openconnect

Documentation

Overview

Portions of the AnyConnect multiple-certificate exchange are derived from OpenConnect commit 2035601b64a5360a46d18e08937e7f654b3230f2, auth.c prepare_multicert_response/post_multicert_response and openssl.c multicert_sign_data. OpenConnect is licensed LGPL-2.1-or-later.

Portions of the RSA SecurID implementation are derived from libstoken commit 837e843e8850d14a5d49d799b066d61d04fd649a, src/securid.c. It follows securid_mac, v2_decode_token, v2_decrypt_seed, v3_decode_token, v3_decrypt_seed, and securid_compute_tokencode. Copyright 2012 Kevin Cernekee. libstoken is licensed LGPL-2.1-or-later.

Index

• Constants
• Variables
• type AuthChallenge
• type AuthForm
• type AuthFormChoice
• type AuthFormField
• type AuthFormResponse
• type AuthResponse
• type BrowserCookie
• type BrowserRequest
• type BrowserResult
• type CSDOptions
• type Client
  • func NewClient(options ClientOptions) (*Client, error)
  • func (c *Client) ActiveTransport() string
  • func (c *Client) ActiveTransportUpdated() <-chan struct{}
  • func (c *Client) AuthChallengeUpdated() <-chan struct{}
  • func (c *Client) CancelAuthChallenge(id string) error
  • func (c *Client) Close() error
  • func (c *Client) CompleteAuthChallenge(id string, response AuthResponse) error
  • func (c *Client) DroppedIncomingDataPackets() uint64
  • func (c *Client) PendingAuthChallenge() *AuthChallenge
  • func (c *Client) ReadDataPacket(ctx context.Context) ([]byte, error)
  • func (c *Client) ReadDataPacketBuffer(ctx context.Context) (*buf.Buffer, error)
  • func (c *Client) ReadDataPackets(ctx context.Context) ([]*buf.Buffer, error)
  • func (c *Client) Ready() bool
  • func (c *Client) RestartSession()
  • func (c *Client) Start() error
  • func (c *Client) TunnelConfiguration() TunnelConfiguration
  • func (c *Client) WriteDataPacket(packet []byte) error
  • func (c *Client) WriteDataPacketBuffers(packetBuffers []*buf.Buffer) error
  • func (c *Client) WriteDataPackets(packets [][]byte) error
• type ClientOptions
• type ClientTLSOptions
• type FormEntry
• type HIPOptions
• type Material
  • func (m Material) IsSet() bool
  • func (m Material) Validate(name string) error
• type TNCCOptions
• type TokenOptions
• type TunnelConfiguration
• type TunnelConfigurationEvent
• type TunnelConfigurationEventReason
• type TunnelRoute
• type TunnelSplitDNSRule

Constants

const (
	AuthFormFieldText     = "text"
	AuthFormFieldPassword = "password"
	AuthFormFieldSelect   = "select"
)

const (
	FlavorAnyConnect = "anyconnect"
	FlavorGP         = "gp"
	FlavorFortinet   = "fortinet"
	FlavorF5         = "f5"
	FlavorPulse      = "pulse"
	FlavorNC         = "nc"
)

const (
	TokenModeTOTP   = "totp"
	TokenModeHOTP   = "hotp"
	TokenModeSToken = "stoken"
)

const (
	TransportCSTP = "cstp"
	TransportGPST = "gpst"
	TransportTLS  = "tls"
	TransportDTLS = "dtls"
	TransportIFT  = "ift"
	TransportONCP = "oncp"
	TransportESP  = "esp"
)

