OpenVPN
options.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2026 OpenVPN Inc <sales@openvpn.net>
9 * Copyright (C) 2008-2026 David Sommerseth <dazo@eurephia.org>
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2
13 * as published by the Free Software Foundation.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, see <https://www.gnu.org/licenses/>.
22 */
23
24/*
25 * 2004-01-28: Added Socks5 proxy support
26 * (Christof Meerwald, https://cmeerw.org)
27 */
28
29#ifdef HAVE_CONFIG_H
30#include "config.h"
31#endif
32#ifdef HAVE_CONFIG_VERSION_H
33#include "config-version.h"
34#endif
35
36#include "syshead.h"
37
38#include "buffer.h"
39#include "error.h"
40#include "common.h"
41#include "run_command.h"
42#include "shaper.h"
43#include "crypto.h"
44#include "ssl.h"
45#include "ssl_ncp.h"
46#include "options.h"
47#include "misc.h"
48#include "socket_util.h"
49#include "packet_id.h"
50#include "pkcs11.h"
51#include "win32.h"
52#include "push.h"
53#include "pool.h"
54#include "proto.h"
55#include "helper.h"
56#include "manage.h"
57#include "forward.h"
58#include "ssl_verify.h"
59#include "platform.h"
60#include "xkey_common.h"
61#include "dco.h"
62#include "options_util.h"
63#include "tun_afunix.h"
64#include "domain_helper.h"
65#include "mbuf.h"
66#include "check_file_access.h"
67
68#include <ctype.h>
69
70#include "memdbg.h"
71#include "options_util.h"
72
73const char title_string[] = PACKAGE_STRING
74#ifdef CONFIGURE_GIT_REVISION
75 " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS "]"
76#endif
77 " " TARGET_ALIAS
78#if defined(ENABLE_CRYPTO_MBEDTLS)
79 " [SSL (mbed TLS)]"
80#elif defined(ENABLE_CRYPTO_OPENSSL)
81 " [SSL (OpenSSL)]"
82#else
83 " [SSL]"
84#endif /* defined(ENABLE_CRYPTO_MBEDTLS) */
85#ifdef USE_COMP
86#ifdef ENABLE_LZO
87 " [LZO]"
88#endif
89#ifdef ENABLE_LZ4
90 " [LZ4]"
91#endif
92#ifdef ENABLE_COMP_STUB
93 " [COMP_STUB]"
94#endif
95#endif /* USE_COMP */
96#if EPOLL
97 " [EPOLL]"
98#endif
99#ifdef PRODUCT_TAP_DEBUG
100 " [TAPDBG]"
101#endif
102#ifdef ENABLE_PKCS11
103 " [PKCS11]"
104#endif
105#if ENABLE_IP_PKTINFO
106#if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
107 " [MH/PKTINFO]"
108#elif defined(IP_RECVDSTADDR)
109 " [MH/RECVDA]"
110#endif
111#endif
112 " [AEAD]"
113#ifdef ENABLE_DCO
114 " [DCO]"
115#endif
116#ifdef CONFIGURE_GIT_REVISION
117 " built on " __DATE__
118#endif
119 ;
120
121#ifndef ENABLE_SMALL
122
123static const char usage_message[] =
124 "%s\n"
125 "\n"
126 "General Options:\n"
127 "--config file : Read configuration options from file.\n"
128 "--help : Show options.\n"
129 "--version : Show copyright and version information.\n"
130 "\n"
131 "Tunnel Options:\n"
132 "--local host|* [port]: Local host name or IP address and port for bind.\n"
133 " If specified, OpenVPN will bindto this address. If unspecified,\n"
134 " OpenVPN will bind to all interfaces. '*' can be used as hostname\n"
135 " and means 'any host' (OpenVPN will listen on what is returned by the OS).\n"
136 " On a client, or in point-to-point mode, this can only be specified once (1 socket).\n"
137 " On an OpenVPN setup running as ``--server``, this can be specified multiple times\n"
138 " to open multiple listening sockets on different addresses and/or different ports.\n"
139 " In order to specify multiple listen ports without specifying an address, use '*'\n"
140 " to signal 'use what the operating system gives you as default', for\n"
141 " 'all IPv4 addresses' use '0.0.0.0', for 'all IPv6 addresses' use '::'.\n"
142 " ``--local`` implies ``--bind``.\n"
143 "--remote host [port] : Remote host name or ip address.\n"
144 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
145 "--remote-random-hostname : Add a random string to remote DNS name.\n"
146 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
147 "--proto p : Use protocol p for communicating with peer.\n"
148 " p = udp (default), tcp-server, tcp-client\n"
149 " udp4, tcp4-server, tcp4-client\n"
150 " udp6, tcp6-server, tcp6-client\n"
151 "--proto-force p : only consider protocol p in list of connection profiles.\n"
152 " p = udp or tcp\n"
153 "--connect-retry n [m] : For client, number of seconds to wait between\n"
154 " connection retries (default=%d). On repeated retries\n"
155 " the wait time is exponentially increased to a maximum of m\n"
156 " (default=%d).\n"
157 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
158 "--http-proxy s p [up] [auth] : Connect to remote host\n"
159 " through an HTTP proxy at address s and port p.\n"
160 " If proxy authentication is required,\n"
161 " up is a file containing username/password on 2 lines, or\n"
162 " 'stdin' to prompt from console.\n"
163 "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
164 " determine auth method and query for username/password\n"
165 " if needed. auto-nct disables weak proxy auth methods.\n"
166 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
167 " Repeat to set multiple options.\n"
168 " VERSION version (default=1.0)\n"
169 " AGENT user-agent\n"
170 "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
171 " address s and port p (default port = 1080).\n"
172 " If proxy authentication is required,\n"
173 " up is a file containing username/password on 2 lines, or\n"
174 " 'stdin' to prompt for console.\n"
175 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
176 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
177 " resolve for n seconds before failing (disabled by default).\n"
178 " Set n=\"infinite\" to retry indefinitely.\n"
179 "--preresolve : Resolve configured --remote, --local, and proxy hostnames at startup.\n"
180 "--float : Allow remote to change its IP address/port, such as through\n"
181 " DHCP (this is the default if --remote is not used).\n"
182 "--ipchange cmd : Run command cmd on remote ip address initial\n"
183 " setting or change -- execute as: cmd ip-address port#\n"
184 "--port port : TCP/UDP port # for both local and remote.\n"
185 "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
186 "--rport port : TCP/UDP port # for remote (default=%s).\n"
187 "--bind : Bind to local address and port. (This is the default unless\n"
188 " --proto tcp-client"
189 " or --http-proxy"
190 " or --socks-proxy"
191 " is used).\n"
192 "--nobind : Do not bind to local address and port.\n"
193 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device).\n"
194 " Defaults to \"tun\" if neither --dev nor --dev-type is given.\n"
195 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
196 " this option only if the tun/tap device used with --dev\n"
197 " does not begin with \"tun\" or \"tap\".\n"
198 "--dev-node node : Explicitly set the device node rather than using\n"
199 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
200#if defined(ENABLE_DCO)
201 "--disable-dco : Do not attempt using Data Channel Offload.\n"
202#endif
203 "--lladdr hw : Set the link layer address of the tap device.\n"
204 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
205#ifdef ENABLE_IPROUTE
206 "--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n"
207#endif
208 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
209 " endpoint and rn as a remote endpoint. l & rn should be\n"
210 " swapped on the other peer. l & rn must be private\n"
211 " addresses outside of the subnets used by either peer.\n"
212 " TAP: configure device to use IP address l as a local\n"
213 " endpoint and rn as a subnet mask.\n"
214 "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
215 " endpoint (as a /64) and r as remote endpoint\n"
216 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
217 " pass --ifconfig parms by environment to scripts.\n"
218 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
219 " connection doesn't match the remote side.\n"
220#ifdef TARGET_LINUX
221 "--route-table table_id : Specify a custom routing table for use with --route(-ipv6).\n"
222 " If not specified, the id of the default routing table will be used.\n"
223#endif
224 "--route network [netmask] [gateway] [metric] :\n"
225 " Add route to routing table after connection\n"
226 " is established. Multiple routes can be specified.\n"
227 " netmask default: 255.255.255.255\n"
228 " gateway default: taken from --route-gateway or --ifconfig\n"
229 " Specify default by leaving blank or setting to \"default\".\n"
230 "--route-ipv6 network/bits [gateway] [metric] :\n"
231 " Add IPv6 route to routing table after connection\n"
232 " is established. Multiple routes can be specified.\n"
233 " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
234 " in --ifconfig-ipv6\n"
235 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
236 "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
237 "--route-metric m : Specify a default metric for use with --route.\n"
238 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
239 " adding routes (may be 0). If not specified, routes will\n"
240 " be added immediately after tun/tap open. On Windows, wait\n"
241 " up to w seconds for TUN/TAP adapter to come up.\n"
242 "--route-up cmd : Run command cmd after routes are added.\n"
243 "--route-pre-down cmd : Run command cmd before routes are removed.\n"
244 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
245 " --route-up script using environmental variables.\n"
246 "--route-nopull : When used with --client or --pull, accept options pushed\n"
247 " by server EXCEPT for routes, dns, and dhcp options.\n"
248 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
249 " --ifconfig, --route, and --route-gateway.\n"
250 "--redirect-gateway [flags]: Automatically execute routing\n"
251 " commands to redirect all outgoing IP traffic through the\n"
252 " VPN. Add 'local' flag if both " PACKAGE_NAME " servers are directly\n"
253 " connected via a common subnet, such as with WiFi.\n"
254 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
255 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
256 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
257 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
258 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
259 " the default gateway. Useful when pushing private subnets.\n"
260 "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
261 " ICMPv6 host unreachable messages on the client.\n"
262 " (Server) Instead of forwarding IPv6 packets send\n"
263 " ICMPv6 host unreachable packets to the client.\n"
264 "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
265 "--push-peer-info : (client only) push client info to server.\n"
266 "--setenv name value : Set a custom environmental variable to pass to script.\n"
267 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
268 " directives for future OpenVPN versions to be ignored.\n"
269 "--ignore-unknown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
270 " these options to be ignored when unknown\n"
271 "--script-security level: Where level can be:\n"
272 " 0 -- strictly no calling of external programs\n"
273 " 1 -- (default) only call built-ins such as ifconfig\n"
274 " 2 -- allow calling of built-ins and scripts\n"
275 " 3 -- allow password to be passed to scripts via env\n"
276 "--shaper n : Restrict output to peer to n bytes per second.\n"
277 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
278 " ping once every n seconds, restart if ping not received\n"
279 " for m seconds.\n"
280 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
281 " produces a combined in/out byte count < bytes.\n"
282 "--session-timeout n: Limit connection time to n seconds.\n"
283 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
284 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
285 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
286 " remote address.\n"
287 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
288#if ENABLE_IP_PKTINFO
289 "--multihome : Configure a multi-homed UDP server.\n"
290#endif
291 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
292 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
293 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
294 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
295#if PASSTOS_CAPABILITY
296 "--passtos : TOS passthrough (applies to IPv4 only).\n"
297#endif
298 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
299 " TCP/UDP MTU from it (default=%d).\n"
300 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
301 " as n bytes more than the tun-mtu size on read\n"
302 " (default TUN=0 TAP=%d).\n"
303 "--tun-mtu-max n : Maximum pushable MTU (default and minimum=%d).\n"
304 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
305 " from it.\n"
306 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
307 " 'no' -- Never send DF (Don't Fragment) frames\n"
308 " 'maybe' -- Use per-route hints\n"
309 " 'yes' -- Always DF (Don't Fragment)\n"
310 "--mtu-test : Empirically measure and report MTU.\n"
311#ifdef ENABLE_FRAGMENT
312 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
313 " datagrams are sent which are larger than max bytes.\n"
314 " Adds 4 bytes of overhead per datagram.\n"
315#endif
316 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
317 " or --fragment max value, whichever is lower.\n"
318 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
319 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
320#if defined(TARGET_LINUX)
321 "--mark value : Mark encrypted packets being sent with value. The mark value\n"
322 " can be matched in policy routing and packetfilter rules.\n"
323 "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
324 " listening for connections. This allows sending encrypted packets\n"
325 " via a VRF present on the system.\n"
326#endif
327 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
328 "--mlock : Disable Paging -- ensures key material and tunnel\n"
329 " data will never be written to disk.\n"
330 "--up cmd : Run command cmd after successful tun device open.\n"
331 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
332 " ifconfig-local-ip ifconfig-remote-ip\n"
333 " (pre --user or --group UID/GID change)\n"
334 "--up-delay : Delay tun/tap open and possible --up script execution\n"
335 " until after TCP/UDP connection establishment with peer.\n"
336 "--down cmd : Run command cmd after tun device close.\n"
337 " (post --user/--group UID/GID change and/or --chroot)\n"
338 " (command parameters are same as --up option)\n"
339 "--down-pre : Run --down command before TUN/TAP close.\n"
340 "--up-restart : Run up/down commands for all restarts including those\n"
341 " caused by --ping-restart or SIGUSR1\n"
342 "--user user : Set UID to user after initialization.\n"
343 "--group group : Set GID to group after initialization.\n"
344 "--chroot dir : Chroot to this directory after initialization.\n"
345#ifdef ENABLE_SELINUX
346 "--setcon context: Apply this SELinux context after initialization.\n"
347#endif
348 "--cd dir : Change to this directory before initialization.\n"
349 "--daemon [name] : Become a daemon after initialization.\n"
350 " The optional 'name' parameter will be passed\n"
351 " as the program name to the system logger.\n"
352 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
353 " See --daemon above for a description of the 'name' parm.\n"
354 "--log file : Output log to file which is created/truncated on open.\n"
355 "--log-append file : Append log to file, or create file if nonexistent.\n"
356 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
357 "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
358 "--writepid file : Write main process ID to file.\n"
359 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
360 "--echo [parms ...] : Echo parameters to log output.\n"
361 "--verb n : Set output verbosity to n (default=%d):\n"
362 " (Level 3 is recommended if you want a good summary\n"
363 " of what's happening without being swamped by output).\n"
364 " : 0 -- no output except fatal errors\n"
365 " : 1 -- startup info + connection initiated messages +\n"
366 " non-fatal encryption & net errors\n"
367 " : 2,3 -- show TLS negotiations & route info\n"
368 " : 4 -- show parameters\n"
369 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
370 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
371 " : 6 to 11 -- debug messages of increasing verbosity\n"
372 "--mute n : Log at most n consecutive messages in the same category.\n"
373 "--status file [n] : Write operational status to file every n seconds.\n"
374 "--status-version [n] : Choose the status file format version number.\n"
375 " Currently, n can be 1, 2, or 3 (default=1).\n"
376 "--disable-occ : (DEPRECATED) Disable options consistency check between peers.\n"
377#ifdef ENABLE_DEBUG
378 "--gremlin mask : Special stress testing mode (for debugging only).\n"
379#endif
380#if defined(USE_COMP)
381 "--compress alg : Use compression algorithm alg\n"
382 "--allow-compression: Specify whether compression should be allowed\n"
383#if defined(ENABLE_LZO)
384 "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
385 " packet for incompressible data.\n"
386 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
387 " is specified.\n"
388#endif
389#endif
390#ifdef ENABLE_MANAGEMENT
391 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
392 " management functions. pass is a password file\n"
393 " or 'stdin' to prompt from console.\n"
394#if UNIX_SOCK_SUPPORT
395 " To listen on a unix domain socket, specific the pathname\n"
396 " in place of ip and use 'unix' as the port number.\n"
397#endif
398 "--management-client : Management interface will connect as a TCP client to\n"
399 " ip/port rather than listen as a TCP server.\n"
400 "--management-query-passwords : Query management channel for private key\n"
401 " and auth-user-pass passwords.\n"
402 "--management-query-proxy : Query management channel for proxy information.\n"
403 "--management-query-remote : Query management channel for --remote directive.\n"
404 "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n"
405 " of the management interface explicitly starts it.\n"
406 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
407 "--management-forget-disconnect : Forget passwords when management disconnect\n"
408 " event occurs.\n"
409 "--management-up-down : Report tunnel up/down events to management interface.\n"
410 "--management-log-cache n : Cache n lines of log file history for usage\n"
411 " by the management channel.\n"
412#if UNIX_SOCK_SUPPORT
413 "--management-client-user u : When management interface is a unix socket, only\n"
414 " allow connections from user u.\n"
415 "--management-client-group g : When management interface is a unix socket, only\n"
416 " allow connections from group g.\n"
417#endif
418 "--management-client-auth : gives management interface client the responsibility\n"
419 " to authenticate clients after their client certificate\n"
420 " has been verified.\n"
421#endif /* ifdef ENABLE_MANAGEMENT */
422#ifdef ENABLE_PLUGIN
423 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
424 " to its initialization function.\n"
425#endif
426 "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
427 "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
428 "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
429 "\n"
430 "Multi-Client Server options (when --mode server is used):\n"
431 "--server network netmask : Helper option to easily configure server mode.\n"
432 "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
433 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
434 " easily configure ethernet bridging server mode.\n"
435 "--push \"option\" : Push a config file option back to the peer for remote\n"
436 " execution. Peer must specify --pull in its config file.\n"
437 "--push-reset : Don't inherit global push list for specific\n"
438 " client instance.\n"
439 "--push-remove opt : Remove options matching 'opt' from the push list for\n"
440 " a specific client instance.\n"
441 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
442 " to be dynamically allocated to connecting clients.\n"
443 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
444 " data to file, at seconds intervals (default=600).\n"
445 " If seconds=0, file will be treated as read-only.\n"
446 "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
447 " to be dynamically allocated to connecting clients.\n"
448 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
449 " overrides --ifconfig-pool dynamic allocation.\n"
450 " Only valid in a client-specific config file.\n"
451 "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
452 " remote, overrides --ifconfig-ipv6-pool allocation.\n"
453 " Only valid in a client-specific config file.\n"
454 "--iroute network [netmask] : Route subnet to client.\n"
455 "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
456 " Sets up internal routes only.\n"
457 " Only valid in a client-specific config file.\n"
458 "--disable : Client is disabled.\n"
459 " Only valid in a client-specific config file.\n"
460 "--override-username: Overrides the client-specific username to be used.\n"
461 " Only valid in a client-specific config file.\n"
462 "--verify-client-cert [none|optional|require] : perform no, optional or\n"
463 " mandatory client certificate verification.\n"
464 " Default is to require the client to supply a certificate.\n"
465 "--username-as-common-name : For auth-user-pass authentication, use\n"
466 " the authenticated username as the common name,\n"
467 " rather than the common name from the client cert.\n"
468 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
469 " run command cmd to verify. If method='via-env', pass\n"
470 " user/pass via environment, if method='via-file', pass\n"
471 " user/pass via temporary file.\n"
472 "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
473 " to each client, replacing the password. Useful when\n"
474 " OTP based two-factor auth mechanisms are in use and\n"
475 " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
476 " for generated tokens can be set.\n"
477 "--auth-user-pass-optional : Allow connections by clients that don't\n"
478 " specify a username/password.\n"
479 "--client-to-client : Internally route client-to-client traffic.\n"
480 "--duplicate-cn : Allow multiple clients with the same common name to\n"
481 " concurrently connect.\n"
482 "--client-connect cmd : Run command cmd on client connection.\n"
483 "--client-disconnect cmd : Run command cmd on client disconnection.\n"
484 "--client-config-dir dir : Directory for custom client config files.\n"
485 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
486 "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
487 "--hash-size r v : Set the size of the real address hash table to r and the\n"
488 " virtual address table to v.\n"
489 "--bcast-buffers n : Allocate n broadcast buffers.\n"
490 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
491 "--tcp-nodelay : In server mode, push TCP_NODELAY to clients (it is\n"
492 " enabled by default on the local socket).\n"
493 "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
494 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
495 "--connect-freq-initial n s : Allow a maximum of n replies for initial connections attempts per s seconds.\n"
496 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
497 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
498 "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
499 " older than n seconds. Run this check every t\n"
500 " seconds (defaults to n).\n"
501 "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
502 " clients. n = 1 - reconnect to same server,\n"
503 " 2 - advance to next server, default=1.\n"
504#if PORT_SHARE
505 "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
506 " sessions to a web server at host:port. dir specifies an\n"
507 " optional directory to write origin IP:port data.\n"
508#endif
509 "\n"
510 "Client options (when connecting to a multi-client server):\n"
511 "--client : Helper option to easily configure client mode.\n"
512 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
513 " up is a file containing the username on the first line,\n"
514 " and a password on the second. If either the password or both\n"
515 " the username and the password are omitted OpenVPN will prompt\n"
516 " for them from console. If [up] is 'username-only', only username\n"
517 " will be prompted for from console or management interface.\n"
518 "--pull : Accept certain config file options from the peer as if they\n"
519 " were part of the local config file. Must be specified\n"
520 " when connecting to a '--mode server' remote host.\n"
521 "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
522 " server if it starts with the text t. The action flag accept,\n"
523 " ignore or reject causes the option to be allowed, removed or\n"
524 " rejected with error. May be specified multiple times, and\n"
525 " each filter is applied in the order of appearance.\n"
526 "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
527 " Valid options are :\n"
528 " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n"
529 " resolve-domains <domain> [domain ...] : split domains\n"
530 " dnssec <yes|no|optional> : option to use DNSSEC\n"
531 " transport <DoH|DoT> : query server over HTTPS / TLS\n"
532 " sni <domain> : DNS server name indication\n"
533 "--dns search-domains <domain> [domain ...]:\n"
534 " Add domains to DNS domain search list\n"
535 "--dns-updown cmd|force|disable : Run cmd as user defined dns config command,\n"
536 " force running the default script or disable running it.\n"
537 "--auth-retry t : How to handle auth failures. Set t to\n"
538 " none (default), interact, or nointeract.\n"
539 "--static-challenge t e [<scrv1|concat>]: Enable static challenge/response protocol using\n"
540 " challenge text t, with e indicating echo flag (0|1)\n"
541 " and optional argument scrv1 or concat to use SCRV1 protocol or"
542 " concatenate response with password. Default is scrv1.\n"
543 "--connect-timeout n : when polling possible remote servers to connect to\n"
544 " in a round-robin fashion, spend no more than n seconds\n"
545 " waiting for a response before trying the next server.\n"
546 "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
547 " incoming tun packets with same destination as host.\n"
548 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
549 " server/remote. n = # of retries, default=1.\n"
550 "\n"
551 "Data Channel Encryption Options (must be compatible between peers):\n"
552 "(These options are meaningful for both Static Key & TLS-mode)\n"
553 "--auth alg : Authenticate packets with HMAC using message\n"
554 " digest algorithm alg (default=%s).\n"
555 " (usually adds 16 or 20 bytes per packet)\n"
556 " Set alg=none to disable authentication.\n"
557 "--cipher alg : Encrypt packets with cipher algorithm alg.\n"
558 " You should usually use --data-ciphers instead.\n"
559 " Set alg=none to disable encryption.\n"
560 "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
561#ifndef ENABLE_CRYPTO_MBEDTLS
562 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
563#endif
564 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
565 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
566 " and a time window of t seconds.\n"
567 " Default n=%d t=%d\n"
568 "--replay-persist file : Persist replay-protection state across sessions\n"
569 " using file.\n"
570 "--test-crypto : Run a self-test of crypto features enabled.\n"
571 " For debugging only.\n"
572 "\n"
573 "TLS Key Negotiation Options:\n"
574 "(These options are meaningful only for TLS-mode)\n"
575 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
576 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
577 "--ca file : Certificate authority file in .pem format containing\n"
578 " root certificate.\n"
579#ifndef ENABLE_CRYPTO_MBEDTLS
580 "--capath dir : A directory of trusted certificates (CAs"
581 " and CRLs).\n"
582#endif /* ENABLE_CRYPTO_MBEDTLS */
583 "--dh file : File containing Diffie Hellman parameters\n"
584 " in .pem format (for --tls-server only).\n"
585 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
586 "--cert file : Local certificate in .pem format or a URI -- must be signed\n"
587 " by a Certificate Authority in --ca file used by the peer.\n"
588 "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
589 "--key file : Local private key in .pem format or a URI.\n"
590 "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
591 " will accept from the peer. If version is unrecognized and 'or-highest'\n"
592 " is specified, require max TLS version supported by SSL implementation.\n"
593 "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
594#ifndef ENABLE_CRYPTO_MBEDTLS
595 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
596 " and optionally the root CA certificate.\n"
597 "--x509-username-field : Field in x509 certificate containing the username.\n"
598 " Default is CN in the Subject field.\n"
599#endif
600 "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
601 " Valid algo flags are SHA1 and SHA256. \n"
602#ifdef _WIN32
603 "--cryptoapicert select-string : Load the certificate and private key from the\n"
604 " Windows Certificate System Store.\n"
605#endif
606 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
607 "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites separated by : (optional)\n"
608 " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
609 "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
610 " (default=legacy).\n"
611#ifndef ENABLE_CRYPTO_MBEDTLS
612 "--providers l : A list l of OpenSSL providers to load.\n"
613#endif
614 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
615 " if no ACK from remote within n seconds (default=%d).\n"
616 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
617 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
618 "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
619 " and at least min (defaults to 90%% of max on servers and equal\n"
620 " to max on clients).\n"
621 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
622 " of handshake initiation by any peer (default=%d).\n"
623 "--tran-window n : Transition window -- old key can live this many seconds\n"
624 " after new key renegotiation begins (default=%d).\n"
625 "--single-session: Allow only one session (reset state on restart).\n"
626 "--tls-exit : Exit on TLS negotiation failure.\n"
627 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
628 " control channel to protect against attacks on the TLS stack\n"
629 " and DoS attacks.\n"
630 " f (required) is a shared-secret key file.\n"
631 " The optional d parameter controls key directionality.\n"
632 "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
633 " of the TLS control channel to hide the TLS certificate,\n"
634 " provide basic post-quantum security and protect against\n"
635 " attacks on the TLS stack and DoS attacks.\n"
636 " key (required) provides the pre-shared key file.\n"
637 "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
638 " For servers: use key to decrypt client-specific keys. For\n"
639 " key generation (--genkey tls-crypt-v2-client): use key to\n"
640 " encrypt generated client-specific key. (See --tls-crypt.)\n"
641 "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
642 " fresh tls-crypt-v2 client key, and store to\n"
643 " keyfile. If supplied, include metadata in wrapped key.\n"
644 "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
645 " fresh tls-crypt-v2 server key, and store to keyfile\n"
646 "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
647 " client-supplied tls-crypt-v2 client key\n"
648 "--tls-crypt-v2-max-age n : Only accept tls-crypt-v2 client keys that have a\n"
649 " timestamp which is at most n days old.\n"
650 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
651 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
652 "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
653 "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
654 " pending TLS connection that has otherwise passed all other\n"
655 " tests of certification. cmd should return 0 to allow\n"
656 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
657 " executed as 'cmd certificate_depth subject')\n"
658 "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
659 " DN name. The remote host must also pass all other tests\n"
660 " of verification.\n"
661#ifndef ENABLE_CRYPTO_MBEDTLS
662 "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
663 " an explicit nsCertType designation t = 'client' | 'server'.\n"
664#endif
665 "--x509-track x : Save peer X509 attribute x in environment for use by\n"
666 " plugins and management interface.\n"
667 "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
668 " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
669 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
670 " explicit key usage, you can specify more than one value.\n"
671 " value should be given in hex format.\n"
672 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
673 " explicit extended key usage. Extended key usage can be encoded\n"
674 " as an object identifier or OpenSSL string representation.\n"
675 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
676 " key usage and extended key usage based on RFC3280 TLS rules.\n"
677 " t = 'client' | 'server'.\n"
678#ifdef ENABLE_PKCS11
679 "\n"
680 "PKCS#11 Options:\n"
681 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
682 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
683 " path. Set for each provider.\n"
684 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
685 " 0 : Try to determine automatically (default).\n"
686 " 1 : Use Sign.\n"
687 " 2 : Use SignRecover.\n"
688 " 4 : Use Decrypt.\n"
689 " 8 : Use Unwrap.\n"
690 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
691 " certificate can be accessed. Set for each provider.\n"
692 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
693 " cache until token is removed.\n"
694 "--pkcs11-id-management : Acquire identity from management interface.\n"
695 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
696#endif /* ENABLE_PKCS11 */
697 "\n"
698 "SSL Library information:\n"
699 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
700 "--show-digests : Show message digest algorithms to use with --auth option.\n"
701 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
702 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
703#ifdef _WIN32
704 "\n"
705 "Windows Specific:\n"
706 "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
707 " from SystemRoot environment variable.\n"
708 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
709 " IP address using method = manual, netsh, ipapi,\n"
710 " dynamic, or adaptive (default = adaptive).\n"
711 " Dynamic method allows two optional parameters:\n"
712 " offset: DHCP server address offset (> -256 and < 256).\n"
713 " If 0, use network address, if >0, take nth\n"
714 " address forward from network address, if <0,\n"
715 " take nth address backward from broadcast\n"
716 " address.\n"
717 " Default is 0.\n"
718 " lease-time: Lease time in seconds.\n"
719 " Default is one year.\n"
720 "--route-method : Which method to use for adding routes on Windows?\n"
721 " adaptive (default) -- Try ipapi then fall back to exe.\n"
722 " ipapi -- Use IP helper API.\n"
723 " exe -- Call the route.exe shell command.\n"
724 "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
725 " be used with --ip-win32 dynamic. For options\n"
726 " which allow multiple addresses,\n"
727 " --dhcp-option must be repeated.\n"
728 " DOMAIN name : Set DNS suffix\n"
729 " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
730 " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
731 " NTP : Set NTP server address(es)\n"
732 " NBDD : Set NBDD server address(es)\n"
733 " WINS addr : Set WINS server address(es)\n"
734 " NBT type : Set NetBIOS over TCP/IP Node type\n"
735 " 1: B, 2: P, 4: M, 8: H\n"
736 " NBS id : Set NetBIOS scope ID\n"
737 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
738 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
739 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
740 " startup.\n"
741 "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
742 " on connection initiation.\n"
743 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
744 " attempting to set adapter properties.\n"
745 "--pause-exit : When run from a console window, pause before exiting.\n"
746 "--service ex [0|1] : For use when " PACKAGE_NAME " is being instantiated by a\n"
747 " service, and should not be used directly by end-users.\n"
748 " ex is the name of an event object which, when\n"
749 " signaled, will cause " PACKAGE_NAME " to exit. A second\n"
750 " optional parameter controls the initial state of ex.\n"
751 "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n"
752 " after TAP adapter is up and routes have been added.\n"
753 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
754 "Windows Standalone Options:\n"
755 "\n"
756 "--show-adapters : Show all TAP-Windows adapters.\n"
757 "--show-net : Show " PACKAGE_NAME "'s view of routing table and net adapter list.\n"
758 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
759 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME " running without admin privileges\n"
760 " to access TAP adapter.\n"
761#endif /* ifdef _WIN32 */
762 "\n"
763 "Generate a new key :\n"
764 "--genkey tls-auth file : Generate a new random key of type and write to file\n"
765 " (for use with --tls-auth or --tls-crypt)."
766#ifdef ENABLE_FEATURE_TUN_PERSIST
767 "\n"
768 "Tun/tap config mode:\n"
769 "--mktun : Create a persistent tunnel.\n"
770 "--rmtun : Remove a persistent tunnel.\n"
771 "--dev tunX|tapX : tun/tap device\n"
772 "--dev-type dt : Device type. See tunnel options above for details.\n"
773 "--user user : User to set privilege to.\n"
774 "--group group : Group to set privilege to.\n"
775#endif
776#ifdef ENABLE_PKCS11
777 "\n"
778 "PKCS#11 standalone options:\n"
779#ifdef DEFAULT_PKCS11_MODULE
780 "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
781#else
782 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
783#endif
784 " --verb option can be added *BEFORE* this.\n"
785#endif /* ENABLE_PKCS11 */
786 "\n"
787 "General Standalone Options:\n"
788#ifdef ENABLE_DEBUG
789 "--show-gateway [address]: Show info about gateway [to v4/v6 address].\n"
790#endif
791 ;
792
793#endif /* !ENABLE_SMALL */
794
795/*
796 * This is where the options defaults go.
797 * Any option not explicitly set here
798 * will be set to 0.
799 */
800void
801init_options(struct options *o)
802{
803 CLEAR(*o);
804 gc_init(&o->gc);
805 gc_init(&o->dns_options.gc);
806
807 o->mode = MODE_POINT_TO_POINT;
808 o->dev = "tun";
809 o->topology = TOP_UNDEF;
810 o->ce.proto = PROTO_UDP;
811 o->ce.af = AF_UNSPEC;
812 o->ce.bind_ipv6_only = false;
813 o->ce.connect_retry_seconds = 1;
814 o->ce.connect_retry_seconds_max = 300;
815 o->ce.connect_timeout = 120;
816 o->connect_retry_max = 0;
817 o->ce.local_port = o->ce.remote_port = OPENVPN_PORT;
818 o->verbosity = 1;
819 o->status_file_update_freq = 60;
820 o->status_file_version = 1;
821 o->ce.bind_local = true;
822 o->ce.tun_mtu = TUN_MTU_DEFAULT;
823 o->ce.occ_mtu = 0;
824 o->ce.link_mtu = LINK_MTU_DEFAULT;
825 o->ce.tls_mtu = TLS_MTU_DEFAULT;
826 o->ce.mtu_discover_type = -1;
827 o->ce.mssfix = 0;
828 o->ce.mssfix_default = true;
829 o->ce.mssfix_encap = true;
830 o->route_default_table_id = 0;
831 o->route_delay_window = 30;
832 o->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
833 o->resolve_in_advance = false;
834 o->proto_force = -1;
835 o->occ = true;
836#ifdef ENABLE_MANAGEMENT
837 o->management_log_history_cache = 250;
838 o->management_echo_buffer_size = 100;
839 o->management_state_buffer_size = 100;
840#endif
841#ifdef ENABLE_FEATURE_TUN_PERSIST
842 o->persist_mode = 1;
843#endif
844#ifdef _WIN32
845#if 0
846 o->tuntap_options.ip_win32_type = IPW32_SET_ADAPTIVE;
847#else
848 o->tuntap_options.ip_win32_type = IPW32_SET_DHCP_MASQ;
849#endif
850 o->tuntap_options.dhcp_lease_time = 31536000; /* one year */
851 /* use network address as internal DHCP server address */
852 o->tuntap_options.dhcp_masq_offset = 0;
853 o->route_method = ROUTE_METHOD_ADAPTIVE;
854 o->block_outside_dns = false;
855 o->windows_driver = WINDOWS_DRIVER_UNSPECIFIED;
856#endif
857 o->vlan_accept = VLAN_ALL;
858 o->vlan_pvid = 1;
859 o->n_bcast_buf = 256;
860 o->tcp_queue_limit = 64;
861 o->max_clients = 1024;
862 o->cf_initial_per = 10;
863 o->cf_initial_max = 100;
864 o->max_routes_per_client = 256;
865 o->stale_routes_check_interval = 0;
866 o->ifconfig_pool_persist_refresh_freq = 600;
867 o->scheduled_exit_interval = 5;
868 o->authname = "SHA1";
869 o->replay_window = DEFAULT_SEQ_BACKTRACK;
870 o->replay_time = DEFAULT_TIME_BACKTRACK;
871 o->key_direction = KEY_DIRECTION_BIDIRECTIONAL;
872 o->tls_timeout = 2;
873 o->renegotiate_bytes = -1;
874 o->renegotiate_seconds = 3600;
875 o->renegotiate_seconds_min = -1;
876 o->handshake_window = 60;
877 o->transition_window = 3600;
878 o->tls_cert_profile = NULL;
879 o->ecdh_curve = NULL;
880 o->x509_username_field[0] = X509_USERNAME_FIELD_DEFAULT;
881#ifdef ENABLE_PKCS11
882 o->pkcs11_pin_cache_period = -1;
883#endif /* ENABLE_PKCS11 */
884
885 /* P2MP server context features */
886 o->auth_token_generate = false;
887
888 /* Set default --tmp-dir */
889 o->tmp_dir = platform_get_tmp_dir();
890
891 o->allow_recursive_routing = false;
892
893#ifndef ENABLE_DCO
894 o->disable_dco = true;
895#endif /* ENABLE_DCO */
896
897#ifdef ENABLE_DNS_UPDOWN_BY_DEFAULT
898 o->dns_options.updown = DEFAULT_DNS_UPDOWN;
899#endif /* ENABLE_DNS_UPDOWN_BY_DEFAULT */
900}
901
902void
903uninit_options(struct options *o)
904{
905 if (o->connection_list)
906 {
907 CLEAR(*o->connection_list);
908 }
909 if (o->remote_list)
910 {
911 CLEAR(*o->remote_list);
912 }
913
914 gc_free(&o->gc);
915 gc_free(&o->dns_options.gc);
916}
917
918static void
919setenv_connection_entry(struct env_set *es, const struct connection_entry *e, const int i)
920{
921 setenv_str_i(es, "remote", e->remote, i);
922 setenv_str_i(es, "remote_port", e->remote_port, i);
923
924 if (e->http_proxy_options)
925 {
926 setenv_str_i(es, "http_proxy_server", e->http_proxy_options->server, i);
927 setenv_str_i(es, "http_proxy_port", e->http_proxy_options->port, i);
928 }
929 if (e->socks_proxy_server)
930 {
931 setenv_str_i(es, "socks_proxy_server", e->socks_proxy_server, i);
932 setenv_str_i(es, "socks_proxy_port", e->socks_proxy_port, i);
933 }
934}
935
936static void
937setenv_local_entry(struct env_set *es, const struct local_entry *e, const int i)
938{
939 setenv_str_i(es, "proto", proto2ascii(e->proto, AF_UNSPEC, false), i);
940 setenv_str_i(es, "local", e->local, i);
941 setenv_str_i(es, "local_port", e->port, i);
942}
943
944void
945setenv_settings(struct env_set *es, const struct options *o)
946{
947 setenv_str(es, "config", o->config);
948 setenv_int(es, "verb", o->verbosity);
949 setenv_int(es, "daemon", o->daemon);
950 setenv_int(es, "daemon_log_redirect", o->log);
951 setenv_long_long(es, "daemon_start_time", time(NULL));
952 setenv_int(es, "daemon_pid", platform_getpid());
953
954 if (o->connection_list)
955 {
956 int i;
957 for (i = 0; i < o->connection_list->len; ++i)
958 {
959 setenv_connection_entry(es, o->connection_list->array[i], i + 1);
960 }
961 }
962 else
963 {
964 setenv_connection_entry(es, &o->ce, 1);
965 }
966
967 if (o->ce.local_list)
968 {
969 for (int i = 0; i < o->ce.local_list->len; i++)
970 {
971 setenv_local_entry(es, o->ce.local_list->array[i], i + 1);
972 }
973 }
974}
975
976#ifndef _WIN32
977static void
978setenv_foreign_option(struct options *o, const char *option, const char *value, struct env_set *es)
979{
980 struct gc_arena gc = gc_new();
981 struct buffer env_name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
982 struct buffer env_value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
983 bool good = true;
984
985 good &= buf_printf(&env_name, "foreign_option_%d", o->foreign_option_index + 1);
986 if (value)
987 {
988 good &= buf_printf(&env_value, "dhcp-option %s %s", option, value);
989 }
990 else
991 {
992 good &= buf_printf(&env_value, "dhcp-option %s", option);
993 }
994 if (good)
995 {
996 setenv_str(es, BSTR(&env_name), BSTR(&env_value));
997 ++o->foreign_option_index;
998 }
999 else
1000 {
1001 msg(M_WARN, "foreign_option: name/value overflow");
1002 }
1003 gc_free(&gc);
1004}
1005
1006static void
1007delete_all_dhcp_fo(struct options *o, struct env_item **list)
1008{
1009 struct env_item *current, *prev;
1010
1011 ASSERT(list);
1012
1013 for (current = *list, prev = NULL; current != NULL; current = current->next)
1014 {
1015 char *tmp_value = NULL;
1016 if (!strncmp(current->string, "foreign_option_", sizeof("foreign_option_") - 1))
1017 {
1018 tmp_value = strchr(current->string, '=');
1019 if (tmp_value && ++tmp_value)
1020 {
1021 if (!strncmp(tmp_value, "dhcp-option ", sizeof("dhcp-option ") - 1))
1022 {
1023 if (prev)
1024 {
1025 prev->next = current->next;
1026 }
1027 else
1028 {
1029 *list = current->next;
1030 }
1031 o->foreign_option_index--;
1032 }
1033 }
1034 }
1035 prev = current;
1036 }
1037}
1038
1039#endif /* ifndef _WIN32 */
1040
1041static in_addr_t
1042get_ip_addr(const char *ip_string, msglvl_t msglevel, bool *error)
1043{
1044 unsigned int flags = GETADDR_HOST_ORDER;
1045 bool succeeded = false;
1046 in_addr_t ret;
1047
1048 if (msglevel & M_FATAL)
1049 {
1050 flags |= GETADDR_FATAL;
1051 }
1052
1053 ret = getaddr(flags, ip_string, 0, &succeeded, NULL);
1054 if (!succeeded && error)
1055 {
1056 *error = true;
1057 }
1058 return ret;
1059}
1060
1066static char *
1067get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
1068{
1069 const char *end = strchr(addr, '/');
1070 char *ret = NULL;
1071 if (NULL == end)
1072 {
1073 ret = string_alloc(addr, gc);
1074 }
1075 else
1076 {
1077 size_t len = end - addr;
1078 ret = gc_malloc(len + 1, true, gc);
1079 memcpy(ret, addr, len);
1080 }
1081 return ret;
1082}
1083
1084static bool
1085ipv6_addr_safe_hexplusbits(const char *ipv6_prefix_spec)
1086{
1087 return get_ipv6_addr(ipv6_prefix_spec, NULL, NULL, M_WARN);
1088}
1089
1099static struct verify_hash_list *
1100parse_hash_fingerprint(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
1101{
1102 int i = 0;
1103 const char *cp = str;
1104
1105 struct verify_hash_list *ret;
1106 ALLOC_OBJ_CLEAR_GC(ret, struct verify_hash_list, gc);
1107
1108 char term = 0;
1109 unsigned int byte;
1110
1111 while (*cp && i < nbytes)
1112 {
1113 /* valid segments consist of exactly two hex digits, then ':' or EOS */
1114 if (!isxdigit(cp[0]) || !isxdigit(cp[1]) || (cp[2] != ':' && cp[2] != '\0')
1115 || sscanf(cp, "%x", &byte) != 1)
1116 {
1117 msg(msglevel, "format error in hash fingerprint: %s", str);
1118 break;
1119 }
1120
1121 ret->hash[i++] = (uint8_t)byte;
1122
1123 term = cp[2];
1124 if (term == '\0')
1125 {
1126 break;
1127 }
1128 cp += 3;
1129 }
1130 if (i < nbytes)
1131 {
1132 msg(msglevel, "hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes, i,
1133 str);
1134 }
1135 else if (term != '\0')
1136 {
1137 msg(msglevel, "hash fingerprint too long - expected only %d bytes: %s", nbytes, str);
1138 }
1139 return ret;
1140}
1141
1152static struct verify_hash_list *
1153parse_hash_fingerprint_multiline(const char *str, int nbytes, msglvl_t msglevel,
1154 struct gc_arena *gc)
1155{
1156 struct gc_arena gc_temp = gc_new();
1157 char *lines = string_alloc(str, &gc_temp);
1158
1159 struct verify_hash_list *ret = NULL;
1160
1161 const char *line;
1162 while ((line = strsep(&lines, "\n")))
1163 {
1164 /* ignore leading whitespace */
1165 while (isspace(*line))
1166 {
1167 line++;
1168 }
1169 /* skip empty lines and comment lines */
1170 if (strlen(line) == 0 || *line == '#' || *line == ';')
1171 {
1172 continue;
1173 }
1174
1175 struct verify_hash_list *hash = parse_hash_fingerprint(line, nbytes, msglevel, gc);
1176
1177 if (!hash)
1178 {
1179 gc_free(&gc_temp);
1180 return NULL;
1181 }
1182
1183 hash->next = ret;
1184 ret = hash;
1185 }
1186 gc_free(&gc_temp);
1187
1188 return ret;
1189}
1190
1191static void
1192dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, unsigned int *len, msglvl_t msglevel)
1193{
1194 struct in6_addr addr;
1195 if (*len >= N_DHCP_ADDR)
1196 {
1197 msg(msglevel, "--dhcp-option DNS: maximum of %u IPv6 dns servers can be specified",
1198 N_DHCP_ADDR);
1199 }
1200 else if (get_ipv6_addr(parm, &addr, NULL, msglevel))
1201 {
1202 dns6_list[(*len)++] = addr;
1203 }
1204}
1205static void
1206dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, unsigned int *len,
1207 msglvl_t msglevel)
1208{
1209 if (*len >= N_DHCP_ADDR)
1210 {
1211 msg(msglevel, "--dhcp-option %s: maximum of %u %s servers can be specified", name,
1212 N_DHCP_ADDR, name);
1213 }
1214 else
1215 {
1216 if (ip_addr_dotted_quad_safe(parm)) /* FQDN -- IP address only */
1217 {
1218 bool error = false;
1219 const in_addr_t addr = get_ip_addr(parm, msglevel, &error);
1220 if (!error)
1221 {
1222 array[(*len)++] = addr;
1223 }
1224 }
1225 else
1226 {
1227 msg(msglevel, "dhcp-option parameter %s '%s' must be an IP address", name, parm);
1228 }
1229 }
1230}
1231
1232static void
1233option_iroute(struct options *o, const char *network_str, const char *netmask_str,
1234 msglvl_t msglevel)
1235{
1236 struct iroute *ir;
1237
1238 ALLOC_OBJ_GC(ir, struct iroute, &o->gc);
1239 ir->network = getaddr(GETADDR_HOST_ORDER, network_str, 0, NULL, NULL);
1240 ir->netbits = 32; /* host route if no netmask given */
1241
1242 if (netmask_str)
1243 {
1244 const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, netmask_str, 0, NULL, NULL);
1245 ir->netbits = netmask_to_netbits2(netmask);
1246
1247 if (ir->netbits < 0)
1248 {
1249 msg(msglevel, "in --iroute %s %s : Bad network/subnet specification", network_str,
1250 netmask_str);
1251 return;
1252 }
1253 }
1254
1255 ir->next = o->iroutes;
1256 o->iroutes = ir;
1257}
1258
1259static void
1260option_iroute_ipv6(struct options *o, const char *prefix_str, msglvl_t msglevel)
1261{
1262 struct iroute_ipv6 *ir;
1263
1264 ALLOC_OBJ_GC(ir, struct iroute_ipv6, &o->gc);
1265
1266 if (!get_ipv6_addr(prefix_str, &ir->network, &ir->netbits, msglevel))
1267 {
1268 msg(msglevel, "in --iroute-ipv6 %s: Bad IPv6 prefix specification", prefix_str);
1269 return;
1270 }
1271
1272 ir->next = o->iroutes_ipv6;
1273 o->iroutes_ipv6 = ir;
1274}
1275
1276void
1277options_detach(struct options *o)
1278{
1279 /* The options struct carries two gc_arena's (one generic and one specific
1280 * to the DNS settings), which the by-value options
1281 * copy in inherit_context_child()/inherit_context_top() shares with the
1282 * source.
1283 *
1284 * Detach both (i.e. re-initialize them), otherwise child's call of
1285 * gc_free() (or context teardown) would free allocations the source
1286 * context still references, leading to a use-after-free (and subsequent
1287 * double-free).
1288 */
1289 gc_detach(&o->gc);
1290 gc_detach(&o->dns_options.gc);
1291 o->routes = NULL;
1292 o->client_nat = NULL;
1293 clone_push_list(o);
1294}
1295
1296void
1297rol_check_alloc(struct options *options)
1298{
1299 if (!options->routes)
1300 {
1301 options->routes = new_route_option_list(&options->gc);
1302 }
1303}
1304
1305static void
1313
1314static void
1315cnol_check_alloc(struct options *options)
1316{
1317 if (!options->client_nat)
1318 {
1319 options->client_nat = new_client_nat_list(&options->gc);
1320 }
1321}
1322
1323#ifdef ENABLE_MANAGEMENT
1324
1325static struct http_proxy_options *
1326parse_http_proxy_override(const char *server, const char *port, const char *flags,
1327 struct gc_arena *gc)
1328{
1329 if (server && port)
1330 {
1331 struct http_proxy_options *ho;
1332 ALLOC_OBJ_CLEAR_GC(ho, struct http_proxy_options, gc);
1333 ho->server = string_alloc(server, gc);
1334 ho->port = port;
1335 if (flags && !strcmp(flags, "nct"))
1336 {
1337 ho->auth_retry = PAR_NCT;
1338 }
1339 else
1340 {
1341 ho->auth_retry = PAR_ALL;
1342 }
1343 ho->http_version = "1.0";
1344 ho->user_agent = "OpenVPN-Autoproxy/1.0";
1345 return ho;
1346 }
1347 else
1348 {
1349 return NULL;
1350 }
1351}
1352
1353static void
1354options_postprocess_http_proxy_override(struct options *o)
1355{
1356 const struct connection_list *l = o->connection_list;
1357 int i;
1358 bool succeed = false;
1359 for (i = 0; i < l->len; ++i)
1360 {
1361 struct connection_entry *ce = l->array[i];
1362 if (ce->proto == PROTO_TCP_CLIENT || ce->proto == PROTO_TCP)
1363 {
1364 ce->http_proxy_options = o->http_proxy_override;
1365 succeed = true;
1366 }
1367 }
1368 if (succeed)
1369 {
1370 for (i = 0; i < l->len; ++i)
1371 {
1372 struct connection_entry *ce = l->array[i];
1373 if (ce->proto == PROTO_UDP)
1374 {
1375 ce->flags |= CE_DISABLED;
1376 }
1377 }
1378 }
1379 else
1380 {
1381 msg(M_WARN,
1382 "Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
1383 }
1384}
1385
1386#endif /* ifdef ENABLE_MANAGEMENT */
1387
1388static struct local_list *
1389alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
1390{
1391 if (!ce->local_list)
1392 {
1393 ALLOC_OBJ_CLEAR_GC(ce->local_list, struct local_list, gc);
1394 }
1395 return ce->local_list;
1396}
1397
1398static struct local_entry *
1399alloc_local_entry(struct connection_entry *ce, const msglvl_t msglevel, struct gc_arena *gc)
1400{
1401 struct local_list *l = alloc_local_list_if_undef(ce, gc);
1402 struct local_entry *e;
1403
1404 if (l->len >= l->capacity)
1405 {
1406 const int new_cap = l->capacity + 1;
1407 const size_t elem_size = sizeof(*l->array);
1408
1409 struct local_entry **new_array = gc_realloc(l->array, new_cap * elem_size, gc);
1410 if (!new_array)
1411 {
1412 msg(msglevel,
1413 "Unable to process more local options: out of memory. Number of entries = %d",
1414 l->len);
1415 return NULL;
1416 }
1417
1418 l->array = new_array;
1419 l->capacity = new_cap;
1420 }
1421
1422 ALLOC_OBJ_CLEAR_GC(e, struct local_entry, gc);
1423 e->proto = PROTO_NONE;
1424 l->array[l->len++] = e;
1425
1426 return e;
1427}
1428
1429static struct connection_list *
1438
1439static struct connection_entry *
1440alloc_connection_entry(struct options *options, const msglvl_t msglevel)
1441{
1442 struct connection_list *l = alloc_connection_list_if_undef(options);
1443 struct connection_entry *e;
1444
1445 if (l->len == l->capacity)
1446 {
1447 int capacity = l->capacity + CONNECTION_LIST_SIZE;
1448 struct connection_entry **ce =
1449 gc_realloc(l->array, capacity * sizeof(struct connection_entry *), &options->gc);
1450 if (ce == NULL)
1451 {
1452 msg(msglevel,
1453 "Unable to process more connection options: out of memory. Number of entries = %d",
1454 l->len);
1455 return NULL;
1456 }
1457 l->array = ce;
1458 l->capacity = capacity;
1459 }
1460 ALLOC_OBJ_GC(e, struct connection_entry, &options->gc);
1461 l->array[l->len++] = e;
1462 return e;
1463}
1464
1465static struct remote_list *
1466alloc_remote_list_if_undef(struct options *options)
1467{
1468 if (!options->remote_list)
1469 {
1470 ALLOC_OBJ_CLEAR_GC(options->remote_list, struct remote_list, &options->gc);
1471 }
1472 return options->remote_list;
1473}
1474
1475static struct remote_entry *
1476alloc_remote_entry(struct options *options, const msglvl_t msglevel)
1477{
1478 struct remote_list *l = alloc_remote_list_if_undef(options);
1479 struct remote_entry *e;
1480
1481 if (l->len == l->capacity)
1482 {
1483 int capacity = l->capacity + CONNECTION_LIST_SIZE;
1484 struct remote_entry **re =
1485 gc_realloc(l->array, capacity * sizeof(struct remote_entry *), &options->gc);
1486 if (re == NULL)
1487 {
1488 msg(msglevel,
1489 "Unable to process more remote options: out of memory. Number of entries = %d",
1490 l->len);
1491 return NULL;
1492 }
1493 l->array = re;
1494 l->capacity = capacity;
1495 }
1496 ALLOC_OBJ_GC(e, struct remote_entry, &options->gc);
1497 l->array[l->len++] = e;
1498 return e;
1499}
1500
1501static struct pull_filter_list *
1502alloc_pull_filter_list(struct options *o)
1503{
1504 if (!o->pull_filter_list)
1505 {
1506 ALLOC_OBJ_CLEAR_GC(o->pull_filter_list, struct pull_filter_list, &o->gc);
1507 }
1508 return o->pull_filter_list;
1509}
1510
1511static struct pull_filter *
1512alloc_pull_filter(struct options *o)
1513{
1514 struct pull_filter_list *l = alloc_pull_filter_list(o);
1515 struct pull_filter *f;
1516
1517 ALLOC_OBJ_CLEAR_GC(f, struct pull_filter, &o->gc);
1518 if (l->head)
1519 {
1520 ASSERT(l->tail);
1521 l->tail->next = f;
1522 }
1523 else
1524 {
1525 ASSERT(!l->tail);
1526 l->head = f;
1527 }
1528 l->tail = f;
1529 return f;
1530}
1531
1532static void
1533connection_entry_load_re(struct connection_entry *ce, const struct remote_entry *re)
1534{
1535 if (re->remote)
1536 {
1537 ce->remote = re->remote;
1538 }
1539 if (re->remote_port)
1540 {
1541 ce->remote_port = re->remote_port;
1542 }
1543 if (re->proto >= 0)
1544 {
1545 ce->proto = re->proto;
1546 }
1547 if (re->af > 0)
1548 {
1549 ce->af = re->af;
1550 }
1551}
1552
1553static void
1554connection_entry_preload_key(const char **key_file, bool *key_inline, struct gc_arena *gc)
1555{
1556 if (key_file && *key_file && !(*key_inline))
1557 {
1558 struct buffer in = buffer_read_from_file(*key_file, gc);
1559 if (!buf_valid(&in))
1560 {
1561 msg(M_FATAL, "Cannot pre-load keyfile (%s)", *key_file);
1562 }
1563
1564 *key_file = (const char *)in.data;
1565 *key_inline = true;
1566 }
1567}
1568
1569static void
1570check_ca_required(const struct options *options)
1571{
1572#ifdef ENABLE_CRYPTO_MBEDTLS
1573 if (options->ca_path)
1574 {
1575 msg(M_USAGE, "Parameter --capath cannot be used with the mbed TLS version of OpenVPN.");
1576 }
1577#endif
1578
1579 if (options->verify_hash_no_ca || options->pkcs12_file || options->ca_file
1580#ifndef ENABLE_CRYPTO_MBEDTLS
1581 || options->ca_path
1582#endif
1583 )
1584 {
1585 return;
1586 }
1587
1588 const char *const str = "You must define CA file (--ca)"
1589#ifndef ENABLE_CRYPTO_MBEDTLS
1590 " or CA path (--capath)"
1591#endif
1592 " and/or peer fingerprint verification (--peer-fingerprint)";
1593 msg(M_USAGE, "%s", str);
1594}
1595
1596#define MUST_BE_UNDEF(parm, parm_name) \
1597 if (options->parm != defaults.parm) \
1598 { \
1599 msg(M_USAGE, use_err, parm_name); \
1600 }
1601#define MUST_BE_FALSE(condition, parm_name) \
1602 if (condition) \
1603 { \
1604 msg(M_USAGE, use_err, parm_name); \
1605 }
1606
1607static void
1608options_postprocess_verify_ce(const struct options *options, const struct connection_entry *ce)
1609{
1610 struct options defaults;
1611 int dev = DEV_TYPE_UNDEF;
1612 bool pull = false;
1613
1614 init_options(&defaults);
1615
1616 if (!options->test_crypto)
1617 {
1618 notnull(options->dev, "TUN/TAP device (--dev)");
1619 }
1620
1621 /*
1622 * Get tun/tap/null device type
1623 */
1624 dev = dev_type_enum(options->dev, options->dev_type);
1625
1626 /*
1627 * If "proto tcp" is specified, make sure we know whether it is
1628 * tcp-client or tcp-server.
1629 */
1630 if (ce->proto == PROTO_TCP)
1631 {
1632 msg(M_USAGE, "--proto tcp is ambiguous in this context. Please specify "
1633 "--proto tcp-server or --proto tcp-client");
1634 }
1635
1636 /*
1637 * Sanity check on Client mode
1638 */
1639
1640 if (options->mode != MODE_SERVER && ce->local_list->len > 1)
1641 {
1642 msg(M_USAGE, "multiple --local statements only allowed in --server mode");
1643 }
1644
1645 if (options->lladdr && dev != DEV_TYPE_TAP)
1646 {
1647 msg(M_USAGE, "--lladdr can only be used in --dev tap mode");
1648 }
1649
1650 /*
1651 * Sanity check on MTU parameters
1652 */
1653 if (options->ce.tun_mtu_defined && options->ce.link_mtu_defined)
1654 {
1655 msg(M_USAGE, "only one of --tun-mtu or --link-mtu may be defined");
1656 }
1657
1658 if (!proto_is_udp(ce->proto) && options->mtu_test)
1659 {
1660 msg(M_USAGE, "--mtu-test only makes sense with --proto udp");
1661 }
1662
1663 /* will we be pulling options from server? */
1664 pull = options->pull;
1665
1666 /*
1667 * Sanity check on --local, --remote, and --ifconfig
1668 */
1669
1670 if (string_defined_equal(ce->remote, options->ifconfig_local)
1671 || string_defined_equal(ce->remote, options->ifconfig_remote_netmask))
1672 {
1673 msg(M_USAGE, "--local and --remote addresses must be distinct from --ifconfig "
1674 "addresses");
1675 }
1676
1677 if (string_defined_equal(options->ifconfig_local, options->ifconfig_remote_netmask))
1678 {
1679 msg(M_USAGE, "local and remote/netmask --ifconfig addresses must be different");
1680 }
1681
1682 if (ce->bind_defined && !ce->bind_local)
1683 {
1684 msg(M_USAGE, "--bind and --nobind can't be used together");
1685 }
1686
1687 if (ce->local_port_defined && !ce->bind_local)
1688 {
1689 msg(M_USAGE, "--lport and --nobind don't make sense when used together");
1690 }
1691
1692 if (!ce->remote && !ce->bind_local)
1693 {
1694 msg(M_USAGE, "--nobind doesn't make sense unless used with --remote");
1695 }
1696
1697 for (int i = 0; i < ce->local_list->len; i++)
1698 {
1699 const struct local_entry *le = ce->local_list->array[i];
1700
1701 if (proto_is_net(le->proto) && string_defined_equal(le->local, ce->remote)
1702 && string_defined_equal(le->port, ce->remote_port))
1703 {
1704 msg(M_USAGE, "--remote and one of the --local addresses are the same");
1705 }
1706
1707 if (string_defined_equal(le->local, options->ifconfig_local)
1708 || string_defined_equal(le->local, options->ifconfig_remote_netmask))
1709 {
1710 msg(M_USAGE, "--local addresses must be distinct from --ifconfig addresses");
1711 }
1712
1713 if (le->local && !ce->bind_local)
1714 {
1715 msg(M_USAGE, "--local and --nobind don't make sense when used together");
1716 }
1717 }
1718
1719 /*
1720 * Check for consistency of management options
1721 */
1722#ifdef ENABLE_MANAGEMENT
1723 if (!options->management_addr
1724 && (options->management_flags
1725 || options->management_log_history_cache != defaults.management_log_history_cache))
1726 {
1727 msg(M_USAGE,
1728 "--management is not specified, however one or more options which modify the behavior of --management were specified");
1729 }
1730
1731 if ((options->management_client_user || options->management_client_group)
1732 && !(options->management_flags & MF_UNIX_SOCK))
1733 {
1734 msg(M_USAGE, "--management-client-(user|group) can only be used on unix domain sockets");
1735 }
1736
1737 if (options->management_addr && !(options->management_flags & MF_UNIX_SOCK)
1738 && (!options->management_user_pass))
1739 {
1740 msg(M_WARN, "WARNING: Using --management on a TCP port WITHOUT "
1741 "passwords is STRONGLY discouraged and considered insecure");
1742 }
1743
1744#endif /* ifdef ENABLE_MANAGEMENT */
1745
1746#if !defined(HAVE_XKEY_PROVIDER)
1747 if ((tls_version_max() >= TLS_VER_1_3) && (options->management_flags & MF_EXTERNAL_KEY)
1748 && !(options->management_flags & (MF_EXTERNAL_KEY_NOPADDING)))
1749 {
1750 msg(M_FATAL, "management-external-key with TLS 1.3 or later requires "
1751 "nopadding argument/support");
1752 }
1753#endif
1754 /*
1755 * Windows-specific options.
1756 */
1757
1758#ifdef _WIN32
1759 if (dev == DEV_TYPE_TUN
1760 && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask)))
1761 {
1762 msg(M_USAGE, "On Windows, --ifconfig is required when --dev tun is used");
1763 }
1764
1765 if ((options->tuntap_options.ip_win32_defined)
1766 && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask)))
1767 {
1768 msg(M_USAGE, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
1769 }
1770
1771 if (options->tuntap_options.dhcp_options & DHCP_OPTIONS_DHCP_REQUIRED)
1772 {
1773 const char *prefix = "Some --dhcp-option or --dns options require DHCP server";
1774 if (options->windows_driver != WINDOWS_DRIVER_TAP_WINDOWS6)
1775 {
1776 msg(M_USAGE, "%s, which is not supported by the selected %s driver", prefix,
1777 print_tun_backend_driver(options->windows_driver));
1778 }
1779 else if (options->tuntap_options.ip_win32_type != IPW32_SET_DHCP_MASQ
1780 && options->tuntap_options.ip_win32_type != IPW32_SET_ADAPTIVE)
1781 {
1782 msg(M_USAGE, "%s, which requires --ip-win32 dynamic or adaptive", prefix);
1783 }
1784 }
1785#endif /* ifdef _WIN32 */
1786
1787 /*
1788 * Check that protocol options make sense.
1789 */
1790
1791#ifdef ENABLE_FRAGMENT
1792 if (!proto_is_udp(ce->proto) && ce->fragment)
1793 {
1794 msg(M_USAGE, "--fragment can only be used with --proto udp");
1795 }
1796#endif
1797
1798 if (!ce->remote && ce->proto == PROTO_TCP_CLIENT)
1799 {
1800 msg(M_USAGE, "--remote MUST be used in TCP Client mode");
1801 }
1802
1803 if ((ce->http_proxy_options) && ce->proto != PROTO_TCP_CLIENT)
1804 {
1805 msg(M_USAGE, "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
1806 "tcp-client)");
1807 }
1808
1809 if ((ce->http_proxy_options) && !ce->http_proxy_options->server)
1810 {
1811 msg(M_USAGE, "--http-proxy not specified but other http proxy options present");
1812 }
1813
1814 if (ce->http_proxy_options && ce->socks_proxy_server)
1815 {
1816 msg(M_USAGE, "--http-proxy can not be used together with --socks-proxy");
1817 }
1818
1819 if (ce->socks_proxy_server && ce->proto == PROTO_TCP_SERVER)
1820 {
1821 msg(M_USAGE, "--socks-proxy can not be used in TCP Server mode");
1822 }
1823
1824 if (ce->proto == PROTO_TCP_SERVER && (options->connection_list->len > 1))
1825 {
1826 msg(M_USAGE, "TCP server mode allows at most one --remote address");
1827 }
1828
1829 /*
1830 * Check consistency of --mode server options.
1831 */
1832 if (options->mode == MODE_SERVER)
1833 {
1834 const char use_err[] = "--%s cannot be used with --mode server.";
1835
1836#define USAGE_VALID_SERVER_PROTOS \
1837 "--mode server currently only supports " \
1838 "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
1839#ifdef TARGET_ANDROID
1840 msg(M_FATAL, "--mode server not supported on Android");
1841#endif
1842 if (!(dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP))
1843 {
1844 msg(M_USAGE, "--mode server only works with --dev tun or --dev tap");
1845 }
1846 MUST_BE_UNDEF(pull, "pull");
1847 if (options->pull_filter_list)
1848 {
1849 msg(M_WARN, "--pull-filter ignored for --mode server");
1850 }
1851 if (!(proto_is_udp(ce->proto) || ce->proto == PROTO_TCP_SERVER))
1852 {
1853 msg(M_USAGE, USAGE_VALID_SERVER_PROTOS);
1854 }
1855#if PORT_SHARE
1856 bool has_tcp = false;
1857 for (int i = 0; i < ce->local_list->len && !has_tcp; i++)
1858 {
1859 has_tcp = (ce->local_list->array[i]->proto == PROTO_TCP_SERVER);
1860 }
1861 if ((options->port_share_host || options->port_share_port)
1862 && !has_tcp)
1863 {
1864 msg(M_USAGE, "--port-share only works in TCP server mode "
1865 "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
1866 }
1867#endif
1868 if (!options->tls_server)
1869 {
1870 msg(M_USAGE, "--mode server requires --tls-server");
1871 }
1872 MUST_BE_FALSE(ce->remote, "remote");
1873 MUST_BE_FALSE(!ce->bind_local, "nobind");
1874 MUST_BE_FALSE(ce->http_proxy_options, "http-proxy");
1875 MUST_BE_FALSE(ce->socks_proxy_server, "socks-proxy");
1876 /* <connection> blocks force to have a remote embedded, so we check
1877 * for the --remote and bail out if it is present
1878 */
1879 if (options->connection_list->len > 1 || options->connection_list->array[0]->remote)
1880 {
1881 msg(M_USAGE, "<connection> cannot be used with --mode server");
1882 }
1883
1884 MUST_BE_UNDEF(shaper, "shaper");
1885 if (options->ipchange)
1886 {
1887 msg(M_USAGE, "--ipchange cannot be used with --mode server (use "
1888 "--client-connect instead)");
1889 }
1890 if (!(proto_is_dgram(ce->proto) || ce->proto == PROTO_TCP_SERVER))
1891 {
1892 msg(M_USAGE, USAGE_VALID_SERVER_PROTOS);
1893 }
1894 if (!proto_is_udp(ce->proto) && (options->cf_max || options->cf_per))
1895 {
1896 msg(M_USAGE,
1897 "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
1898 }
1899 if (!(dev == DEV_TYPE_TAP || (dev == DEV_TYPE_TUN && options->topology == TOP_SUBNET))
1900 && options->ifconfig_pool_netmask)
1901 {
1902 msg(M_USAGE,
1903 "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
1904 }
1905 if (options->routes && (options->routes->flags & RG_ENABLE))
1906 {
1907 msg(M_USAGE,
1908 "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
1909 }
1910 MUST_BE_UNDEF(route_delay_defined, "route-delay");
1911 MUST_BE_UNDEF(up_delay, "up-delay");
1912 if (!options->ifconfig_pool_defined && !options->ifconfig_ipv6_pool_defined
1913 && options->ifconfig_pool_persist_filename)
1914 {
1915 msg(M_USAGE,
1916 "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
1917 }
1918 if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local)
1919 {
1920 msg(M_USAGE, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
1921 }
1922 MUST_BE_UNDEF(allow_recursive_routing, "allow-recursive-routing");
1923 if (options->auth_user_pass_file)
1924 {
1925 msg(M_USAGE,
1926 "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
1927 }
1928 if (options->ccd_exclusive && !options->client_config_dir)
1929 {
1930 msg(M_USAGE, "--ccd-exclusive must be used with --client-config-dir");
1931 }
1932 if (options->auth_token_generate && !options->renegotiate_seconds)
1933 {
1934 msg(M_USAGE, "--auth-gen-token needs a non-infinite "
1935 "--renegotiate_seconds setting");
1936 }
1937 if (options->auth_token_generate && options->auth_token_renewal
1938 && options->auth_token_renewal < 2 * options->handshake_window)
1939 {
1940 msg(M_USAGE,
1941 "--auth-gen-token renewal time needs to be at least "
1942 " two times --hand-window (%d).",
1943 options->handshake_window);
1944 }
1945 if (!options->auth_user_pass_verify_script && !PLUGIN_OPTION_LIST(options)
1946 && !MAN_CLIENT_AUTH_ENABLED(options))
1947 {
1948 const char *use_err =
1949 "--%s must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
1950
1951 MUST_BE_FALSE(options->ssl_flags
1952 & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL),
1953 "verify-client-cert none|optional");
1954 MUST_BE_FALSE(options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME,
1955 "username-as-common-name");
1956 MUST_BE_FALSE(options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL,
1957 "auth-user-pass-optional");
1958 }
1959
1960 if (options->vlan_tagging && dev != DEV_TYPE_TAP)
1961 {
1962 msg(M_USAGE, "--vlan-tagging must be used with --dev tap");
1963 }
1964 if (!options->vlan_tagging)
1965 {
1966 const char use_err[] = "--%s requires --vlan-tagging";
1967 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
1968 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
1969 }
1970
1971 if (options->server_flags & SF_TCP_NODELAY_HELPER)
1972 {
1973 msg(M_INFO, "NOTE: TCP_NODELAY is always enabled locally; "
1974 "--tcp-nodelay is now only useful to push the flag to "
1975 "clients older than 2.7.6.");
1976 }
1977 }
1978 else
1979 {
1980 const char use_err[] = "--%s requires --mode server";
1981 /*
1982 * When not in server mode, err if parameters are
1983 * specified which require --mode server.
1984 */
1985 MUST_BE_UNDEF(ifconfig_pool_defined, "ifconfig-pool");
1986 MUST_BE_UNDEF(ifconfig_pool_persist_filename, "ifconfig-pool-persist");
1987 MUST_BE_UNDEF(ifconfig_ipv6_pool_defined, "ifconfig-ipv6-pool");
1988 MUST_BE_UNDEF(real_hash_size, "hash-size");
1989 MUST_BE_UNDEF(virtual_hash_size, "hash-size");
1990 MUST_BE_UNDEF(learn_address_script, "learn-address");
1991 MUST_BE_UNDEF(client_connect_script, "client-connect");
1992 MUST_BE_UNDEF(client_crresponse_script, "client-crresponse");
1993 MUST_BE_UNDEF(client_disconnect_script, "client-disconnect");
1994 MUST_BE_UNDEF(client_config_dir, "client-config-dir");
1995 MUST_BE_UNDEF(ccd_exclusive, "ccd-exclusive");
1996 MUST_BE_UNDEF(enable_c2c, "client-to-client");
1997 MUST_BE_UNDEF(duplicate_cn, "duplicate-cn");
1998 MUST_BE_UNDEF(cf_max, "connect-freq");
1999 MUST_BE_UNDEF(cf_per, "connect-freq");
2000 MUST_BE_FALSE(options->ssl_flags
2001 & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL),
2002 "verify-client-cert");
2003 MUST_BE_FALSE(options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME, "username-as-common-name");
2004 MUST_BE_FALSE(options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL, "auth-user-pass-optional");
2005 if (options->server_flags & SF_TCP_NODELAY_HELPER)
2006 {
2007 msg(M_WARN, "DEPRECATED OPTION: --tcp-nodelay is always enabled on clients");
2008 }
2009 MUST_BE_UNDEF(auth_user_pass_verify_script, "auth-user-pass-verify");
2010 MUST_BE_UNDEF(auth_token_generate, "auth-gen-token");
2011#if PORT_SHARE
2012 if (options->port_share_host || options->port_share_port)
2013 {
2014 msg(M_USAGE,
2015 "--port-share requires TCP server mode (--mode server --proto tcp-server)");
2016 }
2017#endif
2018 MUST_BE_UNDEF(stale_routes_check_interval, "stale-routes-check");
2019 MUST_BE_UNDEF(vlan_tagging, "vlan-tagging");
2020 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
2021 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
2022 MUST_BE_UNDEF(force_key_material_export, "force-key-material-export");
2023
2024 if (options->push_list.head)
2025 {
2026 msg(M_WARN, "Note: Using --push without --mode server is an "
2027 "unsupported configuration. Negotiation of OpenVPN "
2028 "features is expected to fail.");
2029 }
2030 }
2031
2032 /*
2033 * SSL/TLS mode sanity checks.
2034 */
2035 if (options->tls_server + options->tls_client + (options->shared_secret_file != NULL) > 1)
2036 {
2037 msg(M_USAGE, "specify only one of --tls-server, --tls-client, or --secret");
2038 }
2039
2040 if (!options->tls_server && !options->tls_client && !options->test_crypto)
2041 {
2042 msglvl_t msglevel = M_USAGE;
2043 if (options->allow_deprecated_insecure_static_crypto)
2044 {
2045 msglevel = M_INFO;
2046 }
2047
2048 msg(msglevel, "DEPRECATION: No tls-client or tls-server option in "
2049 "configuration detected. OpenVPN 2.8 will remove the "
2050 "functionality to run a VPN without TLS. "
2051 "See the examples section in the manual page for "
2052 "examples of a similar quick setup with peer-fingerprint. "
2053 "OpenVPN 2.7 allows using this configuration when using "
2054 "--allow-deprecated-insecure-static-crypto but you should move "
2055 "to a proper configuration using TLS as soon as possible.");
2056 }
2057
2058 if (options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL))
2059 {
2060 msg(M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
2061 "--verify-client-cert none|optional "
2062 "may accept clients which do not present a certificate");
2063 }
2064
2065 const unsigned int tls_ver_max =
2066 (options->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT) & SSLF_TLS_VERSION_MAX_MASK;
2067 const unsigned int tls_ver_min =
2068 (options->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT) & SSLF_TLS_VERSION_MIN_MASK;
2069
2070 if (tls_ver_max > 0 && tls_ver_max < tls_ver_min)
2071 {
2072 msg(M_USAGE, "--tls-version-min bigger than --tls-version-max");
2073 }
2074
2075 if (options->tls_server || options->tls_client)
2076 {
2077 check_ca_required(options);
2078#ifdef ENABLE_PKCS11
2079 if (!options->pkcs11_providers[0] && options->pkcs11_id)
2080 {
2081 msg(M_WARN, "Option pkcs11-id is ignored as no pkcs11-providers are specified");
2082 }
2083 else if (!options->pkcs11_providers[0] && options->pkcs11_id_management)
2084 {
2085 msg(M_WARN,
2086 "Option pkcs11-id-management is ignored as no pkcs11-providers are specified");
2087 }
2088
2089 if (options->pkcs11_providers[0])
2090 {
2091 if (options->pkcs11_id_management && options->pkcs11_id != NULL)
2092 {
2093 msg(M_USAGE,
2094 "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2095 }
2096 if (!options->pkcs11_id_management && options->pkcs11_id == NULL)
2097 {
2098 msg(M_USAGE,
2099 "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2100 }
2101 const char use_err[] =
2102 "Parameter --%s cannot be used when --pkcs11-provider is also specified.";
2103 MUST_BE_UNDEF(cert_file, "cert");
2104 MUST_BE_UNDEF(priv_key_file, "key");
2105 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2106 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2107 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2108#ifdef ENABLE_CRYPTOAPI
2109 MUST_BE_UNDEF(cryptoapi_cert, "cryptoapicert");
2110#endif
2111 }
2112 else
2113#endif /* ifdef ENABLE_PKCS11 */
2114#ifdef ENABLE_CRYPTOAPI
2115 if (options->cryptoapi_cert)
2116 {
2117 const char use_err[] =
2118 "Parameter --%s cannot be used when --cryptoapicert is also specified.";
2119 MUST_BE_UNDEF(cert_file, "cert");
2120 MUST_BE_UNDEF(priv_key_file, "key");
2121 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2122 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2123 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2124 }
2125 else
2126#endif
2127 if (options->pkcs12_file)
2128 {
2129#ifdef ENABLE_CRYPTO_MBEDTLS
2130 msg(M_USAGE, "Parameter --pkcs12 cannot be used with the mbed TLS version of OpenVPN.");
2131#else
2132 const char use_err[] = "Parameter --%s cannot be used when --pkcs12 is also specified.";
2133 MUST_BE_UNDEF(ca_path, "capath");
2134 MUST_BE_UNDEF(cert_file, "cert");
2135 MUST_BE_UNDEF(priv_key_file, "key");
2136 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2137 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2138#endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2139 }
2140 else /* cert/key from none of pkcs11, pkcs12, cryptoapi */
2141 {
2142 if ((options->management_flags & MF_EXTERNAL_KEY) && options->priv_key_file)
2143 {
2144 msg(M_USAGE, "--key and --management-external-key are mutually exclusive");
2145 }
2146 if ((options->management_flags & MF_EXTERNAL_CERT))
2147 {
2148 if (options->cert_file)
2149 {
2150 msg(M_USAGE, "--cert and --management-external-cert are mutually exclusive");
2151 }
2152 else if (!(options->management_flags & MF_EXTERNAL_KEY))
2153 {
2154 msg(M_USAGE,
2155 "--management-external-cert must be used with --management-external-key");
2156 }
2157 }
2158 if (pull)
2159 {
2160 const int sum =
2161 ((options->cert_file != NULL) || (options->management_flags & MF_EXTERNAL_CERT))
2162 + ((options->priv_key_file != NULL)
2163 || (options->management_flags & MF_EXTERNAL_KEY));
2164
2165 if (sum == 0)
2166 {
2167 if (!options->auth_user_pass_file)
2168 {
2169 msg(M_USAGE, "No client-side authentication method is "
2170 "specified. You must use either "
2171 "--cert/--key, --pkcs12, or "
2172 "--auth-user-pass");
2173 }
2174 }
2175 else if (sum != 2)
2176 {
2177 msg(M_USAGE, "If you use one of --cert or --key, you must use them both");
2178 }
2179 }
2180 else
2181 {
2182 if (!(options->management_flags & MF_EXTERNAL_CERT))
2183 {
2184 notnull(options->cert_file,
2185 "certificate file (--cert) or PKCS#12 file (--pkcs12)");
2186 }
2187 if (!(options->management_flags & MF_EXTERNAL_KEY))
2188 {
2189 notnull(options->priv_key_file,
2190 "private key file (--key) or PKCS#12 file (--pkcs12)");
2191 }
2192 }
2193 }
2194 if (ce->tls_auth_file && ce->tls_crypt_file)
2195 {
2196 msg(M_USAGE, "--tls-auth and --tls-crypt are mutually exclusive");
2197 }
2198 if (options->tls_client && ce->tls_crypt_v2_file
2199 && (ce->tls_auth_file || ce->tls_crypt_file))
2200 {
2201 msg(M_USAGE,
2202 "--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
2203 }
2204 }
2205 else
2206 {
2207 /*
2208 * Make sure user doesn't specify any TLS options
2209 * when in non-TLS mode.
2210 */
2211
2212 const char use_err[] = "Parameter %s can only be specified in TLS-mode, "
2213 "i.e. where --tls-server or --tls-client is also specified.";
2214
2215 MUST_BE_UNDEF(ca_file, "ca");
2216 MUST_BE_UNDEF(ca_path, "capath");
2217 MUST_BE_UNDEF(dh_file, "dh");
2218 MUST_BE_UNDEF(cert_file, "cert");
2219 MUST_BE_UNDEF(priv_key_file, "key");
2220#ifndef ENABLE_CRYPTO_MBEDTLS
2221 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2222#endif
2223 MUST_BE_UNDEF(cipher_list, "tls-cipher");
2224 MUST_BE_UNDEF(cipher_list_tls13, "tls-ciphersuites");
2225 MUST_BE_UNDEF(tls_cert_profile, "tls-cert-profile");
2226 MUST_BE_UNDEF(tls_verify, "tls-verify");
2227 MUST_BE_UNDEF(tls_export_peer_cert_dir, "tls-export-cert");
2228 MUST_BE_UNDEF(verify_x509_name, "verify-x509-name");
2229 MUST_BE_UNDEF(tls_timeout, "tls-timeout");
2230 MUST_BE_UNDEF(renegotiate_bytes, "reneg-bytes");
2231 MUST_BE_UNDEF(renegotiate_packets, "reneg-pkts");
2232 MUST_BE_UNDEF(renegotiate_seconds, "reneg-sec");
2233 MUST_BE_UNDEF(handshake_window, "hand-window");
2234 MUST_BE_UNDEF(transition_window, "tran-window");
2235 MUST_BE_UNDEF(tls_auth_file, "tls-auth");
2236 MUST_BE_UNDEF(tls_crypt_file, "tls-crypt");
2237 MUST_BE_UNDEF(tls_crypt_v2_file, "tls-crypt-v2");
2238 MUST_BE_UNDEF(single_session, "single-session");
2239 MUST_BE_UNDEF(push_peer_info, "push-peer-info");
2240 MUST_BE_UNDEF(tls_exit, "tls-exit");
2241 MUST_BE_UNDEF(crl_file, "crl-verify");
2242 MUST_BE_UNDEF(ns_cert_type, "ns-cert-type");
2243 MUST_BE_UNDEF(remote_cert_ku[0], "remote-cert-ku");
2244 MUST_BE_UNDEF(remote_cert_eku, "remote-cert-eku");
2245#ifdef ENABLE_PKCS11
2246 MUST_BE_UNDEF(pkcs11_providers[0], "pkcs11-providers");
2247 MUST_BE_UNDEF(pkcs11_private_mode[0], "pkcs11-private-mode");
2248 MUST_BE_UNDEF(pkcs11_id, "pkcs11-id");
2249 MUST_BE_UNDEF(pkcs11_id_management, "pkcs11-id-management");
2250#endif
2251
2252 if (pull)
2253 {
2254 msg(M_USAGE, use_err, "--pull");
2255 }
2256 }
2257 if (options->auth_user_pass_file && !options->pull)
2258 {
2259 msg(M_USAGE, "--auth-user-pass requires --pull");
2260 }
2261
2262 uninit_options(&defaults);
2263}
2264
2265#undef MUST_BE_UNDEF
2266#undef MUST_BE_FALSE
2267
2268static void
2269options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
2270{
2271 const int dev = dev_type_enum(o->dev, o->dev_type);
2272
2273 if (o->server_defined || o->server_bridge_defined || o->server_bridge_proxy_dhcp)
2274 {
2275 if (ce->proto == PROTO_TCP)
2276 {
2277 ce->proto = PROTO_TCP_SERVER;
2278 o->ce.proto = ce->proto;
2279 }
2280 }
2281
2282 if (o->mode != MODE_SERVER)
2283 {
2284 if (ce->proto == PROTO_TCP)
2285 {
2286 ce->proto = PROTO_TCP_CLIENT;
2287 o->ce.proto = ce->proto;
2288 }
2289 }
2290
2291 /* an option is present that requires local bind to enabled */
2292 bool need_bind = ce->local_port_defined || ce->bind_defined || ce->local_list;
2293
2294 /* socks proxy is enabled */
2295 bool uses_socks = ce->proto == PROTO_UDP && ce->socks_proxy_server;
2296
2297 /* If binding is not forced by an explicit option and we have (at least)
2298 * one of --tcp-client, --pull (or --client), or socks we do not bind
2299 * locally to have "normal" IP client behaviour of a random source port */
2300 if (!need_bind && (ce->proto == PROTO_TCP_CLIENT || uses_socks || o->pull))
2301 {
2302 ce->bind_local = false;
2303 }
2304
2305 if (!ce->bind_local)
2306 {
2307 ce->local_port = NULL;
2308 }
2309
2310 /* if protocol forcing is enabled, disable all protocols
2311 * except for the forced one
2312 */
2313 if (o->proto_force >= 0 && o->proto_force != ce->proto)
2314 {
2315 ce->flags |= CE_DISABLED;
2316 }
2317
2318 if (ce->http_proxy_options)
2319 {
2320 ce->http_proxy_options->nocache = ssl_get_auth_nocache();
2321 }
2322
2323 /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)
2324 * so fall back to IPv4-only (trac #1221)
2325 */
2326 if (ce->socks_proxy_server && proto_is_udp(ce->proto) && ce->af != AF_INET)
2327 {
2328 if (ce->af == AF_INET6)
2329 {
2330 msg(M_INFO, "WARNING: '--proto udp6' is not compatible with "
2331 "'--socks-proxy' today. Forcing IPv4 mode.");
2332 }
2333 else
2334 {
2335 msg(M_INFO, "NOTICE: dual-stack mode for '--proto udp' does not "
2336 "work correctly with '--socks-proxy' today. Forcing IPv4.");
2337 }
2338 ce->af = AF_INET;
2339 }
2340
2341 /*
2342 * Set MTU defaults
2343 */
2344 {
2345 if (!ce->tun_mtu_defined && !ce->link_mtu_defined)
2346 {
2347 ce->tun_mtu_defined = true;
2348 }
2349 if ((dev == DEV_TYPE_TAP) && !ce->tun_mtu_extra_defined)
2350 {
2351 ce->tun_mtu_extra_defined = true;
2352 ce->tun_mtu_extra = TAP_MTU_EXTRA_DEFAULT;
2353 }
2354 }
2355
2356 /*
2357 * If --mssfix is supplied without a parameter or not specified at all,
2358 * default it to --fragment value, if --fragment is specified and otherwise
2359 * to the default if tun-mtu is 1500
2360 */
2361 if (o->ce.mssfix_default)
2362 {
2363#ifdef ENABLE_FRAGMENT
2364 if (ce->fragment)
2365 {
2366 ce->mssfix = ce->fragment;
2367 }
2368 else
2369#endif
2370 if (ce->tun_mtu_defined)
2371 {
2372 if (o->ce.tun_mtu == TUN_MTU_DEFAULT)
2373 {
2374 /* We want to only set mssfix default value if we use a default
2375 * MTU Size, otherwise the different size of tun should either
2376 * already solve the problem or mssfix might artifically make the
2377 * payload packets smaller without mssfix 0 */
2378 ce->mssfix = MSSFIX_DEFAULT;
2379 ce->mssfix_encap = true;
2380 }
2381 else
2382 {
2383 /* We still apply the mssfix value but only adjust it to the
2384 * size of the tun interface. */
2385 ce->mssfix = ce->tun_mtu;
2386 ce->mssfix_fixed = true;
2387 }
2388 }
2389 }
2390
2391 /*
2392 * Set per-connection block tls-auth/crypt/crypto-v2 fields if undefined.
2393 *
2394 * At the end only one of these will be really set because the parser
2395 * logic prevents configurations where more are set.
2396 */
2397 if (!ce->tls_auth_file && !ce->tls_crypt_file && !ce->tls_crypt_v2_file)
2398 {
2399 ce->tls_auth_file = o->tls_auth_file;
2400 ce->tls_auth_file_inline = o->tls_auth_file_inline;
2401 ce->key_direction = o->key_direction;
2402
2403 ce->tls_crypt_file = o->tls_crypt_file;
2404 ce->tls_crypt_file_inline = o->tls_crypt_file_inline;
2405
2406 ce->tls_crypt_v2_file = o->tls_crypt_v2_file;
2407 ce->tls_crypt_v2_file_inline = o->tls_crypt_v2_file_inline;
2408 }
2409
2410 /* Pre-cache tls-auth/crypt(-v2) key file if
2411 * keys were not already embedded in the config file.
2412 */
2413 connection_entry_preload_key(&ce->tls_auth_file, &ce->tls_auth_file_inline, &o->gc);
2414 connection_entry_preload_key(&ce->tls_crypt_file, &ce->tls_crypt_file_inline, &o->gc);
2415 connection_entry_preload_key(&ce->tls_crypt_v2_file, &ce->tls_crypt_v2_file_inline, &o->gc);
2416
2417
2418 if (!proto_is_udp(ce->proto) && ce->explicit_exit_notification)
2419 {
2420 msg(M_WARN, "NOTICE: --explicit-exit-notify ignored for --proto tcp");
2421 ce->explicit_exit_notification = 0;
2422 }
2423}
2424
2425static void
2426options_postprocess_mutate_le(struct connection_entry *ce, struct local_entry *le, int mode)
2427{
2428 /* use the global port if none is specified */
2429 if (!le->port)
2430 {
2431 le->port = ce->local_port;
2432 }
2433 /* use the global proto if none is specified and
2434 * allow proto bindings on server mode only */
2435 if (!le->proto || mode == MODE_POINT_TO_POINT)
2436 {
2437 le->proto = ce->proto;
2438 }
2439}
2440
2441#ifdef _WIN32
2442/* If iservice is in use, we need def1 method for redirect-gateway */
2443static void
2444remap_redirect_gateway_flags(struct options *opt)
2445{
2446 if (opt->routes && opt->route_method == ROUTE_METHOD_SERVICE
2447 && opt->routes->flags & RG_REROUTE_GW && !(opt->routes->flags & RG_DEF1))
2448 {
2449 msg(M_INFO, "Flag 'def1' added to --redirect-gateway (iservice is in use)");
2450 opt->routes->flags |= RG_DEF1;
2451 }
2452}
2453#endif /* ifdef _WIN32 */
2454
2455/*
2456 * Save/Restore certain option defaults before --pull is applied.
2457 */
2458
2459static void
2460pre_connect_save(struct options *o)
2461{
2462 ALLOC_OBJ_CLEAR_GC(o->pre_connect, struct options_pre_connect, &o->gc);
2463 o->pre_connect->tuntap_options = o->tuntap_options;
2464 o->pre_connect->tuntap_options_defined = true;
2465 o->pre_connect->foreign_option_index = o->foreign_option_index;
2466
2467 if (o->routes)
2468 {
2469 o->pre_connect->routes = clone_route_option_list(o->routes, &o->gc);
2470 o->pre_connect->routes_defined = true;
2471 }
2472 if (o->routes_ipv6)
2473 {
2474 o->pre_connect->routes_ipv6 = clone_route_ipv6_option_list(o->routes_ipv6, &o->gc);
2475 o->pre_connect->routes_ipv6_defined = true;
2476 }
2477 if (o->client_nat)
2478 {
2479 o->pre_connect->client_nat = clone_client_nat_option_list(o->client_nat, &o->gc);
2480 o->pre_connect->client_nat_defined = true;
2481 }
2482
2483 o->pre_connect->ifconfig_local = o->ifconfig_local;
2484 o->pre_connect->ifconfig_ipv6_local = o->ifconfig_ipv6_local;
2485
2486 o->pre_connect->route_default_gateway = o->route_default_gateway;
2487 o->pre_connect->route_ipv6_default_gateway = o->route_ipv6_default_gateway;
2488
2489 o->pre_connect->dns_options = clone_dns_options(&o->dns_options, &o->gc);
2490
2491 /* NCP related options that can be overwritten by a push */
2492 o->pre_connect->ciphername = o->ciphername;
2493 o->pre_connect->authname = o->authname;
2494
2495 /* Ping related options should be reset to the config values on reconnect */
2496 o->pre_connect->ping_rec_timeout = o->ping_rec_timeout;
2497 o->pre_connect->ping_rec_timeout_action = o->ping_rec_timeout_action;
2498 o->pre_connect->ping_send_timeout = o->ping_send_timeout;
2499
2500 /* Miscellaneous Options */
2501 o->pre_connect->comp = o->comp;
2502}
2503
2504void
2505pre_connect_restore(struct options *o, struct gc_arena *gc)
2506{
2507 const struct options_pre_connect *pp = o->pre_connect;
2508 if (pp)
2509 {
2510 CLEAR(o->tuntap_options);
2511 if (pp->tuntap_options_defined)
2512 {
2513 o->tuntap_options = pp->tuntap_options;
2514 }
2515
2516 if (pp->routes_defined)
2517 {
2518 rol_check_alloc(o);
2519 copy_route_option_list(o->routes, pp->routes, gc);
2520 }
2521 else
2522 {
2523 o->routes = NULL;
2524 }
2525
2526 if (pp->routes_ipv6_defined)
2527 {
2528 rol6_check_alloc(o);
2529 copy_route_ipv6_option_list(o->routes_ipv6, pp->routes_ipv6, gc);
2530 }
2531 else
2532 {
2533 o->routes_ipv6 = NULL;
2534 }
2535
2536 o->ifconfig_local = pp->ifconfig_local;
2537 o->ifconfig_ipv6_local = pp->ifconfig_ipv6_local;
2538
2539 o->route_default_gateway = pp->route_default_gateway;
2540 o->route_ipv6_default_gateway = pp->route_ipv6_default_gateway;
2541
2542 /* Free DNS options and reset them to pre-pull state */
2543 gc_free(&o->dns_options.gc);
2544 struct gc_arena dns_gc = gc_new();
2545 o->dns_options = clone_dns_options(&pp->dns_options, &dns_gc);
2546 o->dns_options.gc = dns_gc;
2547
2548 if (pp->client_nat_defined)
2549 {
2550 cnol_check_alloc(o);
2551 copy_client_nat_option_list(o->client_nat, pp->client_nat);
2552 }
2553 else
2554 {
2555 o->client_nat = NULL;
2556 }
2557
2558 o->foreign_option_index = pp->foreign_option_index;
2559
2560 o->ciphername = pp->ciphername;
2561 o->authname = pp->authname;
2562
2563 o->ping_rec_timeout = pp->ping_rec_timeout;
2564 o->ping_rec_timeout_action = pp->ping_rec_timeout_action;
2565 o->ping_send_timeout = pp->ping_send_timeout;
2566
2567 /* Miscellaneous Options */
2568 o->comp = pp->comp;
2569 }
2570
2571 o->push_continuation = 0;
2572 o->push_option_types_found = 0;
2573 o->push_update_options_found = 0;
2574 o->imported_protocol_flags = 0;
2575}
2576
2577static void
2578options_postprocess_mutate_invariant(struct options *options)
2579{
2580#ifdef _WIN32
2581 const int dev = dev_type_enum(options->dev, options->dev_type);
2582
2583 /* when using ovpn-dco, kernel doesn't send DHCP requests, so don't use it */
2584 if ((options->windows_driver == DRIVER_DCO)
2585 && (options->tuntap_options.ip_win32_type == IPW32_SET_DHCP_MASQ
2586 || options->tuntap_options.ip_win32_type == IPW32_SET_ADAPTIVE))
2587 {
2588 options->tuntap_options.ip_win32_type = IPW32_SET_NETSH;
2589 }
2590
2591 if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined)
2592 {
2593 /* delay may only be necessary when we perform DHCP handshake */
2594 const bool dhcp = (options->tuntap_options.ip_win32_type == IPW32_SET_DHCP_MASQ)
2595 || (options->tuntap_options.ip_win32_type == IPW32_SET_ADAPTIVE);
2596 if ((options->mode == MODE_POINT_TO_POINT) && dhcp)
2597 {
2598 options->route_delay_defined = true;
2599 options->route_delay = 5; /* Vista sometimes has a race without this */
2600 }
2601 }
2602
2603 if (options->ifconfig_noexec)
2604 {
2605 options->tuntap_options.ip_win32_type = IPW32_SET_MANUAL;
2606 options->ifconfig_noexec = false;
2607 }
2608
2609 remap_redirect_gateway_flags(options);
2610
2611 /*
2612 * Check consistency of --mode server options.
