From 1b15fbdbe8ce0ad8492d19f3b3fcf49dd7083dc9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 20 Mar 2020 14:27:23 +0100 Subject: [PATCH 01/75] Update to 1.0.0-1 - Update to upstream 1.0.0 release --- .gitignore | 11 +++++++++++ ocserv.spec | 7 +++++-- sources | 6 +++--- 3 files changed, 19 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 6270347..acefa7a 100644 --- a/.gitignore +++ b/.gitignore @@ -203,3 +203,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.6.tar.xz.sig /ocserv-0.12.6.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-1.0.0.tar.xz.sig +/ocserv-1.0.0.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 740f4cc..2cdba2e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.6 -Release: 4%{?dist} +Version: 1.0.0 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 +- Update to upstream 1.0.0 release + * Wed Jan 29 2020 Fedora Release Engineering - 0.12.6-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index 7ff8e74..d7ee406 100644 --- a/sources +++ b/sources @@ -5,7 +5,7 @@ SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e1 SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 +SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.6.tar.xz.sig) = 8791479c6f1e6e8c6fd7b6f08857c5e6c1fc81ebc9a11c55231a049c27e2ee9f0bf938ccf1b66fb704eafb26cda6c9595f54edffa265d732dd640e8123538313 -SHA512 (ocserv-0.12.6.tar.xz) = 4d254298dc897304b4676f28a21338c138196cbdb08170c6d536c8c6730fab307642dbf853f96e66335604cb68711262678d3d0be84e6768ec720b9a81ccf813 +SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd +SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 From 0cdbcbefc24dad621ff43687d431240fec726dfb Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 20 Mar 2020 14:27:53 +0100 Subject: [PATCH 02/75] Update to 1.0.0-1 - Update to upstream 1.0.0 release --- .gitignore | 11 +++++++++++ ocserv.spec | 7 +++++-- sources | 6 +++--- 3 files changed, 19 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 6270347..acefa7a 100644 --- a/.gitignore +++ b/.gitignore @@ -203,3 +203,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-0.12.6.tar.xz.sig /ocserv-0.12.6.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-1.0.0.tar.xz.sig +/ocserv-1.0.0.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 740f4cc..2cdba2e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 0.12.6 -Release: 4%{?dist} +Version: 1.0.0 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 +- Update to upstream 1.0.0 release + * Wed Jan 29 2020 Fedora Release Engineering - 0.12.6-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index 7ff8e74..d7ee406 100644 --- a/sources +++ b/sources @@ -5,7 +5,7 @@ SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e1 SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 5b68a3547c6c69bf7c2b322692d6382162a587c47edad97690223c36f30ed98d3869d1ce063c630740d91888a4d70aadd657ddc6052c10e6e26800fca2e9d0c0 +SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-0.12.6.tar.xz.sig) = 8791479c6f1e6e8c6fd7b6f08857c5e6c1fc81ebc9a11c55231a049c27e2ee9f0bf938ccf1b66fb704eafb26cda6c9595f54edffa265d732dd640e8123538313 -SHA512 (ocserv-0.12.6.tar.xz) = 4d254298dc897304b4676f28a21338c138196cbdb08170c6d536c8c6730fab307642dbf853f96e66335604cb68711262678d3d0be84e6768ec720b9a81ccf813 +SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd +SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 From 2ed4cf2e996cceb4aec0cbfcef3603f7b8256e66 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 9 Apr 2020 14:28:18 +0200 Subject: [PATCH 03/75] sources: removed unnecessary files --- sources | 9 --------- 1 file changed, 9 deletions(-) diff --git a/sources b/sources index d7ee406..b2918a0 100644 --- a/sources +++ b/sources @@ -1,11 +1,2 @@ -SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 -SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 -SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 -SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac -SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 -SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a -SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 From ad75870eb95717c3f745841e8ad2a2c1319f8a22 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 9 Apr 2020 23:12:59 +0200 Subject: [PATCH 04/75] Update to 1.0.1-1 - Update to upstream 1.0.1 release --- .gitignore | 11 +++++++++++ ocserv.spec | 5 ++++- sources | 13 +++++++++++-- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index acefa7a..7bde321 100644 --- a/.gitignore +++ b/.gitignore @@ -214,3 +214,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-1.0.0.tar.xz.sig /ocserv-1.0.0.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-1.0.1.tar.xz.sig +/ocserv-1.0.1.tar.xz diff --git a/ocserv.spec b/ocserv.spec index 2cdba2e..0f85f1c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 1.0.0 +Version: 1.0.1 Release: 1%{?dist} %global _hardened_build 1 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 +- Update to upstream 1.0.1 release + * Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 - Update to upstream 1.0.0 release diff --git a/sources b/sources index b2918a0..4fe1ae5 100644 --- a/sources +++ b/sources @@ -1,2 +1,11 @@ -SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd -SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 +SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 +SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 +SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 +SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac +SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 +SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a +SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 +SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 +SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad +SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 +SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 From d1ee6c6e2a5bb099a7a1eb6e43feac56b39f37e9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 9 Apr 2020 23:13:06 +0200 Subject: [PATCH 05/75] Update to 1.0.1-1 - Update to upstream 1.0.1 release --- .gitignore | 11 +++++++++++ ocserv.conf | 4 ++-- ocserv.spec | 5 ++++- sources | 6 +++--- 4 files changed, 20 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index acefa7a..7bde321 100644 --- a/.gitignore +++ b/.gitignore @@ -214,3 +214,14 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-1.0.0.tar.xz.sig /ocserv-1.0.0.tar.xz +/ocserv.init +/gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg +/ocserv-script +/ocserv-genkey +/PACKAGE-LICENSING +/ocserv-pamd.conf +/ocserv.service +/ocserv.conf +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/ocserv-1.0.1.tar.xz.sig +/ocserv-1.0.1.tar.xz diff --git a/ocserv.conf b/ocserv.conf index 59d8e75..be9354b 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -290,9 +290,9 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 # difference with AES_128_CBC_SHA1 (the default for anyconnect clients) # in your system. -# Note that in Fedora gnutls follows crypto policies so insecure options +# Note that in RHEL gnutls follows crypto policies so insecure options # are disabled within it. -tls-priorities = "NORMAL:%SERVER_PRECEDENCE" +tls-priorities = "@SYSTEM:%SERVER_PRECEDENCE" # That option requires the established DTLS channel to use the same # cipher as the primary TLS channel. This cannot be combined with diff --git a/ocserv.spec b/ocserv.spec index 2cdba2e..0f85f1c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 1.0.0 +Version: 1.0.1 Release: 1%{?dist} %global _hardened_build 1 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 +- Update to upstream 1.0.1 release + * Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 - Update to upstream 1.0.0 release diff --git a/sources b/sources index d7ee406..779f5b3 100644 --- a/sources +++ b/sources @@ -5,7 +5,7 @@ SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e1 SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 +SHA512 (ocserv.conf) = 0e3520f3a07fd300070e1813632c9ef5d121364c050dd21f2ab03ef8dbfe58ad4de430955ea4c532a2208e9f74f4f943692b08afa62e0fdf24b0f0a7f9c17cdf SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (ocserv-1.0.0.tar.xz.sig) = f7e9c1c73a6668592b7cf849b0e2ef6555f3c6d3cbc1331da75f78c7fa1ee4d4ce831fba5a90d83df4c5e184d7724961a61a95f579e27464143d5fd241918acd -SHA512 (ocserv-1.0.0.tar.xz) = 6f396c9180004f8d439e094f9de0490016b085dad6bd7a5d17d3433480b37de65c25fc0c52452f5ea408bb7bc997ddcbfcdd80a3bbe454af3267aa14edbb3df9 +SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 +SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 From b41463a994418a2dd24b93e4112177aca9b8b6f3 Mon Sep 17 00:00:00 2001 From: Igor Raits Date: Wed, 15 Apr 2020 17:51:43 +0200 Subject: [PATCH 06/75] Rebuild for http-parser 2.9.4 Signed-off-by: Igor Raits --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 0f85f1c..2782492 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 1.0.1 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -279,6 +279,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Apr 15 2020 Igor Raits - 1.0.1-2 +- Rebuild for http-parser 2.9.4 + * Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 - Update to upstream 1.0.1 release From 4a1f58542c385391a2fe0e40a19ca367905b22ad Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 1 May 2020 19:48:41 +0200 Subject: [PATCH 07/75] sources: removed unnecessary files Signed-off-by: Nikos Mavrogiannopoulos --- sources | 9 --------- 1 file changed, 9 deletions(-) diff --git a/sources b/sources index 4fe1ae5..8d6f956 100644 --- a/sources +++ b/sources @@ -1,11 +1,2 @@ -SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 -SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 -SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 -SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac -SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 -SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a -SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 95260fb4e9f60ae0de69669f88e786d169f8ccc561cfd4cacb06b32bbfcfadaaa97469192852c53f7b689aa801b8d777568372e69ac758279b0a8b7a89361350 -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 From 67850255cf5499cf964875e1ee96c2cf7914ce0b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 6 May 2020 19:56:44 +0200 Subject: [PATCH 08/75] Requirements turned to recommendations This enables ocserv being used without these dependencies. --- ocserv.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 2782492..123b5fe 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -111,9 +111,9 @@ BuildRequires: libseccomp-devel BuildRequires: rubygem(ronn) %endif -Requires: gnutls-utils -Requires: iproute -Requires: pam +Recommends: gnutls-utils +Recommends: iproute +Recommends: pam Requires(pre): shadow-utils %if %{use_systemd} Requires(post): systemd From 8c0e03af5de5a5f2db52098fd9a0285a73b582ec Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 16 Jun 2020 19:46:48 +0200 Subject: [PATCH 09/75] updated to 1.1.0 --- .gitignore | 2 ++ ocserv.spec | 11 ++++++++--- sources | 4 ++-- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 7bde321..00721b2 100644 --- a/.gitignore +++ b/.gitignore @@ -225,3 +225,5 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-1.0.1.tar.xz.sig /ocserv-1.0.1.tar.xz +/ocserv-1.1.0.tar.xz +/ocserv-1.1.0.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 123b5fe..3eb5c60 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated -Version: 1.0.1 -Release: 2%{?dist} +Version: 1.1.0 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -57,6 +57,7 @@ BuildRequires: gnutls-devel %endif BuildRequires: pam-devel BuildRequires: iproute +BuildRequires: openconnect %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel @@ -203,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} +make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change %if %{use_systemd} %post @@ -270,6 +271,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %{_bindir}/ocserv-fw %{_bindir}/ocserv-script %{_sbindir}/ocserv +%{_sbindir}/ocserv-worker %{_sbindir}/ocserv-genkey %{_localstatedir}/lib/ocserv/profile.xml %if %{use_systemd} @@ -279,6 +281,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 +- Update to upstream 1.1.0 release (introduces ocserv-worker) + * Wed Apr 15 2020 Igor Raits - 1.0.1-2 - Rebuild for http-parser 2.9.4 diff --git a/sources b/sources index 8d6f956..9db8d9c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 -SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 +SHA512 (ocserv-1.1.0.tar.xz) = 10a589ccf28bf9568e602fc26d9133c78a840205f1a777d62cb52b680221bdaa8c231c37a95587b3494437dafc649b40f71be05a4868646c48efb3d873615861 +SHA512 (ocserv-1.1.0.tar.xz.sig) = 29c4082fa34327663ce6bcd29102c2eba088d79049e6637fabd048c8310fa9ff27853f06ef696c19ef66c146ce9e6e455cecc0261676a6ed343de731142f2022 From 1d6efda772d4bae26188f6b63e0bba05a00bbd5c Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 16 Jun 2020 22:18:27 +0200 Subject: [PATCH 10/75] sources: removed unnecessary files --- sources | 9 --------- 1 file changed, 9 deletions(-) diff --git a/sources b/sources index 779f5b3..8d6f956 100644 --- a/sources +++ b/sources @@ -1,11 +1,2 @@ -SHA512 (ocserv.init) = 7c3256dd0f7d5882c4e126c95209084e2476f7d8d142af137f46c5987364982eb88044bfa5d587ebc397ebd379edb40f22e5c97c0276764be982a27715a9c601 -SHA512 (gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg) = c664fd9999cbf9912eeea88ee3a2c356df3f70813a664bb7a7f592be258c12bdeb9e99e4aa9a368c1f123ee449eb08e288d1dc3dcf81e849a958ece6eab82d67 -SHA512 (ocserv-script) = 6d77ebe95d23469d96b45b1ac8de7a062cb1360febd0f9664b42debf0494891a522e3da8feec53d22b84e39ad349a1824b7ecd6b6b8f0790edf75aed1087e2d0 -SHA512 (ocserv-genkey) = e898144fd977e4c57c4a9a5480b38f6a166c0281c41500c3fa9b7e142197c4525d3fb90846a738e38d217116dc33c2ba5c16ec3e11de0dbf4d834e204c598eac -SHA512 (PACKAGE-LICENSING) = eea2a2a4765c90d874c79bb72d754c8b26b58d5e5b3c3cee10c24754fbba6849fd91f7b28e380b5db9789a456f95fc94b3bd8fe8c160a98c8042f404479ecb68 -SHA512 (ocserv-pamd.conf) = 3a75f19d89ddd164f3faa9c3579c7f675fc58413a194f43ec28eee7ebced6fee3f4ca305fe9b0ddf76ae39cd669e8d3d63b58afbbf19b84e4ca646ae7f42d61a -SHA512 (ocserv.service) = 2b258b2e9d211c9626e9e5c67b6c2573b713e0f490917ed1c84c2bb2708f874026ddb55dceb9585e491f86de5d3c8cd400bba864d12966ae96609cc4ce6413d2 -SHA512 (ocserv.conf) = 0e3520f3a07fd300070e1813632c9ef5d121364c050dd21f2ab03ef8dbfe58ad4de430955ea4c532a2208e9f74f4f943692b08afa62e0fdf24b0f0a7f9c17cdf -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 From fd8df59d9e4516c33909493393d29c75fc8b019f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 16 Jun 2020 19:46:48 +0200 Subject: [PATCH 11/75] updated to 1.1.0 --- .gitignore | 2 ++ ocserv.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7bde321..00721b2 100644 --- a/.gitignore +++ b/.gitignore @@ -225,3 +225,5 @@ /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /ocserv-1.0.1.tar.xz.sig /ocserv-1.0.1.tar.xz +/ocserv-1.1.0.tar.xz +/ocserv-1.1.0.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 0f85f1c..6ea0bf2 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 1.0.1 +Version: 1.1.0 Release: 1%{?dist} %global _hardened_build 1 @@ -57,6 +57,7 @@ BuildRequires: gnutls-devel %endif BuildRequires: pam-devel BuildRequires: iproute +BuildRequires: openconnect %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel @@ -203,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} +make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change %if %{use_systemd} %post @@ -270,6 +271,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %{_bindir}/ocserv-fw %{_bindir}/ocserv-script %{_sbindir}/ocserv +%{_sbindir}/ocserv-worker %{_sbindir}/ocserv-genkey %{_localstatedir}/lib/ocserv/profile.xml %if %{use_systemd} @@ -279,6 +281,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 +- Update to upstream 1.1.0 release (introduces ocserv-worker) + * Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 - Update to upstream 1.0.1 release diff --git a/sources b/sources index 8d6f956..9db8d9c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.0.1.tar.xz.sig) = 525e3cd0a649129332496a6f6c18b22f1c7329865d23479a25e774f8d6cfa6b60a46473024544bdc5c1204ed8d982a5ee73847f6838ab44e47f328f087c07601 -SHA512 (ocserv-1.0.1.tar.xz) = 953e1b6084f68f8627b5383e28b5fcde987881e66feac645a40fa37d895f0711b171c9029c3703773dfbd5432d747f92c71af9240c2df3381599902a7d5fe880 +SHA512 (ocserv-1.1.0.tar.xz) = 10a589ccf28bf9568e602fc26d9133c78a840205f1a777d62cb52b680221bdaa8c231c37a95587b3494437dafc649b40f71be05a4868646c48efb3d873615861 +SHA512 (ocserv-1.1.0.tar.xz.sig) = 29c4082fa34327663ce6bcd29102c2eba088d79049e6637fabd048c8310fa9ff27853f06ef696c19ef66c146ce9e6e455cecc0261676a6ed343de731142f2022 From babbac89f7dfa322f20cd76a45675a145e305374 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sun, 21 Jun 2020 21:06:36 +0200 Subject: [PATCH 12/75] Rebuilt for protobuf 3.12 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 3eb5c60..b3e1edb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 1.1.0 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -281,6 +281,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sun Jun 21 2020 Adrian Reber - 1.1.0-2 +- Rebuilt for protobuf 3.12 + * Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 - Update to upstream 1.1.0 release (introduces ocserv-worker) From 019fa4784fdfdd25cb03a721c3ab6abd60bbeb3d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 12:24:17 +0000 Subject: [PATCH 13/75] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index b3e1edb..dca7776 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 1.1.0 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -281,6 +281,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 1.1.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Sun Jun 21 2020 Adrian Reber - 1.1.0-2 - Rebuilt for protobuf 3.12 From 71f2d63baa1480f2d7cc87fb7e0cabfb0a1cfa82 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:37:59 +0200 Subject: [PATCH 14/75] updated to 1.1.1 --- .gitignore | 2 ++ ocserv.conf | 13 +++++++++---- ocserv.spec | 8 +++++--- sources | 4 ++-- 4 files changed, 18 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 00721b2..20cd616 100644 --- a/.gitignore +++ b/.gitignore @@ -227,3 +227,5 @@ /ocserv-1.0.1.tar.xz /ocserv-1.1.0.tar.xz /ocserv-1.1.0.tar.xz.sig +/ocserv-1.1.1.tar.xz +/ocserv-1.1.1.tar.xz.sig diff --git a/ocserv.conf b/ocserv.conf index 59d8e75..5daa176 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -176,9 +176,12 @@ server-key = /etc/pki/ocserv/private/server.key # information at: https://gitlab.com/ocserv/ocserv/issues isolate-workers = true -# A banner to be displayed on clients +# A banner to be displayed on clients after connection #banner = "Welcome" +# A banner to be displayed on clients before connection +#pre-login-banner = "Welcome" + # Limit the number of clients. Unset or set to zero for unlimited. #max-clients = 1024 max-clients = 16 @@ -195,9 +198,11 @@ max-same-clients = 2 # is recommended as it is more efficient in parsing. #listen-proxy-proto = true -# Limit the number of client connections to one every X milliseconds -# (X is the provided value). Set to zero for no limit. -#rate-limit-ms = 100 +# Rate limit the number of incoming connections to one every X milliseconds +# (X is the provided value), as the secmod backlog grows. This +# makes the server more resilient (and prevents connection failures) on +# multiple concurrent connections. Set to zero for no limit. +rate-limit-ms = 100 # Stats report time. The number of seconds after which each # worker process will report its usage statistics (number of diff --git a/ocserv.spec b/ocserv.spec index dca7776..f3305db 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,6 +1,5 @@ -# This spec file has been automatically updated -Version: 1.1.0 -Release: 3%{?dist} +Version: 1.1.1 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -281,6 +280,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 +- Update to upstream 1.1.1 release + * Tue Jul 28 2020 Fedora Release Engineering - 1.1.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index 9db8d9c..b716d8a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.0.tar.xz) = 10a589ccf28bf9568e602fc26d9133c78a840205f1a777d62cb52b680221bdaa8c231c37a95587b3494437dafc649b40f71be05a4868646c48efb3d873615861 -SHA512 (ocserv-1.1.0.tar.xz.sig) = 29c4082fa34327663ce6bcd29102c2eba088d79049e6637fabd048c8310fa9ff27853f06ef696c19ef66c146ce9e6e455cecc0261676a6ed343de731142f2022 +SHA512 (ocserv-1.1.1.tar.xz) = 1173416f0d32f9faf98e539c8e73316a50ac93b519d1ade19374a3df865d10d975e13ac53e0c5a5e77c80f3605d7a810287b18b85b798887d227389761b54220 +SHA512 (ocserv-1.1.1.tar.xz.sig) = 9fe0f3e2ea4daaf1d053c2cdc87d38dc8256feb11c16f93e7e677500457914a82e659901f77f6ec4ca175fceeec74e3f8d001412c969c18dcf486545bac83393 From ea091e0b7b5020168e953fe0ca25c2a5788d83fa Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:42:52 +0200 Subject: [PATCH 15/75] documented crypto policies change --- ocserv.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index f3305db..6c40b4e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -282,6 +282,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %changelog * Thu Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 - Update to upstream 1.1.1 release +- Set default priorities to NORMAL as using @SYSTEM is no longer necessary + to follow crypto policies. * Tue Jul 28 2020 Fedora Release Engineering - 1.1.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 745079e26b223152e834f5c55cab8f34b5524bf6 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:51:06 +0200 Subject: [PATCH 16/75] added resumption to XFAIL This test seems to be failing --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 6c40b4e..a88eea4 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -203,7 +203,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change +make check %{?_smp_mflags} XFAIL_TESTS="test-sighup-key-change resumption" %if %{use_systemd} %post From 52adc1c385d8e21f07f97cdb8c113131e168702e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 12:52:20 +0200 Subject: [PATCH 17/75] ensure gnutls-utils are installed when building This is needed for certain tests --- ocserv.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index a88eea4..c1e65c2 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -57,6 +57,7 @@ BuildRequires: gnutls-devel BuildRequires: pam-devel BuildRequires: iproute BuildRequires: openconnect +BuildRequires: gnutls-utils %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel @@ -203,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} XFAIL_TESTS="test-sighup-key-change resumption" +make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change %if %{use_systemd} %post From df7d3b4c34672216c749880f3c05a46eafa52594 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 13:01:57 +0200 Subject: [PATCH 18/75] removed xfail tests; they no longer fail --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index c1e65c2..41715c1 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -204,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} XFAIL_TESTS=test-sighup-key-change +make check %{?_smp_mflags} %if %{use_systemd} %post From bd9a292f76f01f3cb582f5e22ac6344e0249fbae Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 13:51:50 +0200 Subject: [PATCH 19/75] make check: be verbose --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 41715c1..021a1fa 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -204,7 +204,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} +make check %{?_smp_mflags} VERBOSE=1 %if %{use_systemd} %post From 184c39d298841228e48067a5f48adb5a9caf6d6f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 14:51:06 +0200 Subject: [PATCH 20/75] disable socket_wrapper on archs where it causes problems --- ocserv.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ocserv.spec b/ocserv.spec index 021a1fa..764219e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -92,7 +92,11 @@ BuildRequires: systemd BuildRequires: systemd-devel BuildRequires: liboath-devel BuildRequires: uid_wrapper +# Disable socket_wrapper on certain architectures because it +# introduces new syscalls that the worker cannot handle. +%ifnarch aarch64 %{ix86} %{arm} BuildRequires: socket_wrapper +%endif BuildRequires: gnupg2 %if 0%{?rhel} && 0%{?rhel} >= 7 From b6e52d29bccf07c6abe1cd124f0e81a2240e2e6d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 21 Sep 2020 15:12:40 +0200 Subject: [PATCH 21/75] corrected bogus date --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 764219e..ef359eb 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -285,7 +285,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog -* Thu Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 +* Mon Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 - Update to upstream 1.1.1 release - Set default priorities to NORMAL as using @SYSTEM is no longer necessary to follow crypto policies. From 5ee6ad0f36bab8db247295cf86ec98d9fd63fedc Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 24 Sep 2020 14:42:40 +0200 Subject: [PATCH 22/75] Rebuilt for protobuf 3.13 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ef359eb..16d62c8 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.1 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -285,6 +285,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Sep 24 2020 Adrian Reber - 1.1.1-2 +- Rebuilt for protobuf 3.13 + * Mon Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 - Update to upstream 1.1.1 release - Set default priorities to NORMAL as using @SYSTEM is no longer necessary From fc6fc1e94fafeade3768a9b25ccd49c262b55049 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 23 Oct 2020 15:00:03 +0200 Subject: [PATCH 23/75] do not treat TODO as document to install --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 16d62c8..4705016 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -263,7 +263,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/ocserv %config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml -%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* From 6326ab472dc5fb98fd8d627243180216c346dc2a Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 29 Oct 2020 09:54:59 +0100 Subject: [PATCH 24/75] rebuild without pcllib --- ocserv.spec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 4705016..011ea59 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.1 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -67,7 +67,6 @@ BuildRequires: libnl3-devel BuildRequires: krb5-devel BuildRequires: libtasn1-devel BuildRequires: gperf -BuildRequires: pcllib-devel BuildRequires: libtalloc-devel BuildRequires: libev-devel %if %{use_http_parser} @@ -156,7 +155,6 @@ rm -rf src/protobuf/protobuf-c/ touch src/*.proto %endif rm -rf src/ccan/talloc -rm -f src/pcl/*.c src/pcl/*.h sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config # GPLv3 in headers is a gnulib bug: @@ -179,6 +177,7 @@ autoreconf -fvi %endif %configure \ + --without-pcl-lib \ %if %{use_systemd} --enable-systemd \ %else @@ -285,6 +284,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Oct 29 2020 Nikos Mavrogiannopoulos - 1.1.1-3 +- Rebuilt without pcllib dependency + * Thu Sep 24 2020 Adrian Reber - 1.1.1-2 - Rebuilt for protobuf 3.13 From 361405c03bd3ce6a4ce282a1861777c94c011828 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 29 Oct 2020 13:20:03 +0100 Subject: [PATCH 25/75] Compile with new glibc --- ocserv-1.1.1-socketwrapper.patch | 19 +++++++++++++++++++ ocserv.spec | 5 ++++- 2 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 ocserv-1.1.1-socketwrapper.patch diff --git a/ocserv-1.1.1-socketwrapper.patch b/ocserv-1.1.1-socketwrapper.patch new file mode 100644 index 0000000..9f8b3c9 --- /dev/null +++ b/ocserv-1.1.1-socketwrapper.patch @@ -0,0 +1,19 @@ +diff --git a/src/worker-privs.c b/src/worker-privs.c +index ea503cd0..3d4d5fa4 100644 +--- a/src/worker-privs.c ++++ b/src/worker-privs.c +@@ -166,6 +166,14 @@ int disable_system_calls(struct worker_st *ws) + ADD_SYSCALL(fstat, 0); + ADD_SYSCALL(lseek, 0); + ++ /* if running under socketwrapper ensure we allow its calls */ ++ if (getenv("SOCKET_WRAPPER_DIR") != NULL) { ++ ADD_SYSCALL(stat64, 0); ++ ADD_SYSCALL(readlink, 0); ++ ADD_SYSCALL(newfstatat, 0); ++ ADD_SYSCALL(mmap, 0); ++ } ++ + ADD_SYSCALL(getsockopt, 0); + ADD_SYSCALL(setsockopt, 0); + diff --git a/ocserv.spec b/ocserv.spec index 011ea59..cf635cf 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -44,6 +44,7 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +Patch0: ocserv-1.1.1-socketwrapper.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -177,6 +178,7 @@ autoreconf -fvi %endif %configure \ + --with-seccomp-trap \ --without-pcl-lib \ %if %{use_systemd} --enable-systemd \ @@ -285,7 +287,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %changelog * Thu Oct 29 2020 Nikos Mavrogiannopoulos - 1.1.1-3 -- Rebuilt without pcllib dependency +- Rebuild without pcllib dependency +- Enhanced seccomp filters for tests to run in all architectures * Thu Sep 24 2020 Adrian Reber - 1.1.1-2 - Rebuilt for protobuf 3.13 From 26ab9a4fb3d7607f4bc5c835218d4cae646d7b4b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 30 Oct 2020 09:04:58 +0100 Subject: [PATCH 26/75] spec: removed seccomp-trap debugging option --- ocserv.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index cf635cf..3cabcd6 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -178,7 +178,6 @@ autoreconf -fvi %endif %configure \ - --with-seccomp-trap \ --without-pcl-lib \ %if %{use_systemd} --enable-systemd \ From f4653b53904de7c2805ab5719c19e847ecab8136 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 11 Nov 2020 23:18:03 +0100 Subject: [PATCH 27/75] rebuilt for new radcli --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 3cabcd6..c94ee9e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.1 -Release: 3%{?dist} +Release: 4%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -285,6 +285,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Nov 11 2020 Nikos Mavrogiannopoulos - 1.1.1-4 +- Rebuilt for radcli 1.3.0 + * Thu Oct 29 2020 Nikos Mavrogiannopoulos - 1.1.1-3 - Rebuild without pcllib dependency - Enhanced seccomp filters for tests to run in all architectures From 1400361cdd7e280622568f2d1fd4a40c90f6ebb3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 23 Nov 2020 12:05:38 +0100 Subject: [PATCH 28/75] Rebuilt for ronn successor --- ocserv.