GnuTLS: Add supporting certificates from PKCS#12 file

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make GnuTLS parse_pkcs12() return extra certificates from the PKCS#12 too

Create a separate list, return them for the caller to do with as it sees fit.

This also cleans up the error handling a little. When this was a purely
internal GnuTLS function, it was fine to leave things (like *key) allocated
and return an error. If my intention is to make this exportable, then it
ought to clean up after itself when returning an error.

I think this actually fixes a potential memory leak for the GnuTLS internal
caller of this function, too.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Import pkcs12_parse() function from GnuTLS to fix PKCS#12 handling

An immediate effect is that this fixes the checking of cert expiry for
PKCS#12 certificates.

But it also means we can include the full supporting chain of
intermediate CAs (which has to be pre-assembled before we ever call
gnutls_certificate_set_x509_key() and can't be appended later), and we
can use the extra certs from the PKCS#12 file too, which parse_pkcs12()
currently doesn't bother to give us.

The plan is to fix parse_pkcs12(), submit the changes back upstream and
make it an exported function there, then stick a version-conditional on
our local copy and look forward to the day when we can rip it out again.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add server certificate validation for GnuTLS

It's broken with trust chains at the moment, at least with GnuTLS
2.12.x, because it looks up issuer certs by *name* and then when it
picks the wrong one the signature unsurprisingly fails. And then it
returns GNUTLS_CERT_INVALID without any specific *reason* for the
failure, which is even more joyful. At least with OpenSSL I can get a
reason string out of it.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Clean up GnuTLS PKCS#12 handling a little

Also try other types if gnutls_pkcs12_verify_mac() returns anything other
than GNUTLS_E_MAC_VERIFY_FAILED.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Check cert expiry, at least for PEM certs

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add client certificate support for GnuTLS

Argh. Why is there not just a function I can call to do this all *for* me?
249 lines of code for this one, which is more than the OpenSSL one I ranted
about at http://www.advogato.org/person/dwmw2/diary/205.html

Oh well, at least the password handling is *slightly* more consistent, if
not entirely so.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Improve GnuTLS compatibility options

TLSv1.0, no safe renegotiation, no padding.

For some reason, large amounts of padding are causing the Intel servers to
kick me off — although gnutls-cli is allowed to use large amounts of padding
with getting disconnected, and I can't see *why* there's a difference.

So there's something else odd going on here, and disabling padding is just
a workaround. I bet I forget about this, and I bet it comes back to bite
me one day. And it'll serve me right for being lazy and not following it
up properly right now. But still, there's plenty more GnuTLS porting work
to be done and I've spent long enough staring at packet traces already
today.

Disable safe renegotiation because we've previously observed that some
servers are behind crappy firewalls that'll block *any* extension.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make CSTP connection in a single SSL record

By creating a buffer with the request and sending it in a single SSL record,
I roughly halve the amount of time it takes for the round trip from 215ms
to 116ms.

Introduce a buf_append() function to help with processing the buffer, since
I shouldn't just be using sprintf() like other places do. Will fix those
next...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Refuse to build with GnuTLS < 2.12.16

We need the fix for gnutls_record_get_direction() or we end up sitting in
select() waiting for a read, when the blockage was actually on a *write*.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add barely functional GnuTLS support

It has no DTLS, doesn't do any server certificate validation, doesn't
support client certificates and there are odd bugs with it even in the
bits that *are* implemented. But we're getting there...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Introduce semi-opaque OPENCONNECT_X509 type in library API

We offer functions to do everything that a user might want to do with the
cert, including one that returns it in DER form. The *only* reason this
isn't a completely opaque type is backward-compatibility.

When we change the soname, it'll be opaque. For now, let it actually be
an X509* for OpenSSL or a gnutls_x509_crt_t for GnuTLS.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add SSL library definition to CFLAGS in openconnect.pc

If openconnect.h is going to reference this, it needs to be set reliably.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove OpenSSL dependency from http.c

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Disable DTLS for GnuTLS build for now

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Move OpenSSL-specific functions from ssl.c to openssl.c

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Split out connect_https_socket() function from openconnect_open_https()

This can be used by the GnuTLS version too.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add openconnect_random() function

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add openconnect_get_cert_DER() function

This translates a cert into an SSL-library-agnostic form, so that the caller
can then process it using their own choice of tools.

As with the new openconnect_get_cert_details(), this isn't marked as a
public function yet because we anticipate more changes to the API.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Be more self-sufficient with header inclusions

Don't rely on things that are implicitly included through OpenSSL headers.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Move basic process_auth_form() out to main.c

There's no need for it to be in the library, and it uses OpenSSL UI.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add openconnect_sha1() function and use it instead of using OpenSSL directly

This also adds openssl.c that OpenSSL-specific functions will migrate to.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add openconnect_get_cert_details() function

Another aspect of the certificate handling becomes ssl-library-agnostic.

