pool/ocserv
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1461f5bfdf
ocserv/ocserv.spec

160 lines
5.8 KiB
RPMSpec
Raw Normal View History

Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
#
# spec file for package ocserv
#
Accepting request 1059390 from home:mgerstner:branches:network:vpn - add ocserv-forwarding.sh: replace the sysctl drop-in file which was wrongly installed into /etc by a more tailored mechanism. Enabling IP routing globally and permanently, just because the package is installed is quite invasive. This new script will be invoked before and after the ocserv service to switch on and off forwarding, if necessary (bsc#1174722). OBS-URL: https://build.opensuse.org/request/show/1059390 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=45
2023-03-07 13:02:19 +01:00
# Copyright (c) 2023 SUSE LLC
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
Accepting request 758221 from home:dimstar:Factory - BuildRequire pkgconfig(libsystemd) instead of systemd-devel: Allow OBS to shortcut through the -mini flavors. OBS-URL: https://build.opensuse.org/request/show/758221 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=28
2020-01-21 14:52:29 +01:00
# Please submit bugfixes or comments via https://bugs.opensuse.org/
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
#
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
Name: ocserv
Accepting request 1174680 from home:m407:branches:network:vpn - Update to version 1.3.0 * Switch to https://github.com/nodejs/llhttp from http-parser. http-parser was a liability as an unmaintained project (#598) * Bump the number of groups per account from 128 to 512 (#219) * Allow connecting users to select an authgroup by appending the group name to the URL, as in https://vpn.example.com/groupname; this introduces the select-group-by-url config option (#597). * Informational messages due to configuration loading are not printed during worker initialization. - Update to version 1.2.4 * Get connection speed limits (traffic shaping) from RADIUS (#554) * Fix logging to stderr: add missing newline. * Fixed compatibility with AnyConnect clients on Linux (#544) * Detect the new AnyConnect-compatible identifier of OpenConnect clients * occtl: Print bit rates as kb/s. - Update to version 1.2.3 * Treat unknown clients as capable of IPv6 routes and DNS servers * Introduced new ocserv options --log-stderr and --syslog that redirect logging to stderr or syslog explicitly. The stderr option allows for better integration with logging on containers or under systemd. The default remains syslog. * Warn when more than 2 DNS server IPv6 addresses are sent by Radius. * Improved server shutdown (#563) * Modified Camouflage functionality to allow AnyConnect clients (#544) * ocserv-fw: Move under libexec. * ocserv-fw: Fixed clean_all_rules logic on multiple similar devices (!384) * occtl: added machine-readable raw_connected_at field for user stats OBS-URL: https://build.opensuse.org/request/show/1174680 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=53
2024-06-03 17:02:09 +02:00
Version: 1.3.0
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
Release: 0
Summary: OpenConnect VPN Server
Accepting request 606481 from home:stawidy:branches:network:vpn - Update to version 0.12.0 * Allow DTLS stream to come from different IP from TLS stream. There are situations where internet providers send the UDP stream from different IP. * Increased possibilities of allowed combinations of authentication methods. * Corrected regression since 0.11.8 with OTP authentication. * Added support for hostname-based virtual hosts, utilizing TLS SNI. With that change it is possible to configure multiple servers running over the same port. * Rename the tun device on BSD systems which support SIOCSIFNAME ioctl. * Correctly handle proxy-protocol’s health commands. That eliminates few connection drops when proxy protocol is in use. * Corrected crash on certain cases when proxy protocol is in use. - Update ocserv.config.patch due to upstream changes OBS-URL: https://build.opensuse.org/request/show/606481 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=18
2018-05-13 03:22:59 +02:00
License: GPL-2.0-only
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
Group: Productivity/Networking/Security
Accepting request 1113393 from home:mnhauke:network - Update to version 1.2.2 * Fix session and accounting data tracking of ocserv. This reverts fix for #444 (#541) * No longer account ICMP and IGMP data for idle session detection - Update URL OBS-URL: https://build.opensuse.org/request/show/1113393 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=49
2023-09-28 18:05:09 +02:00
URL: https://ocserv.gitlab.io/www/
