Revert "auth: Temporarily disable XML POST if an authgroup dropdown exists"

This reverts commit f2774911bc2d94e3130a4a10079c5cb56e57a2b2.

Now that the new library API allows callers to change the authgroup via
NEWGROUP, we no longer need this workaround.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Unconditionally redirect CSD stdout to stderr

CSD output breaks --cookieonly, so let's make a rule that
openconnect_obtain_cookie() will never print to stdout.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
ssl: Set FD_CLOEXEC on all sockets

It was recently discovered that open CSTP sockets were being inherited
by the tunnel script.  Use FD_CLOEXEC so this no longer happens.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
gnutls: Remove unused local variable

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Introduce new helper functions for cancel_fd checking

The same code shows up in 12 places, so we'll move it into a common
location.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Rename cancel_fd to cmd_fd

Applications which use libopenconnect may need to interrupt the mainloop
for a couple of reasons:

 - Cancel/disconnect
 - Force reconnect: in case the IP configuration changed
 - Retrieving bytecounts or other internal information

The cancel_fd mechanism provides a convenient way to send these commands,
but first we need to make it more generic (while preserving backward
compatibility).

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Add new openconnect_setup_cmd_pipe() call

Most callers will use a simple nonblocking UNIX pipe as their cmd_fd,
so provide a convenience function for creating it.  Also, libopenconnect
will take care of cleaning up pipes created in this manner when the
library instance is freed.

Pipes created through this function will be able to send new commands,
such as "reconnect".  Pipes passed in via openconnect_set_cancel_fd()
can only be used to cancel the connection, for backward compatibility.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Add new helper functions to support cmd_fd feature

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Move signal handling out of mainloop

In order to make the mainloop a reusable library function, it should not
take over any POSIX signals.  Handle the signals in main.c instead, and
use the cmd_fd mechanism to tell the mainloop to exit.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
mainloop: Convert vpn_mainloop() into a library function

Rename to openconnect_mainloop() and allow the caller to specify
reconnection parameters.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
dtls: Add dtls_close() helper function

This provides an easy way to clean up or shut down DTLS.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
mainloop: Add OC_CMD_PAUSE operation

This forces the connection to immediately drop, and
openconnect_mainloop() to return with status 1.  The caller may
re-invoke the mainloop when he wants to re-establish the connection,
assuming the idle/session timeouts have not expired.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
main: Introduce xstrdup() function

This will abort on error, instead of causing a segfault.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
tun: Export setup_tun() functionality

Create three new setup_tun() library functions:

    openconnect_setup_tun_device - create a tun device
    openconnect_setup_tun_script - pass traffic through a script
    openconnect_setup_tun_fd - pass traffic through an existing fd

The latter is needed to support Android's VpnService API.

In all cases, the caller no longer needs to directly manipulate
vpninfo->vpnc_script or vpninfo->script_tun.  The former is treated as
a standard caller-allocated, library-freed string.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Move vpninfo default settings into library

This allows main.c to call openconnect_vpninfo_new() to create the
library instance.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Check for failed allocations in openconnect_vpninfo_new()

This is probably fatal anyway, but it is better to fail in a predictable
manner.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
dtls: Export setup_dtls() function

This is an optional call; the default is "no DTLS."

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
cstp: Export make_cstp_connection()

Just rename it and add it to openconnect.h.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Move the mainloop guts into libopenconnect

Now the standalone openconnect binary only consists of main.c and xml.c.

Unfortunately openconnect_CFLAGS still needs to include the whole kitchen
sink, until we can remove openconnect-internal.h as a dependency.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
library: Update openconnect.pc.in

Add openssl + gnutls to Requires.private for the ssl_library=both case.
Add liboath to Requires.private.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>