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index c94ee9e..e7178a9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.1 -Release: 4%{?dist} +Release: 5%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -113,7 +113,7 @@ BuildRequires: libseccomp-devel # no rubygem in epel7 %if 0%{?fedora} -BuildRequires: rubygem(ronn) +BuildRequires: rubygem-ronn-ng %endif Recommends: gnutls-utils @@ -285,6 +285,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Mon Nov 23 2020 Nikos Mavrogiannopoulos - 1.1.1-5 +- Rebuilt for ronn successor + * Wed Nov 11 2020 Nikos Mavrogiannopoulos - 1.1.1-4 - Rebuilt for radcli 1.3.0 From e9d48e920a2233ac3640faa91d5afc25da24dda0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sun, 6 Dec 2020 14:11:06 +0100 Subject: [PATCH 29/75] Update to upstream 1.1.2 release --- .gitignore | 2 ++ ocserv-1.1.1-socketwrapper.patch | 19 ------------------- ocserv.conf | 6 ------ ocserv.spec | 8 +++++--- sources | 4 ++-- 5 files changed, 9 insertions(+), 30 deletions(-) delete mode 100644 ocserv-1.1.1-socketwrapper.patch diff --git a/.gitignore b/.gitignore index 20cd616..48fba86 100644 --- a/.gitignore +++ b/.gitignore @@ -229,3 +229,5 @@ /ocserv-1.1.0.tar.xz.sig /ocserv-1.1.1.tar.xz /ocserv-1.1.1.tar.xz.sig +/ocserv-1.1.2.tar.xz +/ocserv-1.1.2.tar.xz.sig diff --git a/ocserv-1.1.1-socketwrapper.patch b/ocserv-1.1.1-socketwrapper.patch deleted file mode 100644 index 9f8b3c9..0000000 --- a/ocserv-1.1.1-socketwrapper.patch +++ /dev/null @@ -1,19 +0,0 @@ -diff --git a/src/worker-privs.c b/src/worker-privs.c -index ea503cd0..3d4d5fa4 100644 ---- a/src/worker-privs.c -+++ b/src/worker-privs.c -@@ -166,6 +166,14 @@ int disable_system_calls(struct worker_st *ws) - ADD_SYSCALL(fstat, 0); - ADD_SYSCALL(lseek, 0); - -+ /* if running under socketwrapper ensure we allow its calls */ -+ if (getenv("SOCKET_WRAPPER_DIR") != NULL) { -+ ADD_SYSCALL(stat64, 0); -+ ADD_SYSCALL(readlink, 0); -+ ADD_SYSCALL(newfstatat, 0); -+ ADD_SYSCALL(mmap, 0); -+ } -+ - ADD_SYSCALL(getsockopt, 0); - ADD_SYSCALL(setsockopt, 0); - diff --git a/ocserv.conf b/ocserv.conf index 5daa176..d5e0814 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -89,12 +89,6 @@ auth = "pam" tcp-port = 443 udp-port = 443 -# Accept connections using a socket file. It accepts HTTP -# connections (i.e., without SSL/TLS unlike its TCP counterpart), -# and uses it as the primary channel. That option cannot be -# combined with certificate authentication. -#listen-clear-file = /var/run/ocserv-conn.socket - # The user the worker processes will be run as. It should be # unique (no other services run as this user). run-as-user = ocserv diff --git a/ocserv.spec b/ocserv.spec index e7178a9..7b9ad2f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.1 -Release: 5%{?dist} +Version: 1.1.2 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -44,7 +44,6 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -Patch0: ocserv-1.1.1-socketwrapper.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -285,6 +284,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 +- Update to upstream 1.1.2 release + * Mon Nov 23 2020 Nikos Mavrogiannopoulos - 1.1.1-5 - Rebuilt for ronn successor diff --git a/sources b/sources index b716d8a..9c321dd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.1.tar.xz) = 1173416f0d32f9faf98e539c8e73316a50ac93b519d1ade19374a3df865d10d975e13ac53e0c5a5e77c80f3605d7a810287b18b85b798887d227389761b54220 -SHA512 (ocserv-1.1.1.tar.xz.sig) = 9fe0f3e2ea4daaf1d053c2cdc87d38dc8256feb11c16f93e7e677500457914a82e659901f77f6ec4ca175fceeec74e3f8d001412c969c18dcf486545bac83393 +SHA512 (ocserv-1.1.2.tar.xz) = 8a145ff729414482c10ab763ac891e21f588fb8f61265fb4e6e61684a9b48c5fcaaafaad1ddcaeaf4ffad85377be45c002b628b27d9a7d08f5b403668f62c3f0 +SHA512 (ocserv-1.1.2.tar.xz.sig) = 3de64d1b4812c836ce809dd31adbf0ba7f2b11f408bb279bdd64f915be7c70b6601f098281e219a986febd0f5ddabaa6eba2448a0b9baf0ae025187b06aec3ce From 4fa9fe0ca251d6b22057375ab23050d9373fc6f9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sun, 6 Dec 2020 19:57:21 +0100 Subject: [PATCH 30/75] skip patch that needs root --- ocserv-1.1.2-tests.patch | 42 ++++++++++++++++++++++++++++++++++++++++ ocserv.spec | 5 +++-- 2 files changed, 45 insertions(+), 2 deletions(-) create mode 100644 ocserv-1.1.2-tests.patch diff --git a/ocserv-1.1.2-tests.patch b/ocserv-1.1.2-tests.patch new file mode 100644 index 0000000..0927fa0 --- /dev/null +++ b/ocserv-1.1.2-tests.patch @@ -0,0 +1,42 @@ +From 8d3dc40a5f59be1c91236823b4b4f75adb2e8e7c Mon Sep 17 00:00:00 2001 +From: Nikos Mavrogiannopoulos +Date: Sun, 6 Dec 2020 19:55:03 +0100 +Subject: [PATCH] tests: drain-server-fail: make sure it runs only when root + +Signed-off-by: Nikos Mavrogiannopoulos +--- + tests/common.sh | 3 +++ + tests/drain-server-fail | 3 ++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tests/common.sh b/tests/common.sh +index cd9bc885..d574d2d0 100644 +--- a/tests/common.sh ++++ b/tests/common.sh +@@ -45,6 +45,9 @@ else + echo "Skipping test requiring ldpreload" + exit 77 + fi ++fi ++ ++if test "${NEED_SOCKET_WRAPPER}" = 1 || test "${NO_NEED_ROOT}" = 1;then + SOCKDIR="${srcdir}/tmp/sockwrap.$$.tmp" + mkdir -p $SOCKDIR + export SOCKET_WRAPPER_DIR=$SOCKDIR +diff --git a/tests/drain-server-fail b/tests/drain-server-fail +index 40a2ed01..d61106e6 100755 +--- a/tests/drain-server-fail ++++ b/tests/drain-server-fail +@@ -20,7 +20,8 @@ + SERV="${SERV:-../src/ocserv}" + OCCTL="${OCCTL:-../src/occtl/occtl}" + srcdir=${srcdir:-.} +-NO_NEED_ROOT=1 ++#we cannot use NO_NEED_ROOT here as occtl commands can only be issued by root ++NEED_SOCKET_WRAPPER=1 + PIDFILE=ocserv-pid.$$.tmp + OCCTL_SOCKET=./occtl-drain-$$.socket + +-- +2.28.0 + diff --git a/ocserv.spec b/ocserv.spec index 7b9ad2f..e0f8244 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -44,6 +44,7 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +Patch0: ocserv-1.1.2-tests.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -195,7 +196,7 @@ autoreconf -fvi --without-libwrap %endif -make #%{?_smp_mflags} +make %{?_smp_mflags} %pre getent group ocserv &>/dev/null || groupadd -r ocserv @@ -284,7 +285,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog -* Sat Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 +* Sun Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 - Update to upstream 1.1.2 release * Mon Nov 23 2020 Nikos Mavrogiannopoulos - 1.1.1-5 From 3a3280275f4f3aee6256e1e1244c7c10aeb6a68e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 9 Dec 2020 09:44:49 +0100 Subject: [PATCH 31/75] do not special case rhel8 for http-parser The development headers are now shipped. --- ocserv.spec | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index e0f8244..b634a1e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -18,12 +18,6 @@ Release: 1%{?dist} %define use_geoip 1 %endif -%if 0%{?rhel} && 0%{?rhel} == 8 -%define use_http_parser 0 -%else -%define use_http_parser 1 -%endif - %define use_local_protobuf 0 Name: ocserv @@ -70,9 +64,7 @@ BuildRequires: libtasn1-devel BuildRequires: gperf BuildRequires: libtalloc-devel BuildRequires: libev-devel -%if %{use_http_parser} BuildRequires: http-parser-devel -%endif %if %{use_libwrap} BuildRequires: tcp_wrappers-devel @@ -148,9 +140,7 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %autosetup -p1 -%if %{use_http_parser} rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h -%endif %if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ touch src/*.proto @@ -187,9 +177,6 @@ autoreconf -fvi %if %{use_local_protobuf} --without-protobuf \ %endif -%if ! %{use_http_parser} - --without-http-parser \ -%endif %if %{use_libwrap} --with-libwrap %else From e1cb96f264b5d747ae3f6569237d09cbfc8587a1 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 9 Jan 2021 03:24:47 +0000 Subject: [PATCH 32/75] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index b634a1e..a55c2cc 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -43,6 +43,7 @@ Patch0: ocserv-1.1.2-tests.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 +BuildRequires: make BuildRequires: gcc %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel From 65e0fa740890990db362c7e04830c452d95fa2fc Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 14 Jan 2021 08:31:27 +0100 Subject: [PATCH 33/75] Rebuilt for protobuf 3.14 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index a55c2cc..14877ad 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.2 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -273,6 +273,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 14 08:31:24 CET 2021 Adrian Reber - 1.1.2-2 +- Rebuilt for protobuf 3.14 + * Sun Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 - Update to upstream 1.1.2 release From 3d30df7cf7bd9c4341b28f88c5cd99c11d8291f9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 22:12:48 +0000 Subject: [PATCH 34/75] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 14877ad..295f5c5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.2 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -273,6 +273,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 1.1.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Thu Jan 14 08:31:24 CET 2021 Adrian Reber - 1.1.2-2 - Rebuilt for protobuf 3.14 From 6f808faf0edbba5590ae35bc2f75421dd18c246b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 2 Jun 2021 09:12:04 +0200 Subject: [PATCH 35/75] updated to 1.1.3 --- .gitignore | 2 ++ ocserv.spec | 8 +++++--- sources | 4 ++-- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 48fba86..9ab0623 100644 --- a/.gitignore +++ b/.gitignore @@ -231,3 +231,5 @@ /ocserv-1.1.1.tar.xz.sig /ocserv-1.1.2.tar.xz /ocserv-1.1.2.tar.xz.sig +/ocserv-1.1.3.tar.xz +/ocserv-1.1.3.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index 295f5c5..5233256 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.2 -Release: 3%{?dist} +Version: 1.1.3 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -38,7 +38,6 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -Patch0: ocserv-1.1.2-tests.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -273,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Wed Jun 2 2021 Nikos Mavrogiannopoulos - 1.1.3-1 +- Updated to latest release + * Tue Jan 26 2021 Fedora Release Engineering - 1.1.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index 9c321dd..6722d35 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.2.tar.xz) = 8a145ff729414482c10ab763ac891e21f588fb8f61265fb4e6e61684a9b48c5fcaaafaad1ddcaeaf4ffad85377be45c002b628b27d9a7d08f5b403668f62c3f0 -SHA512 (ocserv-1.1.2.tar.xz.sig) = 3de64d1b4812c836ce809dd31adbf0ba7f2b11f408bb279bdd64f915be7c70b6601f098281e219a986febd0f5ddabaa6eba2448a0b9baf0ae025187b06aec3ce +SHA512 (ocserv-1.1.3.tar.xz) = 1138bd530e41f215f75e967aa293e80504a0ffc3384184832910b7bf8dc2049a637c1d8bef0221b6abb3e6510e51fba3c45d43901c0d2e4c0f180e72c0804628 +SHA512 (ocserv-1.1.3.tar.xz.sig) = 90c9a0bc35ac970faeeef2e0c32c7f4104c1acecfdcf9d266a647102912e2bf575f2cab365ae0040a69ec857fb616cbfd829316dbfccff079e9cb3cfa4a4ffae From 86658a4f0a66f9e2753b64cfac886f8e03a2adff Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 2 Jun 2021 09:28:31 +0200 Subject: [PATCH 36/75] removed unused file --- ocserv-1.1.2-tests.patch | 42 ---------------------------------------- 1 file changed, 42 deletions(-) delete mode 100644 ocserv-1.1.2-tests.patch diff --git a/ocserv-1.1.2-tests.patch b/ocserv-1.1.2-tests.patch deleted file mode 100644 index 0927fa0..0000000 --- a/ocserv-1.1.2-tests.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 8d3dc40a5f59be1c91236823b4b4f75adb2e8e7c Mon Sep 17 00:00:00 2001 -From: Nikos Mavrogiannopoulos -Date: Sun, 6 Dec 2020 19:55:03 +0100 -Subject: [PATCH] tests: drain-server-fail: make sure it runs only when root - -Signed-off-by: Nikos Mavrogiannopoulos ---- - tests/common.sh | 3 +++ - tests/drain-server-fail | 3 ++- - 2 files changed, 5 insertions(+), 1 deletion(-) - -diff --git a/tests/common.sh b/tests/common.sh -index cd9bc885..d574d2d0 100644 ---- a/tests/common.sh -+++ b/tests/common.sh -@@ -45,6 +45,9 @@ else - echo "Skipping test requiring ldpreload" - exit 77 - fi -+fi -+ -+if test "${NEED_SOCKET_WRAPPER}" = 1 || test "${NO_NEED_ROOT}" = 1;then - SOCKDIR="${srcdir}/tmp/sockwrap.$$.tmp" - mkdir -p $SOCKDIR - export SOCKET_WRAPPER_DIR=$SOCKDIR -diff --git a/tests/drain-server-fail b/tests/drain-server-fail -index 40a2ed01..d61106e6 100755 ---- a/tests/drain-server-fail -+++ b/tests/drain-server-fail -@@ -20,7 +20,8 @@ - SERV="${SERV:-../src/ocserv}" - OCCTL="${OCCTL:-../src/occtl/occtl}" - srcdir=${srcdir:-.} --NO_NEED_ROOT=1 -+#we cannot use NO_NEED_ROOT here as occtl commands can only be issued by root -+NEED_SOCKET_WRAPPER=1 - PIDFILE=ocserv-pid.$$.tmp - OCCTL_SOCKET=./occtl-drain-$$.socket - --- -2.28.0 - From 1412a40612531c442c7ed0091f798b0b337e8aeb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 16:54:24 +0000 Subject: [PATCH 37/75] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 5233256..9485788 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.3 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Wed Jun 2 2021 Nikos Mavrogiannopoulos - 1.1.3-1 - Updated to latest release From 32af46b9e7464eb4ecc22f1c443be2d47e54aecb Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Tue, 26 Oct 2021 08:47:45 +0200 Subject: [PATCH 38/75] Rebuilt for protobuf 3.18.1 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 9485788..9a8f744 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.3 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Tue Oct 26 2021 Adrian Reber - 1.1.3-3 +- Rebuilt for protobuf 3.18.1 + * Thu Jul 22 2021 Fedora Release Engineering - 1.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From ecf3bd2df8ce4501f87dbef44891e840aa82fcf1 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sat, 6 Nov 2021 12:59:42 +0100 Subject: [PATCH 39/75] Rebuilt for protobuf 3.19.0 --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 9a8f744..faf0b14 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.3 -Release: 3%{?dist} +Release: 4%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat Nov 06 2021 Adrian Reber - 1.1.3-4 +- Rebuilt for protobuf 3.19.0 + * Tue Oct 26 2021 Adrian Reber - 1.1.3-3 - Rebuilt for protobuf 3.18.1 From 1230c3d17a52df568984a7936755970477cc46aa Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 13 Nov 2021 13:06:44 +0100 Subject: [PATCH 40/75] update to 1.1.4 --- .gitignore | 2 ++ ocserv.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9ab0623..ea83165 100644 --- a/.gitignore +++ b/.gitignore @@ -233,3 +233,5 @@ /ocserv-1.1.2.tar.xz.sig /ocserv-1.1.3.tar.xz /ocserv-1.1.3.tar.xz.sig +/ocserv-1.1.4.tar.xz +/ocserv-1.1.4.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index faf0b14..5feec6c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.3 -Release: 4%{?dist} +Version: 1.1.4 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sat Nov 13 2021 Nikos Mavrogiannopoulos - 1.1.4-1 +- Update to upstream 1.1.4 release + * Sat Nov 06 2021 Adrian Reber - 1.1.3-4 - Rebuilt for protobuf 3.19.0 diff --git a/sources b/sources index 6722d35..c949381 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.3.tar.xz) = 1138bd530e41f215f75e967aa293e80504a0ffc3384184832910b7bf8dc2049a637c1d8bef0221b6abb3e6510e51fba3c45d43901c0d2e4c0f180e72c0804628 -SHA512 (ocserv-1.1.3.tar.xz.sig) = 90c9a0bc35ac970faeeef2e0c32c7f4104c1acecfdcf9d266a647102912e2bf575f2cab365ae0040a69ec857fb616cbfd829316dbfccff079e9cb3cfa4a4ffae +SHA512 (ocserv-1.1.4.tar.xz) = bbdbf8d4fbe0c2aa3cf03e2b049d42a73918cc0863fa3ad0db79905e7855c7cb875e46c1d817e8c9eb19632bb0ee8a097f45c168046d9442901b56a5fd2a69a8 +SHA512 (ocserv-1.1.4.tar.xz.sig) = 1ca7a2fdd56dc7e628f4331c77b9859c9867af3eeef058357b3c197106a93052b099c278bef495f622a00ce5527f69b3762e9f57001cf6ba9f7b3b219a3e1a0d From 7bbf4483784d3cfe559d6984c8bfab5a5885d3f6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 22:02:26 +0000 Subject: [PATCH 41/75] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 5feec6c..a55d67f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.4 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 1.1.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Sat Nov 13 2021 Nikos Mavrogiannopoulos - 1.1.4-1 - Update to upstream 1.1.4 release From 17e5b407a3f0f7f548df4bb45144612290f30fab Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 10 Feb 2022 16:04:44 +0100 Subject: [PATCH 42/75] Fixes for gnutls 3.7.3 and glibc new syscalls --- futex.patch | 12 ++++++++++++ gnutls-3.7.3.patch | 16 ++++++++++++++++ ocserv.spec | 8 +++++++- 3 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 futex.patch create mode 100644 gnutls-3.7.3.patch diff --git a/futex.patch b/futex.patch new file mode 100644 index 0000000..1eecad4 --- /dev/null +++ b/futex.patch @@ -0,0 +1,12 @@ +diff --git a/src/worker-privs.c b/src/worker-privs.c +index ae0b375d..0b285113 100644 +--- a/src/worker-privs.c ++++ b/src/worker-privs.c +@@ -128,6 +128,7 @@ int disable_system_calls(struct worker_st *ws) + ADD_SYSCALL(getrusage, 0); + ADD_SYSCALL(alarm, 0); + ADD_SYSCALL(getpid, 0); ++ ADD_SYSCALL(futex, 0); + + /* memory allocation - both are used by different platforms */ + ADD_SYSCALL(brk, 0); diff --git a/gnutls-3.7.3.patch b/gnutls-3.7.3.patch new file mode 100644 index 0000000..7e99e4e --- /dev/null +++ b/gnutls-3.7.3.patch @@ -0,0 +1,16 @@ +diff --git a/src/sec-mod.c b/src/sec-mod.c +index 03f78276..6492b68a 100644 +--- a/src/sec-mod.c ++++ b/src/sec-mod.c +@@ -834,7 +834,10 @@ static int load_keys(sec_mod_st *sec, unsigned force) + gnutls_privkey_import_x509_raw(p, &data, + GNUTLS_X509_FMT_PEM, + NULL, 0); +- if (ret == GNUTLS_E_DECRYPTION_FAILED && vhost->pins.pin[0]) { ++ /* GnuTLS 3.7.3 introduces a backwards incompatible change and ++ * GNUTLS_E_PKCS11_PIN_ERROR is returned when an encrypted ++ * file is loaded https://gitlab.com/gnutls/gnutls/-/issues/1321 */ ++ if ((ret == GNUTLS_E_DECRYPTION_FAILED || ret == GNUTLS_E_PKCS11_PIN_ERROR) && vhost->pins.pin[0]) { + ret = + gnutls_privkey_import_x509_raw(p, &data, + GNUTLS_X509_FMT_PEM, diff --git a/ocserv.spec b/ocserv.spec index a55d67f..025e5b5 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.4 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -38,6 +38,8 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +Patch1: futex.patch +Patch2: gnutls-3.7.3.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -272,6 +274,10 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Feb 10 2022 Nikos Mavrogiannopoulos - 1.1.4-3 +- Update seccomp rules to allow the futex syscall +- Workaround incompatible API change in GnuTLS 3.7.3. + * Thu Jan 20 2022 Fedora Release Engineering - 1.1.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 6f808d421328e22b0ff4bcc1b8cab12ffc5fab2d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 17 Feb 2022 13:07:15 +0100 Subject: [PATCH 43/75] Updated to 1.1.6 --- .gitignore | 2 ++ futex.patch | 12 ------------ gnutls-3.7.3.patch | 16 ---------------- ocserv.spec | 9 +++++---- sources | 4 ++-- 5 files changed, 9 insertions(+), 34 deletions(-) delete mode 100644 futex.patch delete mode 100644 gnutls-3.7.3.patch diff --git a/.gitignore b/.gitignore index ea83165..d8812e1 100644 --- a/.gitignore +++ b/.gitignore @@ -235,3 +235,5 @@ /ocserv-1.1.3.tar.xz.sig /ocserv-1.1.4.tar.xz /ocserv-1.1.4.tar.xz.sig +/ocserv-1.1.6.tar.xz.sig +/ocserv-1.1.6.tar.xz diff --git a/futex.patch b/futex.patch deleted file mode 100644 index 1eecad4..0000000 --- a/futex.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/src/worker-privs.c b/src/worker-privs.c -index ae0b375d..0b285113 100644 ---- a/src/worker-privs.c -+++ b/src/worker-privs.c -@@ -128,6 +128,7 @@ int disable_system_calls(struct worker_st *ws) - ADD_SYSCALL(getrusage, 0); - ADD_SYSCALL(alarm, 0); - ADD_SYSCALL(getpid, 0); -+ ADD_SYSCALL(futex, 0); - - /* memory allocation - both are used by different platforms */ - ADD_SYSCALL(brk, 0); diff --git a/gnutls-3.7.3.patch b/gnutls-3.7.3.patch deleted file mode 100644 index 7e99e4e..0000000 --- a/gnutls-3.7.3.patch +++ /dev/null @@ -1,16 +0,0 @@ -diff --git a/src/sec-mod.c b/src/sec-mod.c -index 03f78276..6492b68a 100644 ---- a/src/sec-mod.c -+++ b/src/sec-mod.c -@@ -834,7 +834,10 @@ static int load_keys(sec_mod_st *sec, unsigned force) - gnutls_privkey_import_x509_raw(p, &data, - GNUTLS_X509_FMT_PEM, - NULL, 0); -- if (ret == GNUTLS_E_DECRYPTION_FAILED && vhost->pins.pin[0]) { -+ /* GnuTLS 3.7.3 introduces a backwards incompatible change and -+ * GNUTLS_E_PKCS11_PIN_ERROR is returned when an encrypted -+ * file is loaded https://gitlab.com/gnutls/gnutls/-/issues/1321 */ -+ if ((ret == GNUTLS_E_DECRYPTION_FAILED || ret == GNUTLS_E_PKCS11_PIN_ERROR) && vhost->pins.pin[0]) { - ret = - gnutls_privkey_import_x509_raw(p, &data, - GNUTLS_X509_FMT_PEM, diff --git a/ocserv.spec b/ocserv.spec index 025e5b5..f24d8a7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.4 -Release: 3%{?dist} +Version: 1.1.6 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -38,8 +38,6 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -Patch1: futex.patch -Patch2: gnutls-3.7.3.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -274,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Feb 17 2022 Nikos Mavrogiannopoulos - 1.1.6-1 +- Updated to 1.1.6 + * Thu Feb 10 2022 Nikos Mavrogiannopoulos - 1.1.4-3 - Update seccomp rules to allow the futex syscall - Workaround incompatible API change in GnuTLS 3.7.3. diff --git a/sources b/sources index c949381..bb03d35 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.4.tar.xz) = bbdbf8d4fbe0c2aa3cf03e2b049d42a73918cc0863fa3ad0db79905e7855c7cb875e46c1d817e8c9eb19632bb0ee8a097f45c168046d9442901b56a5fd2a69a8 -SHA512 (ocserv-1.1.4.tar.xz.sig) = 1ca7a2fdd56dc7e628f4331c77b9859c9867af3eeef058357b3c197106a93052b099c278bef495f622a00ce5527f69b3762e9f57001cf6ba9f7b3b219a3e1a0d +SHA512 (ocserv-1.1.6.tar.xz.sig) = 2a87768ad63d40053732fa011bbeb3532c9673296b9be299bf8f7d8dd3dd35571eee96c0b4fa9bf5a30633b4c844337ab3d562d6ea2b6ad8efca084eb5e6f502 +SHA512 (ocserv-1.1.6.tar.xz) = d1c5e5cf0e84aab168ed51516534df8b2968194dd1421f33563c61b3e47d5d79ebe9e6ffbf7cbcc9ff1242fae05151024f70ef586d063bec0b3eec00050bfdfa From a593faeb19068dcd6869922745b2b29e06c1d1cc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 22 Jul 2022 01:38:36 +0000 Subject: [PATCH 44/75] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index f24d8a7..f2dc5c0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.6 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Fri Jul 22 2022 Fedora Release Engineering - 1.1.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Feb 17 2022 Nikos Mavrogiannopoulos - 1.1.6-1 - Updated to 1.1.6 From 1628aac0554d2478d7225750634a44512c12cc20 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 22:27:47 +0000 Subject: [PATCH 45/75] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ocserv.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index f2dc5c0..bb03199 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.6 -Release: 2%{?dist} +Release: 3%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 1.1.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Fri Jul 22 2022 Fedora Release Engineering - 1.1.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 7bc9463df441ea599ab31cedea710d297744b54d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sun, 7 May 2023 14:32:21 +0200 Subject: [PATCH 46/75] updated to 1.1.7 --- .gitignore | 2 ++ ocserv.spec | 9 ++++++--- sources | 4 ++-- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index d8812e1..1435b3a 100644 --- a/.gitignore +++ b/.gitignore @@ -237,3 +237,5 @@ /ocserv-1.1.4.tar.xz.sig /ocserv-1.1.6.tar.xz.sig /ocserv-1.1.6.tar.xz +/ocserv-1.1.7.tar.xz +/ocserv-1.1.7.tar.xz.sig diff --git a/ocserv.spec b/ocserv.spec index bb03199..adc065b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ -Version: 1.1.6 -Release: 3%{?dist} +Version: 1.1.7 +Release: 1%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -250,7 +250,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/ocserv %config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml -%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING COPYING README.md PACKAGE-LICENSING %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* @@ -272,6 +272,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Sun May 07 2023 Nikos Mavrogiannopoulos - 1.1.7-1 +- Updated to 1.1.7 + * Thu Jan 19 2023 Fedora Release Engineering - 1.1.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index bb03d35..30fa688 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.6.tar.xz.sig) = 2a87768ad63d40053732fa011bbeb3532c9673296b9be299bf8f7d8dd3dd35571eee96c0b4fa9bf5a30633b4c844337ab3d562d6ea2b6ad8efca084eb5e6f502 -SHA512 (ocserv-1.1.6.tar.xz) = d1c5e5cf0e84aab168ed51516534df8b2968194dd1421f33563c61b3e47d5d79ebe9e6ffbf7cbcc9ff1242fae05151024f70ef586d063bec0b3eec00050bfdfa +SHA512 (ocserv-1.1.7.tar.xz) = 5b6182b98c0406a27dae7121ec0d8771b158e0d8ce2056bd35451c8ed087a8b7f7d40035f9db5c19aa9a9a3b2c6b07be8f0bad4b6b96569584815a5358202ba4 +SHA512 (ocserv-1.1.7.tar.xz.sig) = 96d2562fdf918f2b6ea829d747330a3be2e015ab25897e01bd0d387cb69ef3592aacabbeec9612e95eca1fbce6178a176dbf76d553b7626c09d453d216ddd63d From 8536d0e5f064fb8fee9098ca18172f39f4f300e9 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 22 Jun 2023 12:27:36 +0200 Subject: [PATCH 47/75] Backported fixes for expired certificates --- expired-certs.patch | 2308 +++++++++++++++++++++++++++++++++++++++++++ ocserv.spec | 9 +- 2 files changed, 2316 insertions(+), 1 deletion(-) create mode 100644 expired-certs.patch diff --git a/expired-certs.patch b/expired-certs.patch new file mode 100644 index 0000000..443bd7b --- /dev/null +++ b/expired-certs.patch @@ -0,0 +1,2308 @@ +diff --git a/tests/Makefile.am b/tests/Makefile.am +index d965eae..ecc417c 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -44,7 +44,8 @@ EXTRA_DIST = certs/ca-key.pem certs/ca.pem ns.sh common.sh certs/server-cert.pem + data/disconnect-user2.config data/ping-leases.config data/haproxy-proxyproto.config \ + data/haproxy-proxyproto.cfg scripts/proxy-connectscript data/haproxy-proxyproto-v1.config \ + data/haproxy-proxyproto-v1.cfg scripts/proxy-connectscript-v1 data/test-multiple-client-ip.config \ +- data/test-client-bypass-protocol.config asan.supp ++ data/test-client-bypass-protocol.config asan.supp certs/ca.tmpl certs/server-cert.tmpl \ ++ certs/user-cert.tmpl + + xfail_scripts = + dist_check_SCRIPTS = ocpasswd-test +@@ -176,6 +177,25 @@ gen_oidc_test_data_CPPFLAGS = $(AM_CPPFLAGS) + gen_oidc_test_data_SOURCES = generate_oidc_test_data.c + gen_oidc_test_data_LDADD = $(LDADD) $(CJOSE_LIBS) $(JANSSON_LIBS) + ++certs/ca.pem: certs/ca-key.pem certs/ca.tmpl ++ certtool --generate-self-signed --template certs/ca.tmpl --load-privkey certs/ca-key.pem --outfile certs/ca.pem ++ ++certs/server-cert-ca.pem: certs/ca.pem certs/server-cert.pem ++ cat certs/server-cert.pem certs/ca.pem > certs/server-cert-ca.pem ++ ++certs/server-cert.pem: certs/server-cert.tmpl certs/ca.pem certs/server-key.pem certs/ca-key.pem ++ certtool --generate-certificate --template certs/server-cert.tmpl --load-privkey certs/server-key.pem --load-ca-certificate certs/ca.pem --load-ca-privkey certs/ca-key.pem --outfile certs/server-cert.pem ++ ++certs/user-cert.pem: certs/user-cert.tmpl certs/ca.pem certs/user-key.pem certs/ca-key.pem ++ certtool --generate-certificate --template certs/user-cert.tmpl --load-privkey certs/user-key.pem --load-ca-certificate certs/ca.pem --load-ca-privkey certs/ca-key.pem --outfile certs/user-cert.pem ++ ++# make the user certificate invalid by signing it with another CA ++certs/user-cert-invalid.pem: certs/user-cert.tmpl ++ certtool --generate-privkey --outfile ca-key.tmp ++ certtool --generate-self-signed --template certs/ca.tmpl --load-privkey ca-key.tmp --outfile ca.tmp ++ certtool --generate-certificate --template certs/user-cert.tmpl --load-privkey certs/user-key.pem --load-ca-certificate ca.tmp --load-ca-privkey ca-key.tmp --outfile certs/user-cert-invalid.pem ++ rm -f ca-key.tmp ca.tmp ++ + if ENABLE_OIDC_AUTH_TESTS + check_PROGRAMS += gen_oidc_test_data + dist_check_SCRIPTS += test-oidc +diff --git a/tests/apple-ios b/tests/apple-ios +index 897d823..45b0cd3 100755 +--- a/tests/apple-ios ++++ b/tests/apple-ios +@@ -54,11 +54,11 @@ wait_server $PID + sleep 2 + + echo " * Connecting to obtain cookie... " +-( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null ) || ++( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null ) || + fail $PID "Could not receive cookie from server" + + echo " * Re-connect to force script run with platform... " +-echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 ++echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 + + sleep 5 + +@@ -87,7 +87,7 @@ fi + rm -f ${TMPFILE} + + echo " * Re-connecting to force script run with user agent... " +-echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose --useragent="Cisco AnyConnect VPN Agent for Apple" localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 ++echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose --useragent="Cisco AnyConnect VPN Agent for Apple" localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 + + sleep 5 + +@@ -114,7 +114,7 @@ fi + sleep 5 + echo " - Check server status" + +-( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo " - Killing server" +diff --git a/tests/banner b/tests/banner +index 44954e2..08f8f19 100755 +--- a/tests/banner ++++ b/tests/banner +@@ -50,7 +50,7 @@ wait_server $PID + sleep 3 + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >${TMPFILE} 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >${TMPFILE} 2>&1 ) || + fail $PID "Could not receive cookie from server" + + grep "${BANNER}" ${TMPFILE} >/dev/null +@@ -61,7 +61,7 @@ if test $? != 0;then + fi + + echo "Connecting to obtain cookie with wrong password... