From colinz at seas.harvard.edu  Fri Dec  4 12:43:26 2009
From: colinz at seas.harvard.edu (Colin Jia Zheng)
Date: Fri, 4 Dec 2009 12:43:26 -0500
Subject: Reconnection problem on roam
Message-ID: <20091204174326.GA32269@cjz.client.fas.harvard.edu>

I have recently started using openconnect and really appreciate the work
behind it.  However whenever I restart the network service (ie, kill
wpa_supplicant and dhcpcd, then restart them), openconnect reports:

    CSTP Dead Peer Detection detected dead peer!

and then connection is lost.  I'm using the regular vpnc-script.  Does
anyone know how to solve this?  I often travel with my laptop and
suspend/resume it.

Thanks!
Colin


From colin at co-rp.org  Fri Dec  4 12:44:44 2009
From: colin at co-rp.org (Colin Jia Zheng)
Date: Fri, 4 Dec 2009 12:44:44 -0500
Subject: Reconnection problem on roam
Message-ID: <20091204174444.GB32269@cjz.client.fas.harvard.edu>

I have recently started using openconnect and really appreciate the work
behind it.  However whenever I restart the network service (ie, kill
wpa_supplicant and dhcpcd, then restart them), openconnect reports:

    CSTP Dead Peer Detection detected dead peer!

and then connection is lost.  I'm using the regular vpnc-script.  Does
anyone know how to solve this?  I often travel with my laptop and
suspend/resume it.

Thanks!
Colin


From dwmw2 at infradead.org  Fri Dec  4 12:55:51 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Fri, 04 Dec 2009 17:55:51 +0000
Subject: Reconnection problem on roam
In-Reply-To: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
Message-ID: <1259949351.17440.36.camel@macbook.infradead.org>

On Fri, 2009-12-04 at 12:44 -0500, Colin Jia Zheng wrote:
> 
> I have recently started using openconnect and really appreciate the
> work
> behind it.  However whenever I restart the network service (ie, kill
> wpa_supplicant and dhcpcd, then restart them), openconnect reports:
> 
>     CSTP Dead Peer Detection detected dead peer!
> 
> and then connection is lost.  I'm using the regular vpnc-script.  Does
> anyone know how to solve this?  I often travel with my laptop and
> suspend/resume it. 

It should reconnect after detecting a dead peer. What _exactly_ is the
output you get from it? Try running with -v too; it'll be more
enlightening.

-- 
dwmw2



From colin at co-rp.org  Fri Dec  4 13:19:23 2009
From: colin at co-rp.org (Colin Zheng)
Date: Fri, 4 Dec 2009 13:19:23 -0500
Subject: Reconnection problem on roam
In-Reply-To: <1259949351.17440.36.camel@macbook.infradead.org>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
	<1259949351.17440.36.camel@macbook.infradead.org>
Message-ID: <945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>

> It should reconnect after detecting a dead peer. What _exactly_ is the
> output you get from it? Try running with -v too; it'll be more
> enlightening.
>
> --
> dwmw2
>
> The output of openconnect -v after restarting network:

Send CSTP DPD
Sending uncompressed data packet of 73 bytes
Did no work; sleeping for 15000 ms...
Sending uncompressed data packet of 73 bytes
Did no work; sleeping for 12000 ms...
Sending uncompressed data packet of 73 bytes
Did no work; sleeping for 8000 ms...

...

CSTP Dead Peer Detection detected dead peer!
getaddrinfo failed: Temporary failure in name resolution
sleep 10s, remaining timeout 300s
getaddrinfo failed: Temporary failure in name resolution
sleep 20s, remaining timeout 290s
...

I waited for about 40s, then stopped openconnect, and immediately had
network connection again.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bombadil.infradead.org/pipermail/openconnect-devel/attachments/20091204/b096ee82/attachment.htm>

From dwmw2 at infradead.org  Sat Dec  5 19:18:28 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Sun, 06 Dec 2009 00:18:28 +0000
Subject: Reconnection problem on roam
In-Reply-To: <945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
	<1259949351.17440.36.camel@macbook.infradead.org>
	<945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>
Message-ID: <1260058708.17440.275.camel@macbook.infradead.org>

On Fri, 2009-12-04 at 13:19 -0500, Colin Zheng wrote:
> 
> CSTP Dead Peer Detection detected dead peer!
> getaddrinfo failed: Temporary failure in name resolution
> sleep 10s, remaining timeout 300s
> getaddrinfo failed: Temporary failure in name resolution
> sleep 20s, remaining timeout 290s 

Ah. It's trying to reconnect... but it's doing a DNS lookup to find the
address of the server again. That's not so cunning.

Can you confirm that it works properly if you specify the IP address of
the server on the command line, instead of the DNS name?

-- 
dwmw2



From dwmw2 at infradead.org  Sat Dec  5 19:30:07 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Sun, 06 Dec 2009 00:30:07 +0000
Subject: Reconnection problem on roam
In-Reply-To: <1260058708.17440.275.camel@macbook.infradead.org>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
	<1259949351.17440.36.camel@macbook.infradead.org>
	<945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>
	<1260058708.17440.275.camel@macbook.infradead.org>
Message-ID: <1260059407.17440.288.camel@macbook.infradead.org>

On Sun, 2009-12-06 at 00:18 +0000, David Woodhouse wrote:
> On Fri, 2009-12-04 at 13:19 -0500, Colin Zheng wrote:
> > 
> > CSTP Dead Peer Detection detected dead peer!
> > getaddrinfo failed: Temporary failure in name resolution
> > sleep 10s, remaining timeout 300s
> > getaddrinfo failed: Temporary failure in name resolution
> > sleep 20s, remaining timeout 290s 
> 
> Ah. It's trying to reconnect... but it's doing a DNS lookup to find the
> address of the server again. That's not so cunning.
> 
> Can you confirm that it works properly if you specify the IP address of
> the server on the command line, instead of the DNS name?

