diff --git a/.gitignore b/.gitignore index a9e3272..c97bec0 100644 --- a/.gitignore +++ b/.gitignore @@ -237,9 +237,17 @@ /ocserv-1.1.4.tar.xz.sig /ocserv-1.1.6.tar.xz.sig /ocserv-1.1.6.tar.xz +/ocserv-1.1.7.tar.xz +/ocserv-1.1.7.tar.xz.sig +/ocserv-1.2.0.tar.xz +/ocserv-1.2.0.tar.xz.sig /ocserv-1.2.1.tar.xz /ocserv-1.2.1.tar.xz.sig /ocserv-1.2.2.tar.xz /ocserv-1.2.2.tar.xz.sig /ocserv-1.2.4.tar.xz /ocserv-1.2.4.tar.xz.sig +/ocserv-1.3.0.tar.xz +/ocserv-1.3.0.tar.xz.sig +/ocserv-1.4.0.tar.xz +/ocserv-1.4.0.tar.xz.sig diff --git a/README.packit b/README.packit index bba9424..9bb65f0 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.89.0.post1.dev4+gabf90471. +The file was generated using packit 1.13.0.post1.dev2+g84134016c. diff --git a/ocserv-1.2.0.tar.xz b/ocserv-1.2.0.tar.xz deleted file mode 100644 index 6843ae9..0000000 Binary files a/ocserv-1.2.0.tar.xz and /dev/null differ diff --git a/ocserv-1.2.0.tar.xz.sig b/ocserv-1.2.0.tar.xz.sig deleted file mode 100644 index df75764..0000000 Binary files a/ocserv-1.2.0.tar.xz.sig and /dev/null differ diff --git a/ocserv-genkey b/ocserv-genkey index 924aab9..8cfc320 100755 --- a/ocserv-genkey +++ b/ocserv-genkey @@ -1,9 +1,25 @@ #!/bin/sh +#default key type:rsa +KEY_TYPE="rsa" + +#check key type 'rsa', 'rsa-pss', 'dsa', 'ecdsa', 'ed25519, 'ed448', 'x25519', and 'x448' +if [ $# -gt 0 ]; then + case "$1" in + rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448) + KEY_TYPE="$1" + ;; + *) + echo "Usage: $0 [rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448]" + echo "Default key type: rsa" + exit 1 + ;; + esac +fi #generate CA certificate/key if test ! -f /etc/pki/ocserv/private/ca.key;then mkdir -p /etc/pki/ocserv/private -certtool --generate-privkey --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1 +certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1 echo "cn=`hostname -f` CA" >/etc/pki/ocserv/ca.tmpl echo "expiration_days=-1" >>/etc/pki/ocserv/ca.tmpl echo "serial=1" >>/etc/pki/ocserv/ca.tmpl @@ -17,7 +33,7 @@ fi #generate server certificate/key if test ! -f /etc/pki/ocserv/private/server.key;then -certtool --generate-privkey --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1 +certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1 echo "cn=`hostname -f`" >/etc/pki/ocserv/server.tmpl echo "serial=2" >>/etc/pki/ocserv/server.tmpl echo "expiration_days=-1" >>/etc/pki/ocserv/server.tmpl diff --git a/ocserv.conf b/ocserv.conf index 694b830..0e63981 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -301,7 +301,7 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients) # in your system. -# Note that in RHEL gnutls follows crypto policies so insecure options +# Note that in Fedora gnutls follows crypto policies so insecure options # are disabled within it. tls-priorities = "NORMAL:%SERVER_PRECEDENCE" @@ -438,7 +438,7 @@ pid-file = /var/run/ocserv.pid # 4 http # 8 sensitive # 9 TLS -log-level = 1 +log-level = 3 # Set the protocol-defined priority (SO_PRIORITY) for packets to # be sent. That is a number from 0 to 6 with 0 being the lowest diff --git a/ocserv.spec b/ocserv.spec index 1321b76..55f1520 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.4 +Version: 1.4.0 Release: %autorelease %global _hardened_build 1 @@ -25,8 +25,8 @@ Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. -License: GPLv2+ and BSD and MIT and CC0 -URL: http://www.infradead.org/ocserv/ +License: GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0 +URL: https://ocserv.openconnect-vpn.net/ Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg @@ -43,6 +43,7 @@ Source11: ocserv.init # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 BuildRequires: make +BuildRequires: libxcrypt-devel BuildRequires: gcc %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel @@ -56,7 +57,7 @@ BuildRequires: protobuf-c-devel %endif BuildRequires: libnl3-devel, krb5-devel, libtasn1-devel, gperf, libtalloc-devel -BuildRequires: libev-devel, http-parser-devel, radcli-devel, lz4-devel, readline-devel +BuildRequires: libev-devel, llhttp-devel, radcli-devel, lz4-devel, readline-devel BuildRequires: automake, autoconf %if %{use_libwrap} @@ -100,7 +101,6 @@ BuildRequires: rubygem-ronn-ng Recommends: gnutls-utils Recommends: iproute Recommends: pam -Requires(pre): shadow-utils %if %{use_systemd} Requires(post): systemd Requires(preun): systemd @@ -129,7 +129,6 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %autosetup -p1 -rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ touch src/*.proto @@ -142,6 +141,11 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config echo "int main() { return 77; }" > tests/valid-hostname.c %endif +# Create a sysusers.d config file +cat >ocserv.sysusers.conf </dev/null || groupadd -r ocserv -getent passwd ocserv &>/dev/null || \ - /usr/sbin/useradd -r -g ocserv -s /sbin/nologin -c ocserv \ - -d %{_localstatedir}/lib/ocserv ocserv mkdir -p %{_sysconfdir}/pki/ocserv/public mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts @@ -191,7 +191,7 @@ make check %{?_smp_mflags} VERBOSE=1 %systemd_preun ocserv.service %postun -%systemd_postun ocserv.service +%systemd_postun_with_restart ocserv.service %endif %install @@ -226,6 +226,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %make_install +install -m0644 -D ocserv.sysusers.conf %{buildroot}%{_sysusersdir}/ocserv.conf + %files %defattr(-,root,root,-) @@ -256,6 +258,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %else %{_initrddir}/%{name} %endif +%{_sysusersdir}/ocserv.conf %changelog %autochangelog diff --git a/sources b/sources index b51fe99..bc50de1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.4.tar.xz) = 202c7045bea1b7a10bd711d9b1b23f5437da9ff71fde0577137c8059ea68956c8cc294f3d23f041bda7b0fb0ae292577a99101554a12206177f5a1f5ca16ea3b -SHA512 (ocserv-1.2.4.tar.xz.sig) = b2c287e0398eb55571a04e0b0ae16f2b5636c136f467b41872c9bdfd8bd8b25aa541022a6c8b337b0d160f4f673076d03358c7c0259ec4554d604cf31e7f36d3 +SHA512 (ocserv-1.4.0.tar.xz) = cef771c6ee43925d743b7a21fed1cd7d54c10e39c0966fbc7062df9b7691c9a3a73c1c4589382592668f81809edea0fe0b947c7ddf86a6cdc1a144cf059526b0 +SHA512 (ocserv-1.4.0.tar.xz.sig) = a73ce14e8e355f747e40241056c2bb734d6dae4e1d6aed0f24aaa6d1a469f6d86a077af4a38e6376846fd5520ee33c7be8ce7b3830bcb0faa5e32b12ed7483cd