2613 */
2614 if (options->mode == MODE_SERVER)
2615 {
2616 /*
2617 * We need to explicitly set --tap-sleep because
2618 * we do not schedule event timers in the top-level context.
2619 */
2620 options->tuntap_options.tap_sleep = 10;
2621 if (options->route_delay_defined && options->route_delay)
2622 {
2623 options->tuntap_options.tap_sleep = options->route_delay;
2624 }
2625 options->route_delay_defined = false;
2626 }
2627#endif /* ifdef _WIN32 */
2628
2629#ifdef DEFAULT_PKCS11_MODULE
2630 /* If p11-kit is present on the system then load its p11-kit-proxy.so
2631 * by default if the user asks for PKCS#11 without otherwise specifying
2632 * the module to use. */
2633 if (!options->pkcs11_providers[0] && (options->pkcs11_id || options->pkcs11_id_management))
2634 {
2635 options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
2636 }
2637#endif
2638}
2639
2640static void
2641options_postprocess_verify(const struct options *o)
2642{
2643 if (o->connection_list)
2644 {
2645 int i;
2646 for (i = 0; i < o->connection_list->len; ++i)
2647 {
2648 options_postprocess_verify_ce(o, o->connection_list->array[i]);
2649 }
2650 }
2651 else
2652 {
2653 options_postprocess_verify_ce(o, &o->ce);
2654 }
2655
2656 dns_options_verify(M_FATAL, &o->dns_options);
2657
2658 if (dco_enabled(o))
2659 {
2660 if (o->enable_c2c)
2661 {
2662 msg(M_WARN, "Note: --client-to-client has no effect when using data "
2663 "channel offload: packets are always sent to the VPN "
2664 "interface and then routed based on the system routing table");
2665 }
2666
2667 if (o->renegotiate_bytes > 0 || o->renegotiate_packets)
2668 {
2669 msg(M_WARN, "Note: '--reneg-bytes' and '--reneg-pkts' are not supported "
2670 "by data channel offload; automatic key renegotiation "
2671 "mechanisms are sufficient for modern ciphers. "
2672 "Ignoring these options.");
2673 }
2674 }
2675}
2676
2677static void
2678options_postprocess_cipher(struct options *o)
2679{
2680 if (!o->pull && !(o->mode == MODE_SERVER))
2681 {
2682 /* If the cipher is not set, use the old default of BF-CBC. We will
2683 * warn that this is deprecated on cipher initialisation, no need
2684 * to warn here as well */
2685 if (!o->ciphername)
2686 {
2687 o->ciphername = "BF-CBC";
2688 }
2689 else
2690 {
2691 o->enable_ncp_fallback = true;
2692 }
2693 return;
2694 }
2695
2696 /* pull or P2MP mode */
2697 if (!o->ciphername)
2698 {
2699 /* We still need to set the ciphername to BF-CBC since various other
2700 * parts of OpenVPN assert that the ciphername is set */
2701 o->ciphername = "BF-CBC";
2702
2703 msg(M_INFO,
2704 "Note: --cipher is not set. OpenVPN versions before 2.5 "
2705 "defaulted to BF-CBC as fallback when cipher negotiation "
2706 "failed in this case. If you need this fallback please add "
2707 "'--data-ciphers-fallback BF-CBC' to your configuration "
2708 "and/or add BF-CBC to --data-ciphers. E.g. "
2709 "--data-ciphers %s:BF-CBC",
2710 o->ncp_ciphers_conf);
2711 }
2712 else if (!o->enable_ncp_fallback && !tls_item_in_cipher_list(o->ciphername, o->ncp_ciphers))
2713 {
2714 msg(M_WARN,
2715 "DEPRECATED OPTION: --cipher set to '%s' but missing in "
2716 "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
2717 "negotiations. ",
2718 o->ciphername, o->ncp_ciphers_conf);
2719 }
2720}
2721
2737static bool
2738need_compatibility_before(const struct options *o, unsigned int version)
2739{
2740 return o->backwards_compatible != 0 && o->backwards_compatible < version;
2741}
2742
2747static void
2748options_set_backwards_compatible_options(struct options *o)
2749{
2750 /* TLS min version is not set */
2751 unsigned int tls_ver_min = (o->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT) & SSLF_TLS_VERSION_MIN_MASK;
2752 if (tls_ver_min == 0)
2753 {
2754 unsigned int tls_ver_max = (o->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT) & SSLF_TLS_VERSION_MAX_MASK;
2755 if (need_compatibility_before(o, 20307))
2756 {
2757 /* 2.3.6 and earlier have TLS 1.0 only, set minimum to TLS 1.0 */
2758 o->ssl_flags |= (TLS_VER_1_0 << SSLF_TLS_VERSION_MIN_SHIFT);
2759 }
2760 else if (tls_ver_max == 0 || tls_ver_max >= TLS_VER_1_2)
2761 {
2762 /* Use TLS 1.2 as proper default */
2763 o->ssl_flags |= (TLS_VER_1_2 << SSLF_TLS_VERSION_MIN_SHIFT);
2764 }
2765 else
2766 {
2767 /* Maximize the minimum version */
2768 o->ssl_flags |= (tls_ver_max << SSLF_TLS_VERSION_MIN_SHIFT);
2769 }
2770 }
2771
2772 if (need_compatibility_before(o, 20400))
2773 {
2774 if (!o->ciphername)
2775 {
2776 /* If ciphername is not set default to BF-CBC when targeting these
2777 * old versions that do not have NCP */
2778 o->ciphername = "BF-CBC";
2779 }
2780 /* Versions < 2.4.0 additionally might be compiled with --enable-small and
2781 * not have OCC strings required for "poor man's NCP" */
2782 o->enable_ncp_fallback = true;
2783 }
2784
2785 /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers.
2786 * Version 2.4 probably does not need it but NCP was not so
2787 * good with 2.4 and ncp-disable might be more common on 2.4 peers.
2788 * Only do this iff --cipher is set (explicitly or by compat mode
2789 * < 2.4.0, see above). This is not 100% correct backwards compatible
2790 * behaviour but 2.5 already behaved like this */
2791 if (o->ciphername && need_compatibility_before(o, 20500)
2792 && !tls_item_in_cipher_list(o->ciphername, o->ncp_ciphers))
2793 {
2794 append_cipher_to_ncp_list(o, o->ciphername);
2795 }
2796
2797#ifdef USE_COMP
2798 /* Compression is deprecated and we do not want to announce support for it
2799 * by default anymore, additionally DCO breaks with compression.
2800 *
2801 * Disable compression by default starting with 2.6.0 if no other
2802 * compression related option has been explicitly set */
2803 if (!need_compatibility_before(o, 20600) && (o->comp.flags == 0))
2804 {
2805 if (!comp_non_stub_enabled(&o->comp))
2806 {
2807 o->comp.flags = COMP_F_ALLOW_STUB_ONLY | COMP_F_ADVERTISE_STUBS_ONLY;
2808 }
2809 }
2810#else /* ifdef USE_COMP */
2811 o->comp.flags = COMP_F_ALLOW_NOCOMP_ONLY;
2812#endif
2813}
2814
2815static void
2816options_process_mutate_prf(struct options *o)
2817{
2818 if (!check_tls_prf_working())
2819 {
2820 msg(D_TLS_ERRORS, "Warning: TLS 1.0 PRF with MD5+SHA1 PRF is not "
2821 "supported by the TLS library. Your system does not support this "
2822 "calculation anymore or your security policy (e.g. FIPS 140-2) "
2823 "forbids it. Connections will only work with peers running "
2824 "OpenVPN 2.6.0 or higher)");
2825 if (o->mode == MODE_SERVER)
2826 {
2827 msg(M_WARN, "Automatically enabling option "
2828 "--force-tls-key-material-export");
2829 o->force_key_material_export = true;
2830 }
2831 }
2832}
2833
2834#if defined(_WIN32) || defined(TARGET_ANDROID)
2843static void
2844tuntap_options_postprocess_dns(struct options *o)
2845{
2846 struct dns_options *dns = &o->dns_options;
2847 struct tuntap_options *tt = &o->tuntap_options;
2848 if (!dns->servers)
2849 {
2850 /* Copy --dhcp-options to tuntap_options */
2851 struct dhcp_options *dhcp = &dns->from_dhcp;
2852 ASSERT(sizeof(dhcp->dns) == sizeof(tt->dns));
2853 ASSERT(sizeof(dhcp->dns6) == sizeof(tt->dns6));
2854 ASSERT(sizeof(dhcp->domain_search_list) == sizeof(tt->domain_search_list));
2855
2856 tt->domain = dhcp->domain;
2857 tt->dns_len = dhcp->dns_len;
2858 tt->dns6_len = dhcp->dns6_len;
2859
2860 memcpy(tt->dns, dhcp->dns, sizeof(tt->dns));
2861 memcpy(tt->dns6, dhcp->dns6, sizeof(tt->dns6));
2862
2863 tt->domain_search_list_len = dhcp->domain_search_list_len;
2864 for (size_t i = 0; i < SIZE(tt->domain_search_list); ++i)
2865 {
2866 tt->domain_search_list[i] = dhcp->domain_search_list[i];
2867 }
2868
2869 return;
2870 }
2871
2872#if defined(_WIN32)
2873 if (tt->ip_win32_type != IPW32_SET_DHCP_MASQ && tt->ip_win32_type != IPW32_SET_ADAPTIVE)
2874 {
2875 return; /* Not in DHCP mode */
2876 }
2877#endif /* if defined(_WIN32) */
2878
2879 /* Copy --dns options to tuntap_options */
2880
2881 const struct dns_domain *d = dns->search_domains;
2882 if (d)
2883 {
2884 tt->domain_search_list_len = 0;
2885 }
2886
2887 while (d && tt->domain_search_list_len + 1 < N_SEARCH_LIST_LEN)
2888 {
2889 tt->domain_search_list[tt->domain_search_list_len++] = d->name;
2890 d = d->next;
2891 }
2892 if (d)
2893 {
2894 msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to TUN/TAP");
2895 }
2896
2897 tt->dns_len = 0;
2898 tt->dns6_len = 0;
2899
2900 const struct dns_server *s = dns->servers;
2901 while (s)
2902 {
2903 bool non_standard_server_port = false;
2904 for (size_t i = 0; i < s->addr_count; ++i)
2905 {
2906 if (s->addr[i].port && s->addr[i].port != 53)
2907 {
2908 non_standard_server_port = true;
2909 break;
2910 }
2911 }
2912 if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN)
2913 || (s->dnssec && s->dnssec != DNS_SECURITY_NO) || non_standard_server_port)
2914 {
2915 /* Skip servers requiring unsupported config to be set */
2916 s = s->next;
2917 }
2918 else
2919 {
2920 bool overflow = false;
2921 for (size_t i = 0; i < s->addr_count; ++i)
2922 {
2923 if (s->addr[i].family == AF_INET && tt->dns_len + 1 < N_DHCP_ADDR)
2924 {
2925 tt->dns[tt->dns_len++] = ntohl(s->addr[i].in.a4.s_addr);
2926 }
2927 else if (tt->dns6_len + 1 < N_DHCP_ADDR)
2928 {
2929 tt->dns6[tt->dns6_len++] = s->addr[i].in.a6;
2930 }
2931 else
2932 {
2933 overflow = true;
2934 }
2935 }
2936 if (overflow)
2937 {
2938 msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to TUN/TAP");
2939 }
2940 tt->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
2941 return;
2942 }
2943 }
2944}
2945
2946#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
2947
2958static void
2959dhcp_options_postprocess_dns(struct options *o, struct env_set *es)
2960{
2961 struct gc_arena gc = gc_new();
2962 struct dns_options *dns = &o->dns_options;
2963
2964 if (is_tun_afunix(o->dev_node))
2965 {
2966 /* Disable running dns-updown script with lwipovpn */
2967 dns->updown_flags = DNS_UPDOWN_NO_FLAGS;
2968 dns->updown = NULL;
2969 }
2970
2971 if (dns->servers || dns_updown_user_set(dns) || dns_updown_forced(dns))
2972 {
2973 /* Clean up env from --dhcp-option DNS config */
2974 struct buffer name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
2975 struct buffer value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
2976
2977 const int fo_count = o->foreign_option_index;
2978 o->foreign_option_index = 0;
2979
2980 for (int i = 1; i <= fo_count; ++i)
2981 {
2982 buf_clear(&name);
2983 buf_printf(&name, "foreign_option_%d", i);
2984 const char *env_str = env_set_get(es, BSTR(&name));
2985 const char *item_val = strchr(env_str, '=') + 1;
2986 buf_clear(&value);
2987 buf_printf(&value, "%s", item_val);
2988
2989 /* Remove foreign option item from env set */
2990 env_set_del(es, BSTR(&name));
2991
2992 item_val = BSTR(&value);
2993 if (strncmp(item_val, "dhcp-option ", 12) != 0
2994 || (strncmp(item_val + 12, "ADAPTER-DOMAIN-SUFFIX ", 22) != 0
2995 && strncmp(item_val + 12, "DOMAIN-SEARCH ", 14) != 0
2996 && strncmp(item_val + 12, "DOMAIN ", 7) != 0
2997 && strncmp(item_val + 12, "DNS6 ", 5) != 0
2998 && strncmp(item_val + 12, "DNS ", 4) != 0))
2999 {
3000 /* Re-set the item with potentially updated name */
3001 buf_clear(&name);
3002 buf_printf(&name, "foreign_option_%d", ++o->foreign_option_index);
3003 setenv_str(es, BSTR(&name), BSTR(&value));
3004 }
3005 }
3006 }
3007
3008 if (!dns->servers)
3009 {
3010 /* Copy --dhcp-options to dns_options */
3011 struct dhcp_options *dhcp = &dns->from_dhcp;
3012
3013 if (dhcp->dns_len || dhcp->dns6_len)
3014 {
3015 struct dns_domain **entry = &dns->search_domains;
3016 ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc);
3017 struct dns_domain *domain = *entry;
3018 domain->name = dhcp->domain;
3019 entry = &domain->next;
3020
3021 for (unsigned int i = 0; i < dhcp->domain_search_list_len; ++i)
3022 {
3023 ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc);
3024 struct dns_domain *search_domain = *entry;
3025 search_domain->name = dhcp->domain_search_list[i];
3026 entry = &search_domain->next;
3027 }
3028
3029 struct dns_server *server = dns_server_get(&dns->servers, 0, &dns->gc);
3030 const size_t max_addrs = SIZE(server->addr);
3031 for (unsigned int i = 0; i < dhcp->dns_len && server->addr_count < max_addrs; ++i)
3032 {
3033 server->addr[server->addr_count].in.a4.s_addr = htonl(dhcp->dns[i]);
3034 server->addr[server->addr_count].family = AF_INET;
3035 server->addr_count += 1;
3036 }
3037 for (unsigned int i = 0; i < dhcp->dns6_len && server->addr_count < max_addrs; ++i)
3038 {
3039 server->addr[server->addr_count].in.a6 = dhcp->dns6[i];
3040 server->addr[server->addr_count].family = AF_INET6;
3041 server->addr_count += 1;
3042 }
3043 }
3044 }
3045 else if (o->up_script && !dns_updown_user_set(dns) && !dns_updown_forced(dns))
3046 {
3047 /* Set foreign option env vars from --dns config */
3048 const struct dns_domain *d = dns->search_domains;
3049 while (d)
3050 {
3051 setenv_foreign_option(o, "DOMAIN", d->name, es);
3052 d = d->next;
3053 }
3054
3055 const struct dns_server *s = dns->servers;
3056 while (s)
3057 {
3058 bool non_standard_server_port = false;
3059 for (size_t i = 0; i < s->addr_count; ++i)
3060 {
3061 if (s->addr[i].port && s->addr[i].port != 53)
3062 {
3063 non_standard_server_port = true;
3064 break;
3065 }
3066 }
3067 if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN)
3068 || (s->dnssec && s->dnssec != DNS_SECURITY_NO) || non_standard_server_port)
3069 {
3070 /* Skip servers requiring unsupported config to be set */
3071 s = s->next;
3072 }
3073 else
3074 {
3075 for (size_t i = 0; i < s->addr_count; ++i)
3076 {
3077 const char *option;
3078 const char *value;
3079 if (s->addr[i].family == AF_INET)
3080 {
3081 option = "DNS";
3082 value = print_in_addr_t(s->addr[i].in.a4.s_addr, IA_NET_ORDER, &gc);
3083 }
3084 else
3085 {
3086 option = "DNS6";
3087 value = print_in6_addr(s->addr[i].in.a6, 0, &gc);
3088 }
3089 setenv_foreign_option(o, option, value, es);
3090 }
3091 break;
3092 }
3093 }
3094 }
3095
3096 gc_free(&gc);
3097}
3098#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
3103static void
3104helper_hashmap_sizes(struct options *o)
3105{
3106 if (!o->real_hash_size)
3107 {
3108 o->real_hash_size = 4 * o->max_clients;
3109 }
3110 if (!o->virtual_hash_size)
3111 {
3112 o->virtual_hash_size = 4 * o->max_clients;
3113 }
3114}
3115
3116static void
3117options_postprocess_mutate(struct options *o, struct env_set *es)
3118{
3119 /*
3120 * Process helper-type options which map to other, more complex
3121 * sequences of options.
3122 */
3123 helper_client_server(o);
3124 /* must be called after helpers that might set --mode */
3125 helper_setdefault_topology(o);
3126 helper_keepalive(o);
3127 helper_tcp_nodelay(o);
3128
3129 if (o->mode == MODE_SERVER)
3130 {
3131 helper_hashmap_sizes(o);
3132 }
3133
3134 options_postprocess_setdefault_ncpciphers(o);
3135 options_set_backwards_compatible_options(o);
3136 options_process_mutate_prf(o);
3137
3138 options_postprocess_cipher(o);
3139 o->ncp_ciphers = mutate_ncp_cipher_list(o->ncp_ciphers, &o->gc);
3140 if (o->ncp_ciphers == NULL)
3141 {
3142 msg(M_USAGE, "--data-ciphers list contains unsupported ciphers or is too long.");
3143 }
3144
3145 if (o->remote_list && !o->connection_list)
3146 {
3147 /*
3148 * Convert remotes into connection list
3149 */
3150 const struct remote_list *rl = o->remote_list;
3151 for (int i = 0; i < rl->len; ++i)
3152 {
3153 const struct remote_entry *re = rl->array[i];
3154 struct connection_entry ce = o->ce;
3155 struct connection_entry *ace;
3156
3157 ASSERT(re->remote);
3158 connection_entry_load_re(&ce, re);
3159 ace = alloc_connection_entry(o, M_USAGE);
3160 ASSERT(ace);
3161 *ace = ce;
3162 }
3163 }
3164 else if (!o->remote_list && !o->connection_list)
3165 {
3166 struct connection_entry *ace;
3167 ace = alloc_connection_entry(o, M_USAGE);
3168 ASSERT(ace);
3169 *ace = o->ce;
3170 }
3171
3172 ASSERT(o->connection_list);
3173 for (int i = 0; i < o->connection_list->len; ++i)
3174 {
3175 options_postprocess_mutate_ce(o, o->connection_list->array[i]);
3176 }
3177
3178 if (o->ce.local_list)
3179 {
3180 for (int i = 0; i < o->ce.local_list->len; i++)
3181 {
3182 options_postprocess_mutate_le(&o->ce, o->ce.local_list->array[i], o->mode);
3183 }
3184
3185 for (int i = 0; i < o->ce.local_list->len; i++)
3186 {
3187 if (o->ce.local_list->array[i]->proto == PROTO_TCP)
3188 {
3189 o->ce.local_list->array[i]->proto = PROTO_TCP_SERVER;
3190 }
3191 else if (o->ce.local_list->array[i]->proto == PROTO_NONE)
3192 {
3193 o->ce.local_list->array[i]->proto = o->ce.proto;
3194 }
3195 }
3196 }
3197 else
3198 {
3199 /* if no 'local' directive was specified, convert the global port
3200 * setting to a listen entry */
3201 struct local_entry *e = alloc_local_entry(&o->ce, M_USAGE, &o->gc);
3202 ASSERT(e);
3203 e->port = o->ce.local_port;
3204 e->proto = o->ce.proto;
3205 }
3206
3207 /* use the same listen list for every outgoing connection */
3208 for (int i = 0; i < o->connection_list->len; ++i)
3209 {
3210 o->connection_list->array[i]->local_list = o->ce.local_list;
3211 }
3212
3213 if (o->tls_server)
3214 {
3215 if (o->dh_file && streq(o->dh_file, "none"))
3216 {
3217 o->dh_file = NULL;
3218 }
3219 }
3220 else if (o->dh_file)
3221 {
3222 /* DH file is only meaningful in a tls-server context. */
3223 msg(M_WARN, "WARNING: Ignoring option 'dh' in tls-client mode, please only "
3224 "include this in your server configuration");
3225 o->dh_file = NULL;
3226 }
3227#if ENABLE_MANAGEMENT
3228 if (o->http_proxy_override)
3229 {
3230 options_postprocess_http_proxy_override(o);
3231 }
3232#endif
3233 if (!o->ca_file && !o->ca_path && o->verify_hash && o->verify_hash_depth == 0)
3234 {
3235 msg(M_INFO, "Using certificate fingerprint to verify peer (no CA "
3236 "option set). ");
3237 o->verify_hash_no_ca = true;
3238 }
3239
3240 if (o->config && streq(o->config, "stdin") && o->remap_sigusr1 == SIGHUP)
3241 {
3242 msg(M_USAGE, "Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3243 "incompatible with each other.");
3244 }
3245
3246 if (dco_enabled(o))
3247 {
3248 /* check if any option should force disabling DCO */
3249 o->disable_dco = !dco_check_option(D_DCO, o) || !dco_check_startup_option(D_DCO, o);
3250 }
3251#ifdef USE_COMP
3252 if (dco_enabled(o))
3253 {
3254 o->comp.flags |= COMP_F_ALLOW_NOCOMP_ONLY;
3255 }
3256#endif
3257
3258#ifdef _WIN32
3259 if (dco_enabled(o))
3260 {
3261 o->windows_driver = DRIVER_DCO;
3262 }
3263 else
3264 {
3265 o->windows_driver = WINDOWS_DRIVER_TAP_WINDOWS6;
3266 }
3267#else /* _WIN32 */
3268 if (dco_enabled(o) && o->dev_node)
3269 {
3270 msg(M_WARN, "Note: ignoring --dev-node as it has no effect when using "
3271 "data channel offload");
3272 o->dev_node = NULL;
3273 }
3274#endif /* _WIN32 */
3275
3276 /* this depends on o->windows_driver, which is set above */
3277 options_postprocess_mutate_invariant(o);
3278
3279 /* check that compression settings in the options are okay */
3280 check_compression_settings_valid(&o->comp, M_USAGE);
3281
3282 /*
3283 * Save certain parms before modifying options during connect, especially
3284 * when using --pull
3285 */
3286 if (o->pull)
3287 {
3288 dns_options_preprocess_pull(&o->dns_options);
3289 }
3290 else
3291 {
3292#if defined(_WIN32) || defined(TARGET_ANDROID)
3293 tuntap_options_postprocess_dns(o);
3294#else
3295 dhcp_options_postprocess_dns(o, es);
3296#endif
3297 }
3298 if (o->auth_token_generate && !o->auth_token_renewal)
3299 {
3300 o->auth_token_renewal = o->renegotiate_seconds;
3301 }
3302#if ENABLE_MANAGEMENT
3303 if (o->auth_user_pass_username_only && o->sc_info.challenge_text)
3304 {
3305 msg(M_USAGE, "'auth-user-pass username-only' cannot be used with static challenge");
3306 }
3307#endif
3308 pre_connect_save(o);
3309}
3310
3311/*
3312 * Sanity check on options.
3313 * Also set some options based on other
3314 * options.
3315 */
3316void
3317options_postprocess(struct options *options, struct env_set *es)
3318{
3319 options_postprocess_mutate(options, es);
3320 options_postprocess_verify(options);
3321#ifndef ENABLE_SMALL
3322 options_postprocess_filechecks(options);
3323#endif /* !ENABLE_SMALL */
3324}
3325
3326/*
3327 * Sanity check on options after more options were pulled from server.
3328 * Also time to modify some options based on other options.
3329 */
3330bool
3331options_postprocess_pull(struct options *o, struct env_set *es)
3332{
3333 bool success = dns_options_verify(D_PUSH_ERRORS, &o->dns_options);
3334 if (success)
3335 {
3336 dns_options_postprocess_pull(&o->dns_options);
3337#if defined(_WIN32) || defined(TARGET_ANDROID)
3338 tuntap_options_postprocess_dns(o);
3339#else
3340 dhcp_options_postprocess_dns(o, es);
3341#endif
3342 }
3343 return success;
3344}
3345
3346/*
3347 * parse/print topology coding
3348 */
3349
3350int
3351parse_topology(const char *str, const msglvl_t msglevel)
3352{
3353 if (streq(str, "net30"))
3354 {
3355 return TOP_NET30;
3356 }
3357 else if (streq(str, "p2p"))
3358 {
3359 return TOP_P2P;
3360 }
3361 else if (streq(str, "subnet"))
3362 {
3363 return TOP_SUBNET;
3364 }
3365 else
3366 {
3367 msg(msglevel, "--topology must be net30, p2p, or subnet");
3368 return TOP_UNDEF;
3369 }
3370}
3371
3372const char *
3373print_topology(const int topology)
3374{
3375 switch (topology)
3376 {
3377 case TOP_UNDEF:
3378 return "undef";
3379
3380 case TOP_NET30:
3381 return "net30";
3382
3383 case TOP_P2P:
3384 return "p2p";
3385
3386 case TOP_SUBNET:
3387 return "subnet";
3388
3389 default:
3390 return "unknown";
3391 }
3392}
3393
3394/*
3395 * Manage auth-retry variable
3396 */
3397
3398static int global_auth_retry; /* GLOBAL */
3399
3400int
3401auth_retry_get(void)
3402{
3403 return global_auth_retry;
3404}
3405
3406bool
3407auth_retry_set(const msglvl_t msglevel, const char *option)
3408{
3409 if (streq(option, "interact"))
3410 {
3411 global_auth_retry = AR_INTERACT;
3412 }
3413 else if (streq(option, "nointeract"))
3414 {
3415 global_auth_retry = AR_NOINTERACT;
3416 }
3417 else if (streq(option, "none"))
3418 {
3419 global_auth_retry = AR_NONE;
3420 }
3421 else
3422 {
3423 msg(msglevel, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
3424 return false;
3425 }
3426 return true;
3427}
3428
3429const char *
3430auth_retry_print(void)
3431{
3432 switch (global_auth_retry)
3433 {
3434 case AR_NONE:
3435 return "none";
3436
3437 case AR_NOINTERACT:
3438 return "nointeract";
3439
3440 case AR_INTERACT:
3441 return "interact";
3442
3443 default:
3444 return "???";
3445 }
3446}
3447
3448/*
3449 * Print the help message.
3450 */
3451void
3452usage(void)
3453{
3454 FILE *fp = msg_fp(0);
3455
3456#ifdef ENABLE_SMALL
3457
3458 fprintf(fp, "Usage message not available\n");
3459
3460#else
3461
3462 struct options o;
3463 init_options(&o);
3464
3465 fprintf(fp, usage_message, title_string, o.ce.connect_retry_seconds,
3466 o.ce.connect_retry_seconds_max, o.ce.local_port, o.ce.remote_port, TUN_MTU_DEFAULT,
3467 TAP_MTU_EXTRA_DEFAULT, TUN_MTU_MAX_MIN, o.verbosity, o.authname, o.replay_window,
3468 o.replay_time, o.tls_timeout, o.renegotiate_seconds, o.handshake_window,
3469 o.transition_window);
3470 fflush(fp);
3471
3472#endif /* ENABLE_SMALL */
3473
3474 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
3475}
3476
3477void
3478usage_small(void)
3479{
3480 msg(M_WARN | M_NOPREFIX, "Use --help for more information.");
3481 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
3482}
3483
3484#ifdef _WIN32
3485void
3486show_windows_version(const unsigned int flags)
3487{
3488 struct gc_arena gc = gc_new();
3489 msg(flags, "Windows version: %s", win32_version_string(&gc));
3490 gc_free(&gc);
3491}
3492#endif
3493
3494void
3495show_dco_version(const unsigned int flags)
3496{
3497#ifdef ENABLE_DCO
3498 struct gc_arena gc = gc_new();
3499 msg(flags, "DCO version: %s", dco_version_string(&gc));
3500 gc_free(&gc);
3501#endif
3502}
3503
3504void
3505show_library_versions(const unsigned int flags)
3506{
3507#ifdef ENABLE_LZO
3508#define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
3509#else
3510#define LZO_LIB_VER_STR "", ""
3511#endif
3512
3513 msg(flags, "library versions: %s%s%s", get_ssl_library_version(), LZO_LIB_VER_STR);
3514
3515#undef LZO_LIB_VER_STR
3516}
3517
3518static void
3519usage_version(void)
3520{
3521 msg(M_INFO | M_NOPREFIX, "%s", title_string);
3522 show_library_versions(M_INFO | M_NOPREFIX);
3523#ifdef _WIN32
3524 show_windows_version(M_INFO | M_NOPREFIX);
3525#endif
3526 show_dco_version(M_INFO | M_NOPREFIX);
3527 msg(M_INFO | M_NOPREFIX, "Originally developed by James Yonan");
3528 msg(M_INFO | M_NOPREFIX, "Copyright (C) 2002-2026 OpenVPN Inc <sales@openvpn.net>");
3529#ifndef ENABLE_SMALL
3530#ifdef CONFIGURE_DEFINES
3531 msg(M_INFO | M_NOPREFIX, "Compile time defines: %s", CONFIGURE_DEFINES);
3532#endif
3533#ifdef CONFIGURE_SPECIAL_BUILD
3534 msg(M_INFO | M_NOPREFIX, "special build: %s", CONFIGURE_SPECIAL_BUILD);
3535#endif
3536#endif
3537 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD);
3538}
3539
3540void
3541notnull(const char *arg, const char *description)
3542{
3543 if (!arg)
3544 {
3545 msg(M_USAGE, "You must define %s", description);
3546 }
3547}
3548
3549#if 0
3550static void
3551ping_rec_err(msglvl_t msglevel)
3552{
3553 msg(msglevel, "only one of --ping-exit or --ping-restart options may be specified");
3554}
3555#endif
3556
3557#ifdef _WIN32 /* This function is only used when compiling on Windows */
3558static unsigned int
3559atou(const char *str)
3560{
3561 unsigned int val = 0;
3562 sscanf(str, "%u", &val);
3563 return val;
3564}
3565#endif
3566
3567#define VERIFY_PERMISSION(mask) \
3568 { \
3569 if (!verify_permission(p[0], file, line, (mask), permission_mask, option_types_found, \
3570 msglevel, options, is_inline)) \
3571 { \
3572 goto err; \
3573 } \
3574 }
3575
3576static bool
3577verify_permission(const char *name, const char *file, int line, const uint64_t type,
3578 const uint64_t allowed, uint64_t *found, const msglvl_t msglevel,
3579 struct options *options, bool is_inline)
3580{
3581 if (!(type & allowed))
3582 {
3583 msg(msglevel, "option '%s' cannot be used in this context (%s)", name, file);
3584 return false;
3585 }
3586
3587 if (is_inline && !(type & OPT_P_INLINE))
3588 {
3589 msg(msglevel, "option '%s' is not expected to be inline (%s:%d)", name, file, line);
3590 return false;
3591 }
3592
3593 if (found)
3594 {
3595 *found |= type;
3596 }
3597
3598#ifndef ENABLE_SMALL
3599 /* Check if this options is allowed in connection block,
3600 * but we are currently not in a connection block
3601 * unless this is a pushed option.
3602 * Parsing a connection block uses a temporary options struct without
3603 * connection_list
3604 */
3605
3606 if ((type & OPT_P_CONNECTION) && options->connection_list && !(allowed & OPT_P_PULL_MODE))
3607 {
3608 if (file)
3609 {
3610 msg(M_WARN, "Option '%s' in %s:%d is ignored by previous <connection> blocks ", name,
3611 file, line);
3612 }
3613 else
3614 {
3615 msg(M_WARN, "Option '%s' is ignored by previous <connection> blocks", name);
3616 }
3617 }
3618#endif
3619 return true;
3620}
3621
3622/*
3623 * Check that an option doesn't have too
3624 * many parameters.
3625 */
3626
3627#define NM_QUOTE_HINT (1 << 0)
3628
3629static bool
3630no_more_than_n_args(const msglvl_t msglevel, char *p[], const int max, const unsigned int flags)
3631{
3632 const int len = string_array_len((const char **)p);
3633
3634 if (!len)
3635 {
3636 return false;
3637 }
3638
3639 if (len > max)
3640 {
3641 msg(msglevel, "the --%s directive should have at most %d parameter%s.%s", p[0], max - 1,
3642 max >= 3 ? "s" : "",
3643 (flags & NM_QUOTE_HINT)
3644 ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")."
3645 : "");
3646 return false;
3647 }
3648 else
3649 {
3650 return true;
3651 }
3652}
3653
3654static inline msglvl_t
3655msglevel_forward_compatible(struct options *options, const msglvl_t msglevel)
3656{
3657 return options->forward_compatible ? M_WARN : msglevel;
3658}
3659
3660#define RESET_OPTION_ROUTES(option_ptr, field) \
3661 if (option_ptr) \
3662 { \
3663 option_ptr->field = NULL; \
3664 option_ptr->flags = 0; \
3665 }
3666
3667void
3668remove_option(struct context *c, struct options *options, char *p[], bool is_inline,
3669 const char *file, int line, const msglvl_t msglevel,
3670 const uint64_t permission_mask, uint64_t *option_types_found,
3671 struct env_set *es)
3672{
3673 msglvl_t msglevel_fc = msglevel_forward_compatible(options, msglevel);
3674
3675 if (streq(p[0], "ifconfig") && !p[1])
3676 {
3677 VERIFY_PERMISSION(OPT_P_UP);
3678 options->ifconfig_local = NULL;
3679 options->ifconfig_remote_netmask = NULL;
3680 }
3681 else if (streq(p[0], "ifconfig-ipv6") && !p[1])
3682 {
3683 VERIFY_PERMISSION(OPT_P_UP);
3684 options->ifconfig_ipv6_local = NULL;
3685 options->ifconfig_ipv6_netbits = 0;
3686 options->ifconfig_ipv6_remote = NULL;
3687 }
3688 else if (streq(p[0], "route") && !p[1])
3689 {
3690 VERIFY_PERMISSION(OPT_P_ROUTE);
3691 if (c->c1.route_list)
3692 {
3693 delete_routes_v4(c->c1.route_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options), es,
3694 &c->net_ctx);
3695 RESET_OPTION_ROUTES(options->routes, routes);
3696 }
3697 }
3698 else if (streq(p[0], "route-ipv6") && !p[1])
3699 {
3700 VERIFY_PERMISSION(OPT_P_ROUTE);
3701 if (c->c1.route_ipv6_list)
3702 {
3703 delete_routes_v6(c->c1.route_ipv6_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options),
3704 es, &c->net_ctx);
3705 RESET_OPTION_ROUTES(options->routes_ipv6, routes_ipv6);
3706 }
3707 }
3708 else if (streq(p[0], "route-gateway") && !p[1])
3709 {
3710 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
3711 options->route_gateway_via_dhcp = false;
3712 options->route_default_gateway = NULL;
3713 }
3714 else if (streq(p[0], "route-metric") && !p[1])
3715 {
3716 VERIFY_PERMISSION(OPT_P_ROUTE);
3717 options->route_default_metric = 0;
3718 }
3719 else if (streq(p[0], "push-continuation") && !p[1])
3720 {
3721 VERIFY_PERMISSION(OPT_P_PULL_MODE);
3722 options->push_continuation = 0;
3723 }
3724 else if ((streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private")) && !p[1])
3725 {
3726 VERIFY_PERMISSION(OPT_P_ROUTE);
3727 if (options->routes)
3728 {
3729 options->routes->flags = 0;
3730 }
3731 if (options->routes_ipv6)
3732 {
3733 options->routes_ipv6->flags = 0;
3734 }
3735 env_set_del(es, "route_redirect_gateway_ipv4");
3736 env_set_del(es, "route_redirect_gateway_ipv6");
3737 }
3738 else if (streq(p[0], "dns") && !p[1])
3739 {
3740 VERIFY_PERMISSION(OPT_P_DHCPDNS);
3741 gc_free(&options->dns_options.gc);
3742 CLEAR(options->dns_options);
3743 }
3744 else if (streq(p[0], "topology") && !p[1])
3745 {
3746 VERIFY_PERMISSION(OPT_P_UP);
3747 options->topology = TOP_UNDEF;
3748 helper_setdefault_topology(options);
3749 }
3750 else if (streq(p[0], "tun-mtu") && !p[1])
3751 {
3752 VERIFY_PERMISSION(OPT_P_PUSH_MTU | OPT_P_CONNECTION);
3753 options->ce.tun_mtu = TUN_MTU_DEFAULT;
3754 options->ce.tun_mtu_defined = false;
3755 options->ce.occ_mtu = 0;
3756 }
3757 else if (streq(p[0], "block-ipv6") && !p[1])
3758 {
3759 VERIFY_PERMISSION(OPT_P_ROUTE);
3760 options->block_ipv6 = false;
3761 }
3762#if defined(_WIN32) || defined(TARGET_ANDROID)
3763 else if (streq(p[0], "dhcp-option") && !p[1])
3764 {
3765 struct tuntap_options *o = &options->tuntap_options;
3766 VERIFY_PERMISSION(OPT_P_DHCPDNS);
3767
3768 o->domain = NULL;
3769 o->netbios_scope = NULL;
3770 o->netbios_node_type = 0;
3771 o->dns6_len = 0;
3772 memset(o->dns6, 0, sizeof(o->dns6));
3773 o->dns_len = 0;
3774 memset(o->dns, 0, sizeof(o->dns));
3775 o->wins_len = 0;
3776 memset(o->wins, 0, sizeof(o->wins));
3777 o->ntp_len = 0;
3778 memset(o->ntp, 0, sizeof(o->ntp));
3779 o->nbdd_len = 0;
3780 memset(o->nbdd, 0, sizeof(o->nbdd));
3781 o->domain_search_list_len = 0;
3782 CLEAR(o->domain_search_list);
3783 o->disable_nbt = 0;
3784 o->dhcp_options = 0;
3785 CLEAR(options->dns_options.from_dhcp);
3786
3787#if defined(TARGET_ANDROID)
3788 o->http_proxy_port = 0;
3789 o->http_proxy = NULL;
3790#endif
3791 }
3792#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
3793#ifdef _WIN32
3794 else if (streq(p[0], "block-outside-dns") && !p[1])
3795 {
3796 VERIFY_PERMISSION(OPT_P_DHCPDNS);
3797 options->block_outside_dns = false;
3798 }
3799#else /* ifdef _WIN32 */
3800 else if (streq(p[0], "dhcp-option") && !p[1])
3801 {
3802 VERIFY_PERMISSION(OPT_P_DHCPDNS);
3803 delete_all_dhcp_fo(options, &es->list);
3804 }
3805#endif
3806 else
3807 {
3808 msglvl_t msglevel_unknown = msglevel_fc;
3809 /* Check if an option is in --ignore-unknown-option and
3810 * set warning level to non fatal */
3811 for (int i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
3812 {
3813 if (streq(p[0], options->ignore_unknown_option[i]))
3814 {
3815 msglevel_unknown = M_WARN;
3816 break;
3817 }
3818 }
3819 msg(msglevel_unknown,
3820 "Unrecognized option or missing or extra parameter(s) in %s:%d: -%s (%s)", file, line,
3821 p[0], PACKAGE_VERSION);
3822 }
3823 return;
3824err:
3825 msg(msglevel, "Error occurred trying to remove %s option", p[0]);
3826}
3827
3828
3829static bool
3830check_route_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
3831{
3832 rol_check_alloc(options);
3833 if (pull_mode)
3834 {
3835 if (!ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
3836 && !is_special_addr(p[1])) /* FQDN -- may be DNS name */
3837 {
3838 msg(msglevel, "route parameter network/IP '%s' must be a valid address", p[1]);
3839 return false;
3840 }
3841 if (p[2] && !ip_addr_dotted_quad_safe(p[2])) /* FQDN -- must be IP address */
3842 {
3843 msg(msglevel, "route parameter netmask '%s' must be an IP address", p[2]);
3844 return false;
3845 }
3846 if (p[3] && !ip_or_dns_addr_safe(p[3], options->allow_pull_fqdn)
3847 && !is_special_addr(p[3])) /* FQDN -- may be DNS name */
3848 {
3849 msg(msglevel, "route parameter gateway '%s' must be a valid address", p[3]);
3850 return false;
3851 }
3852 }
3853 return true;
3854}
3855
3856
3857static bool
3858check_route6_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
3859{
3860 rol6_check_alloc(options);
3861 if (pull_mode)
3862 {
3863 if (!ipv6_addr_safe_hexplusbits(p[1]))
3864 {
3865 msg(msglevel, "route-ipv6 parameter network/IP '%s' must be a valid address", p[1]);
3866 return false;
3867 }
3868 if (p[2] && !ipv6_addr_safe(p[2]))
3869 {
3870 msg(msglevel, "route-ipv6 parameter gateway '%s' must be a valid address", p[2]);
3871 return false;
3872 }
3873 /* p[3] is metric, if present */
3874 }
3875 return true;
3876}
3877
3878static bool
3879check_dns_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
3880{
3881 if (streq(p[1], "search-domains") && p[2])
3882 {
3883 if (!dns_domain_list_append(&options->dns_options.search_domains, &p[2],
3884 &options->dns_options.gc))
3885 {
3886 msg(msglevel, "--dns %s contain invalid characters", p[1]);
3887 return false;
3888 }
3889 }
3890 else if (streq(p[1], "server") && p[2] && p[3] && p[4])
3891 {
3892 long priority;
3893 if (!dns_server_priority_parse(&priority, p[2], pull_mode))
3894 {
3895 msg(msglevel, "--dns server: invalid priority value '%s'", p[2]);
3896 return false;
3897 }
3898
3899 struct dns_server *server =
3900 dns_server_get(&options->dns_options.servers, priority, &options->dns_options.gc);
3901
3902 if (streq(p[3], "address"))
3903 {
3904 for (int i = 4; p[i]; ++i)
3905 {
3906 if (!dns_server_addr_parse(server, p[i]))
3907 {
3908 msg(msglevel, "--dns server %ld: malformed address or maximum exceeded '%s'",
3909 priority, p[i]);
3910 return false;
3911 }
3912 }
3913 }
3914 else if (streq(p[3], "resolve-domains"))
3915 {
3916 if (!dns_domain_list_append(&server->domains, &p[4], &options->dns_options.gc))
3917 {
3918 msg(msglevel, "--dns server %ld: %s contain invalid characters", priority, p[3]);
3919 return false;
3920 }
3921 }
3922 else if (streq(p[3], "dnssec") && !p[5])
3923 {
3924 if (streq(p[4], "yes"))
3925 {
3926 server->dnssec = DNS_SECURITY_YES;
3927 }
3928 else if (streq(p[4], "no"))
3929 {
3930 server->dnssec = DNS_SECURITY_NO;
3931 }
3932 else if (streq(p[4], "optional"))
3933 {
3934 server->dnssec = DNS_SECURITY_OPTIONAL;
3935 }
3936 else
3937 {
3938 msg(msglevel, "--dns server %ld: malformed dnssec value '%s'", priority, p[4]);
3939 return false;
3940 }
3941 }
3942 else if (streq(p[3], "transport") && !p[5])
3943 {
3944 if (streq(p[4], "plain"))
3945 {
3946 server->transport = DNS_TRANSPORT_PLAIN;
3947 }
3948 else if (streq(p[4], "DoH"))
3949 {
3950 server->transport = DNS_TRANSPORT_HTTPS;
3951 }
3952 else if (streq(p[4], "DoT"))
3953 {
3954 server->transport = DNS_TRANSPORT_TLS;
3955 }
3956 else
3957 {
3958 msg(msglevel, "--dns server %ld: malformed transport value '%s'", priority, p[4]);
3959 return false;
3960 }
3961 }
3962 else if (streq(p[3], "sni") && !p[5])
3963 {
3964 if (!validate_domain(p[4]))
3965 {
3966 msg(msglevel, "--dns server %ld: %s contains invalid characters", priority, p[3]);
3967 return false;
3968 }
3969 server->sni = p[4];
3970 }
3971 else
3972 {
3973 msg(msglevel,
3974 "--dns server %ld: unknown option type '%s' or missing or unknown parameter",
3975 priority, p[3]);
3976 return false;
3977 }
3978 }
3979 else
3980 {
3981 msg(msglevel, "--dns: unknown option type '%s' or missing or unknown parameter", p[1]);
3982 return false;
3983 }
3984 return true;
3985}
3986
3987void
3988update_option(struct context *c, struct options *options, char *p[], bool is_inline,
3989 const char *file, int line, const int level, const msglvl_t msglevel,
3990 const uint64_t permission_mask, uint64_t *option_types_found,
3991 struct env_set *es)
3992{
3993 const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
3994 ASSERT(MAX_PARMS >= 7);
3995
3996 if (streq(p[0], "route") && p[1] && !p[5])
3997 {
3998 if (!(options->push_update_options_found & OPT_P_U_ROUTE))
3999 {
4000 VERIFY_PERMISSION(OPT_P_ROUTE);
4001 if (!check_route_option(options, p, msglevel, pull_mode))
4002 {
4003 goto err;
4004 }
4005 if (c->c1.route_list)
4006 {
4007 delete_routes_v4(c->c1.route_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options),
4008 es, &c->net_ctx);
4009 RESET_OPTION_ROUTES(options->routes, routes);
4010 }
4011 options->push_update_options_found |= OPT_P_U_ROUTE;
4012 }
4013 }
4014 else if (streq(p[0], "route-ipv6") && p[1] && !p[4])
4015 {
4016 if (!(options->push_update_options_found & OPT_P_U_ROUTE6))
4017 {
4018 VERIFY_PERMISSION(OPT_P_ROUTE);
4019 if (!check_route6_option(options, p, msglevel, pull_mode))
4020 {
4021 goto err;
4022 }
4023 if (c->c1.route_ipv6_list)
4024 {
4025 delete_routes_v6(c->c1.route_ipv6_list, c->c1.tuntap,
4026 ROUTE_OPTION_FLAGS(&c->options), es, &c->net_ctx);
4027 RESET_OPTION_ROUTES(options->routes_ipv6, routes_ipv6);
4028 }
4029 options->push_update_options_found |= OPT_P_U_ROUTE6;
4030 }
4031 }
4032 else if (streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private"))
4033 {
4034 if (!(options->push_update_options_found & OPT_P_U_REDIR_GATEWAY))
4035 {
4036 VERIFY_PERMISSION(OPT_P_ROUTE);
4037 if (options->routes)
4038 {
4039 options->routes->flags = 0;
4040 }
4041 if (options->routes_ipv6)
4042 {
4043 options->routes_ipv6->flags = 0;
4044 }
4045 env_set_del(es, "route_redirect_gateway_ipv4");
4046 env_set_del(es, "route_redirect_gateway_ipv6");
4047 options->push_update_options_found |= OPT_P_U_REDIR_GATEWAY;
4048 }
4049 }
4050 else if (streq(p[0], "dns") && p[1])
4051 {
4052 if (!(options->push_update_options_found & OPT_P_U_DNS))
4053 {
4054 VERIFY_PERMISSION(OPT_P_DHCPDNS);
4055 if (!check_dns_option(options, p, msglevel, pull_mode))
4056 {
4057 goto err;
4058 }
4059 gc_free(&options->dns_options.gc);
4060 CLEAR(options->dns_options);
4061 options->push_update_options_found |= OPT_P_U_DNS;
4062 }
4063 }
4064#if defined(_WIN32) || defined(TARGET_ANDROID)
4065 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
4066 {
4067 if (!(options->push_update_options_found & OPT_P_U_DHCP))
4068 {
4069 struct tuntap_options *o = &options->tuntap_options;
4070 VERIFY_PERMISSION(OPT_P_DHCPDNS);
4071
4072 o->domain = NULL;
4073 o->netbios_scope = NULL;
4074 o->netbios_node_type = 0;
4075 o->dns6_len = 0;
4076 CLEAR(o->dns6);
4077 o->dns_len = 0;
4078 CLEAR(o->dns);
4079 o->wins_len = 0;
4080 CLEAR(o->wins);
4081 o->ntp_len = 0;
4082 CLEAR(o->ntp);
4083 o->nbdd_len = 0;
4084 CLEAR(o->nbdd);
4085 o->domain_search_list_len = 0;
4086 CLEAR(o->domain_search_list);
4087 o->disable_nbt = 0;
4088 o->dhcp_options = 0;
4089
4090 CLEAR(options->dns_options.from_dhcp);
4091#if defined(TARGET_ANDROID)
4092 o->http_proxy_port = 0;
4093 o->http_proxy = NULL;
4094#endif
4095 options->push_update_options_found |= OPT_P_U_DHCP;
4096 }
4097 }
4098#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
4099 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
4100 {
4101 if (!(options->push_update_options_found & OPT_P_U_DHCP))
4102 {
4103 VERIFY_PERMISSION(OPT_P_DHCPDNS);
4104 delete_all_dhcp_fo(options, &es->list);
4105 options->push_update_options_found |= OPT_P_U_DHCP;
4106 }
4107 }
4108#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
4109 add_option(options, p, is_inline, file, line, level, msglevel, permission_mask,
4110 option_types_found, es);
4111 return;
4112err:
4113 msg(msglevel, "Error occurred trying to update %s option", p[0]);
4114}
4115
4116static void
4117set_user_script(struct options *options, const char **script, const char *new_script,
4118 const char *type, bool in_chroot)
4119{
4120 if (*script)
4121 {
4122 msg(M_WARN,
4123 "Multiple --%s scripts defined. "
4124 "The previously configured script is overridden.",
4125 type);
4126 }
4127 *script = new_script;
4128 options->user_script_used = true;
4129
4130#ifndef ENABLE_SMALL
4131 {
4132 char script_name[100];
4133 snprintf(script_name, sizeof(script_name), "--%s script", type);
4134
4135 if (check_cmd_access(*script, script_name, (in_chroot ? options->chroot_dir : NULL)))
4136 {
4137 msg(M_USAGE, "Please correct this error.");
4138 }
4139 }
4140#endif
4141}
4142
4143static void
4144show_compression_warning(struct compress_options *info)
4145{
4146 if (comp_non_stub_enabled(info))
4147 {
4148 msg(M_WARN, "WARNING: Compression for receiving enabled. "
4149 "Compression has been used in the past to break encryption. "
4150 "Compression support is deprecated and we recommend to disable "
4151 "it completely.");
4152 }
4153}
4154
4155bool
4156key_is_external(const struct options *options)
4157{
4158 bool ret = options->management_flags & MF_EXTERNAL_KEY;
4159#ifdef ENABLE_PKCS11
4160 ret = ret || (options->pkcs11_providers[0] != NULL);
4161#endif
4162#ifdef ENABLE_CRYPTOAPI
4163 ret = ret || options->cryptoapi_cert;
4164#endif
4165
4166 return ret;
4167}
4168
4169#if defined(__GNUC__) || defined(__clang__)
4170#pragma GCC diagnostic push
4171#pragma GCC diagnostic ignored "-Wsign-compare"
4172#endif
4173
4174void
4175add_option(struct options *options, char *p[], bool is_inline, const char *file, int line,
4176 const int level, const msglvl_t msglevel, const uint64_t permission_mask,
4177 uint64_t *option_types_found, struct env_set *es)
4178{
4179 struct gc_arena gc = gc_new();
4180 const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
4181 msglvl_t msglevel_fc = msglevel_forward_compatible(options, msglevel);
4182
4183 ASSERT(MAX_PARMS >= 7);
4184
4185 /*
4186 * If directive begins with "setenv opt" prefix, don't raise an error if
4187 * directive is unrecognized.
