* Author: David Woodhouse <dwmw2@infradead.org>

*

* This program is free software; you can redistribute it and/or

* WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

* Lesser General Public License for more details.

*

* You should have received a copy of the GNU Lesser General Public

* License along with this library; if not, write to:

*

* Free Software Foundation, Inc.

* 51 Franklin Street, Fifth Floor,

* Boston, MA 02110-1301 USA

*/

#ifdef HAVE_GETLINE

/* Various BSD systems require this for getline() to be visible */

#define _WITH_GETLINE

#endif

#ifdef ANDROID

#include <android/log.h>

#else

#ifdef HAVE_STRINGS_H

#include <strings.h>

#endif

#include <errno.h>

#include <fcntl.h>

#include <unistd.h>

#include <pwd.h>

#include <sys/utsname.h>

#include <sys/types.h>

static int write_new_config(void *_vpninfo,

char *buf, int buflen);

static void write_progress(void *_vpninfo,

int level, const char *fmt, ...);

static void syslog_progress(void *_vpninfo,

int level, const char *fmt, ...);

static int validate_peer_cert(void *_vpninfo,

OPENCONNECT_X509 *peer_cert,

const char *reason);

static int process_auth_form(void *_vpninfo,

struct oc_auth_form *form);

/* A sanity check that the openconnect executable is running against a

library of the same version */

OPT_AUTHENTICATE = 0x100,

OPT_AUTHGROUP,

OPT_COOKIEONLY,

OPT_COOKIE_ON_STDIN,

OPT_CSD_USER,

OPT_DISABLE_IPV6,

OPT_DTLS_CIPHERS,

OPT_FORCE_DPD,

OPT_KEY_PASSWORD_FROM_FSID,

OPT_LIBPROXY,

OPT_NO_CERT_CHECK,

OPT_NO_DTLS,

OPT_NO_HTTP_KEEPALIVE,

OPT_NO_PASSWD,

OPT_NO_PROXY,

OPT_PASSWORD_ON_STDIN,

OPT_PRINTCOOKIE,

OPT_RECONNECT_TIMEOUT,

OPT_SERVERCERT,

OPT_USERAGENT,

};

