File 0001-GlobalProtect-Add-external-browser-with-CA... of Package openconnect

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-GlobalProtect-Add-external-browser-with-CAS-support.patch of Package openconnect (Revision 3ad1065dc5b0d882348304340094b163)

Currently displaying revision 3ad1065dc5b0d882348304340094b163 , Show latest

From 016bb929eed67032f74fb2469e77831d9a348390 Mon Sep 17 00:00:00 2001
From: Jan-Michael Brummer <jan-michael.brummer1@volkswagen.de>
Date: Fri, 29 Sep 2023 16:50:15 +0200
Subject: [PATCH 1/4] GlobalProtect: Add external browser with CAS support

In order to handle 2FA login pages an external browser is necessary
until webkitgtk supports those methods out out the box.
Therefore add an option to make use of external browser depending
on default-browser setting. In order to return the callback data
from browser to openconnect a helper is necessary which registers
a MimeType in the system.

Signed-off-by: Jan-Michael Brummer <jan-michael.brummer1@volkswagen.de>

Fixes: https://gitlab.com/openconnect/openconnect/-/issues/651
---
 Makefile.am               |  11 ++
 auth-globalprotect.c      | 307 +++++++++++++++++++++++++++++++++++++-
 gp_browser_helper.c       | 101 +++++++++++++
 gp_browser_helper.desktop |   8 +
 library.c                 |  24 +--
 openconnect-internal.h    |   4 +
 6 files changed, 438 insertions(+), 17 deletions(-)
 create mode 100644 gp_browser_helper.c
 create mode 100644 gp_browser_helper.desktop

diff --git a/Makefile.am b/Makefile.am
index ce08613f..f141068a 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -16,6 +16,7 @@ noinst_DATA = openconnect-installer-$(INSTALLER_SUFFIX).exe
 endif
 
 lib_LTLIBRARIES = libopenconnect.la
+bin_PROGRAMS = gp_browser_helper
 sbin_PROGRAMS = openconnect
 man8_MANS = openconnect.8
 bin_PROGRAMS :=
@@ -25,6 +26,16 @@ noinst_PROGRAMS :=
 AM_CFLAGS = @WFLAGS@
 AM_CPPFLAGS = -DLOCALEDIR="\"$(localedir)\""
 
+# GlobalProtect Browser Helper
+gp_browser_helper_SOURCES: gp_browser_helper.c
+
+desktopdir = $(datadir)/applications
+dist_desktop_DATA = gp_browser_helper.desktop
+install-data-hook:
+	if which update-desktop-database>/dev/null 2>&1 ; then \
+		update-desktop-database; \
+	fi
+
 openconnect_SOURCES = xml.c main.c
 openconnect_CFLAGS = $(AM_CFLAGS) $(SSL_CFLAGS) $(DTLS_SSL_CFLAGS) \
 	$(LIBXML2_CFLAGS) $(JSON_CFLAGS) $(LIBPROXY_CFLAGS) \
diff --git a/auth-globalprotect.c b/auth-globalprotect.c
index 7540a4b6..c462c8b7 100644
--- a/auth-globalprotect.c
+++ b/auth-globalprotect.c
@@ -21,6 +21,20 @@
 
 #include <ctype.h>
 #include <errno.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#ifndef _WIN32
+#include <pwd.h>
+#include <sys/inotify.h>
+#endif
+
+#define MAX_EVENTS 2
+#define LEN_NAME 32
+#define EVENT_SIZE  ( sizeof (struct inotify_event) ) /*size of one event*/
+#define BUF_LEN     ( MAX_EVENTS * ( EVENT_SIZE + LEN_NAME ))
+
+#define GP_DATA_FILE "globalprotect.dat"
 
 struct login_context {
 	char *username;				/* Username that has already succeeded in some form */
@@ -29,6 +43,7 @@ struct login_context {
 	char *portal_prelogonuserauthcookie;	/* portal-prelogonuserauthcookie (from global-protect/getconfig.esp) */
 	char *region;				/* Region (typically 2 characters, e.g. DE, US) */
 	struct oc_auth_form *form;
+	int cas_auth;				/* Flag indicating whether cas auth is to be used */
 };
 
 void gpst_common_headers(struct openconnect_info *vpninfo,
@@ -61,6 +76,32 @@ const char *gpst_os_name(struct openconnect_info *vpninfo)
 		return "Windows";
 }
 
