From dlenski at gmail.com  Mon Aug  2 10:51:31 2021
From: dlenski at gmail.com (Daniel Lenski)
Date: Mon, 2 Aug 2021 10:51:31 -0700
Subject: OpenConnect for Windows 1.5.3: TAP-Windows driver issues.
In-Reply-To: <1QIpce7i7AteyA8SVEzvFprey9pt9E5ilsdpEJaGCxZj88rxGLAnQd7aGATR6STS5w6gap5_lJBouFLdrqOqCCKRl4X-V3f1u1-qkos752I=@protonmail.com>
References: <1QIpce7i7AteyA8SVEzvFprey9pt9E5ilsdpEJaGCxZj88rxGLAnQd7aGATR6STS5w6gap5_lJBouFLdrqOqCCKRl4X-V3f1u1-qkos752I=@protonmail.com>
Message-ID: <CAOw_LSFyEVtyW_mj8LaPLuu2QwHefh0gdSFbkfRM+C0xA1qEdg@mail.gmail.com>

On Fri, Jul 23, 2021 at 12:13 AM Madobe Nanami
<Madobenanami at protonmail.com> wrote:
>
> 1. The integrated TAP driver (TAP-Windows 9.21.2) has no WHQL signature. On "UEFI Secure Boot" enabled Microsoft Windows, only WHQL drivers are allowed.
>
> [bunch of screenshots from OpenConnect-GUI installer]

OpenConnect-GUI has not been maintained in quite a while. It could
really use a new maintainer, since none of us core OpenConnect
developers use Windows much.

However, we *have* been updating the base OpenConnect library and CLI
application to use the better-maintained Wintun driver instead of
TAP-Windows. See:

- https://gitlab.com/openconnect/openconnect/-/commit/60d1f092e35f05217f1c96823c4f1b86c7915bbd
- https://gitlab.com/openconnect/openconnect/-/merge_requests/178

It would help us greatly to have more users test recent Windows builds
with Wintun support, in order to be able to include this change in an
upcoming release.

Thanks,
Dan


From antonio.petrelli at gmail.com  Tue Aug  3 01:21:44 2021
From: antonio.petrelli at gmail.com (Antonio Petrelli)
Date: Tue, 3 Aug 2021 10:21:44 +0200
Subject: Available for support for F5 + MFA
Message-ID: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>

Hello
At my firm we are using F5 and MFA from Microsoft. I noticed in the
website that, in case I have a different authentication than
username+password, it would be nice to contact you to add support for
a different authentication mechanism.
So here am I, feel free to contact me and I will try to assist you in
adding support.

Thanks for your hard work!

Antonio Petrelli


From dlenski at gmail.com  Tue Aug  3 08:02:36 2021
From: dlenski at gmail.com (Daniel Lenski)
Date: Tue, 3 Aug 2021 08:02:36 -0700
Subject: Available for support for F5 + MFA
In-Reply-To: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
Message-ID: <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>

On Tue, Aug 3, 2021 at 1:22 AM Antonio Petrelli
<antonio.petrelli at gmail.com> wrote:
> Hello
> At my firm we are using F5 and MFA from Microsoft. I noticed in the
> website that, in case I have a different authentication than
> username+password, it would be nice to contact you to add support for
> a different authentication mechanism.

Thanks! I suspect that this probably involves some kind of handoff
mechanism like SAML, as we already know of for the GlobalProtect and
AnyConnect protocols.

> So here am I, feel free to contact me and I will try to assist you in
> adding support.

Can you successfully login by visiting the login page in a browser,
then capturing whatever tokens result from it, and injecting those
into OpenConnect? (whether in the form of a surrogate one-time-use
password, or perhaps an MRHSession cookie)

If so, writing an external authentication wrapper script modeled on
https://github.com/dlenski/smxlogin would be a good place to start
here.

Dan


From antonio.petrelli at gmail.com  Tue Aug  3 09:08:36 2021
From: antonio.petrelli at gmail.com (Antonio Petrelli)
Date: Tue, 3 Aug 2021 18:08:36 +0200
Subject: Available for support for F5 + MFA
In-Reply-To: <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
Message-ID: <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>

Hello again
>From now on, the edited values are between <angle-brackets>, but the
rest is literal.?
Ok after login, I land on a page that says "Connect to VPN".
Clicking on it this request is sent:

GET /vdesk/get_token_for_sessid.php3 HTTP/1.0
Host: <corporate-vpn-host-name>
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0)
Gecko/20100101 Firefox/90.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://<corporate-vpn-host-name>/vdesk/webtop.eui?webtop=/Common/Portal_<CORPORATE-VPN-HOST-NAME-IN-UPPERCASE>_Webtop&webtop_type=webtop_full
Cookie: LastMRH_Session=<4-bytes-hex-encoded>; TIN=66000;
MRHSession=<MRHSession-Cookie>; F5_ST=<F5-ST-Cookie>; F5_fullWT=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

And the response (empty) is:
HTTP/1.0 200 OK
Server: BigIP
Content-Length: 0
X-ACCESS-Session-Token: <access-session-token>
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close

Now a resource is going to be opened by f5vpn. The resource is:

f5-vpn://<corporate-vpn-host-name>?server=<corporate-vpn-host-name>&resourcename=/Common/SSL_VPN_Portal_Import-<id-variable-part>&resourcetype=network_access&cmd=launch&protocol=https&port=443&sid=nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn&token=<some-hex-encoded-value>&otc=<access-session-token>

Notice that the ID of the element <div> that contains the button is:
network_access:/Common/SSL_VPN_Portal_Import-<id-variable-part>

Notice that the value:
<some-hex-encoded-value>
for the token parameter in the f5-vpn URL seems to be always the same,
however I cannot see where it comes from.

What should I do now? How do I inject those codes in OpenConnect?