#ifdef __sun__

/*

* The 'name' field in Solaris 'struct option' lacks the 'const', and causes

* lots of warnings unless we cast it... https://www.illumos.org/issues/1881

*/

#define OPTION(name, arg, abbrev) {(char *)name, arg, NULL, abbrev}

#else

#define OPTION(name, arg, abbrev) {name, arg, NULL, abbrev}

#endif

OPTION("background", 0, 'b'),

OPTION("pid-file", 1, OPT_PIDFILE),

OPTION("certificate", 1, 'c'),

OPTION("sslkey", 1, 'k'),

OPTION("cookie", 1, 'C'),

OPTION("deflate", 0, 'd'),

OPTION("no-deflate", 0, 'D'),

OPTION("cert-expire-warning", 1, 'e'),

OPTION("usergroup", 1, 'g'),

OPTION("help", 0, 'h'),

OPTION("interface", 1, 'i'),

OPTION("mtu", 1, 'm'),

OPTION("setuid", 1, 'U'),

OPTION("script", 1, 's'),

OPTION("script-tun", 0, 'S'),

OPTION("syslog", 0, 'l'),

OPTION("key-password", 1, 'p'),

OPTION("proxy", 1, 'P'),

OPTION("user", 1, 'u'),

OPTION("verbose", 0, 'v'),

OPTION("version", 0, 'V'),

OPTION("cafile", 1, OPT_CAFILE),

OPTION("cookieonly", 0, OPT_COOKIEONLY),

OPTION("printcookie", 0, OPT_PRINTCOOKIE),

OPTION("quiet", 0, 'q'),

OPTION("queue-len", 1, 'Q'),

OPTION("xmlconfig", 1, 'x'),

OPTION("cookie-on-stdin", 0, OPT_COOKIE_ON_STDIN),

OPTION("passwd-on-stdin", 0, OPT_PASSWORD_ON_STDIN),

OPTION("no-passwd", 0, OPT_NO_PASSWD),

OPTION("reconnect-timeout", 1, OPT_RECONNECT_TIMEOUT),

OPTION("dtls-ciphers", 1, OPT_DTLS_CIPHERS),

OPTION("authgroup", 1, OPT_AUTHGROUP),

OPTION("servercert", 1, OPT_SERVERCERT),

OPTION("key-password-from-fsid", 0, OPT_KEY_PASSWORD_FROM_FSID),

OPTION("useragent", 1, OPT_USERAGENT),

OPTION("csd-user", 1, OPT_CSD_USER),

OPTION("csd-wrapper", 1, OPT_CSD_WRAPPER),

OPTION("disable-ipv6", 0, OPT_DISABLE_IPV6),

OPTION("no-proxy", 0, OPT_NO_PROXY),

OPTION("libproxy", 0, OPT_LIBPROXY),

OPTION("no-http-keepalive", 0, OPT_NO_HTTP_KEEPALIVE),

OPTION("no-cert-check", 0, OPT_NO_CERT_CHECK),

OPTION("force-dpd", 1, OPT_FORCE_DPD),

OPTION("non-inter", 0, OPT_NON_INTER),

OPTION(NULL, 0, 0)

};

static void helpmessage(void)

{

printf(_("For assistance with OpenConnect, please see the web page at\n"

" http://www.infradead.org/openconnect/mail.html\n"));

}

static void print_build_opts(void)

{

#if defined (OPENCONNECT_OPENSSL) && defined (HAVE_ENGINE)

if (openconnect_has_tss_blob_support())

printf(_("Using OpenSSL with TPM ENGINE support. Loading TPM engine succeeded.\n"));

else

printf(_("Using OpenSSL with TPM ENGINE support, but loading TPM engine failed.\n"));

#else

#error wtf

#endif

#ifndef HAVE_DTLS

#else

#error wtf

#endif

}

printf(" -b, --background %s\n", _("Continue in background after startup"));

printf(" --pid-file=PIDFILE %s\n", _("Write the daemons pid to this file"));

printf(" -c, --certificate=CERT %s\n", _("Use SSL client certificate CERT"));

printf(" -e, --cert-expire-warning=DAYS %s\n", _("Warn when certificate lifetime < DAYS"));

printf(" -k, --sslkey=KEY %s\n", _("Use SSL private key file KEY"));

printf(" -K, --key-type=TYPE %s\n", _("Private key type (PKCS#12 / TPM / PEM)"));

printf(" -C, --cookie=COOKIE %s\n", _("Use WebVPN cookie COOKIE"));

printf(" --cookie-on-stdin %s\n", _("Read cookie from standard input"));

printf(" -d, --deflate %s\n", _("Enable compression (default)"));

printf(" -D, --no-deflate %s\n", _("Disable compression"));

printf(" --force-dpd=INTERVAL %s\n", _("Set minimum Dead Peer Detection interval"));

printf(" -g, --usergroup=GROUP %s\n", _("Set login usergroup"));

printf(" -h, --help %s\n", _("Display help text"));

printf(" -i, --interface=IFNAME %s\n", _("Use IFNAME for tunnel interface"));

printf(" -l, --syslog %s\n", _("Use syslog for progress messages"));

printf(" -U, --setuid=USER %s\n", _("Drop privileges after connecting"));

printf(" --csd-user=USER %s\n", _("Drop privileges during CSD execution"));

printf(" --csd-wrapper=SCRIPT %s\n", _("Run SCRIPT instead of CSD binary"));

printf(" -m, --mtu=MTU %s\n", _("Request MTU from server"));

printf(" -p, --key-password=PASS %s\n", _("Set key passphrase or TPM SRK PIN"));

printf(" --key-password-from-fsid %s\n", _("Key passphrase is fsid of file system"));

