nmav pushed to ocserv (f22). "updated to 0.10.5 (..more)"

Mon May 25 08:30:09 UTC 2015

From d0a43cda35771108aa6340c8f3f660efb634711c Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav at redhat.com>
Date: Mon, 25 May 2015 10:18:24 +0200
Subject: updated to 0.10.5

Resolves: rhbz#1215326

diff --git a/.gitignore b/.gitignore
index d392fba..183bef7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,5 @@
 /ocserv-0.10.2.tar.xz
 /ocserv-0.10.4.tar.xz.sig
 /ocserv-0.10.4.tar.xz
+/ocserv-0.10.5.tar.xz.sig
+/ocserv-0.10.5.tar.xz
diff --git a/ocserv.conf b/ocserv.conf
index b0982e6..035d9ba 100644
--- a/ocserv.conf
+++ b/ocserv.conf
@@ -19,20 +19,20 @@
 # One entry must be listed per line, and 'ocpasswd' should be used
 # to generate password entries.
 #
-# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name]:
+# radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name,override-interim-updates=false]:
 #  The radius option requires specifying freeradius-client configuration
 # file. If the groupconfig option is set, then config-per-user will be overriden,
-# and all configuration will be read from radius. The supported atributes for
-# radius configuration are:
-# Group-Name, Framed-IPv6-Address, Framed-IPv6-Prefix, DNS-Server-IPv6-Address,
-# Framed-IP-Address, Framed-IP-Netmask, MS-Primary-DNS-Server, MS-Secondary-DNS-Server
+# and all configuration will be read from radius. The 'override-interim-updates' if set to
+# true will ignore Acct-Interim-Interval from the server and 'stats-report-time' will be considered.
 #
-# gssapi[keytab=/etc/key.tab,require-local-user-map=false]
+# gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]
 #  The gssapi option allows to use authentication methods supported by GSSAPI,
 # such as Kerberos tickets with ocserv. It should be best used as an alternative
 # to PAM (i.e., have pam in auth and gssapi in enable-auth), to allow users with
 # tickets and without tickets to login. The default value for require-local-user-map
-# is true.
+# is true. The 'tgt-freshness-time' if set, it would require the TGT tickets presented
+# to have been issued within the provided number of seconds. That option is used to
+# restrict logins even if the KDC provides long time TGT tickets.
 
 auth = "pam"
 #auth = "pam[gid-min=1000]"
@@ -45,7 +45,7 @@ auth = "pam"
 # will be sufficient to login.
 #enable-auth = certificate
 #enable-auth = gssapi
-#enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true]"
+#enable-auth = "gssapi[keytab=/etc/key.tab,require-local-user-map=true,tgt-freshness-time=900]"
 
 # Accounting methods available:
 # pam: can only be combined with PAM authentication method, it provides
@@ -245,6 +245,10 @@ auth-timeout = 40
 # before being disconnected. Unset to disable.
 #idle-timeout = 1200
 
+# The time (in seconds) that a client is allowed to stay connected
+# Unset to disable.
+#session-timeout = 86400
+
 # The time (in seconds) that a mobile client is allowed to stay idle (no
 # traffic) before being disconnected. Unset to disable.
 #mobile-idle-timeout = 2400
@@ -283,6 +287,11 @@ ban-reset-time = 300
 # between different networks.
 cookie-timeout = 300
 
+# If this is enabled (not recommended) the cookies will stay
+# valid even after a user manually disconnects, and until they
+# expire. This may improve roaming with some broken clients.
+#persistent-cookies = true
+
 # Whether roaming is allowed, i.e., if true a cookie is
 # restricted to a single IP address and cannot be re-used
 # from a different IP.
@@ -290,7 +299,8 @@ deny-roaming = false
 
 # ReKey time (in seconds)
 # ocserv will ask the client to refresh keys periodically once
-# this amount of seconds is elapsed. Set to zero to disable.
+# this amount of seconds is elapsed. Set to zero to disable (note
+# that, some clients fail if rekey is disabled).
 rekey-time = 172800
 
 # ReKey method
@@ -438,8 +448,9 @@ ping-leases = false
 # per group. Each file name on these directories must match the username
 # or the groupname.
 # The options allowed in the configuration files are dns, nbns,
-#  ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route,
-#  net-priority, deny-roaming, no-udp, user-profile, and cgroup.
+#  ipv?-network, ipv4-netmask, rx/tx-per-sec, iroute, route, no-route,
+#  explicit-ipv4, explicit-ipv6, net-priority, deny-roaming, no-udp, 
+#  user-profile, cgroup, stats-report-time, and session-timeout.
 #
 # Note that the 'iroute' option allows to add routes on the server
 # based on a user or group. The syntax depends on the input accepted
@@ -499,11 +510,6 @@ cisco-client-compat = true
 # This file must be accessible from inside the worker's chroot. 
 user-profile = profile.xml
 
-# Binary files that may be downloaded by the CISCO client. Must
-# be within any chroot environment. Normally you don't need
-# to use this option.
-#binary-files = /path/to/binaries
-
 #Advanced options
 
 # Option to allow sending arbitrary custom headers to the client after
diff --git a/ocserv.spec b/ocserv.spec
index d5a267d..56a3e82 100644
--- a/ocserv.spec
+++ b/ocserv.spec
@@ -1,7 +1,7 @@
 %global _hardened_build 1
 
 Name:		ocserv
-Version:	0.10.4
+Version:	0.10.5
 Release:	1%{?dist}
 Summary:	OpenConnect SSL VPN server
 
@@ -156,6 +156,9 @@ rm -rf %{buildroot}
 %{_localstatedir}/lib/ocserv/profile.xml
 
 %changelog
+* Mon May 25 2015 Nikos Mavrogiannopoulos <nmav at redhat.com> - 0.10.5-1
+- new upstream release (#1215326)
+
 * Mon Apr 27 2015 Nikos Mavrogiannopoulos <nmav at redhat.com> - 0.10.4-1
 - new upstream release
 
diff --git a/sources b/sources
index 60962f6..30c22ea 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-6605003c40a206698f90475f9aa2a548  ocserv-0.10.4.tar.xz.sig
-6df31778642320ea7b90f314c4c9a897  ocserv-0.10.4.tar.xz
+7396cedfa7071a4c6d5d243435ce663c  ocserv-0.10.5.tar.xz.sig
+17ee861f352d6ef7cd33114819b215ba  ocserv-0.10.5.tar.xz
-- 
cgit v0.10.2


	http://pkgs.fedoraproject.org/cgit/ocserv.git/commit/?h=f22&id=d0a43cda35771108aa6340c8f3f660efb634711c