const PacketHeadroom = espFixedHeaderSize

Variables

var (
	ErrMissingServer                = E.New("missing openconnect server")
	ErrUnsupportedFlavor            = E.New("unsupported openconnect flavor")
	ErrClientClosed                 = E.New("openconnect client is closed")
	ErrDataChannelNotReady          = E.New("openconnect data channel is not ready")
	ErrNoPendingAuthChallenge       = E.New("no pending openconnect authentication challenge")
	ErrAuthChallengeNotAnswerable   = E.New("openconnect authentication challenge does not accept a response")
	ErrAuthChallengeCanceled        = E.New("openconnect authentication challenge canceled")
	ErrInvalidAuthResponse          = E.New("invalid openconnect authentication response")
	ErrAuthenticationFailed         = E.New("openconnect authentication failed")
	ErrSessionRejected              = E.New("openconnect session rejected")
	ErrInvalidBrowserAuthentication = E.New("invalid openconnect browser authentication result")
	ErrMaterialSourceConflict       = E.New("openconnect material path and content are both set")
	ErrInvalidTLSMaterial           = E.New("invalid openconnect TLS material")
	ErrDeprecatedCryptoDisabled     = E.New("openconnect deprecated cryptography is disabled")
	ErrProtocolNotSupported         = E.New("openconnect protocol behavior is not supported")
)

Types

type AuthChallenge

type AuthChallenge struct {
	ID      string
	Banner  string
	Message string
	Error   string
	Form    *AuthForm
	Browser *BrowserRequest
}

type AuthForm

type AuthForm struct {
	Fields []AuthFormField
}

type AuthFormChoice

type AuthFormChoice struct {
	Value string
	Label string
}

type AuthFormField

type AuthFormField struct {
	SubmissionKey string
	Name          string
	Label         string
	Kind          string
	Value         string
	Options       []AuthFormChoice
}

type AuthFormResponse

type AuthFormResponse struct {
	Values map[string]string
}

type AuthResponse

type AuthResponse struct {
	Form    *AuthFormResponse
	Browser *BrowserResult
}

type BrowserCookie

type BrowserCookie struct {
	Name  string
	Value string
}

type BrowserRequest

type BrowserRequest struct {
	URL         string
	FinalURL    string
	CookieNames []string
	HeaderNames []string
}

type BrowserResult

type BrowserResult struct {
	FinalURL string
	Cookies  []BrowserCookie
	Header   http.Header
}

type CSDOptions

type CSDOptions struct {
	WrapperPath string
}

type Client

type Client struct {
	// contains filtered or unexported fields
}

func NewClient

func NewClient(options ClientOptions) (*Client, error)

func (*Client) ActiveTransport

func (c *Client) ActiveTransport() string

func (*Client) ActiveTransportUpdated

func (c *Client) ActiveTransportUpdated() <-chan struct{}

func (*Client) AuthChallengeUpdated

func (c *Client) AuthChallengeUpdated() <-chan struct{}

func (*Client) CancelAuthChallenge

func (c *Client) CancelAuthChallenge(id string) error

func (*Client) Close

func (c *Client) Close() error

func (*Client) CompleteAuthChallenge

func (c *Client) CompleteAuthChallenge(id string, response AuthResponse) error

func (*Client) DroppedIncomingDataPackets

func (c *Client) DroppedIncomingDataPackets() uint64

func (*Client) PendingAuthChallenge

func (c *Client) PendingAuthChallenge() *AuthChallenge

func (*Client) ReadDataPacket

func (c *Client) ReadDataPacket(ctx context.Context) ([]byte, error)

ReadDataPacket returns a caller-owned copy of the next packet.

func (*Client) ReadDataPacketBuffer

func (c *Client) ReadDataPacketBuffer(ctx context.Context) (*buf.Buffer, error)

ReadDataPacketBuffer transfers ownership of the returned buffer to the caller, which must release it.

func (*Client) ReadDataPackets

func (c *Client) ReadDataPackets(ctx context.Context) ([]*buf.Buffer, error)

ReadDataPackets transfers ownership of the returned buffers to the caller, which must release each buffer.

