View Single Post
Posts: 5 | Thanked: 5 times | Joined on Jan 2010
#84
DTLS seems to be working here...

Code:
Nokia-N900:~# echo $COOKIE | /usr/bin/openconnect --cookie-on-stdin --script /usr/share/openconnect/vpnc-script --servercert 2C1104B703504606AB12813AFC315438B94F85BB $SERVER -v
Attempting to connect to x.x.x.x:443
SSL negotiation with x.x.x.x
Connected to HTTPS on x.x.x.x
Got CONNECT response: HTTP/1.1 200 OK
X-CSTP-Version: 1
X-CSTP-Address: 10.255.12.105
X-CSTP-Netmask: 255.255.252.0
X-CSTP-DNS: 10.248.2.1
X-CSTP-DNS: 10.19.1.12
X-CSTP-Lease-Duration: 172800
X-CSTP-Session-Timeout: 172800
X-CSTP-Idle-Timeout: 43200
X-CSTP-Disconnected-Timeout: 43200
X-CSTP-Split-Exclude: 0.0.0.0/255.255.255.255
X-CSTP-Keep: true
X-CSTP-Rekey-Time: 86400
X-CSTP-Rekey-Method: new-tunnel
X-CSTP-DPD: 30
X-CSTP-Keepalive: 15
X-CSTP-MSIE-Proxy-Lockdown: true
X-CSTP-Smartcard-Removal-Disconnect: true
X-CSTP-Content-Encoding: deflate
X-DTLS-Session-ID: 3BABE19A744F1298EFCFF084CC7268333C27FBA5C1727D56BE1D550C42F1C9E7
X-DTLS-Port: 443
X-DTLS-Keepalive: 15
X-DTLS-DPD: 30
X-DTLS-Rekey-Time: 86400
X-CSTP-MTU: 1266
X-DTLS-CipherSuite: AES128-SHA
X-CSTP-Routing-Filtering-Ignore: false
CSTP connected. DPD 30, Keepalive 15
DTLS option X-DTLS-Session-ID : 3BABE19A744F1298EFCFF084CC7268333C27FBA5C1727D56BE1D550C42F1C9E7
DTLS option X-DTLS-Port : 443
DTLS option X-DTLS-Keepalive : 15
DTLS option X-DTLS-DPD : 30
DTLS option X-DTLS-Rekey-Time : 86400
DTLS option X-DTLS-CipherSuite : AES128-SHA
DTLS connected. DPD 30, Keepalive 15
Connected tun0 as 10.255.12.105, using SSL + deflate
No work to do; sleeping for 14000 ms...
No work to do; sleeping for 14000 ms...
Established DTLS connection
No work to do; sleeping for 14000 ms...
Sent DTLS packet of 64 bytes; SSL_write() returned 65
No work to do; sleeping for 2000 ms...
Received DTLS packet 0x00 of 131 bytes
No work to do; sleeping for 2000 ms...
Sent DTLS packet of 83 bytes; SSL_write() returned 84
...
I object to using the --no-cert-check option; please don't do that. Instead, use the --servercert option to tell OpenConnect what the server's cert fingerprint *should* be. Then it doesn't need to validate it against the full CA trust chain.

Also, you shouldn't need to patch OpenConnect to accept a password on the command line. You can already just 'echo $PASSWORD | openconnect --passwd-on-stdin', and then the password doesn't sit around visible in ps(1) for the entire lifetime of the VPN session.

In fact, though, you shouldn't be giving the username/group/password/etc to OpenConnect at all. If you look at the command line above, that's basically what we should be doing. The *GUI* can handle the authentication, then all it needs to give openconnect is the server's address and cert, and the cookie.
 

The Following 2 Users Say Thank You to dwmw2 For This Useful Post: