David Woodhouse [Wed, 6 Apr 2022 15:42:09 +0000 (16:42 +0100)]
epoll: Handle EPOLLERR as 'readable'
When we use select(), an error event on a file descriptor causes it to
be reported as readable, and some of the handlers will only clean it up
if that happens. So set the 'readable' flag on EPOLLERR too.
This is part of #389.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
However, we forget to make stoken.c set the `auth_id` for the forms that it
creates for RSA SecurID token decryption and PIN entry. Let's name these:
- `_rsa_unlock`, for token decryption.
- `_rsa_pin`, for PIN entry. Also, rename the numeric PIN field to `pin`
rather than `password`; there can't be any existing users relying on
`--form-entry` to set its value, because that wouldn't work without the
`auth_id`.
Luca Boccassi [Wed, 2 Mar 2022 16:35:29 +0000 (16:35 +0000)]
Add --enable-docs option
Allow to explicitly disable building documentation. Some
platforms are too old (RHEL 7) and even if Python is available due
to build macros, building documentation fails. Allow to disable it
explicitly.
David Woodhouse [Sat, 26 Feb 2022 17:34:26 +0000 (17:34 +0000)]
Fix Windows tun setup crash
The intention was to use vpninfo->hostname, by passing it as a parameter
to the create_ifname_w() function. But that function still just uses
vpninfo->ifname unconditionally, ignoring the argument. And causing the
crash in #370.
Fix up some bogus formatting while we're at it. We don't do open braces
on the same line as the function declaration.
Fixes: 48bd28aadd ("Use hostname as Wintun ifname (if ifname not specified)") Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Dimitri Papadopoulos [Thu, 30 Dec 2021 21:35:37 +0000 (22:35 +0100)]
Check return value of sigaction()
It shouldn't fail, but you never know. Check the return value and print
an error message. Yet do not bale out, as OpenConnect might still be
able to create the VPN connection.
Dimitri Papadopoulos [Sat, 1 Jan 2022 19:28:03 +0000 (20:28 +0100)]
Win32: gai_strerror → WSAGetLastError
The Windows Sockets documentation recommends using WSAGetLastError()
instead of gai_strerror(), because the latter is not thread safe:
https://docs.microsoft.com/en-us/windows/win32/winsock/error-codes-errno-h-errno-and-wsagetlasterror-2
Properly decode the output using openconnect__win32_strerror().
Daniel Lenski [Tue, 5 Jan 2021 18:44:12 +0000 (10:44 -0800)]
split OC_FORM_OPT_SSO into _TOKEN and _USER versions, and don't open_webview until after "normal" form processing
OC_FORM_OPT_SSO_USER will be needed for GlobalProtect SSO.
See https://gitlab.com/openconnect/openconnect/-/merge_requests/75#note_478078985
for why we (might )need to process the "normal" form fields before handling
the SSO parts.
Steven Walter [Wed, 18 Mar 2020 16:36:25 +0000 (12:36 -0400)]
Support AnyConnect single-sign-on-v2
Advertise support for auth-method single-sign-on-v2. This, combined
with not sending X-AnyConnect-Platform and X-Support-HTTP-Auth, allows
one to complete a web-based SSO authentication. Server replies with a
response like:
If either X-AnyConnect-Platform or X-Support-HTTP-Auth is present, then
this response is not received, and a 302 redirect to the "standard" auth
flow is given. However, this auth flow does not work on my VPN server;
presumably it is administratively disabled.
Once you get the above response, you can open the URL from sso-v2-login
in an HTML viewer and complete the steps. This requires an openconnect
front-end that supports the open_webview callback. Eventually you end
up at the URL from sso-v2-login-final, and then you can extract the
cookie with the name in sso-v2-token-cookie-name (acSamlv2Token, in this
case).
Neither samlwebcookie nor openconnect-sso, mentioned in #84, worked for
me.
