abrasive / nxbender Goto Github PK
View Code? Open in Web Editor NEWOpen source client for netExtender SSL VPNs
License: BSD 3-Clause "New" or "Revised" License
nxbender's People
Contributors
Stargazers
Watchers
Forkers
retornaz larswolter tisoft tomkcook drivera73 richardash1981 guillaumeseren syhe sshyran justbeta jeanlego orbitz scottworkman lykos153 00mjk fgiuba githangar flintinxbender's Issues
Not working on Ubuntu 20.04
Since Ubuntu 20.04 deprecated python2 it is no longer shipped and the paths are different. pip is now pip3 and python is now python3. Also, after changing the shebang and launching the program I get: ModuleNotFoundError: No module named 'configargparse'
Am I missing something or is this project just not python3 ready?
Here pip output for completeness
$ pip3 install -r requirements.txt
Collecting ConfigArgParse
Downloading ConfigArgParse-1.2.3.tar.gz (42 kB)
|████████████████████████████████| 42 kB 259 kB/s
Collecting ipaddress
Downloading ipaddress-1.0.23-py2.py3-none-any.whl (18 kB)
Collecting pyroute2
Downloading pyroute2-0.5.12.tar.gz (864 kB)
|████████████████████████████████| 864 kB 1.1 MB/s
Requirement already satisfied: requests in /usr/lib/python3/dist-packages (from -r requirements.txt (line 4)) (2.22.0)
Collecting colorlog
Downloading colorlog-4.1.0-py2.py3-none-any.whl (14 kB)
Building wheels for collected packages: ConfigArgParse, pyroute2
Building wheel for ConfigArgParse (setup.py) ... done
Created wheel for ConfigArgParse: filename=ConfigArgParse-1.2.3-py3-none-any.whl size=19326 sha256=cff8a839264d888acd5254751fcb4cbaa06d1c5cc8c9bbd02a4b1d9edbbecb56
Stored in directory: /home/mattia/.cache/pip/wheels/b4/12/fe/1e4628f6ec22a9580d9e8fbef23df7a03948a1edde0821d7f5
Building wheel for pyroute2 (setup.py) ... done
Created wheel for pyroute2: filename=pyroute2-0.5.12-py3-none-any.whl size=381421 sha256=b8639ee4ec2496ee25905bf35c12fa71e9021b60d3fadb9de5d7825f12768325
Stored in directory: /home/mattia/.cache/pip/wheels/e9/c7/c0/8173ea3b27edd0f8bc962a287528c6209dc7e028dafadf67ab
Successfully built ConfigArgParse pyroute2
Installing collected packages: ConfigArgParse, ipaddress, pyroute2, colorlog
Successfully installed ConfigArgParse-1.2.3 colorlog-4.1.0 ipaddress-1.0.23 pyroute2-0.5.12
Connection drops fairly quickly with "Broken pipe"
This appears to be related to the latter comments on #9. When I start a VPN connection with nxBender and then try to move some traffic over it, I get:
INFO Logging in...
DEBUG Starting new HTTPS connection (1): censored.com:4433
send: 'POST /cgi-bin/userLogin HTTP/1.1\r\nHost: censored.com:4433\r\nAccept-Encoding: identity\r\nX-NE-pda: true\r\nUser-Agent: SonicWALL NetExtender for Linux 8.6.800\r\nX-NE-SESSIONPROMPT: true\r\nContent-Length: 65\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nusername=tom.cook&domain=censored&password=censored&login=true'
reply: 'HTTP/1.0 200 OK\r\n'
header: Server: SonicWALL SSLVPN Web Server
header: X-NE-tfresult: 0
header: MC-bookmarks: 1
header: Set-Cookie: swap=MzdmNDhjMjhub2ZyYXJhcA==; path=/;
header: Connection: close
header: Content-Type: text/html; charset=UTF-8
DEBUG https://censored.com:4433 "POST /cgi-bin/userLogin HTTP/1.1" 200 None
INFO Starting session...
