For release builds, the tarball contents still don't have the default
name; we need to explicitly state that it's openconnect-%{version}

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

It won't work in someone else's master branch if they've forked the repo.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Fixes building from distribution tarball on win32/mingw.

Makefile.am: Include win32-ipicmp.h and openconnect.ico in tarball

Signed-off-by: Justin Kendrick <justin@kendrick.tech>

Signed-off-by: Randy Moss <kasaxet794@homedepinst.com>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

This makes it possible for a privileged vpnc-script pre-init hook to
create the tun device before an unprivileged openconnect process tries
to use it.

Signed-off-by: Steven Luo <steven@steven676.net>

This removes dtls-psk from XFAIL in centos8 as it is no longer applicable,
adds crypto policies script from missing targets, and checks for both
devices prior to adding routes in dtls-psk.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

Previously a change in Fedora release would result to several weeks or
months of broken CI. Fix on a specific version so that the CI is stable,
even if that comes at the cost of a manual update of the fedora CI.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

This also ensures that we don't take into account the state of the
algorithm (e.g., marked as insecure), because it does matter for
checking whether the keys match.

Resolves: #189

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

.gitlab-ci.yml: fixed failing tests and update to fedora 33

Closes #189

See merge request openconnect/openconnect!128

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

…' into 'master'

explain why --form-entry shouldn't be used for passwords

See merge request openconnect/openconnect!123

Fingerprint-checking monkey-patch for SSLSocket needs to be refined to work with Python 3.7+

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

See https://gitlab.com/openconnect/openconnect/-/merge_requests/120#note_356905574

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

fix tncc_emulate.py with Python 3.7+

Closes #152

See merge request openconnect/openconnect!120

…onnection

In order to write OpenConnect wrapper scripts that decouple the
authentication phase and tunnel phase, while caching authentication cookies,
we need to be able to reliably distinguish errors from invalid/expired
cookies from other errors. This makes that possible.

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

…'master'

Consistent handling of initial connection errors

See merge request openconnect/openconnect!133

…nnect, since they will abort if new addresses are sent by the server.

* GlobalProtect:
  - Supported and used by official clients (POST /ssl-vpn/getconfig.esp with preferred-ip form field).
  - GlobalProtect servers often give different IP addresses on reconnect if this mechanism is *not* used,
    so this mechanism is necessary.
  - Same mechanism appears to exist for IPv6 (preferred-ipv6) and was added to OpenConnect in
    d6db0ec, even though IPv6 support is not yet complete.
* AnyConnect:
  - Not (yet) supported by ocserv
  - It appears that *some* AnyConnect server will try to provide the IP address provided in the X-CSTP-Address
    *request* header along with the CONNECT request, but other servers appear not to
  - This patch reproduces the behavior of GPST: attempt to request same IPv4 and IPv6 addresses on reconnect,
    via CONNECT headers.
* Juniper:
  - There does not appear to be any way to provide this using the Juniper NC protocol.
  - No known reports of Juniper servers giving out different IP address on reconnect.

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

…-EINVAL

(see previous commit by David Woodhouse, 24df331, which did this for cstp.c)

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

…in oncp.c and pulse.c as well

Suggested by David Woodhouse: https://gitlab.com/openconnect/openconnect/merge_requests/35#note_169620281

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

… with "real" inet_aton()

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

…on successful connection

As suggested by David Woodhouse (https://gitlab.com/openconnect/openconnect/merge_requests/35#note_163190180)

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

Common code for check_address_sanity()

See merge request openconnect/openconnect!116

…on) for compatibility with ancient cURL

cURL <7.39 doesn't have `--pinnedpubkey` option.  Falling back to insecure connection to CSD server (as we did until
4385272) is the easiest band-aid.

CentOS 7 is affected, as described in https://lists.infradead.org/pipermail/openconnect-devel/2020-July/004886.html

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

…ve it from the PINNEDPUBKEY variable

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

…s' into 'master'

Enable insecure CSD submission for ancient cURL versions

See merge request openconnect/openconnect!125

- dtls-psk is frequently failing; add 1-second wait AFTER tunnel interface appears
- (already merged in !128) CentOS8 now has GnuTLS with client random bug fixed (remove XFAIL_TESTS="dtls-psk")
- (already merged in !128) Fedora 32 needs crypto-policies-scripts package for update-crypto-policies to work

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

It appears that a separate Power Tools repository needs to be enabled for `{uid,socket}_wrapper` in CentOS8.
See https://centos.pkgs.org/8/centos-powertools-x86_64/uid_wrapper-1.2.4-4.el8.x86_64.rpm.html and https://serverfault.com/questions/997896/how-to-enable-powertools-repository-in-centos-8

For softhsm, this should work per nmav: https://gitlab.com/openconnect/openconnect/-/issues/145#note_347864560

The auth-nonascii test, and DSA cert tests, are now failing again, and needs to be disabled.

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

fix CI and coverage

See merge request openconnect/openconnect!134

It is now possible to send an optional platform to the script using the
parameter `--client-os` (defaults to `Windows` if parameter is missing).

We still don't know how the Mac XML looks like so, in case the platform
value is not `Linux`, it will be always defaulted to Windows.

Signed-off-by: Roberto Leinardi <leinardi@gmail.com>

hipreport.sh: Vary emulated report output by platform (Windows vs. Linux)

See merge request openconnect/openconnect!129

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

fix duplicate bitfield constant

See merge request openconnect/openconnect!115

This also fixes the image for coverity to fedora31 to avoid
gcc compatibility issues. The reason for moving to scheduled
runs is that there is a limit to coverity runs per project.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

.gitlab-ci.yml: run coverity weekly with a scheduled run

See merge request openconnect/openconnect!127

Make correct TUNDEV value available to vpnc-script during pre-init

See merge request openconnect/openconnect!122

Apparently some GlobalProtect servers complain about old versions of the client connecting to them, so we should periodically bump up the version number of the client that we emulate.

See https://gitlab.com/openconnect/openconnect/-/issues/176#note_395207613

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

bump emulated GlobalProtect version number

See merge request openconnect/openconnect!131

…/Host Checker failure: log error about this

Suggested at https://gitlab.com/openconnect/openconnect/-/issues/175#note_392561212

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

…e' into 'master'

Juniper unknown forms with action remediate.cgi seem to indicate TNCC/Host Checker failure

See merge request openconnect/openconnect!130