This is marked OPENCONNECT_PRIVATE for now. It probably *won't* be private,
but there are other changes to come and probably an soname bump, so there's
no point in exporting it for now.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Move peer_cert handling to openconnect_open_https()

There's no real need to do this in openconnect_obtain_cookie(). It doesn't
really matter if we do it for other connections, since any connections we
make *after* obtaining the cookie will be to the same server anyway.

This moves another OpenSSL-specific snippet out of what should be generic
code.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix API major/minor handling for out-of-source-tree build

We need to look in ${srcdir}/openconnect.h, not just openconnect.h

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add gnutls support to build system

Don't get excited; this is *only* in the build system. It won't build at all.
But we have to start somewhere.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use openconnect_open_https() and openconnect_close_https() better.

Use them unconditionally, without checking ->https_ssl first, and use them
in some places instead of open-coding the same thing.

This makes the code slightly more agnostic to the choice of SSL library.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix non-blocking support in fetch_config()

Rarely likely to matter, but writing the GET request for the config wasn't
coping with -EAGAIN.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make openconnect_open_https() and openconnect_close_https() more forgiving.

If openconnect_open_https() is called with the connection already open,
return immediate success. Thus, the caller doesn't have to poke at
vpninfo->https_ssl to check it.

And if openconnect_close_https() is called when the connection isn't open,
don't attempt to close/free things that don't exist.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove libopenconnect.map from EXTRA_DIST

Signed-off-by: Mike Miller <mtmiller@ieee.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add --with-pkgconfigdir to allow different environments like FreeBSD

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.20

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix invalid progress callback on socket cancellation

Oops! This caused the KDE auth-dialog to die because we pass it back
the wrong pointer.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Stash peer certificate before fetching HTTP response

If the server closes the connection by giving an HTTP 1.0-style response,
then the SSL connection will be gone by the time the GUI auth dialog calls
openconnect_get_peer_cert(). So remember it in order to give it out later.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.19

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use SOCK_CLOEXEC when opening TCP socket

We were already setting FD_CLOEXEC but we should use SOCK_CLOEXEC where
it's available, so there's no race condition in a threaded environment.

When SOCK_CLOEXEC isn't available, set FD_CLOEXEC as soon as possible
after the socket() call to at least reduce the race window.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix --non-inter option so it still allows username/password from command line

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix error message when too many command line arguments

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Call BIO_set_nbio() for SSL BIO at startup

Oops, this was still in CSTP code where we *used* to make the socket
non-blocking, and now it should be like that from the beginning.

It's not entirely clear what difference it makes; all my testing of the
non-blocking code through authentication and CSTP connection was working
fine in non-blocking mode without it, when all I'd done was set O_NONBLOCK
on the socket.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Clean up BIO_set_nbio() calls for DTLS

It's not necessary to do it twice for the same BIO, and it's not necessary
to get that BIO back from the SSL with SSL_get_[rw]bio() when we already
have it in a local variable.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Namespace cleanup: s/set_http_proxy/openconnect_set_http_proxy/

Now the library namespace is entirely prefixed by openconnect_ with no
inappropriate pollution. At least on platforms where the linker version
scripts work.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove internal_parse_url() from the library exports.

The only thing that main.c was really doing differently to the public
openconnect_parse_url() function was allowing 'urlpath' to be superseded
by the --usergroup command line argument. Which we can handle simply
by storing that in a separate variable and applying it afterwards.

The other thing it did differently was check that the scheme is https.
But openconnect_parse_url() arguably should have been doing that anyway.

Fix potential memory leak of old strings in openconnect_parse_url()
while we're at it.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Refuse to redirect to a non-https URL

Not good:
$ ./openconnect www.cam.ac.uk
Attempting to connect to 131.111.8.46:443
SSL negotiation with www.cam.ac.uk
Connected to HTTPS on www.cam.ac.uk
GET https://www.cam.ac.uk/
Got HTTP response: HTTP/1.1 301 Moved Permanently
GET https://www.cam.ac.uk/http://www.cam.ac.uk:80/
Got HTTP response: HTTP/1.1 301 Moved Permanently
GET https://www.cam.ac.uk/http://www.cam.ac.uk:80/http://www.cam.ac.uk:80/
Got HTTP response: HTTP/1.1 301 Moved Permanently
GET https://www.cam.ac.uk/http://www.cam.ac.uk:80/http://www.cam.ac.uk:80/http://www.cam.ac.uk:80/

OK, I asked it to do a stupid thing, but a polite refusal is much better.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add OPENCONNECT_CHECK_VER() macro for compatibility testing

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix up the historical version tags in libopenconnect.map

It's entirely irrelevant since nothing was using them back then, but it
doesn't hurt to have them correct.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make compat symbols @@OPENCONNECT_PRIVATE

Would be even nicer if I could find a way to let *only* openconnect itself
use them, and not have them visible to general users of the library.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove duplicate library API version number from Makefile.am

Pick it up from openconnect.h automatically. This means that the
configure script will run, and the makefiles will be regenerated,
whenever openconnect.h changes — but openconnect.h shouldn't be changing
in non-cosmetic ways without the version being bumped anyway, and if the
version is bumped then the makefile needs to be rebuilt too.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add library.c and compat.c to POTFILES.in for translation