#Git-Clone: https://gitlab.com/openconnect/ocserv.git
Accepting request 796111 from home:mnhauke:network - Add signature and keyring for source verification - Build with support for maxminddb - Build with support for OATH - Update to version 1.0.1 * Prevent clients that use broken versions of gnutls from connecting using DTLS. * occtl: added machine-readable fields in json output. * occtl: IPs in ban list value is now reflecting the actual banned IPs rather than the database size. - Update to version 1.0.0 * Avoid crash on invalid configuration values. * Updated manpage generation to work with newer versions of ronn. * Ensure scripts have all the information on all disconnection types. * Several updates to further restrict the control that worker processes have on the main process. * Add support for RFC6750 bearer tokens. This adds the "auth=oidc" config option. See doc/README-oidc.md for more information. * Add USER_AGENT, DEVICE_TYPE and DEVICE_PLATFORM environment variables when connect/disconnect scripts execute. * Corrected issue with DTLS-PSK negotiation which prevented it from being enabled. * Improved IPv6 handling of AnyConnect client for Apple ios. * Fixed issue with Radius accounting. - Update to version 0.12.6 * Improved IPv6 support for anyconnect clients. * The 'split-dns' configuration directive can be used per-user. * The max-same-clients=1 configuration option no longer refuses the reconnection of an already connected user. * Added openat() to the accepted list of seccomp calls. This OBS-URL: https://build.opensuse.org/request/show/796111 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=30
2020-07-03 13:12:30 +02:00
Source: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz
Accepting request 818634 from home:stawidy - Update to version 1.1.0: * Switch from fork to fork/exec model to achieve better scaling and ASLR protection. This introduces an ocserv-worker application which should be installed at the same path as ocserv (#285). * When Linux OOM takes control kill ocserv workers before ocserv-main or ocserv-secmod (#283). * Disable TCP queuing on the TLS port. * Fix leak of GnuTLS session when DTLS connection is re-established (#293). - Verify source with keyring before build. OBS-URL: https://build.opensuse.org/request/show/818634 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=31
2020-07-03 20:01:09 +02:00
Source1: ftp://ftp.infradead.org/pub/ocserv/%{name}-%{version}.tar.xz.sig
Source2: ca.tmpl
Source3: server.tmpl
Source4: user.tmpl
Accepting request 1059390 from home:mgerstner:branches:network:vpn - add ocserv-forwarding.sh: replace the sysctl drop-in file which was wrongly installed into /etc by a more tailored mechanism. Enabling IP routing globally and permanently, just because the package is installed is quite invasive. This new script will be invoked before and after the ocserv service to switch on and off forwarding, if necessary (bsc#1174722). OBS-URL: https://build.opensuse.org/request/show/1059390 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=45
2023-03-07 13:02:19 +01:00
Source5: ocserv-forwarding.sh
Accepting request 580402 from home:MargueriteSu:branches:network:vpn - add firewalld service OBS-URL: https://build.opensuse.org/request/show/580402 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=15
2018-02-27 04:21:12 +01:00
Source6: ocserv.firewalld.xml
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
Source99: README.SUSE
Accepting request 818634 from home:stawidy - Update to version 1.1.0: * Switch from fork to fork/exec model to achieve better scaling and ASLR protection. This introduces an ocserv-worker application which should be installed at the same path as ocserv (#285). * When Linux OOM takes control kill ocserv workers before ocserv-main or ocserv-secmod (#283). * Disable TCP queuing on the TLS port. * Fix leak of GnuTLS session when DTLS connection is re-established (#293). - Verify source with keyring before build. OBS-URL: https://build.opensuse.org/request/show/818634 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=31
2020-07-03 20:01:09 +02:00
Source100: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
#PATCH-FIX-UPSTREAM marguerite@opensuse.org $LIBSYSTEMD_DAEMON env is not set on openSUSE
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
Patch1: %{name}-enable-systemd.patch
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
#PATCH-FIX-UPSTREAM marguerite@opensuse.org tweak configuration
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
Patch2: %{name}.config.patch
Accepting request 580000 from home:MargueriteSu:branches:network:vpn - update version 0.11.10 * see NEWS - drop boo1021353-ocserv-doc-racing-in-parallel-build.patch * upstreamed - add ocserv-LZ4_compress_default.patch * leap doesn't have LZ4_compress_default OBS-URL: https://build.opensuse.org/request/show/580000 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=13
