openconnect-9.12-150400.15.3.1

- Update to release 9.12:
  * Explicitly reject overly long tun device names.
  * Increase maximum input size from stdin (#579).
  * Ignore 0.0.0.0 as NBNS address (!446, vpnc-scripts#58).
  * Fix stray (null) in URL path after Pulse authentication (4023bd95).
  * Fix config XML parsing mistake that left GlobalProtect ESP non-working in v9.10 (!475).
  * Fix case sensitivity in GPST header matching (!474).

- Update to release 9.10:
  * Fix external browser authentication with KDE plasma-nm < 5.26.
  * Always redirect stdout to stderr when spawning external browser.
  * Increase default queue length to 32 packets.
  * Fix receiving multiple packets in one TLS frame, and single packets split across multiple TLS frames, for Array.
  * Handle idiosyncratic variation in search domain separators for all protocols
  * Support region selection field for Pulse authentication
  * Support modified configuration packet from Pulse 9.1R16 servers
  * Allow hidden form fields to be populated or converted to text fields on the command line
  * Support yet another strange way of encoding challenge-based 2FA for GlobalProtect
  * Add --sni option (and corresponding C and Java API functions) to allow domain-fronting connections in censored/filtered network environments
  * Parrot a GlobalProtect server's software version, if present, as the client version (!333)
  * Fix NULL pointer dereference that has left Android builds broken since v8.20 (!389).
  * Fix Fortinet authentication bug where repeated SVPNCOOKIE causes segfaults (#514, !418).
  * Support F5 VPNs which encode authentication forms only in JSON, not in HTML.
  * Support simultaneous IPv6 and Legacy IP ("dual-stack") for Fortinet .
  * Support "FTM-push" token mode for Fortinet VPNs .
  * Send IPv6-compatible version string in Pulse IF/T session establishment
  * Add --no-external-auth option to not advertise external-browser authentication
  * Many small improvements in server response parsing, and better logging messages and documentation.

- Update to release 9.01:
  * Add support for AnyConnect "Session Token Re-use Anchor Protocol" (STRAP)
  * Add support for AnyConnect "external browser" SSO mode
  * Bugfix RSA SecurID token decryption and PIN entry forms, broken in v8.20
  * Support Cisco's multiple-certificate authentication
  * Revert GlobalProtect default route handling change from v8.20
  * Suppo split-exclude routes for Fortinet
  * Add webview callback and SAML/SSO support for AnyConnect, GlobalProtect

- Update to release 8.20:
  * Support non-AEAD ciphersuites in DTLSv1.2 with AnyConnect.
  * Emulated a newer version of GlobalProtect official clients,
    5.1.5-8; was 4.0.2-19
  * Support Juniper login forms containing both password and 2FA
    token
  * Explicitly disable 3DES and RC4, unless enabled with
  - -allow-insecure-crypto
  * Allow protocols to delay tunnel setup and shutdown (!117)
  * Support for GlobalProtect IPv6
  * SIGUSR1now causes OpenConnect to log detailed connection
    information and statistics
  * Allow --servercert to be specified multiple times in order to
    accept server certificates matching more than one possible
    fingerprint
  * Demangle default routes sent as split routes by GlobalProtect
  * Support more Juniper login forms, including some SSO forms
  * Restore compatibility with newer Cisco servers, by no longer
    sending them the X-AnyConnect-Platform header
  * Add support for PPP-based protocols, currently over TLS only.
  * Add support for two PPP-based protocols, F5 with
  - -protocol=f5 and Fortinet with --protocol=fortinet.
  * Add support for Array Networks SSL VPN.
  * Support TLSv1.3 with TPMv2 EC and RSA keys, add test cases
    for swtpm and hardware TPM.

- Import the latest version of the vpnc-script, revision
  1d35a8527e5422967514dd1d47350ff2ede55903 (boo#1140772)
  * This brings a lot of improvements for non-trivial network setups, IPv6 etc

- Build with --without-gnutls-version-check

- Update to version 8.10:
  * Install bash completion script to
    ${datadir}/bash-completion/completions/openconnect.
  * Improve compatibility of csd-post.sh trojan.
  * Fix potential buffer overflow with GnuTLS describing local
    certs (CVE-2020-12823, bsc#1171862,
    gl#openconnect/openconnect!108).