If so, does this patch also fix it?

diff --git a/ssl.c b/ssl.c
index 88214f9..6d51146 100644
--- a/ssl.c
+++ b/ssl.c
@@ -476,52 +476,67 @@ int openconnect_open_https(struct openconnect_info *vpninfo)
 	BIO *https_bio;
 	int ssl_sock = -1;
 	int err;
-	struct addrinfo hints, *result, *rp;
-
-	memset(&hints, 0, sizeof(struct addrinfo));
-	hints.ai_family = AF_UNSPEC;
-	hints.ai_socktype = SOCK_STREAM;
-	hints.ai_flags = AI_PASSIVE | AI_NUMERICSERV;
-	hints.ai_protocol = 0;
-	hints.ai_canonname = NULL;
-	hints.ai_addr = NULL;
-	hints.ai_next = NULL;
-
-	err = getaddrinfo(vpninfo->hostname, "443", &hints, &result);
-	if (err) {
-		vpninfo->progress(vpninfo, PRG_ERR, "getaddrinfo failed: %s\n", gai_strerror(err));
-		return -EINVAL;
-	}
 
-	vpninfo->progress(vpninfo, PRG_INFO,
-			  "Attempting to connect to %s\n", vpninfo->hostname);
-
-	for (rp = result; rp ; rp = rp->ai_next) {
-		ssl_sock = socket(rp->ai_family, rp->ai_socktype,
-				  rp->ai_protocol);
-		if (ssl_sock < 0)
-			continue;
-		if (connect(ssl_sock, rp->ai_addr, rp->ai_addrlen) >= 0) {
-			/* Store the peer address we actually used, so that DTLS can
-			   use it again later */
-			vpninfo->peer_addr = malloc(rp->ai_addrlen);
-			if (!vpninfo->peer_addr) {
-				vpninfo->progress(vpninfo, PRG_ERR, "Failed to allocate sockaddr storage\n");
-				close(ssl_sock);
-				return -ENOMEM;
-			}
-			vpninfo->peer_addrlen = rp->ai_addrlen;
-			memcpy(vpninfo->peer_addr, rp->ai_addr, rp->ai_addrlen);
-			break;
+	if (vpninfo->peer_addr) {
+		ssl_sock = socket(vpninfo->peer_addr->sa_family, SOCK_STREAM, IPPROTO_IP);
+		if (ssl_sock < 0) {
+		reconn_err:
+			vpninfo->progress(vpninfo, PRG_ERR, "Failed to reconnect to host %s\n", vpninfo->hostname);
+			return -EINVAL;
 		}
-		close(ssl_sock);
-		ssl_sock = -1;
-	}
-	freeaddrinfo(result);
+		if (connect(ssl_sock, vpninfo->peer_addr, vpninfo->peer_addrlen))
+			goto reconn_err;
 
-	if (ssl_sock < 0) {
-		vpninfo->progress(vpninfo, PRG_ERR, "Failed to connect to host %s\n", vpninfo->hostname);
-		return -EINVAL;
+		
+		
+	} else {
+		struct addrinfo hints, *result, *rp;
+
+		memset(&hints, 0, sizeof(struct addrinfo));
+		hints.ai_family = AF_UNSPEC;
+		hints.ai_socktype = SOCK_STREAM;
+		hints.ai_flags = AI_PASSIVE | AI_NUMERICSERV;
+		hints.ai_protocol = 0;
+		hints.ai_canonname = NULL;
+		hints.ai_addr = NULL;
+		hints.ai_next = NULL;
+
+		err = getaddrinfo(vpninfo->hostname, "443", &hints, &result);
+		if (err) {
+			vpninfo->progress(vpninfo, PRG_ERR, "getaddrinfo failed: %s\n", gai_strerror(err));
+			return -EINVAL;
+		}
+
+		vpninfo->progress(vpninfo, PRG_INFO,
+				  "Attempting to connect to %s\n", vpninfo->hostname);
+
+		for (rp = result; rp ; rp = rp->ai_next) {
+			ssl_sock = socket(rp->ai_family, rp->ai_socktype,
+					  rp->ai_protocol);
+			if (ssl_sock < 0)
+				continue;
+			if (connect(ssl_sock, rp->ai_addr, rp->ai_addrlen) >= 0) {
+				/* Store the peer address we actually used, so that DTLS can
+				   use it again later */
+				vpninfo->peer_addr = malloc(rp->ai_addrlen);
+				if (!vpninfo->peer_addr) {
+					vpninfo->progress(vpninfo, PRG_ERR, "Failed to allocate sockaddr storage\n");
+					close(ssl_sock);
+					return -ENOMEM;
+				}
+				vpninfo->peer_addrlen = rp->ai_addrlen;
+				memcpy(vpninfo->peer_addr, rp->ai_addr, rp->ai_addrlen);
+				break;
+			}
+			close(ssl_sock);
+			ssl_sock = -1;
+		}
+		freeaddrinfo(result);
+		
+		if (ssl_sock < 0) {
+			vpninfo->progress(vpninfo, PRG_ERR, "Failed to connect to host %s\n", vpninfo->hostname);
+			return -EINVAL;
+		}
 	}
 	fcntl(ssl_sock, F_SETFD, FD_CLOEXEC);
 


-- 
dwmw2



From colin at co-rp.org  Sat Dec  5 19:57:48 2009
From: colin at co-rp.org (Colin Jia Zheng)
Date: Sat, 5 Dec 2009 19:57:48 -0500
Subject: Reconnection problem on roam
In-Reply-To: <1260058708.17440.275.camel@macbook.infradead.org>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
	<1259949351.17440.36.camel@macbook.infradead.org>
	<945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>
	<1260058708.17440.275.camel@macbook.infradead.org>
Message-ID: <20091206005748.GA3690@cjz.client.fas.harvard.edu>

Unfortunately, even with IP it fails to reconnect:

    Did no work; sleeping for 4000 ms...
    Send CSTP DPD
    Did no work; sleeping for 15000 ms...
    CSTP Dead Peer Detection detected dead peer!
    Attempting to connect to 140.247.2.134
    Failed to connect to host 140.247.2.134
    sleep 10s, remaining timeout 300s
    Attempting to connect to 140.247.2.134
    sleep 20s, remaining timeout 290s
    ^C

The command line was:

echo ******* | openconnect -v --user 70731703 --passwd-on-stdin \
    --script /etc/vpnc-script \
    140.247.2.134
#    core-vpn-2-gw.fas.harvard.edu

The version of openconnect and compilation flags:
http://repos.archlinux.org/wsvn/packages/openconnect/repos/extra-x86_64/PKGBUILD

BTW, after running for 10+ hours, openconnect often loses connection and
 fails to reconnect.  Maybe it's the same problem.

Let me know if more details will help! THanks!!