2018-02-26 03:10:00 +01:00
#PATCH-FIX-OPENSUSE marguerite@opensuse.org leap doesn't have LZ4_compress_default
Patch3: %{name}-LZ4_compress_default.patch
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
BuildRequires: autogen
BuildRequires: dbus-1-devel
Accepting request 580402 from home:MargueriteSu:branches:network:vpn - add firewalld service OBS-URL: https://build.opensuse.org/request/show/580402 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=15
2018-02-27 04:21:12 +01:00
BuildRequires: firewall-macros
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
BuildRequires: freeradius-client-devel
BuildRequires: gperf
Accepting request 818634 from home:stawidy - Update to version 1.1.0: * Switch from fork to fork/exec model to achieve better scaling and ASLR protection. This introduces an ocserv-worker application which should be installed at the same path as ocserv (#285). * When Linux OOM takes control kill ocserv workers before ocserv-main or ocserv-secmod (#283). * Disable TCP queuing on the TLS port. * Fix leak of GnuTLS session when DTLS connection is re-established (#293). - Verify source with keyring before build. OBS-URL: https://build.opensuse.org/request/show/818634 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=31
2020-07-03 20:01:09 +02:00
BuildRequires: gpg2
Accepting request 1174680 from home:m407:branches:network:vpn - Update to version 1.3.0 * Switch to https://github.com/nodejs/llhttp from http-parser. http-parser was a liability as an unmaintained project (#598) * Bump the number of groups per account from 128 to 512 (#219) * Allow connecting users to select an authgroup by appending the group name to the URL, as in https://vpn.example.com/groupname; this introduces the select-group-by-url config option (#597). * Informational messages due to configuration loading are not printed during worker initialization. - Update to version 1.2.4 * Get connection speed limits (traffic shaping) from RADIUS (#554) * Fix logging to stderr: add missing newline. * Fixed compatibility with AnyConnect clients on Linux (#544) * Detect the new AnyConnect-compatible identifier of OpenConnect clients * occtl: Print bit rates as kb/s. - Update to version 1.2.3 * Treat unknown clients as capable of IPv6 routes and DNS servers * Introduced new ocserv options --log-stderr and --syslog that redirect logging to stderr or syslog explicitly. The stderr option allows for better integration with logging on containers or under systemd. The default remains syslog. * Warn when more than 2 DNS server IPv6 addresses are sent by Radius. * Improved server shutdown (#563) * Modified Camouflage functionality to allow AnyConnect clients (#544) * ocserv-fw: Move under libexec. * ocserv-fw: Fixed clean_all_rules logic on multiple similar devices (!384) * occtl: added machine-readable raw_connected_at field for user stats OBS-URL: https://build.opensuse.org/request/show/1174680 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=53
2024-06-03 17:02:09 +02:00
BuildRequires: ipcalc
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
BuildRequires: libev-devel
Accepting request 983859 from home:dimstar:Factory - explicitly buildignore libevent-devel, which is pulled in by ubound. We use libev here and can get away with this. OBS-URL: https://build.opensuse.org/request/show/983859 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=41
2022-07-06 10:56:39 +02:00
#!BuildIgnore: libevent-devel
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
BuildRequires: libgnutls-devel >= 3.1.10
Accepting request 1113393 from home:mnhauke:network - Update to version 1.2.2 * Fix session and accounting data tracking of ocserv. This reverts fix for #444 (#541) * No longer account ICMP and IGMP data for idle session detection - Update URL OBS-URL: https://build.opensuse.org/request/show/1113393 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=49
2023-09-28 18:05:09 +02:00
BuildRequires: liblz4-devel
