mirror of
https://github.com/openwrt/packages.git
synced 2026-05-31 06:51:51 +08:00
Paul Donald
e8cdb4bde3
* Version 1.4.1 (released 2026-02-28) - [SECURITY] Fixed authentication bypass (medium severity) when using certificate authentication with cert-user-oid set to SAN(rfc822name): a client presenting a valid CA-signed certificate without the expected RFC822 SAN field could authenticate using password credentials alone, bypassing the intended certificate-to-username binding. Requires the attacker to possess both a valid CA-signed certificate and valid user credentials (694) - The bundled inih was updated to r62. - The bundled protobuf-c was updated to 1.5.2. - Fixed a bug where session timeout could be bypassed by reconnecting (e.g., closing/opening laptop lid) (599) - occtl: 'show user' command now includes a 'Session started at:' field, indicating when the VPN session was established - occtl: Fix column misalignment in ban command outputs - occtl: Fix 'show ip bans' may produce invalid JSON (683) - Handle dotted client hostnames (e.g., .local) by stripping the domain suffix - Renamed `min-reauth-time` configuration option to `ban-time` to better reflect its purpose (676). This option defines the duration (in seconds) for which an IP address is banned after exceeding the maximum allowed `max-ban-score`. Default is 300 seconds (5 minutes). - Fixed ocserv-worker process title - Fixed ignored udp-port in vhost (612) * Version 1.4.0 (released 2026-01-04) - The bundled llhtp was updated to 9.3.0. - The bundled protobuf-c was updated to 1.5.1. - Fixed issues with PAM authentication when combined with pam_sssd (618) - Enhanced the seccomp filters to address issue in testing (627) - Fixed "unexpected URL" errors for Cisco AnyConnect clients - Fixed the 'ping-leases' option, which was broken since version 1.1.1 - Fixed maximum MTU tracking in server statistics - Fixed 'iroute' option processing to handle multiple routes (625) - Fixed session accounting for roaming users (674) - occtl: fix invalid JSON output in `occtl -j show iroutes` (661) - occtl: fix regression with trailing commas in `occtl -j show sessions` (669) - occtl: fix missing column headers in 'show ip bans' output (677) - occtl: 'show ip bans' no longer shows expired bans (675) - Fixed DTLS not working with systemd socket activation (647) - Fixed a bug in the ban timer logic that could prevent IP addresses from being banned or cause premature unbans (678) - Session statistics are now reported at consistent intervals for RADIUS compatibility (630) - Single form to enter username and password (551) Signed-off-by: Paul Donald <newtwen+github@gmail.com>
120 lines
3.5 KiB
Makefile
120 lines
3.5 KiB
Makefile
#
|
|
# Copyright (C) 2007-2011 OpenWrt.org
|
|
#
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
# See /LICENSE for more information.
|
|
#
|
|
|
|
include $(TOPDIR)/rules.mk
|
|
|
|
PKG_NAME:=ocserv
|
|
PKG_VERSION:=1.4.1
|
|
PKG_RELEASE:=1
|
|
PKG_BUILD_FLAGS:=no-mips16
|
|
|
|
PKG_BUILD_DIR :=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
|
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
|
|
PKG_SOURCE_URL:=https://www.infradead.org/ocserv/download/
|
|
PKG_HASH:=54a0e036421ef81556d5a573f13e123166e8fa9679e9a0877f5ef0c472128553
|
|
|
|
PKG_LICENSE:=GPL-2.0-or-later
|
|
PKG_LICENSE_FILES:=COPYING
|
|
#PKG_FIXUP:=autoreconf
|
|
|
|
PKG_CONFIG_DEPENDS:= \
|
|
CONFIG_OCSERV_PAM \
|
|
CONFIG_OCSERV_SECCOMP \
|
|
CONFIG_OCSERV_PROTOBUF \
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
|
|
define Package/ocserv/config
|
|
source "$(SOURCE)/Config.in"
|
|
endef
|
|
|
|
define Package/ocserv
|
|
SECTION:=net
|
|
CATEGORY:=Network
|
|
SUBMENU:=VPN
|
|
TITLE:=OpenConnect VPN server
|
|
URL:=http://www.infradead.org/ocserv/
|
|
MAINTAINER:=Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
|
|
DEPENDS:= +USE_GLIBC:libcrypt-compat +OCSERV_RADIUS:libradcli +OCSERV_SECCOMP:libseccomp +libgnutls +certtool +libncurses +libreadline +OCSERV_PAM:libpam +OCSERV_PROTOBUF:libprotobuf-c +OCSERV_LIBOATH:liboath +libev +kmod-tun
|
|
USERID:=ocserv=72:ocserv=72
|
|
endef
|
|
|
|
define Package/ocserv/description
|
|
OpenConnect server (ocserv) is an SSL VPN server. Its purpose is to be
|
|
a secure, small, fast and configurable VPN server. It implements the
|
|
OpenConnect SSL VPN protocol, and has also (currently experimental)
|
|
compatibility with clients using the AnyConnect SSL VPN protocol. The
|
|
OpenConnect VPN protocol uses the standard IETF security protocols such
|
|
as TLS 1.2, and Datagram TLS to provide the secure VPN service.