Thanks
Antonio


From dlenski at gmail.com  Wed Aug  4 09:08:11 2021
From: dlenski at gmail.com (Daniel Lenski)
Date: Wed, 4 Aug 2021 09:08:11 -0700
Subject: Available for support for F5 + MFA
In-Reply-To: <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
Message-ID: <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>

On Tue, Aug 3, 2021 at 9:08 AM Antonio Petrelli
<antonio.petrelli at gmail.com> wrote:
>
> Hello again
> From now on, the edited values are between <angle-brackets>, but the
> rest is literal.?
> Ok after login, I land on a page that says "Connect to VPN".
>
> Clicking on it this request is sent:
>
> GET /vdesk/get_token_for_sessid.php3 HTTP/1.0
> Host: <corporate-vpn-host-name>
> User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0)
> Gecko/20100101 Firefox/90.0
> Accept: */*
> Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
> Accept-Encoding: gzip, deflate, br
> DNT: 1
> Connection: keep-alive
> Referer: https://<corporate-vpn-host-name>/vdesk/webtop.eui?webtop=/Common/Portal_<CORPORATE-VPN-HOST-NAME-IN-UPPERCASE>_Webtop&webtop_type=webtop_full
> Cookie: LastMRH_Session=<4-bytes-hex-encoded>; TIN=66000;
> MRHSession=<MRHSession-Cookie>; F5_ST=<F5-ST-Cookie>; F5_fullWT=1
> Sec-Fetch-Dest: empty
> Sec-Fetch-Mode: cors
> Sec-Fetch-Site: same-origin

Since you've already arrived at the "webtop" interface, you've already
completed the login process and you already have the credential (the
cookie named 'MRHSession') which OpenConnect requires to be able to
actually configure and connect to the VPN tunnel.

I believe you should be able to simply capture the value of
<MRHSession-Cookie> (using the browser dev tools), and then run
OpenConnect as follows:

    openconnect --dump -vvvv --prot=f5 \
      --cookie "MRHSession=<MRHSession-Cookie>" \
      <corporate-vpn-host-name>

(Important: do NOT close the browser window before running this
command; that may cause it to logoff the session and invalidate the
cookie)

I'll wager 70% odds that this Just Works. If that doesn't work, then I
guess we'll have to figure out what the "token" and
"access-session-token" values mean, and how they get used by the f5vpn
binary.

Dan


From antonio.petrelli at gmail.com  Wed Aug  4 09:44:07 2021
From: antonio.petrelli at gmail.com (Antonio Petrelli)
Date: Wed, 4 Aug 2021 18:44:07 +0200
Subject: Available for support for F5 + MFA
In-Reply-To: <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
 <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
Message-ID: <CAHTRney8W4PmPpM4LTGwH_xXwGGbnx3hw+hZ1wQHp0AF86LG6Q@mail.gmail.com>

Il giorno mer 4 ago 2021 alle ore 18:08 Daniel Lenski
<dlenski at gmail.com> ha scritto:
>
> Since you've already arrived at the "webtop" interface, you've already
> completed the login process and you already have the credential (the
> cookie named 'MRHSession') which OpenConnect requires to be able to
> actually configure and connect to the VPN tunnel.
>
> I believe you should be able to simply capture the value of
> <MRHSession-Cookie> (using the browser dev tools), and then run
> OpenConnect as follows:
>
>     openconnect --dump -vvvv --prot=f5 \
>       --cookie "MRHSession=<MRHSession-Cookie>" \
>       <corporate-vpn-host-name>
>
> (Important: do NOT close the browser window before running this
> command; that may cause it to logoff the session and invalidate the
> cookie)
>
> I'll wager 70% odds that this Just Works. If that doesn't work, then I
> guess we'll have to figure out what the "token" and
> "access-session-token" values mean, and how they get used by the f5vpn
> binary.

OK thanks, the part that I missed is how to send this cookie.
About testing I have a few questions because the site is confusing to me:
1. Are there any nightly pre-built binaries of the source code?
2. If not, what is the repository, the one at infradead.org or the one
at GitLab?
3. What branch should I use, master?

In the meantime I am cloning the GitLab repository at master, since it
seems the most updated, but correct me if I am wrong!

I will let you know about the tests, thanks again!

Antonio


From dwmw2 at infradead.org  Wed Aug  4 09:48:10 2021
From: dwmw2 at infradead.org (David Woodhouse)
Date: Wed, 04 Aug 2021 17:48:10 +0100
Subject: Available for support for F5 + MFA
In-Reply-To: <CAHTRney8W4PmPpM4LTGwH_xXwGGbnx3hw+hZ1wQHp0AF86LG6Q@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
 <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
 <CAHTRney8W4PmPpM4LTGwH_xXwGGbnx3hw+hZ1wQHp0AF86LG6Q@mail.gmail.com>
Message-ID: <131A8ABC-DAB5-45A4-9D02-F513FEDAB75B@infradead.org>



On 4 August 2021 17:44:07 BST, Antonio Petrelli <antonio.petrelli at gmail.com> wrote:
>Il giorno mer 4 ago 2021 alle ore 18:08 Daniel Lenski
><dlenski at gmail.com> ha scritto:
>>
>> Since you've already arrived at the "webtop" interface, you've already
>> completed the login process and you already have the credential (the
>> cookie named 'MRHSession') which OpenConnect requires to be able to
>> actually configure and connect to the VPN tunnel.
>>
>> I believe you should be able to simply capture the value of
>> <MRHSession-Cookie> (using the browser dev tools), and then run
>> OpenConnect as follows:
>>
>>     openconnect --dump -vvvv --prot=f5 \
>>       --cookie "MRHSession=<MRHSession-Cookie>" \
>>       <corporate-vpn-host-name>
>>
>> (Important: do NOT close the browser window before running this
>> command; that may cause it to logoff the session and invalidate the
>> cookie)
>>
>> I'll wager 70% odds that this Just Works. If that doesn't work, then I
>> guess we'll have to figure out what the "token" and
>> "access-session-token" values mean, and how they get used by the f5vpn
>> binary.
>
>OK thanks, the part that I missed is how to send this cookie.
>About testing I have a few questions because the site is confusing to me:
>1. Are there any nightly pre-built binaries of the source code?
>2. If not, what is the repository, the one at infradead.org or the one
>at GitLab?
>3. What branch should I use, master?
>
>In the meantime I am cloning the GitLab repository at master, since it
>seems the most updated, but correct me if I am wrong!
>
>I will let you know about the tests, thanks again!

