Fix out-of-source-tree invocation of version.sh

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix out-of-source-tree build of web pages

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove -Wundef and -Wmissing-noreturn from default CFLAGS

These just cause unwanted noise.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Attempt to build without NLS if intltool isn't available

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Pointers to translated strings must be const

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix arithmetic on void pointers in cstp.c

This is a gccism and not portable. And could have been dereferencing an
unaligned pointer too. Thanks to Florian Wobbe for pointing it out.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix newlines in nl translations

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make usage help output translatable

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add maintainer mode

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make more strings translatable

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix newlines in nl translations

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add update-translations make target

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.13

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add openconnect_set_cert_expiry_warning() to library

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add --cert-expire-warning,-e option to set warning level

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make certificate expiry warning time variable (still default 60 days)

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Clean up DTLS Session-ID length warning

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Switch to using PNG image in web site. Android can't show SVG. Still!

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update transations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add OpenSuSE to distribution status list

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Man page update: clarify which fsid is used, forget Solaris tuntap IPv6 patch.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add links to manual page, don't number 'started' subpages

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix header on connecting page

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix up distro status page.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use automake for www/ directory

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update new web pages in release, not openconnect.html

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add new version of web pages

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Translatability fix for 'Discard bad split xxclude' message

Thanks to Jussi Kukkonen for pointing it out.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add Transifex config file so 'tx pull' works in any checkout.

Would be nicer if it worked anonymously rather than having to have an account.
For that see http://trac.transifex.org/ticket/740

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add (empty) translation files from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add error message when SSL cert fails

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix build instructions on web page.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Reduce certificate warning to PRG_INFO

We're going to call back into the validate_peer_cert() function anyway.
Let it handle things properly.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use dgettext() so the domain is always correct even in libopenconnect

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make user-visible strings translatable

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add translation support

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix libproxy build.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix DTLS-may-fail warning when built against OpenSSL 1.0.0e and run with older

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Refactor xmlnode_msg() not to use server-provided string as asprintf() format.

auth.c: In function 'xmlnode_msg':
auth.c:287:2: warning: format not a string literal, argument types not checked [-Wformat-nonliteral]

There wasn't actually a problem here; we *were* vetting the string. But this
is cleaner and stops the compiler bitching.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix handling of vpninfo->ifname. Always strdup()

We don't actually free it; there will only be one instance during the whole
lifetime of the openconnect process. But stop the compiler bitching about it.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make in_ex and route args to process_split_xxclude const

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix another const char warning in start_cstp_connection()

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make vpninfo->quit_reason const to avoid compiler complaints

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Avoid unused 'autoproxy' variable when built without libproxy support.

If we change the way we detect and abort, we can *check* that variable
that the compiler is complaining about.

I just noticed that libproxy support isn't working; OPENCONNECT_LIBPROXY
is never being defined. Will fix that shortly...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make 'base' arg to openconnect_create_useragent() const

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make usage() static to avoid compiler complaints

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix compiler warnings about constness of csd_argv[]

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make parse_xml_response() method and request_body_type args const

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make 'print_equals' string const to avoid compiler complaints

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix char pointers in check_certificate_expiry() to be const

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make match_cert_hostname() static to avoid compiler complaints

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Enable various compiler warnings

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Enable AM_SILENT_RULES so that warnings are more visible.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Clean up DTLS timer workaround to make it work with Debian OpenSSL, hopefully

The Debian libraries don't export dtls1_stop_timer() since it's supposed to
be an internal function. But thankfully I think we can do it manually. This
sucks; it means that a misguided attempt at restricting us has forced us
into poking at even *more* internal stuff than we ever wanted to. Yay Debian.

Try to make it slightly less insane by putting upper and lower bounds on
the versions for which we'll do it: We know that OpenSSL 1.0.0e and
above won't be resending the ChangeCipherSpec messages anyway, because
of the fix for OpenSSL RT#2505. I'm dubious about that being the correct
thing to do, but it's working and it matches the Cisco client so I'm going
to try not to think about it too hard.

Also stop *defining* SSL_OP_CISCO_ANYCONNECT for ourselves, and simply
refuse to build DTLS support if it's absent. That patch is merged into
OpenSSL long ago, so we are effectively requiring 0.9.8m or above.

That version is, by coincidence, also the first version where our own
dirty reimplementation of dtls1_stop_timer() is valid. If someone does
backport the Cisco compatibility patch to even-more-ancient OpenSSL than
that, they'd best make sure they backport the other fixes too.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.12

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Print SHA1 fingerprint with server certificate details.

...so that it can be used with --servercert next time.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add --pid-file option

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix DTLS compatibility with ASA firmware 8.4.1(11) and above.

It seems to get very upset when we resend our ChangeCipherSpec messages,
as the RFC says we're supposed to do. Without a periodic resend, if the
original did get lost in transit, the server wouldn't be able to decrypt
any of our data packets.

Perhaps there's something "wrong" with our packets; the ChangeCipherSpec
messages is is one of the areas in which Cisco's "speshul" version of
DTLS differs from RFC4347. But the Cisco client doesn't seem to resend it
at all, ever. Making it hard to tell what Cisco want it to look like,
unless we wanted to reverse-engineer their code. Which we don't.