DEBUG Resetting dropped connection: censored.com
send: 'GET /cgi-bin/sslvpnclient?launchplatform=mac&neProto=3&supportipv6=no HTTP/1.1\r\nHost: censored.com:4433\r\nAccept-Encoding: identity\r\nX-NE-pda: true\r\nUser-Agent: SonicWALL NetExtender for Linux 8.6.800\r\nCookie: swap=MzdmNDhjMjhub2ZyYXJhcA==\r\n\r\n'
reply: 'HTTP/1.0 200 OK\r\n'
header: Server: SonicWALL SSLVPN Web Server
header: Set-Cookie: swap=37f48c28nofrarap; path=/;
header: Connection: close
header: Content-Type: text/html; charset=UTF-8
DEBUG https://censored.com:4433 "GET /cgi-bin/sslvpnclient?launchplatform=mac&neProto=3&supportipv6=no HTTP/1.1" 200 None
DEBUG srv_option 'NELaunchX1.userName' = '"tom.cook"'
DEBUG srv_option 'NELaunchX1.domainName' = '"LocalDomain"'
DEBUG srv_option 'SessionId' = 'QkMO6MFoLUdjNiCNLyakRw=='
DEBUG srv_option 'Route' = 'censored'
DEBUG srv_option 'Route' = 'censored'
DEBUG srv_option 'Route' = 'censored'
DEBUG srv_option 'Route' = 'censored'
DEBUG srv_option 'Route' = 'censored'
DEBUG srv_option 'Route' = 'censored'
DEBUG srv_option 'dns1' = 'censored'
DEBUG srv_option 'dns2' = 'censored'
DEBUG srv_option 'ipv6Support' = 'no'
DEBUG srv_option 'dnsSuffix' = 'censored.com'
DEBUG srv_option 'dnsSuffixes' = 'censored.com'
INFO Duplicated srv_options value dnsSuffixes = censored.local
DEBUG srv_option 'dnsSuffixes' = 'censored.local'
INFO Duplicated srv_options value dnsSuffixes = censored.net
DEBUG srv_option 'dnsSuffixes' = 'censored.net'
INFO Duplicated srv_options value dnsSuffixes = censored.local
DEBUG srv_option 'dnsSuffixes' = 'censored.local'
INFO Duplicated srv_options value dnsSuffixes = censored.local
DEBUG srv_option 'dnsSuffixes' = 'censored.local'
DEBUG srv_option 'pppFrameEncoded' = '0'
DEBUG srv_option 'PppPref' = 'async'
DEBUG srv_option 'TunnelAllMode' = '0'
DEBUG srv_option 'ExitAfterDisconnect' = '0'
DEBUG srv_option 'UninstallAfterExit' = '0'
DEBUG srv_option 'NoProfileCreate' = '0'
DEBUG srv_option 'AllowSavePassword' = '1'
DEBUG srv_option 'AllowSaveUser' = '1'
DEBUG srv_option 'AllowSavePasswordInKeychain' = '1'
DEBUG srv_option 'AllowSavePasswordInKeystore' = '1'
DEBUG srv_option 'ClientIPLower' = '"192.168.40.100"'
DEBUG srv_option 'ClientIPHigh' = '"192.168.40.149"'
INFO Logging out ...
DEBUG Resetting dropped connection: censored.com
send: 'GET /cgi-bin/userLogout HTTP/1.1\r\nHost: censored.com:4433\r\nAccept-Encoding: identity\r\nX-NE-pda: true\r\nUser-Agent: SonicWALL NetExtender for Linux 8.6.800\r\nCookie: swap=MzdmNDhjMjhub2ZyYXJhcA==\r\n\r\n'
reply: ''
INFO Dialing up tunnel...
INFO Remote routing configured, VPN is up
ERROR Broken pipe
INFO Shutting down...
This appears to be related to the amount of traffic carried, not the time the connection has been up. It definitely carries traffic for a bit, and can stay up for some minutes if no traffic goes across it, but if I try to copy a large file across it lasts perhaps ten seconds.
Happy to test any changes or provide further information if requested.
pppd exited with code 2
Hi,
when starting nxBender I get this:
./nxBender --server netextender.marc-cain.com -u XXX -p XXX -d master-access-ad --fingerprint eb:8e:59:33:0f:8b:75:f3:e8:35:76:69:e3:f2:37:00:fc:d5:43:1a
INFO: Logging in...
INFO: Starting session...
INFO: Dialing up tunnel...
INFO: pppd exited with code 2
INFO: Shutting down...
I googled and this exit code means "An error was detected in processing the options given, such as two mutually exclusive options being used.".
But I have no clue what that means.
pyroute2 error
Hi!
I've been frustrated with netExtender on Linux for years now (flaky performance, weird issues, etc). This project would be a wonderful solution. I'm willing to help however I can -- probably mostly debugging right now, but I'll try to learn on the fly and see if I can contribute anything.
I'm trying right now to get this working on a Manjaro installation. I get the following output:
sudo ./nxBender --server ### -u ### -p ### -d ### --fingerprint ###
INFO: Logging in...
INFO: Starting session...
INFO: Duplicated srv_options value dnsSuffixes = xxx.edu
INFO: Dialing up tunnel...
INFO: Shutting down...
Traceback (most recent call last):
File "./nxBender", line 12, in
nxbender.main()
File "/home/tcarroll/nxBender-master/nxbender/init.py", line 39, in main
sess.run()
File "/home/tcarroll/nxBender-master/nxbender/nx.py", line 50, in run
self.tunnel()
File "/home/tcarroll/nxBender-master/nxbender/nx.py", line 126, in tunnel
pppd.run()
File "/home/tcarroll/nxBender-master/nxbender/ppp.py", line 70, in run
stop = self._pump()
File "/home/tcarroll/nxBender-master/nxbender/ppp.py", line 123, in _pump
self.routecallback(remote_ip)
File "/home/tcarroll/nxBender-master/nxbender/nx.py", line 134, in setup_routes
ip.route("add", dst=dst, gateway=gateway)
File "/usr/lib/python2.7/site-packages/pyroute2/iproute.py", line 1750, in route
callback=callback)
File "/usr/lib/python2.7/site-packages/pyroute2/netlink/nlsocket.py", line 804, in nlm_request
return do_try()
File "/usr/lib/python2.7/site-packages/pyroute2/netlink/nlsocket.py", line 783, in do_try
callback=callback)
File "/usr/lib/python2.7/site-packages/pyroute2/netlink/nlsocket.py", line 648, in get
raise msg['header']['error']
pyroute2.netlink.exceptions.NetlinkError: (17, 'File exists')
I noticed the "Duplicated srv_options value dnsSuffixes" error. The server response included two values for that parameter: xxx.local and xxx.edu. I modified the code a bit to skip the first one and keep the second one. That got rid of the "Duplicated..." error but nothing else changed.
