From nmav at gnutls.org  Sun Dec  1 05:12:14 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sun, 01 Dec 2013 11:12:14 +0100
Subject: [PATCH ocserv 4/4] README: Add info on build dependencies
In-Reply-To: <1385864709-28739-4-git-send-email-cernekee@gmail.com>
References: <1385864709-28739-1-git-send-email-cernekee@gmail.com>
 <1385864709-28739-4-git-send-email-cernekee@gmail.com>
Message-ID: <1385892734.1829.25.camel@aspire.lan>

On Sat, 2013-11-30 at 18:25 -0800, Kevin Cernekee wrote:
> ---
>  README | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> 
> FYI: the "sometimes libopts/Makefile exists, sometimes not" logic
> breaks the distclean and dist targets.  I spent some time messing
> around with it but did not come up with a satisfactory fix.

Thank you. I've applied the patches. Is that due to libopts.m4? Maybe
that should go as a bug report to autogen.

btw. Does the license: accept fix the mobile client connection?

regards,
Nikos




From cernekee at gmail.com  Sun Dec  1 11:15:27 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sun, 1 Dec 2013 08:15:27 -0800
Subject: [PATCH ocserv 4/4] README: Add info on build dependencies
In-Reply-To: <1385892734.1829.25.camel@aspire.lan>
References: <1385864709-28739-1-git-send-email-cernekee@gmail.com>
 <1385864709-28739-4-git-send-email-cernekee@gmail.com>
 <1385892734.1829.25.camel@aspire.lan>
Message-ID: <CAJiQ=7ATN=N612ca7-cy++sVfwE_fZ3OhSqWeMNVsgdESEJBqA@mail.gmail.com>

On Sun, Dec 1, 2013 at 2:12 AM, Nikos Mavrogiannopoulos <nmav at gnutls.org> wrote:
>> FYI: the "sometimes libopts/Makefile exists, sometimes not" logic
>> breaks the distclean and dist targets.  I spent some time messing
>> around with it but did not come up with a satisfactory fix.
>
> Thank you. I've applied the patches. Is that due to libopts.m4? Maybe
> that should go as a bug report to autogen.

It seems like making AC_CONFIG_FILES conditional may be a problem:

AC_DEFUN([LIBOPTS_CHECK], [
  m4_pushdef([AO_Libopts_Dir],
              [ifelse($1, , [libopts], [$1])])
  LIBOPTS_BUILD_BLOCKED=''
  LIBOPTS_CHECK_COMMON(AO_Libopts_Dir)
  AM_COND_IF([NEED_LIBOPTS], [
    INVOKE_LIBOPTS_MACROS
    AC_CONFIG_FILES(AO_Libopts_Dir/Makefile)
  ])dnl

If I try adding libopts/Makefile to AC_CONFIG_FILES in configure.ac so
that we always generate libopts/Makefile to support distclean and
dist, autoconf aborts because it was added twice.

I also noticed that the autogen binary on my system (FC19) generates
*-args files which reference symbols that do not exist in the bundled
libopts, causing a compile error when --enable-local-libopts is used.
So it looks like there is a dependency between the library version and
the autogen version.  This could be a problem for users building the
released tarball sources (with bundled *-args files) against the
libopts system library.

> btw. Does the license: accept fix the mobile client connection?

Yes, I can now successfully connect with both Android and iOS clients.


From dj.ktuli at gmail.com  Mon Dec  2 12:44:30 2013
From: dj.ktuli at gmail.com (Bill S)
Date: Mon, 2 Dec 2013 12:44:30 -0500
Subject: CentOS 6.4 build openconnect with gnutls errors
Message-ID: <CAHXvEG-TLB0338N0uUK6jmYrfagbzW3V5gyowsDTuOM8swdU-A@mail.gmail.com>

I am trying to build openconnect from source to be able to include
gnutls support (the CentOS packages does not include gnutls support,
and therefor will not work with my smartcard).  I've manually built
both gnutls-3.1.17 and nettle-2.5 and used
PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/ to get ./configure to pass
its tests, but when I try to make the binaries, I get the following
results....

[root at wjslaptop openconnect-5.01]# ./configure --with-gnutls
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking build system type... x86_64-unknown-linux-gnu
checking host system type... x86_64-unknown-linux-gnu
checking whether to enable maintainer-specific portions of Makefiles... yes
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
/home/wjs/tools/build/openconnect-5.01/missing: Unknown
`--is-lightweight' option
Try `/home/wjs/tools/build/openconnect-5.01/missing --help' for more information
configure: WARNING: 'missing' script is too old or missing
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
configure: Applying feature macros for GNU build
checking for style of include used by make... GNU
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking dependency style of gcc... gcc3
checking for fdevname_r... no
checking for getline... yes
checking for strcasestr... yes
checking for asprintf... yes
checking for supported compiler flags...  -Wall -Wextra
-Wno-missing-field-initializers -Wno-sign-compare
-Wno-unused-parameter -Werror=pointer-to-int-cast
-Wdeclaration-after-statement -Werror-implicit-function-declaration
-Wformat-nonliteral -Wformat-security -Winit-self
-Wmissing-declarations -Wmissing-include-dirs -Wnested-externs
-Wpointer-arith -Wwrite-strings
checking for socket... yes
checking for inet_aton... yes
checking for __android_log_vprint... no
checking for __android_log_vprint in -llog... no
checking for msgfmt... /usr/bin/msgfmt
checking for functional NLS support... yes
checking for GNUTLS... yes
checking for gnutls_dtls_set_data_mtu... yes
checking for gnutls_certificate_set_x509_system_trust... yes
checking for gnutls_pkcs12_simple_parse... yes
checking for gnutls_certificate_set_key... yes
checking for gnutls_pk_to_sign... yes
checking for gnutls_session_set_premaster... yes
checking for gnutls_pkcs11_add_provider... no
checking for tss library... no
checking how to print strings... printf
checking for a sed that does not truncate output... /bin/sed
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for fgrep... /bin/grep -F
checking for ld used by gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1966080
checking whether the shell understands some XSI constructs... yes
checking whether the shell understands "+="... yes
checking how to convert x86_64-unknown-linux-gnu file names to
x86_64-unknown-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-unknown-linux-gnu file names to
toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for ar... ar
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for mt... no
checking if : is a manifest tool... no
checking how to run the C preprocessor... gcc -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -fPIC -DPIC
checking if gcc PIC flag -fPIC -DPIC works... yes
checking if gcc static flag -static works... no
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports
shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... no
checking if library symbol versioning is available... yes (with
--version-script)
checking for LIBXML2... yes
checking for ZLIB... yes
checking for LIBPROXY... no
checking for libproxy... no
checking for LIBSTOKEN... no
checking for LIBOATH... no
checking if_tun.h usability... no
checking if_tun.h presence... no
checking for if_tun.h... no
checking linux/if_tun.h usability... yes
checking linux/if_tun.h presence... yes
checking for linux/if_tun.h... yes
checking for python... /usr/bin/python
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating openconnect.pc
config.status: creating po/Makefile
config.status: creating www/Makefile
config.status: creating libopenconnect.map
config.status: creating openconnect.8
config.status: creating www/styles/Makefile
config.status: creating www/inc/Makefile
config.status: creating www/images/Makefile
config.status: executing depfiles commands
config.status: executing libtool commands
[root at wjslaptop openconnect-5.01]# make
Making all in www
make[1]: Entering directory `/home/wjs/tools/build/openconnect-5.01/www'
Making all in styles
make[2]: Entering directory `/home/wjs/tools/build/openconnect-5.01/www/styles'
make[2]: Nothing to be done for `all'.
make[2]: Leaving directory `/home/wjs/tools/build/openconnect-5.01/www/styles'
Making all in inc
make[2]: Entering directory `/home/wjs/tools/build/openconnect-5.01/www/inc'
make[2]: Nothing to be done for `all'.
make[2]: Leaving directory `/home/wjs/tools/build/openconnect-5.01/www/inc'
Making all in images
make[2]: Entering directory `/home/wjs/tools/build/openconnect-5.01/www/images'
make[2]: Nothing to be done for `all'.
make[2]: Leaving directory `/home/wjs/tools/build/openconnect-5.01/www/images'
make[2]: Entering directory `/home/wjs/tools/build/openconnect-5.01/www'
groff -t -K UTF-8 -mandoc -Txhtml ../openconnect.8 | sed -e
'1,/<body>/d' -e '/<\/body>/,$d' > openconnect.8.inc
groff: invalid option -- 'K'
usage: groff [-abceghilpstvzCENRSUVXZ] [-Fdir] [-mname] [-Tdev]
[-ffam]
       [-wname] [-Wname] [-Mdir] [-dcs] [-rcn] [-nnum] [-olist]
[-Parg]
       [-Larg] [-Idir] [files...]
groff -h gives more help
/usr/bin/python "./html.py" -d . manual.xml > manual.html || (rm
manual.html; exit 1)
make[2]: Leaving directory
`/home/wjs/tools/build/openconnect-5.01/www'
make[1]: Leaving directory
`/home/wjs/tools/build/openconnect-5.01/www'
Making all in po
make[1]: Entering directory
`/home/wjs/tools/build/openconnect-5.01/po'
make[1]: Nothing to be done for `all'.
make[1]: Leaving directory `/home/wjs/tools/build/openconnect-5.01/po'
make[1]: Entering directory `/home/wjs/tools/build/openconnect-5.01'
  CCLD     libopenconnect.la
  CCLD     openconnect
openconnect-dtls.o: In function `dtls_try_handshake':
/home/wjs/tools/build/openconnect-5.01/dtls.c:219: undefined reference
to `SSL_do_handshake'
/home/wjs/tools/build/openconnect-5.01/dtls.c:300: undefined reference
to `SSL_get_error'
/home/wjs/tools/build/openconnect-5.01/dtls.c:226: undefined reference
to `SSL_free'
/home/wjs/tools/build/openconnect-5.01/dtls.c:258: undefined reference
to `SSLeay'
/home/wjs/tools/build/openconnect-5.01/dtls.c:318: undefined reference
to `openconnect_print_err_cb'
/home/wjs/tools/build/openconnect-5.01/dtls.c:318: undefined reference
to `ERR_print_errors_cb'
/home/wjs/tools/build/openconnect-5.01/dtls.c:321: undefined reference
to `SSL_free'
/home/wjs/tools/build/openconnect-5.01/dtls.c:332: undefined reference
to `SSL_free'
openconnect-dtls.o: In function `start_dtls_handshake':
/home/wjs/tools/build/openconnect-5.01/dtls.c:173: undefined reference
to `SSL_new'
/home/wjs/tools/build/openconnect-5.01/dtls.c:174: undefined reference
to `SSL_set_connect_state'
/home/wjs/tools/build/openconnect-5.01/dtls.c:176: undefined reference
to `SSL_get_ciphers'
/home/wjs/tools/build/openconnect-5.01/dtls.c:177: undefined reference
to `sk_num'
/home/wjs/tools/build/openconnect-5.01/dtls.c:187: undefined reference
to `sk_value'
/home/wjs/tools/build/openconnect-5.01/dtls.c:194: undefined reference
to `SSL_set_session'
/home/wjs/tools/build/openconnect-5.01/dtls.c:205: undefined reference
to `BIO_new_socket'
/home/wjs/tools/build/openconnect-5.01/dtls.c:207: undefined reference
to `BIO_ctrl'
/home/wjs/tools/build/openconnect-5.01/dtls.c:208: undefined reference
to `SSL_set_bio'
/home/wjs/tools/build/openconnect-5.01/dtls.c:210: undefined reference
to `SSL_ctrl'
/home/wjs/tools/build/openconnect-5.01/dtls.c:154: undefined reference
to `SSL_SESSION_new'
/home/wjs/tools/build/openconnect-5.01/dtls.c:179: undefined reference
to `SSL_CTX_free'
/home/wjs/tools/build/openconnect-5.01/dtls.c:180: undefined reference
to `SSL_free'
/home/wjs/tools/build/openconnect-5.01/dtls.c:181: undefined reference
to `SSL_SESSION_free'
/home/wjs/tools/build/openconnect-5.01/dtls.c:128: undefined reference
to `DTLSv1_client_method'
/home/wjs/tools/build/openconnect-5.01/dtls.c:129: undefined reference
to `SSL_CTX_new'
/home/wjs/tools/build/openconnect-5.01/dtls.c:140: undefined reference
to `SSL_CTX_ctrl'
/home/wjs/tools/build/openconnect-5.01/dtls.c:142: undefined reference
to `SSL_CTX_set_cipher_list'
/home/wjs/tools/build/openconnect-5.01/dtls.c:145: undefined reference
to `SSL_CTX_free'
/home/wjs/tools/build/openconnect-5.01/dtls.c:133: undefined reference
to `openconnect_print_err_cb'
/home/wjs/tools/build/openconnect-5.01/dtls.c:133: undefined reference
to `ERR_print_errors_cb'
openconnect-dtls.o: In function `dtls_restart':
/home/wjs/tools/build/openconnect-5.01/dtls.c:602: undefined reference
to `SSL_free'
openconnect-dtls.o: In function `dtls_mainloop':
/home/wjs/tools/build/openconnect-5.01/dtls.c:709: undefined reference
to `SSL_read'
/home/wjs/tools/build/openconnect-5.01/dtls.c:835: undefined reference
to `SSL_write'
/home/wjs/tools/build/openconnect-5.01/dtls.c:837: undefined reference
to `SSL_get_error'
/home/wjs/tools/build/openconnect-5.01/dtls.c:845: undefined reference
to `openconnect_print_err_cb'
/home/wjs/tools/build/openconnect-5.01/dtls.c:845: undefined reference
to `ERR_print_errors_cb'
/home/wjs/tools/build/openconnect-5.01/dtls.c:732: undefined reference
to `SSL_write'
/home/wjs/tools/build/openconnect-5.01/dtls.c:812: undefined reference
to `SSL_write'
/home/wjs/tools/build/openconnect-5.01/dtls.c:794: undefined reference
to `SSL_write'
openconnect-cstp.o: In function `cstp_write':
/home/wjs/tools/build/openconnect-5.01/cstp.c:647: undefined reference
to `SSL_write'
/home/wjs/tools/build/openconnect-5.01/cstp.c:651: undefined reference
to `SSL_get_error'
/home/wjs/tools/build/openconnect-5.01/cstp.c:662: undefined reference
to `openconnect_print_err_cb'
/home/wjs/tools/build/openconnect-5.01/cstp.c:662: undefined reference
to `ERR_print_errors_cb'
openconnect-cstp.o: In function `cstp_read':
/home/wjs/tools/build/openconnect-5.01/cstp.c:629: undefined reference
to `SSL_read'
/home/wjs/tools/build/openconnect-5.01/cstp.c:633: undefined reference
to `SSL_get_error'
./.libs/libopenconnect.so: undefined reference to `X509_free'
./.libs/libopenconnect.so: undefined reference to `ENGINE_free'
./.libs/libopenconnect.so: undefined reference to
`ENGINE_load_builtin_engines'
./.libs/libopenconnect.so: undefined reference to `ENGINE_by_id'
collect2: ld returned 1 exit status
make[1]: *** [openconnect] Error 1
make[1]: Leaving directory `/home/wjs/tools/build/openconnect-5.01'
make: *** [all-recursive] Error 1
[root at wjslaptop openconnect-5.01]#


Any assistance you can provide is greatly appreciated!

 - Bill


From nmav at gnutls.org  Tue Dec  3 17:34:31 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Tue, 03 Dec 2013 23:34:31 +0100
Subject: [PATCH ocserv 4/4] README: Add info on build dependencies
In-Reply-To: <CAJiQ=7ATN=N612ca7-cy++sVfwE_fZ3OhSqWeMNVsgdESEJBqA@mail.gmail.com>
References: <1385864709-28739-1-git-send-email-cernekee@gmail.com>
 <1385864709-28739-4-git-send-email-cernekee@gmail.com>
 <1385892734.1829.25.camel@aspire.lan>
 <CAJiQ=7ATN=N612ca7-cy++sVfwE_fZ3OhSqWeMNVsgdESEJBqA@mail.gmail.com>
Message-ID: <1386110071.1834.16.camel@aspire.lan>

On Sun, 2013-12-01 at 08:15 -0800, Kevin Cernekee wrote:

> It seems like making AC_CONFIG_FILES conditional may be a problem:
> 
> AC_DEFUN([LIBOPTS_CHECK], [
>   m4_pushdef([AO_Libopts_Dir],
>               [ifelse($1, , [libopts], [$1])])
>   LIBOPTS_BUILD_BLOCKED=''
>   LIBOPTS_CHECK_COMMON(AO_Libopts_Dir)
>   AM_COND_IF([NEED_LIBOPTS], [
>     INVOKE_LIBOPTS_MACROS
>     AC_CONFIG_FILES(AO_Libopts_Dir/Makefile)
>   ])dnl
> If I try adding libopts/Makefile to AC_CONFIG_FILES in configure.ac so
> that we always generate libopts/Makefile to support distclean and
> dist, autoconf aborts because it was added twice.

Could you report that to the autogen list?

> I also noticed that the autogen binary on my system (FC19) generates
> *-args files which reference symbols that do not exist in the bundled
> libopts, causing a compile error when --enable-local-libopts is used.
> So it looks like there is a dependency between the library version and
> the autogen version.  This could be a problem for users building the
> released tarball sources (with bundled *-args files) against the
> libopts system library.

Unfortunately this problem exists for someone building from the
repository and using the included library. To work you should use the
autogen version that corresponds to the included libopts (5.18 - that is
in fc20). The best when compiling from the repository would be not to
use the included libopts.

regards,
Nikos




From weeker at outlook.com  Wed Dec  4 20:13:44 2013
From: weeker at outlook.com (Karl)
Date: Thu, 5 Dec 2013 09:13:44 +0800
Subject: AnyConnect client MTU issue?
Message-ID: <CAFuxyaEfPNcwuv+6mgDt4JwAzSUgbUd2d-hXuHCubiHeBy9XCw@mail.gmail.com>

Hi, by using iOS AnyConnect  client, some web resource like images
could not be loaded, looks like MTU problem, but how to fix this?
Tried different MTU value in ocserv config but doesn't help.

Thanks for the great work!

W.


From n.mavrogiannopoulos at gmail.com  Thu Dec  5 05:09:13 2013
From: n.mavrogiannopoulos at gmail.com (Nikos Mavrogiannopoulos)
Date: Thu, 5 Dec 2013 11:09:13 +0100
Subject: AnyConnect client MTU issue?
In-Reply-To: <CAFuxyaEfPNcwuv+6mgDt4JwAzSUgbUd2d-hXuHCubiHeBy9XCw@mail.gmail.com>
References: <CAFuxyaEfPNcwuv+6mgDt4JwAzSUgbUd2d-hXuHCubiHeBy9XCw@mail.gmail.com>
Message-ID: <CAJU7zaLMB834vR2SDiyznEvSrdpQ88ceorDvwVyc6VQPCuANYg@mail.gmail.com>

On Thu, Dec 5, 2013 at 2:13 AM, Karl <weeker at outlook.com> wrote:
> Hi, by using iOS AnyConnect  client, some web resource like images
> could not be loaded, looks like MTU problem, but how to fix this?
> Tried different MTU value in ocserv config but doesn't help.

Hello,
 Which verison of ocserv did you use? In some old versions the "mtu"
option existed but was inactive.

Have you tried with only allowing TCP? Does it fix the issue you see?

regards,
Nikos


From per at juborg.nu  Thu Dec  5 16:38:55 2013
From: per at juborg.nu (Per Juborg)
Date: Thu, 5 Dec 2013 22:38:55 +0100
Subject: Error building ocserv 0.2.2
Message-ID: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>

Hi

I'm having problems with building OCServ on my Mac OSX 10.8.5

I get the following message when running make:

make  all-recursive
Making all in gl
make  all-recursive
make[4]: Nothing to be done for `all-am'.
Making all in src
Making all in pcl
make[3]: Nothing to be done for `all'.
  CC       main.o
In file included from main.c:30:
./system.h:28:1: error: unknown type name 'sighandler_t'
sighandler_t ocsignal(int signum, sighandler_t handler);
^
./system.h:28:35: error: unknown type name 'sighandler_t'
sighandler_t ocsignal(int signum, sighandler_t handler);
                                  ^
In file included from main.c:35:
In file included from ./script-list.h:24:
In file included from ./main.h:28:
In file included from ./vpn.h:211:
In file included from ./tun.h:26:
./ccan/list/list.h:126:9: warning: 'LIST_HEAD' macro redefined
#define LIST_HEAD(name) \
        ^
/usr/include/sys/queue.h:373:9: note: previous definition is here
#define LIST_HEAD(name, type)                                           \
        ^
main.c:706:7: warning: 'daemon' is deprecated: first deprecated in OS X 10.5 [-Wdeprecated-declarations]
                if (daemon(0, 0) == -1) {
                    ^
/usr/include/stdlib.h:292:6: note: 'daemon' declared here
int      daemon(int, int) __DARWIN_1050(daemon) __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_0, __MAC_10_5...
         ^
2 warnings and 2 errors generated.
make[3]: *** [main.o] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

Have I missed something when running configure or are there flags that have to be set specifically for building on OSX?

/Per


From n.mavrogiannopoulos at gmail.com  Fri Dec  6 03:50:35 2013
From: n.mavrogiannopoulos at gmail.com (Nikos Mavrogiannopoulos)
Date: Fri, 6 Dec 2013 09:50:35 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
Message-ID: <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>

On Thu, Dec 5, 2013 at 10:38 PM, Per Juborg <per at juborg.nu> wrote:
> Hi
> I'm having problems with building OCServ on my Mac OSX 10.8.5
> I get the following message when running make:
> In file included from main.c:30:
> ./system.h:28:1: error: unknown type name 'sighandler_t'
> sighandler_t ocsignal(int signum, sighandler_t handler);

Hello,
 Simply replace sighandler_t with sig_t on that system. I've added a
configure check in master to prevent that issue in the future.

> #define LIST_HEAD(name) \
>         ^
> /usr/include/sys/queue.h:373:9: note: previous definition is here
> #define LIST_HEAD(name, type)                                           \
>         ^

edit src/ccan/list/list.h and add the following:
#undef LIST_HEAD
after the last include. Does that fix the issue you see?

regards,
Nikos


From per at juborg.nu  Fri Dec  6 15:59:26 2013
From: per at juborg.nu (Per Juborg)
Date: Fri, 6 Dec 2013 21:59:26 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
Message-ID: <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>

Hi,

That helped, but not all the way :(

Look at this:
make
make  all-recursive
Making all in gl
make  all-recursive
make[4]: Nothing to be done for `all-am'.
Making all in src
Making all in pcl
make[3]: Nothing to be done for `all'.
  CC       worker-vpn.o
In file included from worker-vpn.c:35:
/usr/include/net/if.h:306:19: error: field has incomplete type 'struct sockaddr'
                struct  sockaddr ifru_addr;
                                 ^
/usr/include/net/if.h:306:10: note: forward declaration of 'struct sockaddr'
                struct  sockaddr ifru_addr;
                        ^
/usr/include/net/if.h:307:19: error: field has incomplete type 'struct sockaddr'
                struct  sockaddr ifru_dstaddr;
                                 ^
/usr/include/net/if.h:306:10: note: forward declaration of 'struct sockaddr'
                struct  sockaddr ifru_addr;
                        ^
/usr/include/net/if.h:308:19: error: field has incomplete type 'struct sockaddr'
                struct  sockaddr ifru_broadaddr;
                                 ^
/usr/include/net/if.h:306:10: note: forward declaration of 'struct sockaddr'
                struct  sockaddr ifru_addr;
                        ^
/usr/include/net/if.h:352:18: error: field has incomplete type 'struct sockaddr'
        struct  sockaddr ifra_addr;
                         ^
/usr/include/net/if.h:306:10: note: forward declaration of 'struct sockaddr'
                struct  sockaddr ifru_addr;
                        ^
/usr/include/net/if.h:353:18: error: field has incomplete type 'struct sockaddr'
        struct  sockaddr ifra_broadaddr;
                         ^
/usr/include/net/if.h:306:10: note: forward declaration of 'struct sockaddr'
                struct  sockaddr ifru_addr;
                        ^
/usr/include/net/if.h:354:18: error: field has incomplete type 'struct sockaddr'
        struct  sockaddr ifra_mask;
                         ^
/usr/include/net/if.h:306:10: note: forward declaration of 'struct sockaddr'
                struct  sockaddr ifru_addr;
                        ^
/usr/include/net/if.h:437:26: error: field has incomplete type 'struct sockaddr_storage'
        struct sockaddr_storage addr;   /* in/out */
                                ^
/usr/include/net/if.h:437:9: note: forward declaration of 'struct sockaddr_storage'
        struct sockaddr_storage addr;   /* in/out */
               ^
/usr/include/net/if.h:438:26: error: field has incomplete type 'struct sockaddr_storage'
        struct sockaddr_storage dstaddr; /* out */
                                ^
/usr/include/net/if.h:437:9: note: forward declaration of 'struct sockaddr_storage'
        struct sockaddr_storage addr;   /* in/out */
               ^
8 errors generated.
make[3]: *** [worker-vpn.o] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

/Per

-----Original Message-----
From: Nikos Mavrogiannopoulos [mailto:n.mavrogiannopoulos at gmail.com] 
Sent: den 6 december 2013 09:51
To: Per Juborg
Cc: openconnect-devel at lists.infradead.org
Subject: Re: Error building ocserv 0.2.2

On Thu, Dec 5, 2013 at 10:38 PM, Per Juborg <per at juborg.nu> wrote:
> Hi
> I'm having problems with building OCServ on my Mac OSX 10.8.5 I get 
> the following message when running make:
> In file included from main.c:30:
> ./system.h:28:1: error: unknown type name 'sighandler_t'
> sighandler_t ocsignal(int signum, sighandler_t handler);

Hello,
 Simply replace sighandler_t with sig_t on that system. I've added a configure check in master to prevent that issue in the future.

> #define LIST_HEAD(name) \
>         ^
> /usr/include/sys/queue.h:373:9: note: previous definition is here
> #define LIST_HEAD(name, type)                                           \
>         ^

edit src/ccan/list/list.h and add the following:
#undef LIST_HEAD
after the last include. Does that fix the issue you see?

regards,
Nikos

From weeker at outlook.com  Sat Dec  7 03:18:59 2013
From: weeker at outlook.com (Karl)
Date: Sat, 7 Dec 2013 16:18:59 +0800
Subject: AnyConnect client MTU issue?
Message-ID: <CAFuxyaEK_zv862TREMt5cC7h_BPQtkX3u1kDWar+poVt29yBiQ@mail.gmail.com>

Version is latest 0.2.2.

Tried comment udp-port, doesn't fix it :(


>Hello,
> Which verison of ocserv did you use? In some old versions the "mtu"
>option existed but was inactive.

>Have you tried with only allowing TCP? Does it fix the issue you see?


From nmav at gnutls.org  Sat Dec  7 11:46:27 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sat, 07 Dec 2013 17:46:27 +0100
Subject: AnyConnect client MTU issue?
In-Reply-To: <CAFuxyaEK_zv862TREMt5cC7h_BPQtkX3u1kDWar+poVt29yBiQ@mail.gmail.com>
References: <CAFuxyaEK_zv862TREMt5cC7h_BPQtkX3u1kDWar+poVt29yBiQ@mail.gmail.com>
Message-ID: <1386434787.7734.4.camel@aspire.lan>

On Sat, 2013-12-07 at 16:18 +0800, Karl wrote:
> Version is latest 0.2.2.
> 
> Tried comment udp-port, doesn't fix it :(

Interesting. I just realized that you cannot disable UDP on the current
ocserv version. I've added that option in master, however, the only
thing you can do to test that with the version you have, is firewall
that port.

regards,
Nikos




From nmav at gnutls.org  Sat Dec  7 11:48:44 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sat, 07 Dec 2013 17:48:44 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
Message-ID: <1386434924.7734.6.camel@aspire.lan>

On Fri, 2013-12-06 at 21:59 +0100, Per Juborg wrote:
> Hi,
> 
> That helped, but not all the way :(
> 
> Look at this:
> make
> make  all-recursive
> Making all in gl
> make  all-recursive
> make[4]: Nothing to be done for `all-am'.
> Making all in src
> Making all in pcl
> make[3]: Nothing to be done for `all'.
>   CC       worker-vpn.o
> In file included from worker-vpn.c:35:
> /usr/include/net/if.h:306:19: error: field has incomplete type 'struct sockaddr'
>                 struct  sockaddr ifru_addr;
>                                  ^
> /usr/include/net/if.h:306:10: note: forward declaration of 'struct sockaddr'

No idea what is that. It looks like an issue in this system's headers.
Could you try editing worker-vpn.c and moving the "include net/if.h" at
the end of the include list?

regards,
Nikos




From weeker at outlook.com  Sat Dec  7 12:59:31 2013
From: weeker at outlook.com (Karl)
Date: Sun, 8 Dec 2013 01:59:31 +0800
Subject: Certificate auth issue in 0.2.2
Message-ID: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>

Hi,

In my config, it has:

auth = "certificate"
auth = "plain[/opt/ocserv/passwd]"

but AnyConnect client failed to connect, debug log shows:

 "No certificate was found."

add "always-require-cert=false", it goes further, but still has error like:

"error verifying client certificate."

Did I miss something or buggy in 0.2.2?

Thanks!


From weeker at outlook.com  Sat Dec  7 12:53:18 2013
From: weeker at outlook.com (Karl)
Date: Sun, 8 Dec 2013 01:53:18 +0800
Subject: AnyConnect client MTU issue?
In-Reply-To: <1386434787.7734.4.camel@aspire.lan>
References: <CAFuxyaEK_zv862TREMt5cC7h_BPQtkX3u1kDWar+poVt29yBiQ@mail.gmail.com>
 <1386434787.7734.4.camel@aspire.lan>
Message-ID: <CAFuxyaHUeqz+HBZ1D5mJ=D7wT4xAU+aE0mzPoKiLV20rKJGGpA@mail.gmail.com>

After patched, seems fixed this issue :)

Thanks for your work, that's great!

On Sun, Dec 8, 2013 at 12:46 AM, Nikos Mavrogiannopoulos
<nmav at gnutls.org> wrote:
> On Sat, 2013-12-07 at 16:18 +0800, Karl wrote:
>> Version is latest 0.2.2.
>>
>> Tried comment udp-port, doesn't fix it :(
>
> Interesting. I just realized that you cannot disable UDP on the current
> ocserv version. I've added that option in master, however, the only
> thing you can do to test that with the version you have, is firewall
> that port.
>
> regards,
> Nikos
>
>


From nmav at gnutls.org  Sat Dec  7 14:45:12 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sat, 07 Dec 2013 20:45:12 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
Message-ID: <1386445512.1858.1.camel@aspire.lan>

On Sun, 2013-12-08 at 01:59 +0800, Karl wrote:
> Hi,
> 
> In my config, it has:
> 
> auth = "certificate" auth = "plain[/opt/ocserv/passwd]"
> 
> but AnyConnect client failed to connect, debug log shows:
> 
>  "No certificate was found."
> 
> add "always-require-cert=false", it goes further, but still has error
> like:
> 
> "error verifying client certificate." Did I miss something or buggy in
> 0.2.2?

You'll need to set the authority that signed the client certificate
with the ca-cert option. Otherwise ocserv doesn't know how which
certificates are valid.

regards, 
Nikos




From nmav at gnutls.org  Sat Dec  7 14:48:35 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sat, 07 Dec 2013 20:48:35 +0100
Subject: AnyConnect client MTU issue?
In-Reply-To: <CAFuxyaHUeqz+HBZ1D5mJ=D7wT4xAU+aE0mzPoKiLV20rKJGGpA@mail.gmail.com>
References: <CAFuxyaEK_zv862TREMt5cC7h_BPQtkX3u1kDWar+poVt29yBiQ@mail.gmail.com>
 <1386434787.7734.4.camel@aspire.lan>
 <CAFuxyaHUeqz+HBZ1D5mJ=D7wT4xAU+aE0mzPoKiLV20rKJGGpA@mail.gmail.com>
Message-ID: <1386445715.1858.4.camel@aspire.lan>

On Sun, 2013-12-08 at 01:53 +0800, Karl wrote:
> After patched, seems fixed this issue :)

That's of course a work-around of the MTU issue. A proper fix would be
after identifying what causes that issue. 

btw. when trying setting the mtu manually, have you tried capturing
packets to see whether the lost packets exceeded the set mtu? If yes,
could you verify using the --http-debug option whether the client
receives the correct mtu?

regards,
Nikos




From weeker at outlook.com  Sat Dec  7 14:53:57 2013
From: weeker at outlook.com (Karl)
Date: Sun, 8 Dec 2013 03:53:57 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <1386445512.1858.1.camel@aspire.lan>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
Message-ID: <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>

Yes, sure, ca-cert set, log shows "[main] processed 1 CA
certificate(s)", and the cert-user-oid set to use CN too, but no luck.

On Sun, Dec 8, 2013 at 3:45 AM, Nikos Mavrogiannopoulos <nmav at gnutls.org> wrote:
> On Sun, 2013-12-08 at 01:59 +0800, Karl wrote:
>> Hi,
>>
>> In my config, it has:
>>
>> auth = "certificate" auth = "plain[/opt/ocserv/passwd]"
>>
>> but AnyConnect client failed to connect, debug log shows:
>>
>>  "No certificate was found."
>>
>> add "always-require-cert=false", it goes further, but still has error
>> like:
>>
>> "error verifying client certificate." Did I miss something or buggy in
>> 0.2.2?
>
> You'll need to set the authority that signed the client certificate
> with the ca-cert option. Otherwise ocserv doesn't know how which
> certificates are valid.
>
> regards,
> Nikos
>
>


From per at juborg.nu  Sat Dec  7 18:53:28 2013
From: per at juborg.nu (Per Juborg)
Date: Sun, 8 Dec 2013 00:53:28 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <1386434924.7734.6.camel@aspire.lan>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
 <1386434924.7734.6.camel@aspire.lan>
Message-ID: <585F10E43CE3454B95691D0A1F56D106F4676E9290@exch2.email.eworx.se>

Hi,

I tested bith moving it and removing the include of net/if.h, both helped.

Then I ran in to another include in tun.c to "net/if_tun.h" that don't exist in Apple headers so I removed that one.