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >${TMPFILE} 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >${TMPFILE} 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + grep "${BANNER}" ${TMPFILE} >/dev/null +diff --git a/tests/certs/ca-key.pem b/tests/certs/ca-key.pem +index 9bd0754..ee5599c 100644 +--- a/tests/certs/ca-key.pem ++++ b/tests/certs/ca-key.pem +@@ -31,25 +31,3 @@ y1hvTfWRAoGZALNT3AbF9EDnJmZlS30MWtBggw83UhszC8XN2tY30AsvsDOS6a0F + UVhyNvBTKo6lPqXqUsVxp16TKeeQKF+DuYuuNZN3pXXsHTiHkRMDCRVEqz7UnZEc + /Bq/Kh2aOkelkX2S27QzTZGL + -----END RSA PRIVATE KEY----- +------BEGIN CERTIFICATE----- +-MIIDtDCCAmygAwIBAgIETeC0yjANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDEw5H +-bnVUTFMgVGVzdCBDQTAeFw0xMTA1MjgwODM5MzlaFw0zODEwMTIwODM5NDBaMC8x +-LTArBgNVBAMTJEdudVRMUyBUZXN0IFNlcnZlciAoUlNBIGNlcnRpZmljYXRlKTCC +-AVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/HsqwfvTYvO1D +-hmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJl1U1F/Oh +-ckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq +-58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mB +-VAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03 +-U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b7eujbZ3L +-xTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUC +-AwEAAaOBjTCBijAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAT +-BgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBR2 +-B1hM6rUp9S2ABoyDSoINCeyT3jAfBgNVHSMEGDAWgBRNVrdqAFjxZ5L0pnVVG45T +-AQPvzzANBgkqhkiG9w0BAQsFAAOCATEAdNWmTsh5uIfngyhOWwm7pK2+vgUMY8nH +-gMoMFHt0yuxuImcUMXu3LRS1dZSoCJACBpTFGi/Dg2U0qvOHQcEmc3OwNqHB90R3 +-LG5jUSCtq/bYW7h/6Gd9KeWCgZczaHbQ9IPTjLH1dLswVPt+fXKB6Eh0ggSrGATE +-/wRZT/XgDCW8t4C+2+TmJ8ZEzvU87KAPQ9rUBS1+p3EUAR/FfMApApsEig1IZ+ZD +-5joaGBW7zh1H0B9mEKidRvD7yuRJyzAcvD25nT15NLW0QR3dEeXosLc720xxJl1h +-h8NJ7YOvn323mOjR9er4i4D6iJlXmJ8tvN9vakCankWvBzb7plFn2sfMQqICFpRc +-w075D8hdQxfpGffL2tEeKSgjyNHXS7x3dFhUpN3IQjUi2x4f2e/ZXg== +------END CERTIFICATE----- +diff --git a/tests/certs/ca.pem b/tests/certs/ca.pem +index c4058ee..02f0b76 100644 +--- a/tests/certs/ca.pem ++++ b/tests/certs/ca.pem +@@ -1,20 +1,20 @@ + -----BEGIN CERTIFICATE----- +-MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD +-EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw +-fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ +-l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW +-DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh +-zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt +-c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b +-7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep +-n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA +-MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC +-ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT +-z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP +-g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX +-ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk +-x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH +-yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg +-fJbi9Ui2FmXEeKkX34f1ONNj9Q== ++MIIDPDCCAfSgAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzAyMTMxNTMyMTJaGA85OTk5MTIzMTIzNTk1OVowDTELMAkGA1UEAxMC ++Q0EwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQC0ayeYJa/B/x7KsH70 ++2LztQ4ZnVF3atB7CkF+DPAIR/BNyhbKIpGVBC3ZfI76Kn/55S3M7LsdLPL8WyZdV ++NRfzoXJLMMLgJ5QS81YA5s6CSxFdpB6b+vq5GypNGLW6peYMx6iooW2qiITclg6y ++bBw1qufHlD351cfCog1Ls2569whfxQnNFZMa95jfKkxmiSTtH9AWY4FlpVg7oc0l ++YpuZgVQIFxjsfC8IojsoVzKdF0cKhvtisUGZ5vveqOogfvMb7rrqmiFkKZLyrXPl ++GQWdN1PiEZ8YXyK64osNAIyeL6eHPUC+SqKlkggMLmHAWHyameHWrIM5Jc8+G+3r ++o22dy8U43sHHbps0FL4wPoKQHrlKmnbk7zMMRqIxcvbDYQv4qmeJ9KXldjehKZ+A ++eap1AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMB0G ++A1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOCATEA ++foqPGdiyJYHih4J5YHwFPQxmkOzPHSa13K/q8sDvobE+HFTzrlTbAFC8bS38Bv2f ++9ZrPME4JvnsGdRGYwxS3LUmNdHHWR8LkvGXBE3u/TZsJfPtOR8JwdulQXpRw7hhL ++ew/mR5IEHZrUZgnnI4dg1kJhE1JPTvmtgqcE1CsikVQ14NvG/ehJbJyPgKTq/Zxm ++Ru4B5N+Jef/LaOqZvK4xK8x2ZaZ/L/ANou+7EY4DoWAkOEEoCU8DQHLAFgf6B7La ++oemLQGNHcBpba81jlS5EXXGJccOvfbw0MJTP3ZvyVIlEYu/X4roC7EJP/UkCZUJG ++f79Nc28q2/2D8tuFOqG7UbP7r2cWSa8OO3cI/V1W1k3iWZ63WltqDwFC0c8iqYFL ++9xKfQ96Q7wrYOCjmuaCLbw== + -----END CERTIFICATE----- +diff --git a/tests/certs/ca.tmpl b/tests/certs/ca.tmpl +new file mode 100644 +index 0000000..da5cc3f +--- /dev/null ++++ b/tests/certs/ca.tmpl +@@ -0,0 +1,6 @@ ++cn = CA ++ca ++cert_signing_key ++expiration_days = -1 ++activation_date = "2013-02-13 16:32:12" ++serial = 0x51d82ecc +diff --git a/tests/certs/server-cert-ca.pem b/tests/certs/server-cert-ca.pem +index 818101a..8ffaad3 100644 +--- a/tests/certs/server-cert-ca.pem ++++ b/tests/certs/server-cert-ca.pem +@@ -1,42 +1,42 @@ + -----BEGIN CERTIFICATE----- +-MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD +-Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs +-PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 +-u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd +-YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ +-IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 +-KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 +-7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU +-yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL +-gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg +-ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 +-UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s +-9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 +-GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C +-zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ +-eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF +-FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j +-LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM +-zzJKdNg= ++MIIDjjCCAkagAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJ ++bG9jYWxob3N0MIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEApzor7D8U ++sCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leAWOGW/O7QvQQVfl9/pTP4/LuR ++7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6zJlm4RYJFZTeX06qGNJZ3WCc ++dl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kapfe2AGUV3DKEF1Y20Zs1S2SFb ++pkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ROhb62gHMvniNIF0xpO+fSjT ++2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjpV3Ymf8ox4OfkSkOXbd3ZOe5Q ++CFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0uxLQdDQiDO4b4ct9kKyeWVMjZ ++3E0n+qjFaHnYHQIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ ++bG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIFoDAd ++BgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0UwqJ ++MThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAGQoUMiZVg6+Ibj8kyfq ++l/vfu4QxlUlqAbm/b9PVdOLrhz+T986HMFhL0b2HUGg5Mb0NZcgHjH4VLkei4AIb ++g/1nGdJ2I6EcLiQOvO4h2F3CoU6HkEGVEUXFaBd19tSDm7aM+2h7oPb3Vs3YT9QE ++x7ejmVeA+Qr9+H9xHyModpA1PkKRW31TOYtjUXHdHObT1uar++C1JLHn49ooKDZM ++5p9a4ExQVYd6WMRXKC83py1V4Ne5kBxC/l+3QkVZnMwByChySP7SEMa9yGv4KFM9 ++FT7XvxQsrkqPi5bCllUyGDrVeyTpyPDrb4BKgAu/Cy4tyDxLzBTZ5TXDH7E1IBps ++g1k5llFIyGdO5vQrX8vF61tqK5DBhgVvwu0k/m2lP9esLfaF7I5oGAbUKGhRr8mE ++xs8= + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- +-MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD +-EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw +-fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ +-l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW +-DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh +-zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt +-c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b +-7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep +-n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA +-MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC +-ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT +-z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP +-g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX +-ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk +-x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH +-yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg +-fJbi9Ui2FmXEeKkX34f1ONNj9Q== ++MIIDPDCCAfSgAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzAyMTMxNTMyMTJaGA85OTk5MTIzMTIzNTk1OVowDTELMAkGA1UEAxMC ++Q0EwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQC0ayeYJa/B/x7KsH70 ++2LztQ4ZnVF3atB7CkF+DPAIR/BNyhbKIpGVBC3ZfI76Kn/55S3M7LsdLPL8WyZdV ++NRfzoXJLMMLgJ5QS81YA5s6CSxFdpB6b+vq5GypNGLW6peYMx6iooW2qiITclg6y ++bBw1qufHlD351cfCog1Ls2569whfxQnNFZMa95jfKkxmiSTtH9AWY4FlpVg7oc0l ++YpuZgVQIFxjsfC8IojsoVzKdF0cKhvtisUGZ5vveqOogfvMb7rrqmiFkKZLyrXPl ++GQWdN1PiEZ8YXyK64osNAIyeL6eHPUC+SqKlkggMLmHAWHyameHWrIM5Jc8+G+3r ++o22dy8U43sHHbps0FL4wPoKQHrlKmnbk7zMMRqIxcvbDYQv4qmeJ9KXldjehKZ+A ++eap1AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMB0G ++A1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOCATEA ++foqPGdiyJYHih4J5YHwFPQxmkOzPHSa13K/q8sDvobE+HFTzrlTbAFC8bS38Bv2f ++9ZrPME4JvnsGdRGYwxS3LUmNdHHWR8LkvGXBE3u/TZsJfPtOR8JwdulQXpRw7hhL ++ew/mR5IEHZrUZgnnI4dg1kJhE1JPTvmtgqcE1CsikVQ14NvG/ehJbJyPgKTq/Zxm ++Ru4B5N+Jef/LaOqZvK4xK8x2ZaZ/L/ANou+7EY4DoWAkOEEoCU8DQHLAFgf6B7La ++oemLQGNHcBpba81jlS5EXXGJccOvfbw0MJTP3ZvyVIlEYu/X4roC7EJP/UkCZUJG ++f79Nc28q2/2D8tuFOqG7UbP7r2cWSa8OO3cI/V1W1k3iWZ63WltqDwFC0c8iqYFL ++9xKfQ96Q7wrYOCjmuaCLbw== + -----END CERTIFICATE----- +diff --git a/tests/certs/server-cert.pem b/tests/certs/server-cert.pem +index 4acde02..b304b47 100644 +--- a/tests/certs/server-cert.pem ++++ b/tests/certs/server-cert.pem +@@ -1,22 +1,22 @@ + -----BEGIN CERTIFICATE----- +-MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD +-Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs +-PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 +-u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd +-YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ +-IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 +-KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 +-7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU +-yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL +-gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg +-ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 +-UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s +-9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 +-GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C +-zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ +-eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF +-FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j +-LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM +-zzJKdNg= ++MIIDjjCCAkagAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJ ++bG9jYWxob3N0MIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEApzor7D8U ++sCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leAWOGW/O7QvQQVfl9/pTP4/LuR ++7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6zJlm4RYJFZTeX06qGNJZ3WCc ++dl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kapfe2AGUV3DKEF1Y20Zs1S2SFb ++pkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ROhb62gHMvniNIF0xpO+fSjT ++2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjpV3Ymf8ox4OfkSkOXbd3ZOe5Q ++CFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0uxLQdDQiDO4b4ct9kKyeWVMjZ ++3E0n+qjFaHnYHQIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ ++bG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIFoDAd ++BgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0UwqJ ++MThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAGQoUMiZVg6+Ibj8kyfq ++l/vfu4QxlUlqAbm/b9PVdOLrhz+T986HMFhL0b2HUGg5Mb0NZcgHjH4VLkei4AIb ++g/1nGdJ2I6EcLiQOvO4h2F3CoU6HkEGVEUXFaBd19tSDm7aM+2h7oPb3Vs3YT9QE ++x7ejmVeA+Qr9+H9xHyModpA1PkKRW31TOYtjUXHdHObT1uar++C1JLHn49ooKDZM ++5p9a4ExQVYd6WMRXKC83py1V4Ne5kBxC/l+3QkVZnMwByChySP7SEMa9yGv4KFM9 ++FT7XvxQsrkqPi5bCllUyGDrVeyTpyPDrb4BKgAu/Cy4tyDxLzBTZ5TXDH7E1IBps ++g1k5llFIyGdO5vQrX8vF61tqK5DBhgVvwu0k/m2lP9esLfaF7I5oGAbUKGhRr8mE ++xs8= + -----END CERTIFICATE----- +diff --git a/tests/certs/server-cert.tmpl b/tests/certs/server-cert.tmpl +new file mode 100644 +index 0000000..82e34ca +--- /dev/null ++++ b/tests/certs/server-cert.tmpl +@@ -0,0 +1,8 @@ ++cn = localhost ++dns_name = localhost ++tls_www_server ++signing_key ++encryption_key ++expiration_days = -1 ++activation_date = "2013-06-06 14:51:29" ++serial = 0x51d82ef0 +diff --git a/tests/certs/user-cert-invalid.pem b/tests/certs/user-cert-invalid.pem +index 0175bdf..4f5dd96 100644 +--- a/tests/certs/user-cert-invalid.pem ++++ b/tests/certs/user-cert-invalid.pem +@@ -1,107 +1,23 @@ +-X.509 Certificate Information: +- Version: 3 +- Serial Number (hex): 51d82f14 +- Issuer: CN=CA +- Validity: +- Not Before: Sat Jul 06 14:52:05 UTC 2013 +- Not After: Mon May 15 14:52:05 UTC 2023 +- Subject: CN=A user,UID=test +- Subject Public Key Algorithm: RSA +- Algorithm Security Level: Medium (2432 bits) +- Modulus (bits 2432): +- 00:ab:54:98:fc:a9:c6:15:95:9d:a6:c1:94:84:94:91 +- 79:1e:78:db:2d:48:51:99:65:01:02:c0:40:52:49:5d +- eb:70:bc:26:ef:68:39:1e:04:91:e2:db:cb:6f:93:40 +- 45:1e:22:8e:71:5a:58:89:28:79:5e:1a:32:25:3e:8b +- 9d:3b:34:7f:19:f8:d0:2f:37:b7:62:32:b7:53:a5:43 +- 2c:c5:5d:ec:ac:f9:35:fa:14:2b:34:66:f1:d6:a7:a1 +- d0:83:9a:56:f4:19:83:bc:bf:11:74:30:2d:a8:28:5b +- a2:ab:7a:c6:cd:9c:5c:f8:51:e9:a9:0c:48:db:71:bb +- b1:34:77:f7:ee:de:5d:78:c0:48:0a:37:0d:65:1e:3b +- 2b:14:03:89:72:f2:52:ed:5f:00:c5:06:60:ea:80:20 +- d0:43:ec:66:bc:d2:26:db:f0:29:3e:6a:f9:62:20:be +- 58:26:44:ba:d7:8c:6f:76:a6:05:20:e4:98:b7:c4:72 +- 7a:5d:df:4f:0d:23:ec:2e:9c:71:ec:30:f9:14:5f:c8 +- 75:0b:ab:67:f6:7d:fb:4d:76:64:4a:a5:d5:fa:b4:08 +- 50:9d:13:c7:8f:c2:79:b0:b4:3e:2f:89:d3:33:27:4d +- 9f:8b:d3:60:24:07:ab:b2:72:3d:29:a5:c4:4a:ec:3c +- 04:d2:49:3e:26:1b:ec:7a:10:3d:ca:45:5a:80:8b:4d +- 2a:96:63:4f:2d:63:28:0f:3b:47:47:ca:7c:2c:15:41 +- 32:d5:e0:c9:be:a5:55:2c:b3:6b:46:2a:56:b1:1b:ed +- 29 +- Exponent (bits 24): +- 01:00:01 +- Extensions: +- Basic Constraints (critical): +- Certificate Authority (CA): FALSE +- Key Purpose (not critical): +- TLS WWW Client. +- Key Usage (critical): +- Digital signature. +- Key encipherment. +- Subject Key Identifier (not critical): +- 8b01094b3b91ece321b91dec8d6b4c5d9e40805e +- Authority Key Identifier (not critical): +- 482334530a8931384a5aeacab6d2a6dece1d2b18 +- Signature Algorithm: RSA-SHA256 +- Signature: +- 6b:bd:e2:90:d7:11:cf:6c:0d:e3:bd:f4:61:cd:57:83 +- 41:be:2a:92:46:dd:fa:44:6c:60:1c:ef:3e:1e:2f:e1 +- e2:5b:45:88:6a:1e:50:2d:8d:96:c4:c7:80:75:59:7b +- 54:6b:fb:86:b0:f1:6d:45:09:db:48:de:20:0a:87:60 +- 30:5e:35:f0:52:c4:55:44:c1:ff:e1:7c:3d:d6:6d:58 +- ca:1c:fd:bf:04:9a:9b:10:35:05:fc:d1:01:3c:af:bb +- 64:31:5e:59:8f:ef:6f:0d:35:e5:c0:07:77:0e:31:20 +- 8e:e3:2e:f1:a6:4d:f1:be:85:5b:df:04:48:9d:8c:c9 +- c9:c1:b8:e3:e2:d2:4b:55:83:e9:d8:7b:71:2f:8e:89 +- fc:4d:a7:f1:b0:bf:47:9b:97:c4:85:dd:c3:3d:38:15 +- 36:08:73:10:87:08:f6:e6:1c:4e:29:a8:a5:f5:24:b8 +- 0d:e9:d9:b8:19:27:1d:73:35:fe:7b:81:1f:4a:81:6a +- 93:cd:a2:71:d7:60:0e:08:ee:ea:c8:2b:44:1b:e4:45 +- 6c:fe:44:68:d6:86:ad:89:4f:7e:9f:f9:1a:2a:97:0f +- 6b:eb:5d:6e:38:b3:5b:13:b9:e3:4a:10:32:5b:dc:a9 +- b4:a1:4e:b3:f9:4f:91:de:bc:cc:36:91:44:ba:e0:34 +- 74:f7:68:b4:7b:0e:db:4e:ec:28:03:01:cf:0a:63:c4 +- 23:75:0b:4b:41:9d:e0:68:b3:cb:bf:b5:5c:3d:52:93 +- 20:ba:ea:b8:f0:8c:f7:a6:ec:cd:a3:aa:4f:2a:ff:20 +-Other Information: +- SHA1 fingerprint: +- 5509a76b8738216938cdb3ec25048812737170de +- SHA256 fingerprint: +- c93e38ef35f1a9c485a27b161e708f2d45bf8768eb53a23fec841a8f35d6e478 +- Public Key ID: +- 8b01094b3b91ece321b91dec8d6b4c5d9e40805e +- Public key's random art: +- +--[ RSA 2432]----+ +- | o=o | +- |..oE.. | +- |.+=.o | +- |o.*.... | +- | * B +..S | +- |. * o oo . | +- | o . . . | +- | + | +- | . | +- +-----------------+ +- + -----BEGIN CERTIFICATE----- +-MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD +-EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF +-AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw +-vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF +-Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0 +-d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm +-RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd +-E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW +-Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB +-Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD +-VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4 +-SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveKQ1xHPbA3jvfRhzVeD +-Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg +-MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg +-juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV +-NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF +-bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0 +-dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g ++MIID2TCCAkGgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowJzEPMA0GA1UEAxMG ++QSB1c2VyMRQwEgYKCZImiZPyLGQBARMEdGVzdDCCAVIwDQYJKoZIhvcNAQEBBQAD ++ggE/ADCCAToCggExAKtUmPypxhWVnabBlISUkXkeeNstSFGZZQECwEBSSV3rcLwm ++72g5HgSR4tvLb5NARR4ijnFaWIkoeV4aMiU+i507NH8Z+NAvN7diMrdTpUMsxV3s ++rPk1+hQrNGbx1qeh0IOaVvQZg7y/EXQwLagoW6KresbNnFz4UempDEjbcbuxNHf3 ++7t5deMBICjcNZR47KxQDiXLyUu1fAMUGYOqAINBD7Ga80ibb8Ck+avliIL5YJkS6 ++14xvdqYFIOSYt8Ryel3fTw0j7C6cceww+RRfyHULq2f2fftNdmRKpdX6tAhQnRPH ++j8J5sLQ+L4nTMydNn4vTYCQHq7JyPSmlxErsPATSST4mG+x6ED3KRVqAi00qlmNP ++LWMoDztHR8p8LBVBMtXgyb6lVSyza0YqVrEb7SkCAwEAAaN1MHMwDAYDVR0TAQH/ ++BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0O ++BBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFAV+KcZC+G2nf/6V ++sElx119oZKWUMA0GCSqGSIb3DQEBCwUAA4IBgQCTOjwtK5sDPFdbWWlScDX9xfNf ++tnqRL22Id6VIRcAiuu6KVAYRNs3Pdv65H9orSaohrBRfWKEqAi51bhvDQvzhbw7u ++881txF+6s0fauArxAUai3e11eCil3gt0JOQVephmPKw6pVq9mMieho5I2SQ8CXoQ ++pSrselGaOTp8CK1r90pn8RGiJrZ3xJu5Yezb3AWCs3IOHhRT1Rc5mFnvs9VVR64h ++Pvlr9yBOf/pBEuylQr00plhsZdLra/nIspsGnOIiuM4eIliP6bQwE06u1LxlCbgB ++CAGTQ86vbO2xT1i8dZeq8TJ72OatmRboUBncaZNIT3rUTZxZYkYhkNtVTKnv/8qq ++LZI23qtcWLEAsc1O0Xva22wjkg5QE06AiWdcwK3f/Qpvj5yO9+PL7X4lP47n5D6m ++t1S6xisKgjo/IP9Wk3mPNaNDN3hZCaFRYEHn4CYrlXHqjg1w7quCKApYzrh5/L1Y ++b9U/qzwF7SatFovndYtf02bjcrHC/TA53IdiQPA= + -----END CERTIFICATE----- +diff --git a/tests/certs/user-cert.pem b/tests/certs/user-cert.pem +index ef5114c..32ab235 100644 +--- a/tests/certs/user-cert.pem ++++ b/tests/certs/user-cert.pem +@@ -1,21 +1,21 @@ + -----BEGIN CERTIFICATE----- +-MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD +-QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD +-EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF +-AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw +-vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF +-Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0 +-d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm +-RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd +-E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW +-Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB +-Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD +-VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4 +-SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveOQ1xHPbA3jvfRhzVeD +-Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg +-MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg +-juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV +-NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF +-bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0 +-dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g ++MIIDiTCCAkGgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD ++QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowJzEPMA0GA1UEAxMG ++QSB1c2VyMRQwEgYKCZImiZPyLGQBARMEdGVzdDCCAVIwDQYJKoZIhvcNAQEBBQAD ++ggE/ADCCAToCggExAKtUmPypxhWVnabBlISUkXkeeNstSFGZZQECwEBSSV3rcLwm ++72g5HgSR4tvLb5NARR4ijnFaWIkoeV4aMiU+i507NH8Z+NAvN7diMrdTpUMsxV3s ++rPk1+hQrNGbx1qeh0IOaVvQZg7y/EXQwLagoW6KresbNnFz4UempDEjbcbuxNHf3 ++7t5deMBICjcNZR47KxQDiXLyUu1fAMUGYOqAINBD7Ga80ibb8Ck+avliIL5YJkS6 ++14xvdqYFIOSYt8Ryel3fTw0j7C6cceww+RRfyHULq2f2fftNdmRKpdX6tAhQnRPH ++j8J5sLQ+L4nTMydNn4vTYCQHq7JyPSmlxErsPATSST4mG+x6ED3KRVqAi00qlmNP ++LWMoDztHR8p8LBVBMtXgyb6lVSyza0YqVrEb7SkCAwEAAaN1MHMwDAYDVR0TAQH/ ++BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0O ++BBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4Slrq ++yrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQAp51Ks5DDWVlLB6fMM2NJV80sX ++Rx6U1g6ovA7N5BDQiF6FYzVZECMH3d9nyZssHbkzb6qyO1m58P0cNkVurEH27+Z2 ++xdkNw5bbcvNDVhfVSjwa6nyTLfhf7vOTWaIxGGmffP72PIe87N6QmyCCGG0IXIkO ++kcTAE8IgX6k1mEr1Xy2ZtFVgKjPPLxsixIJ7TEktvJR1RqWQfbsOS8f13lvS1Vhh ++vc+UMbIQnz+jl4qNV/AX7GfpEYiBkbrgcjsggl/KMuwcauhEDdvfIQjcyRbQN36p ++KcVEXDpnG54sAfXAs9Z+adbvmu0ONAMCDuxKCT2eG1SGVrtiT5+7kCMso1eKz/5A ++r1XP0RgCKFExIRYb1elFpLc8wmJbN4qof2zisKG8UajFIHzIGateiu53enNn + -----END CERTIFICATE----- +diff --git a/tests/certs/user-cert.tmpl b/tests/certs/user-cert.tmpl +new file mode 100644 +index 0000000..6a60496 +--- /dev/null ++++ b/tests/certs/user-cert.tmpl +@@ -0,0 +1,7 @@ ++dn = "uid=test,cn=A user" ++tls_www_client ++signing_key ++encryption_key ++expiration_days = -1 ++activation_date = "2013-06-06 14:51:29" ++serial = 0x51d82f14 +diff --git a/tests/cipher-common.sh b/tests/cipher-common.sh +index fb9e2ac..07443a0 100755 +--- a/tests/cipher-common.sh ++++ b/tests/cipher-common.sh +@@ -91,14 +91,14 @@ fi + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ${CSTR} --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ${CSTR} --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ${CSTR} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ${CSTR} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/disconnect-user b/tests/disconnect-user +index 67a016e..bf4c7ab 100755 +--- a/tests/disconnect-user ++++ b/tests/disconnect-user +@@ -77,7 +77,7 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${TMPFILE} ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${TMPFILE} ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 +@@ -85,7 +85,7 @@ fi + + eval $(cat ${TMPFILE}) + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) ++( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -105,7 +105,7 @@ if test $? != 0;then + fi + + echo " * Re-connecting to obtain cookie after disconnect... " +-( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) ++( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) + if test $? = 0;then + echo "Succeeded using the cookie to connect" + exit 1 +diff --git a/tests/disconnect-user2 b/tests/disconnect-user2 +index ef8c3c1..e00cc67 100755 +--- a/tests/disconnect-user2 ++++ b/tests/disconnect-user2 +@@ -75,7 +75,7 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${TMPFILE} ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${TMPFILE} ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 +@@ -83,7 +83,7 @@ fi + + eval $(cat ${TMPFILE}) + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) ++( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -103,7 +103,7 @@ if test $? != 0;then + fi + + echo " * Re-connecting to obtain cookie after disconnect... " +-( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) ++( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) + if test $? = 0;then + echo "Succeeded using the cookie to connect" + exit 1 +diff --git a/tests/drain-server b/tests/drain-server +index be51cd4..808067f 100755 +--- a/tests/drain-server ++++ b/tests/drain-server +@@ -35,7 +35,7 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + if ! test -f ${PIDFILE};then +@@ -48,7 +48,7 @@ kill -15 $(cat $PIDFILE) + sleep 1 + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) && + fail $PID "Server is still listening" + + wait +diff --git a/tests/drain-server-fail b/tests/drain-server-fail +index d61106e..a2c495d 100755 +--- a/tests/drain-server-fail ++++ b/tests/drain-server-fail +@@ -48,7 +48,7 @@ launch_simple_sr_server -d 3 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + if ! test -f ${PIDFILE};then +diff --git a/tests/flowcontrol b/tests/flowcontrol +index fb60f67..7ef6b70 100755 +--- a/tests/flowcontrol ++++ b/tests/flowcontrol +@@ -37,39 +37,39 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with wrong password... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + echo "Connecting to obtain cookie with empty password... " +-( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + echo "Connecting to obtain cookie with wrong username... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + # test locked account + + echo "Connecting to obtain cookie with locked account... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + #test special characters + + echo "Connecting to obtain cookie with special password... " +-( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with empty password... " +-( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + #echo "Normal connection... " +-#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || ++#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || + # fail $PID "Could not connect to server" + + if ! test -f ${PIDFILE};then +diff --git a/tests/haproxy-auth b/tests/haproxy-auth +index b653714..5261860 100755 +--- a/tests/haproxy-auth ++++ b/tests/haproxy-auth +@@ -51,7 +51,7 @@ LD_PRELOAD=libsocket_wrapper.so:libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT + wait_server ${HAPID} + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + kill ${HAPID} + fail ${PID} "Could not receive cookie from server" +@@ -66,7 +66,7 @@ LD_PRELOAD=libsocket_wrapper.so:libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT + wait_server ${HAPID} + + echo "Re-connecting to obtain cookie after haproxy restart... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + kill ${HAPID} + fail ${PID} "Could not receive cookie from server" +diff --git a/tests/haproxy-connect b/tests/haproxy-connect +index c42b76c..662c08f 100755 +--- a/tests/haproxy-connect ++++ b/tests/haproxy-connect +@@ -91,14 +91,14 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -135,7 +135,7 @@ set +e + sleep 3 + + echo " * Re-connecting to obtain cookie after haproxy restart... " +-( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not receive cookie from server on reconnection" + exit 1 +diff --git a/tests/haproxy-proxyproto b/tests/haproxy-proxyproto +index 70c1390..54e413c 100755 +--- a/tests/haproxy-proxyproto ++++ b/tests/haproxy-proxyproto +@@ -94,14 +94,14 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/haproxy-proxyproto-v1 b/tests/haproxy-proxyproto-v1 +index d274575..f767581 100755 +--- a/tests/haproxy-proxyproto-v1 ++++ b/tests/haproxy-proxyproto-v1 +@@ -94,14 +94,14 @@ sleep 3 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${HAPORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/ipv6-iface b/tests/ipv6-iface +index d5262e5..9b78d5e 100755 +--- a/tests/ipv6-iface ++++ b/tests/ipv6-iface +@@ -70,7 +70,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + wait_server $PID + + echo -n "Connecting to setup interface... " +-echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ++echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/ipv6-small-net b/tests/ipv6-small-net +index 4fc7260..c87b429 100755 +--- a/tests/ipv6-small-net ++++ b/tests/ipv6-small-net +@@ -70,7 +70,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + wait_server $PID + + echo -n "Connecting to setup interface... " +-echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ++echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/json b/tests/json +index 72dd4bf..24c66d8 100755 +--- a/tests/json ++++ b/tests/json +@@ -78,7 +78,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + sleep 4 + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/lz4-compression b/tests/lz4-compression +index 76478cf..405b2a2 100755 +--- a/tests/lz4-compression ++++ b/tests/lz4-compression +@@ -81,14 +81,14 @@ sleep 4 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/lzs-compression b/tests/lzs-compression +index c485df2..eef55f0 100755 +--- a/tests/lzs-compression ++++ b/tests/lzs-compression +@@ -81,14 +81,14 @@ sleep 4 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/multiple-routes b/tests/multiple-routes +index b6cc0c5..63c7614 100755 +--- a/tests/multiple-routes ++++ b/tests/multiple-routes +@@ -39,13 +39,13 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (with certificate)... " +-( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null ) || ++( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Re-connecting to get routes... " +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 + + echo ok + +diff --git a/tests/no-route-default b/tests/no-route-default +index 0c6f4f2..6cc68f0 100755 +--- a/tests/no-route-default ++++ b/tests/no-route-default +@@ -43,7 +43,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to get routes... " +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 + + echo ok + +@@ -68,7 +68,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to get routes... " +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 + + echo ok + +diff --git a/tests/no-route-group b/tests/no-route-group +index 59ec2f0..25cfaa6 100755 +--- a/tests/no-route-group ++++ b/tests/no-route-group +@@ -43,7 +43,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to get routes... " +-echo "test" | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 -u test --passwd-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 ++echo "test" | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 -u test --passwd-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 + + echo ok + +@@ -68,7 +68,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to get routes... " +-echo test | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 --passwd-on-stdin -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 ++echo test | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 --passwd-on-stdin -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 + + echo ok + +diff --git a/tests/ping-leases b/tests/ping-leases +index d97012e..3a43ac5 100755 +--- a/tests/ping-leases ++++ b/tests/ping-leases +@@ -52,12 +52,12 @@ fi + echo "Server started with PID $PID..." + + echo "Connecting to obtain cookie..." +-( echo "test" | $OPENCONNECT -q localhost:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | $OPENCONNECT -q localhost:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + + echo "Connecting to ping lease..." +-echo "test" | timeout 10 $OPENCONNECT localhost:$PORT -u "test" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ++echo "test" | timeout 10 $OPENCONNECT localhost:$PORT -u "test" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true + + if test $? != 124;then + fail $PID "Could not connect to server" +diff --git a/tests/radius b/tests/radius +index 859671d..7bc705a 100755 +--- a/tests/radius ++++ b/tests/radius +@@ -98,21 +98,21 @@ sleep 4 + + # Run clients + echo " * Testing wrong username at ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u xxx --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u xxx --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? = 0;then + echo "Connected with incorrect username" + exit 1 + fi + + echo " * Testing wrong password at ${ADDRESS}:${PORT}..." +-( echo "xxx" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "xxx" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? = 0;then + echo "Connected with incorrect password" + exit 1 + fi + + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 +@@ -120,7 +120,7 @@ fi + + echo " * Connecting to ${ADDRESS}:${PORT} with special IP..." + USERNAME=test-arb +-( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -148,7 +148,7 @@ sleep 3 + + echo " * Connecting to ${ADDRESS}:${PORT}..." + USERNAME=test +-( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/radius-config b/tests/radius-config +index 7285091..af9d3f7 100755 +--- a/tests/radius-config ++++ b/tests/radius-config +@@ -123,7 +123,7 @@ sleep 4 + + echo " * Connecting to ${ADDRESS}:${PORT}..." + USERNAME=testtime +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/radius-group b/tests/radius-group +index 1f28cda..9b85889 100755 +--- a/tests/radius-group ++++ b/tests/radius-group +@@ -100,7 +100,7 @@ sleep 4 + + echo " * Tests the radius group functionality" + USERNAME=test-class +-( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group2 -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group2 -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -137,7 +137,7 @@ sleep 4 + + echo " * Tests the alt radius group functionality" + USERNAME=test-class +-( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group1 -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group1 -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/radius-otp b/tests/radius-otp +index 11c3907..9b4fecb 100755 +--- a/tests/radius-otp ++++ b/tests/radius-otp +@@ -111,7 +111,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + sleep 0.5 + echo "$USERNAME-stage$COUNT" + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b >/dev/null 2>&1) + if test $? != 0; then + echo "Could not connect to server" + exit 1 +@@ -151,7 +151,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + sleep 0.5 + echo "$USERNAME-stage" + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected with wrong username" + exit 1 +@@ -173,7 +173,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + echo "$USERNAME-stage$COUNT" + fi + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected with wrong OTP" + exit 1 +@@ -197,7 +197,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + echo "$USERNAME-stage$COUNT" + fi + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected with wrong OTP" + exit 1 +@@ -218,7 +218,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + echo "$USERNAME-stage$COUNT" + fi + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected with blank OTP" + exit 1 +@@ -247,7 +247,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do + echo "$USERNAME-stage$COUNT" + fi + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Successful connection with the number of OTP retries greater than allowed by the ban system (default 30)." + ${OCCTL} -s ${OCCTL_SOCKET} show