Cargo.lock

@@ -564,7 +564,7 @@ dependencies = [
 
 [[package]]
 name = "common"
-version = "2.1.4"
+version = "2.1.3"
 dependencies = [
  "is_executable",
 ]
@@ -1430,7 +1430,7 @@ dependencies = [
 
 [[package]]
 name = "gpapi"
-version = "2.1.4"
+version = "2.1.3"
 dependencies = [
  "anyhow",
  "base64 0.21.5",
@@ -1462,7 +1462,7 @@ dependencies = [
 
 [[package]]
 name = "gpauth"
-version = "2.1.4"
+version = "2.1.3"
 dependencies = [
  "anyhow",
  "clap",
@@ -1483,7 +1483,7 @@ dependencies = [
 
 [[package]]
 name = "gpclient"
-version = "2.1.4"
+version = "2.1.3"
 dependencies = [
  "anyhow",
  "clap",
@@ -1505,7 +1505,7 @@ dependencies = [
 
 [[package]]
 name = "gpgui-helper"
-version = "2.1.4"
+version = "2.1.3"
 dependencies = [
  "anyhow",
  "clap",
@@ -1523,7 +1523,7 @@ dependencies = [
 
 [[package]]
 name = "gpservice"
-version = "2.1.4"
+version = "2.1.3"
 dependencies = [
  "anyhow",
  "axum",
@@ -2537,7 +2537,7 @@ dependencies = [
 
 [[package]]
 name = "openconnect"
-version = "2.1.4"
+version = "2.1.3"
 dependencies = [
  "cc",
  "common",

Cargo.toml

@@ -5,7 +5,7 @@ members = ["crates/*", "apps/gpclient", "apps/gpservice", "apps/gpauth", "apps/g
 
 [workspace.package]
 rust-version = "1.70"
-version = "2.1.4"
+version = "2.1.3"
 authors = ["Kevin Yue <k3vinyue@gmail.com>"]
 homepage = "https://github.com/yuezk/GlobalProtect-openconnect"
 edition = "2021"

apps/gpclient/src/connect.rs

@@ -6,7 +6,7 @@ use gpapi::{
   clap::args::Os,
   credential::{Credential, PasswordCredential},
   error::PortalError,
-  gateway::{gateway_login, GatewayLogin},
+  gateway::gateway_login,
   gp_params::{ClientOs, GpParams},
   portal::{prelogin, retrieve_config, Prelogin},
   process::{
@@ -154,7 +154,7 @@ impl<'a> ConnectHandler<'a> {
     let gateway = selected_gateway.server();
     let cred = portal_config.auth_cookie().into();
 
-    let cookie = match self.login_gateway(gateway, &cred, &gp_params).await {
+    let cookie = match gateway_login(gateway, &cred, &gp_params).await {
       Ok(cookie) => cookie,
       Err(err) => {
         info!("Gateway login failed: {}", err);
@@ -174,28 +174,11 @@ impl<'a> ConnectHandler<'a> {
     let prelogin = prelogin(gateway, &gp_params).await?;
     let cred = self.obtain_credential(&prelogin, gateway).await?;
 
-    let cookie = self.login_gateway(gateway, &cred, &gp_params).await?;
+    let cookie = gateway_login(gateway, &cred, &gp_params).await?;
 
     self.connect_gateway(gateway, &cookie).await
   }
 
-  async fn login_gateway(&self, gateway: &str, cred: &Credential, gp_params: &GpParams) -> anyhow::Result<String> {
-    let mut gp_params = gp_params.clone();
-
-    loop {
-      match gateway_login(gateway, cred, &gp_params).await? {
-        GatewayLogin::Cookie(cookie) => return Ok(cookie),
-        GatewayLogin::Mfa(message, input_str) => {
-          let otp = Text::new(&message).prompt()?;
-          gp_params.set_input_str(&input_str);
-          gp_params.set_otp(&otp);
-
-          info!("Retrying gateway login with MFA...");
-        }
-      }
-    }
-  }
-
   async fn connect_gateway(&self, gateway: &str, cookie: &str) -> anyhow::Result<()> {
     let mtu = self.args.mtu.unwrap_or(0);
     let csd_uid = get_csd_uid(&self.args.csd_user)?;

changelog.md

@@ -1,10 +1,5 @@
 # Changelog
 
-## 2.1.4 - 2024-04-10
-
-- Support MFA authentication (fix [#343](https://github.com/yuezk/GlobalProtect-openconnect/issues/343))
-- Improve the Gateway switcher UI
-
 ## 2.1.3 - 2024-04-07
 
 - Support CAS authentication (fix [#339](https://github.com/yuezk/GlobalProtect-openconnect/issues/339))

crates/gpapi/src/gateway/login.rs

@@ -11,12 +11,7 @@ use crate::{
   utils::{normalize_server, parse_gp_error, remove_url_scheme},
 };
 