+static char *get_user_cache_dir(void)
+{
+	char *cache_dir;
+	int cache_dir_len;
+#ifndef _WIN32
+	struct passwd *pw = getpwuid(getuid());
+	char *home = strdup(pw->pw_dir);
+#else
+	/* TODO: Add WIN32 implementation */
+	char *home = strdup("");
+#endif
+
+	/* Ensure that the openconnect cache dir exists */
+	cache_dir_len = strlen(home) + strlen("/.cache/openconnect/") + 1;
+	cache_dir = malloc(cache_dir_len);
+	snprintf(cache_dir, cache_dir_len, "%s/.cache/openconnect/", home);
+	free(home);
+
+#ifndef _WIN32
+	mkdir(cache_dir, 0700);
+#else
+	CreateDirectory(cache_dir, NULL);
+#endif
+
+	return cache_dir;
+}
 
 /* Parse pre-login response ({POST,GET} /{global-protect,ssl-vpn}/pre-login.esp)
  *
@@ -83,11 +124,18 @@ static int parse_prelogin_xml(struct openconnect_info *vpninfo, xmlNode *xml_nod
 	char *prompt = NULL, *username_label = NULL, *password_label = NULL;
 	char *s = NULL, *saml_method = NULL, *saml_path = NULL;
 	int result = -EINVAL;
+	int default_browser = 0;
+	int cas_auth = 0;
 
 	if (!xmlnode_is_named(xml_node, "prelogin-response"))
 		goto out;
 
 	for (xml_node = xml_node->children; xml_node; xml_node = xml_node->next) {
+		if (xmlnode_is_named(xml_node, "saml-default-browser"))
+			default_browser = xmlnode_bool_or_int_value(xml_node);
+		if (xmlnode_is_named(xml_node, "cas-auth"))
+			cas_auth = xmlnode_bool_or_int_value(xml_node);
+
 		xmlnode_get_val(xml_node, "saml-request", &s);
 		xmlnode_get_val(xml_node, "saml-auth-method", &saml_method);
 		xmlnode_get_trimmed_val(xml_node, "authentication-message", &prompt);
@@ -97,6 +145,11 @@ static int parse_prelogin_xml(struct openconnect_info *vpninfo, xmlNode *xml_nod
 		/* XX: should we save the certificate username from <ccusername/> ? */
 	}
 
+	if (default_browser != 0) {
+		vpn_progress(vpninfo, PRG_INFO, "Using default browser\n");
+		ctx->cas_auth = cas_auth;
+	}
+
 	if (saml_method && s) {
 		/* Allow the legacy workflow (no GUI setting up open_webview) to keep working */
 		if (!vpninfo->open_webview && ctx->portal_userauthcookie)
@@ -688,8 +741,8 @@ static int gpst_login(struct openconnect_info *vpninfo, int portal, struct login
 		}
 		if (!keep_urlpath) {
 			orig_path = vpninfo->urlpath;
-			if (asprintf(&vpninfo->urlpath, "%s/prelogin.esp?tmp=tmp&clientVer=4100&clientos=%s",
-				     portal ? "global-protect" : "ssl-vpn", gpst_os_name(vpninfo)) < 0) {
+			if (asprintf(&vpninfo->urlpath, "%s/prelogin.esp?tmp=tmp&clientVer=4100&clientos=%s&default-browser=4&cas-support=yes",
+				portal ? "global-protect" : "ssl-vpn", gpst_os_name(vpninfo)) < 0) {
 				result = -ENOMEM;
 				goto out;
 			}
@@ -741,6 +794,8 @@ static int gpst_login(struct openconnect_info *vpninfo, int portal, struct login
 		append_opt(request_body, "os-version", vpninfo->platname);
 		append_opt(request_body, "server", vpninfo->hostname);
 		append_opt(request_body, "computer", vpninfo->localname);
+		if (ctx->cas_auth && vpninfo->sso_token_cookie)
+			append_opt(request_body, "token", vpninfo->sso_token_cookie);
 		if (ctx->portal_userauthcookie)
 			append_opt(request_body, "portal-userauthcookie", ctx->portal_userauthcookie);
 		if (ctx->portal_prelogonuserauthcookie)
@@ -750,9 +805,11 @@ static int gpst_login(struct openconnect_info *vpninfo, int portal, struct login
 			append_opt(request_body, "preferred-ip", vpninfo->ip_info.addr);
 		if (vpninfo->ip_info.addr6)
 			append_opt(request_body, "preferred-ipv6", vpninfo->ip_info.addr);
-		if (ctx->form->action)
-			append_opt(request_body, "inputStr", ctx->form->action);
-		append_form_opts(vpninfo, ctx->form, request_body);
+		if (ctx->form) {
+			if (ctx->form->action)
+				append_opt(request_body, "inputStr", ctx->form->action);
+			append_form_opts(vpninfo, ctx->form, request_body);
+		}
 		if ((result = buf_error(request_body)))
 			goto out;
 