Signed-off-by: Steven Walter <steven@stevenwalter.org> Co-authored-by: Luca Boccassi <luca.boccassi@microsoft.com>
David Woodhouse [Sun, 20 Feb 2022 17:06:07 +0000 (17:06 +0000)]
Fix EXTRA_DIST for ocserv config files
We need to include the .config.in file in the tarball, not the file
that is generated from it. Not entirely show how this ever worked,
but some of the messing with how it's autogenerated has caused it
to hard-code usernames from my build/ship system in the tarballs
and cause koji builds to fail with unknown users in the config.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
David Woodhouse [Sun, 20 Feb 2022 16:38:37 +0000 (17:38 +0100)]
Avoid printing spurious ENOENT error from EPOLL_CTL_DEL
In openconnect_close_https() we always unmonitor the ssl_fd even if we are
still in the auth phase and hadn't actually monitored it yet. I think I'd
like to keep track of that better, with a flag to explicitly keep track
of whether a given fd is registered. Or maybe abusing a high bit of the
existing vpninfo->XXX_epoll variables that already keep state.
For the imminent release though, let's take the simple approach and just
ignore the harmless error. Not pretty, but safer.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Dimitri Papadopoulos [Fri, 4 Feb 2022 16:26:52 +0000 (17:26 +0100)]
html.py must run with either Python 2 or 3 to support COPR builds
The script starts with `#!/usr/bin/env python3` but COPR builds run it as
`/usr/bin/python2 "./html.py"`. In the long term we should phase out Python
2 and make sure Python 3 is used everywhere. In the short term, let's
repair COPR builds first, then plan the Python 2 to 3 transition.
Daniel Lenski [Thu, 3 Feb 2022 22:12:17 +0000 (14:12 -0800)]
In dumb_socketpair(), delete Unix-domain socket path once no longer needed
Small follow-up improvement to
https://gitlab.com/openconnect/openconnect/-/merge_requests/320, which made
dumb_socketpair() able to use Unix-domain sockets, on those Windows versions
that support them albeit only with named paths.
This was suggested as a way to prevent the Windows dumb_socketpair()
implementation from leaving behind size-0 files, even if normally only in
temporary directories.
See original suggestion at
https://github.com/microsoft/WSL/issues/4240#issuecomment-1027607891.
Luca Boccassi [Wed, 18 Mar 2020 16:36:25 +0000 (12:36 -0400)]
libopenconnect: add public interface stubs for SAML support
The SAML support is still work in progress and not merged yet.
Start adding the new public API to libopenconnect, so that
distributions can choose to ship with out-of-tree support to
let their users have the feature without breaking ABI
compatibility.
Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Co-authored-by: Steven Walter <steven@stevenwalter.org>
Daniel Lenski [Wed, 1 Sep 2021 00:49:27 +0000 (17:49 -0700)]
Clarify Fortinet no-valid-cookie error paths
When requesting connection options in XML format…
1. A redirect indicates invalid cookie only if it is to /remote/login
2. A 403 followed by a fetch of the HTML format connection options
indicates an ancient FortiOS version only if the HTML fetch is actually
*successful* (200)
Daniel Lenski [Tue, 31 Aug 2021 23:44:52 +0000 (16:44 -0700)]
Print warning if Fortinet server doesn't indicate support/no-support for reconnect-after-drop
FortiGate v6.2.1 and newer appear to support reconnect-after-drop without
reauth, but only if the tag and attribute
'<auth-ses tun-connect-without-reauth="1">' are present in the config. As
of https://gitlab.com/openconnect/openconnect/-/merge_requests/292, we print
and act on this information.
We should also request feedback from users of Fortinet VPNs which don't
explicitly advertise either allowing or disallowing it.
See discussion at
https://gitlab.com/openconnect/openconnect/-/issues/297#note_664686767
Also, print the 'mr_num' field which is apparently part of some newer
Fortinet servers' version information.
Daniel Lenski [Mon, 30 Aug 2021 04:41:12 +0000 (21:41 -0700)]
Print Pulse server's IPv6 internal gateway address (in addition to Legacy IP)
The existence of this attribute was noted in
https://gitlab.com/openconnect/openconnect/-/issues/254#note_595455571. As
with its Legacy IP equivalent, an IPv6 "gateway" address is superfluous and
unnecessary for a tunnel connection.
