_server_st * s) - } - goto cleanup; - } -- length = (buffer[2] << 8) | buffer[1]; -+ memcpy(&length, &buffer[1], 2); - buffer_size = ret - 3; - - if (length != buffer_size) { -diff --git a/src/occtl-unix.c b/src/occtl-unix.c -index 183825d..0c1b3e1 100644 ---- a/src/occtl-unix.c -+++ b/src/occtl-unix.c -@@ -83,15 +83,14 @@ int send_cmd(struct unix_ctx *ctx, unsigned cmd, const void *data, - struct iovec iov[2]; - unsigned iov_len = 1; - int e, ret; -- unsigned length = 0; -+ uint16_t length = 0; - void *packed = NULL; - - if (get_size) - length = get_size(data); - - header[0] = cmd; -- header[1] = length; -- header[2] = length >> 8; -+ memcpy(&header[1], &length, 2); - - iov[0].iov_base = header; - iov[0].iov_len = 3; -@@ -145,7 +144,7 @@ int send_cmd(struct unix_ctx *ctx, unsigned cmd, const void *data, - goto fail; - } - -- length = (header[2] << 8) | header[1]; -+ memcpy(&length, &header[1], 2); - - rep->data_size = length; - rep->data = talloc_size(ctx, length); -diff --git a/src/sec-mod.c b/src/sec-mod.c -index 15ee32a..c3d4bad 100644 ---- a/src/sec-mod.c -+++ b/src/sec-mod.c -@@ -354,6 +354,7 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f - unsigned cmd, length; - unsigned i, buffer_size; - uint8_t *buffer, *tpool; -+ uint16_t l16; - struct pin_st pins; - int sd; - sec_mod_st *sec; -@@ -538,10 +539,11 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f - } - - cmd = buffer[0]; -- length = buffer[1] | buffer[2] << 8; -+ memcpy(&l16, &buffer[1], 2); -+ length = l16; - - if (length > buffer_size - 4) { -- seclog(LOG_INFO, "too big message"); -+ seclog(LOG_INFO, "too big message (%d)", length); - goto cont; - } - diff --git a/ocserv.spec b/ocserv.spec index 644edbf..7903e10 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.8.0 -Release: 2%{?dist} +Version: 0.8.1 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -16,9 +16,6 @@ Source5: org.infradead.ocserv.conf Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey -Patch1: ocserv-0.8.0-endianness.patch -Patch2: ocserv-0.8.0-cmp.patch - # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -76,8 +73,6 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* -%patch1 -p1 -b .cmp -%patch2 -p1 -b .endianness %build @@ -146,6 +141,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jun 30 2014 Nikos Mavrogiannopoulos - 0.8.1-1 +- New upstream release + * Fri Jun 06 2014 Nikos Mavrogiannopoulos - 0.8.0-2 - Generate certificates and private keys before the first run - Corrected chroot path diff --git a/sources b/sources index fb6cafa..1f51640 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -6383535a21f8eecfb1bbb7f7ac99c41f ocserv-0.8.0.tar.xz -1336250a0db4923e6a597b960209b42d ocserv-0.8.0.tar.xz.sig +9a2eeafbe018128460df0729096b20c6 ocserv-0.8.1.tar.xz +f6def04b953baa3f2fe0eb23fd091ee2 ocserv-0.8.1.tar.xz.sig From c037480c7e804315576ba8180ccccd6ecdec9a2d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 28 Jul 2014 09:31:13 +0200 Subject: [PATCH 07/87] new upstream release --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index fe72e6d..3d40924 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,5 @@ /ocserv-0.8.0.tar.xz.sig /ocserv-0.8.1.tar.xz /ocserv-0.8.1.tar.xz.sig +/ocserv-0.8.2.tar.xz +/ocserv-0.8.2.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 7903e10..5cc48d9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.8.1 +Version: 0.8.2 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -141,6 +141,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jul 28 2014 Nikos Mavrogiannopoulos - 0.8.2-1 +- New upstream release + * Mon Jun 30 2014 Nikos Mavrogiannopoulos - 0.8.1-1 - New upstream release diff --git a/sources b/sources index 1f51640..e9ded37 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -9a2eeafbe018128460df0729096b20c6 ocserv-0.8.1.tar.xz -f6def04b953baa3f2fe0eb23fd091ee2 ocserv-0.8.1.tar.xz.sig +fd890e121445dfe8bb514da67c91c675 ocserv-0.8.2.tar.xz +d7fb256c6b4c9837ffc16c9844ded77f ocserv-0.8.2.tar.xz.sig From e03b30d1f03686aaf9004f8ed57fb000aa72d386 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 1 Aug 2014 15:32:51 +0200 Subject: [PATCH 08/87] disabled auto-select-group by default --- ocserv.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 835273c..44872d5 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -282,12 +282,12 @@ route = 192.168.1.0/255.255.255.0 # The name of the group that if selected it would allow to use # the assigned by default group. -default-select-group = DEFAULT +#default-select-group = DEFAULT # Instead of specifying manually all the allowed groups, you may instruct # ocserv to scan all available groups and include the full list. That # option is only functional on plain authentication. -auto-select-group = true +#auto-select-group = true # The system command to use to setup a route. %R will be replaced with the # route/mask and %D with the (tun) device. From c758c8c129e43a19d48ab0d97d2732221da2143a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 5 Aug 2014 09:52:21 +0200 Subject: [PATCH 09/87] rebuilt with new protobuf-c --- ocserv.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 5cc48d9..921ecc7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -26,7 +26,7 @@ BuildRequires: iproute BuildRequires: systemd BuildRequires: systemd-devel BuildRequires: autogen-libopts-devel -#BuildRequires: protobuf-c-devel +BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen @@ -64,7 +64,7 @@ to provide the secure VPN service. %prep %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h -#rm -rf src/protobuf/ +rm -rf src/protobuf/ rm -rf src/ccan/talloc rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h @@ -73,6 +73,7 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* +touch src/*.proto %build @@ -141,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Tue Aug 05 2014 Nikos Mavrogiannopoulos - 0.8.2-2 +- Rebuilt with new protobuf-c + * Mon Jul 28 2014 Nikos Mavrogiannopoulos - 0.8.2-1 - New upstream release From 757b3d707a2e92923fec8775e9b39d118bce6770 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 28 Aug 2014 11:14:20 +0200 Subject: [PATCH 10/87] updated to 0.8.4 and removed unused file Conflicts: ocserv.spec --- .gitignore | 2 ++ ocserv.spec | 10 +++++----- org.infradead.ocserv.conf | 14 -------------- sources | 4 ++-- 4 files changed, 9 insertions(+), 21 deletions(-) delete mode 100644 org.infradead.ocserv.conf diff --git a/.gitignore b/.gitignore index 3d40924..c4b2660 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,5 @@ /ocserv-0.8.1.tar.xz.sig /ocserv-0.8.2.tar.xz /ocserv-0.8.2.tar.xz.sig +/ocserv-0.8.4.tar.xz +/ocserv-0.8.4.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 921ecc7..01cd229 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.8.2 -Release: 2%{?dist} +Version: 0.8.4 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -12,7 +12,6 @@ Source1: ocserv.conf Source2: ocserv.service Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING -Source5: org.infradead.ocserv.conf Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey @@ -106,8 +105,6 @@ mkdir -p %{buildroot}/%{_sysconfdir}/pam.d/ mkdir -p %{buildroot}/%{_sysconfdir}/ocserv/ install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/pam.d/ocserv install -p -m 644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/ocserv/ -mkdir -p %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ -install -p -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ mkdir -p %{buildroot}/%{_unitdir} install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ @@ -142,6 +139,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Aug 28 2014 Nikos Mavrogiannopoulos - 0.8.4-1 +- New upstream release + * Tue Aug 05 2014 Nikos Mavrogiannopoulos - 0.8.2-2 - Rebuilt with new protobuf-c diff --git a/org.infradead.ocserv.conf b/org.infradead.ocserv.conf deleted file mode 100644 index 8c69f93..0000000 --- a/org.infradead.ocserv.conf +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - diff --git a/sources b/sources index e9ded37..a00d33a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -fd890e121445dfe8bb514da67c91c675 ocserv-0.8.2.tar.xz -d7fb256c6b4c9837ffc16c9844ded77f ocserv-0.8.2.tar.xz.sig +3eb452fddebda887eaa5f6412dab634c ocserv-0.8.4.tar.xz +bd84f29bc6fb278c37275d1eca420145 ocserv-0.8.4.tar.xz.sig From 26fc9905eeb69ef26f86eb5189ec7245b3ef97c2 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 28 Aug 2014 11:30:22 +0200 Subject: [PATCH 11/87] removed unused config file --- ocserv.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 01cd229..5b65b0e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -123,7 +123,6 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/ocserv %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf -%config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.infradead.ocserv.conf %config(noreplace) %{_sysconfdir}/pam.d/ocserv %doc AUTHORS ChangeLog NEWS COPYING LICENSE README TODO PACKAGE-LICENSING From 0497931d6c930fcd0c9f80f841288d8eb5cea745 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 9 Sep 2014 16:18:55 +0200 Subject: [PATCH 12/87] Ship a default ocserv-script, which will put connecting clients into the internal firewall zone. --- ocserv-script | 10 ++++++++++ ocserv.conf | 7 +++---- ocserv.spec | 10 +++++++++- 3 files changed, 22 insertions(+), 5 deletions(-) create mode 100755 ocserv-script diff --git a/ocserv-script b/ocserv-script new file mode 100755 index 0000000..b3e2061 --- /dev/null +++ b/ocserv-script @@ -0,0 +1,10 @@ +#!/bin/sh + +if [ "$REASON" = "connect" ];then + # add the user's interface into the internal zone + firewall-cmd --zone=internal --add-interface=$DEVICE +else + firewall-cmd --zone=internal --remove-interface=$DEVICE +fi + +exit 0 diff --git a/ocserv.conf b/ocserv.conf index 44872d5..b554b1d 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -151,8 +151,8 @@ rekey-method = ssl # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /usr/bin/myscript -#disconnect-script = /usr/bin/myscript +#connect-script = /usr/bin/ocserv-script +#disconnect-script = /usr/bin/ocserv-script # UTMP use-utmp = true @@ -285,8 +285,7 @@ route = 192.168.1.0/255.255.255.0 #default-select-group = DEFAULT # Instead of specifying manually all the allowed groups, you may instruct -# ocserv to scan all available groups and include the full list. That -# option is only functional on plain authentication. +# ocserv to scan all available groups and include the full list. #auto-select-group = true # The system command to use to setup a route. %R will be replaced with the diff --git a/ocserv.spec b/ocserv.spec index 5b65b0e..e154d9d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -14,6 +14,7 @@ Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey +Source8: ocserv-script # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -111,6 +112,8 @@ mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ mkdir -p %{buildroot}/%{_sbindir} install -p -m 755 %{SOURCE7} %{buildroot}/%{_sbindir} +mkdir -p %{buildroot}/%{_bindir} +install -p -m 755 %{SOURCE8} %{buildroot}/%{_bindir} %make_install %clean @@ -132,12 +135,17 @@ rm -rf %{buildroot} %{_mandir}/man8/ocpasswd.8* %{_bindir}/ocpasswd %{_bindir}/occtl +%{_bindir}/ocserv-script %{_sbindir}/ocserv %{_sbindir}/ocserv-genkey %{_unitdir}/ocserv.service %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 +- Ship a default ocserv-script, which will put connecting clients + into the internal firewall zone. + * Thu Aug 28 2014 Nikos Mavrogiannopoulos - 0.8.4-1 - New upstream release From 7a4d6331d073534d00b2db1d60e3a2fab198cb73 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Oct 2014 09:38:31 +0100 Subject: [PATCH 13/87] updated to 0.8.7 --- .gitignore | 2 ++ ocserv.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index c4b2660..665d3e8 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,5 @@ /ocserv-0.8.2.tar.xz.sig /ocserv-0.8.4.tar.xz /ocserv-0.8.4.tar.xz.sig +/ocserv-0.8.7.tar.xz.sig +/ocserv-0.8.7.tar.xz diff --git a/ocserv.spec b/ocserv.spec index e154d9d..f30818b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.8.4 -Release: 2%{?dist} +Version: 0.8.7 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -142,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Oct 27 2014 Nikos Mavrogiannopoulos - 0.8.7-1 +- New upstream release + * Thu Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 - Ship a default ocserv-script, which will put connecting clients into the internal firewall zone. diff --git a/sources b/sources index a00d33a..dee4776 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -3eb452fddebda887eaa5f6412dab634c ocserv-0.8.4.tar.xz -bd84f29bc6fb278c37275d1eca420145 ocserv-0.8.4.tar.xz.sig +b807339aed1d713a096d2533ae6da232 ocserv-0.8.7.tar.xz.sig +79c00132c3366bb60546f256068211eb ocserv-0.8.7.tar.xz From 65f3082e4ccb06750570f9ea7df65b0e2af3ce04 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Oct 2014 10:06:28 +0100 Subject: [PATCH 14/87] corrected bogus date --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index f30818b..eb094ab 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -145,7 +145,7 @@ rm -rf %{buildroot} * Mon Oct 27 2014 Nikos Mavrogiannopoulos - 0.8.7-1 - New upstream release -* Thu Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 +* Tue Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 - Ship a default ocserv-script, which will put connecting clients into the internal firewall zone. From 69698f92c8c14809e5bae28e94b1d1b75011fb8d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 26 Nov 2014 17:10:29 +0100 Subject: [PATCH 15/87] new upstream release Resolves: #1167692 --- .gitignore | 2 ++ ocserv.conf | 12 +++++++++--- ocserv.spec | 5 ++++- sources | 4 ++-- 4 files changed, 17 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 665d3e8..5d57c42 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,5 @@ /ocserv-0.8.4.tar.xz.sig /ocserv-0.8.7.tar.xz.sig /ocserv-0.8.7.tar.xz +/ocserv-0.8.8.tar.xz.sig +/ocserv-0.8.8.tar.xz diff --git a/ocserv.conf b/ocserv.conf index b554b1d..6871a25 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,10 +1,16 @@ -# User authentication method. Could be set multiple times and in that case -# all should succeed. -# Options: certificate, pam. +# User authentication method. Could be set multiple times and in +# that case all should succeed. To enable multiple methods use +# multiple auth directives. Available options: certificate, certificate[optional], +# plain, pam. #auth = "certificate" #auth = "plain[./sample.passwd]" auth = "pam" +# This indicates that a user may present a certificate. When that option +# is set, individual users or user groups can be forced to present a valid +# certificate by using "require-cert=true". +#auth = "certificate[optional]" + # The gid-min option is used by auto-select-group option, in order to # select the minimum group ID. #auth = "pam[gid-min=1000]" diff --git a/ocserv.spec b/ocserv.spec index eb094ab..49e92f1 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.8.7 +Version: 0.8.8 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -142,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Wed Nov 26 2014 Nikos Mavrogiannopoulos - 0.8.8-1 +- New upstream release + * Mon Oct 27 2014 Nikos Mavrogiannopoulos - 0.8.7-1 - New upstream release diff --git a/sources b/sources index dee4776..63a85e1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -b807339aed1d713a096d2533ae6da232 ocserv-0.8.7.tar.xz.sig -79c00132c3366bb60546f256068211eb ocserv-0.8.7.tar.xz +de7faa9e1658dfea0f409fcc83fcb7ff ocserv-0.8.8.tar.xz.sig +d9b12a3fa976dfda3e4c0238173744e6 ocserv-0.8.8.tar.xz From 044e25051c197387a3ce9176d692392d53080692 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 11 Dec 2014 13:34:08 +0100 Subject: [PATCH 16/87] new upstream release --- .gitignore | 2 ++ ocserv.conf | 70 ++++++++++++++++++++++++++++++++++++++++------------- ocserv.spec | 5 +++- sources | 4 +-- 4 files changed, 61 insertions(+), 20 deletions(-) diff --git a/.gitignore b/.gitignore index 5d57c42..099ada9 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,5 @@ /ocserv-0.8.7.tar.xz /ocserv-0.8.8.tar.xz.sig /ocserv-0.8.8.tar.xz +/ocserv-0.8.9.tar.xz.sig +/ocserv-0.8.9.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 6871a25..2d6f6f9 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -22,13 +22,19 @@ auth = "pam" # to generate password entries. #auth = "plain[/etc/ocserv/ocpasswd]" +# Whether to enable seccomp worker isolation. That restricts the number of +# system calls allowed to a worker process, in order to reduce damage from a +# bug in the worker process. It is available on Linux systems at a performance cost. +#use-seccomp = true + +# Whether to enable the authentication method's session control (i.e., PAM). +# That requires more resources on the server, and makes cookies one-time-use; +# thus don't enable unless you need it. +#session-control = true + # A banner to be displayed on clients #banner = "Welcome" -# Use listen-host to limit to specific IPs or to the IPs of a provided -# hostname. -#listen-host = [IP|HOSTNAME] - # Limit the number of clients. Unset or set to zero for unlimited. #max-clients = 1024 max-clients = 16 @@ -41,10 +47,23 @@ max-clients = 16 # multiple times). Unset or set to zero for unlimited. max-same-clients = 2 +# Use listen-host to limit to specific IPs or to the IPs of a provided +# hostname. +#listen-host = [IP|HOSTNAME] + +# When the server has a dynamic DNS address (that may change), +# should set that to true to ask the client to resolve again on +# reconnects. +#listen-host-is-dyndns = true + # TCP and UDP port number tcp-port = 443 udp-port = 443 +# Accept connections using a socket file. The connections are +# forwarded without SSL/TLS. +listen-clear-file = /var/run/ocserv-conn.socket + # Keepalive in seconds keepalive = 32400 @@ -94,7 +113,6 @@ server-key = /etc/pki/ocserv/private/server.key # The Certificate Authority that will be used to verify # client certificates (public keys) if certificate authentication # is set. -#ca-cert = /path/to/ca.pem ca-cert = /etc/pki/ocserv/cacerts/ca.crt # The object identifier that will be used to read the user ID in the client @@ -113,10 +131,10 @@ ca-cert = /etc/pki/ocserv/cacerts/ca.crt #crl = /path/to/crl.pem # GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-ARCFOUR-128" # To enforce perfect forward secrecy (PFS) on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" # The time (in seconds) that a client is allowed to stay connected prior # to authentication @@ -135,7 +153,18 @@ auth-timeout = 40 #min-reauth-time = 2 # Cookie timeout (in seconds) -cookie-timeout = 360 +# Once a client is authenticated he's provided a cookie with +# which he can reconnect. That cookie will be invalided if not +# used within this timeout value. On a user disconnection, that +# cookie will also be active for this time amount prior to be +# invalid. That should allow a reasonable amount of time for roaming +# between different networks. +cookie-timeout = 300 + +# Whether roaming is allowed, i.e., if true a cookie is +# restricted to a single IP address and cannot be re-used +# from a different IP. +deny-roaming = false # ReKey time (in seconds) # ocserv will ask the client to refresh keys periodically once @@ -157,8 +186,8 @@ rekey-method = ssl # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /usr/bin/ocserv-script -#disconnect-script = /usr/bin/ocserv-script +#connect-script = /scripts/ocserv-script +#disconnect-script = /scripts/ocserv-script # UTMP use-utmp = true @@ -171,6 +200,7 @@ use-occtl = true # if you use more than a single servers. #occtl-socket-file = /var/run/occtl.socket + # PID file. It can be overriden in the command line. #pid-file = /var/run/ocserv.pid @@ -254,7 +284,7 @@ ping-leases = false # # To set the server as the default gateway for the client just # comment out all routes from the server. -route = 192.168.1.0/255.255.255.0 +#route = 192.168.1.0/255.255.255.0 #route = 192.168.5.0/255.255.255.0 #route = fef4:db8:1000:1001::/64 @@ -291,17 +321,23 @@ route = 192.168.1.0/255.255.255.0 #default-select-group = DEFAULT # Instead of specifying manually all the allowed groups, you may instruct -# ocserv to scan all available groups and include the full list. +# ocserv to scan all available groups and include the full list. That +# option is only functional on plain authentication. #auto-select-group = true -# The system command to use to setup a route. %R will be replaced with the -# route/mask and %D with the (tun) device. +# The system command to use to setup a route. %{R} will be replaced with the +# route/mask and %{D} with the (tun) device. # -# The following example is from linux systems. %R should be something +# The following example is from linux systems. %{R} should be something # like 192.168.2.0/24 -route-add-cmd = "ip route add %R dev %D" -route-del-cmd = "ip route delete %R dev %D" +route-add-cmd = "ip route add %{R} dev %{D}" +route-del-cmd = "ip route delete %{R} dev %{D}" + +# This option allows to forward a proxy. The special strings '%{U}' +# and '%{G}', if present will be replaced by the username and group name. +#proxy-url = http://example.com/ +#proxy-url = http://example.com/%{U}/%{G}/hello # # The following options are for (experimental) AnyConnect client diff --git a/ocserv.spec b/ocserv.spec index 49e92f1..62d4caf 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.8.8 +Version: 0.8.9 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -142,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 +- New upstream release + * Wed Nov 26 2014 Nikos Mavrogiannopoulos - 0.8.8-1 - New upstream release diff --git a/sources b/sources index 63a85e1..3900854 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -de7faa9e1658dfea0f409fcc83fcb7ff ocserv-0.8.8.tar.xz.sig -d9b12a3fa976dfda3e4c0238173744e6 ocserv-0.8.8.tar.xz +5ea9824e39ca125260b67a1379f42036 ocserv-0.8.9.tar.xz.sig +cd935cc89bffac75c825e66ef71f6a73 ocserv-0.8.9.tar.xz From b840657972daf2caac8af62a0e43bfbdd0b843af Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 11 Dec 2014 13:40:49 +0100 Subject: [PATCH 17/87] updated for bundled script --- ocserv.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 2d6f6f9..b754103 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -186,8 +186,8 @@ rekey-method = ssl # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /scripts/ocserv-script -#disconnect-script = /scripts/ocserv-script +#connect-script = /usr/bin/ocserv-script +#disconnect-script = /usr/bin/ocserv-script # UTMP use-utmp = true From 6e97e413b1f961fd3821bbc406f284ab842234b5 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 29 Dec 2014 13:02:34 +0200 Subject: [PATCH 18/87] Added seccomp dependency --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 62d4caf..cb9241f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -30,6 +30,7 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen +BuildRequires: libseccomp-devel BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: http-parser-devel From 38a959547bf86f04f871c00fda56413be144b7eb Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 5 Jan 2015 13:55:20 +0100 Subject: [PATCH 19/87] ocserv.service: depend on network-online.target (#1178760) --- ocserv.service | 2 +- ocserv.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ocserv.service b/ocserv.service index 3f6a3e2..4fe4813 100644 --- a/ocserv.service +++ b/ocserv.service @@ -2,7 +2,7 @@ Description=OpenConnect SSL VPN server Documentation=man:ocserv(8) After=syslog.target -After=network.target +After=network-online.target After=dbus.service [Service] diff --git a/ocserv.spec b/ocserv.spec index cb9241f..c66dcb3 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -143,6 +143,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 +- ocserv.service: depend on network-online.target (#1178760) + * Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 - New upstream release From 644aca4576c1e2b67192d25226d30079d9b7faf3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 6 Jan 2015 10:40:15 +0100 Subject: [PATCH 20/87] disable seccomp on arm --- ocserv.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index c66dcb3..280d42a 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -78,7 +78,11 @@ touch src/*.proto %build -%configure +%configure \ +%ifarch %{arm} + --disable-seccomp \ +%endif + --enable-systemd make %{?_smp_mflags} From e4628ce6ec3bae872b16a43ea6c9ee27df5e4232 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 6 Jan 2015 11:08:22 +0100 Subject: [PATCH 21/87] mention the enabling of seccomp --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 280d42a..4f653a7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -149,6 +149,7 @@ rm -rf %{buildroot} %changelog * Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 - ocserv.service: depend on network-online.target (#1178760) +- enable seccomp * Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 - New upstream release From 3f9635ec8102fef2c12481f8079ceec643a6d0c2 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 6 Jan 2015 11:54:39 +0100 Subject: [PATCH 22/87] enable seccomp on x86 platforms only --- ocserv.spec | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 4f653a7..a00fc0b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -30,7 +30,9 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen +%ifarch %{ix86} x86_64 BuildRequires: libseccomp-devel +%endif BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: http-parser-devel @@ -79,9 +81,6 @@ touch src/*.proto %build %configure \ -%ifarch %{arm} - --disable-seccomp \ -%endif --enable-systemd make %{?_smp_mflags} @@ -149,7 +148,7 @@ rm -rf %{buildroot} %changelog * Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 - ocserv.service: depend on network-online.target (#1178760) -- enable seccomp +- enable seccomp (on platforms it is available) * Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 - New upstream release From 4526326ba2a75751374da7857257bf1df9b31ad0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 9 Jan 2015 13:13:33 +0100 Subject: [PATCH 23/87] enable PIE --- ocserv.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index a00fc0b..ee3ebb2 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,8 @@ +%global _hardened_build 1 + Name: ocserv Version: 0.8.9 -Release: 2%{?dist} +Release: 3%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -146,6 +148,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Jan 9 2015 Nikos Mavrogiannopoulos - 0.8.9-3 +- enable PIE + * Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 - ocserv.service: depend on network-online.target (#1178760) - enable seccomp (on platforms it is available) From 54800e0b3fa6ca0bb9a7a5b09f4a39c631955eb3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 13 Jan 2015 09:50:05 +0100 Subject: [PATCH 24/87] compile without support for smp to prevent issues with autogen --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ee3ebb2..0203475 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -85,7 +85,7 @@ touch src/*.proto %configure \ --enable-systemd -make %{?_smp_mflags} +make #%{?_smp_mflags} %pre getent group ocserv &>/dev/null || groupadd -r ocserv From a44d97abff2d419fe4d14c0abf75ef01420b394e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 29 Jan 2015 14:09:41 +0100 Subject: [PATCH 25/87] run make check --- ocserv.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index 0203475..e6058df 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -96,6 +96,9 @@ mkdir -p %{_sysconfdir}/pki/ocserv/public mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts +%check +make check %{?_smp_mflags} + %post %systemd_post ocserv.service From 257b7d20ce9fd39cbfd4935c8b0624fe299ee76a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 29 Jan 2015 14:08:58 +0100 Subject: [PATCH 26/87] Do not enable seccomp in x86. It is broken. --- ocserv.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index e6058df..f9d857f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.8.9 -Release: 3%{?dist} +Release: 4%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -32,7 +32,7 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen -%ifarch %{ix86} x86_64 +%ifarch x86_64 #%{ix86} BuildRequires: libseccomp-devel %endif BuildRequires: pcllib-devel @@ -151,6 +151,10 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jan 29 2015 Nikos Mavrogiannopoulos - 0.8.9-4 +- only enable seccomp in x86-64. It seems to be broken in x86: + http://sourceforge.net/p/libseccomp/mailman/message/33275762/ + * Fri Jan 9 2015 Nikos Mavrogiannopoulos - 0.8.9-3 - enable PIE From 30dcca7e9c0df71cef5b6ec1810725062845d79e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 31 Mar 2015 10:43:14 +0200 Subject: [PATCH 27/87] updated ocserv to 0.10.2 --- .gitignore | 2 + ocserv.conf | 401 +++++++++++++++++++++++++++++++++++----------------- ocserv.spec | 14 +- sources | 4 +- 4 files changed, 290 insertions(+), 131 deletions(-) diff --git a/.gitignore b/.gitignore index 099ada9..9579ec4 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ /ocserv-0.8.8.tar.xz /ocserv-0.8.9.tar.xz.sig /ocserv-0.8.9.tar.xz +/ocserv-0.10.2.tar.xz +/ocserv-0.10.2.