Accepting request 796111 from home:mnhauke:network - Add signature and keyring for source verification - Build with support for maxminddb - Build with support for OATH - Update to version 1.0.1 * Prevent clients that use broken versions of gnutls from connecting using DTLS. * occtl: added machine-readable fields in json output. * occtl: IPs in ban list value is now reflecting the actual banned IPs rather than the database size. - Update to version 1.0.0 * Avoid crash on invalid configuration values. * Updated manpage generation to work with newer versions of ronn. * Ensure scripts have all the information on all disconnection types. * Several updates to further restrict the control that worker processes have on the main process. * Add support for RFC6750 bearer tokens. This adds the "auth=oidc" config option. See doc/README-oidc.md for more information. * Add USER_AGENT, DEVICE_TYPE and DEVICE_PLATFORM environment variables when connect/disconnect scripts execute. * Corrected issue with DTLS-PSK negotiation which prevented it from being enabled. * Improved IPv6 handling of AnyConnect client for Apple ios. * Fixed issue with Radius accounting. - Update to version 0.12.6 * Improved IPv6 support for anyconnect clients. * The 'split-dns' configuration directive can be used per-user. * The max-same-clients=1 configuration option no longer refuses the reconnection of an already connected user. * Added openat() to the accepted list of seccomp calls. This OBS-URL: https://build.opensuse.org/request/show/796111 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=30
2020-07-03 13:12:30 +02:00
BuildRequires: libmaxminddb-devel
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
BuildRequires: libnl3-devel
BuildRequires: libprotobuf-c-devel
BuildRequires: libseccomp-devel
BuildRequires: libtalloc-devel
BuildRequires: libtool
BuildRequires: pam-devel
BuildRequires: pkgconfig
BuildRequires: protobuf-c
Accepting request 495452 from home:dimstar:Factory Fix build in openSUSE:Factory by doing the right thing OBS-URL: https://build.opensuse.org/request/show/495452 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=11
2017-05-29 14:02:01 +02:00
BuildRequires: readline-devel
Accepting request 796111 from home:mnhauke:network - Add signature and keyring for source verification - Build with support for maxminddb - Build with support for OATH - Update to version 1.0.1 * Prevent clients that use broken versions of gnutls from connecting using DTLS. * occtl: added machine-readable fields in json output. * occtl: IPs in ban list value is now reflecting the actual banned IPs rather than the database size. - Update to version 1.0.0 * Avoid crash on invalid configuration values. * Updated manpage generation to work with newer versions of ronn. * Ensure scripts have all the information on all disconnection types. * Several updates to further restrict the control that worker processes have on the main process. * Add support for RFC6750 bearer tokens. This adds the "auth=oidc" config option. See doc/README-oidc.md for more information. * Add USER_AGENT, DEVICE_TYPE and DEVICE_PLATFORM environment variables when connect/disconnect scripts execute. * Corrected issue with DTLS-PSK negotiation which prevented it from being enabled. * Improved IPv6 handling of AnyConnect client for Apple ios. * Fixed issue with Radius accounting. - Update to version 0.12.6 * Improved IPv6 support for anyconnect clients. * The 'split-dns' configuration directive can be used per-user. * The max-same-clients=1 configuration option no longer refuses the reconnection of an already connected user. * Added openat() to the accepted list of seccomp calls. This OBS-URL: https://build.opensuse.org/request/show/796111 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=30
2020-07-03 13:12:30 +02:00
BuildRequires: pkgconfig(liboath)
Accepting request 758221 from home:dimstar:Factory - BuildRequire pkgconfig(libsystemd) instead of systemd-devel: Allow OBS to shortcut through the -mini flavors. OBS-URL: https://build.opensuse.org/request/show/758221 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=28
2020-01-21 14:52:29 +01:00
BuildRequires: pkgconfig(libsystemd)
Accepting request 668674 from home:stawidy:branches:network:vpn - Update to version 0.12.2: * Added support for AES256-SHA legacy cipher. This allows the anyconnect clients to use AES256. * Added support for the DTLS1.2 protocol hack used by new Anyconnect clients. OBS-URL: https://build.opensuse.org/request/show/668674 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=22
2019-01-25 17:12:44 +01:00
BuildRequires: rubygem(ronn)
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
# /usr/bin/certtool for generating certificates
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
Requires: gnutls >= 3.1.10
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%{?systemd_requires}
%description
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
OpenConnect server (ocserv) is an SSL VPN server. Its purpose is to
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
be a secure, small, fast and configurable VPN server. It implements
the OpenConnect SSL VPN protocol, and has also (currently experimental)
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
compatibility with clients using the AnyConnect SSL VPN protocol.