Colin

On Sun, Dec 06, 2009 at 12:18:28AM +0000, David Woodhouse wrote:
> On Fri, 2009-12-04 at 13:19 -0500, Colin Zheng wrote:
> > 
> > CSTP Dead Peer Detection detected dead peer!
> > getaddrinfo failed: Temporary failure in name resolution
> > sleep 10s, remaining timeout 300s
> > getaddrinfo failed: Temporary failure in name resolution
> > sleep 20s, remaining timeout 290s 
> 
> Ah. It's trying to reconnect... but it's doing a DNS lookup to find the
> address of the server again. That's not so cunning.
> 
> Can you confirm that it works properly if you specify the IP address of
> the server on the command line, instead of the DNS name?
> 
> -- 
> dwmw2
> 


From dwmw2 at infradead.org  Sat Dec  5 20:14:40 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Sun, 06 Dec 2009 01:14:40 +0000
Subject: Reconnection problem on roam
In-Reply-To: <20091206005748.GA3690@cjz.client.fas.harvard.edu>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
	<1259949351.17440.36.camel@macbook.infradead.org>
	<945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>
	<1260058708.17440.275.camel@macbook.infradead.org>
	<20091206005748.GA3690@cjz.client.fas.harvard.edu>
Message-ID: <1260062080.17440.335.camel@macbook.infradead.org>

On Sat, 2009-12-05 at 19:57 -0500, Colin Jia Zheng wrote:
> Unfortunately, even with IP it fails to reconnect:
> 
>     Did no work; sleeping for 4000 ms...
>     Send CSTP DPD
>     Did no work; sleeping for 15000 ms...
>     CSTP Dead Peer Detection detected dead peer!
>     Attempting to connect to 140.247.2.134
>     Failed to connect to host 140.247.2.134
>     sleep 10s, remaining timeout 300s
>     Attempting to connect to 140.247.2.134
>     sleep 20s, remaining timeout 290s 

That's odd. What's your routing table at this point? Do you have a
sensible route to the server -- you're not trying to route packets to it
_through_ the VPN or anything daft?

Use tcpdump on the outgoing interface. Does it show an attempt to
connect?

-- 
dwmw2



From colinz at seas.harvard.edu  Sat Dec  5 20:49:44 2009
From: colinz at seas.harvard.edu (Colin Jia Zheng)
Date: Sat, 5 Dec 2009 20:49:44 -0500
Subject: Reconnection problem on roam
In-Reply-To: <1260062080.17440.335.camel@macbook.infradead.org>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
	<1259949351.17440.36.camel@macbook.infradead.org>
	<945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>
	<1260058708.17440.275.camel@macbook.infradead.org>
	<20091206005748.GA3690@cjz.client.fas.harvard.edu>
	<1260062080.17440.335.camel@macbook.infradead.org>
Message-ID: <20091206014944.GB3690@cjz.client.fas.harvard.edu>

> That's odd. What's your routing table at this point? Do you have a
> sensible route to the server -- you're not trying to route packets to it
> _through_ the VPN or anything daft?

Routing table before running vpn:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
140.247.5.0     *               255.255.255.0   U     304    0        0 wlan0
default         core-np-gw-vl26 0.0.0.0         UG    304    0        0 wlan0


Routing table after running vpn:
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
core-vpn-2-gw.f core-np-gw-vl26 255.255.255.255 UGH    1500 0          0 wlan0
140.247.5.0     *               255.255.255.0   U         0 0          0 wlan0
default         *               0.0.0.0         U         0 0          0 tun0
default         core-np-gw-vl26 0.0.0.0         UG        0 0          0 wlan0


After I restart network, and while openconnect attempts to reconnect,
?netstat -r? gets stuck after printing these lines

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
140.247.5.0     *               255.255.255.0   U         0 0          0 wlan0
default         *               0.0.0.0         U         0 0          0 tun0



> 
> Use tcpdump on the outgoing interface. Does it show an attempt to
> connect?

After restarting network, tcpdump -i wlan0 says

1 packets captured
2480 packets received by filter
0 packets dropped by kernel




From dwmw2 at infradead.org  Sun Dec  6 08:39:17 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Sun, 06 Dec 2009 13:39:17 +0000
Subject: Reconnection problem on roam
In-Reply-To: <20091206014944.GB3690@cjz.client.fas.harvard.edu>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
	<1259949351.17440.36.camel@macbook.infradead.org>
	<945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>
	<1260058708.17440.275.camel@macbook.infradead.org>
	<20091206005748.GA3690@cjz.client.fas.harvard.edu>
	<1260062080.17440.335.camel@macbook.infradead.org>
	<20091206014944.GB3690@cjz.client.fas.harvard.edu>
Message-ID: <1260106757.17440.583.camel@macbook.infradead.org>

On Sat, 2009-12-05 at 20:49 -0500, Colin Jia Zheng wrote:
> 
> After I restart network, and while openconnect attempts to reconnect,
> ?netstat -r? gets stuck after printing these lines

It gets stuck because you're asking it to do DNS lookups. Use
'netstat -rn' and it won't.

> Kernel IP routing table
> Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
> 140.247.5.0     *               255.255.255.0   U         0 0          0 wlan0
> default         *               0.0.0.0         U         0 0          0 tun0

OK, this is your problem. The explicit route to the VPN server through
your local gateway is gone. Your vpnc-script will have added it, but
when you restarted the network, it went away again. You may need to add
it back again manually.

-- 
dwmw2



From colin at co-rp.org  Sun Dec  6 13:59:54 2009
From: colin at co-rp.org (Colin Jia Zheng)
Date: Sun, 6 Dec 2009 13:59:54 -0500
Subject: Reconnection problem on roam
In-Reply-To: <1260106757.17440.583.camel@macbook.infradead.org>
References: <20091204174444.GB32269@cjz.client.fas.harvard.edu>
	<1259949351.17440.36.camel@macbook.infradead.org>
	<945fdc300912041019ge3e822dp125a0380fce7f6f5@mail.gmail.com>
	<1260058708.17440.275.camel@macbook.infradead.org>
	<20091206005748.GA3690@cjz.client.fas.harvard.edu>
	<1260062080.17440.335.camel@macbook.infradead.org>
	<20091206014944.GB3690@cjz.client.fas.harvard.edu>
	<1260106757.17440.583.camel@macbook.infradead.org>
Message-ID: <20091206185954.GD3690@cjz.client.fas.harvard.edu>

> OK, this is your problem. The explicit route to the VPN server through
> your local gateway is gone. Your vpnc-script will have added it, but
> when you restarted the network, it went away again. You may need to add
> it back again manually.

Manually adding it back works, thanks you!  But how do I know the VPN
gateway (as VPNGATEWAY in the vpnc script) in general?  For now I shall
simply kill/start openconnect in the network start/shutdown script,
which is fine.  But when roaming (eg when the laptop resumes from RAM
and automatically reconnects to a different wireless network), I hope
openconnect could detect connection loss and call the vpnc script to
reset and then set the routes?



From paulf at free.fr  Wed Dec  9 17:22:33 2009
From: paulf at free.fr (Paul Floyd)
Date: Wed, 09 Dec 2009 23:22:33 +0100
Subject: Getting started
Message-ID: <4B202329.8000806@free.fr>

Hi

At work, we're moving our remote access to use Cisco AnyConnect.

In the past I did manage to get vpnc to work on FreeBSD, and to almost 
work on Solaris (can't remember if it was OpenSolaris or Solaris 10, 
either way, I could connect, but the split routing didn't work).

Anyway, I've just been through the AnyConnect rigmarole to get a 
certificate and get connected on Windows. I'd rather not be forced to 
use Windows though, not use the nasty looking bits that Cisco installed. 
I'd prefer to use Solaris or Mac.