Now it got a bit more complicated. Can anyone make anything out of this?
make  all-recursive
Making all in gl
make  all-recursive
make[4]: Nothing to be done for `all-am'.
Making all in src
Making all in pcl
make[3]: Nothing to be done for `all'.
  CC       icmp-ping.o
In file included from icmp-ping.c:76:
/usr/include/netinet/ip_icmp.h:92:4: error: unknown type name 'n_short'; did you mean 'u_short'?
                        n_short icd_id;
                        ^
/usr/include/sys/types.h:85:25: note: 'u_short' declared here
typedef unsigned short          u_short;
                                ^
In file included from icmp-ping.c:76:
/usr/include/netinet/ip_icmp.h:93:4: error: unknown type name 'n_short'; did you mean 'u_short'?
                        n_short icd_seq;
                        ^
/usr/include/sys/types.h:85:25: note: 'u_short' declared here
typedef unsigned short          u_short;
                                ^
In file included from icmp-ping.c:76:
/usr/include/netinet/ip_icmp.h:99:4: error: unknown type name 'n_short'; did you mean 'u_short'?
                        n_short ipm_void;
                        ^
/usr/include/sys/types.h:85:25: note: 'u_short' declared here
typedef unsigned short          u_short;
                                ^
In file included from icmp-ping.c:76:
/usr/include/netinet/ip_icmp.h:100:4: error: unknown type name 'n_short'; did you mean 'u_short'?
                        n_short ipm_nextmtu;
                        ^
/usr/include/sys/types.h:85:25: note: 'u_short' declared here
typedef unsigned short          u_short;
                                ^
In file included from icmp-ping.c:76:
/usr/include/netinet/ip_icmp.h:121:4: error: unknown type name 'n_time'
                        n_time its_otime;
                        ^
/usr/include/netinet/ip_icmp.h:122:4: error: unknown type name 'n_time'
                        n_time its_rtime;
                        ^
/usr/include/netinet/ip_icmp.h:123:4: error: unknown type name 'n_time'
                        n_time its_ttime;
                        ^
/usr/include/netinet/ip_icmp.h:126:14: error: field has incomplete type 'struct ip'
                        struct ip idi_ip;
                                  ^
/usr/include/netinet/ip_icmp.h:126:11: note: forward declaration of 'struct ip'
                        struct ip idi_ip;
                               ^
icmp-ping.c:227:44: error: incomplete definition of type 'struct iphdr'
                                pkt = (struct icmp *) (packet1 + (iphdr->ihl << 2));    /* skip ip hdr */
                                                                  ~~~~~^
icmp-ping.c:225:12: note: forward declaration of 'struct iphdr'
                                struct iphdr *iphdr =
                                       ^
icmp-ping.c:231:33: error: use of undeclared identifier 'ICMP_DEST_UNREACH'
                                        else if (pkt->icmp_type == ICMP_DEST_UNREACH)
                                                                   ^
icmp-ping.c:297:23: error: use of undeclared identifier 'SOL_RAW'
        setsockopt(pingsock, SOL_RAW, IPV6_CHECKSUM,
                             ^
icmp-ping.c:337:34: error: use of undeclared identifier 'ICMP_DEST_UNREACH'
                                        else if (pkt->icmp6_type == ICMP_DEST_UNREACH)
                                                                    ^
12 errors generated.
make[3]: *** [icmp-ping.o] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

/Per

-----Original Message-----
From: Nikos Mavrogiannopoulos [mailto:n.mavrogiannopoulos at gmail.com] On Behalf Of Nikos Mavrogiannopoulos
Sent: den 7 december 2013 17:49
To: Per Juborg
Cc: openconnect-devel at lists.infradead.org
Subject: Re: Error building ocserv 0.2.2

On Fri, 2013-12-06 at 21:59 +0100, Per Juborg wrote:
> Hi,
> 
> That helped, but not all the way :(
> 
> Look at this:
> make
> make  all-recursive
> Making all in gl
> make  all-recursive
> make[4]: Nothing to be done for `all-am'.
> Making all in src
> Making all in pcl
> make[3]: Nothing to be done for `all'.
>   CC       worker-vpn.o
> In file included from worker-vpn.c:35:
> /usr/include/net/if.h:306:19: error: field has incomplete type 'struct sockaddr'
>                 struct  sockaddr ifru_addr;
>                                  ^
> /usr/include/net/if.h:306:10: note: forward declaration of 'struct sockaddr'

No idea what is that. It looks like an issue in this system's headers.
Could you try editing worker-vpn.c and moving the "include net/if.h" at the end of the include list?

regards,
Nikos



From cernekee at gmail.com  Sat Dec  7 22:15:38 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat,  7 Dec 2013 19:15:38 -0800
Subject: [GIT PULL V5] Library/Android/JNI improvements
Message-ID: <1386472538-1107-1-git-send-email-cernekee@gmail.com>

V4->V5 changes:

Added support for refreshing the auth form when a new group is chosen

Added support for second-auth fields and noaaa

Changed "cancel_pipe" to "cmd_pipe" so it can be used for other
asynchronous requests

Added a "force reconnect" command, issued via cmd_pipe, for use when a
mobile device's IP or connectivity changes

Clean up some of the JNI local reference usage


The code changes needed to make the Android UI work with
OC_FORM_RESULT_NEWGROUP were not too bad:

https://github.com/cernekee/ics-openconnect/commit/c8d30bb24ef17aabba6efc66ffed1ff6be1ea3d2
https://github.com/cernekee/ics-openconnect/commit/ffb882f28d1f90c8c9fc40a8288eec11653e5e72

I tested both the Android client and the CLI, with XML POST enabled and
disabled.  AFAICT the results mirrored what Cisco AnyConnect is doing.
However, I am not aware of any live servers that actually enable
second-auth on certain authgroups; vpn.cmu.edu looks like the best test
case we have at the moment.

I did not test NEWGROUP with CSD, which may be a risk since it changes
the openconnect_obtain_cookie() flow.

--

The following changes since commit b06b862f572c0b6cbdf3a8e81b93554f98fbef80:

  Include supporting certificates from PKCS#11 tokens (2013-11-15 22:49:25 +0000)

are available in the git repository at:

  git://github.com/cernekee/openconnect jni-v5

for you to fetch changes up to 6dfcb9f57a100cb1fc44a3cbc988c463ae1d1c58:

  auth: Hide unused form fields based on the selected authgroup (2013-12-07 18:54:13 -0800)

----------------------------------------------------------------
Kevin Cernekee (50):
      Clear peer_addr if aborting XML POST changes the hostname
      library: Remove declaration for nonexistent openconnect_get_vpn_name()
      auth: Hack around const warnings
      Introduce new helper functions for cancel_fd checking
      library: Rename cancel_fd to cmd_fd
      library: Add new openconnect_setup_cmd_pipe() call
      Add new helper functions to support cmd_fd feature
      Move signal handling out of mainloop
      mainloop: Convert vpn_mainloop() into a library function
      mainloop: Add OC_CMD_RECONNECT operation
      main: Introduce xstrdup() function
      tun: Export setup_tun() functionality
      Move vpninfo default settings into library
      library: Check for failed allocations in openconnect_vpninfo_new()
      dtls: Export setup_dtls() function
      cstp: Export make_cstp_connection()
      library: Move the mainloop guts into libopenconnect
      library: Update openconnect.pc.in
      tun, cstp: Don't exit() on failure
      library: Free zlib state
      cstp: Clean up split include/exclude/DNS lists when freeing vpninfo
      library: Add get/set functions for servercert, ifname, reqmtu
      library: Export VPN IP information to callers
      library: Add protect_socket callback
      library: Add support for mobile headers
      library: Add openconnect_set_xmlpost() to support different CSD modes
      library: Update changelog and bump minor version
      main: Add openconnect_vpninfo_free() on a couple of exit paths
      buildsys: Allow overriding -W flags
      acinclude: Add AX_JNI_INCLUDE_DIR macro
      JNI: Initial commit of C wrapper functions
      JNI: Initial commit of Java library + example program
      android: Bump gmp up to version 5.1.2
      android: Enable JNI in build
      android: Add libstoken to build
      android: Add liboath to build
      android: Honor $TMPDIR when writing CSD script
      auth: Fix comment in parse_form()
      android: Add "sources" target
      android: Fix broken ARCH=mips build
      android: Add .gitignore file
      android: Update Makefile to use NDK r9b
      library: Use named constants for process_auth_form() return value
      main: Move username/password/authgroup vars into main.c
      auth: Add <group-access> node to XML POST initial request
      auth: Add oc_choice->selected flag
      process_auth_form: Add code to support NEWGROUP return status from UI
      auth: Remove outdated comment for parse_auth_choice()
      auth: Parse second-auth-related properties from the auth form
      auth: Hide unused form fields based on the selected authgroup

 .gitignore                                         |    1 +
 Makefile.am                                        |   25 +-
 acinclude.m4                                       |  125 +++
 android/.gitignore                                 |    8 +
 android/0001-Remove-call-to-mlockall.patch         |   33 +
 ...-fflush-freadahead-fseeko-Fix-for-Android.patch |   43 +
 android/Makefile                                   |  119 ++-
 auth.c                                             |  159 +++-
 configure.ac                                       |   48 +-
 cstp.c                                             |  137 +--
 dtls.c                                             |   18 +-
 gnutls.c                                           |   36 +-
 http.c                                             |   49 +-
 java/.gitignore                                    |    2 +
 java/README                                        |   22 +
 java/build.xml                                     |   33 +
 java/src/com/example/LibTest.java                  |  207 ++++
 .../infradead/libopenconnect/LibOpenConnect.java   |  256 +++++
 jni.c                                              | 1004 ++++++++++++++++++++
 libopenconnect.map.in                              |   19 +
 library.c                                          |  109 ++-
 main.c                                             |  193 ++--
 mainloop.c                                         |   38 +-
 openconnect-internal.h                             |   56 +-
 openconnect.h                                      |   99 +-
 openconnect.pc.in                                  |    2 +-
 openssl.c                                          |   36 +-
 ssl.c                                              |   62 +-
 tun.c                                              |  187 ++--
 29 files changed, 2716 insertions(+), 410 deletions(-)
 create mode 100644 android/.gitignore
 create mode 100644 android/0001-Remove-call-to-mlockall.patch
 create mode 100644 android/0001-fflush-freadahead-fseeko-Fix-for-Android.patch
 create mode 100644 java/.gitignore
 create mode 100644 java/README
 create mode 100644 java/build.xml
 create mode 100644 java/src/com/example/LibTest.java
 create mode 100644 java/src/org/infradead/libopenconnect/LibOpenConnect.java
 create mode 100644 jni.c


From borneo.antonio at gmail.com  Sat Dec  7 23:29:32 2013
From: borneo.antonio at gmail.com (Antonio Borneo)
Date: Sun,  8 Dec 2013 12:29:32 +0800
Subject: [PATCH] Fix --os=win
Message-ID: <1386476972-25595-1-git-send-email-borneo.antonio@gmail.com>

Running OpenConnect with flag "--os=win" we get
        vpninfo->csd_xmltag == "csd"
In fact, in library.c we have:
     85         else if (!strcmp(os, "win"))
     86                 vpninfo->csd_xmltag = "csd";

In current code, the case (vpninfo->csd_xmltag == "csd") is
grabbed by previous "else if()" condition and not evaluated
anymore to extract "stuburl", "starturl" and "waiturl".

Split the "else if" in independent statement.

Signed-off-by: Antonio Borneo <borneo.antonio at gmail.com>
---
 auth.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/auth.c b/auth.c
index f28e350..9336b29 100644
--- a/auth.c
+++ b/auth.c
@@ -454,7 +454,8 @@ static int parse_auth_node(struct openconnect_info *vpninfo, xmlNode *xml_node,
 		} else if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, "csd")) {
 			xmlnode_get_prop(xml_node, "token", &vpninfo->csd_token);
 			xmlnode_get_prop(xml_node, "ticket", &vpninfo->csd_ticket);
-		} else if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, vpninfo->csd_xmltag)) {
+		}
+		if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, vpninfo->csd_xmltag)) {
 			xmlnode_get_prop(xml_node, "stuburl", &vpninfo->csd_stuburl);
 			xmlnode_get_prop(xml_node, "starturl", &vpninfo->csd_starturl);
 			xmlnode_get_prop(xml_node, "waiturl", &vpninfo->csd_waiturl);
-- 
1.7.3.4



From cernekee at gmail.com  Sat Dec  7 23:54:27 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 7 Dec 2013 20:54:27 -0800
Subject: [PATCH] Fix --os=win
In-Reply-To: <1386476972-25595-1-git-send-email-borneo.antonio@gmail.com>
References: <1386476972-25595-1-git-send-email-borneo.antonio@gmail.com>
Message-ID: <CAJiQ=7BjdW0c29isKa4wqALOMY2MYo4ZjhGE=Rb4+Q-zJV5EtA@mail.gmail.com>

On Sat, Dec 7, 2013 at 8:29 PM, Antonio Borneo <borneo.antonio at gmail.com> wrote:
> --- a/auth.c
> +++ b/auth.c
> @@ -454,7 +454,8 @@ static int parse_auth_node(struct openconnect_info *vpninfo, xmlNode *xml_node,
>                 } else if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, "csd")) {
>                         xmlnode_get_prop(xml_node, "token", &vpninfo->csd_token);
>                         xmlnode_get_prop(xml_node, "ticket", &vpninfo->csd_ticket);
> -               } else if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, vpninfo->csd_xmltag)) {
> +               }
> +               if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, vpninfo->csd_xmltag)) {
>                         xmlnode_get_prop(xml_node, "stuburl", &vpninfo->csd_stuburl);
>                         xmlnode_get_prop(xml_node, "starturl", &vpninfo->csd_starturl);
>                         xmlnode_get_prop(xml_node, "waiturl", &vpninfo->csd_waiturl);

Could you please update the comments above the function to reflect the
new behavior?  They currently say "ignore" for the Windows csd node.

Also, it would be good to test this in conjunction with my proposed
Android/iOS changes, which touch the same function:

https://github.com/cernekee/openconnect/commit/8826e8430cf5695ae8e42ca2b81969a9ecbd00a6

Are you using this on Linux/UNIX with a wrapper script, or actually
running openconnect on Windows using the native CSD *.exe files?

Thanks.


From nmav at gnutls.org  Sun Dec  8 02:33:52 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sun, 08 Dec 2013 08:33:52 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <585F10E43CE3454B95691D0A1F56D106F4676E9290@exch2.email.eworx.se>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
 <1386434924.7734.6.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E9290@exch2.email.eworx.se>
Message-ID: <1386488032.2093.0.camel@aspire.lan>

On Sun, 2013-12-08 at 00:53 +0100, Per Juborg wrote:
> Hi,
> 
> I tested bith moving it and removing the include of net/if.h, both helped.
> 
> Then I ran in to another include in tun.c to "net/if_tun.h" that don't exist in Apple headers so I removed that one.
> 
> Now it got a bit more complicated. Can anyone make anything out of this?
> make  all-recursive
> Making all in gl
> make  all-recursive
> make[4]: Nothing to be done for `all-am'.
> Making all in src
> Making all in pcl
> make[3]: Nothing to be done for `all'.
>   CC       icmp-ping.o
> In file included from icmp-ping.c:76:
> /usr/include/netinet/ip_icmp.h:92:4: error: unknown type name 'n_short'; did you mean 'u_short'?
>                         n_short icd_id;

Try adding:
#include <netinet/in_systm.h>
before ip_icmp.h.

regards,
Nikos




From nmav at gnutls.org  Sun Dec  8 02:41:43 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sun, 08 Dec 2013 08:41:43 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
Message-ID: <1386488503.2093.5.camel@aspire.lan>

On Sun, 2013-12-08 at 03:53 +0800, Karl wrote:
> Yes, sure, ca-cert set, log shows "[main] processed 1 CA
> certificate(s)", and the cert-user-oid set to use CN too, but no luck.

Try verifying the certificate that is sent by the client manually using
certtool and the CA file. What is the output? If it is verified
correctly try enabling debugging (--tls-debug) in ocserv to pin-point
the issue, and if it is not obvious send the relevant parts of the log
here.

As I see you error is not a verification failure, but a failure of the
verification function which is quite uncommon.

regards,
Nikos




From borneo.antonio at gmail.com  Sun Dec  8 02:58:21 2013
From: borneo.antonio at gmail.com (Antonio Borneo)
Date: Sun, 8 Dec 2013 15:58:21 +0800
Subject: [PATCH] Fix --os=win
In-Reply-To: <CAJiQ=7BjdW0c29isKa4wqALOMY2MYo4ZjhGE=Rb4+Q-zJV5EtA@mail.gmail.com>
References: <1386476972-25595-1-git-send-email-borneo.antonio@gmail.com>
 <CAJiQ=7BjdW0c29isKa4wqALOMY2MYo4ZjhGE=Rb4+Q-zJV5EtA@mail.gmail.com>
Message-ID: <CAAj6DX1MKR1XmKE59Z2G6jV58iAFyUpJVWVDhYnTtaNY2oof=g@mail.gmail.com>

On Sun, Dec 8, 2013 at 12:54 PM, Kevin Cernekee <cernekee at gmail.com> wrote:
> ...
> Could you please update the comments above the function to reflect the
> new behavior?  They currently say "ignore" for the Windows csd node.

Hi Kevin,

yes, did not noticed the comment. I'm sending V2 right now

> Also, it would be good to test this in conjunction with my proposed
> Android/iOS changes, which touch the same function:
>
> https://github.com/cernekee/openconnect/commit/8826e8430cf5695ae8e42ca2b81969a9ecbd00a6

Should work until you autodetect the OS at compile time. Not sure what
happen if you add "--os=win" at runtime.

> Are you using this on Linux/UNIX with a wrapper script, or actually
> running openconnect on Windows using the native CSD *.exe files?

I'm using Linux+wrapper.

Best Regards,
Antonio


From borneo.antonio at gmail.com  Sun Dec  8 03:00:54 2013
From: borneo.antonio at gmail.com (Antonio Borneo)
Date: Sun,  8 Dec 2013 16:00:54 +0800
Subject: [PATCH V2] Fix --os=win
Message-ID: <1386489654-28432-1-git-send-email-borneo.antonio@gmail.com>

Signed-off-by: Antonio Borneo <borneo.antonio at gmail.com>
---

V1 -> V2: modify comments above function parse_auth_node()

 auth.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/auth.c b/auth.c
index f28e350..88ee0f1 100644
--- a/auth.c
+++ b/auth.c
@@ -367,9 +367,9 @@ static int xmlnode_get_text(xmlNode *xml_node, const char *name, char **var)
  *   <title><!-- title to display to user --></title>
  *   <csd token="<!-- save to vpninfo->csd_token -->"
  *        ticket="<!-- save to vpninfo->csd_ticket -->" />
- *   <csd stuburl="<!-- ignore -->"
- *        starturl="<!-- ignore -->"
- *        waiturl="<!-- ignore -->"
+ *   <csd stuburl="<!-- save to vpninfo->csd_stuburl when "--os=win" -->"
+ *        starturl="<!-- save to vpninfo->csd_starturl when "--os=win" -->"
+ *        waiturl="<!-- save to vpninfo->csd_waiturl when "--os=win" -->"
  *   <csdMac
  *           stuburl="<!-- save to vpninfo->csd_stuburl on Mac only -->"
  *           starturl="<!-- save to vpninfo->csd_starturl on Mac only -->"
@@ -454,7 +454,8 @@ static int parse_auth_node(struct openconnect_info *vpninfo, xmlNode *xml_node,
 		} else if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, "csd")) {
 			xmlnode_get_prop(xml_node, "token", &vpninfo->csd_token);
 			xmlnode_get_prop(xml_node, "ticket", &vpninfo->csd_ticket);
-		} else if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, vpninfo->csd_xmltag)) {
+		}
+		if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, vpninfo->csd_xmltag)) {
 			xmlnode_get_prop(xml_node, "stuburl", &vpninfo->csd_stuburl);
 			xmlnode_get_prop(xml_node, "starturl", &vpninfo->csd_starturl);
 			xmlnode_get_prop(xml_node, "waiturl", &vpninfo->csd_waiturl);
-- 
1.7.3.4



From borneo.antonio at gmail.com  Sun Dec  8 03:27:10 2013
From: borneo.antonio at gmail.com (Antonio Borneo)
Date: Sun, 8 Dec 2013 16:27:10 +0800
Subject: [PATCH V2] Fix --os=win
In-Reply-To: <1386489654-28432-1-git-send-email-borneo.antonio@gmail.com>
References: <1386489654-28432-1-git-send-email-borneo.antonio@gmail.com>
Message-ID: <CAAj6DX0wvA9MzXuqOSeB5=PmhZFc1Qk4kfevsOsHFJGmEZ46YA@mail.gmail.com>

Sorry, please skip this V2.
By mistake I removed the commit message.
I'm sending V3 ...

Antonio


From borneo.antonio at gmail.com  Sun Dec  8 03:32:55 2013
From: borneo.antonio at gmail.com (Antonio Borneo)
Date: Sun,  8 Dec 2013 16:32:55 +0800
Subject: [PATCH V3] Fix --os=win
Message-ID: <1386491575-29179-1-git-send-email-borneo.antonio@gmail.com>

Running OpenConnect with flag "--os=win" we get
        vpninfo->csd_xmltag == "csd"
In fact, in library.c we have:
     85         else if (!strcmp(os, "win"))
     86                 vpninfo->csd_xmltag = "csd";

In current code, the case (vpninfo->csd_xmltag == "csd") is
grabbed by previous "else if()" condition and not evaluated
anymore to extract "stuburl", "starturl" and "waiturl".

Split the "else if" in independent statement.
Modify comment above the function.

Signed-off-by: Antonio Borneo <borneo.antonio at gmail.com>
---

V1 -> V2: modify comments above function parse_auth_node()
V2 -> V3: recover commit message

 auth.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/auth.c b/auth.c
index f28e350..88ee0f1 100644
--- a/auth.c
+++ b/auth.c
@@ -367,9 +367,9 @@ static int xmlnode_get_text(xmlNode *xml_node, const char *name, char **var)
  *   <title><!-- title to display to user --></title>
  *   <csd token="<!-- save to vpninfo->csd_token -->"
  *        ticket="<!-- save to vpninfo->csd_ticket -->" />
- *   <csd stuburl="<!-- ignore -->"
- *        starturl="<!-- ignore -->"
- *        waiturl="<!-- ignore -->"
+ *   <csd stuburl="<!-- save to vpninfo->csd_stuburl when "--os=win" -->"
+ *        starturl="<!-- save to vpninfo->csd_starturl when "--os=win" -->"
+ *        waiturl="<!-- save to vpninfo->csd_waiturl when "--os=win" -->"
  *   <csdMac
  *           stuburl="<!-- save to vpninfo->csd_stuburl on Mac only -->"
  *           starturl="<!-- save to vpninfo->csd_starturl on Mac only -->"
@@ -454,7 +454,8 @@ static int parse_auth_node(struct openconnect_info *vpninfo, xmlNode *xml_node,
 		} else if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, "csd")) {
 			xmlnode_get_prop(xml_node, "token", &vpninfo->csd_token);
 			xmlnode_get_prop(xml_node, "ticket", &vpninfo->csd_ticket);
-		} else if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, vpninfo->csd_xmltag)) {
+		}
+		if (!vpninfo->csd_scriptname && xmlnode_is_named(xml_node, vpninfo->csd_xmltag)) {
 			xmlnode_get_prop(xml_node, "stuburl", &vpninfo->csd_stuburl);
 			xmlnode_get_prop(xml_node, "starturl", &vpninfo->csd_starturl);
 			xmlnode_get_prop(xml_node, "waiturl", &vpninfo->csd_waiturl);
-- 
1.7.3.4



From weeker at outlook.com  Sun Dec  8 10:35:42 2013
From: weeker at outlook.com (Karl)
Date: Sun, 8 Dec 2013 23:35:42 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <1386488503.2093.5.camel@aspire.lan>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
Message-ID: <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>

certtool --verify --load-ca-certificate ca-cert.pem --infile user-cert.pem
Chain verification output: Verified. The certificate is trusted.

I found it quite different between iOS and Android AnyConnect client,
both failed to connect, but Android looks go further, iOS always
prompts username, Android will prompt password after input username.

Android client's log: http://pastebin.com/VxubQJQv
iOS client's log: http://pastebin.com/XNYK6iRk

On Sun, Dec 8, 2013 at 3:41 PM, Nikos Mavrogiannopoulos <nmav at gnutls.org> wrote:
> On Sun, 2013-12-08 at 03:53 +0800, Karl wrote:
>> Yes, sure, ca-cert set, log shows "[main] processed 1 CA
>> certificate(s)", and the cert-user-oid set to use CN too, but no luck.
>
> Try verifying the certificate that is sent by the client manually using
> certtool and the CA file. What is the output? If it is verified
> correctly try enabling debugging (--tls-debug) in ocserv to pin-point
> the issue, and if it is not obvious send the relevant parts of the log
> here.
>
> As I see you error is not a verification failure, but a failure of the
> verification function which is quite uncommon.
>
> regards,
> Nikos
>
>


From nmav at gnutls.org  Sun Dec  8 13:01:24 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sun, 08 Dec 2013 19:01:24 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
Message-ID: <1386525684.10056.7.camel@aspire.lan>

On Sun, 2013-12-08 at 23:35 +0800, Karl wrote:
> certtool --verify --load-ca-certificate ca-cert.pem --infile user-cert.pem
> Chain verification output: Verified. The certificate is trusted.
> 
> I found it quite different between iOS and Android AnyConnect client,
> both failed to connect, but Android looks go further, iOS always
> prompts username, Android will prompt password after input username.
> Android client's log: http://pastebin.com/VxubQJQv

That client would only work with the ocserv version in the repository.

> iOS client's log: http://pastebin.com/XNYK6iRk

Here I see the following on the client's connection:
> ocserv[13876]: TLS[<4>]: REC[0x87d11c0]: Alert[2|46] - Unknown
certificate - was received

Meaning that the client alerted that it doesn't like (trust) the server
certificate. Could that be the issue?

> ocserv[13879]: TLS[<2>]: ASSERT: cert.c:1094
> ocserv[13879]: [MYIP]:55974 error verifying client certificate

The client sent no certificate for some reason. That most likely would
be (a) because of the reason above, or (b) because the ca-cert set
doesn't match the client's issuer CA.

I'd suggest to use the version in git as well, and try capturing the
traffic with wireshark and send it to me (also the client's
certificate). With that I could rule out case b.

regards,
Nikos




From weeker at outlook.com  Sun Dec  8 14:23:15 2013
From: weeker at outlook.com (Karl)
Date: Mon, 9 Dec 2013 03:23:15 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <1386525684.10056.7.camel@aspire.lan>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
Message-ID: <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>

Tried to check all the possibilities, with no luck. You mean capturing
the traffic with wireshark on server side? Is there any simple
instruction to do capture work? Thanks.

On Mon, Dec 9, 2013 at 2:01 AM, Nikos Mavrogiannopoulos <nmav at gnutls.org> wrote:
> On Sun, 2013-12-08 at 23:35 +0800, Karl wrote:
>> certtool --verify --load-ca-certificate ca-cert.pem --infile user-cert.pem
>> Chain verification output: Verified. The certificate is trusted.
>>
>> I found it quite different between iOS and Android AnyConnect client,
>> both failed to connect, but Android looks go further, iOS always
>> prompts username, Android will prompt password after input username.
>> Android client's log: http://pastebin.com/VxubQJQv
>
> That client would only work with the ocserv version in the repository.
>
>> iOS client's log: http://pastebin.com/XNYK6iRk
>
> Here I see the following on the client's connection:
>> ocserv[13876]: TLS[<4>]: REC[0x87d11c0]: Alert[2|46] - Unknown
> certificate - was received
>
> Meaning that the client alerted that it doesn't like (trust) the server
> certificate. Could that be the issue?
>
>> ocserv[13879]: TLS[<2>]: ASSERT: cert.c:1094
>> ocserv[13879]: [MYIP]:55974 error verifying client certificate
>
> The client sent no certificate for some reason. That most likely would
> be (a) because of the reason above, or (b) because the ca-cert set
> doesn't match the client's issuer CA.
>
> I'd suggest to use the version in git as well, and try capturing the
> traffic with wireshark and send it to me (also the client's
> certificate). With that I could rule out case b.
>
> regards,
> Nikos
>
>


From per at juborg.nu  Sun Dec  8 18:02:20 2013
From: per at juborg.nu (Per Juborg)
Date: Mon, 9 Dec 2013 00:02:20 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <1386488032.2093.0.camel@aspire.lan>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
 <1386434924.7734.6.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E9290@exch2.email.eworx.se>
 <1386488032.2093.0.camel@aspire.lan>
Message-ID: <585F10E43CE3454B95691D0A1F56D106F4676E92A3@exch2.email.eworx.se>

Hi,

The story continues,

I added the include, I also had to add netinet/ip.h 

The this shows up:
  CC       icmp-ping.o
icmp-ping.c:229:44: error: incomplete definition of type 'struct iphdr'
                                pkt = (struct icmp *) (packet1 + (iphdr->ihl << 2));    /* skip ip hdr */
                                                                  ~~~~~^
icmp-ping.c:227:12: note: forward declaration of 'struct iphdr'
                                struct iphdr *iphdr =
                                       ^
icmp-ping.c:233:33: error: use of undeclared identifier 'ICMP_DEST_UNREACH'
                                        else if (pkt->icmp_type == ICMP_DEST_UNREACH)
                                                                   ^
icmp-ping.c:299:23: error: use of undeclared identifier 'SOL_RAW'
        setsockopt(pingsock, SOL_RAW, IPV6_CHECKSUM,
                             ^
icmp-ping.c:339:34: error: use of undeclared identifier 'ICMP_DEST_UNREACH'
                                        else if (pkt->icmp6_type == ICMP_DEST_UNREACH)
                                                                    ^
4 errors generated.


/Per

-----Original Message-----
From: Nikos Mavrogiannopoulos [mailto:n.mavrogiannopoulos at gmail.com] On Behalf Of Nikos Mavrogiannopoulos
Sent: den 8 december 2013 08:34
To: Per Juborg
Cc: openconnect-devel at lists.infradead.org
Subject: Re: Error building ocserv 0.2.2

On Sun, 2013-12-08 at 00:53 +0100, Per Juborg wrote:
> Hi,
> 
> I tested bith moving it and removing the include of net/if.h, both helped.
> 
> Then I ran in to another include in tun.c to "net/if_tun.h" that don't exist in Apple headers so I removed that one.
> 
> Now it got a bit more complicated. Can anyone make anything out of this?
> make  all-recursive
> Making all in gl
> make  all-recursive
> make[4]: Nothing to be done for `all-am'.
> Making all in src
> Making all in pcl
> make[3]: Nothing to be done for `all'.
>   CC       icmp-ping.o
> In file included from icmp-ping.c:76:
> /usr/include/netinet/ip_icmp.h:92:4: error: unknown type name 'n_short'; did you mean 'u_short'?
>                         n_short icd_id;

Try adding:
#include <netinet/in_systm.h>
before ip_icmp.h.

regards,
Nikos



From nmav at gnutls.org  Mon Dec  9 04:09:04 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Mon, 9 Dec 2013 10:09:04 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
Message-ID: <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>

On Sun, Dec 8, 2013 at 8:23 PM, Karl <weeker at outlook.com> wrote:
> Tried to check all the possibilities, with no luck. You mean capturing
> the traffic with wireshark on server side? Is there any simple
> instruction to do capture work? Thanks.

