WIP: Add openconnect_set_id_option to API, and --local-id to CLI
This addresses #133.
Examples:
-
--prot=anyconnect --local-id platform_version="$(uname -a)" --local-id device_uniqueid=A1C043E19F166410ABC2C2BDC8C376DA4F7F03513FBE1DCB3A066F22C65C12B6 --local-id device_type="VMWare ESX whatever"(replicates behavior ofopenconnect_set_mobile_infoAPI function) -
--prot=nc --csd-wrapper=trojans/tncc-emulate.py --local-id TNCC_DEVICE_ID=f00faaabbcccdd --local-id TNCC_FUNK=1(pass arbitraryTNCC_*variables totrojans/tncc-emulate.py) -
--prot=gp --local-id os-version="Windows 10 x64 SP2 blah blah" --local-id app-version="5.3.3-1" --local-id host-id="deadbeef-dead-beef-dead-beefdeadbeef"(setos-version,app-version/gpclientversion, andhost-idfields submitted to{login,getconfig}.espto non-default values
Things that are great about this:
- No more worrying about how to design an API for random field X that some VPN wants.
- No more cluttering global
struct openconnect_infowith random field X that some VPN of a specific protocol wants - Can easily specify repeated values of fields like AnyConnect client MAC address, with
--local-id mac_address=aa-bb-cc-dd-ee-ff --local-id mac_address=11-22-33-44-55-66, and have the<mac-address-list>XML correctly constructed.
Things I don't love about this…
- We're stuck with the existing
openconnect_set_mobile_infoAPI function which manages to be not just redundant and overly-specific but also incomplete (because it doesn't include the originally-proposedmobile_mac_addressparameter). - Key names are randomly protocol-specific. For example, …
-
Cisco
device_uniqueid, JuniperTNCC_DEVICE_ID, and GlobalProtecthost-idare basically all the same thing. -
Cisco
platform_versionand GlobalProtectos-versionare basically the same thing too. -
Does this matter? Should we try to "unify" these under generic names?
We already have generic APIs and CLI options for platform (
--os={win,linux,etc}) and client hostname (--local-hostname); despite the protocol-agnostic naming, these are used in ways that are entirely protocol-specific.Should we consider this past pattern a mistake? Should we reserve it for values that are reasonably transparent, like client hostname, but not opaque values like obfuscated device ID? If so, where do we draw the line?
-