4188 */
4189 if (streq(p[0], "setenv") && p[1] && streq(p[1], "opt") && !(permission_mask & OPT_P_PULL_MODE))
4190 {
4191 if (!p[2])
4192 {
4193 p[2] = "setenv opt"; /* will trigger an error that includes setenv opt */
4194 }
4195 p += 2;
4196 msglevel_fc = M_WARN;
4197 }
4198
4199 if (!file)
4200 {
4201 file = "[CMD-LINE]";
4202 line = 1;
4203 }
4204 if (streq(p[0], "help"))
4205 {
4206 VERIFY_PERMISSION(OPT_P_GENERAL);
4207 usage();
4208 if (p[1])
4209 {
4210 msg(msglevel, "--help does not accept any parameters");
4211 goto err;
4212 }
4213 }
4214 if (streq(p[0], "version") && !p[1])
4215 {
4216 VERIFY_PERMISSION(OPT_P_GENERAL);
4217 usage_version();
4218 }
4219 else if (streq(p[0], "config") && p[1] && !p[2])
4220 {
4221 VERIFY_PERMISSION(OPT_P_CONFIG);
4222
4223 /* save first config file only in options */
4224 if (!options->config)
4225 {
4226 options->config = p[1];
4227 }
4228
4229 read_config_file(options, p[1], level, file, line, msglevel, permission_mask,
4230 option_types_found, es);
4231 }
4232#if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
4233 else if (streq(p[0], "show-gateway") && !p[2])
4234 {
4235 struct route_gateway_info rgi;
4236 struct route_ipv6_gateway_info rgi6;
4237 in_addr_t remote_ipv4 = 0;
4238 struct in6_addr remote_ipv6 = IN6ADDR_ANY_INIT;
4239 openvpn_net_ctx_t net_ctx;
4240 VERIFY_PERMISSION(OPT_P_GENERAL);
4241 if (p[1])
4242 {
4243 /* try parsing the argument as a v4 or v6 address - if
4244 * possible, the output will show the exact route there, and
4245 * "the default route" for the other protocol
4246 */
4247 remote_ipv4 = get_ip_addr(p[1], M_WARN, NULL);
4248 get_ipv6_addr(p[1], &remote_ipv6, NULL, M_WARN);
4249 }
4250 net_ctx_init(NULL, &net_ctx);
4251 get_default_gateway(&rgi, remote_ipv4, &net_ctx);
4252 get_default_gateway_ipv6(&rgi6, &remote_ipv6, &net_ctx);
4253 print_default_gateway(M_INFO, &rgi, &rgi6);
4254 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
4255 }
4256#endif
4257 else if (streq(p[0], "echo") || streq(p[0], "parameter"))
4258 {
4259 struct buffer string = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
4260 int j;
4261 bool good = true;
4262
4263 VERIFY_PERMISSION(OPT_P_ECHO);
4264
4265 for (j = 1; j < MAX_PARMS; ++j)
4266 {
4267 if (!p[j])
4268 {
4269 break;
4270 }
4271 if (j > 1)
4272 {
4273 good &= buf_printf(&string, " ");
4274 }
4275 good &= buf_printf(&string, "%s", p[j]);
4276 }
4277 if (good)
4278 {
4279 /* only message-related ECHO are logged, since other ECHOs
4280 * can potentially include security-sensitive strings */
4281 if (p[1] && strncmp(p[1], "msg", 3) == 0)
4282 {
4283 msg(M_INFO, "%s:%s", pull_mode ? "ECHO-PULL" : "ECHO", BSTR(&string));
4284 }
4285#ifdef ENABLE_MANAGEMENT
4286 if (management)
4287 {
4288 management_echo(management, BSTR(&string), pull_mode);
4289 }
4290#endif
4291 }
4292 else
4293 {
4294 msg(M_WARN, "echo/parameter option overflow");
4295 }
4296 }
4297#ifdef ENABLE_MANAGEMENT
4298 else if (streq(p[0], "management") && p[1] && p[2] && !p[4])
4299 {
4300 VERIFY_PERMISSION(OPT_P_GENERAL);
4301 if (streq(p[2], "unix"))
4302 {
4303#if UNIX_SOCK_SUPPORT
4304 options->management_flags |= MF_UNIX_SOCK;
4305#else
4306 msg(msglevel, "MANAGEMENT: this platform does not support unix domain sockets");
4307 goto err;
4308#endif
4309 }
4310
4311 options->management_addr = p[1];
4312 options->management_port = p[2];
4313 if (p[3])
4314 {
4315 options->management_user_pass = p[3];
4316 }
4317 }
4318 else if (streq(p[0], "management-client-user") && p[1] && !p[2])
4319 {
4320 VERIFY_PERMISSION(OPT_P_GENERAL);
4321 options->management_client_user = p[1];
4322 }
4323 else if (streq(p[0], "management-client-group") && p[1] && !p[2])
4324 {
4325 VERIFY_PERMISSION(OPT_P_GENERAL);
4326 options->management_client_group = p[1];
4327 }
4328 else if (streq(p[0], "management-query-passwords") && !p[1])
4329 {
4330 VERIFY_PERMISSION(OPT_P_GENERAL);
4331 options->management_flags |= MF_QUERY_PASSWORDS;
4332 }
4333 else if (streq(p[0], "management-query-remote") && !p[1])
4334 {
4335 VERIFY_PERMISSION(OPT_P_GENERAL);
4336 options->management_flags |= MF_QUERY_REMOTE;
4337 }
4338 else if (streq(p[0], "management-query-proxy") && !p[1])
4339 {
4340 VERIFY_PERMISSION(OPT_P_GENERAL);
4341 options->management_flags |= MF_QUERY_PROXY;
4342 }
4343 else if (streq(p[0], "management-hold") && !p[1])
4344 {
4345 VERIFY_PERMISSION(OPT_P_GENERAL);
4346 options->management_flags |= MF_HOLD;
4347 }
4348 else if (streq(p[0], "management-signal") && !p[1])
4349 {
4350 VERIFY_PERMISSION(OPT_P_GENERAL);
4351 options->management_flags |= MF_SIGNAL;
4352 }
4353 else if (streq(p[0], "management-forget-disconnect") && !p[1])
4354 {
4355 VERIFY_PERMISSION(OPT_P_GENERAL);
4356 options->management_flags |= MF_FORGET_DISCONNECT;
4357 }
4358 else if (streq(p[0], "management-up-down") && !p[1])
4359 {
4360 VERIFY_PERMISSION(OPT_P_GENERAL);
4361 options->management_flags |= MF_UP_DOWN;
4362 }
4363 else if (streq(p[0], "management-client") && !p[1])
4364 {
4365 VERIFY_PERMISSION(OPT_P_GENERAL);
4366 options->management_flags |= MF_CONNECT_AS_CLIENT;
4367 }
4368 else if (streq(p[0], "management-external-key"))
4369 {
4370 VERIFY_PERMISSION(OPT_P_GENERAL);
4371 for (int j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
4372 {
4373 if (streq(p[j], "nopadding"))
4374 {
4375 options->management_flags |= MF_EXTERNAL_KEY_NOPADDING;
4376 }
4377 else if (streq(p[j], "pkcs1"))
4378 {
4379 options->management_flags |= MF_EXTERNAL_KEY_PKCS1PAD;
4380 }
4381 else if (streq(p[j], "pss"))
4382 {
4383 options->management_flags |= MF_EXTERNAL_KEY_PSSPAD;
4384 }
4385 else if (streq(p[j], "digest"))
4386 {
4387 options->management_flags |= MF_EXTERNAL_KEY_DIGEST;
4388 }
4389 else
4390 {
4391 msg(msglevel, "Unknown management-external-key flag: %s", p[j]);
4392 }
4393 }
4394 /*
4395 * When no option is present, assume that only PKCS1
4396 * padding is supported
4397 */
4398 if (!(options->management_flags & (MF_EXTERNAL_KEY_NOPADDING | MF_EXTERNAL_KEY_PKCS1PAD)))
4399 {
4400 options->management_flags |= MF_EXTERNAL_KEY_PKCS1PAD;
4401 }
4402 options->management_flags |= MF_EXTERNAL_KEY;
4403 }
4404 else if (streq(p[0], "management-external-cert") && p[1] && !p[2])
4405 {
4406 VERIFY_PERMISSION(OPT_P_GENERAL);
4407 options->management_flags |= MF_EXTERNAL_CERT;
4408 options->management_certificate = p[1];
4409 }
4410 else if (streq(p[0], "management-client-auth") && !p[1])
4411 {
4412 VERIFY_PERMISSION(OPT_P_GENERAL);
4413 options->management_flags |= MF_CLIENT_AUTH;
4414 }
4415 else if (streq(p[0], "management-log-cache") && p[1] && !p[2])
4416 {
4417 VERIFY_PERMISSION(OPT_P_GENERAL);
4418 if (!atoi_constrained(p[1], &options->management_log_history_cache,
4419 p[0], 1, INT_MAX, msglevel))
4420 {
4421 goto err;
4422 }
4423 }
4424#endif /* ifdef ENABLE_MANAGEMENT */
4425#ifdef ENABLE_PLUGIN
4426 else if (streq(p[0], "plugin") && p[1])
4427 {
4428 VERIFY_PERMISSION(OPT_P_PLUGIN);
4429 if (!options->plugin_list)
4430 {
4431 options->plugin_list = plugin_option_list_new(&options->gc);
4432 }
4433 if (!plugin_option_list_add(options->plugin_list, &p[1], &options->gc))
4434 {
4435 msg(msglevel, "plugin add failed: %s", p[1]);
4436 goto err;
4437 }
4438 }
4439#endif
4440 else if (streq(p[0], "mode") && p[1] && !p[2])
4441 {
4442 VERIFY_PERMISSION(OPT_P_GENERAL);
4443 if (streq(p[1], "p2p"))
4444 {
4445 options->mode = MODE_POINT_TO_POINT;
4446 }
4447 else if (streq(p[1], "server"))
4448 {
4449 options->mode = MODE_SERVER;
4450 }
4451 else
4452 {
4453 msg(msglevel, "Bad --mode parameter: %s", p[1]);
4454 goto err;
4455 }
4456 }
4457 else if (streq(p[0], "dev") && p[1] && !p[2])
4458 {
4459 VERIFY_PERMISSION(OPT_P_GENERAL);
4460 options->dev = p[1];
4461 }
4462 else if (streq(p[0], "dev-type") && p[1] && !p[2])
4463 {
4464 VERIFY_PERMISSION(OPT_P_GENERAL);
4465 options->dev_type = p[1];
4466 }
4467#ifdef _WIN32
4468 else if (streq(p[0], "windows-driver") && p[1] && !p[2])
4469 {
4470 VERIFY_PERMISSION(OPT_P_GENERAL);
4471 msg(M_WARN,
4472 "DEPRECATED OPTION: windows-driver: In OpenVPN 2.7, the default Windows driver is ovpn-dco. "
4473 "If incompatible options are used, OpenVPN will fall back to tap-windows6. Wintun support has been removed.");
4474 }
4475#endif
4476 else if (streq(p[0], "disable-dco"))
4477 {
4478 options->disable_dco = true;
4479 }
4480 else if (streq(p[0], "dev-node") && p[1] && !p[2])
4481 {
4482 VERIFY_PERMISSION(OPT_P_GENERAL);
4483 options->dev_node = p[1];
4484 }
4485 else if (streq(p[0], "lladdr") && p[1] && !p[2])
4486 {
4487 VERIFY_PERMISSION(OPT_P_UP);
4488 if (mac_addr_safe(p[1])) /* MAC address only */
4489 {
4490 options->lladdr = p[1];
4491 }
4492 else
4493 {
4494 msg(msglevel, "lladdr parm '%s' must be a MAC address", p[1]);
4495 goto err;
4496 }
4497 }
4498 else if (streq(p[0], "topology") && p[1] && !p[2])
4499 {
4500 VERIFY_PERMISSION(OPT_P_UP);
4501 options->topology = parse_topology(p[1], msglevel);
4502 }
4503 else if (streq(p[0], "tun-ipv6") && !p[1])
4504 {
4505 if (!pull_mode)
4506 {
4507 msg(M_WARN,
4508 "Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.");
4509 }
4510 }
4511#ifdef ENABLE_IPROUTE
4512 else if (streq(p[0], "iproute") && p[1] && !p[2])
4513 {
4514 VERIFY_PERMISSION(OPT_P_GENERAL);
4515 iproute_path = p[1];
4516 }
4517#endif
4518 else if (streq(p[0], "ifconfig") && p[1] && p[2] && !p[3])
4519 {
4520 VERIFY_PERMISSION(OPT_P_UP);
4521 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
4522 && ip_or_dns_addr_safe(p[2], options->allow_pull_fqdn)) /* FQDN -- may be DNS name */
4523 {
4524 options->ifconfig_local = p[1];
4525 options->ifconfig_remote_netmask = p[2];
4526 }
4527 else
4528 {
4529 msg(msglevel, "ifconfig parms '%s' and '%s' must be valid addresses", p[1], p[2]);
4530 goto err;
4531 }
4532 }
4533 else if (streq(p[0], "ifconfig-ipv6") && p[1] && p[2] && !p[3])
4534 {
4535 unsigned int netbits;
4536
4537 VERIFY_PERMISSION(OPT_P_UP);
4538 if (get_ipv6_addr(p[1], NULL, &netbits, msglevel) && ipv6_addr_safe(p[2]))
4539 {
4540 if (netbits < 64 || netbits > 124)
4541 {
4542 msg(msglevel, "ifconfig-ipv6: /netbits must be between 64 and 124, not '/%d'",
4543 netbits);
4544 goto err;
4545 }
4546
4547 options->ifconfig_ipv6_local = get_ipv6_addr_no_netbits(p[1], &options->gc);
4548 options->ifconfig_ipv6_netbits = netbits;
4549 options->ifconfig_ipv6_remote = p[2];
4550 }
4551 else
4552 {
4553 msg(msglevel, "ifconfig-ipv6 parms '%s' and '%s' must be valid addresses", p[1], p[2]);
4554 goto err;
4555 }
4556 }
4557 else if (streq(p[0], "ifconfig-noexec") && !p[1])
4558 {
4559 VERIFY_PERMISSION(OPT_P_UP);
4560 options->ifconfig_noexec = true;
4561 }
4562 else if (streq(p[0], "ifconfig-nowarn") && !p[1])
4563 {
4564 VERIFY_PERMISSION(OPT_P_UP);
4565 options->ifconfig_nowarn = true;
4566 }
4567 else if (streq(p[0], "local") && p[1] && !p[4])
4568 {
4569 struct local_entry *e;
4570
4571 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4572
4573 e = alloc_local_entry(&options->ce, M_USAGE, &options->gc);
4574 ASSERT(e);
4575
4576 /* '*' is treated as 'ask the system to get some socket',
4577 * therefore force binding on a particular address only when
4578 * actually specified. */
4579 if (strcmp(p[1], "*") != 0)
4580 {
4581 e->local = p[1];
4582 }
4583
4584 if (p[2])
4585 {
4586 e->port = p[2];
4587 }
4588
4589 if (p[3])
4590 {
4591 e->proto = ascii2proto(p[3]);
4592 }
4593 }
4594 else if (streq(p[0], "remote-random") && !p[1])
4595 {
4596 VERIFY_PERMISSION(OPT_P_GENERAL);
4597 options->remote_random = true;
4598 }
4599 else if (streq(p[0], "connection") && p[1] && !p[3])
4600 {
4601 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
4602 if (is_inline)
4603 {
4604 struct options sub;
4605 struct connection_entry *e;
4606
4607 init_options(&sub);
4608 sub.ce = options->ce;
4609 read_config_string("[CONNECTION-OPTIONS]", &sub, p[1], msglevel, OPT_P_CONNECTION,
4610 option_types_found, es);
4611 if (!sub.ce.remote)
4612 {
4613 msg(msglevel,
4614 "Each 'connection' block must contain exactly one 'remote' directive");
4615 uninit_options(&sub);
4616 goto err;
4617 }
4618
4619 e = alloc_connection_entry(options, msglevel);
4620 if (!e)
4621 {
4622 uninit_options(&sub);
4623 goto err;
4624 }
4625 *e = sub.ce;
4626 gc_transfer(&options->gc, &sub.gc);
4627 uninit_options(&sub);
4628 }
4629 }
4630 else if (streq(p[0], "ignore-unknown-option") && p[1])
4631 {
4632 int i;
4633 int j;
4634 int numignored = 0;
4635 const char **ignore;
4636
4637 VERIFY_PERMISSION(OPT_P_GENERAL);
4638 /* Find out how many options to be ignored */
4639 for (i = 1; p[i]; i++)
4640 {
4641 numignored++;
4642 }
4643
4644 /* add number of options already ignored */
4645 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
4646 {
4647 numignored++;
4648 }
4649
4650 /* Allocate array */
4651 ALLOC_ARRAY_GC(ignore, const char *, numignored + 1, &options->gc);
4652 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
4653 {
4654 ignore[i] = options->ignore_unknown_option[i];
4655 }
4656
4657 options->ignore_unknown_option = ignore;
4658
4659 for (j = 1; p[j]; j++)
4660 {
4661 /* Allow the user to specify ignore-unknown-option --opt too */
4662 if (p[j][0] == '-' && p[j][1] == '-')
4663 {
4664 options->ignore_unknown_option[i] = (p[j] + 2);
4665 }
4666 else
4667 {
4668 options->ignore_unknown_option[i] = p[j];
4669 }
4670 i++;
4671 }
4672
4673 options->ignore_unknown_option[i] = NULL;
4674 }
4675#if ENABLE_MANAGEMENT
4676 else if (streq(p[0], "http-proxy-override") && p[1] && p[2] && !p[4])
4677 {
4678 VERIFY_PERMISSION(OPT_P_GENERAL);
4679 options->http_proxy_override = parse_http_proxy_override(p[1], p[2], p[3], &options->gc);
4680 if (!options->http_proxy_override)
4681 {
4682 goto err;
4683 }
4684 }
4685#endif
4686 else if (streq(p[0], "remote") && p[1] && !p[4])
4687 {
4688 struct remote_entry re;
4689 re.remote = re.remote_port = NULL;
4690 re.proto = -1;
4691 re.af = 0;
4692
4693 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4694 re.remote = p[1];
4695 if (p[2])
4696 {
4697 re.remote_port = p[2];
4698 if (p[3])
4699 {
4700 const int proto = ascii2proto(p[3]);
4701 const sa_family_t af = ascii2af(p[3]);
4702 if (proto < 0)
4703 {
4704 msg(msglevel, "remote: bad protocol associated with host %s: '%s'", p[1], p[3]);
4705 goto err;
4706 }
4707 re.proto = proto;
4708 re.af = af;
4709 }
4710 }
4711 if (permission_mask & OPT_P_GENERAL)
4712 {
4713 struct remote_entry *e = alloc_remote_entry(options, msglevel);
4714 if (!e)
4715 {
4716 goto err;
4717 }
4718 *e = re;
4719 }
4720 else if (permission_mask & OPT_P_CONNECTION)
4721 {
4722 connection_entry_load_re(&options->ce, &re);
4723 }
4724 }
4725 else if (streq(p[0], "resolv-retry") && p[1] && !p[2])
4726 {
4727 VERIFY_PERMISSION(OPT_P_GENERAL);
4728 if (streq(p[1], "infinite"))
4729 {
4730 options->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
4731 }
4732 else
4733 {
4734 options->resolve_retry_seconds = positive_atoi(p[1], msglevel);
4735 }
4736 }
4737 else if ((streq(p[0], "preresolve") || streq(p[0], "ip-remote-hint")) && !p[2])
4738 {
4739 VERIFY_PERMISSION(OPT_P_GENERAL);
4740 options->resolve_in_advance = true;
4741 /* Note the ip-remote-hint and the argument p[1] are for
4742 * backward compatibility */
4743 if (p[1])
4744 {
4745 options->ip_remote_hint = p[1];
4746 }
4747 }
4748 else if (streq(p[0], "connect-retry") && p[1] && !p[3])
4749 {
4750 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4751 options->ce.connect_retry_seconds = positive_atoi(p[1], msglevel);
4752 /*
4753 * Limit the base value of retry wait interval to 16 bits to avoid
4754 * overflow when scaled up for exponential backoff
4755 */
4756 if (options->ce.connect_retry_seconds > 0xFFFF)
4757 {
4758 options->ce.connect_retry_seconds = 0xFFFF;
4759 msg(M_WARN, "connect retry wait interval truncated to %d",
4760 options->ce.connect_retry_seconds);
4761 }
4762
4763 if (p[2])
4764 {
4765 options->ce.connect_retry_seconds_max =
4766 max_int(positive_atoi(p[2], msglevel), options->ce.connect_retry_seconds);
4767 }
4768 }
4769 else if ((streq(p[0], "connect-timeout") || streq(p[0], "server-poll-timeout")) && p[1]
4770 && !p[2])
4771 {
4772 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4773 options->ce.connect_timeout = positive_atoi(p[1], msglevel);
4774 }
4775 else if (streq(p[0], "connect-retry-max") && p[1] && !p[2])
4776 {
4777 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4778 options->connect_retry_max = positive_atoi(p[1], msglevel);
4779 }
4780 else if (streq(p[0], "ipchange") && p[1])
4781 {
4782 VERIFY_PERMISSION(OPT_P_SCRIPT);
4783 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
4784 {
4785 goto err;
4786 }
4787 set_user_script(options, &options->ipchange,
4788 string_substitute(p[1], ',', ' ', &options->gc), "ipchange", true);
4789 }
4790 else if (streq(p[0], "float") && !p[1])
4791 {
4792 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4793 options->ce.remote_float = true;
4794 }
4795#ifdef ENABLE_DEBUG
4796 else if (streq(p[0], "gremlin") && p[1] && !p[2])
4797 {
4798 VERIFY_PERMISSION(OPT_P_GENERAL);
4799 options->gremlin = positive_atoi(p[1], msglevel);
4800 }
4801#endif
4802 else if (streq(p[0], "chroot") && p[1] && !p[2])
4803 {
4804 VERIFY_PERMISSION(OPT_P_GENERAL);
4805 options->chroot_dir = p[1];
4806 }
4807 else if (streq(p[0], "cd") && p[1] && !p[2])
4808 {
4809 VERIFY_PERMISSION(OPT_P_GENERAL);
4810 if (platform_chdir(p[1]))
4811 {
4812 msg(M_ERR, "cd to '%s' failed", p[1]);
4813 goto err;
4814 }
4815 options->cd_dir = p[1];
4816 }
4817#ifdef ENABLE_SELINUX
4818 else if (streq(p[0], "setcon") && p[1] && !p[2])
4819 {
4820 VERIFY_PERMISSION(OPT_P_GENERAL);
4821 options->selinux_context = p[1];
4822 }
4823#endif
4824 else if (streq(p[0], "writepid") && p[1] && !p[2])
4825 {
4826 VERIFY_PERMISSION(OPT_P_GENERAL);
4827 options->writepid = p[1];
4828 }
4829 else if (streq(p[0], "up") && p[1])
4830 {
4831 VERIFY_PERMISSION(OPT_P_SCRIPT);
4832 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
4833 {
4834 goto err;
4835 }
4836 set_user_script(options, &options->up_script, p[1], "up", false);
4837 }
4838 else if (streq(p[0], "down") && p[1])
4839 {
4840 VERIFY_PERMISSION(OPT_P_SCRIPT);
4841 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
4842 {
4843 goto err;
4844 }
4845 set_user_script(options, &options->down_script, p[1], "down", true);
4846 }
4847 else if (streq(p[0], "down-pre") && !p[1])
4848 {
4849 VERIFY_PERMISSION(OPT_P_GENERAL);
4850 options->down_pre = true;
4851 }
4852 else if (streq(p[0], "up-delay") && !p[1])
4853 {
4854 VERIFY_PERMISSION(OPT_P_GENERAL);
4855 options->up_delay = true;
4856 }
4857 else if (streq(p[0], "up-restart") && !p[1])
4858 {
4859 VERIFY_PERMISSION(OPT_P_GENERAL);
4860 options->up_restart = true;
4861 }
4862 else if (streq(p[0], "syslog") && !p[2])
4863 {
4864 VERIFY_PERMISSION(OPT_P_GENERAL);
4865 open_syslog(p[1], false);
4866 }
4867 else if (streq(p[0], "daemon") && !p[2])
4868 {
4869 bool didit = false;
4870 VERIFY_PERMISSION(OPT_P_GENERAL);
4871 if (!options->daemon)
4872 {
4873 options->daemon = didit = true;
4874 open_syslog(p[1], false);
4875 }
4876 if (p[1])
4877 {
4878 if (!didit)
4879 {
4880 msg(M_WARN,
4881 "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)",
4882 p[1]);
4883 goto err;
4884 }
4885 }
4886 }
4887 else if (streq(p[0], "log") && p[1] && !p[2])
4888 {
4889 VERIFY_PERMISSION(OPT_P_GENERAL);
4890 options->log = true;
4891 redirect_stdout_stderr(p[1], false);
4892 }
4893 else if (streq(p[0], "suppress-timestamps") && !p[1])
4894 {
4895 VERIFY_PERMISSION(OPT_P_GENERAL);
4896 options->suppress_timestamps = true;
4897 set_suppress_timestamps(true);
4898 }
4899 else if (streq(p[0], "machine-readable-output") && !p[1])
4900 {
4901 VERIFY_PERMISSION(OPT_P_GENERAL);
4902 options->machine_readable_output = true;
4903 set_machine_readable_output(true);
4904 }
4905 else if (streq(p[0], "log-append") && p[1] && !p[2])
4906 {
4907 VERIFY_PERMISSION(OPT_P_GENERAL);
4908 options->log = true;
4909 redirect_stdout_stderr(p[1], true);
4910 }
4911 else if (streq(p[0], "mlock") && !p[1])
4912 {
4913 VERIFY_PERMISSION(OPT_P_GENERAL);
4914 options->mlock = true;
4915 }
4916#if ENABLE_IP_PKTINFO
4917 else if (streq(p[0], "multihome") && !p[2])
4918 {
4919 VERIFY_PERMISSION(OPT_P_GENERAL);
4920 options->sockflags |= SF_USE_IP_PKTINFO;
4921 if (p[1] && streq(p[1], "same-interface"))
4922 {
4923 options->sockflags |= SF_PKTINFO_COPY_IIF;
4924 }
4925 else if (p[1])
4926 {
4927 msg(msglevel, "Unknown parameter to --multihome: %s", p[1]);
4928 }
4929 }
4930#endif
4931 else if (streq(p[0], "verb") && p[1] && !p[2])
4932 {
4933 VERIFY_PERMISSION(OPT_P_MESSAGES);
4934 options->verbosity = positive_atoi(p[1], msglevel);
4935 if (options->verbosity >= (D_TLS_DEBUG_MED & M_DEBUG_LEVEL))
4936 {
4937 /* We pass this flag to the SSL library to avoid
4938 * mbed TLS always generating debug level logging */
4939 options->ssl_flags |= SSLF_TLS_DEBUG_ENABLED;
4940 }
4941#if !defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
4942 /* Warn when a debug verbosity is supplied when built without debug support */
4943 if (options->verbosity >= 7)
4944 {
4945 msg(M_WARN,
4946 "NOTE: debug verbosity (--verb %d) is enabled but this build lacks debug support.",
4947 options->verbosity);
4948 }
4949#endif
4950 }
4951 else if (streq(p[0], "mute") && p[1] && !p[2])
4952 {
4953 VERIFY_PERMISSION(OPT_P_MESSAGES);
4954 options->mute = positive_atoi(p[1], msglevel);
4955 }
4956 else if (streq(p[0], "errors-to-stderr") && !p[1])
4957 {
4958 VERIFY_PERMISSION(OPT_P_MESSAGES);
4959 errors_to_stderr();
4960 }
4961 else if (streq(p[0], "status") && p[1] && !p[3])
4962 {
4963 VERIFY_PERMISSION(OPT_P_GENERAL);
4964 options->status_file = p[1];
4965 if (p[2])
4966 {
4967 options->status_file_update_freq = positive_atoi(p[2], msglevel);
4968 }
4969 }
4970 else if (streq(p[0], "status-version") && p[1] && !p[2])
4971 {
4972 VERIFY_PERMISSION(OPT_P_GENERAL);
4973 if (!atoi_constrained(p[1], &options->status_file_version, p[0], 1, 3, msglevel))
4974 {
4975 goto err;
4976 }
4977 }
4978 else if (streq(p[0], "remap-usr1") && p[1] && !p[2])
4979 {
4980 VERIFY_PERMISSION(OPT_P_GENERAL);
4981 if (streq(p[1], "SIGHUP"))
4982 {
4983 options->remap_sigusr1 = SIGHUP;
4984 }
4985 else if (streq(p[1], "SIGTERM"))
4986 {
4987 options->remap_sigusr1 = SIGTERM;
4988 }
4989 else
4990 {
4991 msg(msglevel, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'");
4992 goto err;
4993 }
4994 }
4995 else if ((streq(p[0], "link-mtu") || streq(p[0], "udp-mtu")) && p[1] && !p[2])
4996 {
4997 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
4998 options->ce.link_mtu = positive_atoi(p[1], msglevel);
4999 options->ce.link_mtu_defined = true;
5000 }
5001 else if (streq(p[0], "tun-mtu") && p[1] && !p[3])
5002 {
5003 VERIFY_PERMISSION(OPT_P_PUSH_MTU | OPT_P_CONNECTION);
5004 if (atoi_constrained(p[1], &options->ce.tun_mtu, "tun-mtu", TUN_MTU_MIN, TUN_MTU_MAX, msglevel))
5005 {
5006 options->ce.tun_mtu_defined = true;
5007 if (p[2])
5008 {
5009 atoi_constrained(p[2], &options->ce.occ_mtu, "tun-mtu occ-mtu", TUN_MTU_MIN, TUN_MTU_MAX, msglevel);
5010 }
5011 else
5012 {
5013 options->ce.occ_mtu = 0;
5014 }
5015 }
5016 }
5017 else if (streq(p[0], "tun-mtu-max") && p[1] && !p[2])
5018 {
5019 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5020 atoi_constrained(p[1], &options->ce.tun_mtu_max, p[0], TUN_MTU_MAX_MIN, TUN_MTU_MAX, msglevel);
5021 }
5022 else if (streq(p[0], "tun-mtu-extra") && p[1] && !p[2])
5023 {
5024 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5025 if (atoi_constrained(p[1], &options->ce.tun_mtu_extra, p[0], 0, TUN_MTU_MAX, msglevel))
5026 {
5027 options->ce.tun_mtu_extra_defined = true;
5028 }
5029 }
5030 else if (streq(p[0], "max-packet-size") && p[1] && !p[2])
5031 {
5032 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5033 int maxmtu = positive_atoi(p[1], msglevel);
5034 options->ce.tls_mtu = constrain_int(maxmtu, TLS_CHANNEL_MTU_MIN, TLS_CHANNEL_BUF_SIZE);
5035
5036 if (maxmtu < TLS_CHANNEL_MTU_MIN || maxmtu > TLS_CHANNEL_BUF_SIZE)
5037 {
5038 msg(M_WARN,
5039 "Note: max-packet-size value outside of allowed "
5040 "control channel packet size (%d to %d), will use %d "
5041 "instead.",
5042 TLS_CHANNEL_MTU_MIN, TLS_CHANNEL_BUF_SIZE, options->ce.tls_mtu);
5043 }
5044
5045 /* also set mssfix maxmtu mtu */
5046 options->ce.mssfix = maxmtu;
5047 options->ce.mssfix_default = false;
5048 options->ce.mssfix_encap = true;
5049 }
5050#ifdef ENABLE_FRAGMENT
5051 else if (streq(p[0], "mtu-dynamic"))
5052 {
5053 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5054 msg(msglevel, "--mtu-dynamic has been replaced by --fragment");
5055 goto err;
5056 }
5057 else if (streq(p[0], "fragment") && p[1] && !p[3])
5058 {
5059 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5060 if (!atoi_constrained(p[1], &options->ce.fragment, p[0], 68, INT_MAX, msglevel))
5061 {
5062 goto err;
5063 }
5064
5065 if (p[2] && streq(p[2], "mtu"))
5066 {
5067 options->ce.fragment_encap = true;
5068 }
5069 else if (p[2])
5070 {
5071 msg(msglevel, "Unknown parameter to --fragment: %s", p[2]);
5072 }
5073 }
5074#endif /* ifdef ENABLE_FRAGMENT */
5075 else if (streq(p[0], "mtu-disc") && p[1] && !p[2])
5076 {
5077 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5078 options->ce.mtu_discover_type = translate_mtu_discover_type_name(p[1]);
5079 }
5080 else if (streq(p[0], "mtu-test") && !p[1])
5081 {
5082 VERIFY_PERMISSION(OPT_P_GENERAL);
5083 options->mtu_test = true;
5084 }
5085 else if (streq(p[0], "nice") && p[1] && !p[2])
5086 {
5087 VERIFY_PERMISSION(OPT_P_NICE);
5088 options->nice = atoi_warn(p[1], msglevel);
5089 }
5090 else if (streq(p[0], "rcvbuf") && p[1] && !p[2])
5091 {
5092 VERIFY_PERMISSION(OPT_P_SOCKBUF);
5093 options->rcvbuf = positive_atoi(p[1], msglevel);
5094 }
5095 else if (streq(p[0], "sndbuf") && p[1] && !p[2])
5096 {
5097 VERIFY_PERMISSION(OPT_P_SOCKBUF);
5098 options->sndbuf = positive_atoi(p[1], msglevel);
5099 }
5100 else if (streq(p[0], "mark") && p[1] && !p[2])
5101 {
5102#if defined(TARGET_LINUX)
5103 VERIFY_PERMISSION(OPT_P_GENERAL);
5104 options->mark = atoi_warn(p[1], msglevel);
5105#endif
5106 }
5107 else if (streq(p[0], "socket-flags"))
5108 {
5109 int j;
5110 VERIFY_PERMISSION(OPT_P_SOCKFLAGS);
5111 for (j = 1; j < MAX_PARMS && p[j]; ++j)
5112 {
5113 /* TCP_NODELAY is enabled by default; the flag is still accepted
5114 * for backwards compatibility but no longer has any effect */
5115 if (!streq(p[j], "TCP_NODELAY"))
5116 {
5117 msg(msglevel, "unknown socket flag: %s", p[j]);
5118 }
5119 }
5120 }
5121#ifdef TARGET_LINUX
5122 else if (streq(p[0], "bind-dev") && p[1])
5123 {
5124 VERIFY_PERMISSION(OPT_P_SOCKFLAGS);
5125 if (strlen(p[1]) < IFNAMSIZ)
5126 {
5127 options->bind_dev = p[1];
5128 }
5129 else
5130 {
5131 msg(msglevel, "argument to --bind-dev is longer than allowed %u", IFNAMSIZ - 1);
5132 goto err;
5133 }
5134 }
5135#endif
5136 else if (streq(p[0], "txqueuelen") && p[1] && !p[2])
5137 {
5138 VERIFY_PERMISSION(OPT_P_GENERAL);
5139#ifdef TARGET_LINUX
5140 options->tuntap_options.txqueuelen = positive_atoi(p[1], msglevel);
5141#else
5142 msg(msglevel, "--txqueuelen not supported on this OS");
5143 goto err;
5144#endif
5145 }
5146 else if (streq(p[0], "shaper") && p[1] && !p[2])
5147 {
5148 VERIFY_PERMISSION(OPT_P_SHAPER);
5149 if (!atoi_constrained(p[1], &options->shaper, p[0], SHAPER_MIN, SHAPER_MAX, msglevel))
5150 {
5151 goto err;
5152 }
5153 }
5154 else if (streq(p[0], "port") && p[1] && !p[2])
5155 {
5156 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5157 options->ce.local_port = options->ce.remote_port = p[1];
5158 }
5159 else if (streq(p[0], "lport") && p[1] && !p[2])
5160 {
5161 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5162
5163 /* only trigger bind() if port is not 0 (or --local is used) */
5164 if (!streq(p[1], "0"))
5165 {
5166 options->ce.local_port_defined = true;
5167 }
5168 options->ce.local_port = p[1];
5169 }
5170 else if (streq(p[0], "rport") && p[1] && !p[2])
5171 {
5172 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5173 options->ce.remote_port = p[1];
5174 }
5175 else if (streq(p[0], "bind") && !p[2])
5176 {
5177 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5178 options->ce.bind_defined = true;
5179 if (p[1] && streq(p[1], "ipv6only"))
5180 {
5181 options->ce.bind_ipv6_only = true;
5182 }
5183 }
5184 else if (streq(p[0], "nobind") && !p[1])
5185 {
5186 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5187 options->ce.bind_local = false;
5188 }
5189 else if (streq(p[0], "fast-io") && !p[1])
5190 {
5191 VERIFY_PERMISSION(OPT_P_GENERAL);
5192 msg(M_WARN, "DEPRECATED OPTION: --fast-io option ignored.");
5193 }
5194 else if (streq(p[0], "inactive") && p[1] && !p[3])
5195 {
5196 VERIFY_PERMISSION(OPT_P_TIMER);
5197 options->inactivity_timeout = positive_atoi(p[1], msglevel);
5198 if (p[2])
5199 {
5200 positive_atoll(p[2], &options->inactivity_minimum_bytes, p[0], msglevel);
5201 if (options->inactivity_minimum_bytes > INT_MAX)
5202 {
5203 msg(M_WARN,
5204 "WARNING: '--inactive' with a 'bytes' value"
5205 " >2 Gbyte was silently ignored in older versions. If "
5206 " your VPN exits unexpectedly with 'Inactivity timeout'"
5207 " in %d seconds, revisit this value.",
5208 options->inactivity_timeout);
5209 }
5210 }
5211 }
5212 else if (streq(p[0], "session-timeout") && p[1] && !p[2])
5213 {
5214 VERIFY_PERMISSION(OPT_P_TIMER);
5215 options->session_timeout = positive_atoi(p[1], msglevel);
5216 }
5217 else if (streq(p[0], "proto") && p[1] && !p[2])
5218 {
5219 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5220 int proto = ascii2proto(p[1]);
5221 sa_family_t af = ascii2af(p[1]);
5222 if (proto < 0)
5223 {
5224 msg(msglevel, "Bad protocol: '%s'. Allowed protocols with --proto option: %s", p[1],
5225 proto2ascii_all(&gc));
5226 goto err;
5227 }
5228 options->ce.proto = proto;
5229 options->ce.af = af;
5230 }
5231 else if (streq(p[0], "proto-force") && p[1] && !p[2])
5232 {
5233 int proto_force;
5234 VERIFY_PERMISSION(OPT_P_GENERAL);
5235 proto_force = ascii2proto(p[1]);
5236 if (proto_force < 0)
5237 {
5238 msg(msglevel, "Bad --proto-force protocol: '%s'", p[1]);
5239 goto err;
5240 }
5241 options->proto_force = proto_force;
5242 }
5243 else if (streq(p[0], "http-proxy") && p[1] && !p[5])
5244 {
5245 struct http_proxy_options *ho;
5246
5247 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5248
5249 {
5250 if (!p[2])
5251 {
5252 msg(msglevel, "http-proxy port number not defined");
5253 goto err;
5254 }
5255
5256 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
5257
5258 ho->server = p[1];
5259 ho->port = p[2];
5260 }
5261
5262 if (p[3])
5263 {
5264 /* auto -- try to figure out proxy addr, port, and type automatically */
5265 /* auto-nct -- disable proxy auth cleartext protocols (i.e. basic auth) */
5266 if (streq(p[3], "auto"))
5267 {
5268 ho->auth_retry = PAR_ALL;
5269 }
5270 else if (streq(p[3], "auto-nct"))
5271 {
5272 ho->auth_retry = PAR_NCT;
5273 }
5274 else
5275 {
5276 ho->auth_method_string = "basic";
5277 ho->auth_file = p[3];
5278
5279 if (p[4])
5280 {
5281 ho->auth_method_string = p[4];
5282 }
5283 }
5284 }
5285 else
5286 {
5287 ho->auth_method_string = "none";
5288 }
5289 }
5290 else if (streq(p[0], "http-proxy-user-pass") && p[1])
5291 {
5292 struct http_proxy_options *ho;
5293 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
5294 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
5295 ho->auth_file_up = p[1];
5296 ho->inline_creds = is_inline;
5297 }
5298 else if (streq(p[0], "http-proxy-retry") || streq(p[0], "socks-proxy-retry") || streq(p[0], "http-proxy-timeout"))
5299 {
5300 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5301 msg(M_WARN, "DEPRECATED OPTION: %s option ignored.", p[0]);
5302 }
5303 else if (streq(p[0], "http-proxy-option") && p[1] && !p[4])
5304 {
5305 struct http_proxy_options *ho;
5306
5307 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5308 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
5309
5310 if (streq(p[1], "VERSION") && p[2] && !p[3])
5311 {
5312 ho->http_version = p[2];
5313 }
5314 else if (streq(p[1], "AGENT") && p[2] && !p[3])
5315 {
5316 ho->user_agent = p[2];
5317 }
5318 else if ((streq(p[1], "EXT1") || streq(p[1], "EXT2") || streq(p[1], "CUSTOM-HEADER"))
5319 && p[2])
5320 {
5321 /* In the wild patched versions use both EXT1/2 and CUSTOM-HEADER
5322 * with either two argument or one */
5323
5324 struct http_custom_header *custom_header = NULL;
5325 int i;
5326 /* Find the first free header */
5327 for (i = 0; i < MAX_CUSTOM_HTTP_HEADER; i++)
5328 {
5329 if (!ho->custom_headers[i].name)
5330 {
5331 custom_header = &ho->custom_headers[i];
5332 break;
5333 }
5334 }
5335 if (!custom_header)
5336 {
5337 msg(msglevel, "Cannot use more than %d http-proxy-option CUSTOM-HEADER : '%s'",
5338 MAX_CUSTOM_HTTP_HEADER, p[1]);
5339 }
5340 else
5341 {
5342 /* We will save p[2] and p[3], the proxy code will detect if
5343 * p[3] is NULL */
5344 custom_header->name = p[2];
5345 custom_header->content = p[3];
5346 }
5347 }
5348 else
5349 {
5350 msg(msglevel, "Bad http-proxy-option or missing or extra parameter: '%s'", p[1]);
5351 }
5352 }
5353 else if (streq(p[0], "socks-proxy") && p[1] && !p[4])
5354 {
5355 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5356
5357 if (p[2])
5358 {
5359 options->ce.socks_proxy_port = p[2];
5360 }
5361 else
5362 {
5363 options->ce.socks_proxy_port = "1080";
5364 }
5365 options->ce.socks_proxy_server = p[1];
5366 options->ce.socks_proxy_authfile = p[3]; /* might be NULL */
5367 }
5368 else if (streq(p[0], "keepalive") && p[1] && p[2] && !p[3])
5369 {
5370 VERIFY_PERMISSION(OPT_P_GENERAL);
5371 atoi_constrained(p[1], &options->keepalive_ping, "keepalive ping",
5372 1, PING_TIMEOUT_MAX, msglevel);
5373 atoi_constrained(p[2], &options->keepalive_timeout, "keepalive timeout",
5374 1, PING_TIMEOUT_MAX, msglevel);
5375 }
5376 else if (streq(p[0], "ping") && p[1] && !p[2])
5377 {
5378 VERIFY_PERMISSION(OPT_P_TIMER);
5379 atoi_constrained(p[1], &options->ping_send_timeout, p[0],
5380 0, PING_TIMEOUT_MAX, msglevel);
5381 }
5382 else if (streq(p[0], "ping-exit") && p[1] && !p[2])
5383 {
5384 VERIFY_PERMISSION(OPT_P_TIMER);
5385 atoi_constrained(p[1], &options->ping_rec_timeout, p[0],
5386 0, PING_TIMEOUT_MAX, msglevel);
5387 options->ping_rec_timeout_action = PING_EXIT;
5388 }
5389 else if (streq(p[0], "ping-restart") && p[1] && !p[2])
5390 {
5391 VERIFY_PERMISSION(OPT_P_TIMER);
5392 atoi_constrained(p[1], &options->ping_rec_timeout, p[0],
5393 0, PING_TIMEOUT_MAX, msglevel);
5394 options->ping_rec_timeout_action = PING_RESTART;
5395 }
5396 else if (streq(p[0], "ping-timer-rem") && !p[1])
5397 {
5398 VERIFY_PERMISSION(OPT_P_TIMER);
5399 options->ping_timer_remote = true;
5400 }
5401 else if (streq(p[0], "explicit-exit-notify") && !p[2])
5402 {
5403 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_EXPLICIT_NOTIFY);
5404 if (p[1])
5405 {
5406 options->ce.explicit_exit_notification = positive_atoi(p[1], msglevel);
5407 }
5408 else
5409 {
5410 options->ce.explicit_exit_notification = 1;
5411 }
5412 }
5413 else if (streq(p[0], "persist-tun") && !p[1])
5414 {
5415 VERIFY_PERMISSION(OPT_P_PERSIST);
5416 options->persist_tun = true;
5417 }
5418 else if (streq(p[0], "persist-key") && !p[1])
5419 {
5420 VERIFY_PERMISSION(OPT_P_PERSIST);
5421 msg(M_WARN, "DEPRECATED OPTION: --persist-key option ignored. "
5422 "Keys are now always persisted across restarts. ");
5423 }
5424 else if (streq(p[0], "persist-local-ip") && !p[1])
5425 {
5426 VERIFY_PERMISSION(OPT_P_PERSIST_IP);
5427 options->persist_local_ip = true;
5428 }
5429 else if (streq(p[0], "persist-remote-ip") && !p[1])
5430 {
5431 VERIFY_PERMISSION(OPT_P_PERSIST_IP);
5432 options->persist_remote_ip = true;
5433 }
5434 else if (streq(p[0], "client-nat") && p[1] && p[2] && p[3] && p[4] && !p[5])
5435 {
5436 VERIFY_PERMISSION(OPT_P_ROUTE);
5437 cnol_check_alloc(options);
5438 add_client_nat_to_option_list(options->client_nat, p[1], p[2], p[3], p[4], msglevel);
5439 }
5440 else if (streq(p[0], "route-table") && p[1] && !p[2])
5441 {
5442#ifndef ENABLE_SITNL
5443 msg(M_WARN, "NOTE: --route-table is supported only on Linux when SITNL is built-in");
5444#endif
5445 VERIFY_PERMISSION(OPT_P_ROUTE_TABLE);
5446 options->route_default_table_id = positive_atoi(p[1], msglevel);
5447 }
5448 else if (streq(p[0], "route") && p[1] && !p[5])
5449 {
5450 VERIFY_PERMISSION(OPT_P_ROUTE);
5451 if (!check_route_option(options, p, msglevel, pull_mode))
5452 {
5453 goto err;
5454 }
5455 add_route_to_option_list(options->routes, p[1], p[2], p[3], p[4],
5456 options->route_default_table_id);
5457 }
5458 else if (streq(p[0], "route-ipv6") && p[1] && !p[4])
5459 {
5460 VERIFY_PERMISSION(OPT_P_ROUTE);
5461 if (!check_route6_option(options, p, msglevel, pull_mode))
5462 {
5463 goto err;
5464 }
5465 add_route_ipv6_to_option_list(options->routes_ipv6, p[1], p[2], p[3],
5466 options->route_default_table_id);
5467 }
5468 else if (streq(p[0], "max-routes") && !p[2])
5469 {
5470 msg(M_WARN, "DEPRECATED OPTION: --max-routes option ignored.");
5471 }
5472 else if (streq(p[0], "route-gateway") && p[1] && !p[2])
5473 {
5474 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
5475 if (streq(p[1], "dhcp"))
5476 {
5477 options->route_gateway_via_dhcp = true;
5478 }
5479 else
5480 {
5481 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
5482 || is_special_addr(p[1])) /* FQDN -- may be DNS name */
5483 {
5484 options->route_default_gateway = p[1];
5485 }
5486 else
5487 {
5488 msg(msglevel, "route-gateway parm '%s' must be a valid address", p[1]);
5489 goto err;
5490 }
5491 }
5492 }
5493 else if (streq(p[0], "route-ipv6-gateway") && p[1] && !p[2])
5494 {
5495 if (ipv6_addr_safe(p[1]))
5496 {
5497 options->route_ipv6_default_gateway = p[1];
5498 }
5499 else
5500 {
5501 msg(msglevel, "route-ipv6-gateway parm '%s' must be a valid address", p[1]);
5502 goto err;
5503 }
5504 }
5505 else if (streq(p[0], "route-metric") && p[1] && !p[2])
5506 {
5507 VERIFY_PERMISSION(OPT_P_ROUTE);
5508 options->route_default_metric = positive_atoi(p[1], msglevel);
5509 }
5510 else if (streq(p[0], "route-delay") && !p[3])
5511 {
5512 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
5513 options->route_delay_defined = true;
5514 if (p[1])
5515 {
5516 options->route_delay = positive_atoi(p[1], msglevel);
5517 if (p[2])
5518 {
5519 options->route_delay_window = positive_atoi(p[2], msglevel);
5520 }
5521 }
5522 else
5523 {
5524 options->route_delay = 0;
5525 }
5526 }
5527 else if (streq(p[0], "route-up") && p[1])
5528 {
5529 VERIFY_PERMISSION(OPT_P_SCRIPT);
5530 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
5531 {
5532 goto err;
5533 }
5534 set_user_script(options, &options->route_script, p[1], "route-up", false);
5535 }
5536 else if (streq(p[0], "route-pre-down") && p[1])
5537 {
