Revert "GP: Fix the issue of a 0.0.0.0/0 "split"-include route by swapping the "split...

This reverts commit 99ae55aec1408a2905df72394dab99cb6fb41aed, which causes
regressions with existing NetworkManager-openconnect releases.

We can do it in NetworkManager-openconnect with
https://gitlab.gnome.org/GNOME/NetworkManager-openconnect/-/merge_requests/36

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

diff --git a/gpst.c b/gpst.c
index a7c6fb9911e95ecb964b82987ddf544d9cc5b916..b655a3da0a23bbeaabe5b002afe33c463e54ba4b 100644 (file)
--- a/gpst.c
+++ b/gpst.c
@@ -342,11 +342,9 @@ out:
 static int gpst_parse_config_xml(struct openconnect_info *vpninfo, xmlNode *xml_node, void *cb_data)
 {
        xmlNode *member;
-       char *s = NULL, *deferred_netmask = NULL;
-       struct oc_split_include *inc;
-       int split_route_is_default_route = 0;
        int n_dns = 0, esp_keys = 0, esp_v4 = 0, esp_v6 = 0;
        int ret = 0;
+       char *s = NULL;
        int ii;
 
        uint32_t esp_magic = 0;
@@ -370,11 +368,8 @@ static int gpst_parse_config_xml(struct openconnect_info *vpninfo, xmlNode *xml_
                else if (!xmlnode_get_val(xml_node, "ip-address-v6", &s)) {
                        if (!vpninfo->disable_ipv6)
                                new_ip_info.addr6 = add_option_steal(&new_opts, "ipaddr6", &s);
-               } else if (!xmlnode_get_val(xml_node, "netmask", &deferred_netmask)) {
-                       /* XX: GlobalProtect servers always (almost always?) send 255.255.255.255 as their netmask
-                        * (a /32 host route), and if they want to include an actual default route (0.0.0.0/0)
-                        * they instead put it under <access-routes/>. We defer saving the netmask until later.
-                        */
+               } else if (!xmlnode_get_val(xml_node, "netmask", &s)) {
+                       new_ip_info.netmask = add_option_steal(&new_opts, "netmask", &s);
                } else if (!xmlnode_get_val(xml_node, "mtu", &s))
                        new_ip_info.mtu = atoi(s);
                else if (!xmlnode_get_val(xml_node, "lifetime", &s))
@@ -455,22 +450,12 @@ static int gpst_parse_config_xml(struct openconnect_info *vpninfo, xmlNode *xml_
                           xmlnode_is_named(xml_node, "access-routes") || xmlnode_is_named(xml_node, "exclude-access-routes")) {
                        for (member = xml_node->children; member; member=member->next) {
                                if (!xmlnode_get_val(member, "member", &s)) {
-                                       int is_inc = (xml_node->name[0] == 'a');
-
-                                       /* XX: if this is a default Legacy IP route jammed into the split-include
-                                        * routes, just mark it for now.
-                                        */
-                                       if (is_inc && !strcmp(s, "0.0.0.0/0")) {
-                                               split_route_is_default_route = 1;
-                                               continue;
-                                       }
-
-                                       inc = malloc(sizeof(*inc));
+                                       struct oc_split_include *inc = malloc(sizeof(*inc));
                                        if (!inc) {
                                                ret = -ENOMEM;
                                                goto err;
                                        }
-                                       if (is_inc) {
+                                       if (xmlnode_is_named(xml_node, "access-routes")) {
                                                inc->route = add_option_steal(&new_opts, "split-include", &s);
                                                inc->next = new_ip_info.split_includes;
                                                new_ip_info.split_includes = inc;
@@ -530,35 +515,6 @@ static int gpst_parse_config_xml(struct openconnect_info *vpninfo, xmlNode *xml_
                }
        }
 
-       /* Fix the issue of a 0.0.0.0/0 "split"-include route by swapping the "split" route with the default netmask. */
-       if (split_route_is_default_route) {
-               char *original_netmask = deferred_netmask;
-
-               if ((deferred_netmask = strdup("0.0.0.0")) == NULL)
-                       return -ENOMEM;
-
-               /* If the original netmask wasn't /32, add it as a split route */
-               if (new_ip_info.addr && original_netmask) {
-                       uint32_t nm_bits = inet_addr(original_netmask);
-                       if (nm_bits != 0xffffffff) { /* 255.255.255.255 */
-                               struct in_addr net_addr;
-                               inet_aton(new_ip_info.addr, &net_addr);
-                               net_addr.s_addr &= nm_bits; /* clear host bits */
-
-                               char abuf[INET_ADDRSTRLEN];
-                               if ((inc = malloc(sizeof(*inc))) == NULL ||
-                                   asprintf(&s, "%s/%s", inet_ntop(AF_INET, &net_addr, abuf, sizeof(abuf)), original_netmask) <= 0)
-                                       return -ENOMEM;
-                               inc->route = add_option_steal(&new_opts, "split-include", &s);
-                               inc->next = new_ip_info.split_includes;
-                               new_ip_info.split_includes = inc;
-                       }
-               }
-               free(original_netmask);
-       }
-       if (deferred_netmask)
-               new_ip_info.netmask = add_option_steal(&new_opts, "netmask", &deferred_netmask);
-
        /* Set 10-second DPD/keepalive (same as Windows client) unless
         * overridden with --force-dpd */
        if (!vpninfo->ssl_times.dpd)

diff --git a/www/changelog.xml b/www/changelog.xml
index 4cd7e700caab63e8768f9d85b80c63743fe754a6..7dc7e9c06604b655cc4f3f2919d2641f2ceab8ee 100644 (file)
--- a/www/changelog.xml
+++ b/www/changelog.xml
@@ -21,6 +21,7 @@
        <li>Bugfix RSA SecurID token decryption and PIN entry forms, broken in v8.20. (<a href="https://gitlab.com/openconnect/openconnect/-/issues/388">#388</a>, <a href="https://gitlab.com/openconnect/openconnect/-/merge_requests/344">!344</a>)</li>
        <li>Support <a href="https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client-v4x/212483-configure-asa-as-the-ssl-gateway-for-any.html">Cisco's multiple-certificate authentication</a> (<a href="https://gitlab.com/openconnect/openconnect/-/merge_requests/194">!194</a>).</li>
        <li>Append <tt>internal=no</tt> to GlobalProtect authentication/configuration forms, for compatibility with servers which apparently require this to function properly. (<a href="https://gitlab.com/openconnect/openconnect/-/issues/246">#246</a>, <a href="https://gitlab.com/openconnect/openconnect/-/merge_requests/337">!337</a>)</li>
+       <li>Revert GlobalProtect default route handling change from v8.20. (<a href="https://gitlab.com/openconnect/openconnect/-/merge_requests/367">!367</a>)</li>
      </ul><br/>
   </li>
   <li><b><a href="https://www.infradead.org/openconnect/download/openconnect-8.20.tar.gz">OpenConnect v8.20</a></b>