Ignore errors fetching NC landing page if auth was successful

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

diff --git a/auth-juniper.c b/auth-juniper.c
index 8f30a3ba4b65158a305d8cefb247d68763f65c82..d3eb1ff61b9af01f39403b29cc3e827ebbfc90f9 100644 (file)
--- a/auth-juniper.c
+++ b/auth-juniper.c
@@ -467,15 +467,20 @@ int oncp_obtain_cookie(struct openconnect_info *vpninfo)
                        ret = do_https_request(vpninfo, "GET", NULL, NULL,
                                               &form_buf, 2);
 
-               if (ret < 0)
-                       break;
-
+               /* After login, the server will redirect the "browser" to a landing page.
+                * https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784
+                * turned some of those landing pages into a 403 but we don't *care*
+                * about that as long as we have the cookie we wanted. So check for
+                * cookie success *before* checking 'ret'. */
                if (!check_cookie_success(vpninfo)) {
                        free(form_buf);
                        ret = 0;
                        break;
                }
 
+               if (ret < 0)
+                       break;
+
                url = internal_get_url(vpninfo);
                if (!url) {
                        free(form_buf);

diff --git a/www/changelog.xml b/www/changelog.xml
index cde6422d75da7fecf75297cfb886527c85e86026..e66719ef99b5aff56d5538e873cb5c9d7b13eb45 100644 (file)
--- a/www/changelog.xml
+++ b/www/changelog.xml
@@ -38,6 +38,7 @@
        <li>Add support for <a href="https://www.wintun.net/">Wintun</a> Layer 3 TUN driver under Windows.</li>
        <li>Fix output redirection under Windows (<a href="https://gitlab.com/openconnect/openconnect/-/issues/229">#229</a>)</li>
        <li>More gracefully handle Pulse/NC idle timeouts and other Pulse fatal errors (<a href="https://gitlab.com/openconnect/openconnect/-/issues/187">!187</a>)</li>
+       <li>Ignore failures to fetch the NC landing page if the authentication was successful.</li>
      </ul><br/>
   </li>
   <li><b><a href="ftp://ftp.infradead.org/pub/openconnect/openconnect-8.10.tar.gz">OpenConnect v8.10</a></b>