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index b754103..ac6b87f 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,51 +1,62 @@ # User authentication method. Could be set multiple times and in # that case all should succeed. To enable multiple methods use -# multiple auth directives. Available options: certificate, certificate[optional], -# plain, pam. -#auth = "certificate" -#auth = "plain[./sample.passwd]" -auth = "pam" +# multiple auth directives. Available options: certificate, +# plain, pam, radius, gssapi. +# +# Note that authentication methods cannot be changed with reload. -# This indicates that a user may present a certificate. When that option -# is set, individual users or user groups can be forced to present a valid -# certificate by using "require-cert=true". -#auth = "certificate[optional]" - -# The gid-min option is used by auto-select-group option, in order to -# select the minimum group ID. -#auth = "pam[gid-min=1000]" - -# The plain option requires specifying a password file which contains +# certificate: +# This indicates that all connecting users must present a certificate. +# +# pam[gid-min=1000]: +# This enabled PAM authentication of the user. The gid-min option is used +# by auto-select-group option, in order to select the minimum valid group ID. +# +# plain[passwd=/etc/ocserv/ocpasswd] +# The plain option requires specifying a password file which contains # entries of the following format. -# "username:groupname:encoded-password" -# One entry must be listed per line, and 'ocpasswd' can be used +# "username:groupname1,groupname2:encoded-password" +# One entry must be listed per line, and 'ocpasswd' should be used # to generate password entries. -#auth = "plain[/etc/ocserv/ocpasswd]" +# +# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name]: +# The radius option requires specifying freeradius-client configuration +# file. If the groupconfig option is set, then config-per-user will be overriden, +# and all configuration will be read from radius. The supported atributes for +# radius configuration are: +# Group-Name, Framed-IPv6-Address, Framed-IPv6-Prefix, DNS-Server-IPv6-Address, +# Framed-IP-Address, Framed-IP-Netmask, MS-Primary-DNS-Server, MS-Secondary-DNS-Server +# +# gssapi[keytab=/etc/key.tab,require-local-user-map=false] +# The gssapi option allows to use authentication methods supported by GSSAPI, +# such as Kerberos tickets with ocserv. It should be best used as an alternative +# to PAM (i.e., have pam in auth and gssapi in enable-auth), to allow users with +# tickets and without tickets to login. The default value for require-local-user-map +# is true. -# Whether to enable seccomp worker isolation. That restricts the number of -# system calls allowed to a worker process, in order to reduce damage from a -# bug in the worker process. It is available on Linux systems at a performance cost. -#use-seccomp = true +auth = "pam" +#auth = "pam[gid-min=1000]" +#auth = "plain[passwd=./sample.passwd]" +#auth = "certificate" +#auth = "radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true]" -# Whether to enable the authentication method's session control (i.e., PAM). -# That requires more resources on the server, and makes cookies one-time-use; -# thus don't enable unless you need it. -#session-control = true +# Specify alternative authentication methods that are sufficient +# for authentication. That is, if set, any of the methods enabled +# will be sufficient to login. +#enable-auth = certificate +#enable-auth = gssapi +#enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true]" -# A banner to be displayed on clients -#banner = "Welcome" - -# Limit the number of clients. Unset or set to zero for unlimited. -#max-clients = 1024 -max-clients = 16 - -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 - -# Limit the number of identical clients (i.e., users connecting -# multiple times). Unset or set to zero for unlimited. -max-same-clients = 2 +# Accounting methods available: +# pam: can only be combined with PAM authentication method, it provides +# a session opened using PAM. +# +# radius: can be combined with any authentication method, it provides +# radius accounting to available users (see also stats-report-time). +# +# Only one accounting method can be specified. +#acct = "pam" +#acct = "radius[config=/etc/radiusclient/radiusclient.conf]" # Use listen-host to limit to specific IPs or to the IPs of a provided # hostname. @@ -60,21 +71,81 @@ max-same-clients = 2 tcp-port = 443 udp-port = 443 -# Accept connections using a socket file. The connections are -# forwarded without SSL/TLS. -listen-clear-file = /var/run/ocserv-conn.socket +# Accept connections using a socket file. It accepts HTTP +# connections (i.e., without SSL/TLS unlike its TCP counterpart), +# and uses it as the primary channel. That option cannot be +# combined with certificate authentication. +#listen-clear-file = /var/run/ocserv-conn.socket + +# The user the worker processes will be run as. It should be +# unique (no other services run as this user). +run-as-user = ocserv +run-as-group = ocserv + +# socket file used for IPC with occtl. You only need to set that, +# if you use more than a single servers. +#occtl-socket-file = /var/run/occtl.socket + +# socket file used for server IPC (worker-main), will be appended with .PID +# It must be accessible within the chroot environment (if any), so it is best +# specified relatively to the chroot directory. +socket-file = ocserv.sock + +# The default server directory. Does not require any devices present. +chroot-dir = /var/lib/ocserv + + +### All configuration options below this line are reloaded on a SIGHUP. +### The options above, will remain unchanged. + +# Whether to enable seccomp/Linux namespaces worker isolation. That restricts the number of +# system calls allowed to a worker process, in order to reduce damage from a +# bug in the worker process. It is available on Linux systems at a performance cost. +# The performance cost is roughly 2% overhead at transfer time (tested on a Linux 3.17.8). +isolate-workers = true + +# A banner to be displayed on clients +#banner = "Welcome" + +# Limit the number of clients. Unset or set to zero for unlimited. +#max-clients = 1024 +max-clients = 16 + +# Limit the number of identical clients (i.e., users connecting +# multiple times). Unset or set to zero for unlimited. +max-same-clients = 2 + +# When the server has a dynamic DNS address (that may change), +# should set that to true to ask the client to resolve again on +# reconnects. +#listen-host-is-dyndns = true + +# Limit the number of client connections to one every X milliseconds +# (X is the provided value). Set to zero for no limit. +#rate-limit-ms = 100 + +# Stats report time. The number of seconds after which each +# worker process will report its usage statistics (number of +# bytes transferred etc). This is useful when accounting like +# radius is in use. +#stats-report-time = 360 # Keepalive in seconds keepalive = 32400 # Dead peer detection in seconds. +# Note that when the client is behind a NAT this value +# needs to be short enough to prevent the NAT disassociating +# his UDP session from the port number. Otherwise the client +# could have his UDP connection stalled, for several minutes. dpd = 90 -# Dead peer detection for mobile clients. The needs to -# be much higher to prevent such clients being awaken too +# Dead peer detection for mobile clients. That needs to +# be higher to prevent such clients being awaken too # often by the DPD messages, and save battery. -# (clients that send the X-AnyConnect-Identifier-DeviceType) -#mobile-dpd = 1800 +# The mobile clients are distinguished from the header +# 'X-AnyConnect-Identifier-DeviceType'. +mobile-dpd = 1800 # MTU discovery (DPD must be enabled) try-mtu-discovery = false @@ -84,8 +155,11 @@ try-mtu-discovery = false # tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user # or pkcs11:object=my-vpn-key;object-type=private) # -# There may be multiple certificate and key pairs and each key -# should correspond to the preceding certificate. +# The server-cert file may contain a single certificate, or +# a sorted certificate chain. +# +# There may be multiple server-cert and server-key directives, +# but each key should correspond to the preceding certificate. server-cert = /etc/pki/ocserv/public/server.crt server-key = /etc/pki/ocserv/private/server.key @@ -119,7 +193,7 @@ ca-cert = /etc/pki/ocserv/cacerts/ca.crt # certificate. The object identifier should be part of the certificate's DN # Useful OIDs are: # CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 -#cert-user-oid = 0.9.2342.19200300.100.1.1 +cert-user-oid = 0.9.2342.19200300.100.1.1 # The object identifier that will be used to read the user group in the # client certificate. The object identifier should be part of the certificate's @@ -128,12 +202,38 @@ ca-cert = /etc/pki/ocserv/cacerts/ca.crt #cert-group-oid = 2.5.4.11 # The revocation list of the certificates issued by the 'ca-cert' above. +# See the manual to generate an empty CRL initially. #crl = /path/to/crl.pem -# GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-ARCFOUR-128" +# Uncomment this to enable compression negotiation (LZS, LZ4). +#compression = true -# To enforce perfect forward secrecy (PFS) on the main channel. +# Set the minimum size under which a packet will not be compressed. +# That is to allow low-latency for VoIP packets. The default size +# is 256 bytes. Modify it if the clients typically use compression +# as well of VoIP with codecs that exceed the default value. +#no-compress-limit = 256 + +# GnuTLS priority string; note that SSL 3.0 is disabled by default +# as there are no openconnect (and possibly anyconnect clients) using +# that protocol. The string below does not enforce perfect forward +# secrecy, in order to be compatible with legacy clients. +# +# Note that the most performant ciphersuites are the moment are the ones +# involving AES-GCM. These are very fast in x86 and x86-64 hardware, and +# in addition require no padding, thus taking full advantage of the MTU. +# For that to be taken advantage of, the openconnect client must be +# used, and the server must be compiled against GnuTLS 3.2.7 or later. +# Use "gnutls-cli --benchmark-tls-ciphers", to see the performance +# difference with AES_128_CBC_SHA1 (the default for anyconnect clients) +# in your system. + +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" + +# More combinations in priority strings are available, check +# http://gnutls.org/manual/html_node/Priority-Strings.html +# E.g., the string below enforces perfect forward secrecy (PFS) +# on the main channel. #tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" # The time (in seconds) that a client is allowed to stay connected prior @@ -150,7 +250,28 @@ auth-timeout = 40 # The time (in seconds) that a client is not allowed to reconnect after # a failed authentication attempt. -#min-reauth-time = 2 +min-reauth-time = 300 + +# Banning clients in ocserv works with a point system. IP addresses +# that get a score over that configured number are banned for +# min-reauth-time seconds. By default a wrong password attempt is 10 points, +# a KKDCP POST is 1 point, and a connection is 1 point. Note that +# due to difference processes being involved the count of points +# will not be real-time precise. +# +# Score banning cannot be reliably used when receiving proxied connections +# locally from an HTTP server (i.e., when listen-clear-file is used). +# +# Set to zero to disable. +max-ban-score = 50 + +# The time (in seconds) that all score kept for a client is reset. +ban-reset-time = 300 + +# In case you'd like to change the default points. +#ban-points-wrong-password = 10 +#ban-points-connection = 1 +#ban-points-kkdcp = 1 # Cookie timeout (in seconds) # Once a client is authenticated he's provided a cookie with @@ -180,41 +301,33 @@ rekey-time = 172800 # option. rekey-method = ssl -# Script to call when a client connects and obtains an IP -# Parameters are passed on the environment. +# Script to call when a client connects and obtains an IP. +# The following parameters are passed on the environment. # REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), +# IPV6_LOCAL (the IPv6 local address if there are both IPv4 and IPv6 +# assigned), IPV6_REMOVE (the IPv6 remote address), and # ID (a unique numeric ID); REASON may be "connect" or "disconnect". + +# The disconnect script will receive the additional values: STATS_BYTES_IN, +# STATS_BYTES_OUT, STATS_DURATION that contain a 64-bit counter of the bytes +# output from the tun device, and the duration of the session in seconds. + #connect-script = /usr/bin/ocserv-script #disconnect-script = /usr/bin/ocserv-script # UTMP -use-utmp = true +# Register the connected clients to utmp. This will allow viewing +# the connected clients using the command 'who'. +#use-utmp = true # Whether to enable support for the occtl tool (i.e., either through D-BUS, # or via a unix socket). use-occtl = true -# socket file used for IPC with occtl. You only need to set that, -# if you use more than a single servers. -#occtl-socket-file = /var/run/occtl.socket - - # PID file. It can be overriden in the command line. -#pid-file = /var/run/ocserv.pid - -# The default server directory. Does not require any devices present. -chroot-dir = /var/lib/ocserv - -# socket file used for IPC, will be appended with .PID -# It must be accessible within the chroot environment (if any) -socket-file = ocserv.sock - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). -run-as-user = ocserv -run-as-group = ocserv +pid-file = /var/run/ocserv.pid # Set the protocol-defined priority (SO_PRIORITY) for packets to # be sent. That is a number from 0 to 6 with 0 being the lowest @@ -231,7 +344,7 @@ run-as-group = ocserv # Network settings # -# The name of the tun device +# The name to use for the tun device device = vpns # Whether the generated IPs will be predictable, i.e., IP stays the @@ -241,32 +354,41 @@ predictable-ips = true # The default domain to be advertised default-domain = example.com -# The pool of addresses that leases will be given from. -ipv4-network = 192.168.1.0 -ipv4-netmask = 255.255.255.0 +# The pool of addresses that leases will be given from. If the leases +# are given via Radius, or via the explicit-ip? per-user config option then +# these network values should contain a network with at least a single +# address that will remain under the full control of ocserv (that is +# to be able to assign the local part of the tun device address). +#ipv4-network = 192.168.1.0 +#ipv4-netmask = 255.255.255.0 + +# An alternative way of specifying the network: +#ipv4-network = 192.168.1.0/24 + +# The IPv6 subnet that leases will be given from. +#ipv6-network = fda9:4efe:7e3b:03ea::/64 # The advertized DNS server. Use multiple lines for # multiple servers. # dns = fc00::4be0 -dns = 192.168.1.2 +#dns = 192.168.1.2 # The NBNS server (if any) #nbns = 192.168.1.3 -# The IPv6 subnet that leases will be given from. -#ipv6-network = fc00:: -#ipv6-prefix = 16 - # The domains over which the provided DNS should be used. Use # multiple lines for multiple domains. #split-dns = example.com # Prior to leasing any IP from the pool ping it to verify that # it is not in use by another (unrelated to this server) host. +# Only set to true, if there can be occupied addresses in the +# IP range for leases. ping-leases = false -# Unset to assign the default MTU of the device -# mtu = +# Use this option to enforce an MTU value to the incoming +# connections. Unset to use the default MTU of the TUN device. +#mtu = 1420 # Unset to enable bandwidth restrictions (in bytes/sec). The # setting here is global, but can also be set per user or per group. @@ -283,84 +405,111 @@ ping-leases = false # config-per-user/group or even connect and disconnect scripts. # # To set the server as the default gateway for the client just -# comment out all routes from the server. -#route = 192.168.1.0/255.255.255.0 -#route = 192.168.5.0/255.255.255.0 +# comment out all routes from the server, or use the special keyword +# 'default'. + +#route = 10.10.10.0/255.255.255.0 +#route = 192.168.0.0/255.255.0.0 #route = fef4:db8:1000:1001::/64 +# Subsets of the routes above that will not be routed by +# the server. + +#no-route = 192.168.5.0/255.255.255.0 + +# Groups that a client is allowed to select from. +# A client may belong in multiple groups, and in certain use-cases +# it is needed to switch between them. For these cases the client can +# select prior to authentication. Add multiple entries for multiple groups. +# The group may be followed by a user-friendly name in brackets. +#select-group = group1 +#select-group = group2[My special group] + +# The name of the (virtual) group that if selected it would assign the user +# to its default group. +#default-select-group = DEFAULT + +# Instead of specifying manually all the allowed groups, you may instruct +# ocserv to scan all available groups and include the full list. +#auto-select-group = true + # Configuration files that will be applied per user connection or # per group. Each file name on these directories must match the username # or the groupname. # The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, -# net-priority and cgroup. +# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, +# net-priority, deny-roaming, no-udp, user-profile, and cgroup. # # Note that the 'iroute' option allows to add routes on the server # based on a user or group. The syntax depends on the input accepted -# by the commands route-add-cmd and route-del-cmd (see below). +# by the commands route-add-cmd and route-del-cmd (see below). The no-udp +# is a boolean option (e.g., no-udp = true), and will prevent a UDP session +# for that specific user or group. #config-per-user = /etc/ocserv/config-per-user/ #config-per-group = /etc/ocserv/config-per-group/ # When config-per-xxx is specified and there is no group or user that # matches, then utilize the following configuration. - #default-user-config = /etc/ocserv/defaults/user.conf #default-group-config = /etc/ocserv/defaults/group.conf -# Groups that a client is allowed to select from. -# A client may belong in multiple groups, and in certain use-cases -# it is needed to switch between them. For these cases the client can -# select prior to authentication. Add multiple entries for multiple groups. -#select-group = group1 -#select-group = group2[My group 2] -#select-group = tost[The tost group] - -# The name of the group that if selected it would allow to use -# the assigned by default group. -#default-select-group = DEFAULT - -# Instead of specifying manually all the allowed groups, you may instruct -# ocserv to scan all available groups and include the full list. That -# option is only functional on plain authentication. -#auto-select-group = true - # The system command to use to setup a route. %{R} will be replaced with the # route/mask and %{D} with the (tun) device. # -# The following example is from linux systems. %{R} should be something -# like 192.168.2.0/24 +# The following example is from linux systems. %R should be something +# like 192.168.2.0/24 (the argument of iroute). -route-add-cmd = "ip route add %{R} dev %{D}" -route-del-cmd = "ip route delete %{R} dev %{D}" +#route-add-cmd = "ip route add %{R} dev %{D}" +#route-del-cmd = "ip route delete %{R} dev %{D}" -# This option allows to forward a proxy. The special strings '%{U}' +# This option allows to forward a proxy. The special keywords '%{U}' # and '%{G}', if present will be replaced by the username and group name. #proxy-url = http://example.com/ -#proxy-url = http://example.com/%{U}/%{G}/hello +#proxy-url = http://example.com/%{U}/ + +# This option allows you to specify a URL location where a client can +# post using MS-KKDCP, and the message will be forwarded to the provided +# KDC server. That is a translation URL between HTTP and Kerberos. +# In MIT kerberos you'll need to add in realms: +# EXAMPLE.COM = { +# kdc = https://ocserv.example.com/kerberos +# http_anchors = FILE:/etc/ocserv-ca.pem +# } +# This option is available if ocserv is compiled with GSSAPI support. + +#kkdcp = SERVER-PATH KERBEROS-REALM PROTOCOL@SERVER:PORT +#kkdcp = /kerberos EXAMPLE.COM udp@127.0.0.1:88 +#kkdcp = /kerberos-tcp EXAMPLE.COM tcp@127.0.0.1:88 # # The following options are for (experimental) AnyConnect client # compatibility. +# This option must be set to true to support legacy CISCO clients. +# A side effect of this option is that it will no longer be required +# for clients to present their certificate on every connection. +# That is they may resume a cookie without presenting a certificate +# (when certificate authentication is used). +cisco-client-compat = true + # Client profile xml. A sample file exists in doc/profile.xml. +# It is required by some of the CISCO clients. # This file must be accessible from inside the worker's chroot. -# It is not used by the openconnect client. user-profile = profile.xml # Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. +# be within any chroot environment. Normally you don't need +# to use this option. #binary-files = /path/to/binaries -# Unless set to false it is required for clients to present their -# certificate even if they are authenticating via a previously granted -# cookie and complete their authentication in the same TCP connection. -# Legacy CISCO clients do not do that, and thus this option should be -# set for them. -cisco-client-compat = true - #Advanced options # Option to allow sending arbitrary custom headers to the client after -# authentication and prior to VPN tunnel establishment. +# authentication and prior to VPN tunnel establishment. You shouldn't +# need to use this option normally; if you do and you think that +# this may help others, please send your settings and reason to +# the openconnect mailing list. The special keywords '%{U}' +# and '%{G}', if present will be replaced by the username and group name. #custom-header = "X-My-Header: hi there" + diff --git a/ocserv.spec b/ocserv.spec index f9d857f..bab4216 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.8.9 -Release: 4%{?dist} +Version: 0.10.2 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -32,7 +32,7 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen -%ifarch x86_64 #%{ix86} +%ifarch x86_64 %{ix86} BuildRequires: libseccomp-devel %endif BuildRequires: pcllib-devel @@ -40,6 +40,11 @@ BuildRequires: libtalloc-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf +BuildRequires: krb5-devel +BuildRequires: libtasn1-devel +BuildRequires: gperf +BuildRequires: freeradius-client-devel +BuildRequires: lz4-devel # we don't build with dbus support #BuildRequires: dbus-devel @@ -151,6 +156,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Mar 30 2015 Nikos Mavrogiannopoulos - 0.10.2-1 +- new upstream release + * Thu Jan 29 2015 Nikos Mavrogiannopoulos - 0.8.9-4 - only enable seccomp in x86-64. It seems to be broken in x86: http://sourceforge.net/p/libseccomp/mailman/message/33275762/ diff --git a/sources b/sources index 3900854..bbf6d06 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -5ea9824e39ca125260b67a1379f42036 ocserv-0.8.9.tar.xz.sig -cd935cc89bffac75c825e66ef71f6a73 ocserv-0.8.9.tar.xz +32ce2c2a00a97ab7c27e571aae207b2d ocserv-0.10.2.tar.xz +5caf016f3d2362ec567bef4861d65d1b ocserv-0.10.2.tar.xz.sig From 2cc1a37e20205a0903f1a8c3503f5dcac9479676 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 31 Mar 2015 10:58:12 +0200 Subject: [PATCH 28/87] do not require libtasn1 3.9 for building --- ocserv-0.10.2-libtasn1.patch | 13 +++++++++++++ ocserv.spec | 6 ++++-- 2 files changed, 17 insertions(+), 2 deletions(-) create mode 100644 ocserv-0.10.2-libtasn1.patch diff --git a/ocserv-0.10.2-libtasn1.patch b/ocserv-0.10.2-libtasn1.patch new file mode 100644 index 0000000..d909db3 --- /dev/null +++ b/ocserv-0.10.2-libtasn1.patch @@ -0,0 +1,13 @@ +diff --git a/configure.ac b/configure.ac +index 2f4f5a5..b006d9a 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -392,7 +392,7 @@ if test "$test_for_gssapi" = yes;then + PKG_CHECK_MODULES([LIBKRB5], [krb5-gssapi], [ + enable_gssapi=yes + AC_DEFINE([HAVE_GSSAPI], [], [GSSAPI was found]) +-PKG_CHECK_MODULES(LIBTASN1, [libtasn1 >= 3.9]) ++PKG_CHECK_MODULES(LIBTASN1, [libtasn1 >= 3.8]) + ], + [ + AC_MSG_WARN([[ diff --git a/ocserv.spec b/ocserv.spec index bab4216..ab14b01 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -17,6 +17,7 @@ Source4: PACKAGE-LICENSING Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey Source8: ocserv-script +Patch0: ocserv-0.10.2-libtasn1.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -39,7 +40,7 @@ BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel -BuildRequires: automake, autoconf +BuildRequires: automake autoconf libtool BuildRequires: krb5-devel BuildRequires: libtasn1-devel BuildRequires: gperf @@ -84,9 +85,10 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* touch src/*.proto +%patch0 -p1 -b .libtasn1 %build - +autoreconf -ifv %configure \ --enable-systemd From abbf86337ce6b87e0dc9e58c1ec456faa437ba0a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 31 Mar 2015 13:45:11 +0200 Subject: [PATCH 29/87] made detection of gnutls capabilities dynamic --- ocserv-0.10.2-dynamic.patch | 89 +++++++++++++++++++++++++++++++++++++ ocserv.spec | 7 ++- 2 files changed, 95 insertions(+), 1 deletion(-) create mode 100644 ocserv-0.10.2-dynamic.patch diff --git a/ocserv-0.10.2-dynamic.patch b/ocserv-0.10.2-dynamic.patch new file mode 100644 index 0000000..032a2d3 --- /dev/null +++ b/ocserv-0.10.2-dynamic.patch @@ -0,0 +1,89 @@ +diff --git a/src/tlslib.c b/src/tlslib.c +index 86a2413..1aabd9f 100644 +--- a/src/tlslib.c ++++ b/src/tlslib.c +@@ -828,6 +828,7 @@ unsigned i; + return retval; + } + ++ + size_t tls_get_overhead(gnutls_protocol_t version, gnutls_cipher_algorithm_t cipher, gnutls_mac_algorithm_t mac) + { + #if GNUTLS_VERSION_NUMBER >= 0x030207 +@@ -840,9 +841,7 @@ unsigned block_size; + switch(version) { + case GNUTLS_DTLS0_9: + case GNUTLS_DTLS1_0: +-#if GNUTLS_VERSION_NUMBER >= 0x030200 + case GNUTLS_DTLS1_2: +-#endif + overhead += 13; + break; + default: +diff --git a/src/tlslib.h b/src/tlslib.h +index 7fc71af..8c20150 100644 +--- a/src/tlslib.h ++++ b/src/tlslib.h +@@ -27,6 +27,10 @@ + #include + #include + ++# if GNUTLS_VERSION_NUMBER < 0x030200 ++# define GNUTLS_DTLS1_2 202 ++# endif ++ + typedef struct + { + struct htable *ht; +diff --git a/src/worker-http.c b/src/worker-http.c +index e7161e2..b8de179 100644 +--- a/src/worker-http.c ++++ b/src/worker-http.c +@@ -76,7 +76,6 @@ const static struct known_urls_st known_urls[] = { + * HTTP headers (WTF), and the compression negotiation. + */ + static const dtls_ciphersuite_st ciphersuites[] = { +-#if GNUTLS_VERSION_NUMBER >= 0x030207 + { + .oc_name = CS_AES128_GCM, + .gnutls_name = +@@ -84,6 +83,7 @@ static const dtls_ciphersuite_st ciphersuites[] = { + .gnutls_version = GNUTLS_DTLS1_2, + .gnutls_mac = GNUTLS_MAC_AEAD, + .gnutls_cipher = GNUTLS_CIPHER_AES_128_GCM, ++ .txt_version = "3.2.7", + .server_prio = 90}, + { + .oc_name = CS_AES256_GCM, +@@ -93,8 +93,8 @@ static const dtls_ciphersuite_st ciphersuites[] = { + .gnutls_mac = GNUTLS_MAC_AEAD, + .gnutls_cipher = GNUTLS_CIPHER_AES_256_GCM, + .server_prio = 80, ++ .txt_version = "3.2.7", + }, +-#endif + { + .oc_name = "AES128-SHA", + .gnutls_name = +@@ -256,6 +256,9 @@ void header_value_check(struct worker_st *ws, struct http_req_st *req) + i < sizeof(ciphersuites) / sizeof(ciphersuites[0]); + i++) { + if (strcmp(token, ciphersuites[i].oc_name) == 0) { ++ if (ciphersuites[i].txt_version != NULL && gnutls_check_version(ciphersuites[i].txt_version) == NULL) ++ continue; /* not supported */ ++ + if (cand == NULL || + cand->server_prio < + ciphersuites[i].server_prio) { +diff --git a/src/worker.h b/src/worker.h +index 9584532..d4f31f4 100644 +--- a/src/worker.h ++++ b/src/worker.h +@@ -102,6 +102,7 @@ typedef struct dtls_ciphersuite_st { + unsigned gnutls_cipher; + unsigned gnutls_mac; + unsigned gnutls_version; ++ const char *txt_version; + } dtls_ciphersuite_st; + + #ifdef HAVE_GSSAPI diff --git a/ocserv.spec b/ocserv.spec index ab14b01..c0d9620 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.10.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -18,6 +18,7 @@ Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey Source8: ocserv-script Patch0: ocserv-0.10.2-libtasn1.patch +Patch1: ocserv-0.10.2-dynamic.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -86,6 +87,7 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* touch src/*.proto %patch0 -p1 -b .libtasn1 +%patch1 -p1 -b .dynamic %build autoreconf -ifv @@ -158,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Mar 30 2015 Nikos Mavrogiannopoulos - 0.10.2-2 +- Detection of gnutls capabilities is done dynamically + * Mon Mar 30 2015 Nikos Mavrogiannopoulos - 0.10.2-1 - new upstream release From eaa4fcb68be5676a1f36419e49a50a4a80ef4334 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 25 May 2015 11:53:03 +0200 Subject: [PATCH 30/87] updated to 0.10.5 --- ocserv-0.10.2-dynamic.patch | 89 ------------------------------------ ocserv-0.10.2-libtasn1.patch | 13 ------ ocserv.conf | 41 ++++++++++------- ocserv.spec | 21 ++++----- sources | 4 +- 5 files changed, 36 insertions(+), 132 deletions(-) delete mode 100644 ocserv-0.10.2-dynamic.patch delete mode 100644 ocserv-0.10.2-libtasn1.patch diff --git a/ocserv-0.10.2-dynamic.patch b/ocserv-0.10.2-dynamic.patch deleted file mode 100644 index 032a2d3..0000000 --- a/ocserv-0.10.2-dynamic.patch +++ /dev/null @@ -1,89 +0,0 @@ -diff --git a/src/tlslib.c b/src/tlslib.c -index 86a2413..1aabd9f 100644 ---- a/src/tlslib.c -+++ b/src/tlslib.c -@@ -828,6 +828,7 @@ unsigned i; - return retval; - } - -+ - size_t tls_get_overhead(gnutls_protocol_t version, gnutls_cipher_algorithm_t cipher, gnutls_mac_algorithm_t mac) - { - #if GNUTLS_VERSION_NUMBER >= 0x030207 -@@ -840,9 +841,7 @@ unsigned block_size; - switch(version) { - case GNUTLS_DTLS0_9: - case GNUTLS_DTLS1_0: --#if GNUTLS_VERSION_NUMBER >= 0x030200 - case GNUTLS_DTLS1_2: --#endif - overhead += 13; - break; - default: -diff --git a/src/tlslib.h b/src/tlslib.h -index 7fc71af..8c20150 100644 ---- a/src/tlslib.h -+++ b/src/tlslib.h -@@ -27,6 +27,10 @@ - #include - #include - -+# if GNUTLS_VERSION_NUMBER < 0x030200 -+# define GNUTLS_DTLS1_2 202 -+# endif -+ - typedef struct - { - struct htable *ht; -diff --git a/src/worker-http.c b/src/worker-http.c -index e7161e2..b8de179 100644 ---- a/src/worker-http.c -+++ b/src/worker-http.c -@@ -76,7 +76,6 @@ const static struct known_urls_st known_urls[] = { - * HTTP headers (WTF), and the compression negotiation. - */ - static const dtls_ciphersuite_st ciphersuites[] = { --#if GNUTLS_VERSION_NUMBER >= 0x030207 - { - .oc_name = CS_AES128_GCM, - .gnutls_name = -@@ -84,6 +83,7 @@ static const dtls_ciphersuite_st ciphersuites[] = { - .gnutls_version = GNUTLS_DTLS1_2, - .gnutls_mac = GNUTLS_MAC_AEAD, - .gnutls_cipher = GNUTLS_CIPHER_AES_128_GCM, -+ .txt_version = "3.2.7", - .server_prio = 90}, - { - .oc_name = CS_AES256_GCM, -@@ -93,8 +93,8 @@ static const dtls_ciphersuite_st ciphersuites[] = { - .gnutls_mac = GNUTLS_MAC_AEAD, - .gnutls_cipher = GNUTLS_CIPHER_AES_256_GCM, - .server_prio = 80, -+ .txt_version = "3.2.7", - }, --#endif - { - .oc_name = "AES128-SHA", - .gnutls_name = -@@ -256,6 +256,9 @@ void header_value_check(struct worker_st *ws, struct http_req_st *req) - i < sizeof(ciphersuites) / sizeof(ciphersuites[0]); - i++) { - if (strcmp(token, ciphersuites[i].oc_name) == 0) { -+ if (ciphersuites[i].txt_version != NULL && gnutls_check_version(ciphersuites[i].txt_version) == NULL) -+ continue; /* not supported */ -+ - if (cand == NULL || - cand->server_prio < - ciphersuites[i].server_prio) { -diff --git a/src/worker.h b/src/worker.h -index 9584532..d4f31f4 100644 ---- a/src/worker.h -+++ b/src/worker.h -@@ -102,6 +102,7 @@ typedef struct dtls_ciphersuite_st { - unsigned gnutls_cipher; - unsigned gnutls_mac; - unsigned gnutls_version; -+ const char *txt_version; - } dtls_ciphersuite_st; - - #ifdef HAVE_GSSAPI diff --git a/ocserv-0.10.2-libtasn1.patch b/ocserv-0.10.2-libtasn1.patch deleted file mode 100644 index d909db3..0000000 --- a/ocserv-0.10.2-libtasn1.