On OpenSolaris, I've compiled and installed tun, compiled and installed 
openconnect. After that the instructions start getting a bit thin on the 
ground. I've tried jailbreak, and found one Client Authentication 
certificate. When I try to export it, it says it's marked as not 
exportable and won't export the private key. Is that right? Next, there 
are a choice of 3 formats, with DER as the default. Does it matter which 
one I choose?

I've tried the 1st and 3rd options when exporting, to get a .CER and a 
.PK7 file, and in both cases openconnect gives me a message that 
"Loading certificate failed".

Any help welcome!

Paul
-- 
Paul Floyd                 http://paulf.free.fr




From dwmw2 at infradead.org  Wed Dec  9 18:13:09 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Wed, 09 Dec 2009 23:13:09 +0000
Subject: Getting started
In-Reply-To: <4B202329.8000806@free.fr>
References: <4B202329.8000806@free.fr>
Message-ID: <1260400389.14512.2609.camel@macbook.infradead.org>

On Wed, 2009-12-09 at 23:22 +0100, Paul Floyd wrote:
> Anyway, I've just been through the AnyConnect rigmarole to get a 
> certificate and get connected on Windows. I'd rather not be forced to 
> use Windows though, not use the nasty looking bits that Cisco installed. 
> I'd prefer to use Solaris or Mac.

OpenConnect has been recently tested on both Solaris and OSX.

> On OpenSolaris, I've compiled and installed tun, compiled and installed 
> openconnect. After that the instructions start getting a bit thin on the 
> ground.

That's because there's not a lot else to do.

If you use password authentication, we can't tell you who you need to
talk to to reset your password on your own servers.

If you use certificate authentication, we can't tell you how to get your
certificates. I could tell you about my own employer's PKI
infrastructure and the SOAP methods we use to issue certificates, but it
wouldn't help you much.

>  I've tried jailbreak, and found one Client Authentication 
> certificate. When I try to export it, it says it's marked as not 
> exportable and won't export the private key. Is that right?

Doesn't sound right to me. I thought the whole point in jailbreak was
that it would export the private keys? All your keys are supposed to
appear as exportable.

Perhaps you need to be running it as a user with Administrator privs?

>  Next, there are a choice of 3 formats, with DER as the default. Does
> it matter which one I choose?
> 
> I've tried the 1st and 3rd options when exporting, to get a .CER and a 
> .PK7 file, and in both cases openconnect gives me a message that 
> "Loading certificate failed".

That sounds like it's exporting a certificate without the corresponding
private key. You want to the fourth option in that dialog box, which is
PKCS#12. OpenConnect can eat PKCS#12 files directly.

You can only export as PKCS#12 if you've been able to select 'Yes,
export the private key' at the previous stage. That seems to be your
problem.

-- 
dwmw2



From paulf at free.fr  Thu Dec 10 03:45:25 2009
From: paulf at free.fr (Paul Floyd)
Date: Thu, 10 Dec 2009 09:45:25 +0100
Subject: Getting started
In-Reply-To: <1260400389.14512.2609.camel@macbook.infradead.org>
References: <4B202329.8000806@free.fr>
	<1260400389.14512.2609.camel@macbook.infradead.org>
Message-ID: <1260434725.4b20b5255dc67@imp.free.fr>

Quoting David Woodhouse <dwmw2 at infradead.org>:

> On Wed, 2009-12-09 at 23:22 +0100, Paul Floyd wrote:
> > Anyway, I've just been through the AnyConnect rigmarole to get a
> > certificate and get connected on Windows. I'd rather not be forced to
> > use Windows though, not use the nasty looking bits that Cisco installed.
> > I'd prefer to use Solaris or Mac.
>
> OpenConnect has been recently tested on both Solaris and OSX.
>
> > On OpenSolaris, I've compiled and installed tun, compiled and installed
> > openconnect. After that the instructions start getting a bit thin on the
> > ground.
>
> That's because there's not a lot else to do.
>
> If you use password authentication, we can't tell you who you need to
> talk to to reset your password on your own servers.
>
> If you use certificate authentication, we can't tell you how to get your
> certificates. I could tell you about my own employer's PKI
> infrastructure and the SOAP methods we use to issue certificates, but it
> wouldn't help you much.

On Windows, as far as I can tell, it's a certificate plus the AnyConnect client
asks for a password. I'm not sure that I can count on much help from my
employer, as only AnuConnect on Windows and RHEL are officially supported.

[getting certificate]

I'll keep on plugging away at that.

A+
Paul
-- 
Paul Floyd   http://paulf.free.fr


From dwmw2 at infradead.org  Thu Dec 10 05:39:23 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Thu, 10 Dec 2009 10:39:23 +0000
Subject: Getting started
In-Reply-To: <1260434725.4b20b5255dc67@imp.free.fr>
References: <4B202329.8000806@free.fr>
	<1260400389.14512.2609.camel@macbook.infradead.org>
	<1260434725.4b20b5255dc67@imp.free.fr>
Message-ID: <1260441563.14512.3426.camel@macbook.infradead.org>

On Thu, 2009-12-10 at 09:45 +0100, Paul Floyd wrote:
> 
> On Windows, as far as I can tell, it's a certificate plus the AnyConnect client
> asks for a password. I'm not sure that I can count on much help from my
> employer, as only AnuConnect on Windows and RHEL are officially supported.
> 
> [getting certificate]

How do you go about getting a cert for RHEL? That's probably easier to
deal with. I believe that the official AnyConnect client on Linux
doesn't cope with any form of certificate storage other than
_unencrypted_ in the user's firefox certificate store -- and you can
just export it from there.

-- 
dwmw2



From paulf at free.fr  Thu Dec 10 16:19:12 2009
From: paulf at free.fr (Paul Floyd)
Date: Thu, 10 Dec 2009 22:19:12 +0100
Subject: Getting started
In-Reply-To: <1260441563.14512.3426.camel@macbook.infradead.org>
References: <4B202329.8000806@free.fr>	
	<1260400389.14512.2609.camel@macbook.infradead.org>	
	<1260434725.4b20b5255dc67@imp.free.fr>
	<1260441563.14512.3426.camel@macbook.infradead.org>
Message-ID: <4B2165D0.7060403@free.fr>

David Woodhouse wrote:
> On Thu, 2009-12-10 at 09:45 +0100, Paul Floyd wrote:
> 
>>On Windows, as far as I can tell, it's a certificate plus the AnyConnect client
>>asks for a password. I'm not sure that I can count on much help from my
>>employer, as only AnuConnect on Windows and RHEL are officially supported.
>>
>>[getting certificate]
> 
> 
> How do you go about getting a cert for RHEL? That's probably easier to
> deal with. I believe that the official AnyConnect client on Linux
> doesn't cope with any form of certificate storage other than
> _unencrypted_ in the user's firefox certificate store -- and you can
> just export it from there.