@@ -770,14 +827,18 @@ static int gpst_login(struct openconnect_info *vpninfo, int portal, struct login
 			/* Invalid username/password; reuse same form, but blank,
 			 * unless we just did a blind retry.
 			 */
-			nuke_opt_values(ctx->form->opts);
+			if (ctx->form)
+				nuke_opt_values(ctx->form->opts);
+			else
+				blind_retry = 0;
+
 			if (!blind_retry)
 				goto got_form;
 			else
 				blind_retry = 0;
 		} else {
 			/* Save successful username */
-			if (!ctx->username)
+			if (!ctx->username && ctx->form && ctx->form->opts->_value)
 				ctx->username = strdup(ctx->form->opts->_value);
 			if (result == -EAGAIN) {
 				/* New form is already populated from the challenge */
@@ -789,7 +850,7 @@ static int gpst_login(struct openconnect_info *vpninfo, int portal, struct login
 				 */
 				portal = 0;
 				if (ctx->portal_userauthcookie || ctx->portal_prelogonuserauthcookie ||
-				    (strcmp(ctx->form->auth_id, "_challenge") && !ctx->alt_secret)) {
+				    (ctx->form &&(strcmp(ctx->form->auth_id, "_challenge")) && !ctx->alt_secret)) {
 					blind_retry = 1;
 					goto replay_form;
 				}
@@ -893,3 +954,233 @@ out:
 	free(xml_buf);
 	return result;
 }
+
+static int parse_callback_file (struct openconnect_info *vpninfo, const char *data_file)
+{
+	FILE *fptr;
+	char *data;
+	int len;
+	void *xml = NULL;
+	xmlDocPtr xml_doc;
+	xmlNode *xml_node;
+	char *comment = NULL;
+	char *prelogin_cookie = NULL;
+	char *saml_username = NULL;
+	int size;
+
+	/* Open callback data file */
+	fptr = fopen(data_file, "r");
+	if (!fptr) {
+		vpn_progress(vpninfo, PRG_INFO, "Failed to open file %s\n", data_file);
+		return -1;
+	}
+
+	/* Get file size */
+	fseek(fptr, 0L, SEEK_END);
+	size = ftell(fptr);
+	fseek(fptr, 0L, SEEK_SET);
+
+	/* Read data */
+	data = malloc(size + 1);
+	memset(data, 0, size + 1);
+	fread(data, size, 1, fptr);
+	fclose(fptr);
+
+	if (strstr(data, "cas-as%3D")) {
+		char *token = strstr (data, "token%3D");
+		char *un = strstr (data, "un%3D");
+
+		if (!token || !un) {
+			free(data);
+			return -1;
+		}
+
+		vpn_progress(vpninfo, PRG_INFO, "CAS method for user %s\n", un);
+
+		saml_username = malloc (token - un);
+		if (saml_username) {
+			strncpy(saml_username, un + 5, token - un - 5 - 3);
+			free(vpninfo->sso_username);
+			vpninfo->sso_username = saml_username;
+		}
+
+		vpninfo->sso_token_cookie = strdup(token + 8);
+		free(data);
+
+		return 0;
+	}
+
+	vpn_progress(vpninfo, PRG_INFO, "Token method\n");
+
+	xml = openconnect_base64_decode (&len, data);
+	free(data);
+
+	vpn_progress(vpninfo, PRG_INFO, "xml (%d): %s\n", len, (char*)xml);
+
+	xml_doc = xmlReadMemory((char*)xml, len, NULL, NULL, XML_PARSE_NOERROR|XML_PARSE_RECOVER);
+	free(xml);
+
+	xml_node = xmlDocGetRootElement(xml_doc);
+	if (!xml_node)
+		return -1;
+
+	for (xmlNode *x = xml_node->children; x; x = x->next) {
+		/* Weird protocol response...
+		 * <html>
+		 *	<!-- <saml-auth-status>1</saml-auth-status>       // Authentication Status 1 = OK
+		 *	<prelogin-cookie>TOKEN</prelogin-cookie>          // Prelogin Cookie
+		 *	<saml-username>NAME</saml-username>               // Username
+		 * 	<saml-slo>no</saml-slo>                           // SAML Single Log-Out (SLO)
+		 *	<saml-SessionNotOnOrAfter>2023-11-18T03:13:37.368Z</saml-SessionNotOnOrAfter> // Session Lifetime, used for reconnect
+		 * -></html>
+		 */
+		if (!xmlnode_get_val(x, "comment", &comment)) {
+			/* Create a parent xml node for parsing */
+			char *buf = malloc(strlen("<parent>") + strlen(comment) + strlen("</parent>"));