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 2f4f5a5..b006d9a 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -392,7 +392,7 @@ if test "$test_for_gssapi" = yes;then - PKG_CHECK_MODULES([LIBKRB5], [krb5-gssapi], [ - enable_gssapi=yes - AC_DEFINE([HAVE_GSSAPI], [], [GSSAPI was found]) --PKG_CHECK_MODULES(LIBTASN1, [libtasn1 >= 3.9]) -+PKG_CHECK_MODULES(LIBTASN1, [libtasn1 >= 3.8]) - ], - [ - AC_MSG_WARN([[ diff --git a/ocserv.conf b/ocserv.conf index ac6b87f..035d9ba 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -19,20 +19,20 @@ # One entry must be listed per line, and 'ocpasswd' should be used # to generate password entries. # -# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name]: +# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name,override-interim-updates=false]: # The radius option requires specifying freeradius-client configuration # file. If the groupconfig option is set, then config-per-user will be overriden, -# and all configuration will be read from radius. The supported atributes for -# radius configuration are: -# Group-Name, Framed-IPv6-Address, Framed-IPv6-Prefix, DNS-Server-IPv6-Address, -# Framed-IP-Address, Framed-IP-Netmask, MS-Primary-DNS-Server, MS-Secondary-DNS-Server +# and all configuration will be read from radius. The 'override-interim-updates' if set to +# true will ignore Acct-Interim-Interval from the server and 'stats-report-time' will be considered. # -# gssapi[keytab=/etc/key.tab,require-local-user-map=false] +# gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900] # The gssapi option allows to use authentication methods supported by GSSAPI, # such as Kerberos tickets with ocserv. It should be best used as an alternative # to PAM (i.e., have pam in auth and gssapi in enable-auth), to allow users with # tickets and without tickets to login. The default value for require-local-user-map -# is true. +# is true. The 'tgt-freshness-time' if set, it would require the TGT tickets presented +# to have been issued within the provided number of seconds. That option is used to +# restrict logins even if the KDC provides long time TGT tickets. auth = "pam" #auth = "pam[gid-min=1000]" @@ -45,7 +45,7 @@ auth = "pam" # will be sufficient to login. #enable-auth = certificate #enable-auth = gssapi -#enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true]" +#enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]" # Accounting methods available: # pam: can only be combined with PAM authentication method, it provides @@ -228,7 +228,8 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients) # in your system. -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" +tls-priorities = "@SYSTEM" # More combinations in priority strings are available, check # http://gnutls.org/manual/html_node/Priority-Strings.html @@ -244,6 +245,10 @@ auth-timeout = 40 # before being disconnected. Unset to disable. #idle-timeout = 1200 +# The time (in seconds) that a client is allowed to stay connected +# Unset to disable. +#session-timeout = 86400 + # The time (in seconds) that a mobile client is allowed to stay idle (no # traffic) before being disconnected. Unset to disable. #mobile-idle-timeout = 2400 @@ -282,6 +287,11 @@ ban-reset-time = 300 # between different networks. cookie-timeout = 300 +# If this is enabled (not recommended) the cookies will stay +# valid even after a user manually disconnects, and until they +# expire. This may improve roaming with some broken clients. +#persistent-cookies = true + # Whether roaming is allowed, i.e., if true a cookie is # restricted to a single IP address and cannot be re-used # from a different IP. @@ -289,7 +299,8 @@ deny-roaming = false # ReKey time (in seconds) # ocserv will ask the client to refresh keys periodically once -# this amount of seconds is elapsed. Set to zero to disable. +# this amount of seconds is elapsed. Set to zero to disable (note +# that, some clients fail if rekey is disabled). rekey-time = 172800 # ReKey method @@ -437,8 +448,9 @@ ping-leases = false # per group. Each file name on these directories must match the username # or the groupname. # The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, -# net-priority, deny-roaming, no-udp, user-profile, and cgroup. +# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, no-route, +# explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, +# user-profile, cgroup, stats-report-time, and session-timeout. # # Note that the 'iroute' option allows to add routes on the server # based on a user or group. The syntax depends on the input accepted @@ -498,11 +510,6 @@ cisco-client-compat = true # This file must be accessible from inside the worker's chroot. user-profile = profile.xml -# Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. Normally you don't need -# to use this option. -#binary-files = /path/to/binaries - #Advanced options # Option to allow sending arbitrary custom headers to the client after diff --git a/ocserv.spec b/ocserv.spec index c0d9620..061352d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.2 -Release: 2%{?dist} +Version: 0.10.5 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -17,8 +17,6 @@ Source4: PACKAGE-LICENSING Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey Source8: ocserv-script -Patch0: ocserv-0.10.2-libtasn1.patch -Patch1: ocserv-0.10.2-dynamic.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -32,8 +30,11 @@ BuildRequires: systemd-devel BuildRequires: autogen-libopts-devel BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel +BuildRequires: krb5-devel +BuildRequires: libtasn1-devel BuildRequires: readline-devel BuildRequires: autogen +BuildRequires: gperf %ifarch x86_64 %{ix86} BuildRequires: libseccomp-devel %endif @@ -41,10 +42,7 @@ BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel -BuildRequires: automake autoconf libtool -BuildRequires: krb5-devel -BuildRequires: libtasn1-devel -BuildRequires: gperf +BuildRequires: automake, autoconf BuildRequires: freeradius-client-devel BuildRequires: lz4-devel @@ -86,11 +84,9 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* touch src/*.proto -%patch0 -p1 -b .libtasn1 -%patch1 -p1 -b .dynamic %build -autoreconf -ifv + %configure \ --enable-systemd @@ -160,6 +156,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon May 25 2015 Nikos Mavrogiannopoulos - 0.10.5-1 +- new upstream release (#1215326) + * Mon Mar 30 2015 Nikos Mavrogiannopoulos - 0.10.2-2 - Detection of gnutls capabilities is done dynamically diff --git a/sources b/sources index bbf6d06..30c22ea 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -32ce2c2a00a97ab7c27e571aae207b2d ocserv-0.10.2.tar.xz -5caf016f3d2362ec567bef4861d65d1b ocserv-0.10.2.tar.xz.sig +7396cedfa7071a4c6d5d243435ce663c ocserv-0.10.5.tar.xz.sig +17ee861f352d6ef7cd33114819b215ba ocserv-0.10.5.tar.xz From 7330ac41f98340aee120012d125232dd65ec6449 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 25 May 2015 12:45:22 +0200 Subject: [PATCH 31/87] depend on vim-minimal, without it, it doesn't compile in EPEL7 --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 061352d..96a1b29 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -45,6 +45,7 @@ BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf BuildRequires: freeradius-client-devel BuildRequires: lz4-devel +BuildRequires: vim-minimal # we don't build with dbus support #BuildRequires: dbus-devel From 78c9d160c6e621b5431d36506ef53188ee7088d8 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 23 Jun 2015 09:45:24 +0200 Subject: [PATCH 32/87] Corrected the ciphers' priorities string --- ocserv.conf | 3 +-- ocserv.spec | 5 ++++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 035d9ba..159424a 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -228,8 +228,7 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients) # in your system. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" -tls-priorities = "@SYSTEM" +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" # More combinations in priority strings are available, check # http://gnutls.org/manual/html_node/Priority-Strings.html diff --git a/ocserv.spec b/ocserv.spec index 96a1b29..07141e0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.10.5 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -157,6 +157,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Tue Jun 23 2015 Nikos Mavrogiannopoulos - 0.10.5-2 +- Corrected the ciphers' priorities string + * Mon May 25 2015 Nikos Mavrogiannopoulos - 0.10.5-1 - new upstream release (#1215326) From 592773825f8fc771250c08761e0b91c7c09d6fbf Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 2 Jul 2015 09:34:01 +0200 Subject: [PATCH 33/87] updated to 0.10.6 Resolves: rhbz#1238499 --- .gitignore | 2 ++ ocserv.conf | 15 ++++++++++++--- ocserv.spec | 7 +++++-- sources | 4 ++-- 4 files changed, 21 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index 9579ec4..4842a17 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,5 @@ /ocserv-0.8.9.tar.xz /ocserv-0.10.2.tar.xz /ocserv-0.10.2.tar.xz.sig +/ocserv-0.10.6.tar.xz +/ocserv-0.10.6.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 159424a..2176e6a 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -43,8 +43,8 @@ auth = "pam" # Specify alternative authentication methods that are sufficient # for authentication. That is, if set, any of the methods enabled # will be sufficient to login. -#enable-auth = certificate -#enable-auth = gssapi +#enable-auth = "certificate" +#enable-auth = "gssapi" #enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]" # Accounting methods available: @@ -178,12 +178,21 @@ server-key = /etc/pki/ocserv/private/server.key # Make sure that you replace the following file in an atomic way. #ocsp-response = /path/to/ocsp.der -# In case PKCS #11 or TPM keys are used the PINs should be available +# In case PKCS #11, TPM or encrypted keys are used the PINs should be available # in files. The srk-pin-file is applicable to TPM keys only, and is the # storage root key. #pin-file = /path/to/pin.txt #srk-pin-file = /path/to/srkpin.txt +# The password or PIN needed to unlock the key in server-key file. +# Only needed if the file is encrypted or a PKCS #11 object. This +# is an alternative method to pin-file. +#key-pin = 1234 + +# The SRK PIN for TPM. +# This is an alternative method to srk-pin-file. +#srk-pin = 1234 + # The Certificate Authority that will be used to verify # client certificates (public keys) if certificate authentication # is set. diff --git a/ocserv.spec b/ocserv.spec index 07141e0..44b558d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.5 -Release: 2%{?dist} +Version: 0.10.6 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -157,6 +157,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jul 2 2015 Nikos Mavrogiannopoulos - 0.10.6-1 +- new upstream release (#1238499) + * Tue Jun 23 2015 Nikos Mavrogiannopoulos - 0.10.5-2 - Corrected the ciphers' priorities string diff --git a/sources b/sources index 30c22ea..1496e43 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -7396cedfa7071a4c6d5d243435ce663c ocserv-0.10.5.tar.xz.sig -17ee861f352d6ef7cd33114819b215ba ocserv-0.10.5.tar.xz +b99c74b781a180348f3a3240940fc838 ocserv-0.10.6.tar.xz +1cc410cd9ccaa796f36180d10bdeb3a7 ocserv-0.10.6.tar.xz.sig From e831398aae571fc81f029d32cbcd48489f7cf37e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 2 Jul 2015 10:03:37 +0200 Subject: [PATCH 34/87] Allow compilation with rhel7 glibc --- ocserv-0.10.6-path-mtu.patch | 13 +++++++++++++ ocserv.spec | 4 ++++ 2 files changed, 17 insertions(+) create mode 100644 ocserv-0.10.6-path-mtu.patch diff --git a/ocserv-0.10.6-path-mtu.patch b/ocserv-0.10.6-path-mtu.patch new file mode 100644 index 0000000..8f54ce8 --- /dev/null +++ b/ocserv-0.10.6-path-mtu.patch @@ -0,0 +1,13 @@ +diff --git a/src/worker-vpn.c b/src/worker-vpn.c +index 7765e84..cf2a6b6 100644 +--- a/src/worker-vpn.c ++++ b/src/worker-vpn.c +@@ -46,7 +46,7 @@ + #include + #include + +-#ifdef __linux__ ++#if 0 + /* for IPV6_PATHMTU */ + # include + #endif diff --git a/ocserv.spec b/ocserv.spec index 44b558d..8d698fd 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -17,6 +17,7 @@ Source4: PACKAGE-LICENSING Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey Source8: ocserv-script +Patch0: ocserv-0.10.6-path-mtu.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -74,6 +75,9 @@ to provide the secure VPN service. %prep %setup -q + +%patch0 -p1 -b .path-mtu + rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/ rm -rf src/ccan/talloc From e0d087fcc767ecd2b3fd3f2267b758cebd988d41 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 9 Jul 2015 12:13:38 +0200 Subject: [PATCH 35/87] corrected JSON output in occtl --- ocserv-0.10.6-json.patch | 29 +++++++++++++++++++++++++++++ ocserv.spec | 7 ++++++- 2 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 ocserv-0.10.6-json.patch diff --git a/ocserv-0.10.6-json.patch b/ocserv-0.10.6-json.patch new file mode 100644 index 0000000..4afb8ea --- /dev/null +++ b/ocserv-0.10.6-json.patch @@ -0,0 +1,29 @@ +diff --git a/src/occtl-print.c b/src/occtl-print.c +index 1441cd6..8ff297e 100644 +--- a/src/occtl-print.c ++++ b/src/occtl-print.c +@@ -47,9 +47,9 @@ int print_list_entries(FILE* out, cmd_params_st *params, const char* name, char + tmp = val[i]; + if (tmp != NULL) { + if (i==0) +- fprintf(out, "%s", tmp); ++ fprintf(out, "\"%s\"", tmp); + else +- fprintf(out, ", %s", tmp); ++ fprintf(out, ", \"%s\"", tmp); + } + } + fprintf(out, "]%s\n", have_more?",":""); +diff --git a/src/occtl-unix.c b/src/occtl-unix.c +index 6df5a1e..d6b28f3 100644 +--- a/src/occtl-unix.c ++++ b/src/occtl-unix.c +@@ -254,7 +254,7 @@ int handle_status_cmd(struct unix_ctx *ctx, const char *arg, cmd_params_st *para + print_single_value_int(stdout, params, "TLS DB entries", rep->stored_tls_sessions, 1); + print_separator(stdout, params); + print_single_value_int(stdout, params, "Server PID", rep->pid, 1); +- print_single_value_int(stdout, params, "Sec-mod PID", rep->sec_mod_pid, 1); ++ print_single_value_int(stdout, params, "Sec-mod PID", rep->sec_mod_pid, 0); + print_end_block(stdout, params, 0); + + status_rep__free_unpacked(rep, &pa); diff --git a/ocserv.spec b/ocserv.spec index 8d698fd..7cfaaf5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.10.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -18,6 +18,7 @@ Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey Source8: ocserv-script Patch0: ocserv-0.10.6-path-mtu.patch +Patch1: ocserv-0.10.6-json.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -77,6 +78,7 @@ to provide the secure VPN service. %setup -q %patch0 -p1 -b .path-mtu +%patch1 -p1 -b .json rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/ @@ -161,6 +163,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Wed Jul 15 2015 Nikos Mavrogiannopoulos - 0.10.6-2 +- corrected JSON output + * Thu Jul 2 2015 Nikos Mavrogiannopoulos - 0.10.6-1 - new upstream release (#1238499) From 8642355591d902de3f4b6ab117e212c4b71aab3d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 7 Sep 2015 17:36:05 +0200 Subject: [PATCH 36/87] updated to 0.10.8 --- .gitignore | 4 ++++ ocserv.conf | 4 ---- ocserv.spec | 12 +++++------- sources | 4 ++-- 4 files changed, 11 insertions(+), 13 deletions(-) diff --git a/.gitignore b/.gitignore index 4842a17..292c2e8 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,7 @@ /ocserv-0.10.2.tar.xz.sig /ocserv-0.10.6.tar.xz /ocserv-0.10.6.tar.xz.sig +/ocserv-0.10.7.tar.xz.sig +/ocserv-0.10.7.tar.xz +/ocserv-0.10.8.tar.xz.sig +/ocserv-0.10.8.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 2176e6a..0afe7d1 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -48,14 +48,10 @@ auth = "pam" #enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]" # Accounting methods available: -# pam: can only be combined with PAM authentication method, it provides -# a session opened using PAM. -# # radius: can be combined with any authentication method, it provides # radius accounting to available users (see also stats-report-time). # # Only one accounting method can be specified. -#acct = "pam" #acct = "radius[config=/etc/radiusclient/radiusclient.conf]" # Use listen-host to limit to specific IPs or to the IPs of a provided diff --git a/ocserv.spec b/ocserv.spec index 7cfaaf5..3e3c3d6 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.6 -Release: 2%{?dist} +Version: 0.10.8 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -17,8 +17,6 @@ Source4: PACKAGE-LICENSING Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey Source8: ocserv-script -Patch0: ocserv-0.10.6-path-mtu.patch -Patch1: ocserv-0.10.6-json.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -77,9 +75,6 @@ to provide the secure VPN service. %prep %setup -q -%patch0 -p1 -b .path-mtu -%patch1 -p1 -b .json - rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/ rm -rf src/ccan/talloc @@ -163,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Sep 7 2015 Nikos Mavrogiannopoulos - 0.10.8-1 +- new upstream release (#1260327) + * Wed Jul 15 2015 Nikos Mavrogiannopoulos - 0.10.6-2 - corrected JSON output diff --git a/sources b/sources index 1496e43..e8a8158 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -b99c74b781a180348f3a3240940fc838 ocserv-0.10.6.tar.xz -1cc410cd9ccaa796f36180d10bdeb3a7 ocserv-0.10.6.tar.xz.sig +ffc602ecfb35df216874248eec5ddb85 ocserv-0.10.8.tar.xz.sig +665b854377850db535271098a37213f1 ocserv-0.10.8.tar.xz From c559f03b1bdbac765bbf24f37ae9e49632cce273 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 17 Sep 2015 11:47:52 +0200 Subject: [PATCH 37/87] compile ocserv using radcli --- ocserv.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 3e3c3d6..19d02f7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.10.8 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -43,7 +43,7 @@ BuildRequires: libtalloc-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf -BuildRequires: freeradius-client-devel +BuildRequires: radcli-devel BuildRequires: lz4-devel BuildRequires: vim-minimal @@ -158,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Sep 17 2015 Nikos Mavrogiannopoulos - 0.10.8-2 +- compile ocserv using radcli + * Mon Sep 7 2015 Nikos Mavrogiannopoulos - 0.10.8-1 - new upstream release (#1260327) From 238056a1f6f5be8607868d09018659f91455f320 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 8 Oct 2015 13:23:49 +0200 Subject: [PATCH 38/87] updated to 0.10.9 --- .gitignore | 2 ++ ocserv.conf | 13 ++++++++++--- ocserv.spec | 9 ++++++--- sources | 4 ++-- 4 files changed, 20 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 292c2e8..d2dab91 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,5 @@ /ocserv-0.10.7.tar.xz /ocserv-0.10.8.tar.xz.sig /ocserv-0.10.8.tar.xz +/ocserv-0.10.9.tar.xz.sig +/ocserv-0.10.9.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 0afe7d1..2b1be5a 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -12,12 +12,14 @@ # This enabled PAM authentication of the user. The gid-min option is used # by auto-select-group option, in order to select the minimum valid group ID. # -# plain[passwd=/etc/ocserv/ocpasswd] +# plain[passwd=/etc/ocserv/ocpasswd,otp=/etc/ocserv/users.otp] # The plain option requires specifying a password file which contains # entries of the following format. # "username:groupname1,groupname2:encoded-password" # One entry must be listed per line, and 'ocpasswd' should be used -# to generate password entries. +# to generate password entries. The 'otp' suboption allows to specify +# an oath password file to be used for one time passwords; the format of +# the file is described in https://code.google.com/p/mod-authn-otp/wiki/UsersFile # # radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name,override-interim-updates=false]: # The radius option requires specifying freeradius-client configuration @@ -36,7 +38,7 @@ auth = "pam" #auth = "pam[gid-min=1000]" -#auth = "plain[passwd=./sample.passwd]" +#auth = "plain[passwd=./sample.passwd,otp=./sample.otp]" #auth = "certificate" #auth = "radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true]" @@ -51,6 +53,11 @@ auth = "pam" # radius: can be combined with any authentication method, it provides # radius accounting to available users (see also stats-report-time). # +# pam: can be combined with any authentication method, it provides +# a validation of the connecting user's name using PAM. It is +# superfluous to use this method when authentication is already +# PAM. +# # Only one accounting method can be specified. #acct = "radius[config=/etc/radiusclient/radiusclient.conf]" diff --git a/ocserv.spec b/ocserv.spec index 19d02f7..481c132 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.8 -Release: 2%{?dist} +Version: 0.10.9 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -144,7 +144,7 @@ rm -rf %{buildroot} %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf %config(noreplace) %{_sysconfdir}/pam.d/ocserv -%doc AUTHORS ChangeLog NEWS COPYING LICENSE README TODO PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* %{_mandir}/man8/occtl.8* @@ -158,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Oct 8 2015 Nikos Mavrogiannopoulos - 0.10.9-1 +- new upstream release (#1269479) + * Thu Sep 17 2015 Nikos Mavrogiannopoulos - 0.10.8-2 - compile ocserv using radcli diff --git a/sources b/sources index e8a8158..34833c2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -ffc602ecfb35df216874248eec5ddb85 ocserv-0.10.8.tar.xz.sig -665b854377850db535271098a37213f1 ocserv-0.10.8.tar.xz +650c80e96ef429f34787347a59476d07 ocserv-0.10.9.tar.xz.sig +74834c59aa96beaa222c21ee6521adb2 ocserv-0.10.9.tar.xz From cd3b8638e70b45f2aff92b32abf033cc55d93244 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 30 Nov 2015 16:59:06 +0100 Subject: [PATCH 39/87] updated to 0.10.10 --- .gitignore | 2 ++ ocserv.conf | 19 +++++++++++++++++++ ocserv.spec | 6 +++++- sources | 4 ++-- 4 files changed, 28 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d2dab91..0c9a132 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,5 @@ /ocserv-0.10.8.tar.xz /ocserv-0.10.9.tar.xz.sig /ocserv-0.10.9.tar.xz +/ocserv-0.10.10.tar.xz.sig +/ocserv-0.10.10.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 2b1be5a..7039b1c 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -390,6 +390,13 @@ default-domain = example.com # The IPv6 subnet that leases will be given from. #ipv6-network = fda9:4efe:7e3b:03ea::/64 +# Specify the size of the network to provide to clients. It is +# generally recommended to provide clients with a /64 network in +# IPv6, but any subnet may be specified. To provide clients only +# with a single IP use the prefix 128. +#ipv6-subnet-prefix = 128 +#ipv6-subnet-prefix = 64 + # The advertized DNS server. Use multiple lines for # multiple servers. # dns = fc00::4be0 @@ -439,6 +446,18 @@ ping-leases = false #no-route = 192.168.5.0/255.255.255.0 +# If set, the script /usr/bin/ocserv-fw will be called to restrict +# the user to its allowed routes and prevent him from accessing +# any other routes. In case of defaultroute, the no-routes are restricted. +# All the routes applied by ocserv can be reverted using /usr/bin/ocserv-fw +# --removeall. This option can be set globally or in the per-user configuration. +#restrict-user-to-routes = true + +# When set to true, all client's iroutes are made visible to all +# connecting clients except for the ones offering them. This option +# only makes sense if config-per-user is set. +#expose-iroutes = true + # Groups that a client is allowed to select from. # A client may belong in multiple groups, and in certain use-cases # it is needed to switch between them. For these cases the client can diff --git a/ocserv.spec b/ocserv.spec index 481c132..6396b4d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.9 +Version: 0.10.10 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -151,6 +151,7 @@ rm -rf %{buildroot} %{_mandir}/man8/ocpasswd.8* %{_bindir}/ocpasswd %{_bindir}/occtl +%{_bindir}/ocserv-fw %{_bindir}/ocserv-script %{_sbindir}/ocserv %{_sbindir}/ocserv-genkey @@ -158,6 +159,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Nov 30 2015 Nikos Mavrogiannopoulos - 0.10.10-1 +- new upstream release + * Thu Oct 8 2015 Nikos Mavrogiannopoulos - 0.10.9-1 - new upstream release (#1269479) diff --git a/sources b/sources index 34833c2..3c0611b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -650c80e96ef429f34787347a59476d07 ocserv-0.10.9.tar.xz.sig -74834c59aa96beaa222c21ee6521adb2 ocserv-0.10.9.tar.xz +1de2ff2dfdb1b3a9e06b5a884438c8db ocserv-0.10.10.tar.xz.sig +1f73ccb66d36cd51279323e95ae99e68 ocserv-0.10.10.tar.xz From 045fb39c399bf4a03600f5a193de1b140c5a63ba Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 11 Jan 2016 09:58:19 +0100 Subject: [PATCH 40/87] updated to 0.10.11 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 0c9a132..b7c327e 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,5 @@ /ocserv-0.10.9.tar.xz /ocserv-0.10.10.tar.xz.sig /ocserv-0.10.10.tar.xz +/ocserv-0.10.11.tar.xz.sig +/ocserv-0.10.11.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 6396b4d..45f31de 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.10 +Version: 0.10.11 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -159,6 +159,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jan 11 2016 Nikos Mavrogiannopoulos - 0.10.11-1 +- new upstream release + * Mon Nov 30 2015 Nikos Mavrogiannopoulos - 0.10.10-1 - new upstream release diff --git a/sources b/sources index 3c0611b..f10d358 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -1de2ff2dfdb1b3a9e06b5a884438c8db ocserv-0.10.10.tar.xz.sig -1f73ccb66d36cd51279323e95ae99e68 ocserv-0.10.10.tar.xz +7be01cd70cf9e8df2210531429a7aa10 ocserv-0.10.11.tar.xz.sig +7daf9f105b115cd6611a2ac016a29d24 ocserv-0.10.11.tar.xz From bf22ff07d95775ab98f97b01a3eb60c2cbbe50c8 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 19 Feb 2016 11:29:22 +0100 Subject: [PATCH 41/87] updated to 0.10.12 --- .gitignore | 2 ++ ocserv.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b7c327e..8489f9d 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,5 @@ /ocserv-0.10.10.tar.xz /ocserv-0.10.11.tar.xz.sig /ocserv-0.10.11.tar.xz +/ocserv-0.10.12.tar.xz +/ocserv-0.10.12.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 45f31de..2801e39 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,13 +1,13 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.11 +Version: 0.10.12 Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING # To simplify licenses LGPLv2+ files have been promoted to GPLv3+. -License: GPLv3+ and BSD and MIT and CC0 +License: GPLv2+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz Source1: ocserv.conf @@ -33,6 +33,7 @@ BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel BuildRequires: readline-devel +BuildRequires: liboath-devel BuildRequires: autogen BuildRequires: gperf %ifarch x86_64 %{ix86} @@ -159,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Feb 19 2016 Nikos Mavrogiannopoulos - 0.10.12-1 +- new upstream release + * Mon Jan 11 2016 Nikos Mavrogiannopoulos - 0.10.11-1 - new upstream release diff --git a/sources b/sources index f10d358..3dd6d39 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -7be01cd70cf9e8df2210531429a7aa10 ocserv-0.10.11.tar.xz.sig -7daf9f105b115cd6611a2ac016a29d24 ocserv-0.10.11.tar.xz +a0080697a6e7b07d3868d224a81b60f3 ocserv-0.10.12.tar.xz +fca0be88724adbb6b0f448a50e9f99b6 ocserv-0.10.12.tar.xz.sig From 1a86be56dfa4c2eab07564c237bfb724702f7008 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 19 Feb 2016 11:39:53 +0100 Subject: [PATCH 42/87] removed liboath from epel7 dependencies as it is not present --- ocserv.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 2801e39..649f644 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -33,7 +33,6 @@ BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel BuildRequires: readline-devel -BuildRequires: liboath-devel BuildRequires: autogen BuildRequires: gperf %ifarch x86_64 %{ix86} From 3ed541a2f58ef50ce4ce26006d87ed8b562736d5 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 26 Apr 2016 10:27:07 +0200 Subject: [PATCH 43/87] updated to 0.11.2 --- .gitignore | 2 ++ ocserv.conf | 37 +++++++++++++++++++++++++++---------- ocserv.spec | 8 ++++++-- sources | 4 ++-- 4 files changed, 37 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index 8489f9d..f2b43a1 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,5 @@ /ocserv-0.10.11.tar.xz /ocserv-0.10.12.tar.xz /ocserv-0.10.12.tar.xz.sig +/ocserv-0.11.2.tar.xz +/ocserv-0.11.2.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 7039b1c..43cc196 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -99,12 +99,22 @@ chroot-dir = /var/lib/ocserv ### All configuration options below this line are reloaded on a SIGHUP. -### The options above, will remain unchanged. +### The options above, will remain unchanged. Note however, that the +### server-cert, server-key, dh-params and ca-cert options will be reloaded +### if the provided file changes, on server reload. That allows certificate +### rotation, but requires the server key to remain the same for seamless +### operation. If the server key changes on reload, there may be connection +### failures during the reloading time. + # Whether to enable seccomp/Linux namespaces worker isolation. That restricts the number of # system calls allowed to a worker process, in order to reduce damage from a # bug in the worker process. It is available on Linux systems at a performance cost. # The performance cost is roughly 2% overhead at transfer time (tested on a Linux 3.17.8). +# Note however, that process isolation is restricted to the specific libc versions +# the isolation was tested at. If you get random failures on worker processes, try +# disabling that option and report the failures you, along with system and debugging +# information at: https://gitlab.com/ocserv/ocserv/issues isolate-workers = true # A banner to be displayed on clients @@ -118,11 +128,6 @@ max-clients = 16 # multiple times). Unset or set to zero for unlimited. max-same-clients = 2 -# When the server has a dynamic DNS address (that may change), -# should set that to true to ask the client to resolve again on -# reconnects. -#listen-host-is-dyndns = true - # Limit the number of client connections to one every X milliseconds # (X is the provided value). Set to zero for no limit. #rate-limit-ms = 100 @@ -214,7 +219,9 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 #cert-group-oid = 2.5.4.11 # The revocation list of the certificates issued by the 'ca-cert' above. -# See the manual to generate an empty CRL initially. +# See the manual to generate an empty CRL initially. The CRL will be reloaded +# periodically when ocserv detects a change in the file. To force a reload use +# SIGHUP. #crl = /path/to/crl.pem # Uncomment this to enable compression negotiation (LZS, LZ4). @@ -250,7 +257,7 @@ tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" # The time (in seconds) that a client is allowed to stay connected prior # to authentication -auth-timeout = 40 +auth-timeout = 240 # The time (in seconds) that a client is allowed to stay idle (no traffic) # before being disconnected. Unset to disable. @@ -326,11 +333,17 @@ rekey-method = ssl # Script to call when a client connects and obtains an IP. # The following parameters are passed on the environment. # REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP +# DEVICE, IP_REAL (the real IP of the client), IP_REAL_LOCAL (the local +# interface IP the client connected), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # IPV6_LOCAL (the IPv6 local address if there are both IPv4 and IPv6 -# assigned), IPV6_REMOVE (the IPv6 remote address), and +# assigned), IPV6_REMOTE (the IPv6 remote address), IPV6_PREFIX, and # ID (a unique numeric ID); REASON may be "connect" or "disconnect". +# In addition the following variables OCSERV_ROUTES (the applied routes for this +# client), OCSERV_NO_ROUTES, OCSERV_DNS (the DNS servers for this client), +# will contain a space separated list of routes or DNS servers. A version +# of these variables with the 4 or 6 suffix will contain only the IPv4 or +# IPv6 values. # The disconnect script will receive the additional values: STATS_BYTES_IN, # STATS_BYTES_OUT, STATS_DURATION that contain a 64-bit counter of the bytes @@ -397,6 +410,10 @@ default-domain = example.com #ipv6-subnet-prefix = 128 #ipv6-subnet-prefix = 64 +# Whether to tunnel all DNS queries via the VPN. This is the default +# when a default route is set. +#tunnel-all-dns = true + # The advertized DNS server. Use multiple lines for # multiple servers. # dns = fc00::4be0 diff --git a/ocserv.spec b/ocserv.spec index 649f644..4f10d4e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.12 +Version: 0.11.2 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -35,6 +35,7 @@ BuildRequires: libtasn1-devel BuildRequires: readline-devel BuildRequires: autogen BuildRequires: gperf +BuildRequires: libev-devel %ifarch x86_64 %{ix86} BuildRequires: libseccomp-devel %endif @@ -76,7 +77,7 @@ to provide the secure VPN service. %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h -rm -rf src/protobuf/ +rm -rf src/protobuf/protobuf-c rm -rf src/ccan/talloc rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h @@ -159,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Tue Apr 26 2016 Nikos Mavrogiannopoulos - 0.11.2-1 +- New upstream release + * Fri Feb 19 2016 Nikos Mavrogiannopoulos - 0.10.12-1 - new upstream release diff --git a/sources b/sources index 3dd6d39..5b6c2a5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -a0080697a6e7b07d3868d224a81b60f3 ocserv-0.10.12.tar.xz -fca0be88724adbb6b0f448a50e9f99b6 ocserv-0.10.12.tar.xz.sig +6731f4d9a85ff0476ae37fa7a4d57ee2 ocserv-0.11.2.tar.xz +4e8b8291fee4b3da8c6f43b08819dd1f ocserv-0.11.2.tar.xz.sig From 8774878ae2a2d1e4ad371b55953825873e9331e5 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 16 Jun 2016 09:37:34 +0200 Subject: [PATCH 44/87] updated to 0.11.3 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index f2b43a1..ead9f1b 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,5 @@ /ocserv-0.10.12.tar.xz.sig /ocserv-0.11.2.tar.xz /ocserv-0.11.2.tar.xz.sig +/ocserv-0.11.3.tar.xz +/ocserv-0.11.3.