OpenConnect

OpenConnect is a client for Cisco's AnyConnect SSL VPN, which is supported by the ASA5500 Series, by IOS 12.4(9)T or later on Cisco SR500, 870, 880, 1800, 2800, 3800, 7200 Series and Cisco 7301 Routers, and probably others.

OpenConnect is released under the GNU Lesser Public License, version 2.1.

Like vpnc, OpenConnect is not officially supported by, or associated in any way with, Cisco Systems. It just happens to interoperate with their equipment.

Development of OpenConnect was started after a trial of their "official" client under Linux found it to have many deficiencies:

Naturally, OpenConnect addresses all of the above issues, and more.

Getting started

Before you get dismayed by the badly laid out information below, here's a simple intro to using OpenConnect.
  1. Install OpenConnect.
    Some distributions like Fedora have packages; otherwise you can download it and type 'make' to build it. To build it, you'll want development packages for libxml2, zlib and obviously OpenSSL to be installed.
  2. Install a vpnc-script.
    This script is what sets up all the addresses and routes for you; it's the same as vpnc's. You can get one from here if you don't have one — or if you need IPv6 or Solaris support, which the vpnc version lacks. (Note that the script needs to be executable, and stored somewhere where SELinux or similar security setups won't prevent the root user from accessing it.)
  3. Connect to your server, running as root:
    openconnect --script /etc/vpnc/vpnc-script https://vpn.mycompany.com/
That should be it, if you have a password-based login. If you use certificates, you'll need to tell OpenConnect where to find the certificate with the -c option. You might need to steal the certificate from your Windows certificate store using a tool like Jailbreak.

You can ignore anything you see below about needing to patch OpenSSL so that DTLS works — you don't really need it, although it will make your connections much faster if you're experiencing packet loss between you and the VPN server. But you can worry about that later.

Supported Platforms

OpenConnect is known to work on Linux, OpenBSD, FreeBSD, NetBSD, DragonFly BSD, OpenSolaris and Mac OS X platforms, and should be trivially portable to any other platform supporting TUN/TAP devices and on which OpenSSL runs. IPv6 support is tested on Linux, FreeBSD and OpenSolaris.

For Solaris support, and for IPv6 on any platform, the vpnc-script shipped with vpnc itself (as of v0.5.3) is not sufficient. It is necessary to use the script from my vpnc-scripts repository instead.

It is known to work on at least i386, x86_64, PowerPC and MIPS processors, and should not have issues with portability to other CPUs.

Note that 'Cisco Secure Desktop' support may require the ability to run Linux/i386 binaries; see below.

Features

Running as non-root

There are two ways that OpenConnect can run without root privileges. The first is that it can use a tun device which is created in advance by the root user, and set to be owned by the user who runs OpenConnect.

The second is that it can avoid using the tun device altogether and instead spawn a user-supplied program, passing all data traffic through a UNIX socket to that program. This latter option can be used in conjunction with a userspace TCP stack such as lwip to provide SOCKS access to the VPN without giving full access to all untrusted users and processes on the computer, and without requiring root privileges at all.

Cisco Secure Desktop

The 'Cisco Secure Desktop' is a bit of a misnomer — it works by downloading a trojan binary from the server and running it on your client machine to perform some kind of 'verification' and post its approval back to the server. This seems anything but secure to me, especially given their history of trivially-exploitable bugs.

It's also fairly easy to subvert, by running your own modified binary instead of the one you download from the server. Or by running their binary but poking at it with gdb.

We support this idiocy, but because of the security concerns the trojan will be executed only if a userid is specified on the command line using the --csd-user= option.

This support currently only works when the server has a Linux binary installed, and only when that Linux binary runs on the client machine.

Mailing list

There is a mailing list at openconnect-devel@lists.infradead.org. To subscribe, visit the Mailman admin page.

TODO

Platform support for new UNIX systems is relatively simple to add — most of the difference is in the TUN/TAP device handling, and the major variants of that are already supported.

A port to Windows should be fairly simple, since a TUN/TAP driver exists for Windows and Cygwin should make the basic port work OK.