- Fix CVE-2020-12105 (boo#1170452)
- Introduce subpackage for bash-completion
- Update to 8.09:
  * Add bash completion support.
  * Give more helpful error in case of Pulse servers asking for
    TNCC.
  * Sanitize non-canonical Legacy IP network addresses.
  * Fix OpenSSL validation for trusted but invalid certificates
    (CVE-2020-12105).
  * Convert tncc-wrapper.py to Python 3, and include modernized
    tncc-emulate.py as well. (!91)
  * Disable Nagle's algorithm for TLS sockets, to improve
    interactivity when tunnel runs over TCP rather than UDP.
  * GlobalProtect: more resilient handling of periodic HIP check
    and login arguments, and predictable naming of challenge forms.
  * Work around PKCS#11 tokens which forget to set
    CKF_LOGIN_REQUIRED.
- Update to 8.0.8:
  * Fix check of pin-sha256: public key hashes to be case sensitive
  * Don't give non-functioning stderr to CSD trojan scripts.
  * Fix crash with uninitialised OIDC token.
- Update to 8.0.7:
  * Don't abort Pulse connection when server-provided certificate
    MD5 doesn't match.
  * Fix off-by-one in check for bad GnuTLS versions, and add build
    and run time checks.
  * Don't abort connection if CSD wrapper script returns non-zero
    (for now).
  * Make --passtos work for protocols that use ESP, in addition
    to DTLS.
  * Convert tncc-wrapper.py to Python 3, and include modernized
    tncc-emulate.py as well.

- Remove tncc-wrapper.py script as it is python2 only bsc#1157446

- No need to ship hipreport-android.sh as it is intented for
  android systems only

- Update to 8.0.5:
  * Minor fixes to build on specific platforms
  * Includes fix for a buffer overflow with chunked HTTP handling
    (CVE-2019-16239, bsc#1151178)

- Use python3 to generate the web data as now it is supported
  by upstream

- Update to 8.0.3:
  * Fix Cisco DTLSv1.2 support for AES256-GCM-SHA384.
  * Fix recognition of OTP password fields.
- Verify source signature

- Update to 8.02:
  * Fix GNU/Hurd build.
  * Discover vpnc-script in default packaged location on FreeBSD/OpenBSD.
  * Support split-exclude routes for GlobalProtect.
  * Fix GnuTLS builds without libtasn1.
  * Fix DTLS support with OpenSSL 1.1.1+.
  * Add Cisco-compatible DTLSv1.2 support.
  * Invoke script with reason=attempt-reconnect before doing so.

- Update to 8.01:
  * Clear form submissions (which may include passwords) before
    freeing (CVE-2018-20319, bsc#1215669).
  * Allow form responses to be provided on command line.
  * Add support for SSL keys stored in TPM2.
  * Fix ESP rekey when replay protection is disabled.
  * Drop support for GnuTLS older than 3.2.10.
  * Fix --passwd-on-stdin for Windows to not forcibly open console.
  * Fix portability of shell scripts in test suite.
  * Add Google Authenticator TOTP support for Juniper.
  * Add RFC7469 key PIN support for cert hashes.
  * Add protocol method to securely log out the Juniper session.
  * Relax requirements for Juniper hostname packet response to support old gateways.
  * Add API functions to query the supported protocols.
  * Verify ESP sequence numbers and warn even if replay protection is disabled.
  * Add support for PAN GlobalProtect VPN protocol (--protocol=gp).
  * Reorganize listing of command-line options, and include information on supported protocols.
  * SIGTERM cleans up the session similarly to SIGINT.
  * Fix memset_s() arguments.
  * Fix OpenBSD build.
- Explicitely enable all the features as needed to stop build if
  something is missing
- Run tests
- Folow the library packaging guidelines

- Modified spec file: only add this BuildRequires on Leap/SLE 15+
  (fate#325553).
  > BuildRequires:  pkgconfig(libpskc)

- Drop pkgconfig(gconf-2.0) and pkgconfig(gtk+-2.0) BuildRequires:
  Not needed, nor used.

- Add openconnect-CVE-2020-12105.patch: Use OpenSSL X509_check_host()
  and X509_check_ip() correctly(bsc#1170452, CVE-2020-12105).

