mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-02-09 08:16:58 +08:00
ed538039c3
Once a client has progressed through the initial auth checks (and successfully passed the initial camouflage check), it's safe to skip further camouflage checks. This allows the Cisco Secure client continue successfully through HTTP requests for /profiles//etc/ocserv/profile.xml and /1/VPNManifest.xml. Resolves: #544 Signed-off-by: Rob van Oostenrijk <robvanoostenrijk@users.noreply.github.com>
99 lines
3.3 KiB
Bash
Executable File
99 lines
3.3 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# Copyright (C) 2013 Nikos Mavrogiannopoulos
|
|
# Copyright (C) 2023 Kirill Ovchinnikov
|
|
#
|
|
# This file is part of ocserv.
|
|
#
|
|
# ocserv is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by the
|
|
# Free Software Foundation; either version 2 of the License, or (at
|
|
# your option) any later version.
|
|
#
|
|
# ocserv is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
# General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with GnuTLS; if not, write to the Free Software Foundation,
|
|
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
|
|
SERV="${SERV:-../src/ocserv}"
|
|
srcdir=${srcdir:-.}
|
|
CLIENTPIDFILE=openconnect-pid.$$.tmp
|
|
SECRETURL="/?mysecretkey"
|
|
SERVERCERT="pin-sha256:xp3scfzy3rOQsv9NcOve/8YVVv+pHr4qNCXEXrNl5s8="
|
|
|
|
. `dirname $0`/common.sh
|
|
|
|
eval "${GETPORT}"
|
|
|
|
echo "Testing connection to the server with camouflage enabled"
|
|
|
|
update_config test-camouflage.config
|
|
|
|
launch_server -d 1 -f -c ${CONFIG} & PID=$!
|
|
wait_server ${PID}
|
|
|
|
echo "Checking with CURL that server returns us HTTP 401 for GET"
|
|
http_result=$(curl --insecure https://localhost:${PORT} --output /dev/null --silent --write-out "%{http_code}")
|
|
if [ "${http_result}" != "401" ]; then
|
|
fail ${PID} "Server returned ${http_result} instead of 401 for GET"
|
|
fi
|
|
echo "OK"
|
|
|
|
|
|
echo "Checking with CURL that server returns us HTTP 403 for POST"
|
|
http_result=$(curl -X POST -F 'test=test' --insecure https://localhost:${PORT} --output /dev/null --silent --write-out "%{http_code}")
|
|
if [ "${http_result}" != "401" ]; then
|
|
fail ${PID} "Server returned ${http_result} instead of 401 for POST"
|
|
fi
|
|
echo "OK"
|
|
|
|
echo "Connecting to obtain cookie without secret URL"
|
|
eval `echo "test" | ${OPENCONNECT} -q localhost:${PORT} -u test --servercert ${SERVERCERT} --authenticate`
|
|
if [ ! -z "${COOKIE}" ];then
|
|
fail ${PID} "Got a cookie, this shouldn't happen"
|
|
fi
|
|
echo "OK"
|
|
|
|
echo "Connecting to obtain cookie using secret URL.."
|
|
eval `echo "test" | ${OPENCONNECT} -q localhost:${PORT}${SECRETURL} -u test --servercert ${SERVERCERT} --authenticate`
|
|
if [ -z "${COOKIE}" ];then
|
|
fail ${PID} "Could not obtain cookie"
|
|
fi
|
|
echo "OK"
|
|
|
|
echo "Cookie: \"${COOKIE}\""
|
|
|
|
# Ensure a valid HTTP cookie for cURL
|
|
if echo "${COOKIE}" | grep -q -E "[a-z_]+=[^;]+"; then
|
|
HTTP_COOKIE=${COOKIE}
|
|
else
|
|
HTTP_COOKIE="webvpn=${COOKIE}"
|
|
fi
|
|
|
|
echo "Checking with CURL that server returns HTTP 200 for user authenticated GET"
|
|
http_result=$(curl --insecure https://localhost:${PORT}/cert.pem --output /dev/null --cookie "${HTTP_COOKIE}" --silent --write-out "%{http_code}")
|
|
if [ "${http_result}" != "200" ]; then
|
|
fail ${PID} "Server returned ${http_result} instead of 200 for GET"
|
|
fi
|
|
echo "OK"
|
|
|
|
echo "Connecting with cookie..."
|
|
$OPENCONNECT -q localhost:${PORT} -u test -C "${COOKIE}" --servercert ${SERVERCERT} --script=/bin/true --verbose --pid-file "${CLIENTPIDFILE}" --background
|
|
sleep 4
|
|
if [ ! -f "${CLIENTPIDFILE}" ];then
|
|
fail ${PID} "Failed to establish the session"
|
|
fi
|
|
echo "Seems like the connection is established, stopping the client to finish the test...."
|
|
kill -USR1 `cat "${CLIENTPIDFILE}"`
|
|
if test $? != 0;then
|
|
fail ${PID} "Client process could not be killed"
|
|
fi
|
|
echo "OK"
|
|
|
|
cleanup
|
|
|
|
exit 0 |