Fix NetBSD compile warnings with isspace()

As mentioned in the comment in openssl.c, we need to cast the arguments
for ctype functions first to (unsigned char) and then to (int) to make
NedBSD happy.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Fix UTF-8 handling of config file name

If we're going to convert the filename *from* UTF-8 when opening it, then
we really ought to be convert it *to* UTF-8 first. This would have shown
up if invoking openconnect in a non-UTF-8 locale, with a non-ASCII
filename.

On POSIX systems this whole thing is a no-op, since converting from any
arbitrary 8-bit charset to UTF-8 and back again effectively does nothing.

However, on Windows the convert_arg_to_utf8() function doesn't just work
on the input string; it looks aside with GetCommandLineW() to find the
*original* text on the command line, and uses that instead. So we really
do have to do the double "conversion" — even when it's simply converting to
UTF-8, *immediately* converting back again (in fopen_utf8()), and *never*
using it again.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Use O_BINARY for xmlconfig file

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Silence iconv() compiler warnings on systems which expect (const char **)

Some systems expect the src argument to be const, so just cast it to (void *)
to shut them up.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Update translations from GNOME
Fix SOCKS GSSAPI auth to send final token client->server if needed

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Fix SOCKS SSPI auth to send final token client->server if needed

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Fix SSPI SOCKS auth crash on double-cleanup

Using the state for this is horrid; we should make it idempotent like
the GSSAPI one is.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Fix endless loop when automatic NTLM auth fails

We never *do* actually fall back from automatic to manual NTLM auth since
our criteria for using each are mutually exclusive. So arguably we could
simplify things somewhat and just set the state to AUTH_FAILED if the SSO
version fails. But let's preserve the option to fall back later, if we do
start prompting for a password on demand.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Fix ntlm_auth handling to accept AF in auth reply

This is what it should have been giving all along, if it weren't for
Samba bug #10691. Also report the error better if we do get one.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Minor SSPI fixes

When using NTLM, the payload sometimes does get encrypted, so preserve it.
And after DecryptMessage() don't free the buffer. It'll have been decrypted
in-place.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Update translations from GNOME

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Convert all args using GetCommandLineW() on Windows

Checking for ? isn't enough — some characters are 'loosely' translated on
the 8-bit command line judging by https://bugzilla.redhat.com/1124436#c2

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Be consistent about spelling of cancel{l,}ed

The source uses 'cancelled', and the en_US file can be 'canceled' if that's
the way they prefer it.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
For HOTP tokens increment vpninfo->token_time in do_gen_hotp_code()

This allows us to do a lock/increment/unlock cycle in one place.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Allow whitespace at end of HOTP and TOTP tokens

When we're reading them from a file, in particular, we want to tolerate
having a newline at the end.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Allow HOTP/TOTP secrets to be specified in hex form

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Remember what form we got the HOTP secret in

We'll care about this shortly...

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Add openconnect_set_token_callbacks() API

This allows the application to lock the file (or other) storage when
a token is about to be generated, then to unlock it and write the new
counter back to the file when we're done.

This gives us a clean way to use HOTP tokens safely.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>