openconnect

package module
v0.0.0-...-e0c9776 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: GPL-2.0 Imports: 78 Imported by: 0

Documentation

Overview

Portions of the AnyConnect multiple-certificate exchange are derived from OpenConnect commit 2035601b64a5360a46d18e08937e7f654b3230f2, auth.c prepare_multicert_response/post_multicert_response and openssl.c multicert_sign_data. OpenConnect is licensed LGPL-2.1-or-later.

This file contains a Go port of OpenConnect 9.21, lzs.c.

Copyright © 2008-2015 Intel Corporation. Author: David Woodhouse <dwmw2@infradead.org>

OpenConnect is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License version 2.1, as published by the Free Software Foundation. OpenConnect is distributed without any warranty; without even the implied warranty of merchantability or fitness for a particular purpose.

Portions of the RSA SecurID implementation are derived from libstoken commit 837e843e8850d14a5d49d799b066d61d04fd649a, src/securid.c. It follows securid_mac, v2_decode_token, v2_decrypt_seed, v3_decode_token, v3_decrypt_seed, and securid_compute_tokencode. Copyright 2012 Kevin Cernekee. libstoken is licensed LGPL-2.1-or-later.

Index

Constants

View Source 
const (
	AuthFormFieldText     = "text"
	AuthFormFieldPassword = "password"
	AuthFormFieldSelect   = "select"
)
View Source 
const (
	FlavorAnyConnect = "anyconnect"
	FlavorGP         = "gp"
	FlavorFortinet   = "fortinet"
	FlavorF5         = "f5"
	FlavorPulse      = "pulse"
	FlavorNC         = "nc"
)
View Source 
const (
	TokenModeTOTP   = "totp"
	TokenModeHOTP   = "hotp"
	TokenModeSToken = "stoken"
	TokenModeOIDC   = "oidc"

	CompressionModeStateless = "stateless"
	CompressionModeAll       = "all"
)
View Source 
const (
	TransportCSTP = "cstp"
	TransportGPST = "gpst"
	TransportTLS  = "tls"
	TransportDTLS = "dtls"
	TransportIFT  = "ift"
	TransportONCP = "oncp"
	TransportESP  = "esp"
)
View Source 
const PacketHeadroom = espFixedHeaderSize

Variables

View Source 
var (
	ErrMissingServer                = E.New("missing openconnect server")
	ErrUnsupportedFlavor            = E.New("unsupported openconnect flavor")
	ErrClientClosed                 = E.New("client is closed")
	ErrDataChannelNotReady          = E.New("data channel is not ready")
	ErrNoPendingAuthChallenge       = E.New("no pending openconnect authentication challenge")
	ErrAuthChallengeNotAnswerable   = E.New("authentication challenge does not accept a response")
	ErrAuthChallengeCanceled        = E.New("authentication challenge canceled")
	ErrInvalidAuthResponse          = E.New("invalid openconnect authentication response")
	ErrAuthenticationFailed         = E.New("authentication failed")
	ErrSessionRejected              = E.New("session rejected")
	ErrInvalidBrowserAuthentication = E.New("invalid openconnect browser authentication result")
	ErrMaterialSourceConflict       = E.New("material path and content are both set")
	ErrInvalidTLSMaterial           = E.New("invalid openconnect TLS material")
	ErrDeprecatedCryptoDisabled     = E.New("deprecated cryptography is disabled")
	ErrReconnectTimeout             = E.New("reconnect timeout exceeded")
	ErrProtocolNotSupported         = E.New("protocol behavior is not supported")
)

Functions

This section is empty.

Types

type AuthChallenge 

type AuthChallenge struct {
	ID      string
	Banner  string
	Message string
	Error   string
	Form    *AuthForm
	Browser *BrowserRequest
}

type AuthForm 

type AuthForm struct {
	Fields []AuthFormField
}

type AuthFormChoice 

type AuthFormChoice struct {
	Value string
	Label string
}

type AuthFormField 

type AuthFormField struct {
	SubmissionKey string
	Name          string
	Label         string
	Kind          string
	Value         string
	Options       []AuthFormChoice
}

type AuthFormResponse 

type AuthFormResponse struct {
	Values map[string]string
}

type AuthResponse 

type AuthResponse struct {
	Form    *AuthFormResponse
	Browser *BrowserResult
}

type BrowserCookie 

type BrowserCookie struct {
	Name  string
	Value string
}

type BrowserRequest 

type BrowserRequest struct {
	URL                 string
	FinalURL            string
	CallbackURLPrefixes []string
	CookieNames         []string
	EarlyCookieNames    []string
	HeaderNames         []string
}

type BrowserResult 

type BrowserResult struct {
	FinalURL string
	Cookies  []BrowserCookie
	Header   http.Header
}

type CSDOptions 

type CSDOptions struct {
	WrapperPath string
}

type Client 

type Client struct {
	// contains filtered or unexported fields
}

func NewClient 

func NewClient(options ClientOptions) (*Client, error)

func (*Client) ActiveTransport 

func (c *Client) ActiveTransport() string

func (*Client) ActiveTransportUpdated 

func (c *Client) ActiveTransportUpdated() <-chan struct{}

func (*Client) AuthChallengeUpdated 

func (c *Client) AuthChallengeUpdated() <-chan struct{}

func (*Client) CancelAuthChallenge 

func (c *Client) CancelAuthChallenge(id string) error

func (*Client) Close 

func (c *Client) Close() error

func (*Client) CompleteAuthChallenge 

func (c *Client) CompleteAuthChallenge(id string, response AuthResponse) error

func (*Client) DroppedIncomingDataPackets 

func (c *Client) DroppedIncomingDataPackets() uint64

func (*Client) PendingAuthChallenge 

func (c *Client) PendingAuthChallenge() *AuthChallenge

func (*Client) ReadDataPacket 

func (c *Client) ReadDataPacket(ctx context.Context) ([]byte, error)

ReadDataPacket returns a caller-owned copy of the next packet.

func (*Client) ReadDataPacketBuffer 

func (c *Client) ReadDataPacketBuffer(ctx context.Context) (*buf.Buffer, error)

ReadDataPacketBuffer transfers ownership of the returned buffer to the caller, which must release it.

func (*Client) ReadDataPackets 

func (c *Client) ReadDataPackets(ctx context.Context) ([]*buf.Buffer, error)

ReadDataPackets transfers ownership of the returned buffers to the caller, which must release each buffer.

func (*Client) Ready 

func (c *Client) Ready() bool

func (*Client) RestartSession 

func (c *Client) RestartSession()

func (*Client) Start 

func (c *Client) Start() error

func (*Client) TunnelConfiguration 

func (c *Client) TunnelConfiguration() TunnelConfiguration

func (*Client) WriteDataPacket 

func (c *Client) WriteDataPacket(packet []byte) error

WriteDataPacket copies packet before returning.

func (*Client) WriteDataPacketBuffers 

func (c *Client) WriteDataPacketBuffers(packetBuffers []*buf.Buffer) error

WriteDataPacketBuffers takes ownership of every buffer and releases them before returning.

func (*Client) WriteDataPackets 

func (c *Client) WriteDataPackets(packets [][]byte) error

WriteDataPackets copies every packet before returning.

