GitHub - nmav/openconnect-mine: Experimental extensions to openconnect client

Branches Tags

Name		Name	Last commit message	Last commit date
Latest commit History 2,687 Commits
android		android
java		java
m4		m4
po		po
tests		tests
www		www
.gitignore		.gitignore
.gitlab-ci.yml		.gitlab-ci.yml
AUTHORS		AUTHORS
COPYING.LGPL		COPYING.LGPL
Makefile.am		Makefile.am
README.DTLS		README.DTLS
README.TESTS		README.TESTS
TODO		TODO
acinclude.m4		acinclude.m4
auth-common.c		auth-common.c
auth-juniper.c		auth-juniper.c
auth.c		auth.c
autogen.sh		autogen.sh
compat.c		compat.c
config.rpath		config.rpath
configure.ac		configure.ac
cstp.c		cstp.c
digest.c		digest.c
dtls.c		dtls.c
esp-seqno.c		esp-seqno.c
esp.c		esp.c
gnutls-dtls.c		gnutls-dtls.c
gnutls-esp.c		gnutls-esp.c
gnutls.c		gnutls.c
gnutls.h		gnutls.h
gnutls_pkcs12.c		gnutls_pkcs12.c
gnutls_tpm.c		gnutls_tpm.c
gssapi.c		gssapi.c
http-auth.c		http-auth.c
http.c		http.c
iconv.c		iconv.c
jni.c		jni.c
libopenconnect.map.in		libopenconnect.map.in
library.c		library.c
lzo.c		lzo.c
lzo.h		lzo.h
lzs.c		lzs.c
main.c		main.c
mainloop.c		mainloop.c
ntlm.c		ntlm.c
oath.c		oath.c
oncp.c		oncp.c
openconnect-internal.h		openconnect-internal.h
openconnect.8.in		openconnect.8.in
openconnect.h		openconnect.h
openconnect.pc.in		openconnect.pc.in
openssl-dtls.c		openssl-dtls.c
openssl-esp.c		openssl-esp.c
openssl-pkcs11.c		openssl-pkcs11.c
openssl.c		openssl.c
script.c		script.c
ssl.c		ssl.c
sspi.c		sspi.c
stoken.c		stoken.c
tncc-wrapper.py		tncc-wrapper.py
tun-win32.c		tun-win32.c
tun.c		tun.c
version.sh		version.sh
xml.c		xml.c
yubikey.c		yubikey.c

Repository files navigation

Cisco's implementation of the DTLS protocol unfortunately does not
comply with the relevant standards. OpenSSL 0.9.8m or newer, and
1.0.0-beta2 or newer, contain a compatibility mode which allows
interoperation with Cisco's servers.

As long as you are using a current version of OpenSSL, you have nothing
to worry about -- everything should work optimally.

Without a suitable OpenSSL, the openconnect client will fall back to
passing packets over the HTTPS connection. This will still work OK, but 
will suffer quite a lot if your connection has packet loss. For details
of why that happens, see http://sites.inka.de/~W1011/devel/tcp-tcp.html

If you insist on using ancient buggy versions of OpenSSL, these are the
patches you require if you want DTLS to work:

For versions of OpenSSL earlier than 0.9.8m, you'll need the Cisco
compatibility support:
	http://cvs.openssl.org/chngview?cn=18037

For versions of OpenSSL earlier than 0.9.8j, a couple of other DTLS
bug-fixes are also required:
	http://cvs.openssl.org/chngview?cn=17500
	http://cvs.openssl.org/chngview?cn=17505