Hi

I haven't gotten that far yet (I have Fedora 11 on the same PC, which 
ought to work).

In any case, I've figured out the jailbreak issue [I had run the mmc 
plugin rather than the jailbreak exe which should run the plugin], and 
so have managed to progress a bit.

Now I get this

Attempting to connect to [vpn gateway]
Enter PKCS#12 pass phrase:
SSL negotiation with [vpn gateway]
Connected to HTTPS on [vpn gateway]
GET [vpn gateway]/
Attempting to connect to [vpn gateway]
SSL negotiation with [vpn gateway]
Connected to HTTPS on [vpn gateway]
GET [vpn gateway]/+webvpn+/index.html
GET [vpn gateway]/CACHE/sdesktop/install/binaries/sfinst
Trying to run Linux CSD trojan script.GET [vpn gateway]/+CSCOE+/sde
ait.html
/tmp/csdaMaWRb: syntax error at line 3: `MARKER=$' unexpected
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
GET [vpn gateway]/+CSCOE+/sdesktop/wait.html
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
[many repeates]
Error fetching HTTPS response

Here's the start of /tmp/csdaMaWRb

#!/bin/sh
#
MARKER=$((`grep -an "[B]EGIN\ ARCHIVE" $0 | cut -d ":" -f 1` + 1))

Is that some broken shell script that my company's vpn server is trying 
to run on my machine? Assuming it is, then it seems to be trying to 
extract a Linux or Darwin binary (only). Ho hum. I would have preferred 
to use (Open)Solaris, but there's not a snowball's chance in hell that 
out IT dept will bother to support it.

Now on to the Mac version. Seems to get even further, asking me for my 
group/user/password.

Then
CSTP connected. DPD 10, Keepalive 300
open tun: No such file or directory

Next, I installed TunTap. Now I can connect. I get this message

add net xxx: gateway ggg [x several]
SSL_set_session() failed with old protocol version 0x100
Your OpenSSL may lack Cisco compatibility support
See http://rt.openssl.org/Ticket/Display.html?id=1751
Use the --no-dtls command line option to avoid this message
Set up DTLS failed; using SSL instead

I suppose that isn't too serious?

Though nslookup works but if I run vpnclient with a hostname I get

  main:        unable to resolve host by name: No such file or directory (2)

When I'm not connected, my /etc/resolv.conf contains

search orange.fr

and this remains, but with my employer's domain added to the line. That 
doesn't seem right to me (though perhaps harmless).

And when I disconnect
^CSend BYE packet: Client received SIGINT
route: writing to routing socket: No such process
delete net default: not in table

Thanks for the quick help so far.

A+
Paul

-- 
Paul Floyd                 http://paulf.free.fr




From dwmw2 at infradead.org  Thu Dec 10 16:39:01 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Thu, 10 Dec 2009 21:39:01 +0000
Subject: Getting started
In-Reply-To: <4B2165D0.7060403@free.fr>
References: <4B202329.8000806@free.fr>
	<1260400389.14512.2609.camel@macbook.infradead.org>
	<1260434725.4b20b5255dc67@imp.free.fr>
	<1260441563.14512.3426.camel@macbook.infradead.org>
	<4B2165D0.7060403@free.fr>
Message-ID: <1260481141.14512.5272.camel@macbook.infradead.org>

On Thu, 2009-12-10 at 22:19 +0100, Paul Floyd wrote:
> David Woodhouse wrote:
> > On Thu, 2009-12-10 at 09:45 +0100, Paul Floyd wrote:
> > 
> >>On Windows, as far as I can tell, it's a certificate plus the AnyConnect client
> >>asks for a password. I'm not sure that I can count on much help from my
> >>employer, as only AnuConnect on Windows and RHEL are officially supported.
> >>
> >>[getting certificate]
> > 
> > 
> > How do you go about getting a cert for RHEL? That's probably easier to
> > deal with. I believe that the official AnyConnect client on Linux
> > doesn't cope with any form of certificate storage other than
> > _unencrypted_ in the user's firefox certificate store -- and you can
> > just export it from there.
> 
> Hi
> 
> I haven't gotten that far yet (I have Fedora 11 on the same PC, which 
> ought to work).
> 
> In any case, I've figured out the jailbreak issue [I had run the mmc 
> plugin rather than the jailbreak exe which should run the plugin], and 
> so have managed to progress a bit.
> 
> Now I get this
> 
> Attempting to connect to [vpn gateway]
> Enter PKCS#12 pass phrase:
> SSL negotiation with [vpn gateway]
> Connected to HTTPS on [vpn gateway]
> GET [vpn gateway]/
> Attempting to connect to [vpn gateway]
> SSL negotiation with [vpn gateway]
> Connected to HTTPS on [vpn gateway]
> GET [vpn gateway]/+webvpn+/index.html
> GET [vpn gateway]/CACHE/sdesktop/install/binaries/sfinst
> Trying to run Linux CSD trojan script.GET [vpn gateway]/+CSCOE+/sde
> ait.html
> /tmp/csdaMaWRb: syntax error at line 3: `MARKER=$' unexpected
> Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
> GET [vpn gateway]/+CSCOE+/sdesktop/wait.html
> Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
> [many repeates]
> Error fetching HTTPS response
> 
> Here's the start of /tmp/csdaMaWRb
> 
> #!/bin/sh
> #
> MARKER=$((`grep -an "[B]EGIN\ ARCHIVE" $0 | cut -d ":" -f 1` + 1))
> 
> Is that some broken shell script that my company's vpn server is trying 
> to run on my machine? Assuming it is, then it seems to be trying to 
> extract a Linux or Darwin binary (only). Ho hum. I would have preferred 
> to use (Open)Solaris, but there's not a snowball's chance in hell that 
> out IT dept will bother to support it.

Can't you run Linux binaries on Solaris? Other people have been looking
into what that shell script is actually doing, and it should be fairly
simple to just make something that posts an 'Accepted' or 'OK' response
to let you login proceed.

> Now on to the Mac version. Seems to get even further, asking me for my 
> group/user/password.
> 
> Then
> CSTP connected. DPD 10, Keepalive 300
> open tun: No such file or directory
> 
> Next, I installed TunTap. Now I can connect. I get this message
> 
> add net xxx: gateway ggg [x several]
> SSL_set_session() failed with old protocol version 0x100
> Your OpenSSL may lack Cisco compatibility support
> See http://rt.openssl.org/Ticket/Display.html?id=1751
> Use the --no-dtls command line option to avoid this message
> Set up DTLS failed; using SSL instead
> 
> I suppose that isn't too serious?

No, it should work without; just less efficiently. The openconnect web
page has a link to an explanation of why TCP over TCP is bad.

