OpenConnect 7.08 release

[Mike Miller]

On Tue, Dec 13, 2016 at 16:28:38 +0000, David Woodhouse wrote:
> I've added a certificate torture test suite and fixed a number of the
> bugs it showed with various esoteric (and not so esoteric) file
> formats. Distributors, please ensure you run 'make check' in your
> package build, and chase up any failures caused by the libraries you're
> building against.

I am unable to get `auth-pkcs11` to pass. The first problem is the
hardcoded Fedora path in tests/.config/pkcs11/modules/softhsm2.module.

After fixing that for my system (/usr/lib/softhsm/libsofthsm2.so), the
test fails with:

Testing PKCS#11 auth... 
warning: skipping unknown option 'cookie-validity'
Parsing plain auth method subconfig using legacy format
note: setting 'certificate+plain' as primary authentication method
note: setting 'file' as supplemental config option
listening (TCP) on 0.0.0.0:443...
listening (TCP) on [::]:443...
listening (UDP) on 0.0.0.0:443...
listening (UDP) on [::]:443...
ocserv[14837]: main: not using control unix socket
ocserv[14837]: main: initialized ocserv 0.11.6
ocserv[14847]: sec-mod: reading supplemental config from files
ocserv[14847]: sec-mod: sec-mod initialized (socket: ./ocserv-socket.14837)
ocserv[14837]: main: processed 1 CA certificate(s)
Connecting to obtain cookie (token openconnect-test key object=RSA)... error in setrlimit(1024): Operation not permitted
p11-kit: softhsm2: module failed to initialize, skipping: Internal error
Error loading certificate from PKCS#11: The requested data were not available.
Loading certificate failed. Aborting.
Failed to open HTTPS connection to 127.0.0.2
Failed to obtain WebVPN cookie
ocserv[14920]: GnuTLS error (at worker-vpn.c:595): The TLS connection was non-properly terminated.
ocserv[14837]: main: 127.0.0.2:24871 user disconnected (reason: unspecified, rx: 0, tx: 0)
Failure: Could not connect with token openconnect-test key object=RSA!
ocserv[14837]: main: termination request received; waiting for children to die
FAIL auth-pkcs11 (exit status: 1)

I'm happy to run more tests if there is something worth debugging here,
but I don't know what to look at.

-- 
mike