Could you please elaborate on what you tried and what was the outcome?
How did you fix the untrusted certificate by the client? After that
was fixed, did you try with the ocserv version in git? Did that change
anything in the logs?

regards,
Nikos


From nmav at gnutls.org  Mon Dec  9 04:28:29 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Mon, 9 Dec 2013 10:28:29 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <585F10E43CE3454B95691D0A1F56D106F4676E92A3@exch2.email.eworx.se>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
 <1386434924.7734.6.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E9290@exch2.email.eworx.se>
 <1386488032.2093.0.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E92A3@exch2.email.eworx.se>
Message-ID: <CAJU7zaJ5MTGS89qPGmRYo99YH9JkVTSTWjFPiEE6d9PPGB4kFg@mail.gmail.com>

On Mon, Dec 9, 2013 at 12:02 AM, Per Juborg <per at juborg.nu> wrote:
> Hi,
>
> The story continues,
>
> I added the include, I also had to add netinet/ip.h
>
> The this shows up:
>   CC       icmp-ping.o
> icmp-ping.c:229:44: error: incomplete definition of type 'struct iphdr'
>                                 pkt = (struct icmp *) (packet1 + (iphdr->ihl << 2));    /* skip ip hdr */
>                                                                   ~~~~~^

Most probably you need something like the attached patch (which is untested).

regards,
Nikos
-------------- next part --------------
diff --git a/src/icmp-ping.c b/src/icmp-ping.c
index bd39ad7..a7326f6 100644
--- a/src/icmp-ping.c
+++ b/src/icmp-ping.c
@@ -77,6 +77,7 @@
 # include <netinet/in_systm.h>
 #endif
 #include <netinet/ip_icmp.h>
+#include <netinet/ip.h>
 #include <netinet/icmp6.h>
 #include <sys/select.h>
 #include <sys/time.h>
@@ -225,9 +226,13 @@ int icmp_ping4(main_server_st * s, struct sockaddr_in *addr1,
 			    (SA_IN_P(&from), SA_IN_P(addr2),
 			     SA_IN_SIZE(sizeof(*addr2))) == 0) {
 
+#ifdef HAVE_STRUCT_IPHDR_IHL
 				struct iphdr *iphdr =
 				    (struct iphdr *) packet1;
 				pkt = (struct icmp *) (packet1 + (iphdr->ihl << 2));	/* skip ip hdr */
+#else
+				pkt = (struct icmp *) (packet1 + ((packet[0] & 0x0f) << 2));	/* skip ip hdr */
+#endif
 				if (pkt->icmp_id == id1 || pkt->icmp_id == id2) {
 					if (pkt->icmp_type == ICMP_ECHOREPLY)
 						gotreply++;

From weeker at outlook.com  Mon Dec  9 12:12:25 2013
From: weeker at outlook.com (Karl)
Date: Tue, 10 Dec 2013 01:12:25 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
Message-ID: <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>

I always use the git version to keep it updated ;) I got no fixed on
these, still failed to connect. The iOS client seems more insane, so I
test it on Android, when input the password, the client said: "gateway
rejected the connection attempt.", debug log like:

ocserv[22901]: [MYIP]:36190 accepted connection
ocserv[22901]: [MYIP]:36190 client certificate verification succeeded
ocserv[22901]: [MYIP]:36190 TLS handshake completed
ocserv[22892]: [MYIP]:36190 auth init for user 'user' from '[MYIP]:36190'
ocserv[22901]: [MYIP]:36190 sending auth request
ocserv[22892]: [MYIP]:36190 auth req for user 'user'
ocserv[22892]: [MYIP]:36190 accepting user 'user'
ocserv[22892]: [MYIP]:36190 auth deinit for user 'user'
ocserv[22892]: [MYIP]:36190 Selected IP: [10.10.11.192]:0
ocserv[22892]: [MYIP]:36190 assigning tun device vpns0
ocserv[22892]: [MYIP]:36190 user 'user' of group '[unknown]' authenticated
ocserv[22901]: [MYIP]:36190 User 'user' logged in
ocserv[22904]: [MYIP]:36191 accepted connection
ocserv[22904]: [MYIP]:36191 error verifying client certificate: No
certificate was found.
ocserv[22904]: [MYIP]:36191 TLS handshake completed
ocserv[22892]: [MYIP]:36191 command socket closed
ocserv[22905]: [MYIP]:36192 accepted connection
ocserv[22905]: [MYIP]:36192 error verifying client certificate: No
certificate was found.
ocserv[22905]: [MYIP]:36192 TLS handshake completed
ocserv[22905]: [MYIP]:36192 sending cookie authentication request
ocserv[22892]: [MYIP]:36192 failed authentication attempt for user 'user'
ocserv[22905]: [MYIP]:36192 failed cookie authentication attempt
ocserv[22892]: [MYIP]:36192 command socket closed
ocserv[22892]: [MYIP]:36190 command socket closed

On Mon, Dec 9, 2013 at 5:09 PM, Nikos Mavrogiannopoulos <nmav at gnutls.org> wrote:
> On Sun, Dec 8, 2013 at 8:23 PM, Karl <weeker at outlook.com> wrote:
>> Tried to check all the possibilities, with no luck. You mean capturing
>> the traffic with wireshark on server side? Is there any simple
>> instruction to do capture work? Thanks.
>
> Could you please elaborate on what you tried and what was the outcome?
> How did you fix the untrusted certificate by the client? After that
> was fixed, did you try with the ocserv version in git? Did that change
> anything in the logs?
>
> regards,
> Nikos


From nmav at gnutls.org  Mon Dec  9 13:48:08 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Mon, 09 Dec 2013 19:48:08 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
Message-ID: <1386614888.24726.3.camel@aspire.lan>

On Tue, 2013-12-10 at 01:12 +0800, Karl wrote:
> I always use the git version to keep it updated ;) I got no fixed on
> these, still failed to connect. The iOS client seems more insane, so I
> test it on Android, when input the password, the client said: "gateway
> rejected the connection attempt.", debug log like:
> ocserv[22905]: [MYIP]:36192 TLS handshake completed
> ocserv[22905]: [MYIP]:36192 sending cookie authentication request
> ocserv[22892]: [MYIP]:36192 failed authentication attempt for user 'user'
> ocserv[22905]: [MYIP]:36192 failed cookie authentication attempt

Could you try again with the latest version?

regards,
Nikos




From weeker at outlook.com  Mon Dec  9 15:11:33 2013
From: weeker at outlook.com (Karl)
Date: Tue, 10 Dec 2013 04:11:33 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <1386614888.24726.3.camel@aspire.lan>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
Message-ID: <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>

No luck.

ocserv[13872]: [main] processed 1 CA certificate(s)
ocserv[13872]: [main] initialized ocserv 0.2.3
ocserv[13874]: [MYIP]:37080 accepted connection
ocserv[13874]: [MYIP]:37080 client certificate verification succeeded
ocserv[13873]: sec-mod received request from pid 13874 and uid 65534
ocserv[13874]: [MYIP]:37080 TLS handshake completed
ocserv[13872]: [MYIP]:37080 auth init for user 'user' from '[MYIP]:37080'
ocserv[13874]: [MYIP]:37080 sending auth request
ocserv[13872]: [MYIP]:37080 auth req for user 'user'
ocserv[13872]: [MYIP]:37080 accepting user 'user'
ocserv[13872]: [MYIP]:37080 auth deinit for user 'user'
ocserv[13872]: [MYIP]:37080 Selected IP: [10.10.11.192]:0
ocserv[13872]: [MYIP]:37080 assigned IPv4: [10.10.11.193]:0
ocserv[13872]: [MYIP]:37080 assigning tun device vpns0
ocserv[13872]: [MYIP]:37080 user 'user' of group '[unknown]' authenticated
ocserv[13874]: [MYIP]:37080 User 'user' logged in
ocserv[13877]: [MYIP]:37081 accepted connection
ocserv[13877]: [MYIP]:37081 error verifying client certificate: No
certificate was found.
ocserv[13873]: sec-mod received request from pid 13877 and uid 65534
ocserv[13877]: [MYIP]:37081 TLS handshake completed
ocserv[13872]: [MYIP]:37081 command socket closed
ocserv[13878]: [MYIP]:37082 accepted connection
ocserv[13878]: [MYIP]:37082 error verifying client certificate: No
certificate was found.
ocserv[13873]: sec-mod received request from pid 13878 and uid 65534
ocserv[13878]: [MYIP]:37082 TLS handshake completed
ocserv[13878]: [MYIP]:37082 sending cookie authentication request
ocserv[13872]: [MYIP]:37082 user 'user' presented a certificate from user ''
ocserv[13872]: [MYIP]:37082 failed authentication attempt for user 'user'
ocserv[13878]: [MYIP]:37082 recv_auth_reply: unexpected command
ocserv[13878]: [MYIP]:37082 error receiving cookie authentication reply
ocserv[13878]: [MYIP]:37082 failed cookie authentication attempt
ocserv[13872]: [MYIP]:37082 command socket closed
ocserv[13872]: [MYIP]:37080 command socket closed

On Tue, Dec 10, 2013 at 2:48 AM, Nikos Mavrogiannopoulos
<nmav at gnutls.org> wrote:
> On Tue, 2013-12-10 at 01:12 +0800, Karl wrote:
>> I always use the git version to keep it updated ;) I got no fixed on
>> these, still failed to connect. The iOS client seems more insane, so I
>> test it on Android, when input the password, the client said: "gateway
>> rejected the connection attempt.", debug log like:
>> ocserv[22905]: [MYIP]:36192 TLS handshake completed
>> ocserv[22905]: [MYIP]:36192 sending cookie authentication request
>> ocserv[22892]: [MYIP]:36192 failed authentication attempt for user 'user'
>> ocserv[22905]: [MYIP]:36192 failed cookie authentication attempt
>
> Could you try again with the latest version?
>
> regards,
> Nikos
>
>


From per at juborg.nu  Mon Dec  9 15:41:08 2013
From: per at juborg.nu (Per Juborg)
Date: Mon, 9 Dec 2013 21:41:08 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <CAJU7zaJ5MTGS89qPGmRYo99YH9JkVTSTWjFPiEE6d9PPGB4kFg@mail.gmail.com>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
 <1386434924.7734.6.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E9290@exch2.email.eworx.se>
 <1386488032.2093.0.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E92A3@exch2.email.eworx.se>
 <CAJU7zaJ5MTGS89qPGmRYo99YH9JkVTSTWjFPiEE6d9PPGB4kFg@mail.gmail.com>
Message-ID: <585F10E43CE3454B95691D0A1F56D106F4676E92B3@exch2.email.eworx.se>

Hi,

I've moved on to Ocserv 0.2.3 from git.

After running autoreconf and configure, make gives me this:

clang: warning: argument unused during compilation: '-R/usr/local/lib'
  CC       main.o
main.c:715:7: warning: 'daemon' is deprecated: first deprecated in OS X 10.5 [-Wdeprecated-declarations]
                if (daemon(0, 0) == -1) {
                    ^
/usr/include/stdlib.h:292:6: note: 'daemon' declared here
int      daemon(int, int) __DARWIN_1050(daemon) __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_0, __MAC_10_5...
         ^
1 warning generated.
  CC       main-auth.o
  CC       worker-vpn.o
worker-vpn.c:996:46: error: use of undeclared identifier 'SO_PRIORITY'
                ret = setsockopt( ws->conn_fd, SOL_SOCKET, SO_PRIORITY, &l, sizeof(l));
                                                           ^
worker-vpn.c:1055:46: error: use of undeclared identifier 'SO_PRIORITY'
                        ret = setsockopt( ws->udp_fd, SOL_SOCKET, SO_PRIORITY, &l, sizeof(l));
                                                                  ^
2 errors generated.

/Per

-----Original Message-----
From: n.mavrogiannopoulos at gmail.com [mailto:n.mavrogiannopoulos at gmail.com] On Behalf Of Nikos Mavrogiannopoulos
Sent: den 9 december 2013 10:28
To: Per Juborg
Cc: openconnect-devel at lists.infradead.org
Subject: Re: Error building ocserv 0.2.2

On Mon, Dec 9, 2013 at 12:02 AM, Per Juborg <per at juborg.nu> wrote:
> Hi,
>
> The story continues,
>
> I added the include, I also had to add netinet/ip.h
>
> The this shows up:
>   CC       icmp-ping.o
> icmp-ping.c:229:44: error: incomplete definition of type 'struct iphdr'
>                                 pkt = (struct icmp *) (packet1 + (iphdr->ihl << 2));    /* skip ip hdr */
>                                                                   ~~~~~^

Most probably you need something like the attached patch (which is untested).

regards,
Nikos

From nmav at gnutls.org  Mon Dec  9 16:14:19 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Mon, 09 Dec 2013 22:14:19 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
 <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
Message-ID: <1386623659.4155.0.camel@aspire.lan>

On Tue, 2013-12-10 at 04:11 +0800, Karl wrote:
> No luck.
> error verifying client certificate: No
> certificate was found.
> ocserv[13873]: sec-mod received request from pid 13878 and uid 65534
> ocserv[13878]: [MYIP]:37082 TLS handshake completed
> ocserv[13878]: [MYIP]:37082 sending cookie authentication request
> ocserv[13872]: [MYIP]:37082 user 'user' presented a certificate from user ''

I think we are getting closer though (you may try again).

regards,
Nikos




From nmav at gnutls.org  Mon Dec  9 16:16:40 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Mon, 09 Dec 2013 22:16:40 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <585F10E43CE3454B95691D0A1F56D106F4676E92B3@exch2.email.eworx.se>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
 <1386434924.7734.6.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E9290@exch2.email.eworx.se>
 <1386488032.2093.0.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E92A3@exch2.email.eworx.se>
 <CAJU7zaJ5MTGS89qPGmRYo99YH9JkVTSTWjFPiEE6d9PPGB4kFg@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E92B3@exch2.email.eworx.se>
Message-ID: <1386623800.4155.2.camel@aspire.lan>

On Mon, 2013-12-09 at 21:41 +0100, Per Juborg wrote:

> 1 warning generated.
>   CC       main-auth.o
>   CC       worker-vpn.o
> worker-vpn.c:996:46: error: use of undeclared identifier 'SO_PRIORITY'
>                 ret = setsockopt( ws->conn_fd, SOL_SOCKET, SO_PRIORITY, &l, sizeof(l));
>                                                            ^
> worker-vpn.c:1055:46: error: use of undeclared identifier 'SO_PRIORITY'
>                         ret = setsockopt( ws->udp_fd, SOL_SOCKET, SO_PRIORITY, &l, sizeof(l));

Hello Per,
 I've moved that to conditional. However, is there any way to set
priority (for IP or just internally in the sockets) in that system?

regards,
Nikos




From per at juborg.nu  Mon Dec  9 16:48:54 2013
From: per at juborg.nu (Per Juborg)
Date: Mon, 9 Dec 2013 22:48:54 +0100
Subject: Error building ocserv 0.2.2
In-Reply-To: <1386623800.4155.2.camel@aspire.lan>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9286@exch2.email.eworx.se>
 <CAJU7zaKLnXka361wxJDfzhU_P0dxV9o_r3+Rdi4vkLTx9CDz7w@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E928B@exch2.email.eworx.se>
 <1386434924.7734.6.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E9290@exch2.email.eworx.se>
 <1386488032.2093.0.camel@aspire.lan>
 <585F10E43CE3454B95691D0A1F56D106F4676E92A3@exch2.email.eworx.se>
 <CAJU7zaJ5MTGS89qPGmRYo99YH9JkVTSTWjFPiEE6d9PPGB4kFg@mail.gmail.com>
 <585F10E43CE3454B95691D0A1F56D106F4676E92B3@exch2.email.eworx.se>
 <1386623800.4155.2.camel@aspire.lan>
Message-ID: <CC4DDDE6-200A-44AE-98A0-7802AA216172@juborg.nu>

Hi

I googled SO_PRIORITY an found iut that it'snot supported :(

I'll test compiling tomorrow

/Per

> 9 dec 2013 kl. 22:16 skrev "Nikos Mavrogiannopoulos" <nmav at gnutls.org>:
> 
>> On Mon, 2013-12-09 at 21:41 +0100, Per Juborg wrote:
>> 
>> 1 warning generated.
>>  CC       main-auth.o
>>  CC       worker-vpn.o
>> worker-vpn.c:996:46: error: use of undeclared identifier 'SO_PRIORITY'
>>                ret = setsockopt( ws->conn_fd, SOL_SOCKET, SO_PRIORITY, &l, sizeof(l));
>>                                                           ^
>> worker-vpn.c:1055:46: error: use of undeclared identifier 'SO_PRIORITY'
>>                        ret = setsockopt( ws->udp_fd, SOL_SOCKET, SO_PRIORITY, &l, sizeof(l));
> 
> Hello Per,
> I've moved that to conditional. However, is there any way to set
> priority (for IP or just internally in the sockets) in that system?
> 
> regards,
> Nikos
> 
> 


From weeker at outlook.com  Mon Dec  9 17:04:50 2013
From: weeker at outlook.com (Karl)
Date: Tue, 10 Dec 2013 06:04:50 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <1386623659.4155.0.camel@aspire.lan>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
 <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
 <1386623659.4155.0.camel@aspire.lan>
Message-ID: <CAFuxyaER80yj7S5giRRRHPNe4QP_82hpKez0Thv7b0f5OkBWSw@mail.gmail.com>

That works great on Android now. Thanks, Nikos.

On iOS client, it still fails at infinite username prompt, log:

ocserv[14809]: [MYIP]:61337 accepted connection
ocserv[14809]: GnuTLS error (at worker-vpn.c:571): The TLS connection
was non-properly terminated.
ocserv[14807]: [MYIP]:61337 command socket closed

tls-debug log: http://pastebin.com/9SAjZJ79

iOS client complains : No valid certificates available for
authentication. Which Cisco doc said: "The secure gateway did not
accept any of the certificates AnyConnect provided. No more
certificates remain."

On Tue, Dec 10, 2013 at 5:14 AM, Nikos Mavrogiannopoulos
<nmav at gnutls.org> wrote:
> On Tue, 2013-12-10 at 04:11 +0800, Karl wrote:
>> No luck.
>> error verifying client certificate: No
>> certificate was found.
>> ocserv[13873]: sec-mod received request from pid 13878 and uid 65534
>> ocserv[13878]: [MYIP]:37082 TLS handshake completed
>> ocserv[13878]: [MYIP]:37082 sending cookie authentication request
>> ocserv[13872]: [MYIP]:37082 user 'user' presented a certificate from user ''
>
> I think we are getting closer though (you may try again).
>
> regards,
> Nikos
>
>


From cernekee at gmail.com  Mon Dec  9 19:24:09 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Mon, 9 Dec 2013 16:24:09 -0800
Subject: [GIT PULL V4] JNI bindings for libopenconnect
In-Reply-To: <CAJU7zaKhCYru68Vbd=N5bd5wBuvyeDF+KeDRDK3Ag0F+gyoDhw@mail.gmail.com>
References: <1383510172-17953-1-git-send-email-cernekee@gmail.com>
 <CAJU7zaKhCYru68Vbd=N5bd5wBuvyeDF+KeDRDK3Ag0F+gyoDhw@mail.gmail.com>
Message-ID: <CAJiQ=7ATKFOG3jENWHJhSC4kFM8x-q5HF9SJz7HjVA6bR3kGaA@mail.gmail.com>

On Mon, Nov 4, 2013 at 7:38 AM, Nikos Mavrogiannopoulos
<n.mavrogiannopoulos at gmail.com> wrote:
> On Sun, Nov 3, 2013 at 9:22 PM, Kevin Cernekee <cernekee at gmail.com> wrote:
>
>> The modified ics-openvpn Android app has been tested on ARMv7, x86, and
>> MIPS devices.  It is able to connect to ocserv and ping through the VPN on
>> all architectures.
>
> Thanks for the app it is really useful.
>
>> I sometimes see intermittent errors logged on the ocserv side:
>>     ocserv[25459]: [main] DTLS record version: 1.0
>>     ocserv[25459]: [main] DTLS hello version: 220.94
>>     ocserv[25459]: [main] unexpected DTLS content type: 23
>>     ocserv[25459]: [main] could not determine the owner of received UDP packet
>
> Do you have an idea of when this is received? Is it after a client has
> terminated? In ocserv the main process receives the first DTLS packet
> (client hello) and forwards it to the relevant process (in a complex
> process - as connecting on UDP cannot be handled as nicely as TCP).
> The error that you see means that the main process received a DTLS
> packet that isn't a client hello (23 is application data), which was
> probably intended to be delivered to a worker process.
>
> Thus either you received a duplicate/delayed packet after a worker has
> disconnected, or the UDP socket connection to a worker process was
> lost for some reason and UDP packets are being forwarded to the main
> process instead.

Hmm, OK.  I don't have an easy way to reproduce this, but I did see it
again running the latest ocserv code from a few days ago.  If I get a
better log I'll post it.

I also saw another issue:

ocserv[4080]: [192.168.0.10]:42559 have not received TCP DPD for long (906 secs)
ocserv[4080]: [192.168.0.10]:42559 TCP MSS is 1435
ocserv[4080]: [192.168.0.10]:42559 received 32 byte(s) (TLS)
ocserv[4080]: [192.168.0.10]:42559 received BYE packet; exiting
ocserv[3003]: [192.168.0.10]:42559 command socket closed

2013-12-08 12:31:27 LIB: Connected to HTTPS on 192.168.0.1
2013-12-08 12:31:31 LIB: Got CONNECT response: HTTP/1.1 200 CONNECTED
2013-12-08 12:31:31 LIB: CSTP connected. DPD 440, Keepalive 32400
2013-12-08 12:31:31 LIB: DTLS got write error: The specified session
has been invalidated for some reason.. Falling back to SSL
2013-12-08 12:31:31 LIB: Established DTLS connection (using GnuTLS)
2013-12-08 12:46:37 LIB: Unknown packet 03 54 46 01 00 3c 00 00
2013-12-08 12:46:37 LIB: Send BYE packet: Unknown packet received

It looks like periodic_check() is sending out raw 1-byte DPD commands
without the "STF\x01" magic header.  I suspect you probably want to do
something like this (compile-tested only):

diff --git a/src/worker-vpn.c b/src/worker-vpn.c
index d4edd5f..290b177 100644
--- a/src/worker-vpn.c
+++ b/src/worker-vpn.c
@@ -745,8 +745,7 @@ int max, e, ret;
        }
        if (now-ws->last_msg_tcp > DPD_TRIES*ws->config->dpd) {
                oclog(ws, LOG_ERR, "have not received TCP DPD for long
(%d secs)", (int)(now-ws->last_msg_tcp));
-               ws->buffer[0] = AC_PKT_DPD_OUT;
-               tls_send(ws->session, ws->buffer, 1);
+               tls_send(ws->session, "STF\x01\x00\x00\x03\x00", 8);

                if (now-ws->last_msg_tcp > DPD_MAX_TRIES*ws->config->dpd) {
                        oclog(ws, LOG_ERR, "have not received TCP DPD
for very long; tearing down connection");


Also, cstp_mainloop() in libopenconnect can rely on stale or
uninitialized data if cstp_read() returns a malformed (short) packet.
In this case it only received "\x03" from ocserv, but it erroneously
displayed buf[1..7] left over from a previous read, obfuscating the
source of the problem.


From n.mavrogiannopoulos at gmail.com  Tue Dec 10 02:40:28 2013
From: n.mavrogiannopoulos at gmail.com (Nikos Mavrogiannopoulos)
Date: Tue, 10 Dec 2013 08:40:28 +0100
Subject: [GIT PULL V4] JNI bindings for libopenconnect
In-Reply-To: <CAJiQ=7ATKFOG3jENWHJhSC4kFM8x-q5HF9SJz7HjVA6bR3kGaA@mail.gmail.com>
References: <1383510172-17953-1-git-send-email-cernekee@gmail.com>
 <CAJU7zaKhCYru68Vbd=N5bd5wBuvyeDF+KeDRDK3Ag0F+gyoDhw@mail.gmail.com>
 <CAJiQ=7ATKFOG3jENWHJhSC4kFM8x-q5HF9SJz7HjVA6bR3kGaA@mail.gmail.com>
Message-ID: <CAJU7zaJ+_F2qjtpyfdMXvLs6jOaWjaDSLdwTy7ZpmydXHqJ5_Q@mail.gmail.com>

On Tue, Dec 10, 2013 at 1:24 AM, Kevin Cernekee <cernekee at gmail.com> wrote:

>> Thus either you received a duplicate/delayed packet after a worker has
>> disconnected, or the UDP socket connection to a worker process was
>> lost for some reason and UDP packets are being forwarded to the main
>> process instead.
> Hmm, OK.  I don't have an easy way to reproduce this, but I did see it
> again running the latest ocserv code from a few days ago.  If I get a
> better log I'll post it.

Are these errors occuring when some other even starts or stops?

> 2013-12-08 12:31:27 LIB: Connected to HTTPS on 192.168.0.1
> 2013-12-08 12:31:31 LIB: Got CONNECT response: HTTP/1.1 200 CONNECTED
> 2013-12-08 12:31:31 LIB: CSTP connected. DPD 440, Keepalive 32400
> 2013-12-08 12:31:31 LIB: DTLS got write error: The specified session
> has been invalidated for some reason.. Falling back to SSL
> 2013-12-08 12:31:31 LIB: Established DTLS connection (using GnuTLS)
> 2013-12-08 12:46:37 LIB: Unknown packet 03 54 46 01 00 3c 00 00
> 2013-12-08 12:46:37 LIB: Send BYE packet: Unknown packet received
> It looks like periodic_check() is sending out raw 1-byte DPD commands
> without the "STF\x01" magic header.  I suspect you probably want to do
> something like this (compile-tested only):

I wonder how does this worked so far. I've committed a fix, thanks.

regards,
Nikos


From nmav at gnutls.org  Tue Dec 10 02:48:25 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Tue, 10 Dec 2013 08:48:25 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaER80yj7S5giRRRHPNe4QP_82hpKez0Thv7b0f5OkBWSw@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
 <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
 <1386623659.4155.0.camel@aspire.lan>
 <CAFuxyaER80yj7S5giRRRHPNe4QP_82hpKez0Thv7b0f5OkBWSw@mail.gmail.com>
Message-ID: <CAJU7zaJmK7rhihhRt7p926179e265RY8Vu+SFRdg=xZZg2dRvg@mail.gmail.com>

On Mon, Dec 9, 2013 at 11:04 PM, Karl <weeker at outlook.com> wrote:
> That works great on Android now. Thanks, Nikos.
>
> On iOS client, it still fails at infinite username prompt, log:
>
> ocserv[14809]: [MYIP]:61337 accepted connection
> ocserv[14809]: GnuTLS error (at worker-vpn.c:571): The TLS connection
> was non-properly terminated.
> ocserv[14807]: [MYIP]:61337 command socket closed
>
> tls-debug log: http://pastebin.com/9SAjZJ79
> iOS client complains : No valid certificates available for
> authentication. Which Cisco doc said: "The secure gateway did not
> accept any of the certificates AnyConnect provided. No more
> certificates remain."

Well, I cannot tell much from the log as I don't know to which gnutls
version it corresponds to. However what I see there is the client
receiving the certificate request and (possibly) bailing out. That
could mean that the client didn't like the CA certificate that was
sent be the server (possibly it didn't correspond to its client
certificate?). Is there debugging output available on the ios client?

regards,
Nikos


From cernekee at gmail.com  Tue Dec 10 10:44:32 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Tue, 10 Dec 2013 07:44:32 -0800
Subject: [GIT PULL V4] JNI bindings for libopenconnect
In-Reply-To: <CAJU7zaJ+_F2qjtpyfdMXvLs6jOaWjaDSLdwTy7ZpmydXHqJ5_Q@mail.gmail.com>
References: <1383510172-17953-1-git-send-email-cernekee@gmail.com>
 <CAJU7zaKhCYru68Vbd=N5bd5wBuvyeDF+KeDRDK3Ag0F+gyoDhw@mail.gmail.com>
 <CAJiQ=7ATKFOG3jENWHJhSC4kFM8x-q5HF9SJz7HjVA6bR3kGaA@mail.gmail.com>
 <CAJU7zaJ+_F2qjtpyfdMXvLs6jOaWjaDSLdwTy7ZpmydXHqJ5_Q@mail.gmail.com>
Message-ID: <CAJiQ=7DXrm_35Yi=v1UgbsgwutcAZfJjX0x2DE4vpKPWF12qtQ@mail.gmail.com>

On Mon, Dec 9, 2013 at 11:40 PM, Nikos Mavrogiannopoulos
<n.mavrogiannopoulos at gmail.com> wrote:
> On Tue, Dec 10, 2013 at 1:24 AM, Kevin Cernekee <cernekee at gmail.com> wrote:
>
>>> Thus either you received a duplicate/delayed packet after a worker has
>>> disconnected, or the UDP socket connection to a worker process was
>>> lost for some reason and UDP packets are being forwarded to the main
>>> process instead.
>> Hmm, OK.  I don't have an easy way to reproduce this, but I did see it
>> again running the latest ocserv code from a few days ago.  If I get a
>> better log I'll post it.
>
> Are these errors occuring when some other even starts or stops?

Sorry, not sure on the exact circumstances.

>> 2013-12-08 12:31:27 LIB: Connected to HTTPS on 192.168.0.1
>> 2013-12-08 12:31:31 LIB: Got CONNECT response: HTTP/1.1 200 CONNECTED
>> 2013-12-08 12:31:31 LIB: CSTP connected. DPD 440, Keepalive 32400
>> 2013-12-08 12:31:31 LIB: DTLS got write error: The specified session
>> has been invalidated for some reason.. Falling back to SSL
>> 2013-12-08 12:31:31 LIB: Established DTLS connection (using GnuTLS)
>> 2013-12-08 12:46:37 LIB: Unknown packet 03 54 46 01 00 3c 00 00
>> 2013-12-08 12:46:37 LIB: Send BYE packet: Unknown packet received
>> It looks like periodic_check() is sending out raw 1-byte DPD commands
>> without the "STF\x01" magic header.  I suspect you probably want to do
>> something like this (compile-tested only):
>
> I wonder how does this worked so far. I've committed a fix, thanks.

Maybe the client-side CSTP DPD catches most of the connection
timeouts, and by the time the server-side DPD kicks in, the situation
is already hopeless?

In my case, the server-side DPD repeatedly kicks in because the client
device is sleeping and largely ignoring the requests.

The DPD/Keepalive messages have not been good for mobile battery life.
 Now I am experimenting with dropping the TCP connection, and
waking+reconnecting just often enough to keep the server from
invalidating the cookie.

BTW, another problem I noticed: if there is a stale CSTP connection
active and the client attempts to reconnect, ocserv will kill the old
connection and give the client his old IP again.  But if I close() the
CSTP connection (killall -9 openconnect), then reconnect using the
same cookie, the IP changes and this confuses openconnect.


From n.mavrogiannopoulos at gmail.com  Tue Dec 10 11:18:58 2013
From: n.mavrogiannopoulos at gmail.com (Nikos Mavrogiannopoulos)
Date: Tue, 10 Dec 2013 17:18:58 +0100
Subject: [GIT PULL V4] JNI bindings for libopenconnect
In-Reply-To: <CAJiQ=7DXrm_35Yi=v1UgbsgwutcAZfJjX0x2DE4vpKPWF12qtQ@mail.gmail.com>
References: <1383510172-17953-1-git-send-email-cernekee@gmail.com>
 <CAJU7zaKhCYru68Vbd=N5bd5wBuvyeDF+KeDRDK3Ag0F+gyoDhw@mail.gmail.com>
 <CAJiQ=7ATKFOG3jENWHJhSC4kFM8x-q5HF9SJz7HjVA6bR3kGaA@mail.gmail.com>
 <CAJU7zaJ+_F2qjtpyfdMXvLs6jOaWjaDSLdwTy7ZpmydXHqJ5_Q@mail.gmail.com>
 <CAJiQ=7DXrm_35Yi=v1UgbsgwutcAZfJjX0x2DE4vpKPWF12qtQ@mail.gmail.com>
Message-ID: <CAJU7za+gRSE1TCJ0dPhRVpzjsvgwFr=rDXCbkygEd3xXVqZaVA@mail.gmail.com>

On Tue, Dec 10, 2013 at 4:44 PM, Kevin Cernekee <cernekee at gmail.com> wrote:

> The DPD/Keepalive messages have not been good for mobile battery life.
>  Now I am experimenting with dropping the TCP connection, and
> waking+reconnecting just often enough to keep the server from
> invalidating the cookie.
>
> BTW, another problem I noticed: if there is a stale CSTP connection
> active and the client attempts to reconnect, ocserv will kill the old
> connection and give the client his old IP again.  But if I close() the
> CSTP connection (killall -9 openconnect), then reconnect using the
> same cookie, the IP changes and this confuses openconnect.

I cannot reproduce that. Could you try with the latest git? I want to
check what is the reason that the initial IP wasn't used.

regards,
Nikos


From weeker at outlook.com  Tue Dec 10 14:50:43 2013
From: weeker at outlook.com (Karl)
Date: Wed, 11 Dec 2013 03:50:43 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAJU7zaJmK7rhihhRt7p926179e265RY8Vu+SFRdg=xZZg2dRvg@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
 <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
 <1386623659.4155.0.camel@aspire.lan>
 <CAFuxyaER80yj7S5giRRRHPNe4QP_82hpKez0Thv7b0f5OkBWSw@mail.gmail.com>
 <CAJU7zaJmK7rhihhRt7p926179e265RY8Vu+SFRdg=xZZg2dRvg@mail.gmail.com>
Message-ID: <CAFuxyaFQd=GbsX7OFZj8LfOsnmRS1bAQ9z_r2+SUD7=+PKPhrA@mail.gmail.com>

Hi, Nikos, after add Digital Signature, Key Encipherment, Data
Encipherment, Certificate Sign, TLS Web Client Authentication to the
user cert, it looks *better*, I sent the logs if you have interesting
to look.

ocserv[20805]: [vpn.server.com]:49540 accepted connection
ocserv[20805]: [vpn.server.com]:49540 error verifying client
certificate: No certificate was found.
ocserv[20799]: sec-mod received request from pid 20805 and uid 65534
ocserv[20805]: [vpn.server.com]:49540 TLS handshake completed
ocserv[20805]: [vpn.server.com]:49540 no certificate provided for authentication
ocserv[20798]: [vpn.server.com]:49540 command socket closed
ocserv[20806]: [vpn.server.com]:49541 accepted connection
ocserv[20806]: [vpn.server.com]:49541 sending resumption request (fetch)
ocserv[20806]: [vpn.server.com]:49541 error verifying client
certificate: No certificate was found.
ocserv[20806]: [vpn.server.com]:49541 TLS handshake completed
ocserv[20806]: [vpn.server.com]:49541 no certificate provided for authentication
ocserv[20798]: [vpn.server.com]:49541 command socket closed
ocserv[20807]: [vpn.server.com]:49542 accepted connection
ocserv[20807]: [vpn.server.com]:49542 error verifying client
certificate: No certificate was found.
ocserv[20799]: sec-mod received request from pid 20807 and uid 65534
ocserv[20807]: [vpn.server.com]:49542 TLS handshake completed
ocserv[20798]: [vpn.server.com]:49542 command socket closed



On Tue, Dec 10, 2013 at 3:48 PM, Nikos Mavrogiannopoulos
<nmav at gnutls.org> wrote:
> On Mon, Dec 9, 2013 at 11:04 PM, Karl <weeker at outlook.com> wrote:
>> That works great on Android now. Thanks, Nikos.
>>
>> On iOS client, it still fails at infinite username prompt, log:
>>
>> ocserv[14809]: [MYIP]:61337 accepted connection
>> ocserv[14809]: GnuTLS error (at worker-vpn.c:571): The TLS connection
>> was non-properly terminated.
>> ocserv[14807]: [MYIP]:61337 command socket closed
>>
>> tls-debug log: http://pastebin.com/9SAjZJ79
>> iOS client complains : No valid certificates available for
>> authentication. Which Cisco doc said: "The secure gateway did not
>> accept any of the certificates AnyConnect provided. No more
>> certificates remain."
>
> Well, I cannot tell much from the log as I don't know to which gnutls
> version it corresponds to. However what I see there is the client
> receiving the certificate request and (possibly) bailing out. That
> could mean that the client didn't like the CA certificate that was
> sent be the server (possibly it didn't correspond to its client
> certificate?). Is there debugging output available on the ios client?
>
> regards,
> Nikos
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Logs2013-12-11iPhone03_42_59.zip
Type: application/zip
Size: 4522 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131211/2e0aa5b9/attachment.zip>

From per at juborg.nu  Tue Dec 10 16:03:55 2013
From: per at juborg.nu (Per Juborg)
Date: Tue, 10 Dec 2013 22:03:55 +0100
Subject: Error building ocserv 0.2.3 from git
Message-ID: <585F10E43CE3454B95691D0A1F56D106F4676E92C6@exch2.email.eworx.se>

Hi,

I don't really remember what I've tried, did a git pull a few minutes ago:

This is my result:
  CC       icmp-ping.o
In file included from icmp-ping.c:77:
/usr/include/netinet/ip_icmp.h:126:14: error: field has incomplete type 'struct ip'
                        struct ip idi_ip;
                                  ^
/usr/include/netinet/ip_icmp.h:126:11: note: forward declaration of 'struct ip'
                        struct ip idi_ip;
                               ^
icmp-ping.c:232:40: error: use of undeclared identifier 'packet'
                                pkt = (struct icmp *) (packet1 + ((packet[0] & 0x0f) << 2));    /* ski...
                                                                   ^
icmp-ping.c:237:33: error: use of undeclared identifier 'ICMP_DEST_UNREACH'
                                        else if (pkt->icmp_type == ICMP_DEST_UNREACH)
                                                                   ^
icmp-ping.c:303:23: error: use of undeclared identifier 'SOL_RAW'
        setsockopt(pingsock, SOL_RAW, IPV6_CHECKSUM,
                             ^
icmp-ping.c:343:34: error: use of undeclared identifier 'ICMP_DEST_UNREACH'
                                        else if (pkt->icmp6_type == ICMP_DEST_UNREACH)
                                                                    ^
5 errors generated.

