]> www.infradead.org Git - users/dwmw2/openconnect.git/commitdiff
SIGTERM cleans up the session similarly to SIGINT
authorNikos Mavrogiannopoulos <nmav@gnutls.org>
Sat, 27 Oct 2018 10:23:04 +0000 (12:23 +0200)
committerNikos Mavrogiannopoulos <nmav@gnutls.org>
Sat, 24 Nov 2018 14:35:45 +0000 (14:35 +0000)
Resolves #9

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
main.c
openconnect.8.in
tests/Makefile.am
tests/scripts/vpnc-script-detect-disconnect [new file with mode: 0755]
tests/sigterm [new file with mode: 0755]
www/changelog.xml

diff --git a/main.c b/main.c
index fc2db3425a3191717df2abc8f5d6c45d28737357..bff4fb98758c9e5fb23563b478adc5e7c0824b50 100644 (file)
--- a/main.c
+++ b/main.c
@@ -725,6 +725,7 @@ static void handle_signal(int sig)
        char cmd;
 
        switch (sig) {
+       case SIGTERM:
        case SIGINT:
                cmd = OC_CMD_CANCEL;
                break;
@@ -1538,6 +1539,7 @@ int main(int argc, char **argv)
        memset(&sa, 0, sizeof(sa));
 
        sa.sa_handler = handle_signal;
+       sigaction(SIGTERM, &sa, NULL);
        sigaction(SIGINT, &sa, NULL);
        sigaction(SIGHUP, &sa, NULL);
        sigaction(SIGUSR2, &sa, NULL);
@@ -1693,7 +1695,7 @@ int main(int argc, char **argv)
                ret = 1;
                break;
        case -EINTR:
-               vpn_progress(vpninfo, PRG_INFO, _("User cancelled (SIGINT); exiting.\n"));
+               vpn_progress(vpninfo, PRG_INFO, _("User cancelled (SIGINT/SIGTERM); exiting.\n"));
                ret = 0;
                break;
        case -ECONNABORTED:
index 86497423e08d360835032a32bcc91eac4512d3a8..6ff205cebeebb7d3f9f54970289e93f76345eade 100644 (file)
@@ -547,7 +547,7 @@ if this code is not executable on the local machine.
 .SH SIGNALS
 In the data phase of the connection, the following signals are handled:
 .TP
-.B SIGINT
+.B SIGINT / SIGTERM
 performs a clean shutdown by logging the session off, disconnecting from the
 gateway, and running the vpnc\-script to restore the network configuration.
 .TP
@@ -560,8 +560,6 @@ session off; this allows for reconnection later using
 forces an immediate disconnection and reconnection; this can be used to
 quickly recover from LAN IP address changes.
 .TP
-.B SIGTERM
-exits immediately without logging off or running vpnc\-script.
 .SH LIMITATIONS
 Note that although IPv6 has been tested on all platforms on which
 .B openconnect
index 47d3d4d4359ad02c4aaa3465667bcc2ba44b3267..6003d1240f548b87438a0e3c2ccd41a854131870 100644 (file)
@@ -38,12 +38,12 @@ EXTRA_DIST = certs/ca.pem certs/ca-key.pem certs/user-cert.pem $(USER_KEYS) $(US
        certs/server-cert.pem certs/server-key.pem configs/test1.passwd \
        common.sh configs/test-user-cert.config configs/test-user-pass.config \
        configs/user-cert.prm softhsm2.conf.in softhsm ns.sh configs/test-dtls-psk.config \
-       scripts/vpnc-script
+       scripts/vpnc-script scripts/vpnc-script-detect-disconnect
 
 dist_check_SCRIPTS =
 
 if HAVE_NETNS
-dist_check_SCRIPTS += dtls-psk
+dist_check_SCRIPTS += dtls-psk sigterm
 endif
 
