Simplify handling of supporting_certs

Dispense with the "if supporting_certs is non-NULL then use it else there's
a single certificate in cert" logic. It's complex and pointless. We can live
with an extra allocation in the "fast path", for $DEITY's sake.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Keep free_supporting_certs array to remember which to free

This replaces the 'certs_to_free' variable, which was only capable of
specifying the first N certs.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Simplify extra_certs handling w.r.t. assign_privkey()

With the free_supporting_certs[] array, there's no need to pass
extra_certs[] in to the GnuTLS 2 version of assign_privkey() just to
let it remove the certs that it wants to steal. Instead, remove them as
we *find* them and put them into the supporting_certs[] array, and mark
them as "to be freed".

By keeping the free_my_certs[] array, this also fixes a bug in the
GnuTLS 2 code where we would end up freeing a cert which was obtained
by gnutls_certificate_get_issuer(), which we are *supposed* to treat as
being constant.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Include supporting certificates from PKCS#11 tokens

Sometimes, we really need to include the supporting CA on the wire, and
it is only found in the PKCS#11 alongside the user's own certificate.

Seen with the Belgian eID devices, and a server which didn't appear to
know the 'Citizen CA' for itself, but did trust 'Belguim Root CA2'.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Make openconnect_set_hostname() clear vpninfo->peer_addr, use it more often

Based on a patch from Kevin Cernekee.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
library: Remove declaration for nonexistent openconnect_get_vpn_name()

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Fix const warnings in stoken code with NLS disabled

The gettext() function will return a non-const 'char *' pointer, and we
should have a cast in the dummy version of the _() macro to do the same.
Otherwise, we get:

../auth.c: In function 'prepare_stoken':
../auth.c:907:15: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
../auth.c:915:14: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
../auth.c:922:14: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
../auth.c:929:14: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]

Based on a patch from Kevin Cernekee.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
auth: Remove bogus comment in parse_form()

This function never actually returns 1.

[dwmw2: So remove the comment entirely. Zero for success or -ERR is normal
        and warrants no comment at all.]

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
android: Update Makefile to use NDK r9b

NDK gcc 4.7 is now deprecated, so let's recommend NDK r9b + gcc 4.8.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
android: Add .gitignore file

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
android: Honor $TMPDIR when writing CSD script

Android doesn't have /tmp, so honor $TMPDIR if the caller sets it to
an alternate location.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
android: Bump gmp up to version 5.1.2

binutils 2.23.2, which is part of the arm-linux-androideabi-4.8
toolchain in NDK r9, fails to compile gmp without the following
workaround from v5.1.2:

    * mpn/arm/udiv.asm: Change spacing to work around binutils bug.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
main: Move username/password/authgroup vars into main.c

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
auth: Add <group-access> node to XML POST initial request

This ensures that we get the form and <opaque> data corresponding to the
authgroup in use.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
http: Fix NULL vpninfo->hostname pointer on redirect

Commit 1fe3f43f08 (Make openconnect_set_hostname() clear
vpninfo->peer_addr, use it more often) broke NEWHOST redirects:

    $ ./openconnect -v vpn.ufl.edu
    POST https://vpn.ufl.edu/
    Attempting to connect to server 128.227.166.118:443
    SSL negotiation with vpn.ufl.edu
    Matched DNS altname 'vpn.ufl.edu'
    Connected to HTTPS on vpn.ufl.edu
    Got HTTP response: HTTP/1.0 302 Temporary moved
    Content-Length: 0
    Cache-Control: no-cache
    Pragma: no-cache
    Connection: Close
    Date: Tue, 31 Dec 2013 19:43:47 GMT
    Location: https://ctx36-vpn-asa5500-1-g10-1.ns.ufl.edu/
    HTTP body length:  (0)
    POST https://(null)/
    Segmentation fault

Fix this by populating vpninfo->hostname with the correct value.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
auth: Save a pointer to the group_list dropdown option if it exists

This will eventually be used to implement the NEWGROUP feature.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
auth: Temporarily disable XML POST if an authgroup dropdown exists

Properly supporting this configuration requires a library API change.
Skip it for now so we can make a bugfix release.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
dtls: Don't send packets to a dead socket during rekeying

vpninfo->{dtls_fd,dtls_ssl} are typically invalid when dtls_restart()
returns, as the new handshake has not completed at that point.  Under some
circumstances, FD_CLR() may be called on a negative fd, resulting in a
crash:

    (gdb) bt
    #0  0x00007f749201df77 in __GI_raise (sig=sig@entry=6)
        at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
    #1  0x00007f74920215e8 in __GI_abort () at abort.c:90
    #2  0x00007f749205b4fb in __libc_message (do_abort=do_abort@entry=2,
        fmt=fmt@entry=0x7f749216cf10 "*** %s ***: %s terminated\n")
        at ../sysdeps/unix/sysv/linux/libc_fatal.c:199
    #3  0x00007f74920f908c in __GI___fortify_fail (msg=<optimized out>,
        msg@entry=0x7f749216cea7 "buffer overflow detected") at fortify_fail.c:37
    #4  0x00007f74920f8020 in __GI___chk_fail () at chk_fail.c:28
    #5  0x00007f74920f8fd7 in __fdelt_chk (d=<optimized out>) at fdelt_chk.c:25
    #6  0x00007f749388b86c in ?? ()
    #7  0x00007f749388e271 in ?? ()
    #8  0x00007f74938883a2 in ?? ()
    #9  0x00007f7492008de5 in __libc_start_main (main=0x7f7493887010, argc=5,
        ubp_av=0x7fff01f1fe98, init=<optimized out>, fini=<optimized out>,
        rtld_fini=<optimized out>, stack_end=0x7fff01f1fe88) at libc-start.c:260
    #10 0x00007f74938885e3 in ?? ()

So we should return back to the mainloop instead of trying to send out
queued packets over DTLS.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
www: Fix quoting in v5.01 changelog

Using "&lt;" instead of "&amp;lt", the entry renders as "Attempt to
handle in aggregate auth mode."  Which does not make any sense.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
main: --cookie-on-stdin doesn't work with ocserv cookies

ocserv's cookie strings are typically much longer (512 characters) than
the cookies generated by a Cisco ASA (<100 characters).  So when
network-manager-openconnect tries to connect to ocserv, the connection
will abruptly drop, and this will show up in syslog:

    NetworkManager[717]: <info> VPN plugin state changed: starting (3)
    NetworkManager[717]: <info> VPN connection 'ocserv' (Connect) reply received.
    openconnect[23054]: Attempting to connect to server 192.168.0.1:443
    openconnect[23054]: SSL negotiation with 192.168.0.1
    openconnect[23054]: Connected to HTTPS on 192.168.0.1
    openconnect[23054]: VPN service unavailable; reason: <unknown>

Quick fix is to allow up to 1024 bytes + NUL termination for the cookie
string.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>