Cisco Anyconnect CSD wrapper for OpenConnect (exhanced to autodownload and autoupdate hostscan)

csd-wrapper.sh

#!/bin/bash
# Cisco Anyconnect CSD wrapper for OpenConnect

# Enter your vpn host here
CSD_HOSTNAME=
if [[ -z ${CSD_HOSTNAME} ]]
then
    echo "Define CSD_HOSTNAME with vpn-host in script text. Exiting."
    exit 1
fi

HOSTSCAN_DIR="$HOME/.cisco/hostscan"
LIB_DIR="$HOSTSCAN_DIR/lib"
BIN_DIR="$HOSTSCAN_DIR/bin"

BINS=("cscan" "cstub" "cnotify")


# parsing command line
shift

URL=
TICKET=
STUB=
GROUP=
CERTHASH=
LANGSELEN=

while [ "$1" ]; do
    if [ "$1" == "-ticket" ];   then shift; TICKET=$1; fi
    if [ "$1" == "-stub" ];     then shift; STUB=$1; fi
    if [ "$1" == "-group" ];    then shift; GROUP=$1; fi
    if [ "$1" == "-certhash" ]; then shift; CERTHASH=$1; fi
    if [ "$1" == "-url" ];      then shift; URL=$1; fi
    if [ "$1" == "-langselen" ];then shift; LANGSELEN=$1; fi
    shift
done


ARCH=$(uname -m)

if [[ "$ARCH" == "x86_64" ]]
then
    ARCH="linux_x64"
else
    ARCH="linux_i386"
fi

# creating dirs
for dir in $HOSTSCAN_DIR $LIB_DIR $BIN_DIR ; do
    if [[ ! -f $dir ]]
    then
        mkdir -p $dir
    fi
done

# getting manifest, and checking binaries
wget --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/manifest" -O "$HOSTSCAN_DIR/manifest"

# generating md5.sum with full paths from manifest
export HOSTSCAN_DIR=$HOSTSCAN_DIR
cat $HOSTSCAN_DIR/manifest | sed -r 's/\(|\)//g' | awk '{ cmd = "find $HOSTSCAN_DIR -iname " $2; while (cmd | getline line) { print $4, line; } }' > $HOSTSCAN_DIR/md5.sum

# check number of files either
MD5_LINES=`wc --lines $HOSTSCAN_DIR/md5.sum | awk '{ print $1; }'`
MANIFEST_LINES=`wc --lines $HOSTSCAN_DIR/manifest | awk '{ print $1; }'`
echo "Got $MANIFEST_LINES files in manifes, locally found $MD5_LINES"

# check md5
md5sum -c $HOSTSCAN_DIR/md5.sum
if [[ "$?" -ne "0" || "$MD5_LINES" -ne "$MANIFEST_LINES" ]]
then
    echo "Corrupted files, or whatever wrong with md5 sums, or missing some file"
    # just download every file mentioned in manifest (not ideal, but hopefully should be enough)
    FILES=( $(cat $HOSTSCAN_DIR/manifest | sed -r 's/\(|\)//g' | awk '{ print $2; }') )
    WORK_DIR=`pwd`
    TMP_DIR=`mktemp -d` && cd $TMP_DIR
    for i in ${FILES[@]} ; do
        FILE="$(basename "$i")"
           
        echo "Downloading: $FILE to $TMP_DIR"
        wget --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/$FILE" -O $FILE

        # some files are in gz (don't understand logic here)
        if [[ ! -f $FILE || ! -s $FILE ]]
        then
            # remove 0 size files
            if [[ ! -s $FILE ]]; then 
                rm $FILE
            fi
            
            echo "Failure on $FILE, trying gz"
            FILE_GZ=$FILE.gz
            wget --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/$FILE_GZ" -O $FILE_GZ
            gunzip --verbose --decompress $FILE_GZ
        fi
	