The OpenConnect protocol provides a dual TCP/UDP VPN channel, and
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
uses the standard IETF security protocols to secure it. The server
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
is implemented primarily for the GNU/Linux platform but its code
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
is designed to be portable to other UNIX variants as well.
Ocserv's main features are security through privilege separation
and sandboxing, accounting, and resilience due to a combined use
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
of TCP and UDP. Authentication occurs in an isolated security
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
module process, and each user is assigned an unprivileged worker
process, and a networking (tun) device. That not only eases the
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
control of the resources of each user or group of users, but also
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
prevents data leak (e.g., heartbleed-style attacks), and privilege
escalation due to any bug on the VPN handling (worker) process.
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
A management interface allows for viewing and querying logged-in users.
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%prep
Accepting request 1151388 from home:dimstar:rpm4.20:o Prepare for RPM 4.20 OBS-URL: https://build.opensuse.org/request/show/1151388 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=51
2024-03-01 21:30:19 +01:00
%autosetup -p1
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%build
Accepting request 1151388 from home:dimstar:rpm4.20:o Prepare for RPM 4.20 OBS-URL: https://build.opensuse.org/request/show/1151388 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=51
2024-03-01 21:30:19 +01:00
autoreconf -fiv
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%configure --enable-systemd \
--enable-seccomp \
--disable-rpath \
--enable-local-libopts \
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
--enable-libopts-install
Accepting request 361424 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/361424 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=5
2016-02-25 15:38:11 +01:00
make V=1 %{?_smp_mflags}
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%install
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
make %{?_smp_mflags} DESTDIR=%{buildroot} install
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
Accepting request 1059390 from home:mgerstner:branches:network:vpn - add ocserv-forwarding.sh: replace the sysctl drop-in file which was wrongly installed into /etc by a more tailored mechanism. Enabling IP routing globally and permanently, just because the package is installed is quite invasive. This new script will be invoked before and after the ocserv service to switch on and off forwarding, if necessary (bsc#1174722). OBS-URL: https://build.opensuse.org/request/show/1059390 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=45
2023-03-07 13:02:19 +01:00
install -Dm 0755 %{SOURCE5} %{buildroot}%{_sbindir}/ocserv-forwarding
Accepting request 827856 from home:gmbr3:libexecdir - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) OBS-URL: https://build.opensuse.org/request/show/827856 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=35
2020-08-27 13:41:14 +02:00
install -D -m 644 %{SOURCE6} %{buildroot}%{_prefix}/lib/firewalld/services/ocserv.xml
Accepting request 361424 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/361424 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=5
2016-02-25 15:38:11 +01:00
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
install -d %{buildroot}%{_sysconfdir}/ocserv/certificates
install -m 0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/ocserv/certificates
install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/ocserv/certificates
Accepting request 818634 from home:stawidy - Update to version 1.1.0: * Switch from fork to fork/exec model to achieve better scaling and ASLR protection. This introduces an ocserv-worker application which should be installed at the same path as ocserv (#285). * When Linux OOM takes control kill ocserv workers before ocserv-main or ocserv-secmod (#283). * Disable TCP queuing on the TLS port. * Fix leak of GnuTLS session when DTLS connection is re-established (#293). - Verify source with keyring before build. OBS-URL: https://build.opensuse.org/request/show/818634 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=31
2020-07-03 20:01:09 +02:00
install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/ocserv/certificates
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
install -m 0644 %{SOURCE99} %{buildroot}%{_sysconfdir}/ocserv/
