Kevin Cernekee [Sat, 13 Oct 2012 19:39:40 +0000 (12:39 -0700)]
Fix missing newline in the "No form handler" error message
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Kevin Cernekee [Mon, 8 Oct 2012 01:03:37 +0000 (18:03 -0700)]
Link to OpenConnect SOCKS proxy (ocproxy) from documentation
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Kevin Cernekee [Mon, 8 Oct 2012 01:03:36 +0000 (18:03 -0700)]
Update Debian package status
Debian stable (squeeze) includes openconnect,
network-manager-openconnect, and OpenSSL 0.9.8o:
http://packages.debian.org/squeeze/openconnect
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Kevin Cernekee [Mon, 8 Oct 2012 01:03:35 +0000 (18:03 -0700)]
Fix a couple of minor typos
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Kevin Cernekee [Sun, 30 Sep 2012 03:02:35 +0000 (20:02 -0700)]
Delete references to long-removed SecurID code
Commit
d707fc524 (Clean up auth form handling) removed securid.c and
the tokencode+PIN prompts, but the docs and headers still refer to these
features.
Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 21:01:10 +0000 (22:01 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 20:56:21 +0000 (21:56 +0100)]
Update changelog
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 20:55:42 +0000 (21:55 +0100)]
Fix leaks on failure paths in OpenSSL openconnect_open_https()
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:42:10 +0000 (20:42 +0100)]
Fix use-after-free of numeric IPv6 hostname on error path
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:27:25 +0000 (20:27 +0100)]
Fix fd/memory leak on error return from openconnect_open_https()
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:26:04 +0000 (20:26 +0100)]
Close dtls_fd on error returns from connect_dtls_socket()
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:24:52 +0000 (20:24 +0100)]
Close config_fd before returning from write_new_config()
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:23:31 +0000 (20:23 +0100)]
Close ssl_sock before returning error in connect_https_socket()
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:21:37 +0000 (20:21 +0100)]
Free CSTP option structure before error return if malloc fails
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:20:32 +0000 (20:20 +0100)]
Close XML file handle before error return if fstat() fails
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:12:57 +0000 (20:12 +0100)]
Fix error reporting when failed to write CSD script file
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:09:17 +0000 (20:09 +0100)]
Fix potential NULL dereference in error path in gnutls_pkcs11_simple_parse()
Spotted by Coverity. Also fixed in GnuTLS already in commit
6aca5dd7.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 26 Sep 2012 19:04:28 +0000 (20:04 +0100)]
Fix token serial number matching when trying to find hidden PKCS#11 key
Spotted by Coverity.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 24 Sep 2012 10:34:20 +0000 (11:34 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 23 Sep 2012 13:48:05 +0000 (14:48 +0100)]
Update translations from Transifex
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sat, 22 Sep 2012 11:20:03 +0000 (12:20 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 23 Sep 2012 15:42:41 +0000 (17:42 +0200)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 23 Sep 2012 15:41:09 +0000 (17:41 +0200)]
Be explicit when we're connecting to a proxy not directly to a VPN server
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 10 Sep 2012 15:59:10 +0000 (16:59 +0100)]
Update translations from Transifex
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 3 Sep 2012 23:11:51 +0000 (00:11 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 31 Aug 2012 12:29:57 +0000 (13:29 +0100)]
Tag version 4.07
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 31 Aug 2012 12:25:06 +0000 (13:25 +0100)]
Update changelog
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Stuart Henderson [Thu, 30 Aug 2012 13:15:05 +0000 (14:15 +0100)]
Add missing : to getopt string for -p which takes a parameter.
Print an error rather than trying to strdup(NULL) if the parameter
is not specified.
Signed-off-by: Stuart Henderson <sthen@openbsd.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 20 Aug 2012 10:37:52 +0000 (11:37 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 20 Aug 2012 10:14:23 +0000 (11:14 +0100)]
Update translations from Transifex
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 3 Aug 2012 22:26:52 +0000 (23:26 +0100)]
Handle CSTP rekey when stalled
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 3 Aug 2012 09:11:54 +0000 (10:11 +0100)]
Fix CSTP write stall handling
We were handling the -EAGAIN case as a hard error and tearing down the
connection. Instead, we should just wait for the socket to become writeable.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 2 Aug 2012 21:08:12 +0000 (22:08 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 23 Jul 2012 13:14:06 +0000 (14:14 +0100)]
Tag version 4.06
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Mike Miller [Thu, 19 Jul 2012 05:10:42 +0000 (01:10 -0400)]
Check for system CA certificate file for GnuTLS
Look in certain well-known system paths for the default file to give to
gnutls_certificate_set_x509_trust_file() if required. Auto-detection is
inspired by the GnuTLS configure script.
