From 672dedfae29115ad48816ce7be1eda52546ab183 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Dec 2013 14:24:37 +0100 Subject: [PATCH 001/195] Initial import (#1027770) --- .gitignore | 1 + PACKAGE-LICENSING | 148 +++++++++++++++++++++++++++ ocserv-http-parser.patch | 139 +++++++++++++++++++++++++ ocserv-pamd.conf | 5 + ocserv-tests.patch | 91 +++++++++++++++++ ocserv.conf | 215 +++++++++++++++++++++++++++++++++++++++ ocserv.service | 14 +++ ocserv.spec | 144 ++++++++++++++++++++++++++ sources | 1 + 9 files changed, 758 insertions(+) create mode 100644 PACKAGE-LICENSING create mode 100644 ocserv-http-parser.patch create mode 100644 ocserv-pamd.conf create mode 100644 ocserv-tests.patch create mode 100644 ocserv.conf create mode 100644 ocserv.service create mode 100644 ocserv.spec diff --git a/.gitignore b/.gitignore index e69de29..3b179d1 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1 @@ +/ocserv-0.2.1.tar.xz diff --git a/PACKAGE-LICENSING b/PACKAGE-LICENSING new file mode 100644 index 0000000..8215872 --- /dev/null +++ b/PACKAGE-LICENSING @@ -0,0 +1,148 @@ +Note that ocserv contains components under different (but compatible) licenses. +A breakdown of those is given below. + +GPL (v2 or later) +----------------- +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/common.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/config.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/cookies.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/html.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ip-lease.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/log.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/main-auth.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/main-config.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/main-misc.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/main-resume.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/main-user.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/main.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ocpasswd.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/pam.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/plain.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/route-add.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/sec-mod.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/setproctitle.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/system.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/tlslib.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/tun.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-auth.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-bandwidth.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-extras.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-misc.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-privs.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-resume.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-tun.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-vpn.c + +# Note that these files were marked as GPLv3 or later by the gnulib-tool, +# but this is a bug: http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html +GPL (v2 or later) +----------------- +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/build-aux/snippet/arg-nonnull.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/build-aux/snippet/c++defs.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/build-aux/snippet/warn-on-use.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/build-aux/snippet/_Noreturn.h + + +BSD (3 clause) and GPL (v2 or later) +-------------------------------- +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/icmp-ping.c + + +LGPL (v2.1 or later) +-------------------- +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/memchr.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/c-ctype.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/c-ctype.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/c-strcase.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/c-strcasecmp.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/c-strncasecmp.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/cloexec.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/cloexec.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/close.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/dup2.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/errno.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/fcntl.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/fcntl.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/fd-hook.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/fd-hook.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/fseek.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/fseeko.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/fstat.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/getdelim.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/getdtablesize.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/getline.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/getpass.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/getpass.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/lseek.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/malloc.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/memmem.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/minmax.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/msvc-inval.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/msvc-inval.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/msvc-nothrow.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/msvc-nothrow.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/realloc.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/stdbool.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/stddef.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/stdint.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/stdio-impl.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/stdio.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/stdlib.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/str-two-way.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/strdup.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/string.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/sys_stat.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/sys_types.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/time.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/unistd.in.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/common.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/cookies.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/gettime.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/html.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/icmp-ping.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ip-lease.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ipc.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/main-auth.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/main.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/pam.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/plain.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/route-add.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/script-list.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/sec-mod.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/setproctitle.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/str.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/str.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/system.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/tlslib.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/tun.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/vpn.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker-bandwidth.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/worker.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/htable/htable.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/htable/htable.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/htable/htable_type.h + + +CC0 (public domain) +-------------------- +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/build_assert/build_assert.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/container_of/container_of.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/check_type/check_type.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/hash/hash.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/hash/hash.h + + +MIT +-------------------- +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/list/list.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ccan/list/list.h + + +Auto-generated files +-------------------- +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/gl/unistd.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ocpasswd-args.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ocpasswd-args.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ocserv-args.c +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/ocserv-args.h +/var/lib/mock/fedora-rawhide-i386/root/builddir/build/BUILD/ocserv-0.2.1/src/version.inc diff --git a/ocserv-http-parser.patch b/ocserv-http-parser.patch new file mode 100644 index 0000000..ba40b75 --- /dev/null +++ b/ocserv-http-parser.patch @@ -0,0 +1,139 @@ +diff -ur ocserv-0.2.1.orig/configure.ac ocserv-0.2.1/configure.ac +--- ocserv-0.2.1.orig/configure.ac 2013-11-06 20:47:34.000000000 +0100 ++++ ocserv-0.2.1/configure.ac 2013-11-11 13:48:45.536372275 +0100 +@@ -94,6 +94,27 @@ + AC_DEFINE([ANYCONNECT_CLIENT_COMPAT], [], [Enable Anyconnect compatibility]) + fi + ++dnl Test for http_parser library ++with_local_http_parser=yes ++LIBS="$oldlibs -lhttp_parser" ++AC_MSG_CHECKING([for http_parser library]) ++AC_LINK_IFELSE([AC_LANG_PROGRAM([ ++ #include ],[ ++ http_parser_init(0, 0);])], ++ [AC_MSG_RESULT(yes) ++ AC_SUBST([HTTP_PARSER_LIBS], [-lhttp_parser]) ++ AC_SUBST([HTTP_PARSER_CFLAGS], []) ++ with_local_http_parser=no], ++ [AC_MSG_RESULT(no) ++ AC_MSG_WARN([[ ++*** ++*** libhttp-parser not found. ++*** An included version of the library will be used. ++*** ]])]) ++LIBS="$oldlibs" ++AM_CONDITIONAL(LOCAL_HTTP_PARSER, test "x$with_local_http_parser" != xno) ++ ++ + dnl needed in the included PCL + AC_C_VOLATILE + AC_C_CONST +diff -ur ocserv-0.2.1.orig/src/Makefile.am ocserv-0.2.1/src/Makefile.am +--- ocserv-0.2.1.orig/src/Makefile.am 2013-11-05 19:59:45.000000000 +0100 ++++ ocserv-0.2.1/src/Makefile.am 2013-11-11 13:48:45.536372275 +0100 +@@ -3,10 +3,18 @@ + AM_CPPFLAGS = -I$(srcdir)/../gl/ -I$(builddir)/../gl/ \ + -I$(srcdir)/ -I$(builddir)/../ $(LIBOPTS_CFLAGS) + ++if LOCAL_HTTP_PARSER ++AM_CPPFLAGS += -I$(srcdir)/http-parser/ ++HTTP_PARSER_SOURCES = http-parser/http_parser.c http-parser/http_parser.h ++NEEDED_HTTP_PARSER_LIBS = ++else ++NEEDED_HTTP_PARSER_LIBS = $(HTTP_PARSER_LIBS) ++endif ++ + if NEED_LIBOPTS +-LIBOPTS = ../libopts/libopts.a ++NEEDED_LIBOPTS = ../libopts/libopts.a + else +-LIBOPTS = $(LIBOPTS_LDADD) ++NEEDED_LIBOPTS = $(LIBOPTS_LDADD) + endif + + EXTRA_DIST = ccan/licenses/BSD-MIT version.inc.in \ +@@ -24,21 +32,21 @@ + ocserv_SOURCES = ocserv-args.def ocserv-args.c ocserv-args.h + + ocserv_SOURCES += main.c main-auth.c worker-vpn.c worker-auth.c tlslib.c \ +- http-parser/http_parser.c ipc.h cookies.c worker-tun.c main-misc.c \ ++ ipc.h cookies.c worker-tun.c main-misc.c \ + main-config.c ip-lease.c ip-lease.h \ +- vpn.h cookies.h tlslib.h http-parser/http_parser.h log.c tun.c tun.h \ ++ vpn.h cookies.h tlslib.h log.c tun.c tun.h \ + config.c pam.c pam.h worker-resume.c worker.h main-resume.c main.h \ + worker-extras.c main-auth.h html.c html.h \ + main-user.c worker-misc.c setproctitle.h route-add.c route-add.h \ + setproctitle.c worker-privs.c plain.c plain.h common.h common.c \ + sec-mod.c sec-mod.h script-list.h system.c system.h icmp-ping.c icmp-ping.h \ + worker-bandwidth.c worker-bandwidth.h \ +- str.c str.h gettime.h $(CCAN_SOURCES) ++ str.c str.h gettime.h $(CCAN_SOURCES) $(HTTP_PARSER_SOURCES) + + +-ocserv_LDADD = ../gl/libgnu.a $(LIBOPTS) ++ocserv_LDADD = ../gl/libgnu.a $(NEEDED_LIBOPTS) + ocserv_LDADD += $(LIBGNUTLS_LIBS) $(PAM_LIBS) $(LIBUTIL) \ +- $(LIBSECCOMP) $(LIBWRAP) $(LIBCRYPT) ++ $(LIBSECCOMP) $(LIBWRAP) $(LIBCRYPT) $(NEEDED_HTTP_PARSER_LIBS) + + if PCL + ocserv_LDADD += $(PCL_LIBS) +@@ -54,7 +62,7 @@ + ocpasswd_SOURCES = ocpasswd-args.def ocpasswd-args.c ocpasswd-args.h \ + ocpasswd.c + +-ocpasswd_LDADD = ../gl/libgnu.a $(LIBOPTS) ++ocpasswd_LDADD = ../gl/libgnu.a $(NEEDED_LIBOPTS) + ocpasswd_LDADD += $(LIBGNUTLS_LIBS) $(LIBCRYPT) + + ocpasswd-args.c ocpasswd-args.h: $(srcdir)/ocpasswd-args.def +diff -ur ocserv-0.2.1.orig/src/vpn.h ocserv-0.2.1/src/vpn.h +--- ocserv-0.2.1.orig/src/vpn.h 2013-11-05 19:34:54.000000000 +0100 ++++ ocserv-0.2.1/src/vpn.h 2013-11-11 13:49:03.608470106 +0100 +@@ -23,7 +23,7 @@ + + #include + #include +-#include ++#include + #include + #include + #include +diff -ur ocserv-0.2.1.orig/src/worker-auth.c ocserv-0.2.1/src/worker-auth.c +--- ocserv-0.2.1.orig/src/worker-auth.c 2013-11-05 19:38:09.000000000 +0100 ++++ ocserv-0.2.1/src/worker-auth.c 2013-11-11 13:48:45.537372280 +0100 +@@ -41,7 +41,7 @@ + #include + #include + +-#include ++#include + + #define SUCCESS_MSG_HEAD "\n" \ + "\n" \ +diff -ur ocserv-0.2.1.orig/src/worker-tun.c ocserv-0.2.1/src/worker-tun.c +--- ocserv-0.2.1.orig/src/worker-tun.c 2013-11-05 19:38:22.000000000 +0100 ++++ ocserv-0.2.1/src/worker-tun.c 2013-11-11 13:48:45.537372280 +0100 +@@ -45,8 +45,6 @@ + #include + #include + +-#include +- + /* if local is non zero it returns the local, otherwise the remote */ + static + int get_ip(struct worker_st* ws, int fd, int family, unsigned int local, +diff -ur ocserv-0.2.1.orig/src/worker-vpn.c ocserv-0.2.1/src/worker-vpn.c +--- ocserv-0.2.1.orig/src/worker-vpn.c 2013-11-05 20:06:51.000000000 +0100 ++++ ocserv-0.2.1/src/worker-vpn.c 2013-11-11 13:48:45.537372280 +0100 +@@ -49,7 +49,7 @@ + #include + #include + +-#include ++#include + + /* after that time (secs) of inactivity in the UDP part, connection switches to + * TCP (if activity occurs there). diff --git a/ocserv-pamd.conf b/ocserv-pamd.conf new file mode 100644 index 0000000..968e252 --- /dev/null +++ b/ocserv-pamd.conf @@ -0,0 +1,5 @@ +#%PAM-1.0 +auth include password-auth +account required pam_nologin.so +account include password-auth +session include password-auth diff --git a/ocserv-tests.patch b/ocserv-tests.patch new file mode 100644 index 0000000..e700e81 --- /dev/null +++ b/ocserv-tests.patch @@ -0,0 +1,91 @@ +diff -ur ocserv-0.2.1.orig/tests/Makefile.in ocserv-0.2.1/tests/Makefile.in +--- ocserv-0.2.1.orig/tests/Makefile.in 2013-11-06 20:47:51.000000000 +0100 ++++ ocserv-0.2.1/tests/Makefile.in 2013-11-11 13:56:15.231784324 +0100 +@@ -1,4 +1,4 @@ +-# Makefile.in generated by automake 1.14 from Makefile.am. ++# Makefile.in generated by automake 1.13.4 from Makefile.am. + # @configure_input@ + + # Copyright (C) 1994-2013 Free Software Foundation, Inc. +@@ -721,6 +721,8 @@ + HAVE_WCHAR_T = @HAVE_WCHAR_T@ + HAVE__BOOL = @HAVE__BOOL@ + HAVE__EXIT = @HAVE__EXIT@ ++HTTP_PARSER_CFLAGS = @HTTP_PARSER_CFLAGS@ ++HTTP_PARSER_LIBS = @HTTP_PARSER_LIBS@ + INCLUDE_NEXT = @INCLUDE_NEXT@ + INCLUDE_NEXT_AS_FIRST_DIRECTIVE = @INCLUDE_NEXT_AS_FIRST_DIRECTIVE@ + INSTALL = @INSTALL@ +diff -ur ocserv-0.2.1.orig/tests/test1.config ocserv-0.2.1/tests/test1.config +--- ocserv-0.2.1.orig/tests/test1.config 2013-07-06 15:10:57.000000000 +0200 ++++ ocserv-0.2.1/tests/test1.config 2013-11-11 13:56:15.231784324 +0100 +@@ -132,7 +132,7 @@ + # The user the worker processes will be run as. It should be + # unique (no other services run as this user). + run-as-user = nobody +-run-as-group = nogroup ++run-as-group = nobody + + # Network settings + +diff -ur ocserv-0.2.1.orig/tests/test2.config ocserv-0.2.1/tests/test2.config +--- ocserv-0.2.1.orig/tests/test2.config 2013-07-06 16:54:44.000000000 +0200 ++++ ocserv-0.2.1/tests/test2.config 2013-11-11 13:56:15.231784324 +0100 +@@ -132,7 +132,7 @@ + # The user the worker processes will be run as. It should be + # unique (no other services run as this user). + run-as-user = nobody +-run-as-group = nogroup ++run-as-group = nobody + + # Network settings + +diff -ur ocserv-0.2.1.orig/tests/test3.config ocserv-0.2.1/tests/test3.config +--- ocserv-0.2.1.orig/tests/test3.config 2013-10-29 20:11:52.000000000 +0100 ++++ ocserv-0.2.1/tests/test3.config 2013-11-11 13:56:15.232784330 +0100 +@@ -132,7 +132,7 @@ + # The user the worker processes will be run as. It should be + # unique (no other services run as this user). + run-as-user = nobody +-run-as-group = nogroup ++run-as-group = nobody + + # Network settings + +diff -ur ocserv-0.2.1.orig/tests/test-iroute ocserv-0.2.1/tests/test-iroute +--- ocserv-0.2.1.orig/tests/test-iroute 2013-10-30 12:39:28.000000000 +0100 ++++ ocserv-0.2.1/tests/test-iroute 2013-11-11 13:56:32.933878367 +0100 +@@ -35,7 +35,7 @@ + + echo -n "Checking if routes have been applied... " + +-if [ ! -f test-iroute.tmp ];then ++if [ ! -f ./test-iroute.tmp ];then + fail $PID "Temporary file cannot be found" + fi + +Only in ocserv-0.2.1/tests: test-iroute~ +diff -ur ocserv-0.2.1.orig/tests/test-iroute.config ocserv-0.2.1/tests/test-iroute.config +--- ocserv-0.2.1.orig/tests/test-iroute.config 2013-10-30 12:31:33.000000000 +0100 ++++ ocserv-0.2.1/tests/test-iroute.config 2013-11-11 13:56:15.232784330 +0100 +@@ -132,7 +132,7 @@ + # The user the worker processes will be run as. It should be + # unique (no other services run as this user). + run-as-user = nobody +-run-as-group = nogroup ++run-as-group = nobody + + # Network settings + +diff -ur ocserv-0.2.1.orig/tests/test-pass-script.config ocserv-0.2.1/tests/test-pass-script.config +--- ocserv-0.2.1.orig/tests/test-pass-script.config 2013-10-31 17:20:37.000000000 +0100 ++++ ocserv-0.2.1/tests/test-pass-script.config 2013-11-11 13:56:15.232784330 +0100 +@@ -132,7 +132,7 @@ + # The user the worker processes will be run as. It should be + # unique (no other services run as this user). + run-as-user = nobody +-run-as-group = nogroup ++run-as-group = nobody + + # Network settings + diff --git a/ocserv.conf b/ocserv.conf new file mode 100644 index 0000000..baa7bca --- /dev/null +++ b/ocserv.conf @@ -0,0 +1,215 @@ +# User authentication method. Could be set multiple times and in that case +# all should succeed. +# Options: certificate, pam. +#auth = "certificate" +#auth = "plain[./sample.passwd]" +auth = "pam" + +# A banner to be displayed on clients +#banner = "Welcome" + +# Use listen-host to limit to specific IPs or to the IPs of a provided hostname. +#listen-host = [IP|HOSTNAME] + +# Limit the number of clients. Unset or set to zero for unlimited. +#max-clients = 1024 +max-clients = 16 + +# Limit the number of client connections to one every X milliseconds +# (X is the provided value). Set to zero for no limit. +#rate-limit-ms = 100 + +# Limit the number of identical clients (i.e., users connecting multiple times) +# Unset or set to zero for unlimited. +max-same-clients = 2 + +# TCP and UDP port number +tcp-port = 4443 +udp-port = 4443 + +# Keepalive in seconds +keepalive = 32400 + +# Dead peer detection in seconds +dpd = 60 + +# MTU discovery (DPD must be enabled) +try-mtu-discovery = false + +# The key and the certificates of the server +# The key may be a file, or any URL supported by GnuTLS (e.g., +# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user +# or pkcs11:object=my-vpn-key;object-type=private) +# +# There may be multiple certificate and key pairs and each key +# should correspond to the preceding certificate. +server-cert = /etc/ocserv/server.crt +server-key = /etc/ocserv/server.key + +# Diffie-Hellman parameters. Only needed if you require support +# for the DHE ciphersuites (by default this server supports ECDHE). +# Can be generated using: +# certtool --generate-dh-params --outfile /path/to/dh.pem +#dh-params = /path/to/dh.pem + +# If you have a certificate from a CA that provides an OCSP +# service you may provide a fresh OCSP status response within +# the TLS handshake. That will prevent the client from connecting +# independently on the OCSP server. +# You can update this response periodically using: +# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response +# Make sure that you replace the following file in an atomic way. +#ocsp-response = /path/to/ocsp.der + +# In case PKCS #11 or TPM keys are used the PINs should be available +# in files. The srk-pin-file is applicable to TPM keys only (It's the storage +# root key). +#pin-file = /path/to/pin.txt +#srk-pin-file = /path/to/srkpin.txt + +# The Certificate Authority that will be used +# to verify clients if certificate authentication +# is set. +#ca-cert = /etc/ocserv/ca.crt + +# The object identifier that will be used to read the user ID in the client certificate. +# The object identifier should be part of the certificate's DN +# Useful OIDs are: +# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 +#cert-user-oid = 0.9.2342.19200300.100.1.1 + +# The object identifier that will be used to read the user group in the client +# certificate. The object identifier should be part of the certificate's DN +# Useful OIDs are: +# OU (organizational unit) = 2.5.4.11 +#cert-group-oid = 2.5.4.11 + +# A revocation list of ca-cert is set +#crl = /path/to/crl.pem + +# GnuTLS priority string +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" + +# To enforce perfect forward secrecy (PFS) on the main channel. +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" + +# The time (in seconds) that a client is allowed to stay connected prior +# to authentication +auth-timeout = 40 + +# The time (in seconds) that a client is not allowed to reconnect after +# a failed authentication attempt. +min-reauth-time = 2 + +# Cookie validity time (in seconds) +# Once a client is authenticated he's provided a cookie with +# which he can reconnect. This option sets the maximum lifetime +# of that cookie. +cookie-validity = 172800 + +# Script to call when a client connects and obtains an IP +# Parameters are passed on the environment. +# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), +# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP +# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON +# may be "connect" or "disconnect". +#connect-script = /usr/bin/myscript +#disconnect-script = /usr/bin/myscript + +# UTMP +use-utmp = true + +# PID file +#pid-file = /var/run/ocserv.pid + +# The default server directory. Does not require any devices present. +chroot-dir = /var/ocserv/ + +# socket file used for IPC, will be appended with .PID +# It must be accessible within the chroot environment (if any) +socket-file = ocserv.sock + +# The user the worker processes will be run as. It should be +# unique (no other services run as this user). +run-as-user = ocserv +run-as-group = ocserv + +# Network settings + +device = vpns + +# The default domain to be advertised +#default-domain = example.com + +#ipv4-network = 192.168.1.0 +#ipv4-netmask = 255.255.255.0 +# Use the keywork local to advertize the local P-t-P address as DNS server +# ipv4-dns = 192.168.2.1 +#ipv4-dns = local + +# The NBNS server (if any) +#ipv4-nbns = 192.168.2.3 + +#ipv6-address = +#ipv6-dns = + +# The IPv6 subnet prefix +#ipv6-prefix = + +# Prior to leasing any IP from the pool ping it to verify that +# it is not in use by another (unrelated to this server) host. +ping-leases = false + +# Leave empty to assign the default MTU of the device +# mtu = + +# Unset to enable bandwidth restrictions (in bytes/sec). The +# setting here is global, but can also be set per user or per group. +#rx-data-per-sec = 40960 +#tx-data-per-sec = 40960 + +# The number of packets (of MTU size) that are available in +# the output buffer. The default is low to improve latency. +# Setting it higher will improve throughput. +output-buffer = 100 + +#route = 192.168.1.0/255.255.255.0 +#route = 192.168.5.0/255.255.255.0 + +# Configuration files that will be applied per user connection or +# per group. Each file name on these directories must match the username +# or the groupname. +# The options allowed in the configuration files are ipv?-dns, ipv?-nbns, +# ipv?-network, ipv?-netmask, ipv6-prefix, iroute and route. +# +# Note that the 'iroute' option allows to add routes on the server +# based on a user or group. The syntax depends on the input accepted +# by the commands route-add-cmd and route-del-cmd (see below). + +#config-per-user = /etc/ocserv/config-per-user/ +#config-per-group = /etc/ocserv/config-per-group/ + +# The system command to use to setup a route. %R will be replaced with the +# route/mask and %D with the (tun) device. +# +# The following example is from linux systems. %R should be something +# like 192.168.2.0/24 (so iroute in this system has different syntax than route) + +route-add-cmd = "ip route add %R dev %D" +route-del-cmd = "ip route delete %R dev %D" + +# +# The following options are for (experimental) AnyConnect client +# compatibility. + +# Client profile xml. A sample file exists in doc/profile.xml. +# This file must be accessible from inside the worker's chroot. +# The profile is ignored by the openconnect client. +#user-profile = profile.xml + +# Unless set to false it is required for clients to present their +# certificate even if they are authenticating via a previously granted +# cookie. Legacy CISCO clients do not do that, and thus this option +# should be set for them. +#always-require-cert = false + diff --git a/ocserv.service b/ocserv.service new file mode 100644 index 0000000..3b39466 --- /dev/null +++ b/ocserv.service @@ -0,0 +1,14 @@ +[Unit] +Description=OpenConnect SSL VPN server +Documentation=man:ocserv(8) +After=syslog.target network.target + +[Service] +PrivateTmp=true +Type=forking +PIDFile=/var/run/ocserv.pid +ExecStart=/usr/sbin/ocserv --pid-file /var/run/ocserv.pid --config /etc/ocserv/ocserv.conf +ExecReload=/bin/kill -HUP $MAINPID + +[Install] +WantedBy=multi-user.target diff --git a/ocserv.spec b/ocserv.spec new file mode 100644 index 0000000..1368da1 --- /dev/null +++ b/ocserv.spec @@ -0,0 +1,144 @@ +Name: ocserv +Version: 0.2.1 +Release: 6%{?dist} +Summary: OpenConnect SSL VPN server + +# For a breakdown of the licensing, see PACKAGE-LICENSING +# To simplify licenses LGPLv2+ files have been promoted to GPLv2+. +License: GPLv2+ and BSD and MIT and CC0 +URL: http://www.infradead.org/ocserv/ +Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz +Source1: ocserv.conf +Source2: ocserv.service +Source3: ocserv-pamd.conf +Source4: PACKAGE-LICENSING + +# Taken from upstream: +# http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 +Patch0: ocserv-http-parser.patch +Patch1: ocserv-tests.patch +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) + +BuildRequires: gnutls-devel +BuildRequires: pam-devel +BuildRequires: iproute +BuildRequires: systemd +BuildRequires: autogen-libopts-devel >= 5.18 +BuildRequires: autogen +BuildRequires: pcllib-devel, http-parser-devel, tcp_wrappers-devel +BuildRequires: automake, autoconf + +Requires: iproute +Requires: pam +Requires(pre): shadow-utils +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +#gnulib is bundled. See https://fedorahosted.org/fpc/ticket/174 +Provides: bundled(gnulib) +#CCAN is bundled. See https://fedorahosted.org/fpc/ticket/364 +Provides: bundled(bobjenkins-hash) bundled(ccan-container_of) +Provides: bundled(ccan-htable) bundled(ccan-list) +Provides: bundled(ccan-check_type) bundled(ccan-build_assert) + +%description +OpenConnect server (ocserv) is an SSL VPN server. Its purpose is to be +a secure, small, fast and configurable VPN server that uses standard +protocols such as TLS 1.2, and Datagram TLS. It implements the +OpenConnect SSL VPN protocol, which is compatible with the AnyConnect +SSL VPN protocol. + +%prep +%setup -q +%patch0 -p1 +%patch1 -p1 +rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h +rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h +rm -f src/pcl/*.c src/pcl/*.h +# GPLv3 in headers was a gnulib bug: +# http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html +sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* +# remove GPLv3 components +rm -f tests/test-* tests/common.sh + +%build +autoreconf -fi + +%configure + +# disable the smp_mflags until an issue with the dependencies in the +# autogen'erated files is fixed +make #%{?_smp_mflags} + +%pre +getent group ocserv &>/dev/null || groupadd -r ocserv +getent passwd ocserv &>/dev/null || \ + /usr/sbin/useradd -r -g ocserv -s /sbin/nologin -c ocserv \ + -d /var/lib/ocserv ocserv + +%post +%systemd_post ocserv.service + +%preun +%systemd_preun ocserv.service + +%postun +%systemd_postun ocserv.service + +%install +rm -rf %{buildroot} +cp -a %{SOURCE4} PACKAGE-LICENSING +mkdir -p %{buildroot}/%{_sysconfdir}/pam.d/ +mkdir -p %{buildroot}/%{_sysconfdir}/ocserv/ +install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/pam.d/ocserv +install -p -m 644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/ocserv/ +mkdir -p %{buildroot}/%{_unitdir} +install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} +mkdir -p %{buildroot}/var/lib/ocserv/ +%make_install + +%clean +rm -rf %{buildroot} + +%files +%defattr(-,root,root,-) + +%dir /var/lib/ocserv +%dir %{_sysconfdir}/ocserv + +%config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf +%config(noreplace) %{_sysconfdir}/pam.d/ocserv + +%doc AUTHORS ChangeLog NEWS COPYING LICENSE README TODO PACKAGE-LICENSING +%doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT +%{_mandir}/man8/ocserv.8* +%{_mandir}/man8/ocpasswd.8* +%{_bindir}/ocpasswd +%{_sbindir}/ocserv +%{_unitdir}/ocserv.service + +%changelog +* Fri Dec 6 2013 Nikos Mavrogiannopoulos - 0.2.1-6 +- Added exception for the bundling of CCAN components. + +* Wed Nov 13 2013 Nikos Mavrogiannopoulos - 0.2.1-5 +- Updated the way PACKAGE-LICENSING is handled. + +* Tue Nov 12 2013 Nikos Mavrogiannopoulos - 0.2.1-4 +- Replaced gnulib's GPLv3+ license with GPLv2+. According to + http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html + it was a gnulib bug. +- Reduced the number of applicable licenses by upgrading LGPLv2+ + components to GPLv2+. +- Added PACKAGE-LICENSING. + +* Mon Nov 11 2013 Nikos Mavrogiannopoulos - 0.2.1-3 +- Updated spec to add http-parser and pcllib as dependencies. +- Bundled library files are removed. +- Updated license information. + +* Fri Nov 8 2013 Nikos Mavrogiannopoulos - 0.2.1-2 +- Updated spec to account improvements suggested by Alec Leamas. + +* Thu Nov 7 2013 Nikos Mavrogiannopoulos - 0.2.1-1 +- Initial version of the package diff --git a/sources b/sources index e69de29..84447ec 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +99f239f796c9d29746e307e6a51999f0 ocserv-0.2.1.tar.xz From e0d05d7de926578ddc6fd214f548093133b5b131 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Dec 2013 14:35:59 +0100 Subject: [PATCH 002/195] compile with any version of libopts --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 1368da1..7f35e14 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -23,7 +23,7 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute BuildRequires: systemd -BuildRequires: autogen-libopts-devel >= 5.18 +BuildRequires: autogen-libopts-devel BuildRequires: autogen BuildRequires: pcllib-devel, http-parser-devel, tcp_wrappers-devel BuildRequires: automake, autoconf From 89a912e128817a73728aac47ff75946c56d8b68a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Dec 2013 15:19:39 +0100 Subject: [PATCH 003/195] corrected chroot directory --- ocserv.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.conf b/ocserv.conf index baa7bca..a8d983e 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -123,7 +123,7 @@ use-utmp = true #pid-file = /var/run/ocserv.pid # The default server directory. Does not require any devices present. -chroot-dir = /var/ocserv/ +chroot-dir = /var/lib/ocserv/ # socket file used for IPC, will be appended with .PID # It must be accessible within the chroot environment (if any) From 642f6cd3b101a1e4f69dc334cfb55a249ea13f60 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Dec 2013 15:21:42 +0100 Subject: [PATCH 004/195] use the correct config file --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 7f35e14..d2328ab 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -55,6 +55,7 @@ SSL VPN protocol. rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h +sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c # GPLv3 in headers was a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* From 8e96cd34fb39ff4b8e7378339d14d3cbbba1593e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 16 Dec 2013 10:32:18 +0100 Subject: [PATCH 005/195] updated to 0.2.3 --- .gitignore | 1 + ocserv-http-parser.patch | 139 --------------------------------------- ocserv-tests.patch | 91 ------------------------- ocserv.conf | 12 ++++ ocserv.spec | 27 ++++---- sources | 2 +- 6 files changed, 27 insertions(+), 245 deletions(-) delete mode 100644 ocserv-http-parser.patch delete mode 100644 ocserv-tests.patch diff --git a/.gitignore b/.gitignore index 3b179d1..3475ef7 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /ocserv-0.2.1.tar.xz +/ocserv-0.2.3.tar.xz diff --git a/ocserv-http-parser.patch b/ocserv-http-parser.patch deleted file mode 100644 index ba40b75..0000000 --- a/ocserv-http-parser.patch +++ /dev/null @@ -1,139 +0,0 @@ -diff -ur ocserv-0.2.1.orig/configure.ac ocserv-0.2.1/configure.ac ---- ocserv-0.2.1.orig/configure.ac 2013-11-06 20:47:34.000000000 +0100 -+++ ocserv-0.2.1/configure.ac 2013-11-11 13:48:45.536372275 +0100 -@@ -94,6 +94,27 @@ - AC_DEFINE([ANYCONNECT_CLIENT_COMPAT], [], [Enable Anyconnect compatibility]) - fi - -+dnl Test for http_parser library -+with_local_http_parser=yes -+LIBS="$oldlibs -lhttp_parser" -+AC_MSG_CHECKING([for http_parser library]) -+AC_LINK_IFELSE([AC_LANG_PROGRAM([ -+ #include ],[ -+ http_parser_init(0, 0);])], -+ [AC_MSG_RESULT(yes) -+ AC_SUBST([HTTP_PARSER_LIBS], [-lhttp_parser]) -+ AC_SUBST([HTTP_PARSER_CFLAGS], []) -+ with_local_http_parser=no], -+ [AC_MSG_RESULT(no) -+ AC_MSG_WARN([[ -+*** -+*** libhttp-parser not found. -+*** An included version of the library will be used. -+*** ]])]) -+LIBS="$oldlibs" -+AM_CONDITIONAL(LOCAL_HTTP_PARSER, test "x$with_local_http_parser" != xno) -+ -+ - dnl needed in the included PCL - AC_C_VOLATILE - AC_C_CONST -diff -ur ocserv-0.2.1.orig/src/Makefile.am ocserv-0.2.1/src/Makefile.am ---- ocserv-0.2.1.orig/src/Makefile.am 2013-11-05 19:59:45.000000000 +0100 -+++ ocserv-0.2.1/src/Makefile.am 2013-11-11 13:48:45.536372275 +0100 -@@ -3,10 +3,18 @@ - AM_CPPFLAGS = -I$(srcdir)/../gl/ -I$(builddir)/../gl/ \ - -I$(srcdir)/ -I$(builddir)/../ $(LIBOPTS_CFLAGS) - -+if LOCAL_HTTP_PARSER -+AM_CPPFLAGS += -I$(srcdir)/http-parser/ -+HTTP_PARSER_SOURCES = http-parser/http_parser.c http-parser/http_parser.h -+NEEDED_HTTP_PARSER_LIBS = -+else -+NEEDED_HTTP_PARSER_LIBS = $(HTTP_PARSER_LIBS) -+endif -+ - if NEED_LIBOPTS --LIBOPTS = ../libopts/libopts.a -+NEEDED_LIBOPTS = ../libopts/libopts.a - else --LIBOPTS = $(LIBOPTS_LDADD) -+NEEDED_LIBOPTS = $(LIBOPTS_LDADD) - endif - - EXTRA_DIST = ccan/licenses/BSD-MIT version.inc.in \ -@@ -24,21 +32,21 @@ - ocserv_SOURCES = ocserv-args.def ocserv-args.c ocserv-args.h - - ocserv_SOURCES += main.c main-auth.c worker-vpn.c worker-auth.c tlslib.c \ -- http-parser/http_parser.c ipc.h cookies.c worker-tun.c main-misc.c \ -+ ipc.h cookies.c worker-tun.c main-misc.c \ - main-config.c ip-lease.c ip-lease.h \ -- vpn.h cookies.h tlslib.h http-parser/http_parser.h log.c tun.c tun.h \ -+ vpn.h cookies.h tlslib.h log.c tun.c tun.h \ - config.c pam.c pam.h worker-resume.c worker.h main-resume.c main.h \ - worker-extras.c main-auth.h html.c html.h \ - main-user.c worker-misc.c setproctitle.h route-add.c route-add.h \ - setproctitle.c worker-privs.c plain.c plain.h common.h common.c \ - sec-mod.c sec-mod.h script-list.h system.c system.h icmp-ping.c icmp-ping.h \ - worker-bandwidth.c worker-bandwidth.h \ -- str.c str.h gettime.h $(CCAN_SOURCES) -+ str.c str.h gettime.h $(CCAN_SOURCES) $(HTTP_PARSER_SOURCES) - - --ocserv_LDADD = ../gl/libgnu.a $(LIBOPTS) -+ocserv_LDADD = ../gl/libgnu.a $(NEEDED_LIBOPTS) - ocserv_LDADD += $(LIBGNUTLS_LIBS) $(PAM_LIBS) $(LIBUTIL) \ -- $(LIBSECCOMP) $(LIBWRAP) $(LIBCRYPT) -+ $(LIBSECCOMP) $(LIBWRAP) $(LIBCRYPT) $(NEEDED_HTTP_PARSER_LIBS) - - if PCL - ocserv_LDADD += $(PCL_LIBS) -@@ -54,7 +62,7 @@ - ocpasswd_SOURCES = ocpasswd-args.def ocpasswd-args.c ocpasswd-args.h \ - ocpasswd.c - --ocpasswd_LDADD = ../gl/libgnu.a $(LIBOPTS) -+ocpasswd_LDADD = ../gl/libgnu.a $(NEEDED_LIBOPTS) - ocpasswd_LDADD += $(LIBGNUTLS_LIBS) $(LIBCRYPT) - - ocpasswd-args.c ocpasswd-args.h: $(srcdir)/ocpasswd-args.def -diff -ur ocserv-0.2.1.orig/src/vpn.h ocserv-0.2.1/src/vpn.h ---- ocserv-0.2.1.orig/src/vpn.h 2013-11-05 19:34:54.000000000 +0100 -+++ ocserv-0.2.1/src/vpn.h 2013-11-11 13:49:03.608470106 +0100 -@@ -23,7 +23,7 @@ - - #include - #include --#include -+#include - #include - #include - #include -diff -ur ocserv-0.2.1.orig/src/worker-auth.c ocserv-0.2.1/src/worker-auth.c ---- ocserv-0.2.1.orig/src/worker-auth.c 2013-11-05 19:38:09.000000000 +0100 -+++ ocserv-0.2.1/src/worker-auth.c 2013-11-11 13:48:45.537372280 +0100 -@@ -41,7 +41,7 @@ - #include - #include - --#include -+#include - - #define SUCCESS_MSG_HEAD "\n" \ - "\n" \ -diff -ur ocserv-0.2.1.orig/src/worker-tun.c ocserv-0.2.1/src/worker-tun.c ---- ocserv-0.2.1.orig/src/worker-tun.c 2013-11-05 19:38:22.000000000 +0100 -+++ ocserv-0.2.1/src/worker-tun.c 2013-11-11 13:48:45.537372280 +0100 -@@ -45,8 +45,6 @@ - #include - #include - --#include -- - /* if local is non zero it returns the local, otherwise the remote */ - static - int get_ip(struct worker_st* ws, int fd, int family, unsigned int local, -diff -ur ocserv-0.2.1.orig/src/worker-vpn.c ocserv-0.2.1/src/worker-vpn.c ---- ocserv-0.2.1.orig/src/worker-vpn.c 2013-11-05 20:06:51.000000000 +0100 -+++ ocserv-0.2.1/src/worker-vpn.c 2013-11-11 13:48:45.537372280 +0100 -@@ -49,7 +49,7 @@ - #include - #include - --#include -+#include - - /* after that time (secs) of inactivity in the UDP part, connection switches to - * TCP (if activity occurs there). diff --git a/ocserv-tests.patch b/ocserv-tests.patch deleted file mode 100644 index e700e81..0000000 --- a/ocserv-tests.patch +++ /dev/null @@ -1,91 +0,0 @@ -diff -ur ocserv-0.2.1.orig/tests/Makefile.in ocserv-0.2.1/tests/Makefile.in ---- ocserv-0.2.1.orig/tests/Makefile.in 2013-11-06 20:47:51.000000000 +0100 -+++ ocserv-0.2.1/tests/Makefile.in 2013-11-11 13:56:15.231784324 +0100 -@@ -1,4 +1,4 @@ --# Makefile.in generated by automake 1.14 from Makefile.am. -+# Makefile.in generated by automake 1.13.4 from Makefile.am. - # @configure_input@ - - # Copyright (C) 1994-2013 Free Software Foundation, Inc. -@@ -721,6 +721,8 @@ - HAVE_WCHAR_T = @HAVE_WCHAR_T@ - HAVE__BOOL = @HAVE__BOOL@ - HAVE__EXIT = @HAVE__EXIT@ -+HTTP_PARSER_CFLAGS = @HTTP_PARSER_CFLAGS@ -+HTTP_PARSER_LIBS = @HTTP_PARSER_LIBS@ - INCLUDE_NEXT = @INCLUDE_NEXT@ - INCLUDE_NEXT_AS_FIRST_DIRECTIVE = @INCLUDE_NEXT_AS_FIRST_DIRECTIVE@ - INSTALL = @INSTALL@ -diff -ur ocserv-0.2.1.orig/tests/test1.config ocserv-0.2.1/tests/test1.config ---- ocserv-0.2.1.orig/tests/test1.config 2013-07-06 15:10:57.000000000 +0200 -+++ ocserv-0.2.1/tests/test1.config 2013-11-11 13:56:15.231784324 +0100 -@@ -132,7 +132,7 @@ - # The user the worker processes will be run as. It should be - # unique (no other services run as this user). - run-as-user = nobody --run-as-group = nogroup -+run-as-group = nobody - - # Network settings - -diff -ur ocserv-0.2.1.orig/tests/test2.config ocserv-0.2.1/tests/test2.config ---- ocserv-0.2.1.orig/tests/test2.config 2013-07-06 16:54:44.000000000 +0200 -+++ ocserv-0.2.1/tests/test2.config 2013-11-11 13:56:15.231784324 +0100 -@@ -132,7 +132,7 @@ - # The user the worker processes will be run as. It should be - # unique (no other services run as this user). - run-as-user = nobody --run-as-group = nogroup -+run-as-group = nobody - - # Network settings - -diff -ur ocserv-0.2.1.orig/tests/test3.config ocserv-0.2.1/tests/test3.config ---- ocserv-0.2.1.orig/tests/test3.config 2013-10-29 20:11:52.000000000 +0100 -+++ ocserv-0.2.1/tests/test3.config 2013-11-11 13:56:15.232784330 +0100 -@@ -132,7 +132,7 @@ - # The user the worker processes will be run as. It should be - # unique (no other services run as this user). - run-as-user = nobody --run-as-group = nogroup -+run-as-group = nobody - - # Network settings - -diff -ur ocserv-0.2.1.orig/tests/test-iroute ocserv-0.2.1/tests/test-iroute ---- ocserv-0.2.1.orig/tests/test-iroute 2013-10-30 12:39:28.000000000 +0100 -+++ ocserv-0.2.1/tests/test-iroute 2013-11-11 13:56:32.933878367 +0100 -@@ -35,7 +35,7 @@ - - echo -n "Checking if routes have been applied... " - --if [ ! -f test-iroute.tmp ];then -+if [ ! -f ./test-iroute.tmp ];then - fail $PID "Temporary file cannot be found" - fi - -Only in ocserv-0.2.1/tests: test-iroute~ -diff -ur ocserv-0.2.1.orig/tests/test-iroute.config ocserv-0.2.1/tests/test-iroute.config ---- ocserv-0.2.1.orig/tests/test-iroute.config 2013-10-30 12:31:33.000000000 +0100 -+++ ocserv-0.2.1/tests/test-iroute.config 2013-11-11 13:56:15.232784330 +0100 -@@ -132,7 +132,7 @@ - # The user the worker processes will be run as. It should be - # unique (no other services run as this user). - run-as-user = nobody --run-as-group = nogroup -+run-as-group = nobody - - # Network settings - -diff -ur ocserv-0.2.1.orig/tests/test-pass-script.config ocserv-0.2.1/tests/test-pass-script.config ---- ocserv-0.2.1.orig/tests/test-pass-script.config 2013-10-31 17:20:37.000000000 +0100 -+++ ocserv-0.2.1/tests/test-pass-script.config 2013-11-11 13:56:15.232784330 +0100 -@@ -132,7 +132,7 @@ - # The user the worker processes will be run as. It should be - # unique (no other services run as this user). - run-as-user = nobody --run-as-group = nogroup -+run-as-group = nobody - - # Network settings - diff --git a/ocserv.conf b/ocserv.conf index a8d983e..19e40fd 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -134,6 +134,18 @@ socket-file = ocserv.sock run-as-user = ocserv run-as-group = ocserv +# Set the protocol-defined priority (SO_PRIORITY) for packets to +# be sent. That is a number from 0 to 6 with 0 being the lowest +# priority. Alternatively this can be used to set the IP Type- +# Of-Service, by setting it to a hexadecimal number (e.g., 0x20). +# This can be set per user/group or globally. +#net-priority = 3 + +# Set the VPN worker process into a specific cgroup. This is Linux +# specific and can be set per user/group or globally. +#cgroup = "cpuset,cpu:test" + + # Network settings device = vpns diff --git a/ocserv.spec b/ocserv.spec index d2328ab..bc87405 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.2.1 -Release: 6%{?dist} +Version: 0.2.3 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -15,8 +15,6 @@ Source4: PACKAGE-LICENSING # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 -Patch0: ocserv-http-parser.patch -Patch1: ocserv-tests.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: gnutls-devel @@ -42,28 +40,25 @@ Provides: bundled(ccan-htable) bundled(ccan-list) Provides: bundled(ccan-check_type) bundled(ccan-build_assert) %description -OpenConnect server (ocserv) is an SSL VPN server. Its purpose is to be -a secure, small, fast and configurable VPN server that uses standard -protocols such as TLS 1.2, and Datagram TLS. It implements the -OpenConnect SSL VPN protocol, which is compatible with the AnyConnect -SSL VPN protocol. +OpenConnect server (ocserv) is an SSL VPN server. Its purpose is to be a +secure, small, fast and configurable VPN server. It implements the OpenConnect +SSL VPN protocol, and has also (currently experimental) compatibility with +clients using the AnyConnect SSL VPN protocol. The OpenConnect VPN protocol +uses the standard IETF security protocols such as TLS 1.2, and Datagram TLS +to provide the secure VPN service. %prep %setup -q -%patch0 -p1 -%patch1 -p1 rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c +sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # GPLv3 in headers was a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* -# remove GPLv3 components -rm -f tests/test-* tests/common.sh %build -autoreconf -fi %configure @@ -119,6 +114,10 @@ rm -rf %{buildroot} %{_unitdir}/ocserv.service %changelog +* Mon Dec 16 2013 Nikos Mavrogiannopoulos - 0.2.3-1 +- Updated to latest upstream version (0.2.3). +- Corrected the chroot directory in config file. + * Fri Dec 6 2013 Nikos Mavrogiannopoulos - 0.2.1-6 - Added exception for the bundling of CCAN components. diff --git a/sources b/sources index 84447ec..8e4e1da 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -99f239f796c9d29746e307e6a51999f0 ocserv-0.2.1.tar.xz +8ea3cd7decf8a95f96e41f6a2ea5152c ocserv-0.2.3.tar.xz From 3dc34d462651279ce8c293819dee2485ef8ce758 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Jan 2014 10:43:16 +0100 Subject: [PATCH 006/195] updated to ocserv 0.3.0 --- .gitignore | 1 + ocserv.conf | 13 +++++++---- ocserv.service | 4 +++- ocserv.spec | 47 ++++++++++++++++++++++++++++++++++++--- org.infradead.ocserv.conf | 14 ++++++++++++ sources | 2 +- 6 files changed, 72 insertions(+), 9 deletions(-) create mode 100644 org.infradead.ocserv.conf diff --git a/.gitignore b/.gitignore index 3475ef7..a04b424 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /ocserv-0.2.1.tar.xz /ocserv-0.2.3.tar.xz +/ocserv-0.3.0.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 19e40fd..53e1af5 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -43,8 +43,8 @@ try-mtu-discovery = false # # There may be multiple certificate and key pairs and each key # should correspond to the preceding certificate. -server-cert = /etc/ocserv/server.crt -server-key = /etc/ocserv/server.key +server-cert = /etc/pki/ocserv/public/server.crt +server-key = /etc/pki/ocserv/private/server.key # Diffie-Hellman parameters. Only needed if you require support # for the DHE ciphersuites (by default this server supports ECDHE). @@ -70,7 +70,7 @@ server-key = /etc/ocserv/server.key # The Certificate Authority that will be used # to verify clients if certificate authentication # is set. -#ca-cert = /etc/ocserv/ca.crt +ca-cert = /etc/pki/ocserv/cacerts/ca.crt # The object identifier that will be used to read the user ID in the client certificate. # The object identifier should be part of the certificate's DN @@ -116,6 +116,11 @@ cookie-validity = 172800 #connect-script = /usr/bin/myscript #disconnect-script = /usr/bin/myscript +# D-BUS usage. If disabled occtl tool cannot be used. If enabled +# then ocserv must have access to register org.infradead.ocserv +# D-BUS service. See doc/dbus/org.infradead.ocserv.conf +use-dbus = true + # UTMP use-utmp = true @@ -223,5 +228,5 @@ route-del-cmd = "ip route delete %R dev %D" # certificate even if they are authenticating via a previously granted # cookie. Legacy CISCO clients do not do that, and thus this option # should be set for them. -#always-require-cert = false +cisco-client-compat = true diff --git a/ocserv.service b/ocserv.service index 3b39466..86fca91 100644 --- a/ocserv.service +++ b/ocserv.service @@ -1,7 +1,9 @@ [Unit] Description=OpenConnect SSL VPN server Documentation=man:ocserv(8) -After=syslog.target network.target +After=syslog.target +After=network.target +After=dbus.service [Service] PrivateTmp=true diff --git a/ocserv.spec b/ocserv.spec index bc87405..c477f2a 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.2.3 +Version: 0.3.0 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -12,6 +12,7 @@ Source1: ocserv.conf Source2: ocserv.service Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING +Source5: org.infradead.ocserv.conf # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -22,10 +23,15 @@ BuildRequires: pam-devel BuildRequires: iproute BuildRequires: systemd BuildRequires: autogen-libopts-devel +BuildRequires: protobuf-c-devel +BuildRequires: libnl3-devel +BuildRequires: readline-devel +BuildRequires: dbus-devel BuildRequires: autogen BuildRequires: pcllib-devel, http-parser-devel, tcp_wrappers-devel BuildRequires: automake, autoconf +Requires: gnutls-utils Requires: iproute Requires: pam Requires(pre): shadow-utils @@ -50,11 +56,12 @@ to provide the secure VPN service. %prep %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h +rm -rf src/protobuf/ rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config -# GPLv3 in headers was a gnulib bug: +# GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* @@ -64,13 +71,41 @@ sed -i 's/either version 3 of the License/either version 2 of the License/g' bui # disable the smp_mflags until an issue with the dependencies in the # autogen'erated files is fixed -make #%{?_smp_mflags} +make %{?_smp_mflags} %pre getent group ocserv &>/dev/null || groupadd -r ocserv getent passwd ocserv &>/dev/null || \ /usr/sbin/useradd -r -g ocserv -s /sbin/nologin -c ocserv \ -d /var/lib/ocserv ocserv +mkdir -p %{_sysconfdir}/pki/ocserv/public +mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private +mkdir -p %{_sysconfdir}/pki/ocserv/cacerts +#generate CA certificate/key +if test ! -f %{_sysconfdir}/pki/ocserv/private/ca.key;then +certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/ca.key +echo "cn=`hostname -f` CA" >%{_sysconfdir}/pki/ocserv/ca.tmpl +echo "serial=1" >>%{_sysconfdir}/pki/ocserv/ca.tmpl +echo "ca" >>%{_sysconfdir}/pki/ocserv/ca.tmpl +echo "cert_signing_key" >>%{_sysconfdir}/pki/ocserv/ca.tmpl +certtool --template %{_sysconfdir}/pki/ocserv/ca.tmpl \ + --generate-self-signed --load-privkey %{_sysconfdir}/pki/ocserv/private/ca.key \ + --outfile %{_sysconfdir}/pki/ocserv/cacerts/ca.crt +#rm -f %{_sysconfdir}/pki/ocserv/ca.tmpl +fi +#generate server certificate/key +if test ! -f %{_sysconfdir}/pki/ocserv/private/server.key;then +certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/server.key +echo "cn=`hostname -f`" >%{_sysconfdir}/pki/ocserv/server.tmpl +echo "serial=2" >>%{_sysconfdir}/pki/ocserv/server.tmpl +echo "signing_key" >>%{_sysconfdir}/pki/ocserv/server.tmpl +echo "encryption_key" >>%{_sysconfdir}/pki/ocserv/server.tmpl +certtool --template %{_sysconfdir}/pki/ocserv/server.tmpl \ + --generate-certificate --load-privkey %{_sysconfdir}/pki/ocserv/private/server.key \ + --load-ca-certificate %{_sysconfdir}/pki/ocserv/cacerts/ca.crt --load-ca-privkey \ + %{_sysconfdir}/pki/ocserv/private/ca.key --outfile %{_sysconfdir}/pki/ocserv/public/server.crt +#rm -f %{_sysconfdir}/pki/ocserv/server.tmpl +fi %post %systemd_post ocserv.service @@ -88,6 +123,8 @@ mkdir -p %{buildroot}/%{_sysconfdir}/pam.d/ mkdir -p %{buildroot}/%{_sysconfdir}/ocserv/ install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/pam.d/ocserv install -p -m 644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/ocserv/ +mkdir -p %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ +install -p -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ mkdir -p %{buildroot}/%{_unitdir} install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} mkdir -p %{buildroot}/var/lib/ocserv/ @@ -103,13 +140,17 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/ocserv %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf +%config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.infradead.ocserv.conf %config(noreplace) %{_sysconfdir}/pam.d/ocserv + %doc AUTHORS ChangeLog NEWS COPYING LICENSE README TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* +%{_mandir}/man8/occtl.8* %{_mandir}/man8/ocpasswd.8* %{_bindir}/ocpasswd +%{_bindir}/occtl %{_sbindir}/ocserv %{_unitdir}/ocserv.service diff --git a/org.infradead.ocserv.conf b/org.infradead.ocserv.conf new file mode 100644 index 0000000..8c69f93 --- /dev/null +++ b/org.infradead.ocserv.conf @@ -0,0 +1,14 @@ + + + + + + + + + + + + diff --git a/sources b/sources index 8e4e1da..a5c1666 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -8ea3cd7decf8a95f96e41f6a2ea5152c ocserv-0.2.3.tar.xz +f6d64451ac8c458c7bdd40ee8ff51192 ocserv-0.3.0.tar.xz From a54d692ba315ab4849601ea073dfc04487ed775f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Jan 2014 10:44:33 +0100 Subject: [PATCH 007/195] added changelog entry --- ocserv.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index c477f2a..f8290bb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -155,6 +155,10 @@ rm -rf %{buildroot} %{_unitdir}/ocserv.service %changelog +* Mon Jan 27 2014 Nikos Mavrogiannopoulos - 0.3.0-1 +- Updated to latest upstream version (0.3.0). +- Certificates and private keys are auto-generated. + * Mon Dec 16 2013 Nikos Mavrogiannopoulos - 0.2.3-1 - Updated to latest upstream version (0.2.3). - Corrected the chroot directory in config file. From c95eb0798ce01283f778883722a3d305d35fe5cd Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Jan 2014 11:23:57 +0100 Subject: [PATCH 008/195] do not output anything when generating certificates --- ocserv.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index f8290bb..c0c3ea8 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -83,19 +83,19 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts #generate CA certificate/key if test ! -f %{_sysconfdir}/pki/ocserv/private/ca.key;then -certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/ca.key +certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/ca.key >/dev/null 2>&1 echo "cn=`hostname -f` CA" >%{_sysconfdir}/pki/ocserv/ca.tmpl echo "serial=1" >>%{_sysconfdir}/pki/ocserv/ca.tmpl echo "ca" >>%{_sysconfdir}/pki/ocserv/ca.tmpl echo "cert_signing_key" >>%{_sysconfdir}/pki/ocserv/ca.tmpl certtool --template %{_sysconfdir}/pki/ocserv/ca.tmpl \ --generate-self-signed --load-privkey %{_sysconfdir}/pki/ocserv/private/ca.key \ - --outfile %{_sysconfdir}/pki/ocserv/cacerts/ca.crt + --outfile %{_sysconfdir}/pki/ocserv/cacerts/ca.crt >/dev/null 2>&1 #rm -f %{_sysconfdir}/pki/ocserv/ca.tmpl fi #generate server certificate/key if test ! -f %{_sysconfdir}/pki/ocserv/private/server.key;then -certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/server.key +certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/server.key >/dev/null 2>&1 echo "cn=`hostname -f`" >%{_sysconfdir}/pki/ocserv/server.tmpl echo "serial=2" >>%{_sysconfdir}/pki/ocserv/server.tmpl echo "signing_key" >>%{_sysconfdir}/pki/ocserv/server.tmpl @@ -103,7 +103,7 @@ echo "encryption_key" >>%{_sysconfdir}/pki/ocserv/server.tmpl certtool --template %{_sysconfdir}/pki/ocserv/server.tmpl \ --generate-certificate --load-privkey %{_sysconfdir}/pki/ocserv/private/server.key \ --load-ca-certificate %{_sysconfdir}/pki/ocserv/cacerts/ca.crt --load-ca-privkey \ - %{_sysconfdir}/pki/ocserv/private/ca.key --outfile %{_sysconfdir}/pki/ocserv/public/server.crt + %{_sysconfdir}/pki/ocserv/private/ca.key --outfile %{_sysconfdir}/pki/ocserv/public/server.crt >/dev/null 2>&1 #rm -f %{_sysconfdir}/pki/ocserv/server.tmpl fi From 9d295c61755fa20212aa690a72cd6ccad50690da Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Jan 2014 11:45:34 +0100 Subject: [PATCH 009/195] more uniform handling of buildrequires --- ocserv.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index c0c3ea8..bc27917 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -28,7 +28,9 @@ BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: dbus-devel BuildRequires: autogen -BuildRequires: pcllib-devel, http-parser-devel, tcp_wrappers-devel +BuildRequires: pcllib-devel +BuildRequires: http-parser-devel +BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf Requires: gnutls-utils @@ -69,8 +71,6 @@ sed -i 's/either version 3 of the License/either version 2 of the License/g' bui %configure -# disable the smp_mflags until an issue with the dependencies in the -# autogen'erated files is fixed make %{?_smp_mflags} %pre From fcdc556224ad1d94ae5c2fcc017f45e9b5a503f4 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 29 Jan 2014 09:35:20 +0100 Subject: [PATCH 010/195] remove expiration date by default --- ocserv.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index bc27917..03521cb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -85,6 +85,7 @@ mkdir -p %{_sysconfdir}/pki/ocserv/cacerts if test ! -f %{_sysconfdir}/pki/ocserv/private/ca.key;then certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/ca.key >/dev/null 2>&1 echo "cn=`hostname -f` CA" >%{_sysconfdir}/pki/ocserv/ca.tmpl +echo "expiration_days=-1" >>%{_sysconfdir}/pki/ocserv/ca.tmpl echo "serial=1" >>%{_sysconfdir}/pki/ocserv/ca.tmpl echo "ca" >>%{_sysconfdir}/pki/ocserv/ca.tmpl echo "cert_signing_key" >>%{_sysconfdir}/pki/ocserv/ca.tmpl @@ -98,6 +99,7 @@ if test ! -f %{_sysconfdir}/pki/ocserv/private/server.key;then certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/server.key >/dev/null 2>&1 echo "cn=`hostname -f`" >%{_sysconfdir}/pki/ocserv/server.tmpl echo "serial=2" >>%{_sysconfdir}/pki/ocserv/server.tmpl +echo "expiration_days=-1" >>%{_sysconfdir}/pki/ocserv/server.tmpl echo "signing_key" >>%{_sysconfdir}/pki/ocserv/server.tmpl echo "encryption_key" >>%{_sysconfdir}/pki/ocserv/server.tmpl certtool --template %{_sysconfdir}/pki/ocserv/server.tmpl \ @@ -155,6 +157,9 @@ rm -rf %{buildroot} %{_unitdir}/ocserv.service %changelog +* Wed Jan 29 2014 Nikos Mavrogiannopoulos - 0.3.0-2 +- Generated certificates no longer carry an expiration date. + * Mon Jan 27 2014 Nikos Mavrogiannopoulos - 0.3.0-1 - Updated to latest upstream version (0.3.0). - Certificates and private keys are auto-generated. From ad60bc84c8923a0ee26a2c36476e24caa6d72d33 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 29 Jan 2014 09:36:02 +0100 Subject: [PATCH 011/195] bumped version --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 03521cb..76af3da 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.3.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING From 4835271e779ec8d33c343f5f77ea3e094480430d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 17 Feb 2014 08:27:55 +0100 Subject: [PATCH 012/195] new upstream release --- .gitignore | 1 + ocserv.conf | 14 +++++++------- ocserv.spec | 7 +++++-- sources | 2 +- 4 files changed, 14 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index a04b424..00aafc8 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /ocserv-0.2.1.tar.xz /ocserv-0.2.3.tar.xz /ocserv-0.3.0.tar.xz +/ocserv-0.3.1.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 53e1af5..9e452c8 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -30,6 +30,9 @@ udp-port = 4443 # Keepalive in seconds keepalive = 32400 +# Rekey time in seconds +rekey-time 172800 + # Dead peer detection in seconds dpd = 60 @@ -160,18 +163,15 @@ device = vpns #ipv4-network = 192.168.1.0 #ipv4-netmask = 255.255.255.0 -# Use the keywork local to advertize the local P-t-P address as DNS server -# ipv4-dns = 192.168.2.1 -#ipv4-dns = local +#ipv4-dns = 192.168.2.1 # The NBNS server (if any) #ipv4-nbns = 192.168.2.3 -#ipv6-address = -#ipv6-dns = - -# The IPv6 subnet prefix +# The IPv6 subnet +#ipv6-network = #ipv6-prefix = +#ipv6-dns = # Prior to leasing any IP from the pool ping it to verify that # it is not in use by another (unrelated to this server) host. diff --git a/ocserv.spec b/ocserv.spec index 76af3da..f0f92af 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.3.0 -Release: 2%{?dist} +Version: 0.3.1 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -157,6 +157,9 @@ rm -rf %{buildroot} %{_unitdir}/ocserv.service %changelog +* Mon Feb 17 2014 Nikos Mavrogiannopoulos - 0.3.1-1 +- new upstream release + * Wed Jan 29 2014 Nikos Mavrogiannopoulos - 0.3.0-2 - Generated certificates no longer carry an expiration date. diff --git a/sources b/sources index a5c1666..d6781a1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -f6d64451ac8c458c7bdd40ee8ff51192 ocserv-0.3.0.tar.xz +22bd81fd4f60e27fe85aac8fd73dada3 ocserv-0.3.1.tar.xz From 8afbd5807d30cc1e88c0a4e1dbc038ce3f5d2e94 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 17 Feb 2014 08:36:36 +0100 Subject: [PATCH 013/195] fixes in default config --- ocserv.conf | 4 ++-- ocserv.spec | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 9e452c8..4b523d2 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -163,7 +163,7 @@ device = vpns #ipv4-network = 192.168.1.0 #ipv4-netmask = 255.255.255.0 -#ipv4-dns = 192.168.2.1 +#dns = 192.168.2.1 # The NBNS server (if any) #ipv4-nbns = 192.168.2.3 @@ -171,7 +171,7 @@ device = vpns # The IPv6 subnet #ipv6-network = #ipv6-prefix = -#ipv6-dns = +#dns = # Prior to leasing any IP from the pool ping it to verify that # it is not in use by another (unrelated to this server) host. diff --git a/ocserv.spec b/ocserv.spec index f0f92af..29ce110 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.3.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -157,7 +157,7 @@ rm -rf %{buildroot} %{_unitdir}/ocserv.service %changelog -* Mon Feb 17 2014 Nikos Mavrogiannopoulos - 0.3.1-1 +* Mon Feb 17 2014 Nikos Mavrogiannopoulos - 0.3.1-2 - new upstream release * Wed Jan 29 2014 Nikos Mavrogiannopoulos - 0.3.0-2 From 2e7890b870be1458e94c2326d5864a6329318add Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 17 Feb 2014 08:42:45 +0100 Subject: [PATCH 014/195] more config updates --- ocserv.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 4b523d2..43391e2 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -166,7 +166,7 @@ device = vpns #dns = 192.168.2.1 # The NBNS server (if any) -#ipv4-nbns = 192.168.2.3 +#nbns = 192.168.2.3 # The IPv6 subnet #ipv6-network = @@ -196,8 +196,8 @@ output-buffer = 100 # Configuration files that will be applied per user connection or # per group. Each file name on these directories must match the username # or the groupname. -# The options allowed in the configuration files are ipv?-dns, ipv?-nbns, -# ipv?-network, ipv?-netmask, ipv6-prefix, iroute and route. +# The options allowed in the configuration files are dns, nbns, +# ipv?-network, ipv4-netmask, ipv6-prefix, iroute and route. # # Note that the 'iroute' option allows to add routes on the server # based on a user or group. The syntax depends on the input accepted From 50490ebb14fba43b79922972c1efb06ea53a94d4 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 17 Feb 2014 15:52:29 +0100 Subject: [PATCH 015/195] Added missing profile file. --- ocserv.conf | 2 +- ocserv.spec | 18 ++++++++++++------ profile.xml | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+), 7 deletions(-) create mode 100644 profile.xml diff --git a/ocserv.conf b/ocserv.conf index 43391e2..36d4987 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -222,7 +222,7 @@ route-del-cmd = "ip route delete %R dev %D" # Client profile xml. A sample file exists in doc/profile.xml. # This file must be accessible from inside the worker's chroot. # The profile is ignored by the openconnect client. -#user-profile = profile.xml +user-profile = profile.xml # Unless set to false it is required for clients to present their # certificate even if they are authenticating via a previously granted diff --git a/ocserv.spec b/ocserv.spec index 29ce110..1655528 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.3.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -13,6 +13,7 @@ Source2: ocserv.service Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING Source5: org.infradead.ocserv.conf +Source6: profile.xml # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -77,7 +78,7 @@ make %{?_smp_mflags} getent group ocserv &>/dev/null || groupadd -r ocserv getent passwd ocserv &>/dev/null || \ /usr/sbin/useradd -r -g ocserv -s /sbin/nologin -c ocserv \ - -d /var/lib/ocserv ocserv + -d %{_localstatedir}/lib/ocserv ocserv mkdir -p %{_sysconfdir}/pki/ocserv/public mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts @@ -129,7 +130,9 @@ mkdir -p %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ install -p -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ mkdir -p %{buildroot}/%{_unitdir} install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} -mkdir -p %{buildroot}/var/lib/ocserv/ +mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ +#install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ +install -p -m 644 %{SOURCE6} %{buildroot}%{_localstatedir}/lib/ocserv/ %make_install %clean @@ -138,16 +141,15 @@ rm -rf %{buildroot} %files %defattr(-,root,root,-) -%dir /var/lib/ocserv +%dir %{_localstatedir}/lib/ocserv %dir %{_sysconfdir}/ocserv %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf %config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.infradead.ocserv.conf %config(noreplace) %{_sysconfdir}/pam.d/ocserv - %doc AUTHORS ChangeLog NEWS COPYING LICENSE README TODO PACKAGE-LICENSING -%doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT +%doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* %{_mandir}/man8/occtl.8* %{_mandir}/man8/ocpasswd.8* @@ -155,8 +157,12 @@ rm -rf %{buildroot} %{_bindir}/occtl %{_sbindir}/ocserv %{_unitdir}/ocserv.service +%{_localstatedir}/lib/ocserv/profile.xml %changelog +#* xxx xxx xx 2014 Nikos Mavrogiannopoulos - 0.3.1-3 +#- Added missing profile.xml + * Mon Feb 17 2014 Nikos Mavrogiannopoulos - 0.3.1-2 - new upstream release diff --git a/profile.xml b/profile.xml new file mode 100644 index 0000000..3ceb4d7 --- /dev/null +++ b/profile.xml @@ -0,0 +1,32 @@ + + + + + false + false + false + IPSec + true + AllowRemoteUsers + pinAllowed + + + Digital_Signature + + + ClientAuth + + + + + localhost + + + + + + VPN Server + localhost + + + From bacae63f2cf499f5261c41d6c36b3e0cf716758b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 14 Mar 2014 17:02:34 +0100 Subject: [PATCH 016/195] new upstream release --- .gitignore | 1 + ocserv.spec | 12 +++++------- profile.xml | 32 -------------------------------- sources | 2 +- 4 files changed, 7 insertions(+), 40 deletions(-) delete mode 100644 profile.xml diff --git a/.gitignore b/.gitignore index 00aafc8..fc8515f 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /ocserv-0.2.3.tar.xz /ocserv-0.3.0.tar.xz /ocserv-0.3.1.tar.xz +/ocserv-0.3.2.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 1655528..2d75d7f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.3.1 -Release: 3%{?dist} +Version: 0.3.2 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -13,7 +13,6 @@ Source2: ocserv.service Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING Source5: org.infradead.ocserv.conf -Source6: profile.xml # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -131,8 +130,7 @@ install -p -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ mkdir -p %{buildroot}/%{_unitdir} install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ -#install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ -install -p -m 644 %{SOURCE6} %{buildroot}%{_localstatedir}/lib/ocserv/ +install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ %make_install %clean @@ -160,8 +158,8 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog -#* xxx xxx xx 2014 Nikos Mavrogiannopoulos - 0.3.1-3 -#- Added missing profile.xml +* Fri Mar 14 2014 Nikos Mavrogiannopoulos - 0.3.2-1 +- New upstream release * Mon Feb 17 2014 Nikos Mavrogiannopoulos - 0.3.1-2 - new upstream release diff --git a/profile.xml b/profile.xml deleted file mode 100644 index 3ceb4d7..0000000 --- a/profile.xml +++ /dev/null @@ -1,32 +0,0 @@ - - - - - false - false - false - IPSec - true - AllowRemoteUsers - pinAllowed - - - Digital_Signature - - - ClientAuth - - - - - localhost - - - - - - VPN Server - localhost - - - diff --git a/sources b/sources index d6781a1..1ca45d0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -22bd81fd4f60e27fe85aac8fd73dada3 ocserv-0.3.1.tar.xz +c2cc1ddce632b725f5b82964824e6762 ocserv-0.3.2.tar.xz From 502c2d23e46de6ccad2ce6e794dda140656cb8e3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 10 Apr 2014 14:43:02 +0200 Subject: [PATCH 017/195] new upstream release --- .gitignore | 1 + ocserv.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index fc8515f..191c200 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /ocserv-0.3.0.tar.xz /ocserv-0.3.1.tar.xz /ocserv-0.3.2.tar.xz +/ocserv-0.3.3.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 2d75d7f..6929179 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.3.2 +Version: 0.3.3 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -158,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Apr 10 2014 Nikos Mavrogiannopoulos - 0.3.3-1 +- New upstream release + * Fri Mar 14 2014 Nikos Mavrogiannopoulos - 0.3.2-1 - New upstream release diff --git a/sources b/sources index 1ca45d0..4b92dd3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -c2cc1ddce632b725f5b82964824e6762 ocserv-0.3.2.tar.xz +47ac15222048744c40dcaae153c2a9db ocserv-0.3.3.tar.xz From c437e0ae339c493fee4aecbc472e6d06b8cd1d6c Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 2 May 2014 13:54:34 +0200 Subject: [PATCH 018/195] new upstream release --- .gitignore | 1 + ocserv.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 191c200..ce73977 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /ocserv-0.3.1.tar.xz /ocserv-0.3.2.tar.xz /ocserv-0.3.3.tar.xz +/ocserv-0.3.4.