- Add openconnect-CVE-2019-16239.patch: Fix buffer overflow with
  chunked HTTP handling(bsc#1151178, CVE-2019-16239).

- Add BuildRequires pkgconfig(libpcsclite/libpskc) to enable
  liboath (TOTP/HOTP) and yubikey support.

- Add explicit python2-base and python2-xml BuildRequires: the
  buildsystem checks for python2 and disables building the
  documentation if not found. Buildinf the documentation in plus
  depends on the xml modules.
  So far we relied on other packages pulling in python2 for us.

- Drop vpnc dependency by including vpnc-script from vpnc package
  (fate#323497).

- update to version 7.08 (bsc#1056389)
  * Add SHA256 support for server cert hashes.
  * Enable DHE ciphers for Cisco DTLS.
  * Increase initial oNCP configuration buffer size.
  * Improve support for point-to-point routing on Windows.
  * Check for non-resumed DTLS sessions which may indicate a MiTM attack.
  * Fix compatibility with Pulse Secure 8.2R5.
  * Support DTLS automatic negotiation.
  * Support --key-password for GnuTLS PKCS#11 PIN.
  * Support automatic DTLS MTU detection with OpenSSL.
  * Update OpenSSL to allow TLSv1.2, improve compatibility options.
  * Remove --no-cert-check option. It was being (mis)used.
  * Fix OpenSSL support for PKCS#11 EC keys without public key.
  * Fix polling/retry on "tun" socket when buffers full.
  * Fix AnyConnect server-side MTU setting.
  * Fix ESP replay detection.
  * Add certificate torture test suite.
  * Support PKCS#11 PIN via pin-value= and --key-password for OpenSSL.
  * Fix integer overflow issues with ESP packet replay detection.
  * Add --pass-tos option as in OpenVPN.
  * Support role selection form in Juniper VPN.
  * Support DER-format certificates, add certificate format torture tests.
  * For OpenSSL >= 1.0.2, fix certificate validation when only an
    intermediate CA is specified with the --cafile option.
  * Support Juniper "Pre Sign-in Message".
- dropped juniper-fix-for-upstream-sources.patch, upstreamed

- Upgraded to 7.07, included fix for Juniper vpn

- Update to version 7.0.7
  * More fixes for OpenSSL 1.1 build.
  * Support Juniper "Post Sign-in Message".
  * Add --protocol option.
  * Fix ChaCha20-Poly1305 cipher suite to reflect final standard.
  * Add ability to disable IPv6 support via library API.
  * Set groups appropriately when using setuid().
  * Automatic DTLS MTU detection.
  * Support SSL client certificate authentication with Juniper servers.
  * Revamp SSL certificate validation for OpenSSL and stop supporting OpenSSL older than 0.9.8.
  * Fix handling of multiple DNS search domains with Network Connect.
  * Fix handling of large configuration packets for Network Connect.
  * Enable SNI when built with OpenSSL (1.0.1g or later).
  * Add --resolve and --local-hostname options to command line.
- juniper-fix-for-upstream-sources.patch included to fix upgraded Juniper servers
  * Submitted to upstream, not yet included in release

- Update to version 7.0.6
  * Fix openconnect.pc breakage after liboath removal.
  * Refactor Juniper Network Connect receive loop.
  * Fix some memory leaks.
  * Add Bosnian translation.

- Update to version 7.0.5
  * Fix alignment issue which broke LZS compression on ARM etc.
  * Support HTTP authentication to servers, not just proxies.
  * Add SHA256/SHA512 support for OATH.
  * Remove liboath dependency.
  * Support DTLS v1.2 and AES-GCM with OpenSSL 1.0.2.
  * Add OpenSSL 1.0.2 to known-broken releases (RT#3703, RT#3711).
  * Fix build with OpenSSL HEAD (OpenSSL 1.1.x).
  * Preliminary support for Juniper SSL VPN.

- Update to Version 7.04
  * Change default behaviour to enable only stateless compression.
  * Add --compression argument and openconnect_set_compression_mode().
  * Add support for LZS compression
  * Add support for LZ4 compression
- Add liblz4-devel dependency for LZ4 compression support.