My changes:
git diff
diff --git a/config.h.in b/config.h.in
index cf98738..451929f 100644
--- a/config.h.in
+++ b/config.h.in
@@ -945,9 +945,6 @@
 /* Define to a substitute value for mmap()'s MAP_ANONYMOUS flag. */
 #undef MAP_ANONYMOUS

-/* Define to 1 if your C compiler doesn't accept -c and -o together. */
-#undef NO_MINUS_C_MINUS_O
-
 /* Define this if optional arguments are disallowed */
 #undef NO_OPTIONAL_OPT_ARGS

diff --git a/src/icmp-ping.c b/src/icmp-ping.c
index a7326f6..4edf03d 100644
--- a/src/icmp-ping.c
+++ b/src/icmp-ping.c
@@ -73,9 +73,7 @@
 #include <config.h>
 #include <main.h>
 #include <net/if.h>
-#ifdef HAVE_NETINIT_IN_SYSTM_H
-# include <netinet/in_systm.h>
-#endif
+#include <netinet/in_systm.h>
 #include <netinet/ip_icmp.h>
 #include <netinet/ip.h>
 #include <netinet/icmp6.h>
diff --git a/src/worker-tun.c b/src/worker-tun.c
index 91a3331..583f52c 100644
--- a/src/worker-tun.c
+++ b/src/worker-tun.c
@@ -32,11 +32,11 @@
 #include <fcntl.h>
 #include <unistd.h>
 #include <limits.h>
-#include <net/if.h>
 #include <netinet/in.h>
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
+#include <net/if.h>
 #include <arpa/inet.h>
 #include <signal.h>
 #include <time.h>

/Per

-----Original Message-----
From: Nikos Mavrogiannopoulos [mailto:n.mavrogiannopoulos at gmail.com] On Behalf Of Nikos Mavrogiannopoulos
Sent: den 9 december 2013 22:17
To: Per Juborg
Cc: openconnect-devel at lists.infradead.org
Subject: Re: Error building ocserv 0.2.2

On Mon, 2013-12-09 at 21:41 +0100, Per Juborg wrote:

> 1 warning generated.
>   CC       main-auth.o
>   CC       worker-vpn.o
> worker-vpn.c:996:46: error: use of undeclared identifier 'SO_PRIORITY'
>                 ret = setsockopt( ws->conn_fd, SOL_SOCKET, SO_PRIORITY, &l, sizeof(l));
>                                                            ^
> worker-vpn.c:1055:46: error: use of undeclared identifier 'SO_PRIORITY'
>                         ret = setsockopt( ws->udp_fd, SOL_SOCKET, 
> SO_PRIORITY, &l, sizeof(l));

Hello Per,
 I've moved that to conditional. However, is there any way to set priority (for IP or just internally in the sockets) in that system?

regards,
Nikos



From cernekee at gmail.com  Wed Dec 11 01:17:26 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Tue, 10 Dec 2013 22:17:26 -0800
Subject: [PATCH ocserv] Fix multiple session disconnect when max-same-clients
 is 0
Message-ID: <1386742646-10053-1-git-send-email-cernekee@gmail.com>

max-same-clients is used to limit the number of outstanding sessions
(cookies).  If set to 0, it means an unlimited number of active cookies
can be owned by each user.  But it doesn't mean that the same cookie
can be reused for multiple CSTP connections with different IPs, as
the protocol does not normally work this way.
---
 src/main-auth.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/main-auth.c b/src/main-auth.c
index 181c100..67a81b2 100644
--- a/src/main-auth.c
+++ b/src/main-auth.c
@@ -472,9 +472,6 @@ int check_multiple_users(main_server_st *s, struct proc_st* proc)
 struct proc_st *ctmp = NULL, *cpos;
 unsigned int entries = 1; /* that one */
 
-	if (s->config->max_same_clients == 0)
-		return 0; /* ok */
-
 	list_for_each_safe(&s->clist.head, ctmp, cpos, list) {
 		if (ctmp != proc) {
 			if (memcmp(proc->cookie, ctmp->cookie, sizeof(proc->cookie)) == 0) {
@@ -492,7 +489,7 @@ unsigned int entries = 1; /* that one */
 		}
 	}
 	
-	if (entries > s->config->max_same_clients)
+	if (s->config->max_same_clients && entries > s->config->max_same_clients)
 		return -1;
 	
 	return 0;
-- 
1.8.2.1



From cernekee at gmail.com  Wed Dec 11 01:42:25 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Tue, 10 Dec 2013 22:42:25 -0800
Subject: [GIT PULL V4] JNI bindings for libopenconnect
In-Reply-To: <CAJU7za+gRSE1TCJ0dPhRVpzjsvgwFr=rDXCbkygEd3xXVqZaVA@mail.gmail.com>
References: <1383510172-17953-1-git-send-email-cernekee@gmail.com>
 <CAJU7zaKhCYru68Vbd=N5bd5wBuvyeDF+KeDRDK3Ag0F+gyoDhw@mail.gmail.com>
 <CAJiQ=7ATKFOG3jENWHJhSC4kFM8x-q5HF9SJz7HjVA6bR3kGaA@mail.gmail.com>
 <CAJU7zaJ+_F2qjtpyfdMXvLs6jOaWjaDSLdwTy7ZpmydXHqJ5_Q@mail.gmail.com>
 <CAJiQ=7DXrm_35Yi=v1UgbsgwutcAZfJjX0x2DE4vpKPWF12qtQ@mail.gmail.com>
 <CAJU7za+gRSE1TCJ0dPhRVpzjsvgwFr=rDXCbkygEd3xXVqZaVA@mail.gmail.com>
Message-ID: <CAJiQ=7DwWG6PM-SUhBSbUFnwT-zg9pYxUkQfmscG9MUSHF+Sbw@mail.gmail.com>

On Tue, Dec 10, 2013 at 8:18 AM, Nikos Mavrogiannopoulos
<n.mavrogiannopoulos at gmail.com> wrote:
> On Tue, Dec 10, 2013 at 4:44 PM, Kevin Cernekee <cernekee at gmail.com> wrote:
>
>> The DPD/Keepalive messages have not been good for mobile battery life.
>>  Now I am experimenting with dropping the TCP connection, and
>> waking+reconnecting just often enough to keep the server from
>> invalidating the cookie.
>>
>> BTW, another problem I noticed: if there is a stale CSTP connection
>> active and the client attempts to reconnect, ocserv will kill the old
>> connection and give the client his old IP again.  But if I close() the
>> CSTP connection (killall -9 openconnect), then reconnect using the
>> same cookie, the IP changes and this confuses openconnect.
>
> I cannot reproduce that. Could you try with the latest git? I want to
> check what is the reason that the initial IP wasn't used.

This requires two concurrent sessions under the same username.  I see
this behavior using the ocserv head of tree (rev 791d77632):

1) First session starts; the IPv4 address is based on a hash of the
username so it is typically the same number every time.

2) Second session starts; the IP is randomly chosen because
get_ipv4_lease() picks the IP via gnutls_rnd() if its first choice,
based on the username hash, was taken:

    ocserv[18952]: [192.168.0.10]:32780 cannot assign remote IP
[192.168.1.191]:0 to 'test'; it is in use.
    ocserv[18952]: [192.168.0.10]:32780 selected IP for 'test':
[192.168.1.130]:0
    ocserv[18952]: [192.168.0.10]:32780 assigned IPv4 to 'test':
[192.168.1.131]:0

3) kill -9 <second_openconnect_pid>

4) handle_commands() gets 0 from recvmsg(), returns ERR_WORKER_TERMINATED.

5) remove_proc() is called, printing "command socket closed" in the
log and removing our entry (including leases) from clist.

6) openconnect reconnects with the same cookie.

7) ocserv can't find any trace of our existing leases in clist, and so
get_ipv4_lease() is called again to generate a new random number.


The hash mentioned in step #1 will effectively mask this problem if
there is only one active connection under each username.

Obviously openconnect won't complain about IP changes if I'm invoking
it manually with --cookie, but it will complain if the CSTP connection
drops (e.g. TCP reset), it auto-reconnects 10 seconds later, and then
it gets a different IP.


From nmav at gnutls.org  Wed Dec 11 02:41:58 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Wed, 11 Dec 2013 08:41:58 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaFQd=GbsX7OFZj8LfOsnmRS1bAQ9z_r2+SUD7=+PKPhrA@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
 <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
 <1386623659.4155.0.camel@aspire.lan>
 <CAFuxyaER80yj7S5giRRRHPNe4QP_82hpKez0Thv7b0f5OkBWSw@mail.gmail.com>
 <CAJU7zaJmK7rhihhRt7p926179e265RY8Vu+SFRdg=xZZg2dRvg@mail.gmail.com>
 <CAFuxyaFQd=GbsX7OFZj8LfOsnmRS1bAQ9z_r2+SUD7=+PKPhrA@mail.gmail.com>
Message-ID: <CAJU7zaL0f7mt6j+eG1KTjmE9ERRGwXbA2MHKwOj9Xot+N20fCA@mail.gmail.com>

On Tue, Dec 10, 2013 at 8:50 PM, Karl <weeker at outlook.com> wrote:
> Hi, Nikos, after add Digital Signature, Key Encipherment, Data
> Encipherment, Certificate Sign, TLS Web Client Authentication to the
> user cert, it looks *better*, I sent the logs if you have interesting
> to look.

Most probably the digital signature flag would have been sufficient.
Was is some openconnect or ocserv documentation that didn't mention
this flag?

regards,
Nikos


From nmav at gnutls.org  Wed Dec 11 02:54:49 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Wed, 11 Dec 2013 08:54:49 +0100
Subject: Error building ocserv 0.2.3 from git
In-Reply-To: <585F10E43CE3454B95691D0A1F56D106F4676E92C6@exch2.email.eworx.se>
References: <585F10E43CE3454B95691D0A1F56D106F4676E92C6@exch2.email.eworx.se>
Message-ID: <CAJU7za+ukz8FVeVxJ5L-Qm7hH-EuLZcxL-A8XzdbG=T3Ofm2Ow@mail.gmail.com>

On Tue, Dec 10, 2013 at 10:03 PM, Per Juborg <per at juborg.nu> wrote:
> Hi,
> I don't really remember what I've tried, did a git pull a few minutes ago:
> This is my result:
>   CC       icmp-ping.o
> In file included from icmp-ping.c:77:
> /usr/include/netinet/ip_icmp.h:126:14: error: field has incomplete type 'struct ip'

Thanks. I've updated the source based on the errors you see.

regards,
Nikos


From n.mavrogiannopoulos at gmail.com  Wed Dec 11 02:55:16 2013
From: n.mavrogiannopoulos at gmail.com (Nikos Mavrogiannopoulos)
Date: Wed, 11 Dec 2013 08:55:16 +0100
Subject: [PATCH ocserv] Fix multiple session disconnect when
 max-same-clients is 0
In-Reply-To: <1386742646-10053-1-git-send-email-cernekee@gmail.com>
References: <1386742646-10053-1-git-send-email-cernekee@gmail.com>
Message-ID: <CAJU7zaJnKa0kkA8zrkOYXEVRROo=iPLi+D7OgvxcUd0UZjK6EQ@mail.gmail.com>

On Wed, Dec 11, 2013 at 7:17 AM, Kevin Cernekee <cernekee at gmail.com> wrote:
> max-same-clients is used to limit the number of outstanding sessions
> (cookies).  If set to 0, it means an unlimited number of active cookies
> can be owned by each user.  But it doesn't mean that the same cookie
> can be reused for multiple CSTP connections with different IPs, as
> the protocol does not normally work this way.

Applied, thanks.


From n.mavrogiannopoulos at gmail.com  Wed Dec 11 02:57:28 2013
From: n.mavrogiannopoulos at gmail.com (Nikos Mavrogiannopoulos)
Date: Wed, 11 Dec 2013 08:57:28 +0100
Subject: [GIT PULL V4] JNI bindings for libopenconnect
In-Reply-To: <CAJiQ=7DwWG6PM-SUhBSbUFnwT-zg9pYxUkQfmscG9MUSHF+Sbw@mail.gmail.com>
References: <1383510172-17953-1-git-send-email-cernekee@gmail.com>
 <CAJU7zaKhCYru68Vbd=N5bd5wBuvyeDF+KeDRDK3Ag0F+gyoDhw@mail.gmail.com>
 <CAJiQ=7ATKFOG3jENWHJhSC4kFM8x-q5HF9SJz7HjVA6bR3kGaA@mail.gmail.com>
 <CAJU7zaJ+_F2qjtpyfdMXvLs6jOaWjaDSLdwTy7ZpmydXHqJ5_Q@mail.gmail.com>
 <CAJiQ=7DXrm_35Yi=v1UgbsgwutcAZfJjX0x2DE4vpKPWF12qtQ@mail.gmail.com>
 <CAJU7za+gRSE1TCJ0dPhRVpzjsvgwFr=rDXCbkygEd3xXVqZaVA@mail.gmail.com>
 <CAJiQ=7DwWG6PM-SUhBSbUFnwT-zg9pYxUkQfmscG9MUSHF+Sbw@mail.gmail.com>
Message-ID: <CAJU7zaJSP4VCNBYuPbaBABzGWoV-3e=c6LN7ragLCXhv951gDQ@mail.gmail.com>

On Wed, Dec 11, 2013 at 7:42 AM, Kevin Cernekee <cernekee at gmail.com> wrote:

>> I cannot reproduce that. Could you try with the latest git? I want to
>> check what is the reason that the initial IP wasn't used.
> This requires two concurrent sessions under the same username.  I see
> this behavior using the ocserv head of tree (rev 791d77632):

Ok that makes sense. That use-case can only be fixed by storing the
assigned IP in the cookie. I'll see to it.

regards,
Nikos


From weeker at outlook.com  Wed Dec 11 03:58:27 2013
From: weeker at outlook.com (Karl)
Date: Wed, 11 Dec 2013 16:58:27 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAJU7zaL0f7mt6j+eG1KTjmE9ERRGwXbA2MHKwOj9Xot+N20fCA@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
 <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
 <1386623659.4155.0.camel@aspire.lan>
 <CAFuxyaER80yj7S5giRRRHPNe4QP_82hpKez0Thv7b0f5OkBWSw@mail.gmail.com>
 <CAJU7zaJmK7rhihhRt7p926179e265RY8Vu+SFRdg=xZZg2dRvg@mail.gmail.com>
 <CAFuxyaFQd=GbsX7OFZj8LfOsnmRS1bAQ9z_r2+SUD7=+PKPhrA@mail.gmail.com>
 <CAJU7zaL0f7mt6j+eG1KTjmE9ERRGwXbA2MHKwOj9Xot+N20fCA@mail.gmail.com>
Message-ID: <CAFuxyaFaVJUwZQ5PAhm4bdcuKc=QTK6yGwhiAXT86Jf3NnA19A@mail.gmail.com>

If it only have digital signature flag, iOS client will complain error
like: "EKU not found", "CERTIFICATE_ERROR_VERIFY_KEYUSAGE_FAILED:The
certificate did not contain the required Key Usages", after added the
other flags, no more errors like these.

On Wed, Dec 11, 2013 at 3:41 PM, Nikos Mavrogiannopoulos
<nmav at gnutls.org> wrote:
> digital signature flag


From nmav at gnutls.org  Wed Dec 11 04:22:49 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Wed, 11 Dec 2013 10:22:49 +0100
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAFuxyaFaVJUwZQ5PAhm4bdcuKc=QTK6yGwhiAXT86Jf3NnA19A@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
 <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
 <1386623659.4155.0.camel@aspire.lan>
 <CAFuxyaER80yj7S5giRRRHPNe4QP_82hpKez0Thv7b0f5OkBWSw@mail.gmail.com>
 <CAJU7zaJmK7rhihhRt7p926179e265RY8Vu+SFRdg=xZZg2dRvg@mail.gmail.com>
 <CAFuxyaFQd=GbsX7OFZj8LfOsnmRS1bAQ9z_r2+SUD7=+PKPhrA@mail.gmail.com>
 <CAJU7zaL0f7mt6j+eG1KTjmE9ERRGwXbA2MHKwOj9Xot+N20fCA@mail.gmail.com>
 <CAFuxyaFaVJUwZQ5PAhm4bdcuKc=QTK6yGwhiAXT86Jf3NnA19A@mail.gmail.com>
Message-ID: <CAJU7za+uitn_qxKzbOYJb8zFvbNjJLeF64=tnZa3OGkpBqa_aQ@mail.gmail.com>

On Wed, Dec 11, 2013 at 9:58 AM, Karl <weeker at outlook.com> wrote:
> If it only have digital signature flag, iOS client will complain error
> like: "EKU not found", "CERTIFICATE_ERROR_VERIFY_KEYUSAGE_FAILED:The
> certificate did not contain the required Key Usages", after added the
> other flags, no more errors like these.

So I guess iOS requires the "TLS Web Client Authentication" as well
(the other flags you mentioned are really unrelated). That's
interesting as the client isn't using the certificate for web
authentication (but rather for VPN). Nevertheless, it's nice to know
there are more implementations that enforce the certificate flags.

regards,
Nikos


From weeker at outlook.com  Wed Dec 11 04:35:32 2013
From: weeker at outlook.com (Karl)
Date: Wed, 11 Dec 2013 17:35:32 +0800
Subject: Certificate auth issue in 0.2.2
In-Reply-To: <CAJU7za+uitn_qxKzbOYJb8zFvbNjJLeF64=tnZa3OGkpBqa_aQ@mail.gmail.com>
References: <CAFuxyaGSwSG+22=nFrugKQHpX0qnJr8VdziXnZLROknaKKD32Q@mail.gmail.com>
 <1386445512.1858.1.camel@aspire.lan>
 <CAFuxyaHuLk4q=9CpYMn4x7RuhSZWPjWUGt=kmf4jBr1=UcDh9A@mail.gmail.com>
 <1386488503.2093.5.camel@aspire.lan>
 <CAFuxyaHAmjD-FmnVebMeBV=6smDex_i99Ux3Z0A04ipkF+JiOA@mail.gmail.com>
 <1386525684.10056.7.camel@aspire.lan>
 <CAFuxyaFpinjY=phr3QkC9TVmoMh6LA0U0A0L30W8GG9NVZB+Kw@mail.gmail.com>
 <CAJU7za+hYKv=N-J+T7eqjdgH9QHOB+2mxGgVo3axAm4j+Wr5ww@mail.gmail.com>
 <CAFuxyaE8pp0zO2e0xfHqRGVgJB9d=ahPbE0bj2tpN6ywPEng=A@mail.gmail.com>
 <1386614888.24726.3.camel@aspire.lan>
 <CAFuxyaG-hHGuOppTdorZkyuK-EMGnM5RB+JnauKdK4bW7UC-dQ@mail.gmail.com>
 <1386623659.4155.0.camel@aspire.lan>
 <CAFuxyaER80yj7S5giRRRHPNe4QP_82hpKez0Thv7b0f5OkBWSw@mail.gmail.com>
 <CAJU7zaJmK7rhihhRt7p926179e265RY8Vu+SFRdg=xZZg2dRvg@mail.gmail.com>
 <CAFuxyaFQd=GbsX7OFZj8LfOsnmRS1bAQ9z_r2+SUD7=+PKPhrA@mail.gmail.com>
 <CAJU7zaL0f7mt6j+eG1KTjmE9ERRGwXbA2MHKwOj9Xot+N20fCA@mail.gmail.com>
 <CAFuxyaFaVJUwZQ5PAhm4bdcuKc=QTK6yGwhiAXT86Jf3NnA19A@mail.gmail.com>
 <CAJU7za+uitn_qxKzbOYJb8zFvbNjJLeF64=tnZa3OGkpBqa_aQ@mail.gmail.com>
Message-ID: <CAFuxyaHh78wP6YkTH-MYHDPahNSAnUD+qVuRM+9feBkVVr+OuA@mail.gmail.com>

Yes, "TLS Web Client Authentication" I put also, tried different user
certs, but all failed to connect.

On Wed, Dec 11, 2013 at 5:22 PM, Nikos Mavrogiannopoulos
<nmav at gnutls.org> wrote:
> On Wed, Dec 11, 2013 at 9:58 AM, Karl <weeker at outlook.com> wrote:
>> If it only have digital signature flag, iOS client will complain error
>> like: "EKU not found", "CERTIFICATE_ERROR_VERIFY_KEYUSAGE_FAILED:The
>> certificate did not contain the required Key Usages", after added the
>> other flags, no more errors like these.
>
> So I guess iOS requires the "TLS Web Client Authentication" as well
> (the other flags you mentioned are really unrelated). That's
> interesting as the client isn't using the certificate for web
> authentication (but rather for VPN). Nevertheless, it's nice to know
> there are more implementations that enforce the certificate flags.
>
> regards,
> Nikos


From per at juborg.nu  Wed Dec 11 16:22:15 2013
From: per at juborg.nu (Per Juborg)
Date: Wed, 11 Dec 2013 22:22:15 +0100
Subject: Error building ocserv 0.2.3 from git
In-Reply-To: <CAJU7za+ukz8FVeVxJ5L-Qm7hH-EuLZcxL-A8XzdbG=T3Ofm2Ow@mail.gmail.com>
References: <585F10E43CE3454B95691D0A1F56D106F4676E92C6@exch2.email.eworx.se>
 <CAJU7za+ukz8FVeVxJ5L-Qm7hH-EuLZcxL-A8XzdbG=T3Ofm2Ow@mail.gmail.com>
Message-ID: <585F10E43CE3454B95691D0A1F56D106F4676E92D4@exch2.email.eworx.se>

Hi,

It compiles fine now, will do some testing this weekend.

/Per

-----Original Message-----
From: n.mavrogiannopoulos at gmail.com [mailto:n.mavrogiannopoulos at gmail.com] On Behalf Of Nikos Mavrogiannopoulos
Sent: den 11 december 2013 08:55
To: Per Juborg
Cc: openconnect-devel at lists.infradead.org
Subject: Re: Error building ocserv 0.2.3 from git

On Tue, Dec 10, 2013 at 10:03 PM, Per Juborg <per at juborg.nu> wrote:
> Hi,
> I don't really remember what I've tried, did a git pull a few minutes ago:
> This is my result:
>   CC       icmp-ping.o
> In file included from icmp-ping.c:77:
> /usr/include/netinet/ip_icmp.h:126:14: error: field has incomplete type 'struct ip'

Thanks. I've updated the source based on the errors you see.

regards,
Nikos

From james at retrohq.co.uk  Fri Dec 13 07:08:46 2013
From: james at retrohq.co.uk (James Boulton)
Date: Fri, 13 Dec 2013 12:08:46 -0000
Subject: Connection Problems... help!
Message-ID: <001501cef7fc$14317d50$3c9477f0$@co.uk>

Hi,

I've built openconnect on my NAS box and am trying to connect to a VPN. The
connection seems to go through with username / password then I get this :

	CSTP connected. DPD 30, Keepalive 20
	readlink: /dev/net/tun: Invalid argument

	>> REPEATED 100x
	BusyBox v1.01 (2013.06.23-18:40+0000) multi-call binary

	Usage: sleep N

	Pause for N seconds.
	<<

	Failed to open tun device: No such device

The sleep error seems to be down to the busybox sleep only accepting whole
numbers, and readlink seems to report on error if not used on an actual
link.

/dev/net/tun exists but tun is not listed in lsmod.

Any pointers appreciated.

-- James



From dwmw2 at infradead.org  Fri Dec 13 08:03:31 2013
From: dwmw2 at infradead.org (David Woodhouse)
Date: Fri, 13 Dec 2013 13:03:31 +0000
Subject: Connection Problems... help!
In-Reply-To: <001501cef7fc$14317d50$3c9477f0$@co.uk>
References: <001501cef7fc$14317d50$3c9477f0$@co.uk>
Message-ID: <1386939811.18917.32.camel@shinybook.infradead.org>

On Fri, 2013-12-13 at 12:08 +0000, James Boulton wrote:
> /dev/net/tun exists but tun is not listed in lsmod.

That would appear to be your problem. Is tun built into the kernel? You
do need to have the tun driver somehow, be it built-in or loaded as a
module. Fixing that it outside the scope of the openconnect client
itself! :)

You say /dev/net/tun exists... is it a symlink? To where?

-- 
dwmw2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5745 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131213/1ec6df60/attachment.bin>

From james at retrohq.co.uk  Fri Dec 13 09:01:23 2013
From: james at retrohq.co.uk (James Boulton)
Date: Fri, 13 Dec 2013 14:01:23 -0000
Subject: Connection Problems... help!
In-Reply-To: <1386939811.18917.32.camel@shinybook.infradead.org>
References: <001501cef7fc$14317d50$3c9477f0$@co.uk>
 <1386939811.18917.32.camel@shinybook.infradead.org>
Message-ID: <002101cef80b$cf21a360$6d64ea20$@co.uk>

Yes, that was indeed the problem. Not long after posting the message I found the tun kernel module and loaded it, and now openconnect actually connects!

It seems tun isn?t loaded by default on this QNAP NAS box, although they do kindly provide a prebuilt version, which was nice!

Thanks!
-- James


-----Original Message-----
From: David Woodhouse [mailto:dwmw2 at infradead.org] 
Sent: 13 December 2013 13:04
To: James Boulton
Cc: openconnect-devel at lists.infradead.org
Subject: Re: Connection Problems... help!

On Fri, 2013-12-13 at 12:08 +0000, James Boulton wrote:
> /dev/net/tun exists but tun is not listed in lsmod.

That would appear to be your problem. Is tun built into the kernel? You
do need to have the tun driver somehow, be it built-in or loaded as a
module. Fixing that it outside the scope of the openconnect client
itself! :)

You say /dev/net/tun exists... is it a symlink? To where?

-- 
dwmw2




From cernekee at gmail.com  Sun Dec 15 01:42:51 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:51 -0800
Subject: [PATCH/RFC V3 00/13] Fix authgroup selection in XML POST mode
Message-ID: <1387089785-17543-1-git-send-email-cernekee@gmail.com>

This is my third attempt at addressing the various authgroup selection
issues involving XML POST[1] and second-auth[2].  The basic idea is that
whenever the user changes the selected authgroup (whose name is passed
to the UI via oc_auth_form->authgroup_field), the process_auth_form
callback returns back to libopenconnect with a special status code, and
allows the library to construct a new form.  In XML POST mode this
results in a new POST to the gateway (and probably a new <opaque> data
blob); in second-auth mode the form fields are manipulated locally.

The changes are intended to be mostly backward compatible.  The only
incompatible change is that opt->value is prepopulated if
secondary_username is marked editable, as the Cisco clients do allow
the server to specify the initial value for this field.  Library
users that do not know about this may overwrite the pointer (leaking
memory) and will probably ignore the prepopulated value.  Also, users
that do not know about the API change will still not be able to handle
authgroup changes properly.

This has been lightly tested with network-manager-openconnect and the
command-line client.

[1] https://bugs.launchpad.net/bugs/1229195
[2] http://lists.infradead.org/pipermail/openconnect-devel/2013-June/001088.html


Kevin Cernekee (13):
  main: Move username/password/authgroup vars into main.c
  auth: Add <group-access> node to XML POST initial request
  library: Use named constants for process_auth_form() return value
  library: Decouple internal and external oc_* auth form structs
  main: Rename process_auth_form() to avoid conflict with library
  Create a common process_auth_form() wrapper function
  Split user-visible oc_* fields from internal fields
  auth: Provide information on which auth choice is currently selected
  process_auth_form: Add code to support NEWGROUP return status from UI
  auth: Remove outdated comment for parse_auth_choice()
  auth: Parse second-auth-related properties from the auth form
  auth: Hide unused form fields based on the selected authgroup
  library: Bump API version to 2.3 and document changes

 auth.c                 |  421 +++++++++++++++++++++++++++++++-----------------
 gnutls.c               |   30 ++--
 http.c                 |   22 ++-
 library.c              |    1 +
 main.c                 |   54 ++++---
 openconnect-internal.h |   37 ++++-
 openconnect.h          |   13 +-
 openssl.c              |   28 ++--
 ssl.c                  |   21 ++-
 9 files changed, 400 insertions(+), 227 deletions(-)

-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:42:53 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:53 -0800
Subject: [PATCH/RFC V3 02/13] auth: Add <group-access> node to XML POST
 initial request
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-3-git-send-email-cernekee@gmail.com>

This ensures that we get the form and <opaque> data corresponding to the
authgroup in use.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/auth.c b/auth.c
index ea76fec..b6b9698 100644
--- a/auth.c
+++ b/auth.c
@@ -800,6 +800,11 @@ int xmlpost_initial_req(struct openconnect_info *vpninfo, char *request_body, in
 		if (!node)
 			goto bad;
 	}
+	if (vpninfo->authgroup) {
+		node = xmlNewTextChild(root, NULL, XCAST("group-select"), XCAST(vpninfo->authgroup));
+		if (!node)
+			goto bad;
+	}
 	return xmlpost_complete(doc, request_body, req_len);
 
 bad:
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:42:52 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:52 -0800
Subject: [PATCH/RFC V3 01/13] main: Move username/password/authgroup vars into
 main.c
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-2-git-send-email-cernekee@gmail.com>

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 main.c                 |   33 ++++++++++++++++++---------------
 openconnect-internal.h |    2 --
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/main.c b/main.c
index 5ddd9b8..e0114d2 100644
--- a/main.c
+++ b/main.c
@@ -83,6 +83,10 @@ int nocertcheck;
 int non_inter;
 int cookieonly;
 
+char *username;
+char *password;
+char *authgroup;
+
 enum {
 	OPT_AUTHENTICATE = 0x100,
 	OPT_AUTHGROUP,
@@ -563,7 +567,7 @@ int main(int argc, char **argv)
 				vpninfo->cookie = NULL;
 			break;
 		case OPT_PASSWORD_ON_STDIN:
-			read_stdin(&vpninfo->password);
+			read_stdin(&password);
 			break;
 		case OPT_NO_PASSWD:
 			vpninfo->nopasswd = 1;
@@ -581,7 +585,7 @@ int main(int argc, char **argv)
 			vpninfo->dtls_ciphers = keep_config_arg();
 			break;
 		case OPT_AUTHGROUP:
-			vpninfo->authgroup = keep_config_arg();
+			authgroup = keep_config_arg();
 			break;
 		case 'b':
 			background = 1;
@@ -661,7 +665,7 @@ int main(int argc, char **argv)
 			vpninfo->script_tun = 1;
 			break;
 		case 'u':
-			vpninfo->username = keep_config_arg();
+			username = keep_config_arg();
 			break;
 		case 'U': {
 			char *strend;
@@ -1106,13 +1110,12 @@ static int process_auth_form(void *_vpninfo,
 			if (!select_opt->nr_choices)
 				continue;
 
-			if (vpninfo->authgroup &&
+			if (authgroup &&
 			    !strcmp(opt->name, "group_list")) {
 				for (i = 0; i < select_opt->nr_choices; i++) {
 					choice = &select_opt->choices[i];
 
-					if (!strcmp(vpninfo->authgroup,
-						    choice->label)) {
+					if (!strcmp(authgroup, choice->label)) {
 						opt->value = choice->name;
 						break;
 					}
@@ -1120,7 +1123,7 @@ static int process_auth_form(void *_vpninfo,
 				if (!opt->value)
 					vpn_progress(vpninfo, PRG_ERR,
 						     _("Auth choice \"%s\" not available\n"),
-						     vpninfo->authgroup);
+						     authgroup);
 			}
 			if (!opt->value && select_opt->nr_choices == 1) {
 				choice = &select_opt->choices[0];
@@ -1173,9 +1176,9 @@ static int process_auth_form(void *_vpninfo,
 	for (opt = form->opts; opt; opt = opt->next) {
 
 		if (opt->type == OC_FORM_OPT_TEXT) {
-			if (vpninfo->username &&
+			if (username &&
 			    !strcmp(opt->name, "username")) {
-				opt->value = strdup(vpninfo->username);
+				opt->value = strdup(username);
 				if (!opt->value)
 					goto err;
 			} else if (non_inter) {
@@ -1199,10 +1202,10 @@ static int process_auth_form(void *_vpninfo,
 			}
 
 		} else if (opt->type == OC_FORM_OPT_PASSWORD) {
-			if (vpninfo->password &&
+			if (password &&
 			    !strcmp(opt->name, "password")) {
-				opt->value = vpninfo->password;
-				vpninfo->password = NULL;
+				opt->value = password;
+				password = NULL;
 				if (!opt->value)
 					goto err;
 			} else if (non_inter) {
@@ -1239,9 +1242,9 @@ static int process_auth_form(void *_vpninfo,
 		}
 	}
 
-	if (vpninfo->password) {
-		free(vpninfo->password);
-		vpninfo->password = NULL;
+	if (password) {
+		free(password);
+		password = NULL;
 	}
 
 	return 0;
diff --git a/openconnect-internal.h b/openconnect-internal.h
index 4dc9ed4..4f9af77 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -171,8 +171,6 @@ struct openconnect_info {
 	const char *servercert;
 	const char *xmlconfig;
 	char xmlsha1[(SHA1_SIZE * 2) + 1];
-	char *username;
-	char *password;
 	char *authgroup;
 	int nopasswd;
 	int xmlpost;
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:42:56 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:56 -0800
Subject: [PATCH/RFC V3 05/13] main: Rename process_auth_form() to avoid
 conflict with library
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-6-git-send-email-cernekee@gmail.com>