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 6929179..85580dc 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.3.3 +Version: 0.3.4 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -158,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri May 02 2014 Nikos Mavrogiannopoulos - 0.3.4-1 +- New upstream release + * Thu Apr 10 2014 Nikos Mavrogiannopoulos - 0.3.3-1 - New upstream release diff --git a/sources b/sources index 4b92dd3..608a0ed 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -47ac15222048744c40dcaae153c2a9db ocserv-0.3.3.tar.xz +d60feddbb55a4a029284a3051d7f26e7 ocserv-0.3.4.tar.xz From 59650d4e781e87245666b8919e7b0a751a0a1e0e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 2 May 2014 13:59:37 +0200 Subject: [PATCH 019/195] updated default config file --- ocserv.conf | 158 ++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 110 insertions(+), 48 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 36d4987..0e638e5 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -5,10 +5,18 @@ #auth = "plain[./sample.passwd]" auth = "pam" +# The plain option requires specifying a password file which contains +# entries of the following format. +# "username:groupname:encoded-password" +# One entry must be listed per line, and 'ocpasswd' can be used +# to generate password entries. +#auth = "plain[/etc/ocserv/ocpasswd]" + # A banner to be displayed on clients #banner = "Welcome" -# Use listen-host to limit to specific IPs or to the IPs of a provided hostname. +# Use listen-host to limit to specific IPs or to the IPs of a provided +# hostname. #listen-host = [IP|HOSTNAME] # Limit the number of clients. Unset or set to zero for unlimited. @@ -19,22 +27,25 @@ max-clients = 16 # (X is the provided value). Set to zero for no limit. #rate-limit-ms = 100 -# Limit the number of identical clients (i.e., users connecting multiple times) -# Unset or set to zero for unlimited. +# Limit the number of identical clients (i.e., users connecting +# multiple times). Unset or set to zero for unlimited. max-same-clients = 2 # TCP and UDP port number -tcp-port = 4443 -udp-port = 4443 +tcp-port = 443 +udp-port = 443 # Keepalive in seconds keepalive = 32400 -# Rekey time in seconds -rekey-time 172800 +# Dead peer detection in seconds. +dpd = 90 -# Dead peer detection in seconds -dpd = 60 +# Dead peer detection for mobile clients. The needs to +# be much higher to prevent such clients being awaken too +# often by the DPD messages, and save battery. +# (clients that send the X-AnyConnect-Identifier-DeviceType) +#mobile-dpd = 1800 # MTU discovery (DPD must be enabled) try-mtu-discovery = false @@ -65,29 +76,30 @@ server-key = /etc/pki/ocserv/private/server.key #ocsp-response = /path/to/ocsp.der # In case PKCS #11 or TPM keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only (It's the storage -# root key). +# in files. The srk-pin-file is applicable to TPM keys only, and is the +# storage root key. #pin-file = /path/to/pin.txt #srk-pin-file = /path/to/srkpin.txt -# The Certificate Authority that will be used -# to verify clients if certificate authentication +# The Certificate Authority that will be used to verify +# client certificates (public keys) if certificate authentication # is set. +#ca-cert = /path/to/ca.pem ca-cert = /etc/pki/ocserv/cacerts/ca.crt -# The object identifier that will be used to read the user ID in the client certificate. -# The object identifier should be part of the certificate's DN +# The object identifier that will be used to read the user ID in the client +# certificate. The object identifier should be part of the certificate's DN # Useful OIDs are: # CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 #cert-user-oid = 0.9.2342.19200300.100.1.1 -# The object identifier that will be used to read the user group in the client -# certificate. The object identifier should be part of the certificate's DN -# Useful OIDs are: +# The object identifier that will be used to read the user group in the +# client certificate. The object identifier should be part of the certificate's +# DN. Useful OIDs are: # OU (organizational unit) = 2.5.4.11 #cert-group-oid = 2.5.4.11 -# A revocation list of ca-cert is set +# The revocation list of the certificates issued by the 'ca-cert' above. #crl = /path/to/crl.pem # GnuTLS priority string @@ -100,38 +112,60 @@ tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" # to authentication auth-timeout = 40 +# The time (in seconds) that a client is allowed to stay idle (no traffic) +# before being disconnected. Unset to disable. +#idle-timeout = 1200 + +# The time (in seconds) that a mobile client is allowed to stay idle (no +# traffic) before being disconnected. Unset to disable. +#mobile-idle-timeout = 2400 + # The time (in seconds) that a client is not allowed to reconnect after # a failed authentication attempt. -min-reauth-time = 2 +#min-reauth-time = 2 # Cookie validity time (in seconds) # Once a client is authenticated he's provided a cookie with # which he can reconnect. This option sets the maximum lifetime # of that cookie. -cookie-validity = 172800 +cookie-validity = 86400 + +# ReKey time (in seconds) +# ocserv will ask the client to refresh keys periodically once +# this amount of seconds is elapsed. Set to zero to disable. +rekey-time = 172800 + +# ReKey method +# Valid options: ssl, new-tunnel +# ssl: Will perform an efficient rehandshake on the channel allowing +# a seamless connection during rekey. +# new-tunnel: Will instruct the client to discard and re-establish the channel. +# Use this option only if the connecting clients have issues with the ssl +# option. +rekey-method = ssl # Script to call when a client connects and obtains an IP # Parameters are passed on the environment. # REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON -# may be "connect" or "disconnect". +# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), +# ID (a unique numeric ID); REASON may be "connect" or "disconnect". #connect-script = /usr/bin/myscript #disconnect-script = /usr/bin/myscript +# UTMP +use-utmp = true + # D-BUS usage. If disabled occtl tool cannot be used. If enabled # then ocserv must have access to register org.infradead.ocserv # D-BUS service. See doc/dbus/org.infradead.ocserv.conf use-dbus = true -# UTMP -use-utmp = true - -# PID file +# PID file. It can be overriden in the command line. #pid-file = /var/run/ocserv.pid # The default server directory. Does not require any devices present. -chroot-dir = /var/lib/ocserv/ +chroot-dir = /path/to/chroot # socket file used for IPC, will be appended with .PID # It must be accessible within the chroot environment (if any) @@ -153,51 +187,69 @@ run-as-group = ocserv # specific and can be set per user/group or globally. #cgroup = "cpuset,cpu:test" - +# # Network settings +# +# The name of the tun device device = vpns # The default domain to be advertised -#default-domain = example.com +default-domain = example.com -#ipv4-network = 192.168.1.0 -#ipv4-netmask = 255.255.255.0 -#dns = 192.168.2.1 +# The pool of addresses that leases will be given from. +ipv4-network = 192.168.1.0 +ipv4-netmask = 255.255.255.0 + +# The advertized DNS server. Use multiple lines for +# multiple servers. +# dns = fc00::4be0 +dns = 192.168.1.2 # The NBNS server (if any) -#nbns = 192.168.2.3 +#nbns = 192.168.1.3 -# The IPv6 subnet -#ipv6-network = -#ipv6-prefix = -#dns = +# The IPv6 subnet that leases will be given from. +#ipv6-network = fc00:: +#ipv6-prefix = 16 + +# The domains over which the provided DNS should be used. Use +# multiple lines for multiple domains. +#split-dns = example.com # Prior to leasing any IP from the pool ping it to verify that # it is not in use by another (unrelated to this server) host. ping-leases = false -# Leave empty to assign the default MTU of the device +# Unset to assign the default MTU of the device # mtu = # Unset to enable bandwidth restrictions (in bytes/sec). The # setting here is global, but can also be set per user or per group. -#rx-data-per-sec = 40960 -#tx-data-per-sec = 40960 +#rx-data-per-sec = 40000 +#tx-data-per-sec = 40000 # The number of packets (of MTU size) that are available in # the output buffer. The default is low to improve latency. # Setting it higher will improve throughput. -output-buffer = 100 +#output-buffer = 10 -#route = 192.168.1.0/255.255.255.0 +# Routes to be forwarded to the client. If you need the +# client to forward routes to the server, you may use the +# config-per-user/group or even connect and disconnect scripts. +# +# To set the server as the default gateway for the client just +# comment out all routes from the server. +route = 192.168.1.0/255.255.255.0 #route = 192.168.5.0/255.255.255.0 +#route = fef4:db8:1000:1001::/64 # Configuration files that will be applied per user connection or # per group. Each file name on these directories must match the username # or the groupname. # The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, iroute and route. +# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, +# net-priority and cgroup. # # Note that the 'iroute' option allows to add routes on the server # based on a user or group. The syntax depends on the input accepted @@ -210,7 +262,7 @@ output-buffer = 100 # route/mask and %D with the (tun) device. # # The following example is from linux systems. %R should be something -# like 192.168.2.0/24 (so iroute in this system has different syntax than route) +# like 192.168.2.0/24 route-add-cmd = "ip route add %R dev %D" route-del-cmd = "ip route delete %R dev %D" @@ -221,12 +273,22 @@ route-del-cmd = "ip route delete %R dev %D" # Client profile xml. A sample file exists in doc/profile.xml. # This file must be accessible from inside the worker's chroot. -# The profile is ignored by the openconnect client. +# It is not used by the openconnect client. user-profile = profile.xml +# Binary files that may be downloaded by the CISCO client. Must +# be within any chroot environment. +#binary-files = /path/to/binaries + # Unless set to false it is required for clients to present their # certificate even if they are authenticating via a previously granted -# cookie. Legacy CISCO clients do not do that, and thus this option -# should be set for them. +# cookie and complete their authentication in the same TCP connection. +# Legacy CISCO clients do not do that, and thus this option should be +# set for them. cisco-client-compat = true +#Advanced options + +# Option to allow sending arbitrary custom headers to the client after +# authentication and prior to VPN tunnel establishment. +#custom-header = "X-My-Header: hi there" From 87ad88173a507c3f8e884c8e77042709988cf98d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 9 May 2014 11:00:44 +0200 Subject: [PATCH 020/195] new upstream release --- .gitignore | 1 + ocserv.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index ce73977..ba9312a 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /ocserv-0.3.2.tar.xz /ocserv-0.3.3.tar.xz /ocserv-0.3.4.tar.xz +/ocserv-0.3.5.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 85580dc..79094fe 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.3.4 +Version: 0.3.5 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -158,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri May 09 2014 Nikos Mavrogiannopoulos - 0.3.5-1 +- New upstream release + * Fri May 02 2014 Nikos Mavrogiannopoulos - 0.3.4-1 - New upstream release diff --git a/sources b/sources index 608a0ed..f768ad7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -d60feddbb55a4a029284a3051d7f26e7 ocserv-0.3.4.tar.xz +7ba8ebe4eba08b6e1c9dabbc78da16e5 ocserv-0.3.5.tar.xz From 100c73194f53f0c62537dc8c1023baa5557357c6 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 26 May 2014 13:06:37 +0200 Subject: [PATCH 021/195] new upstream release --- .gitignore | 2 ++ ocserv.conf | 44 +++++++++++++++++++++++++++++++++++++++----- ocserv.spec | 10 ++++++++-- sources | 3 ++- 4 files changed, 51 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index ba9312a..26820b3 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,5 @@ /ocserv-0.3.3.tar.xz /ocserv-0.3.4.tar.xz /ocserv-0.3.5.tar.xz +/ocserv-0.8.0pre0.tar.xz +/ocserv-0.8.0pre0.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 0e638e5..b87ba46 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -5,6 +5,10 @@ #auth = "plain[./sample.passwd]" auth = "pam" +# The gid-min option is used by auto-select-group option, in order to +# select the minimum group ID. +#auth = "pam[gid-min=1000]" + # The plain option requires specifying a password file which contains # entries of the following format. # "username:groupname:encoded-password" @@ -128,7 +132,7 @@ auth-timeout = 40 # Once a client is authenticated he's provided a cookie with # which he can reconnect. This option sets the maximum lifetime # of that cookie. -cookie-validity = 86400 +cookie-validity = 10800 # ReKey time (in seconds) # ocserv will ask the client to refresh keys periodically once @@ -156,10 +160,13 @@ rekey-method = ssl # UTMP use-utmp = true -# D-BUS usage. If disabled occtl tool cannot be used. If enabled -# then ocserv must have access to register org.infradead.ocserv -# D-BUS service. See doc/dbus/org.infradead.ocserv.conf -use-dbus = true +# Whether to enable support for the occtl tool (i.e., either through D-BUS, +# or via a unix socket). +use-occtl = true + +# socket file used for IPC with occtl. You only need to set that, +# if you use more than a single servers. +#occtl-socket-file = /var/run/occtl.socket # PID file. It can be overriden in the command line. #pid-file = /var/run/ocserv.pid @@ -194,6 +201,10 @@ run-as-group = ocserv # The name of the tun device device = vpns +# Whether the generated IPs will be predictable, i.e., IP stays the +# same for the same user when possible. +predictable-ips = true + # The default domain to be advertised default-domain = example.com @@ -258,6 +269,29 @@ route = 192.168.1.0/255.255.255.0 #config-per-user = /etc/ocserv/config-per-user/ #config-per-group = /etc/ocserv/config-per-group/ +# When config-per-xxx is specified and there is no group or user that +# matches, then utilize the following configuration. + +#default-user-config = /etc/ocserv/defaults/user.conf +#default-group-config = /etc/ocserv/defaults/group.conf + +# Groups that a client is allowed to select from. +# A client may belong in multiple groups, and in certain use-cases +# it is needed to switch between them. For these cases the client can +# select prior to authentication. Add multiple entries for multiple groups. +#select-group = group1 +#select-group = group2[My group 2] +#select-group = tost[The tost group] + +# The name of the group that if selected it would allow to use +# the assigned by default group. +default-select-group = DEFAULT + +# Instead of specifying manually all the allowed groups, you may instruct +# ocserv to scan all available groups and include the full list. That +# option is only functional on plain authentication. +auto-select-group = true + # The system command to use to setup a route. %R will be replaced with the # route/mask and %D with the (tun) device. # diff --git a/ocserv.spec b/ocserv.spec index 79094fe..87a96ca 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.3.5 +Version: 0.8.0pre0 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -13,6 +13,7 @@ Source2: ocserv.service Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING Source5: org.infradead.ocserv.conf +Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -26,13 +27,15 @@ BuildRequires: autogen-libopts-devel BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel -BuildRequires: dbus-devel BuildRequires: autogen BuildRequires: pcllib-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf +# we don't build with dbus support +#BuildRequires: dbus-devel + Requires: gnutls-utils Requires: iproute Requires: pam @@ -158,6 +161,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon May 26 2014 Nikos Mavrogiannopoulos - 0.8.0pre0-1 +- New upstream release + * Fri May 09 2014 Nikos Mavrogiannopoulos - 0.3.5-1 - New upstream release diff --git a/sources b/sources index f768ad7..d20aea7 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -7ba8ebe4eba08b6e1c9dabbc78da16e5 ocserv-0.3.5.tar.xz +de476b85be78be000f33c912a076657a ocserv-0.8.0pre0.tar.xz +0f2c49c121883cd189f28126d8ff718f ocserv-0.8.0pre0.tar.xz.sig From 67813f7c1f7959fbc7e8e05ee065a6e6935ecd47 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 26 May 2014 13:09:24 +0200 Subject: [PATCH 022/195] depend on talloc --- ocserv.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index 87a96ca..7db9d6b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -29,6 +29,7 @@ BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen BuildRequires: pcllib-devel +BuildRequires: libtalloc-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf @@ -62,6 +63,7 @@ to provide the secure VPN service. %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/ +rm -rf src/ccan/talloc rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c From 04321eb1cb479a4af9e3926585211252fd8ea6b5 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 26 May 2014 13:23:01 +0200 Subject: [PATCH 023/195] depend on systemd-devel --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 7db9d6b..859a23a 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -23,6 +23,7 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute BuildRequires: systemd +BuildRequires: systemd-devel BuildRequires: autogen-libopts-devel BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel From aa81804b849fc02e6cb2c9995fe434dcf95294f3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 27 May 2014 10:11:20 +0200 Subject: [PATCH 024/195] Updated license information --- ocserv.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 859a23a..0c73e2d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -4,8 +4,8 @@ Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING -# To simplify licenses LGPLv2+ files have been promoted to GPLv2+. -License: GPLv2+ and BSD and MIT and CC0 +# To simplify licenses LGPLv2+ files have been promoted to GPLv3+. +License: GPLv3+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz Source1: ocserv.conf From 86abe99de540d3c3735524071f646d84b365bfa8 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 2 Jun 2014 09:10:26 +0200 Subject: [PATCH 025/195] updated ocserv to 0.8.0 --- .gitignore | 2 + ocserv-0.8.0-cmp.patch | 13 +++++++ ocserv-0.8.0-endianness.patch | 70 +++++++++++++++++++++++++++++++++++ ocserv.conf | 7 +--- ocserv.spec | 10 ++++- sources | 4 +- 6 files changed, 98 insertions(+), 8 deletions(-) create mode 100644 ocserv-0.8.0-cmp.patch create mode 100644 ocserv-0.8.0-endianness.patch diff --git a/.gitignore b/.gitignore index 26820b3..11ec67a 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,5 @@ /ocserv-0.3.5.tar.xz /ocserv-0.8.0pre0.tar.xz /ocserv-0.8.0pre0.tar.xz.sig +/ocserv-0.8.0.tar.xz +/ocserv-0.8.0.tar.xz.sig diff --git a/ocserv-0.8.0-cmp.patch b/ocserv-0.8.0-cmp.patch new file mode 100644 index 0000000..1a00580 --- /dev/null +++ b/ocserv-0.8.0-cmp.patch @@ -0,0 +1,13 @@ +diff --git a/src/auth/plain.c b/src/auth/plain.c +index 1b66683..c8ed5bf 100644 +--- a/src/auth/plain.c ++++ b/src/auth/plain.c +@@ -266,7 +266,7 @@ static size_t rehash(const void *_e, void *unused) + + static bool str_cmp(const void* _c1, void* _c2) + { +- const char *c1 = _c1, *c2 = c2; ++ const char *c1 = _c1, *c2 = _c2; + + if (strcmp(c1, c2) == 0) + return 1; diff --git a/ocserv-0.8.0-endianness.patch b/ocserv-0.8.0-endianness.patch new file mode 100644 index 0000000..0afd8a3 --- /dev/null +++ b/ocserv-0.8.0-endianness.patch @@ -0,0 +1,70 @@ +diff --git a/src/main-ctl-unix.c b/src/main-ctl-unix.c +index b4da5eb..90d604f 100644 +--- a/src/main-ctl-unix.c ++++ b/src/main-ctl-unix.c +@@ -629,7 +629,7 @@ static void ctl_handle_commands(main_server_st * s) + } + goto cleanup; + } +- length = (buffer[2] << 8) | buffer[1]; ++ memcpy(&length, &buffer[1], 2); + buffer_size = ret - 3; + + if (length != buffer_size) { +diff --git a/src/occtl-unix.c b/src/occtl-unix.c +index 183825d..0c1b3e1 100644 +--- a/src/occtl-unix.c ++++ b/src/occtl-unix.c +@@ -83,15 +83,14 @@ int send_cmd(struct unix_ctx *ctx, unsigned cmd, const void *data, + struct iovec iov[2]; + unsigned iov_len = 1; + int e, ret; +- unsigned length = 0; ++ uint16_t length = 0; + void *packed = NULL; + + if (get_size) + length = get_size(data); + + header[0] = cmd; +- header[1] = length; +- header[2] = length >> 8; ++ memcpy(&header[1], &length, 2); + + iov[0].iov_base = header; + iov[0].iov_len = 3; +@@ -145,7 +144,7 @@ int send_cmd(struct unix_ctx *ctx, unsigned cmd, const void *data, + goto fail; + } + +- length = (header[2] << 8) | header[1]; ++ memcpy(&length, &header[1], 2); + + rep->data_size = length; + rep->data = talloc_size(ctx, length); +diff --git a/src/sec-mod.c b/src/sec-mod.c +index 15ee32a..c3d4bad 100644 +--- a/src/sec-mod.c ++++ b/src/sec-mod.c +@@ -354,6 +354,7 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f + unsigned cmd, length; + unsigned i, buffer_size; + uint8_t *buffer, *tpool; ++ uint16_t l16; + struct pin_st pins; + int sd; + sec_mod_st *sec; +@@ -538,10 +539,11 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f + } + + cmd = buffer[0]; +- length = buffer[1] | buffer[2] << 8; ++ memcpy(&l16, &buffer[1], 2); ++ length = l16; + + if (length > buffer_size - 4) { +- seclog(LOG_INFO, "too big message"); ++ seclog(LOG_INFO, "too big message (%d)", length); + goto cont; + } + diff --git a/ocserv.conf b/ocserv.conf index b87ba46..002dcee 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -128,11 +128,8 @@ auth-timeout = 40 # a failed authentication attempt. #min-reauth-time = 2 -# Cookie validity time (in seconds) -# Once a client is authenticated he's provided a cookie with -# which he can reconnect. This option sets the maximum lifetime -# of that cookie. -cookie-validity = 10800 +# Cookie timeout (in seconds) +cookie-timeout = 360 # ReKey time (in seconds) # ocserv will ask the client to refresh keys periodically once diff --git a/ocserv.spec b/ocserv.spec index 0c73e2d..27665b5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.8.0pre0 +Version: 0.8.0 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -15,6 +15,9 @@ Source4: PACKAGE-LICENSING Source5: org.infradead.ocserv.conf Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig +Patch1: ocserv-0.8.0-endianness.patch +Patch2: ocserv-0.8.0-cmp.patch + # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -72,6 +75,8 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* +%patch1 -p1 -b .cmp +%patch2 -p1 -b .endianness %build @@ -164,6 +169,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jun 02 2014 Nikos Mavrogiannopoulos - 0.8.0-1 +- New upstream release + * Mon May 26 2014 Nikos Mavrogiannopoulos - 0.8.0pre0-1 - New upstream release diff --git a/sources b/sources index d20aea7..fb6cafa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -de476b85be78be000f33c912a076657a ocserv-0.8.0pre0.tar.xz -0f2c49c121883cd189f28126d8ff718f ocserv-0.8.0pre0.tar.xz.sig +6383535a21f8eecfb1bbb7f7ac99c41f ocserv-0.8.0.tar.xz +1336250a0db4923e6a597b960209b42d ocserv-0.8.0.tar.xz.sig From 925686a46452fc4ec64b23048ddf38575ef151e7 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Jun 2014 17:24:25 +0200 Subject: [PATCH 026/195] Generate the certificates and private keys before the first run --- ocserv.service | 1 + ocserv.spec | 36 ++++++++---------------------------- 2 files changed, 9 insertions(+), 28 deletions(-) diff --git a/ocserv.service b/ocserv.service index 86fca91..3f6a3e2 100644 --- a/ocserv.service +++ b/ocserv.service @@ -9,6 +9,7 @@ After=dbus.service PrivateTmp=true Type=forking PIDFile=/var/run/ocserv.pid +ExecStartPre=/usr/sbin/ocserv-genkey ExecStart=/usr/sbin/ocserv --pid-file /var/run/ocserv.pid --config /etc/ocserv/ocserv.conf ExecReload=/bin/kill -HUP $MAINPID diff --git a/ocserv.spec b/ocserv.spec index 27665b5..3b7d8f1 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -14,6 +14,7 @@ Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING Source5: org.infradead.ocserv.conf Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig +Source7: ocserv-genkey Patch1: ocserv-0.8.0-endianness.patch Patch2: ocserv-0.8.0-cmp.patch @@ -92,33 +93,6 @@ getent passwd ocserv &>/dev/null || \ mkdir -p %{_sysconfdir}/pki/ocserv/public mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts -#generate CA certificate/key -if test ! -f %{_sysconfdir}/pki/ocserv/private/ca.key;then -certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/ca.key >/dev/null 2>&1 -echo "cn=`hostname -f` CA" >%{_sysconfdir}/pki/ocserv/ca.tmpl -echo "expiration_days=-1" >>%{_sysconfdir}/pki/ocserv/ca.tmpl -echo "serial=1" >>%{_sysconfdir}/pki/ocserv/ca.tmpl -echo "ca" >>%{_sysconfdir}/pki/ocserv/ca.tmpl -echo "cert_signing_key" >>%{_sysconfdir}/pki/ocserv/ca.tmpl -certtool --template %{_sysconfdir}/pki/ocserv/ca.tmpl \ - --generate-self-signed --load-privkey %{_sysconfdir}/pki/ocserv/private/ca.key \ - --outfile %{_sysconfdir}/pki/ocserv/cacerts/ca.crt >/dev/null 2>&1 -#rm -f %{_sysconfdir}/pki/ocserv/ca.tmpl -fi -#generate server certificate/key -if test ! -f %{_sysconfdir}/pki/ocserv/private/server.key;then -certtool --generate-privkey --outfile %{_sysconfdir}/pki/ocserv/private/server.key >/dev/null 2>&1 -echo "cn=`hostname -f`" >%{_sysconfdir}/pki/ocserv/server.tmpl -echo "serial=2" >>%{_sysconfdir}/pki/ocserv/server.tmpl -echo "expiration_days=-1" >>%{_sysconfdir}/pki/ocserv/server.tmpl -echo "signing_key" >>%{_sysconfdir}/pki/ocserv/server.tmpl -echo "encryption_key" >>%{_sysconfdir}/pki/ocserv/server.tmpl -certtool --template %{_sysconfdir}/pki/ocserv/server.tmpl \ - --generate-certificate --load-privkey %{_sysconfdir}/pki/ocserv/private/server.key \ - --load-ca-certificate %{_sysconfdir}/pki/ocserv/cacerts/ca.crt --load-ca-privkey \ - %{_sysconfdir}/pki/ocserv/private/ca.key --outfile %{_sysconfdir}/pki/ocserv/public/server.crt >/dev/null 2>&1 -#rm -f %{_sysconfdir}/pki/ocserv/server.tmpl -fi %post %systemd_post ocserv.service @@ -142,6 +116,8 @@ mkdir -p %{buildroot}/%{_unitdir} install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ +mkdir -p %{buildroot}/%{_sbindir} +install -p -m 755 %{SOURCE7} %{buildroot}/%{_sbindir} %make_install %clean @@ -165,10 +141,14 @@ rm -rf %{buildroot} %{_bindir}/ocpasswd %{_bindir}/occtl %{_sbindir}/ocserv +%{_sbindir}/ocserv-genkey %{_unitdir}/ocserv.service %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jun 02 2014 Nikos Mavrogiannopoulos - 0.8.0-2 +- Generate certificates and private keys before the first run + * Mon Jun 02 2014 Nikos Mavrogiannopoulos - 0.8.0-1 - New upstream release From ae2c0a022e451021ebea97ff1f15e81f277febf0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Jun 2014 17:37:26 +0200 Subject: [PATCH 027/195] corrected chroot path --- ocserv.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.conf b/ocserv.conf index 002dcee..835273c 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -169,7 +169,7 @@ use-occtl = true #pid-file = /var/run/ocserv.pid # The default server directory. Does not require any devices present. -chroot-dir = /path/to/chroot +chroot-dir = /var/lib/ocserv # socket file used for IPC, will be appended with .PID # It must be accessible within the chroot environment (if any) From eeb0dfaaa0bc82942e2b92004c26892566d3ceb2 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Jun 2014 17:37:42 +0200 Subject: [PATCH 028/195] doc update --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 3b7d8f1..b9df5e2 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -148,6 +148,7 @@ rm -rf %{buildroot} %changelog * Mon Jun 02 2014 Nikos Mavrogiannopoulos - 0.8.0-2 - Generate certificates and private keys before the first run +- Corrected chroot path * Mon Jun 02 2014 Nikos Mavrogiannopoulos - 0.8.0-1 - New upstream release From 145e41b394f89c417c71af797a79b669068aad6b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Jun 2014 17:40:51 +0200 Subject: [PATCH 029/195] corrected date --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index b9df5e2..7594277 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -146,7 +146,7 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog -* Mon Jun 02 2014 Nikos Mavrogiannopoulos - 0.8.0-2 +* Fri Jun 06 2014 Nikos Mavrogiannopoulos - 0.8.0-2 - Generate certificates and private keys before the first run - Corrected chroot path From 18c47c83ef92dd3fbce6685808d91c7e3873b630 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 6 Jun 2014 17:49:59 +0200 Subject: [PATCH 030/195] Added ocserv-genkey --- ocserv-genkey | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100755 ocserv-genkey diff --git a/ocserv-genkey b/ocserv-genkey new file mode 100755 index 0000000..687d685 --- /dev/null +++ b/ocserv-genkey @@ -0,0 +1,32 @@ +#!/bin/sh + +#generate CA certificate/key +if test ! -f /etc/pki/ocserv/private/ca.key;then +certtool --generate-privkey --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1 +echo "cn=`hostname -f` CA" >/etc/pki/ocserv/ca.tmpl +echo "expiration_days=-1" >>/etc/pki/ocserv/ca.tmpl +echo "serial=1" >>/etc/pki/ocserv/ca.tmpl +echo "ca" >>/etc/pki/ocserv/ca.tmpl +echo "cert_signing_key" >>/etc/pki/ocserv/ca.tmpl +certtool --template /etc/pki/ocserv/ca.tmpl \ + --generate-self-signed --load-privkey /etc/pki/ocserv/private/ca.key \ + --outfile /etc/pki/ocserv/cacerts/ca.crt >/dev/null 2>&1 +#rm -f /etc/pki/ocserv/ca.tmpl +fi + +#generate server certificate/key +if test ! -f /etc/pki/ocserv/private/server.key;then +certtool --generate-privkey --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1 +echo "cn=`hostname -f`" >/etc/pki/ocserv/server.tmpl +echo "serial=2" >>/etc/pki/ocserv/server.tmpl +echo "expiration_days=-1" >>/etc/pki/ocserv/server.tmpl +echo "signing_key" >>/etc/pki/ocserv/server.tmpl +echo "encryption_key" >>/etc/pki/ocserv/server.tmpl +certtool --template /etc/pki/ocserv/server.tmpl \ + --generate-certificate --load-privkey /etc/pki/ocserv/private/server.key \ + --load-ca-certificate /etc/pki/ocserv/cacerts/ca.crt --load-ca-privkey \ + /etc/pki/ocserv/private/ca.key --outfile /etc/pki/ocserv/public/server.crt >/dev/null 2>&1 +#rm -f /etc/pki/ocserv/server.tmpl +fi + +exit 0 From b821c127dbcac7c550b932db03ef5da93b6f3887 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 30 Jun 2014 10:29:57 +0200 Subject: [PATCH 031/195] Updated to 0.8.1 --- .gitignore | 2 + ocserv-0.8.0-cmp.patch | 13 ------- ocserv-0.8.0-endianness.patch | 70 ----------------------------------- ocserv.spec | 12 +++--- sources | 4 +- 5 files changed, 9 insertions(+), 92 deletions(-) delete mode 100644 ocserv-0.8.0-cmp.patch delete mode 100644 ocserv-0.8.0-endianness.patch diff --git a/.gitignore b/.gitignore index 11ec67a..fe72e6d 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,5 @@ /ocserv-0.8.0pre0.tar.xz.sig /ocserv-0.8.0.tar.xz /ocserv-0.8.0.tar.xz.sig +/ocserv-0.8.1.tar.xz +/ocserv-0.8.1.tar.xz.sig diff --git a/ocserv-0.8.0-cmp.patch b/ocserv-0.8.0-cmp.patch deleted file mode 100644 index 1a00580..0000000 --- a/ocserv-0.8.0-cmp.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/auth/plain.c b/src/auth/plain.c -index 1b66683..c8ed5bf 100644 ---- a/src/auth/plain.c -+++ b/src/auth/plain.c -@@ -266,7 +266,7 @@ static size_t rehash(const void *_e, void *unused) - - static bool str_cmp(const void* _c1, void* _c2) - { -- const char *c1 = _c1, *c2 = c2; -+ const char *c1 = _c1, *c2 = _c2; - - if (strcmp(c1, c2) == 0) - return 1; diff --git a/ocserv-0.8.0-endianness.patch b/ocserv-0.8.0-endianness.patch deleted file mode 100644 index 0afd8a3..0000000 --- a/ocserv-0.8.0-endianness.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff --git a/src/main-ctl-unix.c b/src/main-ctl-unix.c -index b4da5eb..90d604f 100644 ---- a/src/main-ctl-unix.c -+++ b/src/main-ctl-unix.c -@@ -629,7 +629,7 @@ static void ctl_handle_commands(main_server_st * s) - } - goto cleanup; - } -- length = (buffer[2] << 8) | buffer[1]; -+ memcpy(&length, &buffer[1], 2); - buffer_size = ret - 3; - - if (length != buffer_size) { -diff --git a/src/occtl-unix.c b/src/occtl-unix.c -index 183825d..0c1b3e1 100644 ---- a/src/occtl-unix.c -+++ b/src/occtl-unix.c -@@ -83,15 +83,14 @@ int send_cmd(struct unix_ctx *ctx, unsigned cmd, const void *data, - struct iovec iov[2]; - unsigned iov_len = 1; - int e, ret; -- unsigned length = 0; -+ uint16_t length = 0; - void *packed = NULL; - - if (get_size) - length = get_size(data); - - header[0] = cmd; -- header[1] = length; -- header[2] = length >> 8; -+ memcpy(&header[1], &length, 2); - - iov[0].iov_base = header; - iov[0].iov_len = 3; -@@ -145,7 +144,7 @@ int send_cmd(struct unix_ctx *ctx, unsigned cmd, const void *data, - goto fail; - } - -- length = (header[2] << 8) | header[1]; -+ memcpy(&length, &header[1], 2); - - rep->data_size = length; - rep->data = talloc_size(ctx, length); -diff --git a/src/sec-mod.c b/src/sec-mod.c -index 15ee32a..c3d4bad 100644 ---- a/src/sec-mod.c -+++ b/src/sec-mod.c -@@ -354,6 +354,7 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f - unsigned cmd, length; - unsigned i, buffer_size; - uint8_t *buffer, *tpool; -+ uint16_t l16; - struct pin_st pins; - int sd; - sec_mod_st *sec; -@@ -538,10 +539,11 @@ void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_f - } - - cmd = buffer[0]; -- length = buffer[1] | buffer[2] << 8; -+ memcpy(&l16, &buffer[1], 2); -+ length = l16; - - if (length > buffer_size - 4) { -- seclog(LOG_INFO, "too big message"); -+ seclog(LOG_INFO, "too big message (%d)", length); - goto cont; - } - diff --git a/ocserv.spec b/ocserv.spec index 7594277..2afb2f5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.8.0 -Release: 2%{?dist} +Version: 0.8.1 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -16,9 +16,6 @@ Source5: org.infradead.ocserv.conf Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey -Patch1: ocserv-0.8.0-endianness.patch -Patch2: ocserv-0.8.0-cmp.patch - # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -76,8 +73,6 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* -%patch1 -p1 -b .cmp -%patch2 -p1 -b .endianness %build @@ -146,6 +141,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jun 30 2014 Nikos Mavrogiannopoulos - 0.8.1-1 +- New upstream release + * Fri Jun 06 2014 Nikos Mavrogiannopoulos - 0.8.0-2 - Generate certificates and private keys before the first run - Corrected chroot path diff --git a/sources b/sources index fb6cafa..1f51640 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -6383535a21f8eecfb1bbb7f7ac99c41f ocserv-0.8.0.tar.xz -1336250a0db4923e6a597b960209b42d ocserv-0.8.0.tar.xz.sig +9a2eeafbe018128460df0729096b20c6 ocserv-0.8.1.tar.xz +f6def04b953baa3f2fe0eb23fd091ee2 ocserv-0.8.1.tar.xz.sig From b98703bb9a057a9260b7b638a5fe7e44e72b6538 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 28 Jul 2014 09:31:13 +0200 Subject: [PATCH 032/195] new upstream release --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index fe72e6d..3d40924 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,5 @@ /ocserv-0.8.0.tar.xz.sig /ocserv-0.8.1.tar.xz /ocserv-0.8.1.tar.xz.sig +/ocserv-0.8.2.tar.xz +/ocserv-0.8.2.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 2afb2f5..630abca 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.8.1 +Version: 0.8.2 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -141,6 +141,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jul 28 2014 Nikos Mavrogiannopoulos - 0.8.2-1 +- New upstream release + * Mon Jun 30 2014 Nikos Mavrogiannopoulos - 0.8.1-1 - New upstream release diff --git a/sources b/sources index 1f51640..e9ded37 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -9a2eeafbe018128460df0729096b20c6 ocserv-0.8.1.tar.xz -f6def04b953baa3f2fe0eb23fd091ee2 ocserv-0.8.1.tar.xz.sig +fd890e121445dfe8bb514da67c91c675 ocserv-0.8.2.tar.xz +d7fb256c6b4c9837ffc16c9844ded77f ocserv-0.8.2.tar.xz.sig From 182d817e02ee9a359d3bc588e53ddb9fa179a314 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 1 Aug 2014 15:32:51 +0200 Subject: [PATCH 033/195] disabled auto-select-group by default --- ocserv.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 835273c..44872d5 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -282,12 +282,12 @@ route = 192.168.1.0/255.255.255.0 # The name of the group that if selected it would allow to use # the assigned by default group. -default-select-group = DEFAULT +#default-select-group = DEFAULT # Instead of specifying manually all the allowed groups, you may instruct # ocserv to scan all available groups and include the full list. That # option is only functional on plain authentication. -auto-select-group = true +#auto-select-group = true # The system command to use to setup a route. %R will be replaced with the # route/mask and %D with the (tun) device. From 948b6e77129cadee32cf20c26f7c1b9f15358aee Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 5 Aug 2014 09:53:54 +0200 Subject: [PATCH 034/195] rebuilt for new protobuf-c --- ocserv.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 630abca..ce36bfa 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -73,6 +73,7 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* +touch src/*.proto %build @@ -141,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Tue Aug 05 2014 Nikos Mavrogiannopoulos - 0.8.2-2 +- Rebuilt for new protobuf-c + * Mon Jul 28 2014 Nikos Mavrogiannopoulos - 0.8.2-1 - New upstream release From 98a738a2c747ded7232520af4fd2b5d190ce3c4f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 8 Aug 2014 13:32:42 +0200 Subject: [PATCH 035/195] rebuilt --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ce36bfa..95a9f5e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -142,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Aug 08 2014 Nikos Mavrogiannopoulos - 0.8.2-3 +- Rebuilt + * Tue Aug 05 2014 Nikos Mavrogiannopoulos - 0.8.2-2 - Rebuilt for new protobuf-c From 320435c8641252703c1cd61ceeb772caaf37f163 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 17 Aug 2014 13:16:13 +0000 Subject: [PATCH 036/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 95a9f5e..e4f34a4 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -142,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Sun Aug 17 2014 Fedora Release Engineering - 0.8.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + * Fri Aug 08 2014 Nikos Mavrogiannopoulos - 0.8.2-3 - Rebuilt From a6425598dcc825a47ad8cd0e2f236ef93d78d3d5 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 28 Aug 2014 11:14:20 +0200 Subject: [PATCH 037/195] updated to 0.8.4 and removed unused file --- .gitignore | 2 ++ ocserv.spec | 10 +++++----- org.infradead.ocserv.conf | 14 -------------- sources | 4 ++-- 4 files changed, 9 insertions(+), 21 deletions(-) delete mode 100644 org.infradead.ocserv.conf diff --git a/.gitignore b/.gitignore index 3d40924..c4b2660 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,5 @@ /ocserv-0.8.1.tar.xz.sig /ocserv-0.8.2.tar.xz /ocserv-0.8.2.tar.xz.sig +/ocserv-0.8.4.tar.xz +/ocserv-0.8.4.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index e4f34a4..50e23d4 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.8.2 -Release: 4%{?dist} +Version: 0.8.4 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -12,7 +12,6 @@ Source1: ocserv.conf Source2: ocserv.service Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING -Source5: org.infradead.ocserv.conf Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey @@ -106,8 +105,6 @@ mkdir -p %{buildroot}/%{_sysconfdir}/pam.d/ mkdir -p %{buildroot}/%{_sysconfdir}/ocserv/ install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/pam.d/ocserv install -p -m 644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/ocserv/ -mkdir -p %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ -install -p -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/dbus-1/system.d/ mkdir -p %{buildroot}/%{_unitdir} install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ @@ -142,6 +139,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Aug 28 2014 Nikos Mavrogiannopoulos - 0.8.4-1 +- New upstream release + * Sun Aug 17 2014 Fedora Release Engineering - 0.8.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild diff --git a/org.infradead.ocserv.conf b/org.infradead.ocserv.conf deleted file mode 100644 index 8c69f93..0000000 --- a/org.infradead.ocserv.conf +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - - diff --git a/sources b/sources index e9ded37..a00d33a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -fd890e121445dfe8bb514da67c91c675 ocserv-0.8.2.tar.xz -d7fb256c6b4c9837ffc16c9844ded77f ocserv-0.8.2.tar.xz.sig +3eb452fddebda887eaa5f6412dab634c ocserv-0.8.4.tar.xz +bd84f29bc6fb278c37275d1eca420145 ocserv-0.8.4.tar.xz.sig From 7152f9c08c4bf0d0f2ec7e074e290dd92fb0c94f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 28 Aug 2014 11:30:22 +0200 Subject: [PATCH 038/195] removed unused config file --- ocserv.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 50e23d4..b3341b5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -123,7 +123,6 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/ocserv %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf -%config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.infradead.ocserv.conf %config(noreplace) %{_sysconfdir}/pam.d/ocserv %doc AUTHORS ChangeLog NEWS COPYING LICENSE README TODO PACKAGE-LICENSING From fcf19fcfacb2615df2ee4657d755b9d408e30d14 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 9 Sep 2014 16:18:55 +0200 Subject: [PATCH 039/195] Ship a default ocserv-script, which will put connecting clients into the internal firewall zone. --- ocserv-script | 10 ++++++++++ ocserv.conf | 7 +++---- ocserv.spec | 10 +++++++++- 3 files changed, 22 insertions(+), 5 deletions(-) create mode 100755 ocserv-script diff --git a/ocserv-script b/ocserv-script new file mode 100755 index 0000000..b3e2061 --- /dev/null +++ b/ocserv-script @@ -0,0 +1,10 @@ +#!/bin/sh + +if [ "$REASON" = "connect" ];then + # add the user's interface into the internal zone + firewall-cmd --zone=internal --add-interface=$DEVICE +else + firewall-cmd --zone=internal --remove-interface=$DEVICE +fi + +exit 0 diff --git a/ocserv.conf b/ocserv.conf index 44872d5..b554b1d 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -151,8 +151,8 @@ rekey-method = ssl # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /usr/bin/myscript -#disconnect-script = /usr/bin/myscript +#connect-script = /usr/bin/ocserv-script +#disconnect-script = /usr/bin/ocserv-script # UTMP use-utmp = true @@ -285,8 +285,7 @@ route = 192.168.1.0/255.255.255.0 #default-select-group = DEFAULT # Instead of specifying manually all the allowed groups, you may instruct -# ocserv to scan all available groups and include the full list. That -# option is only functional on plain authentication. +# ocserv to scan all available groups and include the full list. #auto-select-group = true # The system command to use to setup a route. %R will be replaced with the diff --git a/ocserv.spec b/ocserv.spec index b3341b5..5474956 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -14,6 +14,7 @@ Source3: ocserv-pamd.conf Source4: PACKAGE-LICENSING Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey +Source8: ocserv-script # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -111,6 +112,8 @@ mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ mkdir -p %{buildroot}/%{_sbindir} install -p -m 755 %{SOURCE7} %{buildroot}/%{_sbindir} +mkdir -p %{buildroot}/%{_bindir} +install -p -m 755 %{SOURCE8} %{buildroot}/%{_bindir} %make_install %clean @@ -132,12 +135,17 @@ rm -rf %{buildroot} %{_mandir}/man8/ocpasswd.8* %{_bindir}/ocpasswd %{_bindir}/occtl +%{_bindir}/ocserv-script %{_sbindir}/ocserv %{_sbindir}/ocserv-genkey %{_unitdir}/ocserv.service %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 +- Ship a default ocserv-script, which will put connecting clients + into the internal firewall zone. + * Thu Aug 28 2014 Nikos Mavrogiannopoulos - 0.8.4-1 - New upstream release From 35c982245e0be7e98ad70c428f3918200bd8290a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Oct 2014 09:38:31 +0100 Subject: [PATCH 040/195] updated to 0.8.7 --- .gitignore | 2 ++ ocserv.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index c4b2660..665d3e8 100644 --- a/.gitignore +++ b/.gitignore @@ -16,3 +16,5 @@ /ocserv-0.8.2.tar.xz.sig /ocserv-0.8.4.tar.xz /ocserv-0.8.4.tar.xz.sig +/ocserv-0.8.7.tar.xz.sig +/ocserv-0.8.7.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 5474956..b763626 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv -Version: 0.8.4 -Release: 2%{?dist} +Version: 0.8.7 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -142,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Oct 27 2014 Nikos Mavrogiannopoulos - 0.8.7-1 +- New upstream release + * Thu Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 - Ship a default ocserv-script, which will put connecting clients into the internal firewall zone. diff --git a/sources b/sources index a00d33a..dee4776 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -3eb452fddebda887eaa5f6412dab634c ocserv-0.8.4.tar.xz -bd84f29bc6fb278c37275d1eca420145 ocserv-0.8.4.tar.xz.sig +b807339aed1d713a096d2533ae6da232 ocserv-0.8.7.tar.xz.sig +79c00132c3366bb60546f256068211eb ocserv-0.8.7.tar.xz From d6e127e82c763b6fadf6f28ed123c2f1af809c20 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Oct 2014 10:06:28 +0100 Subject: [PATCH 041/195] corrected bogus date --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index b763626..3ce7760 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -145,7 +145,7 @@ rm -rf %{buildroot} * Mon Oct 27 2014 Nikos Mavrogiannopoulos - 0.8.7-1 - New upstream release -* Thu Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 +* Tue Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 - Ship a default ocserv-script, which will put connecting clients into the internal firewall zone. From a13678e2eab657775cde28706066cf573bc72cc0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 26 Nov 2014 17:10:29 +0100 Subject: [PATCH 042/195] new upstream release Resolves: #1167692 --- .gitignore | 2 ++ ocserv.conf | 12 +++++++++--- ocserv.spec | 5 ++++- sources | 4 ++-- 4 files changed, 17 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 665d3e8..5d57c42 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,5 @@ /ocserv-0.8.4.tar.xz.sig /ocserv-0.8.7.tar.xz.sig /ocserv-0.8.7.tar.xz +/ocserv-0.8.8.tar.xz.sig +/ocserv-0.8.8.tar.xz diff --git a/ocserv.conf b/ocserv.conf index b554b1d..6871a25 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,10 +1,16 @@ -# User authentication method. Could be set multiple times and in that case -# all should succeed. -# Options: certificate, pam. +# User authentication method. Could be set multiple times and in +# that case all should succeed. To enable multiple methods use +# multiple auth directives. Available options: certificate, certificate[optional], +# plain, pam. #auth = "certificate" #auth = "plain[./sample.passwd]" auth = "pam" +# This indicates that a user may present a certificate. When that option +# is set, individual users or user groups can be forced to present a valid +# certificate by using "require-cert=true". +#auth = "certificate[optional]" + # The gid-min option is used by auto-select-group option, in order to # select the minimum group ID. #auth = "pam[gid-min=1000]" diff --git a/ocserv.spec b/ocserv.spec index 3ce7760..e2aa87d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.8.7 +Version: 0.8.8 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -142,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Wed Nov 26 2014 Nikos Mavrogiannopoulos - 0.8.8-1 +- New upstream release + * Mon Oct 27 2014 Nikos Mavrogiannopoulos - 0.8.7-1 - New upstream release diff --git a/sources b/sources index dee4776..63a85e1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -b807339aed1d713a096d2533ae6da232 ocserv-0.8.7.tar.xz.sig -79c00132c3366bb60546f256068211eb ocserv-0.8.7.tar.xz +de7faa9e1658dfea0f409fcc83fcb7ff ocserv-0.8.8.tar.xz.sig +d9b12a3fa976dfda3e4c0238173744e6 ocserv-0.8.8.tar.xz From 87a8dc624ef7819156303d653850ab59dfd2379e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 11 Dec 2014 13:34:08 +0100 Subject: [PATCH 043/195] new upstream release --- .gitignore | 2 ++ ocserv.conf | 70 ++++++++++++++++++++++++++++++++++++++++------------- ocserv.spec | 5 +++- sources | 4 +-- 4 files changed, 61 insertions(+), 20 deletions(-) diff --git a/.gitignore b/.gitignore index 5d57c42..099ada9 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,5 @@ /ocserv-0.8.7.tar.xz /ocserv-0.8.8.tar.xz.sig /ocserv-0.8.8.tar.xz +/ocserv-0.8.9.tar.xz.sig +/ocserv-0.8.9.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 6871a25..2d6f6f9 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -22,13 +22,19 @@ auth = "pam" # to generate password entries. #auth = "plain[/etc/ocserv/ocpasswd]" +# Whether to enable seccomp worker isolation. That restricts the number of +# system calls allowed to a worker process, in order to reduce damage from a +# bug in the worker process. It is available on Linux systems at a performance cost. +#use-seccomp = true + +# Whether to enable the authentication method's session control (i.e., PAM). +# That requires more resources on the server, and makes cookies one-time-use; +# thus don't enable unless you need it. +#session-control = true + # A banner to be displayed on clients #banner = "Welcome" -# Use listen-host to limit to specific IPs or to the IPs of a provided -# hostname. -#listen-host = [IP|HOSTNAME] - # Limit the number of clients. Unset or set to zero for unlimited. #max-clients = 1024 max-clients = 16 @@ -41,10 +47,23 @@ max-clients = 16 # multiple times). Unset or set to zero for unlimited. max-same-clients = 2 +# Use listen-host to limit to specific IPs or to the IPs of a provided +# hostname. +#listen-host = [IP|HOSTNAME] + +# When the server has a dynamic DNS address (that may change), +# should set that to true to ask the client to resolve again on +# reconnects. +#listen-host-is-dyndns = true + # TCP and UDP port number tcp-port = 443 udp-port = 443 +# Accept connections using a socket file. The connections are +# forwarded without SSL/TLS. +listen-clear-file = /var/run/ocserv-conn.socket + # Keepalive in seconds keepalive = 32400 @@ -94,7 +113,6 @@ server-key = /etc/pki/ocserv/private/server.key # The Certificate Authority that will be used to verify # client certificates (public keys) if certificate authentication # is set. -#ca-cert = /path/to/ca.pem ca-cert = /etc/pki/ocserv/cacerts/ca.crt # The object identifier that will be used to read the user ID in the client @@ -113,10 +131,10 @@ ca-cert = /etc/pki/ocserv/cacerts/ca.crt #crl = /path/to/crl.pem # GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT" +tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-ARCFOUR-128" # To enforce perfect forward secrecy (PFS) on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA" +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" # The time (in seconds) that a client is allowed to stay connected prior # to authentication @@ -135,7 +153,18 @@ auth-timeout = 40 #min-reauth-time = 2 # Cookie timeout (in seconds) -cookie-timeout = 360 +# Once a client is authenticated he's provided a cookie with +# which he can reconnect. That cookie will be invalided if not +# used within this timeout value. On a user disconnection, that +# cookie will also be active for this time amount prior to be +# invalid. That should allow a reasonable amount of time for roaming +# between different networks. +cookie-timeout = 300 + +# Whether roaming is allowed, i.e., if true a cookie is +# restricted to a single IP address and cannot be re-used +# from a different IP. +deny-roaming = false # ReKey time (in seconds) # ocserv will ask the client to refresh keys periodically once @@ -157,8 +186,8 @@ rekey-method = ssl # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /usr/bin/ocserv-script -#disconnect-script = /usr/bin/ocserv-script +#connect-script = /scripts/ocserv-script +#disconnect-script = /scripts/ocserv-script # UTMP use-utmp = true @@ -171,6 +200,7 @@ use-occtl = true # if you use more than a single servers. #occtl-socket-file = /var/run/occtl.socket + # PID file. It can be overriden in the command line. #pid-file = /var/run/ocserv.pid @@ -254,7 +284,7 @@ ping-leases = false # # To set the server as the default gateway for the client just # comment out all routes from the server. -route = 192.168.1.0/255.255.255.0 +#route = 192.168.1.0/255.255.255.0 #route = 192.168.5.0/255.255.255.0 #route = fef4:db8:1000:1001::/64 @@ -291,17 +321,23 @@ route = 192.168.1.0/255.255.255.0 #default-select-group = DEFAULT # Instead of specifying manually all the allowed groups, you may instruct -# ocserv to scan all available groups and include the full list. +# ocserv to scan all available groups and include the full list. That +# option is only functional on plain authentication. #auto-select-group = true -# The system command to use to setup a route. %R will be replaced with the -# route/mask and %D with the (tun) device. +# The system command to use to setup a route. %{R} will be replaced with the +# route/mask and %{D} with the (tun) device. # -# The following example is from linux systems. %R should be something +# The following example is from linux systems. %{R} should be something # like 192.168.2.0/24 -route-add-cmd = "ip route add %R dev %D" -route-del-cmd = "ip route delete %R dev %D" +route-add-cmd = "ip route add %{R} dev %{D}" +route-del-cmd = "ip route delete %{R} dev %{D}" + +# This option allows to forward a proxy. The special strings '%{U}' +# and '%{G}', if present will be replaced by the username and group name. +#proxy-url = http://example.com/ +#proxy-url = http://example.com/%{U}/%{G}/hello # # The following options are for (experimental) AnyConnect client diff --git a/ocserv.spec b/ocserv.spec index e2aa87d..8dc9f4d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Name: ocserv -Version: 0.8.8 +Version: 0.8.9 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -142,6 +142,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 +- New upstream release + * Wed Nov 26 2014 Nikos Mavrogiannopoulos - 0.8.8-1 - New upstream release diff --git a/sources b/sources index 63a85e1..3900854 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -de7faa9e1658dfea0f409fcc83fcb7ff ocserv-0.8.8.tar.xz.sig -d9b12a3fa976dfda3e4c0238173744e6 ocserv-0.8.8.tar.xz +5ea9824e39ca125260b67a1379f42036 ocserv-0.8.9.tar.xz.sig +cd935cc89bffac75c825e66ef71f6a73 ocserv-0.8.9.tar.xz From e46482a0cf259e9e55ecd58d5153afdb31fc71be Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 11 Dec 2014 13:40:49 +0100 Subject: [PATCH 044/195] updated for bundled script --- ocserv.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 2d6f6f9..b754103 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -186,8 +186,8 @@ rekey-method = ssl # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # ID (a unique numeric ID); REASON may be "connect" or "disconnect". -#connect-script = /scripts/ocserv-script -#disconnect-script = /scripts/ocserv-script +#connect-script = /usr/bin/ocserv-script +#disconnect-script = /usr/bin/ocserv-script # UTMP use-utmp = true From a6a5de2d906c89b130eeb0f73786c1dc7efbcbe4 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 29 Dec 2014 13:02:34 +0200 Subject: [PATCH 045/195] Added seccomp dependency --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 8dc9f4d..c1a22a8 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -30,6 +30,7 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen +BuildRequires: libseccomp-devel BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: http-parser-devel From 14a5206c7191fe705f4af4a17058baa44e8b0c8b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 5 Jan 2015 13:55:20 +0100 Subject: [PATCH 046/195] ocserv.service: depend on network-online.target (#1178760) --- ocserv.service | 2 +- ocserv.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ocserv.service b/ocserv.service index 3f6a3e2..4fe4813 100644 --- a/ocserv.service +++ b/ocserv.service @@ -2,7 +2,7 @@ Description=OpenConnect SSL VPN server Documentation=man:ocserv(8) After=syslog.target -After=network.target +After=network-online.target After=dbus.service [Service] diff --git a/ocserv.spec b/ocserv.spec index c1a22a8..daee557 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.9 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -143,6 +143,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 +- ocserv.service: depend on network-online.target (#1178760) + * Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 - New upstream release From 8ab678bc477d4a3e56befe798c80920e015ae24e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 6 Jan 2015 10:40:15 +0100 Subject: [PATCH 047/195] disable seccomp on arm --- ocserv.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index daee557..eee476d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -78,7 +78,11 @@ touch src/*.proto %build -%configure +%configure \ +%ifarch %{arm} + --disable-seccomp \ +%endif + --enable-systemd make %{?_smp_mflags} From cbda7da2bc8e6e7ed18bd03c400932019e70e2c4 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 6 Jan 2015 11:08:22 +0100 Subject: [PATCH 048/195] mention the enabling of seccomp --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index eee476d..1a88255 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -149,6 +149,7 @@ rm -rf %{buildroot} %changelog * Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 - ocserv.service: depend on network-online.target (#1178760) +- enable seccomp * Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 - New upstream release From 0696cb0ce8a15c6948a11cc968400c5298e42bd2 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 6 Jan 2015 11:54:39 +0100 Subject: [PATCH 049/195] enable seccomp on x86 platforms only --- ocserv.spec | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 1a88255..2e3431f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -30,7 +30,9 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen +%ifarch %{ix86} x86_64 BuildRequires: libseccomp-devel +%endif BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: http-parser-devel @@ -79,9 +81,6 @@ touch src/*.proto %build %configure \ -%ifarch %{arm} - --disable-seccomp \ -%endif --enable-systemd make %{?_smp_mflags} @@ -149,7 +148,7 @@ rm -rf %{buildroot} %changelog * Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 - ocserv.service: depend on network-online.target (#1178760) -- enable seccomp +- enable seccomp (on platforms it is available) * Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 - New upstream release From a7f82c575368a44e9aaa01a9e24d89c966935f82 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 6 Jan 2015 16:38:41 +0100 Subject: [PATCH 050/195] Comply with system-wide crypto policies Resolves: rhbz#1179332 --- ocserv.conf | 3 ++- ocserv.spec | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index b754103..04e5b0e 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -131,7 +131,8 @@ ca-cert = /etc/pki/ocserv/cacerts/ca.crt #crl = /path/to/crl.pem # GnuTLS priority string -tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-ARCFOUR-128" +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-ARCFOUR-128" +tls-priorities = "@SYSTEM" # To enforce perfect forward secrecy (PFS) on the main channel. #tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" diff --git a/ocserv.spec b/ocserv.spec index 2e3431f..e428c08 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ Name: ocserv Version: 0.8.9 -Release: 2%{?dist} +Release: 3%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -146,6 +146,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Tue Jan 6 2015 Nikos Mavrogiannopoulos - 0.8.9-3 +- Comply with system-wide crypto policies (#1179332) + * Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 - ocserv.service: depend on network-online.target (#1178760) - enable seccomp (on platforms it is available) From 9a2398b5eb24cd268da6b47ff6b59687186bd0cd Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 9 Jan 2015 13:13:33 +0100 Subject: [PATCH 051/195] enable PIE --- ocserv.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index e428c08..313ea6d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,8 @@ +%global _hardened_build 1 + Name: ocserv Version: 0.8.9 -Release: 3%{?dist} +Release: 4%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -146,6 +148,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Jan 9 2015 Nikos Mavrogiannopoulos - 0.8.9-4 +- enable PIE + * Tue Jan 6 2015 Nikos Mavrogiannopoulos - 0.8.9-3 - Comply with system-wide crypto policies (#1179332) From ed496f82a18c3c918d4233881be60934e44fa360 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 13 Jan 2015 09:50:05 +0100 Subject: [PATCH 052/195] compile without support for smp to prevent issues with autogen --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 313ea6d..3e8ed6a 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -85,7 +85,7 @@ touch src/*.proto %configure \ --enable-systemd -make %{?_smp_mflags} +make #%{?_smp_mflags} %pre getent group ocserv &>/dev/null || groupadd -r ocserv From d2cb3ed97fa26118ea203109b57485e30ff5b027 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 22 Jan 2015 11:41:49 +0100 Subject: [PATCH 053/195] new upstream release --- .gitignore | 2 + ocserv.conf | 233 ++++++++++++++++++++++++++++++++++------------------ ocserv.spec | 8 +- sources | 4 +- 4 files changed, 161 insertions(+), 86 deletions(-) diff --git a/.gitignore b/.gitignore index 099ada9..0ef6c80 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ /ocserv-0.8.8.tar.xz /ocserv-0.8.9.tar.xz.sig /ocserv-0.8.9.tar.xz +/ocserv-0.9.0.tar.xz +/ocserv-0.9.0.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 04e5b0e..aa5dbaf 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,36 +1,47 @@ # User authentication method. Could be set multiple times and in # that case all should succeed. To enable multiple methods use # multiple auth directives. Available options: certificate, certificate[optional], -# plain, pam. -#auth = "certificate" -#auth = "plain[./sample.passwd]" -auth = "pam" +# plain, pam, radius[configfile,groupconfig]. -# This indicates that a user may present a certificate. When that option +# certificate: +# This indicates that all connecting users must present a certificate. +# +# certificate[optional]: +# This indicates that a user may present a certificate. When that option # is set, individual users or user groups can be forced to present a valid -# certificate by using "require-cert=true". -#auth = "certificate[optional]" - -# The gid-min option is used by auto-select-group option, in order to -# select the minimum group ID. -#auth = "pam[gid-min=1000]" - -# The plain option requires specifying a password file which contains +# certificate by adding "require-cert=true" in the per-user configuration file. +# +# pam[gid-min=1000]: +# The gid-min option is used by auto-select-group option, in order to +# select the minimum valid group ID. +# +# plain[/etc/ocserv/ocpasswd] +# The plain option requires specifying a password file which contains # entries of the following format. -# "username:groupname:encoded-password" -# One entry must be listed per line, and 'ocpasswd' can be used +# "username:groupname1,groupname2:encoded-password" +# One entry must be listed per line, and 'ocpasswd' should be used # to generate password entries. -#auth = "plain[/etc/ocserv/ocpasswd]" +# +# radius[/etc/radiusclient/radiusclient.conf,groupconfig]: +# The radius option requires specifying freeradius-client configuration +# file. If the groupconfig option is set, then config-per-user will be overriden, +# and all configuration will be read from radius. The supported atributes for +# radius configuration are: +# Group-Name, Framed-IPv6-Address, Framed-IPv6-Prefix, DNS-Server-IPv6-Address, +# Framed-IP-Address, Framed-IP-Netmask, MS-Primary-DNS-Server, MS-Secondary-DNS-Server -# Whether to enable seccomp worker isolation. That restricts the number of +#auth = "certificate" +#auth = "certificate[optional]" +auth = "pam" +#auth = "pam[gid-min=1000]" +#auth = "plain[/etc/ocserv/ocpasswd]" +#auth = "radius[/etc/radiusclient/radiusclient.conf,groupconfig]" + +# Whether to enable seccomp/Linux namespaces worker isolation. That restricts the number of # system calls allowed to a worker process, in order to reduce damage from a # bug in the worker process. It is available on Linux systems at a performance cost. -#use-seccomp = true - -# Whether to enable the authentication method's session control (i.e., PAM). -# That requires more resources on the server, and makes cookies one-time-use; -# thus don't enable unless you need it. -#session-control = true +# The performance cost is roughly 2% overhead at transfer time (tested on a Linux 3.17.8). +isolate-workers = true # A banner to be displayed on clients #banner = "Welcome" @@ -60,21 +71,34 @@ max-same-clients = 2 tcp-port = 443 udp-port = 443 -# Accept connections using a socket file. The connections are -# forwarded without SSL/TLS. -listen-clear-file = /var/run/ocserv-conn.socket +# Accept connections using a socket file. It accepts HTTP +# connections (i.e., without SSL/TLS unlike its TCP counterpart), +# and uses it as the primary channel. That option cannot be +# combined with certificate authentication. +#listen-clear-file = /var/run/ocserv-conn.socket + +# Stats report time. The number of seconds after which each +# worker process will report its usage statistics (number of +# bytes transferred etc). This is useful when accounting like +# radius is in use. +#stats-report-time = 360 # Keepalive in seconds keepalive = 32400 # Dead peer detection in seconds. +# Note that when the client is behind a NAT this value +# needs to be short enough to prevent the NAT disassociating +# his UDP session from the port number. Otherwise the client +# could have his UDP connection stalled, for several minutes. dpd = 90 -# Dead peer detection for mobile clients. The needs to -# be much higher to prevent such clients being awaken too +# Dead peer detection for mobile clients. That needs to +# be higher to prevent such clients being awaken too # often by the DPD messages, and save battery. -# (clients that send the X-AnyConnect-Identifier-DeviceType) -#mobile-dpd = 1800 +# The mobile clients are distinguished from the header +# 'X-AnyConnect-Identifier-DeviceType'. +mobile-dpd = 1800 # MTU discovery (DPD must be enabled) try-mtu-discovery = false @@ -84,8 +108,11 @@ try-mtu-discovery = false # tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user # or pkcs11:object=my-vpn-key;object-type=private) # -# There may be multiple certificate and key pairs and each key -# should correspond to the preceding certificate. +# The server-cert file may contain a single certificate, or +# a sorted certificate chain. +# +# There may be multiple server-cert and server-key directives, +# but each key should correspond to the preceding certificate. server-cert = /etc/pki/ocserv/public/server.crt server-key = /etc/pki/ocserv/private/server.key @@ -128,13 +155,29 @@ ca-cert = /etc/pki/ocserv/cacerts/ca.crt #cert-group-oid = 2.5.4.11 # The revocation list of the certificates issued by the 'ca-cert' above. +# See the manual to generate an empty CRL initially. #crl = /path/to/crl.pem -# GnuTLS priority string -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-ARCFOUR-128" +# Uncomment this to enable compression negotiation (LZS, LZ4). +#compression = true + +# Set the minimum size under which a packet will not be compressed. +# That is to allow low-latency for VoIP packets. The default size +# is 256 bytes. Modify it if the clients typically use compression +# as well of VoIP with codecs that exceed the default value. +#no-compress-limit = 256 + +# GnuTLS priority string; note that SSL 3.0 is disabled by default +# as there are no openconnect (and possibly anyconnect clients) using +# that protocol. The string below does not enforce perfect forward +# secrecy, in order to be compatible with legacy clients. +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0" tls-priorities = "@SYSTEM" -# To enforce perfect forward secrecy (PFS) on the main channel. +# More combinations in priority strings are available, check +# http://gnutls.org/manual/html_node/Priority-Strings.html +# E.g., the string below enforces perfect forward secrecy (PFS) +# on the main channel. #tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" # The time (in seconds) that a client is allowed to stay connected prior @@ -181,16 +224,25 @@ rekey-time = 172800 # option. rekey-method = ssl -# Script to call when a client connects and obtains an IP -# Parameters are passed on the environment. +# Script to call when a client connects and obtains an IP. +# The following parameters are passed on the environment. # REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), # DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), +# IPV6_LOCAL (the IPv6 local address if there are both IPv4 and IPv6 +# assigned), IPV6_REMOVE (the IPv6 remote address), and # ID (a unique numeric ID); REASON may be "connect" or "disconnect". + +# The disconnect script will receive the additional values: STATS_BYTES_IN, +# STATS_BYTES_OUT, STATS_DURATION that contain a 64-bit counter of the bytes +# output from the tun device, and the duration of the session in seconds. + #connect-script = /usr/bin/ocserv-script #disconnect-script = /usr/bin/ocserv-script # UTMP +# Register the connected clients to utmp. This will allow viewing +# the connected clients using the command 'who'. use-utmp = true # Whether to enable support for the occtl tool (i.e., either through D-BUS, @@ -201,14 +253,13 @@ use-occtl = true # if you use more than a single servers. #occtl-socket-file = /var/run/occtl.socket - # PID file. It can be overriden in the command line. #pid-file = /var/run/ocserv.pid # The default server directory. Does not require any devices present. chroot-dir = /var/lib/ocserv -# socket file used for IPC, will be appended with .PID +# socket file used for server IPC (worker-main), will be appended with .PID # It must be accessible within the chroot environment (if any) socket-file = ocserv.sock @@ -232,7 +283,7 @@ run-as-group = ocserv # Network settings # -# The name of the tun device +# The name to use for the tun device device = vpns # Whether the generated IPs will be predictable, i.e., IP stays the @@ -243,20 +294,22 @@ predictable-ips = true default-domain = example.com # The pool of addresses that leases will be given from. -ipv4-network = 192.168.1.0 -ipv4-netmask = 255.255.255.0 +#ipv4-network = 192.168.1.0 +#ipv4-netmask = 255.255.255.0 + +# An alternative way of specifying the network: +#ipv4-network = 192.168.1.0/24 # The advertized DNS server. Use multiple lines for # multiple servers. # dns = fc00::4be0 -dns = 192.168.1.2 +#dns = 192.168.1.2 # The NBNS server (if any) #nbns = 192.168.1.3 # The IPv6 subnet that leases will be given from. -#ipv6-network = fc00:: -#ipv6-prefix = 16 +#ipv6-network = fda9:4efe:7e3b:03ea::/64 # The domains over which the provided DNS should be used. Use # multiple lines for multiple domains. @@ -264,10 +317,13 @@ dns = 192.168.1.2 # Prior to leasing any IP from the pool ping it to verify that # it is not in use by another (unrelated to this server) host. +# Only set to true, if there can be occupied addresses in the +# IP range for leases. ping-leases = false -# Unset to assign the default MTU of the device -# mtu = +# Use this option to enforce an MTU value to the incoming +# connections. Unset to use the default MTU of the TUN device. +#mtu = 1420 # Unset to enable bandwidth restrictions (in bytes/sec). The # setting here is global, but can also be set per user or per group. @@ -284,84 +340,97 @@ ping-leases = false # config-per-user/group or even connect and disconnect scripts. # # To set the server as the default gateway for the client just -# comment out all routes from the server. +# comment out all routes from the server, or use the special keyword +# 'default'. + #route = 192.168.1.0/255.255.255.0 #route = 192.168.5.0/255.255.255.0 #route = fef4:db8:1000:1001::/64 +# Groups that a client is allowed to select from. +# A client may belong in multiple groups, and in certain use-cases +# it is needed to switch between them. For these cases the client can +# select prior to authentication. Add multiple entries for multiple groups. +# The group may be followed by a user-friendly name in brackets. +#select-group = group1 +#select-group = group2[My special group] + +# The name of the (virtual) group that if selected it would assign the user +# to its default group. +#default-select-group = DEFAULT + +# Instead of specifying manually all the allowed groups, you may instruct +# ocserv to scan all available groups and include the full list. +#auto-select-group = true + # Configuration files that will be applied per user connection or # per group. Each file name on these directories must match the username # or the groupname. # The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, ipv6-prefix, rx/tx-per-sec, iroute, route, -# net-priority and cgroup. +# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, +# net-priority, deny-roaming, no-udp, user-profile, require-cert, and cgroup. # # Note that the 'iroute' option allows to add routes on the server # based on a user or group. The syntax depends on the input accepted -# by the commands route-add-cmd and route-del-cmd (see below). +# by the commands route-add-cmd and route-del-cmd (see below). The no-udp +# is a boolean option (e.g., no-udp = true), and will prevent a UDP session +# for that specific user or group. #config-per-user = /etc/ocserv/config-per-user/ #config-per-group = /etc/ocserv/config-per-group/ # When config-per-xxx is specified and there is no group or user that # matches, then utilize the following configuration. - #default-user-config = /etc/ocserv/defaults/user.conf #default-group-config = /etc/ocserv/defaults/group.conf -# Groups that a client is allowed to select from. -# A client may belong in multiple groups, and in certain use-cases -# it is needed to switch between them. For these cases the client can -# select prior to authentication. Add multiple entries for multiple groups. -#select-group = group1 -#select-group = group2[My group 2] -#select-group = tost[The tost group] - -# The name of the group that if selected it would allow to use -# the assigned by default group. -#default-select-group = DEFAULT - -# Instead of specifying manually all the allowed groups, you may instruct -# ocserv to scan all available groups and include the full list. That -# option is only functional on plain authentication. -#auto-select-group = true +# This option is only valid in a user/group configuration file. If the +# auth mode is certificate[optional], it requires a certificate for this +# particular user or group. +#require-cert = true # The system command to use to setup a route. %{R} will be replaced with the # route/mask and %{D} with the (tun) device. # -# The following example is from linux systems. %{R} should be something -# like 192.168.2.0/24 +# The following example is from linux systems. %R should be something +# like 192.168.2.0/24 (the argument of iroute). route-add-cmd = "ip route add %{R} dev %{D}" route-del-cmd = "ip route delete %{R} dev %{D}" -# This option allows to forward a proxy. The special strings '%{U}' +# This option allows to forward a proxy. The special keywords '%{U}' # and '%{G}', if present will be replaced by the username and group name. #proxy-url = http://example.com/ -#proxy-url = http://example.com/%{U}/%{G}/hello +#proxy-url = http://example.com/%{U}/ # # The following options are for (experimental) AnyConnect client # compatibility. +# This option must be set to true to support legacy CISCO clients. +# A side effect of this option is that it will no longer be required +# for clients to present their certificate on every connection. +# That is they may resume a cookie without presenting a certificate +# (when certificate authentication is used). +cisco-client-compat = true + # Client profile xml. A sample file exists in doc/profile.xml. +# It is required by some of the CISCO clients. # This file must be accessible from inside the worker's chroot. -# It is not used by the openconnect client. user-profile = profile.xml # Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. +# be within any chroot environment. Normally you don't need +# to use this option. #binary-files = /path/to/binaries -# Unless set to false it is required for clients to present their -# certificate even if they are authenticating via a previously granted -# cookie and complete their authentication in the same TCP connection. -# Legacy CISCO clients do not do that, and thus this option should be -# set for them. -cisco-client-compat = true - #Advanced options # Option to allow sending arbitrary custom headers to the client after -# authentication and prior to VPN tunnel establishment. +# authentication and prior to VPN tunnel establishment. You shouldn't +# need to use this option normally; if you do and you think that +# this may help others, please send your settings and reason to +# the openconnect mailing list. The special keywords '%{U}' +# and '%{G}', if present will be replaced by the username and group name. #custom-header = "X-My-Header: hi there" + diff --git a/ocserv.spec b/ocserv.spec index 3e8ed6a..6908137 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.8.9 -Release: 4%{?dist} +Version: 0.9.0 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -32,6 +32,7 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen +BuildRequires: gperf %ifarch %{ix86} x86_64 BuildRequires: libseccomp-devel %endif @@ -148,6 +149,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jan 22 2015 Nikos Mavrogiannopoulos - 0.9.0-1 +- new upstream release + * Fri Jan 9 2015 Nikos Mavrogiannopoulos - 0.8.9-4 - enable PIE diff --git a/sources b/sources index 3900854..cb7074e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -5ea9824e39ca125260b67a1379f42036 ocserv-0.8.9.tar.xz.sig -cd935cc89bffac75c825e66ef71f6a73 ocserv-0.8.9.tar.xz +50994bf7e40fd6bedda33bb2f99b1f11 ocserv-0.9.0.tar.xz +62942bdda7e101c0049622c68fd13dd4 ocserv-0.9.0.tar.xz.sig From 612fa73824993c929805b221624cab2922295266 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 29 Jan 2015 14:08:58 +0100 Subject: [PATCH 054/195] Do not enable seccomp in x86. It is broken. --- ocserv.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 6908137..8b22302 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.9.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -33,7 +33,7 @@ BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen BuildRequires: gperf -%ifarch %{ix86} x86_64 +%ifarch x86_64 #%{ix86} BuildRequires: libseccomp-devel %endif BuildRequires: pcllib-devel @@ -149,6 +149,10 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jan 29 2015 Nikos Mavrogiannopoulos - 0.9.0-2 +- only enable seccomp in x86-64. It seems to be broken in x86: + http://sourceforge.net/p/libseccomp/mailman/message/33275762/ + * Thu Jan 22 2015 Nikos Mavrogiannopoulos - 0.9.0-1 - new upstream release From 4fdbcb2406340261fc7e76c3f774de2fbac93cab Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 29 Jan 2015 14:09:41 +0100 Subject: [PATCH 055/195] run make check --- ocserv.