ip ban points +@@ -265,7 +265,7 @@ for (( COUNT=1; COUNT <= 17; COUNT++ )); do + sleep 0.5 + echo "$USERNAME-stage$COUNT" + done +-} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) ++} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) + if test $? == 0; then + echo "Connected to server - MAX_CHALLENGES test failed" + exit 1 +diff --git a/tests/test-append-routes b/tests/test-append-routes +index be71d22..923d0aa 100755 +--- a/tests/test-append-routes ++++ b/tests/test-append-routes +@@ -41,7 +41,7 @@ wait_server $PID + + echo "Checking if routes are appended... " + +-timeout 15s $OPENCONNECT localhost:$PORT -v --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 ++timeout 15s $OPENCONNECT localhost:$PORT -v --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 + + echo "cat" + cat ${TMPFILE1} +diff --git a/tests/test-ban b/tests/test-ban +index eb6a874..be4695a 100755 +--- a/tests/test-ban ++++ b/tests/test-ban +@@ -59,15 +59,15 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + sleep 4 + + echo "Connecting with wrong password 5 times... " +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + + echo "" + echo "Connecting with correct password... " +-eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -n "$COOKIE" ];then + fail $PID "Obtained cookie although should have been banned" +@@ -90,7 +90,7 @@ sleep 25 + echo "" + + echo "Connecting with correct password after ban time... " +-eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie even though ban should be lifted" +@@ -99,16 +99,16 @@ fi + echo "" + echo "Checking ban reset time... " + +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + sleep 11 +-echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + + echo "" + echo "Connecting with correct password after ban reset time... " +-eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie even though ban should be lifted" +diff --git a/tests/test-ban-local b/tests/test-ban-local +index d2a4397..fbe0eb2 100755 +--- a/tests/test-ban-local ++++ b/tests/test-ban-local +@@ -60,15 +60,15 @@ ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! + sleep 4 + + echo "Connecting with wrong password 5 times... " +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 +-echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ++echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + + echo "" + echo "Connecting with correct password... " +-eval `echo "test" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie even though client should be exempt" +diff --git a/tests/test-cert b/tests/test-cert +index 41362aa..7967193 100755 +--- a/tests/test-cert ++++ b/tests/test-cert +@@ -49,19 +49,19 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with invalid certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected with invalid certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -80,7 +80,7 @@ kill -HUP $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with DER CRL)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -99,13 +99,13 @@ kill -HUP $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with revoked certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected with revoked certificate!" + + echo "ok (failed as expected)" + + #echo "Normal connection... " +-#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || ++#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || + # fail $PID "Could not connect to server" + + rm -f "${CRLNAME}" "${CRLTMPLNAME}" +diff --git a/tests/test-cert-opt-pass b/tests/test-cert-opt-pass +index 18893d3..0109ef2 100755 +--- a/tests/test-cert-opt-pass ++++ b/tests/test-cert-opt-pass +@@ -34,7 +34,7 @@ opts=$1 + pass=$2 + rm -f ${OUTFILE} + +-echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 ++echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 + if test $? != 0;then + cat ${OUTFILE} + return 1 +diff --git a/tests/test-client-bypass-protocol b/tests/test-client-bypass-protocol +index 09f3cb2..14cb5a5 100755 +--- a/tests/test-client-bypass-protocol ++++ b/tests/test-client-bypass-protocol +@@ -43,7 +43,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting... " +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 + + echo ok + +@@ -68,7 +68,7 @@ PID=$! + wait_server $PID + + echo -n "Reconnecting..." +-timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 ++timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 + + echo ok + +diff --git a/tests/test-config-per-group b/tests/test-config-per-group +index 4a8bd60..6b8929a 100755 +--- a/tests/test-config-per-group ++++ b/tests/test-config-per-group +@@ -81,7 +81,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & + sleep 4 + + echo " * Connecting with user NOT in group..." +-( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -129,7 +129,7 @@ sleep 2 + USERNAME=test + PASSWORD=test + echo " * Connecting with user in group to ${ADDRESS}:${PORT}..." +-( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/test-cookie-invalidation b/tests/test-cookie-invalidation +index 5f77afa..a6f8cea 100755 +--- a/tests/test-cookie-invalidation ++++ b/tests/test-cookie-invalidation +@@ -35,7 +35,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie" +@@ -44,7 +44,7 @@ fi + #echo "Cookie: $COOKIE" + + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background >/dev/null 2>&1 ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background >/dev/null 2>&1 + + sleep 4 + +@@ -58,9 +58,9 @@ if test $? != 0;then + fi + + echo "Terminating and connecting again with same cookie... " +-#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + # fail $PID "Could not connect to server" +-echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 ++echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 + + sleep 4 + +@@ -82,9 +82,9 @@ rm -f "${PIDFILE2}" + sleep 18 + + echo "Proper termination and connecting again with same (invalidated) cookie... " +-#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + # fail $PID "Could not connect to server" +-echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 ++echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 + + sleep 4 + +diff --git a/tests/test-cookie-timeout b/tests/test-cookie-timeout +index 08081b2..b8b4dda 100755 +--- a/tests/test-cookie-timeout ++++ b/tests/test-cookie-timeout +@@ -34,7 +34,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie" +@@ -44,7 +44,7 @@ fi + sleep 16 + echo "" + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background ++echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background + + sleep 4 + +@@ -59,7 +59,7 @@ rm -f "${PIDFILE}" + sleep 16 + echo "" + echo "Connecting again with cookie... " +-echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background ++echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background + + sleep 4 + +@@ -74,7 +74,7 @@ rm -f "${PIDFILE}" + sleep 16 + echo "" + echo "Connecting after forced kill with cookie... " +-echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background ++echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background + + sleep 4 + +@@ -90,7 +90,7 @@ rm -f "${PIDFILE}" + sleep 45 + echo "" + echo "Connecting with cookie after expiration... " +-echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background ++echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background + + sleep 4 + +@@ -104,7 +104,7 @@ fi + # test cookie verification after cookie verification failure. That is to verify whether + # the channel between main and sec-mod is in consistent state. + echo "Connecting (again) to obtain cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= + + if test $? != 0;then + fail $PID "Could not obtain cookie" +diff --git a/tests/test-cookie-timeout-2 b/tests/test-cookie-timeout-2 +index fbeba81..4161eb6 100755 +--- a/tests/test-cookie-timeout-2 ++++ b/tests/test-cookie-timeout-2 +@@ -33,7 +33,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + fail $PID "Could not obtain cookie" +@@ -43,7 +43,7 @@ fi + sleep 10 + echo "" + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background ++echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background + + sleep 4 + +@@ -58,7 +58,7 @@ rm -f "${srcdir}/pid2.$$" + sleep 30 + echo "" + echo "Connecting again with cookie (overriding first session)... " +-echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background ++echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background + + sleep 6 + +diff --git a/tests/test-enc-key b/tests/test-enc-key +index 0ca6249..5d65b62 100755 +--- a/tests/test-enc-key ++++ b/tests/test-enc-key +@@ -33,7 +33,7 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + cleanup +@@ -48,7 +48,7 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + cleanup +diff --git a/tests/test-explicit-ip b/tests/test-explicit-ip +index bfd1a9d..41d4665 100755 +--- a/tests/test-explicit-ip ++++ b/tests/test-explicit-ip +@@ -31,13 +31,13 @@ connect() + opts=$1 + pass=$2 + COOKIE='' +-eval `echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate` ++eval `echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate` + if [ -z "$COOKIE" ];then + return 1 + fi + + rm -f $TMPFILE +-echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 & ++echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 & + CPID=$! + + sleep 3 +diff --git a/tests/test-group-pass b/tests/test-group-pass +index 1530f43..7a78237 100755 +--- a/tests/test-group-pass ++++ b/tests/test-group-pass +@@ -33,19 +33,19 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group1 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group1 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with wrong groupname... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group4 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group4 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + cleanup +diff --git a/tests/test-gssapi-opt-cert b/tests/test-gssapi-opt-cert +index 0ef2d55..5cf1105 100755 +--- a/tests/test-gssapi-opt-cert ++++ b/tests/test-gssapi-opt-cert +@@ -29,7 +29,7 @@ opts=$1 + pass=$2 + rm -f ${OUTFILE} + +-echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 ++echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 + if test $? != 0;then + cat ${OUTFILE} + return 1 +diff --git a/tests/test-gssapi-opt-pass b/tests/test-gssapi-opt-pass +index 8999d30..b6ebd11 100755 +--- a/tests/test-gssapi-opt-pass ++++ b/tests/test-gssapi-opt-pass +@@ -29,7 +29,7 @@ opts=$1 + pass=$2 + rm -f ${OUTFILE} + +-echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 ++echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 + if test $? != 0;then + cat ${OUTFILE} + return 1 +diff --git a/tests/test-iroute b/tests/test-iroute +index d7b5f52..caf0a92 100755 +--- a/tests/test-iroute ++++ b/tests/test-iroute +@@ -34,13 +34,13 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (with certificate)... " +-( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -47,7 +47,7 @@ kill -USR2 $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -58,7 +58,7 @@ kill -USR2 $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +diff --git a/tests/test-max-same-1 b/tests/test-max-same-1 +index 5146483..ec19c0d 100755 +--- a/tests/test-max-same-1 ++++ b/tests/test-max-same-1 +@@ -47,7 +47,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + echo "Could not obtain cookie" +@@ -57,12 +57,12 @@ fi + #echo "Cookie: $COOKIE" + + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background + + sleep 4 + + echo "Connecting again with same cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background + + sleep 4 + +diff --git a/tests/test-multi-cookie b/tests/test-multi-cookie +index 83c9cb5..7581f9c 100755 +--- a/tests/test-multi-cookie ++++ b/tests/test-multi-cookie +@@ -47,7 +47,7 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + echo "Could not obtain cookie" +@@ -57,12 +57,12 @@ fi + #echo "Cookie: $COOKIE" + + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background + + sleep 4 + + echo "Connecting again with same cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background + + sleep 4 + +diff --git a/tests/test-multiple-client-ip b/tests/test-multiple-client-ip +index 0e799e0..76099fe 100755 +--- a/tests/test-multiple-client-ip ++++ b/tests/test-multiple-client-ip +@@ -84,14 +84,14 @@ sleep 4 + + # Run client 1 + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +@@ -99,14 +99,14 @@ fi + + # Run client 2 + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID2} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID2} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 +diff --git a/tests/test-namespace-listen b/tests/test-namespace-listen +index 9691b28..81c3e86 100755 +--- a/tests/test-namespace-listen ++++ b/tests/test-namespace-listen +@@ -77,7 +77,7 @@ if test $? != 0; then + fi + + echo " connecting to server" +-(echo "test" | ${CMDNS3} $OPENCONNECT $ADDRESS:$PORT -u "test" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --pid-file=${CLIPID} -b) || ++(echo "test" | ${CMDNS3} $OPENCONNECT $ADDRESS:$PORT -u "test" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --pid-file=${CLIPID} -b) || + fail $PID "could not connect to server" + sleep 5 + +diff --git a/tests/test-otp b/tests/test-otp +index 5209b0a..ed1fe94 100755 +--- a/tests/test-otp ++++ b/tests/test-otp +@@ -45,27 +45,27 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting with wrong username... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u falsetest --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u falsetest --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Connected with wrong username!" + echo ok + + echo -n "Connecting with wrong OTP... " +-( echo -e "test\n999482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n999482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Should not have connected with wrong OTP!" + echo ok + + echo -n "Connecting with correct password and OTP... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with OTP!" + echo ok + + echo -n "Connecting with empty password and wrong OTP... " +-( echo -e "999999\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "999999\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Should have not connected with wrong OTP!" + echo ok + + echo -n "Connecting with empty password and OTP... " +-( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with OTP-only!" + echo ok + +diff --git a/tests/test-otp-cert b/tests/test-otp-cert +index c8dc12c..61a71db 100755 +--- a/tests/test-otp-cert ++++ b/tests/test-otp-cert +@@ -45,22 +45,22 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + echo ok + + echo -n "Connecting to obtain cookie (with incorrect certificate)... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Should not have connected with wrong certificate!" + echo ok + + echo -n "Connecting to obtain cookie (with certificate)... " +-( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + echo ok + + echo -n "Connecting to obtain cookie (with no pass and certificate)... " +-( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + echo ok + +diff --git a/tests/test-pam b/tests/test-pam +index 8ec787a..561a140 100755 +--- a/tests/test-pam ++++ b/tests/test-pam +@@ -37,22 +37,22 @@ wait_server $PID + + echo "" + echo "Connecting with wrong password... " +-( echo -e "testuser\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "testuser\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with wrong cred" + + echo "" + echo "Connecting with empty password... " +-( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with wrong cred" + + echo "" + echo "Connecting with wrong username... " +-( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with wrong cred" + + echo "" + echo "Connecting with correct password... " +-( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ||#>/dev/null 2>&1 ) || ++( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) ||#>/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + cleanup +diff --git a/tests/test-pam-noauth b/tests/test-pam-noauth +index dc8dd3d..1f67371 100755 +--- a/tests/test-pam-noauth ++++ b/tests/test-pam-noauth +@@ -35,19 +35,19 @@ launch_sr_pam_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting with correct password but no PAM user... " +-( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u xtest --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u xtest --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with non existing user" + + echo "Connecting with incorrect password (correct in PAM) and existing user... " +-( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with non existing user" + + echo "Connecting with empty password (correct in PAM) and existing user... " +-( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie with non existing user" + + echo "Connecting with correct password and existing user... " +-( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ||#>/dev/null 2>&1 ) || ++( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) ||#>/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + cleanup +diff --git a/tests/test-pass b/tests/test-pass +index 9d5484a..5aaaf48 100755 +--- a/tests/test-pass ++++ b/tests/test-pass +@@ -34,39 +34,39 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with wrong password... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + echo "Connecting to obtain cookie with empty password... " +-( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + echo "Connecting to obtain cookie with wrong username... " +-( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + # test locked account + + echo "Connecting to obtain cookie with locked account... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + #test special characters + + echo "Connecting to obtain cookie with special password... " +-( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting to obtain cookie with empty password... " +-( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + #echo "Normal connection... " +-#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || ++#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || + # fail $PID "Could not connect to server" + + if ! test -f ${PIDFILE};then +diff --git a/tests/test-pass-cert b/tests/test-pass-cert +index 8050788..8d284b8 100755 +--- a/tests/test-pass-cert ++++ b/tests/test-pass-cert +@@ -34,26 +34,26 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + + echo ok + + echo -n "Connecting to obtain cookie (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie (with incorrect certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Should not have connected with wrong certificate!" + + echo ok + + + #echo "Normal connection... " +-#( echo "test" | $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || ++#( echo "test" | $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || + # fail $PID "Could not connect to server" + + cleanup +diff --git a/tests/test-pass-group-cert b/tests/test-pass-group-cert +index ff64993..e559ac6 100755 +--- a/tests/test-pass-group-cert ++++ b/tests/test-pass-group-cert +@@ -33,37 +33,37 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group1 (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - DEFAULT (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup DEFAULT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup DEFAULT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group2 (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group3 (hidden) (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group4 (with certificate)... " +-( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group4 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group4 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Got cookie when it shouldn't!" + + echo ok +diff --git a/tests/test-pass-group-cert-no-pass b/tests/test-pass-group-cert-no-pass +index bc39b45..401b24f 100755 +--- a/tests/test-pass-group-cert-no-pass ++++ b/tests/test-pass-group-cert-no-pass +@@ -33,25 +33,25 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 && ++LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 && + fail $PID "Connected without certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group1 (with certificate)... " +-LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || ++LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group2 (with certificate)... " +-LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || ++LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Connecting to obtain cookie - group3 (hidden) (with certificate)... " +-LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || ++LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || + fail $PID "Could not connect with certificate!" + + echo ok +diff --git a/tests/test-pass-opt-cert b/tests/test-pass-opt-cert +index ac9adc1..1836538 100755 +--- a/tests/test-pass-opt-cert ++++ b/tests/test-pass-opt-cert +@@ -38,7 +38,7 @@ connect() + { + opts=$1 + pass=$2 +-echo ${pass} | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --passwd-on-stdin --authenticate >${TMPFILE} ++echo ${pass} | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --passwd-on-stdin --authenticate >${TMPFILE} + if test $? != 0;then + cat ${TMPFILE} + return 1 +diff --git a/tests/test-pass-script b/tests/test-pass-script +index 89a4094..0f18551 100755 +--- a/tests/test-pass-script ++++ b/tests/test-pass-script +@@ -67,7 +67,7 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! + wait_server $PID + + echo " * Connecting to obtain cookie with wrong username... " +-( echo "tost" | $OPENCONNECT -q localhost:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && ++( echo "tost" | $OPENCONNECT -q localhost:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && + fail $PID "Received cookie when we shouldn't" + + rm -f ${builddir}/connect.ok +@@ -76,11 +76,11 @@ rm -f ${builddir}/host-update.ok + #test special characters + + echo " * Connecting to obtain cookie... " +-( echo "!@#$%^&*()<>" | $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo " * Re-connecting to force script run... " +-echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ++echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true + + TIMEOUT=5 + while ! test -f ${builddir}/disconnect.ok; do +@@ -112,7 +112,7 @@ rm -f ${builddir}/disconnect.ok + rm -f ${builddir}/host-update.ok + + echo " * Re-connecting to get cookie... " +-echo "test2" | $OPENCONNECT -q localhost:$PORT -u "test2" --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${PARAMSFILE} ++echo "test2" | $OPENCONNECT -q localhost:$PORT -u "test2" --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${PARAMSFILE} + if test $? != 0;then + echo "Could not connect" + cat ${PARAMSFILE} +@@ -127,7 +127,7 @@ fi + + echo " * Re-connecting to force session stealing... " + eval "$(grep COOKIE ${PARAMSFILE})" +-echo ${COOKIE}| $OPENCONNECT --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true --pid-file=${OPIDFILE} -b ++echo ${COOKIE}| $OPENCONNECT --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true --pid-file=${OPIDFILE} -b + + echo " - Pausing client" + TIMEOUT=4 +@@ -156,7 +156,7 @@ rm -f ${builddir}/connect.ok + rm -f ${builddir}/disconnect.ok + + echo " * Re-connecting to steal previous IP address... " +-echo ${COOKIE} | $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true --pid-file=${OPIDFILE2} -b ++echo ${COOKIE} | $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true --pid-file=${OPIDFILE2} -b + + echo " - Resuming (disconnected) client" + kill -s CONT $(cat ${OPIDFILE}) +@@ -205,7 +205,7 @@ done + sleep 5 + echo " - Check server status" + +-( echo "!@#$%^&*()<>" | $OPENCONNECT --local-hostname='mylocalname' -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "!@#$%^&*()<>" | $OPENCONNECT --local-hostname='mylocalname' -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo " - Killing server" +diff --git a/tests/test-replay b/tests/test-replay +index b8aa848..0533893 100755 +--- a/tests/test-replay ++++ b/tests/test-replay +@@ -60,7 +60,7 @@ launch_server -d 9999 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to obtain cookie... " +-eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` ++eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` + + if [ -z "$COOKIE" ];then + echo "Could not obtain cookie" +@@ -70,7 +70,7 @@ fi + #echo "Cookie: $COOKIE" + + echo "Connecting with cookie... " +-echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --verbose --pid-file "${PIDFILE1}" --background ++echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --verbose --pid-file "${PIDFILE1}" --background + + sleep 4 + +diff --git a/tests/test-san-cert b/tests/test-san-cert +index a5040ae..a41c331 100755 +--- a/tests/test-san-cert ++++ b/tests/test-san-cert +@@ -49,25 +49,25 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (without certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected without certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with invalid certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected with invalid certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with certificate - no SAN)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Connected with invalid certificate!" + + echo "ok (failed as expected)" + + echo -n "Connecting to obtain cookie (with certificate - SAN)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-san-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-san-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Failed to connect with certificate!" + + echo ok +diff --git a/tests/test-script-multi-user b/tests/test-script-multi-user +index 6327a26..c0bfa3d 100755 +--- a/tests/test-script-multi-user ++++ b/tests/test-script-multi-user +@@ -47,16 +47,16 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! + wait_server $PID + + echo "Connecting to force script block... " +-echo "!@#$%^&*()<>" | timeout 60 $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true & ++echo "!@#$%^&*()<>" | timeout 60 $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true & + + sleep 3 + + echo "Connecting to obtain cookie... " +-( echo "${USERNAME}" | $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || ++( echo "${USERNAME}" | $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || + fail $PID "Could not receive cookie from server" + + echo "Connecting in background... " +-( echo "${USERNAME}" | timeout 15 $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --background >/dev/null 2>&1 ) || ++( echo "${USERNAME}" | timeout 15 $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --background >/dev/null 2>&1 ) || + fail $PID "Could not connect to server; probably blocked" + + sleep 3 +diff --git a/tests/test-sighup b/tests/test-sighup +index add538f..dd424e5 100755 +--- a/tests/test-sighup ++++ b/tests/test-sighup +@@ -34,7 +34,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -44,7 +44,7 @@ kill -HUP $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || + fail $PID "Could not connect with certificate!" + + echo ok +@@ -57,7 +57,7 @@ kill -HUP $PID + sleep 5 + + echo -n "Connecting to obtain cookie (with certificate)... " +-( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && ++( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && + fail $PID "Could not connect with certificate!" + + echo ok +diff --git a/tests/test-stress b/tests/test-stress +index 3816604..a2db96e 100755 +--- a/tests/test-stress ++++ b/tests/test-stress +@@ -33,7 +33,7 @@ run_client() { + PASS=$1; + shift; + +- ( echo $PASS | $OPENCONNECT -q $HOST -u $USER --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >/dev/null 2>&1 ) || ++ ( echo $PASS | $OPENCONNECT -q $HOST -u $USER --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >/dev/null 2>&1 ) || + echo "$USER: Could not connect to server" + } + +diff --git a/tests/test-udp-listen-host b/tests/test-udp-listen-host +index f3e6623..956938b 100755 +--- a/tests/test-udp-listen-host ++++ b/tests/test-udp-listen-host +@@ -111,7 +111,7 @@ ${CMDNS2} ${HAPROXY} -f ${HACONFIG} -d & HAPID=$! + sleep 3 + + echo " * Connecting to haproxy and using dtls ... " +-echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${CLIPID}" --background ++echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${CLIPID}" --background + + wait_file "${CLIPID}" 11 + +@@ -134,7 +134,7 @@ echo "restart ocsev with udp-listen-host set to 127.0.0.1" + ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG_UDP_LISTEN_LOCAL} ${DEBUG} & PID=$! + + echo " * Connecting to haproxy and using dtls again ... " +-echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${CLIPID2}" --background ++echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${CLIPID2}" --background + + wait_file "${CLIPID2}" 11 + +diff --git a/tests/test-user-config b/tests/test-user-config +index 1c7f518..f8573ce 100755 +--- a/tests/test-user-config ++++ b/tests/test-user-config +@@ -42,20 +42,20 @@ PID=$! + wait_server $PID + + echo -n "Connecting to obtain cookie (with certificate)... " +-( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null ) || ++( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null ) || + fail $PID "Could not connect with certificate!" + + echo ok + + echo -n "Re-connecting to force script run... " +-$OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true /dev/null & ++$OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true /dev/null & + kpid1=$! + echo ok + + sleep 2 + + echo -n "Re-connecting to check the iroutes... " +-$OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 & ++$OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 & + kpid2=$! + + echo ok +@@ -63,7 +63,7 @@ sleep 3 + + echo -n "Checking if max-same-clients is considered... " + +-timeout 15s $OPENCONNECT localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE2} 2>&1 ++timeout 15s $OPENCONNECT localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE2} 2>&1 + if test $? = 124;then + fail $PID "Max-same-clients directive was ignored" + fi +@@ -155,7 +155,7 @@ rm -f ${TMPFILE1} + rm -f ${TMPFILE2} + + echo -n "Re-connecting to check the ipv4-network... " +-$OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 & kpid3=$! ++$OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 & kpid3=$! + + echo ok + sleep 3 +diff --git a/tests/test-vhost b/tests/test-vhost +index 902f011..1a57e60 100755 +--- a/tests/test-vhost ++++ b/tests/test-vhost +@@ -62,7 +62,7 @@ PID=$! + wait_server $PID + + echo -n "Connecting to default host to obtain cookie (user without certificate)... " +-connect "default.example.com" "-u test" "test" "d66b507ae074d03b02eafca40d35f87dd81049d3" ++connect "default.example.com" "-u test" "test" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" + if test $? != 0;then + fail $PID "Failed to connect with user without certificate!" + fi +@@ -111,7 +111,7 @@ fi + echo ok + + echo -n "Connecting to default host to obtain cookie (with certificate)... " +-connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "d66b507ae074d03b02eafca40d35f87dd81049d3" ++connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" + if test $? = 0;then + fail $PID "Connected to wrong host with certificate!" + fi +@@ -136,7 +136,7 @@ kill -HUP $PID + sleep 5 + + echo -n "Sanity check to default host..." +-connect "default.example.com" "-u test" "test" "d66b507ae074d03b02eafca40d35f87dd81049d3" ++connect "default.example.com" "-u test" "test" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" + if test $? != 0;then + fail $PID "Failed to connect with user without certificate!" + fi +diff --git a/tests/traffic b/tests/traffic +index 3ea962f..1f0fcaf 100755 +--- a/tests/traffic ++++ b/tests/traffic +@@ -79,14 +79,14 @@ sleep 4 + + # Run clients + echo " * Getting cookie from ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) + if test $? != 0;then + echo "Could not get cookie from server" + exit 1 + fi + + echo " * Connecting to ${ADDRESS}:${PORT}..." +-( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) ++( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) + if test $? != 0;then + echo "Could not connect to server" + exit 1 diff --git a/ocserv.spec b/ocserv.spec index adc065b..bb9f61b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.7 -Release: 1%{?dist} +Release: 2%{?dist} %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -38,6 +38,8 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init +# When removed remove the autoreconf step +Patch0: expired-certs.