+
+			strcpy(buf, "<parent>");
+			strcat(buf, comment);
+			strcat(buf, "</parent>");
+
+			xmlDocPtr xml2_doc = xmlReadMemory((char*)buf, strlen(buf), NULL, NULL, XML_PARSE_NOERROR|XML_PARSE_RECOVER);
+			free(buf);
+			xmlNode *xml2_node = xmlDocGetRootElement(xml2_doc);
+
+			for (xmlNode *y = xml2_node->children; y; y = y->next) {
+				vpn_progress(vpninfo, PRG_DEBUG, "-> Got node: %s\n", y->name);
+				xmlnode_get_val(y, "prelogin-cookie", &prelogin_cookie);
+				xmlnode_get_val(y, "saml-username", &saml_username);
+			}
+			xmlFreeDoc(xml2_doc);
+		}
+	}
+
+	if (saml_username) {
+		vpn_progress(vpninfo, PRG_INFO, "saml_username: %s\n", saml_username);
+		free(vpninfo->sso_username);
+		vpninfo->sso_username = strdup(saml_username);
+	}
+
+	if (prelogin_cookie) {
+		vpn_progress(vpninfo, PRG_INFO, "prelogin_cookie: %s\n", prelogin_cookie);
+		free(vpninfo->sso_token_cookie);
+		free(vpninfo->sso_cookie_value);
+		vpninfo->sso_token_cookie = strdup("prelogin_cookie");
+		vpninfo->sso_cookie_value = strdup(prelogin_cookie);
+	}
+
+	return 0;
+}
+
+int gpst_handle_external_browser(struct openconnect_info *vpninfo)
+{
+	int ret = -1;
+	char *data_file = NULL;
+	char *uri = NULL;
+	char *oc_cache_dir = NULL;
+	int data_file_len;
+
+	oc_cache_dir = get_user_cache_dir ();
+
+	/* Create data */
+	data_file_len = strlen (oc_cache_dir) + 1 + strlen(GP_DATA_FILE) + 1;
+	data_file = malloc(data_file_len);
+	strcpy(data_file, oc_cache_dir);
+	strcat(data_file, "/");
+	strcat(data_file, GP_DATA_FILE);
+
+	/* Check whether the sso_login is actually a data field */
+	if (strlen(vpninfo->sso_login) > 22 && strncmp(vpninfo->sso_login, "data:text/html;base64,", 22) == 0) {
+		int len;
+		void *out = openconnect_base64_decode(&len, vpninfo->sso_login + 22);
+		char *tmp_file;
+		FILE *file;
+		int tmp_file_len;
+
+		vpn_progress(vpninfo, PRG_INFO, "data: %s\n", vpninfo->sso_login);
+		if (!out)
+			goto finish;
+
+		tmp_file_len = strlen(oc_cache_dir) + strlen("/saml.html") + 1;
+		tmp_file = malloc(tmp_file_len);
+		strcpy(tmp_file, oc_cache_dir);
+		strcat(tmp_file, "/saml.html");
+		file = fopen(tmp_file, "w");
+		fwrite((char*)out, 1, len, file);
+		fclose(file);
+
+		free(out);
+
+		uri = malloc(strlen("file:///") + strlen(tmp_file) + 1);
+		strcpy(uri, "file:///");
+		strcat(uri, tmp_file);
+		free(tmp_file);
+	} else {
+		uri = strdup(vpninfo->sso_login);
+	}
+
+#ifndef _WIN32
+	int fd, wd;
+
+	fd = inotify_init();
+	if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
+		goto finish;
+
+	wd = inotify_add_watch(fd, oc_cache_dir, IN_CLOSE_WRITE);
+	if (wd == -1) {
+		vpn_progress(vpninfo, PRG_DEBUG, "Could not watch : %s\n", oc_cache_dir);
+	} else {
+		vpn_progress(vpninfo, PRG_DEBUG, "Watching : %s\n", oc_cache_dir);
+	}
+
+	if (vpninfo->open_ext_browser) {
+		ret = vpninfo->open_ext_browser(vpninfo, uri, vpninfo->cbdata);
+	} else {
+		ret = -EINVAL;
+	}
+
+	if (ret) {
+		vpn_progress(vpninfo, PRG_ERR,
+			     _("Failed to spawn external browser for %s\n"),
+			     vpninfo->sso_login);
+		goto finish;
+	}
+
+	/* TODO: Add timeout check to prevent lock up */
+	 while (1) {
+		int i = 0, length;
+		char buffer[BUF_LEN];
+
+		length = read(fd, buffer, BUF_LEN);
+
+		while (i < length) {
+ 			struct inotify_event *event = (struct inotify_event *) &buffer[i];
+
+			if (event->len) {
+				if ((event->mask & IN_CLOSE_WRITE) && !(event->mask & IN_ISDIR) && strcmp(event->name, GP_DATA_FILE) == 0) {