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index 8b22302..18362fa 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -97,6 +97,9 @@ mkdir -p %{_sysconfdir}/pki/ocserv/public mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts +%check +make check %{?_smp_mflags} + %post %systemd_post ocserv.service From e4fe6e80bfa43aed425551071cf3fb9a5dbf85db Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 16 Feb 2015 10:45:16 +0100 Subject: [PATCH 056/195] updated to 0.9.1 --- .gitignore | 2 ++ ocserv.conf | 25 +++++++++---------------- ocserv.spec | 9 ++++++--- sources | 4 ++-- 4 files changed, 19 insertions(+), 21 deletions(-) diff --git a/.gitignore b/.gitignore index 0ef6c80..291a6a8 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,5 @@ /ocserv-0.8.9.tar.xz /ocserv-0.9.0.tar.xz /ocserv-0.9.0.tar.xz.sig +/ocserv-0.9.1.tar.xz.sig +/ocserv-0.9.1.tar.xz diff --git a/ocserv.conf b/ocserv.conf index aa5dbaf..20da17f 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,16 +1,11 @@ # User authentication method. Could be set multiple times and in # that case all should succeed. To enable multiple methods use -# multiple auth directives. Available options: certificate, certificate[optional], +# multiple auth directives. Available options: certificate, # plain, pam, radius[configfile,groupconfig]. # certificate: # This indicates that all connecting users must present a certificate. # -# certificate[optional]: -# This indicates that a user may present a certificate. When that option -# is set, individual users or user groups can be forced to present a valid -# certificate by adding "require-cert=true" in the per-user configuration file. -# # pam[gid-min=1000]: # The gid-min option is used by auto-select-group option, in order to # select the minimum valid group ID. @@ -31,7 +26,6 @@ # Framed-IP-Address, Framed-IP-Netmask, MS-Primary-DNS-Server, MS-Secondary-DNS-Server #auth = "certificate" -#auth = "certificate[optional]" auth = "pam" #auth = "pam[gid-min=1000]" #auth = "plain[/etc/ocserv/ocpasswd]" @@ -293,13 +287,20 @@ predictable-ips = true # The default domain to be advertised default-domain = example.com -# The pool of addresses that leases will be given from. +# The pool of addresses that leases will be given from. If the leases +# are given via Radius, or via explicit-ip? per-user config option then +# these network values should contain a network with at least a single +# address that will remain under the full control of ocserv (that is +# to be able to assign the local part of the tun device address). #ipv4-network = 192.168.1.0 #ipv4-netmask = 255.255.255.0 # An alternative way of specifying the network: #ipv4-network = 192.168.1.0/24 +# The IPv6 subnet that leases will be given from. +#ipv6-network = fda9:4efe:7e3b:03ea::/64 + # The advertized DNS server. Use multiple lines for # multiple servers. # dns = fc00::4be0 @@ -308,9 +309,6 @@ default-domain = example.com # The NBNS server (if any) #nbns = 192.168.1.3 -# The IPv6 subnet that leases will be given from. -#ipv6-network = fda9:4efe:7e3b:03ea::/64 - # The domains over which the provided DNS should be used. Use # multiple lines for multiple domains. #split-dns = example.com @@ -384,11 +382,6 @@ ping-leases = false #default-user-config = /etc/ocserv/defaults/user.conf #default-group-config = /etc/ocserv/defaults/group.conf -# This option is only valid in a user/group configuration file. If the -# auth mode is certificate[optional], it requires a certificate for this -# particular user or group. -#require-cert = true - # The system command to use to setup a route. %{R} will be replaced with the # route/mask and %{D} with the (tun) device. # diff --git a/ocserv.spec b/ocserv.spec index 18362fa..c8bf84c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.9.0 -Release: 2%{?dist} +Version: 0.9.1 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -33,7 +33,7 @@ BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen BuildRequires: gperf -%ifarch x86_64 #%{ix86} +%ifarch x86_64 %{ix86} BuildRequires: libseccomp-devel %endif BuildRequires: pcllib-devel @@ -152,6 +152,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Feb 16 2015 Nikos Mavrogiannopoulos - 0.9.1-1 +- new upstream release + * Thu Jan 29 2015 Nikos Mavrogiannopoulos - 0.9.0-2 - only enable seccomp in x86-64. It seems to be broken in x86: http://sourceforge.net/p/libseccomp/mailman/message/33275762/ diff --git a/sources b/sources index cb7074e..7c25dd1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -50994bf7e40fd6bedda33bb2f99b1f11 ocserv-0.9.0.tar.xz -62942bdda7e101c0049622c68fd13dd4 ocserv-0.9.0.tar.xz.sig +c7e0d60139372b9fbb866cd271ded8c4 ocserv-0.9.1.tar.xz.sig +5dee08e1386258a32a73caf2cb47749c ocserv-0.9.1.tar.xz From 79f0b3bec8588320d56633dc8bdf67d4c1595165 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 16 Feb 2015 10:56:29 +0100 Subject: [PATCH 057/195] depend on freeradius-client --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index c8bf84c..561d586 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -41,6 +41,7 @@ BuildRequires: libtalloc-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf +BuildRequires: freeradius-client-devel # we don't build with dbus support #BuildRequires: dbus-devel From 8a7554ecc8a9bef1fb924a25c020cec4bd2a1f28 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Mon, 16 Feb 2015 15:46:32 +0000 Subject: [PATCH 058/195] aarch64 (and ARMv7) now has seccomp support --- ocserv.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 561d586..57f5142 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.9.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -33,7 +33,7 @@ BuildRequires: libnl3-devel BuildRequires: readline-devel BuildRequires: autogen BuildRequires: gperf -%ifarch x86_64 %{ix86} +%ifarch x86_64 %{ix86} %{arm} aarch64 BuildRequires: libseccomp-devel %endif BuildRequires: pcllib-devel @@ -153,6 +153,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Feb 16 2015 Peter Robinson 0.9.1-2 +- aarch64 (and ARMv7) now has seccomp support + * Mon Feb 16 2015 Nikos Mavrogiannopoulos - 0.9.1-1 - new upstream release From e4b15cba33f52ce988571ea64014117cda037371 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 18 Feb 2015 10:29:58 +0100 Subject: [PATCH 059/195] new upstream release --- .gitignore | 2 ++ ocserv.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 291a6a8..d3675b5 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,5 @@ /ocserv-0.9.0.tar.xz.sig /ocserv-0.9.1.tar.xz.sig /ocserv-0.9.1.tar.xz +/ocserv-0.9.2.tar.xz.sig +/ocserv-0.9.2.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 57f5142..e7b76a7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.9.1 -Release: 2%{?dist} +Version: 0.9.2 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -42,6 +42,7 @@ BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf BuildRequires: freeradius-client-devel +BuildRequires: lz4-devel # we don't build with dbus support #BuildRequires: dbus-devel @@ -153,6 +154,10 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Wed Feb 18 2015 Nikos Mavrogiannopoulos - 0.9.2-1 +- new upstream release +- enabled lz4 compression + * Mon Feb 16 2015 Peter Robinson 0.9.1-2 - aarch64 (and ARMv7) now has seccomp support diff --git a/sources b/sources index 7c25dd1..4eb3751 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -c7e0d60139372b9fbb866cd271ded8c4 ocserv-0.9.1.tar.xz.sig -5dee08e1386258a32a73caf2cb47749c ocserv-0.9.1.tar.xz +141166419dc5845530fe40415eee1cab ocserv-0.9.2.tar.xz.sig +9697c37cc81b30be2b178258ee595d97 ocserv-0.9.2.tar.xz From cf5f1ccc88b20905878ed27b317649fc04df1f93 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 11 Mar 2015 09:55:21 +0100 Subject: [PATCH 060/195] updated to 0.10.0 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d3675b5..ae69654 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,5 @@ /ocserv-0.9.1.tar.xz /ocserv-0.9.2.tar.xz.sig /ocserv-0.9.2.tar.xz +/ocserv-0.10.0.tar.xz.sig +/ocserv-0.10.0.tar.xz diff --git a/ocserv.spec b/ocserv.spec index e7b76a7..ac9b730 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.9.2 +Version: 0.10.0 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -154,6 +154,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Wed Mar 11 2015 Nikos Mavrogiannopoulos - 0.10.0-1 +- new upstream release + * Wed Feb 18 2015 Nikos Mavrogiannopoulos - 0.9.2-1 - new upstream release - enabled lz4 compression diff --git a/sources b/sources index 4eb3751..900e27f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -141166419dc5845530fe40415eee1cab ocserv-0.9.2.tar.xz.sig -9697c37cc81b30be2b178258ee595d97 ocserv-0.9.2.tar.xz +be821b0428ce05634727c5823227f88f ocserv-0.10.0.tar.xz.sig +7ad50983a75c88da4c2fddd8f670584e ocserv-0.10.0.tar.xz From aa24be214d6505210234880a93cf50bda191c2ad Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 11 Mar 2015 10:12:51 +0100 Subject: [PATCH 061/195] updated dependencies and files for 0.10.0 --- ocserv.conf | 197 +++++++++++++++++++++++++++++++++++++--------------- ocserv.spec | 2 + 2 files changed, 144 insertions(+), 55 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 20da17f..b0982e6 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,56 +1,62 @@ # User authentication method. Could be set multiple times and in # that case all should succeed. To enable multiple methods use -# multiple auth directives. Available options: certificate, -# plain, pam, radius[configfile,groupconfig]. +# multiple auth directives. Available options: certificate, +# plain, pam, radius, gssapi. +# +# Note that authentication methods cannot be changed with reload. # certificate: # This indicates that all connecting users must present a certificate. # # pam[gid-min=1000]: -# The gid-min option is used by auto-select-group option, in order to -# select the minimum valid group ID. +# This enabled PAM authentication of the user. The gid-min option is used +# by auto-select-group option, in order to select the minimum valid group ID. # -# plain[/etc/ocserv/ocpasswd] +# plain[passwd=/etc/ocserv/ocpasswd] # The plain option requires specifying a password file which contains # entries of the following format. # "username:groupname1,groupname2:encoded-password" # One entry must be listed per line, and 'ocpasswd' should be used # to generate password entries. # -# radius[/etc/radiusclient/radiusclient.conf,groupconfig]: +# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name]: # The radius option requires specifying freeradius-client configuration # file. If the groupconfig option is set, then config-per-user will be overriden, # and all configuration will be read from radius. The supported atributes for # radius configuration are: # Group-Name, Framed-IPv6-Address, Framed-IPv6-Prefix, DNS-Server-IPv6-Address, # Framed-IP-Address, Framed-IP-Netmask, MS-Primary-DNS-Server, MS-Secondary-DNS-Server +# +# gssapi[keytab=/etc/key.tab,require-local-user-map=false] +# The gssapi option allows to use authentication methods supported by GSSAPI, +# such as Kerberos tickets with ocserv. It should be best used as an alternative +# to PAM (i.e., have pam in auth and gssapi in enable-auth), to allow users with +# tickets and without tickets to login. The default value for require-local-user-map +# is true. -#auth = "certificate" auth = "pam" #auth = "pam[gid-min=1000]" -#auth = "plain[/etc/ocserv/ocpasswd]" -#auth = "radius[/etc/radiusclient/radiusclient.conf,groupconfig]" +#auth = "plain[passwd=./sample.passwd]" +#auth = "certificate" +#auth = "radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true]" -# Whether to enable seccomp/Linux namespaces worker isolation. That restricts the number of -# system calls allowed to a worker process, in order to reduce damage from a -# bug in the worker process. It is available on Linux systems at a performance cost. -# The performance cost is roughly 2% overhead at transfer time (tested on a Linux 3.17.8). -isolate-workers = true +# Specify alternative authentication methods that are sufficient +# for authentication. That is, if set, any of the methods enabled +# will be sufficient to login. +#enable-auth = certificate +#enable-auth = gssapi +#enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true]" -# A banner to be displayed on clients -#banner = "Welcome" - -# Limit the number of clients. Unset or set to zero for unlimited. -#max-clients = 1024 -max-clients = 16 - -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 - -# Limit the number of identical clients (i.e., users connecting -# multiple times). Unset or set to zero for unlimited. -max-same-clients = 2 +# Accounting methods available: +# pam: can only be combined with PAM authentication method, it provides +# a session opened using PAM. +# +# radius: can be combined with any authentication method, it provides +# radius accounting to available users (see also stats-report-time). +# +# Only one accounting method can be specified. +#acct = "pam" +#acct = "radius[config=/etc/radiusclient/radiusclient.conf]" # Use listen-host to limit to specific IPs or to the IPs of a provided # hostname. @@ -71,6 +77,53 @@ udp-port = 443 # combined with certificate authentication. #listen-clear-file = /var/run/ocserv-conn.socket +# The user the worker processes will be run as. It should be +# unique (no other services run as this user). +run-as-user = ocserv +run-as-group = ocserv + +# socket file used for IPC with occtl. You only need to set that, +# if you use more than a single servers. +#occtl-socket-file = /var/run/occtl.socket + +# socket file used for server IPC (worker-main), will be appended with .PID +# It must be accessible within the chroot environment (if any), so it is best +# specified relatively to the chroot directory. +socket-file = ocserv.sock + +# The default server directory. Does not require any devices present. +chroot-dir = /var/lib/ocserv + + +### All configuration options below this line are reloaded on a SIGHUP. +### The options above, will remain unchanged. + +# Whether to enable seccomp/Linux namespaces worker isolation. That restricts the number of +# system calls allowed to a worker process, in order to reduce damage from a +# bug in the worker process. It is available on Linux systems at a performance cost. +# The performance cost is roughly 2% overhead at transfer time (tested on a Linux 3.17.8). +isolate-workers = true + +# A banner to be displayed on clients +#banner = "Welcome" + +# Limit the number of clients. Unset or set to zero for unlimited. +#max-clients = 1024 +max-clients = 16 + +# Limit the number of identical clients (i.e., users connecting +# multiple times). Unset or set to zero for unlimited. +max-same-clients = 2 + +# When the server has a dynamic DNS address (that may change), +# should set that to true to ask the client to resolve again on +# reconnects. +#listen-host-is-dyndns = true + +# Limit the number of client connections to one every X milliseconds +# (X is the provided value). Set to zero for no limit. +#rate-limit-ms = 100 + # Stats report time. The number of seconds after which each # worker process will report its usage statistics (number of # bytes transferred etc). This is useful when accounting like @@ -140,7 +193,7 @@ ca-cert = /etc/pki/ocserv/cacerts/ca.crt # certificate. The object identifier should be part of the certificate's DN # Useful OIDs are: # CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 -#cert-user-oid = 0.9.2342.19200300.100.1.1 +cert-user-oid = 0.9.2342.19200300.100.1.1 # The object identifier that will be used to read the user group in the # client certificate. The object identifier should be part of the certificate's @@ -165,7 +218,17 @@ ca-cert = /etc/pki/ocserv/cacerts/ca.crt # as there are no openconnect (and possibly anyconnect clients) using # that protocol. The string below does not enforce perfect forward # secrecy, in order to be compatible with legacy clients. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0" +# +# Note that the most performant ciphersuites are the moment are the ones +# involving AES-GCM. These are very fast in x86 and x86-64 hardware, and +# in addition require no padding, thus taking full advantage of the MTU. +# For that to be taken advantage of, the openconnect client must be +# used, and the server must be compiled against GnuTLS 3.2.7 or later. +# Use "gnutls-cli --benchmark-tls-ciphers", to see the performance +# difference with AES_128_CBC_SHA1 (the default for anyconnect clients) +# in your system. + +#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" tls-priorities = "@SYSTEM" # More combinations in priority strings are available, check @@ -188,7 +251,28 @@ auth-timeout = 40 # The time (in seconds) that a client is not allowed to reconnect after # a failed authentication attempt. -#min-reauth-time = 2 +min-reauth-time = 300 + +# Banning clients in ocserv works with a point system. IP addresses +# that get a score over that configured number are banned for +# min-reauth-time seconds. By default a wrong password attempt is 10 points, +# a KKDCP POST is 1 point, and a connection is 1 point. Note that +# due to difference processes being involved the count of points +# will not be real-time precise. +# +# Score banning cannot be reliably used when receiving proxied connections +# locally from an HTTP server (i.e., when listen-clear-file is used). +# +# Set to zero to disable. +max-ban-score = 50 + +# The time (in seconds) that all score kept for a client is reset. +ban-reset-time = 300 + +# In case you'd like to change the default points. +#ban-points-wrong-password = 10 +#ban-points-connection = 1 +#ban-points-kkdcp = 1 # Cookie timeout (in seconds) # Once a client is authenticated he's provided a cookie with @@ -237,30 +321,14 @@ rekey-method = ssl # UTMP # Register the connected clients to utmp. This will allow viewing # the connected clients using the command 'who'. -use-utmp = true +#use-utmp = true # Whether to enable support for the occtl tool (i.e., either through D-BUS, # or via a unix socket). use-occtl = true -# socket file used for IPC with occtl. You only need to set that, -# if you use more than a single servers. -#occtl-socket-file = /var/run/occtl.socket - # PID file. It can be overriden in the command line. -#pid-file = /var/run/ocserv.pid - -# The default server directory. Does not require any devices present. -chroot-dir = /var/lib/ocserv - -# socket file used for server IPC (worker-main), will be appended with .PID -# It must be accessible within the chroot environment (if any) -socket-file = ocserv.sock - -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). -run-as-user = ocserv -run-as-group = ocserv +pid-file = /var/run/ocserv.pid # Set the protocol-defined priority (SO_PRIORITY) for packets to # be sent. That is a number from 0 to 6 with 0 being the lowest @@ -288,7 +356,7 @@ predictable-ips = true default-domain = example.com # The pool of addresses that leases will be given from. If the leases -# are given via Radius, or via explicit-ip? per-user config option then +# are given via Radius, or via the explicit-ip? per-user config option then # these network values should contain a network with at least a single # address that will remain under the full control of ocserv (that is # to be able to assign the local part of the tun device address). @@ -341,10 +409,15 @@ ping-leases = false # comment out all routes from the server, or use the special keyword # 'default'. -#route = 192.168.1.0/255.255.255.0 -#route = 192.168.5.0/255.255.255.0 +#route = 10.10.10.0/255.255.255.0 +#route = 192.168.0.0/255.255.0.0 #route = fef4:db8:1000:1001::/64 +# Subsets of the routes above that will not be routed by +# the server. + +#no-route = 192.168.5.0/255.255.255.0 + # Groups that a client is allowed to select from. # A client may belong in multiple groups, and in certain use-cases # it is needed to switch between them. For these cases the client can @@ -366,7 +439,7 @@ ping-leases = false # or the groupname. # The options allowed in the configuration files are dns, nbns, # ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, -# net-priority, deny-roaming, no-udp, user-profile, require-cert, and cgroup. +# net-priority, deny-roaming, no-udp, user-profile, and cgroup. # # Note that the 'iroute' option allows to add routes on the server # based on a user or group. The syntax depends on the input accepted @@ -388,14 +461,28 @@ ping-leases = false # The following example is from linux systems. %R should be something # like 192.168.2.0/24 (the argument of iroute). -route-add-cmd = "ip route add %{R} dev %{D}" -route-del-cmd = "ip route delete %{R} dev %{D}" +#route-add-cmd = "ip route add %{R} dev %{D}" +#route-del-cmd = "ip route delete %{R} dev %{D}" # This option allows to forward a proxy. The special keywords '%{U}' # and '%{G}', if present will be replaced by the username and group name. #proxy-url = http://example.com/ #proxy-url = http://example.com/%{U}/ +# This option allows you to specify a URL location where a client can +# post using MS-KKDCP, and the message will be forwarded to the provided +# KDC server. That is a translation URL between HTTP and Kerberos. +# In MIT kerberos you'll need to add in realms: +# EXAMPLE.COM = { +# kdc = https://ocserv.example.com/kerberos +# http_anchors = FILE:/etc/ocserv-ca.pem +# } +# This option is available if ocserv is compiled with GSSAPI support. + +#kkdcp = SERVER-PATH KERBEROS-REALM PROTOCOL@SERVER:PORT +#kkdcp = /kerberos EXAMPLE.COM udp@127.0.0.1:88 +#kkdcp = /kerberos-tcp EXAMPLE.COM tcp@127.0.0.1:88 + # # The following options are for (experimental) AnyConnect client # compatibility. diff --git a/ocserv.spec b/ocserv.spec index ac9b730..8552839 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -30,6 +30,8 @@ BuildRequires: systemd-devel BuildRequires: autogen-libopts-devel BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel +BuildRequires: krb5-devel +BuildRequires: libtasn1-devel BuildRequires: readline-devel BuildRequires: autogen BuildRequires: gperf From be4d4a16a6e0f67728e1fe0e38fc1c3b6368cc89 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 16 Mar 2015 10:08:13 +0100 Subject: [PATCH 062/195] updated to 0.10.1 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ae69654..bb93f8a 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,5 @@ /ocserv-0.9.2.tar.xz /ocserv-0.10.0.tar.xz.sig /ocserv-0.10.0.tar.xz +/ocserv-0.10.1.tar.xz.sig +/ocserv-0.10.1.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 8552839..6f15685 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.0 +Version: 0.10.1 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -156,6 +156,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Mar 16 2015 Nikos Mavrogiannopoulos - 0.10.1-1 +- new upstream release + * Wed Mar 11 2015 Nikos Mavrogiannopoulos - 0.10.0-1 - new upstream release diff --git a/sources b/sources index 900e27f..042fd93 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -be821b0428ce05634727c5823227f88f ocserv-0.10.0.tar.xz.sig -7ad50983a75c88da4c2fddd8f670584e ocserv-0.10.0.tar.xz +bea711b4ed8784cd503de4f654a65f1f ocserv-0.10.1.tar.xz.sig +d39c3101f73fdc785a7c2cbdb00c40fd ocserv-0.10.1.tar.xz From a87bbc763a566430db3a0ab022d3268576d79d8f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 30 Mar 2015 10:12:18 +0200 Subject: [PATCH 063/195] new upstream release --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index bb93f8a..2da4313 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,5 @@ /ocserv-0.10.0.tar.xz /ocserv-0.10.1.tar.xz.sig /ocserv-0.10.1.tar.xz +/ocserv-0.10.2.tar.xz.sig +/ocserv-0.10.2.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 6f15685..06034dc 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.1 +Version: 0.10.2 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -156,6 +156,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Mar 30 2015 Nikos Mavrogiannopoulos - 0.10.2-1 +- new upstream release + * Mon Mar 16 2015 Nikos Mavrogiannopoulos - 0.10.1-1 - new upstream release diff --git a/sources b/sources index 042fd93..ca1ec98 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -bea711b4ed8784cd503de4f654a65f1f ocserv-0.10.1.tar.xz.sig -d39c3101f73fdc785a7c2cbdb00c40fd ocserv-0.10.1.tar.xz +5caf016f3d2362ec567bef4861d65d1b ocserv-0.10.2.tar.xz.sig +32ce2c2a00a97ab7c27e571aae207b2d ocserv-0.10.2.tar.xz From d20bd2e9105997abc7fd36daaa65d41afa79330c Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 27 Apr 2015 10:11:00 +0200 Subject: [PATCH 064/195] new upstream release Resolves: rhbz#1215326 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2da4313..d392fba 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,5 @@ /ocserv-0.10.1.tar.xz /ocserv-0.10.2.tar.xz.sig /ocserv-0.10.2.tar.xz +/ocserv-0.10.4.tar.xz.sig +/ocserv-0.10.4.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 06034dc..d5a267d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.2 +Version: 0.10.4 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -156,6 +156,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Apr 27 2015 Nikos Mavrogiannopoulos - 0.10.4-1 +- new upstream release + * Mon Mar 30 2015 Nikos Mavrogiannopoulos - 0.10.2-1 - new upstream release diff --git a/sources b/sources index ca1ec98..60962f6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -5caf016f3d2362ec567bef4861d65d1b ocserv-0.10.2.tar.xz.sig -32ce2c2a00a97ab7c27e571aae207b2d ocserv-0.10.2.tar.xz +6605003c40a206698f90475f9aa2a548 ocserv-0.10.4.tar.xz.sig +6df31778642320ea7b90f314c4c9a897 ocserv-0.10.4.tar.xz From ccd9d004a3d91f4314f8252b1bcd7ce73ee7a982 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 25 May 2015 10:18:24 +0200 Subject: [PATCH 065/195] updated to 0.10.5 Resolves: rhbz#1215326 --- .gitignore | 2 ++ ocserv.conf | 38 ++++++++++++++++++++++---------------- ocserv.spec | 5 ++++- sources | 4 ++-- 4 files changed, 30 insertions(+), 19 deletions(-) diff --git a/.gitignore b/.gitignore index d392fba..183bef7 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,5 @@ /ocserv-0.10.2.tar.xz /ocserv-0.10.4.tar.xz.sig /ocserv-0.10.4.tar.xz +/ocserv-0.10.5.tar.xz.sig +/ocserv-0.10.5.tar.xz diff --git a/ocserv.conf b/ocserv.conf index b0982e6..035d9ba 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -19,20 +19,20 @@ # One entry must be listed per line, and 'ocpasswd' should be used # to generate password entries. # -# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name]: +# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name,override-interim-updates=false]: # The radius option requires specifying freeradius-client configuration # file. If the groupconfig option is set, then config-per-user will be overriden, -# and all configuration will be read from radius. The supported atributes for -# radius configuration are: -# Group-Name, Framed-IPv6-Address, Framed-IPv6-Prefix, DNS-Server-IPv6-Address, -# Framed-IP-Address, Framed-IP-Netmask, MS-Primary-DNS-Server, MS-Secondary-DNS-Server +# and all configuration will be read from radius. The 'override-interim-updates' if set to +# true will ignore Acct-Interim-Interval from the server and 'stats-report-time' will be considered. # -# gssapi[keytab=/etc/key.tab,require-local-user-map=false] +# gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900] # The gssapi option allows to use authentication methods supported by GSSAPI, # such as Kerberos tickets with ocserv. It should be best used as an alternative # to PAM (i.e., have pam in auth and gssapi in enable-auth), to allow users with # tickets and without tickets to login. The default value for require-local-user-map -# is true. +# is true. The 'tgt-freshness-time' if set, it would require the TGT tickets presented +# to have been issued within the provided number of seconds. That option is used to +# restrict logins even if the KDC provides long time TGT tickets. auth = "pam" #auth = "pam[gid-min=1000]" @@ -45,7 +45,7 @@ auth = "pam" # will be sufficient to login. #enable-auth = certificate #enable-auth = gssapi -#enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true]" +#enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]" # Accounting methods available: # pam: can only be combined with PAM authentication method, it provides @@ -245,6 +245,10 @@ auth-timeout = 40 # before being disconnected. Unset to disable. #idle-timeout = 1200 +# The time (in seconds) that a client is allowed to stay connected +# Unset to disable. +#session-timeout = 86400 + # The time (in seconds) that a mobile client is allowed to stay idle (no # traffic) before being disconnected. Unset to disable. #mobile-idle-timeout = 2400 @@ -283,6 +287,11 @@ ban-reset-time = 300 # between different networks. cookie-timeout = 300 +# If this is enabled (not recommended) the cookies will stay +# valid even after a user manually disconnects, and until they +# expire. This may improve roaming with some broken clients. +#persistent-cookies = true + # Whether roaming is allowed, i.e., if true a cookie is # restricted to a single IP address and cannot be re-used # from a different IP. @@ -290,7 +299,8 @@ deny-roaming = false # ReKey time (in seconds) # ocserv will ask the client to refresh keys periodically once -# this amount of seconds is elapsed. Set to zero to disable. +# this amount of seconds is elapsed. Set to zero to disable (note +# that, some clients fail if rekey is disabled). rekey-time = 172800 # ReKey method @@ -438,8 +448,9 @@ ping-leases = false # per group. Each file name on these directories must match the username # or the groupname. # The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, -# net-priority, deny-roaming, no-udp, user-profile, and cgroup. +# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, no-route, +# explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, +# user-profile, cgroup, stats-report-time, and session-timeout. # # Note that the 'iroute' option allows to add routes on the server # based on a user or group. The syntax depends on the input accepted @@ -499,11 +510,6 @@ cisco-client-compat = true # This file must be accessible from inside the worker's chroot. user-profile = profile.xml -# Binary files that may be downloaded by the CISCO client. Must -# be within any chroot environment. Normally you don't need -# to use this option. -#binary-files = /path/to/binaries - #Advanced options # Option to allow sending arbitrary custom headers to the client after diff --git a/ocserv.spec b/ocserv.spec index d5a267d..56a3e82 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.4 +Version: 0.10.5 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -156,6 +156,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon May 25 2015 Nikos Mavrogiannopoulos - 0.10.5-1 +- new upstream release (#1215326) + * Mon Apr 27 2015 Nikos Mavrogiannopoulos - 0.10.4-1 - new upstream release diff --git a/sources b/sources index 60962f6..30c22ea 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -6605003c40a206698f90475f9aa2a548 ocserv-0.10.4.tar.xz.sig -6df31778642320ea7b90f314c4c9a897 ocserv-0.10.4.tar.xz +7396cedfa7071a4c6d5d243435ce663c ocserv-0.10.5.tar.xz.sig +17ee861f352d6ef7cd33114819b215ba ocserv-0.10.5.tar.xz From a1e5ef5b4c4b8105257e68164cf903e0f9b26aa0 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Wed, 17 Jun 2015 23:38:25 +0000 Subject: [PATCH 066/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 56a3e82..855317d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.10.5 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -156,6 +156,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Wed Jun 17 2015 Fedora Release Engineering - 0.10.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + * Mon May 25 2015 Nikos Mavrogiannopoulos - 0.10.5-1 - new upstream release (#1215326) From f9e76556f8a0f6f6c424ea5f07d3e854e5857714 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 2 Jul 2015 09:34:01 +0200 Subject: [PATCH 067/195] updated to 0.10.6 Resolves: rhbz#1238499 --- .gitignore | 18 +++--------------- ocserv.conf | 15 ++++++++++++--- ocserv.spec | 7 +++++-- sources | 4 ++-- 4 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.gitignore b/.gitignore index 183bef7..4842a17 100644 --- a/.gitignore +++ b/.gitignore @@ -22,19 +22,7 @@ /ocserv-0.8.8.tar.xz /ocserv-0.8.9.tar.xz.sig /ocserv-0.8.9.tar.xz -/ocserv-0.9.0.tar.xz -/ocserv-0.9.0.tar.xz.sig -/ocserv-0.9.1.tar.xz.sig -/ocserv-0.9.1.tar.xz -/ocserv-0.9.2.tar.xz.sig -/ocserv-0.9.2.tar.xz -/ocserv-0.10.0.tar.xz.sig -/ocserv-0.10.0.tar.xz -/ocserv-0.10.1.tar.xz.sig -/ocserv-0.10.1.tar.xz -/ocserv-0.10.2.tar.xz.sig /ocserv-0.10.2.tar.xz -/ocserv-0.10.4.tar.xz.sig -/ocserv-0.10.4.tar.xz -/ocserv-0.10.5.tar.xz.sig -/ocserv-0.10.5.tar.xz +/ocserv-0.10.2.tar.xz.sig +/ocserv-0.10.6.tar.xz +/ocserv-0.10.6.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 035d9ba..6f64efa 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -43,8 +43,8 @@ auth = "pam" # Specify alternative authentication methods that are sufficient # for authentication. That is, if set, any of the methods enabled # will be sufficient to login. -#enable-auth = certificate -#enable-auth = gssapi +#enable-auth = "certificate" +#enable-auth = "gssapi" #enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]" # Accounting methods available: @@ -178,12 +178,21 @@ server-key = /etc/pki/ocserv/private/server.key # Make sure that you replace the following file in an atomic way. #ocsp-response = /path/to/ocsp.der -# In case PKCS #11 or TPM keys are used the PINs should be available +# In case PKCS #11, TPM or encrypted keys are used the PINs should be available # in files. The srk-pin-file is applicable to TPM keys only, and is the # storage root key. #pin-file = /path/to/pin.txt #srk-pin-file = /path/to/srkpin.txt +# The password or PIN needed to unlock the key in server-key file. +# Only needed if the file is encrypted or a PKCS #11 object. This +# is an alternative method to pin-file. +#key-pin = 1234 + +# The SRK PIN for TPM. +# This is an alternative method to srk-pin-file. +#srk-pin = 1234 + # The Certificate Authority that will be used to verify # client certificates (public keys) if certificate authentication # is set. diff --git a/ocserv.spec b/ocserv.spec index 855317d..8364436 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.5 -Release: 2%{?dist} +Version: 0.10.6 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -156,6 +156,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jul 2 2015 Nikos Mavrogiannopoulos - 0.10.6-1 +- new upstream release (#1238499) + * Wed Jun 17 2015 Fedora Release Engineering - 0.10.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild diff --git a/sources b/sources index 30c22ea..1496e43 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -7396cedfa7071a4c6d5d243435ce663c ocserv-0.10.5.tar.xz.sig -17ee861f352d6ef7cd33114819b215ba ocserv-0.10.5.tar.xz +b99c74b781a180348f3a3240940fc838 ocserv-0.10.6.tar.xz +1cc410cd9ccaa796f36180d10bdeb3a7 ocserv-0.10.6.tar.xz.sig From 3e1272dcfa7d28358b3fd4d64678bbe0e46ae8a9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 9 Jul 2015 12:13:38 +0200 Subject: [PATCH 068/195] corrected JSON output in occtl --- ocserv-0.10.6-json.patch | 29 +++++++++++++++++++++++++++++ ocserv.spec | 8 +++++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 ocserv-0.10.6-json.patch diff --git a/ocserv-0.10.6-json.patch b/ocserv-0.10.6-json.patch new file mode 100644 index 0000000..4afb8ea --- /dev/null +++ b/ocserv-0.10.6-json.patch @@ -0,0 +1,29 @@ +diff --git a/src/occtl-print.c b/src/occtl-print.c +index 1441cd6..8ff297e 100644 +--- a/src/occtl-print.c ++++ b/src/occtl-print.c +@@ -47,9 +47,9 @@ int print_list_entries(FILE* out, cmd_params_st *params, const char* name, char + tmp = val[i]; + if (tmp != NULL) { + if (i==0) +- fprintf(out, "%s", tmp); ++ fprintf(out, "\"%s\"", tmp); + else +- fprintf(out, ", %s", tmp); ++ fprintf(out, ", \"%s\"", tmp); + } + } + fprintf(out, "]%s\n", have_more?",":""); +diff --git a/src/occtl-unix.c b/src/occtl-unix.c +index 6df5a1e..d6b28f3 100644 +--- a/src/occtl-unix.c ++++ b/src/occtl-unix.c +@@ -254,7 +254,7 @@ int handle_status_cmd(struct unix_ctx *ctx, const char *arg, cmd_params_st *para + print_single_value_int(stdout, params, "TLS DB entries", rep->stored_tls_sessions, 1); + print_separator(stdout, params); + print_single_value_int(stdout, params, "Server PID", rep->pid, 1); +- print_single_value_int(stdout, params, "Sec-mod PID", rep->sec_mod_pid, 1); ++ print_single_value_int(stdout, params, "Sec-mod PID", rep->sec_mod_pid, 0); + print_end_block(stdout, params, 0); + + status_rep__free_unpacked(rep, &pa); diff --git a/ocserv.spec b/ocserv.spec index 8364436..65f76d2 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.10.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -17,6 +17,7 @@ Source4: PACKAGE-LICENSING Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey Source8: ocserv-script +Patch0: ocserv-0.10.6-json.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -73,6 +74,8 @@ to provide the secure VPN service. %prep %setup -q +%patch0 -p1 -b .json + rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/ rm -rf src/ccan/talloc @@ -156,6 +159,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jul 9 2015 Nikos Mavrogiannopoulos - 0.10.6-2 +- corrected JSON output + * Thu Jul 2 2015 Nikos Mavrogiannopoulos - 0.10.6-1 - new upstream release (#1238499) From 9d24b69707ee291dfa0a7ad6394ee4d486d7dc12 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 7 Aug 2015 10:28:34 +0200 Subject: [PATCH 069/195] updated to 0.10.7 --- .gitignore | 2 ++ ocserv-0.10.6-json.patch | 29 ----------------------------- ocserv.spec | 9 +++++---- sources | 4 ++-- 4 files changed, 9 insertions(+), 35 deletions(-) delete mode 100644 ocserv-0.10.6-json.patch diff --git a/.gitignore b/.gitignore index 4842a17..70e0dce 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,5 @@ /ocserv-0.10.2.tar.xz.sig /ocserv-0.10.6.tar.xz /ocserv-0.10.6.tar.xz.sig +/ocserv-0.10.7.tar.xz.sig +/ocserv-0.10.7.tar.xz diff --git a/ocserv-0.10.6-json.patch b/ocserv-0.10.6-json.patch deleted file mode 100644 index 4afb8ea..0000000 --- a/ocserv-0.10.6-json.patch +++ /dev/null @@ -1,29 +0,0 @@ -diff --git a/src/occtl-print.c b/src/occtl-print.c -index 1441cd6..8ff297e 100644 ---- a/src/occtl-print.c -+++ b/src/occtl-print.c -@@ -47,9 +47,9 @@ int print_list_entries(FILE* out, cmd_params_st *params, const char* name, char - tmp = val[i]; - if (tmp != NULL) { - if (i==0) -- fprintf(out, "%s", tmp); -+ fprintf(out, "\"%s\"", tmp); - else -- fprintf(out, ", %s", tmp); -+ fprintf(out, ", \"%s\"", tmp); - } - } - fprintf(out, "]%s\n", have_more?",":""); -diff --git a/src/occtl-unix.c b/src/occtl-unix.c -index 6df5a1e..d6b28f3 100644 ---- a/src/occtl-unix.c -+++ b/src/occtl-unix.c -@@ -254,7 +254,7 @@ int handle_status_cmd(struct unix_ctx *ctx, const char *arg, cmd_params_st *para - print_single_value_int(stdout, params, "TLS DB entries", rep->stored_tls_sessions, 1); - print_separator(stdout, params); - print_single_value_int(stdout, params, "Server PID", rep->pid, 1); -- print_single_value_int(stdout, params, "Sec-mod PID", rep->sec_mod_pid, 1); -+ print_single_value_int(stdout, params, "Sec-mod PID", rep->sec_mod_pid, 0); - print_end_block(stdout, params, 0); - - status_rep__free_unpacked(rep, &pa); diff --git a/ocserv.spec b/ocserv.spec index 65f76d2..d38de34 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.6 -Release: 2%{?dist} +Version: 0.10.7 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -17,7 +17,6 @@ Source4: PACKAGE-LICENSING Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source7: ocserv-genkey Source8: ocserv-script -Patch0: ocserv-0.10.6-json.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -74,7 +73,6 @@ to provide the secure VPN service. %prep %setup -q -%patch0 -p1 -b .json rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/ @@ -159,6 +157,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Aug 7 2015 Nikos Mavrogiannopoulos - 0.10.7-1 +- new upstream release (#1251305) + * Thu Jul 9 2015 Nikos Mavrogiannopoulos - 0.10.6-2 - corrected JSON output diff --git a/sources b/sources index 1496e43..402b382 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -b99c74b781a180348f3a3240940fc838 ocserv-0.10.6.tar.xz -1cc410cd9ccaa796f36180d10bdeb3a7 ocserv-0.10.6.tar.xz.sig +b828a7f3e7672f09f9908f30aa21b242 ocserv-0.10.7.tar.xz.sig +328469feb7505c2289f2f07720dc7777 ocserv-0.10.7.tar.xz From 46e3bdf2df6ec4547ae82705c42c9caadc2fb7c0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 7 Sep 2015 17:36:05 +0200 Subject: [PATCH 070/195] updated to 0.10.8 --- .gitignore | 2 ++ ocserv.conf | 4 ---- ocserv.spec | 5 ++++- sources | 4 ++-- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index 70e0dce..292c2e8 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,5 @@ /ocserv-0.10.6.tar.xz.sig /ocserv-0.10.7.tar.xz.sig /ocserv-0.10.7.tar.xz +/ocserv-0.10.8.tar.xz.sig +/ocserv-0.10.8.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 6f64efa..3dba4d5 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -48,14 +48,10 @@ auth = "pam" #enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]" # Accounting methods available: -# pam: can only be combined with PAM authentication method, it provides -# a session opened using PAM. -# # radius: can be combined with any authentication method, it provides # radius accounting to available users (see also stats-report-time). # # Only one accounting method can be specified. -#acct = "pam" #acct = "radius[config=/etc/radiusclient/radiusclient.conf]" # Use listen-host to limit to specific IPs or to the IPs of a provided diff --git a/ocserv.spec b/ocserv.spec index d38de34..301ca6a 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.7 +Version: 0.10.8 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -157,6 +157,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Sep 7 2015 Nikos Mavrogiannopoulos - 0.10.8-1 +- new upstream release (#1260327) + * Fri Aug 7 2015 Nikos Mavrogiannopoulos - 0.10.7-1 - new upstream release (#1251305) diff --git a/sources b/sources index 402b382..e8a8158 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -b828a7f3e7672f09f9908f30aa21b242 ocserv-0.10.7.tar.xz.sig -328469feb7505c2289f2f07720dc7777 ocserv-0.10.7.tar.xz +ffc602ecfb35df216874248eec5ddb85 ocserv-0.10.8.tar.xz.sig +665b854377850db535271098a37213f1 ocserv-0.10.8.tar.xz From bb0b202d105327fb17fb7385deb1dbda1aa0d01b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 17 Sep 2015 11:47:52 +0200 Subject: [PATCH 071/195] compile ocserv using radcli --- ocserv.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 301ca6a..fe0f70e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.10.8 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -43,7 +43,7 @@ BuildRequires: libtalloc-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf -BuildRequires: freeradius-client-devel +BuildRequires: radcli-devel BuildRequires: lz4-devel # we don't build with dbus support @@ -157,6 +157,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Sep 17 2015 Nikos Mavrogiannopoulos - 0.10.8-2 +- compile ocserv using radcli + * Mon Sep 7 2015 Nikos Mavrogiannopoulos - 0.10.8-1 - new upstream release (#1260327) From e5f5c63e8d2b2a0adb9152765e91470e23b83d99 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 8 Oct 2015 13:23:49 +0200 Subject: [PATCH 072/195] updated to 0.10.9 --- .gitignore | 2 ++ ocserv.conf | 13 ++++++++++--- ocserv.spec | 9 ++++++--- sources | 4 ++-- 4 files changed, 20 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 292c2e8..d2dab91 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,5 @@ /ocserv-0.10.7.tar.xz /ocserv-0.10.8.tar.xz.sig /ocserv-0.10.8.tar.xz +/ocserv-0.10.9.tar.xz.sig +/ocserv-0.10.9.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 3dba4d5..df18a8a 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -12,12 +12,14 @@ # This enabled PAM authentication of the user. The gid-min option is used # by auto-select-group option, in order to select the minimum valid group ID. # -# plain[passwd=/etc/ocserv/ocpasswd] +# plain[passwd=/etc/ocserv/ocpasswd,otp=/etc/ocserv/users.otp] # The plain option requires specifying a password file which contains # entries of the following format. # "username:groupname1,groupname2:encoded-password" # One entry must be listed per line, and 'ocpasswd' should be used -# to generate password entries. +# to generate password entries. The 'otp' suboption allows to specify +# an oath password file to be used for one time passwords; the format of +# the file is described in https://code.google.com/p/mod-authn-otp/wiki/UsersFile # # radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name,override-interim-updates=false]: # The radius option requires specifying freeradius-client configuration @@ -36,7 +38,7 @@ auth = "pam" #auth = "pam[gid-min=1000]" -#auth = "plain[passwd=./sample.passwd]" +#auth = "plain[passwd=./sample.passwd,otp=./sample.otp]" #auth = "certificate" #auth = "radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true]" @@ -51,6 +53,11 @@ auth = "pam" # radius: can be combined with any authentication method, it provides # radius accounting to available users (see also stats-report-time). # +# pam: can be combined with any authentication method, it provides +# a validation of the connecting user's name using PAM. It is +# superfluous to use this method when authentication is already +# PAM. +# # Only one accounting method can be specified. #acct = "radius[config=/etc/radiusclient/radiusclient.conf]" diff --git a/ocserv.spec b/ocserv.spec index fe0f70e..8cfee07 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.8 -Release: 2%{?dist} +Version: 0.10.9 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -143,7 +143,7 @@ rm -rf %{buildroot} %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf %config(noreplace) %{_sysconfdir}/pam.d/ocserv -%doc AUTHORS ChangeLog NEWS COPYING LICENSE README TODO PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* %{_mandir}/man8/occtl.8* @@ -157,6 +157,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Oct 8 2015 Nikos Mavrogiannopoulos - 0.10.9-1 +- new upstream release (#1269479) + * Thu Sep 17 2015 Nikos Mavrogiannopoulos - 0.10.8-2 - compile ocserv using radcli diff --git a/sources b/sources index e8a8158..34833c2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -ffc602ecfb35df216874248eec5ddb85 ocserv-0.10.8.tar.xz.sig -665b854377850db535271098a37213f1 ocserv-0.10.8.tar.xz +650c80e96ef429f34787347a59476d07 ocserv-0.10.9.tar.xz.sig +74834c59aa96beaa222c21ee6521adb2 ocserv-0.10.9.tar.xz From 36bf63761d168e5e01125b406422e88fc8a7c3c2 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 30 Nov 2015 16:59:06 +0100 Subject: [PATCH 073/195] updated to 0.10.10 --- .gitignore | 2 ++ ocserv.conf | 19 +++++++++++++++++++ ocserv.spec | 6 +++++- sources | 4 ++-- 4 files changed, 28 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d2dab91..0c9a132 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,5 @@ /ocserv-0.10.8.tar.xz /ocserv-0.10.9.tar.xz.sig /ocserv-0.10.9.tar.xz +/ocserv-0.10.10.tar.xz.sig +/ocserv-0.10.10.tar.xz diff --git a/ocserv.conf b/ocserv.conf index df18a8a..62ea00b 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -391,6 +391,13 @@ default-domain = example.com # The IPv6 subnet that leases will be given from. #ipv6-network = fda9:4efe:7e3b:03ea::/64 +# Specify the size of the network to provide to clients. It is +# generally recommended to provide clients with a /64 network in +# IPv6, but any subnet may be specified. To provide clients only +# with a single IP use the prefix 128. +#ipv6-subnet-prefix = 128 +#ipv6-subnet-prefix = 64 + # The advertized DNS server. Use multiple lines for # multiple servers. # dns = fc00::4be0 @@ -440,6 +447,18 @@ ping-leases = false #no-route = 192.168.5.0/255.255.255.0 +# If set, the script /usr/bin/ocserv-fw will be called to restrict +# the user to its allowed routes and prevent him from accessing +# any other routes. In case of defaultroute, the no-routes are restricted. +# All the routes applied by ocserv can be reverted using /usr/bin/ocserv-fw +# --removeall. This option can be set globally or in the per-user configuration. +#restrict-user-to-routes = true + +# When set to true, all client's iroutes are made visible to all +# connecting clients except for the ones offering them. This option +# only makes sense if config-per-user is set. +#expose-iroutes = true + # Groups that a client is allowed to select from. # A client may belong in multiple groups, and in certain use-cases # it is needed to switch between them. For these cases the client can diff --git a/ocserv.spec b/ocserv.spec index 8cfee07..ec51bf9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.9 +Version: 0.10.10 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -150,6 +150,7 @@ rm -rf %{buildroot} %{_mandir}/man8/ocpasswd.8* %{_bindir}/ocpasswd %{_bindir}/occtl +%{_bindir}/ocserv-fw %{_bindir}/ocserv-script %{_sbindir}/ocserv %{_sbindir}/ocserv-genkey @@ -157,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Nov 30 2015 Nikos Mavrogiannopoulos - 0.10.10-1 +- new upstream release + * Thu Oct 8 2015 Nikos Mavrogiannopoulos - 0.10.9-1 - new upstream release (#1269479) diff --git a/sources b/sources index 34833c2..3c0611b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -650c80e96ef429f34787347a59476d07 ocserv-0.10.9.tar.xz.sig -74834c59aa96beaa222c21ee6521adb2 ocserv-0.10.9.tar.xz +1de2ff2dfdb1b3a9e06b5a884438c8db ocserv-0.10.10.tar.xz.sig +1f73ccb66d36cd51279323e95ae99e68 ocserv-0.10.10.tar.xz From 2f212bda6f0f4804a8fc196538881347d7c19f67 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 11 Jan 2016 09:58:19 +0100 Subject: [PATCH 074/195] updated to 0.10.11 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 0c9a132..b7c327e 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,5 @@ /ocserv-0.10.9.tar.xz /ocserv-0.10.10.tar.xz.sig /ocserv-0.10.10.tar.xz +/ocserv-0.10.11.tar.xz.sig +/ocserv-0.10.11.tar.xz diff --git a/ocserv.spec b/ocserv.spec index ec51bf9..c1bd189 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.10 +Version: 0.10.11 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -158,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Jan 11 2016 Nikos Mavrogiannopoulos - 0.10.11-1 +- new upstream release + * Mon Nov 30 2015 Nikos Mavrogiannopoulos - 0.10.10-1 - new upstream release diff --git a/sources b/sources index 3c0611b..f10d358 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -1de2ff2dfdb1b3a9e06b5a884438c8db ocserv-0.10.10.tar.xz.sig -1f73ccb66d36cd51279323e95ae99e68 ocserv-0.10.10.tar.xz +7be01cd70cf9e8df2210531429a7aa10 ocserv-0.10.11.tar.xz.sig +7daf9f105b115cd6611a2ac016a29d24 ocserv-0.10.11.tar.xz From 417cae3c2cec6d88f4211918885f3a32e076eaa9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 2 Feb 2016 10:18:58 +0100 Subject: [PATCH 075/195] corrected license to apply to the real one --- ocserv.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index c1bd189..c12e764 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -6,8 +6,8 @@ Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING -# To simplify licenses LGPLv2+ files have been promoted to GPLv3+. -License: GPLv3+ and BSD and MIT and CC0 +# To simplify licenses LGPLv2+ files have been promoted to GPLv2+. +License: GPLv2+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz Source1: ocserv.conf From 402e65ae3f2ceb5d33334add949e9fc5baa6465b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 4 Feb 2016 11:12:42 +0000 Subject: [PATCH 076/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index c12e764..3a3f8e0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.10.11 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -158,6 +158,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Feb 04 2016 Fedora Release Engineering - 0.10.11-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + * Mon Jan 11 2016 Nikos Mavrogiannopoulos - 0.10.11-1 - new upstream release From 9a47bd4bafc5aae777575b5e964fd56d1205c56f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 19 Feb 2016 11:23:57 +0100 Subject: [PATCH 077/195] updated to 0.11.0 --- .gitignore | 2 ++ ocserv.conf | 44 ++++++++++++++++++++++++++++++++++---------- ocserv.spec | 11 ++++++++--- sources | 4 ++-- 4 files changed, 46 insertions(+), 15 deletions(-) diff --git a/.gitignore b/.gitignore index b7c327e..af95b9d 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,5 @@ /ocserv-0.10.10.tar.xz /ocserv-0.10.11.tar.xz.sig /ocserv-0.10.11.tar.xz +/ocserv-0.11.0.tar.xz +/ocserv-0.11.0.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 62ea00b..b62dfdb 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -99,12 +99,22 @@ chroot-dir = /var/lib/ocserv ### All configuration options below this line are reloaded on a SIGHUP. -### The options above, will remain unchanged. +### The options above, will remain unchanged. Note however, that the +### server-cert, server-key, dh-params and ca-cert options will be reloaded +### if the provided file changes, on server reload. That allows certificate +### rotation, but requires the server key to remain the same for seamless +### operation. If the server key changes on reload, there may be connection +### failures during the reloading time. + # Whether to enable seccomp/Linux namespaces worker isolation. That restricts the number of # system calls allowed to a worker process, in order to reduce damage from a # bug in the worker process. It is available on Linux systems at a performance cost. # The performance cost is roughly 2% overhead at transfer time (tested on a Linux 3.17.8). +# Note however, that process isolation is restricted to the specific libc versions +# the isolation was tested at. If you get random failures on worker processes, try +# disabling that option and report the failures you, along with system and debugging +# information at: https://gitlab.com/ocserv/ocserv/issues isolate-workers = true # A banner to be displayed on clients @@ -118,11 +128,6 @@ max-clients = 16 # multiple times). Unset or set to zero for unlimited. max-same-clients = 2 -# When the server has a dynamic DNS address (that may change), -# should set that to true to ask the client to resolve again on -# reconnects. -#listen-host-is-dyndns = true - # Limit the number of client connections to one every X milliseconds # (X is the provided value). Set to zero for no limit. #rate-limit-ms = 100 @@ -214,7 +219,9 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 #cert-group-oid = 2.5.4.11 # The revocation list of the certificates issued by the 'ca-cert' above. -# See the manual to generate an empty CRL initially. +# See the manual to generate an empty CRL initially. The CRL will be reloaded +# periodically when ocserv detects a change in the file. To force a reload use +# SIGHUP. #crl = /path/to/crl.pem # Uncomment this to enable compression negotiation (LZS, LZ4). @@ -251,7 +258,7 @@ tls-priorities = "@SYSTEM" # The time (in seconds) that a client is allowed to stay connected prior # to authentication -auth-timeout = 40 +auth-timeout = 240 # The time (in seconds) that a client is allowed to stay idle (no traffic) # before being disconnected. Unset to disable. @@ -299,6 +306,13 @@ ban-reset-time = 300 # between different networks. cookie-timeout = 300 +# Cookie rekey time (in seconds) +# The time after which the key used to encrypt cookies will be +# refreshed. After this time the previous key will also be valid +# for verification. It is recommended not to modify the default +# value. +cookie-rekey-time = 14400 + # If this is enabled (not recommended) the cookies will stay # valid even after a user manually disconnects, and until they # expire. This may improve roaming with some broken clients. @@ -327,11 +341,17 @@ rekey-method = ssl # Script to call when a client connects and obtains an IP. # The following parameters are passed on the environment. # REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP +# DEVICE, IP_REAL (the real IP of the client), IP_REAL_LOCAL (the local +# interface IP the client connected), IP_LOCAL (the local IP # in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # IPV6_LOCAL (the IPv6 local address if there are both IPv4 and IPv6 -# assigned), IPV6_REMOVE (the IPv6 remote address), and +# assigned), IPV6_REMOTE (the IPv6 remote address), IPV6_PREFIX, and # ID (a unique numeric ID); REASON may be "connect" or "disconnect". +# In addition the following variables OCSERV_ROUTES (the applied routes for this +# client), OCSERV_NO_ROUTES, OCSERV_DNS (the DNS servers for this client), +# will contain a space separated list of routes or DNS servers. A version +# of these variables with the 4 or 6 suffix will contain only the IPv4 or +# IPv6 values. # The disconnect script will receive the additional values: STATS_BYTES_IN, # STATS_BYTES_OUT, STATS_DURATION that contain a 64-bit counter of the bytes @@ -398,6 +418,10 @@ default-domain = example.com #ipv6-subnet-prefix = 128 #ipv6-subnet-prefix = 64 +# Whether to tunnel all DNS queries via the VPN. This is the default +# when a default route is set. +#tunnel-all-dns = true + # The advertized DNS server. Use multiple lines for # multiple servers. # dns = fc00::4be0 diff --git a/ocserv.spec b/ocserv.spec index 3a3f8e0..316b66c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.10.11 -Release: 2%{?dist} +Version: 0.11.0 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -32,6 +32,7 @@ BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel +BuildRequires: liboath-devel BuildRequires: readline-devel BuildRequires: autogen BuildRequires: gperf @@ -40,6 +41,7 @@ BuildRequires: libseccomp-devel %endif BuildRequires: pcllib-devel BuildRequires: libtalloc-devel +BuildRequires: libev-devel BuildRequires: http-parser-devel BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf @@ -75,7 +77,7 @@ to provide the secure VPN service. %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h -rm -rf src/protobuf/ +rm -rf src/protobuf/protobuf-c/ rm -rf src/ccan/talloc rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h @@ -158,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Feb 19 2016 Nikos Mavrogiannopoulos - 0.11.0-1 +- new upstream release + * Thu Feb 04 2016 Fedora Release Engineering - 0.10.11-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild diff --git a/sources b/sources index f10d358..9b1194f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -7be01cd70cf9e8df2210531429a7aa10 ocserv-0.10.11.tar.xz.sig -7daf9f105b115cd6611a2ac016a29d24 ocserv-0.10.11.tar.xz +9161b506142232957ccf786c251b5b42 ocserv-0.11.0.tar.xz +441bb6e47fa642de92e3adfa4a46ae1b ocserv-0.11.0.tar.xz.sig From 00c8edca9a26f2703408bbedc4848d7be9249557 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Mar 2016 08:58:53 +0100 Subject: [PATCH 078/195] updated to 0.11.1 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index af95b9d..b0317c8 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,5 @@ /ocserv-0.10.11.tar.xz /ocserv-0.11.0.tar.xz /ocserv-0.11.0.tar.xz.sig +/ocserv-0.11.1.tar.xz.sig +/ocserv-0.11.1.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 316b66c..b4120ae 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.0 +Version: 0.11.1 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -160,6 +160,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Mar 21 2016 Nikos Mavrogiannopoulos - 0.11.1-1 +- new upstream release + * Fri Feb 19 2016 Nikos Mavrogiannopoulos - 0.11.0-1 - new upstream release diff --git a/sources b/sources index 9b1194f..3e9f901 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -9161b506142232957ccf786c251b5b42 ocserv-0.11.0.tar.xz -441bb6e47fa642de92e3adfa4a46ae1b ocserv-0.11.0.tar.xz.sig +12ef887f9796735083207e255c94f40c ocserv-0.11.1.tar.xz.sig +a581b8669f5d16639773ef81f25a1317 ocserv-0.11.1.tar.xz From 26a4b6858742a06e7b03d0fc6872850e22643ab9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 26 Apr 2016 09:47:18 +0200 Subject: [PATCH 079/195] updated to 0.11.2 and added auto sig verification --- .gitignore | 3 +++ ocserv.spec | 39 ++++++++++++++++++++++----------------- sources | 5 +++-- 3 files changed, 28 insertions(+), 19 deletions(-) diff --git a/.gitignore b/.gitignore index b0317c8..de309fb 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,6 @@ /ocserv-0.11.0.tar.xz.sig /ocserv-0.11.1.tar.xz.sig /ocserv-0.11.1.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.2.tar.xz +/ocserv-0.11.2.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index b4120ae..917af4e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.1 +Version: 0.11.2 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -10,13 +10,14 @@ Summary: OpenConnect SSL VPN server License: GPLv2+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz -Source1: ocserv.conf -Source2: ocserv.service -Source3: ocserv-pamd.conf -Source4: PACKAGE-LICENSING -Source6: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig -Source7: ocserv-genkey -Source8: ocserv-script +Source1: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig +Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +Source3: ocserv.conf +Source4: ocserv.service +Source5: ocserv-pamd.conf +Source6: PACKAGE-LICENSING +Source8: ocserv-genkey +Source9: ocserv-script # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -47,9 +48,8 @@ BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf BuildRequires: radcli-devel BuildRequires: lz4-devel - -# we don't build with dbus support -#BuildRequires: dbus-devel +BuildRequires: uid_wrapper +BuildRequires: socket_wrapper Requires: gnutls-utils Requires: iproute @@ -74,6 +74,7 @@ uses the standard IETF security protocols such as TLS 1.2, and Datagram TLS to provide the secure VPN service. %prep +gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h @@ -118,19 +119,19 @@ make check %{?_smp_mflags} %install rm -rf %{buildroot} -cp -a %{SOURCE4} PACKAGE-LICENSING +cp -a %{SOURCE6} PACKAGE-LICENSING mkdir -p %{buildroot}/%{_sysconfdir}/pam.d/ mkdir -p %{buildroot}/%{_sysconfdir}/ocserv/ -install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/pam.d/ocserv -install -p -m 644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/ocserv/ +install -p -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/pam.d/ocserv +install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/ocserv/ mkdir -p %{buildroot}/%{_unitdir} -install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir} +install -p -m 644 %{SOURCE4} %{buildroot}/%{_unitdir} mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ mkdir -p %{buildroot}/%{_sbindir} -install -p -m 755 %{SOURCE7} %{buildroot}/%{_sbindir} +install -p -m 755 %{SOURCE8} %{buildroot}/%{_sbindir} mkdir -p %{buildroot}/%{_bindir} -install -p -m 755 %{SOURCE8} %{buildroot}/%{_bindir} +install -p -m 755 %{SOURCE9} %{buildroot}/%{_bindir} %make_install %clean @@ -160,6 +161,10 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Mar 21 2016 Nikos Mavrogiannopoulos - 0.11.2-1 +- New upstream release +- Added automatic verification of signature during build + * Mon Mar 21 2016 Nikos Mavrogiannopoulos - 0.11.1-1 - new upstream release diff --git a/sources b/sources index 3e9f901..bff4cce 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ -12ef887f9796735083207e255c94f40c ocserv-0.11.1.tar.xz.sig -a581b8669f5d16639773ef81f25a1317 ocserv-0.11.1.tar.xz +310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +6731f4d9a85ff0476ae37fa7a4d57ee2 ocserv-0.11.2.tar.xz +4e8b8291fee4b3da8c6f43b08819dd1f ocserv-0.11.2.tar.xz.sig From df1c1dc6a304cc2760acccf6d5a8ca163dc89e22 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 26 Apr 2016 10:29:29 +0200 Subject: [PATCH 080/195] fixed date and removed legacy config options --- ocserv.conf | 7 ------- ocserv.spec | 2 +- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index b62dfdb..c7f9ad1 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -306,13 +306,6 @@ ban-reset-time = 300 # between different networks. cookie-timeout = 300 -# Cookie rekey time (in seconds) -# The time after which the key used to encrypt cookies will be -# refreshed. After this time the previous key will also be valid -# for verification. It is recommended not to modify the default -# value. -cookie-rekey-time = 14400 - # If this is enabled (not recommended) the cookies will stay # valid even after a user manually disconnects, and until they # expire. This may improve roaming with some broken clients. diff --git a/ocserv.spec b/ocserv.spec index 917af4e..556a074 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -161,7 +161,7 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog -* Mon Mar 21 2016 Nikos Mavrogiannopoulos - 0.11.2-1 +* Tue Apr 26 2016 Nikos Mavrogiannopoulos - 0.11.2-1 - New upstream release - Added automatic verification of signature during build From 2d1dc3442903f58d5f4735cea5cad66d6a53be8c Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 16 Jun 2016 09:37:34 +0200 Subject: [PATCH 081/195] updated to 0.11.3 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index de309fb..3119d48 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,5 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.2.tar.xz /ocserv-0.11.2.tar.xz.sig +/ocserv-0.11.3.tar.xz +/ocserv-0.11.3.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 556a074..f057a5b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.2 +Version: 0.11.3 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -161,6 +161,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jun 16 2016 Nikos Mavrogiannopoulos - 0.11.3-1 +- New upstream release + * Tue Apr 26 2016 Nikos Mavrogiannopoulos - 0.11.2-1 - New upstream release - Added automatic verification of signature during build diff --git a/sources b/sources index bff4cce..71e8e5b 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ 310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg -6731f4d9a85ff0476ae37fa7a4d57ee2 ocserv-0.11.2.tar.xz -4e8b8291fee4b3da8c6f43b08819dd1f ocserv-0.11.2.tar.xz.sig +ffe3d79662e939bb55dfe7c9e490b4f2 ocserv-0.11.3.tar.xz +4bf5d98c6ededa172aa04460386bb0e6 ocserv-0.11.3.tar.xz.sig From 0070a879b3d684701e0e4def2a96bdb7b2a5c641 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 5 Aug 2016 13:01:40 +0200 Subject: [PATCH 082/195] updated to 0.11.4 --- .gitignore | 3 +++ ocserv.spec | 10 +++++++--- sources | 5 +++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 3119d48..fa6eaeb 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,6 @@ /ocserv-0.11.2.tar.xz.sig /ocserv-0.11.3.tar.xz /ocserv-0.11.3.tar.xz.sig +/ocserv-0.11.4.tar.xz +/ocserv-0.11.4.tar.xz.sig +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg diff --git a/ocserv.spec b/ocserv.spec index f057a5b..43ac23c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.3 +Version: 0.11.4 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -18,6 +18,7 @@ Source5: ocserv-pamd.conf Source6: PACKAGE-LICENSING Source8: ocserv-genkey Source9: ocserv-script +Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -74,7 +75,7 @@ uses the standard IETF security protocols such as TLS 1.2, and Datagram TLS to provide the secure VPN service. %prep -gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} +gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h @@ -83,7 +84,7 @@ rm -rf src/ccan/talloc rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c -sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/*.config +sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* @@ -161,6 +162,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Fri Aug 5 2016 Nikos Mavrogiannopoulos - 0.11.4-1 +- New upstream release + * Thu Jun 16 2016 Nikos Mavrogiannopoulos - 0.11.3-1 - New upstream release diff --git a/sources b/sources index 71e8e5b..44d23cb 100644 --- a/sources +++ b/sources @@ -1,3 +1,4 @@ 310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg -ffe3d79662e939bb55dfe7c9e490b4f2 ocserv-0.11.3.tar.xz -4bf5d98c6ededa172aa04460386bb0e6 ocserv-0.11.3.tar.xz.sig +c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +645b8f26d2aa40bfe4c32c8de7c8c87e ocserv-0.11.4.tar.xz +a036652f70660c5041adbea14aabf934 ocserv-0.11.4.tar.xz.sig From dc4fb1af307312b7ff07d1ea184fa9dc073e1d2d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 8 Sep 2016 09:03:15 +0200 Subject: [PATCH 083/195] Rebuild to address http-parser breakage (#1374081) --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 43ac23c..7b89dbe 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.11.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -162,6 +162,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Sep 8 2016 Nikos Mavrogiannopoulos - 0.11.4-2 +- Rebuild to address http-parser breakage (#1374081) + * Fri Aug 5 2016 Nikos Mavrogiannopoulos - 0.11.4-1 - New upstream release From d0dbbc1a1988c995771c0bbb85894e723049b5ef Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 14 Sep 2016 10:26:06 +0200 Subject: [PATCH 084/195] Added getrandom to the list of allowed syscalls (#1375851) --- ocserv-0.11.4-getrandom.patch | 24 ++++++++++++++++++++++++ ocserv.spec | 8 +++++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 ocserv-0.11.4-getrandom.patch diff --git a/ocserv-0.11.4-getrandom.patch b/ocserv-0.11.4-getrandom.patch new file mode 100644 index 0000000..ffe15ea --- /dev/null +++ b/ocserv-0.11.4-getrandom.patch @@ -0,0 +1,24 @@ +From cc1dbf1c246375c175b4392e3c6ca2139b0c355a Mon Sep 17 00:00:00 2001 +From: Nikos Mavrogiannopoulos +Date: Wed, 14 Sep 2016 10:20:41 +0200 +Subject: [PATCH] seccomp: added getrandom() to the accepted list of calls + +--- + src/worker-privs.c | 1 + + 1 file changed, 1 insertion(+), 0 deletions(-) + +diff --git a/src/worker-privs.c b/src/worker-privs.c +index 1557c59..33dc46c 100644 +--- a/src/worker-privs.c ++++ b/src/worker-privs.c +@@ -61,6 +61,7 @@ int disable_system_calls(struct worker_st *ws) + ADD_SYSCALL(alarm, 0); + ADD_SYSCALL(getpid, 0); + ADD_SYSCALL(brk, 0); ++ ADD_SYSCALL(getrandom, 0); /* used by gnutls 3.5.x */ + + ADD_SYSCALL(recvmsg, 0); + ADD_SYSCALL(sendmsg, 0); +-- +libgit2 0.24.0 + diff --git a/ocserv.spec b/ocserv.spec index 7b89dbe..8bf3700 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.11.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -19,6 +19,7 @@ Source6: PACKAGE-LICENSING Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +Patch0: ocserv-0.11.4-getrandom.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -78,6 +79,8 @@ to provide the secure VPN service. gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %setup -q +%patch0 -p1 -b .getrandom + rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/protobuf-c/ rm -rf src/ccan/talloc @@ -162,6 +165,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Wed Sep 14 2016 Nikos Mavrogiannopoulos - 0.11.4-3 +- Added getrandom to the list of allowed syscalls (#1375851) + * Thu Sep 8 2016 Nikos Mavrogiannopoulos - 0.11.4-2 - Rebuild to address http-parser breakage (#1374081) From 4cfe8c0e027fa9b6d65a0c4ae7e9fa437486c32d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 23 Sep 2016 10:54:38 +0200 Subject: [PATCH 085/195] updated to 0.11.5 --- .gitignore | 2 ++ ocserv-0.11.4-getrandom.patch | 24 ------------------------ ocserv.conf | 30 +++++++++++++++++++++++++----- ocserv.spec | 7 ++----- sources | 4 ++-- 5 files changed, 31 insertions(+), 36 deletions(-) delete mode 100644 ocserv-0.11.4-getrandom.patch diff --git a/.gitignore b/.gitignore index fa6eaeb..30d44e6 100644 --- a/.gitignore +++ b/.gitignore @@ -48,3 +48,5 @@ /ocserv-0.11.4.tar.xz /ocserv-0.11.4.tar.xz.sig /gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-0.11.5.tar.xz +/ocserv-0.11.5.tar.xz.sig diff --git a/ocserv-0.11.4-getrandom.patch b/ocserv-0.11.4-getrandom.patch deleted file mode 100644 index ffe15ea..0000000 --- a/ocserv-0.11.4-getrandom.patch +++ /dev/null @@ -1,24 +0,0 @@ -From cc1dbf1c246375c175b4392e3c6ca2139b0c355a Mon Sep 17 00:00:00 2001 -From: Nikos Mavrogiannopoulos -Date: Wed, 14 Sep 2016 10:20:41 +0200 -Subject: [PATCH] seccomp: added getrandom() to the accepted list of calls - ---- - src/worker-privs.c | 1 + - 1 file changed, 1 insertion(+), 0 deletions(-) - -diff --git a/src/worker-privs.c b/src/worker-privs.c -index 1557c59..33dc46c 100644 ---- a/src/worker-privs.c -+++ b/src/worker-privs.c -@@ -61,6 +61,7 @@ int disable_system_calls(struct worker_st *ws) - ADD_SYSCALL(alarm, 0); - ADD_SYSCALL(getpid, 0); - ADD_SYSCALL(brk, 0); -+ ADD_SYSCALL(getrandom, 0); /* used by gnutls 3.5.x */ - - ADD_SYSCALL(recvmsg, 0); - ADD_SYSCALL(sendmsg, 0); --- -libgit2 0.24.0 - diff --git a/ocserv.conf b/ocserv.conf index c7f9ad1..53c626e 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -256,6 +256,14 @@ tls-priorities = "@SYSTEM" # on the main channel. #tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" +# That option requires the established DTLS channel to use the same +# cipher as the primary TLS channel. This cannot be combined with +# listen-clear-file since the ciphersuite information is not available +# in that configuration. Note also, that this option implies that +# dtls-legacy option is false; this option cannot be enforced +# in the legacy/compat protocol. +#match-tls-dtls-ciphers = true + # The time (in seconds) that a client is allowed to stay connected prior # to authentication auth-timeout = 240 @@ -546,13 +554,25 @@ ping-leases = false # The following options are for (experimental) AnyConnect client # compatibility. -# This option must be set to true to support legacy CISCO clients. -# A side effect of this option is that it will no longer be required -# for clients to present their certificate on every connection. -# That is they may resume a cookie without presenting a certificate -# (when certificate authentication is used). +# This option will enable the pre-draft-DTLS version of DTLS, and +# will not require clients to present their certificate on every TLS +# connection. It must be set to true to support legacy CISCO clients +# and openconnect clients < 7.08. When set to true, it implies dtls-legacy = true. cisco-client-compat = true +# This option allows to disable the DTLS-PSK negotiation (enabled by default). +# The DTLS-PSK negotiation was introduced in ocserv 0.11.5 to deprecate +# the pre-draft-DTLS negotiation inherited from AnyConnect. It allows the +# DTLS channel to negotiate its ciphers and the DTLS protocol version. +#dtls-psk = false + +# This option allows to disable the legacy DTLS negotiation (enabled by default, +# but that may change in the future). +# The legacy DTLS uses a pre-draft version of the DTLS protocol and was +# from AnyConnect protocol. It has several limitations, that are addressed +# by the dtls-psk protocol supported by openconnect 7.08+. +dtls-legacy = true + # Client profile xml. A sample file exists in doc/profile.xml. # It is required by some of the CISCO clients. # This file must be accessible from inside the worker's chroot. diff --git a/ocserv.spec b/ocserv.spec index 8bf3700..8640f7e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,8 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.4 -Release: 3%{?dist} +Version: 0.11.5 +Release: 1%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -19,7 +19,6 @@ Source6: PACKAGE-LICENSING Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg -Patch0: ocserv-0.11.4-getrandom.