There are no translatable strings in them yet, but I'm never going to
remember to add them if they ever *do* grow strings. So add them now
while I think of it.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Define _WITH_GETLINE for BSD systems

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make symbol versioning work on Solaris too

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update copyright years

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix corruption of input string to openconnect_parse_url()

Well, kind of. This is the approach which was partially implemented in
commit 382d05dd1929788be151e96d80e7b8289b8f7c08 but missed restoring the
colon before the port number. It's still fairly dodgy that we're scribbling
on the input string at all, even if we do put it back again afterwards.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove inappropriate exit() from library code

It makes the auth-dialog very unhappy, if openconnect_obtain_cookie() calls
exit() from its thread when it gets cancelled. Distinctly suboptimal.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add symbol versioning to libopenconnect shared library

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Export openconnect_version as a pointer rather than an array

Otherwise, the binary seems to *know* the length of the string that it
expected to be in the library, and when bitching of a mismatch it still
truncates the library version to the length that it *expected* the library
version string to be.

Change the name of it to 'openconnect_version_str' at the same time as we
change the datatype, to avoid crashes when linking against an older/newer
library.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add openconnect_set_cancel_fd() to library

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use openconnect_SSL_read() for fetching HTTP response

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add openconnect_SSL_read() functional which handles cancellation

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Write initial auth GET request in non-blocking mode

Now we can remain non-blocking all the way to fetching the body.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Handle cancellation in openconnect_SSL_gets()

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add cancellable openconnect_SSL_write(), use it from openconnect_SSL_printf()

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Return non-blocking socket from openconnect_open_https()

All the callers just set it to blocking mode again immediately, but we're
working on that...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add vpninfo arg to openconnect_SSL_{printf,gets} functions

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add cancellation handling to SSL_connect() for https connection

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add cancellation handling to proxy I/O functions

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix handling of error from proxy_write() in process_http_proxy()

It returns the error; don't look in errno for it

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add vpninfo arg to proxy I/O functions, use proxy_read() from proxy_gets()

This allows us to handle cancellation in proxy_read() and proxy_write().

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Handling cancellation during initial connect()

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add (unused) cancel_fd to vpninfo struct

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Flush progress output immediately.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Expand OpenSSL DTLS compatibility to include Ubuntu 10.04 (Lucid Lynx)

They appear to have backported the Cisco DTLS compatibility, but their
OpenSSL is otherwise so old that our workaround for the absence of
dtls1_stop_timer() doesn't work. The timer handling is entirely different
there. So after an archaeological expedition through OpenSSL CVS history
and RT, cope a little better with such abominations.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix ENGINE_by_id() and dtls1_stop_timer() checks with non-system OpenSSL

If we use AC_CHECK_LIB(-lssl, ...) then it'll use the system libssl even
when configured with --with-openssl= to use something different. So switch
to using AC_LINK_IFELSE and use $OPENSSL_LIBS (which should be correct)
instead.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add local getline() for Solaris 10 build

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add --config option for reading options from file

Based on a patch by Fabian Jäger.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Prepare for config file support; don't use getopt_long() and optarg directly

And also use an accessor macro for when we want to *copy* it, since when
it comes from the config file it'll need to be strdup'd.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.18

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix potential buffer overflow in banner handling

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Attempt to fix autohate breakage when building without NLS support

configure: error: conditional "AMDEP" was never defined.
Usually this means the macro was only invoked conditionally.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.17

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update building and vpnc-script pages for mandatory vpnc-script

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update distro status

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update supported platform list

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove unused started.xml page

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix version.sh for Solaris 10

./version.sh: !: not found

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Cast uid_t to (long) to print it, silencing warnings on Solaris

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Work around warnings caused by Solaris misdefinition of 'struct option'.

Its man page clearly states that the 'name' field in 'struct option' is a
const char *. It lies, and the compiler bitches about normal assignment
of static strings.

https://www.illumos.org/issues/1881

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Move asprintf() implementation to compat.c

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Work around time() brokenness on Solaris.

On Solaris and OpenIndiana, time() goes backwards. It and gettimeofday()
occasionally jump back to 1970 and return zero seconds — although the
tv_usec field is still sane, bizarrely.

CR7121035 in Solaris, https://www.illumos.org/issues/1871 in OpenIndiana.

It seems that gethrtime() doesn't suffer the same problem, so let's use
that instead of time() for now.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove gratuitous ARP plumbing which breaks Solaris 10

Suggested by Kazuyoshi Aizawa and tested on S10, S11, oi_151a with both
IPv6 and Legacy IP.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove openconnect.html from EXTRA_DIST

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add local implementation of asprintf() for Solaris 10

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix shared/static setup to clarify default setting

Change the variables from their defaults only in the --with-openssl
section.  This leaves the default conspicuous and makes --help show the
correct default behavior.

Signed-off-by: Mike Miller <mtmiller@ieee.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make vpnc-script mandatory.

Things won't work without it, and it will also help to make sure packagers
notice that it's needed.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>