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 4f10d4e..a97fe38 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.2 +Version: 0.11.3 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -160,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jun 16 2016 Nikos Mavrogiannopoulos - 0.11.3-1 +- New upstream release + * Tue Apr 26 2016 Nikos Mavrogiannopoulos - 0.11.2-1 - New upstream release diff --git a/sources b/sources index 5b6c2a5..3d8b1ae 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -6731f4d9a85ff0476ae37fa7a4d57ee2 ocserv-0.11.2.tar.xz -4e8b8291fee4b3da8c6f43b08819dd1f ocserv-0.11.2.tar.xz.sig +ffe3d79662e939bb55dfe7c9e490b4f2 ocserv-0.11.3.tar.xz +4bf5d98c6ededa172aa04460386bb0e6 ocserv-0.11.3.tar.xz.sig From b8b70544739ab204c643551345d0ad20a3c98985 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 5 Aug 2016 13:01:40 +0200 Subject: [PATCH 45/87] updated to 0.11.4 --- .gitignore | 3 +++ ocserv.spec | 7 +++++-- sources | 6 ++++-- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ead9f1b..faf3d74 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,6 @@ /ocserv-0.11.2.tar.xz.sig /ocserv-0.11.3.tar.xz /ocserv-0.11.3.tar.xz.sig +/ocserv-0.11.4.tar.xz +/ocserv-0.11.4.tar.xz.sig +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg diff --git a/ocserv.spec b/ocserv.spec index a97fe38..336a826 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.3 +Version: 0.11.4 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -82,7 +82,7 @@ rm -rf src/ccan/talloc rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c -sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config +sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* @@ -160,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Aug 5 2016 Nikos Mavrogiannopoulos - 0.11.4-1 +- New upstream release + * Thu Jun 16 2016 Nikos Mavrogiannopoulos - 0.11.3-1 - New upstream release diff --git a/sources b/sources index 3d8b1ae..44d23cb 100644 --- a/sources +++ b/sources @@ -1,2 +1,4 @@ -ffe3d79662e939bb55dfe7c9e490b4f2 ocserv-0.11.3.tar.xz -4bf5d98c6ededa172aa04460386bb0e6 ocserv-0.11.3.tar.xz.sig +310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +645b8f26d2aa40bfe4c32c8de7c8c87e ocserv-0.11.4.tar.xz +a036652f70660c5041adbea14aabf934 ocserv-0.11.4.tar.xz.sig From db60acc38ae4acbb284edd651fba652f9f24b661 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 23 Sep 2016 11:25:36 +0200 Subject: [PATCH 46/87] updated to 0.11.5 --- .gitignore | 2 ++ ocserv.conf | 30 +++++++++++++++++++++++++----- ocserv.spec | 5 ++++- sources | 4 ++-- 4 files changed, 33 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index faf3d74..7c992c4 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,5 @@ /ocserv-0.11.4.tar.xz /ocserv-0.11.4.tar.xz.sig /gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-0.11.5.tar.xz +/ocserv-0.11.5.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 43cc196..9530d82 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -255,6 +255,14 @@ tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" # on the main channel. #tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" +# That option requires the established DTLS channel to use the same +# cipher as the primary TLS channel. This cannot be combined with +# listen-clear-file since the ciphersuite information is not available +# in that configuration. Note also, that this option implies that +# dtls-legacy option is false; this option cannot be enforced +# in the legacy/compat protocol. +#match-tls-dtls-ciphers = true + # The time (in seconds) that a client is allowed to stay connected prior # to authentication auth-timeout = 240 @@ -545,13 +553,25 @@ ping-leases = false # The following options are for (experimental) AnyConnect client # compatibility. -# This option must be set to true to support legacy CISCO clients. -# A side effect of this option is that it will no longer be required -# for clients to present their certificate on every connection. -# That is they may resume a cookie without presenting a certificate -# (when certificate authentication is used). +# This option will enable the pre-draft-DTLS version of DTLS, and +# will not require clients to present their certificate on every TLS +# connection. It must be set to true to support legacy CISCO clients +# and openconnect clients < 7.08. When set to true, it implies dtls-legacy = true. cisco-client-compat = true +# This option allows to disable the DTLS-PSK negotiation (enabled by default). +# The DTLS-PSK negotiation was introduced in ocserv 0.11.5 to deprecate +# the pre-draft-DTLS negotiation inherited from AnyConnect. It allows the +# DTLS channel to negotiate its ciphers and the DTLS protocol version. +#dtls-psk = false + +# This option allows to disable the legacy DTLS negotiation (enabled by default, +# but that may change in the future). +# The legacy DTLS uses a pre-draft version of the DTLS protocol and was +# from AnyConnect protocol. It has several limitations, that are addressed +# by the dtls-psk protocol supported by openconnect 7.08+. +dtls-legacy = true + # Client profile xml. A sample file exists in doc/profile.xml. # It is required by some of the CISCO clients. # This file must be accessible from inside the worker's chroot. diff --git a/ocserv.spec b/ocserv.spec index 336a826..0a71b54 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.4 +Version: 0.11.5 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -160,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Sep 23 2016 Nikos Mavrogiannopoulos - 0.11.5-1 +- New upstream release + * Fri Aug 5 2016 Nikos Mavrogiannopoulos - 0.11.4-1 - New upstream release diff --git a/sources b/sources index 44d23cb..197a6c2 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ 310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg -645b8f26d2aa40bfe4c32c8de7c8c87e ocserv-0.11.4.tar.xz -a036652f70660c5041adbea14aabf934 ocserv-0.11.4.tar.xz.sig +fbda999ce0b528d001bb46b3db6f5d49 ocserv-0.11.5.tar.xz +f008f957a95feb8ef675ff1af09e3b53 ocserv-0.11.5.tar.xz.sig From 4d62f13b9eb551d8964718619ab26fab32729975 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Nov 2016 14:57:30 +0100 Subject: [PATCH 47/87] ocserv.conf: include switch-to-tcp-timeout --- ocserv.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ocserv.conf b/ocserv.conf index 9530d82..30c38da 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -155,6 +155,14 @@ dpd = 90 # 'X-AnyConnect-Identifier-DeviceType'. mobile-dpd = 1800 +# If using DTLS, and no UDP traffic is received for this +# many seconds, attempt to send future traffic over the TCP +# connection instead, in an attempt to wake up the client +# in the case that there is a NAT and the UDP translation +# was deleted. If this is unset, do not attempt to use this +# recovery mechanism. +switch-to-tcp-timeout = 25 + # MTU discovery (DPD must be enabled) try-mtu-discovery = false From 4d1f846075fec3c8f8e2549ae410e2d96d3ea934 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Nov 2016 15:20:12 +0100 Subject: [PATCH 48/87] updated to 0.11.6 --- ocserv.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 0a71b54..55f4941 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.5 +Version: 0.11.6 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -160,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-1 +- New upstream release + * Fri Sep 23 2016 Nikos Mavrogiannopoulos - 0.11.5-1 - New upstream release diff --git a/sources b/sources index 197a6c2..6dd3e56 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ 310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg -fbda999ce0b528d001bb46b3db6f5d49 ocserv-0.11.5.tar.xz -f008f957a95feb8ef675ff1af09e3b53 ocserv-0.11.5.tar.xz.sig +0e4f82d267d27f2f9d3fcba58ac6cf5a ocserv-0.11.6.tar.xz +12a026b472daa54373f38538773673d8 ocserv-0.11.6.tar.xz.sig From 220e9abf5ea19a3d8171981da4531ac0f2d485ba Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Nov 2016 15:20:45 +0100 Subject: [PATCH 49/87] updated to 0.11.6 --- .gitignore | 3 +++ sources | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 7c992c4..2d09306 100644 --- a/.gitignore +++ b/.gitignore @@ -47,3 +47,6 @@ /gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg /ocserv-0.11.5.tar.xz /ocserv-0.11.5.tar.xz.sig +/ocserv-0.11.6.tar.xz +/ocserv-0.11.6.tar.xz.sig +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg diff --git a/sources b/sources index 6dd3e56..ba362bf 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ -310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg -c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg 0e4f82d267d27f2f9d3fcba58ac6cf5a ocserv-0.11.6.tar.xz 12a026b472daa54373f38538773673d8 ocserv-0.11.6.tar.xz.sig +310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg From ac26011acddd07610dd9b300036bbb57e59d7fab Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 2 Dec 2016 09:44:02 +0100 Subject: [PATCH 50/87] recompile to address libnl3 issue --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 55f4941..946d31a 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.11.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -160,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Dec 2 2016 Nikos Mavrogiannopoulos - 0.11.6-2 +- Recompile to resolve libnl3 instability (#1400744) + * Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-1 - New upstream release From 55074c55ac0f17233b59872b4f6bff4adb50e686 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 2 Dec 2016 14:24:45 +0100 Subject: [PATCH 51/87] Recompile without libnl3 to fix issue between EPEL and Centos --- ocserv.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 946d31a..10eed48 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.11.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -91,7 +91,8 @@ touch src/*.proto %build %configure \ - --enable-systemd + --enable-systemd \ + --without-libnl make #%{?_smp_mflags} @@ -160,8 +161,8 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog -* Fri Dec 2 2016 Nikos Mavrogiannopoulos - 0.11.6-2 -- Recompile to resolve libnl3 instability (#1400744) +* Fri Dec 2 2016 Nikos Mavrogiannopoulos - 0.11.6-3 +- Recompile without libnl3 to fix issue between EPEL and Centos (#1400693) * Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-1 - New upstream release From aee10b505da82ffbae513ba7b4803658cc77b3fb Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 5 Dec 2016 09:08:51 +0100 Subject: [PATCH 52/87] Reverted the libnl3 removal The actual issue is compatibility with Centos7.2 which is not possible due to EPEL build root. --- ocserv.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 10eed48..d21b311 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.11.6 -Release: 3%{?dist} +Release: 4%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -91,8 +91,7 @@ touch src/*.proto %build %configure \ - --enable-systemd \ - --without-libnl + --enable-systemd make #%{?_smp_mflags} @@ -161,6 +160,10 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Dec 5 2016 Nikos Mavrogiannopoulos - 0.11.6-4 +- Reverted the libnl3 removal; the actual issue is compatibility with + Centos7.2 which is not possible due to EPEL build root. + * Fri Dec 2 2016 Nikos Mavrogiannopoulos - 0.11.6-3 - Recompile without libnl3 to fix issue between EPEL and Centos (#1400693) From 2f721a69c0fbd55ef757fc40b14d59d32ec5d4fd Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 9 Jan 2017 10:08:50 +0100 Subject: [PATCH 53/87] document purpose for rebuild --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index d21b311..ff723cc 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -163,6 +163,7 @@ rm -rf %{buildroot} * Mon Dec 5 2016 Nikos Mavrogiannopoulos - 0.11.6-4 - Reverted the libnl3 removal; the actual issue is compatibility with Centos7.2 which is not possible due to EPEL build root. +- Rebuild to work-around http-parser breakage (#1411021) * Fri Dec 2 2016 Nikos Mavrogiannopoulos - 0.11.6-3 - Recompile without libnl3 to fix issue between EPEL and Centos (#1400693) From b5af65c1bb4f4f8ddd129b3326af8d01edf29065 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 13 Feb 2017 11:38:55 +0100 Subject: [PATCH 54/87] Update to 0.11.7-1 - Update to upstream 0.11.7 release --- .gitignore | 11 ++++++ ocserv-0.10.6-json.patch | 29 -------------- ocserv-0.10.6-path-mtu.patch | 13 ------ ocserv.spec | 77 +++++++++++++++++++++++++----------- sources | 15 +++++-- 5 files changed, 76 insertions(+), 69 deletions(-) delete mode 100644 ocserv-0.10.6-json.patch delete mode 100644 ocserv-0.10.6-path-mtu.patch diff --git a/.gitignore b/.gitignore index 2d09306..9717ab9 100644 --- a/.gitignore +++ b/.gitignore @@ -50,3 +50,14 @@ /ocserv-0.11.6.tar.xz /ocserv-0.11.6.tar.xz.sig /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.7.tar.xz.sig +/ocserv-0.11.7.tar.xz diff --git a/ocserv-0.10.6-json.patch b/ocserv-0.10.6-json.patch deleted file mode 100644 index 4afb8ea..0000000 --- a/ocserv-0.10.6-json.patch +++ /dev/null @@ -1,29 +0,0 @@ -diff --git a/src/occtl-print.c b/src/occtl-print.c -index 1441cd6..8ff297e 100644 ---- a/src/occtl-print.c -+++ b/src/occtl-print.c -@@ -47,9 +47,9 @@ int print_list_entries(FILE* out, cmd_params_st *params, const char* name, char - tmp = val[i]; - if (tmp != NULL) { - if (i==0) -- fprintf(out, "%s", tmp); -+ fprintf(out, "\"%s\"", tmp); - else -- fprintf(out, ", %s", tmp); -+ fprintf(out, ", \"%s\"", tmp); - } - } - fprintf(out, "]%s\n", have_more?",":""); -diff --git a/src/occtl-unix.c b/src/occtl-unix.c -index 6df5a1e..d6b28f3 100644 ---- a/src/occtl-unix.c -+++ b/src/occtl-unix.c -@@ -254,7 +254,7 @@ int handle_status_cmd(struct unix_ctx *ctx, const char *arg, cmd_params_st *para - print_single_value_int(stdout, params, "TLS DB entries", rep->stored_tls_sessions, 1); - print_separator(stdout, params); - print_single_value_int(stdout, params, "Server PID", rep->pid, 1); -- print_single_value_int(stdout, params, "Sec-mod PID", rep->sec_mod_pid, 1); -+ print_single_value_int(stdout, params, "Sec-mod PID", rep->sec_mod_pid, 0); - print_end_block(stdout, params, 0); - - status_rep__free_unpacked(rep, &pa); diff --git a/ocserv-0.10.6-path-mtu.patch b/ocserv-0.10.6-path-mtu.patch deleted file mode 100644 index 8f54ce8..0000000 --- a/ocserv-0.10.6-path-mtu.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/worker-vpn.c b/src/worker-vpn.c -index 7765e84..cf2a6b6 100644 ---- a/src/worker-vpn.c -+++ b/src/worker-vpn.c -@@ -46,7 +46,7 @@ - #include - #include - --#ifdef __linux__ -+#if 0 - /* for IPV6_PATHMTU */ - # include - #endif diff --git a/ocserv.spec b/ocserv.spec index ff723cc..1968f21 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,28 +1,36 @@ +# This spec file has been automatically updated +Version: 0.11.7 +Release: 1%{?dist} %global _hardened_build 1 Name: ocserv -Version: 0.11.6 -Release: 4%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING -# To simplify licenses LGPLv2+ files have been promoted to GPLv3+. +# To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPLv2+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz -Source1: ocserv.conf -Source2: ocserv.service -Source3: ocserv-pamd.conf -Source4: PACKAGE-LICENSING -Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig -Source7: ocserv-genkey -Source8: ocserv-script +Source1: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig +Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +Source3: ocserv.conf +Source4: ocserv.service +Source5: ocserv-pamd.conf +Source6: PACKAGE-LICENSING +Source8: ocserv-genkey +Source9: ocserv-script +Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +Source11: ocserv.init # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +%if 0%{?rhel} && 0%{?rhel} <= 6 +BuildRequires: gnutls30-devel +%else BuildRequires: gnutls-devel +%endif BuildRequires: pam-devel BuildRequires: iproute BuildRequires: systemd @@ -32,24 +40,33 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel +%if 0%{?fedora} +BuildRequires: liboath-devel +BuildRequires: uid_wrapper +BuildRequires: socket_wrapper +%endif BuildRequires: readline-devel BuildRequires: autogen BuildRequires: gperf -BuildRequires: libev-devel + +%if 0%{?rhel} && 0%{?rhel} >= 7 %ifarch x86_64 %{ix86} BuildRequires: libseccomp-devel %endif +%else +%ifarch x86_64 %{ix86} %{arm} aarch64 +BuildRequires: libseccomp-devel +%endif +%endif BuildRequires: pcllib-devel BuildRequires: libtalloc-devel +BuildRequires: libev-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf BuildRequires: radcli-devel BuildRequires: lz4-devel -BuildRequires: vim-minimal -# we don't build with dbus support -#BuildRequires: dbus-devel Requires: gnutls-utils Requires: iproute @@ -74,10 +91,11 @@ uses the standard IETF security protocols such as TLS 1.2, and Datagram TLS to provide the secure VPN service. %prep +gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h -rm -rf src/protobuf/protobuf-c +rm -rf src/protobuf/protobuf-c/ rm -rf src/ccan/talloc rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h @@ -118,19 +136,25 @@ make check %{?_smp_mflags} %install rm -rf %{buildroot} -cp -a %{SOURCE4} PACKAGE-LICENSING +cp -a %{SOURCE6} PACKAGE-LICENSING mkdir -p %{buildroot}/%{_sysconfdir}/pam.d/ mkdir -p %{buildroot}/%{_sysconfdir}/ocserv/ -install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/pam.d/ocserv -install -p -m 644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/ocserv/ -mkdir -p %{buildroot}/%{_unitdir} -install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} +install -p -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/pam.d/ocserv +install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/ocserv/ mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ mkdir -p %{buildroot}/%{_sbindir} -install -p -m 755 %{SOURCE7} %{buildroot}/%{_sbindir} +install -p -m 755 %{SOURCE8} %{buildroot}/%{_sbindir} mkdir -p %{buildroot}/%{_bindir} -install -p -m 755 %{SOURCE8} %{buildroot}/%{_bindir} +install -p -m 755 %{SOURCE9} %{buildroot}/%{_bindir} + +%if 0%{?rhel} && 0%{?rhel} <= 6 +install -D -m 0755 %{SOURCE8} %{buildroot}/%{_initrddir}/%{name} +%else +mkdir -p %{buildroot}/%{_unitdir} +install -p -m 644 %{SOURCE4} %{buildroot}/%{_unitdir} +%endif + %make_install %clean @@ -156,10 +180,17 @@ rm -rf %{buildroot} %{_bindir}/ocserv-script %{_sbindir}/ocserv %{_sbindir}/ocserv-genkey -%{_unitdir}/ocserv.service %{_localstatedir}/lib/ocserv/profile.xml +%if 0%{?rhel} && 0%{?rhel} <= 6 +%{_initrddir}/%{name} +%else +%{_unitdir}/ocserv.service +%endif %changelog +* Mon Feb 13 2017 Nikos Mavrogiannopoulos - 0.11.7-1 +- Update to upstream 0.11.7 release + * Mon Dec 5 2016 Nikos Mavrogiannopoulos - 0.11.6-4 - Reverted the libnl3 removal; the actual issue is compatibility with Centos7.2 which is not possible due to EPEL build root. diff --git a/sources b/sources index ba362bf..03b31ca 100644 --- a/sources +++ b/sources @@ -1,4 +1,11 @@ -0e4f82d267d27f2f9d3fcba58ac6cf5a ocserv-0.11.6.tar.xz -12a026b472daa54373f38538773673d8 ocserv-0.11.6.tar.xz.sig -310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg -c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 +SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 +SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 +SHA512 (ocserv-genkey) = c02a25a5504e2bd514c6e6944651960a3cc9bf2ef0a4509744f99d61421feace1f8e440c4d336652efd7349465d1a707cd3a370ff6102ef5096d709b34099a86 +SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 +SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a +SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 +SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c +SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c +SHA512 (ocserv-0.11.7.tar.xz.sig) = fd4af775842cff6817adaf4a641b180d3be3b55e3b64a026977fd6f328ddc5f7070f4c91cdce7e83eb8c3b078a5c1dc7780cfe40c5322abef61ca7fc408fbb2c +SHA512 (ocserv-0.11.7.tar.xz) = a563725bd8753186ece80c91a237a2940071047bb32d1990e2ee122a32ad0468b78a7f35d422dcc9b968a8c56358992842d00958dbf9d743632a03623dd2f5cf From 308a96f5ec58bea9c31e13b3111cfbf1758bf67d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 14 Feb 2017 11:12:27 +0100 Subject: [PATCH 55/87] corrected configuration files --- ocserv.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 1968f21..a3741ef 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.7 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 Name: ocserv @@ -148,6 +148,13 @@ install -p -m 755 %{SOURCE8} %{buildroot}/%{_sbindir} mkdir -p %{buildroot}/%{_bindir} install -p -m 755 %{SOURCE9} %{buildroot}/%{_bindir} +%if 0%{?rhel} +sed -i 's|expiration_days=-1|expiration_days=9999|' %{buildroot}/%{_sbindir}/ocserv-genkey +sed -i 's|tls-priorities = "@SYSTEM"|tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"|' %{buildroot}/%{_sysconfdir}/ocserv/ocserv.conf +%if 0%{?rhel} <= 6 +sed -i 's|isolate-workers = true|isolate-workers = false|' %{buildroot}/%{_sysconfdir}/ocserv/ocserv.conf +%endif + %if 0%{?rhel} && 0%{?rhel} <= 6 install -D -m 0755 %{SOURCE8} %{buildroot}/%{_initrddir}/%{name} %else From a68bd078b832dfceca818a9458a6b55dfb1fd751 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 14 Feb 2017 11:13:01 +0100 Subject: [PATCH 56/87] corrected typo --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index a3741ef..ad635d0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -154,6 +154,7 @@ sed -i 's|tls-priorities = "@SYSTEM"|tls-priorities = "NORMAL:%SERVER_PRECEDENCE %if 0%{?rhel} <= 6 sed -i 's|isolate-workers = true|isolate-workers = false|' %{buildroot}/%{_sysconfdir}/ocserv/ocserv.conf %endif +%endif %if 0%{?rhel} && 0%{?rhel} <= 6 install -D -m 0755 %{SOURCE8} %{buildroot}/%{_initrddir}/%{name} From 491551252ff54b42621cdf7817e51b699aa0f2b6 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 17 Feb 2017 07:58:20 +0100 Subject: [PATCH 57/87] Included liboath in the build --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ad635d0..11169eb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -40,7 +40,7 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel -%if 0%{?fedora} +%if 0%{?fedora} || 0%{?rhel} >= 7 BuildRequires: liboath-devel BuildRequires: uid_wrapper BuildRequires: socket_wrapper @@ -196,6 +196,9 @@ rm -rf %{buildroot} %endif %changelog +* Fri Feb 17 2017 Nikos Mavrogiannopoulos - 0.11.7-2 +- Included liboath in the build + * Mon Feb 13 2017 Nikos Mavrogiannopoulos - 0.11.7-1 - Update to upstream 0.11.7 release From 80cb8b94e577d2dfb1e7a5fbfd6aea35c54b2511 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 17 Feb 2017 08:00:18 +0100 Subject: [PATCH 58/87] bumped version --- ocserv.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 11169eb..cf54f4c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.7 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 Name: ocserv @@ -196,7 +196,7 @@ rm -rf %{buildroot} %endif %changelog -* Fri Feb 17 2017 Nikos Mavrogiannopoulos - 0.11.7-2 +* Fri Feb 17 2017 Nikos Mavrogiannopoulos - 0.11.7-3 - Included liboath in the build * Mon Feb 13 2017 Nikos Mavrogiannopoulos - 0.11.7-1 From c1e25d54e309b8fffe47d5c876b5a7787d9a083c Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 3 May 2017 03:10:13 +0200 Subject: [PATCH 59/87] Update to 0.11.8-1 - Update to upstream 0.11.8 release --- .gitignore | 11 ++ ...42418905D8206AA754CCDC29EE58B996865171.gpg | Bin 0 -> 56226 bytes ...EE7FA9E8173B19FE86268D763712747F343FA7.gpg | Bin 0 -> 2135 bytes ocserv-genkey | 1 + ocserv.conf | 3 +- ocserv.init | 141 ++++++++++++++++++ ocserv.spec | 89 +++++++---- sources | 6 +- 8 files changed, 222 insertions(+), 29 deletions(-) create mode 100644 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg create mode 100644 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg create mode 100644 ocserv.init diff --git a/.gitignore b/.gitignore index 9717ab9..a635fc3 100644 --- a/.gitignore +++ b/.gitignore @@ -61,3 +61,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.7.tar.xz.sig /ocserv-0.11.7.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.8.tar.xz.sig +/ocserv-0.11.8.tar.xz diff --git a/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg b/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg new file mode 100644 index 0000000000000000000000000000000000000000..1f9a40cc96ea43f54ea9dc0f1873971a85535c2f GIT binary patch literal 56226 zcmb5#gL9?PyXg5H+qP}nwr$%sJ4VMz$2L0Z*tVUHZ9BP@-#K?~pPH$fnSbE3_FB(3 zEALL_%>YUOmBc$}1cD{pxXIaBVJ{hWJA4%Z)9ni{SHt5yt#wqrchRH}nVar+Hg16F zb)B38Lw{tz5e0U;n8D@MMBjiku$@o$9b!zR>J)Li;lyXD^sHJ~Wp6q- z0yXavWO2O;<#hYK2ABm-Tz8iOqOtR5$)65eONbbZI^*!NeJO|ljurm^x1@h4m)2vW zUeaK6U7O~oldSCtC{mVzHLzMPnOZ+V*%2W!J65foX@`K@ydA{uC5*@0Wb1 zeW5;GRFe6ThZJ$+-VDDMqV-(fyc$ux%tbl28IZZ^g=gNBei_x9a5cKv&+xT)RIv`a z@F8k69-rjTJjDBjlH1t%1(L?fdomeXh=U>`0RzCnfF+rJ}ke72fhDD6WmFZaET^IgW5za`-4hWFLY7|``6^>`K zOFsIcPaNZX4Ssw0e;hgaV!Ut1YTwvhVK7HDDh7}j=5BiZJOgozfiI(Z0}6UJXI5hk z$jgEUQJ~TAPqrv2FY4#Jy~OMYhx^A-SX=#eq}XA2@ZR!G*;fF$=H7r6`5k)QwA)+E z%}uatXU}eKK;FoJseFjfM6UzF!B?O6>HC!yr1!th!TYy!z=U?tlAmQIRtw0+#`@B= zpXei@`YfeaXW=woM*ZU`f_{BFu^mTe?O4Yk zN9BNA->_0|0wd?h(4Fxsc=3TZuma|3KsG^^_@8{YJ}+*G8LNd>Am&88i{5`7AKGt+ z5jd7q5~b<0A03dZ$6I4bro>e6IiAMD^#aE}&-F3}$bt_5UVv&bU-nW~@O~-ZCM-fa z|7Y%U%9q98jtg$>yh?8&gZDTfZ~MW%nzW`-O&;gfiv-^lzoOcv0FXDuOTjc8pJ)A3 zM2_=Z+0Qw4;)3{}&!d9U^X=Hd408)=Vsf~O0&*yNvekel*%$1t5B$`Z3@TYYsKo%e z*3WgHYd@KB&eP)$GK~=E#Fz7n{&fhBzn!@4Ou9qdt=y~@K&}Tm`{(1MPgmcsjD;jH z(_5Y?^hrQAw#z%vvP(4H6iKa{hGOVW9}24DKaQ#|)wjcdJ>x>f3-+N31jtKA&7A_~ z_8;LAY{No{C^4Gbb2SCz#SYk*1it&Gn*73T%doM}V3*Jj`o~eDuljbncI;`X{elTI zx&gU%Gc(IAbkBE+$goCs8X=yuw56ngyn1u@wzDq+er+O=w>r&OU*|se&3_z?{)%r0 z_-77w;s=VeJQE-rGmF#{bLeWyQVOYr2pep$$UA@tkhh6_nzuthVQg)x{1c&j+?=y? z%l{uolRxI$*{ooOX2yC6Q0=m?F^#U#>o@`_45(| z@={|KFo|xk5rt=sqOX(BxasaF>i~I&20S`sFl*o~2fLw1cl*_4Ui~{Nga#Qhhb?4+=S3N+k7$({pD+$t~@a0xZ@b>l43MbR& z|8W$4P=|gy>PKHul!C*Mj+1~~?cDV9S)!dh*9qEb^Lm2#t4oLlKwdq(%@bg=S1e+mw{0vZQV(U zF`5Q>d*v^K$wyMP|2UA}_q?2@*DiO zbF6O6SqIz1Vn74Pi@#KloBSjWtC8gbG-emF9fU5<0rEyMM_yLY+0R~~_eu>5+)9V5 z2hIO+G&OF%9Zqle6#q82FF{B^ULu%^Vj-8R8#9*NWcQ}0nXP103?SDQi=6!4rZBxTG5tGNe0N_ z)Shfa(a!9S8#`GZrI-o^Ixt&|5C=v1?|ms+n0`A9DQJ)thrslwsDQkfdaD;=>mTE( z*;&(0vd{gz){i@YY`l09jlWawISYmd(@wJD5l07*ud4Ph->+kd55e?QIt;qG}S44i<`;cEe5(;`WcDR{{8TezNrk zIFdp<(cuH~Huubnp$l3Vi3K{{pF`AJGnPfq0XbySTz62!^wmZ5x_jgozBLK6az6iY zp#Rg4!jsjv^Iq4kYe3NLXtM#x#!}#+lJz4XEYwiuo41q49gi_)0OU~eFlF(dMpzeNe>z?peX>`P%{3u0yoJIK_7z0=&Z^NWwfUS?w5} zYnrB`q?U!@uT=sE$8YPy^grTllXaedw&c+gm%NB7*^+JaaE{T2(dyNGj{hzmQWp z7;8uPCA6064607oqJFkmM3{l1AVC7iz<}k{2U_s4EnQt5xfvKdJUr+v99%6e92{KC z={91*8e~(4Ae5qHATXwAg3?rk>wj(wRxn^Wg;_nie|KZV>`8B8$zW>6VB=u# zYGm`D9nm>D*jkx*(ObIO*?w=%$xal7FNT;-z8jD$%+%=V{q@tm6e@AB^)u1HK;BIX zkSiax#Xa{4&dk_0>J8lW-b(+l*ZMzJb@>0ks`?@o|EM>(>d_P+R~LK5bs>^Ky#7gk zVc++&c5Ozx9gwTuY`su=138D?NNC%%!*Z(WVXPD3_n#Yt4-8n&a6zB>-@V#fnb6rA znb0{pJ6M~UxPCvtGx!_Z8W}k<{Ig*YFd)zGO*=1aJumd%q+JLBazthAg3t$pC?|we)6?R z=aP?gQb<51LsEfE9_zmHt_#Se{Dp^S zbyfOh4%oYuJSS-RC=ES{hL@4zZTx8%)7e2H|9q`bK_TpOLw}1?V~w(+70@rU+u&Y~x{5?x z*sZnFyK=&*TFH>HZuP7gM9iym?OWbPeJ#V<9zTib$fQzUbBOj#_@xoQOfHYO!eg7X zm}uR9k4Fh9_WPW(YNwIZT^&+-_8{KCJcN}>!I4p6;^=E?g40y*_*)2fO?)8~IrXqn z%`Nl@GJSLxQ%(XiO2mzx3P=4J$lU3Bi(!!PQzs5bFtkx9aPA8XVLB|+ihDO(%NG_I zlcimnAg4D;mVG>?01x-z7A2^uEo-U_!JnpYg3-5aRib(KVgC< zZ5?80$rI|OiieE`NvNSO*^ImK>wBV;Y-AB>45hD4Act!1FVHYSw2;vC;q@95rvsVnlU4}BYJ=E-ec3MS%dDQ>Y9`O`W=^u+1QyEp)bLIJj<6nYRM8E9RaAO?jeOR834w<-wSk9&S3| ze7XX)dYhMX#vXm?IOMu`UxUqB~z6|S} zwta__|E4OHgv-eTbVfKKi*V3`;|wa~5; za&?v>Ddd89s0d(_tCrz)t7L(T@0P;sG*H)8@-o9r(^M*H;;&-@^1Dc_@z*WyIqN;F zk}aBL`J_^ymcMtR8c8vUOf-EO!j-tI&_Xcf2t13vKSFnk&GL|xm4*}3d&{p@V^qwG zG(hyh`@LxJQY~VGkx}Lu=ae?&4!)bCIT*T1{HbR=%ALhnj&beXl;KJ%0JS-IeaEF8 z7@n8>imRXs?8T%+kj3Nk+pe-BRGu^=mHH{ihjM&^pFDLuU@I@TT?918k@Wj`Q2zVw zQ7YN`{^2^&4r<8}>SC|lhxp`IQ$a(4U*V7OA?F`yB9V1n3#*n;p$&StxEc~j_ABAI z!5;TRBwKpz8krSMq9^jc=zZP&z%c7jXDCm0DiZi{l-TG9!qKDlj2aRRs?DSER+{a` z+_udFf{5v8qk(Q9amsliD8WjVzs(G(TD`E9tDmoTW5fP?2@+^Lyb>2C`}chcTZ#_J z2^@vqX^Ba1@T~Ls>7G}sQ%c@uu2PkAU{`Q+9@3EnAqIb!UUiYw{QMhIrYo5qewzH2 zeyLLVkhBx5Tk9KkC4kycMGuk5gjpGUUz)nfGM4X`%`a~Dsjy~AI@N|CaNU0Qhh;5` z$>l>ae0Wy*yxLC7(SiWPQi6A?)FCol82etrUfoE;blPUTY*)p((x=Ke#PlV#s*+L5 z$mLXh?CbOy%2zP);-&f3B?fd01_~Qf6enh$XcO)^cTa$2bIfL~B0W>YR287k`Q7TS zAy-)=Y9qt~Mwvqhk)YrX&O6KByQ^;!4OK3T?_4Mh`_@R1{SETV-Sx(mv$(p^<34dJ z=5l925(*_hCiaB&r#wk*>Yj*%(a!4}r+IE(`o(k+n%Q?Y;Yf}cD^d9ANSGW+%MpwE_Iz7ym>)hWEX%n6B_0p~MJ0ix8M`y)Z? zDUE?)%qrN<4Wb)d2TXjeURU-8@S@44ZB?U?svc63(x;fe7BB~VoZ?|L67hNd`eugI zLGvWZ)EN9hFc96m#x|3NCygSFa zcJPOhHXp-h-BT%W8MH{C>+KJ$mF*Ocj*?ZZbUGx?3c9mUQD*2@<~B+sP|ttHL;n4z z&Vxo^91t)lvUG3&I1Cgd1PCxF8ZaaXC^|3*5HLOvFh=0__^2*5TT{c7oCwol3Dp0x z%I8epIkGpQmEG9S?b?&x!5+rtl}1FU_PDcaWCD|d!M%X;V%i)K3F?JJ(;{l`nsmzi zt%qaUKQoghv|n#HXu>(`cuX3k8uR(P{I#ftE{$vOdiG~4pQKR!q+3_qj+-DIh?HEr zhF#9?&2VjCAVc3fg%wE9>O9aSQ8FI?*b-Z}k4mS)%IrnerJq(HMXO|qyMP~mk!QoE zq@m6q(|Wg4lkIx0d9ADShT1%4KX#0?B>{qh7&cW0Da0GkonG!_kLiX7zgo)L_xNLR z`<5?B<7L+G=cA7rRkQu3b#L(^caZLrtb;A3qtv94+sIu; zH%U3EzqHss*3*+Lln^M0Avef-z;t5e33i1hc3p*8W9$3pg3qc5p-{t-(#-tFGiB?p*&jD1*7?Ne`MM~nwydb%oO`qDCg9z-1{ zP}W_|pR_lMEFqwQ3mak|wL@nP$@xg2{{M`S>i=zcV8D`7br8Ttqhg%}nGjDhvl ziQM>y&{y{KwJiDH!U%4udoIv4yj@z96Qf~_<}AvCb!hr63dh)!6~tDa;idxio=1su z*NN8h7p!59B!Vb;joswyWQCVyrDrwrp)C`H(z)au?uv9nj|pL-(Yk2>8jypz)+E-e zVr`WU9ue9K4cdgF)EM-j-tTt+3>&e=@8ES7w@bUnH>K%l-WGV_yz0g6{xhIjV_A=% zxs^uE8Yq4d5$e~W0bR`7RJ@sA@UEqytv@|rD(C~Em-$HmIpf_nT90d;rskljRIbGv zf0N&i!?pG#jm&YjnkCweaRpY3ZFNMS7A%HRy!`i+cDHz(Gi;Yw(;(q}$Ck8}PS@@H z$V#qUG8VfntTvc`LQUM`!lg_z_5cMV%0vsnOu3 z6OIoW!@_LUS8u4pl}`Oeix2)SDK3{zw48j7o`0DKS(Bf#yfrC$bJ({h-)ranpiOxd zM3B<}}hNCD(M>X8+^X=#a;A>m>~K|DdHL{;8@Pg~8N zzyw{bT%cECd-0Vd6B~^nTT7w&^{_@6ojr>nWq#(*|>q(Zm{}Gk)?c3r(P>}4>l>c zbLYSbW6i?R+cT-dV&Sv6I8}5D%ioLlP8}^}et3aM%O!f75FE}>m;Cg6dS0idlPam9 zH+P(d3jfubhG+(iLp{mN+CM9{0n+cE3_m_SI>|V09eQs!O#7Yqy=A z#_H;0@7jC1H--F!Jn3#$MM1|nnKe=~dty5aDV5PKz=N6V_-`Hx>)hXY_@_~ie?oiT zd1E4cX*P25rCfPfI6-4NoDds$Z8_h~W zzl5VaF^=2_#E#RycgIVyqm!3qmX2x|RHfJ%Y(d))cz~?onwD}Ip$er|*ZbHz?%RD#`cMpF9U0$S zB&*=BEV{tk${AIX?kbf^xpv;YY>Yxa2V;C`2WAujV;f%E9x>pBzyc7m`@ ziIF^hdrwM5rcOLs&Y2^;7~++}&c|~i!x;dIy*zOhZfuDFU+QL*&_yvkT&{A1=X6RS z9{186hZT`F^B5#4x-n34@0|FvyYtDVBL}9%!=H&g^uR{FVz%}2)p3KrX5Olb2SHVH z{73Z*gK}lYdi0*n+OBW4l-JX)IW*ux*pwHjEb&O{?w#jvkSOC(=wD@URj%2&p)aCW zp?jERYa}O40^F$=Ad1B?owK$G*S}zQsXyzA+3bzZlYjJaaL;WzMop?7VKoZ1$o!j! zqK@Eq9!EyN+moMF3^06%fRr{7GclZPS~}@a5cOo&>1uhTIu(fqQdO<_{w6RR zF%&Deu;QRb@UbA>B+2pw`UFpdtz5xLbg)(eI0Sj7B3hP~r{|USMC?HYJ^{oRVLf^g zJLmhW8{NFIkzy0&#-4%K{wPfOif|P&rX&i#p}Hr5JY~1!5mq0XrTaJ+34ml5I@W3-+~Xg^U*T*fgCxkp3ka5 z@iQo8UGYPdqHbqPy)SbWb2=y!@Ze4=SiIe6a%ay(ReUK}UAiWWRqt`YnA)x!!2m*V zztpWb*@?m5hiU^Thm?7XP1pJ3(|~^4eGC+Yb4>Vd3aAO02#=4qhe~xx?JXJBRAq!_ zk8ROo`i?kLN=>QX;SSZI<`w4ICSttr5)Q2?1a)topz&(-oZ70K?leQ1_EmbF)yOyg z_PzcJhwF`K-ZF|UwKtA^E9*%PBKEjBDFCryWSq1Ibe5QasJSaCDOS_UtzjnGk+7on zcEcu0$G9{RuevjyXM1wMWveDVpqe9VJ)u8hR=JSpMUWD)P*e^i}# z0Q!AqW=zAO(_@owTGOv$o~Dbz^)=OeXj93#AA3q;%%`FBiGII2rI-Zehv410Jf$u3 zt`#wPrHbsOc=iesqM%p5Pdii!gHSEu*5iKtW;y;UHTaF~2XAw(5U3sIYR&5Kn)oVV zt69>ZvIj{&c&EmhenziR<|_pn!?EN4dx}f;cDXajPK3Y0&rg3tE31FXuo*cdq>8Iz z$&2(W;e7lU)rKDJU6u{SY~RHSn$J5OwHw1;T{Qc{MUpl0aDXCoNdGfY0~lh0zpwaU z0%b^vO*Ni0tuyAhzKWK8$u3#Z#z0?>m}($iG_eOw*O6Um9<|k)b!LoyAS8u$DD}zi zk@OsILWzrYojl8Qm!c9q?ktUO6^y#EY1lm{z<#WWt=VKxzdqo%5Z>PtAw!yl_h)&a z8=u0X{fp~+wph#Qef)y5BUuCd(KdD^Ko6W0iVi%#o;WcwTDUN5IUN@_&yCZnCypQbwe+|sh+dJw&`Q$?N$d_-zaUl--u zrQ}P+GxvHcE+#?QG3|jRpyYUVEFxPt=|?pUuMXYlb4(-9{5TnEK=8v+XrCmEW_om# zvIYZaYgN)$ z+1wQ|+6iv*3=b`UhnSHN$>Dcoi@h(s#(R@NLZ(HN+poserMY3Ri_37EQzDc}}SB@0dA5}zyu z#TNbO%s4M*X*IuAsUs$|u}P%YqB{J3ha{i#h)zci2+dQs4NEh8w0oXp!Yn(4Y` z`Xhl#VaZX{Wo4*^J#q)DpsZDV795&XE$hvx{o;r~ErxAB8e;TK7zKxXGQ%n{1yyAv zL+j(ks|MXge~Vz;#7z;yLWB+wx|^_w*Y-8C_dYqK2>H^aCTJ3xJJeDc8Tb5B&?ure zzJ%SPji!9&{-53AbI(!;!d{Hm0_C|0r_S-!%qjC|LJ}f%VnbYQl80GP4?e^sRCUVC zE#+^uRV}4}TI6J~p+c*xt)ezI0Avh!B6Id6I|gCvAL^MA7*Y+IftIhucb?g?USpUh zY#*UnG~7W{c^Z?LPAfy4Kc^JoBOmP+IDjJg&;Xu8IU?O*0HA2;`JidDmo`Iqqx{kA z>u|RPCqyiwn%!KZg)s%!kHsa6hKxWu6&H?6qU`~Hdfx-(z+Lr1`;RmgnM_^34qZm_ zhe4Lp^q!s-KOKso;p8sI-sngz z8BK&Fts;Ie`qrE>tYq7(6&gMa07YE$rZZ&nLd40${A(eTYNM@$Q|T^c~Gg%HR_>sStj_LC$S7% zuG6A^Qr?Zp{ac8jt1~SLK2K515_l+-L=edqzv7e)q#D^VY@QNbA6xn|co-nE!K|pL z27|iYpL=Ubv$pH#Fxzi}Az*NKcfgzgWBc}4$J z$^juE8oY@oC(guyo%YnejvhA}2V-71l;$fIaE5eOI?G3YL#&h76Mb39%Ru9 zF2kFcN!3f0Revsbx;k}vRH~=V4%Uq*+Xd1uqkP0RcD^Q-TU`y|OZs7`%D!P%UbbCYQHCM6Ze^9AyuC2{pu;NZ z)(z96EsQQo6)k4#u4G0P4Yn0RnAv*OtKZ1P7{rT5McB1;s*zoZrBAY%GwNWZMt`fj zS1s1(LR<8Y{GpvvXFq0B5#lCrbSU|ty_nCrdy0u-F*(_Ec<6>Sp!j1}RI&FSY{ctm z5SzO8=$W~f-$gy&OT|k-txI<>Lz~N5vNQ1q0(R|;h)xrZ)Gs*aO;M)YylC{0k_0kQ z8yi2QN&jECR-Kc5X#0dG=X*=)5~r3&-3Q=2XK^ga67y|b?kd$Y9ItMTIO9)0B%#+4 z9S}-8X;Qp@l#!ib{oci!X7<3{6RPjPuJvR#d6g%uo$m^iC-uG{_%y6m%JhBH;G7OA zXqgF7va4wNz;FKaxSP~a_eqH;M?MpNFSn0;0VTRlU#BbwzMXq)_PKg4IlAiP*}r)% zj6B?!n_aZUBG;&Jz&Iwy?qxVxHmezCfF8V7p(G4Wee@+M}= z?