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -139,6 +141,8 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %endif %autosetup -p1 +# temporarily needed to apply patches +autoreconf -fvi rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) @@ -272,6 +276,9 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog +* Thu Jun 22 2023 Nikos Mavrogiannopoulos - 1.1.7-2 +- Backported fixes for expired certificates + * Sun May 07 2023 Nikos Mavrogiannopoulos - 1.1.7-1 - Updated to 1.1.7 From 4dfb15142e87e295b5ef7e5a8ecffae29f5537e3 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 11 Jul 2023 17:12:11 +0200 Subject: [PATCH 48/75] use %autorelease and %autochangelog --- ocserv.spec | 361 +--------------------------------------------------- 1 file changed, 2 insertions(+), 359 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index bb9f61b..8f2b22b 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,5 +1,5 @@ Version: 1.1.7 -Release: 2%{?dist} +Release: %autorelease %global _hardened_build 1 %if 0%{?fedora} || 0%{?rhel} >= 7 @@ -276,361 +276,4 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %endif %changelog -* Thu Jun 22 2023 Nikos Mavrogiannopoulos - 1.1.7-2 -- Backported fixes for expired certificates - -* Sun May 07 2023 Nikos Mavrogiannopoulos - 1.1.7-1 -- Updated to 1.1.7 - -* Thu Jan 19 2023 Fedora Release Engineering - 1.1.6-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Fri Jul 22 2022 Fedora Release Engineering - 1.1.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Feb 17 2022 Nikos Mavrogiannopoulos - 1.1.6-1 -- Updated to 1.1.6 - -* Thu Feb 10 2022 Nikos Mavrogiannopoulos - 1.1.4-3 -- Update seccomp rules to allow the futex syscall -- Workaround incompatible API change in GnuTLS 3.7.3. - -* Thu Jan 20 2022 Fedora Release Engineering - 1.1.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Sat Nov 13 2021 Nikos Mavrogiannopoulos - 1.1.4-1 -- Update to upstream 1.1.4 release - -* Sat Nov 06 2021 Adrian Reber - 1.1.3-4 -- Rebuilt for protobuf 3.19.0 - -* Tue Oct 26 2021 Adrian Reber - 1.1.3-3 -- Rebuilt for protobuf 3.18.1 - -* Thu Jul 22 2021 Fedora Release Engineering - 1.1.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Jun 2 2021 Nikos Mavrogiannopoulos - 1.1.3-1 -- Updated to latest release - -* Tue Jan 26 2021 Fedora Release Engineering - 1.1.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Thu Jan 14 08:31:24 CET 2021 Adrian Reber - 1.1.2-2 -- Rebuilt for protobuf 3.14 - -* Sun Dec 6 2020 Nikos Mavrogiannopoulos - 1.1.2-1 -- Update to upstream 1.1.2 release - -* Mon Nov 23 2020 Nikos Mavrogiannopoulos - 1.1.1-5 -- Rebuilt for ronn successor - -* Wed Nov 11 2020 Nikos Mavrogiannopoulos - 1.1.1-4 -- Rebuilt for radcli 1.3.0 - -* Thu Oct 29 2020 Nikos Mavrogiannopoulos - 1.1.1-3 -- Rebuild without pcllib dependency -- Enhanced seccomp filters for tests to run in all architectures - -* Thu Sep 24 2020 Adrian Reber - 1.1.1-2 -- Rebuilt for protobuf 3.13 - -* Mon Sep 21 2020 Nikos Mavrogiannopoulos - 1.1.1-1 -- Update to upstream 1.1.1 release -- Set default priorities to NORMAL as using @SYSTEM is no longer necessary - to follow crypto policies. - -* Tue Jul 28 2020 Fedora Release Engineering - 1.1.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Sun Jun 21 2020 Adrian Reber - 1.1.0-2 -- Rebuilt for protobuf 3.12 - -* Tue Jun 16 2020 Nikos Mavrogiannopoulos - 1.1.0-1 -- Update to upstream 1.1.0 release (introduces ocserv-worker) - -* Wed Apr 15 2020 Igor Raits - 1.0.1-2 -- Rebuild for http-parser 2.9.4 - -* Thu Apr 09 2020 Nikos Mavrogiannopoulos - 1.0.1-1 -- Update to upstream 1.0.1 release - -* Fri Mar 20 2020 Nikos Mavrogiannopoulos - 1.0.0-1 -- Update to upstream 1.0.0 release - -* Wed Jan 29 2020 Fedora Release Engineering - 0.12.6-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Sat Dec 28 2019 Nikos Mavrogiannopoulos - 0.12.6-1 -- Update to upstream 0.12.6 release - -* Wed Oct 16 2019 Nikos Mavrogiannopoulos - 0.12.5-1 -- Update to upstream 0.12.5 release - -* Thu Jul 25 2019 Fedora Release Engineering - 0.12.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Wed Jul 03 2019 Nikos Mavrogiannopoulos - 0.12.4-1 -- Update to upstream 0.12.4 release - -* Tue Mar 12 2019 Nikos Mavrogiannopoulos - 0.12.3-1 -- Update to upstream 0.12.3 release - -* Sun Feb 17 2019 Igor Gnatenko - 0.12.2-4 -- Rebuild for readline 8.0 - -* Fri Feb 01 2019 Fedora Release Engineering - 0.12.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Mon Jan 14 2019 Björn Esser - 0.12.2-2 -- Rebuilt for libcrypt.so.2 (#1666033) - -* Thu Jan 10 2019 Nikos Mavrogiannopoulos - 0.12.2-1 -- Update to upstream 0.12.2 release - -* Tue Jul 24 2018 Nikos Mavrogiannopoulos - 0.12.1-3 -- Added gcc as build-dependency - -* Fri Jul 13 2018 Fedora Release Engineering - 0.12.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Sat May 12 2018 Nikos Mavrogiannopoulos - 0.12.1-1 -- Update to upstream 0.12.1 release - -* Mon Apr 23 2018 Nikos Mavrogiannopoulos - 0.12.0-1 -- Update to upstream 0.12.0 release - -* Thu Apr 12 2018 Nikos Mavrogiannopoulos - 0.11.11-2 -- Update to upstream 0.11.11 release -- include crypt.h to use crypt() - -* Mon Mar 05 2018 Nikos Mavrogiannopoulos - 0.11.11-1 -- Update to upstream 0.11.11 release - -* Thu Feb 08 2018 Fedora Release Engineering - 0.11.10-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Sat Jan 20 2018 Björn Esser - 0.11.10-2 -- Rebuilt for switch to libxcrypt - -* Mon Jan 08 2018 Nikos Mavrogiannopoulos - 0.11.10-1 -- Update to upstream 0.11.10 release - -* Tue Nov 21 2017 Nikos Mavrogiannopoulos - 0.11.9-3 -- Update to upstream 0.11.9 release - -* Thu Nov 16 2017 Nikos Mavrogiannopoulos - 0.11.9-2 -- Do not enable libwrap - -* Tue Oct 10 2017 Nikos Mavrogiannopoulos - 0.11.9-1 -- Update to upstream 0.11.9 release - -* Thu Aug 03 2017 Fedora Release Engineering - 0.11.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 0.11.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Wed May 03 2017 Nikos Mavrogiannopoulos - 0.11.8-1 -- Update to upstream 0.11.8 release - -* Mon Feb 13 2017 Nikos Mavrogiannopoulos - 0.11.7-1 -- Update to upstream 0.11.7 release - -* Sat Feb 11 2017 Fedora Release Engineering - 0.11.6-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Thu Jan 12 2017 Igor Gnatenko - 0.11.6-3 -- Rebuild for readline 7.x - -* Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-2 -- Removed gpgkeys from sources - -* Tue Nov 15 2016 Nikos Mavrogiannopoulos - 0.11.6-1 -- New upstream release - -* Wed Sep 14 2016 Nikos Mavrogiannopoulos - 0.11.4-3 -- Added getrandom to the list of allowed syscalls (#1375851) - -* Thu Sep 8 2016 Nikos Mavrogiannopoulos - 0.11.4-2 -- Rebuild to address http-parser breakage (#1374081) - -* Fri Aug 5 2016 Nikos Mavrogiannopoulos - 0.11.4-1 -- New upstream release - -* Thu Jun 16 2016 Nikos Mavrogiannopoulos - 0.11.3-1 -- New upstream release - -* Tue Apr 26 2016 Nikos Mavrogiannopoulos - 0.11.2-1 -- New upstream release -- Added automatic verification of signature during build - -* Mon Mar 21 2016 Nikos Mavrogiannopoulos - 0.11.1-1 -- new upstream release - -* Fri Feb 19 2016 Nikos Mavrogiannopoulos - 0.11.0-1 -- new upstream release - -* Thu Feb 04 2016 Fedora Release Engineering - 0.10.11-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Mon Jan 11 2016 Nikos Mavrogiannopoulos - 0.10.11-1 -- new upstream release - -* Mon Nov 30 2015 Nikos Mavrogiannopoulos - 0.10.10-1 -- new upstream release - -* Thu Oct 8 2015 Nikos Mavrogiannopoulos - 0.10.9-1 -- new upstream release (#1269479) - -* Thu Sep 17 2015 Nikos Mavrogiannopoulos - 0.10.8-2 -- compile ocserv using radcli - -* Mon Sep 7 2015 Nikos Mavrogiannopoulos - 0.10.8-1 -- new upstream release (#1260327) - -* Fri Aug 7 2015 Nikos Mavrogiannopoulos - 0.10.7-1 -- new upstream release (#1251305) - -* Thu Jul 9 2015 Nikos Mavrogiannopoulos - 0.10.6-2 -- corrected JSON output - -* Thu Jul 2 2015 Nikos Mavrogiannopoulos - 0.10.6-1 -- new upstream release (#1238499) - -* Wed Jun 17 2015 Fedora Release Engineering - 0.10.5-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Mon May 25 2015 Nikos Mavrogiannopoulos - 0.10.5-1 -- new upstream release (#1215326) - -* Mon Apr 27 2015 Nikos Mavrogiannopoulos - 0.10.4-1 -- new upstream release - -* Mon Mar 30 2015 Nikos Mavrogiannopoulos - 0.10.2-1 -- new upstream release - -* Mon Mar 16 2015 Nikos Mavrogiannopoulos - 0.10.1-1 -- new upstream release - -* Wed Mar 11 2015 Nikos Mavrogiannopoulos - 0.10.0-1 -- new upstream release - -* Wed Feb 18 2015 Nikos Mavrogiannopoulos - 0.9.2-1 -- new upstream release -- enabled lz4 compression - -* Mon Feb 16 2015 Peter Robinson 0.9.1-2 -- aarch64 (and ARMv7) now has seccomp support - -* Mon Feb 16 2015 Nikos Mavrogiannopoulos - 0.9.1-1 -- new upstream release - -* Thu Jan 29 2015 Nikos Mavrogiannopoulos - 0.9.0-2 -- only enable seccomp in x86-64. It seems to be broken in x86: - http://sourceforge.net/p/libseccomp/mailman/message/33275762/ - -* Thu Jan 22 2015 Nikos Mavrogiannopoulos - 0.9.0-1 -- new upstream release - -* Fri Jan 9 2015 Nikos Mavrogiannopoulos - 0.8.9-4 -- enable PIE - -* Tue Jan 6 2015 Nikos Mavrogiannopoulos - 0.8.9-3 -- Comply with system-wide crypto policies (#1179332) - -* Mon Jan 5 2015 Nikos Mavrogiannopoulos - 0.8.9-2 -- ocserv.service: depend on network-online.target (#1178760) -- enable seccomp (on platforms it is available) - -* Thu Dec 11 2014 Nikos Mavrogiannopoulos - 0.8.9-1 -- New upstream release - -* Wed Nov 26 2014 Nikos Mavrogiannopoulos - 0.8.8-1 -- New upstream release - -* Mon Oct 27 2014 Nikos Mavrogiannopoulos - 0.8.7-1 -- New upstream release - -* Tue Sep 09 2014 Nikos Mavrogiannopoulos - 0.8.4-2 -- Ship a default ocserv-script, which will put connecting clients - into the internal firewall zone. - -* Thu Aug 28 2014 Nikos Mavrogiannopoulos - 0.8.4-1 -- New upstream release - -* Sun Aug 17 2014 Fedora Release Engineering - 0.8.2-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Fri Aug 08 2014 Nikos Mavrogiannopoulos - 0.8.2-3 -- Rebuilt - -* Tue Aug 05 2014 Nikos Mavrogiannopoulos - 0.8.2-2 -- Rebuilt for new protobuf-c - -* Mon Jul 28 2014 Nikos Mavrogiannopoulos - 0.8.2-1 -- New upstream release - -* Mon Jun 30 2014 Nikos Mavrogiannopoulos - 0.8.1-1 -- New upstream release - -* Fri Jun 06 2014 Nikos Mavrogiannopoulos - 0.8.0-2 -- Generate certificates and private keys before the first run -- Corrected chroot path - -* Mon Jun 02 2014 Nikos Mavrogiannopoulos - 0.8.0-1 -- New upstream release - -* Mon May 26 2014 Nikos Mavrogiannopoulos - 0.8.0pre0-1 -- New upstream release - -* Fri May 09 2014 Nikos Mavrogiannopoulos - 0.3.5-1 -- New upstream release - -* Fri May 02 2014 Nikos Mavrogiannopoulos - 0.3.4-1 -- New upstream release - -* Thu Apr 10 2014 Nikos Mavrogiannopoulos - 0.3.3-1 -- New upstream release - -* Fri Mar 14 2014 Nikos Mavrogiannopoulos - 0.3.2-1 -- New upstream release - -* Mon Feb 17 2014 Nikos Mavrogiannopoulos - 0.3.1-2 -- new upstream release - -* Wed Jan 29 2014 Nikos Mavrogiannopoulos - 0.3.0-2 -- Generated certificates no longer carry an expiration date. - -* Mon Jan 27 2014 Nikos Mavrogiannopoulos - 0.3.0-1 -- Updated to latest upstream version (0.3.0). -- Certificates and private keys are auto-generated. - -* Mon Dec 16 2013 Nikos Mavrogiannopoulos - 0.2.3-1 -- Updated to latest upstream version (0.2.3). -- Corrected the chroot directory in config file. - -* Fri Dec 6 2013 Nikos Mavrogiannopoulos - 0.2.1-6 -- Added exception for the bundling of CCAN components. - -* Wed Nov 13 2013 Nikos Mavrogiannopoulos - 0.2.1-5 -- Updated the way PACKAGE-LICENSING is handled. - -* Tue Nov 12 2013 Nikos Mavrogiannopoulos - 0.2.1-4 -- Replaced gnulib's GPLv3+ license with GPLv2+. According to - http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html - it was a gnulib bug. -- Reduced the number of applicable licenses by upgrading LGPLv2+ - components to GPLv2+. -- Added PACKAGE-LICENSING. - -* Mon Nov 11 2013 Nikos Mavrogiannopoulos - 0.2.1-3 -- Updated spec to add http-parser and pcllib as dependencies. -- Bundled library files are removed. -- Updated license information. - -* Fri Nov 8 2013 Nikos Mavrogiannopoulos - 0.2.1-2 -- Updated spec to account improvements suggested by Alec Leamas. - -* Thu Nov 7 2013 Nikos Mavrogiannopoulos - 0.2.1-1 -- Initial version of the package +%autochangelog From a9ef7caf17d80eee2b090c456a32080925c1d54f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 11 Jul 2023 17:31:45 +0200 Subject: [PATCH 49/75] Updated to 1.2.0 --- .gitignore | 2 + expired-certs.patch | 2308 ------------------------------------------- ocserv.conf | 138 ++- ocserv.spec | 14 +- sources | 4 +- 5 files changed, 115 insertions(+), 2351 deletions(-) delete mode 100644 expired-certs.patch diff --git a/.gitignore b/.gitignore index 1435b3a..2113177 100644 --- a/.gitignore +++ b/.gitignore @@ -239,3 +239,5 @@ /ocserv-1.1.6.tar.xz /ocserv-1.1.7.tar.xz /ocserv-1.1.7.tar.xz.sig +/ocserv-1.2.0.tar.xz +/ocserv-1.2.0.tar.xz.sig diff --git a/expired-certs.patch b/expired-certs.patch deleted file mode 100644 index 443bd7b..0000000 --- a/expired-certs.patch +++ /dev/null @@ -1,2308 +0,0 @@ -diff --git a/tests/Makefile.am b/tests/Makefile.am -index d965eae..ecc417c 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -44,7 +44,8 @@ EXTRA_DIST = certs/ca-key.pem certs/ca.pem ns.sh common.sh certs/server-cert.pem - data/disconnect-user2.config data/ping-leases.config data/haproxy-proxyproto.config \ - data/haproxy-proxyproto.cfg scripts/proxy-connectscript data/haproxy-proxyproto-v1.config \ - data/haproxy-proxyproto-v1.cfg scripts/proxy-connectscript-v1 data/test-multiple-client-ip.config \ -- data/test-client-bypass-protocol.config asan.supp -+ data/test-client-bypass-protocol.config asan.supp certs/ca.tmpl certs/server-cert.tmpl \ -+ certs/user-cert.tmpl - - xfail_scripts = - dist_check_SCRIPTS = ocpasswd-test -@@ -176,6 +177,25 @@ gen_oidc_test_data_CPPFLAGS = $(AM_CPPFLAGS) - gen_oidc_test_data_SOURCES = generate_oidc_test_data.c - gen_oidc_test_data_LDADD = $(LDADD) $(CJOSE_LIBS) $(JANSSON_LIBS) - -+certs/ca.pem: certs/ca-key.pem certs/ca.tmpl -+ certtool --generate-self-signed --template certs/ca.tmpl --load-privkey certs/ca-key.pem --outfile certs/ca.pem -+ -+certs/server-cert-ca.pem: certs/ca.pem certs/server-cert.pem -+ cat certs/server-cert.pem certs/ca.pem > certs/server-cert-ca.pem -+ -+certs/server-cert.pem: certs/server-cert.tmpl certs/ca.pem certs/server-key.pem certs/ca-key.pem -+ certtool --generate-certificate --template certs/server-cert.tmpl --load-privkey certs/server-key.pem --load-ca-certificate certs/ca.pem --load-ca-privkey certs/ca-key.pem --outfile certs/server-cert.pem -+ -+certs/user-cert.pem: certs/user-cert.tmpl certs/ca.pem certs/user-key.pem certs/ca-key.pem -+ certtool --generate-certificate --template certs/user-cert.tmpl --load-privkey certs/user-key.pem --load-ca-certificate certs/ca.pem --load-ca-privkey certs/ca-key.pem --outfile certs/user-cert.pem -+ -+# make the user certificate invalid by signing it with another CA -+certs/user-cert-invalid.pem: certs/user-cert.tmpl -+ certtool --generate-privkey --outfile ca-key.tmp -+ certtool --generate-self-signed --template certs/ca.tmpl --load-privkey ca-key.tmp --outfile ca.tmp -+ certtool --generate-certificate --template certs/user-cert.tmpl --load-privkey certs/user-key.pem --load-ca-certificate ca.tmp --load-ca-privkey ca-key.tmp --outfile certs/user-cert-invalid.pem -+ rm -f ca-key.tmp ca.tmp -+ - if ENABLE_OIDC_AUTH_TESTS - check_PROGRAMS += gen_oidc_test_data - dist_check_SCRIPTS += test-oidc -diff --git a/tests/apple-ios b/tests/apple-ios -index 897d823..45b0cd3 100755 ---- a/tests/apple-ios -+++ b/tests/apple-ios -@@ -54,11 +54,11 @@ wait_server $PID - sleep 2 - - echo " * Connecting to obtain cookie... " --( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null ) || -+( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null ) || - fail $PID "Could not receive cookie from server" - - echo " * Re-connect to force script run with platform... " --echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 -+echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 - - sleep 5 - -@@ -87,7 +87,7 @@ fi - rm -f ${TMPFILE} - - echo " * Re-connecting to force script run with user agent... " --echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose --useragent="Cisco AnyConnect VPN Agent for Apple" localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 -+echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT --verbose --useragent="Cisco AnyConnect VPN Agent for Apple" localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 - - sleep 5 - -@@ -114,7 +114,7 @@ fi - sleep 5 - echo " - Check server status" - --( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | $OPENCONNECT localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo " - Killing server" -diff --git a/tests/banner b/tests/banner -index 44954e2..08f8f19 100755 ---- a/tests/banner -+++ b/tests/banner -@@ -50,7 +50,7 @@ wait_server $PID - sleep 3 - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >${TMPFILE} 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >${TMPFILE} 2>&1 ) || - fail $PID "Could not receive cookie from server" - - grep "${BANNER}" ${TMPFILE} >/dev/null -@@ -61,7 +61,7 @@ if test $? != 0;then - fi - - echo "Connecting to obtain cookie with wrong password... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >${TMPFILE} 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >${TMPFILE} 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - grep "${BANNER}" ${TMPFILE} >/dev/null -diff --git a/tests/certs/ca-key.pem b/tests/certs/ca-key.pem -index 9bd0754..ee5599c 100644 ---- a/tests/certs/ca-key.pem -+++ b/tests/certs/ca-key.pem -@@ -31,25 +31,3 @@ y1hvTfWRAoGZALNT3AbF9EDnJmZlS30MWtBggw83UhszC8XN2tY30AsvsDOS6a0F - UVhyNvBTKo6lPqXqUsVxp16TKeeQKF+DuYuuNZN3pXXsHTiHkRMDCRVEqz7UnZEc - /Bq/Kh2aOkelkX2S27QzTZGL - -----END RSA PRIVATE KEY----- -------BEGIN CERTIFICATE----- --MIIDtDCCAmygAwIBAgIETeC0yjANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDEw5H --bnVUTFMgVGVzdCBDQTAeFw0xMTA1MjgwODM5MzlaFw0zODEwMTIwODM5NDBaMC8x --LTArBgNVBAMTJEdudVRMUyBUZXN0IFNlcnZlciAoUlNBIGNlcnRpZmljYXRlKTCC --AVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/HsqwfvTYvO1D --hmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJl1U1F/Oh --ckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq --58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mB --VAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03 --U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b7eujbZ3L --xTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUC --AwEAAaOBjTCBijAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAT --BgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBR2 --B1hM6rUp9S2ABoyDSoINCeyT3jAfBgNVHSMEGDAWgBRNVrdqAFjxZ5L0pnVVG45T --AQPvzzANBgkqhkiG9w0BAQsFAAOCATEAdNWmTsh5uIfngyhOWwm7pK2+vgUMY8nH --gMoMFHt0yuxuImcUMXu3LRS1dZSoCJACBpTFGi/Dg2U0qvOHQcEmc3OwNqHB90R3 --LG5jUSCtq/bYW7h/6Gd9KeWCgZczaHbQ9IPTjLH1dLswVPt+fXKB6Eh0ggSrGATE --/wRZT/XgDCW8t4C+2+TmJ8ZEzvU87KAPQ9rUBS1+p3EUAR/FfMApApsEig1IZ+ZD --5joaGBW7zh1H0B9mEKidRvD7yuRJyzAcvD25nT15NLW0QR3dEeXosLc720xxJl1h --h8NJ7YOvn323mOjR9er4i4D6iJlXmJ8tvN9vakCankWvBzb7plFn2sfMQqICFpRc --w075D8hdQxfpGffL2tEeKSgjyNHXS7x3dFhUpN3IQjUi2x4f2e/ZXg== -------END CERTIFICATE----- -diff --git a/tests/certs/ca.pem b/tests/certs/ca.pem -index c4058ee..02f0b76 100644 ---- a/tests/certs/ca.pem -+++ b/tests/certs/ca.pem -@@ -1,20 +1,20 @@ - -----BEGIN CERTIFICATE----- --MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD --EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw --fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ --l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW --DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh --zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt --c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b --7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep --n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA --MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC --ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT --z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP --g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX --ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk --x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH --yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg --fJbi9Ui2FmXEeKkX34f1ONNj9Q== -+MIIDPDCCAfSgAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzAyMTMxNTMyMTJaGA85OTk5MTIzMTIzNTk1OVowDTELMAkGA1UEAxMC -+Q0EwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQC0ayeYJa/B/x7KsH70 -+2LztQ4ZnVF3atB7CkF+DPAIR/BNyhbKIpGVBC3ZfI76Kn/55S3M7LsdLPL8WyZdV -+NRfzoXJLMMLgJ5QS81YA5s6CSxFdpB6b+vq5GypNGLW6peYMx6iooW2qiITclg6y -+bBw1qufHlD351cfCog1Ls2569whfxQnNFZMa95jfKkxmiSTtH9AWY4FlpVg7oc0l -+YpuZgVQIFxjsfC8IojsoVzKdF0cKhvtisUGZ5vveqOogfvMb7rrqmiFkKZLyrXPl -+GQWdN1PiEZ8YXyK64osNAIyeL6eHPUC+SqKlkggMLmHAWHyameHWrIM5Jc8+G+3r -+o22dy8U43sHHbps0FL4wPoKQHrlKmnbk7zMMRqIxcvbDYQv4qmeJ9KXldjehKZ+A -+eap1AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMB0G -+A1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOCATEA -+foqPGdiyJYHih4J5YHwFPQxmkOzPHSa13K/q8sDvobE+HFTzrlTbAFC8bS38Bv2f -+9ZrPME4JvnsGdRGYwxS3LUmNdHHWR8LkvGXBE3u/TZsJfPtOR8JwdulQXpRw7hhL -+ew/mR5IEHZrUZgnnI4dg1kJhE1JPTvmtgqcE1CsikVQ14NvG/ehJbJyPgKTq/Zxm -+Ru4B5N+Jef/LaOqZvK4xK8x2ZaZ/L/ANou+7EY4DoWAkOEEoCU8DQHLAFgf6B7La -+oemLQGNHcBpba81jlS5EXXGJccOvfbw0MJTP3ZvyVIlEYu/X4roC7EJP/UkCZUJG -+f79Nc28q2/2D8tuFOqG7UbP7r2cWSa8OO3cI/V1W1k3iWZ63WltqDwFC0c8iqYFL -+9xKfQ96Q7wrYOCjmuaCLbw== - -----END CERTIFICATE----- -diff --git a/tests/certs/ca.tmpl b/tests/certs/ca.tmpl -new file mode 100644 -index 0000000..da5cc3f ---- /dev/null -+++ b/tests/certs/ca.tmpl -@@ -0,0 +1,6 @@ -+cn = CA -+ca -+cert_signing_key -+expiration_days = -1 -+activation_date = "2013-02-13 16:32:12" -+serial = 0x51d82ecc -diff --git a/tests/certs/server-cert-ca.pem b/tests/certs/server-cert-ca.pem -index 818101a..8ffaad3 100644 ---- a/tests/certs/server-cert-ca.pem -+++ b/tests/certs/server-cert-ca.pem -@@ -1,42 +1,42 @@ - -----BEGIN CERTIFICATE----- --MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD --Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs --PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 --u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd --YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ --IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 --KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 --7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU --yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL --gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg --ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 --UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s --9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 --GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C --zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ --eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF --FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j --LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM --zzJKdNg= -+MIIDjjCCAkagAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJ -+bG9jYWxob3N0MIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEApzor7D8U -+sCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leAWOGW/O7QvQQVfl9/pTP4/LuR -+7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6zJlm4RYJFZTeX06qGNJZ3WCc -+dl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kapfe2AGUV3DKEF1Y20Zs1S2SFb -+pkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ROhb62gHMvniNIF0xpO+fSjT -+2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjpV3Ymf8ox4OfkSkOXbd3ZOe5Q -+CFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0uxLQdDQiDO4b4ct9kKyeWVMjZ -+3E0n+qjFaHnYHQIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ -+bG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIFoDAd -+BgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0UwqJ -+MThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAGQoUMiZVg6+Ibj8kyfq -+l/vfu4QxlUlqAbm/b9PVdOLrhz+T986HMFhL0b2HUGg5Mb0NZcgHjH4VLkei4AIb -+g/1nGdJ2I6EcLiQOvO4h2F3CoU6HkEGVEUXFaBd19tSDm7aM+2h7oPb3Vs3YT9QE -+x7ejmVeA+Qr9+H9xHyModpA1PkKRW31TOYtjUXHdHObT1uar++C1JLHn49ooKDZM -+5p9a4ExQVYd6WMRXKC83py1V4Ne5kBxC/l+3QkVZnMwByChySP7SEMa9yGv4KFM9 -+FT7XvxQsrkqPi5bCllUyGDrVeyTpyPDrb4BKgAu/Cy4tyDxLzBTZ5TXDH7E1IBps -+g1k5llFIyGdO5vQrX8vF61tqK5DBhgVvwu0k/m2lP9esLfaF7I5oGAbUKGhRr8mE -+xs8= - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- --MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD --EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw --fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ --l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW --DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh --zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt --c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b --7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep --n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA --MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC --ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT --z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP --g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX --ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk --x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH --yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg --fJbi9Ui2FmXEeKkX34f1ONNj9Q== -+MIIDPDCCAfSgAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzAyMTMxNTMyMTJaGA85OTk5MTIzMTIzNTk1OVowDTELMAkGA1UEAxMC -+Q0EwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQC0ayeYJa/B/x7KsH70 -+2LztQ4ZnVF3atB7CkF+DPAIR/BNyhbKIpGVBC3ZfI76Kn/55S3M7LsdLPL8WyZdV -+NRfzoXJLMMLgJ5QS81YA5s6CSxFdpB6b+vq5GypNGLW6peYMx6iooW2qiITclg6y -+bBw1qufHlD351cfCog1Ls2569whfxQnNFZMa95jfKkxmiSTtH9AWY4FlpVg7oc0l -+YpuZgVQIFxjsfC8IojsoVzKdF0cKhvtisUGZ5vveqOogfvMb7rrqmiFkKZLyrXPl -+GQWdN1PiEZ8YXyK64osNAIyeL6eHPUC+SqKlkggMLmHAWHyameHWrIM5Jc8+G+3r -+o22dy8U43sHHbps0FL4wPoKQHrlKmnbk7zMMRqIxcvbDYQv4qmeJ9KXldjehKZ+A -+eap1AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMB0G -+A1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOCATEA -+foqPGdiyJYHih4J5YHwFPQxmkOzPHSa13K/q8sDvobE+HFTzrlTbAFC8bS38Bv2f -+9ZrPME4JvnsGdRGYwxS3LUmNdHHWR8LkvGXBE3u/TZsJfPtOR8JwdulQXpRw7hhL -+ew/mR5IEHZrUZgnnI4dg1kJhE1JPTvmtgqcE1CsikVQ14NvG/ehJbJyPgKTq/Zxm -+Ru4B5N+Jef/LaOqZvK4xK8x2ZaZ/L/ANou+7EY4DoWAkOEEoCU8DQHLAFgf6B7La -+oemLQGNHcBpba81jlS5EXXGJccOvfbw0MJTP3ZvyVIlEYu/X4roC7EJP/UkCZUJG -+f79Nc28q2/2D8tuFOqG7UbP7r2cWSa8OO3cI/V1W1k3iWZ63WltqDwFC0c8iqYFL -+9xKfQ96Q7wrYOCjmuaCLbw== - -----END CERTIFICATE----- -diff --git a/tests/certs/server-cert.pem b/tests/certs/server-cert.pem -index 4acde02..b304b47 100644 ---- a/tests/certs/server-cert.pem -+++ b/tests/certs/server-cert.pem -@@ -1,22 +1,22 @@ - -----BEGIN CERTIFICATE----- --MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD --Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs --PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8 --u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd --YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ --IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759 --KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5 --7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU --yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL --gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg --ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0 --UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s --9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9 --GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C --zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/ --eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF --FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j --LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM --zzJKdNg= -+MIIDjjCCAkagAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowFDESMBAGA1UEAxMJ -+bG9jYWxob3N0MIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEApzor7D8U -+sCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leAWOGW/O7QvQQVfl9/pTP4/LuR -+7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6zJlm4RYJFZTeX06qGNJZ3WCc -+dl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kapfe2AGUV3DKEF1Y20Zs1S2SFb -+pkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+ROhb62gHMvniNIF0xpO+fSjT -+2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjpV3Ymf8ox4OfkSkOXbd3ZOe5Q -+CFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0uxLQdDQiDO4b4ct9kKyeWVMjZ -+3E0n+qjFaHnYHQIDAQABo4GMMIGJMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJ -+bG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA4GA1UdDwEB/wQEAwIFoDAd -+BgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0UwqJ -+MThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAGQoUMiZVg6+Ibj8kyfq -+l/vfu4QxlUlqAbm/b9PVdOLrhz+T986HMFhL0b2HUGg5Mb0NZcgHjH4VLkei4AIb -+g/1nGdJ2I6EcLiQOvO4h2F3CoU6HkEGVEUXFaBd19tSDm7aM+2h7oPb3Vs3YT9QE -+x7ejmVeA+Qr9+H9xHyModpA1PkKRW31TOYtjUXHdHObT1uar++C1JLHn49ooKDZM -+5p9a4ExQVYd6WMRXKC83py1V4Ne5kBxC/l+3QkVZnMwByChySP7SEMa9yGv4KFM9 -+FT7XvxQsrkqPi5bCllUyGDrVeyTpyPDrb4BKgAu/Cy4tyDxLzBTZ5TXDH7E1IBps -+g1k5llFIyGdO5vQrX8vF61tqK5DBhgVvwu0k/m2lP9esLfaF7I5oGAbUKGhRr8mE -+xs8= - -----END CERTIFICATE----- -diff --git a/tests/certs/server-cert.tmpl b/tests/certs/server-cert.tmpl -new file mode 100644 -index 0000000..82e34ca ---- /dev/null -+++ b/tests/certs/server-cert.tmpl -@@ -0,0 +1,8 @@ -+cn = localhost -+dns_name = localhost -+tls_www_server -+signing_key -+encryption_key -+expiration_days = -1 -+activation_date = "2013-06-06 14:51:29" -+serial = 0x51d82ef0 -diff --git a/tests/certs/user-cert-invalid.pem b/tests/certs/user-cert-invalid.pem -index 0175bdf..4f5dd96 100644 ---- a/tests/certs/user-cert-invalid.pem -+++ b/tests/certs/user-cert-invalid.pem -@@ -1,107 +1,23 @@ --X.509 Certificate Information: -- Version: 3 -- Serial Number (hex): 51d82f14 -- Issuer: CN=CA -- Validity: -- Not Before: Sat Jul 06 14:52:05 UTC 2013 -- Not After: Mon May 15 14:52:05 UTC 2023 -- Subject: CN=A user,UID=test -- Subject Public Key Algorithm: RSA -- Algorithm Security Level: Medium (2432 bits) -- Modulus (bits 2432): -- 00:ab:54:98:fc:a9:c6:15:95:9d:a6:c1:94:84:94:91 -- 79:1e:78:db:2d:48:51:99:65:01:02:c0:40:52:49:5d -- eb:70:bc:26:ef:68:39:1e:04:91:e2:db:cb:6f:93:40 -- 45:1e:22:8e:71:5a:58:89:28:79:5e:1a:32:25:3e:8b -- 9d:3b:34:7f:19:f8:d0:2f:37:b7:62:32:b7:53:a5:43 -- 2c:c5:5d:ec:ac:f9:35:fa:14:2b:34:66:f1:d6:a7:a1 -- d0:83:9a:56:f4:19:83:bc:bf:11:74:30:2d:a8:28:5b -- a2:ab:7a:c6:cd:9c:5c:f8:51:e9:a9:0c:48:db:71:bb -- b1:34:77:f7:ee:de:5d:78:c0:48:0a:37:0d:65:1e:3b -- 2b:14:03:89:72:f2:52:ed:5f:00:c5:06:60:ea:80:20 -- d0:43:ec:66:bc:d2:26:db:f0:29:3e:6a:f9:62:20:be -- 58:26:44:ba:d7:8c:6f:76:a6:05:20:e4:98:b7:c4:72 -- 7a:5d:df:4f:0d:23:ec:2e:9c:71:ec:30:f9:14:5f:c8 -- 75:0b:ab:67:f6:7d:fb:4d:76:64:4a:a5:d5:fa:b4:08 -- 50:9d:13:c7:8f:c2:79:b0:b4:3e:2f:89:d3:33:27:4d -- 9f:8b:d3:60:24:07:ab:b2:72:3d:29:a5:c4:4a:ec:3c -- 04:d2:49:3e:26:1b:ec:7a:10:3d:ca:45:5a:80:8b:4d -- 2a:96:63:4f:2d:63:28:0f:3b:47:47:ca:7c:2c:15:41 -- 32:d5:e0:c9:be:a5:55:2c:b3:6b:46:2a:56:b1:1b:ed -- 29 -- Exponent (bits 24): -- 01:00:01 -- Extensions: -- Basic Constraints (critical): -- Certificate Authority (CA): FALSE -- Key Purpose (not critical): -- TLS WWW Client. -- Key Usage (critical): -- Digital signature. -- Key encipherment. -- Subject Key Identifier (not critical): -- 8b01094b3b91ece321b91dec8d6b4c5d9e40805e -- Authority Key Identifier (not critical): -- 482334530a8931384a5aeacab6d2a6dece1d2b18 -- Signature Algorithm: RSA-SHA256 -- Signature: -- 6b:bd:e2:90:d7:11:cf:6c:0d:e3:bd:f4:61:cd:57:83 -- 41:be:2a:92:46:dd:fa:44:6c:60:1c:ef:3e:1e:2f:e1 -- e2:5b:45:88:6a:1e:50:2d:8d:96:c4:c7:80:75:59:7b -- 54:6b:fb:86:b0:f1:6d:45:09:db:48:de:20:0a:87:60 -- 30:5e:35:f0:52:c4:55:44:c1:ff:e1:7c:3d:d6:6d:58 -- ca:1c:fd:bf:04:9a:9b:10:35:05:fc:d1:01:3c:af:bb -- 64:31:5e:59:8f:ef:6f:0d:35:e5:c0:07:77:0e:31:20 -- 8e:e3:2e:f1:a6:4d:f1:be:85:5b:df:04:48:9d:8c:c9 -- c9:c1:b8:e3:e2:d2:4b:55:83:e9:d8:7b:71:2f:8e:89 -- fc:4d:a7:f1:b0:bf:47:9b:97:c4:85:dd:c3:3d:38:15 -- 36:08:73:10:87:08:f6:e6:1c:4e:29:a8:a5:f5:24:b8 -- 0d:e9:d9:b8:19:27:1d:73:35:fe:7b:81:1f:4a:81:6a -- 93:cd:a2:71:d7:60:0e:08:ee:ea:c8:2b:44:1b:e4:45 -- 6c:fe:44:68:d6:86:ad:89:4f:7e:9f:f9:1a:2a:97:0f -- 6b:eb:5d:6e:38:b3:5b:13:b9:e3:4a:10:32:5b:dc:a9 -- b4:a1:4e:b3:f9:4f:91:de:bc:cc:36:91:44:ba:e0:34 -- 74:f7:68:b4:7b:0e:db:4e:ec:28:03:01:cf:0a:63:c4 -- 23:75:0b:4b:41:9d:e0:68:b3:cb:bf:b5:5c:3d:52:93 -- 20:ba:ea:b8:f0:8c:f7:a6:ec:cd:a3:aa:4f:2a:ff:20 --Other Information: -- SHA1 fingerprint: -- 5509a76b8738216938cdb3ec25048812737170de -- SHA256 fingerprint: -- c93e38ef35f1a9c485a27b161e708f2d45bf8768eb53a23fec841a8f35d6e478 -- Public Key ID: -- 8b01094b3b91ece321b91dec8d6b4c5d9e40805e -- Public key's random art: -- +--[ RSA 2432]----+ -- | o=o | -- |..oE.. | -- |.