A port to Symbian, to provide VPN connectivity on phone handsets, would be very useful. Any volunteers?

Download

Development of OpenConnect is in the git repository at git://git.infradead.org/users/dwmw2/openconnect.git, which can be viewed in gitweb at http://git.infradead.org/users/dwmw2/openconnect.git

Tarball releases can be downloaded from ftp://ftp.infradead.org/pub/openconnect/

Release Notes / Changelog

For full changelog entries including the latest development, see gitweb.

NetworkManager support

Support for OpenConnect in NetworkManager has been integrated into GNOME git and is released alongside NetworkManager's other VPN modules: http://ftp.gnome.org/pub/GNOME/sources/NetworkManager-openconnect/.

Unlike other VPN support in NetworkManager, the auth-dialog tool which handles GUI authentication is part of OpenConnect itself, rather than included in the network-manager-openconnect package. This is because it shares a lot of code with OpenConnect, but doesn't actually share any with NetworkManager or the other parts of the NetworkManager support.

ConnMan support

Basic support for OpenConnect in ConnMan has been submitted, and is pending approval. It can be obtained from the git repository at git://git.infradead.org/users/dwmw2/connman-openconnect.git; browsable in gitweb.

Requirements

The basic text-mode client uses the following libraries: Mac OS X users will also need to install the Mac OS X tun/tap driver, and Solaris users will need the Solaris one. Note that for IPv6 support, the Solaris tun/tap driver from 16th Nov 2009 or newer is required.

For building the NetworkManager support, you will also need:

Patches converting OpenConnect from libxml2 to something more compact like expat would be welcomed...

How the VPN works

The VPN is extremely simple, based almost entirely on the standard HTTPS and DTLS protocols. You connect to the secure web server, authenticate using certificates and/or arbitrary web forms, and you are rewarded with a standard HTTP cookie.

You then use this cookie in an HTTP CONNECT request, and can then pass traffic over that connection. IP addresses and routing information are passed back and forth in the headers of that CONNECT request.

Since TCP over TCP is very suboptimal, the VPN also attempts to use UDP datagrams, and will only actually pass traffic over the HTTPS connection if that fails. The UDP connectivity is done using Datagram TLS, which is supported by OpenSSL.

OpenSSL/DTLS compatibility

Note: DTLS is optional and not required for basic connectivity, as explained above.

Unfortunately, Cisco used an old version of OpenSSL for their server, which predates the official RFC and has a few differences in the implementation of DTLS.

Compatibility support for their "speshul" version of the protocol is in the 0.9.8m and later releases of OpenSSL (and 1.0.0-beta2 and later).

If you are using an older version of OpenSSL, DTLS will only work if you apply this patch from OpenSSL CVS:

For versions older than 0.9.8j, some generic DTLS bug fixes are also required: The username/password for OpenSSL RT is 'guest/guest'

Distribution Status

Updates to the information below are welcomed, especially for distributions (including *BSD etc.) which aren't yet mentioned.

Fedora

Both openconnect and NetworkManager-openconnect packages are included in Fedora. Fedora's OpenSSL packages include all required patches for DTLS compatibility.

Debian

The openconnect and network-manager-openconnect packages are available in unstable and testing.
Debian bug #524982 has been filed, requesting that the required patches be included in Debian's OpenSSL package.

Ubuntu

Reasonably current versions of the required packages are finally included in Ubuntu 10.04 "Lucid". Older releases still have out of date OpenSSL and out of date OpenConnect which doesn't work around the latest Cisco bugs.

Gentoo

Gentoo bug #263097 has been filed, asking for openconnect to be packaged.

NetBSD, DragonFly BSD, etc. (pkgsrc)

There are packages for vpnc-script and openconnect in the pkgsrc-wip repository (pkgsrc-wip.sf.net).

FreeBSD

An openconnect port is available for FreeBSD. FreeBSD does not yet ship a version of OpenSSL which supports Cisco's "speshul" version of DTLS.
David Woodhouse <dwmw2@infradead.org>
Last modified: Sat May 15 09:23:37 BST 2010