- Update to Version 7.03
  * Clean up handling of incoming packets.
  * Fix issue with two-stage (i.e. NetworkManager) connection to
    servers with trick DNS (rh#1179681).
  * Stop using static variables for received packets.

- Update to Version 7.02
  * Add PKCS#11 support for OpenSSL.
  * Fix handling of select options in openconnect_set_option_value().

- Update to Version 7.01
  * Try harder to find a PKCS#11 key to match a given certificate.
  * Handle 'Connection: close' from proxies correctly.
  * Warn when MTU is set too low (<1280) to permit IPv6 connectivity.
  * Add support for X-CSTP-DynDNS, to trigger DNS lookup on each reconnec

- Update to Version 7.00
  * Add support for GnuTLS 3.4 system: keys including Windows certificate store.
  * Add support for HOTP/TOTP keys from Yubikey NEO devices.
  * Add ---no-system-trust option to disable default certificate authorities.
  * Improve libiconv and libintl detection.
  * Stop calling setenv() from library functions.
  * Support utun driver on OS X.
  * Change library API so string ownership is never transferred.
  * Support new NDIS6 TAP-Windows driver shipped with OpenVPN 2.3.4.
  * Support using PSKC (RFC6030) token files for HOTP/TOTP tokens.
  * Support for updating HOTP token storage when token is used.
  * Support for reading OTP token data from a file.
  * Add full character set handling for legacy non-UTF8 systems (including Windows).
  * Fix legacy (i.e. not XML POST) submission of non-ASCII form entries (even in UTF-8 locales).
  * Avoid retrying without XML POST, when we failed to even reach the server.
  * Fix off-by-one in parameter substitution in error messages.
  * Improve reporting when GSSAPI auth requested but not compiled in.
  * Fix parsing of split include routes on Windows.
  * Fix crash on invocation with --token-mode but no --token-secret.

- Add token support via stoken

- Update to Version 6.00
  * Support SOCKS proxy authentication (password, GSSAPI).
  * Support HTTP proxy authentication (Basic, Digest, NTLM and GSSAPI).
  * Download XML profile in XML POST mode.
  * Fix a couple of bugs involving DTLS rekeying.
  * Fix problems seen when building or connecting without DTLS enabled.
  * Fix tun error handling on Windows hosts.
  * Skip password prompts when using PKCS#8 and PKCS#12 certificates with
  empty passwords.
  * Fix several minor memory leaks and error paths.
  * Update several Android dependencies, and make the download process more
  robust.

- Update to Version 5.99
  * Add RFC4226 HOTP token support.
  * Tolerate servers closing connection uncleanly after HTTP/1.0 response
  (Ubuntu #1225276).
  * Add support for IPv6 split tunnel configuration.
  * Add Windows support with MinGW (tested with both IPv6 and Legacy IP with
  latest vpnc-script-win.js)
  * Change library API to support updating the auth form when the authgroup
  is changed (Ubuntu #1229195).
  * Change --os mac to --os mac-intel, to match the identifier used by Cisco
  clients.
  * Add new API functions to support invoking the VPN mainloop directly from
  an application.
  * Add JNI interface and sample Java application.
  * Fix junk in --cookieonly output when CSD is enabled.
  * Enable TOTP, stoken, and JNI support in the Android builds.
  * Add --pfs option to enforce perfect forward secrecy.
  * Enable elliptic curves with GnuTLS 3.2.9+, where there is a workaround for
  certain firewalls that fail with client hellos between 256 and 512 bytes.
  * Add padding when sending password, to avoid leakage of password and
  username length.
  * Add support for DTLS 1.2 and AES-GCM when connecting to ocserv.
  * Add support for server name indication when compiled with GnuTLS 3.2.9+.