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -79,8 +78,6 @@ to provide the secure VPN service. gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %setup -q -%patch0 -p1 -b .getrandom - rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/protobuf-c/ rm -rf src/ccan/talloc diff --git a/sources b/sources index 44d23cb..197a6c2 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ 310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg -645b8f26d2aa40bfe4c32c8de7c8c87e ocserv-0.11.4.tar.xz -a036652f70660c5041adbea14aabf934 ocserv-0.11.4.tar.xz.sig +fbda999ce0b528d001bb46b3db6f5d49 ocserv-0.11.5.tar.xz +f008f957a95feb8ef675ff1af09e3b53 ocserv-0.11.5.tar.xz.sig From bb91f26d9d5039d4d43e5d35d558e0fc200f4ef6 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Nov 2016 14:51:31 +0100 Subject: [PATCH 086/195] updated to 0.11.6 --- .gitignore | 2 ++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 30d44e6..6fcad36 100644 --- a/.gitignore +++ b/.gitignore @@ -50,3 +50,5 @@ /gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg /ocserv-0.11.5.tar.xz /ocserv-0.11.5.tar.xz.sig +/ocserv-0.11.6.tar.xz +/ocserv-0.11.6.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 8640f7e..8cf0cec 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 Name: ocserv -Version: 0.11.5 +Version: 0.11.6 Release: 1%{?dist} Summary: OpenConnect SSL VPN server @@ -162,6 +162,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-1 +- New upstream release + * Wed Sep 14 2016 Nikos Mavrogiannopoulos - 0.11.4-3 - Added getrandom to the list of allowed syscalls (#1375851) diff --git a/sources b/sources index 197a6c2..6dd3e56 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ 310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg -fbda999ce0b528d001bb46b3db6f5d49 ocserv-0.11.5.tar.xz -f008f957a95feb8ef675ff1af09e3b53 ocserv-0.11.5.tar.xz.sig +0e4f82d267d27f2f9d3fcba58ac6cf5a ocserv-0.11.6.tar.xz +12a026b472daa54373f38538773673d8 ocserv-0.11.6.tar.xz.sig From 77b3f227f7f49a02d9660107624e1f907a7e75ee Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Nov 2016 14:57:30 +0100 Subject: [PATCH 087/195] ocserv.conf: include switch-to-tcp-timeout --- ocserv.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ocserv.conf b/ocserv.conf index 53c626e..96082b7 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -155,6 +155,14 @@ dpd = 90 # 'X-AnyConnect-Identifier-DeviceType'. mobile-dpd = 1800 +# If using DTLS, and no UDP traffic is received for this +# many seconds, attempt to send future traffic over the TCP +# connection instead, in an attempt to wake up the client +# in the case that there is a NAT and the UDP translation +# was deleted. If this is unset, do not attempt to use this +# recovery mechanism. +switch-to-tcp-timeout = 25 + # MTU discovery (DPD must be enabled) try-mtu-discovery = false From 0cab039273b47c78f1706211f2e7432da912fe0e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Nov 2016 15:23:40 +0100 Subject: [PATCH 088/195] Removed gpg keys from sources --- .gitignore | 2 -- ...1F42418905D8206AA754CCDC29EE58B996865171.gpg | Bin 0 -> 56226 bytes ...56EE7FA9E8173B19FE86268D763712747F343FA7.gpg | Bin 0 -> 2135 bytes ocserv.spec | 5 ++++- sources | 2 -- 5 files changed, 4 insertions(+), 5 deletions(-) create mode 100644 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg create mode 100644 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg diff --git a/.gitignore b/.gitignore index 6fcad36..683b9bb 100644 --- a/.gitignore +++ b/.gitignore @@ -40,14 +40,12 @@ /ocserv-0.11.0.tar.xz.sig /ocserv-0.11.1.tar.xz.sig /ocserv-0.11.1.tar.xz -/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.2.tar.xz /ocserv-0.11.2.tar.xz.sig /ocserv-0.11.3.tar.xz /ocserv-0.11.3.tar.xz.sig /ocserv-0.11.4.tar.xz /ocserv-0.11.4.tar.xz.sig -/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg /ocserv-0.11.5.tar.xz /ocserv-0.11.5.tar.xz.sig /ocserv-0.11.6.tar.xz diff --git a/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg b/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg new file mode 100644 index 0000000000000000000000000000000000000000..1f9a40cc96ea43f54ea9dc0f1873971a85535c2f GIT binary patch literal 56226 zcmb5#gL9?PyXg5H+qP}nwr$%sJ4VMz$2L0Z*tVUHZ9BP@-#K?~pPH$fnSbE3_FB(3 zEALL_%>YUOmBc$}1cD{pxXIaBVJ{hWJA4%Z)9ni{SHt5yt#wqrchRH}nVar+Hg16F zb)B38Lw{tz5e0U;n8D@MMBjiku$@o$9b!zR>J)Li;lyXD^sHJ~Wp6q- z0yXavWO2O;<#hYK2ABm-Tz8iOqOtR5$)65eONbbZI^*!NeJO|ljurm^x1@h4m)2vW zUeaK6U7O~oldSCtC{mVzHLzMPnOZ+V*%2W!J65foX@`K@ydA{uC5*@0Wb1 zeW5;GRFe6ThZJ$+-VDDMqV-(fyc$ux%tbl28IZZ^g=gNBei_x9a5cKv&+xT)RIv`a z@F8k69-rjTJjDBjlH1t%1(L?fdomeXh=U>`0RzCnfF+rJ}ke72fhDD6WmFZaET^IgW5za`-4hWFLY7|``6^>`K zOFsIcPaNZX4Ssw0e;hgaV!Ut1YTwvhVK7HDDh7}j=5BiZJOgozfiI(Z0}6UJXI5hk z$jgEUQJ~TAPqrv2FY4#Jy~OMYhx^A-SX=#eq}XA2@ZR!G*;fF$=H7r6`5k)QwA)+E z%}uatXU}eKK;FoJseFjfM6UzF!B?O6>HC!yr1!th!TYy!z=U?tlAmQIRtw0+#`@B= zpXei@`YfeaXW=woM*ZU`f_{BFu^mTe?O4Yk zN9BNA->_0|0wd?h(4Fxsc=3TZuma|3KsG^^_@8{YJ}+*G8LNd>Am&88i{5`7AKGt+ z5jd7q5~b<0A03dZ$6I4bro>e6IiAMD^#aE}&-F3}$bt_5UVv&bU-nW~@O~-ZCM-fa z|7Y%U%9q98jtg$>yh?8&gZDTfZ~MW%nzW`-O&;gfiv-^lzoOcv0FXDuOTjc8pJ)A3 zM2_=Z+0Qw4;)3{}&!d9U^X=Hd408)=Vsf~O0&*yNvekel*%$1t5B$`Z3@TYYsKo%e z*3WgHYd@KB&eP)$GK~=E#Fz7n{&fhBzn!@4Ou9qdt=y~@K&}Tm`{(1MPgmcsjD;jH z(_5Y?^hrQAw#z%vvP(4H6iKa{hGOVW9}24DKaQ#|)wjcdJ>x>f3-+N31jtKA&7A_~ z_8;LAY{No{C^4Gbb2SCz#SYk*1it&Gn*73T%doM}V3*Jj`o~eDuljbncI;`X{elTI zx&gU%Gc(IAbkBE+$goCs8X=yuw56ngyn1u@wzDq+er+O=w>r&OU*|se&3_z?{)%r0 z_-77w;s=VeJQE-rGmF#{bLeWyQVOYr2pep$$UA@tkhh6_nzuthVQg)x{1c&j+?=y? z%l{uolRxI$*{ooOX2yC6Q0=m?F^#U#>o@`_45(| z@={|KFo|xk5rt=sqOX(BxasaF>i~I&20S`sFl*o~2fLw1cl*_4Ui~{Nga#Qhhb?4+=S3N+k7$({pD+$t~@a0xZ@b>l43MbR& z|8W$4P=|gy>PKHul!C*Mj+1~~?cDV9S)!dh*9qEb^Lm2#t4oLlKwdq(%@bg=S1e+mw{0vZQV(U zF`5Q>d*v^K$wyMP|2UA}_q?2@*DiO zbF6O6SqIz1Vn74Pi@#KloBSjWtC8gbG-emF9fU5<0rEyMM_yLY+0R~~_eu>5+)9V5 z2hIO+G&OF%9Zqle6#q82FF{B^ULu%^Vj-8R8#9*NWcQ}0nXP103?SDQi=6!4rZBxTG5tGNe0N_ z)Shfa(a!9S8#`GZrI-o^Ixt&|5C=v1?|ms+n0`A9DQJ)thrslwsDQkfdaD;=>mTE( z*;&(0vd{gz){i@YY`l09jlWawISYmd(@wJD5l07*ud4Ph->+kd55e?QIt;qG}S44i<`;cEe5(;`WcDR{{8TezNrk zIFdp<(cuH~Huubnp$l3Vi3K{{pF`AJGnPfq0XbySTz62!^wmZ5x_jgozBLK6az6iY zp#Rg4!jsjv^Iq4kYe3NLXtM#x#!}#+lJz4XEYwiuo41q49gi_)0OU~eFlF(dMpzeNe>z?peX>`P%{3u0yoJIK_7z0=&Z^NWwfUS?w5} zYnrB`q?U!@uT=sE$8YPy^grTllXaedw&c+gm%NB7*^+JaaE{T2(dyNGj{hzmQWp z7;8uPCA6064607oqJFkmM3{l1AVC7iz<}k{2U_s4EnQt5xfvKdJUr+v99%6e92{KC z={91*8e~(4Ae5qHATXwAg3?rk>wj(wRxn^Wg;_nie|KZV>`8B8$zW>6VB=u# zYGm`D9nm>D*jkx*(ObIO*?w=%$xal7FNT;-z8jD$%+%=V{q@tm6e@AB^)u1HK;BIX zkSiax#Xa{4&dk_0>J8lW-b(+l*ZMzJb@>0ks`?@o|EM>(>d_P+R~LK5bs>^Ky#7gk zVc++&c5Ozx9gwTuY`su=138D?NNC%%!*Z(WVXPD3_n#Yt4-8n&a6zB>-@V#fnb6rA znb0{pJ6M~UxPCvtGx!_Z8W}k<{Ig*YFd)zGO*=1aJumd%q+JLBazthAg3t$pC?|we)6?R z=aP?gQb<51LsEfE9_zmHt_#Se{Dp^S zbyfOh4%oYuJSS-RC=ES{hL@4zZTx8%)7e2H|9q`bK_TpOLw}1?V~w(+70@rU+u&Y~x{5?x z*sZnFyK=&*TFH>HZuP7gM9iym?OWbPeJ#V<9zTib$fQzUbBOj#_@xoQOfHYO!eg7X zm}uR9k4Fh9_WPW(YNwIZT^&+-_8{KCJcN}>!I4p6;^=E?g40y*_*)2fO?)8~IrXqn z%`Nl@GJSLxQ%(XiO2mzx3P=4J$lU3Bi(!!PQzs5bFtkx9aPA8XVLB|+ihDO(%NG_I zlcimnAg4D;mVG>?01x-z7A2^uEo-U_!JnpYg3-5aRib(KVgC< zZ5?80$rI|OiieE`NvNSO*^ImK>wBV;Y-AB>45hD4Act!1FVHYSw2;vC;q@95rvsVnlU4}BYJ=E-ec3MS%dDQ>Y9`O`W=^u+1QyEp)bLIJj<6nYRM8E9RaAO?jeOR834w<-wSk9&S3| ze7XX)dYhMX#vXm?IOMu`UxUqB~z6|S} zwta__|E4OHgv-eTbVfKKi*V3`;|wa~5; za&?v>Ddd89s0d(_tCrz)t7L(T@0P;sG*H)8@-o9r(^M*H;;&-@^1Dc_@z*WyIqN;F zk}aBL`J_^ymcMtR8c8vUOf-EO!j-tI&_Xcf2t13vKSFnk&GL|xm4*}3d&{p@V^qwG zG(hyh`@LxJQY~VGkx}Lu=ae?&4!)bCIT*T1{HbR=%ALhnj&beXl;KJ%0JS-IeaEF8 z7@n8>imRXs?8T%+kj3Nk+pe-BRGu^=mHH{ihjM&^pFDLuU@I@TT?918k@Wj`Q2zVw zQ7YN`{^2^&4r<8}>SC|lhxp`IQ$a(4U*V7OA?F`yB9V1n3#*n;p$&StxEc~j_ABAI z!5;TRBwKpz8krSMq9^jc=zZP&z%c7jXDCm0DiZi{l-TG9!qKDlj2aRRs?DSER+{a` z+_udFf{5v8qk(Q9amsliD8WjVzs(G(TD`E9tDmoTW5fP?2@+^Lyb>2C`}chcTZ#_J z2^@vqX^Ba1@T~Ls>7G}sQ%c@uu2PkAU{`Q+9@3EnAqIb!UUiYw{QMhIrYo5qewzH2 zeyLLVkhBx5Tk9KkC4kycMGuk5gjpGUUz)nfGM4X`%`a~Dsjy~AI@N|CaNU0Qhh;5` z$>l>ae0Wy*yxLC7(SiWPQi6A?)FCol82etrUfoE;blPUTY*)p((x=Ke#PlV#s*+L5 z$mLXh?CbOy%2zP);-&f3B?fd01_~Qf6enh$XcO)^cTa$2bIfL~B0W>YR287k`Q7TS zAy-)=Y9qt~Mwvqhk)YrX&O6KByQ^;!4OK3T?_4Mh`_@R1{SETV-Sx(mv$(p^<34dJ z=5l925(*_hCiaB&r#wk*>Yj*%(a!4}r+IE(`o(k+n%Q?Y;Yf}cD^d9ANSGW+%MpwE_Iz7ym>)hWEX%n6B_0p~MJ0ix8M`y)Z? zDUE?)%qrN<4Wb)d2TXjeURU-8@S@44ZB?U?svc63(x;fe7BB~VoZ?|L67hNd`eugI zLGvWZ)EN9hFc96m#x|3NCygSFa zcJPOhHXp-h-BT%W8MH{C>+KJ$mF*Ocj*?ZZbUGx?3c9mUQD*2@<~B+sP|ttHL;n4z z&Vxo^91t)lvUG3&I1Cgd1PCxF8ZaaXC^|3*5HLOvFh=0__^2*5TT{c7oCwol3Dp0x z%I8epIkGpQmEG9S?b?&x!5+rtl}1FU_PDcaWCD|d!M%X;V%i)K3F?JJ(;{l`nsmzi zt%qaUKQoghv|n#HXu>(`cuX3k8uR(P{I#ftE{$vOdiG~4pQKR!q+3_qj+-DIh?HEr zhF#9?&2VjCAVc3fg%wE9>O9aSQ8FI?*b-Z}k4mS)%IrnerJq(HMXO|qyMP~mk!QoE zq@m6q(|Wg4lkIx0d9ADShT1%4KX#0?B>{qh7&cW0Da0GkonG!_kLiX7zgo)L_xNLR z`<5?B<7L+G=cA7rRkQu3b#L(^caZLrtb;A3qtv94+sIu; zH%U3EzqHss*3*+Lln^M0Avef-z;t5e33i1hc3p*8W9$3pg3qc5p-{t-(#-tFGiB?p*&jD1*7?Ne`MM~nwydb%oO`qDCg9z-1{ zP}W_|pR_lMEFqwQ3mak|wL@nP$@xg2{{M`S>i=zcV8D`7br8Ttqhg%}nGjDhvl ziQM>y&{y{KwJiDH!U%4udoIv4yj@z96Qf~_<}AvCb!hr63dh)!6~tDa;idxio=1su z*NN8h7p!59B!Vb;joswyWQCVyrDrwrp)C`H(z)au?uv9nj|pL-(Yk2>8jypz)+E-e zVr`WU9ue9K4cdgF)EM-j-tTt+3>&e=@8ES7w@bUnH>K%l-WGV_yz0g6{xhIjV_A=% zxs^uE8Yq4d5$e~W0bR`7RJ@sA@UEqytv@|rD(C~Em-$HmIpf_nT90d;rskljRIbGv zf0N&i!?pG#jm&YjnkCweaRpY3ZFNMS7A%HRy!`i+cDHz(Gi;Yw(;(q}$Ck8}PS@@H z$V#qUG8VfntTvc`LQUM`!lg_z_5cMV%0vsnOu3 z6OIoW!@_LUS8u4pl}`Oeix2)SDK3{zw48j7o`0DKS(Bf#yfrC$bJ({h-)ranpiOxd zM3B<}}hNCD(M>X8+^X=#a;A>m>~K|DdHL{;8@Pg~8N zzyw{bT%cECd-0Vd6B~^nTT7w&^{_@6ojr>nWq#(*|>q(Zm{}Gk)?c3r(P>}4>l>c zbLYSbW6i?R+cT-dV&Sv6I8}5D%ioLlP8}^}et3aM%O!f75FE}>m;Cg6dS0idlPam9 zH+P(d3jfubhG+(iLp{mN+CM9{0n+cE3_m_SI>|V09eQs!O#7Yqy=A z#_H;0@7jC1H--F!Jn3#$MM1|nnKe=~dty5aDV5PKz=N6V_-`Hx>)hXY_@_~ie?oiT zd1E4cX*P25rCfPfI6-4NoDds$Z8_h~W zzl5VaF^=2_#E#RycgIVyqm!3qmX2x|RHfJ%Y(d))cz~?onwD}Ip$er|*ZbHz?%RD#`cMpF9U0$S zB&*=BEV{tk${AIX?kbf^xpv;YY>Yxa2V;C`2WAujV;f%E9x>pBzyc7m`@ ziIF^hdrwM5rcOLs&Y2^;7~++}&c|~i!x;dIy*zOhZfuDFU+QL*&_yvkT&{A1=X6RS z9{186hZT`F^B5#4x-n34@0|FvyYtDVBL}9%!=H&g^uR{FVz%}2)p3KrX5Olb2SHVH z{73Z*gK}lYdi0*n+OBW4l-JX)IW*ux*pwHjEb&O{?w#jvkSOC(=wD@URj%2&p)aCW zp?jERYa}O40^F$=Ad1B?owK$G*S}zQsXyzA+3bzZlYjJaaL;WzMop?7VKoZ1$o!j! zqK@Eq9!EyN+moMF3^06%fRr{7GclZPS~}@a5cOo&>1uhTIu(fqQdO<_{w6RR zF%&Deu;QRb@UbA>B+2pw`UFpdtz5xLbg)(eI0Sj7B3hP~r{|USMC?HYJ^{oRVLf^g zJLmhW8{NFIkzy0&#-4%K{wPfOif|P&rX&i#p}Hr5JY~1!5mq0XrTaJ+34ml5I@W3-+~Xg^U*T*fgCxkp3ka5 z@iQo8UGYPdqHbqPy)SbWb2=y!@Ze4=SiIe6a%ay(ReUK}UAiWWRqt`YnA)x!!2m*V zztpWb*@?m5hiU^Thm?7XP1pJ3(|~^4eGC+Yb4>Vd3aAO02#=4qhe~xx?JXJBRAq!_ zk8ROo`i?kLN=>QX;SSZI<`w4ICSttr5)Q2?1a)topz&(-oZ70K?leQ1_EmbF)yOyg z_PzcJhwF`K-ZF|UwKtA^E9*%PBKEjBDFCryWSq1Ibe5QasJSaCDOS_UtzjnGk+7on zcEcu0$G9{RuevjyXM1wMWveDVpqe9VJ)u8hR=JSpMUWD)P*e^i}# z0Q!AqW=zAO(_@owTGOv$o~Dbz^)=OeXj93#AA3q;%%`FBiGII2rI-Zehv410Jf$u3 zt`#wPrHbsOc=iesqM%p5Pdii!gHSEu*5iKtW;y;UHTaF~2XAw(5U3sIYR&5Kn)oVV zt69>ZvIj{&c&EmhenziR<|_pn!?EN4dx}f;cDXajPK3Y0&rg3tE31FXuo*cdq>8Iz z$&2(W;e7lU)rKDJU6u{SY~RHSn$J5OwHw1;T{Qc{MUpl0aDXCoNdGfY0~lh0zpwaU z0%b^vO*Ni0tuyAhzKWK8$u3#Z#z0?>m}($iG_eOw*O6Um9<|k)b!LoyAS8u$DD}zi zk@OsILWzrYojl8Qm!c9q?ktUO6^y#EY1lm{z<#WWt=VKxzdqo%5Z>PtAw!yl_h)&a z8=u0X{fp~+wph#Qef)y5BUuCd(KdD^Ko6W0iVi%#o;WcwTDUN5IUN@_&yCZnCypQbwe+|sh+dJw&`Q$?N$d_-zaUl--u zrQ}P+GxvHcE+#?QG3|jRpyYUVEFxPt=|?pUuMXYlb4(-9{5TnEK=8v+XrCmEW_om# zvIYZaYgN)$ z+1wQ|+6iv*3=b`UhnSHN$>Dcoi@h(s#(R@NLZ(HN+poserMY3Ri_37EQzDc}}SB@0dA5}zyu z#TNbO%s4M*X*IuAsUs$|u}P%YqB{J3ha{i#h)zci2+dQs4NEh8w0oXp!Yn(4Y` z`Xhl#VaZX{Wo4*^J#q)DpsZDV795&XE$hvx{o;r~ErxAB8e;TK7zKxXGQ%n{1yyAv zL+j(ks|MXge~Vz;#7z;yLWB+wx|^_w*Y-8C_dYqK2>H^aCTJ3xJJeDc8Tb5B&?ure zzJ%SPji!9&{-53AbI(!;!d{Hm0_C|0r_S-!%qjC|LJ}f%VnbYQl80GP4?e^sRCUVC zE#+^uRV}4}TI6J~p+c*xt)ezI0Avh!B6Id6I|gCvAL^MA7*Y+IftIhucb?g?USpUh zY#*UnG~7W{c^Z?LPAfy4Kc^JoBOmP+IDjJg&;Xu8IU?O*0HA2;`JidDmo`Iqqx{kA z>u|RPCqyiwn%!KZg)s%!kHsa6hKxWu6&H?6qU`~Hdfx-(z+Lr1`;RmgnM_^34qZm_ zhe4Lp^q!s-KOKso;p8sI-sngz z8BK&Fts;Ie`qrE>tYq7(6&gMa07YE$rZZ&nLd40${A(eTYNM@$Q|T^c~Gg%HR_>sStj_LC$S7% zuG6A^Qr?Zp{ac8jt1~SLK2K515_l+-L=edqzv7e)q#D^VY@QNbA6xn|co-nE!K|pL z27|iYpL=Ubv$pH#Fxzi}Az*NKcfgzgWBc}4$J z$^juE8oY@oC(guyo%YnejvhA}2V-71l;$fIaE5eOI?G3YL#&h76Mb39%Ru9 zF2kFcN!3f0Revsbx;k}vRH~=V4%Uq*+Xd1uqkP0RcD^Q-TU`y|OZs7`%D!P%UbbCYQHCM6Ze^9AyuC2{pu;NZ z)(z96EsQQo6)k4#u4G0P4Yn0RnAv*OtKZ1P7{rT5McB1;s*zoZrBAY%GwNWZMt`fj zS1s1(LR<8Y{GpvvXFq0B5#lCrbSU|ty_nCrdy0u-F*(_Ec<6>Sp!j1}RI&FSY{ctm z5SzO8=$W~f-$gy&OT|k-txI<>Lz~N5vNQ1q0(R|;h)xrZ)Gs*aO;M)YylC{0k_0kQ z8yi2QN&jECR-Kc5X#0dG=X*=)5~r3&-3Q=2XK^ga67y|b?kd$Y9ItMTIO9)0B%#+4 z9S}-8X;Qp@l#!ib{oci!X7<3{6RPjPuJvR#d6g%uo$m^iC-uG{_%y6m%JhBH;G7OA zXqgF7va4wNz;FKaxSP~a_eqH;M?MpNFSn0;0VTRlU#BbwzMXq)_PKg4IlAiP*}r)% zj6B?!n_aZUBG;&Jz&Iwy?qxVxHmezCfF8V7p(G4Wee@+M}= z?&TN_-c{Q8mmO`|nv=;KL81SIL@v#A0M`Rn>u8f0sq02I)7gdC`YWy*K}iyKK%o?p z&V`E22>GWd`cJY%lng6=D|sn8D~CR^D6lj9)#Ze&{aJ}J4-kLVhY~*ecbERalFn_` zQ%d`fJ6|Zl+3`41hr;%B&+z_Qo9wqpv3SXfgWpwXIQ^SC&tT3tT> z%#>PR`9ZomEO3bP+c}hoGebUyno_bA9LM#uJY7GVNMzo@zztzwiMx@^LvtKBOwB_a z(H_$|^Ii^e5YxU{l~8K1obEXZU|8dY;x-#4mpH5~;g-cL+KhNVmLH*{2;5H%1DXHzeDPXf z&GvC?PS&Q7NlVv)#Q;)`wGNz@?GrNixtHJE&nGqQydp<>ZE{QSNR@^d>Vi17@ndPE z5ifIXlxjvXye30dl#R*L5GW+aO>Ki=mZ(|CNBUWB1kM0`)aiq?@#h!83UP4kE7=oM z1|YWQ9YQK%6byDr|0BOG%Zc?OmqL!p*7+c~B^)}33U;L={@k1m9mmhVY+%H+p z9{C*L!Ow{4IJaj+U&=Wk%xSUg`6TAWwh|P4@hm%)=1m?eypsv|VLnHHpR03{_P#4cE5ujVOnsx_cB{$zjZ;T7&yt z>H}-Dg>KDICuuA@)Svc}=eUKDc)o=HSF3-juykw8B_PHc^QTMQ=*_eo~mOU{cy@x&aTm-phYHIDA9~_K^eWf&$ zoT@KLghD`K`m&Bcxaalb3}-Tt>|~uamyvL_6TBcTTh1Tg700fkM(i(?Pz`FLXeieQ z!+yj*sM7j3iFU&V2Al-N9TX5EE6o$(&@~Xr^5YoUn96+qoScq@q?qjAJPZcLzi$r^ zkS%4hk-e}*c!W+J|MSesL#yoC%F!@7zY7d z1>E9URcdJEyv^WkyjLNQlxSP&1Yl^qI_b1(A$gyIhYCr#A&1T51nNgLrBosp{+$-b zU7yN1y#hE;_9?bHqCsN#rm3&=yI9VVZqY#~h+lRk@sS^k*F!1YqoalzbobS<6<+8eA#cA0 zy`VsPYh@4ySKED6Vp~WYU{UV!J}jO3Q5*g~5&jIGH15xCRJO2<*3 zvt9c*RlShE^zsDh{yvhKThQ{LhMidtEJuy;dPO7(9}-_t45>)4TN@fvW>?>qfoRYb zHk#G>0Wy)-i`kTqs1~KUbP| z=Ks1uH1KwTZ$9v<=Lh1QxIO*L{G+8M6~YlOOMHbg7i5QlwtCVVOJOa^Mi^9D?kX7W z!1`#|If%0md+~rvQ!HJ;nK0UwE|*s3$w=V7triyg;urZf{{EG9`mf(MELDxJx8WKA z!~w5Am0Muci6P7`Z2sE0oI&)SOc)7KqFt)H79Z79c*kIAZ@!0Z8p!y{IQhZyP(=_g zE+x>2{+ox3qw#khqg*d(Uua=1D18W@EdAH2#{!j}jfuz)mO9He(vX3kSPIe?*R>=i zdcfcjvN0RRu3BV9xjU{@L$-V;(us%L#>akjws3{A#$CSOZD1|z?~oDHYibHax!{veayH*lzc z`8gQaNoHK>ouS*nP)p2FHHk&IAv%WtSQPoFeR^@4?{Dsc@*}jXwmHAIzkaMnTh*!*u(d7$ z-9p9*Dn(jYyN`FpSV^%Tg9Am5&U&1#77%$OZB4 zL^l(Tvc-p4HqjP>AJj%NdjIATp4jxA2OyKh&E{8yT8TO$AR>?7%V_ww{7}|p*b+xm zIw*_F{C(gW? z4DwUi=mg>39rR^_4h3S&yKDfq>(MoYixv$B7`O+`Fr%9mj(g=ae zSlliouA@dfsUP=-jqqYH#9~292!6d28RgUX6Hw4~3N zl!CFrCg*x&QR3@}l|rL|yrr(kJXSKId+uCh2Om;Fm$_0VP~F9h>H(p!H%ln$xAK0% z{yeXZgVe8KHh<4}OI7#0oM*L0^U+QCuXwAz+442|r>#PQ2K*&G2i)cGnqC>GW4e44 zt;B9q7rSArR-0`7w1OjoWrXOR%>vJ@Js`WHAI_bEN(|av2)dvnABIMyPhcp}ZVv=x z`mrZ=Eb}bo(VC6o_xs|~3H0zb%NKuaczcDn=~vccgb$<_ zp}%QOe$&;gtaeUMRF+;izIJqG{?$D@nkSOM!WP^ID!-1S7ubPRE z%O82?MZ*CBQNvvQ834%HkSbs#urB+Wz5peey=~|~E~cVv#k6g+mw#aQ>F-&*{JO{` z_+dD4((uzf6Q>X%jBjAPl5FscD;A>S7dG$J@}_O`ZKnDN5B1{Fb%TKS^GloJD=S`w zTs*cFHuwVLbVFb_`jy-)?a$cwn{i@AC!rE)@8%F=91JgZms3>Ti*Z${Fsvt#rVEy; zqtU@+b8oO1Hs<8ShnXcKponu_4WvFNZJ5B({G(Nr&OZiRBzvULj!}XKaPRy-!H5A0 zb!({RoyclO?2E0Y1lvM4=)cV*SYPz0Wv4GAN7hfzlYoH{W;)6QCA}PmAg_2FQhh2i z(HXg8La=`OiJ2Q#YSGUl8fM}4E+EIvEez<>X8B3EmAoC)2TfO;KR28A@yLxi)1;`Z&;QCz5Y@ZjP4nro3ULB$!9G7S04ZM_JBfj z@OK_fIe&q^QkF3Vr+{e>B3NHAoB{{q}KMMQAOl!gh7^Ty0cLu zvgm*)endCtTwv{idVl?JnU&5?wBln}Eu3d;&xytX?;4|N$rE_b*7Gec*BccBOirJ* z`NfJWUW3xWHHpNYLLkdgX#2}scr@ge8*}&^8_&blBd)*4_x|a&t3Z-9GC15cFB}u26*>8Fh z;i`U#P5iJZ69pl^6q}noAeOXl;0HMnT&61L>aFQjqPp?NUQOkulofFq<@|Iu&WAl{ zykfh%Pe7jrUwcHKyQx|CQ9i`|%!}c$lcrw!R#SakDEC?{t=8+ZIH^E7FxFkhiUM{> zA?*nydN}v;-#iov|MT)+8AE%>-J&B4D@SGwO8BPOrX?Soqm;;ukFZ*kyHw?|6$$$r96uSt_qIn1wv5s7a4c`lp zitYNDN{-n}2eC9MSx-~rftu9GEI<2?I<^bOCh?3mSDYZ+)5T$I87o@P90^XaQYI|P zvuxIGTaV2z|JUx7sB%ILQ;wX&68W}HUQ@-`!-=t8B=?AfdD-BGHof1!1>)QGTn!==nXf41)eYaKX*z`F|+@w}(yG7y{c;`~CXZqX#FuW9{^0B zha~AINq+Fl#)qs!`Vu()VFAe2Zhs$dR&%F55ht_Ie^ha-Ldt4~YA>gY`>BR|U*da!i&G3? zbZKo^Q2{17Q;;9{WPAfsmOIHl1`^@=tO^Mf>ilGl?dt1a->mV4yVe_#god8k1k~4z ze*(ahiTsr8%H|#$honQ_-{x{jR**{eWnZ=<8ZVPX_pIQ=f!wTLH7=;%g$Mk3L2Y?# z6)vTM98_+~axVP$F6)*AtoV) zpb)SI*KiB>P^3-b;9u?-|7L5!o&M&P#1_?q--sQjs zAMW=RYMfVkw8V4o=THN9G+DHWhWa!l9x|d&fZPYVMQvCnYHU~wrW~nN_of|6L9riK zN0y=)5~$*Kf`M7VEtEzHtTMLn7mldWiGr9SMh=ifSot>(k4M<=Jd$JQ0n8d|nK~8- zpJec@{7{&N=TmtXpg`)@3K@K8>WoxxOPdf4*f2}D@XId7G*-X@zxGp$)6lAsIROq( zwGLBYIvse=e5L3}7T6Ki$s}qQU;~CIgkB~caXpudXnY}pN~>hlGINXDpZ9?ZoTR!! zn1Z~!9=XKgJ)=X*94Iz2Z_RxCd=yj1^x;r%d! zEU4bQr$VXpZ_7<~<0}_5i1oomcUTu!7eH16{aO5(3F|Rl)*ZfqSEq?$Nt*wa$A7(f zrqTbO7hA~pM%+q839rCm5kAla1tB3UzrZ7rZ`;;!{$6CF3R6_vl^+h5LNQdhokwor z^ZD2q@91w~jVHo?n#ut`$nNks;;}`SA5K4a4&|z<*ar-qm9E4XUO?~v9N&<$0`SHj zi&qgbZl_%0+%*;j5NNya>us}0CCeGOH;_q|rVlI%$e3)Y5>)U!iA-as@1=20mi|fU zyCnv1OGcDlZGcpB22rc9rXd=Z6-png)n-A_iHVZ(B+P?YdmW>sGQM{*a8zEZxb@!m z`=due)GcQmtu3jbpC79FEh^mdeEv)!8Z1A&QC2o3z5Mv_$= z+a5fAQMMub>9VOwb*`XOsg+sUsy+d;+k`xbs5`;obijj@#qU&|81xM*P|~9 z@}g%GiB zQQHxrPvYEtq*1bf2Y+UGxpe9h2d3l^2;?|@edhx!I?hLd=v6)>)9RQDA?{P5|~TvI~+ zhH7}WRbg5qX5K^#)e@?GCE#@y8D!T;^{Y3q*Vn^W3$KJ3#4VF1&W*rq8XFwo)Qbm? zU~ne#$4kjl+mnR~f$~TXeL0`|#NWHJPjoO;k6a#ZVi4|P%UdSFl@l)iMZb3gpC6KK z47{gC_`{vCC*J~GimvVBWzy~8f3bEC&XKO+y6`*p#5O0IU}D?O#1q@LZQJQ+Vq>C- zZQHiZQ)}(L&Ym^3_o?sH`Tl{cyWYOK`|f_~y?+dGgBIk5U^cd#kK&}_8}^Q?TGDU% z8n@pu-BNZ`&%vG-;e=vYo)X3YMn~v`apjOaJwd#j@83Mg?>WVB#CYsax8GG9O7uD8kb!*4yYhV(ui6f17W0#jm$Wh((Fy zsfAAo@-jVCKg9_Kvd2N$94i5fsxPM!ekbe^S z3-QBXRe1nzbz+i~*~+d09)bA_I-o+$oxj^wc(UGgzY+>Tz19kryl*pMr_E*jcuFouRn}E zMIC*`S!Hd}`e9#-#)r81>B9?8C6SdB7DSt#p=*5`)-t80WEW0jlen#iZ_>s9{Zpy?C!k)T{G!yy?G_Fn+ zjKc7@=Wy`b${4M|>CXwCS>IF%q91m%>>tavtmb~cS|A~^prRvJ&5VM4fp@665Y1W( zrtl=Rz-lAS>&b`JBlqm}|y)<3BXA2pn-WjdyiOoGcipS$Rv2x`S^?;vbkIXqW zKXKNkPN$)E%zfjih&41XSU)-jg?u$+ZQJ%JjT3*^6M@sT#0~Qtp%uM66s{(>m&$Fw zIO7IV{D85}h@NF88EEEMmM#=Jk8~x>GDC|W3{_I5H-a=%gss2(xVv9@mF#A(hFW$w zR^t2Uh8_OwWKRRffmf^Lh(~LAi$)^AKUg3|*gkYqbUlRRZx}WcD`xI#cnkvt=vB|{ zgc;J&^+&Vvl9u;*Gy>aF&rXn5>9c_&)rZ6f(aYMhSQ)_H_%(21cH?e%yfd^&QXz-yXpm3Ey0tC!~-3Z-~1l80vjCG?$qSX8Q7H= zTo`ZpZ6h=${fCo*IK#N^6X85~z7z#K=TTudxZzDWk2@e)^VKq~4>p zK}L@q$n`---FN($+J-xt-Iv^w!#Kcg^Y|nThQ5XCj++{mmF6PW%{u=cd$ykI^-fZ; zToos z4hAMIAMl|r$Hf)&0LS(AQtY3?*i35iZJ;AXi|K{1D@I=qA8?QLkTo-1W55-p{QG0w2Tf(=TT3`#`}9cEdY zR5*dQXPO^ONSv$N=GUnDHCni%Mu&cLDGGNTQuejLxi`brPjZ>pS+XhWdM1Q-aL$v5 z(d=)M1V--#fo5!-n^t0f)#IN#dSoB|-U`sRlJpZczvI(F1mYXo2wEwsTK+`-7JBLK zX?sk$f}$uLFve{%A=uN;WZ5=`FthL5ppP+!tcJj;{t>cXw^e3S&u&#LorjA6p;^G} zR|7cop{DU#luM@7zAfCu*GhaL)wEUoysZj4a2X}+O6ZT*QfK2^jUM zM_lf+#^*zY*S4@k`SDxNa?c7-9_JyZXjLHl#*vTQ$Ww-_q`{$ho48PHy96qVW+s(R zMO9JIPkAscL53Hho*psXk+zW&IhpjAgTOU}-lVUNYT;~r%Ye|QAH5skb#`E^eRYT} zK+(=zL~1ofGvd@ytuaD~i!&{Hf@x~7@mx~d<4{@_1w1WHW>bnR6;~KfZYsH125bd# z#24+FpwrNN06c;<`<{54sK^)2{9VHgRB{37itwo4>me8P_cETe1OoCU0uWkCZ^SoD zxrQYCaOK-ito7LA;ml!-ml^Cr;17!IJf9o5)j~N6l$Aj;cvoszx&$aKGe{H046jiz zN-5SEcd^Ra%TUq9_MFh~#Xf0Y=1xmB(dEbqmw)lx2cP6Q==OqdZOx4e7`_Xwbq6~+ z45s6g?Xqrd=;lgKks-%D7iJB+=@+^W!CFV=3~VN}@OVjAk7K^3i9+0dINv-Wj{p}| zAgiH)#~J=fJQ8M%MK^8Q00sf(qFKDdhB-FaD(tWCRU&SiOVz*cUMHsY-F|!LdJgTI zR?e=rZpM@{oRfmM%g{T*mrD-{iF>5(AXNo)vVltX8`WQCM{Bs)Kq=>A;?@`vd4zSr z2>UUkN4c+Z_!~Q>Q0O4SGUj0~5WHSnksw|dn6=|Yj6eN?meEf{WwCh$iITk1x4Umo zq9?CTX+pG6bZ^nJOS?jhdPZz--Z`eAV%(-Vd4i?o)55SGUkTX0znY!joz1+LQd`!2 zXf$W1H69OuQQm&d`xFSFJSNh%#2^Mumv%JA!5Bah+Ns<30qi$aJZQDDuc`t1U7!o}!j9K2 zC!cRf4gbWETmH7>BTDG4xR?9b$-+oM3wMfldP8_+U%C1s`HGeoe%uiD#|L~wY}-=P<5um!xV4WqgCuVl3e z&41^iuJb3Er3BK!m2KE$fAMKaqp?@U+~~)xr(<&tzphiV20!oU;xb6H`-m1itfu`~ zg_2VG24RIim$pjbi$B14Kv~R>aF`@a7ZlPJPLt^SqijM9`>G}FN@bc?RE$HSdOVmY;0 zZ~e*({xSP2brT9Omg_44*3H$P;spx0yl|{qJ*TiARv~ksk##4o!Qcen;W0ByaDj+u z0QS9N2Y<$H>k6=S06FB~^$T#@yJo7!fX9&CrV(MzT;uXFE|h?3!H*+QeWG!ZJP2dT z;`AhO=J$Gh+xdG%5Y)Q&v9iZFyn8j`8@g|h6l&}AnIUsW{oASJsG=L>riehn8Ot!b z5tC(0iMY;oB-C^~ScOGeZzLpb?lbr}PrDO>S%>2jwMlZpAu+H{%QpdXN?{9kKEaTm z0*yDW5x&EDB`*&p2h4SR+q16WT=!c$ub;S{=@BphkZoGP&IUIS7l;z+qfeuM#_1}5 zkHXBmFsi&0S6i8>IsM@0K7%_GvAX}Ws0)$)#-z*t&UedvBsOHQIw5c4i3Ar~#D`u$ zRsMyc`l`yz%8|R?W~?;7$`G0tPC_CHYM3H#%KBd5k+>Kgnv^fuUtx!r)uZf1xnEK3 zaG7SyZ#Ko731R*@wX~xnyGx}7@7Wy+egoH|Q%M_3U3Sp=2Fla9Sk=a-{FJRPK=mmS zMtWlUwe@n?3@m@WH_pO4Szxw<`{nug!bwbb5LOTU?(>5qDGZ2z$iLt`wWL+l-J2_r86MOVD9{*(=hB`aH z?=G%*Xo!83Mli=52FFKEpZk6!BAVx7=^bs7WNq~I4iP zH+Big+}O8S)jlQ3=sDd7xw0kG+>sXkZE7dbvq`f9N1C7}mNaQ`x0wa1zNsI<=f`3ZQBUACEVhg6(jz@g$Y%V z$jdavSvteo57zlP9O(Oi8FBO?>_MA2E*DRiL;n#%wdpXwjXR~J^&{qKgLtVsB}>OV znD|peu*FJhSzky=TfpZAaEym{TF<3{v2`EPajp%!n)Srf9T4MQLS^Fc)JT=@imb2D zj|+>4!@+o$ay6_)v9Cv%9vMyTJ)%9!Ov$Zob;XHu)D^`^n)=0)zzX4t6_H=G<>z%% zml9p;XGadFz=J&>J6ZXAJrw$_|Eh-^oM1rGmEr_OOtey-70ZK}@qYGVln~9lcim=?N^c(}{ezaMw?0;xlS5$Bn1= zC+BTE@-2lJ(L3;xFO{9zM`LO?y5EuFsx2ZV7!a2z-}>Yq0K9DzO>eUdM_iv>TN45e zujGfKDJvizK`lJPZdE6Gy62HLZUh4vad8BjP`fbu2Xn4H zz&KZ?dene=K#KQJ>W_fbFc&vRP1G6M=S1+T9zNR<9TGOWuniq+eU=|b8ZFtq`Pc@N z<*TA5yrbVTj46Fgmsitdw&};PecG@e$fMvVHJcaUz#5Tt82!TBy|E~ zFaCu)qija(OW?3D59D~;m#8i3df&=JbCcm&LG|lKLaYq(Gq)fs1;PVYwA7EQ$kD)w2-_}B-=40{pvgF z;`*JjsG-}YB=Ba6G1uP$0qVSWGFcpO(Dn01W0q&K zl4V`D52yZWzrJ#k*}zhKIBdVHxtRI5vtmLQ?ZG=-Cc2c7y(k?OTtM*YA}L+j$=wNW zqUg&p{?2ISc~GGp;!5kT(cb2DUk2+D+34w4{I=wR;C0iFvr;9HSt68VkH(%g=}5}~ zt3AOiSw({`JD3nVJSuL}%+j+%;Egcc!)AVh#FS4*nT>QZ3@;IcEhuMVoG*1HbV^t_ z;EVe{l%Uwp8dxyj>J#=8g4HXdj268@@>i*ju$cFQaMzbq8I3Ytd+MF+Q-p7Bra!!z z=~A}j``Te<=*<$KHW8Sct{oltYUC!OBUdkqv^eSJJkT9ZLp$7!Ip$ZPm&9lJ?08Q} z`ZUyzWgfj5UFM3*Jx_W8A3>B@@o&5sdZRCys-~nOjF*poJY4+1e5kU#_i2WK9O*ix8Sgzs@K$*0$9RRjrC1gGtZwd@6m;24^eHn zE@DJ9W4~wX6a7a${#obt_n+$7t3z>1Wg_07Rfr$j2st%)YlEkZB{bvtdPP-7BPI>m6l5XU^R0`Yn#;581;{MMjR?^{p58e^ z(v&cp-=HErpKyVPG2uRSv4Qj;=NMz$rQh9Jtnd%m>3==I9qfGux_PJW9%9BQvcr*H zKa2+E_&|UNMlb<&x;(xG**4TD;ai58-kOx;Xp(WFOr&baIN`;d*Q)BNd6x|*ZRaZ` zd)I~lgq0$~%IEeLj#~TJ1sZ^<?ONr6Do86y_~okX@C4QUw%3$41e|9p5;1XRQz}aa37+5T9#WM3MK)n zM#FF$l4x*ig%HvKqex(w7n{Iq5&g&}?b!vg81vhifD_Btf{`TJf|jX;o~>47xGvfG zU-@e;oO%{EM5mjWT9wxwumpmMZW55;6o;)WFxl9XY1u{A{$PGe8ER2^;h0T7dp>Ae z*3d@qK+SPC-|Miy8j-t5U_BI^sDOU|E-xAKDhNi`F~qMVP2dpMU&0Ovd0{Ms79Vlf z`YGink`q3kJaP-Ppq;I)QbTNFTeb|d}p`jXIQC}gn?cqu6_V9T}mnTd*kE9?B zF58XX^r~u3G)c}6nuWhb;@Qtd+T1%`&3q?K>Ut$&sKne7A!f8frwi>AZGq2qtAcd> zff>^Ay4WzX<5HUDuVAl7ie&iCRQ_Xlkc^s5kx}!KCZ?}smQ5IZu~DndcAgl3E>Ry8 z$~uUJU=g(fp|7>G+}SBauU#M0+EeulT|M5)5rNgUj`5u*7NU%{1m7ruV`s1~CMxk4 zG{2me)Gzr4p@@L1}DEY8+Y*tOkM+iOwAz;&fP|0{`KL4^dFO} z^888lU*A1=p9R^-0WM^8Q%Hc^0tc*Y%bxsB{>PPq658Tk$~1_AXahC1IH?p*^5y4U zN0go!NawXSVl#OEjD68>y;mf({&Z9IDJXhhRdezheO@o)9$3+3H6GrCjLR$x~Pv$vX4f zM=4eY41YM|tXn2P#V zivF0X&My!-h0NtHJ>YQjSb>5tOCEb&ID{P%cdMXOIDFOZ41j-%litj3DVf9yN>}tt zLCZ1?KqMIYC*H~{uCMZuOFF7Dp8C1@mR@iSn*VnRq@jE75{>RK3?4%RdNRS3EBmv? zu?idhV-eZ|W*aQk-|Mkd_xH-*{vZCw27~l?5CTYmAf$p%5XeYUe(A87HN$tK_|05F zaAj1fUXAXKb+MPXf2;^rwQ$|iMMecC;rn<7 zwRJ+-NKiDn8=-`B%=*jjjb0F@-&oB?aonp``SpGl03XDlG%a*o6vJNadWOu7)b#7| z<4rQ74wsf*iVf;;yW>tBl$(%}EYpi1$`aW`r{!{}1Clw@U)CUlXO}aaKT*lYwleKG z+kF$;6mMUG%bq##O>}gjwvq~nE~rIu^kE~A_h-g)b2=`UDp28mx|+%oLI70{i;F%Y zg0N)w+&iM9tJR%L0MjH~k#)_|HufaI%fcZfvRQRo@~)J4J6aY=>cpD-Q7B%4-5MY< z)hv0w%&d?(PNRDAracg5PW2J$8xt%Cy8^aKK?q*yc?tGzUoYipgO*F5;c%d$0+^!? zy5{Hp1j#F!XDr7PEax6$NB0?sLQ9b0L9Xwr@UGB%4sN2thsr;{U6Aq^zphuV-q#S6 zAgRJ|=4@WcSX>9srYC?EQX-^{6u4e3v%+QyCsrKcZn|4hd-3H5U%+)iQX++v-w*Vl z+m1w=FcBkNxqdi|MT^Lq97t;Ng0lG53J)682b!w2SbT#+>CN6iq?!;%W){M6E?2|v z0b?^emYGUIxL9L$rNb(85CL$=O;(xp&Hqu4zef`l44Ux2K0SJVxqdZ;hq2t1KmsJq zgulTv*|*I~Wf;-7cA2HiLcYw4gd{q=+D4 z)gEw=QR_IC4J`PSVI#&w)~t?bJpvytTFsH%PoDi#qG{deC988x2d%m0^yEQ>M1~~$ zMbsDo6bc-GacPBow|-`tIeQs-67}C-k3uzjEGhf=nu!A&p%TkVxa*}-=%-8Xpt&ml zJuxv)t*P^Adwxq~hch&>K~?vwkeAbslK5JieyHN6`n7L9H3c=oUSR5dYZU^U1z0uk zL}UV2OnALzeviSX)`R5RmmJj$6VlAJa(r6^#zLG4moPVnR^C{129Dql8e;dx<5INc z&?LFCMfBEAusBTtUIZVcd2*!ReB2`BC>%qQm=nu>3U=kr4lJ7eJR^l=p(Q2IWyhda3(rkt!E(zfoj6OImr9NM$eQbM?Hc)zca zf$?h(eddD+D7d1{jb>s~-i3?=QE$41^NiX}h22slJNi{@&<3`b0XK9(P!Myoultp=Y2%phM-$4xv=y) z+ZoT9u;p-Pw~W4lQR}ZP6pE^^_TkSyu%2s*90GA^i#86L|4xi<#<4!wth`CEOwAjE zK;c{#M=7G{-`qtk`Q4kq+ux=t0FwQu=qb)m`ZVXap)klnR8MxYcVcNg$hhT1nuuB5 z;qt`yh*tq7*0E<*yjI&HEvP2&f8T;10P|Gj3mAHOp%Go3%!qV|u zZmL)Bb3FSB;8#xRH3D6&c5k&sp-#%CZWpLLQZObC8f=mw-6RI+xZ!e+KgB`uaJG$v z-6(GBY5vdhg{hN+sg<6YC7pqd6>k_w_ut2Rln|f_G_wSME)|1BhX#d#h5H|N!ugBC z6GfM1;tzL&HI>hP<#^LVRVJwm4ddLL{W9U8PkNVvG$4HH(c$Ofl7yOp4mbZM^r6n1 z>`jwG4HM}Eok}4*YTE$uev%+|ec{LId%m4Www%9s((jGVf0XBccr*x3$R=w%S}v2% zQ$!9?)?|3#7#>%*87K*+krAIZM;b`H!$yt>#7z2hn=vKAEoH&778Uy$bboTw)&3^z zR;HLkZ=Y&zwFO#xyoSi&J;0)GdiePgORW7wXXz+>g1i7aNc=}RxKY6?>`Sk_vg-F` zV=I|1$C5{(f$Pd#bh8ZEhAPh}4eo>_xyAm{A%iF#I_}(>@h_Gy@l5jIC!E<{i%|V= zwvZ@=Vx}&F*&ut?Nwg&m!@E1s_5C#;MEp)GK|K1H%p{nJly4hZgtcdq&_0%>US%$w z%$-jLn-Hx%iXzy|&DdR4AJOtCBFIT+c^rv94r8!0CSc6Wx^ko8mw4tlPl?qj3!{+7 z*Cizc%x3B;Vmm6yB(Y?WDH76caW=>OpcQ@}C+1IvexEiIh7muMOKQM_t5g;Zs{33w)Xs#q_^bSj6e7+S-T@9<#^it#E0&JBn9A1$FnD9p z70;hCet7f`*i4C@ppXn5UJ#criNwFsh8O?5C=f323h*O?L%K;I%$7@i zab}OiZ%OEFp&=hG;8pFYT@K%*W5y~^Jk{Lkk)(AB<&ljxQJr%3IrPtHT}isl#>@-} zG;z=kPd=SQl~y27ZSZ!gME3ol66k;BrMWn8xzE#p09gc>uU&j6A74{Aw^Z7(QS0Cy z8nKLBw0y{D!W}qFJYJ8f(vW$1QK*w1e`yKmmuBRG0-N1Dc!1gll{mU$|B0M)>35B> z$v)-8$?M3Eq?1OAh8f}!AE@GO?G|p=?QwJw1vgH1A-Q~XKdO6AMi6Na=-KZ53JVA6 zru@?wr0^<`Kk;kIuLOG*wbH{G_-~_YjDp=>4jk4{2h|PJpatq+XfYk;m?WMi=Wh#n zb`3&mmQ1*x%JiFj=JFgh2;&1fZrogxWOBRG&6xSN<$!OK8=bb1b;<^_?P<5nSTG7| zAmKy(0~$BHF`(%jM&aLC2Nelh(q>P}kB^$@F%GnjWPh*6AJb-pIpT-8*Cf9JaeE6| z;t&@xmDqP~QdrifWTJAIEO@JT_)kx&$>J`nwN&xOHe?q~m~HXIBQSolIRGzf9!t>V z^k>BFIV)Agec0hiU;NwaT*XTjF~@M zdaFnu)p0K-#i$ujp^3&zlBpmSlt&5|G=KC82*$sXB{Xz*-YTG2tMZ(&inSQFR7*0> zo3^25DK!n|uMl9lGd3#uoF(0(uUd`sMRH?e<82ULHDob~Ya0i1+kBP$e(JkpAdxnwU?pcXCPP*j*w1lUm z;Wrn6)1N3@^TspMqb$#sfD50eJS@Lu3Ed9rQ6U-B4H%I4_c-ydX%p)N@k3mLB+Ql^ zXTr~l)X2h)x^X7Q`AhAVjy|4EI6l#551Wb(9;HcAn{czXRzXoR?|~M63OIF<&T&Pa zUtjQiA!gclJu_q{7Rtz~)~#oN04++;sHitiL1|Pp;M<5nn*KR@B#1#(=LdnN|^% zJz+;p#2$|_Bq5+uRJX2>d7V6KwZFzi4kmqCO^F#9vDj_6pdbG}WkLGiKSusFZF0yV zzQSLEh|wsWtl1KDc1bYA-y_4=j6O}=?0LM6`Uk<4c7CUcqvrB%3$p#hNup=>G%Ya_ z*&gEZpdb-3@CL<$qzu+vJ!CLCtfPFvgW%{|<56=Ia6-V}NDAZSK22w;s_^SxFE~%n zt)G^8T`40(iT*^hyL~&RGtT;>VIk0h0!x8zjhkL*NDv`M2XzGbK2Vtg&2M~~KQfyz zn*2*rVf7kwZ=b_*o#G}M%j#1vdba6aF-8Bg^3^uwGEl&RzU+?>u%@02fm@3yo3xHM3VmO9FwS)*^ev@F~QH$FBh zH7~lz3YI095%4K~;x^9!?e(D5^@EtL2$(#_*3DmZma^dh0=X!RZXqY_O834FvR@wj{xM(b`{a0IAIBKqu*ec|1p zq;6lKza#r*PS6Aj0X7DbXN;*yW#sOOBo9K5)TrJ~&u8Nn6X{V|qIeqorOeZ|=22Nw ze?3;_Tt8V}Wf-vlg&csCg$>;GTucgW@|BXlhN2=B<-pryq%PmPra2WSP+}de!hC0O zD`m14srRJx_|Cd9`T_*TQR|r_xs3{URkGUqat~(^b=!{{H2Rje@rS(b)Kxv(|2%Ed zS^bHx@tgeb$@9NdA94Ks^}lA8f7CV65w z4-jSGrkeZuy1R&+YYnle<+q$a)V1_l05EWXHe15_#e33YLFb~>{n9TASq_ke$Ho8g zMK@c0Qz#rncbNUx^Z8R<^AZB&h@%hZLkV_lXkj`AP4cX9qP#r<0l?FTb_5&2 zlS7!bX9(k%go@5)8r9!({;jS(e*@%5c8|2_Jh*-$mEFz|9JF4^n#h3xJ5AnBt^N+el^8v`_?A#KxQjWi{$8kSa9tPcIHWmT}jX5|HEMzV0~4ixx3*itV024?%sfT_Xno1}Nhn zU-ipMvC?C4+Kl^+rqsIru1o!)t|>48fUE6%#9ugAV6TcT*nXW7`eeW4Xaj&L;!Tre z;E^o6Z-+VZjzHA%j@qBBoFl3iwo>$a&cD?)Qf@#t9nisTJV0h2R8vD+5sE54B+BT3P7}cxSKEe1D3uP70g?KhBE+vclU&_#bYJ`8PYr3(395*(NsD*9TUoQJ8dNapz>tv^Ok$@a`8M_wZ zz@Iz$pc6K7*Mi5Jk9oDf<@}+pNp%8pG&MwHJ$Ew$x&*|gy#pXy`&uB?0XbeNAs@5m z*(Xs9Rk{vR!{)B~Ptw2TsPV@C^*;SaT{D;fWHYvv1@|3H@gr!X5?Lym$#*9lwE=(; z6-PSEI$gA>Q{73drYG}LSh-C9%IWwk=O1;gvI39+9?Hg1JYJNwPfiuO8otf0ht5F* z$kBSamm5YQ^|96MxuA~_JwVH#5&bPkIsd3@S9Snkr7sgUlFpgAzNzmVWH(zQ zB^XT>AjdF2D|vA`UK9^W4lh>9-^nR^<@vXq?}u)G<-ln0ohwSgs5zGdvXCp5zlN?% z0y_pa-Rpa^e=W8i<^zD04Jc4|t9(f!DuhVcfo;zqf@i&c;SV1iwV9 zKL=0@mq~i6QnuU!fH%yrk9{gey^~kIBQKKcww|1OQe$^3carhniURrG|s_b>M)WWBjFW{b!&5$@xcbYv=@IVIddZ zL>jKQZ{qj%J$^+&Vt&m@1pxi|6VB_;ZsvF>dBU_Tm zD1`5q)2Kf&%aosW^{CSf$mUDNp(AvP-Zr(RnxR!s5oJ9O!Ty)t_VcgT{U5!Jy#N4= z`H)u%pMmh*=K2h$AzKE35YP^nd@#SD-Xi!?k8Xc8A~0)WZMacxq1DqSL%ixMC2IV_HYY8Q4J>?X4p2BM?{qGgHQFK5Sb_551F9G<6DtJ(|?`?`eyjt%TAV(mSmK^V(%SnydYMo2A zol2SMVD-10KNPr-eL#*bdJnl6ity2jnT)my_y%)966zWt$BQyEY*CCR-VX7mDmF(R zUO8mWJyh#|Qs90i0v?NyEK7CaAgNK<*uRm>zbig^&X<_S@apr89S6SRVFEr3x=u`` zMo5r44NLPLu;3is1S~ZR#F-zJyUMak$|;|JL)!j8;8-I7&tMGo4NM^xA;aM#ow;T* zD4aFcaC|+V*M1e%0=ff?{Q(~io1QNabMw?0MtKU-(??fa6(!#Ct^9{<)63(2s#adV z<^O@eMVSFUl&iiP$&r`n-ok}yk7VeBo53KWk`^4uzkV_1bof$G&Jz+Kp6hUad0=MOVJ7y!6%vDR?I&4#m3vwMvfjElI| zv6Th@?#l?>UVrya9u|!-OV4(54f4vVfyoFWa!Wy;5Kf9~0o@WaNRWfA~6bF={F|M3z?)-yiki zFx)1!I6aFFo#}=swf9n@p8T$o!OO3{Z&>#(x^GMgdziW0c<=unyc-yhPJ3xc+Z}P0 zuF=ucSQ#@_faFpBHkGp2YerByJs@ZxO?jVGxLz0O4U|e$d|0t(48WnhkQ%f_uF42c z6_bPI<@Ru1s(DMKy%^z7-^{KO)(NZlQXk|gX-#(b;L!5b%>v_Td)>Oi-dbE{3m@86 z^T;zjb1j@3Gdt8dV+~UgysxleQW={`WpF2Fo<=!AA`M2;ER@<1tL|aa9BK1 zHq9?M{j)uPugvNjR%AGkmrI=QHSe;8UzfvA-cVNkzbt_$6#GzOzpJ7&4S&Z$gMc(M z(-P#B0h_ZRiK$b!8AX9#6oKzt%`TU?G?aaoT)4?#g!CYSZyu6`zFI!pm;dg|?4ra@ zjkOWlD1_NWY4${VCviwi&i1vO1QV}#^TZDc%@N)`{lo>G-OS;=N9^9Ot#-klaLxH# zsG1cQhMbw)f7CoH^F0}6K*g{u>g@p9MyyUy-!-xcmVaF4x6AX-*z*qpcft+zVLfjh zNrW8^#^>0*=Z#2Uc@fxFuICN6_JFRY7)5`^0i4K;~7|D~dCvv`bq z;hpGUM*yyQB~P8EPN1YjAq@6cNaD{SbB(_EJPJ@~O>yfL+B7;(L(S#6idm`MsXN_< zIRztrWwI>oOTvXv&x1S*2zmomH5Fp^P|(7=k~0++WiD{bKbu&<0Pub%02doU$YiSIdwxXT)L^~h?c ztgg!NkR)TG-q6tp2S%#0f(X!+F`z>##P+Kuo7&&eVbn{CVBRcU}JjANO*X!u zyG6A5+@!y;C`11nfqVaJX8s3(D+q!Ighhk!#SAlKJG8?0y?SUxg}!`0{6*vLSkP7A zWPWD)bkMGta)w-FOxZ?ff)hVBFnhM9bIi=R1R6$$IkCW7j@NB5ht`VedAZWniQ;o6 zf;`vh;|sg~qwr_7q_U3NbP#OM1Q^93&_NrlJ`{^RG#np|J2=9#{#)U3g}zvXoc@r* zGYoD5CRdjsR`s*Ohxc@_cfCLYnPKJR86Ms}f=|FSHasF=y-h!&fgor(9Ff{UecGc(B2z$eazy;`p#*kKm04eFezWn5(5`w0K@q|7f=h=KKTUf{fQ zc%nX1ilxwoV2@bSc}GRB@R?&AN5D-%b<2WFMo{C^{G+rPg& zXCm+b-xf6@4W+O311Dp77zI1{yUWE2cxD=Pcm`s}w!>}dMb(oIp(Rlf;!)InDhO1$ zp!R#v+x$5pWJ1kxG(T4d1$q!1{N#q%KL1ShLuJjq5?KnY5Qmlr)k){tOM36ZzKJo= z&7?glN1iTk|1$q0**0A2a&i3#(s+23>ZFGk>NfLBup9J4F#xxgCb`z3)WFM*6DjfS zN!ZPrrVe^@qOoBO!;T(7V{e*O4pVX!N|vU8UyPKK1+!y8Gf89D`IV9!_6?OkCdR) z1pd|tuhYE%I4FV_ZNid)1O;6p;=wOJr>`DX4(YNxbyJ^8>|#YKuat}E<`>?Oy?FfG z?1Fe03}7`^y)sA~gip})#T>2!Ra~#;3IBz_?a%#rTn@R->dRg?w{qW@>J2jQ}jIl z;I~wYYl}yz%;|j^(}i6J2-+MVdIjyF&?=Sc-eytJv~-t`MkMmZgxa)6ruVN?ohSI0 zIoLtPtVK|y^k%8ykmKXTz$M`=c)fv@#ka|yb4b}sco~_MHgo@Y)h(>{9hrC(qg}wvaF6-&xl(*HTowW<*N#`P4(->6-xY zEhZ(KOO)mNclfjffw%x>0Wb9U;MCd-bp6$aME|*wNu^$zXORMrL2DfSw&e!l+x3=j z4NVt*HXY~&T$2MX&^qft(eU)bX`aywkVNVAd$l{i3}hv26%}E(%V3kH`!Adpp+KVt zW|ag;SsJ4JbxrAREc$I%+W{1>Uuo%Z2@}fY)a_>ml1>z)p%3tMiE8PWn&h- z=^LSF$@{oT>-%&@h&=ysWcMFH@gIDc5gOu$vgVjWVFCRpI8`F70?0EnQoFdmKwUD} z2Hhde3g@Cmi2JG0wRK%tus-{AgSV9F+fNsaZm#DcxaO}v5odQF?aDK8kVK0=edDV1 z`*`P|4S7^4Gab&HvwFe{Kg(F0ug*q3MI$XHzgb45kxS!u{{&X>g64E~3%et)k=(+) zgzvbv8A^rWfpK?y0F57uO8s@|<3bChIYq~e0_wEBWTwna3Gs;PDc=;3F_cOd5LS&c zGf{db0fA*iGKO7f$qMOVT~Zg3*-c zPPRV$1+b5cD8|DF@IHhfX&JpB0WMUsc`l&K#5l8>4?ob-gGcFR53&qkI5ix7LiEn| zz`fYXmUTM=o>pe+J4NyR(T;>K*Q|WA9$RU3{O-$=A7uvNZeJG6go?5nTgR$EBSyl_ zfMTsRjU2sSbA1qd`EKxbdpG(MW7DnNIA;>A^3)W;*>a=qi<1SnbHX=Zm9Z?PCgAKp zg`E@93s-usxvI-{x4M3#_g6jJ#QnV&X-I$=s~Kl&Q7*kJ)mp?A{7#Ezi2P>< zWf8jev|Bty3~DK9> zMa8uG=UHf%*?_itBc{%mX`N2^)E=D@PI&k=N={}q6@7)q@P%sf^*f%+Pv5GaqR@8m z^lJ5`&6hk{^w*Y~P$*}|(hwljEbw$7N@R!SpoE9H9)q?S<2U$Bs3D<6A=$>yPY9{x z?lmO*5-)%zE048K_F31K6VS)S$(2d3!;VL`UJ-{Vo1Ad_R$6eRq-6(T<|Iu_E@O}Z z{#?EAonp=9LO)UDE+xK;L-3~oAshcuy7z~IjFCyb(eDH#JseO{brGD-eliwVyg*%M&Op($IQ{+2azY{LCO(vU?S@c_sNZojnqS_M1uDA|__6(`N8+P_DHRG3tPj%?ZHO7J%Y;& z{q9ZfO_O9-d0JBtlFJTECqA#sFFY4|ZW34(?o#!V|>u1IKak~zJ!H5#actisiZo9yw zfNHgi_L1>4u`HUwIhO!hoNbz>1mj6(Q74!hHxkE-y~#>`xGbx^P$jD{jv}J1u;?b7JGFDSsJI^D)xc2;DQ(Of#6U|?IY`&N zFQXn=11iStn0>0-Q{WqI_YHwp@#3?)FgdhrDFE7~`F=hE?m)e&>GhFpIt5N-jcDys z%rerwb~J$xNUn|{;S-x5*{EB3@N!N+W4YTX)Np|cDNtfJ;0i?^dXcklYRo1HEu2#} z56Os8@otU>t_3CZY5{C|oZPkTlb(bOvo9`CP3;fZ1E|t!GE&K{xW~DmJhrVs zdS@_y&wcH16V%r69hi$qI@0LNO(1lZ3I%8PKmytd!J+)Liol#n$(4J4zqENuwQdik z0SZGh-)A?{B_qq?u||_b&@GI-4QlpGB3f6@w#DD`_!l2GY=QXgRrDi-%~9^XWW!5W z|JL1XuBFz;Pb`4L_Ht{72UQCa0iyNe@RKG`cuwf=Ze z_8zE1Cb|XN+DTai+r1OYQ>`~7{jvTW`yo%hF4yddRS-v#+c&o4Q-z|}1r?A#Y6()M z=XfIZ_QyP?tEneX>oet5pzEMz;Cv}-Bb{DgE=sIlTvu0oa=Edr$Do+X*3GnMgL-IL{48iC=M?WElnJN2h#QW+2$KlerJ zlLPU374&22fPX!`o_%Jd(*3-#o|uCXV>huUvR1aIEwmk7!13;^-72j5sVt7KYWDe$ zwRZ2pZYQTELfi1B&Bm6)4>1zB4iS>xvQ@M9h-uejDc>D%FK5TH?YAoqBXrUvN2%A*+smplubk+Gv5U$ z9hRaf{17&S!zB)A4P|3^PXz-#a-`XLjv5!WUR(Vvxvhl9mx7oqq>Ajl6G4>ckp??n zjnRbL^puRIfos=}le=F2XA1G%b1(@EiewkDaQO*f|IFhbd>Csa5>O(`E0EXvl5CD7 zlN;5exRsvpc;tQvS=c+Y7sKrAL23=XL`_#%tJ=z2SFH+1BCY>Gs~;Z0AfdIV<4{1T z>T^LKR0ebkH1=^OoD=|Ykzm@(;nR()4oUF24(JpS=?DE~WXt5xNvtGvHQ^1?f^^#} zj-k-ia?uhdqpn7N)cYAm**4@d8yDnOmtt(ZCr8hGJ&0uG_MtyU@+1)^*3%gj~ z`HxCIxUkE&$;8Ka+gIf8M7Q_48YBls3SkhDQjDR<=spB^{^ZS4)EEM41KLTxm%5%> z{NPUdx&~x^*RKSg3lblrXN;m;G{q>7`^%KE=S;fT1DQLla($gAY$e&GMn1JyG84+K zSsHR-Z@D(**s9LfVl=u%|GQ|S=`0gkP@MPBaVulmBf%9rgz(lv*XF$1(*>jDE7rYQ z(NfrnPE};>NmiZ8=qVJ7Js=HXazKv`XGm-Y9!lI21Z#;xsy6%WSgfQfUfIW3%iV#2 zd}YAY!qjIL3+vHqKVos~N;5>g6$JOXIF`(*T&Itp;H5%VlTG7`HnsKcIX-FAH>p~M zt(4srsCVOSQW7-T9#kSNTZ)cqTHR!57U{fH9=xqyFVdym#VzEc$BMiTA z@E&22Y#E3Xzh7R8#jQgSw6wn+^w>c3(rKvLzUAIEAlUxj=JEaiKmT8T{+`FbbUAfO zB%tXbv0Ou)24Uux23i_wjS3)QIJ4HEb3-b5l>=##62I}-nY(+6G^HbGzeC>@d&mjt z1w`v8biPYiTk|EAjJy`3H%=P?5R2I`cq5o796^C~?xhtL!{Znl3Y%`+T;4;O{0d>y z%G`kou}ki;rN-$H2s0GJ0yN5qVLQee&P&i4JMUWnn8$YbdwU(q8%W^DObSQ?!q>>+ z>U4bK`OV>C_7_d(qsG=go~Q$%m=B)+ec_5jcfv5X90^^@XMKxYOe2Hh^0Q+VKnlzs zXyRO01Mk^9-c+Y3x`t1aH9;Csap1UW!nj2b@9w?j+(+^locIg#tBddATbk#Ip%?Ra zOFx&c2wKR*@+Oqs?K+cA+yZKGHCKcgpaayYv2*6}8aUg_z!9u5gORf`Z`xZ1U|~4{ z*8arc8`Uky;oOsip9J}Y<~5Vh^VuCz7Y+ppM3UBQL!GqTw;JSutbA0X6&PWTaNQ<< zm{9H}S2gKYoDTtcU9Cq!PdW>Guo1t}x^yM5-PnwMIg_+olba~hec+pR3*}R3%{m>b zroYX4yvKa*SCHHhA~neAwK{m~k-Aa>TBsLP4W>`1O=W?7QjZQY85f8qN==!Gcro`OxFsDB5N6dtHu{e|{;A7R z`6GTSDB^m3ZU$?`wrZnCKoP%S%95Ex|30~M{v;Gw=l&rwBy9Ee*peod=)iZNhvgj4 z&L1ANn6!`F+YPL+%xfHNQf|`h6QHmzVQ%|zoH6AVJt>4$@!Piy;~KK6t$8uv>u0$- z9So?omlgJpQi5wqC!#``4djh1Nlk++!81(kk%(EK2exB(e8KvZPdr0{l)`Plg|4VW z9R?<~fE5ia<}^j(%&~@ZojteW^H_U%Xxs^U3U48l!QWgoUmxW>L8k~msS{mvS{Zy{ zFQ+{08KuY*=45@!18!cRMc-fGtxPv1iq1#cG?$PLqWK|LiR_zBMempVCDuo+v$ZHj zk1X?ySenna15~8A-KEo1%upoML*q#keU&foeuy`8xrl{W7+pm+qP{nfgws>y1dy#c z?_#{1;q%mBgZq8rxD_@RefGmI2Hb! zzL@>aXFQ|cM$N_p|4@vuN;sXTSyDp;r8Q2i2oY#l@SVVl@jL&eD~juyu~@6J1p{5_9< z>2i=&i0|ONdhh5FY5v1O+m+s>9%BoZ9pieobbwKCA8RA*MAmWzlg}vBvsqdcGdJfvm_Jc7?X8?-c6jaMQZjFag1t6t zaXLbd{g7ED4AAX{m#b7^Ag~f+3}{1q^n~}MExy26L>Kmv_35AOawTpm9ow8xj|(ES zXwHEqBCEwt^Kz)$uJxzals#TnqYTerFZ&0A{I5xO)c2ByASP$urLi0>fzU~ms54Gh z6cRn|T<%wP*P$;~lG~f0>l0IBDGB;6O^y|icg z7~aiS6A~rxM^Y&+B^d?Laywkk2m+2eFxyo2=HV~Pd_-TS9Ah7V`O0=i2S}eOu#bDA z@za#P%gPmcg_PV@K$1-{dr}%)gdurKSwPJr3C*sU`4ao*JXpWZNaoa^PE;9L^_|XH zH+(dtg%Re3U(i$V&_p4kxa#CIqtKcR$8QQ&>Ny!N^5P2OLp$cEzqBm8N(ci?QW>!# zZn&8>Up}q2$pNp)@QLtllvN`j55YO_a}e+y(#CZRvY8fCC;kS-npJ0gWr*st{$>5) zdLBr^ybl}!F{wF~qf^@)=DRxRhBRsA#b|_e%7}N3k{&E`Q)d=|YwC=I!*_E!sdQ<@ z>~FhS^f`$Ms_V6_2jY**&uczheR5agCplin%I5pZmKa4{+3*7ggX##^5z?*xSO>|e;Iwatq)>B_6+*cGN?BcJgv_wH zWw7ZVVGwn#U8B7>@@gc}1>hTAO{ORmmvY?8miu*%_8_ZyaqBVy{#3tIb z_SCnkCvo^J>ezGRp{}*2CX3e+)D_&{9!i2Bp3K^%4>^H>$_A3|=WNoE1nFaQnOPb?19^joZ(>xBwdnR&Ui zOqpETCqkacjUn;LBwtWUyT>(LWdxS6Dj$ zuKjjz`dQVuAY=}3QowFJ>-hKS@h^OE#0?23@S;#0#7V|0M76dX22zS{lJZ0Pm-nEl zOZvU6=+Mmrf{4|^pc^v$Ht4pK93EXJaXkNdY+P?af6<%XBH09@XmLIzj5yklPFue; zc9`}~1o+AR3F@0aNAVt~f~;>B| ztD~;9S3rNHEmX)1SB9+Q{BfcPHI4oP48uL0x+SekK6zlGw}qzfubMe5>YJ!V(uqezlO@0VrslbA zG0_+8uJl#4a?;e*>}NI=D{=!YjsB~j1FPt0bu70MnZRb}{y z9S8KV!R>1g-hlJRCohBFIqn{iAsxTxG|CC}`#y*V&-9)kqNOV`2BKRM==B-|-A)*^ z?{J>RBo-9|7~P#$RNhuj7H-!D=1kK{>YpYf9ks1iu>Uw4wvIP}TpE_snqTAq{dvS6 zzVxhQ45mXIj9>8BqeU8AWjfXaB;M|z>%)a=w8G)>wlmzkhLSpU?=TGf9B>k`cj^5Q zR6JRUR&~n9^CC7|!kU7I5K%OLYnG}azpo^NJtYA$!#7a^qC1%+L=OJlS>@(XbpR3+ zd&xIVWc9=uz*Te$Ot!2^8Vh54hP~i|CBz?`y!f*{BHw#0yDZgBI+;_?i-CdM#b2;& zo1kpa+}Wb-8rpU8d4ztRO7LMYf9Y*6xwj3+VOe&T+2uV+&ZSG`}Oq4z4Xxe7oucbE2~&u-58L4)}$QH#fqE;M?N zLz-O40%3a_@k|^W`V!6JyyGc#dH(^)qx~95gzVrnim={jRH=4~o(T`tj0C#e2 zR`$*QB)xGs+sAh3*=E^2d6(=uT-790(wo|X z&9L)3*^_KDUKm#zKC*-6AuI`dC9`;X<&~@GK4ktS__0_x6=KX%du@^-%Nwb2w)a^w zkiC0u`m0C=ky@)n_NV2>{kTn~XUB=|@J!vjNK8{iSDXQnO#1A;-Wt(YE{@20p6(^A#=T$=YGJxI8xjGW8aLFCPt&OMndlH!_NMpc4_>+Z}81 zScxXP<<&D0&GSXRJ&^Tb#-DCM0HHFUS3Bp>W(vl0IDa9TfCvuB6*F55}aIlc;LiqO3yUC_& z@$7GKUuveqDsiFk7_;Ol+@F4eEIzw6np~E2_z%ap<{1wBHp4Qef{fC=yQr) zjOAo@75ipmW2{kqo;TpUgsmAY?DP4d%Otokg2d!Kw>g4AoGn`hU;kU-%%yFygnMn@>#S0oMumyrhZpV}n+U zolYUh4RW$SvZ}~*a9YpPtMFHb46YPai zMaz;2#mDfj4&%mf88?^(cbSt@#8`&KLod$!Olk2cT8LrVifVXKGR`4^njhDW zC2em?j$Jc#rnI^DW*cA#VZ(cx+GJH^rX&4^GvyaKAE+E{Q#cR#LzR2!?2QBUOuVjB z&z~j3mfvao=G`TP zH1>&*eHoH-Gq)GE|58bcA}b$PW`VdLB6eoc(Amc_>T%B5b)Wcnlz!`9Xw2QSVqvRd zv`Pime7E4`A9DnnsE(*>J{~&2`ABh^mg`-X+u{kNMp0Y5h~gDr|bX{VW0em z+^?Cm_At)5O)y5IE8L*dDrGSh;3wi>6lBm+vURQ;U{&HmFtUNoQqv ztmrPU=~OAiWaRH}8#s+A1qVM#+jz243=1Os#IcLkXH#5=sA?ekvC7{nI3GKdsFnc% z7}U!XjDyG{Y*CEttjRPbzcADTV9Y76QlG9Z4c(sa=~&OO80J3Dqgh;6tzA`OKo(v` zmGOOYo<`5C)esVSZRcVcxppW*5QCVk!@i|40b}POo;(fyK$w3Phx@BMj<|)u6f1|} zF8t(YxKpaff3@u;u#qi7G-w8FtOw~wG1;TNy*BbNFk?r6d)jn^sx;w0;fqjecP{>7E$gC+W%*I{IB?+s1o8AHx2u^mV%;m78I0; zRUIL-zucYy@)amNAw!Mwb@tI|G&s!1HNQzAqXDxujbFSJFzapYmjwX-DQKj(K1 z#KxQk2omCWeC+eZ`o-47E*Dky85{$9Kl2BZuPHAvPdST@gTl$cmm5zhE>oD)OluR> z@aSKsYn`5Hos>1@W(eSKs+JYoafxqd)XRJ}GT2Ty@dr|OrpTUNhYhu_UZ)O_lQ#pA zNaN@EZ9gW=liDuY^=TLcq;5p{b(f(%;7^kMln|EU$njl{LI0fLBrgV zep#O4f6dI@IeZ-v5U1JNEt&>$2SQnfAXswy5cc_*K68_#}7n!4+t zbN}H+E8!Um6q-L@x#$tC2Q=R}qcfaav2p^{O=7Khfe9m+$Or$jxAfMeFWr#9uhlG_ zgmj~@vTAC>tkYmCrtB4*^5N;Bh;?hUnYHJBM}?959^DXg;9TkD!%1Hj%M=3&g8#@=Nd^)cH>+p;nR+m(j#TYH)?6*4 zV|#_3n!-x}vidvT5`2_ld_xOGb)}`})QEF3opLWE=->1B7e4s8g9OwM-HCpeiK&ty z7)*RwtztooSY{W#On^6%OwdP^-F73F<8CcVtM%K`Tz14HZCIJkW5@v6#}UfTAGR3` zcxA`tO3M!6aoL)7c?(!j4C|F?9zkkhj6Q$00ra}Xl3un=`hDNs-hDelmST+R68f-ZGGB4BLo zVR_ZmE$Zj*pq1UQ_8QMqH0AYrry_l9S1{wf`M32G=+}^j zP5hdsSqqG%5&1851$V4wyRj4F=j%{)Dn{cI_CW*XybAWfnh=@CffF1H`BX$dx`Rwx z3~;im@K+Z=4XzoN&XGKqhNW!7^0MbL`r0*vkd}kDgQCaspddRAXQy0fTvxm$a+ z2-8r3DsarW%El6nM6}_Dc(=TevS9vxJdQ4~Fy? z`18>W^UZ2of%w?bwYCZP(&{G|lQXf;8QhQc&&diS=k@KLMT=DZk$RUnEpLFL$ zJjod^$s9gFZ>QvTP24PxJhqVRyq(+64?C8BRGZm==V0}Mt{b_WM*k+wp%(*9{b^et z+}D{NL#6;;$tp*Uv(+|+0wnCB@~mh_rI<(+X=YjkcqPeugH zj+vK|HFJ@r>p0})kWMR*TVX@Jl9BBqsp(wko0mgRr95AR^%vF~(!}sjVyb?JY$F%r zgtMD0n*lfeW-|RuB`ZmMRr8^buZmSVjV6g@1;6sXckc`1*y#8D#UFVihc_i@%{6hv zQ|%YPuB>?xMdxUU-hz}ZKa9n229itVW4$5GT6jSHg7|HK5-Qiu61gK#H<&zJi6~$R zU{_imqTDR#Xde=o6$5=ywD&x}>EIxEkDXCwij4!uJuifMp#MHST%Y0pT8sS`AN15h z{I*+N=6V^jS;m$q(aTxu!oV|TG&|Ap9!d20^?RxS+XH)9NiZ#x4O@zZ8 z@+5Yp4>xfQ660{18BY=DcvOlq4N*VpIDj7{Cn7@bILzp+iw=yKX=o0X`PZ~l#;zm+e6Z@Yxd0XdiG^+ghyF=XNos15;K z3O)KZ>}|2xU~wL89nj|%zGy8>4@4x<19x|B`;_IOnZ4@_B`c)@O1a}`Tf=7!rwe1R z19RL;pg26g4;Js~E3^`n!7Bq4S^P`xKp{*??ncV|`&81E=~2G>4TPnmuTlG%IGE+o zMCGUf!;(nz+65%*tGl3X;QXLw=4q_LL@eQI&tr!g>QTouo)FgT{S6%DKVUSf(~O?& z8=_07hrZDfKG!X&3-s@+WQ`Lvx{1Iqh@0lOs_zcsZDKu>s~1Bv`fQYsx`HG|ArHd< z$W<=i+HizUR%afxImkb&LJH&05B`vHyz~{}D#R%q_rDM=WHN$;;pPU%l%Ehsmpi4)whT=k1Cn)V_^Q~E+iy!r2^ z<@LPP5Knol7GI`B;x!$y^??h&@07(~-C0E?u^Wqq+T&I;8!<`d)5jhc7#e7c{1aFd zHa&={&W7M!`f6?qU-v?DK?lIWCbe{qp0ynHXM`SD2dxbNLpB0|wdw+|;Lv0CKTr%m!3P8_PR^=}{$+5Pa zQ@=sUiBHr12KypJSn%j~1IgiFn*qV}WbZJU03*@EJ)pI*fR%PkpE8xRg#x^z~U z%ag(5eUqF458}bvWjN#qbxT~#9a)1wNY{)>zGD+@e0OU%XJh*xqRh`iE*fh>0RpS`@^c9cWooTiX+h`reI_ zZC<&25vga#Y~{B)oBON-a#k~g%53LLoMrZ%;*YQGFjdrH3INovQ?LS^3G$MTK^zEP z*YhfO$CsKkyN-nxg8Vi=z5A;RX*a#@7-ZldhP62W2Zh`lUr~#eD?Dr(dMz8beid8! z^dE)Um64t+EIvzfxrXroM%-=_QqCEWErk-3ce!QOaITT@0D+6fcXbWJlW0W{GRc~K z=upzrak=UNEK8;zvUF#(_}2Iqy2_<1uL#i2l^zOOOrx(*ZXeKaiPcV0(G*ZXZ!494 z!9|*$xX(1osE>UMxhBiP+8IzCEZ}~L19-m7mq|6fwinP7wM>d(&kALBVqD_e3>V9dk4fEp&Yh}W6KmF_WbYzo{wX@lPhFCxSpkgj;N~aaS{A_&M z?_8VeDVK>c5}%l^@@6&cYx%$;ghIMF@^Q$+GZi1VcrZ-3FXjW-Z#bF}VHO!l%La^A zr)mHqM|Ua`U)m;s?_Zv_LGiSVJ;w__e*F^f>~^CdJJwGW6RbcM_|!%g^tA~~B2hYU zIp{$K6%aYGqx9@!mhFpoo+T`^vj&)cTGu&Z_&V{z%-nnA9pmFvbKbta0-rp8ADDAt~c`(Bwm;&BRsy2WSrZT+e z@&Tt$ziwdvGsd-lP ztFI&^=OcFmqWBD7G&m_;w<0v4?i1kK7R&o$KeA#s(xIS~A>K{=5Z&Ek{)C}PX0{&b zqSqw=Du~PZ1^E)9! zlF>|V-mq4H_9l^dWU(WQklS-bEUP-zu#77}J zG>}082TeHqE=_dEzb_>jp`wSzQh+XFy=`yf=yt#YhDBkd7^4-MtFBx~-$#N1ItE96 z6b2`)D>SfJGu&*OmU~S2(hL<72@2TCMWd@ZI{J$uti!QvOXq@b?F&rMQNZU(@Rwai z_lcwtFoWJTVj4l+LCH||hprinG~s%v0iP&=hG`1sv(ww$@3oxw?7x73ngz1Hbw6ra=za^j3{`^BV?Cw;*1p z&c2EWqdoOaQDq}|yRdDmZ%rVV-GKtzo>1i&23(}>YK!Hy7uzP_a;cPFd?-jZ0m>uX zy;_44`Cj6$2?@wQJ=rO(HH-&xR?%PS z6;98L2`0r(M(mS6$g|N6d4=#QbnfnAvB{)UaF@GeRmJFs`)1fyMF!;;xvpMA62W8{=n5661=}br5*_Wc{un|?(b~?$ zIf3h(-g4BsXaa6)6fS$CW`9nszH4G|r*2g~gx-b3z56v-YV_SWOIXFxjqXtG=Jjr%{Ujn(M<4^*0Sz8WU{!EK5;RRK!MIrK6*xFAynTK5tyTv7@Tu zXb%d%U`7;iuWY(b6C{(XOX`Bx0v%a%(>g4PL>=T@lh&J+cDfhoa?^5i!QNbieMK)maEVgXHn*mS3C4hS^3=Er1v^;9E!syrNncrWp z#i!W3#@0Ix-EexZY!wzEz+g?&SsNgtsOW3NXm18q-y5t-hufK8K!cF?I2@>Or0u$fnJ%h)vH(*3@ZUppk*PIldyXw^(dW*gA6 zCUX?w;%xwN6YLn)OZZT*0W(rbmoS`G1K^PHe$RU$)D2N}YLF*Am%R(*AgFZdWbeMy zi9$E_>?le>#<`gX6dJLIB^sWpmM}9qN?^n%r}SaXk{=W0ZX0U6m)!*FwV^~^feiH6 z{;KaK5iwphdm%v}=8m%A+XT6?x@o8bUBlp3o&4mE3s7OYUyrlMjE8~!Zb=@Ymx3^$Kg6KsHi1NRSEJz5Qy~QGEWt$dc+&78`&Q|g6~Lo83IIJ zB0&psIOFHGt6c2QIkNjzd@hP6FOK$Fkl25M!Qand^Joq)3dKeK5o? z3hP%l>GBx^KK{cdQRnnIqC^Ba5V;L3{QZrZEzv^Z0`(yYgRrLv8(Gh@^XQq}yik^$ zbadFRo1emerY_tTbSohA!bE% z%*+6&mwj3%aK@Ry4@Gn}FNzfpw#FjHk~O!f0+eVchsDjGkNO_rK<^k5anxg(N&F(E z)E(`L)vg!M9xA8;&&a=?z{4UWGBCAF11TQ*E=Ez9JvcCx_CBzuO;wf#`OMde6?^Q^ zcUj3=$J}o*xvJdTcw`v+Rs7LSCmnk=BVh5v$IUXwUB@>ECkUH=e6B7p&Tq9E^d4&u z2^2)M2%Dh$w?b%MRq+)g8o9GXWKX7oP@DlKb`BRxnPqoUN(A}=(cSN2&#OT3GlTqy^7`XDv(SUM8~aL zA9zggPMhPl8I0a(!0+w@O>*UXGCN%%3enZtt7+0Nk(#`Ar(=#u`MecQf6wDzHl=$M z;Em#(^s&+h8C!1_%hrKpqe}>Po7JY}1k)Ci_5s$k z6iU=cpNbG9=a(R^R1~G(EBx)46bqdBbT*U^28yB!8=pU?Rg^RTNT(x-A>BKmb_}vX zX=pE>;|Hq^9gLr1jLQBzYt!b>CrzH{V#oN-kzqTu2LFoJT#_#{&(uX%ckL6t0{+s9?A{t){f}-9B*N%t1%PS1Z zdIo2#abtL5^7*%G(DkPcp+N>}u6dUs4+IH8b@MY}p(ISFS9@Q%3t;Fh8PQ6IDRl?2 zTD&U&k;ow=cE23L0lZb|REBoizy9DNSZ#?2k1*Oz_9C30`MA=b@u{f?m__UFc_RjreWTjlQPKd<8L%cA(LnGqWRm{jgk0Ml}?08Af`GZTeZjc2chEm8qlD75*xdxJ7Im~JjhOYr{7FAqgY zLb{wK3f4L3;m;jESTclJ=9J<72>Y^^R{$X}qj*AM-k?1v60f~la@WVkp{vO;s=1ev zOx0Wyy%Zcp)whIPw48P0)P~Z>1Iu)V(9Yt_Ra+_fNouzHCW2nTrqp8wP`huD=}&0? z(90Mle|}29sdw4%#ZI`o)iB(vm);9($NWg#{}Emr_2H z?Q$F7>?Cbbe8Z-8Q!W{J*zm@;7b^~Tw)@WnK-hG=xgb;@1MIXF} zaA}tTu;Hh{A#EHOR-fc-o4ck~$g;lWv&W8a-c@cf(5V(4q{Q2~EKv2w81Wq-ZK5PT zcJQM8Bw++7$vGZn@ZR)RB`Ac1Fn)b{V`G&#hAhbrkYKrTxHVUG%SE8v z?$5*j$>V>uDf5w#fSUPnsvUHm5>nAHN?W$I(dVIKnQwkH`JO+EEa={CdJVDmxDvDB zDrYd2hdP#zmDxD(-gujR0SS$NB*IeCHM7#A7;J{;6wBvzf?E(frHnx$WT$VsbsLNV zoyEt`zkdlaPc32JDdef3`n7;-$a^MCEX+NkZpWzzvM{S&rCDJ^2Inut>4=mlhH5qj zDQ_R5C;OdpmWU^HGnjLj-N7Khs7Ss_r|o>|)D9W+KG?Zy(e$-=Nq9;zL*o)TfJTFP z)B5YdDhu!F4cPG&j7|UqND0+P+du;qZZ*?#( zJss2gyzk%h_%&?%*Yx01mw3XSt7Tgg{n`J+=78>5-E+#9l4Nd-T0VSnlFoy zgUN0aBad@=sVo~@4SQB<-dd(oE%zNm6nqc$($|e2V1Pd7zJs*Evsz&!F-=W=B%TbX zJ`F+^8e>EXJINjdU_V8+(cE0Qu0uZ09X~q{MVHtesGjbb-=yL3GRzT5=B1wx&-W#f z3e@1AJBldz+pku0z?TvYh$Mh|Jv`+llpRV0Q6&EYVC2n z_Vthw)_{f_BP%AzLO`OYLkLq>*`Wie_B(7{UARhs1V!~zB3WwtPLLf_fuQxRM2O!I zWHWxKm)#b|DDWz5oh7sRe$^t@NcOw<4+*4CJ1AnDG(%ZirU|K0H!}Ma`vH*Ek%EV5 z*DVt<29K*+mUAKw1{dV-{YwK(kTH$#L>|~LKi`hvt{l;DVzk;YuwDL$7*`pR?ur*p zIUXH*>HF`FTnK9TFl=!iMdc!In7l(l2OvCsJj(YBq7_ccg~WESd9<3hEc~iH0Y6(+ z0WDG7*wUydM@03|vH#hc{-w)7fP=^?!~D5%s6E<*4t1g3;pHDMp(5s~P2vfM5f60Y^c|Hnsg_x!?3x>g3M%mX<4{ zvT*Tk6#4_Fi_rj~nHr{{Cf!RsfA#0|6d*5wXv}D*@$jk)kc}!M`y!--uXmXnhD(2q zoK|#|eGZ*@{*wAo4k0_$S%D3wo;jV^9mb z1Z~pl(-tn-?426LnhLflpZ;k$TFPq5r}tSf^DlD^oiSvKYapU6YT z^$Ow1*`yK&hZoaPc)L&%H25v>8>;p6s&31jwm)$b-oV=IUC1W(6%ImPbGChy7JP7h z@0#PQIF{0e30dur&CC3J{2#cU>ym2Ke!kcXuPZ_O`);xpdbjyYNKy}{fCumiXkx}I zcnuqLz$~Z9)5apMEhKw68xsUdl|R7{=C={9UsD5tE2c^_X418Tt6_ZWjY|i{8hE@5 z>3Vw!2A~!#rDwUVKPq-iWT2SwO+Tw~F582T{bzdouQuf*KN3)$I986b*p=HA+*vn( z-DW0?!rXb>PhIY3kp-^c0V9H~rxd}K)(QHul_6>dqG#o{IYUd;QR<|}V%(?MWM5E= z3zBG{pzFBAz1>TjhjaBV;(}I5e@wOFB(RzSxA3JGRyJM$s!NmW4$xp)wyEf|+tc`v z7F!r_){wNBliBIl2lGe%iwNt+eJq)ugGEEro@8cT-6cRUMPhjD+8ZtVr{iFuR3)>p z*%;h34|-bAMpUo^{{Wrk&@HMA5)8djqdQyt;I;hsf$%I-L39W4YlxDBesO^FMrZ?Z$Q;F{Aibwm)6%BMX=QgF9C=yTG*L#pKfTOEWC6C1P^OZ z+7-@T=2V7rQ{yus)uv4Yd;U5R>5`Iy+S_{qxAI%S%4ToI`%N#R7I`APd94bK%vLOM zpsgRr64I@@iL13us?9Qf8Xxe!nh1zU1Dk3&qWA4R34&RYdKcgoDa{6c}xI_jm*QpF(m3@1J`g+O+w@MS850>YmeI8r zQy@|j&NtZ_w}0HnRA=aKu(a2Lb}FCPbtKghMH69;qhe`vKN87SYgp5l(UeI++yP2^ z{hS8=%@tq0%rVJFNIr_pkBpk7{`d7I;qrtL1#sxlrA1^DYC>0M*w4#p^64Bk`LE6D z6}$=LsatnV*yCAPUVJjEG>?xMmohN#P0-;~%0z9U>4hID9-VIRL8V&=1&308iXr11 z_7M`xGgS0}n{l)#55hW^Um5h^6)_H&dfew=K&&)>4VVAhru>H%gxZYw0bNhaKfX|3 z!{L5jg);Mj>>ik39d|bw%i1P}aizxKetd6hvPm+xyE#kzmh>maFdQm&hgXfB&wDL-j!&wHUSWB8`erpmFV~7 zsnlGkMRepK25XFgIk*+2rK4^A=EAAP9*w{b)j;=$o)^H>F*JmN>4zPe?lLXdlkov& zpb1J59eaDK3vJFf0&oGrlXz0NvJi8l60LAv^)ENhbQ*gyYS2kxdBW#W8{u%Eby^!C z>GSyf2c=A}_8-~G(8N5T9 zh~sRxj{c~Z%tBAj3Ua#ro`pAe6HHZ2k)n4z_S?CbsH4bo0^*(5Nv~B$kSPYk%bNdJ zU3dM}grom)d?Td>5|b%N%BT_2-3$aqN;A3yKY|~S5~N!Yq>+>uEj?<0jBW&!Q3{Gm zPJuD{p3m3sJ?H*#@Bi?A{PI5Mb)MgpqWLq=720?y#^rW<#!Q#5D6irr%l!z)L5gmV z9hJe>vn@%6N&YP+`PkpUnN~>US7o=Ax>#E zyRo<|;21l6>Ymk^QQZ9fd*tWwxw}>~N-VLkwryecFd!Yaq(!kjHtok0w`O$*yXu_h zl+NV3%fP9!sdyZttRF-IyeiCb50q2zt0K0F%R3}AZDCD{P&DH&q5I{xRigGZme*_) zW%`*;7a17$Rm93}TNdI^qqp=qd6OF9z~Mk#vN0F9y0K7347j&uXRf3%(qxM13rhOg zku0<>C1*Ny*;+a@!qgZ|3=fyj<vA{OlPIHd9T|7SPB0EMfdPhrMJbU+`mwbc5$W)iES^&$4C!szvS9S(xV?Wg znlj>VWHdYu+_p69z;mOohlIMeh3_#TzuJ`9)#+C z-qOg2bsyeH#&03xlkw?3dG0Qi4EmkX--Q9YnMb)R6tUX^q z?``9lZK`o3*Oh+vmiUXG8J+f0u@#k{D`aJh-Py=e%2ai-pmHI=E*5ye-xF(%R^|IH zCclNbEbPhI`TG94ZrHP^PDAs)Y!_-(n=#mbof8;EMibf^euRodrkH8F!)_tCXT;B1 zi~XyoO^czRbG$HkL&?p0?hEaOn05aKk&*R&KYa+2)_8K7hd)~bZFE}tbrV;5%YFv; z!wE)iYi~yKSnaeG7u5~hQ2H8z_>iYHvd+)ut#NsqzqznlXM9PnzP&AWb~vqRmh@yJ zHc6cBa6mYmH!O`ZAyqV4Fwuaj(|dC2P}T#waPATD-l7lJsH&{znq#x_q81)W{Y5EW6Vlv}$ec)ts#u z=;+|{R5Ww=zH|7jX(B~Oe{^u9jaxXqOR<##e-^T@B#-UUli$IqtY5U;G6oZqy~u-} zAO_?=4J6A~4r@Fb_N8ekh<$B?kc!@r7PPC=6#5An_@0X>pg!#{b&TgE$v(W6BTom5 zWhL82}pciz%-n2A?F)uzDy^84Nmp_0U06BmBbyqP;o{#nH2Ph|9 zpv{)CwJkf+p#w-qro+Ak1Kt4i5&}j#^o$DA+B0$Wxp%W0%Of0kdMPAdrCc6MUsqq} zcP}wrcH^&g=cSM2o?8-QS1LC8LKHDC9RfYT9^;SRf1AcX*QY+lC7Gz}G7aQ=lX9kk z5$E5Y9*vO<_}UIn7$nY-ON+;XS~xCsOR6G%qLSb-z}dh&lVH!zYrB;-_#6Qls302PD4zGX*N ztg&yO9VZ#&&n{JmeM{t@UqJz~n(&GVtuC%}0}$&Le?ILU)TVxt5Hs(EK&yHG#;JR= zsc7aPegFW8|`^~C7V#TZVTn8;{#m*vR@el56IvT`Y* zg!q|{)LvwPDr#|Dv=wKC@9d#toX>}5nE%W#!JPFs?H>8i#3ck698h{fmn^-y99*?J zAx`>I?>!BeIYMKEGt!G*2ueHXksg~XJusK>7Wwck^OnN5>=C<1!5dG}SjQwQjphS%;uM_8Orvy9wt zaVC4Y$yz^U52u^##h^xB+p`&>=#%_6f$uq7>HJGxW_XeZ$&5=P(Dw&SNS~RSYqa_9 zd_Nppnzqnouy}KV`Of@69p9I$t2GEH$AuxD?_}j*8d=|_m(kvyI{K`f32JL3 z&;9BBnOoyc(H?nqkInV7+2-ELDF%Fr?ihje3<1eDqwI!clu})+&UDs3|p*q2D1vT6T z5BGS3Fgb$Ywaz3|n?V^uOxJF2x#|ZWcG%U0DAS?F0wz6`5|jc79SW22ld;(rs#Prh zKW$Io4Ztw%1qDk+nq%$?=ruzq&g)1UYErr`GvG8NRCg?64M@0Tm9EPc;Q25Syw!Uu zk}!+SzSHvykHNcZ5zsYPF8s6~T2lZi=# zkIDidN|{3lc!BA&k<>3mj)v6{bp`A(@G7aSc71_5du1(368TycCHfmWdkhhbq zfr-n4r>_{3nB=TMDBB^WcjfsQKnKcUM<&wCqIAa(VhYJ-USy%Ni<@<`3iJ-R*3`iH zKc3iI1Xn$>G}1wdP2P5KTc*7pj3)TBdmyBUia@a#s0t)VNegqt{BBE9~a9dQ)W>Y|7 zQG!CE=4f62h;JNkJ~+)FvXt%meA=$Wf*%n6f5Fr6ydxF`2_hm`XyVV$a~gty%Uzi; z%#i5atz_!tr+-;#44-2+`MSfIG!yl*wnP2=J*OR&l~7scd#Zj@bTv!5%C=tZwij89 zC5C23{>LB9!Rip$S7Xt7R_D}Nmk6I)wU9z5z&*BL&%(27>5sQ2Mqxqmrz;CL#h%9B zrKqPD$~XBZKd$Ql8l4C&6*eSlkC!KK9tC#wV~Y4#rp16B zD`V5xMdWLQ?I4V3<50RRECDNbo?Z*w3` zVRmwFXK7(>Zf|gJb!=~QAUtkuVRk@rWn^e!bS`6WZ9a(sz628i0strl0#dItr2-oR z1ql+&0{{jK2?z%R0tOWb0tpHW1Qr4V0RkQY0vCV)3JDN)HxhJzG(V>oRSW(n2{3kZ zoZd|#a;IJBd{qPyFA+Ba@gP`J&U2`?;t~$>>0qYj732iKq1#gh^)yTlw^k0Qxr%Y>()!ivFiYV_cZu5+{(|CE zhWn>1t{AQE&%$RmwRun8o-2TGFg?v4Ou641f0-o)lm{T3cpm1(ebae<|+Jh`vg7V3ZIi@)(LX!$} zKw(2O(+S6`Pj2j%WN1c-0iXmB0RjL91p-p9G#LO22@omnSh<#lQE?q`3?Q?@_+%GY zj6`h8XwbUH@knP)CdW0S`qhQ6ZKJK*W4gw zWK*LN6CCcEgo16OXIbx~iNf^}fKfWaq=^~g%prFbk?J{T*10={s>g)Pj$pPlT!GXO{(EUrc&?l8Qc~FyrW{OAT zHLgNwG~dAC6UlzCpd)qoPW)=iegXnoP+Hd8;Q69Mg)k6va5~jNi*N8L?bNVJ6qZGQ zrIbNM$U2iZTQxx~pOO&S_pG@AjRaD!Go=9x0N!Ud3in$zcL{ljKS_|@38R=47VhPu z)`KEO*K=LYI>)7+AhIi-{9!Ez4x5zv!R;;q+(xk?H0>cIBOA4%g_zDj@LOgWa3=0c ztqn7%ax+8qXheHhU4hTxLI*Equ=HIkWVn7p2U3k6K?mrA-f|Q;XeaI>M?_?D_Mp|C z6@GNKa;umx0Gs*&-UfS;-TE96pfmDmy^ko9nH5ks5A`SgNS8hwrL32ZADd5=-Pq)j zJ|G+%)5IXP;io9UP}v7$4IA6+I*mQaN~BZJ%LY{w3}Dp(ZKnO38K#K2FEf&Z&X$(+ zV0(;@zO212<74h?lkzUh)MNWqWh^-vOe{5LF?(BO0k7D)IQeR|^Ln8m94b@3(ZOe- z6mee#2nUjmj(q@$z58@M;_F}sd9|PX3<56|Kk<9Gi~`RJZcZammb5`X(Wi=Kb_2|3 z)8f?x8h{vBNA1wa#Zx_PzC$$!@;@b_rmBd=ZY{o=ms!?4hc1AMq=sdb&51!vF#r(( z00D^sr34rO0ss#M0#dItr2-oa1ql+&0{{RD2@rNS5_EqwKc`-}3;sWzHSMmh;A>s5 z&^KEth;3%C6<5d!21H;V>Mn1#Z{(-UQ1`j!G>OKcrg9m!OBc+8Yv9hV!Jyu03xjHV zl-$%cUZrqo5J_!T6j#`>2!S?UJM~J - 0.11.6-2 +- Removed gpgkeys from sources + * Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-1 - New upstream release diff --git a/sources b/sources index 6dd3e56..f7d16dd 100644 --- a/sources +++ b/sources @@ -1,4 +1,2 @@ -310168e221d6e810022b270e32bf9662 gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg -c144d7522377a701cb9e63a20098e122 gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg 0e4f82d267d27f2f9d3fcba58ac6cf5a ocserv-0.11.6.tar.xz 12a026b472daa54373f38538773673d8 ocserv-0.11.6.tar.xz.sig From 81f261225981c82fc6c21e83fee08f761b2c3d22 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Thu, 12 Jan 2017 17:30:35 +0100 Subject: [PATCH 089/195] Rebuild for readline 7.x Signed-off-by: Igor Gnatenko --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 599545c..1d32fc5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.11.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -162,6 +162,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Thu Jan 12 2017 Igor Gnatenko - 0.11.6-3 +- Rebuild for readline 7.x + * Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-2 - Removed gpgkeys from sources From a64c8c405cccdc392367be0d13810b3bfc8dcf70 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 11 Feb 2017 00:37:43 +0000 Subject: [PATCH 090/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 1d32fc5..404c68b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -2,7 +2,7 @@ Name: ocserv Version: 0.11.6 -Release: 3%{?dist} +Release: 4%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -162,6 +162,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Sat Feb 11 2017 Fedora Release Engineering - 0.11.6-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + * Thu Jan 12 2017 Igor Gnatenko - 0.11.6-3 - Rebuild for readline 7.x From 38af83d5e9d323769eae3c8270a6f4fad70f7eb3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 13 Feb 2017 11:23:29 +0100 Subject: [PATCH 091/195] Update to 0.11.7-1 - Update to upstream 0.11.7 release --- .gitignore | 10 ++++++++++ ocserv.spec | 8 ++++++-- sources | 12 ++++++++++-- 3 files changed, 26 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 683b9bb..433523a 100644 --- a/.gitignore +++ b/.gitignore @@ -50,3 +50,13 @@ /ocserv-0.11.5.tar.xz.sig /ocserv-0.11.6.tar.xz /ocserv-0.11.6.tar.xz.sig +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.7.tar.xz.sig +/ocserv-0.11.7.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 404c68b..e24d20d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,9 @@ +# This spec file has been automatically updated +Version: 0.11.7 +Release: 1%{?dist} %global _hardened_build 1 Name: ocserv -Version: 0.11.6 -Release: 4%{?dist} Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING @@ -162,6 +163,9 @@ rm -rf %{buildroot} %{_localstatedir}/lib/ocserv/profile.xml %changelog +* Mon Feb 13 2017 Nikos Mavrogiannopoulos - 0.11.7-1 +- Update to upstream 0.11.7 release + * Sat Feb 11 2017 Fedora Release Engineering - 0.11.6-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild diff --git a/sources b/sources index f7d16dd..907a2bb 100644 --- a/sources +++ b/sources @@ -1,2 +1,10 @@ -0e4f82d267d27f2f9d3fcba58ac6cf5a ocserv-0.11.6.tar.xz -12a026b472daa54373f38538773673d8 ocserv-0.11.6.tar.xz.sig +SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 +SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 +SHA512 (ocserv-genkey) = c02a25a5504e2bd514c6e6944651960a3cc9bf2ef0a4509744f99d61421feace1f8e440c4d336652efd7349465d1a707cd3a370ff6102ef5096d709b34099a86 +SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 +SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a +SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 +SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c +SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c +SHA512 (ocserv-0.11.7.tar.xz.sig) = fd4af775842cff6817adaf4a641b180d3be3b55e3b64a026977fd6f328ddc5f7070f4c91cdce7e83eb8c3b078a5c1dc7780cfe40c5322abef61ca7fc408fbb2c +SHA512 (ocserv-0.11.7.tar.xz) = a563725bd8753186ece80c91a237a2940071047bb32d1990e2ee122a32ad0468b78a7f35d422dcc9b968a8c56358992842d00958dbf9d743632a03623dd2f5cf From 236cc5805c81592c7f1d550961d1c4c34d0f80e9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 3 May 2017 02:51:27 +0200 Subject: [PATCH 092/195] Update to 0.11.8-1 - Update to upstream 0.11.8 release --- .gitignore | 11 ++++ ocserv-genkey | 1 + ocserv.init | 141 ++++++++++++++++++++++++++++++++++++++++++++++++++ ocserv.spec | 100 ++++++++++++++++++++++++++++++----- sources | 7 +-- 5 files changed, 243 insertions(+), 17 deletions(-) create mode 100644 ocserv.init diff --git a/.gitignore b/.gitignore index 433523a..333d3bb 100644 --- a/.gitignore +++ b/.gitignore @@ -60,3 +60,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.7.tar.xz.sig /ocserv-0.11.7.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.8.tar.xz.sig +/ocserv-0.11.8.tar.xz diff --git a/ocserv-genkey b/ocserv-genkey index 687d685..924aab9 100755 --- a/ocserv-genkey +++ b/ocserv-genkey @@ -2,6 +2,7 @@ #generate CA certificate/key if test ! -f /etc/pki/ocserv/private/ca.key;then +mkdir -p /etc/pki/ocserv/private certtool --generate-privkey --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1 echo "cn=`hostname -f` CA" >/etc/pki/ocserv/ca.tmpl echo "expiration_days=-1" >>/etc/pki/ocserv/ca.tmpl diff --git a/ocserv.init b/ocserv.init new file mode 100644 index 0000000..81be91b --- /dev/null +++ b/ocserv.init @@ -0,0 +1,141 @@ +#!/bin/sh +# +# ocserv This shell script takes care of starting and stopping +# ocserv on RedHat or other chkconfig-based system. +# +# chkconfig: - 24 76 +# +# processname: ocserv +# port. + +### BEGIN INIT INFO +# Provides: ocserv +# Required-Start: $network +# Required-Stop: $network +# Short-Description: start and stop ocserv +# Description: ocserv is a VPN server +### END INIT INFO + + +# To install: +# copy this file to /etc/rc.d/init.d/ocserv +# shell> chkconfig --add ocserv +# shell> mkdir /etc/ocserv +# make .conf or .sh files in /etc/ocserv (see below) + +# To uninstall: +# run: chkconfig --del ocserv + +ocserv="" +ocserv_locations="/usr/sbin/ocserv /usr/local/sbin/ocserv" +for location in $ocserv_locations +do + if [ -f "$location" ] + then + ocserv=$location + fi +done + +# PID directory +piddir="/var/run/ocserv" +pidf="$piddir/ocserv.pid" + +# Our working directory +work=/etc/ocserv + +# Source function library. +. /etc/rc.d/init.d/functions + +# Source networking configuration. +. /etc/sysconfig/network + +# Check that networking is up. +if [ ${NETWORKING} = "no" ] +then + echo "Networking is down" + exit 0 +fi + +# Check that binary exists +if ! [ -f $ocserv ] +then + echo "ocserv binary not found" + exit 0 +fi + +# See how we were called. +case "$1" in + start) + echo -n $"Starting ocserv: " + + /sbin/modprobe tun >/dev/null 2>&1 + + # From a security perspective, I think it makes + # sense to remove this, and have users who need + # it explictly enable in their --up scripts or + # firewall setups. + + #echo 1 > /proc/sys/net/ipv4/ip_forward + + # Run startup script, if defined + if [ -x /usr/sbin/ocserv-genkey ]; then + /usr/sbin/ocserv-genkey + fi + + if [ ! -d $piddir ]; then + mkdir $piddir + fi + + if [ -s $pidf ]; then + kill `cat $pidf` >/dev/null 2>&1 + sleep 2 + fi + rm -f $pidf + + cd $work + + # Start every .conf in $work and run .sh if exists + errors=0 + $ocserv --pid-file $pidf -c $work/ocserv.conf + errors=$? + if [ $errors != 0 ]; then + failure; echo + else + success; echo + fi + ;; + stop) + echo -n $"Shutting down ocserv: " + if [ -s $pidf ]; then + kill `cat $pidf` >/dev/null 2>&1 + fi + rm -f $pidf + + success; echo + rm -f $lock + ;; + restart) + $0 stop + sleep 2 + $0 start + ;; + reload) + /usr/bin/occtl reload + exit $? + ;; + reopen) + ;; + condrestart) + $0 stop + sleep 2 + $0 start + ;; + status) + /usr/bin/occtl show status + ;; + *) + echo "Usage: ocserv {start|stop|restart|condrestart|reload|reopen|status}" + exit 1 + ;; +esac +exit 0 diff --git a/ocserv.spec b/ocserv.spec index e24d20d..687f8ab 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,8 +1,16 @@ # This spec file has been automatically updated -Version: 0.11.7 +Version: 0.11.8 Release: 1%{?dist} %global _hardened_build 1 +%if 0%{?fedora} || 0%{?rhel} >= 7 +%define use_systemd 1 +%define have_gpgv2 1 +%else +%define use_systemd 0 +%define have_gpgv2 0 +%endif + Name: ocserv Summary: OpenConnect SSL VPN server @@ -20,28 +28,25 @@ Source6: PACKAGE-LICENSING Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +Source11: ocserv.init # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +%if 0%{?rhel} && 0%{?rhel} <= 6 +BuildRequires: gnutls30-devel +%else BuildRequires: gnutls-devel +%endif BuildRequires: pam-devel BuildRequires: iproute -BuildRequires: systemd -BuildRequires: systemd-devel -BuildRequires: autogen-libopts-devel + BuildRequires: protobuf-c-devel BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel -BuildRequires: liboath-devel -BuildRequires: readline-devel -BuildRequires: autogen BuildRequires: gperf -%ifarch x86_64 %{ix86} %{arm} aarch64 -BuildRequires: libseccomp-devel -%endif BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: libev-devel @@ -50,16 +55,40 @@ BuildRequires: tcp_wrappers-devel BuildRequires: automake, autoconf BuildRequires: radcli-devel BuildRequires: lz4-devel +BuildRequires: readline-devel +BuildRequires: GeoIP-devel + +%if %{use_systemd} +BuildRequires: systemd +BuildRequires: systemd-devel +BuildRequires: autogen-libopts-devel +BuildRequires: autogen +BuildRequires: liboath-devel BuildRequires: uid_wrapper BuildRequires: socket_wrapper +%if 0%{?rhel} && 0%{?rhel} >= 7 +%ifarch x86_64 %{ix86} +BuildRequires: libseccomp-devel +%endif +%else +%ifarch x86_64 %{ix86} %{arm} aarch64 +BuildRequires: libseccomp-devel +%endif +%endif + +%endif #use systemd + Requires: gnutls-utils Requires: iproute Requires: pam Requires(pre): shadow-utils +%if %{use_systemd} Requires(post): systemd Requires(preun): systemd Requires(postun): systemd +%endif + #gnulib is bundled. See https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) #CCAN is bundled. See https://fedorahosted.org/fpc/ticket/364 @@ -76,13 +105,14 @@ uses the standard IETF security protocols such as TLS 1.2, and Datagram TLS to provide the secure VPN service. %prep +%if %{have_gpgv2} gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} +%endif %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h rm -rf src/protobuf/protobuf-c/ rm -rf src/ccan/talloc -rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config @@ -91,10 +121,28 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* touch src/*.proto +%if 0%{?rhel} && 0%{?rhel} <= 6 +echo "int main() { return 77; }" > tests/valid-hostname.c +%else +rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h +%endif + %build +%if 0%{?rhel} && 0%{?rhel} <= 6 +export PKG_CONFIG_LIBDIR="%{_libdir}/gnutls30/pkgconfig:%{_libdir}/pkgconfig" +export LIBGNUTLS_CFLAGS="-I/usr/include/gnutls30" +export LIBGNUTLS_LIBS="-L%{_libdir}/gnutls30/ -lgnutls" +export CFLAGS="$CFLAGS -I/usr/include/libev -I/usr/include/gnutls30" +sed -i 's/AM_PROG_AR//g' configure.ac +autoreconf -fvi +%configure \ + --disable-systemd \ + --enable-local-libopts +%else %configure \ --enable-systemd +%endif make #%{?_smp_mflags} @@ -110,6 +158,7 @@ mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check make check %{?_smp_mflags} +%if %{use_systemd} %post %systemd_post ocserv.service @@ -118,6 +167,7 @@ make check %{?_smp_mflags} %postun %systemd_postun ocserv.service +%endif %install rm -rf %{buildroot} @@ -126,14 +176,29 @@ mkdir -p %{buildroot}/%{_sysconfdir}/pam.d/ mkdir -p %{buildroot}/%{_sysconfdir}/ocserv/ install -p -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/pam.d/ocserv install -p -m 644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/ocserv/ -mkdir -p %{buildroot}/%{_unitdir} -install -p -m 644 %{SOURCE4} %{buildroot}/%{_unitdir} mkdir -p %{buildroot}%{_localstatedir}/lib/ocserv/ install -p -m 644 doc/profile.xml %{buildroot}%{_localstatedir}/lib/ocserv/ mkdir -p %{buildroot}/%{_sbindir} install -p -m 755 %{SOURCE8} %{buildroot}/%{_sbindir} mkdir -p %{buildroot}/%{_bindir} install -p -m 755 %{SOURCE9} %{buildroot}/%{_bindir} + +%if 0%{?rhel} +sed -i 's|expiration_days=-1|expiration_days=9999|' %{buildroot}/%{_sbindir}/ocserv-genkey +sed -i 's|tls-priorities = "@SYSTEM"|tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"|' %{buildroot}/%{_sysconfdir}/ocserv/ocserv.conf +%if 0%{?rhel} <= 6 +sed -i 's|isolate-workers = true|isolate-workers = false|' %{buildroot}/%{_sysconfdir}/ocserv/ocserv.conf +%endif +%endif + +%if %{use_systemd} +mkdir -p %{buildroot}/%{_unitdir} +install -p -m 644 %{SOURCE4} %{buildroot}/%{_unitdir} +%else +mkdir -p %{buildroot}/%{_initrddir} +install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} +%endif + %make_install %clean @@ -159,10 +224,17 @@ rm -rf %{buildroot} %{_bindir}/ocserv-script %{_sbindir}/ocserv %{_sbindir}/ocserv-genkey -%{_unitdir}/ocserv.service %{_localstatedir}/lib/ocserv/profile.xml +%if %{use_systemd} +%{_unitdir}/ocserv.service +%else +%{_initrddir}/%{name} +%endif %changelog +* Wed May 03 2017 Nikos Mavrogiannopoulos - 0.11.8-1 +- Update to upstream 0.11.8 release + * Mon Feb 13 2017 Nikos Mavrogiannopoulos - 0.11.7-1 - Update to upstream 0.11.7 release diff --git a/sources b/sources index 907a2bb..348aa08 100644 --- a/sources +++ b/sources @@ -1,10 +1,11 @@ +SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 -SHA512 (ocserv-genkey) = c02a25a5504e2bd514c6e6944651960a3cc9bf2ef0a4509744f99d61421feace1f8e440c4d336652efd7349465d1a707cd3a370ff6102ef5096d709b34099a86 +SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (ocserv-0.11.7.tar.xz.sig) = fd4af775842cff6817adaf4a641b180d3be3b55e3b64a026977fd6f328ddc5f7070f4c91cdce7e83eb8c3b078a5c1dc7780cfe40c5322abef61ca7fc408fbb2c -SHA512 (ocserv-0.11.7.tar.xz) = a563725bd8753186ece80c91a237a2940071047bb32d1990e2ee122a32ad0468b78a7f35d422dcc9b968a8c56358992842d00958dbf9d743632a03623dd2f5cf +SHA512 (ocserv-0.11.8.tar.xz.sig) = 5551591abc54dfc053125c356095138aaecec6c3255cd125bd38e17350a257bc822094c270d5b3bb329afd4a9e37f355d3d16db16b4db804e15b8c5959321214 +SHA512 (ocserv-0.11.8.tar.xz) = cea5ef084a15de1e16c0d55f418f454f32c77e4303246f3d11e71ddbc7dbea028282b8200b59a49f5509e786970749b0a9795262639209924bbaa1d619c5c25c From 8c7b340f2dd54dde6423c5582c0d68398ced1f1f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 27 Jul 2017 01:33:44 +0000 Subject: [PATCH 093/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 687f8ab..62e5760 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.8 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -232,6 +232,9 @@ rm -rf %{buildroot} %endif %changelog +* Thu Jul 27 2017 Fedora Release Engineering - 0.11.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Wed May 03 2017 Nikos Mavrogiannopoulos - 0.11.8-1 - Update to upstream 0.11.8 release From f855e9af5f0268dc83365ebb9d34a1e5b73dc374 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 3 Aug 2017 04:22:01 +0000 Subject: [PATCH 094/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 62e5760..b2766aa 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.8 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -232,6 +232,9 @@ rm -rf %{buildroot} %endif %changelog +* Thu Aug 03 2017 Fedora Release Engineering - 0.11.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + * Thu Jul 27 2017 Fedora Release Engineering - 0.11.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild From afb369ee55a7c5939d8e3b79fe79f94e7a99193d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 10 Oct 2017 13:13:21 +0200 Subject: [PATCH 095/195] Update to 0.11.9-1 - Update to upstream 0.11.9 release --- .gitignore | 11 +++++++++++ ocserv.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 333d3bb..5ca14e7 100644 --- a/.gitignore +++ b/.gitignore @@ -71,3 +71,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.8.tar.xz.sig /ocserv-0.11.8.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.9.tar.xz.sig +/ocserv-0.11.9.tar.xz diff --git a/ocserv.spec b/ocserv.spec index b2766aa..f6dae2d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.11.8 -Release: 3%{?dist} +Version: 0.11.9 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -232,6 +232,9 @@ rm -rf %{buildroot} %endif %changelog +* Tue Oct 10 2017 Nikos Mavrogiannopoulos - 0.11.9-1 +- Update to upstream 0.11.9 release + * Thu Aug 03 2017 Fedora Release Engineering - 0.11.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild diff --git a/sources b/sources index 348aa08..dadd5d3 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (ocserv-0.11.8.tar.xz.sig) = 5551591abc54dfc053125c356095138aaecec6c3255cd125bd38e17350a257bc822094c270d5b3bb329afd4a9e37f355d3d16db16b4db804e15b8c5959321214 -SHA512 (ocserv-0.11.8.tar.xz) = cea5ef084a15de1e16c0d55f418f454f32c77e4303246f3d11e71ddbc7dbea028282b8200b59a49f5509e786970749b0a9795262639209924bbaa1d619c5c25c +SHA512 (ocserv-0.11.9.tar.xz.sig) = 10fb1a9b80e92ce0aafc79af647fe16e61eafc20e3d6846d74cd357826f3d0217ab57c4e9e6efe8ba2ea7b665224e863caef2c5567c512c6403bbf99a3dd321d +SHA512 (ocserv-0.11.9.tar.xz) = e497dfbb55e83874d55238162b0c4340db0a9c6ac2223cfd905923b59ebfd2fba0f998c1a60e9492be2d1e4434c66c960c3619968b47efc8464420f2e9319067 From 4197da7e800100e9726fb47251e402146cdf525b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 16 Nov 2017 08:54:10 +0100 Subject: [PATCH 096/195] do not enable libwrap --- ocserv.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index f6dae2d..790a9a3 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.9 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -141,7 +141,8 @@ autoreconf -fvi --enable-local-libopts %else %configure \ - --enable-systemd + --enable-systemd \ + --without-libwrap %endif make #%{?_smp_mflags} @@ -232,6 +233,9 @@ rm -rf %{buildroot} %endif %changelog +* Thu Nov 16 2017 Nikos Mavrogiannopoulos - 0.11.9-2 +- Do not enable libwrap + * Tue Oct 10 2017 Nikos Mavrogiannopoulos - 0.11.9-1 - Update to upstream 0.11.9 release From f65600d86fcc3ecc9cbe289bd77de4c1ff250ef9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 21 Nov 2017 11:22:29 +0100 Subject: [PATCH 097/195] Update to 0.11.9-3 - Update to upstream 0.11.9 release --- .gitignore | 11 +++++++++++ ocserv.spec | 35 ++++++++++++++++++++++++++++++----- 2 files changed, 41 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 5ca14e7..75a2b6c 100644 --- a/.gitignore +++ b/.gitignore @@ -82,3 +82,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.9.tar.xz.sig /ocserv-0.11.9.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.9.tar.xz.sig +/ocserv-0.11.9.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 790a9a3..94af597 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.9 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -11,6 +11,12 @@ Release: 2%{?dist} %define have_gpgv2 0 %endif +%if 0%{?fedora} >= 28 || 0%{?rhel} > 7 +%define use_libwrap 0 +%else +%define use_libwrap 1 +%endif + Name: ocserv Summary: OpenConnect SSL VPN server @@ -42,7 +48,15 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute +%if 0%{?rhel} && 0%{?rhel} == 7 +%ifnarch ppc64 BuildRequires: protobuf-c-devel +%endif +%else + +BuildRequires: protobuf-c-devel +%endif + BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel @@ -136,12 +150,20 @@ export LIBGNUTLS_LIBS="-L%{_libdir}/gnutls30/ -lgnutls" export CFLAGS="$CFLAGS -I/usr/include/libev -I/usr/include/gnutls30" sed -i 's/AM_PROG_AR//g' configure.ac autoreconf -fvi +%endif + %configure \ - --disable-systemd \ - --enable-local-libopts -%else -%configure \ +%if %{use_systemd} --enable-systemd \ +%else + --disable-systemd \ +%endif +%if 0%{?rhel} && 0%{?rhel} <= 6 + --enable-local-libopts \ +%endif +%if %{use_libwrap} + --with-libwrap +%else --without-libwrap %endif @@ -233,6 +255,9 @@ rm -rf %{buildroot} %endif %changelog +* Tue Nov 21 2017 Nikos Mavrogiannopoulos - 0.11.9-3 +- Update to upstream 0.11.9 release + * Thu Nov 16 2017 Nikos Mavrogiannopoulos - 0.11.9-2 - Do not enable libwrap From 9b84d3301b67f88de962d971a17322ccc6fc0c96 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 8 Jan 2018 13:33:03 +0100 Subject: [PATCH 098/195] Update to 0.11.10-1 - Update to upstream 0.11.10 release --- .gitignore | 11 +++++++++++ ocserv.spec | 28 +++++++++++++++++++--------- sources | 4 ++-- 3 files changed, 32 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index 75a2b6c..ed5bff9 100644 --- a/.gitignore +++ b/.gitignore @@ -93,3 +93,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.9.tar.xz.sig /ocserv-0.11.9.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.10.tar.xz.sig +/ocserv-0.11.10.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 94af597..f536113 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.11.9 -Release: 3%{?dist} +Version: 0.11.10 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -17,6 +17,13 @@ Release: 3%{?dist} %define use_libwrap 1 %endif +%define use_local_protobuf 0 +%if 0%{?rhel} && 0%{?rhel} == 7 +%ifarch ppc64 +%define use_local_protobuf 1 +%endif +%endif + Name: ocserv Summary: OpenConnect SSL VPN server @@ -48,12 +55,7 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute -%if 0%{?rhel} && 0%{?rhel} == 7 -%ifnarch ppc64 -BuildRequires: protobuf-c-devel -%endif -%else - +%if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel %endif @@ -125,7 +127,10 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %setup -q rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h +%if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ +touch src/*.proto +%endif rm -rf src/ccan/talloc rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c @@ -133,7 +138,6 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* -touch src/*.proto %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c @@ -161,6 +165,9 @@ autoreconf -fvi %if 0%{?rhel} && 0%{?rhel} <= 6 --enable-local-libopts \ %endif +%if %{use_local_protobuf} + --without-protobuf \ +%endif %if %{use_libwrap} --with-libwrap %else @@ -255,6 +262,9 @@ rm -rf %{buildroot} %endif %changelog +* Mon Jan 08 2018 Nikos Mavrogiannopoulos - 0.11.10-1 +- Update to upstream 0.11.10 release + * Tue Nov 21 2017 Nikos Mavrogiannopoulos - 0.11.9-3 - Update to upstream 0.11.9 release diff --git a/sources b/sources index dadd5d3..43899fc 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (ocserv-0.11.9.tar.xz.sig) = 10fb1a9b80e92ce0aafc79af647fe16e61eafc20e3d6846d74cd357826f3d0217ab57c4e9e6efe8ba2ea7b665224e863caef2c5567c512c6403bbf99a3dd321d -SHA512 (ocserv-0.11.9.tar.xz) = e497dfbb55e83874d55238162b0c4340db0a9c6ac2223cfd905923b59ebfd2fba0f998c1a60e9492be2d1e4434c66c960c3619968b47efc8464420f2e9319067 +SHA512 (ocserv-0.11.10.tar.xz.sig) = d88f3e42595df6c3a13dc64cbcdcca2126f22be7143856b00b0c7620358f9d0e5c524019c11ff10549e74ef5eebb0613c25afd9f7244c6ab14fb70b8059188b8 +SHA512 (ocserv-0.11.10.tar.xz) = 40fe152adf4438ed390406ec46049ff3769208e1d48b40bc0f015d507902a6e81012a52dd4ddd867f56a6d50de1dfb8fa497dc3bb6ece3e666ca14df1d76c561 From 2aa5d4894213553235ab9b5920329e23b7456c5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 20 Jan 2018 23:07:21 +0100 Subject: [PATCH 099/195] Rebuilt for switch to libxcrypt --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index f536113..93f5a4d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.10 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -262,6 +262,9 @@ rm -rf %{buildroot} %endif %changelog +* Sat Jan 20 2018 Björn Esser - 0.11.10-2 +- Rebuilt for switch to libxcrypt + * Mon Jan 08 2018 Nikos Mavrogiannopoulos - 0.11.10-1 - Update to upstream 0.11.10 release From c5e8e8678935b8c95a10e62a98d9b585bc77e218 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 8 Feb 2018 09:03:26 +0000 Subject: [PATCH 100/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 93f5a4d..ff47c89 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.11.10 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -262,6 +262,9 @@ rm -rf %{buildroot} %endif %changelog +* Thu Feb 08 2018 Fedora Release Engineering - 0.11.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Sat Jan 20 2018 Björn Esser - 0.11.10-2 - Rebuilt for switch to libxcrypt From 294a8e96f6a14fefb8c3d2a905d10afc7506cce8 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Tue, 13 Feb 2018 23:56:17 +0100 Subject: [PATCH 101/195] Remove BuildRoot definition None of currently supported distributions need that. It was needed last for EL5 which is EOL now Signed-off-by: Igor Gnatenko --- ocserv.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ff47c89..e2c72d7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -45,7 +45,6 @@ Source11: ocserv.init # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel From d582cc66e84d03dab3579f61f6e936b2832a282f Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Wed, 14 Feb 2018 07:23:36 +0100 Subject: [PATCH 102/195] Remove %clean section None of currently supported distributions need that. Last one was EL5 which is EOL for a while. Signed-off-by: Igor Gnatenko --- ocserv.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index e2c72d7..e40f34b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -230,9 +230,6 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %make_install -%clean -rm -rf %{buildroot} - %files %defattr(-,root,root,-) From e193d435ca9b0393762db2df2162138f4c28eeea Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 5 Mar 2018 16:56:38 +0100 Subject: [PATCH 103/195] Update to 0.11.11-1 - Update to upstream 0.11.11 release --- .gitignore | 11 +++++++++++ ...42418905D8206AA754CCDC29EE58B996865171.gpg | Bin 56226 -> 58697 bytes ocserv.spec | 11 +++++++++-- sources | 6 +++--- 4 files changed, 23 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index ed5bff9..325d272 100644 --- a/.gitignore +++ b/.gitignore @@ -104,3 +104,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.10.tar.xz.sig /ocserv-0.11.10.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.11.tar.xz.sig +/ocserv-0.11.11.tar.xz diff --git a/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg b/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg index 1f9a40cc96ea43f54ea9dc0f1873971a85535c2f..b1ee43c60379c783e5f3457c480d6a7ecc2447c5 100644 GIT binary patch delta 2201 zcmajfc{me}9|!Pl=AJuq&XptPi(I*nxuX%52)RWlAfZp?Q9Q`^!3dC3PpY4+LQv=C>t3>qinS9bDmO+iAPZZd~l($$+Yk|`EUM(b>rQG}ZYwp~0NipABHt$KT=2!*pw=7EyUq5kFXS2$SyEx-R zOpu};aRD$+(G{5mst5LHA$h{~hps4U#=dgu7A&o2om;==t3>7W%)9{bJg-6Ot!y+s zp*h?n588O?`kj`8KC$5m`weubIhq0wB?P&cNMH(UpU&n7nEu!r#r>UgFn0S6ut6!d z!iJYez;GfCUOn@v!sK~g2V6R{H->25(kAUK9?zhG6cV;TY^+%UYg!vaecpg?X%;T^ ztiJYsp&&z_EB-*`$o}2ySVNhBMo#(ceAV9g8A3=d{tbPa0z#94Twu32lMNsnp#DQF z|J6L&Ok}XwkYJdzNV7#CLb5do!3j@S49hDR)RifH*_!Wms~vQor3%US{jA+vQR6B> z-|B(^La=>)Y6@c|X5C(0H5Q{=M4D4w_p)xLlhUZNw+lvU>>LPBB4BM;(j6 zV=MzsMtp5XYvSZw4c(!S9hc$WrejRS0WOm?;&2+0Hb)PH*wlQ~=qKAn(Dg%k{P%S^ z=hmPW7#4*3GG%hgsB4ocm2pD3nLqZppWo)KwkFIMVU?