+					vpn_progress(vpninfo, PRG_INFO, "The file %s was written.\n", event->name);
+					ret = parse_callback_file (vpninfo, data_file);
+					goto finish;
+				}
+			}
+			i += EVENT_SIZE + event->len;
+		}
+	}
+#else
+	vpn_progress(vpninfo, PRG_INFO, "Proper callback data handling missing on Windows\n");
+	Sleep(10 * 1000);
+	ret = parse_callback_file (vpninfo, data_file);
+#endif
+
+finish:
+	if (uri)
+		free(uri);
+
+	if (oc_cache_dir)
+		free(oc_cache_dir);
+
+	if (data_file)
+		free(data_file);
+
+	return ret;
+}
diff --git a/gp_browser_helper.c b/gp_browser_helper.c
new file mode 100644
index 00000000..7fcc2e69
--- /dev/null
+++ b/gp_browser_helper.c
@@ -0,0 +1,101 @@
+/*
+ * OpenConnect (SSL + DTLS) VPN client
+ *
+ * Copyright © 2023 Jan-Michael Brummer <jan-michael.brummer1@volkswagen.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * version 2.1, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+#ifndef _WIN32
+#include <pwd.h>
+#endif
+
+#define DATA_FILE_NAME "globalprotect.dat"
+
+static char *get_user_cache_dir(void)
+{
+	char *cache_dir;
+	int cache_dir_len;
+#ifndef _WIN32
+	struct passwd *pw = getpwuid(getuid());
+	char *home = strdup(pw->pw_dir);
+#else
+	/* TODO: Add WIN32 implementation */
+	char *home = strdup("");
+#endif
+
+	/* Ensure that the openconnect cache dir exists */
+	cache_dir_len = strlen(home) + strlen("/.cache/openconnect/") + 1;
+	cache_dir = malloc(cache_dir_len);
+	snprintf(cache_dir, cache_dir_len, "%s/.cache/openconnect/", home);
+	free(home);
+
+#ifndef _WIN32
+	mkdir(cache_dir, 0700);
+#else
+	mkdir(cache_dir);
+#endif
+
+	return cache_dir;
+}
+
+int main(int argc, char **argv)
+{
+	FILE *fp;
+	char *callback_data;
+	char *oc_cache_dir;
+	char *data_file;
+	int data_file_len;
+	int ret = 0;
+
+	if (argc < 2)
+		return -1;
+
+	callback_data = argv[1];
+
+	oc_cache_dir = get_user_cache_dir();
+
+	data_file_len = strlen (oc_cache_dir) + strlen (DATA_FILE_NAME) + 2;
+	data_file = malloc (data_file_len);
+	strcpy(data_file, oc_cache_dir);
+	strcat(data_file, "/");
+	strcat(data_file, DATA_FILE_NAME);
+
+	fp = fopen(data_file, "w");
+	if (fp) {
+		/* callback_data format:
+		 * globalprotectcallback:DATA
+		 *
+		 * DATA:
+		 * - Using CAS: cas-as=1&un=<USER>&token=<TOKEN>
+		 * - Without CAS: <TOKEN>
+		 *
+		 * As we just want the data, we skip the prefix
+		 */
+		fwrite(callback_data + strlen("globalprotectcallback:"),
+		       strlen(callback_data) - strlen("globalprotectcallback:"),
+		       1,
+		       fp);
+		fclose (fp);
+		ret = 0;
+	}
+
+	free(data_file);
+	free(oc_cache_dir);
+
+	return ret;
+}
diff --git a/gp_browser_helper.desktop b/gp_browser_helper.desktop
new file mode 100644
index 00000000..a3869f52
--- /dev/null
+++ b/gp_browser_helper.desktop
@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=OpenConnect Browser Helper for GlobalProtect
+Type=Application
+Terminal=false
+NoDisplay=true
+Exec=gp_browser_helper %U
+MimeType=x-scheme-handler/globalprotectcallback;
\ No newline at end of file
diff --git a/library.c b/library.c
index 2abea4d1..ff0df5f4 100644
--- a/library.c
+++ b/library.c
@@ -176,6 +176,7 @@ static const struct vpn_proto openconnect_protos[] = {
 		.obtain_cookie = gpst_obtain_cookie,
 		.sso_detect_done = gpst_sso_detect_done,
 		.udp_protocol = "ESP",
+		.handle_external_browser = gpst_handle_external_browser,
 #ifdef HAVE_ESP
 		.udp_setup = esp_setup,
 		.udp_mainloop = esp_mainloop,
@@ -1708,15 +1709,20 @@ retry:
 		vpninfo->sso_cookie_value = NULL;
 		vpninfo->sso_username = NULL;
 