There are automatic builds for Fedora (and cross-builds for Windows in MinGW RPM packages) at https://copr.fedorainfracloud.org/coprs/dwmw2/openconnect/

Yes, the master branch is correct. Usually git.infradead.org and gitlab are in sync but not today.

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.


From antonio.petrelli at gmail.com  Wed Aug  4 10:00:55 2021
From: antonio.petrelli at gmail.com (Antonio Petrelli)
Date: Wed, 4 Aug 2021 19:00:55 +0200
Subject: Available for support for F5 + MFA
In-Reply-To: <131A8ABC-DAB5-45A4-9D02-F513FEDAB75B@infradead.org>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
 <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
 <CAHTRney8W4PmPpM4LTGwH_xXwGGbnx3hw+hZ1wQHp0AF86LG6Q@mail.gmail.com>
 <131A8ABC-DAB5-45A4-9D02-F513FEDAB75B@infradead.org>
Message-ID: <CAHTRnewdtEUpS2MZ6gDXuFWD7hT-aGbExPbZHcECjQaC+KaEGw@mail.gmail.com>

Il giorno mer 4 ago 2021 alle ore 18:48 David Woodhouse
<dwmw2 at infradead.org> ha scritto:

> There are automatic builds for Fedora (and cross-builds for Windows in MinGW RPM packages) at https://copr.fedorainfracloud.org/coprs/dwmw2/openconnect/

Too bad, I am using Kubuntu, no problem though, I can still compile it myself.

> Yes, the master branch is correct. Usually git.infradead.org and gitlab are in sync but not today.

OK, I suppose that I should use gitlab, right?

Notice that I am not a C developer, but a Java one, so go easy on me :-)

Thanks again
Antonio


From antonio.petrelli at gmail.com  Wed Aug  4 10:29:32 2021
From: antonio.petrelli at gmail.com (Antonio Petrelli)
Date: Wed, 4 Aug 2021 19:29:32 +0200
Subject: Available for support for F5 + MFA
In-Reply-To: <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
 <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
Message-ID: <CAHTRneydS=ikwuG3mFaw+0qxez1S794SJFYcM5Wv6sv3vrXu1w@mail.gmail.com>

Il giorno mer 4 ago 2021 alle ore 18:08 Daniel Lenski
<dlenski at gmail.com> ha scritto:
>
me-origin
>
> Since you've already arrived at the "webtop" interface, you've already
> completed the login process and you already have the credential (the
> cookie named 'MRHSession') which OpenConnect requires to be able to
> actually configure and connect to the VPN tunnel.
>
> I believe you should be able to simply capture the value of
> <MRHSession-Cookie> (using the browser dev tools), and then run
> OpenConnect as follows:
>
>     openconnect --dump -vvvv --prot=f5 \
>       --cookie "MRHSession=<MRHSession-Cookie>" \
>       <corporate-vpn-host-name>
>
> (Important: do NOT close the browser window before running this
> command; that may cause it to logoff the session and invalidate the
> cookie)
>
> I'll wager 70% odds that this Just Works. If that doesn't work, then I
> guess we'll have to figure out what the "token" and
> "access-session-token" values mean, and how they get used by the f5vpn
> binary.

Ok I managed to run it but, unfortunately, the result is this one:

$> sudo ./openconnect --dump -vvvv --protocol=f5 --cookie
"MRHSession=<mrhsession-cookie>" <corporate-vpn-host-name>

GET https://<corporate-vpn-host-name>/vdesk/vpn/index.php3?outform=xml&client_version=2.0
Attempting to connect to server <corporate-vpn-ip-address>:443
Connected to <corporate-vpn-ip-address>:443
SSL negotiation with <corporate-vpn-host-name>
Matched peer certificate subject name '*.<corporate-domain>'
Connected to HTTPS on <corporate-vpn-host-name> with ciphersuite
TLSv1.3-TLS_AES_128_GCM_SHA256
> GET /vdesk/vpn/index.php3?outform=xml&client_version=2.0 HTTP/1.1
> Host: <corporate-vpn-host-name>
> User-Agent: Open AnyConnect VPN Agent v8.10-632-gc7403272
> Cookie: MRHSession=<mrhsession-cookie>
>
Got HTTP response: HTTP/1.0 302 Found
Server: BigIP
Cache-Control: no-cache, no-store
Content-Length: 0
Location: /my.logout.php3?errorcode=20
Set-Cookie: LastMRH_Session=<lastmrh-session-cookie>;path=/;secure
Set-Cookie: MRHSession=<elided>;path=/;secure
Connection: close
HTTP body length:  (0)
EPOLL_CTL_DEL: File o directory non esistente
Creating SSL connection failed
Unknown error; exiting.

-----

Obviously the web page has been open all the time but, after the
command, if I refresh the browser page, I've been logged out
Notice that I compiled the project only with necessary things.

Let me know what to do from here.

