From: Benjamin Mako Hill <mako@atdot.cc>
Date: Mon, 10 Mar 2025 06:10:39 +0000 (-0700)
Subject: updated the proxy code to make it work based on other bitrot
X-Git-Url: https://code.communitydata.science/nu-vpn-proxy.git/commitdiff_plain/c3af198d8797d9d03af520f7662e932f26472573?ds=inline;hp=-c
updated the proxy code to make it work based on other bitrot
- hipreport: updated the client version to match new globalconnect code
- hipreport: update linux kernel version to something more modern
- disable ESP and IPv6 which seem to be working poorly
- change code in ssh wrapper for no ESP
---
c3af198d8797d9d03af520f7662e932f26472573
diff --git a/hipreport-modified.sh b/hipreport-modified.sh
index 2253596..68be2a5 100755
--- a/hipreport-modified.sh
+++ b/hipreport-modified.sh
@@ -69,8 +69,8 @@ cat <<EOF
<generate-time>$NOW</generate-time>
<categories>
<entry name="host-info">
- <client-version>5.1.0-101</client-version>
- <os>Linux 4.19.0-6-amd64</os>
+ <client-version>6.3.0-33</client-version>
+ <os>Linux 6.1.0-31-amd64</os>
<os-vendor>Linux</os-vendor>
<domain>domain.com</domain>
<host-name>spes</host-name>
@@ -102,8 +102,8 @@ cat <<EOF
<hip-report-version>4</hip-report-version>
<categories>
<entry name="host-info">
- <client-version>5.1.0-101</client-version>
- <os>Linux 4.19.0-6-amd64</os>
+ <client-version>6.3.0-33</client-version>
+ <os>Linux 6.1.0-31-amd64</os>
<os-vendor>Linux</os-vendor>
<domain>domain.com</domain>
<host-name>spes</host-name>
diff --git a/openconnect_command-general.sh b/openconnect_command-general.sh
index b7df399..59f32e9 100755
--- a/openconnect_command-general.sh
+++ b/openconnect_command-general.sh
@@ -6,5 +6,5 @@ cd ~/bin/nu-vpn-proxy
## do the authentication
eval $( ./gp-saml-gui.py -v --gateway --clientos=Linux vpn-connect2.northwestern.edu )
-echo "$COOKIE" | sudo openconnect --useragent="PAN GlobalConnect" --version-string='5.1.0-101' --protocol=gp -u "$USER" --os="$OS" --passwd-on-stdin "$HOST" --csd-wrapper="hipreport-modified.sh" --reconnect-timeout 60
+echo "$COOKIE" | sudo openconnect --useragent="PAN GlobalConnect" --version-string='6.3.0-33' --protocol=gp -u "$USER" --os="$OS" --passwd-on-stdin "$HOST" --csd-wrapper="hipreport-modified.sh" --reconnect-timeout 60
diff --git a/openconnect_command-http.sh b/openconnect_command-http.sh
index e7821b8..335fd81 100755
--- a/openconnect_command-http.sh
+++ b/openconnect_command-http.sh
@@ -12,6 +12,6 @@ cd ~/bin/nu-vpn-proxy
eval $( ./gp-saml-gui.py -v --gateway --clientos=Linux vpn-connect2.northwestern.edu )
-echo "$COOKIE" | /usr/sbin/openconnect --verbose --useragent="PAN GlobalConnect" --version-string='5.1.0-101' --protocol=gp -u "$USER" --os="$OS" --passwd-on-stdin "$HOST" --csd-wrapper="hipreport-modified.sh" --reconnect-timeout 60 --script-tun --script "ocproxy -D 8181 --keepalive 5 --verbose" -b --pid-file "${PID_FILE}"
+echo "$COOKIE" | /usr/sbin/openconnect --verbose --useragent="PAN GlobalConnect" --version-string='6.3.0-33' --protocol=gp -u "$USER" --os="$OS" --passwd-on-stdin "$HOST" --csd-wrapper="hipreport-modified.sh" --reconnect-timeout 60 --script-tun --script "ocproxy -D 8181 --keepalive 5 --verbose" -b --pid-file "${PID_FILE}"
diff --git a/openconnect_command-ssh.sh b/openconnect_command-ssh.sh
index 2a875ff..d20f723 100755
--- a/openconnect_command-ssh.sh
+++ b/openconnect_command-ssh.sh
@@ -12,5 +12,4 @@ cd ~/bin/nu-vpn-proxy
## do the authentication
eval $( ./gp-saml-gui.py -v --gateway --clientos=Linux vpn-connect2.northwestern.edu )
-echo "$COOKIE" | /usr/sbin/openconnect --useragent="PAN GlobalConnect" --version-string='5.1.0-101' --protocol=gp -u "$USER" --os="$OS" --passwd-on-stdin "$HOST" --csd-wrapper="hipreport-modified.sh" --reconnect-timeout 60 --script-tun --script "ocproxy -D 9052" -b --pid-file "${PID_FILE}"
-
+echo "${COOKIE}" | /usr/sbin/openconnect --protocol=gp '--useragent=PAN GlobalProtect' --user="${USER}" --os="${OS}" --usergroup=gateway:prelogin-cookie --passwd-on-stdin vpn-connect2.northwestern.edu --csd-wrapper="hipreport-modified.sh" --reconnect-timeout 60 --script-tun --script "ocproxy -D 9052" -b --disable-ipv6 --no-dtls --pid-file "${PID_FILE}"
diff --git a/ssh-vpn-proxy b/ssh-vpn-proxy
index 58f847a..6f3644c 100755
--- a/ssh-vpn-proxy
+++ b/ssh-vpn-proxy
@@ -2,7 +2,8 @@
export OPENSSL_CONF="${HOME}/bin/nu-vpn-proxy/openssl.conf"
# this allows for legacy renegotation which seems to be required now
-SEARCH_PATTERN="ESP tunnel connected; exiting HTTPS mainloop."
+# SEARCH_PATTERN="ESP tunnel connected; exiting HTTPS mainloop."
+SEARCH_PATTERN="Continuing in background; pid"
# connects to SSH through openconnect and VPN
# for use with ProxyCommand in SSH