Known Pulse servers consistently send an IPv6 internal gateway address which
falls in the fc00::/7 range of "unique local addresses"
(https://en.wikipedia.org/wiki/Unique_local_address), as in this example:
$ openconnect -vv pulse.vpn.com
...
Received internal Legacy IP address 10.200.200.2
Received netmask 255.255.255.255
Received internal gateway address 10.200.200.200 (Legacy IP)
Received internal IPv6 address 2001:abc:123:4::567/128
Received internal gateway IPv6 address fd00::ac8:c8c8 (IPv6)
Received IPv6 split include ::/0
This patch also *renames* the 'cstp_options' entry for the Legacy IP gateway
address (was 'ipaddr', changed to 'gateway') so that any front-end which
uses this list won't confuse it with the VPN interface's assigned Legacy IP
address (which is named 'ipaddr' for all currently-supported protocols).
Dimitri Papadopoulos [Sat, 25 Dec 2021 21:28:54 +0000 (22:28 +0100)]
Print detailed error information when opening cmd pipe/socketpair fails
Retrieve and print detailed information using GetLastError() and
strerror().
This should be more useful to end-users than the current message (simply
“Error opening cmd pipe”) and might have helped us to solve
https://gitlab.com/openconnect/openconnect/-/issues/228 more quickly.
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com> Signed-off-by: Daniel Lenski <dlenski@gmail.com>
David Overton [Fri, 28 Jan 2022 23:35:49 +0000 (23:35 +0000)]
Pulse: handle 0x2e20f000 main configuration packet
This packet type was received upon attempting to connect to a
Pulseb 9.1R14 server (with IPv6 enabled, though this may not
be relevant).
Upon receiving this packet we previously bailed out and failed
back to the user with:
Unexpected IF-T/TLS packet when expecting configuration
The "new" config packet packs what appears to be a second
attributes section in front of the legacy routing block. It
is not yet clear what the single example attribute seen so
far (0x4025) is for (perhaps it is to indicate the presence
or absence of the legacy routing block?).
We now have two other reports that this fixes
https://gitlab.com/openconnect/openconnect/-/issues/379, allowing other
users to connect to Pulse 9.1R14 servers as well:
Daniel Lenski [Mon, 7 Feb 2022 02:01:41 +0000 (18:01 -0800)]
Fix memory leak in pulse.c
This issue was hidden by the oversight of Legacy IPv4 split routes in 3d845bc9b, which was subsequently fixed in
https://gitlab.com/openconnect/openconnect/-/merge_requests/330 / 52d1c674.
David Overton [Fri, 28 Jan 2022 22:49:46 +0000 (22:49 +0000)]
Bugfix Legacy IP split include/exclude routes for Pulse
In 3d845bc9b, routing configuration was modified to use the `new_ip_info`
and `install_vpn_opts()`. Pulse IPv6 split include/exclude handling were
modified accordingly in that commit, but Legacy IP split include/exclude
routes were overlooked.
Since `install_vpn_opts()` clobbers the split include/exclude routes, this
means Legacy IP split routes for Pulse have been ignored since then.
Dimitri Papadopoulos [Sat, 29 Jan 2022 16:35:27 +0000 (17:35 +0100)]
Add jq as a build dependency to fix COPR builds
OpenConnect is cross-compiled directly from Fedora in COPR builds, so
this build dependency is a native Fedora package.
The dependency on 'jq' was introduced in b8f79ce9, and the resulting
brokenness of the COPR builds was noted in
https://gitlab.com/openconnect/openconnect/-/issues/286#note_825611200
Daniel Lenski [Sat, 22 Jan 2022 23:36:20 +0000 (15:36 -0800)]
Add new documentation on how to observe/MITM VPN clients
Put this in a new subsection of "Contributing". This is based on
https://gitlab.com/openconnect/openconnect/-/issues/246#note_811153868, and
other recent requests for help MITM'ing VPN clients.
Daniel Lenski [Sun, 23 Jan 2022 02:02:38 +0000 (18:02 -0800)]
The GitLab repo is more than an "experiment" at this point
We're using it for everything from bug reports, to new code contributions,
to CI for automated building of Windows installers. Make the docs reflect
that!