Thanks
Antonio


From antonio.petrelli at gmail.com  Wed Aug  4 10:40:56 2021
From: antonio.petrelli at gmail.com (Antonio Petrelli)
Date: Wed, 4 Aug 2021 19:40:56 +0200
Subject: Available for support for F5 + MFA
In-Reply-To: <CAHTRneydS=ikwuG3mFaw+0qxez1S794SJFYcM5Wv6sv3vrXu1w@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
 <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
 <CAHTRneydS=ikwuG3mFaw+0qxez1S794SJFYcM5Wv6sv3vrXu1w@mail.gmail.com>
Message-ID: <CAHTRnez5+UFYBxMK0v63DB83i4vT5b42QaDFR8qbzCre+M=ghg@mail.gmail.com>

Il giorno mer 4 ago 2021 alle ore 19:29 Antonio Petrelli
<antonio.petrelli at gmail.com> ha scritto:
>
> Il giorno mer 4 ago 2021 alle ore 18:08 Daniel Lenski
> <dlenski at gmail.com> ha scritto:
> >
> me-origin
> >
> > Since you've already arrived at the "webtop" interface, you've already
> > completed the login process and you already have the credential (the
> > cookie named 'MRHSession') which OpenConnect requires to be able to
> > actually configure and connect to the VPN tunnel.
> >
> > I believe you should be able to simply capture the value of
> > <MRHSession-Cookie> (using the browser dev tools), and then run
> > OpenConnect as follows:
> >
> >     openconnect --dump -vvvv --prot=f5 \
> >       --cookie "MRHSession=<MRHSession-Cookie>" \
> >       <corporate-vpn-host-name>
> >
> > (Important: do NOT close the browser window before running this
> > command; that may cause it to logoff the session and invalidate the
> > cookie)
> >
> > I'll wager 70% odds that this Just Works. If that doesn't work, then I
> > guess we'll have to figure out what the "token" and
> > "access-session-token" values mean, and how they get used by the f5vpn
> > binary.
>
> Ok I managed to run it but, unfortunately, the result is this one:
>
> $> sudo ./openconnect --dump -vvvv --protocol=f5 --cookie
> "MRHSession=<mrhsession-cookie>" <corporate-vpn-host-name>
>
> GET https://<corporate-vpn-host-name>/vdesk/vpn/index.php3?outform=xml&client_version=2.0
> Attempting to connect to server <corporate-vpn-ip-address>:443
> Connected to <corporate-vpn-ip-address>:443
> SSL negotiation with <corporate-vpn-host-name>
> Matched peer certificate subject name '*.<corporate-domain>'
> Connected to HTTPS on <corporate-vpn-host-name> with ciphersuite
> TLSv1.3-TLS_AES_128_GCM_SHA256
> > GET /vdesk/vpn/index.php3?outform=xml&client_version=2.0 HTTP/1.1
> > Host: <corporate-vpn-host-name>
> > User-Agent: Open AnyConnect VPN Agent v8.10-632-gc7403272
> > Cookie: MRHSession=<mrhsession-cookie>
> >
> Got HTTP response: HTTP/1.0 302 Found
> Server: BigIP
> Cache-Control: no-cache, no-store
> Content-Length: 0
> Location: /my.logout.php3?errorcode=20
> Set-Cookie: LastMRH_Session=<lastmrh-session-cookie>;path=/;secure
> Set-Cookie: MRHSession=<elided>;path=/;secure
> Connection: close
> HTTP body length:  (0)
> EPOLL_CTL_DEL: File o directory non esistente
> Creating SSL connection failed
> Unknown error; exiting.
>
> -----
>

OMG IT WORKED! It seems that the error before happens sometimes, but
it happens anyway sometimes because something is wrong server side.
Wait a bit, ignore the previous email, in the next one I will post another log.

Antonio


From antonio.petrelli at gmail.com  Wed Aug  4 10:56:57 2021
From: antonio.petrelli at gmail.com (Antonio Petrelli)
Date: Wed, 4 Aug 2021 19:56:57 +0200
Subject: Available for support for F5 + MFA
In-Reply-To: <CAHTRnez5+UFYBxMK0v63DB83i4vT5b42QaDFR8qbzCre+M=ghg@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
 <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
 <CAHTRneydS=ikwuG3mFaw+0qxez1S794SJFYcM5Wv6sv3vrXu1w@mail.gmail.com>
 <CAHTRnez5+UFYBxMK0v63DB83i4vT5b42QaDFR8qbzCre+M=ghg@mail.gmail.com>
Message-ID: <CAHTRneztPu3uUO0ncevGgDmpvrqxW6jyBsLiTvVp1Bjr22veVQ@mail.gmail.com>

Il giorno mer 4 ago 2021 alle ore 19:40 Antonio Petrelli
<antonio.petrelli at gmail.com> ha scritto:

> OMG IT WORKED! It seems that the error before happens sometimes, but
> it happens anyway sometimes because something is wrong server side.
> Wait a bit, ignore the previous email, in the next one I will post another log.

I have good news and bad news.
The good news is that I managed to make it work.
The bad news is that it works only if I connect via original f5vpn,
disconnect, then launch openconnect.
Probably the culprit is the access token.
What to do now?