Signed-off-by: Mike Miller <mtmiller@ieee.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 16 Jul 2012 20:20:45 +0000 (21:20 +0100)]
Fix strict-aliasing warning with DTLS local port handling
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 16 Jul 2012 19:19:44 +0000 (20:19 +0100)]
Improve error reporting for vpnc-script
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 15 Jul 2012 19:25:44 +0000 (20:25 +0100)]
Handle PKCS#11 tokens which don't list keys before login
If the user passed only one URL for both key+cert, and the cert was found,
then at least *try* looking for the key in the same token before giving up.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 12 Jul 2012 13:57:01 +0000 (14:57 +0100)]
Tag version 4.05
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 12 Jul 2012 12:12:50 +0000 (13:12 +0100)]
Use correct XML tag for CSD script on Mac
Other operating systems still get the Linux version, and will need a
wrapper or something to make it cope.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 12 Jul 2012 12:05:33 +0000 (13:05 +0100)]
Remove CSD script when done with it
We still don't remove it if the user hits Ctrl-C when we're logging in.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 12 Jul 2012 11:56:54 +0000 (12:56 +0100)]
Only setuid() for CSD if a user was specified.
Otherwise it'll be setuid(0) which will (mostly) be a no-op for root, or
fail for non-root users.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 12 Jul 2012 11:53:33 +0000 (12:53 +0100)]
Remove -vpnclient arg from CSD invocation
It never made any sense, and doesn't seem to be necessary.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 11 Jul 2012 21:42:29 +0000 (22:42 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 11 Jul 2012 21:40:17 +0000 (22:40 +0100)]
Remove obsolete --key-type option from usage help text
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 11 Jul 2012 17:13:34 +0000 (18:13 +0100)]
Fix endless loop when multiple PKCS#11 tokens need PINs
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 11 Jul 2012 16:58:32 +0000 (17:58 +0100)]
Use P11_KIT_URI_FOR_ANY to preserve all attributes in PKCS#11 URIs
Otherwise we were losing the attributes which specified a token... which is
a pain when the token doesn't list private keys until you're logged in. In
that case you do *have* to specify the token otherwise the object will never
be found.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Tue, 10 Jul 2012 14:30:26 +0000 (15:30 +0100)]
Don't forget key password on reconnect / change hosts in GUI.
As part of the password handling cleanup, we were clearing the stored
->cert_password after using it. This means we have to retain the https_ctx
or https_cred structure for the whole lifetime of the vpninfo, even across
reconnects. Fix openconnect_reset_ssl() accordingly.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Stuart Henderson [Sun, 8 Jul 2012 15:23:05 +0000 (17:23 +0200)]
mainloop.c - malloc without a prototype
I noticed a little problem building OpenConnect against gnutls 3;
mainloop.c uses malloc() in queue_new_packet(), somewhere in the chain
of openssl headers stdlib.h gets pulled in so it works ok there, but
this isn't the case with a gnutls build.
Signed-off-by: Stuart Henderson <sthen@openbsd.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 8 Jul 2012 19:42:07 +0000 (20:42 +0100)]
Update translations from Transifex
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 8 Jul 2012 19:38:34 +0000 (20:38 +0100)]
Fix 'make update-translations' not to remove file headers
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 5 Jul 2012 10:14:27 +0000 (11:14 +0100)]
Tag version 4.04
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 5 Jul 2012 10:03:37 +0000 (11:03 +0100)]
Strip out full header when comparing po files
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 5 Jul 2012 08:50:09 +0000 (09:50 +0100)]
Fix spelling error in --pid-file help text
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 5 Jul 2012 08:40:36 +0000 (09:40 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 2 Jul 2012 23:41:38 +0000 (00:41 +0100)]
Fix GnuTLS password handling for PKCS#8 files
When we have no preconfigured password for a PKCS#8 file, we were getting
the wrong error and were aborting instead of asking for a password.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 2 Jul 2012 10:25:55 +0000 (11:25 +0100)]
Tag version 4.03
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Tiago Vignatti [Sun, 1 Jul 2012 23:03:23 +0000 (02:03 +0300)]
Fix --no-proxy option
A missing break in the case statement meant that --no-proxy would not disable
the proxy at all; it would actually have the same effect as --libproxy.
