Fix --authenticate crash

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Import translations from GNOME

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Tag version 5.03

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Merge OpenConnect v5.03 bugfix
mention DTLS ciphersuite name

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Added support for GCM ciphersuites (require DTLS 1.2).

The GCM ciphersuites provide several advantages over their CBC counterparts.
They have no issues related to the CBC padding oracle attacks, and furthermore
provide more space for data as they use shorter explicit nonce, shorter MAC
than SHA1, and require no padding.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Enable a padding when sending password, to avoid leakage of password length.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Added --pfs option to force perfect forward secrecy

The PFS option will prevent a leakage of the server long-term key from causing
decryption of all previously exchanged data.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
When selecting TLS protocol options for GnuTLS set the same defaults as in openssl.

This change removes the protocol-weakening options (e.g., the disabling of
secure renegotiation, the removal of ECDHE ciphersuites, and the restriction
to the known to be weak TLS 1.0).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Added openconnect_set_pfs() and its JNI counterpart

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
link to Kevin's android port.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Updated changelog for previous changes.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
android: Add android/ directory to release tarballs

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
cstp: Always restart DTLS after a CSTP disconnect

cstp_reconnect() can get called on its own, e.g. due to a DPD timeout.
Under some circumstances this can cause the DTLS parameters to be
renegotiated.  For instance, start_cstp_connection() sometimes sends a
new master DTLS secret to the gateway.  And Cisco ASAs seem to like
generating new DTLS-Session-ID strings on each reconnect.

If DTLS is not restarted, the client and server will get out of sync and
will not be able to pass data traffic.  The situation is exacerbated by
certain gateway settings, like setting DPD=0 and disabling DTLS rekey,
which may cause the connection to remain in a "living dead" state for
extended periods of time.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
http: Don't retry on user cancellation

We aren't currently checking to see if do_https_request() failed due to
an actual network error or a user cancellation.  So if the library tries
to connect to an unreachable host, and the user hits Cancel before the
operation times out, we will still try falling back to non-xmlpost mode:

    $ ./openconnect 1.2.3.4
    POST https://1.2.3.4/
    Attempting to connect to server 1.2.3.4:443
    ^CSocket connect cancelled
    Failed to connect to host 1.2.3.4
    Failed to open HTTPS connection to 1.2.3.4
    GET https://1.2.3.4/
    Attempting to connect to server 1.2.3.4:443
    ^CSocket connect cancelled
    Failed to connect to host 1.2.3.4
    Failed to open HTTPS connection to 1.2.3.4
    Failed to obtain WebVPN cookie

Add a new check and return the appropriate error code for "user cancelled"
to openconnect_obtain_cookie().

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Add liboath version check

Versions prior to 1.12.0 are missing oath_base32_decode(), resulting in an
error:

      CC     libopenconnect_la-library.lo
    library.c: In function 'set_oath_mode':
    library.c:475:3: error: implicit declaration of function 'oath_base32_decode' [-Werror=implicit-function-declaration]
    library.c:475:3: warning: nested extern declaration of 'oath_base32_decode' [-Wnested-externs]

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>