So here's the log, I hope I edited all the needed things :-D

Thanks
Antonio

---------------------

GET https://<corporate-vpn-host-name>/vdesk/vpn/index.php3?outform=xml&client_version=2.0
Attempting to connect to server 77.241.209.42:443
Connected to 77.241.209.42:443
SSL negotiation with <corporate-vpn-host-name>
Matched peer certificate subject name '*.eng.it'
Connected to HTTPS on <corporate-vpn-host-name> with ciphersuite
TLSv1.3-TLS_AES_128_GCM_SHA256
> GET /vdesk/vpn/index.php3?outform=xml&client_version=2.0 HTTP/1.1
> Host: <corporate-vpn-host-name>
> User-Agent: Open AnyConnect VPN Agent v8.10-632-gc7403272
> Cookie: MRHSession=<mrhsession-cookie>
>
Got HTTP response: HTTP/1.1 200 OK
Server: BigIP
Content-Type: text/xml; charset=utf-8
Accept-Ranges: bytes
Connection: close
Date: Wed, 04 Aug 2021 17:40:13 GMT
Age:     173
Content-Length:        334
X-Frame-Options: DENY
Cache-Control: no-store
HTTP body length:  (334)
EPOLL_CTL_DEL: File o directory non esistente
< <?xml version="1.0" encoding="utf-8"?>
< <favorites type="VPN" limited="YES">
< <favorite id="/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA">
< <caption>SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA</caption>
< <name>/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA</name>
< <params>resourcename=/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA</params>
< </favorite>
< </favorites>
Got profile parameters
'resourcename=/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA'
GET https://<corporate-vpn-host-name>/vdesk/vpn/connect.php3?resourcename=/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA&outform=xml&client_version=2.0
SSL negotiation with <corporate-vpn-host-name>
Matched peer certificate subject name '*.eng.it'
Connected to HTTPS on <corporate-vpn-host-name> with ciphersuite
TLSv1.3-TLS_AES_128_GCM_SHA256
> GET /vdesk/vpn/connect.php3?resourcename=/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA&outform=xml&client_version=2.0 HTTP/1.1
> Host: <corporate-vpn-host-name>
> User-Agent: Open AnyConnect VPN Agent v8.10-632-gc7403272
> Cookie: MRHSession=<mrhsession-cookie>
>
Got HTTP response: HTTP/1.1 200 OK
Server: BigIP
Content-Type: text/html; charset=ISO-8859-1
Accept-Ranges: bytes
Connection: close
Date: Wed, 04 Aug 2021 17:40:13 GMT
Age:    5409
Content-Length:       5728
X-Frame-Options: DENY
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Cache-Control: no-store
HTTP body length:  (5728)
EPOLL_CTL_DEL: File o directory non esistente
< <?xml version="1.0" encoding="UTF-8" ?><favorite>
< <object ID="ur_Host"
CLASSID="CLSID:CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7"
CODEBASE="https://<corporate-vpn-host-name>/vdesk/terminal/urxshost.cab#version=7213,2021,527,649"
WIDTH="320" HEIGHT="240">
<     <ur_UI_URL>https://<corporate-vpn-host-name>/vdesk/webtop/index.html?S=<mrhsession-cookie></ur_UI_URL>
<     <ur_CLSID_URHOST>CLSID:E0FF21FA-B857-45C5-8621-F120A0C17FF2</ur_CLSID_URHOST>
<     <ur_CODEBASE_URHOST>https://<corporate-vpn-host-name>/public/download/urxhost.cab#version=7213,2021,527,649</ur_CODEBASE_URHOST>
<     <ur_CLSID_PROXY>CLSID:6C275925-A1ED-4DD2-9CEE-9823F5FDAA10</ur_CLSID_PROXY>
<     <ur_CODEBASE_PROXY>https://<corporate-vpn-host-name>/public/download/f5tunsrv.cab#version=7213,2021,527,649</ur_CODEBASE_PROXY>
<     <ur_CLSID>CLSID:2BCDB465-81F9-41CB-832C-8037A4064446</ur_CLSID>
<     <ur_CODEBASE>https://<corporate-vpn-host-name>/public/download/urxvpn.cab#version=7213,2021,527,649</ur_CODEBASE>
<     <ur_CLSID_PROXY_9X_NEW>CLSID:6C275925-A1ED-4DD2-9CEE-9823F5FDAA10</ur_CLSID_PROXY_9X_NEW>
<     <ur_CODEBASE_PROXY_9X_NEW>https://<corporate-vpn-host-name>/public/download/f5tunsrv.cab#version=7213,2021,527,649</ur_CODEBASE_PROXY_9X_NEW>
<     <ur_CODEBASE_PortRedirector>https://<corporate-vpn-host-name>/public/download/f5fltsrv.cab#version=7213,2021,527,649</ur_CODEBASE_PortRedirector>
<     <ur_CLSID_PortRedirector>service:F5FltSrv</ur_CLSID_PortRedirector>
<     <resources>https://<corporate-vpn-host-name>/public/download/utunres.cab#2003,6,4,1</resources>
<     <Session_ID><mrhsession-cookie></Session_ID>
<     <ur_SIDHASH><mrhsession-cookie></ur_SIDHASH>
<     <ur_Z>/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA</ur_Z>
<     <ur_name>/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA</ur_name>
<     <host0>127.0.0.1</host0>
<     <port0>44444</port0>
<     <ur_type>VPN</ur_type>
<     <ur_connect>auto</ur_connect>
<     <tunnel_host0><corporate-vpn-host-name></tunnel_host0>
<     <tunnel_port0>443</tunnel_port0>
<     <tunnel_protocol0>https</tunnel_protocol0>
<     <idle_session_timeout>900</idle_session_timeout>
<     <firepassserver0>/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA</firepassserver0>
<     <IPV4_0>1</IPV4_0>
<     <IPV6_0>0</IPV6_0>
<     <tunnel_dtls>1</tunnel_dtls>
<     <tunnel_port_dtls>4433</tunnel_port_dtls>
<     <DNS0><elided></DNS0>
<     <DNS6_0></DNS6_0>
<     <WINS0></WINS0>
<     <DNSSuffix0><elided></DNSSuffix0>
<     <DNSRegisterConnection0>1</DNSRegisterConnection0>
<     <DNSUseDNSSuffixForRegistration0>1</DNSUseDNSSuffixForRegistration0>
<     <SplitTunneling0>1</SplitTunneling0>
<     <LAN0><routing-info-elided> </LAN0>
<     <LAN6_0></LAN6_0>
<     <ExcludeSubnets0> </ExcludeSubnets0>
<     <ExcludeSubnets6_0> </ExcludeSubnets6_0>
<     <DNS_SPLIT0><elided></DNS_SPLIT0>
<     <ExcludeDomainNames0></ExcludeDomainNames0>
<     <AllowLocalSubnetAccess0>1</AllowLocalSubnetAccess0>
<     <AllowLocalDNSServersAccess0>0</AllowLocalDNSServersAccess0>
<     <AllowLocalDHCPAccess0>1</AllowLocalDHCPAccess0>
<
<
<     <ur_DoNotWarnUser>no</ur_DoNotWarnUser>
<     <AppLaunch00>&quot;reconnect_to_domain&quot; </AppLaunch00>
<
<     <ClientForMicrosoftNetworks0>1</ClientForMicrosoftNetworks0>
<     <FileAndPrinterSharingForMicrosoftNetworks0>1</FileAndPrinterSharingForMicrosoftNetworks0>
<     <EnforceDNSOrder0>ON</EnforceDNSOrder0>
<
<
<
<     <ur_disableClientCerts>no</ur_disableClientCerts>
<
<     <DontReportPolicy0>TRUE</DontReportPolicy0>
<     <ProcessTimeout0>-1</ProcessTimeout0>
<     <hdlc_framing>no</hdlc_framing>
<     <AutoReconnectIfDropped0>yes</AutoReconnectIfDropped0>
<     <tcp_reconnect_timeout0>900000</tcp_reconnect_timeout0>
<     <tcp_reconnect_delay0>200</tcp_reconnect_delay0>
<     <TrafficControl0></TrafficControl0>
<     <ur_PowerManagement>0</ur_PowerManagement>
<     <DisplayedBandwidth0>100000000</DisplayedBandwidth0>
<
<     <display_connect_msg0>NO</display_connect_msg0>
<     <ur_NetworkTunnelEnabled>yes</ur_NetworkTunnelEnabled>
<     <ur_OptimizedAppsEnabled>no</ur_OptimizedAppsEnabled>