5538 VERIFY_PERMISSION(OPT_P_SCRIPT);
5539 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
5540 {
5541 goto err;
5542 }
5543 set_user_script(options, &options->route_predown_script, p[1], "route-pre-down", true);
5544 }
5545 else if (streq(p[0], "route-noexec") && !p[1])
5546 {
5547 VERIFY_PERMISSION(OPT_P_SCRIPT);
5548 options->route_noexec = true;
5549 }
5550 else if (streq(p[0], "route-nopull") && !p[1])
5551 {
5552 VERIFY_PERMISSION(OPT_P_GENERAL);
5553 options->route_nopull = true;
5554 }
5555 else if (streq(p[0], "pull-filter") && p[1] && p[2] && !p[3])
5556 {
5557 struct pull_filter *f;
5558 VERIFY_PERMISSION(OPT_P_GENERAL)
5559 f = alloc_pull_filter(options);
5560
5561 if (strcmp("accept", p[1]) == 0)
5562 {
5563 f->type = PUF_TYPE_ACCEPT;
5564 }
5565 else if (strcmp("ignore", p[1]) == 0)
5566 {
5567 f->type = PUF_TYPE_IGNORE;
5568 }
5569 else if (strcmp("reject", p[1]) == 0)
5570 {
5571 f->type = PUF_TYPE_REJECT;
5572 }
5573 else
5574 {
5575 msg(msglevel, "Unknown --pull-filter type: %s", p[1]);
5576 goto err;
5577 }
5578 f->pattern = p[2];
5579 f->size = strlen(p[2]);
5580 }
5581 else if (streq(p[0], "allow-pull-fqdn") && !p[1])
5582 {
5583 VERIFY_PERMISSION(OPT_P_GENERAL);
5584 options->allow_pull_fqdn = true;
5585 }
5586 else if (streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private"))
5587 {
5588 int j;
5589 VERIFY_PERMISSION(OPT_P_ROUTE);
5590 rol_check_alloc(options);
5591
5592 if (options->routes->flags & RG_ENABLE)
5593 {
5594 msg(M_WARN, "WARNING: You have specified redirect-gateway and "
5595 "redirect-private at the same time (or the same option "
5596 "multiple times). This is not well supported and may lead to "
5597 "unexpected results");
5598 }
5599
5600 options->routes->flags |= RG_ENABLE;
5601
5602 if (streq(p[0], "redirect-gateway"))
5603 {
5604 options->routes->flags |= RG_REROUTE_GW;
5605 }
5606 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
5607 {
5608 if (streq(p[j], "local"))
5609 {
5610 options->routes->flags |= RG_LOCAL;
5611 }
5612 else if (streq(p[j], "autolocal"))
5613 {
5614 options->routes->flags |= RG_AUTO_LOCAL;
5615 }
5616 else if (streq(p[j], "def1"))
5617 {
5618 options->routes->flags |= RG_DEF1;
5619 }
5620 else if (streq(p[j], "bypass-dhcp"))
5621 {
5622 options->routes->flags |= RG_BYPASS_DHCP;
5623 }
5624 else if (streq(p[j], "bypass-dns"))
5625 {
5626 options->routes->flags |= RG_BYPASS_DNS;
5627 }
5628 else if (streq(p[j], "block-local"))
5629 {
5630 options->routes->flags |= RG_BLOCK_LOCAL;
5631 }
5632 else if (streq(p[j], "ipv6"))
5633 {
5634 rol6_check_alloc(options);
5635 options->routes_ipv6->flags |= RG_REROUTE_GW;
5636 }
5637 else if (streq(p[j], "!ipv4"))
5638 {
5639 options->routes->flags &= ~(RG_REROUTE_GW | RG_ENABLE);
5640 }
5641 else
5642 {
5643 msg(msglevel, "unknown --%s flag: %s", p[0], p[j]);
5644 goto err;
5645 }
5646 }
5647 if (options->routes->flags & RG_REROUTE_GW)
5648 {
5649 setenv_int(es, "route_redirect_gateway_ipv4",
5650 (options->routes->flags & RG_BLOCK_LOCAL) ? 2 : 1);
5651 }
5652 if (options->routes_ipv6 && (options->routes_ipv6->flags & RG_REROUTE_GW))
5653 {
5654 setenv_int(es, "route_redirect_gateway_ipv6",
5655 (options->routes->flags & RG_BLOCK_LOCAL) ? 2 : 1);
5656 }
5657#ifdef _WIN32
5658 /* we need this here to handle pushed --redirect-gateway */
5659 remap_redirect_gateway_flags(options);
5660#endif
5661 }
5662 else if (streq(p[0], "block-ipv6") && !p[1])
5663 {
5664 VERIFY_PERMISSION(OPT_P_ROUTE);
5665 options->block_ipv6 = true;
5666 }
5667 else if (streq(p[0], "remote-random-hostname") && !p[1])
5668 {
5669 VERIFY_PERMISSION(OPT_P_GENERAL);
5670 options->sockflags |= SF_HOST_RANDOMIZE;
5671 }
5672 else if (streq(p[0], "setenv") && p[1] && !p[3])
5673 {
5674 VERIFY_PERMISSION(OPT_P_GENERAL);
5675 if (streq(p[1], "REMOTE_RANDOM_HOSTNAME") && !p[2])
5676 {
5677 options->sockflags |= SF_HOST_RANDOMIZE;
5678 }
5679 else if (streq(p[1], "GENERIC_CONFIG"))
5680 {
5681 msg(msglevel, "this is a generic configuration and cannot directly be used");
5682 goto err;
5683 }
5684 else if (streq(p[1], "PUSH_PEER_INFO") && !p[2])
5685 {
5686 options->push_peer_info = true;
5687 }
5688 else if (streq(p[1], "SERVER_POLL_TIMEOUT") && p[2])
5689 {
5690 options->ce.connect_timeout = positive_atoi(p[2], msglevel);
5691 }
5692 else
5693 {
5694 if (streq(p[1], "FORWARD_COMPATIBLE") && p[2] && streq(p[2], "1"))
5695 {
5696 options->forward_compatible = true;
5697 }
5698 setenv_str(es, p[1], p[2] ? p[2] : "");
5699 }
5700 }
5701 else if (streq(p[0], "compat-mode") && p[1] && !p[3])
5702 {
5703 unsigned int major, minor, patch;
5704 if (!(sscanf(p[1], "%u.%u.%u", &major, &minor, &patch) == 3))
5705 {
5706 msg(msglevel, "cannot parse version number for --compat-mode: %s", p[1]);
5707 goto err;
5708 }
5709
5710 options->backwards_compatible = major * 10000 + minor * 100 + patch;
5711 }
5712 else if (streq(p[0], "setenv-safe") && p[1] && !p[3])
5713 {
5714 VERIFY_PERMISSION(OPT_P_SETENV);
5715 setenv_str_safe(es, p[1], p[2] ? p[2] : "");
5716 }
5717 else if (streq(p[0], "script-security") && p[1] && !p[2])
5718 {
5719 VERIFY_PERMISSION(OPT_P_GENERAL);
5720 int security;
5721 if (atoi_constrained(p[1], &security, p[0], SSEC_NONE, SSEC_PW_ENV, msglevel))
5722 {
5723 script_security_set(security);
5724 }
5725 }
5726 else if (streq(p[0], "mssfix") && !p[3])
5727 {
5728 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5729 if (p[1])
5730 {
5731 int mssfix;
5732 if (!atoi_constrained(p[1], &mssfix, p[0], 0, UINT16_MAX, msglevel))
5733 {
5734 goto err;
5735 }
5736 if (mssfix != 0 && mssfix < TLS_CHANNEL_MTU_MIN)
5737 {
5738 msg(msglevel, "mssfix needs to be >= %d, not %d", TLS_CHANNEL_MTU_MIN, mssfix);
5739 goto err;
5740 }
5741
5742 /* value specified, assume encapsulation is not
5743 * included unless "mtu" follows later */
5744 options->ce.mssfix = mssfix;
5745 options->ce.mssfix_encap = false;
5746 options->ce.mssfix_default = false;
5747 }
5748 else
5749 {
5750 /* Set MTU to default values */
5751 options->ce.mssfix_default = true;
5752 options->ce.mssfix_encap = true;
5753 options->ce.mssfix_fixed = false;
5754 }
5755
5756 if (p[2] && streq(p[2], "mtu"))
5757 {
5758 options->ce.mssfix_encap = true;
5759 }
5760 else if (p[2] && streq(p[2], "fixed"))
5761 {
5762 options->ce.mssfix_fixed = true;
5763 }
5764 else if (p[2])
5765 {
5766 msg(msglevel, "Unknown parameter to --mssfix: %s", p[2]);
5767 }
5768 }
5769 else if (streq(p[0], "disable-occ") && !p[1])
5770 {
5771 VERIFY_PERMISSION(OPT_P_GENERAL);
5772 options->occ = false;
5773 }
5774 else if (streq(p[0], "server") && p[1] && p[2] && !p[4])
5775 {
5776 const int lev = M_WARN;
5777 bool error = false;
5778 in_addr_t network, netmask;
5779
5780 VERIFY_PERMISSION(OPT_P_GENERAL);
5781 network = get_ip_addr(p[1], lev, &error);
5782 netmask = get_ip_addr(p[2], lev, &error);
5783 if (error || !network || !netmask)
5784 {
5785 msg(msglevel, "error parsing --server parameters");
5786 goto err;
5787 }
5788 options->server_defined = true;
5789 options->server_network = network;
5790 options->server_netmask = netmask;
5791
5792 if (p[3])
5793 {
5794 if (streq(p[3], "nopool"))
5795 {
5796 options->server_flags |= SF_NOPOOL;
5797 }
5798 else
5799 {
5800 msg(msglevel, "error parsing --server: %s is not a recognized flag", p[3]);
5801 goto err;
5802 }
5803 }
5804 }
5805 else if (streq(p[0], "server-ipv6") && p[1] && !p[2])
5806 {
5807 const int lev = M_WARN;
5808 struct in6_addr network;
5809 unsigned int netbits = 0;
5810
5811 VERIFY_PERMISSION(OPT_P_GENERAL);
5812 if (!get_ipv6_addr(p[1], &network, &netbits, lev))
5813 {
5814 msg(msglevel, "error parsing --server-ipv6 parameter");
5815 goto err;
5816 }
5817 if (netbits < 64 || netbits > 124)
5818 {
5819 msg(msglevel, "--server-ipv6 settings: network must be between /64 and /124 (not /%d)",
5820 netbits);
5821
5822 goto err;
5823 }
5824 options->server_ipv6_defined = true;
5825 options->server_network_ipv6 = network;
5826 options->server_netbits_ipv6 = netbits;
5827 }
5828 else if (streq(p[0], "server-bridge") && p[1] && p[2] && p[3] && p[4] && !p[5])
5829 {
5830 const int lev = M_WARN;
5831 bool error = false;
5832 in_addr_t ip, netmask, pool_start, pool_end;
5833
5834 VERIFY_PERMISSION(OPT_P_GENERAL);
5835 ip = get_ip_addr(p[1], lev, &error);
5836 netmask = get_ip_addr(p[2], lev, &error);
5837 pool_start = get_ip_addr(p[3], lev, &error);
5838 pool_end = get_ip_addr(p[4], lev, &error);
5839 if (error || !ip || !netmask || !pool_start || !pool_end)
5840 {
5841 msg(msglevel, "error parsing --server-bridge parameters");
5842 goto err;
5843 }
5844 options->server_bridge_defined = true;
5845 options->server_bridge_ip = ip;
5846 options->server_bridge_netmask = netmask;
5847 options->server_bridge_pool_start = pool_start;
5848 options->server_bridge_pool_end = pool_end;
5849 }
5850 else if (streq(p[0], "server-bridge") && p[1] && streq(p[1], "nogw") && !p[2])
5851 {
5852 VERIFY_PERMISSION(OPT_P_GENERAL);
5853 options->server_bridge_proxy_dhcp = true;
5854 options->server_flags |= SF_NO_PUSH_ROUTE_GATEWAY;
5855 }
5856 else if (streq(p[0], "server-bridge") && !p[1])
5857 {
5858 VERIFY_PERMISSION(OPT_P_GENERAL);
5859 options->server_bridge_proxy_dhcp = true;
5860 }
5861 else if (streq(p[0], "push") && p[1] && !p[2])
5862 {
5863 VERIFY_PERMISSION(OPT_P_PUSH);
5864 push_options(options, &p[1], msglevel, &options->gc);
5865 }
5866 else if (streq(p[0], "push-reset") && !p[1])
5867 {
5868 VERIFY_PERMISSION(OPT_P_INSTANCE);
5869 push_reset(options);
5870 }
5871 else if (streq(p[0], "push-remove") && p[1] && !p[2])
5872 {
5873 VERIFY_PERMISSION(OPT_P_INSTANCE);
5874 msg(D_PUSH, "PUSH_REMOVE '%s'", p[1]);
5875 push_remove_option(options, p[1]);
5876 }
5877 else if (streq(p[0], "ifconfig-pool") && p[1] && p[2] && !p[4])
5878 {
5879 const int lev = M_WARN;
5880 bool error = false;
5881 in_addr_t start, end, netmask = 0;
5882
5883 VERIFY_PERMISSION(OPT_P_GENERAL);
5884 start = get_ip_addr(p[1], lev, &error);
5885 end = get_ip_addr(p[2], lev, &error);
5886 if (p[3])
5887 {
5888 netmask = get_ip_addr(p[3], lev, &error);
5889 }
5890 if (error)
5891 {
5892 msg(msglevel, "error parsing --ifconfig-pool parameters");
5893 goto err;
5894 }
5895 if (!ifconfig_pool_verify_range(msglevel, start, end))
5896 {
5897 goto err;
5898 }
5899
5900 options->ifconfig_pool_defined = true;
5901 options->ifconfig_pool_start = start;
5902 options->ifconfig_pool_end = end;
5903 if (netmask)
5904 {
5905 options->ifconfig_pool_netmask = netmask;
5906 }
5907 }
5908 else if (streq(p[0], "ifconfig-pool-persist") && p[1] && !p[3])
5909 {
5910 VERIFY_PERMISSION(OPT_P_GENERAL);
5911 options->ifconfig_pool_persist_filename = p[1];
5912 if (p[2])
5913 {
5914 options->ifconfig_pool_persist_refresh_freq = positive_atoi(p[2], msglevel);
5915 }
5916 }
5917 else if (streq(p[0], "ifconfig-ipv6-pool") && p[1] && !p[2])
5918 {
5919 const int lev = M_WARN;
5920 struct in6_addr network;
5921 unsigned int netbits = 0;
5922
5923 VERIFY_PERMISSION(OPT_P_GENERAL);
5924 if (!get_ipv6_addr(p[1], &network, &netbits, lev))
5925 {
5926 msg(msglevel, "error parsing --ifconfig-ipv6-pool parameters");
5927 goto err;
5928 }
5929 if (netbits < 64 || netbits > 124)
5930 {
5931 msg(msglevel,
5932 "--ifconfig-ipv6-pool settings: network must be between /64 and /124 (not /%d)",
5933 netbits);
5934 goto err;
5935 }
5936
5937 options->ifconfig_ipv6_pool_defined = true;
5938 options->ifconfig_ipv6_pool_base = network;
5939 options->ifconfig_ipv6_pool_netbits = netbits;
5940 }
5941 else if (streq(p[0], "hash-size") && p[1] && p[2] && !p[3])
5942 {
5943 int real, virtual;
5944
5945 VERIFY_PERMISSION(OPT_P_GENERAL);
5946 if (!atoi_constrained(p[1], &real, "hash-size real", 1, INT_MAX, msglevel)
5947 || !atoi_constrained(p[2], &virtual, "hash-size virtual", 1, INT_MAX, msglevel))
5948 {
5949 goto err;
5950 }
5951 options->real_hash_size = (uint32_t)real;
5952 options->virtual_hash_size = (uint32_t)virtual;
5953 }
5954 else if (streq(p[0], "connect-freq") && p[1] && p[2] && !p[3])
5955 {
5956 int cf_max, cf_per;
5957
5958 VERIFY_PERMISSION(OPT_P_GENERAL);
5959 if (!atoi_constrained(p[1], &cf_max, "connect-freq n", 1, INT_MAX, msglevel)
5960 || !atoi_constrained(p[2], &cf_per, "connect-freq seconds", 1, INT_MAX, msglevel))
5961 {
5962 goto err;
5963 }
5964 options->cf_max = cf_max;
5965 options->cf_per = cf_per;
5966 }
5967 else if (streq(p[0], "connect-freq-initial") && p[1] && p[2] && !p[3])
5968 {
5969 int cf_max, cf_per;
5970
5971 VERIFY_PERMISSION(OPT_P_GENERAL);
5972 if (!atoi_constrained(p[1], &cf_max, "connect-freq-initial n", 1, INT_MAX, msglevel)
5973 || !atoi_constrained(p[2], &cf_per, "connect-freq-initial seconds", 1, INT_MAX, msglevel))
5974 {
5975 goto err;
5976 }
5977 options->cf_initial_max = cf_max;
5978 options->cf_initial_per = cf_per;
5979 }
5980 else if (streq(p[0], "max-clients") && p[1] && !p[2])
5981 {
5982 VERIFY_PERMISSION(OPT_P_GENERAL);
5983 if (!atoi_constrained(p[1], (int *)&options->max_clients, p[0], 1, MAX_PEER_ID - 1, msglevel))
5984 {
5985 goto err;
5986 }
5987 }
5988 else if (streq(p[0], "max-routes-per-client") && p[1] && !p[2])
5989 {
5990 VERIFY_PERMISSION(OPT_P_INHERIT);
5991 atoi_constrained(p[1], &options->max_routes_per_client, p[0], 1, INT_MAX, msglevel);
5992 }
5993 else if (streq(p[0], "client-cert-not-required") && !p[1])
5994 {
5995 VERIFY_PERMISSION(OPT_P_GENERAL);
5996 msg(M_FATAL,
5997 "REMOVED OPTION: --client-cert-not-required, use '--verify-client-cert none' instead");
5998 }
5999 else if (streq(p[0], "verify-client-cert") && !p[2])
6000 {
6001 VERIFY_PERMISSION(OPT_P_GENERAL);
6002
6003 /* Reset any existing flags */
6004 options->ssl_flags &= ~SSLF_CLIENT_CERT_OPTIONAL;
6005 options->ssl_flags &= ~SSLF_CLIENT_CERT_NOT_REQUIRED;
6006 if (p[1])
6007 {
6008 if (streq(p[1], "none"))
6009 {
6010 options->ssl_flags |= SSLF_CLIENT_CERT_NOT_REQUIRED;
6011 }
6012 else if (streq(p[1], "optional"))
6013 {
6014 options->ssl_flags |= SSLF_CLIENT_CERT_OPTIONAL;
6015 }
6016 else if (!streq(p[1], "require"))
6017 {
6018 msg(msglevel,
6019 "parameter to --verify-client-cert must be 'none', 'optional' or 'require'");
6020 goto err;
6021 }
6022 }
6023 }
6024 else if (streq(p[0], "username-as-common-name") && !p[1])
6025 {
6026 VERIFY_PERMISSION(OPT_P_GENERAL);
6027 options->ssl_flags |= SSLF_USERNAME_AS_COMMON_NAME;
6028 }
6029 else if (streq(p[0], "auth-user-pass-optional") && !p[1])
6030 {
6031 VERIFY_PERMISSION(OPT_P_GENERAL);
6032 options->ssl_flags |= SSLF_AUTH_USER_PASS_OPTIONAL;
6033 }
6034 else if (streq(p[0], "opt-verify") && !p[1])
6035 {
6036 VERIFY_PERMISSION(OPT_P_GENERAL);
6037 msg(M_INFO, "DEPRECATED OPTION: --opt-verify was removed in OpenVPN 2.7.");
6038 }
6039 else if (streq(p[0], "auth-user-pass-verify") && p[1])
6040 {
6041 VERIFY_PERMISSION(OPT_P_SCRIPT);
6042 if (!no_more_than_n_args(msglevel, p, 3, NM_QUOTE_HINT))
6043 {
6044 goto err;
6045 }
6046 if (p[2])
6047 {
6048 if (streq(p[2], "via-env"))
6049 {
6050 options->auth_user_pass_verify_script_via_file = false;
6051 }
6052 else if (streq(p[2], "via-file"))
6053 {
6054 options->auth_user_pass_verify_script_via_file = true;
6055 }
6056 else
6057 {
6058 msg(msglevel,
6059 "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'");
6060 goto err;
6061 }
6062 }
6063 else
6064 {
6065 msg(msglevel,
6066 "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')");
6067 goto err;
6068 }
6069 set_user_script(options, &options->auth_user_pass_verify_script, p[1],
6070 "auth-user-pass-verify", true);
6071 }
6072 else if (streq(p[0], "auth-gen-token"))
6073 {
6074 VERIFY_PERMISSION(OPT_P_GENERAL);
6075 options->auth_token_generate = true;
6076 options->auth_token_lifetime = p[1] ? positive_atoi(p[1], msglevel) : 0;
6077
6078 for (int i = 2; i < MAX_PARMS && p[i] != NULL; i++)
6079 {
6080 /* the second parameter can be the renewal time */
6081 if (i == 2 && valid_integer(p[i], true))
6082 {
6083 options->auth_token_renewal = positive_atoi(p[i], msglevel);
6084 }
6085 else if (streq(p[i], "external-auth"))
6086 {
6087 options->auth_token_call_auth = true;
6088 }
6089 else
6090 {
6091 msg(msglevel, "Invalid argument to auth-gen-token: %s (%d)", p[i], i);
6092 }
6093 }
6094 }
6095 else if (streq(p[0], "auth-gen-token-secret") && p[1] && !p[2])
6096 {
6097 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
6098 options->auth_token_secret_file = p[1];
6099 options->auth_token_secret_file_inline = is_inline;
6100 }
6101 else if (streq(p[0], "client-connect") && p[1])
6102 {
6103 VERIFY_PERMISSION(OPT_P_SCRIPT);
6104 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6105 {
6106 goto err;
6107 }
6108 set_user_script(options, &options->client_connect_script, p[1], "client-connect", true);
6109 }
6110 else if (streq(p[0], "client-crresponse") && p[1])
6111 {
6112 VERIFY_PERMISSION(OPT_P_SCRIPT);
6113 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6114 {
6115 goto err;
6116 }
6117 set_user_script(options, &options->client_crresponse_script, p[1], "client-crresponse",
6118 true);
6119 }
6120 else if (streq(p[0], "client-disconnect") && p[1])
6121 {
6122 VERIFY_PERMISSION(OPT_P_SCRIPT);
6123 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6124 {
6125 goto err;
6126 }
6127 set_user_script(options, &options->client_disconnect_script, p[1], "client-disconnect",
6128 true);
6129 }
6130 else if (streq(p[0], "learn-address") && p[1])
6131 {
6132 VERIFY_PERMISSION(OPT_P_SCRIPT);
6133 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6134 {
6135 goto err;
6136 }
6137 set_user_script(options, &options->learn_address_script, p[1], "learn-address", true);
6138 }
6139 else if (streq(p[0], "tmp-dir") && p[1] && !p[2])
6140 {
6141 VERIFY_PERMISSION(OPT_P_GENERAL);
6142 options->tmp_dir = p[1];
6143 }
6144 else if (streq(p[0], "client-config-dir") && p[1] && !p[2])
6145 {
6146 VERIFY_PERMISSION(OPT_P_GENERAL);
6147 options->client_config_dir = p[1];
6148 }
6149 else if (streq(p[0], "ccd-exclusive") && !p[1])
6150 {
6151 VERIFY_PERMISSION(OPT_P_GENERAL);
6152 options->ccd_exclusive = true;
6153 }
6154 else if (streq(p[0], "bcast-buffers") && p[1] && !p[2])
6155 {
6156 VERIFY_PERMISSION(OPT_P_GENERAL);
6157 atoi_constrained(p[1], &options->n_bcast_buf, p[0], 1, MBUF_SIZE_MAX, msglevel);
6158 }
6159 else if (streq(p[0], "tcp-queue-limit") && p[1] && !p[2])
6160 {
6161 VERIFY_PERMISSION(OPT_P_GENERAL);
6162 atoi_constrained(p[1], &options->tcp_queue_limit, p[0], 1, INT_MAX, msglevel);
6163 }
6164#if PORT_SHARE
6165 else if (streq(p[0], "port-share") && p[1] && p[2] && !p[4])
6166 {
6167 VERIFY_PERMISSION(OPT_P_GENERAL);
6168 options->port_share_host = p[1];
6169 options->port_share_port = p[2];
6170 options->port_share_journal_dir = p[3];
6171 }
6172#endif
6173 else if (streq(p[0], "client-to-client") && !p[1])
6174 {
6175 VERIFY_PERMISSION(OPT_P_GENERAL);
6176 options->enable_c2c = true;
6177 }
6178 else if (streq(p[0], "duplicate-cn") && !p[1])
6179 {
6180 VERIFY_PERMISSION(OPT_P_GENERAL);
6181 options->duplicate_cn = true;
6182 }
6183 else if (streq(p[0], "iroute") && p[1] && !p[3])
6184 {
6185 VERIFY_PERMISSION(OPT_P_INSTANCE);
6186 option_iroute(options, p[1], p[2], msglevel);
6187 }
6188 else if (streq(p[0], "iroute-ipv6") && p[1] && !p[2])
6189 {
6190 VERIFY_PERMISSION(OPT_P_INSTANCE);
6191 option_iroute_ipv6(options, p[1], msglevel);
6192 }
6193 else if (streq(p[0], "ifconfig-push") && p[1] && p[2] && !p[4])
6194 {
6195 in_addr_t local, remote_netmask;
6196
6197 VERIFY_PERMISSION(OPT_P_INSTANCE);
6198 local = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[1], 0, NULL, NULL);
6199 remote_netmask = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[2], 0, NULL, NULL);
6200 if (local && remote_netmask)
6201 {
6202 options->push_ifconfig_defined = true;
6203 options->push_ifconfig_local = local;
6204 options->push_ifconfig_remote_netmask = remote_netmask;
6205 if (p[3])
6206 {
6207 options->push_ifconfig_local_alias =
6208 getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[3], 0, NULL, NULL);
6209 }
6210 }
6211 else
6212 {
6213 msg(msglevel, "cannot parse --ifconfig-push addresses");
6214 goto err;
6215 }
6216 }
6217 else if (streq(p[0], "ifconfig-push-constraint") && p[1] && p[2] && !p[3])
6218 {
6219 in_addr_t network, netmask;
6220
6221 VERIFY_PERMISSION(OPT_P_GENERAL);
6222 network = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[1], 0, NULL, NULL);
6223 netmask = getaddr(GETADDR_HOST_ORDER, p[2], 0, NULL, NULL);
6224 if (network && netmask)
6225 {
6226 options->push_ifconfig_constraint_defined = true;
6227 options->push_ifconfig_constraint_network = network;
6228 options->push_ifconfig_constraint_netmask = netmask;
6229 }
6230 else
6231 {
6232 msg(msglevel, "cannot parse --ifconfig-push-constraint addresses");
6233 goto err;
6234 }
6235 }
6236 else if (streq(p[0], "ifconfig-ipv6-push") && p[1] && !p[3])
6237 {
6238 struct in6_addr local, remote;
6239 unsigned int netbits;
6240
6241 VERIFY_PERMISSION(OPT_P_INSTANCE);
6242
6243 if (!get_ipv6_addr(p[1], &local, &netbits, msglevel))
6244 {
6245 msg(msglevel, "cannot parse --ifconfig-ipv6-push addresses");
6246 goto err;
6247 }
6248
6249 if (p[2])
6250 {
6251 if (!get_ipv6_addr(p[2], &remote, NULL, msglevel))
6252 {
6253 msg(msglevel, "cannot parse --ifconfig-ipv6-push addresses");
6254 goto err;
6255 }
6256 }
6257 else
6258 {
6259 if (!options->ifconfig_ipv6_local
6260 || !get_ipv6_addr(options->ifconfig_ipv6_local, &remote, NULL, msglevel))
6261 {
6262 msg(msglevel,
6263 "second argument to --ifconfig-ipv6-push missing and no global --ifconfig-ipv6 address set");
6264 goto err;
6265 }
6266 }
6267
6268 options->push_ifconfig_ipv6_defined = true;
6269 options->push_ifconfig_ipv6_local = local;
6270 options->push_ifconfig_ipv6_netbits = netbits;
6271 options->push_ifconfig_ipv6_remote = remote;
6272 options->push_ifconfig_ipv6_blocked = false;
6273 }
6274 else if (streq(p[0], "disable") && !p[1])
6275 {
6276 VERIFY_PERMISSION(OPT_P_INSTANCE);
6277 options->disable = true;
6278 }
6279 else if (streq(p[0], "override-username") && p[1] && !p[2])
6280 {
6281 VERIFY_PERMISSION(OPT_P_INSTANCE);
6282 if (strlen(p[1]) > USER_PASS_LEN)
6283 {
6284 msg(msglevel,
6285 "override-username exceeds the maximum length of %d "
6286 "characters",
6287 USER_PASS_LEN);
6288
6289 /* disable the connection since ignoring the request to
6290 * set another username might cause serious problems */
6291 options->disable = true;
6292 }
6293 else
6294 {
6295 options->override_username = p[1];
6296 }
6297 }
6298 else if (streq(p[0], "tcp-nodelay") && !p[1])
6299 {
6300 VERIFY_PERMISSION(OPT_P_GENERAL);
6301 options->server_flags |= SF_TCP_NODELAY_HELPER;
6302 }
6303 else if (streq(p[0], "stale-routes-check") && p[1] && !p[3])
6304 {
6305 int ageing_time, check_interval;
6306
6307 VERIFY_PERMISSION(OPT_P_GENERAL);
6308 if (!atoi_constrained(p[1], &ageing_time, "stale-routes-check age", 1, INT_MAX, msglevel))
6309 {
6310 goto err;
6311 }
6312
6313 if (p[2])
6314 {
6315 if (!atoi_constrained(p[2], &check_interval,
6316 "stale-routes-check interval", 1, INT_MAX, msglevel))
6317 {
6318 goto err;
6319 }
6320 }
6321 else
6322 {
6323 check_interval = ageing_time;
6324 }
6325
6326 options->stale_routes_ageing_time = ageing_time;
6327 options->stale_routes_check_interval = check_interval;
6328 }
6329
6330 else if (streq(p[0], "client") && !p[1])
6331 {
6332 VERIFY_PERMISSION(OPT_P_GENERAL);
6333 options->client = true;
6334 }
6335 else if (streq(p[0], "pull") && !p[1])
6336 {
6337 VERIFY_PERMISSION(OPT_P_GENERAL);
6338 options->pull = true;
6339 }
6340 else if (streq(p[0], "push-continuation") && p[1] && !p[2])
6341 {
6342 VERIFY_PERMISSION(OPT_P_PULL_MODE);
6343 atoi_constrained(p[1], &options->push_continuation, p[0], 0, 2, msglevel);
6344 }
6345 else if (streq(p[0], "auth-user-pass") && !p[2])
6346 {
6347 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
6348 options->auth_user_pass_username_only = false;
6349 if (p[1] && streq(p[1], "username-only"))
6350 {
6351 options->auth_user_pass_username_only = true;
6352 options->auth_user_pass_file = "stdin";
6353 }
6354 else if (p[1])
6355 {
6356 options->auth_user_pass_file = p[1];
6357 options->auth_user_pass_file_inline = is_inline;
6358 }
6359 else
6360 {
6361 options->auth_user_pass_file = "stdin";
6362 }
6363 }
6364 else if (streq(p[0], "auth-retry") && p[1] && !p[2])
6365 {
6366 VERIFY_PERMISSION(OPT_P_GENERAL);
6367 auth_retry_set(msglevel, p[1]);
6368 }
6369#ifdef ENABLE_MANAGEMENT
6370 else if (streq(p[0], "static-challenge") && p[1] && p[2] && !p[4])
6371 {
6372 VERIFY_PERMISSION(OPT_P_GENERAL);
6373 options->sc_info.challenge_text = p[1];
6374 if (atoi_warn(p[2], msglevel))
6375 {
6376 options->sc_info.flags |= SC_ECHO;
6377 }
6378 if (p[3] && streq(p[3], "concat"))
6379 {
6380 options->sc_info.flags |= SC_CONCAT;
6381 }
6382 else if (p[3] && !streq(p[3], "scrv1"))
6383 {
6384 msg(msglevel, "--static-challenge: unknown format indicator '%s'", p[3]);
6385 goto err;
6386 }
6387 }
6388#endif
6389 else if (streq(p[0], "msg-channel") && p[1])
6390 {
6391#ifdef _WIN32
6392 VERIFY_PERMISSION(OPT_P_GENERAL);
6393 HANDLE process = GetCurrentProcess();
6394 HANDLE handle = (HANDLE)((intptr_t)atoll(p[1]));
6395 if (!DuplicateHandle(process, handle, process, &options->msg_channel, 0, FALSE,
6396 DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS))
6397 {
6398 msg(msglevel, "could not duplicate service pipe handle");
6399 goto err;
6400 }
6401 options->route_method = ROUTE_METHOD_SERVICE;
6402#else /* ifdef _WIN32 */
6403 msg(msglevel, "--msg-channel is only supported on Windows");
6404 goto err;
6405#endif
6406 }
6407#ifdef _WIN32
6408 else if (streq(p[0], "win-sys") && p[1] && !p[2])
6409 {
6410 VERIFY_PERMISSION(OPT_P_GENERAL);
6411 if (streq(p[1], "env"))
6412 {
6413 msg(M_INFO, "NOTE: --win-sys env is default from OpenVPN 2.3. "
6414 "This entry will now be ignored. "
6415 "Please remove this entry from your configuration file.");
6416 }
6417 else
6418 {
6419 set_win_sys_path(p[1], es);
6420 }
6421 }
6422 else if (streq(p[0], "route-method") && p[1] && !p[2])
6423 {
6424 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
6425 if (streq(p[1], "adaptive"))
6426 {
6427 options->route_method = ROUTE_METHOD_ADAPTIVE;
6428 }
6429 else if (streq(p[1], "ipapi"))
6430 {
6431 options->route_method = ROUTE_METHOD_IPAPI;
6432 }
6433 else if (streq(p[1], "exe"))
6434 {
6435 options->route_method = ROUTE_METHOD_EXE;
6436 }
6437 else
6438 {
6439 msg(msglevel, "--route method must be 'adaptive', 'ipapi', or 'exe'");
6440 goto err;
6441 }
6442 }
6443 else if (streq(p[0], "ip-win32") && p[1] && !p[4])
6444 {
6445 const int index = ascii2ipset(p[1]);
6446 struct tuntap_options *to = &options->tuntap_options;
6447
6448 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6449
6450 if (index < 0)
6451 {
6452 msg(msglevel, "Bad --ip-win32 method: '%s'. Allowed methods: %s", p[1],
6453 ipset2ascii_all(&gc));
6454 goto err;
6455 }
6456
6457 if (index == IPW32_SET_ADAPTIVE)
6458 {
6459 options->route_delay_window = IPW32_SET_ADAPTIVE_DELAY_WINDOW;
6460 }
6461
6462 if (index == IPW32_SET_DHCP_MASQ)
6463 {
6464 if (p[2])
6465 {
6466 if (!streq(p[2], "default"))
6467 {
6468 int offset;
6469
6470 if (!atoi_constrained(p[2], &offset, "ip-win32 offset", -256, 256, msglevel))
6471 {
6472 goto err;
6473 }
6474 to->dhcp_masq_custom_offset = true;
6475 to->dhcp_masq_offset = offset;
6476 }
6477
6478 if (p[3])
6479 {
6480 if (!atoi_constrained(p[3], &to->dhcp_lease_time,
6481 "ip-win32 lease time", 30, INT_MAX, msglevel))
6482 {
6483 goto err;
6484 }
6485 }
6486 }
6487 }
6488 to->ip_win32_type = index;
6489 to->ip_win32_defined = true;
6490 }
6491#endif /* ifdef _WIN32 */
6492 else if (streq(p[0], "dns-updown") && p[1])
6493 {
6494 VERIFY_PERMISSION(OPT_P_SCRIPT);
6495 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6496 {
6497 goto err;
6498 }
6499 struct dns_options *dns = &options->dns_options;
6500 if (streq(p[1], "disable"))
6501 {
6502 dns->updown = NULL;
6503 dns->updown_flags = DNS_UPDOWN_NO_FLAGS;
6504 }
6505 else if (streq(p[1], "force"))
6506 {
6507 /* force dns-updown run, even if a --up script is defined */
6508 if (!dns_updown_user_set(dns))
6509 {
6510 dns->updown = DEFAULT_DNS_UPDOWN;
6511 dns->updown_flags = DNS_UPDOWN_FORCED;
6512 }
6513 }
6514 else
6515 {
6516 if (dns->updown && streq(dns->updown, DEFAULT_DNS_UPDOWN))
6517 {
6518 /* Unset the default command to prevent warnings */
6519 dns->updown = NULL;
6520 }
6521 set_user_script(options, &dns->updown, p[1], p[0], false);
6522 dns->updown_flags = DNS_UPDOWN_USER_SET;
6523 }
6524 }
6525 else if (streq(p[0], "dns") && p[1])
6526 {
6527 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6528 if (!check_dns_option(options, p, msglevel, pull_mode))
6529 {
6530 goto err;
6531 }
6532 }
6533 else if (streq(p[0], "dhcp-option") && p[1])
6534 {
6535 struct dhcp_options *dhcp = &options->dns_options.from_dhcp;
6536#if defined(_WIN32) || defined(TARGET_ANDROID)
6537 struct tuntap_options *o = &options->tuntap_options;
6538#endif
6539 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6540
6541 bool dhcp_optional = false;
6542
6543 if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX")) && p[2] && !p[3])
6544 {
6545 if (!validate_domain(p[2]))
6546 {
6547 msg(msglevel, "--dhcp-option %s contains invalid characters", p[1]);
6548 goto err;
6549 }
6550
6551 dhcp->domain = p[2];
6552 dhcp_optional = true;
6553 }
6554 else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3])
6555 {
6556 if (!validate_domain(p[2]))
6557 {
6558 msg(msglevel, "--dhcp-option %s contains invalid characters", p[1]);
6559 goto err;
6560 }
6561
6562 if (dhcp->domain_search_list_len < N_SEARCH_LIST_LEN)
6563 {
6564 dhcp->domain_search_list[dhcp->domain_search_list_len++] = p[2];
6565 }
6566 else
6567 {
6568 msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified",
6569 p[1], N_SEARCH_LIST_LEN);
6570 }
6571 dhcp_optional = true;
6572 }
6573 else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3]
6574 && (!strstr(p[2], ":") || ipv6_addr_safe(p[2])))
6575 {
6576 if (strstr(p[2], ":"))
6577 {
6578 dhcp_option_dns6_parse(p[2], dhcp->dns6, &dhcp->dns6_len, msglevel);
6579 }
6580 else
6581 {
6582 dhcp_option_address_parse("DNS", p[2], dhcp->dns, &dhcp->dns_len, msglevel);
6583 dhcp_optional = true;
6584 }
6585 }
6586#if defined(_WIN32) || defined(TARGET_ANDROID)
6587 else if (streq(p[1], "NBS") && p[2] && !p[3])
6588 {
6589 o->netbios_scope = p[2];
6590 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6591 }
6592 else if (streq(p[1], "NBT") && p[2] && !p[3])
6593 {
6594 int t = atoi_warn(p[2], msglevel);
6595 if (!(t == 1 || t == 2 || t == 4 || t == 8))
6596 {
6597 msg(msglevel, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t);
6598 goto err;
6599 }
6600 o->netbios_node_type = (uint8_t)t;
6601 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6602 }
6603 else if (streq(p[1], "WINS") && p[2] && !p[3])
6604 {
6605 dhcp_option_address_parse("WINS", p[2], o->wins, &o->wins_len, msglevel);
6606 o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
6607 }
6608 else if (streq(p[1], "NTP") && p[2] && !p[3])
6609 {
6610 dhcp_option_address_parse("NTP", p[2], o->ntp, &o->ntp_len, msglevel);
6611 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6612 }
6613 else if (streq(p[1], "NBDD") && p[2] && !p[3])
6614 {
6615 dhcp_option_address_parse("NBDD", p[2], o->nbdd, &o->nbdd_len, msglevel);
6616 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6617 }
6618 else if (streq(p[1], "DISABLE-NBT") && !p[2])
6619 {
6620 o->disable_nbt = 1;
6621 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6622 }
6623#if defined(TARGET_ANDROID)
6624 else if (streq(p[1], "PROXY_HTTP") && p[3] && !p[4])
6625 {
6626 o->http_proxy_port = positive_atoi(p[3], msglevel);
6627 o->http_proxy = p[2];
6628 }
6629#endif
6630 else
6631 {
6632 msg(msglevel, "--dhcp-option: unknown option type '%s' or missing or unknown parameter",
6633 p[1]);
6634 goto err;
6635 }
6636#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
6637 setenv_foreign_option(options, p[1], p[2], es);
6638#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
6639
6640 if (dhcp_optional)
6641 {
6642#if defined(_WIN32) || defined(TARGET_ANDROID)
6643 o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
6644#endif
6645 }
6646 }
6647#ifdef _WIN32
6648 else if (streq(p[0], "show-adapters") && !p[1])
6649 {
6650 VERIFY_PERMISSION(OPT_P_GENERAL);
6651 show_tap_win_adapters(M_INFO | M_NOPREFIX, M_WARN | M_NOPREFIX);
6652 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6653 }
6654 else if (streq(p[0], "show-net") && !p[1])
6655 {
6656 VERIFY_PERMISSION(OPT_P_GENERAL);
6657 show_routes(M_INFO | M_NOPREFIX);
6658 show_adapters(M_INFO | M_NOPREFIX);
6659 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6660 }
6661 else if (streq(p[0], "show-net-up") && !p[1])
6662 {
6663 VERIFY_PERMISSION(OPT_P_UP);
6664 options->show_net_up = true;
6665 }
6666 else if (streq(p[0], "tap-sleep") && p[1] && !p[2])
6667 {
6668 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6669 if (!atoi_constrained(p[1], &options->tuntap_options.tap_sleep, p[0], 0, 255, msglevel))
6670 {
6671 goto err;
6672 }
6673 }
6674 else if (streq(p[0], "dhcp-renew") && !p[1])
6675 {
6676 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6677 options->tuntap_options.dhcp_renew = true;
6678 }
6679 else if (streq(p[0], "dhcp-pre-release") && !p[1])
6680 {
6681 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6682 options->tuntap_options.dhcp_pre_release = true;
6683 options->tuntap_options.dhcp_renew = true;
6684 }
6685 else if (streq(p[0], "dhcp-release") && !p[1])
6686 {
6687 msg(M_WARN, "Obsolete option --dhcp-release detected. This is now on by default");
6688 }
6689 else if (streq(p[0], "dhcp-internal") && p[1] && !p[2]) /* standalone method for internal use */
6690 {
6691 unsigned int adapter_index;
6692 VERIFY_PERMISSION(OPT_P_GENERAL);
6693 set_debug_level(options->verbosity, SDL_CONSTRAIN);
6694 adapter_index = atou(p[1]);
6695 sleep(options->tuntap_options.tap_sleep);
6696 if (options->tuntap_options.dhcp_pre_release)
6697 {
6698 dhcp_release_by_adapter_index(adapter_index);
6699 }
6700 if (options->tuntap_options.dhcp_renew)
6701 {
6702 dhcp_renew_by_adapter_index(adapter_index);
6703 }
6704 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6705 }
6706 else if (streq(p[0], "register-dns") && !p[1])
6707 {
6708 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6709 options->tuntap_options.register_dns = true;
6710 }
6711 else if (streq(p[0], "block-outside-dns") && !p[1])
6712 {
6713 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6714 options->block_outside_dns = true;
6715 }
6716 else if (streq(p[0], "rdns-internal") && !p[1])
6717 /* standalone method for internal use
6718 *
6719 * (if --register-dns is set, openvpn needs to call itself in a
6720 * sub-process to execute the required functions in a non-blocking
6721 * way, and uses --rdns-internal to signal that to itself)
6722 */
6723 {
6724 VERIFY_PERMISSION(OPT_P_GENERAL);
6725 set_debug_level(options->verbosity, SDL_CONSTRAIN);
6726 if (options->tuntap_options.register_dns)
6727 {
6728 ipconfig_register_dns(NULL);
6729 }
6730 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6731 }
6732 else if (streq(p[0], "show-valid-subnets") && !p[1])
6733 {
6734 VERIFY_PERMISSION(OPT_P_GENERAL);
6735 show_valid_win32_tun_subnets();
6736 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6737 }
6738 else if (streq(p[0], "pause-exit") && !p[1])
6739 {
6740 VERIFY_PERMISSION(OPT_P_GENERAL);
6741 set_pause_exit_win32();
6742 }
6743 else if (streq(p[0], "service") && p[1] && !p[3])
6744 {
6745 VERIFY_PERMISSION(OPT_P_GENERAL);
6746 options->exit_event_name = p[1];
6747 if (p[2])
6748 {
6749 options->exit_event_initial_state = (atoi_warn(p[2], msglevel) != 0);
6750 }
6751 }
6752 else if (streq(p[0], "allow-nonadmin") && !p[2])
6753 {
6754 VERIFY_PERMISSION(OPT_P_GENERAL);
6755 tap_allow_nonadmin_access(p[1]);
6756 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6757 }
6758 else if (streq(p[0], "user") && p[1] && !p[2])
6759 {
6760 VERIFY_PERMISSION(OPT_P_GENERAL);
6761 msg(M_WARN, "NOTE: --user option is not implemented on Windows");
6762 }
6763 else if (streq(p[0], "group") && p[1] && !p[2])
6764 {
6765 VERIFY_PERMISSION(OPT_P_GENERAL);
6766 msg(M_WARN, "NOTE: --group option is not implemented on Windows");
6767 }
6768#else /* ifdef _WIN32 */
6769 else if (streq(p[0], "user") && p[1] && !p[2])
6770 {
6771 VERIFY_PERMISSION(OPT_P_GENERAL);
6772 options->username = p[1];
6773 }
6774 else if (streq(p[0], "group") && p[1] && !p[2])
6775 {
6776 VERIFY_PERMISSION(OPT_P_GENERAL);
6777 options->groupname = p[1];
6778 }
6779 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
6780 {
6781 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6782 setenv_foreign_option(options, p[1], p[2], es);
6783 }
6784 else if (streq(p[0], "route-method") && p[1] && !p[2])
6785 {
6786 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
6787 /* ignore when pushed to non-Windows OS */
6788 }
6789#endif /* ifdef _WIN32 */
6790#if PASSTOS_CAPABILITY
6791 else if (streq(p[0], "passtos") && !p[1])
6792 {
6793 VERIFY_PERMISSION(OPT_P_GENERAL);
6794 options->passtos = true;
6795 }
6796#endif
6797 else if (streq(p[0], "allow-compression") && p[1] && !p[2])
6798 {
6799 VERIFY_PERMISSION(OPT_P_GENERAL);
6800
6801 if (streq(p[1], "no"))
6802 {
6803 options->comp.flags = COMP_F_ALLOW_STUB_ONLY | COMP_F_ADVERTISE_STUBS_ONLY;
6804 if (comp_non_stub_enabled(&options->comp))
6805 {
6806 msg(msglevel, "'--allow-compression no' conflicts with "
6807 " enabling compression");
6808 }
6809 }
6810 else if (options->comp.flags & COMP_F_ALLOW_STUB_ONLY)
6811 {
6812 /* Also printed on a push to hint at configuration problems */
6813 msg(msglevel,
6814 "Cannot set allow-compression to '%s' "
6815 "after set to 'no'",
6816 p[1]);
6817 goto err;
6818 }
6819 else if (streq(p[1], "asym"))
6820 {
6821 options->comp.flags |= COMP_F_ALLOW_ASYM;
6822 }
6823 else if (streq(p[1], "yes"))
6824 {
6825 msg(M_WARN,
6826 "DEPRECATED OPTION: \"--allow-compression yes\" has been removed. "
6827 "We will use \"asym\" mode instead. See the manual page for more information.");
6828
6829 options->comp.flags |= COMP_F_ALLOW_ASYM;
6830 }
6831 else
6832 {
6833 msg(msglevel,
6834 "bad allow-compression option: %s -- "
6835 "must be 'yes', 'no', or 'asym'",
6836 p[1]);
6837 goto err;
6838 }
6839 }
6840 else if (streq(p[0], "comp-lzo") && !p[2])
6841 {
6842 VERIFY_PERMISSION(OPT_P_COMP);
6843
6844 /* All lzo variants do not use swap */
6845 options->comp.flags &= ~COMP_F_SWAP;
6846 options->comp.alg = COMP_ALG_LZO;
6847
6848 if (p[1])
6849 {
6850 if (streq(p[1], "no"))
6851 {
6852 options->comp.alg = COMP_ALG_STUB;
6853 }
6854 /* There is no actual difference anymore between these variants.