I also tried installing the latest version of pyroute2 from github but that didn't seem to work. (Not convinced I did that correctly; I'm not super familiar with the python environment.)
It looks like the error is not originating in your code... but any suggestions on how to proceed would be great.
Thanks for creating a project like this!
Cheers,
tom
How to pipe to another command when VPN connects?
I'm trying to add dns once VPN connects, however I'm not sure how to do this:
sudo nxBender --server SERVER-NAME --username USER-NAME --domain DOMAIN --port 4433 --fingerprint CERT-FINGERPRINT && sudo resolvectl dns ppp0 DNS-IPS && sudo resolvectl domain ppp0 DOMAIN-NAME
nxBender never terminates, so the second command (resolvectl) never gets to run.
MFA, X-NE-tf 1 response
Hello,
Any luck adding support for MFA, which is X-NE-tf 1? This is a TOTP password login. I'm trying to get this to work with my current employer
Unhandled error with self signed certificate, unable to print fingerprint
Expected: Connection rejected, fingerprint printed.
Got: Chain of unhandled errors:
System:
Ubuntu 20.04
Linux lenovo-ila 5.4.0-34-generic #38-Ubuntu SMP Mon May 25 15:46:55 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
Python 3.8.2
Package Version
---------------------- -------------
colorlog 4.1.0
ConfigArgParse 1.2.3
ipaddress 1.0.23
nxBender 0.3.0
pyroute2 0.5.12
requests 2.22.0
urllib3 1.25.8
Error log:
$ nxBender -s 123.123.123.123 -P 4433 -u user -p pass -d localDomain
INFO Logging in...
ERROR SSL error: HTTPSConnectionPool(host='123.123.123.123', port=4433): Max retries exceeded with url: /cgi-bin/userLogin (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1108)')))
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 665, in urlopen
httplib_response = self._make_request(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 376, in _make_request
self._validate_conn(conn)
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 996, in _validate_conn
conn.connect()
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 352, in connect
self.sock = ssl_wrap_socket(
File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 383, in ssl_wrap_socket
return context.wrap_socket(sock)
File "/usr/lib/python3.8/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.8/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1108)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
resp = conn.urlopen(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 719, in urlopen
retries = retries.increment(
File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 436, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='123.123.123.123', port=4433): Max retries exceeded with url: /cgi-bin/userLogin (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1108)')))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.8/dist-packages/nxbender/__init__.py", line 66, in main
sess.run()
File "/usr/local/lib/python3.8/dist-packages/nxbender/nx.py", line 45, in run
self.login(
File "/usr/local/lib/python3.8/dist-packages/nxbender/nx.py", line 58, in login
resp = self.session.post('https://%s/cgi-bin/userLogin' % self.host,
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 581, in post
return self.request('POST', url, data=data, json=json, **kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 533, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='123.123.123.123', port=4433): Max retries exceeded with url: /cgi-bin/userLogin (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1108)')))
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/bin/nxBender", line 8, in <module>
sys.exit(main())
File "/usr/local/lib/python3.8/dist-packages/nxbender/__init__.py", line 70, in main
sslconn.print_fingerprint(args.server)
File "/usr/local/lib/python3.8/dist-packages/nxbender/sslconn.py", line 33, in print_fingerprint
conn = SSLConnection(None, host, 443)
File "/usr/local/lib/python3.8/dist-packages/nxbender/sslconn.py", line 15, in __init__
sock.connect((host, port))
ConnectionRefusedError: [Errno 111] Connection refused
Support of the two-factor authentication
Hello !
New job new vpn, and I was asked to use netExtender.
While trying to keep my machine clean from this closed source stuff, I discovered you project.
I am testing it, but actually I need a was to provide the two-factor authentication,
here what I get:
└─> nxBender --server ssl1.client.com -u gseren -p 'pass' -d 2fa.client.com --debug
INFO Logging in...
DEBUG Starting new HTTPS connection (1): ssl1.client.com:443
send: b'POST /cgi-bin/userLogin HTTP/1.1\r\nHost: ssl1.client.com\r\nAccept-Encoding: identity\r\nUser-Agent: Dell SonicWALL NetExtender for Linux 8.1.789\r\nX-NE-SESSIONPROMPT: true\r\nContent-Length: 78\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n'
send: b'username=gseren&password=pass&domain=2fa.client.com&login=true'
reply: 'HTTP/1.1 200 OK\r\n'
header: Date: Wed, 15 Jul 2020 11:09:48 GMT
header: Server: SonicWALL SSL-VPN Web Server
header: X-NE-tf: 1
header: X-NE-message: Get a verification code from the two-factor authentication app and verify your identity
header: MC-bookmarks: 3
header: Set-Cookie: swap=MGZzRm5ZdzBLR3c4WVZtMEltaU1NYUl3M2kjkjkjkjkxNeFBiS0xwS3VhST0=; path=/; secure; HttpOnly
header: X-FRAME-OPTIONS: SAMEORIGIN
header: X-XSS-Protection: 1; mode=block
header: Content-Security-Policy: script-src https://*.duosecurity.com 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'
header: Referrer-Policy: strict-origin
header: X-Content-Type-Options: nosniff
header: Transfer-Encoding: chunked
header: Content-Type: text/html; charset=UTF-8
DEBUG https://ssl1.client.com:443 "POST /cgi-bin/userLogin HTTP/1.1" 200 None
Traceback (most recent call last):
File "/home/gseren/.local/bin/nxBender", line 8, in <module>
sys.exit(main())
File "/home/gseren/.local/lib/python3.7/site-packages/nxbender/__init__.py", line 67, in main
sess.run()
File "/home/gseren/.local/lib/python3.7/site-packages/nxbender/nx.py", line 48, in run
self.options.domain
File "/home/gseren/.local/lib/python3.7/site-packages/nxbender/nx.py", line 73, in login
raise IOError('Server returned error: %s' % error)
OSError: Server returned error: Get a verification code from the two-factor authentication app and verify your identity
I think it should be possible to catch this error, and ask (or provide it by an argument) the two-factor pin,
what do you think ?
