ocserv: bump to v1.4.1#29207
Open
systemcrash wants to merge 1 commit intoopenwrt:masterfrom
Open
Conversation
* Version 1.4.1 (released 2026-02-28) - [SECURITY] Fixed authentication bypass (medium severity) when using certificate authentication with cert-user-oid set to SAN(rfc822name): a client presenting a valid CA-signed certificate without the expected RFC822 SAN field could authenticate using password credentials alone, bypassing the intended certificate-to-username binding. Requires the attacker to possess both a valid CA-signed certificate and valid user credentials (694) - The bundled inih was updated to r62. - The bundled protobuf-c was updated to 1.5.2. - Fixed a bug where session timeout could be bypassed by reconnecting (e.g., closing/opening laptop lid) (599) - occtl: 'show user' command now includes a 'Session started at:' field, indicating when the VPN session was established - occtl: Fix column misalignment in ban command outputs - occtl: Fix 'show ip bans' may produce invalid JSON (683) - Handle dotted client hostnames (e.g., .local) by stripping the domain suffix - Renamed `min-reauth-time` configuration option to `ban-time` to better reflect its purpose (676). This option defines the duration (in seconds) for which an IP address is banned after exceeding the maximum allowed `max-ban-score`. Default is 300 seconds (5 minutes). - Fixed ocserv-worker process title - Fixed ignored udp-port in vhost (612) * Version 1.4.0 (released 2026-01-04) - The bundled llhtp was updated to 9.3.0. - The bundled protobuf-c was updated to 1.5.1. - Fixed issues with PAM authentication when combined with pam_sssd (618) - Enhanced the seccomp filters to address issue in testing (627) - Fixed "unexpected URL" errors for Cisco AnyConnect clients - Fixed the 'ping-leases' option, which was broken since version 1.1.1 - Fixed maximum MTU tracking in server statistics - Fixed 'iroute' option processing to handle multiple routes (625) - Fixed session accounting for roaming users (674) - occtl: fix invalid JSON output in `occtl -j show iroutes` (661) - occtl: fix regression with trailing commas in `occtl -j show sessions` (669) - occtl: fix missing column headers in 'show ip bans' output (677) - occtl: 'show ip bans' no longer shows expired bans (675) - Fixed DTLS not working with systemd socket activation (647) - Fixed a bug in the ban timer logic that could prevent IP addresses from being banned or cause premature unbans (678) - Session statistics are now reported at consistent intervals for RADIUS compatibility (630) - Single form to enter username and password (551) Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Contributor
|
LGTM, though it would make sense to move to 1.4.2 directly. |
nmav
approved these changes
Apr 21, 2026
Contributor
Author
Not an easy transition to meson in my dev env. Still a few kinks to work out. |
Contributor
Author
|
I'm not sure what's up with neon here tho: Those 8x16 vs 16x8 things seem a problem of llhttp. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
certificate authentication with cert-user-oid set to SAN(rfc822name):
a client presenting a valid CA-signed certificate without the expected
RFC822 SAN field could authenticate using password credentials alone,
bypassing the intended certificate-to-username binding. Requires the
attacker to possess both a valid CA-signed certificate and valid user
credentials (694)
(e.g., closing/opening laptop lid) (599)
indicating when the VPN session was established
min-reauth-timeconfiguration option toban-timeto better reflectits purpose (676). This option defines the duration (in seconds) for which
an IP address is banned after exceeding the maximum allowed
max-ban-score.Default is 300 seconds (5 minutes).
occtl -j show iroutes(661)occtl -j show sessions(669)from being banned or cause premature unbans (678)
for RADIUS compatibility (630)
ping @nmav