6855 * We never compress. On the server side we replace this with
6856 * --compress migrate later anyway.
6857 */
6858 else if (!(streq(p[1], "yes") || streq(p[1], "adaptive")))
6859 {
6860 msg(msglevel, "bad comp-lzo option: %s -- must be 'yes', 'no', or 'adaptive'",
6861 p[1]);
6862 goto err;
6863 }
6864 }
6865 show_compression_warning(&options->comp);
6866 }
6867 else if (streq(p[0], "comp-noadapt") && !p[1])
6868 {
6869 /* NO-OP since we never compress anymore */
6870 }
6871 else if (streq(p[0], "compress") && !p[2])
6872 {
6873 VERIFY_PERMISSION(OPT_P_COMP);
6874 const char *alg = "stub";
6875 if (p[1])
6876 {
6877 alg = p[1];
6878 }
6879
6880 if (streq(alg, "stub"))
6881 {
6882 options->comp.alg = COMP_ALG_STUB;
6883 options->comp.flags |= (COMP_F_SWAP | COMP_F_ADVERTISE_STUBS_ONLY);
6884 }
6885 else if (streq(alg, "stub-v2"))
6886 {
6887 options->comp.alg = COMP_ALGV2_UNCOMPRESSED;
6888 options->comp.flags |= COMP_F_ADVERTISE_STUBS_ONLY;
6889 }
6890 else if (streq(alg, "migrate"))
6891 {
6892 options->comp.alg = COMP_ALG_UNDEF;
6893 options->comp.flags = COMP_F_MIGRATE;
6894 }
6895 else if (streq(alg, "lzo"))
6896 {
6897 options->comp.alg = COMP_ALG_LZO;
6898 options->comp.flags &= ~COMP_F_SWAP;
6899 }
6900 else if (streq(alg, "lz4"))
6901 {
6902 options->comp.alg = COMP_ALG_LZ4;
6903 options->comp.flags |= COMP_F_SWAP;
6904 }
6905 else if (streq(alg, "lz4-v2"))
6906 {
6907 options->comp.alg = COMP_ALGV2_LZ4;
6908 }
6909 else
6910 {
6911 msg(msglevel, "bad comp option: %s", alg);
6912 goto err;
6913 }
6914
6915 show_compression_warning(&options->comp);
6916 }
6917 else if (streq(p[0], "show-ciphers") && !p[1])
6918 {
6919 VERIFY_PERMISSION(OPT_P_GENERAL);
6920 options->show_ciphers = true;
6921 }
6922 else if (streq(p[0], "show-digests") && !p[1])
6923 {
6924 VERIFY_PERMISSION(OPT_P_GENERAL);
6925 options->show_digests = true;
6926 }
6927 else if (streq(p[0], "show-engines") && !p[1])
6928 {
6929 VERIFY_PERMISSION(OPT_P_GENERAL);
6930 options->show_engines = true;
6931 }
6932 else if (streq(p[0], "key-direction") && p[1] && !p[2])
6933 {
6934 int key_direction;
6935
6936 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6937
6938 key_direction = ascii2keydirection(msglevel, p[1]);
6939 if (key_direction >= 0)
6940 {
6941 if (permission_mask & OPT_P_GENERAL)
6942 {
6943 options->key_direction = key_direction;
6944 }
6945 else if (permission_mask & OPT_P_CONNECTION)
6946 {
6947 options->ce.key_direction = key_direction;
6948 }
6949 }
6950 else
6951 {
6952 goto err;
6953 }
6954 }
6955 else if (streq(p[0], "secret") && p[1] && !p[3])
6956 {
6957 msg(M_WARN, "DEPRECATED OPTION: The option --secret is deprecated.");
6958 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
6959 options->shared_secret_file = p[1];
6960 options->shared_secret_file_inline = is_inline;
6961 if (!is_inline && p[2])
6962 {
6963 int key_direction;
6964
6965 key_direction = ascii2keydirection(msglevel, p[2]);
6966 if (key_direction >= 0)
6967 {
6968 options->key_direction = key_direction;
6969 }
6970 else
6971 {
6972 goto err;
6973 }
6974 }
6975 }
6976 else if (streq(p[0], "allow-deprecated-insecure-static-crypto"))
6977 {
6978 VERIFY_PERMISSION(OPT_P_GENERAL);
6979 options->allow_deprecated_insecure_static_crypto = true;
6980 }
6981 else if (streq(p[0], "genkey") && !p[4])
6982 {
6983 VERIFY_PERMISSION(OPT_P_GENERAL);
6984 options->genkey = true;
6985 if (!p[1])
6986 {
6987 options->genkey_type = GENKEY_SECRET;
6988 }
6989 else
6990 {
6991 if (streq(p[1], "secret") || streq(p[1], "tls-auth") || streq(p[1], "tls-crypt"))
6992 {
6993 options->genkey_type = GENKEY_SECRET;
6994 }
6995 else if (streq(p[1], "tls-crypt-v2-server"))
6996 {
6997 options->genkey_type = GENKEY_TLS_CRYPTV2_SERVER;
6998 }
6999 else if (streq(p[1], "tls-crypt-v2-client"))
7000 {
7001 options->genkey_type = GENKEY_TLS_CRYPTV2_CLIENT;
7002 if (p[3])
7003 {
7004 options->genkey_extra_data = p[3];
7005 }
7006 }
7007 else if (streq(p[1], "auth-token"))
7008 {
7009 options->genkey_type = GENKEY_AUTH_TOKEN;
7010 }
7011 else
7012 {
7013 msg(msglevel, "unknown --genkey type: %s", p[1]);
7014 }
7015 }
7016 if (p[2])
7017 {
7018 options->genkey_filename = p[2];
7019 }
7020 }
7021 else if (streq(p[0], "auth") && p[1] && !p[2])
7022 {
7023 VERIFY_PERMISSION(OPT_P_GENERAL);
7024 options->authname = p[1];
7025 }
7026 else if (streq(p[0], "cipher") && p[1] && !p[2])
7027 {
7028 VERIFY_PERMISSION(OPT_P_NCP | OPT_P_INSTANCE);
7029 options->ciphername = p[1];
7030 }
7031 else if (streq(p[0], "data-ciphers-fallback") && p[1] && !p[2])
7032 {
7033 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
7034 options->ciphername = p[1];
7035 options->enable_ncp_fallback = true;
7036 }
7037 else if ((streq(p[0], "data-ciphers") || streq(p[0], "ncp-ciphers")) && p[1] && !p[2])
7038 {
7039 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
7040 if (streq(p[0], "ncp-ciphers"))
7041 {
7042 msg(M_INFO, "Note: Treating option '--ncp-ciphers' as "
7043 " '--data-ciphers' (renamed in OpenVPN 2.5).");
7044 }
7045 options->ncp_ciphers = p[1];
7046 }
7047 else if (streq(p[0], "key-derivation") && p[1])
7048 {
7049 /* NCP only option that is pushed by the server to enable EKM,
7050 * should not be used by normal users in config files*/
7051 VERIFY_PERMISSION(OPT_P_NCP)
7052 if (streq(p[1], "tls-ekm"))
7053 {
7054 options->imported_protocol_flags |= CO_USE_TLS_KEY_MATERIAL_EXPORT;
7055 }
7056 else
7057 {
7058 msg(msglevel, "Unknown key-derivation method %s", p[1]);
7059 }
7060 }
7061 else if (streq(p[0], "protocol-flags") && p[1])
7062 {
7063 /* NCP only option that is pushed by the server to enable protocol
7064 * features that are negotiated, should not be used by normal users
7065 * in config files */
7066 VERIFY_PERMISSION(OPT_P_NCP)
7067 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
7068 {
7069 if (streq(p[j], "cc-exit"))
7070 {
7071 options->imported_protocol_flags |= CO_USE_CC_EXIT_NOTIFY;
7072 }
7073 else if (streq(p[j], "tls-ekm"))
7074 {
7075 options->imported_protocol_flags |= CO_USE_TLS_KEY_MATERIAL_EXPORT;
7076 }
7077 else if (streq(p[j], "dyn-tls-crypt"))
7078 {
7079 options->imported_protocol_flags |= CO_USE_DYNAMIC_TLS_CRYPT;
7080 }
7081 else if (streq(p[j], "aead-epoch"))
7082 {
7083 options->imported_protocol_flags |= CO_EPOCH_DATA_KEY_FORMAT;
7084 }
7085 else
7086 {
7087 msg(msglevel, "Unknown protocol-flags flag: %s", p[j]);
7088 }
7089 }
7090 }
7091 else if (streq(p[0], "force-tls-key-material-export"))
7092 {
7093 VERIFY_PERMISSION(OPT_P_GENERAL);
7094 options->force_key_material_export = true;
7095 }
7096 else if (streq(p[0], "prng") && p[1] && !p[3])
7097 {
7098 msg(M_WARN, "NOTICE: --prng option ignored (SSL library PRNG is used)");
7099 }
7100 else if (streq(p[0], "no-replay") && !p[1])
7101 {
7102 VERIFY_PERMISSION(OPT_P_GENERAL);
7103 /* always error out, this breaks the connection */
7104 msg(M_FATAL, "--no-replay was removed in OpenVPN 2.7. "
7105 "Update your configuration.");
7106 }
7107 else if (streq(p[0], "replay-window") && !p[3])
7108 {
7109 VERIFY_PERMISSION(OPT_P_GENERAL);
7110 if (p[1])
7111 {
7112 if (!atoi_constrained(p[1], &options->replay_window, "replay-window windows size",
7113 MIN_SEQ_BACKTRACK, MAX_SEQ_BACKTRACK, msglevel))
7114 {
7115 goto err;
7116 }
7117
7118 if (p[2])
7119 {
7120 if (!atoi_constrained(p[2], &options->replay_time, "replay-window time window",
7121 MIN_TIME_BACKTRACK, MAX_TIME_BACKTRACK, msglevel))
7122 {
7123 goto err;
7124 }
7125 }
7126 }
7127 else
7128 {
7129 msg(msglevel, "replay-window option is missing window size parameter");
7130 goto err;
7131 }
7132 }
7133 else if (streq(p[0], "mute-replay-warnings") && !p[1])
7134 {
7135 VERIFY_PERMISSION(OPT_P_GENERAL);
7136 options->mute_replay_warnings = true;
7137 }
7138 else if (streq(p[0], "replay-persist") && p[1] && !p[2])
7139 {
7140 VERIFY_PERMISSION(OPT_P_GENERAL);
7141 options->packet_id_file = p[1];
7142 }
7143 else if (streq(p[0], "test-crypto") && !p[1])
7144 {
7145 VERIFY_PERMISSION(OPT_P_GENERAL);
7146 options->test_crypto = true;
7147 }
7148#ifndef ENABLE_CRYPTO_MBEDTLS
7149 else if (streq(p[0], "engine") && !p[2])
7150 {
7151 VERIFY_PERMISSION(OPT_P_GENERAL);
7152 if (p[1])
7153 {
7154 options->engine = p[1];
7155 }
7156 else
7157 {
7158 options->engine = "auto";
7159 }
7160 }
7161#endif /* ENABLE_CRYPTO_MBEDTLS */
7162 else if (streq(p[0], "providers") && p[1])
7163 {
7164 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
7165 {
7166 options->providers.names[j] = p[j];
7167 }
7168 }
7169 else if (streq(p[0], "show-tls") && !p[1])
7170 {
7171 VERIFY_PERMISSION(OPT_P_GENERAL);
7172 options->show_tls_ciphers = true;
7173 }
7174 else if ((streq(p[0], "show-curves") || streq(p[0], "show-groups")) && !p[1])
7175 {
7176 VERIFY_PERMISSION(OPT_P_GENERAL);
7177 options->show_curves = true;
7178 }
7179 else if (streq(p[0], "ecdh-curve") && p[1] && !p[2])
7180 {
7181 VERIFY_PERMISSION(OPT_P_GENERAL);
7182 msg(M_WARN, "Consider setting groups/curves preference with "
7183 "tls-groups instead of forcing a specific curve with "
7184 "ecdh-curve.");
7185 options->ecdh_curve = p[1];
7186 }
7187 else if (streq(p[0], "tls-server") && !p[1])
7188 {
7189 VERIFY_PERMISSION(OPT_P_GENERAL);
7190 options->tls_server = true;
7191 }
7192 else if (streq(p[0], "tls-client") && !p[1])
7193 {
7194 VERIFY_PERMISSION(OPT_P_GENERAL);
7195 options->tls_client = true;
7196 }
7197 else if (streq(p[0], "ca") && p[1] && !p[2])
7198 {
7199 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7200 options->ca_file = p[1];
7201 options->ca_file_inline = is_inline;
7202 }
7203#ifndef ENABLE_CRYPTO_MBEDTLS
7204 else if (streq(p[0], "capath") && p[1] && !p[2])
7205 {
7206 VERIFY_PERMISSION(OPT_P_GENERAL);
7207 options->ca_path = p[1];
7208 }
7209#endif /* ENABLE_CRYPTO_MBEDTLS */
7210 else if (streq(p[0], "dh") && p[1] && !p[2])
7211 {
7212 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7213 options->dh_file = p[1];
7214 options->dh_file_inline = is_inline;
7215 }
7216 else if (streq(p[0], "cert") && p[1] && !p[2])
7217 {
7218 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7219 options->cert_file = p[1];
7220 options->cert_file_inline = is_inline;
7221 }
7222 else if (streq(p[0], "extra-certs") && p[1] && !p[2])
7223 {
7224 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7225 options->extra_certs_file = p[1];
7226 options->extra_certs_file_inline = is_inline;
7227 }
7228 else if ((streq(p[0], "verify-hash") && p[1] && !p[3])
7229 || (streq(p[0], "peer-fingerprint") && p[1] && !p[2]))
7230 {
7231 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7232
7233 int verify_hash_depth = 0;
7234 if (streq(p[0], "verify-hash"))
7235 {
7236 msg(M_WARN, "DEPRECATED OPTION: The option --verify-hash is deprecated. "
7237 "You should switch to the either use the level 1 certificate as "
7238 "--ca option, use --tls-verify or use --peer-fingerprint");
7239 /* verify level 1 cert, i.e. the CA that signed the leaf cert */
7240 verify_hash_depth = 1;
7241 }
7242
7243 options->verify_hash_algo = MD_SHA256;
7244
7245 int digest_len = SHA256_DIGEST_LENGTH;
7246
7247 if (options->verify_hash && options->verify_hash_depth != verify_hash_depth)
7248 {
7249 msg(msglevel,
7250 "ERROR: Setting %s not allowed. --verify-hash and"
7251 " --peer-fingerprint are mutually exclusive",
7252 p[0]);
7253 goto err;
7254 }
7255
7256 if (streq(p[0], "verify-hash"))
7257 {
7258 if ((!p[2] && !is_inline) || (p[2] && streq(p[2], "SHA1")))
7259 {
7260 options->verify_hash_algo = MD_SHA1;
7261 digest_len = SHA_DIGEST_LENGTH;
7262 }
7263 else if (p[2] && !streq(p[2], "SHA256"))
7264 {
7265 msg(msglevel,
7266 "invalid or unsupported hashing algorithm: %s "
7267 "(only SHA1 and SHA256 are supported)",
7268 p[2]);
7269 goto err;
7270 }
7271 }
7272
7273 struct verify_hash_list *newlist;
7274 newlist = parse_hash_fingerprint_multiline(p[1], digest_len, msglevel, &options->gc);
7275
7276 /* Append the new list to the end of our current list */
7277 if (!options->verify_hash)
7278 {
7279 options->verify_hash = newlist;
7280 options->verify_hash_depth = verify_hash_depth;
7281 }
7282 else
7283 {
7284 /* since both the old and new list can have multiple entries
7285 * we need to go to the end of one of them to concatenate them */
7286 struct verify_hash_list *listend = options->verify_hash;
7287 while (listend->next)
7288 {
7289 listend = listend->next;
7290 }
7291 listend->next = newlist;
7292 }
7293 }
7294#if defined(ENABLE_CRYPTOAPI) && defined(HAVE_XKEY_PROVIDER)
7295 else if (streq(p[0], "cryptoapicert") && p[1] && !p[2])
7296 {
7297 VERIFY_PERMISSION(OPT_P_GENERAL);
7298 options->cryptoapi_cert = p[1];
7299 }
7300#endif
7301 else if (streq(p[0], "key") && p[1] && !p[2])
7302 {
7303 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7304 options->priv_key_file = p[1];
7305 options->priv_key_file_inline = is_inline;
7306 }
7307 else if (streq(p[0], "tls-version-min") && p[1] && !p[3])
7308 {
7309 VERIFY_PERMISSION(OPT_P_GENERAL);
7310 int ver = tls_version_parse(p[1], p[2]);
7311 if (ver == TLS_VER_BAD)
7312 {
7313 msg(msglevel, "unknown tls-version-min parameter: %s", p[1]);
7314 goto err;
7315 }
7316
7317#ifdef ENABLE_CRYPTO_MBEDTLS
7318 if (ver < TLS_VER_1_2)
7319 {
7320 msg(M_WARN, "--tls-version-min %s is not supported by mbedtls, using 1.2", p[1]);
7321 ver = TLS_VER_1_2;
7322 }
7323#endif
7324
7325 options->ssl_flags &= ~(SSLF_TLS_VERSION_MIN_MASK << SSLF_TLS_VERSION_MIN_SHIFT);
7326 options->ssl_flags |= ((unsigned int)ver << SSLF_TLS_VERSION_MIN_SHIFT);
7327 }
7328 else if (streq(p[0], "tls-version-max") && p[1] && !p[2])
7329 {
7330 VERIFY_PERMISSION(OPT_P_GENERAL);
7331 int ver = tls_version_parse(p[1], NULL);
7332 if (ver == TLS_VER_BAD)
7333 {
7334 msg(msglevel, "unknown tls-version-max parameter: %s", p[1]);
7335 goto err;
7336 }
7337 options->ssl_flags &= ~(SSLF_TLS_VERSION_MAX_MASK << SSLF_TLS_VERSION_MAX_SHIFT);
7338 options->ssl_flags |= ((unsigned int)ver << SSLF_TLS_VERSION_MAX_SHIFT);
7339 }
7340#ifndef ENABLE_CRYPTO_MBEDTLS
7341 else if (streq(p[0], "pkcs12") && p[1] && !p[2])
7342 {
7343 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7344 options->pkcs12_file = p[1];
7345 options->pkcs12_file_inline = is_inline;
7346 }
7347#endif /* ENABLE_CRYPTO_MBEDTLS */
7348 else if (streq(p[0], "askpass") && !p[2])
7349 {
7350 VERIFY_PERMISSION(OPT_P_GENERAL);
7351 if (p[1])
7352 {
7353 options->key_pass_file = p[1];
7354 }
7355 else
7356 {
7357 options->key_pass_file = "stdin";
7358 }
7359 }
7360 else if (streq(p[0], "auth-nocache") && !p[1])
7361 {
7362 VERIFY_PERMISSION(OPT_P_GENERAL);
7363 ssl_set_auth_nocache();
7364 }
7365 else if (streq(p[0], "auth-token") && p[1] && !p[2])
7366 {
7367 VERIFY_PERMISSION(OPT_P_ECHO);
7368 ssl_set_auth_token(p[1]);
7369#ifdef ENABLE_MANAGEMENT
7370 if (management)
7371 {
7372 management_auth_token(p[1]);
7373 }
7374#endif
7375 }
7376 else if (streq(p[0], "auth-token-user") && p[1] && !p[2])
7377 {
7378 VERIFY_PERMISSION(OPT_P_ECHO);
7379 ssl_set_auth_token_user(p[1]);
7380 }
7381 else if (streq(p[0], "single-session") && !p[1])
7382 {
7383 VERIFY_PERMISSION(OPT_P_GENERAL);
7384 options->single_session = true;
7385 }
7386 else if (streq(p[0], "push-peer-info") && !p[1])
7387 {
7388 VERIFY_PERMISSION(OPT_P_GENERAL);
7389 options->push_peer_info = true;
7390 }
7391 else if (streq(p[0], "tls-exit") && !p[1])
7392 {
7393 VERIFY_PERMISSION(OPT_P_GENERAL);
7394 options->tls_exit = true;
7395 }
7396 else if (streq(p[0], "tls-cipher") && p[1] && !p[2])
7397 {
7398 VERIFY_PERMISSION(OPT_P_GENERAL);
7399 options->cipher_list = p[1];
7400 }
7401 else if (streq(p[0], "tls-cert-profile") && p[1] && !p[2])
7402 {
7403 VERIFY_PERMISSION(OPT_P_GENERAL);
7404 options->tls_cert_profile = p[1];
7405 }
7406 else if (streq(p[0], "tls-ciphersuites") && p[1] && !p[2])
7407 {
7408 VERIFY_PERMISSION(OPT_P_GENERAL);
7409 options->cipher_list_tls13 = p[1];
7410 }
7411 else if (streq(p[0], "tls-groups") && p[1] && !p[2])
7412 {
7413 VERIFY_PERMISSION(OPT_P_GENERAL);
7414 options->tls_groups = p[1];
7415 }
7416 else if (streq(p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || !p[2]))
7417 {
7418 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7419 if (p[2] && streq(p[2], "dir"))
7420 {
7421 options->ssl_flags |= SSLF_CRL_VERIFY_DIR;
7422 }
7423 options->crl_file = p[1];
7424 options->crl_file_inline = is_inline;
7425 }
7426 else if (streq(p[0], "tls-verify") && p[1])
7427 {
7428 VERIFY_PERMISSION(OPT_P_SCRIPT);
7429 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7430 {
7431 goto err;
7432 }
7433 set_user_script(options, &options->tls_verify,
7434 string_substitute(p[1], ',', ' ', &options->gc), "tls-verify", true);
7435 }
7436 else if (streq(p[0], "tls-export-cert") && p[1] && !p[2])
7437 {
7438 VERIFY_PERMISSION(OPT_P_SCRIPT);
7439 options->tls_export_peer_cert_dir = p[1];
7440 }
7441 else if (streq(p[0], "compat-names"))
7442 {
7443 VERIFY_PERMISSION(OPT_P_GENERAL);
7444 msg(msglevel, "--compat-names was removed in OpenVPN 2.5. "
7445 "Update your configuration.");
7446 goto err;
7447 }
7448 else if (streq(p[0], "no-name-remapping") && !p[1])
7449 {
7450 VERIFY_PERMISSION(OPT_P_GENERAL);
7451 msg(msglevel, "--no-name-remapping was removed in OpenVPN 2.5. "
7452 "Update your configuration.");
7453 goto err;
7454 }
7455 else if (streq(p[0], "verify-x509-name") && p[1] && strlen(p[1]) && !p[3])
7456 {
7457 int type = VERIFY_X509_SUBJECT_DN;
7458 VERIFY_PERMISSION(OPT_P_GENERAL);
7459 if (p[2])
7460 {
7461 if (streq(p[2], "subject"))
7462 {
7463 type = VERIFY_X509_SUBJECT_DN;
7464 }
7465 else if (streq(p[2], "name"))
7466 {
7467 type = VERIFY_X509_SUBJECT_RDN;
7468 }
7469 else if (streq(p[2], "name-prefix"))
7470 {
7471 type = VERIFY_X509_SUBJECT_RDN_PREFIX;
7472 }
7473 else
7474 {
7475 msg(msglevel, "unknown X.509 name type: %s", p[2]);
7476 goto err;
7477 }
7478 }
7479 options->verify_x509_type = type;
7480 options->verify_x509_name = p[1];
7481 }
7482 else if (streq(p[0], "ns-cert-type") && p[1] && !p[2])
7483 {
7484#ifdef ENABLE_CRYPTO_MBEDTLS
7485 msg(msglevel, "--ns-cert-type is not available with mbedtls.");
7486 goto err;
7487#else
7488 VERIFY_PERMISSION(OPT_P_GENERAL);
7489 if (streq(p[1], "server"))
7490 {
7491 options->ns_cert_type = NS_CERT_CHECK_SERVER;
7492 }
7493 else if (streq(p[1], "client"))
7494 {
7495 options->ns_cert_type = NS_CERT_CHECK_CLIENT;
7496 }
7497 else
7498 {
7499 msg(msglevel, "--ns-cert-type must be 'client' or 'server'");
7500 goto err;
7501 }
7502#endif /* ENABLE_CRYPTO_MBEDTLS */
7503 }
7504 else if (streq(p[0], "remote-cert-ku"))
7505 {
7506 VERIFY_PERMISSION(OPT_P_GENERAL);
7507
7508 size_t j;
7509 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7510 {
7511 sscanf(p[j], "%x", &(options->remote_cert_ku[j - 1]));
7512 }
7513 if (j == 1)
7514 {
7515 /* No specific KU required, but require KU to be present */
7516 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
7517 }
7518 }
7519 else if (streq(p[0], "remote-cert-eku") && p[1] && !p[2])
7520 {
7521 VERIFY_PERMISSION(OPT_P_GENERAL);
7522 options->remote_cert_eku = p[1];
7523 }
7524 else if (streq(p[0], "remote-cert-tls") && p[1] && !p[2])
7525 {
7526 VERIFY_PERMISSION(OPT_P_GENERAL);
7527
7528 if (streq(p[1], "server"))
7529 {
7530 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
7531 options->remote_cert_eku = "TLS Web Server Authentication";
7532 }
7533 else if (streq(p[1], "client"))
7534 {
7535 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
7536 options->remote_cert_eku = "TLS Web Client Authentication";
7537 }
7538 else
7539 {
7540 msg(msglevel, "--remote-cert-tls must be 'client' or 'server'");
7541 goto err;
7542 }
7543 }
7544 else if (streq(p[0], "tls-timeout") && p[1] && !p[2])
7545 {
7546 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7547 /* Constrain the timeout to not have problems with
7548 * RELIABLE_MAX_TIMEOUT_SHIFT creating an overflow. 65k seconds
7549 * timeout is already way too much anyway */
7550 if (!atoi_constrained(p[1], &options->tls_timeout, "tls-timeout", 1,
7551 RELIABLE_MAX_INITIAL_TIMEOUT, msglevel))
7552 {
7553 goto err;
7554 }
7555 }
7556 else if (streq(p[0], "reneg-bytes") && p[1] && !p[2])
7557 {
7558 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7559 if (!positive_atoll(p[1], &options->renegotiate_bytes, p[0], msglevel))
7560 {
7561 goto err;
7562 }
7563 }
7564 else if (streq(p[0], "reneg-pkts") && p[1] && !p[2])
7565 {
7566 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7567 if (!positive_atoll(p[1], &options->renegotiate_packets, p[0], msglevel))
7568 {
7569 goto err;
7570 }
7571 }
7572 else if (streq(p[0], "reneg-sec") && p[1] && !p[3])
7573 {
7574 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7575 options->renegotiate_seconds = positive_atoi(p[1], msglevel);
7576 if (p[2])
7577 {
7578 options->renegotiate_seconds_min = positive_atoi(p[2], msglevel);
7579 }
7580 }
7581 else if (streq(p[0], "hand-window") && p[1] && !p[2])
7582 {
7583 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7584 options->handshake_window = positive_atoi(p[1], msglevel);
7585 }
7586 else if (streq(p[0], "tran-window") && p[1] && !p[2])
7587 {
7588 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7589 options->transition_window = positive_atoi(p[1], msglevel);
7590 }
7591 else if (streq(p[0], "tls-auth") && p[1] && !p[3])
7592 {
7593 int key_direction = -1;
7594
7595 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
7596
7597 if (permission_mask & OPT_P_GENERAL)
7598 {
7599 options->tls_auth_file = p[1];
7600 options->tls_auth_file_inline = is_inline;
7601
7602 if (!is_inline && p[2])
7603 {
7604 key_direction = ascii2keydirection(msglevel, p[2]);
7605 if (key_direction < 0)
7606 {
7607 goto err;
7608 }
7609 options->key_direction = key_direction;
7610 }
7611 }
7612 else if (permission_mask & OPT_P_CONNECTION)
7613 {
7614 options->ce.tls_auth_file = p[1];
7615 options->ce.tls_auth_file_inline = is_inline;
7616 options->ce.key_direction = KEY_DIRECTION_BIDIRECTIONAL;
7617
7618 if (!is_inline && p[2])
7619 {
7620 key_direction = ascii2keydirection(msglevel, p[2]);
7621 if (key_direction < 0)
7622 {
7623 goto err;
7624 }
7625 options->ce.key_direction = key_direction;
7626 }
7627 }
7628 }
7629 else if (streq(p[0], "tls-crypt") && p[1] && !p[3])
7630 {
7631 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
7632 if (permission_mask & OPT_P_GENERAL)
7633 {
7634 options->tls_crypt_file = p[1];
7635 options->tls_crypt_file_inline = is_inline;
7636 }
7637 else if (permission_mask & OPT_P_CONNECTION)
7638 {
7639 options->ce.tls_crypt_file = p[1];
7640 options->ce.tls_crypt_file_inline = is_inline;
7641 }
7642 }
7643 else if (streq(p[0], "tls-crypt-v2") && p[1] && !p[3])
7644 {
7645 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
7646 if (permission_mask & OPT_P_GENERAL)
7647 {
7648 options->tls_crypt_v2_file = p[1];
7649 options->tls_crypt_v2_file_inline = is_inline;
7650 }
7651 else if (permission_mask & OPT_P_CONNECTION)
7652 {
7653 options->ce.tls_crypt_v2_file = p[1];
7654 options->ce.tls_crypt_v2_file_inline = is_inline;
7655 }
7656
7657 if (p[2] && streq(p[2], "force-cookie"))
7658 {
7659 options->ce.tls_crypt_v2_force_cookie = true;
7660 }
7661 else if (p[2] && streq(p[2], "allow-noncookie"))
7662 {
7663 options->ce.tls_crypt_v2_force_cookie = false;
7664 }
7665 else if (p[2])
7666 {
7667 msg(msglevel, "Unsupported tls-crypt-v2 argument: %s", p[2]);
7668 }
7669 }
7670 else if (streq(p[0], "tls-crypt-v2-verify") && p[1] && !p[2])
7671 {
7672 VERIFY_PERMISSION(OPT_P_GENERAL);
7673 options->tls_crypt_v2_verify_script = p[1];
7674 }
7675 else if (streq(p[0], "tls-crypt-v2-max-age") && p[1])
7676 {
7677 VERIFY_PERMISSION(OPT_P_GENERAL);
7678 if (!atoi_constrained(p[1], &options->tls_crypt_v2_max_age, "tls-crypt-v2-max-age", 1, INT_MAX, msglevel))
7679 {
7680 goto err;
7681 }
7682 }
7683 else if (streq(p[0], "x509-track") && p[1] && !p[2])
7684 {
7685 VERIFY_PERMISSION(OPT_P_GENERAL);
7686 x509_track_add(&options->x509_track, p[1], msglevel, &options->gc);
7687 }
7688 else if (streq(p[0], "x509-username-field") && p[1])
7689 {
7690 VERIFY_PERMISSION(OPT_P_GENERAL);
7691 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7692 {
7693 char *s = p[j];
7694
7695 if (strncmp("ext:", s, 4) == 0 && !x509_username_field_ext_supported(s + 4))
7696 {
7697 msg(msglevel, "Unsupported x509-username-field extension: %s", s);
7698 }
7699 options->x509_username_field[j - 1] = p[j];
7700 }
7701 }
7702#ifdef ENABLE_PKCS11
7703 else if (streq(p[0], "show-pkcs11-ids") && !p[3])
7704 {
7705 const char *provider = p[1];
7706 bool cert_private = (p[2] == NULL ? false : (atoi_warn(p[2], msglevel) != 0));
7707
7708#ifdef DEFAULT_PKCS11_MODULE
7709 if (!provider)
7710 {
7711 provider = DEFAULT_PKCS11_MODULE;
7712 }
7713 else if (!p[2])
7714 {
7715 char *endp = NULL;
7716 long i = strtol(provider, &endp, 10);
7717
7718 if (*endp == 0)
7719 {
7720 /* There was one argument, and it was purely numeric.
