Add --config option for reading options from file

Based on a patch by Fabian Jäger.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Prepare for config file support; don't use getopt_long() and optarg directly

And also use an accessor macro for when we want to *copy* it, since when
it comes from the config file it'll need to be strdup'd.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.18

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix potential buffer overflow in banner handling

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Attempt to fix autohate breakage when building without NLS support

configure: error: conditional "AMDEP" was never defined.
Usually this means the macro was only invoked conditionally.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.17

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update building and vpnc-script pages for mandatory vpnc-script

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update distro status

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update supported platform list

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove unused started.xml page

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix version.sh for Solaris 10

./version.sh: !: not found

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Cast uid_t to (long) to print it, silencing warnings on Solaris

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Work around warnings caused by Solaris misdefinition of 'struct option'.

Its man page clearly states that the 'name' field in 'struct option' is a
const char *. It lies, and the compiler bitches about normal assignment
of static strings.

https://www.illumos.org/issues/1881

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Move asprintf() implementation to compat.c

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Work around time() brokenness on Solaris.

On Solaris and OpenIndiana, time() goes backwards. It and gettimeofday()
occasionally jump back to 1970 and return zero seconds — although the
tv_usec field is still sane, bizarrely.

CR7121035 in Solaris, https://www.illumos.org/issues/1871 in OpenIndiana.

It seems that gethrtime() doesn't suffer the same problem, so let's use
that instead of time() for now.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove gratuitous ARP plumbing which breaks Solaris 10

Suggested by Kazuyoshi Aizawa and tested on S10, S11, oi_151a with both
IPv6 and Legacy IP.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove openconnect.html from EXTRA_DIST

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add local implementation of asprintf() for Solaris 10

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix shared/static setup to clarify default setting

Change the variables from their defaults only in the --with-openssl
section.  This leaves the default conspicuous and makes --help show the
correct default behavior.

Signed-off-by: Mike Miller <mtmiller@ieee.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make vpnc-script mandatory.

Things won't work without it, and it will also help to make sure packagers
notice that it's needed.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Don't attempt to configure Legacy IP address on tun device.

This was only setting the Legacy IP address and not IPv6, and it wasn't
setting up any routes or nameservers. It wasn't even setting a *netmask*,
so wasn't even useful in the simple case of a VPN serving a single network
range. I can't think of a single case in which it was actually useful.

This is my response to the patch from Stanislav Sedov which makes the IP
configuration code work on FreeBSD 10. The tun code is a big enough mess
of OS-specific ifdefs already; I don't want it getting even worse, so let's
just rip this bit out.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Don't leave stray zlib in $LIBS

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Attempt to build against OpenSSL without pkg-config

If we insist on using --with-openssl to do that, it looks for (and
builds) a static library. That's intended for use with a locally-built
OpenSSL source tree. For systems like FreeBSD which lack pkg-config for
an otherwise normally-installed dynamic OpenSSL library, we need to cope
the same way as we do with pkg-config-less zlib.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove out of date openconnect.html

Somewhat overdue...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Cope with ancient autoconf by defining $(htmldir) and $(localedir) manually

Otherwise you can't build from git on RHEL5, which has autoconf 2.59

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Include <string.h> in library.c

Don't know how this escaped giving us a warning before...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Really disable static library when appropriate

We need the AC_PROG_LIBTOOL to occur *after* AC_DISABLE_STATIC, or it
doesn't work. And the old comment about having to be before the
conditional NLS bits was probably (hopefully) obsoleted by commit
b976ecb0 which rewrote all that.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use autoconf's standard $(htmldir) and make everything relative to it

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Install HTML docs under $(docdir)/html

Signed-off-by: Mike Miller <mtmiller@ieee.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Invoke vpnc-script with "pre-init" to load tun module if necessary

Shift the os-specific tun setup out into a separate function, just because
it declares local variables and the pre-init script call is now happening
before that in the code block.

Clean up script invocation a little too, and fix the fact that we'd run the
script with "reconnect" reason even if there wasn't a script at all.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.16

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix system detection for GNU/kFreeBSD and GNU/Hurd

Define the same library features for all GNU/* environments.  Also use
$host_os for system tests.

Signed-off-by: Mike Miller <mtmiller@ieee.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix up the library documentation in openconnect.h a little.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix memcpy-less DTLS RX so it really doesn't use memcpy().

It was receiving into a preallocated packet... then using queue_new_packet()
on that buffer which would allocate and copy to a *new* packet. Doh!

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove getmsg() on Solaris and use read() like everyone else.

As long as we put the file descriptor into "message-discard" mode with
the I_SRDOPT ioctl, it'll behave like every other OS and only return
one packet at a time even if more would fit in the buffer.

The MOREDATA flag doesn't mean what we thought it did, so getmsg() has no
efficiency advantages, and we're better off keeping it simple.