Since we're still including openconnect-internal.h in main.c, it isn't
possible to use function names that overlap with internal library
symbols.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 main.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/main.c b/main.c
index 16c1824..b7ccb1f 100644
--- a/main.c
+++ b/main.c
@@ -65,8 +65,8 @@ static void syslog_progress(void *_vpninfo,
 static int validate_peer_cert(void *_vpninfo,
 			      OPENCONNECT_X509 *peer_cert,
 			      const char *reason);
-static int process_auth_form(void *_vpninfo,
-			     struct oc_auth_form *form);
+static int process_auth_form_cb(void *_vpninfo,
+				struct oc_auth_form *form);
 static void init_token(struct openconnect_info *vpninfo,
 		       oc_token_mode_t token_mode, const char *token_str);
 
@@ -507,7 +507,7 @@ int main(int argc, char **argv)
 	vpninfo->uid_csd = 0;
 	vpninfo->uid_csd_given = 0;
 	vpninfo->validate_peer_cert = validate_peer_cert;
-	vpninfo->process_auth_form = process_auth_form;
+	vpninfo->process_auth_form = process_auth_form_cb;
 	vpninfo->cbdata = vpninfo;
 	vpninfo->cert_expire_warning = 60 * 86400;
 	vpninfo->vpnc_script = DEFAULT_VPNCSCRIPT;
@@ -1083,8 +1083,8 @@ static int validate_peer_cert(void *_vpninfo, OPENCONNECT_X509 *peer_cert,
  *  = 0, when form was parsed and POST required
  *  = 1, when response was cancelled by user
  */
-static int process_auth_form(void *_vpninfo,
-			     struct oc_auth_form *form)
+static int process_auth_form_cb(void *_vpninfo,
+				struct oc_auth_form *form)
 {
 	struct openconnect_info *vpninfo = _vpninfo;
 	struct oc_form_opt *opt;
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:42:54 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:54 -0800
Subject: [PATCH/RFC V3 03/13] library: Use named constants for
 process_auth_form() return value
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-4-git-send-email-cernekee@gmail.com>

Currently we have 3 valid results, and we're about to add a fourth.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c        |   12 ++++++------
 http.c        |    4 ++--
 main.c        |    4 ++--
 openconnect.h |    5 +++++
 4 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/auth.c b/auth.c
index b6b9698..17f80ef 100644
--- a/auth.c
+++ b/auth.c
@@ -581,9 +581,9 @@ int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct
 
 /* Return value:
  *  < 0, on error
- *  = 0, when form parsed and POST required
- *  = 1, when response was cancelled by user
- *  = 2, when form indicates that login was already successful
+ *  = OC_FORM_RESULT_OK (0), when form parsed and POST required
+ *  = OC_FORM_RESULT_CANCELLED, when response was cancelled by user
+ *  = __OC_FORM_RESULT_LOGGEDIN, when form indicates that login was already successful
  */
 int handle_auth_form(struct openconnect_info *vpninfo, struct oc_auth_form *form,
 		     char *request_body, int req_len, const char **method,
@@ -593,7 +593,7 @@ int handle_auth_form(struct openconnect_info *vpninfo, struct oc_auth_form *form
 	struct vpn_option *opt, *next;
 
 	if (!strcmp(form->auth_id, "success"))
-		return 2;
+		return __OC_FORM_RESULT_LOGGEDIN;
 
 	if (vpninfo->nopasswd) {
 		vpn_progress(vpninfo, PRG_ERR,
@@ -611,7 +611,7 @@ int handle_auth_form(struct openconnect_info *vpninfo, struct oc_auth_form *form
 			free(opt);
 		}
 		vpninfo->cookies = NULL;
-		return 0;
+		return OC_FORM_RESULT_OK;
 	}
 	if (!form->opts) {
 		if (form->message)
@@ -625,7 +625,7 @@ int handle_auth_form(struct openconnect_info *vpninfo, struct oc_auth_form *form
 		ret = vpninfo->process_auth_form(vpninfo->cbdata, form);
 	else {
 		vpn_progress(vpninfo, PRG_ERR, _("No form handler; cannot authenticate.\n"));
-		ret = 1;
+		ret = OC_FORM_RESULT_CANCELLED;
 	}
 	if (ret)
 		return ret;
diff --git a/http.c b/http.c
index 3a5c2c6..fa803c5 100644
--- a/http.c
+++ b/http.c
@@ -1181,9 +1181,9 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
 		request_body[0] = 0;
 		result = handle_auth_form(vpninfo, form, request_body, sizeof(request_body),
 					  &method, &request_body_type);
-		if (result < 0 || result == 1)
+		if (result < 0 || result == OC_FORM_RESULT_CANCELLED)
 			goto out;
-		if (result == 2)
+		if (result == __OC_FORM_RESULT_LOGGEDIN)
 			break;
 
 		result = do_https_request(vpninfo, method, request_body_type, request_body,
diff --git a/main.c b/main.c
index e0114d2..16c1824 100644
--- a/main.c
+++ b/main.c
@@ -1247,7 +1247,7 @@ static int process_auth_form(void *_vpninfo,
 		password = NULL;
 	}
 
-	return 0;
+	return OC_FORM_RESULT_OK;
 
  err:
 	for (opt = form->opts; opt; opt = opt->next) {
@@ -1257,7 +1257,7 @@ static int process_auth_form(void *_vpninfo,
 			opt->value = NULL;
 		}
 	}
-	return -EINVAL;
+	return OC_FORM_RESULT_ERR;
 }
 
 static void init_token(struct openconnect_info *vpninfo,
diff --git a/openconnect.h b/openconnect.h
index d48bc25..8f601cb 100644
--- a/openconnect.h
+++ b/openconnect.h
@@ -93,6 +93,11 @@
 #define OC_FORM_OPT_HIDDEN	4
 #define OC_FORM_OPT_TOKEN	5
 
+#define OC_FORM_RESULT_ERR		-1
+#define OC_FORM_RESULT_OK		0
+#define OC_FORM_RESULT_CANCELLED	1
+#define __OC_FORM_RESULT_LOGGEDIN	255	/* internal library use only */
+
 /* char * fields are static (owned by XML parser) and don't need to be
    freed by the form handling code -- except for value, which for TEXT
    and PASSWORD options is allocated by process_form() when
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:42:57 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:57 -0800
Subject: [PATCH/RFC V3 06/13] Create a common process_auth_form() wrapper
 function
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-7-git-send-email-cernekee@gmail.com>

This will be used to translate between internal library structs and
public structs.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c                 |   25 ++++++++++++-------------
 gnutls.c               |    2 +-
 openconnect-internal.h |    2 ++
 openssl.c              |    2 +-
 ssl.c                  |    5 +----
 5 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/auth.c b/auth.c
index c957897..7bd2641 100644
--- a/auth.c
+++ b/auth.c
@@ -579,6 +579,15 @@ int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct
 	return ret;
 }
 
+int process_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *form)
+{
+	if (!vpninfo->process_auth_form) {
+		vpn_progress(vpninfo, PRG_ERR, _("No form handler; cannot authenticate.\n"));
+		return OC_FORM_RESULT_ERR;
+	}
+	return vpninfo->process_auth_form(vpninfo->cbdata, form);
+}
+
 /* Return value:
  *  < 0, on error
  *  = OC_FORM_RESULT_OK (0), when form parsed and POST required
@@ -621,12 +630,7 @@ int handle_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *fo
 		return -EPERM;
 	}
 
-	if (vpninfo->process_auth_form)
-		ret = vpninfo->process_auth_form(vpninfo->cbdata, form);
-	else {
-		vpn_progress(vpninfo, PRG_ERR, _("No form handler; cannot authenticate.\n"));
-		ret = OC_FORM_RESULT_CANCELLED;
-	}
+	ret = process_auth_form(vpninfo, form);
 	if (ret)
 		return ret;
 
@@ -944,11 +948,11 @@ int prepare_stoken(struct openconnect_info *vpninfo)
 		if (!opts[0].type) {
 			/* don't bug the user if there's nothing to enter */
 			ret = 0;
-		} else if (vpninfo->process_auth_form) {
+		} else {
 			int some_empty = 0, all_empty = 1;
 
 			/* < 0 for error; 1 if cancelled */
-			ret = vpninfo->process_auth_form(vpninfo->cbdata, &form);
+			ret = process_auth_form(vpninfo, &form);
 			if (ret)
 				break;
 
@@ -970,11 +974,6 @@ int prepare_stoken(struct openconnect_info *vpninfo)
 					     _("All fields are required; try again.\n"));
 				continue;
 			}
-		} else {
-			vpn_progress(vpninfo, PRG_ERR,
-				     _("No form handler; cannot authenticate.\n"));
-			ret = -EIO;
-			break;
 		}
 
 		ret = stoken_decrypt_seed(vpninfo->stoken_ctx,
diff --git a/gnutls.c b/gnutls.c
index 5c56c3d..852e061 100644
--- a/gnutls.c
+++ b/gnutls.c
@@ -2183,7 +2183,7 @@ static P11KitPin *pin_callback(const char *pin_source, P11KitUri *pin_uri,
 	o.label = (char *)_("Enter PIN:");
 	o.value = NULL;
 
-	ret = vpninfo->process_auth_form(vpninfo->cbdata, &f);
+	ret = process_auth_form(vpninfo, &f);
 	if (ret || !o.value)
 		return NULL;
 
diff --git a/openconnect-internal.h b/openconnect-internal.h
index 0dc1175..7048c0f 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -438,6 +438,8 @@ int config_lookup_host(struct openconnect_info *vpninfo, const char *host);
 /* auth.c */
 int parse_xml_response(struct openconnect_info *vpninfo, char *response,
 		       struct __oc_auth_form **form, int *cert_rq);
+int process_auth_form(struct openconnect_info *vpninfo,
+		      struct __oc_auth_form *form);
 int handle_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *form,
 		     char *request_body, int req_len, const char **method,
 		     const char **request_body_type);
diff --git a/openssl.c b/openssl.c
index d79e8af..dda102c 100644
--- a/openssl.c
+++ b/openssl.c
@@ -306,7 +306,7 @@ static int ui_flush(UI *ui)
 	struct ui_form_opt *opt;
 	int ret;
 
-	ret = vpninfo->process_auth_form(vpninfo->cbdata, &ui_data->form);
+	ret = process_auth_form(vpninfo, &ui_data->form);
 	if (ret)
 		return 0;
 
diff --git a/ssl.c b/ssl.c
index f8dd361..7c1f194 100644
--- a/ssl.c
+++ b/ssl.c
@@ -318,9 +318,6 @@ int request_passphrase(struct openconnect_info *vpninfo, const char *label,
 	va_list args;
 	int ret;
 
-	if (!vpninfo->process_auth_form)
-		return -EINVAL;
-
 	buf[1023] = 0;
 	memset(&f, 0, sizeof(f));
 	va_start(args, fmt);
@@ -336,7 +333,7 @@ int request_passphrase(struct openconnect_info *vpninfo, const char *label,
 	o.label = buf;
 	o.value = NULL;
 
-	ret = vpninfo->process_auth_form(vpninfo->cbdata, &f);
+	ret = process_auth_form(vpninfo, &f);
 	if (!ret) {
 		*response = o.value;
 		return 0;
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:42:55 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:55 -0800
Subject: [PATCH/RFC V3 04/13] library: Decouple internal and external oc_*
 auth form structs
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-5-git-send-email-cernekee@gmail.com>

It isn't possible to extend some of the public structs (e.g. oc_form_opt
or oc_form_opt_select) without breaking the ABI, so instead we'll make
private versions for use inside the library.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c                 |   68 ++++++++++++++++++++++++------------------------
 gnutls.c               |    4 +--
 http.c                 |    2 +-
 openconnect-internal.h |   11 +++++---
 openssl.c              |    6 ++---
 ssl.c                  |    4 +--
 6 files changed, 50 insertions(+), 45 deletions(-)

diff --git a/auth.c b/auth.c
index 17f80ef..c957897 100644
--- a/auth.c
+++ b/auth.c
@@ -47,10 +47,10 @@
 #include "openconnect-internal.h"
 
 static int xmlpost_append_form_opts(struct openconnect_info *vpninfo,
-				    struct oc_auth_form *form, char *body, int bodylen);
+				    struct __oc_auth_form *form, char *body, int bodylen);
 static int can_gen_tokencode(struct openconnect_info *vpninfo,
-			     struct oc_auth_form *form, struct oc_form_opt *opt);
-static int do_gen_tokencode(struct openconnect_info *vpninfo, struct oc_auth_form *form);
+			     struct __oc_auth_form *form, struct __oc_form_opt *opt);
+static int do_gen_tokencode(struct openconnect_info *vpninfo, struct __oc_auth_form *form);
 
 static int append_opt(char *body, int bodylen, char *opt, char *name)
 {
@@ -99,9 +99,9 @@ static int append_opt(char *body, int bodylen, char *opt, char *name)
 }
 
 static int append_form_opts(struct openconnect_info *vpninfo,
-			    struct oc_auth_form *form, char *body, int bodylen)
+			    struct __oc_auth_form *form, char *body, int bodylen)
 {
-	struct oc_form_opt *opt;
+	struct __oc_form_opt *opt;
 	int ret;
 
 	for (opt = form->opts; opt; opt = opt->next) {
@@ -119,10 +119,10 @@ static int append_form_opts(struct openconnect_info *vpninfo,
  * So we just accept the first option with an auth-type property.
  */
 
-static int parse_auth_choice(struct openconnect_info *vpninfo, struct oc_auth_form *form,
+static int parse_auth_choice(struct openconnect_info *vpninfo, struct __oc_auth_form *form,
 			     xmlNode *xml_node)
 {
-	struct oc_form_opt_select *opt;
+	struct __oc_form_opt_select *opt;
 
 	opt = calloc(1, sizeof(*opt));
 	if (!opt)
@@ -140,7 +140,7 @@ static int parse_auth_choice(struct openconnect_info *vpninfo, struct oc_auth_fo
 
 	for (xml_node = xml_node->children; xml_node; xml_node = xml_node->next) {
 		char *form_id;
-		struct oc_choice *choice;
+		struct __oc_choice *choice;
 
 		if (xml_node->type != XML_ELEMENT_NODE)
 			continue;
@@ -180,13 +180,13 @@ static int parse_auth_choice(struct openconnect_info *vpninfo, struct oc_auth_fo
  *  < 0, on error
  *  = 0, when form was parsed
  */
-static int parse_form(struct openconnect_info *vpninfo, struct oc_auth_form *form,
+static int parse_form(struct openconnect_info *vpninfo, struct __oc_auth_form *form,
 		      xmlNode *xml_node)
 {
 	char *input_type, *input_name, *input_label;
 
 	for (xml_node = xml_node->children; xml_node; xml_node = xml_node->next) {
-		struct oc_form_opt *opt, **p;
+		struct __oc_form_opt *opt, **p;
 
 		if (xml_node->type != XML_ELEMENT_NODE)
 			continue;
@@ -417,7 +417,7 @@ static int xmlnode_get_text(xmlNode *xml_node, const char *name, char **var)
  */
 
 static int parse_auth_node(struct openconnect_info *vpninfo, xmlNode *xml_node,
-			   struct oc_auth_form *form)
+			   struct __oc_auth_form *form)
 {
 	int ret = 0;
 
@@ -487,9 +487,9 @@ static int parse_host_scan_node(struct openconnect_info *vpninfo, xmlNode *xml_n
  *  < 0, on error
  *  = 0, on success; *form is populated
  */
-int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct oc_auth_form **formp, int *cert_rq)
+int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct __oc_auth_form **formp, int *cert_rq)
 {
-	struct oc_auth_form *form;
+	struct __oc_auth_form *form;
 	xmlDocPtr xml_doc;
 	xmlNode *xml_node;
 	int ret;
@@ -585,7 +585,7 @@ int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct
  *  = OC_FORM_RESULT_CANCELLED, when response was cancelled by user
  *  = __OC_FORM_RESULT_LOGGEDIN, when form indicates that login was already successful
  */
-int handle_auth_form(struct openconnect_info *vpninfo, struct oc_auth_form *form,
+int handle_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *form,
 		     char *request_body, int req_len, const char **method,
 		     const char **request_body_type)
 {
@@ -645,19 +645,19 @@ int handle_auth_form(struct openconnect_info *vpninfo, struct oc_auth_form *form
 	return ret;
 }
 
-void free_auth_form(struct oc_auth_form *form)
+void free_auth_form(struct __oc_auth_form *form)
 {
 	if (!form)
 		return;
 	while (form->opts) {
-		struct oc_form_opt *tmp = form->opts->next;
+		struct __oc_form_opt *tmp = form->opts->next;
 		if (form->opts->type == OC_FORM_OPT_TEXT ||
 		    form->opts->type == OC_FORM_OPT_PASSWORD ||
 		    form->opts->type == OC_FORM_OPT_HIDDEN ||
 		    form->opts->type == OC_FORM_OPT_TOKEN)
 			free(form->opts->value);
 		else if (form->opts->type == OC_FORM_OPT_SELECT) {
-			struct oc_form_opt_select *sel = (void *)form->opts;
+			struct __oc_form_opt_select *sel = (void *)form->opts;
 			int i;
 
 			for (i = 0; i < sel->nr_choices; i++) {
@@ -813,11 +813,11 @@ bad:
 }
 
 static int xmlpost_append_form_opts(struct openconnect_info *vpninfo,
-				    struct oc_auth_form *form, char *body, int bodylen)
+				    struct __oc_auth_form *form, char *body, int bodylen)
 {
 	xmlNodePtr root, node;
 	xmlDocPtr doc = xmlpost_new_query(vpninfo, "auth-reply", &root);
-	struct oc_form_opt *opt;
+	struct __oc_form_opt *opt;
 
 	if (!doc)
 		return -ENOMEM;
@@ -875,7 +875,7 @@ bad:
 
 
 #ifdef HAVE_LIBSTOKEN
-static void nuke_opt_values(struct oc_form_opt *opt)
+static void nuke_opt_values(struct __oc_form_opt *opt)
 {
 	for (; opt; opt = opt->next) {
 		free(opt->value);
@@ -899,8 +899,8 @@ static void nuke_opt_values(struct oc_form_opt *opt)
 int prepare_stoken(struct openconnect_info *vpninfo)
 {
 #ifdef HAVE_LIBSTOKEN
-	struct oc_auth_form form;
-	struct oc_form_opt opts[3], *opt = opts;
+	struct __oc_auth_form form;
+	struct __oc_form_opt opts[3], *opt = opts;
 	char **devid = NULL, **pass = NULL, **pin = NULL;
 	int ret = 0;
 
@@ -1020,8 +1020,8 @@ int prepare_stoken(struct openconnect_info *vpninfo)
  *  = 0, on success
  */
 static int can_gen_stoken_code(struct openconnect_info *vpninfo,
-			       struct oc_auth_form *form,
-			       struct oc_form_opt *opt)
+			       struct __oc_auth_form *form,
+			       struct __oc_form_opt *opt)
 {
 #ifdef HAVE_LIBSTOKEN
 	if ((strcmp(opt->name, "password") && strcmp(opt->name, "answer")) ||
@@ -1053,8 +1053,8 @@ static int can_gen_stoken_code(struct openconnect_info *vpninfo,
  *  = 0, on success
  */
 static int can_gen_totp_code(struct openconnect_info *vpninfo,
-			     struct oc_auth_form *form,
-			     struct oc_form_opt *opt)
+			     struct __oc_auth_form *form,
+			     struct __oc_form_opt *opt)
 {
 #ifdef HAVE_LIBOATH
 	if ((strcmp(opt->name, "secondary_password") != 0) ||
@@ -1085,8 +1085,8 @@ static int can_gen_totp_code(struct openconnect_info *vpninfo,
  *  = 0, on success
  */
 static int can_gen_tokencode(struct openconnect_info *vpninfo,
-			     struct oc_auth_form *form,
-			     struct oc_form_opt *opt)
+			     struct __oc_auth_form *form,
+			     struct __oc_form_opt *opt)
 {
 	switch (vpninfo->token_mode) {
 	case OC_TOKEN_MODE_STOKEN:
@@ -1101,8 +1101,8 @@ static int can_gen_tokencode(struct openconnect_info *vpninfo,
 }
 
 static int do_gen_stoken_code(struct openconnect_info *vpninfo,
-			      struct oc_auth_form *form,
-			      struct oc_form_opt *opt)
+			      struct __oc_auth_form *form,
+			      struct __oc_form_opt *opt)
 {
 #ifdef HAVE_LIBSTOKEN
 	char tokencode[STOKEN_MAX_TOKENCODE + 1];
@@ -1127,8 +1127,8 @@ static int do_gen_stoken_code(struct openconnect_info *vpninfo,
 }
 
 static int do_gen_totp_code(struct openconnect_info *vpninfo,
-			    struct oc_auth_form *form,
-			    struct oc_form_opt *opt)
+			    struct __oc_auth_form *form,
+			    struct __oc_form_opt *opt)
 {
 #ifdef HAVE_LIBOATH
 	int oath_err;
@@ -1165,9 +1165,9 @@ static int do_gen_totp_code(struct openconnect_info *vpninfo,
  *  = 0, on success
  */
 static int do_gen_tokencode(struct openconnect_info *vpninfo,
-			    struct oc_auth_form *form)
+			    struct __oc_auth_form *form)
 {
-	struct oc_form_opt *opt;
+	struct __oc_form_opt *opt;
 
 	for (opt = form->opts; ; opt = opt->next) {
 		/* this form might not have anything for us to do */
diff --git a/gnutls.c b/gnutls.c
index 52e632b..5c56c3d 100644
--- a/gnutls.c
+++ b/gnutls.c
@@ -2118,8 +2118,8 @@ static P11KitPin *pin_callback(const char *pin_source, P11KitUri *pin_uri,
 {
 	struct openconnect_info *vpninfo = _vpninfo;
 	struct pin_cache **cache = &vpninfo->pin_cache;
-	struct oc_auth_form f;
-	struct oc_form_opt o;
+	struct __oc_auth_form f;
+	struct __oc_form_opt o;
 	char message[1024];
 	char *uri;
 	P11KitPin *pin;
diff --git a/http.c b/http.c
index fa803c5..c4fffe5 100644
--- a/http.c
+++ b/http.c
@@ -997,7 +997,7 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
 {
 	struct vpn_option *opt;
 	char *form_buf = NULL;
-	struct oc_auth_form *form = NULL;
+	struct __oc_auth_form *form = NULL;
 	int result, buflen, tries;
 	char request_body[2048];
 	const char *request_body_type = "application/x-www-form-urlencoded";
diff --git a/openconnect-internal.h b/openconnect-internal.h
index 4f9af77..0dc1175 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -122,6 +122,11 @@ struct pin_cache {
 	char *pin;
 };
 
+#define __oc_form_opt		oc_form_opt
+#define __oc_choice		oc_choice
+#define __oc_form_opt_select	oc_form_opt_select
+#define __oc_auth_form		oc_auth_form
+
 #define RECONNECT_INTERVAL_MIN	10
 #define RECONNECT_INTERVAL_MAX	100
 
@@ -432,11 +437,11 @@ int config_lookup_host(struct openconnect_info *vpninfo, const char *host);
 
 /* auth.c */
 int parse_xml_response(struct openconnect_info *vpninfo, char *response,
-		       struct oc_auth_form **form, int *cert_rq);
-int handle_auth_form(struct openconnect_info *vpninfo, struct oc_auth_form *form,
+		       struct __oc_auth_form **form, int *cert_rq);
+int handle_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *form,
 		     char *request_body, int req_len, const char **method,
 		     const char **request_body_type);
-void free_auth_form(struct oc_auth_form *form);
+void free_auth_form(struct __oc_auth_form *form);
 int xmlpost_initial_req(struct openconnect_info *vpninfo, char *request_body, int req_len, int cert_fail);
 int prepare_stoken(struct openconnect_info *vpninfo);
 
diff --git a/openssl.c b/openssl.c
index a395bc5..d79e8af 100644
--- a/openssl.c
+++ b/openssl.c
@@ -231,12 +231,12 @@ int openconnect_SSL_gets(struct openconnect_info *vpninfo, char *buf, size_t len
 
 struct ui_data {
 	struct openconnect_info *vpninfo;
-	struct oc_form_opt **last_opt;
-	struct oc_auth_form form;
+	struct __oc_form_opt **last_opt;
+	struct __oc_auth_form form;
 };
 
 struct ui_form_opt {
-	struct oc_form_opt opt;
+	struct __oc_form_opt opt;
 	UI_STRING *uis;
 };
 
diff --git a/ssl.c b/ssl.c
index 7a08609..f8dd361 100644
--- a/ssl.c
+++ b/ssl.c
@@ -312,8 +312,8 @@ int  __attribute__ ((format (printf, 2, 3)))
 int request_passphrase(struct openconnect_info *vpninfo, const char *label,
 		       char **response, const char *fmt, ...)
 {
-	struct oc_auth_form f;
-	struct oc_form_opt o;
+	struct __oc_auth_form f;
+	struct __oc_form_opt o;
 	char buf[1024];
 	va_list args;
 	int ret;
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:42:59 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:59 -0800
Subject: [PATCH/RFC V3 08/13] auth: Provide information on which auth choice
 is currently selected
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-9-git-send-email-cernekee@gmail.com>

In XML POST mode, the gateway keeps track of which authgroup is selected.
Provide this information to the UI so that the interface can be rendered
correctly.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c                 |   21 +++++++++++++++++++++
 openconnect-internal.h |    1 +
 openconnect.h          |    2 ++
 3 files changed, 24 insertions(+)

diff --git a/auth.c b/auth.c
index e9dfb2f..2b08403 100644
--- a/auth.c
+++ b/auth.c
@@ -112,6 +112,17 @@ static int append_form_opts(struct openconnect_info *vpninfo,
 	return 0;
 }
 
+static int prop_equals(xmlNode *xml_node, const char *name, const char *value)
+{
+	char *tmp = (char *)xmlGetProp(xml_node, (unsigned char *)name);
+	int ret = 0;
+
+	if (tmp && !strcasecmp(tmp, value))
+		ret = 1;
+	free(tmp);
+	return ret;
+}
+
 /*
  * Maybe we should offer this choice to the user. So far we've only
  * ever seen it offer bogus choices though -- between certificate and
@@ -123,6 +134,7 @@ static int parse_auth_choice(struct openconnect_info *vpninfo, struct __oc_auth_
 			     xmlNode *xml_node)
 {
 	struct __oc_form_opt_select *opt;
+	int selection = 0;
 
 	opt = calloc(1, sizeof(*opt));
 	if (!opt)
@@ -167,6 +179,15 @@ static int parse_auth_choice(struct openconnect_info *vpninfo, struct __oc_auth_
 		choice->u.auth_type = (char *)xmlGetProp(xml_node, (unsigned char *)"auth-type");
 		choice->u.override_name = (char *)xmlGetProp(xml_node, (unsigned char *)"override-name");
 		choice->u.override_label = (char *)xmlGetProp(xml_node, (unsigned char *)"override-label");
+
+		if (prop_equals(xml_node, "selected", "true"))
+			selection = opt->nr_choices - 1;
+	}
+
+	if (!strcmp(opt->form.u.name, "group_list")) {
+		form->u.authgroup_field = opt->form.u.name;
+		form->u.authgroup_selection = selection;
+		form->authgroup_opt = opt;
 	}
 
 	/* We link the choice _first_ so it's at the top of what we present
diff --git a/openconnect-internal.h b/openconnect-internal.h
index c980ef8..1f52d5d 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -141,6 +141,7 @@ struct __oc_form_opt_select {
 struct __oc_auth_form {
 	struct oc_auth_form u;
 	struct __oc_form_opt *opts;
+	struct __oc_form_opt_select *authgroup_opt;
 };
 
 #define RECONNECT_INTERVAL_MIN	10
diff --git a/openconnect.h b/openconnect.h
index 8f601cb..18d31ae 100644
--- a/openconnect.h
+++ b/openconnect.h
@@ -134,6 +134,8 @@ struct oc_auth_form {
 	char *method;
 	char *action;
 	struct oc_form_opt *opts;
+	char *authgroup_field;
+	int authgroup_selection;
 };
 
 /****************************************************************************/
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:43:04 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:43:04 -0800
Subject: [PATCH/RFC V3 13/13] library: Bump API version to 2.3 and document
 changes
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-14-git-send-email-cernekee@gmail.com>

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 openconnect.h |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/openconnect.h b/openconnect.h
index 97747ff..9561b55 100644
--- a/openconnect.h
+++ b/openconnect.h
@@ -32,9 +32,12 @@
 #include <unistd.h>
 
 #define OPENCONNECT_API_VERSION_MAJOR 2
-#define OPENCONNECT_API_VERSION_MINOR 2
+#define OPENCONNECT_API_VERSION_MINOR 3
 
 /*
+ * API version 2.3:
+ *  - Add OC_FORM_RESULT_* and oc_auth_form->authgroup_*
+ *
  * API version 2.2:
  *  - Add openconnect_set_token_mode(), openconnect_has_oath_support()
  *  - Deprecate openconnect_set_stoken_mode()
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:43:01 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:43:01 -0800
Subject: [PATCH/RFC V3 10/13] auth: Remove outdated comment for
 parse_auth_choice()
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-11-git-send-email-cernekee@gmail.com>

We do offer <select> choices to the user (and have for some time).

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c |    7 -------
 1 file changed, 7 deletions(-)

diff --git a/auth.c b/auth.c
index 7c95037..9f6e6d0 100644
--- a/auth.c
+++ b/auth.c
@@ -123,13 +123,6 @@ static int prop_equals(xmlNode *xml_node, const char *name, const char *value)
 	return ret;
 }
 
-/*
- * Maybe we should offer this choice to the user. So far we've only
- * ever seen it offer bogus choices though -- between certificate and
- * password authentication, when the former has already failed.
- * So we just accept the first option with an auth-type property.
- */
-
 static int parse_auth_choice(struct openconnect_info *vpninfo, struct __oc_auth_form *form,
 			     xmlNode *xml_node)
 {
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:43:00 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:43:00 -0800
Subject: [PATCH/RFC V3 09/13] process_auth_form: Add code to support NEWGROUP
 return status from UI
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-10-git-send-email-cernekee@gmail.com>

In order to support refreshing the <opaque> data (XML POST) or the
secondary_* fields (non XML POST) on the auth form, it is necessary for
the process_auth_form() callback to return to libopenconnect to refresh
the form fields whenever the user changes the value of a <select>
dropdown.