|
|
endef
|
|
|
|
EXTRA_CPPFLAGS+=-I$(STAGING_DIR)/usr/include/readline/
|
|
EXTRA_LDFLAGS+=-lncurses
|
|
|
|
CONFIGURE_VARS += \
|
|
ac_cv_file__proc_self_exe=yes \
|
|
ac_cv_prog_IPCALC=/bin/true
|
|
|
|
CONFIGURE_ARGS+= \
|
|
--with-pager="" \
|
|
--with-libreadline-prefix="$(STAGING_DIR)/" \
|
|
--without-libnl \
|
|
--without-gssapi \
|
|
--without-maxmind \
|
|
--with-libcrypt-prefix="$(STAGING_DIR)/" \
|
|
--with-libev-prefix="$(STAGING_DIR)/" \
|
|
--without-lz4 \
|
|
--with-local-talloc \
|
|
|
|
ifneq ($(CONFIG_OCSERV_PAM),y)
|
|
CONFIGURE_ARGS += --without-pam
|
|
endif
|
|
|
|
ifneq ($(CONFIG_OCSERV_RADIUS),y)
|
|
CONFIGURE_ARGS += --without-radius
|
|
endif
|
|
|
|
ifneq ($(CONFIG_OCSERV_SECCOMP),y)
|
|
CONFIGURE_ARGS += --disable-seccomp
|
|
endif
|
|
|
|
ifneq ($(CONFIG_OCSERV_PROTOBUF),y)
|
|
CONFIGURE_ARGS += --without-protobuf
|
|
endif
|
|
|
|
ifndef CONFIG_OCSERV_LIBOATH
|
|
CONFIGURE_ARGS += --without-liboath
|
|
endif
|
|
|
|
ifeq ($(ARCH),arm)
|
|
TARGET_CFLAGS += -flax-vector-conversions
|
|
endif
|
|
|
|
define Package/ocserv/conffiles
|
|
/etc/config/ocserv
|
|
endef
|
|
|
|
define Package/ocserv/install
|
|
$(INSTALL_DIR) $(1)/usr/sbin
|
|
$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/ocserv $(1)/usr/sbin/
|
|
$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/ocserv-worker $(1)/usr/sbin/
|
|
$(INSTALL_DIR) $(1)/usr/bin
|
|
$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/ocserv-fw $(1)/usr/bin/
|
|
$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/ocpasswd/ocpasswd $(1)/usr/bin/
|
|
$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/occtl/occtl $(1)/usr/bin/
|
|
$(INSTALL_DIR) $(1)/etc/init.d
|
|
$(INSTALL_BIN) ./files/ocserv.init $(1)/etc/init.d/ocserv
|
|
$(INSTALL_DIR) $(1)/etc/ocserv
|
|
$(INSTALL_CONF) ./files/ocserv.conf.template $(1)/etc/ocserv/ocserv.conf.template
|
|
$(INSTALL_DIR) $(1)/etc/config
|
|
$(INSTALL_CONF) ./files/config $(1)/etc/config/ocserv
|
|
$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
|
|
$(INSTALL_DATA) ./files/ocserv.upgrade $(1)/lib/upgrade/keep.d/ocserv
|
|
endef
|
|
|
|
$(eval $(call BuildPackage,ocserv))
|