install -m 0644 doc/sample.config %{buildroot}%{_sysconfdir}/ocserv/ocserv.conf
install -m 0644 doc/sample.passwd %{buildroot}%{_sysconfdir}/ocserv/ocpasswd
install -m 0755 doc/scripts/ocserv-script %{buildroot}%{_bindir}
install -d %{buildroot}%{_unitdir}
# if --with-dubs, here should be "standalone"
install -m 0644 doc/systemd/socket-activated/ocserv.socket %{buildroot}%{_unitdir}
install -m 0644 doc/systemd/socket-activated/ocserv.service %{buildroot}%{_unitdir}
Accepting request 1059390 from home:mgerstner:branches:network:vpn - add ocserv-forwarding.sh: replace the sysctl drop-in file which was wrongly installed into /etc by a more tailored mechanism. Enabling IP routing globally and permanently, just because the package is installed is quite invasive. This new script will be invoked before and after the ocserv service to switch on and off forwarding, if necessary (bsc#1174722). OBS-URL: https://build.opensuse.org/request/show/1059390 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=45
2023-03-07 13:02:19 +01:00
sed -i '/^\[Service\].*/a ExecStopPost=%{_sbindir}/ocserv-forwarding --disable' %{buildroot}%{_unitdir}/ocserv.service
sed -i '/^\[Service\].*/a ExecStartPre=%{_sbindir}/ocserv-forwarding --enable' %{buildroot}%{_unitdir}/ocserv.service
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%pre
%service_add_pre ocserv.service ocserv.socket
%post
%service_add_post ocserv.service ocserv.socket
Accepting request 580402 from home:MargueriteSu:branches:network:vpn - add firewalld service OBS-URL: https://build.opensuse.org/request/show/580402 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=15
2018-02-27 04:21:12 +01:00
%firewalld_reload
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%preun
%service_del_preun ocserv.service ocserv.socket
%postun
%service_del_postun ocserv.service ocserv.socket
%files
%defattr(-,root,root)
Accepting request 853618 from home:mnhauke:network - Update to version 1.1.2 * Allow setup of new DTLS session concurrent with old session. * Fixed an infinite loop on sec-mod crash when server-drain-ms is set. * Don't apply BanIP checks to clients on the same subnet. * Don't attempt TLS if the client closes the connection with zero data sent. * Increased the maximum configuration line; this allows banner messages longer than 200 characters. * Removed the listen-clear-file config option. This option was incompatible with several clients, and thus is unusable for a generic server. - Update to version 1.1.1: * Improved rate-limit-ms and made it dependent on secmod backlog. This makes the server more resilient (and prevents connection failures) on multiple concurrent connections - Added namespace support for listen address by introducing the listen-netns option. - Disable TLS1.3 when cisco client compatibility is enabled. New anyconnect clients seem to supporting TLS1.3 but are unable to handle a client with an RSA key. - Enable a race free user disconnection via occtl. - Added the config option of a pre-login-banner. - Ocserv siwtched to using multiple ocserv-sm processes to improve scale, with the number of ocserv-sm process dependent on maximum clients and number of CPUs. Configuration option sec-mod-scale can be used to override the heuristics. - Fixed issue with group selection on radius servers sending multiple group class attribute. OBS-URL: https://build.opensuse.org/request/show/853618 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=37
2021-01-02 22:13:41 +01:00
%doc AUTHORS NEWS README.md
Accepting request 1107938 from home:mnhauke:network - Update to version 1.2.1 * Accept the Clavister OneConnect VPN Android client. * No longer require to set device name per vhost. * Account the correct number of points when proxyproto is in use * nuttcp tests were replaced with iperf3 that is available in more environments * occtl: fix duplicate key in `occtl --json show users` output - Update to version 1.2.0 * Add support for Cisco Enterprise phones to authenticate via the /svc endpoint and the 'cisco-svc-client-compat' config option. * Enhanced radius group support to enable radius servers send multiple group class attributes See doc/README-radius.md for more information. * Enhanced the seccomp filters to open files related to FIPS compliance on SuSe. * Added "Camouflage" functionality that makes ocserv look like a web server to unauthorized parties. * Avoid login failure when the end point of server URI contains a query string. * Make sure we print proper JSON with `occtl --debug --json` * Eliminated the need for using the gnulib portability library. - Update to version 1.1.7 * Emit a LOG_ERR error message with plain authentication fails * The bundled inih was updated to r56. * The bundled protobuf-c was updated to 1.4.1. * Enhanced the seccomp filters for ARMv7 compatibility and musl libc * HTTP headers always capitalised as in RFC 9110 OBS-URL: https://build.opensuse.org/request/show/1107938 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=47