This change should not break existing implementations.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c        |   12 ++++++++++++
 http.c        |    8 ++++++++
 library.c     |    1 +
 main.c        |    9 ++++++---
 openconnect.h |    1 +
 5 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/auth.c b/auth.c
index 2b08403..7c95037 100644
--- a/auth.c
+++ b/auth.c
@@ -631,6 +631,7 @@ int process_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *f
 		return OC_FORM_RESULT_ERR;
 	}
 
+retry:
 	/* We have two parallel linked lists of form fields here:
 	   form->u.opts is a linked list of user-visible oc_form_opt's
 	   form->opts is a linked list of internally-visible __oc_form_opt's
@@ -661,6 +662,17 @@ int process_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *f
 			sopt->u = NULL;
 		}
 	}
+
+	if (ret == OC_FORM_RESULT_NEWGROUP &&
+	    form->authgroup_opt &&
+	    form->authgroup_opt->form.u.value) {
+		free(vpninfo->authgroup);
+		vpninfo->authgroup = strdup(form->authgroup_opt->form.u.value);
+
+		if (!vpninfo->xmlpost)
+			goto retry;
+	}
+
 	return ret;
 }
 
diff --git a/http.c b/http.c
index 4f85f8a..f66acf5 100644
--- a/http.c
+++ b/http.c
@@ -1025,6 +1025,7 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
 	 * b) Same-host redirect (e.g. Location: /foo/bar)
 	 * c) Three redirects without seeing a plausible login form
 	 */
+newgroup:
 	result = xmlpost_initial_req(vpninfo, request_body, sizeof(request_body), 0);
 	if (result < 0)
 		return result;
@@ -1185,6 +1186,13 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
 			goto out;
 		if (result == __OC_FORM_RESULT_LOGGEDIN)
 			break;
+		if (result == OC_FORM_RESULT_NEWGROUP) {
+			free(form_buf);
+			form_buf = NULL;
+			free_auth_form(form);
+			form = NULL;
+			goto newgroup;
+		}
 
 		result = do_https_request(vpninfo, method, request_body_type, request_body,
 					  &form_buf, 1);
diff --git a/library.c b/library.c
index 66bf89b..e1bd0f2 100644
--- a/library.c
+++ b/library.c
@@ -145,6 +145,7 @@ void openconnect_vpninfo_free(struct openconnect_info *vpninfo)
 		vpninfo->peer_cert = NULL;
 	}
 	free(vpninfo->useragent);
+	free(vpninfo->authgroup);
 #ifdef HAVE_LIBSTOKEN
 	if (vpninfo->stoken_pin)
 		free(vpninfo->stoken_pin);
diff --git a/main.c b/main.c
index b7ccb1f..c9a3fa4 100644
--- a/main.c
+++ b/main.c
@@ -1105,13 +1105,12 @@ static int process_auth_form_cb(void *_vpninfo,
 		if (opt->type == OC_FORM_OPT_SELECT) {
 			struct oc_form_opt_select *select_opt = (void *)opt;
 			struct oc_choice *choice = NULL;
-			int i;
+			int i, is_group_list = form->authgroup_field && !strcmp(opt->name, form->authgroup_field);
 
 			if (!select_opt->nr_choices)
 				continue;
 
-			if (authgroup &&
-			    !strcmp(opt->name, "group_list")) {
+			if (authgroup && is_group_list) {
 				for (i = 0; i < select_opt->nr_choices; i++) {
 					choice = &select_opt->choices[i];
 
@@ -1158,9 +1157,13 @@ static int process_auth_form_cb(void *_vpninfo,
 
 			for (i = 0; i < select_opt->nr_choices; i++) {
 				choice = &select_opt->choices[i];
+				select_opt->form.value = choice->name;
 
 				if (!strcmp(response, choice->label)) {
 					select_opt->form.value = choice->name;
+					authgroup = strdup(choice->label);
+					if (is_group_list)
+						return OC_FORM_RESULT_NEWGROUP;
 					break;
 				}
 			}
diff --git a/openconnect.h b/openconnect.h
index 18d31ae..97747ff 100644
--- a/openconnect.h
+++ b/openconnect.h
@@ -96,6 +96,7 @@
 #define OC_FORM_RESULT_ERR		-1
 #define OC_FORM_RESULT_OK		0
 #define OC_FORM_RESULT_CANCELLED	1
+#define OC_FORM_RESULT_NEWGROUP		2
 #define __OC_FORM_RESULT_LOGGEDIN	255	/* internal library use only */
 
 /* char * fields are static (owned by XML parser) and don't need to be
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:43:02 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:43:02 -0800
Subject: [PATCH/RFC V3 11/13] auth: Parse second-auth-related properties from
 the auth form
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-12-git-send-email-cernekee@gmail.com>

Add new fields to the internal __oc_form_opt and __oc_choice structs.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c                 |    8 ++++++++
 openconnect-internal.h |    5 +++++
 2 files changed, 13 insertions(+)

diff --git a/auth.c b/auth.c
index 9f6e6d0..6ff0b01 100644
--- a/auth.c
+++ b/auth.c
@@ -173,6 +173,13 @@ static int parse_auth_choice(struct openconnect_info *vpninfo, struct __oc_auth_
 		choice->u.override_name = (char *)xmlGetProp(xml_node, (unsigned char *)"override-name");
 		choice->u.override_label = (char *)xmlGetProp(xml_node, (unsigned char *)"override-label");
 
+		choice->second_auth = prop_equals(xml_node, "second-auth", "1");
+		choice->secondary_username = (char *)xmlGetProp(xml_node,
+			(unsigned char *)"secondary_username");
+		choice->secondary_username_editable = prop_equals(xml_node,
+			"secondary_username_editable", "true");
+		choice->noaaa = prop_equals(xml_node, "noaaa", "1");
+
 		if (prop_equals(xml_node, "selected", "true"))
 			selection = opt->nr_choices - 1;
 	}
@@ -247,6 +254,7 @@ static int parse_form(struct openconnect_info *vpninfo, struct __oc_auth_form *f
 
 		opt->u.name = input_name;
 		opt->u.label = input_label;
+		opt->second_auth = prop_equals(xml_node, "second-auth", "1");
 
 		if (!strcmp(input_type, "hidden")) {
 			opt->u.type = OC_FORM_OPT_HIDDEN;
diff --git a/openconnect-internal.h b/openconnect-internal.h
index 1f52d5d..51ff7ad 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -125,10 +125,15 @@ struct pin_cache {
 struct __oc_form_opt {
 	struct __oc_form_opt *next;
 	struct oc_form_opt u;
+	int second_auth;
 };
 
 struct __oc_choice {
 	struct oc_choice u;
+	int second_auth;
+	char *secondary_username;
+	int secondary_username_editable;
+	int noaaa;
 };
 
 struct __oc_form_opt_select {
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:43:03 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:43:03 -0800
Subject: [PATCH/RFC V3 12/13] auth: Hide unused form fields based on the
 selected authgroup
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-13-git-send-email-cernekee@gmail.com>

Non-aggregate-auth servers have limited support for customizing the login
form based on which authgroup is currently selected.  Selectively convert
text/password fields to hidden fields, based on the following attributes:

  <input second-auth="1"> (for text/password fields)

  <option                 (for authgroup options)
          second-auth="1"
          secondary_username="foo"
          secondary_username_editable="true"
          noaaa="1" >

Note that implementing secondary_username_editable can cause
libopenconnect to prepopulate the opt->value field, which may be blindly
overwritten (without freeing) by legacy clients.  The other changes
should be backward-compatible, although they are not fully functional
on clients that do not implement OC_FORM_RESULT_NEWGROUP.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c |   36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/auth.c b/auth.c
index 6ff0b01..4f94df4 100644
--- a/auth.c
+++ b/auth.c
@@ -626,6 +626,8 @@ int process_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *f
 	int ret;
 	struct __oc_form_opt *opt;
 	struct oc_form_opt **last;
+	struct __oc_form_opt_select *grp = form->authgroup_opt;
+	struct __oc_choice *auth_choice;
 
 	if (!vpninfo->process_auth_form) {
 		vpn_progress(vpninfo, PRG_ERR, _("No form handler; cannot authenticate.\n"));
@@ -633,6 +635,18 @@ int process_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *f
 	}
 
 retry:
+	auth_choice = NULL;
+	if (grp && grp->nr_choices && !vpninfo->xmlpost) {
+		if (vpninfo->authgroup) {
+			/* For non-XML-POST, the server doesn't tell us which group is selected */
+			int i;
+			for (i = 0; i < grp->nr_choices; i++)
+				if (!strcmp(grp->choices[i].u.name, vpninfo->authgroup))
+					form->u.authgroup_selection = i;
+		}
+		auth_choice = &grp->choices[form->u.authgroup_selection];
+	}
+
 	/* We have two parallel linked lists of form fields here:
 	   form->u.opts is a linked list of user-visible oc_form_opt's
 	   form->opts is a linked list of internally-visible __oc_form_opt's
@@ -647,10 +661,26 @@ retry:
 				continue;
 			*last = (struct oc_form_opt *)sopt->u;
 			last = &sopt->u->form.next;
-		} else {
-			*last = &opt->u;
-			last = &opt->u.next;
+			continue;
+		} else if (!auth_choice) {
+			/* nothing left to check */
+		} else if (auth_choice->noaaa &&
+			   (opt->u.type == OC_FORM_OPT_TEXT || opt->u.type == OC_FORM_OPT_PASSWORD)) {
+			/* nuke all text fields for noaaa groups */
+			continue;
+		} else if (!auth_choice->second_auth && opt->second_auth) {
+			/* hide second-auth fields if a non-second-auth group is selected */
+			continue;
+		} else if (!strcmp(opt->u.name, "secondary_username") && opt->second_auth) {
+			if (auth_choice->secondary_username) {
+				free(opt->u.value);
+				opt->u.value = strdup(auth_choice->secondary_username);
+			}
+			if (!auth_choice->secondary_username_editable)
+				continue;
 		}
+		*last = &opt->u;
+		last = &opt->u.next;
 	}
 	*last = NULL;
 	ret = vpninfo->process_auth_form(vpninfo->cbdata, &form->u);
-- 
1.7.9.5



From cernekee at gmail.com  Sun Dec 15 01:43:05 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:43:05 -0800
Subject: [PATCH/RFC nm-openconnect] auth-dialog: First attempt at supporting
 NEWGROUP
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-15-git-send-email-cernekee@gmail.com>

When the user selects a different authgroup, return NEWGROUP to
libopenconnect to allow it to refresh the form.  Different groups may
require different prompts.

Also, if secondary_username is provided by the server, prepopulate the
form field.
---
 auth-dialog/main.c | 109 ++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 92 insertions(+), 17 deletions(-)

diff --git a/auth-dialog/main.c b/auth-dialog/main.c
index 8bc13b8..1be6236 100644
--- a/auth-dialog/main.c
+++ b/auth-dialog/main.c
@@ -71,6 +71,20 @@
 #define __openconnect_set_token_mode openconnect_set_token_mode
 #endif
 
+#if OPENCONNECT_CHECK_VER(2,3)
+#define NEWGROUP_SUPPORTED		1
+#define AUTHGROUP_FIELD(form)		(form)->authgroup_field
+#define AUTHGROUP_SELECTION(form)	(form)->authgroup_selection
+#else
+#define NEWGROUP_SUPPORTED		0
+#define AUTHGROUP_FIELD(form)		NULL
+#define AUTHGROUP_SELECTION(form)	0
+#define OC_FORM_RESULT_ERR		-1
+#define OC_FORM_RESULT_OK		0
+#define OC_FORM_RESULT_CANCELLED	1
+#define OC_FORM_RESULT_NEWGROUP		2
+#endif
+
 #ifdef OPENCONNECT_OPENSSL
 #include <openssl/ssl.h>
 #include <openssl/bio.h>
@@ -179,6 +193,9 @@ typedef struct auth_ui_data {
 	GCond form_shown_changed;
 	gboolean form_shown;
 
+	gboolean newgroup;
+	gboolean group_set;
+
 	GCond cert_response_changed;
 	enum certificate_response cert_response;
 } auth_ui_data;
@@ -271,6 +288,7 @@ typedef struct ui_fragment_data {
 #endif
 	struct oc_form_opt *opt;
 	char *entry_text;
+	int initial_selection;
 	int grab_focus;
 } ui_fragment_data;
 
@@ -334,6 +352,12 @@ static void combo_changed(GtkComboBox *combo, ui_fragment_data *data)
 
 	data->entry_text = sopt->choices[entry].name;
 
+	if (NEWGROUP_SUPPORTED && entry != data->initial_selection) {
+		data->ui_data->newgroup = TRUE;
+		gtk_dialog_response(GTK_DIALOG(data->ui_data->dialog), AUTH_DIALOG_RESPONSE_LOGIN);
+		return;
+	}
+
 	g_queue_foreach(data->ui_data->form_entries, (GFunc)do_override_label,
 			&sopt->choices[entry]);
 }
@@ -412,7 +436,7 @@ static gboolean ui_add_select (ui_fragment_data *data)
 	auth_ui_data *ui_data = _ui_data; /* FIXME global */
 	GtkWidget *hbox, *text, *combo;
 	struct oc_form_opt_select *sopt = (void *)data->opt;
-	int i;
+	int i, user_selection = -1;
 
 	hbox = gtk_box_new (GTK_ORIENTATION_HORIZONTAL, 0);
 	gtk_box_pack_start(GTK_BOX(data->ui_data->ssl_box), hbox, FALSE, FALSE, 0);
@@ -422,20 +446,21 @@ static gboolean ui_add_select (ui_fragment_data *data)
 
 	combo = gtk_combo_box_text_new();
 	gtk_box_pack_end(GTK_BOX(hbox), combo, FALSE, FALSE, 0);
+
 	for (i = 0; i < sopt->nr_choices; i++) {
 		gtk_combo_box_text_append_text(GTK_COMBO_BOX_TEXT(combo), sopt->choices[i].label);
 		if (data->entry_text &&
-		    !strcmp(data->entry_text, sopt->choices[i].name)) {
-			gtk_combo_box_set_active(GTK_COMBO_BOX(combo), i);
-			g_free(data->entry_text);
-			data->entry_text = sopt->choices[i].name;
-		}
-	}
-	if (gtk_combo_box_get_active(GTK_COMBO_BOX(combo)) < 0) {
-		gtk_combo_box_set_active(GTK_COMBO_BOX(combo), 0); 
-		data->entry_text = sopt->choices[0].name;
+		    !strcmp(data->entry_text, sopt->choices[i].name))
+			user_selection = i;
 	}
 
+	i = data->initial_selection != -1 ? data->initial_selection :
+	    user_selection != -1 ? user_selection : 0;
+	gtk_combo_box_set_active(GTK_COMBO_BOX(combo), i);
+	g_free(data->entry_text);
+	data->entry_text = sopt->choices[i].name;
+	data->initial_selection = i;
+
 	if (g_queue_peek_tail(ui_data->form_entries) == data)
 		gtk_widget_grab_focus (combo);
 	g_signal_connect(G_OBJECT(combo), "changed", G_CALLBACK(combo_changed), data);
@@ -672,10 +697,12 @@ static gboolean ui_form (struct oc_auth_form *form)
 			g_mutex_lock (&ui_data->form_mutex);
 			g_queue_push_head(ui_data->form_entries, data);
 			g_mutex_unlock (&ui_data->form_mutex);
-			if (opt->type != OC_FORM_OPT_PASSWORD)
+			if (opt->type != OC_FORM_OPT_PASSWORD) {
 				data->entry_text = g_strdup (find_form_answer(ui_data->secrets,
 									      form, opt));
-			else {
+				if (!data->entry_text)
+					data->entry_text = g_strdup (opt->value);
+			} else {
 				GHashTable *attrs;
 
 				data->cancel = g_cancellable_new ();
@@ -698,6 +725,11 @@ static gboolean ui_form (struct oc_auth_form *form)
 			data->entry_text = g_strdup (find_form_answer(ui_data->secrets,
 								      form, opt));
 
+			if (AUTHGROUP_FIELD(form) && !strcmp(AUTHGROUP_FIELD(form), opt->name))
+				data->initial_selection = AUTHGROUP_SELECTION(form);
+			else
+				data->initial_selection = -1;
+
 			ui_add_select(data);
 		} else
 			g_slice_free (ui_fragment_data, data);
@@ -706,11 +738,51 @@ static gboolean ui_form (struct oc_auth_form *form)
 	return ui_show(ui_data);
 }
 
+/* If our stored group_list selection differs from the server default, send a
+   NEWGROUP request to try to change it before rendering the form */
+
+static gboolean set_initial_authgroup (auth_ui_data *ui_data, struct oc_auth_form *form)
+{
+	struct oc_form_opt *opt;
+
+	if (!NEWGROUP_SUPPORTED || ui_data->group_set || !AUTHGROUP_FIELD(form))
+		return FALSE;
+	ui_data->group_set = TRUE;
+
+	for (opt = form->opts; opt; opt = opt->next) {
+		int i;
+		char *saved_group;
+		struct oc_form_opt_select *sopt;
+
+		if (opt->type != OC_FORM_OPT_SELECT || strcmp(opt->name, AUTHGROUP_FIELD(form)))
+			continue;
+
+		saved_group = find_form_answer(ui_data->secrets, form, opt);
+		if (!saved_group)
+			return FALSE;
+
+		sopt = (struct oc_form_opt_select *)opt;
+		for (i = 0; i < sopt->nr_choices; i++) {
+			struct oc_choice *ch = &sopt->choices[i];
+			if (!strcmp(saved_group, ch->name) && i != AUTHGROUP_SELECTION(form)) {
+				free(opt->value);
+				opt->value = g_strdup(saved_group);
+				return TRUE;
+			}
+		}
+	}
+	return FALSE;
+}
+
 static int nm_process_auth_form (void *cbdata, struct oc_auth_form *form)
 {
 	auth_ui_data *ui_data = cbdata;
 	int response;
 
+	if (set_initial_authgroup(ui_data, form))
+		return OC_FORM_RESULT_NEWGROUP;
+
+	ui_data->newgroup = FALSE;
 	g_idle_add((GSourceFunc)ui_form, form);
 
 	g_mutex_lock(&ui_data->form_mutex);
@@ -770,11 +842,14 @@ static int nm_process_auth_form (void *cbdata, struct oc_auth_form *form)
 
 	ui_data->form_grabbed = 0;
 	g_mutex_unlock(&ui_data->form_mutex);
-	
-	/* -1 = cancel,
-	 *  0 = failure,
-	 *  1 = success */
-	return (response == AUTH_DIALOG_RESPONSE_LOGIN ? 0 : 1);
+
+	if (response == AUTH_DIALOG_RESPONSE_LOGIN) {
+		if (ui_data->newgroup)
+			return OC_FORM_RESULT_NEWGROUP;
+		else
+			return OC_FORM_RESULT_OK;
+	} else
+		return OC_FORM_RESULT_CANCELLED;
 
 }
 
-- 
1.8.3.2



From cernekee at gmail.com  Sun Dec 15 01:42:58 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Sat, 14 Dec 2013 22:42:58 -0800
Subject: [PATCH/RFC V3 07/13] Split user-visible oc_* fields from internal
 fields
In-Reply-To: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
Message-ID: <1387089785-17543-8-git-send-email-cernekee@gmail.com>

Most of this commit consists of trivial substitutions, but it also
requires changing process_auth_form() to translate the internal __oc_*
structs into user-visible oc_* structs.

Signed-off-by: Kevin Cernekee <cernekee at gmail.com>
---
 auth.c                 |  239 +++++++++++++++++++++++++++++-------------------
 gnutls.c               |   24 ++---
 http.c                 |    8 +-
 openconnect-internal.h |   24 ++++-
 openssl.c              |   20 ++--
 ssl.c                  |   12 +--
 6 files changed, 199 insertions(+), 128 deletions(-)

diff --git a/auth.c b/auth.c
index 7bd2641..e9dfb2f 100644
--- a/auth.c
+++ b/auth.c
@@ -105,7 +105,7 @@ static int append_form_opts(struct openconnect_info *vpninfo,
 	int ret;
 
 	for (opt = form->opts; opt; opt = opt->next) {
-		ret = append_opt(body, bodylen, opt->name, opt->value);
+		ret = append_opt(body, bodylen, opt->u.name, opt->u.value);
 		if (ret)
 			return ret;
 	}
@@ -128,11 +128,11 @@ static int parse_auth_choice(struct openconnect_info *vpninfo, struct __oc_auth_
 	if (!opt)
 		return -ENOMEM;
 
-	opt->form.type = OC_FORM_OPT_SELECT;
-	opt->form.name = (char *)xmlGetProp(xml_node, (unsigned char *)"name");
-	opt->form.label = (char *)xmlGetProp(xml_node, (unsigned char *)"label");
+	opt->form.u.type = OC_FORM_OPT_SELECT;
+	opt->form.u.name = (char *)xmlGetProp(xml_node, (unsigned char *)"name");
+	opt->form.u.label = (char *)xmlGetProp(xml_node, (unsigned char *)"label");
 
-	if (!opt->form.name) {
+	if (!opt->form.u.name) {
 		vpn_progress(vpninfo, PRG_ERR, _("Form choice has no name\n"));
 		free(opt);
 		return -EINVAL;
@@ -162,11 +162,11 @@ static int parse_auth_choice(struct openconnect_info *vpninfo, struct __oc_auth_
 
 		choice = &opt->choices[opt->nr_choices-1];
 
-		choice->name = form_id;
-		choice->label = (char *)xmlNodeGetContent(xml_node);
-		choice->auth_type = (char *)xmlGetProp(xml_node, (unsigned char *)"auth-type");
-		choice->override_name = (char *)xmlGetProp(xml_node, (unsigned char *)"override-name");
-		choice->override_label = (char *)xmlGetProp(xml_node, (unsigned char *)"override-label");
+		choice->u.name = form_id;
+		choice->u.label = (char *)xmlNodeGetContent(xml_node);
+		choice->u.auth_type = (char *)xmlGetProp(xml_node, (unsigned char *)"auth-type");
+		choice->u.override_name = (char *)xmlGetProp(xml_node, (unsigned char *)"override-name");
+		choice->u.override_label = (char *)xmlGetProp(xml_node, (unsigned char *)"override-label");
 	}
 
 	/* We link the choice _first_ so it's at the top of what we present
@@ -231,20 +231,20 @@ static int parse_form(struct openconnect_info *vpninfo, struct __oc_auth_form *f
 			return -ENOMEM;
 		}
 
-		opt->name = input_name;
-		opt->label = input_label;
+		opt->u.name = input_name;
+		opt->u.label = input_label;
 
 		if (!strcmp(input_type, "hidden")) {
-			opt->type = OC_FORM_OPT_HIDDEN;
-			opt->value = (char *)xmlGetProp(xml_node, (unsigned char *)"value");
+			opt->u.type = OC_FORM_OPT_HIDDEN;
+			opt->u.value = (char *)xmlGetProp(xml_node, (unsigned char *)"value");
 		} else if (!strcmp(input_type, "text")) {
-			opt->type = OC_FORM_OPT_TEXT;
+			opt->u.type = OC_FORM_OPT_TEXT;
 		} else if (!strcmp(input_type, "password")) {
 			if (vpninfo->token_mode != OC_TOKEN_MODE_NONE &&
 			    (can_gen_tokencode(vpninfo, form, opt) == 0)) {
-				opt->type = OC_FORM_OPT_TOKEN;
+				opt->u.type = OC_FORM_OPT_TOKEN;
 			} else {
-				opt->type = OC_FORM_OPT_PASSWORD;
+				opt->u.type = OC_FORM_OPT_PASSWORD;
 			}
 		} else {
 			vpn_progress(vpninfo, PRG_INFO,
@@ -425,24 +425,24 @@ static int parse_auth_node(struct openconnect_info *vpninfo, xmlNode *xml_node,
 		if (xml_node->type != XML_ELEMENT_NODE)
 			continue;
 
-		xmlnode_get_text(xml_node, "banner", &form->banner);
-		xmlnode_get_text(xml_node, "message", &form->message);
-		xmlnode_get_text(xml_node, "error", &form->error);
+		xmlnode_get_text(xml_node, "banner", &form->u.banner);
+		xmlnode_get_text(xml_node, "message", &form->u.message);
+		xmlnode_get_text(xml_node, "error", &form->u.error);
 
 		if (xmlnode_is_named(xml_node, "form")) {
 
 			/* defaults for new XML POST */
-			form->method = strdup("POST");
-			form->action = strdup("/");
+			form->u.method = strdup("POST");
+			form->u.action = strdup("/");
 
-			xmlnode_get_prop(xml_node, "method", &form->method);
-			xmlnode_get_prop(xml_node, "action", &form->action);
+			xmlnode_get_prop(xml_node, "method", &form->u.method);
+			xmlnode_get_prop(xml_node, "action", &form->u.action);
 
-			if (!form->method || !form->action ||
-			    strcasecmp(form->method, "POST") || !form->action[0]) {
+			if (!form->u.method || !form->u.action ||
+			    strcasecmp(form->u.method, "POST") || !form->u.action[0]) {
 				vpn_progress(vpninfo, PRG_ERR,
 					     _("Cannot handle form method='%s', action='%s'\n"),
-					     form->method, form->action);
+					     form->u.method, form->u.action);
 				ret = -EINVAL;
 				goto out;
 			}
@@ -542,7 +542,7 @@ int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct
 				ret = -EINVAL;
 			}
 		} else if (xmlnode_is_named(xml_node, "auth")) {
-			xmlnode_get_prop(xml_node, "id", &form->auth_id);
+			xmlnode_get_prop(xml_node, "id", &form->u.auth_id);
 			ret = parse_auth_node(vpninfo, xml_node, form);
 		} else if (xmlnode_is_named(xml_node, "opaque")) {
 			if (vpninfo->opaque_srvdata)
@@ -554,7 +554,7 @@ int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct
 			ret = parse_host_scan_node(vpninfo, xml_node);
 		} else {
 			xmlnode_get_text(xml_node, "session-token", &vpninfo->cookie);
-			xmlnode_get_text(xml_node, "error", &form->error);
+			xmlnode_get_text(xml_node, "error", &form->u.error);
 		}
 
 		if (ret)
@@ -562,7 +562,7 @@ int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct
 		xml_node = xml_node->next;
 	}
 
-	if (!form->auth_id && (!cert_rq || !*cert_rq)) {
+	if (!form->u.auth_id && (!cert_rq || !*cert_rq)) {
 		vpn_progress(vpninfo, PRG_ERR,
 			     _("XML response has no \"auth\" node\n"));
 		ret = -EINVAL;
@@ -579,13 +579,68 @@ int parse_xml_response(struct openconnect_info *vpninfo, char *response, struct
 	return ret;
 }
 
+static int dup_select_opt(struct __oc_form_opt_select *sopt)
+{
+	struct oc_form_opt_select *usopt;
+	int i;
+
+	if (!sopt->nr_choices)
+		return -EINVAL;
+
+	usopt = calloc(1, sizeof(*sopt) + sizeof(struct oc_choice) * sopt->nr_choices);
+	if (!usopt)
+		return -ENOMEM;
+
+	usopt->form = sopt->form.u;
+	usopt->nr_choices = sopt->nr_choices;
+	for (i = 0; i < usopt->nr_choices; i++)
+		usopt->choices[i] = sopt->choices[i].u;
+	sopt->u = usopt;
+	return 0;
+}
+
 int process_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *form)
 {
+	int ret;
+	struct __oc_form_opt *opt;
+	struct oc_form_opt **last;
+
 	if (!vpninfo->process_auth_form) {
 		vpn_progress(vpninfo, PRG_ERR, _("No form handler; cannot authenticate.\n"));
 		return OC_FORM_RESULT_ERR;
 	}
-	return vpninfo->process_auth_form(vpninfo->cbdata, form);
+
+	/* We have two parallel linked lists of form fields here:
+	   form->u.opts is a linked list of user-visible oc_form_opt's
+	   form->opts is a linked list of internally-visible __oc_form_opt's
+	   The former may omit fields contained in the latter. */
+	last = &form->u.opts;
+
+	for (opt = form->opts; opt; opt = opt->next) {
+		if (opt->u.type == OC_FORM_OPT_SELECT) {
+			struct __oc_form_opt_select *sopt = (void *)opt;
+
+			if (dup_select_opt(sopt) < 0)
+				continue;
+			*last = (struct oc_form_opt *)sopt->u;
+			last = &sopt->u->form.next;
+		} else {
+			*last = &opt->u;
+			last = &opt->u.next;
+		}
+	}
+	*last = NULL;
+	ret = vpninfo->process_auth_form(vpninfo->cbdata, &form->u);
+
+	for (opt = form->opts; opt; opt = opt->next) {
+		if (opt->u.type == OC_FORM_OPT_SELECT) {
+			struct __oc_form_opt_select *sopt = (void *)opt;
+			sopt->form.u.value = sopt->u->form.value;
+			free(sopt->u);
+			sopt->u = NULL;
+		}
+	}
+	return ret;
 }
 
 /* Return value:
@@ -601,7 +656,7 @@ int handle_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *fo
 	int ret;
 	struct vpn_option *opt, *next;
 
-	if (!strcmp(form->auth_id, "success"))
+	if (!strcmp(form->u.auth_id, "success"))
 		return __OC_FORM_RESULT_LOGGEDIN;
 
 	if (vpninfo->nopasswd) {
@@ -623,10 +678,10 @@ int handle_auth_form(struct openconnect_info *vpninfo, struct __oc_auth_form *fo
 		return OC_FORM_RESULT_OK;
 	}
 	if (!form->opts) {
-		if (form->message)
-			vpn_progress(vpninfo, PRG_INFO, "%s\n", form->message);
-		if (form->error)
-			vpn_progress(vpninfo, PRG_ERR, "%s\n", form->error);
+		if (form->u.message)
+			vpn_progress(vpninfo, PRG_INFO, "%s\n", form->u.message);
+		if (form->u.error)
+			vpn_progress(vpninfo, PRG_ERR, "%s\n", form->u.error);
 		return -EPERM;
 	}
 
@@ -655,34 +710,34 @@ void free_auth_form(struct __oc_auth_form *form)
 		return;
 	while (form->opts) {
 		struct __oc_form_opt *tmp = form->opts->next;
-		if (form->opts->type == OC_FORM_OPT_TEXT ||
-		    form->opts->type == OC_FORM_OPT_PASSWORD ||
-		    form->opts->type == OC_FORM_OPT_HIDDEN ||
-		    form->opts->type == OC_FORM_OPT_TOKEN)
-			free(form->opts->value);
-		else if (form->opts->type == OC_FORM_OPT_SELECT) {
+		if (form->opts->u.type == OC_FORM_OPT_TEXT ||
+		    form->opts->u.type == OC_FORM_OPT_PASSWORD ||
+		    form->opts->u.type == OC_FORM_OPT_HIDDEN ||
+		    form->opts->u.type == OC_FORM_OPT_TOKEN)
+			free(form->opts->u.value);
+		else if (form->opts->u.type == OC_FORM_OPT_SELECT) {
 			struct __oc_form_opt_select *sel = (void *)form->opts;
 			int i;
 
 			for (i = 0; i < sel->nr_choices; i++) {
-				free(sel->choices[i].name);
-				free(sel->choices[i].label);
-				free(sel->choices[i].auth_type);
-				free(sel->choices[i].override_name);
-				free(sel->choices[i].override_label);
+				free(sel->choices[i].u.name);
+				free(sel->choices[i].u.label);
+				free(sel->choices[i].u.auth_type);
+				free(sel->choices[i].u.override_name);
+				free(sel->choices[i].u.override_label);
 			}
 		}
-		free(form->opts->label);
-		free(form->opts->name);
+		free(form->opts->u.label);
+		free(form->opts->u.name);
 		free(form->opts);
 		form->opts = tmp;
 	}
-	free(form->error);
-	free(form->message);
-	free(form->banner);
-	free(form->auth_id);
-	free(form->method);
-	free(form->action);
+	free(form->u.error);
+	free(form->u.message);
+	free(form->u.banner);
+	free(form->u.auth_id);
+	free(form->u.method);
+	free(form->u.action);
 	free(form);
 }
 
@@ -840,29 +895,29 @@ static int xmlpost_append_form_opts(struct openconnect_info *vpninfo,
 
 	for (opt = form->opts; opt; opt = opt->next) {
 		/* group_list: create a new <group-select> node under <config-auth> */
-		if (!strcmp(opt->name, "group_list")) {
-			if (!xmlNewTextChild(root, NULL, XCAST("group-select"), XCAST(opt->value)))
+		if (!strcmp(opt->u.name, "group_list")) {
+			if (!xmlNewTextChild(root, NULL, XCAST("group-select"), XCAST(opt->u.value)))
 				goto bad;
 			continue;
 		}
 
 		/* answer,whichpin,new_password: rename to "password" */
-		if (!strcmp(opt->name, "answer") ||
-		    !strcmp(opt->name, "whichpin") ||
-		    !strcmp(opt->name, "new_password")) {
-			if (!xmlNewTextChild(node, NULL, XCAST("password"), XCAST(opt->value)))
+		if (!strcmp(opt->u.name, "answer") ||
+		    !strcmp(opt->u.name, "whichpin") ||
+		    !strcmp(opt->u.name, "new_password")) {
+			if (!xmlNewTextChild(node, NULL, XCAST("password"), XCAST(opt->u.value)))
 				goto bad;
 			continue;
 		}
 
 		/* verify_pin,verify_password: ignore */
-		if (!strcmp(opt->name, "verify_pin") ||
-		    !strcmp(opt->name, "verify_password")) {
+		if (!strcmp(opt->u.name, "verify_pin") ||
+		    !strcmp(opt->u.name, "verify_password")) {
 			continue;
 		}
 
 		/* everything else: create <foo>user_input</foo> under <auth> */
-		if (!xmlNewTextChild(node, NULL, XCAST(opt->name), XCAST(opt->value)))
+		if (!xmlNewTextChild(node, NULL, XCAST(opt->u.name), XCAST(opt->u.value)))
 			goto bad;
 	}
 
@@ -882,8 +937,8 @@ bad:
 static void nuke_opt_values(struct __oc_form_opt *opt)
 {
 	for (; opt; opt = opt->next) {
-		free(opt->value);
-		opt->value = NULL;
+		free(opt->u.value);
+		opt->u.value = NULL;
 	}
 }
 #endif
@@ -912,40 +967,40 @@ int prepare_stoken(struct openconnect_info *vpninfo)
 	memset(&opts, 0, sizeof(opts));
 
 	form.opts = opts;
-	form.message = (char *)_("Enter credentials to unlock software token.");
+	form.u.message = (char *)_("Enter credentials to unlock software token.");
 
 	vpninfo->token_tries = 0;
 	vpninfo->token_bypassed = 0;
 
 	if (stoken_devid_required(vpninfo->stoken_ctx)) {
-		opt->type = OC_FORM_OPT_TEXT;
-		opt->name = (char *)"devid";
-		opt->label = (char *)_("Device ID:");
-		devid = &opt->value;
+		opt->u.type = OC_FORM_OPT_TEXT;
+		opt->u.name = (char *)"devid";
+		opt->u.label = (char *)_("Device ID:");
+		devid = &opt->u.value;
 		opt++;
 	}
 	if (stoken_pass_required(vpninfo->stoken_ctx)) {
-		opt->type = OC_FORM_OPT_PASSWORD;
-		opt->name = (char *)"password";
-		opt->label = (char *)_("Password:");
-		pass = &opt->value;
+		opt->u.type = OC_FORM_OPT_PASSWORD;
+		opt->u.name = (char *)"password";
+		opt->u.label = (char *)_("Password:");
+		pass = &opt->u.value;
 		opt++;
 	}
 	if (stoken_pin_required(vpninfo->stoken_ctx)) {
-		opt->type = OC_FORM_OPT_PASSWORD;
-		opt->name = (char *)"password";
-		opt->label = (char *)_("PIN:");
-		pin = &opt->value;
+		opt->u.type = OC_FORM_OPT_PASSWORD;
+		opt->u.name = (char *)"password";
+		opt->u.label = (char *)_("PIN:");
+		pin = &opt->u.value;
 		opt++;
 	}
 
-	opts[0].next = opts[1].type ? &opts[1] : NULL;
-	opts[1].next = opts[2].type ? &opts[2] : NULL;
+	opts[0].next = opts[1].u.type ? &opts[1] : NULL;
+	opts[1].next = opts[2].u.type ? &opts[2] : NULL;
 
 	while (1) {
 		nuke_opt_values(opts);
 