&TN_-c{Q8mmO`|nv=;KL81SIL@v#A0M`Rn>u8f0sq02I)7gdC`YWy*K}iyKK%o?p z&V`E22>GWd`cJY%lng6=D|sn8D~CR^D6lj9)#Ze&{aJ}J4-kLVhY~*ecbERalFn_` zQ%d`fJ6|Zl+3`41hr;%B&+z_Qo9wqpv3SXfgWpwXIQ^SC&tT3tT> z%#>PR`9ZomEO3bP+c}hoGebUyno_bA9LM#uJY7GVNMzo@zztzwiMx@^LvtKBOwB_a z(H_$|^Ii^e5YxU{l~8K1obEXZU|8dY;x-#4mpH5~;g-cL+KhNVmLH*{2;5H%1DXHzeDPXf z&GvC?PS&Q7NlVv)#Q;)`wGNz@?GrNixtHJE&nGqQydp<>ZE{QSNR@^d>Vi17@ndPE z5ifIXlxjvXye30dl#R*L5GW+aO>Ki=mZ(|CNBUWB1kM0`)aiq?@#h!83UP4kE7=oM z1|YWQ9YQK%6byDr|0BOG%Zc?OmqL!p*7+c~B^)}33U;L={@k1m9mmhVY+%H+p z9{C*L!Ow{4IJaj+U&=Wk%xSUg`6TAWwh|P4@hm%)=1m?eypsv|VLnHHpR03{_P#4cE5ujVOnsx_cB{$zjZ;T7&yt z>H}-Dg>KDICuuA@)Svc}=eUKDc)o=HSF3-juykw8B_PHc^QTMQ=*_eo~mOU{cy@x&aTm-phYHIDA9~_K^eWf&$ zoT@KLghD`K`m&Bcxaalb3}-Tt>|~uamyvL_6TBcTTh1Tg700fkM(i(?Pz`FLXeieQ z!+yj*sM7j3iFU&V2Al-N9TX5EE6o$(&@~Xr^5YoUn96+qoScq@q?qjAJPZcLzi$r^ zkS%4hk-e}*c!W+J|MSesL#yoC%F!@7zY7d z1>E9URcdJEyv^WkyjLNQlxSP&1Yl^qI_b1(A$gyIhYCr#A&1T51nNgLrBosp{+$-b zU7yN1y#hE;_9?bHqCsN#rm3&=yI9VVZqY#~h+lRk@sS^k*F!1YqoalzbobS<6<+8eA#cA0 zy`VsPYh@4ySKED6Vp~WYU{UV!J}jO3Q5*g~5&jIGH15xCRJO2<*3 zvt9c*RlShE^zsDh{yvhKThQ{LhMidtEJuy;dPO7(9}-_t45>)4TN@fvW>?>qfoRYb zHk#G>0Wy)-i`kTqs1~KUbP| z=Ks1uH1KwTZ$9v<=Lh1QxIO*L{G+8M6~YlOOMHbg7i5QlwtCVVOJOa^Mi^9D?kX7W z!1`#|If%0md+~rvQ!HJ;nK0UwE|*s3$w=V7triyg;urZf{{EG9`mf(MELDxJx8WKA z!~w5Am0Muci6P7`Z2sE0oI&)SOc)7KqFt)H79Z79c*kIAZ@!0Z8p!y{IQhZyP(=_g zE+x>2{+ox3qw#khqg*d(Uua=1D18W@EdAH2#{!j}jfuz)mO9He(vX3kSPIe?*R>=i zdcfcjvN0RRu3BV9xjU{@L$-V;(us%L#>akjws3{A#$CSOZD1|z?~oDHYibHax!{veayH*lzc z`8gQaNoHK>ouS*nP)p2FHHk&IAv%WtSQPoFeR^@4?{Dsc@*}jXwmHAIzkaMnTh*!*u(d7$ z-9p9*Dn(jYyN`FpSV^%Tg9Am5&U&1#77%$OZB4 zL^l(Tvc-p4HqjP>AJj%NdjIATp4jxA2OyKh&E{8yT8TO$AR>?7%V_ww{7}|p*b+xm zIw*_F{C(gW? z4DwUi=mg>39rR^_4h3S&yKDfq>(MoYixv$B7`O+`Fr%9mj(g=ae zSlliouA@dfsUP=-jqqYH#9~292!6d28RgUX6Hw4~3N zl!CFrCg*x&QR3@}l|rL|yrr(kJXSKId+uCh2Om;Fm$_0VP~F9h>H(p!H%ln$xAK0% z{yeXZgVe8KHh<4}OI7#0oM*L0^U+QCuXwAz+442|r>#PQ2K*&G2i)cGnqC>GW4e44 zt;B9q7rSArR-0`7w1OjoWrXOR%>vJ@Js`WHAI_bEN(|av2)dvnABIMyPhcp}ZVv=x z`mrZ=Eb}bo(VC6o_xs|~3H0zb%NKuaczcDn=~vccgb$<_ zp}%QOe$&;gtaeUMRF+;izIJqG{?$D@nkSOM!WP^ID!-1S7ubPRE z%O82?MZ*CBQNvvQ834%HkSbs#urB+Wz5peey=~|~E~cVv#k6g+mw#aQ>F-&*{JO{` z_+dD4((uzf6Q>X%jBjAPl5FscD;A>S7dG$J@}_O`ZKnDN5B1{Fb%TKS^GloJD=S`w zTs*cFHuwVLbVFb_`jy-)?a$cwn{i@AC!rE)@8%F=91JgZms3>Ti*Z${Fsvt#rVEy; zqtU@+b8oO1Hs<8ShnXcKponu_4WvFNZJ5B({G(Nr&OZiRBzvULj!}XKaPRy-!H5A0 zb!({RoyclO?2E0Y1lvM4=)cV*SYPz0Wv4GAN7hfzlYoH{W;)6QCA}PmAg_2FQhh2i z(HXg8La=`OiJ2Q#YSGUl8fM}4E+EIvEez<>X8B3EmAoC)2TfO;KR28A@yLxi)1;`Z&;QCz5Y@ZjP4nro3ULB$!9G7S04ZM_JBfj z@OK_fIe&q^QkF3Vr+{e>B3NHAoB{{q}KMMQAOl!gh7^Ty0cLu zvgm*)endCtTwv{idVl?JnU&5?wBln}Eu3d;&xytX?;4|N$rE_b*7Gec*BccBOirJ* z`NfJWUW3xWHHpNYLLkdgX#2}scr@ge8*}&^8_&blBd)*4_x|a&t3Z-9GC15cFB}u26*>8Fh z;i`U#P5iJZ69pl^6q}noAeOXl;0HMnT&61L>aFQjqPp?NUQOkulofFq<@|Iu&WAl{ zykfh%Pe7jrUwcHKyQx|CQ9i`|%!}c$lcrw!R#SakDEC?{t=8+ZIH^E7FxFkhiUM{> zA?*nydN}v;-#iov|MT)+8AE%>-J&B4D@SGwO8BPOrX?Soqm;;ukFZ*kyHw?|6$$$r96uSt_qIn1wv5s7a4c`lp zitYNDN{-n}2eC9MSx-~rftu9GEI<2?I<^bOCh?3mSDYZ+)5T$I87o@P90^XaQYI|P zvuxIGTaV2z|JUx7sB%ILQ;wX&68W}HUQ@-`!-=t8B=?AfdD-BGHof1!1>)QGTn!==nXf41)eYaKX*z`F|+@w}(yG7y{c;`~CXZqX#FuW9{^0B zha~AINq+Fl#)qs!`Vu()VFAe2Zhs$dR&%F55ht_Ie^ha-Ldt4~YA>gY`>BR|U*da!i&G3? zbZKo^Q2{17Q;;9{WPAfsmOIHl1`^@=tO^Mf>ilGl?dt1a->mV4yVe_#god8k1k~4z ze*(ahiTsr8%H|#$honQ_-{x{jR**{eWnZ=<8ZVPX_pIQ=f!wTLH7=;%g$Mk3L2Y?# z6)vTM98_+~axVP$F6)*AtoV) zpb)SI*KiB>P^3-b;9u?-|7L5!o&M&P#1_?q--sQjs zAMW=RYMfVkw8V4o=THN9G+DHWhWa!l9x|d&fZPYVMQvCnYHU~wrW~nN_of|6L9riK zN0y=)5~$*Kf`M7VEtEzHtTMLn7mldWiGr9SMh=ifSot>(k4M<=Jd$JQ0n8d|nK~8- zpJec@{7{&N=TmtXpg`)@3K@K8>WoxxOPdf4*f2}D@XId7G*-X@zxGp$)6lAsIROq( zwGLBYIvse=e5L3}7T6Ki$s}qQU;~CIgkB~caXpudXnY}pN~>hlGINXDpZ9?ZoTR!! zn1Z~!9=XKgJ)=X*94Iz2Z_RxCd=yj1^x;r%d! zEU4bQr$VXpZ_7<~<0}_5i1oomcUTu!7eH16{aO5(3F|Rl)*ZfqSEq?$Nt*wa$A7(f zrqTbO7hA~pM%+q839rCm5kAla1tB3UzrZ7rZ`;;!{$6CF3R6_vl^+h5LNQdhokwor z^ZD2q@91w~jVHo?n#ut`$nNks;;}`SA5K4a4&|z<*ar-qm9E4XUO?~v9N&<$0`SHj zi&qgbZl_%0+%*;j5NNya>us}0CCeGOH;_q|rVlI%$e3)Y5>)U!iA-as@1=20mi|fU zyCnv1OGcDlZGcpB22rc9rXd=Z6-png)n-A_iHVZ(B+P?YdmW>sGQM{*a8zEZxb@!m z`=due)GcQmtu3jbpC79FEh^mdeEv)!8Z1A&QC2o3z5Mv_$= z+a5fAQMMub>9VOwb*`XOsg+sUsy+d;+k`xbs5`;obijj@#qU&|81xM*P|~9 z@}g%GiB zQQHxrPvYEtq*1bf2Y+UGxpe9h2d3l^2;?|@edhx!I?hLd=v6)>)9RQDA?{P5|~TvI~+ zhH7}WRbg5qX5K^#)e@?GCE#@y8D!T;^{Y3q*Vn^W3$KJ3#4VF1&W*rq8XFwo)Qbm? zU~ne#$4kjl+mnR~f$~TXeL0`|#NWHJPjoO;k6a#ZVi4|P%UdSFl@l)iMZb3gpC6KK z47{gC_`{vCC*J~GimvVBWzy~8f3bEC&XKO+y6`*p#5O0IU}D?O#1q@LZQJQ+Vq>C- zZQHiZQ)}(L&Ym^3_o?sH`Tl{cyWYOK`|f_~y?+dGgBIk5U^cd#kK&}_8}^Q?TGDU% z8n@pu-BNZ`&%vG-;e=vYo)X3YMn~v`apjOaJwd#j@83Mg?>WVB#CYsax8GG9O7uD8kb!*4yYhV(ui6f17W0#jm$Wh((Fy zsfAAo@-jVCKg9_Kvd2N$94i5fsxPM!ekbe^S z3-QBXRe1nzbz+i~*~+d09)bA_I-o+$oxj^wc(UGgzY+>Tz19kryl*pMr_E*jcuFouRn}E zMIC*`S!Hd}`e9#-#)r81>B9?8C6SdB7DSt#p=*5`)-t80WEW0jlen#iZ_>s9{Zpy?C!k)T{G!yy?G_Fn+ zjKc7@=Wy`b${4M|>CXwCS>IF%q91m%>>tavtmb~cS|A~^prRvJ&5VM4fp@665Y1W( zrtl=Rz-lAS>&b`JBlqm}|y)<3BXA2pn-WjdyiOoGcipS$Rv2x`S^?;vbkIXqW zKXKNkPN$)E%zfjih&41XSU)-jg?u$+ZQJ%JjT3*^6M@sT#0~Qtp%uM66s{(>m&$Fw zIO7IV{D85}h@NF88EEEMmM#=Jk8~x>GDC|W3{_I5H-a=%gss2(xVv9@mF#A(hFW$w zR^t2Uh8_OwWKRRffmf^Lh(~LAi$)^AKUg3|*gkYqbUlRRZx}WcD`xI#cnkvt=vB|{ zgc;J&^+&Vvl9u;*Gy>aF&rXn5>9c_&)rZ6f(aYMhSQ)_H_%(21cH?e%yfd^&QXz-yXpm3Ey0tC!~-3Z-~1l80vjCG?$qSX8Q7H= zTo`ZpZ6h=${fCo*IK#N^6X85~z7z#K=TTudxZzDWk2@e)^VKq~4>p zK}L@q$n`---FN($+J-xt-Iv^w!#Kcg^Y|nThQ5XCj++{mmF6PW%{u=cd$ykI^-fZ; zToos z4hAMIAMl|r$Hf)&0LS(AQtY3?*i35iZJ;AXi|K{1D@I=qA8?QLkTo-1W55-p{QG0w2Tf(=TT3`#`}9cEdY zR5*dQXPO^ONSv$N=GUnDHCni%Mu&cLDGGNTQuejLxi`brPjZ>pS+XhWdM1Q-aL$v5 z(d=)M1V--#fo5!-n^t0f)#IN#dSoB|-U`sRlJpZczvI(F1mYXo2wEwsTK+`-7JBLK zX?sk$f}$uLFve{%A=uN;WZ5=`FthL5ppP+!tcJj;{t>cXw^e3S&u&#LorjA6p;^G} zR|7cop{DU#luM@7zAfCu*GhaL)wEUoysZj4a2X}+O6ZT*QfK2^jUM zM_lf+#^*zY*S4@k`SDxNa?c7-9_JyZXjLHl#*vTQ$Ww-_q`{$ho48PHy96qVW+s(R zMO9JIPkAscL53Hho*psXk+zW&IhpjAgTOU}-lVUNYT;~r%Ye|QAH5skb#`E^eRYT} zK+(=zL~1ofGvd@ytuaD~i!&{Hf@x~7@mx~d<4{@_1w1WHW>bnR6;~KfZYsH125bd# z#24+FpwrNN06c;<`<{54sK^)2{9VHgRB{37itwo4>me8P_cETe1OoCU0uWkCZ^SoD zxrQYCaOK-ito7LA;ml!-ml^Cr;17!IJf9o5)j~N6l$Aj;cvoszx&$aKGe{H046jiz zN-5SEcd^Ra%TUq9_MFh~#Xf0Y=1xmB(dEbqmw)lx2cP6Q==OqdZOx4e7`_Xwbq6~+ z45s6g?Xqrd=;lgKks-%D7iJB+=@+^W!CFV=3~VN}@OVjAk7K^3i9+0dINv-Wj{p}| zAgiH)#~J=fJQ8M%MK^8Q00sf(qFKDdhB-FaD(tWCRU&SiOVz*cUMHsY-F|!LdJgTI zR?e=rZpM@{oRfmM%g{T*mrD-{iF>5(AXNo)vVltX8`WQCM{Bs)Kq=>A;?@`vd4zSr z2>UUkN4c+Z_!~Q>Q0O4SGUj0~5WHSnksw|dn6=|Yj6eN?meEf{WwCh$iITk1x4Umo zq9?CTX+pG6bZ^nJOS?jhdPZz--Z`eAV%(-Vd4i?o)55SGUkTX0znY!joz1+LQd`!2 zXf$W1H69OuQQm&d`xFSFJSNh%#2^Mumv%JA!5Bah+Ns<30qi$aJZQDDuc`t1U7!o}!j9K2 zC!cRf4gbWETmH7>BTDG4xR?9b$-+oM3wMfldP8_+U%C1s`HGeoe%uiD#|L~wY}-=P<5um!xV4WqgCuVl3e z&41^iuJb3Er3BK!m2KE$fAMKaqp?@U+~~)xr(<&tzphiV20!oU;xb6H`-m1itfu`~ zg_2VG24RIim$pjbi$B14Kv~R>aF`@a7ZlPJPLt^SqijM9`>G}FN@bc?RE$HSdOVmY;0 zZ~e*({xSP2brT9Omg_44*3H$P;spx0yl|{qJ*TiARv~ksk##4o!Qcen;W0ByaDj+u z0QS9N2Y<$H>k6=S06FB~^$T#@yJo7!fX9&CrV(MzT;uXFE|h?3!H*+QeWG!ZJP2dT z;`AhO=J$Gh+xdG%5Y)Q&v9iZFyn8j`8@g|h6l&}AnIUsW{oASJsG=L>riehn8Ot!b z5tC(0iMY;oB-C^~ScOGeZzLpb?lbr}PrDO>S%>2jwMlZpAu+H{%QpdXN?{9kKEaTm z0*yDW5x&EDB`*&p2h4SR+q16WT=!c$ub;S{=@BphkZoGP&IUIS7l;z+qfeuM#_1}5 zkHXBmFsi&0S6i8>IsM@0K7%_GvAX}Ws0)$)#-z*t&UedvBsOHQIw5c4i3Ar~#D`u$ zRsMyc`l`yz%8|R?W~?;7$`G0tPC_CHYM3H#%KBd5k+>Kgnv^fuUtx!r)uZf1xnEK3 zaG7SyZ#Ko731R*@wX~xnyGx}7@7Wy+egoH|Q%M_3U3Sp=2Fla9Sk=a-{FJRPK=mmS zMtWlUwe@n?3@m@WH_pO4Szxw<`{nug!bwbb5LOTU?(>5qDGZ2z$iLt`wWL+l-J2_r86MOVD9{*(=hB`aH z?=G%*Xo!83Mli=52FFKEpZk6!BAVx7=^bs7WNq~I4iP zH+Big+}O8S)jlQ3=sDd7xw0kG+>sXkZE7dbvq`f9N1C7}mNaQ`x0wa1zNsI<=f`3ZQBUACEVhg6(jz@g$Y%V z$jdavSvteo57zlP9O(Oi8FBO?>_MA2E*DRiL;n#%wdpXwjXR~J^&{qKgLtVsB}>OV znD|peu*FJhSzky=TfpZAaEym{TF<3{v2`EPajp%!n)Srf9T4MQLS^Fc)JT=@imb2D zj|+>4!@+o$ay6_)v9Cv%9vMyTJ)%9!Ov$Zob;XHu)D^`^n)=0)zzX4t6_H=G<>z%% zml9p;XGadFz=J&>J6ZXAJrw$_|Eh-^oM1rGmEr_OOtey-70ZK}@qYGVln~9lcim=?N^c(}{ezaMw?0;xlS5$Bn1= zC+BTE@-2lJ(L3;xFO{9zM`LO?y5EuFsx2ZV7!a2z-}>Yq0K9DzO>eUdM_iv>TN45e zujGfKDJvizK`lJPZdE6Gy62HLZUh4vad8BjP`fbu2Xn4H zz&KZ?dene=K#KQJ>W_fbFc&vRP1G6M=S1+T9zNR<9TGOWuniq+eU=|b8ZFtq`Pc@N z<*TA5yrbVTj46Fgmsitdw&};PecG@e$fMvVHJcaUz#5Tt82!TBy|E~ zFaCu)qija(OW?3D59D~;m#8i3df&=JbCcm&LG|lKLaYq(Gq)fs1;PVYwA7EQ$kD)w2-_}B-=40{pvgF z;`*JjsG-}YB=Ba6G1uP$0qVSWGFcpO(Dn01W0q&K zl4V`D52yZWzrJ#k*}zhKIBdVHxtRI5vtmLQ?ZG=-Cc2c7y(k?OTtM*YA}L+j$=wNW zqUg&p{?2ISc~GGp;!5kT(cb2DUk2+D+34w4{I=wR;C0iFvr;9HSt68VkH(%g=}5}~ zt3AOiSw({`JD3nVJSuL}%+j+%;Egcc!)AVh#FS4*nT>QZ3@;IcEhuMVoG*1HbV^t_ z;EVe{l%Uwp8dxyj>J#=8g4HXdj268@@>i*ju$cFQaMzbq8I3Ytd+MF+Q-p7Bra!!z z=~A}j``Te<=*<$KHW8Sct{oltYUC!OBUdkqv^eSJJkT9ZLp$7!Ip$ZPm&9lJ?08Q} z`ZUyzWgfj5UFM3*Jx_W8A3>B@@o&5sdZRCys-~nOjF*poJY4+1e5kU#_i2WK9O*ix8Sgzs@K$*0$9RRjrC1gGtZwd@6m;24^eHn zE@DJ9W4~wX6a7a${#obt_n+$7t3z>1Wg_07Rfr$j2st%)YlEkZB{bvtdPP-7BPI>m6l5XU^R0`Yn#;581;{MMjR?^{p58e^ z(v&cp-=HErpKyVPG2uRSv4Qj;=NMz$rQh9Jtnd%m>3==I9qfGux_PJW9%9BQvcr*H zKa2+E_&|UNMlb<&x;(xG**4TD;ai58-kOx;Xp(WFOr&baIN`;d*Q)BNd6x|*ZRaZ` zd)I~lgq0$~%IEeLj#~TJ1sZ^<?ONr6Do86y_~okX@C4QUw%3$41e|9p5;1XRQz}aa37+5T9#WM3MK)n zM#FF$l4x*ig%HvKqex(w7n{Iq5&g&}?b!vg81vhifD_Btf{`TJf|jX;o~>47xGvfG zU-@e;oO%{EM5mjWT9wxwumpmMZW55;6o;)WFxl9XY1u{A{$PGe8ER2^;h0T7dp>Ae z*3d@qK+SPC-|Miy8j-t5U_BI^sDOU|E-xAKDhNi`F~qMVP2dpMU&0Ovd0{Ms79Vlf z`YGink`q3kJaP-Ppq;I)QbTNFTeb|d}p`jXIQC}gn?cqu6_V9T}mnTd*kE9?B zF58XX^r~u3G)c}6nuWhb;@Qtd+T1%`&3q?K>Ut$&sKne7A!f8frwi>AZGq2qtAcd> zff>^Ay4WzX<5HUDuVAl7ie&iCRQ_Xlkc^s5kx}!KCZ?}smQ5IZu~DndcAgl3E>Ry8 z$~uUJU=g(fp|7>G+}SBauU#M0+EeulT|M5)5rNgUj`5u*7NU%{1m7ruV`s1~CMxk4 zG{2me)Gzr4p@@L1}DEY8+Y*tOkM+iOwAz;&fP|0{`KL4^dFO} z^888lU*A1=p9R^-0WM^8Q%Hc^0tc*Y%bxsB{>PPq658Tk$~1_AXahC1IH?p*^5y4U zN0go!NawXSVl#OEjD68>y;mf({&Z9IDJXhhRdezheO@o)9$3+3H6GrCjLR$x~Pv$vX4f zM=4eY41YM|tXn2P#V zivF0X&My!-h0NtHJ>YQjSb>5tOCEb&ID{P%cdMXOIDFOZ41j-%litj3DVf9yN>}tt zLCZ1?KqMIYC*H~{uCMZuOFF7Dp8C1@mR@iSn*VnRq@jE75{>RK3?4%RdNRS3EBmv? zu?idhV-eZ|W*aQk-|Mkd_xH-*{vZCw27~l?5CTYmAf$p%5XeYUe(A87HN$tK_|05F zaAj1fUXAXKb+MPXf2;^rwQ$|iMMecC;rn<7 zwRJ+-NKiDn8=-`B%=*jjjb0F@-&oB?aonp``SpGl03XDlG%a*o6vJNadWOu7)b#7| z<4rQ74wsf*iVf;;yW>tBl$(%}EYpi1$`aW`r{!{}1Clw@U)CUlXO}aaKT*lYwleKG z+kF$;6mMUG%bq##O>}gjwvq~nE~rIu^kE~A_h-g)b2=`UDp28mx|+%oLI70{i;F%Y zg0N)w+&iM9tJR%L0MjH~k#)_|HufaI%fcZfvRQRo@~)J4J6aY=>cpD-Q7B%4-5MY< z)hv0w%&d?(PNRDAracg5PW2J$8xt%Cy8^aKK?q*yc?tGzUoYipgO*F5;c%d$0+^!? zy5{Hp1j#F!XDr7PEax6$NB0?sLQ9b0L9Xwr@UGB%4sN2thsr;{U6Aq^zphuV-q#S6 zAgRJ|=4@WcSX>9srYC?EQX-^{6u4e3v%+QyCsrKcZn|4hd-3H5U%+)iQX++v-w*Vl z+m1w=FcBkNxqdi|MT^Lq97t;Ng0lG53J)682b!w2SbT#+>CN6iq?!;%W){M6E?2|v z0b?^emYGUIxL9L$rNb(85CL$=O;(xp&Hqu4zef`l44Ux2K0SJVxqdZ;hq2t1KmsJq zgulTv*|*I~Wf;-7cA2HiLcYw4gd{q=+D4 z)gEw=QR_IC4J`PSVI#&w)~t?bJpvytTFsH%PoDi#qG{deC988x2d%m0^yEQ>M1~~$ zMbsDo6bc-GacPBow|-`tIeQs-67}C-k3uzjEGhf=nu!A&p%TkVxa*}-=%-8Xpt&ml zJuxv)t*P^Adwxq~hch&>K~?vwkeAbslK5JieyHN6`n7L9H3c=oUSR5dYZU^U1z0uk zL}UV2OnALzeviSX)`R5RmmJj$6VlAJa(r6^#zLG4moPVnR^C{129Dql8e;dx<5INc z&?LFCMfBEAusBTtUIZVcd2*!ReB2`BC>%qQm=nu>3U=kr4lJ7eJR^l=p(Q2IWyhda3(rkt!E(zfoj6OImr9NM$eQbM?Hc)zca zf$?h(eddD+D7d1{jb>s~-i3?=QE$41^NiX}h22slJNi{@&<3`b0XK9(P!Myoultp=Y2%phM-$4xv=y) z+ZoT9u;p-Pw~W4lQR}ZP6pE^^_TkSyu%2s*90GA^i#86L|4xi<#<4!wth`CEOwAjE zK;c{#M=7G{-`qtk`Q4kq+ux=t0FwQu=qb)m`ZVXap)klnR8MxYcVcNg$hhT1nuuB5 z;qt`yh*tq7*0E<*yjI&HEvP2&f8T;10P|Gj3mAHOp%Go3%!qV|u zZmL)Bb3FSB;8#xRH3D6&c5k&sp-#%CZWpLLQZObC8f=mw-6RI+xZ!e+KgB`uaJG$v z-6(GBY5vdhg{hN+sg<6YC7pqd6>k_w_ut2Rln|f_G_wSME)|1BhX#d#h5H|N!ugBC z6GfM1;tzL&HI>hP<#^LVRVJwm4ddLL{W9U8PkNVvG$4HH(c$Ofl7yOp4mbZM^r6n1 z>`jwG4HM}Eok}4*YTE$uev%+|ec{LId%m4Www%9s((jGVf0XBccr*x3$R=w%S}v2% zQ$!9?)?|3#7#>%*87K*+krAIZM;b`H!$yt>#7z2hn=vKAEoH&778Uy$bboTw)&3^z zR;HLkZ=Y&zwFO#xyoSi&J;0)GdiePgORW7wXXz+>g1i7aNc=}RxKY6?>`Sk_vg-F` zV=I|1$C5{(f$Pd#bh8ZEhAPh}4eo>_xyAm{A%iF#I_}(>@h_Gy@l5jIC!E<{i%|V= zwvZ@=Vx}&F*&ut?Nwg&m!@E1s_5C#;MEp)GK|K1H%p{nJly4hZgtcdq&_0%>US%$w z%$-jLn-Hx%iXzy|&DdR4AJOtCBFIT+c^rv94r8!0CSc6Wx^ko8mw4tlPl?qj3!{+7 z*Cizc%x3B;Vmm6yB(Y?WDH76caW=>OpcQ@}C+1IvexEiIh7muMOKQM_t5g;Zs{33w)Xs#q_^bSj6e7+S-T@9<#^it#E0&JBn9A1$FnD9p z70;hCet7f`*i4C@ppXn5UJ#criNwFsh8O?5C=f323h*O?L%K;I%$7@i zab}OiZ%OEFp&=hG;8pFYT@K%*W5y~^Jk{Lkk)(AB<&ljxQJr%3IrPtHT}isl#>@-} zG;z=kPd=SQl~y27ZSZ!gME3ol66k;BrMWn8xzE#p09gc>uU&j6A74{Aw^Z7(QS0Cy z8nKLBw0y{D!W}qFJYJ8f(vW$1QK*w1e`yKmmuBRG0-N1Dc!1gll{mU$|B0M)>35B> z$v)-8$?M3Eq?1OAh8f}!AE@GO?G|p=?QwJw1vgH1A-Q~XKdO6AMi6Na=-KZ53JVA6 zru@?wr0^<`Kk;kIuLOG*wbH{G_-~_YjDp=>4jk4{2h|PJpatq+XfYk;m?WMi=Wh#n zb`3&mmQ1*x%JiFj=JFgh2;&1fZrogxWOBRG&6xSN<$!OK8=bb1b;<^_?P<5nSTG7| zAmKy(0~$BHF`(%jM&aLC2Nelh(q>P}kB^$@F%GnjWPh*6AJb-pIpT-8*Cf9JaeE6| z;t&@xmDqP~QdrifWTJAIEO@JT_)kx&$>J`nwN&xOHe?q~m~HXIBQSolIRGzf9!t>V z^k>BFIV)Agec0hiU;NwaT*XTjF~@M zdaFnu)p0K-#i$ujp^3&zlBpmSlt&5|G=KC82*$sXB{Xz*-YTG2tMZ(&inSQFR7*0> zo3^25DK!n|uMl9lGd3#uoF(0(uUd`sMRH?e<82ULHDob~Ya0i1+kBP$e(JkpAdxnwU?pcXCPP*j*w1lUm z;Wrn6)1N3@^TspMqb$#sfD50eJS@Lu3Ed9rQ6U-B4H%I4_c-ydX%p)N@k3mLB+Ql^ zXTr~l)X2h)x^X7Q`AhAVjy|4EI6l#551Wb(9;HcAn{czXRzXoR?|~M63OIF<&T&Pa zUtjQiA!gclJu_q{7Rtz~)~#oN04++;sHitiL1|Pp;M<5nn*KR@B#1#(=LdnN|^% zJz+;p#2$|_Bq5+uRJX2>d7V6KwZFzi4kmqCO^F#9vDj_6pdbG}WkLGiKSusFZF0yV zzQSLEh|wsWtl1KDc1bYA-y_4=j6O}=?0LM6`Uk<4c7CUcqvrB%3$p#hNup=>G%Ya_ z*&gEZpdb-3@CL<$qzu+vJ!CLCtfPFvgW%{|<56=Ia6-V}NDAZSK22w;s_^SxFE~%n zt)G^8T`40(iT*^hyL~&RGtT;>VIk0h0!x8zjhkL*NDv`M2XzGbK2Vtg&2M~~KQfyz zn*2*rVf7kwZ=b_*o#G}M%j#1vdba6aF-8Bg^3^uwGEl&RzU+?>u%@02fm@3yo3xHM3VmO9FwS)*^ev@F~QH$FBh zH7~lz3YI095%4K~;x^9!?e(D5^@EtL2$(#_*3DmZma^dh0=X!RZXqY_O834FvR@wj{xM(b`{a0IAIBKqu*ec|1p zq;6lKza#r*PS6Aj0X7DbXN;*yW#sOOBo9K5)TrJ~&u8Nn6X{V|qIeqorOeZ|=22Nw ze?3;_Tt8V}Wf-vlg&csCg$>;GTucgW@|BXlhN2=B<-pryq%PmPra2WSP+}de!hC0O zD`m14srRJx_|Cd9`T_*TQR|r_xs3{URkGUqat~(^b=!{{H2Rje@rS(b)Kxv(|2%Ed zS^bHx@tgeb$@9NdA94Ks^}lA8f7CV65w z4-jSGrkeZuy1R&+YYnle<+q$a)V1_l05EWXHe15_#e33YLFb~>{n9TASq_ke$Ho8g zMK@c0Qz#rncbNUx^Z8R<^AZB&h@%hZLkV_lXkj`AP4cX9qP#r<0l?FTb_5&2 zlS7!bX9(k%go@5)8r9!({;jS(e*@%5c8|2_Jh*-$mEFz|9JF4^n#h3xJ5AnBt^N+el^8v`_?A#KxQjWi{$8kSa9tPcIHWmT}jX5|HEMzV0~4ixx3*itV024?%sfT_Xno1}Nhn zU-ipMvC?C4+Kl^+rqsIru1o!)t|>48fUE6%#9ugAV6TcT*nXW7`eeW4Xaj&L;!Tre z;E^o6Z-+VZjzHA%j@qBBoFl3iwo>$a&cD?)Qf@#t9nisTJV0h2R8vD+5sE54B+BT3P7}cxSKEe1D3uP70g?KhBE+vclU&_#bYJ`8PYr3(395*(NsD*9TUoQJ8dNapz>tv^Ok$@a`8M_wZ zz@Iz$pc6K7*Mi5Jk9oDf<@}+pNp%8pG&MwHJ$Ew$x&*|gy#pXy`&uB?0XbeNAs@5m z*(Xs9Rk{vR!{)B~Ptw2TsPV@C^*;SaT{D;fWHYvv1@|3H@gr!X5?Lym$#*9lwE=(; z6-PSEI$gA>Q{73drYG}LSh-C9%IWwk=O1;gvI39+9?Hg1JYJNwPfiuO8otf0ht5F* z$kBSamm5YQ^|96MxuA~_JwVH#5&bPkIsd3@S9Snkr7sgUlFpgAzNzmVWH(zQ zB^XT>AjdF2D|vA`UK9^W4lh>9-^nR^<@vXq?}u)G<-ln0ohwSgs5zGdvXCp5zlN?% z0y_pa-Rpa^e=W8i<^zD04Jc4|t9(f!DuhVcfo;zqf@i&c;SV1iwV9 zKL=0@mq~i6QnuU!fH%yrk9{gey^~kIBQKKcww|1OQe$^3carhniURrG|s_b>M)WWBjFW{b!&5$@xcbYv=@IVIddZ zL>jKQZ{qj%J$^+&Vt&m@1pxi|6VB_;ZsvF>dBU_Tm zD1`5q)2Kf&%aosW^{CSf$mUDNp(AvP-Zr(RnxR!s5oJ9O!Ty)t_VcgT{U5!Jy#N4= z`H)u%pMmh*=K2h$AzKE35YP^nd@#SD-Xi!?k8Xc8A~0)WZMacxq1DqSL%ixMC2IV_HYY8Q4J>?X4p2BM?{qGgHQFK5Sb_551F9G<6DtJ(|?`?`eyjt%TAV(mSmK^V(%SnydYMo2A zol2SMVD-10KNPr-eL#*bdJnl6ity2jnT)my_y%)966zWt$BQyEY*CCR-VX7mDmF(R zUO8mWJyh#|Qs90i0v?NyEK7CaAgNK<*uRm>zbig^&X<_S@apr89S6SRVFEr3x=u`` zMo5r44NLPLu;3is1S~ZR#F-zJyUMak$|;|JL)!j8;8-I7&tMGo4NM^xA;aM#ow;T* zD4aFcaC|+V*M1e%0=ff?{Q(~io1QNabMw?0MtKU-(??fa6(!#Ct^9{<)63(2s#adV z<^O@eMVSFUl&iiP$&r`n-ok}yk7VeBo53KWk`^4uzkV_1bof$G&Jz+Kp6hUad0=MOVJ7y!6%vDR?I&4#m3vwMvfjElI| zv6Th@?#l?>UVrya9u|!-OV4(54f4vVfyoFWa!Wy;5Kf9~0o@WaNRWfA~6bF={F|M3z?)-yiki zFx)1!I6aFFo#}=swf9n@p8T$o!OO3{Z&>#(x^GMgdziW0c<=unyc-yhPJ3xc+Z}P0 zuF=ucSQ#@_faFpBHkGp2YerByJs@ZxO?jVGxLz0O4U|e$d|0t(48WnhkQ%f_uF42c z6_bPI<@Ru1s(DMKy%^z7-^{KO)(NZlQXk|gX-#(b;L!5b%>v_Td)>Oi-dbE{3m@86 z^T;zjb1j@3Gdt8dV+~UgysxleQW={`WpF2Fo<=!AA`M2;ER@<1tL|aa9BK1 zHq9?M{j)uPugvNjR%AGkmrI=QHSe;8UzfvA-cVNkzbt_$6#GzOzpJ7&4S&Z$gMc(M z(-P#B0h_ZRiK$b!8AX9#6oKzt%`TU?G?aaoT)4?#g!CYSZyu6`zFI!pm;dg|?4ra@ zjkOWlD1_NWY4${VCviwi&i1vO1QV}#^TZDc%@N)`{lo>G-OS;=N9^9Ot#-klaLxH# zsG1cQhMbw)f7CoH^F0}6K*g{u>g@p9MyyUy-!-xcmVaF4x6AX-*z*qpcft+zVLfjh zNrW8^#^>0*=Z#2Uc@fxFuICN6_JFRY7)5`^0i4K;~7|D~dCvv`bq z;hpGUM*yyQB~P8EPN1YjAq@6cNaD{SbB(_EJPJ@~O>yfL+B7;(L(S#6idm`MsXN_< zIRztrWwI>oOTvXv&x1S*2zmomH5Fp^P|(7=k~0++WiD{bKbu&<0Pub%02doU$YiSIdwxXT)L^~h?c ztgg!NkR)TG-q6tp2S%#0f(X!+F`z>##P+Kuo7&&eVbn{CVBRcU}JjANO*X!u zyG6A5+@!y;C`11nfqVaJX8s3(D+q!Ighhk!#SAlKJG8?0y?SUxg}!`0{6*vLSkP7A zWPWD)bkMGta)w-FOxZ?ff)hVBFnhM9bIi=R1R6$$IkCW7j@NB5ht`VedAZWniQ;o6 zf;`vh;|sg~qwr_7q_U3NbP#OM1Q^93&_NrlJ`{^RG#np|J2=9#{#)U3g}zvXoc@r* zGYoD5CRdjsR`s*Ohxc@_cfCLYnPKJR86Ms}f=|FSHasF=y-h!&fgor(9Ff{UecGc(B2z$eazy;`p#*kKm04eFezWn5(5`w0K@q|7f=h=KKTUf{fQ zc%nX1ilxwoV2@bSc}GRB@R?&AN5D-%b<2WFMo{C^{G+rPg& zXCm+b-xf6@4W+O311Dp77zI1{yUWE2cxD=Pcm`s}w!>}dMb(oIp(Rlf;!)InDhO1$ zp!R#v+x$5pWJ1kxG(T4d1$q!1{N#q%KL1ShLuJjq5?KnY5Qmlr)k){tOM36ZzKJo= z&7?glN1iTk|1$q0**0A2a&i3#(s+23>ZFGk>NfLBup9J4F#xxgCb`z3)WFM*6DjfS zN!ZPrrVe^@qOoBO!;T(7V{e*O4pVX!N|vU8UyPKK1+!y8Gf89D`IV9!_6?OkCdR) z1pd|tuhYE%I4FV_ZNid)1O;6p;=wOJr>`DX4(YNxbyJ^8>|#YKuat}E<`>?Oy?FfG z?1Fe03}7`^y)sA~gip})#T>2!Ra~#;3IBz_?a%#rTn@R->dRg?w{qW@>J2jQ}jIl z;I~wYYl}yz%;|j^(}i6J2-+MVdIjyF&?=Sc-eytJv~-t`MkMmZgxa)6ruVN?ohSI0 zIoLtPtVK|y^k%8ykmKXTz$M`=c)fv@#ka|yb4b}sco~_MHgo@Y)h(>{9hrC(qg}wvaF6-&xl(*HTowW<*N#`P4(->6-xY zEhZ(KOO)mNclfjffw%x>0Wb9U;MCd-bp6$aME|*wNu^$zXORMrL2DfSw&e!l+x3=j z4NVt*HXY~&T$2MX&^qft(eU)bX`aywkVNVAd$l{i3}hv26%}E(%V3kH`!Adpp+KVt zW|ag;SsJ4JbxrAREc$I%+W{1>Uuo%Z2@}fY)a_>ml1>z)p%3tMiE8PWn&h- z=^LSF$@{oT>-%&@h&=ysWcMFH@gIDc5gOu$vgVjWVFCRpI8`F70?0EnQoFdmKwUD} z2Hhde3g@Cmi2JG0wRK%tus-{AgSV9F+fNsaZm#DcxaO}v5odQF?aDK8kVK0=edDV1 z`*`P|4S7^4Gab&HvwFe{Kg(F0ug*q3MI$XHzgb45kxS!u{{&X>g64E~3%et)k=(+) zgzvbv8A^rWfpK?y0F57uO8s@|<3bChIYq~e0_wEBWTwna3Gs;PDc=;3F_cOd5LS&c zGf{db0fA*iGKO7f$qMOVT~Zg3*-c zPPRV$1+b5cD8|DF@IHhfX&JpB0WMUsc`l&K#5l8>4?ob-gGcFR53&qkI5ix7LiEn| zz`fYXmUTM=o>pe+J4NyR(T;>K*Q|WA9$RU3{O-$=A7uvNZeJG6go?5nTgR$EBSyl_ zfMTsRjU2sSbA1qd`EKxbdpG(MW7DnNIA;>A^3)W;*>a=qi<1SnbHX=Zm9Z?PCgAKp zg`E@93s-usxvI-{x4M3#_g6jJ#QnV&X-I$=s~Kl&Q7*kJ)mp?A{7#Ezi2P>< zWf8jev|Bty3~DK9> zMa8uG=UHf%*?_itBc{%mX`N2^)E=D@PI&k=N={}q6@7)q@P%sf^*f%+Pv5GaqR@8m z^lJ5`&6hk{^w*Y~P$*}|(hwljEbw$7N@R!SpoE9H9)q?S<2U$Bs3D<6A=$>yPY9{x z?lmO*5-)%zE048K_F31K6VS)S$(2d3!;VL`UJ-{Vo1Ad_R$6eRq-6(T<|Iu_E@O}Z z{#?EAonp=9LO)UDE+xK;L-3~oAshcuy7z~IjFCyb(eDH#JseO{brGD-eliwVyg*%M&Op($IQ{+2azY{LCO(vU?S@c_sNZojnqS_M1uDA|__6(`N8+P_DHRG3tPj%?ZHO7J%Y;& z{q9ZfO_O9-d0JBtlFJTECqA#sFFY4|ZW34(?o#!V|>u1IKak~zJ!H5#actisiZo9yw zfNHgi_L1>4u`HUwIhO!hoNbz>1mj6(Q74!hHxkE-y~#>`xGbx^P$jD{jv}J1u;?b7JGFDSsJI^D)xc2;DQ(Of#6U|?IY`&N zFQXn=11iStn0>0-Q{WqI_YHwp@#3?)FgdhrDFE7~`F=hE?m)e&>GhFpIt5N-jcDys z%rerwb~J$xNUn|{;S-x5*{EB3@N!N+W4YTX)Np|cDNtfJ;0i?^dXcklYRo1HEu2#} z56Os8@otU>t_3CZY5{C|oZPkTlb(bOvo9`CP3;fZ1E|t!GE&K{xW~DmJhrVs zdS@_y&wcH16V%r69hi$qI@0LNO(1lZ3I%8PKmytd!J+)Liol#n$(4J4zqENuwQdik z0SZGh-)A?{B_qq?u||_b&@GI-4QlpGB3f6@w#DD`_!l2GY=QXgRrDi-%~9^XWW!5W z|JL1XuBFz;Pb`4L_Ht{72UQCa0iyNe@RKG`cuwf=Ze z_8zE1Cb|XN+DTai+r1OYQ>`~7{jvTW`yo%hF4yddRS-v#+c&o4Q-z|}1r?A#Y6()M z=XfIZ_QyP?tEneX>oet5pzEMz;Cv}-Bb{DgE=sIlTvu0oa=Edr$Do+X*3GnMgL-IL{48iC=M?WElnJN2h#QW+2$KlerJ zlLPU374&22fPX!`o_%Jd(*3-#o|uCXV>huUvR1aIEwmk7!13;^-72j5sVt7KYWDe$ zwRZ2pZYQTELfi1B&Bm6)4>1zB4iS>xvQ@M9h-uejDc>D%FK5TH?YAoqBXrUvN2%A*+smplubk+Gv5U$ z9hRaf{17&S!zB)A4P|3^PXz-#a-`XLjv5!WUR(Vvxvhl9mx7oqq>Ajl6G4>ckp??n zjnRbL^puRIfos=}le=F2XA1G%b1(@EiewkDaQO*f|IFhbd>Csa5>O(`E0EXvl5CD7 zlN;5exRsvpc;tQvS=c+Y7sKrAL23=XL`_#%tJ=z2SFH+1BCY>Gs~;Z0AfdIV<4{1T z>T^LKR0ebkH1=^OoD=|Ykzm@(;nR()4oUF24(JpS=?DE~WXt5xNvtGvHQ^1?f^^#} zj-k-ia?uhdqpn7N)cYAm**4@d8yDnOmtt(ZCr8hGJ&0uG_MtyU@+1)^*3%gj~ z`HxCIxUkE&$;8Ka+gIf8M7Q_48YBls3SkhDQjDR<=spB^{^ZS4)EEM41KLTxm%5%> z{NPUdx&~x^*RKSg3lblrXN;m;G{q>7`^%KE=S;fT1DQLla($gAY$e&GMn1JyG84+K zSsHR-Z@D(**s9LfVl=u%|GQ|S=`0gkP@MPBaVulmBf%9rgz(lv*XF$1(*>jDE7rYQ z(NfrnPE};>NmiZ8=qVJ7Js=HXazKv`XGm-Y9!lI21Z#;xsy6%WSgfQfUfIW3%iV#2 zd}YAY!qjIL3+vHqKVos~N;5>g6$JOXIF`(*T&Itp;H5%VlTG7`HnsKcIX-FAH>p~M zt(4srsCVOSQW7-T9#kSNTZ)cqTHR!57U{fH9=xqyFVdym#VzEc$BMiTA z@E&22Y#E3Xzh7R8#jQgSw6wn+^w>c3(rKvLzUAIEAlUxj=JEaiKmT8T{+`FbbUAfO zB%tXbv0Ou)24Uux23i_wjS3)QIJ4HEb3-b5l>=##62I}-nY(+6G^HbGzeC>@d&mjt z1w`v8biPYiTk|EAjJy`3H%=P?5R2I`cq5o796^C~?xhtL!{Znl3Y%`+T;4;O{0d>y z%G`kou}ki;rN-$H2s0GJ0yN5qVLQee&P&i4JMUWnn8$YbdwU(q8%W^DObSQ?!q>>+ z>U4bK`OV>C_7_d(qsG=go~Q$%m=B)+ec_5jcfv5X90^^@XMKxYOe2Hh^0Q+VKnlzs zXyRO01Mk^9-c+Y3x`t1aH9;Csap1UW!nj2b@9w?j+(+^locIg#tBddATbk#Ip%?Ra zOFx&c2wKR*@+Oqs?K+cA+yZKGHCKcgpaayYv2*6}8aUg_z!9u5gORf`Z`xZ1U|~4{ z*8arc8`Uky;oOsip9J}Y<~5Vh^VuCz7Y+ppM3UBQL!GqTw;JSutbA0X6&PWTaNQ<< zm{9H}S2gKYoDTtcU9Cq!PdW>Guo1t}x^yM5-PnwMIg_+olba~hec+pR3*}R3%{m>b zroYX4yvKa*SCHHhA~neAwK{m~k-Aa>TBsLP4W>`1O=W?7QjZQY85f8qN==!Gcro`OxFsDB5N6dtHu{e|{;A7R z`6GTSDB^m3ZU$?`wrZnCKoP%S%95Ex|30~M{v;Gw=l&rwBy9Ee*peod=)iZNhvgj4 z&L1ANn6!`F+YPL+%xfHNQf|`h6QHmzVQ%|zoH6AVJt>4$@!Piy;~KK6t$8uv>u0$- z9So?omlgJpQi5wqC!#``4djh1Nlk++!81(kk%(EK2exB(e8KvZPdr0{l)`Plg|4VW z9R?<~fE5ia<}^j(%&~@ZojteW^H_U%Xxs^U3U48l!QWgoUmxW>L8k~msS{mvS{Zy{ zFQ+{08KuY*=45@!18!cRMc-fGtxPv1iq1#cG?$PLqWK|LiR_zBMempVCDuo+v$ZHj zk1X?ySenna15~8A-KEo1%upoML*q#keU&foeuy`8xrl{W7+pm+qP{nfgws>y1dy#c z?_#{1;q%mBgZq8rxD_@RefGmI2Hb! zzL@>aXFQ|cM$N_p|4@vuN;sXTSyDp;r8Q2i2oY#l@SVVl@jL&eD~juyu~@6J1p{5_9< z>2i=&i0|ONdhh5FY5v1O+m+s>9%BoZ9pieobbwKCA8RA*MAmWzlg}vBvsqdcGdJfvm_Jc7?X8?-c6jaMQZjFag1t6t zaXLbd{g7ED4AAX{m#b7^Ag~f+3}{1q^n~}MExy26L>Kmv_35AOawTpm9ow8xj|(ES zXwHEqBCEwt^Kz)$uJxzals#TnqYTerFZ&0A{I5xO)c2ByASP$urLi0>fzU~ms54Gh z6cRn|T<%wP*P$;~lG~f0>l0IBDGB;6O^y|icg z7~aiS6A~rxM^Y&+B^d?Laywkk2m+2eFxyo2=HV~Pd_-TS9Ah7V`O0=i2S}eOu#bDA z@za#P%gPmcg_PV@K$1-{dr}%)gdurKSwPJr3C*sU`4ao*JXpWZNaoa^PE;9L^_|XH zH+(dtg%Re3U(i$V&_p4kxa#CIqtKcR$8QQ&>Ny!N^5P2OLp$cEzqBm8N(ci?QW>!# zZn&8>Up}q2$pNp)@QLtllvN`j55YO_a}e+y(#CZRvY8fCC;kS-npJ0gWr*st{$>5) zdLBr^ybl}!F{wF~qf^@)=DRxRhBRsA#b|_e%7}N3k{&E`Q)d=|YwC=I!*_E!sdQ<@ z>~FhS^f`$Ms_V6_2jY**&uczheR5agCplin%I5pZmKa4{+3*7ggX##^5z?*xSO>|e;Iwatq)>B_6+*cGN?BcJgv_wH zWw7ZVVGwn#U8B7>@@gc}1>hTAO{ORmmvY?8miu*%_8_ZyaqBVy{#3tIb z_SCnkCvo^J>ezGRp{}*2CX3e+)D_&{9!i2Bp3K^%4>^H>$_A3|=WNoE1nFaQnOPb?19^joZ(>xBwdnR&Ui zOqpETCqkacjUn;LBwtWUyT>(LWdxS6Dj$ zuKjjz`dQVuAY=}3QowFJ>-hKS@h^OE#0?23@S;#0#7V|0M76dX22zS{lJZ0Pm-nEl zOZvU6=+Mmrf{4|^pc^v$Ht4pK93EXJaXkNdY+P?af6<%XBH09@XmLIzj5yklPFue; zc9`}~1o+AR3F@0aNAVt~f~;>B| ztD~;9S3rNHEmX)1SB9+Q{BfcPHI4oP48uL0x+SekK6zlGw}qzfubMe5>YJ!V(uqezlO@0VrslbA zG0_+8uJl#4a?;e*>}NI=D{=!YjsB~j1FPt0bu70MnZRb}{y z9S8KV!R>1g-hlJRCohBFIqn{iAsxTxG|CC}`#y*V&-9)kqNOV`2BKRM==B-|-A)*^ z?{J>RBo-9|7~P#$RNhuj7H-!D=1kK{>YpYf9ks1iu>Uw4wvIP}TpE_snqTAq{dvS6 zzVxhQ45mXIj9>8BqeU8AWjfXaB;M|z>%)a=w8G)>wlmzkhLSpU?=TGf9B>k`cj^5Q zR6JRUR&~n9^CC7|!kU7I5K%OLYnG}azpo^NJtYA$!#7a^qC1%+L=OJlS>@(XbpR3+ zd&xIVWc9=uz*Te$Ot!2^8Vh54hP~i|CBz?`y!f*{BHw#0yDZgBI+;_?i-CdM#b2;& zo1kpa+}Wb-8rpU8d4ztRO7LMYf9Y*6xwj3+VOe&T+2uV+&ZSG`}Oq4z4Xxe7oucbE2~&u-58L4)}$QH#fqE;M?N zLz-O40%3a_@k|^W`V!6JyyGc#dH(^)qx~95gzVrnim={jRH=4~o(T`tj0C#e2 zR`$*QB)xGs+sAh3*=E^2d6(=uT-790(wo|X z&9L)3*^_KDUKm#zKC*-6AuI`dC9`;X<&~@GK4ktS__0_x6=KX%du@^-%Nwb2w)a^w zkiC0u`m0C=ky@)n_NV2>{kTn~XUB=|@J!vjNK8{iSDXQnO#1A;-Wt(YE{@20p6(^A#=T$=YGJxI8xjGW8aLFCPt&OMndlH!_NMpc4_>+Z}81 zScxXP<<&D0&GSXRJ&^Tb#-DCM0HHFUS3Bp>W(vl0IDa9TfCvuB6*F55}aIlc;LiqO3yUC_& z@$7GKUuveqDsiFk7_;Ol+@F4eEIzw6np~E2_z%ap<{1wBHp4Qef{fC=yQr) zjOAo@75ipmW2{kqo;TpUgsmAY?DP4d%Otokg2d!Kw>g4AoGn`hU;kU-%%yFygnMn@>#S0oMumyrhZpV}n+U zolYUh4RW$SvZ}~*a9YpPtMFHb46YPai zMaz;2#mDfj4&%mf88?^(cbSt@#8`&KLod$!Olk2cT8LrVifVXKGR`4^njhDW zC2em?j$Jc#rnI^DW*cA#VZ(cx+GJH^rX&4^GvyaKAE+E{Q#cR#LzR2!?2QBUOuVjB z&z~j3mfvao=G`TP zH1>&*eHoH-Gq)GE|58bcA}b$PW`VdLB6eoc(Amc_>T%B5b)Wcnlz!`9Xw2QSVqvRd zv`Pime7E4`A9DnnsE(*>J{~&2`ABh^mg`-X+u{kNMp0Y5h~gDr|bX{VW0em z+^?Cm_At)5O)y5IE8L*dDrGSh;3wi>6lBm+vURQ;U{&HmFtUNoQqv ztmrPU=~OAiWaRH}8#s+A1qVM#+jz243=1Os#IcLkXH#5=sA?ekvC7{nI3GKdsFnc% z7}U!XjDyG{Y*CEttjRPbzcADTV9Y76QlG9Z4c(sa=~&OO80J3Dqgh;6tzA`OKo(v` zmGOOYo<`5C)esVSZRcVcxppW*5QCVk!@i|40b}POo;(fyK$w3Phx@BMj<|)u6f1|} zF8t(YxKpaff3@u;u#qi7G-w8FtOw~wG1;TNy*BbNFk?r6d)jn^sx;w0;fqjecP{>7E$gC+W%*I{IB?+s1o8AHx2u^mV%;m78I0; zRUIL-zucYy@)amNAw!Mwb@tI|G&s!1HNQzAqXDxujbFSJFzapYmjwX-DQKj(K1 z#KxQk2omCWeC+eZ`o-47E*Dky85{$9Kl2BZuPHAvPdST@gTl$cmm5zhE>oD)OluR> z@aSKsYn`5Hos>1@W(eSKs+JYoafxqd)XRJ}GT2Ty@dr|OrpTUNhYhu_UZ)O_lQ#pA zNaN@EZ9gW=liDuY^=TLcq;5p{b(f(%;7^kMln|EU$njl{LI0fLBrgV zep#O4f6dI@IeZ-v5U1JNEt&>$2SQnfAXswy5cc_*K68_#}7n!4+t zbN}H+E8!Um6q-L@x#$tC2Q=R}qcfaav2p^{O=7Khfe9m+$Or$jxAfMeFWr#9uhlG_ zgmj~@vTAC>tkYmCrtB4*^5N;Bh;?hUnYHJBM}?959^DXg;9TkD!%1Hj%M=3&g8#@=Nd^)cH>+p;nR+m(j#TYH)?6*4 zV|#_3n!-x}vidvT5`2_ld_xOGb)}`})QEF3opLWE=->1B7e4s8g9OwM-HCpeiK&ty z7)*RwtztooSY{W#On^6%OwdP^-F73F<8CcVtM%K`Tz14HZCIJkW5@v6#}UfTAGR3` zcxA`tO3M!6aoL)7c?(!j4C|F?9zkkhj6Q$00ra}Xl3un=`hDNs-hDelmST+R68f-ZGGB4BLo zVR_ZmE$Zj*pq1UQ_8QMqH0AYrry_l9S1{wf`M32G=+}^j zP5hdsSqqG%5&1851$V4wyRj4F=j%{)Dn{cI_CW*XybAWfnh=@CffF1H`BX$dx`Rwx z3~;im@K+Z=4XzoN&XGKqhNW!7^0MbL`r0*vkd}kDgQCaspddRAXQy0fTvxm$a+ z2-8r3DsarW%El6nM6}_Dc(=TevS9vxJdQ4~Fy? z`18>W^UZ2of%w?bwYCZP(&{G|lQXf;8QhQc&&diS=k@KLMT=DZk$RUnEpLFL$ zJjod^$s9gFZ>QvTP24PxJhqVRyq(+64?C8BRGZm==V0}Mt{b_WM*k+wp%(*9{b^et z+}D{NL#6;;$tp*Uv(+|+0wnCB@~mh_rI<(+X=YjkcqPeugH zj+vK|HFJ@r>p0})kWMR*TVX@Jl9BBqsp(wko0mgRr95AR^%vF~(!}sjVyb?JY$F%r zgtMD0n*lfeW-|RuB`ZmMRr8^buZmSVjV6g@1;6sXckc`1*y#8D#UFVihc_i@%{6hv zQ|%YPuB>?xMdxUU-hz}ZKa9n229itVW4$5GT6jSHg7|HK5-Qiu61gK#H<&zJi6~$R zU{_imqTDR#Xde=o6$5=ywD&x}>EIxEkDXCwij4!uJuifMp#MHST%Y0pT8sS`AN15h z{I*+N=6V^jS;m$q(aTxu!oV|TG&|Ap9!d20^?RxS+XH)9NiZ#x4O@zZ8 z@+5Yp4>xfQ660{18BY=DcvOlq4N*VpIDj7{Cn7@bILzp+iw=yKX=o0X`PZ~l#;zm+e6Z@Yxd0XdiG^+ghyF=XNos15;K z3O)KZ>}|2xU~wL89nj|%zGy8>4@4x<19x|B`;_IOnZ4@_B`c)@O1a}`Tf=7!rwe1R z19RL;pg26g4;Js~E3^`n!7Bq4S^P`xKp{*??ncV|`&81E=~2G>4TPnmuTlG%IGE+o zMCGUf!;(nz+65%*tGl3X;QXLw=4q_LL@eQI&tr!g>QTouo)FgT{S6%DKVUSf(~O?& z8=_07hrZDfKG!X&3-s@+WQ`Lvx{1Iqh@0lOs_zcsZDKu>s~1Bv`fQYsx`HG|ArHd< z$W<=i+HizUR%afxImkb&LJH&05B`vHyz~{}D#R%q_rDM=WHN$;;pPU%l%Ehsmpi4)whT=k1Cn)V_^Q~E+iy!r2^ z<@LPP5Knol7GI`B;x!$y^??h&@07(~-C0E?u^Wqq+T&I;8!<`d)5jhc7#e7c{1aFd zHa&={&W7M!`f6?qU-v?DK?lIWCbe{qp0ynHXM`SD2dxbNLpB0|wdw+|;Lv0CKTr%m!3P8_PR^=}{$+5Pa zQ@=sUiBHr12KypJSn%j~1IgiFn*qV}WbZJU03*@EJ)pI*fR%PkpE8xRg#x^z~U z%ag(5eUqF458}bvWjN#qbxT~#9a)1wNY{)>zGD+@e0OU%XJh*xqRh`iE*fh>0RpS`@^c9cWooTiX+h`reI_ zZC<&25vga#Y~{B)oBON-a#k~g%53LLoMrZ%;*YQGFjdrH3INovQ?LS^3G$MTK^zEP z*YhfO$CsKkyN-nxg8Vi=z5A;RX*a#@7-ZldhP62W2Zh`lUr~#eD?Dr(dMz8beid8! z^dE)Um64t+EIvzfxrXroM%-=_QqCEWErk-3ce!QOaITT@0D+6fcXbWJlW0W{GRc~K z=upzrak=UNEK8;zvUF#(_}2Iqy2_<1uL#i2l^zOOOrx(*ZXeKaiPcV0(G*ZXZ!494 z!9|*$xX(1osE>UMxhBiP+8IzCEZ}~L19-m7mq|6fwinP7wM>d(&kALBVqD_e3>V9dk4fEp&Yh}W6KmF_WbYzo{wX@lPhFCxSpkgj;N~aaS{A_&M z?_8VeDVK>c5}%l^@@6&cYx%$;ghIMF@^Q$+GZi1VcrZ-3FXjW-Z#bF}VHO!l%La^A zr)mHqM|Ua`U)m;s?_Zv_LGiSVJ;w__e*F^f>~^CdJJwGW6RbcM_|!%g^tA~~B2hYU zIp{$K6%aYGqx9@!mhFpoo+T`^vj&)cTGu&Z_&V{z%-nnA9pmFvbKbta0-rp8ADDAt~c`(Bwm;&BRsy2WSrZT+e z@&Tt$ziwdvGsd-lP ztFI&^=OcFmqWBD7G&m_;w<0v4?i1kK7R&o$KeA#s(xIS~A>K{=5Z&Ek{)C}PX0{&b zqSqw=Du~PZ1^E)9! zlF>|V-mq4H_9l^dWU(WQklS-bEUP-zu#77}J zG>}082TeHqE=_dEzb_>jp`wSzQh+XFy=`yf=yt#YhDBkd7^4-MtFBx~-$#N1ItE96 z6b2`)D>SfJGu&*OmU~S2(hL<72@2TCMWd@ZI{J$uti!QvOXq@b?F&rMQNZU(@Rwai z_lcwtFoWJTVj4l+LCH||hprinG~s%v0iP&=hG`1sv(ww$@3oxw?7x73ngz1Hbw6ra=za^j3{`^BV?Cw;*1p z&c2EWqdoOaQDq}|yRdDmZ%rVV-GKtzo>1i&23(}>YK!Hy7uzP_a;cPFd?-jZ0m>uX zy;_44`Cj6$2?@wQJ=rO(HH-&xR?%PS z6;98L2`0r(M(mS6$g|N6d4=#QbnfnAvB{)UaF@GeRmJFs`)1fyMF!;;xvpMA62W8{=n5661=}br5*_Wc{un|?(b~?$ zIf3h(-g4BsXaa6)6fS$CW`9nszH4G|r*2g~gx-b3z56v-YV_SWOIXFxjqXtG=Jjr%{Ujn(M<4^*0Sz8WU{!EK5;RRK!MIrK6*xFAynTK5tyTv7@Tu zXb%d%U`7;iuWY(b6C{(XOX`Bx0v%a%(>g4PL>=T@lh&J+cDfhoa?^5i!QNbieMK)maEVgXHn*mS3C4hS^3=Er1v^;9E!syrNncrWp z#i!W3#@0Ix-EexZY!wzEz+g?&SsNgtsOW3NXm18q-y5t-hufK8K!cF?I2@>Or0u$fnJ%h)vH(*3@ZUppk*PIldyXw^(dW*gA6 zCUX?w;%xwN6YLn)OZZT*0W(rbmoS`G1K^PHe$RU$)D2N}YLF*Am%R(*AgFZdWbeMy zi9$E_>?le>#<`gX6dJLIB^sWpmM}9qN?^n%r}SaXk{=W0ZX0U6m)!*FwV^~^feiH6 z{;KaK5iwphdm%v}=8m%A+XT6?x@o8bUBlp3o&4mE3s7OYUyrlMjE8~!Zb=@Ymx3^$Kg6KsHi1NRSEJz5Qy~QGEWt$dc+&78`&Q|g6~Lo83IIJ zB0&psIOFHGt6c2QIkNjzd@hP6FOK$Fkl25M!Qand^Joq)3dKeK5o? z3hP%l>GBx^KK{cdQRnnIqC^Ba5V;L3{QZrZEzv^Z0`(yYgRrLv8(Gh@^XQq}yik^$ zbadFRo1emerY_tTbSohA!bE% z%*+6&mwj3%aK@Ry4@Gn}FNzfpw#FjHk~O!f0+eVchsDjGkNO_rK<^k5anxg(N&F(E z)E(`L)vg!M9xA8;&&a=?z{4UWGBCAF11TQ*E=Ez9JvcCx_CBzuO;wf#`OMde6?^Q^ zcUj3=$J}o*xvJdTcw`v+Rs7LSCmnk=BVh5v$IUXwUB@>ECkUH=e6B7p&Tq9E^d4&u z2^2)M2%Dh$w?b%MRq+)g8o9GXWKX7oP@DlKb`BRxnPqoUN(A}=(cSN2&#OT3GlTqy^7`XDv(SUM8~aL zA9zggPMhPl8I0a(!0+w@O>*UXGCN%%3enZtt7+0Nk(#`Ar(=#u`MecQf6wDzHl=$M z;Em#(^s&+h8C!1_%hrKpqe}>Po7JY}1k)Ci_5s$k z6iU=cpNbG9=a(R^R1~G(EBx)46bqdBbT*U^28yB!8=pU?Rg^RTNT(x-A>BKmb_}vX zX=pE>;|Hq^9gLr1jLQBzYt!b>CrzH{V#oN-kzqTu2LFoJT#_#{&(uX%ckL6t0{+s9?A{t){f}-9B*N%t1%PS1Z zdIo2#abtL5^7*%G(DkPcp+N>}u6dUs4+IH8b@MY}p(ISFS9@Q%3t;Fh8PQ6IDRl?2 zTD&U&k;ow=cE23L0lZb|REBoizy9DNSZ#?2k1*Oz_9C30`MA=b@u{f?m__UFc_RjreWTjlQPKd<8L%cA(LnGqWRm{jgk0Ml}?08Af`GZTeZjc2chEm8qlD75*xdxJ7Im~JjhOYr{7FAqgY zLb{wK3f4L3;m;jESTclJ=9J<72>Y^^R{$X}qj*AM-k?1v60f~la@WVkp{vO;s=1ev zOx0Wyy%Zcp)whIPw48P0)P~Z>1Iu)V(9Yt_Ra+_fNouzHCW2nTrqp8wP`huD=}&0? z(90Mle|}29sdw4%#ZI`o)iB(vm);9($NWg#{}Emr_2H z?Q$F7>?Cbbe8Z-8Q!W{J*zm@;7b^~Tw)@WnK-hG=xgb;@1MIXF} zaA}tTu;Hh{A#EHOR-fc-o4ck~$g;lWv&W8a-c@cf(5V(4q{Q2~EKv2w81Wq-ZK5PT zcJQM8Bw++7$vGZn@ZR)RB`Ac1Fn)b{V`G&#hAhbrkYKrTxHVUG%SE8v z?$5*j$>V>uDf5w#fSUPnsvUHm5>nAHN?W$I(dVIKnQwkH`JO+EEa={CdJVDmxDvDB zDrYd2hdP#zmDxD(-gujR0SS$NB*IeCHM7#A7;J{;6wBvzf?E(frHnx$WT$VsbsLNV zoyEt`zkdlaPc32JDdef3`n7;-$a^MCEX+NkZpWzzvM{S&rCDJ^2Inut>4=mlhH5qj zDQ_R5C;OdpmWU^HGnjLj-N7Khs7Ss_r|o>|)D9W+KG?Zy(e$-=Nq9;zL*o)TfJTFP z)B5YdDhu!F4cPG&j7|UqND0+P+du;qZZ*?#( zJss2gyzk%h_%&?%*Yx01mw3XSt7Tgg{n`J+=78>5-E+#9l4Nd-T0VSnlFoy zgUN0aBad@=sVo~@4SQB<-dd(oE%zNm6nqc$($|e2V1Pd7zJs*Evsz&!F-=W=B%TbX zJ`F+^8e>EXJINjdU_V8+(cE0Qu0uZ09X~q{MVHtesGjbb-=yL3GRzT5=B1wx&-W#f z3e@1AJBldz+pku0z?TvYh$Mh|Jv`+llpRV0Q6&EYVC2n z_Vthw)_{f_BP%AzLO`OYLkLq>*`Wie_B(7{UARhs1V!~zB3WwtPLLf_fuQxRM2O!I zWHWxKm)#b|DDWz5oh7sRe$^t@NcOw<4+*4CJ1AnDG(%ZirU|K0H!}Ma`vH*Ek%EV5 z*DVt<29K*+mUAKw1{dV-{YwK(kTH$#L>|~LKi`hvt{l;DVzk;YuwDL$7*`pR?ur*p zIUXH*>HF`FTnK9TFl=!iMdc!In7l(l2OvCsJj(YBq7_ccg~WESd9<3hEc~iH0Y6(+ z0WDG7*wUydM@03|vH#hc{-w)7fP=^?!~D5%s6E<*4t1g3;pHDMp(5s~P2vfM5f60Y^c|Hnsg_x!?3x>g3M%mX<4{ zvT*Tk6#4_Fi_rj~nHr{{Cf!RsfA#0|6d*5wXv}D*@$jk)kc}!M`y!--uXmXnhD(2q zoK|#|eGZ*@{*wAo4k0_$S%D3wo;jV^9mb z1Z~pl(-tn-?426LnhLflpZ;k$TFPq5r}tSf^DlD^oiSvKYapU6YT z^$Ow1*`yK&hZoaPc)L&%H25v>8>;p6s&31jwm)$b-oV=IUC1W(6%ImPbGChy7JP7h z@0#PQIF{0e30dur&CC3J{2#cU>ym2Ke!kcXuPZ_O`);xpdbjyYNKy}{fCumiXkx}I zcnuqLz$~Z9)5apMEhKw68xsUdl|R7{=C={9UsD5tE2c^_X418Tt6_ZWjY|i{8hE@5 z>3Vw!2A~!#rDwUVKPq-iWT2SwO+Tw~F582T{bzdouQuf*KN3)$I986b*p=HA+*vn( z-DW0?!rXb>PhIY3kp-^c0V9H~rxd}K)(QHul_6>dqG#o{IYUd;QR<|}V%(?MWM5E= z3zBG{pzFBAz1>TjhjaBV;(}I5e@wOFB(RzSxA3JGRyJM$s!NmW4$xp)wyEf|+tc`v z7F!r_){wNBliBIl2lGe%iwNt+eJq)ugGEEro@8cT-6cRUMPhjD+8ZtVr{iFuR3)>p z*%;h34|-bAMpUo^{{Wrk&@HMA5)8djqdQyt;I;hsf$%I-L39W4YlxDBesO^FMrZ?Z$Q;F{Aibwm)6%BMX=QgF9C=yTG*L#pKfTOEWC6C1P^OZ z+7-@T=2V7rQ{yus)uv4Yd;U5R>5`Iy+S_{qxAI%S%4ToI`%N#R7I`APd94bK%vLOM zpsgRr64I@@iL13us?9Qf8Xxe!nh1zU1Dk3&qWA4R34&RYdKcgoDa{6c}xI_jm*QpF(m3@1J`g+O+w@MS850>YmeI8r zQy@|j&NtZ_w}0HnRA=aKu(a2Lb}FCPbtKghMH69;qhe`vKN87SYgp5l(UeI++yP2^ z{hS8=%@tq0%rVJFNIr_pkBpk7{`d7I;qrtL1#sxlrA1^DYC>0M*w4#p^64Bk`LE6D z6}$=LsatnV*yCAPUVJjEG>?xMmohN#P0-;~%0z9U>4hID9-VIRL8V&=1&308iXr11 z_7M`xGgS0}n{l)#55hW^Um5h^6)_H&dfew=K&&)>4VVAhru>H%gxZYw0bNhaKfX|3 z!{L5jg);Mj>>ik39d|bw%i1P}aizxKetd6hvPm+xyE#kzmh>maFdQm&hgXfB&wDL-j!&wHUSWB8`erpmFV~7 zsnlGkMRepK25XFgIk*+2rK4^A=EAAP9*w{b)j;=$o)^H>F*JmN>4zPe?lLXdlkov& zpb1J59eaDK3vJFf0&oGrlXz0NvJi8l60LAv^)ENhbQ*gyYS2kxdBW#W8{u%Eby^!C z>GSyf2c=A}_8-~G(8N5T9 zh~sRxj{c~Z%tBAj3Ua#ro`pAe6HHZ2k)n4z_S?CbsH4bo0^*(5Nv~B$kSPYk%bNdJ zU3dM}grom)d?Td>5|b%N%BT_2-3$aqN;A3yKY|~S5~N!Yq>+>uEj?<0jBW&!Q3{Gm zPJuD{p3m3sJ?H*#@Bi?A{PI5Mb)MgpqWLq=720?y#^rW<#!Q#5D6irr%l!z)L5gmV z9hJe>vn@%6N&YP+`PkpUnN~>US7o=Ax>#E zyRo<|;21l6>Ymk^QQZ9fd*tWwxw}>~N-VLkwryecFd!Yaq(!kjHtok0w`O$*yXu_h zl+NV3%fP9!sdyZttRF-IyeiCb50q2zt0K0F%R3}AZDCD{P&DH&q5I{xRigGZme*_) zW%`*;7a17$Rm93}TNdI^qqp=qd6OF9z~Mk#vN0F9y0K7347j&uXRf3%(qxM13rhOg zku0<>C1*Ny*;+a@!qgZ|3=fyj<vA{OlPIHd9T|7SPB0EMfdPhrMJbU+`mwbc5$W)iES^&$4C!szvS9S(xV?Wg znlj>VWHdYu+_p69z;mOohlIMeh3_#TzuJ`9)#+C z-qOg2bsyeH#&03xlkw?3dG0Qi4EmkX--Q9YnMb)R6tUX^q z?``9lZK`o3*Oh+vmiUXG8J+f0u@#k{D`aJh-Py=e%2ai-pmHI=E*5ye-xF(%R^|IH zCclNbEbPhI`TG94ZrHP^PDAs)Y!_-(n=#mbof8;EMibf^euRodrkH8F!)_tCXT;B1 zi~XyoO^czRbG$HkL&?p0?hEaOn05aKk&*R&KYa+2)_8K7hd)~bZFE}tbrV;5%YFv; z!wE)iYi~yKSnaeG7u5~hQ2H8z_>iYHvd+)ut#NsqzqznlXM9PnzP&AWb~vqRmh@yJ zHc6cBa6mYmH!O`ZAyqV4Fwuaj(|dC2P}T#waPATD-l7lJsH&{znq#x_q81)W{Y5EW6Vlv}$ec)ts#u z=;+|{R5Ww=zH|7jX(B~Oe{^u9jaxXqOR<##e-^T@B#-UUli$IqtY5U;G6oZqy~u-} zAO_?=4J6A~4r@Fb_N8ekh<$B?kc!@r7PPC=6#5An_@0X>pg!