2023-09-02 13:14:37 +02:00
%license COPYING
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%config %{_sysconfdir}/ocserv
Accepting request 827856 from home:gmbr3:libexecdir - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) OBS-URL: https://build.opensuse.org/request/show/827856 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=35
2020-08-27 13:41:14 +02:00
%dir %{_prefix}/lib/firewalld
%dir %{_prefix}/lib/firewalld/services
%{_prefix}/lib/firewalld/services/ocserv.xml
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%{_bindir}/occtl
%{_bindir}/ocpasswd
%{_bindir}/ocserv-script
Accepting request 1174680 from home:m407:branches:network:vpn - Update to version 1.3.0 * Switch to https://github.com/nodejs/llhttp from http-parser. http-parser was a liability as an unmaintained project (#598) * Bump the number of groups per account from 128 to 512 (#219) * Allow connecting users to select an authgroup by appending the group name to the URL, as in https://vpn.example.com/groupname; this introduces the select-group-by-url config option (#597). * Informational messages due to configuration loading are not printed during worker initialization. - Update to version 1.2.4 * Get connection speed limits (traffic shaping) from RADIUS (#554) * Fix logging to stderr: add missing newline. * Fixed compatibility with AnyConnect clients on Linux (#544) * Detect the new AnyConnect-compatible identifier of OpenConnect clients * occtl: Print bit rates as kb/s. - Update to version 1.2.3 * Treat unknown clients as capable of IPv6 routes and DNS servers * Introduced new ocserv options --log-stderr and --syslog that redirect logging to stderr or syslog explicitly. The stderr option allows for better integration with logging on containers or under systemd. The default remains syslog. * Warn when more than 2 DNS server IPv6 addresses are sent by Radius. * Improved server shutdown (#563) * Modified Camouflage functionality to allow AnyConnect clients (#544) * ocserv-fw: Move under libexec. * ocserv-fw: Fixed clean_all_rules logic on multiple similar devices (!384) * occtl: added machine-readable raw_connected_at field for user stats OBS-URL: https://build.opensuse.org/request/show/1174680 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=53
2024-06-03 17:02:09 +02:00
%{_libexecdir}/ocserv-fw
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%{_sbindir}/ocserv
Accepting request 1059390 from home:mgerstner:branches:network:vpn - add ocserv-forwarding.sh: replace the sysctl drop-in file which was wrongly installed into /etc by a more tailored mechanism. Enabling IP routing globally and permanently, just because the package is installed is quite invasive. This new script will be invoked before and after the ocserv service to switch on and off forwarding, if necessary (bsc#1174722). OBS-URL: https://build.opensuse.org/request/show/1059390 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=45
2023-03-07 13:02:19 +01:00
%{_sbindir}/ocserv-forwarding
Accepting request 818634 from home:stawidy - Update to version 1.1.0: * Switch from fork to fork/exec model to achieve better scaling and ASLR protection. This introduces an ocserv-worker application which should be installed at the same path as ocserv (#285). * When Linux OOM takes control kill ocserv workers before ocserv-main or ocserv-secmod (#283). * Disable TCP queuing on the TLS port. * Fix leak of GnuTLS session when DTLS connection is re-established (#293). - Verify source with keyring before build. OBS-URL: https://build.opensuse.org/request/show/818634 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=31
2020-07-03 20:01:09 +02:00
%{_sbindir}/ocserv-worker
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
%{_unitdir}/ocserv.service
%{_unitdir}/ocserv.socket
Accepting request 447315 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/447315 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=7
2016-12-21 16:24:26 +01:00
%{_mandir}/man8/occtl.8%{ext_man}
%{_mandir}/man8/ocpasswd.8%{ext_man}
%{_mandir}/man8/ocserv.8%{ext_man}
Accepting request 285939 from home:MargueriteSu OBS-URL: https://build.opensuse.org/request/show/285939 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=1
2015-02-26 21:07:11 +01:00
Accepting request 361424 from home:MargueriteSu:branches:network:vpn OBS-URL: https://build.opensuse.org/request/show/361424 OBS-URL: https://build.opensuse.org/package/show/network:vpn/ocserv?expand=0&rev=5
2016-02-25 15:38:11 +01:00
%changelog
Reference in New Issue Copy Permalink