Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add internal host detection support #384

Merged
merged 1 commit into from
Jul 2, 2024
Merged

Conversation

ruben-rodriguez
Copy link
Contributor

@ruben-rodriguez ruben-rodriguez commented Jul 1, 2024

Adds internal host detection support (reverse DNS lookup).

Fixes #377

After SAML auth, portal sends in the config a block like the following:

<internal-host-detection>
      <ip-address></ip-address>
      <host></host>
      <ipv6-address/>
      <ipv6-host/>
</internal-host-detection>

It is meant to be resolved by the client in order to present appropiate gateway list to the user, internal or external gateways, depending on the success of the DNS lookup:

<gateways>
        <internal>
          <list>
                <entry name="xxx.xxx.xxx.xxx">
                    <priority-rule>
                        <entry name="Any">
                            <priority>1</priority>
                        </entry>
                    </priority-rule>
                    <priority>1</priority>
                    <description>vpn_gateway</description>
                </entry>
            </list>
        </internal>
        <cutoff-time>5</cutoff-time>
        <external>
            <list>
                <entry name="xxx.xxx.xxx.xxx">
                    <priority-rule>
                        <entry name="Any">
                            <priority>1</priority>
                        </entry>
                    </priority-rule>
                    <priority>1</priority>
                    <description>vpn_gateway</description>
                </entry>
            </list>
        </external>
    </gateways>

Sample output when DNS lookup fails (external gateways list is provided):

[2024-07-01T21:16:04Z INFO  gpclient::cli] gpclient started: 2.3.3 (2024-07-01)
[2024-07-01T21:16:04Z INFO  gpapi::portal::prelogin] Portal prelogin with user_agent: PAN GlobalProtect
[2024-07-01T21:16:04Z INFO  gpauth::cli] gpauth started: 2.3.3 (2024-07-01)
[2024-07-01T21:16:04Z INFO  gpauth::cli] Please continue the authentication process in the default browser
[2024-07-01T21:16:04Z INFO  gpclient::connect] Waiting for the browser authentication to complete...
[2024-07-01T21:16:04Z INFO  gpclient::connect] Listening authentication data on port 41875
[2024-07-01T21:16:38Z INFO  gpclient::connect] Received the browser authentication data from the socket
[2024-07-01T21:16:38Z INFO  gpapi::auth] Parsing SAML auth data...
[2024-07-01T21:16:38Z INFO  gpapi::portal::config] Portal config, user_agent: PAN GlobalProtect
[2024-07-01T21:16:38Z INFO  gpapi::portal::config] internal-host-detection returned, performing DNS lookup
[2024-07-01T21:16:38Z WARN  gpapi::portal::config] DNS lookup failed for x.x.x.x: failed to lookup address information: Name or service not known
? Which gateway do you want to connect to?
> Germany
  Netherlands
  Hong Kong
  US
  UK

I tested the internal use-case by making the DNS resolution successful in local /etc/hosts file.

Rust is not a programming language I'm used to, and I'm happy to make any modifications that could improve the code.

@yuezk
Copy link
Owner

yuezk commented Jul 2, 2024

Hi @ruben-rodriguez, Thank you so much for implementing this. I will release this feature soon.

@yuezk yuezk merged commit 26dbd8d into yuezk:main Jul 2, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Internal Gateway Detection not working, preventing connection
2 participants