#{b&TgE$v(W6BTom5 zWhL82}pciz%-n2A?F)uzDy^84Nmp_0U06BmBbyqP;o{#nH2Ph|9 zpv{)CwJkf+p#w-qro+Ak1Kt4i5&}j#^o$DA+B0$Wxp%W0%Of0kdMPAdrCc6MUsqq} zcP}wrcH^&g=cSM2o?8-QS1LC8LKHDC9RfYT9^;SRf1AcX*QY+lC7Gz}G7aQ=lX9kk z5$E5Y9*vO<_}UIn7$nY-ON+;XS~xCsOR6G%qLSb-z}dh&lVH!zYrB;-_#6Qls302PD4zGX*N ztg&yO9VZ#&&n{JmeM{t@UqJz~n(&GVtuC%}0}$&Le?ILU)TVxt5Hs(EK&yHG#;JR= zsc7aPegFW8|`^~C7V#TZVTn8;{#m*vR@el56IvT`Y* zg!q|{)LvwPDr#|Dv=wKC@9d#toX>}5nE%W#!JPFs?H>8i#3ck698h{fmn^-y99*?J zAx`>I?>!BeIYMKEGt!G*2ueHXksg~XJusK>7Wwck^OnN5>=C<1!5dG}SjQwQjphS%;uM_8Orvy9wt zaVC4Y$yz^U52u^##h^xB+p`&>=#%_6f$uq7>HJGxW_XeZ$&5=P(Dw&SNS~RSYqa_9 zd_Nppnzqnouy}KV`Of@69p9I$t2GEH$AuxD?_}j*8d=|_m(kvyI{K`f32JL3 z&;9BBnOoyc(H?nqkInV7+2-ELDF%Fr?ihje3<1eDqwI!clu})+&UDs3|p*q2D1vT6T z5BGS3Fgb$Ywaz3|n?V^uOxJF2x#|ZWcG%U0DAS?F0wz6`5|jc79SW22ld;(rs#Prh zKW$Io4Ztw%1qDk+nq%$?=ruzq&g)1UYErr`GvG8NRCg?64M@0Tm9EPc;Q25Syw!Uu zk}!+SzSHvykHNcZ5zsYPF8s6~T2lZi=# zkIDidN|{3lc!BA&k<>3mj)v6{bp`A(@G7aSc71_5du1(368TycCHfmWdkhhbq zfr-n4r>_{3nB=TMDBB^WcjfsQKnKcUM<&wCqIAa(VhYJ-USy%Ni<@<`3iJ-R*3`iH zKc3iI1Xn$>G}1wdP2P5KTc*7pj3)TBdmyBUia@a#s0t)VNegqt{BBE9~a9dQ)W>Y|7 zQG!CE=4f62h;JNkJ~+)FvXt%meA=$Wf*%n6f5Fr6ydxF`2_hm`XyVV$a~gty%Uzi; z%#i5atz_!tr+-;#44-2+`MSfIG!yl*wnP2=J*OR&l~7scd#Zj@bTv!5%C=tZwij89 zC5C23{>LB9!Rip$S7Xt7R_D}Nmk6I)wU9z5z&*BL&%(27>5sQ2Mqxqmrz;CL#h%9B zrKqPD$~XBZKd$Ql8l4C&6*eSlkC!KK9tC#wV~Y4#rp16B zD`V5xMdWLQ?I4V3<50RRECDNbo?Z*w3` zVRmwFXK7(>Zf|gJb!=~QAUtkuVRk@rWn^e!bS`6WZ9a(sz628i0strl0#dItr2-oR z1ql+&0{{jK2?z%R0tOWb0tpHW1Qr4V0RkQY0vCV)3JDN)HxhJzG(V>oRSW(n2{3kZ zoZd|#a;IJBd{qPyFA+Ba@gP`J&U2`?;t~$>>0qYj732iKq1#gh^)yTlw^k0Qxr%Y>()!ivFiYV_cZu5+{(|CE zhWn>1t{AQE&%$RmwRun8o-2TGFg?v4Ou641f0-o)lm{T3cpm1(ebae<|+Jh`vg7V3ZIi@)(LX!$} zKw(2O(+S6`Pj2j%WN1c-0iXmB0RjL91p-p9G#LO22@omnSh<#lQE?q`3?Q?@_+%GY zj6`h8XwbUH@knP)CdW0S`qhQ6ZKJK*W4gw zWK*LN6CCcEgo16OXIbx~iNf^}fKfWaq=^~g%prFbk?J{T*10={s>g)Pj$pPlT!GXO{(EUrc&?l8Qc~FyrW{OAT zHLgNwG~dAC6UlzCpd)qoPW)=iegXnoP+Hd8;Q69Mg)k6va5~jNi*N8L?bNVJ6qZGQ zrIbNM$U2iZTQxx~pOO&S_pG@AjRaD!Go=9x0N!Ud3in$zcL{ljKS_|@38R=47VhPu z)`KEO*K=LYI>)7+AhIi-{9!Ez4x5zv!R;;q+(xk?H0>cIBOA4%g_zDj@LOgWa3=0c ztqn7%ax+8qXheHhU4hTxLI*Equ=HIkWVn7p2U3k6K?mrA-f|Q;XeaI>M?_?D_Mp|C z6@GNKa;umx0Gs*&-UfS;-TE96pfmDmy^ko9nH5ks5A`SgNS8hwrL32ZADd5=-Pq)j zJ|G+%)5IXP;io9UP}v7$4IA6+I*mQaN~BZJ%LY{w3}Dp(ZKnO38K#K2FEf&Z&X$(+ zV0(;@zO212<74h?lkzUh)MNWqWh^-vOe{5LF?(BO0k7D)IQeR|^Ln8m94b@3(ZOe- z6mee#2nUjmj(q@$z58@M;_F}sd9|PX3<56|Kk<9Gi~`RJZcZammb5`X(Wi=Kb_2|3 z)8f?x8h{vBNA1wa#Zx_PzC$$!@;@b_rmBd=ZY{o=ms!?4hc1AMq=sdb&51!vF#r(( z00D^sr34rO0ss#M0#dItr2-oa1ql+&0{{RD2@rNS5_EqwKc`-}3;sWzHSMmh;A>s5 z&^KEth;3%C6<5d!21H;V>Mn1#Z{(-UQ1`j!G>OKcrg9m!OBc+8Yv9hV!Jyu03xjHV zl-$%cUZrqo5J_!T6j#`>2!S?UJM~J/dev/null 2>&1 echo "cn=`hostname -f` CA" >/etc/pki/ocserv/ca.tmpl echo "expiration_days=-1" >>/etc/pki/ocserv/ca.tmpl diff --git a/ocserv.conf b/ocserv.conf index 30c38da..96082b7 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -255,7 +255,8 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients) # in your system. -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" +tls-priorities = "@SYSTEM" # More combinations in priority strings are available, check # http://gnutls.org/manual/html_node/Priority-Strings.html diff --git a/ocserv.init b/ocserv.init new file mode 100644 index 0000000..81be91b --- /dev/null +++ b/ocserv.init @@ -0,0 +1,141 @@ +#!/bin/sh +# +# ocserv This shell script takes care of starting and stopping +# ocserv on RedHat or other chkconfig-based system. +# +# chkconfig: - 24 76 +# +# processname: ocserv +# port. + +### BEGIN INIT INFO +# Provides: ocserv +# Required-Start: $network +# Required-Stop: $network +# Short-Description: start and stop ocserv +# Description: ocserv is a VPN server +### END INIT INFO + + +# To install: +# copy this file to /etc/rc.d/init.d/ocserv +# shell> chkconfig --add ocserv +# shell> mkdir /etc/ocserv +# make .conf or .sh files in /etc/ocserv (see below) + +# To uninstall: +# run: chkconfig --del ocserv + +ocserv="" +ocserv_locations="/usr/sbin/ocserv /usr/local/sbin/ocserv" +for location in $ocserv_locations +do + if [ -f "$location" ] + then + ocserv=$location + fi +done + +# PID directory +piddir="/var/run/ocserv" +pidf="$piddir/ocserv.pid" + +# Our working directory +work=/etc/ocserv + +# Source function library. +. /etc/rc.d/init.d/functions + +# Source networking configuration. +. /etc/sysconfig/network + +# Check that networking is up. +if [ ${NETWORKING} = "no" ] +then + echo "Networking is down" + exit 0 +fi + +# Check that binary exists +if ! [ -f $ocserv ] +then + echo "ocserv binary not found" + exit 0 +fi + +# See how we were called. +case "$1" in + start) + echo -n $"Starting ocserv: " + + /sbin/modprobe tun >/dev/null 2>&1 + + # From a security perspective, I think it makes + # sense to remove this, and have users who need + # it explictly enable in their --up scripts or + # firewall setups. + + #echo 1 > /proc/sys/net/ipv4/ip_forward + + # Run startup script, if defined + if [ -x /usr/sbin/ocserv-genkey ]; then + /usr/sbin/ocserv-genkey + fi + + if [ ! -d $piddir ]; then + mkdir $piddir + fi + + if [ -s $pidf ]; then + kill `cat $pidf` >/dev/null 2>&1 + sleep 2 + fi + rm -f $pidf + + cd $work + + # Start every .conf in $work and run .sh if exists + errors=0 + $ocserv --pid-file $pidf -c $work/ocserv.conf + errors=$? + if [ $errors != 0 ]; then + failure; echo + else + success; echo + fi + ;; + stop) + echo -n $"Shutting down ocserv: " + if [ -s $pidf ]; then + kill `cat $pidf` >/dev/null 2>&1 + fi + rm -f $pidf + + success; echo + rm -f $lock + ;; + restart) + $0 stop + sleep 2 + $0 start + ;; + reload) + /usr/bin/occtl reload + exit $? + ;; + reopen) + ;; + condrestart) + $0 stop + sleep 2 + $0 start + ;; + status) + /usr/bin/occtl show status + ;; + *) + echo "Usage: ocserv {start|stop|restart|condrestart|reload|reopen|status}" + exit 1 + ;; +esac +exit 0 diff --git a/ocserv.spec b/ocserv.spec index cf54f4c..413f65e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,16 @@ # This spec file has been automatically updated -Version: 0.11.7 -Release: 3%{?dist} +Version: 0.11.8 +Release: 1%{?dist} %global _hardened_build 1 +%if 0%{?fedora} || 0%{?rhel} >= 7 +%define use_systemd 1 +%define have_gpgv2 1 +%else +%define use_systemd 0 +%define have_gpgv2 0 +%endif + Name: ocserv Summary: OpenConnect SSL VPN server @@ -33,21 +41,31 @@ BuildRequires: gnutls-devel %endif BuildRequires: pam-devel BuildRequires: iproute -BuildRequires: systemd -BuildRequires: systemd-devel -BuildRequires: autogen-libopts-devel + BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel -%if 0%{?fedora} || 0%{?rhel} >= 7 +BuildRequires: gperf +BuildRequires: pcllib-devel +BuildRequires: libtalloc-devel +BuildRequires: libev-devel +BuildRequires: http-parser-devel +BuildRequires: tcp_wrappers-devel +BuildRequires: automake, autoconf +BuildRequires: radcli-devel +BuildRequires: lz4-devel +BuildRequires: readline-devel +BuildRequires: GeoIP-devel + +%if %{use_systemd} +BuildRequires: systemd +BuildRequires: systemd-devel +BuildRequires: autogen-libopts-devel +BuildRequires: autogen BuildRequires: liboath-devel BuildRequires: uid_wrapper BuildRequires: socket_wrapper -%endif -BuildRequires: readline-devel -BuildRequires: autogen -BuildRequires: gperf %if 0%{?rhel} && 0%{?rhel} >= 7 %ifarch x86_64 %{ix86} @@ -58,23 +76,19 @@ BuildRequires: libseccomp-devel BuildRequires: libseccomp-devel %endif %endif -BuildRequires: pcllib-devel -BuildRequires: libtalloc-devel -BuildRequires: libev-devel -BuildRequires: http-parser-devel -BuildRequires: tcp_wrappers-devel -BuildRequires: automake, autoconf -BuildRequires: radcli-devel -BuildRequires: lz4-devel +%endif #use systemd Requires: gnutls-utils Requires: iproute Requires: pam Requires(pre): shadow-utils +%if %{use_systemd} Requires(post): systemd Requires(preun): systemd Requires(postun): systemd +%endif + #gnulib is bundled. See https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) #CCAN is bundled. See https://fedorahosted.org/fpc/ticket/364 @@ -91,13 +105,14 @@ uses the standard IETF security protocols such as TLS 1.2, and Datagram TLS to provide the secure VPN service. %prep +%if %{have_gpgv2} gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} +%endif %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/protobuf-c/ rm -rf src/ccan/talloc -rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config @@ -106,10 +121,28 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* touch src/*.proto +%if 0%{?rhel} && 0%{?rhel} <= 6 +echo "int main() { return 77; }" > tests/valid-hostname.c +%else +rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h +%endif + %build +%if 0%{?rhel} && 0%{?rhel} <= 6 +export PKG_CONFIG_LIBDIR="%{_libdir}/gnutls30/pkgconfig:%{_libdir}/pkgconfig" +export LIBGNUTLS_CFLAGS="-I/usr/include/gnutls30" +export LIBGNUTLS_LIBS="-L%{_libdir}/gnutls30/ -lgnutls" +export CFLAGS="$CFLAGS -I/usr/include/libev -I/usr/include/gnutls30" +sed -i 's/AM_PROG_AR//g' configure.ac +autoreconf -fvi +%configure \ + --disable-systemd \ + --enable-local-libopts +%else %configure \ --enable-systemd +%endif make #%{?_smp_mflags} @@ -125,6 +158,7 @@ mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check make check %{?_smp_mflags} +%if %{use_systemd} %post %systemd_post ocserv.service @@ -133,6 +167,7 @@ make check %{?_smp_mflags} %postun %systemd_postun ocserv.service +%endif %install rm -rf %{buildroot} @@ -156,11 +191,12 @@ sed -i 's|isolate-workers = true|isolate-workers = false|' %{buildroot}/%{_sysco %endif %endif -%if 0%{?rhel} && 0%{?rhel} <= 6 -install -D -m 0755 %{SOURCE8} %{buildroot}/%{_initrddir}/%{name} -%else +%if %{use_systemd} mkdir -p %{buildroot}/%{_unitdir} install -p -m 644 %{SOURCE4} %{buildroot}/%{_unitdir} +%else +mkdir -p %{buildroot}/%{_initrddir} +install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %make_install @@ -189,13 +225,16 @@ rm -rf %{buildroot} %{_sbindir}/ocserv %{_sbindir}/ocserv-genkey %{_localstatedir}/lib/ocserv/profile.xml -%if 0%{?rhel} && 0%{?rhel} <= 6 -%{_initrddir}/%{name} -%else +%if %{use_systemd} %{_unitdir}/ocserv.service +%else +%{_initrddir}/%{name} %endif %changelog +* Wed May 03 2017 Nikos Mavrogiannopoulos - 0.11.8-1 +- Update to upstream 0.11.8 release + * Fri Feb 17 2017 Nikos Mavrogiannopoulos - 0.11.7-3 - Included liboath in the build diff --git a/sources b/sources index 03b31ca..348aa08 100644 --- a/sources +++ b/sources @@ -1,11 +1,11 @@ SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 -SHA512 (ocserv-genkey) = c02a25a5504e2bd514c6e6944651960a3cc9bf2ef0a4509744f99d61421feace1f8e440c4d336652efd7349465d1a707cd3a370ff6102ef5096d709b34099a86 +SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (ocserv-0.11.7.tar.xz.sig) = fd4af775842cff6817adaf4a641b180d3be3b55e3b64a026977fd6f328ddc5f7070f4c91cdce7e83eb8c3b078a5c1dc7780cfe40c5322abef61ca7fc408fbb2c -SHA512 (ocserv-0.11.7.tar.xz) = a563725bd8753186ece80c91a237a2940071047bb32d1990e2ee122a32ad0468b78a7f35d422dcc9b968a8c56358992842d00958dbf9d743632a03623dd2f5cf +SHA512 (ocserv-0.11.8.tar.xz.sig) = 5551591abc54dfc053125c356095138aaecec6c3255cd125bd38e17350a257bc822094c270d5b3bb329afd4a9e37f355d3d16db16b4db804e15b8c5959321214 +SHA512 (ocserv-0.11.8.tar.xz) = cea5ef084a15de1e16c0d55f418f454f32c77e4303246f3d11e71ddbc7dbea028282b8200b59a49f5509e786970749b0a9795262639209924bbaa1d619c5c25c From 79dbd08a4e390aacf82775d4fbe416b5792c8ebc Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 21 Nov 2017 11:19:56 +0100 Subject: [PATCH 60/87] Update to 0.11.9-1 - Update to upstream 0.11.9 release --- .gitignore | 11 +++++++++++ ocserv.spec | 36 +++++++++++++++++++++++++++++++----- sources | 4 ++-- 3 files changed, 44 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index a635fc3..7f57cd4 100644 --- a/.gitignore +++ b/.gitignore @@ -72,3 +72,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.8.tar.xz.sig /ocserv-0.11.8.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.9.tar.xz.sig +/ocserv-0.11.9.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 413f65e..0ca1677 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.11.8 +Version: 0.11.9 Release: 1%{?dist} %global _hardened_build 1 @@ -11,6 +11,12 @@ Release: 1%{?dist} %define have_gpgv2 0 %endif +%if 0%{?fedora} >= 28 || 0%{?rhel} > 7 +%define use_libwrap 0 +%else +%define use_libwrap 1 +%endif + Name: ocserv Summary: OpenConnect SSL VPN server @@ -42,7 +48,15 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute +%if 0%{?rhel} && 0%{?rhel} == 7 +%ifnarch ppc64 BuildRequires: protobuf-c-devel +%endif +%else + +BuildRequires: protobuf-c-devel +%endif + BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel @@ -136,12 +150,21 @@ export LIBGNUTLS_LIBS="-L%{_libdir}/gnutls30/ -lgnutls" export CFLAGS="$CFLAGS -I/usr/include/libev -I/usr/include/gnutls30" sed -i 's/AM_PROG_AR//g' configure.ac autoreconf -fvi +%endif + %configure \ - --disable-systemd \ - --enable-local-libopts +%if %{use_systemd} + --enable-systemd \ %else -%configure \ - --enable-systemd + --disable-systemd \ +%endif +%if 0%{?rhel} && 0%{?rhel} <= 6 + --enable-local-libopts \ +%endif +%if %{use_libwrap} + --with-libwrap +%else + --without-libwrap %endif make #%{?_smp_mflags} @@ -232,6 +255,9 @@ rm -rf %{buildroot} %endif %changelog +* Tue Nov 21 2017 Nikos Mavrogiannopoulos - 0.11.9-1 +- Update to upstream 0.11.9 release + * Wed May 03 2017 Nikos Mavrogiannopoulos - 0.11.8-1 - Update to upstream 0.11.8 release diff --git a/sources b/sources index 348aa08..dadd5d3 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (ocserv-0.11.8.tar.xz.sig) = 5551591abc54dfc053125c356095138aaecec6c3255cd125bd38e17350a257bc822094c270d5b3bb329afd4a9e37f355d3d16db16b4db804e15b8c5959321214 -SHA512 (ocserv-0.11.8.tar.xz) = cea5ef084a15de1e16c0d55f418f454f32c77e4303246f3d11e71ddbc7dbea028282b8200b59a49f5509e786970749b0a9795262639209924bbaa1d619c5c25c +SHA512 (ocserv-0.11.9.tar.xz.sig) = 10fb1a9b80e92ce0aafc79af647fe16e61eafc20e3d6846d74cd357826f3d0217ab57c4e9e6efe8ba2ea7b665224e863caef2c5567c512c6403bbf99a3dd321d +SHA512 (ocserv-0.11.9.tar.xz) = e497dfbb55e83874d55238162b0c4340db0a9c6ac2223cfd905923b59ebfd2fba0f998c1a60e9492be2d1e4434c66c960c3619968b47efc8464420f2e9319067 From bc89292ce8d76002f65d9e6c09054783be6c37da Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 21 Nov 2017 12:01:05 +0100 Subject: [PATCH 61/87] allow build without protobuf on ppc64 --- ocserv.spec | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 0ca1677..cdfe474 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -17,6 +17,13 @@ Release: 1%{?dist} %define use_libwrap 1 %endif +%define use_local_protobuf 0 +%if 0%{?rhel} && 0%{?rhel} == 7 +%ifarch ppc64 +%define use_local_protobuf 1 +%endif +%endif + Name: ocserv Summary: OpenConnect SSL VPN server @@ -48,12 +55,7 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute -%if 0%{?rhel} && 0%{?rhel} == 7 -%ifnarch ppc64 -BuildRequires: protobuf-c-devel -%endif -%else - +%if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel %endif @@ -125,7 +127,10 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h +%if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ +touch src/*.proto +%endif rm -rf src/ccan/talloc rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c @@ -133,7 +138,6 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* -touch src/*.proto %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c @@ -161,6 +165,9 @@ autoreconf -fvi %if 0%{?rhel} && 0%{?rhel} <= 6 --enable-local-libopts \ %endif +%if %{use_local_protobuf} + --without-protobuf \ +%endif %if %{use_libwrap} --with-libwrap %else From 0c8c0572d0673e58f9c0143d243c5ef09b94bee9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 8 Jan 2018 13:04:48 +0100 Subject: [PATCH 62/87] Update to 0.11.10-1 - Update to upstream 0.11.10 release --- .gitignore | 11 +++++++++++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 7f57cd4..c493b4f 100644 --- a/.gitignore +++ b/.gitignore @@ -83,3 +83,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.9.tar.xz.sig /ocserv-0.11.9.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.10.tar.xz.sig +/ocserv-0.11.10.tar.xz diff --git a/ocserv.spec b/ocserv.spec index cdfe474..75a0861 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.11.9 +Version: 0.11.10 Release: 1%{?dist} %global _hardened_build 1 @@ -262,6 +262,9 @@ rm -rf %{buildroot} %endif %changelog +* Mon Jan 08 2018 Nikos Mavrogiannopoulos - 0.11.10-1 +- Update to upstream 0.11.10 release + * Tue Nov 21 2017 Nikos Mavrogiannopoulos - 0.11.9-1 - Update to upstream 0.11.9 release diff --git a/sources b/sources index dadd5d3..43899fc 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (ocserv-0.11.9.tar.xz.sig) = 10fb1a9b80e92ce0aafc79af647fe16e61eafc20e3d6846d74cd357826f3d0217ab57c4e9e6efe8ba2ea7b665224e863caef2c5567c512c6403bbf99a3dd321d -SHA512 (ocserv-0.11.9.tar.xz) = e497dfbb55e83874d55238162b0c4340db0a9c6ac2223cfd905923b59ebfd2fba0f998c1a60e9492be2d1e4434c66c960c3619968b47efc8464420f2e9319067 +SHA512 (ocserv-0.11.10.tar.xz.sig) = d88f3e42595df6c3a13dc64cbcdcca2126f22be7143856b00b0c7620358f9d0e5c524019c11ff10549e74ef5eebb0613c25afd9f7244c6ab14fb70b8059188b8 +SHA512 (ocserv-0.11.10.tar.xz) = 40fe152adf4438ed390406ec46049ff3769208e1d48b40bc0f015d507902a6e81012a52dd4ddd867f56a6d50de1dfb8fa497dc3bb6ece3e666ca14df1d76c561 From b795c451c669542b92a4507cdc13c738da01669a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 16 Jan 2018 16:23:39 +0100 Subject: [PATCH 63/87] applied patch to address infinite loop --- ocserv-0.11.10-fix-loop.patch | 23 +++++++++++++++++++++++ ocserv.spec | 4 +++- 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 ocserv-0.11.10-fix-loop.patch diff --git a/ocserv-0.11.10-fix-loop.patch b/ocserv-0.11.10-fix-loop.patch new file mode 100644 index 0000000..233625a --- /dev/null +++ b/ocserv-0.11.10-fix-loop.patch @@ -0,0 +1,23 @@ +diff --git a/src/worker-vpn.c b/src/worker-vpn.c +index 730d7d2b..f1585a44 100644 +--- a/src/worker-vpn.c ++++ b/src/worker-vpn.c +@@ -2158,11 +2158,17 @@ static int connect_handler(worker_st * ws) + sigprocmask(SIG_BLOCK, &blockset, NULL); + #endif + if (ret == -1) { +- if (errno == EINTR) ++ if (errno == EINTR || EAGAIN) + continue; + terminate_reason = REASON_ERROR; + goto exit; + } ++ ++ if ((pfd[0].revents | pfd[1].revents | ++ pfd[2].revents | pfd[3].revents) & POLLERR) { ++ terminate_reason = REASON_ERROR; ++ goto exit; ++ } + } + gettime(&tnow); + diff --git a/ocserv.spec b/ocserv.spec index 75a0861..68df47d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.10 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -42,6 +42,7 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +Patch0: ocserv-0.11.10-fix-loop.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -125,6 +126,7 @@ to provide the secure VPN service. gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %endif %setup -q +%patch0 -p1 -b .infinite-loop rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) From b13f7a752663530840d5b0d8794152ffeb44da03 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 5 Mar 2018 17:08:34 +0100 Subject: [PATCH 64/87] Update to 0.11.11-1 - Update to upstream 0.11.11 release --- .gitignore | 11 +++++++++ ...42418905D8206AA754CCDC29EE58B996865171.gpg | Bin 56226 -> 58697 bytes ocserv-0.11.10-fix-loop.patch | 23 ------------------ ocserv.spec | 17 +++++++------ sources | 6 ++--- 5 files changed, 23 insertions(+), 34 deletions(-) delete mode 100644 ocserv-0.11.10-fix-loop.patch diff --git a/.gitignore b/.gitignore index c493b4f..3f616bf 100644 --- a/.gitignore +++ b/.gitignore @@ -94,3 +94,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.10.tar.xz.sig /ocserv-0.11.10.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.11.tar.xz.sig +/ocserv-0.11.11.tar.xz diff --git a/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg b/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg index 1f9a40cc96ea43f54ea9dc0f1873971a85535c2f..b1ee43c60379c783e5f3457c480d6a7ecc2447c5 100644 GIT binary patch delta 2201 zcmajfc{me}9|!Pl=AJuq&XptPi(I*nxuX%52)RWlAfZp?Q9Q`^!3dC3PpY4+LQv=C>t3>qinS9bDmO+iAPZZd~l($$+Yk|`EUM(b>rQG}ZYwp~0NipABHt$KT=2!*pw=7EyUq5kFXS2$SyEx-R zOpu};aRD$+(G{5mst5LHA$h{~hps4U#=dgu7A&o2om;==t3>7W%)9{bJg-6Ot!y+s zp*h?n588O?`kj`8KC$5m`weubIhq0wB?P&cNMH(UpU&n7nEu!r#r>UgFn0S6ut6!d z!iJYez;GfCUOn@v!sK~g2V6R{H->25(kAUK9?zhG6cV;TY^+%UYg!vaecpg?X%;T^ ztiJYsp&&z_EB-*`$o}2ySVNhBMo#(ceAV9g8A3=d{tbPa0z#94Twu32lMNsnp#DQF z|J6L&Ok}XwkYJdzNV7#CLb5do!3j@S49hDR)RifH*_!Wms~vQor3%US{jA+vQR6B> z-|B(^La=>)Y6@c|X5C(0H5Q{=M4D4w_p)xLlhUZNw+lvU>>LPBB4BM;(j6 zV=MzsMtp5XYvSZw4c(!S9hc$WrejRS0WOm?;&2+0Hb)PH*wlQ~=qKAn(Dg%k{P%S^ z=hmPW7#4*3GG%hgsB4ocm2pD3nLqZppWo)KwkFIMVU?_5WXIvOSe_<#Ul2Iw1D z7{~^Yhf0Gb5vCc;(^A2e&ckzx+gHih)XU+_p#S;;iGi5e`G=VRKofS}KT*dWDX<8T z4FH2mgI!M=-760WRS<^@k<;SVX?uZ1{=Z)V9PGS*E@;xFYVQ(HPkM)aS zI9SqhoWOUs7KKxi78HagU2K8M>T3_i$@a+nY)-*AM3@R8^o9NUNI}ID8C9CnWg7U> zH94+`CH~bLjht1;Bg>lZ1*16mxA-u-HKICNOvcADn=vg2k-|`VW>epO6Aj4`(dbo4vgq`8y_xg*q7zEB*RYH7sLW+JyCLx|I90 zq&41`e5b5}YY)||>ZyY+>g3GsA5m!3CyuD~>HRU0ex_O~YiJiMiHkm$v3rvb_Rp^2 z;>rG)XVj9jLN0CH>I5XrP*=YD5EC1Bw{1^CFnWK zu7b}f2O3hh0L2uDUm!$gPwI}6hx)M>11@fw&G4e9I9`g%F8;BB)YWmyE9 zzEyRGQ(Wy=_n3$sn!F}DQC9A8ww%oO3)ShQOG8YL<6MF~;p!blj5}mLd;X^~=gUkaG)> zJH4zfntmm;`Olti4SMsxK>&9AUl2?=Kw^;JApAG)KOk7FK_rx;RrCxa)0c2Kb*leN zOb#?8J1F9k^&!XR=XXSFaR%%OwVCfDv+(nQ)vCc8lKWF#49%nZ5ZJ^Rb7TIY7D3*d!?9;5u~KJT~?0x=KP z=1jIlwavO}pMMY(@_k!UTPIj;Cl}HQ>t>P=fML4y3a}e&>>IEYQ-cP({a+T|#FWE^ z)8sF;Q`{oY3P= 7 @@ -42,11 +42,9 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -Patch0: ocserv-0.11.10-fix-loop.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel @@ -68,7 +66,9 @@ BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: libev-devel BuildRequires: http-parser-devel +%if %{use_libwrap} BuildRequires: tcp_wrappers-devel +%endif BuildRequires: automake, autoconf BuildRequires: radcli-devel BuildRequires: lz4-devel @@ -83,6 +83,7 @@ BuildRequires: autogen BuildRequires: liboath-devel BuildRequires: uid_wrapper BuildRequires: socket_wrapper +BuildRequires: gnupg2 %if 0%{?rhel} && 0%{?rhel} >= 7 %ifarch x86_64 %{ix86} @@ -126,7 +127,6 @@ to provide the secure VPN service. gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %endif %setup -q -%patch0 -p1 -b .infinite-loop rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) @@ -140,6 +140,7 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* +sed -i 's/exit 1/exit 77/g' tests/ocpasswd-test %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c @@ -233,9 +234,6 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %make_install -%clean -rm -rf %{buildroot} - %files %defattr(-,root,root,-) @@ -264,6 +262,9 @@ rm -rf %{buildroot} %endif %changelog +* Mon Mar 05 2018 Nikos Mavrogiannopoulos - 0.11.11-1 +- Update to upstream 0.11.11 release + * Mon Jan 08 2018 Nikos Mavrogiannopoulos - 0.11.10-1 - Update to upstream 0.11.10 release diff --git a/sources b/sources index 43899fc..2f7f48b 100644 --- a/sources +++ b/sources @@ -6,6 +6,6 @@ SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (ocserv-0.11.10.tar.xz.sig) = d88f3e42595df6c3a13dc64cbcdcca2126f22be7143856b00b0c7620358f9d0e5c524019c11ff10549e74ef5eebb0613c25afd9f7244c6ab14fb70b8059188b8 -SHA512 (ocserv-0.11.10.tar.xz) = 40fe152adf4438ed390406ec46049ff3769208e1d48b40bc0f015d507902a6e81012a52dd4ddd867f56a6d50de1dfb8fa497dc3bb6ece3e666ca14df1d76c561 +SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad +SHA512 (ocserv-0.11.11.tar.xz.sig) = 7a1521f94d48d7aafb66e6c544eb2e1c5a08d02441acc5f57876faaa984ad203f0395da37e602ad5539f54aa0ce1ff5da7389254028f6b811a9e01d6f86b1e84 +SHA512 (ocserv-0.11.11.tar.xz) = 1750e4ddd221913f82379ed34cf63f2ce858d73cfda0bcf60670a32bf2e8574a39f267c77abab78d2cf9a563a816d975e1a07b85c5e2412bd6d009850c8c262d From a5336195d4380cd039642542160a9321ed9894f1 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 23 Apr 2018 13:00:38 +0200 Subject: [PATCH 65/87] Update to 0.12.0-1 - Update to upstream 0.12.0 release --- .gitignore | 11 +++++++ ocserv-0.12.0-add-missing-test.patch | 46 ++++++++++++++++++++++++++++ ocserv.conf | 27 +++++++++++----- ocserv.spec | 34 +++++++++++--------- sources | 6 ++-- 5 files changed, 99 insertions(+), 25 deletions(-) create mode 100644 ocserv-0.12.0-add-missing-test.patch diff --git a/.gitignore b/.gitignore index 3f616bf..fb7efd3 100644 --- a/.gitignore +++ b/.gitignore @@ -105,3 +105,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.11.tar.xz.sig /ocserv-0.11.11.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.0.tar.xz.sig +/ocserv-0.12.0.tar.xz diff --git a/ocserv-0.12.0-add-missing-test.patch b/ocserv-0.12.0-add-missing-test.patch new file mode 100644 index 0000000..91e1f6b --- /dev/null +++ b/ocserv-0.12.0-add-missing-test.patch @@ -0,0 +1,46 @@ +diff --git a/tests/server-cert-rsa-pss b/tests/server-cert-rsa-pss +new file mode 100755 +index 0000000..be3d098 +--- /dev/null ++++ b/tests/server-cert-rsa-pss +@@ -0,0 +1,40 @@ ++#!/bin/sh ++# ++# Copyright (C) 2017 Red Hat, Inc. ++# ++# This file is part of ocserv. ++# ++# ocserv is free software; you can redistribute it and/or modify it ++# under the terms of the GNU General Public License as published by the ++# Free Software Foundation; either version 2 of the License, or (at ++# your option) any later version. ++# ++# ocserv is distributed in the hope that it will be useful, but ++# WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++# General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with GnuTLS; if not, write to the Free Software Foundation, ++# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. ++ ++SERV="${SERV:-../src/ocserv}" ++srcdir=${srcdir:-.} ++NO_NEED_ROOT=1 ++PORT=4444 ++ ++. `dirname $0`/common.sh ++ ++echo "Testing server cert with RSA-PSS... " ++ ++update_config test-rsa-pss.config ++launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! ++wait_server $PID ++ ++echo "Connecting to obtain cookie... " ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=sha256:7462b697482f771a9a787bc19db00f704a1685ae09ed201b7a126b052a09522e --cookieonly ) || ++ fail $PID "Could not receive cookie from server" ++ ++cleanup ++ ++exit 0 diff --git a/ocserv.conf b/ocserv.conf index 96082b7..63ac7db 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,12 +1,19 @@ -# User authentication method. Could be set multiple times and in -# that case all should succeed. To enable multiple methods use -# multiple auth directives. Available options: certificate, -# plain, pam, radius, gssapi. +### The following directives do not change with server reload. +# +# User authentication method. To require multiple methods to be +# used for the user to login, add multiple auth directives. The values +# in the 'auth' directive are AND composed (if multiple all must +# succeed). +# Available options: certificate, plain, pam, radius, gssapi. +# Note that authentication methods utilizing passwords cannot be +# combined (e.g., the plain, pam or radius methods). # -# Note that authentication methods cannot be changed with reload. - # certificate: # This indicates that all connecting users must present a certificate. +# The username and user group will be then extracted from it (see +# cert-user-oid and cert-group-oid). The certificate to be accepted +# it must be signed by the CA certificate as specified in 'ca-cert' and +# it must not be listed in the CRL, as specified by the 'crl' option. # # pam[gid-min=1000]: # This enabled PAM authentication of the user. The gid-min option is used @@ -44,7 +51,9 @@ auth = "pam" # Specify alternative authentication methods that are sufficient # for authentication. That is, if set, any of the methods enabled -# will be sufficient to login. +# will be sufficient to login, irrespective of the main 'auth' entries. +# When multiple options are present, they are OR composed (any of them +# succeeding allows login). #enable-auth = "certificate" #enable-auth = "gssapi" #enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]" @@ -176,6 +185,10 @@ try-mtu-discovery = false # # There may be multiple server-cert and server-key directives, # but each key should correspond to the preceding certificate. +# The certificate files will be reloaded when changed allowing for in-place +# certificate renewal (they are checked and reloaded periodically; +# a SIGHUP signal to main server will force reload). + server-cert = /etc/pki/ocserv/public/server.crt server-key = /etc/pki/ocserv/private/server.key diff --git a/ocserv.spec b/ocserv.spec index 7a0069e..3d34685 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,7 @@ # This spec file has been automatically updated -Version: 0.11.11 +Version: 0.12.0 Release: 1%{?dist} +Patch1: ocserv-0.12.0-add-missing-test.patch %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -18,11 +19,6 @@ Release: 1%{?dist} %endif %define use_local_protobuf 0 -%if 0%{?rhel} && 0%{?rhel} == 7 -%ifarch ppc64 -%define use_local_protobuf 1 -%endif -%endif Name: ocserv Summary: OpenConnect SSL VPN server @@ -78,8 +74,6 @@ BuildRequires: GeoIP-devel %if %{use_systemd} BuildRequires: systemd BuildRequires: systemd-devel -BuildRequires: autogen-libopts-devel -BuildRequires: autogen BuildRequires: liboath-devel BuildRequires: uid_wrapper BuildRequires: socket_wrapper @@ -97,6 +91,11 @@ BuildRequires: libseccomp-devel %endif #use systemd +# no rubygem in epel7 +%if 0%{?fedora} || 0%{?rhel} > 7 +BuildRequires: rubygem(ronn) +%endif + Requires: gnutls-utils Requires: iproute Requires: pam @@ -126,7 +125,8 @@ to provide the secure VPN service. %if %{have_gpgv2} gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %endif -%setup -q + +%autosetup -p1 rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) @@ -140,14 +140,13 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* -sed -i 's/exit 1/exit 77/g' tests/ocpasswd-test %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c -%else -rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h %endif +chmod 755 tests/server-cert-rsa-pss + %build %if 0%{?rhel} && 0%{?rhel} <= 6 @@ -165,9 +164,6 @@ autoreconf -fvi %else --disable-systemd \ %endif -%if 0%{?rhel} && 0%{?rhel} <= 6 - --enable-local-libopts \ -%endif %if %{use_local_protobuf} --without-protobuf \ %endif @@ -245,9 +241,14 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT + +## Temporarily disable when rubygem is not present; there is a bug in 0.12.0 dist +%if 0%{?fedora} || 0%{?rhel} > 7 %{_mandir}/man8/ocserv.8* %{_mandir}/man8/occtl.8* %{_mandir}/man8/ocpasswd.8* +%endif + %{_bindir}/ocpasswd %{_bindir}/occtl %{_bindir}/ocserv-fw @@ -262,6 +263,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Mon Apr 23 2018 Nikos Mavrogiannopoulos - 0.12.0-1 +- Update to upstream 0.12.0 release + * Mon Mar 05 2018 Nikos Mavrogiannopoulos - 0.11.11-1 - Update to upstream 0.11.11 release diff --git a/sources b/sources index 2f7f48b..db4b5fa 100644 --- a/sources +++ b/sources @@ -5,7 +5,7 @@ SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e1 SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 -SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c +SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.11.11.tar.xz.sig) = 7a1521f94d48d7aafb66e6c544eb2e1c5a08d02441acc5f57876faaa984ad203f0395da37e602ad5539f54aa0ce1ff5da7389254028f6b811a9e01d6f86b1e84 -SHA512 (ocserv-0.11.11.tar.xz) = 1750e4ddd221913f82379ed34cf63f2ce858d73cfda0bcf60670a32bf2e8574a39f267c77abab78d2cf9a563a816d975e1a07b85c5e2412bd6d009850c8c262d +SHA512 (ocserv-0.12.0.tar.xz.sig) = a746e72ba07bf7d28104385a70ba4c685389353368d02383eb385aece19ccc9d51a86226371338dbe1737046e403b17e351a04ffa2674ca594bf9e467438b534 +SHA512 (ocserv-0.12.0.tar.xz) = 73e39a6073761a42cff7637fdc0748d969dc6ddd80635633487aa2627ae7234af772194cf27fdded9f08637b26d7ca9017555242ccdb6ade03897f9d4ca4de8d From e40d41b3e763ff5c521a5af8809822a8e1437e71 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 12 May 2018 12:46:16 +0200 Subject: [PATCH 66/87] Update to 0.12.1-1 - Update to upstream 0.12.1 release --- .gitignore | 11 +++++++ ocserv-0.12.0-add-missing-test.patch | 46 ---------------------------- ocserv.service | 4 +-- ocserv.spec | 11 +++---- sources | 6 ++-- 5 files changed, 20 insertions(+), 58 deletions(-) delete mode 100644 ocserv-0.12.0-add-missing-test.patch diff --git a/.gitignore b/.gitignore index fb7efd3..c37a7b9 100644 --- a/.gitignore +++ b/.gitignore @@ -116,3 +116,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.0.tar.xz.sig /ocserv-0.12.0.