Also fix a bug introduced for script_tun mode by commit 337cf1a7.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix compiler warning about char signedness in buffer pointer

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Plumb interface for IPv6 with I_LINK ioctl we do for Legacy IP

This fixes the inconsistency noted in commit 5f873b34 — that we plumb the
interface from openconnect itself for Legacy IP, but use 'ifconfig' in the
vpnc-script to set it up for IPv6. Which has the potential to leave a stale
interface lying around if openconnect exits uncleanly.

Signed-off-by: Kazuyoshi Aizawa <admin2@whiteboard.ne.jp>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix memory leak of zlib streams on CSTP reconnect

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix memory leak of CSTP deflated packets, and resend current pkt on reconnect

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Eliminate memcpy() for incoming packets from DTLS

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Eliminate memcpy() for outgoing packets from tun device

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use I_LINK instead of I_PLINK on Solaris

This should avoid leaving stale tunnel devices around, because they'll
automatically go away when the fd gets closed.

This is only for Legacy IP though; We are still plumbing for IPv6 in the
vpnc-script, which is weird and inconsistent. If only I could work out
how to do it in tun.c like we do for IPv4...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Clean up man page a little

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

IPv6 testing coverage now complete; OSX works too

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update IPv6 testing status. {Open,Net,Dragonfly}BSD are now known to work.

As well as Linux, FreeBSD and Solaris/OpenIndiana which were already tested.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix GNUism in www/Makefile.am

Signed-off-by: Stuart Henderson <stu@openbsd.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix typo

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Print error when write() to tun device fails.

This happens on OpenBSD when writing IPv6 packets, for some reason.
Silent failure is not recommended; much better to bitch about it.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Before using libproxy without pkg-config, check it actually builds.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix potential crash in processing libproxy results.

Oops. Helps if we start reading the array at element zero.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Refer to mail.html in usage() output

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Refer to vpnc-script.html when invoked with no --script argument

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Clean up vpnc-script web page to make it clearer

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.15

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add uninstall rules for translations

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Call bindtextdomain() to ensure that translations are found in $(prefix)

We may be installing to a location that libintl doesn't search by default.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use $(localedir) for installing translations

The $(localedir) variable is provided for us by autoconf; no need to make
it up for ourselves.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use getmsg() intead of read() on Solaris tun device

On Solaris, a read from the tun device can return parts of multiple
packets, and there's no safe way to tell where one ends and the next
starts. Use getmsg() instead, which will only return one packet.

[dwmw2: Mangled a little to cope with script_tun mode and simplify loop]
Signed-off-by: Kazuyoshi Aizawa <admin2@whiteboard.ne.jp>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update help/mail page to try to encourage people to use the list more

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add Developer's Certificate of Origin to contribute web page

Best to spell this out explicitly.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix broken line to non-existent compatibility.html

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Tag version 3.14

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add PGP signature information to changelog and download web pages

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add tarball signing to Makefile

I managed to screw up the 3.13 signature doing it manually; the .asc file
contained a copy of the tarball data rather than being *just* the signature.

Add it to the Makefile and that should stop me screwing it up later.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update Dutch translation

It was at 100% until I added the library version warning; it was a shame
to screw that over just before the release so thanks Arjan for translating
the new warning.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update translations from Transifex

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add upload-pot make target

It happens automatically too, but sometimes it's useful to do it immediately,
for instance when preparing a release...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add sanity check that libopenconnect matches the openconnect executable

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Move openconnect to sbin

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix HTML converter output in out-of-tree builds

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Build version.c correctly in out-of-tree builds

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Avoid use of $(wildcard) in version.c dependencies

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Don't remove version.c in distclean

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix GNUism in dependencies for version.c

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Add OpenIndiana to supported platform list

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix Solaris/OpenIndiana warning: no previous declaration for 'local_strcasestr'

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove unneeded inclusion of <arpa/inet.h> from cstp.c and mainloop.c

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix OpenBSD build warning when printing off_t

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Remove all _xxx_SOURCE macros from source, do it in configure.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix NetBSD ctype warnings.

We have to cast to int via unsigned char. Ick.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix GNUism in po/Makefile.am handling of $(LINGUAS)

We can't use $(shell...). Make the configure script do it instead.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix GNUism in Makefile.am handling of NODISTHOOK

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Attempt to find zlib if no pkgconfig for it

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Make version.sh find git metadata only for openconnect itself, not parent dirs

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Drop $(GETTEXT_PACKAGE) and just use $(PACKAGE)

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Use AC_LINK_IFELSE to check for working NLS support

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Fix build with -ansi and without optimisation.

strdup(), strcasecmp(), vsyslog(), and other things need feature macros
defined. For some reason this only bites when optimisation is disabled.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>