_5WXIvOSe_<#Ul2Iw1D z7{~^Yhf0Gb5vCc;(^A2e&ckzx+gHih)XU+_p#S;;iGi5e`G=VRKofS}KT*dWDX<8T z4FH2mgI!M=-760WRS<^@k<;SVX?uZ1{=Z)V9PGS*E@;xFYVQ(HPkM)aS zI9SqhoWOUs7KKxi78HagU2K8M>T3_i$@a+nY)-*AM3@R8^o9NUNI}ID8C9CnWg7U> zH94+`CH~bLjht1;Bg>lZ1*16mxA-u-HKICNOvcADn=vg2k-|`VW>epO6Aj4`(dbo4vgq`8y_xg*q7zEB*RYH7sLW+JyCLx|I90 zq&41`e5b5}YY)||>ZyY+>g3GsA5m!3CyuD~>HRU0ex_O~YiJiMiHkm$v3rvb_Rp^2 z;>rG)XVj9jLN0CH>I5XrP*=YD5EC1Bw{1^CFnWK zu7b}f2O3hh0L2uDUm!$gPwI}6hx)M>11@fw&G4e9I9`g%F8;BB)YWmyE9 zzEyRGQ(Wy=_n3$sn!F}DQC9A8ww%oO3)ShQOG8YL<6MF~;p!blj5}mLd;X^~=gUkaG)> zJH4zfntmm;`Olti4SMsxK>&9AUl2?=Kw^;JApAG)KOk7FK_rx;RrCxa)0c2Kb*leN zOb#?8J1F9k^&!XR=XXSFaR%%OwVCfDv+(nQ)vCc8lKWF#49%nZ5ZJ^Rb7TIY7D3*d!?9;5u~KJT~?0x=KP z=1jIlwavO}pMMY(@_k!UTPIj;Cl}HQ>t>P=fML4y3a}e&>>IEYQ-cP({a+T|#FWE^ z)8sF;Q`{oY3P= 7 @@ -66,7 +66,9 @@ BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: libev-devel BuildRequires: http-parser-devel +%if %{use_libwrap} BuildRequires: tcp_wrappers-devel +%endif BuildRequires: automake, autoconf BuildRequires: radcli-devel BuildRequires: lz4-devel @@ -81,6 +83,7 @@ BuildRequires: autogen BuildRequires: liboath-devel BuildRequires: uid_wrapper BuildRequires: socket_wrapper +BuildRequires: gnupg2 %if 0%{?rhel} && 0%{?rhel} >= 7 %ifarch x86_64 %{ix86} @@ -137,6 +140,7 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* +sed -i 's/exit 1/exit 77/g' tests/ocpasswd-test %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c @@ -258,6 +262,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Mon Mar 05 2018 Nikos Mavrogiannopoulos - 0.11.11-1 +- Update to upstream 0.11.11 release + * Thu Feb 08 2018 Fedora Release Engineering - 0.11.10-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild diff --git a/sources b/sources index 43899fc..2f7f48b 100644 --- a/sources +++ b/sources @@ -6,6 +6,6 @@ SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 7eccc70fb763cf8a6525228230c1f537224809cf553efb3ad6bc88ad96f01122c30a5cd9d8328fa3a97b242d59e00bc9966589a24b1e65dd4a27eb71393f097c -SHA512 (ocserv-0.11.10.tar.xz.sig) = d88f3e42595df6c3a13dc64cbcdcca2126f22be7143856b00b0c7620358f9d0e5c524019c11ff10549e74ef5eebb0613c25afd9f7244c6ab14fb70b8059188b8 -SHA512 (ocserv-0.11.10.tar.xz) = 40fe152adf4438ed390406ec46049ff3769208e1d48b40bc0f015d507902a6e81012a52dd4ddd867f56a6d50de1dfb8fa497dc3bb6ece3e666ca14df1d76c561 +SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad +SHA512 (ocserv-0.11.11.tar.xz.sig) = 7a1521f94d48d7aafb66e6c544eb2e1c5a08d02441acc5f57876faaa984ad203f0395da37e602ad5539f54aa0ce1ff5da7389254028f6b811a9e01d6f86b1e84 +SHA512 (ocserv-0.11.11.tar.xz) = 1750e4ddd221913f82379ed34cf63f2ce858d73cfda0bcf60670a32bf2e8574a39f267c77abab78d2cf9a563a816d975e1a07b85c5e2412bd6d009850c8c262d From dc565f4e83076ee38dd0893fa304a3384bf8fa49 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 12 Apr 2018 16:37:32 +0200 Subject: [PATCH 104/195] Update to 0.11.11-2 - Update to upstream 0.11.11 release - include crypt.h to use crypt() --- .gitignore | 11 +++++++ ocserv-0.11.11-crypt.patch | 65 ++++++++++++++++++++++++++++++++++++++ ocserv.spec | 7 +++- 3 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 ocserv-0.11.11-crypt.patch diff --git a/.gitignore b/.gitignore index 325d272..3553425 100644 --- a/.gitignore +++ b/.gitignore @@ -115,3 +115,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.11.tar.xz.sig /ocserv-0.11.11.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.11.11.tar.xz.sig +/ocserv-0.11.11.tar.xz diff --git a/ocserv-0.11.11-crypt.patch b/ocserv-0.11.11-crypt.patch new file mode 100644 index 0000000..cec65e6 --- /dev/null +++ b/ocserv-0.11.11-crypt.patch @@ -0,0 +1,65 @@ +From cf9cda99a5caf8fabd547f25a962b96a46e13957 Mon Sep 17 00:00:00 2001 +From: Nikos Mavrogiannopoulos +Date: Thu, 12 Apr 2018 14:58:59 +0200 +Subject: [PATCH] include crypt.h to use crypt() + +This is necessary in Fedora28 as it doesn't provide +crypt() prototype in unistd.h + +https://bugzilla.redhat.com/show_bug.cgi?id=1566464 + +Signed-off-by: Nikos Mavrogiannopoulos +--- + configure.ac | 2 +- + src/auth/plain.c | 5 +++++ + src/ocpasswd/ocpasswd.c | 5 +++++ + 3 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/configure.ac b/configure.ac +index 71c27564..c03d8e7b 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -319,7 +319,7 @@ AC_CHECK_MEMBER([struct sockaddr.sa_len], + #include + ]) + +-AC_CHECK_HEADERS([net/if_tun.h linux/if_tun.h netinet/in_systm.h], [], [], []) ++AC_CHECK_HEADERS([net/if_tun.h linux/if_tun.h netinet/in_systm.h crypt.h], [], [], []) + + AC_CHECK_FUNCS([setproctitle vasprintf clock_gettime isatty pselect ppoll getpeereid sigaltstack]) + AC_CHECK_FUNCS([strlcpy posix_memalign malloc_trim strsep]) +diff --git a/src/auth/plain.c b/src/auth/plain.c +index 2052e07d..f9c7b1b1 100644 +--- a/src/auth/plain.c ++++ b/src/auth/plain.c +@@ -37,6 +37,11 @@ + #ifdef HAVE_LIBOATH + # include + #endif ++#ifdef HAVE_CRYPT_H ++ /* libcrypt in Fedora28 does not provide prototype ++ * in unistd.h */ ++# include ++#endif + + #define MAX_CPASS_SIZE 128 + #define HOTP_WINDOW 20 +diff --git a/src/ocpasswd/ocpasswd.c b/src/ocpasswd/ocpasswd.c +index de3b8396..abb66744 100644 +--- a/src/ocpasswd/ocpasswd.c ++++ b/src/ocpasswd/ocpasswd.c +@@ -32,6 +32,11 @@ + #include + #include + #include "ocpasswd-args.h" ++#ifdef HAVE_CRYPT_H ++ /* libcrypt in Fedora28 does not provide prototype ++ * in unistd.h */ ++# include ++#endif + + /* Gnulib portability files. */ + #include +-- +2.14.3 + diff --git a/ocserv.spec b/ocserv.spec index eac0ae1..53982f9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,7 @@ # This spec file has been automatically updated Version: 0.11.11 -Release: 1%{?dist} +Release: 2%{?dist} +Patch1: ocserv-0.11.11-crypt.patch %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -262,6 +263,10 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Apr 12 2018 Nikos Mavrogiannopoulos - 0.11.11-2 +- Update to upstream 0.11.11 release +- include crypt.h to use crypt() + * Mon Mar 05 2018 Nikos Mavrogiannopoulos - 0.11.11-1 - Update to upstream 0.11.11 release From 914a518ada555171c0e5fbda48a632eaf8c4bec5 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 23 Apr 2018 11:20:16 +0200 Subject: [PATCH 105/195] Update to 0.12.0-1 - Update to upstream 0.12.0 release --- .gitignore | 11 +++++ ocserv-0.11.11-crypt.patch | 65 ---------------------------- ocserv-0.12.0-add-missing-test.patch | 46 ++++++++++++++++++++ ocserv.conf | 27 +++++++++--- ocserv.spec | 31 +++++++------ sources | 6 +-- 6 files changed, 97 insertions(+), 89 deletions(-) delete mode 100644 ocserv-0.11.11-crypt.patch create mode 100644 ocserv-0.12.0-add-missing-test.patch diff --git a/.gitignore b/.gitignore index 3553425..d09b5eb 100644 --- a/.gitignore +++ b/.gitignore @@ -126,3 +126,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.11.11.tar.xz.sig /ocserv-0.11.11.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.0.tar.xz.sig +/ocserv-0.12.0.tar.xz diff --git a/ocserv-0.11.11-crypt.patch b/ocserv-0.11.11-crypt.patch deleted file mode 100644 index cec65e6..0000000 --- a/ocserv-0.11.11-crypt.patch +++ /dev/null @@ -1,65 +0,0 @@ -From cf9cda99a5caf8fabd547f25a962b96a46e13957 Mon Sep 17 00:00:00 2001 -From: Nikos Mavrogiannopoulos -Date: Thu, 12 Apr 2018 14:58:59 +0200 -Subject: [PATCH] include crypt.h to use crypt() - -This is necessary in Fedora28 as it doesn't provide -crypt() prototype in unistd.h - -https://bugzilla.redhat.com/show_bug.cgi?id=1566464 - -Signed-off-by: Nikos Mavrogiannopoulos ---- - configure.ac | 2 +- - src/auth/plain.c | 5 +++++ - src/ocpasswd/ocpasswd.c | 5 +++++ - 3 files changed, 11 insertions(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index 71c27564..c03d8e7b 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -319,7 +319,7 @@ AC_CHECK_MEMBER([struct sockaddr.sa_len], - #include - ]) - --AC_CHECK_HEADERS([net/if_tun.h linux/if_tun.h netinet/in_systm.h], [], [], []) -+AC_CHECK_HEADERS([net/if_tun.h linux/if_tun.h netinet/in_systm.h crypt.h], [], [], []) - - AC_CHECK_FUNCS([setproctitle vasprintf clock_gettime isatty pselect ppoll getpeereid sigaltstack]) - AC_CHECK_FUNCS([strlcpy posix_memalign malloc_trim strsep]) -diff --git a/src/auth/plain.c b/src/auth/plain.c -index 2052e07d..f9c7b1b1 100644 ---- a/src/auth/plain.c -+++ b/src/auth/plain.c -@@ -37,6 +37,11 @@ - #ifdef HAVE_LIBOATH - # include - #endif -+#ifdef HAVE_CRYPT_H -+ /* libcrypt in Fedora28 does not provide prototype -+ * in unistd.h */ -+# include -+#endif - - #define MAX_CPASS_SIZE 128 - #define HOTP_WINDOW 20 -diff --git a/src/ocpasswd/ocpasswd.c b/src/ocpasswd/ocpasswd.c -index de3b8396..abb66744 100644 ---- a/src/ocpasswd/ocpasswd.c -+++ b/src/ocpasswd/ocpasswd.c -@@ -32,6 +32,11 @@ - #include - #include - #include "ocpasswd-args.h" -+#ifdef HAVE_CRYPT_H -+ /* libcrypt in Fedora28 does not provide prototype -+ * in unistd.h */ -+# include -+#endif - - /* Gnulib portability files. */ - #include --- -2.14.3 - diff --git a/ocserv-0.12.0-add-missing-test.patch b/ocserv-0.12.0-add-missing-test.patch new file mode 100644 index 0000000..91e1f6b --- /dev/null +++ b/ocserv-0.12.0-add-missing-test.patch @@ -0,0 +1,46 @@ +diff --git a/tests/server-cert-rsa-pss b/tests/server-cert-rsa-pss +new file mode 100755 +index 0000000..be3d098 +--- /dev/null ++++ b/tests/server-cert-rsa-pss +@@ -0,0 +1,40 @@ ++#!/bin/sh ++# ++# Copyright (C) 2017 Red Hat, Inc. ++# ++# This file is part of ocserv. ++# ++# ocserv is free software; you can redistribute it and/or modify it ++# under the terms of the GNU General Public License as published by the ++# Free Software Foundation; either version 2 of the License, or (at ++# your option) any later version. ++# ++# ocserv is distributed in the hope that it will be useful, but ++# WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++# General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with GnuTLS; if not, write to the Free Software Foundation, ++# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. ++ ++SERV="${SERV:-../src/ocserv}" ++srcdir=${srcdir:-.} ++NO_NEED_ROOT=1 ++PORT=4444 ++ ++. `dirname $0`/common.sh ++ ++echo "Testing server cert with RSA-PSS... " ++ ++update_config test-rsa-pss.config ++launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! ++wait_server $PID ++ ++echo "Connecting to obtain cookie... " ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=sha256:7462b697482f771a9a787bc19db00f704a1685ae09ed201b7a126b052a09522e --cookieonly ) || ++ fail $PID "Could not receive cookie from server" ++ ++cleanup ++ ++exit 0 diff --git a/ocserv.conf b/ocserv.conf index 96082b7..63ac7db 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,12 +1,19 @@ -# User authentication method. Could be set multiple times and in -# that case all should succeed. To enable multiple methods use -# multiple auth directives. Available options: certificate, -# plain, pam, radius, gssapi. +### The following directives do not change with server reload. +# +# User authentication method. To require multiple methods to be +# used for the user to login, add multiple auth directives. The values +# in the 'auth' directive are AND composed (if multiple all must +# succeed). +# Available options: certificate, plain, pam, radius, gssapi. +# Note that authentication methods utilizing passwords cannot be +# combined (e.g., the plain, pam or radius methods). # -# Note that authentication methods cannot be changed with reload. - # certificate: # This indicates that all connecting users must present a certificate. +# The username and user group will be then extracted from it (see +# cert-user-oid and cert-group-oid). The certificate to be accepted +# it must be signed by the CA certificate as specified in 'ca-cert' and +# it must not be listed in the CRL, as specified by the 'crl' option. # # pam[gid-min=1000]: # This enabled PAM authentication of the user. The gid-min option is used @@ -44,7 +51,9 @@ auth = "pam" # Specify alternative authentication methods that are sufficient # for authentication. That is, if set, any of the methods enabled -# will be sufficient to login. +# will be sufficient to login, irrespective of the main 'auth' entries. +# When multiple options are present, they are OR composed (any of them +# succeeding allows login). #enable-auth = "certificate" #enable-auth = "gssapi" #enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]" @@ -176,6 +185,10 @@ try-mtu-discovery = false # # There may be multiple server-cert and server-key directives, # but each key should correspond to the preceding certificate. +# The certificate files will be reloaded when changed allowing for in-place +# certificate renewal (they are checked and reloaded periodically; +# a SIGHUP signal to main server will force reload). + server-cert = /etc/pki/ocserv/public/server.crt server-key = /etc/pki/ocserv/private/server.key diff --git a/ocserv.spec b/ocserv.spec index 53982f9..8744f34 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,7 @@ # This spec file has been automatically updated -Version: 0.11.11 -Release: 2%{?dist} -Patch1: ocserv-0.11.11-crypt.patch +Version: 0.12.0 +Release: 1%{?dist} +Patch1: ocserv-0.12.0-add-missing-test.patch %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -20,9 +20,9 @@ Patch1: ocserv-0.11.11-crypt.patch %define use_local_protobuf 0 %if 0%{?rhel} && 0%{?rhel} == 7 -%ifarch ppc64 -%define use_local_protobuf 1 -%endif +#%ifarch ppc64 +#%define use_local_protobuf 1 +#%endif %endif Name: ocserv @@ -79,12 +79,11 @@ BuildRequires: GeoIP-devel %if %{use_systemd} BuildRequires: systemd BuildRequires: systemd-devel -BuildRequires: autogen-libopts-devel -BuildRequires: autogen BuildRequires: liboath-devel BuildRequires: uid_wrapper BuildRequires: socket_wrapper BuildRequires: gnupg2 +BuildRequires: rubygem(ronn) %if 0%{?rhel} && 0%{?rhel} >= 7 %ifarch x86_64 %{ix86} @@ -127,7 +126,12 @@ to provide the secure VPN service. %if %{have_gpgv2} gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %endif + +%if 0%{?rhel} && 0%{?rhel} <= 6 %setup -q +%else +%autosetup -p1 +%endif rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) @@ -141,14 +145,13 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: # http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* -sed -i 's/exit 1/exit 77/g' tests/ocpasswd-test %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c -%else -rm -f libopts/*.c libopts/*.h libopts/*/*.c libopts/*/*.h %endif +chmod 755 tests/server-cert-rsa-pss + %build %if 0%{?rhel} && 0%{?rhel} <= 6 @@ -166,9 +169,6 @@ autoreconf -fvi %else --disable-systemd \ %endif -%if 0%{?rhel} && 0%{?rhel} <= 6 - --enable-local-libopts \ -%endif %if %{use_local_protobuf} --without-protobuf \ %endif @@ -263,6 +263,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Mon Apr 23 2018 Nikos Mavrogiannopoulos - 0.12.0-1 +- Update to upstream 0.12.0 release + * Thu Apr 12 2018 Nikos Mavrogiannopoulos - 0.11.11-2 - Update to upstream 0.11.11 release - include crypt.h to use crypt() diff --git a/sources b/sources index 2f7f48b..db4b5fa 100644 --- a/sources +++ b/sources @@ -5,7 +5,7 @@ SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e1 SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 -SHA512 (ocserv.conf) = 0a48d394dba183528c1e92df2a8b844a4d7d419244b1c08883f79c8b48843986e786ea4d48478ed4e8d57fd56626bf962dbcf6c76b5839ba5ab5fac8b089c44c +SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.11.11.tar.xz.sig) = 7a1521f94d48d7aafb66e6c544eb2e1c5a08d02441acc5f57876faaa984ad203f0395da37e602ad5539f54aa0ce1ff5da7389254028f6b811a9e01d6f86b1e84 -SHA512 (ocserv-0.11.11.tar.xz) = 1750e4ddd221913f82379ed34cf63f2ce858d73cfda0bcf60670a32bf2e8574a39f267c77abab78d2cf9a563a816d975e1a07b85c5e2412bd6d009850c8c262d +SHA512 (ocserv-0.12.0.tar.xz.sig) = a746e72ba07bf7d28104385a70ba4c685389353368d02383eb385aece19ccc9d51a86226371338dbe1737046e403b17e351a04ffa2674ca594bf9e467438b534 +SHA512 (ocserv-0.12.0.tar.xz) = 73e39a6073761a42cff7637fdc0748d969dc6ddd80635633487aa2627ae7234af772194cf27fdded9f08637b26d7ca9017555242ccdb6ade03897f9d4ca4de8d From d4859d253fa969f4cc85473af34a2ec5f71e7ef3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 12 May 2018 12:03:06 +0200 Subject: [PATCH 106/195] Update to 0.12.1-1 - Update to upstream 0.12.1 release --- .gitignore | 11 +++++++ ocserv-0.12.0-add-missing-test.patch | 46 ---------------------------- ocserv.service | 4 +-- ocserv.spec | 28 ++++++++--------- sources | 6 ++-- 5 files changed, 30 insertions(+), 65 deletions(-) delete mode 100644 ocserv-0.12.0-add-missing-test.patch diff --git a/.gitignore b/.gitignore index d09b5eb..5aa3c3c 100644 --- a/.gitignore +++ b/.gitignore @@ -137,3 +137,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.0.tar.xz.sig /ocserv-0.12.0.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.1.tar.xz.sig +/ocserv-0.12.1.tar.xz diff --git a/ocserv-0.12.0-add-missing-test.patch b/ocserv-0.12.0-add-missing-test.patch deleted file mode 100644 index 91e1f6b..0000000 --- a/ocserv-0.12.0-add-missing-test.patch +++ /dev/null @@ -1,46 +0,0 @@ -diff --git a/tests/server-cert-rsa-pss b/tests/server-cert-rsa-pss -new file mode 100755 -index 0000000..be3d098 ---- /dev/null -+++ b/tests/server-cert-rsa-pss -@@ -0,0 +1,40 @@ -+#!/bin/sh -+# -+# Copyright (C) 2017 Red Hat, Inc. -+# -+# This file is part of ocserv. -+# -+# ocserv is free software; you can redistribute it and/or modify it -+# under the terms of the GNU General Public License as published by the -+# Free Software Foundation; either version 2 of the License, or (at -+# your option) any later version. -+# -+# ocserv is distributed in the hope that it will be useful, but -+# WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+# General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with GnuTLS; if not, write to the Free Software Foundation, -+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -+ -+SERV="${SERV:-../src/ocserv}" -+srcdir=${srcdir:-.} -+NO_NEED_ROOT=1 -+PORT=4444 -+ -+. `dirname $0`/common.sh -+ -+echo "Testing server cert with RSA-PSS... " -+ -+update_config test-rsa-pss.config -+launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! -+wait_server $PID -+ -+echo "Connecting to obtain cookie... " -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=sha256:7462b697482f771a9a787bc19db00f704a1685ae09ed201b7a126b052a09522e --cookieonly ) || -+ fail $PID "Could not receive cookie from server" -+ -+cleanup -+ -+exit 0 diff --git a/ocserv.service b/ocserv.service index 4fe4813..a71f2dd 100644 --- a/ocserv.service +++ b/ocserv.service @@ -7,10 +7,10 @@ After=dbus.service [Service] PrivateTmp=true -Type=forking +Type=simple PIDFile=/var/run/ocserv.pid ExecStartPre=/usr/sbin/ocserv-genkey -ExecStart=/usr/sbin/ocserv --pid-file /var/run/ocserv.pid --config /etc/ocserv/ocserv.conf +ExecStart=/usr/sbin/ocserv --pid-file /var/run/ocserv.pid --config /etc/ocserv/ocserv.conf -f ExecReload=/bin/kill -HUP $MAINPID [Install] diff --git a/ocserv.spec b/ocserv.spec index 8744f34..492d171 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,7 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.0 +Version: 0.12.1 Release: 1%{?dist} -Patch1: ocserv-0.12.0-add-missing-test.patch %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -19,11 +18,6 @@ Patch1: ocserv-0.12.0-add-missing-test.patch %endif %define use_local_protobuf 0 -%if 0%{?rhel} && 0%{?rhel} == 7 -#%ifarch ppc64 -#%define use_local_protobuf 1 -#%endif -%endif Name: ocserv Summary: OpenConnect SSL VPN server @@ -83,7 +77,6 @@ BuildRequires: liboath-devel BuildRequires: uid_wrapper BuildRequires: socket_wrapper BuildRequires: gnupg2 -BuildRequires: rubygem(ronn) %if 0%{?rhel} && 0%{?rhel} >= 7 %ifarch x86_64 %{ix86} @@ -97,6 +90,11 @@ BuildRequires: libseccomp-devel %endif #use systemd +# no rubygem in epel7 +%if 0%{?fedora} || 0%{?rhel} > 7 +BuildRequires: rubygem(ronn) +%endif + Requires: gnutls-utils Requires: iproute Requires: pam @@ -127,11 +125,7 @@ to provide the secure VPN service. gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %{SOURCE1} %{SOURCE0} %endif -%if 0%{?rhel} && 0%{?rhel} <= 6 -%setup -q -%else %autosetup -p1 -%endif rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) @@ -150,8 +144,6 @@ sed -i 's/either version 3 of the License/either version 2 of the License/g' bui echo "int main() { return 77; }" > tests/valid-hostname.c %endif -chmod 755 tests/server-cert-rsa-pss - %build %if 0%{?rhel} && 0%{?rhel} <= 6 @@ -246,9 +238,14 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT + +## Temporarily disable when rubygem is not present; there is a bug in 0.12.0 dist +%if 0%{?fedora} || 0%{?rhel} > 7 %{_mandir}/man8/ocserv.8* %{_mandir}/man8/occtl.8* %{_mandir}/man8/ocpasswd.8* +%endif + %{_bindir}/ocpasswd %{_bindir}/occtl %{_bindir}/ocserv-fw @@ -263,6 +260,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat May 12 2018 Nikos Mavrogiannopoulos - 0.12.1-1 +- Update to upstream 0.12.1 release + * Mon Apr 23 2018 Nikos Mavrogiannopoulos - 0.12.0-1 - Update to upstream 0.12.0 release diff --git a/sources b/sources index db4b5fa..e483c81 100644 --- a/sources +++ b/sources @@ -4,8 +4,8 @@ SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42deb SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a -SHA512 (ocserv.service) = 264f3389d88aec1f7d2e4683a4dfc0aa67af2325154de822eecf5fb43f8c221aab0d9f0c6a8eedb893e6d69ed4d94c9397b01e5d0d12e88330017a3bfa5f3644 +SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.0.tar.xz.sig) = a746e72ba07bf7d28104385a70ba4c685389353368d02383eb385aece19ccc9d51a86226371338dbe1737046e403b17e351a04ffa2674ca594bf9e467438b534 -SHA512 (ocserv-0.12.0.tar.xz) = 73e39a6073761a42cff7637fdc0748d969dc6ddd80635633487aa2627ae7234af772194cf27fdded9f08637b26d7ca9017555242ccdb6ade03897f9d4ca4de8d +SHA512 (ocserv-0.12.1.tar.xz.sig) = 0dd3123ffc525faa724de7a10f0a2202fc31ea667428e41c3ca68a3fffc29979d9bff16abde3adece8e921881704efc952d077e9bc161be4d69a124218ae5616 +SHA512 (ocserv-0.12.1.tar.xz) = 3fc5e6c6a3b4390cb0ffa78fac4f8e70aa689227c6f5b62180b95f35cf2de0c41075a157412de40866ce1af12ad8feabd87b2b986c8ca09ebee70514da9ec13f From a6201d770437f2c326b44ee2c590a35f0cfba481 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Mon, 9 Jul 2018 19:06:49 +0200 Subject: [PATCH 107/195] add BuildRequires: gcc Reference: https://fedoraproject.org/wiki/Changes/Remove_GCC_from_BuildRoot --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 492d171..55098a8 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -42,6 +42,7 @@ Source11: ocserv.init # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 %if 0%{?rhel} && 0%{?rhel} <= 6 +BuildRequires: gcc BuildRequires: gnutls30-devel %else BuildRequires: gnutls-devel From fd5e7c4a707b777c23555299578a90e5621ea89f Mon Sep 17 00:00:00 2001 From: Jason Tibbitts Date: Tue, 10 Jul 2018 01:54:25 -0500 Subject: [PATCH 108/195] Remove needless use of %defattr --- ocserv.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 55098a8..675b95b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -229,7 +229,6 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %make_install %files -%defattr(-,root,root,-) %dir %{_localstatedir}/lib/ocserv %dir %{_sysconfdir}/ocserv From c692b002287d20bb4f1dc818e18f5b7389a4deec Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 13 Jul 2018 14:51:24 +0000 Subject: [PATCH 109/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 675b95b..079b664 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.1 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -260,6 +260,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Jul 13 2018 Fedora Release Engineering - 0.12.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Sat May 12 2018 Nikos Mavrogiannopoulos - 0.12.1-1 - Update to upstream 0.12.1 release From 9d114bd7a92000adb24355eb79fd81d3b37d4108 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 24 Jul 2018 09:09:40 +0200 Subject: [PATCH 110/195] Added gcc as build-dependency --- ocserv.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 079b664..d780d14 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.1 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -41,8 +41,9 @@ Source11: ocserv.init # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 -%if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gcc + +%if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel %else BuildRequires: gnutls-devel @@ -260,6 +261,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jul 24 2018 Nikos Mavrogiannopoulos - 0.12.1-3 +- Added gcc as build-dependency + * Fri Jul 13 2018 Fedora Release Engineering - 0.12.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From 040d07710192d1bd0d9c2da163b41b0a736c8038 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 10 Jan 2019 20:53:38 +0100 Subject: [PATCH 111/195] Update to 0.12.2-1 - Update to upstream 0.12.2 release --- .gitignore | 11 +++++++++++ ocserv.spec | 14 +++++++------- sources | 4 ++-- 3 files changed, 20 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 5aa3c3c..aab5bdc 100644 --- a/.gitignore +++ b/.gitignore @@ -148,3 +148,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.1.tar.xz.sig /ocserv-0.12.1.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.2.tar.xz.sig +/ocserv-0.12.2.tar.xz diff --git a/ocserv.spec b/ocserv.spec index d780d14..663142c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.1 -Release: 3%{?dist} +Version: 0.12.2 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -41,8 +41,7 @@ Source11: ocserv.init # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 -BuildRequires: gcc - +BuildRequires: gcc %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel %else @@ -230,6 +229,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %make_install %files +%defattr(-,root,root,-) %dir %{_localstatedir}/lib/ocserv %dir %{_sysconfdir}/ocserv @@ -240,12 +240,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT -## Temporarily disable when rubygem is not present; there is a bug in 0.12.0 dist -%if 0%{?fedora} || 0%{?rhel} > 7 %{_mandir}/man8/ocserv.8* %{_mandir}/man8/occtl.8* %{_mandir}/man8/ocpasswd.8* -%endif %{_bindir}/ocpasswd %{_bindir}/occtl @@ -261,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 10 2019 Nikos Mavrogiannopoulos - 0.12.2-1 +- Update to upstream 0.12.2 release + * Tue Jul 24 2018 Nikos Mavrogiannopoulos - 0.12.1-3 - Added gcc as build-dependency diff --git a/sources b/sources index e483c81..4b8f0de 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.1.tar.xz.sig) = 0dd3123ffc525faa724de7a10f0a2202fc31ea667428e41c3ca68a3fffc29979d9bff16abde3adece8e921881704efc952d077e9bc161be4d69a124218ae5616 -SHA512 (ocserv-0.12.1.tar.xz) = 3fc5e6c6a3b4390cb0ffa78fac4f8e70aa689227c6f5b62180b95f35cf2de0c41075a157412de40866ce1af12ad8feabd87b2b986c8ca09ebee70514da9ec13f +SHA512 (ocserv-0.12.2.tar.xz.sig) = 135eda011200679e7ae29fc66a09f940a88c056561c8491538089070327554c295533ad238a1b866f90a702b5465969817148495c96fa5b3ef8d1a10bf14ce6d +SHA512 (ocserv-0.12.2.tar.xz) = 3ce6cf68ad9349d6d090f35c14712ce3ddb8f2fe6b33285e050e99ac4457ca1127b55d3cea739a4364072534c69cb094912b4631a14b87362bd31ccc1a550b3a From 7feaa2186078638ec55da9f949ad0775b78eb7ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Mon, 14 Jan 2019 19:10:33 +0100 Subject: [PATCH 112/195] Rebuilt for libcrypt.so.2 (#1666033) --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 663142c..2516e05 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.2 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Mon Jan 14 2019 Björn Esser - 0.12.2-2 +- Rebuilt for libcrypt.so.2 (#1666033) + * Thu Jan 10 2019 Nikos Mavrogiannopoulos - 0.12.2-1 - Update to upstream 0.12.2 release From d5f2f4f60c9415040ea3e1973713c5e273951320 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 1 Feb 2019 17:02:29 +0000 Subject: [PATCH 113/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 2516e05..a6f9d9e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.2 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Feb 01 2019 Fedora Release Engineering - 0.12.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Mon Jan 14 2019 Björn Esser - 0.12.2-2 - Rebuilt for libcrypt.so.2 (#1666033) From 49598e0b1109be5ebd7b24b62d8fdecb75b17a2f Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sun, 17 Feb 2019 09:30:52 +0100 Subject: [PATCH 114/195] Rebuild for readline 8.0 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index a6f9d9e..75f110f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.2 -Release: 3%{?dist} +Release: 4%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sun Feb 17 2019 Igor Gnatenko - 0.12.2-4 +- Rebuild for readline 8.0 + * Fri Feb 01 2019 Fedora Release Engineering - 0.12.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 7ab4ba388f0f4bfb045c55c37d26fdd549503b8d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 12 Mar 2019 21:24:37 +0100 Subject: [PATCH 115/195] Update to 0.12.3-1 - Update to upstream 0.12.3 release --- .gitignore | 11 +++++++++++ ocserv.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index aab5bdc..4aac85e 100644 --- a/.gitignore +++ b/.gitignore @@ -159,3 +159,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.2.tar.xz.sig /ocserv-0.12.2.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.3.tar.xz.sig +/ocserv-0.12.3.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 75f110f..957abba 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.2 -Release: 4%{?dist} +Version: 0.12.3 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Mar 12 2019 Nikos Mavrogiannopoulos - 0.12.3-1 +- Update to upstream 0.12.3 release + * Sun Feb 17 2019 Igor Gnatenko - 0.12.2-4 - Rebuild for readline 8.0 diff --git a/sources b/sources index 4b8f0de..8e150a5 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.2.tar.xz.sig) = 135eda011200679e7ae29fc66a09f940a88c056561c8491538089070327554c295533ad238a1b866f90a702b5465969817148495c96fa5b3ef8d1a10bf14ce6d -SHA512 (ocserv-0.12.2.tar.xz) = 3ce6cf68ad9349d6d090f35c14712ce3ddb8f2fe6b33285e050e99ac4457ca1127b55d3cea739a4364072534c69cb094912b4631a14b87362bd31ccc1a550b3a +SHA512 (ocserv-0.12.3.tar.xz.sig) = cac126cc717dded853ffcca2754111c7f1fda270e931ce912aed6c2b7394ebb193e67bc2c1c10bd883e93a271c0ec60393945d37c4820d5ca648894a265effcf +SHA512 (ocserv-0.12.3.tar.xz) = 93a85a09c1d55c265a188864744ef99a52d72d5bdcd5cce1c3cb6a1089fadd27464be9bb7775d05001e962bc4ac7edcb9cbaf7b209557cb147b8b27252082dbe From 1e4d860399d6a3646e14ce6abcb49e896039d0df Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 3 Jul 2019 21:27:29 +0200 Subject: [PATCH 116/195] Update to 0.12.4-1 - Update to upstream 0.12.4 release --- .gitignore | 11 +++++++++++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4aac85e..14c17cd 100644 --- a/.gitignore +++ b/.gitignore @@ -170,3 +170,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.3.tar.xz.sig /ocserv-0.12.3.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.4.tar.xz.sig +/ocserv-0.12.4.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 957abba..858cf5d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.12.3 +Version: 0.12.4 Release: 1%{?dist} %global _hardened_build 1 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Jul 03 2019 Nikos Mavrogiannopoulos - 0.12.4-1 +- Update to upstream 0.12.4 release + * Tue Mar 12 2019 Nikos Mavrogiannopoulos - 0.12.3-1 - Update to upstream 0.12.3 release diff --git a/sources b/sources index 8e150a5..7a8dae7 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.3.tar.xz.sig) = cac126cc717dded853ffcca2754111c7f1fda270e931ce912aed6c2b7394ebb193e67bc2c1c10bd883e93a271c0ec60393945d37c4820d5ca648894a265effcf -SHA512 (ocserv-0.12.3.tar.xz) = 93a85a09c1d55c265a188864744ef99a52d72d5bdcd5cce1c3cb6a1089fadd27464be9bb7775d05001e962bc4ac7edcb9cbaf7b209557cb147b8b27252082dbe +SHA512 (ocserv-0.12.4.tar.xz.sig) = 8ac5a5a7b3b4dcedce4a497cba923092e0035c816ea0d6b9a888102aeb03889af101259eb392d676501717abdc7544b78f60054f4409835022cf2a6949e795ff +SHA512 (ocserv-0.12.4.tar.xz) = 5483cede9627886912f9620d358f1a22504b5de2653529e4275f4b96e4fc874b264877ff0c9ef85c9a0662253d0de44950c4f3a8410fea427d742cc733d5f741 From 27ded8f35d395bd3489e470cd6a9395b38372e07 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jul 2019 23:06:02 +0000 Subject: [PATCH 117/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 858cf5d..79213fb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.4 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -258,6 +258,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jul 25 2019 Fedora Release Engineering - 0.12.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Wed Jul 03 2019 Nikos Mavrogiannopoulos - 0.12.4-1 - Update to upstream 0.12.4 release From 61100caa824332fc212f854a9ef3e4601362ae30 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 14 Oct 2019 14:42:22 +0200 Subject: [PATCH 118/195] spec: updated for rhel8 --- ocserv.spec | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 79213fb..7b1ebcf 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -17,6 +17,13 @@ Release: 2%{?dist} %define use_libwrap 1 %endif +%if 0%{?rhel} && 0%{?rhel} == 8 +%define use_http_parser 0 +%define use_geoip 0 +%else +%define use_geoip 1 +%endif + %define use_local_protobuf 0 Name: ocserv @@ -61,7 +68,10 @@ BuildRequires: gperf BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: libev-devel +%if %{use_http_parser} BuildRequires: http-parser-devel +%endif + %if %{use_libwrap} BuildRequires: tcp_wrappers-devel %endif @@ -69,7 +79,9 @@ BuildRequires: automake, autoconf BuildRequires: radcli-devel BuildRequires: lz4-devel BuildRequires: readline-devel +%if %{use_geoip} BuildRequires: GeoIP-devel +%endif %if %{use_systemd} BuildRequires: systemd @@ -92,7 +104,7 @@ BuildRequires: libseccomp-devel %endif #use systemd # no rubygem in epel7 -%if 0%{?fedora} || 0%{?rhel} > 7 +%if 0%{?fedora} BuildRequires: rubygem(ronn) %endif @@ -128,7 +140,9 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %autosetup -p1 +%if %{use_http_parser} rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h +%endif %if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ touch src/*.proto @@ -165,6 +179,9 @@ autoreconf -fvi %if %{use_local_protobuf} --without-protobuf \ %endif +%if ! %{use_http_parser} + --without-http-parser \ +%endif %if %{use_libwrap} --with-libwrap %else From c1e22541312dfbc95249f670025ce8f87d7a70b0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 16 Oct 2019 20:41:46 +0200 Subject: [PATCH 119/195] spec: fix missing definition --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 7b1ebcf..78bc59f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -21,6 +21,7 @@ Release: 2%{?dist} %define use_http_parser 0 %define use_geoip 0 %else +%define use_http_parser 1 %define use_geoip 1 %endif From 3df62c607cca082ba5edae8b5a8db70f33586066 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 16 Oct 2019 22:05:13 +0200 Subject: [PATCH 120/195] Update to 0.12.5-1 - Update to upstream 0.12.5 release --- .gitignore | 11 +++++++++++ ocserv.spec | 13 +++++++++---- sources | 4 ++-- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 14c17cd..2e600d0 100644 --- a/.gitignore +++ b/.gitignore @@ -181,3 +181,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.4.tar.xz.sig /ocserv-0.12.4.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.5.tar.xz.sig +/ocserv-0.12.5.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 78bc59f..7037de8 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.4 -Release: 2%{?dist} +Version: 0.12.5 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -13,16 +13,16 @@ Release: 2%{?dist} %if 0%{?fedora} >= 28 || 0%{?rhel} > 7 %define use_libwrap 0 +%define use_geoip 0 %else %define use_libwrap 1 +%define use_geoip 1 %endif %if 0%{?rhel} && 0%{?rhel} == 8 %define use_http_parser 0 -%define use_geoip 0 %else %define use_http_parser 1 -%define use_geoip 1 %endif %define use_local_protobuf 0 @@ -82,6 +82,8 @@ BuildRequires: lz4-devel BuildRequires: readline-devel %if %{use_geoip} BuildRequires: GeoIP-devel +%else +BuildRequires: libmaxminddb-devel %endif %if %{use_systemd} @@ -276,6 +278,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Oct 16 2019 Nikos Mavrogiannopoulos - 0.12.5-1 +- Update to upstream 0.12.5 release + * Thu Jul 25 2019 Fedora Release Engineering - 0.12.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 7a8dae7..585bfb5 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.4.tar.xz.sig) = 8ac5a5a7b3b4dcedce4a497cba923092e0035c816ea0d6b9a888102aeb03889af101259eb392d676501717abdc7544b78f60054f4409835022cf2a6949e795ff -SHA512 (ocserv-0.12.4.tar.xz) = 5483cede9627886912f9620d358f1a22504b5de2653529e4275f4b96e4fc874b264877ff0c9ef85c9a0662253d0de44950c4f3a8410fea427d742cc733d5f741 +SHA512 (ocserv-0.12.5.tar.xz.sig) = 049cf165ba148090a6b21bbb17d68c0c35936e904ab5731a7a8473cd85944af955ea738b87ce580cdb8c3524bdca8a3361d1f30895cf7e272682b1061902b3bf +SHA512 (ocserv-0.12.5.tar.xz) = b6e6262fbf5f00639253f85ce8ed0b10d8b45dbcdf4325cbba7f5a80fee979d556f23a635df36b85b307f12b7e5bd44165d8631624500d52168170ca00a166aa From 2dc5db7b83e0508133ef22fc8197ee0e6b64e1a8 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 28 Dec 2019 20:32:14 +0100 Subject: [PATCH 121/195] Update to 0.12.6-1 - Update to upstream 0.12.6 release --- .gitignore | 11 +++++++++++ ocserv.spec | 5 ++++- sources | 4 ++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2e600d0..6270347 100644 --- a/.gitignore +++ b/.gitignore @@ -192,3 +192,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.5.tar.xz.sig /ocserv-0.12.5.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-0.12.6.tar.xz.sig +/ocserv-0.12.6.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 7037de8..117a2be 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.12.5 +Version: 0.12.6 Release: 1%{?dist} %global _hardened_build 1 @@ -278,6 +278,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat Dec 28 2019 Nikos Mavrogiannopoulos - 0.12.6-1 +- Update to upstream 0.12.6 release + * Wed Oct 16 2019 Nikos Mavrogiannopoulos - 0.12.5-1 - Update to upstream 0.12.5 release diff --git a/sources b/sources index 585bfb5..7ff8e74 100644 --- a/sources +++ b/sources @@ -7,5 +7,5 @@ SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28e SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.5.tar.xz.sig) = 049cf165ba148090a6b21bbb17d68c0c35936e904ab5731a7a8473cd85944af955ea738b87ce580cdb8c3524bdca8a3361d1f30895cf7e272682b1061902b3bf -SHA512 (ocserv-0.12.5.tar.xz) = b6e6262fbf5f00639253f85ce8ed0b10d8b45dbcdf4325cbba7f5a80fee979d556f23a635df36b85b307f12b7e5bd44165d8631624500d52168170ca00a166aa +SHA512 (ocserv-0.12.6.tar.xz.sig) = 8791479c6f1e6e8c6fd7b6f08857c5e6c1fc81ebc9a11c55231a049c27e2ee9f0bf938ccf1b66fb704eafb26cda6c9595f54edffa265d732dd640e8123538313 +SHA512 (ocserv-0.12.6.tar.xz) = 4d254298dc897304b4676f28a21338c138196cbdb08170c6d536c8c6730fab307642dbf853f96e66335604cb68711262678d3d0be84e6768ec720b9a81ccf813 From a8f51f2fe48ca54d8f874baf77aab34779feeeb9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 28 Dec 2019 21:25:34 +0100 Subject: [PATCH 122/195] ocserv.conf: updated to latest upstream version --- ocserv.conf | 285 +++++++++++++++++++++++++++++++++------------------- ocserv.spec | 4 +- 2 files changed, 184 insertions(+), 105 deletions(-) diff --git a/ocserv.conf b/ocserv.conf index 63ac7db..59d8e75 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -1,5 +1,5 @@ ### The following directives do not change with server reload. -# + # User authentication method. To require multiple methods to be # used for the user to login, add multiple auth directives. The values # in the 'auth' directive are AND composed (if multiple all must @@ -7,7 +7,7 @@ # Available options: certificate, plain, pam, radius, gssapi. # Note that authentication methods utilizing passwords cannot be # combined (e.g., the plain, pam or radius methods). -# + # certificate: # This indicates that all connecting users must present a certificate. # The username and user group will be then extracted from it (see @@ -16,7 +16,7 @@ # it must not be listed in the CRL, as specified by the 'crl' option. # # pam[gid-min=1000]: -# This enabled PAM authentication of the user. The gid-min option is used +# This enabled PAM authentication of the user. The gid-min option is used # by auto-select-group option, in order to select the minimum valid group ID. # # plain[passwd=/etc/ocserv/ocpasswd,otp=/etc/ocserv/users.otp] @@ -24,18 +24,20 @@ # entries of the following format. # "username:groupname1,groupname2:encoded-password" # One entry must be listed per line, and 'ocpasswd' should be used -# to generate password entries. The 'otp' suboption allows to specify +# to generate password entries. The 'otp' suboption allows one to specify # an oath password file to be used for one time passwords; the format of -# the file is described in https://code.google.com/p/mod-authn-otp/wiki/UsersFile +# the file is described in https://github.com/archiecobbs/mod-authn-otp/wiki/UsersFile # -# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name,override-interim-updates=false]: +# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name]: # The radius option requires specifying freeradius-client configuration -# file. If the groupconfig option is set, then config-per-user will be overriden, -# and all configuration will be read from radius. The 'override-interim-updates' if set to -# true will ignore Acct-Interim-Interval from the server and 'stats-report-time' will be considered. +# file. If the groupconfig option is set, then config-per-user/group will be overridden, +# and all configuration will be read from radius. That also includes the +# Acct-Interim-Interval, and Session-Timeout values. +# +# See doc/README-radius.md for the supported radius configuration atributes. # # gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900] -# The gssapi option allows to use authentication methods supported by GSSAPI, +# The gssapi option allows one to use authentication methods supported by GSSAPI, # such as Kerberos tickets with ocserv. It should be best used as an alternative # to PAM (i.e., have pam in auth and gssapi in enable-auth), to allow users with # tickets and without tickets to login. The default value for require-local-user-map @@ -79,6 +81,10 @@ auth = "pam" # reconnects. #listen-host-is-dyndns = true +# Use udp-listen-host to limit udp to specific IPs or to the IPs of a provided +# hostname. if not set, listen-host will be used +#udp-listen-host = [IP|HOSTNAME] + # TCP and UDP port number tcp-port = 443 udp-port = 443 @@ -106,6 +112,50 @@ socket-file = ocserv.sock # The default server directory. Does not require any devices present. chroot-dir = /var/lib/ocserv +# The key and the certificates of the server +# The key may be a file, or any URL supported by GnuTLS (e.g., +# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user +# or pkcs11:object=my-vpn-key;object-type=private) +# +# The server-cert file may contain a single certificate, or +# a sorted certificate chain. +# There may be multiple server-cert and server-key directives, +# but each key should correspond to the preceding certificate. +# The certificate files will be reloaded when changed allowing for in-place +# certificate renewal (they are checked and reloaded periodically; +# a SIGHUP signal to main server will force reload). + +server-cert = /etc/pki/ocserv/public/server.crt +server-key = /etc/pki/ocserv/private/server.key + +# Diffie-Hellman parameters. Only needed if for old (pre 3.6.0 +# versions of GnuTLS for supporting DHE ciphersuites. +# Can be generated using: +# certtool --generate-dh-params --outfile /etc/ocserv/dh.pem +#dh-params = /etc/ocserv/dh.pem + +# In case PKCS #11, TPM or encrypted keys are used the PINs should be available +# in files. The srk-pin-file is applicable to TPM keys only, and is the +# storage root key. +#pin-file = /etc/ocserv/pin.txt +#srk-pin-file = /etc/ocserv/srkpin.txt + +# The password or PIN needed to unlock the key in server-key file. +# Only needed if the file is encrypted or a PKCS #11 object. This +# is an alternative method to pin-file. +#key-pin = 1234 + +# The SRK PIN for TPM. +# This is an alternative method to srk-pin-file. +#srk-pin = 1234 + +# The Certificate Authority that will be used to verify +# client certificates (public keys) if certificate authentication +# is set. +#ca-cert = /etc/ocserv/ca.pem + + + ### All configuration options below this line are reloaded on a SIGHUP. ### The options above, will remain unchanged. Note however, that the @@ -137,6 +187,14 @@ max-clients = 16 # multiple times). Unset or set to zero for unlimited. max-same-clients = 2 +# When the server receives connections from a proxy, like haproxy +# which supports the proxy protocol, set this to obtain the correct +# client addresses. The proxy protocol would then be expected in +# the TCP or UNIX socket (not the UDP one). Although both v1 +# and v2 versions of proxy protocol are supported, the v2 version +# is recommended as it is more efficient in parsing. +#listen-proxy-proto = true + # Limit the number of client connections to one every X milliseconds # (X is the provided value). Set to zero for no limit. #rate-limit-ms = 100 @@ -147,6 +205,12 @@ max-same-clients = 2 # radius is in use. #stats-report-time = 360 +# Stats reset time. The period of time statistics kept by main/sec-mod +# processes will be reset. These are the statistics shown by cmd +# 'occtl show stats'. For daily: 86400, weekly: 604800 +# This is unrelated to stats-report-time. +server-stats-reset-time = 604800 + # Keepalive in seconds keepalive = 32400 @@ -161,7 +225,7 @@ dpd = 90 # be higher to prevent such clients being awaken too # often by the DPD messages, and save battery. # The mobile clients are distinguished from the header -# 'X-AnyConnect-Identifier-DeviceType'. +# 'X-AnyConnect-Identifier-Platform'. mobile-dpd = 1800 # If using DTLS, and no UDP traffic is received for this @@ -175,29 +239,6 @@ switch-to-tcp-timeout = 25 # MTU discovery (DPD must be enabled) try-mtu-discovery = false -# The key and the certificates of the server -# The key may be a file, or any URL supported by GnuTLS (e.g., -# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user -# or pkcs11:object=my-vpn-key;object-type=private) -# -# The server-cert file may contain a single certificate, or -# a sorted certificate chain. -# -# There may be multiple server-cert and server-key directives, -# but each key should correspond to the preceding certificate. -# The certificate files will be reloaded when changed allowing for in-place -# certificate renewal (they are checked and reloaded periodically; -# a SIGHUP signal to main server will force reload). - -server-cert = /etc/pki/ocserv/public/server.crt -server-key = /etc/pki/ocserv/private/server.key - -# Diffie-Hellman parameters. Only needed if you require support -# for the DHE ciphersuites (by default this server supports ECDHE). -# Can be generated using: -# certtool --generate-dh-params --outfile /path/to/dh.pem -#dh-params = /path/to/dh.pem - # If you have a certificate from a CA that provides an OCSP # service you may provide a fresh OCSP status response within # the TLS handshake. That will prevent the client from connecting @@ -205,37 +246,18 @@ server-key = /etc/pki/ocserv/private/server.key # You can update this response periodically using: # ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response # Make sure that you replace the following file in an atomic way. -#ocsp-response = /path/to/ocsp.der - -# In case PKCS #11, TPM or encrypted keys are used the PINs should be available -# in files. The srk-pin-file is applicable to TPM keys only, and is the -# storage root key. -#pin-file = /path/to/pin.txt -#srk-pin-file = /path/to/srkpin.txt - -# The password or PIN needed to unlock the key in server-key file. -# Only needed if the file is encrypted or a PKCS #11 object. This -# is an alternative method to pin-file. -#key-pin = 1234 - -# The SRK PIN for TPM. -# This is an alternative method to srk-pin-file. -#srk-pin = 1234 - -# The Certificate Authority that will be used to verify -# client certificates (public keys) if certificate authentication -# is set. -ca-cert = /etc/pki/ocserv/cacerts/ca.crt +#ocsp-response = /etc/ocserv/ocsp.der # The object identifier that will be used to read the user ID in the client # certificate. The object identifier should be part of the certificate's DN # Useful OIDs are: -# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1 +# CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1, SAN(rfc822name) cert-user-oid = 0.9.2342.19200300.100.1.1 # The object identifier that will be used to read the user group in the -# client certificate. The object identifier should be part of the certificate's -# DN. Useful OIDs are: +# client certificate. The object identifier should be part of the certificate's +# DN. If the user may belong to multiple groups, then use multiple such fields +# in the certificate's DN. Useful OIDs are: # OU (organizational unit) = 2.5.4.11 #cert-group-oid = 2.5.4.11 @@ -243,7 +265,7 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # See the manual to generate an empty CRL initially. The CRL will be reloaded # periodically when ocserv detects a change in the file. To force a reload use # SIGHUP. -#crl = /path/to/crl.pem +#crl = /etc/ocserv/crl.pem # Uncomment this to enable compression negotiation (LZS, LZ4). #compression = true @@ -268,14 +290,9 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients) # in your system. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0" -tls-priorities = "@SYSTEM" - -# More combinations in priority strings are available, check -# http://gnutls.org/manual/html_node/Priority-Strings.html -# E.g., the string below enforces perfect forward secrecy (PFS) -# on the main channel. -#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128" +# Note that in Fedora gnutls follows crypto policies so insecure options +# are disabled within it. +tls-priorities = "NORMAL:%SERVER_PRECEDENCE" # That option requires the established DTLS channel to use the same # cipher as the primary TLS channel. This cannot be combined with @@ -294,7 +311,9 @@ auth-timeout = 240 #idle-timeout = 1200 # The time (in seconds) that a client is allowed to stay connected -# Unset to disable. +# Unset to disable. When set a client will be disconnected after being +# continuously connected for this amount of time, and its cookies will +# be invalidated (i.e., re-authentication will be required). #session-timeout = 86400 # The time (in seconds) that a mobile client is allowed to stay idle (no @@ -316,10 +335,10 @@ min-reauth-time = 300 # locally from an HTTP server (i.e., when listen-clear-file is used). # # Set to zero to disable. -max-ban-score = 50 +max-ban-score = 80 # The time (in seconds) that all score kept for a client is reset. -ban-reset-time = 300 +ban-reset-time = 1200 # In case you'd like to change the default points. #ban-points-wrong-password = 10 @@ -328,11 +347,11 @@ ban-reset-time = 300 # Cookie timeout (in seconds) # Once a client is authenticated he's provided a cookie with -# which he can reconnect. That cookie will be invalided if not -# used within this timeout value. On a user disconnection, that -# cookie will also be active for this time amount prior to be -# invalid. That should allow a reasonable amount of time for roaming -# between different networks. +# which he can reconnect. That cookie will be invalidated if not +# used within this timeout value. This cookie remains valid, during +# the user's connected time, and after user disconnection it +# remains active for this amount of time. That setting should allow a +# reasonable amount of time for roaming between different networks. cookie-timeout = 300 # If this is enabled (not recommended) the cookies will stay @@ -362,10 +381,9 @@ rekey-method = ssl # Script to call when a client connects and obtains an IP. # The following parameters are passed on the environment. -# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), -# DEVICE, IP_REAL (the real IP of the client), IP_REAL_LOCAL (the local -# interface IP the client connected), IP_LOCAL (the local IP -# in the P-t-P connection), IP_REMOTE (the VPN IP of the client), +# REASON, VHOST, USERNAME, GROUPNAME, DEVICE, IP_REAL (the real IP of the client), +# IP_REAL_LOCAL (the local interface IP the client connected), IP_LOCAL +# (the local IP in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # IPV6_LOCAL (the IPv6 local address if there are both IPv4 and IPv6 # assigned), IPV6_REMOTE (the IPv6 remote address), IPV6_PREFIX, and # ID (a unique numeric ID); REASON may be "connect" or "disconnect". @@ -373,7 +391,8 @@ rekey-method = ssl # client), OCSERV_NO_ROUTES, OCSERV_DNS (the DNS servers for this client), # will contain a space separated list of routes or DNS servers. A version # of these variables with the 4 or 6 suffix will contain only the IPv4 or -# IPv6 values. +# IPv6 values. The connect script must return zero as exit code, or the +# client connection will be refused. # The disconnect script will receive the additional values: STATS_BYTES_IN, # STATS_BYTES_OUT, STATS_DURATION that contain a 64-bit counter of the bytes @@ -391,7 +410,7 @@ rekey-method = ssl # or via a unix socket). use-occtl = true -# PID file. It can be overriden in the command line. +# PID file. It can be overridden in the command line. pid-file = /var/run/ocserv.pid # Set the protocol-defined priority (SO_PRIORITY) for packets to @@ -424,6 +443,9 @@ default-domain = example.com # these network values should contain a network with at least a single # address that will remain under the full control of ocserv (that is # to be able to assign the local part of the tun device address). +# Note that, you could use addresses from a subnet of your LAN network if you +# enable [proxy arp in the LAN interface](http://ocserv.gitlab.io/www/recipes-ocserv-pseudo-bridge.html); +# in that case it is recommended to set ping-leases to true. #ipv4-network = 192.168.1.0 #ipv4-netmask = 255.255.255.0 @@ -431,7 +453,7 @@ default-domain = example.com #ipv4-network = 192.168.1.0/24 # The IPv6 subnet that leases will be given from. -#ipv6-network = fda9:4efe:7e3b:03ea::/64 +#ipv6-network = fda9:4efe:7e3b:03ea::/48 # Specify the size of the network to provide to clients. It is # generally recommended to provide clients with a /64 network in @@ -462,8 +484,10 @@ default-domain = example.com # IP range for leases. ping-leases = false -# Use this option to enforce an MTU value to the incoming +# Use this option to set a link MTU value to the incoming # connections. Unset to use the default MTU of the TUN device. +# Note that the MTU is negotiated using the value set and the +# value sent by the peer. #mtu = 1420 # Unset to enable bandwidth restrictions (in bytes/sec). The @@ -487,11 +511,15 @@ ping-leases = false #route = 10.10.10.0/255.255.255.0 #route = 192.168.0.0/255.255.0.0 #route = fef4:db8:1000:1001::/64 +#route = default # Subsets of the routes above that will not be routed by # the server. -#no-route = 192.168.5.0/255.255.255.0 +no-route = 192.168.5.0/255.255.255.0 + +# Note the that following two firewalling options currently are available +# in Linux systems with iptables software. # If set, the script /usr/bin/ocserv-fw will be called to restrict # the user to its allowed routes and prevent him from accessing @@ -500,6 +528,15 @@ ping-leases = false # --removeall. This option can be set globally or in the per-user configuration. #restrict-user-to-routes = true +# This option implies restrict-user-to-routes set to true. If set, the +# script /usr/bin/ocserv-fw will be called to restrict the user to +# access specific ports in the network. This option can be set globally +# or in the per-user configuration. +#restrict-user-to-ports = "tcp(443), tcp(80), udp(443), sctp(99), tcp(583), icmp(), icmpv6()" + +# You could also use negation, i.e., block the user from accessing these ports only. +#restrict-user-to-ports = "!(tcp(443), tcp(80))" + # When set to true, all client's iroutes are made visible to all # connecting clients except for the ones offering them. This option # only makes sense if config-per-user is set. @@ -527,13 +564,18 @@ ping-leases = false # The options allowed in the configuration files are dns, nbns, # ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, no-route, # explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, -# user-profile, cgroup, stats-report-time, and session-timeout. +# keepalive, dpd, mobile-dpd, max-same-clients, tunnel-all-dns, +# restrict-user-to-routes, user-profile, cgroup, stats-report-time, +# mtu, idle-timeout, mobile-idle-timeout, restrict-user-to-ports, +# split-dns and session-timeout. # -# Note that the 'iroute' option allows to add routes on the server +# Note that the 'iroute' option allows one to add routes on the server # based on a user or group. The syntax depends on the input accepted # by the commands route-add-cmd and route-del-cmd (see below). The no-udp # is a boolean option (e.g., no-udp = true), and will prevent a UDP session -# for that specific user or group. +# for that specific user or group. The hostname option will set a +# hostname to override any proposed by the user. Note also, that, any +# routes, no-routes, DNS or NBNS servers present will overwrite the global ones. #config-per-user = /etc/ocserv/config-per-user/ #config-per-group = /etc/ocserv/config-per-group/ @@ -544,15 +586,15 @@ ping-leases = false #default-group-config = /etc/ocserv/defaults/group.conf # The system command to use to setup a route. %{R} will be replaced with the -# route/mask and %{D} with the (tun) device. +# route/mask, %{RI} with the route in CIDR format, and %{D} with the (tun) device. # -# The following example is from linux systems. %R should be something -# like 192.168.2.0/24 (the argument of iroute). +# The following example is from linux systems. %{R} should be something +# like 192.168.2.0/255.255.255.0 and %{RI} 192.168.2.0/24 (the argument of iroute). #route-add-cmd = "ip route add %{R} dev %{D}" #route-del-cmd = "ip route delete %{R} dev %{D}" -# This option allows to forward a proxy. The special keywords '%{U}' +# This option allows one to forward a proxy. The special keywords '%{U}' # and '%{G}', if present will be replaced by the username and group name. #proxy-url = http://example.com/ #proxy-url = http://example.com/%{U}/ @@ -562,14 +604,36 @@ ping-leases = false # KDC server. That is a translation URL between HTTP and Kerberos. # In MIT kerberos you'll need to add in realms: # EXAMPLE.COM = { -# kdc = https://ocserv.example.com/kerberos +# kdc = https://ocserv.example.com/KdcProxy # http_anchors = FILE:/etc/ocserv-ca.pem # } -# This option is available if ocserv is compiled with GSSAPI support. +# In some distributions the krb5-k5tls plugin of kinit is required. +# +# The following option is available in ocserv, when compiled with GSSAPI support. -#kkdcp = SERVER-PATH KERBEROS-REALM PROTOCOL@SERVER:PORT -#kkdcp = /kerberos EXAMPLE.COM udp@127.0.0.1:88 -#kkdcp = /kerberos-tcp EXAMPLE.COM tcp@127.0.0.1:88 +#kkdcp = "SERVER-PATH KERBEROS-REALM PROTOCOL@SERVER:PORT" +#kkdcp = "/KdcProxy KERBEROS.REALM udp@127.0.0.1:88" +#kkdcp = "/KdcProxy KERBEROS.REALM tcp@127.0.0.1:88" +#kkdcp = "/KdcProxy KERBEROS.REALM tcp@[::1]:88" + +# Client profile xml. This can be used to advertise alternative servers +# to the client. A minimal file can be: +# +# +# +# +# VPN Server name +# localhost +# +# +# +# +# Other fields may be used by some of the CISCO clients. +# This file must be accessible from inside the worker's chroot. +# Note that enabling this option is not recommended as it will allow +# the worker processes to open arbitrary files (when isolate-workers is +# set to true). +#user-profile = profile.xml # # The following options are for (experimental) AnyConnect client @@ -581,24 +645,19 @@ ping-leases = false # and openconnect clients < 7.08. When set to true, it implies dtls-legacy = true. cisco-client-compat = true -# This option allows to disable the DTLS-PSK negotiation (enabled by default). +# This option allows one to disable the DTLS-PSK negotiation (enabled by default). # The DTLS-PSK negotiation was introduced in ocserv 0.11.5 to deprecate # the pre-draft-DTLS negotiation inherited from AnyConnect. It allows the # DTLS channel to negotiate its ciphers and the DTLS protocol version. #dtls-psk = false -# This option allows to disable the legacy DTLS negotiation (enabled by default, +# This option allows one to disable the legacy DTLS negotiation (enabled by default, # but that may change in the future). # The legacy DTLS uses a pre-draft version of the DTLS protocol and was # from AnyConnect protocol. It has several limitations, that are addressed # by the dtls-psk protocol supported by openconnect 7.08+. dtls-legacy = true -# Client profile xml. A sample file exists in doc/profile.xml. -# It is required by some of the CISCO clients. -# This file must be accessible from inside the worker's chroot. -user-profile = profile.xml - #Advanced options # Option to allow sending arbitrary custom headers to the client after @@ -609,3 +668,23 @@ user-profile = profile.xml # and '%{G}', if present will be replaced by the username and group name. #custom-header = "X-My-Header: hi there" + + +## An example virtual host with different authentication methods serviced +## by this server. + +#[vhost:www.example.com] +#auth = "certificate" + +#ca-cert = /etc/ocserv/ca.pem + +# The certificate set here must include a 'dns_name' corresponding to +# the virtual host name. + +#server-cert = /etc/pki/ocserv/public/server.crt +#server-key = /etc/pki/ocserv/private/server.key + +#ipv4-network = 192.168.2.0 +#ipv4-netmask = 255.255.255.0 + +#cert-user-oid = 0.9.2342.19200300.100.1.1 diff --git a/ocserv.spec b/ocserv.spec index 117a2be..fe5bd2f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.6 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -104,7 +104,7 @@ BuildRequires: libseccomp-devel %endif %endif -%endif #use systemd +%endif # no rubygem in epel7 %if 0%{?fedora} From b4cf8ae0e0ad61e74797cd987e99f8c13310639d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 2 Jan 2020 12:54:02 +0100 Subject: [PATCH 123/195] updated configuration to mark profile as configuration --- ocserv.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index fe5bd2f..52ffb91 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.6 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -230,7 +230,7 @@ install -p -m 755 %{SOURCE8} %{buildroot}/%{_sbindir} mkdir -p %{buildroot}/%{_bindir} install -p -m 755 %{SOURCE9} %{buildroot}/%{_bindir} -%if 0%{?rhel} +%if 0%{?rhel} && 0%{?rhel} <= 7 sed -i 's|expiration_days=-1|expiration_days=9999|' %{buildroot}/%{_sbindir}/ocserv-genkey sed -i 's|tls-priorities = "@SYSTEM"|tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"|' %{buildroot}/%{_sysconfdir}/ocserv/ocserv.conf %if 0%{?rhel} <= 6 @@ -256,6 +256,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf %config(noreplace) %{_sysconfdir}/pam.d/ocserv +%config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml %doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT From f19405cd011bb3f9201ba8b96eb8baffa9ffa655 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jan 2020 19:52:52 +0000 Subject: [PATCH 124/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 52ffb91..740f4cc 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.12.6 -Release: 3%{?dist} +Release: 4%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Jan 29 2020 Fedora Release Engineering - 0.12.6-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Sat Dec 28 2019 Nikos Mavrogiannopoulos - 0.12.6-1 - Update to upstream 0.12.6 release From 1b15fbdbe8ce0ad8492d19f3b3fcf49dd7083dc9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 20 Mar 2020 14:27:23 +0100 Subject: [PATCH 125/195] Update to 1.0.0-1 - Update to upstream 1.0.0 release --- .gitignore | 11 +++++++++++ ocserv.spec | 7 +++++-- sources | 6 +++--- 3 files changed, 19 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 6270347..acefa7a 100644 --- a/.gitignore +++ b/.gitignore @@ -203,3 +203,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.6.tar.xz.sig /ocserv-0.12.6.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-1.0.0.tar.xz.sig +/ocserv-1.0.0.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 740f4cc..2cdba2e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.6 -Release: 4%{?dist} +Version: 1.0.0 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 +- Update to upstream 1.0.0 release + * Wed Jan 29 2020 Fedora Release Engineering - 0.12.6-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index 7ff8e74..d7ee406 100644 --- a/sources +++ b/sources @@ -5,7 +5,7 @@ SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e1 SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 +SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.6.tar.xz.sig) = 8791479c6f1e6e8c6fd7b6f08857c5e6c1fc81ebc9a11c55231a049c27e2ee9f0bf938ccf1b66fb704eafb26cda6c9595f54edffa265d732dd640e8123538313 -SHA512 (ocserv-0.12.6.tar.xz) = 4d254298dc897304b4676f28a21338c138196cbdb08170c6d536c8c6730fab307642dbf853f96e66335604cb68711262678d3d0be84e6768ec720b9a81ccf813 +SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd +SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 From 2ed4cf2e996cceb4aec0cbfcef3603f7b8256e66 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 9 Apr 2020 14:28:18 +0200 Subject: [PATCH 126/195] sources: removed unnecessary files --- sources | 9 --------- 1 file changed, 9 deletions(-) diff --git a/sources b/sources index d7ee406..b2918a0 100644 --- a/sources +++ b/sources @@ -1,11 +1,2 @@ -SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 -SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 -SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 -SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac -SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 -SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a -SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 From ad75870eb95717c3f745841e8ad2a2c1319f8a22 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 9 Apr 2020 23:12:59 +0200 Subject: [PATCH 127/195] Update to 1.0.1-1 - Update to upstream 1.0.1 release --- .gitignore | 11 +++++++++++ ocserv.spec | 5 ++++- sources | 13 +++++++++++-- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index acefa7a..7bde321 100644 --- a/.gitignore +++ b/.gitignore @@ -214,3 +214,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-1.0.0.tar.xz.sig /ocserv-1.0.0.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-1.0.1.tar.xz.sig +/ocserv-1.0.1.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 2cdba2e..0f85f1c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 1.0.0 +Version: 1.0.1 Release: 1%{?dist} %global _hardened_build 1 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 +- Update to upstream 1.0.1 release + * Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 - Update to upstream 1.0.0 release diff --git a/sources b/sources index b2918a0..4fe1ae5 100644 --- a/sources +++ b/sources @@ -1,2 +1,11 @@ -SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd -SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 +SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 +SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 +SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 +SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac +SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 +SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a +SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 +SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 +SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad +SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 +SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 From b41463a994418a2dd24b93e4112177aca9b8b6f3 Mon Sep 17 00:00:00 2001 From: Igor Raits Date: Wed, 15 Apr 2020 17:51:43 +0200 Subject: [PATCH 128/195] Rebuild for http-parser 2.9.4 Signed-off-by: Igor Raits --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 0f85f1c..2782492 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 1.0.1 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Apr 15 2020 Igor Raits - 1.0.1-2 +- Rebuild for http-parser 2.9.4 + * Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 - Update to upstream 1.0.1 release From 4a1f58542c385391a2fe0e40a19ca367905b22ad Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 1 May 2020 19:48:41 +0200 Subject: [PATCH 129/195] sources: removed unnecessary files Signed-off-by: Nikos Mavrogiannopoulos --- sources | 9 --------- 1 file changed, 9 deletions(-) diff --git a/sources b/sources index 4fe1ae5..8d6f956 100644 --- a/sources +++ b/sources @@ -1,11 +1,2 @@ -SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 -SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 -SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 -SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac -SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 -SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a -SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 From 67850255cf5499cf964875e1ee96c2cf7914ce0b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 6 May 2020 19:56:44 +0200 Subject: [PATCH 130/195] Requirements turned to recommendations This enables ocserv being used without these dependencies. --- ocserv.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 2782492..123b5fe 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -111,9 +111,9 @@ BuildRequires: libseccomp-devel BuildRequires: rubygem(ronn) %endif -Requires: gnutls-utils -Requires: iproute -Requires: pam +Recommends: gnutls-utils +Recommends: iproute +Recommends: pam Requires(pre): shadow-utils %if %{use_systemd} Requires(post): systemd From 8c0e03af5de5a5f2db52098fd9a0285a73b582ec Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 16 Jun 2020 19:46:48 +0200 Subject: [PATCH 131/195] updated to 1.1.0 --- .gitignore | 2 ++ ocserv.spec | 11 ++++++++--- sources | 4 ++-- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 7bde321..00721b2 100644 --- a/.gitignore +++ b/.gitignore @@ -225,3 +225,5 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-1.0.1.tar.xz.sig /ocserv-1.0.1.tar.xz +/ocserv-1.1.0.tar.xz +/ocserv-1.1.0.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 123b5fe..3eb5c60 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 1.0.1 -Release: 2%{?dist} +Version: 1.1.0 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -57,6 +57,7 @@ BuildRequires: gnutls-devel %endif BuildRequires: pam-devel BuildRequires: iproute +BuildRequires: openconnect %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel @@ -203,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} +make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change %if %{use_systemd} %post @@ -270,6 +271,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %{_bindir}/ocserv-fw %{_bindir}/ocserv-script %{_sbindir}/ocserv +%{_sbindir}/ocserv-worker %{_sbindir}/ocserv-genkey %{_localstatedir}/lib/ocserv/profile.xml %if %{use_systemd} @@ -279,6 +281,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 +- Update to upstream 1.1.0 release (introduces ocserv-worker) + * Wed Apr 15 2020 Igor Raits - 1.0.1-2 - Rebuild for http-parser 2.9.4 diff --git a/sources b/sources index 8d6f956..9db8d9c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 -SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 +SHA512 (ocserv-1.1.0.tar.xz) = 10a589ccf28bf9568e602fc26d9133c78a840205f1a777d62cb52b680221bdaa8c231c37a95587b3494437dafc649b40f71be05a4868646c48efb3d873615861 +SHA512 (ocserv-1.1.0.tar.xz.sig) = 29c4082fa34327663ce6bcd29102c2eba088d79049e6637fabd048c8310fa9ff27853f06ef696c19ef66c146ce9e6e455cecc0261676a6ed343de731142f2022 From babbac89f7dfa322f20cd76a45675a145e305374 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sun, 21 Jun 2020 21:06:36 +0200 Subject: [PATCH 132/195] Rebuilt for protobuf 3.12 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 3eb5c60..b3e1edb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 1.1.0 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -281,6 +281,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sun Jun 21 2020 Adrian Reber - 1.1.0-2 +- Rebuilt for protobuf 3.12 + * Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 - Update to upstream 1.1.0 release (introduces ocserv-worker) From 019fa4784fdfdd25cb03a721c3ab6abd60bbeb3d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 12:24:17 +0000 Subject: [PATCH 133/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index b3e1edb..dca7776 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 1.1.0 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -281,6 +281,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 1.1.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Sun Jun 21 2020 Adrian Reber - 1.1.0-2 - Rebuilt for protobuf 3.12 From 71f2d63baa1480f2d7cc87fb7e0cabfb0a1cfa82 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:37:59 +0200 Subject: [PATCH 134/195] updated to 1.1.1 --- .gitignore | 2 ++ ocserv.conf | 13 +++++++++---- ocserv.spec | 8 +++++--- sources | 4 ++-- 4 files changed, 18 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 00721b2..20cd616 100644 --- a/.gitignore +++ b/.gitignore @@ -227,3 +227,5 @@ /ocserv-1.0.1.tar.xz /ocserv-1.1.0.tar.xz /ocserv-1.1.0.tar.xz.sig +/ocserv-1.1.1.tar.xz +/ocserv-1.1.1.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 59d8e75..5daa176 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -176,9 +176,12 @@ server-key = /etc/pki/ocserv/private/server.key # information at: https://gitlab.com/ocserv/ocserv/issues isolate-workers = true -# A banner to be displayed on clients +# A banner to be displayed on clients after connection #banner = "Welcome" +# A banner to be displayed on clients before connection +#pre-login-banner = "Welcome" + # Limit the number of clients. Unset or set to zero for unlimited. #max-clients = 1024 max-clients = 16 @@ -195,9 +198,11 @@ max-same-clients = 2 # is recommended as it is more efficient in parsing. #listen-proxy-proto = true -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 +# Rate limit the number of incoming connections to one every X milliseconds +# (X is the provided value), as the secmod backlog grows. This +# makes the server more resilient (and prevents connection failures) on +# multiple concurrent connections. Set to zero for no limit. +rate-limit-ms = 100 # Stats report time. The number of seconds after which each # worker process will report its usage statistics (number of diff --git a/ocserv.spec b/ocserv.spec index dca7776..f3305db 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,5 @@ -# This spec file has been automatically updated -Version: 1.1.0 -Release: 3%{?dist} +Version: 1.1.1 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -281,6 +280,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 +- Update to upstream 1.1.1 release + * Tue Jul 28 2020 Fedora Release Engineering - 1.1.