dtls: Add dtls_close() helper function and call it on library cleanup

This provides an easy way to clean up or shut down DTLS.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
mainloop: Add OC_CMD_PAUSE operation

This forces the connection to immediately drop, and
openconnect_mainloop() to return with status 1.  The caller may
re-invoke the mainloop when he wants to re-establish the connection,
assuming the idle/session timeouts have not expired.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
main: Introduce xstrdup() function

This will abort on error, instead of causing a segfault.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
tun: Export setup_tun() functionality

Create three new setup_tun() library functions:

    openconnect_setup_tun_device - create a tun device
    openconnect_setup_tun_script - pass traffic through a script
    openconnect_setup_tun_fd - pass traffic through an existing fd

The latter is needed to support Android's VpnService API.  If a fd is
passed in, the library will not close it.

In all cases, the caller no longer needs to directly manipulate
vpninfo->vpnc_script or vpninfo->script_tun.  The former is treated as
a standard caller-allocated, library-freed string.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Move vpninfo default settings into library

This allows main.c to call openconnect_vpninfo_new() to create the
library instance.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Check for failed allocations in openconnect_vpninfo_new()

This is probably fatal anyway, but it is better to fail in a predictable
manner.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
dtls: Export setup_dtls() function

This is an optional call; the default is "no DTLS."

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
cstp: Export make_cstp_connection()

Just rename it and add it to openconnect.h.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Move the mainloop guts into libopenconnect

Now the standalone openconnect binary only consists of main.c and xml.c.

Unfortunately openconnect_CFLAGS still needs to include the whole kitchen
sink, until we can remove openconnect-internal.h as a dependency.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Update openconnect.pc.in

Add openssl + gnutls to Requires.private for the ssl_library=both case.
Add liboath to Requires.private.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
tun, cstp: Don't exit() on failure

These files are part of a library now so they should report errors back
to the caller.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Free zlib state

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
cstp: Clean up split include/exclude/DNS lists when freeing vpninfo

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Add get/set functions for servercert, ifname, reqmtu

This allows all connection parameters used by nm-openconnect to be set
through the library API.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Move IP information into a public struct

Library users will want to know IPs, DNS servers, etc. so rename the
relevant structs and move them into openconnect.h.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Make vpn_option a public struct

Rename vpn_option to oc_vpn_option and move it into the public header
file.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Export VPN configuration info to callers

Make a new library call to obtain IP configuration and X-{CSTP,DTLS}-*
parameters.  Use the new call from main.c instead of directly accessing
the private vpninfo elements.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Add protect_socket callback

In some situations (e.g. Android VpnService) it isn't possible to add a
routing table entry for the VPN gateway's IP.  Instead, it is necessary
to bind each individual file descriptor used for the tunnel to the default
interface before passing traffic on it.  Add an optional protect_socket
callback for this purpose.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Add support for mobile headers

Cisco's Android and iOS clients send a couple of extra HTTP headers[1]
which are necessary to enable a limited "mobile CSD" mode on the
gateway[2].  Add an API allowing the caller to specify these headers.
Also, skip downloading the CSD trojan on mobile devices, as it won't
run anyway.

[1] http://lists.infradead.org/pipermail/openconnect-devel/2013-February/000890.html
[2] http://lists.infradead.org/pipermail/openconnect-devel/2013-March/000989.html

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Add openconnect_set_xmlpost() to support different CSD modes

In certain configurations, XML POST mode can impact the use of
CSD/Hostscan.  Some gateways are set up to refuse the CSD results if
XML POST is not being used; but in other cases supporting XML POST
on the client side can require a custom CSD wrapper script which isn't
needed for the non-XML-POST case.  So we'll allow the caller to decide
which mode to use.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>