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.1.tar.xz.sig +/ocserv-0.12.1.tar.xz diff --git a/ocserv-0.12.0-add-missing-test.patch b/ocserv-0.12.0-add-missing-test.patch deleted file mode 100644 index 91e1f6b..0000000 --- a/ocserv-0.12.0-add-missing-test.patch +++ /dev/null @@ -1,46 +0,0 @@ -diff --git a/tests/server-cert-rsa-pss b/tests/server-cert-rsa-pss -new file mode 100755 -index 0000000..be3d098 ---- /dev/null -+++ b/tests/server-cert-rsa-pss -@@ -0,0 +1,40 @@ -+#!/bin/sh -+# -+# Copyright (C) 2017 Red Hat, Inc. -+# -+# This file is part of ocserv. -+# -+# ocserv is free software; you can redistribute it and/or modify it -+# under the terms of the GNU General Public License as published by the -+# Free Software Foundation; either version 2 of the License, or (at -+# your option) any later version. -+# -+# ocserv is distributed in the hope that it will be useful, but -+# WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+# General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with GnuTLS; if not, write to the Free Software Foundation, -+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -+ -+SERV="${SERV:-../src/ocserv}" -+srcdir=${srcdir:-.} -+NO_NEED_ROOT=1 -+PORT=4444 -+ -+. `dirname $0`/common.sh -+ -+echo "Testing server cert with RSA-PSS... " -+ -+update_config test-rsa-pss.config -+launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! -+wait_server $PID -+ -+echo "Connecting to obtain cookie... " -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=sha256:7462b697482f771a9a787bc19db00f704a1685ae09ed201b7a126b052a09522e --cookieonly ) || -+ fail $PID "Could not receive cookie from server" -+ -+cleanup -+ -+exit 0 diff --git a/ocserv.service b/ocserv.service index 4fe4813..a71f2dd 100644 --- a/ocserv.service +++ b/ocserv.service @@ -7,10 +7,10 @@ After=dbus.service [Service] PrivateTmp=true -Type=forking +Type=simple PIDFile=/var/run/ocserv.pid ExecStartPre=/usr/sbin/ocserv-genkey -ExecStart=/usr/sbin/ocserv --pid-file /var/run/ocserv.pid --config /etc/ocserv/ocserv.conf +ExecStart=/usr/sbin/ocserv --pid-file /var/run/ocserv.pid --config /etc/ocserv/ocserv.conf -f ExecReload=/bin/kill -HUP $MAINPID [Install] diff --git a/ocserv.spec b/ocserv.spec index 3d34685..065ae06 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.0 +Version: 0.12.1 Release: 1%{?dist} -Patch1: ocserv-0.12.0-add-missing-test.patch %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -145,8 +144,6 @@ sed -i 's/either version 3 of the License/either version 2 of the License/g' bui echo "int main() { return 77; }" > tests/valid-hostname.c %endif -chmod 755 tests/server-cert-rsa-pss - %build %if 0%{?rhel} && 0%{?rhel} <= 6 @@ -242,12 +239,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT -## Temporarily disable when rubygem is not present; there is a bug in 0.12.0 dist -%if 0%{?fedora} || 0%{?rhel} > 7 %{_mandir}/man8/ocserv.8* %{_mandir}/man8/occtl.8* %{_mandir}/man8/ocpasswd.8* -%endif %{_bindir}/ocpasswd %{_bindir}/occtl @@ -263,6 +257,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat May 12 2018 Nikos Mavrogiannopoulos - 0.12.1-1 +- Update to upstream 0.12.1 release + * Mon Apr 23 2018 Nikos Mavrogiannopoulos - 0.12.0-1 - Update to upstream 0.12.0 release diff --git a/sources b/sources index db4b5fa..e483c81 100644 --- a/sources +++ b/sources @@ -4,8 +4,8 @@ SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42deb SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a -SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 +SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.0.tar.xz.sig) = a746e72ba07bf7d28104385a70ba4c685389353368d02383eb385aece19ccc9d51a86226371338dbe1737046e403b17e351a04ffa2674ca594bf9e467438b534 -SHA512 (ocserv-0.12.0.tar.xz) = 73e39a6073761a42cff7637fdc0748d969dc6ddd80635633487aa2627ae7234af772194cf27fdded9f08637b26d7ca9017555242ccdb6ade03897f9d4ca4de8d +SHA512 (ocserv-0.12.1.tar.xz.sig) = 0dd3123ffc525faa724de7a10f0a2202fc31ea667428e41c3ca68a3fffc29979d9bff16abde3adece8e921881704efc952d077e9bc161be4d69a124218ae5616 +SHA512 (ocserv-0.12.1.tar.xz) = 3fc5e6c6a3b4390cb0ffa78fac4f8e70aa689227c6f5b62180b95f35cf2de0c41075a157412de40866ce1af12ad8feabd87b2b986c8ca09ebee70514da9ec13f From b191177a8bae6eba369c04de06648f3609c4ffe7 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 10 Jan 2019 20:53:38 +0100 Subject: [PATCH 67/87] Update to 0.12.2-1 - Update to upstream 0.12.2 release --- .gitignore | 11 +++++++++++ ocserv.spec | 6 +++++- sources | 4 ++-- 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index c37a7b9..7dfe253 100644 --- a/.gitignore +++ b/.gitignore @@ -127,3 +127,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.1.tar.xz.sig /ocserv-0.12.1.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.2.tar.xz.sig +/ocserv-0.12.2.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 065ae06..3772742 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.12.1 +Version: 0.12.2 Release: 1%{?dist} %global _hardened_build 1 @@ -41,6 +41,7 @@ Source11: ocserv.init # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 +BuildRequires: gcc %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel %else @@ -257,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 10 2019 Nikos Mavrogiannopoulos - 0.12.2-1 +- Update to upstream 0.12.2 release + * Sat May 12 2018 Nikos Mavrogiannopoulos - 0.12.1-1 - Update to upstream 0.12.1 release diff --git a/sources b/sources index e483c81..4b8f0de 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.1.tar.xz.sig) = 0dd3123ffc525faa724de7a10f0a2202fc31ea667428e41c3ca68a3fffc29979d9bff16abde3adece8e921881704efc952d077e9bc161be4d69a124218ae5616 -SHA512 (ocserv-0.12.1.tar.xz) = 3fc5e6c6a3b4390cb0ffa78fac4f8e70aa689227c6f5b62180b95f35cf2de0c41075a157412de40866ce1af12ad8feabd87b2b986c8ca09ebee70514da9ec13f +SHA512 (ocserv-0.12.2.tar.xz.sig) = 135eda011200679e7ae29fc66a09f940a88c056561c8491538089070327554c295533ad238a1b866f90a702b5465969817148495c96fa5b3ef8d1a10bf14ce6d +SHA512 (ocserv-0.12.2.tar.xz) = 3ce6cf68ad9349d6d090f35c14712ce3ddb8f2fe6b33285e050e99ac4457ca1127b55d3cea739a4364072534c69cb094912b4631a14b87362bd31ccc1a550b3a From 2667383daa2f96607e970fd3037053adf4842683 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 12 Mar 2019 21:24:11 +0100 Subject: [PATCH 68/87] Update to 0.12.3-1 - Update to upstream 0.12.3 release --- .gitignore | 11 +++++++++++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 7dfe253..7b7de1e 100644 --- a/.gitignore +++ b/.gitignore @@ -138,3 +138,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.2.tar.xz.sig /ocserv-0.12.2.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.3.tar.xz.sig +/ocserv-0.12.3.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 3772742..d81556b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.12.2 +Version: 0.12.3 Release: 1%{?dist} %global _hardened_build 1 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Mar 12 2019 Nikos Mavrogiannopoulos - 0.12.3-1 +- Update to upstream 0.12.3 release + * Thu Jan 10 2019 Nikos Mavrogiannopoulos - 0.12.2-1 - Update to upstream 0.12.2 release diff --git a/sources b/sources index 4b8f0de..8e150a5 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.2.tar.xz.sig) = 135eda011200679e7ae29fc66a09f940a88c056561c8491538089070327554c295533ad238a1b866f90a702b5465969817148495c96fa5b3ef8d1a10bf14ce6d -SHA512 (ocserv-0.12.2.tar.xz) = 3ce6cf68ad9349d6d090f35c14712ce3ddb8f2fe6b33285e050e99ac4457ca1127b55d3cea739a4364072534c69cb094912b4631a14b87362bd31ccc1a550b3a +SHA512 (ocserv-0.12.3.tar.xz.sig) = cac126cc717dded853ffcca2754111c7f1fda270e931ce912aed6c2b7394ebb193e67bc2c1c10bd883e93a271c0ec60393945d37c4820d5ca648894a265effcf +SHA512 (ocserv-0.12.3.tar.xz) = 93a85a09c1d55c265a188864744ef99a52d72d5bdcd5cce1c3cb6a1089fadd27464be9bb7775d05001e962bc4ac7edcb9cbaf7b209557cb147b8b27252082dbe From 4e8e4aca6ef80fc74728ff4074194e97f6f62554 Mon Sep 17 00:00:00 2001 From: Simone Caronni Date: Fri, 7 Jun 2019 18:11:02 +0200 Subject: [PATCH 69/87] Rebuild for oath-toolkit update --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index d81556b..165ddeb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.3 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Jun 07 2019 Simone Caronni - 0.12.3-2 +- Rebuild for oath-toolkit update. + * Tue Mar 12 2019 Nikos Mavrogiannopoulos - 0.12.3-1 - Update to upstream 0.12.3 release From e12c74d3372dc15539c844acf3f63b314b6a0613 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 3 Jul 2019 22:00:23 +0200 Subject: [PATCH 70/87] Update to 0.12.4-1 - Update to upstream 0.12.4 release --- .gitignore | 11 +++++++++++ ocserv.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7b7de1e..201e0b6 100644 --- a/.gitignore +++ b/.gitignore @@ -149,3 +149,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.3.tar.xz.sig /ocserv-0.12.3.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.4.tar.xz.sig +/ocserv-0.12.4.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 165ddeb..f694cd7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.3 -Release: 2%{?dist} +Version: 0.12.4 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Jul 03 2019 Nikos Mavrogiannopoulos - 0.12.4-1 +- Update to upstream 0.12.4 release + * Fri Jun 07 2019 Simone Caronni - 0.12.3-2 - Rebuild for oath-toolkit update. diff --git a/sources b/sources index 8e150a5..7a8dae7 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.3.tar.xz.sig) = cac126cc717dded853ffcca2754111c7f1fda270e931ce912aed6c2b7394ebb193e67bc2c1c10bd883e93a271c0ec60393945d37c4820d5ca648894a265effcf -SHA512 (ocserv-0.12.3.tar.xz) = 93a85a09c1d55c265a188864744ef99a52d72d5bdcd5cce1c3cb6a1089fadd27464be9bb7775d05001e962bc4ac7edcb9cbaf7b209557cb147b8b27252082dbe +SHA512 (ocserv-0.12.4.tar.xz.sig) = 8ac5a5a7b3b4dcedce4a497cba923092e0035c816ea0d6b9a888102aeb03889af101259eb392d676501717abdc7544b78f60054f4409835022cf2a6949e795ff +SHA512 (ocserv-0.12.4.tar.xz) = 5483cede9627886912f9620d358f1a22504b5de2653529e4275f4b96e4fc874b264877ff0c9ef85c9a0662253d0de44950c4f3a8410fea427d742cc733d5f741 From 80903ef2db2ee5f7868245ddee568bdb7b7b6f32 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 16 Oct 2019 22:42:17 +0200 Subject: [PATCH 71/87] Update to 0.12.5-1 - Update to upstream 0.12.5 release --- .gitignore | 11 +++++++++++ ocserv.spec | 27 +++++++++++++++++++++++++-- sources | 4 ++-- 3 files changed, 38 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 201e0b6..6cc30ce 100644 --- a/.gitignore +++ b/.gitignore @@ -160,3 +160,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.4.tar.xz.sig /ocserv-0.12.4.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.5.tar.xz.sig +/ocserv-0.12.5.tar.xz diff --git a/ocserv.spec b/ocserv.spec index f694cd7..84b7ff7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.12.4 +Version: 0.12.5 Release: 1%{?dist} %global _hardened_build 1 @@ -13,8 +13,16 @@ Release: 1%{?dist} %if 0%{?fedora} >= 28 || 0%{?rhel} > 7 %define use_libwrap 0 +%define use_geoip 0 %else %define use_libwrap 1 +%define use_geoip 1 +%endif + +%if 0%{?rhel} && 0%{?rhel} == 8 +%define use_http_parser 0 +%else +%define use_http_parser 1 %endif %define use_local_protobuf 0 @@ -61,7 +69,10 @@ BuildRequires: gperf BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: libev-devel +%if %{use_http_parser} BuildRequires: http-parser-devel +%endif + %if %{use_libwrap} BuildRequires: tcp_wrappers-devel %endif @@ -69,7 +80,11 @@ BuildRequires: automake, autoconf BuildRequires: radcli-devel BuildRequires: lz4-devel BuildRequires: readline-devel +%if %{use_geoip} BuildRequires: GeoIP-devel +%else +BuildRequires: libmaxminddb-devel +%endif %if %{use_systemd} BuildRequires: systemd @@ -92,7 +107,7 @@ BuildRequires: libseccomp-devel %endif #use systemd # no rubygem in epel7 -%if 0%{?fedora} || 0%{?rhel} > 7 +%if 0%{?fedora} BuildRequires: rubygem(ronn) %endif @@ -128,7 +143,9 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %autosetup -p1 +%if %{use_http_parser} rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h +%endif %if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ touch src/*.proto @@ -165,6 +182,9 @@ autoreconf -fvi %if %{use_local_protobuf} --without-protobuf \ %endif +%if ! %{use_http_parser} + --without-http-parser \ +%endif %if %{use_libwrap} --with-libwrap %else @@ -258,6 +278,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Oct 16 2019 Nikos Mavrogiannopoulos - 0.12.5-1 +- Update to upstream 0.12.5 release + * Wed Jul 03 2019 Nikos Mavrogiannopoulos - 0.12.4-1 - Update to upstream 0.12.4 release diff --git a/sources b/sources index 7a8dae7..585bfb5 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.4.tar.xz.sig) = 8ac5a5a7b3b4dcedce4a497cba923092e0035c816ea0d6b9a888102aeb03889af101259eb392d676501717abdc7544b78f60054f4409835022cf2a6949e795ff -SHA512 (ocserv-0.12.4.tar.xz) = 5483cede9627886912f9620d358f1a22504b5de2653529e4275f4b96e4fc874b264877ff0c9ef85c9a0662253d0de44950c4f3a8410fea427d742cc733d5f741 +SHA512 (ocserv-0.12.5.tar.xz.sig) = 049cf165ba148090a6b21bbb17d68c0c35936e904ab5731a7a8473cd85944af955ea738b87ce580cdb8c3524bdca8a3361d1f30895cf7e272682b1061902b3bf +SHA512 (ocserv-0.12.5.tar.xz) = b6e6262fbf5f00639253f85ce8ed0b10d8b45dbcdf4325cbba7f5a80fee979d556f23a635df36b85b307f12b7e5bd44165d8631624500d52168170ca00a166aa From ffc05bd4a44aaa155dc75dbfe2fc6a815486cca3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 28 Dec 2019 20:34:30 +0100 Subject: [PATCH 72/87] Update to 0.12.6-1 - Update to upstream 0.12.6 release --- .gitignore | 11 +++++++++++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 6cc30ce..2aeceee 100644 --- a/.gitignore +++ b/.gitignore @@ -171,3 +171,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.5.tar.xz.sig /ocserv-0.12.5.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.6.tar.xz.sig +/ocserv-0.12.6.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 84b7ff7..9263fb9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.12.5 +Version: 0.12.6 Release: 1%{?dist} %global _hardened_build 1 @@ -278,6 +278,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat Dec 28 2019 Nikos Mavrogiannopoulos - 0.12.6-1 +- Update to upstream 0.12.6 release + * Wed Oct 16 2019 Nikos Mavrogiannopoulos - 0.12.5-1 - Update to upstream 0.12.5 release diff --git a/sources b/sources index 585bfb5..7ff8e74 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.5.tar.xz.sig) = 049cf165ba148090a6b21bbb17d68c0c35936e904ab5731a7a8473cd85944af955ea738b87ce580cdb8c3524bdca8a3361d1f30895cf7e272682b1061902b3bf -SHA512 (ocserv-0.12.5.tar.xz) = b6e6262fbf5f00639253f85ce8ed0b10d8b45dbcdf4325cbba7f5a80fee979d556f23a635df36b85b307f12b7e5bd44165d8631624500d52168170ca00a166aa +SHA512 (ocserv-0.12.6.tar.xz.sig) = 8791479c6f1e6e8c6fd7b6f08857c5e6c1fc81ebc9a11c55231a049c27e2ee9f0bf938ccf1b66fb704eafb26cda6c9595f54edffa265d732dd640e8123538313 +SHA512 (ocserv-0.12.6.tar.xz) = 4d254298dc897304b4676f28a21338c138196cbdb08170c6d536c8c6730fab307642dbf853f96e66335604cb68711262678d3d0be84e6768ec720b9a81ccf813 From f2950632b0ff852f87e3b1f7231af83066cc0e56 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 2 Jan 2020 15:31:22 +0100 Subject: [PATCH 73/87] ocserv: mark profile.xml as configuration file Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 9263fb9..8875f5f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.6 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -230,7 +230,7 @@ install -p -m 755 %{SOURCE8} %{buildroot}/%{_sbindir} mkdir -p %{buildroot}/%{_bindir} install -p -m 755 %{SOURCE9} %{buildroot}/%{_bindir} -%if 0%{?rhel} +%if 0%{?rhel} && 0%{?rhel} <= 7 sed -i 's|expiration_days=-1|expiration_days=9999|' %{buildroot}/%{_sbindir}/ocserv-genkey sed -i 's|tls-priorities = "@SYSTEM"|tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"|' %{buildroot}/%{_sysconfdir}/ocserv/ocserv.conf %if 0%{?rhel} <= 6 @@ -256,6 +256,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf %config(noreplace) %{_sysconfdir}/pam.d/ocserv +%config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml %doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT @@ -278,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 2 2020 Nikos Mavrogiannopoulos - 0.12.6-2 +- profile.xml is marked as configuration + * Sat Dec 28 2019 Nikos Mavrogiannopoulos - 0.12.6-1 - Update to upstream 0.12.6 release From 58540975de0b78dd4c9c146eaef6028cbcaf5fed Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 2 Jan 2020 15:51:41 +0100 Subject: [PATCH 74/87] corrected typo --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 8875f5f..136218d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -104,7 +104,7 @@ BuildRequires: libseccomp-devel %endif %endif -%endif #use systemd +%endif # no rubygem in epel7 %if 0%{?fedora} From 5f3a13e314820ea2c440a3afc4db6098f1c61f88 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 20 Mar 2020 14:28:39 +0100 Subject: [PATCH 75/87] Update to 1.0.0-1 - Update to upstream 1.0.0 release --- .gitignore | 11 +++++++++++ ocserv.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 2aeceee..598943f 100644 --- a/.gitignore +++ b/.gitignore @@ -182,3 +182,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.6.tar.xz.sig /ocserv-0.12.6.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-1.0.0.tar.xz.sig +/ocserv-1.0.0.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 136218d..3e890a5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.6 -Release: 2%{?dist} +Version: 1.0.0 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 +- Update to upstream 1.0.0 release + * Thu Jan 2 2020 Nikos Mavrogiannopoulos - 0.12.6-2 - profile.xml is marked as configuration diff --git a/sources b/sources index 7ff8e74..38f1c83 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.6.tar.xz.sig) = 8791479c6f1e6e8c6fd7b6f08857c5e6c1fc81ebc9a11c55231a049c27e2ee9f0bf938ccf1b66fb704eafb26cda6c9595f54edffa265d732dd640e8123538313 -SHA512 (ocserv-0.12.6.tar.xz) = 4d254298dc897304b4676f28a21338c138196cbdb08170c6d536c8c6730fab307642dbf853f96e66335604cb68711262678d3d0be84e6768ec720b9a81ccf813 +SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd +SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 From 14e3978673836e762580f38dc801c5ca9e7fd430 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 9 Apr 2020 23:12:45 +0200 Subject: [PATCH 76/87] Update to 1.0.1-1 - Update to upstream 1.0.1 release --- .gitignore | 11 +++++++++++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 598943f..662daf5 100644 --- a/.gitignore +++ b/.gitignore @@ -193,3 +193,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-1.0.0.tar.xz.sig /ocserv-1.0.0.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-1.0.1.tar.xz.sig +/ocserv-1.0.1.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 3e890a5..f06ee6b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 1.0.0 +Version: 1.0.1 Release: 1%{?dist} %global _hardened_build 1 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 +- Update to upstream 1.0.1 release + * Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 - Update to upstream 1.0.0 release diff --git a/sources b/sources index 38f1c83..5228c14 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd -SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 +SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 +SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 From 048e6ca0a64ab3e53f2b10a1c709a7d24cf8dc91 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 1 May 2020 19:44:28 +0200 Subject: [PATCH 77/87] removed unnecessary files --- sources | 9 --------- 1 file changed, 9 deletions(-) diff --git a/sources b/sources index 5228c14..8d6f956 100644 --- a/sources +++ b/sources @@ -1,11 +1,2 @@ -SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 -SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 -SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 -SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac -SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 -SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a -SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 From 437757d081e4b4f68808159fb2e3ae5c2dd874c4 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 6 May 2020 19:56:44 +0200 Subject: [PATCH 78/87] Requirements turned to recommendations This enables ocserv being used without these dependencies. --- ocserv.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index f06ee6b..65a66d9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -111,9 +111,9 @@ BuildRequires: libseccomp-devel BuildRequires: rubygem(ronn) %endif -Requires: gnutls-utils -Requires: iproute -Requires: pam +Recommends: gnutls-utils +Recommends: iproute +Recommends: pam Requires(pre): shadow-utils %if %{use_systemd} Requires(post): systemd From 3627d7cec7fd9f8c9564f016cac744066b4c37c8 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 16 May 2020 12:13:07 +0200 Subject: [PATCH 79/87] Revert "Requirements turned to recommendations" This reverts commit 437757d081e4b4f68808159fb2e3ae5c2dd874c4. EPEL7 cannot use recommends. --- ocserv.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 65a66d9..f06ee6b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -111,9 +111,9 @@ BuildRequires: libseccomp-devel BuildRequires: rubygem(ronn) %endif -Recommends: gnutls-utils -Recommends: iproute -Recommends: pam +Requires: gnutls-utils +Requires: iproute +Requires: pam Requires(pre): shadow-utils %if %{use_systemd} Requires(post): systemd From d77fc633f9d4189a189825b9018dbcb08e9e2ef7 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 16 Jun 2020 19:46:48 +0200 Subject: [PATCH 80/87] updated to 1.1.0 --- .gitignore | 2 ++ ocserv.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 662daf5..5bb0fef 100644 --- a/.gitignore +++ b/.gitignore @@ -204,3 +204,5 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-1.0.1.tar.xz.sig /ocserv-1.0.1.tar.xz +/ocserv-1.1.0.tar.xz +/ocserv-1.1.0.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index f06ee6b..b66358c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 1.0.1 +Version: 1.1.0 Release: 1%{?dist} %global _hardened_build 1 @@ -57,6 +57,7 @@ BuildRequires: gnutls-devel %endif BuildRequires: pam-devel BuildRequires: iproute +BuildRequires: openconnect %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel @@ -203,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} +make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change %if %{use_systemd} %post @@ -270,6 +271,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %{_bindir}/ocserv-fw %{_bindir}/ocserv-script %{_sbindir}/ocserv +%{_sbindir}/ocserv-worker %{_sbindir}/ocserv-genkey %{_localstatedir}/lib/ocserv/profile.xml %if %{use_systemd} @@ -279,6 +281,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 +- Update to upstream 1.1.0 release (introduces ocserv-worker) + * Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 - Update to upstream 1.0.1 release diff --git a/sources b/sources index 8d6f956..9db8d9c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 -SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 +SHA512 (ocserv-1.1.0.tar.xz) = 10a589ccf28bf9568e602fc26d9133c78a840205f1a777d62cb52b680221bdaa8c231c37a95587b3494437dafc649b40f71be05a4868646c48efb3d873615861 +SHA512 (ocserv-1.1.0.tar.xz.sig) = 29c4082fa34327663ce6bcd29102c2eba088d79049e6637fabd048c8310fa9ff27853f06ef696c19ef66c146ce9e6e455cecc0261676a6ed343de731142f2022 From 74489711f4abd8ab2dcbda79eefe00e4a9646efc Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:37:59 +0200 Subject: [PATCH 81/87] updated to 1.1.1 --- .gitignore | 2 ++ ocserv.conf | 24 ++++++++++++++++++------ ocserv.spec | 6 ++++-- sources | 4 ++-- 4 files changed, 26 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 5bb0fef..d241a20 100644 --- a/.gitignore +++ b/.gitignore @@ -206,3 +206,5 @@ /ocserv-1.0.1.tar.xz /ocserv-1.1.0.tar.xz /ocserv-1.1.0.tar.xz.sig +/ocserv-1.1.1.tar.xz +/ocserv-1.1.1.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 63ac7db..50b980a 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -126,9 +126,12 @@ chroot-dir = /var/lib/ocserv # information at: https://gitlab.com/ocserv/ocserv/issues isolate-workers = true -# A banner to be displayed on clients +# A banner to be displayed on clients after connection #banner = "Welcome" +# A banner to be displayed on clients before connection +#pre-login-banner = "Welcome" + # Limit the number of clients. Unset or set to zero for unlimited. #max-clients = 1024 max-clients = 16 @@ -137,9 +140,19 @@ max-clients = 16 # multiple times). Unset or set to zero for unlimited. max-same-clients = 2 -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 +# When the server receives connections from a proxy, like haproxy +# which supports the proxy protocol, set this to obtain the correct +# client addresses. The proxy protocol would then be expected in +# the TCP or UNIX socket (not the UDP one). Although both v1 +# and v2 versions of proxy protocol are supported, the v2 version +# is recommended as it is more efficient in parsing. +#listen-proxy-proto = true + +# Rate limit the number of incoming connections to one every X milliseconds +# (X is the provided value), as the secmod backlog grows. This +# makes the server more resilient (and prevents connection failures) on +# multiple concurrent connections. Set to zero for no limit. +rate-limit-ms = 100 # Stats report time. The number of seconds after which each # worker process will report its usage statistics (number of @@ -268,8 +281,7 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients) # in your system. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" -tls-priorities = "@SYSTEM" +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" # More combinations in priority strings are available, check # http://gnutls.org/manual/html_node/Priority-Strings.html diff --git a/ocserv.spec b/ocserv.spec index b66358c..86b4b2d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,4 @@ -# This spec file has been automatically updated -Version: 1.1.0 +Version: 1.1.1 Release: 1%{?dist} %global _hardened_build 1 @@ -281,6 +280,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 +- Update to upstream 1.1.1 release + * Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 - Update to upstream 1.1.0 release (introduces ocserv-worker) diff --git a/sources b/sources index 9db8d9c..b716d8a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.0.tar.xz) = 10a589ccf28bf9568e602fc26d9133c78a840205f1a777d62cb52b680221bdaa8c231c37a95587b3494437dafc649b40f71be05a4868646c48efb3d873615861 -SHA512 (ocserv-1.1.0.tar.xz.sig) = 29c4082fa34327663ce6bcd29102c2eba088d79049e6637fabd048c8310fa9ff27853f06ef696c19ef66c146ce9e6e455cecc0261676a6ed343de731142f2022 +SHA512 (ocserv-1.1.1.tar.xz) = 1173416f0d32f9faf98e539c8e73316a50ac93b519d1ade19374a3df865d10d975e13ac53e0c5a5e77c80f3605d7a810287b18b85b798887d227389761b54220 +SHA512 (ocserv-1.1.1.tar.xz.sig) = 9fe0f3e2ea4daaf1d053c2cdc87d38dc8256feb11c16f93e7e677500457914a82e659901f77f6ec4ca175fceeec74e3f8d001412c969c18dcf486545bac83393 From dea83137ae9678488ac7d21f967d7ceadc720d56 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 15:03:28 +0200 Subject: [PATCH 82/87] updated according to master --- ocserv.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 86b4b2d..1d015c0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -57,6 +57,7 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute BuildRequires: openconnect +BuildRequires: gnutls-utils %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel @@ -203,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change +make check %{?