7721 * Interpret it as the cert_private argument */
7722 provider = DEFAULT_PKCS11_MODULE;
7723 cert_private = i;
7724 }
7725 }
7726#else /* ifdef DEFAULT_PKCS11_MODULE */
7727 if (!provider)
7728 {
7729 msg(msglevel, "--show-pkcs11-ids requires a provider parameter");
7730 goto err;
7731 }
7732#endif /* ifdef DEFAULT_PKCS11_MODULE */
7733 VERIFY_PERMISSION(OPT_P_GENERAL);
7734
7735 set_debug_level(options->verbosity, SDL_CONSTRAIN);
7736 show_pkcs11_ids(provider, cert_private);
7737 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
7738 }
7739 else if (streq(p[0], "pkcs11-providers") && p[1])
7740 {
7741 int j;
7742
7743 VERIFY_PERMISSION(OPT_P_GENERAL);
7744
7745 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7746 {
7747 options->pkcs11_providers[j - 1] = p[j];
7748 }
7749 }
7750 else if (streq(p[0], "pkcs11-protected-authentication"))
7751 {
7752 int j;
7753
7754 VERIFY_PERMISSION(OPT_P_GENERAL);
7755
7756 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7757 {
7758 options->pkcs11_protected_authentication[j - 1] =
7759 atoi_warn(p[j], msglevel) != 0 ? 1 : 0;
7760 }
7761 }
7762 else if (streq(p[0], "pkcs11-private-mode") && p[1])
7763 {
7764 int j;
7765
7766 VERIFY_PERMISSION(OPT_P_GENERAL);
7767
7768 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7769 {
7770 sscanf(p[j], "%x", &(options->pkcs11_private_mode[j - 1]));
7771 }
7772 }
7773 else if (streq(p[0], "pkcs11-cert-private"))
7774 {
7775 int j;
7776
7777 VERIFY_PERMISSION(OPT_P_GENERAL);
7778
7779 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7780 {
7781 options->pkcs11_cert_private[j - 1] = (bool)(atoi_warn(p[j], msglevel));
7782 }
7783 }
7784 else if (streq(p[0], "pkcs11-pin-cache") && p[1] && !p[2])
7785 {
7786 VERIFY_PERMISSION(OPT_P_GENERAL);
7787 options->pkcs11_pin_cache_period = positive_atoi(p[1], msglevel);
7788 }
7789 else if (streq(p[0], "pkcs11-id") && p[1] && !p[2])
7790 {
7791 VERIFY_PERMISSION(OPT_P_GENERAL);
7792 options->pkcs11_id = p[1];
7793 }
7794 else if (streq(p[0], "pkcs11-id-management") && !p[1])
7795 {
7796 VERIFY_PERMISSION(OPT_P_GENERAL);
7797 options->pkcs11_id_management = true;
7798 }
7799#endif /* ifdef ENABLE_PKCS11 */
7800 else if (streq(p[0], "rmtun") && !p[1])
7801 {
7802 VERIFY_PERMISSION(OPT_P_GENERAL);
7803 options->persist_config = true;
7804 options->persist_mode = 0;
7805 }
7806 else if (streq(p[0], "mktun") && !p[1])
7807 {
7808 VERIFY_PERMISSION(OPT_P_GENERAL);
7809 options->persist_config = true;
7810 options->persist_mode = 1;
7811 }
7812 else if (streq(p[0], "peer-id") && p[1] && !p[2])
7813 {
7814 VERIFY_PERMISSION(OPT_P_PEER_ID);
7815 options->use_peer_id = true;
7816 options->peer_id = atoi_warn(p[1], msglevel);
7817 }
7818 else if (streq(p[0], "keying-material-exporter") && p[1] && p[2])
7819 {
7820 VERIFY_PERMISSION(OPT_P_GENERAL);
7821
7822 if (strncmp(p[1], "EXPORTER", 8))
7823 {
7824 msg(msglevel, "Keying material exporter label must begin with "
7825 "\"EXPORTER\"");
7826 goto err;
7827 }
7828 if (streq(p[1], EXPORT_KEY_DATA_LABEL))
7829 {
7830 msg(msglevel,
7831 "Keying material exporter label must not be '" EXPORT_KEY_DATA_LABEL "'.");
7832 }
7833
7834 if (!atoi_constrained(p[2], &options->keying_material_exporter_length,
7835 p[0], 16, 4095, msglevel))
7836 {
7837 goto err;
7838 }
7839
7840 options->keying_material_exporter_label = p[1];
7841 }
7842 else if (streq(p[0], "allow-recursive-routing") && !p[1])
7843 {
7844 VERIFY_PERMISSION(OPT_P_GENERAL);
7845 options->allow_recursive_routing = true;
7846 }
7847 else if (streq(p[0], "vlan-tagging") && !p[1])
7848 {
7849 VERIFY_PERMISSION(OPT_P_GENERAL);
7850 options->vlan_tagging = true;
7851 }
7852 else if (streq(p[0], "vlan-accept") && p[1] && !p[2])
7853 {
7854 VERIFY_PERMISSION(OPT_P_GENERAL);
7855 if (streq(p[1], "tagged"))
7856 {
7857 options->vlan_accept = VLAN_ONLY_TAGGED;
7858 }
7859 else if (streq(p[1], "untagged"))
7860 {
7861 options->vlan_accept = VLAN_ONLY_UNTAGGED_OR_PRIORITY;
7862 }
7863 else if (streq(p[1], "all"))
7864 {
7865 options->vlan_accept = VLAN_ALL;
7866 }
7867 else
7868 {
7869 msg(msglevel, "--vlan-accept must be 'tagged', 'untagged' or 'all'");
7870 goto err;
7871 }
7872 }
7873 else if (streq(p[0], "vlan-pvid") && p[1] && !p[2])
7874 {
7875 int vlan_pvid;
7876 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
7877 if (!atoi_constrained(p[1], &vlan_pvid, p[0],
7878 OPENVPN_8021Q_MIN_VID, OPENVPN_8021Q_MAX_VID, msglevel))
7879 {
7880 goto err;
7881 }
7882 options->vlan_pvid = (uint16_t)vlan_pvid;
7883 }
7884 else
7885 {
7886 int i;
7887 msglvl_t msglevel_unknown = msglevel_fc;
7888 /* Check if an option is in --ignore-unknown-option and
7889 * set warning level to non fatal */
7890 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
7891 {
7892 if (streq(p[0], options->ignore_unknown_option[i]))
7893 {
7894 msglevel_unknown = M_WARN;
7895 break;
7896 }
7897 }
7898 if (file)
7899 {
7900 msg(msglevel_unknown,
7901 "Unrecognized option or missing or extra parameter(s) in %s:%d: %s (%s)", file,
7902 line, p[0], PACKAGE_VERSION);
7903 }
7904 else
7905 {
7906 msg(msglevel_unknown, "Unrecognized option or missing or extra parameter(s): --%s (%s)",
7907 p[0], PACKAGE_VERSION);
7908 }
7909 }
7910err:
7911 gc_free(&gc);
7912}
7913
7914#if defined(__GNUC__) || defined(__clang__)
7915#pragma GCC diagnostic pop
7916#endif
7917
7918bool
7919has_udp_in_local_list(const struct options *options)
7920{
7921 if (options->ce.local_list)
7922 {
7923 for (int i = 0; i < options->ce.local_list->len; i++)
7924 {
7925 if (proto_is_dgram(options->ce.local_list->array[i]->proto))
7926 {
7927 return true;
7928 }
7929 }
7930 }
7931
7932 return false;
7933}
buf_clear
void buf_clear(struct buffer *buf)
Zeroise and reset a buffer.
Definition buffer.c:148
buf_printf
bool buf_printf(struct buffer *buf, const char *format,...)
printf-style append to a buffer with overflow check.
Definition buffer.c:226
gc_transfer
void gc_transfer(struct gc_arena *dest, struct gc_arena *src)
Move all allocations from one garbage collection arena to another.
Definition buffer.c:429
gc_realloc
void * gc_realloc(void *ptr, size_t size, struct gc_arena *a)
allows to realloc a pointer previously allocated by gc_malloc or gc_realloc
Definition buffer.c:343
string_defined_equal
bool string_defined_equal(const char *s1, const char *s2)
Definition buffer.c:1089
gc_malloc
void * gc_malloc(size_t size, bool clear, struct gc_arena *a)
Allocate memory and, optionally, zero it.
Definition buffer.c:318
alloc_buf_gc
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Allocate a buffer of the given size under garbage collection.
Definition buffer.c:77
string_array_len
int string_array_len(const char **array)
Return the number of elements in a NULL-terminated array of strings.
Definition buffer.c:661
buffer_read_from_file
struct buffer buffer_read_from_file(const char *filename, struct gc_arena *gc)
buffer_read_from_file - copy the content of a file into a buffer
Definition buffer.c:1356
string_substitute
char * string_substitute(const char *src, char from, char to, struct gc_arena *gc)
Definition buffer.c:1102
string_alloc
char * string_alloc(const char *str, struct gc_arena *gc)
Duplicate a string, allocating memory under garbage collection.
Definition buffer.c:616
buffer.h
Buffer management functions and garbage collection.
gc_detach
static void gc_detach(struct gc_arena *a)
Detach all allocations from an arena without freeing them.
Definition buffer.h:1947
BSTR
#define BSTR(buf)
Return the buffer content pointer cast to char *.
Definition buffer.h:157
ALLOC_ARRAY_GC
#define ALLOC_ARRAY_GC(dptr, type, n, gc)
Allocate a garbage-collected array of n elements of the given type.
Definition buffer.h:2065
buf_valid
static bool buf_valid(const struct buffer *buf)
Return true iff buf is valid.
Definition buffer.h:412
gc_init
static void gc_init(struct gc_arena *a)
Initialise a garbage collection arena to an empty state.
Definition buffer.h:1932
ALLOC_OBJ_CLEAR_GC
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Allocate and zero-initialise a garbage-collected object of the given type.
Definition buffer.h:2132
ALLOC_OBJ_GC
#define ALLOC_OBJ_GC(dptr, type, gc)
Allocate a garbage-collected object of the given type (uninitialised).
Definition buffer.h:2120
gc_free
static void gc_free(struct gc_arena *a)
Free all allocations in a garbage collection arena.
Definition buffer.h:1974
gc_new
static struct gc_arena gc_new(void)
Allocate and return a new, empty garbage collection arena.
Definition buffer.h:1958
check_cmd_access
bool check_cmd_access(const char *command, const char *opt, const char *chroot)
Verifies that the path in the "command" that comes after certain script options (e....
Definition check_file_access.c:214
options_postprocess_filechecks
void options_postprocess_filechecks(struct options *options)
Sanity check of all file/dir options.
Definition check_file_access.c:250
check_file_access.h
add_client_nat_to_option_list
void add_client_nat_to_option_list(struct client_nat_option_list *dest, const char *type, const char *network, const char *netmask, const char *foreign_network, msglvl_t msglevel)
Definition clinat.c:102
new_client_nat_list
struct client_nat_option_list * new_client_nat_list(struct gc_arena *gc)
Definition clinat.c:71
clone_client_nat_option_list
struct client_nat_option_list * clone_client_nat_option_list(const struct client_nat_option_list *src, struct gc_arena *gc)
Definition clinat.c:79
copy_client_nat_option_list
void copy_client_nat_option_list(struct client_nat_option_list *dest, const struct client_nat_option_list *src)
Definition clinat.c:88
TLS_CHANNEL_BUF_SIZE
#define TLS_CHANNEL_BUF_SIZE
Definition common.h:70
TLS_CHANNEL_MTU_MIN
#define TLS_CHANNEL_MTU_MIN
Definition common.h:83
check_compression_settings_valid
bool check_compression_settings_valid(struct compress_options *info, msglvl_t msglevel)
Checks if the compression settings are valid.
Definition comp.c:162
COMP_F_ALLOW_STUB_ONLY
#define COMP_F_ALLOW_STUB_ONLY
Only accept stub compression, even with COMP_F_ADVERTISE_STUBS_ONLY we still accept other compression...
Definition comp.h:45
COMP_F_SWAP
#define COMP_F_SWAP
initial command byte is swapped with last byte in buffer to preserve payload alignment
Definition comp.h:40
COMP_ALG_LZ4
#define COMP_ALG_LZ4
LZ4 algorithm.
Definition comp.h:59
COMP_ALGV2_LZ4
#define COMP_ALGV2_LZ4
Definition comp.h:64
COMP_F_ALLOW_NOCOMP_ONLY
#define COMP_F_ALLOW_NOCOMP_ONLY
Do not allow compression framing (breaks DCO)
Definition comp.h:51
COMP_F_ALLOW_ASYM
#define COMP_F_ALLOW_ASYM
Compression was explicitly set to allow asymetric compression.
Definition comp.h:49
COMP_ALGV2_UNCOMPRESSED
#define COMP_ALGV2_UNCOMPRESSED
Definition comp.h:63
COMP_ALG_STUB
#define COMP_ALG_STUB
support compression command byte and framing without actual compression
Definition comp.h:56
COMP_ALG_LZO
#define COMP_ALG_LZO
LZO algorithm.
Definition comp.h:57
COMP_F_ADVERTISE_STUBS_ONLY
#define COMP_F_ADVERTISE_STUBS_ONLY
tell server that we only support compression stubs
Definition comp.h:42
COMP_F_MIGRATE
#define COMP_F_MIGRATE
push stub-v2 or comp-lzo no when we see a client with comp-lzo in occ
Definition comp.h:47
comp_non_stub_enabled
static bool comp_non_stub_enabled(const struct compress_options *info)
Definition comp.h:81
COMP_ALG_UNDEF
#define COMP_ALG_UNDEF
Definition comp.h:54
strsep
char * strsep(char **stringp, const char *delim)
Definition compat-strsep.c:35
ascii2keydirection
int ascii2keydirection(msglvl_t msglevel, const char *str)
Definition crypto.c:1630
check_tls_prf_working
bool check_tls_prf_working(void)
Checks if the current TLS library supports the TLS 1.0 PRF with MD5+SHA1 that OpenVPN uses when TLS K...
Definition crypto.c:1914
crypto.h
Data Channel Cryptography Module.
CO_USE_TLS_KEY_MATERIAL_EXPORT
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition crypto.h:359
CO_USE_DYNAMIC_TLS_CRYPT
#define CO_USE_DYNAMIC_TLS_CRYPT
Bit-flag indicating that renegotiations are using tls-crypt with a TLS-EKM derived key.
Definition crypto.h:375
CO_EPOCH_DATA_KEY_FORMAT
#define CO_EPOCH_DATA_KEY_FORMAT
Bit-flag indicating the epoch the data format.
Definition crypto.h:379
KEY_DIRECTION_BIDIRECTIONAL
#define KEY_DIRECTION_BIDIRECTIONAL
Definition crypto.h:231
CO_USE_CC_EXIT_NOTIFY
#define CO_USE_CC_EXIT_NOTIFY
Bit-flag indicating that explicit exit notifies should be sent via the control channel instead of usi...
Definition crypto.h:371
MD_SHA256
@ MD_SHA256
Definition crypto_backend.h:61
MD_SHA1
@ MD_SHA1
Definition crypto_backend.h:60
SHA_DIGEST_LENGTH
#define SHA_DIGEST_LENGTH
Definition crypto_mbedtls.h:62
SHA256_DIGEST_LENGTH
#define SHA256_DIGEST_LENGTH
Definition crypto_mbedtls.h:63
dco_check_startup_option
static bool dco_check_startup_option(msglvl_t msglevel, const struct options *o)
Definition dco.h:280
dco_check_option
static bool dco_check_option(msglvl_t msglevel, const struct options *o)
Definition dco.h:274
dco_version_string
static const char * dco_version_string(struct gc_arena *gc)
Definition dco.h:268
dns_options_verify
bool dns_options_verify(msglvl_t msglevel, const struct dns_options *o)
Checks validity of DNS options.
Definition dns.c:212
dns_options_postprocess_pull
void dns_options_postprocess_pull(struct dns_options *o)
Merges pulled DNS servers with static ones into an ordered list.
Definition dns.c:289
dns_server_addr_parse
bool dns_server_addr_parse(struct dns_server *server, const char *addr)
Parses a string IPv4 or IPv6 address and optional colon separated port, into a in_addr or in6_addr re...
Definition dns.c:62
dns_domain_list_append
bool dns_domain_list_append(struct dns_domain **entry, char **domains, struct gc_arena *gc)
Appends safe DNS domain parameters to a linked list.
Definition dns.c:148
dns_server_get
struct dns_server * dns_server_get(struct dns_server **entry, long priority, struct gc_arena *gc)
Find or create DNS server with priority in a linked list.
Definition dns.c:190
dns_server_priority_parse
bool dns_server_priority_parse(long *priority, const char *str, bool pulled)
Parses a string DNS server priority and validates it.
Definition dns.c:175
clone_dns_options
struct dns_options clone_dns_options(const struct dns_options *o, struct gc_arena *gc)
Makes a deep copy of the passed DNS options.
Definition dns.c:266
dns_options_preprocess_pull
void dns_options_preprocess_pull(struct dns_options *o)
Saves and resets the server options, so that pulled ones don't mix in.
Definition dns.c:282
dns_updown_user_set
static bool dns_updown_user_set(const struct dns_options *o)
Returns whether dns-updown is user defined.
Definition dns.h:218
DNS_UPDOWN_FORCED
@ DNS_UPDOWN_FORCED
Definition dns.h:50
DNS_UPDOWN_NO_FLAGS
@ DNS_UPDOWN_NO_FLAGS
Definition dns.h:48
DNS_UPDOWN_USER_SET
@ DNS_UPDOWN_USER_SET
Definition dns.h:49
DNS_SECURITY_NO
@ DNS_SECURITY_NO
Definition dns.h:33
DNS_SECURITY_YES
@ DNS_SECURITY_YES
Definition dns.h:34
DNS_SECURITY_OPTIONAL
@ DNS_SECURITY_OPTIONAL
Definition dns.h:35
dns_updown_forced
static bool dns_updown_forced(const struct dns_options *o)
Returns whether dns-updown is forced to run.
Definition dns.h:229
DNS_TRANSPORT_PLAIN
@ DNS_TRANSPORT_PLAIN
Definition dns.h:41
DNS_TRANSPORT_TLS
@ DNS_TRANSPORT_TLS
Definition dns.h:43
DNS_TRANSPORT_HTTPS
@ DNS_TRANSPORT_HTTPS
Definition dns.h:42
domain_helper.h
validate_domain
static bool validate_domain(const char *domain)
Definition domain_helper.h:34
setenv_int
void setenv_int(struct env_set *es, const char *name, int value)
Definition env_set.c:291
setenv_str_i
void setenv_str_i(struct env_set *es, const char *name, const char *value, const int i)
Definition env_set.c:423
setenv_str
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition env_set.c:307
env_set_get
const char * env_set_get(const struct env_set *es, const char *name)
Definition env_set.c:201
setenv_str_safe
void setenv_str_safe(struct env_set *es, const char *name, const char *value)
Definition env_set.c:313
env_set_del
bool env_set_del(struct env_set *es, const char *str)
Definition env_set.c:183
setenv_long_long
void setenv_long_long(struct env_set *es, const char *name, long long value)
Definition env_set.c:299
D_PUSH
#define D_PUSH
Definition errlevel.h:82
D_TLS_DEBUG_MED
#define D_TLS_DEBUG_MED
Definition errlevel.h:156
D_DCO
#define D_DCO
Definition errlevel.h:93
D_PUSH_ERRORS
#define D_PUSH_ERRORS
Definition errlevel.h:66
D_TLS_ERRORS
#define D_TLS_ERRORS
Definition errlevel.h:58
M_INFO
#define M_INFO
Definition errlevel.h:54
forward.h
Interface functions to the internal and external multiplexers.
RELIABLE_MAX_INITIAL_TIMEOUT
#define RELIABLE_MAX_INITIAL_TIMEOUT
Maximum initial timeout (–tls-timeout) we accept.
Definition reliable.h:65
helper_setdefault_topology
void helper_setdefault_topology(struct options *o)
Set –topology default depending on –mode.
Definition helper.c:129
helper_tcp_nodelay
void helper_tcp_nodelay(struct options *o)
Definition helper.c:601
helper_client_server
void helper_client_server(struct options *o)
Definition helper.c:157
helper_keepalive
void helper_keepalive(struct options *o)
Definition helper.c:540
max_int
static int max_int(int x, int y)
Definition integer.h:92
constrain_int
static int constrain_int(int x, int min, int max)
Definition integer.h:118
tls_verify
static int tls_verify(struct openvpn_plugin_args_func_in const *args)
Definition keyingmaterialexporter.c:166
management_auth_token
void management_auth_token(const char *token)
Definition manage.c:3222
management_echo
void management_echo(struct management *man, const char *string, const bool pull)
Definition manage.c:3143
MF_FORGET_DISCONNECT
#define MF_FORGET_DISCONNECT
Definition manage.h:31
MF_EXTERNAL_KEY_PKCS1PAD
#define MF_EXTERNAL_KEY_PKCS1PAD
Definition manage.h:38
MF_CLIENT_AUTH
#define MF_CLIENT_AUTH
Definition manage.h:33
MF_EXTERNAL_KEY_PSSPAD
#define MF_EXTERNAL_KEY_PSSPAD
Definition manage.h:43
MF_EXTERNAL_KEY_NOPADDING
#define MF_EXTERNAL_KEY_NOPADDING
Definition manage.h:37
MF_QUERY_PROXY
#define MF_QUERY_PROXY
Definition manage.h:41
MF_EXTERNAL_KEY
#define MF_EXTERNAL_KEY
Definition manage.h:36
MF_QUERY_REMOTE
#define MF_QUERY_REMOTE
Definition manage.h:40
MF_QUERY_PASSWORDS
#define MF_QUERY_PASSWORDS
Definition manage.h:28
MF_EXTERNAL_CERT
#define MF_EXTERNAL_CERT
Definition manage.h:42
MF_EXTERNAL_KEY_DIGEST
#define MF_EXTERNAL_KEY_DIGEST
Definition manage.h:44
MF_UP_DOWN
#define MF_UP_DOWN
Definition manage.h:39
MF_HOLD
#define MF_HOLD
Definition manage.h:29
MF_SIGNAL
#define MF_SIGNAL
Definition manage.h:30
MF_UNIX_SOCK
#define MF_UNIX_SOCK
Definition manage.h:35
MF_CONNECT_AS_CLIENT
#define MF_CONNECT_AS_CLIENT
Definition manage.h:32
MBUF_SIZE_MAX
#define MBUF_SIZE_MAX
Definition mbuf.h:40
USER_PASS_LEN
#define USER_PASS_LEN
Definition misc.h:67
SC_CONCAT
#define SC_CONCAT
Definition misc.h:95
SC_ECHO
#define SC_ECHO
Definition misc.h:94
translate_mtu_discover_type_name
int translate_mtu_discover_type_name(const char *name)
Definition mtu.c:261
MSSFIX_DEFAULT
#define MSSFIX_DEFAULT
Definition mtu.h:89
TUN_MTU_MAX_MIN
#define TUN_MTU_MAX_MIN
Definition mtu.h:79
TAP_MTU_EXTRA_DEFAULT
#define TAP_MTU_EXTRA_DEFAULT
Definition mtu.h:84
LINK_MTU_DEFAULT
#define LINK_MTU_DEFAULT
Definition mtu.h:64
TUN_MTU_DEFAULT
#define TUN_MTU_DEFAULT
Definition mtu.h:69
TUN_MTU_MAX
#define TUN_MTU_MAX
Maximum MTU we accept for MTU related options.
Definition mtu.h:74
TUN_MTU_MIN
#define TUN_MTU_MIN
Definition mtu.h:59
TLS_MTU_DEFAULT
#define TLS_MTU_DEFAULT
Definition mtu.h:94
learn_address_script
static bool learn_address_script(const struct multi_context *m, const struct multi_instance *mi, const char *op, const struct mroute_addr *addr)
Definition multi.c:83
net_ctx_init
static int net_ctx_init(struct context *c, openvpn_net_ctx_t *ctx)
Definition networking.h:47
openvpn_net_ctx_t
void * openvpn_net_ctx_t
Definition networking.h:38
BOOL_CAST
#define BOOL_CAST(x)
Definition basic.h:26
CLEAR
#define CLEAR(x)
Definition basic.h:32
SIZE
#define SIZE(x)
Definition basic.h:29
errors_to_stderr
void errors_to_stderr(void)
Definition error.c:181
open_syslog
void open_syslog(const char *pgmname, bool stdio_to_null)
Definition error.c:444
redirect_stdout_stderr
void redirect_stdout_stderr(const char *file, bool append)
Definition error.c:493
openvpn_exit
void openvpn_exit(const int status)
Definition error.c:709
set_suppress_timestamps
void set_suppress_timestamps(bool suppressed)
Definition error.c:145
set_machine_readable_output
void set_machine_readable_output(bool parsable)
Definition error.c:151
msg_fp
FILE * msg_fp(const msglvl_t flags)
Definition error.c:190
set_debug_level
bool set_debug_level(const int level, const unsigned int flags)
Definition error.c:103
SDL_CONSTRAIN
#define SDL_CONSTRAIN
Definition error.h:201
M_NOPREFIX
#define M_NOPREFIX
Definition error.h:98
M_DEBUG_LEVEL
#define M_DEBUG_LEVEL
Definition error.h:88
M_USAGE
#define M_USAGE
Definition error.h:107
OPENVPN_EXIT_STATUS_USAGE
#define OPENVPN_EXIT_STATUS_USAGE
Definition error.h:54
OPENVPN_EXIT_STATUS_GOOD
#define OPENVPN_EXIT_STATUS_GOOD
Definition error.h:52
M_FATAL
#define M_FATAL
Definition error.h:90
M_ERR
#define M_ERR
Definition error.h:106
msg
#define msg(flags,...)
Definition error.h:152
msglvl_t
unsigned int msglvl_t
Definition error.h:77
ASSERT
#define ASSERT(x)
Definition error.h:219
M_WARN
#define M_WARN
Definition error.h:92
MAX_PEER_ID
#define MAX_PEER_ID
Definition openvpn.h:550
RESET_OPTION_ROUTES
#define RESET_OPTION_ROUTES(option_ptr, field)
Definition options.c:3660
rol6_check_alloc
static void rol6_check_alloc(struct options *options)
Definition options.c:1306
options_postprocess_verify_ce
static void options_postprocess_verify_ce(const struct options *options, const struct connection_entry *ce)
Definition options.c:1608
NM_QUOTE_HINT
#define NM_QUOTE_HINT
Definition options.c:3627
options_postprocess_mutate_ce
static void options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
Definition options.c:2269
usage_version
static void usage_version(void)
Definition options.c:3519
get_ip_addr
static in_addr_t get_ip_addr(const char *ip_string, msglvl_t msglevel, bool *error)
Definition options.c:1042
alloc_pull_filter
static struct pull_filter * alloc_pull_filter(struct options *o)
Definition options.c:1512
USAGE_VALID_SERVER_PROTOS
#define USAGE_VALID_SERVER_PROTOS
pre_connect_save
static void pre_connect_save(struct options *o)
Definition options.c:2460
setenv_connection_entry
static void setenv_connection_entry(struct env_set *es, const struct connection_entry *e, const int i)
Definition options.c:919
global_auth_retry
static int global_auth_retry
Definition options.c:3398
options_postprocess_pull
bool options_postprocess_pull(struct options *o, struct env_set *es)
Definition options.c:3331
remove_option
void remove_option(struct context *c, struct options *options, char *p[], bool is_inline, const char *file, int line, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Resets options found in the PUSH_UPDATE message that are preceded by the - flag.
Definition options.c:3668
uninit_options
void uninit_options(struct options *o)
Definition options.c:903
connection_entry_load_re
static void connection_entry_load_re(struct connection_entry *ce, const struct remote_entry *re)
Definition options.c:1533
parse_topology
int parse_topology(const char *str, const msglvl_t msglevel)
Definition options.c:3351
show_windows_version
void show_windows_version(const unsigned int flags)
Definition options.c:3486
VERIFY_PERMISSION
#define VERIFY_PERMISSION(mask)
Definition options.c:3567
key_is_external
bool key_is_external(const struct options *options)
Definition options.c:4156
check_ca_required
static void check_ca_required(const struct options *options)
Definition options.c:1570
parse_http_proxy_override
static struct http_proxy_options * parse_http_proxy_override(const char *server, const char *port, const char *flags, struct gc_arena *gc)
Definition options.c:1326
init_options
void init_options(struct options *o)
Definition options.c:801
tuntap_options_postprocess_dns
static void tuntap_options_postprocess_dns(struct options *o)
Postprocess DNS related settings.
Definition options.c:2844
dhcp_option_dns6_parse
static void dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, unsigned int *len, msglvl_t msglevel)
Definition options.c:1192
get_ipv6_addr_no_netbits
static char * get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
Returns newly allocated string containing address part without "/nn".
Definition options.c:1067
option_iroute_ipv6
static void option_iroute_ipv6(struct options *o, const char *prefix_str, msglvl_t msglevel)
Definition options.c:1260
check_route_option
static bool check_route_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:3830
show_dco_version
void show_dco_version(const unsigned int flags)
Definition options.c:3495
rol_check_alloc
void rol_check_alloc(struct options *options)
Definition options.c:1297
alloc_local_list_if_undef
static struct local_list * alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
Definition options.c:1389
dhcp_option_address_parse
static void dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, unsigned int *len, msglvl_t msglevel)
Definition options.c:1206
helper_hashmap_sizes
static void helper_hashmap_sizes(struct options *o)
Sets the internal hash maps sizes according to the max_clients.
Definition options.c:3104
set_user_script
static void set_user_script(struct options *options, const char **script, const char *new_script, const char *type, bool in_chroot)
Definition options.c:4117
update_option
void update_option(struct context *c, struct options *options, char *p[], bool is_inline, const char *file, int line, const int level, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Processes an option to update.
Definition options.c:3988
verify_permission
static bool verify_permission(const char *name, const char *file, int line, const uint64_t type, const uint64_t allowed, uint64_t *found, const msglvl_t msglevel, struct options *options, bool is_inline)
Definition options.c:3577
parse_hash_fingerprint_multiline
static struct verify_hash_list * parse_hash_fingerprint_multiline(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
Parses a string consisting of multiple lines of hexstrings and checks if each string has the correct ...
Definition options.c:1153
LZO_LIB_VER_STR
#define LZO_LIB_VER_STR
no_more_than_n_args
static bool no_more_than_n_args(const msglvl_t msglevel, char *p[], const int max, const unsigned int flags)
Definition options.c:3630
options_postprocess_mutate_le
static void options_postprocess_mutate_le(struct connection_entry *ce, struct local_entry *le, int mode)
Definition options.c:2426
options_postprocess
void options_postprocess(struct options *options, struct env_set *es)
Definition options.c:3317
usage_small
void usage_small(void)
Definition options.c:3478
auth_retry_print
const char * auth_retry_print(void)
Definition options.c:3430
alloc_remote_entry
static struct remote_entry * alloc_remote_entry(struct options *options, const msglvl_t msglevel)
Definition options.c:1476
show_library_versions
void show_library_versions(const unsigned int flags)
Definition options.c:3505
setenv_settings
void setenv_settings(struct env_set *es, const struct options *o)
Definition options.c:945
usage_message
static const char usage_message[]
Definition options.c:123
alloc_connection_list_if_undef
static struct connection_list * alloc_connection_list_if_undef(struct options *options)
Definition options.c:1430
cnol_check_alloc
static void cnol_check_alloc(struct options *options)
Definition options.c:1315
options_postprocess_mutate
static void options_postprocess_mutate(struct options *o, struct env_set *es)
Definition options.c:3117
options_detach
void options_detach(struct options *o)
Definition options.c:1277
atou
static unsigned int atou(const char *str)
Definition options.c:3559
pre_connect_restore
void pre_connect_restore(struct options *o, struct gc_arena *gc)
Definition options.c:2505
alloc_pull_filter_list
static struct pull_filter_list * alloc_pull_filter_list(struct options *o)
Definition options.c:1502
print_topology
const char * print_topology(const int topology)
Definition options.c:3373
parse_hash_fingerprint
static struct verify_hash_list * parse_hash_fingerprint(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
Parses a hexstring and checks if the string has the correct length.
Definition options.c:1100
check_dns_option
static bool check_dns_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:3879
options_postprocess_cipher
static void options_postprocess_cipher(struct options *o)
Definition options.c:2678
options_set_backwards_compatible_options
static void options_set_backwards_compatible_options(struct options *o)
Changes default values so that OpenVPN can be compatible with the user specified version.
Definition options.c:2748
MUST_BE_FALSE
#define MUST_BE_FALSE(condition, parm_name)
Definition options.c:1601
MUST_BE_UNDEF
#define MUST_BE_UNDEF(parm, parm_name)
Definition options.c:1596
options_postprocess_http_proxy_override
static void options_postprocess_http_proxy_override(struct options *o)
Definition options.c:1354
options_postprocess_mutate_invariant
static void options_postprocess_mutate_invariant(struct options *options)
Definition options.c:2578
ipv6_addr_safe_hexplusbits
static bool ipv6_addr_safe_hexplusbits(const char *ipv6_prefix_spec)
Definition options.c:1085
title_string
const char title_string[]
Definition options.c:73
setenv_local_entry
static void setenv_local_entry(struct env_set *es, const struct local_entry *e, const int i)
Definition options.c:937
remap_redirect_gateway_flags
static void remap_redirect_gateway_flags(struct options *opt)
Definition options.c:2444
msglevel_forward_compatible
static msglvl_t msglevel_forward_compatible(struct options *options, const msglvl_t msglevel)
Definition options.c:3655
auth_retry_set
bool auth_retry_set(const msglvl_t msglevel, const char *option)
Definition options.c:3407
auth_retry_get
int auth_retry_get(void)
Definition options.c:3401
alloc_remote_list_if_undef
static struct remote_list * alloc_remote_list_if_undef(struct options *options)
Definition options.c:1466
check_route6_option
static bool check_route6_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:3858
notnull
void notnull(const char *arg, const char *description)
Definition options.c:3541
usage
void usage(void)
Definition options.c:3452
alloc_local_entry
static struct local_entry * alloc_local_entry(struct connection_entry *ce, const msglvl_t msglevel, struct gc_arena *gc)
Definition options.c:1399
show_compression_warning
static void show_compression_warning(struct compress_options *info)
Definition options.c:4144
options_process_mutate_prf
static void options_process_mutate_prf(struct options *o)
Definition options.c:2816
add_option
void add_option(struct options *options, char *p[], bool is_inline, const char *file, int line, const int level, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options.c:4175
has_udp_in_local_list
bool has_udp_in_local_list(const struct options *options)
Definition options.c:7919
option_iroute
static void option_iroute(struct options *o, const char *network_str, const char *netmask_str, msglvl_t msglevel)
Definition options.c:1233
options_postprocess_verify
static void options_postprocess_verify(const struct options *o)
Definition options.c:2641
connection_entry_preload_key
static void connection_entry_preload_key(const char **key_file, bool *key_inline, struct gc_arena *gc)
Definition options.c:1554
alloc_connection_entry
static struct connection_entry * alloc_connection_entry(struct options *options, const msglvl_t msglevel)
Definition options.c:1440
need_compatibility_before
static bool need_compatibility_before(const struct options *o, unsigned int version)
The option –compat-mode is used to set up default settings to values used on the specified openvpn ve...
Definition options.c:2738
MODE_POINT_TO_POINT
#define MODE_POINT_TO_POINT
Definition options.h:264
OPT_P_SCRIPT
#define OPT_P_SCRIPT
Definition options.h:735
PUF_TYPE_ACCEPT
#define PUF_TYPE_ACCEPT
filter type to accept a matching option
Definition options.h:800
OPT_P_PUSH
#define OPT_P_PUSH
Definition options.h:747
SF_TCP_NODELAY_HELPER
#define SF_TCP_NODELAY_HELPER
Definition options.h:475
OPT_P_UP
#define OPT_P_UP
Definition options.h:732
OPT_P_CONNECTION
#define OPT_P_CONNECTION
Definition options.h:758
OPT_P_INSTANCE
#define OPT_P_INSTANCE
allowed in ccd, client-connect etc
Definition options.h:748
OPT_P_NCP
#define OPT_P_NCP
Negotiable crypto parameters.
Definition options.h:743
OPT_P_ECHO
#define OPT_P_ECHO
Definition options.h:751
OPT_P_ROUTE_TABLE
#define OPT_P_ROUTE_TABLE
Definition options.h:762
OPT_P_CONFIG
#define OPT_P_CONFIG
Definition options.h:749
MODE_SERVER
#define MODE_SERVER
Definition options.h:265
CONNECTION_LIST_SIZE
#define CONNECTION_LIST_SIZE
Definition options.h:192
streq
#define streq(x, y)
Definition options.h:726
OPT_P_U_REDIR_GATEWAY
#define OPT_P_U_REDIR_GATEWAY
Definition options.h:795
OPT_P_EXPLICIT_NOTIFY
#define OPT_P_EXPLICIT_NOTIFY
Definition options.h:750
PUF_TYPE_IGNORE
#define PUF_TYPE_IGNORE
filter type to ignore a matching option
Definition options.h:801
AR_INTERACT
#define AR_INTERACT
Definition options.h:940
OPT_P_SHAPER
#define OPT_P_SHAPER
Definition options.h:737
OPT_P_U_ROUTE6
#define OPT_P_U_ROUTE6
Definition options.h:792
dco_enabled
static bool dco_enabled(const struct options *o)
Returns whether the current configuration has dco enabled.
Definition options.h:961
OPT_P_SOCKFLAGS
#define OPT_P_SOCKFLAGS
Definition options.h:757
SF_NOPOOL
#define SF_NOPOOL
Definition options.h:474
PUF_TYPE_REJECT
#define PUF_TYPE_REJECT
filter type to reject and trigger SIGUSR1
Definition options.h:802
OPT_P_MESSAGES
#define OPT_P_MESSAGES
Definition options.h:742
OPT_P_SETENV
#define OPT_P_SETENV
Definition options.h:736
OPT_P_SOCKBUF
#define OPT_P_SOCKBUF
Definition options.h:756
OPT_P_PLUGIN
#define OPT_P_PLUGIN
Definition options.h:755
OPTION_PARM_SIZE
#define OPTION_PARM_SIZE
Definition options.h:56
OPT_P_TIMER
#define OPT_P_TIMER
Definition options.h:738
OPT_P_GENERAL
#define OPT_P_GENERAL
Definition options.h:731
read_config_file
void read_config_file(struct options *options, const char *file, int level, const char *top_file, const int top_line, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options_parse.c:347
PING_RESTART
#define PING_RESTART
Definition options.h:356
OPT_P_DHCPDNS
#define OPT_P_DHCPDNS
Definition options.h:734
OPT_P_PULL_MODE
#define OPT_P_PULL_MODE
Definition options.h:754
GENKEY_AUTH_TOKEN
@ GENKEY_AUTH_TOKEN
Definition options.h:244
GENKEY_SECRET
@ GENKEY_SECRET
Definition options.h:241
GENKEY_TLS_CRYPTV2_SERVER
@ GENKEY_TLS_CRYPTV2_SERVER
Definition options.h:243
GENKEY_TLS_CRYPTV2_CLIENT
@ GENKEY_TLS_CRYPTV2_CLIENT
Definition options.h:242
OPT_P_PUSH_MTU
#define OPT_P_PUSH_MTU
Definition options.h:761
AR_NONE
#define AR_NONE
Definition options.h:939
AR_NOINTERACT
#define AR_NOINTERACT
Definition options.h:941
SF_NO_PUSH_ROUTE_GATEWAY
#define SF_NO_PUSH_ROUTE_GATEWAY
Definition options.h:476
OPT_P_PERSIST
#define OPT_P_PERSIST
Definition options.h:739
MAX_PARMS
#define MAX_PARMS
Definition options.h:51
OPT_P_U_DNS
#define OPT_P_U_DNS
Definition options.h:793
PLUGIN_OPTION_LIST
#define PLUGIN_OPTION_LIST(opt)
Definition options.h:777
ROUTE_OPTION_FLAGS
#define ROUTE_OPTION_FLAGS(o)
Definition options.h:769
OPT_P_U_ROUTE
#define OPT_P_U_ROUTE
Definition options.h:791
PING_EXIT
#define PING_EXIT
Definition options.h:355
OPT_P_COMP
#define OPT_P_COMP
Definition options.h:741
OPT_P_PERSIST_IP
#define OPT_P_PERSIST_IP
Definition options.h:740
OPT_P_MTU
#define OPT_P_MTU
Definition options.h:745
OPT_P_ROUTE_EXTRAS
#define OPT_P_ROUTE_EXTRAS
Definition options.h:753
OPT_P_U_DHCP
#define OPT_P_U_DHCP
Definition options.h:794
OPT_P_NICE
#define OPT_P_NICE
Definition options.h:746
OPT_P_PEER_ID
#define OPT_P_PEER_ID
Definition options.h:759
OPT_P_INHERIT
#define OPT_P_INHERIT
Definition options.h:752
OPT_P_TLS_PARMS
#define OPT_P_TLS_PARMS
Definition options.h:744
OPT_P_ROUTE
#define OPT_P_ROUTE
Definition options.h:733
PING_TIMEOUT_MAX
#define PING_TIMEOUT_MAX
Definition options.h:59
read_config_string
void read_config_string(const char *prefix, struct options *options, const char *config, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options_parse.c:421
MAN_CLIENT_AUTH_ENABLED
#define MAN_CLIENT_AUTH_ENABLED(opt)
Definition options.h:783
CE_DISABLED
#define CE_DISABLED
Definition options.h:155
OPT_P_INLINE
#define OPT_P_INLINE
Definition options.h:760
VLAN_ONLY_UNTAGGED_OR_PRIORITY
@ VLAN_ONLY_UNTAGGED_OR_PRIORITY
Definition options.h:227
VLAN_ALL
@ VLAN_ALL
Definition options.h:228
VLAN_ONLY_TAGGED
@ VLAN_ONLY_TAGGED
Definition options.h:226
atoi_warn
int atoi_warn(const char *str, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number.
Definition options_util.c:152
positive_atoi
int positive_atoi(const char *str, msglvl_t msglevel)
Converts a str to a positive number if the string represents a postive integer number.
Definition options_util.c:121
positive_atoll
bool positive_atoll(const char *str, int64_t *value, const char *name, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number and is >= 0.
Definition options_util.c:136
valid_integer
bool valid_integer(const char *str, bool positive)
Checks if the string is a valid integer by checking if it can be converted to an integer.
Definition options_util.c:105
atoi_constrained
bool atoi_constrained(const char *str, int *value, const char *name, int min, int max, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number and is between min...
Definition options_util.c:167
options_util.h
packet_id.h
MAX_SEQ_BACKTRACK
#define MAX_SEQ_BACKTRACK
Definition packet_id.h:85
MIN_SEQ_BACKTRACK
#define MIN_SEQ_BACKTRACK
Definition packet_id.h:84
DEFAULT_SEQ_BACKTRACK
#define DEFAULT_SEQ_BACKTRACK
Definition packet_id.h:86
MAX_TIME_BACKTRACK
#define MAX_TIME_BACKTRACK
Definition packet_id.h:94
DEFAULT_TIME_BACKTRACK
#define DEFAULT_TIME_BACKTRACK
Definition packet_id.h:95
MIN_TIME_BACKTRACK
#define MIN_TIME_BACKTRACK
Definition packet_id.h:93
platform_getpid
unsigned int platform_getpid(void)
Definition platform.c:333
platform_chdir
int platform_chdir(const char *dir)
Definition platform.c:392
platform_get_tmp_dir
const char * platform_get_tmp_dir(void)
Get a directory for temporary files.
Definition platform.c:588
plugin_option_list_new
struct plugin_option_list * plugin_option_list_new(struct gc_arena *gc)
Definition plugin.c:159
plugin_option_list_add
bool plugin_option_list_add(struct plugin_option_list *list, char **p, struct gc_arena *gc)
Definition plugin.c:167
ifconfig_pool_verify_range
bool ifconfig_pool_verify_range(const msglvl_t msglevel, const in_addr_t start, const in_addr_t end)
Definition pool.c:117
OPENVPN_8021Q_MIN_VID
#define OPENVPN_8021Q_MIN_VID
Definition proto.h:316
OPENVPN_8021Q_MAX_VID
#define OPENVPN_8021Q_MAX_VID
Definition proto.h:317
DEV_TYPE_TAP
#define DEV_TYPE_TAP
Definition proto.h:36
TOP_UNDEF
#define TOP_UNDEF
Definition proto.h:40
DEV_TYPE_UNDEF
#define DEV_TYPE_UNDEF
Definition proto.h:34
TOP_NET30
#define TOP_NET30
Definition proto.h:41
DEV_TYPE_TUN
#define DEV_TYPE_TUN
Definition proto.h:35
TOP_P2P
#define TOP_P2P
Definition proto.h:42
TOP_SUBNET
#define TOP_SUBNET
Definition proto.h:43
init_http_proxy_options_once
struct http_proxy_options * init_http_proxy_options_once(struct http_proxy_options **hpo, struct gc_arena *gc)
Definition proxy.c:44
PAR_NCT
#define PAR_NCT
Definition proxy.h:51
MAX_CUSTOM_HTTP_HEADER
#define MAX_CUSTOM_HTTP_HEADER
Definition proxy.h:43
PAR_ALL
#define PAR_ALL
Definition proxy.h:50
push_reset
void push_reset(struct options *o)
Definition push.c:943
push_options
void push_options(struct options *o, char **p, msglvl_t msglevel, struct gc_arena *gc)
Definition push.c:917
clone_push_list
void clone_push_list(struct options *o)
Definition push.c:902
push_remove_option
void push_remove_option(struct options *o, const char *p)
Definition push.c:949
is_special_addr
bool is_special_addr(const char *addr_str)
Definition route.c:288
clone_route_option_list
struct route_option_list * clone_route_option_list(const struct route_option_list *src, struct gc_arena *a)
Definition route.c:155
netmask_to_netbits2
int netmask_to_netbits2(in_addr_t netmask)
Definition route.c:3856
new_route_ipv6_option_list
struct route_ipv6_option_list * new_route_ipv6_option_list(struct gc_arena *a)
Definition route.c:139
delete_routes_v6
void delete_routes_v6(struct route_ipv6_list *rl6, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1185
get_default_gateway_ipv6
void get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest, openvpn_net_ctx_t *ctx)
Definition route.c:2628
add_route_ipv6_to_option_list
void add_route_ipv6_to_option_list(struct route_ipv6_option_list *l, const char *prefix, const char *gateway, const char *metric, int table_id)
Definition route.c:496
copy_route_option_list
void copy_route_option_list(struct route_option_list *dest, const struct route_option_list *src, struct gc_arena *a)
Definition route.c:173
copy_route_ipv6_option_list
void copy_route_ipv6_option_list(struct route_ipv6_option_list *dest, const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:181
print_default_gateway
void print_default_gateway(const msglvl_t msglevel, const struct route_gateway_info *rgi, const struct route_ipv6_gateway_info *rgi6)
Definition route.c:1241
get_default_gateway
void get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
Retrieves the best gateway for a given destination based on the routing table.
Definition route.c:2531
clone_route_ipv6_option_list
struct route_ipv6_option_list * clone_route_ipv6_option_list(const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:164
new_route_option_list
struct route_option_list * new_route_option_list(struct gc_arena *a)
Definition route.c:130
show_routes
void show_routes(msglvl_t msglevel)
Definition route.c:3031
delete_routes_v4
void delete_routes_v4(struct route_list *rl, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1163
add_route_to_option_list
void add_route_to_option_list(struct route_option_list *l, const char *network, const char *netmask, const char *gateway, const char *metric, int table_id)
Definition route.c:481
RG_LOCAL
#define RG_LOCAL
Definition route.h:87
RG_BYPASS_DHCP
#define RG_BYPASS_DHCP
Definition route.h:89
ROUTE_METHOD_SERVICE
#define ROUTE_METHOD_SERVICE
Definition route.h:42
ROUTE_METHOD_IPAPI
#define ROUTE_METHOD_IPAPI
Definition route.h:40
ROUTE_METHOD_EXE
#define ROUTE_METHOD_EXE
Definition route.h:41
RG_DEF1
#define RG_DEF1
Definition route.h:88
RG_BYPASS_DNS
#define RG_BYPASS_DNS
Definition route.h:90
RG_ENABLE
#define RG_ENABLE
Definition route.h:86
RG_REROUTE_GW
#define RG_REROUTE_GW
Definition route.h:91
ROUTE_METHOD_ADAPTIVE
#define ROUTE_METHOD_ADAPTIVE
Definition route.h:39
RG_AUTO_LOCAL
#define RG_AUTO_LOCAL
Definition route.h:92
RG_BLOCK_LOCAL
#define RG_BLOCK_LOCAL
Definition route.h:93
script_security_set
void script_security_set(int level)
Definition run_command.c:48
run_command.h
SSEC_PW_ENV
#define SSEC_PW_ENV
allow calling of built-in programs and user-defined scripts that may receive a password as an environ...
Definition run_command.h:38
SSEC_NONE
#define SSEC_NONE
strictly no calling of external programs
Definition run_command.h:31
SHAPER_MAX
#define SHAPER_MAX
Definition shaper.h:40
SHAPER_MIN
#define SHAPER_MIN
Definition shaper.h:39
get_ipv6_addr
bool get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits, msglvl_t msglevel)
Translate an IPv6 addr or hostname from string form to in6_addr.
Definition socket.c:222
getaddr
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, struct signal_info *sig_info)
Translate an IPv4 addr or hostname from string form to in_addr_t.
