Add --no-xmlpost option to fall back to old behaviour

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

diff --git a/http.c b/http.c
index bb707a3e7ae1c37f5398249515f94a2866211ef8..1437b8976adfcaf4397634e84b27e184c4de6026 100644 (file)
--- a/http.c
+++ b/http.c
@@ -976,6 +976,9 @@ int openconnect_obtain_cookie(struct openconnect_info *vpninfo)
                        return result;
        }
 
+       if (vpninfo->noxmlpost)
+               goto fail;
+
        /*
         * Step 2: Probe for XML POST compatibility
         *

diff --git a/main.c b/main.c
index d140d783a759203249f8e2e256a1095ba3e8e3bd..ef173aaccb9517e61d2d0df93d58bcdf871641e8 100644 (file)
--- a/main.c
+++ b/main.c
@@ -103,6 +103,7 @@ enum {
        OPT_NO_HTTP_KEEPALIVE,
        OPT_NO_PASSWD,
        OPT_NO_PROXY,
+       OPT_NO_XMLPOST,
        OPT_PIDFILE,
        OPT_PASSWORD_ON_STDIN,
        OPT_PRINTCOOKIE,
@@ -180,6 +181,7 @@ static struct option long_options[] = {
        OPTION("token-mode", 1, OPT_TOKEN_MODE),
        OPTION("token-secret", 1, OPT_TOKEN_SECRET),
        OPTION("os", 1, OPT_OS),
+       OPTION("no-xmlpost", 0, OPT_NO_XMLPOST),
        OPTION(NULL, 0, 0)
 };
 
@@ -286,6 +288,7 @@ static void usage(void)
        printf("      --no-http-keepalive         %s\n", _("Disable HTTP connection re-use"));
        printf("      --no-passwd                 %s\n", _("Disable password/SecurID authentication"));
        printf("      --no-cert-check             %s\n", _("Do not require server SSL cert to be valid"));
+       printf("      --no-xmlpost                %s\n", _("Do not attempt XML POST authentication"));
        printf("      --non-inter                 %s\n", _("Do not expect user input; exit if it is required"));
        printf("      --passwd-on-stdin           %s\n", _("Read password from standard input"));
        printf("      --token-mode=MODE           %s\n", _("Software token type: rsa or totp"));
@@ -561,6 +564,9 @@ int main(int argc, char **argv)
                case OPT_NO_PASSWD:
                        vpninfo->nopasswd = 1;
                        break;
+               case OPT_NO_XMLPOST:
+                       vpninfo->noxmlpost = 1;
+                       break;
                case OPT_NON_INTER:
                        non_inter = 1;
                        break;

diff --git a/openconnect-internal.h b/openconnect-internal.h
index c116a324f77e92f91ff9a36543c71008603a08f4..d2c176edad1f16df35500e92b95eb45dfce66d63 100644 (file)
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -175,6 +175,7 @@ struct openconnect_info {
        char *password;
        char *authgroup;
        int nopasswd;
+       int noxmlpost;
        char *dtls_ciphers;
        uid_t uid_csd;
        char *csd_wrapper;

diff --git a/openconnect.8.in b/openconnect.8.in
index e940fe6f573f825ebb155446ac72d5154a4b3334..3038c4f00924c8e5d9a781725499d3517c16813e 100644 (file)
--- a/openconnect.8.in
+++ b/openconnect.8.in
@@ -47,6 +47,7 @@ openconnect \- Connect to Cisco AnyConnect VPN
 .OP \-\-no\-dtls
 .OP \-\-no\-http\-keepalive
 .OP \-\-no\-passwd
+.OP \-\-no\-xmlpost
 .OP \-\-non\-inter
 .OP \-\-passwd\-on\-stdin
 .OP \-\-token-mode mode
@@ -319,6 +320,19 @@ mailing list.
 .B \-\-no\-passwd
 Never attempt password (or SecurID) authentication.
 .TP
+.B \-\-no\-xmlpost
+Do not attempt to post an XML authentication/configuration request to the
+server; use the old style GET method which was used by older clients and
+servers instead.
+
+This option is a temporary safety net, to work around potential
+compatibility issues with the code which falls back to the old method
+automatically. It causes OpenConnect to behave more like older
+versions (4.08 and below) did. If you find that you need to use this
+option, then you have found a bug in OpenConnect. Please see
+http://www.infradead.org/openconnect/mail.html and report this to the
+developers.
+.TP
 .B \-\-non\-inter
 Do not expect user input; exit if it is required.
 .TP

diff --git a/www/changelog.xml b/www/changelog.xml
index 6b9b50ac410b90edd871512a7b364adb45c413a1..ec848da90c0f717ae83e3a8b77153d3b9526ec49 100644 (file)
--- a/www/changelog.xml
+++ b/www/changelog.xml
@@ -17,6 +17,7 @@
 <ul>
    <li><b>OpenConnect HEAD</b>
      <ul>
+       <li>Add <tt>--no-xmlpost</tt> option to revert to older, compatible behaviour.</li>
        <li>Close connection before falling back to non-xmlpost mode <a href="https://bugzilla.redhat.com/show_bug.cgi?id=964650"><i>(RH#964650)</i></a>.</li>
        <li>Improve error handling when server closes connection <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708928"><i>(Debian #708928)</i></a>.</li>
      </ul><br/>