> Though nslookup works but if I run vpnclient with a hostname I get
> 
>   main:        unable to resolve host by name: No such file or directory (2)
> 
> When I'm not connected, my /etc/resolv.conf contains
> 
> search orange.fr
> 
> and this remains, but with my employer's domain added to the line. That 
> doesn't seem right to me (though perhaps harmless).

Harmless. Do you have nameservers listed in the file?

By default, openconnect won't do any routing setup. It expects you to
use a script for that, and it's compatible with the one from vpnc. Did
you use that?

> And when I disconnect
> ^CSend BYE packet: Client received SIGINT
> route: writing to routing socket: No such process
> delete net default: not in table

Does look like you're using some kind of routing script.

So what does the routing look like when you're connected? Can you try
basic IP connectivity first, and then debug DNS once you've sure that's
working?

-- 
dwmw2



From dwmw2 at infradead.org  Thu Dec 10 16:40:07 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Thu, 10 Dec 2009 21:40:07 +0000
Subject: Getting started
In-Reply-To: <4B2165D0.7060403@free.fr>
References: <4B202329.8000806@free.fr>
	<1260400389.14512.2609.camel@macbook.infradead.org>
	<1260434725.4b20b5255dc67@imp.free.fr>
	<1260441563.14512.3426.camel@macbook.infradead.org>
	<4B2165D0.7060403@free.fr>
Message-ID: <1260481207.14512.5277.camel@macbook.infradead.org>

Btw, if you run 'openconnect --cookieonly' on the Mac and log in
successfully, you should be able to take that cookie to the Solaris box
and use it there. My own vpnc-script _does_ work on Solaris, for both
IPv6 and Legacy IP connectivity.

-- 
dwmw2



From paulf at free.fr  Fri Dec 11 03:25:49 2009
From: paulf at free.fr (Paul Floyd)
Date: Fri, 11 Dec 2009 09:25:49 +0100
Subject: Getting started
In-Reply-To: <1260481141.14512.5272.camel@macbook.infradead.org>
References: <4B202329.8000806@free.fr>	
	<1260400389.14512.2609.camel@macbook.infradead.org>	
	<1260434725.4b20b5255dc67@imp.free.fr>	
	<1260441563.14512.3426.camel@macbook.infradead.org>	
	<4B2165D0.7060403@free.fr>
	<1260481141.14512.5272.camel@macbook.infradead.org>
Message-ID: <4B22020D.6000800@free.fr>

David Woodhouse wrote:

> Can't you run Linux binaries on Solaris? Other people have been looking
> into what that shell script is actually doing, and it should be fairly
> simple to just make something that posts an 'Accepted' or 'OK' response
> to let you login proceed.

Yes and no. There's an old, old tool called lxrun which basically did 
syscall translation (back in the days of Red Hat 6 or thereabouts). I 
can't imagine it would work now. Otherwise there are 'branded zones'. 
I've never tried using one (branded or not), and I don't know if the vpn 
would be limited to the zone or not.

 From what I can see, the script extracts 1 binary, csd, which ends up 
in  ~/.cisco. csd seems to communicate back to the concentrator using 
http and Virata-EmWeb, and it downloads and executes another binary, 
hostscan. Also in ~/.cisco there are log files. hostscan seems to do 
some checking (firewall, antivirus, open ports), and also communicates 
over http. Looking in the log, it seems to connect once every minute.

[dtls warning]

> No, it should work without; just less efficiently. The openconnect web
> page has a link to an explanation of why TCP over TCP is bad.

>>and this remains, but with my employer's domain added to the line. That 
>>doesn't seem right to me (though perhaps harmless).
> 
> Harmless. Do you have nameservers listed in the file?

Yes, 2, belonging to my employer, it seemed correct to me so I didn't 
mention it.

> By default, openconnect won't do any routing setup. It expects you to
> use a script for that, and it's compatible with the one from vpnc. Did
> you use that?

Yes, I used the vpnc-script from the link on the openconnect website.

> Does look like you're using some kind of routing script.
> 
> So what does the routing look like when you're connected? Can you try
> basic IP connectivity first, and then debug DNS once you've sure that's
> working?

The IP connectivity is fine. E.g., I managed to connect to a VNC by 
using the IP address obtained by nslookup, but it didn't work with 
vncviewer and the human readable address.

A+
Paul
-- 
Paul Floyd                 http://paulf.free.fr




From dwmw2 at infradead.org  Fri Dec 11 04:53:43 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Fri, 11 Dec 2009 09:53:43 +0000
Subject: Getting started
In-Reply-To: <4B22020D.6000800@free.fr>
References: <4B202329.8000806@free.fr>
	<1260400389.14512.2609.camel@macbook.infradead.org>
	<1260434725.4b20b5255dc67@imp.free.fr>
	<1260441563.14512.3426.camel@macbook.infradead.org>
	<4B2165D0.7060403@free.fr>
	<1260481141.14512.5272.camel@macbook.infradead.org>
	<4B22020D.6000800@free.fr>
Message-ID: <1260525223.14512.7501.camel@macbook.infradead.org>

On Fri, 2009-12-11 at 09:25 +0100, Paul Floyd wrote:
> David Woodhouse wrote:
> 
> > Can't you run Linux binaries on Solaris? Other people have been looking
> > into what that shell script is actually doing, and it should be fairly
> > simple to just make something that posts an 'Accepted' or 'OK' response
> > to let you login proceed.
> 
> Yes and no. There's an old, old tool called lxrun which basically did 
> syscall translation (back in the days of Red Hat 6 or thereabouts). I 
> can't imagine it would work now. Otherwise there are 'branded zones'. 
> I've never tried using one (branded or not), and I don't know if the vpn 
> would be limited to the zone or not.
> 
>  From what I can see, the script extracts 1 binary, csd, which ends up 
> in  ~/.cisco. csd seems to communicate back to the concentrator using 
> http and Virata-EmWeb, and it downloads and executes another binary, 
> hostscan. Also in ~/.cisco there are log files. hostscan seems to do 
> some checking (firewall, antivirus, open ports), and also communicates 
> over http. Looking in the log, it seems to connect once every minute.

See earlier discussions on this list about what hostscan is actually
doing. It shouldn't be too hard to write a tool which emulates it
sufficiently well to allow your VPN login to complete.

> [dtls warning]
> 
> > No, it should work without; just less efficiently. The openconnect web
> > page has a link to an explanation of why TCP over TCP is bad.
> 
> >>and this remains, but with my employer's domain added to the line. That 
> >>doesn't seem right to me (though perhaps harmless).
> > 
> > Harmless. Do you have nameservers listed in the file?
> 
> Yes, 2, belonging to my employer, it seemed correct to me so I didn't 
> mention it.

OK -- so you were just querying the fact that your original search
domain is retained, while adding the new VPN-derived one? That's just
how vpnc-script does it.

> The IP connectivity is fine. E.g., I managed to connect to a VNC by 
> using the IP address obtained by nslookup, but it didn't work with 
> vncviewer and the human readable address.

OSX has a strange way of setting up DNS -- you don't just
edit /etc/resolv.conf. It's possible that that doesn't work correctly on
(recent versions of) OSX with vpnc-script. There have been reports of
that on the vpnc-devel mailing list too, recently. My version of
vpnc-script doesn't have any modifications for OSX.

-- 
dwmw2



From pal.dorogi at gmail.com  Thu Dec 17 17:43:22 2009
From: pal.dorogi at gmail.com (=?ISO-8859-1?Q?P=E1l_Dorogi?=)
Date: Fri, 18 Dec 2009 11:43:22 +1300
Subject: Proxy support patch
Message-ID: <a69cfd4e0912171443n5dc7c416xfc721dd35b1ce7ec@mail.gmail.com>

Hi,

I've created a patch for the openconnect-2.12 to allow connect to the target
host through a Proxy.
It's just a simple patch without any Proxy authentication feature.
More info can be found in the
http://ilapstech.blogspot.com/2009/12/add-proxy-support-to-openconnect.html

Cheers,

Pal
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20091218/8feb55b0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: openconnect-2.12_proxy.diff
Type: text/x-diff
Size: 7680 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20091218/8feb55b0/attachment.bin>

From dwmw2 at infradead.org  Fri Dec 18 04:19:56 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Fri, 18 Dec 2009 09:19:56 +0000
Subject: Proxy support patch
In-Reply-To: <a69cfd4e0912171443n5dc7c416xfc721dd35b1ce7ec@mail.gmail.com>
References: <a69cfd4e0912171443n5dc7c416xfc721dd35b1ce7ec@mail.gmail.com>
Message-ID: <1261127996.26352.33.camel@macbook.infradead.org>

On Fri, 2009-12-18 at 11:43 +1300, P?l Dorogi wrote:
> Hi,
> 
> I've created a patch for the openconnect-2.12 to allow connect to the
> target host through a Proxy.
> It's just a simple patch without any Proxy authentication feature.
> More info can be found in the
> http://ilapstech.blogspot.com/2009/12/add-proxy-support-to-openconnect.html

Looks good; thanks. A few comments...

It doesn't look like you've fixed the NetworkManager authentication
dialog to set the default proxy port, as main.c does. Perhaps it's
better to handle that in the connection code itself
(vpninfo->proxy_port?:"8080") rather than requiring the setup as you
have? But I'll settle for anything that doesn't make the NetworkManager
GUI segfault.

Don't you want to disable DTLS support when you connect through a proxy?
If direct TCP connections to port 443 don't work, then UDP surely isn't
going to either -- even if the server _would_ accept DTLS connections
from a different IP address to the CSTP connection, which I suspect it
doesn't.

You can't necessarily just use strchr(proxy,':') because that's going to
break parsing of IPv6 addresses. We need to make that work with a string
like '[2001:8b0:10b:1:21d:7dff:fe04:dbe2]:8080'

+ /* else the default one (1080) which is already set  will be used  */
Er, 8080? This isn't SOCKS support.

Shouldn't process_http_proxy() return zero for success, not 1?

This is going to immediately lead to feature requests / bug reports
about honouring an $http_proxy environment variable, and/or using
something like libproxy to "do the right thing" according to system-wide
configuration, including proxy autoconfig. Using libproxy ought to be
fairly simple, and it's small and simple enough that I think it's
reasonable to declare it an unconditional build dependency. Although
it's simple enough to have a fallback which just uses
getenv("http_proxy") if libproxy isn't available at build time.

It's going to lead to requests for SOCKS support too, but I can probably
do that later, if you want.

Oh, and ideally you'd send a patch made from the git repository, which
wouldn't include changes to the version.c file. But just excluding
version.c from the patch works too.

-- 
dwmw2



From pal.dorogi at gmail.com  Sat Dec 19 04:17:57 2009
From: pal.dorogi at gmail.com (=?ISO-8859-1?Q?P=E1l_Dorogi?=)
Date: Sat, 19 Dec 2009 22:17:57 +1300
Subject: Proxy support patch
In-Reply-To: <1261127996.26352.33.camel@macbook.infradead.org>
References: <a69cfd4e0912171443n5dc7c416xfc721dd35b1ce7ec@mail.gmail.com>
	<1261127996.26352.33.camel@macbook.infradead.org>
Message-ID: <a69cfd4e0912190117t2a98e2ddu6e155cee164a5391@mail.gmail.com>

2009/12/18 David Woodhouse <dwmw2 at infradead.org>

> On Fri, 2009-12-18 at 11:43 +1300, P?l Dorogi wrote:
> > Hi,
> >
> > I've created a patch for the openconnect-2.12 to allow connect to the
> > target host through a Proxy.
> > It's just a simple patch without any Proxy authentication feature.
> > More info can be found in the
> >
> http://ilapstech.blogspot.com/2009/12/add-proxy-support-to-openconnect.html
>
> Looks good; thanks. A few comments...
>
> It doesn't look like you've fixed the NetworkManager authentication
> dialog to set the default proxy port, as main.c does. Perhaps it's
> better to handle that in the connection code itself
> (vpninfo->proxy_port?:"8080") rather than requiring the setup as you
> have? But I'll settle for anything that doesn't make the NetworkManager
> GUI segfault.
>
> I just had a quick look at source and I haven't tried to understand all the
logic of all of the codes. I just pick up those things which I needed
urgently as this was just a quick solution for my problem.:) To tell the
truth, I didn't know that this great stuff is supporting the NetworkManager
either.:)


> Don't you want to disable DTLS support when you connect through a proxy?
> If direct TCP connections to port 443 don't work, then UDP surely isn't
> going to either -- even if the server _would_ accept DTLS connections
> from a different IP address to the CSTP connection, which I suspect it
> doesn't.
>
Yep, you must be right.


>
> You can't necessarily just use strchr(proxy,':') because that's going to
> break parsing of IPv6 addresses. We need to make that work with a string
> like '[2001:8b0:10b:1:21d:7dff:fe04:dbe2]:8080'
>
Yep, that's possible but I prefer just the full hostname based url format
instead, coz
the bunch of other features handling could make the source too complex.
But, the protocol://hostname:port  based would be acceptable too.
Of course I meant this above for proxy and not for the target host.


> + /* else the default one (1080) which is already set  will be used  */
> Er, 8080? This isn't SOCKS support.
>
Yep, It's  8080 as it's set in the header file.