This bug has been present since the --no-proxy option was first added in
v2.20 (commit
9c6d3f1b). Although it was falling through to the --script
option then.
Signed-off-by: Tiago Vignatti <tiago.vignatti@intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 1 Jul 2012 21:23:01 +0000 (22:23 +0100)]
Update changelog
It looks like the problematic server wasn't really objecting to SSLv3; it
was the lack of 3DES cipher. It wouldn't accept AES which was the only
thing that GnuTLS was offering.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sat, 30 Jun 2012 00:41:59 +0000 (01:41 +0100)]
Separate requested from received MTU settings
This fixes a bug where an MTU requested with the --mtu option will actually
be set as the interface MTU even if the server replies with a smaller value.
It also fixes reconnect behaviour, by not treating the MTU response from
the server on the original connection into an override for the reconnect.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 29 Jun 2012 23:55:06 +0000 (00:55 +0100)]
Fix GnuTLS DTLS MTU for GnuTLS 3.0.21 and above
The fix in 4.01 (commit
c218e2ac) was relying on buggy behaviour of
GnuTLS. It shouldn't have been sufficient just to pass it the *data* MTU
plus 13 and rely on the fact that GnuTLS will happily send packets
larger than that. In fixing GnuTLS MTU handling and adding the new
gnutls_dtls_set_data_mtu() function in 3.0.21, I have broken my own
code. And it serves me right.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 29 Jun 2012 20:17:47 +0000 (21:17 +0100)]
Advertise TLS1.0 not SSL3.0 in GnuTLS ClientHello
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 29 Jun 2012 11:52:41 +0000 (12:52 +0100)]
Remove hard-coded table of ciphers for PEM decryption
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 28 Jun 2012 23:58:34 +0000 (00:58 +0100)]
Improve cipher coverage of OpenSSL encrypted PEM support for GnuTLS
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 28 Jun 2012 14:52:51 +0000 (15:52 +0100)]
Tag version 4.02
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 28 Jun 2012 13:04:36 +0000 (14:04 +0100)]
Fix build failure on systems without GnuTLS v3
Oops. Including header files which are only available in GnuTLS v3 is
probably not cunning, if we're building with OpenSSL or with GnuTLS v2.
Pointed out by Stuart Henderson (thanks).
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 28 Jun 2012 11:46:40 +0000 (12:46 +0100)]
Tag version 4.01
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 27 Jun 2012 22:20:40 +0000 (23:20 +0100)]
Fix DTLS MTU for GnuTLS
GnuTLS defaults to an MTU of 1200 (less the 13-byte overhead), and will
truncate data packets accordingly. We *really* don't want that...
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 27 Jun 2012 18:58:55 +0000 (19:58 +0100)]
Fix SEGV on cstp_reconnect() without deflate
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Tue, 26 Jun 2012 14:41:16 +0000 (15:41 +0100)]
Clean up Transifex import some more
Don't let local msgmerge use fuzzy translations either, don't care about
Translation-Team: changing, and use 'diff' so we actually see the changes
(since more often than not they're false positives, so it eases debugging).
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 25 Jun 2012 20:13:35 +0000 (22:13 +0200)]
Fix build on systems without O_CLOEXEC
Reported by Ryan Steinmetz <zi@freebsd.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Steven Ihde [Sun, 24 Jun 2012 03:49:32 +0000 (20:49 -0700)]
Add source port option for DTLS
Signed-off-by: Steven Ihde <sihde@hamachi.us>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sat, 23 Jun 2012 16:15:07 +0000 (18:15 +0200)]
Update translations from Transifex
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sat, 23 Jun 2012 15:20:42 +0000 (17:20 +0200)]
Transifex import: Reduce churn, and don't forget to add new translations
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 22 Jun 2012 14:17:40 +0000 (15:17 +0100)]
Import translations from GNOME
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 22 Jun 2012 09:56:37 +0000 (10:56 +0100)]
Rebuild openconnect.8 if necessary before openconnect.8.inc
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 22 Jun 2012 09:03:01 +0000 (10:03 +0100)]
Print correct error when /dev/net/tun open fails
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Thu, 21 Jun 2012 16:04:23 +0000 (17:04 +0100)]
Don't require zlib in pkgconfig if it was found without it
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 20 Jun 2012 17:01:21 +0000 (18:01 +0100)]
Tag version 4.00
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 20 Jun 2012 13:59:25 +0000 (14:59 +0100)]
Update translations from Transifex
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 20 Jun 2012 13:47:41 +0000 (14:47 +0100)]