-pub enum GatewayLogin {
-  Cookie(String),
-  Mfa(String, String),
-}
-
-pub async fn gateway_login(gateway: &str, cred: &Credential, gp_params: &GpParams) -> anyhow::Result<GatewayLogin> {
+pub async fn gateway_login(gateway: &str, cred: &Credential, gp_params: &GpParams) -> anyhow::Result<String> {
   let url = normalize_server(gateway)?;
   let gateway = remove_url_scheme(&url);
 
@@ -54,22 +49,10 @@ pub async fn gateway_login(gateway: &str, cred: &Credential, gp_params: &GpParam
     bail!("Gateway login error, reason: {}", reason);
   }
 
-  let res = res.text().await?;
+  let res_xml = res.text().await?;
+  let doc = Document::parse(&res_xml)?;
 
-  // MFA detected
-  if res.contains("Challenge") {
-    let Some((message, input_str)) = parse_mfa(&res) else {
-      bail!("Failed to parse MFA challenge: {res}");
-    };
-
-    return Ok(GatewayLogin::Mfa(message, input_str));
-  }
-
-  let doc = Document::parse(&res)?;
-
-  let cookie = build_gateway_token(&doc, gp_params.computer())?;
-
-  Ok(GatewayLogin::Cookie(cookie))
+  build_gateway_token(&doc, gp_params.computer())
 }
 
 fn build_gateway_token(doc: &Document, computer: &str) -> anyhow::Result<String> {
@@ -103,33 +86,3 @@ fn read_args<'a>(args: &'a [String], index: usize, key: &'a str) -> anyhow::Resu
     .ok_or_else(|| anyhow::anyhow!("Failed to read {key} from args"))
     .map(|s| (key, s.as_ref()))
 }
-
-fn parse_mfa(res: &str) -> Option<(String, String)> {
-  let message = res
-    .lines()
-    .find(|l| l.contains("respMsg"))
-    .and_then(|l| l.split('"').nth(1).map(|s| s.to_string()))?;
-
-  let input_str = res
-    .lines()
-    .find(|l| l.contains("inputStr"))
-    .and_then(|l| l.split('"').nth(1).map(|s| s.to_string()))?;
-
-  Some((message, input_str))
-}
-
-#[cfg(test)]
-mod tests {
-  use super::*;
-
-  #[test]
-  fn mfa() {
-    let res = r#"var respStatus = "Challenge";
-var respMsg = "MFA message";
-thisForm.inputStr.value = "5ef64e83000119ed";"#;
-
-    let (message, input_str) = parse_mfa(res).unwrap();
-    assert_eq!(message, "MFA message");
-    assert_eq!(input_str, "5ef64e83000119ed");
-  }
-}

crates/gpapi/src/gp_params.rs

@@ -42,7 +42,7 @@ impl ClientOs {
   }
 }
 
-#[derive(Debug, Serialize, Deserialize, Type, Default, Clone)]
+#[derive(Debug, Serialize, Deserialize, Type, Default)]
 pub struct GpParams {
   is_gateway: bool,
   user_agent: String,
@@ -51,9 +51,6 @@ pub struct GpParams {
   client_version: Option<String>,
   computer: String,
   ignore_tls_errors: bool,
-  // Used for MFA
-  input_str: Option<String>,
-  otp: Option<String>,
 }
 
 impl GpParams {
@@ -93,14 +90,6 @@ impl GpParams {
     self.client_version.as_deref()
   }
 
-  pub fn set_input_str(&mut self, input_str: &str) {
-    self.input_str = Some(input_str.to_string());
-  }
-
-  pub fn set_otp(&mut self, otp: &str) {
-    self.otp = Some(otp.to_string());
-  }
-
   pub(crate) fn to_params(&self) -> HashMap<&str, &str> {
     let mut params: HashMap<&str, &str> = HashMap::new();
     let client_os = self.client_os.as_str();
@@ -111,16 +100,11 @@ impl GpParams {
     params.insert("ok", "Login");
     params.insert("direct", "yes");
     params.insert("ipv6-support", "yes");
+    params.insert("inputStr", "");
     params.insert("clientVer", "4100");
     params.insert("clientos", client_os);
     params.insert("computer", &self.computer);
 
-    // MFA
-    params.insert("inputStr", self.input_str.as_deref().unwrap_or_default());
-    if let Some(otp) = &self.otp {
-      params.insert("passwd", otp);
-    }
-
     if let Some(os_version) = &self.os_version {
       params.insert("os-version", os_version);
     }
@@ -203,8 +187,6 @@ impl GpParamsBuilder {
       client_version: self.client_version.clone(),
       computer: self.computer.clone(),
       ignore_tls_errors: self.ignore_tls_errors,
-      input_str: Default::default(),
-      otp: Default::default(),
     }
   }
 }