Crash due to removal of ssl.wrap_socket
ssl.wrap_socket is deprecated since Python 3.7 and has recently been removed in Python 3.12.
On Python 3.12, nxBender therefore fails with:
Traceback (most recent call last):
File "/usr/local/bin/nxBender", line 8, in <module>
sys.exit(main())
^^^^^^
File "/opt/nxBender/lib/python3.12/site-packages/nxbender/__init__.py", line 69, in main
sess.run()
File "/opt/nxBender/lib/python3.12/site-packages/nxbender/nx.py", line 103, in run
self.tunnel()
File "/opt/nxBender/lib/python3.12/site-packages/nxbender/nx.py", line 216, in tunnel
pppd.run()
File "/opt/nxBender/lib/python3.12/site-packages/nxbender/ppp.py", line 51, in run
self.tunsock = sslconn.SSLTunnel(self.session_id, self.options, self.options.server, self.options.port)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/nxBender/lib/python3.12/site-packages/nxbender/sslconn.py", line 38, in __init__
super(SSLTunnel, self).__init__(*args, **kwargs)
File "/opt/nxBender/lib/python3.12/site-packages/nxbender/sslconn.py", line 17, in __init__
self.s = ssl.wrap_socket(sock)
^^^^^^^^^^^^^^^
AttributeError: module 'ssl' has no attribute 'wrap_socket'
Disconnect with ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:2426)
This VPN client has worked well for me for quite a while, thank you very much for making it. I'm not sure when this started happening because I didn't connect to the VPN for several months. I'm not sure if it is because of a VPN server update or a Python library update... but it used to work perfectly. Now, it does connect and even long enough for me to start an SSH connection to our servers, but it dies after a short time (under 30 seconds) with ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:2426)
user@Hydra:~/Sonic/nxBender$ sudo ./nxBender --debug --show-ppp-log --server vpn.somedomain.org --port 4434 -u myusername -d somedomain.org
Password:
INFO Logging in...
DEBUG Starting new HTTPS connection (1): vpn.somedomain.org:4434
send: b'POST /cgi-bin/userLogin HTTP/1.1\r\nHost: vpn.somedomain.org:4434\r\nAccept-Encoding: identity\r\nUser-Agent: Dell SonicWALL NetExtender for Linux 8.1.789\r\nX-NE-SESSIONPROMPT: true\r\nContent-Length: 66\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n'
send: b'username=myusername&password=mypassword&domain=somedomain.org&login=true'
reply: 'HTTP/1.0 200 OK\r\n'
header: Server: SonicWALL SSLVPN Web Server
header: X-NE-tfresult: 0
header: MC-bookmarks: 1
header: Set-Cookie: swap=NGFiODZlZDBwcm9waG9zdw==; path=/;
header: Connection: close
header: Content-Type: text/html; charset=UTF-8
DEBUG https://vpn.somedomain.org:4434 "POST /cgi-bin/userLogin HTTP/1.1" 200 None
INFO Starting session...
DEBUG Resetting dropped connection: vpn.somedomain.org
send: b'GET /cgi-bin/sslvpnclient?launchplatform=mac&neProto=3&supportipv6=no HTTP/1.1\r\nHost: vpn.somedomain.org:4434\r\nAccept-Encoding: identity\r\nUser-Agent: Dell SonicWALL NetExtender for Linux 8.1.789\r\nCookie: swap=NGFiODZlZDBwcm9waG9zdw==\r\n\r\n'
reply: 'HTTP/1.0 200 OK\r\n'
header: Server: SonicWALL SSLVPN Web Server
header: Set-Cookie: swap=4ab86ed0prophosw; path=/;
header: Connection: close
header: Content-Type: text/html; charset=UTF-8
DEBUG https://vpn.somedomain.org:4434 "GET /cgi-bin/sslvpnclient?launchplatform=mac&neProto=3&supportipv6=no HTTP/1.1" 200 None
DEBUG srv_option 'NELaunchX1.userName' = '"myusername";'
DEBUG srv_option 'NELaunchX1.domainName' = '"LocalDomain";'
DEBUG srv_option 'SessionId' = 'QkMO6MFoLUdjNiCNLyakRw==;'
DEBUG srv_option 'Route' = '10.2.9.0/255.255.255.128'
DEBUG srv_option 'Route' = '10.2.6.0/255.255.255.128'
DEBUG srv_option 'Route' = '10.4.10.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.2.6.128/255.255.255.192'
DEBUG srv_option 'Route' = '10.4.64.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.2.19.0/255.255.255.128'
DEBUG srv_option 'Route' = '10.2.0.0/255.255.252.0'
DEBUG srv_option 'Route' = '10.2.5.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.2.4.128/255.255.255.128'
DEBUG srv_option 'Route' = '10.2.4.0/255.255.255.128'
