OpenConnect

OpenConnect is a client for Cisco's AnyConnect SSL VPN, which is supported by IOS 12.4(9)T or later on Cisco SR500, 870, 880, 1800, 2800, 3800, 7200 Series and Cisco 7301 Routers.

OpenConnect is released under the GNU Lesser Public License, version 2.1.

Like vpnc, OpenConnect is not officially supported by, or associated in any way with, Cisco Systems. It just happens to interoperate with their equipment.

Development of OpenConnect was started after a trial of their "official" client under Linux found it to have many deficiencies:

• Inability to use SSL certificates from a TPM, or even use a passphrase.
• Lack of support for Linux platforms other than i386.
• Lack of integration with NetworkManager on the Linux desktop.
• Lack of proper (RPM/DEB) packaging for Linux distributions.
• "Stealth" use of libraries with dlopen(), even using the development-only symlinks such as libz.so — making it hard to properly discover the dependencies which proper packaging would have expressed
• Tempfile races allowing unprivileged users to trick it into overwriting arbitrary files, as root.
• Unable to run as an unprivileged user, which would have reduced the severity of the above bug.
• Inability to audit the source code for further such "Security 101" bugs.

Supported Platforms

It is known to work on at least i386, x86_64, PowerPC and MIPS processors, and should not have issues with portability to other CPUs.

Features

• Automatic detection of IPv4 address, routes.
• Authentication via HTTP forms.
• Authentication using SSL certificates, from local file or Trusted Platform Module.
• UserGroup support for selecting between multiple configurations on a single VPN server.
• Data transport over TCP (HTTPS) or UDP (DTLS).
• Keepalive and Dead Peer Detection on both HTTPS and DTLS.
• Automatic update of VPN server list / configuration.
• Roaming support, allowing reconnection when the local IP address changes.
• Run without root privileges.

The second is that it can avoid using the tun device altogether and instead spawn a user-supplied program, passing all data traffic through a UNIX socket to that program. This latter option can be used in conjunction with a userspace TCP stack such as lwip to provide SOCKS access to the VPN without giving full access to all untrusted users and processes on the computer, and without requiring root privileges at all.

TODO

• IPv6 support
• Windows / BSD / etc. support

The second is just a case of someone testing it on new platforms and letting me have any patches that are required; it mostly ought to 'just work', with maybe a few system-specific modifications to the tun support.

Download

Tarball releases can be downloaded from ftp://ftp.infradead.org/pub/openconnect/

Release Notes / Changelog

• OpenConnect HEAD
  
  • No changelog entries yet
  
  
• OpenConnect v2.00 — 2009-06-03
  
  • Add OpenBSD and FreeBSD support.
  • Build with OpenSSL-0.9.7 (Mac OS X, OpenBSD, etc.)
  • Support PKCS#12 certificates.
  • Automatic detection of certificate type (PKCS#12, PEM, TPM).
  • Work around OpenSSL trust chain issues (RT#1942).
  • Allow PEM passphrase to be specified on command line.
  • Allow PEM passphrase automatically generated from the fsid of the file system on which the certificate is stored.
  • Fix certificate comparisons (in NM auth-dialog and --servercert option) to use SHA1 fingerprint, not signature.
  • Fix segfault in NM auth-dialog when changing hosts.
  
  
• OpenConnect v1.40 — 2009-05-27
  
  • Fix validation of server's SSL certificate when NetworkManager runs openconnect as an unprivileged user (which can't read the real user's trust chain file).
  • Fix double-free of DTLS Cipher option on reconnect.
  • Reconnect on SSL write errors
  • Fix reporting of SSL errors through syslog/UI.
  
  
• OpenConnect v1.30 — 2009-05-13
  
  • NetworkManager auth-dialog will now cache authentication form options.
  
  
• OpenConnect v1.20 — 2009-05-08
  
  • DTLS cipher choice fixes.
  • Improve handling of authentication group selection.
  • Export more information to connection script.
  • Add --background option to dæmonize after connection.
  • Detect TCP connection closure.
  
  
• OpenConnect v1.10 — 2009-04-01
  
  • NetworkManager UI rewrite with many improvements.
  • Support for "UserGroups" where a single server offers multiple configurations according to the URL used to connect.
  
  
• OpenConnect v1.00 — 2009-03-18
  
  • First non-beta release.

NetworkManager support

Unlike other VPN support in NetworkManager, the auth-dialog tool which handles GUI authentication is part of OpenConnect itself, rather than included in the network-manager-openconnect package. This is because it shares a lot of code with OpenConnect, but doesn't actually share any with NetworkManager or the other parts of the NetworkManager support.

ConnMan support

Requirements

• OpenSSL — all versions from 0.9.7 onwards will work for basic connectivity, but see note on DTLS compatibility below.
• libxml2

For building the NetworkManager support, you will also need:

• GTK
• GConf

How the VPN works

You then use this cookie in an HTTP CONNECT request, and can then pass traffic over that connection. IP addresses and routing information are passed back and forth in the headers of that CONNECT request.

Since TCP over TCP is very suboptimal, the VPN also attempts to use UDP datagrams, and will only actually pass traffic over the HTTPS connection if that fails. The UDP connectivity is done using Datagram TLS, which is supported by OpenSSL.

OpenSSL/DTLS compatibility

If you are using a version of OpenSSL older than 0.9.8l, you will need to apply this patch from OpenSSL CVS:

• http://cvs.openssl.org/chngview?cn=18037 (OpenSSL RT#1751)

• http://cvs.openssl.org/chngview?cn=17500 (OpenSSL RT#1703)
• http://cvs.openssl.org/chngview?cn=17505 (OpenSSL RT#1752)

Distribution Status

Fedora

Debian

Gentoo