<     <minimize_after_connect0>YES</minimize_after_connect0>
<     <ur_CtrlChannelEnabled>1</ur_CtrlChannelEnabled>
<     <ur_ISessionEnabled>1</ur_ISessionEnabled>
<     <display_connect_msg_txt0></display_connect_msg_txt0>
<     <display_connect_fallback_msg_txt0></display_connect_fallback_msg_txt0>
<     <display_routing_changes_txt0></display_routing_changes_txt0>
<     <display_process_check_txt0></display_process_check_txt0>
<     <display_registry_check_txt0></display_registry_check_txt0>
<     <display_config_error_txt0></display_config_error_txt0>
<     <display_os_patch_check_txt0></display_os_patch_check_txt0>
<     <display_ie_patch_check_txt0></display_ie_patch_check_txt0>
<     <display_pf_check_txt0></display_pf_check_txt0>
<
< </object>
< </favorite>
<
Idle timeout is 15 minutes
Got DNS server <elided>
Got search domain italy.itroot.adnet
Got SplitTunneling0 value of 1
Got split include route <elided>
...
DTLS is enabled on port 4433
Got ipv4 1 ipv6 0 hdlc 0 ur_Z
'/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA'
UDP SO_SNDBUF: 30000
DTLS handshake failed: 1
139969204090688:error:141E70BF:SSL
routines:tls_construct_client_hello:no protocols
available:../ssl/statem/statem_clnt.c:1112:
Set up UDP failed; using SSL instead
Delaying tunnel with reason: PPP negotiation
SSL negotiation with <corporate-vpn-host-name>
Matched peer certificate subject name '*.eng.it'
Connected to HTTPS on <corporate-vpn-host-name> with ciphersuite
TLSv1.3-TLS_AES_128_GCM_SHA256
> GET /myvpn?sess=<mrhsession-cookie>&hdlc_framing=no&ipv4=yes&ipv6=no&Z=/Common/SSL_VPN_Portal_Import-<CORPORATE-ELIDED>_NA&hostname=YW50b25pby1ONTNTVg== HTTP/1.1
> Host: <corporate-vpn-host-name>
> User-Agent: Open AnyConnect VPN Agent v8.10-632-gc7403272
>
Got HTTP response: HTTP/1.0 200 OK
Content-length: 0
X-VPN-client-IP: <elided>
Got Legacy IP address <elided>
X-VPN-server-IP: 1.1.1.1
TCP_INFO rcv mss 1436, snd mss 1448, adv mss 1448, pmtu 1500
Using base_mtu of 1500
After removing TCP/IPv4 headers, MTU of 1448
After removing protocol specific overhead (10 unpadded, 0 padded, 1
blocksize), MTU of 1438
Requesting calculated MTU of 1438
Sending our LCP/id 1 config request to server
PPP state transition from DEAD to ESTABLISH on TLS channel
Current PPP state: ESTABLISH (encap F5):
    in: asyncmap=0x00000000, lcp_opts=0, lcp_magic=0x00000000,
ipv4=0.0.0.0, ipv6=none
   out: asyncmap=0x00000000, lcp_opts=930, lcp_magic=0x732ed1fa,
ipv4=<elided>, ipv6=none, solicit_peerns=0, got_peerns=0
< 0000:  f5 00 00 1c ff 03 c0 21  01 01 00 18 01 04 05 77  |.......!.......w|
< 0010:  02 06 00 00 00 00 05 06  b9 ff cf 14 07 02 08 02  |................|
Received LCP/id 1 Configure-Request from server
Received MRU 1399 from server. Nak-offering larger MRU of 1438 (our MTU)
Received asyncmap of 0x00000000 from server
Received magic number of 0xb9ffcf14 from server
Received protocol field compression from server
Received address and control field compression from server
Nak LCP/id 1 config from server
Sending PPP LCP Configure-Request packet over TLS (id 1, 26 bytes total)
> 0000:  f5 00 00 16 ff 03 c0 21  01 01 00 12 01 04 05 9e  |.......!........|
> 0010:  05 06 73 2e d1 fa 07 02  08 02                    |..s.......|
Sending PPP LCP Configure-Nak packet over TLS (id 1, 16 bytes total)
> 0000:  f5 00 00 0c ff 03 c0 21  03 01 00 08 01 04 05 9e  |.......!........|
Delaying tunnel with reason: DTLS connection pending
No work to do; sleeping for 1000 ms...
Delaying tunnel with reason: PPP negotiation
< 0000:  f5 00 00 16 ff 03 c0 21  02 01 00 12 01 04 05 9e  |.......!........|
< 0010:  05 06 73 2e d1 fa 07 02  08 02                    |..s.......|
Received LCP/id 1 Configure-Ack from server
No work to do; sleeping for 1000 ms...
Delaying tunnel with reason: PPP negotiation
< 0000:  f5 00 00 1c ff 03 c0 21  01 02 00 18 01 04 05 9e  |.......!........|
< 0010:  02 06 00 00 00 00 05 06  b9 ff cf 14 07 02 08 02  |................|
Received LCP/id 2 Configure-Request from server
Received MRU 1438 from server. Setting our MTU to match.
Received asyncmap of 0x00000000 from server
Received magic number of 0xb9ffcf14 from server
Received protocol field compression from server
Received address and control field compression from server
Ack LCP/id 2 config from server
Sending our IPCP/id 1 config request to server
PPP state transition from ESTABLISH to OPENED on TLS channel
Current PPP state: OPENED (encap F5):
    in: asyncmap=0x00000000, lcp_opts=384, lcp_magic=0xb9ffcf14,
ipv4=0.0.0.0, ipv6=none
   out: asyncmap=0x00000000, lcp_opts=418, lcp_magic=0x732ed1fa,
ipv4=<elided>, ipv6=none, solicit_peerns=0, got_peerns=0
Sending PPP LCP Configure-Ack packet over TLS (id 2, 32 bytes total)
> 0000:  f5 00 00 1c ff 03 c0 21  02 02 00 18 01 04 05 9e  |.......!........|
> 0010:  02 06 00 00 00 00 05 06  b9 ff cf 14 07 02 08 02  |................|
Sending PPP IPCP Configure-Request packet over TLS (id 1, 16 bytes total)
> 0000:  f5 00 00 0c 80 21 01 01  00 0a 03 06 a1 1b 3d e4  |.....!........=.|
No work to do; sleeping for 1000 ms...
Delaying tunnel with reason: PPP negotiation
< 0000:  f5 00 00 0c ff 03 c0 21  09 00 00 08 b9 ff cf 14  |.......!........|
Received LCP/id 0 Echo-Request from server
< 0000:  f5 00 00 0c 80 21 01 01  00 0a 03 06 01 01 01 01  |.....!..........|
Received IPCP/id 1 Configure-Request from server
Received peer IPv4 address 1.1.1.1 from server
Ack IPCP/id 1 config from server
< 0000:  f5 00 00 10 80 57 01 01  00 0e 01 0a 58 92 fc 2f  |.....W......X../|
< 0010:  4f f5 00 8d                                       |O...|
Sending Protocol-Reject for IP6CP. Payload:
> 0000:  01 01 00 0e 01 0a 58 92  fc 2f 4f f5 00 8d        |......X../O...|
< 0000:  f5 00 00 0c 80 21 02 01  00 0a 03 06 a1 1b 3d e4  |.....!........=.|
Received IPCP/id 1 Configure-Ack from server
PPP state transition from OPENED to NETWORK on TLS channel
Current PPP state: NETWORK (encap F5):
    in: asyncmap=0x00000000, lcp_opts=384, lcp_magic=0xb9ffcf14,
ipv4=1.1.1.1, ipv6=none
   out: asyncmap=0x00000000, lcp_opts=418, lcp_magic=0x732ed1fa,
ipv4=<elided>, ipv6=none, solicit_peerns=0, got_peerns=0
Sending PPP LCP Echo-Reply packet over TLS (id 0, 16 bytes total)
> 0000:  f5 00 00 0c ff 03 c0 21  0a 00 00 08 73 2e d1 fa  |.......!....s...|
Sending PPP IPCP Configure-Ack packet over TLS (id 1, 16 bytes total)
> 0000:  f5 00 00 0c 80 21 02 01  00 0a 03 06 01 01 01 01  |.....!..........|
Sending PPP LCP Protocol-Reject packet over TLS (id 2, 28 bytes total)
> 0000:  f5 00 00 18 ff 03 c0 21  08 02 00 14 80 57 01 01  |.......!.....W..|
> 0010:  00 0e 01 0a 58 92 fc 2f  4f f5 00 8d              |....X../O...|