DEBUG srv_option 'Route' = '10.2.13.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.2.6.192/255.255.255.240'
DEBUG srv_option 'Route' = '10.2.6.208/255.255.255.240'
DEBUG srv_option 'Route' = '10.2.19.160/255.255.255.224'
DEBUG srv_option 'Route' = '10.2.7.74/255.255.255.255'
DEBUG srv_option 'Route' = '10.4.0.0/255.255.254.0'
DEBUG srv_option 'Route' = '10.4.2.0/255.255.254.0'
DEBUG srv_option 'Route' = '10.4.4.0/255.255.254.0'
DEBUG srv_option 'Route' = '10.4.6.0/255.255.254.0'
DEBUG srv_option 'Route' = '10.4.8.0/255.255.254.0'
DEBUG srv_option 'Route' = '10.4.11.0/255.255.255.128'
DEBUG srv_option 'Route' = '10.4.11.128/255.255.255.128'
DEBUG srv_option 'Route' = '10.4.20.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.2.6.4/255.255.255.252'
DEBUG srv_option 'Route' = '10.161.232.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.161.233.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.161.234.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.161.200.0/255.255.254.0'
DEBUG srv_option 'Route' = '10.161.86.0/255.255.254.0'
DEBUG srv_option 'Route' = '10.161.202.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.2.6.0/255.255.255.248'
DEBUG srv_option 'Route' = '10.2.6.224/255.255.255.240'
DEBUG srv_option 'dns1' = '10.2.6.5'
DEBUG srv_option 'dns2' = '10.2.6.6'
DEBUG srv_option 'ipv6Support' = 'no'
DEBUG srv_option 'dnsSuffix' = 'somedomain.org'
WARNING Unexpected line in session start message: 'dnsSuffixes =somedomain.org'
INFO Duplicated srv_options value dnsSuffix = somedomain.org
DEBUG srv_option 'dnsSuffix' = 'somedomain.org'
WARNING Unexpected line in session start message: 'dnsSuffixes =10.2.6.5'
INFO Duplicated srv_options value dnsSuffix = somedomain.org
DEBUG srv_option 'dnsSuffix' = 'somedomain.org'
WARNING Unexpected line in session start message: 'dnsSuffixes =10.2.6.6'
INFO Duplicated srv_options value dnsSuffix = somedomain.org
DEBUG srv_option 'dnsSuffix' = 'somedomain.org'
WARNING Unexpected line in session start message: 'dnsSuffixes =10.2.7.74'
INFO Duplicated srv_options value dnsSuffix = somedomain.org
DEBUG srv_option 'dnsSuffix' = 'somedomain.org'
DEBUG srv_option 'pppFrameEncoded' = '0;'
DEBUG srv_option 'PppPref' = 'async'
DEBUG srv_option 'TunnelAllMode' = '0;'
DEBUG srv_option 'ExitAfterDisconnect' = '0;'
DEBUG srv_option 'UninstallAfterExit' = '0;'
DEBUG srv_option 'NoProfileCreate' = '0;'
DEBUG srv_option 'AllowSavePassword' = '1;'
DEBUG srv_option 'AllowSaveUser' = '1;'
DEBUG srv_option 'AllowSavePasswordInKeychain' = '0'
DEBUG srv_option 'AllowSavePasswordInKeystore' = '0'
DEBUG srv_option 'ClientIPLower' = '"10.1.221.0";'
DEBUG srv_option 'ClientIPHigh' = '"10.1.221.255";'
INFO Dialing up tunnel...
pppd: pppd options in effect:
pppd: debug debug # (from command line)
pppd: logfd 2 # (from command line)
pppd: ktune # (from command line)
pppd: dump # (from command line)
pppd: nomp # (from command line)
pppd: noauth # (from command line)
pppd: lock # (from /etc/ppp/options)
pppd: crtscts # (from /etc/ppp/options)
pppd: local # (from command line)
pppd: asyncmap 0 # (from /etc/ppp/options)
pppd: lcp-echo-failure 2 # (from command line)
pppd: lcp-echo-interval 10 # (from command line)
pppd: hide-password # (from /etc/ppp/options)
pppd: noipdefault # (from command line)
pppd: usepeerdns # (from command line)
pppd: noccp # (from command line)
pppd: noipx # (from /etc/ppp/options)
pppd: using channel 2
pppd: Using interface ppp0
pppd: Connect: ppp0 <--> /dev/pts/2
pppd: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xc19245d2> <pcomp> <accomp>]
pppd: rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x5c7daa40>]
pppd: sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x5c7daa40>]
pppd: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xc19245d2> <pcomp> <accomp>]
pppd: rcvd [LCP ConfRej id=0x1 <pcomp>]
pppd: sent [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0xc19245d2> <accomp>]
pppd: rcvd [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0xc19245d2> <accomp>]
pppd: sent [LCP EchoReq id=0x0 magic=0xc19245d2]