        # don't know why, but my version of hostscan requires tables to be stored in libs
        echo $FILE | grep --extended-regexp --quiet --invert-match ".so|tables.dat"
        IS_LIB=$?
        if [[ "$IS_LIB" -eq "1" ]]
        then
            cp --verbose $FILE $LIB_DIR
        else
            cp --verbose $FILE $BIN_DIR
        fi
        
    done
    
    for i in ${BINS[@]} ; do
        echo "Setting excecution bit on: $BIN_DIR/$i"
        chmod u+x $BIN_DIR/$i
    done
    
    cd $WORK_DIR
    rm -rf $TMP_DIR
    
fi

# cstub doesn't care about logging options, sic!
#ARGS="-log debug -ticket $TICKET -stub $STUB -group $GROUP -host $URL -certhash $CERTHASH"
ARGS="-log error -ticket $TICKET -stub $STUB -group $GROUP -host $URL -certhash $CERTHASH"

echo "Launching: $BIN_DIR/cstub $ARGS"
$BIN_DIR/cstub $ARGS

Thanks @sharkodlak,
I had the same issue on ubuntu, and fixed adding the certificate as suggested by you.

Here is a guide on how to do that:
https://brian.haun.me/how-to-update-root-ca-certs.html

@sharkodlak @danparisi do you have this certificate's fingerprint? I cant find it on verisign.com... Any links? Thanks!

@unb9rn No I don't, I just followed the guide I linked above. I think it's an old certificate but I didn't find any other solution to let it work

Nothing is working

POST https://myvpn/global-protect/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Linux
Connected to myvpn:443
SSL negotiation with myvpn
Connected to HTTPS on myvpn with ciphersuite (TLS1.2)-(RSA)-(AES-256-GCM)
Enter login credentials
POST https://myvpn/global-protect/getconfig.esp
Portal set HIP report interval to 60 minutes).
1 gateway servers available:
  GW-*** (myvpn)
Please select GlobalProtect gateway.
GATEWAY: [GW-***]:GW-***
POST https://myvpn/ssl-vpn/login.esp
GlobalProtect login returned authentication-source=Auth_Seq_Standard
GlobalProtect login returned usually-equals-4=4
GlobalProtect login returned usually-equals-unknown=unknown
POST https://myvpn/ssl-vpn/getconfig.esp
Session will expire after 43200 minutes.
Tunnel timeout (rekey interval) is 180 minutes.
Idle timeout is 180 minutes.
No MTU received. Calculated 1422 for ESP tunnel
POST https://myvpn/ssl-vpn/hipreportcheck.esp
/usr/lib/openconnect/csd-wrapper.sh: line 122: /home/nobody/.cisco/hostscan/manifest: No such file or directory
/usr/lib/openconnect/csd-wrapper.sh: line 129: /home/nobody/.cisco/hostscan/bin/cstub: No such file or directory
POST https://myvpn/ssl-vpn/hipreport.esp
Missing or invalid required input parameters
HIP report submission failed.
Creating SSL connection failed

Thanks @sharkodlak and @danparisi, this solution also worked for me to get past the unable to get local issuer certificate error validating the signed libcsd.so file. There was no indication what certificate it needed, so this was vital information.

For me on Ubuntu 20.04 it was a slightly different process:

• Get the "verisigng5.crt" certificate from https://brian.haun.me/how-to-update-root-ca-certs.html
• Save to /usr/share/ca-certificates
• Add filename to the list in /etc/ca-certificates.conf
• Run update-ca-certificates

Thank you @sharkodlak and @danparisi and also thank you @cer28 for summarizing, it works for me.

Thanks @sharkodlak @danparisi @cer28, it works for me too

The workaround I used on Ubuntu 22.04:

1. Build custom docker image based on older Ubuntu where security wasn't that strict, something like

FROM ubuntu:18.04

RUN apt update \
  && apt install -y wget

and build it:

docker build -t unsecuressl:latest .

2. In the script replace direct wget invocation with one using this image. Instead of

wget --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/manifest" -O "$HOSTSCAN_DIR/manifest"

do

docker run --rm --entrypoint wget unsecuressl:latest --no-check-certificate -c "https://${CSD_HOSTNAME}/CACHE/sdesktop/hostscan/$ARCH/manifest" -O- > "$HOSTSCAN_DIR/manifest"

Similarly replace other occurrences.

After doing these changes, I was able to connect.