From dlenski at gmail.com  Tue Aug 10 17:41:23 2021
From: dlenski at gmail.com (Daniel Lenski)
Date: Tue, 10 Aug 2021 17:41:23 -0700
Subject: Available for support for F5 + MFA
In-Reply-To: <CAHTRneztPu3uUO0ncevGgDmpvrqxW6jyBsLiTvVp1Bjr22veVQ@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
 <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
 <CAHTRneydS=ikwuG3mFaw+0qxez1S794SJFYcM5Wv6sv3vrXu1w@mail.gmail.com>
 <CAHTRnez5+UFYBxMK0v63DB83i4vT5b42QaDFR8qbzCre+M=ghg@mail.gmail.com>
 <CAHTRneztPu3uUO0ncevGgDmpvrqxW6jyBsLiTvVp1Bjr22veVQ@mail.gmail.com>
Message-ID: <CAOw_LSHwOtadCsir=aSanRmoNhDS-7jirUm49jB6qyxieJ6bvA@mail.gmail.com>

On Wed, Aug 4, 2021 at 10:57 AM Antonio Petrelli
<antonio.petrelli at gmail.com> wrote:
>
> Il giorno mer 4 ago 2021 alle ore 19:40 Antonio Petrelli
> <antonio.petrelli at gmail.com> ha scritto:
>
> > > OMG IT WORKED! It seems that the error before happens sometimes, but
> > it happens anyway sometimes because something is wrong server side.
> > Wait a bit, ignore the previous email, in the next one I will post another log.
>
> I have good news and bad news.
> The good news is that I managed to make it work.
> The bad news is that it works only if I connect via original f5vpn,
> disconnect, then launch openconnect.

That's interesting.

>> Probably the culprit is the access token.

My guess is that when the f5vpn executable launches, it sends
additional request(s) to the server to somehow activate/enable the
MRHSession cookie to be used for the VPN tunnel?

