T7635: OpenConnect Certificate Authentication

Author: giga1699

data/templates/ocserv/ocserv_config.j2

@@ -30,6 +30,9 @@ auth = "plain[otp=/run/ocserv/users.oath]"
 {%     else %}
 auth = "plain[/run/ocserv/ocpasswd]"
 {%     endif %}
+{% elif "cert" in authentication.mode %}
+auth = "certificate"
+cert-user-oid = {{ authentication.mode.cert }}
 {% else %}
 auth = "plain[/run/ocserv/ocpasswd]"
 {% endif %}

interface-definitions/vpn_openconnect.xml.in

@@ -69,6 +69,30 @@
                       <valueless/>
                     </properties>
                   </leafNode>
+                  <leafNode name="cert">
+                    <properties>
+                      <help>Use certificate based authentication</help>
+                      <valueHelp>
+                        <format>cn</format>
+                        <description>OID 2.5.4.3 - Common Name</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>uid</format>
+                        <description>OID 0.9.2342.19200300.100.1.1 - UID</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>x.x.xx.xxx</format>
+                        <description>Custom OID in dotted decimal format</description>
+                      </valueHelp>
+                      <constraint>
+                        <regex>(^\.?\d{1,5}(?:\.\d{1,5})*$|cn|uid)</regex>
+                      </constraint>
+                      <constraintErrorMessage>Invalid OID selection. Must be cn, uid, or a valid OID format.</constraintErrorMessage>
+                      <completionHelp>
+                        <list>cn uid x.x.xx.xxx</list>
+                      </completionHelp>
+                     </properties>
+                   </leafNode>
                 </children>
               </node>
               <node name="identity-based-config">

src/conf_mode/vpn_openconnect.py

@@ -106,10 +106,21 @@ def verify(ocserv):
             if (
                 'local' in ocserv['authentication']['mode']
                 and 'radius' in ocserv['authentication']['mode']
+                or
+                'local' in ocserv['authentication']['mode']
+                and 'cert' in ocserv['authentication']['mode']
+                or
+                'radius' in ocserv['authentication']['mode']
+                and 'cert' in ocserv['authentication']['mode']
             ):
                 raise ConfigError(
-                    'OpenConnect authentication modes are mutually-exclusive, remove either local or radius from your configuration'
+                    'OpenConnect authentication modes are mutually-exclusive. Only one of local, radius, or cert.'
                 )
+            if 'cert' in ocserv['authentication']['mode']:
+                if 'cn' in ocserv['authentication']['mode']['cert']:
+                    ocserv['authentication']['mode']['cert'] = '2.5.4.3'
+                elif 'uid' in ocserv['authentication']['mode']['cert']:
+                    ocserv['authentication']['mode']['cert'] = '0.9.2342.19200300.100.1.1'
             if 'radius' in ocserv['authentication']['mode']:
                 if 'server' not in ocserv['authentication']['radius']:
                     raise ConfigError(
@@ -202,6 +213,9 @@ def verify(ocserv):
         raise ConfigError('SSL certificate missing on OpenConnect config!')
     verify_pki_certificate(ocserv, ocserv['ssl']['certificate'])
 
+    if 'ca_certificate' not in ocserv['ssl'] and 'cert' in ocserv['authentication']['mode']:
+        raise ConfigError('CA certificate must be provided in certificate authentication mode!')
+
     if 'ca_certificate' in ocserv['ssl']:
         for ca_cert in ocserv['ssl']['ca_certificate']:
             verify_pki_ca_certificate(ocserv, ca_cert)