Skip to content

Instantly share code, notes, and snippets.

@l0ki000
Forked from zer4tul/gist:6477470
Last active January 19, 2024 11:56
Show Gist options
  • Save l0ki000/56845c00fd2a0e76d688 to your computer and use it in GitHub Desktop.
Save l0ki000/56845c00fd2a0e76d688 to your computer and use it in GitHub Desktop.
Cisco Anyconnect CSD wrapper for OpenConnect (exhanced to autodownload and autoupdate hostscan)
#!/bin/bash
# Cisco Anyconnect CSD wrapper for OpenConnect
# Enter your vpn host here
CSD_HOSTNAME=
if [[ -z ${CSD_HOSTNAME} ]]
then
echo "Define CSD_HOSTNAME with vpn-host in script text. Exiting."
exit 1
fi
HOSTSCAN_DIR="$HOME/.cisco/hostscan"
LIB_DIR="$HOSTSCAN_DIR/lib"
BIN_DIR="$HOSTSCAN_DIR/bin"
BINS=("cscan" "cstub" "cnotify")
# parsing command line
shift
URL=
TICKET=
STUB=
GROUP=
CERTHASH=
LANGSELEN=
while [ "$1" ]; do
if [ "$1" == "-ticket" ]; then shift; TICKET=$1; fi
if [ "$1" == "-stub" ]; then shift; STUB=$1; fi
if [ "$1" == "-group" ]; then shift; GROUP=$1; fi
if [ "$1" == "-certhash" ]; then shift; CERTHASH=$1; fi
if [ "$1" == "-url" ]; then shift; URL=$1; fi
if [ "$1" == "-langselen" ];then shift; LANGSELEN=$1; fi
shift
done
ARCH=$(uname -m)
if [[ "$ARCH" == "x86_64" ]]
then
ARCH="linux_x64"
else
ARCH="linux_i386"
fi
# creating dirs
for dir in $HOSTSCAN_DIR $LIB_DIR $BIN_DIR ; do
if [[ ! -f $dir ]]
then
mkdir -p $dir
fi
done
# getting manifest, and checking binaries
wget --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/manifest" -O "$HOSTSCAN_DIR/manifest"
# generating md5.sum with full paths from manifest
export HOSTSCAN_DIR=$HOSTSCAN_DIR
cat $HOSTSCAN_DIR/manifest | sed -r 's/\(|\)//g' | awk '{ cmd = "find $HOSTSCAN_DIR -iname " $2; while (cmd | getline line) { print $4, line; } }' > $HOSTSCAN_DIR/md5.sum
# check number of files either
MD5_LINES=`wc --lines $HOSTSCAN_DIR/md5.sum | awk '{ print $1; }'`
MANIFEST_LINES=`wc --lines $HOSTSCAN_DIR/manifest | awk '{ print $1; }'`
echo "Got $MANIFEST_LINES files in manifes, locally found $MD5_LINES"
# check md5
md5sum -c $HOSTSCAN_DIR/md5.sum
if [[ "$?" -ne "0" || "$MD5_LINES" -ne "$MANIFEST_LINES" ]]
then
echo "Corrupted files, or whatever wrong with md5 sums, or missing some file"
# just download every file mentioned in manifest (not ideal, but hopefully should be enough)
FILES=( $(cat $HOSTSCAN_DIR/manifest | sed -r 's/\(|\)//g' | awk '{ print $2; }') )
WORK_DIR=`pwd`
TMP_DIR=`mktemp -d` && cd $TMP_DIR
for i in ${FILES[@]} ; do
FILE="$(basename "$i")"
echo "Downloading: $FILE to $TMP_DIR"
wget --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/$FILE" -O $FILE
# some files are in gz (don't understand logic here)
if [[ ! -f $FILE || ! -s $FILE ]]
then
# remove 0 size files
if [[ ! -s $FILE ]]; then
rm $FILE
fi
echo "Failure on $FILE, trying gz"
FILE_GZ=$FILE.gz
wget --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/$FILE_GZ" -O $FILE_GZ
gunzip --verbose --decompress $FILE_GZ
fi
# don't know why, but my version of hostscan requires tables to be stored in libs
echo $FILE | grep --extended-regexp --quiet --invert-match ".so|tables.dat"
IS_LIB=$?
if [[ "$IS_LIB" -eq "1" ]]
then
cp --verbose $FILE $LIB_DIR
else
cp --verbose $FILE $BIN_DIR
fi
done
for i in ${BINS[@]} ; do
echo "Setting excecution bit on: $BIN_DIR/$i"
chmod u+x $BIN_DIR/$i
done
cd $WORK_DIR
rm -rf $TMP_DIR
fi
# cstub doesn't care about logging options, sic!
#ARGS="-log debug -ticket $TICKET -stub $STUB -group $GROUP -host $URL -certhash $CERTHASH"
ARGS="-log error -ticket $TICKET -stub $STUB -group $GROUP -host $URL -certhash $CERTHASH"
echo "Launching: $BIN_DIR/cstub $ARGS"
$BIN_DIR/cstub $ARGS
@danparisi
Copy link