type ClientOptions 

type ClientOptions struct {
	Context                        context.Context
	Server                         string
	Flavor                         string
	Username                       string
	Password                       string
	AuthGroup                      string
	Cookie                         string
	Token                          *TokenOptions
	ReportedOS                     string
	UserAgent                      string
	Version                        string
	LocalHostname                  string
	Mobile                         *MobileOptions
	CSD                            *CSDOptions
	HIP                            *HIPOptions
	TNCC                           *TNCCOptions
	FortinetHostCheck              *FortinetHostCheckOptions
	NoUDP                          bool
	DTLSLocalPort                  uint16
	DTLSCipherSuites               string
	DTLS12CipherSuites             string
	CompressionDisabled            bool
	CompressionMode                string
	IPv6Disabled                   bool
	HTTPKeepAliveDisabled          bool
	XMLPostDisabled                bool
	ExternalAuthDisabled           bool
	PasswordAuthenticationDisabled bool
	AllowInsecureCrypto            bool
	PFS                            bool
	MTU                            uint32
	BaseMTU                        uint32
	QueueLength                    uint32
	DPDInterval                    time.Duration
	ReconnectTimeout               time.Duration
	TrojanInterval                 time.Duration
	TLSConfig                      ClientTLSOptions
	FormEntries                    []FormEntry
	Dialer                         N.Dialer
	Logger                         logger.ContextLogger
	OnTunnelConfiguration          func(event TunnelConfigurationEvent) error
}

type ClientTLSOptions 

type ClientTLSOptions struct {
	Config                           *tls.Config
	ServerName                       string
	SystemTrustDisabled              bool
	CertificateExpiryWarning         time.Duration
	CertificateExpiryWarningDisabled bool
	PeerFingerprints                 []string
	CertificateAuthority             Material
	Certificate                      Material
	Key                              Material
	KeyPassword                      string
	MCACertificate                   Material
	MCAKey                           Material
	MCAKeyPassword                   string
}

type FormEntry 

type FormEntry struct {
	FormID        string
	SubmissionKey string
	Name          string
	Value         string
	Promote       bool
}

type FortinetHostCheckOptions 

type FortinetHostCheckOptions struct {
	HostCheck           string
	CheckVirtualDesktop string
}

type HIPOptions 

type HIPOptions struct {
	WrapperPath string
}

type Material 

type Material struct {
	Path    string
	Content []byte
}

func (Material) IsSet 

func (m Material) IsSet() bool

func (Material) Validate 

func (m Material) Validate(name string) error

type MobileOptions 

type MobileOptions struct {
	PlatformVersion string
	DeviceType      string
	DeviceUniqueID  string
}

type TNCCOptions 

type TNCCOptions struct {
	WrapperPath                  string
	DeviceID                     string
	UserAgent                    string
	MachineIdentificationEnabled bool
	Certificates                 []Material
}

type TokenOptions 

type TokenOptions struct {
	Mode          string
	Secret        string
	SecretPath    string
	PIN           string
	Password      string
	DeviceID      string
	Counter       uint64
	UpdateCounter func(ctx context.Context, counter uint64) error
}

type TunnelConfiguration 

type TunnelConfiguration struct {
	MTU                      uint32
	RemoteAddress            netip.Addr
	Addresses                []netip.Prefix
	Routes                   []TunnelRoute
	ExcludedRoutes           []TunnelRoute
	DNS                      []netip.Addr
	NBNS                     []netip.Addr
	SearchDomains            []string
	SplitDNS                 []string
	SplitDNSRules            []TunnelSplitDNSRule
	ProxyAutoConfigURL       string
	Banner                   string
	TunnelAllDNS             bool
	ClientBypassProtocol     bool
	IdleTimeout              time.Duration
	AuthenticationExpiration time.Time
	// contains filtered or unexported fields
}

type TunnelConfigurationEvent 

type TunnelConfigurationEvent struct {
	Reason        TunnelConfigurationEventReason
	Configuration TunnelConfiguration
}

type TunnelConfigurationEventReason 

type TunnelConfigurationEventReason string
const (
	TunnelConfigurationEventInitial         TunnelConfigurationEventReason = "initial"
	TunnelConfigurationEventReestablishment TunnelConfigurationEventReason = "reestablishment"
	TunnelConfigurationEventRekey           TunnelConfigurationEventReason = "rekey"
	TunnelConfigurationEventPathMTU         TunnelConfigurationEventReason = "path-mtu"
)

type TunnelRoute 

type TunnelRoute struct {
	Prefix  netip.Prefix
	Gateway netip.Addr
	Metric  int
}

type TunnelSplitDNSRule 

type TunnelSplitDNSRule struct {
	Domains []string
	Servers []netip.Addr
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.