pppd: sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: sent [IPV6CP ConfReq id=0x1 <addr fe80::91d2:7d94:15b2:b05c>]
pppd: rcvd [IPCP ConfReq id=0x1 <addr 192.0.2.1> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: sent [IPCP ConfRej id=0x1 <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: rcvd [LCP EchoRep id=0x0 magic=0x5c7daa40]
pppd: rcvd [IPCP ConfRej id=0x1 <compress VJ 0f 01>]
pppd: sent [IPCP ConfReq id=0x2 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: rcvd [LCP ProtRej id=0x1 80 57 01 01 00 0e 01 0a 91 d2 7d 94 15 b2 b0 5c]
pppd: Protocol-Reject for 'IPv6 Control Protocol' (0x8057) received
pppd: rcvd [IPCP ConfReq id=0x2 <addr 192.0.2.1>]
pppd: sent [IPCP ConfAck id=0x2 <addr 192.0.2.1>]
pppd: rcvd [IPCP ConfNak id=0x2 <addr 10.1.221.8>]
pppd: sent [IPCP ConfReq id=0x3 <addr 10.1.221.8> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: rcvd [IPCP ConfAck id=0x3 <addr 10.1.221.8> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: Script /etc/ppp/ip-pre-up started (pid 8858)
pppd: Script /etc/ppp/ip-pre-up finished (pid 8858), status = 0x0
pppd: local IP address 10.1.221.8
pppd: remote IP address 192.0.2.1
INFO Remote routing configured, VPN is up
pppd: Script /etc/ppp/ip-up started (pid 8863)
pppd: Script /etc/ppp/ip-up finished (pid 8863), status = 0x0
pppd: sent [LCP EchoReq id=0x1 magic=0xc19245d2]
pppd: sent [LCP EchoReq id=0x2 magic=0xc19245d2]
ERROR EOF occurred in violation of protocol (_ssl.c:2426)
Traceback (most recent call last):
File "/home/kunji/Sonic/nxBender/nxbender/ppp.py", line 71, in run
stop = self._pump()
File "/home/kunji/Sonic/nxBender/nxbender/ppp.py", line 116, in _pump
stop = self.tunsock.write_from(self.pty)
File "/home/kunji/Sonic/nxBender/nxbender/sslconn.py", line 79, in write_from
self.write(data)
File "/home/kunji/Sonic/nxBender/nxbender/sslconn.py", line 103, in write
self.write_pump()
File "/home/kunji/Sonic/nxBender/nxbender/sslconn.py", line 113, in write_pump
self.s.sendall(buf)
File "/usr/lib/python3.10/ssl.py", line 1266, in sendall
v = self.send(byte_view[count:])
File "/usr/lib/python3.10/ssl.py", line 1235, in send
return self._sslobj.write(data)
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:2426)
INFO Shutting down...
DEBUG Resetting dropped connection: vpn.somedomain.org
send: b'GET /cgi-bin/userLogout HTTP/1.1\r\nHost: vpn.somedomain.org:4434\r\nAccept-Encoding: identity\r\nUser-Agent: Dell SonicWALL NetExtender for Linux 8.1.789\r\nCookie: swap=4ab86ed0prophosw\r\n\r\n'
reply: 'HTTP/1.0 200 OK\r\n'
header: Server: SonicWALL SSLVPN Web Server
header: Connection: close
header: Content-Type: text/html; charset=UTF-8
DEBUG https://vpn.somedomain.org:4434 "GET /cgi-bin/userLogout HTTP/1.1" 200 None
DNS settings from server are not being applied
When I connect to my employer's SonicWall VPN, no DNS servers / search domains are propagated, which means that most remote network resources are not reachable. If I manually set up the DNS servers then the connection works.
This is not a terribly recent SonicWall system, it works with V8.0 clients (which newer appliances do not).
Exploring a bit further, I found that this is because the DNS settings are being sent by the server in the HTTPS response, but are not supplied via PPP - even though usepeerdns is set in the pppd options.
INFO Logging in...
DEBUG Starting new HTTPS connection (1): <Hostname>:443
send: b'POST /cgi-bin/userLogin HTTP/1.1\r\nHost: <Hostname>\r\nAccept-Encoding: identity\r\nUser-Agent: Dell SonicWALL NetExtender for Linux 8.1.789\r\nX-NE-SESSIONPROMPT: true\r\nContent-Length: 72\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n'
send: b'username=<user>&password=<password>&domain=<domain>&login=true'
reply: 'HTTP/1.0 200 OK\r\n'
header: Server: SonicWALL SSLVPN Web Server
header: X-NE-tfresult: 0
header: MC-bookmarks: 1
header: Set-Cookie: swap=YzVkYTIxOTBzcGlyaXNwYQ==; path=/;
header: Connection: close
header: Content-Type: text/html; charset=UTF-8
DEBUG https://<Hostname>:443 "POST /cgi-bin/userLogin HTTP/1.1" 200 None
INFO Starting session...