 if HAVE_CWRAP
diff --git a/tests/scripts/vpnc-script-detect-disconnect b/tests/scripts/vpnc-script-detect-disconnect
new file mode 100755 (executable)
index 0000000..fe6d1c7
--- /dev/null
@@ -0,0 +1,14 @@
+#!/bin/sh -x
+
+# Fake script just for unit tests. Do not use.
+# For a real one, see http://www.infradead.org/openconnect/vpnc-script.html
+
+if [ "$reason" = "connect" ]; then
+    ip link set dev "$TUNDEV" up mtu "$INTERNAL_IP4_MTU"
+    ip addr add "$INTERNAL_IP4_ADDRESS/32" peer "$INTERNAL_IP4_ADDRESS" dev "$TUNDEV"
+    ip -6 addr add $INTERNAL_IP6_NETMASK dev $TUNDEV
+    rm -f ${DISCONNECT_FILE}
+elif [ "$reason" = "disconnect" ];then
+    touch ${DISCONNECT_FILE}
+fi
+exit 0
diff --git a/tests/sigterm b/tests/sigterm
new file mode 100755 (executable)
index 0000000..c8ebe6f
--- /dev/null
@@ -0,0 +1,133 @@
+#!/bin/bash
+#
+# Copyright (C) 2018 Nikos Mavrogiannopoulos
+#
+# This file is part of ocserv.
+#
+# ocserv is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at
+# your option) any later version.
+#
+# ocserv is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# This tests operation/traffic under compression (lzs or lz4).
+
+OCCTL="${OCCTL:-occtl}"
+SERV="${OCSERV:-ocserv}"
+srcdir=${srcdir:-.}
+PORT=4569
+PIDFILE=ocserv-pid.$$.tmp
+CLIPID=oc-pid.$$.tmp
+PATH=${PATH}:/usr/sbin
+IP=$(which ip)
+OUTFILE=traffic.$$.tmp
+export DISCONNECT_FILE=disconnected-ok.$$.tmp
+
+. `dirname $0`/common.sh
+
+rm -f ${DISCONNECT_FILE}
+
+if test -z "${IP}";then
+       echo "no IP tool is present"
+       exit 77
+fi
+
+if test "$(id -u)" != "0";then
+       echo "This test must be run as root"
+       exit 77
+fi
+
+echo "Testing ocserv connection with DTLS-PSK... "
+
+function finish {
+  set +e
+  echo " * Cleaning up..."
+  test -n "${PID}" && kill ${PID} >/dev/null 2>&1
+  test -n "${PIDFILE}" && rm -f ${PIDFILE} >/dev/null 2>&1
+  test -f "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1
+  test -f "${CLIPID}" && rm -f ${CLIPID} >/dev/null 2>&1
+  test -n "${CONFIG}" && rm -f ${CONFIG} >/dev/null 2>&1
+  rm -f ${OUTFILE} 2>&1
+}
+trap finish EXIT
+
+# server address
+ADDRESS=10.202.2.1
+CLI_ADDRESS=10.202.1.1
+VPNNET=192.168.3.0/24
+VPNADDR=192.168.3.1
+VPNNET6=fd91:6d87:8341:dc6a::/112
+VPNADDR6=fd91:6d87:8341:dc6a::1
+OCCTL_SOCKET=./occtl-comp-$$.socket
+USERNAME=test
+TUNDEV=oc-$$-tun0
+
+. `dirname $0`/ns.sh
+
+# Run servers
+update_config test-dtls-psk.config
+if test "$VERBOSE" = 1;then
+DEBUG="-d 3"
+fi
+
+${CMDNS2} ${SERV} -p ${PIDFILE} -f -c ${CONFIG} ${DEBUG} & PID=$!
+
+sleep 4
+
+# Run clients
+echo " * Getting cookie from ${ADDRESS}:${PORT}..."
+( echo "test" | ${CMDNS1} ${OPENCONNECT} ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly )
+if test $? != 0;then
+       echo "Could not get cookie from server"
+       exit 1
+fi
+
+echo " * Connecting to ${ADDRESS}:${PORT}..."
+( echo "test" | ${CMDNS1} ${OPENCONNECT} --interface ${TUNDEV} --dtls-ciphers=PSK-NEGOTIATE ${ADDRESS}:${PORT} -u ${USERNAME} --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 -s ${srcdir}/scripts/vpnc-script-detect-disconnect --pid-file=${CLIPID} --passwd-on-stdin -b )
+if test $? != 0;then
+       echo "Could not connect to server"
+       exit 1
+fi
+
+set -e
+
+echo " * wait for ${TUNDEV}"
+
+TIMEOUT=10
+while ! ${CMDNS1} ip addr list dev ${TUNDEV} &>/dev/null; do
+    TIMEOUT=$(($TIMEOUT - 1))
+    if [ $TIMEOUT -eq 0 ]; then
+       echo "Timed out waiting for ${TUNDEV}"
+       exit 1
+    fi
+    sleep 1
+done
+
+echo " * add routes"
+
+${CMDNS1} ip route add ${VPNADDR} dev ${TUNDEV}
+${CMDNS1} ip -6 route add ${VPNADDR6} dev ${TUNDEV}
+
+echo " * ping remote address"
+
+${CMDNS1} ping -c 3 ${VPNADDR}
+
+test -f "${CLIPID}" && kill $(cat ${CLIPID}) >/dev/null 2>&1
+rm -f "${CLIPID}"
+
+sleep 5
+
+if ! test -f ${DISCONNECT_FILE};then
+       echo "Could not find ${DISCONNECT_FILE}"
+       exit 1
+fi
+
+exit 0
index a99b73cb9385e0b17f2a70fe41f60651a0f513f2..315d9172409dafdc844ba5ac40266dabbbf4f377 100644 (file)
@@ -29,6 +29,7 @@
        <li>Verify ESP sequence numbers and warn even if replay protection is disabled.</li>
        <li>Add support for PAN GlobalProtect VPN protocol (<tt>--protocol=gp</tt>).</li>
        <li>Reorganize listing of command-line options, and include information on supported protocols.</li>
+       <li>SIGTERM cleans up the session similarly to SIGINT.</li>
      </ul><br/>
   </li>
   <li><b><a href="ftp://ftp.infradead.org/pub/openconnect/openconnect-7.08.tar.gz">OpenConnect v7.08</a></b>