-		if (!opts[0].type) {
+		if (!opts[0].u.type) {
 			/* don't bug the user if there's nothing to enter */
 			ret = 0;
 		} else {
@@ -957,7 +1012,7 @@ int prepare_stoken(struct openconnect_info *vpninfo)
 				break;
 
 			for (opt = opts; opt; opt = opt->next) {
-				if (!opt->value || !strlen(opt->value))
+				if (!opt->u.value || !strlen(opt->u.value))
 					some_empty = 1;
 				else
 					all_empty = 0;
@@ -1023,15 +1078,15 @@ static int can_gen_stoken_code(struct openconnect_info *vpninfo,
 			       struct __oc_form_opt *opt)
 {
 #ifdef HAVE_LIBSTOKEN
-	if ((strcmp(opt->name, "password") && strcmp(opt->name, "answer")) ||
+	if ((strcmp(opt->u.name, "password") && strcmp(opt->u.name, "answer")) ||
 	    vpninfo->token_bypassed)
 		return -EINVAL;
 	if (vpninfo->token_tries == 0) {
 		vpn_progress(vpninfo, PRG_DEBUG,
 			     _("OK to generate INITIAL tokencode\n"));
 		vpninfo->token_time = 0;
-	} else if (vpninfo->token_tries == 1 && form->message &&
-		   strcasestr(form->message, "next tokencode")) {
+	} else if (vpninfo->token_tries == 1 && form->u.message &&
+		   strcasestr(form->u.message, "next tokencode")) {
 		vpn_progress(vpninfo, PRG_DEBUG,
 			     _("OK to generate NEXT tokencode\n"));
 		vpninfo->token_time += 60;
@@ -1056,7 +1111,7 @@ static int can_gen_totp_code(struct openconnect_info *vpninfo,
 			     struct __oc_form_opt *opt)
 {
 #ifdef HAVE_LIBOATH
-	if ((strcmp(opt->name, "secondary_password") != 0) ||
+	if ((strcmp(opt->u.name, "secondary_password") != 0) ||
 	    vpninfo->token_bypassed)
 		return -EINVAL;
 	if (vpninfo->token_tries == 0) {
@@ -1118,8 +1173,8 @@ static int do_gen_stoken_code(struct openconnect_info *vpninfo,
 	}
 
 	vpninfo->token_tries++;
-	opt->value = strdup(tokencode);
-	return opt->value ? 0 : -ENOMEM;
+	opt->u.value = strdup(tokencode);
+	return opt->u.value ? 0 : -ENOMEM;
 #else
 	return 0;
 #endif
@@ -1152,8 +1207,8 @@ static int do_gen_totp_code(struct openconnect_info *vpninfo,
 	}
 
 	vpninfo->token_tries++;
-	opt->value = strdup(tokencode);
-	return opt->value ? 0 : -ENOMEM;
+	opt->u.value = strdup(tokencode);
+	return opt->u.value ? 0 : -ENOMEM;
 #else
 	return 0;
 #endif
@@ -1172,7 +1227,7 @@ static int do_gen_tokencode(struct openconnect_info *vpninfo,
 		/* this form might not have anything for us to do */
 		if (!opt)
 			return 0;
-		if (opt->type == OC_FORM_OPT_TOKEN)
+		if (opt->u.type == OC_FORM_OPT_TOKEN)
 			break;
 	}
 
diff --git a/gnutls.c b/gnutls.c
index 852e061..3855aa5 100644
--- a/gnutls.c
+++ b/gnutls.c
@@ -2156,12 +2156,12 @@ static P11KitPin *pin_callback(const char *pin_source, P11KitUri *pin_uri,
 	}
 
 	memset(&f, 0, sizeof(f));
-	f.auth_id = (char *)"pkcs11_pin";
+	f.u.auth_id = (char *)"pkcs11_pin";
 	f.opts = &o;
 
 	message[sizeof(message)-1] = 0;
 	snprintf(message, sizeof(message) - 1, _("PIN required for %s"), pin_description);
-	f.message = message;
+	f.u.message = message;
 
 	/*
 	 * In p11-kit <= 0.12, these flags are *odd*.
@@ -2170,25 +2170,25 @@ static P11KitPin *pin_callback(const char *pin_source, P11KitUri *pin_uri,
 	 * http://cgit.freedesktop.org/p11-glue/p11-kit/commit/?id=59774b11
 	 */
 	if ((flags & P11_KIT_PIN_FLAGS_RETRY) == P11_KIT_PIN_FLAGS_RETRY)
-		f.error = (char *)_("Wrong PIN");
+		f.u.error = (char *)_("Wrong PIN");
 
 	if ((flags & P11_KIT_PIN_FLAGS_FINAL_TRY) == P11_KIT_PIN_FLAGS_FINAL_TRY)
-		f.banner = (char *)_("This is the final try before locking!");
+		f.u.banner = (char *)_("This is the final try before locking!");
 	else if ((flags & P11_KIT_PIN_FLAGS_MANY_TRIES) == P11_KIT_PIN_FLAGS_MANY_TRIES)
-		f.banner = (char *)_("Only a few tries left before locking!");
+		f.u.banner = (char *)_("Only a few tries left before locking!");
 
 	o.next = NULL;
-	o.type = OC_FORM_OPT_PASSWORD;
-	o.name = (char *)"pkcs11_pin";
-	o.label = (char *)_("Enter PIN:");
-	o.value = NULL;
+	o.u.type = OC_FORM_OPT_PASSWORD;
+	o.u.name = (char *)"pkcs11_pin";
+	o.u.label = (char *)_("Enter PIN:");
+	o.u.value = NULL;
 
 	ret = process_auth_form(vpninfo, &f);
-	if (ret || !o.value)
+	if (ret || !o.u.value)
 		return NULL;
 
-	pin = p11_kit_pin_new_for_string(o.value);
-	(*cache)->pin = o.value;
+	pin = p11_kit_pin_new_for_string(o.u.value);
+	(*cache)->pin = o.u.value;
 
 	return pin;
 }
diff --git a/http.c b/http.c
index c4fffe5..4f85f8a 100644
--- a/http.c
+++ b/http.c
@@ -1100,8 +1100,8 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
 				goto fail;
 			continue;
 		}
-		if (form && form->action) {
-			vpninfo->redirect_url = strdup(form->action);
+		if (form && form->u.action) {
+			vpninfo->redirect_url = strdup(form->u.action);
 			handle_redirect(vpninfo);
 		}
 		break;
@@ -1194,8 +1194,8 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
 		result = parse_xml_response(vpninfo, form_buf, &form, NULL);
 		if (result < 0)
 			goto out;
-		if (form->action) {
-			vpninfo->redirect_url = strdup(form->action);
+		if (form->u.action) {
+			vpninfo->redirect_url = strdup(form->u.action);
 			handle_redirect(vpninfo);
 		}
 	}
diff --git a/openconnect-internal.h b/openconnect-internal.h
index 7048c0f..c980ef8 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -122,10 +122,26 @@ struct pin_cache {
 	char *pin;
 };
 
-#define __oc_form_opt		oc_form_opt
-#define __oc_choice		oc_choice
-#define __oc_form_opt_select	oc_form_opt_select
-#define __oc_auth_form		oc_auth_form
+struct __oc_form_opt {
+	struct __oc_form_opt *next;
+	struct oc_form_opt u;
+};
+
+struct __oc_choice {
+	struct oc_choice u;
+};
+
+struct __oc_form_opt_select {
+	struct __oc_form_opt form;
+	struct oc_form_opt_select *u;
+	int nr_choices;
+	struct __oc_choice choices[0];
+};
+
+struct __oc_auth_form {
+	struct oc_auth_form u;
+	struct __oc_form_opt *opts;
+};
 
 #define RECONNECT_INTERVAL_MIN	10
 #define RECONNECT_INTERVAL_MAX	100
diff --git a/openssl.c b/openssl.c
index dda102c..b9cdc2d 100644
--- a/openssl.c
+++ b/openssl.c
@@ -258,7 +258,7 @@ static int ui_open(UI *ui)
 	memset(ui_data, 0, sizeof(*ui_data));
 	ui_data->last_opt = &ui_data->form.opts;
 	ui_data->vpninfo = vpninfo;
-	ui_data->form.auth_id = (char *)"openssl_ui";
+	ui_data->form.u.auth_id = (char *)"openssl_ui";
 	UI_add_user_data(ui, ui_data);
 
 	return 1;
@@ -271,10 +271,10 @@ static int ui_write(UI *ui, UI_STRING *uis)
 
 	switch (UI_get_string_type(uis)) {
 	case UIT_ERROR:
-		ui_data->form.error = (char *)UI_get0_output_string(uis);
+		ui_data->form.u.error = (char *)UI_get0_output_string(uis);
 		break;
 	case UIT_INFO:
-		ui_data->form.message = (char *)UI_get0_output_string(uis);
+		ui_data->form.u.message = (char *)UI_get0_output_string(uis);
 		break;
 	case UIT_PROMPT:
 		opt = malloc(sizeof(*opt));
@@ -282,11 +282,11 @@ static int ui_write(UI *ui, UI_STRING *uis)
 			return 1;
 		memset(opt, 0, sizeof(*opt));
 		opt->uis = uis;
-		opt->opt.label = opt->opt.name = (char *)UI_get0_output_string(uis);
+		opt->opt.u.label = opt->opt.u.name = (char *)UI_get0_output_string(uis);
 		if (UI_get_input_flags(uis) & UI_INPUT_FLAG_ECHO)
-			opt->opt.type = OC_FORM_OPT_TEXT;
+			opt->opt.u.type = OC_FORM_OPT_TEXT;
 		else
-			opt->opt.type = OC_FORM_OPT_PASSWORD;
+			opt->opt.u.type = OC_FORM_OPT_PASSWORD;
 		*(ui_data->last_opt) = &opt->opt;
 		ui_data->last_opt = &opt->opt.next;
 		break;
@@ -312,8 +312,8 @@ static int ui_flush(UI *ui)
 
 	for (opt = (struct ui_form_opt *)ui_data->form.opts; opt;
 	     opt = (struct ui_form_opt *)opt->opt.next) {
-		if (opt->opt.value && opt->uis)
-			UI_set_result(ui, opt->uis, opt->opt.value);
+		if (opt->opt.u.value && opt->uis)
+			UI_set_result(ui, opt->uis, opt->opt.u.value);
 	}
 	return 1;
 }
@@ -326,8 +326,8 @@ static int ui_close(UI *ui)
 	opt = (struct ui_form_opt *)ui_data->form.opts;
 	while (opt) {
 		next_opt = (struct ui_form_opt *)opt->opt.next;
-		if (opt->opt.value)
-			free(opt->opt.value);
+		if (opt->opt.u.value)
+			free(opt->opt.u.value);
 		free(opt);
 		opt = next_opt;
 	}
diff --git a/ssl.c b/ssl.c
index 7c1f194..5242a08 100644
--- a/ssl.c
+++ b/ssl.c
@@ -324,18 +324,18 @@ int request_passphrase(struct openconnect_info *vpninfo, const char *label,
 	vsnprintf(buf, 1023, fmt, args);
 	va_end(args);
 
-	f.auth_id = (char *)label;
+	f.u.auth_id = (char *)label;
 	f.opts = &o;
 
 	o.next = NULL;
-	o.type = OC_FORM_OPT_PASSWORD;
-	o.name = (char *)label;
-	o.label = buf;
-	o.value = NULL;
+	o.u.type = OC_FORM_OPT_PASSWORD;
+	o.u.name = (char *)label;
+	o.u.label = buf;
+	o.u.value = NULL;
 
 	ret = process_auth_form(vpninfo, &f);
 	if (!ret) {
-		*response = o.value;
+		*response = o.u.value;
 		return 0;
 	}
 
-- 
1.7.9.5



From nmav at gnutls.org  Sun Dec 15 03:54:58 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sun, 15 Dec 2013 09:54:58 +0100
Subject: ocserv 0.2.3
Message-ID: <1387097698.3202.4.camel@aspire.lan>

Hello,
 I've just released ocserv 0.2.3. ocserv is a VPN server that implements
the AnyConnect SSL VPN protocol and targets small embedded Linux
devices.

This release fixes known bugs, adds support for the AnyConnect mobile clients,
and support for cgroups in Linux that can be set per user or group.

* Version 0.2.3 (released 2013-12-15)

- Added X-CSTP-License header to client reply for mobile client
  compatibility. Patch by Kevin Cernekee.
- When a new connection presents a cookie of an existing session
  the previous session of this cookie is disconnected (and its IP is hijacked).
  If no previous session is active, the server will attempt to assign
  the previously used IP.
- If udp-port is unset or set to zero then the server will not listen
  for UDP sessions.
- When using PAM allow it to update the username.
- When always-require-cert is set to false do not require a certificate
  for cookie authentication.
- Added the net-priority configuration option.
- Corrected sending of DPD in the main TLS channel. Report and initial
  fix by Kevin Cernekee.
- Added support for cgroups in Linux.


The current release is available at:
ftp://ftp.infradead.org/pub/ocserv/ocserv-0.2.3.tar.xz
ftp://ftp.infradead.org/pub/ocserv/ocserv-0.2.3.tar.xz.sig

The VPN server's web-site is at:
http://www.infradead.org/ocserv

regards,
Nikos




From per at juborg.nu  Tue Dec 17 01:57:28 2013
From: per at juborg.nu (Per Juborg)
Date: Tue, 17 Dec 2013 07:57:28 +0100
Subject: ocserv: server certificate generation
Message-ID: <585F10E43CE3454B95691D0A1F56D106F4676E9311@exch2.email.eworx.se>

Hi,

I've managed to compile ocserv and create a minimal config file on my Mac OSX 10.8.5.

However, I need to know how to create a proper server certificate, the manual isn't very clear on that subject.

When starting my server I get the following message: server certificate key usage prevents key encipherment; unable to support the RSA ciphersuites

How should I generate my certificate?

Is also seems that the server doesn't present the CA certificate, I've only been able to test that with a browser.

/Per


From nmav at gnutls.org  Tue Dec 17 07:53:05 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Tue, 17 Dec 2013 13:53:05 +0100
Subject: ocserv: server certificate generation
In-Reply-To: <585F10E43CE3454B95691D0A1F56D106F4676E9311@exch2.email.eworx.se>
References: <585F10E43CE3454B95691D0A1F56D106F4676E9311@exch2.email.eworx.se>
Message-ID: <CAJU7zaLkQrJbwP1nAqku_+vSAHzOFHF4_BoQdeQ2KStR7iH_=w@mail.gmail.com>

On Tue, Dec 17, 2013 at 7:57 AM, Per Juborg <per at juborg.nu> wrote:
> Hi,
> I've managed to compile ocserv and create a minimal config file on my Mac OSX 10.8.5.
> However, I need to know how to create a proper server certificate, the manual isn't very clear on that subject.
> When starting my server I get the following message: server certificate key usage prevents key encipherment; unable to support the RSA ciphersuites
> How should I generate my certificate?

Follow the instructions for the user certificate but use the following template:
cn = "www.example.com"
expiration_days = 9999
signing_key
encryption_key
tls_www_server

> Is also seems that the server doesn't present the CA certificate, I've only been able to test that with a browser.

The TLS protocol requires that the CA certificate isn't included in
the list presented by the server (but many servers don't follow that
requirement). There is no need for that since the client must already
have it to very the server certificate.
Nevertheless, if you need to have it included just append it after the
server certificate.

regards,
Nikos


From marina.cogsci at gmail.com  Thu Dec 19 17:00:49 2013
From: marina.cogsci at gmail.com (Marina Papoutsi)
Date: Thu, 19 Dec 2013 22:00:49 +0000
Subject: Slow connection after successful vpn login
Message-ID: <52B36C91.7000000@gmail.com>

Hi,

I've been using openconnect successfully for a couple of months and 
suddenly things don't work very well.

I am still able to connect to ucl's vpn.ucl.ac.uk using the attached 
csd-wrapper that Kevin provided some time ago, when I had trouble 
connecting.

The trouble this time is that as soon as I login to vpn, my internet 
connection slows down and I am no longer able to access any websites. 
This is both for ucl internal and external websites.

I can ssh to my ucl workstation, but I can't e.g. scp anything back. I 
try, but it stalls. Needless to say, remote desktop doesn't work either.

I run kubuntu 3.11, 64-bit, openconnect 5.01 and no firewall.
I have not recently made any changes to iptables either ...
Not sure what is going on, but if anyone have any idea about this, I'd 
really appreciated.

Many thanks,
Marina

-------------- next part --------------
A non-text attachment was scrubbed...
Name: android_csd.sh
Type: application/x-shellscript
Size: 814 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131219/5b54b406/attachment.bin>

From nmav at gnutls.org  Fri Dec 20 03:22:51 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Fri, 20 Dec 2013 09:22:51 +0100
Subject: Slow connection after successful vpn login
In-Reply-To: <52B36C91.7000000@gmail.com>
References: <52B36C91.7000000@gmail.com>
Message-ID: <1387527771.2086.2.camel@aspire.lan>

On Thu, 2013-12-19 at 22:00 +0000, Marina Papoutsi wrote:
> Hi,
> I've been using openconnect successfully for a couple of months and 
> suddenly things don't work very well.
> I am still able to connect to ucl's vpn.ucl.ac.uk using the attached 
> csd-wrapper that Kevin provided some time ago, when I had trouble 
> connecting.
> The trouble this time is that as soon as I login to vpn, my internet 
> connection slows down and I am no longer able to access any websites. 
> This is both for ucl internal and external websites.
> 
> I can ssh to my ucl workstation, but I can't e.g. scp anything back. I 
> try, but it stalls. Needless to say, remote desktop doesn't work either.

Hello,
 Most likely the fragmentation needed ICMP packets are filtered
somewhere in your path. Try adjusting manually the MTU until you find a
value that works for you.

regards,
Nikos




From nmav at gnutls.org  Sat Dec 21 07:09:38 2013
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Sat, 21 Dec 2013 13:09:38 +0100
Subject: mingw32 patch
Message-ID: <1387627778.2690.8.camel@aspire.lan>

Hello,
 Attached is a patch for openconnect to compile under mingw32. That
takes care the compilation, but I'm not sure whether the tun handling
is sufficient. It would require vpnc-script-win.js, but I've not tried
it myself. That would require some feedback or patches by someone with
direct access to such a system. I also attach the makefile used to 
build the dependencies.

regards,
Nikos


-------------- next part --------------
A non-text attachment was scrubbed...
Name: Makefile
Type: text/x-makefile
Size: 8192 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131221/62d4dcbd/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Several-updates-to-compile-under-win32.patch.gz
Type: application/gzip
Size: 10588 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131221/62d4dcbd/attachment.gz>

From anton at codeborne.com  Wed Dec 25 10:53:38 2013
From: anton at codeborne.com (Anton Keks)
Date: Wed, 25 Dec 2013 17:53:38 +0200
Subject: Openconnect 5.01 no longer connects
Message-ID: <CABzMGtaRvngnXGQ40vqRbEV0VVPkocciCPLbsQG7AAr1fKMMpQ@mail.gmail.com>

Hello and happy holidays!

we are sorry to inform that we have an Anyconnect server that worked
perfectly with openconnect 4.07, but no longer works with openconnect
5.01.
We discovered it after upgrade to Ubuntu 13.10. Downgrading
openconnect back to 4.07 solves the issue.

By not working I mean it cannot estabilish the conneciton, but it
doesn't give any meaningful error messages except for "connection
failed" after the password has been entered.

Which debugging info can I provide in order to trace this problem?

Anton


From cernekee at gmail.com  Wed Dec 25 10:58:14 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Wed, 25 Dec 2013 07:58:14 -0800
Subject: Openconnect 5.01 no longer connects
In-Reply-To: <CABzMGtaRvngnXGQ40vqRbEV0VVPkocciCPLbsQG7AAr1fKMMpQ@mail.gmail.com>
References: <CABzMGtaRvngnXGQ40vqRbEV0VVPkocciCPLbsQG7AAr1fKMMpQ@mail.gmail.com>
Message-ID: <CAJiQ=7BFcdCQFT0QB=+tnNFpM_8xiGCN8m-bw9aXUXwk5MDEFw@mail.gmail.com>

On Wed, Dec 25, 2013 at 7:53 AM, Anton Keks <anton at codeborne.com> wrote:
> Hello and happy holidays!
>
> we are sorry to inform that we have an Anyconnect server that worked
> perfectly with openconnect 4.07, but no longer works with openconnect
> 5.01.
> We discovered it after upgrade to Ubuntu 13.10. Downgrading
> openconnect back to 4.07 solves the issue.
>
> By not working I mean it cannot estabilish the conneciton, but it
> doesn't give any meaningful error messages except for "connection
> failed" after the password has been entered.
>
> Which debugging info can I provide in order to trace this problem?

Please post the output from running "openconnect -v <hostname>"

Also you might want to try my "jni-20131224" branch from
git://github.com/cernekee/openconnect as this fixes a number of
outstanding bugs.


From anton at codeborne.com  Wed Dec 25 11:16:37 2013
From: anton at codeborne.com (Anton Keks)
Date: Wed, 25 Dec 2013 18:16:37 +0200
Subject: Openconnect 5.01 no longer connects
In-Reply-To: <CAJiQ=7BFcdCQFT0QB=+tnNFpM_8xiGCN8m-bw9aXUXwk5MDEFw@mail.gmail.com>
References: <CABzMGtaRvngnXGQ40vqRbEV0VVPkocciCPLbsQG7AAr1fKMMpQ@mail.gmail.com>
 <CAJiQ=7BFcdCQFT0QB=+tnNFpM_8xiGCN8m-bw9aXUXwk5MDEFw@mail.gmail.com>
Message-ID: <CABzMGtami4kApr2HDnntcVgAsbXMPwXO0njwX91cSTXgxtt1dA@mail.gmail.com>

OK, it seems that 4.07 is getting a redirect, while 5.01 does not:

Failing output of openconnect 5.01:

POST https://213.172.3.40/
Attempting to connect to server 213.172.3.40:443
SSL negotiation with 213.172.3.40
Server certificate verify failed: signer not found

Certificate from VPN server "213.172.3.40" failed verification.
Reason: signer not found
Enter 'yes' to accept, 'no' to abort; anything else to view: yes
Connected to HTTPS on 213.172.3.40
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Date: Wed, 25 Dec 2013 16:11:18 GMT
X-Aggregate-Auth: 1
HTTP body chunked (-2)
XML POST enabled
GROUP: [ADMBankier|ADMCborne|ADMCborne-new|ADMNetwork|ADMOther|ADMPhones|ADMW2K|MobileMGR|WssDocs]:ADMCborne
Username:cborne
Password:
POST https://213.172.3.40/
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Date: Wed, 25 Dec 2013 16:11:33 GMT
X-Aggregate-Auth: 1
HTTP body chunked (-2)
Login failed.
GROUP: [ADMBankier|ADMCborne|ADMCborne-new|ADMNetwork|ADMOther|ADMPhones|ADMW2K|MobileMGR|WssDocs]:



Successful output with openconnect 4.07:

Attempting to connect to 213.172.3.40:443
SSL negotiation with 213.172.3.40
Server certificate verify failed: signer not found

Certificate from VPN server "213.172.3.40" failed verification.
Reason: signer not found
Enter 'yes' to accept, 'no' to abort; anything else to view: yes
Connected to HTTPS on 213.172.3.40
GET https://213.172.3.40/
Got HTTP response: HTTP/1.0 302 Object Moved
Content-Type: text/html; charset=utf-8
Content-Length: 0
Cache-Control: no-cache
Pragma: no-cache
Connection: Close
Date: Wed, 25 Dec 2013 16:05:02 GMT
Location: /+webvpn+/index.html
Set-Cookie: tg=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
HTTP body length:  (0)
SSL negotiation with 213.172.3.40
Server certificate verify failed: signer not found
Connected to HTTPS on 213.172.3.40
GET https://213.172.3.40/+webvpn+/index.html
Got HTTP response: HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: text/xml
Cache-Control: max-age=0
Set-Cookie: webvpn=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpnc=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpnlogin=1; secure
X-Transcend-Version: 1
HTTP body chunked (-2)
Fixed options give
Please enter your username and password.
GROUP: [ADMBankier|ADMCborne|ADMCborne-new|ADMNetwork|ADMOther|ADMPhones|ADMW2K|MobileMGR|WssDocs]:ADMCborne
Username:cborne
Password:
POST https://213.172.3.40/+webvpn+/index.html
Got HTTP response: HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: text/xml
Cache-Control: max-age=0
Set-Cookie: webvpnlogin=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpn=<elided>; path=/; secure
Set-Cookie: webvpnc=bu:/CACHE/stc/&p:t&iu:1/&sh:9AA6F4978ABEAEC4EB82EDB65A87391F3171214D&lu:/+CSCOT+/translation-table?textdomain%3DAnyConnect%26type%3Dmanifest;
path=/; secure
Set-Cookie: webvpnx=
Set-Cookie: webvpnaac=1; path=/; secure
X-Transcend-Version: 1
HTTP body chunked (-2)
TCP_INFO rcv mss 1368, snd mss 1368, adv mss 1448, pmtu 1500
Got CONNECT response: HTTP/1.1 200 OK
....


On Wed, Dec 25, 2013 at 5:58 PM, Kevin Cernekee <cernekee at gmail.com> wrote:
> On Wed, Dec 25, 2013 at 7:53 AM, Anton Keks <anton at codeborne.com> wrote:
>> Hello and happy holidays!
>>
>> we are sorry to inform that we have an Anyconnect server that worked
>> perfectly with openconnect 4.07, but no longer works with openconnect
>> 5.01.
>> We discovered it after upgrade to Ubuntu 13.10. Downgrading
>> openconnect back to 4.07 solves the issue.
>>
>> By not working I mean it cannot estabilish the conneciton, but it
>> doesn't give any meaningful error messages except for "connection
>> failed" after the password has been entered.
>>
>> Which debugging info can I provide in order to trace this problem?
>
> Please post the output from running "openconnect -v <hostname>"
>
> Also you might want to try my "jni-20131224" branch from
> git://github.com/cernekee/openconnect as this fixes a number of
> outstanding bugs.



-- 
Anton
//codeborne


From cernekee at gmail.com  Wed Dec 25 13:02:37 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Wed, 25 Dec 2013 10:02:37 -0800
Subject: Openconnect 5.01 no longer connects
In-Reply-To: <CABzMGtami4kApr2HDnntcVgAsbXMPwXO0njwX91cSTXgxtt1dA@mail.gmail.com>
References: <CABzMGtaRvngnXGQ40vqRbEV0VVPkocciCPLbsQG7AAr1fKMMpQ@mail.gmail.com>
 <CAJiQ=7BFcdCQFT0QB=+tnNFpM_8xiGCN8m-bw9aXUXwk5MDEFw@mail.gmail.com>
 <CABzMGtami4kApr2HDnntcVgAsbXMPwXO0njwX91cSTXgxtt1dA@mail.gmail.com>
Message-ID: <CAJiQ=7CHRcmjawjpYqZbyjScKxwdjewPyt2Qe3SwWf_reGdCjQ@mail.gmail.com>

On Wed, Dec 25, 2013 at 8:16 AM, Anton Keks <anton at codeborne.com> wrote:
> OK, it seems that 4.07 is getting a redirect, while 5.01 does not:
[...]
> XML POST enabled
> GROUP: [ADMBankier|ADMCborne|ADMCborne-new|ADMNetwork|ADMOther|ADMPhones|ADMW2K|MobileMGR|WssDocs]:ADMCborne

In current releases, XML POST does not work correctly with a
non-default authgroup.

As a temporary workaround you can try passing "--no-xmlpost" if it is
supported in the version you are running.

There's also a fix in the git tree I referenced earlier.  But I don't
actually use a VPN gateway that requires an authgroup, so it would be
helpful if you tested it and let me know if everything works as
expected.

Thanks.


From anton at codeborne.com  Thu Dec 26 04:35:54 2013
From: anton at codeborne.com (Anton Keks)
Date: Thu, 26 Dec 2013 11:35:54 +0200
Subject: Openconnect 5.01 no longer connects
In-Reply-To: <CAJiQ=7CHRcmjawjpYqZbyjScKxwdjewPyt2Qe3SwWf_reGdCjQ@mail.gmail.com>
References: <CABzMGtaRvngnXGQ40vqRbEV0VVPkocciCPLbsQG7AAr1fKMMpQ@mail.gmail.com>
 <CAJiQ=7BFcdCQFT0QB=+tnNFpM_8xiGCN8m-bw9aXUXwk5MDEFw@mail.gmail.com>
 <CABzMGtami4kApr2HDnntcVgAsbXMPwXO0njwX91cSTXgxtt1dA@mail.gmail.com>
 <CAJiQ=7CHRcmjawjpYqZbyjScKxwdjewPyt2Qe3SwWf_reGdCjQ@mail.gmail.com>
Message-ID: <CABzMGtZf=zNVPDjx_BpSMc3UDLEGFbtunhCQmbC7Gz100nAAvQ@mail.gmail.com>

5.01 with --no-xmlpost works (see output below), however git master
still fails without --no-xmlpost, just like 5.01.

$ sudo openconnect -v 213.172.3.40 --no-xmlpost
GET https://213.172.3.40/
Attempting to connect to server 213.172.3.40:443
SSL negotiation with 213.172.3.40
Server certificate verify failed: signer not found

Certificate from VPN server "213.172.3.40" failed verification.
Reason: signer not found
Enter 'yes' to accept, 'no' to abort; anything else to view: yes
Connected to HTTPS on 213.172.3.40
Got HTTP response: HTTP/1.0 302 Object Moved
Content-Type: text/html; charset=utf-8
Content-Length: 0
Cache-Control: no-cache
Pragma: no-cache
Connection: Close
Date: Thu, 26 Dec 2013 09:16:50 GMT
Location: /+webvpn+/index.html
Set-Cookie: tg=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
HTTP body length:  (0)
GET https://213.172.3.40/+webvpn+/index.html
SSL negotiation with 213.172.3.40
Server certificate verify failed: signer not found
Connected to HTTPS on 213.172.3.40
Got HTTP response: HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: text/xml
Cache-Control: max-age=0
Set-Cookie: webvpn=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpnc=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpnlogin=1; secure
X-Transcend-Version: 1
HTTP body chunked (-2)
Please enter your username and password.
GROUP: [ADMBankier|ADMCborne|ADMCborne-new|ADMNetwork|ADMOther|ADMPhones|ADMW2K|MobileMGR|WssDocs]:ADMCborne
Username:cborne
Password:
POST https://213.172.3.40/+webvpn+/index.html
Got HTTP response: HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: text/xml
Cache-Control: max-age=0
Set-Cookie: webvpnlogin=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpn=<elided>; path=/; secure
Set-Cookie: webvpnc=bu:/CACHE/stc/&p:t&iu:1/&sh:9AA6F4978ABEAEC4EB82EDB65A87391F3171214D&lu:/+CSCOT+/translation-table?textdomain%3DAnyConnect%26type%3Dmanifest;
path=/; secure
Set-Cookie: webvpnx=
Set-Cookie: webvpnaac=1; path=/; secure
X-Transcend-Version: 1
HTTP body chunked (-2)
TCP_INFO rcv mss 1368, snd mss 1368, adv mss 1448, pmtu 1500
Got CONNECT response: HTTP/1.1 200 OK


On Wed, Dec 25, 2013 at 8:02 PM, Kevin Cernekee <cernekee at gmail.com> wrote:
> On Wed, Dec 25, 2013 at 8:16 AM, Anton Keks <anton at codeborne.com> wrote:
>> OK, it seems that 4.07 is getting a redirect, while 5.01 does not:
> [...]
>> XML POST enabled
>> GROUP: [ADMBankier|ADMCborne|ADMCborne-new|ADMNetwork|ADMOther|ADMPhones|ADMW2K|MobileMGR|WssDocs]:ADMCborne
>
> In current releases, XML POST does not work correctly with a
> non-default authgroup.
>
> As a temporary workaround you can try passing "--no-xmlpost" if it is
> supported in the version you are running.
>
> There's also a fix in the git tree I referenced earlier.  But I don't
> actually use a VPN gateway that requires an authgroup, so it would be
> helpful if you tested it and let me know if everything works as
> expected.
>
> Thanks.



-- 
Anton
//codeborne


From cernekee at gmail.com  Thu Dec 26 10:23:03 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Thu, 26 Dec 2013 09:23:03 -0600
Subject: Openconnect 5.01 no longer connects
In-Reply-To: <CABzMGtZf=zNVPDjx_BpSMc3UDLEGFbtunhCQmbC7Gz100nAAvQ@mail.gmail.com>
References: <CABzMGtaRvngnXGQ40vqRbEV0VVPkocciCPLbsQG7AAr1fKMMpQ@mail.gmail.com>
 <CAJiQ=7BFcdCQFT0QB=+tnNFpM_8xiGCN8m-bw9aXUXwk5MDEFw@mail.gmail.com>
 <CABzMGtami4kApr2HDnntcVgAsbXMPwXO0njwX91cSTXgxtt1dA@mail.gmail.com>
 <CAJiQ=7CHRcmjawjpYqZbyjScKxwdjewPyt2Qe3SwWf_reGdCjQ@mail.gmail.com>
 <CABzMGtZf=zNVPDjx_BpSMc3UDLEGFbtunhCQmbC7Gz100nAAvQ@mail.gmail.com>
Message-ID: <CAJiQ=7CenogjmZpjaDYhR2SFHMutwa=+rVWtvrdev7CbteTdUg@mail.gmail.com>

On Thu, Dec 26, 2013 at 3:35 AM, Anton Keks <anton at codeborne.com> wrote:
> 5.01 with --no-xmlpost works (see output below), however git master
> still fails without --no-xmlpost, just like 5.01.

Could you please post the log from git master?

Are you running my branch from git://github.com/cernekee/openconnect ?

Thanks.


From anton at codeborne.com  Fri Dec 27 17:37:52 2013
From: anton at codeborne.com (Anton Keks)
Date: Sat, 28 Dec 2013 00:37:52 +0200
Subject: Openconnect 5.01 no longer connects
In-Reply-To: <CAJiQ=7CenogjmZpjaDYhR2SFHMutwa=+rVWtvrdev7CbteTdUg@mail.gmail.com>
References: <CABzMGtaRvngnXGQ40vqRbEV0VVPkocciCPLbsQG7AAr1fKMMpQ@mail.gmail.com>
 <CAJiQ=7BFcdCQFT0QB=+tnNFpM_8xiGCN8m-bw9aXUXwk5MDEFw@mail.gmail.com>
 <CABzMGtami4kApr2HDnntcVgAsbXMPwXO0njwX91cSTXgxtt1dA@mail.gmail.com>
 <CAJiQ=7CHRcmjawjpYqZbyjScKxwdjewPyt2Qe3SwWf_reGdCjQ@mail.gmail.com>
 <CABzMGtZf=zNVPDjx_BpSMc3UDLEGFbtunhCQmbC7Gz100nAAvQ@mail.gmail.com>
 <CAJiQ=7CenogjmZpjaDYhR2SFHMutwa=+rVWtvrdev7CbteTdUg@mail.gmail.com>
Message-ID: <CABzMGtY=PTH_peEOyVuwPUJxQUcVTnCkjZsVd-XPTu0aHz7dfQ@mail.gmail.com>

OK, sorry, I used the official master from infradead.org, which had a
few commits on top of 5.01.

Now I compiled your git master and it works with xml post!

