jni: Sync jni.c and LibOpenConnect.java

Remove unused setupFD() jni stub.  Add missing setPFS() Java declaration.
Add missing setReqMTU() jni stub.  Remove unnecessary "!!" on jboolean.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
jni: Change setPFS() to use a boolean argument

This makes it more consistent with setXMLPost().

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
man: Add hints on using --pfs option

I ran "openconnect --pfs" to connect to 37 semi-randomly chosen servers:

  33 servers failed with a TLS fatal alert
   3 servers successfully negotiated the connection
   1 server no longer existed

According to Cisco, PFS support is about a year old in the 9.1 branch[1],
two years old in the 8.4 branch[2], and absent in 8.6/9.0.

So, if this means that some ~90% of users will not have much luck with
--pfs, we can at least offer some information to help their system
administrators configure it.

[1] http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/release/notes/asarn91.html#pgfId-685480o
[2] http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/release/notes/asarn84.html#pgfId-580804

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Export openconnect_set_pfs() and bump API version to 3.3

v5.99 advertises API version 3.2.  This function was present in v5.99 but
not exported.  So in order to use this symbol, the caller should test for
API version >= 3.3.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
main: Use openconnect_set_pfs() instead of touching vpninfo->pfs

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Add "new library function checklist"

This process keeps getting more complex, so let's add a checklist that
documents all of the steps in one central place.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
www: Update changelog

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
android: Update to GnuTLS 3.2.15

This fixes GNUTLS-SA-2014-3 / CVE-2014-3466 (ServerHello memory
corruption vulnerability), and updates gnulib to fix an Android build
problem.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Tested-by: 1000+ Android users
tun: Export os_shutdown_tun() to library callers

This lets the caller safely exit after the connection has been paused,
instead of having to re-enter the mainloop, reconnect, and then send
OC_CMD_CANCEL.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Add openconnect_set_dpd()

Some users on unstable connections have requested the ability to lower
the local DPD timeout, so the VPN reconnects more quickly if the
connection hangs.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
main: Refactor signal handling

Eliminate the SIGUSR1/SIGUSR2 debug logging behavior and introduce new
behavior for the following signals:

    SIGINT: Disconnect and logoff, run vpnc-script accordingly
    SIGHUP: Disconnect and run vpnc-script (cookie can be re-used)
    SIGTERM: Just die. Disconnect without logoff, no vpnc-script
    SIGUSR2: Reconnect to server immediately as if DPD triggered.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Change most PRG_TRACE prints to PRG_DEBUG

Use PRG_TRACE for the really noisy (and performance-impacting) log
prints, like packet info and "No work to do" polling.  Use PRG_DEBUG for
other verbose-but-infrequent debug output.  Change the command line
parsing so that "-v" enables PRG_DEBUG and "-vv" enables PRG_TRACE.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>