DEBUG Resetting dropped connection: <Hostname>
send: b'GET /cgi-bin/sslvpnclient?launchplatform=mac&neProto=3&supportipv6=no HTTP/1.1\r\nHost: <Hostname>\r\nAccept-Encoding: identity\r\nUser-Agent: Dell SonicWALL NetExtender for Linux 8.1.789\r\nCookie: swap=YzVkYTIxOTBzcGlyaXNwYQ==\r\n\r\n'
reply: 'HTTP/1.0 200 OK\r\n'
header: Server: SonicWALL SSLVPN Web Server
header: Set-Cookie: swap=c5da2190spirispa; path=/;
header: Connection: close
header: Content-Type: text/html; charset=UTF-8
DEBUG https://<Hostname>:443 "GET /cgi-bin/sslvpnclient?launchplatform=mac&neProto=3&supportipv6=no HTTP/1.1" 200 None
DEBUG Server response follows:
DEBUG <html><head><title>SonicWALL - Virtual Office</title><meta http-equiv='pragma' content='no-cache'><meta http-equiv='cache-control' content='no-cache'><meta http-equiv='cache-control' content='must-revalidate'><meta http-equiv='Content-Type' content='text/html;charset=UTF-8'><link href='/styleblueblackgrey.css' rel=stylesheet type='text/css'><script>function neLauncherInit(){
NELaunchX1.userName = "<user>";
NELaunchX1.domainName = "LocalDomain";
SessionId = QkMO6MFoLUdjNiCNLyakRw==;
Route = 172.16.0.0/255.255.0.0
Route = 10.21.21.9/255.255.255.255
Route = 192.168.21.0/255.255.255.0
Route = 10.10.184.42/255.255.255.255
Route = 46.137.162.66/255.255.255.255
Route = 46.137.110.80/255.255.255.255
dns1 = 172.16.252.200
dns2 = 172.16.252.201
ipv6Support = no
dnsSuffix = <domain>
dnsSuffixes =<domain>
pppFrameEncoded = 0;
PppPref = async
TunnelAllMode = 0;
ExitAfterDisconnect = 0;
UninstallAfterExit = 0;
NoProfileCreate = 0;
AllowSavePassword = 1;
AllowSaveUser = 1;
AllowSavePasswordInKeychain = 1
AllowSavePasswordInKeystore = 1
ClientIPLower = "10.20.20.2";
ClientIPHigh = "10.20.20.254";
}</script></head></html>
DEBUG End server response.
DEBUG srv_option 'NELaunchX1.userName' = '"ra";'
DEBUG srv_option 'NELaunchX1.domainName' = '"LocalDomain";'
DEBUG srv_option 'SessionId' = 'QkMO6MFoLUdjNiCNLyakRw==;'
DEBUG srv_option 'Route' = '172.16.0.0/255.255.0.0'
DEBUG srv_option 'Route' = '10.21.21.9/255.255.255.255'
DEBUG srv_option 'Route' = '192.168.21.0/255.255.255.0'
DEBUG srv_option 'Route' = '10.10.184.42/255.255.255.255'
DEBUG srv_option 'Route' = '46.137.162.66/255.255.255.255'
DEBUG srv_option 'Route' = '46.137.110.80/255.255.255.255'
DEBUG srv_option 'dns1' = '172.16.252.200'
DEBUG srv_option 'dns2' = '172.16.252.201'
DEBUG srv_option 'ipv6Support' = 'no'
DEBUG srv_option 'dnsSuffix' = '<domain>'
WARNING Unexpected line in session start message: 'dnsSuffixes =<domain>'
INFO Duplicated srv_options value dnsSuffix = <domain>
DEBUG srv_option 'dnsSuffix' = '<domain>'
DEBUG srv_option 'pppFrameEncoded' = '0;'
DEBUG srv_option 'PppPref' = 'async'
DEBUG srv_option 'TunnelAllMode' = '0;'
DEBUG srv_option 'ExitAfterDisconnect' = '0;'
DEBUG srv_option 'UninstallAfterExit' = '0;'
DEBUG srv_option 'NoProfileCreate' = '0;'
DEBUG srv_option 'AllowSavePassword' = '1;'
DEBUG srv_option 'AllowSaveUser' = '1;'
DEBUG srv_option 'AllowSavePasswordInKeychain' = '1'
DEBUG srv_option 'AllowSavePasswordInKeystore' = '1'
DEBUG srv_option 'ClientIPLower' = '"10.20.20.2";'
DEBUG srv_option 'ClientIPHigh' = '"10.20.20.254";'
INFO Dialing up tunnel...