+=.o | -- |o.*.... | -- | * B +..S | -- |. * o oo . | -- | o . . . | -- | + | -- | . | -- +-----------------+ -- - -----BEGIN CERTIFICATE----- --MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD --EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF --AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw --vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF --Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0 --d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm --RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd --E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW --Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB --Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD --VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4 --SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveKQ1xHPbA3jvfRhzVeD --Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg --MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg --juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV --NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF --bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0 --dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g -+MIID2TCCAkGgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowJzEPMA0GA1UEAxMG -+QSB1c2VyMRQwEgYKCZImiZPyLGQBARMEdGVzdDCCAVIwDQYJKoZIhvcNAQEBBQAD -+ggE/ADCCAToCggExAKtUmPypxhWVnabBlISUkXkeeNstSFGZZQECwEBSSV3rcLwm -+72g5HgSR4tvLb5NARR4ijnFaWIkoeV4aMiU+i507NH8Z+NAvN7diMrdTpUMsxV3s -+rPk1+hQrNGbx1qeh0IOaVvQZg7y/EXQwLagoW6KresbNnFz4UempDEjbcbuxNHf3 -+7t5deMBICjcNZR47KxQDiXLyUu1fAMUGYOqAINBD7Ga80ibb8Ck+avliIL5YJkS6 -+14xvdqYFIOSYt8Ryel3fTw0j7C6cceww+RRfyHULq2f2fftNdmRKpdX6tAhQnRPH -+j8J5sLQ+L4nTMydNn4vTYCQHq7JyPSmlxErsPATSST4mG+x6ED3KRVqAi00qlmNP -+LWMoDztHR8p8LBVBMtXgyb6lVSyza0YqVrEb7SkCAwEAAaN1MHMwDAYDVR0TAQH/ -+BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0O -+BBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFAV+KcZC+G2nf/6V -+sElx119oZKWUMA0GCSqGSIb3DQEBCwUAA4IBgQCTOjwtK5sDPFdbWWlScDX9xfNf -+tnqRL22Id6VIRcAiuu6KVAYRNs3Pdv65H9orSaohrBRfWKEqAi51bhvDQvzhbw7u -+881txF+6s0fauArxAUai3e11eCil3gt0JOQVephmPKw6pVq9mMieho5I2SQ8CXoQ -+pSrselGaOTp8CK1r90pn8RGiJrZ3xJu5Yezb3AWCs3IOHhRT1Rc5mFnvs9VVR64h -+Pvlr9yBOf/pBEuylQr00plhsZdLra/nIspsGnOIiuM4eIliP6bQwE06u1LxlCbgB -+CAGTQ86vbO2xT1i8dZeq8TJ72OatmRboUBncaZNIT3rUTZxZYkYhkNtVTKnv/8qq -+LZI23qtcWLEAsc1O0Xva22wjkg5QE06AiWdcwK3f/Qpvj5yO9+PL7X4lP47n5D6m -+t1S6xisKgjo/IP9Wk3mPNaNDN3hZCaFRYEHn4CYrlXHqjg1w7quCKApYzrh5/L1Y -+b9U/qzwF7SatFovndYtf02bjcrHC/TA53IdiQPA= - -----END CERTIFICATE----- -diff --git a/tests/certs/user-cert.pem b/tests/certs/user-cert.pem -index ef5114c..32ab235 100644 ---- a/tests/certs/user-cert.pem -+++ b/tests/certs/user-cert.pem -@@ -1,21 +1,21 @@ - -----BEGIN CERTIFICATE----- --MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD --QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD --EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF --AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw --vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF --Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0 --d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm --RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd --E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW --Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB --Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD --VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4 --SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveOQ1xHPbA3jvfRhzVeD --Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg --MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg --juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV --NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF --bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0 --dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g -+MIIDiTCCAkGgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD -+QTAgFw0xMzA2MDYxMjUxMjlaGA85OTk5MTIzMTIzNTk1OVowJzEPMA0GA1UEAxMG -+QSB1c2VyMRQwEgYKCZImiZPyLGQBARMEdGVzdDCCAVIwDQYJKoZIhvcNAQEBBQAD -+ggE/ADCCAToCggExAKtUmPypxhWVnabBlISUkXkeeNstSFGZZQECwEBSSV3rcLwm -+72g5HgSR4tvLb5NARR4ijnFaWIkoeV4aMiU+i507NH8Z+NAvN7diMrdTpUMsxV3s -+rPk1+hQrNGbx1qeh0IOaVvQZg7y/EXQwLagoW6KresbNnFz4UempDEjbcbuxNHf3 -+7t5deMBICjcNZR47KxQDiXLyUu1fAMUGYOqAINBD7Ga80ibb8Ck+avliIL5YJkS6 -+14xvdqYFIOSYt8Ryel3fTw0j7C6cceww+RRfyHULq2f2fftNdmRKpdX6tAhQnRPH -+j8J5sLQ+L4nTMydNn4vTYCQHq7JyPSmlxErsPATSST4mG+x6ED3KRVqAi00qlmNP -+LWMoDztHR8p8LBVBMtXgyb6lVSyza0YqVrEb7SkCAwEAAaN1MHMwDAYDVR0TAQH/ -+BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0O -+BBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4Slrq -+yrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQAp51Ks5DDWVlLB6fMM2NJV80sX -+Rx6U1g6ovA7N5BDQiF6FYzVZECMH3d9nyZssHbkzb6qyO1m58P0cNkVurEH27+Z2 -+xdkNw5bbcvNDVhfVSjwa6nyTLfhf7vOTWaIxGGmffP72PIe87N6QmyCCGG0IXIkO -+kcTAE8IgX6k1mEr1Xy2ZtFVgKjPPLxsixIJ7TEktvJR1RqWQfbsOS8f13lvS1Vhh -+vc+UMbIQnz+jl4qNV/AX7GfpEYiBkbrgcjsggl/KMuwcauhEDdvfIQjcyRbQN36p -+KcVEXDpnG54sAfXAs9Z+adbvmu0ONAMCDuxKCT2eG1SGVrtiT5+7kCMso1eKz/5A -+r1XP0RgCKFExIRYb1elFpLc8wmJbN4qof2zisKG8UajFIHzIGateiu53enNn - -----END CERTIFICATE----- -diff --git a/tests/certs/user-cert.tmpl b/tests/certs/user-cert.tmpl -new file mode 100644 -index 0000000..6a60496 ---- /dev/null -+++ b/tests/certs/user-cert.tmpl -@@ -0,0 +1,7 @@ -+dn = "uid=test,cn=A user" -+tls_www_client -+signing_key -+encryption_key -+expiration_days = -1 -+activation_date = "2013-06-06 14:51:29" -+serial = 0x51d82f14 -diff --git a/tests/cipher-common.sh b/tests/cipher-common.sh -index fb9e2ac..07443a0 100755 ---- a/tests/cipher-common.sh -+++ b/tests/cipher-common.sh -@@ -91,14 +91,14 @@ fi - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ${CSTR} --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ${CSTR} --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 ${CSTR} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= ${CSTR} -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/disconnect-user b/tests/disconnect-user -index 67a016e..bf4c7ab 100755 ---- a/tests/disconnect-user -+++ b/tests/disconnect-user -@@ -77,7 +77,7 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${TMPFILE} ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${TMPFILE} ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 -@@ -85,7 +85,7 @@ fi - - eval $(cat ${TMPFILE}) - echo " * Connecting to ${ADDRESS}:${PORT}..." --( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) -+( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -105,7 +105,7 @@ if test $? != 0;then - fi - - echo " * Re-connecting to obtain cookie after disconnect... " --( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) -+( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) - if test $? = 0;then - echo "Succeeded using the cookie to connect" - exit 1 -diff --git a/tests/disconnect-user2 b/tests/disconnect-user2 -index ef8c3c1..e00cc67 100755 ---- a/tests/disconnect-user2 -+++ b/tests/disconnect-user2 -@@ -75,7 +75,7 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${TMPFILE} ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${TMPFILE} ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 -@@ -83,7 +83,7 @@ fi - - eval $(cat ${TMPFILE}) - echo " * Connecting to ${ADDRESS}:${PORT}..." --( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) -+( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -103,7 +103,7 @@ if test $? != 0;then - fi - - echo " * Re-connecting to obtain cookie after disconnect... " --( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) -+( ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${PORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script -C "${COOKIE}" --pid-file=${CLIPID} -b ) - if test $? = 0;then - echo "Succeeded using the cookie to connect" - exit 1 -diff --git a/tests/drain-server b/tests/drain-server -index be51cd4..808067f 100755 ---- a/tests/drain-server -+++ b/tests/drain-server -@@ -35,7 +35,7 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - if ! test -f ${PIDFILE};then -@@ -48,7 +48,7 @@ kill -15 $(cat $PIDFILE) - sleep 1 - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) && - fail $PID "Server is still listening" - - wait -diff --git a/tests/drain-server-fail b/tests/drain-server-fail -index d61106e..a2c495d 100755 ---- a/tests/drain-server-fail -+++ b/tests/drain-server-fail -@@ -48,7 +48,7 @@ launch_simple_sr_server -d 3 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - if ! test -f ${PIDFILE};then -diff --git a/tests/flowcontrol b/tests/flowcontrol -index fb60f67..7ef6b70 100755 ---- a/tests/flowcontrol -+++ b/tests/flowcontrol -@@ -37,39 +37,39 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with wrong password... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - echo "Connecting to obtain cookie with empty password... " --( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - echo "Connecting to obtain cookie with wrong username... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - # test locked account - - echo "Connecting to obtain cookie with locked account... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - #test special characters - - echo "Connecting to obtain cookie with special password... " --( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with empty password... " --( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - #echo "Normal connection... " --#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || -+#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || - # fail $PID "Could not connect to server" - - if ! test -f ${PIDFILE};then -diff --git a/tests/haproxy-auth b/tests/haproxy-auth -index b653714..5261860 100755 ---- a/tests/haproxy-auth -+++ b/tests/haproxy-auth -@@ -51,7 +51,7 @@ LD_PRELOAD=libsocket_wrapper.so:libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT - wait_server ${HAPID} - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - kill ${HAPID} - fail ${PID} "Could not receive cookie from server" -@@ -66,7 +66,7 @@ LD_PRELOAD=libsocket_wrapper.so:libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT - wait_server ${HAPID} - - echo "Re-connecting to obtain cookie after haproxy restart... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - kill ${HAPID} - fail ${PID} "Could not receive cookie from server" -diff --git a/tests/haproxy-connect b/tests/haproxy-connect -index c42b76c..662c08f 100755 ---- a/tests/haproxy-connect -+++ b/tests/haproxy-connect -@@ -91,14 +91,14 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -135,7 +135,7 @@ set +e - sleep 3 - - echo " * Re-connecting to obtain cookie after haproxy restart... " --( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not receive cookie from server on reconnection" - exit 1 -diff --git a/tests/haproxy-proxyproto b/tests/haproxy-proxyproto -index 70c1390..54e413c 100755 ---- a/tests/haproxy-proxyproto -+++ b/tests/haproxy-proxyproto -@@ -94,14 +94,14 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/haproxy-proxyproto-v1 b/tests/haproxy-proxyproto-v1 -index d274575..f767581 100755 ---- a/tests/haproxy-proxyproto-v1 -+++ b/tests/haproxy-proxyproto-v1 -@@ -94,14 +94,14 @@ sleep 3 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${HAPORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} -q ${ADDRESS}:${HAPORT} -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/ipv6-iface b/tests/ipv6-iface -index d5262e5..9b78d5e 100755 ---- a/tests/ipv6-iface -+++ b/tests/ipv6-iface -@@ -70,7 +70,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - wait_server $PID - - echo -n "Connecting to setup interface... " --echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b -+echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/ipv6-small-net b/tests/ipv6-small-net -index 4fc7260..c87b429 100755 ---- a/tests/ipv6-small-net -+++ b/tests/ipv6-small-net -@@ -70,7 +70,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - wait_server $PID - - echo -n "Connecting to setup interface... " --echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b -+echo "test" | ${CMDNS1} $OPENCONNECT -q $ADDRESS:$PORT -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/json b/tests/json -index 72dd4bf..24c66d8 100755 ---- a/tests/json -+++ b/tests/json -@@ -78,7 +78,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - sleep 4 - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/lz4-compression b/tests/lz4-compression -index 76478cf..405b2a2 100755 ---- a/tests/lz4-compression -+++ b/tests/lz4-compression -@@ -81,14 +81,14 @@ sleep 4 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/lzs-compression b/tests/lzs-compression -index c485df2..eef55f0 100755 ---- a/tests/lzs-compression -+++ b/tests/lzs-compression -@@ -81,14 +81,14 @@ sleep 4 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/multiple-routes b/tests/multiple-routes -index b6cc0c5..63c7614 100755 ---- a/tests/multiple-routes -+++ b/tests/multiple-routes -@@ -39,13 +39,13 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (with certificate)... " --( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null ) || -+( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Re-connecting to get routes... " --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 - - echo ok - -diff --git a/tests/no-route-default b/tests/no-route-default -index 0c6f4f2..6cc68f0 100755 ---- a/tests/no-route-default -+++ b/tests/no-route-default -@@ -43,7 +43,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to get routes... " --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 - - echo ok - -@@ -68,7 +68,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to get routes... " --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 - - echo ok - -diff --git a/tests/no-route-group b/tests/no-route-group -index 59ec2f0..25cfaa6 100755 ---- a/tests/no-route-group -+++ b/tests/no-route-group -@@ -43,7 +43,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to get routes... " --echo "test" | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 -u test --passwd-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 -+echo "test" | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 -u test --passwd-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 - - echo ok - -@@ -68,7 +68,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to get routes... " --echo test | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 --passwd-on-stdin -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${TMPFILE} 2>&1 -+echo test | timeout 15s $OPENCONNECT -v localhost:$PORT --authgroup group1 --passwd-on-stdin -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${TMPFILE} 2>&1 - - echo ok - -diff --git a/tests/ping-leases b/tests/ping-leases -index d97012e..3a43ac5 100755 ---- a/tests/ping-leases -+++ b/tests/ping-leases -@@ -52,12 +52,12 @@ fi - echo "Server started with PID $PID..." - - echo "Connecting to obtain cookie..." --( echo "test" | $OPENCONNECT -q localhost:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | $OPENCONNECT -q localhost:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - - echo "Connecting to ping lease..." --echo "test" | timeout 10 $OPENCONNECT localhost:$PORT -u "test" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true -+echo "test" | timeout 10 $OPENCONNECT localhost:$PORT -u "test" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true - - if test $? != 124;then - fail $PID "Could not connect to server" -diff --git a/tests/radius b/tests/radius -index 859671d..7bc705a 100755 ---- a/tests/radius -+++ b/tests/radius -@@ -98,21 +98,21 @@ sleep 4 - - # Run clients - echo " * Testing wrong username at ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u xxx --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u xxx --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? = 0;then - echo "Connected with incorrect username" - exit 1 - fi - - echo " * Testing wrong password at ${ADDRESS}:${PORT}..." --( echo "xxx" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "xxx" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? = 0;then - echo "Connected with incorrect password" - exit 1 - fi - - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 -@@ -120,7 +120,7 @@ fi - - echo " * Connecting to ${ADDRESS}:${PORT} with special IP..." - USERNAME=test-arb --( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -148,7 +148,7 @@ sleep 3 - - echo " * Connecting to ${ADDRESS}:${PORT}..." - USERNAME=test --( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/radius-config b/tests/radius-config -index 7285091..af9d3f7 100755 ---- a/tests/radius-config -+++ b/tests/radius-config -@@ -123,7 +123,7 @@ sleep 4 - - echo " * Connecting to ${ADDRESS}:${PORT}..." - USERNAME=testtime --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/radius-group b/tests/radius-group -index 1f28cda..9b85889 100755 ---- a/tests/radius-group -+++ b/tests/radius-group -@@ -100,7 +100,7 @@ sleep 4 - - echo " * Tests the radius group functionality" - USERNAME=test-class --( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group2 -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group2 -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -137,7 +137,7 @@ sleep 4 - - echo " * Tests the alt radius group functionality" - USERNAME=test-class --( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group1 -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${USERNAME}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} --authgroup group1 -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/radius-otp b/tests/radius-otp -index 11c3907..9b4fecb 100755 ---- a/tests/radius-otp -+++ b/tests/radius-otp -@@ -111,7 +111,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - sleep 0.5 - echo "$USERNAME-stage$COUNT" - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b >/dev/null 2>&1) - if test $? != 0; then - echo "Could not connect to server" - exit 1 -@@ -151,7 +151,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - sleep 0.5 - echo "$USERNAME-stage" - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected with wrong username" - exit 1 -@@ -173,7 +173,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - echo "$USERNAME-stage$COUNT" - fi - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected with wrong OTP" - exit 1 -@@ -197,7 +197,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - echo "$USERNAME-stage$COUNT" - fi - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected with wrong OTP" - exit 1 -@@ -218,7 +218,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - echo "$USERNAME-stage$COUNT" - fi - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected with blank OTP" - exit 1 -@@ -247,7 +247,7 @@ for (( COUNT=1; COUNT <= 3; COUNT++ )); do - echo "$USERNAME-stage$COUNT" - fi - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Successful connection with the number of OTP retries greater than allowed by the ban system (default 30)." - ${OCCTL} -s ${OCCTL_SOCKET} show ip ban points -@@ -265,7 +265,7 @@ for (( COUNT=1; COUNT <= 17; COUNT++ )); do - sleep 0.5 - echo "$USERNAME-stage$COUNT" - done --} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) -+} | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} -b --cookieonly >/dev/null 2>&1) - if test $? == 0; then - echo "Connected to server - MAX_CHALLENGES test failed" - exit 1 -diff --git a/tests/test-append-routes b/tests/test-append-routes -index be71d22..923d0aa 100755 ---- a/tests/test-append-routes -+++ b/tests/test-append-routes -@@ -41,7 +41,7 @@ wait_server $PID - - echo "Checking if routes are appended... " - --timeout 15s $OPENCONNECT localhost:$PORT -v --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 -+timeout 15s $OPENCONNECT localhost:$PORT -v --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 - - echo "cat" - cat ${TMPFILE1} -diff --git a/tests/test-ban b/tests/test-ban -index eb6a874..be4695a 100755 ---- a/tests/test-ban -+++ b/tests/test-ban -@@ -59,15 +59,15 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - sleep 4 - - echo "Connecting with wrong password 5 times... " --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - - echo "" - echo "Connecting with correct password... " --eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -n "$COOKIE" ];then - fail $PID "Obtained cookie although should have been banned" -@@ -90,7 +90,7 @@ sleep 25 - echo "" - - echo "Connecting with correct password after ban time... " --eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie even though ban should be lifted" -@@ -99,16 +99,16 @@ fi - echo "" - echo "Checking ban reset time... " - --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - sleep 11 --echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "notest" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - - echo "" - echo "Connecting with correct password after ban reset time... " --eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | ${CMDNS1} ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie even though ban should be lifted" -diff --git a/tests/test-ban-local b/tests/test-ban-local -index d2a4397..fbe0eb2 100755 ---- a/tests/test-ban-local -+++ b/tests/test-ban-local -@@ -60,15 +60,15 @@ ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$! - sleep 4 - - echo "Connecting with wrong password 5 times... " --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -+echo "notest" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - - echo "" - echo "Connecting with correct password... " --eval `echo "test" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | ${OPENCONNECT} --passwd-on-stdin -q ${ADDRESS}:${PORT} -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie even though client should be exempt" -diff --git a/tests/test-cert b/tests/test-cert -index 41362aa..7967193 100755 ---- a/tests/test-cert -+++ b/tests/test-cert -@@ -49,19 +49,19 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with invalid certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected with invalid certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -80,7 +80,7 @@ kill -HUP $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with DER CRL)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -99,13 +99,13 @@ kill -HUP $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with revoked certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected with revoked certificate!" - - echo "ok (failed as expected)" - - #echo "Normal connection... " --#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || -+#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || - # fail $PID "Could not connect to server" - - rm -f "${CRLNAME}" "${CRLTMPLNAME}" -diff --git a/tests/test-cert-opt-pass b/tests/test-cert-opt-pass -index 18893d3..0109ef2 100755 ---- a/tests/test-cert-opt-pass -+++ b/tests/test-cert-opt-pass -@@ -34,7 +34,7 @@ opts=$1 - pass=$2 - rm -f ${OUTFILE} - --echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 -+echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 - if test $? != 0;then - cat ${OUTFILE} - return 1 -diff --git a/tests/test-client-bypass-protocol b/tests/test-client-bypass-protocol -index 09f3cb2..14cb5a5 100755 ---- a/tests/test-client-bypass-protocol -+++ b/tests/test-client-bypass-protocol -@@ -43,7 +43,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting... " --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 - - echo ok - -@@ -68,7 +68,7 @@ PID=$! - wait_server $PID - - echo -n "Reconnecting..." --timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE} 2>&1 -+timeout 15s $OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE} 2>&1 - - echo ok - -diff --git a/tests/test-config-per-group b/tests/test-config-per-group -index 4a8bd60..6b8929a 100755 ---- a/tests/test-config-per-group -+++ b/tests/test-config-per-group -@@ -81,7 +81,7 @@ ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & - sleep 4 - - echo " * Connecting with user NOT in group..." --( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -129,7 +129,7 @@ sleep 2 - USERNAME=test - PASSWORD=test - echo " * Connecting with user in group to ${ADDRESS}:${PORT}..." --( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "${PASSWORD}" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/test-cookie-invalidation b/tests/test-cookie-invalidation -index 5f77afa..a6f8cea 100755 ---- a/tests/test-cookie-invalidation -+++ b/tests/test-cookie-invalidation -@@ -35,7 +35,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie" -@@ -44,7 +44,7 @@ fi - #echo "Cookie: $COOKIE" - - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background >/dev/null 2>&1 -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background >/dev/null 2>&1 - - sleep 4 - -@@ -58,9 +58,9 @@ if test $? != 0;then - fi - - echo "Terminating and connecting again with same cookie... " --#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - # fail $PID "Could not connect to server" --echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 -+echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 - - sleep 4 - -@@ -82,9 +82,9 @@ rm -f "${PIDFILE2}" - sleep 18 - - echo "Proper termination and connecting again with same (invalidated) cookie... " --#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+#( echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - # fail $PID "Could not connect to server" --echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 -+echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background >/dev/null 2>&1 - - sleep 4 - -diff --git a/tests/test-cookie-timeout b/tests/test-cookie-timeout -index 08081b2..b8b4dda 100755 ---- a/tests/test-cookie-timeout -+++ b/tests/test-cookie-timeout -@@ -34,7 +34,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie" -@@ -44,7 +44,7 @@ fi - sleep 16 - echo "" - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background -+echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background - - sleep 4 - -@@ -59,7 +59,7 @@ rm -f "${PIDFILE}" - sleep 16 - echo "" - echo "Connecting again with cookie... " --echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background -+echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background - - sleep 4 - -@@ -74,7 +74,7 @@ rm -f "${PIDFILE}" - sleep 16 - echo "" - echo "Connecting after forced kill with cookie... " --echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background -+echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background - - sleep 4 - -@@ -90,7 +90,7 @@ rm -f "${PIDFILE}" - sleep 45 - echo "" - echo "Connecting with cookie after expiration... " --echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE}" --background -+echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE}" --background - - sleep 4 - -@@ -104,7 +104,7 @@ fi - # test cookie verification after cookie verification failure. That is to verify whether - # the channel between main and sec-mod is in consistent state. - echo "Connecting (again) to obtain cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= - - if test $? != 0;then - fail $PID "Could not obtain cookie" -diff --git a/tests/test-cookie-timeout-2 b/tests/test-cookie-timeout-2 -index fbeba81..4161eb6 100755 ---- a/tests/test-cookie-timeout-2 -+++ b/tests/test-cookie-timeout-2 -@@ -33,7 +33,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - fail $PID "Could not obtain cookie" -@@ -43,7 +43,7 @@ fi - sleep 10 - echo "" - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background -+echo "test" | $OPENCONNECT -q -b localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid.$$ --background - - sleep 4 - -@@ -58,7 +58,7 @@ rm -f "${srcdir}/pid2.$$" - sleep 30 - echo "" - echo "Connecting again with cookie (overriding first session)... " --echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background -+echo "test" | $OPENCONNECT -b -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pid2.$$ --background - - sleep 6 - -diff --git a/tests/test-enc-key b/tests/test-enc-key -index 0ca6249..5d65b62 100755 ---- a/tests/test-enc-key -+++ b/tests/test-enc-key -@@ -33,7 +33,7 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - cleanup -@@ -48,7 +48,7 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - cleanup -diff --git a/tests/test-explicit-ip b/tests/test-explicit-ip -index bfd1a9d..41d4665 100755 ---- a/tests/test-explicit-ip -+++ b/tests/test-explicit-ip -@@ -31,13 +31,13 @@ connect() - opts=$1 - pass=$2 - COOKIE='' --eval `echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate` -+eval `echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate` - if [ -z "$COOKIE" ];then - return 1 - fi - - rm -f $TMPFILE --echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 & -+echo "$pass" | $OPENCONNECT -q localhost:$PORT $opts -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file ${srcdir}/pidx >$TMPFILE 2>&1 & - CPID=$! - - sleep 3 -diff --git a/tests/test-group-pass b/tests/test-group-pass -index 1530f43..7a78237 100755 ---- a/tests/test-group-pass -+++ b/tests/test-group-pass -@@ -33,19 +33,19 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group1 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group1 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group2 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with wrong groupname... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group4 --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --authgroup group4 --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - cleanup -diff --git a/tests/test-gssapi-opt-cert b/tests/test-gssapi-opt-cert -index 0ef2d55..5cf1105 100755 ---- a/tests/test-gssapi-opt-cert -+++ b/tests/test-gssapi-opt-cert -@@ -29,7 +29,7 @@ opts=$1 - pass=$2 - rm -f ${OUTFILE} - --echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 -+echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 - if test $? != 0;then - cat ${OUTFILE} - return 1 -diff --git a/tests/test-gssapi-opt-pass b/tests/test-gssapi-opt-pass -index 8999d30..b6ebd11 100755 ---- a/tests/test-gssapi-opt-pass -+++ b/tests/test-gssapi-opt-pass -@@ -29,7 +29,7 @@ opts=$1 - pass=$2 - rm -f ${OUTFILE} - --echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --authenticate >${OUTFILE} 2>&1 -+echo "$pass" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --authenticate >${OUTFILE} 2>&1 - if test $? != 0;then - cat ${OUTFILE} - return 1 -diff --git a/tests/test-iroute b/tests/test-iroute -index d7b5f52..caf0a92 100755 ---- a/tests/test-iroute -+++ b/tests/test-iroute -@@ -34,13 +34,13 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (with certificate)... " --( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -47,7 +47,7 @@ kill -USR2 $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -58,7 +58,7 @@ kill -USR2 $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -diff --git a/tests/test-max-same-1 b/tests/test-max-same-1 -index 5146483..ec19c0d 100755 ---- a/tests/test-max-same-1 -+++ b/tests/test-max-same-1 -@@ -47,7 +47,7 @@ launch_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - echo "Could not obtain cookie" -@@ -57,12 +57,12 @@ fi - #echo "Cookie: $COOKIE" - - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background - - sleep 4 - - echo "Connecting again with same cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background - - sleep 4 - -diff --git a/tests/test-multi-cookie b/tests/test-multi-cookie -index 83c9cb5..7581f9c 100755 ---- a/tests/test-multi-cookie -+++ b/tests/test-multi-cookie -@@ -47,7 +47,7 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - echo "Could not obtain cookie" -@@ -57,12 +57,12 @@ fi - #echo "Cookie: $COOKIE" - - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE1}" --background - - sleep 4 - - echo "Connecting again with same cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -b -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${PIDFILE2}" --background - - sleep 4 - -diff --git a/tests/test-multiple-client-ip b/tests/test-multiple-client-ip -index 0e799e0..76099fe 100755 ---- a/tests/test-multiple-client-ip -+++ b/tests/test-multiple-client-ip -@@ -84,14 +84,14 @@ sleep 4 - - # Run client 1 - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -@@ -99,14 +99,14 @@ fi - - # Run client 2 - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID2} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS3} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID2} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 -diff --git a/tests/test-namespace-listen b/tests/test-namespace-listen -index 9691b28..81c3e86 100755 ---- a/tests/test-namespace-listen -+++ b/tests/test-namespace-listen -@@ -77,7 +77,7 @@ if test $? != 0; then - fi - - echo " connecting to server" --(echo "test" | ${CMDNS3} $OPENCONNECT $ADDRESS:$PORT -u "test" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --pid-file=${CLIPID} -b) || -+(echo "test" | ${CMDNS3} $OPENCONNECT $ADDRESS:$PORT -u "test" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --pid-file=${CLIPID} -b) || - fail $PID "could not connect to server" - sleep 5 - -diff --git a/tests/test-otp b/tests/test-otp -index 5209b0a..ed1fe94 100755 ---- a/tests/test-otp -+++ b/tests/test-otp -@@ -45,27 +45,27 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting with wrong username... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u falsetest --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u falsetest --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Connected with wrong username!" - echo ok - - echo -n "Connecting with wrong OTP... " --( echo -e "test\n999482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n999482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Should not have connected with wrong OTP!" - echo ok - - echo -n "Connecting with correct password and OTP... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with OTP!" - echo ok - - echo -n "Connecting with empty password and wrong OTP... " --( echo -e "999999\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "999999\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Should have not connected with wrong OTP!" - echo ok - - echo -n "Connecting with empty password and OTP... " --( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with OTP-only!" - echo ok - -diff --git a/tests/test-otp-cert b/tests/test-otp-cert -index c8dc12c..61a71db 100755 ---- a/tests/test-otp-cert -+++ b/tests/test-otp-cert -@@ -45,22 +45,22 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - echo ok - - echo -n "Connecting to obtain cookie (with incorrect certificate)... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Should not have connected with wrong certificate!" - echo ok - - echo -n "Connecting to obtain cookie (with certificate)... " --( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo -e "test\n328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - echo ok - - echo -n "Connecting to obtain cookie (with no pass and certificate)... " --( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo -e "328482\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - echo ok - -diff --git a/tests/test-pam b/tests/test-pam -index 8ec787a..561a140 100755 ---- a/tests/test-pam -+++ b/tests/test-pam -@@ -37,22 +37,22 @@ wait_server $PID - - echo "" - echo "Connecting with wrong password... " --( echo -e "testuser\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "testuser\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with wrong cred" - - echo "" - echo "Connecting with empty password... " --( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with wrong cred" - - echo "" - echo "Connecting with wrong username... " --( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with wrong cred" - - echo "" - echo "Connecting with correct password... " --( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ||#>/dev/null 2>&1 ) || -+( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -v $ADDRESS:$PORT --authgroup group2 -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) ||#>/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - cleanup -diff --git a/tests/test-pam-noauth b/tests/test-pam-noauth -index dc8dd3d..1f67371 100755 ---- a/tests/test-pam-noauth -+++ b/tests/test-pam-noauth -@@ -35,19 +35,19 @@ launch_sr_pam_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting with correct password but no PAM user... " --( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u xtest --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u xtest --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with non existing user" - - echo "Connecting with incorrect password (correct in PAM) and existing user... " --( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "testuser123\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with non existing user" - - echo "Connecting with empty password (correct in PAM) and existing user... " --( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie with non existing user" - - echo "Connecting with correct password and existing user... " --( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) ||#>/dev/null 2>&1 ) || -+( echo -e "test\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u testuser --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) ||#>/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - cleanup -diff --git a/tests/test-pass b/tests/test-pass -index 9d5484a..5aaaf48 100755 ---- a/tests/test-pass -+++ b/tests/test-pass -@@ -34,39 +34,39 @@ launch_sr_server -d 1 -p ${PIDFILE} -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with wrong password... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - echo "Connecting to obtain cookie with empty password... " --( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo -e "\n" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - echo "Connecting to obtain cookie with wrong username... " --( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - # test locked account - - echo "Connecting to obtain cookie with locked account... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u locked --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - #test special characters - - echo "Connecting to obtain cookie with special password... " --( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting to obtain cookie with empty password... " --( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u "empty" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - #echo "Normal connection... " --#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || -+#( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || - # fail $PID "Could not connect to server" - - if ! test -f ${PIDFILE};then -diff --git a/tests/test-pass-cert b/tests/test-pass-cert -index 8050788..8d284b8 100755 ---- a/tests/test-pass-cert -+++ b/tests/test-pass-cert -@@ -34,26 +34,26 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - - echo ok - - echo -n "Connecting to obtain cookie (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie (with incorrect certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-wrong.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Should not have connected with wrong certificate!" - - echo ok - - - #echo "Normal connection... " --#( echo "test" | $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) || -+#( echo "test" | $OPENCONNECT -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true ) || - # fail $PID "Could not connect to server" - - cleanup -diff --git a/tests/test-pass-group-cert b/tests/test-pass-group-cert -index ff64993..e559ac6 100755 ---- a/tests/test-pass-group-cert -+++ b/tests/test-pass-group-cert -@@ -33,37 +33,37 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group1 (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - DEFAULT (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup DEFAULT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup DEFAULT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group2 (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group3 (hidden) (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group4 (with certificate)... " --( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group4 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "test" | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group4 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Got cookie when it shouldn't!" - - echo ok -diff --git a/tests/test-pass-group-cert-no-pass b/tests/test-pass-group-cert-no-pass -index bc39b45..401b24f 100755 ---- a/tests/test-pass-group-cert-no-pass -+++ b/tests/test-pass-group-cert-no-pass -@@ -33,25 +33,25 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 && -+LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 && - fail $PID "Connected without certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group1 (with certificate)... " --LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || -+LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group1 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group2 (with certificate)... " --LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || -+LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group2 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Connecting to obtain cookie - group3 (hidden) (with certificate)... " --LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 || -+LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT --authgroup group3 -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-group-key.pem -c ${srcdir}/certs/user-group-cert.pem -u test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 || - fail $PID "Could not connect with certificate!" - - echo ok -diff --git a/tests/test-pass-opt-cert b/tests/test-pass-opt-cert -index ac9adc1..1836538 100755 ---- a/tests/test-pass-opt-cert -+++ b/tests/test-pass-opt-cert -@@ -38,7 +38,7 @@ connect() - { - opts=$1 - pass=$2 --echo ${pass} | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --passwd-on-stdin --authenticate >${TMPFILE} -+echo ${pass} | LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT $opts --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --passwd-on-stdin --authenticate >${TMPFILE} - if test $? != 0;then - cat ${TMPFILE} - return 1 -diff --git a/tests/test-pass-script b/tests/test-pass-script -index 89a4094..0f18551 100755 ---- a/tests/test-pass-script -+++ b/tests/test-pass-script -@@ -67,7 +67,7 @@ launch_server -d 1 -f -c "${CONFIG}" & PID=$! - wait_server $PID - - echo " * Connecting to obtain cookie with wrong username... " --( echo "tost" | $OPENCONNECT -q localhost:$PORT -u tost --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) && -+( echo "tost" | $OPENCONNECT -q localhost:$PORT -u tost --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) && - fail $PID "Received cookie when we shouldn't" - - rm -f ${builddir}/connect.ok -@@ -76,11 +76,11 @@ rm -f ${builddir}/host-update.ok - #test special characters - - echo " * Connecting to obtain cookie... " --( echo "!@#$%^&*()<>" | $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo " * Re-connecting to force script run... " --echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true -+echo "!@#$%^&*()<>" | timeout 7 $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true - - TIMEOUT=5 - while ! test -f ${builddir}/disconnect.ok; do -@@ -112,7 +112,7 @@ rm -f ${builddir}/disconnect.ok - rm -f ${builddir}/host-update.ok - - echo " * Re-connecting to get cookie... " --echo "test2" | $OPENCONNECT -q localhost:$PORT -u "test2" --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >${PARAMSFILE} -+echo "test2" | $OPENCONNECT -q localhost:$PORT -u "test2" --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >${PARAMSFILE} - if test $? != 0;then - echo "Could not connect" - cat ${PARAMSFILE} -@@ -127,7 +127,7 @@ fi - - echo " * Re-connecting to force session stealing... " - eval "$(grep COOKIE ${PARAMSFILE})" --echo ${COOKIE}| $OPENCONNECT --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true --pid-file=${OPIDFILE} -b -+echo ${COOKIE}| $OPENCONNECT --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true --pid-file=${OPIDFILE} -b - - echo " - Pausing client" - TIMEOUT=4 -@@ -156,7 +156,7 @@ rm -f ${builddir}/connect.ok - rm -f ${builddir}/disconnect.ok - - echo " * Re-connecting to steal previous IP address... " --echo ${COOKIE} | $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true --pid-file=${OPIDFILE2} -b -+echo ${COOKIE} | $OPENCONNECT -q --local-hostname='mylocalname' localhost:$PORT -u "test2" --reconnect-timeout 0 --cookie-on-stdin --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true --pid-file=${OPIDFILE2} -b - - echo " - Resuming (disconnected) client" - kill -s CONT $(cat ${OPIDFILE}) -@@ -205,7 +205,7 @@ done - sleep 5 - echo " - Check server status" - --( echo "!@#$%^&*()<>" | $OPENCONNECT --local-hostname='mylocalname' -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "!@#$%^&*()<>" | $OPENCONNECT --local-hostname='mylocalname' -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo " - Killing server" -diff --git a/tests/test-replay b/tests/test-replay -index b8aa848..0533893 100755 ---- a/tests/test-replay -+++ b/tests/test-replay -@@ -60,7 +60,7 @@ launch_server -d 9999 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to obtain cookie... " --eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3` -+eval `echo "test" | $OPENCONNECT -q localhost:$PORT -u test --authenticate --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=` - - if [ -z "$COOKIE" ];then - echo "Could not obtain cookie" -@@ -70,7 +70,7 @@ fi - #echo "Cookie: $COOKIE" - - echo "Connecting with cookie... " --echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --verbose --pid-file "${PIDFILE1}" --background -+echo "test" | $OPENCONNECT -q localhost:$PORT -u test -C "$COOKIE" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --verbose --pid-file "${PIDFILE1}" --background - - sleep 4 - -diff --git a/tests/test-san-cert b/tests/test-san-cert -index a5040ae..a41c331 100755 ---- a/tests/test-san-cert -+++ b/tests/test-san-cert -@@ -49,25 +49,25 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (without certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected without certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with invalid certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-invalid.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected with invalid certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with certificate - no SAN)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Connected with invalid certificate!" - - echo "ok (failed as expected)" - - echo -n "Connecting to obtain cookie (with certificate - SAN)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-san-cert.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-san-cert.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Failed to connect with certificate!" - - echo ok -diff --git a/tests/test-script-multi-user b/tests/test-script-multi-user -index 6327a26..c0bfa3d 100755 ---- a/tests/test-script-multi-user -+++ b/tests/test-script-multi-user -@@ -47,16 +47,16 @@ launch_sr_server -d 1 -f -c ${CONFIG} & PID=$! - wait_server $PID - - echo "Connecting to force script block... " --echo "!@#$%^&*()<>" | timeout 60 $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true & -+echo "!@#$%^&*()<>" | timeout 60 $OPENCONNECT -q localhost:$PORT -u "sp@c/al" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true & - - sleep 3 - - echo "Connecting to obtain cookie... " --( echo "${USERNAME}" | $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) || -+( echo "${USERNAME}" | $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly >/dev/null 2>&1 ) || - fail $PID "Could not receive cookie from server" - - echo "Connecting in background... " --( echo "${USERNAME}" | timeout 15 $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --background >/dev/null 2>&1 ) || -+( echo "${USERNAME}" | timeout 15 $OPENCONNECT -q localhost:$PORT -u "${USERNAME}" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --background >/dev/null 2>&1 ) || - fail $PID "Could not connect to server; probably blocked" - - sleep 3 -diff --git a/tests/test-sighup b/tests/test-sighup -index add538f..dd424e5 100755 ---- a/tests/test-sighup -+++ b/tests/test-sighup -@@ -34,7 +34,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -44,7 +44,7 @@ kill -HUP $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) || -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) || - fail $PID "Could not connect with certificate!" - - echo ok -@@ -57,7 +57,7 @@ kill -HUP $PID - sleep 5 - - echo -n "Connecting to obtain cookie (with certificate)... " --( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null 2>&1 ) && -+( LD_PRELOAD=libsocket_wrapper.so $OPENCONNECT -q $ADDRESS:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null 2>&1 ) && - fail $PID "Could not connect with certificate!" - - echo ok -diff --git a/tests/test-stress b/tests/test-stress -index 3816604..a2db96e 100755 ---- a/tests/test-stress -+++ b/tests/test-stress -@@ -33,7 +33,7 @@ run_client() { - PASS=$1; - shift; - -- ( echo $PASS | $OPENCONNECT -q $HOST -u $USER --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true >/dev/null 2>&1 ) || -+ ( echo $PASS | $OPENCONNECT -q $HOST -u $USER --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true >/dev/null 2>&1 ) || - echo "$USER: Could not connect to server" - } - -diff --git a/tests/test-udp-listen-host b/tests/test-udp-listen-host -index f3e6623..956938b 100755 ---- a/tests/test-udp-listen-host -+++ b/tests/test-udp-listen-host -@@ -111,7 +111,7 @@ ${CMDNS2} ${HAPROXY} -f ${HACONFIG} -d & HAPID=$! - sleep 3 - - echo " * Connecting to haproxy and using dtls ... " --echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${CLIPID}" --background -+echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${CLIPID}" --background - - wait_file "${CLIPID}" 11 - -@@ -134,7 +134,7 @@ echo "restart ocsev with udp-listen-host set to 127.0.0.1" - ${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG_UDP_LISTEN_LOCAL} ${DEBUG} & PID=$! - - echo " * Connecting to haproxy and using dtls again ... " --echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true --verbose --pid-file "${CLIPID2}" --background -+echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${HAPORT} --user test --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --script=/bin/true --verbose --pid-file "${CLIPID2}" --background - - wait_file "${CLIPID2}" 11 - -diff --git a/tests/test-user-config b/tests/test-user-config -index 1c7f518..f8573ce 100755 ---- a/tests/test-user-config -+++ b/tests/test-user-config -@@ -42,20 +42,20 @@ PID=$! - wait_server $PID - - echo -n "Connecting to obtain cookie (with certificate)... " --( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly /dev/null ) || -+( $OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly /dev/null ) || - fail $PID "Could not connect with certificate!" - - echo ok - - echo -n "Re-connecting to force script run... " --$OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true /dev/null & -+$OPENCONNECT -q localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true /dev/null & - kpid1=$! - echo ok - - sleep 2 - - echo -n "Re-connecting to check the iroutes... " --$OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 & -+$OPENCONNECT -v localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 & - kpid2=$! - - echo ok -@@ -63,7 +63,7 @@ sleep 3 - - echo -n "Checking if max-same-clients is considered... " - --timeout 15s $OPENCONNECT localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE2} 2>&1 -+timeout 15s $OPENCONNECT localhost:$PORT --sslkey ${srcdir}/certs/user-key.pem -c ${srcdir}/certs/user-cert-testuser.pem --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE2} 2>&1 - if test $? = 124;then - fail $PID "Max-same-clients directive was ignored" - fi -@@ -155,7 +155,7 @@ rm -f ${TMPFILE1} - rm -f ${TMPFILE2} - - echo -n "Re-connecting to check the ipv4-network... " --$OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s /bin/true ${TMPFILE1} 2>&1 & kpid3=$! -+$OPENCONNECT -v localhost:$PORT --sslkey "${srcdir}/certs/user-key.pem" -c "${srcdir}/certs/user-cert-testipnet.pem" --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s /bin/true ${TMPFILE1} 2>&1 & kpid3=$! - - echo ok - sleep 3 -diff --git a/tests/test-vhost b/tests/test-vhost -index 902f011..1a57e60 100755 ---- a/tests/test-vhost -+++ b/tests/test-vhost -@@ -62,7 +62,7 @@ PID=$! - wait_server $PID - - echo -n "Connecting to default host to obtain cookie (user without certificate)... " --connect "default.example.com" "-u test" "test" "d66b507ae074d03b02eafca40d35f87dd81049d3" -+connect "default.example.com" "-u test" "test" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" - if test $? != 0;then - fail $PID "Failed to connect with user without certificate!" - fi -@@ -111,7 +111,7 @@ fi - echo ok - - echo -n "Connecting to default host to obtain cookie (with certificate)... " --connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "d66b507ae074d03b02eafca40d35f87dd81049d3" -+connect "default.example.com" "-u test --sslkey ./certs/user-key.pem -c ./certs/user-cert.pem" "" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" - if test $? = 0;then - fail $PID "Connected to wrong host with certificate!" - fi -@@ -136,7 +136,7 @@ kill -HUP $PID - sleep 5 - - echo -n "Sanity check to default host..." --connect "default.example.com" "-u test" "test" "d66b507ae074d03b02eafca40d35f87dd81049d3" -+connect "default.example.com" "-u test" "test" "pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8=" - if test $? != 0;then - fail $PID "Failed to connect with user without certificate!" - fi -diff --git a/tests/traffic b/tests/traffic -index 3ea962f..1f0fcaf 100755 ---- a/tests/traffic -+++ b/tests/traffic -@@ -79,14 +79,14 @@ sleep 4 - - # Run clients - echo " * Getting cookie from ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= --cookieonly ) - if test $? != 0;then - echo "Could not get cookie from server" - exit 1 - fi - - echo " * Connecting to ${ADDRESS}:${PORT}..." --( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) -+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8= -s ${srcdir}/scripts/vpnc-script --pid-file=${CLIPID} --passwd-on-stdin -b ) - if test $? != 0;then - echo "Could not connect to server" - exit 1 diff --git a/ocserv.conf b/ocserv.conf index d5e0814..0ecd600 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -34,7 +34,7 @@ # and all configuration will be read from radius. That also includes the # Acct-Interim-Interval, and Session-Timeout values. # -# See doc/README-radius.md for the supported radius configuration atributes. +# See doc/README-radius.md for the supported radius configuration attributes. # # gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900] # The gssapi option allows one to use authentication methods supported by GSSAPI, @@ -72,25 +72,29 @@ auth = "pam" # Only one accounting method can be specified. #acct = "radius[config=/etc/radiusclient/radiusclient.conf]" -# Use listen-host to limit to specific IPs or to the IPs of a provided +# Use listen-host to limit to specific IPs or to the IPs of a provided # hostname. #listen-host = [IP|HOSTNAME] +# Use udp-listen-host to limit udp to specific IPs or to the IPs of a provided +# hostname. if not set, listen-host will be used +#udp-listen-host = [IP|HOSTNAME] + # When the server has a dynamic DNS address (that may change), # should set that to true to ask the client to resolve again on # reconnects. #listen-host-is-dyndns = true -# Use udp-listen-host to limit udp to specific IPs or to the IPs of a provided -# hostname. if not set, listen-host will be used -#udp-listen-host = [IP|HOSTNAME] +# move the listen socket within the specified network namespace +# listen-netns = "foo" # TCP and UDP port number tcp-port = 443 udp-port = 443 -# The user the worker processes will be run as. It should be -# unique (no other services run as this user). +# The user the worker processes will be run as. This should be a dedicated +# unprivileged user (e.g., 'ocserv') and no other services should run as this +# user. run-as-user = ocserv run-as-group = ocserv @@ -148,7 +152,10 @@ server-key = /etc/pki/ocserv/private/server.key # is set. #ca-cert = /etc/ocserv/ca.pem - +# The number of sub-processes to use for the security module (authentication) +# processes. Typically this should not be set as the number of processes +# is determined automatically by the initially set maximum number of clients. +#sec-mod-scale = 4 ### All configuration options below this line are reloaded on a SIGHUP. @@ -167,7 +174,7 @@ server-key = /etc/pki/ocserv/private/server.key # Note however, that process isolation is restricted to the specific libc versions # the isolation was tested at. If you get random failures on worker processes, try # disabling that option and report the failures you, along with system and debugging -# information at: https://gitlab.com/ocserv/ocserv/issues +# information at: https://gitlab.com/openconnect/ocserv/issues isolate-workers = true # A banner to be displayed on clients after connection @@ -176,7 +183,8 @@ isolate-workers = true # A banner to be displayed on clients before connection #pre-login-banner = "Welcome" -# Limit the number of clients. Unset or set to zero for unlimited. +# Limit the number of clients. Unset or set to zero if unknown. In +# that case the maximum value is ~8k clients. #max-clients = 1024 max-clients = 16 @@ -238,6 +246,10 @@ switch-to-tcp-timeout = 25 # MTU discovery (DPD must be enabled) try-mtu-discovery = false +# To enable load-balancer connection draining, set server-drain-ms to a value +# higher than your load-balancer health probe interval. +#server-drain-ms = 15000 + # If you have a certificate from a CA that provides an OCSP # service you may provide a fresh OCSP status response within # the TLS handshake. That will prevent the client from connecting @@ -294,11 +306,8 @@ cert-user-oid = 0.9.2342.19200300.100.1.1 tls-priorities = "NORMAL:%SERVER_PRECEDENCE" # That option requires the established DTLS channel to use the same -# cipher as the primary TLS channel. This cannot be combined with -# listen-clear-file since the ciphersuite information is not available -# in that configuration. Note also, that this option implies that -# dtls-legacy option is false; this option cannot be enforced -# in the legacy/compat protocol. +# cipher as the primary TLS channel.Note also, that this option implies +# that the dtls-legacy option is false; this option cannot be enforced #match-tls-dtls-ciphers = true # The time (in seconds) that a client is allowed to stay connected prior @@ -327,11 +336,9 @@ min-reauth-time = 300 # that get a score over that configured number are banned for # min-reauth-time seconds. By default a wrong password attempt is 10 points, # a KKDCP POST is 1 point, and a connection is 1 point. Note that -# due to difference processes being involved the count of points -# will not be real-time precise. -# -# Score banning cannot be reliably used when receiving proxied connections -# locally from an HTTP server (i.e., when listen-clear-file is used). +# due to different processes being involved the count of points +# will not be real-time precise. Local subnet IPs are exempt to allow +# services that check for process health. # # Set to zero to disable. max-ban-score = 80 @@ -381,7 +388,8 @@ rekey-method = ssl # Script to call when a client connects and obtains an IP. # The following parameters are passed on the environment. # REASON, VHOST, USERNAME, GROUPNAME, DEVICE, IP_REAL (the real IP of the client), -# IP_REAL_LOCAL (the local interface IP the client connected), IP_LOCAL +# REMOTE_HOSTNAME (the remotely advertised hostname), IP_REAL_LOCAL +# (the local interface IP the client connected), IP_LOCAL # (the local IP in the P-t-P connection), IP_REMOTE (the VPN IP of the client), # IPV6_LOCAL (the IPv6 local address if there are both IPv4 and IPv6 # assigned), IPV6_REMOTE (the IPv6 remote address), IPV6_PREFIX, and @@ -400,6 +408,12 @@ rekey-method = ssl #connect-script = /usr/bin/ocserv-script #disconnect-script = /usr/bin/ocserv-script +# This script is to be called when the client's advertised hostname becomes +# available. It will contain REASON with "host-update" value and the +# variable REMOTE_HOSTNAME in addition to the connect variables. + +#host-update-script = /usr/bin/myhostnamescript + # UTMP # Register the connected clients to utmp. This will allow viewing # the connected clients using the command 'who'. @@ -412,6 +426,20 @@ use-occtl = true # PID file. It can be overridden in the command line. pid-file = /var/run/ocserv.pid +# Log Level. Ocserv sends the logging messages to standard error +# as well as the system log. The log level can be overridden in the +# command line with the -d option. All messages at the configured +# level and lower will be displayed. +# Supported levels (default 0): +# 0 default (Same as basic) +# 1 basic +# 2 info +# 3 debug +# 4 http +# 8 sensitive +# 9 TLS +log-level = 1 + # Set the protocol-defined priority (SO_PRIORITY) for packets to # be sent. That is a number from 0 to 6 with 0 being the lowest # priority. Alternatively this can be used to set the IP Type- @@ -434,7 +462,8 @@ device = vpns # same for the same user when possible. predictable-ips = true -# The default domain to be advertised +# The default domain to be advertised. Multiple domains (functional on +# openconnect clients) can be provided in a space separated list. default-domain = example.com # The pool of addresses that leases will be given from. If the leases @@ -561,10 +590,10 @@ no-route = 192.168.5.0/255.255.255.0 # per group. Each file name on these directories must match the username # or the groupname. # The options allowed in the configuration files are dns, nbns, -# ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, no-route, -# explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, +# ipv?