Import translations from GNOME

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Update changelog

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
dtls: Fix dtls_pkt heap overflow (CVE-2013-7098)

Each time openconnect (re)establishes a CSTP connection, it reinitializes
vpninfo->actual_mtu from the X-{CSTP,DTLS}-MTU headers provided by the
gateway.  dtls_mainloop() uses the CURRENT value of vpninfo->actual_mtu
as an upper limit when reading a packet, but it used the ORIGINAL value
of vpninfo->actual_mtu when allocating the dtls_pkt buffer.  So if the
original value was smaller than the current value, it is possible to
overwrite a part of the heap with packet data.

This probably would not happen under normal circumstances, but it may
happen if a malicious person gained administrative access to the VPN
gateway, or if a user was tricked into connecting to a bogus gateway.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Change Transifex hostname

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Tag version 5.02

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
library: Use named constants for process_auth_form() return value

Currently we have 3 valid results, and we're about to add a fourth.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
main: Rename process_auth_form() to avoid conflict with library

Since we're still including openconnect-internal.h in main.c, it isn't
possible to use function names that overlap with internal library
symbols.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Create a common process_auth_form() wrapper function

This will be used to show/hide options based on the authgroup setting.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
auth: Remove outdated comment for parse_auth_choice()

We do offer <select> choices to the user (and have for some time).

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
auth: Introduce free_opt() helper function

This frees the name/label/value (as appropriate) and fixes a potential
leak in parse_auth_choice().

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Change oc_form_opt_select->choices to a pointer array

This will allow the library to store internal data at the end of each
oc_choice struct, and potentially at the end of the oc_form_opt_select
struct as well.

This change breaks the public API.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
auth: Provide information on which auth choice is currently selected

In XML POST mode, the gateway keeps track of which authgroup is selected.
Provide this information to the UI so that the interface can be rendered
correctly.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
process_auth_form: Add code to support NEWGROUP return status from UI

In order to support refreshing the <opaque> data (XML POST) or the
secondary_* fields (non XML POST) on the auth form, it is necessary for
the process_auth_form() callback to return to libopenconnect to refresh
the form fields whenever the user changes the value of a <select>
dropdown.

This change should not break existing implementations.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
auth: Parse second-auth-related properties from the auth form

Add new fields/flags to the oc_form_opt and oc_choice structs.

Note that it isn't possible to add private fields at the end of
oc_form_opt, because the layout of oc_form_opt_select depends on the
length of oc_form_opt.  So we will add a publicly visible flags
field (which also supports internal flags) and reserve space for future
expansion.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
auth: Hide unused form fields based on the selected authgroup

Non-aggregate-auth servers have limited support for customizing the login
form based on which authgroup is currently selected.  Flag the appropriate
fields as OC_FORM_OPT_IGNORE based on these attributes:

  <input second-auth="1"> (for text/password fields)

  <option                 (for authgroup options)
          second-auth="1"
          secondary_username="foo"
          secondary_username_editable="true"
          noaaa="1" >

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
main: Avoid infinite "303 See Other" loops on certificate-only authgroups

Since we are now caching the authgroup selection, it is possible to
receive a form from the server that skips all user prompts.  If the
selected authgroup is set up for certificate auth only (no l/p) and the
client certificate is not valid, the server will render a new form which
shows only the authgroup dropdown.  Since our CLI caches this response,
we need to make sure it doesn't keep resubmitting the same response over
and over again.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Bump API version to 3.0 and document changes

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Unconditionally redirect CSD stdout to stderr

CSD output breaks --cookieonly, so let's make a rule that
openconnect_obtain_cookie() will never print to stdout.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
ssl: Set FD_CLOEXEC on all sockets

It was recently discovered that open CSTP sockets were being inherited
by the tunnel script.  Use FD_CLOEXEC so this no longer happens.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
www: Update changelog

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>