Now I hope that you can get this released soon :-)


POST https://213.172.3.40/
Attempting to connect to server 213.172.3.40:443
SSL negotiation with 213.172.3.40
Server certificate verify failed: signer not found

Certificate from VPN server "213.172.3.40" failed verification.
Reason: signer not found
Enter 'yes' to accept, 'no' to abort; anything else to view: yes
Connected to HTTPS on 213.172.3.40
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Date: Fri, 27 Dec 2013 22:32:25 GMT
X-Aggregate-Auth: 1
HTTP body chunked (-2)
XML POST enabled
GROUP: [ADMBankier|ADMCborne|ADMCborne-new|ADMNetwork|ADMOther|ADMPhones|ADMW2K|MobileMGR|WssDocs]:ADMCborne
POST https://213.172.3.40/
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Date: Fri, 27 Dec 2013 22:32:32 GMT
X-Aggregate-Auth: 1
HTTP body chunked (-2)
XML POST enabled
Username:cborne
Password:
POST https://213.172.3.40/
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
Connection: Keep-Alive
Date: Fri, 27 Dec 2013 22:32:51 GMT
X-Aggregate-Auth: 1
HTTP body chunked (-2)
TCP_INFO rcv mss 1368, snd mss 1368, adv mss 1448, pmtu 1500
Got CONNECT response: HTTP/1.1 200 OK
X-CSTP-Version: 1
X-CSTP-Protocol: Copyright (c) 2004 Cisco Systems, Inc.
...


On Thu, Dec 26, 2013 at 5:23 PM, Kevin Cernekee <cernekee at gmail.com> wrote:
> On Thu, Dec 26, 2013 at 3:35 AM, Anton Keks <anton at codeborne.com> wrote:
>> 5.01 with --no-xmlpost works (see output below), however git master
>> still fails without --no-xmlpost, just like 5.01.
>
> Could you please post the log from git master?
>
> Are you running my branch from git://github.com/cernekee/openconnect ?
>
> Thanks.



-- 
Anton
//codeborne


From bugfood-ml at fatooh.org  Mon Dec 30 01:51:09 2013
From: bugfood-ml at fatooh.org (Corey Hickey)
Date: Sun, 29 Dec 2013 22:51:09 -0800
Subject: contributing to vpnc-script
Message-ID: <52C117DD.5060305@fatooh.org>

Hi,

Years ago, I hacked my vpnc-script to do some specific stuff, and I
would like to contribute that upstream now, but of course I need to do
it properly first, so that the new stuff is optional and non-default.

Specifically, I would like vpnc-script to:
a. not touch /etc/resolv.conf
b. add/remove routes in a specific table rather than "main"
c. do not ever set a default route

It's simple to do that non-optionally, but if I want to make any of
those optional, how should I pass the necessary parameters to the
vpnc-script? Should I use environment variables, or arguments, or ...?

A wrapper script would probably set the environment variables or
arguments, as an easy exercise for the user who wants to use them.


Anyway, no approach seems obvious to me, and I would like to know the
proper path before starting out.

Thanks,
Corey


From jeremy at visser.name  Mon Dec 30 04:04:22 2013
From: jeremy at visser.name (Jeremy Visser)
Date: Mon, 30 Dec 2013 20:04:22 +1100
Subject: [PATCH] Support Split-Include-IP6 and Split-Exclude-IP6 headers
Message-ID: <52C13716.9080604@visser.name>

G'day,

I was wondering why my VPN (ASA 9.1.x), which is configured with IPv6
split tunnelling, was still only seeing an IPv6 default route with
OpenConnect.  Turns out it's a simple fix as most of the work has
already been done.

See attached patch.

The vpnc-script at [0] already supports CISCO_IPV6_SPLIT_INC and friends.

Also process_split_xxclude() in tun.c also supports recognising IPv6
addresses and passing them off into said environment variables.

One missing link was that the "X-CSTP-Full-IPv6-Capability: true" header
was not sent (required for the ASA to send IPv6 split routes).

The other was start_cstp_connection() in cstp.c was assuming that both
IPv4 and IPv6 split routes would be listed in the "Split-Include" /
"Split-Exclude" headers.

In fact, the ASA sends "Split-Include-IP6" / "Split-Exclude-IP6"
headers, e.g.:

X-CSTP-Split-Include: 192.168.1.0/255.255.255.0
X-CSTP-Split-Include: 192.168.2.0/255.255.255.0
X-CSTP-Split-Include-IP6: 2001:db8:1000:1001::/64
X-CSTP-Split-Include-IP6: 2001:db8:1000:1002::/64

There is not much need to separate these internally, given that
process_split_xxclude() already assumes they are combined, so it was a
simple matter to just do a little 'or' operator as you will see in the
patch.

Cheers,
Jeremy.

--
[0]
<http://git.infradead.org/users/dwmw2/vpnc-scripts.git/blob_plain/HEAD:/vpnc-script>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: cstp.c.patch
Type: text/x-patch
Size: 1388 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131230/5c5709e5/attachment.bin>

From dwmw2 at infradead.org  Mon Dec 30 10:05:05 2013
From: dwmw2 at infradead.org (David Woodhouse)
Date: Mon, 30 Dec 2013 15:05:05 +0000
Subject: [PATCH/RFC V3 07/13] Split user-visible oc_* fields from
 internal fields
In-Reply-To: <1387089785-17543-8-git-send-email-cernekee@gmail.com>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
 <1387089785-17543-8-git-send-email-cernekee@gmail.com>
Message-ID: <1388415905.5694.7.camel@i7.infradead.org>

On Sat, 2013-12-14 at 22:42 -0800, Kevin Cernekee wrote:
> @@ -912,40 +967,40 @@ int prepare_stoken(struct openconnect_info *vpninfo)
>         memset(&opts, 0, sizeof(opts));
>  
>         form.opts = opts;
> -       form.message = (char *)_("Enter credentials to unlock software token.");
> +       form.u.message = (char *)_("Enter credentials to unlock software token.");

This depends on an earlier 'Hack around const warnings' commit in your
tree, btw.

Thanks for doing this work. It mostly looks good to me. However, I'm
wondering if we can get away without the parallel definitions of public
vs. private structures, and *especially* without the parallel linked
lists of options, and this:

> +static int dup_select_opt(struct __oc_form_opt_select *sopt)
> +{
> +       struct oc_form_opt_select *usopt;
> +       int i;
> +
> +       if (!sopt->nr_choices)
> +               return -EINVAL;
> +
> +       usopt = calloc(1, sizeof(*sopt) + sizeof(struct oc_choice) * sopt->nr_choices);
> +       if (!usopt)
> +               return -ENOMEM;
> +
> +       usopt->form = sopt->form.u;
> +       usopt->nr_choices = sopt->nr_choices;
> +       for (i = 0; i < usopt->nr_choices; i++)
> +               usopt->choices[i] = sopt->choices[i].u;
> +       sopt->u = usopt;
> +       return 0;
> +}

Let's assume we can bump the ABI version to libopenconnect.so.3. So we
can add a OC_FORM_OPT_IGNORE flag into items in the *main* list to make
the UI ignore them, instead of having to put them in a second list,
right?

And let's also assume (or *declare* that the UI will never be allocating
these structures. So if we need private fields, we could do something
like:

struct oc_choice {
 	char *name;
	char *label;
	char *auth_type;
	char *override_name;
	char *override_label;
#ifdef __OPENCONNECT_PRIVATE__
        int second_auth;
	char *secondary_username;
	int secondary_username_editable;
	int noaaa;
#endif
};

Hell, we could even process the openconnect.h with unifdef or something
like that on 'make install', if we really wanted to.

How does that sound?

-- 
dwmw2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5745 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131230/a6913c24/attachment.bin>

From dwmw2 at infradead.org  Mon Dec 30 17:29:21 2013
From: dwmw2 at infradead.org (David Woodhouse)
Date: Mon, 30 Dec 2013 22:29:21 +0000
Subject: [PATCH/RFC V3 07/13] Split user-visible oc_* fields from
 internal fields
In-Reply-To: <1388415905.5694.7.camel@i7.infradead.org>
References: <1387089785-17543-1-git-send-email-cernekee@gmail.com>
 <1387089785-17543-8-git-send-email-cernekee@gmail.com>
 <1388415905.5694.7.camel@i7.infradead.org>
Message-ID: <1388442561.7717.2.camel@shinybook.infradead.org>

On Mon, 2013-12-30 at 15:05 +0000, David Woodhouse wrote:
> 
> Thanks for doing this work. It mostly looks good to me. However, I'm
> wondering if we can get away without the parallel definitions of public
> vs. private structures...

I see you're working on this ? a new clone of your tree, so I could look
at the final results, was confusing different to the version I was
already looking at :)

I've pulled in a bunch of the early commits, with a few modifications,
and pushed it out to my git tree. I don't think I've touched anything
that you've made changes to, or that'll be difficult to rebase on top
of.

I *haven't* pulled in the Android-MIPS fix yet because I'd like that to
contain a reference to the upstream Android NDK bug.

-- 
dwmw2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5745 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131230/79d9bb86/attachment.bin>

From cernekee at gmail.com  Mon Dec 30 20:48:18 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Mon, 30 Dec 2013 17:48:18 -0800
Subject: [GIT PULL V6] Library/Android/JNI improvements
Message-ID: <1388454498-4705-1-git-send-email-cernekee@gmail.com>

V5->V6:

Reorder commits to put possible 5.10 (?) bugfix release items in front,
followed by new features.

New bugfix: fix --cookie-on-stdin so it works with ocserv cookies,
allowing network-manager-openconnect to connect to ocserv gateways.

New bugfix: always redirect CSD trojan stdout to stderr, so --cookieonly
works properly with CSD.

New bugfix: set FD_CLOEXEC on CSTP sockets so they don't get passed to
the tun script.

New bugfix: don't leak name/label strings on parse_auth_choice() error
paths.

New bugfix: don't leak HTTP request buffer if the connection cannot be
opened.

Rework auth form changes again per David's latest feedback; rev the
library to libopenconnect.so.3.  Lightly tested with
network-manager-openconnect and with Android ics-openconnect.

New API versions:

 - OPENCONNECT_3.0 just covers the auth form changes, intended for a
   bugfix release.

 - OPENCONNECT_3.1 covers the new functions added for JNI support and
   the more invasive library changes.

Fix mishandling of authgroup responses in CLI (main.c).

Provide a reference for the Android MIPS NDK link bug.

Add --timestamp option (this is slightly nicer than using
annotate-output since the latter breaks interactive prompts).

Change OC_CMD_RECONNECT to OC_CMD_PAUSE, allowing the mainloop to be
started and stopped at will.  This helps prevent unnecessary wakeups on
mobile devices, while still allowing the login session to remain active
for extended periods of time.

Add OC_CMD_STATS, to query TX/RX stats without exiting the mainloop.

Fix more reference leaks in the JNI code.

Fix off-by-one select() nfds argument in mainloop.

Fix JNI assignment of opt->value on SELECT dropdowns.

Add CLI logic to avoid infinite loops if we select a certificate-only
authgroup and the login fails.

Extend setCSDWrapper() to set $PATH, as Java is missing setenv().  Make
both TMPDIR and PATH optional (null-able).

Extend the new openconnect_get_ip_info() library call so that it also
returns the X-{CSTP,DTLS} options.  This can be useful for
enabling/disabling random features like smartcard removal disconnect,
and knowing the session/idle/DPD timeouts also lets the frontend make
more intelligent decisions about how to keep the session alive.


The following changes since commit 3cb5435da91e263e2dc7e3aa4f54488ae43dd5c4:

  auth: Add <group-access> node to XML POST initial request (2013-12-30 22:13:36 +0000)

are available in the git repository at:

  git://github.com/cernekee/openconnect jni-20131230

for you to fetch changes up to 5550734cb9a7ffdf83ee73bbdd1ec07c8b0df522:

  main: Add --timestamp option (2013-12-30 16:06:58 -0800)

----------------------------------------------------------------
Kevin Cernekee (61):
      android: Fix broken ARCH=mips build
      library: Use named constants for process_auth_form() return value
      main: Rename process_auth_form() to avoid conflict with library
      Create a common process_auth_form() wrapper function
      auth: Remove outdated comment for parse_auth_choice()
      auth: Introduce free_opt() helper function
      library: Change oc_form_opt_select->choices to a pointer array
      auth: Provide information on which auth choice is currently selected
      process_auth_form: Add code to support NEWGROUP return status from UI
      auth: Parse second-auth-related properties from the auth form
      auth: Hide unused form fields based on the selected authgroup
      main: Avoid infinite "303 See Other" loops on certificate-only authgroups
      library: Bump API version to 3.0 and document changes
      Unconditionally redirect CSD stdout to stderr
      dtls: Don't send packets to a dead socket during rekeying
      main: --cookie-on-stdin doesn't work with ocserv cookies
      ssl: Set FD_CLOEXEC on all sockets
      www: Fix quoting in v5.01 changelog
      www: Update changelog
      gnutls: Remove unused local variable
      http: Don't leak HTTP request buffer on failed connections

<<< end of bugfix commits >>>

      Introduce new helper functions for cancel_fd checking
      library: Rename cancel_fd to cmd_fd
      library: Add new openconnect_setup_cmd_pipe() call
      Add new helper functions to support cmd_fd feature
      Move signal handling out of mainloop
      mainloop: Convert vpn_mainloop() into a library function
      dtls: Add dtls_close() helper function
      mainloop: Add OC_CMD_PAUSE operation
      main: Introduce xstrdup() function
      tun: Export setup_tun() functionality
      Move vpninfo default settings into library
      library: Check for failed allocations in openconnect_vpninfo_new()
      dtls: Export setup_dtls() function
      cstp: Export make_cstp_connection()
      library: Move the mainloop guts into libopenconnect
      library: Update openconnect.pc.in
      tun, cstp: Don't exit() on failure
      library: Free zlib state
      cstp: Clean up split include/exclude/DNS lists when freeing vpninfo
      library: Add get/set functions for servercert, ifname, reqmtu
      library: Move IP information into a public struct
      library: Make vpn_option a public struct
      library: Export VPN configuration info to callers
      library: Add protect_socket callback
      library: Add support for mobile headers
      library: Add openconnect_set_xmlpost() to support different CSD modes
      library: Add new callback for obtaining TX/RX statistics
      ssl: Don't let cmd_fd activity break timeouts
      library: Update changelog and bump minor version
      main: Add openconnect_vpninfo_free() on a couple of exit paths
      buildsys: Allow overriding -W flags
      acinclude: Add AX_JNI_INCLUDE_DIR macro
      JNI: Initial commit of C wrapper functions
      JNI: Initial commit of Java library + example program
      android: Enable JNI in build
      android: Add libstoken to build
      android: Add liboath to build
      android: Add "sources" target
      android: Detect /dev/tun shutdown
      main: Add --timestamp option

 .gitignore                                         |    1 +
 Makefile.am                                        |   25 +-
 acinclude.m4                                       |  125 +++
 android/0001-Remove-call-to-mlockall.patch         |   33 +
 ...-fflush-freadahead-fseeko-Fix-for-Android.patch |   43 +
 android/Makefile                                   |  113 +-
 auth.c                                             |  206 +++-
 configure.ac                                       |   48 +-
 cstp.c                                             |  156 +--
 dtls.c                                             |  117 +-
 gnutls.c                                           |   40 +-
 http.c                                             |   59 +-
 java/.gitignore                                    |    2 +
 java/README                                        |   22 +
 java/build.xml                                     |   33 +
 java/src/com/example/LibTest.java                  |  237 ++++
 .../infradead/libopenconnect/LibOpenConnect.java   |  278 +++++
 jni.c                                              | 1127 ++++++++++++++++++++
 libopenconnect.map.in                              |   32 +-
 library.c                                          |  128 ++-
 main.c                                             |  210 ++--
 mainloop.c                                         |   53 +-
 openconnect-internal.h                             |   70 +-
 openconnect.8.in                                   |    4 +
 openconnect.h                                      |  143 ++-
 openconnect.pc.in                                  |    2 +-
 openssl.c                                          |   38 +-
 ssl.c                                              |  101 +-
 tun.c                                              |  199 ++--
 www/changelog.xml                                  |    7 +-
 30 files changed, 3096 insertions(+), 556 deletions(-)
 create mode 100644 android/0001-Remove-call-to-mlockall.patch
 create mode 100644 android/0001-fflush-freadahead-fseeko-Fix-for-Android.patch
 create mode 100644 java/.gitignore
 create mode 100644 java/README
 create mode 100644 java/build.xml
 create mode 100644 java/src/com/example/LibTest.java
 create mode 100644 java/src/org/infradead/libopenconnect/LibOpenConnect.java
 create mode 100644 jni.c

-- 
1.7.9.5



From cernekee at gmail.com  Mon Dec 30 20:49:35 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Mon, 30 Dec 2013 17:49:35 -0800
Subject: [PATCH V2 nm-openconnect 1/3] auth-dialog: Introduce FORMCHOICE
 helper macro
Message-ID: <1388454577-4789-1-git-send-email-cernekee@gmail.com>

libopenconnect >= 3.0 uses a pointer array so we need to change the way
the "choices" field is accessed.
---
 auth-dialog/main.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/auth-dialog/main.c b/auth-dialog/main.c
index 8bc13b8..9253daa 100644
--- a/auth-dialog/main.c
+++ b/auth-dialog/main.c
@@ -71,6 +71,8 @@
 #define __openconnect_set_token_mode openconnect_set_token_mode
 #endif
 
+#define FORMCHOICE(sopt, i)		(&(sopt)->choices[i])
+
 #ifdef OPENCONNECT_OPENSSL
 #include <openssl/ssl.h>
 #include <openssl/bio.h>
@@ -332,10 +334,10 @@ static void combo_changed(GtkComboBox *combo, ui_fragment_data *data)
 	if (entry < 0)
 		return;
 
-	data->entry_text = sopt->choices[entry].name;
+	data->entry_text = FORMCHOICE(sopt, entry)->name;
 
 	g_queue_foreach(data->ui_data->form_entries, (GFunc)do_override_label,
-			&sopt->choices[entry]);
+			FORMCHOICE(sopt, entry));
 }
 
 #ifdef OPENCONNECT_OPENSSL
@@ -423,17 +425,17 @@ static gboolean ui_add_select (ui_fragment_data *data)
 	combo = gtk_combo_box_text_new();
 	gtk_box_pack_end(GTK_BOX(hbox), combo, FALSE, FALSE, 0);
 	for (i = 0; i < sopt->nr_choices; i++) {
-		gtk_combo_box_text_append_text(GTK_COMBO_BOX_TEXT(combo), sopt->choices[i].label);
+		gtk_combo_box_text_append_text(GTK_COMBO_BOX_TEXT(combo), FORMCHOICE(sopt, i)->label);
 		if (data->entry_text &&
-		    !strcmp(data->entry_text, sopt->choices[i].name)) {
+		    !strcmp(data->entry_text, FORMCHOICE(sopt, i)->name)) {
 			gtk_combo_box_set_active(GTK_COMBO_BOX(combo), i);
 			g_free(data->entry_text);
-			data->entry_text = sopt->choices[i].name;
+			data->entry_text = FORMCHOICE(sopt, i)->name;
 		}
 	}
 	if (gtk_combo_box_get_active(GTK_COMBO_BOX(combo)) < 0) {
 		gtk_combo_box_set_active(GTK_COMBO_BOX(combo), 0); 
-		data->entry_text = sopt->choices[0].name;
+		data->entry_text = FORMCHOICE(sopt, 0)->name;
 	}
 
 	if (g_queue_peek_tail(ui_data->form_entries) == data)
-- 
1.8.3.2



From cernekee at gmail.com  Mon Dec 30 20:49:36 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Mon, 30 Dec 2013 17:49:36 -0800
Subject: [PATCH V2 nm-openconnect 2/3] auth-dialog: Add support for NEWGROUP
In-Reply-To: <1388454577-4789-1-git-send-email-cernekee@gmail.com>
References: <1388454577-4789-1-git-send-email-cernekee@gmail.com>
Message-ID: <1388454577-4789-2-git-send-email-cernekee@gmail.com>

When the user selects a different authgroup, return NEWGROUP to
libopenconnect to allow it to refresh the form.  Different groups may
require different prompts.

Also, if secondary_username is provided by the server, prepopulate the
form field.
---
 auth-dialog/main.c | 112 +++++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 95 insertions(+), 17 deletions(-)

diff --git a/auth-dialog/main.c b/auth-dialog/main.c
index 9253daa..f4c772b 100644
--- a/auth-dialog/main.c
+++ b/auth-dialog/main.c
@@ -71,7 +71,21 @@
 #define __openconnect_set_token_mode openconnect_set_token_mode
 #endif
 
+#if OPENCONNECT_CHECK_VER(3,0)
+#define NEWGROUP_SUPPORTED		1
+#define AUTHGROUP_FIELD(form)		(form)->authgroup_field
+#define AUTHGROUP_SELECTION(form)	(form)->authgroup_selection
+#define FORMCHOICE(sopt, i)		((sopt)->choices[i])
+#else
+#define NEWGROUP_SUPPORTED		0
+#define AUTHGROUP_FIELD(form)		NULL
+#define AUTHGROUP_SELECTION(form)	0
 #define FORMCHOICE(sopt, i)		(&(sopt)->choices[i])
+#define OC_FORM_RESULT_ERR		-1
+#define OC_FORM_RESULT_OK		0
+#define OC_FORM_RESULT_CANCELLED	1
+#define OC_FORM_RESULT_NEWGROUP		2
+#endif
 
 #ifdef OPENCONNECT_OPENSSL
 #include <openssl/ssl.h>
@@ -181,6 +195,9 @@ typedef struct auth_ui_data {
 	GCond form_shown_changed;
 	gboolean form_shown;
 
+	gboolean newgroup;
+	gboolean group_set;
+
 	GCond cert_response_changed;
 	enum certificate_response cert_response;
 } auth_ui_data;
@@ -273,6 +290,7 @@ typedef struct ui_fragment_data {
 #endif
 	struct oc_form_opt *opt;
 	char *entry_text;
+	int initial_selection;
 	int grab_focus;
 } ui_fragment_data;
 
@@ -336,6 +354,12 @@ static void combo_changed(GtkComboBox *combo, ui_fragment_data *data)
 
 	data->entry_text = FORMCHOICE(sopt, entry)->name;
 
+	if (NEWGROUP_SUPPORTED && entry != data->initial_selection) {
+		data->ui_data->newgroup = TRUE;
+		gtk_dialog_response(GTK_DIALOG(data->ui_data->dialog), AUTH_DIALOG_RESPONSE_LOGIN);
+		return;
+	}
+
 	g_queue_foreach(data->ui_data->form_entries, (GFunc)do_override_label,
 			FORMCHOICE(sopt, entry));
 }
@@ -414,7 +438,7 @@ static gboolean ui_add_select (ui_fragment_data *data)
 	auth_ui_data *ui_data = _ui_data; /* FIXME global */
 	GtkWidget *hbox, *text, *combo;
 	struct oc_form_opt_select *sopt = (void *)data->opt;
-	int i;
+	int i, user_selection = -1;
 
 	hbox = gtk_box_new (GTK_ORIENTATION_HORIZONTAL, 0);
 	gtk_box_pack_start(GTK_BOX(data->ui_data->ssl_box), hbox, FALSE, FALSE, 0);
@@ -424,20 +448,21 @@ static gboolean ui_add_select (ui_fragment_data *data)
 
 	combo = gtk_combo_box_text_new();
 	gtk_box_pack_end(GTK_BOX(hbox), combo, FALSE, FALSE, 0);
+
 	for (i = 0; i < sopt->nr_choices; i++) {
 		gtk_combo_box_text_append_text(GTK_COMBO_BOX_TEXT(combo), FORMCHOICE(sopt, i)->label);
 		if (data->entry_text &&
-		    !strcmp(data->entry_text, FORMCHOICE(sopt, i)->name)) {
-			gtk_combo_box_set_active(GTK_COMBO_BOX(combo), i);
-			g_free(data->entry_text);
-			data->entry_text = FORMCHOICE(sopt, i)->name;
-		}
-	}
-	if (gtk_combo_box_get_active(GTK_COMBO_BOX(combo)) < 0) {
-		gtk_combo_box_set_active(GTK_COMBO_BOX(combo), 0); 
-		data->entry_text = FORMCHOICE(sopt, 0)->name;
+		    !strcmp(data->entry_text, FORMCHOICE(sopt, i)->name))
+			user_selection = i;
 	}
 
+	i = data->initial_selection != -1 ? data->initial_selection :
+	    user_selection != -1 ? user_selection : 0;
+	gtk_combo_box_set_active(GTK_COMBO_BOX(combo), i);
+	g_free(data->entry_text);
+	data->entry_text = FORMCHOICE(sopt, i)->name;
+	data->initial_selection = i;
+
 	if (g_queue_peek_tail(ui_data->form_entries) == data)
 		gtk_widget_grab_focus (combo);
 	g_signal_connect(G_OBJECT(combo), "changed", G_CALLBACK(combo_changed), data);
@@ -674,10 +699,12 @@ static gboolean ui_form (struct oc_auth_form *form)
 			g_mutex_lock (&ui_data->form_mutex);
 			g_queue_push_head(ui_data->form_entries, data);
 			g_mutex_unlock (&ui_data->form_mutex);
-			if (opt->type != OC_FORM_OPT_PASSWORD)
+			if (opt->type != OC_FORM_OPT_PASSWORD) {
 				data->entry_text = g_strdup (find_form_answer(ui_data->secrets,
 									      form, opt));
-			else {
+				if (!data->entry_text)
+					data->entry_text = g_strdup (opt->value);
+			} else {
 				GHashTable *attrs;
 
 				data->cancel = g_cancellable_new ();
@@ -694,12 +721,19 @@ static gboolean ui_form (struct oc_auth_form *form)
 
 			ui_write_prompt(data);
 		} else if (opt->type == OC_FORM_OPT_SELECT) {
+			char *authgroup_field = AUTHGROUP_FIELD(form);
+
 			g_mutex_lock (&ui_data->form_mutex);
 			g_queue_push_head(ui_data->form_entries, data);
 			g_mutex_unlock (&ui_data->form_mutex);
 			data->entry_text = g_strdup (find_form_answer(ui_data->secrets,
 								      form, opt));
 
+			if (authgroup_field && !strcmp(authgroup_field, opt->name))
+				data->initial_selection = AUTHGROUP_SELECTION(form);
+			else
+				data->initial_selection = -1;
+
 			ui_add_select(data);
 		} else
 			g_slice_free (ui_fragment_data, data);
@@ -708,11 +742,52 @@ static gboolean ui_form (struct oc_auth_form *form)
 	return ui_show(ui_data);
 }
 
+/* If our stored group_list selection differs from the server default, send a
+   NEWGROUP request to try to change it before rendering the form */
+
+static gboolean set_initial_authgroup (auth_ui_data *ui_data, struct oc_auth_form *form)
+{
+	struct oc_form_opt *opt;
+	char *authgroup_field = AUTHGROUP_FIELD(form);
+
+	if (!NEWGROUP_SUPPORTED || ui_data->group_set || authgroup_field)
+		return FALSE;
+	ui_data->group_set = TRUE;
+
+	for (opt = form->opts; opt; opt = opt->next) {
+		int i;
+		char *saved_group;
+		struct oc_form_opt_select *sopt;
+
+		if (opt->type != OC_FORM_OPT_SELECT || strcmp(opt->name, authgroup_field))
+			continue;
+
+		saved_group = find_form_answer(ui_data->secrets, form, opt);
+		if (!saved_group)
+			return FALSE;
+
+		sopt = (struct oc_form_opt_select *)opt;
+		for (i = 0; i < sopt->nr_choices; i++) {
+			struct oc_choice *ch = FORMCHOICE(sopt, i);
+			if (!strcmp(saved_group, ch->name) && i != AUTHGROUP_SELECTION(form)) {
+				free(opt->value);
+				opt->value = g_strdup(saved_group);
+				return TRUE;
+			}
+		}
+	}
+	return FALSE;
+}
+
 static int nm_process_auth_form (void *cbdata, struct oc_auth_form *form)
 {
 	auth_ui_data *ui_data = cbdata;
 	int response;
 
+	if (set_initial_authgroup(ui_data, form))
+		return OC_FORM_RESULT_NEWGROUP;
+
+	ui_data->newgroup = FALSE;
 	g_idle_add((GSourceFunc)ui_form, form);
 
 	g_mutex_lock(&ui_data->form_mutex);
@@ -772,11 +847,14 @@ static int nm_process_auth_form (void *cbdata, struct oc_auth_form *form)
 
 	ui_data->form_grabbed = 0;
 	g_mutex_unlock(&ui_data->form_mutex);
-	
-	/* -1 = cancel,
-	 *  0 = failure,
-	 *  1 = success */
-	return (response == AUTH_DIALOG_RESPONSE_LOGIN ? 0 : 1);
+
+	if (response == AUTH_DIALOG_RESPONSE_LOGIN) {
+		if (ui_data->newgroup)
+			return OC_FORM_RESULT_NEWGROUP;
+		else
+			return OC_FORM_RESULT_OK;
+	} else
+		return OC_FORM_RESULT_CANCELLED;
 
 }
 
-- 
1.8.3.2



From cernekee at gmail.com  Mon Dec 30 20:49:37 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Mon, 30 Dec 2013 17:49:37 -0800
Subject: [PATCH V2 nm-openconnect 3/3] auth-dialog: Add support for
 OC_FORM_OPT_IGNORE
In-Reply-To: <1388454577-4789-1-git-send-email-cernekee@gmail.com>
References: <1388454577-4789-1-git-send-email-cernekee@gmail.com>
Message-ID: <1388454577-4789-3-git-send-email-cernekee@gmail.com>

Hide any options that libopenconnect doesn't want us to display.
---
 auth-dialog/main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/auth-dialog/main.c b/auth-dialog/main.c
index f4c772b..3f9b77e 100644
--- a/auth-dialog/main.c
+++ b/auth-dialog/main.c
@@ -76,11 +76,13 @@
 #define AUTHGROUP_FIELD(form)		(form)->authgroup_field
 #define AUTHGROUP_SELECTION(form)	(form)->authgroup_selection
 #define FORMCHOICE(sopt, i)		((sopt)->choices[i])
+#define IGNORE_OPT(opt)			((opt)->flags & OC_FORM_OPT_IGNORE)
 #else
 #define NEWGROUP_SUPPORTED		0
 #define AUTHGROUP_FIELD(form)		NULL
 #define AUTHGROUP_SELECTION(form)	0
 #define FORMCHOICE(sopt, i)		(&(sopt)->choices[i])
+#define IGNORE_OPT(opt)			0
 #define OC_FORM_RESULT_ERR		-1
 #define OC_FORM_RESULT_OK		0
 #define OC_FORM_RESULT_CANCELLED	1
@@ -687,7 +689,8 @@ static gboolean ui_form (struct oc_auth_form *form)
 	for (opt = form->opts; opt; opt = opt->next) {
 		ui_fragment_data *data;
 
-		if (opt->type == OC_FORM_OPT_HIDDEN)
+		if (opt->type == OC_FORM_OPT_HIDDEN ||
+		    IGNORE_OPT(opt))
 			continue;
 
 		data = g_slice_new0 (ui_fragment_data);
-- 
1.8.3.2



From dwmw2 at infradead.org  Tue Dec 31 12:55:22 2013
From: dwmw2 at infradead.org (David Woodhouse)
Date: Tue, 31 Dec 2013 17:55:22 +0000
Subject: [GIT PULL V6] Library/Android/JNI improvements
In-Reply-To: <1388454498-4705-1-git-send-email-cernekee@gmail.com>
References: <1388454498-4705-1-git-send-email-cernekee@gmail.com>
Message-ID: <1388512522.7717.7.camel@shinybook.infradead.org>

On Mon, 2013-12-30 at 17:48 -0800, Kevin Cernekee wrote:
> 
> New API versions:
> 
>  - OPENCONNECT_3.0 just covers the auth form changes, intended for a
>    bugfix release.

I'm actually pondering a 5.02 release which doesn't change the ABI,
which distros can easily pick up, which will just disable xmlpost
automatically if there's an authgroup to be chosen. That'll deal with
the biggest regression, without completely disabling xmlpost. What do
you think?

-- 
dwmw2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5745 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20131231/e52dd76e/attachment.bin>

From cernekee at gmail.com  Tue Dec 31 15:16:24 2013
From: cernekee at gmail.com (Kevin Cernekee)
Date: Tue, 31 Dec 2013 12:16:24 -0800
Subject: [GIT PULL V6] Library/Android/JNI improvements
In-Reply-To: <1388512522.7717.7.camel@shinybook.infradead.org>
References: <1388454498-4705-1-git-send-email-cernekee@gmail.com>
 <1388512522.7717.7.camel@shinybook.infradead.org>
Message-ID: <CAJiQ=7B5Emb83dfP4ySaq7sWt6yLnMmysqenXsK2f_uAaM3dCA@mail.gmail.com>

On Tue, Dec 31, 2013 at 9:55 AM, David Woodhouse <dwmw2 at infradead.org> wrote:
> On Mon, 2013-12-30 at 17:48 -0800, Kevin Cernekee wrote:
>>
>> New API versions:
>>
>>  - OPENCONNECT_3.0 just covers the auth form changes, intended for a
>>    bugfix release.
>
> I'm actually pondering a 5.02 release which doesn't change the ABI,
> which distros can easily pick up, which will just disable xmlpost
> automatically if there's an authgroup to be chosen. That'll deal with
> the biggest regression, without completely disabling xmlpost. What do
> you think?

Yeah, I wondered about whether the distributions would resist taking
an update that breaks dependent packages...

For 5.02, how does this tree (plus the patch sent via email) look?


The following changes since commit 3cb5435da91e263e2dc7e3aa4f54488ae43dd5c4:

  auth: Add <group-access> node to XML POST initial request
(2013-12-30 22:13:36 +0000)

are available in the git repository at:

  git://github.com/cernekee/openconnect staging-5.02

for you to fetch changes up to ee077db1616fecee8478ba19c490688b72ddd3cb:

  android: Fix broken ARCH=mips build (2013-12-31 12:11:13 -0800)

----------------------------------------------------------------
Kevin Cernekee (8):
      http: Fix NULL vpninfo->hostname pointer on redirect
      auth: Save a pointer to the group_list dropdown option if it exists
      auth: Temporarily disable XML POST if an authgroup dropdown exists
      dtls: Don't send packets to a dead socket during rekeying
      www: Fix quoting in v5.01 changelog
      main: --cookie-on-stdin doesn't work with ocserv cookies
      http: Don't leak HTTP request buffer on failed connections
      android: Fix broken ARCH=mips build

 android/Makefile       |    2 ++
 auth.c                 |   12 ++++++++++++
 dtls.c                 |    8 ++------
 http.c                 |    3 ++-
 main.c                 |    4 ++--
 openconnect-internal.h |    2 ++
 openconnect.h          |    3 +++
 www/changelog.xml      |    2 +-
 8 files changed, 26 insertions(+), 10 deletions(-)