Definition socket.c:195
RESOLV_RETRY_INFINITE
#define RESOLV_RETRY_INFINITE
Definition socket.h:48
OPENVPN_PORT
#define OPENVPN_PORT
Definition socket.h:42
SF_USE_IP_PKTINFO
#define SF_USE_IP_PKTINFO
Definition socket.h:210
SF_HOST_RANDOMIZE
#define SF_HOST_RANDOMIZE
Definition socket.h:213
SF_PKTINFO_COPY_IIF
#define SF_PKTINFO_COPY_IIF
Definition socket.h:217
proto2ascii
const char * proto2ascii(int proto, sa_family_t af, bool display_form)
Definition socket_util.c:409
mac_addr_safe
bool mac_addr_safe(const char *mac_addr)
Definition socket_util.c:890
proto2ascii_all
const char * proto2ascii_all(struct gc_arena *gc)
Definition socket_util.c:430
ascii2af
sa_family_t ascii2af(const char *proto_name)
Definition socket_util.c:396
ipv6_addr_safe
bool ipv6_addr_safe(const char *ipv6_text_addr)
Definition socket_util.c:837
print_in6_addr
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition socket_util.c:216
ip_or_dns_addr_safe
bool ip_or_dns_addr_safe(const char *addr, const bool allow_fqdn)
Definition socket_util.c:873
ascii2proto
int ascii2proto(const char *proto_name)
Definition socket_util.c:383
print_in_addr_t
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition socket_util.c:196
ip_addr_dotted_quad_safe
bool ip_addr_dotted_quad_safe(const char *dotted_quad)
Definition socket_util.c:787
socket_util.h
proto_is_net
static bool proto_is_net(int proto)
Definition socket_util.h:185
proto_is_udp
static bool proto_is_udp(int proto)
Returns if the protocol being used is UDP.
Definition socket_util.h:195
GETADDR_FATAL
#define GETADDR_FATAL
Definition socket_util.h:118
PROTO_NONE
@ PROTO_NONE
Definition socket_util.h:176
PROTO_UDP
@ PROTO_UDP
Definition socket_util.h:177
PROTO_TCP
@ PROTO_TCP
Definition socket_util.h:178
PROTO_TCP_CLIENT
@ PROTO_TCP_CLIENT
Definition socket_util.h:180
PROTO_TCP_SERVER
@ PROTO_TCP_SERVER
Definition socket_util.h:179
GETADDR_HOST_ORDER
#define GETADDR_HOST_ORDER
Definition socket_util.h:119
proto_is_dgram
static bool proto_is_dgram(int proto)
Return if the protocol is datagram (UDP)
Definition socket_util.h:206
GETADDR_RESOLVE
#define GETADDR_RESOLVE
Definition socket_util.h:117
IA_NET_ORDER
#define IA_NET_ORDER
Definition socket_util.h:90
ssl_set_auth_token_user
void ssl_set_auth_token_user(const char *username)
Definition ssl.c:375
ssl_set_auth_nocache
void ssl_set_auth_nocache(void)
Definition ssl.c:350
push_peer_info
static bool push_peer_info(struct buffer *buf, struct tls_multi *multi, struct tls_session *session)
Prepares the IV_ and UV_ variables that are part of the exchange to signal the peer's capabilities.
Definition ssl.c:1954
tls_version_parse
int tls_version_parse(const char *vstr, const char *extra)
Definition ssl.c:434
ssl_set_auth_token
void ssl_set_auth_token(const char *token)
Definition ssl.c:369
ssl_get_auth_nocache
bool ssl_get_auth_nocache(void)
Definition ssl.c:360
ssl.h
Control Channel SSL/Data channel negotiation module.
X509_USERNAME_FIELD_DEFAULT
#define X509_USERNAME_FIELD_DEFAULT
Definition ssl.h:120
get_ssl_library_version
const char * get_ssl_library_version(void)
return a pointer to a static memory area containing the name and version number of the SSL library in...
Definition ssl_openssl.c:2626
TLS_VER_BAD
#define TLS_VER_BAD
Parse a TLS version specifier.
Definition ssl_backend.h:103
TLS_VER_1_0
#define TLS_VER_1_0
Definition ssl_backend.h:105
EXPORT_KEY_DATA_LABEL
#define EXPORT_KEY_DATA_LABEL
Definition ssl_backend.h:383
TLS_VER_1_2
#define TLS_VER_1_2
Definition ssl_backend.h:107
TLS_VER_1_3
#define TLS_VER_1_3
Definition ssl_backend.h:108
tls_version_max
int tls_version_max(void)
Return the maximum TLS version (as a TLS_VER_x constant) supported by current SSL implementation.
Definition ssl_openssl.c:188
SSLF_TLS_VERSION_MAX_SHIFT
#define SSLF_TLS_VERSION_MAX_SHIFT
Definition ssl_common.h:431
SSLF_CLIENT_CERT_OPTIONAL
#define SSLF_CLIENT_CERT_OPTIONAL
Definition ssl_common.h:424
SSLF_AUTH_USER_PASS_OPTIONAL
#define SSLF_AUTH_USER_PASS_OPTIONAL
Definition ssl_common.h:426
SSLF_CLIENT_CERT_NOT_REQUIRED
#define SSLF_CLIENT_CERT_NOT_REQUIRED
Definition ssl_common.h:423
SSLF_CRL_VERIFY_DIR
#define SSLF_CRL_VERIFY_DIR
Definition ssl_common.h:428
SSLF_TLS_DEBUG_ENABLED
#define SSLF_TLS_DEBUG_ENABLED
Definition ssl_common.h:433
SSLF_TLS_VERSION_MAX_MASK
#define SSLF_TLS_VERSION_MAX_MASK
Definition ssl_common.h:432
SSLF_TLS_VERSION_MIN_SHIFT
#define SSLF_TLS_VERSION_MIN_SHIFT
Definition ssl_common.h:429
SSLF_TLS_VERSION_MIN_MASK
#define SSLF_TLS_VERSION_MIN_MASK
Definition ssl_common.h:430
SSLF_USERNAME_AS_COMMON_NAME
#define SSLF_USERNAME_AS_COMMON_NAME
Definition ssl_common.h:425
options_postprocess_setdefault_ncpciphers
void options_postprocess_setdefault_ncpciphers(struct options *o)
Checks for availibility of Chacha20-Poly1305 and sets the ncp_cipher to either AES-256-GCM:AES-128-GC...
Definition ssl_ncp.c:585
tls_item_in_cipher_list
bool tls_item_in_cipher_list(const char *item, const char *list)
Return true iff item is present in the colon-separated zero-terminated cipher list.
Definition ssl_ncp.c:197
append_cipher_to_ncp_list
void append_cipher_to_ncp_list(struct options *o, const char *ciphername)
Appends the cipher specified by the ciphernamer parameter to to the o->ncp_ciphers list.
Definition ssl_ncp.c:186
mutate_ncp_cipher_list
char * mutate_ncp_cipher_list(const char *list, struct gc_arena *gc)
Check whether the ciphers in the supplied list are supported.
Definition ssl_ncp.c:86
ssl_ncp.h
Control Channel SSL/Data dynamic negotiation Module This file is split from ssl.h to be able to unit ...
ssl_verify.h
Control Channel Verification Module.
OPENVPN_KU_REQUIRED
#define OPENVPN_KU_REQUIRED
Require keyUsage to be present in cert (0xFFFF is an invalid KU value)
Definition ssl_verify.h:257
VERIFY_X509_SUBJECT_DN
#define VERIFY_X509_SUBJECT_DN
Definition ssl_verify.h:69
VERIFY_X509_SUBJECT_RDN
#define VERIFY_X509_SUBJECT_RDN
Definition ssl_verify.h:70
NS_CERT_CHECK_CLIENT
#define NS_CERT_CHECK_CLIENT
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:254
VERIFY_X509_SUBJECT_RDN_PREFIX
#define VERIFY_X509_SUBJECT_RDN_PREFIX
Definition ssl_verify.h:71
NS_CERT_CHECK_SERVER
#define NS_CERT_CHECK_SERVER
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:252
x509_username_field_ext_supported
bool x509_username_field_ext_supported(const char *extname)
Return true iff the supplied extension field is supported by the –x509-username-field option.
Definition ssl_verify_openssl.c:115
x509_track_add
void x509_track_add(const struct x509_track **ll_head, const char *name, msglvl_t msglevel, struct gc_arena *gc)
Definition ssl_verify_openssl.c:444
buffer
Wrapper structure for dynamically allocated memory.
Definition buffer.h:71
buffer::data
uint8_t * data
Pointer to the allocated memory.
Definition buffer.h:78
buffer::len
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:76
compress_options
Definition comp.h:75
compress_options::flags
unsigned int flags
Definition comp.h:77
compress_options::alg
int alg
Definition comp.h:76
connection_entry
Definition options.h:109
connection_entry::local_list
struct local_list * local_list
Definition options.h:110
connection_entry::tun_mtu_max
int tun_mtu_max
Definition options.h:131
connection_entry::connect_retry_seconds
int connect_retry_seconds
Definition options.h:121
connection_entry::tls_crypt_v2_force_cookie
bool tls_crypt_v2_force_cookie
Definition options.h:181
connection_entry::link_mtu
int link_mtu
Definition options.h:136
connection_entry::link_mtu_defined
bool link_mtu_defined
Definition options.h:137
connection_entry::tun_mtu_extra
int tun_mtu_extra
Definition options.h:134
connection_entry::connect_retry_seconds_max
int connect_retry_seconds_max
Definition options.h:122
connection_entry::bind_local
bool bind_local
Definition options.h:120
connection_entry::mssfix
int mssfix
Definition options.h:146
connection_entry::tls_crypt_file
const char * tls_crypt_file
Definition options.h:172
connection_entry::tls_crypt_v2_file
const char * tls_crypt_v2_file
Definition options.h:177
connection_entry::tun_mtu_extra_defined
bool tun_mtu_extra_defined
Definition options.h:135
connection_entry::remote
const char * remote
Definition options.h:116
connection_entry::connect_timeout
int connect_timeout
Definition options.h:123
connection_entry::socks_proxy_port
const char * socks_proxy_port
Definition options.h:126
connection_entry::mssfix_default
bool mssfix_default
Definition options.h:147
connection_entry::mssfix_encap
bool mssfix_encap
Definition options.h:148
connection_entry::occ_mtu
int occ_mtu
Definition options.h:130
connection_entry::http_proxy_options
struct http_proxy_options * http_proxy_options
Definition options.h:124
connection_entry::tls_crypt_file_inline
bool tls_crypt_file_inline
Definition options.h:173
connection_entry::tls_auth_file_inline
bool tls_auth_file_inline
Definition options.h:168
connection_entry::bind_ipv6_only
bool bind_ipv6_only
Definition options.h:119
connection_entry::tun_mtu_defined
bool tun_mtu_defined
Definition options.h:133
connection_entry::remote_float
bool remote_float
Definition options.h:117
connection_entry::tls_mtu
int tls_mtu
Definition options.h:138
connection_entry::explicit_exit_notification
int explicit_exit_notification
Definition options.h:152
connection_entry::socks_proxy_authfile
const char * socks_proxy_authfile
Definition options.h:127
connection_entry::remote_port
const char * remote_port
Definition options.h:115
connection_entry::fragment_encap
bool fragment_encap
Definition options.h:144
connection_entry::socks_proxy_server
const char * socks_proxy_server
Definition options.h:125
connection_entry::fragment
int fragment
Definition options.h:143
connection_entry::mtu_discover_type
int mtu_discover_type
Definition options.h:141
connection_entry::proto
int proto
Definition options.h:111
connection_entry::af
sa_family_t af
Definition options.h:112
connection_entry::tls_auth_file
const char * tls_auth_file
Definition options.h:167
connection_entry::local_port_defined
bool local_port_defined
Definition options.h:114
connection_entry::tun_mtu
int tun_mtu
Definition options.h:129
connection_entry::bind_defined
bool bind_defined
Definition options.h:118
connection_entry::local_port
const char * local_port
Definition options.h:113
connection_entry::key_direction
int key_direction
Definition options.h:169
connection_entry::tls_crypt_v2_file_inline
bool tls_crypt_v2_file_inline
Definition options.h:178
connection_entry::flags
unsigned int flags
Definition options.h:164
connection_entry::mssfix_fixed
bool mssfix_fixed
Definition options.h:150
connection_list
Definition options.h:202
connection_list::array
struct connection_entry ** array
Definition options.h:206
connection_list::capacity
int capacity
Definition options.h:203
connection_list::len
int len
Definition options.h:204
context_1::route_list
struct route_list * route_list
List of routing information.
Definition openvpn.h:178
context_1::route_ipv6_list
struct route_ipv6_list * route_ipv6_list
Definition openvpn.h:183
context_1::tuntap
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition openvpn.h:173
context
Contains all state information for one tunnel.
Definition openvpn.h:471
context::net_ctx
openvpn_net_ctx_t net_ctx
Networking API opaque context.
Definition openvpn.h:498
context::options
struct options options
Options loaded from command line or configuration file.
Definition openvpn.h:472
context::c1
struct context_1 c1
Level 1 context.
Definition openvpn.h:513
dhcp_options
Definition dns.h:100
dhcp_options::dns
in_addr_t dns[N_DHCP_ADDR]
Definition dns.h:101
dhcp
Definition dhcp.h:62
dns_domain
Definition dns.h:54
dns_domain::next
struct dns_domain * next
Definition dns.h:55
dns_domain::name
const char * name
Definition dns.h:56
dns_options
Definition dns.h:113
dns_options::servers
struct dns_server * servers
Definition dns.h:117
dns_options::updown
const char * updown
Definition dns.h:119
dns_options::from_dhcp
struct dhcp_options from_dhcp
Definition dns.h:114
dns_options::gc
struct gc_arena gc
Definition dns.h:118
dns_options::updown_flags
enum dns_updown_flags updown_flags
Definition dns.h:120
dns_options::search_domains
struct dns_domain * search_domains
Definition dns.h:115
dns_server_addr::a4
struct in_addr a4
Definition dns.h:63
dns_server_addr::in
union dns_server_addr::@0 in
dns_server_addr::family
sa_family_t family
Definition dns.h:66
dns_server_addr::a6
struct in6_addr a6
Definition dns.h:64
dns_server_addr::port
in_port_t port
Definition dns.h:67
dns_server
Definition dns.h:71
dns_server::addr
struct dns_server_addr addr[8]
Definition dns.h:75
dns_server::dnssec
enum dns_security dnssec
Definition dns.h:77
dns_server::next
struct dns_server * next
Definition dns.h:72
dns_server::priority
long priority
Definition dns.h:73
dns_server::addr_count
size_t addr_count
Definition dns.h:74
dns_server::domains
struct dns_domain * domains
Definition dns.h:76
dns_server::transport
enum dns_server_transport transport
Definition dns.h:78
dns_server::sni
const char * sni
Definition dns.h:79
env_item
Definition env_set.h:37
env_item::string
char * string
Definition env_set.h:38
env_item::next
struct env_item * next
Definition env_set.h:39
env_set
Definition env_set.h:43
env_set::list
struct env_item * list
Definition env_set.h:45
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:127
hash
Definition list.h:56
http_custom_header
Definition proxy.h:38
http_custom_header::name
const char * name
Definition proxy.h:39
http_custom_header::content
const char * content
Definition proxy.h:40
http_proxy_options
Definition proxy.h:45
http_proxy_options::auth_file
const char * auth_file
Definition proxy.h:55
http_proxy_options::http_version
const char * http_version
Definition proxy.h:57
http_proxy_options::port
const char * port
Definition proxy.h:47
http_proxy_options::inline_creds
bool inline_creds
Definition proxy.h:60
http_proxy_options::user_agent
const char * user_agent
Definition proxy.h:58
http_proxy_options::auth_retry
int auth_retry
Definition proxy.h:52
http_proxy_options::auth_method_string
const char * auth_method_string
Definition proxy.h:54
http_proxy_options::nocache
bool nocache
Definition proxy.h:63
http_proxy_options::custom_headers
struct http_custom_header custom_headers[MAX_CUSTOM_HTTP_HEADER]
Definition proxy.h:59
http_proxy_options::auth_file_up
const char * auth_file_up
Definition proxy.h:56
http_proxy_options::server
const char * server
Definition proxy.h:46
iroute_ipv6
Definition route.h:268
iroute_ipv6::next
struct iroute_ipv6 * next
Definition route.h:271
iroute_ipv6::netbits
unsigned int netbits
Definition route.h:270
iroute_ipv6::network
struct in6_addr network
Definition route.h:269
iroute::network
in_addr_t network
Definition route.h:262
iroute::netbits
int netbits
Definition route.h:263
iroute::next
struct iroute * next
Definition route.h:264
local_entry
Definition options.h:102
local_entry::port
const char * port
Definition options.h:104
local_entry::proto
int proto
Definition options.h:105
local_entry::local
const char * local
Definition options.h:103
local_list
Definition options.h:195
local_list::array
struct local_entry ** array
Definition options.h:198
local_list::len
int len
Definition options.h:197
local_list::capacity
int capacity
Definition options.h:196
options_pre_connect
Definition options.h:65
options_pre_connect::tuntap_options
struct tuntap_options tuntap_options
Definition options.h:67
options_pre_connect::routes_defined
bool routes_defined
Definition options.h:72
options_pre_connect::ping_rec_timeout_action
int ping_rec_timeout_action
Definition options.h:91
options_pre_connect::foreign_option_index
int foreign_option_index
Definition options.h:93
options_pre_connect::tuntap_options_defined
bool tuntap_options_defined
Definition options.h:66
options_pre_connect::routes_ipv6_defined
bool routes_ipv6_defined
Definition options.h:75
options_pre_connect::ping_rec_timeout
int ping_rec_timeout
Definition options.h:90
options_pre_connect::routes
struct route_option_list * routes
Definition options.h:73
options_pre_connect::comp
struct compress_options comp
Definition options.h:94
options_pre_connect::ciphername
const char * ciphername
Definition options.h:86
options_pre_connect::ifconfig_local
const char * ifconfig_local
Definition options.h:69
options_pre_connect::dns_options
struct dns_options dns_options
Definition options.h:84
options_pre_connect::route_default_gateway
const char * route_default_gateway
Definition options.h:78
options_pre_connect::ping_send_timeout
int ping_send_timeout
Definition options.h:89
options_pre_connect::ifconfig_ipv6_local
const char * ifconfig_ipv6_local
Definition options.h:70
options_pre_connect::authname
const char * authname
Definition options.h:87
options_pre_connect::routes_ipv6
struct route_ipv6_option_list * routes_ipv6
Definition options.h:76
options_pre_connect::client_nat_defined
bool client_nat_defined
Definition options.h:81
options_pre_connect::client_nat
struct client_nat_option_list * client_nat
Definition options.h:82
options_pre_connect::route_ipv6_default_gateway
const char * route_ipv6_default_gateway
Definition options.h:79
options::resolve_retry_seconds
int resolve_retry_seconds
Definition options.h:367
options::rcvbuf
int rcvbuf
Definition options.h:413
options::resolve_in_advance
bool resolve_in_advance
Definition options.h:368
options::route_nopull
bool route_nopull
Definition options.h:437
options::genkey_extra_data
const char * genkey_extra_data
Definition options.h:290
options::comp
struct compress_options comp
Definition options.h:410
options::http_proxy_override
struct http_proxy_options * http_proxy_override
Definition options.h:313
options::push_ifconfig_ipv6_netbits
int push_ifconfig_ipv6_netbits
Definition options.h:523
options::proto_force
int proto_force
Definition options.h:336
options::persist_config
bool persist_config
Definition options.h:278
options::connection_list
struct connection_list * connection_list
Definition options.h:295
options::management_port
const char * management_port
Definition options.h:447
options::tls_crypt_file_inline
bool tls_crypt_file_inline
Definition options.h:665
options::ifconfig_ipv6_remote
const char * ifconfig_ipv6_remote
Definition options.h:331
options::max_routes_per_client
int max_routes_per_client
Definition options.h:536
options::ncp_ciphers_conf
const char * ncp_ciphers_conf
The original ncp_ciphers specified by the user in the configuration.
Definition options.h:579
options::status_file_version
int status_file_version
Definition options.h:407
options::vlan_accept
enum vlan_acceptable_frames vlan_accept
Definition options.h:713
options::auth_token_renewal
int auth_token_renewal
Definition options.h:545
options::push_ifconfig_constraint_network
in_addr_t push_ifconfig_constraint_network
Definition options.h:518
options::tmp_dir
const char * tmp_dir
Definition options.h:466
options::push_peer_info
bool push_peer_info
Definition options.h:681
options::daemon
bool daemon
Definition options.h:391
options::pre_connect
struct options_pre_connect * pre_connect
Definition options.h:563
options::route_default_metric
int route_default_metric
Definition options.h:429
options::renegotiate_seconds_min
int renegotiate_seconds_min
Definition options.h:647
options::auth_token_secret_file
const char * auth_token_secret_file
Definition options.h:546
options::imported_protocol_flags
unsigned int imported_protocol_flags
Definition options.h:723
options::tls_export_peer_cert_dir
const char * tls_export_peer_cert_dir
Definition options.h:612
options::crl_file_inline
bool crl_file_inline
Definition options.h:616
options::cryptoapi_cert
const char * cryptoapi_cert
Definition options.h:638
options::down_script
const char * down_script
Definition options.h:386
options::backwards_compatible
unsigned int backwards_compatible
What version we should try to be compatible with as major * 10000 + minor * 100 + patch,...
Definition options.h:272
options::verify_hash_algo
hash_algo_type verify_hash_algo
Definition options.h:622
options::scheduled_exit_interval
int scheduled_exit_interval
Definition options.h:565
options::stale_routes_ageing_time
int stale_routes_ageing_time
Definition options.h:538
options::pkcs12_file_inline
bool pkcs12_file_inline
Definition options.h:605
options::replay_time
int replay_time
Definition options.h:586
options::management_state_buffer_size
int management_state_buffer_size
Definition options.h:451
options::ca_file
const char * ca_file
Definition options.h:593
options::tls_auth_file
const char * tls_auth_file
Definition options.h:660
options::providers
struct provider_list providers
Definition options.h:583
options::duplicate_cn
bool duplicate_cn
Definition options.h:527
options::server_network_ipv6
struct in6_addr server_network_ipv6
Definition options.h:471
options::shaper
int shaper
Definition options.h:334
options::management_echo_buffer_size
int management_echo_buffer_size
Definition options.h:450
options::server_network
in_addr_t server_network
Definition options.h:468
options::real_hash_size
uint32_t real_hash_size
Definition options.h:499
options::show_net_up
bool show_net_up
Definition options.h:694
options::verify_hash_no_ca
bool verify_hash_no_ca
Definition options.h:624
options::allow_pull_fqdn
bool allow_pull_fqdn
Definition options.h:439
options::use_peer_id
bool use_peer_id
Whether the data channel uses the DATA_V2 header (peer-id).
Definition options.h:703
options::remote_cert_ku
unsigned remote_cert_ku[MAX_PARMS]
Definition options.h:619
options::server_bridge_defined
bool server_bridge_defined
Definition options.h:481
options::keying_material_exporter_label
const char * keying_material_exporter_label
Definition options.h:707
options::status_file
const char * status_file
Definition options.h:406
options::ssl_flags
unsigned int ssl_flags
Definition options.h:625
options::route_noexec
bool route_noexec
Definition options.h:430
options::ifconfig_nowarn
bool ifconfig_nowarn
Definition options.h:333
options::remote_cert_eku
const char * remote_cert_eku
Definition options.h:620
options::ifconfig_pool_netmask
in_addr_t ifconfig_pool_netmask
Definition options.h:491
options::server_netmask
in_addr_t server_netmask
Definition options.h:469
options::tls_timeout
int tls_timeout
Definition options.h:641
options::test_crypto
bool test_crypto
Definition options.h:588
options::up_delay
bool up_delay
Definition options.h:389
options::server_bridge_proxy_dhcp
bool server_bridge_proxy_dhcp
Definition options.h:479
options::allow_recursive_routing
bool allow_recursive_routing
Definition options.h:720
options::authname
const char * authname
Definition options.h:581
options::exit_event_name
const char * exit_event_name
Definition options.h:692
options::ifconfig_ipv6_local
const char * ifconfig_ipv6_local
Definition options.h:329
options::cf_max
int cf_max
Definition options.h:529
options::dh_file_inline
bool dh_file_inline
Definition options.h:597
options::replay_window
int replay_window
Definition options.h:585
options::disable
bool disable
Definition options.h:507
options::mute
int mute
Definition options.h:400
options::auth_user_pass_verify_script_via_file
bool auth_user_pass_verify_script_via_file
Definition options.h:541
options::dev_type
const char * dev_type
Definition options.h:323
options::persist_mode
int persist_mode
Definition options.h:279
options::ifconfig_pool_persist_refresh_freq
int ifconfig_pool_persist_refresh_freq
Definition options.h:493
options::show_digests
bool show_digests
Definition options.h:283
options::up_script
const char * up_script
Definition options.h:385
options::push_option_types_found
uint64_t push_option_types_found
Definition options.h:558
options::single_session
bool single_session
Definition options.h:679
options::push_ifconfig_defined
bool push_ifconfig_defined
Definition options.h:513
options::ifconfig_pool_defined
bool ifconfig_pool_defined
Definition options.h:488
options::verify_hash_depth
int verify_hash_depth
Definition options.h:623
options::route_delay_defined
bool route_delay_defined
Definition options.h:433
options::packet_id_file
const char * packet_id_file
Definition options.h:587
options::tls_crypt_v2_file
const char * tls_crypt_v2_file
Definition options.h:669
options::management_log_history_cache
int management_log_history_cache
Definition options.h:449
options::server_bridge_netmask
in_addr_t server_bridge_netmask
Definition options.h:483
options::ip_remote_hint
const char * ip_remote_hint
Definition options.h:369
options::vlan_tagging
bool vlan_tagging
Definition options.h:712
options::peer_id
uint32_t peer_id
Definition options.h:704
options::routes
struct route_option_list * routes
Definition options.h:434
options::ifconfig_pool_end
in_addr_t ifconfig_pool_end
Definition options.h:490
options::keepalive_timeout
int keepalive_timeout
Definition options.h:343
options::writepid
const char * writepid
Definition options.h:384
options::inactivity_minimum_bytes
int64_t inactivity_minimum_bytes
Definition options.h:346
options::ifconfig_ipv6_pool_defined
bool ifconfig_ipv6_pool_defined
Definition options.h:495
options::server_flags
unsigned int server_flags
Definition options.h:477
options::max_clients
uint32_t max_clients
Definition options.h:535
options::block_outside_dns
bool block_outside_dns
Definition options.h:696
options::push_ifconfig_ipv6_blocked
bool push_ifconfig_ipv6_blocked
Definition options.h:525
options::tls_exit
bool tls_exit
Definition options.h:683
options::pkcs12_file
const char * pkcs12_file
Definition options.h:604
options::client_disconnect_script
const char * client_disconnect_script
Definition options.h:502
options::show_engines
bool show_engines
Definition options.h:284
options::remote_list
struct remote_list * remote_list
Definition options.h:297
options::msg_channel
HANDLE msg_channel
Definition options.h:691
options::key_pass_file
const char * key_pass_file
Definition options.h:281
options::mute_replay_warnings
bool mute_replay_warnings
Definition options.h:584
options::tls_crypt_file
const char * tls_crypt_file
Definition options.h:664
options::inactivity_timeout
int inactivity_timeout
Definition options.h:345
options::n_bcast_buf
int n_bcast_buf
Definition options.h:509
options::handshake_window
int handshake_window
Definition options.h:651
options::server_defined
bool server_defined
Definition options.h:467
options::ifconfig_local
const char * ifconfig_local
Definition options.h:327
options::x509_username_field
char * x509_username_field[MAX_PARMS]
Definition options.h:654
options::ce
struct connection_entry ce
Definition options.h:294
options::iroutes_ipv6
struct iroute_ipv6 * iroutes_ipv6
Definition options.h:512
options::push_list
struct push_list push_list
Definition options.h:487
options::user_script_used
bool user_script_used
Definition options.h:387
options::tls_groups
const char * tls_groups
Definition options.h:608
options::show_tls_ciphers
bool show_tls_ciphers
Definition options.h:285
options::tuntap_options
struct tuntap_options tuntap_options
Definition options.h:371
options::route_method
int route_method
Definition options.h:695
options::verify_hash
struct verify_hash_list * verify_hash
Definition options.h:621
options::tls_cert_profile
const char * tls_cert_profile
Definition options.h:609
options::renegotiate_packets
int64_t renegotiate_packets
Definition options.h:645
options::management_flags
unsigned int management_flags
Definition options.h:459
options::push_continuation
int push_continuation
Definition options.h:557
options::route_default_gateway
const char * route_default_gateway
Definition options.h:426
options::push_ifconfig_local_alias
in_addr_t push_ifconfig_local_alias
Definition options.h:516
options::dns_options
struct dns_options dns_options
Definition options.h:318
options::exit_event_initial_state
bool exit_event_initial_state
Definition options.h:693
options::sc_info
struct static_challenge_info sc_info
Definition options.h:568
options::auth_token_call_auth
bool auth_token_call_auth
Definition options.h:543
options::ipchange
const char * ipchange
Definition options.h:321
options::topology
int topology
Definition options.h:326
options::disable_dco
bool disable_dco
Definition options.h:374
options::ncp_ciphers
const char * ncp_ciphers
Definition options.h:580
options::genkey
bool genkey
Definition options.h:287
options::virtual_hash_size
uint32_t virtual_hash_size
Definition options.h:500
options::learn_address_script
const char * learn_address_script
Definition options.h:503
options::ciphername
const char * ciphername
Definition options.h:575
options::auth_user_pass_file
const char * auth_user_pass_file
Definition options.h:560
options::tls_crypt_v2_max_age
int tls_crypt_v2_max_age
Definition options.h:676
options::forward_compatible
bool forward_compatible
Definition options.h:269
options::username
const char * username
Definition options.h:377
options::cf_initial_max
int cf_initial_max
Definition options.h:532
options::stale_routes_check_interval
int stale_routes_check_interval
Definition options.h:537
options::plugin_list
struct plugin_option_list * plugin_list
Definition options.h:462
options::auth_token_lifetime
int auth_token_lifetime
Definition options.h:544
options::vlan_pvid
uint16_t vlan_pvid
Definition options.h:714
options::ns_cert_type
int ns_cert_type
Definition options.h:618
options::tls_crypt_v2_verify_script
const char * tls_crypt_v2_verify_script
Definition options.h:674
options::mode
int mode
Definition options.h:266
options::tls_server
bool tls_server
Definition options.h:591
options::auth_user_pass_verify_script
const char * auth_user_pass_verify_script
Definition options.h:540
options::connect_retry_max
int connect_retry_max
Definition options.h:293
options::bind_dev
char * bind_dev
Definition options.h:418
options::extra_certs_file
const char * extra_certs_file
Definition options.h:600
options::client
bool client
Definition options.h:555
options::pull
bool pull
Definition options.h:556
options::ifconfig_ipv6_pool_netbits
int ifconfig_ipv6_pool_netbits
Definition options.h:497
options::push_ifconfig_constraint_netmask
in_addr_t push_ifconfig_constraint_netmask
Definition options.h:519
options::show_curves
bool show_curves
Definition options.h:286
options::route_ipv6_default_gateway
const char * route_ipv6_default_gateway
Definition options.h:427
options::tls_client
bool tls_client
Definition options.h:592
options::ping_timer_remote
bool ping_timer_remote
Definition options.h:352
options::auth_token_generate
bool auth_token_generate
Definition options.h:542
options::priv_key_file_inline
bool priv_key_file_inline
Definition options.h:603
options::tls_verify
const char * tls_verify
Definition options.h:611
options::crl_file
const char * crl_file
Definition options.h:615
options::ping_rec_timeout_action
int ping_rec_timeout_action
Definition options.h:357
options::auth_user_pass_file_inline
bool auth_user_pass_file_inline
Definition options.h:561
options::show_ciphers
bool show_ciphers
Definition options.h:282
options::enable_ncp_fallback
bool enable_ncp_fallback
If defined fall back to ciphername if NCP fails.
Definition options.h:576
options::route_predown_script
const char * route_predown_script
Definition options.h:425
options::dh_file
const char * dh_file
Definition options.h:596
options::route_delay_window
int route_delay_window
Definition options.h:432
options::push_ifconfig_local
in_addr_t push_ifconfig_local
Definition options.h:514
options::mlock
bool mlock
Definition options.h:340
options::ignore_unknown_option
const char ** ignore_unknown_option
Definition options.h:275
options::sndbuf
int sndbuf
Definition options.h:414
options::foreign_option_index
int foreign_option_index
Definition options.h:688
options::gc
struct gc_arena gc
Definition options.h:258
options::down_pre
bool down_pre
Definition options.h:388
options::persist_tun
bool persist_tun
Definition options.h:359
options::route_default_table_id
int route_default_table_id
Definition options.h:428
options::ca_file_inline
bool ca_file_inline
Definition options.h:594
options::auth_token_secret_file_inline
bool auth_token_secret_file_inline
Definition options.h:547
options::block_ipv6
bool block_ipv6
Definition options.h:436
options::config
const char * config
Definition options.h:261
options::extra_certs_file_inline
bool extra_certs_file_inline
Definition options.h:601
options::push_ifconfig_constraint_defined
bool push_ifconfig_constraint_defined
Definition options.h:517
options::mark
int mark
Definition options.h:417
options::cf_initial_per
int cf_initial_per
Definition options.h:533
options::keying_material_exporter_length
int keying_material_exporter_length
Definition options.h:708
options::suppress_timestamps
bool suppress_timestamps
Definition options.h:396
options::force_key_material_export
bool force_key_material_export
Definition options.h:710
options::mtu_test
bool mtu_test
Definition options.h:338
options::iroutes
struct iroute * iroutes
Definition options.h:511
options::verify_x509_type
int verify_x509_type
Definition options.h:613
options::cipher_list_tls13
const char * cipher_list_tls13
Definition options.h:607
options::ecdh_curve
const char * ecdh_curve
Definition options.h:610
options::status_file_update_freq
int status_file_update_freq
Definition options.h:408
options::management_client_user
const char * management_client_user
Definition options.h:453
options::cipher_list
const char * cipher_list
Definition options.h:606
options::ccd_exclusive
bool ccd_exclusive
Definition options.h:506
options::allow_deprecated_insecure_static_crypto
bool allow_deprecated_insecure_static_crypto
Definition options.h:573
options::pull_filter_list
struct pull_filter_list * pull_filter_list
Definition options.h:716
options::management_certificate
const char * management_certificate
Definition options.h:456
options::genkey_filename
const char * genkey_filename
Definition options.h:289
options::x509_track
const struct x509_track * x509_track
Definition options.h:685
options::chroot_dir
const char * chroot_dir
Definition options.h:379
options::auth_user_pass_username_only
bool auth_user_pass_username_only
Definition options.h:562
options::log
bool log
Definition options.h:395
options::shared_secret_file_inline
bool shared_secret_file_inline
Definition options.h:572
options::push_ifconfig_ipv6_remote
struct in6_addr push_ifconfig_ipv6_remote
Definition options.h:524
options::ca_path
const char * ca_path
Definition options.h:595
options::renegotiate_seconds
int renegotiate_seconds
Definition options.h:646
options::ping_rec_timeout
int ping_rec_timeout
Definition options.h:351
options::sockflags
unsigned int sockflags
Definition options.h:421
options::engine
const char * engine
Definition options.h:582
options::management_addr
const char * management_addr
Definition options.h:446
options::client_connect_script
const char * client_connect_script
Definition options.h:501
options::verify_x509_name
const char * verify_x509_name
Definition options.h:614
options::ping_send_timeout
int ping_send_timeout
Definition options.h:350
options::route_gateway_via_dhcp
bool route_gateway_via_dhcp
Definition options.h:438
options::remote_random
bool remote_random
Definition options.h:320
options::push_ifconfig_ipv6_defined
bool push_ifconfig_ipv6_defined
Definition options.h:521
options::tcp_queue_limit
int tcp_queue_limit
Definition options.h:510
options::route_delay
int route_delay
Definition options.h:431
options::dev_node
const char * dev_node
Definition options.h:324
options::override_username
const char * override_username
Definition options.h:508
options::client_crresponse_script
const char * client_crresponse_script
Definition options.h:504
options::routes_ipv6
struct route_ipv6_option_list * routes_ipv6
Definition options.h:435
options::machine_readable_output
bool machine_readable_output
Definition options.h:397
options::key_direction
int key_direction
Definition options.h:574
options::server_ipv6_defined
bool server_ipv6_defined
Definition options.h:470
options::priv_key_file
const char * priv_key_file
Definition options.h:602
options::persist_remote_ip
bool persist_remote_ip
Definition options.h:361
options::up_restart
bool up_restart
Definition options.h:390
options::keepalive_ping
int keepalive_ping
Definition options.h:342
options::tls_auth_file_inline
bool tls_auth_file_inline
Definition options.h:661
options::tls_crypt_v2_file_inline
bool tls_crypt_v2_file_inline
Definition options.h:670
options::groupname
const char * groupname
Definition options.h:378
options::server_bridge_pool_start
in_addr_t server_bridge_pool_start
Definition options.h:484
options::cd_dir
const char * cd_dir
Definition options.h:380
options::client_nat
struct client_nat_option_list * client_nat
Definition options.h:440
options::push_ifconfig_ipv6_local
struct in6_addr push_ifconfig_ipv6_local
Definition options.h:522
options::nice
int nice
Definition options.h:398
options::push_update_options_found
uint64_t push_update_options_found
Definition options.h:559
options::transition_window
int transition_window
Definition options.h:657
options::ifconfig_remote_netmask
const char * ifconfig_remote_netmask
Definition options.h:328
options::lladdr
const char * lladdr
Definition options.h:325
options::verbosity
int verbosity
Definition options.h:399
options::session_timeout
int session_timeout
Definition options.h:348
options::cert_file
const char * cert_file
Definition options.h:598
options::enable_c2c
bool enable_c2c
Definition options.h:526
options::server_bridge_pool_end
in_addr_t server_bridge_pool_end
Definition options.h:485
options::cf_per
int cf_per
Definition options.h:530
options::windows_driver
enum tun_driver_type windows_driver
Definition options.h:697
options::cert_file_inline
bool cert_file_inline
Definition options.h:599
options::remap_sigusr1
int remap_sigusr1
Definition options.h:393
options::renegotiate_bytes
int64_t renegotiate_bytes
Definition options.h:644
options::route_script
const char * route_script
Definition options.h:424
options::ifconfig_pool_start
in_addr_t ifconfig_pool_start
Definition options.h:489
options::management_user_pass
const char * management_user_pass
Definition options.h:448
options::server_netbits_ipv6
unsigned int server_netbits_ipv6
Definition options.h:472
options::push_ifconfig_remote_netmask
in_addr_t push_ifconfig_remote_netmask
Definition options.h:515
options::occ
bool occ
Definition options.h:443
options::server_bridge_ip
in_addr_t server_bridge_ip
Definition options.h:482
options::shared_secret_file
const char * shared_secret_file
Definition options.h:571
options::ifconfig_noexec
bool ifconfig_noexec
Definition options.h:332
options::dev
const char * dev
Definition options.h:322
options::management_client_group
const char * management_client_group
Definition options.h:454
options::ifconfig_ipv6_pool_base
struct in6_addr ifconfig_ipv6_pool_base
Definition options.h:496
options::client_config_dir
const char * client_config_dir
Definition options.h:505
options::genkey_type
enum genkey_type genkey_type
Definition options.h:288
options::ifconfig_pool_persist_filename
const char * ifconfig_pool_persist_filename
Definition options.h:492
options::ifconfig_ipv6_netbits
int ifconfig_ipv6_netbits
Definition options.h:330
options::persist_local_ip
bool persist_local_ip
Definition options.h:360
provider_list::names
const char * names[MAX_PARMS]
Definition options.h:219
pull_filter_list
Definition options.h:810
pull_filter_list::tail
struct pull_filter * tail
Definition options.h:812
pull_filter_list::head
struct pull_filter * head
Definition options.h:811
pull_filter
Definition options.h:798
pull_filter::type
int type
Definition options.h:803
pull_filter::next
struct pull_filter * next
Definition options.h:806
pull_filter::pattern
char * pattern
Definition options.h:805
pull_filter::size
size_t size
Definition options.h:804
push_list::head
struct push_entry * head
Definition pushlist.h:37
remote_entry
Definition options.h:185
remote_entry::proto
int proto
Definition options.h:188
remote_entry::remote
const char * remote
Definition options.h:186
remote_entry::remote_port
const char * remote_port
Definition options.h:187
remote_entry::af
sa_family_t af
Definition options.h:189
remote_list
Definition options.h:210
remote_list::len
int len
Definition options.h:212
remote_list::array
struct remote_entry ** array
Definition options.h:213
remote_list::capacity
int capacity
Definition options.h:211
route_gateway_info
Definition route.h:158
route_ipv6_gateway_info
Definition route.h:195
route_ipv6_option_list::flags
unsigned int flags
Definition route.h:113
route_option_list::flags
unsigned int flags
Definition route.h:97
static_challenge_info::flags
unsigned int flags
Definition misc.h:96
static_challenge_info::challenge_text
const char * challenge_text
Definition misc.h:98
tuntap_options
Definition tun.h:73
tuntap_options::dns6
struct in6_addr dns6[N_DHCP_ADDR]
Definition tun.h:140
tuntap_options::nbdd
in_addr_t nbdd[N_DHCP_ADDR]
Definition tun.h:123
tuntap_options::dns6_len
unsigned int dns6_len
Definition tun.h:141
tuntap_options::ntp
in_addr_t ntp[N_DHCP_ADDR]
Definition tun.h:119
tuntap_options::ntp_len
unsigned int ntp_len
Definition tun.h:120
tuntap_options::wins
in_addr_t wins[N_DHCP_ADDR]
Definition tun.h:115
tuntap_options::tap_sleep
int tap_sleep
Definition tun.h:95
tuntap_options::netbios_node_type
uint8_t netbios_node_type
Definition tun.h:105
tuntap_options::dns_len
unsigned int dns_len
Definition tun.h:112
tuntap_options::dhcp_lease_time
int dhcp_lease_time
Definition tun.h:92
tuntap_options::dns
in_addr_t dns[N_DHCP_ADDR]
Definition tun.h:111
tuntap_options::netbios_scope
const char * netbios_scope
Definition tun.h:103
tuntap_options::ip_win32_defined
bool ip_win32_defined
Definition tun.h:75
tuntap_options::domain_search_list_len
unsigned int domain_search_list_len
Definition tun.h:130
tuntap_options::dhcp_masq_custom_offset
bool dhcp_masq_custom_offset
Definition tun.h:90
tuntap_options::domain
const char * domain
Definition tun.h:101
tuntap_options::dhcp_renew
bool dhcp_renew
Definition tun.h:135
tuntap_options::domain_search_list
const char * domain_search_list[N_SEARCH_LIST_LEN]
Definition tun.h:129
tuntap_options::dhcp_masq_offset
int dhcp_masq_offset
Definition tun.h:91
tuntap_options::ip_win32_type
int ip_win32_type
Definition tun.h:83
tuntap_options::nbdd_len
unsigned int nbdd_len
Definition tun.h:124
tuntap_options::dhcp_pre_release
bool dhcp_pre_release
Definition tun.h:136
tuntap_options::register_dns
bool register_dns
Definition tun.h:138
tuntap_options::disable_nbt
bool disable_nbt
Definition tun.h:133
tuntap_options::wins_len
unsigned int wins_len
Definition tun.h:116
tuntap_options::dhcp_options
int dhcp_options
Definition tun.h:99
verify_hash_list
Definition options.h:248
verify_hash_list::next
struct verify_hash_list * next
Definition options.h:252
verify_hash_list::hash
uint8_t hash[SHA256_DIGEST_LENGTH]
Definition options.h:251
SIGHUP
#define SIGHUP
Definition syshead.h:55
sa_family_t
unsigned short sa_family_t
Definition syshead.h:409
SIGTERM
#define SIGTERM
Definition syshead.h:59
sleep
#define sleep(x)
Definition syshead.h:42
in_addr_t
uint32_t in_addr_t
Definition syshead.h:52
pkcs11_id_management
static bool pkcs11_id_management
Definition test_pkcs11.c:135
gc
struct gc_arena gc
Definition test_ssl.c:122
ipconfig_register_dns
void ipconfig_register_dns(const struct env_set *es)
Definition tun.c:4880
dev_type_enum
int dev_type_enum(const char *dev, const char *dev_type)
Definition tun.c:521
show_tap_win_adapters
void show_tap_win_adapters(msglvl_t msglevel, msglvl_t warnlevel)
Definition tun.c:3806
dhcp_renew_by_adapter_index
bool dhcp_renew_by_adapter_index(const DWORD adapter_index)
Definition tun.c:4813
ascii2ipset
int ascii2ipset(const char *name)
Definition tun.c:6237
dhcp_release_by_adapter_index
bool dhcp_release_by_adapter_index(const DWORD adapter_index)
Definition tun.c:4772
tap_allow_nonadmin_access
void tap_allow_nonadmin_access(const char *dev_node)
Definition tun.c:4692
show_adapters
void show_adapters(msglvl_t msglevel)
Definition tun.c:4643
ipset2ascii_all
const char * ipset2ascii_all(struct gc_arena *gc)
Definition tun.c:6266
show_valid_win32_tun_subnets
void show_valid_win32_tun_subnets(void)
Definition tun.c:3773
print_tun_backend_driver
const char * print_tun_backend_driver(enum tun_driver_type driver)
Return a string representation of the tun backed driver type.
Definition tun.c:59
IPW32_SET_NETSH
#define IPW32_SET_NETSH
Definition tun.h:78
IPW32_SET_ADAPTIVE
#define IPW32_SET_ADAPTIVE
Definition tun.h:81
DHCP_OPTIONS_DHCP_REQUIRED
#define DHCP_OPTIONS_DHCP_REQUIRED
Definition tun.h:70
N_SEARCH_LIST_LEN
#define N_SEARCH_LIST_LEN
Definition tun.h:126
IPW32_SET_DHCP_MASQ
#define IPW32_SET_DHCP_MASQ
Definition tun.h:80
IPW32_SET_MANUAL
#define IPW32_SET_MANUAL
Definition tun.h:77
WINDOWS_DRIVER_UNSPECIFIED
@ WINDOWS_DRIVER_UNSPECIFIED
Definition tun.h:45
WINDOWS_DRIVER_TAP_WINDOWS6
@ WINDOWS_DRIVER_TAP_WINDOWS6
Definition tun.h:46
DRIVER_DCO
@ DRIVER_DCO
Definition tun.h:53
IPW32_SET_ADAPTIVE_DELAY_WINDOW
#define IPW32_SET_ADAPTIVE_DELAY_WINDOW
Definition tun.h:65
N_DHCP_ADDR
#define N_DHCP_ADDR
Definition tun.h:108
DHCP_OPTIONS_DHCP_OPTIONAL
#define DHCP_OPTIONS_DHCP_OPTIONAL
Definition tun.h:69
tun_afunix.h
is_tun_afunix
static bool is_tun_afunix(const char *devnode)
Checks whether a –dev-node parameter specifies a AF_UNIX device.
Definition tun_afunix.h:61
set_win_sys_path
void set_win_sys_path(const char *newpath, struct env_set *es)
Definition win32.c:1162
win32_version_string
const char * win32_version_string(struct gc_arena *gc)
Get Windows version string with architecture info.
Definition win32.c:1428
set_pause_exit_win32
void set_pause_exit_win32(void)
Definition win32.c:146
xkey_common.h
Generated by doxygen 1.9.8