- Update to version 5.03
  * Fix crash on --authenticate due to freeing --cafile option in argv.
- Update to version 5.02
  * Fix XML POST issues with authgroups by falling back to old style login.
  * Fix --cookie-on-stdin with cookies from ocserv.
  * Fix reconnection to wrong host after redirect.
  * Reduce limit of queued packets on DTLS socket, to fix VoIP latency.
  * Fix Solaris build breakage due to missing <string.h> includes.
  * Include path in <group-access> node.
  * Include supporting CA certificates from PKCS#11 tokens (with GnuTLS 3.2.7+).
  * Fix possible heap overflow if MTU is increased on reconnection (CVE-2013-7098).
- Update to version 5.01
  * Attempt to handle <client-cert-request> in aggregate auth mode.
  * Don't include X-Aggregate-Auth: header in fallback mode.
  * Enable AES256 mode for DTLS with GnuTLS (RH#955710).
  * Add --dump-http-traffic option for debugging.
  * Be more permissive in parsing XML forms.
  * Use original URL when falling back to non-XML POST mode.
  * Add --no-xmlpost option to revert to older, compatible behaviour.
  * Close connection before falling back to non-xmlpost mode (RH#964650).
  * Improve error handling when server closes connection (Debian #708928).
- Update to version 5.00
  * Use GnuTLS by default instead of OpenSSL.
  * Avoid using deprecated gnutls_pubkey_verify_data() function.
  * Fix compatibility issues with XML POST authentication.
  * Fix memory leaks on realloc() failure.
  * Fix certificate validation problem caused by hostname canonicalisation.
  * Add RFC6238 TOTP token support using liboath.
  * Replace --stoken option with more generic --token-mode and --token-secret options.
- Update to version 4.99
  * Add --os switch to report a different OS type to the gateway.
  * Support new XML POST format.
  * Add SecurID token support using libstoken.

- Fix bnc#817152
- Update to version 4.09
  * Fix overflow on HTTP request buffers (CVE-2012-6128)
  * Fix connection to servers with round-robin DNS with two-stage
    auth/connect.
  * Impose minimum MTU of 1280 bytes.
  * Fix some harmless issues reported by Coverity.
  * Improve "Attempting to connect..." message to be explicit
    when it's connecting to a proxy.
- Update to version 4.07
  * Fix segmentation fault when invoked with -p argument.
  * Fix handling of write stalls on CSTP (TCP) socket.
- Update to version 4.06
  * Fix default CA location for non-Fedora systems with old GnuTLS.
  * Improve error handing when vpnc-script exits with error.
  * Handle PKCS#11 tokens which won't list keys without login.
- Update to version 4.05
  * Use correct CSD script for Mac OS X.
  * Fix endless loop in PIN cache handling with multiple PKCS#11
    tokens.
  * Fix PKCS#11 URI handling to preserve all attributes.
  * Don't forget key password on GUI reconnect.
  * Fix GnuTLS v3 build on OpenBSD.
- Update to version 4.04
  * Fix GnuTLS password handling for PKCS#8 files.
- Update to version 4.03
  * Fix --no-proxy option.
  * Fix handling of requested vs. received MTU settings.
  * Fix DTLS MTU for GnuTLS 3.0.21 and newer.
  * Support more ciphers for OpenSSL encrypted PEM keys, with
    GnuTLS.
  * Fix GnuTLS compatibilty issue with servers that insist on
    TLSv1.0 or non-AES ciphers (RH#836558).
- Update to version 4.02
  * Fix build failure due to unconditional inclusion of
    <gnutls/dtls.h>.
- Update to version 4.01
  * Add support for OpenSSL's odd encrypted PKCS#1 files, for
    GnuTLS.
  * Fix repeated passphrase retry for OpenSSL.
  * Add keystore support for Android.
  * Support TPM, and also additional checks on PKCS#11 certs,
    even with GnuTLS 2.12.
  * Fix library references to OpenSSL's ERR_print_errors_cb() when built against GnuTLS v2.12.
- Update to version 4.00
  * Add support for OpenSSL's odd encrypted PKCS#1 files, for GnuTLS.
  * Fix repeated passphrase retry for OpenSSL.
  * Add keystore support for Android.
  * Support TPM, and also additional checks on PKCS#11 certs, even with GnuTLS 2.12.
  * Fix library references to OpenSSL's ERR_print_errors_cb() when built against GnuTLS v2.12.

- license update: LGPL-2.1+
  No LGPL-2.1 "only" licenses found. Fedora also uses LGPL-2.1 "or later"
  as license

- Fixes buffer overflow security vulnerability.  See:
  * CVE-2012-3291
  * BNC#767616
- Update to version 3.99
  * Enable native TPM support when built with GnuTLS.
  * Enable PKCS#11 token support when built with GnuTLS.
  * Eliminate all SSL library exposure through libopenconnect.
  * Parse split DNS information, provide $CISCO_SPLIT_DNS
    environment variable to vpnc-script.
  * Attempt to provide new-style MTU information to server (on
    Linux only, unless specified on command line).
  * Allow building against GnuTLS, including DTLS support.
  * Add --with-pkgconfigdir= option to configure for FreeBSD's
    benefit (fd#48743).
- Update to version 3.20
  * Cope with non-keepalive HTTP response on authentication success
  * Fix progress callback with incorrect cbdata which caused KDE
    crash.
- Update to version 3.19
  * Add --config option for reading options from file.
  * Improve OpenSSL DTLS compatibility to work on Ubuntu 10.04.
  * Flush progress logging output promptly after each message.
  * Add symbol versioning for shared library (on sane platforms).
  * Add openconnect_set_cancel_fd() function to allow clean
    cancellation.
  * Fix corruption of URL in openconnect_parse_url() if it
    specifies a port number.
  * Fix inappropriate exit() calls from library code.
  * Library namespace cleanup ? all symbols now have the prefix
    openconnect_ on platforms where symbol versioning works.
  * Fix --non-inter option so it still uses login information from
    command line.
- Update to version 3.18
  * Fix autohate breakage with --disable-nls... hopefully.
  * Fix buffer overflow in banner handling.
- Update to version 3.17
  * Work around time() brokenness on Solaris.
  * Fix interface plumbing on Solaris 10.
  * Provide asprintf() function for (unpatched) Solaris 10.
  * Make vpnc-script mandatory, like it is for vpnc
  * Don't set Legacy IP address on tun device; let vpnc-script do
    it.
  * Detect OpenSSL even without pkg-config.
  * Stop building static library by default.
  * Invoke vpnc-script with "pre-init" reason to load tun module if
    necessary.
- Update to version 3.16
  * Fix build failure on Debian/kFreeBSD and Hurd.
  * Fix memory leak of deflated packets.
  * Fix memory leak of zlib state on CSTP reconnect.
  * Eliminate memcpy() calls on packets from DTLS and tunnel device
  * Use I_LINK instead of I_PLINK on Solaris to plumb interface for
    Legacy IP.
  * Plumb interface for IPv6 on Solaris, instead of expecting
    vpnc-script to do it.
  * Refer to vpnc-script and help web pages in openconnect output.
  * Fix potential crash when processing libproxy results.
  * Be more conservative in detecting libproxy without pkg-config.
- Add optional libproxy-devel buildrequires
- Add new mandatory vpnc buildrequires
- Package new documentation in doc package
- Remove static devel libraries since this is the new upstream
  default

- Update to version 3.15
  * Fix for reading multiple packets from Solaris tun device.
  * Call bindtextdomain() to ensure that translations are found in install path.
- Update to version 3.14
  * Move executable to $prefix/sbin.
  * Fix build issues on OSX, OpenIndiana, DragonFlyBSD, OpenBSD, FreeBSD & NetBSD.
  * Fix non-portable (void *) arithmetic.
  * Make more messages translatable.
  * Attempt to make NLS support more portable (with fewer dependencies).
- Update to version 3.13
  * Add --cert-expire-warning option.
  * Give visible warning when server dislikes client SSL certificate.
  * Add localisation support.
  * Fix build on Debian systems where dtls1_stop_timer() is not available.
  * Fix libproxy detection.
  * Enable a useful set of compiler warnings by default.
  * Fix various minor compiler warnings.
- Update to version 3.12
  * Fix DTLS compatibility with ASA firmware 8.4.1(11) and above.
  * Fix build failures on GNU Hurd, on systems with ancient OpenSSL, and on Debian.
  * Add --pid-file option.
  * Print SHA1 fingerprint with server certificate details.
- spec file changes
  * Package language files in a lang package
  * Since the binary is in /usr/sbin, keep the manual as man8
  * Package .a file in -devel package and have -devel package provide -devel-static

- Simplified man file installation
- Cleaned up spec file formatting

- Changed manuals to man1

- Removed %{?_smp_mflags}

- Removed unneeded libopenconnect.la file.
- Minor formatting changes to several spec file macros

- Added upstream url to Source0: tag
- Switched back to original tar.gz file