Dhicitaanka cookie-ga ConnMan OpenConnect, ma aha dhibaato shahaado

ConnMan wuxuu shaqeeyaa galab kadib wuu diidaa, khadka diiwaankuna wuxuu xuso xaqiijinta shahaadada. Khadkaas wuxuu dadka u diraa xidhmooyinka CA oo aan waligood jabin. Laba khalad oo kala duwan ayaa soo saara ku dhawaad isla qaabka guuldarrada: cookie-ga fadhigu wuu dhacaa, ama shahaadada server-ka ayaa dhab ahaan is beddeshay. Waxaa lagu kala saari karaa hal daqiiqo gudaheed, mana jiro mid ka mid ah oo faraha taabto.

Laba khalad, hal khad diiwaan jaahwareer leh

Waxay ku kala baxaan laba aragtida, midkoodna ma u baahna akhris labaad. Midda hore waa goorta guuldarradii bilaabatay: cookie dhacday waxay timaadaa saacado ama maalmo shaqo kadib, iyo shahaado la beddelay waxay timaadaa isla markiiba beddelka gateway-ga.

Imtixaanka hal daqiiqo waa socodka authenticate ee hoose. Isbarbardhig FINGERPRINT-kiisa iyo OpenConnect.ServerCert ee faylka. Faraha isku mid ah iyo COOKIE kala duwan macnaheedu waa beddel cookie-ga oo keliya. Faraha kala duwan macnaheedu waa shahaadada server-ka dhab ahaan way is beddeshay, sidaas darteed si ula kac ah u dheji mar kale oo qor cidda ansixisay.

Soo saar maaddada halkii aad qori lahayd

ConnMan ma laha tallaabo soo dejinta profile-ka OpenConnect, si ka duwan NetworkManager. Wuxuu akhriyaa fayl bixineed oo qiyamkiisa ay tahay in horay loo soo saaro, habka la taageeray ee loo soo saaro waa habka authenticate ee OpenConnect.

sudo openconnect --csd-wrapper=/home/user/.cisco/csd-wrapper.sh \
  --authenticate --user myuser vpn.example.com

Wax soo saarku wuxuu daabacaa afar qiime: POST, COOKIE, HOST iyo FINGERPRINT. Faraha, oo leh horgalaha sha256:, waa dhejinta server-ka. Cookie-ga waa farshaxanka fadhiga oo cimrigiisa uu gateway-ga go'aamiyo. U qaado sida noocyo sir ah oo kala duwan: waxay dhacaan jadwalo kala duwan, oo mid keliya ayaa la filayaa inuu is beddelo.

Faylku wuxuu qaadaa labadaba, wayna duqoobaan si kala duwan

Faylka bixinta wuxuu ku hoos jiraa /var/lib/connman-vpn/ oo xiriir kasta waxaa akhriya daemon-ka VPN, ma aha applet-ka tray-ga. Ku hay magaca xiriirka qaybta caalamiga ah iyo faahfaahinta borotokoolka qaybta bixiyaha.

[global]
Name = Company VPN

[provider_openconnect]
Type = OpenConnect
Name = Company Cisco VPN
Host = vpn.example.com
Domain = corp.example
OpenConnect.ServerCert = sha256:...
OpenConnect.Cookie = ...

Isticmaal magaca martigeliyaha uu portalku dhab ahaan u adeego. Cinwaan IP qaawan ayaa laga yaabaa inuu ka gudbo imtixaanka shahaadada oo wali guul darro, sababtoo ah qalabku wuxuu maraa martigeliyaha maldahan oo wuxuu filayaa magaca.

systemctl status connman-vpn --no-pager   # is the daemon even installed and running
sudo systemctl restart connman-vpn       # after the file edit
journalctl -u connman-vpn --since '1 hour ago'  # after the connection attempt

Waxa diiwaanku dhab ahaan muujiyo

Tilmaanta tray-ga ma sheegayso khaladka aad qabto. Diiwaanku wuu sheegi doonaa, haddii aad akhrido taxanaha halkii aad ka akhrin lahayd khadka koowaad ee cabsi geliya. Cookie duugoobay wuxuu caadi ahaan muujiyaa in wada-hadalka TLS dhammaaday oo lakabka HTTP uu kadib diiday, taasina waa sababta ereyada shahaadada ay u dhinac taagan yihiin guuldarrada oggolaanshaha.

Isbarbardhig socodka authenticate cusub iyo qiyamka faylka. Haddii farahu is waafaqaan oo cookie-ga keliya duwan yahay, jawaabtaadii haysataa adigoon taaban dejinta kalsoonida.

Cusboonaysii goobta dhacday

Ku celi amarka authenticate, beddel OpenConnect.Cookie, kadibna dib u bilow daemon-ka. Ka tag faraha haddii wax soo saarka cusub uusan muujin qiime kale; markaas shahaadada server-ka dhab ahaan waa la beddelay oo dib u dhejintu waa go'aan qof uu diiwaangeliyo, ma aha dhejis laga soo nuqulay fariin khalad.

Otomaatigaynta cusboonaysiinta waa macquul: skript yar ayaa ka akhriya erayga sirta ah gelinta caadiga ah, maamula habka authenticate oo dib u qoraa khadka cookie-ga keliya. Ku hay aqoonsiga skript-ka dibaddiisa oo keliya loo akhriyi karo akoonka maamula, oo ka dhig dib-u-qorista atomik ah si socod guuldaraystay uusan uga tegin fayl badh qoran.

Haddii cusboonaysiinta loo baahan yahay kasta dhowr saacadood, qor muddada. Waa sifo ka mid ah siyaasadda fadhiyada gateway-ga, waxayna go'aamisaa in cusboonaysiinta la otomaatigaysto ama la codsado fadhi dheer.