>
> Shouldn't process_http_proxy() return zero for success, not 1?
>
Probably. I've learnt the C in the old days, where the TRUE was 1 and the
FALSE is 0. So, I tried to use the mix of the logic of your codes and my old
days things.:)
But the "... < 0" and the "return 0;" would have better choice.:)


> This is going to immediately lead to feature requests / bug reports
> about honouring an $http_proxy environment variable, and/or using
> something like libproxy to "do the right thing" according to system-wide
> configuration, including proxy autoconfig. Using libproxy ought to be
> fairly simple, and it's small and simple enough that I think it's
> reasonable to declare it an unconditional build dependency. Although
> it's simple enough to have a fallback which just uses
> getenv("http_proxy") if libproxy isn't available at build time.
>

> It's going to lead to requests for SOCKS support too, but I can probably
> do that later, if you want.
>
I don't think it's necessary as I think the SOCKS proxy is not commonly used
nowadays, but I might be false.

>
> Oh, and ideally you'd send a patch made from the git repository, which
> wouldn't include changes to the version.c file. But just excluding
> version.c from the patch works too.
>
> --
> dwmw2
>
> OK, I'll clean my patch a bit and add the getenv support too.
Cheers,

Pal
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20091219/db6f5929/attachment.htm>

From phallows at globemicro.com  Tue Dec 22 10:50:41 2009
From: phallows at globemicro.com (Phil Hallows)
Date: Tue, 22 Dec 2009 15:50:41 +0000
Subject: Failed to open HTTPS connection to ip:443
Message-ID: <4B30EAD1.3050408@globemicro.com>

All,

I'm not entirely sure if this is a problem with openconnect or a problem 
with the router, so apologies if I am incorrect.

# openconnect -v IP
Attempting to connect to IP
SSL negotiation with IP
Connected to HTTPS on IP
GET IP/
Got HTTP response: HTTP/1.1 303 See Other
Content-Type: text/html
Content-Length: 0
Location: https://IP:443/webvpn.html
Set-Cookie: webvpncontext=00 at firewall; path=/
Connection: Keep-Alive
getaddrinfo failed: Name or service not known
Failed to open HTTPS connection to IP:443
Failed to obtain WebVPN cookie

It seems that getaddrinfo in ssl.c is looking up firstly just the IP 
with the provided port, then a second time around it looks up the 
hostname "IP:443", and fails.

strace shows dns lookups to "IP:443.mydomain" as well.

However, it seems odd to me that no one else has noticed, so must be 
something I am doing wrong? I've tried the latest tarball.

Is it a bug?

Many thanks,

-- 
Phil Hallows
Globe Microsystems

Globe?s office will be closed over the Christmas period, from 12pm on Thursday 24th December 2009 until 8.45am on Monday 4th January 2009.

Globe Microsystems Limited is registered in England and Wales with
company number 2581610 and VAT registration GB849738662.
This message is intended only for the use of the person(s) ("The intended
recipient(s)") to whom it is addressed. It may contain information,
which is privileged and confidential within the meaning of applicable
law. If you are not the intended recipient, please contact the sender
as soon as possible. The views expressed in this communication may
not necessarily be the views held by Globe Microsystems Limited. Any
attachment software files will be subject to the license agreement of
the relevant manufacturer. The information in this email was considered
valid at the time of sending, though may be subject to change or error,
therefore please request further confirmation if you intend to rely on
the contents hereof. Globe Microsystems Limited terms and conditions
apply to all transactions.


From dwmw2 at infradead.org  Tue Dec 22 14:09:25 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Tue, 22 Dec 2009 19:09:25 +0000 (GMT)
Subject: Failed to open HTTPS connection to ip:443
In-Reply-To: <4B30EAD1.3050408@globemicro.com>
References: <4B30EAD1.3050408@globemicro.com>
Message-ID: <alpine.LFD.2.00.0912221905150.5614@macbook.infradead.org>

On Tue, 22 Dec 2009, Phil Hallows wrote:
> This message is intended only for the use of the person(s) ("The intended
> recipient(s)") to whom it is addressed. It may contain information,
> which is privileged and confidential within the meaning of applicable
> law. If you are not the intended recipient, please contact the sender
> as soon as possible. The views expressed in this communication may
> not necessarily be the views held by Globe Microsystems Limited. Any
> attachment software files will be subject to the license agreement of
> the relevant manufacturer. The information in this email was considered
> valid at the time of sending, though may be subject to change or error,
> therefore please request further confirmation if you intend to rely on
> the contents hereof. Globe Microsystems Limited terms and conditions
> apply to all transactions.

I almost threw a patch together which ought to get you connected, but then 
noticed the above.

I provide a PUBLIC mailing list service; I consider the above 
'disclaimer' to be an abuse of the services I provide. As well as 
demonstrating a fairly comprehensive lack of understanding of relevant 
law.

Please do not _ever_ post nonsense like this to a public mailing list.

Ask again sensibly, and I'll attempt to fix the problem for you.

-- 
dwmw2



From dwmw2 at infradead.org  Wed Dec 23 18:18:19 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Wed, 23 Dec 2009 23:18:19 +0000
Subject: Proxy support patch
In-Reply-To: <a69cfd4e0912171443n5dc7c416xfc721dd35b1ce7ec@mail.gmail.com>
References: <a69cfd4e0912171443n5dc7c416xfc721dd35b1ce7ec@mail.gmail.com>
Message-ID: <1261610299.12559.69.camel@macbook.infradead.org>

On Fri, 2009-12-18 at 11:43 +1300, P?l Dorogi wrote:
> 
> +       buflen = read(ssl_sock, buf, MAX_BUF_LEN);
> +
> +       if ((buflen < 0) || strncmp(buf, "HTTP/1.1 200", 12)) { 

That isn't quite right either -- you have to be able to do multiple
reads until you have the response and the trailing \r\n\r\n. And are you
really refusing to deal with HTTP 1.0 proxies?

Oh, and shouldn't IPv6 literal addresses be wrapped in [] in the connect
request?

-- 
dwmw2



From dwmw2 at infradead.org  Thu Dec 24 19:41:39 2009
From: dwmw2 at infradead.org (David Woodhouse)
Date: Fri, 25 Dec 2009 00:41:39 +0000
Subject: Proxy support patch
In-Reply-To: <a69cfd4e0912190117t2a98e2ddu6e155cee164a5391@mail.gmail.com>
References: <a69cfd4e0912171443n5dc7c416xfc721dd35b1ce7ec@mail.gmail.com>
	<1261127996.26352.33.camel@macbook.infradead.org>
	<a69cfd4e0912190117t2a98e2ddu6e155cee164a5391@mail.gmail.com>
Message-ID: <1261701699.12559.122.camel@macbook.infradead.org>

On Sat, 2009-12-19 at 22:17 +1300, P?l Dorogi wrote:
> Yep, that's possible but I prefer just the full hostname based url
> format
> instead, coz
> the bunch of other features handling could make the source too
> complex.
> But, the protocol://hostname:port  based would be acceptable too.
> Of course I meant this above for proxy and not for the target host.

I provided a parse_url() function, which you should be able to use to
parse the $http_proxy environment variable or the values returned by
libproxy.

-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse at intel.com                              Intel Corporation