-network, ipv4-netmask, rx/tx-data-per-sec, iroute, route, no-route, +# explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, # keepalive, dpd, mobile-dpd, max-same-clients, tunnel-all-dns, -# restrict-user-to-routes, user-profile, cgroup, stats-report-time, +# restrict-user-to-routes, cgroup, stats-report-time, # mtu, idle-timeout, mobile-idle-timeout, restrict-user-to-ports, # split-dns and session-timeout. # @@ -628,10 +657,13 @@ no-route = 192.168.5.0/255.255.255.0 # # # Other fields may be used by some of the CISCO clients. -# This file must be accessible from inside the worker's chroot. -# Note that enabling this option is not recommended as it will allow -# the worker processes to open arbitrary files (when isolate-workers is -# set to true). +# This file must be accessible from inside the worker's chroot. +# Note that: +# (1) enabling this option is not recommended as it will allow the +# worker processes to open arbitrary files (when isolate-workers is +# set to true). +# (2) This option cannot be set per-user or per-group; only the global +# version is being sent to client. #user-profile = profile.xml # @@ -657,6 +689,35 @@ cisco-client-compat = true # by the dtls-psk protocol supported by openconnect 7.08+. dtls-legacy = true +# This option will enable the settings needed for Cisco SVC IPPhone clients +# to connect. It implies dtls-legacy = true and tls-priorities is changed to +# only the ciphers the device supports. +cisco-svc-client-compat = false + +# This option will enable the X-CSTP-Client-Bypass-Protocol (disabled by default). +# If the server has not configured an IPv6 or IPv4 address pool, enabling this option +# will instruct the client to bypass the server for that IP protocol. The option is +# currently only understood by Anyconnect clients. +client-bypass-protocol = false + +# The following options are related to server camouflage (hidden service) + +# This option allows you to enable the camouflage feature of ocserv that makes it look +# like a web server to unauthorized parties. +# With "camouflage" enabled, connection to the VPN can be established only if the client provided a specific +# "secret string" in the connection URL, e.g. "https://example.com/?mysecretkey", +# otherwise the server will return HTTP error for all requests. +camouflage = false + +# The URL prefix that should be set on the client (after '?' sign) to pass through the camouflage check, +# e.g. in case of 'mysecretkey', the server URL on the client should be like "https://example.com/?mysecretkey". +camouflage_secret = "mysecretkey" + +# Defines the realm (browser prompt) for HTTP authentication. +# If no realm is set, the server will return 404 Not found error instead of 401 Unauthorized. +# Better change it from the default value to avoid fingerprinting. +camouflage_realm = "Restricted Content" + #Advanced options # Option to allow sending arbitrary custom headers to the client after @@ -669,8 +730,8 @@ dtls-legacy = true -## An example virtual host with different authentication methods serviced -## by this server. +# An example virtual host with different authentication methods serviced +# by this server. #[vhost:www.example.com] #auth = "certificate" @@ -687,3 +748,18 @@ dtls-legacy = true #ipv4-netmask = 255.255.255.0 #cert-user-oid = 0.9.2342.19200300.100.1.1 + +# HTTP headers +included-http-headers = Strict-Transport-Security: max-age=31536000 ; includeSubDomains +included-http-headers = X-Frame-Options: deny +included-http-headers = X-Content-Type-Options: nosniff +included-http-headers = Content-Security-Policy: default-src 'none' +included-http-headers = X-Permitted-Cross-Domain-Policies: none +included-http-headers = Referrer-Policy: no-referrer +included-http-headers = Clear-Site-Data: "cache","cookies","storage" +included-http-headers = Cross-Origin-Embedder-Policy: require-corp +included-http-headers = Cross-Origin-Opener-Policy: same-origin +included-http-headers = Cross-Origin-Resource-Policy: same-origin +included-http-headers = X-XSS-Protection: 0 +included-http-headers = Pragma: no-cache +included-http-headers = Cache-control: no-store, no-cache diff --git a/ocserv.spec b/ocserv.spec index 8f2b22b..1a72762 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.1.7 +Version: 1.2.0 Release: %autorelease %global _hardened_build 1 @@ -38,8 +38,6 @@ Source8: ocserv-genkey Source9: ocserv-script Source10: gpgkey-56EE7FA9E8173B19FE86268D763712747F343FA7.gpg Source11: ocserv.init -# When removed remove the autoreconf step -Patch0: expired-certs.patch # Taken from upstream: # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 @@ -141,8 +139,6 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %endif %autosetup -p1 -# temporarily needed to apply patches -autoreconf -fvi rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) @@ -152,9 +148,6 @@ touch src/*.proto rm -rf src/ccan/talloc sed -i 's|/etc/ocserv.conf|/etc/ocserv/ocserv.conf|g' src/config.c sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config -# GPLv3 in headers is a gnulib bug: -# http://lists.gnu.org/archive/html/bug-gnulib/2013-11/msg00062.html -sed -i 's/either version 3 of the License/either version 2 of the License/g' build-aux/snippet/* %if 0%{?rhel} && 0%{?rhel} <= 6 echo "int main() { return 77; }" > tests/valid-hostname.c @@ -199,7 +192,8 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -make check %{?_smp_mflags} VERBOSE=1 +# The 1.2.0 release has a missing file +make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" %if %{use_systemd} %post @@ -254,7 +248,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/ocserv %config(noreplace) %{_localstatedir}/lib/ocserv/profile.xml -%doc AUTHORS ChangeLog NEWS COPYING COPYING README.md PACKAGE-LICENSING +%doc AUTHORS ChangeLog NEWS COPYING README.md PACKAGE-LICENSING doc/README-radius.md %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT %{_mandir}/man8/ocserv.8* diff --git a/sources b/sources index 30fa688..bd969b3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.1.7.tar.xz) = 5b6182b98c0406a27dae7121ec0d8771b158e0d8ce2056bd35451c8ed087a8b7f7d40035f9db5c19aa9a9a3b2c6b07be8f0bad4b6b96569584815a5358202ba4 -SHA512 (ocserv-1.1.7.tar.xz.sig) = 96d2562fdf918f2b6ea829d747330a3be2e015ab25897e01bd0d387cb69ef3592aacabbeec9612e95eca1fbce6178a176dbf76d553b7626c09d453d216ddd63d +SHA512 (ocserv-1.2.0.tar.xz) = 23edd48313cb4988cea1e2493ab65784c7a39a062798e1ffd380b6de5629e69bd71ded863eb7a0c9fe1bac3cc2db23014cdedbd5d15801e2a66d5ef4e3f28ffb +SHA512 (ocserv-1.2.0.tar.xz.sig) = 1d8ac24c97c6495adc070f7b24553715ff27e6a9937a020522904559f4c48f3e18ca712b80762d55c285ce8f99eb4cd9a84b2875a351eb1df1ef6c705c5d3199 From 0d6a1f1a428aaffbbaf37750b798246e483a8468 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 18 Jul 2023 20:43:09 +0200 Subject: [PATCH 50/75] Added packit integration --- .packit.yaml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .packit.yaml diff --git a/.packit.yaml b/.packit.yaml new file mode 100644 index 0000000..3902f72 --- /dev/null +++ b/.packit.yaml @@ -0,0 +1,25 @@ +upstream_project_url: https://gitlab.com/openconnect/ocserv +issue_repository: https://gitlab.com/openconnect/ocserv +copy_upstream_release_description: true + +jobs: +- job: pull_from_upstream + trigger: release + dist_git_branches: + - fedora-all + - epel-8 + - epel-9 + +- job: koji_build + trigger: commit + dist_git_branches: + - fedora-all + - epel-8 + - epel-9 + +- job: bodhi_update + trigger: commit + dist_git_branches: + - fedora-branched # rawhide updates are created automatically + - epel-8 + - epel-9 From ca1630fd18e366f0eefc4ae3ff1a385685bf054d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 17:39:51 +0000 Subject: [PATCH 51/75] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering From e9edd55d41cd6497e0ff6ae709ad99d6a4999446 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 15 Aug 2023 19:16:12 +0200 Subject: [PATCH 52/75] use %systemd_postun_with_restart Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 1a72762..a44cf9c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -203,7 +203,7 @@ make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" %systemd_preun ocserv.service %postun -%systemd_postun ocserv.service +%systemd_postun_with_restart ocserv.service %endif %install From 9433e7b6230e0767e1094ca25e974629e7d4906e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 22 Aug 2023 19:31:54 +0200 Subject: [PATCH 53/75] updated URIs of source --- ocserv.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index a44cf9c..f940294 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -27,8 +27,8 @@ Summary: OpenConnect SSL VPN server # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPLv2+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ -Source0: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz -Source1: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig +Source0: https://www.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz +Source1: https://www.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg Source3: ocserv.conf Source4: ocserv.service From 95752d9463d8fc6888b80dfd0753845f23dc8254 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 23 Aug 2023 09:21:15 +0200 Subject: [PATCH 54/75] corrected download link --- ocserv.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index f940294..63ec528 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -27,8 +27,8 @@ Summary: OpenConnect SSL VPN server # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPLv2+ and BSD and MIT and CC0 URL: http://www.infradead.org/ocserv/ -Source0: https://www.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz -Source1: https://www.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig +Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz +Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg Source3: ocserv.conf Source4: ocserv.service From ec00a93d97ea686a71a447d3258ff2635d8c5018 Mon Sep 17 00:00:00 2001 From: Packit Date: Wed, 23 Aug 2023 07:24:35 +0000 Subject: [PATCH 55/75] [packit] 1.2.1 upstream release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upstream tag: 1.2.1 Upstream commit: 895a23f3 If you need to do any change in this pull request, you need to locally fetch the source branch of it and push it (with a fix) to your fork (as it is not possible to push to the branch created in the Packit’s fork): ``` git fetch https://src.fedoraproject.org/forks/packit/rpms/ocserv.git refs/heads/*:refs/remotes/packit/* git checkout packit/1.2.1-rawhide-update-pull_from_upstream ``` --- .gitignore | 2 ++ README.packit | 3 +++ ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 8 insertions(+), 3 deletions(-) create mode 100644 README.packit diff --git a/.gitignore b/.gitignore index 2113177..1b89049 100644 --- a/.gitignore +++ b/.gitignore @@ -241,3 +241,5 @@ /ocserv-1.1.7.tar.xz.sig /ocserv-1.2.0.tar.xz /ocserv-1.2.0.tar.xz.sig +/ocserv-1.2.1.tar.xz +/ocserv-1.2.1.tar.xz.sig diff --git a/README.packit b/README.packit new file mode 100644 index 0000000..797aefb --- /dev/null +++ b/README.packit @@ -0,0 +1,3 @@ +This repository is maintained by packit. +https://packit.dev/ +The file was generated using packit 0.79.0.post2+g93f33d9. diff --git a/ocserv.spec b/ocserv.spec index 63ec528..67ea6c7 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.0 +Version: 1.2.1 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index bd969b3..b336b2f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.0.tar.xz) = 23edd48313cb4988cea1e2493ab65784c7a39a062798e1ffd380b6de5629e69bd71ded863eb7a0c9fe1bac3cc2db23014cdedbd5d15801e2a66d5ef4e3f28ffb -SHA512 (ocserv-1.2.0.tar.xz.sig) = 1d8ac24c97c6495adc070f7b24553715ff27e6a9937a020522904559f4c48f3e18ca712b80762d55c285ce8f99eb4cd9a84b2875a351eb1df1ef6c705c5d3199 +SHA512 (ocserv-1.2.1.tar.xz) = 13cc0dc33cced3c020a754414ce6f4f6c210875b75264528b2ba7b62c07416c30db1549f2efdad6f5f01b3156a23379243c7d761b3164db9741929ec8e001c93 +SHA512 (ocserv-1.2.1.tar.xz.sig) = de1a4ec354d48834901e98f165d9f25b5a3a19f7b81194b728dac19d93198a8ddd8b692cb266fe3a707523a8d936403f171c3f33ed8293ff20a5eda9d3abc912 From 9a1b8aec554f33bf5406302397d1daef27d47eee Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 23 Aug 2023 09:47:54 +0200 Subject: [PATCH 56/75] make check: no longer use xfail for missing file --- ocserv.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index 67ea6c7..6ca2228 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -192,8 +192,7 @@ mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts %check -# The 1.2.0 release has a missing file -make check %{?_smp_mflags} VERBOSE=1 XFAIL_TESTS="test-group-cert" +make check %{?_smp_mflags} VERBOSE=1 %if %{use_systemd} %post From acf2636e4a2c5de4f7b7671aed54f0a823ba696b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Tue, 29 Aug 2023 11:00:27 +0200 Subject: [PATCH 57/75] config: increased log level to 3 Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.conf b/ocserv.conf index 0ecd600..0e63981 100644 --- a/ocserv.conf +++ b/ocserv.conf @@ -438,7 +438,7 @@ pid-file = /var/run/ocserv.pid # 4 http # 8 sensitive # 9 TLS -log-level = 1 +log-level = 3 # Set the protocol-defined priority (SO_PRIORITY) for packets to # be sent. That is a number from 0 to 6 with 0 being the lowest From 79e827501fbc1867c97666fad825a65dad2380c6 Mon Sep 17 00:00:00 2001 From: Packit Date: Thu, 21 Sep 2023 19:44:09 +0000 Subject: [PATCH 58/75] [packit] 1.2.2 upstream release Upstream tag: 1.2.2 Upstream commit: f6164756 --- .gitignore | 2 ++ README.packit | 2 +- ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 1b89049..4fa485b 100644 --- a/.gitignore +++ b/.gitignore @@ -243,3 +243,5 @@ /ocserv-1.2.0.tar.xz.sig /ocserv-1.2.1.tar.xz /ocserv-1.2.1.tar.xz.sig +/ocserv-1.2.2.tar.xz +/ocserv-1.2.2.tar.xz.sig diff --git a/README.packit b/README.packit index 797aefb..ce6b9b9 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.79.0.post2+g93f33d9. +The file was generated using packit 0.80.0.post35+g9430d702. diff --git a/ocserv.spec b/ocserv.spec index 6ca2228..ff70f88 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.1 +Version: 1.2.2 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index b336b2f..58e8472 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.1.tar.xz) = 13cc0dc33cced3c020a754414ce6f4f6c210875b75264528b2ba7b62c07416c30db1549f2efdad6f5f01b3156a23379243c7d761b3164db9741929ec8e001c93 -SHA512 (ocserv-1.2.1.tar.xz.sig) = de1a4ec354d48834901e98f165d9f25b5a3a19f7b81194b728dac19d93198a8ddd8b692cb266fe3a707523a8d936403f171c3f33ed8293ff20a5eda9d3abc912 +SHA512 (ocserv-1.2.2.tar.xz) = f1a55d2d849aadadcae6ea792845531d4fe71a3d7defad353a961828ddea74faa85a7d6b8de64a5fce115b14ea00f87755f01833cf31550532b1c52a02bd1fb0 +SHA512 (ocserv-1.2.2.tar.xz.sig) = e3a159d76b5651c99487546681657cdb008d50d86647bf2df1034dc6936720d0db9566490958a9d79ad4a68b122b1d19021e0c849d72a0ab3277d777b9e1ddb7 From e6f6c537c313505f39d43ccd538412c131ab2525 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 21 Sep 2023 21:55:46 +0200 Subject: [PATCH 59/75] explicitly set package name in packit --- .packit.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.packit.yaml b/.packit.yaml index 3902f72..b3ac8a0 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -1,6 +1,7 @@ upstream_project_url: https://gitlab.com/openconnect/ocserv issue_repository: https://gitlab.com/openconnect/ocserv copy_upstream_release_description: true +downstream_package_name: ocserv jobs: - job: pull_from_upstream From 1ea8c5c3f424bbd80aff6b81b16d274b40982b0f Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 13 Oct 2023 22:00:20 +0200 Subject: [PATCH 60/75] Use the SPDX identifiers for license --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index ff70f88..044934f 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -25,7 +25,7 @@ Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. -License: GPLv2+ and BSD and MIT and CC0 +License: GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0 URL: http://www.infradead.org/ocserv/ Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig From 1a032ccb5d0d119571906266bdefb3b46892b55b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 10:38:32 +0000 Subject: [PATCH 61/75] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 72eba2e3ca135c9a18a8304438b860283f8b043a Mon Sep 17 00:00:00 2001 From: Packit Date: Wed, 24 Jan 2024 22:32:00 +0000 Subject: [PATCH 62/75] [packit] 1.2.4 upstream release Upstream tag: 1.2.4 Upstream commit: 7ced730f --- .gitignore | 2 ++ README.packit | 2 +- ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 4fa485b..7d9002b 100644 --- a/.gitignore +++ b/.gitignore @@ -245,3 +245,5 @@ /ocserv-1.2.1.tar.xz.sig /ocserv-1.2.2.tar.xz /ocserv-1.2.2.tar.xz.sig +/ocserv-1.2.4.tar.xz +/ocserv-1.2.4.tar.xz.sig diff --git a/README.packit b/README.packit index ce6b9b9..bba9424 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.80.0.post35+g9430d702. +The file was generated using packit 0.89.0.post1.dev4+gabf90471. diff --git a/ocserv.spec b/ocserv.spec index 044934f..d33856e 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.2 +Version: 1.2.4 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index 58e8472..b51fe99 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.2.tar.xz) = f1a55d2d849aadadcae6ea792845531d4fe71a3d7defad353a961828ddea74faa85a7d6b8de64a5fce115b14ea00f87755f01833cf31550532b1c52a02bd1fb0 -SHA512 (ocserv-1.2.2.tar.xz.sig) = e3a159d76b5651c99487546681657cdb008d50d86647bf2df1034dc6936720d0db9566490958a9d79ad4a68b122b1d19021e0c849d72a0ab3277d777b9e1ddb7 +SHA512 (ocserv-1.2.4.tar.xz) = 202c7045bea1b7a10bd711d9b1b23f5437da9ff71fde0577137c8059ea68956c8cc294f3d23f041bda7b0fb0ae292577a99101554a12206177f5a1f5ca16ea3b +SHA512 (ocserv-1.2.4.tar.xz.sig) = b2c287e0398eb55571a04e0b0ae16f2b5636c136f467b41872c9bdfd8bd8b25aa541022a6c8b337b0d160f4f673076d03358c7c0259ec4554d604cf31e7f36d3 From 589cf4fe6b41eae178018c38f4cefd32ba9a8849 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 25 Jan 2024 08:56:12 +0100 Subject: [PATCH 63/75] spec: added ipcalc and updated the location of ocserv-fw Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index d33856e..4b43e8c 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -49,30 +49,19 @@ BuildRequires: gnutls30-devel %else BuildRequires: gnutls-devel %endif -BuildRequires: pam-devel -BuildRequires: iproute -BuildRequires: openconnect -BuildRequires: gnutls-utils +BuildRequires: pam-devel, iproute, ipcalc, openconnect, gnutls-utils %if (0%{?use_local_protobuf} == 0) BuildRequires: protobuf-c-devel %endif -BuildRequires: libnl3-devel -BuildRequires: krb5-devel -BuildRequires: libtasn1-devel -BuildRequires: gperf -BuildRequires: libtalloc-devel -BuildRequires: libev-devel -BuildRequires: http-parser-devel +BuildRequires: libnl3-devel, krb5-devel, libtasn1-devel, gperf, libtalloc-devel +BuildRequires: libev-devel, http-parser-devel, radcli-devel, lz4-devel, readline-devel +BuildRequires: automake, autoconf %if %{use_libwrap} BuildRequires: tcp_wrappers-devel %endif -BuildRequires: automake, autoconf -BuildRequires: radcli-devel -BuildRequires: lz4-devel -BuildRequires: readline-devel %if %{use_geoip} BuildRequires: GeoIP-devel %else @@ -256,7 +245,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %{_bindir}/ocpasswd %{_bindir}/occtl -%{_bindir}/ocserv-fw +%{_libexecdir}/ocserv-fw %{_bindir}/ocserv-script %{_sbindir}/ocserv %{_sbindir}/ocserv-worker From 323c089d8200ba93de9fc73e7d305824ca302905 Mon Sep 17 00:00:00 2001 From: Packit Date: Sun, 5 May 2024 20:21:54 +0000 Subject: [PATCH 64/75] Update to 1.3.0 upstream release - Resolves: rhbz#2279186 Upstream tag: 1.3.0 Upstream commit: 92dba6e4 Commit authored by Packit automation (https://packit.dev/) --- .gitignore | 2 ++ README.packit | 2 +- ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7d9002b..0c67db0 100644 --- a/.gitignore +++ b/.gitignore @@ -247,3 +247,5 @@ /ocserv-1.2.2.tar.xz.sig /ocserv-1.2.4.tar.xz /ocserv-1.2.4.tar.xz.sig +/ocserv-1.3.0.tar.xz +/ocserv-1.3.0.tar.xz.sig diff --git a/README.packit b/README.packit index bba9424..066b312 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.89.0.post1.dev4+gabf90471. +The file was generated using packit 0.95.0.post1.dev8+gce6bd577. diff --git a/ocserv.spec b/ocserv.spec index 4b43e8c..bbb5b68 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.2.4 +Version: 1.3.0 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index b51fe99..4426293 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.2.4.tar.xz) = 202c7045bea1b7a10bd711d9b1b23f5437da9ff71fde0577137c8059ea68956c8cc294f3d23f041bda7b0fb0ae292577a99101554a12206177f5a1f5ca16ea3b -SHA512 (ocserv-1.2.4.tar.xz.sig) = b2c287e0398eb55571a04e0b0ae16f2b5636c136f467b41872c9bdfd8bd8b25aa541022a6c8b337b0d160f4f673076d03358c7c0259ec4554d604cf31e7f36d3 +SHA512 (ocserv-1.3.0.tar.xz) = 24c3129b389fa767ad14f158580d8abd6830e697162b8fcfe3df6a4d21d543460c1955c3e0c63fecb8b4b01bd2492254d3eea8d5ba60d864cea314325badda7e +SHA512 (ocserv-1.3.0.tar.xz.sig) = dd6a2e6f28a512bda19e758b32149cfe7951151edab8c34ac371dbcd17eed4a8b10fdfee306629c1d42c2a3e22bcfe523ee2aafb84d59181d5be719c399cfb7d From dd77e0d1691e0cab6c189409c9fd9b58f82ec26e Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 6 May 2024 08:21:15 +0200 Subject: [PATCH 65/75] add llhttp dependency Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index bbb5b68..656cfa0 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -56,7 +56,7 @@ BuildRequires: protobuf-c-devel %endif BuildRequires: libnl3-devel, krb5-devel, libtasn1-devel, gperf, libtalloc-devel -BuildRequires: libev-devel, http-parser-devel, radcli-devel, lz4-devel, readline-devel +BuildRequires: libev-devel, llhttp-devel, radcli-devel, lz4-devel, readline-devel BuildRequires: automake, autoconf %if %{use_libwrap} @@ -129,7 +129,6 @@ gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} || gpgv2 --keyring %{SOURCE10} %autosetup -p1 -rm -f src/http-parser/http_parser.c src/http-parser/http_parser.h %if (0%{?use_local_protobuf} == 0) rm -rf src/protobuf/protobuf-c/ touch src/*.proto From 324fe9b5f41a685fcb4860fc513783148f23a082 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 6 May 2024 08:26:18 +0200 Subject: [PATCH 66/75] Updated project URI --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 656cfa0..5a2221a 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -26,7 +26,7 @@ Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0 -URL: http://www.infradead.org/ocserv/ +URL: http://ocserv.openconnect-vpn.net/ Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg From 2a60a76b0b2649d9a8d4917d721a8ab0b9cf54a1 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 6 May 2024 08:34:49 +0200 Subject: [PATCH 67/75] URI: corrected Signed-off-by: Nikos Mavrogiannopoulos --- ocserv.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ocserv.spec b/ocserv.spec index 5a2221a..5663985 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -26,7 +26,7 @@ Summary: OpenConnect SSL VPN server # For a breakdown of the licensing, see PACKAGE-LICENSING # To simplify licenses LGPLv2+ files have been promoted to GPLv2+. License: GPL-2.0-or-later AND BSD-3-Clause AND MIT AND CC0-1.0 -URL: http://ocserv.openconnect-vpn.net/ +URL: https://ocserv.openconnect-vpn.net/ Source0: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz Source1: https://www.infradead.org/ocserv/download/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg From 5817038376fc5d7ce07bf8a918ea3c45eccc8ba0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 20:29:03 +0000 Subject: [PATCH 68/75] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 2f4d19486046c52c616d52694f80ee8b40392491 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 21:15:56 +0000 Subject: [PATCH 69/75] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From e45ab8cbe6d421eca94ca54de371845f3f1a8b8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:56:09 +0100 Subject: [PATCH 70/75] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- ocserv.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ocserv.spec b/ocserv.spec index 5663985..d7bf29d 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -43,6 +43,7 @@ Source11: ocserv.init # http://git.infradead.org/ocserv.git/commitdiff/7d70006a2dbddf783213f1856374bacc74217e09 BuildRequires: make +BuildRequires: libxcrypt-devel BuildRequires: gcc %if 0%{?rhel} && 0%{?rhel} <= 6 BuildRequires: gnutls30-devel From 470ea11ba7286796e5d558b289b81c6f2b328d53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 15:53:26 +0100 Subject: [PATCH 71/75] Add sysusers.d config file to allow rpm to create users/groups automatically See https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers. --- ocserv.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/ocserv.spec b/ocserv.spec index d7bf29d..30aacd9 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -101,7 +101,6 @@ BuildRequires: rubygem-ronn-ng Recommends: gnutls-utils Recommends: iproute Recommends: pam -Requires(pre): shadow-utils %if %{use_systemd} Requires(post): systemd Requires(preun): systemd @@ -142,6 +141,11 @@ sed -i 's/run-as-group = nogroup/run-as-group = nobody/g' tests/data/*.config echo "int main() { return 77; }" > tests/valid-hostname.c %endif +# Create a sysusers.d config file +cat >ocserv.sysusers.conf </dev/null || groupadd -r ocserv -getent passwd ocserv &>/dev/null || \ - /usr/sbin/useradd -r -g ocserv -s /sbin/nologin -c ocserv \ - -d %{_localstatedir}/lib/ocserv ocserv mkdir -p %{_sysconfdir}/pki/ocserv/public mkdir -p -m 700 %{_sysconfdir}/pki/ocserv/private mkdir -p %{_sysconfdir}/pki/ocserv/cacerts @@ -226,6 +226,8 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %make_install +install -m0644 -D ocserv.sysusers.conf %{buildroot}%{_sysusersdir}/ocserv.conf + %files %defattr(-,root,root,-) @@ -256,6 +258,7 @@ install -D -m 0755 %{SOURCE11} %{buildroot}/%{_initrddir}/%{name} %else %{_initrddir}/%{name} %endif +%{_sysusersdir}/ocserv.conf %changelog %autochangelog From ae84a30d03bd0bf3a2109e55de2066dd4482d34b Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Sun, 18 May 2025 07:09:54 -0400 Subject: [PATCH 72/75] Rebuilt for llhttp 9.3.0 From 32d376716d2d796be925b24c4c5498c921ee4298 Mon Sep 17 00:00:00 2001 From: indeo mail Date: Wed, 23 Jul 2025 11:13:11 +0000 Subject: [PATCH 73/75] Update ocserv-genkey OCServ genkey is a good tool in OCServ The default key type of certtool is rsa, but rsa may not be a good choice I tried to add a logic to the ocserv genkey. The key type can be determined according to the parameters. If there is no input parameter, it will be generated according to the default rsa, which does not conflict with the previous use logic. After installing OCSERV, I can directly run `ocserv-genkey ecdsa` to generate ecdsa based certificates. --- ocserv-genkey | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/ocserv-genkey b/ocserv-genkey index 924aab9..8cfc320 100755 --- a/ocserv-genkey +++ b/ocserv-genkey @@ -1,9 +1,25 @@ #!/bin/sh +#default key type:rsa +KEY_TYPE="rsa" + +#check key type 'rsa', 'rsa-pss', 'dsa', 'ecdsa', 'ed25519, 'ed448', 'x25519', and 'x448' +if [ $# -gt 0 ]; then + case "$1" in + rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448) + KEY_TYPE="$1" + ;; + *) + echo "Usage: $0 [rsa|rsa-pss|dsa|ecdsa|ed25519|ed448|x25519|x448]" + echo "Default key type: rsa" + exit 1 + ;; + esac +fi #generate CA certificate/key if test ! -f /etc/pki/ocserv/private/ca.key;then mkdir -p /etc/pki/ocserv/private -certtool --generate-privkey --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1 +certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/ca.key >/dev/null 2>&1 echo "cn=`hostname -f` CA" >/etc/pki/ocserv/ca.tmpl echo "expiration_days=-1" >>/etc/pki/ocserv/ca.tmpl echo "serial=1" >>/etc/pki/ocserv/ca.tmpl @@ -17,7 +33,7 @@ fi #generate server certificate/key if test ! -f /etc/pki/ocserv/private/server.key;then -certtool --generate-privkey --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1 +certtool --generate-privkey --key-type=$KEY_TYPE --outfile /etc/pki/ocserv/private/server.key >/dev/null 2>&1 echo "cn=`hostname -f`" >/etc/pki/ocserv/server.tmpl echo "serial=2" >>/etc/pki/ocserv/server.tmpl echo "expiration_days=-1" >>/etc/pki/ocserv/server.tmpl From f7c89057b3b761b7ecac30011e8bd9e0d4502abb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 23:23:30 +0000 Subject: [PATCH 74/75] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 26e4189551072a985626f903b3b66651905b4425 Mon Sep 17 00:00:00 2001 From: Packit Date: Sun, 4 Jan 2026 15:15:35 +0000 Subject: [PATCH 75/75] Update to 1.4.0 upstream release - Resolves: rhbz#2427015 Upstream tag: 1.4.0 Upstream commit: 5f5ac6fe Commit authored by Packit automation (https://packit.dev/) --- .gitignore | 2 ++ README.packit | 2 +- ocserv.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0c67db0..c97bec0 100644 --- a/.gitignore +++ b/.gitignore @@ -249,3 +249,5 @@ /ocserv-1.2.4.tar.xz.sig /ocserv-1.3.0.tar.xz /ocserv-1.3.0.tar.xz.sig +/ocserv-1.4.0.tar.xz +/ocserv-1.4.0.tar.xz.sig diff --git a/README.packit b/README.packit index 066b312..9bb65f0 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.95.0.post1.dev8+gce6bd577. +The file was generated using packit 1.13.0.post1.dev2+g84134016c. diff --git a/ocserv.spec b/ocserv.spec index 30aacd9..55f1520 100644 --- a/ocserv.spec +++ b/ocserv.spec @@ -1,4 +1,4 @@ -Version: 1.3.0 +Version: 1.4.0 Release: %autorelease %global _hardened_build 1 diff --git a/sources b/sources index 4426293..bc50de1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (ocserv-1.3.0.tar.xz) = 24c3129b389fa767ad14f158580d8abd6830e697162b8fcfe3df6a4d21d543460c1955c3e0c63fecb8b4b01bd2492254d3eea8d5ba60d864cea314325badda7e -SHA512 (ocserv-1.3.0.tar.xz.sig) = dd6a2e6f28a512bda19e758b32149cfe7951151edab8c34ac371dbcd17eed4a8b10fdfee306629c1d42c2a3e22bcfe523ee2aafb84d59181d5be719c399cfb7d +SHA512 (ocserv-1.4.0.tar.xz) = cef771c6ee43925d743b7a21fed1cd7d54c10e39c0966fbc7062df9b7691c9a3a73c1c4589382592668f81809edea0fe0b947c7ddf86a6cdc1a144cf059526b0 +SHA512 (ocserv-1.4.0.tar.xz.sig) = a73ce14e8e355f747e40241056c2bb734d6dae4e1d6aed0f24aaa6d1a469f6d86a077af4a38e6376846fd5520ee33c7be8ce7b3830bcb0faa5e32b12ed7483cd