_smp_mflags} VERBOSE=1 %if %{use_systemd} %post @@ -280,7 +281,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog -* Thu Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 +* Mon Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 - Update to upstream 1.1.1 release * Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 From 26ce79ba744b91b8c8568c22f8933f27b635339b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 23 Oct 2020 15:00:03 +0200 Subject: [PATCH 83/87] do not treat TODO as document to install --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 1d015c0..65b1166 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -259,7 +259,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/ocserv %config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml -%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* From a41e4da334e66f3cd58790d42e84544823422560 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 11 Jul 2023 18:46:47 +0200 Subject: [PATCH 84/87] updated to 1.2.0 --- ocserv.conf | 390 +++++++++++++++++++++++++++++++++++----------------- ocserv.spec | 36 ++--- sources | 4 +- 3 files changed, 280 insertions(+), 150 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 50b980a..694b830 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,5 +1,5 @@ ### The following directives do not change with server reload. -# + # User authentication method. To require multiple methods to be # used for the user to login, add multiple auth directives. The values # in the 'auth' directive are AND composed (if multiple all must @@ -7,7 +7,7 @@ # Available options: certificate, plain, pam, radius, gssapi. # Note that authentication methods utilizing passwords cannot be # combined (e.g., the plain, pam or radius methods). -# + # certificate: # This indicates that all connecting users must present a certificate. # The username and user group will be then extracted from it (see @@ -16,7 +16,7 @@ # it must not be listed in the CRL, as specified by the 'crl' option. # # pam[gid-min=1000]: -# This enabled PAM authentication of the user. The gid-min option is used +# This enabled PAM authentication of the user. The gid-min option is used # by auto-select-group option, in order to select the minimum valid group ID. # # plain[passwd=/etc/ocserv/ocpasswd,otp=/etc/ocserv/users.otp] @@ -24,18 +24,20 @@ # entries of the following format. # "username:groupname1,groupname2:encoded-password" # One entry must be listed per line, and 'ocpasswd' should be used -# to generate password entries. The 'otp' suboption allows to specify +# to generate password entries. The 'otp' suboption allows one to specify # an oath password file to be used for one time passwords; the format of -# the file is described in https://code.google.com/p/mod-authn-otp/wiki/UsersFile +# the file is described in https://github.com/archiecobbs/mod-authn-otp/wiki/UsersFile # -# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name,override-interim-updates=false]: +# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name]: # The radius option requires specifying freeradius-client configuration -# file. If the groupconfig option is set, then config-per-user will be overriden, -# and all configuration will be read from radius. The 'override-interim-updates' if set to -# true will ignore Acct-Interim-Interval from the server and 'stats-report-time' will be considered. +# file. If the groupconfig option is set, then config-per-user/group will be overridden, +# and all configuration will be read from radius. That also includes the +# Acct-Interim-Interval, and Session-Timeout values. +# +# See doc/README-radius.md for the supported radius configuration attributes. # # gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900] -# The gssapi option allows to use authentication methods supported by GSSAPI, +# The gssapi option allows one to use authentication methods supported by GSSAPI, # such as Kerberos tickets with ocserv. It should be best used as an alternative # to PAM (i.e., have pam in auth and gssapi in enable-auth), to allow users with # tickets and without tickets to login. The default value for require-local-user-map @@ -70,27 +72,29 @@ auth = "pam" # Only one accounting method can be specified. #acct = "radius[config=/etc/radiusclient/radiusclient.conf]" -# Use listen-host to limit to specific IPs or to the IPs of a provided +# Use listen-host to limit to specific IPs or to the IPs of a provided # hostname. #listen-host = [IP|HOSTNAME] +# Use udp-listen-host to limit udp to specific IPs or to the IPs of a provided +# hostname. if not set, listen-host will be used +#udp-listen-host = [IP|HOSTNAME] + # When the server has a dynamic DNS address (that may change), # should set that to true to ask the client to resolve again on # reconnects. #listen-host-is-dyndns = true +# move the listen socket within the specified network namespace +# listen-netns = "foo" + # TCP and UDP port number tcp-port = 443 udp-port = 443 -# Accept connections using a socket file. It accepts HTTP -# connections (i.e., without SSL/TLS unlike its TCP counterpart), -# and uses it as the primary channel. That option cannot be -# combined with certificate authentication. -#listen-clear-file = /var/run/ocserv-conn.socket - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). +# The user the worker processes will be run as. This should be a dedicated +# unprivileged user (e.g., 'ocserv') and no other services should run as this +# user. run-as-user = ocserv run-as-group = ocserv @@ -106,6 +110,53 @@ socket-file = ocserv.sock # The default server directory. Does not require any devices present. chroot-dir = /var/lib/ocserv +# The key and the certificates of the server +# The key may be a file, or any URL supported by GnuTLS (e.g., +# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user +# or pkcs11:object=my-vpn-key;object-type=private) +# +# The server-cert file may contain a single certificate, or +# a sorted certificate chain. +# There may be multiple server-cert and server-key directives, +# but each key should correspond to the preceding certificate. +# The certificate files will be reloaded when changed allowing for in-place +# certificate renewal (they are checked and reloaded periodically; +# a SIGHUP signal to main server will force reload). + +server-cert = /etc/pki/ocserv/public/server.crt +server-key = /etc/pki/ocserv/private/server.key + +# Diffie-Hellman parameters. Only needed if for old (pre 3.6.0 +# versions of GnuTLS for supporting DHE ciphersuites. +# Can be generated using: +# certtool --generate-dh-params --outfile /etc/ocserv/dh.pem +#dh-params = /etc/ocserv/dh.pem + +# In case PKCS #11, TPM or encrypted keys are used the PINs should be available +# in files. The srk-pin-file is applicable to TPM keys only, and is the +# storage root key. +#pin-file = /etc/ocserv/pin.txt +#srk-pin-file = /etc/ocserv/srkpin.txt + +# The password or PIN needed to unlock the key in server-key file. +# Only needed if the file is encrypted or a PKCS #11 object. This +# is an alternative method to pin-file. +#key-pin = 1234 + +# The SRK PIN for TPM. +# This is an alternative method to srk-pin-file. +#srk-pin = 1234 + +# The Certificate Authority that will be used to verify +# client certificates (public keys) if certificate authentication +# is set. +#ca-cert = /etc/ocserv/ca.pem + +# The number of sub-processes to use for the security module (authentication) +# processes. Typically this should not be set as the number of processes +# is determined automatically by the initially set maximum number of clients. +#sec-mod-scale = 4 + ### All configuration options below this line are reloaded on a SIGHUP. ### The options above, will remain unchanged. Note however, that the @@ -123,7 +174,7 @@ chroot-dir = /var/lib/ocserv # Note however, that process isolation is restricted to the specific libc versions # the isolation was tested at. If you get random failures on worker processes, try # disabling that option and report the failures you, along with system and debugging -# information at: https://gitlab.com/ocserv/ocserv/issues +# information at: https://gitlab.com/openconnect/ocserv/issues isolate-workers = true # A banner to be displayed on clients after connection @@ -132,7 +183,8 @@ isolate-workers = true # A banner to be displayed on clients before connection #pre-login-banner = "Welcome" -# Limit the number of clients. Unset or set to zero for unlimited. +# Limit the number of clients. Unset or set to zero if unknown. In +# that case the maximum value is ~8k clients. #max-clients = 1024 max-clients = 16 @@ -160,6 +212,12 @@ rate-limit-ms = 100 # radius is in use. #stats-report-time = 360 +# Stats reset time. The period of time statistics kept by main/sec-mod +# processes will be reset. These are the statistics shown by cmd +# 'occtl show stats'. For daily: 86400, weekly: 604800 +# This is unrelated to stats-report-time. +server-stats-reset-time = 604800 + # Keepalive in seconds keepalive = 32400 @@ -174,7 +232,7 @@ dpd = 90 # be higher to prevent such clients being awaken too # often by the DPD messages, and save battery. # The mobile clients are distinguished from the header -# 'X-AnyConnect-Identifier-DeviceType'. +# 'X-AnyConnect-Identifier-Platform'. mobile-dpd = 1800 # If using DTLS, and no UDP traffic is received for this @@ -188,28 +246,9 @@ switch-to-tcp-timeout = 25 # MTU discovery (DPD must be enabled) try-mtu-discovery = false -# The key and the certificates of the server -# The key may be a file, or any URL supported by GnuTLS (e.g., -# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user -# or pkcs11:object=my-vpn-key;object-type=private) -# -# The server-cert file may contain a single certificate, or -# a sorted certificate chain. -# -# There may be multiple server-cert and server-key directives, -# but each key should correspond to the preceding certificate. -# The certificate files will be reloaded when changed allowing for in-place -# certificate renewal (they are checked and reloaded periodically; -# a SIGHUP signal to main server will force reload). - -server-cert = /etc/pki/ocserv/public/server.crt -server-key = /etc/pki/ocserv/private/server.key - -# Diffie-Hellman parameters. Only needed if you require support -# for the DHE ciphersuites (by default this server supports ECDHE). -# Can be generated using: -# certtool --generate-dh-params --outfile /path/to/dh.pem -#dh-params = /path/to/dh.pem +# To enable load-balancer connection draining, set server-drain-ms to a value +# higher than your load-balancer health probe interval. +#server-drain-ms = 15000 # If you have a certificate from a CA that provides an OCSP # service you may provide a fresh OCSP status response within @@ -218,37 +257,18 @@ server-key = /etc/pki/ocserv/private/server.key # You can update this response periodically using: # ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response # Make sure that you replace the following file in an atomic way. -#ocsp-response = /path/to/ocsp.der - -# In case PKCS #11, TPM or encrypted keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only, and is the -# storage root key. -#pin-file = /path/to/pin.txt -#srk-pin-file = /path/to/srkpin.txt - -# The password or PIN needed to unlock the key in server-key file. -# Only needed if the file is encrypted or a PKCS #11 object. This -# is an alternative method to pin-file. -#key-pin = 1234 - -# The SRK PIN for TPM. -# This is an alternative method to srk-pin-file. -#srk-pin = 1234 - -# The Certificate Authority that will be used to verify -# client certificates (public keys) if certificate authentication -# is set. -ca-cert = /etc/pki/ocserv/cacerts/ca.crt +#ocsp-response = /etc/ocserv/ocsp.der # The object identifier that will be used to read the user ID in the client # certificate. The object identifier should be part of the certificate's DN # Useful OIDs are: -# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 +# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1, SAN(rfc822name) cert-user-oid = 0.9.2342.19200300.100.1.1 # The object identifier that will be used to read the user group in the -# client certificate. The object identifier should be part of the certificate's -# DN. Useful OIDs are: +# client certificate. The object identifier should be part of the certificate's +# DN. If the user may belong to multiple groups, then use multiple such fields +# in the certificate's DN. Useful OIDs are: # OU (organizational unit) = 2.5.4.11 #cert-group-oid = 2.5.4.11 @@ -256,7 +276,7 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # See the manual to generate an empty CRL initially. The CRL will be reloaded # periodically when ocserv detects a change in the file. To force a reload use # SIGHUP. -#crl = /path/to/crl.pem +#crl = /etc/ocserv/crl.pem # Uncomment this to enable compression negotiation (LZS, LZ4). #compression = true @@ -281,20 +301,13 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients) # in your system. -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" - -# More combinations in priority strings are available, check -# http://gnutls.org/manual/html_node/Priority-Strings.html -# E.g., the string below enforces perfect forward secrecy (PFS) -# on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" +# Note that in RHEL gnutls follows crypto policies so insecure options +# are disabled within it. +tls-priorities = "NORMAL:%SERVER_PRECEDENCE" # That option requires the established DTLS channel to use the same -# cipher as the primary TLS channel. This cannot be combined with -# listen-clear-file since the ciphersuite information is not available -# in that configuration. Note also, that this option implies that -# dtls-legacy option is false; this option cannot be enforced -# in the legacy/compat protocol. +# cipher as the primary TLS channel.Note also, that this option implies +# that the dtls-legacy option is false; this option cannot be enforced #match-tls-dtls-ciphers = true # The time (in seconds) that a client is allowed to stay connected prior @@ -306,7 +319,9 @@ auth-timeout = 240 #idle-timeout = 1200 # The time (in seconds) that a client is allowed to stay connected -# Unset to disable. +# Unset to disable. When set a client will be disconnected after being +# continuously connected for this amount of time, and its cookies will +# be invalidated (i.e., re-authentication will be required). #session-timeout = 86400 # The time (in seconds) that a mobile client is allowed to stay idle (no @@ -321,17 +336,15 @@ min-reauth-time = 300 # that get a score over that configured number are banned for # min-reauth-time seconds. By default a wrong password attempt is 10 points, # a KKDCP POST is 1 point, and a connection is 1 point. Note that -# due to difference processes being involved the count of points -# will not be real-time precise. -# -# Score banning cannot be reliably used when receiving proxied connections -# locally from an HTTP server (i.e., when listen-clear-file is used). +# due to different processes being involved the count of points +# will not be real-time precise. Local subnet IPs are exempt to allow +# services that check for process health. # # Set to zero to disable. -max-ban-score = 50 +max-ban-score = 80 # The time (in seconds) that all score kept for a client is reset. -ban-reset-time = 300 +ban-reset-time = 1200 # In case you'd like to change the default points. #ban-points-wrong-password = 10 @@ -340,11 +353,11 @@ ban-reset-time = 300 # Cookie timeout (in seconds) # Once a client is authenticated he's provided a cookie with -# which he can reconnect. That cookie will be invalided if not -# used within this timeout value. On a user disconnection, that -# cookie will also be active for this time amount prior to be -# invalid. That should allow a reasonable amount of time for roaming -# between different networks. +# which he can reconnect. That cookie will be invalidated if not +# used within this timeout value. This cookie remains valid, during +# the user's connected time, and after user disconnection it +# remains active for this amount of time. That setting should allow a +# reasonable amount of time for roaming between different networks. cookie-timeout = 300 # If this is enabled (not recommended) the cookies will stay @@ -374,10 +387,10 @@ rekey-method = ssl # Script to call when a client connects and obtains an IP. # The following parameters are passed on the environment. -# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_REAL_LOCAL (the local -# interface IP the client connected), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), +# REASON, VHOST, USERNAME, GROUPNAME, DEVICE, IP_REAL (the real IP of the client), +# REMOTE_HOSTNAME (the remotely advertised hostname), IP_REAL_LOCAL +# (the local interface IP the client connected), IP_LOCAL +# (the local IP in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # IPV6_LOCAL (the IPv6 local address if there are both IPv4 and IPv6 # assigned), IPV6_REMOTE (the IPv6 remote address), IPV6_PREFIX, and # ID (a unique numeric ID); REASON may be "connect" or "disconnect". @@ -385,7 +398,8 @@ rekey-method = ssl # client), OCSERV_NO_ROUTES, OCSERV_DNS (the DNS servers for this client), # will contain a space separated list of routes or DNS servers. A version # of these variables with the 4 or 6 suffix will contain only the IPv4 or -# IPv6 values. +# IPv6 values. The connect script must return zero as exit code, or the +# client connection will be refused. # The disconnect script will receive the additional values: STATS_BYTES_IN, # STATS_BYTES_OUT, STATS_DURATION that contain a 64-bit counter of the bytes @@ -394,6 +408,12 @@ rekey-method = ssl #connect-script = /usr/bin/ocserv-script #disconnect-script = /usr/bin/ocserv-script +# This script is to be called when the client's advertised hostname becomes +# available. It will contain REASON with "host-update" value and the +# variable REMOTE_HOSTNAME in addition to the connect variables. + +#host-update-script = /usr/bin/myhostnamescript + # UTMP # Register the connected clients to utmp. This will allow viewing # the connected clients using the command 'who'. @@ -403,9 +423,23 @@ rekey-method = ssl # or via a unix socket). use-occtl = true -# PID file. It can be overriden in the command line. +# PID file. It can be overridden in the command line. pid-file = /var/run/ocserv.pid +# Log Level. Ocserv sends the logging messages to standard error +# as well as the system log. The log level can be overridden in the +# command line with the -d option. All messages at the configured +# level and lower will be displayed. +# Supported levels (default 0): +# 0 default (Same as basic) +# 1 basic +# 2 info +# 3 debug +# 4 http +# 8 sensitive +# 9 TLS +log-level = 1 + # Set the protocol-defined priority (SO_PRIORITY) for packets to # be sent. That is a number from 0 to 6 with 0 being the lowest # priority. Alternatively this can be used to set the IP Type- @@ -428,7 +462,8 @@ device = vpns # same for the same user when possible. predictable-ips = true -# The default domain to be advertised +# The default domain to be advertised. Multiple domains (functional on +# openconnect clients) can be provided in a space separated list. default-domain = example.com # The pool of addresses that leases will be given from. If the leases @@ -436,6 +471,9 @@ default-domain = example.com # these network values should contain a network with at least a single # address that will remain under the full control of ocserv (that is # to be able to assign the local part of the tun device address). +# Note that, you could use addresses from a subnet of your LAN network if you +# enable [proxy arp in the LAN interface](http://ocserv.gitlab.io/www/recipes-ocserv-pseudo-bridge.html); +# in that case it is recommended to set ping-leases to true. #ipv4-network = 192.168.1.0 #ipv4-netmask = 255.255.255.0 @@ -443,7 +481,7 @@ default-domain = example.com #ipv4-network = 192.168.1.0/24 # The IPv6 subnet that leases will be given from. -#ipv6-network = fda9:4efe:7e3b:03ea::/64 +#ipv6-network = fda9:4efe:7e3b:03ea::/48 # Specify the size of the network to provide to clients. It is # generally recommended to provide clients with a /64 network in @@ -474,8 +512,10 @@ default-domain = example.com # IP range for leases. ping-leases = false -# Use this option to enforce an MTU value to the incoming +# Use this option to set a link MTU value to the incoming # connections. Unset to use the default MTU of the TUN device. +# Note that the MTU is negotiated using the value set and the +# value sent by the peer. #mtu = 1420 # Unset to enable bandwidth restrictions (in bytes/sec). The @@ -499,11 +539,15 @@ ping-leases = false #route = 10.10.10.0/255.255.255.0 #route = 192.168.0.0/255.255.0.0 #route = fef4:db8:1000:1001::/64 +#route = default # Subsets of the routes above that will not be routed by # the server. -#no-route = 192.168.5.0/255.255.255.0 +no-route = 192.168.5.0/255.255.255.0 + +# Note the that following two firewalling options currently are available +# in Linux systems with iptables software. # If set, the script /usr/bin/ocserv-fw will be called to restrict # the user to its allowed routes and prevent him from accessing @@ -512,6 +556,15 @@ ping-leases = false # --removeall. This option can be set globally or in the per-user configuration. #restrict-user-to-routes = true +# This option implies restrict-user-to-routes set to true. If set, the +# script /usr/bin/ocserv-fw will be called to restrict the user to +# access specific ports in the network. This option can be set globally +# or in the per-user configuration. +#restrict-user-to-ports = "tcp(443), tcp(80), udp(443), sctp(99), tcp(583), icmp(), icmpv6()" + +# You could also use negation, i.e., block the user from accessing these ports only. +#restrict-user-to-ports = "!(tcp(443), tcp(80))" + # When set to true, all client's iroutes are made visible to all # connecting clients except for the ones offering them. This option # only makes sense if config-per-user is set. @@ -537,15 +590,20 @@ ping-leases = false # per group. Each file name on these directories must match the username # or the groupname. # The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, no-route, -# explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, -# user-profile, cgroup, stats-report-time, and session-timeout. +# ipv?-network, ipv4-netmask, rx/tx-data-per-sec, iroute, route, no-route, +# explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, +# keepalive, dpd, mobile-dpd, max-same-clients, tunnel-all-dns, +# restrict-user-to-routes, cgroup, stats-report-time, +# mtu, idle-timeout, mobile-idle-timeout, restrict-user-to-ports, +# split-dns and session-timeout. # -# Note that the 'iroute' option allows to add routes on the server +# Note that the 'iroute' option allows one to add routes on the server # based on a user or group. The syntax depends on the input accepted # by the commands route-add-cmd and route-del-cmd (see below). The no-udp # is a boolean option (e.g., no-udp = true), and will prevent a UDP session -# for that specific user or group. +# for that specific user or group. The hostname option will set a +# hostname to override any proposed by the user. Note also, that, any +# routes, no-routes, DNS or NBNS servers present will overwrite the global ones. #config-per-user = /etc/ocserv/config-per-user/ #config-per-group = /etc/ocserv/config-per-group/ @@ -556,15 +614,15 @@ ping-leases = false #default-group-config = /etc/ocserv/defaults/group.conf # The system command to use to setup a route. %{R} will be replaced with the -# route/mask and %{D} with the (tun) device. +# route/mask, %{RI} with the route in CIDR format, and %{D} with the (tun) device. # -# The following example is from linux systems. %R should be something -# like 192.168.2.0/24 (the argument of iroute). +# The following example is from linux systems. %{R} should be something +# like 192.168.2.0/255.255.255.0 and %{RI} 192.168.2.0/24 (the argument of iroute). #route-add-cmd = "ip route add %{R} dev %{D}" #route-del-cmd = "ip route delete %{R} dev %{D}" -# This option allows to forward a proxy. The special keywords '%{U}' +# This option allows one to forward a proxy. The special keywords '%{U}' # and '%{G}', if present will be replaced by the username and group name. #proxy-url = http://example.com/ #proxy-url = http://example.com/%{U}/ @@ -574,14 +632,39 @@ ping-leases = false # KDC server. That is a translation URL between HTTP and Kerberos. # In MIT kerberos you'll need to add in realms: # EXAMPLE.COM = { -# kdc = https://ocserv.example.com/kerberos +# kdc = https://ocserv.example.com/KdcProxy # http_anchors = FILE:/etc/ocserv-ca.pem # } -# This option is available if ocserv is compiled with GSSAPI support. +# In some distributions the krb5-k5tls plugin of kinit is required. +# +# The following option is available in ocserv, when compiled with GSSAPI support. -#kkdcp = SERVER-PATH KERBEROS-REALM PROTOCOL@SERVER:PORT -#kkdcp = /kerberos EXAMPLE.COM udp@127.0.0.1:88 -#kkdcp = /kerberos-tcp EXAMPLE.COM tcp@127.0.0.1:88 +#kkdcp = "SERVER-PATH KERBEROS-REALM PROTOCOL@SERVER:PORT" +#kkdcp = "/KdcProxy KERBEROS.REALM udp@127.0.0.1:88" +#kkdcp = "/KdcProxy KERBEROS.REALM tcp@127.0.0.1:88" +#kkdcp = "/KdcProxy KERBEROS.REALM tcp@[::1]:88" + +# Client profile xml. This can be used to advertise alternative servers +# to the client. A minimal file can be: +# +# +# +# +# VPN Server name +# localhost +# +# +# +# +# Other fields may be used by some of the CISCO clients. +# This file must be accessible from inside the worker's chroot. +# Note that: +# (1) enabling this option is not recommended as it will allow the +# worker processes to open arbitrary files (when isolate-workers is +# set to true). +# (2) This option cannot be set per-user or per-group; only the global +# version is being sent to client. +#user-profile = profile.xml # # The following options are for (experimental) AnyConnect client @@ -593,23 +676,47 @@ ping-leases = false # and openconnect clients < 7.08. When set to true, it implies dtls-legacy = true. cisco-client-compat = true -# This option allows to disable the DTLS-PSK negotiation (enabled by default). +# This option allows one to disable the DTLS-PSK negotiation (enabled by default). # The DTLS-PSK negotiation was introduced in ocserv 0.11.5 to deprecate # the pre-draft-DTLS negotiation inherited from AnyConnect. It allows the # DTLS channel to negotiate its ciphers and the DTLS protocol version. #dtls-psk = false -# This option allows to disable the legacy DTLS negotiation (enabled by default, +# This option allows one to disable the legacy DTLS negotiation (enabled by default, # but that may change in the future). # The legacy DTLS uses a pre-draft version of the DTLS protocol and was # from AnyConnect protocol. It has several limitations, that are addressed # by the dtls-psk protocol supported by openconnect 7.08+. dtls-legacy = true -# Client profile xml. A sample file exists in doc/profile.xml. -# It is required by some of the CISCO clients. -# This file must be accessible from inside the worker's chroot. -user-profile = profile.xml +# This option will enable the settings needed for Cisco SVC IPPhone clients +# to connect. It implies dtls-legacy = true and tls-priorities is changed to +# only the ciphers the device supports. +cisco-svc-client-compat = false + +# This option will enable the X-CSTP-Client-Bypass-Protocol (disabled by default). +# If the server has not configured an IPv6 or IPv4 address pool, enabling this option +# will instruct the client to bypass the server for that IP protocol. The option is +# currently only understood by Anyconnect clients. +client-bypass-protocol = false + +# The following options are related to server camouflage (hidden service) + +# This option allows you to enable the camouflage feature of ocserv that makes it look +# like a web server to unauthorized parties. +# With "camouflage" enabled, connection to the VPN can be established only if the client provided a specific +# "secret string" in the connection URL, e.g. "https://example.com/?mysecretkey", +# otherwise the server will return HTTP error for all requests. +camouflage = false + +# The URL prefix that should be set on the client (after '?' sign) to pass through the camouflage check, +# e.g. in case of 'mysecretkey', the server URL on the client should be like "https://example.com/?mysecretkey". +camouflage_secret = "mysecretkey" + +# Defines the realm (browser prompt) for HTTP authentication. +# If no realm is set, the server will return 404 Not found error instead of 401 Unauthorized. +# Better change it from the default value to avoid fingerprinting. +camouflage_realm = "Restricted Content" #Advanced options @@ -621,3 +728,38 @@ user-profile = profile.xml # and '%{G}', if present will be replaced by the username and group name. #custom-header = "X-My-Header: hi there" + + +# An example virtual host with different authentication methods serviced +# by this server. + +#[vhost:www.example.com] +#auth = "certificate" + +#ca-cert = /etc/ocserv/ca.pem + +# The certificate set here must include a 'dns_name' corresponding to +# the virtual host name. + +#server-cert = /etc/pki/ocserv/public/server.crt +#server-key = /etc/pki/ocserv/private/server.key + +#ipv4-network = 192.168.2.0 +#ipv4-netmask = 255.255.255.0 + +#cert-user-oid = 0.9.2342.19200300.100.1.1 + +# HTTP headers +included-http-headers = Strict-Transport-Security: max-age=31536000 ; includeSubDomains +included-http-headers = X-Frame-Options: deny +included-http-headers = X-Content-Type-Options: nosniff +included-http-headers = Content-Security-Policy: default-src 'none' +included-http-headers = X-Permitted-Cross-Domain-Policies: none +included-http-headers = Referrer-Policy: no-referrer +included-http-headers = Clear-Site-Data: "cache","cookies","storage" +included-http-headers = Cross-Origin-Embedder-Policy: require-corp +included-http-headers = Cross-Origin-Opener-Policy: same-origin +included-http-headers = Cross-Origin-Resource-Policy: same-origin +included-http-headers = X-XSS-Protection: 0 +included-http-headers = Pragma: no-cache +included-http-headers = Cache-control: no-store, no-cache diff --git a/ocserv.spec b/ocserv.spec index 65b1166..ed13677 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.1 -Release: 1%{?dist} +Version: 1.2.0 +Release: 1 %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -18,12 +18,6 @@ Release: 1%{?dist} %define use_geoip 1 %endif -%if 0%{?rhel} && 0%{?rhel} == 8 -%define use_http_parser 0 -%else -%define use_http_parser 1 -%endif - %define use_local_protobuf 0 Name: ocserv @@ -48,6 +42,7 @@ Source11: ocserv.init # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 +BuildRequires: make BuildRequires: gcc %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel @@ -67,12 +62,9 @@ BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel BuildRequires: gperf -BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: libev-devel -%if %{use_http_parser} BuildRequires: http-parser-devel -%endif %if %{use_libwrap} BuildRequires: tcp_wrappers-devel @@ -109,7 +101,7 @@ BuildRequires: libseccomp-devel # no rubygem in epel7 %if 0%{?fedora} -BuildRequires: rubygem(ronn) +BuildRequires: rubygem(ronn) %endif Requires: gnutls-utils @@ -144,20 +136,14 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %autosetup -p1 -%if %{use_http_parser} rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h -%endif %if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ touch src/*.proto %endif rm -rf src/ccan/talloc -rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config -# GPLv3 in headers is a gnulib bug: -# http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html -sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c @@ -175,6 +161,7 @@ autoreconf -fvi %endif %configure \ + --without-pcl-lib \ %if %{use_systemd} --enable-systemd \ %else @@ -183,16 +170,13 @@ autoreconf -fvi %if %{use_local_protobuf} --without-protobuf \ %endif -%if ! %{use_http_parser} - --without-http-parser \ -%endif %if %{use_libwrap} --with-libwrap %else --without-libwrap %endif -make #%{?_smp_mflags} +make %{?_smp_mflags} %pre getent group ocserv &>/dev/null || groupadd -r ocserv @@ -204,7 +188,8 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} VERBOSE=1 +# The 1.2.0 release has a missing file +make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" %if %{use_systemd} %post @@ -259,7 +244,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/ocserv %config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml -%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING README.md PACKAGE-LICENSING doc/README-radius.md %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* @@ -281,6 +266,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jul 11 2023 Nikos Mavrogiannopoulos - 1.2.0-1 +- Updated to 1.2.0 + * Mon Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 - Update to upstream 1.1.1 release diff --git a/sources b/sources index b716d8a..bd969b3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.1.tar.xz) = 1173416f0d32f9faf98e539c8e73316a50ac93b519d1ade19374a3df865d10d975e13ac53e0c5a5e77c80f3605d7a810287b18b85b798887d227389761b54220 -SHA512 (ocserv-1.1.1.tar.xz.sig) = 9fe0f3e2ea4daaf1d053c2cdc87d38dc8256feb11c16f93e7e677500457914a82e659901f77f6ec4ca175fceeec74e3f8d001412c969c18dcf486545bac83393 +SHA512 (ocserv-1.2.0.tar.xz) = 23edd48313cb4988cea1e2493ab65784c7a39a062798e1ffd380b6de5629e69bd71ded863eb7a0c9fe1bac3cc2db23014cdedbd5d15801e2a66d5ef4e3f28ffb +SHA512 (ocserv-1.2.0.tar.xz.sig) = 1d8ac24c97c6495adc070f7b24553715ff27e6a9937a020522904559f4c48f3e18ca712b80762d55c285ce8f99eb4cd9a84b2875a351eb1df1ef6c705c5d3199 From a8deb523a2f7b8d0ee119d6099ca7cc5876b8f21 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 11 Jul 2023 19:06:58 +0200 Subject: [PATCH 85/87] ocserv.spec: corrected release version --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ed13677..96036be 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.2.0 -Release: 1 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 From 8300c8313da02d410cfff62c17d34da800b1f4c5 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Aug 2023 19:16:12 +0200 Subject: [PATCH 86/87] Restart service on upgrade --- ocserv.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 96036be..f0f0d31 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.2.0 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -199,7 +199,7 @@ make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" %systemd_preun ocserv.service %postun -%systemd_postun ocserv.service +%systemd_postun_with_restart ocserv.service %endif %install @@ -266,6 +266,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Aug 15 2023 Nikos Mavrogiannopoulos - 1.2.0-2 +- Restart service on upgrade + * Tue Jul 11 2023 Nikos Mavrogiannopoulos - 1.2.0-1 - Updated to 1.2.0 From 41642ebcc58b380f7fc3808ded05383cd1b6c341 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 21 Sep 2023 22:01:45 +0200 Subject: [PATCH 87/87] updated to 1.2.2 --- ocserv.spec | 9 ++++++--- sources | 4 ++-- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index f0f0d31..eba61cc 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.2.0 -Release: 2%{?dist} +Version: 1.2.2 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -189,7 +189,7 @@ mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check # The 1.2.0 release has a missing file -make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" +make check %{?_smp_mflags} VERBOSE=1 %if %{use_systemd} %post @@ -266,6 +266,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Sep 21 2023 Nikos Mavrogiannopoulos - 1.2.2-1 +- Updated to 1.2.2 + * Tue Aug 15 2023 Nikos Mavrogiannopoulos - 1.2.0-2 - Restart service on upgrade diff --git a/sources b/sources index bd969b3..58e8472 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.0.tar.xz) = 23edd48313cb4988cea1e2493ab65784c7a39a062798e1ffd380b6de5629e69bd71ded863eb7a0c9fe1bac3cc2db23014cdedbd5d15801e2a66d5ef4e3f28ffb -SHA512 (ocserv-1.2.0.tar.xz.sig) = 1d8ac24c97c6495adc070f7b24553715ff27e6a9937a020522904559f4c48f3e18ca712b80762d55c285ce8f99eb4cd9a84b2875a351eb1df1ef6c705c5d3199 +SHA512 (ocserv-1.2.2.tar.xz) = f1a55d2d849aadadcae6ea792845531d4fe71a3d7defad353a961828ddea74faa85a7d6b8de64a5fce115b14ea00f87755f01833cf31550532b1c52a02bd1fb0 +SHA512 (ocserv-1.2.2.tar.xz.sig) = e3a159d76b5651c99487546681657cdb008d50d86647bf2df1034dc6936720d0db9566490958a9d79ad4a68b122b1d19021e0c849d72a0ab3277d777b9e1ddb7