~mamarley/openconnect/+git/gitlab-main:658-anyconnect-cisco-secure-client

Last commit made on 2023-09-02
Get this branch:
git clone -b 658-anyconnect-cisco-secure-client https://git.launchpad.net/~mamarley/openconnect/+git/gitlab-main

Branch merges

Branch information

Name:
658-anyconnect-cisco-secure-client
Repository:
lp:~mamarley/openconnect/+git/gitlab-main

Recent commits

7512698... by Dan Lenski

Shim for renaming of GNUTLS_NO_EXTENSIONS in GnuTLS v3.8.1

The constant `GNUTLS_NO_EXTENSIONS` was renamed in
https://gitlab.com/gnutls/gnutls/-/commit/a7c4a04e (released in v3.8.1), and
then a backwards-compatibility shim was belatedly added in
https://gitlab.com/gnutls/gnutls/-/commit/abfa8634, which has not yet been
released.

We need to re-add the constant ourselves in order to build correctly with
GnuTLS v3.8.1. This should fix
https://gitlab.com/openconnect/openconnect/-/issues/650.

Signed-off-by: Daniel Lenski <email address hidden>

17b9375... by Nikos Mavrogiannopoulos

Merge branch 'tmp-update-fedora-build' into 'master'

Update fedora build & add centos streams

See merge request openconnect/openconnect!485

394bc54... by Nikos Mavrogiannopoulos

Merge branch 'tmp-enable-asan' into 'master'

Enable address sanitizer checks

See merge request openconnect/openconnect!486

db3722f... by Audric Schiltknecht <email address hidden>

Fix invalid reset of URL variable in csd-wrapper

The URL variable is constructed from the CSD_HOSTNAME at the beginning of
the script. However, prior to parsing the command line, it was reset to
an empty value.

[DRL: This bug has existed since
https://gitlab.com/openconnect/openconnect/-/commit/cb83e535213ff2132643d2a68c50abc294b43b82,
when I modified the `csd-wrapper.sh` script to parse its `-url` command-line
argument, but forgot to remove the subsequent line `URL=`.]

Signed-off-by: Audric Schiltknecht <email address hidden>

b0034f2... by Dan Lenski

Request help with the interpretation of F5 URIs in the docs

Some F5 VPNs use these to complete authentication and handoff to the
proprietary client, and we currently don't know how to interpret them in a
way that would allow OpenConnect to be used instead.

See https://gitlab.com/openconnect/openconnect/-/issues/639 and
https://lists.infradead.org/pipermail/openconnect-devel/2021-August/005035.html
for further discussion.

Signed-off-by: Daniel Lenski <email address hidden>

9c63c94... by dwmw2

Fix changelog entry for Pulse OS reporting

This was added under v9.12 instead of the HEAD section. Next person to do
that gets to implement a CI test for it :)

Perhaps we should have a policy of adding in reverse chronological order
so that newly-added lines are always immediately below the 'HEAD' title,
which would mean that merging older PRs would *conflict* instead of
silently merging into the older changelog?

Fixes: ff86be7281 ("update changelog")
Signed-off-by: David Woodhouse <email address hidden>

5a9a37a... by Dan Lenski

Fix juniper-auth test

In 57160c9f2673adbbe468db137b28da4187549061, I updated
fake-juniper-server.py to use a "persistent" configuration (as already done
for fake GlobalProtect, Fortinet, F5 servers), but thne I somehow forgot to
update the actual juniper-auth test script accordingly.

Signed-off-by: Daniel Lenski <email address hidden>

9d9a33c... by Dan Lenski

Replace broken link with Wayback Machine link

The article "Why TCP Over TCP Is A Bad Idea" is very useful for explaining
why VPNs perform better when using UDP-based transport (DTLS or ESP) rather
than TCP-based transport (TLS), but unfortunately the original site is no
longer available.

Replace it with a link to the Internet Archive's Waback Machine, specifically
https://web.archive.org/web/20230228035749/http://sites.inka.de/~W1011/devel/tcp-tcp.html

Signed-off-by: Daniel Lenski <email address hidden>

93f4397... by Nikos Mavrogiannopoulos

.gitlab-ci.yml: enabled address sanitizer checks

Signed-off-by: Nikos Mavrogiannopoulos <email address hidden>

a5d3897... by Nikos Mavrogiannopoulos

.gitlab-ci.yml: added centos 8 and 9 stream builds

The --allow-insecure-crypto doesn't work with CentOS stream 9
and the openssl legacy provider.

Signed-off-by: Nikos Mavrogiannopoulos <email address hidden>