[PATCH v5 1/2] enumerate supported VPN protocols via openconnect_get_supported_protocols()

[Daniel Lenski]

Add a new public function, openconnect_get_supported_protocols(), which
returns a list of protocols supported by the client.  Each supported
protocol has a short name (as accepted by the --protocol command-line
option), description, and list of flags.

The flags indicate features that are meaningful for this protocol, to be
used by tools like the Networkmanager configuration UI. Current flags:

  * OC_PROTO_PROXY: can connect via HTTP or SOCKS proxy
  * OC_PROTO_CSD: supports verification of the client via CSD trojan
  * OC_PROTO_AUTH_CERT: supports authentication by client certificate
  * OC_PROTO_AUTH_OTP: supports authentication by OATH HOTP/TOTP token
  * OC_PROTO_AUTH_STOKEN: supports authentication by RSA SecurID token (stoken)

Description of anyconnect protocol adjusted to match IETF draft
standard for openconnect VPN (https://tools.ietf.org/html/draft-mavrogiannopoulos-openconnect-00).

Signed-off-by: Daniel Lenski <dlenski at gmail.com>
---
 libopenconnect.map.in  |  5 +++++
 library.c              | 32 ++++++++++++++++++++++++++++++++
 openconnect-internal.h |  3 +++
 openconnect.h          | 23 +++++++++++++++++++++++
 4 files changed, 63 insertions(+)

diff --git a/libopenconnect.map.in b/libopenconnect.map.in
index 44eea34..749466c 100644
--- a/libopenconnect.map.in
+++ b/libopenconnect.map.in
@@ -92,6 +92,11 @@ OPENCONNECT_5_4 {
 	openconnect_set_pass_tos;
 } OPENCONNECT_5_3;
 
+OPENCONNECT_5_5 {
+ global:
+	openconnect_get_supported_protocols;
+} OPENCONNECT_5_4;
+
 OPENCONNECT_PRIVATE {
  global: @SYMVER_TIME@ @SYMVER_GETLINE@ @SYMVER_JAVA@ @SYMVER_ASPRINTF@ @SYMVER_VASPRINTF@ @SYMVER_WIN32_STRERROR@
 	openconnect_fopen_utf8;
diff --git a/library.c b/library.c
index 58ccf93..86b524a 100644
--- a/library.c
+++ b/library.c
@@ -109,6 +109,9 @@ err:
 const struct vpn_proto openconnect_protos[] = {
 	{
 		.name = "anyconnect",
+		.pretty_name = "Cisco AnyConnect or openconnect",
+		.description = "Compatible with Cisco AnyConnect SSL VPN, as well as ocserv",
+		.flags = OC_PROTO_PROXY | OC_PROTO_CSD | OC_PROTO_AUTH_CERT | OC_PROTO_AUTH_OTP | OC_PROTO_AUTH_STOKEN,
 		.vpn_close_session = cstp_bye,
 		.tcp_connect = cstp_connect,
 		.tcp_mainloop = cstp_mainloop,
@@ -122,6 +125,9 @@ const struct vpn_proto openconnect_protos[] = {
 #endif
 	}, {
 		.name = "nc",
+		.pretty_name = "Juniper Network Connect",
+		.description = "Compatible with Juniper Network Connect / Pulse Secure SSL VPN",
+		.flags = OC_PROTO_PROXY | OC_PROTO_CSD | OC_PROTO_AUTH_CERT | OC_PROTO_AUTH_OTP,
 		.vpn_close_session = oncp_bye,
 		.tcp_connect = oncp_connect,
 		.tcp_mainloop = oncp_mainloop,
@@ -137,6 +143,9 @@ const struct vpn_proto openconnect_protos[] = {
 #endif
 	}, {
 		.name = "gp",
+		.pretty_name = "Palo Alto Networks GlobalProtect",
+		.description = "Compatible with Palo Alto Networks (PAN) GlobalProtect SSL VPN",
+		.flags = OC_PROTO_PROXY | OC_PROTO_AUTH_CERT,
 		.vpn_close_session = gpst_bye,
 		.tcp_connect = gpst_setup,
 		.tcp_mainloop = gpst_mainloop,
@@ -154,6 +163,29 @@ const struct vpn_proto openconnect_protos[] = {
 	{ /* NULL */ }
 };
 
+int openconnect_get_supported_protocols(struct oc_vpn_proto **protos)
+{
+	struct oc_vpn_proto *pr;
+	const struct vpn_proto *p;
+
+	*protos = pr = calloc(sizeof(openconnect_protos)/sizeof(*openconnect_protos), sizeof(*pr));
+	if (!pr)
+		return -ENOMEM;
+
+	for (p = openconnect_protos; p->name; p++, pr++) {
+		pr->name = p->name;
+		pr->pretty_name = _(p->pretty_name);
+		pr->description = _(p->description);
+		pr->flags = p->flags;
+	}
+	return 0;
+}
+
+void openconnect_free_supported_protocols(struct oc_vpn_proto *protos)
+{
+	free((void *)protos);
+}
+
 int openconnect_set_protocol(struct openconnect_info *vpninfo, const char *protocol)
 {
 	const struct vpn_proto *p;
diff --git a/openconnect-internal.h b/openconnect-internal.h
index ee4edbd..67a122f 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -258,6 +258,9 @@ struct http_auth_state {
 
 struct vpn_proto {
 	const char *name;
+	const char *pretty_name;
+	const char *description;
+	unsigned int flags;
 	int (*vpn_close_session)(struct openconnect_info *vpninfo, const char *reason);
 
 	/* This does the full authentication, calling back as appropriate */
diff --git a/openconnect.h b/openconnect.h
index fc23c3c..f99a39c 100644
--- a/openconnect.h
+++ b/openconnect.h
@@ -36,6 +36,10 @@ extern "C" {
 #define OPENCONNECT_API_VERSION_MINOR 4
 
 /*
+ * API version 5.5:
+ *  - Add openconnect_get_supported_protocols()
+ *  - Add openconnect_free_supported_protocols()
+ *
  * API version 5.4 (v7.08; 2016-12-13):
  *  - Add openconnect_set_pass_tos()
  *
@@ -166,6 +170,23 @@ extern "C" {
 
 /****************************************************************************/
 
+/* Enumeration of supported VPN protocols */
+
+#define OC_PROTO_PROXY	(1<<0)
+#define OC_PROTO_CSD	(1<<1)
+#define OC_PROTO_AUTH_CERT	(1<<2)
+#define OC_PROTO_AUTH_OTP	(1<<3)
+#define OC_PROTO_AUTH_STOKEN	(1<<4)
+
+struct oc_vpn_proto {
+	const char *name;
+	const char *pretty_name;
+	const char *description;
+	unsigned int flags;
+};
+
+/****************************************************************************/
+
 /* Authentication form processing */
 
 #define OC_FORM_OPT_TEXT	1
@@ -640,6 +661,8 @@ int openconnect_has_oath_support(void);
 int openconnect_has_yubioath_support(void);
 int openconnect_has_system_key_support(void);
 
+int openconnect_get_supported_protocols(struct oc_vpn_proto **protos);
+void openconnect_free_supported_protocols(struct oc_vpn_proto *protos);
 int openconnect_set_protocol(struct openconnect_info *vpninfo, const char *protocol);
 
 struct addrinfo;
-- 
2.7.4