Daniel Lenski [Sat, 22 Jan 2022 23:08:07 +0000 (15:08 -0800)]
Update "Contributing" docs
1. Testing: We understand GlobalProtect IPv6 very well now. No immediate need for
more testers.
2. New protocols: Reference the MR with working code for at least some
modes of CheckPoint.
3. Help needed: We *do* need a bunch of help with external auth/SAML/SSO.
1. Nontext files, those where '-text' is explicitly set in .gitattributes
2. LICENSE/COPYING files (we never modify these)
3. '.po' files (not hand-edited)
Daniel Lenski [Fri, 21 Jan 2022 16:52:57 +0000 (08:52 -0800)]
Change library ordering when testing for library availability with autoconf
As discussed in #371, the order in which libraries must be listed on the
compiler command-line has changed in recent versions of GCC, in order for
linking to succeed. This is because the `--as-needed` option has become
enabled by default:
https://sigquit.wordpress.com/2011/02/16/why-asneeded-doesnt-work-as-expected-for-your-libraries-on-your-autotools-project
A succinct explanation of the required changes in library-ordering from
https://wiki.ubuntu.com/NattyNarwhal/ToolchainTransition by way of
https://stackoverflow.com/a/69795683:
> "The --as-needed option also makes the linker sensitive to the ordering
> of libraries on the command-line. You may need to move some libraries
> later in the command-line, so they come after other libraries or files
> that require symbols from them." [3]
It appears that both Debian-based and Fedora-based distributions are moving
towards this as the new default behavior:
Daniel Lenski [Wed, 19 Jan 2022 02:17:58 +0000 (18:17 -0800)]
Fix changelog links/labels
- A few merge-request links (`!123`) and issue links (`#456`) were confused,
in that they pointed to the wrong URL, or had the wrong label.
- Reference specific commits, or ranges of commits, where there was no
MR or issue.
- Consistently use the human-friendly searchable term Juniper, rather than
the jargon-y oNCP/NC, in the changelog.
Dimitri Papadopoulos [Thu, 23 Dec 2021 09:58:20 +0000 (10:58 +0100)]
Option --version prints default script location
Add a function to print the default location of the VPNC-compatible
script. Print this default location also with option --version, not
only with option --help.
Tim De Baets [Wed, 12 Jan 2022 17:20:09 +0000 (18:20 +0100)]
Issue OC_CMD_DETACH instead of OC_CMD_CANCEL on Ctrl+Break
If the user terminates OpenConnect with Ctrl+C, the session will be
logged off (OC_CMD_CANCEL), and with Ctrl+Break the session will NOT
be logged off (OC_CMD_DETACH). Either way, the vpnc-script
will still be invoked with reason=disconnect.
Signed-off-by: Tim De Baets <10608063-tdebaets@users.noreply.gitlab.com>
Tim De Baets [Tue, 11 Jan 2022 17:40:28 +0000 (18:40 +0100)]
Install a custom signal handler on Windows using SetConsoleCtrlHandler()
This fixes the longstanding bug
https://gitlab.com/openconnect/openconnect/-/issues/362, wherein the
vpnc-script never gets called to do any routing cleanup on Windows.
Also added checking for the number of characters returned by ReadConsole() so
that we still exit when receiving a control signal while waiting for user
input.
Signed-off-by: Tim De Baets <10608063-tdebaets@users.noreply.gitlab.com>
Daniel Lenski [Mon, 3 Jan 2022 16:23:18 +0000 (11:23 -0500)]
dumb_socketpair(): fallback from AF_UNIX to AF_INET if AF_UNIX fails
1) If bind() fails with an AF_UNIX socket, we should retry with
AF_INET socket
Because we have to used named paths for AF_UNIX sockets on Windows, a
likely point of failure is that the temporary directory in
nonexistent/non-writable, or even that we somehow have a collision in the
filename.
2) If any of the other AF_UNIX operations (listen, socket, connect, accept)
fail, we might as well also retry with AF_INET.
We don't know of any expected points-of-failure, but all indications are
that AF_UNIX support in Windows is incomplete, undocumented, and
potentially buggy.
projects / users / dwmw2 / openconnect.git / log