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index 9db8d9c..b716d8a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.0.tar.xz) = 10a589ccf28bf9568e602fc26d9133c78a840205f1a777d62cb52b680221bdaa8c231c37a95587b3494437dafc649b40f71be05a4868646c48efb3d873615861 -SHA512 (ocserv-1.1.0.tar.xz.sig) = 29c4082fa34327663ce6bcd29102c2eba088d79049e6637fabd048c8310fa9ff27853f06ef696c19ef66c146ce9e6e455cecc0261676a6ed343de731142f2022 +SHA512 (ocserv-1.1.1.tar.xz) = 1173416f0d32f9faf98e539c8e73316a50ac93b519d1ade19374a3df865d10d975e13ac53e0c5a5e77c80f3605d7a810287b18b85b798887d227389761b54220 +SHA512 (ocserv-1.1.1.tar.xz.sig) = 9fe0f3e2ea4daaf1d053c2cdc87d38dc8256feb11c16f93e7e677500457914a82e659901f77f6ec4ca175fceeec74e3f8d001412c969c18dcf486545bac83393 From ea091e0b7b5020168e953fe0ca25c2a5788d83fa Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:42:52 +0200 Subject: [PATCH 135/195] documented crypto policies change --- ocserv.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index f3305db..6c40b4e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -282,6 +282,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %changelog * Thu Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 - Update to upstream 1.1.1 release +- Set default priorities to NORMAL as using @SYSTEM is no longer necessary + to follow crypto policies. * Tue Jul 28 2020 Fedora Release Engineering - 1.1.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 745079e26b223152e834f5c55cab8f34b5524bf6 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:51:06 +0200 Subject: [PATCH 136/195] added resumption to XFAIL This test seems to be failing --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 6c40b4e..a88eea4 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -203,7 +203,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change +make check %{?_smp_mflags} XFAIL_TESTS="test-sighup-key-change resumption" %if %{use_systemd} %post From 52adc1c385d8e21f07f97cdb8c113131e168702e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:52:20 +0200 Subject: [PATCH 137/195] ensure gnutls-utils are installed when building This is needed for certain tests --- ocserv.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index a88eea4..c1e65c2 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -57,6 +57,7 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute BuildRequires: openconnect +BuildRequires: gnutls-utils %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel @@ -203,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} XFAIL_TESTS="test-sighup-key-change resumption" +make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change %if %{use_systemd} %post From df7d3b4c34672216c749880f3c05a46eafa52594 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 13:01:57 +0200 Subject: [PATCH 138/195] removed xfail tests; they no longer fail --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index c1e65c2..41715c1 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -204,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change +make check %{?_smp_mflags} %if %{use_systemd} %post From bd9a292f76f01f3cb582f5e22ac6344e0249fbae Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 13:51:50 +0200 Subject: [PATCH 139/195] make check: be verbose --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 41715c1..021a1fa 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -204,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} +make check %{?_smp_mflags} VERBOSE=1 %if %{use_systemd} %post From 184c39d298841228e48067a5f48adb5a9caf6d6f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 14:51:06 +0200 Subject: [PATCH 140/195] disable socket_wrapper on archs where it causes problems --- ocserv.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index 021a1fa..764219e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -92,7 +92,11 @@ BuildRequires: systemd BuildRequires: systemd-devel BuildRequires: liboath-devel BuildRequires: uid_wrapper +# Disable socket_wrapper on certain architectures because it +# introduces new syscalls that the worker cannot handle. +%ifnarch aarch64 %{ix86} %{arm} BuildRequires: socket_wrapper +%endif BuildRequires: gnupg2 %if 0%{?rhel} && 0%{?rhel} >= 7 From b6e52d29bccf07c6abe1cd124f0e81a2240e2e6d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 15:12:40 +0200 Subject: [PATCH 141/195] corrected bogus date --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 764219e..ef359eb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -285,7 +285,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog -* Thu Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 +* Mon Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 - Update to upstream 1.1.1 release - Set default priorities to NORMAL as using @SYSTEM is no longer necessary to follow crypto policies. From 5ee6ad0f36bab8db247295cf86ec98d9fd63fedc Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 24 Sep 2020 14:42:40 +0200 Subject: [PATCH 142/195] Rebuilt for protobuf 3.13 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ef359eb..16d62c8 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.1 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -285,6 +285,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Sep 24 2020 Adrian Reber - 1.1.1-2 +- Rebuilt for protobuf 3.13 + * Mon Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 - Update to upstream 1.1.1 release - Set default priorities to NORMAL as using @SYSTEM is no longer necessary From fc6fc1e94fafeade3768a9b25ccd49c262b55049 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 23 Oct 2020 15:00:03 +0200 Subject: [PATCH 143/195] do not treat TODO as document to install --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 16d62c8..4705016 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -263,7 +263,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/ocserv %config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml -%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* From 6326ab472dc5fb98fd8d627243180216c346dc2a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 29 Oct 2020 09:54:59 +0100 Subject: [PATCH 144/195] rebuild without pcllib --- ocserv.spec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 4705016..011ea59 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.1 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -67,7 +67,6 @@ BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel BuildRequires: gperf -BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: libev-devel %if %{use_http_parser} @@ -156,7 +155,6 @@ rm -rf src/protobuf/protobuf-c/ touch src/*.proto %endif rm -rf src/ccan/talloc -rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: @@ -179,6 +177,7 @@ autoreconf -fvi %endif %configure \ + --without-pcl-lib \ %if %{use_systemd} --enable-systemd \ %else @@ -285,6 +284,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Oct 29 2020 Nikos Mavrogiannopoulos - 1.1.1-3 +- Rebuilt without pcllib dependency + * Thu Sep 24 2020 Adrian Reber - 1.1.1-2 - Rebuilt for protobuf 3.13 From 361405c03bd3ce6a4ce282a1861777c94c011828 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 29 Oct 2020 13:20:03 +0100 Subject: [PATCH 145/195] Compile with new glibc --- ocserv-1.1.1-socketwrapper.patch | 19 +++++++++++++++++++ ocserv.spec | 5 ++++- 2 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 ocserv-1.1.1-socketwrapper.patch diff --git a/ocserv-1.1.1-socketwrapper.patch b/ocserv-1.1.1-socketwrapper.patch new file mode 100644 index 0000000..9f8b3c9 --- /dev/null +++ b/ocserv-1.1.1-socketwrapper.patch @@ -0,0 +1,19 @@ +diff --git a/src/worker-privs.c b/src/worker-privs.c +index ea503cd0..3d4d5fa4 100644 +--- a/src/worker-privs.c ++++ b/src/worker-privs.c +@@ -166,6 +166,14 @@ int disable_system_calls(struct worker_st *ws) + ADD_SYSCALL(fstat, 0); + ADD_SYSCALL(lseek, 0); + ++ /* if running under socketwrapper ensure we allow its calls */ ++ if (getenv("SOCKET_WRAPPER_DIR") != NULL) { ++ ADD_SYSCALL(stat64, 0); ++ ADD_SYSCALL(readlink, 0); ++ ADD_SYSCALL(newfstatat, 0); ++ ADD_SYSCALL(mmap, 0); ++ } ++ + ADD_SYSCALL(getsockopt, 0); + ADD_SYSCALL(setsockopt, 0); + diff --git a/ocserv.spec b/ocserv.spec index 011ea59..cf635cf 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -44,6 +44,7 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +Patch0: ocserv-1.1.1-socketwrapper.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -177,6 +178,7 @@ autoreconf -fvi %endif %configure \ + --with-seccomp-trap \ --without-pcl-lib \ %if %{use_systemd} --enable-systemd \ @@ -285,7 +287,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %changelog * Thu Oct 29 2020 Nikos Mavrogiannopoulos - 1.1.1-3 -- Rebuilt without pcllib dependency +- Rebuild without pcllib dependency +- Enhanced seccomp filters for tests to run in all architectures * Thu Sep 24 2020 Adrian Reber - 1.1.1-2 - Rebuilt for protobuf 3.13 From 26ab9a4fb3d7607f4bc5c835218d4cae646d7b4b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 30 Oct 2020 09:04:58 +0100 Subject: [PATCH 146/195] spec: removed seccomp-trap debugging option --- ocserv.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index cf635cf..3cabcd6 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -178,7 +178,6 @@ autoreconf -fvi %endif %configure \ - --with-seccomp-trap \ --without-pcl-lib \ %if %{use_systemd} --enable-systemd \ From f4653b53904de7c2805ab5719c19e847ecab8136 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 11 Nov 2020 23:18:03 +0100 Subject: [PATCH 147/195] rebuilt for new radcli --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 3cabcd6..c94ee9e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.1 -Release: 3%{?dist} +Release: 4%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -285,6 +285,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Nov 11 2020 Nikos Mavrogiannopoulos - 1.1.1-4 +- Rebuilt for radcli 1.3.0 + * Thu Oct 29 2020 Nikos Mavrogiannopoulos - 1.1.1-3 - Rebuild without pcllib dependency - Enhanced seccomp filters for tests to run in all architectures From 1400361cdd7e280622568f2d1fd4a40c90f6ebb3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 23 Nov 2020 12:05:38 +0100 Subject: [PATCH 148/195] Rebuilt for ronn successor --- ocserv.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index c94ee9e..e7178a9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.1 -Release: 4%{?dist} +Release: 5%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -113,7 +113,7 @@ BuildRequires: libseccomp-devel # no rubygem in epel7 %if 0%{?fedora} -BuildRequires: rubygem(ronn) +BuildRequires: rubygem-ronn-ng %endif Recommends: gnutls-utils @@ -285,6 +285,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Mon Nov 23 2020 Nikos Mavrogiannopoulos - 1.1.1-5 +- Rebuilt for ronn successor + * Wed Nov 11 2020 Nikos Mavrogiannopoulos - 1.1.1-4 - Rebuilt for radcli 1.3.0 From e9d48e920a2233ac3640faa91d5afc25da24dda0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sun, 6 Dec 2020 14:11:06 +0100 Subject: [PATCH 149/195] Update to upstream 1.1.2 release --- .gitignore | 2 ++ ocserv-1.1.1-socketwrapper.patch | 19 ------------------- ocserv.conf | 6 ------ ocserv.spec | 8 +++++--- sources | 4 ++-- 5 files changed, 9 insertions(+), 30 deletions(-) delete mode 100644 ocserv-1.1.1-socketwrapper.patch diff --git a/.gitignore b/.gitignore index 20cd616..48fba86 100644 --- a/.gitignore +++ b/.gitignore @@ -229,3 +229,5 @@ /ocserv-1.1.0.tar.xz.sig /ocserv-1.1.1.tar.xz /ocserv-1.1.1.tar.xz.sig +/ocserv-1.1.2.tar.xz +/ocserv-1.1.2.tar.xz.sig diff --git a/ocserv-1.1.1-socketwrapper.patch b/ocserv-1.1.1-socketwrapper.patch deleted file mode 100644 index 9f8b3c9..0000000 --- a/ocserv-1.1.1-socketwrapper.patch +++ /dev/null @@ -1,19 +0,0 @@ -diff --git a/src/worker-privs.c b/src/worker-privs.c -index ea503cd0..3d4d5fa4 100644 ---- a/src/worker-privs.c -+++ b/src/worker-privs.c -@@ -166,6 +166,14 @@ int disable_system_calls(struct worker_st *ws) - ADD_SYSCALL(fstat, 0); - ADD_SYSCALL(lseek, 0); - -+ /* if running under socketwrapper ensure we allow its calls */ -+ if (getenv("SOCKET_WRAPPER_DIR") != NULL) { -+ ADD_SYSCALL(stat64, 0); -+ ADD_SYSCALL(readlink, 0); -+ ADD_SYSCALL(newfstatat, 0); -+ ADD_SYSCALL(mmap, 0); -+ } -+ - ADD_SYSCALL(getsockopt, 0); - ADD_SYSCALL(setsockopt, 0); - diff --git a/ocserv.conf b/ocserv.conf index 5daa176..d5e0814 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -89,12 +89,6 @@ auth = "pam" tcp-port = 443 udp-port = 443 -# Accept connections using a socket file. It accepts HTTP -# connections (i.e., without SSL/TLS unlike its TCP counterpart), -# and uses it as the primary channel. That option cannot be -# combined with certificate authentication. -#listen-clear-file = /var/run/ocserv-conn.socket - # The user the worker processes will be run as. It should be # unique (no other services run as this user). run-as-user = ocserv diff --git a/ocserv.spec b/ocserv.spec index e7178a9..7b9ad2f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.1 -Release: 5%{?dist} +Version: 1.1.2 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -44,7 +44,6 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -Patch0: ocserv-1.1.1-socketwrapper.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -285,6 +284,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 +- Update to upstream 1.1.2 release + * Mon Nov 23 2020 Nikos Mavrogiannopoulos - 1.1.1-5 - Rebuilt for ronn successor diff --git a/sources b/sources index b716d8a..9c321dd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.1.tar.xz) = 1173416f0d32f9faf98e539c8e73316a50ac93b519d1ade19374a3df865d10d975e13ac53e0c5a5e77c80f3605d7a810287b18b85b798887d227389761b54220 -SHA512 (ocserv-1.1.1.tar.xz.sig) = 9fe0f3e2ea4daaf1d053c2cdc87d38dc8256feb11c16f93e7e677500457914a82e659901f77f6ec4ca175fceeec74e3f8d001412c969c18dcf486545bac83393 +SHA512 (ocserv-1.1.2.tar.xz) = 8a145ff729414482c10ab763ac891e21f588fb8f61265fb4e6e61684a9b48c5fcaaafaad1ddcaeaf4ffad85377be45c002b628b27d9a7d08f5b403668f62c3f0 +SHA512 (ocserv-1.1.2.tar.xz.sig) = 3de64d1b4812c836ce809dd31adbf0ba7f2b11f408bb279bdd64f915be7c70b6601f098281e219a986febd0f5ddabaa6eba2448a0b9baf0ae025187b06aec3ce From 4fa9fe0ca251d6b22057375ab23050d9373fc6f9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sun, 6 Dec 2020 19:57:21 +0100 Subject: [PATCH 150/195] skip patch that needs root --- ocserv-1.1.2-tests.patch | 42 ++++++++++++++++++++++++++++++++++++++++ ocserv.spec | 5 +++-- 2 files changed, 45 insertions(+), 2 deletions(-) create mode 100644 ocserv-1.1.2-tests.patch diff --git a/ocserv-1.1.2-tests.patch b/ocserv-1.1.2-tests.patch new file mode 100644 index 0000000..0927fa0 --- /dev/null +++ b/ocserv-1.1.2-tests.patch @@ -0,0 +1,42 @@ +From 8d3dc40a5f59be1c91236823b4b4f75adb2e8e7c Mon Sep 17 00:00:00 2001 +From: Nikos Mavrogiannopoulos +Date: Sun, 6 Dec 2020 19:55:03 +0100 +Subject: [PATCH] tests: drain-server-fail: make sure it runs only when root + +Signed-off-by: Nikos Mavrogiannopoulos +--- + tests/common.sh | 3 +++ + tests/drain-server-fail | 3 ++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tests/common.sh b/tests/common.sh +index cd9bc885..d574d2d0 100644 +--- a/tests/common.sh ++++ b/tests/common.sh +@@ -45,6 +45,9 @@ else + echo "Skipping test requiring ldpreload" + exit 77 + fi ++fi ++ ++if test "${NEED_SOCKET_WRAPPER}" = 1 || test "${NO_NEED_ROOT}" = 1;then + SOCKDIR="${srcdir}/tmp/sockwrap.$$.tmp" + mkdir -p $SOCKDIR + export SOCKET_WRAPPER_DIR=$SOCKDIR +diff --git a/tests/drain-server-fail b/tests/drain-server-fail +index 40a2ed01..d61106e6 100755 +--- a/tests/drain-server-fail ++++ b/tests/drain-server-fail +@@ -20,7 +20,8 @@ + SERV="${SERV:-../src/ocserv}" + OCCTL="${OCCTL:-../src/occtl/occtl}" + srcdir=${srcdir:-.} +-NO_NEED_ROOT=1 ++#we cannot use NO_NEED_ROOT here as occtl commands can only be issued by root ++NEED_SOCKET_WRAPPER=1 + PIDFILE=ocserv-pid.$$.tmp + OCCTL_SOCKET=./occtl-drain-$$.socket + +-- +2.28.0 + diff --git a/ocserv.spec b/ocserv.spec index 7b9ad2f..e0f8244 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -44,6 +44,7 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +Patch0: ocserv-1.1.2-tests.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -195,7 +196,7 @@ autoreconf -fvi --without-libwrap %endif -make #%{?_smp_mflags} +make %{?_smp_mflags} %pre getent group ocserv &>/dev/null || groupadd -r ocserv @@ -284,7 +285,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog -* Sat Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 +* Sun Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 - Update to upstream 1.1.2 release * Mon Nov 23 2020 Nikos Mavrogiannopoulos - 1.1.1-5 From 3a3280275f4f3aee6256e1e1244c7c10aeb6a68e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 9 Dec 2020 09:44:49 +0100 Subject: [PATCH 151/195] do not special case rhel8 for http-parser The development headers are now shipped. --- ocserv.spec | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index e0f8244..b634a1e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -18,12 +18,6 @@ Release: 1%{?dist} %define use_geoip 1 %endif -%if 0%{?rhel} && 0%{?rhel} == 8 -%define use_http_parser 0 -%else -%define use_http_parser 1 -%endif - %define use_local_protobuf 0 Name: ocserv @@ -70,9 +64,7 @@ BuildRequires: libtasn1-devel BuildRequires: gperf BuildRequires: libtalloc-devel BuildRequires: libev-devel -%if %{use_http_parser} BuildRequires: http-parser-devel -%endif %if %{use_libwrap} BuildRequires: tcp_wrappers-devel @@ -148,9 +140,7 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %autosetup -p1 -%if %{use_http_parser} rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h -%endif %if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ touch src/*.proto @@ -187,9 +177,6 @@ autoreconf -fvi %if %{use_local_protobuf} --without-protobuf \ %endif -%if ! %{use_http_parser} - --without-http-parser \ -%endif %if %{use_libwrap} --with-libwrap %else From e1cb96f264b5d747ae3f6569237d09cbfc8587a1 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 9 Jan 2021 03:24:47 +0000 Subject: [PATCH 152/195] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index b634a1e..a55c2cc 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -43,6 +43,7 @@ Patch0: ocserv-1.1.2-tests.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 +BuildRequires: make BuildRequires: gcc %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel From 65e0fa740890990db362c7e04830c452d95fa2fc Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 14 Jan 2021 08:31:27 +0100 Subject: [PATCH 153/195] Rebuilt for protobuf 3.14 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index a55c2cc..14877ad 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.2 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -273,6 +273,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 14 08:31:24 CET 2021 Adrian Reber - 1.1.2-2 +- Rebuilt for protobuf 3.14 + * Sun Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 - Update to upstream 1.1.2 release From 3d30df7cf7bd9c4341b28f88c5cd99c11d8291f9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 22:12:48 +0000 Subject: [PATCH 154/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 14877ad..295f5c5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.2 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -273,6 +273,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 1.1.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Thu Jan 14 08:31:24 CET 2021 Adrian Reber - 1.1.2-2 - Rebuilt for protobuf 3.14 From 6f808faf0edbba5590ae35bc2f75421dd18c246b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 2 Jun 2021 09:12:04 +0200 Subject: [PATCH 155/195] updated to 1.1.3 --- .gitignore | 2 ++ ocserv.spec | 8 +++++--- sources | 4 ++-- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 48fba86..9ab0623 100644 --- a/.gitignore +++ b/.gitignore @@ -231,3 +231,5 @@ /ocserv-1.1.1.tar.xz.sig /ocserv-1.1.2.tar.xz /ocserv-1.1.2.tar.xz.sig +/ocserv-1.1.3.tar.xz +/ocserv-1.1.3.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 295f5c5..5233256 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.2 -Release: 3%{?dist} +Version: 1.1.3 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -38,7 +38,6 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -Patch0: ocserv-1.1.2-tests.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -273,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Jun 2 2021 Nikos Mavrogiannopoulos - 1.1.3-1 +- Updated to latest release + * Tue Jan 26 2021 Fedora Release Engineering - 1.1.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index 9c321dd..6722d35 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.2.tar.xz) = 8a145ff729414482c10ab763ac891e21f588fb8f61265fb4e6e61684a9b48c5fcaaafaad1ddcaeaf4ffad85377be45c002b628b27d9a7d08f5b403668f62c3f0 -SHA512 (ocserv-1.1.2.tar.xz.sig) = 3de64d1b4812c836ce809dd31adbf0ba7f2b11f408bb279bdd64f915be7c70b6601f098281e219a986febd0f5ddabaa6eba2448a0b9baf0ae025187b06aec3ce +SHA512 (ocserv-1.1.3.tar.xz) = 1138bd530e41f215f75e967aa293e80504a0ffc3384184832910b7bf8dc2049a637c1d8bef0221b6abb3e6510e51fba3c45d43901c0d2e4c0f180e72c0804628 +SHA512 (ocserv-1.1.3.tar.xz.sig) = 90c9a0bc35ac970faeeef2e0c32c7f4104c1acecfdcf9d266a647102912e2bf575f2cab365ae0040a69ec857fb616cbfd829316dbfccff079e9cb3cfa4a4ffae From 86658a4f0a66f9e2753b64cfac886f8e03a2adff Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 2 Jun 2021 09:28:31 +0200 Subject: [PATCH 156/195] removed unused file --- ocserv-1.1.2-tests.patch | 42 ---------------------------------------- 1 file changed, 42 deletions(-) delete mode 100644 ocserv-1.1.2-tests.patch diff --git a/ocserv-1.1.2-tests.patch b/ocserv-1.1.2-tests.patch deleted file mode 100644 index 0927fa0..0000000 --- a/ocserv-1.1.2-tests.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 8d3dc40a5f59be1c91236823b4b4f75adb2e8e7c Mon Sep 17 00:00:00 2001 -From: Nikos Mavrogiannopoulos -Date: Sun, 6 Dec 2020 19:55:03 +0100 -Subject: [PATCH] tests: drain-server-fail: make sure it runs only when root - -Signed-off-by: Nikos Mavrogiannopoulos ---- - tests/common.sh | 3 +++ - tests/drain-server-fail | 3 ++- - 2 files changed, 5 insertions(+), 1 deletion(-) - -diff --git a/tests/common.sh b/tests/common.sh -index cd9bc885..d574d2d0 100644 ---- a/tests/common.sh -+++ b/tests/common.sh -@@ -45,6 +45,9 @@ else - echo "Skipping test requiring ldpreload" - exit 77 - fi -+fi -+ -+if test "${NEED_SOCKET_WRAPPER}" = 1 || test "${NO_NEED_ROOT}" = 1;then - SOCKDIR="${srcdir}/tmp/sockwrap.$$.tmp" - mkdir -p $SOCKDIR - export SOCKET_WRAPPER_DIR=$SOCKDIR -diff --git a/tests/drain-server-fail b/tests/drain-server-fail -index 40a2ed01..d61106e6 100755 ---- a/tests/drain-server-fail -+++ b/tests/drain-server-fail -@@ -20,7 +20,8 @@ - SERV="${SERV:-../src/ocserv}" - OCCTL="${OCCTL:-../src/occtl/occtl}" - srcdir=${srcdir:-.} --NO_NEED_ROOT=1 -+#we cannot use NO_NEED_ROOT here as occtl commands can only be issued by root -+NEED_SOCKET_WRAPPER=1 - PIDFILE=ocserv-pid.$$.tmp - OCCTL_SOCKET=./occtl-drain-$$.socket - --- -2.28.0 - From 1412a40612531c442c7ed0091f798b0b337e8aeb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 16:54:24 +0000 Subject: [PATCH 157/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 5233256..9485788 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.3 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Wed Jun 2 2021 Nikos Mavrogiannopoulos - 1.1.3-1 - Updated to latest release From 32af46b9e7464eb4ecc22f1c443be2d47e54aecb Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Tue, 26 Oct 2021 08:47:45 +0200 Subject: [PATCH 158/195] Rebuilt for protobuf 3.18.1 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 9485788..9a8f744 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.3 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Oct 26 2021 Adrian Reber - 1.1.3-3 +- Rebuilt for protobuf 3.18.1 + * Thu Jul 22 2021 Fedora Release Engineering - 1.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From ecf3bd2df8ce4501f87dbef44891e840aa82fcf1 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sat, 6 Nov 2021 12:59:42 +0100 Subject: [PATCH 159/195] Rebuilt for protobuf 3.19.0 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 9a8f744..faf0b14 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.3 -Release: 3%{?dist} +Release: 4%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat Nov 06 2021 Adrian Reber - 1.1.3-4 +- Rebuilt for protobuf 3.19.0 + * Tue Oct 26 2021 Adrian Reber - 1.1.3-3 - Rebuilt for protobuf 3.18.1 From 1230c3d17a52df568984a7936755970477cc46aa Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 13 Nov 2021 13:06:44 +0100 Subject: [PATCH 160/195] update to 1.1.4 --- .gitignore | 2 ++ ocserv.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9ab0623..ea83165 100644 --- a/.gitignore +++ b/.gitignore @@ -233,3 +233,5 @@ /ocserv-1.1.2.tar.xz.sig /ocserv-1.1.3.tar.xz /ocserv-1.1.3.tar.xz.sig +/ocserv-1.1.4.tar.xz +/ocserv-1.1.4.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index faf0b14..5feec6c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.3 -Release: 4%{?dist} +Version: 1.1.4 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat Nov 13 2021 Nikos Mavrogiannopoulos - 1.1.4-1 +- Update to upstream 1.1.4 release + * Sat Nov 06 2021 Adrian Reber - 1.1.3-4 - Rebuilt for protobuf 3.19.0 diff --git a/sources b/sources index 6722d35..c949381 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.3.tar.xz) = 1138bd530e41f215f75e967aa293e80504a0ffc3384184832910b7bf8dc2049a637c1d8bef0221b6abb3e6510e51fba3c45d43901c0d2e4c0f180e72c0804628 -SHA512 (ocserv-1.1.3.tar.xz.sig) = 90c9a0bc35ac970faeeef2e0c32c7f4104c1acecfdcf9d266a647102912e2bf575f2cab365ae0040a69ec857fb616cbfd829316dbfccff079e9cb3cfa4a4ffae +SHA512 (ocserv-1.1.4.tar.xz) = bbdbf8d4fbe0c2aa3cf03e2b049d42a73918cc0863fa3ad0db79905e7855c7cb875e46c1d817e8c9eb19632bb0ee8a097f45c168046d9442901b56a5fd2a69a8 +SHA512 (ocserv-1.1.4.tar.xz.sig) = 1ca7a2fdd56dc7e628f4331c77b9859c9867af3eeef058357b3c197106a93052b099c278bef495f622a00ce5527f69b3762e9f57001cf6ba9f7b3b219a3e1a0d From 7bbf4483784d3cfe559d6984c8bfab5a5885d3f6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 22:02:26 +0000 Subject: [PATCH 161/195] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 5feec6c..a55d67f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.4 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 1.1.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Sat Nov 13 2021 Nikos Mavrogiannopoulos - 1.1.4-1 - Update to upstream 1.1.4 release From 17e5b407a3f0f7f548df4bb45144612290f30fab Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 10 Feb 2022 16:04:44 +0100 Subject: [PATCH 162/195] Fixes for gnutls 3.7.3 and glibc new syscalls --- futex.patch | 12 ++++++++++++ gnutls-3.7.3.patch | 16 ++++++++++++++++ ocserv.spec | 8 +++++++- 3 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 futex.patch create mode 100644 gnutls-3.7.3.patch diff --git a/futex.patch b/futex.patch new file mode 100644 index 0000000..1eecad4 --- /dev/null +++ b/futex.patch @@ -0,0 +1,12 @@ +diff --git a/src/worker-privs.c b/src/worker-privs.c +index ae0b375d..0b285113 100644 +--- a/src/worker-privs.c ++++ b/src/worker-privs.c +@@ -128,6 +128,7 @@ int disable_system_calls(struct worker_st *ws) + ADD_SYSCALL(getrusage, 0); + ADD_SYSCALL(alarm, 0); + ADD_SYSCALL(getpid, 0); ++ ADD_SYSCALL(futex, 0); + + /* memory allocation - both are used by different platforms */ + ADD_SYSCALL(brk, 0); diff --git a/gnutls-3.7.3.patch b/gnutls-3.7.3.patch new file mode 100644 index 0000000..7e99e4e --- /dev/null +++ b/gnutls-3.7.3.patch @@ -0,0 +1,16 @@ +diff --git a/src/sec-mod.c b/src/sec-mod.c +index 03f78276..6492b68a 100644 +--- a/src/sec-mod.c ++++ b/src/sec-mod.c +@@ -834,7 +834,10 @@ static int load_keys(sec_mod_st *sec, unsigned force) + gnutls_privkey_import_x509_raw(p, &data, + GNUTLS_X509_FMT_PEM, + NULL, 0); +- if (ret == GNUTLS_E_DECRYPTION_FAILED && vhost->pins.pin[0]) { ++ /* GnuTLS 3.7.3 introduces a backwards incompatible change and ++ * GNUTLS_E_PKCS11_PIN_ERROR is returned when an encrypted ++ * file is loaded https://gitlab.com/gnutls/gnutls/-/issues/1321 */ ++ if ((ret == GNUTLS_E_DECRYPTION_FAILED || ret == GNUTLS_E_PKCS11_PIN_ERROR) && vhost->pins.pin[0]) { + ret = + gnutls_privkey_import_x509_raw(p, &data, + GNUTLS_X509_FMT_PEM, diff --git a/ocserv.spec b/ocserv.spec index a55d67f..025e5b5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.4 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -38,6 +38,8 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +Patch1: futex.patch +Patch2: gnutls-3.7.3.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -272,6 +274,10 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Feb 10 2022 Nikos Mavrogiannopoulos - 1.1.4-3 +- Update seccomp rules to allow the futex syscall +- Workaround incompatible API change in GnuTLS 3.7.3. + * Thu Jan 20 2022 Fedora Release Engineering - 1.1.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 6f808d421328e22b0ff4bcc1b8cab12ffc5fab2d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 17 Feb 2022 13:07:15 +0100 Subject: [PATCH 163/195] Updated to 1.1.6 --- .gitignore | 2 ++ futex.patch | 12 ------------ gnutls-3.7.3.patch | 16 ---------------- ocserv.spec | 9 +++++---- sources | 4 ++-- 5 files changed, 9 insertions(+), 34 deletions(-) delete mode 100644 futex.patch delete mode 100644 gnutls-3.7.3.patch diff --git a/.gitignore b/.gitignore index ea83165..d8812e1 100644 --- a/.gitignore +++ b/.gitignore @@ -235,3 +235,5 @@ /ocserv-1.1.3.tar.xz.sig /ocserv-1.1.4.tar.xz /ocserv-1.1.4.tar.xz.sig +/ocserv-1.1.6.tar.xz.sig +/ocserv-1.1.6.tar.xz diff --git a/futex.patch b/futex.patch deleted file mode 100644 index 1eecad4..0000000 --- a/futex.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/src/worker-privs.c b/src/worker-privs.c -index ae0b375d..0b285113 100644 ---- a/src/worker-privs.c -+++ b/src/worker-privs.c -@@ -128,6 +128,7 @@ int disable_system_calls(struct worker_st *ws) - ADD_SYSCALL(getrusage, 0); - ADD_SYSCALL(alarm, 0); - ADD_SYSCALL(getpid, 0); -+ ADD_SYSCALL(futex, 0); - - /* memory allocation - both are used by different platforms */ - ADD_SYSCALL(brk, 0); diff --git a/gnutls-3.7.3.patch b/gnutls-3.7.3.patch deleted file mode 100644 index 7e99e4e..0000000 --- a/gnutls-3.7.3.patch +++ /dev/null @@ -1,16 +0,0 @@ -diff --git a/src/sec-mod.c b/src/sec-mod.c -index 03f78276..6492b68a 100644 ---- a/src/sec-mod.c -+++ b/src/sec-mod.c -@@ -834,7 +834,10 @@ static int load_keys(sec_mod_st *sec, unsigned force) - gnutls_privkey_import_x509_raw(p, &data, - GNUTLS_X509_FMT_PEM, - NULL, 0); -- if (ret == GNUTLS_E_DECRYPTION_FAILED && vhost->pins.pin[0]) { -+ /* GnuTLS 3.7.3 introduces a backwards incompatible change and -+ * GNUTLS_E_PKCS11_PIN_ERROR is returned when an encrypted -+ * file is loaded https://gitlab.com/gnutls/gnutls/-/issues/1321 */ -+ if ((ret == GNUTLS_E_DECRYPTION_FAILED || ret == GNUTLS_E_PKCS11_PIN_ERROR) && vhost->pins.pin[0]) { - ret = - gnutls_privkey_import_x509_raw(p, &data, - GNUTLS_X509_FMT_PEM, diff --git a/ocserv.spec b/ocserv.spec index 025e5b5..f24d8a7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.4 -Release: 3%{?dist} +Version: 1.1.6 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -38,8 +38,6 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -Patch1: futex.patch -Patch2: gnutls-3.7.3.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -274,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Feb 17 2022 Nikos Mavrogiannopoulos - 1.1.6-1 +- Updated to 1.1.6 + * Thu Feb 10 2022 Nikos Mavrogiannopoulos - 1.1.4-3 - Update seccomp rules to allow the futex syscall - Workaround incompatible API change in GnuTLS 3.7.3. diff --git a/sources b/sources index c949381..bb03d35 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.4.tar.xz) = bbdbf8d4fbe0c2aa3cf03e2b049d42a73918cc0863fa3ad0db79905e7855c7cb875e46c1d817e8c9eb19632bb0ee8a097f45c168046d9442901b56a5fd2a69a8 -SHA512 (ocserv-1.1.4.tar.xz.sig) = 1ca7a2fdd56dc7e628f4331c77b9859c9867af3eeef058357b3c197106a93052b099c278bef495f622a00ce5527f69b3762e9f57001cf6ba9f7b3b219a3e1a0d +SHA512 (ocserv-1.1.6.tar.xz.sig) = 2a87768ad63d40053732fa011bbeb3532c9673296b9be299bf8f7d8dd3dd35571eee96c0b4fa9bf5a30633b4c844337ab3d562d6ea2b6ad8efca084eb5e6f502 +SHA512 (ocserv-1.1.6.tar.xz) = d1c5e5cf0e84aab168ed51516534df8b2968194dd1421f33563c61b3e47d5d79ebe9e6ffbf7cbcc9ff1242fae05151024f70ef586d063bec0b3eec00050bfdfa From a593faeb19068dcd6869922745b2b29e06c1d1cc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 22 Jul 2022 01:38:36 +0000 Subject: [PATCH 164/195] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index f24d8a7..f2dc5c0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.6 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Jul 22 2022 Fedora Release Engineering - 1.1.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Feb 17 2022 Nikos Mavrogiannopoulos - 1.1.6-1 - Updated to 1.1.6 From 1628aac0554d2478d7225750634a44512c12cc20 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 22:27:47 +0000 Subject: [PATCH 165/195] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index f2dc5c0..bb03199 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.6 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 1.1.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Fri Jul 22 2022 Fedora Release Engineering - 1.1.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 7bc9463df441ea599ab31cedea710d297744b54d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sun, 7 May 2023 14:32:21 +0200 Subject: [PATCH 166/195] updated to 1.1.7 --- .gitignore | 2 ++ ocserv.spec | 9 ++++++--- sources | 4 ++-- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index d8812e1..1435b3a 100644 --- a/.gitignore +++ b/.gitignore @@ -237,3 +237,5 @@ /ocserv-1.1.4.tar.xz.sig /ocserv-1.1.6.tar.xz.sig /ocserv-1.1.6.tar.xz +/ocserv-1.1.7.tar.xz +/ocserv-1.1.7.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index bb03199..adc065b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.6 -Release: 3%{?dist} +Version: 1.1.7 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -250,7 +250,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/ocserv %config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml -%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING COPYING README.md PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sun May 07 2023 Nikos Mavrogiannopoulos - 1.1.7-1 +- Updated to 1.1.7 + * Thu Jan 19 2023 Fedora Release Engineering - 1.1.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index bb03d35..30fa688 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.6.tar.xz.sig) = 2a87768ad63d40053732fa011bbeb3532c9673296b9be299bf8f7d8dd3dd35571eee96c0b4fa9bf5a30633b4c844337ab3d562d6ea2b6ad8efca084eb5e6f502 -SHA512 (ocserv-1.1.6.tar.xz) = d1c5e5cf0e84aab168ed51516534df8b2968194dd1421f33563c61b3e47d5d79ebe9e6ffbf7cbcc9ff1242fae05151024f70ef586d063bec0b3eec00050bfdfa +SHA512 (ocserv-1.1.7.tar.xz) = 5b6182b98c0406a27dae7121ec0d8771b158e0d8ce2056bd35451c8ed087a8b7f7d40035f9db5c19aa9a9a3b2c6b07be8f0bad4b6b96569584815a5358202ba4 +SHA512 (ocserv-1.1.7.tar.xz.sig) = 96d2562fdf918f2b6ea829d747330a3be2e015ab25897e01bd0d387cb69ef3592aacabbeec9612e95eca1fbce6178a176dbf76d553b7626c09d453d216ddd63d From 8536d0e5f064fb8fee9098ca18172f39f4f300e9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 22 Jun 2023 12:27:36 +0200 Subject: [PATCH 167/195] Backported fixes for expired certificates --- expired-certs.patch | 2308 +++++++++++++++++++++++++++++++++++++++++++ ocserv.spec | 9 +- 2 files changed, 2316 insertions(+), 1 deletion(-) create mode 100644 expired-certs.patch diff --git a/expired-certs.patch b/expired-certs.patch new file mode 100644 index 0000000..443bd7b --- /dev/null +++ b/expired-certs.patch @@ -0,0 +1,2308 @@ +diff --git a/tests/Makefile.am b/tests/Makefile.am +index d965eae..ecc417c 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -44,7 +44,8 @@ EXTRA_DIST = certs/ca-key.pem certs/ca.pem ns.sh common.sh certs/server-cert.pem + data/disconnect-user2.config data/ping-leases.config data/haproxy-proxyproto.config \ + data/haproxy-proxyproto.cfg scripts/proxy-connectscript data/haproxy-proxyproto-v1.config \ + data/haproxy-proxyproto-v1.cfg scripts/proxy-connectscript-v1 data/test-multiple-client-ip.config \ +- data/test-client-bypass-protocol.config asan.supp ++ data/test-client-bypass-protocol.config asan.supp certs/ca.tmpl certs/server-cert.tmpl \ ++ certs/user-cert.tmpl + + xfail_scripts = + dist_check_SCRIPTS = ocpasswd-test +@@ -176,6 +177,25 @@ gen_oidc_test_data_CPPFLAGS = $(AM_CPPFLAGS) + gen_oidc_test_data_SOURCES = generate_oidc_test_data.c + gen_oidc_test_data_LDADD = $(LDADD) $(CJOSE_LIBS) $(JANSSON_LIBS) + ++certs/ca.pem: certs/ca-key.pem certs/ca.tmpl ++ certtool --generate-self-signed --template certs/ca.tmpl --load-privkey certs/ca-key.pem --outfile certs/ca.pem ++ ++certs/server-cert-ca.pem: certs/ca.pem certs/server-cert.pem ++ cat certs/server-cert.pem certs/ca.pem > certs/server-cert-ca.pem ++ ++certs/server-cert.pem: certs/server-cert.tmpl certs/ca.pem certs/server-key.pem certs/ca-key.pem ++ certtool --generate-certificate --template certs/server-cert.tmpl --load-privkey certs/server-key.pem --load-ca-certificate certs/ca.pem --load-ca-privkey certs/ca-key.pem --outfile certs/server-cert.pem ++ ++certs/user-cert.pem: certs/user-cert.tmpl certs/ca.pem certs/user-key.pem certs/ca-key.pem ++ certtool --generate-certificate --template certs/user-cert.tmpl --load-privkey certs/user-key.pem --load-ca-certificate certs/ca.pem --load-ca-privkey certs/ca-key.pem --outfile certs/user-cert.pem ++ ++# make the user certificate invalid by signing it with another CA ++certs/user-cert-invalid.pem: certs/user-cert.tmpl ++ certtool --generate-privkey --outfile ca-key.tmp ++ certtool --generate-self-signed --template certs/ca.tmpl --load-privkey ca-key.tmp --outfile ca.tmp ++ certtool --generate-certificate --template certs/user-cert.tmpl --load-privkey certs/user-key.pem --load-ca-certificate ca.tmp --load-ca-privkey ca-key.tmp --outfile certs/user-cert-invalid.pem ++ rm -f ca-key.tmp ca.tmp ++ + if ENABLE_OIDC_AUTH_TESTS + check_PROGRAMS += gen_oidc_test_data + dist_check_SCRIPTS += test-oidc +diff --git a/tests/apple-ios b/tests/apple-ios +index 897d823..45b0cd3 100755 +--- a/tests/apple-ios ++++ b/tests/apple-ios +@@ -54,11 +54,11 @@ wait_server $PID + sleep 2 + + echo " * Connecting to obtain cookie... " +-( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null ) || ++( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null ) || + fail $PID "Could not receive cookie from server" + + echo " * Re-connect to force script run with platform... " +-echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 ++echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 + + sleep 5 + +@@ -87,7 +87,7 @@ fi + rm -f ${TMPFILE} + + echo " * Re-connecting to force script run with user agent... " +-echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose --useragent="Cisco AnyConnect VPN Agent for Apple" localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 ++echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose --useragent="Cisco AnyConnect VPN Agent for Apple" localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 + + sleep 5 + +@@ -114,7 +114,7 @@ fi + sleep 5 + echo " - Check server status" + +-( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo " - Killing server" +diff --git a/tests/banner b/tests/banner +index 44954e2..08f8f19 100755 +--- a/tests/banner ++++ b/tests/banner +@@ -50,7 +50,7 @@ wait_server $PID + sleep 3 + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >${TMPFILE} 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >${TMPFILE} 2>&1 ) || + fail $PID "Could not receive cookie from server" + + grep "${BANNER}" ${TMPFILE} >/dev/null +@@ -61,7 +61,7 @@ if test $? != 0;then + fi + + echo "Connecting to obtain cookie with wrong password... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >${TMPFILE} 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >${TMPFILE} 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + grep "${BANNER}" ${TMPFILE} >/dev/null +diff --git a/tests/certs/ca-key.pem b/tests/certs/ca-key.pem +index 9bd0754..ee5599c 100644 +--- a/tests/certs/ca-key.pem ++++ b/tests/certs/ca-key.pem +@@ -31,25 +31,3 @@ y1hvTfWRAoGZALNT3AbF9EDnJmZlS30MWtBggw83UhszC8XN2tY30AsvsDOS6a0F + UVhyNvBTKo6lPqXqUsVxp16TKeeQKF+DuYuuNZN3pXXsHTiHkRMDCRVEqz7UnZEc + /Bq/Kh2aOkelkX2S27QzTZGL + -----END RSA PRIVATE KEY----- +------BEGIN CERTIFICATE----- +-MIIDtDCCAmygAwIBAgIETeC0yjANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDEw5H +-bnVUTFMgVGVzdCBDQTAeFw0xMTA1MjgwODM5MzlaFw0zODEwMTIwODM5NDBaMC8x +-LTArBgNVBAMTJEdudVRMUyBUZXN0IFNlcnZlciAoUlNBIGNlcnRpZmljYXRlKTCC +-AVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/HsqwfvTYvO1D +-hmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJl1U1F/Oh +-ckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq +-58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mB +-VAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03 +-U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b7eujbZ3L +-xTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUC +-AwEAAaOBjTCBijAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAT +-BgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBR2 +-B1hM6rUp9S2ABoyDSoINCeyT3jAfBgNVHSMEGDAWgBRNVrdqAFjxZ5L0pnVVG45T +-AQPvzzANBgkqhkiG9w0BAQsFAAOCATEAdNWmTsh5uIfngyhOWwm7pK2+vgUMY8nH +-gMoMFHt0yuxuImcUMXu3LRS1dZSoCJACBpTFGi/Dg2U0qvOHQcEmc3OwNqHB90R3 +-LG5jUSCtq/bYW7h/6Gd9KeWCgZczaHbQ9IPTjLH1dLswVPt+fXKB6Eh0ggSrGATE +-/wRZT/XgDCW8t4C+2+TmJ8ZEzvU87KAPQ9rUBS1+p3EUAR/FfMApApsEig1IZ+ZD +-5joaGBW7zh1H0B9mEKidRvD7yuRJyzAcvD25nT15NLW0QR3dEeXosLc720xxJl1h +-h8NJ7YOvn323mOjR9er4i4D6iJlXmJ8tvN9vakCankWvBzb7plFn2sfMQqICFpRc +-w075D8hdQxfpGffL2tEeKSgjyNHXS7x3dFhUpN3IQjUi2x4f2e/ZXg== +------END CERTIFICATE----- +diff --git a/tests/certs/ca.pem b/tests/certs/ca.pem +index c4058ee..02f0b76 100644 +--- a/tests/certs/ca.pem ++++ b/tests/certs/ca.pem +@@ -1,20 +1,20 @@ + -----BEGIN CERTIFICATE----- +-MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD +-EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw +-fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ +-l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW +-DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh +-zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt +-c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b +-7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep +-n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA +-MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC +-ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT +-z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP +-g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX +-ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk +-x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH +-yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg +-fJbi9Ui2FmXEeKkX34f1ONNj9Q== ++MIIDPDCCAfSgAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzAyMTMxNTMyMTJaGA85OTk5MTIzMTIzNTk1OVowDTELMAkGA1UEAxMC ++Q0EwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQC0ayeYJa/B/x7KsH70 ++2LztQ4ZnVF3atB7CkF+DPAIR/BNyhbKIpGVBC3ZfI76Kn/55S3M7LsdLPL8WyZdV ++NRfzoXJLMMLgJ5QS81YA5s6CSxFdpB6b+vq5GypNGLW6peYMx6iooW2qiITclg6y ++bBw1qufHlD351cfCog1Ls2569whfxQnNFZMa95jfKkxmiSTtH9AWY4FlpVg7oc0l ++YpuZgVQIFxjsfC8IojsoVzKdF0cKhvtisUGZ5vveqOogfvMb7rrqmiFkKZLyrXPl ++GQWdN1PiEZ8YXyK64osNAIyeL6eHPUC+SqKlkggMLmHAWHyameHWrIM5Jc8+G+3r ++o22dy8U43sHHbps0FL4wPoKQHrlKmnbk7zMMRqIxcvbDYQv4qmeJ9KXldjehKZ+A ++eap1AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMB0G ++A1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOCATEA ++foqPGdiyJYHih4J5YHwFPQxmkOzPHSa13K/q8sDvobE+HFTzrlTbAFC8bS38Bv2f ++9ZrPME4JvnsGdRGYwxS3LUmNdHHWR8LkvGXBE3u/TZsJfPtOR8JwdulQXpRw7hhL ++ew/mR5IEHZrUZgnnI4dg1kJhE1JPTvmtgqcE1CsikVQ14NvG/ehJbJyPgKTq/Zxm ++Ru4B5N+Jef/LaOqZvK4xK8x2ZaZ/L/ANou+7EY4DoWAkOEEoCU8DQHLAFgf6B7La ++oemLQGNHcBpba81jlS5EXXGJccOvfbw0MJTP3ZvyVIlEYu/X4roC7EJP/UkCZUJG ++f79Nc28q2/2D8tuFOqG7UbP7r2cWSa8OO3cI/V1W1k3iWZ63WltqDwFC0c8iqYFL ++9xKfQ96Q7wrYOCjmuaCLbw== + -----END CERTIFICATE----- +diff --git a/tests/certs/ca.tmpl b/tests/certs/ca.tmpl +new file mode 100644 +index 0000000..da5cc3f +--- /dev/null ++++ b/tests/certs/ca.tmpl +@@ -0,0 +1,6 @@ ++cn = CA ++ca ++cert_signing_key ++expiration_days = -1 ++activation_date = "2013-02-13 16:32:12" ++serial = 0x51d82ecc +diff --git a/tests/certs/server-cert-ca.pem b/tests/certs/server-cert-ca.pem +index 818101a..8ffaad3 100644 +--- a/tests/certs/server-cert-ca.pem ++++ b/tests/certs/server-cert-ca.pem +@@ -1,42 +1,42 @@ + -----BEGIN CERTIFICATE----- +-MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD +-Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs +-PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 +-u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd +-YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ +-IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 +-KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 +-7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU +-yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL +-gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg +-ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 +-UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s +-9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 +-GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C +-zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ +-eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF +-FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j +-LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM +-zzJKdNg= ++MIIDjjCCAkagAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJ ++bG9jYWxob3N0MIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEApzor7D8U ++sCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leAWOGW/O7QvQQVfl9/pTP4/LuR ++7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6zJlm4RYJFZTeX06qGNJZ3WCc ++dl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kapfe2AGUV3DKEF1Y20Zs1S2SFb ++pkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ROhb62gHMvniNIF0xpO+fSjT ++2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjpV3Ymf8ox4OfkSkOXbd3ZOe5Q ++CFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0uxLQdDQiDO4b4ct9kKyeWVMjZ ++3E0n+qjFaHnYHQIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ ++bG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIFoDAd ++BgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0UwqJ ++MThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAGQoUMiZVg6+Ibj8kyfq ++l/vfu4QxlUlqAbm/b9PVdOLrhz+T986HMFhL0b2HUGg5Mb0NZcgHjH4VLkei4AIb ++g/1nGdJ2I6EcLiQOvO4h2F3CoU6HkEGVEUXFaBd19tSDm7aM+2h7oPb3Vs3YT9QE ++x7ejmVeA+Qr9+H9xHyModpA1PkKRW31TOYtjUXHdHObT1uar++C1JLHn49ooKDZM ++5p9a4ExQVYd6WMRXKC83py1V4Ne5kBxC/l+3QkVZnMwByChySP7SEMa9yGv4KFM9 ++FT7XvxQsrkqPi5bCllUyGDrVeyTpyPDrb4BKgAu/Cy4tyDxLzBTZ5TXDH7E1IBps ++g1k5llFIyGdO5vQrX8vF61tqK5DBhgVvwu0k/m2lP9esLfaF7I5oGAbUKGhRr8mE ++xs8= + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- +-MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD +-EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw +-fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ +-l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW +-DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh +-zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt +-c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b +-7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep +-n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA +-MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC +-ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT +-z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP +-g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX +-ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk +-x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH +-yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg +-fJbi9Ui2FmXEeKkX34f1ONNj9Q== ++MIIDPDCCAfSgAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzAyMTMxNTMyMTJaGA85OTk5MTIzMTIzNTk1OVowDTELMAkGA1UEAxMC ++Q0EwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQC0ayeYJa/B/x7KsH70 ++2LztQ4ZnVF3atB7CkF+DPAIR/BNyhbKIpGVBC3ZfI76Kn/55S3M7LsdLPL8WyZdV ++NRfzoXJLMMLgJ5QS81YA5s6CSxFdpB6b+vq5GypNGLW6peYMx6iooW2qiITclg6y ++bBw1qufHlD351cfCog1Ls2569whfxQnNFZMa95jfKkxmiSTtH9AWY4FlpVg7oc0l ++YpuZgVQIFxjsfC8IojsoVzKdF0cKhvtisUGZ5vveqOogfvMb7rrqmiFkKZLyrXPl ++GQWdN1PiEZ8YXyK64osNAIyeL6eHPUC+SqKlkggMLmHAWHyameHWrIM5Jc8+G+3r ++o22dy8U43sHHbps0FL4wPoKQHrlKmnbk7zMMRqIxcvbDYQv4qmeJ9KXldjehKZ+A ++eap1AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMB0G ++A1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOCATEA ++foqPGdiyJYHih4J5YHwFPQxmkOzPHSa13K/q8sDvobE+HFTzrlTbAFC8bS38Bv2f ++9ZrPME4JvnsGdRGYwxS3LUmNdHHWR8LkvGXBE3u/TZsJfPtOR8JwdulQXpRw7hhL ++ew/mR5IEHZrUZgnnI4dg1kJhE1JPTvmtgqcE1CsikVQ14NvG/ehJbJyPgKTq/Zxm ++Ru4B5N+Jef/LaOqZvK4xK8x2ZaZ/L/ANou+7EY4DoWAkOEEoCU8DQHLAFgf6B7La ++oemLQGNHcBpba81jlS5EXXGJccOvfbw0MJTP3ZvyVIlEYu/X4roC7EJP/UkCZUJG ++f79Nc28q2/2D8tuFOqG7UbP7r2cWSa8OO3cI/V1W1k3iWZ63WltqDwFC0c8iqYFL ++9xKfQ96Q7wrYOCjmuaCLbw== + -----END CERTIFICATE----- +diff --git a/tests/certs/server-cert.pem b/tests/certs/server-cert.pem +index 4acde02..b304b47 100644 +--- a/tests/certs/server-cert.pem ++++ b/tests/certs/server-cert.pem +@@ -1,22 +1,22 @@ + -----BEGIN CERTIFICATE----- +-MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD +-Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs +-PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 +-u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd +-YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ +-IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 +-KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 +-7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU +-yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL +-gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg +-ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 +-UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s +-9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 +-GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C +-zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ +-eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF +-FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j +-LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM +-zzJKdNg= ++MIIDjjCCAkagAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJ ++bG9jYWxob3N0MIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEApzor7D8U ++sCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leAWOGW/O7QvQQVfl9/pTP4/LuR ++7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6zJlm4RYJFZTeX06qGNJZ3WCc ++dl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kapfe2AGUV3DKEF1Y20Zs1S2SFb ++pkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ROhb62gHMvniNIF0xpO+fSjT ++2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjpV3Ymf8ox4OfkSkOXbd3ZOe5Q ++CFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0uxLQdDQiDO4b4ct9kKyeWVMjZ ++3E0n+qjFaHnYHQIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ ++bG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIFoDAd ++BgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0UwqJ ++MThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAGQoUMiZVg6+Ibj8kyfq ++l/vfu4QxlUlqAbm/b9PVdOLrhz+T986HMFhL0b2HUGg5Mb0NZcgHjH4VLkei4AIb ++g/1nGdJ2I6EcLiQOvO4h2F3CoU6HkEGVEUXFaBd19tSDm7aM+2h7oPb3Vs3YT9QE ++x7ejmVeA+Qr9+H9xHyModpA1PkKRW31TOYtjUXHdHObT1uar++C1JLHn49ooKDZM ++5p9a4ExQVYd6WMRXKC83py1V4Ne5kBxC/l+3QkVZnMwByChySP7SEMa9yGv4KFM9 ++FT7XvxQsrkqPi5bCllUyGDrVeyTpyPDrb4BKgAu/Cy4tyDxLzBTZ5TXDH7E1IBps ++g1k5llFIyGdO5vQrX8vF61tqK5DBhgVvwu0k/m2lP9esLfaF7I5oGAbUKGhRr8mE ++xs8= + -----END CERTIFICATE----- +diff --git a/tests/certs/server-cert.tmpl b/tests/certs/server-cert.tmpl +new file mode 100644 +index 0000000..82e34ca +--- /dev/null ++++ b/tests/certs/server-cert.tmpl +@@ -0,0 +1,8 @@ ++cn = localhost ++dns_name = localhost ++tls_www_server ++signing_key ++encryption_key ++expiration_days = -1 ++activation_date = "2013-06-06 14:51:29" ++serial = 0x51d82ef0 +diff --git a/tests/certs/user-cert-invalid.pem b/tests/certs/user-cert-invalid.pem +index 0175bdf..4f5dd96 100644 +--- a/tests/certs/user-cert-invalid.pem ++++ b/tests/certs/user-cert-invalid.pem +@@ -1,107 +1,23 @@ +-X.509 Certificate Information: +- Version: 3 +- Serial Number (hex): 51d82f14 +- Issuer: CN=CA +- Validity: +- Not Before: Sat Jul 06 14:52:05 UTC 2013 +- Not After: Mon May 15 14:52:05 UTC 2023 +- Subject: CN=A user,UID=test +- Subject Public Key Algorithm: RSA +- Algorithm Security Level: Medium (2432 bits) +- Modulus (bits 2432): +- 00:ab:54:98:fc:a9:c6:15:95:9d:a6:c1:94:84:94:91 +- 79:1e:78:db:2d:48:51:99:65:01:02:c0:40:52:49:5d +- eb:70:bc:26:ef:68:39:1e:04:91:e2:db:cb:6f:93:40 +- 45:1e:22:8e:71:5a:58:89:28:79:5e:1a:32:25:3e:8b +- 9d:3b:34:7f:19:f8:d0:2f:37:b7:62:32:b7:53:a5:43 +- 2c:c5:5d:ec:ac:f9:35:fa:14:2b:34:66:f1:d6:a7:a1 +- d0:83:9a:56:f4:19:83:bc:bf:11:74:30:2d:a8:28:5b +- a2:ab:7a:c6:cd:9c:5c:f8:51:e9:a9:0c:48:db:71:bb +- b1:34:77:f7:ee:de:5d:78:c0:48:0a:37:0d:65:1e:3b +- 2b:14:03:89:72:f2:52:ed:5f:00:c5:06:60:ea:80:20 +- d0:43:ec:66:bc:d2:26:db:f0:29:3e:6a:f9:62:20:be +- 58:26:44:ba:d7:8c:6f:76:a6:05:20:e4:98:b7:c4:72 +- 7a:5d:df:4f:0d:23:ec:2e:9c:71:ec:30:f9:14:5f:c8 +- 75:0b:ab:67:f6:7d:fb:4d:76:64:4a:a5:d5:fa:b4:08 +- 50:9d:13:c7:8f:c2:79:b0:b4:3e:2f:89:d3:33:27:4d +- 9f:8b:d3:60:24:07:ab:b2:72:3d:29:a5:c4:4a:ec:3c +- 04:d2:49:3e:26:1b:ec:7a:10:3d:ca:45:5a:80:8b:4d +- 2a:96:63:4f:2d:63:28:0f:3b:47:47:ca:7c:2c:15:41 +- 32:d5:e0:c9:be:a5:55:2c:b3:6b:46:2a:56:b1:1b:ed +- 29 +- Exponent (bits 24): +- 01:00:01 +- Extensions: +- Basic Constraints (critical): +- Certificate Authority (CA): FALSE +- Key Purpose (not critical): +- TLS WWW Client. +- Key Usage (critical): +- Digital signature. +- Key encipherment. +- Subject Key Identifier (not critical): +- 8b01094b3b91ece321b91dec8d6b4c5d9e40805e +- Authority Key Identifier (not critical): +- 482334530a8931384a5aeacab6d2a6dece1d2b18 +- Signature Algorithm: RSA-SHA256 +- Signature: +- 6b:bd:e2:90:d7:11:cf:6c:0d:e3:bd:f4:61:cd:57:83 +- 41:be:2a:92:46:dd:fa:44:6c:60:1c:ef:3e:1e:2f:e1 +- e2:5b:45:88:6a:1e:50:2d:8d:96:c4:c7:80:75:59:7b +- 54:6b:fb:86:b0:f1:6d:45:09:db:48:de:20:0a:87:60 +- 30:5e:35:f0:52:c4:55:44:c1:ff:e1:7c:3d:d6:6d:58 +- ca:1c:fd:bf:04:9a:9b:10:35:05:fc:d1:01:3c:af:bb +- 64:31:5e:59:8f:ef:6f:0d:35:e5:c0:07:77:0e:31:20 +- 8e:e3:2e:f1:a6:4d:f1:be:85:5b:df:04:48:9d:8c:c9 +- c9:c1:b8:e3:e2:d2:4b:55:83:e9:d8:7b:71:2f:8e:89 +- fc:4d:a7:f1:b0:bf:47:9b:97:c4:85:dd:c3:3d:38:15 +- 36:08:73:10:87:08:f6:e6:1c:4e:29:a8:a5:f5:24:b8 +- 0d:e9:d9:b8:19:27:1d:73:35:fe:7b:81:1f:4a:81:6a +- 93:cd:a2:71:d7:60:0e:08:ee:ea:c8:2b:44:1b:e4:45 +- 6c:fe:44:68:d6:86:ad:89:4f:7e:9f:f9:1a:2a:97:0f +- 6b:eb:5d:6e:38:b3:5b:13:b9:e3:4a:10:32:5b:dc:a9 +- b4:a1:4e:b3:f9:4f:91:de:bc:cc:36:91:44:ba:e0:34 +- 74:f7:68:b4:7b:0e:db:4e:ec:28:03:01:cf:0a:63:c4 +- 23:75:0b:4b:41:9d:e0:68:b3:cb:bf:b5:5c:3d:52:93 +- 20:ba:ea:b8:f0:8c:f7:a6:ec:cd:a3:aa:4f:2a:ff:20 +-Other Information: +- SHA1 fingerprint: +- 5509a76b8738216938cdb3ec25048812737170de +- SHA256 fingerprint: +- c93e38ef35f1a9c485a27b161e708f2d45bf8768eb53a23fec841a8f35d6e478 +- Public Key ID: +- 8b01094b3b91ece321b91dec8d6b4c5d9e40805e +- Public key's random art: +- +--[ RSA 2432]----+ +- | o=o | +- |..oE.. | +- |.+=.o | +- |o.*.... | +- | * B +..S | +- |. * o oo . | +- | o . . . | +- | + | +- | . | +- +-----------------+ +- + -----BEGIN CERTIFICATE----- +-MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD +-EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF +-AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw +-vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF +-Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0 +-d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm +-RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd +-E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW +-Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB +-Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD +-VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4 +-SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveKQ1xHPbA3jvfRhzVeD +-Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg +-MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg +-juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV +-NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF +-bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0 +-dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g ++MIID2TCCAkGgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowJzEPMA0GA1UEAxMG ++QSB1c2VyMRQwEgYKCZImiZPyLGQBARMEdGVzdDCCAVIwDQYJKoZIhvcNAQEBBQAD ++ggE/ADCCAToCggExAKtUmPypxhWVnabBlISUkXkeeNstSFGZZQECwEBSSV3rcLwm ++72g5HgSR4tvLb5NARR4ijnFaWIkoeV4aMiU+i507NH8Z+NAvN7diMrdTpUMsxV3s ++rPk1+hQrNGbx1qeh0IOaVvQZg7y/EXQwLagoW6KresbNnFz4UempDEjbcbuxNHf3 ++7t5deMBICjcNZR47KxQDiXLyUu1fAMUGYOqAINBD7Ga80ibb8Ck+avliIL5YJkS6 ++14xvdqYFIOSYt8Ryel3fTw0j7C6cceww+RRfyHULq2f2fftNdmRKpdX6tAhQnRPH ++j8J5sLQ+L4nTMydNn4vTYCQHq7JyPSmlxErsPATSST4mG+x6ED3KRVqAi00qlmNP ++LWMoDztHR8p8LBVBMtXgyb6lVSyza0YqVrEb7SkCAwEAAaN1MHMwDAYDVR0TAQH/ ++BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0O ++BBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFAV+KcZC+G2nf/6V ++sElx119oZKWUMA0GCSqGSIb3DQEBCwUAA4IBgQCTOjwtK5sDPFdbWWlScDX9xfNf ++tnqRL22Id6VIRcAiuu6KVAYRNs3Pdv65H9orSaohrBRfWKEqAi51bhvDQvzhbw7u ++881txF+6s0fauArxAUai3e11eCil3gt0JOQVephmPKw6pVq9mMieho5I2SQ8CXoQ ++pSrselGaOTp8CK1r90pn8RGiJrZ3xJu5Yezb3AWCs3IOHhRT1Rc5mFnvs9VVR64h ++Pvlr9yBOf/pBEuylQr00plhsZdLra/nIspsGnOIiuM4eIliP6bQwE06u1LxlCbgB ++CAGTQ86vbO2xT1i8dZeq8TJ72OatmRboUBncaZNIT3rUTZxZYkYhkNtVTKnv/8qq ++LZI23qtcWLEAsc1O0Xva22wjkg5QE06AiWdcwK3f/Qpvj5yO9+PL7X4lP47n5D6m ++t1S6xisKgjo/IP9Wk3mPNaNDN3hZCaFRYEHn4CYrlXHqjg1w7quCKApYzrh5/L1Y ++b9U/qzwF7SatFovndYtf02bjcrHC/TA53IdiQPA= + -----END CERTIFICATE----- +diff --git a/tests/certs/user-cert.pem b/tests/certs/user-cert.pem +index ef5114c..32ab235 100644 +--- a/tests/certs/user-cert.pem ++++ b/tests/certs/user-cert.pem +@@ -1,21 +1,21 @@ + -----BEGIN CERTIFICATE----- +-MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD +-EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF +-AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw +-vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF +-Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0 +-d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm +-RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd +-E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW +-Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB +-Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD +-VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4 +-SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveOQ1xHPbA3jvfRhzVeD +-Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg +-MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg +-juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV +-NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF +-bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0 +-dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g ++MIIDiTCCAkGgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowJzEPMA0GA1UEAxMG ++QSB1c2VyMRQwEgYKCZImiZPyLGQBARMEdGVzdDCCAVIwDQYJKoZIhvcNAQEBBQAD ++ggE/ADCCAToCggExAKtUmPypxhWVnabBlISUkXkeeNstSFGZZQECwEBSSV3rcLwm ++72g5HgSR4tvLb5NARR4ijnFaWIkoeV4aMiU+i507NH8Z+NAvN7diMrdTpUMsxV3s ++rPk1+hQrNGbx1qeh0IOaVvQZg7y/EXQwLagoW6KresbNnFz4UempDEjbcbuxNHf3 ++7t5deMBICjcNZR47KxQDiXLyUu1fAMUGYOqAINBD7Ga80ibb8Ck+avliIL5YJkS6 ++14xvdqYFIOSYt8Ryel3fTw0j7C6cceww+RRfyHULq2f2fftNdmRKpdX6tAhQnRPH ++j8J5sLQ+L4nTMydNn4vTYCQHq7JyPSmlxErsPATSST4mG+x6ED3KRVqAi00qlmNP ++LWMoDztHR8p8LBVBMtXgyb6lVSyza0YqVrEb7SkCAwEAAaN1MHMwDAYDVR0TAQH/ ++BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0O ++BBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4Slrq ++yrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQAp51Ks5DDWVlLB6fMM2NJV80sX ++Rx6U1g6ovA7N5BDQiF6FYzVZECMH3d9nyZssHbkzb6qyO1m58P0cNkVurEH27+Z2 ++xdkNw5bbcvNDVhfVSjwa6nyTLfhf7vOTWaIxGGmffP72PIe87N6QmyCCGG0IXIkO ++kcTAE8IgX6k1mEr1Xy2ZtFVgKjPPLxsixIJ7TEktvJR1RqWQfbsOS8f13lvS1Vhh ++vc+UMbIQnz+jl4qNV/AX7GfpEYiBkbrgcjsggl/KMuwcauhEDdvfIQjcyRbQN36p ++KcVEXDpnG54sAfXAs9Z+adbvmu0ONAMCDuxKCT2eG1SGVrtiT5+7kCMso1eKz/5A ++r1XP0RgCKFExIRYb1elFpLc8wmJbN4qof2zisKG8UajFIHzIGateiu53enNn + -----END CERTIFICATE----- +diff --git a/tests/certs/user-cert.tmpl b/tests/certs/user-cert.tmpl +new file mode 100644 +index 0000000..6a60496 +--- /dev/null ++++ b/tests/certs/user-cert.tmpl +@@ -0,0 +1,7 @@ ++dn = "uid=test,cn=A user" ++tls_www_client ++signing_key ++encryption_key ++expiration_days = -1 ++activation_date = "2013-06-06 14:51:29" ++serial = 0x51d82f14 +diff --git a/tests/cipher-common.sh b/tests/cipher-common.sh +index fb9e2ac..07443a0 100755 +--- a/tests/cipher-common.sh ++++ b/tests/cipher-common.sh +@@ -91,14 +91,14 @@ fi + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ${CSTR} --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ${CSTR} --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ${CSTR} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ${CSTR} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/disconnect-user b/tests/disconnect-user +index 67a016e..bf4c7ab 100755 +--- a/tests/disconnect-user ++++ b/tests/disconnect-user +@@ -77,7 +77,7 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${TMPFILE} ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${TMPFILE} ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 +@@ -85,7 +85,7 @@ fi + + eval $(cat ${TMPFILE}) + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) ++( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -105,7 +105,7 @@ if test $? != 0;then + fi + + echo " * Re-connecting to obtain cookie after disconnect... " +-( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) ++( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) + if test $? = 0;then + echo "Succeeded using the cookie to connect" + exit 1 +diff --git a/tests/disconnect-user2 b/tests/disconnect-user2 +index ef8c3c1..e00cc67 100755 +--- a/tests/disconnect-user2 ++++ b/tests/disconnect-user2 +@@ -75,7 +75,7 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${TMPFILE} ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${TMPFILE} ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 +@@ -83,7 +83,7 @@ fi + + eval $(cat ${TMPFILE}) + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) ++( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -103,7 +103,7 @@ if test $? != 0;then + fi + + echo " * Re-connecting to obtain cookie after disconnect... " +-( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) ++( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) + if test $? = 0;then + echo "Succeeded using the cookie to connect" + exit 1 +diff --git a/tests/drain-server b/tests/drain-server +index be51cd4..808067f 100755 +--- a/tests/drain-server ++++ b/tests/drain-server +@@ -35,7 +35,7 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + if ! test -f ${PIDFILE};then +@@ -48,7 +48,7 @@ kill -15 $(cat $PIDFILE) + sleep 1 + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) && + fail $PID "Server is still listening" + + wait +diff --git a/tests/drain-server-fail b/tests/drain-server-fail +index d61106e..a2c495d 100755 +--- a/tests/drain-server-fail ++++ b/tests/drain-server-fail +@@ -48,7 +48,7 @@ launch_simple_sr_server -d 3 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + if ! test -f ${PIDFILE};then +diff --git a/tests/flowcontrol b/tests/flowcontrol +index fb60f67..7ef6b70 100755 +--- a/tests/flowcontrol ++++ b/tests/flowcontrol +@@ -37,39 +37,39 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with wrong password... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + echo "Connecting to obtain cookie with empty password... " +-( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + echo "Connecting to obtain cookie with wrong username... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + # test locked account + + echo "Connecting to obtain cookie with locked account... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + #test special characters + + echo "Connecting to obtain cookie with special password... " +-( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with empty password... " +-( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + #echo "Normal connection... " +-#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || ++#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || + # fail $PID "Could not connect to server" + + if ! test -f ${PIDFILE};then +diff --git a/tests/haproxy-auth b/tests/haproxy-auth +index b653714..5261860 100755 +--- a/tests/haproxy-auth ++++ b/tests/haproxy-auth +@@ -51,7 +51,7 @@ LD_PRELOAD=libsocket_wrapper.so:libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT + wait_server ${HAPID} + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + kill ${HAPID} + fail ${PID} "Could not receive cookie from server" +@@ -66,7 +66,7 @@ LD_PRELOAD=libsocket_wrapper.so:libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT + wait_server ${HAPID} + + echo "Re-connecting to obtain cookie after haproxy restart... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + kill ${HAPID} + fail ${PID} "Could not receive cookie from server" +diff --git a/tests/haproxy-connect b/tests/haproxy-connect +index c42b76c..662c08f 100755 +--- a/tests/haproxy-connect ++++ b/tests/haproxy-connect +@@ -91,14 +91,14 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -135,7 +135,7 @@ set +e + sleep 3 + + echo " * Re-connecting to obtain cookie after haproxy restart... " +-( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not receive cookie from server on reconnection" + exit 1 +diff --git a/tests/haproxy-proxyproto b/tests/haproxy-proxyproto +index 70c1390..54e413c 100755 +--- a/tests/haproxy-proxyproto ++++ b/tests/haproxy-proxyproto +@@ -94,14 +94,14 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/haproxy-proxyproto-v1 b/tests/haproxy-proxyproto-v1 +index d274575..f767581 100755 +--- a/tests/haproxy-proxyproto-v1 ++++ b/tests/haproxy-proxyproto-v1 +@@ -94,14 +94,14 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/ipv6-iface b/tests/ipv6-iface +index d5262e5..9b78d5e 100755 +--- a/tests/ipv6-iface ++++ b/tests/ipv6-iface +@@ -70,7 +70,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + wait_server $PID + + echo -n "Connecting to setup interface... " +-echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ++echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/ipv6-small-net b/tests/ipv6-small-net +index 4fc7260..c87b429 100755 +--- a/tests/ipv6-small-net ++++ b/tests/ipv6-small-net +@@ -70,7 +70,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + wait_server $PID + + echo -n "Connecting to setup interface... " +-echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ++echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/json b/tests/json +index 72dd4bf..24c66d8 100755 +--- a/tests/json ++++ b/tests/json +@@ -78,7 +78,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + sleep 4 + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/lz4-compression b/tests/lz4-compression +index 76478cf..405b2a2 100755 +--- a/tests/lz4-compression ++++ b/tests/lz4-compression +@@ -81,14 +81,14 @@ sleep 4 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/lzs-compression b/tests/lzs-compression +index c485df2..eef55f0 100755 +--- a/tests/lzs-compression ++++ b/tests/lzs-compression +@@ -81,14 +81,14 @@ sleep 4 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/multiple-routes b/tests/multiple-routes +index b6cc0c5..63c7614 100755 +--- a/tests/multiple-routes ++++ b/tests/multiple-routes +@@ -39,13 +39,13 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (with certificate)... " +-( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null ) || ++( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Re-connecting to get routes... " +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 + + echo ok + +diff --git a/tests/no-route-default b/tests/no-route-default +index 0c6f4f2..6cc68f0 100755 +--- a/tests/no-route-default ++++ b/tests/no-route-default +@@ -43,7 +43,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to get routes... " +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 + + echo ok + +@@ -68,7 +68,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to get routes... " +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 + + echo ok + +diff --git a/tests/no-route-group b/tests/no-route-group +index 59ec2f0..25cfaa6 100755 +--- a/tests/no-route-group ++++ b/tests/no-route-group +@@ -43,7 +43,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to get routes... " +-echo "test" | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 -u test --passwd-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 ++echo "test" | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 -u test --passwd-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 + + echo ok + +@@ -68,7 +68,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to get routes... " +-echo test | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 --passwd-on-stdin -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 ++echo test | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 --passwd-on-stdin -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 + + echo ok + +diff --git a/tests/ping-leases b/tests/ping-leases +index d97012e..3a43ac5 100755 +--- a/tests/ping-leases ++++ b/tests/ping-leases +@@ -52,12 +52,12 @@ fi + echo "Server started with PID $PID..." + + echo "Connecting to obtain cookie..." +-( echo "test" | $OPENCONNECT -q localhost:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | $OPENCONNECT -q localhost:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + + echo "Connecting to ping lease..." +-echo "test" | timeout 10 $OPENCONNECT localhost:$PORT -u "test" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ++echo "test" | timeout 10 $OPENCONNECT localhost:$PORT -u "test" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true + + if test $? != 124;then + fail $PID "Could not connect to server" +diff --git a/tests/radius b/tests/radius +index 859671d..7bc705a 100755 +--- a/tests/radius ++++ b/tests/radius +@@ -98,21 +98,21 @@ sleep 4 + + # Run clients + echo " * Testing wrong username at ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u xxx --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u xxx --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? = 0;then + echo "Connected with incorrect username" + exit 1 + fi + + echo " * Testing wrong password at ${ADDRESS}:${PORT}..." +-( echo "xxx" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "xxx" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? = 0;then + echo "Connected with incorrect password" + exit 1 + fi + + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 +@@ -120,7 +120,7 @@ fi + + echo " * Connecting to ${ADDRESS}:${PORT} with special IP..." + USERNAME=test-arb +-( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -148,7 +148,7 @@ sleep 3 + + echo " * Connecting to ${ADDRESS}:${PORT}..." + USERNAME=test +-( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/radius-config b/tests/radius-config +index 7285091..af9d3f7 100755 +--- a/tests/radius-config ++++ b/tests/radius-config +@@ -123,7 +123,7 @@ sleep 4 + + echo " * Connecting to ${ADDRESS}:${PORT}..." + USERNAME=testtime +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/radius-group b/tests/radius-group +index 1f28cda..9b85889 100755 +--- a/tests/radius-group ++++ b/tests/radius-group +@@ -100,7 +100,7 @@ sleep 4 + + echo " * Tests the radius group functionality" + USERNAME=test-class +-( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group2 -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group2 -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -137,7 +137,7 @@ sleep 4 + + echo " * Tests the alt radius group functionality" + USERNAME=test-class +-( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group1 -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group1 -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/radius-otp b/tests/radius-otp +index 11c3907..9b4fecb 100755 +--- a/tests/radius-otp ++++ b/tests/radius-otp +@@ -111,7 +111,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + sleep 0.5 + echo "$USERNAME-stage$COUNT" + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b >/dev/null 2>&1) + if test $? != 0; then + echo "Could not connect to server" + exit 1 +@@ -151,7 +151,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + sleep 0.5 + echo "$USERNAME-stage" + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected with wrong username" + exit 1 +@@ -173,7 +173,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + echo "$USERNAME-stage$COUNT" + fi + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected with wrong OTP" + exit 1 +@@ -197,7 +197,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + echo "$USERNAME-stage$COUNT" + fi + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected with wrong OTP" + exit 1 +@@ -218,7 +218,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + echo "$USERNAME-stage$COUNT" + fi + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected with blank OTP" + exit 1 +@@ -247,7 +247,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + echo "$USERNAME-stage$COUNT" + fi + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Successful connection with the number of OTP retries greater than allowed by the ban system (default 30)." + ${OCCTL} -s ${OCCTL_SOCKET} show ip ban points +@@ -265,7 +265,7 @@ for (( COUNT=1; COUNT <= 17; COUNT++ )); do + sleep 0.5 + echo "$USERNAME-stage$COUNT" + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected to server - MAX_CHALLENGES test failed" + exit 1 +diff --git a/tests/test-append-routes b/tests/test-append-routes +index be71d22..923d0aa 100755 +--- a/tests/test-append-routes ++++ b/tests/test-append-routes +@@ -41,7 +41,7 @@ wait_server $PID + + echo "Checking if routes are appended... " + +-timeout 15s $OPENCONNECT localhost:$PORT -v --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 ++timeout 15s $OPENCONNECT localhost:$PORT -v --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 + + echo "cat" + cat ${TMPFILE1} +diff --git a/tests/test-ban b/tests/test-ban +index eb6a874..be4695a 100755 +--- a/tests/test-ban ++++ b/tests/test-ban +@@ -59,15 +59,15 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + sleep 4 + + echo "Connecting with wrong password 5 times... " +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + + echo "" + echo "Connecting with correct password... " +-eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -n "$COOKIE" ];then + fail $PID "Obtained cookie although should have been banned" +@@ -90,7 +90,7 @@ sleep 25 + echo "" + + echo "Connecting with correct password after ban time... " +-eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie even though ban should be lifted" +@@ -99,16 +99,16 @@ fi + echo "" + echo "Checking ban reset time... " + +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + sleep 11 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + + echo "" + echo "Connecting with correct password after ban reset time... " +-eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie even though ban should be lifted" +diff --git a/tests/test-ban-local b/tests/test-ban-local +index d2a4397..fbe0eb2 100755 +--- a/tests/test-ban-local ++++ b/tests/test-ban-local +@@ -60,15 +60,15 @@ ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + sleep 4 + + echo "Connecting with wrong password 5 times... " +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + + echo "" + echo "Connecting with correct password... " +-eval `echo "test" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie even though client should be exempt" +diff --git a/tests/test-cert b/tests/test-cert +index 41362aa..7967193 100755 +--- a/tests/test-cert ++++ b/tests/test-cert +@@ -49,19 +49,19 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with invalid certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected with invalid certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -80,7 +80,7 @@ kill -HUP $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with DER CRL)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -99,13 +99,13 @@ kill -HUP $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with revoked certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected with revoked certificate!" + + echo "ok (failed as expected)" + + #echo "Normal connection... " +-#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || ++#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || + # fail $PID "Could not connect to server" + + rm -f "${CRLNAME}" "${CRLTMPLNAME}" +diff --git a/tests/test-cert-opt-pass b/tests/test-cert-opt-pass +index 18893d3..0109ef2 100755 +--- a/tests/test-cert-opt-pass ++++ b/tests/test-cert-opt-pass +@@ -34,7 +34,7 @@ opts=$1 + pass=$2 + rm -f ${OUTFILE} + +-echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 ++echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 + if test $? != 0;then + cat ${OUTFILE} + return 1 +diff --git a/tests/test-client-bypass-protocol b/tests/test-client-bypass-protocol +index 09f3cb2..14cb5a5 100755 +--- a/tests/test-client-bypass-protocol ++++ b/tests/test-client-bypass-protocol +@@ -43,7 +43,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting... " +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 + + echo ok + +@@ -68,7 +68,7 @@ PID=$! + wait_server $PID + + echo -n "Reconnecting..." +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 + + echo ok + +diff --git a/tests/test-config-per-group b/tests/test-config-per-group +index 4a8bd60..6b8929a 100755 +--- a/tests/test-config-per-group ++++ b/tests/test-config-per-group +@@ -81,7 +81,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & + sleep 4 + + echo " * Connecting with user NOT in group..." +-( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -129,7 +129,7 @@ sleep 2 + USERNAME=test + PASSWORD=test + echo " * Connecting with user in group to ${ADDRESS}:${PORT}..." +-( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/test-cookie-invalidation b/tests/test-cookie-invalidation +index 5f77afa..a6f8cea 100755 +--- a/tests/test-cookie-invalidation ++++ b/tests/test-cookie-invalidation +@@ -35,7 +35,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie" +@@ -44,7 +44,7 @@ fi + #echo "Cookie: $COOKIE" + + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background >/dev/null 2>&1 ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background >/dev/null 2>&1 + + sleep 4 + +@@ -58,9 +58,9 @@ if test $? != 0;then + fi + + echo "Terminating and connecting again with same cookie... " +-#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + # fail $PID "Could not connect to server" +-echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 ++echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 + + sleep 4 + +@@ -82,9 +82,9 @@ rm -f "${PIDFILE2}" + sleep 18 + + echo "Proper termination and connecting again with same (invalidated) cookie... " +-#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + # fail $PID "Could not connect to server" +-echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 ++echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 + + sleep 4 + +diff --git a/tests/test-cookie-timeout b/tests/test-cookie-timeout +index 08081b2..b8b4dda 100755 +--- a/tests/test-cookie-timeout ++++ b/tests/test-cookie-timeout +@@ -34,7 +34,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie" +@@ -44,7 +44,7 @@ fi + sleep 16 + echo "" + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background ++echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background + + sleep 4 + +@@ -59,7 +59,7 @@ rm -f "${PIDFILE}" + sleep 16 + echo "" + echo "Connecting again with cookie... " +-echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background ++echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background + + sleep 4 + +@@ -74,7 +74,7 @@ rm -f "${PIDFILE}" + sleep 16 + echo "" + echo "Connecting after forced kill with cookie... " +-echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background ++echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background + + sleep 4 + +@@ -90,7 +90,7 @@ rm -f "${PIDFILE}" + sleep 45 + echo "" + echo "Connecting with cookie after expiration... " +-echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background ++echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background + + sleep 4 + +@@ -104,7 +104,7 @@ fi + # test cookie verification after cookie verification failure. That is to verify whether + # the channel between main and sec-mod is in consistent state. + echo "Connecting (again) to obtain cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + + if test $? != 0;then + fail $PID "Could not obtain cookie" +diff --git a/tests/test-cookie-timeout-2 b/tests/test-cookie-timeout-2 +index fbeba81..4161eb6 100755 +--- a/tests/test-cookie-timeout-2 ++++ b/tests/test-cookie-timeout-2 +@@ -33,7 +33,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie" +@@ -43,7 +43,7 @@ fi + sleep 10 + echo "" + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background ++echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background + + sleep 4 + +@@ -58,7 +58,7 @@ rm -f "${srcdir}/pid2.