If Cisco get away without resending, I suppose we can, until/unless we
work it out. DPD should mostly let us get away with it, because if the
first packet *does* get lost, DPD will soon tell us that the DTLS
connection is dead and we'll make a new one. Sucks, but that's what you
get for using crappy not-quite-RFC-compliant kit. Yay Cisco. Why not join
us in 2006 and start using the proper standard? It's not even as if it'd
be hard to support both in parallel for a while.

Thanks to Eric Barkie for the initial diagnosis.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Changelog entry for build fixes

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix build failure with ancient OpenSSL lacking SSL_OP_NO_TICKET

If it doesn't support the ticket extension, that means we don't need
to stop it from *sending* the ticket extension...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix build failure on GNU Hurd (Debian bug #637362)

Currently openconnect does not compile on hurd-i386. The problem is a
missing inclusion of sys/statfs.h in ssl.c. The inlined patch fixes
this issue.

Signed-off-by: svante.signell@telia.com
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add zlib to linker line to fix building on Debian

Signed-off-by: Ilia Kats <ilia-kats@gmx.net>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.11

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Output to stderr too in Android's syslog_progress()

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Mention Android in supported platforms

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

android: fix typo in #include header

Signed-off-by: Jason Cooper <cyanogen@lakedaemon.net>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Android build support.

[dwmw2: Clean up file lists, define IF_TUN_HDR]

Signed-off-by: Jason Cooper <cyanogen@lakedaemon.net>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add Android logging support

[dwmw2: make it use the --syslog option instead of removing it]

Signed-off-by: Jason Cooper <cyanogen@lakedaemon.net>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove <sys/syslog.h> inclusion. It should be <syslog.h>

Android doesn't have <sys/syslog.h>

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make TPM ENGINE support optional

Android's OpenSSL doesn't have ENGINE support; don't require it.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Changelog entry for the switch back to TLSv1

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use TLSv1 again, but with no extensions.

In commit 3bee59cd8c4fd6dc38bc2c7d5edb9b5795509fca ("Use SSLv3 not TLSv1")
we switched to SSLv3 to avoid problems with VPN servers (or firewalls)
which reject extensions in ClientHello. Another user now reports that
using SSLv3 is failing, and he needs to use TLSv1.

Testing confirms that the originally problematic server *does* work with
TLSv1, as long as we disable the session ticket extension. So that makes
everyone happy... for now, until a new extension is invented and enabled
by default, and we have to block that too.  It's a shame that there's no
SSL_OP_NO_EXTENSIONS which would turn them *all* off.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.10

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Note the existence of KDE support for NetworkManager + openconnect

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Silence output from tag checks

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove debugging from uncommitted-check rule

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add 'make tmp-dist' for testing tarballs, to work around the tag check

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Check for repeated tags in 'make tag'

And remove the ifdef VERSION, since $(VERSION) is always defined now.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix dist-hook to enforce being at $(VERSION)

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Switch to using autohate :(

I really didn't want to do this, but much as I hate libtool it is the
easiest way to portably build shared libraries, and we really do need
to build libopenconnect as a shared library. And having used libtool
we might as well concede entirely and use autoconf/automake.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add openconnect_vpninfo_new_with_cbdata() function to ease C++ integration

C++ callers really want the 'self' object pointer to be the first argument
of the callbacks. Give them the chance to get that, instead of the vpninfo
pointer.

Preserve the old openconnect_vpninfo_new() call, even with the same
prototype for the callback functions, for compatibility with the existing
GNOME auth-dialog.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Explicitly require pkg-config. It's not installed by default on OS X

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add 'reconnect' invocation of vpnc-script, to re-ensure routing/DNS setup

If we reconnect because of an actual local network disconnect/reconnect, then
something (DHCP, etc.) may have screwed up the routing and DNS according to
the local configuration. Give the script a chance to remedy that.

With iproute (i.e. modern Linux) it ought to work just to make vpnc-script
do the same as it does on 'connect'. For other systems it's somewhat harder.

For now vpnc-script will ignore it, anyway.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use 'openssl' pkgconfig not 'libssl'. Debian doesn't include -lcrypto in libssl

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add --non-inter option

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update web page to document NetworkManager auth-dialog move

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Clarify that --script [...] will be evaluated by the shell.

Signed-off-by: Thomas Schwinge <thomas@codesourcery.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.02

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix manpage formatting

Adding back a period at the start of this file fixes the broken
formatting.

Signed-off-by: Ray Kohler <ataraxia937@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Clear cached peer_addr where necessary.

If the user declined to manually accept a certificate in the NetworkManager
auth-dialog, and the SSL_connect() failed, we were still keeping the cached
peer_addr around. So even after the user chose *another* host to connect to,
we weren't actually doing another DNS lookup; we were just continuing to
connect to the old address.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use pkgconfig for libssl.

Taken from the Gentoo portage. Either they hadn't bothered to send me
the patch, or I had dropped it.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Bump library API for openconnect_vpninfo_free() addition

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>