func (*Client) Ready

func (c *Client) Ready() bool

func (*Client) RestartSession

func (c *Client) RestartSession()

func (*Client) Start

func (c *Client) Start() error

func (*Client) TunnelConfiguration

func (c *Client) TunnelConfiguration() TunnelConfiguration

func (*Client) WriteDataPacket

func (c *Client) WriteDataPacket(packet []byte) error

WriteDataPacket copies packet before returning.

func (*Client) WriteDataPacketBuffers

func (c *Client) WriteDataPacketBuffers(packetBuffers []*buf.Buffer) error

WriteDataPacketBuffers takes ownership of every buffer and releases them before returning.

func (*Client) WriteDataPackets

func (c *Client) WriteDataPackets(packets [][]byte) error

WriteDataPackets copies every packet before returning.

type ClientOptions

type ClientOptions struct {
	Context               context.Context
	Server                string
	Flavor                string
	Username              string
	Password              string
	AuthGroup             string
	Token                 *TokenOptions
	ReportedOS            string
	UserAgent             string
	CSD                   *CSDOptions
	HIP                   *HIPOptions
	TNCC                  *TNCCOptions
	NoUDP                 bool
	AllowInsecureCrypto   bool
	TLSConfig             ClientTLSOptions
	FormEntries           []FormEntry
	Dialer                N.Dialer
	Logger                logger.ContextLogger
	OnTunnelConfiguration func(event TunnelConfigurationEvent) error
}

type ClientTLSOptions

type ClientTLSOptions struct {
	Config               *tls.Config
	CertificateAuthority Material
	Certificate          Material
	Key                  Material
	KeyPassword          string
	MCACertificate       Material
	MCAKey               Material
	MCAKeyPassword       string
}

type FormEntry

type FormEntry struct {
	FormID        string
	SubmissionKey string
	Name          string
	Value         string
	Promote       bool
}

type HIPOptions

type HIPOptions struct {
	WrapperPath string
}

type Material

type Material struct {
	Path    string
	Content []byte
}

func (Material) IsSet

func (m Material) IsSet() bool

func (Material) Validate

func (m Material) Validate(name string) error

type TNCCOptions

type TNCCOptions struct {
	WrapperPath                  string
	DeviceID                     string
	UserAgent                    string
	MachineIdentificationEnabled bool
	Certificates                 []Material
}

type TokenOptions

type TokenOptions struct {
	Mode          string
	Secret        string
	PIN           string
	Password      string
	DeviceID      string
	Counter       uint64
	UpdateCounter func(ctx context.Context, counter uint64) error
}

type TunnelConfiguration

type TunnelConfiguration struct {
	MTU                      uint32
	Addresses                []netip.Prefix
	Routes                   []TunnelRoute
	ExcludedRoutes           []TunnelRoute
	DNS                      []netip.Addr
	NBNS                     []netip.Addr
	SearchDomains            []string
	SplitDNS                 []string
	SplitDNSRules            []TunnelSplitDNSRule
	ProxyAutoConfigURL       string
	Banner                   string
	TunnelAllDNS             bool
	ClientBypassProtocol     bool
	IdleTimeout              time.Duration
	AuthenticationExpiration time.Time
}

type TunnelConfigurationEvent

type TunnelConfigurationEvent struct {
	Reason        TunnelConfigurationEventReason
	Configuration TunnelConfiguration
}

type TunnelConfigurationEventReason

type TunnelConfigurationEventReason string

const (
	TunnelConfigurationEventInitial         TunnelConfigurationEventReason = "initial"
	TunnelConfigurationEventReestablishment TunnelConfigurationEventReason = "reestablishment"
	TunnelConfigurationEventRekey           TunnelConfigurationEventReason = "rekey"
	TunnelConfigurationEventPathMTU         TunnelConfigurationEventReason = "path-mtu"
)

type TunnelRoute

type TunnelRoute struct {
	Prefix  netip.Prefix
	Gateway netip.Addr
	Metric  int
}

type TunnelSplitDNSRule

type TunnelSplitDNSRule struct {
	Domains []string
	Servers []netip.Addr
}