-		/* Handle the special Cisco external browser mode */
-		if (vpninfo->sso_browser_mode && !strcmp(vpninfo->sso_browser_mode, "external")) {
-			ret = handle_external_browser(vpninfo);
-		} else if (vpninfo->open_webview) {
-			ret = vpninfo->open_webview(vpninfo, vpninfo->sso_login, vpninfo->cbdata);
-		} else {
-			vpn_progress(vpninfo, PRG_ERR,
-				     _("No SSO handler\n")); /* XX: print more debugging info */
-			ret = -EINVAL;
+		if (vpninfo->proto->handle_external_browser)
+			ret = vpninfo->proto->handle_external_browser(vpninfo);
+
+		if (ret != 0) {
+			/* Handle the special Cisco external browser mode */
+			if (vpninfo->sso_browser_mode && !strcmp(vpninfo->sso_browser_mode, "external")) {
+				ret = handle_external_browser(vpninfo);
+			} else if (vpninfo->open_webview) {
+				ret = vpninfo->open_webview(vpninfo, vpninfo->sso_login, vpninfo->cbdata);
+			} else {
+				vpn_progress(vpninfo, PRG_ERR,
+					     _("No SSO handler\n")); /* XX: print more debugging info */
+				ret = -EINVAL;
+			}
 		}
 		if (!ret) {
 			for (opt = form->opts; opt; opt = opt->next) {
diff --git a/openconnect-internal.h b/openconnect-internal.h
index 5abfe98d..bec2fe3b 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -863,6 +863,9 @@ struct vpn_proto {
 
 	/* Catch probe packet confirming the (UDP) session */
 	int (*udp_catch_probe)(struct openconnect_info *vpninfo, struct pkt *p);
+
+	/* External browser */
+	int (*handle_external_browser)(struct openconnect_info *vpninfo);
 };
 
 static inline struct pkt *dequeue_packet(struct pkt_q *q)
@@ -1396,6 +1399,7 @@ int gpst_mainloop(struct openconnect_info *vpninfo, int *timeout, int readable);
 int gpst_esp_send_probes(struct openconnect_info *vpninfo);
 int gpst_esp_catch_probe(struct openconnect_info *vpninfo, struct pkt *pkt);
 int gpst_sso_detect_done(struct openconnect_info *vpninfo, const struct oc_webview_result *result);
+int gpst_handle_external_browser(struct openconnect_info *vpninfo);
 
 /* lzs.c */
 int lzs_decompress(unsigned char *dst, int dstlen, const unsigned char *src, int srclen);
-- 
2.45.2

Places

File 0001-GlobalProtect-Add-external-browser-with-CAS-support.patch of Package openconnect (Revision 3ad1065dc5b0d882348304340094b163)

Places