pppd: pppd options in effect:
pppd: debug debug # (from command line)
pppd: logfd 2 # (from command line)
pppd: ktune # (from command line)
pppd: dump # (from command line)
pppd: nomp # (from command line)
pppd: noauth # (from command line)
pppd: lock # (from /etc/ppp/options)
pppd: local # (from command line)
pppd: lcp-echo-failure 2 # (from command line)
pppd: lcp-echo-interval 10 # (from command line)
pppd: noipdefault # (from command line)
pppd: usepeerdns # (from command line)
pppd: +ipv6 # (from /etc/ppp/options)
pppd: noccp # (from command line)
pppd: using channel 2
pppd: Using interface ppp0
pppd: Connect: ppp0 <--> /dev/pts/4
pppd: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xf49a6715> <pcomp> <accomp>]
pppd: rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xfe428ad2>]
pppd: sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0xfe428ad2>]
pppd: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xf49a6715> <pcomp> <accomp>]
pppd: rcvd [LCP ConfRej id=0x1 <pcomp>]
pppd: sent [LCP ConfReq id=0x2 <asyncmap 0x0> <magic 0xf49a6715> <accomp>]
pppd: rcvd [LCP ConfAck id=0x2 <asyncmap 0x0> <magic 0xf49a6715> <accomp>]
pppd: sent [LCP EchoReq id=0x0 magic=0xf49a6715]
pppd: sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: sent [IPV6CP ConfReq id=0x1 <addr fe80::182e:9a60:90f4:7231>]
pppd: rcvd [IPCP ConfReq id=0x1 <addr 192.0.2.1> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: sent [IPCP ConfRej id=0x1 <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: rcvd [CCP ConfReq id=0x1 <mppe -H -M -S -L -D +C>]
pppd: Unsupported protocol 'Compression Control Protocol' (0x80fd) received
pppd: sent [LCP ProtRej id=0x3 80 fd 01 01 00 0a 12 06 00 00 00 01]
pppd: rcvd [LCP EchoRep id=0x0 magic=0xfe428ad2]
pppd: rcvd [IPCP ConfRej id=0x1 <compress VJ 0f 01>]
pppd: sent [IPCP ConfReq id=0x2 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: rcvd [LCP ProtRej id=0x1 80 57 01 01 00 0e 01 0a 18 2e 9a 60 90 f4 72 31]
pppd: Protocol-Reject for 'IPv6 Control Protocol' (0x8057) received
pppd: rcvd [IPCP ConfReq id=0x2 <addr 192.0.2.1>]
pppd: sent [IPCP ConfAck id=0x2 <addr 192.0.2.1>]
pppd: rcvd [IPCP ConfNak id=0x2 <addr 10.20.20.25>]
pppd: sent [IPCP ConfReq id=0x3 <addr 10.20.20.25> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: rcvd [IPCP ConfAck id=0x3 <addr 10.20.20.25> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
pppd: local IP address 10.20.20.25
pppd: remote IP address 192.0.2.1
INFO Remote routing configured, VPN is up
pppd: Script /etc/ppp/ip-up started (pid 7895)
pppd: Script /etc/ppp/ip-up finished (pid 7895), status = 0x1
pppd: sent [LCP EchoReq id=0x1 magic=0xf49a6715]
pppd: rcvd [LCP EchoRep id=0x1 magic=0xfe428ad2]
error when you add a custom port
When you add a port that isnt 443, it seems to fail
cameron@cameron-pc:~/nxBender$ sudo ./nxBender --server vpn.example.com -u example -p **** -d domain.local -P 4433
INFO Logging in...
INFO Starting session...
Traceback (most recent call last):
File "./nxBender", line 12, in <module>
nxbender.main()
File "/home/cameron/nxBender/__init__.py", line 55, in main
sess.run()
File "/home/cameron/nxBender/nx.py", line 52, in run
self.start_session()
File "/home/cameron/nxBender/nx.py", line 113, in start_session
key, value = line.split(' = ', 1)
ValueError: need more than 1 value to unpack
Ubuntu 18.10 error
The Readme does not specify what python version should be used. I used what comes with Ubuntu 18
O.S.: Ubuntu 18.10
Python Version: Python 2.7.15+
Pip version: pip 9.0.1 from /usr/lib/python2.7/dist-packages (python 2.7)
I got this:
pablo@pablo-lenovo:~/temp/nxBender(master)$ sudo ./nxBender --server vpn.server.net -u myUsername -p myPassword -d myDomain
Traceback (most recent call last):
File "./nxBender", line 9, in <module>
import nxbender
File "/home/pablo/temp/nxBender/nxbender/__init__.py", line 1, in <module>
import nx
File "/home/pablo/temp/nxBender/nxbender/nx.py", line 2, in <module>
import requests
ImportError: No module named requests
Also, a big thanks for the effort you put on this; this seems to resolve DNS issues I am experiecing right now.
Can't mount samba directories over VPN connection, but works inside network
I'm getting this error when trying to mount cifs shares:
mount error(4): Interrupted system call
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)
This didn't use to happen when mounting them inside network (without VPN). I'm quite unsure what to do with this.
Something to do with client certificates?
Unable to sustain RDP connection over VPN
Don't know how to properly express my gratitude that you are working on this project! I really want to be able to remote into my work environment via my RPi4, but netExtender is obviously not working for me and I've run out of other solutions. That said...no luck connecting so far. My office uses a self-signed certificate and non-standard port, but I created a config file to house all of that info, and that seems to be working, but here is the output every time I try to connect:
INFO Logging in...
INFO Starting session...
WARNING Unexpected line in session start message: '}</script>'
INFO Duplicated srv_options value ClientIPHigh = "192.168.168.200";
INFO Dialing up tunnel...
ERROR TLS/SSL connection has been closed (EOF) (_ssl.c:1829)
Traceback (most recent call last):
File "/opt/nxBender/nxbender/ppp.py", line 71, in run
stop = self._pump()
File "/opt/nxBender/nxbender/ppp.py", line 116, in _pump
stop = self.tunsock.write_from(self.pty)
File "/opt/nxBender/nxbender/sslconn.py", line 79, in write_from
self.write(data)
File "/opt/nxBender/nxbender/sslconn.py", line 103, in write
self.write_pump()
File "/opt/nxBender/nxbender/sslconn.py", line 113, in write_pump
self.s.sendall(buf)
File "/usr/lib/python2.7/ssl.py", line 741, in sendall
v = self.send(data[count:])
File "/usr/lib/python2.7/ssl.py", line 707, in send
v = self._sslobj.write(data)
SSLZeroReturnError: TLS/SSL connection has been closed (EOF) (_ssl.c:1829)
INFO Shutting down...
Really hoping this makes sense to someone...please let me know if there's anything else I could provide to help troubleshoot!
Thanks,
David
potentialy interesting
Have a look at this commit: retornaz@7a7820f
This make it compatible with a more up to date sonicwall server. But maybe it stay compatible with an old version.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.