Determining webvpn cookie lifetime?

[Dan Lenski]

Hi,

I'm writing a script which will periodically connect to several different 
AnyConnect VPNs, and I'm finding that the webvpn cookies for some of them 
become invalid much sooner than others... so I'm trying to figure out 
intelligently how often they have to be used to remain valid.

Is it possible for OpenConnect to determine the lifetime during which the 
webvpn cookie obtained in the authentication process will remain valid?

- Using the --dump-http-traffic and --cookieonly flags doesn't seem to
  provide any information about the lifetime of the webvpn cookie.

- After the VPN is actually setup with CONNECT, the --dump-http-traffic 
  headers appear to show some lifetime-related settings, e.g.:

    Got CONNECT response: HTTP/1.1 200 OK
    ...
    X-CSTP-Lease-Duration: 259200
    X-CSTP-Session-Timeout: 259200
    X-CSTP-Idle-Timeout: 1800
    X-CSTP-Disconnected-Timeout: 1800
    X-CSTP-Keep: true
    X-CSTP-DPD: 30
    X-CSTP-Keepalive: 20
    X-DTLS-Keepalive: 20
    X-DTLS-DPD: 30
    X-CSTP-TCP-Keepalive: true
    ...
    CSTP connected. DPD 30, Keepalive 20

Does one of these indicate how long the cookie will remain valid? My guess:

- CSTP-Session-Timeout indicates the time after which the session 
  will end no matter what (3 days here)
- CSTP-Idle-Timeout indicates the time after which the session will 
  end, with no traffic (30 minutes here)
- CSTP-Disconnected-Timeout indicates the time after which the cookie will
  become invalid, after disconnection (30 minutes here)

However, my testing appears to show that the server starts to reject the 
cookie (openconnect -C COOKIE) much sooner than any of these timeouts would 
indicate, a few minutes.

Thanks,
Dan