Run msgmerge after importing translations from Transifex
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 20 Jun 2012 12:55:30 +0000 (13:55 +0100)]
Add translations that GNOME NetworkManager-openconnect has, that we don't
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Wed, 20 Jun 2012 12:34:19 +0000 (13:34 +0100)]
Fix typo in error message
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Tue, 19 Jun 2012 16:42:22 +0000 (17:42 +0100)]
Support old-style OpenSSL encrypted PEM keys
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Tue, 19 Jun 2012 16:34:41 +0000 (17:34 +0100)]
Fix memory leaks in text-mode process_form_opts
The caller probably won't free the returned answers if we return error,
so do it locally.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Tue, 19 Jun 2012 12:37:38 +0000 (13:37 +0100)]
NUL-terminate blobs from Andoird keystore
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Mon, 18 Jun 2012 19:06:36 +0000 (20:06 +0100)]
Fix PKCS#11 cleanup when no SSL certificate is set
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 17 Jun 2012 22:42:53 +0000 (23:42 +0100)]
Add Android keystore support for --cafile
Based on a patch from Vilmos Nebehaj <v.nebehaj@gmail.com>
Signed-off-by: Vilmos Nebehaj <v.nebehaj@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 17 Jun 2012 22:40:41 +0000 (23:40 +0100)]
Add missing includes and libs to Android.mk
I probably shouldn't need to add libc, but it shouldn't hurt either, and I
*do* need it. Otherwise I think my screwed up local build system is using
the wrong one. One day I'll actually get AOSP or Cyanogen to build properly
and I won't have to suffer with this cobbled-together pile of crap that I'm
using...
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 17 Jun 2012 21:02:16 +0000 (22:02 +0100)]
Switch from Android's keystore_get() to our own keystore_fetch()
This gives proper error handling which Android's lacks.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 17 Jun 2012 20:58:02 +0000 (21:58 +0100)]
Fix double-free of BIO in loading cert from keystore
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 17 Jun 2012 01:37:42 +0000 (02:37 +0100)]
Fix fake Android keystore_get() to return -1 on failure
Harmless in this case, but it doesn't hurt to be consistent with Android.
At least, with what Android does when it's *not* buggy... :)
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sun, 17 Jun 2012 01:33:43 +0000 (02:33 +0100)]
Fix Android keystore support for older keystore_get.h
This is an "inline" function, in the header file. So it's about the build
environment you use for building openconnect, not the runtime environment.
It was fixed by the following commit in android/frameworks/base:
commit
c741a2fe41ea33fc386a4d5b932cc081aa92a18c
Author: Chia-chi Yeh <chiachi@android.com>
Date: Thu Sep 30 15:17:58 2010 +0800
KeyStore: Fix the return value when send() or recv() has an error.
Change-Id: I20a63c76bd29b1a9f8959a6c4fe5a5b8a9a971b4
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 15 Jun 2012 14:06:31 +0000 (15:06 +0100)]
Add trousers to list of optional build deps
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 15 Jun 2012 13:55:56 +0000 (14:55 +0100)]
Add gnutls.h to noinst_HEADERS
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 15 Jun 2012 13:49:06 +0000 (14:49 +0100)]
Remove POTFILES.in from po/ EXTRA_DIST
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 15 Jun 2012 13:48:04 +0000 (14:48 +0100)]
Automatically keep Android.mk in sync with source lists from Makefile.am
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 15 Jun 2012 13:26:26 +0000 (14:26 +0100)]
OpenSSL: Fix recognition of repeated 'wrong passphrase' errors
Without it, we were getting the wrong error if the passphrase was wrong
a second time, and not correctly staying in the retry loop:
Enter PEM pass phrase:
140379913099200:error:
06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:536:
Loading private key failed (wrong passphrase?)
Enter PEM pass phrase:
140379913099200:error:
23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error:p12_decr.c:97:
Loading private key failed (see above errors)
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 15 Jun 2012 13:03:03 +0000 (14:03 +0100)]
Add Android keystore support
Based on a patch from Vilmos Nebehaj <v.nebehaj@gmail.com>
Signed-off-by: Vilmos Nebehaj <v.nebehaj@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Fri, 15 Jun 2012 12:45:13 +0000 (13:45 +0100)]
Fix Android build
Well, almost. My local NDK setup still fails to link because libicuuc.so
needs libgabi++.so, and even with that it has undefined references to
mbstowcs and wcstombs. But that's probably a local issue.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>