$$" + sleep 30 + echo "" + echo "Connecting again with cookie (overriding first session)... " +-echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background ++echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background + + sleep 6 + +diff --git a/tests/test-enc-key b/tests/test-enc-key +index 0ca6249..5d65b62 100755 +--- a/tests/test-enc-key ++++ b/tests/test-enc-key +@@ -33,7 +33,7 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + cleanup +@@ -48,7 +48,7 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + cleanup +diff --git a/tests/test-explicit-ip b/tests/test-explicit-ip +index bfd1a9d..41d4665 100755 +--- a/tests/test-explicit-ip ++++ b/tests/test-explicit-ip +@@ -31,13 +31,13 @@ connect() + opts=$1 + pass=$2 + COOKIE='' +-eval `echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate` ++eval `echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate` + if [ -z "$COOKIE" ];then + return 1 + fi + + rm -f $TMPFILE +-echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 & ++echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 & + CPID=$! + + sleep 3 +diff --git a/tests/test-group-pass b/tests/test-group-pass +index 1530f43..7a78237 100755 +--- a/tests/test-group-pass ++++ b/tests/test-group-pass +@@ -33,19 +33,19 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group1 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group1 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with wrong groupname... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group4 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group4 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + cleanup +diff --git a/tests/test-gssapi-opt-cert b/tests/test-gssapi-opt-cert +index 0ef2d55..5cf1105 100755 +--- a/tests/test-gssapi-opt-cert ++++ b/tests/test-gssapi-opt-cert +@@ -29,7 +29,7 @@ opts=$1 + pass=$2 + rm -f ${OUTFILE} + +-echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 ++echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 + if test $? != 0;then + cat ${OUTFILE} + return 1 +diff --git a/tests/test-gssapi-opt-pass b/tests/test-gssapi-opt-pass +index 8999d30..b6ebd11 100755 +--- a/tests/test-gssapi-opt-pass ++++ b/tests/test-gssapi-opt-pass +@@ -29,7 +29,7 @@ opts=$1 + pass=$2 + rm -f ${OUTFILE} + +-echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 ++echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 + if test $? != 0;then + cat ${OUTFILE} + return 1 +diff --git a/tests/test-iroute b/tests/test-iroute +index d7b5f52..caf0a92 100755 +--- a/tests/test-iroute ++++ b/tests/test-iroute +@@ -34,13 +34,13 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (with certificate)... " +-( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -47,7 +47,7 @@ kill -USR2 $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -58,7 +58,7 @@ kill -USR2 $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +diff --git a/tests/test-max-same-1 b/tests/test-max-same-1 +index 5146483..ec19c0d 100755 +--- a/tests/test-max-same-1 ++++ b/tests/test-max-same-1 +@@ -47,7 +47,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + echo "Could not obtain cookie" +@@ -57,12 +57,12 @@ fi + #echo "Cookie: $COOKIE" + + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background + + sleep 4 + + echo "Connecting again with same cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background + + sleep 4 + +diff --git a/tests/test-multi-cookie b/tests/test-multi-cookie +index 83c9cb5..7581f9c 100755 +--- a/tests/test-multi-cookie ++++ b/tests/test-multi-cookie +@@ -47,7 +47,7 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + echo "Could not obtain cookie" +@@ -57,12 +57,12 @@ fi + #echo "Cookie: $COOKIE" + + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background + + sleep 4 + + echo "Connecting again with same cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background + + sleep 4 + +diff --git a/tests/test-multiple-client-ip b/tests/test-multiple-client-ip +index 0e799e0..76099fe 100755 +--- a/tests/test-multiple-client-ip ++++ b/tests/test-multiple-client-ip +@@ -84,14 +84,14 @@ sleep 4 + + # Run client 1 + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -99,14 +99,14 @@ fi + + # Run client 2 + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID2} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID2} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/test-namespace-listen b/tests/test-namespace-listen +index 9691b28..81c3e86 100755 +--- a/tests/test-namespace-listen ++++ b/tests/test-namespace-listen +@@ -77,7 +77,7 @@ if test $? != 0; then + fi + + echo " connecting to server" +-(echo "test" | ${CMDNS3} $OPENCONNECT $ADDRESS:$PORT -u "test" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --pid-file=${CLIPID} -b) || ++(echo "test" | ${CMDNS3} $OPENCONNECT $ADDRESS:$PORT -u "test" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --pid-file=${CLIPID} -b) || + fail $PID "could not connect to server" + sleep 5 + +diff --git a/tests/test-otp b/tests/test-otp +index 5209b0a..ed1fe94 100755 +--- a/tests/test-otp ++++ b/tests/test-otp +@@ -45,27 +45,27 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting with wrong username... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u falsetest --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u falsetest --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Connected with wrong username!" + echo ok + + echo -n "Connecting with wrong OTP... " +-( echo -e "test\n999482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n999482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Should not have connected with wrong OTP!" + echo ok + + echo -n "Connecting with correct password and OTP... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with OTP!" + echo ok + + echo -n "Connecting with empty password and wrong OTP... " +-( echo -e "999999\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "999999\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Should have not connected with wrong OTP!" + echo ok + + echo -n "Connecting with empty password and OTP... " +-( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with OTP-only!" + echo ok + +diff --git a/tests/test-otp-cert b/tests/test-otp-cert +index c8dc12c..61a71db 100755 +--- a/tests/test-otp-cert ++++ b/tests/test-otp-cert +@@ -45,22 +45,22 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + echo ok + + echo -n "Connecting to obtain cookie (with incorrect certificate)... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Should not have connected with wrong certificate!" + echo ok + + echo -n "Connecting to obtain cookie (with certificate)... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + echo ok + + echo -n "Connecting to obtain cookie (with no pass and certificate)... " +-( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + echo ok + +diff --git a/tests/test-pam b/tests/test-pam +index 8ec787a..561a140 100755 +--- a/tests/test-pam ++++ b/tests/test-pam +@@ -37,22 +37,22 @@ wait_server $PID + + echo "" + echo "Connecting with wrong password... " +-( echo -e "testuser\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "testuser\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with wrong cred" + + echo "" + echo "Connecting with empty password... " +-( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with wrong cred" + + echo "" + echo "Connecting with wrong username... " +-( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with wrong cred" + + echo "" + echo "Connecting with correct password... " +-( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ||#>/dev/null 2>&1 ) || ++( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) ||#>/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + cleanup +diff --git a/tests/test-pam-noauth b/tests/test-pam-noauth +index dc8dd3d..1f67371 100755 +--- a/tests/test-pam-noauth ++++ b/tests/test-pam-noauth +@@ -35,19 +35,19 @@ launch_sr_pam_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting with correct password but no PAM user... " +-( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u xtest --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u xtest --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with non existing user" + + echo "Connecting with incorrect password (correct in PAM) and existing user... " +-( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with non existing user" + + echo "Connecting with empty password (correct in PAM) and existing user... " +-( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with non existing user" + + echo "Connecting with correct password and existing user... " +-( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ||#>/dev/null 2>&1 ) || ++( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) ||#>/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + cleanup +diff --git a/tests/test-pass b/tests/test-pass +index 9d5484a..5aaaf48 100755 +--- a/tests/test-pass ++++ b/tests/test-pass +@@ -34,39 +34,39 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with wrong password... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + echo "Connecting to obtain cookie with empty password... " +-( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + echo "Connecting to obtain cookie with wrong username... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + # test locked account + + echo "Connecting to obtain cookie with locked account... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + #test special characters + + echo "Connecting to obtain cookie with special password... " +-( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with empty password... " +-( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + #echo "Normal connection... " +-#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || ++#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || + # fail $PID "Could not connect to server" + + if ! test -f ${PIDFILE};then +diff --git a/tests/test-pass-cert b/tests/test-pass-cert +index 8050788..8d284b8 100755 +--- a/tests/test-pass-cert ++++ b/tests/test-pass-cert +@@ -34,26 +34,26 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + + echo ok + + echo -n "Connecting to obtain cookie (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie (with incorrect certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Should not have connected with wrong certificate!" + + echo ok + + + #echo "Normal connection... " +-#( echo "test" | $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || ++#( echo "test" | $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || + # fail $PID "Could not connect to server" + + cleanup +diff --git a/tests/test-pass-group-cert b/tests/test-pass-group-cert +index ff64993..e559ac6 100755 +--- a/tests/test-pass-group-cert ++++ b/tests/test-pass-group-cert +@@ -33,37 +33,37 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group1 (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - DEFAULT (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup DEFAULT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup DEFAULT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group2 (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group3 (hidden) (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group4 (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group4 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group4 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Got cookie when it shouldn't!" + + echo ok +diff --git a/tests/test-pass-group-cert-no-pass b/tests/test-pass-group-cert-no-pass +index bc39b45..401b24f 100755 +--- a/tests/test-pass-group-cert-no-pass ++++ b/tests/test-pass-group-cert-no-pass +@@ -33,25 +33,25 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 && ++LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 && + fail $PID "Connected without certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group1 (with certificate)... " +-LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || ++LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group2 (with certificate)... " +-LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || ++LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group3 (hidden) (with certificate)... " +-LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || ++LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || + fail $PID "Could not connect with certificate!" + + echo ok +diff --git a/tests/test-pass-opt-cert b/tests/test-pass-opt-cert +index ac9adc1..1836538 100755 +--- a/tests/test-pass-opt-cert ++++ b/tests/test-pass-opt-cert +@@ -38,7 +38,7 @@ connect() + { + opts=$1 + pass=$2 +-echo ${pass} | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --passwd-on-stdin --authenticate >${TMPFILE} ++echo ${pass} | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --passwd-on-stdin --authenticate >${TMPFILE} + if test $? != 0;then + cat ${TMPFILE} + return 1 +diff --git a/tests/test-pass-script b/tests/test-pass-script +index 89a4094..0f18551 100755 +--- a/tests/test-pass-script ++++ b/tests/test-pass-script +@@ -67,7 +67,7 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! + wait_server $PID + + echo " * Connecting to obtain cookie with wrong username... " +-( echo "tost" | $OPENCONNECT -q localhost:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | $OPENCONNECT -q localhost:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + rm -f ${builddir}/connect.ok +@@ -76,11 +76,11 @@ rm -f ${builddir}/host-update.ok + #test special characters + + echo " * Connecting to obtain cookie... " +-( echo "!@#$%^&*()<>" | $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo " * Re-connecting to force script run... " +-echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ++echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true + + TIMEOUT=5 + while ! test -f ${builddir}/disconnect.ok; do +@@ -112,7 +112,7 @@ rm -f ${builddir}/disconnect.ok + rm -f ${builddir}/host-update.ok + + echo " * Re-connecting to get cookie... " +-echo "test2" | $OPENCONNECT -q localhost:$PORT -u "test2" --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${PARAMSFILE} ++echo "test2" | $OPENCONNECT -q localhost:$PORT -u "test2" --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${PARAMSFILE} + if test $? != 0;then + echo "Could not connect" + cat ${PARAMSFILE} +@@ -127,7 +127,7 @@ fi + + echo " * Re-connecting to force session stealing... " + eval "$(grep COOKIE ${PARAMSFILE})" +-echo ${COOKIE}| $OPENCONNECT --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true --pid-file=${OPIDFILE} -b ++echo ${COOKIE}| $OPENCONNECT --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true --pid-file=${OPIDFILE} -b + + echo " - Pausing client" + TIMEOUT=4 +@@ -156,7 +156,7 @@ rm -f ${builddir}/connect.ok + rm -f ${builddir}/disconnect.ok + + echo " * Re-connecting to steal previous IP address... " +-echo ${COOKIE} | $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true --pid-file=${OPIDFILE2} -b ++echo ${COOKIE} | $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true --pid-file=${OPIDFILE2} -b + + echo " - Resuming (disconnected) client" + kill -s CONT $(cat ${OPIDFILE}) +@@ -205,7 +205,7 @@ done + sleep 5 + echo " - Check server status" + +-( echo "!@#$%^&*()<>" | $OPENCONNECT --local-hostname='mylocalname' -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | $OPENCONNECT --local-hostname='mylocalname' -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo " - Killing server" +diff --git a/tests/test-replay b/tests/test-replay +index b8aa848..0533893 100755 +--- a/tests/test-replay ++++ b/tests/test-replay +@@ -60,7 +60,7 @@ launch_server -d 9999 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + echo "Could not obtain cookie" +@@ -70,7 +70,7 @@ fi + #echo "Cookie: $COOKIE" + + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --verbose --pid-file "${PIDFILE1}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --verbose --pid-file "${PIDFILE1}" --background + + sleep 4 + +diff --git a/tests/test-san-cert b/tests/test-san-cert +index a5040ae..a41c331 100755 +--- a/tests/test-san-cert ++++ b/tests/test-san-cert +@@ -49,25 +49,25 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with invalid certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected with invalid certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with certificate - no SAN)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected with invalid certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with certificate - SAN)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-san-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-san-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Failed to connect with certificate!" + + echo ok +diff --git a/tests/test-script-multi-user b/tests/test-script-multi-user +index 6327a26..c0bfa3d 100755 +--- a/tests/test-script-multi-user ++++ b/tests/test-script-multi-user +@@ -47,16 +47,16 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to force script block... " +-echo "!@#$%^&*()<>" | timeout 60 $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true & ++echo "!@#$%^&*()<>" | timeout 60 $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true & + + sleep 3 + + echo "Connecting to obtain cookie... " +-( echo "${USERNAME}" | $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "${USERNAME}" | $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting in background... " +-( echo "${USERNAME}" | timeout 15 $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --background >/dev/null 2>&1 ) || ++( echo "${USERNAME}" | timeout 15 $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --background >/dev/null 2>&1 ) || + fail $PID "Could not connect to server; probably blocked" + + sleep 3 +diff --git a/tests/test-sighup b/tests/test-sighup +index add538f..dd424e5 100755 +--- a/tests/test-sighup ++++ b/tests/test-sighup +@@ -34,7 +34,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -44,7 +44,7 @@ kill -HUP $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -57,7 +57,7 @@ kill -HUP $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Could not connect with certificate!" + + echo ok +diff --git a/tests/test-stress b/tests/test-stress +index 3816604..a2db96e 100755 +--- a/tests/test-stress ++++ b/tests/test-stress +@@ -33,7 +33,7 @@ run_client() { + PASS=$1; + shift; + +- ( echo $PASS | $OPENCONNECT -q $HOST -u $USER --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >/dev/null 2>&1 ) || ++ ( echo $PASS | $OPENCONNECT -q $HOST -u $USER --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >/dev/null 2>&1 ) || + echo "$USER: Could not connect to server" + } + +diff --git a/tests/test-udp-listen-host b/tests/test-udp-listen-host +index f3e6623..956938b 100755 +--- a/tests/test-udp-listen-host ++++ b/tests/test-udp-listen-host +@@ -111,7 +111,7 @@ ${CMDNS2} ${HAPROXY} -f ${HACONFIG} -d & HAPID=$! + sleep 3 + + echo " * Connecting to haproxy and using dtls ... " +-echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${CLIPID}" --background ++echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${CLIPID}" --background + + wait_file "${CLIPID}" 11 + +@@ -134,7 +134,7 @@ echo "restart ocsev with udp-listen-host set to 127.0.0.1" + ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG_UDP_LISTEN_LOCAL} ${DEBUG} & PID=$! + + echo " * Connecting to haproxy and using dtls again ... " +-echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${CLIPID2}" --background ++echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${CLIPID2}" --background + + wait_file "${CLIPID2}" 11 + +diff --git a/tests/test-user-config b/tests/test-user-config +index 1c7f518..f8573ce 100755 +--- a/tests/test-user-config ++++ b/tests/test-user-config +@@ -42,20 +42,20 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (with certificate)... " +-( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null ) || ++( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Re-connecting to force script run... " +-$OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true /dev/null & ++$OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true /dev/null & + kpid1=$! + echo ok + + sleep 2 + + echo -n "Re-connecting to check the iroutes... " +-$OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 & ++$OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 & + kpid2=$! + + echo ok +@@ -63,7 +63,7 @@ sleep 3 + + echo -n "Checking if max-same-clients is considered... " + +-timeout 15s $OPENCONNECT localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE2} 2>&1 ++timeout 15s $OPENCONNECT localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE2} 2>&1 + if test $? = 124;then + fail $PID "Max-same-clients directive was ignored" + fi +@@ -155,7 +155,7 @@ rm -f ${TMPFILE1} + rm -f ${TMPFILE2} + + echo -n "Re-connecting to check the ipv4-network... " +-$OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 & kpid3=$! ++$OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 & kpid3=$! + + echo ok + sleep 3 +diff --git a/tests/test-vhost b/tests/test-vhost +index 902f011..1a57e60 100755 +--- a/tests/test-vhost ++++ b/tests/test-vhost +@@ -62,7 +62,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to default host to obtain cookie (user without certificate)... " +-connect "default.example.com" "-u test" "test" "d66b507ae074d03b02eafca40d35f87dd81049d3" ++connect "default.example.com" "-u test" "test" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" + if test $? != 0;then + fail $PID "Failed to connect with user without certificate!" + fi +@@ -111,7 +111,7 @@ fi + echo ok + + echo -n "Connecting to default host to obtain cookie (with certificate)... " +-connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "d66b507ae074d03b02eafca40d35f87dd81049d3" ++connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" + if test $? = 0;then + fail $PID "Connected to wrong host with certificate!" + fi +@@ -136,7 +136,7 @@ kill -HUP $PID + sleep 5 + + echo -n "Sanity check to default host..." +-connect "default.example.com" "-u test" "test" "d66b507ae074d03b02eafca40d35f87dd81049d3" ++connect "default.example.com" "-u test" "test" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" + if test $? != 0;then + fail $PID "Failed to connect with user without certificate!" + fi +diff --git a/tests/traffic b/tests/traffic +index 3ea962f..1f0fcaf 100755 +--- a/tests/traffic ++++ b/tests/traffic +@@ -79,14 +79,14 @@ sleep 4 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 diff --git a/ocserv.spec b/ocserv.spec index adc065b..bb9f61b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.7 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -38,6 +38,8 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +# When removed remove the autoreconf step +Patch0: expired-certs.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -139,6 +141,8 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %endif %autosetup -p1 +# temporarily needed to apply patches +autoreconf -fvi rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) @@ -272,6 +276,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jun 22 2023 Nikos Mavrogiannopoulos - 1.1.7-2 +- Backported fixes for expired certificates + * Sun May 07 2023 Nikos Mavrogiannopoulos - 1.1.7-1 - Updated to 1.1.7 From 4dfb15142e87e295b5ef7e5a8ecffae29f5537e3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 11 Jul 2023 17:12:11 +0200 Subject: [PATCH 168/195] use %autorelease and %autochangelog --- ocserv.spec | 361 +--------------------------------------------------- 1 file changed, 2 insertions(+), 359 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index bb9f61b..8f2b22b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.7 -Release: 2%{?dist} +Release: %autorelease %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -276,361 +276,4 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog -* Thu Jun 22 2023 Nikos Mavrogiannopoulos - 1.1.7-2 -- Backported fixes for expired certificates - -* Sun May 07 2023 Nikos Mavrogiannopoulos - 1.1.7-1 -- Updated to 1.1.7 - -* Thu Jan 19 2023 Fedora Release Engineering - 1.1.6-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Fri Jul 22 2022 Fedora Release Engineering - 1.1.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Feb 17 2022 Nikos Mavrogiannopoulos - 1.1.6-1 -- Updated to 1.1.6 - -* Thu Feb 10 2022 Nikos Mavrogiannopoulos - 1.1.4-3 -- Update seccomp rules to allow the futex syscall -- Workaround incompatible API change in GnuTLS 3.7.3. - -* Thu Jan 20 2022 Fedora Release Engineering - 1.1.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Sat Nov 13 2021 Nikos Mavrogiannopoulos - 1.1.4-1 -- Update to upstream 1.1.4 release - -* Sat Nov 06 2021 Adrian Reber - 1.1.3-4 -- Rebuilt for protobuf 3.19.0 - -* Tue Oct 26 2021 Adrian Reber - 1.1.3-3 -- Rebuilt for protobuf 3.18.1 - -* Thu Jul 22 2021 Fedora Release Engineering - 1.1.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Jun 2 2021 Nikos Mavrogiannopoulos - 1.1.3-1 -- Updated to latest release - -* Tue Jan 26 2021 Fedora Release Engineering - 1.1.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Thu Jan 14 08:31:24 CET 2021 Adrian Reber - 1.1.2-2 -- Rebuilt for protobuf 3.14 - -* Sun Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 -- Update to upstream 1.1.2 release - -* Mon Nov 23 2020 Nikos Mavrogiannopoulos - 1.1.1-5 -- Rebuilt for ronn successor - -* Wed Nov 11 2020 Nikos Mavrogiannopoulos - 1.1.1-4 -- Rebuilt for radcli 1.3.0 - -* Thu Oct 29 2020 Nikos Mavrogiannopoulos - 1.1.1-3 -- Rebuild without pcllib dependency -- Enhanced seccomp filters for tests to run in all architectures - -* Thu Sep 24 2020 Adrian Reber - 1.1.1-2 -- Rebuilt for protobuf 3.13 - -* Mon Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 -- Update to upstream 1.1.1 release -- Set default priorities to NORMAL as using @SYSTEM is no longer necessary - to follow crypto policies. - -* Tue Jul 28 2020 Fedora Release Engineering - 1.1.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Sun Jun 21 2020 Adrian Reber - 1.1.0-2 -- Rebuilt for protobuf 3.12 - -* Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 -- Update to upstream 1.1.0 release (introduces ocserv-worker) - -* Wed Apr 15 2020 Igor Raits - 1.0.1-2 -- Rebuild for http-parser 2.9.4 - -* Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 -- Update to upstream 1.0.1 release - -* Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 -- Update to upstream 1.0.0 release - -* Wed Jan 29 2020 Fedora Release Engineering - 0.12.6-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Sat Dec 28 2019 Nikos Mavrogiannopoulos - 0.12.6-1 -- Update to upstream 0.12.6 release - -* Wed Oct 16 2019 Nikos Mavrogiannopoulos - 0.12.5-1 -- Update to upstream 0.12.5 release - -* Thu Jul 25 2019 Fedora Release Engineering - 0.12.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Wed Jul 03 2019 Nikos Mavrogiannopoulos - 0.12.4-1 -- Update to upstream 0.12.4 release - -* Tue Mar 12 2019 Nikos Mavrogiannopoulos - 0.12.3-1 -- Update to upstream 0.12.3 release - -* Sun Feb 17 2019 Igor Gnatenko - 0.12.2-4 -- Rebuild for readline 8.0 - -* Fri Feb 01 2019 Fedora Release Engineering - 0.12.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Mon Jan 14 2019 Björn Esser - 0.12.2-2 -- Rebuilt for libcrypt.so.2 (#1666033) - -* Thu Jan 10 2019 Nikos Mavrogiannopoulos - 0.12.2-1 -- Update to upstream 0.12.2 release - -* Tue Jul 24 2018 Nikos Mavrogiannopoulos - 0.12.1-3 -- Added gcc as build-dependency - -* Fri Jul 13 2018 Fedora Release Engineering - 0.12.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Sat May 12 2018 Nikos Mavrogiannopoulos - 0.12.1-1 -- Update to upstream 0.12.1 release - -* Mon Apr 23 2018 Nikos Mavrogiannopoulos - 0.12.0-1 -- Update to upstream 0.12.0 release - -* Thu Apr 12 2018 Nikos Mavrogiannopoulos - 0.11.11-2 -- Update to upstream 0.11.11 release -- include crypt.h to use crypt() - -* Mon Mar 05 2018 Nikos Mavrogiannopoulos - 0.11.11-1 -- Update to upstream 0.11.11 release - -* Thu Feb 08 2018 Fedora Release Engineering - 0.11.10-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Sat Jan 20 2018 Björn Esser - 0.11.10-2 -- Rebuilt for switch to libxcrypt - -* Mon Jan 08 2018 Nikos Mavrogiannopoulos - 0.11.10-1 -- Update to upstream 0.11.10 release - -* Tue Nov 21 2017 Nikos Mavrogiannopoulos - 0.11.9-3 -- Update to upstream 0.11.9 release - -* Thu Nov 16 2017 Nikos Mavrogiannopoulos - 0.11.9-2 -- Do not enable libwrap - -* Tue Oct 10 2017 Nikos Mavrogiannopoulos - 0.11.9-1 -- Update to upstream 0.11.9 release - -* Thu Aug 03 2017 Fedora Release Engineering - 0.11.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 0.11.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Wed May 03 2017 Nikos Mavrogiannopoulos - 0.11.8-1 -- Update to upstream 0.11.8 release - -* Mon Feb 13 2017 Nikos Mavrogiannopoulos - 0.11.7-1 -- Update to upstream 0.11.7 release - -* Sat Feb 11 2017 Fedora Release Engineering - 0.11.6-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Thu Jan 12 2017 Igor Gnatenko - 0.11.6-3 -- Rebuild for readline 7.x - -* Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-2 -- Removed gpgkeys from sources - -* Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-1 -- New upstream release - -* Wed Sep 14 2016 Nikos Mavrogiannopoulos - 0.11.4-3 -- Added getrandom to the list of allowed syscalls (#1375851) - -* Thu Sep 8 2016 Nikos Mavrogiannopoulos - 0.11.4-2 -- Rebuild to address http-parser breakage (#1374081) - -* Fri Aug 5 2016 Nikos Mavrogiannopoulos - 0.11.4-1 -- New upstream release - -* Thu Jun 16 2016 Nikos Mavrogiannopoulos - 0.11.3-1 -- New upstream release - -* Tue Apr 26 2016 Nikos Mavrogiannopoulos - 0.11.2-1 -- New upstream release -- Added automatic verification of signature during build - -* Mon Mar 21 2016 Nikos Mavrogiannopoulos - 0.11.1-1 -- new upstream release - -* Fri Feb 19 2016 Nikos Mavrogiannopoulos - 0.11.0-1 -- new upstream release - -* Thu Feb 04 2016 Fedora Release Engineering - 0.10.11-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Mon Jan 11 2016 Nikos Mavrogiannopoulos - 0.10.11-1 -- new upstream release - -* Mon Nov 30 2015 Nikos Mavrogiannopoulos - 0.10.10-1 -- new upstream release - -* Thu Oct 8 2015 Nikos Mavrogiannopoulos - 0.10.9-1 -- new upstream release (#1269479) - -* Thu Sep 17 2015 Nikos Mavrogiannopoulos - 0.10.8-2 -- compile ocserv using radcli - -* Mon Sep 7 2015 Nikos Mavrogiannopoulos - 0.10.8-1 -- new upstream release (#1260327) - -* Fri Aug 7 2015 Nikos Mavrogiannopoulos - 0.10.7-1 -- new upstream release (#1251305) - -* Thu Jul 9 2015 Nikos Mavrogiannopoulos - 0.10.6-2 -- corrected JSON output - -* Thu Jul 2 2015 Nikos Mavrogiannopoulos - 0.10.6-1 -- new upstream release (#1238499) - -* Wed Jun 17 2015 Fedora Release Engineering - 0.10.5-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Mon May 25 2015 Nikos Mavrogiannopoulos - 0.10.5-1 -- new upstream release (#1215326) - -* Mon Apr 27 2015 Nikos Mavrogiannopoulos - 0.10.4-1 -- new upstream release - -* Mon Mar 30 2015 Nikos Mavrogiannopoulos - 0.10.2-1 -- new upstream release - -* Mon Mar 16 2015 Nikos Mavrogiannopoulos - 0.10.1-1 -- new upstream release - -* Wed Mar 11 2015 Nikos Mavrogiannopoulos - 0.10.0-1 -- new upstream release - -* Wed Feb 18 2015 Nikos Mavrogiannopoulos - 0.9.2-1 -- new upstream release -- enabled lz4 compression - -* Mon Feb 16 2015 Peter Robinson 0.9.1-2 -- aarch64 (and ARMv7) now has seccomp support - -* Mon Feb 16 2015 Nikos Mavrogiannopoulos - 0.9.1-1 -- new upstream release - -* Thu Jan 29 2015 Nikos Mavrogiannopoulos - 0.9.0-2 -- only enable seccomp in x86-64. It seems to be broken in x86: - http://sourceforge.net/p/libseccomp/mailman/message/33275762/ - -* Thu Jan 22 2015 Nikos Mavrogiannopoulos - 0.9.0-1 -- new upstream release - -* Fri Jan 9 2015 Nikos Mavrogiannopoulos - 0.8.9-4 -- enable PIE - -* Tue Jan 6 2015 Nikos Mavrogiannopoulos - 0.8.9-3 -- Comply with system-wide crypto policies (#1179332) - -* Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 -- ocserv.service: depend on network-online.target (#1178760) -- enable seccomp (on platforms it is available) - -* Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 -- New upstream release - -* Wed Nov 26 2014 Nikos Mavrogiannopoulos - 0.8.8-1 -- New upstream release - -* Mon Oct 27 2014 Nikos Mavrogiannopoulos - 0.8.7-1 -- New upstream release - -* Tue Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 -- Ship a default ocserv-script, which will put connecting clients - into the internal firewall zone. - -* Thu Aug 28 2014 Nikos Mavrogiannopoulos - 0.8.4-1 -- New upstream release - -* Sun Aug 17 2014 Fedora Release Engineering - 0.8.2-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Fri Aug 08 2014 Nikos Mavrogiannopoulos - 0.8.2-3 -- Rebuilt - -* Tue Aug 05 2014 Nikos Mavrogiannopoulos - 0.8.2-2 -- Rebuilt for new protobuf-c - -* Mon Jul 28 2014 Nikos Mavrogiannopoulos - 0.8.2-1 -- New upstream release - -* Mon Jun 30 2014 Nikos Mavrogiannopoulos - 0.8.1-1 -- New upstream release - -* Fri Jun 06 2014 Nikos Mavrogiannopoulos - 0.8.0-2 -- Generate certificates and private keys before the first run -- Corrected chroot path - -* Mon Jun 02 2014 Nikos Mavrogiannopoulos - 0.8.0-1 -- New upstream release - -* Mon May 26 2014 Nikos Mavrogiannopoulos - 0.8.0pre0-1 -- New upstream release - -* Fri May 09 2014 Nikos Mavrogiannopoulos - 0.3.5-1 -- New upstream release - -* Fri May 02 2014 Nikos Mavrogiannopoulos - 0.3.4-1 -- New upstream release - -* Thu Apr 10 2014 Nikos Mavrogiannopoulos - 0.3.3-1 -- New upstream release - -* Fri Mar 14 2014 Nikos Mavrogiannopoulos - 0.3.2-1 -- New upstream release - -* Mon Feb 17 2014 Nikos Mavrogiannopoulos - 0.3.1-2 -- new upstream release - -* Wed Jan 29 2014 Nikos Mavrogiannopoulos - 0.3.0-2 -- Generated certificates no longer carry an expiration date. - -* Mon Jan 27 2014 Nikos Mavrogiannopoulos - 0.3.0-1 -- Updated to latest upstream version (0.3.0). -- Certificates and private keys are auto-generated. - -* Mon Dec 16 2013 Nikos Mavrogiannopoulos - 0.2.3-1 -- Updated to latest upstream version (0.2.3). -- Corrected the chroot directory in config file. - -* Fri Dec 6 2013 Nikos Mavrogiannopoulos - 0.2.1-6 -- Added exception for the bundling of CCAN components. - -* Wed Nov 13 2013 Nikos Mavrogiannopoulos - 0.2.1-5 -- Updated the way PACKAGE-LICENSING is handled. - -* Tue Nov 12 2013 Nikos Mavrogiannopoulos - 0.2.1-4 -- Replaced gnulib's GPLv3+ license with GPLv2+. According to - http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html - it was a gnulib bug. -- Reduced the number of applicable licenses by upgrading LGPLv2+ - components to GPLv2+. -- Added PACKAGE-LICENSING. - -* Mon Nov 11 2013 Nikos Mavrogiannopoulos - 0.2.1-3 -- Updated spec to add http-parser and pcllib as dependencies. -- Bundled library files are removed. -- Updated license information. - -* Fri Nov 8 2013 Nikos Mavrogiannopoulos - 0.2.1-2 -- Updated spec to account improvements suggested by Alec Leamas. - -* Thu Nov 7 2013 Nikos Mavrogiannopoulos - 0.2.1-1 -- Initial version of the package +%autochangelog From a9ef7caf17d80eee2b090c456a32080925c1d54f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 11 Jul 2023 17:31:45 +0200 Subject: [PATCH 169/195] Updated to 1.2.0 --- .gitignore | 2 + expired-certs.patch | 2308 ------------------------------------------- ocserv.conf | 138 ++- ocserv.spec | 14 +- sources | 4 +- 5 files changed, 115 insertions(+), 2351 deletions(-) delete mode 100644 expired-certs.patch diff --git a/.gitignore b/.gitignore index 1435b3a..2113177 100644 --- a/.gitignore +++ b/.gitignore @@ -239,3 +239,5 @@ /ocserv-1.1.6.tar.xz /ocserv-1.1.7.tar.xz /ocserv-1.1.7.tar.xz.sig +/ocserv-1.2.0.tar.xz +/ocserv-1.2.0.tar.xz.sig diff --git a/expired-certs.patch b/expired-certs.patch deleted file mode 100644 index 443bd7b..0000000 --- a/expired-certs.patch +++ /dev/null @@ -1,2308 +0,0 @@ -diff --git a/tests/Makefile.am b/tests/Makefile.am -index d965eae..ecc417c 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -44,7 +44,8 @@ EXTRA_DIST = certs/ca-key.pem certs/ca.pem ns.sh common.sh certs/server-cert.pem - data/disconnect-user2.config data/ping-leases.config data/haproxy-proxyproto.config \ - data/haproxy-proxyproto.cfg scripts/proxy-connectscript data/haproxy-proxyproto-v1.config \ - data/haproxy-proxyproto-v1.cfg scripts/proxy-connectscript-v1 data/test-multiple-client-ip.config \ -- data/test-client-bypass-protocol.config asan.supp -+ data/test-client-bypass-protocol.config asan.supp certs/ca.tmpl certs/server-cert.tmpl \ -+ certs/user-cert.tmpl - - xfail_scripts = - dist_check_SCRIPTS = ocpasswd-test -@@ -176,6 +177,25 @@ gen_oidc_test_data_CPPFLAGS = $(AM_CPPFLAGS) - gen_oidc_test_data_SOURCES = generate_oidc_test_data.c - gen_oidc_test_data_LDADD = $(LDADD) $(CJOSE_LIBS) $(JANSSON_LIBS) - -+certs/ca.pem: certs/ca-key.pem certs/ca.tmpl -+ certtool --generate-self-signed --template certs/ca.tmpl --load-privkey certs/ca-key.pem --outfile certs/ca.pem -+ -+certs/server-cert-ca.pem: certs/ca.pem certs/server-cert.pem -+ cat certs/server-cert.pem certs/ca.pem > certs/server-cert-ca.pem -+ -+certs/server-cert.pem: certs/server-cert.tmpl certs/ca.pem certs/server-key.pem certs/ca-key.pem -+ certtool --generate-certificate --template certs/server-cert.tmpl --load-privkey certs/server-key.pem --load-ca-certificate certs/ca.pem --load-ca-privkey certs/ca-key.pem --outfile certs/server-cert.pem -+ -+certs/user-cert.pem: certs/user-cert.tmpl certs/ca.pem certs/user-key.pem certs/ca-key.pem -+ certtool --generate-certificate --template certs/user-cert.tmpl --load-privkey certs/user-key.pem --load-ca-certificate certs/ca.pem --load-ca-privkey certs/ca-key.pem --outfile certs/user-cert.pem -+ -+# make the user certificate invalid by signing it with another CA -+certs/user-cert-invalid.pem: certs/user-cert.tmpl -+ certtool --generate-privkey --outfile ca-key.tmp -+ certtool --generate-self-signed --template certs/ca.tmpl --load-privkey ca-key.tmp --outfile ca.tmp -+ certtool --generate-certificate --template certs/user-cert.tmpl --load-privkey certs/user-key.pem --load-ca-certificate ca.tmp --load-ca-privkey ca-key.tmp --outfile certs/user-cert-invalid.pem -+ rm -f ca-key.tmp ca.tmp -+ - if ENABLE_OIDC_AUTH_TESTS - check_PROGRAMS += gen_oidc_test_data - dist_check_SCRIPTS += test-oidc -diff --git a/tests/apple-ios b/tests/apple-ios -index 897d823..45b0cd3 100755 ---- a/tests/apple-ios -+++ b/tests/apple-ios -@@ -54,11 +54,11 @@ wait_server $PID - sleep 2 - - echo " * Connecting to obtain cookie... " --( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null ) || -+( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null ) || - fail $PID "Could not receive cookie from server" - - echo " * Re-connect to force script run with platform... " --echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 -+echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 - - sleep 5 - -@@ -87,7 +87,7 @@ fi - rm -f ${TMPFILE} - - echo " * Re-connecting to force script run with user agent... " --echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose --useragent="Cisco AnyConnect VPN Agent for Apple" localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 -+echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose --useragent="Cisco AnyConnect VPN Agent for Apple" localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 - - sleep 5 - -@@ -114,7 +114,7 @@ fi - sleep 5 - echo " - Check server status" - --( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo " - Killing server" -diff --git a/tests/banner b/tests/banner -index 44954e2..08f8f19 100755 ---- a/tests/banner -+++ b/tests/banner -@@ -50,7 +50,7 @@ wait_server $PID - sleep 3 - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >${TMPFILE} 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >${TMPFILE} 2>&1 ) || - fail $PID "Could not receive cookie from server" - - grep "${BANNER}" ${TMPFILE} >/dev/null -@@ -61,7 +61,7 @@ if test $? != 0;then - fi - - echo "Connecting to obtain cookie with wrong password... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >${TMPFILE} 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >${TMPFILE} 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - grep "${BANNER}" ${TMPFILE} >/dev/null -diff --git a/tests/certs/ca-key.pem b/tests/certs/ca-key.pem -index 9bd0754..ee5599c 100644 ---- a/tests/certs/ca-key.pem -+++ b/tests/certs/ca-key.pem -@@ -31,25 +31,3 @@ y1hvTfWRAoGZALNT3AbF9EDnJmZlS30MWtBggw83UhszC8XN2tY30AsvsDOS6a0F - UVhyNvBTKo6lPqXqUsVxp16TKeeQKF+DuYuuNZN3pXXsHTiHkRMDCRVEqz7UnZEc - /Bq/Kh2aOkelkX2S27QzTZGL - -----END RSA PRIVATE KEY----- -------BEGIN CERTIFICATE----- --MIIDtDCCAmygAwIBAgIETeC0yjANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDEw5H --bnVUTFMgVGVzdCBDQTAeFw0xMTA1MjgwODM5MzlaFw0zODEwMTIwODM5NDBaMC8x --LTArBgNVBAMTJEdudVRMUyBUZXN0IFNlcnZlciAoUlNBIGNlcnRpZmljYXRlKTCC --AVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/HsqwfvTYvO1D --hmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJl1U1F/Oh --ckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq --58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mB --VAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03 --U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b7eujbZ3L --xTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUC --AwEAAaOBjTCBijAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAT --BgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBR2 --B1hM6rUp9S2ABoyDSoINCeyT3jAfBgNVHSMEGDAWgBRNVrdqAFjxZ5L0pnVVG45T --AQPvzzANBgkqhkiG9w0BAQsFAAOCATEAdNWmTsh5uIfngyhOWwm7pK2+vgUMY8nH --gMoMFHt0yuxuImcUMXu3LRS1dZSoCJACBpTFGi/Dg2U0qvOHQcEmc3OwNqHB90R3 --LG5jUSCtq/bYW7h/6Gd9KeWCgZczaHbQ9IPTjLH1dLswVPt+fXKB6Eh0ggSrGATE --/wRZT/XgDCW8t4C+2+TmJ8ZEzvU87KAPQ9rUBS1+p3EUAR/FfMApApsEig1IZ+ZD --5joaGBW7zh1H0B9mEKidRvD7yuRJyzAcvD25nT15NLW0QR3dEeXosLc720xxJl1h --h8NJ7YOvn323mOjR9er4i4D6iJlXmJ8tvN9vakCankWvBzb7plFn2sfMQqICFpRc --w075D8hdQxfpGffL2tEeKSgjyNHXS7x3dFhUpN3IQjUi2x4f2e/ZXg== -------END CERTIFICATE----- -diff --git a/tests/certs/ca.pem b/tests/certs/ca.pem -index c4058ee..02f0b76 100644 ---- a/tests/certs/ca.pem -+++ b/tests/certs/ca.pem -@@ -1,20 +1,20 @@ - -----BEGIN CERTIFICATE----- --MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD --EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw --fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ --l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW --DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh --zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt --c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b --7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep --n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA --MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC --ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT --z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP --g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX --ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk --x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH --yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg --fJbi9Ui2FmXEeKkX34f1ONNj9Q== -+MIIDPDCCAfSgAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzAyMTMxNTMyMTJaGA85OTk5MTIzMTIzNTk1OVowDTELMAkGA1UEAxMC -+Q0EwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQC0ayeYJa/B/x7KsH70 -+2LztQ4ZnVF3atB7CkF+DPAIR/BNyhbKIpGVBC3ZfI76Kn/55S3M7LsdLPL8WyZdV -+NRfzoXJLMMLgJ5QS81YA5s6CSxFdpB6b+vq5GypNGLW6peYMx6iooW2qiITclg6y -+bBw1qufHlD351cfCog1Ls2569whfxQnNFZMa95jfKkxmiSTtH9AWY4FlpVg7oc0l -+YpuZgVQIFxjsfC8IojsoVzKdF0cKhvtisUGZ5vveqOogfvMb7rrqmiFkKZLyrXPl -+GQWdN1PiEZ8YXyK64osNAIyeL6eHPUC+SqKlkggMLmHAWHyameHWrIM5Jc8+G+3r -+o22dy8U43sHHbps0FL4wPoKQHrlKmnbk7zMMRqIxcvbDYQv4qmeJ9KXldjehKZ+A -+eap1AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMB0G -+A1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOCATEA -+foqPGdiyJYHih4J5YHwFPQxmkOzPHSa13K/q8sDvobE+HFTzrlTbAFC8bS38Bv2f -+9ZrPME4JvnsGdRGYwxS3LUmNdHHWR8LkvGXBE3u/TZsJfPtOR8JwdulQXpRw7hhL -+ew/mR5IEHZrUZgnnI4dg1kJhE1JPTvmtgqcE1CsikVQ14NvG/ehJbJyPgKTq/Zxm -+Ru4B5N+Jef/LaOqZvK4xK8x2ZaZ/L/ANou+7EY4DoWAkOEEoCU8DQHLAFgf6B7La -+oemLQGNHcBpba81jlS5EXXGJccOvfbw0MJTP3ZvyVIlEYu/X4roC7EJP/UkCZUJG -+f79Nc28q2/2D8tuFOqG7UbP7r2cWSa8OO3cI/V1W1k3iWZ63WltqDwFC0c8iqYFL -+9xKfQ96Q7wrYOCjmuaCLbw== - -----END CERTIFICATE----- -diff --git a/tests/certs/ca.tmpl b/tests/certs/ca.tmpl -new file mode 100644 -index 0000000..da5cc3f ---- /dev/null -+++ b/tests/certs/ca.tmpl -@@ -0,0 +1,6 @@ -+cn = CA -+ca -+cert_signing_key -+expiration_days = -1 -+activation_date = "2013-02-13 16:32:12" -+serial = 0x51d82ecc -diff --git a/tests/certs/server-cert-ca.pem b/tests/certs/server-cert-ca.pem -index 818101a..8ffaad3 100644 ---- a/tests/certs/server-cert-ca.pem -+++ b/tests/certs/server-cert-ca.pem -@@ -1,42 +1,42 @@ - -----BEGIN CERTIFICATE----- --MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD --Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs --PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 --u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd --YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ --IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 --KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 --7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU --yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL --gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg --ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 --UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s --9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 --GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C --zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ --eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF --FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j --LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM --zzJKdNg= -+MIIDjjCCAkagAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJ -+bG9jYWxob3N0MIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEApzor7D8U -+sCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leAWOGW/O7QvQQVfl9/pTP4/LuR -+7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6zJlm4RYJFZTeX06qGNJZ3WCc -+dl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kapfe2AGUV3DKEF1Y20Zs1S2SFb -+pkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ROhb62gHMvniNIF0xpO+fSjT -+2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjpV3Ymf8ox4OfkSkOXbd3ZOe5Q -+CFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0uxLQdDQiDO4b4ct9kKyeWVMjZ -+3E0n+qjFaHnYHQIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ -+bG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIFoDAd -+BgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0UwqJ -+MThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAGQoUMiZVg6+Ibj8kyfq -+l/vfu4QxlUlqAbm/b9PVdOLrhz+T986HMFhL0b2HUGg5Mb0NZcgHjH4VLkei4AIb -+g/1nGdJ2I6EcLiQOvO4h2F3CoU6HkEGVEUXFaBd19tSDm7aM+2h7oPb3Vs3YT9QE -+x7ejmVeA+Qr9+H9xHyModpA1PkKRW31TOYtjUXHdHObT1uar++C1JLHn49ooKDZM -+5p9a4ExQVYd6WMRXKC83py1V4Ne5kBxC/l+3QkVZnMwByChySP7SEMa9yGv4KFM9 -+FT7XvxQsrkqPi5bCllUyGDrVeyTpyPDrb4BKgAu/Cy4tyDxLzBTZ5TXDH7E1IBps -+g1k5llFIyGdO5vQrX8vF61tqK5DBhgVvwu0k/m2lP9esLfaF7I5oGAbUKGhRr8mE -+xs8= - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- --MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD --EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw --fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ --l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW --DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh --zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt --c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b --7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep --n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA --MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC --ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT --z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP --g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX --ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk --x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH --yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg --fJbi9Ui2FmXEeKkX34f1ONNj9Q== -+MIIDPDCCAfSgAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzAyMTMxNTMyMTJaGA85OTk5MTIzMTIzNTk1OVowDTELMAkGA1UEAxMC -+Q0EwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQC0ayeYJa/B/x7KsH70 -+2LztQ4ZnVF3atB7CkF+DPAIR/BNyhbKIpGVBC3ZfI76Kn/55S3M7LsdLPL8WyZdV -+NRfzoXJLMMLgJ5QS81YA5s6CSxFdpB6b+vq5GypNGLW6peYMx6iooW2qiITclg6y -+bBw1qufHlD351cfCog1Ls2569whfxQnNFZMa95jfKkxmiSTtH9AWY4FlpVg7oc0l -+YpuZgVQIFxjsfC8IojsoVzKdF0cKhvtisUGZ5vveqOogfvMb7rrqmiFkKZLyrXPl -+GQWdN1PiEZ8YXyK64osNAIyeL6eHPUC+SqKlkggMLmHAWHyameHWrIM5Jc8+G+3r -+o22dy8U43sHHbps0FL4wPoKQHrlKmnbk7zMMRqIxcvbDYQv4qmeJ9KXldjehKZ+A -+eap1AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMB0G -+A1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOCATEA -+foqPGdiyJYHih4J5YHwFPQxmkOzPHSa13K/q8sDvobE+HFTzrlTbAFC8bS38Bv2f -+9ZrPME4JvnsGdRGYwxS3LUmNdHHWR8LkvGXBE3u/TZsJfPtOR8JwdulQXpRw7hhL -+ew/mR5IEHZrUZgnnI4dg1kJhE1JPTvmtgqcE1CsikVQ14NvG/ehJbJyPgKTq/Zxm -+Ru4B5N+Jef/LaOqZvK4xK8x2ZaZ/L/ANou+7EY4DoWAkOEEoCU8DQHLAFgf6B7La -+oemLQGNHcBpba81jlS5EXXGJccOvfbw0MJTP3ZvyVIlEYu/X4roC7EJP/UkCZUJG -+f79Nc28q2/2D8tuFOqG7UbP7r2cWSa8OO3cI/V1W1k3iWZ63WltqDwFC0c8iqYFL -+9xKfQ96Q7wrYOCjmuaCLbw== - -----END CERTIFICATE----- -diff --git a/tests/certs/server-cert.pem b/tests/certs/server-cert.pem -index 4acde02..b304b47 100644 ---- a/tests/certs/server-cert.pem -+++ b/tests/certs/server-cert.pem -@@ -1,22 +1,22 @@ - -----BEGIN CERTIFICATE----- --MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD --Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs --PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 --u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd --YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ --IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 --KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 --7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU --yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL --gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg --ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 --UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s --9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 --GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C --zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ --eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF --FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j --LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM --zzJKdNg= -+MIIDjjCCAkagAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJ -+bG9jYWxob3N0MIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEApzor7D8U -+sCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leAWOGW/O7QvQQVfl9/pTP4/LuR -+7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6zJlm4RYJFZTeX06qGNJZ3WCc -+dl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kapfe2AGUV3DKEF1Y20Zs1S2SFb -+pkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ROhb62gHMvniNIF0xpO+fSjT -+2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjpV3Ymf8ox4OfkSkOXbd3ZOe5Q -+CFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0uxLQdDQiDO4b4ct9kKyeWVMjZ -+3E0n+qjFaHnYHQIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ -+bG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIFoDAd -+BgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0UwqJ -+MThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAGQoUMiZVg6+Ibj8kyfq -+l/vfu4QxlUlqAbm/b9PVdOLrhz+T986HMFhL0b2HUGg5Mb0NZcgHjH4VLkei4AIb -+g/1nGdJ2I6EcLiQOvO4h2F3CoU6HkEGVEUXFaBd19tSDm7aM+2h7oPb3Vs3YT9QE -+x7ejmVeA+Qr9+H9xHyModpA1PkKRW31TOYtjUXHdHObT1uar++C1JLHn49ooKDZM -+5p9a4ExQVYd6WMRXKC83py1V4Ne5kBxC/l+3QkVZnMwByChySP7SEMa9yGv4KFM9 -+FT7XvxQsrkqPi5bCllUyGDrVeyTpyPDrb4BKgAu/Cy4tyDxLzBTZ5TXDH7E1IBps -+g1k5llFIyGdO5vQrX8vF61tqK5DBhgVvwu0k/m2lP9esLfaF7I5oGAbUKGhRr8mE -+xs8= - -----END CERTIFICATE----- -diff --git a/tests/certs/server-cert.tmpl b/tests/certs/server-cert.tmpl -new file mode 100644 -index 0000000..82e34ca ---- /dev/null -+++ b/tests/certs/server-cert.tmpl -@@ -0,0 +1,8 @@ -+cn = localhost -+dns_name = localhost -+tls_www_server -+signing_key -+encryption_key -+expiration_days = -1 -+activation_date = "2013-06-06 14:51:29" -+serial = 0x51d82ef0 -diff --git a/tests/certs/user-cert-invalid.pem b/tests/certs/user-cert-invalid.pem -index 0175bdf..4f5dd96 100644 ---- a/tests/certs/user-cert-invalid.pem -+++ b/tests/certs/user-cert-invalid.pem -@@ -1,107 +1,23 @@ --X.509 Certificate Information: -- Version: 3 -- Serial Number (hex): 51d82f14 -- Issuer: CN=CA -- Validity: -- Not Before: Sat Jul 06 14:52:05 UTC 2013 -- Not After: Mon May 15 14:52:05 UTC 2023 -- Subject: CN=A user,UID=test -- Subject Public Key Algorithm: RSA -- Algorithm Security Level: Medium (2432 bits) -- Modulus (bits 2432): -- 00:ab:54:98:fc:a9:c6:15:95:9d:a6:c1:94:84:94:91 -- 79:1e:78:db:2d:48:51:99:65:01:02:c0:40:52:49:5d -- eb:70:bc:26:ef:68:39:1e:04:91:e2:db:cb:6f:93:40 -- 45:1e:22:8e:71:5a:58:89:28:79:5e:1a:32:25:3e:8b -- 9d:3b:34:7f:19:f8:d0:2f:37:b7:62:32:b7:53:a5:43 -- 2c:c5:5d:ec:ac:f9:35:fa:14:2b:34:66:f1:d6:a7:a1 -- d0:83:9a:56:f4:19:83:bc:bf:11:74:30:2d:a8:28:5b -- a2:ab:7a:c6:cd:9c:5c:f8:51:e9:a9:0c:48:db:71:bb -- b1:34:77:f7:ee:de:5d:78:c0:48:0a:37:0d:65:1e:3b -- 2b:14:03:89:72:f2:52:ed:5f:00:c5:06:60:ea:80:20 -- d0:43:ec:66:bc:d2:26:db:f0:29:3e:6a:f9:62:20:be -- 58:26:44:ba:d7:8c:6f:76:a6:05:20:e4:98:b7:c4:72 -- 7a:5d:df:4f:0d:23:ec:2e:9c:71:ec:30:f9:14:5f:c8 -- 75:0b:ab:67:f6:7d:fb:4d:76:64:4a:a5:d5:fa:b4:08 -- 50:9d:13:c7:8f:c2:79:b0:b4:3e:2f:89:d3:33:27:4d -- 9f:8b:d3:60:24:07:ab:b2:72:3d:29:a5:c4:4a:ec:3c -- 04:d2:49:3e:26:1b:ec:7a:10:3d:ca:45:5a:80:8b:4d -- 2a:96:63:4f:2d:63:28:0f:3b:47:47:ca:7c:2c:15:41 -- 32:d5:e0:c9:be:a5:55:2c:b3:6b:46:2a:56:b1:1b:ed -- 29 -- Exponent (bits 24): -- 01:00:01 -- Extensions: -- Basic Constraints (critical): -- Certificate Authority (CA): FALSE -- Key Purpose (not critical): -- TLS WWW Client. -- Key Usage (critical): -- Digital signature. -- Key encipherment. -- Subject Key Identifier (not critical): -- 8b01094b3b91ece321b91dec8d6b4c5d9e40805e -- Authority Key Identifier (not critical): -- 482334530a8931384a5aeacab6d2a6dece1d2b18 -- Signature Algorithm: RSA-SHA256 -- Signature: -- 6b:bd:e2:90:d7:11:cf:6c:0d:e3:bd:f4:61:cd:57:83 -- 41:be:2a:92:46:dd:fa:44:6c:60:1c:ef:3e:1e:2f:e1 -- e2:5b:45:88:6a:1e:50:2d:8d:96:c4:c7:80:75:59:7b -- 54:6b:fb:86:b0:f1:6d:45:09:db:48:de:20:0a:87:60 -- 30:5e:35:f0:52:c4:55:44:c1:ff:e1:7c:3d:d6:6d:58 -- ca:1c:fd:bf:04:9a:9b:10:35:05:fc:d1:01:3c:af:bb -- 64:31:5e:59:8f:ef:6f:0d:35:e5:c0:07:77:0e:31:20 -- 8e:e3:2e:f1:a6:4d:f1:be:85:5b:df:04:48:9d:8c:c9 -- c9:c1:b8:e3:e2:d2:4b:55:83:e9:d8:7b:71:2f:8e:89 -- fc:4d:a7:f1:b0:bf:47:9b:97:c4:85:dd:c3:3d:38:15 -- 36:08:73:10:87:08:f6:e6:1c:4e:29:a8:a5:f5:24:b8 -- 0d:e9:d9:b8:19:27:1d:73:35:fe:7b:81:1f:4a:81:6a -- 93:cd:a2:71:d7:60:0e:08:ee:ea:c8:2b:44:1b:e4:45 -- 6c:fe:44:68:d6:86:ad:89:4f:7e:9f:f9:1a:2a:97:0f -- 6b:eb:5d:6e:38:b3:5b:13:b9:e3:4a:10:32:5b:dc:a9 -- b4:a1:4e:b3:f9:4f:91:de:bc:cc:36:91:44:ba:e0:34 -- 74:f7:68:b4:7b:0e:db:4e:ec:28:03:01:cf:0a:63:c4 -- 23:75:0b:4b:41:9d:e0:68:b3:cb:bf:b5:5c:3d:52:93 -- 20:ba:ea:b8:f0:8c:f7:a6:ec:cd:a3:aa:4f:2a:ff:20 --Other Information: -- SHA1 fingerprint: -- 5509a76b8738216938cdb3ec25048812737170de -- SHA256 fingerprint: -- c93e38ef35f1a9c485a27b161e708f2d45bf8768eb53a23fec841a8f35d6e478 -- Public Key ID: -- 8b01094b3b91ece321b91dec8d6b4c5d9e40805e -- Public key's random art: -- +--[ RSA 2432]----+ -- | o=o | -- |..oE.. | -- |.+=.o | -- |o.*.... | -- | * B +..S | -- |. * o oo . | -- | o . . . | -- | + | -- | . | -- +-----------------+ -- - -----BEGIN CERTIFICATE----- --MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD --EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF --AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw --vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF --Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0 --d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm --RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd --E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW --Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB --Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD --VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4 --SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveKQ1xHPbA3jvfRhzVeD --Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg --MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg --juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV --NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF --bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0 --dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g -+MIID2TCCAkGgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowJzEPMA0GA1UEAxMG -+QSB1c2VyMRQwEgYKCZImiZPyLGQBARMEdGVzdDCCAVIwDQYJKoZIhvcNAQEBBQAD -+ggE/ADCCAToCggExAKtUmPypxhWVnabBlISUkXkeeNstSFGZZQECwEBSSV3rcLwm -+72g5HgSR4tvLb5NARR4ijnFaWIkoeV4aMiU+i507NH8Z+NAvN7diMrdTpUMsxV3s -+rPk1+hQrNGbx1qeh0IOaVvQZg7y/EXQwLagoW6KresbNnFz4UempDEjbcbuxNHf3 -+7t5deMBICjcNZR47KxQDiXLyUu1fAMUGYOqAINBD7Ga80ibb8Ck+avliIL5YJkS6 -+14xvdqYFIOSYt8Ryel3fTw0j7C6cceww+RRfyHULq2f2fftNdmRKpdX6tAhQnRPH -+j8J5sLQ+L4nTMydNn4vTYCQHq7JyPSmlxErsPATSST4mG+x6ED3KRVqAi00qlmNP -+LWMoDztHR8p8LBVBMtXgyb6lVSyza0YqVrEb7SkCAwEAAaN1MHMwDAYDVR0TAQH/ -+BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0O -+BBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFAV+KcZC+G2nf/6V -+sElx119oZKWUMA0GCSqGSIb3DQEBCwUAA4IBgQCTOjwtK5sDPFdbWWlScDX9xfNf -+tnqRL22Id6VIRcAiuu6KVAYRNs3Pdv65H9orSaohrBRfWKEqAi51bhvDQvzhbw7u -+881txF+6s0fauArxAUai3e11eCil3gt0JOQVephmPKw6pVq9mMieho5I2SQ8CXoQ -+pSrselGaOTp8CK1r90pn8RGiJrZ3xJu5Yezb3AWCs3IOHhRT1Rc5mFnvs9VVR64h -+Pvlr9yBOf/pBEuylQr00plhsZdLra/nIspsGnOIiuM4eIliP6bQwE06u1LxlCbgB -+CAGTQ86vbO2xT1i8dZeq8TJ72OatmRboUBncaZNIT3rUTZxZYkYhkNtVTKnv/8qq -+LZI23qtcWLEAsc1O0Xva22wjkg5QE06AiWdcwK3f/Qpvj5yO9+PL7X4lP47n5D6m -+t1S6xisKgjo/IP9Wk3mPNaNDN3hZCaFRYEHn4CYrlXHqjg1w7quCKApYzrh5/L1Y -+b9U/qzwF7SatFovndYtf02bjcrHC/TA53IdiQPA= - -----END CERTIFICATE----- -diff --git a/tests/certs/user-cert.pem b/tests/certs/user-cert.pem -index ef5114c..32ab235 100644 ---- a/tests/certs/user-cert.pem -+++ b/tests/certs/user-cert.pem -@@ -1,21 +1,21 @@ - -----BEGIN CERTIFICATE----- --MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD --EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF --AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw --vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF --Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0 --d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm --RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd --E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW --Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB --Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD --VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4 --SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveOQ1xHPbA3jvfRhzVeD --Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg --MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg --juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV --NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF --bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0 --dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g -+MIIDiTCCAkGgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowJzEPMA0GA1UEAxMG -+QSB1c2VyMRQwEgYKCZImiZPyLGQBARMEdGVzdDCCAVIwDQYJKoZIhvcNAQEBBQAD -+ggE/ADCCAToCggExAKtUmPypxhWVnabBlISUkXkeeNstSFGZZQECwEBSSV3rcLwm -+72g5HgSR4tvLb5NARR4ijnFaWIkoeV4aMiU+i507NH8Z+NAvN7diMrdTpUMsxV3s -+rPk1+hQrNGbx1qeh0IOaVvQZg7y/EXQwLagoW6KresbNnFz4UempDEjbcbuxNHf3 -+7t5deMBICjcNZR47KxQDiXLyUu1fAMUGYOqAINBD7Ga80ibb8Ck+avliIL5YJkS6 -+14xvdqYFIOSYt8Ryel3fTw0j7C6cceww+RRfyHULq2f2fftNdmRKpdX6tAhQnRPH -+j8J5sLQ+L4nTMydNn4vTYCQHq7JyPSmlxErsPATSST4mG+x6ED3KRVqAi00qlmNP -+LWMoDztHR8p8LBVBMtXgyb6lVSyza0YqVrEb7SkCAwEAAaN1MHMwDAYDVR0TAQH/ -+BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0O -+BBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4Slrq -+yrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQAp51Ks5DDWVlLB6fMM2NJV80sX -+Rx6U1g6ovA7N5BDQiF6FYzVZECMH3d9nyZssHbkzb6qyO1m58P0cNkVurEH27+Z2 -+xdkNw5bbcvNDVhfVSjwa6nyTLfhf7vOTWaIxGGmffP72PIe87N6QmyCCGG0IXIkO -+kcTAE8IgX6k1mEr1Xy2ZtFVgKjPPLxsixIJ7TEktvJR1RqWQfbsOS8f13lvS1Vhh -+vc+UMbIQnz+jl4qNV/AX7GfpEYiBkbrgcjsggl/KMuwcauhEDdvfIQjcyRbQN36p -+KcVEXDpnG54sAfXAs9Z+adbvmu0ONAMCDuxKCT2eG1SGVrtiT5+7kCMso1eKz/5A -+r1XP0RgCKFExIRYb1elFpLc8wmJbN4qof2zisKG8UajFIHzIGateiu53enNn - -----END CERTIFICATE----- -diff --git a/tests/certs/user-cert.tmpl b/tests/certs/user-cert.tmpl -new file mode 100644 -index 0000000..6a60496 ---- /dev/null -+++ b/tests/certs/user-cert.tmpl -@@ -0,0 +1,7 @@ -+dn = "uid=test,cn=A user" -+tls_www_client -+signing_key -+encryption_key -+expiration_days = -1 -+activation_date = "2013-06-06 14:51:29" -+serial = 0x51d82f14 -diff --git a/tests/cipher-common.sh b/tests/cipher-common.sh -index fb9e2ac..07443a0 100755 ---- a/tests/cipher-common.sh -+++ b/tests/cipher-common.sh -@@ -91,14 +91,14 @@ fi - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ${CSTR} --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ${CSTR} --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ${CSTR} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ${CSTR} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/disconnect-user b/tests/disconnect-user -index 67a016e..bf4c7ab 100755 ---- a/tests/disconnect-user -+++ b/tests/disconnect-user -@@ -77,7 +77,7 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${TMPFILE} ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${TMPFILE} ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 -@@ -85,7 +85,7 @@ fi - - eval $(cat ${TMPFILE}) - echo " * Connecting to ${ADDRESS}:${PORT}..." --( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) -+( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -105,7 +105,7 @@ if test $? != 0;then - fi - - echo " * Re-connecting to obtain cookie after disconnect... " --( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) -+( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) - if test $? = 0;then - echo "Succeeded using the cookie to connect" - exit 1 -diff --git a/tests/disconnect-user2 b/tests/disconnect-user2 -index ef8c3c1..e00cc67 100755 ---- a/tests/disconnect-user2 -+++ b/tests/disconnect-user2 -@@ -75,7 +75,7 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${TMPFILE} ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${TMPFILE} ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 -@@ -83,7 +83,7 @@ fi - - eval $(cat ${TMPFILE}) - echo " * Connecting to ${ADDRESS}:${PORT}..." --( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) -+( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -103,7 +103,7 @@ if test $? != 0;then - fi - - echo " * Re-connecting to obtain cookie after disconnect... " --( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) -+( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) - if test $? = 0;then - echo "Succeeded using the cookie to connect" - exit 1 -diff --git a/tests/drain-server b/tests/drain-server -index be51cd4..808067f 100755 ---- a/tests/drain-server -+++ b/tests/drain-server -@@ -35,7 +35,7 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - if ! test -f ${PIDFILE};then -@@ -48,7 +48,7 @@ kill -15 $(cat $PIDFILE) - sleep 1 - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) && - fail $PID "Server is still listening" - - wait -diff --git a/tests/drain-server-fail b/tests/drain-server-fail -index d61106e..a2c495d 100755 ---- a/tests/drain-server-fail -+++ b/tests/drain-server-fail -@@ -48,7 +48,7 @@ launch_simple_sr_server -d 3 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - if ! test -f ${PIDFILE};then -diff --git a/tests/flowcontrol b/tests/flowcontrol -index fb60f67..7ef6b70 100755 ---- a/tests/flowcontrol -+++ b/tests/flowcontrol -@@ -37,39 +37,39 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with wrong password... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - echo "Connecting to obtain cookie with empty password... " --( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - echo "Connecting to obtain cookie with wrong username... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - # test locked account - - echo "Connecting to obtain cookie with locked account... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - #test special characters - - echo "Connecting to obtain cookie with special password... " --( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with empty password... " --( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - #echo "Normal connection... " --#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || -+#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || - # fail $PID "Could not connect to server" - - if ! test -f ${PIDFILE};then -diff --git a/tests/haproxy-auth b/tests/haproxy-auth -index b653714..5261860 100755 ---- a/tests/haproxy-auth -+++ b/tests/haproxy-auth -@@ -51,7 +51,7 @@ LD_PRELOAD=libsocket_wrapper.so:libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT - wait_server ${HAPID} - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - kill ${HAPID} - fail ${PID} "Could not receive cookie from server" -@@ -66,7 +66,7 @@ LD_PRELOAD=libsocket_wrapper.so:libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT - wait_server ${HAPID} - - echo "Re-connecting to obtain cookie after haproxy restart... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - kill ${HAPID} - fail ${PID} "Could not receive cookie from server" -diff --git a/tests/haproxy-connect b/tests/haproxy-connect -index c42b76c..662c08f 100755 ---- a/tests/haproxy-connect -+++ b/tests/haproxy-connect -@@ -91,14 +91,14 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -135,7 +135,7 @@ set +e - sleep 3 - - echo " * Re-connecting to obtain cookie after haproxy restart... " --( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not receive cookie from server on reconnection" - exit 1 -diff --git a/tests/haproxy-proxyproto b/tests/haproxy-proxyproto -index 70c1390..54e413c 100755 ---- a/tests/haproxy-proxyproto -+++ b/tests/haproxy-proxyproto -@@ -94,14 +94,14 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/haproxy-proxyproto-v1 b/tests/haproxy-proxyproto-v1 -index d274575..f767581 100755 ---- a/tests/haproxy-proxyproto-v1 -+++ b/tests/haproxy-proxyproto-v1 -@@ -94,14 +94,14 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/ipv6-iface b/tests/ipv6-iface -index d5262e5..9b78d5e 100755 ---- a/tests/ipv6-iface -+++ b/tests/ipv6-iface -@@ -70,7 +70,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - wait_server $PID - - echo -n "Connecting to setup interface... " --echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b -+echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/ipv6-small-net b/tests/ipv6-small-net -index 4fc7260..c87b429 100755 ---- a/tests/ipv6-small-net -+++ b/tests/ipv6-small-net -@@ -70,7 +70,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - wait_server $PID - - echo -n "Connecting to setup interface... " --echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b -+echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/json b/tests/json -index 72dd4bf..24c66d8 100755 ---- a/tests/json -+++ b/tests/json -@@ -78,7 +78,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - sleep 4 - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/lz4-compression b/tests/lz4-compression -index 76478cf..405b2a2 100755 ---- a/tests/lz4-compression -+++ b/tests/lz4-compression -@@ -81,14 +81,14 @@ sleep 4 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/lzs-compression b/tests/lzs-compression -index c485df2..eef55f0 100755 ---- a/tests/lzs-compression -+++ b/tests/lzs-compression -@@ -81,14 +81,14 @@ sleep 4 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/multiple-routes b/tests/multiple-routes -index b6cc0c5..63c7614 100755 ---- a/tests/multiple-routes -+++ b/tests/multiple-routes -@@ -39,13 +39,13 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (with certificate)... " --( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null ) || -+( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Re-connecting to get routes... " --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 - - echo ok - -diff --git a/tests/no-route-default b/tests/no-route-default -index 0c6f4f2..6cc68f0 100755 ---- a/tests/no-route-default -+++ b/tests/no-route-default -@@ -43,7 +43,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to get routes... " --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 - - echo ok - -@@ -68,7 +68,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to get routes... " --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 - - echo ok - -diff --git a/tests/no-route-group b/tests/no-route-group -index 59ec2f0..25cfaa6 100755 ---- a/tests/no-route-group -+++ b/tests/no-route-group -@@ -43,7 +43,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to get routes... " --echo "test" | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 -u test --passwd-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 -+echo "test" | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 -u test --passwd-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 - - echo ok - -@@ -68,7 +68,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to get routes... " --echo test | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 --passwd-on-stdin -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 -+echo test | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 --passwd-on-stdin -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 - - echo ok - -diff --git a/tests/ping-leases b/tests/ping-leases -index d97012e..3a43ac5 100755 ---- a/tests/ping-leases -+++ b/tests/ping-leases -@@ -52,12 +52,12 @@ fi - echo "Server started with PID $PID..." - - echo "Connecting to obtain cookie..." --( echo "test" | $OPENCONNECT -q localhost:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | $OPENCONNECT -q localhost:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - - echo "Connecting to ping lease..." --echo "test" | timeout 10 $OPENCONNECT localhost:$PORT -u "test" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true -+echo "test" | timeout 10 $OPENCONNECT localhost:$PORT -u "test" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true - - if test $? != 124;then - fail $PID "Could not connect to server" -diff --git a/tests/radius b/tests/radius -index 859671d..7bc705a 100755 ---- a/tests/radius -+++ b/tests/radius -@@ -98,21 +98,21 @@ sleep 4 - - # Run clients - echo " * Testing wrong username at ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u xxx --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u xxx --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? = 0;then - echo "Connected with incorrect username" - exit 1 - fi - - echo " * Testing wrong password at ${ADDRESS}:${PORT}..." --( echo "xxx" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "xxx" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? = 0;then - echo "Connected with incorrect password" - exit 1 - fi - - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 -@@ -120,7 +120,7 @@ fi - - echo " * Connecting to ${ADDRESS}:${PORT} with special IP..." - USERNAME=test-arb --( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -148,7 +148,7 @@ sleep 3 - - echo " * Connecting to ${ADDRESS}:${PORT}..." - USERNAME=test --( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/radius-config b/tests/radius-config -index 7285091..af9d3f7 100755 ---- a/tests/radius-config -+++ b/tests/radius-config -@@ -123,7 +123,7 @@ sleep 4 - - echo " * Connecting to ${ADDRESS}:${PORT}..." - USERNAME=testtime --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/radius-group b/tests/radius-group -index 1f28cda..9b85889 100755 ---- a/tests/radius-group -+++ b/tests/radius-group -@@ -100,7 +100,7 @@ sleep 4 - - echo " * Tests the radius group functionality" - USERNAME=test-class --( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group2 -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group2 -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -137,7 +137,7 @@ sleep 4 - - echo " * Tests the alt radius group functionality" - USERNAME=test-class --( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group1 -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group1 -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/radius-otp b/tests/radius-otp -index 11c3907..9b4fecb 100755 ---- a/tests/radius-otp -+++ b/tests/radius-otp -@@ -111,7 +111,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - sleep 0.5 - echo "$USERNAME-stage$COUNT" - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b >/dev/null 2>&1) - if test $? != 0; then - echo "Could not connect to server" - exit 1 -@@ -151,7 +151,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - sleep 0.5 - echo "$USERNAME-stage" - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected with wrong username" - exit 1 -@@ -173,7 +173,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - echo "$USERNAME-stage$COUNT" - fi - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected with wrong OTP" - exit 1 -@@ -197,7 +197,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - echo "$USERNAME-stage$COUNT" - fi - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected with wrong OTP" - exit 1 -@@ -218,7 +218,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - echo "$USERNAME-stage$COUNT" - fi - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected with blank OTP" - exit 1 -@@ -247,7 +247,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - echo "$USERNAME-stage$COUNT" - fi - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Successful connection with the number of OTP retries greater than allowed by the ban system (default 30)." - ${OCCTL} -s ${OCCTL_SOCKET} show ip ban points -@@ -265,7 +265,7 @@ for (( COUNT=1; COUNT <= 17; COUNT++ )); do - sleep 0.5 - echo "$USERNAME-stage$COUNT" - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected to server - MAX_CHALLENGES test failed" - exit 1 -diff --git a/tests/test-append-routes b/tests/test-append-routes -index be71d22..923d0aa 100755 ---- a/tests/test-append-routes -+++ b/tests/test-append-routes -@@ -41,7 +41,7 @@ wait_server $PID - - echo "Checking if routes are appended... " - --timeout 15s $OPENCONNECT localhost:$PORT -v --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 -+timeout 15s $OPENCONNECT localhost:$PORT -v --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 - - echo "cat" - cat ${TMPFILE1} -diff --git a/tests/test-ban b/tests/test-ban -index eb6a874..be4695a 100755 ---- a/tests/test-ban -+++ b/tests/test-ban -@@ -59,15 +59,15 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - sleep 4 - - echo "Connecting with wrong password 5 times... " --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - - echo "" - echo "Connecting with correct password... " --eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -n "$COOKIE" ];then - fail $PID "Obtained cookie although should have been banned" -@@ -90,7 +90,7 @@ sleep 25 - echo "" - - echo "Connecting with correct password after ban time... " --eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie even though ban should be lifted" -@@ -99,16 +99,16 @@ fi - echo "" - echo "Checking ban reset time... " - --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - sleep 11 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - - echo "" - echo "Connecting with correct password after ban reset time... " --eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie even though ban should be lifted" -diff --git a/tests/test-ban-local b/tests/test-ban-local -index d2a4397..fbe0eb2 100755 ---- a/tests/test-ban-local -+++ b/tests/test-ban-local -@@ -60,15 +60,15 @@ ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - sleep 4 - - echo "Connecting with wrong password 5 times... " --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - - echo "" - echo "Connecting with correct password... " --eval `echo "test" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie even though client should be exempt" -diff --git a/tests/test-cert b/tests/test-cert -index 41362aa..7967193 100755 ---- a/tests/test-cert -+++ b/tests/test-cert -@@ -49,19 +49,19 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with invalid certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected with invalid certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -80,7 +80,7 @@ kill -HUP $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with DER CRL)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -99,13 +99,13 @@ kill -HUP $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with revoked certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected with revoked certificate!" - - echo "ok (failed as expected)" - - #echo "Normal connection... " --#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || -+#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || - # fail $PID "Could not connect to server" - - rm -f "${CRLNAME}" "${CRLTMPLNAME}" -diff --git a/tests/test-cert-opt-pass b/tests/test-cert-opt-pass -index 18893d3..0109ef2 100755 ---- a/tests/test-cert-opt-pass -+++ b/tests/test-cert-opt-pass -@@ -34,7 +34,7 @@ opts=$1 - pass=$2 - rm -f ${OUTFILE} - --echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 -+echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 - if test $? != 0;then - cat ${OUTFILE} - return 1 -diff --git a/tests/test-client-bypass-protocol b/tests/test-client-bypass-protocol -index 09f3cb2..14cb5a5 100755 ---- a/tests/test-client-bypass-protocol -+++ b/tests/test-client-bypass-protocol -@@ -43,7 +43,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting... " --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 - - echo ok - -@@ -68,7 +68,7 @@ PID=$! - wait_server $PID - - echo -n "Reconnecting..." --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 - - echo ok - -diff --git a/tests/test-config-per-group b/tests/test-config-per-group -index 4a8bd60..6b8929a 100755 ---- a/tests/test-config-per-group -+++ b/tests/test-config-per-group -@@ -81,7 +81,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & - sleep 4 - - echo " * Connecting with user NOT in group..." --( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -129,7 +129,7 @@ sleep 2 - USERNAME=test - PASSWORD=test - echo " * Connecting with user in group to ${ADDRESS}:${PORT}..." --( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/test-cookie-invalidation b/tests/test-cookie-invalidation -index 5f77afa..a6f8cea 100755 ---- a/tests/test-cookie-invalidation -+++ b/tests/test-cookie-invalidation -@@ -35,7 +35,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie" -@@ -44,7 +44,7 @@ fi - #echo "Cookie: $COOKIE" - - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background >/dev/null 2>&1 -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background >/dev/null 2>&1 - - sleep 4 - -@@ -58,9 +58,9 @@ if test $? != 0;then - fi - - echo "Terminating and connecting again with same cookie... " --#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - # fail $PID "Could not connect to server" --echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 -+echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 - - sleep 4 - -@@ -82,9 +82,9 @@ rm -f "${PIDFILE2}" - sleep 18 - - echo "Proper termination and connecting again with same (invalidated) cookie... " --#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - # fail $PID "Could not connect to server" --echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 -+echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 - - sleep 4 - -diff --git a/tests/test-cookie-timeout b/tests/test-cookie-timeout -index 08081b2..b8b4dda 100755 ---- a/tests/test-cookie-timeout -+++ b/tests/test-cookie-timeout -@@ -34,7 +34,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie" -@@ -44,7 +44,7 @@ fi - sleep 16 - echo "" - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background -+echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background - - sleep 4 - -@@ -59,7 +59,7 @@ rm -f "${PIDFILE}" - sleep 16 - echo "" - echo "Connecting again with cookie... " --echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background -+echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background - - sleep 4 - -@@ -74,7 +74,7 @@ rm -f "${PIDFILE}" - sleep 16 - echo "" - echo "Connecting after forced kill with cookie... " --echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background -+echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background - - sleep 4 - -@@ -90,7 +90,7 @@ rm -f "${PIDFILE}" - sleep 45 - echo "" - echo "Connecting with cookie after expiration... " --echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background -+echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background - - sleep 4 - -@@ -104,7 +104,7 @@ fi - # test cookie verification after cookie verification failure. That is to verify whether - # the channel between main and sec-mod is in consistent state. - echo "Connecting (again) to obtain cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - - if test $? != 0;then - fail $PID "Could not obtain cookie" -diff --git a/tests/test-cookie-timeout-2 b/tests/test-cookie-timeout-2 -index fbeba81..4161eb6 100755 ---- a/tests/test-cookie-timeout-2 -+++ b/tests/test-cookie-timeout-2 -@@ -33,7 +33,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie" -@@ -43,7 +43,7 @@ fi - sleep 10 - echo "" - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background -+echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background - - sleep 4 - -@@ -58,7 +58,7 @@ rm -f "${srcdir}/pid2.$$" - sleep 30 - echo "" - echo "Connecting again with cookie (overriding first session)... " --echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background -+echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background - - sleep 6 - -diff --git a/tests/test-enc-key b/tests/test-enc-key -index 0ca6249..5d65b62 100755 ---- a/tests/test-enc-key -+++ b/tests/test-enc-key -@@ -33,7 +33,7 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - cleanup -@@ -48,7 +48,7 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - cleanup -diff --git a/tests/test-explicit-ip b/tests/test-explicit-ip -index bfd1a9d..41d4665 100755 ---- a/tests/test-explicit-ip -+++ b/tests/test-explicit-ip -@@ -31,13 +31,13 @@ connect() - opts=$1 - pass=$2 - COOKIE='' --eval `echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate` -+eval `echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate` - if [ -z "$COOKIE" ];then - return 1 - fi - - rm -f $TMPFILE --echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 & -+echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 & - CPID=$! - - sleep 3 -diff --git a/tests/test-group-pass b/tests/test-group-pass -index 1530f43..7a78237 100755 ---- a/tests/test-group-pass -+++ b/tests/test-group-pass -@@ -33,19 +33,19 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group1 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group1 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with wrong groupname... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group4 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group4 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - cleanup -diff --git a/tests/test-gssapi-opt-cert b/tests/test-gssapi-opt-cert -index 0ef2d55..5cf1105 100755 ---- a/tests/test-gssapi-opt-cert -+++ b/tests/test-gssapi-opt-cert -@@ -29,7 +29,7 @@ opts=$1 - pass=$2 - rm -f ${OUTFILE} - --echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 -+echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 - if test $? != 0;then - cat ${OUTFILE} - return 1 -diff --git a/tests/test-gssapi-opt-pass b/tests/test-gssapi-opt-pass -index 8999d30..b6ebd11 100755 ---- a/tests/test-gssapi-opt-pass -+++ b/tests/test-gssapi-opt-pass -@@ -29,7 +29,7 @@ opts=$1 - pass=$2 - rm -f ${OUTFILE} - --echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 -+echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 - if test $? != 0;then - cat ${OUTFILE} - return 1 -diff --git a/tests/test-iroute b/tests/test-iroute -index d7b5f52..caf0a92 100755 ---- a/tests/test-iroute -+++ b/tests/test-iroute -@@ -34,13 +34,13 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (with certificate)... " --( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -47,7 +47,7 @@ kill -USR2 $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -58,7 +58,7 @@ kill -USR2 $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -diff --git a/tests/test-max-same-1 b/tests/test-max-same-1 -index 5146483..ec19c0d 100755 ---- a/tests/test-max-same-1 -+++ b/tests/test-max-same-1 -@@ -47,7 +47,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - echo "Could not obtain cookie" -@@ -57,12 +57,12 @@ fi - #echo "Cookie: $COOKIE" - - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background - - sleep 4 - - echo "Connecting again with same cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background - - sleep 4 - -diff --git a/tests/test-multi-cookie b/tests/test-multi-cookie -index 83c9cb5..7581f9c 100755 ---- a/tests/test-multi-cookie -+++ b/tests/test-multi-cookie -@@ -47,7 +47,7 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - echo "Could not obtain cookie" -@@ -57,12 +57,12 @@ fi - #echo "Cookie: $COOKIE" - - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background - - sleep 4 - - echo "Connecting again with same cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background - - sleep 4 - -diff --git a/tests/test-multiple-client-ip b/tests/test-multiple-client-ip -index 0e799e0..76099fe 100755 ---- a/tests/test-multiple-client-ip -+++ b/tests/test-multiple-client-ip -@@ -84,14 +84,14 @@ sleep 4 - - # Run client 1 - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -99,14 +99,14 @@ fi - - # Run client 2 - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID2} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID2} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/test-namespace-listen b/tests/test-namespace-listen -index 9691b28..81c3e86 100755 ---- a/tests/test-namespace-listen -+++ b/tests/test-namespace-listen -@@ -77,7 +77,7 @@ if test $? != 0; then - fi - - echo " connecting to server" --(echo "test" | ${CMDNS3} $OPENCONNECT $ADDRESS:$PORT -u "test" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --pid-file=${CLIPID} -b) || -+(echo "test" | ${CMDNS3} $OPENCONNECT $ADDRESS:$PORT -u "test" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --pid-file=${CLIPID} -b) || - fail $PID "could not connect to server" - sleep 5 - -diff --git a/tests/test-otp b/tests/test-otp -index 5209b0a..ed1fe94 100755 ---- a/tests/test-otp -+++ b/tests/test-otp -@@ -45,27 +45,27 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting with wrong username... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u falsetest --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u falsetest --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Connected with wrong username!" - echo ok - - echo -n "Connecting with wrong OTP... " --( echo -e "test\n999482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n999482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Should not have connected with wrong OTP!" - echo ok - - echo -n "Connecting with correct password and OTP... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with OTP!" - echo ok - - echo -n "Connecting with empty password and wrong OTP... " --( echo -e "999999\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "999999\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Should have not connected with wrong OTP!" - echo ok - - echo -n "Connecting with empty password and OTP... " --( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with OTP-only!" - echo ok - -diff --git a/tests/test-otp-cert b/tests/test-otp-cert -index c8dc12c..61a71db 100755 ---- a/tests/test-otp-cert -+++ b/tests/test-otp-cert -@@ -45,22 +45,22 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - echo ok - - echo -n "Connecting to obtain cookie (with incorrect certificate)... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Should not have connected with wrong certificate!" - echo ok - - echo -n "Connecting to obtain cookie (with certificate)... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - echo ok - - echo -n "Connecting to obtain cookie (with no pass and certificate)... " --( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - echo ok - -diff --git a/tests/test-pam b/tests/test-pam -index 8ec787a..561a140 100755 ---- a/tests/test-pam -+++ b/tests/test-pam -@@ -37,22 +37,22 @@ wait_server $PID - - echo "" - echo "Connecting with wrong password... " --( echo -e "testuser\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "testuser\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with wrong cred" - - echo "" - echo "Connecting with empty password... " --( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with wrong cred" - - echo "" - echo "Connecting with wrong username... " --( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with wrong cred" - - echo "" - echo "Connecting with correct password... " --( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ||#>/dev/null 2>&1 ) || -+( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) ||#>/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - cleanup -diff --git a/tests/test-pam-noauth b/tests/test-pam-noauth -index dc8dd3d..1f67371 100755 ---- a/tests/test-pam-noauth -+++ b/tests/test-pam-noauth -@@ -35,19 +35,19 @@ launch_sr_pam_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting with correct password but no PAM user... " --( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u xtest --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u xtest --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with non existing user" - - echo "Connecting with incorrect password (correct in PAM) and existing user... " --( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with non existing user" - - echo "Connecting with empty password (correct in PAM) and existing user... " --( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with non existing user" - - echo "Connecting with correct password and existing user... " --( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ||#>/dev/null 2>&1 ) || -+( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) ||#>/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - cleanup -diff --git a/tests/test-pass b/tests/test-pass -index 9d5484a..5aaaf48 100755 ---- a/tests/test-pass -+++ b/tests/test-pass -@@ -34,39 +34,39 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with wrong password... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - echo "Connecting to obtain cookie with empty password... " --( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - echo "Connecting to obtain cookie with wrong username... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - # test locked account - - echo "Connecting to obtain cookie with locked account... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - #test special characters - - echo "Connecting to obtain cookie with special password... " --( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with empty password... " --( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - #echo "Normal connection... " --#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || -+#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || - # fail $PID "Could not connect to server" - - if ! test -f ${PIDFILE};then -diff --git a/tests/test-pass-cert b/tests/test-pass-cert -index 8050788..8d284b8 100755 ---- a/tests/test-pass-cert -+++ b/tests/test-pass-cert -@@ -34,26 +34,26 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - - echo ok - - echo -n "Connecting to obtain cookie (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie (with incorrect certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Should not have connected with wrong certificate!" - - echo ok - - - #echo "Normal connection... " --#( echo "test" | $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || -+#( echo "test" | $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || - # fail $PID "Could not connect to server" - - cleanup -diff --git a/tests/test-pass-group-cert b/tests/test-pass-group-cert -index ff64993..e559ac6 100755 ---- a/tests/test-pass-group-cert -+++ b/tests/test-pass-group-cert -@@ -33,37 +33,37 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group1 (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - DEFAULT (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup DEFAULT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup DEFAULT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group2 (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group3 (hidden) (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group4 (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group4 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group4 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Got cookie when it shouldn't!" - - echo ok -diff --git a/tests/test-pass-group-cert-no-pass b/tests/test-pass-group-cert-no-pass -index bc39b45..401b24f 100755 ---- a/tests/test-pass-group-cert-no-pass -+++ b/tests/test-pass-group-cert-no-pass -@@ -33,25 +33,25 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 && -+LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 && - fail $PID "Connected without certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group1 (with certificate)... " --LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || -+LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group2 (with certificate)... " --LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || -+LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group3 (hidden) (with certificate)... " --LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || -+LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || - fail $PID "Could not connect with certificate!" - - echo ok -diff --git a/tests/test-pass-opt-cert b/tests/test-pass-opt-cert -index ac9adc1..1836538 100755 ---- a/tests/test-pass-opt-cert -+++ b/tests/test-pass-opt-cert -@@ -38,7 +38,7 @@ connect() - { - opts=$1 - pass=$2 --echo ${pass} | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --passwd-on-stdin --authenticate >${TMPFILE} -+echo ${pass} | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --passwd-on-stdin --authenticate >${TMPFILE} - if test $? != 0;then - cat ${TMPFILE} - return 1 -diff --git a/tests/test-pass-script b/tests/test-pass-script -index 89a4094..0f18551 100755 ---- a/tests/test-pass-script -+++ b/tests/test-pass-script -@@ -67,7 +67,7 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! - wait_server $PID - - echo " * Connecting to obtain cookie with wrong username... " --( echo "tost" | $OPENCONNECT -q localhost:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | $OPENCONNECT -q localhost:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - rm -f ${builddir}/connect.ok -@@ -76,11 +76,11 @@ rm -f ${builddir}/host-update.ok - #test special characters - - echo " * Connecting to obtain cookie... " --( echo "!@#$%^&*()<>" | $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo " * Re-connecting to force script run... " --echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true -+echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true - - TIMEOUT=5 - while ! test -f ${builddir}/disconnect.ok; do -@@ -112,7 +112,7 @@ rm -f ${builddir}/disconnect.ok - rm -f ${builddir}/host-update.ok - - echo " * Re-connecting to get cookie... " --echo "test2" | $OPENCONNECT -q localhost:$PORT -u "test2" --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${PARAMSFILE} -+echo "test2" | $OPENCONNECT -q localhost:$PORT -u "test2" --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${PARAMSFILE} - if test $? != 0;then - echo "Could not connect" - cat ${PARAMSFILE} -@@ -127,7 +127,7 @@ fi - - echo " * Re-connecting to force session stealing... " - eval "$(grep COOKIE ${PARAMSFILE})" --echo ${COOKIE}| $OPENCONNECT --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true --pid-file=${OPIDFILE} -b -+echo ${COOKIE}| $OPENCONNECT --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true --pid-file=${OPIDFILE} -b - - echo " - Pausing client" - TIMEOUT=4 -@@ -156,7 +156,7 @@ rm -f ${builddir}/connect.ok - rm -f ${builddir}/disconnect.ok - - echo " * Re-connecting to steal previous IP address... " --echo ${COOKIE} | $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true --pid-file=${OPIDFILE2} -b -+echo ${COOKIE} | $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true --pid-file=${OPIDFILE2} -b - - echo " - Resuming (disconnected) client" - kill -s CONT $(cat ${OPIDFILE}) -@@ -205,7 +205,7 @@ done - sleep 5 - echo " - Check server status" - --( echo "!@#$%^&*()<>" | $OPENCONNECT --local-hostname='mylocalname' -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | $OPENCONNECT --local-hostname='mylocalname' -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo " - Killing server" -diff --git a/tests/test-replay b/tests/test-replay -index b8aa848..0533893 100755 ---- a/tests/test-replay -+++ b/tests/test-replay -@@ -60,7 +60,7 @@ launch_server -d 9999 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - echo "Could not obtain cookie" -@@ -70,7 +70,7 @@ fi - #echo "Cookie: $COOKIE" - - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --verbose --pid-file "${PIDFILE1}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --verbose --pid-file "${PIDFILE1}" --background - - sleep 4 - -diff --git a/tests/test-san-cert b/tests/test-san-cert -index a5040ae..a41c331 100755 ---- a/tests/test-san-cert -+++ b/tests/test-san-cert -@@ -49,25 +49,25 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with invalid certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected with invalid certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with certificate - no SAN)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected with invalid certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with certificate - SAN)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-san-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-san-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Failed to connect with certificate!" - - echo ok -diff --git a/tests/test-script-multi-user b/tests/test-script-multi-user -index 6327a26..c0bfa3d 100755 ---- a/tests/test-script-multi-user -+++ b/tests/test-script-multi-user -@@ -47,16 +47,16 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to force script block... " --echo "!@#$%^&*()<>" | timeout 60 $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true & -+echo "!@#$%^&*()<>" | timeout 60 $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true & - - sleep 3 - - echo "Connecting to obtain cookie... " --( echo "${USERNAME}" | $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "${USERNAME}" | $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting in background... " --( echo "${USERNAME}" | timeout 15 $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --background >/dev/null 2>&1 ) || -+( echo "${USERNAME}" | timeout 15 $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --background >/dev/null 2>&1 ) || - fail $PID "Could not connect to server; probably blocked" - - sleep 3 -diff --git a/tests/test-sighup b/tests/test-sighup -index add538f..dd424e5 100755 ---- a/tests/test-sighup -+++ b/tests/test-sighup -@@ -34,7 +34,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -44,7 +44,7 @@ kill -HUP $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -57,7 +57,7 @@ kill -HUP $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Could not connect with certificate!" - - echo ok -diff --git a/tests/test-stress b/tests/test-stress -index 3816604..a2db96e 100755 ---- a/tests/test-stress -+++ b/tests/test-stress -@@ -33,7 +33,7 @@ run_client() { - PASS=$1; - shift; - -- ( echo $PASS | $OPENCONNECT -q $HOST -u $USER --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >/dev/null 2>&1 ) || -+ ( echo $PASS | $OPENCONNECT -q $HOST -u $USER --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >/dev/null 2>&1 ) || - echo "$USER: Could not connect to server" - } - -diff --git a/tests/test-udp-listen-host b/tests/test-udp-listen-host -index f3e6623..956938b 100755 ---- a/tests/test-udp-listen-host -+++ b/tests/test-udp-listen-host -@@ -111,7 +111,7 @@ ${CMDNS2} ${HAPROXY} -f ${HACONFIG} -d & HAPID=$! - sleep 3 - - echo " * Connecting to haproxy and using dtls ... " --echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${CLIPID}" --background -+echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${CLIPID}" --background - - wait_file "${CLIPID}" 11 - -@@ -134,7 +134,7 @@ echo "restart ocsev with udp-listen-host set to 127.0.0.1" - ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG_UDP_LISTEN_LOCAL} ${DEBUG} & PID=$! - - echo " * Connecting to haproxy and using dtls again ... " --echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${CLIPID2}" --background -+echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${CLIPID2}" --background - - wait_file "${CLIPID2}" 11 - -diff --git a/tests/test-user-config b/tests/test-user-config -index 1c7f518..f8573ce 100755 ---- a/tests/test-user-config -+++ b/tests/test-user-config -@@ -42,20 +42,20 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (with certificate)... " --( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null ) || -+( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Re-connecting to force script run... " --$OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true /dev/null & -+$OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true /dev/null & - kpid1=$! - echo ok - - sleep 2 - - echo -n "Re-connecting to check the iroutes... " --$OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 & -+$OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 & - kpid2=$! - - echo ok -@@ -63,7 +63,7 @@ sleep 3 - - echo -n "Checking if max-same-clients is considered... " - --timeout 15s $OPENCONNECT localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE2} 2>&1 -+timeout 15s $OPENCONNECT localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE2} 2>&1 - if test $? = 124;then - fail $PID "Max-same-clients directive was ignored" - fi -@@ -155,7 +155,7 @@ rm -f ${TMPFILE1} - rm -f ${TMPFILE2} - - echo -n "Re-connecting to check the ipv4-network... " --$OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 & kpid3=$! -+$OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 & kpid3=$! - - echo ok - sleep 3 -diff --git a/tests/test-vhost b/tests/test-vhost -index 902f011..1a57e60 100755 ---- a/tests/test-vhost -+++ b/tests/test-vhost -@@ -62,7 +62,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to default host to obtain cookie (user without certificate)... " --connect "default.example.com" "-u test" "test" "d66b507ae074d03b02eafca40d35f87dd81049d3" -+connect "default.example.com" "-u test" "test" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" - if test $? != 0;then - fail $PID "Failed to connect with user without certificate!" - fi -@@ -111,7 +111,7 @@ fi - echo ok - - echo -n "Connecting to default host to obtain cookie (with certificate)... " --connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "d66b507ae074d03b02eafca40d35f87dd81049d3" -+connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" - if test $? = 0;then - fail $PID "Connected to wrong host with certificate!" - fi -@@ -136,7 +136,7 @@ kill -HUP $PID - sleep 5 - - echo -n "Sanity check to default host..." --connect "default.example.com" "-u test" "test" "d66b507ae074d03b02eafca40d35f87dd81049d3" -+connect "default.example.com" "-u test" "test" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" - if test $? != 0;then - fail $PID "Failed to connect with user without certificate!" - fi -diff --git a/tests/traffic b/tests/traffic -index 3ea962f..1f0fcaf 100755 ---- a/tests/traffic -+++ b/tests/traffic -@@ -79,14 +79,14 @@ sleep 4 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 diff --git a/ocserv.conf b/ocserv.conf index d5e0814..0ecd600 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -34,7 +34,7 @@ # and all configuration will be read from radius. That also includes the # Acct-Interim-Interval, and Session-Timeout values. # -# See doc/README-radius.md for the supported radius configuration atributes. +# See doc/README-radius.md for the supported radius configuration attributes. # # gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900] # The gssapi option allows one to use authentication methods supported by GSSAPI, @@ -72,25 +72,29 @@ auth = "pam" # Only one accounting method can be specified. #acct = "radius[config=/etc/radiusclient/radiusclient.conf]" -# Use listen-host to limit to specific IPs or to the IPs of a provided +# Use listen-host to limit to specific IPs or to the IPs of a provided # hostname. #listen-host = [IP|HOSTNAME] +# Use udp-listen-host to limit udp to specific IPs or to the IPs of a provided +# hostname. if not set, listen-host will be used +#udp-listen-host = [IP|HOSTNAME] + # When the server has a dynamic DNS address (that may change), # should set that to true to ask the client to resolve again on # reconnects. #listen-host-is-dyndns = true -# Use udp-listen-host to limit udp to specific IPs or to the IPs of a provided -# hostname. if not set, listen-host will be used -#udp-listen-host = [IP|HOSTNAME] +# move the listen socket within the specified network namespace +# listen-netns = "foo" # TCP and UDP port number tcp-port = 443 udp-port = 443 -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). +# The user the worker processes will be run as. This should be a dedicated +# unprivileged user (e.g., 'ocserv') and no other services should run as this +# user. run-as-user = ocserv run-as-group = ocserv @@ -148,7 +152,10 @@ server-key = /etc/pki/ocserv/private/server.key # is set. #ca-cert = /etc/ocserv/ca.pem - +# The number of sub-processes to use for the security module (authentication) +# processes. Typically this should not be set as the number of processes +# is determined automatically by the initially set maximum number of clients. +#sec-mod-scale = 4 ### All configuration options below this line are reloaded on a SIGHUP. @@ -167,7 +174,7 @@ server-key = /etc/pki/ocserv/private/server.key # Note however, that process isolation is restricted to the specific libc versions # the isolation was tested at. If you get random failures on worker processes, try # disabling that option and report the failures you, along with system and debugging -# information at: https://gitlab.com/ocserv/ocserv/issues +# information at: https://gitlab.com/openconnect/ocserv/issues isolate-workers = true # A banner to be displayed on clients after connection @@ -176,7 +183,8 @@ isolate-workers = true # A banner to be displayed on clients before connection #pre-login-banner = "Welcome" -# Limit the number of clients. Unset or set to zero for unlimited. +# Limit the number of clients. Unset or set to zero if unknown. In +# that case the maximum value is ~8k clients. #max-clients = 1024 max-clients = 16 @@ -238,6 +246,10 @@ switch-to-tcp-timeout = 25 # MTU discovery (DPD must be enabled) try-mtu-discovery = false +# To enable load-balancer connection draining, set server-drain-ms to a value +# higher than your load-balancer health probe interval. +#server-drain-ms = 15000 + # If you have a certificate from a CA that provides an OCSP # service you may provide a fresh OCSP status response within # the TLS handshake. That will prevent the client from connecting @@ -294,11 +306,8 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 tls-priorities = "NORMAL:%SERVER_PRECEDENCE" # That option requires the established DTLS channel to use the same -# cipher as the primary TLS channel. This cannot be combined with -# listen-clear-file since the ciphersuite information is not available -# in that configuration. Note also, that this option implies that -# dtls-legacy option is false; this option cannot be enforced -# in the legacy/compat protocol. +# cipher as the primary TLS channel.Note also, that this option implies +# that the dtls-legacy option is false; this option cannot be enforced #match-tls-dtls-ciphers = true # The time (in seconds) that a client is allowed to stay connected prior @@ -327,11 +336,9 @@ min-reauth-time = 300 # that get a score over that configured number are banned for # min-reauth-time seconds. By default a wrong password attempt is 10 points, # a KKDCP POST is 1 point, and a connection is 1 point. Note that -# due to difference processes being involved the count of points -# will not be real-time precise. -# -# Score banning cannot be reliably used when receiving proxied connections -# locally from an HTTP server (i.e., when listen-clear-file is used). +# due to different processes being involved the count of points +# will not be real-time precise. Local subnet IPs are exempt to allow +# services that check for process health. # # Set to zero to disable. max-ban-score = 80 @@ -381,7 +388,8 @@ rekey-method = ssl # Script to call when a client connects and obtains an IP. # The following parameters are passed on the environment. # REASON, VHOST, USERNAME, GROUPNAME, DEVICE, IP_REAL (the real IP of the client), -# IP_REAL_LOCAL (the local interface IP the client connected), IP_LOCAL +# REMOTE_HOSTNAME (the remotely advertised hostname), IP_REAL_LOCAL +# (the local interface IP the client connected), IP_LOCAL # (the local IP in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # IPV6_LOCAL (the IPv6 local address if there are both IPv4 and IPv6 # assigned), IPV6_REMOTE (the IPv6 remote address), IPV6_PREFIX, and @@ -400,6 +408,12 @@ rekey-method = ssl #connect-script = /usr/bin/ocserv-script #disconnect-script = /usr/bin/ocserv-script +# This script is to be called when the client's advertised hostname becomes +# available. It will contain REASON with "host-update" value and the +# variable REMOTE_HOSTNAME in addition to the connect variables. + +#host-update-script = /usr/bin/myhostnamescript + # UTMP # Register the connected clients to utmp. This will allow viewing # the connected clients using the command 'who'. @@ -412,6 +426,20 @@ use-occtl = true # PID file. It can be overridden in the command line. pid-file = /var/run/ocserv.pid +# Log Level. Ocserv sends the logging messages to standard error +# as well as the system log. The log level can be overridden in the +# command line with the -d option. All messages at the configured +# level and lower will be displayed. +# Supported levels (default 0): +# 0 default (Same as basic) +# 1 basic +# 2 info +# 3 debug +# 4 http +# 8 sensitive +# 9 TLS +log-level = 1 + # Set the protocol-defined priority (SO_PRIORITY) for packets to # be sent. That is a number from 0 to 6 with 0 being the lowest # priority. Alternatively this can be used to set the IP Type- @@ -434,7 +462,8 @@ device = vpns # same for the same user when possible. predictable-ips = true -# The default domain to be advertised +# The default domain to be advertised. Multiple domains (functional on +# openconnect clients) can be provided in a space separated list. default-domain = example.com # The pool of addresses that leases will be given from. If the leases @@ -561,10 +590,10 @@ no-route = 192.168.5.0/255.255.255.0 # per group. Each file name on these directories must match the username # or the groupname. # The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, no-route, -# explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, +# ipv?-network, ipv4-netmask, rx/tx-data-per-sec, iroute, route, no-route, +# explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, # keepalive, dpd, mobile-dpd, max-same-clients, tunnel-all-dns, -# restrict-user-to-routes, user-profile, cgroup, stats-report-time, +# restrict-user-to-routes, cgroup, stats-report-time, # mtu, idle-timeout, mobile-idle-timeout, restrict-user-to-ports, # split-dns and session-timeout. # @@ -628,10 +657,13 @@ no-route = 192.168.5.0/255.255.255.0 # # # Other fields may be used by some of the CISCO clients. -# This file must be accessible from inside the worker's chroot. -# Note that enabling this option is not recommended as it will allow -# the worker processes to open arbitrary files (when isolate-workers is -# set to true). +# This file must be accessible from inside the worker's chroot. +# Note that: +# (1) enabling this option is not recommended as it will allow the +# worker processes to open arbitrary files (when isolate-workers is +# set to true). +# (2) This option cannot be set per-user or per-group; only the global +# version is being sent to client. #user-profile = profile.xml # @@ -657,6 +689,35 @@ cisco-client-compat = true # by the dtls-psk protocol supported by openconnect 7.08+. dtls-legacy = true +# This option will enable the settings needed for Cisco SVC IPPhone clients +# to connect. It implies dtls-legacy = true and tls-priorities is changed to +# only the ciphers the device supports. +cisco-svc-client-compat = false + +# This option will enable the X-CSTP-Client-Bypass-Protocol (disabled by default). +# If the server has not configured an IPv6 or IPv4 address pool, enabling this option +# will instruct the client to bypass the server for that IP protocol. The option is +# currently only understood by Anyconnect clients. +client-bypass-protocol = false + +# The following options are related to server camouflage (hidden service) + +# This option allows you to enable the camouflage feature of ocserv that makes it look +# like a web server to unauthorized parties. +# With "camouflage" enabled, connection to the VPN can be established only if the client provided a specific +# "secret string" in the connection URL, e.g. "https://example.com/?mysecretkey", +# otherwise the server will return HTTP error for all requests. +camouflage = false + +# The URL prefix that should be set on the client (after '?' sign) to pass through the camouflage check, +# e.g. in case of 'mysecretkey', the server URL on the client should be like "https://example.com/?mysecretkey". +camouflage_secret = "mysecretkey" + +# Defines the realm (browser prompt) for HTTP authentication. +# If no realm is set, the server will return 404 Not found error instead of 401 Unauthorized. +# Better change it from the default value to avoid fingerprinting. +camouflage_realm = "Restricted Content" + #Advanced options # Option to allow sending arbitrary custom headers to the client after @@ -669,8 +730,8 @@ dtls-legacy = true -## An example virtual host with different authentication methods serviced -## by this server. +# An example virtual host with different authentication methods serviced +# by this server. #[vhost:www.example.com] #auth = "certificate" @@ -687,3 +748,18 @@ dtls-legacy = true #ipv4-netmask = 255.255.255.0 #cert-user-oid = 0.9.2342.19200300.100.1.1 + +# HTTP headers +included-http-headers = Strict-Transport-Security: max-age=31536000 ; includeSubDomains +included-http-headers = X-Frame-Options: deny +included-http-headers = X-Content-Type-Options: nosniff +included-http-headers = Content-Security-Policy: default-src 'none' +included-http-headers = X-Permitted-Cross-Domain-Policies: none +included-http-headers = Referrer-Policy: no-referrer +included-http-headers = Clear-Site-Data: "cache","cookies","storage" +included-http-headers = Cross-Origin-Embedder-Policy: require-corp +included-http-headers = Cross-Origin-Opener-Policy: same-origin +included-http-headers = Cross-Origin-Resource-Policy: same-origin +included-http-headers = X-XSS-Protection: 0 +included-http-headers = Pragma: no-cache +included-http-headers = Cache-control: no-store, no-cache diff --git a/ocserv.spec b/ocserv.spec index 8f2b22b..1a72762 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.1.7 +Version: 1.2.0 Release: %autorelease %global _hardened_build 1 @@ -38,8 +38,6 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -# When removed remove the autoreconf step -Patch0: expired-certs.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -141,8 +139,6 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %endif %autosetup -p1 -# temporarily needed to apply patches -autoreconf -fvi rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) @@ -152,9 +148,6 @@ touch src/*.proto rm -rf src/ccan/talloc sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config -# GPLv3 in headers is a gnulib bug: -# http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html -sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c @@ -199,7 +192,8 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} VERBOSE=1 +# The 1.2.0 release has a missing file +make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" %if %{use_systemd} %post @@ -254,7 +248,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/ocserv %config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml -%doc AUTHORS ChangeLog NEWS COPYING COPYING README.md PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING README.md PACKAGE-LICENSING doc/README-radius.md %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* diff --git a/sources b/sources index 30fa688..bd969b3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.7.tar.xz) = 5b6182b98c0406a27dae7121ec0d8771b158e0d8ce2056bd35451c8ed087a8b7f7d40035f9db5c19aa9a9a3b2c6b07be8f0bad4b6b96569584815a5358202ba4 -SHA512 (ocserv-1.1.7.tar.xz.sig) = 96d2562fdf918f2b6ea829d747330a3be2e015ab25897e01bd0d387cb69ef3592aacabbeec9612e95eca1fbce6178a176dbf76d553b7626c09d453d216ddd63d +SHA512 (ocserv-1.2.0.tar.xz) = 23edd48313cb4988cea1e2493ab65784c7a39a062798e1ffd380b6de5629e69bd71ded863eb7a0c9fe1bac3cc2db23014cdedbd5d15801e2a66d5ef4e3f28ffb +SHA512 (ocserv-1.2.0.tar.xz.sig) = 1d8ac24c97c6495adc070f7b24553715ff27e6a9937a020522904559f4c48f3e18ca712b80762d55c285ce8f99eb4cd9a84b2875a351eb1df1ef6c705c5d3199 From 0d6a1f1a428aaffbbaf37750b798246e483a8468 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 18 Jul 2023 20:43:09 +0200 Subject: [PATCH 170/195] Added packit integration --- .packit.yaml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .packit.yaml diff --git a/.packit.yaml b/.packit.yaml new file mode 100644 index 0000000..3902f72 --- /dev/null +++ b/.packit.yaml @@ -0,0 +1,25 @@ +upstream_project_url: https://gitlab.com/openconnect/ocserv +issue_repository: https://gitlab.com/openconnect/ocserv +copy_upstream_release_description: true + +jobs: +- job: pull_from_upstream + trigger: release + dist_git_branches: + - fedora-all + - epel-8 + - epel-9 + +- job: koji_build + trigger: commit + dist_git_branches: + - fedora-all + - epel-8 + - epel-9 + +- job: bodhi_update + trigger: commit + dist_git_branches: + - fedora-branched # rawhide updates are created automatically + - epel-8 + - epel-9 From ca1630fd18e366f0eefc4ae3ff1a385685bf054d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 17:39:51 +0000 Subject: [PATCH 171/195] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering From e9edd55d41cd6497e0ff6ae709ad99d6a4999446 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Aug 2023 19:16:12 +0200 Subject: [PATCH 172/195] use %systemd_postun_with_restart Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 1a72762..a44cf9c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -203,7 +203,7 @@ make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" %systemd_preun ocserv.service %postun -%systemd_postun ocserv.service +%systemd_postun_with_restart ocserv.service %endif %install From 9433e7b6230e0767e1094ca25e974629e7d4906e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 22 Aug 2023 19:31:54 +0200 Subject: [PATCH 173/195] updated URIs of source --- ocserv.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index a44cf9c..f940294 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -27,8 +27,8 @@ Summary: OpenConnect SSL VPN server # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPLv2+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ -Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz -Source1: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig +Source0: https://www.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz +Source1: https://www.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg Source3: ocserv.conf Source4: ocserv.service From 95752d9463d8fc6888b80dfd0753845f23dc8254 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 23 Aug 2023 09:21:15 +0200 Subject: [PATCH 174/195] corrected download link --- ocserv.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index f940294..63ec528 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -27,8 +27,8 @@ Summary: OpenConnect SSL VPN server # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPLv2+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ -Source0: https://www.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz -Source1: https://www.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig +Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz +Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg Source3: ocserv.conf Source4: ocserv.service From ec00a93d97ea686a71a447d3258ff2635d8c5018 Mon Sep 17 00:00:00 2001 From: Packit Date: Wed, 23 Aug 2023 07:24:35 +0000 Subject: [PATCH 175/195] [packit] 1.2.1 upstream release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream tag: 1.2.1 Upstream commit: 895a23f3 If you need to do any change in this pull request, you need to locally fetch the source branch of it and push it (with a fix) to your fork (as it is not possible to push to the branch created in the Packit’s fork): ``` git fetch https://src.fedoraproject.org/forks/packit/rpms/ocserv.git refs/heads/*:refs/remotes/packit/* git checkout packit/1.2.1-rawhide-update-pull_from_upstream ``` --- .gitignore | 2 ++ README.packit | 3 +++ ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 8 insertions(+), 3 deletions(-) create mode 100644 README.packit diff --git a/.gitignore b/.gitignore index 2113177..1b89049 100644 --- a/.gitignore +++ b/.gitignore @@ -241,3 +241,5 @@ /ocserv-1.1.7.tar.xz.sig /ocserv-1.2.0.tar.xz /ocserv-1.2.0.tar.xz.sig +/ocserv-1.2.1.tar.xz +/ocserv-1.2.1.tar.xz.sig diff --git a/README.packit b/README.packit new file mode 100644 index 0000000..797aefb --- /dev/null +++ b/README.packit @@ -0,0 +1,3 @@ +This repository is maintained by packit. +https://packit.dev/ +The file was generated using packit 0.79.0.post2+g93f33d9. diff --git a/ocserv.spec b/ocserv.spec index 63ec528..67ea6c7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.0 +Version: 1.2.1 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index bd969b3..b336b2f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.0.tar.xz) = 23edd48313cb4988cea1e2493ab65784c7a39a062798e1ffd380b6de5629e69bd71ded863eb7a0c9fe1bac3cc2db23014cdedbd5d15801e2a66d5ef4e3f28ffb -SHA512 (ocserv-1.2.0.tar.xz.sig) = 1d8ac24c97c6495adc070f7b24553715ff27e6a9937a020522904559f4c48f3e18ca712b80762d55c285ce8f99eb4cd9a84b2875a351eb1df1ef6c705c5d3199 +SHA512 (ocserv-1.2.1.tar.xz) = 13cc0dc33cced3c020a754414ce6f4f6c210875b75264528b2ba7b62c07416c30db1549f2efdad6f5f01b3156a23379243c7d761b3164db9741929ec8e001c93 +SHA512 (ocserv-1.2.1.tar.xz.sig) = de1a4ec354d48834901e98f165d9f25b5a3a19f7b81194b728dac19d93198a8ddd8b692cb266fe3a707523a8d936403f171c3f33ed8293ff20a5eda9d3abc912 From 9a1b8aec554f33bf5406302397d1daef27d47eee Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 23 Aug 2023 09:47:54 +0200 Subject: [PATCH 176/195] make check: no longer use xfail for missing file --- ocserv.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 67ea6c7..6ca2228 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -192,8 +192,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -# The 1.2.0 release has a missing file -make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" +make check %{?_smp_mflags} VERBOSE=1 %if %{use_systemd} %post From acf2636e4a2c5de4f7b7671aed54f0a823ba696b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 29 Aug 2023 11:00:27 +0200 Subject: [PATCH 177/195] config: increased log level to 3 Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.conf b/ocserv.conf index 0ecd600..0e63981 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -438,7 +438,7 @@ pid-file = /var/run/ocserv.pid # 4 http # 8 sensitive # 9 TLS -log-level = 1 +log-level = 3 # Set the protocol-defined priority (SO_PRIORITY) for packets to # be sent. That is a number from 0 to 6 with 0 being the lowest From 79e827501fbc1867c97666fad825a65dad2380c6 Mon Sep 17 00:00:00 2001 From: Packit Date: Thu, 21 Sep 2023 19:44:09 +0000 Subject: [PATCH 178/195] [packit] 1.2.2 upstream release Upstream tag: 1.2.2 Upstream commit: f6164756 --- .gitignore | 2 ++ README.packit | 2 +- ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 1b89049..4fa485b 100644 --- a/.gitignore +++ b/.gitignore @@ -243,3 +243,5 @@ /ocserv-1.2.0.tar.xz.sig /ocserv-1.2.1.tar.xz /ocserv-1.2.1.tar.xz.sig +/ocserv-1.2.2.tar.xz +/ocserv-1.2.2.tar.xz.sig diff --git a/README.packit b/README.packit index 797aefb..ce6b9b9 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.79.0.post2+g93f33d9. +The file was generated using packit 0.80.0.post35+g9430d702. diff --git a/ocserv.spec b/ocserv.spec index 6ca2228..ff70f88 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.1 +Version: 1.2.2 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index b336b2f..58e8472 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.1.tar.xz) = 13cc0dc33cced3c020a754414ce6f4f6c210875b75264528b2ba7b62c07416c30db1549f2efdad6f5f01b3156a23379243c7d761b3164db9741929ec8e001c93 -SHA512 (ocserv-1.2.1.tar.xz.sig) = de1a4ec354d48834901e98f165d9f25b5a3a19f7b81194b728dac19d93198a8ddd8b692cb266fe3a707523a8d936403f171c3f33ed8293ff20a5eda9d3abc912 +SHA512 (ocserv-1.2.2.tar.xz) = f1a55d2d849aadadcae6ea792845531d4fe71a3d7defad353a961828ddea74faa85a7d6b8de64a5fce115b14ea00f87755f01833cf31550532b1c52a02bd1fb0 +SHA512 (ocserv-1.2.2.tar.xz.sig) = e3a159d76b5651c99487546681657cdb008d50d86647bf2df1034dc6936720d0db9566490958a9d79ad4a68b122b1d19021e0c849d72a0ab3277d777b9e1ddb7 From e6f6c537c313505f39d43ccd538412c131ab2525 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 21 Sep 2023 21:55:46 +0200 Subject: [PATCH 179/195] explicitly set package name in packit --- .packit.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.packit.yaml b/.packit.yaml index 3902f72..b3ac8a0 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -1,6 +1,7 @@ upstream_project_url: https://gitlab.com/openconnect/ocserv issue_repository: https://gitlab.com/openconnect/ocserv copy_upstream_release_description: true +downstream_package_name: ocserv jobs: - job: pull_from_upstream From 1ea8c5c3f424bbd80aff6b81b16d274b40982b0f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 13 Oct 2023 22:00:20 +0200 Subject: [PATCH 180/195] Use the SPDX identifiers for license --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ff70f88..044934f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -25,7 +25,7 @@ Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. -License: GPLv2+ and BSD and MIT and CC0 +License: GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0 URL: http://www.infradead.org/ocserv/ Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig From 1a032ccb5d0d119571906266bdefb3b46892b55b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 10:38:32 +0000 Subject: [PATCH 181/195] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 72eba2e3ca135c9a18a8304438b860283f8b043a Mon Sep 17 00:00:00 2001 From: Packit Date: Wed, 24 Jan 2024 22:32:00 +0000 Subject: [PATCH 182/195] [packit] 1.2.4 upstream release Upstream tag: 1.2.4 Upstream commit: 7ced730f --- .gitignore | 2 ++ README.packit | 2 +- ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 4fa485b..7d9002b 100644 --- a/.gitignore +++ b/.gitignore @@ -245,3 +245,5 @@ /ocserv-1.2.1.tar.xz.sig /ocserv-1.2.2.tar.xz /ocserv-1.2.2.tar.xz.sig +/ocserv-1.2.4.tar.xz +/ocserv-1.2.4.tar.xz.sig diff --git a/README.packit b/README.packit index ce6b9b9..bba9424 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.80.0.post35+g9430d702. +The file was generated using packit 0.89.0.post1.dev4+gabf90471. diff --git a/ocserv.spec b/ocserv.spec index 044934f..d33856e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.2 +Version: 1.2.4 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index 58e8472..b51fe99 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.2.tar.xz) = f1a55d2d849aadadcae6ea792845531d4fe71a3d7defad353a961828ddea74faa85a7d6b8de64a5fce115b14ea00f87755f01833cf31550532b1c52a02bd1fb0 -SHA512 (ocserv-1.2.2.tar.xz.sig) = e3a159d76b5651c99487546681657cdb008d50d86647bf2df1034dc6936720d0db9566490958a9d79ad4a68b122b1d19021e0c849d72a0ab3277d777b9e1ddb7 +SHA512 (ocserv-1.2.4.tar.xz) = 202c7045bea1b7a10bd711d9b1b23f5437da9ff71fde0577137c8059ea68956c8cc294f3d23f041bda7b0fb0ae292577a99101554a12206177f5a1f5ca16ea3b +SHA512 (ocserv-1.2.4.tar.xz.sig) = b2c287e0398eb55571a04e0b0ae16f2b5636c136f467b41872c9bdfd8bd8b25aa541022a6c8b337b0d160f4f673076d03358c7c0259ec4554d604cf31e7f36d3 From 589cf4fe6b41eae178018c38f4cefd32ba9a8849 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 25 Jan 2024 08:56:12 +0100 Subject: [PATCH 183/195] spec: added ipcalc and updated the location of ocserv-fw Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index d33856e..4b43e8c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -49,30 +49,19 @@ BuildRequires: gnutls30-devel %else BuildRequires: gnutls-devel %endif -BuildRequires: pam-devel -BuildRequires: iproute -BuildRequires: openconnect -BuildRequires: gnutls-utils +BuildRequires: pam-devel, iproute, ipcalc, openconnect, gnutls-utils %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel %endif -BuildRequires: libnl3-devel -BuildRequires: krb5-devel -BuildRequires: libtasn1-devel -BuildRequires: gperf -BuildRequires: libtalloc-devel -BuildRequires: libev-devel -BuildRequires: http-parser-devel +BuildRequires: libnl3-devel, krb5-devel, libtasn1-devel, gperf, libtalloc-devel +BuildRequires: libev-devel, http-parser-devel, radcli-devel, lz4-devel, readline-devel +BuildRequires: automake, autoconf %if %{use_libwrap} BuildRequires: tcp_wrappers-devel %endif -BuildRequires: automake, autoconf -BuildRequires: radcli-devel -BuildRequires: lz4-devel -BuildRequires: readline-devel %if %{use_geoip} BuildRequires: GeoIP-devel %else @@ -256,7 +245,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %{_bindir}/ocpasswd %{_bindir}/occtl -%{_bindir}/ocserv-fw +%{_libexecdir}/ocserv-fw %{_bindir}/ocserv-script %{_sbindir}/ocserv %{_sbindir}/ocserv-worker From 323c089d8200ba93de9fc73e7d305824ca302905 Mon Sep 17 00:00:00 2001 From: Packit Date: Sun, 5 May 2024 20:21:54 +0000 Subject: [PATCH 184/195] Update to 1.3.0 upstream release - Resolves: rhbz#2279186 Upstream tag: 1.3.0 Upstream commit: 92dba6e4 Commit authored by Packit automation (https://packit.dev/) --- .gitignore | 2 ++ README.packit | 2 +- ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7d9002b..0c67db0 100644 --- a/.gitignore +++ b/.gitignore @@ -247,3 +247,5 @@ /ocserv-1.2.2.tar.xz.sig /ocserv-1.2.4.tar.xz /ocserv-1.2.4.tar.xz.sig +/ocserv-1.3.0.tar.xz +/ocserv-1.3.0.tar.xz.sig diff --git a/README.packit b/README.packit index bba9424..066b312 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.89.0.post1.dev4+gabf90471. +The file was generated using packit 0.95.0.post1.dev8+gce6bd577. diff --git a/ocserv.spec b/ocserv.spec index 4b43e8c..bbb5b68 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.4 +Version: 1.3.0 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index b51fe99..4426293 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.4.tar.xz) = 202c7045bea1b7a10bd711d9b1b23f5437da9ff71fde0577137c8059ea68956c8cc294f3d23f041bda7b0fb0ae292577a99101554a12206177f5a1f5ca16ea3b -SHA512 (ocserv-1.2.4.tar.xz.sig) = b2c287e0398eb55571a04e0b0ae16f2b5636c136f467b41872c9bdfd8bd8b25aa541022a6c8b337b0d160f4f673076d03358c7c0259ec4554d604cf31e7f36d3 +SHA512 (ocserv-1.3.0.tar.xz) = 24c3129b389fa767ad14f158580d8abd6830e697162b8fcfe3df6a4d21d543460c1955c3e0c63fecb8b4b01bd2492254d3eea8d5ba60d864cea314325badda7e +SHA512 (ocserv-1.3.0.tar.xz.sig) = dd6a2e6f28a512bda19e758b32149cfe7951151edab8c34ac371dbcd17eed4a8b10fdfee306629c1d42c2a3e22bcfe523ee2aafb84d59181d5be719c399cfb7d From dd77e0d1691e0cab6c189409c9fd9b58f82ec26e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 6 May 2024 08:21:15 +0200 Subject: [PATCH 185/195] add llhttp dependency Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index bbb5b68..656cfa0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -56,7 +56,7 @@ BuildRequires: protobuf-c-devel %endif BuildRequires: libnl3-devel, krb5-devel, libtasn1-devel, gperf, libtalloc-devel -BuildRequires: libev-devel, http-parser-devel, radcli-devel, lz4-devel, readline-devel +BuildRequires: libev-devel, llhttp-devel, radcli-devel, lz4-devel, readline-devel BuildRequires: automake, autoconf %if %{use_libwrap} @@ -129,7 +129,6 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %autosetup -p1 -rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ touch src/*.proto From 324fe9b5f41a685fcb4860fc513783148f23a082 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 6 May 2024 08:26:18 +0200 Subject: [PATCH 186/195] Updated project URI --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 656cfa0..5a2221a 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -26,7 +26,7 @@ Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0 -URL: http://www.infradead.org/ocserv/ +URL: http://ocserv.openconnect-vpn.net/ Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg From 2a60a76b0b2649d9a8d4917d721a8ab0b9cf54a1 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 6 May 2024 08:34:49 +0200 Subject: [PATCH 187/195] URI: corrected Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 5a2221a..5663985 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -26,7 +26,7 @@ Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0 -URL: http://ocserv.openconnect-vpn.net/ +URL: https://ocserv.openconnect-vpn.net/ Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg From 5817038376fc5d7ce07bf8a918ea3c45eccc8ba0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 20:29:03 +0000 Subject: [PATCH 188/195] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 2f4d19486046c52c616d52694f80ee8b40392491 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 21:15:56 +0000 Subject: [PATCH 189/195] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From e45ab8cbe6d421eca94ca54de371845f3f1a8b8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:56:09 +0100 Subject: [PATCH 190/195] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 5663985..d7bf29d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -43,6 +43,7 @@ Source11: ocserv.init # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 BuildRequires: make +BuildRequires: libxcrypt-devel BuildRequires: gcc %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel From 470ea11ba7286796e5d558b289b81c6f2b328d53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 15:53:26 +0100 Subject: [PATCH 191/195] Add sysusers.d config file to allow rpm to create users/groups automatically See https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers. --- ocserv.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index d7bf29d..30aacd9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -101,7 +101,6 @@ BuildRequires: rubygem-ronn-ng Recommends: gnutls-utils Recommends: iproute Recommends: pam -Requires(pre): shadow-utils %if %{use_systemd} Requires(post): systemd Requires(preun): systemd @@ -142,6 +141,11 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config echo "int main() { return 77; }" > tests/valid-hostname.c %endif +# Create a sysusers.d config file +cat >ocserv.sysusers.conf </dev/null || groupadd -r ocserv -getent passwd ocserv &>/dev/null || \ - /usr/sbin/useradd -r -g ocserv -s /sbin/nologin -c ocserv \ - -d %{_localstatedir}/lib/ocserv ocserv mkdir -p %{_sysconfdir}/pki/ocserv/public mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts @@ -226,6 +226,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %make_install +install -m0644 -D ocserv.sysusers.conf %{buildroot}%{_sysusersdir}/ocserv.conf + %files %defattr(-,root,root,-) @@ -256,6 +258,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %else %{_initrddir}/%{name} %endif +%{_sysusersdir}/ocserv.conf %changelog %autochangelog From ae84a30d03bd0bf3a2109e55de2066dd4482d34b Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Sun, 18 May 2025 07:09:54 -0400 Subject: [PATCH 192/195] Rebuilt for llhttp 9.3.0 From 32d376716d2d796be925b24c4c5498c921ee4298 Mon Sep 17 00:00:00 2001 From: indeo mail Date: Wed, 23 Jul 2025 11:13:11 +0000 Subject: [PATCH 193/195] Update ocserv-genkey OCServ genkey is a good tool in OCServ The default key type of certtool is rsa, but rsa may not be a good choice I tried to add a logic to the ocserv genkey. The key type can be determined according to the parameters. If there is no input parameter, it will be generated according to the default rsa, which does not conflict with the previous use logic. After installing OCSERV, I can directly run `ocserv-genkey ecdsa` to generate ecdsa based certificates. --- ocserv-genkey | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/ocserv-genkey b/ocserv-genkey index 924aab9..8cfc320 100755 --- a/ocserv-genkey +++ b/ocserv-genkey @@ -1,9 +1,25 @@ #!/bin/sh +#default key type:rsa +KEY_TYPE="rsa" + +#check key type 'rsa', 'rsa-pss', 'dsa', 'ecdsa', 'ed25519, 'ed448', 'x25519', and 'x448' +if [ $# -gt 0 ]; then + case "$1" in + rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448) + KEY_TYPE="$1" + ;; + *) + echo "Usage: $0 [rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448]" + echo "Default key type: rsa" + exit 1 + ;; + esac +fi #generate CA certificate/key if test ! -f /etc/pki/ocserv/private/ca.key;then mkdir -p /etc/pki/ocserv/private -certtool --generate-privkey --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1 +certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1 echo "cn=`hostname -f` CA" >/etc/pki/ocserv/ca.tmpl echo "expiration_days=-1" >>/etc/pki/ocserv/ca.tmpl echo "serial=1" >>/etc/pki/ocserv/ca.tmpl @@ -17,7 +33,7 @@ fi #generate server certificate/key if test ! -f /etc/pki/ocserv/private/server.key;then -certtool --generate-privkey --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1 +certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1 echo "cn=`hostname -f`" >/etc/pki/ocserv/server.tmpl echo "serial=2" >>/etc/pki/ocserv/server.tmpl echo "expiration_days=-1" >>/etc/pki/ocserv/server.tmpl From f7c89057b3b761b7ecac30011e8bd9e0d4502abb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 23:23:30 +0000 Subject: [PATCH 194/195] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 26e4189551072a985626f903b3b66651905b4425 Mon Sep 17 00:00:00 2001 From: Packit Date: Sun, 4 Jan 2026 15:15:35 +0000 Subject: [PATCH 195/195] Update to 1.4.0 upstream release - Resolves: rhbz#2427015 Upstream tag: 1.4.0 Upstream commit: 5f5ac6fe Commit authored by Packit automation (https://packit.dev/) --- .gitignore | 2 ++ README.packit | 2 +- ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0c67db0..c97bec0 100644 --- a/.gitignore +++ b/.gitignore @@ -249,3 +249,5 @@ /ocserv-1.2.4.tar.xz.sig /ocserv-1.3.0.tar.xz /ocserv-1.3.0.tar.xz.sig +/ocserv-1.4.0.tar.xz +/ocserv-1.4.0.tar.xz.sig diff --git a/README.packit b/README.packit index 066b312..9bb65f0 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.95.0.post1.dev8+gce6bd577. +The file was generated using packit 1.13.0.post1.dev2+g84134016c. diff --git a/ocserv.spec b/ocserv.spec index 30aacd9..55f1520 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.3.0 +Version: 1.4.0 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index 4426293..bc50de1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.3.0.tar.xz) = 24c3129b389fa767ad14f158580d8abd6830e697162b8fcfe3df6a4d21d543460c1955c3e0c63fecb8b4b01bd2492254d3eea8d5ba60d864cea314325badda7e -SHA512 (ocserv-1.3.0.tar.xz.sig) = dd6a2e6f28a512bda19e758b32149cfe7951151edab8c34ac371dbcd17eed4a8b10fdfee306629c1d42c2a3e22bcfe523ee2aafb84d59181d5be719c399cfb7d +SHA512 (ocserv-1.4.0.tar.xz) = cef771c6ee43925d743b7a21fed1cd7d54c10e39c0966fbc7062df9b7691c9a3a73c1c4589382592668f81809edea0fe0b947c7ddf86a6cdc1a144cf059526b0 +SHA512 (ocserv-1.4.0.tar.xz.sig) = a73ce14e8e355f747e40241056c2bb734d6dae4e1d6aed0f24aaa6d1a469f6d86a077af4a38e6376846fd5520ee33c7be8ce7b3830bcb0faa5e32b12ed7483cd