printf(" -P, --proxy=URL %s\n", _("Set proxy server"));

printf(" --no-proxy %s\n", _("Disable proxy"));

printf(" --libproxy %s\n", _("Use libproxy to automatically configure proxy"));

printf(" -q, --quiet %s\n", _("Less output"));

printf(" -Q, --queue-len=LEN %s\n", _("Set packet queue limit to LEN pkts"));

printf(" -s, --script=SCRIPT %s\n", _("Shell command line for using a vpnc-compatible config script"));

printf(" -S, --script-tun %s\n", _("Pass traffic to 'script' program, not tun"));

printf(" -u, --user=NAME %s\n", _("Set login username"));

printf(" -V, --version %s\n", _("Report version number"));

printf(" -v, --verbose %s\n", _("More output"));

printf(" -x, --xmlconfig=CONFIG %s\n", _("XML config file"));

printf(" --authgroup=GROUP %s\n", _("Choose authentication login selection"));

printf(" --cookieonly %s\n", _("Fetch webvpn cookie only; don't connect"));

printf(" --printcookie %s\n", _("Print webvpn cookie before connecting"));

printf(" --cafile=FILE %s\n", _("Cert file for server verification"));

printf(" --disable-ipv6 %s\n", _("Do not ask for IPv6 connectivity"));

printf(" --dtls-ciphers=LIST %s\n", _("OpenSSL ciphers to support for DTLS"));

printf(" --no-dtls %s\n", _("Disable DTLS"));

printf(" --no-http-keepalive %s\n", _("Disable HTTP connection re-use"));

printf(" --no-passwd %s\n", _("Disable password/SecurID authentication"));

printf(" --no-cert-check %s\n", _("Do not require server SSL cert to be valid"));

printf(" --non-inter %s\n", _("Do not expect user input; exit if it is required"));

printf(" --passwd-on-stdin %s\n", _("Read password from standard input"));

printf(" --reconnect-timeout %s\n", _("Connection retry timeout in seconds"));

printf(" --servercert=FINGERPRINT %s\n", _("Server's certificate SHA1 fingerprint"));

printf(" --useragent=STRING %s\n", _("HTTP header User-Agent: field"));

printf("\n");

helpmessage();

exit(1);

}

{

char *c = malloc(100);

if (!c) {

exit(1);

}

if (!fgets(c, 100, stdin)) {

exit(1);

}

if (c)

*c = 0;

}

static void handle_sigusr(int sig)

{

if (sig == SIGUSR1)

verbose = PRG_TRACE;

else if (sig == SIGUSR2)

verbose = PRG_INFO;

}

static FILE *config_file = NULL;

static int config_line_num = 0;

/* There are three ways to handle config_arg:

*

* 1. We only care about it transiently and it can be lost entirely

* (e.g. vpninfo->reconnect_timeout = atoi(config_arg);

* 2. We need to kep it, but it's a static string and will never be freed

* so when it's part of argv[] we can use it in place, but when it comes

* from a file we have to strdup() because otherwise it'll be overwritten.

* For this we use the keep_config_arg() macro below.

* 3. It may be freed during normal operation, so we have to use strdup()

* even when it's an option from argv[]. (e.g. vpninfo->cert_password).

*/

#define keep_config_arg() (config_file?strdup(config_arg):config_arg)

static int next_option(int argc, char **argv, char **config_arg)

{

/* These get re-used */

static char *line_buf = NULL;

static size_t line_size = 0;

ssize_t llen;

int opt, optlen;

struct option *this;

char *line;

int ate_equals = 0;

next:

if (!config_file) {

opt = getopt_long(argc, argv,

long_options, NULL);

*config_arg = optarg;

return opt;

}

llen = getline(&line_buf, &line_size, config_file);

if (llen < 0) {

if (feof(config_file)) {

fclose(config_file);

config_file = NULL;

goto next;