> GET /vdesk/get_token_for_sessid.php3 HTTP/1.0
> ... bunch of other headers ...
> Cookie: LastMRH_Session=<4-bytes-hex-encoded>; TIN=66000; MRHSession=<MRHSession-Cookie>; F5_ST=<F5-ST-Cookie>; F5_fullWT=1
>
> Now a resource is going to be opened by f5vpn. The resource is:
>
f5-vpn://<corporate-vpn-host-name>?server=<corporate-vpn-host-name>&resourcename=/Common/SSL_VPN_Portal_Import-<id-variable-part>&resourcetype=network_access&cmd=launch&protocol=https&port=443&sid=nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn&token=<some-hex-encoded-value>&otc=<access-session-token>

Can you confirm that the value of the 'sid' field in the f5-vpn:// URI
precisely matches the value of the MRHSession cookie sent in the
get_token_for_sessid.php3 request seen in the browser login? My
expectation is YES, they should be identical. SID appears to be one of
the many names used inconsistently for this 32-hex-digit value.

> What to do now?

Do a MITM capture of the f5vpn binary, and figure out what request(s)
it sends involving the access-session-token value.

> So here's the log, I hope I edited all the needed things :-D

Looks good. For what it's worth, this log doesn't appear to reveal
anything that we don't already understand. The part that we don't
understand apparently *precedes* the requests and responses shown in
the log.

Thanks for working through this, and sorry for the slow response!
Dan


From antonio.petrelli at gmail.com  Mon Aug 23 03:31:25 2021
From: antonio.petrelli at gmail.com (Antonio Petrelli)
Date: Mon, 23 Aug 2021 12:31:25 +0200
Subject: Available for support for F5 + MFA
In-Reply-To: <CAOw_LSHwOtadCsir=aSanRmoNhDS-7jirUm49jB6qyxieJ6bvA@mail.gmail.com>
References: <CAHTRnezvUNY83cNCG7UeoHu5cnY4RtYgPvi6zsrT91pgOMaB6w@mail.gmail.com>
 <CAOw_LSGKE4OcbwZ1tgkshPFaomH77WkmQ3z7PfVANc0ZjC5HoA@mail.gmail.com>
 <CAHTRnezu53bYjpW8KM_tX+nRpVG8xBu-fjggxaVaJVWrAx+0zQ@mail.gmail.com>
 <CAOw_LSFXgycLW_cBtv-PaxPhY4_jE_PojJbFpo+=8TiB6VWk0Q@mail.gmail.com>
 <CAHTRneydS=ikwuG3mFaw+0qxez1S794SJFYcM5Wv6sv3vrXu1w@mail.gmail.com>
 <CAHTRnez5+UFYBxMK0v63DB83i4vT5b42QaDFR8qbzCre+M=ghg@mail.gmail.com>
 <CAHTRneztPu3uUO0ncevGgDmpvrqxW6jyBsLiTvVp1Bjr22veVQ@mail.gmail.com>
 <CAOw_LSHwOtadCsir=aSanRmoNhDS-7jirUm49jB6qyxieJ6bvA@mail.gmail.com>
Message-ID: <CAHTRnezDgqaNDu3ShG2txLzrsFu_31vLWR=hUBwQUiQ01K0dAw@mail.gmail.com>

Hello, sorry but I've been on holidays, so I apologize for my slow
response too :-D

Il giorno mer 11 ago 2021 alle ore 02:42 Daniel Lenski
<dlenski at gmail.com> ha scritto:
> f5-vpn://<corporate-vpn-host-name>?server=<corporate-vpn-host-name>&resourcename=/Common/SSL_VPN_Portal_Import-<id-variable-part>&resourcetype=network_access&cmd=launch&protocol=https&port=443&sid=nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn&token=<some-hex-encoded-value>&otc=<access-session-token>
>
> Can you confirm that the value of the 'sid' field in the f5-vpn:// URI
> precisely matches the value of the MRHSession cookie sent in the
> get_token_for_sessid.php3 request seen in the browser login? My
> expectation is YES, they should be identical. SID appears to be one of
> the many names used inconsistently for this 32-hex-digit value.

No, the sid value is literally nnnn...., this is pretty strange...

> > What to do now?
>
> Do a MITM capture of the f5vpn binary, and figure out what request(s)
> it sends involving the access-session-token value.

I managed to do it on 5th August, but then I went on holidays, so here
you can see the conversation log I managed to take:
https://pastebin.com/BpKWJDfL

The cool thing is that some of the parameters that are sent to f5vpn
via the f5-vpn://... URL seem not to be used, such as "sid".
I have some doubts about the ${f5stNotSetAnywhere} cookie, since it
seems not to be set anywhere...

Let me know your thoughts.

Thanks
Antonio


From cornfeedhobo at fuzzlabs.org  Sun Aug 29 09:27:11 2021
From: cornfeedhobo at fuzzlabs.org (cornfeedhobo)
Date: Sun, 29 Aug 2021 11:27:11 -0500
Subject: Network Manager, OpenConnect, and vpnc-scripts
Message-ID: <4699891.31r3eYUQgx@blackhawk.fuzzlabs.org>

Hello, I need some help debugging.

Overall goal:  I'm on ubuntu 20.04 and trying to get NetworkManager-
openconnect to work the same as when I invoke openconnect manually.

What works:  If I run openconnect with `sudo` then it all works as expected, 
meaning vpnc-script is executed and the returned routes are added to the 
system properly.

What does not work:  If I use network manager to start openconnect, only the 
default route is set and it appears that the helper binary is not invoking 
vpnc-scripts at all.

Current thinking:  Assuming I can get the helper script to invoke vpnc-script 
like it's supposed to (!!), the vpnc-script still does not have the necessary 
permissions to modify the system routing and requires privilege escalation 
that can't be done from a subprocess that is run as the nm-openconnect user. 
However, since NetworkManager is successfully setting the default route, I 
assume there is a NetworkManager API to add routes and that isn't being 
utilized.

Could someone help me debug this?

I'm also on OFTC IRC if someone wants to reach out for rapid iteration.




