]> www.infradead.org Git - users/dwmw2/openconnect.git/commit
Fortinet requires us to check for an HTTP error response only over TLS
authorDaniel Lenski <dlenski@gmail.com>
Thu, 17 Jun 2021 20:23:18 +0000 (13:23 -0700)
committerDaniel Lenski <dlenski@gmail.com>
Thu, 17 Jun 2021 21:01:21 +0000 (14:01 -0700)
commit5cb99148a582f4953f8f884bc2c43187e7fa54b8
tree213d39fa7c645b7e54191f77474f2addb1a2c589
parentf5a4fb069405b8bfe37a55789f1eda67e9ae4ca9
Fortinet requires us to check for an HTTP error response only over TLS

If the Fortinet PPP connection request *succeeds* over TLS, there is no HTTP
response before we start exchanging PPP packets.  If it *fails*, there is an
HTTP response.

If the Fortinet PPP connection request is over DTLS, a 'svrhello' response
is expected regardless of whether it succeeded or failed. This is handled
by fortinet_dtls_catch_svrhello()

Let's only check for that HTTP response in Fortinet if we're definitely
connecting over TLS.  The "proceeding to tunnel stage" test in
'fortinet-auth-config-tests' verifies the correctness of the HTTP response
parsing behavior.

Fortinet connection response matrix ("Don't blame me, I didn't design this."):

           \ TRANSPORT
    STATUS  \             TLS               DTLS
             +            ---------------   -------------------
    Success  |            immediate → PPP   SVRHELLO 'ok' → PPP
    Failure  |            HTTP response     SVRHELLO 'fail'

Signed-off-by: Daniel Lenski <dlenski@gmail.com>
fortinet.c
ppp.c