Fix GnuTLS 2.x build

Commit c7077b96b ("Do not abort when GnuTLS reports unclean shutdown")
introduced a build failure for GnuTLS 2.x which lacks the
GNUTLS_E_PREMATURE_TERMINATION error that we check for. Instead, it
returns GNUTLS_E_UNEXPECTED_PACKET_LENGTH.

Since the offending server turned out not to be an AnyConnect server at
all in the end, gracefully handling the unclean SSL shutdown probably
isn't strictly necessary — although it remains a good idea on general
principles. But it's not *so* important that I'm going to jump through
hoops to do it even for users who are still using GnuTLS 2.x.

So just put the check inside #ifdef GNUTLS_E_PREMATURE_TERMINATION, and
if we later find an *AnyConnect* server which displays this behaviour and
requires us to cope with it, we can find a better solution. Which might
just be to deprecate GnuTLS 2.x entirely... ☺

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Remove W3C icons from web pages

Don't embed links to externally hosted icons in local documentation.

Signed-off-by: Mike Miller <mtmiller@ieee.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
version.sh: respect GIT_DIR

This change allows version.sh to work correctly when checked out
in an external work tree, as for example is done by Homebrew.

Signed-off-by: Jay Soffian <jaysoffian@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Allow libtoolize to be specified via environment variable

On OS X, libtoolize is known as glibtoolize. Allow this to be
specified via an environment variable so that autogen.sh need
not be modified to build.

Signed-off-by: Jay Soffian <jaysoffian@gmail.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Fix 'missing initializer' warning on Solaris/GCC build

Not entirely sure why I can't reproduce locally even when I explicitly add
-Wmissing-field-initializers.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Add autoconf test for functional groff with UTF-8 xhtml output

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
www: Don't ignore groff errors

Since most shells disable pipefail by default, errors parsing the man
page into HTML can be silently ignored.  This results in manual.html
showing a header and a footer, but no content.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
www: Fix missing space on platforms page

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
dtls: Align new-tunnel rekey behavior with Cisco clients

Cisco clients do not appear to send a new DTLS master secret; they just
re-handshake every <n> minutes according to the gateway's rekey interval.
Change openconnect so that it only sets the master secret once upon
creation of the library instance, not in cstp_reconnect().  This also
fixes several other issues:

 - Changing the DTLS master secret on sessions that have rekeying disabled
   (because (last_rekey + rekey < time(NULL) + 300) is pretty much always
   true if rekey == 0)

 - Failing to force a DTLS rehandshake after sending a new master secret
   through a CSTP reconnection request, if DTLS uses REKEY_SSL

 - Incorrectly bumping dtls_times.last_rekey on any successful CSTP
   reconnection

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
cstp: Make cstp_reconnect() static again

This function was originally exported to to support rekeying from dtls.c,
but the DTLS code no longer needs a way to force CSTP reconnections now.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
android: Build ARM with -march=armv7-a

This will be required to use the hand-optimized AES implementation in
nettle 2.7.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
android: Upgrade nettle from v2.6 to v2.7

This is required to support GnuTLS 3.2.12.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
android: Update GnuTLS to 3.2.12

This is primarily intended to address CVE-2014-0092 (certificate
validation bypass).

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
java: Add java/ directory to release tarballs

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Require autoconf 2.62+ to build from git

This provides AC_PATH_PROGS_FEATURE_CHECK.

autoconf 2.62 was released in 2008 so it should be installed on most PCs
by now.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Use AC_PATH_PROGS_FEATURE_CHECK to test groff usability

Using the standard AC_ macro provides a consistent way for users to
override the groff name/path, if necessary.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Make pot file depend on version.sh, not Makefile

It will change when @VERSION@ changes, but other than that we shouldn't
need to rebuild it every time the Makefile changes. Otherwise it ends up
rebuilding itself when LINGUAS changes (because we use autoconf to process
that since not everyone uses GNU make).

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Remove obsolete -DNO_BROKEN_DTLS_CHECK from Android build

We removed this in commit a899e355 ("Check for broken OpenSSL versions at
configure time"). We could add --without-openssl-version-check to the
configure flags to restore the behaviour, but since we build with GnuTLS
anyway it doesn't seem necessary.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Consolidate into a single top-level .gitignore file

The ones in the java/ and android/ directories were being included in the
release tarballs. Easier just to merge into one than filter them out.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Remove unneeded symbols from linker map

Now that we do all the real work in the library, we don't need to export
most of this.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>