}

fprintf(stderr, _("Failed to get line from config file: %s\n"),

strerror(errno));

exit(1);

}

line = line_buf;

/* Strip the trailing newline (coping with DOS newlines) */

if (llen && line[llen-1] == '\n')

line[--llen] = 0;

if (llen && line[llen-1] == '\r')

line[--llen] = 0;

/* Skip and leading whitespace */

while (line[0] == ' ' || line[0] == '\t' || line[0] == '\r')

line++;

/* Ignore comments and empty lines */

if (!line[0] || line[0] == '#') {

config_line_num++;

goto next;

}

/* Try to match on a known option... naïvely. This could be improved. */

for (this = long_options; this->name; this++) {

optlen = strlen(this->name);

/* If the option isn't followed by whitespace or NUL, or

perhaps an equals sign if the option takes an argument,

then it's not a match */

if (!strncmp(this->name, line, optlen) &&

(!line[optlen] || line[optlen] == ' ' || line[optlen] == '\t' ||

line[optlen] == '='))

break;

}

if (!this->name) {

char *l;

for (l = line; *l && *l != ' ' && *l != '\t'; l++)

;

*l = 0;

fprintf(stderr, _("Unrecognised option at line %d: '%s'\n"),

config_line_num, line);

return '?';

}

line += optlen;

while (*line == ' ' || *line == '\t' ||

(*line == '=' && this->has_arg && !ate_equals && ++ate_equals))

line++;

if (!this->has_arg && *line) {

fprintf(stderr, _("Option '%s' does not take an argument at line %d\n"),

this->name, config_line_num);

return '?';

} else if (this->has_arg && !*line) {

fprintf(stderr, _("Option '%s' requires an argument at line %d\n"),

this->name, config_line_num);

return '?';

}

config_line_num++;

*config_arg = line;

return this->val;

}

int main(int argc, char **argv)

{

char *pidfile = NULL;

FILE *fp = NULL;

setlocale(LC_ALL, "");

#endif

fprintf(stderr, _("WARNING: This version of openconnect is %s but\n"

" the libopenconnect library is %s\n"),

}

vpninfo = malloc(sizeof(*vpninfo));

if (!vpninfo) {

exit(1);

}

memset(vpninfo, 0, sizeof(*vpninfo));

vpninfo->uid_csd = 0;

vpninfo->uid_csd_given = 0;

if (!uname(&utsbuf))

vpninfo->localname = utsbuf.nodename;

else

vpninfo->localname = "localhost";

while ((opt = next_option(argc, argv, &config_arg))) {

if (opt < 0)

break;

switch (opt) {

case OPT_CONFIGFILE:

if (config_file) {

fprintf(stderr, _("Cannot use 'config' option inside config file\n"));

exit(1);

}

config_file = fopen(config_arg, "r");

if (!config_file) {

fprintf(stderr, _("Cannot open config file '%s': %s\n"),

config_arg, strerror(errno));

exit(1);

}

config_line_num = 1;

/* The next option will come from the file... */

break;

cookieonly = 1;

break;

cookieonly = 2;

break;

case OPT_AUTHENTICATE:

cookieonly = 3;

break;

/* If the cookie is empty, ignore it */

if (! *vpninfo->cookie) {

vpninfo->cookie = NULL;

}

vpninfo->nopasswd = 1;

break;

case OPT_NON_INTER:

non_inter = 1;

break;

case 'b':

background = 1;

break;

case 'd':

vpninfo->deflate = 1;

break;

case 'D':

vpninfo->deflate = 0;

break;

free(urlpath);

urlpath = strdup(config_arg);

usage();

case 'i':

case 'l':

use_syslog = 1;

break;

}

break;

case OPT_BASEMTU:

vpninfo->basemtu = atol(config_arg);

if (vpninfo->basemtu < 576) {

fprintf(stderr, _("MTU %d too small\n"), vpninfo->basemtu);

vpninfo->basemtu = 576;

}

break;