Thanks @sharkodlak,
I had the same issue on ubuntu, and fixed adding the certificate as suggested by you.

Here is a guide on how to do that:
https://brian.haun.me/how-to-update-root-ca-certs.html

Copy link

ghost commented Feb 5, 2021

@sharkodlak @danparisi do you have this certificate's fingerprint? I cant find it on verisign.com... Any links? Thanks!

@danparisi
Copy link

danparisi commented Feb 5, 2021

@unb9rn No I don't, I just followed the guide I linked above. I think it's an old certificate but I didn't find any other solution to let it work

@BishopWolf
Copy link

Nothing is working

POST https://myvpn/global-protect/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Linux
Connected to myvpn:443
SSL negotiation with myvpn
Connected to HTTPS on myvpn with ciphersuite (TLS1.2)-(RSA)-(AES-256-GCM)
Enter login credentials
POST https://myvpn/global-protect/getconfig.esp
Portal set HIP report interval to 60 minutes).
1 gateway servers available:
  GW-*** (myvpn)
Please select GlobalProtect gateway.
GATEWAY: [GW-***]:GW-***
POST https://myvpn/ssl-vpn/login.esp
GlobalProtect login returned authentication-source=Auth_Seq_Standard
GlobalProtect login returned usually-equals-4=4
GlobalProtect login returned usually-equals-unknown=unknown
POST https://myvpn/ssl-vpn/getconfig.esp
Session will expire after 43200 minutes.
Tunnel timeout (rekey interval) is 180 minutes.
Idle timeout is 180 minutes.
No MTU received. Calculated 1422 for ESP tunnel
POST https://myvpn/ssl-vpn/hipreportcheck.esp
/usr/lib/openconnect/csd-wrapper.sh: line 122: /home/nobody/.cisco/hostscan/manifest: No such file or directory
/usr/lib/openconnect/csd-wrapper.sh: line 129: /home/nobody/.cisco/hostscan/bin/cstub: No such file or directory
POST https://myvpn/ssl-vpn/hipreport.esp
Missing or invalid required input parameters
HIP report submission failed.
Creating SSL connection failed

@cer28
Copy link

cer28 commented Feb 8, 2021

Thanks @sharkodlak and @danparisi, this solution also worked for me to get past the unable to get local issuer certificate error validating the signed libcsd.so file. There was no indication what certificate it needed, so this was vital information.

For me on Ubuntu 20.04 it was a slightly different process:

@pablomarti
Copy link

Thank you @sharkodlak and @danparisi and also thank you @cer28 for summarizing, it works for me.

@dolfinus
Copy link

Thanks @sharkodlak @danparisi @cer28, it works for me too

@janotav
Copy link

janotav commented May 4, 2022

The workaround I used on Ubuntu 22.04:

  1. Build custom docker image based on older Ubuntu where security wasn't that strict, something like
FROM ubuntu:18.04

RUN apt update \
  && apt install -y wget

and build it:

docker build -t unsecuressl:latest .
  1. In the script replace direct wget invocation with one using this image. Instead of
wget --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/manifest" -O "$HOSTSCAN_DIR/manifest"

do

docker run --rm --entrypoint wget unsecuressl:latest --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/manifest" -O- > "$HOSTSCAN_DIR/manifest"

Similarly replace other occurrences.

After doing these changes, I was able to connect.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment